Re: linux 5.17.1 disregarding ACK values resulting in stalled TCP connections
From: Florian Westphal
Date: Fri Apr 01 2022 - 08:10:07 EST
Jaco Kroon <jaco@xxxxxxxxx> wrote:
> > Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
> >> Next step would be to attempt removing _all_ firewalls, especially not
> >> common setups like yours.
> >> conntrack had a bug preventing TFO deployment for a while, because
> >> many boxes kept buggy kernel versions for years.
> >> 356d7d88e088687b6578ca64601b0a2c9d145296 netfilter: nf_conntrack: fix
> >> tcp_in_window for Fast Open
> > Jaco could also try with
> > net.netfilter.nf_conntrack_tcp_be_liberal=1
> > and, if that helps, with liberal=0 and
> > sysctl net.netfilter.nf_conntrack_log_invalid=6
> > (check dmesg/syslog/nflog).
> Our core firewalls already had nf_conntrack_tcp_be_liberal for other
> reasons (asymmetric routing combined with conntrackd left-over if I
> recall), so maybe that's why it got through there ... don't exactly want
> to just flip that setting though, is there a way to log if it would have
> dropped anything, without actually dropping it (yet)?
This means conntrack doesn't tag packets as invalid EVEN if it would
consider sequence/ack out-of-window (e.g. due to a bug).
I have a hard time seeing how tcp liberal-mode conntrack would be to
Only thing you could also check is if
net.netfilter.nf_conntrack_checksum=0 helps (but i doubt it).