occasional connection reset on SNATed after tcp retries

[Dirk Mueller]

When neutron ports are connected to DVR routers that are without floating ip, the traffic is going via SNAT on the network node.

In some cases when the tcp connections that are nat'ed end up retransmitting, sometimes a packet is being retransmitted by the remote that is outside what the Linux kernel connection tracking considers part of valid tcp window. When this happens, the flow is receiving a RST, terminating the connection on the sender side, while leaving the receiver side (the neutron port attached VM) hanging.

A similar issue is described elsewhere, e.g. https://github.com/docker/libnetwork/issues/1090 and the workaround documented there of setting ip_conntrack_tcp_be_liberal seems to help in avoiding conntrack to dismiss packets outside the observed tcp window size which lets the tcp retransmit logic to eventually recover the connection.

[YAMAMOTO Takashi (yamamoto)]

this isn't specific to DVR, right?

[Brian Haley (brian-haley)]

https://review.openstack.org/#/c/618208/ was proposed, and it doesn't seem specific to DVR.

[Swaminathan Vasudevan (swaminathan-vasudevan)]

The environment in which this was seen is with DVR routers.

[Slawek Kaplonski (slaweq)]

This bug has had a related patch abandoned and has been automatically un-assigned due to inactivity. Please re-assign yourself if you are continuing work or adjust the state as appropriate if it is no longer valid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Slawek Kaplonski (<email address hidden>) on branch: master
Review: https://review.openstack.org/618208
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.