From patchwork Fri Sep 25 09:48:20 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Bohac X-Patchwork-Id: 522706 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C6F0B1401AD for ; Fri, 25 Sep 2015 19:48:28 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755637AbbIYJsX (ORCPT ); Fri, 25 Sep 2015 05:48:23 -0400 Received: from mx2.suse.de ([195.135.220.15]:48751 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755114AbbIYJsW (ORCPT ); Fri, 25 Sep 2015 05:48:22 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id B0D62ABDB; Fri, 25 Sep 2015 09:48:19 +0000 (UTC) Date: Fri, 25 Sep 2015 11:48:20 +0200 From: Jiri Bohac To: Wensong Zhang , Simon Horman , Julian Anastasov Cc: netdev@vger.kernel.org, lvs-devel@vger.kernel.org Subject: [PATCH v2] ipvs: drop first packet to dead server Message-ID: <20150925094820.GB5047@midget.suse.cz> References: <20150925093737.GA5047@midget.suse.cz> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20150925093737.GA5047@midget.suse.cz> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org [ original diff was against and older tree, sorry; rediffed against net-next ] Since commit dc7b3eb9 (ipvs: Fix reuse connection if real server is dead), new connections to dead servers are redistributed immediately to new servers. The old connection is expired using ip_vs_conn_expire_now() which sets the connection timer to expire immediately. However, before the timer callback, ip_vs_conn_expire(), is run to clean the connection's conntrack entry, the new redistributed connection may already be established and its conntrack removed instead. Fix this by dropping the first packet of the new connection instead, like we do when the destination server is not available. The timer will have deleted the old conntrack entry long before the first packet of the new connection is retransmitted. Signed-off-by: Jiri Bohac --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c index 1fa12ed..8134881 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -1785,7 +1785,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) if (!atomic_read(&cp->n_control)) ip_vs_conn_expire_now(cp); __ip_vs_conn_put(cp); - cp = NULL; + return NF_DROP; } if (unlikely(!cp)) {