Send a RST when receiving a spurious TCP packet #32
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hlef
force-pushed
the
hlefeuvre/send-RST-reset-draft
branch
2 times, most recently
from
cce7dd9 to
0819835
Compare
Signed-off-by: Hugo Lefeuvre <hugo.lefeuvre@scisemi.com> (cherry picked from commit af215ef)
Spurious TCP packets appear when the system is force-restarting due to an error. In such a case, open TCP connections are not properly teared down, and the remote TCP endpoint sends retransmissions to the newly restarted system. These spurious TCP packets are problematic because they fill packet buffers and quickly cause packet drops. This commit enables the firewall to reply to spurious TCP packets with TCP RST to stop the flow of spurious packets. We do this with a TCP RST "packet template" which we pre-set at startup and complete with MAC address, IP address, port, sequence number, and checksum, when sending the RST. To do this, we need to: - add needed 32-bit `ntohs` and `htons` - add a representation of a TCP header in the firewall compartment Signed-off-by: Hugo Lefeuvre <hugo.lefeuvre@scisemi.com> (cherry picked from commit ec54006)
hlef
force-pushed
the
hlefeuvre/send-RST-reset-draft
branch
from
0819835 to
1e43540
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
One of the limitations of the network stack reset as it is now is that we do not close TCP connections (#31). This leads remote servers to send us retransmissions after the reset which, in the case of several consecutive resets, can result in packet flooding.
To address this limitation, we should send RST packets to remote hosts as part of the network stack reset process.
This Draft PR
This draft PR explores a solution to this problem where we send a RST packet upon receiving spurious TCP packets. As discussed with @davidchisnall this is not something we want to merge for the following reasons:
memcpy).Looking Forward
The reason why things are like this is time constraints (I did this at the end of my visit at SCI) and implementation complexity:
I am not able to pick up this PR and do these changes right now, but we can just keep the draft PR around so that whoever does so can re-use some of the code.