Re: [PATCH v1 3/3] liveupdate: suppress TCP RST during post-kexec restore window

[Li Chen]

Hi Jakub,

 ---- On Tue, 03 Feb 2026 08:53:20 +0800  Jakub Kicinski <kuba@xxxxxxxxxx> wrote --- 
 > On Sun, 01 Feb 2026 09:44:27 +0800 Li Chen wrote:
 > >  > On Fri, 30 Jan 2026 22:51:19 +0800 Li Chen wrote:  
 > >  > > During a kexec-based live update, userspace may restore established TCP
 > >  > > connections after the new kernel has booted (e.g. via CRIU). Any packet
 > >  > > arriving for a not-yet-restored socket will hit the no-socket path and
 > >  > > trigger a TCP RST, causing the peer to immediately drop the connection.  
 > >  > 
 > >  > Can you not add a filter to simply drop those packets until workload is
 > >  > running again? It'd actually be less racy than this hac^w patch ...
 > >  >   
 > > 
 > > Thanks for the suggestion.
 > > 
 > > When you say "add a filter", do you mean installing a temporary drop rule
 > > (nftables/iptables/tc) in the network domain which does not get rebooted by
 > > kexec (e.g. LB/ToR/host firewall), so packets never reach the new kernel
 > > until the workload is restored and ready?
 > > 
 > > If you meant a filter inside the kexec'ed kernel, I'm worried it won't cover
 > > the critical window: kexec resets the ruleset, so we'd have to install the
 > > drop rule extremely early (initramfs) before any packets hit the no-socket
 > > path, which still seems inherently racy.
 > 
 > I'm not sure what your flow is exactly, but I assume you drive 
 > the workload restore from user space already?
 > 

Yes, in our PoC setup the post-kexec restore flow is driven from initramfs / early userspace.

We pass an initramfs via kexec --initrd and install a temporary iptables INPUT DROP rule from a dracut pre-mount hook (keyed by a cmdline like luo_tcp_drop_port=...). In our
external-peer test this avoids the early TCP RST window; the peer just retransmits/timeouts until CRIU restore recreates the socket.

The downside is that it makes initramfs heavier (iptables userspace + required xtables extensions, and it relies on legacy iptables filter support being available early). Not sure
this is a great general solution, but it can work when initramfs is under our control.

Regards,
Li​