Repository navigation
Conversation
Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sairex53 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| }, | ||
| }) | ||
|
|
||
| if timeWaitTimeout > 0 { |
There was a problem hiding this comment.
gvisor accepts 0 as timeout value
| TCPConnectTimeout int `yaml:"tcpConnectTimeout,omitempty"` | ||
|
|
||
| // Timeout in seconds for TCP connections in TIME-WAIT (default: 60) | ||
| TCPTimeWaitTimeout int `yaml:"tcpTimeWaitTimeout,omitempty"` |
There was a problem hiding this comment.
we need to have cli parameter for this, as not all users use YAML for configuration
| } | ||
|
|
||
| func New(configuration *types.Configuration) (*VirtualNetwork, error) { | ||
| if _, err := parseTCPTimeWaitTimeout(configuration.TCPTimeWaitTimeout); err != nil { |
There was a problem hiding this comment.
We don't need to validate the timeout here since it's already being validated in createStack()
| if timeoutSeconds < 0 { | ||
| return 0, errors.New("TCP time-wait timeout must not be negative") | ||
| } | ||
| if int64(timeoutSeconds) > (1<<63-1)/int64(time.Second) { |
There was a problem hiding this comment.
| if int64(timeoutSeconds) > (1<<63-1)/int64(time.Second) { | |
| if int64(timeoutSeconds) > math.MaxInt64 / int64(time.Second) { |
Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Summary
Expose the TCP TIME-WAIT timeout through
stack.tcpTimeWaitTimeoutand the-tcp-time-wait-timeoutCLI flag to address connection stalls caused by stale 4-tuples. An omitted value retains gVisor's 60-second default; an explicit zero is passed through to gVisor. Reject negative and overflowing values before creating the network endpoint or capture file.Fixes #757.
Testing
go test ./pkg/... ./cmd/gvproxy/... -count=1go vet ./pkg/virtualnetwork ./cmd/gvproxygit diff --checkThe CLI regression test fails on the original PR revision because the flag is undefined and passes with this revision.