net/netfilter/ipvs/ip_vs_core.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the Netfilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
  18  * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
  19  * and others.
  20  *
  21  * Changes:
  22  *      Paul `Rusty' Russell            properly handle non-linear skbs
  23  *      Harald Welte                    don't use nfcache
  24  *
  25  */
  26
  27 #define KMSG_COMPONENT "IPVS"
  28 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  29
  30 #include <linux/module.h>
  31 #include <linux/kernel.h>
  32 #include <linux/ip.h>
  33 #include <linux/tcp.h>
  34 #include <linux/sctp.h>
  35 #include <linux/icmp.h>
  36 #include <linux/slab.h>
  37
  38 #include <net/ip.h>
  39 #include <net/tcp.h>
  40 #include <net/udp.h>
  41 #include <net/icmp.h>                   /* for icmp_send */
  42 #include <net/route.h>
  43
  44 #include <linux/netfilter.h>
  45 #include <linux/netfilter_ipv4.h>
  46
  47 #ifdef CONFIG_IP_VS_IPV6
  48 #include <net/ipv6.h>
  49 #include <linux/netfilter_ipv6.h>
  50 #endif
  51
  52 #include <net/ip_vs.h>
  53
  54
  55 EXPORT_SYMBOL(register_ip_vs_scheduler);
  56 EXPORT_SYMBOL(unregister_ip_vs_scheduler);
  57 EXPORT_SYMBOL(ip_vs_skb_replace);
  58 EXPORT_SYMBOL(ip_vs_proto_name);
  59 EXPORT_SYMBOL(ip_vs_conn_new);
  60 EXPORT_SYMBOL(ip_vs_conn_in_get);
  61 EXPORT_SYMBOL(ip_vs_conn_out_get);
  62 #ifdef CONFIG_IP_VS_PROTO_TCP
  63 EXPORT_SYMBOL(ip_vs_tcp_conn_listen);
  64 #endif
  65 EXPORT_SYMBOL(ip_vs_conn_put);
  66 #ifdef CONFIG_IP_VS_DEBUG
  67 EXPORT_SYMBOL(ip_vs_get_debug_level);
  68 #endif
  69
  70
  71 /* ID used in ICMP lookups */
  72 #define icmp_id(icmph)          (((icmph)->un).echo.id)
  73 #define icmpv6_id(icmph)        (icmph->icmp6_dataun.u_echo.identifier)
  74
  75 const char *ip_vs_proto_name(unsigned proto)
  76 {
  77         static char buf[20];
  78
  79         switch (proto) {
  80         case IPPROTO_IP:
  81                 return "IP";
  82         case IPPROTO_UDP:
  83                 return "UDP";
  84         case IPPROTO_TCP:
  85                 return "TCP";
  86         case IPPROTO_SCTP:
  87                 return "SCTP";
  88         case IPPROTO_ICMP:
  89                 return "ICMP";
  90 #ifdef CONFIG_IP_VS_IPV6
  91         case IPPROTO_ICMPV6:
  92                 return "ICMPv6";
  93 #endif
  94         default:
  95                 sprintf(buf, "IP_%d", proto);
  96                 return buf;
  97         }
  98 }
  99
 100 void ip_vs_init_hash_table(struct list_head *table, int rows)
 101 {
 102         while (--rows >= 0)
 103                 INIT_LIST_HEAD(&table[rows]);
 104 }
 105
 106 static inline void
 107 ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 108 {
 109         struct ip_vs_dest *dest = cp->dest;
 110         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
 111                 spin_lock(&dest->stats.lock);
 112                 dest->stats.ustats.inpkts++;
 113                 dest->stats.ustats.inbytes += skb->len;
 114                 spin_unlock(&dest->stats.lock);
 115
 116                 spin_lock(&dest->svc->stats.lock);
 117                 dest->svc->stats.ustats.inpkts++;
 118                 dest->svc->stats.ustats.inbytes += skb->len;
 119                 spin_unlock(&dest->svc->stats.lock);
 120
 121                 spin_lock(&ip_vs_stats.lock);
 122                 ip_vs_stats.ustats.inpkts++;
 123                 ip_vs_stats.ustats.inbytes += skb->len;
 124                 spin_unlock(&ip_vs_stats.lock);
 125         }
 126 }
 127
 128
 129 static inline void
 130 ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 131 {
 132         struct ip_vs_dest *dest = cp->dest;
 133         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
 134                 spin_lock(&dest->stats.lock);
 135                 dest->stats.ustats.outpkts++;
 136                 dest->stats.ustats.outbytes += skb->len;
 137                 spin_unlock(&dest->stats.lock);
 138
 139                 spin_lock(&dest->svc->stats.lock);
 140                 dest->svc->stats.ustats.outpkts++;
 141                 dest->svc->stats.ustats.outbytes += skb->len;
 142                 spin_unlock(&dest->svc->stats.lock);
 143
 144                 spin_lock(&ip_vs_stats.lock);
 145                 ip_vs_stats.ustats.outpkts++;
 146                 ip_vs_stats.ustats.outbytes += skb->len;
 147                 spin_unlock(&ip_vs_stats.lock);
 148         }
 149 }
 150
 151
 152 static inline void
 153 ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
 154 {
 155         spin_lock(&cp->dest->stats.lock);
 156         cp->dest->stats.ustats.conns++;
 157         spin_unlock(&cp->dest->stats.lock);
 158
 159         spin_lock(&svc->stats.lock);
 160         svc->stats.ustats.conns++;
 161         spin_unlock(&svc->stats.lock);
 162
 163         spin_lock(&ip_vs_stats.lock);
 164         ip_vs_stats.ustats.conns++;
 165         spin_unlock(&ip_vs_stats.lock);
 166 }
 167
 168
 169 static inline int
 170 ip_vs_set_state(struct ip_vs_conn *cp, int direction,
 171                 const struct sk_buff *skb,
 172                 struct ip_vs_protocol *pp)
 173 {
 174         if (unlikely(!pp->state_transition))
 175                 return 0;
 176         return pp->state_transition(cp, direction, skb, pp);
 177 }
 178
 179
 180 /*
 181  *  IPVS persistent scheduling function
 182  *  It creates a connection entry according to its template if exists,
 183  *  or selects a server and creates a connection entry plus a template.
 184  *  Locking: we are svc user (svc->refcnt), so we hold all dests too
 185  *  Protocols supported: TCP, UDP
 186  */
 187 static struct ip_vs_conn *
 188 ip_vs_sched_persist(struct ip_vs_service *svc,
 189                     const struct sk_buff *skb,
 190                     __be16 ports[2])
 191 {
 192         struct ip_vs_conn *cp = NULL;
 193         struct ip_vs_iphdr iph;
 194         struct ip_vs_dest *dest;
 195         struct ip_vs_conn *ct;
 196         __be16  dport;                  /* destination port to forward */
 197         union nf_inet_addr snet;        /* source network of the client,
 198                                            after masking */
 199
 200         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 201
 202         /* Mask saddr with the netmask to adjust template granularity */
 203 #ifdef CONFIG_IP_VS_IPV6
 204         if (svc->af == AF_INET6)
 205                 ipv6_addr_prefix(&snet.in6, &iph.saddr.in6, svc->netmask);
 206         else
 207 #endif
 208                 snet.ip = iph.saddr.ip & svc->netmask;
 209
 210         IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "
 211                       "mnet %s\n",
 212                       IP_VS_DBG_ADDR(svc->af, &iph.saddr), ntohs(ports[0]),
 213                       IP_VS_DBG_ADDR(svc->af, &iph.daddr), ntohs(ports[1]),
 214                       IP_VS_DBG_ADDR(svc->af, &snet));
 215
 216         /*
 217          * As far as we know, FTP is a very complicated network protocol, and
 218          * it uses control connection and data connections. For active FTP,
 219          * FTP server initialize data connection to the client, its source port
 220          * is often 20. For passive FTP, FTP server tells the clients the port
 221          * that it passively listens to,  and the client issues the data
 222          * connection. In the tunneling or direct routing mode, the load
 223          * balancer is on the client-to-server half of connection, the port
 224          * number is unknown to the load balancer. So, a conn template like
 225          * <caddr, 0, vaddr, 0, daddr, 0> is created for persistent FTP
 226          * service, and a template like <caddr, 0, vaddr, vport, daddr, dport>
 227          * is created for other persistent services.
 228          */
 229         if (ports[1] == svc->port) {
 230                 /* Check if a template already exists */
 231                 if (svc->port != FTPPORT)
 232                         ct = ip_vs_ct_in_get(svc->af, iph.protocol, &snet, 0,
 233                                              &iph.daddr, ports[1]);
 234                 else
 235                         ct = ip_vs_ct_in_get(svc->af, iph.protocol, &snet, 0,
 236                                              &iph.daddr, 0);
 237
 238                 if (!ct || !ip_vs_check_template(ct)) {
 239                         /*
 240                          * No template found or the dest of the connection
 241                          * template is not available.
 242                          */
 243                         dest = svc->scheduler->schedule(svc, skb);
 244                         if (dest == NULL) {
 245                                 IP_VS_DBG(1, "p-schedule: no dest found.\n");
 246                                 return NULL;
 247                         }
 248
 249                         /*
 250                          * Create a template like <protocol,caddr,0,
 251                          * vaddr,vport,daddr,dport> for non-ftp service,
 252                          * and <protocol,caddr,0,vaddr,0,daddr,0>
 253                          * for ftp service.
 254                          */
 255                         if (svc->port != FTPPORT)
 256                                 ct = ip_vs_conn_new(svc->af, iph.protocol,
 257                                                     &snet, 0,
 258                                                     &iph.daddr,
 259                                                     ports[1],
 260                                                     &dest->addr, dest->port,
 261                                                     IP_VS_CONN_F_TEMPLATE,
 262                                                     dest);
 263                         else
 264                                 ct = ip_vs_conn_new(svc->af, iph.protocol,
 265                                                     &snet, 0,
 266                                                     &iph.daddr, 0,
 267                                                     &dest->addr, 0,
 268                                                     IP_VS_CONN_F_TEMPLATE,
 269                                                     dest);
 270                         if (ct == NULL)
 271                                 return NULL;
 272
 273                         ct->timeout = svc->timeout;
 274                 } else {
 275                         /* set destination with the found template */
 276                         dest = ct->dest;
 277                 }
 278                 dport = dest->port;
 279         } else {
 280                 /*
 281                  * Note: persistent fwmark-based services and persistent
 282                  * port zero service are handled here.
 283                  * fwmark template: <IPPROTO_IP,caddr,0,fwmark,0,daddr,0>
 284                  * port zero template: <protocol,caddr,0,vaddr,0,daddr,0>
 285                  */
 286                 if (svc->fwmark) {
 287                         union nf_inet_addr fwmark = {
 288                                 .ip = htonl(svc->fwmark)
 289                         };
 290
 291                         ct = ip_vs_ct_in_get(svc->af, IPPROTO_IP, &snet, 0,
 292                                              &fwmark, 0);
 293                 } else
 294                         ct = ip_vs_ct_in_get(svc->af, iph.protocol, &snet, 0,
 295                                              &iph.daddr, 0);
 296
 297                 if (!ct || !ip_vs_check_template(ct)) {
 298                         /*
 299                          * If it is not persistent port zero, return NULL,
 300                          * otherwise create a connection template.
 301                          */
 302                         if (svc->port)
 303                                 return NULL;
 304
 305                         dest = svc->scheduler->schedule(svc, skb);
 306                         if (dest == NULL) {
 307                                 IP_VS_DBG(1, "p-schedule: no dest found.\n");
 308                                 return NULL;
 309                         }
 310
 311                         /*
 312                          * Create a template according to the service
 313                          */
 314                         if (svc->fwmark) {
 315                                 union nf_inet_addr fwmark = {
 316                                         .ip = htonl(svc->fwmark)
 317                                 };
 318
 319                                 ct = ip_vs_conn_new(svc->af, IPPROTO_IP,
 320                                                     &snet, 0,
 321                                                     &fwmark, 0,
 322                                                     &dest->addr, 0,
 323                                                     IP_VS_CONN_F_TEMPLATE,
 324                                                     dest);
 325                         } else
 326                                 ct = ip_vs_conn_new(svc->af, iph.protocol,
 327                                                     &snet, 0,
 328                                                     &iph.daddr, 0,
 329                                                     &dest->addr, 0,
 330                                                     IP_VS_CONN_F_TEMPLATE,
 331                                                     dest);
 332                         if (ct == NULL)
 333                                 return NULL;
 334
 335                         ct->timeout = svc->timeout;
 336                 } else {
 337                         /* set destination with the found template */
 338                         dest = ct->dest;
 339                 }
 340                 dport = ports[1];
 341         }
 342
 343         /*
 344          *    Create a new connection according to the template
 345          */
 346         cp = ip_vs_conn_new(svc->af, iph.protocol,
 347                             &iph.saddr, ports[0],
 348                             &iph.daddr, ports[1],
 349                             &dest->addr, dport,
 350                             0,
 351                             dest);
 352         if (cp == NULL) {
 353                 ip_vs_conn_put(ct);
 354                 return NULL;
 355         }
 356
 357         /*
 358          *    Add its control
 359          */
 360         ip_vs_control_add(cp, ct);
 361         ip_vs_conn_put(ct);
 362
 363         ip_vs_conn_stats(cp, svc);
 364         return cp;
 365 }
 366
 367
 368 /*
 369  *  IPVS main scheduling function
 370  *  It selects a server according to the virtual service, and
 371  *  creates a connection entry.
 372  *  Protocols supported: TCP, UDP
 373  */
 374 struct ip_vs_conn *
 375 ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 376 {
 377         struct ip_vs_conn *cp = NULL;
 378         struct ip_vs_iphdr iph;
 379         struct ip_vs_dest *dest;
 380         __be16 _ports[2], *pptr;
 381
 382         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 383         pptr = skb_header_pointer(skb, iph.len, sizeof(_ports), _ports);
 384         if (pptr == NULL)
 385                 return NULL;
 386
 387         /*
 388          *    Persistent service
 389          */
 390         if (svc->flags & IP_VS_SVC_F_PERSISTENT)
 391                 return ip_vs_sched_persist(svc, skb, pptr);
 392
 393         /*
 394          *    Non-persistent service
 395          */
 396         if (!svc->fwmark && pptr[1] != svc->port) {
 397                 if (!svc->port)
 398                         pr_err("Schedule: port zero only supported "
 399                                "in persistent services, "
 400                                "check your ipvs configuration\n");
 401                 return NULL;
 402         }
 403
 404         dest = svc->scheduler->schedule(svc, skb);
 405         if (dest == NULL) {
 406                 IP_VS_DBG(1, "Schedule: no dest found.\n");
 407                 return NULL;
 408         }
 409
 410         /*
 411          *    Create a connection entry.
 412          */
 413         cp = ip_vs_conn_new(svc->af, iph.protocol,
 414                             &iph.saddr, pptr[0],
 415                             &iph.daddr, pptr[1],
 416                             &dest->addr, dest->port ? dest->port : pptr[1],
 417                             0,
 418                             dest);
 419         if (cp == NULL)
 420                 return NULL;
 421
 422         IP_VS_DBG_BUF(6, "Schedule fwd:%c c:%s:%u v:%s:%u "
 423                       "d:%s:%u conn->flags:%X conn->refcnt:%d\n",
 424                       ip_vs_fwd_tag(cp),
 425                       IP_VS_DBG_ADDR(svc->af, &cp->caddr), ntohs(cp->cport),
 426                       IP_VS_DBG_ADDR(svc->af, &cp->vaddr), ntohs(cp->vport),
 427                       IP_VS_DBG_ADDR(svc->af, &cp->daddr), ntohs(cp->dport),
 428                       cp->flags, atomic_read(&cp->refcnt));
 429
 430         ip_vs_conn_stats(cp, svc);
 431         return cp;
 432 }
 433
 434
 435 /*
 436  *  Pass or drop the packet.
 437  *  Called by ip_vs_in, when the virtual service is available but
 438  *  no destination is available for a new connection.
 439  */
 440 int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
 441                 struct ip_vs_protocol *pp)
 442 {
 443         __be16 _ports[2], *pptr;
 444         struct ip_vs_iphdr iph;
 445         int unicast;
 446         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 447
 448         pptr = skb_header_pointer(skb, iph.len, sizeof(_ports), _ports);
 449         if (pptr == NULL) {
 450                 ip_vs_service_put(svc);
 451                 return NF_DROP;
 452         }
 453
 454 #ifdef CONFIG_IP_VS_IPV6
 455         if (svc->af == AF_INET6)
 456                 unicast = ipv6_addr_type(&iph.daddr.in6) & IPV6_ADDR_UNICAST;
 457         else
 458 #endif
 459                 unicast = (inet_addr_type(&init_net, iph.daddr.ip) == RTN_UNICAST);
 460
 461         /* if it is fwmark-based service, the cache_bypass sysctl is up
 462            and the destination is a non-local unicast, then create
 463            a cache_bypass connection entry */
 464         if (sysctl_ip_vs_cache_bypass && svc->fwmark && unicast) {
 465                 int ret, cs;
 466                 struct ip_vs_conn *cp;
 467                 union nf_inet_addr daddr =  { .all = { 0, 0, 0, 0 } };
 468
 469                 ip_vs_service_put(svc);
 470
 471                 /* create a new connection entry */
 472                 IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__);
 473                 cp = ip_vs_conn_new(svc->af, iph.protocol,
 474                                     &iph.saddr, pptr[0],
 475                                     &iph.daddr, pptr[1],
 476                                     &daddr, 0,
 477                                     IP_VS_CONN_F_BYPASS,
 478                                     NULL);
 479                 if (cp == NULL)
 480                         return NF_DROP;
 481
 482                 /* statistics */
 483                 ip_vs_in_stats(cp, skb);
 484
 485                 /* set state */
 486                 cs = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
 487
 488                 /* transmit the first SYN packet */
 489                 ret = cp->packet_xmit(skb, cp, pp);
 490                 /* do not touch skb anymore */
 491
 492                 atomic_inc(&cp->in_pkts);
 493                 ip_vs_conn_put(cp);
 494                 return ret;
 495         }
 496
 497         /*
 498          * When the virtual ftp service is presented, packets destined
 499          * for other services on the VIP may get here (except services
 500          * listed in the ipvs table), pass the packets, because it is
 501          * not ipvs job to decide to drop the packets.
 502          */
 503         if ((svc->port == FTPPORT) && (pptr[1] != FTPPORT)) {
 504                 ip_vs_service_put(svc);
 505                 return NF_ACCEPT;
 506         }
 507
 508         ip_vs_service_put(svc);
 509
 510         /*
 511          * Notify the client that the destination is unreachable, and
 512          * release the socket buffer.
 513          * Since it is in IP layer, the TCP socket is not actually
 514          * created, the TCP RST packet cannot be sent, instead that
 515          * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ
 516          */
 517 #ifdef CONFIG_IP_VS_IPV6
 518         if (svc->af == AF_INET6)
 519                 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 520         else
 521 #endif
 522                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 523
 524         return NF_DROP;
 525 }
 526
 527
 528 /*
 529  *      It is hooked before NF_IP_PRI_NAT_SRC at the NF_INET_POST_ROUTING
 530  *      chain, and is used for VS/NAT.
 531  *      It detects packets for VS/NAT connections and sends the packets
 532  *      immediately. This can avoid that iptable_nat mangles the packets
 533  *      for VS/NAT.
 534  */
 535 static unsigned int ip_vs_post_routing(unsigned int hooknum,
 536                                        struct sk_buff *skb,
 537                                        const struct net_device *in,
 538                                        const struct net_device *out,
 539                                        int (*okfn)(struct sk_buff *))
 540 {
 541         if (!skb->ipvs_property)
 542                 return NF_ACCEPT;
 543         /* The packet was sent from IPVS, exit this chain */
 544         return NF_STOP;
 545 }
 546
 547 __sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset)
 548 {
 549         return csum_fold(skb_checksum(skb, offset, skb->len - offset, 0));
 550 }
 551
 552 static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
 553 {
 554         int err = ip_defrag(skb, user);
 555
 556         if (!err)
 557                 ip_send_check(ip_hdr(skb));
 558
 559         return err;
 560 }
 561
 562 #ifdef CONFIG_IP_VS_IPV6
 563 static inline int ip_vs_gather_frags_v6(struct sk_buff *skb, u_int32_t user)
 564 {
 565         /* TODO IPv6: Find out what to do here for IPv6 */
 566         return 0;
 567 }
 568 #endif
 569
 570 /*
 571  * Packet has been made sufficiently writable in caller
 572  * - inout: 1=in->out, 0=out->in
 573  */
 574 void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
 575                     struct ip_vs_conn *cp, int inout)
 576 {
 577         struct iphdr *iph        = ip_hdr(skb);
 578         unsigned int icmp_offset = iph->ihl*4;
 579         struct icmphdr *icmph    = (struct icmphdr *)(skb_network_header(skb) +
 580                                                       icmp_offset);
 581         struct iphdr *ciph       = (struct iphdr *)(icmph + 1);
 582
 583         if (inout) {
 584                 iph->saddr = cp->vaddr.ip;
 585                 ip_send_check(iph);
 586                 ciph->daddr = cp->vaddr.ip;
 587                 ip_send_check(ciph);
 588         } else {
 589                 iph->daddr = cp->daddr.ip;
 590                 ip_send_check(iph);
 591                 ciph->saddr = cp->daddr.ip;
 592                 ip_send_check(ciph);
 593         }
 594
 595         /* the TCP/UDP/SCTP port */
 596         if (IPPROTO_TCP == ciph->protocol || IPPROTO_UDP == ciph->protocol ||
 597             IPPROTO_SCTP == ciph->protocol) {
 598                 __be16 *ports = (void *)ciph + ciph->ihl*4;
 599
 600                 if (inout)
 601                         ports[1] = cp->vport;
 602                 else
 603                         ports[0] = cp->dport;
 604         }
 605
 606         /* And finally the ICMP checksum */
 607         icmph->checksum = 0;
 608         icmph->checksum = ip_vs_checksum_complete(skb, icmp_offset);
 609         skb->ip_summed = CHECKSUM_UNNECESSARY;
 610
 611         if (inout)
 612                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 613                         "Forwarding altered outgoing ICMP");
 614         else
 615                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 616                         "Forwarding altered incoming ICMP");
 617 }
 618
 619 #ifdef CONFIG_IP_VS_IPV6
 620 void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
 621                     struct ip_vs_conn *cp, int inout)
 622 {
 623         struct ipv6hdr *iph      = ipv6_hdr(skb);
 624         unsigned int icmp_offset = sizeof(struct ipv6hdr);
 625         struct icmp6hdr *icmph   = (struct icmp6hdr *)(skb_network_header(skb) +
 626                                                       icmp_offset);
 627         struct ipv6hdr *ciph     = (struct ipv6hdr *)(icmph + 1);
 628
 629         if (inout) {
 630                 iph->saddr = cp->vaddr.in6;
 631                 ciph->daddr = cp->vaddr.in6;
 632         } else {
 633                 iph->daddr = cp->daddr.in6;
 634                 ciph->saddr = cp->daddr.in6;
 635         }
 636
 637         /* the TCP/UDP/SCTP port */
 638         if (IPPROTO_TCP == ciph->nexthdr || IPPROTO_UDP == ciph->nexthdr ||
 639             IPPROTO_SCTP == ciph->nexthdr) {
 640                 __be16 *ports = (void *)ciph + sizeof(struct ipv6hdr);
 641
 642                 if (inout)
 643                         ports[1] = cp->vport;
 644                 else
 645                         ports[0] = cp->dport;
 646         }
 647
 648         /* And finally the ICMP checksum */
 649         icmph->icmp6_cksum = 0;
 650         /* TODO IPv6: is this correct for ICMPv6? */
 651         ip_vs_checksum_complete(skb, icmp_offset);
 652         skb->ip_summed = CHECKSUM_UNNECESSARY;
 653
 654         if (inout)
 655                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 656                         "Forwarding altered outgoing ICMPv6");
 657         else
 658                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 659                         "Forwarding altered incoming ICMPv6");
 660 }
 661 #endif
 662
 663 /* Handle relevant response ICMP messages - forward to the right
 664  * destination host. Used for NAT and local client.
 665  */
 666 static int handle_response_icmp(int af, struct sk_buff *skb,
 667                                 union nf_inet_addr *snet,
 668                                 __u8 protocol, struct ip_vs_conn *cp,
 669                                 struct ip_vs_protocol *pp,
 670                                 unsigned int offset, unsigned int ihl)
 671 {
 672         unsigned int verdict = NF_DROP;
 673
 674         if (IP_VS_FWD_METHOD(cp) != 0) {
 675                 pr_err("shouldn't reach here, because the box is on the "
 676                        "half connection in the tun/dr module.\n");
 677         }
 678
 679         /* Ensure the checksum is correct */
 680         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
 681                 /* Failed checksum! */
 682                 IP_VS_DBG_BUF(1, "Forward ICMP: failed checksum from %s!\n",
 683                               IP_VS_DBG_ADDR(af, snet));
 684                 goto out;
 685         }
 686
 687         if (IPPROTO_TCP == protocol || IPPROTO_UDP == protocol ||
 688             IPPROTO_SCTP == protocol)
 689                 offset += 2 * sizeof(__u16);
 690         if (!skb_make_writable(skb, offset))
 691                 goto out;
 692
 693 #ifdef CONFIG_IP_VS_IPV6
 694         if (af == AF_INET6)
 695                 ip_vs_nat_icmp_v6(skb, pp, cp, 1);
 696         else
 697 #endif
 698                 ip_vs_nat_icmp(skb, pp, cp, 1);
 699
 700         /* do the statistics and put it back */
 701         ip_vs_out_stats(cp, skb);
 702
 703         skb->ipvs_property = 1;
 704         verdict = NF_ACCEPT;
 705
 706 out:
 707         __ip_vs_conn_put(cp);
 708
 709         return verdict;
 710 }
 711
 712 /*
 713  *      Handle ICMP messages in the inside-to-outside direction (outgoing).
 714  *      Find any that might be relevant, check against existing connections.
 715  *      Currently handles error types - unreachable, quench, ttl exceeded.
 716  */
 717 static int ip_vs_out_icmp(struct sk_buff *skb, int *related)
 718 {
 719         struct iphdr *iph;
 720         struct icmphdr  _icmph, *ic;
 721         struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
 722         struct ip_vs_iphdr ciph;
 723         struct ip_vs_conn *cp;
 724         struct ip_vs_protocol *pp;
 725         unsigned int offset, ihl;
 726         union nf_inet_addr snet;
 727
 728         *related = 1;
 729
 730         /* reassemble IP fragments */
 731         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
 732                 if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
 733                         return NF_STOLEN;
 734         }
 735
 736         iph = ip_hdr(skb);
 737         offset = ihl = iph->ihl * 4;
 738         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
 739         if (ic == NULL)
 740                 return NF_DROP;
 741
 742         IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %pI4->%pI4\n",
 743                   ic->type, ntohs(icmp_id(ic)),
 744                   &iph->saddr, &iph->daddr);
 745
 746         /*
 747          * Work through seeing if this is for us.
 748          * These checks are supposed to be in an order that means easy
 749          * things are checked first to speed up processing.... however
 750          * this means that some packets will manage to get a long way
 751          * down this stack and then be rejected, but that's life.
 752          */
 753         if ((ic->type != ICMP_DEST_UNREACH) &&
 754             (ic->type != ICMP_SOURCE_QUENCH) &&
 755             (ic->type != ICMP_TIME_EXCEEDED)) {
 756                 *related = 0;
 757                 return NF_ACCEPT;
 758         }
 759
 760         /* Now find the contained IP header */
 761         offset += sizeof(_icmph);
 762         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
 763         if (cih == NULL)
 764                 return NF_ACCEPT; /* The packet looks wrong, ignore */
 765
 766         pp = ip_vs_proto_get(cih->protocol);
 767         if (!pp)
 768                 return NF_ACCEPT;
 769
 770         /* Is the embedded protocol header present? */
 771         if (unlikely(cih->frag_off & htons(IP_OFFSET) &&
 772                      pp->dont_defrag))
 773                 return NF_ACCEPT;
 774
 775         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking outgoing ICMP for");
 776
 777         offset += cih->ihl * 4;
 778
 779         ip_vs_fill_iphdr(AF_INET, cih, &ciph);
 780         /* The embedded headers contain source and dest in reverse order */
 781         cp = pp->conn_out_get(AF_INET, skb, pp, &ciph, offset, 1);
 782         if (!cp)
 783                 return NF_ACCEPT;
 784
 785         snet.ip = iph->saddr;
 786         return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp,
 787                                     pp, offset, ihl);
 788 }
 789
 790 #ifdef CONFIG_IP_VS_IPV6
 791 static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related)
 792 {
 793         struct ipv6hdr *iph;
 794         struct icmp6hdr _icmph, *ic;
 795         struct ipv6hdr  _ciph, *cih;    /* The ip header contained
 796                                            within the ICMP */
 797         struct ip_vs_iphdr ciph;
 798         struct ip_vs_conn *cp;
 799         struct ip_vs_protocol *pp;
 800         unsigned int offset;
 801         union nf_inet_addr snet;
 802
 803         *related = 1;
 804
 805         /* reassemble IP fragments */
 806         if (ipv6_hdr(skb)->nexthdr == IPPROTO_FRAGMENT) {
 807                 if (ip_vs_gather_frags_v6(skb, IP_DEFRAG_VS_OUT))
 808                         return NF_STOLEN;
 809         }
 810
 811         iph = ipv6_hdr(skb);
 812         offset = sizeof(struct ipv6hdr);
 813         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
 814         if (ic == NULL)
 815                 return NF_DROP;
 816
 817         IP_VS_DBG(12, "Outgoing ICMPv6 (%d,%d) %pI6->%pI6\n",
 818                   ic->icmp6_type, ntohs(icmpv6_id(ic)),
 819                   &iph->saddr, &iph->daddr);
 820
 821         /*
 822          * Work through seeing if this is for us.
 823          * These checks are supposed to be in an order that means easy
 824          * things are checked first to speed up processing.... however
 825          * this means that some packets will manage to get a long way
 826          * down this stack and then be rejected, but that's life.
 827          */
 828         if ((ic->icmp6_type != ICMPV6_DEST_UNREACH) &&
 829             (ic->icmp6_type != ICMPV6_PKT_TOOBIG) &&
 830             (ic->icmp6_type != ICMPV6_TIME_EXCEED)) {
 831                 *related = 0;
 832                 return NF_ACCEPT;
 833         }
 834
 835         /* Now find the contained IP header */
 836         offset += sizeof(_icmph);
 837         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
 838         if (cih == NULL)
 839                 return NF_ACCEPT; /* The packet looks wrong, ignore */
 840
 841         pp = ip_vs_proto_get(cih->nexthdr);
 842         if (!pp)
 843                 return NF_ACCEPT;
 844
 845         /* Is the embedded protocol header present? */
 846         /* TODO: we don't support fragmentation at the moment anyways */
 847         if (unlikely(cih->nexthdr == IPPROTO_FRAGMENT && pp->dont_defrag))
 848                 return NF_ACCEPT;
 849
 850         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking outgoing ICMPv6 for");
 851
 852         offset += sizeof(struct ipv6hdr);
 853
 854         ip_vs_fill_iphdr(AF_INET6, cih, &ciph);
 855         /* The embedded headers contain source and dest in reverse order */
 856         cp = pp->conn_out_get(AF_INET6, skb, pp, &ciph, offset, 1);
 857         if (!cp)
 858                 return NF_ACCEPT;
 859
 860         ipv6_addr_copy(&snet.in6, &iph->saddr);
 861         return handle_response_icmp(AF_INET6, skb, &snet, cih->nexthdr, cp,
 862                                     pp, offset, sizeof(struct ipv6hdr));
 863 }
 864 #endif
 865
 866 /*
 867  * Check if sctp chunc is ABORT chunk
 868  */
 869 static inline int is_sctp_abort(const struct sk_buff *skb, int nh_len)
 870 {
 871         sctp_chunkhdr_t *sch, schunk;
 872         sch = skb_header_pointer(skb, nh_len + sizeof(sctp_sctphdr_t),
 873                         sizeof(schunk), &schunk);
 874         if (sch == NULL)
 875                 return 0;
 876         if (sch->type == SCTP_CID_ABORT)
 877                 return 1;
 878         return 0;
 879 }
 880
 881 static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
 882 {
 883         struct tcphdr _tcph, *th;
 884
 885         th = skb_header_pointer(skb, nh_len, sizeof(_tcph), &_tcph);
 886         if (th == NULL)
 887                 return 0;
 888         return th->rst;
 889 }
 890
 891 /* Handle response packets: rewrite addresses and send away...
 892  * Used for NAT and local client.
 893  */
 894 static unsigned int
 895 handle_response(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
 896                 struct ip_vs_conn *cp, int ihl)
 897 {
 898         IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
 899
 900         if (!skb_make_writable(skb, ihl))
 901                 goto drop;
 902
 903         /* mangle the packet */
 904         if (pp->snat_handler && !pp->snat_handler(skb, pp, cp))
 905                 goto drop;
 906
 907 #ifdef CONFIG_IP_VS_IPV6
 908         if (af == AF_INET6)
 909                 ipv6_hdr(skb)->saddr = cp->vaddr.in6;
 910         else
 911 #endif
 912         {
 913                 ip_hdr(skb)->saddr = cp->vaddr.ip;
 914                 ip_send_check(ip_hdr(skb));
 915         }
 916
 917         /* For policy routing, packets originating from this
 918          * machine itself may be routed differently to packets
 919          * passing through.  We want this packet to be routed as
 920          * if it came from this machine itself.  So re-compute
 921          * the routing information.
 922          */
 923 #ifdef CONFIG_IP_VS_IPV6
 924         if (af == AF_INET6) {
 925                 if (ip6_route_me_harder(skb) != 0)
 926                         goto drop;
 927         } else
 928 #endif
 929                 if (ip_route_me_harder(skb, RTN_LOCAL) != 0)
 930                         goto drop;
 931
 932         IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
 933
 934         ip_vs_out_stats(cp, skb);
 935         ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
 936         ip_vs_conn_put(cp);
 937
 938         skb->ipvs_property = 1;
 939
 940         LeaveFunction(11);
 941         return NF_ACCEPT;
 942
 943 drop:
 944         ip_vs_conn_put(cp);
 945         kfree_skb(skb);
 946         return NF_STOLEN;
 947 }
 948
 949 /*
 950  *      It is hooked at the NF_INET_FORWARD chain, used only for VS/NAT.
 951  *      Check if outgoing packet belongs to the established ip_vs_conn.
 952  */
 953 static unsigned int
 954 ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
 955           const struct net_device *in, const struct net_device *out,
 956           int (*okfn)(struct sk_buff *))
 957 {
 958         struct ip_vs_iphdr iph;
 959         struct ip_vs_protocol *pp;
 960         struct ip_vs_conn *cp;
 961         int af;
 962
 963         EnterFunction(11);
 964
 965         af = (skb->protocol == htons(ETH_P_IP)) ? AF_INET : AF_INET6;
 966
 967         if (skb->ipvs_property)
 968                 return NF_ACCEPT;
 969
 970         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 971 #ifdef CONFIG_IP_VS_IPV6
 972         if (af == AF_INET6) {
 973                 if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
 974                         int related, verdict = ip_vs_out_icmp_v6(skb, &related);
 975
 976                         if (related)
 977                                 return verdict;
 978                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 979                 }
 980         } else
 981 #endif
 982                 if (unlikely(iph.protocol == IPPROTO_ICMP)) {
 983                         int related, verdict = ip_vs_out_icmp(skb, &related);
 984
 985                         if (related)
 986                                 return verdict;
 987                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 988                 }
 989
 990         pp = ip_vs_proto_get(iph.protocol);
 991         if (unlikely(!pp))
 992                 return NF_ACCEPT;
 993
 994         /* reassemble IP fragments */
 995 #ifdef CONFIG_IP_VS_IPV6
 996         if (af == AF_INET6) {
 997                 if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
 998                         int related, verdict = ip_vs_out_icmp_v6(skb, &related);
 999
1000                         if (related)
1001                                 return verdict;
1002
1003                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1004                 }
1005         } else
1006 #endif
1007                 if (unlikely(ip_hdr(skb)->frag_off & htons(IP_MF|IP_OFFSET) &&
1008                              !pp->dont_defrag)) {
1009                         if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
1010                                 return NF_STOLEN;
1011
1012                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1013                 }
1014
1015         /*
1016          * Check if the packet belongs to an existing entry
1017          */
1018         cp = pp->conn_out_get(af, skb, pp, &iph, iph.len, 0);
1019
1020         if (unlikely(!cp)) {
1021                 if (sysctl_ip_vs_nat_icmp_send &&
1022                     (pp->protocol == IPPROTO_TCP ||
1023                      pp->protocol == IPPROTO_UDP ||
1024                      pp->protocol == IPPROTO_SCTP)) {
1025                         __be16 _ports[2], *pptr;
1026
1027                         pptr = skb_header_pointer(skb, iph.len,
1028                                                   sizeof(_ports), _ports);
1029                         if (pptr == NULL)
1030                                 return NF_ACCEPT;       /* Not for me */
1031                         if (ip_vs_lookup_real_service(af, iph.protocol,
1032                                                       &iph.saddr,
1033                                                       pptr[0])) {
1034                                 /*
1035                                  * Notify the real server: there is no
1036                                  * existing entry if it is not RST
1037                                  * packet or not TCP packet.
1038                                  */
1039                                 if ((iph.protocol != IPPROTO_TCP &&
1040                                      iph.protocol != IPPROTO_SCTP)
1041                                      || ((iph.protocol == IPPROTO_TCP
1042                                           && !is_tcp_reset(skb, iph.len))
1043                                          || (iph.protocol == IPPROTO_SCTP
1044                                                 && !is_sctp_abort(skb,
1045                                                         iph.len)))) {
1046 #ifdef CONFIG_IP_VS_IPV6
1047                                         if (af == AF_INET6)
1048                                                 icmpv6_send(skb,
1049                                                             ICMPV6_DEST_UNREACH,
1050                                                             ICMPV6_PORT_UNREACH,
1051                                                             0);
1052                                         else
1053 #endif
1054                                                 icmp_send(skb,
1055                                                           ICMP_DEST_UNREACH,
1056                                                           ICMP_PORT_UNREACH, 0);
1057                                         return NF_DROP;
1058                                 }
1059                         }
1060                 }
1061                 IP_VS_DBG_PKT(12, pp, skb, 0,
1062                               "packet continues traversal as normal");
1063                 return NF_ACCEPT;
1064         }
1065
1066         return handle_response(af, skb, pp, cp, iph.len);
1067 }
1068
1069
1070 /*
1071  *      Handle ICMP messages in the outside-to-inside direction (incoming).
1072  *      Find any that might be relevant, check against existing connections,
1073  *      forward to the right destination host if relevant.
1074  *      Currently handles error types - unreachable, quench, ttl exceeded.
1075  */
1076 static int
1077 ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
1078 {
1079         struct iphdr *iph;
1080         struct icmphdr  _icmph, *ic;
1081         struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
1082         struct ip_vs_iphdr ciph;
1083         struct ip_vs_conn *cp;
1084         struct ip_vs_protocol *pp;
1085         unsigned int offset, ihl, verdict;
1086         union nf_inet_addr snet;
1087
1088         *related = 1;
1089
1090         /* reassemble IP fragments */
1091         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
1092                 if (ip_vs_gather_frags(skb, hooknum == NF_INET_LOCAL_IN ?
1093                                             IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD))
1094                         return NF_STOLEN;
1095         }
1096
1097         iph = ip_hdr(skb);
1098         offset = ihl = iph->ihl * 4;
1099         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
1100         if (ic == NULL)
1101                 return NF_DROP;
1102
1103         IP_VS_DBG(12, "Incoming ICMP (%d,%d) %pI4->%pI4\n",
1104                   ic->type, ntohs(icmp_id(ic)),
1105                   &iph->saddr, &iph->daddr);
1106
1107         /*
1108          * Work through seeing if this is for us.
1109          * These checks are supposed to be in an order that means easy
1110          * things are checked first to speed up processing.... however
1111          * this means that some packets will manage to get a long way
1112          * down this stack and then be rejected, but that's life.
1113          */
1114         if ((ic->type != ICMP_DEST_UNREACH) &&
1115             (ic->type != ICMP_SOURCE_QUENCH) &&
1116             (ic->type != ICMP_TIME_EXCEEDED)) {
1117                 *related = 0;
1118                 return NF_ACCEPT;
1119         }
1120
1121         /* Now find the contained IP header */
1122         offset += sizeof(_icmph);
1123         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
1124         if (cih == NULL)
1125                 return NF_ACCEPT; /* The packet looks wrong, ignore */
1126
1127         pp = ip_vs_proto_get(cih->protocol);
1128         if (!pp)
1129                 return NF_ACCEPT;
1130
1131         /* Is the embedded protocol header present? */
1132         if (unlikely(cih->frag_off & htons(IP_OFFSET) &&
1133                      pp->dont_defrag))
1134                 return NF_ACCEPT;
1135
1136         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMP for");
1137
1138         offset += cih->ihl * 4;
1139
1140         ip_vs_fill_iphdr(AF_INET, cih, &ciph);
1141         /* The embedded headers contain source and dest in reverse order */
1142         cp = pp->conn_in_get(AF_INET, skb, pp, &ciph, offset, 1);
1143         if (!cp) {
1144                 /* The packet could also belong to a local client */
1145                 cp = pp->conn_out_get(AF_INET, skb, pp, &ciph, offset, 1);
1146                 if (cp) {
1147                         snet.ip = iph->saddr;
1148                         return handle_response_icmp(AF_INET, skb, &snet,
1149                                                     cih->protocol, cp, pp,
1150                                                     offset, ihl);
1151                 }
1152                 return NF_ACCEPT;
1153         }
1154
1155         verdict = NF_DROP;
1156
1157         /* Ensure the checksum is correct */
1158         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
1159                 /* Failed checksum! */
1160                 IP_VS_DBG(1, "Incoming ICMP: failed checksum from %pI4!\n",
1161                           &iph->saddr);
1162                 goto out;
1163         }
1164
1165         /* do the statistics and put it back */
1166         ip_vs_in_stats(cp, skb);
1167         if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
1168                 offset += 2 * sizeof(__u16);
1169         verdict = ip_vs_icmp_xmit(skb, cp, pp, offset);
1170         /* do not touch skb anymore */
1171
1172   out:
1173         __ip_vs_conn_put(cp);
1174
1175         return verdict;
1176 }
1177
1178 #ifdef CONFIG_IP_VS_IPV6
1179 static int
1180 ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)
1181 {
1182         struct ipv6hdr *iph;
1183         struct icmp6hdr _icmph, *ic;
1184         struct ipv6hdr  _ciph, *cih;    /* The ip header contained
1185                                            within the ICMP */
1186         struct ip_vs_iphdr ciph;
1187         struct ip_vs_conn *cp;
1188         struct ip_vs_protocol *pp;
1189         unsigned int offset, verdict;
1190         union nf_inet_addr snet;
1191
1192         *related = 1;
1193
1194         /* reassemble IP fragments */
1195         if (ipv6_hdr(skb)->nexthdr == IPPROTO_FRAGMENT) {
1196                 if (ip_vs_gather_frags_v6(skb, hooknum == NF_INET_LOCAL_IN ?
1197                                                IP_DEFRAG_VS_IN :
1198                                                IP_DEFRAG_VS_FWD))
1199                         return NF_STOLEN;
1200         }
1201
1202         iph = ipv6_hdr(skb);
1203         offset = sizeof(struct ipv6hdr);
1204         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
1205         if (ic == NULL)
1206                 return NF_DROP;
1207
1208         IP_VS_DBG(12, "Incoming ICMPv6 (%d,%d) %pI6->%pI6\n",
1209                   ic->icmp6_type, ntohs(icmpv6_id(ic)),
1210                   &iph->saddr, &iph->daddr);
1211
1212         /*
1213          * Work through seeing if this is for us.
1214          * These checks are supposed to be in an order that means easy
1215          * things are checked first to speed up processing.... however
1216          * this means that some packets will manage to get a long way
1217          * down this stack and then be rejected, but that's life.
1218          */
1219         if ((ic->icmp6_type != ICMPV6_DEST_UNREACH) &&
1220             (ic->icmp6_type != ICMPV6_PKT_TOOBIG) &&
1221             (ic->icmp6_type != ICMPV6_TIME_EXCEED)) {
1222                 *related = 0;
1223                 return NF_ACCEPT;
1224         }
1225
1226         /* Now find the contained IP header */
1227         offset += sizeof(_icmph);
1228         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
1229         if (cih == NULL)
1230                 return NF_ACCEPT; /* The packet looks wrong, ignore */
1231
1232         pp = ip_vs_proto_get(cih->nexthdr);
1233         if (!pp)
1234                 return NF_ACCEPT;
1235
1236         /* Is the embedded protocol header present? */
1237         /* TODO: we don't support fragmentation at the moment anyways */
1238         if (unlikely(cih->nexthdr == IPPROTO_FRAGMENT && pp->dont_defrag))
1239                 return NF_ACCEPT;
1240
1241         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMPv6 for");
1242
1243         offset += sizeof(struct ipv6hdr);
1244
1245         ip_vs_fill_iphdr(AF_INET6, cih, &ciph);
1246         /* The embedded headers contain source and dest in reverse order */
1247         cp = pp->conn_in_get(AF_INET6, skb, pp, &ciph, offset, 1);
1248         if (!cp) {
1249                 /* The packet could also belong to a local client */
1250                 cp = pp->conn_out_get(AF_INET6, skb, pp, &ciph, offset, 1);
1251                 if (cp) {
1252                         ipv6_addr_copy(&snet.in6, &iph->saddr);
1253                         return handle_response_icmp(AF_INET6, skb, &snet,
1254                                                     cih->nexthdr,
1255                                                     cp, pp, offset,
1256                                                     sizeof(struct ipv6hdr));
1257                 }
1258                 return NF_ACCEPT;
1259         }
1260
1261         verdict = NF_DROP;
1262
1263         /* do the statistics and put it back */
1264         ip_vs_in_stats(cp, skb);
1265         if (IPPROTO_TCP == cih->nexthdr || IPPROTO_UDP == cih->nexthdr ||
1266             IPPROTO_SCTP == cih->nexthdr)
1267                 offset += 2 * sizeof(__u16);
1268         verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, offset);
1269         /* do not touch skb anymore */
1270
1271         __ip_vs_conn_put(cp);
1272
1273         return verdict;
1274 }
1275 #endif
1276
1277
1278 /*
1279  *      Check if it's for virtual services, look it up,
1280  *      and send it on its way...
1281  */
1282 static unsigned int
1283 ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
1284          const struct net_device *in, const struct net_device *out,
1285          int (*okfn)(struct sk_buff *))
1286 {
1287         struct ip_vs_iphdr iph;
1288         struct ip_vs_protocol *pp;
1289         struct ip_vs_conn *cp;
1290         int ret, restart, af, pkts;
1291
1292         af = (skb->protocol == htons(ETH_P_IP)) ? AF_INET : AF_INET6;
1293
1294         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1295
1296         /*
1297          *      Big tappo: only PACKET_HOST, including loopback for local client
1298          *      Don't handle local packets on IPv6 for now
1299          */
1300         if (unlikely(skb->pkt_type != PACKET_HOST)) {
1301                 IP_VS_DBG_BUF(12, "packet type=%d proto=%d daddr=%s ignored\n",
1302                               skb->pkt_type,
1303                               iph.protocol,
1304                               IP_VS_DBG_ADDR(af, &iph.daddr));
1305                 return NF_ACCEPT;
1306         }
1307
1308 #ifdef CONFIG_IP_VS_IPV6
1309         if (af == AF_INET6) {
1310                 if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
1311                         int related, verdict = ip_vs_in_icmp_v6(skb, &related, hooknum);
1312
1313                         if (related)
1314                                 return verdict;
1315                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1316                 }
1317         } else
1318 #endif
1319                 if (unlikely(iph.protocol == IPPROTO_ICMP)) {
1320                         int related, verdict = ip_vs_in_icmp(skb, &related, hooknum);
1321
1322                         if (related)
1323                                 return verdict;
1324                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1325                 }
1326
1327         /* Protocol supported? */
1328         pp = ip_vs_proto_get(iph.protocol);
1329         if (unlikely(!pp))
1330                 return NF_ACCEPT;
1331
1332         /*
1333          * Check if the packet belongs to an existing connection entry
1334          */
1335         cp = pp->conn_in_get(af, skb, pp, &iph, iph.len, 0);
1336
1337         if (unlikely(!cp)) {
1338                 int v;
1339
1340                 /* For local client packets, it could be a response */
1341                 cp = pp->conn_out_get(af, skb, pp, &iph, iph.len, 0);
1342                 if (cp)
1343                         return handle_response(af, skb, pp, cp, iph.len);
1344
1345                 if (!pp->conn_schedule(af, skb, pp, &v, &cp))
1346                         return v;
1347         }
1348
1349         if (unlikely(!cp)) {
1350                 /* sorry, all this trouble for a no-hit :) */
1351                 IP_VS_DBG_PKT(12, pp, skb, 0,
1352                               "packet continues traversal as normal");
1353                 return NF_ACCEPT;
1354         }
1355
1356         IP_VS_DBG_PKT(11, pp, skb, 0, "Incoming packet");
1357
1358         /* Check the server status */
1359         if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
1360                 /* the destination server is not available */
1361
1362                 if (sysctl_ip_vs_expire_nodest_conn) {
1363                         /* try to expire the connection immediately */
1364                         ip_vs_conn_expire_now(cp);
1365                 }
1366                 /* don't restart its timer, and silently
1367                    drop the packet. */
1368                 __ip_vs_conn_put(cp);
1369                 return NF_DROP;
1370         }
1371
1372         ip_vs_in_stats(cp, skb);
1373         restart = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
1374         if (cp->packet_xmit)
1375                 ret = cp->packet_xmit(skb, cp, pp);
1376                 /* do not touch skb anymore */
1377         else {
1378                 IP_VS_DBG_RL("warning: packet_xmit is null");
1379                 ret = NF_ACCEPT;
1380         }
1381
1382         /* Increase its packet counter and check if it is needed
1383          * to be synchronized
1384          *
1385          * Sync connection if it is about to close to
1386          * encorage the standby servers to update the connections timeout
1387          */
1388         pkts = atomic_add_return(1, &cp->in_pkts);
1389         if (af == AF_INET && (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
1390             cp->protocol == IPPROTO_SCTP) {
1391                 if ((cp->state == IP_VS_SCTP_S_ESTABLISHED &&
1392                         (atomic_read(&cp->in_pkts) %
1393                          sysctl_ip_vs_sync_threshold[1]
1394                          == sysctl_ip_vs_sync_threshold[0])) ||
1395                                 (cp->old_state != cp->state &&
1396                                  ((cp->state == IP_VS_SCTP_S_CLOSED) ||
1397                                   (cp->state == IP_VS_SCTP_S_SHUT_ACK_CLI) ||
1398                                   (cp->state == IP_VS_SCTP_S_SHUT_ACK_SER)))) {
1399                         ip_vs_sync_conn(cp);
1400                         goto out;
1401                 }
1402         }
1403
1404         if (af == AF_INET &&
1405             (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
1406             (((cp->protocol != IPPROTO_TCP ||
1407                cp->state == IP_VS_TCP_S_ESTABLISHED) &&
1408               (pkts % sysctl_ip_vs_sync_threshold[1]
1409                == sysctl_ip_vs_sync_threshold[0])) ||
1410              ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) &&
1411               ((cp->state == IP_VS_TCP_S_FIN_WAIT) ||
1412                (cp->state == IP_VS_TCP_S_CLOSE) ||
1413                (cp->state == IP_VS_TCP_S_CLOSE_WAIT) ||
1414                (cp->state == IP_VS_TCP_S_TIME_WAIT)))))
1415                 ip_vs_sync_conn(cp);
1416 out:
1417         cp->old_state = cp->state;
1418
1419         ip_vs_conn_put(cp);
1420         return ret;
1421 }
1422
1423
1424 /*
1425  *      It is hooked at the NF_INET_FORWARD chain, in order to catch ICMP
1426  *      related packets destined for 0.0.0.0/0.
1427  *      When fwmark-based virtual service is used, such as transparent
1428  *      cache cluster, TCP packets can be marked and routed to ip_vs_in,
1429  *      but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
1430  *      sent to ip_vs_in_icmp. So, catch them at the NF_INET_FORWARD chain
1431  *      and send them to ip_vs_in_icmp.
1432  */
1433 static unsigned int
1434 ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb,
1435                    const struct net_device *in, const struct net_device *out,
1436                    int (*okfn)(struct sk_buff *))
1437 {
1438         int r;
1439
1440         if (ip_hdr(skb)->protocol != IPPROTO_ICMP)
1441                 return NF_ACCEPT;
1442
1443         return ip_vs_in_icmp(skb, &r, hooknum);
1444 }
1445
1446 #ifdef CONFIG_IP_VS_IPV6
1447 static unsigned int
1448 ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb,
1449                       const struct net_device *in, const struct net_device *out,
1450                       int (*okfn)(struct sk_buff *))
1451 {
1452         int r;
1453
1454         if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
1455                 return NF_ACCEPT;
1456
1457         return ip_vs_in_icmp_v6(skb, &r, hooknum);
1458 }
1459 #endif
1460
1461
1462 static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
1463         /* After packet filtering, forward packet through VS/DR, VS/TUN,
1464          * or VS/NAT(change destination), so that filtering rules can be
1465          * applied to IPVS. */
1466         {
1467                 .hook           = ip_vs_in,
1468                 .owner          = THIS_MODULE,
1469                 .pf             = PF_INET,
1470                 .hooknum        = NF_INET_LOCAL_IN,
1471                 .priority       = 100,
1472         },
1473         /* After packet filtering, change source only for VS/NAT */
1474         {
1475                 .hook           = ip_vs_out,
1476                 .owner          = THIS_MODULE,
1477                 .pf             = PF_INET,
1478                 .hooknum        = NF_INET_FORWARD,
1479                 .priority       = 100,
1480         },
1481         /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1482          * destined for 0.0.0.0/0, which is for incoming IPVS connections */
1483         {
1484                 .hook           = ip_vs_forward_icmp,
1485                 .owner          = THIS_MODULE,
1486                 .pf             = PF_INET,
1487                 .hooknum        = NF_INET_FORWARD,
1488                 .priority       = 99,
1489         },
1490         /* Before the netfilter connection tracking, exit from POST_ROUTING */
1491         {
1492                 .hook           = ip_vs_post_routing,
1493                 .owner          = THIS_MODULE,
1494                 .pf             = PF_INET,
1495                 .hooknum        = NF_INET_POST_ROUTING,
1496                 .priority       = NF_IP_PRI_NAT_SRC-1,
1497         },
1498 #ifdef CONFIG_IP_VS_IPV6
1499         /* After packet filtering, forward packet through VS/DR, VS/TUN,
1500          * or VS/NAT(change destination), so that filtering rules can be
1501          * applied to IPVS. */
1502         {
1503                 .hook           = ip_vs_in,
1504                 .owner          = THIS_MODULE,
1505                 .pf             = PF_INET6,
1506                 .hooknum        = NF_INET_LOCAL_IN,
1507                 .priority       = 100,
1508         },
1509         /* After packet filtering, change source only for VS/NAT */
1510         {
1511                 .hook           = ip_vs_out,
1512                 .owner          = THIS_MODULE,
1513                 .pf             = PF_INET6,
1514                 .hooknum        = NF_INET_FORWARD,
1515                 .priority       = 100,
1516         },
1517         /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1518          * destined for 0.0.0.0/0, which is for incoming IPVS connections */
1519         {
1520                 .hook           = ip_vs_forward_icmp_v6,
1521                 .owner          = THIS_MODULE,
1522                 .pf             = PF_INET6,
1523                 .hooknum        = NF_INET_FORWARD,
1524                 .priority       = 99,
1525         },
1526         /* Before the netfilter connection tracking, exit from POST_ROUTING */
1527         {
1528                 .hook           = ip_vs_post_routing,
1529                 .owner          = THIS_MODULE,
1530                 .pf             = PF_INET6,
1531                 .hooknum        = NF_INET_POST_ROUTING,
1532                 .priority       = NF_IP6_PRI_NAT_SRC-1,
1533         },
1534 #endif
1535 };
1536
1537
1538 /*
1539  *      Initialize IP Virtual Server
1540  */
1541 static int __init ip_vs_init(void)
1542 {
1543         int ret;
1544
1545         ip_vs_estimator_init();
1546
1547         ret = ip_vs_control_init();
1548         if (ret < 0) {
1549                 pr_err("can't setup control.\n");
1550                 goto cleanup_estimator;
1551         }
1552
1553         ip_vs_protocol_init();
1554
1555         ret = ip_vs_app_init();
1556         if (ret < 0) {
1557                 pr_err("can't setup application helper.\n");
1558                 goto cleanup_protocol;
1559         }
1560
1561         ret = ip_vs_conn_init();
1562         if (ret < 0) {
1563                 pr_err("can't setup connection table.\n");
1564                 goto cleanup_app;
1565         }
1566
1567         ret = nf_register_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
1568         if (ret < 0) {
1569                 pr_err("can't register hooks.\n");
1570                 goto cleanup_conn;
1571         }
1572
1573         pr_info("ipvs loaded.\n");
1574         return ret;
1575
1576   cleanup_conn:
1577         ip_vs_conn_cleanup();
1578   cleanup_app:
1579         ip_vs_app_cleanup();
1580   cleanup_protocol:
1581         ip_vs_protocol_cleanup();
1582         ip_vs_control_cleanup();
1583   cleanup_estimator:
1584         ip_vs_estimator_cleanup();
1585         return ret;
1586 }
1587
1588 static void __exit ip_vs_cleanup(void)
1589 {
1590         nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
1591         ip_vs_conn_cleanup();
1592         ip_vs_app_cleanup();
1593         ip_vs_protocol_cleanup();
1594         ip_vs_control_cleanup();
1595         ip_vs_estimator_cleanup();
1596         pr_info("ipvs unloaded.\n");
1597 }
1598
1599 module_init(ip_vs_init);
1600 module_exit(ip_vs_cleanup);
1601 MODULE_LICENSE("GPL");