Re: [PATCH] ipvs: make drop_entry protection effective for SIP-pe

To: Julian Anastasov <ja@xxxxxx>
Subject: Re: [PATCH] ipvs: make drop_entry protection effective for SIP-pe
Cc: Marco Angaroni <marcoangaroni@xxxxxxxxx>, lvs-devel@xxxxxxxxxxxxxxx
From: Simon Horman <horms@xxxxxxxxxxxx>
Date: Mon, 2 May 2016 16:43:57 +1000
On Wed, Apr 27, 2016 at 10:27:41AM +0300, Julian Anastasov wrote:
>       Hello,
> On Tue, 26 Apr 2016, Marco Angaroni wrote:
> > DoS protection policy that deletes connections to avoid out of memory is
> > currently not effective for SIP-pe plus OPS-mode for two reasons:
> >   1) connection templates (holding SIP call-id) are always skipped in
> >      ip_vs_random_dropentry()
> >   2) in_pkts counter (used by drop_entry algorithm) is not incremented
> >      for connection templates
> > 
> > This patch addresses such problems with the following changes:
> >   a) connection templates associated (via their dest) to virtual-services 
> >      configured in OPS mode are included in ip_vs_random_dropentry()
> >      monitoring. This applies to SIP-pe over UDP (which requires OPS mode),
> >      but is more general principle: when OPS is controlled by templates
> >      memory can be used only by templates themselves, since OPS conns are
> >      deleted after packet is forwarded.
> >   b) OPS connections, if controlled by a template, cause increment of 
> >      in_pkts counter of their template. This is already happening but only
> >      in case director is in master-slave mode (see ip_vs_sync_conn()).
> > 
> > Signed-off-by: Marco Angaroni <marcoangaroni@xxxxxxxxx>
>       Looks good to me. Simon, please apply to -next.
> Acked-by: Julian Anastasov <ja@xxxxxx>

Thanks, applied.
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at

<Prev in Thread] Current Thread [Next in Thread>
  • Re: [PATCH] ipvs: make drop_entry protection effective for SIP-pe, Simon Horman <=