|
Hello,
On Wed, 25 Oct 2017, Ye Yin wrote:
> Hi, all,
>
> We run ipvs at host and container in the same host at the same time,
> and ipvs at host will transport network traffic to ipvs in the
> container. Then some problem happended to us, the detail is as
> follows:
>
>
> ________________ _____________
> | ___|___ |container1 |
> | host bridge |_vethA_|----|192.168.1.232 |
> |192.168.1.193/26 | |____________|
> | ___|___ _____________
> | |_vethB_|----|container2 |
> |________________| |192.168.1.233 |
> |_____________|
>
> container1 and container2 connected each other by bridge on the host,
> which is the gateway of the two containers. Run ipvs on the host with
> VIP 172.17.169.208.
>
> host:
> $ ipvsadm -l -n
> IP Virtual Server version 1.2.1 (size=4096)
> Prot LocalAddress:Port Scheduler Flags
> -> RemoteAddress:Port Forward Weight ActiveConn InActConn
> TCP 172.17.169.208:80 rr
> -> 192.168.1.233:80 Masq 1 0 0
>
> container2:
> $ ipvsadm -l -n
> IP Virtual Server version 1.2.1 (size=4096)
> Prot LocalAddress:Port Scheduler Flags
> -> RemoteAddress:Port Forward Weight ActiveConn InActConn
> TCP 192.168.1.233:80 rr
> -> 14.17.xx.yyy:80 Masq 0 0 0
>
> telnet from container1 to container2:
>
> access by ipvs at host will failed:
>
> $ telnet 172.17.169.208 80
> Trying 172.17.169.208...
> telnet: connect to address 172.17.169.208: Connection refused
>
> direct access ipvs in container will success:
> $ telnet 192.168.1.233 80
> Trying 192.168.1.233...
> Connected to 192.168.1.233.
> Escape character is '^]'.
> ^]
> telnet quit
> Connection closed.
>
>
> I think it's the ipvs_property flag make ipvs in container return
> NF_ACCEPT for network traffic, which make traffic go up to tcp layer.
> Please see ip_vs_in.
>
> We should clear this flag when SKB's netns has changed, Any idea?
Good idea. Are you able to test after adding such line to
net/core/skbuff.c:skb_scrub_packet()?:
skb->ipvs_property = 0;
Just after nf_reset_trace(skb);
On success we should provide a patch instead that adds
some ipvs_property_reset(skb) func in include/linux/skbuff.h that
depends on the IS_ENABLED(CONFIG_IP_VS), just like it is done
for nf_reset().
Regards
--
Julian Anastasov <ja@xxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
