[lwip-devel] [bug #27504] tcp_enqueue wrongly concatenates segments which are not consecutive when retransmitting unacked segments

[Jörg Kesten]

URL:
  <http://savannah.nongnu.org/bugs/?27504>

                 Summary: tcp_enqueue wrongly concatenates segments which are
not consecutive when retransmitting unacked segments
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: jkesten
            Submitted on: Wed 23 Sep 2009 09:02:49 AM GMT
                Category: TCP
                Severity: 3 - Normal
              Item Group: Faulty Behaviour
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: 
            lwIP version: 1.3.1

    _______________________________________________________

Details:

tcp_enqueue tries to append a new segment to the last one in the unsent list
if the max len is not reached yet.
It is not checked if the new segment is really the next one after the last
unsent segment, leading to the following faulty behavior if unacked data has
to be resend:

* some segments are send and added to the unacked queue (say n to n+5)
* segment "n" gets lost
* after some time tcp_rexmit moves segment n from the unacked back to the
unsent queue.
* The current state is
   - one segment (number n) is in the unsent queue
   - some further segments are still in the unacked queue (n+1 .. n+5) (the
actual count is not important here)
* Now tcp_enqueue is called, segments n+6 and n+7 get enqueued

!!* tcp_enqueue detects one non-full segment in the unsent queue (n) and
concatenates/chains the first new segment (n+6) to it
!!* so what happens is that the data from segment n+6 gets appended to
segment n, and n+7 gets added to the unsent-queue.

* tcp_output (re)sends segment n (piggybacking the data from n+6 which by
this ends up in the nirvana)
* segment n is received correctly by the peer and all unacked segments are
acked at once (up to n+5)
* next segment send is n+7

Attached is a simple fix which just verifies that the seqno of the new
segment is equal to the seqno of the old segment + len. This seems to be
sufficient, at least for the above described error case.



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Wed 23 Sep 2009 09:02:49 AM GMT  Name: tcp_enqueue.patch  Size: 820B  
By: jkesten

<http://savannah.nongnu.org/bugs/download.php?file_id=18759>

    _______________________________________________________

Reply to this item at:

  <http://savannah.nongnu.org/bugs/?27504>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.nongnu.org/