LVS
lvs-users
Google
 
Web LinuxVirtualServer.org

Re: [lvs-users] ipvs does not sync DNATted or fwmarked connection state

To: "LinuxVirtualServer.org users mailing list." <lvs-users@xxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [lvs-users] ipvs does not sync DNATted or fwmarked connection state
From: Patrick Schaaf <netdev@xxxxxx>
Date: Tue, 21 Dec 2010 08:59:45 +0100
Hi Simon,

On Tue, 2010-12-21 at 07:41 +0900, Simon Horman wrote:

> while there are a number of limitations in the synchronisation code
> I believe that what you are trying to do should work. On the backup
> do you see connections showing up in the output of ipvsadm -Lcn ?

They don't, in the problematic cases. They do for the direct (non-nat /
non-fwmark) case, i.e. the setup is working in principle.

I decorated ip_vs_sync:ip_vs_sync_conn with a debug_level 7 output at
the end.

The normal, working and syncing case shows:

Dec 21 08:49:43 gw1 kernel: [71248.885908] IPVS: ip_vs_sync_conn with
len 24, curr_sb ffff880076c586c0
Dec 21 08:49:43 gw1 kernel: [71248.953799] IPVS: TCP input  [.FA.]
10.0.12.33:80->X.X.X.X:45986 state: FIN_WAIT->TIME_WAIT conn->refcnt:2
Dec 21 08:49:43 gw1 kernel: [71248.953848] IPVS: ip_vs_sync_conn with
len 24, curr_sb ffff880076c586c0
Dec 21 08:49:43 gw1 kernel: [71249.290038] IPVS: Enter:
ip_vs_send_async, net/netfilter/ipvs/ip_vs_sync.c line 707
Dec 21 08:49:43 gw1 kernel: [71249.290080] IPVS: Leave:
ip_vs_send_async, net/netfilter/ipvs/ip_vs_sync.c line 713

The connection appears on the backup server (*)

For the case with DNAT I only always see this:

Dec 21 08:51:04 gw1 kernel: [71329.419629] IPVS: TCP output  [..A.]
10.0.12.33:80->X.X.X.X:48911 state: SYN_RECV->ESTABLISHED conn->refcnt:2
Dec 21 08:51:09 gw1 kernel: [71334.789943] IPVS: TCP output  [.FA.]
10.0.12.33:80->X.X.X.X:48911 state: ESTABLISHED->FIN_WAIT conn->refcnt:2

and nothing turns up.

However, I just found that for the fwmark case, today, I do see the
send_async debug output, AND I now do see the connections on the backup
server. I'm 80% sure that was different yesterday when I sent the first
mail, but maybe I confused myself...

The DNAT case is not syncing in any case.

I will not try to go with the fwmark approach and see whether it stays
stable.

> On the topic of connection synchronisation, a new synchronisation
> protocol (v1) has been developed which addresses a number of the problems
> in the existing code (v0). This includes the explicit synchronisation
> of fwmarks. The code is currently available in the lvs-test-2.6 tree
> on git.kernel.org. It should appear in 2.6.38-rc1.

Thanks for the pointer.

Unfortunately I'm not at all familiar with git and using such
development trees, right now, and I'm a bit reluctant to try something
like that on a soon-to-be-production box.

So I'll look forward to testing that in spring when 2.6.38 is a bit
settled.





_______________________________________________
Please read the documentation before posting - it's available at:
http://www.linuxvirtualserver.org/

LinuxVirtualServer.org mailing list - lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Send requests to lvs-users-request@xxxxxxxxxxxxxxxxxxxxxx
or go to http://lists.graemef.net/mailman/listinfo/lvs-users

<Prev in Thread] Current Thread [Next in Thread>