From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202510 header.b=vaYzD+rF; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id C65E75A0619 for ; Mon, 03 Nov 2025 10:29:49 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202510; t=1762162186; bh=xeYeNnfjq5jrIPb9gZtJNCqICNa8HuwbxnYVycmK0Es=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=vaYzD+rFmUt/IYYkvqR8p0fASTu4DeUrI+7vskOHB1uMUmGkoYiIJ6vByJ7mnAs+M 2lYJzmz4pRKlAvH2pP6r1bc9nBL9xMxSjMSmk11kdNPw+Q2Vc7q/Nm/sOuWEuhyqwN D8BVSROck84arUhSu67bgeR/78gaFGXM21MNUGiXDnoiHlLQ4k/kVrT/wwwA9neP9h 6x0I8hatubWHnSZ3e5+z4T7iSLVZMfGStWzeNPJTzW/JJz+wBw1wzVc3h2vRmnuVwp pz2TI7WiD30vBs+88K3QVSPcWmC5w/IlyM4LhLa7/yOPnhM/+LNY8dziMy+bOqputU w8ZwWd4Q7UN6Q== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4d0RBL33WRz4wDC; Mon, 03 Nov 2025 20:29:46 +1100 (AEDT) Date: Mon, 3 Nov 2025 20:01:46 +1100 From: David Gibson To: Yumei Huang Subject: Re: [PATCH v7 3/5] tcp: Resend SYN for inbound connections Message-ID: References: <20251031054242.7334-1-yuhuang@redhat.com> <20251031054242.7334-4-yuhuang@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="S2VoCuYRhrUl/2sc" Content-Disposition: inline In-Reply-To: Message-ID-Hash: Z4AQYSZZ2W3ROAWGTXXMZM6JOE26IO4Q X-Message-ID-Hash: Z4AQYSZZ2W3ROAWGTXXMZM6JOE26IO4Q X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, sbrivio@redhat.com X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --S2VoCuYRhrUl/2sc Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Nov 03, 2025 at 10:31:21AM +0800, Yumei Huang wrote: > On Mon, Nov 3, 2025 at 9:10=E2=80=AFAM David Gibson wrote: > > > > On Fri, Oct 31, 2025 at 01:42:40PM +0800, Yumei Huang wrote: > > > If a client connects while guest is not connected or ready yet, > > > resend SYN instead of just resetting connection after 10 seconds. > > > > > > Use the same backoff calculation for the timeout as Linux kernel. > > > > > > Link: https://bugs.passt.top/show_bug.cgi?id=3D153 > > > Signed-off-by: Yumei Huang > > > > Reviewed-by: David Gibson > > > > There are a couple of tiny style nits and a mostly theoretical bug > > noted below. > > > > > > > --- > > > tcp.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++-------- > > > tcp.h | 4 ++++ > > > 2 files changed, 53 insertions(+), 8 deletions(-) > > > > > > diff --git a/tcp.c b/tcp.c > > > index 2ec4b0c..bada88a 100644 > > > --- a/tcp.c > > > +++ b/tcp.c > > > @@ -179,9 +179,11 @@ > > > * > > > * Timeouts are implemented by means of timerfd timers, set based on= flags: > > > * > > > - * - SYN_TIMEOUT: if no ACK is received from tap/guest during handsh= ake (flag > > > - * ACK_FROM_TAP_DUE without ESTABLISHED event) within this time, r= eset the > > > - * connection > > > + * - SYN_TIMEOUT_INIT: if no ACK is received from tap/guest during h= andshake > > > > Nit: I'd maybe say SYN,ACK here to distinguish it from other ACKs. > > > > > + * (flag ACK_FROM_TAP_DUE without ESTABLISHED event) within this t= ime, resend > > > + * SYN. It's the starting timeout for the first SYN retry. Retry f= or > > > + * TCP_MAX_RETRIES or (tcp_syn_retries + tcp_syn_linear_timeouts) = times, > > > + * reset the connection > > > * > > > * - ACK_TIMEOUT: if no ACK segment was received from tap/guest, aft= er sending > > > * data (flag ACK_FROM_TAP_DUE with ESTABLISHED event), re-send da= ta from the > > > @@ -340,7 +342,7 @@ enum { > > > #define WINDOW_DEFAULT 14600 /* RFC = 6928 */ > > > > > > #define ACK_INTERVAL 10 /* ms */ > > > -#define SYN_TIMEOUT 10 /* s */ > > > +#define SYN_TIMEOUT_INIT 1 /* s, RFC 6928 = */ > > > #define ACK_TIMEOUT 2 > > > #define FIN_TIMEOUT 60 > > > #define ACT_TIMEOUT 7200 > > > @@ -365,6 +367,12 @@ uint8_t tcp_migrate_rcv_queue [TCP_MI= GRATE_RCV_QUEUE_MAX]; > > > > > > #define TCP_MIGRATE_RESTORE_CHUNK_MIN 1024 /* Try smaller whe= n above this */ > > > > > > +#define TCP_SYN_RETRIES "/proc/sys/net/ipv4/tcp_syn_ret= ries" > > > +#define TCP_SYN_LINEAR_TIMEOUTS "/proc/sys/net/ipv4/tcp_syn_lin= ear_timeouts" > > > + > > > +#define TCP_SYN_RETRIES_DEFAULT 6 > > > +#define TCP_SYN_LINEAR_TIMEOUTS_DEFAULT 4 > > > + > > > /* "Extended" data (not stored in the flow table) for TCP flow migra= tion */ > > > static struct tcp_tap_transfer_ext migrate_ext[FLOW_MAX]; > > > > > > @@ -581,8 +589,10 @@ static void tcp_timer_ctl(const struct ctx *c, s= truct tcp_tap_conn *conn) > > > if (conn->flags & ACK_TO_TAP_DUE) { > > > it.it_value.tv_nsec =3D (long)ACK_INTERVAL * 1000 * 100= 0; > > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > > - if (!(conn->events & ESTABLISHED)) > > > - it.it_value.tv_sec =3D SYN_TIMEOUT; > > > + if (!(conn->events & ESTABLISHED)) { > > > + int exp =3D conn->retries - c->tcp.syn_linear_t= imeouts; > > > + it.it_value.tv_sec =3D SYN_TIMEOUT_INIT << MAX(= exp, 0); > > > + } > > > else > > > > A non-obvious detail of the style we use is that if one branch of an > > if uses { }, then the other branch should as well, even if it's one > > line. So above should be "} else {" and the bit below changed to > > match. >=20 > Oh, I didn't know about this style. Will update it later. Since it's gone in the next patch, it doesn't really matter. > > > it.it_value.tv_sec =3D ACK_TIMEOUT; > > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) { > > > @@ -2409,8 +2419,17 @@ void tcp_timer_handler(const struct ctx *c, un= ion epoll_ref ref) > > > tcp_timer_ctl(c, conn); > > > } else if (conn->flags & ACK_FROM_TAP_DUE) { > > > if (!(conn->events & ESTABLISHED)) { > > > - flow_dbg(conn, "handshake timeout"); > > > - tcp_rst(c, conn); > > > + if (conn->retries >=3D TCP_MAX_RETRIES || > > > + conn->retries >=3D (c->tcp.tcp_syn_retries + > > > + c->tcp.syn_linear_timeout= s)) { > > > > Here's the theoretical bug. We only clamp tcp_syn_retries and > > syn_linear_timeouts to a uint8_t, so if the host has these set to > > strangely large values, this addition could overflow. >=20 > Just checked net/ipv4/sysctl_net_ipv4.c, >=20 > static int tcp_syn_retries_min =3D 1; > static int tcp_syn_retries_max =3D MAX_TCP_SYNCNT; > static int tcp_syn_linear_timeouts_max =3D MAX_TCP_SYNCNT; >=20 > And MAX_TCP_SYNCNT is defined as 127: >=20 > #define MAX_TCP_SYNCNT 127 >=20 > they have a max value as 127, so there won't be overflows. Ok. That's not at all obvious from within the passt code, though. Again, this is really only a theoretical problem, but I think ideally we'd clamp to 127 where we read the values out of the kernel, with a comment saying that limit is derived from the kernel's own limit. >=20 > > > > > + flow_dbg(conn, "handshake timeout"); > > > + tcp_rst(c, conn); > > > + } else { > > > + flow_trace(conn, "SYN timeout, retry"); > > > + tcp_send_flag(c, conn, SYN); > > > + conn->retries++; > > > + tcp_timer_ctl(c, conn); > > > + } > > > } else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED= )) { > > > flow_dbg(conn, "FIN timeout"); > > > tcp_rst(c, conn); > > > @@ -2766,6 +2785,26 @@ static socklen_t tcp_probe_tcp_info(void) > > > return sl; > > > } > > > > > > +/** > > > + * tcp_get_rto_params() - Get host kernel RTO parameters > > > + * @c: Execution context > > > +*/ > > > +void tcp_get_rto_params(struct ctx *c) > > > +{ > > > + intmax_t tcp_syn_retries, syn_linear_timeouts; > > > + > > > + tcp_syn_retries =3D read_file_integer( > > > + TCP_SYN_RETRIES, TCP_SYN_RETRIES_DEFAULT); > > > + syn_linear_timeouts =3D read_file_integer( > > > + TCP_SYN_LINEAR_TIMEOUTS, TCP_SYN_LINEAR_TIMEOUTS_DEFAUL= T); > > > + > > > + c->tcp.tcp_syn_retries =3D MIN(tcp_syn_retries, UINT8_MAX); > > > + c->tcp.syn_linear_timeouts =3D MIN(syn_linear_timeouts, UINT8_M= AX); > > > + > > > + debug("Read sysctl values tcp_syn_retries: %"PRIu8", linear_tim= eouts: %"PRIu8, > > > + c->tcp.tcp_syn_retries, c->tcp.syn_linear_timeouts); > > > +} > > > + > > > /** > > > * tcp_init() - Get initial sequence, hash secret, initialise per-so= cket data > > > * @c: Execution context > > > @@ -2776,6 +2815,8 @@ int tcp_init(struct ctx *c) > > > { > > > ASSERT(!c->no_tcp); > > > > > > + tcp_get_rto_params(c); > > > + > > > tcp_sock_iov_init(c); > > > > > > memset(init_sock_pool4, 0xff, sizeof(init_sock_pool4)= ); > > > diff --git a/tcp.h b/tcp.h > > > index 234a803..befedde 100644 > > > --- a/tcp.h > > > +++ b/tcp.h > > > @@ -59,12 +59,16 @@ union tcp_listen_epoll_ref { > > > * @fwd_out: Port forwarding configuration for outbound pack= ets > > > * @timer_run: Timestamp of most recent timer run > > > * @pipe_size: Size of pipes for spliced connections > > > + * @tcp_syn_retries: SYN retries using exponential backoff timeout > > > + * @syn_linear_timeouts: SYN retries before using exponential backof= f timeout > > > */ > > > struct tcp_ctx { > > > struct fwd_ports fwd_in; > > > struct fwd_ports fwd_out; > > > struct timespec timer_run; > > > size_t pipe_size; > > > + uint8_t tcp_syn_retries; > > > + uint8_t syn_linear_timeouts; > > > }; > > > > > > #endif /* TCP_H */ > > > -- > > > 2.49.0 > > > > > > > -- > > David Gibson (he or they) | I'll have my music baroque, and my co= de > > david AT gibson.dropbear.id.au | minimalist, thank you, not the other = way > > | around. > > http://www.ozlabs.org/~dgibson >=20 >=20 >=20 > --=20 > Thanks, >=20 > Yumei Huang >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --S2VoCuYRhrUl/2sc Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmkIb28ACgkQzQJF27ox 2GdIxA//dRYWhLOAVHa9oukkfiR/hz9EjMSyd5gb0exz27zL3Q/9h6KHai7BpfYq 7bINf2phpmVouM9Bk2KZFL3wqJzui9EmZTSwGI93CR8Sw3jV4UkHSX4mmB6aPTPa jC3/cqgKz+n97MqSUJ+YVJzIKQNw+jZtMOwVcOIkWvK0fTuiC0RjNFGhTDXqq94R UxGWiZjJ+z3jAGR9vnlL32YRlEIlcucMMFBZDXwAbWcdvmncf1xmHGQ4artPv8pw ltl83IMIfYoXGuCE4LFm21Yx0wCu9iPZLWagXRt4FE8VjT9shvz21sZbHkbXgXUQ xiCGB7LC604+2Ec6NJmDt93Myd95VtvxgwYI6lxeSaKdplTb0vkhGr6uQfe2r/F3 Ftx+RJrxMkO7EKsdPriHq7uRUZCOc51oTZ/sU1WOUWOQAAPalb2WELUeX5Kvqjxk d6dn14iWTsr7oYqvbEsyMeFsr916ViYuQpEFisWHbKctLCh9RHDSb3P8mpa73ocp UM8YckuH+FU7lVcNPigXA4z88oVHyDf74WteiPT+v2xsmBOp3LMG6YEi95ae9y5t 2YesKgIFQT5PF3TlHHvDieSGRpTs6QFf5oI0h7zJkOtHga0hwYuqgIqcc7aD/10q jNwOmh1gJSu+Dhtg5t5JH/b5bsDDI4345f+cCBfDrp05uNojnpc= =7pYT -----END PGP SIGNATURE----- --S2VoCuYRhrUl/2sc--