shadow icon indicating copy to clipboard operation
shadow copied to clipboard

Shadow doesn't send an RST response if server has no associated socket for incoming TCP packet

Open stevenengler opened this issue 3 years ago • 1 comments

If a host receives a TCP packet at a port that doesn't have a bound socket (no socket for the 5-tuple), the host just drops the packet without sending an RST packet.

https://github.com/shadow/shadow/blob/d8481e55e4239fd1f34bcf0ffd77aa05dd5cf98d/src/main/host/network_interface.c#L406-L411

This isn't super weird since normally a firewall will drop these packets, but in Shadow these are also dropped on localhost which is unexpected. In Shadow, a connect() on localhost to an unbound port will block forever (or until some timeout, I'm unsure which) since the connecting localhost socket will never receive a response.

Edit: Some discussion in #2679.

stevenengler avatar May 17 '22 21:05 stevenengler

The proper behaviour is probably to follow RFC 9293 3.10.7.1.:

If the state is CLOSED (i.e., TCB does not exist), then all data in the incoming segment is discarded. An incoming segment containing a RST is discarded. An incoming segment not containing a RST causes a RST to be sent in response. The acknowledgment and sequence field values are selected to make the reset sequence acceptable to the TCP endpoint that sent the offending segment.

If the ACK bit is off, sequence number zero is used,

<SEQ=0><ACK=SEG.SEQ+SEG.LEN><CTL=RST,ACK>

If the ACK bit is on,

<SEQ=SEG.ACK><CTL=RST>

Return.

In Shadow packets can only be sent from sockets, but we won't have a socket to send this rst packet from. We might want the network interface to have its own list of rst packets which it takes packets from when networkinterface_pop is called.

stevenengler avatar Aug 25 '23 13:08 stevenengler