netdev - Re: sockets staying in FIN-WAIT-1, CLOSING, or LAST-ACK state till reboot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 16 May 2022 08:12:57 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Sami Farin <hvtaifwkbgefbaei@...il.com>,
        Linux Networking Mailing List <netdev@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>
Subject: Re: sockets staying in FIN-WAIT-1, CLOSING, or LAST-ACK state till
 reboot


On 5/15/22 07:04, Sami Farin wrote:
> Hello,
>
> with 5.15.37, ss -K -t does not properly kill the TCP sockets.
> [ Disclaimer: this is my guess of the culprit.  I also use wireguard. ]
>
> tcp          FIN-WAIT-1        0 1 80.220.8.55:22384                   
> 91.198.174.208:443 ino:0 sk:510b cgroup:unreachable:6c46 ---
>      skmem:(r0,rb87380,t0,tb130560,f0,w0,o0,bl0,d0) ts sack ecn 
> ecnseen bbr wscale:9,10 rto:3744 rtt:33.364/18.714 ato:40 mss:36 
> pmtu:68 rcvmss:536 advmss:1448 cwnd:1 bytes_sent:701 bytes_acked:702 
> bytes_received:254 segs_out:6 segs_in:3 data_segs_out:2 data_segs_in:1 
> bbr:(bw:10176bps,mrtt:27.924,pacing_gain:2.88672,cwnd_gain:2.88672) 
> send 8632bps lastsnd:601107881 lastrcv:601107884 lastack:601107810 
> pacing_rate 11658680bps delivery_rate 10192bps delivered:3 app_limited 
> busy:23371222ms lost:1 rcv_space:14480 rcv_ssthresh:42242 minrtt:27.924
>
> $ nc -l -p 22384
> Ncat: bind to 0.0.0.0:22384: Address already in use. QUITTING.
> $ nc -l 127.0.0.1 22384
> ^C
> $
>
> These zombie sockets all have Send-Q > 0.


That is right.

tcp_abort() currently supports established and SYN_RECV sockets only.

Adding support for TIMEWAIT should not be difficult.