<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Window Tracking not disabled"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1087#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Window Tracking not disabled"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1087">bug 1087</a>
from <span class="vcard"><a class="email" href="mailto:mat999@gmail.com" title="Mathew <mat999@gmail.com>"> <span class="fn">Mathew</span></a>
</span></b>
<pre>Hi,
<span class="quote">>> As I said, to properly deal with this situation, you need "TCPWindowTracking On".</span >
You are confused, "TCPWindowTracking Off" (default) sets the
IP_CT_TCP_FLAG_BE_LIBERAL on the resulting installed connection which disabled
TCP window tracking
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal does the same thing
globally.
--
I can confirm my diagnosis was correct. We patched the kernel to correctly
propagate the IP_CT_TCP_FLAG_BE_LIBERAL flag (which *IS* the flag set by
"TCPWindowTracking") to both sides of the connection. This showed the correct
behaviour.
I have not at this time done extensive testing of the patch or taken it any
further as of yet (plans are to formalise the patch for staging testing within
the fortnight).
The patch is just adding:
if (seen.flags & IP_CT_TCP_FLAG_BE_LIBERAL ) {
ct->proto.tcp.last_flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
}
to the line linked. This correctly propagates the flag to the last_flags
variable which goes on to form the reply side of the connection.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>