mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2025-01-04 11:38:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "fixed bug #48170 (patch by Fabian Koch)"

Browse Source 
This reverts commit 236bc19422.
The fix introduced bug #48328 -> reverted
This commit is contained in:
goldsimon 2016-06-30 08:41:50 +02:00
parent 91b5d8ad1e
commit d31d2ee882
1 changed files with 14 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/core/tcp_in.c
View File

@ -697,27 +697,32 @@ static err_t
tcp_process(struct tcp_pcb *pcb) tcp_process(struct tcp_pcb *pcb)
{ {
struct tcp_seg *rseg; struct tcp_seg *rseg;
u8_t acceptable = 0;
err_t err; err_t err;
err = ERR_OK; err = ERR_OK;
/* Process incoming RST segments. */ /* Process incoming RST segments. */
if (flags & TCP_RST) { if (flags & TCP_RST) {
/* First, determine if the reset is acceptable. (in case of RST only if the sequence number matches) */ /* First, determine if the reset is acceptable. */
if (ackno == pcb->snd_nxt) { if (pcb->state == SYN_SENT) {
if (ackno == pcb->snd_nxt) {
acceptable = 1;
}
} else {
if (TCP_SEQ_BETWEEN(seqno, pcb->rcv_nxt,
pcb->rcv_nxt + pcb->rcv_wnd)) {
acceptable = 1;
}
}
if (acceptable) {
LWIP_DEBUGF(TCP_INPUT_DEBUG, ("tcp_process: Connection RESET\n")); LWIP_DEBUGF(TCP_INPUT_DEBUG, ("tcp_process: Connection RESET\n"));
LWIP_ASSERT("tcp_input: pcb->state != CLOSED", pcb->state != CLOSED); LWIP_ASSERT("tcp_input: pcb->state != CLOSED", pcb->state != CLOSED);
recv_flags |= TF_RESET; recv_flags |= TF_RESET;
pcb->flags &= ~TF_ACK_DELAY; pcb->flags &= ~TF_ACK_DELAY;
return ERR_RST; return ERR_RST;
} else { } else {
/* if the sequence number is inside the window, we only send an ACK
and wait for a re-send with matching sequence number.
This is protection against CVE-2004-0230 (RST spoofing attack) */
if (TCP_SEQ_BETWEEN(seqno, pcb->rcv_nxt,
pcb->rcv_nxt + pcb->rcv_wnd)) {
tcp_ack_now(pcb);
}
LWIP_DEBUGF(TCP_INPUT_DEBUG, ("tcp_process: unacceptable reset seqno %"U32_F" rcv_nxt %"U32_F"\n", LWIP_DEBUGF(TCP_INPUT_DEBUG, ("tcp_process: unacceptable reset seqno %"U32_F" rcv_nxt %"U32_F"\n",
seqno, pcb->rcv_nxt)); seqno, pcb->rcv_nxt));
LWIP_DEBUGF(TCP_DEBUG, ("tcp_process: unacceptable reset seqno %"U32_F" rcv_nxt %"U32_F"\n", LWIP_DEBUGF(TCP_DEBUG, ("tcp_process: unacceptable reset seqno %"U32_F" rcv_nxt %"U32_F"\n",