aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorPhilip Love <love_phil@emc.com>2008-08-27 05:33:50 -0400
committerDavid S. Miller <davem@davemloft.net>2008-08-27 05:33:50 -0400
commit7982d5e1b350acb96aa156916c44c25ef87bb809 (patch)
treed1af9ffefd6137a2972b203296ea3961282f5ae8 /net/ipv4
parentfe439dd09d3e4da6a44d35df7371b9c6a2661b99 (diff)
tcp: fix tcp header size miscalculation when window scale is unused
The size of the TCP header is miscalculated when the window scale ends up being 0. Additionally, this can be induced by sending a SYN to a passive open port with a window scale option with value 0. Signed-off-by: Philip Love <love_phil@emc.com> Signed-off-by: Adam Langley <agl@imperialviolet.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/tcp_output.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a00532de2a8c..8165f5aa8c71 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -468,7 +468,8 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
468 } 468 }
469 if (likely(sysctl_tcp_window_scaling)) { 469 if (likely(sysctl_tcp_window_scaling)) {
470 opts->ws = tp->rx_opt.rcv_wscale; 470 opts->ws = tp->rx_opt.rcv_wscale;
471 size += TCPOLEN_WSCALE_ALIGNED; 471 if(likely(opts->ws))
472 size += TCPOLEN_WSCALE_ALIGNED;
472 } 473 }
473 if (likely(sysctl_tcp_sack)) { 474 if (likely(sysctl_tcp_sack)) {
474 opts->options |= OPTION_SACK_ADVERTISE; 475 opts->options |= OPTION_SACK_ADVERTISE;
@@ -509,7 +510,8 @@ static unsigned tcp_synack_options(struct sock *sk,
509 510
510 if (likely(ireq->wscale_ok)) { 511 if (likely(ireq->wscale_ok)) {
511 opts->ws = ireq->rcv_wscale; 512 opts->ws = ireq->rcv_wscale;
512 size += TCPOLEN_WSCALE_ALIGNED; 513 if(likely(opts->ws))
514 size += TCPOLEN_WSCALE_ALIGNED;
513 } 515 }
514 if (likely(doing_ts)) { 516 if (likely(doing_ts)) {
515 opts->options |= OPTION_TS; 517 opts->options |= OPTION_TS;