TCP urg pointer bug + fix

Mattias =?ISO-8859-1?Q?Engdeg=E5rd (f91-men@nada.kth.se)
Sun, 25 Apr 1999 00:08:11 +0200 (MET DST)


Solaris 2.6 (perhaps Solaris 7 too) sends some packets with the URG flag and
zero offset. For instance,

send(s, "a", 1, MSB_OOB);
send(s, "b", 1, 0);

generates one packet containing "a", urg 1, and the next containing "b", urg 0.
Linux (at least 2.0 - 2.2.6) has problems with this, and often loses the
OOB character. This happens when telnetting from Linux to a Solaris box
(kerberos telnet/telnetd); telnetd sends Data Mark (DM) as TCP urgent data,
and Linux eats the IAC of the DM. (The encryption states are then out
of synch and the connection is unusable.)

This seems to fix it (apply to 2.2.6),

--- net/ipv4/tcp_input.c~ Wed Mar 17 21:39:13 1999
+++ net/ipv4/tcp_input.c Sat Apr 24 21:36:57 1999
@@ -1621,7 +1621,7 @@
struct tcp_opt *tp = &(sk->tp_pinfo.af_tcp);
u32 ptr = ntohs(th->urg_ptr);

- if (ptr && !sysctl_tcp_stdurg)
+ if (!sysctl_tcp_stdurg)
ptr--;
ptr += ntohl(th->seq);

but I would welcome the opinion of some knowledgeable TCP hacker first,
before I send it to Linus.
(Why would the off-by-one correction not apply when the urg offset is zero?)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/