d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix resource exhaustion due to sessions stuck in LAST_ACK state.

Browse Source 
Submitted by:	Jonathan Looney (Juniper SIRT)
Reviewed by:	lstewart
Security:	CVE-2015-5358
Security:	SA-15:13.tcp
This commit is contained in:
delphij 2015-07-21 23:42:15 +00:00
parent 825752c2e5
commit 722d66a533
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/netinet/tcp_output.c
View File

@ -400,7 +400,7 @@ tcp_output(struct tcpcb *tp)
flags &= ~TH_FIN;
}
if (len < 0) {
if (len <= 0) {
/*
* If FIN has been sent but not acked,
* but we haven't been called to retransmit,
@ -410,9 +410,16 @@ tcp_output(struct tcpcb *tp)
* to (closed) window, and set the persist timer
* if it isn't already going. If the window didn't
* close completely, just wait for an ACK.
*
* We also do a general check here to ensure that
* we will set the persist timer when we have data
* to send, but a 0-byte window. This makes sure
* the persist timer is set even if the packet
* hits one of the "goto send" lines below.
*/
len = 0;
if (sendwin == 0) {
if ((sendwin == 0) && (TCPS_HAVEESTABLISHED(tp->t_state)) &&
(off < (int) sbavail(&so->so_snd))) {
tcp_timer_activate(tp, TT_REXMT, 0);
tp->t_rxtshift = 0;
tp->snd_nxt = tp->snd_una;