Messages in this thread | | | Date | Fri, 1 Apr 2022 14:09:58 +0200 | From | Florian Westphal <> | Subject | Re: linux 5.17.1 disregarding ACK values resulting in stalled TCP connections |
| |
Jaco Kroon <jaco@uls.co.za> wrote: > > Eric Dumazet <edumazet@google.com> wrote: > >> Next step would be to attempt removing _all_ firewalls, especially not > >> common setups like yours. > >> > >> conntrack had a bug preventing TFO deployment for a while, because > >> many boxes kept buggy kernel versions for years. > >> > >> 356d7d88e088687b6578ca64601b0a2c9d145296 netfilter: nf_conntrack: fix > >> tcp_in_window for Fast Open > > Jaco could also try with > > net.netfilter.nf_conntrack_tcp_be_liberal=1 > > > > and, if that helps, with liberal=0 and > > sysctl net.netfilter.nf_conntrack_log_invalid=6 > > > > (check dmesg/syslog/nflog). > > Our core firewalls already had nf_conntrack_tcp_be_liberal for other > reasons (asymmetric routing combined with conntrackd left-over if I > recall), so maybe that's why it got through there ... don't exactly want > to just flip that setting though, is there a way to log if it would have > dropped anything, without actually dropping it (yet)?
This means conntrack doesn't tag packets as invalid EVEN if it would consider sequence/ack out-of-window (e.g. due to a bug).
I have a hard time seeing how tcp liberal-mode conntrack would be to blame here.
Only thing you could also check is if net.netfilter.nf_conntrack_checksum=0 helps (but i doubt it).
| |