Question regarding RST packet and the tcp stack

[Charles Swiger]

On Nov 14, 2013, at 5:35 AM, Andrew Schmidt <Andrew.Schmidt at impactmobile.com> wrote:
> The OS on the host receives the following packets in order for that socket:
> 
> Data packet (6 bytes)
> FIN packet
> RST packet
> 
> At this point the application (host) tries to read from the socket.    On windows,  this causes a "the os has closed the connection" exception and doesn't let you read those 6 bytes.
> 
> On Linux, those 6 bytes can be read.

Yes, that's correct behavior (assuming the data received fits within the open window).

> I've looked over the TCP rfc:  http://www.rfc-editor.org/rfc/rfc1122.txt .

The TCP RFC is: http://www.ietf.org/rfc/rfc793.txt

> But it's not clear what should happen to 6 bytes once a RST packet arrives.
> 
> Does anyone know what the correct behaviour is?  Or point me to freebsd's tcp stack code?

See section 3.5 of RFC 793:

"3.5.  Closing a Connection

  CLOSE is an operation meaning "I have no more data to send."  The
  notion of closing a full-duplex connection is subject to ambiguous
  interpretation, of course, since it may not be obvious how to treat
  the receiving side of the connection.  We have chosen to treat CLOSE
  in a simplex fashion.  The user who CLOSEs may continue to RECEIVE
  until he is told that the other side has CLOSED also.  Thus, a program
  could initiate several SENDs followed by a CLOSE, and then continue to
  RECEIVE until signaled that a RECEIVE failed because the other side
  has CLOSED.  We assume that the TCP will signal a user, even if no
  RECEIVEs are outstanding, that the other side has closed, so the user
  can terminate his side gracefully.  A TCP will reliably deliver all
  buffers SENT before the connection was CLOSED so a user who expects no
  data in return need only wait to hear the connection was CLOSED
  successfully to know that all his data was received at the destination
  TCP.  Users must keep reading connections they close for sending until
  the TCP says no more data."

Regards,
-- 
-Chuck