|
On Tue, Apr 12, 2016 at 11:14:17PM +0300, Julian Anastasov wrote:
>
> Hello,
>
> On Sat, 9 Apr 2016, Marco Angaroni wrote:
>
> > When using OPS mode in conjunction with SIP persistent-engine, packets
> > originating from the same ip-address/port could be balanced to different
> > real servers, and (to properly handle SIP responses) OPS connections
> > are created in the in-out direction too, where ip_vs_update_conntrack()
> > is called to modify the reply tuple.
> >
> > As a result, there can be collision of conntrack tuples, causing random
> > packet drops, as explained below:
> >
> > conntrack1: orig=CIP->VIP, reply=RIP1->CIP
> > conntrack2: orig=RIP2->CIP, reply=CIP->VIP
> >
> > Tuple CIP->VIP is both in orig of conntrack1 and reply of conntrack2.
> > The collision triggers packet drop inside nf_conntrack processing.
> >
> > In addition, the current implementation deletes the conntrack object at
> > every expire of an OPS connection (once every forwarded packet), to have
> > it recreated from scratch at next packet traversing IPVS.
> >
> > Since in OPS mode, by definition, we don't expect any associated
> > response, the choices implemented in this patch are:
> > a) don't call nf_conntrack_alter_reply() for OPS connections inside
> > ip_vs_update_conntrack().
> > b) don't delete the conntrack object at OPS connection expire.
> >
> > The result is that created conntrack objects for each tuple CIP->VIP,
> > RIP-N->CIP, etc. are left in UNREPLIED state and not modified by IPVS
> > OPS connection management. This eliminates packet drops and leaves
> > a single conntrack object for each tuple packets are sent from.
> >
> > Signed-off-by: Marco Angaroni <marcoangaroni@xxxxxxxxx>
>
> Thanks! Looks good to me. Simon, please apply.
>
> Signed-off-by: Julian Anastasov <ja@xxxxxx>
Thanks, applied.
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
