netdev - [PATCH v2] ipvs: drop first packet to dead server

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150925094820.GB5047@midget.suse.cz>
Date:	Fri, 25 Sep 2015 11:48:20 +0200
From:	Jiri Bohac <jbohac@...e.cz>
To:	Wensong Zhang <wensong@...ux-vs.org>,
	Simon Horman <horms@...ge.net.au>, Julian Anastasov <ja@....bg>
Cc:	netdev@...r.kernel.org, lvs-devel@...r.kernel.org
Subject: [PATCH v2] ipvs: drop first packet to dead server

[ original diff was against and older tree, sorry; 
  rediffed against net-next ]

Since commit dc7b3eb9 (ipvs: Fix reuse connection if real server
is dead), new connections to dead servers are redistributed
immediately to new servers.  The old connection is expired using
ip_vs_conn_expire_now() which sets the connection timer to expire
immediately. 

However, before the timer callback, ip_vs_conn_expire(), is run
to clean the connection's conntrack entry, the new redistributed
connection may already be established and its conntrack removed
instead.

Fix this by dropping the first packet of the new connection
instead, like we do when the destination server is not available.
The timer will have deleted the old conntrack entry long before
the first packet of the new connection is retransmitted.

Signed-off-by: Jiri Bohac <jbohac@...e.cz>

diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 1fa12ed..8134881 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1785,7 +1785,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
 		if (!atomic_read(&cp->n_control))
 			ip_vs_conn_expire_now(cp);
 		__ip_vs_conn_put(cp);
-		cp = NULL;
+		return NF_DROP;
 	}

 	if (unlikely(!cp)) {
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html