Messages in this thread | | | Date | Fri, 1 Apr 2022 13:54:33 +0200 | Subject | Re: linux 5.17.1 disregarding ACK values resulting in stalled TCP connections | From | Jaco Kroon <> |
| |
Hi,
On 2022/04/01 02:15, Florian Westphal wrote:
Incidently, I always find your initials to be interesting considering (as far as I know) you work on netfilter firewall.
> Eric Dumazet <edumazet@google.com> wrote: >> Next step would be to attempt removing _all_ firewalls, especially not >> common setups like yours. >> >> conntrack had a bug preventing TFO deployment for a while, because >> many boxes kept buggy kernel versions for years. >> >> 356d7d88e088687b6578ca64601b0a2c9d145296 netfilter: nf_conntrack: fix >> tcp_in_window for Fast Open > Jaco could also try with > net.netfilter.nf_conntrack_tcp_be_liberal=1 > > and, if that helps, with liberal=0 and > sysctl net.netfilter.nf_conntrack_log_invalid=6 > > (check dmesg/syslog/nflog).
Our core firewalls already had nf_conntrack_tcp_be_liberal for other reasons (asymmetric routing combined with conntrackd left-over if I recall), so maybe that's why it got through there ... don't exactly want to just flip that setting though, is there a way to log if it would have dropped anything, without actually dropping it (yet)?
Will do this first, first need to confirm that I can reproduce in a dev environment.
Kind Regards, Jaco
| |