[PATCH 1/4] ipvs: add flags for per-service secure TCP state table
flat view
COLD24d
From: Adriano Cordova <hidden>
Date: 2026-09-12 01:32:43
Also in:
lvs-devel, netfilter-devel
Subsystem:
ipvs, the rest · Maintainers:
Simon Horman, Julian Anastasov, Linus Torvalds
Revision v1 of 5 in this series.
Revisions (5)
Add the flag IP_VS_SVC_F_SECURE_TCP to mark a virtual service for the DoS hardened TCP connection state table, and the flag IP_VS_CONN_F_SECURE_TCP to mark a connection and then pass to the TCP state machine. The connection flag is included in IP_VS_CONN_F_BACKUP_MASK, so it is preserved on the backup node. Signed-off-by: Adriano Cordova <redacted> --- include/uapi/linux/ip_vs.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/ip_vs.h b/include/uapi/linux/ip_vs.h
index 2c37c6ac7525..34fcfaf13cd3 100644
--- a/include/uapi/linux/ip_vs.h
+++ b/include/uapi/linux/ip_vs.h@@ -27,6 +27,7 @@ #define IP_VS_SVC_F_SCHED_SH_FALLBACK IP_VS_SVC_F_SCHED1 /* SH fallback */ #define IP_VS_SVC_F_SCHED_SH_PORT IP_VS_SVC_F_SCHED2 /* SH use port */ +#define IP_VS_SVC_F_SECURE_TCP 0x0040 /* use the hardened TCP table */ /* * IPVS sync daemon states
@@ -89,6 +90,7 @@ #define IP_VS_CONN_F_NO_CPORT 0x0800 /* no client port set yet */ #define IP_VS_CONN_F_TEMPLATE 0x1000 /* template, not connection */ #define IP_VS_CONN_F_ONE_PACKET 0x2000 /* forward only one packet */ +#define IP_VS_CONN_F_SECURE_TCP 0x0008 /* use the hardened TCP table */ /* Initial bits allowed in backup server */ #define IP_VS_CONN_F_BACKUP_MASK (IP_VS_CONN_F_FWD_MASK | \
@@ -96,7 +98,8 @@ IP_VS_CONN_F_INACTIVE | \ IP_VS_CONN_F_SEQ_MASK | \ IP_VS_CONN_F_NO_CPORT | \ - IP_VS_CONN_F_TEMPLATE \ + IP_VS_CONN_F_TEMPLATE | \ + IP_VS_CONN_F_SECURE_TCP \ ) /* Bits allowed to update in backup server */
--
2.51.0