The tale of a TCP bug

Stefan `Sec` Zehl sec at 42.org
Fri Mar 25 19:41:11 UTC 2011


Hi,

On Fri, Mar 25, 2011 at 08:25 -0400, John Baldwin wrote:
> Ah, ok.  Can you try this patch first (without the other)?  If it doesn't
> work then we can refine the patch above further.

I tried it completely unpatched and with your new patch. In both cases
that if() statement is not taken. 

Instrumenting this part of the code with printf()s shows that recwin is
65536 right after your patched if, but reduced to 65535 by the next
statment.

|  	if (recwin > (long)TCP_MAXWIN << tp->rcv_scale)
|  		recwin = (long)TCP_MAXWIN << tp->rcv_scale;

That's the same effect as in the the affected adv calculation:

% long adv = min(recwin, (long)TCP_MAXWIN << tp->rcv_scale) -
%       (tp->rcv_adv - tp->rcv_nxt);

recwin is 65535, but the min limits it to 65535.

CU,
    Sec
-- 
But anyway, once I did that, it ran fine!  Accelerated, full-screen.
Then I remembered I don't like Quake :-)


More information about the freebsd-net mailing list