On Tue, Jun 7, 2016 at 11:21 AM, Eric Dumazet <eric.duma...@gmail.com> wrote: > On Tue, 2016-06-07 at 16:30 +0200, Pau Espin Pedrol wrote: >> RFC 5961 advises to only accept RST packets containing a seq number >> matching the next expected seq number instead of the whole receive >> window in order to avoid spoofing attacks. > >> Signed-off-by: Pau Espin Pedrol <pau.es...@tessares.net>
Acked-by: Neal Cardwell <ncardw...@google.com> Tested-by: Neal Cardwell <ncardw...@google.com> I verified that it passes the following packetdrill test, which is based on the script posted by Pau in a recent thread on this topic. Thanks! neal ---- // Test that we accept an incoming RST if it matches the rightmost // SACK block end. 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 +0 < S 0:0(0) win 500 <mss 1460,sackOK,nop,nop,nop,wscale 7> +0 > S. 0:0(0) ack 1 win 29200 <mss 1460,nop,nop,sackOK,nop,wscale 7> +0 < . 1:1(0) ack 1 win 500 +0 accept(3, ..., ...) = 4 // First roundtrip of data client->server (upload) +0 < P. 1:1001(1000) ack 1 win 500 +0 > . 1:1(0) ack 1001 // A packet arrives without prev packet being seen. +0 < P. 5001:6001(1000) ack 1 win 500 +0 > . 1:1(0) ack 1001 <nop,nop,sack 5001:6001> // Another out-of-order packet arrives. +0 < P. 3001:4001(1000) ack 1 win 500 +0 > . 1:1(0) ack 1001 <nop,nop,sack 3001:4001 5001:6001> // We send a challenge ACK for a RST matching the right edge of the inner SACK block: +0 < R. 4001:4001(0) ack 1 win 500 +0 > . 1:1(0) ack 1001 <nop,nop,sack 3001:4001 5001:6001> // RST arrives from client, for instance caused by setsockopt(fd, SOL_SOCKET, SO_LINGER, ...) // Matches right edge of right-most SACK block, so we reset the connection. +0 < R. 6001:6001(0) ack 1 win 500 // Verify that the RST caused the kernel to reset the connection: +.010 write(4, ..., 10000) = -1 ECONNRESET (Connection reset by peer) // Double-check that the socket is gone: +0 < P. 2001:3001(1000) ack 1 win 500 +0 > R 1:1(0) ack 0
