Fix LDAP network timeout not being honored on Linux

[Copilot]

Fixes #62075

Problem

On Linux, System.DirectoryServices.Protocols.LdapConnection does not honor the Timeout property at the network layer, causing network operations (such as connect or bind) to potentially hang indefinitely or much longer than the requested timeout. This occurs because the native LDAP handle does not have LDAP_OPT_NETWORK_TIMEOUT set, while on Windows the timeout is properly enforced at the network layer.

Solution

This PR implements proper network-level timeout support for Linux by setting LDAP_OPT_NETWORK_TIMEOUT via ldap_set_option on the LDAP handle after initialization and before any bind or search operations.

Key Changes

1. Added LDAP_OPT_NETWORK_TIMEOUT constant (0x5005) to the LdapOption enum
2. Added P/Invoke support for setting timeval structures via ldap_set_option_timeval
3. Modified InternalConnectToServer in LdapConnection.Linux.cs to set network timeout using the Timeout property value
4. Added comprehensive tests to verify timeout behavior across platforms
5. Uses proper error handling with CheckAndSetLdapError for timeout option setting

Implementation Details

The timeout is set in InternalConnectToServer after successful URI configuration:

var timeout = new LDAP_TIMEVAL()
{
    tv_sec = (int)(_connectionTimeOut.Ticks / TimeSpan.TicksPerSecond),
    tv_usec = (int)((_connectionTimeOut.Ticks % TimeSpan.TicksPerSecond) / 10)
};

int timeoutResult = LdapPal.SetTimevalOption(_ldapHandle, LdapOption.LDAP_OPT_NETWORK_TIMEOUT, ref timeout);
ErrorChecking.CheckAndSetLdapError(timeoutResult);

The implementation uses standard error handling patterns consistent with other LDAP options in the codebase.

Testing

• Added cross-platform unit tests to verify timeout functionality
• Added timeout failure test using unreachable endpoint (192.0.2.1)
• All existing tests continue to pass (46/46 LdapConnectionTests pass)
• Manual verification confirms proper exception handling and timeout behavior

Impact

This change brings Linux behavior in line with Windows and makes the Timeout property work as documented across platforms. While this could change behavior for callers whose connections previously took longer than the default timeout (30s) without overriding it, this is a desirable bug fix that improves reliability and cross-platform consistency.

Fixes scenarios where LDAP connections would hang indefinitely on Linux when network connectivity issues occurred, particularly important for applications that rely on predictable timeout behavior.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[ericstj]

@copilot can you address the feedback?

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 192.0.2.1
  • Triggering command: /home/REDACTED/work/runtime/runtime/artifacts/bin/testhost/net10.0-linux-Debug-x64/dotnet exec --runtimeconfig /home/REDACTED/work/runtime/runtime/artifacts/bin/System.DirectoryServices.Protocols.Tests/Debug/net10.0-linux/System.DirectoryServices.Protocols.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/runtime/runtime/artifacts/bin/System.DirectoryServices.Protocols.Tests/Debug/net10.0-linux/System.DirectoryServices.Protocols.Tests.deps.json /home/REDACTED/work/runtime/runtime/artifacts/bin/System.DirectoryServices.Protocols.Tests/Debug/net10.0-linux/testhost.dll --port 45025 --endpoint 127.0.0.1:045025 --role client --parentprocessid 58534 --datacollectionport 38201 --telemetryoptedin false (packet block)
• server
  • Triggering command: /home/REDACTED/work/runtime/runtime/artifacts/bin/testhost/net10.0-linux-Debug-x64/dotnet exec --runtimeconfig /home/REDACTED/work/runtime/runtime/artifacts/bin/System.DirectoryServices.Protocols.Tests/Debug/net10.0-linux/System.DirectoryServices.Protocols.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/runtime/runtime/artifacts/bin/System.DirectoryServices.Protocols.Tests/Debug/net10.0-linux/System.DirectoryServices.Protocols.Tests.deps.json /home/REDACTED/work/runtime/runtime/artifacts/bin/System.DirectoryServices.Protocols.Tests/Debug/net10.0-linux/testhost.dll --port 37491 --endpoint 127.0.0.1:037491 --role client --parentprocessid 59763 --datacollectionport 38459 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull Request Overview

This PR fixes a bug where System.DirectoryServices.Protocols.LdapConnection does not honor the Timeout property at the network layer on Linux, potentially causing network operations to hang indefinitely. The solution implements proper network-level timeout support for Linux by setting LDAP_OPT_NETWORK_TIMEOUT via ldap_set_option.

• Added LDAP_OPT_NETWORK_TIMEOUT constant and P/Invoke support for setting timeval structures
• Modified InternalConnectToServer in Linux implementation to set network timeout using the Timeout property
• Added comprehensive cross-platform tests to verify timeout behavior

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/libraries/System.DirectoryServices.Protocols/tests/LdapConnectionTests.cs	Added unit tests for timeout functionality including unreachable server test
src/libraries/System.DirectoryServices.Protocols/src/System/DirectoryServices/Protocols/ldap/LdapConnection.Linux.cs	Modified InternalConnectToServer to set network timeout after URI configuration
src/libraries/System.DirectoryServices.Protocols/src/System/DirectoryServices/Protocols/Interop/LdapPal.Linux.cs	Added SetTimevalOption method for setting timeval-based LDAP options
src/libraries/Common/src/Interop/Linux/OpenLdap/Interop.Ldap.cs	Added P/Invoke declaration for ldap_set_option_timeval
src/libraries/Common/src/Interop/Interop.Ldap.cs	Added LDAP_OPT_NETWORK_TIMEOUT constant to LdapOption enum

[tarekgh]

LGTM! left a minor question.

[ericstj]

Got feedback from customer contact that this does seem to be working in a test environment. They could not test in production. Will merge for now. Customer has a workaround so not planning to backport this to 10.0.