git: b352ef58c29b - main - tcp: Handle <RST,ACK> in SYN-RCVD

The branch main has been updated by rscheff:

URL: https://cgit.FreeBSD.org/src/commit/?id=b352ef58c29b1f2967e358c147e0f7faf8cfbef3

commit b352ef58c29b1f2967e358c147e0f7faf8cfbef3
Author:     Richard Scheffenegger <rscheff@FreeBSD.org>
AuthorDate: 2023-07-26 22:41:25 +0000
Commit:     Richard Scheffenegger <rscheff@FreeBSD.org>
CommitDate: 2023-07-26 22:42:26 +0000

    tcp: Handle <RST,ACK> in SYN-RCVD
    
    Patch base stack to correctly handle the RST bit independently
    of other header flags per TCP RFC.
    
    MFC after: 1 week
    Reviewed By: tuexen, #transport
    Sponsored by: NetApp, Inc.
    Differential Revision: https://reviews.freebsd.org/D40982
---
 sys/netinet/tcp_input.c    |  4 ++++
 sys/netinet/tcp_syncache.c | 12 ------------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 10daab2d61ba..b66e4e9d17ac 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1963,6 +1963,10 @@ tcp_do_segment(struct tcpcb *tp, struct mbuf *m, struct tcphdr *th,
 	 *	if seg contains an ACK, but not for our SYN/ACK, send a RST.
 	 */
 	case TCPS_SYN_RECEIVED:
+		if (thflags & TH_RST) {
+			/* Handle RST segments later. */
+			break;
+		}
 		if ((thflags & TH_ACK) &&
 		    (SEQ_LEQ(th->th_ack, tp->snd_una) ||
 		     SEQ_GT(th->th_ack, tp->snd_max))) {
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
index b9c41eda4d9e..986d4d068f96 100644
--- a/sys/netinet/tcp_syncache.c
+++ b/sys/netinet/tcp_syncache.c
@@ -623,18 +623,6 @@ syncache_chkrst(struct in_conninfo *inc, struct tcphdr *th, struct mbuf *m,
 	sc = syncache_lookup(inc, &sch);	/* returns locked sch */
 	SCH_LOCK_ASSERT(sch);
 
-	/*
-	 * Any RST to our SYN|ACK must not carry ACK, SYN or FIN flags.
-	 * See RFC 793 page 65, section SEGMENT ARRIVES.
-	 */
-	if (tcp_get_flags(th) & (TH_ACK|TH_SYN|TH_FIN)) {
-		if ((s = tcp_log_addrs(inc, th, NULL, NULL)))
-			log(LOG_DEBUG, "%s; %s: Spurious RST with ACK, SYN or "
-			    "FIN flag set, segment ignored\n", s, __func__);
-		TCPSTAT_INC(tcps_badrst);
-		goto done;
-	}
-
 	/*
 	 * No corresponding connection was found in syncache.
 	 * If syncookies are enabled and possibly exclusively