ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1
authorAndrew Sy Kim <kim.andrewsy@gmail.com>
Wed, 8 Jul 2020 16:16:38 +0000 (12:16 -0400)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 21 Jul 2020 23:17:59 +0000 (01:17 +0200)
commit35dfb013149f74c2be1ff9c78f14e6a3cd1539d1
treec667d506f5c295992d6381398a5f4c4c0fbd6a51
parent336f531ab17c3f480f8289d26c35bd48302ed085
ipvs: queue delayed work to expire no destination connections if expire_nodest_conn=1

When expire_nodest_conn=1 and a destination is deleted, IPVS does not
expire the existing connections until the next matching incoming packet.
If there are many connection entries from a single client to a single
destination, many packets may get dropped before all the connections are
expired (more likely with lots of UDP traffic). An optimization can be
made where upon deletion of a destination, IPVS queues up delayed work
to immediately expire any connections with a deleted destination. This
ensures any reused source ports from a client (within the IPVS timeouts)
are scheduled to new real servers instead of silently dropped.

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/ip_vs.h
net/netfilter/ipvs/ip_vs_conn.c
net/netfilter/ipvs/ip_vs_core.c
net/netfilter/ipvs/ip_vs_ctl.c