net: tcp: Fix TCP reset issue

According to RFC793 chapter3.5 with the 'Reset Processing' part,
"In the SYN-SENT state (a RST received in response to an initial
SYN), the RST is acceptable if the ACK field acknowledges the SYN."
So, in the net_tcp_reply_rst() we should use 'ack++' if no ACK
flag but have SYN flag.
And, all the RST packet should use net_tcp_reply_rst() instead of
tcp_out().

Signed-off-by: Shrek Wang <[email protected]>

Author: shrek-wang

subsys/net/ip/tcp.c

@@ -1514,6 +1514,10 @@ void net_tcp_reply_rst(struct net_pkt *pkt)
 	} else {
 		uint32_t ack = ntohl(th_pkt->th_seq) + tcp_data_len(pkt);
 
+		if (th_flags(th_pkt) & SYN) {
+			ack++;
+		}
+
 		UNALIGNED_PUT(RST | ACK, &th_rst->th_flags);
 		UNALIGNED_PUT(htonl(ack), &th_rst->th_ack);
 	}
@@ -2846,7 +2850,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 	NET_DBG("%s", tcp_conn_state(conn, pkt));
 
 	if (th_off(th) < 5) {
-		tcp_out(conn, RST);
+		net_tcp_reply_rst(pkt);
 		do_close = true;
 		close_status = -ECONNRESET;
 		goto out;
@@ -2874,6 +2878,13 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 		if (conn->in_connect) {
 			fl = th_flags(th);
 			if (FL(&fl, ==, RST | ACK)) {
+				if (th_ack(th) != conn->seq) {
+					/* Invalid ACKnum - drop it */
+					net_stats_update_tcp_seg_rsterr(net_pkt_iface(pkt));
+					k_mutex_unlock(&conn->lock);
+					return NET_DROP;
+				}
+
 				close_status = -ECONNREFUSED;
 			}
 		}
@@ -2884,7 +2895,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 	if (tcp_options_len && !tcp_options_check(&conn->recv_options, pkt,
 						  tcp_options_len)) {
 		NET_DBG("DROP: Invalid TCP option list");
-		tcp_out(conn, RST);
+		net_tcp_reply_rst(pkt);
 		do_close = true;
 		close_status = -ECONNRESET;
 		goto out;
@@ -2899,7 +2910,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 		NET_DBG("conn: %p, SYN received in %s state, dropping connection",
 			conn, tcp_state_to_str(conn->state, false));
 		net_stats_update_tcp_seg_drop(conn->iface);
-		tcp_out(conn, RST);
+		net_tcp_reply_rst(pkt);
 		do_close = true;
 		close_status = -ECONNRESET;
 		goto out;
@@ -3173,7 +3184,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 					"(total=%zu)", conn, len_acked,
 					conn->send_data_total);
 				net_stats_update_tcp_seg_drop(conn->iface);
-				tcp_out(conn, RST);
+				net_tcp_reply_rst(pkt);
 				do_close = true;
 				close_status = -ECONNRESET;
 				break;
@@ -3236,7 +3247,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 
 			ret = tcp_send_queued_data(conn);
 			if (ret < 0 && ret != -ENOBUFS) {
-				tcp_out(conn, RST);
+				net_tcp_reply_rst(pkt);
 				do_close = true;
 				close_status = ret;
 				verdict = NET_OK;
@@ -3334,7 +3345,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 
 			next = tcp_enter_time_wait(conn);
 
-			tcp_out(conn, RST);
+			net_tcp_reply_rst(pkt);
 			break;
 		}
 		if (FL(&fl, &, ACK, th_ack(th) == conn->seq)) {
@@ -3414,7 +3425,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 
 			next = tcp_enter_time_wait(conn);
 
-			tcp_out(conn, RST);
+			net_tcp_reply_rst(pkt);
 			break;
 		}
 		/*
@@ -3459,7 +3470,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 
 			next = tcp_enter_time_wait(conn);
 
-			tcp_out(conn, RST);
+			net_tcp_reply_rst(pkt);
 			break;
 		}
 
@@ -3513,7 +3524,7 @@ static enum net_verdict tcp_in(struct tcp *conn, struct net_pkt *pkt)
 				conn, new_len);
 			net_stats_update_tcp_seg_drop(conn->iface);
 
-			tcp_out(conn, RST);
+			net_tcp_reply_rst(pkt);
 		} else {
 			/* Acknowledge any FIN attempts, in case retransmission took
 			 * place.

tests/net/tcp/src/main.c

@@ -2202,7 +2202,7 @@ static void handle_server_rst_on_closed_port(sa_family_t af, struct tcphdr *th)
 		/* Port was closed so expect RST instead of SYN */
 		test_verify_flags(th, RST | ACK);
 		zassert_equal(ntohl(th->th_seq), 0, "Invalid SEQ value");
-		zassert_equal(ntohl(th->th_ack), seq, "Invalid ACK value");
+		zassert_equal(ntohl(th->th_ack), seq + 1, "Invalid ACK value");
 		t_state = T_CLOSING;
 		test_sem_give();
 		break;