Re: [PATCH nf-next v5] netfilter: ipvs: Fix reuse connection if RS weight is 0

On Wed, Nov 03, 2021 at 07:40:46PM +0800, yangxingwu wrote:

hello Simon

I delete the "This will effectively disable expire_nodest_conn" section
from doc, and the others remain untouched. The following is how it looks
like after modification:

0: disable any special handling on port reuse. The new
connection will be delivered to the same real server that was
servicing the previous connection.

Simon, pls help to check if it's necessary to replace servicing with
service.

Sorry, my mistake. No need to replace servicing with service.

And I will move the conn_reuse_mode line above the bool line

On Tue, Nov 2, 2021 at 2:21 AM Julian Anastasov [off-list ref] wrote:

quoted

        Hello,

On Mon, 1 Nov 2021, yangxingwu wrote:

quoted

We are changing expire_nodest_conn to work even for reused connections

when

quoted

conn_reuse_mode=0, just as what was done with commit dc7b3eb900aa ("ipvs:
Fix reuse connection if real server is dead").

For controlled and persistent connections, the new connection will get

the

quoted

needed real server depending on the rules in ip_vs_check_template().

Fixes: d752c3645717 ("ipvs: allow rescheduling of new connections when

port reuse is detected")

quoted

Co-developed-by: Chuanqi Liu <redacted>
Signed-off-by: Chuanqi Liu <redacted>
Signed-off-by: yangxingwu <redacted>

        Looks good to me, thanks!

Acked-by: Julian Anastasov <ja@ssi.bg>

quoted

---
 Documentation/networking/ipvs-sysctl.rst | 3 +--
 net/netfilter/ipvs/ip_vs_core.c          | 8 ++++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/Documentation/networking/ipvs-sysctl.rst

b/Documentation/networking/ipvs-sysctl.rst

quoted

index 2afccc63856e..1cfbf1add2fc 100644

--- a/Documentation/networking/ipvs-sysctl.rst
+++ b/Documentation/networking/ipvs-sysctl.rst

@@ -37,8 +37,7 @@ conn_reuse_mode - INTEGER

      0: disable any special handling on port reuse. The new
      connection will be delivered to the same real server that was
-     servicing the previous connection. This will effectively
-     disable expire_nodest_conn.
+     servicing the previous connection.

      bit 1: enable rescheduling of new connections when it is safe.
      That is, whenever expire_nodest_conn and for TCP sockets, when

diff --git a/net/netfilter/ipvs/ip_vs_core.c

b/net/netfilter/ipvs/ip_vs_core.c

quoted

index 128690c512df..f9d65d2c8da8 100644

--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c

@@ -1964,7 +1964,6 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int

hooknum, struct sk_buff *skb, int

quoted

      struct ip_vs_proto_data *pd;
      struct ip_vs_conn *cp;
      int ret, pkts;
-     int conn_reuse_mode;
      struct sock *sk;

      /* Already marked as IPVS request or reply? */

@@ -2041,15 +2040,16 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int

hooknum, struct sk_buff *skb, int

quoted

      cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,
                           ipvs, af, skb, &iph);

-     conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
-     if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) &&

cp) {

quoted

+     if (!iph.fragoffs && is_new_conn(skb, &iph) && cp) {
              bool old_ct = false, resched = false;
+             int conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);

              if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest

&&

quoted

                  unlikely(!atomic_read(&cp->dest->weight))) {
                      resched = true;
                      old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
-             } else if (is_new_conn_expected(cp, conn_reuse_mode)) {
+             } else if (conn_reuse_mode &&
+                        is_new_conn_expected(cp, conn_reuse_mode)) {
                      old_ct = ip_vs_conn_uses_old_conntrack(cp, skb);
                      if (!atomic_read(&cp->n_control)) {
                              resched = true;
--
2.30.2

Regards

--
Julian Anastasov [off-list ref]