• Julian Anastasov's avatar
    [IPVS]: ip_vs_ftp breaks connections using persistence · 87375ab4
    Julian Anastasov authored
    ip_vs_ftp when loaded can create NAT connections with unknown client
    port for passive FTP. For such expectations we lookup with cport=0 on
    incoming packet but it matches the format of the persistence templates
    causing packets to other persistent virtual servers to be forwarded to
    real server without creating connection. Later the reply packets are
    treated as foreign and not SNAT-ed.
    
    This patch changes the connection lookup for packets from clients:
    
    * introduce IP_VS_CONN_F_TEMPLATE connection flag to mark the
      connection as template
    
    * create new connection lookup function just for templates -
      ip_vs_ct_in_get
    
    * make sure ip_vs_conn_in_get hits only connections with
      IP_VS_CONN_F_NO_CPORT flag set when s_port is 0. By this way
      we avoid returning template when looking for cport=0 (ftp)
    Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    87375ab4
ip_vs.h 29.8 KB