Repository navigation
nstun: bound FIN flow idle lifetime and correct FIN retransmissions - #383
Open
botegalucas wants to merge 7 commits into
Open
botegalucas wants to merge 7 commits into
botegalucas wants to merge 7 commits into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
botegalucas
marked this pull request as ready for review
November 3, 2026 13:12
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This pull request addresses TCP connection lifecycle and resource retention issues identified in #382.
When nstun sends a FIN to the guest following host-side EOF, the TCP flow may remain in
ESTABLISHEDinstead of transitioning intoFIN_WAIT_1.As a result, half-closed connections may retain the 3,600-second established timeout instead of the intended 60-second closing timeout.
The implementation also addresses retransmission timing, TCP sequence number handling, and repeated
EPOLLHUPevents that could interfere with idle connection cleanup.Changes
Apply the existing 60-second closing timeout once a FIN has been sent, including flows that remain in
ESTABLISHED.Introduce an independent retransmission timer (
last_retransmit) to prevent retransmissions from extending the connection's idle lifetime.Retransmit unacknowledged FIN packets using their original TCP sequence number without incorrectly advancing or rewinding the next sequence number.
Prevent duplicate ACK handling from modifying TCP sequence tracking after FIN transmission.
Use modular TCP sequence arithmetic to account for 32-bit sequence number wraparound.
Improve host-side EOF handling to prevent repeated
EPOLLHUPnotifications from continuously refreshing connection activity.Add regression tests covering FIN timeout behavior, retransmissions, sequence numbers, and Linux EOF/HUP handling.
The patch deliberately avoids activating unfinished
FIN_WAIT,CLOSING, andTIME_WAITtransition paths that could introduce additional regressions.Validation Results
The updated implementation was compiled and tested successfully on Ubuntu Linux using GitHub Actions.
All checks in the final contributor-side validation workflow passed:
Validation evidence:
Final Linux build, regression tests, and Docker build:
https://github.com/botegalucas/nsjail/actions/runs/41641007744
Additional Docker build validation:
https://github.com/botegalucas/nsjail/actions/runs/41640783227
The regression harness exercises extracted production TCP timer methods and Linux event handling behavior.
These results confirm successful compilation and the covered regression scenarios. A complete end-to-end TUN networking test with a real guest TCP connection has not yet been performed.
Scope and Compatibility
This is a targeted TCP connection-life 8000 cycle and resource-management correction.
It does not claim a demonstrated security vulnerability or a complete redesign of the TCP closing state machine.
The changes are intentionally limited to reducing resource retention and improving retransmission and EOF handling while preserving existing connection behavior.
Related Issue
Refs #382.
Review Status
The implementation has passed the available Linux build, unit, sanitizer, regression, and Docker checks on the contributor's fork.
The patch is ready for maintainer review. Additional integration testing or adjustments can be incorporated based on reviewer feedback.