2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the Netfilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
8 * Version: $Id: ip_vs_core.c,v 1.34 2003/05/10 03:05:23 wensong Exp $
10 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
11 * Peter Kese <peter.kese@ijs.si>
12 * Julian Anastasov <ja@ssi.bg>
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version
17 * 2 of the License, or (at your option) any later version.
19 * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
20 * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
24 * Paul `Rusty' Russell properly handle non-linear skbs
28 #include <linux/module.h>
29 #include <linux/kernel.h>
31 #include <linux/tcp.h>
32 #include <linux/icmp.h>
37 #include <net/icmp.h> /* for icmp_send */
38 #include <net/route.h>
40 #include <linux/netfilter.h>
41 #include <linux/netfilter_ipv4.h>
43 #include <net/ip_vs.h>
46 EXPORT_SYMBOL(register_ip_vs_scheduler
);
47 EXPORT_SYMBOL(unregister_ip_vs_scheduler
);
48 EXPORT_SYMBOL(ip_vs_skb_replace
);
49 EXPORT_SYMBOL(ip_vs_proto_name
);
50 EXPORT_SYMBOL(ip_vs_conn_new
);
51 EXPORT_SYMBOL(ip_vs_conn_in_get
);
52 EXPORT_SYMBOL(ip_vs_conn_out_get
);
53 #ifdef CONFIG_IP_VS_PROTO_TCP
54 EXPORT_SYMBOL(ip_vs_tcp_conn_listen
);
56 EXPORT_SYMBOL(ip_vs_conn_put
);
57 #ifdef CONFIG_IP_VS_DEBUG
58 EXPORT_SYMBOL(ip_vs_get_debug_level
);
60 EXPORT_SYMBOL(check_for_ip_vs_out
);
61 EXPORT_SYMBOL(ip_vs_make_skb_writable
);
64 /* ID used in ICMP lookups */
65 #define icmp_id(icmph) (((icmph)->un).echo.id)
67 const char *ip_vs_proto_name(unsigned proto
)
81 sprintf(buf
, "IP_%d", proto
);
86 void ip_vs_init_hash_table(struct list_head
*table
, int rows
)
89 INIT_LIST_HEAD(&table
[rows
]);
93 ip_vs_in_stats(struct ip_vs_conn
*cp
, struct sk_buff
*skb
)
95 struct ip_vs_dest
*dest
= cp
->dest
;
96 if (dest
&& (dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
97 spin_lock(&dest
->stats
.lock
);
99 dest
->stats
.inbytes
+= skb
->len
;
100 spin_unlock(&dest
->stats
.lock
);
102 spin_lock(&dest
->svc
->stats
.lock
);
103 dest
->svc
->stats
.inpkts
++;
104 dest
->svc
->stats
.inbytes
+= skb
->len
;
105 spin_unlock(&dest
->svc
->stats
.lock
);
107 spin_lock(&ip_vs_stats
.lock
);
108 ip_vs_stats
.inpkts
++;
109 ip_vs_stats
.inbytes
+= skb
->len
;
110 spin_unlock(&ip_vs_stats
.lock
);
116 ip_vs_out_stats(struct ip_vs_conn
*cp
, struct sk_buff
*skb
)
118 struct ip_vs_dest
*dest
= cp
->dest
;
119 if (dest
&& (dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
120 spin_lock(&dest
->stats
.lock
);
121 dest
->stats
.outpkts
++;
122 dest
->stats
.outbytes
+= skb
->len
;
123 spin_unlock(&dest
->stats
.lock
);
125 spin_lock(&dest
->svc
->stats
.lock
);
126 dest
->svc
->stats
.outpkts
++;
127 dest
->svc
->stats
.outbytes
+= skb
->len
;
128 spin_unlock(&dest
->svc
->stats
.lock
);
130 spin_lock(&ip_vs_stats
.lock
);
131 ip_vs_stats
.outpkts
++;
132 ip_vs_stats
.outbytes
+= skb
->len
;
133 spin_unlock(&ip_vs_stats
.lock
);
139 ip_vs_conn_stats(struct ip_vs_conn
*cp
, struct ip_vs_service
*svc
)
141 spin_lock(&cp
->dest
->stats
.lock
);
142 cp
->dest
->stats
.conns
++;
143 spin_unlock(&cp
->dest
->stats
.lock
);
145 spin_lock(&svc
->stats
.lock
);
147 spin_unlock(&svc
->stats
.lock
);
149 spin_lock(&ip_vs_stats
.lock
);
151 spin_unlock(&ip_vs_stats
.lock
);
156 ip_vs_set_state(struct ip_vs_conn
*cp
, int direction
,
157 const struct sk_buff
*skb
,
158 struct ip_vs_protocol
*pp
)
160 if (unlikely(!pp
->state_transition
))
162 return pp
->state_transition(cp
, direction
, skb
, pp
);
166 int ip_vs_make_skb_writable(struct sk_buff
**pskb
, int writable_len
)
168 struct sk_buff
*skb
= *pskb
;
170 /* skb is already used, better copy skb and its payload */
171 if (unlikely(skb_shared(skb
) || skb
->sk
))
174 /* skb data is already used, copy it */
175 if (unlikely(skb_cloned(skb
)))
178 return pskb_may_pull(skb
, writable_len
);
181 if (unlikely(writable_len
> skb
->len
))
183 return !pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
);
186 if (unlikely(writable_len
> skb
->len
))
188 skb
= skb_copy(skb
, GFP_ATOMIC
);
191 BUG_ON(skb_is_nonlinear(skb
));
193 /* Rest of kernel will get very unhappy if we pass it a
194 suddenly-orphaned skbuff */
196 skb_set_owner_w(skb
, (*pskb
)->sk
);
203 * IPVS persistent scheduling function
204 * It creates a connection entry according to its template if exists,
205 * or selects a server and creates a connection entry plus a template.
206 * Locking: we are svc user (svc->refcnt), so we hold all dests too
207 * Protocols supported: TCP, UDP
209 static struct ip_vs_conn
*
210 ip_vs_sched_persist(struct ip_vs_service
*svc
,
211 const struct sk_buff
*skb
,
214 struct ip_vs_conn
*cp
= NULL
;
215 struct iphdr
*iph
= skb
->nh
.iph
;
216 struct ip_vs_dest
*dest
;
217 struct ip_vs_conn
*ct
;
218 __u16 dport
; /* destination port to forward */
219 __u32 snet
; /* source network of the client, after masking */
221 /* Mask saddr with the netmask to adjust template granularity */
222 snet
= iph
->saddr
& svc
->netmask
;
224 IP_VS_DBG(6, "p-schedule: src %u.%u.%u.%u:%u dest %u.%u.%u.%u:%u "
225 "mnet %u.%u.%u.%u\n",
226 NIPQUAD(iph
->saddr
), ntohs(ports
[0]),
227 NIPQUAD(iph
->daddr
), ntohs(ports
[1]),
231 * As far as we know, FTP is a very complicated network protocol, and
232 * it uses control connection and data connections. For active FTP,
233 * FTP server initialize data connection to the client, its source port
234 * is often 20. For passive FTP, FTP server tells the clients the port
235 * that it passively listens to, and the client issues the data
236 * connection. In the tunneling or direct routing mode, the load
237 * balancer is on the client-to-server half of connection, the port
238 * number is unknown to the load balancer. So, a conn template like
239 * <caddr, 0, vaddr, 0, daddr, 0> is created for persistent FTP
240 * service, and a template like <caddr, 0, vaddr, vport, daddr, dport>
241 * is created for other persistent services.
243 if (ports
[1] == svc
->port
) {
244 /* Check if a template already exists */
245 if (svc
->port
!= FTPPORT
)
246 ct
= ip_vs_conn_in_get(iph
->protocol
, snet
, 0,
247 iph
->daddr
, ports
[1]);
249 ct
= ip_vs_conn_in_get(iph
->protocol
, snet
, 0,
252 if (!ct
|| !ip_vs_check_template(ct
)) {
254 * No template found or the dest of the connection
255 * template is not available.
257 dest
= svc
->scheduler
->schedule(svc
, skb
);
259 IP_VS_DBG(1, "p-schedule: no dest found.\n");
264 * Create a template like <protocol,caddr,0,
265 * vaddr,vport,daddr,dport> for non-ftp service,
266 * and <protocol,caddr,0,vaddr,0,daddr,0>
269 if (svc
->port
!= FTPPORT
)
270 ct
= ip_vs_conn_new(iph
->protocol
,
274 dest
->addr
, dest
->port
,
278 ct
= ip_vs_conn_new(iph
->protocol
,
287 ct
->timeout
= svc
->timeout
;
289 /* set destination with the found template */
295 * Note: persistent fwmark-based services and persistent
296 * port zero service are handled here.
297 * fwmark template: <IPPROTO_IP,caddr,0,fwmark,0,daddr,0>
298 * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
301 ct
= ip_vs_conn_in_get(IPPROTO_IP
, snet
, 0,
302 htonl(svc
->fwmark
), 0);
304 ct
= ip_vs_conn_in_get(iph
->protocol
, snet
, 0,
307 if (!ct
|| !ip_vs_check_template(ct
)) {
309 * If it is not persistent port zero, return NULL,
310 * otherwise create a connection template.
315 dest
= svc
->scheduler
->schedule(svc
, skb
);
317 IP_VS_DBG(1, "p-schedule: no dest found.\n");
322 * Create a template according to the service
325 ct
= ip_vs_conn_new(IPPROTO_IP
,
327 htonl(svc
->fwmark
), 0,
332 ct
= ip_vs_conn_new(iph
->protocol
,
341 ct
->timeout
= svc
->timeout
;
343 /* set destination with the found template */
350 * Create a new connection according to the template
352 cp
= ip_vs_conn_new(iph
->protocol
,
353 iph
->saddr
, ports
[0],
354 iph
->daddr
, ports
[1],
366 ip_vs_control_add(cp
, ct
);
369 ip_vs_conn_stats(cp
, svc
);
375 * IPVS main scheduling function
376 * It selects a server according to the virtual service, and
377 * creates a connection entry.
378 * Protocols supported: TCP, UDP
381 ip_vs_schedule(struct ip_vs_service
*svc
, const struct sk_buff
*skb
)
383 struct ip_vs_conn
*cp
= NULL
;
384 struct iphdr
*iph
= skb
->nh
.iph
;
385 struct ip_vs_dest
*dest
;
386 __u16 _ports
[2], *pptr
;
388 pptr
= skb_header_pointer(skb
, iph
->ihl
*4,
389 sizeof(_ports
), _ports
);
396 if (svc
->flags
& IP_VS_SVC_F_PERSISTENT
)
397 return ip_vs_sched_persist(svc
, skb
, pptr
);
400 * Non-persistent service
402 if (!svc
->fwmark
&& pptr
[1] != svc
->port
) {
404 IP_VS_ERR("Schedule: port zero only supported "
405 "in persistent services, "
406 "check your ipvs configuration\n");
410 dest
= svc
->scheduler
->schedule(svc
, skb
);
412 IP_VS_DBG(1, "Schedule: no dest found.\n");
417 * Create a connection entry.
419 cp
= ip_vs_conn_new(iph
->protocol
,
422 dest
->addr
, dest
->port
?dest
->port
:pptr
[1],
428 IP_VS_DBG(6, "Schedule fwd:%c c:%u.%u.%u.%u:%u v:%u.%u.%u.%u:%u "
429 "d:%u.%u.%u.%u:%u flg:%X cnt:%d\n",
431 NIPQUAD(cp
->caddr
), ntohs(cp
->cport
),
432 NIPQUAD(cp
->vaddr
), ntohs(cp
->vport
),
433 NIPQUAD(cp
->daddr
), ntohs(cp
->dport
),
434 cp
->flags
, atomic_read(&cp
->refcnt
));
436 ip_vs_conn_stats(cp
, svc
);
442 * Pass or drop the packet.
443 * Called by ip_vs_in, when the virtual service is available but
444 * no destination is available for a new connection.
446 int ip_vs_leave(struct ip_vs_service
*svc
, struct sk_buff
*skb
,
447 struct ip_vs_protocol
*pp
)
449 __u16 _ports
[2], *pptr
;
450 struct iphdr
*iph
= skb
->nh
.iph
;
452 pptr
= skb_header_pointer(skb
, iph
->ihl
*4,
453 sizeof(_ports
), _ports
);
455 ip_vs_service_put(svc
);
459 /* if it is fwmark-based service, the cache_bypass sysctl is up
460 and the destination is RTN_UNICAST (and not local), then create
461 a cache_bypass connection entry */
462 if (sysctl_ip_vs_cache_bypass
&& svc
->fwmark
463 && (inet_addr_type(iph
->daddr
) == RTN_UNICAST
)) {
465 struct ip_vs_conn
*cp
;
467 ip_vs_service_put(svc
);
469 /* create a new connection entry */
470 IP_VS_DBG(6, "ip_vs_leave: create a cache_bypass entry\n");
471 cp
= ip_vs_conn_new(iph
->protocol
,
481 ip_vs_in_stats(cp
, skb
);
484 cs
= ip_vs_set_state(cp
, IP_VS_DIR_INPUT
, skb
, pp
);
486 /* transmit the first SYN packet */
487 ret
= cp
->packet_xmit(skb
, cp
, pp
);
488 /* do not touch skb anymore */
490 atomic_inc(&cp
->in_pkts
);
496 * When the virtual ftp service is presented, packets destined
497 * for other services on the VIP may get here (except services
498 * listed in the ipvs table), pass the packets, because it is
499 * not ipvs job to decide to drop the packets.
501 if ((svc
->port
== FTPPORT
) && (pptr
[1] != FTPPORT
)) {
502 ip_vs_service_put(svc
);
506 ip_vs_service_put(svc
);
509 * Notify the client that the destination is unreachable, and
510 * release the socket buffer.
511 * Since it is in IP layer, the TCP socket is not actually
512 * created, the TCP RST packet cannot be sent, instead that
513 * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ
515 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_PORT_UNREACH
, 0);
521 * It is hooked before NF_IP_PRI_NAT_SRC at the NF_IP_POST_ROUTING
522 * chain, and is used for VS/NAT.
523 * It detects packets for VS/NAT connections and sends the packets
524 * immediately. This can avoid that iptable_nat mangles the packets
527 static unsigned int ip_vs_post_routing(unsigned int hooknum
,
528 struct sk_buff
**pskb
,
529 const struct net_device
*in
,
530 const struct net_device
*out
,
531 int (*okfn
)(struct sk_buff
*))
533 if (!((*pskb
)->nfcache
& NFC_IPVS_PROPERTY
))
536 /* The packet was sent from IPVS, exit this chain */
542 u16
ip_vs_checksum_complete(struct sk_buff
*skb
, int offset
)
544 return (u16
) csum_fold(skb_checksum(skb
, offset
, skb
->len
- offset
, 0));
547 static inline struct sk_buff
*
548 ip_vs_gather_frags(struct sk_buff
*skb
)
550 skb
= ip_defrag(skb
);
552 ip_send_check(skb
->nh
.iph
);
557 * Packet has been made sufficiently writable in caller
558 * - inout: 1=in->out, 0=out->in
560 void ip_vs_nat_icmp(struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
561 struct ip_vs_conn
*cp
, int inout
)
563 struct iphdr
*iph
= skb
->nh
.iph
;
564 unsigned int icmp_offset
= iph
->ihl
*4;
565 struct icmphdr
*icmph
= (struct icmphdr
*)(skb
->nh
.raw
+ icmp_offset
);
566 struct iphdr
*ciph
= (struct iphdr
*)(icmph
+ 1);
569 iph
->saddr
= cp
->vaddr
;
571 ciph
->daddr
= cp
->vaddr
;
574 iph
->daddr
= cp
->daddr
;
576 ciph
->saddr
= cp
->daddr
;
580 /* the TCP/UDP port */
581 if (IPPROTO_TCP
== ciph
->protocol
|| IPPROTO_UDP
== ciph
->protocol
) {
582 __u16
*ports
= (void *)ciph
+ ciph
->ihl
*4;
585 ports
[1] = cp
->vport
;
587 ports
[0] = cp
->dport
;
590 /* And finally the ICMP checksum */
592 icmph
->checksum
= ip_vs_checksum_complete(skb
, icmp_offset
);
593 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
596 IP_VS_DBG_PKT(11, pp
, skb
, (void *)ciph
- (void *)iph
,
597 "Forwarding altered outgoing ICMP");
599 IP_VS_DBG_PKT(11, pp
, skb
, (void *)ciph
- (void *)iph
,
600 "Forwarding altered incoming ICMP");
604 * Handle ICMP messages in the inside-to-outside direction (outgoing).
605 * Find any that might be relevant, check against existing connections,
606 * forward to the right destination host if relevant.
607 * Currently handles error types - unreachable, quench, ttl exceeded.
608 * (Only used in VS/NAT)
610 static int ip_vs_out_icmp(struct sk_buff
**pskb
, int *related
)
612 struct sk_buff
*skb
= *pskb
;
614 struct icmphdr _icmph
, *ic
;
615 struct iphdr _ciph
, *cih
; /* The ip header contained within the ICMP */
616 struct ip_vs_conn
*cp
;
617 struct ip_vs_protocol
*pp
;
618 unsigned int offset
, ihl
, verdict
;
622 /* reassemble IP fragments */
623 if (skb
->nh
.iph
->frag_off
& __constant_htons(IP_MF
|IP_OFFSET
)) {
624 skb
= ip_vs_gather_frags(skb
);
631 offset
= ihl
= iph
->ihl
* 4;
632 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
636 IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
637 ic
->type
, ntohs(icmp_id(ic
)),
638 NIPQUAD(iph
->saddr
), NIPQUAD(iph
->daddr
));
641 * Work through seeing if this is for us.
642 * These checks are supposed to be in an order that means easy
643 * things are checked first to speed up processing.... however
644 * this means that some packets will manage to get a long way
645 * down this stack and then be rejected, but that's life.
647 if ((ic
->type
!= ICMP_DEST_UNREACH
) &&
648 (ic
->type
!= ICMP_SOURCE_QUENCH
) &&
649 (ic
->type
!= ICMP_TIME_EXCEEDED
)) {
654 /* Now find the contained IP header */
655 offset
+= sizeof(_icmph
);
656 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
658 return NF_ACCEPT
; /* The packet looks wrong, ignore */
660 pp
= ip_vs_proto_get(cih
->protocol
);
664 /* Is the embedded protocol header present? */
665 if (unlikely(cih
->frag_off
& __constant_htons(IP_OFFSET
) &&
669 IP_VS_DBG_PKT(11, pp
, skb
, offset
, "Checking outgoing ICMP for");
671 offset
+= cih
->ihl
* 4;
673 /* The embedded headers contain source and dest in reverse order */
674 cp
= pp
->conn_out_get(skb
, pp
, cih
, offset
, 1);
680 if (IP_VS_FWD_METHOD(cp
) != 0) {
681 IP_VS_ERR("shouldn't reach here, because the box is on the"
682 "half connection in the tun/dr module.\n");
685 /* Ensure the checksum is correct */
686 if (skb
->ip_summed
!= CHECKSUM_UNNECESSARY
&&
687 ip_vs_checksum_complete(skb
, ihl
)) {
688 /* Failed checksum! */
689 IP_VS_DBG(1, "Forward ICMP: failed checksum from %d.%d.%d.%d!\n",
690 NIPQUAD(iph
->saddr
));
694 if (IPPROTO_TCP
== cih
->protocol
|| IPPROTO_UDP
== cih
->protocol
)
695 offset
+= 2 * sizeof(__u16
);
696 if (!ip_vs_make_skb_writable(pskb
, offset
))
700 ip_vs_nat_icmp(skb
, pp
, cp
, 1);
702 /* do the statistics and put it back */
703 ip_vs_out_stats(cp
, skb
);
705 skb
->nfcache
|= NFC_IPVS_PROPERTY
;
709 __ip_vs_conn_put(cp
);
714 static inline int is_tcp_reset(const struct sk_buff
*skb
)
716 struct tcphdr _tcph
, *th
;
718 th
= skb_header_pointer(skb
, skb
->nh
.iph
->ihl
* 4,
719 sizeof(_tcph
), &_tcph
);
726 * It is hooked at the NF_IP_FORWARD chain, used only for VS/NAT.
727 * Check if outgoing packet belongs to the established ip_vs_conn,
728 * rewrite addresses of the packet and send it on its way...
731 ip_vs_out(unsigned int hooknum
, struct sk_buff
**pskb
,
732 const struct net_device
*in
, const struct net_device
*out
,
733 int (*okfn
)(struct sk_buff
*))
735 struct sk_buff
*skb
= *pskb
;
737 struct ip_vs_protocol
*pp
;
738 struct ip_vs_conn
*cp
;
743 if (skb
->nfcache
& NFC_IPVS_PROPERTY
)
747 if (unlikely(iph
->protocol
== IPPROTO_ICMP
)) {
748 int related
, verdict
= ip_vs_out_icmp(pskb
, &related
);
756 pp
= ip_vs_proto_get(iph
->protocol
);
760 /* reassemble IP fragments */
761 if (unlikely(iph
->frag_off
& __constant_htons(IP_MF
|IP_OFFSET
) &&
763 skb
= ip_vs_gather_frags(skb
);
773 * Check if the packet belongs to an existing entry
775 cp
= pp
->conn_out_get(skb
, pp
, iph
, ihl
, 0);
778 if (sysctl_ip_vs_nat_icmp_send
&&
779 (pp
->protocol
== IPPROTO_TCP
||
780 pp
->protocol
== IPPROTO_UDP
)) {
781 __u16 _ports
[2], *pptr
;
783 pptr
= skb_header_pointer(skb
, ihl
,
784 sizeof(_ports
), _ports
);
786 return NF_ACCEPT
; /* Not for me */
787 if (ip_vs_lookup_real_service(iph
->protocol
,
788 iph
->saddr
, pptr
[0])) {
790 * Notify the real server: there is no
791 * existing entry if it is not RST
792 * packet or not TCP packet.
794 if (iph
->protocol
!= IPPROTO_TCP
795 || !is_tcp_reset(skb
)) {
796 icmp_send(skb
,ICMP_DEST_UNREACH
,
797 ICMP_PORT_UNREACH
, 0);
802 IP_VS_DBG_PKT(12, pp
, skb
, 0,
803 "packet continues traversal as normal");
807 IP_VS_DBG_PKT(11, pp
, skb
, 0, "Outgoing packet");
809 if (!ip_vs_make_skb_writable(pskb
, ihl
))
812 /* mangle the packet */
813 if (pp
->snat_handler
&& !pp
->snat_handler(pskb
, pp
, cp
))
816 skb
->nh
.iph
->saddr
= cp
->vaddr
;
817 ip_send_check(skb
->nh
.iph
);
819 IP_VS_DBG_PKT(10, pp
, skb
, 0, "After SNAT");
821 ip_vs_out_stats(cp
, skb
);
822 ip_vs_set_state(cp
, IP_VS_DIR_OUTPUT
, skb
, pp
);
825 skb
->nfcache
|= NFC_IPVS_PROPERTY
;
838 * Check if the packet is for VS/NAT connections, then send it
840 * Called by ip_fw_compact to detect packets for VS/NAT before
841 * they are changed by ipchains masquerading code.
844 check_for_ip_vs_out(struct sk_buff
**pskb
, int (*okfn
)(struct sk_buff
*))
848 ret
= ip_vs_out(NF_IP_FORWARD
, pskb
, NULL
, NULL
, NULL
);
849 if (ret
!= NF_ACCEPT
) {
852 /* send the packet immediately if it is already mangled
854 if ((*pskb
)->nfcache
& NFC_IPVS_PROPERTY
) {
863 * Handle ICMP messages in the outside-to-inside direction (incoming).
864 * Find any that might be relevant, check against existing connections,
865 * forward to the right destination host if relevant.
866 * Currently handles error types - unreachable, quench, ttl exceeded.
868 static int ip_vs_in_icmp(struct sk_buff
**pskb
, int *related
)
870 struct sk_buff
*skb
= *pskb
;
872 struct icmphdr _icmph
, *ic
;
873 struct iphdr _ciph
, *cih
; /* The ip header contained within the ICMP */
874 struct ip_vs_conn
*cp
;
875 struct ip_vs_protocol
*pp
;
876 unsigned int offset
, ihl
, verdict
;
880 /* reassemble IP fragments */
881 if (skb
->nh
.iph
->frag_off
& __constant_htons(IP_MF
|IP_OFFSET
)) {
882 skb
= ip_vs_gather_frags(skb
);
889 offset
= ihl
= iph
->ihl
* 4;
890 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
894 IP_VS_DBG(12, "Incoming ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
895 ic
->type
, ntohs(icmp_id(ic
)),
896 NIPQUAD(iph
->saddr
), NIPQUAD(iph
->daddr
));
899 * Work through seeing if this is for us.
900 * These checks are supposed to be in an order that means easy
901 * things are checked first to speed up processing.... however
902 * this means that some packets will manage to get a long way
903 * down this stack and then be rejected, but that's life.
905 if ((ic
->type
!= ICMP_DEST_UNREACH
) &&
906 (ic
->type
!= ICMP_SOURCE_QUENCH
) &&
907 (ic
->type
!= ICMP_TIME_EXCEEDED
)) {
912 /* Now find the contained IP header */
913 offset
+= sizeof(_icmph
);
914 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
916 return NF_ACCEPT
; /* The packet looks wrong, ignore */
918 pp
= ip_vs_proto_get(cih
->protocol
);
922 /* Is the embedded protocol header present? */
923 if (unlikely(cih
->frag_off
& __constant_htons(IP_OFFSET
) &&
927 IP_VS_DBG_PKT(11, pp
, skb
, offset
, "Checking incoming ICMP for");
929 offset
+= cih
->ihl
* 4;
931 /* The embedded headers contain source and dest in reverse order */
932 cp
= pp
->conn_in_get(skb
, pp
, cih
, offset
, 1);
938 /* Ensure the checksum is correct */
939 if (skb
->ip_summed
!= CHECKSUM_UNNECESSARY
&&
940 ip_vs_checksum_complete(skb
, ihl
)) {
941 /* Failed checksum! */
942 IP_VS_DBG(1, "Incoming ICMP: failed checksum from %d.%d.%d.%d!\n",
943 NIPQUAD(iph
->saddr
));
947 /* do the statistics and put it back */
948 ip_vs_in_stats(cp
, skb
);
949 if (IPPROTO_TCP
== cih
->protocol
|| IPPROTO_UDP
== cih
->protocol
)
950 offset
+= 2 * sizeof(__u16
);
951 verdict
= ip_vs_icmp_xmit(skb
, cp
, pp
, offset
);
952 /* do not touch skb anymore */
955 __ip_vs_conn_put(cp
);
961 * Check if it's for virtual services, look it up,
962 * and send it on its way...
965 ip_vs_in(unsigned int hooknum
, struct sk_buff
**pskb
,
966 const struct net_device
*in
, const struct net_device
*out
,
967 int (*okfn
)(struct sk_buff
*))
969 struct sk_buff
*skb
= *pskb
;
971 struct ip_vs_protocol
*pp
;
972 struct ip_vs_conn
*cp
;
977 * Big tappo: only PACKET_HOST (neither loopback nor mcasts)
978 * ... don't know why 1st test DOES NOT include 2nd (?)
980 if (unlikely(skb
->pkt_type
!= PACKET_HOST
981 || skb
->dev
== &loopback_dev
|| skb
->sk
)) {
982 IP_VS_DBG(12, "packet type=%d proto=%d daddr=%d.%d.%d.%d ignored\n",
984 skb
->nh
.iph
->protocol
,
985 NIPQUAD(skb
->nh
.iph
->daddr
));
990 if (unlikely(iph
->protocol
== IPPROTO_ICMP
)) {
991 int related
, verdict
= ip_vs_in_icmp(pskb
, &related
);
999 /* Protocol supported? */
1000 pp
= ip_vs_proto_get(iph
->protocol
);
1004 ihl
= iph
->ihl
<< 2;
1007 * Check if the packet belongs to an existing connection entry
1009 cp
= pp
->conn_in_get(skb
, pp
, iph
, ihl
, 0);
1011 if (unlikely(!cp
)) {
1014 if (!pp
->conn_schedule(skb
, pp
, &v
, &cp
))
1018 if (unlikely(!cp
)) {
1019 /* sorry, all this trouble for a no-hit :) */
1020 IP_VS_DBG_PKT(12, pp
, skb
, 0,
1021 "packet continues traversal as normal");
1025 IP_VS_DBG_PKT(11, pp
, skb
, 0, "Incoming packet");
1027 /* Check the server status */
1028 if (cp
->dest
&& !(cp
->dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
1029 /* the destination server is not availabe */
1031 if (sysctl_ip_vs_expire_nodest_conn
) {
1032 /* try to expire the connection immediately */
1033 ip_vs_conn_expire_now(cp
);
1035 /* don't restart its timer, and silently
1037 __ip_vs_conn_put(cp
);
1042 ip_vs_in_stats(cp
, skb
);
1043 restart
= ip_vs_set_state(cp
, IP_VS_DIR_INPUT
, skb
, pp
);
1044 if (cp
->packet_xmit
)
1045 ret
= cp
->packet_xmit(skb
, cp
, pp
);
1046 /* do not touch skb anymore */
1048 IP_VS_DBG_RL("warning: packet_xmit is null");
1052 /* increase its packet counter and check if it is needed
1053 to be synchronized */
1054 atomic_inc(&cp
->in_pkts
);
1055 if ((ip_vs_sync_state
& IP_VS_STATE_MASTER
) &&
1056 (cp
->protocol
!= IPPROTO_TCP
||
1057 cp
->state
== IP_VS_TCP_S_ESTABLISHED
) &&
1058 (atomic_read(&cp
->in_pkts
) % sysctl_ip_vs_sync_threshold
[1]
1059 == sysctl_ip_vs_sync_threshold
[0]))
1060 ip_vs_sync_conn(cp
);
1068 * It is hooked at the NF_IP_FORWARD chain, in order to catch ICMP
1069 * related packets destined for 0.0.0.0/0.
1070 * When fwmark-based virtual service is used, such as transparent
1071 * cache cluster, TCP packets can be marked and routed to ip_vs_in,
1072 * but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
1073 * sent to ip_vs_in_icmp. So, catch them at the NF_IP_FORWARD chain
1074 * and send them to ip_vs_in_icmp.
1077 ip_vs_forward_icmp(unsigned int hooknum
, struct sk_buff
**pskb
,
1078 const struct net_device
*in
, const struct net_device
*out
,
1079 int (*okfn
)(struct sk_buff
*))
1083 if ((*pskb
)->nh
.iph
->protocol
!= IPPROTO_ICMP
)
1086 return ip_vs_in_icmp(pskb
, &r
);
1090 /* After packet filtering, forward packet through VS/DR, VS/TUN,
1091 or VS/NAT(change destination), so that filtering rules can be
1093 static struct nf_hook_ops ip_vs_in_ops
= {
1095 .owner
= THIS_MODULE
,
1097 .hooknum
= NF_IP_LOCAL_IN
,
1101 /* After packet filtering, change source only for VS/NAT */
1102 static struct nf_hook_ops ip_vs_out_ops
= {
1104 .owner
= THIS_MODULE
,
1106 .hooknum
= NF_IP_FORWARD
,
1110 /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1111 destined for 0.0.0.0/0, which is for incoming IPVS connections */
1112 static struct nf_hook_ops ip_vs_forward_icmp_ops
= {
1113 .hook
= ip_vs_forward_icmp
,
1114 .owner
= THIS_MODULE
,
1116 .hooknum
= NF_IP_FORWARD
,
1120 /* Before the netfilter connection tracking, exit from POST_ROUTING */
1121 static struct nf_hook_ops ip_vs_post_routing_ops
= {
1122 .hook
= ip_vs_post_routing
,
1123 .owner
= THIS_MODULE
,
1125 .hooknum
= NF_IP_POST_ROUTING
,
1126 .priority
= NF_IP_PRI_NAT_SRC
-1,
1131 * Initialize IP Virtual Server
1133 static int __init
ip_vs_init(void)
1137 ret
= ip_vs_control_init();
1139 IP_VS_ERR("can't setup control.\n");
1140 goto cleanup_nothing
;
1143 ip_vs_protocol_init();
1145 ret
= ip_vs_app_init();
1147 IP_VS_ERR("can't setup application helper.\n");
1148 goto cleanup_protocol
;
1151 ret
= ip_vs_conn_init();
1153 IP_VS_ERR("can't setup connection table.\n");
1157 ret
= nf_register_hook(&ip_vs_in_ops
);
1159 IP_VS_ERR("can't register in hook.\n");
1163 ret
= nf_register_hook(&ip_vs_out_ops
);
1165 IP_VS_ERR("can't register out hook.\n");
1168 ret
= nf_register_hook(&ip_vs_post_routing_ops
);
1170 IP_VS_ERR("can't register post_routing hook.\n");
1171 goto cleanup_outops
;
1173 ret
= nf_register_hook(&ip_vs_forward_icmp_ops
);
1175 IP_VS_ERR("can't register forward_icmp hook.\n");
1176 goto cleanup_postroutingops
;
1179 IP_VS_INFO("ipvs loaded.\n");
1182 cleanup_postroutingops
:
1183 nf_unregister_hook(&ip_vs_post_routing_ops
);
1185 nf_unregister_hook(&ip_vs_out_ops
);
1187 nf_unregister_hook(&ip_vs_in_ops
);
1189 ip_vs_conn_cleanup();
1191 ip_vs_app_cleanup();
1193 ip_vs_protocol_cleanup();
1194 ip_vs_control_cleanup();
1199 static void __exit
ip_vs_cleanup(void)
1201 nf_unregister_hook(&ip_vs_forward_icmp_ops
);
1202 nf_unregister_hook(&ip_vs_post_routing_ops
);
1203 nf_unregister_hook(&ip_vs_out_ops
);
1204 nf_unregister_hook(&ip_vs_in_ops
);
1205 ip_vs_conn_cleanup();
1206 ip_vs_app_cleanup();
1207 ip_vs_protocol_cleanup();
1208 ip_vs_control_cleanup();
1209 IP_VS_INFO("ipvs unloaded.\n");
1212 module_init(ip_vs_init
);
1213 module_exit(ip_vs_cleanup
);
1214 MODULE_LICENSE("GPL");