netdev - RFC: configurable tcp timewait timeout sysctl kernel knob ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 19 Jul 2013 08:59:54 -0700
From:	Vincent Li <vincent.mc.li@...il.com>
To:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RFC: configurable tcp timewait timeout sysctl kernel knob ?

Hi,

there is sysctl tcp_fin_timeout to tune FIN_WAIT2 timeout, I couldn't
find a sysctl to tune TIME_WAIT timeout and it is hard coded to 60
seconds, we have a situation we need to either reduce the timewait
timeout value or recycle the timewait socket that is to use
tcp_tw_recycle and tcp_tw_reuse, is a sysctl to tune timewait value
good idea or bad idea that no one bothered to write one?

I have  a dirty hack patch to do that, but I think it may be  broken
to screw something I couldn't think of.

diff --git a/include/net/tcp.h b/include/net/tcp.h
index d198005..d1df673 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -245,6 +245,7 @@ extern int sysctl_tcp_timestamps;
 extern int sysctl_tcp_window_scaling;
 extern int sysctl_tcp_sack;
 extern int sysctl_tcp_fin_timeout;
+extern int sysctl_tcp_timewait_timeout;
 extern int sysctl_tcp_keepalive_time;
 extern int sysctl_tcp_keepalive_probes;
 extern int sysctl_tcp_keepalive_intvl;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b2c123c..15a0056 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -412,6 +412,13 @@ static struct ctl_table ipv4_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
        },
+       {
+               .procname       = "tcp_timewait_timeout",
+               .data           = &sysctl_tcp_timewait_timeout,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec_jiffies,
+       },
 #ifdef CONFIG_SYN_COOKIES
        {
                .procname       = "tcp_syncookies",
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 46ed9af..6df2a9c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -282,6 +282,7 @@
 #include <net/ll_poll.h>

 int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
+int sysctl_tcp_timewait_timeout __read_mostly = TCP_TIMEWAIT_LEN;

 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index ab1c086..9c2befc 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -332,6 +332,10 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)

                if (recycle_ok) {
                        tw->tw_timeout = rto;
+               } else if (sysctl_tcp_timewait_timeout) {
+                       tw->tw_timeout = sysctl_tcp_timewait_timeout;
+                       if (state == TCP_TIME_WAIT)
+                               timeo = sysctl_tcp_timewait_timeout;
                } else {
                        tw->tw_timeout = TCP_TIMEWAIT_LEN;
                        if (state == TCP_TIME_WAIT)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html