net/netfilter/ipvs/ip_vs_core.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the Netfilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
  18  * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
  19  * and others.
  20  *
  21  * Changes:
  22  *      Paul `Rusty' Russell            properly handle non-linear skbs
  23  *      Harald Welte                    don't use nfcache
  24  *
  25  */
  26
  27 #define KMSG_COMPONENT "IPVS"
  28 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  29
  30 #include <linux/module.h>
  31 #include <linux/kernel.h>
  32 #include <linux/ip.h>
  33 #include <linux/tcp.h>
  34 #include <linux/sctp.h>
  35 #include <linux/icmp.h>
  36 #include <linux/slab.h>
  37
  38 #include <net/ip.h>
  39 #include <net/tcp.h>
  40 #include <net/udp.h>
  41 #include <net/icmp.h>                   /* for icmp_send */
  42 #include <net/route.h>
  43 #include <net/ip6_checksum.h>
  44
  45 #include <linux/netfilter.h>
  46 #include <linux/netfilter_ipv4.h>
  47
  48 #ifdef CONFIG_IP_VS_IPV6
  49 #include <net/ipv6.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #endif
  52
  53 #include <net/ip_vs.h>
  54
  55
  56 EXPORT_SYMBOL(register_ip_vs_scheduler);
  57 EXPORT_SYMBOL(unregister_ip_vs_scheduler);
  58 EXPORT_SYMBOL(ip_vs_proto_name);
  59 EXPORT_SYMBOL(ip_vs_conn_new);
  60 EXPORT_SYMBOL(ip_vs_conn_in_get);
  61 EXPORT_SYMBOL(ip_vs_conn_out_get);
  62 #ifdef CONFIG_IP_VS_PROTO_TCP
  63 EXPORT_SYMBOL(ip_vs_tcp_conn_listen);
  64 #endif
  65 EXPORT_SYMBOL(ip_vs_conn_put);
  66 #ifdef CONFIG_IP_VS_DEBUG
  67 EXPORT_SYMBOL(ip_vs_get_debug_level);
  68 #endif
  69
  70
  71 /* ID used in ICMP lookups */
  72 #define icmp_id(icmph)          (((icmph)->un).echo.id)
  73 #define icmpv6_id(icmph)        (icmph->icmp6_dataun.u_echo.identifier)
  74
  75 const char *ip_vs_proto_name(unsigned proto)
  76 {
  77         static char buf[20];
  78
  79         switch (proto) {
  80         case IPPROTO_IP:
  81                 return "IP";
  82         case IPPROTO_UDP:
  83                 return "UDP";
  84         case IPPROTO_TCP:
  85                 return "TCP";
  86         case IPPROTO_SCTP:
  87                 return "SCTP";
  88         case IPPROTO_ICMP:
  89                 return "ICMP";
  90 #ifdef CONFIG_IP_VS_IPV6
  91         case IPPROTO_ICMPV6:
  92                 return "ICMPv6";
  93 #endif
  94         default:
  95                 sprintf(buf, "IP_%d", proto);
  96                 return buf;
  97         }
  98 }
  99
 100 void ip_vs_init_hash_table(struct list_head *table, int rows)
 101 {
 102         while (--rows >= 0)
 103                 INIT_LIST_HEAD(&table[rows]);
 104 }
 105
 106 static inline void
 107 ip_vs_in_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 108 {
 109         struct ip_vs_dest *dest = cp->dest;
 110         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
 111                 spin_lock(&dest->stats.lock);
 112                 dest->stats.ustats.inpkts++;
 113                 dest->stats.ustats.inbytes += skb->len;
 114                 spin_unlock(&dest->stats.lock);
 115
 116                 spin_lock(&dest->svc->stats.lock);
 117                 dest->svc->stats.ustats.inpkts++;
 118                 dest->svc->stats.ustats.inbytes += skb->len;
 119                 spin_unlock(&dest->svc->stats.lock);
 120
 121                 spin_lock(&ip_vs_stats.lock);
 122                 ip_vs_stats.ustats.inpkts++;
 123                 ip_vs_stats.ustats.inbytes += skb->len;
 124                 spin_unlock(&ip_vs_stats.lock);
 125         }
 126 }
 127
 128
 129 static inline void
 130 ip_vs_out_stats(struct ip_vs_conn *cp, struct sk_buff *skb)
 131 {
 132         struct ip_vs_dest *dest = cp->dest;
 133         if (dest && (dest->flags & IP_VS_DEST_F_AVAILABLE)) {
 134                 spin_lock(&dest->stats.lock);
 135                 dest->stats.ustats.outpkts++;
 136                 dest->stats.ustats.outbytes += skb->len;
 137                 spin_unlock(&dest->stats.lock);
 138
 139                 spin_lock(&dest->svc->stats.lock);
 140                 dest->svc->stats.ustats.outpkts++;
 141                 dest->svc->stats.ustats.outbytes += skb->len;
 142                 spin_unlock(&dest->svc->stats.lock);
 143
 144                 spin_lock(&ip_vs_stats.lock);
 145                 ip_vs_stats.ustats.outpkts++;
 146                 ip_vs_stats.ustats.outbytes += skb->len;
 147                 spin_unlock(&ip_vs_stats.lock);
 148         }
 149 }
 150
 151
 152 static inline void
 153 ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
 154 {
 155         spin_lock(&cp->dest->stats.lock);
 156         cp->dest->stats.ustats.conns++;
 157         spin_unlock(&cp->dest->stats.lock);
 158
 159         spin_lock(&svc->stats.lock);
 160         svc->stats.ustats.conns++;
 161         spin_unlock(&svc->stats.lock);
 162
 163         spin_lock(&ip_vs_stats.lock);
 164         ip_vs_stats.ustats.conns++;
 165         spin_unlock(&ip_vs_stats.lock);
 166 }
 167
 168
 169 static inline int
 170 ip_vs_set_state(struct ip_vs_conn *cp, int direction,
 171                 const struct sk_buff *skb,
 172                 struct ip_vs_protocol *pp)
 173 {
 174         if (unlikely(!pp->state_transition))
 175                 return 0;
 176         return pp->state_transition(cp, direction, skb, pp);
 177 }
 178
 179 static inline void
 180 ip_vs_conn_fill_param_persist(const struct ip_vs_service *svc,
 181                               struct sk_buff *skb, int protocol,
 182                               const union nf_inet_addr *caddr, __be16 cport,
 183                               const union nf_inet_addr *vaddr, __be16 vport,
 184                               struct ip_vs_conn_param *p)
 185 {
 186         ip_vs_conn_fill_param(svc->af, protocol, caddr, cport, vaddr, vport, p);
 187         p->pe = svc->pe;
 188         if (p->pe && p->pe->fill_param)
 189                 p->pe->fill_param(p, skb);
 190 }
 191
 192 /*
 193  *  IPVS persistent scheduling function
 194  *  It creates a connection entry according to its template if exists,
 195  *  or selects a server and creates a connection entry plus a template.
 196  *  Locking: we are svc user (svc->refcnt), so we hold all dests too
 197  *  Protocols supported: TCP, UDP
 198  */
 199 static struct ip_vs_conn *
 200 ip_vs_sched_persist(struct ip_vs_service *svc,
 201                     struct sk_buff *skb,
 202                     __be16 ports[2])
 203 {
 204         struct ip_vs_conn *cp = NULL;
 205         struct ip_vs_iphdr iph;
 206         struct ip_vs_dest *dest;
 207         struct ip_vs_conn *ct;
 208         __be16 dport = 0;               /* destination port to forward */
 209         unsigned int flags;
 210         struct ip_vs_conn_param param;
 211         union nf_inet_addr snet;        /* source network of the client,
 212                                            after masking */
 213
 214         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 215
 216         /* Mask saddr with the netmask to adjust template granularity */
 217 #ifdef CONFIG_IP_VS_IPV6
 218         if (svc->af == AF_INET6)
 219                 ipv6_addr_prefix(&snet.in6, &iph.saddr.in6, svc->netmask);
 220         else
 221 #endif
 222                 snet.ip = iph.saddr.ip & svc->netmask;
 223
 224         IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "
 225                       "mnet %s\n",
 226                       IP_VS_DBG_ADDR(svc->af, &iph.saddr), ntohs(ports[0]),
 227                       IP_VS_DBG_ADDR(svc->af, &iph.daddr), ntohs(ports[1]),
 228                       IP_VS_DBG_ADDR(svc->af, &snet));
 229
 230         /*
 231          * As far as we know, FTP is a very complicated network protocol, and
 232          * it uses control connection and data connections. For active FTP,
 233          * FTP server initialize data connection to the client, its source port
 234          * is often 20. For passive FTP, FTP server tells the clients the port
 235          * that it passively listens to,  and the client issues the data
 236          * connection. In the tunneling or direct routing mode, the load
 237          * balancer is on the client-to-server half of connection, the port
 238          * number is unknown to the load balancer. So, a conn template like
 239          * <caddr, 0, vaddr, 0, daddr, 0> is created for persistent FTP
 240          * service, and a template like <caddr, 0, vaddr, vport, daddr, dport>
 241          * is created for other persistent services.
 242          */
 243         {
 244                 int protocol = iph.protocol;
 245                 const union nf_inet_addr *vaddr = &iph.daddr;
 246                 const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
 247                 __be16 vport = 0;
 248
 249                 if (ports[1] == svc->port) {
 250                         /* non-FTP template:
 251                          * <protocol, caddr, 0, vaddr, vport, daddr, dport>
 252                          * FTP template:
 253                          * <protocol, caddr, 0, vaddr, 0, daddr, 0>
 254                          */
 255                         if (svc->port != FTPPORT)
 256                                 vport = ports[1];
 257                 } else {
 258                         /* Note: persistent fwmark-based services and
 259                          * persistent port zero service are handled here.
 260                          * fwmark template:
 261                          * <IPPROTO_IP,caddr,0,fwmark,0,daddr,0>
 262                          * port zero template:
 263                          * <protocol,caddr,0,vaddr,0,daddr,0>
 264                          */
 265                         if (svc->fwmark) {
 266                                 protocol = IPPROTO_IP;
 267                                 vaddr = &fwmark;
 268                         }
 269                 }
 270                 ip_vs_conn_fill_param_persist(svc, skb, protocol, &snet, 0,
 271                                               vaddr, vport, &param);
 272         }
 273
 274         /* Check if a template already exists */
 275         ct = ip_vs_ct_in_get(&param);
 276         if (!ct || !ip_vs_check_template(ct)) {
 277                 /* No template found or the dest of the connection
 278                  * template is not available.
 279                  */
 280                 dest = svc->scheduler->schedule(svc, skb);
 281                 if (!dest) {
 282                         IP_VS_DBG(1, "p-schedule: no dest found.\n");
 283                         kfree(param.pe_data);
 284                         return NULL;
 285                 }
 286
 287                 if (ports[1] == svc->port && svc->port != FTPPORT)
 288                         dport = dest->port;
 289
 290                 /* Create a template
 291                  * This adds param.pe_data to the template,
 292                  * and thus param.pe_data will be destroyed
 293                  * when the template expires */
 294                 ct = ip_vs_conn_new(&param, &dest->addr, dport,
 295                                     IP_VS_CONN_F_TEMPLATE, dest);
 296                 if (ct == NULL) {
 297                         kfree(param.pe_data);
 298                         return NULL;
 299                 }
 300
 301                 ct->timeout = svc->timeout;
 302         } else {
 303                 /* set destination with the found template */
 304                 dest = ct->dest;
 305                 kfree(param.pe_data);
 306         }
 307
 308         dport = ports[1];
 309         if (dport == svc->port && dest->port)
 310                 dport = dest->port;
 311
 312         flags = (svc->flags & IP_VS_SVC_F_ONEPACKET
 313                  && iph.protocol == IPPROTO_UDP)?
 314                 IP_VS_CONN_F_ONE_PACKET : 0;
 315
 316         /*
 317          *    Create a new connection according to the template
 318          */
 319         ip_vs_conn_fill_param(svc->af, iph.protocol, &iph.saddr, ports[0],
 320                               &iph.daddr, ports[1], &param);
 321         cp = ip_vs_conn_new(&param, &dest->addr, dport, flags, dest);
 322         if (cp == NULL) {
 323                 ip_vs_conn_put(ct);
 324                 return NULL;
 325         }
 326
 327         /*
 328          *    Add its control
 329          */
 330         ip_vs_control_add(cp, ct);
 331         ip_vs_conn_put(ct);
 332
 333         ip_vs_conn_stats(cp, svc);
 334         return cp;
 335 }
 336
 337
 338 /*
 339  *  IPVS main scheduling function
 340  *  It selects a server according to the virtual service, and
 341  *  creates a connection entry.
 342  *  Protocols supported: TCP, UDP
 343  */
 344 struct ip_vs_conn *
 345 ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb)
 346 {
 347         struct ip_vs_conn *cp = NULL;
 348         struct ip_vs_iphdr iph;
 349         struct ip_vs_dest *dest;
 350         __be16 _ports[2], *pptr;
 351         unsigned int flags;
 352
 353         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 354         pptr = skb_header_pointer(skb, iph.len, sizeof(_ports), _ports);
 355         if (pptr == NULL)
 356                 return NULL;
 357
 358         /*
 359          *    Persistent service
 360          */
 361         if (svc->flags & IP_VS_SVC_F_PERSISTENT)
 362                 return ip_vs_sched_persist(svc, skb, pptr);
 363
 364         /*
 365          *    Non-persistent service
 366          */
 367         if (!svc->fwmark && pptr[1] != svc->port) {
 368                 if (!svc->port)
 369                         pr_err("Schedule: port zero only supported "
 370                                "in persistent services, "
 371                                "check your ipvs configuration\n");
 372                 return NULL;
 373         }
 374
 375         dest = svc->scheduler->schedule(svc, skb);
 376         if (dest == NULL) {
 377                 IP_VS_DBG(1, "Schedule: no dest found.\n");
 378                 return NULL;
 379         }
 380
 381         flags = (svc->flags & IP_VS_SVC_F_ONEPACKET
 382                  && iph.protocol == IPPROTO_UDP)?
 383                 IP_VS_CONN_F_ONE_PACKET : 0;
 384
 385         /*
 386          *    Create a connection entry.
 387          */
 388         {
 389                 struct ip_vs_conn_param p;
 390                 ip_vs_conn_fill_param(svc->af, iph.protocol, &iph.saddr,
 391                                       pptr[0], &iph.daddr, pptr[1], &p);
 392                 cp = ip_vs_conn_new(&p, &dest->addr,
 393                                     dest->port ? dest->port : pptr[1],
 394                                     flags, dest);
 395                 if (!cp)
 396                         return NULL;
 397         }
 398
 399         IP_VS_DBG_BUF(6, "Schedule fwd:%c c:%s:%u v:%s:%u "
 400                       "d:%s:%u conn->flags:%X conn->refcnt:%d\n",
 401                       ip_vs_fwd_tag(cp),
 402                       IP_VS_DBG_ADDR(svc->af, &cp->caddr), ntohs(cp->cport),
 403                       IP_VS_DBG_ADDR(svc->af, &cp->vaddr), ntohs(cp->vport),
 404                       IP_VS_DBG_ADDR(svc->af, &cp->daddr), ntohs(cp->dport),
 405                       cp->flags, atomic_read(&cp->refcnt));
 406
 407         ip_vs_conn_stats(cp, svc);
 408         return cp;
 409 }
 410
 411
 412 /*
 413  *  Pass or drop the packet.
 414  *  Called by ip_vs_in, when the virtual service is available but
 415  *  no destination is available for a new connection.
 416  */
 417 int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
 418                 struct ip_vs_protocol *pp)
 419 {
 420         __be16 _ports[2], *pptr;
 421         struct ip_vs_iphdr iph;
 422         int unicast;
 423         ip_vs_fill_iphdr(svc->af, skb_network_header(skb), &iph);
 424
 425         pptr = skb_header_pointer(skb, iph.len, sizeof(_ports), _ports);
 426         if (pptr == NULL) {
 427                 ip_vs_service_put(svc);
 428                 return NF_DROP;
 429         }
 430
 431 #ifdef CONFIG_IP_VS_IPV6
 432         if (svc->af == AF_INET6)
 433                 unicast = ipv6_addr_type(&iph.daddr.in6) & IPV6_ADDR_UNICAST;
 434         else
 435 #endif
 436                 unicast = (inet_addr_type(&init_net, iph.daddr.ip) == RTN_UNICAST);
 437
 438         /* if it is fwmark-based service, the cache_bypass sysctl is up
 439            and the destination is a non-local unicast, then create
 440            a cache_bypass connection entry */
 441         if (sysctl_ip_vs_cache_bypass && svc->fwmark && unicast) {
 442                 int ret, cs;
 443                 struct ip_vs_conn *cp;
 444                 unsigned int flags = (svc->flags & IP_VS_SVC_F_ONEPACKET &&
 445                                       iph.protocol == IPPROTO_UDP)?
 446                                       IP_VS_CONN_F_ONE_PACKET : 0;
 447                 union nf_inet_addr daddr =  { .all = { 0, 0, 0, 0 } };
 448
 449                 ip_vs_service_put(svc);
 450
 451                 /* create a new connection entry */
 452                 IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__);
 453                 {
 454                         struct ip_vs_conn_param p;
 455                         ip_vs_conn_fill_param(svc->af, iph.protocol,
 456                                               &iph.saddr, pptr[0],
 457                                               &iph.daddr, pptr[1], &p);
 458                         cp = ip_vs_conn_new(&p, &daddr, 0,
 459                                             IP_VS_CONN_F_BYPASS | flags,
 460                                             NULL);
 461                         if (!cp)
 462                                 return NF_DROP;
 463                 }
 464
 465                 /* statistics */
 466                 ip_vs_in_stats(cp, skb);
 467
 468                 /* set state */
 469                 cs = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
 470
 471                 /* transmit the first SYN packet */
 472                 ret = cp->packet_xmit(skb, cp, pp);
 473                 /* do not touch skb anymore */
 474
 475                 atomic_inc(&cp->in_pkts);
 476                 ip_vs_conn_put(cp);
 477                 return ret;
 478         }
 479
 480         /*
 481          * When the virtual ftp service is presented, packets destined
 482          * for other services on the VIP may get here (except services
 483          * listed in the ipvs table), pass the packets, because it is
 484          * not ipvs job to decide to drop the packets.
 485          */
 486         if ((svc->port == FTPPORT) && (pptr[1] != FTPPORT)) {
 487                 ip_vs_service_put(svc);
 488                 return NF_ACCEPT;
 489         }
 490
 491         ip_vs_service_put(svc);
 492
 493         /*
 494          * Notify the client that the destination is unreachable, and
 495          * release the socket buffer.
 496          * Since it is in IP layer, the TCP socket is not actually
 497          * created, the TCP RST packet cannot be sent, instead that
 498          * ICMP_PORT_UNREACH is sent here no matter it is TCP/UDP. --WZ
 499          */
 500 #ifdef CONFIG_IP_VS_IPV6
 501         if (svc->af == AF_INET6)
 502                 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 503         else
 504 #endif
 505                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 506
 507         return NF_DROP;
 508 }
 509
 510 __sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset)
 511 {
 512         return csum_fold(skb_checksum(skb, offset, skb->len - offset, 0));
 513 }
 514
 515 static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
 516 {
 517         int err = ip_defrag(skb, user);
 518
 519         if (!err)
 520                 ip_send_check(ip_hdr(skb));
 521
 522         return err;
 523 }
 524
 525 #ifdef CONFIG_IP_VS_IPV6
 526 static inline int ip_vs_gather_frags_v6(struct sk_buff *skb, u_int32_t user)
 527 {
 528         /* TODO IPv6: Find out what to do here for IPv6 */
 529         return 0;
 530 }
 531 #endif
 532
 533 /*
 534  * Packet has been made sufficiently writable in caller
 535  * - inout: 1=in->out, 0=out->in
 536  */
 537 void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
 538                     struct ip_vs_conn *cp, int inout)
 539 {
 540         struct iphdr *iph        = ip_hdr(skb);
 541         unsigned int icmp_offset = iph->ihl*4;
 542         struct icmphdr *icmph    = (struct icmphdr *)(skb_network_header(skb) +
 543                                                       icmp_offset);
 544         struct iphdr *ciph       = (struct iphdr *)(icmph + 1);
 545
 546         if (inout) {
 547                 iph->saddr = cp->vaddr.ip;
 548                 ip_send_check(iph);
 549                 ciph->daddr = cp->vaddr.ip;
 550                 ip_send_check(ciph);
 551         } else {
 552                 iph->daddr = cp->daddr.ip;
 553                 ip_send_check(iph);
 554                 ciph->saddr = cp->daddr.ip;
 555                 ip_send_check(ciph);
 556         }
 557
 558         /* the TCP/UDP/SCTP port */
 559         if (IPPROTO_TCP == ciph->protocol || IPPROTO_UDP == ciph->protocol ||
 560             IPPROTO_SCTP == ciph->protocol) {
 561                 __be16 *ports = (void *)ciph + ciph->ihl*4;
 562
 563                 if (inout)
 564                         ports[1] = cp->vport;
 565                 else
 566                         ports[0] = cp->dport;
 567         }
 568
 569         /* And finally the ICMP checksum */
 570         icmph->checksum = 0;
 571         icmph->checksum = ip_vs_checksum_complete(skb, icmp_offset);
 572         skb->ip_summed = CHECKSUM_UNNECESSARY;
 573
 574         if (inout)
 575                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 576                         "Forwarding altered outgoing ICMP");
 577         else
 578                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 579                         "Forwarding altered incoming ICMP");
 580 }
 581
 582 #ifdef CONFIG_IP_VS_IPV6
 583 void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp,
 584                     struct ip_vs_conn *cp, int inout)
 585 {
 586         struct ipv6hdr *iph      = ipv6_hdr(skb);
 587         unsigned int icmp_offset = sizeof(struct ipv6hdr);
 588         struct icmp6hdr *icmph   = (struct icmp6hdr *)(skb_network_header(skb) +
 589                                                       icmp_offset);
 590         struct ipv6hdr *ciph     = (struct ipv6hdr *)(icmph + 1);
 591
 592         if (inout) {
 593                 iph->saddr = cp->vaddr.in6;
 594                 ciph->daddr = cp->vaddr.in6;
 595         } else {
 596                 iph->daddr = cp->daddr.in6;
 597                 ciph->saddr = cp->daddr.in6;
 598         }
 599
 600         /* the TCP/UDP/SCTP port */
 601         if (IPPROTO_TCP == ciph->nexthdr || IPPROTO_UDP == ciph->nexthdr ||
 602             IPPROTO_SCTP == ciph->nexthdr) {
 603                 __be16 *ports = (void *)ciph + sizeof(struct ipv6hdr);
 604
 605                 if (inout)
 606                         ports[1] = cp->vport;
 607                 else
 608                         ports[0] = cp->dport;
 609         }
 610
 611         /* And finally the ICMP checksum */
 612         icmph->icmp6_cksum = ~csum_ipv6_magic(&iph->saddr, &iph->daddr,
 613                                               skb->len - icmp_offset,
 614                                               IPPROTO_ICMPV6, 0);
 615         skb->csum_start = skb_network_header(skb) - skb->head + icmp_offset;
 616         skb->csum_offset = offsetof(struct icmp6hdr, icmp6_cksum);
 617         skb->ip_summed = CHECKSUM_PARTIAL;
 618
 619         if (inout)
 620                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 621                         "Forwarding altered outgoing ICMPv6");
 622         else
 623                 IP_VS_DBG_PKT(11, pp, skb, (void *)ciph - (void *)iph,
 624                         "Forwarding altered incoming ICMPv6");
 625 }
 626 #endif
 627
 628 /* Handle relevant response ICMP messages - forward to the right
 629  * destination host. Used for NAT and local client.
 630  */
 631 static int handle_response_icmp(int af, struct sk_buff *skb,
 632                                 union nf_inet_addr *snet,
 633                                 __u8 protocol, struct ip_vs_conn *cp,
 634                                 struct ip_vs_protocol *pp,
 635                                 unsigned int offset, unsigned int ihl)
 636 {
 637         unsigned int verdict = NF_DROP;
 638
 639         if (IP_VS_FWD_METHOD(cp) != 0) {
 640                 pr_err("shouldn't reach here, because the box is on the "
 641                        "half connection in the tun/dr module.\n");
 642         }
 643
 644         /* Ensure the checksum is correct */
 645         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
 646                 /* Failed checksum! */
 647                 IP_VS_DBG_BUF(1, "Forward ICMP: failed checksum from %s!\n",
 648                               IP_VS_DBG_ADDR(af, snet));
 649                 goto out;
 650         }
 651
 652         if (IPPROTO_TCP == protocol || IPPROTO_UDP == protocol ||
 653             IPPROTO_SCTP == protocol)
 654                 offset += 2 * sizeof(__u16);
 655         if (!skb_make_writable(skb, offset))
 656                 goto out;
 657
 658 #ifdef CONFIG_IP_VS_IPV6
 659         if (af == AF_INET6)
 660                 ip_vs_nat_icmp_v6(skb, pp, cp, 1);
 661         else
 662 #endif
 663                 ip_vs_nat_icmp(skb, pp, cp, 1);
 664
 665         /* do the statistics and put it back */
 666         ip_vs_out_stats(cp, skb);
 667
 668         skb->ipvs_property = 1;
 669         if (!(cp->flags & IP_VS_CONN_F_NFCT))
 670                 ip_vs_notrack(skb);
 671         else
 672                 ip_vs_update_conntrack(skb, cp, 0);
 673         verdict = NF_ACCEPT;
 674
 675 out:
 676         __ip_vs_conn_put(cp);
 677
 678         return verdict;
 679 }
 680
 681 /*
 682  *      Handle ICMP messages in the inside-to-outside direction (outgoing).
 683  *      Find any that might be relevant, check against existing connections.
 684  *      Currently handles error types - unreachable, quench, ttl exceeded.
 685  */
 686 static int ip_vs_out_icmp(struct sk_buff *skb, int *related)
 687 {
 688         struct iphdr *iph;
 689         struct icmphdr  _icmph, *ic;
 690         struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
 691         struct ip_vs_iphdr ciph;
 692         struct ip_vs_conn *cp;
 693         struct ip_vs_protocol *pp;
 694         unsigned int offset, ihl;
 695         union nf_inet_addr snet;
 696
 697         *related = 1;
 698
 699         /* reassemble IP fragments */
 700         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
 701                 if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
 702                         return NF_STOLEN;
 703         }
 704
 705         iph = ip_hdr(skb);
 706         offset = ihl = iph->ihl * 4;
 707         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
 708         if (ic == NULL)
 709                 return NF_DROP;
 710
 711         IP_VS_DBG(12, "Outgoing ICMP (%d,%d) %pI4->%pI4\n",
 712                   ic->type, ntohs(icmp_id(ic)),
 713                   &iph->saddr, &iph->daddr);
 714
 715         /*
 716          * Work through seeing if this is for us.
 717          * These checks are supposed to be in an order that means easy
 718          * things are checked first to speed up processing.... however
 719          * this means that some packets will manage to get a long way
 720          * down this stack and then be rejected, but that's life.
 721          */
 722         if ((ic->type != ICMP_DEST_UNREACH) &&
 723             (ic->type != ICMP_SOURCE_QUENCH) &&
 724             (ic->type != ICMP_TIME_EXCEEDED)) {
 725                 *related = 0;
 726                 return NF_ACCEPT;
 727         }
 728
 729         /* Now find the contained IP header */
 730         offset += sizeof(_icmph);
 731         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
 732         if (cih == NULL)
 733                 return NF_ACCEPT; /* The packet looks wrong, ignore */
 734
 735         pp = ip_vs_proto_get(cih->protocol);
 736         if (!pp)
 737                 return NF_ACCEPT;
 738
 739         /* Is the embedded protocol header present? */
 740         if (unlikely(cih->frag_off & htons(IP_OFFSET) &&
 741                      pp->dont_defrag))
 742                 return NF_ACCEPT;
 743
 744         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking outgoing ICMP for");
 745
 746         offset += cih->ihl * 4;
 747
 748         ip_vs_fill_iphdr(AF_INET, cih, &ciph);
 749         /* The embedded headers contain source and dest in reverse order */
 750         cp = pp->conn_out_get(AF_INET, skb, pp, &ciph, offset, 1);
 751         if (!cp)
 752                 return NF_ACCEPT;
 753
 754         snet.ip = iph->saddr;
 755         return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp,
 756                                     pp, offset, ihl);
 757 }
 758
 759 #ifdef CONFIG_IP_VS_IPV6
 760 static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related)
 761 {
 762         struct ipv6hdr *iph;
 763         struct icmp6hdr _icmph, *ic;
 764         struct ipv6hdr  _ciph, *cih;    /* The ip header contained
 765                                            within the ICMP */
 766         struct ip_vs_iphdr ciph;
 767         struct ip_vs_conn *cp;
 768         struct ip_vs_protocol *pp;
 769         unsigned int offset;
 770         union nf_inet_addr snet;
 771
 772         *related = 1;
 773
 774         /* reassemble IP fragments */
 775         if (ipv6_hdr(skb)->nexthdr == IPPROTO_FRAGMENT) {
 776                 if (ip_vs_gather_frags_v6(skb, IP_DEFRAG_VS_OUT))
 777                         return NF_STOLEN;
 778         }
 779
 780         iph = ipv6_hdr(skb);
 781         offset = sizeof(struct ipv6hdr);
 782         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
 783         if (ic == NULL)
 784                 return NF_DROP;
 785
 786         IP_VS_DBG(12, "Outgoing ICMPv6 (%d,%d) %pI6->%pI6\n",
 787                   ic->icmp6_type, ntohs(icmpv6_id(ic)),
 788                   &iph->saddr, &iph->daddr);
 789
 790         /*
 791          * Work through seeing if this is for us.
 792          * These checks are supposed to be in an order that means easy
 793          * things are checked first to speed up processing.... however
 794          * this means that some packets will manage to get a long way
 795          * down this stack and then be rejected, but that's life.
 796          */
 797         if ((ic->icmp6_type != ICMPV6_DEST_UNREACH) &&
 798             (ic->icmp6_type != ICMPV6_PKT_TOOBIG) &&
 799             (ic->icmp6_type != ICMPV6_TIME_EXCEED)) {
 800                 *related = 0;
 801                 return NF_ACCEPT;
 802         }
 803
 804         /* Now find the contained IP header */
 805         offset += sizeof(_icmph);
 806         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
 807         if (cih == NULL)
 808                 return NF_ACCEPT; /* The packet looks wrong, ignore */
 809
 810         pp = ip_vs_proto_get(cih->nexthdr);
 811         if (!pp)
 812                 return NF_ACCEPT;
 813
 814         /* Is the embedded protocol header present? */
 815         /* TODO: we don't support fragmentation at the moment anyways */
 816         if (unlikely(cih->nexthdr == IPPROTO_FRAGMENT && pp->dont_defrag))
 817                 return NF_ACCEPT;
 818
 819         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking outgoing ICMPv6 for");
 820
 821         offset += sizeof(struct ipv6hdr);
 822
 823         ip_vs_fill_iphdr(AF_INET6, cih, &ciph);
 824         /* The embedded headers contain source and dest in reverse order */
 825         cp = pp->conn_out_get(AF_INET6, skb, pp, &ciph, offset, 1);
 826         if (!cp)
 827                 return NF_ACCEPT;
 828
 829         ipv6_addr_copy(&snet.in6, &iph->saddr);
 830         return handle_response_icmp(AF_INET6, skb, &snet, cih->nexthdr, cp,
 831                                     pp, offset, sizeof(struct ipv6hdr));
 832 }
 833 #endif
 834
 835 /*
 836  * Check if sctp chunc is ABORT chunk
 837  */
 838 static inline int is_sctp_abort(const struct sk_buff *skb, int nh_len)
 839 {
 840         sctp_chunkhdr_t *sch, schunk;
 841         sch = skb_header_pointer(skb, nh_len + sizeof(sctp_sctphdr_t),
 842                         sizeof(schunk), &schunk);
 843         if (sch == NULL)
 844                 return 0;
 845         if (sch->type == SCTP_CID_ABORT)
 846                 return 1;
 847         return 0;
 848 }
 849
 850 static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
 851 {
 852         struct tcphdr _tcph, *th;
 853
 854         th = skb_header_pointer(skb, nh_len, sizeof(_tcph), &_tcph);
 855         if (th == NULL)
 856                 return 0;
 857         return th->rst;
 858 }
 859
 860 /* Handle response packets: rewrite addresses and send away...
 861  * Used for NAT and local client.
 862  */
 863 static unsigned int
 864 handle_response(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
 865                 struct ip_vs_conn *cp, int ihl)
 866 {
 867         IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
 868
 869         if (!skb_make_writable(skb, ihl))
 870                 goto drop;
 871
 872         /* mangle the packet */
 873         if (pp->snat_handler && !pp->snat_handler(skb, pp, cp))
 874                 goto drop;
 875
 876 #ifdef CONFIG_IP_VS_IPV6
 877         if (af == AF_INET6)
 878                 ipv6_hdr(skb)->saddr = cp->vaddr.in6;
 879         else
 880 #endif
 881         {
 882                 ip_hdr(skb)->saddr = cp->vaddr.ip;
 883                 ip_send_check(ip_hdr(skb));
 884         }
 885
 886         /*
 887          * nf_iterate does not expect change in the skb->dst->dev.
 888          * It looks like it is not fatal to enable this code for hooks
 889          * where our handlers are at the end of the chain list and
 890          * when all next handlers use skb->dst->dev and not outdev.
 891          * It will definitely route properly the inout NAT traffic
 892          * when multiple paths are used.
 893          */
 894
 895         /* For policy routing, packets originating from this
 896          * machine itself may be routed differently to packets
 897          * passing through.  We want this packet to be routed as
 898          * if it came from this machine itself.  So re-compute
 899          * the routing information.
 900          */
 901         if (sysctl_ip_vs_snat_reroute) {
 902 #ifdef CONFIG_IP_VS_IPV6
 903                 if (af == AF_INET6) {
 904                         if (ip6_route_me_harder(skb) != 0)
 905                                 goto drop;
 906                 } else
 907 #endif
 908                         if (ip_route_me_harder(skb, RTN_LOCAL) != 0)
 909                                 goto drop;
 910         }
 911
 912         IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
 913
 914         ip_vs_out_stats(cp, skb);
 915         ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
 916         skb->ipvs_property = 1;
 917         if (!(cp->flags & IP_VS_CONN_F_NFCT))
 918                 ip_vs_notrack(skb);
 919         else
 920                 ip_vs_update_conntrack(skb, cp, 0);
 921         ip_vs_conn_put(cp);
 922
 923         LeaveFunction(11);
 924         return NF_ACCEPT;
 925
 926 drop:
 927         ip_vs_conn_put(cp);
 928         kfree_skb(skb);
 929         LeaveFunction(11);
 930         return NF_STOLEN;
 931 }
 932
 933 /*
 934  *      It is hooked at the NF_INET_FORWARD chain, used only for VS/NAT.
 935  *      Check if outgoing packet belongs to the established ip_vs_conn.
 936  */
 937 static unsigned int
 938 ip_vs_out(unsigned int hooknum, struct sk_buff *skb,
 939           const struct net_device *in, const struct net_device *out,
 940           int (*okfn)(struct sk_buff *))
 941 {
 942         struct ip_vs_iphdr iph;
 943         struct ip_vs_protocol *pp;
 944         struct ip_vs_conn *cp;
 945         int af;
 946
 947         EnterFunction(11);
 948
 949         af = (skb->protocol == htons(ETH_P_IP)) ? AF_INET : AF_INET6;
 950
 951         if (skb->ipvs_property)
 952                 return NF_ACCEPT;
 953
 954         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 955 #ifdef CONFIG_IP_VS_IPV6
 956         if (af == AF_INET6) {
 957                 if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
 958                         int related, verdict = ip_vs_out_icmp_v6(skb, &related);
 959
 960                         if (related) {
 961                                 if (sysctl_ip_vs_snat_reroute &&
 962                                         NF_ACCEPT == verdict &&
 963                                         ip6_route_me_harder(skb))
 964                                         verdict = NF_DROP;
 965                                 return verdict;
 966                         }
 967                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 968                 }
 969         } else
 970 #endif
 971                 if (unlikely(iph.protocol == IPPROTO_ICMP)) {
 972                         int related, verdict = ip_vs_out_icmp(skb, &related);
 973
 974                         if (related) {
 975                                 if (sysctl_ip_vs_snat_reroute &&
 976                                         NF_ACCEPT == verdict &&
 977                                         ip_route_me_harder(skb, RTN_LOCAL))
 978                                         verdict = NF_DROP;
 979                                 return verdict;
 980                         }
 981                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 982                 }
 983
 984         pp = ip_vs_proto_get(iph.protocol);
 985         if (unlikely(!pp))
 986                 return NF_ACCEPT;
 987
 988         /* reassemble IP fragments */
 989 #ifdef CONFIG_IP_VS_IPV6
 990         if (af == AF_INET6) {
 991                 if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
 992                         int related, verdict = ip_vs_out_icmp_v6(skb, &related);
 993
 994                         if (related)
 995                                 return verdict;
 996
 997                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
 998                 }
 999         } else
1000 #endif
1001                 if (unlikely(ip_hdr(skb)->frag_off & htons(IP_MF|IP_OFFSET) &&
1002                              !pp->dont_defrag)) {
1003                         if (ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT))
1004                                 return NF_STOLEN;
1005
1006                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1007                 }
1008
1009         /*
1010          * Check if the packet belongs to an existing entry
1011          */
1012         cp = pp->conn_out_get(af, skb, pp, &iph, iph.len, 0);
1013
1014         if (unlikely(!cp)) {
1015                 if (sysctl_ip_vs_nat_icmp_send &&
1016                     (pp->protocol == IPPROTO_TCP ||
1017                      pp->protocol == IPPROTO_UDP ||
1018                      pp->protocol == IPPROTO_SCTP)) {
1019                         __be16 _ports[2], *pptr;
1020
1021                         pptr = skb_header_pointer(skb, iph.len,
1022                                                   sizeof(_ports), _ports);
1023                         if (pptr == NULL)
1024                                 return NF_ACCEPT;       /* Not for me */
1025                         if (ip_vs_lookup_real_service(af, iph.protocol,
1026                                                       &iph.saddr,
1027                                                       pptr[0])) {
1028                                 /*
1029                                  * Notify the real server: there is no
1030                                  * existing entry if it is not RST
1031                                  * packet or not TCP packet.
1032                                  */
1033                                 if ((iph.protocol != IPPROTO_TCP &&
1034                                      iph.protocol != IPPROTO_SCTP)
1035                                      || ((iph.protocol == IPPROTO_TCP
1036                                           && !is_tcp_reset(skb, iph.len))
1037                                          || (iph.protocol == IPPROTO_SCTP
1038                                                 && !is_sctp_abort(skb,
1039                                                         iph.len)))) {
1040 #ifdef CONFIG_IP_VS_IPV6
1041                                         if (af == AF_INET6)
1042                                                 icmpv6_send(skb,
1043                                                             ICMPV6_DEST_UNREACH,
1044                                                             ICMPV6_PORT_UNREACH,
1045                                                             0);
1046                                         else
1047 #endif
1048                                                 icmp_send(skb,
1049                                                           ICMP_DEST_UNREACH,
1050                                                           ICMP_PORT_UNREACH, 0);
1051                                         return NF_DROP;
1052                                 }
1053                         }
1054                 }
1055                 IP_VS_DBG_PKT(12, pp, skb, 0,
1056                               "packet continues traversal as normal");
1057                 return NF_ACCEPT;
1058         }
1059
1060         return handle_response(af, skb, pp, cp, iph.len);
1061 }
1062
1063
1064 /*
1065  *      Handle ICMP messages in the outside-to-inside direction (incoming).
1066  *      Find any that might be relevant, check against existing connections,
1067  *      forward to the right destination host if relevant.
1068  *      Currently handles error types - unreachable, quench, ttl exceeded.
1069  */
1070 static int
1071 ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
1072 {
1073         struct iphdr *iph;
1074         struct icmphdr  _icmph, *ic;
1075         struct iphdr    _ciph, *cih;    /* The ip header contained within the ICMP */
1076         struct ip_vs_iphdr ciph;
1077         struct ip_vs_conn *cp;
1078         struct ip_vs_protocol *pp;
1079         unsigned int offset, ihl, verdict;
1080         union nf_inet_addr snet;
1081
1082         *related = 1;
1083
1084         /* reassemble IP fragments */
1085         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
1086                 if (ip_vs_gather_frags(skb, hooknum == NF_INET_LOCAL_IN ?
1087                                             IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD))
1088                         return NF_STOLEN;
1089         }
1090
1091         iph = ip_hdr(skb);
1092         offset = ihl = iph->ihl * 4;
1093         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
1094         if (ic == NULL)
1095                 return NF_DROP;
1096
1097         IP_VS_DBG(12, "Incoming ICMP (%d,%d) %pI4->%pI4\n",
1098                   ic->type, ntohs(icmp_id(ic)),
1099                   &iph->saddr, &iph->daddr);
1100
1101         /*
1102          * Work through seeing if this is for us.
1103          * These checks are supposed to be in an order that means easy
1104          * things are checked first to speed up processing.... however
1105          * this means that some packets will manage to get a long way
1106          * down this stack and then be rejected, but that's life.
1107          */
1108         if ((ic->type != ICMP_DEST_UNREACH) &&
1109             (ic->type != ICMP_SOURCE_QUENCH) &&
1110             (ic->type != ICMP_TIME_EXCEEDED)) {
1111                 *related = 0;
1112                 return NF_ACCEPT;
1113         }
1114
1115         /* Now find the contained IP header */
1116         offset += sizeof(_icmph);
1117         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
1118         if (cih == NULL)
1119                 return NF_ACCEPT; /* The packet looks wrong, ignore */
1120
1121         pp = ip_vs_proto_get(cih->protocol);
1122         if (!pp)
1123                 return NF_ACCEPT;
1124
1125         /* Is the embedded protocol header present? */
1126         if (unlikely(cih->frag_off & htons(IP_OFFSET) &&
1127                      pp->dont_defrag))
1128                 return NF_ACCEPT;
1129
1130         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMP for");
1131
1132         offset += cih->ihl * 4;
1133
1134         ip_vs_fill_iphdr(AF_INET, cih, &ciph);
1135         /* The embedded headers contain source and dest in reverse order */
1136         cp = pp->conn_in_get(AF_INET, skb, pp, &ciph, offset, 1);
1137         if (!cp) {
1138                 /* The packet could also belong to a local client */
1139                 cp = pp->conn_out_get(AF_INET, skb, pp, &ciph, offset, 1);
1140                 if (cp) {
1141                         snet.ip = iph->saddr;
1142                         return handle_response_icmp(AF_INET, skb, &snet,
1143                                                     cih->protocol, cp, pp,
1144                                                     offset, ihl);
1145                 }
1146                 return NF_ACCEPT;
1147         }
1148
1149         verdict = NF_DROP;
1150
1151         /* Ensure the checksum is correct */
1152         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
1153                 /* Failed checksum! */
1154                 IP_VS_DBG(1, "Incoming ICMP: failed checksum from %pI4!\n",
1155                           &iph->saddr);
1156                 goto out;
1157         }
1158
1159         /* do the statistics and put it back */
1160         ip_vs_in_stats(cp, skb);
1161         if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
1162                 offset += 2 * sizeof(__u16);
1163         verdict = ip_vs_icmp_xmit(skb, cp, pp, offset);
1164         /* do not touch skb anymore */
1165
1166   out:
1167         __ip_vs_conn_put(cp);
1168
1169         return verdict;
1170 }
1171
1172 #ifdef CONFIG_IP_VS_IPV6
1173 static int
1174 ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)
1175 {
1176         struct ipv6hdr *iph;
1177         struct icmp6hdr _icmph, *ic;
1178         struct ipv6hdr  _ciph, *cih;    /* The ip header contained
1179                                            within the ICMP */
1180         struct ip_vs_iphdr ciph;
1181         struct ip_vs_conn *cp;
1182         struct ip_vs_protocol *pp;
1183         unsigned int offset, verdict;
1184         union nf_inet_addr snet;
1185
1186         *related = 1;
1187
1188         /* reassemble IP fragments */
1189         if (ipv6_hdr(skb)->nexthdr == IPPROTO_FRAGMENT) {
1190                 if (ip_vs_gather_frags_v6(skb, hooknum == NF_INET_LOCAL_IN ?
1191                                                IP_DEFRAG_VS_IN :
1192                                                IP_DEFRAG_VS_FWD))
1193                         return NF_STOLEN;
1194         }
1195
1196         iph = ipv6_hdr(skb);
1197         offset = sizeof(struct ipv6hdr);
1198         ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
1199         if (ic == NULL)
1200                 return NF_DROP;
1201
1202         IP_VS_DBG(12, "Incoming ICMPv6 (%d,%d) %pI6->%pI6\n",
1203                   ic->icmp6_type, ntohs(icmpv6_id(ic)),
1204                   &iph->saddr, &iph->daddr);
1205
1206         /*
1207          * Work through seeing if this is for us.
1208          * These checks are supposed to be in an order that means easy
1209          * things are checked first to speed up processing.... however
1210          * this means that some packets will manage to get a long way
1211          * down this stack and then be rejected, but that's life.
1212          */
1213         if ((ic->icmp6_type != ICMPV6_DEST_UNREACH) &&
1214             (ic->icmp6_type != ICMPV6_PKT_TOOBIG) &&
1215             (ic->icmp6_type != ICMPV6_TIME_EXCEED)) {
1216                 *related = 0;
1217                 return NF_ACCEPT;
1218         }
1219
1220         /* Now find the contained IP header */
1221         offset += sizeof(_icmph);
1222         cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
1223         if (cih == NULL)
1224                 return NF_ACCEPT; /* The packet looks wrong, ignore */
1225
1226         pp = ip_vs_proto_get(cih->nexthdr);
1227         if (!pp)
1228                 return NF_ACCEPT;
1229
1230         /* Is the embedded protocol header present? */
1231         /* TODO: we don't support fragmentation at the moment anyways */
1232         if (unlikely(cih->nexthdr == IPPROTO_FRAGMENT && pp->dont_defrag))
1233                 return NF_ACCEPT;
1234
1235         IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMPv6 for");
1236
1237         offset += sizeof(struct ipv6hdr);
1238
1239         ip_vs_fill_iphdr(AF_INET6, cih, &ciph);
1240         /* The embedded headers contain source and dest in reverse order */
1241         cp = pp->conn_in_get(AF_INET6, skb, pp, &ciph, offset, 1);
1242         if (!cp) {
1243                 /* The packet could also belong to a local client */
1244                 cp = pp->conn_out_get(AF_INET6, skb, pp, &ciph, offset, 1);
1245                 if (cp) {
1246                         ipv6_addr_copy(&snet.in6, &iph->saddr);
1247                         return handle_response_icmp(AF_INET6, skb, &snet,
1248                                                     cih->nexthdr,
1249                                                     cp, pp, offset,
1250                                                     sizeof(struct ipv6hdr));
1251                 }
1252                 return NF_ACCEPT;
1253         }
1254
1255         verdict = NF_DROP;
1256
1257         /* do the statistics and put it back */
1258         ip_vs_in_stats(cp, skb);
1259         if (IPPROTO_TCP == cih->nexthdr || IPPROTO_UDP == cih->nexthdr ||
1260             IPPROTO_SCTP == cih->nexthdr)
1261                 offset += 2 * sizeof(__u16);
1262         verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, offset);
1263         /* do not touch skb anymore */
1264
1265         __ip_vs_conn_put(cp);
1266
1267         return verdict;
1268 }
1269 #endif
1270
1271
1272 /*
1273  *      Check if it's for virtual services, look it up,
1274  *      and send it on its way...
1275  */
1276 static unsigned int
1277 ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
1278          const struct net_device *in, const struct net_device *out,
1279          int (*okfn)(struct sk_buff *))
1280 {
1281         struct ip_vs_iphdr iph;
1282         struct ip_vs_protocol *pp;
1283         struct ip_vs_conn *cp;
1284         int ret, restart, af, pkts;
1285
1286         af = (skb->protocol == htons(ETH_P_IP)) ? AF_INET : AF_INET6;
1287
1288         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1289
1290         /*
1291          *      Big tappo: only PACKET_HOST, including loopback for local client
1292          *      Don't handle local packets on IPv6 for now
1293          */
1294         if (unlikely(skb->pkt_type != PACKET_HOST)) {
1295                 IP_VS_DBG_BUF(12, "packet type=%d proto=%d daddr=%s ignored\n",
1296                               skb->pkt_type,
1297                               iph.protocol,
1298                               IP_VS_DBG_ADDR(af, &iph.daddr));
1299                 return NF_ACCEPT;
1300         }
1301
1302 #ifdef CONFIG_IP_VS_IPV6
1303         if (af == AF_INET6) {
1304                 if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
1305                         int related, verdict = ip_vs_in_icmp_v6(skb, &related, hooknum);
1306
1307                         if (related)
1308                                 return verdict;
1309                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1310                 }
1311         } else
1312 #endif
1313                 if (unlikely(iph.protocol == IPPROTO_ICMP)) {
1314                         int related, verdict = ip_vs_in_icmp(skb, &related, hooknum);
1315
1316                         if (related)
1317                                 return verdict;
1318                         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
1319                 }
1320
1321         /* Protocol supported? */
1322         pp = ip_vs_proto_get(iph.protocol);
1323         if (unlikely(!pp))
1324                 return NF_ACCEPT;
1325
1326         /*
1327          * Check if the packet belongs to an existing connection entry
1328          */
1329         cp = pp->conn_in_get(af, skb, pp, &iph, iph.len, 0);
1330
1331         if (unlikely(!cp)) {
1332                 int v;
1333
1334                 /* For local client packets, it could be a response */
1335                 cp = pp->conn_out_get(af, skb, pp, &iph, iph.len, 0);
1336                 if (cp)
1337                         return handle_response(af, skb, pp, cp, iph.len);
1338
1339                 if (!pp->conn_schedule(af, skb, pp, &v, &cp))
1340                         return v;
1341         }
1342
1343         if (unlikely(!cp)) {
1344                 /* sorry, all this trouble for a no-hit :) */
1345                 IP_VS_DBG_PKT(12, pp, skb, 0,
1346                               "packet continues traversal as normal");
1347                 return NF_ACCEPT;
1348         }
1349
1350         IP_VS_DBG_PKT(11, pp, skb, 0, "Incoming packet");
1351
1352         /* Check the server status */
1353         if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
1354                 /* the destination server is not available */
1355
1356                 if (sysctl_ip_vs_expire_nodest_conn) {
1357                         /* try to expire the connection immediately */
1358                         ip_vs_conn_expire_now(cp);
1359                 }
1360                 /* don't restart its timer, and silently
1361                    drop the packet. */
1362                 __ip_vs_conn_put(cp);
1363                 return NF_DROP;
1364         }
1365
1366         ip_vs_in_stats(cp, skb);
1367         restart = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
1368         if (cp->packet_xmit)
1369                 ret = cp->packet_xmit(skb, cp, pp);
1370                 /* do not touch skb anymore */
1371         else {
1372                 IP_VS_DBG_RL("warning: packet_xmit is null");
1373                 ret = NF_ACCEPT;
1374         }
1375
1376         /* Increase its packet counter and check if it is needed
1377          * to be synchronized
1378          *
1379          * Sync connection if it is about to close to
1380          * encorage the standby servers to update the connections timeout
1381          */
1382         pkts = atomic_add_return(1, &cp->in_pkts);
1383         if (af == AF_INET && (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
1384             cp->protocol == IPPROTO_SCTP) {
1385                 if ((cp->state == IP_VS_SCTP_S_ESTABLISHED &&
1386                         (pkts % sysctl_ip_vs_sync_threshold[1]
1387                          == sysctl_ip_vs_sync_threshold[0])) ||
1388                                 (cp->old_state != cp->state &&
1389                                  ((cp->state == IP_VS_SCTP_S_CLOSED) ||
1390                                   (cp->state == IP_VS_SCTP_S_SHUT_ACK_CLI) ||
1391                                   (cp->state == IP_VS_SCTP_S_SHUT_ACK_SER)))) {
1392                         ip_vs_sync_conn(cp);
1393                         goto out;
1394                 }
1395         }
1396
1397         /* Keep this block last: TCP and others with pp->num_states <= 1 */
1398         else if (af == AF_INET &&
1399             (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
1400             (((cp->protocol != IPPROTO_TCP ||
1401                cp->state == IP_VS_TCP_S_ESTABLISHED) &&
1402               (pkts % sysctl_ip_vs_sync_threshold[1]
1403                == sysctl_ip_vs_sync_threshold[0])) ||
1404              ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) &&
1405               ((cp->state == IP_VS_TCP_S_FIN_WAIT) ||
1406                (cp->state == IP_VS_TCP_S_CLOSE) ||
1407                (cp->state == IP_VS_TCP_S_CLOSE_WAIT) ||
1408                (cp->state == IP_VS_TCP_S_TIME_WAIT)))))
1409                 ip_vs_sync_conn(cp);
1410 out:
1411         cp->old_state = cp->state;
1412
1413         ip_vs_conn_put(cp);
1414         return ret;
1415 }
1416
1417
1418 /*
1419  *      It is hooked at the NF_INET_FORWARD chain, in order to catch ICMP
1420  *      related packets destined for 0.0.0.0/0.
1421  *      When fwmark-based virtual service is used, such as transparent
1422  *      cache cluster, TCP packets can be marked and routed to ip_vs_in,
1423  *      but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
1424  *      sent to ip_vs_in_icmp. So, catch them at the NF_INET_FORWARD chain
1425  *      and send them to ip_vs_in_icmp.
1426  */
1427 static unsigned int
1428 ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb,
1429                    const struct net_device *in, const struct net_device *out,
1430                    int (*okfn)(struct sk_buff *))
1431 {
1432         int r;
1433
1434         if (ip_hdr(skb)->protocol != IPPROTO_ICMP)
1435                 return NF_ACCEPT;
1436
1437         return ip_vs_in_icmp(skb, &r, hooknum);
1438 }
1439
1440 #ifdef CONFIG_IP_VS_IPV6
1441 static unsigned int
1442 ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb,
1443                       const struct net_device *in, const struct net_device *out,
1444                       int (*okfn)(struct sk_buff *))
1445 {
1446         int r;
1447
1448         if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
1449                 return NF_ACCEPT;
1450
1451         return ip_vs_in_icmp_v6(skb, &r, hooknum);
1452 }
1453 #endif
1454
1455
1456 static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
1457         /* After packet filtering, forward packet through VS/DR, VS/TUN,
1458          * or VS/NAT(change destination), so that filtering rules can be
1459          * applied to IPVS. */
1460         {
1461                 .hook           = ip_vs_in,
1462                 .owner          = THIS_MODULE,
1463                 .pf             = PF_INET,
1464                 .hooknum        = NF_INET_LOCAL_IN,
1465                 .priority       = 100,
1466         },
1467         /* After packet filtering, change source only for VS/NAT */
1468         {
1469                 .hook           = ip_vs_out,
1470                 .owner          = THIS_MODULE,
1471                 .pf             = PF_INET,
1472                 .hooknum        = NF_INET_FORWARD,
1473                 .priority       = 100,
1474         },
1475         /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1476          * destined for 0.0.0.0/0, which is for incoming IPVS connections */
1477         {
1478                 .hook           = ip_vs_forward_icmp,
1479                 .owner          = THIS_MODULE,
1480                 .pf             = PF_INET,
1481                 .hooknum        = NF_INET_FORWARD,
1482                 .priority       = 99,
1483         },
1484 #ifdef CONFIG_IP_VS_IPV6
1485         /* After packet filtering, forward packet through VS/DR, VS/TUN,
1486          * or VS/NAT(change destination), so that filtering rules can be
1487          * applied to IPVS. */
1488         {
1489                 .hook           = ip_vs_in,
1490                 .owner          = THIS_MODULE,
1491                 .pf             = PF_INET6,
1492                 .hooknum        = NF_INET_LOCAL_IN,
1493                 .priority       = 100,
1494         },
1495         /* After packet filtering, change source only for VS/NAT */
1496         {
1497                 .hook           = ip_vs_out,
1498                 .owner          = THIS_MODULE,
1499                 .pf             = PF_INET6,
1500                 .hooknum        = NF_INET_FORWARD,
1501                 .priority       = 100,
1502         },
1503         /* After packet filtering (but before ip_vs_out_icmp), catch icmp
1504          * destined for 0.0.0.0/0, which is for incoming IPVS connections */
1505         {
1506                 .hook           = ip_vs_forward_icmp_v6,
1507                 .owner          = THIS_MODULE,
1508                 .pf             = PF_INET6,
1509                 .hooknum        = NF_INET_FORWARD,
1510                 .priority       = 99,
1511         },
1512 #endif
1513 };
1514
1515
1516 /*
1517  *      Initialize IP Virtual Server
1518  */
1519 static int __init ip_vs_init(void)
1520 {
1521         int ret;
1522
1523         ip_vs_estimator_init();
1524
1525         ret = ip_vs_control_init();
1526         if (ret < 0) {
1527                 pr_err("can't setup control.\n");
1528                 goto cleanup_estimator;
1529         }
1530
1531         ip_vs_protocol_init();
1532
1533         ret = ip_vs_app_init();
1534         if (ret < 0) {
1535                 pr_err("can't setup application helper.\n");
1536                 goto cleanup_protocol;
1537         }
1538
1539         ret = ip_vs_conn_init();
1540         if (ret < 0) {
1541                 pr_err("can't setup connection table.\n");
1542                 goto cleanup_app;
1543         }
1544
1545         ret = nf_register_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
1546         if (ret < 0) {
1547                 pr_err("can't register hooks.\n");
1548                 goto cleanup_conn;
1549         }
1550
1551         pr_info("ipvs loaded.\n");
1552         return ret;
1553
1554   cleanup_conn:
1555         ip_vs_conn_cleanup();
1556   cleanup_app:
1557         ip_vs_app_cleanup();
1558   cleanup_protocol:
1559         ip_vs_protocol_cleanup();
1560         ip_vs_control_cleanup();
1561   cleanup_estimator:
1562         ip_vs_estimator_cleanup();
1563         return ret;
1564 }
1565
1566 static void __exit ip_vs_cleanup(void)
1567 {
1568         nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
1569         ip_vs_conn_cleanup();
1570         ip_vs_app_cleanup();
1571         ip_vs_protocol_cleanup();
1572         ip_vs_control_cleanup();
1573         ip_vs_estimator_cleanup();
1574         pr_info("ipvs unloaded.\n");
1575 }
1576
1577 module_init(ip_vs_init);
1578 module_exit(ip_vs_cleanup);
1579 MODULE_LICENSE("GPL");