[GIT PULL nf] IPVS Fixes for v3.20

[GIT PULL nf] IPVS Fixes for v3.20

[Simon Horman]

Hi Pablo,

please consider this fix for v3.20

This patch prevents the kernel getting into a situation whereby a
real-server may not be removed from a heterogeneous IPVS virtual server.

This problem was introduced by  bc18d37f676f ("ipvs: Allow heterogeneous
pools now that we support them") in v3.18. This patch seems appropriate
for stable and I have checked that it applies cleanly to both v3.19 and
v3.18.6.


The following changes since commit 42b5212fee4f57907e9415b18fe19c13e65574bc:

  xen-netback: stop the guest rx thread after a fatal error (2015-02-02 19:39:04 -0800)

are available in the git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git tags/ipvs-fixes-for-v3.20

for you to fetch changes up to dd3733b3e798daf778a1ec08557f388f00fdc2f6:

  ipvs: fix inability to remove a mixed-family RS (2015-02-09 14:13:30 +0900)

----------------------------------------------------------------
Alexey Andriyanov (1):
      ipvs: fix inability to remove a mixed-family RS

 net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[PATCH nf] ipvs: fix inability to remove a mixed-family RS

[Simon Horman]

From: Alexey Andriyanov <alan@al-an.info>

The current code prevents any operation with a mixed-family dest
unless IP_VS_CONN_F_TUNNEL flag is set. The problem is that it's impossible
for the client to follow this rule, because ip_vs_genl_parse_dest does
not even read the destination conn_flags when cmd = IPVS_CMD_DEL_DEST
(need_full_dest = 0).

Also, not every client can pass this flag when removing a dest. ipvsadm,
for example, does not support the "-i" command line option together with
the "-d" option.

This change disables any checks for mixed-family on IPVS_CMD_DEL_DEST command.

Signed-off-by: Alexey Andriyanov <alan@al-an.info>
Fixes: bc18d37f676f ("ipvs: Allow heterogeneous pools now that we support them")
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index b8295a4..fdcda8b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3399,7 +3399,7 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
 		if (udest.af == 0)
 			udest.af = svc->af;
 
-		if (udest.af != svc->af) {
+		if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
 			/* The synchronization protocol is incompatible
 			 * with mixed family services
 			 */
-- 
2.1.4

Re: [GIT PULL nf] IPVS Fixes for v3.20

[Pablo Neira Ayuso]

On Mon, Feb 09, 2015 at 02:25:07PM +0900, Simon Horman wrote:
> Hi Pablo,
> 
> please consider this fix for v3.20
> 
> This patch prevents the kernel getting into a situation whereby a
> real-server may not be removed from a heterogeneous IPVS virtual server.
> 
> This problem was introduced by  bc18d37f676f ("ipvs: Allow heterogeneous
> pools now that we support them") in v3.18. This patch seems appropriate
> for stable and I have checked that it applies cleanly to both v3.19 and
> v3.18.6.
> 
> 
> The following changes since commit 42b5212fee4f57907e9415b18fe19c13e65574bc:
> 
>   xen-netback: stop the guest rx thread after a fatal error (2015-02-02 19:39:04 -0800)
> 
> are available in the git repository at:
> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git tags/ipvs-fixes-for-v3.20

Pulled, thanks Simon.

Re: [GIT PULL nf] IPVS Fixes for v3.20

[Simon Horman]

On Tue, Feb 10, 2015 at 06:31:41AM +0100, Pablo Neira Ayuso wrote:
> On Mon, Feb 09, 2015 at 02:25:07PM +0900, Simon Horman wrote:
> > Hi Pablo,
> > 
> > please consider this fix for v3.20
> > 
> > This patch prevents the kernel getting into a situation whereby a
> > real-server may not be removed from a heterogeneous IPVS virtual server.
> > 
> > This problem was introduced by  bc18d37f676f ("ipvs: Allow heterogeneous
> > pools now that we support them") in v3.18. This patch seems appropriate
> > for stable and I have checked that it applies cleanly to both v3.19 and
> > v3.18.6.
> > 
> > 
> > The following changes since commit 42b5212fee4f57907e9415b18fe19c13e65574bc:
> > 
> >   xen-netback: stop the guest rx thread after a fatal error (2015-02-02 19:39:04 -0800)
> > 
> > are available in the git repository at:
> > 
> >   https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git tags/ipvs-fixes-for-v3.20
> 
> Pulled, thanks Simon.

Thanks Pablo.

I have an unrelated feature patch for v3.20 queued up.
I'll send a pull request for that shortly.