Re: [PATCH 3/4] tcp: Don't consider FIN flags with mismatching sequence

[Stefano Brivio <sbrivio@redhat.com>]

On Thu, 2 Oct 2025 13:02:09 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> On Thu, Oct 02, 2025 at 12:52:31PM +1000, David Gibson wrote:
> > On Thu, Oct 02, 2025 at 02:06:45AM +0200, Stefano Brivio wrote:  
> > > If a guest or container sends us a FIN segment but its sequence number
> > > doesn't match the highest sequence of data we *accepted* (not
> > > necessarily the highest sequence we received), that is,
> > > conn->seq_from_tap, plus any data we're accepting in the current
> > > batch, we should discard the flag (not necessarily the segment),
> > > because there's still data we need to receive (again) before the end
> > > of the stream.
> > > 
> > > If we consider those FIN flags as such, we'll end up in the
> > > situation described below.
> > > 
> > > Here, 192.168.10.102 is a HTTP server in a Podman container, and
> > > 192.168.10.44 is a client fetching approximately 121 KB of data from
> > > it:
> > > 
> > >    82   2.026811 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [FIN, ACK] Seq=121441 Ack=143 Win=65536 Len=0
> > > 
> > > the server is done sending
> > > 
> > >    83   2.026898 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [ACK] Seq=143 Ack=114394 Win=216192 Len=0
> > > 
> > > pasta (client) acknowledges a previous sequence, because of
> > > a short sendmsg()
> > > 
> > >    84   2.027324 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [FIN, ACK] Seq=143 Ack=114394 Win=216192 Len=0
> > > 
> > > pasta (client) sends FIN, ACK as the client has no more data to
> > > send (a single GET request), while still acknowledging a previous
> > > sequence, because the retransmission didn't happen yet
> > > 
> > >    85   2.027349 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [ACK] Seq=121442 Ack=144 Win=65536 Len=0
> > > 
> > > the server acknowledges the FIN, ACK
> > > 
> > >    86   2.224125 192.168.10.102 → 192.168.10.44 4150 TCP [TCP Retransmission] 55414 → 44992 [ACK] Seq=114394 Ack=144 Win=65536 Len=4096 [TCP segment of a reassembled PDU]
> > > 
> > > and finally a retransmission comes, but as we wrongly switched to
> > > the CLOSE-WAIT state,
> > > 
> > >    87   2.224202 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [RST] Seq=144 Win=0 Len=0
> > > 
> > > we consider frame #86 as an acknowledgement for the FIN segment we
> > > sent, and close the connection, while we still had to re-receive
> > > (and finally send) the missing data segment, instead.
> > > 
> > > Link: https://github.com/containers/podman/issues/27179
> > > Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
> > > ---
> > >  tcp.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/tcp.c b/tcp.c
> > > index 3f7dc82..5a7a607 100644
> > > --- a/tcp.c
> > > +++ b/tcp.c
> > > @@ -1769,7 +1769,7 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn,
> > >  			}
> > >  		}
> > >  
> > > -		if (th->fin)
> > > +		if (th->fin && seq == seq_from_tap)
> > >  			fin = 1;  
> > 
> > Can a FIN segment also contain data?  My quick googling suggests yes.

Yes, absolutely, my slow wiresharking over the years also confirms, and
it's so often the case that (I think) this issue doesn't happen so
frequently as it only occurs if we have a FIN segment without data.

If we have a data segment, with FIN set, that we can't fully transmit,
we already set 'partial_send' and won't set TAP_FIN_RCVD as a result.

Another case where we want to ignore a FIN segment with data is if we
have a gap before it, but in that case we'll eventually set 'keep' and
return early.

> > If so, doesn't this logic need to go after we process the data
> > processing, so that seq_from_tap points to the end of the packet's
> > data, rather than the beginning?  (And the handling of zero-length
> > packets would also need revision to match).  

This made sense to me for a moment but now I'm struggling to understand
or remember why. What I want to check here is that a FIN segment
without data (I should have specified in the commit message) is
acceptable because its sequence is as expected.

But going back to FIN segments with data: why should we sum the length
to seq_from_tap before comparing the sequence? I don't understand what
additional check you want to introduce, or what case you want to cover.

> Following on from that, it seems to me like it would make sense for
> FIN segments to also participate in the 'keep' mechanism.  It should
> work eventually, but I expect it would be smoother in the case that we
> get a final burst of packets in a stream out of order.

FIN segments with data already go through that dance.

Without data, I guess you're right, we might have in the same batch
(not that I've ever seen it happening in practice) a FIN segment
without data that we process first (and now discard because of the
sequence number), and some data before that we process later, so we
shouldn't throw away the FIN segment because of that. We should,
conceptually, reorder it as well.

It probably makes things more complicated for a reason that's not so
critical (ignoring a FIN is fine, we'll get another one), and I wanted
to have the simplest possible fix here.

Let me see if I can make this entirely correct without a substantially
bigger change, I haven't really tried.

-- 
Stefano