Hello,
On Thu, 29 Jan 2015, Alex Gartrell wrote:
> +++ b/net/netfilter/ipvs/ip_vs_xmit.c
> @@ -502,6 +505,9 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
> else
> ip_vs_update_conntrack(skb, cp, 1);
> if (!local) {
> + /* orphan on LOCAL_IN */
> + if (skb->dev)
> + skb_orphan(skb);
If early demux finds one socket in PRE_ROUTING and
later we DNAT the packet to different local real server we should
drop the socket. That is why in previous email I thought
ip_vs_nat_send_or_cont should call skb_orphan() even for
local=true.
Not sure, may be it is possible to get indication
from dnat_handler if packet was changed, so that we can
provide hint to ip_vs_nat_send_or_cont whether to call
skb_orphan only when MASQ mode actually changed daddr/dport,
i.e. when attached socket is not correct anymore.
> skb_forward_csum(skb);
> NF_HOOK(pf, NF_INET_LOCAL_OUT, skb, NULL, skb_dst(skb)->dev,
> dst_output);
Regards
--
Julian Anastasov <ja@xxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
