2 * (C) 2008-2009 Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 #include <linux/module.h>
9 #include <linux/skbuff.h>
10 #include <linux/jhash.h>
14 #include <linux/netfilter/x_tables.h>
15 #include <net/netfilter/nf_conntrack.h>
16 #include <linux/netfilter/xt_cluster.h>
18 static inline u_int32_t
nf_ct_orig_ipv4_src(const struct nf_conn
*ct
)
20 return ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u3
.ip
;
23 static inline const void *nf_ct_orig_ipv6_src(const struct nf_conn
*ct
)
25 return ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
.src
.u3
.ip6
;
28 static inline u_int32_t
29 xt_cluster_hash_ipv4(u_int32_t ip
, const struct xt_cluster_match_info
*info
)
31 return jhash_1word(ip
, info
->hash_seed
);
34 static inline u_int32_t
35 xt_cluster_hash_ipv6(const void *ip
, const struct xt_cluster_match_info
*info
)
37 return jhash2(ip
, NF_CT_TUPLE_L3SIZE
/ sizeof(__u32
), info
->hash_seed
);
40 static inline u_int32_t
41 xt_cluster_hash(const struct nf_conn
*ct
,
42 const struct xt_cluster_match_info
*info
)
46 switch(nf_ct_l3num(ct
)) {
48 hash
= xt_cluster_hash_ipv4(nf_ct_orig_ipv4_src(ct
), info
);
51 hash
= xt_cluster_hash_ipv6(nf_ct_orig_ipv6_src(ct
), info
);
57 return (((u64
)hash
* info
->total_nodes
) >> 32);
61 xt_cluster_is_multicast_addr(const struct sk_buff
*skb
, u_int8_t family
)
63 bool is_multicast
= false;
67 is_multicast
= ipv4_is_multicast(ip_hdr(skb
)->daddr
);
70 is_multicast
= ipv6_addr_type(&ipv6_hdr(skb
)->daddr
) &
81 xt_cluster_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
83 struct sk_buff
*pskb
= (struct sk_buff
*)skb
;
84 const struct xt_cluster_match_info
*info
= par
->matchinfo
;
85 const struct nf_conn
*ct
;
86 enum ip_conntrack_info ctinfo
;
89 /* This match assumes that all nodes see the same packets. This can be
90 * achieved if the switch that connects the cluster nodes support some
91 * sort of 'port mirroring'. However, if your switch does not support
92 * this, your cluster nodes can reply ARP request using a multicast MAC
93 * address. Thus, your switch will flood the same packets to the
94 * cluster nodes with the same multicast MAC address. Using a multicast
95 * link address is a RFC 1812 (section 3.3.2) violation, but this works
98 * Unfortunately, if you use the multicast MAC address, the link layer
99 * sets skbuff's pkt_type to PACKET_MULTICAST, which is not accepted
100 * by TCP and others for packets coming to this node. For that reason,
101 * this match mangles skbuff's pkt_type if it detects a packet
102 * addressed to a unicast address but using PACKET_MULTICAST. Yes, I
103 * know, matches should not alter packets, but we are doing this here
104 * because we would need to add a PKTTYPE target for this sole purpose.
106 if (!xt_cluster_is_multicast_addr(skb
, par
->family
) &&
107 skb
->pkt_type
== PACKET_MULTICAST
) {
108 pskb
->pkt_type
= PACKET_HOST
;
111 ct
= nf_ct_get(skb
, &ctinfo
);
115 if (ct
== &nf_conntrack_untracked
)
119 hash
= xt_cluster_hash(ct
->master
, info
);
121 hash
= xt_cluster_hash(ct
, info
);
123 return !!((1 << hash
) & info
->node_mask
) ^
124 !!(info
->flags
& XT_CLUSTER_F_INV
);
127 static bool xt_cluster_mt_checkentry(const struct xt_mtchk_param
*par
)
129 struct xt_cluster_match_info
*info
= par
->matchinfo
;
131 if (info
->node_mask
>= (1 << info
->total_nodes
)) {
132 printk(KERN_ERR
"xt_cluster: this node mask cannot be "
133 "higher than the total number of nodes\n");
139 static struct xt_match xt_cluster_match __read_mostly
= {
141 .family
= NFPROTO_UNSPEC
,
142 .match
= xt_cluster_mt
,
143 .checkentry
= xt_cluster_mt_checkentry
,
144 .matchsize
= sizeof(struct xt_cluster_match_info
),
148 static int __init
xt_cluster_mt_init(void)
150 return xt_register_match(&xt_cluster_match
);
153 static void __exit
xt_cluster_mt_fini(void)
155 xt_unregister_match(&xt_cluster_match
);
158 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
159 MODULE_LICENSE("GPL");
160 MODULE_DESCRIPTION("Xtables: hash-based cluster match");
161 MODULE_ALIAS("ipt_cluster");
162 MODULE_ALIAS("ip6t_cluster");
163 module_init(xt_cluster_mt_init
);
164 module_exit(xt_cluster_mt_fini
);