lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:	Fri, 20 Nov 2015 08:22:55 -0800
From:	Stephen Hemminger <>
Subject: Fw: [Bug 108191] New: tcp option TCP_USER_TIMEOUT working incorrect
 within tcp keepalive.

Begin forwarded message:

Date: Fri, 20 Nov 2015 11:03:58 +0000
From: "" <>
To: "" <>
Subject: [Bug 108191] New: tcp option TCP_USER_TIMEOUT working incorrect within tcp keepalive.

            Bug ID: 108191
           Summary: tcp option TCP_USER_TIMEOUT working incorrect within
                    tcp keepalive.
           Product: Networking
           Version: 2.5
    Kernel Version: 4.3
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: IPV4
        Regression: No

The TCP_USER_TIMEOUT semantic means when you send an packet,
how long time no received the ACK should disconnect the connection.

In tcp retransmits case, 
retransmits_timed_out checkout this timeout, it walks well.

but in keepalive case.
the code below may have bugs:

    elapsed = keepalive_time_elapsed(tp);

    if (elapsed >= keepalive_time_when(tp)) {
        /* If the TCP_USER_TIMEOUT option is enabled, use that
         * to determine when to timeout instead.
        if ((icsk->icsk_user_timeout != 0 &&
            elapsed >= icsk->icsk_user_timeout &&
            icsk->icsk_probes_out > 0) ||
            (icsk->icsk_user_timeout == 0 &&
            icsk->icsk_probes_out >= keepalive_probes(tp))) {
            tcp_send_active_reset(sk, GFP_ATOMIC);
            goto out;
elapsed >= icsk->icsk_user_timeout should be
elapsed-keepalive_time_when(tp) >= icsk->icsk_user_timeout 

here is the timeline:

idle   .......   keepalive1         ......       keepalive2 ...
<- katime_when ->          <- keepalive_intvl  ->
                 <-  TCP_USER_TIMEOUT ->  // user expected timeout

/* test code */
int v;
v=1;setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &v, 4);
v=30;setsockopt(fd, SOL_TCP, TCP_KEEPIDLE, &v, 4);
v=5;setsockopt(fd, SOL_TCP, TCP_KEEPINTVL, &v, 4);
v=3;setsockopt(fd, SOL_TCP, TCP_KEEPCNT, &v, 4);
v=20*1000; setsockopt(fd, SOL_TCP, TCP_USER_TIMEOUT, &v, 4); 
connect(fd, addr, sizeof(addr);
// when connect
// drop the recv data
// iptables -t filter -A INPUT --protocol tcp --dport 8888 -j DROP

we can see 30s later, tcp start keepalive, and close connection
without do the  first retransmits (because 30+5 > 20)
but we want waiting 20 second.

You are receiving this mail because:
You are the assignee for the bug.
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists