- dev - passt

[PATCH 1/3] tcp: Use flow_foreach_of_type() in tcp_{keepalive,inactivity}
by David Gibson 05 Mar '26

05 Mar '26

These functions step through all TCP flows. I forgot there was already a flow_foreach_of_type() macro which makes this easier. Use it. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/tcp.c b/tcp.c index 88ad886d..16470703 100644 --- a/tcp.c +++ b/tcp.c @@ -2907,12 +2907,9 @@ static void tcp_keepalive(struct ctx *c, const struct timespec *now) c->tcp.keepalive_run = now->tv_sec; - flow_foreach(flow) { + flow_foreach_of_type(flow, FLOW_TCP) { struct tcp_tap_conn *conn = &flow->tcp; - if (flow->f.type != FLOW_TCP) - continue; - if (conn->tap_inactive) { flow_dbg(conn, "No tap activity for least %us, send keepalive", KEEPALIVE_INTERVAL); @@ -2938,12 +2935,9 @@ static void tcp_inactivity(struct ctx *c, const struct timespec *now) debug("TCP inactivity scan"); c->tcp.inactivity_run = now->tv_sec; - flow_foreach(flow) { + flow_foreach_of_type(flow, FLOW_TCP) { struct tcp_tap_conn *conn = &flow->tcp; - if (flow->f.type != FLOW_TCP) - continue; - if (conn->inactive) { /* No activity in this interval, reset */ flow_dbg(conn, "Inactive for at least %us, resetting", -- 2.53.0

2 1

[PATCH 3/3] clang-tidy: Don't insist on #ifdef over #if defined()
by David Gibson 05 Mar '26

05 Mar '26

Commit 036fb8770 ("checksum: add VSX fast path for POWER8/POWER9") changed an #ifdef to #if defined, in order to match a newly introduced #if which needs to check two different symbols. This causes clang-tidy to complain that the directive could be written more concisely. In this case consistency with the other #if branch seems more important, and in general insisting on #ifdef over #if seems unhelpfully pedantic. Suppress that warning globally. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- .clang-tidy | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.clang-tidy b/.clang-tidy index 9d346ec2..773121f5 100644 --- a/.clang-tidy +++ b/.clang-tidy @@ -81,6 +81,11 @@ Checks: # precedence over addition in modern mathematical notation. Adding # parentheses to reinforce that certainly won't improve readability. - "-readability-math-missing-parentheses" + + # #if defined(FOO) is fine, and can be more consistent with other + # #if directives. Don't insist on #ifdef instead. + - "-readability-use-concise-preprocessor-directives" + WarningsAsErrors: "*" HeaderFileExtensions: - h -- 2.53.0

2 1

[PATCH 2/3] fwd, pif: Replace with pif_sock_l4() with pif_listen()
by David Gibson 05 Mar '26

05 Mar '26

It turns out all users of pif_sock_l4() use it for "listening" sockets, which now all have a common epoll reference format. We can take advantage of that to pass the necessary epoll information into pif_sock_l4() in a more natural way, rather than as an opaque u32. That in turn allows union fwd_listen_ref can become a struct, since the union only exist to allow the meaningful fields to be coerced into a u32 for pif_sock_l4(). Rename pif_sock_l4() to pif_listen() to reflect the new semantics. While we're there, remove the static_assert() on the fwd_listen_ref's size. We do still need it to fit into 32 bits, but that constraint is imposed only by the fact that it needs to fit into the whole, epoll_ref structure, which we already check with a static_assert() in epoll_ctl.h. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- epoll_ctl.h | 2 +- fwd.h | 14 +++++--------- pif.c | 14 ++++++++------ pif.h | 6 +++--- tcp.c | 8 +------- udp.c | 8 +------- 6 files changed, 19 insertions(+), 33 deletions(-) diff --git a/epoll_ctl.h b/epoll_ctl.h index 2c103cde..879763cb 100644 --- a/epoll_ctl.h +++ b/epoll_ctl.h @@ -35,7 +35,7 @@ union epoll_ref { union { uint32_t flow; flow_sidx_t flowside; - union fwd_listen_ref listen; + struct fwd_listen_ref listen; uint32_t data; int nsdir_fd; int queue; diff --git a/fwd.h b/fwd.h index 16070111..b0e2373d 100644 --- a/fwd.h +++ b/fwd.h @@ -49,20 +49,16 @@ struct fwd_rule { #define FWD_NO_HINT (-1) /** - * union fwd_listen_ref - information about a single listening socket + * struct fwd_listen_ref - information about a single listening socket * @port: Bound port number of the socket * @pif: pif in which the socket is listening * @rule: Index of forwarding rule */ -union fwd_listen_ref { - struct { - in_port_t port; - uint8_t pif; - unsigned rule :FWD_RULE_BITS; - }; - uint32_t u32; +struct fwd_listen_ref { + in_port_t port; + uint8_t pif; + unsigned rule :FWD_RULE_BITS; }; -static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t)); enum fwd_ports_mode { FWD_UNSET = 0, diff --git a/pif.c b/pif.c index 6ae970a0..82a3b5e4 100644 --- a/pif.c +++ b/pif.c @@ -62,23 +62,23 @@ void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, } } -/** pif_sock_l4() - Open a socket bound to an address on a specified interface +/** pif_listen() - Open a listening socket on a specified pif * @c: Execution context * @type: Socket epoll type * @pif: Interface for this socket * @addr: Address to bind to, or NULL for dual-stack any * @ifname: Interface for binding, NULL for any * @port: Port number to bind to (host byte order) - * @data: epoll reference portion for protocol handlers + * @rule: Forwarding rule index this socket belongs to * * NOTE: For namespace pifs, this must be called having already entered the * relevant namespace. * * Return: newly created socket, negative error code on failure */ -int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, - const union inany_addr *addr, const char *ifname, - in_port_t port, uint32_t data) +int pif_listen(const struct ctx *c, enum epoll_type type, uint8_t pif, + const union inany_addr *addr, const char *ifname, + in_port_t port, unsigned rule) { union epoll_ref ref; int ret; @@ -98,7 +98,9 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, return ref.fd; ref.type = type; - ref.data = data; + ref.listen.port = port; + ref.listen.pif = pif; + ref.listen.rule = rule; ret = epoll_add(c->epollfd, EPOLLIN, ref); if (ret < 0) { diff --git a/pif.h b/pif.h index 0f7f6672..0eb3626a 100644 --- a/pif.h +++ b/pif.h @@ -59,8 +59,8 @@ static inline bool pif_is_socket(uint8_t pif) void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, uint8_t pif, const union inany_addr *addr, in_port_t port); -int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, - const union inany_addr *addr, const char *ifname, - in_port_t port, uint32_t data); +int pif_listen(const struct ctx *c, enum epoll_type type, uint8_t pif, + const union inany_addr *addr, const char *ifname, + in_port_t port, unsigned rule); #endif /* PIF_H */ diff --git a/tcp.c b/tcp.c index 16470703..a0d7cd86 100644 --- a/tcp.c +++ b/tcp.c @@ -2698,11 +2698,6 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, const union inany_addr *addr, const char *ifname, in_port_t port) { - union fwd_listen_ref ref = { - .port = port, - .pif = pif, - .rule = rule, - }; int s; ASSERT(!c->no_tcp); @@ -2722,8 +2717,7 @@ int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, return -EAFNOSUPPORT; } - s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, pif, addr, ifname, - port, ref.u32); + s = pif_listen(c, EPOLL_TYPE_TCP_LISTEN, pif, addr, ifname, port, rule); return s; } diff --git a/udp.c b/udp.c index 19adda06..464aa093 100644 --- a/udp.c +++ b/udp.c @@ -1139,11 +1139,6 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, int udp_listen(const struct ctx *c, uint8_t pif, unsigned rule, const union inany_addr *addr, const char *ifname, in_port_t port) { - union fwd_listen_ref ref = { - .pif = pif, - .port = port, - .rule = rule, - }; int s; ASSERT(!c->no_udp); @@ -1163,8 +1158,7 @@ int udp_listen(const struct ctx *c, uint8_t pif, unsigned rule, return -EAFNOSUPPORT; } - s = pif_sock_l4(c, EPOLL_TYPE_UDP_LISTEN, pif, - addr, ifname, port, ref.u32); + s = pif_listen(c, EPOLL_TYPE_UDP_LISTEN, pif, addr, ifname, port, rule); return s; } -- 2.53.0

2 3

[PATCH] Add missing includes to headers
by Peter Foley 05 Mar '26

05 Mar '26

Support build systems like bazel that check that headers are self-contained. Signed-off-by: Peter Foley <pefoley(a)google.com> --- flow.h | 6 ++++++ flow_table.h | 1 + icmp_flow.h | 2 ++ inany.h | 5 +++++ ip.h | 2 ++ linux_dep.h | 3 +++ pif.h | 4 ++++ seccomp.sh | 5 +++++ siphash.h | 3 +++ tap.h | 5 +++++ tcp_conn.h | 4 ++++ tcp_internal.h | 5 +++++ udp_internal.h | 3 +++ util.c | 1 + 14 files changed, 49 insertions(+) diff --git a/flow.h b/flow.h index d636358..897c9ea 100644 --- a/flow.h +++ b/flow.h @@ -7,6 +7,12 @@ #ifndef FLOW_H #define FLOW_H +#include <stdint.h> +#include <netinet/in.h> + +#include "inany.h" +#include "util.h" + #define FLOW_TIMER_INTERVAL 1000 /* ms */ /** diff --git a/flow_table.h b/flow_table.h index 73de13b..8fb7b5c 100644 --- a/flow_table.h +++ b/flow_table.h @@ -7,6 +7,7 @@ #ifndef FLOW_TABLE_H #define FLOW_TABLE_H +#include "pif.h" #include "tcp_conn.h" #include "icmp_flow.h" #include "udp_flow.h" diff --git a/icmp_flow.h b/icmp_flow.h index fb93801..3af98be 100644 --- a/icmp_flow.h +++ b/icmp_flow.h @@ -7,6 +7,8 @@ #ifndef ICMP_FLOW_H #define ICMP_FLOW_H +#include "flow.h" + /** * struct icmp_ping_flow - Descriptor for a flow of ping requests/replies * @f: Generic flow information diff --git a/inany.h b/inany.h index b02c289..c7de094 100644 --- a/inany.h +++ b/inany.h @@ -9,6 +9,11 @@ #ifndef INANY_H #define INANY_H +#include <string.h> + +#include "ip.h" +#include "siphash.h" + struct siphash_state; /** union inany_addr - Represents either an IPv4 or IPv6 address diff --git a/ip.h b/ip.h index a8043c2..3be2d4e 100644 --- a/ip.h +++ b/ip.h @@ -9,6 +9,8 @@ #include <netinet/ip.h> #include <netinet/ip6.h> +#include "util.h" + #define IN4_IS_ADDR_UNSPECIFIED(a) \ (((struct in_addr *)(a))->s_addr == htonl_constant(INADDR_ANY)) #define IN4_IS_ADDR_BROADCAST(a) \ diff --git a/linux_dep.h b/linux_dep.h index 89e590c..3f8184b 100644 --- a/linux_dep.h +++ b/linux_dep.h @@ -7,6 +7,9 @@ #ifndef LINUX_DEP_H #define LINUX_DEP_H +#include <stdint.h> +#include <unistd.h> + /* struct tcp_info_linux - Information from Linux TCP_INFO getsockopt() * * Largely derived from include/linux/tcp.h in the Linux kernel diff --git a/pif.h b/pif.h index 0f7f667..7c755bd 100644 --- a/pif.h +++ b/pif.h @@ -7,6 +7,10 @@ #ifndef PIF_H #define PIF_H +#include <netinet/in.h> + +#include "epoll_type.h" + union inany_addr; union sockaddr_inany; diff --git a/seccomp.sh b/seccomp.sh index 60ebe84..5347586 100755 --- a/seccomp.sh +++ b/seccomp.sh @@ -34,6 +34,11 @@ AUDIT_ARCH="AUDIT_ARCH_$(echo ${ARCH} | tr '[a-z]' '[A-Z]' \ HEADER="/* This file was automatically generated by $(basename ${0}) */ +#include <stddef.h> +#include <linux/audit.h> +#include <linux/filter.h> +#include <linux/seccomp.h> + #ifndef AUDIT_ARCH_PPC64LE #define AUDIT_ARCH_PPC64LE (AUDIT_ARCH_PPC64 | __AUDIT_ARCH_LE) #endif" diff --git a/siphash.h b/siphash.h index e760236..bbddcac 100644 --- a/siphash.h +++ b/siphash.h @@ -44,6 +44,9 @@ #ifndef SIPHASH_H #define SIPHASH_H +#include <stddef.h> +#include <stdint.h> + /** * struct siphash_state - Internal state of siphash calculation */ diff --git a/tap.h b/tap.h index cc780d1..07ca096 100644 --- a/tap.h +++ b/tap.h @@ -6,6 +6,11 @@ #ifndef TAP_H #define TAP_H +#include <stddef.h> +#include <stdint.h> + +#include "passt.h" + /** L2_MAX_LEN_PASTA - Maximum frame length for pasta mode (with L2 header) * * The kernel tuntap device imposes a maximum frame size of 65535 including diff --git a/tcp_conn.h b/tcp_conn.h index 21cea10..d4d0139 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -9,6 +9,10 @@ #ifndef TCP_CONN_H #define TCP_CONN_H +#include <stdint.h> + +#include "flow.h" + /** * struct tcp_tap_conn - Descriptor for a TCP connection (not spliced) * @f: Generic flow information diff --git a/tcp_internal.h b/tcp_internal.h index 518913b..591e58c 100644 --- a/tcp_internal.h +++ b/tcp_internal.h @@ -6,6 +6,11 @@ #ifndef TCP_INTERNAL_H #define TCP_INTERNAL_H +#include <stdint.h> +#include <netinet/tcp.h> + +#include "util.h" + #define MAX_WS 8 #define MAX_WINDOW (1 << (16 + (MAX_WS))) diff --git a/udp_internal.h b/udp_internal.h index 0a8fe49..64e4577 100644 --- a/udp_internal.h +++ b/udp_internal.h @@ -6,6 +6,9 @@ #ifndef UDP_INTERNAL_H #define UDP_INTERNAL_H +#include <netinet/in.h> +#include <netinet/udp.h> + #include "tap.h" /* needed by udp_meta_t */ /** diff --git a/util.c b/util.c index a48f727..db27431 100644 --- a/util.c +++ b/util.c @@ -25,6 +25,7 @@ #include <errno.h> #include <stdbool.h> #include <linux/errqueue.h> +#include <linux/in6.h> #include <getopt.h> #include "linux_dep.h" -- 2.53.0.371.g1d285c8824-goog

3 25

[PATCH] iov: Add iov_truncate() helper and use it in udp_vu_sock_recv()
by Laurent Vivier 04 Mar '26

04 Mar '26

Add a generic iov_truncate() function that truncates an IO vector to a given number of bytes, returning the number of iov entries that contain data after truncation. Use it in udp_vu_sock_recv() to replace the open-coded truncation logic that adjusted iov entries after recvmsg(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- iov.c | 22 ++++++++++++++++++++++ iov.h | 1 + udp_vu.c | 12 +++--------- 3 files changed, 26 insertions(+), 9 deletions(-) diff --git a/iov.c b/iov.c index ad726daa4cd8..31a3f5bc29e5 100644 --- a/iov.c +++ b/iov.c @@ -147,6 +147,28 @@ size_t iov_size(const struct iovec *iov, size_t iov_cnt) return len; } +/** + * iov_truncate() - Truncate an IO vector to a given number of bytes + * @iov: IO vector (modified) + * @iov_cnt: Number of entries in @iov + * @size: Total number of bytes to keep + * + * Return: number of iov entries that contain data after truncation + */ +size_t iov_truncate(struct iovec *iov, size_t iov_cnt, size_t size) +{ + size_t i, offset; + + i = iov_skip_bytes(iov, iov_cnt, size, &offset); + + if (i < iov_cnt) { + iov[i].iov_len = offset; + i += !!offset; + } + + return i; +} + /** * iov_tail_prune() - Remove any unneeded buffers from an IOV tail * @tail: IO vector tail (modified) diff --git a/iov.h b/iov.h index d2184bfd12bd..f87436f5479b 100644 --- a/iov.h +++ b/iov.h @@ -28,6 +28,7 @@ size_t iov_from_buf(const struct iovec *iov, size_t iov_cnt, size_t iov_to_buf(const struct iovec *iov, size_t iov_cnt, size_t offset, void *buf, size_t bytes); size_t iov_size(const struct iovec *iov, size_t iov_cnt); +size_t iov_truncate(struct iovec *iov, size_t iov_cnt, size_t size); /* * DOC: Theory of Operation, struct iov_tail diff --git a/udp_vu.c b/udp_vu.c index 51f3718f5925..3f558a33b4f2 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -71,9 +71,9 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, bool v6, ssize_t *dlen) { const struct vu_dev *vdev = c->vdev; - int iov_cnt, idx, iov_used; - size_t off, hdrlen, l2len; struct msghdr msg = { 0 }; + int iov_cnt, iov_used; + size_t hdrlen, l2len; ASSERT(!c->no_udp); @@ -115,13 +115,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, iov_vu[0].iov_base = (char *)iov_vu[0].iov_base - hdrlen; iov_vu[0].iov_len += hdrlen; - /* count the numbers of buffer filled by recvmsg() */ - idx = iov_skip_bytes(iov_vu, iov_cnt, *dlen + hdrlen, &off); - - /* adjust last iov length */ - if (idx < iov_cnt) - iov_vu[idx].iov_len = off; - iov_used = idx + !!off; + iov_used = iov_truncate(iov_vu, iov_cnt, *dlen + hdrlen); /* pad frame to 60 bytes: first buffer is at least ETH_ZLEN long */ l2len = *dlen + hdrlen - VNET_HLEN; -- 2.53.0

1 0

[PATCH] Avoid clang warnings in fwd.h
by Peter Foley 04 Mar '26

04 Mar '26

e.g. ./fwd.h:65:63: warning: '_Static_assert' with no message is a C23 extension [-Wc23-extensions] 65 | static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t)); Signed-off-by: Peter Foley <pefoley(a)google.com> --- fwd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fwd.h b/fwd.h index 1607011..7d299b6 100644 --- a/fwd.h +++ b/fwd.h @@ -62,7 +62,7 @@ union fwd_listen_ref { }; uint32_t u32; }; -static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t)); +static_assert(sizeof(union fwd_listen_ref) == sizeof(uint32_t), ""); enum fwd_ports_mode { FWD_UNSET = 0, -- 2.53.0.371.g1d285c8824-goog

3 5

[PATCH] netlink: Return prefix length for IPv6 addresses in nl_addr_get()
by Jon Maloy 04 Mar '26

04 Mar '26

nl_addr_get() was not setting the prefix_len output parameter for IPv6 addresses, only for IPv4. This meant callers always got 0 for IPv6, forcing them to use a hardcoded default (64). Fix by assigning *prefix_len even in the IPv6 case. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/netlink.c b/netlink.c index 82a2f0c..769cb23 100644 --- a/netlink.c +++ b/netlink.c @@ -752,7 +752,7 @@ int nl_addr_set_ll_nodad(int s, unsigned int ifi) * @ifi: Interface index in outer network namespace * @af: Address family * @addr: Global address to fill - * @prefix_len: Mask or prefix length, to fill (for IPv4) + * @prefix_len: Mask or prefix length, to fill * @addr_l: Link-scoped address to fill (for IPv6) * * Return: 0 on success, negative error code on failure @@ -797,7 +797,7 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); - prefix_max = ifa->ifa_prefixlen; + prefix_max = *prefix_len = ifa->ifa_prefixlen; } if (addr_l && -- 2.52.0

2 1

[PATCH trivial] checksum: fix clang-tidy error
by Laurent Vivier 03 Mar '26

03 Mar '26

Fix the following error reported by clang-tidy $ make clang-tidy ... checksum.c:284:2: error: preprocessor condition can be written more concisely using '#ifdef' [readability-use-concise-preprocessor-directives,-warnings-as-errors] 284 | #if defined(__AVX2__) | ^~ ~~~~~~~~~~~~~~~~~ | ifdef __AVX2__ Fixes: 036fb8770cc2 ("checksum: add VSX fast path for POWER8/POWER9") Cc: jfiusdq(a)proton.me Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- checksum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checksum.c b/checksum.c index 828f9ecc9c02..bfba6f78b293 100644 --- a/checksum.c +++ b/checksum.c @@ -281,7 +281,7 @@ void csum_icmp6(struct icmp6hdr *icmp6hr, icmp6hr->icmp6_cksum = csum(payload, dlen, psum); } -#if defined(__AVX2__) +#ifdef __AVX2__ #include <immintrin.h> /** -- 2.53.0

3 2

[PATCH v2 2/4] tcp: Re-introduce inactivity timeouts based on a clock algorithm
by David Gibson 02 Mar '26

02 Mar '26

We previously had a mechanism to remove TCP connections which were inactive for 2 hours. That was broken for a long time, due to poor interactions with the timerfd handling, so we removed it. Adding this long scale timer onto the timerfd handling, which mostly handles much shorter timeouts is tricky to reason about. However, for the inactivity timeouts, we don't require precision. Instead, we can use a 1-bit page replacement / "clock" algorithm. Every INACTIVITY_INTERVAL (2 hours), a global timer marks every TCP connection as tentatively inactive. That flag is cleared if we get any events, either tap side or socket side. If the inactive flag is still set when the next INACTIVITY_INTERVAL expires then the connection has been inactive for an extended period and we reset and close it. In practice this means that connections will be removed after 2-4 hours of inactivity. This is not a true fix for bug 179, but it does mitigate the damage, by limiting the time that inactive connections will remain around, Link: https://bugs.passt.top/show_bug.cgi?id=179 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++---- tcp.h | 4 +++- tcp_conn.h | 3 +++ 3 files changed, 55 insertions(+), 5 deletions(-) diff --git a/tcp.c b/tcp.c index f8663369..09929ee9 100644 --- a/tcp.c +++ b/tcp.c @@ -198,6 +198,13 @@ * TCP_INFO, with a representable range from RTT_STORE_MIN (100 us) to * RTT_STORE_MAX (3276.8 ms). The timeout value is clamped accordingly. * + * We also use a global interval timer for an activity timeout which doesn't + * require precision: + * + * - INACTIVITY_INTERVAL: if a connection has had no activity for an entire + * interval, close and reset it. This means that idle connections (without + * keepalives) will be removed between INACTIVITY_INTERVAL seconds and + * 2*INACTIVITY_INTERVAL seconds after the last activity. * * Summary of data flows (with ESTABLISHED event) * ---------------------------------------------- @@ -333,7 +340,8 @@ enum { #define RTO_INIT 1 /* s, RFC 6298 */ #define RTO_INIT_AFTER_SYN_RETRIES 3 /* s, RFC 6298 */ -#define ACT_TIMEOUT 7200 + +#define INACTIVITY_INTERVAL 7200 /* s */ #define LOW_RTT_TABLE_SIZE 8 #define LOW_RTT_THRESHOLD 10 /* us */ @@ -2254,6 +2262,8 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, return 1; } + conn->inactive = false; + if (th->ack && !(conn->events & ESTABLISHED)) tcp_update_seqack_from_tap(c, conn, ntohl(th->ack_seq)); @@ -2622,6 +2632,8 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, return; } + conn->inactive = false; + if ((conn->events & TAP_FIN_ACKED) && (events & EPOLLHUP)) { conn_event(c, conn, CLOSED); return; @@ -2872,18 +2884,51 @@ int tcp_init(struct ctx *c) return 0; } +/** + * tcp_inactivity() - Scan for and close long-inactive connections + * @c: Execution context + * @now: Current timestamp + */ +static void tcp_inactivity(struct ctx *c, const struct timespec *now) +{ + union flow *flow; + + if (now->tv_sec - c->tcp.inactivity_run < INACTIVITY_INTERVAL) + return; + + debug("TCP inactivity scan"); + c->tcp.inactivity_run = now->tv_sec; + + flow_foreach(flow) { + struct tcp_tap_conn *conn = &flow->tcp; + + if (flow->f.type != FLOW_TCP) + continue; + + if (conn->inactive) { + /* No activity in this interval, reset */ + flow_dbg(conn, "Inactive for at least %us, resetting", + INACTIVITY_INTERVAL); + tcp_rst(c, conn); + } + + /* Ready to check for next interval */ + conn->inactive = true; + } +} + /** * tcp_timer() - Periodic tasks: port detection, closed connections, pool refill * @c: Execution context * @now: Current timestamp */ -void tcp_timer(const struct ctx *c, const struct timespec *now) +void tcp_timer(struct ctx *c, const struct timespec *now) { - (void)now; - tcp_sock_refill_init(c); if (c->mode == MODE_PASTA) tcp_splice_refill(c); + + tcp_inactivity(c, now); } /** diff --git a/tcp.h b/tcp.h index 24b90870..e104d453 100644 --- a/tcp.h +++ b/tcp.h @@ -21,7 +21,7 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, const union inany_addr *addr, const char *ifname, in_port_t port); int tcp_init(struct ctx *c); -void tcp_timer(const struct ctx *c, const struct timespec *now); +void tcp_timer(struct ctx *c, const struct timespec *now); void tcp_defer_handler(struct ctx *c); void tcp_update_l2_buf(const unsigned char *eth_d); @@ -38,6 +38,7 @@ extern bool peek_offset_cap; * @rto_max: Maximum retry timeout (in s) * @syn_retries: SYN retries using exponential backoff timeout * @syn_linear_timeouts: SYN retries before using exponential backoff timeout + * @inactivity_run: Time we last scanned for inactive connections */ struct tcp_ctx { struct fwd_ports fwd_in; @@ -47,6 +48,7 @@ struct tcp_ctx { int rto_max; uint8_t syn_retries; uint8_t syn_linear_timeouts; + time_t inactivity_run; }; #endif /* TCP_H */ diff --git a/tcp_conn.h b/tcp_conn.h index 21cea109..7197ff63 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -16,6 +16,7 @@ * @ws_from_tap: Window scaling factor advertised from tap/guest * @ws_to_tap: Window scaling factor advertised to tap/guest * @tap_mss: MSS advertised by tap/guest, rounded to 2 ^ TCP_MSS_BITS + * @inactive: No activity within the current INACTIVITY_INTERVAL * @sock: Socket descriptor number * @events: Connection events, implying connection states * @timer: timerfd descriptor for timeout events @@ -57,6 +58,8 @@ struct tcp_tap_conn { (conn->rtt_exp = MIN(RTT_EXP_MAX, ilog2(MAX(1, rtt / RTT_STORE_MIN)))) #define RTT_GET(conn) (RTT_STORE_MIN << conn->rtt_exp) + bool inactive :1; + int sock :FD_REF_BITS; uint8_t events; -- 2.53.0

2 2

[PATCH 0/3] Miscellaneous minor fixes
by David Gibson 02 Mar '26

02 Mar '26

I've just gotten back from holiday, so getting back into things with a collection of minor fixes, for things that arose while I was away. David Gibson (3): tcp: Use flow_foreach_of_type() in tcp_{keepalive,inactivity} fwd, pif: Replace with pif_sock_l4() with pif_listen() clang-tidy: Don't insist on #ifdef over #if defined() .clang-tidy | 5 +++++ epoll_ctl.h | 2 +- fwd.h | 14 +++++--------- pif.c | 14 ++++++++------ pif.h | 6 +++--- tcp.c | 18 +++--------------- udp.c | 8 +------- 7 files changed, 26 insertions(+), 41 deletions(-) -- 2.53.0

1 0