2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the Netfilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
8 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
9 * Peter Kese <peter.kese@ijs.si>
10 * Julian Anastasov <ja@ssi.bg>
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
17 * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
18 * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
22 * Paul `Rusty' Russell properly handle non-linear skbs
23 * Harald Welte don't use nfcache
27 #define KMSG_COMPONENT "IPVS"
28 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
30 #include <linux/module.h>
31 #include <linux/kernel.h>
33 #include <linux/tcp.h>
34 #include <linux/icmp.h>
39 #include <net/icmp.h> /* for icmp_send */
40 #include <net/route.h>
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv4.h>
45 #ifdef CONFIG_IP_VS_IPV6
47 #include <linux/netfilter_ipv6.h>
50 #include <net/ip_vs.h>
53 EXPORT_SYMBOL(register_ip_vs_scheduler
);
54 EXPORT_SYMBOL(unregister_ip_vs_scheduler
);
55 EXPORT_SYMBOL(ip_vs_skb_replace
);
56 EXPORT_SYMBOL(ip_vs_proto_name
);
57 EXPORT_SYMBOL(ip_vs_conn_new
);
58 EXPORT_SYMBOL(ip_vs_conn_in_get
);
59 EXPORT_SYMBOL(ip_vs_conn_out_get
);
60 #ifdef CONFIG_IP_VS_PROTO_TCP
61 EXPORT_SYMBOL(ip_vs_tcp_conn_listen
);
63 EXPORT_SYMBOL(ip_vs_conn_put
);
64 #ifdef CONFIG_IP_VS_DEBUG
65 EXPORT_SYMBOL(ip_vs_get_debug_level
);
69 /* ID used in ICMP lookups */
70 #define icmp_id(icmph) (((icmph)->un).echo.id)
71 #define icmpv6_id(icmph) (icmph->icmp6_dataun.u_echo.identifier)
73 const char *ip_vs_proto_name(unsigned proto
)
86 #ifdef CONFIG_IP_VS_IPV6
91 sprintf(buf
, "IP_%d", proto
);
96 void ip_vs_init_hash_table(struct list_head
*table
, int rows
)
99 INIT_LIST_HEAD(&table
[rows
]);
103 ip_vs_in_stats(struct ip_vs_conn
*cp
, struct sk_buff
*skb
)
105 struct ip_vs_dest
*dest
= cp
->dest
;
106 if (dest
&& (dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
107 spin_lock(&dest
->stats
.lock
);
108 dest
->stats
.ustats
.inpkts
++;
109 dest
->stats
.ustats
.inbytes
+= skb
->len
;
110 spin_unlock(&dest
->stats
.lock
);
112 spin_lock(&dest
->svc
->stats
.lock
);
113 dest
->svc
->stats
.ustats
.inpkts
++;
114 dest
->svc
->stats
.ustats
.inbytes
+= skb
->len
;
115 spin_unlock(&dest
->svc
->stats
.lock
);
117 spin_lock(&ip_vs_stats
.lock
);
118 ip_vs_stats
.ustats
.inpkts
++;
119 ip_vs_stats
.ustats
.inbytes
+= skb
->len
;
120 spin_unlock(&ip_vs_stats
.lock
);
126 ip_vs_out_stats(struct ip_vs_conn
*cp
, struct sk_buff
*skb
)
128 struct ip_vs_dest
*dest
= cp
->dest
;
129 if (dest
&& (dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
130 spin_lock(&dest
->stats
.lock
);
131 dest
->stats
.ustats
.outpkts
++;
132 dest
->stats
.ustats
.outbytes
+= skb
->len
;
133 spin_unlock(&dest
->stats
.lock
);
135 spin_lock(&dest
->svc
->stats
.lock
);
136 dest
->svc
->stats
.ustats
.outpkts
++;
137 dest
->svc
->stats
.ustats
.outbytes
+= skb
->len
;
138 spin_unlock(&dest
->svc
->stats
.lock
);
140 spin_lock(&ip_vs_stats
.lock
);
141 ip_vs_stats
.ustats
.outpkts
++;
142 ip_vs_stats
.ustats
.outbytes
+= skb
->len
;
143 spin_unlock(&ip_vs_stats
.lock
);
149 ip_vs_conn_stats(struct ip_vs_conn
*cp
, struct ip_vs_service
*svc
)
151 spin_lock(&cp
->dest
->stats
.lock
);
152 cp
->dest
->stats
.ustats
.conns
++;
153 spin_unlock(&cp
->dest
->stats
.lock
);
155 spin_lock(&svc
->stats
.lock
);
156 svc
->stats
.ustats
.conns
++;
157 spin_unlock(&svc
->stats
.lock
);
159 spin_lock(&ip_vs_stats
.lock
);
160 ip_vs_stats
.ustats
.conns
++;
161 spin_unlock(&ip_vs_stats
.lock
);
166 ip_vs_set_state(struct ip_vs_conn
*cp
, int direction
,
167 const struct sk_buff
*skb
,
168 struct ip_vs_protocol
*pp
)
170 if (unlikely(!pp
->state_transition
))
172 return pp
->state_transition(cp
, direction
, skb
, pp
);
177 * IPVS persistent scheduling function
178 * It creates a connection entry according to its template if exists,
179 * or selects a server and creates a connection entry plus a template.
180 * Locking: we are svc user (svc->refcnt), so we hold all dests too
181 * Protocols supported: TCP, UDP
183 static struct ip_vs_conn
*
184 ip_vs_sched_persist(struct ip_vs_service
*svc
,
185 const struct sk_buff
*skb
,
188 struct ip_vs_conn
*cp
= NULL
;
189 struct ip_vs_iphdr iph
;
190 struct ip_vs_dest
*dest
;
191 struct ip_vs_conn
*ct
;
192 __be16 dport
; /* destination port to forward */
193 union nf_inet_addr snet
; /* source network of the client,
196 ip_vs_fill_iphdr(svc
->af
, skb_network_header(skb
), &iph
);
198 /* Mask saddr with the netmask to adjust template granularity */
199 #ifdef CONFIG_IP_VS_IPV6
200 if (svc
->af
== AF_INET6
)
201 ipv6_addr_prefix(&snet
.in6
, &iph
.saddr
.in6
, svc
->netmask
);
204 snet
.ip
= iph
.saddr
.ip
& svc
->netmask
;
206 IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "
208 IP_VS_DBG_ADDR(svc
->af
, &iph
.saddr
), ntohs(ports
[0]),
209 IP_VS_DBG_ADDR(svc
->af
, &iph
.daddr
), ntohs(ports
[1]),
210 IP_VS_DBG_ADDR(svc
->af
, &snet
));
213 * As far as we know, FTP is a very complicated network protocol, and
214 * it uses control connection and data connections. For active FTP,
215 * FTP server initialize data connection to the client, its source port
216 * is often 20. For passive FTP, FTP server tells the clients the port
217 * that it passively listens to, and the client issues the data
218 * connection. In the tunneling or direct routing mode, the load
219 * balancer is on the client-to-server half of connection, the port
220 * number is unknown to the load balancer. So, a conn template like
221 * <caddr, 0, vaddr, 0, daddr, 0> is created for persistent FTP
222 * service, and a template like <caddr, 0, vaddr, vport, daddr, dport>
223 * is created for other persistent services.
225 if (ports
[1] == svc
->port
) {
226 /* Check if a template already exists */
227 if (svc
->port
!= FTPPORT
)
228 ct
= ip_vs_ct_in_get(svc
->af
, iph
.protocol
, &snet
, 0,
229 &iph
.daddr
, ports
[1]);
231 ct
= ip_vs_ct_in_get(svc
->af
, iph
.protocol
, &snet
, 0,
234 if (!ct
|| !ip_vs_check_template(ct
)) {
236 * No template found or the dest of the connection
237 * template is not available.
239 dest
= svc
->scheduler
->schedule(svc
, skb
);
241 IP_VS_DBG(1, "p-schedule: no dest found.\n");
246 * Create a template like <protocol,caddr,0,
247 * vaddr,vport,daddr,dport> for non-ftp service,
248 * and <protocol,caddr,0,vaddr,0,daddr,0>
251 if (svc
->port
!= FTPPORT
)
252 ct
= ip_vs_conn_new(svc
->af
, iph
.protocol
,
256 &dest
->addr
, dest
->port
,
257 IP_VS_CONN_F_TEMPLATE
,
260 ct
= ip_vs_conn_new(svc
->af
, iph
.protocol
,
264 IP_VS_CONN_F_TEMPLATE
,
269 ct
->timeout
= svc
->timeout
;
271 /* set destination with the found template */
277 * Note: persistent fwmark-based services and persistent
278 * port zero service are handled here.
279 * fwmark template: <IPPROTO_IP,caddr,0,fwmark,0,daddr,0>
280 * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
283 union nf_inet_addr fwmark
= {
284 .ip
= htonl(svc
->fwmark
)
287 ct
= ip_vs_ct_in_get(svc
->af
, IPPROTO_IP
, &snet
, 0,
290 ct
= ip_vs_ct_in_get(svc
->af
, iph
.protocol
, &snet
, 0,
293 if (!ct
|| !ip_vs_check_template(ct
)) {
295 * If it is not persistent port zero, return NULL,
296 * otherwise create a connection template.
301 dest
= svc
->scheduler
->schedule(svc
, skb
);
303 IP_VS_DBG(1, "p-schedule: no dest found.\n");
308 * Create a template according to the service
311 union nf_inet_addr fwmark
= {
312 .ip
= htonl(svc
->fwmark
)
315 ct
= ip_vs_conn_new(svc
->af
, IPPROTO_IP
,
319 IP_VS_CONN_F_TEMPLATE
,
322 ct
= ip_vs_conn_new(svc
->af
, iph
.protocol
,
326 IP_VS_CONN_F_TEMPLATE
,
331 ct
->timeout
= svc
->timeout
;
333 /* set destination with the found template */
340 * Create a new connection according to the template
342 cp
= ip_vs_conn_new(svc
->af
, iph
.protocol
,
343 &iph
.saddr
, ports
[0],
344 &iph
.daddr
, ports
[1],
356 ip_vs_control_add(cp
, ct
);
359 ip_vs_conn_stats(cp
, svc
);
365 * IPVS main scheduling function
366 * It selects a server according to the virtual service, and
367 * creates a connection entry.
368 * Protocols supported: TCP, UDP
371 ip_vs_schedule(struct ip_vs_service
*svc
, const struct sk_buff
*skb
)
373 struct ip_vs_conn
*cp
= NULL
;
374 struct ip_vs_iphdr iph
;
375 struct ip_vs_dest
*dest
;
376 __be16 _ports
[2], *pptr
;
378 ip_vs_fill_iphdr(svc
->af
, skb_network_header(skb
), &iph
);
379 pptr
= skb_header_pointer(skb
, iph
.len
, sizeof(_ports
), _ports
);
386 if (svc
->flags
& IP_VS_SVC_F_PERSISTENT
)
387 return ip_vs_sched_persist(svc
, skb
, pptr
);
390 * Non-persistent service
392 if (!svc
->fwmark
&& pptr
[1] != svc
->port
) {
394 pr_err("Schedule: port zero only supported "
395 "in persistent services, "
396 "check your ipvs configuration\n");
400 dest
= svc
->scheduler
->schedule(svc
, skb
);
402 IP_VS_DBG(1, "Schedule: no dest found.\n");
407 * Create a connection entry.
409 cp
= ip_vs_conn_new(svc
->af
, iph
.protocol
,
412 &dest
->addr
, dest
->port
? dest
->port
: pptr
[1],
418 IP_VS_DBG_BUF(6, "Schedule fwd:%c c:%s:%u v:%s:%u "
419 "d:%s:%u conn->flags:%X conn->refcnt:%d\n",
421 IP_VS_DBG_ADDR(svc
->af
, &cp
->caddr
), ntohs(cp
->cport
),
422 IP_VS_DBG_ADDR(svc
->af
, &cp
->vaddr
), ntohs(cp
->vport
),
423 IP_VS_DBG_ADDR(svc
->af
, &cp
->daddr
), ntohs(cp
->dport
),
424 cp
->flags
, atomic_read(&cp
->refcnt
));
426 ip_vs_conn_stats(cp
, svc
);
432 * Pass or drop the packet.
433 * Called by ip_vs_in, when the virtual service is available but
434 * no destination is available for a new connection.
436 int ip_vs_leave(struct ip_vs_service
*svc
, struct sk_buff
*skb
,
437 struct ip_vs_protocol
*pp
)
439 __be16 _ports
[2], *pptr
;
440 struct ip_vs_iphdr iph
;
442 ip_vs_fill_iphdr(svc
->af
, skb_network_header(skb
), &iph
);
444 pptr
= skb_header_pointer(skb
, iph
.len
, sizeof(_ports
), _ports
);
446 ip_vs_service_put(svc
);
450 #ifdef CONFIG_IP_VS_IPV6
451 if (svc
->af
== AF_INET6
)
452 unicast
= ipv6_addr_type(&iph
.daddr
.in6
) & IPV6_ADDR_UNICAST
;
455 unicast
= (inet_addr_type(&init_net
, iph
.daddr
.ip
) == RTN_UNICAST
);
457 /* if it is fwmark-based service, the cache_bypass sysctl is up
458 and the destination is a non-local unicast, then create
459 a cache_bypass connection entry */
460 if (sysctl_ip_vs_cache_bypass
&& svc
->fwmark
&& unicast
) {
462 struct ip_vs_conn
*cp
;
463 union nf_inet_addr daddr
= { .all
= { 0, 0, 0, 0 } };
465 ip_vs_service_put(svc
);
467 /* create a new connection entry */
468 IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__
);
469 cp
= ip_vs_conn_new(svc
->af
, iph
.protocol
,
479 ip_vs_in_stats(cp
, skb
);
482 cs
= ip_vs_set_state(cp
, IP_VS_DIR_INPUT
, skb
, pp
);
484 /* transmit the first SYN packet */
485 ret
= cp
->packet_xmit(skb
, cp
, pp
);
486 /* do not touch skb anymore */
488 atomic_inc(&cp
->in_pkts
);
494 * When the virtual ftp service is presented, packets destined
495 * for other services on the VIP may get here (except services
496 * listed in the ipvs table), pass the packets, because it is
497 * not ipvs job to decide to drop the packets.
499 if ((svc
->port
== FTPPORT
) && (pptr
[1] != FTPPORT
)) {
500 ip_vs_service_put(svc
);
504 ip_vs_service_put(svc
);
507 * Notify the client that the destination is unreachable, and
508 * release the socket buffer.
509 * Since it is in IP layer, the TCP socket is not actually
510 * created, the TCP RST packet cannot be sent, instead that
511 * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ
513 #ifdef CONFIG_IP_VS_IPV6
514 if (svc
->af
== AF_INET6
)
515 icmpv6_send(skb
, ICMPV6_DEST_UNREACH
, ICMPV6_PORT_UNREACH
, 0,
519 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_PORT_UNREACH
, 0);
526 * It is hooked before NF_IP_PRI_NAT_SRC at the NF_INET_POST_ROUTING
527 * chain, and is used for VS/NAT.
528 * It detects packets for VS/NAT connections and sends the packets
529 * immediately. This can avoid that iptable_nat mangles the packets
532 static unsigned int ip_vs_post_routing(unsigned int hooknum
,
534 const struct net_device
*in
,
535 const struct net_device
*out
,
536 int (*okfn
)(struct sk_buff
*))
538 if (!skb
->ipvs_property
)
540 /* The packet was sent from IPVS, exit this chain */
544 __sum16
ip_vs_checksum_complete(struct sk_buff
*skb
, int offset
)
546 return csum_fold(skb_checksum(skb
, offset
, skb
->len
- offset
, 0));
549 static inline int ip_vs_gather_frags(struct sk_buff
*skb
, u_int32_t user
)
551 int err
= ip_defrag(skb
, user
);
554 ip_send_check(ip_hdr(skb
));
559 #ifdef CONFIG_IP_VS_IPV6
560 static inline int ip_vs_gather_frags_v6(struct sk_buff
*skb
, u_int32_t user
)
562 /* TODO IPv6: Find out what to do here for IPv6 */
568 * Packet has been made sufficiently writable in caller
569 * - inout: 1=in->out, 0=out->in
571 void ip_vs_nat_icmp(struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
572 struct ip_vs_conn
*cp
, int inout
)
574 struct iphdr
*iph
= ip_hdr(skb
);
575 unsigned int icmp_offset
= iph
->ihl
*4;
576 struct icmphdr
*icmph
= (struct icmphdr
*)(skb_network_header(skb
) +
578 struct iphdr
*ciph
= (struct iphdr
*)(icmph
+ 1);
581 iph
->saddr
= cp
->vaddr
.ip
;
583 ciph
->daddr
= cp
->vaddr
.ip
;
586 iph
->daddr
= cp
->daddr
.ip
;
588 ciph
->saddr
= cp
->daddr
.ip
;
592 /* the TCP/UDP port */
593 if (IPPROTO_TCP
== ciph
->protocol
|| IPPROTO_UDP
== ciph
->protocol
) {
594 __be16
*ports
= (void *)ciph
+ ciph
->ihl
*4;
597 ports
[1] = cp
->vport
;
599 ports
[0] = cp
->dport
;
602 /* And finally the ICMP checksum */
604 icmph
->checksum
= ip_vs_checksum_complete(skb
, icmp_offset
);
605 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
608 IP_VS_DBG_PKT(11, pp
, skb
, (void *)ciph
- (void *)iph
,
609 "Forwarding altered outgoing ICMP");
611 IP_VS_DBG_PKT(11, pp
, skb
, (void *)ciph
- (void *)iph
,
612 "Forwarding altered incoming ICMP");
615 #ifdef CONFIG_IP_VS_IPV6
616 void ip_vs_nat_icmp_v6(struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
617 struct ip_vs_conn
*cp
, int inout
)
619 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
620 unsigned int icmp_offset
= sizeof(struct ipv6hdr
);
621 struct icmp6hdr
*icmph
= (struct icmp6hdr
*)(skb_network_header(skb
) +
623 struct ipv6hdr
*ciph
= (struct ipv6hdr
*)(icmph
+ 1);
626 iph
->saddr
= cp
->vaddr
.in6
;
627 ciph
->daddr
= cp
->vaddr
.in6
;
629 iph
->daddr
= cp
->daddr
.in6
;
630 ciph
->saddr
= cp
->daddr
.in6
;
633 /* the TCP/UDP port */
634 if (IPPROTO_TCP
== ciph
->nexthdr
|| IPPROTO_UDP
== ciph
->nexthdr
) {
635 __be16
*ports
= (void *)ciph
+ sizeof(struct ipv6hdr
);
638 ports
[1] = cp
->vport
;
640 ports
[0] = cp
->dport
;
643 /* And finally the ICMP checksum */
644 icmph
->icmp6_cksum
= 0;
645 /* TODO IPv6: is this correct for ICMPv6? */
646 ip_vs_checksum_complete(skb
, icmp_offset
);
647 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
650 IP_VS_DBG_PKT(11, pp
, skb
, (void *)ciph
- (void *)iph
,
651 "Forwarding altered outgoing ICMPv6");
653 IP_VS_DBG_PKT(11, pp
, skb
, (void *)ciph
- (void *)iph
,
654 "Forwarding altered incoming ICMPv6");
658 /* Handle relevant response ICMP messages - forward to the right
659 * destination host. Used for NAT and local client.
661 static int handle_response_icmp(int af
, struct sk_buff
*skb
,
662 union nf_inet_addr
*snet
,
663 __u8 protocol
, struct ip_vs_conn
*cp
,
664 struct ip_vs_protocol
*pp
,
665 unsigned int offset
, unsigned int ihl
)
667 unsigned int verdict
= NF_DROP
;
669 if (IP_VS_FWD_METHOD(cp
) != 0) {
670 pr_err("shouldn't reach here, because the box is on the "
671 "half connection in the tun/dr module.\n");
674 /* Ensure the checksum is correct */
675 if (!skb_csum_unnecessary(skb
) && ip_vs_checksum_complete(skb
, ihl
)) {
676 /* Failed checksum! */
677 IP_VS_DBG_BUF(1, "Forward ICMP: failed checksum from %s!\n",
678 IP_VS_DBG_ADDR(af
, snet
));
682 if (IPPROTO_TCP
== protocol
|| IPPROTO_UDP
== protocol
)
683 offset
+= 2 * sizeof(__u16
);
684 if (!skb_make_writable(skb
, offset
))
687 #ifdef CONFIG_IP_VS_IPV6
689 ip_vs_nat_icmp_v6(skb
, pp
, cp
, 1);
692 ip_vs_nat_icmp(skb
, pp
, cp
, 1);
694 /* do the statistics and put it back */
695 ip_vs_out_stats(cp
, skb
);
697 skb
->ipvs_property
= 1;
701 __ip_vs_conn_put(cp
);
707 * Handle ICMP messages in the inside-to-outside direction (outgoing).
708 * Find any that might be relevant, check against existing connections.
709 * Currently handles error types - unreachable, quench, ttl exceeded.
711 static int ip_vs_out_icmp(struct sk_buff
*skb
, int *related
)
714 struct icmphdr _icmph
, *ic
;
715 struct iphdr _ciph
, *cih
; /* The ip header contained within the ICMP */
716 struct ip_vs_iphdr ciph
;
717 struct ip_vs_conn
*cp
;
718 struct ip_vs_protocol
*pp
;
719 unsigned int offset
, ihl
;
720 union nf_inet_addr snet
;
724 /* reassemble IP fragments */
725 if (ip_hdr(skb
)->frag_off
& htons(IP_MF
| IP_OFFSET
)) {
726 if (ip_vs_gather_frags(skb
, IP_DEFRAG_VS_OUT
))
731 offset
= ihl
= iph
->ihl
* 4;
732 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
736 IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %pI4->%pI4\n",
737 ic
->type
, ntohs(icmp_id(ic
)),
738 &iph
->saddr
, &iph
->daddr
);
741 * Work through seeing if this is for us.
742 * These checks are supposed to be in an order that means easy
743 * things are checked first to speed up processing.... however
744 * this means that some packets will manage to get a long way
745 * down this stack and then be rejected, but that's life.
747 if ((ic
->type
!= ICMP_DEST_UNREACH
) &&
748 (ic
->type
!= ICMP_SOURCE_QUENCH
) &&
749 (ic
->type
!= ICMP_TIME_EXCEEDED
)) {
754 /* Now find the contained IP header */
755 offset
+= sizeof(_icmph
);
756 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
758 return NF_ACCEPT
; /* The packet looks wrong, ignore */
760 pp
= ip_vs_proto_get(cih
->protocol
);
764 /* Is the embedded protocol header present? */
765 if (unlikely(cih
->frag_off
& htons(IP_OFFSET
) &&
769 IP_VS_DBG_PKT(11, pp
, skb
, offset
, "Checking outgoing ICMP for");
771 offset
+= cih
->ihl
* 4;
773 ip_vs_fill_iphdr(AF_INET
, cih
, &ciph
);
774 /* The embedded headers contain source and dest in reverse order */
775 cp
= pp
->conn_out_get(AF_INET
, skb
, pp
, &ciph
, offset
, 1);
779 snet
.ip
= iph
->saddr
;
780 return handle_response_icmp(AF_INET
, skb
, &snet
, cih
->protocol
, cp
,
784 #ifdef CONFIG_IP_VS_IPV6
785 static int ip_vs_out_icmp_v6(struct sk_buff
*skb
, int *related
)
788 struct icmp6hdr _icmph
, *ic
;
789 struct ipv6hdr _ciph
, *cih
; /* The ip header contained
791 struct ip_vs_iphdr ciph
;
792 struct ip_vs_conn
*cp
;
793 struct ip_vs_protocol
*pp
;
795 union nf_inet_addr snet
;
799 /* reassemble IP fragments */
800 if (ipv6_hdr(skb
)->nexthdr
== IPPROTO_FRAGMENT
) {
801 if (ip_vs_gather_frags_v6(skb
, IP_DEFRAG_VS_OUT
))
806 offset
= sizeof(struct ipv6hdr
);
807 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
811 IP_VS_DBG(12, "Outgoing ICMPv6 (%d,%d) %pI6->%pI6\n",
812 ic
->icmp6_type
, ntohs(icmpv6_id(ic
)),
813 &iph
->saddr
, &iph
->daddr
);
816 * Work through seeing if this is for us.
817 * These checks are supposed to be in an order that means easy
818 * things are checked first to speed up processing.... however
819 * this means that some packets will manage to get a long way
820 * down this stack and then be rejected, but that's life.
822 if ((ic
->icmp6_type
!= ICMPV6_DEST_UNREACH
) &&
823 (ic
->icmp6_type
!= ICMPV6_PKT_TOOBIG
) &&
824 (ic
->icmp6_type
!= ICMPV6_TIME_EXCEED
)) {
829 /* Now find the contained IP header */
830 offset
+= sizeof(_icmph
);
831 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
833 return NF_ACCEPT
; /* The packet looks wrong, ignore */
835 pp
= ip_vs_proto_get(cih
->nexthdr
);
839 /* Is the embedded protocol header present? */
840 /* TODO: we don't support fragmentation at the moment anyways */
841 if (unlikely(cih
->nexthdr
== IPPROTO_FRAGMENT
&& pp
->dont_defrag
))
844 IP_VS_DBG_PKT(11, pp
, skb
, offset
, "Checking outgoing ICMPv6 for");
846 offset
+= sizeof(struct ipv6hdr
);
848 ip_vs_fill_iphdr(AF_INET6
, cih
, &ciph
);
849 /* The embedded headers contain source and dest in reverse order */
850 cp
= pp
->conn_out_get(AF_INET6
, skb
, pp
, &ciph
, offset
, 1);
854 ipv6_addr_copy(&snet
.in6
, &iph
->saddr
);
855 return handle_response_icmp(AF_INET6
, skb
, &snet
, cih
->nexthdr
, cp
,
856 pp
, offset
, sizeof(struct ipv6hdr
));
860 static inline int is_tcp_reset(const struct sk_buff
*skb
, int nh_len
)
862 struct tcphdr _tcph
, *th
;
864 th
= skb_header_pointer(skb
, nh_len
, sizeof(_tcph
), &_tcph
);
870 /* Handle response packets: rewrite addresses and send away...
871 * Used for NAT and local client.
874 handle_response(int af
, struct sk_buff
*skb
, struct ip_vs_protocol
*pp
,
875 struct ip_vs_conn
*cp
, int ihl
)
877 IP_VS_DBG_PKT(11, pp
, skb
, 0, "Outgoing packet");
879 if (!skb_make_writable(skb
, ihl
))
882 /* mangle the packet */
883 if (pp
->snat_handler
&& !pp
->snat_handler(skb
, pp
, cp
))
886 #ifdef CONFIG_IP_VS_IPV6
888 ipv6_hdr(skb
)->saddr
= cp
->vaddr
.in6
;
892 ip_hdr(skb
)->saddr
= cp
->vaddr
.ip
;
893 ip_send_check(ip_hdr(skb
));
896 /* For policy routing, packets originating from this
897 * machine itself may be routed differently to packets
898 * passing through. We want this packet to be routed as
899 * if it came from this machine itself. So re-compute
900 * the routing information.
902 #ifdef CONFIG_IP_VS_IPV6
903 if (af
== AF_INET6
) {
904 if (ip6_route_me_harder(skb
) != 0)
908 if (ip_route_me_harder(skb
, RTN_LOCAL
) != 0)
911 IP_VS_DBG_PKT(10, pp
, skb
, 0, "After SNAT");
913 ip_vs_out_stats(cp
, skb
);
914 ip_vs_set_state(cp
, IP_VS_DIR_OUTPUT
, skb
, pp
);
917 skb
->ipvs_property
= 1;
929 * It is hooked at the NF_INET_FORWARD chain, used only for VS/NAT.
930 * Check if outgoing packet belongs to the established ip_vs_conn.
933 ip_vs_out(unsigned int hooknum
, struct sk_buff
*skb
,
934 const struct net_device
*in
, const struct net_device
*out
,
935 int (*okfn
)(struct sk_buff
*))
937 struct ip_vs_iphdr iph
;
938 struct ip_vs_protocol
*pp
;
939 struct ip_vs_conn
*cp
;
944 af
= (skb
->protocol
== htons(ETH_P_IP
)) ? AF_INET
: AF_INET6
;
946 if (skb
->ipvs_property
)
949 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
950 #ifdef CONFIG_IP_VS_IPV6
951 if (af
== AF_INET6
) {
952 if (unlikely(iph
.protocol
== IPPROTO_ICMPV6
)) {
953 int related
, verdict
= ip_vs_out_icmp_v6(skb
, &related
);
957 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
961 if (unlikely(iph
.protocol
== IPPROTO_ICMP
)) {
962 int related
, verdict
= ip_vs_out_icmp(skb
, &related
);
966 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
969 pp
= ip_vs_proto_get(iph
.protocol
);
973 /* reassemble IP fragments */
974 #ifdef CONFIG_IP_VS_IPV6
975 if (af
== AF_INET6
) {
976 if (unlikely(iph
.protocol
== IPPROTO_ICMPV6
)) {
977 int related
, verdict
= ip_vs_out_icmp_v6(skb
, &related
);
982 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
986 if (unlikely(ip_hdr(skb
)->frag_off
& htons(IP_MF
|IP_OFFSET
) &&
988 if (ip_vs_gather_frags(skb
, IP_DEFRAG_VS_OUT
))
991 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
995 * Check if the packet belongs to an existing entry
997 cp
= pp
->conn_out_get(af
, skb
, pp
, &iph
, iph
.len
, 0);
1000 if (sysctl_ip_vs_nat_icmp_send
&&
1001 (pp
->protocol
== IPPROTO_TCP
||
1002 pp
->protocol
== IPPROTO_UDP
)) {
1003 __be16 _ports
[2], *pptr
;
1005 pptr
= skb_header_pointer(skb
, iph
.len
,
1006 sizeof(_ports
), _ports
);
1008 return NF_ACCEPT
; /* Not for me */
1009 if (ip_vs_lookup_real_service(af
, iph
.protocol
,
1013 * Notify the real server: there is no
1014 * existing entry if it is not RST
1015 * packet or not TCP packet.
1017 if (iph
.protocol
!= IPPROTO_TCP
1018 || !is_tcp_reset(skb
, iph
.len
)) {
1019 #ifdef CONFIG_IP_VS_IPV6
1022 ICMPV6_DEST_UNREACH
,
1023 ICMPV6_PORT_UNREACH
,
1029 ICMP_PORT_UNREACH
, 0);
1034 IP_VS_DBG_PKT(12, pp
, skb
, 0,
1035 "packet continues traversal as normal");
1039 return handle_response(af
, skb
, pp
, cp
, iph
.len
);
1044 * Handle ICMP messages in the outside-to-inside direction (incoming).
1045 * Find any that might be relevant, check against existing connections,
1046 * forward to the right destination host if relevant.
1047 * Currently handles error types - unreachable, quench, ttl exceeded.
1050 ip_vs_in_icmp(struct sk_buff
*skb
, int *related
, unsigned int hooknum
)
1053 struct icmphdr _icmph
, *ic
;
1054 struct iphdr _ciph
, *cih
; /* The ip header contained within the ICMP */
1055 struct ip_vs_iphdr ciph
;
1056 struct ip_vs_conn
*cp
;
1057 struct ip_vs_protocol
*pp
;
1058 unsigned int offset
, ihl
, verdict
;
1059 union nf_inet_addr snet
;
1063 /* reassemble IP fragments */
1064 if (ip_hdr(skb
)->frag_off
& htons(IP_MF
| IP_OFFSET
)) {
1065 if (ip_vs_gather_frags(skb
, hooknum
== NF_INET_LOCAL_IN
?
1066 IP_DEFRAG_VS_IN
: IP_DEFRAG_VS_FWD
))
1071 offset
= ihl
= iph
->ihl
* 4;
1072 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
1076 IP_VS_DBG(12, "Incoming ICMP (%d,%d) %pI4->%pI4\n",
1077 ic
->type
, ntohs(icmp_id(ic
)),
1078 &iph
->saddr
, &iph
->daddr
);
1081 * Work through seeing if this is for us.
1082 * These checks are supposed to be in an order that means easy
1083 * things are checked first to speed up processing.... however
1084 * this means that some packets will manage to get a long way
1085 * down this stack and then be rejected, but that's life.
1087 if ((ic
->type
!= ICMP_DEST_UNREACH
) &&
1088 (ic
->type
!= ICMP_SOURCE_QUENCH
) &&
1089 (ic
->type
!= ICMP_TIME_EXCEEDED
)) {
1094 /* Now find the contained IP header */
1095 offset
+= sizeof(_icmph
);
1096 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
1098 return NF_ACCEPT
; /* The packet looks wrong, ignore */
1100 pp
= ip_vs_proto_get(cih
->protocol
);
1104 /* Is the embedded protocol header present? */
1105 if (unlikely(cih
->frag_off
& htons(IP_OFFSET
) &&
1109 IP_VS_DBG_PKT(11, pp
, skb
, offset
, "Checking incoming ICMP for");
1111 offset
+= cih
->ihl
* 4;
1113 ip_vs_fill_iphdr(AF_INET
, cih
, &ciph
);
1114 /* The embedded headers contain source and dest in reverse order */
1115 cp
= pp
->conn_in_get(AF_INET
, skb
, pp
, &ciph
, offset
, 1);
1117 /* The packet could also belong to a local client */
1118 cp
= pp
->conn_out_get(AF_INET
, skb
, pp
, &ciph
, offset
, 1);
1120 snet
.ip
= iph
->saddr
;
1121 return handle_response_icmp(AF_INET
, skb
, &snet
,
1122 cih
->protocol
, cp
, pp
,
1130 /* Ensure the checksum is correct */
1131 if (!skb_csum_unnecessary(skb
) && ip_vs_checksum_complete(skb
, ihl
)) {
1132 /* Failed checksum! */
1133 IP_VS_DBG(1, "Incoming ICMP: failed checksum from %pI4!\n",
1138 /* do the statistics and put it back */
1139 ip_vs_in_stats(cp
, skb
);
1140 if (IPPROTO_TCP
== cih
->protocol
|| IPPROTO_UDP
== cih
->protocol
)
1141 offset
+= 2 * sizeof(__u16
);
1142 verdict
= ip_vs_icmp_xmit(skb
, cp
, pp
, offset
);
1143 /* do not touch skb anymore */
1146 __ip_vs_conn_put(cp
);
1151 #ifdef CONFIG_IP_VS_IPV6
1153 ip_vs_in_icmp_v6(struct sk_buff
*skb
, int *related
, unsigned int hooknum
)
1155 struct ipv6hdr
*iph
;
1156 struct icmp6hdr _icmph
, *ic
;
1157 struct ipv6hdr _ciph
, *cih
; /* The ip header contained
1159 struct ip_vs_iphdr ciph
;
1160 struct ip_vs_conn
*cp
;
1161 struct ip_vs_protocol
*pp
;
1162 unsigned int offset
, verdict
;
1163 union nf_inet_addr snet
;
1167 /* reassemble IP fragments */
1168 if (ipv6_hdr(skb
)->nexthdr
== IPPROTO_FRAGMENT
) {
1169 if (ip_vs_gather_frags_v6(skb
, hooknum
== NF_INET_LOCAL_IN
?
1175 iph
= ipv6_hdr(skb
);
1176 offset
= sizeof(struct ipv6hdr
);
1177 ic
= skb_header_pointer(skb
, offset
, sizeof(_icmph
), &_icmph
);
1181 IP_VS_DBG(12, "Incoming ICMPv6 (%d,%d) %pI6->%pI6\n",
1182 ic
->icmp6_type
, ntohs(icmpv6_id(ic
)),
1183 &iph
->saddr
, &iph
->daddr
);
1186 * Work through seeing if this is for us.
1187 * These checks are supposed to be in an order that means easy
1188 * things are checked first to speed up processing.... however
1189 * this means that some packets will manage to get a long way
1190 * down this stack and then be rejected, but that's life.
1192 if ((ic
->icmp6_type
!= ICMPV6_DEST_UNREACH
) &&
1193 (ic
->icmp6_type
!= ICMPV6_PKT_TOOBIG
) &&
1194 (ic
->icmp6_type
!= ICMPV6_TIME_EXCEED
)) {
1199 /* Now find the contained IP header */
1200 offset
+= sizeof(_icmph
);
1201 cih
= skb_header_pointer(skb
, offset
, sizeof(_ciph
), &_ciph
);
1203 return NF_ACCEPT
; /* The packet looks wrong, ignore */
1205 pp
= ip_vs_proto_get(cih
->nexthdr
);
1209 /* Is the embedded protocol header present? */
1210 /* TODO: we don't support fragmentation at the moment anyways */
1211 if (unlikely(cih
->nexthdr
== IPPROTO_FRAGMENT
&& pp
->dont_defrag
))
1214 IP_VS_DBG_PKT(11, pp
, skb
, offset
, "Checking incoming ICMPv6 for");
1216 offset
+= sizeof(struct ipv6hdr
);
1218 ip_vs_fill_iphdr(AF_INET6
, cih
, &ciph
);
1219 /* The embedded headers contain source and dest in reverse order */
1220 cp
= pp
->conn_in_get(AF_INET6
, skb
, pp
, &ciph
, offset
, 1);
1222 /* The packet could also belong to a local client */
1223 cp
= pp
->conn_out_get(AF_INET6
, skb
, pp
, &ciph
, offset
, 1);
1225 ipv6_addr_copy(&snet
.in6
, &iph
->saddr
);
1226 return handle_response_icmp(AF_INET6
, skb
, &snet
,
1229 sizeof(struct ipv6hdr
));
1236 /* do the statistics and put it back */
1237 ip_vs_in_stats(cp
, skb
);
1238 if (IPPROTO_TCP
== cih
->nexthdr
|| IPPROTO_UDP
== cih
->nexthdr
)
1239 offset
+= 2 * sizeof(__u16
);
1240 verdict
= ip_vs_icmp_xmit_v6(skb
, cp
, pp
, offset
);
1241 /* do not touch skb anymore */
1243 __ip_vs_conn_put(cp
);
1251 * Check if it's for virtual services, look it up,
1252 * and send it on its way...
1255 ip_vs_in(unsigned int hooknum
, struct sk_buff
*skb
,
1256 const struct net_device
*in
, const struct net_device
*out
,
1257 int (*okfn
)(struct sk_buff
*))
1259 struct ip_vs_iphdr iph
;
1260 struct ip_vs_protocol
*pp
;
1261 struct ip_vs_conn
*cp
;
1262 int ret
, restart
, af
, pkts
;
1264 af
= (skb
->protocol
== htons(ETH_P_IP
)) ? AF_INET
: AF_INET6
;
1266 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
1269 * Big tappo: only PACKET_HOST, including loopback for local client
1270 * Don't handle local packets on IPv6 for now
1272 if (unlikely(skb
->pkt_type
!= PACKET_HOST
)) {
1273 IP_VS_DBG_BUF(12, "packet type=%d proto=%d daddr=%s ignored\n",
1276 IP_VS_DBG_ADDR(af
, &iph
.daddr
));
1280 #ifdef CONFIG_IP_VS_IPV6
1281 if (af
== AF_INET6
) {
1282 if (unlikely(iph
.protocol
== IPPROTO_ICMPV6
)) {
1283 int related
, verdict
= ip_vs_in_icmp_v6(skb
, &related
, hooknum
);
1287 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
1291 if (unlikely(iph
.protocol
== IPPROTO_ICMP
)) {
1292 int related
, verdict
= ip_vs_in_icmp(skb
, &related
, hooknum
);
1296 ip_vs_fill_iphdr(af
, skb_network_header(skb
), &iph
);
1299 /* Protocol supported? */
1300 pp
= ip_vs_proto_get(iph
.protocol
);
1305 * Check if the packet belongs to an existing connection entry
1307 cp
= pp
->conn_in_get(af
, skb
, pp
, &iph
, iph
.len
, 0);
1309 if (unlikely(!cp
)) {
1312 /* For local client packets, it could be a response */
1313 cp
= pp
->conn_out_get(af
, skb
, pp
, &iph
, iph
.len
, 0);
1315 return handle_response(af
, skb
, pp
, cp
, iph
.len
);
1317 if (!pp
->conn_schedule(af
, skb
, pp
, &v
, &cp
))
1321 if (unlikely(!cp
)) {
1322 /* sorry, all this trouble for a no-hit :) */
1323 IP_VS_DBG_PKT(12, pp
, skb
, 0,
1324 "packet continues traversal as normal");
1328 IP_VS_DBG_PKT(11, pp
, skb
, 0, "Incoming packet");
1330 /* Check the server status */
1331 if (cp
->dest
&& !(cp
->dest
->flags
& IP_VS_DEST_F_AVAILABLE
)) {
1332 /* the destination server is not available */
1334 if (sysctl_ip_vs_expire_nodest_conn
) {
1335 /* try to expire the connection immediately */
1336 ip_vs_conn_expire_now(cp
);
1338 /* don't restart its timer, and silently
1340 __ip_vs_conn_put(cp
);
1344 ip_vs_in_stats(cp
, skb
);
1345 restart
= ip_vs_set_state(cp
, IP_VS_DIR_INPUT
, skb
, pp
);
1346 if (cp
->packet_xmit
)
1347 ret
= cp
->packet_xmit(skb
, cp
, pp
);
1348 /* do not touch skb anymore */
1350 IP_VS_DBG_RL("warning: packet_xmit is null");
1354 /* Increase its packet counter and check if it is needed
1355 * to be synchronized
1357 * Sync connection if it is about to close to
1358 * encorage the standby servers to update the connections timeout
1360 pkts
= atomic_add_return(1, &cp
->in_pkts
);
1361 if (af
== AF_INET
&&
1362 (ip_vs_sync_state
& IP_VS_STATE_MASTER
) &&
1363 (((cp
->protocol
!= IPPROTO_TCP
||
1364 cp
->state
== IP_VS_TCP_S_ESTABLISHED
) &&
1365 (pkts
% sysctl_ip_vs_sync_threshold
[1]
1366 == sysctl_ip_vs_sync_threshold
[0])) ||
1367 ((cp
->protocol
== IPPROTO_TCP
) && (cp
->old_state
!= cp
->state
) &&
1368 ((cp
->state
== IP_VS_TCP_S_FIN_WAIT
) ||
1369 (cp
->state
== IP_VS_TCP_S_CLOSE_WAIT
) ||
1370 (cp
->state
== IP_VS_TCP_S_TIME_WAIT
)))))
1371 ip_vs_sync_conn(cp
);
1372 cp
->old_state
= cp
->state
;
1380 * It is hooked at the NF_INET_FORWARD chain, in order to catch ICMP
1381 * related packets destined for 0.0.0.0/0.
1382 * When fwmark-based virtual service is used, such as transparent
1383 * cache cluster, TCP packets can be marked and routed to ip_vs_in,
1384 * but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
1385 * sent to ip_vs_in_icmp. So, catch them at the NF_INET_FORWARD chain
1386 * and send them to ip_vs_in_icmp.
1389 ip_vs_forward_icmp(unsigned int hooknum
, struct sk_buff
*skb
,
1390 const struct net_device
*in
, const struct net_device
*out
,
1391 int (*okfn
)(struct sk_buff
*))
1395 if (ip_hdr(skb
)->protocol
!= IPPROTO_ICMP
)
1398 return ip_vs_in_icmp(skb
, &r
, hooknum
);
1401 #ifdef CONFIG_IP_VS_IPV6
1403 ip_vs_forward_icmp_v6(unsigned int hooknum
, struct sk_buff
*skb
,
1404 const struct net_device
*in
, const struct net_device
*out
,
1405 int (*okfn
)(struct sk_buff
*))
1409 if (ipv6_hdr(skb
)->nexthdr
!= IPPROTO_ICMPV6
)
1412 return ip_vs_in_icmp_v6(skb
, &r
, hooknum
);
1417 static struct nf_hook_ops ip_vs_ops
[] __read_mostly
= {
1418 /* After packet filtering, forward packet through VS/DR, VS/TUN,
1419 * or VS/NAT(change destination), so that filtering rules can be
1420 * applied to IPVS. */
1423 .owner
= THIS_MODULE
,
1425 .hooknum
= NF_INET_LOCAL_IN
,
1428 /* After packet filtering, change source only for VS/NAT */
1431 .owner
= THIS_MODULE
,
1433 .hooknum
= NF_INET_FORWARD
,
1436 /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1437 * destined for 0.0.0.0/0, which is for incoming IPVS connections */
1439 .hook
= ip_vs_forward_icmp
,
1440 .owner
= THIS_MODULE
,
1442 .hooknum
= NF_INET_FORWARD
,
1445 /* Before the netfilter connection tracking, exit from POST_ROUTING */
1447 .hook
= ip_vs_post_routing
,
1448 .owner
= THIS_MODULE
,
1450 .hooknum
= NF_INET_POST_ROUTING
,
1451 .priority
= NF_IP_PRI_NAT_SRC
-1,
1453 #ifdef CONFIG_IP_VS_IPV6
1454 /* After packet filtering, forward packet through VS/DR, VS/TUN,
1455 * or VS/NAT(change destination), so that filtering rules can be
1456 * applied to IPVS. */
1459 .owner
= THIS_MODULE
,
1461 .hooknum
= NF_INET_LOCAL_IN
,
1464 /* After packet filtering, change source only for VS/NAT */
1467 .owner
= THIS_MODULE
,
1469 .hooknum
= NF_INET_FORWARD
,
1472 /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1473 * destined for 0.0.0.0/0, which is for incoming IPVS connections */
1475 .hook
= ip_vs_forward_icmp_v6
,
1476 .owner
= THIS_MODULE
,
1478 .hooknum
= NF_INET_FORWARD
,
1481 /* Before the netfilter connection tracking, exit from POST_ROUTING */
1483 .hook
= ip_vs_post_routing
,
1484 .owner
= THIS_MODULE
,
1486 .hooknum
= NF_INET_POST_ROUTING
,
1487 .priority
= NF_IP6_PRI_NAT_SRC
-1,
1494 * Initialize IP Virtual Server
1496 static int __init
ip_vs_init(void)
1500 ip_vs_estimator_init();
1502 ret
= ip_vs_control_init();
1504 pr_err("can't setup control.\n");
1505 goto cleanup_estimator
;
1508 ip_vs_protocol_init();
1510 ret
= ip_vs_app_init();
1512 pr_err("can't setup application helper.\n");
1513 goto cleanup_protocol
;
1516 ret
= ip_vs_conn_init();
1518 pr_err("can't setup connection table.\n");
1522 ret
= nf_register_hooks(ip_vs_ops
, ARRAY_SIZE(ip_vs_ops
));
1524 pr_err("can't register hooks.\n");
1528 pr_info("ipvs loaded.\n");
1532 ip_vs_conn_cleanup();
1534 ip_vs_app_cleanup();
1536 ip_vs_protocol_cleanup();
1537 ip_vs_control_cleanup();
1539 ip_vs_estimator_cleanup();
1543 static void __exit
ip_vs_cleanup(void)
1545 nf_unregister_hooks(ip_vs_ops
, ARRAY_SIZE(ip_vs_ops
));
1546 ip_vs_conn_cleanup();
1547 ip_vs_app_cleanup();
1548 ip_vs_protocol_cleanup();
1549 ip_vs_control_cleanup();
1550 ip_vs_estimator_cleanup();
1551 pr_info("ipvs unloaded.\n");
1554 module_init(ip_vs_init
);
1555 module_exit(ip_vs_cleanup
);
1556 MODULE_LICENSE("GPL");