The tale of a TCP bug

[Stefan `Sec` Zehl]

Hi,

> On Fri, Mar 25, 2011 at 16:40 -0400, John Baldwin wrote:
> > And the problem is that the code that uses 'adv' to determine if it
> > sound send a window update to the remote end is falsely succeeding due
> > to the overflow causing tcp_output() to 'goto send' but that it then
> > fails to send any data because it thinks the remote window is full?

On a whim I wanted to find out, how often that overflow is triggered in
normal operation, and whipped up a quick counter-sysctl.

--- sys/netinet/tcp_output.c.org	2011-01-04 19:27:00.000000000 +0100
+++ sys/netinet/tcp_output.c	2011-03-26 18:49:30.000000000 +0100
@@ -87,6 +87,11 @@
 extern struct mbuf *m_copypack();
 #endif
 
+VNET_DEFINE(int, adv_neg) = 0;
+SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, adv_neg, CTLFLAG_RD,
+   &VNET_NAME(adv_neg), 1,
+   "How many times adv got negative");
+
 VNET_DEFINE(int, path_mtu_discovery) = 1;
 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, path_mtu_discovery, CTLFLAG_RW,
 	&VNET_NAME(path_mtu_discovery), 1,
@@ -573,6 +578,10 @@
 		long adv = min(recwin, (long)TCP_MAXWIN << tp->rcv_scale) -
 			(tp->rcv_adv - tp->rcv_nxt);
 
+		if(min(recwin, (long)TCP_MAXWIN << tp->rcv_scale) <
+				(tp->rcv_adv - tp->rcv_nxt))
+			adv_neg++;
+
 		if (adv >= (long) (2 * tp->t_maxseg))
 			goto send;
 		if (2 * adv >= (long) so->so_rcv.sb_hiwat)

I booted my main (web/shell) box with (only) this patch:

11:36PM  up  3:50, 1 user, load averages: 2.29, 1.51, 0.73
net.inet.tcp.adv_neg: 2466

That's approximately once every 5 seconds. That's way more often than I
suspected.

CU,
    Sec
-- 
I  wish  there was a knob on the TV to turn up the intelligence.
There's a knob called "brightness", but it doesn't seem to work.