From 5dc962affc07e6f8f449d56836476cb2350570ce Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Sun, 17 Nov 2024 11:08:19 +0100 Subject: tcp: Properly ignore keep-alive segments RFC 9293, 3.8.4 says: Implementers MAY include "keep-alives" in their TCP implementations (MAY-5), although this practice is not universally accepted. Some TCP implementations, however, have included a keep-alive mechanism. To confirm that an idle connection is still active, these implementations send a probe segment designed to elicit a response from the TCP peer. Such a segment generally contains SEG.SEQ = SND.NXT-1 and may or may not contain one garbage octet of data. If keep-alives are included, the application MUST be able to turn them on or off for each TCP connection (MUST-24), and they MUST default to off (MUST-25). but currently, tcp_data_from_tap() is not aware of this and will schedule a fast re-transmit on the second keep-alive (because it's also a duplicate ACK), ignoring the fact that the sequence number was rewinded to SND.NXT-1. All we have to do with those segments is to reset the activity timeout, and ignore them for the rest. We can't affect the outbound keep-alive behaviour, other than enabling or disabling keep-alives with SO_KEEPALIVE, because it's controlled by sysctls. Link: https://github.com/containers/podman/discussions/24572 Signed-off-by: Stefano Brivio --- tcp.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/tcp.c b/tcp.c index f357920..4a89c6c 100644 --- a/tcp.c +++ b/tcp.c @@ -1763,6 +1763,19 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn, continue; seq = ntohl(th->seq); + if (SEQ_LT(seq, conn->seq_from_tap) && len <= 1) + flow_trace(conn, + "keep-alive sequence: %u, previous: %u", + seq, conn->seq_from_tap); + + tcp_timer_ctl(c, conn); + + if (p->count == 1) + return 1; + + continue; + } + ack_seq = ntohl(th->ack_seq); if (th->ack) { -- cgit v1.2.3