?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
IPVS: Handle Scheduling errors.
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / netfilter / ipvs / ip_vs_xmit.c
blobfb2a445ddc596718972645e0a65ca6dcc45fdb52
1 /*
2 * ip_vs_xmit.c: various packet transmitters for IPVS
3 *
4 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
5 * Julian Anastasov <ja@ssi.bg>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version
10 * 2 of the License, or (at your option) any later version.
11 *
12 * Changes:
13 *
14 * Description of forwarding methods:
15 * - all transmitters are called from LOCAL_IN (remote clients) and
16 * LOCAL_OUT (local clients) but for ICMP can be called from FORWARD
17 * - not all connections have destination server, for example,
18 * connections in backup server when fwmark is used
19 * - bypass connections use daddr from packet
20 * LOCAL_OUT rules:
21 * - skb->dev is NULL, skb->protocol is not set (both are set in POST_ROUTING)
22 * - skb->pkt_type is not set yet
23 * - the only place where we can see skb->sk != NULL
24 */
25
26 #define KMSG_COMPONENT "IPVS"
27 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
28
29 #include <linux/kernel.h>
30 #include <linux/slab.h>
31 #include <linux/tcp.h> /* for tcphdr */
32 #include <net/ip.h>
33 #include <net/tcp.h> /* for csum_tcpudp_magic */
34 #include <net/udp.h>
35 #include <net/icmp.h> /* for icmp_send */
36 #include <net/route.h> /* for ip_route_output */
37 #include <net/ipv6.h>
38 #include <net/ip6_route.h>
39 #include <net/addrconf.h>
40 #include <linux/icmpv6.h>
41 #include <linux/netfilter.h>
42 #include <linux/netfilter_ipv4.h>
43
44 #include <net/ip_vs.h>
45
46
47 /*
48 * Destination cache to speed up outgoing route lookup
49 */
50 static inline void
51 __ip_vs_dst_set(struct ip_vs_dest *dest, u32 rtos, struct dst_entry *dst,
52 u32 dst_cookie)
53 {
54 struct dst_entry *old_dst;
55
56 old_dst = dest->dst_cache;
57 dest->dst_cache = dst;
58 dest->dst_rtos = rtos;
59 dest->dst_cookie = dst_cookie;
60 dst_release(old_dst);
61 }
62
63 static inline struct dst_entry *
64 __ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos)
65 {
66 struct dst_entry *dst = dest->dst_cache;
67
68 if (!dst)
69 return NULL;
70 if ((dst->obsolete || rtos != dest->dst_rtos) &&
71 dst->ops->check(dst, dest->dst_cookie) == NULL) {
72 dest->dst_cache = NULL;
73 dst_release(dst);
74 return NULL;
75 }
76 dst_hold(dst);
77 return dst;
78 }
79
80 /*
81 * Get route to destination or remote server
82 * rt_mode: flags, &1=Allow local dest, &2=Allow non-local dest,
83 * &4=Allow redirect from remote daddr to local
84 */
85 static struct rtable *
86 __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
87 __be32 daddr, u32 rtos, int rt_mode)
88 {
89 struct net *net = dev_net(skb_dst(skb)->dev);
90 struct rtable *rt; /* Route to the other host */
91 struct rtable *ort; /* Original route */
92 int local;
93
94 if (dest) {
95 spin_lock(&dest->dst_lock);
96 if (!(rt = (struct rtable *)
97 __ip_vs_dst_check(dest, rtos))) {
98 struct flowi fl = {
99 .oif = 0,
100 .nl_u = {
101 .ip4_u = {
102 .daddr = dest->addr.ip,
103 .saddr = 0,
104 .tos = rtos, } },
105 };
106
107 if (ip_route_output_key(net, &rt, &fl)) {
108 spin_unlock(&dest->dst_lock);
109 IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
110 &dest->addr.ip);
111 return NULL;
112 }
113 __ip_vs_dst_set(dest, rtos, dst_clone(&rt->dst), 0);
114 IP_VS_DBG(10, "new dst %pI4, refcnt=%d, rtos=%X\n",
115 &dest->addr.ip,
116 atomic_read(&rt->dst.__refcnt), rtos);
117 }
118 spin_unlock(&dest->dst_lock);
119 } else {
120 struct flowi fl = {
121 .oif = 0,
122 .nl_u = {
123 .ip4_u = {
124 .daddr = daddr,
125 .saddr = 0,
126 .tos = rtos, } },
127 };
128
129 if (ip_route_output_key(net, &rt, &fl)) {
130 IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
131 &daddr);
132 return NULL;
133 }
134 }
135
136 local = rt->rt_flags & RTCF_LOCAL;
137 if (!((local ? 1 : 2) & rt_mode)) {
138 IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI4\n",
139 (rt->rt_flags & RTCF_LOCAL) ?
140 "local":"non-local", &rt->rt_dst);
141 ip_rt_put(rt);
142 return NULL;
143 }
144 if (local && !(rt_mode & 4) && !((ort = skb_rtable(skb)) &&
145 ort->rt_flags & RTCF_LOCAL)) {
146 IP_VS_DBG_RL("Redirect from non-local address %pI4 to local "
147 "requires NAT method, dest: %pI4\n",
148 &ip_hdr(skb)->daddr, &rt->rt_dst);
149 ip_rt_put(rt);
150 return NULL;
151 }
152 if (unlikely(!local && ipv4_is_loopback(ip_hdr(skb)->saddr))) {
153 IP_VS_DBG_RL("Stopping traffic from loopback address %pI4 "
154 "to non-local address, dest: %pI4\n",
155 &ip_hdr(skb)->saddr, &rt->rt_dst);
156 ip_rt_put(rt);
157 return NULL;
158 }
159
160 return rt;
161 }
162
163 /* Reroute packet to local IPv4 stack after DNAT */
164 static int
165 __ip_vs_reroute_locally(struct sk_buff *skb)
166 {
167 struct rtable *rt = skb_rtable(skb);
168 struct net_device *dev = rt->dst.dev;
169 struct net *net = dev_net(dev);
170 struct iphdr *iph = ip_hdr(skb);
171
172 if (rt_is_input_route(rt)) {
173 unsigned long orefdst = skb->_skb_refdst;
174
175 if (ip_route_input(skb, iph->daddr, iph->saddr,
176 iph->tos, skb->dev))
177 return 0;
178 refdst_drop(orefdst);
179 } else {
180 struct flowi fl = {
181 .oif = 0,
182 .nl_u = {
183 .ip4_u = {
184 .daddr = iph->daddr,
185 .saddr = iph->saddr,
186 .tos = RT_TOS(iph->tos),
187 }
188 },
189 .mark = skb->mark,
190 };
191
192 if (ip_route_output_key(net, &rt, &fl))
193 return 0;
194 if (!(rt->rt_flags & RTCF_LOCAL)) {
195 ip_rt_put(rt);
196 return 0;
197 }
198 /* Drop old route. */
199 skb_dst_drop(skb);
200 skb_dst_set(skb, &rt->dst);
201 }
202 return 1;
203 }
204
205 #ifdef CONFIG_IP_VS_IPV6
206
207 static inline int __ip_vs_is_local_route6(struct rt6_info *rt)
208 {
209 return rt->rt6i_dev && rt->rt6i_dev->flags & IFF_LOOPBACK;
210 }
211
212 static struct dst_entry *
213 __ip_vs_route_output_v6(struct net *net, struct in6_addr *daddr,
214 struct in6_addr *ret_saddr, int do_xfrm)
215 {
216 struct dst_entry *dst;
217 struct flowi fl = {
218 .oif = 0,
219 .nl_u = {
220 .ip6_u = {
221 .daddr = *daddr,
222 },
223 },
224 };
225
226 dst = ip6_route_output(net, NULL, &fl);
227 if (dst->error)
228 goto out_err;
229 if (!ret_saddr)
230 return dst;
231 if (ipv6_addr_any(&fl.fl6_src) &&
232 ipv6_dev_get_saddr(net, ip6_dst_idev(dst)->dev,
233 &fl.fl6_dst, 0, &fl.fl6_src) < 0)
234 goto out_err;
235 if (do_xfrm && xfrm_lookup(net, &dst, &fl, NULL, 0) < 0)
236 goto out_err;
237 ipv6_addr_copy(ret_saddr, &fl.fl6_src);
238 return dst;
239
240 out_err:
241 dst_release(dst);
242 IP_VS_DBG_RL("ip6_route_output error, dest: %pI6\n", daddr);
243 return NULL;
244 }
245
246 /*
247 * Get route to destination or remote server
248 * rt_mode: flags, &1=Allow local dest, &2=Allow non-local dest,
249 * &4=Allow redirect from remote daddr to local
250 */
251 static struct rt6_info *
252 __ip_vs_get_out_rt_v6(struct sk_buff *skb, struct ip_vs_dest *dest,
253 struct in6_addr *daddr, struct in6_addr *ret_saddr,
254 int do_xfrm, int rt_mode)
255 {
256 struct net *net = dev_net(skb_dst(skb)->dev);
257 struct rt6_info *rt; /* Route to the other host */
258 struct rt6_info *ort; /* Original route */
259 struct dst_entry *dst;
260 int local;
261
262 if (dest) {
263 spin_lock(&dest->dst_lock);
264 rt = (struct rt6_info *)__ip_vs_dst_check(dest, 0);
265 if (!rt) {
266 u32 cookie;
267
268 dst = __ip_vs_route_output_v6(net, &dest->addr.in6,
269 &dest->dst_saddr,
270 do_xfrm);
271 if (!dst) {
272 spin_unlock(&dest->dst_lock);
273 return NULL;
274 }
275 rt = (struct rt6_info *) dst;
276 cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
277 __ip_vs_dst_set(dest, 0, dst_clone(&rt->dst), cookie);
278 IP_VS_DBG(10, "new dst %pI6, src %pI6, refcnt=%d\n",
279 &dest->addr.in6, &dest->dst_saddr,
280 atomic_read(&rt->dst.__refcnt));
281 }
282 if (ret_saddr)
283 ipv6_addr_copy(ret_saddr, &dest->dst_saddr);
284 spin_unlock(&dest->dst_lock);
285 } else {
286 dst = __ip_vs_route_output_v6(net, daddr, ret_saddr, do_xfrm);
287 if (!dst)
288 return NULL;
289 rt = (struct rt6_info *) dst;
290 }
291
292 local = __ip_vs_is_local_route6(rt);
293 if (!((local ? 1 : 2) & rt_mode)) {
294 IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI6\n",
295 local ? "local":"non-local", daddr);
296 dst_release(&rt->dst);
297 return NULL;
298 }
299 if (local && !(rt_mode & 4) &&
300 !((ort = (struct rt6_info *) skb_dst(skb)) &&
301 __ip_vs_is_local_route6(ort))) {
302 IP_VS_DBG_RL("Redirect from non-local address %pI6 to local "
303 "requires NAT method, dest: %pI6\n",
304 &ipv6_hdr(skb)->daddr, daddr);
305 dst_release(&rt->dst);
306 return NULL;
307 }
308 if (unlikely(!local && (!skb->dev || skb->dev->flags & IFF_LOOPBACK) &&
309 ipv6_addr_type(&ipv6_hdr(skb)->saddr) &
310 IPV6_ADDR_LOOPBACK)) {
311 IP_VS_DBG_RL("Stopping traffic from loopback address %pI6 "
312 "to non-local address, dest: %pI6\n",
313 &ipv6_hdr(skb)->saddr, daddr);
314 dst_release(&rt->dst);
315 return NULL;
316 }
317
318 return rt;
319 }
320 #endif
321
322
323 /*
324 * Release dest->dst_cache before a dest is removed
325 */
326 void
327 ip_vs_dst_reset(struct ip_vs_dest *dest)
328 {
329 struct dst_entry *old_dst;
330
331 old_dst = dest->dst_cache;
332 dest->dst_cache = NULL;
333 dst_release(old_dst);
334 }
335
336 #define IP_VS_XMIT_TUNNEL(skb, cp) \
337 ({ \
338 int __ret = NF_ACCEPT; \
339 \
340 (skb)->ipvs_property = 1; \
341 if (unlikely((cp)->flags & IP_VS_CONN_F_NFCT)) \
342 __ret = ip_vs_confirm_conntrack(skb, cp); \
343 if (__ret == NF_ACCEPT) { \
344 nf_reset(skb); \
345 skb_forward_csum(skb); \
346 } \
347 __ret; \
348 })
349
350 #define IP_VS_XMIT_NAT(pf, skb, cp, local) \
351 do { \
352 (skb)->ipvs_property = 1; \
353 if (likely(!((cp)->flags & IP_VS_CONN_F_NFCT))) \
354 ip_vs_notrack(skb); \
355 else \
356 ip_vs_update_conntrack(skb, cp, 1); \
357 if (local) \
358 return NF_ACCEPT; \
359 skb_forward_csum(skb); \
360 NF_HOOK(pf, NF_INET_LOCAL_OUT, (skb), NULL, \
361 skb_dst(skb)->dev, dst_output); \
362 } while (0)
363
364 #define IP_VS_XMIT(pf, skb, cp, local) \
365 do { \
366 (skb)->ipvs_property = 1; \
367 if (likely(!((cp)->flags & IP_VS_CONN_F_NFCT))) \
368 ip_vs_notrack(skb); \
369 if (local) \
370 return NF_ACCEPT; \
371 skb_forward_csum(skb); \
372 NF_HOOK(pf, NF_INET_LOCAL_OUT, (skb), NULL, \
373 skb_dst(skb)->dev, dst_output); \
374 } while (0)
375
376
377 /*
378 * NULL transmitter (do nothing except return NF_ACCEPT)
379 */
380 int
381 ip_vs_null_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
382 struct ip_vs_protocol *pp)
383 {
384 /* we do not touch skb and do not need pskb ptr */
385 IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);
386 }
387
388
389 /*
390 * Bypass transmitter
391 * Let packets bypass the destination when the destination is not
392 * available, it may be only used in transparent cache cluster.
393 */
394 int
395 ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
396 struct ip_vs_protocol *pp)
397 {
398 struct rtable *rt; /* Route to the other host */
399 struct iphdr *iph = ip_hdr(skb);
400 int mtu;
401
402 EnterFunction(10);
403
404 if (!(rt = __ip_vs_get_out_rt(skb, NULL, iph->daddr,
405 RT_TOS(iph->tos), 2)))
406 goto tx_error_icmp;
407
408 /* MTU checking */
409 mtu = dst_mtu(&rt->dst);
410 if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&
411 !skb_is_gso(skb)) {
412 ip_rt_put(rt);
413 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
414 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
415 goto tx_error;
416 }
417
418 /*
419 * Call ip_send_check because we are not sure it is called
420 * after ip_defrag. Is copy-on-write needed?
421 */
422 if (unlikely((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)) {
423 ip_rt_put(rt);
424 return NF_STOLEN;
425 }
426 ip_send_check(ip_hdr(skb));
427
428 /* drop old route */
429 skb_dst_drop(skb);
430 skb_dst_set(skb, &rt->dst);
431
432 /* Another hack: avoid icmp_send in ip_fragment */
433 skb->local_df = 1;
434
435 IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 0);
436
437 LeaveFunction(10);
438 return NF_STOLEN;
439
440 tx_error_icmp:
441 dst_link_failure(skb);
442 tx_error:
443 kfree_skb(skb);
444 LeaveFunction(10);
445 return NF_STOLEN;
446 }
447
448 #ifdef CONFIG_IP_VS_IPV6
449 int
450 ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
451 struct ip_vs_protocol *pp)
452 {
453 struct rt6_info *rt; /* Route to the other host */
454 struct ipv6hdr *iph = ipv6_hdr(skb);
455 int mtu;
456
457 EnterFunction(10);
458
459 if (!(rt = __ip_vs_get_out_rt_v6(skb, NULL, &iph->daddr, NULL, 0, 2)))
460 goto tx_error_icmp;
461
462 /* MTU checking */
463 mtu = dst_mtu(&rt->dst);
464 if (skb->len > mtu && !skb_is_gso(skb)) {
465 if (!skb->dev) {
466 struct net *net = dev_net(skb_dst(skb)->dev);
467
468 skb->dev = net->loopback_dev;
469 }
470 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
471 dst_release(&rt->dst);
472 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
473 goto tx_error;
474 }
475
476 /*
477 * Call ip_send_check because we are not sure it is called
478 * after ip_defrag. Is copy-on-write needed?
479 */
480 skb = skb_share_check(skb, GFP_ATOMIC);
481 if (unlikely(skb == NULL)) {
482 dst_release(&rt->dst);
483 return NF_STOLEN;
484 }
485
486 /* drop old route */
487 skb_dst_drop(skb);
488 skb_dst_set(skb, &rt->dst);
489
490 /* Another hack: avoid icmp_send in ip_fragment */
491 skb->local_df = 1;
492
493 IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 0);
494
495 LeaveFunction(10);
496 return NF_STOLEN;
497
498 tx_error_icmp:
499 dst_link_failure(skb);
500 tx_error:
501 kfree_skb(skb);
502 LeaveFunction(10);
503 return NF_STOLEN;
504 }
505 #endif
506
507 /*
508 * NAT transmitter (only for outside-to-inside nat forwarding)
509 * Not used for related ICMP
510 */
511 int
512 ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
513 struct ip_vs_protocol *pp)
514 {
515 struct rtable *rt; /* Route to the other host */
516 int mtu;
517 struct iphdr *iph = ip_hdr(skb);
518 int local;
519
520 EnterFunction(10);
521
522 /* check if it is a connection of no-client-port */
523 if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {
524 __be16 _pt, *p;
525 p = skb_header_pointer(skb, iph->ihl*4, sizeof(_pt), &_pt);
526 if (p == NULL)
527 goto tx_error;
528 ip_vs_conn_fill_cport(cp, *p);
529 IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p));
530 }
531
532 if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
533 RT_TOS(iph->tos), 1|2|4)))
534 goto tx_error_icmp;
535 local = rt->rt_flags & RTCF_LOCAL;
536 /*
537 * Avoid duplicate tuple in reply direction for NAT traffic
538 * to local address when connection is sync-ed
539 */
540 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
541 if (cp->flags & IP_VS_CONN_F_SYNC && local) {
542 enum ip_conntrack_info ctinfo;
543 struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);
544
545 if (ct && !nf_ct_is_untracked(ct)) {
546 IP_VS_DBG_RL_PKT(10, AF_INET, pp, skb, 0,
547 "ip_vs_nat_xmit(): "
548 "stopping DNAT to local address");
549 goto tx_error_put;
550 }
551 }
552 #endif
553
554 /* From world but DNAT to loopback address? */
555 if (local && ipv4_is_loopback(rt->rt_dst) &&
556 rt_is_input_route(skb_rtable(skb))) {
557 IP_VS_DBG_RL_PKT(1, AF_INET, pp, skb, 0, "ip_vs_nat_xmit(): "
558 "stopping DNAT to loopback address");
559 goto tx_error_put;
560 }
561
562 /* MTU checking */
563 mtu = dst_mtu(&rt->dst);
564 if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&
565 !skb_is_gso(skb)) {
566 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
567 IP_VS_DBG_RL_PKT(0, AF_INET, pp, skb, 0,
568 "ip_vs_nat_xmit(): frag needed for");
569 goto tx_error_put;
570 }
571
572 /* copy-on-write the packet before mangling it */
573 if (!skb_make_writable(skb, sizeof(struct iphdr)))
574 goto tx_error_put;
575
576 if (skb_cow(skb, rt->dst.dev->hard_header_len))
577 goto tx_error_put;
578
579 /* mangle the packet */
580 if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp))
581 goto tx_error_put;
582 ip_hdr(skb)->daddr = cp->daddr.ip;
583 ip_send_check(ip_hdr(skb));
584
585 if (!local) {
586 /* drop old route */
587 skb_dst_drop(skb);
588 skb_dst_set(skb, &rt->dst);
589 } else {
590 ip_rt_put(rt);
591 /*
592 * Some IPv4 replies get local address from routes,
593 * not from iph, so while we DNAT after routing
594 * we need this second input/output route.
595 */
596 if (!__ip_vs_reroute_locally(skb))
597 goto tx_error;
598 }
599
600 IP_VS_DBG_PKT(10, AF_INET, pp, skb, 0, "After DNAT");
601
602 /* FIXME: when application helper enlarges the packet and the length
603 is larger than the MTU of outgoing device, there will be still
604 MTU problem. */
605
606 /* Another hack: avoid icmp_send in ip_fragment */
607 skb->local_df = 1;
608
609 IP_VS_XMIT_NAT(NFPROTO_IPV4, skb, cp, local);
610
611 LeaveFunction(10);
612 return NF_STOLEN;
613
614 tx_error_icmp:
615 dst_link_failure(skb);
616 tx_error:
617 kfree_skb(skb);
618 LeaveFunction(10);
619 return NF_STOLEN;
620 tx_error_put:
621 ip_rt_put(rt);
622 goto tx_error;
623 }
624
625 #ifdef CONFIG_IP_VS_IPV6
626 int
627 ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
628 struct ip_vs_protocol *pp)
629 {
630 struct rt6_info *rt; /* Route to the other host */
631 int mtu;
632 int local;
633
634 EnterFunction(10);
635
636 /* check if it is a connection of no-client-port */
637 if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {
638 __be16 _pt, *p;
639 p = skb_header_pointer(skb, sizeof(struct ipv6hdr),
640 sizeof(_pt), &_pt);
641 if (p == NULL)
642 goto tx_error;
643 ip_vs_conn_fill_cport(cp, *p);
644 IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p));
645 }
646
647 if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
648 0, 1|2|4)))
649 goto tx_error_icmp;
650 local = __ip_vs_is_local_route6(rt);
651 /*
652 * Avoid duplicate tuple in reply direction for NAT traffic
653 * to local address when connection is sync-ed
654 */
655 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
656 if (cp->flags & IP_VS_CONN_F_SYNC && local) {
657 enum ip_conntrack_info ctinfo;
658 struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);
659
660 if (ct && !nf_ct_is_untracked(ct)) {
661 IP_VS_DBG_RL_PKT(10, AF_INET6, pp, skb, 0,
662 "ip_vs_nat_xmit_v6(): "
663 "stopping DNAT to local address");
664 goto tx_error_put;
665 }
666 }
667 #endif
668
669 /* From world but DNAT to loopback address? */
670 if (local && skb->dev && !(skb->dev->flags & IFF_LOOPBACK) &&
671 ipv6_addr_type(&rt->rt6i_dst.addr) & IPV6_ADDR_LOOPBACK) {
672 IP_VS_DBG_RL_PKT(1, AF_INET6, pp, skb, 0,
673 "ip_vs_nat_xmit_v6(): "
674 "stopping DNAT to loopback address");
675 goto tx_error_put;
676 }
677
678 /* MTU checking */
679 mtu = dst_mtu(&rt->dst);
680 if (skb->len > mtu && !skb_is_gso(skb)) {
681 if (!skb->dev) {
682 struct net *net = dev_net(skb_dst(skb)->dev);
683
684 skb->dev = net->loopback_dev;
685 }
686 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
687 IP_VS_DBG_RL_PKT(0, AF_INET6, pp, skb, 0,
688 "ip_vs_nat_xmit_v6(): frag needed for");
689 goto tx_error_put;
690 }
691
692 /* copy-on-write the packet before mangling it */
693 if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))
694 goto tx_error_put;
695
696 if (skb_cow(skb, rt->dst.dev->hard_header_len))
697 goto tx_error_put;
698
699 /* mangle the packet */
700 if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp))
701 goto tx_error;
702 ipv6_addr_copy(&ipv6_hdr(skb)->daddr, &cp->daddr.in6);
703
704 if (!local || !skb->dev) {
705 /* drop the old route when skb is not shared */
706 skb_dst_drop(skb);
707 skb_dst_set(skb, &rt->dst);
708 } else {
709 /* destined to loopback, do we need to change route? */
710 dst_release(&rt->dst);
711 }
712
713 IP_VS_DBG_PKT(10, AF_INET6, pp, skb, 0, "After DNAT");
714
715 /* FIXME: when application helper enlarges the packet and the length
716 is larger than the MTU of outgoing device, there will be still
717 MTU problem. */
718
719 /* Another hack: avoid icmp_send in ip_fragment */
720 skb->local_df = 1;
721
722 IP_VS_XMIT_NAT(NFPROTO_IPV6, skb, cp, local);
723
724 LeaveFunction(10);
725 return NF_STOLEN;
726
727 tx_error_icmp:
728 dst_link_failure(skb);
729 tx_error:
730 LeaveFunction(10);
731 kfree_skb(skb);
732 return NF_STOLEN;
733 tx_error_put:
734 dst_release(&rt->dst);
735 goto tx_error;
736 }
737 #endif
738
739
740 /*
741 * IP Tunneling transmitter
742 *
743 * This function encapsulates the packet in a new IP packet, its
744 * destination will be set to cp->daddr. Most code of this function
745 * is taken from ipip.c.
746 *
747 * It is used in VS/TUN cluster. The load balancer selects a real
748 * server from a cluster based on a scheduling algorithm,
749 * encapsulates the request packet and forwards it to the selected
750 * server. For example, all real servers are configured with
751 * "ifconfig tunl0 <Virtual IP Address> up". When the server receives
752 * the encapsulated packet, it will decapsulate the packet, processe
753 * the request and return the response packets directly to the client
754 * without passing the load balancer. This can greatly increase the
755 * scalability of virtual server.
756 *
757 * Used for ANY protocol
758 */
759 int
760 ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
761 struct ip_vs_protocol *pp)
762 {
763 struct rtable *rt; /* Route to the other host */
764 struct net_device *tdev; /* Device to other host */
765 struct iphdr *old_iph = ip_hdr(skb);
766 u8 tos = old_iph->tos;
767 __be16 df = old_iph->frag_off;
768 struct iphdr *iph; /* Our new IP header */
769 unsigned int max_headroom; /* The extra header space needed */
770 int mtu;
771 int ret;
772
773 EnterFunction(10);
774
775 if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
776 RT_TOS(tos), 1|2)))
777 goto tx_error_icmp;
778 if (rt->rt_flags & RTCF_LOCAL) {
779 ip_rt_put(rt);
780 IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);
781 }
782
783 tdev = rt->dst.dev;
784
785 mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr);
786 if (mtu < 68) {
787 IP_VS_DBG_RL("%s(): mtu less than 68\n", __func__);
788 goto tx_error_put;
789 }
790 if (skb_dst(skb))
791 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
792
793 df |= (old_iph->frag_off & htons(IP_DF));
794
795 if ((old_iph->frag_off & htons(IP_DF) &&
796 mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb))) {
797 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
798 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
799 goto tx_error_put;
800 }
801
802 /*
803 * Okay, now see if we can stuff it in the buffer as-is.
804 */
805 max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct iphdr);
806
807 if (skb_headroom(skb) < max_headroom
808 || skb_cloned(skb) || skb_shared(skb)) {
809 struct sk_buff *new_skb =
810 skb_realloc_headroom(skb, max_headroom);
811 if (!new_skb) {
812 ip_rt_put(rt);
813 kfree_skb(skb);
814 IP_VS_ERR_RL("%s(): no memory\n", __func__);
815 return NF_STOLEN;
816 }
817 kfree_skb(skb);
818 skb = new_skb;
819 old_iph = ip_hdr(skb);
820 }
821
822 skb->transport_header = skb->network_header;
823
824 /* fix old IP header checksum */
825 ip_send_check(old_iph);
826
827 skb_push(skb, sizeof(struct iphdr));
828 skb_reset_network_header(skb);
829 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
830
831 /* drop old route */
832 skb_dst_drop(skb);
833 skb_dst_set(skb, &rt->dst);
834
835 /*
836 * Push down and install the IPIP header.
837 */
838 iph = ip_hdr(skb);
839 iph->version = 4;
840 iph->ihl = sizeof(struct iphdr)>>2;
841 iph->frag_off = df;
842 iph->protocol = IPPROTO_IPIP;
843 iph->tos = tos;
844 iph->daddr = rt->rt_dst;
845 iph->saddr = rt->rt_src;
846 iph->ttl = old_iph->ttl;
847 ip_select_ident(iph, &rt->dst, NULL);
848
849 /* Another hack: avoid icmp_send in ip_fragment */
850 skb->local_df = 1;
851
852 ret = IP_VS_XMIT_TUNNEL(skb, cp);
853 if (ret == NF_ACCEPT)
854 ip_local_out(skb);
855 else if (ret == NF_DROP)
856 kfree_skb(skb);
857
858 LeaveFunction(10);
859
860 return NF_STOLEN;
861
862 tx_error_icmp:
863 dst_link_failure(skb);
864 tx_error:
865 kfree_skb(skb);
866 LeaveFunction(10);
867 return NF_STOLEN;
868 tx_error_put:
869 ip_rt_put(rt);
870 goto tx_error;
871 }
872
873 #ifdef CONFIG_IP_VS_IPV6
874 int
875 ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
876 struct ip_vs_protocol *pp)
877 {
878 struct rt6_info *rt; /* Route to the other host */
879 struct in6_addr saddr; /* Source for tunnel */
880 struct net_device *tdev; /* Device to other host */
881 struct ipv6hdr *old_iph = ipv6_hdr(skb);
882 struct ipv6hdr *iph; /* Our new IP header */
883 unsigned int max_headroom; /* The extra header space needed */
884 int mtu;
885 int ret;
886
887 EnterFunction(10);
888
889 if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6,
890 &saddr, 1, 1|2)))
891 goto tx_error_icmp;
892 if (__ip_vs_is_local_route6(rt)) {
893 dst_release(&rt->dst);
894 IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 1);
895 }
896
897 tdev = rt->dst.dev;
898
899 mtu = dst_mtu(&rt->dst) - sizeof(struct ipv6hdr);
900 if (mtu < IPV6_MIN_MTU) {
901 IP_VS_DBG_RL("%s(): mtu less than %d\n", __func__,
902 IPV6_MIN_MTU);
903 goto tx_error_put;
904 }
905 if (skb_dst(skb))
906 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
907
908 if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr) &&
909 !skb_is_gso(skb)) {
910 if (!skb->dev) {
911 struct net *net = dev_net(skb_dst(skb)->dev);
912
913 skb->dev = net->loopback_dev;
914 }
915 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
916 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
917 goto tx_error_put;
918 }
919
920 /*
921 * Okay, now see if we can stuff it in the buffer as-is.
922 */
923 max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct ipv6hdr);
924
925 if (skb_headroom(skb) < max_headroom
926 || skb_cloned(skb) || skb_shared(skb)) {
927 struct sk_buff *new_skb =
928 skb_realloc_headroom(skb, max_headroom);
929 if (!new_skb) {
930 dst_release(&rt->dst);
931 kfree_skb(skb);
932 IP_VS_ERR_RL("%s(): no memory\n", __func__);
933 return NF_STOLEN;
934 }
935 kfree_skb(skb);
936 skb = new_skb;
937 old_iph = ipv6_hdr(skb);
938 }
939
940 skb->transport_header = skb->network_header;
941
942 skb_push(skb, sizeof(struct ipv6hdr));
943 skb_reset_network_header(skb);
944 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
945
946 /* drop old route */
947 skb_dst_drop(skb);
948 skb_dst_set(skb, &rt->dst);
949
950 /*
951 * Push down and install the IPIP header.
952 */
953 iph = ipv6_hdr(skb);
954 iph->version = 6;
955 iph->nexthdr = IPPROTO_IPV6;
956 iph->payload_len = old_iph->payload_len;
957 be16_add_cpu(&iph->payload_len, sizeof(*old_iph));
958 iph->priority = old_iph->priority;
959 memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl));
960 ipv6_addr_copy(&iph->daddr, &cp->daddr.in6);
961 ipv6_addr_copy(&iph->saddr, &saddr);
962 iph->hop_limit = old_iph->hop_limit;
963
964 /* Another hack: avoid icmp_send in ip_fragment */
965 skb->local_df = 1;
966
967 ret = IP_VS_XMIT_TUNNEL(skb, cp);
968 if (ret == NF_ACCEPT)
969 ip6_local_out(skb);
970 else if (ret == NF_DROP)
971 kfree_skb(skb);
972
973 LeaveFunction(10);
974
975 return NF_STOLEN;
976
977 tx_error_icmp:
978 dst_link_failure(skb);
979 tx_error:
980 kfree_skb(skb);
981 LeaveFunction(10);
982 return NF_STOLEN;
983 tx_error_put:
984 dst_release(&rt->dst);
985 goto tx_error;
986 }
987 #endif
988
989
990 /*
991 * Direct Routing transmitter
992 * Used for ANY protocol
993 */
994 int
995 ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
996 struct ip_vs_protocol *pp)
997 {
998 struct rtable *rt; /* Route to the other host */
999 struct iphdr *iph = ip_hdr(skb);
1000 int mtu;
1001
1002 EnterFunction(10);
1003
1004 if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
1005 RT_TOS(iph->tos), 1|2)))
1006 goto tx_error_icmp;
1007 if (rt->rt_flags & RTCF_LOCAL) {
1008 ip_rt_put(rt);
1009 IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);
1010 }
1011
1012 /* MTU checking */
1013 mtu = dst_mtu(&rt->dst);
1014 if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu &&
1015 !skb_is_gso(skb)) {
1016 icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
1017 ip_rt_put(rt);
1018 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1019 goto tx_error;
1020 }
1021
1022 /*
1023 * Call ip_send_check because we are not sure it is called
1024 * after ip_defrag. Is copy-on-write needed?
1025 */
1026 if (unlikely((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)) {
1027 ip_rt_put(rt);
1028 return NF_STOLEN;
1029 }
1030 ip_send_check(ip_hdr(skb));
1031
1032 /* drop old route */
1033 skb_dst_drop(skb);
1034 skb_dst_set(skb, &rt->dst);
1035
1036 /* Another hack: avoid icmp_send in ip_fragment */
1037 skb->local_df = 1;
1038
1039 IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 0);
1040
1041 LeaveFunction(10);
1042 return NF_STOLEN;
1043
1044 tx_error_icmp:
1045 dst_link_failure(skb);
1046 tx_error:
1047 kfree_skb(skb);
1048 LeaveFunction(10);
1049 return NF_STOLEN;
1050 }
1051
1052 #ifdef CONFIG_IP_VS_IPV6
1053 int
1054 ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
1055 struct ip_vs_protocol *pp)
1056 {
1057 struct rt6_info *rt; /* Route to the other host */
1058 int mtu;
1059
1060 EnterFunction(10);
1061
1062 if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
1063 0, 1|2)))
1064 goto tx_error_icmp;
1065 if (__ip_vs_is_local_route6(rt)) {
1066 dst_release(&rt->dst);
1067 IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 1);
1068 }
1069
1070 /* MTU checking */
1071 mtu = dst_mtu(&rt->dst);
1072 if (skb->len > mtu) {
1073 if (!skb->dev) {
1074 struct net *net = dev_net(skb_dst(skb)->dev);
1075
1076 skb->dev = net->loopback_dev;
1077 }
1078 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1079 dst_release(&rt->dst);
1080 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1081 goto tx_error;
1082 }
1083
1084 /*
1085 * Call ip_send_check because we are not sure it is called
1086 * after ip_defrag. Is copy-on-write needed?
1087 */
1088 skb = skb_share_check(skb, GFP_ATOMIC);
1089 if (unlikely(skb == NULL)) {
1090 dst_release(&rt->dst);
1091 return NF_STOLEN;
1092 }
1093
1094 /* drop old route */
1095 skb_dst_drop(skb);
1096 skb_dst_set(skb, &rt->dst);
1097
1098 /* Another hack: avoid icmp_send in ip_fragment */
1099 skb->local_df = 1;
1100
1101 IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 0);
1102
1103 LeaveFunction(10);
1104 return NF_STOLEN;
1105
1106 tx_error_icmp:
1107 dst_link_failure(skb);
1108 tx_error:
1109 kfree_skb(skb);
1110 LeaveFunction(10);
1111 return NF_STOLEN;
1112 }
1113 #endif
1114
1115
1116 /*
1117 * ICMP packet transmitter
1118 * called by the ip_vs_in_icmp
1119 */
1120 int
1121 ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
1122 struct ip_vs_protocol *pp, int offset)
1123 {
1124 struct rtable *rt; /* Route to the other host */
1125 int mtu;
1126 int rc;
1127 int local;
1128
1129 EnterFunction(10);
1130
1131 /* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
1132 forwarded directly here, because there is no need to
1133 translate address/port back */
1134 if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
1135 if (cp->packet_xmit)
1136 rc = cp->packet_xmit(skb, cp, pp);
1137 else
1138 rc = NF_ACCEPT;
1139 /* do not touch skb anymore */
1140 atomic_inc(&cp->in_pkts);
1141 goto out;
1142 }
1143
1144 /*
1145 * mangle and send the packet here (only for VS/NAT)
1146 */
1147
1148 if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
1149 RT_TOS(ip_hdr(skb)->tos), 1|2|4)))
1150 goto tx_error_icmp;
1151 local = rt->rt_flags & RTCF_LOCAL;
1152
1153 /*
1154 * Avoid duplicate tuple in reply direction for NAT traffic
1155 * to local address when connection is sync-ed
1156 */
1157 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
1158 if (cp->flags & IP_VS_CONN_F_SYNC && local) {
1159 enum ip_conntrack_info ctinfo;
1160 struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);
1161
1162 if (ct && !nf_ct_is_untracked(ct)) {
1163 IP_VS_DBG(10, "%s(): "
1164 "stopping DNAT to local address %pI4\n",
1165 __func__, &cp->daddr.ip);
1166 goto tx_error_put;
1167 }
1168 }
1169 #endif
1170
1171 /* From world but DNAT to loopback address? */
1172 if (local && ipv4_is_loopback(rt->rt_dst) &&
1173 rt_is_input_route(skb_rtable(skb))) {
1174 IP_VS_DBG(1, "%s(): "
1175 "stopping DNAT to loopback %pI4\n",
1176 __func__, &cp->daddr.ip);
1177 goto tx_error_put;
1178 }
1179
1180 /* MTU checking */
1181 mtu = dst_mtu(&rt->dst);
1182 if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF)) &&
1183 !skb_is_gso(skb)) {
1184 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
1185 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1186 goto tx_error_put;
1187 }
1188
1189 /* copy-on-write the packet before mangling it */
1190 if (!skb_make_writable(skb, offset))
1191 goto tx_error_put;
1192
1193 if (skb_cow(skb, rt->dst.dev->hard_header_len))
1194 goto tx_error_put;
1195
1196 ip_vs_nat_icmp(skb, pp, cp, 0);
1197
1198 if (!local) {
1199 /* drop the old route when skb is not shared */
1200 skb_dst_drop(skb);
1201 skb_dst_set(skb, &rt->dst);
1202 } else {
1203 ip_rt_put(rt);
1204 /*
1205 * Some IPv4 replies get local address from routes,
1206 * not from iph, so while we DNAT after routing
1207 * we need this second input/output route.
1208 */
1209 if (!__ip_vs_reroute_locally(skb))
1210 goto tx_error;
1211 }
1212
1213 /* Another hack: avoid icmp_send in ip_fragment */
1214 skb->local_df = 1;
1215
1216 IP_VS_XMIT_NAT(NFPROTO_IPV4, skb, cp, local);
1217
1218 rc = NF_STOLEN;
1219 goto out;
1220
1221 tx_error_icmp:
1222 dst_link_failure(skb);
1223 tx_error:
1224 dev_kfree_skb(skb);
1225 rc = NF_STOLEN;
1226 out:
1227 LeaveFunction(10);
1228 return rc;
1229 tx_error_put:
1230 ip_rt_put(rt);
1231 goto tx_error;
1232 }
1233
1234 #ifdef CONFIG_IP_VS_IPV6
1235 int
1236 ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
1237 struct ip_vs_protocol *pp, int offset)
1238 {
1239 struct rt6_info *rt; /* Route to the other host */
1240 int mtu;
1241 int rc;
1242 int local;
1243
1244 EnterFunction(10);
1245
1246 /* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
1247 forwarded directly here, because there is no need to
1248 translate address/port back */
1249 if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
1250 if (cp->packet_xmit)
1251 rc = cp->packet_xmit(skb, cp, pp);
1252 else
1253 rc = NF_ACCEPT;
1254 /* do not touch skb anymore */
1255 atomic_inc(&cp->in_pkts);
1256 goto out;
1257 }
1258
1259 /*
1260 * mangle and send the packet here (only for VS/NAT)
1261 */
1262
1263 if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
1264 0, 1|2|4)))
1265 goto tx_error_icmp;
1266
1267 local = __ip_vs_is_local_route6(rt);
1268 /*
1269 * Avoid duplicate tuple in reply direction for NAT traffic
1270 * to local address when connection is sync-ed
1271 */
1272 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
1273 if (cp->flags & IP_VS_CONN_F_SYNC && local) {
1274 enum ip_conntrack_info ctinfo;
1275 struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);
1276
1277 if (ct && !nf_ct_is_untracked(ct)) {
1278 IP_VS_DBG(10, "%s(): "
1279 "stopping DNAT to local address %pI6\n",
1280 __func__, &cp->daddr.in6);
1281 goto tx_error_put;
1282 }
1283 }
1284 #endif
1285
1286 /* From world but DNAT to loopback address? */
1287 if (local && skb->dev && !(skb->dev->flags & IFF_LOOPBACK) &&
1288 ipv6_addr_type(&rt->rt6i_dst.addr) & IPV6_ADDR_LOOPBACK) {
1289 IP_VS_DBG(1, "%s(): "
1290 "stopping DNAT to loopback %pI6\n",
1291 __func__, &cp->daddr.in6);
1292 goto tx_error_put;
1293 }
1294
1295 /* MTU checking */
1296 mtu = dst_mtu(&rt->dst);
1297 if (skb->len > mtu && !skb_is_gso(skb)) {
1298 if (!skb->dev) {
1299 struct net *net = dev_net(skb_dst(skb)->dev);
1300
1301 skb->dev = net->loopback_dev;
1302 }
1303 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1304 IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1305 goto tx_error_put;
1306 }
1307
1308 /* copy-on-write the packet before mangling it */
1309 if (!skb_make_writable(skb, offset))
1310 goto tx_error_put;
1311
1312 if (skb_cow(skb, rt->dst.dev->hard_header_len))
1313 goto tx_error_put;
1314
1315 ip_vs_nat_icmp_v6(skb, pp, cp, 0);
1316
1317 if (!local || !skb->dev) {
1318 /* drop the old route when skb is not shared */
1319 skb_dst_drop(skb);
1320 skb_dst_set(skb, &rt->dst);
1321 } else {
1322 /* destined to loopback, do we need to change route? */
1323 dst_release(&rt->dst);
1324 }
1325
1326 /* Another hack: avoid icmp_send in ip_fragment */
1327 skb->local_df = 1;
1328
1329 IP_VS_XMIT_NAT(NFPROTO_IPV6, skb, cp, local);
1330
1331 rc = NF_STOLEN;
1332 goto out;
1333
1334 tx_error_icmp:
1335 dst_link_failure(skb);
1336 tx_error:
1337 dev_kfree_skb(skb);
1338 rc = NF_STOLEN;
1339 out:
1340 LeaveFunction(10);
1341 return rc;
1342 tx_error_put:
1343 dst_release(&rt->dst);
1344 goto tx_error;
1345 }
1346 #endif
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree