lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 19 Aug 2013 06:24:17 -0700 From: Eric Dumazet <eric.dumazet@...il.com> To: Christoph Paasch <christoph.paasch@...ouvain.be> Cc: Corey Hickey <bugfood-ml@...ooh.org>, Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>, Linux Netdev List <netdev@...r.kernel.org>, netfilter-devel@...r.kernel.org Subject: Re: NAT stops forwarding ACKs after PMTU discovery On Mon, 2013-08-19 at 14:33 +0200, Christoph Paasch wrote: > Hello, > > I would say, the problem is due to a sequence-number rewriting > middlebox, who does not correctly handle the SACK-blocks. > > In remote.pcap, you see: > Packet#10: A Dup-ACK: ACK 1005503816, SACK: 1005505184-1005505648 > The SACK actually covers Packet#9 > > In tun0.pcap, you have: > Packet#9: The one that is SACK'ed: SEQ: 3514869772 > Packet#11: The Dup-ACK: ACK: 3514868404, SACK: 3570452498-3570452962 > > You can see that the SACK-block is not really aligned with the ACK-numbers. > > Netfilter is probably dropping the Dup-ACK, because the SACK-block is > acknowledging unseen data. > > > There are middleboxes out there that randomize the sequence numbers, due to > an old bug in Windows, where the initial sequence number was not > sufficiently randomized. There are some of these middleboxes, who simply do > not support SACK, thus modify only the sequence numbers of the TCP-header > (https://supportforums.cisco.com/docs/DOC-12668#TCP_Sequence_Number_Randomization_and_SACK). > > This results in a TCP retransmission timeout on the sender, because of > the invalid SACK-blocks, the duplicate ACKs are not accounted. This > completly kills the performance, as you can see in our presentation given at > IETF87: http://tools.ietf.org/agenda/87/slides/slides-87-tcpm-11.pdf > > We have a patch that accounts DUP-ACKs with invalid SACK-blocks effectively > as duplicate acknowledgments. I can send the patches, if the > netdev-community is interested in accepting these upstream. > You mean a netfilter patch, a tcp patch, or both ? -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists