Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > I can also see IP_CT_TCP_FLAG_CLOSE_INIT is not set on when ct->state > is adjusted to _FIN_WAIT state in the fixup routine. Unrelated to this patch, but I think that there is an increasing and disturbing amount of code that attempts to 'fix' the ct state. I don't think its right and I intend to remove all of these "fixups" of the conntrack state from flowtable infra. I see no reason whatsoever why we need to do this, fin can be passed up to conntrack and conntrack can and should handle this without any extra mucking with the nf_conn state fields from flowtable infra. The only cases where I see why we need to take action from flowtable layer are: 1. timeout extensions of nf_conn from gc worker to prevent eviction 2. removal of the flowtable entry on RST reception. Don't see why that needs state fixup of nf_conn. 3. removal of the flowtable entry on hard failure of output routines, e.g. because route is stale. Don't see why that needs any nf_conn changes either. My impression is that all these conditionals paper over some other bugs, for example gc_worker extending timeout is racing with the datapath, this needs to be fixed first. I plan to work on this after the selftest fixups.
