From owner-p4-projects@FreeBSD.ORG  Mon Sep  7 19:46:40 2009
Return-Path: <owner-p4-projects@FreeBSD.ORG>
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 3168D1065672; Mon,  7 Sep 2009 19:46:40 +0000 (UTC)
Delivered-To: perforce@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id EA1E7106566C
	for <perforce@freebsd.org>; Mon,  7 Sep 2009 19:46:39 +0000 (UTC)
	(envelope-from andre@freebsd.org)
Received: from repoman.freebsd.org (repoman.freebsd.org
	[IPv6:2001:4f8:fff6::29])
	by mx1.freebsd.org (Postfix) with ESMTP id D94048FC08
	for <perforce@freebsd.org>; Mon,  7 Sep 2009 19:46:39 +0000 (UTC)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.14.3/8.14.3) with ESMTP id n87JkdoZ008379
	for <perforce@freebsd.org>; Mon, 7 Sep 2009 19:46:39 GMT
	(envelope-from andre@freebsd.org)
Received: (from perforce@localhost)
	by repoman.freebsd.org (8.14.3/8.14.3/Submit) id n87JkdSg008377
	for perforce@freebsd.org; Mon, 7 Sep 2009 19:46:39 GMT
	(envelope-from andre@freebsd.org)
Date: Mon, 7 Sep 2009 19:46:39 GMT
Message-Id: <200909071946.n87JkdSg008377@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: perforce set sender to
	andre@freebsd.org using -f
From: Andre Oppermann <andre@FreeBSD.org>
To: Perforce Change Reviews <perforce@freebsd.org>
Cc: 
Subject: PERFORCE change 168297 for review
X-BeenThere: p4-projects@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: p4 projects tree changes <p4-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/p4-projects>
List-Post: <mailto:p4-projects@freebsd.org>
List-Help: <mailto:p4-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Sep 2009 19:46:40 -0000

http://perforce.freebsd.org/chv.cgi?CH=168297

Change 168297 by andre@andre_t61 on 2009/09/07 19:46:36

	In TCPS_SYN_SENT case initialize tiwin variable to shifted window
	and require the window to be at least one mss. A smaller window
	is bogus.

Affected files ...

.. //depot/projects/tcp_new/netinet/tcp_input.c#16 edit

Differences ...

==== //depot/projects/tcp_new/netinet/tcp_input.c#16 (text+ko) ====

@@ -1039,6 +1039,7 @@
 		if ((tp->t_flags & TF_WINSCALE) &&
 		    (to.to_flags & TOF_SCALE)) {
 			tp->snd_scale = to.to_wscale;
+			tiwin = th->th_win << tp->snd_scale;
 		} else if (tp->t_flags & TF_WINSCALE) {
 			/* No window scaling. */
 			tp->t_flags &= ~TF_WINSCALE;
@@ -1059,6 +1060,20 @@
 		}
 
 		/*
+		 * Require the window to allow for at least one segment
+		 * to be sent.  Everything else is bogus and an invitation
+		 * for persistence attacks.
+		 */
+		if (th->th_win < tp->snd_mss) {
+			tcplog("Window too small, "
+			    "connection aborted");
+			tp->t_softerror = ENETRESET;	/* XXXAO: Correct error? */
+			tp = tcp_close(tp);
+			rstreason = BANDLIM_UNLIMITED;
+			goto dropwithreset;
+		}
+
+		/*
 		 * Do timestamps on this connection?
 		 *  RFC1323bis: section 3.2, first and last sentence
 		 */