This patch fixes the problem where the current TCP code can not handle

simultaneous open. Both the bug and the patch were verified using the
ANVL test suite.

PR:		kern/74935
Submitted by:	qingli (before I became committer)
Reviewed by:	andre
MFC after:	5 days

3 files changed, 4 insertions, 3 deletions

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index ae12e82..d4e8b58 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1421,7 +1421,7 @@ after_listen:
 			 *        SYN-SENT* -> SYN-RECEIVED*
 			 * If there was no CC option, clear cached CC value.
 			 */
-			tp->t_flags |= TF_ACKNOW;
+			tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
 			callout_stop(tp->tt_rexmt);
 			tp->t_state = TCPS_SYN_RECEIVED;
 		}
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index f68c2d9..ead2c1a 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -338,7 +338,8 @@ after_sack_rexmit:
 	 * know that foreign host supports TAO, suppress sending segment.
 	 */
 	if ((flags & TH_SYN) && SEQ_GT(tp->snd_nxt, tp->snd_una)) {
-		flags &= ~TH_SYN;
+		if (tp->t_state != TCPS_SYN_RECEIVED)
+			flags &= ~TH_SYN;
 		off--, len++;
 	}
 
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c
index ae12e82..d4e8b58 100644
--- a/sys/netinet/tcp_reass.c
+++ b/sys/netinet/tcp_reass.c
@@ -1421,7 +1421,7 @@ after_listen:
 			 *        SYN-SENT* -> SYN-RECEIVED*
 			 * If there was no CC option, clear cached CC value.
 			 */
-			tp->t_flags |= TF_ACKNOW;
+			tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
 			callout_stop(tp->tt_rexmt);
 			tp->t_state = TCPS_SYN_RECEIVED;
 		}