netdev - Re: TCP connection closed without FIN or RST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1510162142.2849.106.camel@edumazet-glaptop3.roam.corp.google.com>
Date:   Wed, 08 Nov 2017 09:29:02 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Vitaly Davidovich <vitalyd@...il.com>
Cc:     netdev <netdev@...r.kernel.org>
Subject: Re: TCP connection closed without FIN or RST

Please do not top post on netdev.

On Wed, 2017-11-08 at 11:04 -0500, Vitaly Davidovich wrote:
> So this issue is somehow related to setting SO_RCVBUF *after*
> connecting the socket (from the client).  The system is configured
> such that the default rcvbuf size is 1MB, but the code was shrinking
> this down to 75Kb right after connect(). 

What are you calling default rcvbuf size exactly ?

Is the application doing 

 s = socket(...);
 ...
 setsockopt(s, SOL_SOCKET, SO_RCVBUF, [1000000], 4)
 ...
 connect(s, ...)
 setsockopt(s, SOL_SOCKET, SO_RCVBUF, [75000], 4)
 

>  I think that explains why
> the window size advertised by the client was much larger than
> expected.  I see that the kernel does not want to shrink the
> previously advertised window without advancement in the sequence
> space.  So my guess is that the client runs out of buffer and starts
> dropping packets.  Not sure how to further debug this from userspace
> (systemtap? bpf?) - any tips on that front would be appreciated.


You could provide a packet capture (tcpdump) for a start ;)