Julian Anastasov
f719e3754e
ipvs: drop first packet to redirect conntrack
...
Jiri Bohac is reporting for a problem where the attempt
to reschedule existing connection to another real server
needs proper redirect for the conntrack used by the IPVS
connection. For example, when IPVS connection is created
to NAT-ed real server we alter the reply direction of
conntrack. If we later decide to select different real
server we can not alter again the conntrack. And if we
expire the old connection, the new connection is left
without conntrack.
So, the only way to redirect both the IPVS connection and
the Netfilter's conntrack is to drop the SYN packet that
hits existing connection, to wait for the next jiffie
to expire the old connection and its conntrack and to rely
on client's retransmission to create new connection as
usually.
Jiri Bohac provided a fix that drops all SYNs on rescheduling,
I extended his patch to do such drops only for connections
that use conntrack. Here is the original report from Jiri Bohac:
Since commit dc7b3eb900 ("ipvs: Fix reuse connection if real server
is dead"), new connections to dead servers are redistributed
immediately to new servers. The old connection is expired using
ip_vs_conn_expire_now() which sets the connection timer to expire
immediately.
However, before the timer callback, ip_vs_conn_expire(), is run
to clean the connection's conntrack entry, the new redistributed
connection may already be established and its conntrack removed
instead.
Fix this by dropping the first packet of the new connection
instead, like we do when the destination server is not available.
The timer will have deleted the old conntrack entry long before
the first packet of the new connection is retransmitted.
Fixes: dc7b3eb900 ("ipvs: Fix reuse connection if real server is dead")
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
2016-03-07 11:53:30 +09:00
..
9p
9p: switch p9_client_read() to passing struct iov_iter *
2015-04-11 22:28:27 -04:00
bluetooth
Bluetooth: L2CAP: Introduce proper defines for PSM ranges
2016-01-29 11:47:24 +01:00
caif
caif: fix a signedness bug in cfpkt_iterate()
2015-02-20 17:35:14 -05:00
irda
irda: Convert function pointer arrays and uses to const
2014-12-10 15:33:16 -05:00
iucv
s390/iucv: do not use arrays as argument
2015-09-21 16:03:04 -07:00
netfilter
netfilter: nf_conntrack: use safer way to lock all buckets
2016-01-20 14:15:31 +01:00
netns
ipv4: Namespecify the tcp_keepalive_intvl sysctl knob
2016-01-10 17:32:09 -05:00
nfc
nfc: netlink: HCI event connectivity implementation
2015-12-29 19:06:20 +01:00
phonet
sctp
sctp: remove the dead field of sctp_transport
2016-01-28 15:59:32 -08:00
tc_act
act_connmark: Remember the struct net instead of guessing it.
2015-09-18 21:59:31 +02:00
6lowpan.h
6lowpan: add debugfs support
2015-12-10 01:25:25 +01:00
act_api.h
net_sched: make tcf_hash_destroy() static
2015-08-26 11:01:44 -07:00
addrconf.h
soreuseport: fast reuseport UDP socket selection
2016-01-04 22:49:58 -05:00
af_ieee802154.h
ieee802154: af_ieee802154: fix typo in comment.
2015-09-17 13:20:05 +02:00
af_rxrpc.h
af_unix.h
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
af_vsock.h
Revert "Merge branch 'vsock-virtio'"
2015-12-08 21:55:49 -05:00
ah.h
arp.h
neigh: Factor out ___neigh_lookup_noref
2015-03-04 00:23:23 -05:00
atmclip.h
ax25.h
ax25: Stop using sock->sk_protinfo.
2015-06-28 16:55:44 -07:00
ax88796.h
bond_3ad.h
bonding: simplify / unify event handling code for 3ad mode.
2015-11-02 22:52:24 -05:00
bond_alb.h
bond_options.h
bonding: convert num_grat_arp to the new bonding option API
2015-07-27 01:05:24 -07:00
bonding.h
bonding: implement lower state change propagation
2015-12-03 11:49:27 -05:00
busy_poll.h
net: un-inline sk_busy_loop()
2015-11-18 16:17:38 -05:00
cfg80211-wext.h
cfg80211.h
cfg80211: Add support for aborting an ongoing scan
2015-12-04 14:43:32 +01:00
cfg802154.h
nl802154: add support for security layer
2015-09-30 13:16:44 +02:00
checksum.h
rco: Clean up casting errors
2015-12-13 23:57:45 -05:00
cipso_ipv4.h
cipso: don't use IPCB() to locate the CIPSO IP option
2015-02-11 14:46:37 -05:00
cls_cgroup.h
net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct
2015-12-08 22:02:33 -05:00
codel.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-05-13 14:31:43 -04:00
compat.h
net: switch importing msghdr from userland to {compat_,}import_iovec()
2015-04-09 00:02:26 -04:00
datalink.h
dcbevent.h
dcbnl.h
net/dcb: Add IEEE QCN attribute
2015-03-06 21:50:02 -05:00
dn.h
dn_dev.h
dn_fib.h
dn_neigh.h
netfilter: Pass net into okfn
2015-09-17 17:18:37 -07:00
dn_nsp.h
dn_route.h
dsa.h
net: dsa: remove DSA link polling
2015-12-07 16:35:49 -05:00
dsfield.h
dst.h
net: fix IP early demux races
2015-12-14 23:52:00 -05:00
dst_metadata.h
gro: Make GRO aware of lightweight tunnels.
2016-01-20 18:48:38 -08:00
dst_ops.h
ipv4, ipv6: Pass net into __ip_local_out and __ip6_local_out
2015-10-08 04:27:02 -07:00
esp.h
ethoc.h
net/ethoc: support big-endian register layout
2015-09-23 15:33:15 -07:00
fib_rules.h
net: ipv6: use common fib_default_rule_pref
2015-09-09 14:19:50 -07:00
firewire.h
flow.h
net: Rename FLOWI_FLAG_VRFSRC to FLOWI_FLAG_L3MDEV_SRC
2015-10-07 04:27:42 -07:00
flow_dissector.h
flow_dissector: Don't use bit fields.
2015-09-01 16:46:08 -07:00
flowcache.h
fou.h
garp.h
gen_stats.h
genetlink.h
netlink: add a start callback for starting a netlink dump
2015-12-15 23:25:20 -05:00
geneve.h
geneve: Add geneve_get_rx_port support
2015-12-16 10:58:56 -05:00
gre.h
gre: Remove support for sharing GRE protocol hook.
2015-08-10 14:03:54 -07:00
gro_cells.h
gro_cells: remove spinlock protecting receive queues
2015-08-31 15:17:17 -07:00
gue.h
icmp.h
ieee80211_radiotap.h
ieee802154_netdev.h
mac802154: constify ieee802154_llsec_ops structure
2016-01-04 20:40:41 +01:00
if_inet6.h
ipv6: do retries on stable privacy addresses
2015-03-23 22:12:09 -04:00
ila.h
ila: Add generic ILA translation facility
2015-12-15 23:25:20 -05:00
inet6_connection_sock.h
ipv6: remove obsolete inet6 functions
2015-10-03 04:32:42 -07:00
inet6_hashtables.h
ipv6: get rid of __inet6_hash()
2015-03-18 22:00:35 -04:00
inet_common.h
net: avoid NULL deref in inet_ctl_sock_destroy()
2015-11-02 22:46:09 -05:00
inet_connection_sock.h
tcp/dccp: fix another race at listener dismantle
2016-02-18 11:35:51 -05:00
inet_ecn.h
ipv6: update skb->csum when CE mark is propagated
2016-01-15 15:07:23 -05:00
inet_frag.h
inet: kill unused skb_free op
2016-01-05 22:25:57 -05:00
inet_hashtables.h
tcp/dccp: fix hashdance race for passive sessions
2015-10-23 05:42:21 -07:00
inet_sock.h
net: Allow accepted sockets to be bound to l3mdev domain
2015-12-18 14:43:38 -05:00
inet_timewait_sock.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-10-20 06:08:27 -07:00
inetpeer.h
inet: tcp: fix inetpeer_set_addr_v4()
2015-12-16 00:14:12 -05:00
ip.h
ipv4: Pass struct net into ip_defrag and ip_check_defrag
2015-10-12 19:44:16 -07:00
ip6_checksum.h
ip6_fib.h
ipv6: Check rt->dst.from for the DST_NOCACHE route
2015-11-15 17:12:37 -05:00
ip6_route.h
ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail()
2016-01-29 20:31:26 -08:00
ip6_tunnel.h
net: make ip6tunnel_xmit definition conditional
2016-01-04 21:50:51 -05:00
ip_fib.h
route: check and remove route cache when we get route
2016-02-18 11:31:36 -05:00
ip_tunnels.h
vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices
2016-02-10 05:50:03 -05:00
ip_vs.h
ipvs: drop first packet to redirect conntrack
2016-03-07 11:53:30 +09:00
ipcomp.h
ipconfig.h
ipv6.h
ipv6: add ipv6_addr_prefix_copy
2015-12-10 12:55:28 +01:00
ipx.h
iw_handler.h
cfg80211/wext: fix message ordering
2016-01-29 17:13:43 +01:00
l3mdev.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-01-06 22:54:18 -05:00
lapb.h
lib80211.h
llc.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc: Make llc_conn_ev_qfyr_t function pointer arrays const
2014-12-10 15:21:24 -05:00
llc_conn.h
net: Pass kern from net_proto_family.create to sk_alloc
2015-05-11 10:50:17 -04:00
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc: Make llc_sap_action_t function pointer arrays const
2014-12-10 15:21:24 -05:00
llc_sap.h
lwtunnel.h
dst: Pass net into dst->output
2015-10-08 04:27:03 -07:00
mac80211.h
mac80211: add new IEEE80211_VIF_GET_NOA_UPDATE flag
2015-12-04 14:43:32 +01:00
mac802154.h
6lowpan: cleanup lowpan_header_decompress
2015-10-21 00:49:24 +02:00
mip6.h
mld.h
mpls.h
mpls_iptunnel.h
mpls: multipath route support
2015-10-23 06:26:42 -07:00
mrp.h
ndisc.h
Revert "ipv6: ndisc: inherit metadata dst when creating ndisc requests"
2015-12-01 15:07:59 -05:00
neighbour.h
net: add explicit logging and stat for neighbour table overflow
2015-08-10 13:46:21 -07:00
net_namespace.h
netfilter: cttimeout: add netns support
2015-12-14 12:48:58 +01:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h
netlink: add nla_get for le32 and le64
2015-09-30 13:16:44 +02:00
netprio_cgroup.h
net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct
2015-12-08 22:02:33 -05:00
netrom.h
nexthop.h
nl802154.h
nl802154: add support for security layer
2015-09-30 13:16:44 +02:00
p8022.h
ping.h
net: Remove iocb argument from sendmsg and recvmsg
2015-03-02 13:06:31 -05:00
pkt_cls.h
pkt_sched.h
net: sched: consolidate tc_classify{,_compat}
2015-08-27 14:18:48 -07:00
protocol.h
udp: restrict offloads to one namespace
2016-01-10 17:28:24 -05:00
psnap.h
raw.h
rawv6.h
red.h
regulatory.h
cfg80211: allow wiphy specific regdomain management
2014-12-17 11:49:55 +01:00
request_sock.h
net: add inet_sk_transparent() helper
2015-12-22 17:03:05 -05:00
rose.h
route.h
net: Propagate lookup failure in l3mdev_get_saddr to caller
2016-01-04 22:58:30 -05:00
rtnetlink.h
netlink: Rightsize IFLA_AF_SPEC size calculation
2015-10-21 19:15:20 -07:00
sch_generic.h
net, sched: add skb_at_tc_ingress helper
2016-01-10 17:54:28 -05:00
scm.h
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
secure_seq.h
slhc_vj.h
snmp.h
sock.h
net: sock: remove dead cgroup methods from struct proto
2016-01-21 14:16:51 -08:00
sock_reuseport.h
soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind
2016-01-19 14:44:23 -05:00
Space.h
stp.h
switchdev.h
switchdev: Adding MDB entry offload
2016-01-10 16:50:20 -05:00
tcp.h
tcp: do not drop syn_recv on all icmp reports
2016-02-09 04:15:37 -05:00
tcp_states.h
inet: add TCP_NEW_SYN_RECV state
2015-03-12 22:58:12 -04:00
timewait_sock.h
inet: remove BUG_ON() in twsk_destructor()
2015-07-09 15:12:20 -07:00
transp_v6.h
tso.h
net: tso: add support for IPv6
2015-10-26 22:24:22 -07:00
udp.h
soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF
2016-01-04 22:49:59 -05:00
udp_tunnel.h
ip_tunnel: Move stats update to iptunnel_xmit()
2015-12-25 23:32:23 -05:00
udplite.h
net: switch memcpy_fromiovec()/memcpy_fromiovecend() users to copy_from_iter()
2015-02-04 01:34:15 -05:00
vsock_addr.h
vxlan.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-12-17 22:08:28 -05:00
wext.h
wimax.h
x25.h
x25device.h
xfrm.h
xfrm: add rcu protection to sk->sk_policy[]
2015-12-11 19:22:06 -05:00