On Mon, Sep 02, 2013 at 08:58:00PM +0200, Jozsef Kadlecsik wrote: > The netfilter TCP conntrack used to mark packets with bogus SACK option > values as INVALID. However, it seems broken SEQ anonymizers, which are > responsible for such traffic, are not going to die out soon and conntrack > effectively blocks traffic coming through such devices. > > Better be liberal at conntrack level: when SACK is bogus, ignore it. But if conntrack were being "liberal" then it wouldn't care about the value of the ACKs either, no? This sort of defeats the purpose of TCP window tracking. At the very least, this workaround should be dependent upon nf_conntrack_tcp_be_liberal != 0. Also note that David Miller refused to accept a patch working around this issue in the TCP stack [1]. Why should netfilter do so? Phil [1] http://marc.info/?l=linux-netdev&m=137714232805063&w=2 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
