tcp: improve SEG.ACK validation

[tuexen]

Summary

Implement the improved SEG.ACK validation described in RFC 5961. In addition to that, also detect ghost ACKs, which are ACKs for data that has never been sent.

The additional checks are enabled by default, but can be disabled by setting the sysctl-variable net.inet.tcp.insecure-ack to a non-zero value.

This issue was reported in PR 250357.

[tuexen]

Improve output of netstat -sptcp.

[cc]

After reading the paper and IETF slides, it looks good to me on top of the general view. Just some small concerns below.

sys/netinet/tcp_input.c

2244

At the server side (listening side), I am thinking if we move the secure ACK check here and above the TOF_TS check, it would save cycles on checking these timestamps.

2447–2448

code style: As there are two lines, recommend using a pair of {} for readability.

sys/netinet/tcp_stacks/bbr.c

7715–7716

code style:
Same here. As there are two lines, recommend using a pair of {} for readability.

sys/netinet/tcp_stacks/rack.c

12476–12477

code style:
Same here. As there are two lines, recommend using a pair of {} for readability.

[tuexen]

sys/netinet/tcp_input.c

2244

This patch is only about improving the input validation, not about changing the sequence of checks.
Please note that RFC 7323 requires to perform the timestamp checks before the SEG.ACK number checks.

[tuexen]

Always use the stricter check and address style issues reported by cc@.

[tuexen]

sys/netinet/tcp_input.c

2447–2448

Fixed.

sys/netinet/tcp_stacks/bbr.c

7715–7716

Fixed.

sys/netinet/tcp_stacks/rack.c

12476–12477

Fixed.

[cc]

Thanks for the update. Looks better and just a small concern about TCP_MAXWIN for 65535.

sys/netinet/tcp_input.c

2244

I see, in the section 5.3. Basic PAWS Algorithm from RFC7323 claims Also, PAWS processing MUST take precedence over the regular TCP acceptability check (Section 3.3 in [RFC0793]), which is performed after verification of the received Timestamps option...

2446

Can use TCP_MAXWIN instead of 65535.

[tuexen]

sys/netinet/tcp_input.c

2446

Fixed in 37b3e6a660f551ceda412e2115748f3b97b2e615, since this review has already been committed.

[tuexen]

This has been committed in [[ https://cgit.FreeBSD.org/src/commit/?id=646c28ea80cb0f9258386626297495b5a0e56db5

646c28ea80cb ]].