Add a PacketImpact test for Ack behavior in SYN-RCVD

Updates #7199.

PiperOrigin-RevId: 429150157

test/packetimpact/runner/defs.bzl

@@ -307,6 +307,10 @@ ALL_TESTS = [
         name = "generic_dgram_socket_send_recv",
         timeout = "long",
     ),
+    PacketimpactTestInfo(
+        name = "tcp_acceptable_ack_syn_rcvd",
+        expect_netstack_failure = True,
+    ),
 ]
 
 def validate_all_tests():

test/packetimpact/tests/BUILD

@@ -15,6 +15,16 @@ packetimpact_testbench(
     ],
 )
 
+packetimpact_testbench(
+    name = "tcp_acceptable_ack_syn_rcvd",
+    srcs = ["tcp_acceptable_ack_syn_rcvd_test.go"],
+    deps = [
+        "//pkg/tcpip/header",
+        "//test/packetimpact/testbench",
+        "@org_golang_x_sys//unix:go_default_library",
+    ],
+)
+
 packetimpact_testbench(
     name = "ipv4_id_uniqueness",
     srcs = ["ipv4_id_uniqueness_test.go"],

test/packetimpact/tests/tcp_acceptable_ack_syn_rcvd_test.go

@@ -0,0 +1,70 @@
+// Copyright 2022 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package tcp_acceptable_ack_syn_rcvd_test
+
+import (
+	"flag"
+	"fmt"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/test/packetimpact/testbench"
+)
+
+func init() {
+	testbench.Initialize(flag.CommandLine)
+}
+
+func TestAcceptableAckInSynRcvd(t *testing.T) {
+	for _, tt := range []struct {
+		offset    uint32
+		expectRst bool
+	}{
+		{offset: 0, expectRst: true},
+		// The ACK holds the next expected SEQ so valid segments must hold an ACK
+		// that is 1 larger than the last SEQ value.
+		{offset: 1, expectRst: false},
+		{offset: 2, expectRst: true},
+	} {
+		t.Run(fmt.Sprintf("offset=%d, expectRst=%t", tt.offset, tt.expectRst), func(t *testing.T) {
+			dut := testbench.NewDUT(t)
+			listenFd, listenerPort := dut.CreateListener(t, unix.SOCK_STREAM, unix.IPPROTO_TCP, 1)
+			defer dut.Close(t, listenFd)
+			conn := dut.Net.NewTCPIPv4(t, testbench.TCP{DstPort: &listenerPort}, testbench.TCP{SrcPort: &listenerPort})
+			defer conn.Close(t)
+
+			conn.Send(t, testbench.TCP{Flags: testbench.TCPFlags(header.TCPFlagSyn)})
+
+			synAck, err := conn.Expect(t, testbench.TCP{Flags: testbench.TCPFlags(header.TCPFlagSyn | header.TCPFlagAck)}, time.Second)
+			if err != nil {
+				t.Fatalf("didn't get synack during handshake: %s", err)
+			}
+
+			// Calculate the ACK number.
+			ackNum := *synAck.SeqNum + tt.offset
+			conn.Send(t, testbench.TCP{AckNum: &ackNum, Flags: testbench.TCPFlags(header.TCPFlagAck)})
+
+			if tt.expectRst {
+				if _, err := conn.Expect(t, testbench.TCP{SeqNum: &ackNum, Flags: testbench.TCPFlags(header.TCPFlagRst)}, time.Second); err != nil {
+					t.Fatalf("failed to receive rst for an unacceptable ack: %s", err)
+				}
+			} else {
+				acceptFd, _ := dut.Accept(t, listenFd)
+				dut.Close(t, acceptFd)
+			}
+		})
+	}
+}