Bug 493226

Description of problem:
/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal changes from 1 to 0 on `service iptables restart`; ignoring settings in /etc/sysctl.conf (other settings seem to be honoured).

Version-Release number of selected component (if applicable):
iptables-1.3.5-4.el5


How reproducible:
Extremely

Steps to Reproduce:
1) ensure set to 1
[root@europa ~]# sysctl -a | grep ip_conntrack_tcp_be_liberal
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 1

2) restart iptables
[root@europa ~]# service iptables restart
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: nat filter                [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]
Loading additional iptables modules: ip_conntrack_netbios_n[  OK  ]

3) check new value
[root@europa ~]# sysctl -a | grep ip_conntrack_tcp_be_liberal
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 0

4) work around
[root@europa ~]# sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_be_liberal=1
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 1
  
Actual results:
[root@europa ~]# sysctl -a | grep ip_conntrack_tcp_be_liberal
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 0


Expected results:
Really this should honour what /etc/sysctl.conf contains:
root@europa monit.d]# grep liberal /etc/sysctl.conf 
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 1

and thus should produce (at least for me):
[root@europa ~]# sysctl -a | grep ip_conntrack_tcp_be_liberal
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 1


Additional info:
From what Red Hat support has told me at other times there appears to be an issue in netfilter with regards to connection tracking which is marking packets as INVALID when the network is under load. the be liberal setting is a work around already... That said, it probably shouldn't go against what /etc/sysctl.conf contains:
root@europa monit.d]# grep liberal /etc/sysctl.conf 
net.ipv4.netfilter.ip_conntrack_tcp_be_liberal = 1

also, /etc/sysconfig/iptables-config contains the IPTABLES_MODULES_UNLOAD="yes" setting, which set to no prevents this from occuring, but given the comments in the file, and the lack of other adverse effects simply working around it for now seems to do the trick.