On Tue, Nov 10, 2020 at 1:25 AM Jakub Kicinski <k...@kernel.org> wrote: > > On Mon, 9 Nov 2020 12:59:30 +0530 nusid...@redhat.com wrote: > > From: Numan Siddique <nusid...@redhat.com> > > > > Before calling nf_conntrack_in(), caller can set this flag in the > > connection template for a tcp packet and any errors in the > > tcp_in_window() will be ignored. > > > > A helper function - nf_ct_set_tcp_be_liberal(nf_conn) is added which > > sets this flag for both the directions of the nf_conn. > > > > openvswitch makes use of this feature so that any out of window tcp > > packets are not marked invalid. Prior to this there was no easy way > > to distinguish if conntracked packet is marked invalid because of > > tcp_in_window() check error or because it doesn't belong to an > > existing connection. > > > > An earlier attempt (see the link) tried to solve this problem for > > openvswitch in a different way. Florian Westphal instead suggested > > to be liberal in openvswitch for tcp packets. > > > > Link: > > https://patchwork.ozlabs.org/project/netdev/patch/20201006083355.121018-1-nusid...@redhat.com/ > > > > Suggested-by: Florian Westphal <f...@strlen.de> > > Signed-off-by: Numan Siddique <nusid...@redhat.com> > > Please repost Ccing Pablo & netfilter-devel.
Thanks. I will repost. Numan > _______________________________________________ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev
