libcsp icon indicating copy to clipboard operation
libcsp copied to clipboard

RDP: ACK unconditionally accepted via RST + ACK

Open martinerikwerner-aac opened this issue 2 years ago • 2 comments

If a RST + ACK segment arrives in the OPEN state, the ACK is accepted unconditionally:

https://github.com/libcsp/libcsp/blob/ba15bf68a78c1397aaaa7673426ff9ccb44bad35/src/csp_rdp.c#L525-L531

regardless if the ACK is inside the current expected window, or if the received segment has a sequence number that is outside the expected window (which would cause the RST part to be ignored)

Is this intentional?

It seems like this would mean that if a receiver with:

state == OPEN;
snd_una == 1234;
rcv_cur == 2345;

would receive a segment with:

flags == RST | ACK;
seq_nr == 0;
ack_nr == 0;

it would then accept this as a valid ACK and set snd_una = 1 and then ignore the RST as being out of sequence.

It does not seem like this is a thing that it should be accepting in this case?

martinerikwerner-aac avatar May 07 '22 12:05 martinerikwerner-aac

That sounds correct. I'm not sure the code would ever send a reset + ack though. This needs to be investigated further.

johandc avatar May 11 '22 06:05 johandc

ACK + RST are being used in these places at the moment:

https://github.com/libcsp/libcsp/blob/ba15bf68a78c1397aaaa7673426ff9ccb44bad35/src/csp_rdp.c#L791

https://github.com/libcsp/libcsp/blob/ba15bf68a78c1397aaaa7673426ff9ccb44bad35/src/csp_rdp.c#L966

https://github.com/libcsp/libcsp/blob/ba15bf68a78c1397aaaa7673426ff9ccb44bad35/src/csp_rdp.c#L552

martinerikwerner-aac avatar May 11 '22 07:05 martinerikwerner-aac