Bug 2230213

Summary:	Please enable CONFIG_INET_DIAG_DESTROY kernel option
Product:	Red Hat Enterprise Linux 8	Reporter:	Martin Schwenke <martin>
Component:	kernel	Assignee:	Andrea Claudi <aclaudi>
kernel sub component:	Networking	QA Contact:	Mingyu Shi <mshi>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	medium
Priority:	unspecified	CC:	aclaudi, asn, jiji, kzhang
Version:	8.8	Keywords:	Triaged
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel-4.18.0-513.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-11-14 15:46:34 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Schwenke 2023-08-09 01:50:24 UTC

Description of problem:

The ss command's -K | --kill option can be used to forcibly close sockets.  This is very useful for scripting failover in a high-availability setting.  In particular, it can be used to reset the server end of TCP connections so failback will work if a client reconnects using the same source socket.

Other Linux distributions such as Debian and Ubuntu enable this kernel option.

Version-Release number of selected component (if applicable):

all

How reproducible:

This is wishlist, so always.


Steps to Reproduce:
1. ssh 127.0.0.1
2. Try "ss -tanH --kill  state established src 127.0.0.1:22"

If this worked then it would print the connection(s) that were closed.  Can see connection(s) still exist with above command but without --kill option.

Actual results:

Does not close connection(s) and print details


Expected results:

Closes connection(s) and prints details

Additional info:

Kernel config says

# CONFIG_INET_DIAG_DESTROY is not set

This is the case on RHEL 8 and 9.

Comment 4 Mingyu Shi 2023-08-23 13:15:45 UTC

[21:10:13@dell-per730-20 ~]0# grep CONFIG_INET_DIAG_DESTROY /boot/config-4.18.0-5
config-4.18.0-509.el8.5210_967257772.x86_64  config-4.18.0-511.el8.x86_64                 
[21:10:13@dell-per730-20 ~]0# grep CONFIG_INET_DIAG_DESTROY /boot/config-4.18.0-5
config-4.18.0-509.el8.5210_967257772.x86_64  config-4.18.0-511.el8.x86_64                 
[21:10:13@dell-per730-20 ~]0# grep CONFIG_INET_DIAG_DESTROY /boot/config-4.18.0-509.el8.5210_967257772.x86_64 
CONFIG_INET_DIAG_DESTROY=y
[21:13:08@dell-per730-20 ~]0# ssh 127.0.0.1 &
[1] 10403
[21:13:29@dell-per730-20 ~]0# 

[1]+  Stopped                 ssh 127.0.0.1
[21:13:30@dell-per730-20 ~]0# 
[21:13:35@dell-per730-20 ~]0# ss | grep 127.
tcp   ESTAB  0      0                        127.0.0.1:50224          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:43000          127.0.0.1:ssh          
tcp   ESTAB  0      0                        127.0.0.1:50208          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:45753          127.0.0.1:50208        
tcp   ESTAB  0      0                        127.0.0.1:ssh            127.0.0.1:43000        
tcp   ESTAB  0      34                       127.0.0.1:45753          127.0.0.1:50224        
[21:13:40@dell-per730-20 ~]0# ss -K  state established src 127.0.0.1:22
Netid            Recv-Q            Send-Q                       Local Address:Port                        Peer Address:Port             Process            
tcp              0                 0                                127.0.0.1:ssh                            127.0.0.1:43000                               
[21:14:02@dell-per730-20 ~]0# ss | grep 127.
tcp   ESTAB  0      0                        127.0.0.1:50224          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:50208          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:45753          127.0.0.1:50208        
tcp   ESTAB  0      0                        127.0.0.1:45753          127.0.0.1:50224

Comment 5 Martin Schwenke 2023-08-23 23:11:16 UTC

One extra question, if I may, please?

This looks to be moving ahead for RHEL 8.  Thanks for that!  Does this mean the change will propagate to RHEL 9 and future versions?  Or do I need to open another request for RHEL 9?

Thanks...

Comment 6 Andrea Claudi 2023-08-25 15:09:37 UTC

Hi Martin, there was another bz tracking progress about this issue on RHEL 9, https://bugzilla.redhat.com/2137188.
As we are in progress of migrating our backlog on Jira, you can now follow its progress over there, at https://issues.redhat.com/browse/RHEL-212.

Comment 9 Martin Schwenke 2023-08-26 00:44:29 UTC

Hi Andrea,

(In reply to Andrea Claudi from comment #6)
> Hi Martin, there was another bz tracking progress about this issue on RHEL
> 9, https://bugzilla.redhat.com/2137188.
> As we are in progress of migrating our backlog on Jira, you can now follow
> its progress over there, at https://issues.redhat.com/browse/RHEL-212.

Thanks for letting me know!

Both of those (BZ & Jira tickets) seem to have restricted access, probably
due to the default "this is a kernel thing so it might be security
sensitive".  Would it be possible to open them up or, if not, give me access?
I'm martin in both places.

Thanks again!

Comment 11 errata-xmlrpc 2023-11-14 15:46:34 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: kernel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:7077