From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=AOQ9OYV9; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id C55375A004E for ; Thu, 05 Feb 2026 01:17:34 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1770250653; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=92H3kjzvKsUCeygljtckby5n+3il05Sw1U7hybdLJmg=; b=AOQ9OYV9vFdOpop5qJJwWvIY/BvQ8cCNtK4QG13CeBIzmvOAxV7wOPy94UbzAWcxHaa4o/ LFySUyfg4sU/vkGjpkX9JqgfmsJqHeuBW7a33ACBNry5ZXiOX58m/lJUjD4F2j8st3pTBW rWJ9l62adIbxJOHRarX7HhT+HUKctsA= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-460-ui4KWQ3xOcmKz7Ljgz3lUg-1; Wed, 04 Feb 2026 19:17:32 -0500 X-MC-Unique: ui4KWQ3xOcmKz7Ljgz3lUg-1 X-Mimecast-MFC-AGG-ID: ui4KWQ3xOcmKz7Ljgz3lUg_1770250651 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-432db1a9589so277965f8f.0 for ; Wed, 04 Feb 2026 16:17:32 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770250651; x=1770855451; h=date:content-transfer-encoding:mime-version:organization:references :in-reply-to:message-id:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=92H3kjzvKsUCeygljtckby5n+3il05Sw1U7hybdLJmg=; b=Xo8jQSin9nQk/JEwwgnQryVUwkH/A28aXiCL1Fj/EM2q+nE4b7x5EmbgrC0Ui2lhqW TSqsWEYdNmtY9brCSJ3Xx5xxi+dbHonNVl0G4baJgw7BiLNMHBy3LwQ/l9ByVtRqkfk9 t8s/Q/wAd+33nu3SnB4PqBh4dT1ErxStvXPGy2M4bFybzJVpLtISt58TRQfUJeldGFzE /hakgGrAowh9Ns3ticETrCjUmymvykjz9xUefRY9n1QjuH1G8hVQfEYS0Z/F7ehDmRja Ky8QMQfIBSTtqQL+zOAVAovpBU6qpvR1zrHER41/5NwQ3xjiib2BGCVrPrktX0gbm7/T ZtTA== X-Gm-Message-State: AOJu0YzdhDZRSUuvfq8cWSHimg/DnYdP1sDIPXJsKNT8NPUVZioZUjKU kRJajC6+Th4u/MXKSZK+4lq7MM5WkZ0G8wuI9Vqn/2w/2Z4TeKWbdkK//ksfswpq84QDy+FamEL CK68YxbR8LRKht49RxWaTuBFuHR/EmC6bWVj3JTd+TUGp083iH00aVRClZKNOSA== X-Gm-Gg: AZuq6aIwtphwWltKO1AxLuNOgkCG0+yzFRHtf3I8kfKzOqFk8P15YpsNWKKgN5Heg3f tZ4BfMcMooZQPazwLRqTekaxHt3m+r6awv7ZHquelg1XTFbdMmoXhfMObkI2yqaZoXQgwaCAqBW WO+X4EemO5qk0QQojrR2oQ5Z26fvaBXeNwTWdgJOoQ3swZOMzWfGFe53D34bDCyi+qBC+6M0cBS UOZrNBWjzC4tTW0ugde1Zz79Q0dEfT0mjLlQkAcslIy+krebe1IEppoJr7JYJkWXyXiGrZWuc/r 3GW5M0hanHu416a0YgJROb3L62igbK9IzkllxnpO9IdQD5XqRGbklp9mnHSBQYII/0fgsZpTGtJ afr0mE00Z/AmYzc2pv9eY X-Received: by 2002:a05:6000:3110:b0:42f:b707:56e6 with SMTP id ffacd0b85a97d-436180572f1mr6384950f8f.34.1770250650777; Wed, 04 Feb 2026 16:17:30 -0800 (PST) X-Received: by 2002:a05:6000:3110:b0:42f:b707:56e6 with SMTP id ffacd0b85a97d-436180572f1mr6384914f8f.34.1770250649952; Wed, 04 Feb 2026 16:17:29 -0800 (PST) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43617e387b9sm10598473f8f.12.2026.02.04.16.17.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Feb 2026 16:17:29 -0800 (PST) From: Stefano Brivio To: David Gibson Subject: Re: [PATCH 2/4] tcp: Re-introduce inactivity timeouts based on a clock algorithm Message-ID: <20260205011720.337a75db@elisabeth> In-Reply-To: <20260204114137.2784090-3-david@gibson.dropbear.id.au> References: <20260204114137.2784090-1-david@gibson.dropbear.id.au> <20260204114137.2784090-3-david@gibson.dropbear.id.au> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Thu, 05 Feb 2026 01:17:28 +0100 (CET) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: NwGBWNC5KwN58JY1My4vCQtufdeNISW9fg-915bbbpg_1770250651 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: OAIH22ROSVW2R53VXBZP7Z4JHBQFHACY X-Message-ID-Hash: OAIH22ROSVW2R53VXBZP7Z4JHBQFHACY X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Nits only: On Wed, 4 Feb 2026 21:41:35 +1000 David Gibson wrote: > We previously had a mechanism to remove TCP connections which were > inactive for 2 hours. That was broken for a long time, due to poor > interactions with the timerfd handling, so we removed it. > > Adding this long scale timer onto the timerfd handling, which mostly > handles much shorter timeouts is tricky to reason about. However, for the > inactivity timeouts, we don't require precision. Instead, we can use > a 1-bit page replacement / "clock" algorithm. Every INACTIVITY_INTERVAL > (2 hours), a global timer marks every TCP connection as tentatively > inactive. That flag is cleared if we get any events, either tap side or > socket side. > > If the inactive flag is still set when the next INACTIVITY_INTERVAL expires > then the connection has been inactive for an extended period and we reset > and close it. In practice this means that connections will be removed > after 2-4 hours of inactivity. > > This is not a true fix for bug 179, but it does mitigate the damage, by > limiting the time that inactive connections will remain around, > > Link: https://bugs.passt.top/show_bug.cgi?id=179 > Signed-off-by: David Gibson > --- > tcp.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++---- > tcp.h | 4 +++- > tcp_conn.h | 3 +++ > 3 files changed, 54 insertions(+), 5 deletions(-) > > diff --git a/tcp.c b/tcp.c > index f8663369..acdac7df 100644 > --- a/tcp.c > +++ b/tcp.c > @@ -198,6 +198,13 @@ > * TCP_INFO, with a representable range from RTT_STORE_MIN (100 us) to > * RTT_STORE_MAX (3276.8 ms). The timeout value is clamped accordingly. > * > + * We also use a global interval timer for an activity timeout which doesn't > + * require precision: > + * > + * - INACTIVITY_INTERVAL: if a connection has had no activity for an entire > + * interval, close and reset it. This means that idle connections (without > + * keepalives) will be removed between INACTIVITY_INTERVAL s and Probably easier to read: ... seconds > + * 2*INACTIVITY_INTERVAL s after the last activity. same here. > * > * Summary of data flows (with ESTABLISHED event) > * ---------------------------------------------- > @@ -333,7 +340,8 @@ enum { > > #define RTO_INIT 1 /* s, RFC 6298 */ > #define RTO_INIT_AFTER_SYN_RETRIES 3 /* s, RFC 6298 */ > -#define ACT_TIMEOUT 7200 > + > +#define INACTIVITY_INTERVAL 7200 /* s */ > > #define LOW_RTT_TABLE_SIZE 8 > #define LOW_RTT_THRESHOLD 10 /* us */ > @@ -2254,6 +2262,8 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, > return 1; > } > > + conn->inactive = false; > + > if (th->ack && !(conn->events & ESTABLISHED)) > tcp_update_seqack_from_tap(c, conn, ntohl(th->ack_seq)); > > @@ -2622,6 +2632,8 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, > return; > } > > + conn->inactive = false; > + > if ((conn->events & TAP_FIN_ACKED) && (events & EPOLLHUP)) { > conn_event(c, conn, CLOSED); > return; > @@ -2872,18 +2884,50 @@ int tcp_init(struct ctx *c) > return 0; > } > > +/** > + * tcp_inactivity() - Scan for and close long-inactive connections > + * @: Execution context * @c: Execution context * @now: Current timestamp > + */ > +static void tcp_inactivity(struct ctx *c, const struct timespec *now) > +{ > + union flow *flow; > + > + if (now->tv_sec - c->tcp.inactivity_run < INACTIVITY_INTERVAL) > + return; > + > + debug("TCP inactivity scan"); > + c->tcp.inactivity_run = now->tv_sec; > + > + flow_foreach(flow) { > + struct tcp_tap_conn *conn = &flow->tcp; > + > + if (flow->f.type != FLOW_TCP) > + continue; > + > + if (conn->inactive) { > + /* No activity in this interval, reset */ > + flow_dbg(conn, "Inactive for at least %us, resetting", > + INACTIVITY_INTERVAL); > + tcp_rst(c, conn); > + } > + > + /* Ready to check fot next interval */ for > + conn->inactive = true; > + } > +} > + > /** > * tcp_timer() - Periodic tasks: port detection, closed connections, pool refill > * @c: Execution context > * @now: Current timestamp > */ > -void tcp_timer(const struct ctx *c, const struct timespec *now) > +void tcp_timer(struct ctx *c, const struct timespec *now) > { > - (void)now; > - > tcp_sock_refill_init(c); > if (c->mode == MODE_PASTA) > tcp_splice_refill(c); > + > + tcp_inactivity(c, now); > } > > /** > diff --git a/tcp.h b/tcp.h > index 24b90870..e104d453 100644 > --- a/tcp.h > +++ b/tcp.h > @@ -21,7 +21,7 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, > int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, > const union inany_addr *addr, const char *ifname, in_port_t port); > int tcp_init(struct ctx *c); > -void tcp_timer(const struct ctx *c, const struct timespec *now); > +void tcp_timer(struct ctx *c, const struct timespec *now); > void tcp_defer_handler(struct ctx *c); > > void tcp_update_l2_buf(const unsigned char *eth_d); > @@ -38,6 +38,7 @@ extern bool peek_offset_cap; > * @rto_max: Maximum retry timeout (in s) > * @syn_retries: SYN retries using exponential backoff timeout > * @syn_linear_timeouts: SYN retries before using exponential backoff timeout > + * @inactivity_run: Time we last scanned for inactive connections > */ > struct tcp_ctx { > struct fwd_ports fwd_in; > @@ -47,6 +48,7 @@ struct tcp_ctx { > int rto_max; > uint8_t syn_retries; > uint8_t syn_linear_timeouts; > + time_t inactivity_run; > }; > > #endif /* TCP_H */ > diff --git a/tcp_conn.h b/tcp_conn.h > index 21cea109..7197ff63 100644 > --- a/tcp_conn.h > +++ b/tcp_conn.h > @@ -16,6 +16,7 @@ > * @ws_from_tap: Window scaling factor advertised from tap/guest > * @ws_to_tap: Window scaling factor advertised to tap/guest > * @tap_mss: MSS advertised by tap/guest, rounded to 2 ^ TCP_MSS_BITS > + * @inactive: No activity within the current INACTIVITY_INTERVAL > * @sock: Socket descriptor number > * @events: Connection events, implying connection states > * @timer: timerfd descriptor for timeout events > @@ -57,6 +58,8 @@ struct tcp_tap_conn { > (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) > #define RTT_GET(conn) (RTT_STORE_MIN << conn->rtt_exp) > > + bool inactive :1; > + > int sock :FD_REF_BITS; > > uint8_t events; -- Stefano