On Fri, Jun 3, 2016 at 11:13 AM, Eric Dumazet <eric.duma...@gmail.com> wrote: > I have no strict opinion on this. > > It seems to me that checking at most 4 right edges (at least in current > linux implementation) is not adding a huge risk, and allows for better > interoperability. > > I vote for no extra sysctl.
I vote for no extra sysctl as well. But I would also vote to tighten up the proposed logic slightly, and only check the seq of the incoming RST against the right edge of the *right-most* SACK block. That is, the code could loop through the tp->selective_acks to find the right-most of the right edges of the SACK blocks (the end_seq that has no other end_seq after() it). AFAICT it makes sense to expect that a legitimate incoming RST might match rcv_nxt, or might match the right-most edge of the right-most SACK. But allowing a RST to match a sequence of some SACK in the middle of the sequence range would seem to only increase the attack surface for RST attacks. neal
