linux-kernel - TCP stack bug related to F-RTO?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <427999.33681.qm@web63406.mail.re1.yahoo.com>
Date:	Thu, 24 Sep 2009 10:43:19 -0700 (PDT)
From:	Joe Cao <caoco2002@...oo.com>
To:	linux-kernel@...r.kernel.org
Cc:	jcaoco2002@...oo.com
Subject: TCP stack bug related to F-RTO?

Hello,

I have found the following behavior with different versions of linux kernel. The attached pcap trace is collected with server (192.168.0.13) running 2.6.24 and shows the problem. Basically the behavior is like this:

1. The client opens up a big window,
2. the server sends 19 packets in a row (pkt #14- #32 in the trace), but all of them are dropped due to some congestion.
3. The server hits RTO and retransmits pkt #14 in #33
4. The client immediately acks #33 (=#14), and the server (seems like to enter F-RTO) expends the window and sends *NEW* pkt #35 & #36.=A0 Timeoute is doubled to 2*RTO; The client immediately sends two Dup-ack to #35 and #36.
5. after 2*RTO, pkt #15 is retransmitted in #39.
6. The client immediately acks #39 (=#15) in #40, and the server continues to expand the window and sends two *NEW* pkt #41 & #42. Now the timeoute is doubled to 4 *RTO.
8. After 4*RTO timeout, #16 is retransmitted.
9....
10. The above steps repeats for retransmitting pkt #16-#32 and each time the timeout is doubled.
11. It takes a long long time to retransmit all the lost packets and before that is done, the client sends a RST because of timeout.

The above behavior looks like F-RTO is in effect.  And there seems to be a bug in the TCP's congestion control and retransmission algorithm. Why doesn't the TCP on server (running 2.6.24) enter the slow start? Why should the server take that long to recover from a short period of packet loss?

Has anyone else noticed similar problem before?  If my analysis was wrong, can anyone gives me some pointers to what's really wrong and how to fix it?

Thanks a lot,
Joe

PS. Please cc me when this message is replied.

Download attachment "frto.pcap.7" of type "application/octet-stream" (73622 bytes)