Measure RTT during handshake since Linux does the same

Some tcp unit tests are affected by this change:
- Some retransmission tests assumed RTO=1s when connection is established. This
  is no longer true because minRTO was set to 3s in tests so now RTO becomes 3s
  after the first updateRTO call. Set minRTO=1s for these tests.
- Some RACK enabled tests are affected because now that RTT is initialized, and
  the estimated RTT is quite small, spurious TLP might be sent out and causing
  flakes, introduce an artificial delay for these tests so that the estimated
  RTT is larger.

PiperOrigin-RevId: 392768725

9 files changed, 309 insertions, 87 deletions

diff --git a/pkg/tcpip/transport/tcp/accept.go b/pkg/tcpip/transport/tcp/accept.go
index df1634a7a..9560ed43c 100644
--- a/pkg/tcpip/transport/tcp/accept.go
+++ b/pkg/tcpip/transport/tcp/accept.go
@@ -734,16 +734,18 @@ func (e *endpoint) handleListenSegment(ctx *listenContext, s *segment) tcpip.Err
 
 		// Switch state to connected.
 		n.isConnectNotified = true
-		n.transitionToStateEstablishedLocked(&handshake{
-			ep:          n,
-			iss:         iss,
-			ackNum:      irs + 1,
-			rcvWnd:      seqnum.Size(n.initialReceiveWindow()),
-			sndWnd:      s.window,
-			rcvWndScale: e.rcvWndScaleForHandshake(),
-			sndWndScale: rcvdSynOptions.WS,
-			mss:         rcvdSynOptions.MSS,
-		})
+		h := &handshake{
+			ep:                  n,
+			iss:                 iss,
+			ackNum:              irs + 1,
+			rcvWnd:              seqnum.Size(n.initialReceiveWindow()),
+			sndWnd:              s.window,
+			rcvWndScale:         e.rcvWndScaleForHandshake(),
+			sndWndScale:         rcvdSynOptions.WS,
+			mss:                 rcvdSynOptions.MSS,
+			sampleRTTWithTSOnly: true,
+		}
+		h.transitionToStateEstablishedLocked(s)
 
 		// Requeue the segment if the ACK completing the handshake has more info
 		// to be procesed by the newly established endpoint.
diff --git a/pkg/tcpip/transport/tcp/connect.go b/pkg/tcpip/transport/tcp/connect.go
index a80cbd52c..f85775a48 100644
--- a/pkg/tcpip/transport/tcp/connect.go
+++ b/pkg/tcpip/transport/tcp/connect.go
@@ -105,6 +105,11 @@ type handshake struct {
 
 	// sendSYNOpts is the cached values for the SYN options to be sent.
 	sendSYNOpts header.TCPSynOptions
+
+	// sampleRTTWithTSOnly is true when the segment was retransmitted or we can't
+	// tell; then RTT can only be sampled when the incoming segment has timestamp
+	// options enabled.
+	sampleRTTWithTSOnly bool
 }
 
 func (e *endpoint) newHandshake() *handshake {
@@ -268,8 +273,7 @@ func (h *handshake) synSentState(s *segment) tcpip.Error {
 	// and the handshake is completed.
 	if s.flags.Contains(header.TCPFlagAck) {
 		h.state = handshakeCompleted
-
-		h.ep.transitionToStateEstablishedLocked(h)
+		h.transitionToStateEstablishedLocked(s)
 
 		h.ep.sendRaw(buffer.VectorisedView{}, header.TCPFlagAck, h.iss+1, h.ackNum, h.rcvWnd>>h.effectiveRcvWndScale())
 		return nil
@@ -404,9 +408,10 @@ func (h *handshake) synRcvdState(s *segment) tcpip.Error {
 		if h.ep.SendTSOk && s.parsedOptions.TS {
 			h.ep.updateRecentTimestamp(s.parsedOptions.TSVal, h.ackNum, s.sequenceNumber)
 		}
+
 		h.state = handshakeCompleted
 
-		h.ep.transitionToStateEstablishedLocked(h)
+		h.transitionToStateEstablishedLocked(s)
 
 		// Requeue the segment if the ACK completing the handshake has more info
 		// to be procesed by the newly established endpoint.
@@ -559,6 +564,10 @@ func (h *handshake) complete() tcpip.Error {
 					ack:    h.ackNum,
 					rcvWnd: h.rcvWnd,
 				}, h.sendSYNOpts)
+				// If we have ever retransmitted the SYN-ACK or
+				// SYN segment, we should only measure RTT if
+				// TS option is present.
+				h.sampleRTTWithTSOnly = true
 			}
 
 		case wakerForNotification:
@@ -602,6 +611,38 @@ func (h *handshake) complete() tcpip.Error {
 	return nil
 }
 
+// transitionToStateEstablisedLocked transitions the endpoint of the handshake
+// to an established state given the last segment received from peer. It also
+// initializes sender/receiver.
+func (h *handshake) transitionToStateEstablishedLocked(s *segment) {
+	// Transfer handshake state to TCP connection. We disable
+	// receive window scaling if the peer doesn't support it
+	// (indicated by a negative send window scale).
+	h.ep.snd = newSender(h.ep, h.iss, h.ackNum-1, h.sndWnd, h.mss, h.sndWndScale)
+
+	var rtt time.Duration
+	if h.ep.SendTSOk && s.parsedOptions.TSEcr != 0 {
+		rtt = time.Duration(h.ep.timestamp()-s.parsedOptions.TSEcr) * time.Millisecond
+	}
+	if !h.sampleRTTWithTSOnly && rtt == 0 {
+		rtt = h.ep.stack.Clock().NowMonotonic().Sub(h.startTime)
+	}
+
+	if rtt > 0 {
+		h.ep.snd.updateRTO(rtt)
+	}
+
+	h.ep.rcvQueueInfo.rcvQueueMu.Lock()
+	h.ep.rcv = newReceiver(h.ep, h.ackNum-1, h.rcvWnd, h.effectiveRcvWndScale())
+	// Bootstrap the auto tuning algorithm. Starting at zero will
+	// result in a really large receive window after the first auto
+	// tuning adjustment.
+	h.ep.rcvQueueInfo.RcvAutoParams.PrevCopiedBytes = int(h.rcvWnd)
+	h.ep.rcvQueueInfo.rcvQueueMu.Unlock()
+
+	h.ep.setEndpointState(StateEstablished)
+}
+
 type backoffTimer struct {
 	timeout    time.Duration
 	maxTimeout time.Duration
@@ -967,26 +1008,6 @@ func (e *endpoint) completeWorkerLocked() {
 	}
 }
 
-// transitionToStateEstablisedLocked transitions a given endpoint
-// to an established state using the handshake parameters provided.
-// It also initializes sender/receiver.
-func (e *endpoint) transitionToStateEstablishedLocked(h *handshake) {
-	// Transfer handshake state to TCP connection. We disable
-	// receive window scaling if the peer doesn't support it
-	// (indicated by a negative send window scale).
-	e.snd = newSender(e, h.iss, h.ackNum-1, h.sndWnd, h.mss, h.sndWndScale)
-
-	e.rcvQueueInfo.rcvQueueMu.Lock()
-	e.rcv = newReceiver(e, h.ackNum-1, h.rcvWnd, h.effectiveRcvWndScale())
-	// Bootstrap the auto tuning algorithm. Starting at zero will
-	// result in a really large receive window after the first auto
-	// tuning adjustment.
-	e.rcvQueueInfo.RcvAutoParams.PrevCopiedBytes = int(h.rcvWnd)
-	e.rcvQueueInfo.rcvQueueMu.Unlock()
-
-	e.setEndpointState(StateEstablished)
-}
-
 // transitionToStateCloseLocked ensures that the endpoint is
 // cleaned up from the transport demuxer, "before" moving to
 // StateClose. This will ensure that no packet will be
diff --git a/pkg/tcpip/transport/tcp/protocol.go b/pkg/tcpip/transport/tcp/protocol.go
index 174112214..00a083dbe 100644
--- a/pkg/tcpip/transport/tcp/protocol.go
+++ b/pkg/tcpip/transport/tcp/protocol.go
@@ -96,6 +96,7 @@ type protocol struct {
 	maxRetries                 uint32
 	synRetries                 uint8
 	dispatcher                 dispatcher
+
 	// The following secrets are initialized once and stay unchanged after.
 	seqnumSecret     uint32
 	portOffsetSecret uint32
@@ -296,22 +297,26 @@ func (p *protocol) SetOption(option tcpip.SettableTransportProtocolOption) tcpip
 
 	case *tcpip.TCPMinRTOOption:
 		p.mu.Lock()
+		defer p.mu.Unlock()
 		if *v < 0 {
 			p.minRTO = MinRTO
+		} else if minRTO := time.Duration(*v); minRTO <= p.maxRTO {
+			p.minRTO = minRTO
 		} else {
-			p.minRTO = time.Duration(*v)
+			return &tcpip.ErrInvalidOptionValue{}
 		}
-		p.mu.Unlock()
 		return nil
 
 	case *tcpip.TCPMaxRTOOption:
 		p.mu.Lock()
+		defer p.mu.Unlock()
 		if *v < 0 {
 			p.maxRTO = MaxRTO
+		} else if maxRTO := time.Duration(*v); maxRTO >= p.minRTO {
+			p.maxRTO = maxRTO
 		} else {
-			p.maxRTO = time.Duration(*v)
+			return &tcpip.ErrInvalidOptionValue{}
 		}
-		p.mu.Unlock()
 		return nil
 
 	case *tcpip.TCPMaxRetriesOption:
diff --git a/pkg/tcpip/transport/tcp/snd.go b/pkg/tcpip/transport/tcp/snd.go
index 64302f576..a1f1c4e59 100644
--- a/pkg/tcpip/transport/tcp/snd.go
+++ b/pkg/tcpip/transport/tcp/snd.go
@@ -382,6 +382,9 @@ func (s *sender) updateRTO(rtt time.Duration) {
 	if s.RTO < s.minRTO {
 		s.RTO = s.minRTO
 	}
+	if s.RTO > s.maxRTO {
+		s.RTO = s.maxRTO
+	}
 }
 
 // resendSegment resends the first unacknowledged segment.
diff --git a/pkg/tcpip/transport/tcp/tcp_rack_test.go b/pkg/tcpip/transport/tcp/tcp_rack_test.go
index 89e9fb886..c35db7c95 100644
--- a/pkg/tcpip/transport/tcp/tcp_rack_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_rack_test.go
@@ -33,7 +33,6 @@ const (
 	tsOptionSize     = 12
 	maxTCPOptionSize = 40
 	mtu              = header.TCPMinimumSize + header.IPv4MinimumSize + maxTCPOptionSize + maxPayload
-	latency          = 5 * time.Millisecond
 )
 
 func setStackTCPRecovery(t *testing.T, c *context.Context, recovery int) {
@@ -163,7 +162,10 @@ func sendAndReceiveWithSACK(t *testing.T, c *context.Context, numPackets int, en
 	if !enableRACK {
 		setStackTCPRecovery(t, c, 0)
 	}
-	createConnectedWithSACKAndTS(c)
+	// The delay should be below initial RTO (1s) otherwise retransimission
+	// will start. Choose a relatively large value so that estimated RTT
+	// keeps high even after a few rounds of undelayed RTT samples.
+	c.CreateConnectedWithOptions(header.TCPSynOptions{SACKPermitted: c.SACKEnabled(), TS: true}, 800*time.Millisecond /* delay */)
 
 	data := make([]byte, numPackets*maxPayload)
 	for i := range data {
@@ -181,9 +183,6 @@ func sendAndReceiveWithSACK(t *testing.T, c *context.Context, numPackets int, en
 	for i := 0; i < numPackets; i++ {
 		c.ReceiveAndCheckPacketWithOptions(data, bytesRead, maxPayload, tsOptionSize)
 		bytesRead += maxPayload
-		// This delay is added to increase RTT as low RTT can cause TLP
-		// before sending ACK.
-		time.Sleep(latency)
 	}
 
 	return data
diff --git a/pkg/tcpip/transport/tcp/tcp_sack_test.go b/pkg/tcpip/transport/tcp/tcp_sack_test.go
index 83e0653b9..6255355bb 100644
--- a/pkg/tcpip/transport/tcp/tcp_sack_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_sack_test.go
@@ -35,13 +35,13 @@ import (
 // SACKPermitted option enabled if the stack in the context has the SACK support
 // enabled.
 func createConnectedWithSACKPermittedOption(c *context.Context) *context.RawEndpoint {
-	return c.CreateConnectedWithOptions(header.TCPSynOptions{SACKPermitted: c.SACKEnabled()})
+	return c.CreateConnectedWithOptionsNoDelay(header.TCPSynOptions{SACKPermitted: c.SACKEnabled()})
 }
 
 // createConnectedWithSACKAndTS creates and connects c.ep with the SACK & TS
 // option enabled if the stack in the context has SACK and TS enabled.
 func createConnectedWithSACKAndTS(c *context.Context) *context.RawEndpoint {
-	return c.CreateConnectedWithOptions(header.TCPSynOptions{SACKPermitted: c.SACKEnabled(), TS: true})
+	return c.CreateConnectedWithOptionsNoDelay(header.TCPSynOptions{SACKPermitted: c.SACKEnabled(), TS: true})
 }
 
 func setStackSACKPermitted(t *testing.T, c *context.Context, enable bool) {
@@ -108,7 +108,7 @@ func TestSackDisabledConnect(t *testing.T) {
 			setStackSACKPermitted(t, c, sackEnabled)
 			setStackTCPRecovery(t, c, 0)
 
-			rep := c.CreateConnectedWithOptions(header.TCPSynOptions{})
+			rep := c.CreateConnectedWithOptionsNoDelay(header.TCPSynOptions{})
 
 			data := []byte{1, 2, 3}
 
@@ -170,7 +170,7 @@ func TestSackPermittedAccept(t *testing.T) {
 					setStackSACKPermitted(t, c, sackEnabled)
 					setStackTCPRecovery(t, c, 0)
 
-					rep := c.AcceptWithOptions(tc.wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS, SACKPermitted: tc.sackPermitted})
+					rep := c.AcceptWithOptionsNoDelay(tc.wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS, SACKPermitted: tc.sackPermitted})
 					//  Now verify no SACK blocks are
 					//  received when sack is disabled.
 					data := []byte{1, 2, 3}
@@ -244,7 +244,7 @@ func TestSackDisabledAccept(t *testing.T) {
 					setStackSACKPermitted(t, c, sackEnabled)
 					setStackTCPRecovery(t, c, 0)
 
-					rep := c.AcceptWithOptions(tc.wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS})
+					rep := c.AcceptWithOptionsNoDelay(tc.wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS})
 
 					//  Now verify no SACK blocks are
 					//  received when sack is disabled.
diff --git a/pkg/tcpip/transport/tcp/tcp_test.go b/pkg/tcpip/transport/tcp/tcp_test.go
index fb4481c25..bf726e86a 100644
--- a/pkg/tcpip/transport/tcp/tcp_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_test.go
@@ -2144,7 +2144,7 @@ func TestSmallSegReceiveWindowAdvertisement(t *testing.T) {
 		t.Fatalf("SetTransportProtocolOption(%d, &%#v): %s", tcp.ProtocolNumber, opt, err)
 	}
 
-	c.AcceptWithOptions(tcp.FindWndScale(seqnum.Size(opt.Default)), header.TCPSynOptions{MSS: defaultIPv4MSS})
+	c.AcceptWithOptionsNoDelay(tcp.FindWndScale(seqnum.Size(opt.Default)), header.TCPSynOptions{MSS: defaultIPv4MSS})
 
 	// Bump up the receive buffer size such that, when the receive window grows,
 	// the scaled window exceeds maxUint16.
@@ -2536,7 +2536,7 @@ func TestScaledWindowAccept(t *testing.T) {
 
 	// Do 3-way handshake.
 	// wndScale expected is 3 as 65535 * 3 * 2 < 65535 * 2^3 but > 65535 *2 *2
-	c.PassiveConnectWithOptions(100, 3 /* wndScale */, header.TCPSynOptions{MSS: defaultIPv4MSS})
+	c.PassiveConnectWithOptions(100, 3 /* wndScale */, header.TCPSynOptions{MSS: defaultIPv4MSS}, 0 /* delay */)
 
 	// Try to accept the connection.
 	we, ch := waiter.NewChannelEntry(nil)
@@ -3533,6 +3533,12 @@ func TestMaxRetransmitsTimeout(t *testing.T) {
 		t.Fatalf("SetTransportProtocolOption(%d, &%T(%d)): %s", tcp.ProtocolNumber, opt, opt, err)
 	}
 
+	// Wait for the connection to timeout after MaxRetries retransmits.
+	initRTO := time.Second
+	minRTOOpt := tcpip.TCPMinRTOOption(initRTO)
+	if err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, &minRTOOpt); err != nil {
+		t.Fatalf("SetTransportProtocolOption(%d, &%T(%d)): %s", tcp.ProtocolNumber, minRTOOpt, minRTOOpt, err)
+	}
 	c.CreateConnected(context.TestInitialSequenceNumber, 30000 /* rcvWnd */, -1 /* epRcvBuf */)
 
 	waitEntry, notifyCh := waiter.NewChannelEntry(nil)
@@ -3555,8 +3561,6 @@ func TestMaxRetransmitsTimeout(t *testing.T) {
 			),
 		)
 	}
-	// Wait for the connection to timeout after MaxRetries retransmits.
-	initRTO := 1 * time.Second
 	select {
 	case <-notifyCh:
 	case <-time.After((2 << numRetries) * initRTO):
@@ -3591,9 +3595,13 @@ func TestMaxRTO(t *testing.T) {
 	defer c.Cleanup()
 
 	rto := 1 * time.Second
-	opt := tcpip.TCPMaxRTOOption(rto)
-	if err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
-		t.Fatalf("SetTransportProtocolOption(%d, &%T(%d)): %s", tcp.ProtocolNumber, opt, opt, err)
+	minRTOOpt := tcpip.TCPMinRTOOption(rto / 2)
+	if err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, &minRTOOpt); err != nil {
+		t.Fatalf("SetTransportProtocolOption(%d, &%T(%d)): %s", tcp.ProtocolNumber, minRTOOpt, minRTOOpt, err)
+	}
+	maxRTOOpt := tcpip.TCPMaxRTOOption(rto)
+	if err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, &maxRTOOpt); err != nil {
+		t.Fatalf("SetTransportProtocolOption(%d, &%T(%d)): %s", tcp.ProtocolNumber, maxRTOOpt, maxRTOOpt, err)
 	}
 
 	c.CreateConnected(context.TestInitialSequenceNumber, 30000 /* rcvWnd */, -1 /* epRcvBuf */)
@@ -3619,8 +3627,8 @@ func TestMaxRTO(t *testing.T) {
 				checker.TCPFlagsMatch(header.TCPFlagAck, ^header.TCPFlagPsh),
 			),
 		)
-		if time.Since(start).Round(time.Second).Seconds() != rto.Seconds() {
-			t.Errorf("Retransmit interval not capped to MaxRTO.\n")
+		if elapsed := time.Since(start); elapsed.Round(time.Second).Seconds() != rto.Seconds() {
+			t.Errorf("Retransmit interval not capped to MaxRTO(%s). %s", rto, elapsed)
 		}
 	}
 }
@@ -3671,6 +3679,10 @@ func TestRetransmitIPv4IDUniqueness(t *testing.T) {
 			c := context.New(t, defaultMTU)
 			defer c.Cleanup()
 
+			minRTOOpt := tcpip.TCPMinRTOOption(time.Second)
+			if err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, &minRTOOpt); err != nil {
+				t.Fatalf("SetTransportProtocolOption(%d, &%T(%d)): %s", tcp.ProtocolNumber, minRTOOpt, minRTOOpt, err)
+			}
 			c.CreateConnected(context.TestInitialSequenceNumber, 30000 /* rcvWnd */, -1 /* epRcvBuf */)
 
 			// Disabling PMTU discovery causes all packets sent from this socket to
@@ -6305,7 +6317,7 @@ func TestEndpointBindListenAcceptState(t *testing.T) {
 		t.Errorf("unexpected endpoint state: want %s, got %s", want, got)
 	}
 
-	c.PassiveConnectWithOptions(100, 5, header.TCPSynOptions{MSS: defaultIPv4MSS})
+	c.PassiveConnectWithOptions(100, 5, header.TCPSynOptions{MSS: defaultIPv4MSS}, 0 /* delay */)
 
 	// Try to accept the connection.
 	we, ch := waiter.NewChannelEntry(nil)
@@ -6386,7 +6398,7 @@ func TestReceiveBufferAutoTuningApplicationLimited(t *testing.T) {
 	// maximum buffer size defined above.
 	c.WindowScale = uint8(tcp.FindWndScale(maxReceiveBufferSize))
 
-	rawEP := c.CreateConnectedWithOptions(header.TCPSynOptions{TS: true, WS: 4})
+	rawEP := c.CreateConnectedWithOptionsNoDelay(header.TCPSynOptions{TS: true, WS: 4})
 
 	// NOTE: The timestamp values in the sent packets are meaningless to the
 	// peer so we just increment the timestamp value by 1 every batch as we
@@ -6516,7 +6528,7 @@ func TestReceiveBufferAutoTuning(t *testing.T) {
 	// maximum buffer size used by stack.
 	c.WindowScale = uint8(tcp.FindWndScale(maxReceiveBufferSize))
 
-	rawEP := c.CreateConnectedWithOptions(header.TCPSynOptions{TS: true, WS: 4})
+	rawEP := c.CreateConnectedWithOptionsNoDelay(header.TCPSynOptions{TS: true, WS: 4})
 	tsVal := rawEP.TSVal
 	rawEP.NextSeqNum--
 	rawEP.SendPacketWithTS(nil, tsVal)
@@ -7431,6 +7443,11 @@ func TestTCPUserTimeout(t *testing.T) {
 	c := context.New(t, defaultMTU)
 	defer c.Cleanup()
 
+	initRTO := 1 * time.Second
+	minRTOOpt := tcpip.TCPMinRTOOption(initRTO)
+	if err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, &minRTOOpt); err != nil {
+		t.Fatalf("SetTransportProtocolOption(%d, &%T(%d)): %s", tcp.ProtocolNumber, minRTOOpt, minRTOOpt, err)
+	}
 	c.CreateConnected(context.TestInitialSequenceNumber, 30000, -1 /* epRcvBuf */)
 
 	waitEntry, notifyCh := waiter.NewChannelEntry(nil)
@@ -7441,7 +7458,6 @@ func TestTCPUserTimeout(t *testing.T) {
 
 	// Ensure that on the next retransmit timer fire, the user timeout has
 	// expired.
-	initRTO := 1 * time.Second
 	userTimeout := initRTO / 2
 	v := tcpip.TCPUserTimeoutOption(userTimeout)
 	if err := c.EP.SetSockOpt(&v); err != nil {
@@ -7955,6 +7971,151 @@ func TestSetStackTimeWaitReuse(t *testing.T) {
 	}
 }
 
+func TestHandshakeRTT(t *testing.T) {
+	type testCase struct {
+		connect   bool
+		tsEnabled bool
+		useCookie bool
+		retrans   bool
+		delay     time.Duration
+		wantRTT   time.Duration
+	}
+	var testCases []testCase
+	for _, connect := range []bool{false, true} {
+		for _, tsEnabled := range []bool{false, true} {
+			for _, useCookie := range []bool{false, true} {
+				for _, retrans := range []bool{false, true} {
+					if connect && useCookie {
+						continue
+					}
+					delay := 800 * time.Millisecond
+					if retrans {
+						delay = 1200 * time.Millisecond
+					}
+					wantRTT := delay
+					// If syncookie is enabled, sample RTT only when TS option is enabled.
+					if !retrans && useCookie && !tsEnabled {
+						wantRTT = 0
+					}
+					// If retransmitted, sample RTT only when TS option is enabled.
+					if retrans && !tsEnabled {
+						wantRTT = 0
+					}
+					testCases = append(testCases, testCase{connect, tsEnabled, useCookie, retrans, delay, wantRTT})
+				}
+			}
+		}
+	}
+	for _, tt := range testCases {
+		tt := tt
+		t.Run(fmt.Sprintf("connect=%t,TS=%t,cookie=%t,retrans=%t)", tt.connect, tt.tsEnabled, tt.useCookie, tt.retrans), func(t *testing.T) {
+			t.Parallel()
+			c := context.New(t, defaultMTU)
+			if tt.useCookie {
+				opt := tcpip.TCPAlwaysUseSynCookies(true)
+				if err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
+					t.Fatalf("SetTransportProtocolOption(%d, &%T(%t)): %s", tcp.ProtocolNumber, opt, opt, err)
+				}
+			}
+			synOpts := header.TCPSynOptions{}
+			if tt.tsEnabled {
+				synOpts.TS = true
+				synOpts.TSVal = 42
+			}
+			if tt.connect {
+				c.CreateConnectedWithOptions(synOpts, tt.delay)
+			} else {
+				synOpts.MSS = defaultIPv4MSS
+				synOpts.WS = -1
+				c.AcceptWithOptions(-1, synOpts, tt.delay)
+			}
+			var info tcpip.TCPInfoOption
+			if err := c.EP.GetSockOpt(&info); err != nil {
+				t.Fatalf("c.EP.GetSockOpt(&%T) = %s", info, err)
+			}
+			if got := time.Duration(info.RTT).Round(tt.wantRTT); got != tt.wantRTT {
+				t.Fatalf("got info.RTT=%s, expect %s", got, tt.wantRTT)
+			}
+			if info.RTTVar != 0 && tt.wantRTT == 0 {
+				t.Fatalf("got info.RTTVar=%s, expect 0", info.RTTVar)
+			}
+			if info.RTTVar == 0 && tt.wantRTT != 0 {
+				t.Fatalf("got info.RTTVar=0, expect non zero")
+			}
+		})
+	}
+}
+
+func TestSetRTO(t *testing.T) {
+	c := context.New(t, defaultMTU)
+	minRTO, maxRTO := tcpRTOMinMax(t, c)
+	for _, tt := range []struct {
+		name   string
+		RTO    time.Duration
+		minRTO time.Duration
+		maxRTO time.Duration
+		err    tcpip.Error
+	}{
+		{
+			name:   "invalid minRTO",
+			minRTO: maxRTO + time.Second,
+			err:    &tcpip.ErrInvalidOptionValue{},
+		},
+		{
+			name:   "invalid maxRTO",
+			maxRTO: minRTO - time.Millisecond,
+			err:    &tcpip.ErrInvalidOptionValue{},
+		},
+		{
+			name:   "valid minRTO",
+			minRTO: maxRTO - time.Second,
+		},
+		{
+			name:   "valid maxRTO",
+			maxRTO: minRTO + time.Millisecond,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			c := context.New(t, defaultMTU)
+			var opt tcpip.SettableTransportProtocolOption
+			if tt.minRTO > 0 {
+				min := tcpip.TCPMinRTOOption(tt.minRTO)
+				opt = &min
+			}
+			if tt.maxRTO > 0 {
+				max := tcpip.TCPMaxRTOOption(tt.maxRTO)
+				opt = &max
+			}
+			err := c.Stack().SetTransportProtocolOption(tcp.ProtocolNumber, opt)
+			if got, want := err, tt.err; got != want {
+				t.Fatalf("c.Stack().SetTransportProtocolOption(TCP, &%T(%v)) = %v, want = %v", opt, opt, got, want)
+			}
+			if tt.err == nil {
+				minRTO, maxRTO := tcpRTOMinMax(t, c)
+				if tt.minRTO > 0 && tt.minRTO != minRTO {
+					t.Fatalf("got minRTO = %s, want %s", minRTO, tt.minRTO)
+				}
+				if tt.maxRTO > 0 && tt.maxRTO != maxRTO {
+					t.Fatalf("got maxRTO = %s, want %s", maxRTO, tt.maxRTO)
+				}
+			}
+		})
+	}
+}
+
+func tcpRTOMinMax(t *testing.T, c *context.Context) (time.Duration, time.Duration) {
+	t.Helper()
+	var minOpt tcpip.TCPMinRTOOption
+	var maxOpt tcpip.TCPMaxRTOOption
+	if err := c.Stack().TransportProtocolOption(tcp.ProtocolNumber, &minOpt); err != nil {
+		t.Fatalf("c.Stack().TransportProtocolOption(TCP, %T): %s", minOpt, err)
+	}
+	if err := c.Stack().TransportProtocolOption(tcp.ProtocolNumber, &maxOpt); err != nil {
+		t.Fatalf("c.Stack().TransportProtocolOption(TCP, %T): %s", maxOpt, err)
+	}
+	return time.Duration(minOpt), time.Duration(maxOpt)
+}
+
 // generateRandomPayload generates a random byte slice of the specified length
 // causing a fatal test failure if it is unable to do so.
 func generateRandomPayload(t *testing.T, n int) []byte {
diff --git a/pkg/tcpip/transport/tcp/tcp_timestamp_test.go b/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
index 1deb1fe4d..65925daa5 100644
--- a/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
@@ -32,7 +32,7 @@ import (
 // createConnectedWithTimestampOption creates and connects c.ep with the
 // timestamp option enabled.
 func createConnectedWithTimestampOption(c *context.Context) *context.RawEndpoint {
-	return c.CreateConnectedWithOptions(header.TCPSynOptions{TS: true, TSVal: 1})
+	return c.CreateConnectedWithOptionsNoDelay(header.TCPSynOptions{TS: true, TSVal: 1})
 }
 
 // TestTimeStampEnabledConnect tests that netstack sends the timestamp option on
@@ -131,7 +131,7 @@ func TestTimeStampDisabledConnect(t *testing.T) {
 	c := context.New(t, defaultMTU)
 	defer c.Cleanup()
 
-	c.CreateConnectedWithOptions(header.TCPSynOptions{})
+	c.CreateConnectedWithOptionsNoDelay(header.TCPSynOptions{})
 }
 
 func timeStampEnabledAccept(t *testing.T, cookieEnabled bool, wndScale int, wndSize uint16) {
@@ -147,7 +147,7 @@ func timeStampEnabledAccept(t *testing.T, cookieEnabled bool, wndScale int, wndS
 
 	t.Logf("Test w/ CookieEnabled = %v", cookieEnabled)
 	tsVal := rand.Uint32()
-	c.AcceptWithOptions(wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS, TS: true, TSVal: tsVal})
+	c.AcceptWithOptionsNoDelay(wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS, TS: true, TSVal: tsVal})
 
 	// Now send some data and validate that timestamp is echoed correctly in the ACK.
 	data := []byte{1, 2, 3}
@@ -209,7 +209,7 @@ func timeStampDisabledAccept(t *testing.T, cookieEnabled bool, wndScale int, wnd
 	}
 
 	t.Logf("Test w/ CookieEnabled = %v", cookieEnabled)
-	c.AcceptWithOptions(wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS})
+	c.AcceptWithOptionsNoDelay(wndScale, header.TCPSynOptions{MSS: defaultIPv4MSS})
 
 	// Now send some data with the accepted connection endpoint and validate
 	// that no timestamp option is sent in the TCP segment.
diff --git a/pkg/tcpip/transport/tcp/testing/context/context.go b/pkg/tcpip/transport/tcp/testing/context/context.go
index fd746816d..6e55a7a32 100644
--- a/pkg/tcpip/transport/tcp/testing/context/context.go
+++ b/pkg/tcpip/transport/tcp/testing/context/context.go
@@ -883,13 +883,21 @@ func (r *RawEndpoint) VerifyACKHasSACK(sackBlocks []header.SACKBlock) {
 	)
 }
 
+// CreateConnectedWithOptionsNoDelay just calls CreateConnectedWithOptions
+// without delay.
+func (c *Context) CreateConnectedWithOptionsNoDelay(wantOptions header.TCPSynOptions) *RawEndpoint {
+	return c.CreateConnectedWithOptions(wantOptions, 0 /* delay */)
+}
+
 // CreateConnectedWithOptions creates and connects c.ep with the specified TCP
 // options enabled and returns a RawEndpoint which represents the other end of
-// the connection.
+// the connection. It delays before a SYNACK is sent. This makes c.EP have a
+// higher RTT estimate so that spurious TLPs aren't sent in tests, which helps
+// reduce flakiness.
 //
 // It also verifies where required(eg.Timestamp) that the ACK to the SYN-ACK
 // does not carry an option that was not requested.
-func (c *Context) CreateConnectedWithOptions(wantOptions header.TCPSynOptions) *RawEndpoint {
+func (c *Context) CreateConnectedWithOptions(wantOptions header.TCPSynOptions, delay time.Duration) *RawEndpoint {
 	var err tcpip.Error
 	c.EP, err = c.s.NewEndpoint(tcp.ProtocolNumber, ipv4.ProtocolNumber, &c.WQ)
 	if err != nil {
@@ -915,18 +923,17 @@ func (c *Context) CreateConnectedWithOptions(wantOptions header.TCPSynOptions) *
 	// TS value.
 	mss := uint16(c.linkEP.MTU() - header.IPv4MinimumSize - header.TCPMinimumSize)
 
-	checker.IPv4(c.t, b,
-		checker.TCP(
-			checker.DstPort(TestPort),
-			checker.TCPFlags(header.TCPFlagSyn),
-			checker.TCPSynOptions(header.TCPSynOptions{
-				MSS:           mss,
-				TS:            true,
-				WS:            int(c.WindowScale),
-				SACKPermitted: c.SACKEnabled(),
-			}),
-		),
+	synChecker := checker.TCP(
+		checker.DstPort(TestPort),
+		checker.TCPFlags(header.TCPFlagSyn),
+		checker.TCPSynOptions(header.TCPSynOptions{
+			MSS:           mss,
+			TS:            true,
+			WS:            int(c.WindowScale),
+			SACKPermitted: c.SACKEnabled(),
+		}),
 	)
+	checker.IPv4(c.t, b, synChecker)
 	if got, want := tcp.EndpointState(c.EP.State()), tcp.StateSynSent; got != want {
 		c.t.Fatalf("Unexpected endpoint state: want %v, got %v", want, got)
 	}
@@ -952,6 +959,10 @@ func (c *Context) CreateConnectedWithOptions(wantOptions header.TCPSynOptions) *
 	// Build SYN-ACK.
 	c.IRS = seqnum.Value(tcpSeg.SequenceNumber())
 	iss := seqnum.Value(TestInitialSequenceNumber)
+	if delay > 0 {
+		// Sleep so that RTT is increased.
+		time.Sleep(delay)
+	}
 	c.SendPacket(nil, &Headers{
 		SrcPort: tcpSeg.DestinationPort(),
 		DstPort: tcpSeg.SourcePort(),
@@ -963,7 +974,17 @@ func (c *Context) CreateConnectedWithOptions(wantOptions header.TCPSynOptions) *
 	})
 
 	// Read ACK.
-	ackPacket := c.GetPacket()
+	var ackPacket []byte
+	// Ignore retransimitted SYN packets.
+	for {
+		packet := c.GetPacket()
+		if header.TCP(header.IPv4(packet).Payload()).Flags()&header.TCPFlagSyn != 0 {
+			checker.IPv4(c.t, packet, synChecker)
+		} else {
+			ackPacket = packet
+			break
+		}
+	}
 
 	// Verify TCP header fields.
 	tcpCheckers := []checker.TransportChecker{
@@ -1020,13 +1041,19 @@ func (c *Context) CreateConnectedWithOptions(wantOptions header.TCPSynOptions) *
 	}
 }
 
-// AcceptWithOptions initializes a listening endpoint and connects to it with the
-// provided options enabled. It also verifies that the SYN-ACK has the expected
-// values for the provided options.
+// AcceptWithOptionsNoDelay delegates call to AcceptWithOptions without delay.
+func (c *Context) AcceptWithOptionsNoDelay(wndScale int, synOptions header.TCPSynOptions) *RawEndpoint {
+	return c.AcceptWithOptions(wndScale, synOptions, 0 /* delay */)
+}
+
+// AcceptWithOptions initializes a listening endpoint and connects to it with
+// the provided options enabled. It delays before the final ACK of the 3WHS is
+// sent. It also verifies that the SYN-ACK has the expected values for the
+// provided options.
 //
 // The function returns a RawEndpoint representing the other end of the accepted
 // endpoint.
-func (c *Context) AcceptWithOptions(wndScale int, synOptions header.TCPSynOptions) *RawEndpoint {
+func (c *Context) AcceptWithOptions(wndScale int, synOptions header.TCPSynOptions, delay time.Duration) *RawEndpoint {
 	// Create EP and start listening.
 	wq := &waiter.Queue{}
 	ep, err := c.s.NewEndpoint(tcp.ProtocolNumber, ipv4.ProtocolNumber, wq)
@@ -1049,7 +1076,7 @@ func (c *Context) AcceptWithOptions(wndScale int, synOptions header.TCPSynOption
 		c.t.Errorf("Unexpected endpoint state: want %v, got %v", want, got)
 	}
 
-	rep := c.PassiveConnectWithOptions(100, wndScale, synOptions)
+	rep := c.PassiveConnectWithOptions(100, wndScale, synOptions, delay)
 
 	// Try to accept the connection.
 	we, ch := waiter.NewChannelEntry(nil)
@@ -1081,13 +1108,14 @@ func (c *Context) AcceptWithOptions(wndScale int, synOptions header.TCPSynOption
 // PassiveConnectWithOptions.
 func (c *Context) PassiveConnect(maxPayload, wndScale int, synOptions header.TCPSynOptions) {
 	synOptions.WS = -1
-	c.PassiveConnectWithOptions(maxPayload, wndScale, synOptions)
+	c.PassiveConnectWithOptions(maxPayload, wndScale, synOptions, 0 /* delay */)
 }
 
 // PassiveConnectWithOptions initiates a new connection (with the specified TCP
 // options enabled) to the port on which the Context.ep is listening for new
 // connections. It also validates that the SYN-ACK has the expected values for
-// the enabled options.
+// the enabled options. The final ACK of the handshake is delayed by specified
+// duration.
 //
 // NOTE: MSS is not a negotiated option and it can be asymmetric
 // in each direction. This function uses the maxPayload to set the MSS to be
@@ -1097,7 +1125,7 @@ func (c *Context) PassiveConnect(maxPayload, wndScale int, synOptions header.TCP
 // wndScale is the expected window scale in the SYN-ACK and synOptions.WS is the
 // value of the window scaling option to be sent in the SYN. If synOptions.WS >
 // 0 then we send the WindowScale option.
-func (c *Context) PassiveConnectWithOptions(maxPayload, wndScale int, synOptions header.TCPSynOptions) *RawEndpoint {
+func (c *Context) PassiveConnectWithOptions(maxPayload, wndScale int, synOptions header.TCPSynOptions, delay time.Duration) *RawEndpoint {
 	c.t.Helper()
 	opts := make([]byte, header.TCPOptionsMaximumSize)
 	offset := 0
@@ -1184,7 +1212,10 @@ func (c *Context) PassiveConnectWithOptions(maxPayload, wndScale int, synOptions
 		ackHeaders.TCPOpts = opts[:]
 	}
 
-	// Send ACK.
+	// Send ACK, delay if needed.
+	if delay > 0 {
+		time.Sleep(delay)
+	}
 	c.SendPacket(nil, ackHeaders)
 
 	c.RcvdWindowScale = uint8(rcvdSynOptions.WS)