aboutsummaryrefslogtreecommitdiffstats
path: root/net/dccp
diff options
context:
space:
mode:
authorGerrit Renker <gerrit@erg.abdn.ac.uk>2007-09-26 01:41:56 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-10-10 19:52:37 -0400
commite155d7692290f7bc539ccb8ebc3450ec964e53fd (patch)
treececa4fe0902c5efc8fb0936ec40d9482907d5d3a /net/dccp
parentcbe1f5f88af454303a9c1a0624209269430d49fe (diff)
[DCCP]: Fix Reset/Sync-Flood Bug
This updates sequence number checking with regard to RFC 4340, 7.5.4. Missing in the code was an exception for sequence-invalid Reset packets, which get a Sync acknowledging GSR, instead of (as usual) P.seqno. This can lead to an oscillating ping-pong flood of Reset packets. In fact, it has been observed on the wire as follows: 1. client establishes connection to server; 2. before server can write to client, client crashes without notifying the server (NB: now no longer possible due to ABORT function); 3. server sends DCCP-Data packet (has no ackno); 4. client generates Reset "No Connection", seqno=0, increments seqno; 5. server replies with Sync, using ackno = P.seqno; 6. client generates Reset "No Connection" with seqno = ackno + 1; 7. goto (5). The difference is that now in (5) the server uses GSR. This causes the Reset sent by the client in (6) to become sequence-valid, so that in (7) the vicious circle is broken; the Reset is then enqueued and causes the socket to enter TIMEWAIT state. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz> Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/dccp')
-rw-r--r--net/dccp/input.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 6276b23fc204..cde0e704dfce 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -102,9 +102,6 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
102 * Update S.GSR, S.SWL, S.SWH 102 * Update S.GSR, S.SWL, S.SWH
103 * If P.type != Sync, 103 * If P.type != Sync,
104 * Update S.GAR 104 * Update S.GAR
105 * Otherwise,
106 * Send Sync packet acknowledging P.seqno
107 * Drop packet and return
108 */ 105 */
109 lswl = dp->dccps_swl; 106 lswl = dp->dccps_swl;
110 lawl = dp->dccps_awl; 107 lawl = dp->dccps_awl;
@@ -135,6 +132,17 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
135 : "exists", 132 : "exists",
136 (unsigned long long) lawl, (unsigned long long) ackno, 133 (unsigned long long) lawl, (unsigned long long) ackno,
137 (unsigned long long) dp->dccps_awh); 134 (unsigned long long) dp->dccps_awh);
135 /*
136 * Step 6: Check sequence numbers
137 * Otherwise,
138 * If P.type == Reset,
139 * Send Sync packet acknowledging S.GSR
140 * Otherwise,
141 * Send Sync packet acknowledging P.seqno
142 * Drop packet and return
143 */
144 if (dh->dccph_type == DCCP_PKT_RESET)
145 seqno = dp->dccps_gsr;
138 dccp_send_sync(sk, seqno, DCCP_PKT_SYNC); 146 dccp_send_sync(sk, seqno, DCCP_PKT_SYNC);
139 return -1; 147 return -1;
140 } 148 }