1/* 2 * IPVS An implementation of the IP virtual server support for the 3 * LINUX operating system. IPVS is now implemented as a module 4 * over the Netfilter framework. IPVS can be used to build a 5 * high-performance and highly available server based on a 6 * cluster of servers. 7 * 8 * Version: $Id: ip_vs_core.c,v 1.1.1.1 2007/08/03 18:53:51 Exp $ 9 * 10 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org> 11 * Peter Kese <peter.kese@ijs.si> 12 * Julian Anastasov <ja@ssi.bg> 13 * 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese, 20 * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms 21 * and others. 22 * 23 * Changes: 24 * Paul `Rusty' Russell properly handle non-linear skbs 25 * Harald Welte don't use nfcache 26 * 27 */ 28 29#include <linux/module.h> 30#include <linux/kernel.h> 31#include <linux/ip.h> 32#include <linux/tcp.h> 33#include <linux/icmp.h> 34 35#include <net/ip.h> 36#include <net/tcp.h> 37#include <net/udp.h> 38#include <net/icmp.h> /* for icmp_send */ 39#include <net/route.h> 40 41#include <linux/netfilter.h> 42#include <linux/netfilter_ipv4.h> 43 44#include <net/ip_vs.h> 45 46 47EXPORT_SYMBOL(register_ip_vs_scheduler); 48EXPORT_SYMBOL(unregister_ip_vs_scheduler); 49EXPORT_SYMBOL(ip_vs_skb_replace); 50EXPORT_SYMBOL(ip_vs_proto_name); 51EXPORT_SYMBOL(ip_vs_conn_new); 52EXPORT_SYMBOL(ip_vs_conn_in_get); 53EXPORT_SYMBOL(ip_vs_conn_out_get); 54#ifdef CONFIG_IP_VS_PROTO_TCP 55EXPORT_SYMBOL(ip_vs_tcp_conn_listen); 56#endif 57EXPORT_SYMBOL(ip_vs_conn_put); 58#ifdef CONFIG_IP_VS_DEBUG 59EXPORT_SYMBOL(ip_vs_get_debug_level); 60#endif 61EXPORT_SYMBOL(ip_vs_make_skb_writable); 62 63 64/* ID used in ICMP lookups */ 65#define icmp_id(icmph) (((icmph)->un).echo.id) 66 67const char *ip_vs_proto_name(unsigned proto) 68{ 69 static char buf[20]; 70 71 switch (proto) { 72 case IPPROTO_IP: 73 return "IP"; 74 case IPPROTO_UDP: 75 return "UDP"; 76 case IPPROTO_TCP: 77 return "TCP"; 78 case IPPROTO_ICMP: 79 return "ICMP"; 80 default: 81 sprintf(buf, "IP_%d", proto); 82 return buf; 83 } 84} 85 86void ip_vs_init_hash_table(struct list_head *table, int rows) 87{ 88 while (--rows >= 0) 89 INIT_LIST_HEAD(&table[rows]); 90} 91 92static inline void 93ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb) 94{ 95 struct ip_vs_dest *dest = cp->dest; 96 if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) { 97 spin_lock(&dest->stats.lock); 98 dest->stats.inpkts++; 99 dest->stats.inbytes += skb->len; 100 spin_unlock(&dest->stats.lock); 101 102 spin_lock(&dest->svc->stats.lock); 103 dest->svc->stats.inpkts++; 104 dest->svc->stats.inbytes += skb->len; 105 spin_unlock(&dest->svc->stats.lock); 106 107 spin_lock(&ip_vs_stats.lock); 108 ip_vs_stats.inpkts++; 109 ip_vs_stats.inbytes += skb->len; 110 spin_unlock(&ip_vs_stats.lock); 111 } 112} 113 114 115static inline void 116ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb) 117{ 118 struct ip_vs_dest *dest = cp->dest; 119 if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) { 120 spin_lock(&dest->stats.lock); 121 dest->stats.outpkts++; 122 dest->stats.outbytes += skb->len; 123 spin_unlock(&dest->stats.lock); 124 125 spin_lock(&dest->svc->stats.lock); 126 dest->svc->stats.outpkts++; 127 dest->svc->stats.outbytes += skb->len; 128 spin_unlock(&dest->svc->stats.lock); 129 130 spin_lock(&ip_vs_stats.lock); 131 ip_vs_stats.outpkts++; 132 ip_vs_stats.outbytes += skb->len; 133 spin_unlock(&ip_vs_stats.lock); 134 } 135} 136 137 138static inline void 139ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc) 140{ 141 spin_lock(&cp->dest->stats.lock); 142 cp->dest->stats.conns++; 143 spin_unlock(&cp->dest->stats.lock); 144 145 spin_lock(&svc->stats.lock); 146 svc->stats.conns++; 147 spin_unlock(&svc->stats.lock); 148 149 spin_lock(&ip_vs_stats.lock); 150 ip_vs_stats.conns++; 151 spin_unlock(&ip_vs_stats.lock); 152} 153 154 155static inline int 156ip_vs_set_state(struct ip_vs_conn *cp, int direction, 157 const struct sk_buff *skb, 158 struct ip_vs_protocol *pp) 159{ 160 if (unlikely(!pp->state_transition)) 161 return 0; 162 return pp->state_transition(cp, direction, skb, pp); 163} 164 165 166int ip_vs_make_skb_writable(struct sk_buff **pskb, int writable_len) 167{ 168 struct sk_buff *skb = *pskb; 169 170 /* skb is already used, better copy skb and its payload */ 171 if (unlikely(skb_shared(skb) || skb->sk)) 172 goto copy_skb; 173 174 /* skb data is already used, copy it */ 175 if (unlikely(skb_cloned(skb))) 176 goto copy_data; 177 178 return pskb_may_pull(skb, writable_len); 179 180 copy_data: 181 if (unlikely(writable_len > skb->len)) 182 return 0; 183 return !pskb_expand_head(skb, 0, 0, GFP_ATOMIC); 184 185 copy_skb: 186 if (unlikely(writable_len > skb->len)) 187 return 0; 188 skb = skb_copy(skb, GFP_ATOMIC); 189 if (!skb) 190 return 0; 191 BUG_ON(skb_is_nonlinear(skb)); 192 193 /* Rest of kernel will get very unhappy if we pass it a 194 suddenly-orphaned skbuff */ 195 if ((*pskb)->sk) 196 skb_set_owner_w(skb, (*pskb)->sk); 197 kfree_skb(*pskb); 198 *pskb = skb; 199 return 1; 200} 201 202/* 203 * IPVS persistent scheduling function 204 * It creates a connection entry according to its template if exists, 205 * or selects a server and creates a connection entry plus a template. 206 * Locking: we are svc user (svc->refcnt), so we hold all dests too 207 * Protocols supported: TCP, UDP 208 */ 209static struct ip_vs_conn * 210ip_vs_sched_persist(struct ip_vs_service *svc, 211 const struct sk_buff *skb, 212 __be16 ports[2]) 213{ 214 struct ip_vs_conn *cp = NULL; 215 struct iphdr *iph = ip_hdr(skb); 216 struct ip_vs_dest *dest; 217 struct ip_vs_conn *ct; 218 __be16 dport; /* destination port to forward */ 219 __be32 snet; /* source network of the client, after masking */ 220 221 /* Mask saddr with the netmask to adjust template granularity */ 222 snet = iph->saddr & svc->netmask; 223 224 IP_VS_DBG(6, "p-schedule: src %u.%u.%u.%u:%u dest %u.%u.%u.%u:%u " 225 "mnet %u.%u.%u.%u\n", 226 NIPQUAD(iph->saddr), ntohs(ports[0]), 227 NIPQUAD(iph->daddr), ntohs(ports[1]), 228 NIPQUAD(snet)); 229 230 /* 231 * As far as we know, FTP is a very complicated network protocol, and 232 * it uses control connection and data connections. For active FTP, 233 * FTP server initialize data connection to the client, its source port 234 * is often 20. For passive FTP, FTP server tells the clients the port 235 * that it passively listens to, and the client issues the data 236 * connection. In the tunneling or direct routing mode, the load 237 * balancer is on the client-to-server half of connection, the port 238 * number is unknown to the load balancer. So, a conn template like 239 * <caddr, 0, vaddr, 0, daddr, 0> is created for persistent FTP 240 * service, and a template like <caddr, 0, vaddr, vport, daddr, dport> 241 * is created for other persistent services. 242 */ 243 if (ports[1] == svc->port) { 244 /* Check if a template already exists */ 245 if (svc->port != FTPPORT) 246 ct = ip_vs_ct_in_get(iph->protocol, snet, 0, 247 iph->daddr, ports[1]); 248 else 249 ct = ip_vs_ct_in_get(iph->protocol, snet, 0, 250 iph->daddr, 0); 251 252 if (!ct || !ip_vs_check_template(ct)) { 253 /* 254 * No template found or the dest of the connection 255 * template is not available. 256 */ 257 dest = svc->scheduler->schedule(svc, skb); 258 if (dest == NULL) { 259 IP_VS_DBG(1, "p-schedule: no dest found.\n"); 260 return NULL; 261 } 262 263 /* 264 * Create a template like <protocol,caddr,0, 265 * vaddr,vport,daddr,dport> for non-ftp service, 266 * and <protocol,caddr,0,vaddr,0,daddr,0> 267 * for ftp service. 268 */ 269 if (svc->port != FTPPORT) 270 ct = ip_vs_conn_new(iph->protocol, 271 snet, 0, 272 iph->daddr, 273 ports[1], 274 dest->addr, dest->port, 275 IP_VS_CONN_F_TEMPLATE, 276 dest); 277 else 278 ct = ip_vs_conn_new(iph->protocol, 279 snet, 0, 280 iph->daddr, 0, 281 dest->addr, 0, 282 IP_VS_CONN_F_TEMPLATE, 283 dest); 284 if (ct == NULL) 285 return NULL; 286 287 ct->timeout = svc->timeout; 288 } else { 289 /* set destination with the found template */ 290 dest = ct->dest; 291 } 292 dport = dest->port; 293 } else { 294 /* 295 * Note: persistent fwmark-based services and persistent 296 * port zero service are handled here. 297 * fwmark template: <IPPROTO_IP,caddr,0,fwmark,0,daddr,0> 298 * port zero template: <protocol,caddr,0,vaddr,0,daddr,0> 299 */ 300 if (svc->fwmark) 301 ct = ip_vs_ct_in_get(IPPROTO_IP, snet, 0, 302 htonl(svc->fwmark), 0); 303 else 304 ct = ip_vs_ct_in_get(iph->protocol, snet, 0, 305 iph->daddr, 0); 306 307 if (!ct || !ip_vs_check_template(ct)) { 308 /* 309 * If it is not persistent port zero, return NULL, 310 * otherwise create a connection template. 311 */ 312 if (svc->port) 313 return NULL; 314 315 dest = svc->scheduler->schedule(svc, skb); 316 if (dest == NULL) { 317 IP_VS_DBG(1, "p-schedule: no dest found.\n"); 318 return NULL; 319 } 320 321 /* 322 * Create a template according to the service 323 */ 324 if (svc->fwmark) 325 ct = ip_vs_conn_new(IPPROTO_IP, 326 snet, 0, 327 htonl(svc->fwmark), 0, 328 dest->addr, 0, 329 IP_VS_CONN_F_TEMPLATE, 330 dest); 331 else 332 ct = ip_vs_conn_new(iph->protocol, 333 snet, 0, 334 iph->daddr, 0, 335 dest->addr, 0, 336 IP_VS_CONN_F_TEMPLATE, 337 dest); 338 if (ct == NULL) 339 return NULL; 340 341 ct->timeout = svc->timeout; 342 } else { 343 /* set destination with the found template */ 344 dest = ct->dest; 345 } 346 dport = ports[1]; 347 } 348 349 /* 350 * Create a new connection according to the template 351 */ 352 cp = ip_vs_conn_new(iph->protocol, 353 iph->saddr, ports[0], 354 iph->daddr, ports[1], 355 dest->addr, dport, 356 0, 357 dest); 358 if (cp == NULL) { 359 ip_vs_conn_put(ct); 360 return NULL; 361 } 362 363 /* 364 * Add its control 365 */ 366 ip_vs_control_add(cp, ct); 367 ip_vs_conn_put(ct); 368 369 ip_vs_conn_stats(cp, svc); 370 return cp; 371} 372 373 374/* 375 * IPVS main scheduling function 376 * It selects a server according to the virtual service, and 377 * creates a connection entry. 378 * Protocols supported: TCP, UDP 379 */ 380struct ip_vs_conn * 381ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb) 382{ 383 struct ip_vs_conn *cp = NULL; 384 struct iphdr *iph = ip_hdr(skb); 385 struct ip_vs_dest *dest; 386 __be16 _ports[2], *pptr; 387 388 pptr = skb_header_pointer(skb, iph->ihl*4, 389 sizeof(_ports), _ports); 390 if (pptr == NULL) 391 return NULL; 392 393 /* 394 * Persistent service 395 */ 396 if (svc->flags & IP_VS_SVC_F_PERSISTENT) 397 return ip_vs_sched_persist(svc, skb, pptr); 398 399 /* 400 * Non-persistent service 401 */ 402 if (!svc->fwmark && pptr[1] != svc->port) { 403 if (!svc->port) 404 IP_VS_ERR("Schedule: port zero only supported " 405 "in persistent services, " 406 "check your ipvs configuration\n"); 407 return NULL; 408 } 409 410 dest = svc->scheduler->schedule(svc, skb); 411 if (dest == NULL) { 412 IP_VS_DBG(1, "Schedule: no dest found.\n"); 413 return NULL; 414 } 415 416 /* 417 * Create a connection entry. 418 */ 419 cp = ip_vs_conn_new(iph->protocol, 420 iph->saddr, pptr[0], 421 iph->daddr, pptr[1], 422 dest->addr, dest->port?dest->port:pptr[1], 423 0, 424 dest); 425 if (cp == NULL) 426 return NULL; 427 428 IP_VS_DBG(6, "Schedule fwd:%c c:%u.%u.%u.%u:%u v:%u.%u.%u.%u:%u " 429 "d:%u.%u.%u.%u:%u conn->flags:%X conn->refcnt:%d\n", 430 ip_vs_fwd_tag(cp), 431 NIPQUAD(cp->caddr), ntohs(cp->cport), 432 NIPQUAD(cp->vaddr), ntohs(cp->vport), 433 NIPQUAD(cp->daddr), ntohs(cp->dport), 434 cp->flags, atomic_read(&cp->refcnt)); 435 436 ip_vs_conn_stats(cp, svc); 437 return cp; 438} 439 440 441/* 442 * Pass or drop the packet. 443 * Called by ip_vs_in, when the virtual service is available but 444 * no destination is available for a new connection. 445 */ 446int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, 447 struct ip_vs_protocol *pp) 448{ 449 __be16 _ports[2], *pptr; 450 struct iphdr *iph = ip_hdr(skb); 451 452 pptr = skb_header_pointer(skb, iph->ihl*4, 453 sizeof(_ports), _ports); 454 if (pptr == NULL) { 455 ip_vs_service_put(svc); 456 return NF_DROP; 457 } 458 459 /* if it is fwmark-based service, the cache_bypass sysctl is up 460 and the destination is RTN_UNICAST (and not local), then create 461 a cache_bypass connection entry */ 462 if (sysctl_ip_vs_cache_bypass && svc->fwmark 463 && (inet_addr_type(iph->daddr) == RTN_UNICAST)) { 464 int ret, cs; 465 struct ip_vs_conn *cp; 466 467 ip_vs_service_put(svc); 468 469 /* create a new connection entry */ 470 IP_VS_DBG(6, "ip_vs_leave: create a cache_bypass entry\n"); 471 cp = ip_vs_conn_new(iph->protocol, 472 iph->saddr, pptr[0], 473 iph->daddr, pptr[1], 474 0, 0, 475 IP_VS_CONN_F_BYPASS, 476 NULL); 477 if (cp == NULL) 478 return NF_DROP; 479 480 /* statistics */ 481 ip_vs_in_stats(cp, skb); 482 483 /* set state */ 484 cs = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp); 485 486 /* transmit the first SYN packet */ 487 ret = cp->packet_xmit(skb, cp, pp); 488 /* do not touch skb anymore */ 489 490 atomic_inc(&cp->in_pkts); 491 ip_vs_conn_put(cp); 492 return ret; 493 } 494 495 /* 496 * When the virtual ftp service is presented, packets destined 497 * for other services on the VIP may get here (except services 498 * listed in the ipvs table), pass the packets, because it is 499 * not ipvs job to decide to drop the packets. 500 */ 501 if ((svc->port == FTPPORT) && (pptr[1] != FTPPORT)) { 502 ip_vs_service_put(svc); 503 return NF_ACCEPT; 504 } 505 506 ip_vs_service_put(svc); 507 508 /* 509 * Notify the client that the destination is unreachable, and 510 * release the socket buffer. 511 * Since it is in IP layer, the TCP socket is not actually 512 * created, the TCP RST packet cannot be sent, instead that 513 * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ 514 */ 515 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); 516 return NF_DROP; 517} 518 519 520/* 521 * It is hooked before NF_IP_PRI_NAT_SRC at the NF_IP_POST_ROUTING 522 * chain, and is used for VS/NAT. 523 * It detects packets for VS/NAT connections and sends the packets 524 * immediately. This can avoid that iptable_nat mangles the packets 525 * for VS/NAT. 526 */ 527static unsigned int ip_vs_post_routing(unsigned int hooknum, 528 struct sk_buff **pskb, 529 const struct net_device *in, 530 const struct net_device *out, 531 int (*okfn)(struct sk_buff *)) 532{ 533 if (!((*pskb)->ipvs_property)) 534 return NF_ACCEPT; 535 /* The packet was sent from IPVS, exit this chain */ 536 return NF_STOP; 537} 538 539__sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset) 540{ 541 return csum_fold(skb_checksum(skb, offset, skb->len - offset, 0)); 542} 543 544static inline struct sk_buff * 545ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user) 546{ 547 skb = ip_defrag(skb, user); 548 if (skb) 549 ip_send_check(ip_hdr(skb)); 550 return skb; 551} 552 553/* 554 * Packet has been made sufficiently writable in caller 555 * - inout: 1=in->out, 0=out->in 556 */ 557void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp, 558 struct ip_vs_conn *cp, int inout) 559{ 560 struct iphdr *iph = ip_hdr(skb); 561 unsigned int icmp_offset = iph->ihl*4; 562 struct icmphdr *icmph = (struct icmphdr *)(skb_network_header(skb) + 563 icmp_offset); 564 struct iphdr *ciph = (struct iphdr *)(icmph + 1); 565 566 if (inout) { 567 iph->saddr = cp->vaddr; 568 ip_send_check(iph); 569 ciph->daddr = cp->vaddr; 570 ip_send_check(ciph); 571 } else { 572 iph->daddr = cp->daddr; 573 ip_send_check(iph); 574 ciph->saddr = cp->daddr; 575 ip_send_check(ciph); 576 } 577 578 /* the TCP/UDP port */ 579 if (IPPROTO_TCP == ciph->protocol || IPPROTO_UDP == ciph->protocol) { 580 __be16 *ports = (void *)ciph + ciph->ihl*4; 581 582 if (inout) 583 ports[1] = cp->vport; 584 else 585 ports[0] = cp->dport; 586 } 587 588 /* And finally the ICMP checksum */ 589 icmph->checksum = 0; 590 icmph->checksum = ip_vs_checksum_complete(skb, icmp_offset); 591 skb->ip_summed = CHECKSUM_UNNECESSARY; 592 593 if (inout) 594 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph, 595 "Forwarding altered outgoing ICMP"); 596 else 597 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph, 598 "Forwarding altered incoming ICMP"); 599} 600 601/* 602 * Handle ICMP messages in the inside-to-outside direction (outgoing). 603 * Find any that might be relevant, check against existing connections, 604 * forward to the right destination host if relevant. 605 * Currently handles error types - unreachable, quench, ttl exceeded. 606 * (Only used in VS/NAT) 607 */ 608static int ip_vs_out_icmp(struct sk_buff **pskb, int *related) 609{ 610 struct sk_buff *skb = *pskb; 611 struct iphdr *iph; 612 struct icmphdr _icmph, *ic; 613 struct iphdr _ciph, *cih; /* The ip header contained within the ICMP */ 614 struct ip_vs_conn *cp; 615 struct ip_vs_protocol *pp; 616 unsigned int offset, ihl, verdict; 617 618 *related = 1; 619 620 /* reassemble IP fragments */ 621 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { 622 skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT); 623 if (!skb) 624 return NF_STOLEN; 625 *pskb = skb; 626 } 627 628 iph = ip_hdr(skb); 629 offset = ihl = iph->ihl * 4; 630 ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph); 631 if (ic == NULL) 632 return NF_DROP; 633 634 IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n", 635 ic->type, ntohs(icmp_id(ic)), 636 NIPQUAD(iph->saddr), NIPQUAD(iph->daddr)); 637 638 /* 639 * Work through seeing if this is for us. 640 * These checks are supposed to be in an order that means easy 641 * things are checked first to speed up processing.... however 642 * this means that some packets will manage to get a long way 643 * down this stack and then be rejected, but that's life. 644 */ 645 if ((ic->type != ICMP_DEST_UNREACH) && 646 (ic->type != ICMP_SOURCE_QUENCH) && 647 (ic->type != ICMP_TIME_EXCEEDED)) { 648 *related = 0; 649 return NF_ACCEPT; 650 } 651 652 /* Now find the contained IP header */ 653 offset += sizeof(_icmph); 654 cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph); 655 if (cih == NULL) 656 return NF_ACCEPT; /* The packet looks wrong, ignore */ 657 658 pp = ip_vs_proto_get(cih->protocol); 659 if (!pp) 660 return NF_ACCEPT; 661 662 /* Is the embedded protocol header present? */ 663 if (unlikely(cih->frag_off & htons(IP_OFFSET) && 664 pp->dont_defrag)) 665 return NF_ACCEPT; 666 667 IP_VS_DBG_PKT(11, pp, skb, offset, "Checking outgoing ICMP for"); 668 669 offset += cih->ihl * 4; 670 671 /* The embedded headers contain source and dest in reverse order */ 672 cp = pp->conn_out_get(skb, pp, cih, offset, 1); 673 if (!cp) 674 return NF_ACCEPT; 675 676 verdict = NF_DROP; 677 678 if (IP_VS_FWD_METHOD(cp) != 0) { 679 IP_VS_ERR("shouldn't reach here, because the box is on the" 680 "half connection in the tun/dr module.\n"); 681 } 682 683 /* Ensure the checksum is correct */ 684 if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) { 685 /* Failed checksum! */ 686 IP_VS_DBG(1, "Forward ICMP: failed checksum from %d.%d.%d.%d!\n", 687 NIPQUAD(iph->saddr)); 688 goto out; 689 } 690 691 if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol) 692 offset += 2 * sizeof(__u16); 693 if (!ip_vs_make_skb_writable(pskb, offset)) 694 goto out; 695 skb = *pskb; 696 697 ip_vs_nat_icmp(skb, pp, cp, 1); 698 699 /* do the statistics and put it back */ 700 ip_vs_out_stats(cp, skb); 701 702 skb->ipvs_property = 1; 703 verdict = NF_ACCEPT; 704 705 out: 706 __ip_vs_conn_put(cp); 707 708 return verdict; 709} 710 711static inline int is_tcp_reset(const struct sk_buff *skb) 712{ 713 struct tcphdr _tcph, *th; 714 715 th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph); 716 if (th == NULL) 717 return 0; 718 return th->rst; 719} 720 721/* 722 * It is hooked at the NF_IP_FORWARD chain, used only for VS/NAT. 723 * Check if outgoing packet belongs to the established ip_vs_conn, 724 * rewrite addresses of the packet and send it on its way... 725 */ 726static unsigned int 727ip_vs_out(unsigned int hooknum, struct sk_buff **pskb, 728 const struct net_device *in, const struct net_device *out, 729 int (*okfn)(struct sk_buff *)) 730{ 731 struct sk_buff *skb = *pskb; 732 struct iphdr *iph; 733 struct ip_vs_protocol *pp; 734 struct ip_vs_conn *cp; 735 int ihl; 736 737 EnterFunction(11); 738 739 if (skb->ipvs_property) 740 return NF_ACCEPT; 741 742 iph = ip_hdr(skb); 743 if (unlikely(iph->protocol == IPPROTO_ICMP)) { 744 int related, verdict = ip_vs_out_icmp(pskb, &related); 745 746 if (related) 747 return verdict; 748 skb = *pskb; 749 iph = ip_hdr(skb); 750 } 751 752 pp = ip_vs_proto_get(iph->protocol); 753 if (unlikely(!pp)) 754 return NF_ACCEPT; 755 756 /* reassemble IP fragments */ 757 if (unlikely(iph->frag_off & htons(IP_MF|IP_OFFSET) && 758 !pp->dont_defrag)) { 759 skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT); 760 if (!skb) 761 return NF_STOLEN; 762 iph = ip_hdr(skb); 763 *pskb = skb; 764 } 765 766 ihl = iph->ihl << 2; 767 768 /* 769 * Check if the packet belongs to an existing entry 770 */ 771 cp = pp->conn_out_get(skb, pp, iph, ihl, 0); 772 773 if (unlikely(!cp)) { 774 if (sysctl_ip_vs_nat_icmp_send && 775 (pp->protocol == IPPROTO_TCP || 776 pp->protocol == IPPROTO_UDP)) { 777 __be16 _ports[2], *pptr; 778 779 pptr = skb_header_pointer(skb, ihl, 780 sizeof(_ports), _ports); 781 if (pptr == NULL) 782 return NF_ACCEPT; /* Not for me */ 783 if (ip_vs_lookup_real_service(iph->protocol, 784 iph->saddr, pptr[0])) { 785 /* 786 * Notify the real server: there is no 787 * existing entry if it is not RST 788 * packet or not TCP packet. 789 */ 790 if (iph->protocol != IPPROTO_TCP 791 || !is_tcp_reset(skb)) { 792 icmp_send(skb,ICMP_DEST_UNREACH, 793 ICMP_PORT_UNREACH, 0); 794 return NF_DROP; 795 } 796 } 797 } 798 IP_VS_DBG_PKT(12, pp, skb, 0, 799 "packet continues traversal as normal"); 800 return NF_ACCEPT; 801 } 802 803 IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet"); 804 805 if (!ip_vs_make_skb_writable(pskb, ihl)) 806 goto drop; 807 808 /* mangle the packet */ 809 if (pp->snat_handler && !pp->snat_handler(pskb, pp, cp)) 810 goto drop; 811 skb = *pskb; 812 ip_hdr(skb)->saddr = cp->vaddr; 813 ip_send_check(ip_hdr(skb)); 814 815 /* For policy routing, packets originating from this 816 * machine itself may be routed differently to packets 817 * passing through. We want this packet to be routed as 818 * if it came from this machine itself. So re-compute 819 * the routing information. 820 */ 821 if (ip_route_me_harder(pskb, RTN_LOCAL) != 0) 822 goto drop; 823 skb = *pskb; 824 825 IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT"); 826 827 ip_vs_out_stats(cp, skb); 828 ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp); 829 ip_vs_conn_put(cp); 830 831 skb->ipvs_property = 1; 832 833 LeaveFunction(11); 834 return NF_ACCEPT; 835 836 drop: 837 ip_vs_conn_put(cp); 838 kfree_skb(*pskb); 839 return NF_STOLEN; 840} 841 842 843/* 844 * Handle ICMP messages in the outside-to-inside direction (incoming). 845 * Find any that might be relevant, check against existing connections, 846 * forward to the right destination host if relevant. 847 * Currently handles error types - unreachable, quench, ttl exceeded. 848 */ 849static int 850ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum) 851{ 852 struct sk_buff *skb = *pskb; 853 struct iphdr *iph; 854 struct icmphdr _icmph, *ic; 855 struct iphdr _ciph, *cih; /* The ip header contained within the ICMP */ 856 struct ip_vs_conn *cp; 857 struct ip_vs_protocol *pp; 858 unsigned int offset, ihl, verdict; 859 860 *related = 1; 861 862 /* reassemble IP fragments */ 863 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { 864 skb = ip_vs_gather_frags(skb, 865 hooknum == NF_IP_LOCAL_IN ? 866 IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD); 867 if (!skb) 868 return NF_STOLEN; 869 *pskb = skb; 870 } 871 872 iph = ip_hdr(skb); 873 offset = ihl = iph->ihl * 4; 874 ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph); 875 if (ic == NULL) 876 return NF_DROP; 877 878 IP_VS_DBG(12, "Incoming ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n", 879 ic->type, ntohs(icmp_id(ic)), 880 NIPQUAD(iph->saddr), NIPQUAD(iph->daddr)); 881 882 /* 883 * Work through seeing if this is for us. 884 * These checks are supposed to be in an order that means easy 885 * things are checked first to speed up processing.... however 886 * this means that some packets will manage to get a long way 887 * down this stack and then be rejected, but that's life. 888 */ 889 if ((ic->type != ICMP_DEST_UNREACH) && 890 (ic->type != ICMP_SOURCE_QUENCH) && 891 (ic->type != ICMP_TIME_EXCEEDED)) { 892 *related = 0; 893 return NF_ACCEPT; 894 } 895 896 /* Now find the contained IP header */ 897 offset += sizeof(_icmph); 898 cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph); 899 if (cih == NULL) 900 return NF_ACCEPT; /* The packet looks wrong, ignore */ 901 902 pp = ip_vs_proto_get(cih->protocol); 903 if (!pp) 904 return NF_ACCEPT; 905 906 /* Is the embedded protocol header present? */ 907 if (unlikely(cih->frag_off & htons(IP_OFFSET) && 908 pp->dont_defrag)) 909 return NF_ACCEPT; 910 911 IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMP for"); 912 913 offset += cih->ihl * 4; 914 915 /* The embedded headers contain source and dest in reverse order */ 916 cp = pp->conn_in_get(skb, pp, cih, offset, 1); 917 if (!cp) 918 return NF_ACCEPT; 919 920 verdict = NF_DROP; 921 922 /* Ensure the checksum is correct */ 923 if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) { 924 /* Failed checksum! */ 925 IP_VS_DBG(1, "Incoming ICMP: failed checksum from %d.%d.%d.%d!\n", 926 NIPQUAD(iph->saddr)); 927 goto out; 928 } 929 930 /* do the statistics and put it back */ 931 ip_vs_in_stats(cp, skb); 932 if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol) 933 offset += 2 * sizeof(__u16); 934 verdict = ip_vs_icmp_xmit(skb, cp, pp, offset); 935 /* do not touch skb anymore */ 936 937 out: 938 __ip_vs_conn_put(cp); 939 940 return verdict; 941} 942 943/* 944 * Check if it's for virtual services, look it up, 945 * and send it on its way... 946 */ 947static unsigned int 948ip_vs_in(unsigned int hooknum, struct sk_buff **pskb, 949 const struct net_device *in, const struct net_device *out, 950 int (*okfn)(struct sk_buff *)) 951{ 952 struct sk_buff *skb = *pskb; 953 struct iphdr *iph; 954 struct ip_vs_protocol *pp; 955 struct ip_vs_conn *cp; 956 int ret, restart; 957 int ihl; 958 959 /* 960 * Big tappo: only PACKET_HOST (neither loopback nor mcasts) 961 * ... don't know why 1st test DOES NOT include 2nd (?) 962 */ 963 if (unlikely(skb->pkt_type != PACKET_HOST 964 || skb->dev == &loopback_dev || skb->sk)) { 965 IP_VS_DBG(12, "packet type=%d proto=%d daddr=%d.%d.%d.%d ignored\n", 966 skb->pkt_type, 967 ip_hdr(skb)->protocol, 968 NIPQUAD(ip_hdr(skb)->daddr)); 969 return NF_ACCEPT; 970 } 971 972 iph = ip_hdr(skb); 973 if (unlikely(iph->protocol == IPPROTO_ICMP)) { 974 int related, verdict = ip_vs_in_icmp(pskb, &related, hooknum); 975 976 if (related) 977 return verdict; 978 skb = *pskb; 979 iph = ip_hdr(skb); 980 } 981 982 /* Protocol supported? */ 983 pp = ip_vs_proto_get(iph->protocol); 984 if (unlikely(!pp)) 985 return NF_ACCEPT; 986 987 ihl = iph->ihl << 2; 988 989 /* 990 * Check if the packet belongs to an existing connection entry 991 */ 992 cp = pp->conn_in_get(skb, pp, iph, ihl, 0); 993 994 if (unlikely(!cp)) { 995 int v; 996 997 if (!pp->conn_schedule(skb, pp, &v, &cp)) 998 return v; 999 } 1000 1001 if (unlikely(!cp)) { 1002 /* sorry, all this trouble for a no-hit :) */ 1003 IP_VS_DBG_PKT(12, pp, skb, 0, 1004 "packet continues traversal as normal"); 1005 return NF_ACCEPT; 1006 } 1007 1008 IP_VS_DBG_PKT(11, pp, skb, 0, "Incoming packet"); 1009 1010 /* Check the server status */ 1011 if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) { 1012 /* the destination server is not available */ 1013 1014 if (sysctl_ip_vs_expire_nodest_conn) { 1015 /* try to expire the connection immediately */ 1016 ip_vs_conn_expire_now(cp); 1017 } 1018 /* don't restart its timer, and silently 1019 drop the packet. */ 1020 __ip_vs_conn_put(cp); 1021 return NF_DROP; 1022 } 1023 1024 ip_vs_in_stats(cp, skb); 1025 restart = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp); 1026 if (cp->packet_xmit) 1027 ret = cp->packet_xmit(skb, cp, pp); 1028 /* do not touch skb anymore */ 1029 else { 1030 IP_VS_DBG_RL("warning: packet_xmit is null"); 1031 ret = NF_ACCEPT; 1032 } 1033 1034 /* increase its packet counter and check if it is needed 1035 to be synchronized */ 1036 atomic_inc(&cp->in_pkts); 1037 if ((ip_vs_sync_state & IP_VS_STATE_MASTER) && 1038 (cp->protocol != IPPROTO_TCP || 1039 cp->state == IP_VS_TCP_S_ESTABLISHED) && 1040 (atomic_read(&cp->in_pkts) % sysctl_ip_vs_sync_threshold[1] 1041 == sysctl_ip_vs_sync_threshold[0])) 1042 ip_vs_sync_conn(cp); 1043 1044 ip_vs_conn_put(cp); 1045 return ret; 1046} 1047 1048 1049/* 1050 * It is hooked at the NF_IP_FORWARD chain, in order to catch ICMP 1051 * related packets destined for 0.0.0.0/0. 1052 * When fwmark-based virtual service is used, such as transparent 1053 * cache cluster, TCP packets can be marked and routed to ip_vs_in, 1054 * but ICMP destined for 0.0.0.0/0 cannot not be easily marked and 1055 * sent to ip_vs_in_icmp. So, catch them at the NF_IP_FORWARD chain 1056 * and send them to ip_vs_in_icmp. 1057 */ 1058static unsigned int 1059ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff **pskb, 1060 const struct net_device *in, const struct net_device *out, 1061 int (*okfn)(struct sk_buff *)) 1062{ 1063 int r; 1064 1065 if (ip_hdr(*pskb)->protocol != IPPROTO_ICMP) 1066 return NF_ACCEPT; 1067 1068 return ip_vs_in_icmp(pskb, &r, hooknum); 1069} 1070 1071 1072/* After packet filtering, forward packet through VS/DR, VS/TUN, 1073 or VS/NAT(change destination), so that filtering rules can be 1074 applied to IPVS. */ 1075static struct nf_hook_ops ip_vs_in_ops = { 1076 .hook = ip_vs_in, 1077 .owner = THIS_MODULE, 1078 .pf = PF_INET, 1079 .hooknum = NF_IP_LOCAL_IN, 1080 .priority = 100, 1081}; 1082 1083/* After packet filtering, change source only for VS/NAT */ 1084static struct nf_hook_ops ip_vs_out_ops = { 1085 .hook = ip_vs_out, 1086 .owner = THIS_MODULE, 1087 .pf = PF_INET, 1088 .hooknum = NF_IP_FORWARD, 1089 .priority = 100, 1090}; 1091 1092/* After packet filtering (but before ip_vs_out_icmp), catch icmp 1093 destined for 0.0.0.0/0, which is for incoming IPVS connections */ 1094static struct nf_hook_ops ip_vs_forward_icmp_ops = { 1095 .hook = ip_vs_forward_icmp, 1096 .owner = THIS_MODULE, 1097 .pf = PF_INET, 1098 .hooknum = NF_IP_FORWARD, 1099 .priority = 99, 1100}; 1101 1102/* Before the netfilter connection tracking, exit from POST_ROUTING */ 1103static struct nf_hook_ops ip_vs_post_routing_ops = { 1104 .hook = ip_vs_post_routing, 1105 .owner = THIS_MODULE, 1106 .pf = PF_INET, 1107 .hooknum = NF_IP_POST_ROUTING, 1108 .priority = NF_IP_PRI_NAT_SRC-1, 1109}; 1110 1111 1112/* 1113 * Initialize IP Virtual Server 1114 */ 1115static int __init ip_vs_init(void) 1116{ 1117 int ret; 1118 1119 ret = ip_vs_control_init(); 1120 if (ret < 0) { 1121 IP_VS_ERR("can't setup control.\n"); 1122 goto cleanup_nothing; 1123 } 1124 1125 ip_vs_protocol_init(); 1126 1127 ret = ip_vs_app_init(); 1128 if (ret < 0) { 1129 IP_VS_ERR("can't setup application helper.\n"); 1130 goto cleanup_protocol; 1131 } 1132 1133 ret = ip_vs_conn_init(); 1134 if (ret < 0) { 1135 IP_VS_ERR("can't setup connection table.\n"); 1136 goto cleanup_app; 1137 } 1138 1139 ret = nf_register_hook(&ip_vs_in_ops); 1140 if (ret < 0) { 1141 IP_VS_ERR("can't register in hook.\n"); 1142 goto cleanup_conn; 1143 } 1144 1145 ret = nf_register_hook(&ip_vs_out_ops); 1146 if (ret < 0) { 1147 IP_VS_ERR("can't register out hook.\n"); 1148 goto cleanup_inops; 1149 } 1150 ret = nf_register_hook(&ip_vs_post_routing_ops); 1151 if (ret < 0) { 1152 IP_VS_ERR("can't register post_routing hook.\n"); 1153 goto cleanup_outops; 1154 } 1155 ret = nf_register_hook(&ip_vs_forward_icmp_ops); 1156 if (ret < 0) { 1157 IP_VS_ERR("can't register forward_icmp hook.\n"); 1158 goto cleanup_postroutingops; 1159 } 1160 1161 IP_VS_INFO("ipvs loaded.\n"); 1162 return ret; 1163 1164 cleanup_postroutingops: 1165 nf_unregister_hook(&ip_vs_post_routing_ops); 1166 cleanup_outops: 1167 nf_unregister_hook(&ip_vs_out_ops); 1168 cleanup_inops: 1169 nf_unregister_hook(&ip_vs_in_ops); 1170 cleanup_conn: 1171 ip_vs_conn_cleanup(); 1172 cleanup_app: 1173 ip_vs_app_cleanup(); 1174 cleanup_protocol: 1175 ip_vs_protocol_cleanup(); 1176 ip_vs_control_cleanup(); 1177 cleanup_nothing: 1178 return ret; 1179} 1180 1181static void __exit ip_vs_cleanup(void) 1182{ 1183 nf_unregister_hook(&ip_vs_forward_icmp_ops); 1184 nf_unregister_hook(&ip_vs_post_routing_ops); 1185 nf_unregister_hook(&ip_vs_out_ops); 1186 nf_unregister_hook(&ip_vs_in_ops); 1187 ip_vs_conn_cleanup(); 1188 ip_vs_app_cleanup(); 1189 ip_vs_protocol_cleanup(); 1190 ip_vs_control_cleanup(); 1191 IP_VS_INFO("ipvs unloaded.\n"); 1192} 1193 1194module_init(ip_vs_init); 1195module_exit(ip_vs_cleanup); 1196MODULE_LICENSE("GPL"); 1197