From owner-svn-src-stable@freebsd.org Thu Jun 1 14:58:27 2017 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E2AA7AFEC05; Thu, 1 Jun 2017 14:58:27 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id BE3517D29E; Thu, 1 Jun 2017 14:58:27 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v51EwQpq082896; Thu, 1 Jun 2017 14:58:26 GMT (envelope-from tuexen@FreeBSD.org) Received: (from tuexen@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v51EwQ3v082894; Thu, 1 Jun 2017 14:58:26 GMT (envelope-from tuexen@FreeBSD.org) Message-Id: <201706011458.v51EwQ3v082894@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: tuexen set sender to tuexen@FreeBSD.org using -f From: Michael Tuexen Date: Thu, 1 Jun 2017 14:58:26 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r319431 - in stable/11/sys/netinet: . tcp_stacks X-SVN-Group: stable-11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Jun 2017 14:58:28 -0000 Author: tuexen Date: Thu Jun 1 14:58:26 2017 New Revision: 319431 URL: https://svnweb.freebsd.org/changeset/base/319431 Log: When a SYN-ACK is received in SYN-SENT state, RFC 793 requires the validation of SEG.ACK as the first step. If the ACK is not acceptable, a RST segment should be sent and the segment should be dropped. Up to now, the segment was partially processed. This patch moves the check for the SEG.ACK validation up to the front as required. Reviewed by: hiren, gnn Differential Revision: https://reviews.freebsd.org/D10424 Modified: stable/11/sys/netinet/tcp_input.c stable/11/sys/netinet/tcp_stacks/fastpath.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/netinet/tcp_input.c ============================================================================== --- stable/11/sys/netinet/tcp_input.c Thu Jun 1 14:49:53 2017 (r319430) +++ stable/11/sys/netinet/tcp_input.c Thu Jun 1 14:58:26 2017 (r319431) @@ -1607,6 +1607,16 @@ tcp_do_segment(struct mbuf *m, struct tcphdr *th, stru } /* + * If a segment with the ACK-bit set arrives in the SYN-SENT state + * check SEQ.ACK first. + */ + if ((tp->t_state == TCPS_SYN_SENT) && (thflags & TH_ACK) && + (SEQ_LEQ(th->th_ack, tp->iss) || SEQ_GT(th->th_ack, tp->snd_max))) { + rstreason = BANDLIM_UNLIMITED; + goto dropwithreset; + } + + /* * Segment received on connection. * Reset idle time and keep-alive timer. * XXX: This should be done after segment @@ -1984,7 +1994,6 @@ tcp_do_segment(struct mbuf *m, struct tcphdr *th, stru /* * If the state is SYN_SENT: - * if seg contains an ACK, but not for our SYN, drop the input. * if seg contains a RST, then drop the connection. * if seg does not contain SYN, then drop it. * Otherwise this is an acceptable SYN segment @@ -1997,12 +2006,6 @@ tcp_do_segment(struct mbuf *m, struct tcphdr *th, stru * continue processing rest of data/controls, beginning with URG */ case TCPS_SYN_SENT: - if ((thflags & TH_ACK) && - (SEQ_LEQ(th->th_ack, tp->iss) || - SEQ_GT(th->th_ack, tp->snd_max))) { - rstreason = BANDLIM_UNLIMITED; - goto dropwithreset; - } if ((thflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) { TCP_PROBE5(connect__refused, NULL, tp, m, tp, th); Modified: stable/11/sys/netinet/tcp_stacks/fastpath.c ============================================================================== --- stable/11/sys/netinet/tcp_stacks/fastpath.c Thu Jun 1 14:49:53 2017 (r319430) +++ stable/11/sys/netinet/tcp_stacks/fastpath.c Thu Jun 1 14:58:26 2017 (r319431) @@ -485,7 +485,6 @@ tcp_do_slowpath(struct mbuf *m, struct tcphdr *th, str /* * If the state is SYN_SENT: - * if seg contains an ACK, but not for our SYN, drop the input. * if seg contains a RST, then drop the connection. * if seg does not contain SYN, then drop it. * Otherwise this is an acceptable SYN segment @@ -498,12 +497,6 @@ tcp_do_slowpath(struct mbuf *m, struct tcphdr *th, str * continue processing rest of data/controls, beginning with URG */ case TCPS_SYN_SENT: - if ((thflags & TH_ACK) && - (SEQ_LEQ(th->th_ack, tp->iss) || - SEQ_GT(th->th_ack, tp->snd_max))) { - rstreason = BANDLIM_UNLIMITED; - goto dropwithreset; - } if ((thflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) { TCP_PROBE5(connect__refused, NULL, tp, m, tp, th); tp = tcp_drop(tp, ECONNREFUSED); @@ -1744,6 +1737,20 @@ tcp_do_segment_fastslow(struct mbuf *m, struct tcphdr m_freem(m); return; } + + /* + * If a segment with the ACK-bit set arrives in the SYN-SENT state + * check SEQ.ACK first. + */ + if ((tp->t_state == TCPS_SYN_SENT) && (thflags & TH_ACK) && + (SEQ_LEQ(th->th_ack, tp->iss) || SEQ_GT(th->th_ack, tp->snd_max))) { + tcp_dropwithreset(m, th, tp, tlen, BANDLIM_UNLIMITED); + if (ti_locked == TI_RLOCKED) { + INP_INFO_RUNLOCK(&V_tcbinfo); + } + INP_WUNLOCK(tp->t_inpcb); + return; + } tp->sackhint.last_sack_ack = 0; @@ -2203,6 +2210,20 @@ tcp_do_segment_fastack(struct mbuf *m, struct tcphdr * return; } + /* + * If a segment with the ACK-bit set arrives in the SYN-SENT state + * check SEQ.ACK first. + */ + if ((tp->t_state == TCPS_SYN_SENT) && (thflags & TH_ACK) && + (SEQ_LEQ(th->th_ack, tp->iss) || SEQ_GT(th->th_ack, tp->snd_max))) { + tcp_dropwithreset(m, th, tp, tlen, BANDLIM_UNLIMITED); + if (ti_locked == TI_RLOCKED) { + INP_INFO_RUNLOCK(&V_tcbinfo); + } + INP_WUNLOCK(tp->t_inpcb); + return; + } + tp->sackhint.last_sack_ack = 0; /*