Exclude ACKs outside [SND.UNA, SND.NXT] from TCP header prediction so that they fall through to the slow path, where ACK validation is applied.
Add a packetdrill test for a data segment carrying an excessively old ACK. The test fails on the unpatched kernel and passes with the fix. --- Changes in v3: - Add a Fixes tag and stable Cc. - Clarify the visible impact of accepting payload carried by an excessively old ACK (RCV.NXT is advanced before the ACK is rejected). - Document ACK sequence validity as a TCP fast-path condition. - Initialize the packetdrill test with the suite defaults and disable invalid-packet rate limiting. - Add an SPDX license identifier to the packetdrill test. Changes in v2: - Exclude all ACKs before SND.UNA from header prediction instead of duplicating old-ACK validation in the fast path. - Cover pure ACKs as well as data-carrying segments. - Let the existing slow path handle validation and challenge ACKs. - Remove the packetdrill reproducer from the commit message; add the packetdrill test separately. v2: https://lore.kernel.org/netdev/[email protected]/ v1: https://lore.kernel.org/netdev/[email protected]/T/#u Inbal Schussheim (2): tcp: exclude old ACKs from tcp fast path selftests: net: packetdrill: test exclusion of old ACK from TCP fast path net/ipv4/tcp_input.c | 3 +- .../tcp_rfc5961_reject-old-ack.pkt | 29 +++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/net/packetdrill/tcp_rfc5961_reject-old-ack.pkt -- 2.43.0
