Page MenuHomePhabricator

Provide a ferm based alternative to tcp-mss-clamper
Closed, ResolvedPublic

Description

tcp-mss-clamper works great but has some limitations that could be avoided by using ferm on realservers where it's available. Our current puppezation profile::lvs::realserver::ipip is already firewall aware (only adding certain ferm rules if ferm is present) so switching between tcp-mss-clamper or ferm based MSS clamping should be feasible

Event Timeline

Change #1035724 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] lvs::realserver::ipip: Provide ferm MSS clamping support

https://gerrit.wikimedia.org/r/1035724

Change #1035724 merged by Vgutierrez:

[operations/puppet@production] lvs::realserver::ipip: Provide ferm MSS clamping support

https://gerrit.wikimedia.org/r/1035724

Change #1041645 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] realserver::ipip: Fix ferm MSS clamping rule

https://gerrit.wikimedia.org/r/1041645

Change #1041645 merged by Vgutierrez:

[operations/puppet@production] realserver::ipip: Fix ferm MSS clamping rule

https://gerrit.wikimedia.org/r/1041645

Mentioned in SAL (#wikimedia-operations) [2024-06-11T13:45:34Z] <vgutierrez> rolling switch from tcp-mss-clamper to ferm based MSS clamping on A:ncredir - T365689

ferm based MSS clamping is live on ncredir cluster