[PATCHv2 net-next 0/3] Drop IPVS conn templates under attack

[Julian Anastasov <ja@xxxxxx>]

This patchset changes how templates are dropped under attack.

Patch 1 changes ip_vs_state_name arguments, so that we can
print in followup patch info by using just state.

Patch 2 implements assured flag for connection templates to
indicate that connection progressed after initial packet.

Patch 3 uses the assured state to decide if to drop connection
templates under attack.

The patchset is based on implementation from Michal Koutný but
extended to other protocols. The other difference is that we
use cp->state for template flags because there are no many
free bits in cp->flags that are sent in the sync protocol
messages.

v1->v2:
- first patch in v1 was split to patches 1 and 2
- in patch 2 do not clear unknown bits in the state received by backup server

Julian Anastasov (3):
  ipvs: provide just conn to ip_vs_state_name
  ipvs: add assured state for conn templates
  ipvs: drop conn templates under attack

 include/net/ip_vs.h                   | 18 +++++++++-
 net/netfilter/ipvs/ip_vs_conn.c       | 67 ++++++++++++++++++++++-------------
 net/netfilter/ipvs/ip_vs_proto.c      | 19 ++++++++--
 net/netfilter/ipvs/ip_vs_proto_sctp.c |  2 ++
 net/netfilter/ipvs/ip_vs_proto_tcp.c  |  2 ++
 net/netfilter/ipvs/ip_vs_proto_udp.c  |  2 ++
 net/netfilter/ipvs/ip_vs_sync.c       | 18 ++++------
 7 files changed, 88 insertions(+), 40 deletions(-)

-- 
2.9.5

--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html