From: Florin Coras <fcoras@cisco.com>
Date: Fri, 6 Nov 2020 22:21:26 +0000 (-0800)
Subject: tcp: validate fin seq in closing states
X-Git-Tag: v21.06-rc0~194
X-Git-Url: https://gerrit.fd.io/r/gitweb?a=commitdiff_plain;h=c67724a224c8118d402fbe0d1c1cca6e7b01f892;p=vpp.git

tcp: validate fin seq in closing states

Type: fix

Signed-off-by: Florin Coras <fcoras@cisco.com>
Change-Id: Id8673cff699cfdc1ac68797b9ab5cdf6f6b578a3
---

diff --git a/src/vnet/tcp/tcp_input.c b/src/vnet/tcp/tcp_input.c
index 182062f1b42..912b193bf94 100644
--- a/src/vnet/tcp/tcp_input.c
+++ b/src/vnet/tcp/tcp_input.c
@@ -2386,6 +2386,9 @@ tcp46_rcv_process_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	case TCP_STATE_FIN_WAIT_2:
 	  if (vnet_buffer (b0)->tcp.data_len)
 	    error0 = tcp_segment_rcv (wrk, tc0, b0);
+	  /* Don't accept out of order fins lower */
+	  if (vnet_buffer (b0)->tcp.seq_end != tc0->rcv_nxt)
+	    goto drop;
 	  break;
 	case TCP_STATE_CLOSE_WAIT:
 	case TCP_STATE_CLOSING: