2 * ip_vs_nfct.c: Netfilter connection tracking support for IPVS
4 * Portions Copyright (C) 2001-2002
5 * Antefacto Ltd, 181 Parnell St, Dublin 1, Ireland.
7 * Portions Copyright (C) 2003-2010
11 * This code is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
27 * Ben North <ben@redfrontdoor.org>
28 * Julian Anastasov <ja@ssi.bg> Reorganize and sync with latest kernels
29 * Hannes Eder <heder@google.com> Extend NFCT support for FTP, ipvs match
34 * - provide conntrack confirmation for new and related connections, by
35 * this way we can see their proper conntrack state in all hooks
36 * - support for all forwarding methods, not only NAT
37 * - FTP support (NAT), ability to support other NAT apps with expectations
38 * - to correctly create expectations for related NAT connections the proper
39 * NF conntrack support must be already installed, eg. ip_vs_ftp requires
40 * nf_conntrack_ftp ... iptables_nat for the same ports (but no iptables
41 * NAT rules are needed)
42 * - alter reply for NAT when forwarding packet in original direction:
43 * conntrack from client in NEW or RELATED (Passive FTP DATA) state or
44 * when RELATED conntrack is created from real server (Active FTP DATA)
45 * - if iptables_nat is not loaded the Passive FTP will not work (the
46 * PASV response can not be NAT-ed) but Active FTP should work
50 #define KMSG_COMPONENT "IPVS"
51 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
53 #include <linux/module.h>
54 #include <linux/types.h>
55 #include <linux/kernel.h>
56 #include <linux/errno.h>
57 #include <linux/compiler.h>
58 #include <linux/vmalloc.h>
59 #include <linux/skbuff.h>
61 #include <linux/netfilter.h>
62 #include <linux/netfilter_ipv4.h>
63 #include <net/ip_vs.h>
64 #include <net/netfilter/nf_conntrack_core.h>
65 #include <net/netfilter/nf_conntrack_expect.h>
66 #include <net/netfilter/nf_conntrack_helper.h>
67 #include <net/netfilter/nf_conntrack_zones.h>
70 #define FMT_TUPLE "%pI4:%u->%pI4:%u/%u"
71 #define ARG_TUPLE(T) &(T)->src.u3.ip, ntohs((T)->src.u.all), \
72 &(T)->dst.u3.ip, ntohs((T)->dst.u.all), \
75 #define FMT_CONN "%pI4:%u->%pI4:%u->%pI4:%u/%u:%u"
76 #define ARG_CONN(C) &((C)->caddr.ip), ntohs((C)->cport), \
77 &((C)->vaddr.ip), ntohs((C)->vport), \
78 &((C)->daddr.ip), ntohs((C)->dport), \
79 (C)->protocol, (C)->state
82 ip_vs_update_conntrack(struct sk_buff
*skb
, struct ip_vs_conn
*cp
, int outin
)
84 enum ip_conntrack_info ctinfo
;
85 struct nf_conn
*ct
= ct
= nf_ct_get(skb
, &ctinfo
);
86 struct nf_conntrack_tuple new_tuple
;
88 if (ct
== NULL
|| nf_ct_is_confirmed(ct
) || nf_ct_is_untracked(ct
) ||
92 /* Never alter conntrack for non-NAT conns */
93 if (IP_VS_FWD_METHOD(cp
) != IP_VS_CONN_F_MASQ
)
96 /* Alter reply only in original direction */
97 if (CTINFO2DIR(ctinfo
) != IP_CT_DIR_ORIGINAL
)
101 * The connection is not yet in the hashtable, so we update it.
102 * CIP->VIP will remain the same, so leave the tuple in
103 * IP_CT_DIR_ORIGINAL untouched. When the reply comes back from the
104 * real-server we will see RIP->DIP.
106 new_tuple
= ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
;
108 * This will also take care of UDP and other protocols.
111 new_tuple
.src
.u3
= cp
->daddr
;
112 if (new_tuple
.dst
.protonum
!= IPPROTO_ICMP
&&
113 new_tuple
.dst
.protonum
!= IPPROTO_ICMPV6
)
114 new_tuple
.src
.u
.tcp
.port
= cp
->dport
;
116 new_tuple
.dst
.u3
= cp
->vaddr
;
117 if (new_tuple
.dst
.protonum
!= IPPROTO_ICMP
&&
118 new_tuple
.dst
.protonum
!= IPPROTO_ICMPV6
)
119 new_tuple
.dst
.u
.tcp
.port
= cp
->vport
;
121 IP_VS_DBG(7, "%s: Updating conntrack ct=%p, status=0x%lX, "
122 "ctinfo=%d, old reply=" FMT_TUPLE
123 ", new reply=" FMT_TUPLE
", cp=" FMT_CONN
"\n",
124 __func__
, ct
, ct
->status
, ctinfo
,
125 ARG_TUPLE(&ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
),
126 ARG_TUPLE(&new_tuple
), ARG_CONN(cp
));
127 nf_conntrack_alter_reply(ct
, &new_tuple
);
130 int ip_vs_confirm_conntrack(struct sk_buff
*skb
, struct ip_vs_conn
*cp
)
132 return nf_conntrack_confirm(skb
);
136 * Called from init_conntrack() as expectfn handler.
138 static void ip_vs_nfct_expect_callback(struct nf_conn
*ct
,
139 struct nf_conntrack_expect
*exp
)
141 struct nf_conntrack_tuple
*orig
, new_reply
;
142 struct ip_vs_conn
*cp
;
143 struct ip_vs_conn_param p
;
145 if (exp
->tuple
.src
.l3num
!= PF_INET
)
149 * We assume that no NF locks are held before this callback.
150 * ip_vs_conn_out_get and ip_vs_conn_in_get should match their
151 * expectations even if they use wildcard values, now we provide the
152 * actual values from the newly created original conntrack direction.
153 * The conntrack is confirmed when packet reaches IPVS hooks.
157 orig
= &ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
;
158 ip_vs_conn_fill_param(exp
->tuple
.src
.l3num
, orig
->dst
.protonum
,
159 &orig
->src
.u3
, orig
->src
.u
.tcp
.port
,
160 &orig
->dst
.u3
, orig
->dst
.u
.tcp
.port
, &p
);
161 cp
= ip_vs_conn_out_get(&p
);
163 /* Change reply CLIENT->RS to CLIENT->VS */
164 new_reply
= ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
;
165 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE
", "
166 FMT_TUPLE
", found inout cp=" FMT_CONN
"\n",
167 __func__
, ct
, ct
->status
,
168 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
170 new_reply
.dst
.u3
= cp
->vaddr
;
171 new_reply
.dst
.u
.tcp
.port
= cp
->vport
;
172 IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE
", " FMT_TUPLE
173 ", inout cp=" FMT_CONN
"\n",
175 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
181 cp
= ip_vs_conn_in_get(&p
);
183 /* Change reply VS->CLIENT to RS->CLIENT */
184 new_reply
= ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
;
185 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE
", "
186 FMT_TUPLE
", found outin cp=" FMT_CONN
"\n",
187 __func__
, ct
, ct
->status
,
188 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
190 new_reply
.src
.u3
= cp
->daddr
;
191 new_reply
.src
.u
.tcp
.port
= cp
->dport
;
192 IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE
", "
193 FMT_TUPLE
", outin cp=" FMT_CONN
"\n",
195 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
200 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuple=" FMT_TUPLE
201 " - unknown expect\n",
202 __func__
, ct
, ct
->status
, ARG_TUPLE(orig
));
206 /* Never alter conntrack for non-NAT conns */
207 if (IP_VS_FWD_METHOD(cp
) == IP_VS_CONN_F_MASQ
)
208 nf_conntrack_alter_reply(ct
, &new_reply
);
214 * Create NF conntrack expectation with wildcard (optional) source port.
215 * Then the default callback function will alter the reply and will confirm
216 * the conntrack entry when the first packet comes.
217 * Use port 0 to expect connection from any port.
219 void ip_vs_nfct_expect_related(struct sk_buff
*skb
, struct nf_conn
*ct
,
220 struct ip_vs_conn
*cp
, u_int8_t proto
,
221 const __be16 port
, int from_rs
)
223 struct nf_conntrack_expect
*exp
;
225 if (ct
== NULL
|| nf_ct_is_untracked(ct
))
228 exp
= nf_ct_expect_alloc(ct
);
232 nf_ct_expect_init(exp
, NF_CT_EXPECT_CLASS_DEFAULT
, nf_ct_l3num(ct
),
233 from_rs
? &cp
->daddr
: &cp
->caddr
,
234 from_rs
? &cp
->caddr
: &cp
->vaddr
,
235 proto
, port
? &port
: NULL
,
236 from_rs
? &cp
->cport
: &cp
->vport
);
238 exp
->expectfn
= ip_vs_nfct_expect_callback
;
240 IP_VS_DBG(7, "%s: ct=%p, expect tuple=" FMT_TUPLE
"\n",
241 __func__
, ct
, ARG_TUPLE(&exp
->tuple
));
242 nf_ct_expect_related(exp
);
243 nf_ct_expect_put(exp
);
245 EXPORT_SYMBOL(ip_vs_nfct_expect_related
);
248 * Our connection was terminated, try to drop the conntrack immediately
250 void ip_vs_conn_drop_conntrack(struct ip_vs_conn
*cp
)
252 struct nf_conntrack_tuple_hash
*h
;
254 struct nf_conntrack_tuple tuple
;
259 tuple
= (struct nf_conntrack_tuple
) {
260 .dst
= { .protonum
= cp
->protocol
, .dir
= IP_CT_DIR_ORIGINAL
} };
261 tuple
.src
.u3
= cp
->caddr
;
262 tuple
.src
.u
.all
= cp
->cport
;
263 tuple
.src
.l3num
= cp
->af
;
264 tuple
.dst
.u3
= cp
->vaddr
;
265 tuple
.dst
.u
.all
= cp
->vport
;
267 IP_VS_DBG(7, "%s: dropping conntrack with tuple=" FMT_TUPLE
268 " for conn " FMT_CONN
"\n",
269 __func__
, ARG_TUPLE(&tuple
), ARG_CONN(cp
));
271 h
= nf_conntrack_find_get(&init_net
, NF_CT_DEFAULT_ZONE
, &tuple
);
273 ct
= nf_ct_tuplehash_to_ctrack(h
);
274 /* Show what happens instead of calling nf_ct_kill() */
275 if (del_timer(&ct
->timeout
)) {
276 IP_VS_DBG(7, "%s: ct=%p, deleted conntrack timer for tuple="
278 __func__
, ct
, ARG_TUPLE(&tuple
));
279 if (ct
->timeout
.function
)
280 ct
->timeout
.function(ct
->timeout
.data
);
282 IP_VS_DBG(7, "%s: ct=%p, no conntrack timer for tuple="
284 __func__
, ct
, ARG_TUPLE(&tuple
));
288 IP_VS_DBG(7, "%s: no conntrack for tuple=" FMT_TUPLE
"\n",
289 __func__
, ARG_TUPLE(&tuple
));