From patchwork Thu Feb 18 00:41:00 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Horman X-Patchwork-Id: 584412 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 0EB761401E7 for ; Thu, 18 Feb 2016 11:41:35 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=verge.net.au header.i=@verge.net.au header.b=KJkD+qv4; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1422955AbcBRAl1 (ORCPT ); Wed, 17 Feb 2016 19:41:27 -0500 Received: from kirsty.vergenet.net ([202.4.237.240]:40596 "EHLO kirsty.vergenet.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965363AbcBRAlW (ORCPT ); Wed, 17 Feb 2016 19:41:22 -0500 Received: from reginn.isobedori.kobe.vergenet.net (p5023-ipbfp803kobeminato.hyogo.ocn.ne.jp [123.221.39.23]) by kirsty.vergenet.net (Postfix) with ESMTPA id EF4B625B804; Thu, 18 Feb 2016 11:41:15 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verge.net.au; s=mail; t=1455756076; bh=p24bmq5sEmWfkR18lKyP2huqFzcWr+5eFxkFtFg+SP4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KJkD+qv4V/IIgqkaVguKYvXUpmsYKyDTpbfjqBtBtVn/Vs1r9OUAzj5toWRmzghZ4 /8CkPYbKuL6WBEldZXX0diVlcYpoqOTMbqkz2YJdlGCyWDoXZd9Wqt/JmnbO7bK/Vg KKekG9bb6la9KWwcrlY/KRI6pj+Ew+ag0x+/aCFY= Received: by reginn.isobedori.kobe.vergenet.net (Postfix, from userid 7100) id 15B2B943AEA; Thu, 18 Feb 2016 09:41:08 +0900 (JST) From: Simon Horman To: Pablo Neira Ayuso Cc: lvs-devel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, Wensong Zhang , Julian Anastasov , Simon Horman Subject: [PATCH nf 2/3] netfilter: ipvs: allow rescheduling after RST Date: Thu, 18 Feb 2016 09:41:00 +0900 Message-Id: <1455756061-21834-3-git-send-email-horms@verge.net.au> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1455756061-21834-1-git-send-email-horms@verge.net.au> References: <1455756061-21834-1-git-send-email-horms@verge.net.au> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Julian Anastasov "RFC 5961, 4.2. Mitigation" describes a mechanism to request client to confirm with RST the restart of TCP connection before resending its SYN. As result, IPVS can see SYNs for existing connection in CLOSE state. Add check to allow rescheduling in this state. Signed-off-by: Julian Anastasov Signed-off-by: Simon Horman --- net/netfilter/ipvs/ip_vs_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c index 4da560005b0e..0c1d3fef9a7c 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -1089,6 +1089,7 @@ static inline bool is_new_conn_expected(const struct ip_vs_conn *cp, switch (cp->protocol) { case IPPROTO_TCP: return (cp->state == IP_VS_TCP_S_TIME_WAIT) || + cp->state == IP_VS_TCP_S_CLOSE || ((conn_reuse_mode & 2) && (cp->state == IP_VS_TCP_S_FIN_WAIT) && (cp->flags & IP_VS_CONN_F_NOOUTPUT));