The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=8af2f06a99b10c0d3ab9021949e750852662672a
commit 8af2f06a99b10c0d3ab9021949e750852662672a Author: Michael Tuexen <[email protected]> AuthorDate: 2025-10-06 20:39:31 +0000 Commit: Michael Tuexen <[email protected]> CommitDate: 2025-10-06 20:43:11 +0000 tcp: improve SEG.ACK validation in SYN-RECEIVED According to the fifth step in SEGMENT ARRIVES, send a RST segment in response to an ACK segment which fails the SEG.ACK check, but leave the endpoint state unchanged. FreeBSD handles this correctly when entering the SYN-RECEIVED state via the SYN-SENT state, but not in the SYN-cache code, which handles the SYN-RECEIVED state via the LISTEN state. This also fixes a panic reported by Alexander Leidinger. Reviewed by: jtl, glebius MFC after: 3 days Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D52934 --- sys/netinet/tcp_syncache.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c index 2bb99596f965..1fb6104a2944 100644 --- a/sys/netinet/tcp_syncache.c +++ b/sys/netinet/tcp_syncache.c @@ -1285,7 +1285,8 @@ syncache_expand(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th, "segment rejected\n", s, __func__, th->th_ack, sc->sc_iss + 1); SCH_UNLOCK(sch); - goto failed; + free(s, M_TCPLOG); + return (0); /* Do send RST, do not free sc. */; } TAILQ_REMOVE(&sch->sch_bucket, sc, sc_hash);
