[PATCH net 0/2] tcp: validate RST sequence in SYN-RECEIVED

[Yuxiang Yang]

The SYN-RECEIVED request-socket path accepts any in-window RST and
removes the request, even when SEG.SEQ does not exactly match RCV.NXT.
RFC 9293 requires a challenge ACK for a non-exact in-window RST.

Patch 1 applies the RFC 5961 sequence check to request sockets and shares
the per-netns challenge ACK quota with the established-socket path.
Patch 2 adds a compact packetdrill regression test for exact, non-exact,
RST|ACK, and out-of-window cases.

The implementation was tested with a separate raw-socket A/B harness on
IPv4 and IPv6: the unpatched kernel passed 4/12 cases and the patched
kernel passed 12/12.  The packetdrill test fails on the unpatched kernel
and passes on the patched kernel for IPv4, IPv6, and IPv4-mapped IPv6
under QEMU/TCG.

Yuxiang Yang (2):
  tcp: challenge ACK for non-exact RST in SYN-RECEIVED
  selftests/net: packetdrill: cover RST validation in SYN-RECEIVED

 include/net/tcp.h                             |  2 +
 net/ipv4/tcp_input.c                          | 56 +++++++++++++----
 net/ipv4/tcp_minisocks.c                      | 12 +++-
 .../packetdrill/tcp_rfc5961_rst-syn-recv.pkt  | 61 +++++++++++++++++++
 4 files changed, 117 insertions(+), 14 deletions(-)
 create mode 100644 tools/testing/selftests/net/packetdrill/tcp_rfc5961_rst-syn-recv.pkt


base-commit: 3f1f755366687d051174739fb99f7d560202f60b
-- 
2.34.1