Re: [PATCH nf 0/2] ipvs: keep templates and cport 0 conns away from packet lookups

[Julian Anastasov <ja@ssi.bg>]

	Hello,

On Fri, 25 Sep 2026, Axel Mierczuk wrote:

> A template received over the unauthenticated sync protocol with a
> nonzero cport is matched by data packets in ip_vs_conn_in_get() and
> the protocol state machine runs on it. Patch 1 rejects sync records
> with inconsistent cport and IP_VS_CONN_F_NO_CPORT combinations on
> the backup.
> 
> Patch 2 requires a nonzero cp->cport in ip_vs_conn_out_get() so that
> templates and connections still waiting for their cport cannot be
> matched through the out hook.
> 
> The companion patch "ipvs: filter some flags received in the backup
> server" rejects template records carrying IP_VS_CONN_F_NO_CPORT.
> 
> Axel Mierczuk (2):
>   ipvs: validate cport in received sync records
>   ipvs: skip cport 0 connections in ip_vs_conn_out_get()

	Both patches look good to me, thanks!

Acked-by: Julian Anastasov <ja@ssi.bg>

> 
>  net/netfilter/ipvs/ip_vs_conn.c |  3 ++-
>  net/netfilter/ipvs/ip_vs_sync.c | 19 +++++++++++++++++++
>  2 files changed, 21 insertions(+), 1 deletion(-)
> 
> -- 
> 2.43.0

Regards

--
Julian Anastasov <ja@ssi.bg>