From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202502 header.b=bt773nSk; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 551CD5A0272 for ; Mon, 03 Feb 2025 10:25:22 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202502; t=1738574694; bh=7/cdW/4OxhASBrqc9uK5acYSWnxBonBv8m3lkOeOz40=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=bt773nSk+KWkfLaS1Jv/7NRUREOJes5vlR8gGkVrsRokF2oK5JtV6bH3HkNS7J8/P k7wwyA9N7xEW7LobBLXW8Bhe+/IACnnZLP33RxJrWDmt+bPsTtxjIFLvLR7y8CozUu lfXEw67DkQ6OkY1smp9rK/2Tl5OJXQ+MfFT6mVvXULEauYy8NI6RwPzSOWVQsx2see 4YbXGAkR4p5wqwELVSelc3QMG4EHKKQk01fDJ97jPfj6MEkBLHCaOvm0F/kGYqntn2 rIqXAciDNhhQ7MwpffVJAWK93ZSqong4g6u18SI7SPQo5R8+SwQ3NXIY1IznOXTSVx JaWw0M84tPoCw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4Ymh0k3V16z4wyr; Mon, 3 Feb 2025 20:24:54 +1100 (AEDT) Date: Mon, 3 Feb 2025 20:08:25 +1100 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH] tcp: Don't reset outbound connection on SYN retries Message-ID: References: <20250203072558.2075496-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="PKKR6eRuDU5/Y5qk" Content-Disposition: inline In-Reply-To: <20250203072558.2075496-1-sbrivio@redhat.com> Message-ID-Hash: FCWX5QXBL5W6ZRULLVDJAIB7PAZAJ7VT X-Message-ID-Hash: FCWX5QXBL5W6ZRULLVDJAIB7PAZAJ7VT X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --PKKR6eRuDU5/Y5qk Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Feb 03, 2025 at 08:25:58AM +0100, Stefano Brivio wrote: > Reported by somebody on IRC: if the server has considerable latency, > it might happen that the client retries sending SYN segments for the > same flow while we're still in a TAP_SYN_RCVD, non-ESTABLISHED state. >=20 > In that case, we should go with the blanket assumption that we need > to reset the connection on any unexpected segment: RFC 9293 explicitly > mentions this case in Figure 8: Recovery from Old Duplicate SYN, > section 3.5. It doesn't make sense for us to set a specific sequence > number, socket-side, but we should definitely wait and see. >=20 > Ignoring the duplicate SYN segment should also be compatible with > section 3.10.7.3. SYN-SENT STATE, which mentions updating sequences > socket-side (which we can't do anyway), but certainly not reset the > connection. >=20 > Signed-off-by: Stefano Brivio I haven't dug into the RFC to check this thoroughly, but it makes intuitive sense to me. Reviewed-by: David Gibson > --- > tcp.c | 3 +++ > 1 file changed, 3 insertions(+) >=20 > diff --git a/tcp.c b/tcp.c > index 7787381..51ad692 100644 > --- a/tcp.c > +++ b/tcp.c > @@ -1920,6 +1920,9 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pi= f, sa_family_t af, > =20 > /* Establishing connection from tap */ > if (conn->events & TAP_SYN_RCVD) { > + if (th->syn && !th->ack && !th->fin) > + return 1; /* SYN retry: ignore and keep waiting */ > + > if (!(conn->events & TAP_SYN_ACK_SENT)) > goto reset; > =20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --PKKR6eRuDU5/Y5qk Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmegh4gACgkQzQJF27ox 2Ge4FA/6A0ZV6PV1tE9sN/wqpF9pONt50PrRlXCfl0qbbXyH8SU6Hx5FHYVnjfHL bg2EFxLQyYYM7JEnuSoKlyVZjZBYgmaGTDvbcbconZx7k9q7QeseOQGebqJs8tz4 nEzsoMU4kAJ6pf74V0CFu2MjlUMQEZ6pyKfXVixf2pn7Mqb5mwBQHlse7V0ObLnG 4Qvscp1kNso8Eg0XZct8d2fG4N+nsFOAEzsn2u8riR+q2+I59FCcFaOO2C9xo/zg S/qIrLpQAyM2Y+cvRZyVzn/VqX/2ZHmDOv1vfrz8dQ+g8dbFCEvACU9RRbjrvehv QL/LJTf600fHFxzZK4TxSBowXC3qe3OrJ9NZIMgKi8wtcxK+5hHrrQb+BsUebxFm vjyi0dj3Tg0HKJRx/dYPz1jGnqwin1kZUaaGljHQZwlvuccztDmT4x9y7gybZdO3 0mX+55NF+dTBKtQ3/9hvF/CUwr62Y576CvA70Rx43nmjLL/bjf5Cc4qipVh8poJr UvMeBGG7F3S2JQkjWLIzws9GXTvXlQGP3Sp5L8SXtWeGneMys0jpaOH9B5w/SO7z XYDJB8Y+UBMGvbf3G5fLkHGN6LteGWfhrd9s/+sWHpuPF6bdM9vf5bwzylG6R6uG 4ZUsk95CjY2Zb6viCdb+q/2JjV0NYjMfzLB2QkQpeiHlXKCNG08= =Zj7Y -----END PGP SIGNATURE----- --PKKR6eRuDU5/Y5qk--