2 * (C) 2008-2009 Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/module.h>
10 #include <linux/skbuff.h>
11 #include <linux/jhash.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <linux/netfilter/xt_cluster.h>
19 static inline u32
nf_ct_orig_ipv4_src(const struct nf_conn
*ct
)
21 return (__force u32
)ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u3
.ip
;
24 static inline const u32
*nf_ct_orig_ipv6_src(const struct nf_conn
*ct
)
26 return (__force u32
*)ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u3
.ip6
;
29 static inline u_int32_t
30 xt_cluster_hash_ipv4(u_int32_t ip
, const struct xt_cluster_match_info
*info
)
32 return jhash_1word(ip
, info
->hash_seed
);
35 static inline u_int32_t
36 xt_cluster_hash_ipv6(const void *ip
, const struct xt_cluster_match_info
*info
)
38 return jhash2(ip
, NF_CT_TUPLE_L3SIZE
/ sizeof(__u32
), info
->hash_seed
);
41 static inline u_int32_t
42 xt_cluster_hash(const struct nf_conn
*ct
,
43 const struct xt_cluster_match_info
*info
)
47 switch(nf_ct_l3num(ct
)) {
49 hash
= xt_cluster_hash_ipv4(nf_ct_orig_ipv4_src(ct
), info
);
52 hash
= xt_cluster_hash_ipv6(nf_ct_orig_ipv6_src(ct
), info
);
58 return (((u64
)hash
* info
->total_nodes
) >> 32);
62 xt_cluster_ipv6_is_multicast(const struct in6_addr
*addr
)
64 __be32 st
= addr
->s6_addr32
[0];
65 return ((st
& htonl(0xFF000000)) == htonl(0xFF000000));
69 xt_cluster_is_multicast_addr(const struct sk_buff
*skb
, u_int8_t family
)
71 bool is_multicast
= false;
75 is_multicast
= ipv4_is_multicast(ip_hdr(skb
)->daddr
);
79 xt_cluster_ipv6_is_multicast(&ipv6_hdr(skb
)->daddr
);
89 xt_cluster_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
91 struct sk_buff
*pskb
= (struct sk_buff
*)skb
;
92 const struct xt_cluster_match_info
*info
= par
->matchinfo
;
93 const struct nf_conn
*ct
;
94 enum ip_conntrack_info ctinfo
;
97 /* This match assumes that all nodes see the same packets. This can be
98 * achieved if the switch that connects the cluster nodes support some
99 * sort of 'port mirroring'. However, if your switch does not support
100 * this, your cluster nodes can reply ARP request using a multicast MAC
101 * address. Thus, your switch will flood the same packets to the
102 * cluster nodes with the same multicast MAC address. Using a multicast
103 * link address is a RFC 1812 (section 3.3.2) violation, but this works
106 * Unfortunately, if you use the multicast MAC address, the link layer
107 * sets skbuff's pkt_type to PACKET_MULTICAST, which is not accepted
108 * by TCP and others for packets coming to this node. For that reason,
109 * this match mangles skbuff's pkt_type if it detects a packet
110 * addressed to a unicast address but using PACKET_MULTICAST. Yes, I
111 * know, matches should not alter packets, but we are doing this here
112 * because we would need to add a PKTTYPE target for this sole purpose.
114 if (!xt_cluster_is_multicast_addr(skb
, par
->family
) &&
115 skb
->pkt_type
== PACKET_MULTICAST
) {
116 pskb
->pkt_type
= PACKET_HOST
;
119 ct
= nf_ct_get(skb
, &ctinfo
);
123 if (ct
== &nf_conntrack_untracked
)
127 hash
= xt_cluster_hash(ct
->master
, info
);
129 hash
= xt_cluster_hash(ct
, info
);
131 return !!((1 << hash
) & info
->node_mask
) ^
132 !!(info
->flags
& XT_CLUSTER_F_INV
);
135 static bool xt_cluster_mt_checkentry(const struct xt_mtchk_param
*par
)
137 struct xt_cluster_match_info
*info
= par
->matchinfo
;
139 if (info
->total_nodes
> XT_CLUSTER_NODES_MAX
) {
140 pr_info("you have exceeded the maximum "
141 "number of cluster nodes (%u > %u)\n",
142 info
->total_nodes
, XT_CLUSTER_NODES_MAX
);
145 if (info
->node_mask
>= (1ULL << info
->total_nodes
)) {
146 pr_info("this node mask cannot be "
147 "higher than the total number of nodes\n");
153 static struct xt_match xt_cluster_match __read_mostly
= {
155 .family
= NFPROTO_UNSPEC
,
156 .match
= xt_cluster_mt
,
157 .checkentry
= xt_cluster_mt_checkentry
,
158 .matchsize
= sizeof(struct xt_cluster_match_info
),
162 static int __init
xt_cluster_mt_init(void)
164 return xt_register_match(&xt_cluster_match
);
167 static void __exit
xt_cluster_mt_fini(void)
169 xt_unregister_match(&xt_cluster_match
);
172 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
173 MODULE_LICENSE("GPL");
174 MODULE_DESCRIPTION("Xtables: hash-based cluster match");
175 MODULE_ALIAS("ipt_cluster");
176 MODULE_ALIAS("ip6t_cluster");
177 module_init(xt_cluster_mt_init
);
178 module_exit(xt_cluster_mt_fini
);