?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
RT-AC66 3.0.0.4.374.130 core
[tomato.git] / release / src-rt-6.x / linux / linux-2.6 / net / ipv4 / ipvs / ip_vs_core.c
blob67c1d0ac8d1ad39dd68d99deca700631d82c0f4b
1 /*
2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the Netfilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
6 * cluster of servers.
7 *
8 * Version: $Id: ip_vs_core.c,v 1.34 2003/05/10 03:05:23 wensong Exp $
9 *
10 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
11 * Peter Kese <peter.kese@ijs.si>
12 * Julian Anastasov <ja@ssi.bg>
13 *
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version
17 * 2 of the License, or (at your option) any later version.
18 *
19 * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
20 * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
21 * and others.
22 *
23 * Changes:
24 * Paul `Rusty' Russell properly handle non-linear skbs
25 * Harald Welte don't use nfcache
26 *
27 */
28
29 #include <linux/module.h>
30 #include <linux/kernel.h>
31 #include <linux/ip.h>
32 #include <linux/tcp.h>
33 #include <linux/icmp.h>
34
35 #include <net/ip.h>
36 #include <net/tcp.h>
37 #include <net/udp.h>
38 #include <net/icmp.h> /* for icmp_send */
39 #include <net/route.h>
40
41 #include <linux/netfilter.h>
42 #include <linux/netfilter_ipv4.h>
43
44 #include <net/ip_vs.h>
45
46
47 EXPORT_SYMBOL(register_ip_vs_scheduler);
48 EXPORT_SYMBOL(unregister_ip_vs_scheduler);
49 EXPORT_SYMBOL(ip_vs_skb_replace);
50 EXPORT_SYMBOL(ip_vs_proto_name);
51 EXPORT_SYMBOL(ip_vs_conn_new);
52 EXPORT_SYMBOL(ip_vs_conn_in_get);
53 EXPORT_SYMBOL(ip_vs_conn_out_get);
54 #ifdef CONFIG_IP_VS_PROTO_TCP
55 EXPORT_SYMBOL(ip_vs_tcp_conn_listen);
56 #endif
57 EXPORT_SYMBOL(ip_vs_conn_put);
58 #ifdef CONFIG_IP_VS_DEBUG
59 EXPORT_SYMBOL(ip_vs_get_debug_level);
60 #endif
61 EXPORT_SYMBOL(ip_vs_make_skb_writable);
62
63
64 /* ID used in ICMP lookups */
65 #define icmp_id(icmph) (((icmph)->un).echo.id)
66
67 const char *ip_vs_proto_name(unsigned proto)
68 {
69 static char buf[20];
70
71 switch (proto) {
72 case IPPROTO_IP:
73 return "IP";
74 case IPPROTO_UDP:
75 return "UDP";
76 case IPPROTO_TCP:
77 return "TCP";
78 case IPPROTO_ICMP:
79 return "ICMP";
80 default:
81 sprintf(buf, "IP_%d", proto);
82 return buf;
83 }
84 }
85
86 void ip_vs_init_hash_table(struct list_head *table, int rows)
87 {
88 while (--rows >= 0)
89 INIT_LIST_HEAD(&table[rows]);
90 }
91
92 static inline void
93 ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
94 {
95 struct ip_vs_dest *dest = cp->dest;
96 if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
97 spin_lock(&dest->stats.lock);
98 dest->stats.inpkts++;
99 dest->stats.inbytes += skb->len;
100 spin_unlock(&dest->stats.lock);
101
102 spin_lock(&dest->svc->stats.lock);
103 dest->svc->stats.inpkts++;
104 dest->svc->stats.inbytes += skb->len;
105 spin_unlock(&dest->svc->stats.lock);
106
107 spin_lock(&ip_vs_stats.lock);
108 ip_vs_stats.inpkts++;
109 ip_vs_stats.inbytes += skb->len;
110 spin_unlock(&ip_vs_stats.lock);
111 }
112 }
113
114
115 static inline void
116 ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
117 {
118 struct ip_vs_dest *dest = cp->dest;
119 if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
120 spin_lock(&dest->stats.lock);
121 dest->stats.outpkts++;
122 dest->stats.outbytes += skb->len;
123 spin_unlock(&dest->stats.lock);
124
125 spin_lock(&dest->svc->stats.lock);
126 dest->svc->stats.outpkts++;
127 dest->svc->stats.outbytes += skb->len;
128 spin_unlock(&dest->svc->stats.lock);
129
130 spin_lock(&ip_vs_stats.lock);
131 ip_vs_stats.outpkts++;
132 ip_vs_stats.outbytes += skb->len;
133 spin_unlock(&ip_vs_stats.lock);
134 }
135 }
136
137
138 static inline void
139 ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
140 {
141 spin_lock(&cp->dest->stats.lock);
142 cp->dest->stats.conns++;
143 spin_unlock(&cp->dest->stats.lock);
144
145 spin_lock(&svc->stats.lock);
146 svc->stats.conns++;
147 spin_unlock(&svc->stats.lock);
148
149 spin_lock(&ip_vs_stats.lock);
150 ip_vs_stats.conns++;
151 spin_unlock(&ip_vs_stats.lock);
152 }
153
154
155 static inline int
156 ip_vs_set_state(struct ip_vs_conn *cp, int direction,
157 const struct sk_buff *skb,
158 struct ip_vs_protocol *pp)
159 {
160 if (unlikely(!pp->state_transition))
161 return 0;
162 return pp->state_transition(cp, direction, skb, pp);
163 }
164
165
166 int ip_vs_make_skb_writable(struct sk_buff **pskb, int writable_len)
167 {
168 struct sk_buff *skb = *pskb;
169
170 /* skb is already used, better copy skb and its payload */
171 if (unlikely(skb_shared(skb) || skb->sk))
172 goto copy_skb;
173
174 /* skb data is already used, copy it */
175 if (unlikely(skb_cloned(skb)))
176 goto copy_data;
177
178 return pskb_may_pull(skb, writable_len);
179
180 copy_data:
181 if (unlikely(writable_len > skb->len))
182 return 0;
183 return !pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
184
185 copy_skb:
186 if (unlikely(writable_len > skb->len))
187 return 0;
188 skb = skb_copy(skb, GFP_ATOMIC);
189 if (!skb)
190 return 0;
191 BUG_ON(skb_is_nonlinear(skb));
192
193 /* Rest of kernel will get very unhappy if we pass it a
194 suddenly-orphaned skbuff */
195 if ((*pskb)->sk)
196 skb_set_owner_w(skb, (*pskb)->sk);
197 kfree_skb(*pskb);
198 *pskb = skb;
199 return 1;
200 }
201
202 /*
203 * IPVS persistent scheduling function
204 * It creates a connection entry according to its template if exists,
205 * or selects a server and creates a connection entry plus a template.
206 * Locking: we are svc user (svc->refcnt), so we hold all dests too
207 * Protocols supported: TCP, UDP
208 */
209 static struct ip_vs_conn *
210 ip_vs_sched_persist(struct ip_vs_service *svc,
211 const struct sk_buff *skb,
212 __be16 ports[2])
213 {
214 struct ip_vs_conn *cp = NULL;
215 struct iphdr *iph = ip_hdr(skb);
216 struct ip_vs_dest *dest;
217 struct ip_vs_conn *ct;
218 __be16 dport; /* destination port to forward */
219 __be32 snet; /* source network of the client, after masking */
220
221 /* Mask saddr with the netmask to adjust template granularity */
222 snet = iph->saddr & svc->netmask;
223
224 IP_VS_DBG(6, "p-schedule: src %u.%u.%u.%u:%u dest %u.%u.%u.%u:%u "
225 "mnet %u.%u.%u.%u\n",
226 NIPQUAD(iph->saddr), ntohs(ports[0]),
227 NIPQUAD(iph->daddr), ntohs(ports[1]),
228 NIPQUAD(snet));
229
230 /*
231 * As far as we know, FTP is a very complicated network protocol, and
232 * it uses control connection and data connections. For active FTP,
233 * FTP server initialize data connection to the client, its source port
234 * is often 20. For passive FTP, FTP server tells the clients the port
235 * that it passively listens to, and the client issues the data
236 * connection. In the tunneling or direct routing mode, the load
237 * balancer is on the client-to-server half of connection, the port
238 * number is unknown to the load balancer. So, a conn template like
239 * <caddr, 0, vaddr, 0, daddr, 0> is created for persistent FTP
240 * service, and a template like <caddr, 0, vaddr, vport, daddr, dport>
241 * is created for other persistent services.
242 */
243 if (ports[1] == svc->port) {
244 /* Check if a template already exists */
245 if (svc->port != FTPPORT)
246 ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
247 iph->daddr, ports[1]);
248 else
249 ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
250 iph->daddr, 0);
251
252 if (!ct || !ip_vs_check_template(ct)) {
253 /*
254 * No template found or the dest of the connection
255 * template is not available.
256 */
257 dest = svc->scheduler->schedule(svc, skb);
258 if (dest == NULL) {
259 IP_VS_DBG(1, "p-schedule: no dest found.\n");
260 return NULL;
261 }
262
263 /*
264 * Create a template like <protocol,caddr,0,
265 * vaddr,vport,daddr,dport> for non-ftp service,
266 * and <protocol,caddr,0,vaddr,0,daddr,0>
267 * for ftp service.
268 */
269 if (svc->port != FTPPORT)
270 ct = ip_vs_conn_new(iph->protocol,
271 snet, 0,
272 iph->daddr,
273 ports[1],
274 dest->addr, dest->port,
275 IP_VS_CONN_F_TEMPLATE,
276 dest);
277 else
278 ct = ip_vs_conn_new(iph->protocol,
279 snet, 0,
280 iph->daddr, 0,
281 dest->addr, 0,
282 IP_VS_CONN_F_TEMPLATE,
283 dest);
284 if (ct == NULL)
285 return NULL;
286
287 ct->timeout = svc->timeout;
288 } else {
289 /* set destination with the found template */
290 dest = ct->dest;
291 }
292 dport = dest->port;
293 } else {
294 /*
295 * Note: persistent fwmark-based services and persistent
296 * port zero service are handled here.
297 * fwmark template: <IPPROTO_IP,caddr,0,fwmark,0,daddr,0>
298 * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
299 */
300 if (svc->fwmark)
301 ct = ip_vs_ct_in_get(IPPROTO_IP, snet, 0,
302 htonl(svc->fwmark), 0);
303 else
304 ct = ip_vs_ct_in_get(iph->protocol, snet, 0,
305 iph->daddr, 0);
306
307 if (!ct || !ip_vs_check_template(ct)) {
308 /*
309 * If it is not persistent port zero, return NULL,
310 * otherwise create a connection template.
311 */
312 if (svc->port)
313 return NULL;
314
315 dest = svc->scheduler->schedule(svc, skb);
316 if (dest == NULL) {
317 IP_VS_DBG(1, "p-schedule: no dest found.\n");
318 return NULL;
319 }
320
321 /*
322 * Create a template according to the service
323 */
324 if (svc->fwmark)
325 ct = ip_vs_conn_new(IPPROTO_IP,
326 snet, 0,
327 htonl(svc->fwmark), 0,
328 dest->addr, 0,
329 IP_VS_CONN_F_TEMPLATE,
330 dest);
331 else
332 ct = ip_vs_conn_new(iph->protocol,
333 snet, 0,
334 iph->daddr, 0,
335 dest->addr, 0,
336 IP_VS_CONN_F_TEMPLATE,
337 dest);
338 if (ct == NULL)
339 return NULL;
340
341 ct->timeout = svc->timeout;
342 } else {
343 /* set destination with the found template */
344 dest = ct->dest;
345 }
346 dport = ports[1];
347 }
348
349 /*
350 * Create a new connection according to the template
351 */
352 cp = ip_vs_conn_new(iph->protocol,
353 iph->saddr, ports[0],
354 iph->daddr, ports[1],
355 dest->addr, dport,
356 0,
357 dest);
358 if (cp == NULL) {
359 ip_vs_conn_put(ct);
360 return NULL;
361 }
362
363 /*
364 * Add its control
365 */
366 ip_vs_control_add(cp, ct);
367 ip_vs_conn_put(ct);
368
369 ip_vs_conn_stats(cp, svc);
370 return cp;
371 }
372
373
374 /*
375 * IPVS main scheduling function
376 * It selects a server according to the virtual service, and
377 * creates a connection entry.
378 * Protocols supported: TCP, UDP
379 */
380 struct ip_vs_conn *
381 ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
382 {
383 struct ip_vs_conn *cp = NULL;
384 struct iphdr *iph = ip_hdr(skb);
385 struct ip_vs_dest *dest;
386 __be16 _ports[2], *pptr;
387
388 pptr = skb_header_pointer(skb, iph->ihl*4,
389 sizeof(_ports), _ports);
390 if (pptr == NULL)
391 return NULL;
392
393 /*
394 * Persistent service
395 */
396 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
397 return ip_vs_sched_persist(svc, skb, pptr);
398
399 /*
400 * Non-persistent service
401 */
402 if (!svc->fwmark && pptr[1] != svc->port) {
403 if (!svc->port)
404 IP_VS_ERR("Schedule: port zero only supported "
405 "in persistent services, "
406 "check your ipvs configuration\n");
407 return NULL;
408 }
409
410 dest = svc->scheduler->schedule(svc, skb);
411 if (dest == NULL) {
412 IP_VS_DBG(1, "Schedule: no dest found.\n");
413 return NULL;
414 }
415
416 /*
417 * Create a connection entry.
418 */
419 cp = ip_vs_conn_new(iph->protocol,
420 iph->saddr, pptr[0],
421 iph->daddr, pptr[1],
422 dest->addr, dest->port?dest->port:pptr[1],
423 0,
424 dest);
425 if (cp == NULL)
426 return NULL;
427
428 IP_VS_DBG(6, "Schedule fwd:%c c:%u.%u.%u.%u:%u v:%u.%u.%u.%u:%u "
429 "d:%u.%u.%u.%u:%u conn->flags:%X conn->refcnt:%d\n",
430 ip_vs_fwd_tag(cp),
431 NIPQUAD(cp->caddr), ntohs(cp->cport),
432 NIPQUAD(cp->vaddr), ntohs(cp->vport),
433 NIPQUAD(cp->daddr), ntohs(cp->dport),
434 cp->flags, atomic_read(&cp->refcnt));
435
436 ip_vs_conn_stats(cp, svc);
437 return cp;
438 }
439
440
441 /*
442 * Pass or drop the packet.
443 * Called by ip_vs_in, when the virtual service is available but
444 * no destination is available for a new connection.
445 */
446 int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
447 struct ip_vs_protocol *pp)
448 {
449 __be16 _ports[2], *pptr;
450 struct iphdr *iph = ip_hdr(skb);
451
452 pptr = skb_header_pointer(skb, iph->ihl*4,
453 sizeof(_ports), _ports);
454 if (pptr == NULL) {
455 ip_vs_service_put(svc);
456 return NF_DROP;
457 }
458
459 /* if it is fwmark-based service, the cache_bypass sysctl is up
460 and the destination is RTN_UNICAST (and not local), then create
461 a cache_bypass connection entry */
462 if (sysctl_ip_vs_cache_bypass && svc->fwmark
463 && (inet_addr_type(iph->daddr) == RTN_UNICAST)) {
464 int ret, cs;
465 struct ip_vs_conn *cp;
466
467 ip_vs_service_put(svc);
468
469 /* create a new connection entry */
470 IP_VS_DBG(6, "ip_vs_leave: create a cache_bypass entry\n");
471 cp = ip_vs_conn_new(iph->protocol,
472 iph->saddr, pptr[0],
473 iph->daddr, pptr[1],
474 0, 0,
475 IP_VS_CONN_F_BYPASS,
476 NULL);
477 if (cp == NULL)
478 return NF_DROP;
479
480 /* statistics */
481 ip_vs_in_stats(cp, skb);
482
483 /* set state */
484 cs = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
485
486 /* transmit the first SYN packet */
487 ret = cp->packet_xmit(skb, cp, pp);
488 /* do not touch skb anymore */
489
490 atomic_inc(&cp->in_pkts);
491 ip_vs_conn_put(cp);
492 return ret;
493 }
494
495 /*
496 * When the virtual ftp service is presented, packets destined
497 * for other services on the VIP may get here (except services
498 * listed in the ipvs table), pass the packets, because it is
499 * not ipvs job to decide to drop the packets.
500 */
501 if ((svc->port == FTPPORT) && (pptr[1] != FTPPORT)) {
502 ip_vs_service_put(svc);
503 return NF_ACCEPT;
504 }
505
506 ip_vs_service_put(svc);
507
508 /*
509 * Notify the client that the destination is unreachable, and
510 * release the socket buffer.
511 * Since it is in IP layer, the TCP socket is not actually
512 * created, the TCP RST packet cannot be sent, instead that
513 * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ
514 */
515 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
516 return NF_DROP;
517 }
518
519
520 /*
521 * It is hooked before NF_IP_PRI_NAT_SRC at the NF_IP_POST_ROUTING
522 * chain, and is used for VS/NAT.
523 * It detects packets for VS/NAT connections and sends the packets
524 * immediately. This can avoid that iptable_nat mangles the packets
525 * for VS/NAT.
526 */
527 static unsigned int ip_vs_post_routing(unsigned int hooknum,
528 struct sk_buff **pskb,
529 const struct net_device *in,
530 const struct net_device *out,
531 int (*okfn)(struct sk_buff *))
532 {
533 if (!((*pskb)->ipvs_property))
534 return NF_ACCEPT;
535 /* The packet was sent from IPVS, exit this chain */
536 return NF_STOP;
537 }
538
539 __sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset)
540 {
541 return csum_fold(skb_checksum(skb, offset, skb->len - offset, 0));
542 }
543
544 static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
545 {
546 int err = ip_defrag(skb, user);
547
548 if (!err)
549 ip_send_check(ip_hdr(skb));
550
551 return err;
552 }
553
554 /*
555 * Packet has been made sufficiently writable in caller
556 * - inout: 1=in->out, 0=out->in
557 */
558 void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
559 struct ip_vs_conn *cp, int inout)
560 {
561 struct iphdr *iph = ip_hdr(skb);
562 unsigned int icmp_offset = iph->ihl*4;
563 struct icmphdr *icmph = (struct icmphdr *)(skb_network_header(skb) +
564 icmp_offset);
565 struct iphdr *ciph = (struct iphdr *)(icmph + 1);
566
567 if (inout) {
568 iph->saddr = cp->vaddr;
569 ip_send_check(iph);
570 ciph->daddr = cp->vaddr;
571 ip_send_check(ciph);
572 } else {
573 iph->daddr = cp->daddr;
574 ip_send_check(iph);
575 ciph->saddr = cp->daddr;
576 ip_send_check(ciph);
577 }
578
579 /* the TCP/UDP port */
580 if (IPPROTO_TCP == ciph->protocol || IPPROTO_UDP == ciph->protocol) {
581 __be16 *ports = (void *)ciph + ciph->ihl*4;
582
583 if (inout)
584 ports[1] = cp->vport;
585 else
586 ports[0] = cp->dport;
587 }
588
589 /* And finally the ICMP checksum */
590 icmph->checksum = 0;
591 icmph->checksum = ip_vs_checksum_complete(skb, icmp_offset);
592 skb->ip_summed = CHECKSUM_UNNECESSARY;
593
594 if (inout)
595 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
596 "Forwarding altered outgoing ICMP");
597 else
598 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
599 "Forwarding altered incoming ICMP");
600 }
601
602 /*
603 * Handle ICMP messages in the inside-to-outside direction (outgoing).
604 * Find any that might be relevant, check against existing connections,
605 * forward to the right destination host if relevant.
606 * Currently handles error types - unreachable, quench, ttl exceeded.
607 * (Only used in VS/NAT)
608 */
609 static int ip_vs_out_icmp(struct sk_buff **pskb, int *related)
610 {
611 struct sk_buff *skb = *pskb;
612 struct iphdr *iph;
613 struct icmphdr _icmph, *ic;
614 struct iphdr _ciph, *cih; /* The ip header contained within the ICMP */
615 struct ip_vs_conn *cp;
616 struct ip_vs_protocol *pp;
617 unsigned int offset, ihl, verdict;
618
619 *related = 1;
620
621 /* reassemble IP fragments */
622 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
623 if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
624 return NF_STOLEN;
625 }
626
627 iph = ip_hdr(skb);
628 offset = ihl = iph->ihl * 4;
629 ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
630 if (ic == NULL)
631 return NF_DROP;
632
633 IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
634 ic->type, ntohs(icmp_id(ic)),
635 NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
636
637 /*
638 * Work through seeing if this is for us.
639 * These checks are supposed to be in an order that means easy
640 * things are checked first to speed up processing.... however
641 * this means that some packets will manage to get a long way
642 * down this stack and then be rejected, but that's life.
643 */
644 if ((ic->type != ICMP_DEST_UNREACH) &&
645 (ic->type != ICMP_SOURCE_QUENCH) &&
646 (ic->type != ICMP_TIME_EXCEEDED)) {
647 *related = 0;
648 return NF_ACCEPT;
649 }
650
651 /* Now find the contained IP header */
652 offset += sizeof(_icmph);
653 cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
654 if (cih == NULL)
655 return NF_ACCEPT; /* The packet looks wrong, ignore */
656
657 pp = ip_vs_proto_get(cih->protocol);
658 if (!pp)
659 return NF_ACCEPT;
660
661 /* Is the embedded protocol header present? */
662 if (unlikely(cih->frag_off & htons(IP_OFFSET) &&
663 pp->dont_defrag))
664 return NF_ACCEPT;
665
666 IP_VS_DBG_PKT(11, pp, skb, offset, "Checking outgoing ICMP for");
667
668 offset += cih->ihl * 4;
669
670 /* The embedded headers contain source and dest in reverse order */
671 cp = pp->conn_out_get(skb, pp, cih, offset, 1);
672 if (!cp)
673 return NF_ACCEPT;
674
675 verdict = NF_DROP;
676
677 if (IP_VS_FWD_METHOD(cp) != 0) {
678 IP_VS_ERR("shouldn't reach here, because the box is on the"
679 "half connection in the tun/dr module.\n");
680 }
681
682 /* Ensure the checksum is correct */
683 if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
684 /* Failed checksum! */
685 IP_VS_DBG(1, "Forward ICMP: failed checksum from %d.%d.%d.%d!\n",
686 NIPQUAD(iph->saddr));
687 goto out;
688 }
689
690 if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
691 offset += 2 * sizeof(__u16);
692 if (!ip_vs_make_skb_writable(pskb, offset))
693 goto out;
694 skb = *pskb;
695
696 ip_vs_nat_icmp(skb, pp, cp, 1);
697
698 /* do the statistics and put it back */
699 ip_vs_out_stats(cp, skb);
700
701 skb->ipvs_property = 1;
702 verdict = NF_ACCEPT;
703
704 out:
705 __ip_vs_conn_put(cp);
706
707 return verdict;
708 }
709
710 static inline int is_tcp_reset(const struct sk_buff *skb)
711 {
712 struct tcphdr _tcph, *th;
713
714 th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
715 if (th == NULL)
716 return 0;
717 return th->rst;
718 }
719
720 /*
721 * It is hooked at the NF_IP_FORWARD chain, used only for VS/NAT.
722 * Check if outgoing packet belongs to the established ip_vs_conn,
723 * rewrite addresses of the packet and send it on its way...
724 */
725 static unsigned int
726 ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
727 const struct net_device *in, const struct net_device *out,
728 int (*okfn)(struct sk_buff *))
729 {
730 struct sk_buff *skb = *pskb;
731 struct iphdr *iph;
732 struct ip_vs_protocol *pp;
733 struct ip_vs_conn *cp;
734 int ihl;
735
736 EnterFunction(11);
737
738 if (skb->ipvs_property)
739 return NF_ACCEPT;
740
741 iph = ip_hdr(skb);
742 if (unlikely(iph->protocol == IPPROTO_ICMP)) {
743 int related, verdict = ip_vs_out_icmp(pskb, &related);
744
745 if (related)
746 return verdict;
747 skb = *pskb;
748 iph = ip_hdr(skb);
749 }
750
751 pp = ip_vs_proto_get(iph->protocol);
752 if (unlikely(!pp))
753 return NF_ACCEPT;
754
755 /* reassemble IP fragments */
756 if (unlikely(iph->frag_off & htons(IP_MF|IP_OFFSET) &&
757 !pp->dont_defrag)) {
758 if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
759 return NF_STOLEN;
760 iph = ip_hdr(skb);
761 }
762
763 ihl = iph->ihl << 2;
764
765 /*
766 * Check if the packet belongs to an existing entry
767 */
768 cp = pp->conn_out_get(skb, pp, iph, ihl, 0);
769
770 if (unlikely(!cp)) {
771 if (sysctl_ip_vs_nat_icmp_send &&
772 (pp->protocol == IPPROTO_TCP ||
773 pp->protocol == IPPROTO_UDP)) {
774 __be16 _ports[2], *pptr;
775
776 pptr = skb_header_pointer(skb, ihl,
777 sizeof(_ports), _ports);
778 if (pptr == NULL)
779 return NF_ACCEPT; /* Not for me */
780 if (ip_vs_lookup_real_service(iph->protocol,
781 iph->saddr, pptr[0])) {
782 /*
783 * Notify the real server: there is no
784 * existing entry if it is not RST
785 * packet or not TCP packet.
786 */
787 if (iph->protocol != IPPROTO_TCP
788 || !is_tcp_reset(skb)) {
789 icmp_send(skb,ICMP_DEST_UNREACH,
790 ICMP_PORT_UNREACH, 0);
791 return NF_DROP;
792 }
793 }
794 }
795 IP_VS_DBG_PKT(12, pp, skb, 0,
796 "packet continues traversal as normal");
797 return NF_ACCEPT;
798 }
799
800 IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
801
802 if (!ip_vs_make_skb_writable(pskb, ihl))
803 goto drop;
804
805 /* mangle the packet */
806 if (pp->snat_handler && !pp->snat_handler(pskb, pp, cp))
807 goto drop;
808 skb = *pskb;
809 ip_hdr(skb)->saddr = cp->vaddr;
810 ip_send_check(ip_hdr(skb));
811
812 /* For policy routing, packets originating from this
813 * machine itself may be routed differently to packets
814 * passing through. We want this packet to be routed as
815 * if it came from this machine itself. So re-compute
816 * the routing information.
817 */
818 if (ip_route_me_harder(pskb, RTN_LOCAL) != 0)
819 goto drop;
820 skb = *pskb;
821
822 IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
823
824 ip_vs_out_stats(cp, skb);
825 ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
826 ip_vs_conn_put(cp);
827
828 skb->ipvs_property = 1;
829
830 LeaveFunction(11);
831 return NF_ACCEPT;
832
833 drop:
834 ip_vs_conn_put(cp);
835 kfree_skb(*pskb);
836 return NF_STOLEN;
837 }
838
839
840 /*
841 * Handle ICMP messages in the outside-to-inside direction (incoming).
842 * Find any that might be relevant, check against existing connections,
843 * forward to the right destination host if relevant.
844 * Currently handles error types - unreachable, quench, ttl exceeded.
845 */
846 static int
847 ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum)
848 {
849 struct sk_buff *skb = *pskb;
850 struct iphdr *iph;
851 struct icmphdr _icmph, *ic;
852 struct iphdr _ciph, *cih; /* The ip header contained within the ICMP */
853 struct ip_vs_conn *cp;
854 struct ip_vs_protocol *pp;
855 unsigned int offset, ihl, verdict;
856
857 *related = 1;
858
859 /* reassemble IP fragments */
860 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
861 if (ip_vs_gather_frags(skb, hooknum == NF_IP_LOCAL_IN ?
862 IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD))
863 return NF_STOLEN;
864 }
865
866 iph = ip_hdr(skb);
867 offset = ihl = iph->ihl * 4;
868 ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
869 if (ic == NULL)
870 return NF_DROP;
871
872 IP_VS_DBG(12, "Incoming ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
873 ic->type, ntohs(icmp_id(ic)),
874 NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
875
876 /*
877 * Work through seeing if this is for us.
878 * These checks are supposed to be in an order that means easy
879 * things are checked first to speed up processing.... however
880 * this means that some packets will manage to get a long way
881 * down this stack and then be rejected, but that's life.
882 */
883 if ((ic->type != ICMP_DEST_UNREACH) &&
884 (ic->type != ICMP_SOURCE_QUENCH) &&
885 (ic->type != ICMP_TIME_EXCEEDED)) {
886 *related = 0;
887 return NF_ACCEPT;
888 }
889
890 /* Now find the contained IP header */
891 offset += sizeof(_icmph);
892 cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
893 if (cih == NULL)
894 return NF_ACCEPT; /* The packet looks wrong, ignore */
895
896 pp = ip_vs_proto_get(cih->protocol);
897 if (!pp)
898 return NF_ACCEPT;
899
900 /* Is the embedded protocol header present? */
901 if (unlikely(cih->frag_off & htons(IP_OFFSET) &&
902 pp->dont_defrag))
903 return NF_ACCEPT;
904
905 IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMP for");
906
907 offset += cih->ihl * 4;
908
909 /* The embedded headers contain source and dest in reverse order */
910 cp = pp->conn_in_get(skb, pp, cih, offset, 1);
911 if (!cp)
912 return NF_ACCEPT;
913
914 verdict = NF_DROP;
915
916 /* Ensure the checksum is correct */
917 if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
918 /* Failed checksum! */
919 IP_VS_DBG(1, "Incoming ICMP: failed checksum from %d.%d.%d.%d!\n",
920 NIPQUAD(iph->saddr));
921 goto out;
922 }
923
924 /* do the statistics and put it back */
925 ip_vs_in_stats(cp, skb);
926 if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
927 offset += 2 * sizeof(__u16);
928 verdict = ip_vs_icmp_xmit(skb, cp, pp, offset);
929 /* do not touch skb anymore */
930
931 out:
932 __ip_vs_conn_put(cp);
933
934 return verdict;
935 }
936
937 /*
938 * Check if it's for virtual services, look it up,
939 * and send it on its way...
940 */
941 static unsigned int
942 ip_vs_in(unsigned int hooknum, struct sk_buff **pskb,
943 const struct net_device *in, const struct net_device *out,
944 int (*okfn)(struct sk_buff *))
945 {
946 struct sk_buff *skb = *pskb;
947 struct iphdr *iph;
948 struct ip_vs_protocol *pp;
949 struct ip_vs_conn *cp;
950 int ret, restart;
951 int ihl;
952
953 /*
954 * Big tappo: only PACKET_HOST (neither loopback nor mcasts)
955 * ... don't know why 1st test DOES NOT include 2nd (?)
956 */
957 if (unlikely(skb->pkt_type != PACKET_HOST
958 || skb->dev == &loopback_dev || skb->sk)) {
959 IP_VS_DBG(12, "packet type=%d proto=%d daddr=%d.%d.%d.%d ignored\n",
960 skb->pkt_type,
961 ip_hdr(skb)->protocol,
962 NIPQUAD(ip_hdr(skb)->daddr));
963 return NF_ACCEPT;
964 }
965
966 iph = ip_hdr(skb);
967 if (unlikely(iph->protocol == IPPROTO_ICMP)) {
968 int related, verdict = ip_vs_in_icmp(pskb, &related, hooknum);
969
970 if (related)
971 return verdict;
972 skb = *pskb;
973 iph = ip_hdr(skb);
974 }
975
976 /* Protocol supported? */
977 pp = ip_vs_proto_get(iph->protocol);
978 if (unlikely(!pp))
979 return NF_ACCEPT;
980
981 ihl = iph->ihl << 2;
982
983 /*
984 * Check if the packet belongs to an existing connection entry
985 */
986 cp = pp->conn_in_get(skb, pp, iph, ihl, 0);
987
988 if (unlikely(!cp)) {
989 int v;
990
991 if (!pp->conn_schedule(skb, pp, &v, &cp))
992 return v;
993 }
994
995 if (unlikely(!cp)) {
996 /* sorry, all this trouble for a no-hit :) */
997 IP_VS_DBG_PKT(12, pp, skb, 0,
998 "packet continues traversal as normal");
999 return NF_ACCEPT;
1000 }
1001
1002 IP_VS_DBG_PKT(11, pp, skb, 0, "Incoming packet");
1003
1004 /* Check the server status */
1005 if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
1006 /* the destination server is not available */
1007
1008 if (sysctl_ip_vs_expire_nodest_conn) {
1009 /* try to expire the connection immediately */
1010 ip_vs_conn_expire_now(cp);
1011 }
1012 /* don't restart its timer, and silently
1013 drop the packet. */
1014 __ip_vs_conn_put(cp);
1015 return NF_DROP;
1016 }
1017
1018 ip_vs_in_stats(cp, skb);
1019 restart = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
1020 if (cp->packet_xmit)
1021 ret = cp->packet_xmit(skb, cp, pp);
1022 /* do not touch skb anymore */
1023 else {
1024 IP_VS_DBG_RL("warning: packet_xmit is null");
1025 ret = NF_ACCEPT;
1026 }
1027
1028 /* increase its packet counter and check if it is needed
1029 to be synchronized */
1030 atomic_inc(&cp->in_pkts);
1031 if ((ip_vs_sync_state & IP_VS_STATE_MASTER) &&
1032 (cp->protocol != IPPROTO_TCP ||
1033 cp->state == IP_VS_TCP_S_ESTABLISHED) &&
1034 (atomic_read(&cp->in_pkts) % sysctl_ip_vs_sync_threshold[1]
1035 == sysctl_ip_vs_sync_threshold[0]))
1036 ip_vs_sync_conn(cp);
1037
1038 ip_vs_conn_put(cp);
1039 return ret;
1040 }
1041
1042
1043 /*
1044 * It is hooked at the NF_IP_FORWARD chain, in order to catch ICMP
1045 * related packets destined for 0.0.0.0/0.
1046 * When fwmark-based virtual service is used, such as transparent
1047 * cache cluster, TCP packets can be marked and routed to ip_vs_in,
1048 * but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
1049 * sent to ip_vs_in_icmp. So, catch them at the NF_IP_FORWARD chain
1050 * and send them to ip_vs_in_icmp.
1051 */
1052 static unsigned int
1053 ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff **pskb,
1054 const struct net_device *in, const struct net_device *out,
1055 int (*okfn)(struct sk_buff *))
1056 {
1057 int r;
1058
1059 if (ip_hdr(*pskb)->protocol != IPPROTO_ICMP)
1060 return NF_ACCEPT;
1061
1062 return ip_vs_in_icmp(pskb, &r, hooknum);
1063 }
1064
1065
1066 /* After packet filtering, forward packet through VS/DR, VS/TUN,
1067 or VS/NAT(change destination), so that filtering rules can be
1068 applied to IPVS. */
1069 static struct nf_hook_ops ip_vs_in_ops = {
1070 .hook = ip_vs_in,
1071 .owner = THIS_MODULE,
1072 .pf = PF_INET,
1073 .hooknum = NF_IP_LOCAL_IN,
1074 .priority = 100,
1075 };
1076
1077 /* After packet filtering, change source only for VS/NAT */
1078 static struct nf_hook_ops ip_vs_out_ops = {
1079 .hook = ip_vs_out,
1080 .owner = THIS_MODULE,
1081 .pf = PF_INET,
1082 .hooknum = NF_IP_FORWARD,
1083 .priority = 100,
1084 };
1085
1086 /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1087 destined for 0.0.0.0/0, which is for incoming IPVS connections */
1088 static struct nf_hook_ops ip_vs_forward_icmp_ops = {
1089 .hook = ip_vs_forward_icmp,
1090 .owner = THIS_MODULE,
1091 .pf = PF_INET,
1092 .hooknum = NF_IP_FORWARD,
1093 .priority = 99,
1094 };
1095
1096 /* Before the netfilter connection tracking, exit from POST_ROUTING */
1097 static struct nf_hook_ops ip_vs_post_routing_ops = {
1098 .hook = ip_vs_post_routing,
1099 .owner = THIS_MODULE,
1100 .pf = PF_INET,
1101 .hooknum = NF_IP_POST_ROUTING,
1102 .priority = NF_IP_PRI_NAT_SRC-1,
1103 };
1104
1105
1106 /*
1107 * Initialize IP Virtual Server
1108 */
1109 static int __init ip_vs_init(void)
1110 {
1111 int ret;
1112
1113 ret = ip_vs_control_init();
1114 if (ret < 0) {
1115 IP_VS_ERR("can't setup control.\n");
1116 goto cleanup_nothing;
1117 }
1118
1119 ip_vs_protocol_init();
1120
1121 ret = ip_vs_app_init();
1122 if (ret < 0) {
1123 IP_VS_ERR("can't setup application helper.\n");
1124 goto cleanup_protocol;
1125 }
1126
1127 ret = ip_vs_conn_init();
1128 if (ret < 0) {
1129 IP_VS_ERR("can't setup connection table.\n");
1130 goto cleanup_app;
1131 }
1132
1133 ret = nf_register_hook(&ip_vs_in_ops);
1134 if (ret < 0) {
1135 IP_VS_ERR("can't register in hook.\n");
1136 goto cleanup_conn;
1137 }
1138
1139 ret = nf_register_hook(&ip_vs_out_ops);
1140 if (ret < 0) {
1141 IP_VS_ERR("can't register out hook.\n");
1142 goto cleanup_inops;
1143 }
1144 ret = nf_register_hook(&ip_vs_post_routing_ops);
1145 if (ret < 0) {
1146 IP_VS_ERR("can't register post_routing hook.\n");
1147 goto cleanup_outops;
1148 }
1149 ret = nf_register_hook(&ip_vs_forward_icmp_ops);
1150 if (ret < 0) {
1151 IP_VS_ERR("can't register forward_icmp hook.\n");
1152 goto cleanup_postroutingops;
1153 }
1154
1155 IP_VS_INFO("ipvs loaded.\n");
1156 return ret;
1157
1158 cleanup_postroutingops:
1159 nf_unregister_hook(&ip_vs_post_routing_ops);
1160 cleanup_outops:
1161 nf_unregister_hook(&ip_vs_out_ops);
1162 cleanup_inops:
1163 nf_unregister_hook(&ip_vs_in_ops);
1164 cleanup_conn:
1165 ip_vs_conn_cleanup();
1166 cleanup_app:
1167 ip_vs_app_cleanup();
1168 cleanup_protocol:
1169 ip_vs_protocol_cleanup();
1170 ip_vs_control_cleanup();
1171 cleanup_nothing:
1172 return ret;
1173 }
1174
1175 static void __exit ip_vs_cleanup(void)
1176 {
1177 nf_unregister_hook(&ip_vs_forward_icmp_ops);
1178 nf_unregister_hook(&ip_vs_post_routing_ops);
1179 nf_unregister_hook(&ip_vs_out_ops);
1180 nf_unregister_hook(&ip_vs_in_ops);
1181 ip_vs_conn_cleanup();
1182 ip_vs_app_cleanup();
1183 ip_vs_protocol_cleanup();
1184 ip_vs_control_cleanup();
1185 IP_VS_INFO("ipvs unloaded.\n");
1186 }
1187
1188 module_init(ip_vs_init);
1189 module_exit(ip_vs_cleanup);
1190 MODULE_LICENSE("GPL");
Tomato firmware and modifications.