"Connection Timeout" of "Route via HTTP (S)" does not work properly.

Products

• STARTER PACK-7
• CA Rapid App Security
• CA API Gateway

Issue/Introduction

If "Connection Timeout" of "Route via HTTP (S)" is set to a value larger than 60000, it will not work properly.
For axmaple:

("Connection Timeout" is less than 60000)
01. Set the non-connectable URL to "Route via HTTP (S)"
02. "Connection Timeout" : 30000
03. Send request to the service.
Result: Timeout occurred after about 30 seconds.

The log of at that time:

2018-08-28T13:48:23.145+0900 WARNING 249745 com.l7tech.server.policy.assertion.ServerHttpRoutingAssertion: 4042: Problem routing to http://172.8.1.6:8080/aaa. Error msg: Unable to obtain HTTP response from http://172.8.1.6:8080/aaa: Connect to 172.8.1.6:8080 timed out



("Connection Timeout" is greater than 60000)

("Connection Timeout" is less than 60000)
01. Set the non-connectable URL to "Route via HTTP (S)"
02. "Connection Timeout" : 120000
03. Send request to the service.
Result: Timeout occurred aftesecondsr about 60 .

The log of at that time:

2018-08-28T13:45:36.192+0900 WARNING 249849 com.l7tech.server.policy.assertion.ServerHttpRoutingAssertion: 4042: Problem routing to http://172.8.1.6:8080/aaa. Error msg: Unable to obtain HTTP response from http://172.8.1.6:8080/aaa: Connection to http://172.8.1.6:8080 refused. Caused by: Connection timed out (Connection timed out)

If "connection timeout" is greater than 60000, a timeout occurs about 60 seconds after whatever value of "connection timeout" is.
 

Environment

API Gateway 

Resolution

When sending a request to a URL that can not be connected, the reason for timeout in about 60 seconds is due to the timeout decision by the OS.
The Linux TCP connection operation resends the SYN packet if there is no response within 1 second after sending the first SYN packet.
After retransmitting the SYN packet, wait for a time response twice the previous waiting time. Retransmission of the SYN packet is done as many times as set in the kernel parameter net.ipv4.tcp_syn_retries.
The default value is 5. (In case of RHEL 6 used in API Gateway 9.2 Appliance version)
In this case, the total waiting time is 1 + 2 + 4 + 8 + 16 + 32 = 63, and the OS judges the timeout as approximately 63 seconds.
Therefore even if connectionTimout = 12000 on Gateway side, the OS returns timeout 63 seconds later.
The value of Connection Timeout on Gateway side should be shorter than the time until OS side judges timeout.