From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=PtTCWIPH; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 4CF345A026F for ; Mon, 03 Nov 2025 03:31:38 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1762137097; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Pndjra7nsWmfAI09xNo2w7OWoiPw9oSBlQ9pKr6KIpU=; b=PtTCWIPHW5ZcA85hs7ZffzmkrM6JTwO0wuiNP2fpDAgO7WvAVyGptpxPuQvTyhwAqzWnTg ZYPGOjrbUvMJhtKlh/iuv5xeFzSAOgJfARzR9BYlunz5KPSa3DBu1ZUCyPZUYJNeecKKgK hJzEKZffDrAPV6iEtQ+9ge0/nOow4so= Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-617-y6xdIOrOMlqNMKEX9idNNg-1; Sun, 02 Nov 2025 21:31:35 -0500 X-MC-Unique: y6xdIOrOMlqNMKEX9idNNg-1 X-Mimecast-MFC-AGG-ID: y6xdIOrOMlqNMKEX9idNNg_1762137094 Received: by mail-ed1-f72.google.com with SMTP id 4fb4d7f45d1cf-640a03bb8afso2279513a12.0 for ; Sun, 02 Nov 2025 18:31:34 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762137094; x=1762741894; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Pndjra7nsWmfAI09xNo2w7OWoiPw9oSBlQ9pKr6KIpU=; b=YkM6TSW5bTM9m19HHDce/aSTWBa1+hxhhgFgwWrgBgs2OBTG87719/ZdYwKLn7V/Uq rBYWunlDPM3hqDQ7bcLe6thW55LzoYJmZZXAJqNUtcf7tDmVntv9hQSw5fDWNoIiHG+G sUL5SpSHBNmDkUvljM0U6G6D/WcRylDyBqv0oMB2G9u90MlX1uo0rCcUbVqJHkkXQJyL ncZORHAoQjrHXtyqvoU23JNY8k/kloco+vLClCRAfrvGUdEMcSDEQtcxhEi/Np6miEYh EWuNuzXXh6PJYsLCy1e7BsvO4e7agPsB+3W1bViYR/CkrWh5yBiyCa0dP7wD0NSh83Qu KnEQ== X-Gm-Message-State: AOJu0YwVmNcFIv2mZI5HHTkEOmKC0QpKRZn2VVsUNJzF1sRO4Zkg8uNy jmDHzXlAfAW1hlAiq7sAEAWD4gGQxHbcL6V2B4EgNgn3+I/e8iPmn8lfYMbDEZ3aztraeMDN0/D EsHSg+Dylg7+Jl7Njs/quAZzYcmmHFV3VCtoCbGZLvIDUzBDHBy5WuDQJTHrCETOaTIT7U5dDLX ygbWYpqHd59gd+auv6wxYfy2ckAAk5 X-Gm-Gg: ASbGncuNrDYtY98aPWg6kXgsWfu0l8PH4fH1zJ/Rq2//I5Wxp5lo03z5HEC/fRKTQXv ACDQGwNUTjVh1ah93uCQnTq1Zeoh/ftMKPqpS33WWEXFiReNLcIZjqSGh2j8eAL0vwr/rbBRFO2 coYmcBS5QeQyZD4E1ODHOZ+i7qaIFCYLpu7CZ2oXtF6f3mOZOB6QNIL9nU X-Received: by 2002:a05:6402:254c:b0:639:d9e7:804d with SMTP id 4fb4d7f45d1cf-6407704134dmr9008303a12.7.1762137093925; Sun, 02 Nov 2025 18:31:33 -0800 (PST) X-Google-Smtp-Source: AGHT+IGf0EInA587igrP/NmioJ3T6stwwALFTy0Z4+At7T512K7enBGwaJm1ZZp5y/oEjemKDn+0wRcE6tRN2BAaMwA= X-Received: by 2002:a05:6402:254c:b0:639:d9e7:804d with SMTP id 4fb4d7f45d1cf-6407704134dmr9008293a12.7.1762137093437; Sun, 02 Nov 2025 18:31:33 -0800 (PST) MIME-Version: 1.0 References: <20251031054242.7334-1-yuhuang@redhat.com> <20251031054242.7334-4-yuhuang@redhat.com> In-Reply-To: From: Yumei Huang Date: Mon, 3 Nov 2025 10:31:21 +0800 X-Gm-Features: AWmQ_bkIK8mkE6i6PoKusc8Y19wC2Z4tymZk8wAFkhsrOXQ1rxaJc7QbEAV6A9U Message-ID: Subject: Re: [PATCH v7 3/5] tcp: Resend SYN for inbound connections To: David Gibson X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: KUbCtaeUfGIuW0IdYw_hfHyMZ4oVdwEmQxCkfz6R_2U_1762137094 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: XJQXSFWK53OI772YH6HJLIN6U4IVRDQU X-Message-ID-Hash: XJQXSFWK53OI772YH6HJLIN6U4IVRDQU X-MailFrom: yuhuang@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, sbrivio@redhat.com X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon, Nov 3, 2025 at 9:10=E2=80=AFAM David Gibson wrote: > > On Fri, Oct 31, 2025 at 01:42:40PM +0800, Yumei Huang wrote: > > If a client connects while guest is not connected or ready yet, > > resend SYN instead of just resetting connection after 10 seconds. > > > > Use the same backoff calculation for the timeout as Linux kernel. > > > > Link: https://bugs.passt.top/show_bug.cgi?id=3D153 > > Signed-off-by: Yumei Huang > > Reviewed-by: David Gibson > > There are a couple of tiny style nits and a mostly theoretical bug > noted below. > > > > --- > > tcp.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++-------- > > tcp.h | 4 ++++ > > 2 files changed, 53 insertions(+), 8 deletions(-) > > > > diff --git a/tcp.c b/tcp.c > > index 2ec4b0c..bada88a 100644 > > --- a/tcp.c > > +++ b/tcp.c > > @@ -179,9 +179,11 @@ > > * > > * Timeouts are implemented by means of timerfd timers, set based on f= lags: > > * > > - * - SYN_TIMEOUT: if no ACK is received from tap/guest during handshak= e (flag > > - * ACK_FROM_TAP_DUE without ESTABLISHED event) within this time, res= et the > > - * connection > > + * - SYN_TIMEOUT_INIT: if no ACK is received from tap/guest during han= dshake > > Nit: I'd maybe say SYN,ACK here to distinguish it from other ACKs. > > > + * (flag ACK_FROM_TAP_DUE without ESTABLISHED event) within this tim= e, resend > > + * SYN. It's the starting timeout for the first SYN retry. Retry for > > + * TCP_MAX_RETRIES or (tcp_syn_retries + tcp_syn_linear_timeouts) ti= mes, > > + * reset the connection > > * > > * - ACK_TIMEOUT: if no ACK segment was received from tap/guest, after= sending > > * data (flag ACK_FROM_TAP_DUE with ESTABLISHED event), re-send data= from the > > @@ -340,7 +342,7 @@ enum { > > #define WINDOW_DEFAULT 14600 /* RFC 69= 28 */ > > > > #define ACK_INTERVAL 10 /* ms */ > > -#define SYN_TIMEOUT 10 /* s */ > > +#define SYN_TIMEOUT_INIT 1 /* s, RFC 6928 */ > > #define ACK_TIMEOUT 2 > > #define FIN_TIMEOUT 60 > > #define ACT_TIMEOUT 7200 > > @@ -365,6 +367,12 @@ uint8_t tcp_migrate_rcv_queue [TCP_MIGR= ATE_RCV_QUEUE_MAX]; > > > > #define TCP_MIGRATE_RESTORE_CHUNK_MIN 1024 /* Try smaller when = above this */ > > > > +#define TCP_SYN_RETRIES "/proc/sys/net/ipv4/tcp_syn_retri= es" > > +#define TCP_SYN_LINEAR_TIMEOUTS "/proc/sys/net/ipv4/tcp_syn_linea= r_timeouts" > > + > > +#define TCP_SYN_RETRIES_DEFAULT 6 > > +#define TCP_SYN_LINEAR_TIMEOUTS_DEFAULT 4 > > + > > /* "Extended" data (not stored in the flow table) for TCP flow migrati= on */ > > static struct tcp_tap_transfer_ext migrate_ext[FLOW_MAX]; > > > > @@ -581,8 +589,10 @@ static void tcp_timer_ctl(const struct ctx *c, str= uct tcp_tap_conn *conn) > > if (conn->flags & ACK_TO_TAP_DUE) { > > it.it_value.tv_nsec =3D (long)ACK_INTERVAL * 1000 * 1000; > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > - if (!(conn->events & ESTABLISHED)) > > - it.it_value.tv_sec =3D SYN_TIMEOUT; > > + if (!(conn->events & ESTABLISHED)) { > > + int exp =3D conn->retries - c->tcp.syn_linear_tim= eouts; > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT << MAX(ex= p, 0); > > + } > > else > > A non-obvious detail of the style we use is that if one branch of an > if uses { }, then the other branch should as well, even if it's one > line. So above should be "} else {" and the bit below changed to > match. Oh, I didn't know about this style. Will update it later. > > > it.it_value.tv_sec =3D ACK_TIMEOUT; > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) { > > @@ -2409,8 +2419,17 @@ void tcp_timer_handler(const struct ctx *c, unio= n epoll_ref ref) > > tcp_timer_ctl(c, conn); > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > if (!(conn->events & ESTABLISHED)) { > > - flow_dbg(conn, "handshake timeout"); > > - tcp_rst(c, conn); > > + if (conn->retries >=3D TCP_MAX_RETRIES || > > + conn->retries >=3D (c->tcp.tcp_syn_retries + > > + c->tcp.syn_linear_timeouts)= ) { > > Here's the theoretical bug. We only clamp tcp_syn_retries and > syn_linear_timeouts to a uint8_t, so if the host has these set to > strangely large values, this addition could overflow. Just checked net/ipv4/sysctl_net_ipv4.c, static int tcp_syn_retries_min =3D 1; static int tcp_syn_retries_max =3D MAX_TCP_SYNCNT; static int tcp_syn_linear_timeouts_max =3D MAX_TCP_SYNCNT; And MAX_TCP_SYNCNT is defined as 127: #define MAX_TCP_SYNCNT 127 they have a max value as 127, so there won't be overflows. > > > + flow_dbg(conn, "handshake timeout"); > > + tcp_rst(c, conn); > > + } else { > > + flow_trace(conn, "SYN timeout, retry"); > > + tcp_send_flag(c, conn, SYN); > > + conn->retries++; > > + tcp_timer_ctl(c, conn); > > + } > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED))= { > > flow_dbg(conn, "FIN timeout"); > > tcp_rst(c, conn); > > @@ -2766,6 +2785,26 @@ static socklen_t tcp_probe_tcp_info(void) > > return sl; > > } > > > > +/** > > + * tcp_get_rto_params() - Get host kernel RTO parameters > > + * @c: Execution context > > +*/ > > +void tcp_get_rto_params(struct ctx *c) > > +{ > > + intmax_t tcp_syn_retries, syn_linear_timeouts; > > + > > + tcp_syn_retries =3D read_file_integer( > > + TCP_SYN_RETRIES, TCP_SYN_RETRIES_DEFAULT); > > + syn_linear_timeouts =3D read_file_integer( > > + TCP_SYN_LINEAR_TIMEOUTS, TCP_SYN_LINEAR_TIMEOUTS_DEFAULT)= ; > > + > > + c->tcp.tcp_syn_retries =3D MIN(tcp_syn_retries, UINT8_MAX); > > + c->tcp.syn_linear_timeouts =3D MIN(syn_linear_timeouts, UINT8_MAX= ); > > + > > + debug("Read sysctl values tcp_syn_retries: %"PRIu8", linear_timeo= uts: %"PRIu8, > > + c->tcp.tcp_syn_retries, c->tcp.syn_linear_timeouts); > > +} > > + > > /** > > * tcp_init() - Get initial sequence, hash secret, initialise per-sock= et data > > * @c: Execution context > > @@ -2776,6 +2815,8 @@ int tcp_init(struct ctx *c) > > { > > ASSERT(!c->no_tcp); > > > > + tcp_get_rto_params(c); > > + > > tcp_sock_iov_init(c); > > > > memset(init_sock_pool4, 0xff, sizeof(init_sock_pool4)); > > diff --git a/tcp.h b/tcp.h > > index 234a803..befedde 100644 > > --- a/tcp.h > > +++ b/tcp.h > > @@ -59,12 +59,16 @@ union tcp_listen_epoll_ref { > > * @fwd_out: Port forwarding configuration for outbound packet= s > > * @timer_run: Timestamp of most recent timer run > > * @pipe_size: Size of pipes for spliced connections > > + * @tcp_syn_retries: SYN retries using exponential backoff timeout > > + * @syn_linear_timeouts: SYN retries before using exponential backoff = timeout > > */ > > struct tcp_ctx { > > struct fwd_ports fwd_in; > > struct fwd_ports fwd_out; > > struct timespec timer_run; > > size_t pipe_size; > > + uint8_t tcp_syn_retries; > > + uint8_t syn_linear_timeouts; > > }; > > > > #endif /* TCP_H */ > > -- > > 2.49.0 > > > > -- > David Gibson (he or they) | I'll have my music baroque, and my code > david AT gibson.dropbear.id.au | minimalist, thank you, not the other wa= y > | around. > http://www.ozlabs.org/~dgibson --=20 Thanks, Yumei Huang