From: Adriano Cordova <adrianox@gmail.com>
To: Simon Horman <horms@verge.net.au>, Julian Anastasov <ja@ssi.bg>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Shuah Khan <shuah@kernel.org>,
netdev@vger.kernel.org, lvs-devel@vger.kernel.org,
netfilter-devel@vger.kernel.org,
Adriano Cordova <adrianox@gmail.com>
Subject: [PATCH 0/4] ipvs: add per-service secure_tcp
Date: Fri, 11 Sep 2026 22:32:12 -0300 [thread overview]
Message-ID: <20260912013216.588300-1-adrianox@gmail.com> (raw)
IPVS currently exposes secure_tcp as a per-netns sysctl. It switches the
TCP state machine to the hardened tcp_states_dos table.
These patches make it per-service: a virtual service can set
IP_VS_SVC_F_SECURE_TCP which is passed into IP_VS_CONN_F_SECURE_TCP at
connection creation. set_tcp_state() then selects tcp_states_dos for those
connections with IP_VS_CONN_F_SECURE_TCP set and keeps pd->tcp_state_table
(the netns default, including the nomem floor) otherwise.
The flag is part of BACKUP_MASK, so it is preserved on sync to backups.
1. uapi: define the per-service secure_tcp flags
2. carry the flag on every connection-creation path (scheduler,
persistence, RS-initiated, cache-bypass) and on FTP data channels
3. honor it in the TCP state machine, resolving the stale FIXME
4. kselftest contrasting a secure vs. a plain service.
Not sure about patch 4... could be dropped or absorbed into ipvs.sh
Adriano Cordova (4):
ipvs: add flags for per-service secure TCP state table
ipvs: stamp per-service secure_tcp on new connections
ipvs: tcp: enable per-connection secure_tcp in state machine
selftests: netfilter: ipvs: add per-service secure_tcp test
include/uapi/linux/ip_vs.h | 5 +-
net/netfilter/ipvs/ip_vs_core.c | 23 +-
net/netfilter/ipvs/ip_vs_ftp.c | 8 +-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 16 +-
.../testing/selftests/net/netfilter/Makefile | 6 +
.../selftests/net/netfilter/gen_tcp_probe.c | 127 +++++++
.../net/netfilter/ipvs_secure_tcp.sh | 158 +++++++++
.../net/netfilter/ipvs_secure_tcp_mln.c | 310 ++++++++++++++++++
8 files changed, 638 insertions(+), 15 deletions(-)
create mode 100644 tools/testing/selftests/net/netfilter/gen_tcp_probe.c
create mode 100755 tools/testing/selftests/net/netfilter/ipvs_secure_tcp.sh
create mode 100644 tools/testing/selftests/net/netfilter/ipvs_secure_tcp_mln.c
--
2.51.0
next reply other threads:[~2026-09-12 1:32 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-12 1:32 Adriano Cordova [this message]
2026-09-12 1:32 ` [PATCH 1/4] ipvs: add flags for per-service secure TCP state table Adriano Cordova
2026-09-12 1:32 ` [PATCH 2/4] ipvs: stamp per-service secure_tcp on new connections Adriano Cordova
2026-09-12 1:32 ` [PATCH 3/4] ipvs: tcp: enable per-connection secure_tcp in state machine Adriano Cordova
2026-09-12 1:32 ` [PATCH 4/4] selftests: netfilter: ipvs: add per-service secure_tcp test Adriano Cordova
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260912013216.588300-1-adrianox@gmail.com \
--to=adrianox@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=horms@verge.net.au \
--cc=ja@ssi.bg \
--cc=kuba@kernel.org \
--cc=lvs-devel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
--cc=shuah@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox