2 * ip_vs_xmit.c: various packet transmitters for IPVS
4 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
5 * Julian Anastasov <ja@ssi.bg>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version
10 * 2 of the License, or (at your option) any later version.
16 #include <linux/kernel.h>
17 #include <linux/tcp.h> /* for tcphdr */
19 #include <net/tcp.h> /* for csum_tcpudp_magic */
21 #include <net/icmp.h> /* for icmp_send */
22 #include <net/route.h> /* for ip_route_output */
23 #include <linux/netfilter.h>
24 #include <linux/netfilter_ipv4.h>
26 #include <net/ip_vs.h>
30 * Destination cache to speed up outgoing route lookup
33 __ip_vs_dst_set(struct ip_vs_dest
*dest
, u32 rtos
, struct dst_entry
*dst
)
35 struct dst_entry
*old_dst
;
37 old_dst
= dest
->dst_cache
;
38 dest
->dst_cache
= dst
;
39 dest
->dst_rtos
= rtos
;
43 static inline struct dst_entry
*
44 __ip_vs_dst_check(struct ip_vs_dest
*dest
, u32 rtos
, u32 cookie
)
46 struct dst_entry
*dst
= dest
->dst_cache
;
50 if ((dst
->obsolete
|| rtos
!= dest
->dst_rtos
) &&
51 dst
->ops
->check(dst
, cookie
) == NULL
) {
52 dest
->dst_cache
= NULL
;
60 static struct rtable
*
61 __ip_vs_get_out_rt(struct ip_vs_conn
*cp
, u32 rtos
)
63 struct rtable
*rt
; /* Route to the other host */
64 struct ip_vs_dest
*dest
= cp
->dest
;
67 spin_lock(&dest
->dst_lock
);
68 if (!(rt
= (struct rtable
*)
69 __ip_vs_dst_check(dest
, rtos
, 0))) {
79 if (ip_route_output_key(&init_net
, &rt
, &fl
)) {
80 spin_unlock(&dest
->dst_lock
);
81 IP_VS_DBG_RL("ip_route_output error, "
82 "dest: %u.%u.%u.%u\n",
86 __ip_vs_dst_set(dest
, rtos
, dst_clone(&rt
->u
.dst
));
87 IP_VS_DBG(10, "new dst %u.%u.%u.%u, refcnt=%d, rtos=%X\n",
89 atomic_read(&rt
->u
.dst
.__refcnt
), rtos
);
91 spin_unlock(&dest
->dst_lock
);
102 if (ip_route_output_key(&init_net
, &rt
, &fl
)) {
103 IP_VS_DBG_RL("ip_route_output error, dest: "
104 "%u.%u.%u.%u\n", NIPQUAD(cp
->daddr
));
114 * Release dest->dst_cache before a dest is removed
117 ip_vs_dst_reset(struct ip_vs_dest
*dest
)
119 struct dst_entry
*old_dst
;
121 old_dst
= dest
->dst_cache
;
122 dest
->dst_cache
= NULL
;
123 dst_release(old_dst
);
126 #define IP_VS_XMIT(skb, rt) \
128 (skb)->ipvs_property = 1; \
129 skb_forward_csum(skb); \
130 NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, (skb), NULL, \
131 (rt)->u.dst.dev, dst_output); \
136 * NULL transmitter (do nothing except return NF_ACCEPT)
139 ip_vs_null_xmit(struct sk_buff
*skb
, struct ip_vs_conn
*cp
,
140 struct ip_vs_protocol
*pp
)
142 /* we do not touch skb and do not need pskb ptr */
149 * Let packets bypass the destination when the destination is not
150 * available, it may be only used in transparent cache cluster.
153 ip_vs_bypass_xmit(struct sk_buff
*skb
, struct ip_vs_conn
*cp
,
154 struct ip_vs_protocol
*pp
)
156 struct rtable
*rt
; /* Route to the other host */
157 struct iphdr
*iph
= ip_hdr(skb
);
166 .tos
= RT_TOS(tos
), } },
171 if (ip_route_output_key(&init_net
, &rt
, &fl
)) {
172 IP_VS_DBG_RL("ip_vs_bypass_xmit(): ip_route_output error, "
173 "dest: %u.%u.%u.%u\n", NIPQUAD(iph
->daddr
));
178 mtu
= dst_mtu(&rt
->u
.dst
);
179 if ((skb
->len
> mtu
) && (iph
->frag_off
& htons(IP_DF
))) {
181 icmp_send(skb
, ICMP_DEST_UNREACH
,ICMP_FRAG_NEEDED
, htonl(mtu
));
182 IP_VS_DBG_RL("ip_vs_bypass_xmit(): frag needed\n");
187 * Call ip_send_check because we are not sure it is called
188 * after ip_defrag. Is copy-on-write needed?
190 if (unlikely((skb
= skb_share_check(skb
, GFP_ATOMIC
)) == NULL
)) {
194 ip_send_check(ip_hdr(skb
));
197 dst_release(skb
->dst
);
198 skb
->dst
= &rt
->u
.dst
;
200 /* Another hack: avoid icmp_send in ip_fragment */
209 dst_link_failure(skb
);
218 * NAT transmitter (only for outside-to-inside nat forwarding)
219 * Not used for related ICMP
222 ip_vs_nat_xmit(struct sk_buff
*skb
, struct ip_vs_conn
*cp
,
223 struct ip_vs_protocol
*pp
)
225 struct rtable
*rt
; /* Route to the other host */
227 struct iphdr
*iph
= ip_hdr(skb
);
231 /* check if it is a connection of no-client-port */
232 if (unlikely(cp
->flags
& IP_VS_CONN_F_NO_CPORT
)) {
234 p
= skb_header_pointer(skb
, iph
->ihl
*4, sizeof(_pt
), &_pt
);
237 ip_vs_conn_fill_cport(cp
, *p
);
238 IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p
));
241 if (!(rt
= __ip_vs_get_out_rt(cp
, RT_TOS(iph
->tos
))))
245 mtu
= dst_mtu(&rt
->u
.dst
);
246 if ((skb
->len
> mtu
) && (iph
->frag_off
& htons(IP_DF
))) {
248 icmp_send(skb
, ICMP_DEST_UNREACH
,ICMP_FRAG_NEEDED
, htonl(mtu
));
249 IP_VS_DBG_RL_PKT(0, pp
, skb
, 0, "ip_vs_nat_xmit(): frag needed for");
253 /* copy-on-write the packet before mangling it */
254 if (!skb_make_writable(skb
, sizeof(struct iphdr
)))
257 if (skb_cow(skb
, rt
->u
.dst
.dev
->hard_header_len
))
261 dst_release(skb
->dst
);
262 skb
->dst
= &rt
->u
.dst
;
264 /* mangle the packet */
265 if (pp
->dnat_handler
&& !pp
->dnat_handler(skb
, pp
, cp
))
267 ip_hdr(skb
)->daddr
= cp
->daddr
;
268 ip_send_check(ip_hdr(skb
));
270 IP_VS_DBG_PKT(10, pp
, skb
, 0, "After DNAT");
272 /* FIXME: when application helper enlarges the packet and the length
273 is larger than the MTU of outgoing device, there will be still
276 /* Another hack: avoid icmp_send in ip_fragment */
285 dst_link_failure(skb
);
297 * IP Tunneling transmitter
299 * This function encapsulates the packet in a new IP packet, its
300 * destination will be set to cp->daddr. Most code of this function
301 * is taken from ipip.c.
303 * It is used in VS/TUN cluster. The load balancer selects a real
304 * server from a cluster based on a scheduling algorithm,
305 * encapsulates the request packet and forwards it to the selected
306 * server. For example, all real servers are configured with
307 * "ifconfig tunl0 <Virtual IP Address> up". When the server receives
308 * the encapsulated packet, it will decapsulate the packet, processe
309 * the request and return the response packets directly to the client
310 * without passing the load balancer. This can greatly increase the
311 * scalability of virtual server.
313 * Used for ANY protocol
316 ip_vs_tunnel_xmit(struct sk_buff
*skb
, struct ip_vs_conn
*cp
,
317 struct ip_vs_protocol
*pp
)
319 struct rtable
*rt
; /* Route to the other host */
320 struct net_device
*tdev
; /* Device to other host */
321 struct iphdr
*old_iph
= ip_hdr(skb
);
322 u8 tos
= old_iph
->tos
;
323 __be16 df
= old_iph
->frag_off
;
324 sk_buff_data_t old_transport_header
= skb
->transport_header
;
325 struct iphdr
*iph
; /* Our new IP header */
326 unsigned int max_headroom
; /* The extra header space needed */
331 if (skb
->protocol
!= htons(ETH_P_IP
)) {
332 IP_VS_DBG_RL("ip_vs_tunnel_xmit(): protocol error, "
333 "ETH_P_IP: %d, skb protocol: %d\n",
334 htons(ETH_P_IP
), skb
->protocol
);
338 if (!(rt
= __ip_vs_get_out_rt(cp
, RT_TOS(tos
))))
341 tdev
= rt
->u
.dst
.dev
;
343 mtu
= dst_mtu(&rt
->u
.dst
) - sizeof(struct iphdr
);
346 IP_VS_DBG_RL("ip_vs_tunnel_xmit(): mtu less than 68\n");
350 skb
->dst
->ops
->update_pmtu(skb
->dst
, mtu
);
352 df
|= (old_iph
->frag_off
& htons(IP_DF
));
354 if ((old_iph
->frag_off
& htons(IP_DF
))
355 && mtu
< ntohs(old_iph
->tot_len
)) {
356 icmp_send(skb
, ICMP_DEST_UNREACH
,ICMP_FRAG_NEEDED
, htonl(mtu
));
358 IP_VS_DBG_RL("ip_vs_tunnel_xmit(): frag needed\n");
363 * Okay, now see if we can stuff it in the buffer as-is.
365 max_headroom
= LL_RESERVED_SPACE(tdev
) + sizeof(struct iphdr
);
367 if (skb_headroom(skb
) < max_headroom
368 || skb_cloned(skb
) || skb_shared(skb
)) {
369 struct sk_buff
*new_skb
=
370 skb_realloc_headroom(skb
, max_headroom
);
374 IP_VS_ERR_RL("ip_vs_tunnel_xmit(): no memory\n");
379 old_iph
= ip_hdr(skb
);
382 skb
->transport_header
= old_transport_header
;
384 /* fix old IP header checksum */
385 ip_send_check(old_iph
);
387 skb_push(skb
, sizeof(struct iphdr
));
388 skb_reset_network_header(skb
);
389 memset(&(IPCB(skb
)->opt
), 0, sizeof(IPCB(skb
)->opt
));
392 dst_release(skb
->dst
);
393 skb
->dst
= &rt
->u
.dst
;
396 * Push down and install the IPIP header.
400 iph
->ihl
= sizeof(struct iphdr
)>>2;
402 iph
->protocol
= IPPROTO_IPIP
;
404 iph
->daddr
= rt
->rt_dst
;
405 iph
->saddr
= rt
->rt_src
;
406 iph
->ttl
= old_iph
->ttl
;
407 ip_select_ident(iph
, &rt
->u
.dst
, NULL
);
409 /* Another hack: avoid icmp_send in ip_fragment */
419 dst_link_failure(skb
);
428 * Direct Routing transmitter
429 * Used for ANY protocol
432 ip_vs_dr_xmit(struct sk_buff
*skb
, struct ip_vs_conn
*cp
,
433 struct ip_vs_protocol
*pp
)
435 struct rtable
*rt
; /* Route to the other host */
436 struct iphdr
*iph
= ip_hdr(skb
);
441 if (!(rt
= __ip_vs_get_out_rt(cp
, RT_TOS(iph
->tos
))))
445 mtu
= dst_mtu(&rt
->u
.dst
);
446 if ((iph
->frag_off
& htons(IP_DF
)) && skb
->len
> mtu
) {
447 icmp_send(skb
, ICMP_DEST_UNREACH
,ICMP_FRAG_NEEDED
, htonl(mtu
));
449 IP_VS_DBG_RL("ip_vs_dr_xmit(): frag needed\n");
454 * Call ip_send_check because we are not sure it is called
455 * after ip_defrag. Is copy-on-write needed?
457 if (unlikely((skb
= skb_share_check(skb
, GFP_ATOMIC
)) == NULL
)) {
461 ip_send_check(ip_hdr(skb
));
464 dst_release(skb
->dst
);
465 skb
->dst
= &rt
->u
.dst
;
467 /* Another hack: avoid icmp_send in ip_fragment */
476 dst_link_failure(skb
);
485 * ICMP packet transmitter
486 * called by the ip_vs_in_icmp
489 ip_vs_icmp_xmit(struct sk_buff
*skb
, struct ip_vs_conn
*cp
,
490 struct ip_vs_protocol
*pp
, int offset
)
492 struct rtable
*rt
; /* Route to the other host */
498 /* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
499 forwarded directly here, because there is no need to
500 translate address/port back */
501 if (IP_VS_FWD_METHOD(cp
) != IP_VS_CONN_F_MASQ
) {
503 rc
= cp
->packet_xmit(skb
, cp
, pp
);
506 /* do not touch skb anymore */
507 atomic_inc(&cp
->in_pkts
);
512 * mangle and send the packet here (only for VS/NAT)
515 if (!(rt
= __ip_vs_get_out_rt(cp
, RT_TOS(ip_hdr(skb
)->tos
))))
519 mtu
= dst_mtu(&rt
->u
.dst
);
520 if ((skb
->len
> mtu
) && (ip_hdr(skb
)->frag_off
& htons(IP_DF
))) {
522 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_FRAG_NEEDED
, htonl(mtu
));
523 IP_VS_DBG_RL("ip_vs_in_icmp(): frag needed\n");
527 /* copy-on-write the packet before mangling it */
528 if (!skb_make_writable(skb
, offset
))
531 if (skb_cow(skb
, rt
->u
.dst
.dev
->hard_header_len
))
534 /* drop the old route when skb is not shared */
535 dst_release(skb
->dst
);
536 skb
->dst
= &rt
->u
.dst
;
538 ip_vs_nat_icmp(skb
, pp
, cp
, 0);
540 /* Another hack: avoid icmp_send in ip_fragment */
549 dst_link_failure(skb
);