netdev - Re: [PATCH net] tcp: properly scale window in tcp_v[46]_reqsk_send

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Aug 2016 11:49:14 -0700
From:   Yuchung Cheng <ycheng@...gle.com>
To:     Eric Dumazet <eric.dumazet@...il.com>
Cc:     David Miller <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        Neal Cardwell <ncardwell@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>
Subject: Re: [PATCH net] tcp: properly scale window in tcp_v[46]_reqsk_send_ack()

On Mon, Aug 22, 2016 at 11:31 AM, Eric Dumazet <eric.dumazet@...il.com> wrote:
> From: Eric Dumazet <edumazet@...gle.com>
>
> When sending an ack in SYN_RECV state, we must scale the offered
> window if wscale option was negotiated and accepted.
>
> Tested:
>  Following packetdrill test demonstrates the issue :
>
> 0.000 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
> +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
>
> +0 bind(3, ..., ...) = 0
> +0 listen(3, 1) = 0
>
> // Establish a connection.
> +0 < S 0:0(0) win 20000 <mss 1000,sackOK,wscale 7, nop, TS val 100 ecr 0>
> +0 > S. 0:0(0) ack 1 win 28960 <mss 1460,sackOK, TS val 100 ecr 100, nop, wscale 7>
>
> +0 < . 1:11(10) ack 1 win 156 <nop,nop,TS val 99 ecr 100>
> // check that window is properly scaled !
> +0 > . 1:1(0) ack 1 win 226 <nop,nop,TS val 200 ecr 100>
>
>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Yuchung Cheng <ycheng@...gle.com>
> Cc: Neal Cardwell <ncardwell@...gle.com>
> ---
Acked-by: Yuchung Cheng <ycheng@...gle.com>

Nice fix!

>  net/ipv4/tcp_ipv4.c |    8 +++++++-
>  net/ipv6/tcp_ipv6.c |    8 +++++++-
>  2 files changed, 14 insertions(+), 2 deletions(-)
>
>
> diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
> index 32b048e524d6..7158d4f8dae4 100644
> --- a/net/ipv4/tcp_ipv4.c
> +++ b/net/ipv4/tcp_ipv4.c
> @@ -814,8 +814,14 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
>         u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
>                                              tcp_sk(sk)->snd_nxt;
>
> +       /* RFC 7323 2.3
> +        * The window field (SEG.WND) of every outgoing segment, with the
> +        * exception of <SYN> segments, MUST be right-shifted by
> +        * Rcv.Wind.Shift bits:
> +        */
>         tcp_v4_send_ack(sock_net(sk), skb, seq,
> -                       tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
> +                       tcp_rsk(req)->rcv_nxt,
> +                       req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
>                         tcp_time_stamp,
>                         req->ts_recent,
>                         0,
> diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
> index 33df8b8575cc..94f4f89d73e7 100644
> --- a/net/ipv6/tcp_ipv6.c
> +++ b/net/ipv6/tcp_ipv6.c
> @@ -944,9 +944,15 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
>         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
>          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
>          */
> +       /* RFC 7323 2.3
> +        * The window field (SEG.WND) of every outgoing segment, with the
> +        * exception of <SYN> segments, MUST be right-shifted by
> +        * Rcv.Wind.Shift bits:
> +        */
>         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
>                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
> -                       tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
> +                       tcp_rsk(req)->rcv_nxt,
> +                       req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
>                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
>                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
>                         0, 0);
>
>