netdev - Re: strange Mac OSX RST behavior

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d2aefee2-b11d-b93e-d3ad-6b4202bc7852@akamai.com>
Date:	Fri, 22 Jul 2016 17:08:27 -0400
From:	Jason Baron <jbaron@...mai.com>
To:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
CC:	Rick Jones <rick.jones2@....com>, <linux-kernel@...r.kernel.org>,
	<netdev@...r.kernel.org>, <davem@...emloft.net>,
	<eric.dumazet@...il.com>
Subject: Re: strange Mac OSX RST behavior

Hi,

After looking at this further we found that there is actually
a rate limit on 'rst' packets sent by OSX on a closed socket.
Its set to 250 per second and controlled via:
net.inet.icmp.icmplim. Increasing that limit resolves the
issue, but the default is apparently 250.

Thanks,

-Jason

On 07/01/2016 02:16 PM, One Thousand Gnomes wrote:
>> yes, we do in fact see a POLLRDHUP from the FIN in this case and
>> read of zero, but we still have more data to write to the socket, and
>> b/c the RST is dropped here, the socket stays in TIME_WAIT until
>> things eventually time out...
> After the FIN when you send/retransmit your next segment do you then get
> a valid RST back from the Mac end?
>
> Alan