LVS
lvs-devel
Google
 
Web LinuxVirtualServer.org

Re: [PATCH v2] ipvs: don't alter conntrack in OPS mode

To: Julian Anastasov <ja@xxxxxx>
Subject: Re: [PATCH v2] ipvs: don't alter conntrack in OPS mode
Cc: Marco Angaroni <marcoangaroni@xxxxxxxxx>, lvs-devel@xxxxxxxxxxxxxxx
From: Simon Horman <horms@xxxxxxxxxxxx>
Date: Fri, 15 Apr 2016 10:17:43 +1000
On Tue, Apr 12, 2016 at 11:14:17PM +0300, Julian Anastasov wrote:
> 
>       Hello,
> 
> On Sat, 9 Apr 2016, Marco Angaroni wrote:
> 
> > When using OPS mode in conjunction with SIP persistent-engine, packets
> > originating from the same ip-address/port could be balanced to different
> > real servers, and (to properly handle SIP responses) OPS connections 
> > are created in the in-out direction too, where ip_vs_update_conntrack()
> > is called to modify the reply tuple.
> > 
> > As a result, there can be collision of conntrack tuples, causing random
> > packet drops, as explained below:
> > 
> > conntrack1: orig=CIP->VIP, reply=RIP1->CIP
> > conntrack2: orig=RIP2->CIP, reply=CIP->VIP
> > 
> > Tuple CIP->VIP is both in orig of conntrack1 and reply of conntrack2.
> > The collision triggers packet drop inside nf_conntrack processing.
> > 
> > In addition, the current implementation deletes the conntrack object at
> > every expire of an OPS connection (once every forwarded packet), to have
> > it recreated from scratch at next packet traversing IPVS.
> > 
> > Since in OPS mode, by definition, we don't expect any associated 
> > response, the choices implemented in this patch are:
> > a) don't call nf_conntrack_alter_reply() for OPS connections inside
> >    ip_vs_update_conntrack().
> > b) don't delete the conntrack object at OPS connection expire.
> > 
> > The result is that created conntrack objects for each tuple CIP->VIP,
> > RIP-N->CIP, etc. are left in UNREPLIED state and not modified by IPVS
> > OPS connection management. This eliminates packet drops and leaves
> > a single conntrack object for each tuple packets are sent from.
> > 
> > Signed-off-by: Marco Angaroni <marcoangaroni@xxxxxxxxx>
> 
>       Thanks! Looks good to me. Simon, please apply.
> 
> Signed-off-by: Julian Anastasov <ja@xxxxxx>

Thanks, applied.
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

<Prev in Thread] Current Thread [Next in Thread>