Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix bridge connection reset due to invalid packets #2275

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix bridge connection reset due to invalid packets #2275

wants to merge 1 commit into from

Commits on Oct 2, 2018

  1. Fix bridge connection reset due to invalid packets 

    Add drop of conntrack INVALID packets in input
such that invalid packets due to TCP window overflow do
not cause a connection reset.

Due to some netfilter/conntrack limitations, invalid packets
are never treated as NAT'ed but reassigned to the
host and considered martians.
This causes a RST response from the host and resets the connection.
As soon as NAT is setup, for bridge networks for instance,
invalid packets have to be dropped in input.

The implementation adds a generic DOCKER-INPUT chain prefilled
with a rule for dropping invalid packets and a return rule.
As soon as some bridge network is setup, the DOCKER-INPUT
chain call is inserted in the filter table INPUT chain.

Fixes moby#1090.

Signed-off-by: Christophe Guillon <[email protected]>
    @guillon
    guillon committed Oct 2, 2018
    Configuration menu
    Copy the full SHA
    fc8f042 View commit details
    Browse the repository at this point in the history