[PATCH 3/4] ipvs: tcp: enable per-connection secure_tcp in state machine
flat view
COLD23d
From: Adriano Cordova <hidden>
Date: 2026-09-12 01:32:54
Also in:
lvs-devel, netfilter-devel
Subsystem:
ipvs, netfilter, networking [general], the rest · Maintainers:
Simon Horman, Julian Anastasov, Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Revision v1 of 5 in this series.
Revisions (5)
Let set_tcp_state select tcp_states_dos when the connection carries IP_VS_CONN_F_SECURE_TCP, otherwise it keep using the global pd->tcp_state_table (the netns default / or if nomem). Signed-off-by: Adriano Cordova <redacted> --- net/netfilter/ipvs/ip_vs_proto_tcp.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index fec0e8b47b71..3b9a2c8e9a52 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c@@ -451,11 +451,10 @@ static void tcp_timeout_change(struct ip_vs_proto_data *pd, int flags) int on = (flags & 1); /* secure_tcp */ /* - ** FIXME: change secure_tcp to independent sysctl var - ** or make it per-service or per-app because it is valid - ** for most if not for all of the applications. Something - ** like "capabilities" (flags) for each object. - */ + * This remains the netns-wide default / global floor (e.g. when + * memory pressure kicks in). Per-service hardening is now carried + * by IP_VS_CONN_F_SECURE_TCP on each connection (set_tcp_state). + */ pd->tcp_state_table = (on ? tcp_states_dos : tcp_states); }
@@ -479,6 +478,7 @@ set_tcp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, int state_idx; int new_state = IP_VS_TCP_S_CLOSE; int state_off = tcp_state_off[direction]; + const struct tcp_states_t *table; /* * Update state offset to INPUT_ONLY if necessary
@@ -496,8 +496,10 @@ set_tcp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, goto tcp_state_out; } - new_state = - pd->tcp_state_table[state_off+state_idx].next_state[cp->state]; + table = pd->tcp_state_table; + if (cp->flags & IP_VS_CONN_F_SECURE_TCP) + table = tcp_states_dos; + new_state = table[state_off + state_idx].next_state[cp->state]; tcp_state_out: if (new_state != cp->state) {
--
2.51.0