[akasakariko]

Fixes #16102

Compatibility

COMPATIBILITY:NEW-APP-CONFIG — fixes source-port exhaustion in the repeated wildcard-bound connections used by the BusyBox nc healthchecks reported in #16102

Problem and fix

A wildcard bind reserves its port using the wildcard address, but connecting replaces the endpoint local address with the connected address

A dual-stack wildcard bind also reserves both IPv6 and IPv4, while connecting to an IPv4-mapped peer changes effectiveNetProtos to IPv4 and releases the IPv4 reservation

Cleanup must therefore use the reservation address and the network protocols still owned by the endpoint, rather than the connected address and effective protocols

• Record boundAddr and boundNetProtos for explicit binds, implicit connect reservations and accepted tuples
• Release the IPv4 reservation with its complete metadata and retain the IPv6 reservation for close
• Use the recorded reservation in both close and cleanup paths, with checklocks annotations on the new fields

Rebased onto 0bbcbf9de7626fcecba97f37723dce80b435d73d

Regression coverage

Adapted the syscall test suggested by @tamird into SocketInetLoopback.WildcardBoundPortReleasedOnClose, covering IPv4 wildcard and dual-stack wildcard connections to an IPv4 peer

The test uses an abortive close to avoid TIME_WAIT and verifies that both IPv4 and IPv6-only wildcard binds can reuse the port

The review reproducer passes on Linux and fails on the previous PR implementation with EADDRINUSE for the IPv6-only bind

The updated test passes on both Linux and gVisor, replacing the duplicate Go behavior test

Local validation

Linux ARM64 in a Colima-backed Ubuntu container, Bazel 8.8.1

• Focused regression on native Linux and gVisor systrap — passed
• Full socket_inet_loopback suite on native Linux and gVisor systrap — passed, 8 shards each
• TCP and ports package tests — all 28 targets passed, including nogo and checklocks analysis for ARM64 and AMD64
• Ports, TCP and dual-stack tests with race detection and lockdep enabled together — all 3 targets passed
• make lint — passed
• make lint-cc — passed with the compilation database scoped to the affected syscall target and its 16 source files
• git diff --check — passed

common="--jobs=4 --local_resources=memory=5000 --cxxopt=-Werror"

bazel test $common --test_output=errors --test_sharding_strategy=disabled \
  --test_filter=SocketInetLoopback.WildcardBoundPortReleasedOnClose \
  //test/syscalls:socket_inet_loopback_test_native

make syscall-tests DOCKER_BUILD=false BAZEL_OPTIONS="$common" \
  TARGETS=//test/syscalls:socket_inet_loopback_test_runsc_systrap_shared \
  OPTIONS="--test_sharding_strategy=disabled --test_filter=SocketInetLoopback.WildcardBoundPortReleasedOnClose"

bazel test $common --test_output=errors \
  //pkg/tcpip/ports/... //pkg/tcpip/transport/tcp/...

make syscall-tests DOCKER_BUILD=false BAZEL_OPTIONS="$common" \
  TARGETS=//test/syscalls:socket_inet_loopback_test_native

make syscall-tests DOCKER_BUILD=false BAZEL_OPTIONS="$common" \
  TARGETS=//test/syscalls:socket_inet_loopback_test_runsc_systrap_shared

bazel test $common --config=race --config=lockdep --test_output=errors \
  //pkg/tcpip/ports:ports_test //pkg/tcpip/transport/tcp:tcp_test \
  //pkg/tcpip/transport/tcp/test/e2e:dual_stack_test

make lint DOCKER_BUILD=false BAZEL_OPTIONS="$common"
python3 tools/gen_compile_commands.py //test/syscalls/linux:socket_inet_loopback_test
make lint-cc DOCKER_BUILD=false
git diff --check

Performance

Added BenchmarkWildcardBindClose and compared the master base against this change with the same benchmark and build flags

Alternating before/after execution order, 32 samples per version, Linux ARM64 with 6 vCPUs

Metric	Before	After	Comparison
Time	1253 ns/op	1275 ns/op	+1.76%, p=0.016
Allocation bytes	4960 B/op	4960 B/op	unchanged
Allocations	26 allocs/op	26 allocs/op	unchanged

The benchmark measures a small bind/close overhead, with no additional allocations

Each sample runs the built test binary with -test.run='^$' -test.bench='^BenchmarkWildcardBindClose$' -test.benchmem -test.count=1, followed by benchstat comparison

These are local results, not a claim that GitHub CI has passed

[akasakariko]

Could a maintainer approve the fork workflows for 48e209b?

Go, Lint, Gazelle, License header, Labeler and Actions Workflow Security Scan are marked action_required, with the run page confirming that maintainer approval is required

Local validation commands and results are in the PR description, while buildkite/first-pass is still pending

[milantracy]

ありがとう

[milantracy]

can you post the raw benchstat output for BenchmarkWildcardBindClose btw?

[akasakariko]

Thanks, I will post the raw benchstat output tonight (Tokyo time)

[akasakariko]

@milantracy Here is the raw benchstat output for BenchmarkWildcardBindClose

Measured on Linux ARM64 in a Colima-backed Ubuntu container with 6 vCPUs, using 32 samples per version and alternating the before/after execution order

• controlled-before.txt: base 0bbcbf9de7626fcecba97f37723dce80b435d73d with the benchmark added
• controlled-after.txt: PR implementation in 48e209b56058f40e422daa3d5308d5c18a29a1ae
• Both binaries use the same benchmark and build flags

Each sample runs with -test.run='^$' -test.bench='^BenchmarkWildcardBindClose$' -test.benchmem -test.count=1

Command: benchstat controlled-before.txt controlled-after.txt

goos: linux
goarch: arm64
                    │ controlled-before.txt │        controlled-after.txt        │
                    │        sec/op         │   sec/op     vs base               │
WildcardBindClose-6             1.253µ ± 3%   1.275µ ± 1%  +1.76% (p=0.016 n=32)

                    │ controlled-before.txt │       controlled-after.txt       │
                    │         B/op          │     B/op      vs base            │
WildcardBindClose-6            4.844Ki ± 0%   4.844Ki ± 0%  ~ (p=1.000 n=32) ¹
¹ all samples are equal

                    │ controlled-before.txt │      controlled-after.txt      │
                    │       allocs/op       │ allocs/op   vs base            │
WildcardBindClose-6              26.00 ± 0%   26.00 ± 0%  ~ (p=1.000 n=32) ¹
¹ all samples are equal

This measures a 1.76% increase in bind/close time, with unchanged allocation bytes and counts