[Midnightbsd-cvs] src [7127] trunk: Fix a bug where TCP connections transitioning to LAST_ACK

[laffer1 at midnightbsd.org]

Revision: 7127
          http://svnweb.midnightbsd.org/src/?rev=7127
Author:   laffer1
Date:     2015-07-22 11:02:23 -0400 (Wed, 22 Jul 2015)
Log Message:
-----------
        Fix a bug where TCP connections transitioning to LAST_ACK
        state can get stuck. This can result in a denial of service.

Modified Paths:
--------------
    trunk/UPDATING
    trunk/sys/netinet/tcp_output.c

Modified: trunk/UPDATING
===================================================================
--- trunk/UPDATING	2015-07-22 15:00:50 UTC (rev 7126)
+++ trunk/UPDATING	2015-07-22 15:02:23 UTC (rev 7127)
@@ -1,5 +1,9 @@
 Updating Information for MidnightBSD users.
 
+20150722:
+	Fix a bug where TCP connections transitioning to LAST_ACK
+	state can get stuck. This can result in a denial of service.
+
 20150715:
 	libmport now supports @shell and @sample in plists. This means that
 	a shell port can automatically add an entry to /etc/shells and remove

Modified: trunk/sys/netinet/tcp_output.c
===================================================================
--- trunk/sys/netinet/tcp_output.c	2015-07-22 15:00:50 UTC (rev 7126)
+++ trunk/sys/netinet/tcp_output.c	2015-07-22 15:02:23 UTC (rev 7127)
@@ -393,7 +393,7 @@
 		flags &= ~TH_FIN;
 	}
 
-	if (len < 0) {
+	if (len <= 0) {
 		/*
 		 * If FIN has been sent but not acked,
 		 * but we haven't been called to retransmit,
@@ -403,9 +403,16 @@
 		 * to (closed) window, and set the persist timer
 		 * if it isn't already going.  If the window didn't
 		 * close completely, just wait for an ACK.
+		 *
+		 * We also do a general check here to ensure that
+		 * we will set the persist timer when we have data
+		 * to send, but a 0-byte window. This makes sure
+		 * the persist timer is set even if the packet
+		 * hits one of the "goto send" lines below.
 		 */
 		len = 0;
-		if (sendwin == 0) {
+		if ((sendwin == 0) && (TCPS_HAVEESTABLISHED(tp->t_state)) &&
+			(off < (int) so->so_snd.sb_cc)) {
 			tcp_timer_activate(tp, TT_REXMT, 0);
 			tp->t_rxtshift = 0;
 			tp->snd_nxt = tp->snd_una;