Re: [PATCH net-next,v2] ipvs: orphan skb on LOCAL_IN path

To: Alex Gartrell <agartrell@xxxxxx>
Subject: Re: [PATCH net-next,v2] ipvs: orphan skb on LOCAL_IN path
Cc: wensong@xxxxxxxxxxxx, horms@xxxxxxxxxxxx, lvs-devel@xxxxxxxxxxxxxxx, kernel-team@xxxxxx
From: Julian Anastasov <ja@xxxxxx>
Date: Fri, 30 Jan 2015 10:18:05 +0200 (EET)

On Thu, 29 Jan 2015, Alex Gartrell wrote:

> +++ b/net/netfilter/ipvs/ip_vs_xmit.c
> @@ -502,6 +505,9 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct 
> sk_buff *skb,
>       else
>               ip_vs_update_conntrack(skb, cp, 1);
>       if (!local) {
> +             /* orphan on LOCAL_IN */
> +             if (skb->dev)
> +                     skb_orphan(skb);

        If early demux finds one socket in PRE_ROUTING and
later we DNAT the packet to different local real server we should
drop the socket. That is why in previous email I thought 
ip_vs_nat_send_or_cont should call skb_orphan() even for

        Not sure, may be it is possible to get indication
from dnat_handler if packet was changed, so that we can
provide hint to ip_vs_nat_send_or_cont whether to call
skb_orphan only when MASQ mode actually changed daddr/dport,
i.e. when attached socket is not correct anymore.

>               skb_forward_csum(skb);
>               NF_HOOK(pf, NF_INET_LOCAL_OUT, skb, NULL, skb_dst(skb)->dev,
>                       dst_output);


Julian Anastasov <ja@xxxxxx>
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at

<Prev in Thread] Current Thread [Next in Thread>