FreeBSD 7 TCP syncache fix: request for testers

[Mike Silbersack]

On Tue, 10 Jul 2007, Eygene Ryabinkin wrote:

> Can't say that I am pushing much traffic through my box, but after
> applying your patch and rebuilding the kernel I am still seeing the
> messages like
> -----
> TCP: [209.132.176.NNN]:NNN to [144.206.NNN.NNN]:NNN tcpflags 0x19<FIN,PUSH,ACK>; syncache_expand: Segment failed SYNCOOKIE authentication, segment rejected (probably spoofed)
> TCP: [201.90.65.NNN]:NNN to [144.206.NNN.NNN]:NNN; syncache_timer: Response timeout
> -----
> But what had changed is that the lines with the 'syncache_timer'
> started to appear.  There were no such lines prior to the patch,
> only the 'failed SYNCOOKIE' ones.

The "syncache_timer: Response timeout" message means that the syncache 
sent a SYN-ACK response four times, but still didn't receive a response. 
This probably means that someone tried using a port scanner or was going 
through a faulty firewall.  We'll definitely have to take that log message 
out before 7.0 is released.

The fact that you're still getting the syncache_expand message tells me 
that there's another bug which I have not yet fixed still present.

My suspicion is that the "Segment failed SYNCOOKIE authentication" message 
is the aftereffect of FreeBSD 7 randomly dropping TCP connections, and not 
the problem itself.  My theory is that the connection is silently dropped, 
without the other endpoint knowing.  That other endpoint then sends an 
ACK packet, which is then believed to be a syncookie.  Since it is not, it 
obviously fails the verification.

Finding that bug is my next goal.

> But the patch received only half a day of testing, so I will continue
> the tests and will inform you if some other information will be
> available.  Up to date I don't see problems that had appeared without
> the patch, but they tend to show up after a midnight ;))
>
> Thank you!

Thanks for testing, I look forward to hearing how things work for you.

Mike "Silby" Silbersack