From: Thomas Jarosch <thomas.jarosch@intra2net.com>
To: Sasha Levin <sashal@kernel.org>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Florian Westphal <fw@strlen.de>,
Jakub Jankowski <shasta@toxcorp.com>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org
Subject: Re: [PATCH AUTOSEL 4.19 04/42] netfilter: conntrack: always store window size un-scaled
Date: Thu, 8 Aug 2019 11:02:09 +0200 [thread overview]
Message-ID: <20190808090209.wb63n6ibii4ivvba@intra2net.com> (raw)
In-Reply-To: <20190802132302.13537-4-sashal@kernel.org>
Hello together,
You wrote on Fri, Aug 02, 2019 at 09:22:24AM -0400:
> From: Florian Westphal <fw@strlen.de>
>
> [ Upstream commit 959b69ef57db00cb33e9c4777400ae7183ebddd3 ]
>
> Jakub Jankowski reported following oddity:
>
> After 3 way handshake completes, timeout of new connection is set to
> max_retrans (300s) instead of established (5 days).
>
> shortened excerpt from pcap provided:
> 25.070622 IP (flags [DF], proto TCP (6), length 52)
> 10.8.5.4.1025 > 10.8.1.2.80: Flags [S], seq 11, win 64240, [wscale 8]
> 26.070462 IP (flags [DF], proto TCP (6), length 48)
> 10.8.1.2.80 > 10.8.5.4.1025: Flags [S.], seq 82, ack 12, win 65535, [wscale 3]
> 27.070449 IP (flags [DF], proto TCP (6), length 40)
> 10.8.5.4.1025 > 10.8.1.2.80: Flags [.], ack 83, win 512, length 0
>
> Turns out the last_win is of u16 type, but we store the scaled value:
> 512 << 8 (== 0x20000) becomes 0 window.
>
> The Fixes tag is not correct, as the bug has existed forever, but
> without that change all that this causes might cause is to mistake a
> window update (to-nonzero-from-zero) for a retransmit.
>
> Fixes: fbcd253d2448b8 ("netfilter: conntrack: lower timeout to RETRANS seconds if window is 0")
> Reported-by: Jakub Jankowski <shasta@toxcorp.com>
> Tested-by: Jakub Jankowski <shasta@toxcorp.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
Also:
Tested-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
;)
We've hit the issue with the wrong conntrack timeout at two different sites,
long-lived connections to a SAP server over IPSec VPN were constantly dropping.
For us this was a regression after updating from kernel 3.14 to 4.19.
Yesterday I've applied the patch to kernel 4.19.57 and the problem is fixed.
The issue was extra hard to debug as we could just boot the new kernel
for twenty minutes in the evening on these productive systems.
The stable kernel patch from last Friday came right on time. I was just
about the replay the TCP connection with tcpreplay, so this saved
me from another week of debugging. Thanks everyone!
Best regards,
Thomas Jarosch
next prev parent reply other threads:[~2019-08-08 9:07 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-02 13:22 [PATCH AUTOSEL 4.19 01/42] netfilter: nfnetlink: avoid deadlock due to synchronous request_module Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 02/42] vfio-ccw: Set pa_nr to 0 if memory allocation fails for pa_iova_pfn Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 03/42] netfilter: Fix rpfilter dropping vrf packets by mistake Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 04/42] netfilter: conntrack: always store window size un-scaled Sasha Levin
2019-08-08 9:02 ` Thomas Jarosch [this message]
2019-08-14 10:19 ` Reindl Harald
2019-08-14 11:17 ` Jakub Jankowski
2019-08-14 17:01 ` Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 05/42] netfilter: nft_hash: fix symhash with modulus one Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 06/42] scripts/sphinx-pre-install: fix script for RHEL/CentOS Sasha Levin
2019-08-03 10:31 ` Alexander Kapshuk
2019-08-03 10:37 ` Mauro Carvalho Chehab
2019-08-03 12:09 ` Alexander Kapshuk
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 07/42] drm/amd/display: Wait for backlight programming completion in set backlight level Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 08/42] drm/amd/display: use encoder's engine id to find matched free audio device Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 09/42] drm/amd/display: Fix dc_create failure handling and 666 color depths Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 10/42] drm/amd/display: Only enable audio if speaker allocation exists Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 11/42] drm/amd/display: Increase size of audios array Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 12/42] iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 13/42] nl80211: fix NL80211_HE_MAX_CAPABILITY_LEN Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 14/42] mac80211: don't warn about CW params when not using them Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 15/42] allocate_flower_entry: should check for null deref Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 16/42] hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 17/42] x86/mm: Check for pfn instead of page in vmalloc_sync_one() Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 18/42] x86/mm: Sync also unmappings in vmalloc_sync_all() Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 19/42] drm/msm: stop abusing dma_map/unmap for cache Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 20/42] drm: silence variable 'conn' set but not used Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 21/42] cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 22/42] s390/qdio: add sanity checks to the fast-requeue path Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 23/42] ALSA: compress: Fix regression on compressed capture streams Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 24/42] ALSA: compress: Prevent bypasses of set_params Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 25/42] ALSA: compress: Don't allow paritial drain operations on capture streams Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 26/42] ALSA: compress: Be more restrictive about when a drain is allowed Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 27/42] perf tools: Fix proper buffer size for feature processing Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 28/42] perf probe: Avoid calling freeing routine multiple times for same pointer Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 29/42] drbd: dynamically allocate shash descriptor Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 30/42] ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 31/42] nvme: fix multipath crash when ANA is deactivated Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 32/42] ARM: davinci: fix sleep.S build error on ARMv4 Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 33/42] ARM: dts: bcm: bcm47094: add missing #cells for mdio-bus-mux Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 34/42] scsi: megaraid_sas: fix panic on loading firmware crashdump Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 35/42] scsi: ibmvfc: fix WARN_ON during event pool release Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 36/42] scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 37/42] test_firmware: fix a memory leak bug Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 38/42] sched/fair: Don't free p->numa_faults with concurrent readers Sasha Levin
2019-08-02 13:22 ` [PATCH AUTOSEL 4.19 39/42] sched/fair: Use RCU accessors consistently for ->numa_group Sasha Levin
2019-08-02 13:23 ` [PATCH AUTOSEL 4.19 40/42] tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop Sasha Levin
2019-08-02 13:23 ` [PATCH AUTOSEL 4.19 41/42] perf/core: Fix creating kernel counters for PMUs that override event->cpu Sasha Levin
2019-08-02 13:23 ` [PATCH AUTOSEL 4.19 42/42] s390/dma: provide proper ARCH_ZONE_DMA_BITS value Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190808090209.wb63n6ibii4ivvba@intra2net.com \
--to=thomas.jarosch@intra2net.com \
--cc=coreteam@netfilter.org \
--cc=fw@strlen.de \
--cc=kadlec@blackhole.kfki.hu \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=sashal@kernel.org \
--cc=shasta@toxcorp.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).