2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the Netfilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
8 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
9 * Peter Kese <peter.kese@ijs.si>
10 * Julian Anastasov <ja@ssi.bg>
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
17 * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
18 * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
22 * Paul `Rusty' Russell properly handle non-linear skbs
23 * Harald Welte don't use nfcache
27 #define KMSG_COMPONENT "IPVS"
28 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
30 #include <linux/module.h>
31 #include <linux/kernel.h>
33 #include <linux/tcp.h>
34 #include <linux/sctp.h>
35 #include <linux/icmp.h>
36 #include <linux/slab.h>
41 #include <net/icmp.h> /* for icmp_send */
42 #include <net/route.h>
43 #include <net/ip6_checksum.h>
44 #include <net/netns/generic.h> /* net_generic() */
46 #include <linux/netfilter.h>
47 #include <linux/netfilter_ipv4.h>
49 #ifdef CONFIG_IP_VS_IPV6
51 #include <linux/netfilter_ipv6.h>
52 #include <net/ip6_route.h>
55 #include <net/ip_vs.h>
56 #include <linux/indirect_call_wrapper.h>
59 EXPORT_SYMBOL(register_ip_vs_scheduler
);
60 EXPORT_SYMBOL(unregister_ip_vs_scheduler
);
61 EXPORT_SYMBOL(ip_vs_proto_name
);
62 EXPORT_SYMBOL(ip_vs_conn_new
);
63 EXPORT_SYMBOL(ip_vs_conn_in_get
);
64 EXPORT_SYMBOL(ip_vs_conn_out_get
);
65 #ifdef CONFIG_IP_VS_PROTO_TCP
66 EXPORT_SYMBOL(ip_vs_tcp_conn_listen
);
68 EXPORT_SYMBOL(ip_vs_conn_put
);
69 #ifdef CONFIG_IP_VS_DEBUG
70 EXPORT_SYMBOL(ip_vs_get_debug_level
);
72 EXPORT_SYMBOL(ip_vs_new_conn_out
);
74 #ifdef CONFIG_IP_VS_PROTO_TCP
75 INDIRECT_CALLABLE_DECLARE(int
76 tcp_snat_handler(struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
77 struct ip_vs_conn
*cp
, struct ip_vs_iphdr
*iph
));
80 #ifdef CONFIG_IP_VS_PROTO_UDP
81 INDIRECT_CALLABLE_DECLARE(int
82 udp_snat_handler(struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
83 struct ip_vs_conn
*cp
, struct ip_vs_iphdr
*iph
));
86 #if defined(CONFIG_IP_VS_PROTO_TCP) && defined(CONFIG_IP_VS_PROTO_UDP)
87 #define SNAT_CALL(f, ...) \
88 INDIRECT_CALL_2(f, tcp_snat_handler, udp_snat_handler, __VA_ARGS__)
89 #elif defined(CONFIG_IP_VS_PROTO_TCP)
90 #define SNAT_CALL(f, ...) INDIRECT_CALL_1(f, tcp_snat_handler, __VA_ARGS__)
91 #elif defined(CONFIG_IP_VS_PROTO_UDP)
92 #define SNAT_CALL(f, ...) INDIRECT_CALL_1(f, udp_snat_handler, __VA_ARGS__)
94 #define SNAT_CALL(f, ...) f(__VA_ARGS__)
97 static unsigned int ip_vs_net_id __read_mostly
;
98 /* netns cnt used for uniqueness */
99 static atomic_t ipvs_netns_cnt
= ATOMIC_INIT(0);
101 /* ID used in ICMP lookups */
102 #define icmp_id(icmph) (((icmph)->un).echo.id)
103 #define icmpv6_id(icmph) (icmph->icmp6_dataun.u_echo.identifier)
105 const char *ip_vs_proto_name(unsigned int proto
)
120 #ifdef CONFIG_IP_VS_IPV6
125 sprintf(buf
, "IP_%u", proto
);
130 void ip_vs_init_hash_table(struct list_head
*table
, int rows
)
133 INIT_LIST_HEAD(&table
[rows
]);
137 ip_vs_in_stats(struct ip_vs_conn
*cp
, struct sk_buff
*skb
)
139 struct ip_vs_dest
*dest
= cp
->dest
;
140 struct netns_ipvs
*ipvs
= cp
->ipvs
;
142 if (dest
&& (dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
143 struct ip_vs_cpu_stats
*s
;
144 struct ip_vs_service
*svc
;
148 s
= this_cpu_ptr(dest
->stats
.cpustats
);
149 u64_stats_update_begin(&s
->syncp
);
151 s
->cnt
.inbytes
+= skb
->len
;
152 u64_stats_update_end(&s
->syncp
);
154 svc
= rcu_dereference(dest
->svc
);
155 s
= this_cpu_ptr(svc
->stats
.cpustats
);
156 u64_stats_update_begin(&s
->syncp
);
158 s
->cnt
.inbytes
+= skb
->len
;
159 u64_stats_update_end(&s
->syncp
);
161 s
= this_cpu_ptr(ipvs
->tot_stats
.cpustats
);
162 u64_stats_update_begin(&s
->syncp
);
164 s
->cnt
.inbytes
+= skb
->len
;
165 u64_stats_update_end(&s
->syncp
);
173 ip_vs_out_stats(struct ip_vs_conn
*cp
, struct sk_buff
*skb
)
175 struct ip_vs_dest
*dest
= cp
->dest
;
176 struct netns_ipvs
*ipvs
= cp
->ipvs
;
178 if (dest
&& (dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
179 struct ip_vs_cpu_stats
*s
;
180 struct ip_vs_service
*svc
;
184 s
= this_cpu_ptr(dest
->stats
.cpustats
);
185 u64_stats_update_begin(&s
->syncp
);
187 s
->cnt
.outbytes
+= skb
->len
;
188 u64_stats_update_end(&s
->syncp
);
190 svc
= rcu_dereference(dest
->svc
);
191 s
= this_cpu_ptr(svc
->stats
.cpustats
);
192 u64_stats_update_begin(&s
->syncp
);
194 s
->cnt
.outbytes
+= skb
->len
;
195 u64_stats_update_end(&s
->syncp
);
197 s
= this_cpu_ptr(ipvs
->tot_stats
.cpustats
);
198 u64_stats_update_begin(&s
->syncp
);
200 s
->cnt
.outbytes
+= skb
->len
;
201 u64_stats_update_end(&s
->syncp
);
209 ip_vs_conn_stats(struct ip_vs_conn
*cp
, struct ip_vs_service
*svc
)
211 struct netns_ipvs
*ipvs
= svc
->ipvs
;
212 struct ip_vs_cpu_stats
*s
;
216 s
= this_cpu_ptr(cp
->dest
->stats
.cpustats
);
217 u64_stats_update_begin(&s
->syncp
);
219 u64_stats_update_end(&s
->syncp
);
221 s
= this_cpu_ptr(svc
->stats
.cpustats
);
222 u64_stats_update_begin(&s
->syncp
);
224 u64_stats_update_end(&s
->syncp
);
226 s
= this_cpu_ptr(ipvs
->tot_stats
.cpustats
);
227 u64_stats_update_begin(&s
->syncp
);
229 u64_stats_update_end(&s
->syncp
);
236 ip_vs_set_state(struct ip_vs_conn
*cp
, int direction
,
237 const struct sk_buff
*skb
,
238 struct ip_vs_proto_data
*pd
)
240 if (likely(pd
->pp
->state_transition
))
241 pd
->pp
->state_transition(cp
, direction
, skb
, pd
);
245 ip_vs_conn_fill_param_persist(const struct ip_vs_service
*svc
,
246 struct sk_buff
*skb
, int protocol
,
247 const union nf_inet_addr
*caddr
, __be16 cport
,
248 const union nf_inet_addr
*vaddr
, __be16 vport
,
249 struct ip_vs_conn_param
*p
)
251 ip_vs_conn_fill_param(svc
->ipvs
, svc
->af
, protocol
, caddr
, cport
, vaddr
,
253 p
->pe
= rcu_dereference(svc
->pe
);
254 if (p
->pe
&& p
->pe
->fill_param
)
255 return p
->pe
->fill_param(p
, skb
);
261 * IPVS persistent scheduling function
262 * It creates a connection entry according to its template if exists,
263 * or selects a server and creates a connection entry plus a template.
264 * Locking: we are svc user (svc->refcnt), so we hold all dests too
265 * Protocols supported: TCP, UDP
267 static struct ip_vs_conn
*
268 ip_vs_sched_persist(struct ip_vs_service
*svc
,
269 struct sk_buff
*skb
, __be16 src_port
, __be16 dst_port
,
270 int *ignored
, struct ip_vs_iphdr
*iph
)
272 struct ip_vs_conn
*cp
= NULL
;
273 struct ip_vs_dest
*dest
;
274 struct ip_vs_conn
*ct
;
275 __be16 dport
= 0; /* destination port to forward */
277 struct ip_vs_conn_param param
;
278 const union nf_inet_addr fwmark
= { .ip
= htonl(svc
->fwmark
) };
279 union nf_inet_addr snet
; /* source network of the client,
281 const union nf_inet_addr
*src_addr
, *dst_addr
;
283 if (likely(!ip_vs_iph_inverse(iph
))) {
284 src_addr
= &iph
->saddr
;
285 dst_addr
= &iph
->daddr
;
287 src_addr
= &iph
->daddr
;
288 dst_addr
= &iph
->saddr
;
292 /* Mask saddr with the netmask to adjust template granularity */
293 #ifdef CONFIG_IP_VS_IPV6
294 if (svc
->af
== AF_INET6
)
295 ipv6_addr_prefix(&snet
.in6
, &src_addr
->in6
,
296 (__force __u32
) svc
->netmask
);
299 snet
.ip
= src_addr
->ip
& svc
->netmask
;
301 IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "
303 IP_VS_DBG_ADDR(svc
->af
, src_addr
), ntohs(src_port
),
304 IP_VS_DBG_ADDR(svc
->af
, dst_addr
), ntohs(dst_port
),
305 IP_VS_DBG_ADDR(svc
->af
, &snet
));
308 * As far as we know, FTP is a very complicated network protocol, and
309 * it uses control connection and data connections. For active FTP,
310 * FTP server initialize data connection to the client, its source port
311 * is often 20. For passive FTP, FTP server tells the clients the port
312 * that it passively listens to, and the client issues the data
313 * connection. In the tunneling or direct routing mode, the load
314 * balancer is on the client-to-server half of connection, the port
315 * number is unknown to the load balancer. So, a conn template like
316 * <caddr, 0, vaddr, 0, daddr, 0> is created for persistent FTP
317 * service, and a template like <caddr, 0, vaddr, vport, daddr, dport>
318 * is created for other persistent services.
321 int protocol
= iph
->protocol
;
322 const union nf_inet_addr
*vaddr
= dst_addr
;
325 if (dst_port
== svc
->port
) {
327 * <protocol, caddr, 0, vaddr, vport, daddr, dport>
329 * <protocol, caddr, 0, vaddr, 0, daddr, 0>
331 if (svc
->port
!= FTPPORT
)
334 /* Note: persistent fwmark-based services and
335 * persistent port zero service are handled here.
337 * <IPPROTO_IP,caddr,0,fwmark,0,daddr,0>
338 * port zero template:
339 * <protocol,caddr,0,vaddr,0,daddr,0>
342 protocol
= IPPROTO_IP
;
346 /* return *ignored = -1 so NF_DROP can be used */
347 if (ip_vs_conn_fill_param_persist(svc
, skb
, protocol
, &snet
, 0,
348 vaddr
, vport
, ¶m
) < 0) {
354 /* Check if a template already exists */
355 ct
= ip_vs_ct_in_get(¶m
);
356 if (!ct
|| !ip_vs_check_template(ct
, NULL
)) {
357 struct ip_vs_scheduler
*sched
;
360 * No template found or the dest of the connection
361 * template is not available.
362 * return *ignored=0 i.e. ICMP and NF_DROP
364 sched
= rcu_dereference(svc
->scheduler
);
366 /* read svc->sched_data after svc->scheduler */
368 dest
= sched
->schedule(svc
, skb
, iph
);
373 IP_VS_DBG(1, "p-schedule: no dest found.\n");
374 kfree(param
.pe_data
);
379 if (dst_port
== svc
->port
&& svc
->port
!= FTPPORT
)
383 * This adds param.pe_data to the template,
384 * and thus param.pe_data will be destroyed
385 * when the template expires */
386 ct
= ip_vs_conn_new(¶m
, dest
->af
, &dest
->addr
, dport
,
387 IP_VS_CONN_F_TEMPLATE
, dest
, skb
->mark
);
389 kfree(param
.pe_data
);
394 ct
->timeout
= svc
->timeout
;
396 /* set destination with the found template */
398 kfree(param
.pe_data
);
402 if (dport
== svc
->port
&& dest
->port
)
405 flags
= (svc
->flags
& IP_VS_SVC_F_ONEPACKET
406 && iph
->protocol
== IPPROTO_UDP
) ?
407 IP_VS_CONN_F_ONE_PACKET
: 0;
410 * Create a new connection according to the template
412 ip_vs_conn_fill_param(svc
->ipvs
, svc
->af
, iph
->protocol
, src_addr
,
413 src_port
, dst_addr
, dst_port
, ¶m
);
415 cp
= ip_vs_conn_new(¶m
, dest
->af
, &dest
->addr
, dport
, flags
, dest
,
426 ip_vs_control_add(cp
, ct
);
429 ip_vs_conn_stats(cp
, svc
);
435 * IPVS main scheduling function
436 * It selects a server according to the virtual service, and
437 * creates a connection entry.
438 * Protocols supported: TCP, UDP
442 * 1 : protocol tried to schedule (eg. on SYN), found svc but the
443 * svc/scheduler decides that this packet should be accepted with
444 * NF_ACCEPT because it must not be scheduled.
446 * 0 : scheduler can not find destination, so try bypass or
447 * return ICMP and then NF_DROP (ip_vs_leave).
449 * -1 : scheduler tried to schedule but fatal error occurred, eg.
450 * ip_vs_conn_new failure (ENOMEM) or ip_vs_sip_fill_param
451 * failure such as missing Call-ID, ENOMEM on skb_linearize
452 * or pe_data. In this case we should return NF_DROP without
453 * any attempts to send ICMP with ip_vs_leave.
456 ip_vs_schedule(struct ip_vs_service
*svc
, struct sk_buff
*skb
,
457 struct ip_vs_proto_data
*pd
, int *ignored
,
458 struct ip_vs_iphdr
*iph
)
460 struct ip_vs_protocol
*pp
= pd
->pp
;
461 struct ip_vs_conn
*cp
= NULL
;
462 struct ip_vs_scheduler
*sched
;
463 struct ip_vs_dest
*dest
;
464 __be16 _ports
[2], *pptr
, cport
, vport
;
465 const void *caddr
, *vaddr
;
470 * IPv6 frags, only the first hit here.
472 pptr
= frag_safe_skb_hp(skb
, iph
->len
, sizeof(_ports
), _ports
);
476 if (likely(!ip_vs_iph_inverse(iph
))) {
489 * FTPDATA needs this check when using local real server.
490 * Never schedule Active FTPDATA connections from real server.
491 * For LVS-NAT they must be already created. For other methods
492 * with persistence the connection is created on SYN+ACK.
494 if (cport
== FTPDATA
) {
495 IP_VS_DBG_PKT(12, svc
->af
, pp
, skb
, iph
->off
,
496 "Not scheduling FTPDATA");
501 * Do not schedule replies from local real server.
503 if ((!skb
->dev
|| skb
->dev
->flags
& IFF_LOOPBACK
)) {
504 iph
->hdr_flags
^= IP_VS_HDR_INVERSE
;
505 cp
= INDIRECT_CALL_1(pp
->conn_in_get
,
506 ip_vs_conn_in_get_proto
, svc
->ipvs
,
508 iph
->hdr_flags
^= IP_VS_HDR_INVERSE
;
511 IP_VS_DBG_PKT(12, svc
->af
, pp
, skb
, iph
->off
,
512 "Not scheduling reply for existing"
514 __ip_vs_conn_put(cp
);
522 if (svc
->flags
& IP_VS_SVC_F_PERSISTENT
)
523 return ip_vs_sched_persist(svc
, skb
, cport
, vport
, ignored
,
529 * Non-persistent service
531 if (!svc
->fwmark
&& vport
!= svc
->port
) {
533 pr_err("Schedule: port zero only supported "
534 "in persistent services, "
535 "check your ipvs configuration\n");
539 sched
= rcu_dereference(svc
->scheduler
);
541 /* read svc->sched_data after svc->scheduler */
543 dest
= sched
->schedule(svc
, skb
, iph
);
548 IP_VS_DBG(1, "Schedule: no dest found.\n");
552 flags
= (svc
->flags
& IP_VS_SVC_F_ONEPACKET
553 && iph
->protocol
== IPPROTO_UDP
) ?
554 IP_VS_CONN_F_ONE_PACKET
: 0;
557 * Create a connection entry.
560 struct ip_vs_conn_param p
;
562 ip_vs_conn_fill_param(svc
->ipvs
, svc
->af
, iph
->protocol
,
563 caddr
, cport
, vaddr
, vport
, &p
);
564 cp
= ip_vs_conn_new(&p
, dest
->af
, &dest
->addr
,
565 dest
->port
? dest
->port
: vport
,
566 flags
, dest
, skb
->mark
);
573 IP_VS_DBG_BUF(6, "Schedule fwd:%c c:%s:%u v:%s:%u "
574 "d:%s:%u conn->flags:%X conn->refcnt:%d\n",
576 IP_VS_DBG_ADDR(cp
->af
, &cp
->caddr
), ntohs(cp
->cport
),
577 IP_VS_DBG_ADDR(cp
->af
, &cp
->vaddr
), ntohs(cp
->vport
),
578 IP_VS_DBG_ADDR(cp
->daf
, &cp
->daddr
), ntohs(cp
->dport
),
579 cp
->flags
, refcount_read(&cp
->refcnt
));
581 ip_vs_conn_stats(cp
, svc
);
585 static inline int ip_vs_addr_is_unicast(struct net
*net
, int af
,
586 union nf_inet_addr
*addr
)
588 #ifdef CONFIG_IP_VS_IPV6
590 return ipv6_addr_type(&addr
->in6
) & IPV6_ADDR_UNICAST
;
592 return (inet_addr_type(net
, addr
->ip
) == RTN_UNICAST
);
596 * Pass or drop the packet.
597 * Called by ip_vs_in, when the virtual service is available but
598 * no destination is available for a new connection.
600 int ip_vs_leave(struct ip_vs_service
*svc
, struct sk_buff
*skb
,
601 struct ip_vs_proto_data
*pd
, struct ip_vs_iphdr
*iph
)
603 __be16 _ports
[2], *pptr
, dport
;
604 struct netns_ipvs
*ipvs
= svc
->ipvs
;
605 struct net
*net
= ipvs
->net
;
607 pptr
= frag_safe_skb_hp(skb
, iph
->len
, sizeof(_ports
), _ports
);
610 dport
= likely(!ip_vs_iph_inverse(iph
)) ? pptr
[1] : pptr
[0];
612 /* if it is fwmark-based service, the cache_bypass sysctl is up
613 and the destination is a non-local unicast, then create
614 a cache_bypass connection entry */
615 if (sysctl_cache_bypass(ipvs
) && svc
->fwmark
&&
616 !(iph
->hdr_flags
& (IP_VS_HDR_INVERSE
| IP_VS_HDR_ICMP
)) &&
617 ip_vs_addr_is_unicast(net
, svc
->af
, &iph
->daddr
)) {
619 struct ip_vs_conn
*cp
;
620 unsigned int flags
= (svc
->flags
& IP_VS_SVC_F_ONEPACKET
&&
621 iph
->protocol
== IPPROTO_UDP
) ?
622 IP_VS_CONN_F_ONE_PACKET
: 0;
623 union nf_inet_addr daddr
= { .all
= { 0, 0, 0, 0 } };
625 /* create a new connection entry */
626 IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__
);
628 struct ip_vs_conn_param p
;
629 ip_vs_conn_fill_param(svc
->ipvs
, svc
->af
, iph
->protocol
,
630 &iph
->saddr
, pptr
[0],
631 &iph
->daddr
, pptr
[1], &p
);
632 cp
= ip_vs_conn_new(&p
, svc
->af
, &daddr
, 0,
633 IP_VS_CONN_F_BYPASS
| flags
,
640 ip_vs_in_stats(cp
, skb
);
643 ip_vs_set_state(cp
, IP_VS_DIR_INPUT
, skb
, pd
);
645 /* transmit the first SYN packet */
646 ret
= cp
->packet_xmit(skb
, cp
, pd
->pp
, iph
);
647 /* do not touch skb anymore */
649 if ((cp
->flags
& IP_VS_CONN_F_ONE_PACKET
) && cp
->control
)
650 atomic_inc(&cp
->control
->in_pkts
);
652 atomic_inc(&cp
->in_pkts
);
658 * When the virtual ftp service is presented, packets destined
659 * for other services on the VIP may get here (except services
660 * listed in the ipvs table), pass the packets, because it is
661 * not ipvs job to decide to drop the packets.
663 if (svc
->port
== FTPPORT
&& dport
!= FTPPORT
)
666 if (unlikely(ip_vs_iph_icmp(iph
)))
670 * Notify the client that the destination is unreachable, and
671 * release the socket buffer.
672 * Since it is in IP layer, the TCP socket is not actually
673 * created, the TCP RST packet cannot be sent, instead that
674 * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ
676 #ifdef CONFIG_IP_VS_IPV6
677 if (svc
->af
== AF_INET6
) {
679 skb
->dev
= net
->loopback_dev
;
680 icmpv6_send(skb
, ICMPV6_DEST_UNREACH
, ICMPV6_PORT_UNREACH
, 0);
683 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_PORT_UNREACH
, 0);
690 static int sysctl_snat_reroute(struct netns_ipvs
*ipvs
)
692 return ipvs
->sysctl_snat_reroute
;
695 static int sysctl_nat_icmp_send(struct netns_ipvs
*ipvs
)
697 return ipvs
->sysctl_nat_icmp_send
;
700 static int sysctl_expire_nodest_conn(struct netns_ipvs
*ipvs
)
702 return ipvs
->sysctl_expire_nodest_conn
;
707 static int sysctl_snat_reroute(struct netns_ipvs
*ipvs
) { return 0; }
708 static int sysctl_nat_icmp_send(struct netns_ipvs
*ipvs
) { return 0; }
709 static int sysctl_expire_nodest_conn(struct netns_ipvs
*ipvs
) { return 0; }
713 __sum16
ip_vs_checksum_complete(struct sk_buff
*skb
, int offset
)
715 return csum_fold(skb_checksum(skb
, offset
, skb
->len
- offset
, 0));
718 static inline enum ip_defrag_users
ip_vs_defrag_user(unsigned int hooknum
)
720 if (NF_INET_LOCAL_IN
== hooknum
)
721 return IP_DEFRAG_VS_IN
;
722 if (NF_INET_FORWARD
== hooknum
)
723 return IP_DEFRAG_VS_FWD
;
724 return IP_DEFRAG_VS_OUT
;
727 static inline int ip_vs_gather_frags(struct netns_ipvs
*ipvs
,
728 struct sk_buff
*skb
, u_int32_t user
)
733 err
= ip_defrag(ipvs
->net
, skb
, user
);
736 ip_send_check(ip_hdr(skb
));
741 static int ip_vs_route_me_harder(struct netns_ipvs
*ipvs
, int af
,
742 struct sk_buff
*skb
, unsigned int hooknum
)
744 if (!sysctl_snat_reroute(ipvs
))
746 /* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */
747 if (NF_INET_LOCAL_IN
== hooknum
)
749 #ifdef CONFIG_IP_VS_IPV6
750 if (af
== AF_INET6
) {
751 struct dst_entry
*dst
= skb_dst(skb
);
753 if (dst
->dev
&& !(dst
->dev
->flags
& IFF_LOOPBACK
) &&
754 ip6_route_me_harder(ipvs
->net
, skb
) != 0)
758 if (!(skb_rtable(skb
)->rt_flags
& RTCF_LOCAL
) &&
759 ip_route_me_harder(ipvs
->net
, skb
, RTN_LOCAL
) != 0)
766 * Packet has been made sufficiently writable in caller
767 * - inout: 1=in->out, 0=out->in
769 void ip_vs_nat_icmp(struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
770 struct ip_vs_conn
*cp
, int inout
)
772 struct iphdr
*iph
= ip_hdr(skb
);
773 unsigned int icmp_offset
= iph
->ihl
*4;
774 struct icmphdr
*icmph
= (struct icmphdr
*)(skb_network_header(skb
) +
776 struct iphdr
*ciph
= (struct iphdr
*)(icmph
+ 1);
779 iph
->saddr
= cp
->vaddr
.ip
;
781 ciph
->daddr
= cp
->vaddr
.ip
;
784 iph
->daddr
= cp
->daddr
.ip
;
786 ciph
->saddr
= cp
->daddr
.ip
;
790 /* the TCP/UDP/SCTP port */
791 if (IPPROTO_TCP
== ciph
->protocol
|| IPPROTO_UDP
== ciph
->protocol
||
792 IPPROTO_SCTP
== ciph
->protocol
) {
793 __be16
*ports
= (void *)ciph
+ ciph
->ihl
*4;
796 ports
[1] = cp
->vport
;
798 ports
[0] = cp
->dport
;
801 /* And finally the ICMP checksum */
803 icmph
->checksum
= ip_vs_checksum_complete(skb
, icmp_offset
);
804 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
807 IP_VS_DBG_PKT(11, AF_INET
, pp
, skb
, (void *)ciph
- (void *)iph
,
808 "Forwarding altered outgoing ICMP");
810 IP_VS_DBG_PKT(11, AF_INET
, pp
, skb
, (void *)ciph
- (void *)iph
,
811 "Forwarding altered incoming ICMP");
814 #ifdef CONFIG_IP_VS_IPV6
815 void ip_vs_nat_icmp_v6(struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
816 struct ip_vs_conn
*cp
, int inout
)
818 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
819 unsigned int icmp_offset
= 0;
820 unsigned int offs
= 0; /* header offset*/
822 struct icmp6hdr
*icmph
;
823 struct ipv6hdr
*ciph
;
824 unsigned short fragoffs
;
826 ipv6_find_hdr(skb
, &icmp_offset
, IPPROTO_ICMPV6
, &fragoffs
, NULL
);
827 icmph
= (struct icmp6hdr
*)(skb_network_header(skb
) + icmp_offset
);
828 offs
= icmp_offset
+ sizeof(struct icmp6hdr
);
829 ciph
= (struct ipv6hdr
*)(skb_network_header(skb
) + offs
);
831 protocol
= ipv6_find_hdr(skb
, &offs
, -1, &fragoffs
, NULL
);
834 iph
->saddr
= cp
->vaddr
.in6
;
835 ciph
->daddr
= cp
->vaddr
.in6
;
837 iph
->daddr
= cp
->daddr
.in6
;
838 ciph
->saddr
= cp
->daddr
.in6
;
841 /* the TCP/UDP/SCTP port */
842 if (!fragoffs
&& (IPPROTO_TCP
== protocol
|| IPPROTO_UDP
== protocol
||
843 IPPROTO_SCTP
== protocol
)) {
844 __be16
*ports
= (void *)(skb_network_header(skb
) + offs
);
846 IP_VS_DBG(11, "%s() changed port %d to %d\n", __func__
,
847 ntohs(inout
? ports
[1] : ports
[0]),
848 ntohs(inout
? cp
->vport
: cp
->dport
));
850 ports
[1] = cp
->vport
;
852 ports
[0] = cp
->dport
;
855 /* And finally the ICMP checksum */
856 icmph
->icmp6_cksum
= ~csum_ipv6_magic(&iph
->saddr
, &iph
->daddr
,
857 skb
->len
- icmp_offset
,
859 skb
->csum_start
= skb_network_header(skb
) - skb
->head
+ icmp_offset
;
860 skb
->csum_offset
= offsetof(struct icmp6hdr
, icmp6_cksum
);
861 skb
->ip_summed
= CHECKSUM_PARTIAL
;
864 IP_VS_DBG_PKT(11, AF_INET6
, pp
, skb
,
865 (void *)ciph
- (void *)iph
,
866 "Forwarding altered outgoing ICMPv6");
868 IP_VS_DBG_PKT(11, AF_INET6
, pp
, skb
,
869 (void *)ciph
- (void *)iph
,
870 "Forwarding altered incoming ICMPv6");
874 /* Handle relevant response ICMP messages - forward to the right
877 static int handle_response_icmp(int af
, struct sk_buff
*skb
,
878 union nf_inet_addr
*snet
,
879 __u8 protocol
, struct ip_vs_conn
*cp
,
880 struct ip_vs_protocol
*pp
,
881 unsigned int offset
, unsigned int ihl
,
882 unsigned int hooknum
)
884 unsigned int verdict
= NF_DROP
;
886 if (IP_VS_FWD_METHOD(cp
) != IP_VS_CONN_F_MASQ
)
889 /* Ensure the checksum is correct */
890 if (!skb_csum_unnecessary(skb
) && ip_vs_checksum_complete(skb
, ihl
)) {
891 /* Failed checksum! */
892 IP_VS_DBG_BUF(1, "Forward ICMP: failed checksum from %s!\n",
893 IP_VS_DBG_ADDR(af
, snet
));
897 if (IPPROTO_TCP
== protocol
|| IPPROTO_UDP
== protocol
||
898 IPPROTO_SCTP
== protocol
)
899 offset
+= 2 * sizeof(__u16
);
900 if (!skb_make_writable(skb
, offset
))
903 #ifdef CONFIG_IP_VS_IPV6
905 ip_vs_nat_icmp_v6(skb
, pp
, cp
, 1);
908 ip_vs_nat_icmp(skb
, pp
, cp
, 1);
910 if (ip_vs_route_me_harder(cp
->ipvs
, af
, skb
, hooknum
))
913 /* do the statistics and put it back */
914 ip_vs_out_stats(cp
, skb
);
916 skb
->ipvs_property
= 1;
917 if (!(cp
->flags
& IP_VS_CONN_F_NFCT
))
920 ip_vs_update_conntrack(skb
, cp
, 0);
926 __ip_vs_conn_put(cp
);
932 * Handle ICMP messages in the inside-to-outside direction (outgoing).
933 * Find any that might be relevant, check against existing connections.
934 * Currently handles error types - unreachable, quench, ttl exceeded.
936 static int ip_vs_out_icmp(struct netns_ipvs
*ipvs
, struct sk_buff
*skb
,
937 int *related
, unsigned int hooknum
)
940 struct icmphdr _icmph
, *ic
;
941 struct iphdr _ciph
, *cih
; /* The ip header contained within the ICMP */
942 struct ip_vs_iphdr ciph
;
943 struct ip_vs_conn
*cp
;
944 struct ip_vs_protocol
*pp
;
945 unsigned int offset
, ihl
;
946 union nf_inet_addr snet
;
950 /* reassemble IP fragments */
951 if (ip_is_fragment(ip_hdr(skb
))) {
952 if (ip_vs_gather_frags(ipvs
, skb
, ip_vs_defrag_user(hooknum
)))
957 offset
= ihl
= iph
->ihl
* 4;
958 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
962 IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %pI4->%pI4\n",
963 ic
->type
, ntohs(icmp_id(ic
)),
964 &iph
->saddr
, &iph
->daddr
);
967 * Work through seeing if this is for us.
968 * These checks are supposed to be in an order that means easy
969 * things are checked first to speed up processing.... however
970 * this means that some packets will manage to get a long way
971 * down this stack and then be rejected, but that's life.
973 if ((ic
->type
!= ICMP_DEST_UNREACH
) &&
974 (ic
->type
!= ICMP_SOURCE_QUENCH
) &&
975 (ic
->type
!= ICMP_TIME_EXCEEDED
)) {
980 /* Now find the contained IP header */
981 offset
+= sizeof(_icmph
);
982 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
984 return NF_ACCEPT
; /* The packet looks wrong, ignore */
986 pp
= ip_vs_proto_get(cih
->protocol
);
990 /* Is the embedded protocol header present? */
991 if (unlikely(cih
->frag_off
& htons(IP_OFFSET
) &&
995 IP_VS_DBG_PKT(11, AF_INET
, pp
, skb
, offset
,
996 "Checking outgoing ICMP for");
998 ip_vs_fill_iph_skb_icmp(AF_INET
, skb
, offset
, true, &ciph
);
1000 /* The embedded headers contain source and dest in reverse order */
1001 cp
= INDIRECT_CALL_1(pp
->conn_out_get
, ip_vs_conn_out_get_proto
,
1002 ipvs
, AF_INET
, skb
, &ciph
);
1006 snet
.ip
= iph
->saddr
;
1007 return handle_response_icmp(AF_INET
, skb
, &snet
, cih
->protocol
, cp
,
1008 pp
, ciph
.len
, ihl
, hooknum
);
1011 #ifdef CONFIG_IP_VS_IPV6
1012 static int ip_vs_out_icmp_v6(struct netns_ipvs
*ipvs
, struct sk_buff
*skb
,
1013 int *related
, unsigned int hooknum
,
1014 struct ip_vs_iphdr
*ipvsh
)
1016 struct icmp6hdr _icmph
, *ic
;
1017 struct ip_vs_iphdr ciph
= {.flags
= 0, .fragoffs
= 0};/*Contained IP */
1018 struct ip_vs_conn
*cp
;
1019 struct ip_vs_protocol
*pp
;
1020 union nf_inet_addr snet
;
1021 unsigned int offset
;
1024 ic
= frag_safe_skb_hp(skb
, ipvsh
->len
, sizeof(_icmph
), &_icmph
);
1029 * Work through seeing if this is for us.
1030 * These checks are supposed to be in an order that means easy
1031 * things are checked first to speed up processing.... however
1032 * this means that some packets will manage to get a long way
1033 * down this stack and then be rejected, but that's life.
1035 if (ic
->icmp6_type
& ICMPV6_INFOMSG_MASK
) {
1039 /* Fragment header that is before ICMP header tells us that:
1040 * it's not an error message since they can't be fragmented.
1042 if (ipvsh
->flags
& IP6_FH_F_FRAG
)
1045 IP_VS_DBG(8, "Outgoing ICMPv6 (%d,%d) %pI6c->%pI6c\n",
1046 ic
->icmp6_type
, ntohs(icmpv6_id(ic
)),
1047 &ipvsh
->saddr
, &ipvsh
->daddr
);
1049 if (!ip_vs_fill_iph_skb_icmp(AF_INET6
, skb
, ipvsh
->len
+ sizeof(_icmph
),
1051 return NF_ACCEPT
; /* The packet looks wrong, ignore */
1053 pp
= ip_vs_proto_get(ciph
.protocol
);
1057 /* The embedded headers contain source and dest in reverse order */
1058 cp
= INDIRECT_CALL_1(pp
->conn_out_get
, ip_vs_conn_out_get_proto
,
1059 ipvs
, AF_INET6
, skb
, &ciph
);
1063 snet
.in6
= ciph
.saddr
.in6
;
1065 return handle_response_icmp(AF_INET6
, skb
, &snet
, ciph
.protocol
, cp
,
1066 pp
, offset
, sizeof(struct ipv6hdr
),
1072 * Check if sctp chunc is ABORT chunk
1074 static inline int is_sctp_abort(const struct sk_buff
*skb
, int nh_len
)
1076 struct sctp_chunkhdr
*sch
, schunk
;
1077 sch
= skb_header_pointer(skb
, nh_len
+ sizeof(struct sctphdr
),
1078 sizeof(schunk
), &schunk
);
1081 if (sch
->type
== SCTP_CID_ABORT
)
1086 static inline int is_tcp_reset(const struct sk_buff
*skb
, int nh_len
)
1088 struct tcphdr _tcph
, *th
;
1090 th
= skb_header_pointer(skb
, nh_len
, sizeof(_tcph
), &_tcph
);
1096 static inline bool is_new_conn(const struct sk_buff
*skb
,
1097 struct ip_vs_iphdr
*iph
)
1099 switch (iph
->protocol
) {
1101 struct tcphdr _tcph
, *th
;
1103 th
= skb_header_pointer(skb
, iph
->len
, sizeof(_tcph
), &_tcph
);
1108 case IPPROTO_SCTP
: {
1109 struct sctp_chunkhdr
*sch
, schunk
;
1111 sch
= skb_header_pointer(skb
, iph
->len
+ sizeof(struct sctphdr
),
1112 sizeof(schunk
), &schunk
);
1115 return sch
->type
== SCTP_CID_INIT
;
1122 static inline bool is_new_conn_expected(const struct ip_vs_conn
*cp
,
1123 int conn_reuse_mode
)
1125 /* Controlled (FTP DATA or persistence)? */
1129 switch (cp
->protocol
) {
1131 return (cp
->state
== IP_VS_TCP_S_TIME_WAIT
) ||
1132 (cp
->state
== IP_VS_TCP_S_CLOSE
) ||
1133 ((conn_reuse_mode
& 2) &&
1134 (cp
->state
== IP_VS_TCP_S_FIN_WAIT
) &&
1135 (cp
->flags
& IP_VS_CONN_F_NOOUTPUT
));
1137 return cp
->state
== IP_VS_SCTP_S_CLOSED
;
1143 /* Generic function to create new connections for outgoing RS packets
1145 * Pre-requisites for successful connection creation:
1146 * 1) Virtual Service is NOT fwmark based:
1147 * In fwmark-VS actual vaddr and vport are unknown to IPVS
1148 * 2) Real Server and Virtual Service were NOT configured without port:
1149 * This is to allow match of different VS to the same RS ip-addr
1151 struct ip_vs_conn
*ip_vs_new_conn_out(struct ip_vs_service
*svc
,
1152 struct ip_vs_dest
*dest
,
1153 struct sk_buff
*skb
,
1154 const struct ip_vs_iphdr
*iph
,
1158 struct ip_vs_conn_param param
;
1159 struct ip_vs_conn
*ct
= NULL
, *cp
= NULL
;
1160 const union nf_inet_addr
*vaddr
, *daddr
, *caddr
;
1161 union nf_inet_addr snet
;
1168 daddr
= &iph
->saddr
;
1169 caddr
= &iph
->daddr
;
1171 /* check pre-requisites are satisfied */
1174 if (!vport
|| !dport
)
1177 /* for persistent service first create connection template */
1178 if (svc
->flags
& IP_VS_SVC_F_PERSISTENT
) {
1179 /* apply netmask the same way ingress-side does */
1180 #ifdef CONFIG_IP_VS_IPV6
1181 if (svc
->af
== AF_INET6
)
1182 ipv6_addr_prefix(&snet
.in6
, &caddr
->in6
,
1183 (__force __u32
)svc
->netmask
);
1186 snet
.ip
= caddr
->ip
& svc
->netmask
;
1187 /* fill params and create template if not existent */
1188 if (ip_vs_conn_fill_param_persist(svc
, skb
, iph
->protocol
,
1192 ct
= ip_vs_ct_in_get(¶m
);
1193 /* check if template exists and points to the same dest */
1194 if (!ct
|| !ip_vs_check_template(ct
, dest
)) {
1195 ct
= ip_vs_conn_new(¶m
, dest
->af
, daddr
, dport
,
1196 IP_VS_CONN_F_TEMPLATE
, dest
, 0);
1198 kfree(param
.pe_data
);
1201 ct
->timeout
= svc
->timeout
;
1203 kfree(param
.pe_data
);
1207 /* connection flags */
1208 flags
= ((svc
->flags
& IP_VS_SVC_F_ONEPACKET
) &&
1209 iph
->protocol
== IPPROTO_UDP
) ? IP_VS_CONN_F_ONE_PACKET
: 0;
1210 /* create connection */
1211 ip_vs_conn_fill_param(svc
->ipvs
, svc
->af
, iph
->protocol
,
1212 caddr
, cport
, vaddr
, vport
, ¶m
);
1213 cp
= ip_vs_conn_new(¶m
, dest
->af
, daddr
, dport
, flags
, dest
, 0);
1220 ip_vs_control_add(cp
, ct
);
1223 ip_vs_conn_stats(cp
, svc
);
1225 /* return connection (will be used to handle outgoing packet) */
1226 IP_VS_DBG_BUF(6, "New connection RS-initiated:%c c:%s:%u v:%s:%u "
1227 "d:%s:%u conn->flags:%X conn->refcnt:%d\n",
1229 IP_VS_DBG_ADDR(cp
->af
, &cp
->caddr
), ntohs(cp
->cport
),
1230 IP_VS_DBG_ADDR(cp
->af
, &cp
->vaddr
), ntohs(cp
->vport
),
1231 IP_VS_DBG_ADDR(cp
->af
, &cp
->daddr
), ntohs(cp
->dport
),
1232 cp
->flags
, refcount_read(&cp
->refcnt
));
1237 /* Handle outgoing packets which are considered requests initiated by
1238 * real servers, so that subsequent responses from external client can be
1239 * routed to the right real server.
1240 * Used also for outgoing responses in OPS mode.
1242 * Connection management is handled by persistent-engine specific callback.
1244 static struct ip_vs_conn
*__ip_vs_rs_conn_out(unsigned int hooknum
,
1245 struct netns_ipvs
*ipvs
,
1246 int af
, struct sk_buff
*skb
,
1247 const struct ip_vs_iphdr
*iph
)
1249 struct ip_vs_dest
*dest
;
1250 struct ip_vs_conn
*cp
= NULL
;
1251 __be16 _ports
[2], *pptr
;
1253 if (hooknum
== NF_INET_LOCAL_IN
)
1256 pptr
= frag_safe_skb_hp(skb
, iph
->len
,
1257 sizeof(_ports
), _ports
);
1261 dest
= ip_vs_find_real_service(ipvs
, af
, iph
->protocol
,
1262 &iph
->saddr
, pptr
[0]);
1264 struct ip_vs_service
*svc
;
1265 struct ip_vs_pe
*pe
;
1267 svc
= rcu_dereference(dest
->svc
);
1269 pe
= rcu_dereference(svc
->pe
);
1270 if (pe
&& pe
->conn_out
)
1271 cp
= pe
->conn_out(svc
, dest
, skb
, iph
,
1279 /* Handle response packets: rewrite addresses and send away...
1282 handle_response(int af
, struct sk_buff
*skb
, struct ip_vs_proto_data
*pd
,
1283 struct ip_vs_conn
*cp
, struct ip_vs_iphdr
*iph
,
1284 unsigned int hooknum
)
1286 struct ip_vs_protocol
*pp
= pd
->pp
;
1288 IP_VS_DBG_PKT(11, af
, pp
, skb
, iph
->off
, "Outgoing packet");
1290 if (!skb_make_writable(skb
, iph
->len
))
1293 /* mangle the packet */
1294 if (pp
->snat_handler
&&
1295 !SNAT_CALL(pp
->snat_handler
, skb
, pp
, cp
, iph
))
1298 #ifdef CONFIG_IP_VS_IPV6
1300 ipv6_hdr(skb
)->saddr
= cp
->vaddr
.in6
;
1304 ip_hdr(skb
)->saddr
= cp
->vaddr
.ip
;
1305 ip_send_check(ip_hdr(skb
));
1309 * nf_iterate does not expect change in the skb->dst->dev.
1310 * It looks like it is not fatal to enable this code for hooks
1311 * where our handlers are at the end of the chain list and
1312 * when all next handlers use skb->dst->dev and not outdev.
1313 * It will definitely route properly the inout NAT traffic
1314 * when multiple paths are used.
1317 /* For policy routing, packets originating from this
1318 * machine itself may be routed differently to packets
1319 * passing through. We want this packet to be routed as
1320 * if it came from this machine itself. So re-compute
1321 * the routing information.
1323 if (ip_vs_route_me_harder(cp
->ipvs
, af
, skb
, hooknum
))
1326 IP_VS_DBG_PKT(10, af
, pp
, skb
, iph
->off
, "After SNAT");
1328 ip_vs_out_stats(cp
, skb
);
1329 ip_vs_set_state(cp
, IP_VS_DIR_OUTPUT
, skb
, pd
);
1330 skb
->ipvs_property
= 1;
1331 if (!(cp
->flags
& IP_VS_CONN_F_NFCT
))
1334 ip_vs_update_conntrack(skb
, cp
, 0);
1348 * Check if outgoing packet belongs to the established ip_vs_conn.
1351 ip_vs_out(struct netns_ipvs
*ipvs
, unsigned int hooknum
, struct sk_buff
*skb
, int af
)
1353 struct ip_vs_iphdr iph
;
1354 struct ip_vs_protocol
*pp
;
1355 struct ip_vs_proto_data
*pd
;
1356 struct ip_vs_conn
*cp
;
1361 /* Already marked as IPVS request or reply? */
1362 if (skb
->ipvs_property
)
1365 sk
= skb_to_full_sk(skb
);
1366 /* Bad... Do not break raw sockets */
1367 if (unlikely(sk
&& hooknum
== NF_INET_LOCAL_OUT
&&
1370 if (sk
->sk_family
== PF_INET
&& inet_sk(sk
)->nodefrag
)
1374 if (unlikely(!skb_dst(skb
)))
1380 ip_vs_fill_iph_skb(af
, skb
, false, &iph
);
1381 #ifdef CONFIG_IP_VS_IPV6
1382 if (af
== AF_INET6
) {
1383 if (unlikely(iph
.protocol
== IPPROTO_ICMPV6
)) {
1385 int verdict
= ip_vs_out_icmp_v6(ipvs
, skb
, &related
,
1393 if (unlikely(iph
.protocol
== IPPROTO_ICMP
)) {
1395 int verdict
= ip_vs_out_icmp(ipvs
, skb
, &related
, hooknum
);
1401 pd
= ip_vs_proto_data_get(ipvs
, iph
.protocol
);
1406 /* reassemble IP fragments */
1407 #ifdef CONFIG_IP_VS_IPV6
1410 if (unlikely(ip_is_fragment(ip_hdr(skb
)) && !pp
->dont_defrag
)) {
1411 if (ip_vs_gather_frags(ipvs
, skb
,
1412 ip_vs_defrag_user(hooknum
)))
1415 ip_vs_fill_iph_skb(AF_INET
, skb
, false, &iph
);
1419 * Check if the packet belongs to an existing entry
1421 cp
= INDIRECT_CALL_1(pp
->conn_out_get
, ip_vs_conn_out_get_proto
,
1422 ipvs
, af
, skb
, &iph
);
1425 if (IP_VS_FWD_METHOD(cp
) != IP_VS_CONN_F_MASQ
)
1427 return handle_response(af
, skb
, pd
, cp
, &iph
, hooknum
);
1430 /* Check for real-server-started requests */
1431 if (atomic_read(&ipvs
->conn_out_counter
)) {
1432 /* Currently only for UDP:
1433 * connection oriented protocols typically use
1434 * ephemeral ports for outgoing connections, so
1435 * related incoming responses would not match any VS
1437 if (pp
->protocol
== IPPROTO_UDP
) {
1438 cp
= __ip_vs_rs_conn_out(hooknum
, ipvs
, af
, skb
, &iph
);
1440 return handle_response(af
, skb
, pd
, cp
, &iph
,
1445 if (sysctl_nat_icmp_send(ipvs
) &&
1446 (pp
->protocol
== IPPROTO_TCP
||
1447 pp
->protocol
== IPPROTO_UDP
||
1448 pp
->protocol
== IPPROTO_SCTP
)) {
1449 __be16 _ports
[2], *pptr
;
1451 pptr
= frag_safe_skb_hp(skb
, iph
.len
,
1452 sizeof(_ports
), _ports
);
1454 return NF_ACCEPT
; /* Not for me */
1455 if (ip_vs_has_real_service(ipvs
, af
, iph
.protocol
, &iph
.saddr
,
1458 * Notify the real server: there is no
1459 * existing entry if it is not RST
1460 * packet or not TCP packet.
1462 if ((iph
.protocol
!= IPPROTO_TCP
&&
1463 iph
.protocol
!= IPPROTO_SCTP
)
1464 || ((iph
.protocol
== IPPROTO_TCP
1465 && !is_tcp_reset(skb
, iph
.len
))
1466 || (iph
.protocol
== IPPROTO_SCTP
1467 && !is_sctp_abort(skb
,
1469 #ifdef CONFIG_IP_VS_IPV6
1470 if (af
== AF_INET6
) {
1472 skb
->dev
= ipvs
->net
->loopback_dev
;
1474 ICMPV6_DEST_UNREACH
,
1475 ICMPV6_PORT_UNREACH
,
1481 ICMP_PORT_UNREACH
, 0);
1488 IP_VS_DBG_PKT(12, af
, pp
, skb
, iph
.off
,
1489 "ip_vs_out: packet continues traversal as normal");
1493 __ip_vs_conn_put(cp
);
1498 * It is hooked at the NF_INET_FORWARD and NF_INET_LOCAL_IN chain,
1499 * used only for VS/NAT.
1500 * Check if packet is reply for established ip_vs_conn.
1503 ip_vs_reply4(void *priv
, struct sk_buff
*skb
,
1504 const struct nf_hook_state
*state
)
1506 return ip_vs_out(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET
);
1510 * It is hooked at the NF_INET_LOCAL_OUT chain, used only for VS/NAT.
1511 * Check if packet is reply for established ip_vs_conn.
1514 ip_vs_local_reply4(void *priv
, struct sk_buff
*skb
,
1515 const struct nf_hook_state
*state
)
1517 return ip_vs_out(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET
);
1520 #ifdef CONFIG_IP_VS_IPV6
1523 * It is hooked at the NF_INET_FORWARD and NF_INET_LOCAL_IN chain,
1524 * used only for VS/NAT.
1525 * Check if packet is reply for established ip_vs_conn.
1528 ip_vs_reply6(void *priv
, struct sk_buff
*skb
,
1529 const struct nf_hook_state
*state
)
1531 return ip_vs_out(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET6
);
1535 * It is hooked at the NF_INET_LOCAL_OUT chain, used only for VS/NAT.
1536 * Check if packet is reply for established ip_vs_conn.
1539 ip_vs_local_reply6(void *priv
, struct sk_buff
*skb
,
1540 const struct nf_hook_state
*state
)
1542 return ip_vs_out(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET6
);
1548 ip_vs_try_to_schedule(struct netns_ipvs
*ipvs
, int af
, struct sk_buff
*skb
,
1549 struct ip_vs_proto_data
*pd
,
1550 int *verdict
, struct ip_vs_conn
**cpp
,
1551 struct ip_vs_iphdr
*iph
)
1553 struct ip_vs_protocol
*pp
= pd
->pp
;
1555 if (!iph
->fragoffs
) {
1556 /* No (second) fragments need to enter here, as nf_defrag_ipv6
1557 * replayed fragment zero will already have created the cp
1560 /* Schedule and create new connection entry into cpp */
1561 if (!pp
->conn_schedule(ipvs
, af
, skb
, pd
, verdict
, cpp
, iph
))
1565 if (unlikely(!*cpp
)) {
1566 /* sorry, all this trouble for a no-hit :) */
1567 IP_VS_DBG_PKT(12, af
, pp
, skb
, iph
->off
,
1568 "ip_vs_in: packet continues traversal as normal");
1570 /* Fragment couldn't be mapped to a conn entry */
1572 IP_VS_DBG_PKT(7, af
, pp
, skb
, iph
->off
,
1573 "unhandled fragment");
1575 *verdict
= NF_ACCEPT
;
1583 * Handle ICMP messages in the outside-to-inside direction (incoming).
1584 * Find any that might be relevant, check against existing connections,
1585 * forward to the right destination host if relevant.
1586 * Currently handles error types - unreachable, quench, ttl exceeded.
1589 ip_vs_in_icmp(struct netns_ipvs
*ipvs
, struct sk_buff
*skb
, int *related
,
1590 unsigned int hooknum
)
1593 struct icmphdr _icmph
, *ic
;
1594 struct iphdr _ciph
, *cih
; /* The ip header contained within the ICMP */
1595 struct ip_vs_iphdr ciph
;
1596 struct ip_vs_conn
*cp
;
1597 struct ip_vs_protocol
*pp
;
1598 struct ip_vs_proto_data
*pd
;
1599 unsigned int offset
, offset2
, ihl
, verdict
;
1600 bool ipip
, new_cp
= false;
1604 /* reassemble IP fragments */
1605 if (ip_is_fragment(ip_hdr(skb
))) {
1606 if (ip_vs_gather_frags(ipvs
, skb
, ip_vs_defrag_user(hooknum
)))
1611 offset
= ihl
= iph
->ihl
* 4;
1612 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
1616 IP_VS_DBG(12, "Incoming ICMP (%d,%d) %pI4->%pI4\n",
1617 ic
->type
, ntohs(icmp_id(ic
)),
1618 &iph
->saddr
, &iph
->daddr
);
1621 * Work through seeing if this is for us.
1622 * These checks are supposed to be in an order that means easy
1623 * things are checked first to speed up processing.... however
1624 * this means that some packets will manage to get a long way
1625 * down this stack and then be rejected, but that's life.
1627 if ((ic
->type
!= ICMP_DEST_UNREACH
) &&
1628 (ic
->type
!= ICMP_SOURCE_QUENCH
) &&
1629 (ic
->type
!= ICMP_TIME_EXCEEDED
)) {
1634 /* Now find the contained IP header */
1635 offset
+= sizeof(_icmph
);
1636 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
1638 return NF_ACCEPT
; /* The packet looks wrong, ignore */
1640 /* Special case for errors for IPIP packets */
1642 if (cih
->protocol
== IPPROTO_IPIP
) {
1643 if (unlikely(cih
->frag_off
& htons(IP_OFFSET
)))
1645 /* Error for our IPIP must arrive at LOCAL_IN */
1646 if (!(skb_rtable(skb
)->rt_flags
& RTCF_LOCAL
))
1648 offset
+= cih
->ihl
* 4;
1649 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
1651 return NF_ACCEPT
; /* The packet looks wrong, ignore */
1655 pd
= ip_vs_proto_data_get(ipvs
, cih
->protocol
);
1660 /* Is the embedded protocol header present? */
1661 if (unlikely(cih
->frag_off
& htons(IP_OFFSET
) &&
1665 IP_VS_DBG_PKT(11, AF_INET
, pp
, skb
, offset
,
1666 "Checking incoming ICMP for");
1669 ip_vs_fill_iph_skb_icmp(AF_INET
, skb
, offset
, !ipip
, &ciph
);
1672 /* The embedded headers contain source and dest in reverse order.
1673 * For IPIP this is error for request, not for reply.
1675 cp
= INDIRECT_CALL_1(pp
->conn_in_get
, ip_vs_conn_in_get_proto
,
1676 ipvs
, AF_INET
, skb
, &ciph
);
1681 if (ipip
|| !sysctl_schedule_icmp(ipvs
))
1684 if (!ip_vs_try_to_schedule(ipvs
, AF_INET
, skb
, pd
, &v
, &cp
, &ciph
))
1691 /* Ensure the checksum is correct */
1692 if (!skb_csum_unnecessary(skb
) && ip_vs_checksum_complete(skb
, ihl
)) {
1693 /* Failed checksum! */
1694 IP_VS_DBG(1, "Incoming ICMP: failed checksum from %pI4!\n",
1700 __be32 info
= ic
->un
.gateway
;
1701 __u8 type
= ic
->type
;
1702 __u8 code
= ic
->code
;
1704 /* Update the MTU */
1705 if (ic
->type
== ICMP_DEST_UNREACH
&&
1706 ic
->code
== ICMP_FRAG_NEEDED
) {
1707 struct ip_vs_dest
*dest
= cp
->dest
;
1708 u32 mtu
= ntohs(ic
->un
.frag
.mtu
);
1709 __be16 frag_off
= cih
->frag_off
;
1711 /* Strip outer IP and ICMP, go to IPIP header */
1712 if (pskb_pull(skb
, ihl
+ sizeof(_icmph
)) == NULL
)
1714 offset2
-= ihl
+ sizeof(_icmph
);
1715 skb_reset_network_header(skb
);
1716 IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
1717 &ip_hdr(skb
)->saddr
, &ip_hdr(skb
)->daddr
, mtu
);
1718 ipv4_update_pmtu(skb
, ipvs
->net
, mtu
, 0, 0);
1719 /* Client uses PMTUD? */
1720 if (!(frag_off
& htons(IP_DF
)))
1722 /* Prefer the resulting PMTU */
1724 struct ip_vs_dest_dst
*dest_dst
;
1726 dest_dst
= rcu_dereference(dest
->dest_dst
);
1728 mtu
= dst_mtu(dest_dst
->dst_cache
);
1730 if (mtu
> 68 + sizeof(struct iphdr
))
1731 mtu
-= sizeof(struct iphdr
);
1734 /* Strip outer IP, ICMP and IPIP, go to IP header of
1737 if (pskb_pull(skb
, offset2
) == NULL
)
1739 skb_reset_network_header(skb
);
1740 IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
1741 &ip_hdr(skb
)->saddr
, &ip_hdr(skb
)->daddr
,
1742 type
, code
, ntohl(info
));
1743 icmp_send(skb
, type
, code
, info
);
1744 /* ICMP can be shorter but anyways, account it */
1745 ip_vs_out_stats(cp
, skb
);
1749 verdict
= NF_STOLEN
;
1753 /* do the statistics and put it back */
1754 ip_vs_in_stats(cp
, skb
);
1755 if (IPPROTO_TCP
== cih
->protocol
|| IPPROTO_UDP
== cih
->protocol
||
1756 IPPROTO_SCTP
== cih
->protocol
)
1757 offset
+= 2 * sizeof(__u16
);
1758 verdict
= ip_vs_icmp_xmit(skb
, cp
, pp
, offset
, hooknum
, &ciph
);
1761 if (likely(!new_cp
))
1762 __ip_vs_conn_put(cp
);
1769 #ifdef CONFIG_IP_VS_IPV6
1770 static int ip_vs_in_icmp_v6(struct netns_ipvs
*ipvs
, struct sk_buff
*skb
,
1771 int *related
, unsigned int hooknum
,
1772 struct ip_vs_iphdr
*iph
)
1774 struct icmp6hdr _icmph
, *ic
;
1775 struct ip_vs_iphdr ciph
= {.flags
= 0, .fragoffs
= 0};/*Contained IP */
1776 struct ip_vs_conn
*cp
;
1777 struct ip_vs_protocol
*pp
;
1778 struct ip_vs_proto_data
*pd
;
1779 unsigned int offset
, verdict
;
1780 bool new_cp
= false;
1784 ic
= frag_safe_skb_hp(skb
, iph
->len
, sizeof(_icmph
), &_icmph
);
1789 * Work through seeing if this is for us.
1790 * These checks are supposed to be in an order that means easy
1791 * things are checked first to speed up processing.... however
1792 * this means that some packets will manage to get a long way
1793 * down this stack and then be rejected, but that's life.
1795 if (ic
->icmp6_type
& ICMPV6_INFOMSG_MASK
) {
1799 /* Fragment header that is before ICMP header tells us that:
1800 * it's not an error message since they can't be fragmented.
1802 if (iph
->flags
& IP6_FH_F_FRAG
)
1805 IP_VS_DBG(8, "Incoming ICMPv6 (%d,%d) %pI6c->%pI6c\n",
1806 ic
->icmp6_type
, ntohs(icmpv6_id(ic
)),
1807 &iph
->saddr
, &iph
->daddr
);
1809 offset
= iph
->len
+ sizeof(_icmph
);
1810 if (!ip_vs_fill_iph_skb_icmp(AF_INET6
, skb
, offset
, true, &ciph
))
1813 pd
= ip_vs_proto_data_get(ipvs
, ciph
.protocol
);
1818 /* Cannot handle fragmented embedded protocol */
1822 IP_VS_DBG_PKT(11, AF_INET6
, pp
, skb
, offset
,
1823 "Checking incoming ICMPv6 for");
1825 /* The embedded headers contain source and dest in reverse order
1826 * if not from localhost
1828 cp
= INDIRECT_CALL_1(pp
->conn_in_get
, ip_vs_conn_in_get_proto
,
1829 ipvs
, AF_INET6
, skb
, &ciph
);
1834 if (!sysctl_schedule_icmp(ipvs
))
1837 if (!ip_vs_try_to_schedule(ipvs
, AF_INET6
, skb
, pd
, &v
, &cp
, &ciph
))
1843 /* VS/TUN, VS/DR and LOCALNODE just let it go */
1844 if ((hooknum
== NF_INET_LOCAL_OUT
) &&
1845 (IP_VS_FWD_METHOD(cp
) != IP_VS_CONN_F_MASQ
)) {
1846 verdict
= NF_ACCEPT
;
1850 /* do the statistics and put it back */
1851 ip_vs_in_stats(cp
, skb
);
1853 /* Need to mangle contained IPv6 header in ICMPv6 packet */
1855 if (IPPROTO_TCP
== ciph
.protocol
|| IPPROTO_UDP
== ciph
.protocol
||
1856 IPPROTO_SCTP
== ciph
.protocol
)
1857 offset
+= 2 * sizeof(__u16
); /* Also mangle ports */
1859 verdict
= ip_vs_icmp_xmit_v6(skb
, cp
, pp
, offset
, hooknum
, &ciph
);
1862 if (likely(!new_cp
))
1863 __ip_vs_conn_put(cp
);
1873 * Check if it's for virtual services, look it up,
1874 * and send it on its way...
1877 ip_vs_in(struct netns_ipvs
*ipvs
, unsigned int hooknum
, struct sk_buff
*skb
, int af
)
1879 struct ip_vs_iphdr iph
;
1880 struct ip_vs_protocol
*pp
;
1881 struct ip_vs_proto_data
*pd
;
1882 struct ip_vs_conn
*cp
;
1884 int conn_reuse_mode
;
1887 /* Already marked as IPVS request or reply? */
1888 if (skb
->ipvs_property
)
1893 * - remote client: only PACKET_HOST
1894 * - route: used for struct net when skb->dev is unset
1896 if (unlikely((skb
->pkt_type
!= PACKET_HOST
&&
1897 hooknum
!= NF_INET_LOCAL_OUT
) ||
1899 ip_vs_fill_iph_skb(af
, skb
, false, &iph
);
1900 IP_VS_DBG_BUF(12, "packet type=%d proto=%d daddr=%s"
1901 " ignored in hook %u\n",
1902 skb
->pkt_type
, iph
.protocol
,
1903 IP_VS_DBG_ADDR(af
, &iph
.daddr
), hooknum
);
1906 /* ipvs enabled in this netns ? */
1907 if (unlikely(sysctl_backup_only(ipvs
) || !ipvs
->enable
))
1910 ip_vs_fill_iph_skb(af
, skb
, false, &iph
);
1912 /* Bad... Do not break raw sockets */
1913 sk
= skb_to_full_sk(skb
);
1914 if (unlikely(sk
&& hooknum
== NF_INET_LOCAL_OUT
&&
1917 if (sk
->sk_family
== PF_INET
&& inet_sk(sk
)->nodefrag
)
1921 #ifdef CONFIG_IP_VS_IPV6
1922 if (af
== AF_INET6
) {
1923 if (unlikely(iph
.protocol
== IPPROTO_ICMPV6
)) {
1925 int verdict
= ip_vs_in_icmp_v6(ipvs
, skb
, &related
,
1933 if (unlikely(iph
.protocol
== IPPROTO_ICMP
)) {
1935 int verdict
= ip_vs_in_icmp(ipvs
, skb
, &related
,
1942 /* Protocol supported? */
1943 pd
= ip_vs_proto_data_get(ipvs
, iph
.protocol
);
1944 if (unlikely(!pd
)) {
1945 /* The only way we'll see this packet again is if it's
1946 * encapsulated, so mark it with ipvs_property=1 so we
1947 * skip it if we're ignoring tunneled packets
1949 if (sysctl_ignore_tunneled(ipvs
))
1950 skb
->ipvs_property
= 1;
1956 * Check if the packet belongs to an existing connection entry
1958 cp
= INDIRECT_CALL_1(pp
->conn_in_get
, ip_vs_conn_in_get_proto
,
1959 ipvs
, af
, skb
, &iph
);
1961 conn_reuse_mode
= sysctl_conn_reuse_mode(ipvs
);
1962 if (conn_reuse_mode
&& !iph
.fragoffs
&& is_new_conn(skb
, &iph
) && cp
) {
1963 bool uses_ct
= false, resched
= false;
1965 if (unlikely(sysctl_expire_nodest_conn(ipvs
)) && cp
->dest
&&
1966 unlikely(!atomic_read(&cp
->dest
->weight
))) {
1968 uses_ct
= ip_vs_conn_uses_conntrack(cp
, skb
);
1969 } else if (is_new_conn_expected(cp
, conn_reuse_mode
)) {
1970 uses_ct
= ip_vs_conn_uses_conntrack(cp
, skb
);
1971 if (!atomic_read(&cp
->n_control
)) {
1974 /* Do not reschedule controlling connection
1975 * that uses conntrack while it is still
1976 * referenced by controlled connection(s).
1983 if (!atomic_read(&cp
->n_control
))
1984 ip_vs_conn_expire_now(cp
);
1985 __ip_vs_conn_put(cp
);
1992 if (unlikely(!cp
)) {
1995 if (!ip_vs_try_to_schedule(ipvs
, af
, skb
, pd
, &v
, &cp
, &iph
))
1999 IP_VS_DBG_PKT(11, af
, pp
, skb
, iph
.off
, "Incoming packet");
2001 /* Check the server status */
2002 if (cp
->dest
&& !(cp
->dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
2003 /* the destination server is not available */
2005 __u32 flags
= cp
->flags
;
2007 /* when timer already started, silently drop the packet.*/
2008 if (timer_pending(&cp
->timer
))
2009 __ip_vs_conn_put(cp
);
2013 if (sysctl_expire_nodest_conn(ipvs
) &&
2014 !(flags
& IP_VS_CONN_F_ONE_PACKET
)) {
2015 /* try to expire the connection immediately */
2016 ip_vs_conn_expire_now(cp
);
2022 ip_vs_in_stats(cp
, skb
);
2023 ip_vs_set_state(cp
, IP_VS_DIR_INPUT
, skb
, pd
);
2024 if (cp
->packet_xmit
)
2025 ret
= cp
->packet_xmit(skb
, cp
, pp
, &iph
);
2026 /* do not touch skb anymore */
2028 IP_VS_DBG_RL("warning: packet_xmit is null");
2032 /* Increase its packet counter and check if it is needed
2033 * to be synchronized
2035 * Sync connection if it is about to close to
2036 * encorage the standby servers to update the connections timeout
2038 * For ONE_PKT let ip_vs_sync_conn() do the filter work.
2041 if (cp
->flags
& IP_VS_CONN_F_ONE_PACKET
)
2042 pkts
= sysctl_sync_threshold(ipvs
);
2044 pkts
= atomic_add_return(1, &cp
->in_pkts
);
2046 if (ipvs
->sync_state
& IP_VS_STATE_MASTER
)
2047 ip_vs_sync_conn(ipvs
, cp
, pkts
);
2048 else if ((cp
->flags
& IP_VS_CONN_F_ONE_PACKET
) && cp
->control
)
2049 /* increment is done inside ip_vs_sync_conn too */
2050 atomic_inc(&cp
->control
->in_pkts
);
2057 * AF_INET handler in NF_INET_LOCAL_IN chain
2058 * Schedule and forward packets from remote clients
2061 ip_vs_remote_request4(void *priv
, struct sk_buff
*skb
,
2062 const struct nf_hook_state
*state
)
2064 return ip_vs_in(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET
);
2068 * AF_INET handler in NF_INET_LOCAL_OUT chain
2069 * Schedule and forward packets from local clients
2072 ip_vs_local_request4(void *priv
, struct sk_buff
*skb
,
2073 const struct nf_hook_state
*state
)
2075 return ip_vs_in(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET
);
2078 #ifdef CONFIG_IP_VS_IPV6
2081 * AF_INET6 handler in NF_INET_LOCAL_IN chain
2082 * Schedule and forward packets from remote clients
2085 ip_vs_remote_request6(void *priv
, struct sk_buff
*skb
,
2086 const struct nf_hook_state
*state
)
2088 return ip_vs_in(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET6
);
2092 * AF_INET6 handler in NF_INET_LOCAL_OUT chain
2093 * Schedule and forward packets from local clients
2096 ip_vs_local_request6(void *priv
, struct sk_buff
*skb
,
2097 const struct nf_hook_state
*state
)
2099 return ip_vs_in(net_ipvs(state
->net
), state
->hook
, skb
, AF_INET6
);
2106 * It is hooked at the NF_INET_FORWARD chain, in order to catch ICMP
2107 * related packets destined for 0.0.0.0/0.
2108 * When fwmark-based virtual service is used, such as transparent
2109 * cache cluster, TCP packets can be marked and routed to ip_vs_in,
2110 * but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
2111 * sent to ip_vs_in_icmp. So, catch them at the NF_INET_FORWARD chain
2112 * and send them to ip_vs_in_icmp.
2115 ip_vs_forward_icmp(void *priv
, struct sk_buff
*skb
,
2116 const struct nf_hook_state
*state
)
2119 struct netns_ipvs
*ipvs
= net_ipvs(state
->net
);
2121 if (ip_hdr(skb
)->protocol
!= IPPROTO_ICMP
)
2124 /* ipvs enabled in this netns ? */
2125 if (unlikely(sysctl_backup_only(ipvs
) || !ipvs
->enable
))
2128 return ip_vs_in_icmp(ipvs
, skb
, &r
, state
->hook
);
2131 #ifdef CONFIG_IP_VS_IPV6
2133 ip_vs_forward_icmp_v6(void *priv
, struct sk_buff
*skb
,
2134 const struct nf_hook_state
*state
)
2137 struct netns_ipvs
*ipvs
= net_ipvs(state
->net
);
2138 struct ip_vs_iphdr iphdr
;
2140 ip_vs_fill_iph_skb(AF_INET6
, skb
, false, &iphdr
);
2141 if (iphdr
.protocol
!= IPPROTO_ICMPV6
)
2144 /* ipvs enabled in this netns ? */
2145 if (unlikely(sysctl_backup_only(ipvs
) || !ipvs
->enable
))
2148 return ip_vs_in_icmp_v6(ipvs
, skb
, &r
, state
->hook
, &iphdr
);
2153 static const struct nf_hook_ops ip_vs_ops
[] = {
2154 /* After packet filtering, change source only for VS/NAT */
2156 .hook
= ip_vs_reply4
,
2158 .hooknum
= NF_INET_LOCAL_IN
,
2159 .priority
= NF_IP_PRI_NAT_SRC
- 2,
2161 /* After packet filtering, forward packet through VS/DR, VS/TUN,
2162 * or VS/NAT(change destination), so that filtering rules can be
2163 * applied to IPVS. */
2165 .hook
= ip_vs_remote_request4
,
2167 .hooknum
= NF_INET_LOCAL_IN
,
2168 .priority
= NF_IP_PRI_NAT_SRC
- 1,
2170 /* Before ip_vs_in, change source only for VS/NAT */
2172 .hook
= ip_vs_local_reply4
,
2174 .hooknum
= NF_INET_LOCAL_OUT
,
2175 .priority
= NF_IP_PRI_NAT_DST
+ 1,
2177 /* After mangle, schedule and forward local requests */
2179 .hook
= ip_vs_local_request4
,
2181 .hooknum
= NF_INET_LOCAL_OUT
,
2182 .priority
= NF_IP_PRI_NAT_DST
+ 2,
2184 /* After packet filtering (but before ip_vs_out_icmp), catch icmp
2185 * destined for 0.0.0.0/0, which is for incoming IPVS connections */
2187 .hook
= ip_vs_forward_icmp
,
2189 .hooknum
= NF_INET_FORWARD
,
2192 /* After packet filtering, change source only for VS/NAT */
2194 .hook
= ip_vs_reply4
,
2196 .hooknum
= NF_INET_FORWARD
,
2199 #ifdef CONFIG_IP_VS_IPV6
2200 /* After packet filtering, change source only for VS/NAT */
2202 .hook
= ip_vs_reply6
,
2204 .hooknum
= NF_INET_LOCAL_IN
,
2205 .priority
= NF_IP6_PRI_NAT_SRC
- 2,
2207 /* After packet filtering, forward packet through VS/DR, VS/TUN,
2208 * or VS/NAT(change destination), so that filtering rules can be
2209 * applied to IPVS. */
2211 .hook
= ip_vs_remote_request6
,
2213 .hooknum
= NF_INET_LOCAL_IN
,
2214 .priority
= NF_IP6_PRI_NAT_SRC
- 1,
2216 /* Before ip_vs_in, change source only for VS/NAT */
2218 .hook
= ip_vs_local_reply6
,
2220 .hooknum
= NF_INET_LOCAL_OUT
,
2221 .priority
= NF_IP6_PRI_NAT_DST
+ 1,
2223 /* After mangle, schedule and forward local requests */
2225 .hook
= ip_vs_local_request6
,
2227 .hooknum
= NF_INET_LOCAL_OUT
,
2228 .priority
= NF_IP6_PRI_NAT_DST
+ 2,
2230 /* After packet filtering (but before ip_vs_out_icmp), catch icmp
2231 * destined for 0.0.0.0/0, which is for incoming IPVS connections */
2233 .hook
= ip_vs_forward_icmp_v6
,
2235 .hooknum
= NF_INET_FORWARD
,
2238 /* After packet filtering, change source only for VS/NAT */
2240 .hook
= ip_vs_reply6
,
2242 .hooknum
= NF_INET_FORWARD
,
2248 * Initialize IP Virtual Server netns mem.
2250 static int __net_init
__ip_vs_init(struct net
*net
)
2252 struct netns_ipvs
*ipvs
;
2255 ipvs
= net_generic(net
, ip_vs_net_id
);
2259 /* Hold the beast until a service is registerd */
2262 /* Counters used for creating unique names */
2263 ipvs
->gen
= atomic_read(&ipvs_netns_cnt
);
2264 atomic_inc(&ipvs_netns_cnt
);
2267 if (ip_vs_estimator_net_init(ipvs
) < 0)
2268 goto estimator_fail
;
2270 if (ip_vs_control_net_init(ipvs
) < 0)
2273 if (ip_vs_protocol_net_init(ipvs
) < 0)
2276 if (ip_vs_app_net_init(ipvs
) < 0)
2279 if (ip_vs_conn_net_init(ipvs
) < 0)
2282 if (ip_vs_sync_net_init(ipvs
) < 0)
2285 ret
= nf_register_net_hooks(net
, ip_vs_ops
, ARRAY_SIZE(ip_vs_ops
));
2295 ip_vs_sync_net_cleanup(ipvs
);
2297 ip_vs_conn_net_cleanup(ipvs
);
2299 ip_vs_app_net_cleanup(ipvs
);
2301 ip_vs_protocol_net_cleanup(ipvs
);
2303 ip_vs_control_net_cleanup(ipvs
);
2305 ip_vs_estimator_net_cleanup(ipvs
);
2311 static void __net_exit
__ip_vs_cleanup(struct net
*net
)
2313 struct netns_ipvs
*ipvs
= net_ipvs(net
);
2315 nf_unregister_net_hooks(net
, ip_vs_ops
, ARRAY_SIZE(ip_vs_ops
));
2316 ip_vs_service_net_cleanup(ipvs
); /* ip_vs_flush() with locks */
2317 ip_vs_conn_net_cleanup(ipvs
);
2318 ip_vs_app_net_cleanup(ipvs
);
2319 ip_vs_protocol_net_cleanup(ipvs
);
2320 ip_vs_control_net_cleanup(ipvs
);
2321 ip_vs_estimator_net_cleanup(ipvs
);
2322 IP_VS_DBG(2, "ipvs netns %d released\n", ipvs
->gen
);
2326 static void __net_exit
__ip_vs_dev_cleanup(struct net
*net
)
2328 struct netns_ipvs
*ipvs
= net_ipvs(net
);
2330 ipvs
->enable
= 0; /* Disable packet reception */
2332 ip_vs_sync_net_cleanup(ipvs
);
2336 static struct pernet_operations ipvs_core_ops
= {
2337 .init
= __ip_vs_init
,
2338 .exit
= __ip_vs_cleanup
,
2339 .id
= &ip_vs_net_id
,
2340 .size
= sizeof(struct netns_ipvs
),
2343 static struct pernet_operations ipvs_core_dev_ops
= {
2344 .exit
= __ip_vs_dev_cleanup
,
2348 * Initialize IP Virtual Server
2350 static int __init
ip_vs_init(void)
2354 ret
= ip_vs_control_init();
2356 pr_err("can't setup control.\n");
2360 ip_vs_protocol_init();
2362 ret
= ip_vs_conn_init();
2364 pr_err("can't setup connection table.\n");
2365 goto cleanup_protocol
;
2368 ret
= register_pernet_subsys(&ipvs_core_ops
); /* Alloc ip_vs struct */
2372 ret
= register_pernet_device(&ipvs_core_dev_ops
);
2376 ret
= ip_vs_register_nl_ioctl();
2378 pr_err("can't register netlink/ioctl.\n");
2382 pr_info("ipvs loaded.\n");
2387 unregister_pernet_device(&ipvs_core_dev_ops
);
2389 unregister_pernet_subsys(&ipvs_core_ops
);
2391 ip_vs_conn_cleanup();
2393 ip_vs_protocol_cleanup();
2394 ip_vs_control_cleanup();
2399 static void __exit
ip_vs_cleanup(void)
2401 ip_vs_unregister_nl_ioctl();
2402 unregister_pernet_device(&ipvs_core_dev_ops
);
2403 unregister_pernet_subsys(&ipvs_core_ops
); /* free ip_vs struct */
2404 ip_vs_conn_cleanup();
2405 ip_vs_protocol_cleanup();
2406 ip_vs_control_cleanup();
2407 pr_info("ipvs unloaded.\n");
2410 module_init(ip_vs_init
);
2411 module_exit(ip_vs_cleanup
);
2412 MODULE_LICENSE("GPL");