From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=FHiILwCB; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 4A97A5A061C for ; Tue, 04 Nov 2025 05:42:45 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1762231364; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RMj2TCReuGMNhyTC6ZdmuGb29xTcqCqPB1SUBTup5Ro=; b=FHiILwCBCjptTbXnAOfW9SV39V4IU2Eh3hMTz5GBOnA6ffWPKZTC0ev3wMdR32EOXA8mVL kg+PKLtpBlEbZRBCHwKvj80RHQcwbxC748TQ2FO6EVcIarjAaO4lpYJOWNYcM17Sry23b0 A6Y/3TaD3rnbdGwn17EnzC0VpP4WM4w= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-261-VoAnLkaRMXe4NQ3AnGOAfw-1; Mon, 03 Nov 2025 23:42:43 -0500 X-MC-Unique: VoAnLkaRMXe4NQ3AnGOAfw-1 X-Mimecast-MFC-AGG-ID: VoAnLkaRMXe4NQ3AnGOAfw_1762231362 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-47106720618so54333375e9.1 for ; Mon, 03 Nov 2025 20:42:42 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762231362; x=1762836162; h=content-transfer-encoding:mime-version:organization:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=RMj2TCReuGMNhyTC6ZdmuGb29xTcqCqPB1SUBTup5Ro=; b=DFBQ+q5etWqyz7rW20EFX4JIklWo368GxetRxz9f7ohBQ6E2tZQQT0EU/hxRscPY6u TurYPQ3cz664FM27wW3gveOZ0Z0e3qXkeZUzwL4ARyN3nj6J80LDnjQ5kDHjl6QUPe3/ 1pD+M82lW+Fh/7ErVZ11gv2QMKIdeixjO1zip9pxyAU8l9EQniQ3TozYxnMGlOoIcMk5 yKfBskvOd1yhlclz3eYqsmVigLdbDZ5UHB/ndc2IQVVsBILgFBeDO5dh+9ap2bHP+b7d samd9bwR8Hma7Tute5h8UacHp5/3QpWhzc7JkPzakz/rgjUodAnHo4ocN12Dv8SZVz0b 4Zjw== X-Forwarded-Encrypted: i=1; AJvYcCXwiQ6jqvgEtG06GkmOUiRlb6ljmLhubgLpp+AMQyyZKZWsakq5yKN+/nDrtRg2og/wXSTJaDJdYWU=@passt.top X-Gm-Message-State: AOJu0YzpKXIuqD0i9NzlsIgcG8nzVw7PS+MzFPP0sSm0TrnzWiBMO4QJ lZiS43agUQcVEqRWuZuX8z2/Q5G1GWgnHheQn6WyqqJi9GC4DV0g0WtdKbpMpGjB+mxVhDEBd6A kO15C6z90GSJ7Dna5NCgygrQnzPUta7lQ6oP77ayMolDvxK7swz5Quw== X-Gm-Gg: ASbGncshhVJ6AHTKpckRLbUCl5n11FBNfIj9CWf1MVvkuCi1434hr8IC4tjfxANhiYL D7Rd0Zc+3wGXLF1dkb1zRrPOiGKs8IiCPiEbxOGK9unrYEx22xO2K+IQpVAgn3o4bkZbtlh7/pC SV+AiEZrNpT5vQIk5CvomherWUPochSaNxtyUZRtbWvoq9opu9d9JVwl45NnE+HKLFcewgr3SX1 n+Ckpik/ChD3sxDxmX3MYYhqU+8o3ooETAVp4XcEp+nqYPATeuDP7G+PgkkQBO2B1cWDTQdTQDQ GYjSh4matvlIV4UkEVQlP2h0MmQzMGrlE71Wb/pNgd56Jgj08uSJX84e+WRGl6/xa7Yo26g6TXv KEQvkGjmcAQ== X-Received: by 2002:a05:600c:8b32:b0:471:1702:f41c with SMTP id 5b1f17b1804b1-4773bfd5b13mr108649725e9.35.1762231361735; Mon, 03 Nov 2025 20:42:41 -0800 (PST) X-Google-Smtp-Source: AGHT+IEBk6tInfaCvZ9W2b1UmJiny3l7jbQdHrJTLTDABvmJMnKhWZkrc9bswRMkPPFKOSVGS5dIKQ== X-Received: by 2002:a05:600c:8b32:b0:471:1702:f41c with SMTP id 5b1f17b1804b1-4773bfd5b13mr108649535e9.35.1762231361242; Mon, 03 Nov 2025 20:42:41 -0800 (PST) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-429dc1f5a7fsm2214451f8f.24.2025.11.03.20.42.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Nov 2025 20:42:40 -0800 (PST) Date: Tue, 4 Nov 2025 05:42:39 +0100 From: Stefano Brivio To: David Gibson Subject: Re: [PATCH v7 3/5] tcp: Resend SYN for inbound connections Message-ID: <20251104054239.65425fcc@elisabeth> In-Reply-To: References: <20251031054242.7334-1-yuhuang@redhat.com> <20251031054242.7334-4-yuhuang@redhat.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: NfEst2v8oVNnu86tVbou5ihLSaim82fpl0GRc-ntRTE_1762231362 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: JRHWAVNDPWDCYOPGBF62MEP4U4R42BKM X-Message-ID-Hash: JRHWAVNDPWDCYOPGBF62MEP4U4R42BKM X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Yumei Huang , passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon, 3 Nov 2025 20:01:46 +1100 David Gibson wrote: > On Mon, Nov 03, 2025 at 10:31:21AM +0800, Yumei Huang wrote: > > On Mon, Nov 3, 2025 at 9:10=E2=80=AFAM David Gibson wrote: =20 > > > > > > On Fri, Oct 31, 2025 at 01:42:40PM +0800, Yumei Huang wrote: =20 > > > > If a client connects while guest is not connected or ready yet, > > > > resend SYN instead of just resetting connection after 10 seconds. > > > > > > > > Use the same backoff calculation for the timeout as Linux kernel. > > > > > > > > Link: https://bugs.passt.top/show_bug.cgi?id=3D153 > > > > Signed-off-by: Yumei Huang =20 > > > > > > Reviewed-by: David Gibson > > > > > > There are a couple of tiny style nits and a mostly theoretical bug > > > noted below. > > > > > > =20 > > > > --- > > > > tcp.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++------= -- > > > > tcp.h | 4 ++++ > > > > 2 files changed, 53 insertions(+), 8 deletions(-) > > > > > > > > diff --git a/tcp.c b/tcp.c > > > > index 2ec4b0c..bada88a 100644 > > > > --- a/tcp.c > > > > +++ b/tcp.c > > > > @@ -179,9 +179,11 @@ > > > > * > > > > * Timeouts are implemented by means of timerfd timers, set based = on flags: > > > > * > > > > - * - SYN_TIMEOUT: if no ACK is received from tap/guest during hand= shake (flag > > > > - * ACK_FROM_TAP_DUE without ESTABLISHED event) within this time,= reset the > > > > - * connection > > > > + * - SYN_TIMEOUT_INIT: if no ACK is received from tap/guest during= handshake =20 > > > > > > Nit: I'd maybe say SYN,ACK here to distinguish it from other ACKs. > > > =20 > > > > + * (flag ACK_FROM_TAP_DUE without ESTABLISHED event) within this= time, resend > > > > + * SYN. It's the starting timeout for the first SYN retry. Retry= for > > > > + * TCP_MAX_RETRIES or (tcp_syn_retries + tcp_syn_linear_timeouts= ) times, > > > > + * reset the connection > > > > * > > > > * - ACK_TIMEOUT: if no ACK segment was received from tap/guest, a= fter sending > > > > * data (flag ACK_FROM_TAP_DUE with ESTABLISHED event), re-send = data from the > > > > @@ -340,7 +342,7 @@ enum { > > > > #define WINDOW_DEFAULT 14600 /* RF= C 6928 */ > > > > > > > > #define ACK_INTERVAL 10 /* ms */ > > > > -#define SYN_TIMEOUT 10 /* s */ > > > > +#define SYN_TIMEOUT_INIT 1 /* s, RFC 692= 8 */ > > > > #define ACK_TIMEOUT 2 > > > > #define FIN_TIMEOUT 60 > > > > #define ACT_TIMEOUT 7200 > > > > @@ -365,6 +367,12 @@ uint8_t tcp_migrate_rcv_queue [TCP_= MIGRATE_RCV_QUEUE_MAX]; > > > > > > > > #define TCP_MIGRATE_RESTORE_CHUNK_MIN 1024 /* Try smaller w= hen above this */ > > > > > > > > +#define TCP_SYN_RETRIES "/proc/sys/net/ipv4/tcp_syn_r= etries" > > > > +#define TCP_SYN_LINEAR_TIMEOUTS "/proc/sys/net/ipv4/tcp_syn_l= inear_timeouts" > > > > + > > > > +#define TCP_SYN_RETRIES_DEFAULT 6 > > > > +#define TCP_SYN_LINEAR_TIMEOUTS_DEFAULT 4 > > > > + > > > > /* "Extended" data (not stored in the flow table) for TCP flow mig= ration */ > > > > static struct tcp_tap_transfer_ext migrate_ext[FLOW_MAX]; > > > > > > > > @@ -581,8 +589,10 @@ static void tcp_timer_ctl(const struct ctx *c,= struct tcp_tap_conn *conn) > > > > if (conn->flags & ACK_TO_TAP_DUE) { > > > > it.it_value.tv_nsec =3D (long)ACK_INTERVAL * 1000 * 1= 000; > > > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > > > - if (!(conn->events & ESTABLISHED)) > > > > - it.it_value.tv_sec =3D SYN_TIMEOUT; > > > > + if (!(conn->events & ESTABLISHED)) { > > > > + int exp =3D conn->retries - c->tcp.syn_linear= _timeouts; > > > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT << MA= X(exp, 0); > > > > + } > > > > else =20 > > > > > > A non-obvious detail of the style we use is that if one branch of an > > > if uses { }, then the other branch should as well, even if it's one > > > line. So above should be "} else {" and the bit below changed to > > > match. =20 > >=20 > > Oh, I didn't know about this style. Will update it later. =20 >=20 > Since it's gone in the next patch, it doesn't really matter. >=20 > > > > it.it_value.tv_sec =3D ACK_TIMEOUT; > > > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) { > > > > @@ -2409,8 +2419,17 @@ void tcp_timer_handler(const struct ctx *c, = union epoll_ref ref) > > > > tcp_timer_ctl(c, conn); > > > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > > > if (!(conn->events & ESTABLISHED)) { > > > > - flow_dbg(conn, "handshake timeout"); > > > > - tcp_rst(c, conn); > > > > + if (conn->retries >=3D TCP_MAX_RETRIES || > > > > + conn->retries >=3D (c->tcp.tcp_syn_retrie= s + > > > > + c->tcp.syn_linear_timeo= uts)) { =20 > > > > > > Here's the theoretical bug. We only clamp tcp_syn_retries and > > > syn_linear_timeouts to a uint8_t, so if the host has these set to > > > strangely large values, this addition could overflow. =20 Actually, I think it won't, because it's performed as 'unsigned int', see my other email on the subject. But in any case: > > Just checked net/ipv4/sysctl_net_ipv4.c, > >=20 > > static int tcp_syn_retries_min =3D 1; > > static int tcp_syn_retries_max =3D MAX_TCP_SYNCNT; > > static int tcp_syn_linear_timeouts_max =3D MAX_TCP_SYNCNT; > >=20 > > And MAX_TCP_SYNCNT is defined as 127: > >=20 > > #define MAX_TCP_SYNCNT 127 ...these limits come and go, so... > > they have a max value as 127, so there won't be overflows. =20 >=20 > Ok. That's not at all obvious from within the passt code, though. > Again, this is really only a theoretical problem, but I think ideally > we'd clamp to 127 where we read the values out of the kernel, with a > comment saying that limit is derived from the kernel's own limit. that would sound like a good idea anyway, instead of clamping to 255 as done later in this patch. --=20 Stefano