On Fri, 2016-06-03 at 11:45 -0400, Neal Cardwell wrote: > On Fri, Jun 3, 2016 at 11:13 AM, Eric Dumazet <eric.duma...@gmail.com> wrote: > > I have no strict opinion on this. > > > > It seems to me that checking at most 4 right edges (at least in current > > linux implementation) is not adding a huge risk, and allows for better > > interoperability. > > > > I vote for no extra sysctl. > > I vote for no extra sysctl as well. > > But I would also vote to tighten up the proposed logic slightly, and > only check the seq of the incoming RST against the right edge of the > *right-most* SACK block. That is, the code could loop through the > tp->selective_acks to find the right-most of the right edges of the > SACK blocks (the end_seq that has no other end_seq after() it). AFAICT > it makes sense to expect that a legitimate incoming RST might match > rcv_nxt, or might match the right-most edge of the right-most SACK. > But allowing a RST to match a sequence of some SACK in the middle of > the sequence range would seem to only increase the attack surface for > RST attacks.
Well, the most recent info would be in [0], no need to iterate, right ? So only look at the first sack block in the array, even if we have 3 or 4 blocks there.
