Re: [PATCH] ipvs: don't alter conntrack in OPS mode

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



	Hello,

On Sat, 9 Apr 2016, Marco Angaroni wrote:

> Subject: [PATCH] ipvs: don't alter conntrack in OPS mode
> 
> When using OPS mode in conjunction with SIP persistent-engine, packets
> originating from the same ip-address/port could be balanced to different
> real servers, and (to properly handle SIP responses) OPS connections 
> are created in the in-out direction too, where ip_vs_update_conntrack()
> is called to modify the reply tuple.
> 
> As a result, there can be collision of conntrack tuples, causing random
> packet drops, as explained below:
> 
> conntrack1: orig=CIP->VIP  , reply=RIP1->CIP
> conntrack2: orig=RIP2->CIP , reply=CIP->VIP

	To avoid any confusion you should submit as v2 with
single Subject line. You can also remove the above spaces before
the commas.

> Tuple CIP->VIP is both in orig of conntrack1 and reply of conntrack2.
> The collision triggers packet drop inside nf_conntrack processing.
> 
> In addition, the current implementation deletes the conntrack object at
> every expire of an OPS connection (once every forwarded packet), to have
> it recreated from scratch at next packet traversing IPVS.
> 
> Since in OPS mode, by definition, we don't expect any associated 
> response, the choices implemented in this patch are:
> a) don't call nf_conntrack_alter_reply() for OPS connections inside
>    ip_vs_update_conntrack().
> b) don't delete the conntrack object at OPS connection expire.
> 
> The result is that created conntrack objects for each tuple CIP->VIP,
> RIP-N->CIP, etc. are left in UNREPLIED state and not modified by IPVS
> OPS connection management. This eliminates packet drops and leaves
> a single conntrack object for each tuple packets are sent from.
> 
> Signed-off-by: Marco Angaroni <marcoangaroni@xxxxxxxxx>
> ---
>  net/netfilter/ipvs/ip_vs_conn.c | 3 ++-
>  net/netfilter/ipvs/ip_vs_nfct.c | 4 ++++
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
> index dd75d41..292365f 100644
> --- a/net/netfilter/ipvs/ip_vs_conn.c
> +++ b/net/netfilter/ipvs/ip_vs_conn.c
> @@ -836,7 +836,8 @@ static void ip_vs_conn_expire(unsigned long data)
>  		if (cp->control)
>  			ip_vs_control_del(cp);
>  
> -		if (cp->flags & IP_VS_CONN_F_NFCT) {
> +		if ((cp->flags & IP_VS_CONN_F_NFCT) &&
> +		    !(cp->flags & IP_VS_CONN_F_ONE_PACKET)) {
>  			/* Do not access conntracks during subsys cleanup
>  			 * because nf_conntrack_find_get can not be used after
>  			 * conntrack cleanup for the net.
> diff --git a/net/netfilter/ipvs/ip_vs_nfct.c b/net/netfilter/ipvs/ip_vs_nfct.c
> index 30434fb..f04fd8d 100644
> --- a/net/netfilter/ipvs/ip_vs_nfct.c
> +++ b/net/netfilter/ipvs/ip_vs_nfct.c
> @@ -93,6 +93,10 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin)
>  	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
>  		return;
>  
> +	/* Never alter conntrack for OPS conns (no reply is expected) */
> +	if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
> +		return;
> +
>  	/* Alter reply only in original direction */
>  	if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
>  		return;
> -- 
> 1.8.3.1

Regards

--
Julian Anastasov <ja@xxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Filesystem Devel]     [Linux NFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]     [X.Org]

  Powered by Linux