tcp: verify the checksum of the first data segment in a new connection
[ Upstream commitpull/10/head4fd44a98ff
] commit079096f103
("tcp/dccp: install syn_recv requests into ehash table") introduced an optimization for the handling of child sockets created for a new TCP connection. But this optimization passes any data associated with the last ACK of the connection handshake up the stack without verifying its checksum, because it calls tcp_child_process(), which in turn calls tcp_rcv_state_process() directly. These lower-level processing functions do not do any checksum verification. Insert a tcp_checksum_complete call in the TCP_NEW_SYN_RECEIVE path to fix this. Fixes:079096f103
("tcp/dccp: install syn_recv requests into ehash table") Signed-off-by: Frank van der Linden <fllinden@amazon.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Tested-by: Balbir Singh <bsingharora@gmail.com> Reviewed-by: Balbir Singh <bsingharora@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
81d159444d
commit
39f4ae01c1
|
@ -1675,6 +1675,10 @@ process:
|
|||
reqsk_put(req);
|
||||
goto discard_it;
|
||||
}
|
||||
if (tcp_checksum_complete(skb)) {
|
||||
reqsk_put(req);
|
||||
goto csum_error;
|
||||
}
|
||||
if (unlikely(sk->sk_state != TCP_LISTEN)) {
|
||||
inet_csk_reqsk_queue_drop_and_put(sk, req);
|
||||
goto lookup;
|
||||
|
|
|
@ -1453,6 +1453,10 @@ process:
|
|||
reqsk_put(req);
|
||||
goto discard_it;
|
||||
}
|
||||
if (tcp_checksum_complete(skb)) {
|
||||
reqsk_put(req);
|
||||
goto csum_error;
|
||||
}
|
||||
if (unlikely(sk->sk_state != TCP_LISTEN)) {
|
||||
inet_csk_reqsk_queue_drop_and_put(sk, req);
|
||||
goto lookup;
|
||||
|
|
Loading…
Reference in New Issue