Re: [PATCH v5 nf-next 1/3] ipvs: add flags for per-service secure TCP state table

[Julian Anastasov <ja@ssi.bg>]

	Hello,

On Mon, 21 Sep 2026, Adriano Cordova wrote:

> Add IP_VS_SVC_F_SECURE_TCP to mark a virtual service for the
> DoS-hardened TCP connection state table, and
> IP_VS_CONN_F_SECURE_TCP to carry that capability on a connection
> so the TCP state machine can select the hardened table for it.
> 
> The service flag is 0x0100: bits 0x0008/0x0010/0x0020 are the
> scheduler bits, so leave 0x0040/0x0080 free for schedulers.
> 
> Set IP_VS_CONN_F_SECURE_TCP on every connection bound to a
> destination whose service carries IP_VS_SVC_F_SECURE_TCP.
> 
> Signed-off-by: Adriano Cordova <adrianox@gmail.com>
> ---
> Changes in v2:
> - Let IP_VS_SVC_F_SECURE_TCP be 0x0100, leaving 0x0040/0x0080 free for
>   scheduler flags.
> - Let IP_VS_CONN_F_SECURE_TCP be (1 << 17) and drop it from
>   IP_VS_CONN_F_BACKUP_MASK.
> - Set the flag in ip_vs_bind_dest() instead of at every ip_vs_conn_new()
>   call site.
> 
> Changes in v3:
> - Merge the uapi flag definition and the ip_vs_bind_dest() stamping into
>   a single patch.
> 
> (no changes since v3)
> 
>  include/uapi/linux/ip_vs.h      | 2 ++
>  net/netfilter/ipvs/ip_vs_conn.c | 4 ++++
>  net/netfilter/ipvs/ip_vs_core.c | 3 +++
>  3 files changed, 9 insertions(+)
> 
> diff --git a/include/uapi/linux/ip_vs.h b/include/uapi/linux/ip_vs.h
> index 2c37c6ac7525..ade170109ff4 100644
> --- a/include/uapi/linux/ip_vs.h
> +++ b/include/uapi/linux/ip_vs.h
> @@ -27,6 +27,7 @@
>  
>  #define IP_VS_SVC_F_SCHED_SH_FALLBACK	IP_VS_SVC_F_SCHED1 /* SH fallback */
>  #define IP_VS_SVC_F_SCHED_SH_PORT	IP_VS_SVC_F_SCHED2 /* SH use port */
> +#define IP_VS_SVC_F_SECURE_TCP	0x0100		/* use the hardened TCP table */
>  
>  /*
>   *      IPVS sync daemon states
> @@ -105,6 +106,7 @@
>  
>  /* Flags that are not sent to backup server start from bit 16 */
>  #define IP_VS_CONN_F_NFCT	(1 << 16)	/* use netfilter conntrack */
> +#define IP_VS_CONN_F_SECURE_TCP	(1 << 17)	/* use the hardened TCP table */
>  
>  /* Connection flags from destination that can be changed by user space */
>  #define IP_VS_CONN_F_DEST_MASK (IP_VS_CONN_F_FWD_MASK | \
> diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
> index 6fa3e1dc534c..0b465298b64b 100644
> --- a/net/netfilter/ipvs/ip_vs_conn.c
> +++ b/net/netfilter/ipvs/ip_vs_conn.c
> @@ -1090,6 +1090,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
>  {
>  	unsigned int conn_flags;
>  	__u32 flags;
> +	struct ip_vs_service *svc;
>  
>  	/* if dest is NULL, then return directly */
>  	if (!dest)
> @@ -1102,6 +1103,9 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
>  	if (cp->protocol != IPPROTO_UDP)
>  		conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
>  	flags = cp->flags;
> +	svc = rcu_dereference(dest->svc);
> +	if (svc && (svc->flags & IP_VS_SVC_F_SECURE_TCP))
> +		flags |= IP_VS_CONN_F_SECURE_TCP;

	Adriano, due to the long IPVS bugfix queue, sometimes
the -next work may conflict with other changes. This is the case
with the above hunk. Looks like we should wait the patch
"ipvs: do not create invisible templates" to be included
into the net tree, the net tree to be merged into the net-next
and nf-next tree and then you can post a version for nf-next
which will be on top of this patch. In the mean time I'll
review your changes soon, so that the patchset can be ready
for that moment.

>  	/* Bind with the destination and its corresponding transmitter */
>  	if (flags & IP_VS_CONN_F_SYNC) {
>  		/* Synced conns are hashed, so they can not get this flag */
> diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
> index ba0957798bad..aa8a3a964ffd 100644
> --- a/net/netfilter/ipvs/ip_vs_core.c
> +++ b/net/netfilter/ipvs/ip_vs_core.c
> @@ -784,6 +784,9 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
>  				      IP_VS_CONN_F_ONE_PACKET : 0;
>  		union nf_inet_addr daddr = { .all = { 0, 0, 0, 0 } };
>  
> +		if (svc->flags & IP_VS_SVC_F_SECURE_TCP)
> +			flags |= IP_VS_CONN_F_SECURE_TCP;
> +
>  		/* create a new connection entry */
>  		IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__);
>  		{
> -- 
> 2.51.0

Regards

--
Julian Anastasov <ja@ssi.bg>