On Mon, 2 Sep 2013, Phil Oester wrote: > On Mon, Sep 02, 2013 at 08:58:00PM +0200, Jozsef Kadlecsik wrote: > > The netfilter TCP conntrack used to mark packets with bogus SACK option > > values as INVALID. However, it seems broken SEQ anonymizers, which are > > responsible for such traffic, are not going to die out soon and conntrack > > effectively blocks traffic coming through such devices. > > > > Better be liberal at conntrack level: when SACK is bogus, ignore it. > > But if conntrack were being "liberal" then it wouldn't care about the > value of the ACKs either, no? This sort of defeats the purpose of TCP > window tracking. No, it doesn't defeat it - we fall back to checking the ACK value against the window. > At the very least, this workaround should be dependent upon > nf_conntrack_tcp_be_liberal != 0. > > Also note that David Miller refused to accept a patch working around this > issue in the TCP stack [1]. Why should netfilter do so? > > [1] http://marc.info/?l=linux-netdev&m=137714232805063&w=2 The purpose of that patch is to get back as much performance of TCP as possible, by working around the broken SACK options. This patch lets the traffic at least through, otherwise it's simply blocked by conntrack. Similarly to the TCP stack, conntrack should ignore bogus SACK values instead of effectively dropping the stream. This is a long time issue. To be honest, I believed such anonymizer devices would have disappeared (fixed) by now. However it is apparently not so and at the same time conntrack actually breaks TCP robustness. Therefore I think it should be fixed. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
