(fwd) TCP bug in 2.0.30 - increasing the sequence number after FIN

Jari Soderholm (jasoderh@atmweb.ntc.nokia.com)
Mon, 5 May 1997 10:28:48 +0300


From: ig25@fg70.rz.uni-karlsruhe.de (Thomas Koenig)

I think that ssh sometimes triggers a bug in the Linux TCP stack in
version 2.0.30.

I connect from a Linux box, using ssh 1.2.20, to a AIX 4.1.4 or HP-UX
9.0.5 box, running the same version of the ssh daemon. After I log out
again, I find that ssh sometimes hangs for up to a minute, unless
I type ^C.

stracing the offending ssh process shows that it hangs in a close():
(packet.c, line 206 and 207):

if (connection_in == connection_out)
{
shutdown(connection_out, 2);
close(connection_out);
^^^^^^^^^^^^^^^^^^^^^
}
else

17:19:20 sigaction(SIGWINCH, {SIG_DFL}, {0x804ed70, [], SA_RESTART}) = 0
17:19:20 write(2, "Connection to fg70 closed.\r\n", 28) = 28
17:19:20 ioctl(0, SNDCTL_TMR_STOP, {B9600 opost isig icanon echo ...}) = 0
17:19:20 gettimeofday({861895160, 942916}, NULL) = 0
17:19:20 shutdown(3, 2 /* send and receive */) = 0
17:19:20 close(3) = 0
17:19:35 _exit(1) = ?

(observing the strace does show that the ")" only appears after some time.)

Here's a tcpdump of a similar situation. "lxbox" is my Linux box,
running 2.0.30, and hpbox is a HP-UX machine.

What I don't understand is why the Linux machine sends two FIN packets
with sequence numbers 1904 and 1905. There might also be a bug in
the HP TCP stack, of course.

10:52:47.518482 hpbox.22 > lxbox.1022: P 19320:19340(20) ack 1852 win 8192
10:52:47.538481 lxbox.1022 > hpbox.22: . ack 19340 win 31744 (DF) [tos 0x10]
10:52:47.578481 lxbox.1022 > hpbox.22: P 1852:1872(20) ack 19340 win 31744 (DF) [tos 0x10]
10:52:47.598481 hpbox.22 > lxbox.1022: P 19340:19360(20) ack 1872 win 8192
10:52:47.618480 lxbox.1022 > hpbox.22: . ack 19360 win 31744 (DF) [tos 0x10]
10:52:47.778478 lxbox.1022 > hpbox.22: P 1872:1892(20) ack 19360 win 31744 (DF) [tos 0x10]
10:52:47.798478 hpbox.22 > lxbox.1022: P 19360:19388(28) ack 1892 win 8192
10:52:47.818478 lxbox.1022 > hpbox.22: . ack 19388 win 31744 (DF) [tos 0x10]
10:52:48.038475 hpbox.22 > lxbox.1022: P 19388:19408(20) ack 1892 win 8192
10:52:48.038475 lxbox.1022 > hpbox.22: P 1892:1904(12) ack 19408 win 31744 (DF) [tos 0x10]
10:52:48.048475 hpbox.22 > lxbox.1022: F 19408:19408(0) ack 1904 win 8180
10:52:48.048475 lxbox.1022 > hpbox.22: . ack 19409 win 31744 (DF) [tos 0x10]
10:52:48.198473 lxbox.1022 > hpbox.22: F 1904:1904(0) ack 19409 win 31744 [tos 0x10]
10:52:48.198473 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:52:48.198473 hpbox.22 > lxbox.1022: . ack 1905 win 8179
10:52:48.398470 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:52:48.798465 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:52:49.598455 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:52:51.198435 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:52:54.398394 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:53:00.798313 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:53:13.598150 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:53:39.197824 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:54:30.397173 lxbox.1022 > hpbox.22: F 1905:1905(0) ack 19409 win 31744 [tos 0x10]
10:54:30.397173 hpbox.22 > lxbox.1022: R 723409:723409(0) win 8192

-- 
74 a3 53 cc 0b 19
-- end of forwarded message --