linux-toradex.git/include/net/ip_vs.h, branch v4.4.106

ipvs: drop first packet to redirect conntrack

2016-05-11T09:21:09+00:00

commit f719e3754ee2f7275437e61a6afd520181fdd43b upstream.

Jiri Bohac is reporting for a problem where the attempt
to reschedule existing connection to another real server
needs proper redirect for the conntrack used by the IPVS
connection. For example, when IPVS connection is created
to NAT-ed real server we alter the reply direction of
conntrack. If we later decide to select different real
server we can not alter again the conntrack. And if we
expire the old connection, the new connection is left
without conntrack.

So, the only way to redirect both the IPVS connection and
the Netfilter's conntrack is to drop the SYN packet that
hits existing connection, to wait for the next jiffie
to expire the old connection and its conntrack and to rely
on client's retransmission to create new connection as
usually.

Jiri Bohac provided a fix that drops all SYNs on rescheduling,
I extended his patch to do such drops only for connections
that use conntrack. Here is the original report from Jiri Bohac:

Since commit dc7b3eb900aa ("ipvs: Fix reuse connection if real server
is dead"), new connections to dead servers are redistributed
immediately to new servers.  The old connection is expired using
ip_vs_conn_expire_now() which sets the connection timer to expire
immediately.

However, before the timer callback, ip_vs_conn_expire(), is run
to clean the connection's conntrack entry, the new redistributed
connection may already be established and its conntrack removed
instead.

Fix this by dropping the first packet of the new connection
instead, like we do when the destination server is not available.
The timer will have deleted the old conntrack entry long before
the first packet of the new connection is retransmitted.

Fixes: dc7b3eb900aa ("ipvs: Fix reuse connection if real server is dead")
Signed-off-by: Jiri Bohac 
Signed-off-by: Julian Anastasov 
Signed-off-by: Simon Horman 
Signed-off-by: Greg Kroah-Hartman

ipvs: Remove skb_sknet

2015-09-24T00:34:43+00:00

This function adds no real value and it obscures what the code is doing.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Remove skb_net

2015-09-24T00:34:43+00:00

This hack has no more users so remove it.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Pass ipvs not net to ip_vs_protocol_net_(init|cleanup)

2015-09-24T00:34:43+00:00

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Remove net argument from ip_vs_tcp_conn_listen

2015-09-24T00:34:43+00:00

The argument is unnecessary and in practice confusing,
and has caused the callers to do all manner of silly things.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Wrap sysctl_cache_bypass and remove ifdefs in ip_vs_leave

2015-09-24T00:34:42+00:00

With sysctl_cache_bypass now a compile time constant the compiler can
figue out that it can elimiate all of the code that depends on
sysctl_cache_bypass being true.

Also remove the duplicate computation of net previously necessitated
by #ifdef CONFIG_SYSCTL

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Pass ipvs into .conn_schedule and ip_vs_try_to_schedule

2015-09-24T00:34:41+00:00

This moves the hack "net_ipvs(skb_net(skb))" up one level where it
will be easier to remove.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Pass ipvs not net into ip_vs_conn_net_init and ip_vs_conn_net_cleanup

2015-09-24T00:34:41+00:00

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Pass ipvs into conn_out_get

2015-09-24T00:34:41+00:00

Move the hack of relying on "net_ipvs(skb_net(skb))" to derive the
ipvs up a layer.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman

ipvs: Pass ipvs into .conn_in_get and ip_vs_conn_in_get_proto

2015-09-24T00:34:41+00:00

Stop relying on "net_ipvs(skb_net(skb))" to derive the ipvs as
skb_net is a hack.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Julian Anastasov 
Signed-off-by: Simon Horman