Conntrack TW->SS in Reply direction

[Marcelo Ricardo Leitner <mleitner@redhat.com>]

Hi,

Any reason on why we don't allow TW->SS state change in reply direction? It is 
currently marked as (since ever it seems) in a comment:
  *  sTW -> sIV  Reopened connection, but server may not do it.

That is true but just if the server role is never swapped between hosts and I 
don't see it violating any spec by allowing it..

Thing is, there is this application that needs a connection as a callback on a 
specified port range. This application is used between 2 servers, using 
conntrack and only allowing in new connections and its (related) packets. 
There will be a moment that the port that once was server for the callback, 
will now originate a callback to the other server.

As Linux stack uses TIME_WAIT timeout as 1min and conntrack as 2mins, there 
will be a moment on which the port selection allows using a port that, for 
conntrack, is still not allowed...

Reducing conntrack's TIME_WAIT timeout is more complicated because it may 
restrain the compatibility with other implementations, but allowing TW->SS 
imposes no harm?

Thanks,
Marcelo