On Wed, 4 Sep 2013, Phil Oester wrote: > On Tue, Sep 03, 2013 at 09:31:19AM +0200, Jozsef Kadlecsik wrote: > > On Mon, 2 Sep 2013, Phil Oester wrote: > > > But if conntrack were being "liberal" then it wouldn't care about the > > > value of the ACKs either, no? This sort of defeats the purpose of TCP > > > window tracking. > > > > No, it doesn't defeat it - we fall back to checking the ACK value against > > the window. > > > > > At the very least, this workaround should be dependent upon > > > nf_conntrack_tcp_be_liberal != 0. > > > > > > Also note that David Miller refused to accept a patch working around this > > > issue in the TCP stack [1]. Why should netfilter do so? > > > > > > [1] http://marc.info/?l=linux-netdev&m=137714232805063&w=2 > > > > The purpose of that patch is to get back as much performance of TCP as > > possible, by working around the broken SACK options. > > > > This patch lets the traffic at least through, otherwise it's simply > > blocked by conntrack. Similarly to the TCP stack, conntrack should ignore > > bogus SACK values instead of effectively dropping the stream. > > > > This is a long time issue. To be honest, I believed such anonymizer > > devices would have disappeared (fixed) by now. However it is apparently > > not so and at the same time conntrack actually breaks TCP robustness. > > Therefore I think it should be fixed. > > This should still only be allowed if nf_conntrack_tcp_be_liberal is > enabled IMHO (or some new sysctl like > nf_conntrack_tcp_sack_be_liberal?). Personally I don't care about these > broken middleboxes, and would rather not have SACK validation disabled > by default. nf_conntrack_tcp_be_liberal disables window tracking completely, including SACK validation too. I have been thinking on this from time to time and couldn't come up with a solution which is satisfying: even if an nf_conntrack_tcp_sack_be_liberal flag is added to the patch, if it's default off, then that's almost the same situations as we have at the present. Unless someone can back the patch with good arguments, I say forget about it. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
