tls: fix connection failures/interrupts at scale (VPP-1464)

[vpp.git] / src / vnet / tcp / tcp_input.c

diff --git a/src/vnet/tcp/tcp_input.c b/src/vnet/tcp/tcp_input.c
index 3f36b69..d03388e 100644 (file)
--- a/src/vnet/tcp/tcp_input.c
+++ b/src/vnet/tcp/tcp_input.c
@@ -135,7 +135,8 @@ tcp_options_parse (tcp_header_t * th, tcp_options_t * to)
   data = (const u8 *) (th + 1);
 
   /* Zero out all flags but those set in SYN */
-  to->flags &= (TCP_OPTS_FLAG_SACK_PERMITTED | TCP_OPTS_FLAG_WSCALE);
+  to->flags &= (TCP_OPTS_FLAG_SACK_PERMITTED | TCP_OPTS_FLAG_WSCALE
+               | TCP_OPTS_FLAG_SACK);
 
   for (; opts_len > 0; opts_len -= opt_len, data += opt_len)
     {
@@ -1401,7 +1402,9 @@ process_ack:
       if (!tcp_in_cong_recovery (tc))
        return 0;
       *error = TCP_ERROR_ACK_DUP;
-      return vnet_buffer (b)->tcp.data_len ? 0 : -1;
+      if (vnet_buffer (b)->tcp.data_len || tcp_is_fin (th))
+       return 0;
+      return -1;
     }
 
   /*
@@ -2282,8 +2285,8 @@ tcp46_syn_sent_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
          if (tcp_opts_wscale (&new_tc0->rcv_opts))
            new_tc0->snd_wscale = new_tc0->rcv_opts.wscale;
 
-         /* RFC1323: SYN and SYN-ACK wnd not scaled */
-         new_tc0->snd_wnd = clib_net_to_host_u16 (tcp0->window);
+         new_tc0->snd_wnd = clib_net_to_host_u16 (tcp0->window)
+           << new_tc0->snd_wscale;
          new_tc0->snd_wl1 = seq0;
          new_tc0->snd_wl2 = ack0;
 
@@ -2672,9 +2675,12 @@ tcp46_rcv_process_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
              tc0->state = TCP_STATE_CLOSED;
              TCP_EVT_DBG (TCP_EVT_STATE_CHANGE, tc0);
-             /* Delete the connection/session since the pipes should be
-              * clear by now */
-             tcp_connection_del (tc0);
+
+             /* Don't free the connection from the data path since
+              * we can't ensure that we have no packets already enqueued
+              * to output. Rely instead on the waitclose timer */
+             tcp_connection_timers_reset (tc0);
+             tcp_timer_update (tc0, TCP_TIMER_WAITCLOSE, 1);
 
              goto drop;
 
@@ -2735,10 +2741,10 @@ tcp46_rcv_process_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
            case TCP_STATE_SYN_RCVD:
              /* Send FIN-ACK notify app and enter CLOSE-WAIT */
              tcp_connection_timers_reset (tc0);
-             tcp_retransmit_timer_set (tc0);
              tcp_make_fin (tc0, b0);
              tc0->snd_nxt += 1;
              tc0->snd_una_max = tc0->snd_nxt;
+             tcp_retransmit_timer_set (tc0);
              next0 = tcp_next_output (tc0->c_is_ip4);
              stream_session_disconnect_notify (&tc0->connection);
              tc0->state = TCP_STATE_CLOSE_WAIT;
@@ -3441,7 +3447,11 @@ do {                                                             \
   /* ACK for for a SYN-ACK -> tcp-rcv-process. */
   _(SYN_RCVD, TCP_FLAG_ACK, TCP_INPUT_NEXT_RCV_PROCESS, TCP_ERROR_NONE);
   _(SYN_RCVD, TCP_FLAG_RST, TCP_INPUT_NEXT_RCV_PROCESS, TCP_ERROR_NONE);
+  _(SYN_RCVD, TCP_FLAG_RST | TCP_FLAG_ACK, TCP_INPUT_NEXT_RCV_PROCESS,
+    TCP_ERROR_NONE);
   _(SYN_RCVD, TCP_FLAG_SYN, TCP_INPUT_NEXT_RCV_PROCESS, TCP_ERROR_NONE);
+  _(SYN_RCVD, TCP_FLAG_FIN | TCP_FLAG_ACK, TCP_INPUT_NEXT_RCV_PROCESS,
+    TCP_ERROR_NONE);
   /* SYN-ACK for a SYN */
   _(SYN_SENT, TCP_FLAG_SYN | TCP_FLAG_ACK, TCP_INPUT_NEXT_SYN_SENT,
     TCP_ERROR_NONE);
@@ -3482,6 +3492,7 @@ do {                                                              \
   _(LAST_ACK, TCP_FLAG_FIN | TCP_FLAG_ACK, TCP_INPUT_NEXT_RCV_PROCESS,
     TCP_ERROR_NONE);
   _(LAST_ACK, TCP_FLAG_RST, TCP_INPUT_NEXT_RCV_PROCESS, TCP_ERROR_NONE);
+  _(LAST_ACK, TCP_FLAG_SYN, TCP_INPUT_NEXT_RCV_PROCESS, TCP_ERROR_NONE);
   _(TIME_WAIT, TCP_FLAG_FIN, TCP_INPUT_NEXT_RCV_PROCESS, TCP_ERROR_NONE);
   _(TIME_WAIT, TCP_FLAG_FIN | TCP_FLAG_ACK, TCP_INPUT_NEXT_RCV_PROCESS,
     TCP_ERROR_NONE);