Hi,
Any reason on why we don't allow TW->SS state change in reply direction? It is
currently marked as (since ever it seems) in a comment:
* sTW -> sIV Reopened connection, but server may not do it.
That is true but just if the server role is never swapped between hosts and I
don't see it violating any spec by allowing it..
Thing is, there is this application that needs a connection as a callback on a
specified port range. This application is used between 2 servers, using
conntrack and only allowing in new connections and its (related) packets.
There will be a moment that the port that once was server for the callback,
will now originate a callback to the other server.
As Linux stack uses TIME_WAIT timeout as 1min and conntrack as 2mins, there
will be a moment on which the port selection allows using a port that, for
conntrack, is still not allowed...
Reducing conntrack's TIME_WAIT timeout is more complicated because it may
restrain the compatibility with other implementations, but allowing TW->SS
imposes no harm?
Thanks,
Marcelo
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
