Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 11 Sep 1996 17:47:13 -0700 (PDT)
From:      "Jonathan M. Bresler" <jmb>
To:        FreeBSD-gnats-submit@freebsd.org
Subject:   kern/1600: SYN_RCVD bug fix
Message-ID:  <199609120047.RAA18124@freefall.freebsd.org>
Resent-Message-ID: <199609120050.RAA18285@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help 

>Number:         1600
>Category:       kern
>Synopsis:       prevent setting of t_timer[TCPT_KEEP] prematurely
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 11 17:50:01 PDT 1996
>Last-Modified:
>Originator:     Jonathan M. Bresler
>Organization:
Jonathan M. Bresler           FreeBSD Postmaster             jmb@FreeBSD.ORG
FreeBSD--4.4BSD Unix for PC clones, source included. http://www.freebsd.org/
PGP 2.6.2 Fingerprint:      31 57 41 56 06 C1 40 13  C5 1C E3 E5 DC 62 0E FB
>Release:        FreeBSD 2.2-CURRENT i386
>Environment:

	all BSD derived tcp/ip implementations

>Description:

	receipt of two SYN's are sufficient to set the t_timer[TCPT_KEEP]
	to "keepidle".  this should not occur unless the connection has
	been established via the 3-way handshake which requires an ACK

>How-To-Repeat:

	create code to send SYN's to  a port.  use tcpdump to view the
	connection.  the server will send keepalive packets back to
	the client for approximately 11 minutes until TCP_MAXRXTSHIFT
	is exceeded

>Fix:

	apply this patch:

Index: tcp_input.c
===================================================================
RCS file: /home/ncvs/src/sys/netinet/tcp_input.c,v
retrieving revision 1.46
diff -c -2 -r1.46 tcp_input.c
*** tcp_input.c	1996/05/02 05:54:12	1.46
--- tcp_input.c	1996/09/12 00:32:50
***************
*** 451,455 ****
  	 */
  	tp->t_idle = 0;
! 	tp->t_timer[TCPT_KEEP] = tcp_keepidle;
  
  	/*
--- 451,456 ----
  	 */
  	tp->t_idle = 0;
! 	if (TCPS_HAVEESTABLISHED(tp->t_state))
! 		tp->t_timer[TCPT_KEEP] = tcp_keepidle;
  
  	/*
***************
*** 833,839 ****
  				tp->t_flags &= ~TF_NEEDFIN;
  				tiflags &= ~TH_SYN;
! 			} else
  				tp->t_state = TCPS_ESTABLISHED;
! 
  		} else {
  		/*
--- 834,841 ----
  				tp->t_flags &= ~TF_NEEDFIN;
  				tiflags &= ~TH_SYN;
! 			} else {
  				tp->t_state = TCPS_ESTABLISHED;
! 				tp->t_timer[TCPT_KEEP] = tcp_keepidle;
! 			}
  		} else {
  		/*
***************
*** 860,865 ****
  						tp->t_state = TCPS_FIN_WAIT_1;
  						tp->t_flags &= ~TF_NEEDFIN;
! 					} else
  						tp->t_state = TCPS_ESTABLISHED;
  					tp->t_flags |= TF_NEEDSYN;
  				} else
--- 862,869 ----
  						tp->t_state = TCPS_FIN_WAIT_1;
  						tp->t_flags &= ~TF_NEEDFIN;
! 					} else {
  						tp->t_state = TCPS_ESTABLISHED;
+ 						tp->t_timer[TCPT_KEEP] = tcp_keepidle;
+ 					}
  					tp->t_flags |= TF_NEEDSYN;
  				} else
***************
*** 1184,1189 ****
  			tp->t_state = TCPS_FIN_WAIT_1;
  			tp->t_flags &= ~TF_NEEDFIN;
! 		} else
  			tp->t_state = TCPS_ESTABLISHED;
  		/*
  		 * If segment contains data or ACK, will call tcp_reass()
--- 1188,1195 ----
  			tp->t_state = TCPS_FIN_WAIT_1;
  			tp->t_flags &= ~TF_NEEDFIN;
! 		} else {
  			tp->t_state = TCPS_ESTABLISHED;
+ 			tp->t_timer[TCPT_KEEP] = tcp_keepidle;
+ 		}
  		/*
  		 * If segment contains data or ACK, will call tcp_reass()
>Audit-Trail:
>Unformatted:

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199609120047.RAA18124>