The SYN-RECEIVED request-socket path accepts any in-window RST and removes the request, even when SEG.SEQ does not exactly match RCV.NXT. RFC 9293 requires a challenge ACK for a non-exact in-window RST.
Patch 1 applies the RFC 5961 sequence check to request sockets and shares the per-netns challenge ACK quota with the established-socket path. Patch 2 adds a compact packetdrill regression test for exact, non-exact, RST|ACK, and out-of-window cases. The implementation was tested with a separate raw-socket A/B harness on IPv4 and IPv6: the unpatched kernel passed 4/12 cases and the patched kernel passed 12/12. The packetdrill test fails on the unpatched kernel and passes on the patched kernel for IPv4, IPv6, and IPv4-mapped IPv6 under QEMU/TCG. Yuxiang Yang (2): tcp: challenge ACK for non-exact RST in SYN-RECEIVED selftests/net: packetdrill: cover RST validation in SYN-RECEIVED include/net/tcp.h | 2 + net/ipv4/tcp_input.c | 56 +++++++++++++---- net/ipv4/tcp_minisocks.c | 12 +++- .../packetdrill/tcp_rfc5961_rst-syn-recv.pkt | 61 +++++++++++++++++++ 4 files changed, 117 insertions(+), 14 deletions(-) create mode 100644 tools/testing/selftests/net/packetdrill/tcp_rfc5961_rst-syn-recv.pkt base-commit: 3f1f755366687d051174739fb99f7d560202f60b -- 2.34.1
