Unverified Commit 8330907b authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12193 tcp: do not accept ACK of bytes we never sent 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QNVXP3P6QLWNPWUJA7TP6ZLJKDM5SV55/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9T92N 
 
Link:https://gitee.com/openeuler/kernel/pulls/12193

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 8a5965ae 9115e45a

net/ipv4/tcp_input.c

+5 −1
Original line number Diff line number Diff line
@@ -3752,8 +3752,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) 
	 * then we can probably ignore it.

	 */

	if (before(ack, prior_snd_una)) {

		u32 max_window;



		/* do not accept ACK for bytes we never sent. */

		max_window = min_t(u64, tp->max_window, tp->bytes_acked);

		/* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */

		if (before(ack, prior_snd_una - tp->max_window)) {

		if (before(ack, prior_snd_una - max_window)) {

			if (!(flag & FLAG_NO_CHALLENGE_ACK))

				tcp_send_challenge_ack(sk, skb);

			return -1;