IPVS fix

In accordance with the logic for SD, remove the ipvs rules
only when there is no more endpoints using the IP

Signed-off-by: Flavio Crisciani <flavio.crisciani@docker.com>

Author: Flavio Crisciani

service_common.go

@@ -237,14 +237,15 @@ func (c *controller) addServiceBinding(svcName, svcID, nID, eID, containerName s
 		// Create a new load balancer if we are seeing this
 		// network attachment on the service for the first
 		// time.
+		fwMarkCtrMu.Lock()
+
 		lb = &loadBalancer{
 			vip:      vip,
 			fwMark:   fwMarkCtr,
 			backEnds: make(map[string]loadBalancerBackend),
 			service:  s,
 		}
 
-		fwMarkCtrMu.Lock()
 		fwMarkCtr++
 		fwMarkCtrMu.Unlock()
 
@@ -342,7 +343,7 @@ func (c *controller) rmServiceBinding(svcName, svcID, nID, eID, containerName st
 
 	// Remove loadbalancer service(if needed) and backend in all
 	// sandboxes in the network only if the vip is valid.
-	if len(vip) != 0 {
+	if len(vip) != 0 && entries == 0 {
 		n.(*network).rmLBBackend(ip, vip, lb.fwMark, ingressPorts, rmService)
 	}