RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2230213 - Please enable CONFIG_INET_DIAG_DESTROY kernel option
Summary: Please enable CONFIG_INET_DIAG_DESTROY kernel option
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: kernel
Version: 8.8
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Andrea Claudi
QA Contact: Mingyu Shi
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-09 01:50 UTC by Martin Schwenke
Modified: 2024-03-07 07:47 UTC (History)
4 users (show)

Fixed In Version: kernel-4.18.0-513.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-11-14 15:46:34 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Gitlab redhat/rhel/src/kernel rhel-8 merge_requests 5210 0 None None None 2023-08-14 17:23:24 UTC
Red Hat Issue Tracker RHELPLAN-164943 0 None None None 2023-08-09 01:51:06 UTC
Red Hat Product Errata RHSA-2023:7077 0 None None None 2023-11-14 15:47:22 UTC

Description Martin Schwenke 2023-08-09 01:50:24 UTC 
Description of problem:

The ss command's -K | --kill option can be used to forcibly close sockets.  This is very useful for scripting failover in a high-availability setting.  In particular, it can be used to reset the server end of TCP connections so failback will work if a client reconnects using the same source socket.

Other Linux distributions such as Debian and Ubuntu enable this kernel option.

Version-Release number of selected component (if applicable):

all

How reproducible:

This is wishlist, so always.


Steps to Reproduce:
1. ssh 127.0.0.1
2. Try "ss -tanH --kill  state established src 127.0.0.1:22"

If this worked then it would print the connection(s) that were closed.  Can see connection(s) still exist with above command but without --kill option.

Actual results:

Does not close connection(s) and print details


Expected results:

Closes connection(s) and prints details

Additional info:

Kernel config says

# CONFIG_INET_DIAG_DESTROY is not set

This is the case on RHEL 8 and 9.
Comment 4 Mingyu Shi 2023-08-23 13:15:45 UTC 
[21:10:13@dell-per730-20 ~]0# grep CONFIG_INET_DIAG_DESTROY /boot/config-4.18.0-5
config-4.18.0-509.el8.5210_967257772.x86_64  config-4.18.0-511.el8.x86_64                 
[21:10:13@dell-per730-20 ~]0# grep CONFIG_INET_DIAG_DESTROY /boot/config-4.18.0-5
config-4.18.0-509.el8.5210_967257772.x86_64  config-4.18.0-511.el8.x86_64                 
[21:10:13@dell-per730-20 ~]0# grep CONFIG_INET_DIAG_DESTROY /boot/config-4.18.0-509.el8.5210_967257772.x86_64 
CONFIG_INET_DIAG_DESTROY=y
[21:13:08@dell-per730-20 ~]0# ssh 127.0.0.1 &
[1] 10403
[21:13:29@dell-per730-20 ~]0# 

[1]+  Stopped                 ssh 127.0.0.1
[21:13:30@dell-per730-20 ~]0# 
[21:13:35@dell-per730-20 ~]0# ss | grep 127.
tcp   ESTAB  0      0                        127.0.0.1:50224          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:43000          127.0.0.1:ssh          
tcp   ESTAB  0      0                        127.0.0.1:50208          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:45753          127.0.0.1:50208        
tcp   ESTAB  0      0                        127.0.0.1:ssh            127.0.0.1:43000        
tcp   ESTAB  0      34                       127.0.0.1:45753          127.0.0.1:50224        
[21:13:40@dell-per730-20 ~]0# ss -K  state established src 127.0.0.1:22
Netid            Recv-Q            Send-Q                       Local Address:Port                        Peer Address:Port             Process            
tcp              0                 0                                127.0.0.1:ssh                            127.0.0.1:43000                               
[21:14:02@dell-per730-20 ~]0# ss | grep 127.
tcp   ESTAB  0      0                        127.0.0.1:50224          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:50208          127.0.0.1:45753        
tcp   ESTAB  0      0                        127.0.0.1:45753          127.0.0.1:50208        
tcp   ESTAB  0      0                        127.0.0.1:45753          127.0.0.1:50224
Comment 5 Martin Schwenke 2023-08-23 23:11:16 UTC 
One extra question, if I may, please?

This looks to be moving ahead for RHEL 8.  Thanks for that!  Does this mean the change will propagate to RHEL 9 and future versions?  Or do I need to open another request for RHEL 9?

Thanks...
Comment 6 Andrea Claudi 2023-08-25 15:09:37 UTC 
Hi Martin, there was another bz tracking progress about this issue on RHEL 9, https://bugzilla.redhat.com/2137188.
As we are in progress of migrating our backlog on Jira, you can now follow its progress over there, at https://issues.redhat.com/browse/RHEL-212.
Comment 9 Martin Schwenke 2023-08-26 00:44:29 UTC 
Hi Andrea,

(In reply to Andrea Claudi from comment #6)
> Hi Martin, there was another bz tracking progress about this issue on RHEL
> 9, https://bugzilla.redhat.com/2137188.
> As we are in progress of migrating our backlog on Jira, you can now follow
> its progress over there, at https://issues.redhat.com/browse/RHEL-212.

Thanks for letting me know!

Both of those (BZ & Jira tickets) seem to have restricted access, probably
due to the default "this is a kernel thing so it might be security
sensitive".  Would it be possible to open them up or, if not, give me access?
I'm martin in both places.

Thanks again!
Comment 11 errata-xmlrpc 2023-11-14 15:46:34 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: kernel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:7077
Note You need to log in before you can comment on or make changes to this bug.