*                  sent (the segment carries an unaccaptable ACK) ... 
*                  sent (the segment carries an unacceptable ACK) ... 
struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,			   struct request_sock *req,			   struct request_sock **prev){	struct tcphdr *th = skb->h.th;	struct tcp_sock *tp = tcp_sk(sk);	u32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);	int paws_reject = 0;	struct tcp_options_received tmp_opt;	struct sock *child;	tmp_opt.saw_tstamp = 0;	if (th->doff > (sizeof(struct tcphdr)>>2)) {		tcp_parse_options(skb, &tmp_opt, 0);		if (tmp_opt.saw_tstamp) {			tmp_opt.ts_recent = req->ts_recent;			/* We do not store true stamp, but it is not required,			 * it can be estimated (approximately)			 * from another data.			 */			tmp_opt.ts_recent_stamp = xtime.tv_sec - ((TCP_TIMEOUT_INIT/HZ)<<req->retrans);			paws_reject = tcp_paws_check(&tmp_opt, th->rst);		}	}	/* Check for pure retransmitted SYN. */	if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&	    flg == TCP_FLAG_SYN &&	    !paws_reject) {		/*		 * RFC793 draws (Incorrectly! It was fixed in RFC1122)		 * this case on figure 6 and figure 8, but formal		 * protocol description says NOTHING.		 * To be more exact, it says that we should send ACK,		 * because this segment (at least, if it has no data)		 * is out of window.		 *		 *  CONCLUSION: RFC793 (even with RFC1122) DOES NOT		 *  describe SYN-RECV state. All the description		 *  is wrong, we cannot believe to it and should		 *  rely only on common sense and implementation		 *  experience.		 *		 * Enforce "SYN-ACK" according to figure 8, figure 6		 * of RFC793, fixed by RFC1122.		 */		req->rsk_ops->rtx_syn_ack(sk, req, NULL);		return NULL;	}	/* Further reproduces section "SEGMENT ARRIVES"	   for state SYN-RECEIVED of RFC793.	   It is broken, however, it does not work only	   when SYNs are crossed.	   You would think that SYN crossing is impossible here, since	   we should have a SYN_SENT socket (from connect()) on our end,	   but this is not true if the crossed SYNs were sent to both	   ends by a malicious third party.  We must defend against this,	   and to do that we first verify the ACK (as per RFC793, page	   36) and reset if it is invalid.  Is this a true full defense?	   To convince ourselves, let us consider a way in which the ACK	   test can still pass in this 'malicious crossed SYNs' case.	   Malicious sender sends identical SYNs (and thus identical sequence	   numbers) to both A and B:		A: gets SYN, seq=7		B: gets SYN, seq=7	   By our good fortune, both A and B select the same initial	   send sequence number of seven :-)		A: sends SYN|ACK, seq=7, ack_seq=8		B: sends SYN|ACK, seq=7, ack_seq=8	   So we are now A eating this SYN|ACK, ACK test passes.  So	   does sequence test, SYN is truncated, and thus we consider	   it a bare ACK.	   If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this	   bare ACK.  Otherwise, we create an established connection.  Both	   ends (listening sockets) accept the new incoming connection and try	   to talk to each other. 8-)	   Note: This case is both harmless, and rare.  Possibility is about the	   same as us discovering intelligent life on another plant tomorrow.	   But generally, we should (RFC lies!) to accept ACK	   from SYNACK both here and in tcp_rcv_state_process().	   tcp_rcv_state_process() does not, hence, we do not too.	   Note that the case is absolutely generic:	   we cannot optimize anything here without	   violating protocol. All the checks must be made	   before attempt to create socket.	 */	/* RFC793 page 36: "If the connection is in any non-synchronized state ...	 *                  and the incoming segment acknowledges something not yet	 *                  sent (the segment carries an unaccaptable ACK) ...	 *                  a reset is sent."	 *	 * Invalid ACK: reset will be sent by listening socket	 */	if ((flg & TCP_FLAG_ACK) &&	    (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))		return sk;	/* Also, it would be not so bad idea to check rcv_tsecr, which	 * is essentially ACK extension and too early or too late values	 * should cause reset in unsynchronized states.	 */	/* RFC793: "first check sequence number". */	if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,					  tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {		/* Out of window: send ACK and drop. */		if (!(flg & TCP_FLAG_RST))			req->rsk_ops->send_ack(skb, req);		if (paws_reject)			NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);		return NULL;	}	/* In sequence, PAWS is OK. */	if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))			req->ts_recent = tmp_opt.rcv_tsval;		if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {			/* Truncate SYN, it is out of window starting			   at tcp_rsk(req)->rcv_isn + 1. */			flg &= ~TCP_FLAG_SYN;		}		/* RFC793: "second check the RST bit" and		 *	   "fourth, check the SYN bit"		 */		if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN))			goto embryonic_reset;		/* ACK sequence verified above, just make sure ACK is		 * set.  If ACK not set, just silently drop the packet.		 */		if (!(flg & TCP_FLAG_ACK))			return NULL;		/* If TCP_DEFER_ACCEPT is set, drop bare ACK. */		if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&		    TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {			inet_rsk(req)->acked = 1;			return NULL;		}		/* OK, ACK is valid, create big socket and		 * feed this segment to it. It will repeat all		 * the tests. THIS SEGMENT MUST MOVE SOCKET TO		 * ESTABLISHED STATE. If it will be dropped after		 * socket is created, wait for troubles.		 */		child = tp->af_specific->syn_recv_sock(sk, skb, req, NULL);		if (child == NULL)			goto listen_overflow;		inet_csk_reqsk_queue_unlink(sk, req, prev);		inet_csk_reqsk_queue_removed(sk, req);		inet_csk_reqsk_queue_add(sk, req, child);		return child;	listen_overflow:		if (!sysctl_tcp_abort_on_overflow) {			inet_rsk(req)->acked = 1;			return NULL;		}	embryonic_reset:		NET_INC_STATS_BH(LINUX_MIB_EMBRYONICRSTS);		if (!(flg & TCP_FLAG_RST))			req->rsk_ops->send_reset(skb);		inet_csk_reqsk_queue_drop(sk, req, prev);		return NULL;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/caa20d9abe810be2ede9612b6c9db6ce7d6edf80/tcp_minisocks.c/buggy/net/ipv4/tcp_minisocks.c