Re: [PATCH 3/4] tcp: Don't consider FIN flags with mismatching sequence

On Thu, 2 Oct 2025 13:02:09 +1000 David Gibson wrote:

On Thu, Oct 02, 2025 at 12:52:31PM +1000, David Gibson wrote:

...

On Thu, Oct 02, 2025 at 02:06:45AM +0200, Stefano Brivio wrote:

...

If a guest or container sends us a FIN segment but its sequence number doesn't match the highest sequence of data we *accepted* (not necessarily the highest sequence we received), that is, conn->seq_from_tap, plus any data we're accepting in the current batch, we should discard the flag (not necessarily the segment), because there's still data we need to receive (again) before the end of the stream.

If we consider those FIN flags as such, we'll end up in the situation described below.

Here, 192.168.10.102 is a HTTP server in a Podman container, and 192.168.10.44 is a client fetching approximately 121 KB of data from it:

82 2.026811 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [FIN, ACK] Seq=121441 Ack=143 Win=65536 Len=0

the server is done sending

83 2.026898 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [ACK] Seq=143 Ack=114394 Win=216192 Len=0

pasta (client) acknowledges a previous sequence, because of a short sendmsg()

84 2.027324 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [FIN, ACK] Seq=143 Ack=114394 Win=216192 Len=0

pasta (client) sends FIN, ACK as the client has no more data to send (a single GET request), while still acknowledging a previous sequence, because the retransmission didn't happen yet

85 2.027349 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [ACK] Seq=121442 Ack=144 Win=65536 Len=0

the server acknowledges the FIN, ACK

86 2.224125 192.168.10.102 → 192.168.10.44 4150 TCP [TCP Retransmission] 55414 → 44992 [ACK] Seq=114394 Ack=144 Win=65536 Len=4096 [TCP segment of a reassembled PDU]

and finally a retransmission comes, but as we wrongly switched to the CLOSE-WAIT state,

87 2.224202 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [RST] Seq=144 Win=0 Len=0

we consider frame #86 as an acknowledgement for the FIN segment we sent, and close the connection, while we still had to re-receive (and finally send) the missing data segment, instead.

Link: https://github.com/containers/podman/issues/27179 Signed-off-by: Stefano Brivio --- tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcp.c b/tcp.c index 3f7dc82..5a7a607 100644 --- a/tcp.c +++ b/tcp.c @@ -1769,7 +1769,7 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn, } }

- if (th->fin) + if (th->fin && seq == seq_from_tap) fin = 1;

Can a FIN segment also contain data? My quick googling suggests yes.

Yes, absolutely, my slow wiresharking over the years also confirms, and it's so often the case that (I think) this issue doesn't happen so frequently as it only occurs if we have a FIN segment without data. If we have a data segment, with FIN set, that we can't fully transmit, we already set 'partial_send' and won't set TAP_FIN_RCVD as a result. Another case where we want to ignore a FIN segment with data is if we have a gap before it, but in that case we'll eventually set 'keep' and return early.

...

If so, doesn't this logic need to go after we process the data processing, so that seq_from_tap points to the end of the packet's data, rather than the beginning? (And the handling of zero-length packets would also need revision to match).

This made sense to me for a moment but now I'm struggling to understand or remember why. What I want to check here is that a FIN segment without data (I should have specified in the commit message) is acceptable because its sequence is as expected. But going back to FIN segments with data: why should we sum the length to seq_from_tap before comparing the sequence? I don't understand what additional check you want to introduce, or what case you want to cover.

Following on from that, it seems to me like it would make sense for FIN segments to also participate in the 'keep' mechanism. It should work eventually, but I expect it would be smoother in the case that we get a final burst of packets in a stream out of order.

FIN segments with data already go through that dance. Without data, I guess you're right, we might have in the same batch (not that I've ever seen it happening in practice) a FIN segment without data that we process first (and now discard because of the sequence number), and some data before that we process later, so we shouldn't throw away the FIN segment because of that. We should, conceptually, reorder it as well. It probably makes things more complicated for a reason that's not so critical (ignoring a FIN is fine, we'll get another one), and I wanted to have the simplest possible fix here. Let me see if I can make this entirely correct without a substantially bigger change, I haven't really tried. -- Stefano