git: tcp: Accept a RST whose sequence number is exactly RCV.NXT

[Aaron LI]

commit f4823e098625634459b8cb3315434c38b6274475
Author: Thomas Grainger <tagrain at gmail.com>
Date:   Thu Jul 9 08:47:50 2026 +0100

    tcp: Accept a RST whose sequence number is exactly RCV.NXT
    
    An incoming RST is validated against a window anchored on last_ack_sent:
    [last_ack_sent, last_ack_sent + rcv_wnd].  When the receiver has
    delayed-ACKed data (rcv_nxt > last_ack_sent) and its receive window has
    shrunk below that gap (rcv_nxt - last_ack_sent > rcv_wnd), a RST at
    rcv_nxt, sits beyond the right edge last_ack_sent + rcv_wnd and is
    silently dropped.  The caused the connection to stay ESTABLISHED
    (half-open), leaving the application to time out and close.
    
    Accept a RST whose sequence number is exactly rcv_nxt, matching the
    long-deployed OpenBSD [1] and NetBSD [2] behaviour.
    
    This does not weaken existing RST acceptance: DragonFly already accepts
    any in-window RST (RFC 793, no challenge ACK), so an off-path attacker
    gains nothing -- the change only stops legitimate RSTs at rcv_nxt from
    being dropped.  The new behavior also conforms to RFC 793 and RFC 5961
    (section 3.2).
    
    [1] https://github.com/openbsd/src/commit/89ef4ab4d975
    [2] https://github.com/NetBSD/src/commit/8d20d2e95368
    
    Bug: https://bugs.dragonflybsd.org/issues/3418
    GitHub-PR: https://github.com/DragonFlyBSD/DragonFlyBSD/pull/48
    CPython issue: https://github.com/python/cpython/issues/153117

Summary of changes:
 sys/netinet/tcp_input.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/f4823e098625634459b8cb3315434c38b6274475


-- 
DragonFly BSD source repository