On Fri, Jun 3, 2016 at 3:44 PM, Neal Cardwell <ncardw...@google.com> wrote: > On Fri, Jun 3, 2016 at 12:24 PM, Eric Dumazet <eric.duma...@gmail.com> wrote: >> On Fri, 2016-06-03 at 11:45 -0400, Neal Cardwell wrote: >>> But I would also vote to tighten up the proposed logic slightly, and >>> only check the seq of the incoming RST against the right edge of the >>> *right-most* SACK block. That is, the code could loop through the >>> tp->selective_acks to find the right-most of the right edges of the >>> SACK blocks (the end_seq that has no other end_seq after() it). AFAICT >>> it makes sense to expect that a legitimate incoming RST might match >>> rcv_nxt, or might match the right-most edge of the right-most SACK. >>> But allowing a RST to match a sequence of some SACK in the middle of >>> the sequence range would seem to only increase the attack surface for >>> RST attacks. >> >> Well, the most recent info would be in [0], no need to iterate, right ? >> >> So only look at the first sack block in the array, even if we have 3 or >> 4 blocks there. > > Yes, good point. It should only need to check the first SACK block in > the selective_acks array.
Well, hmm. The most recent SACK block may not be the right-most one, if there is reordering or packets are retransmitted. So AFAICT if we wanted to try hard to just use the right-most SACK block we'd need to check all the blocks. But just checking the first SACK block seems like a reasonable trade-off in terms of simplicity. I don't feel strongly either way. neal
