1 /* Cluster IP hashmark target
2 * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
3 * based on ideas of Fabio Olive Leite <olive@unixforge.org>
5 * Development of this code funded by SuSE Linux AG, http://www.suse.com/
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/module.h>
14 #include <linux/proc_fs.h>
15 #include <linux/jhash.h>
16 #include <linux/bitops.h>
17 #include <linux/skbuff.h>
18 #include <linux/slab.h>
20 #include <linux/tcp.h>
21 #include <linux/udp.h>
22 #include <linux/icmp.h>
23 #include <linux/if_arp.h>
24 #include <linux/seq_file.h>
25 #include <linux/netfilter_arp.h>
26 #include <linux/netfilter/x_tables.h>
27 #include <linux/netfilter_ipv4/ip_tables.h>
28 #include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
29 #include <net/netfilter/nf_conntrack.h>
30 #include <net/net_namespace.h>
31 #include <net/netns/generic.h>
32 #include <net/checksum.h>
35 #define CLUSTERIP_VERSION "0.8"
37 MODULE_LICENSE("GPL");
38 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
39 MODULE_DESCRIPTION("Xtables: CLUSTERIP target");
41 struct clusterip_config
{
42 struct list_head list
; /* list of all configs */
43 atomic_t refcount
; /* reference count */
44 atomic_t entries
; /* number of entries/rules
47 __be32 clusterip
; /* the IP address */
48 u_int8_t clustermac
[ETH_ALEN
]; /* the MAC address */
49 struct net_device
*dev
; /* device */
50 u_int16_t num_total_nodes
; /* total number of nodes */
51 unsigned long local_nodes
; /* node number array */
54 struct proc_dir_entry
*pde
; /* proc dir entry */
56 enum clusterip_hashmode hash_mode
; /* which hashing mode */
57 u_int32_t hash_initval
; /* hash initialization */
62 static const struct file_operations clusterip_proc_fops
;
65 static int clusterip_net_id __read_mostly
;
67 struct clusterip_net
{
68 struct list_head configs
;
69 /* lock protects the configs list */
73 struct proc_dir_entry
*procdir
;
78 clusterip_config_get(struct clusterip_config
*c
)
80 atomic_inc(&c
->refcount
);
84 static void clusterip_config_rcu_free(struct rcu_head
*head
)
86 kfree(container_of(head
, struct clusterip_config
, rcu
));
90 clusterip_config_put(struct clusterip_config
*c
)
92 if (atomic_dec_and_test(&c
->refcount
))
93 call_rcu_bh(&c
->rcu
, clusterip_config_rcu_free
);
96 /* decrease the count of entries using/referencing this config. If last
97 * entry(rule) is removed, remove the config from lists, but don't free it
98 * yet, since proc-files could still be holding references */
100 clusterip_config_entry_put(struct clusterip_config
*c
)
102 struct clusterip_net
*cn
= net_generic(&init_net
, clusterip_net_id
);
105 if (atomic_dec_and_lock(&c
->entries
, &cn
->lock
)) {
106 list_del_rcu(&c
->list
);
107 spin_unlock(&cn
->lock
);
110 dev_mc_del(c
->dev
, c
->clustermac
);
113 /* In case anyone still accesses the file, the open/close
114 * functions are also incrementing the refcount on their own,
115 * so it's safe to remove the entry even if it's in use. */
116 #ifdef CONFIG_PROC_FS
124 static struct clusterip_config
*
125 __clusterip_config_find(struct net
*net
, __be32 clusterip
)
127 struct clusterip_config
*c
;
128 struct clusterip_net
*cn
= net_generic(net
, clusterip_net_id
);
130 list_for_each_entry_rcu(c
, &cn
->configs
, list
) {
131 if (c
->clusterip
== clusterip
)
138 static inline struct clusterip_config
*
139 clusterip_config_find_get(struct net
*net
, __be32 clusterip
, int entry
)
141 struct clusterip_config
*c
;
144 c
= __clusterip_config_find(net
, clusterip
);
146 if (unlikely(!atomic_inc_not_zero(&c
->refcount
)))
149 atomic_inc(&c
->entries
);
151 rcu_read_unlock_bh();
157 clusterip_config_init_nodelist(struct clusterip_config
*c
,
158 const struct ipt_clusterip_tgt_info
*i
)
162 for (n
= 0; n
< i
->num_local_nodes
; n
++)
163 set_bit(i
->local_nodes
[n
] - 1, &c
->local_nodes
);
166 static struct clusterip_config
*
167 clusterip_config_init(const struct ipt_clusterip_tgt_info
*i
, __be32 ip
,
168 struct net_device
*dev
)
170 struct clusterip_config
*c
;
171 struct clusterip_net
*cn
= net_generic(dev_net(dev
), clusterip_net_id
);
173 c
= kzalloc(sizeof(*c
), GFP_ATOMIC
);
179 memcpy(&c
->clustermac
, &i
->clustermac
, ETH_ALEN
);
180 c
->num_total_nodes
= i
->num_total_nodes
;
181 clusterip_config_init_nodelist(c
, i
);
182 c
->hash_mode
= i
->hash_mode
;
183 c
->hash_initval
= i
->hash_initval
;
184 atomic_set(&c
->refcount
, 1);
185 atomic_set(&c
->entries
, 1);
187 #ifdef CONFIG_PROC_FS
191 /* create proc dir entry */
192 sprintf(buffer
, "%pI4", &ip
);
193 c
->pde
= proc_create_data(buffer
, S_IWUSR
|S_IRUSR
,
195 &clusterip_proc_fops
, c
);
203 spin_lock_bh(&cn
->lock
);
204 list_add_rcu(&c
->list
, &cn
->configs
);
205 spin_unlock_bh(&cn
->lock
);
210 #ifdef CONFIG_PROC_FS
212 clusterip_add_node(struct clusterip_config
*c
, u_int16_t nodenum
)
216 nodenum
> c
->num_total_nodes
)
219 /* check if we already have this number in our bitfield */
220 if (test_and_set_bit(nodenum
- 1, &c
->local_nodes
))
227 clusterip_del_node(struct clusterip_config
*c
, u_int16_t nodenum
)
230 nodenum
> c
->num_total_nodes
)
233 if (test_and_clear_bit(nodenum
- 1, &c
->local_nodes
))
240 static inline u_int32_t
241 clusterip_hashfn(const struct sk_buff
*skb
,
242 const struct clusterip_config
*config
)
244 const struct iphdr
*iph
= ip_hdr(skb
);
245 unsigned long hashval
;
246 u_int16_t sport
= 0, dport
= 0;
249 poff
= proto_ports_offset(iph
->protocol
);
251 const u_int16_t
*ports
;
254 ports
= skb_header_pointer(skb
, iph
->ihl
* 4 + poff
, 4, _ports
);
260 net_info_ratelimited("unknown protocol %u\n", iph
->protocol
);
263 switch (config
->hash_mode
) {
264 case CLUSTERIP_HASHMODE_SIP
:
265 hashval
= jhash_1word(ntohl(iph
->saddr
),
266 config
->hash_initval
);
268 case CLUSTERIP_HASHMODE_SIP_SPT
:
269 hashval
= jhash_2words(ntohl(iph
->saddr
), sport
,
270 config
->hash_initval
);
272 case CLUSTERIP_HASHMODE_SIP_SPT_DPT
:
273 hashval
= jhash_3words(ntohl(iph
->saddr
), sport
, dport
,
274 config
->hash_initval
);
277 /* to make gcc happy */
279 /* This cannot happen, unless the check function wasn't called
280 * at rule load time */
281 pr_info("unknown mode %u\n", config
->hash_mode
);
286 /* node numbers are 1..n, not 0..n */
287 return (((u64
)hashval
* config
->num_total_nodes
) >> 32) + 1;
291 clusterip_responsible(const struct clusterip_config
*config
, u_int32_t hash
)
293 return test_bit(hash
- 1, &config
->local_nodes
);
296 /***********************************************************************
298 ***********************************************************************/
301 clusterip_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
303 const struct ipt_clusterip_tgt_info
*cipinfo
= par
->targinfo
;
305 enum ip_conntrack_info ctinfo
;
308 /* don't need to clusterip_config_get() here, since refcount
309 * is only decremented by destroy() - and ip_tables guarantees
310 * that the ->target() function isn't called after ->destroy() */
312 ct
= nf_ct_get(skb
, &ctinfo
);
316 /* special case: ICMP error handling. conntrack distinguishes between
317 * error messages (RELATED) and information requests (see below) */
318 if (ip_hdr(skb
)->protocol
== IPPROTO_ICMP
&&
319 (ctinfo
== IP_CT_RELATED
||
320 ctinfo
== IP_CT_RELATED_REPLY
))
323 /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO,
324 * TIMESTAMP, INFO_REQUEST or ADDRESS type icmp packets from here
325 * on, which all have an ID field [relevant for hashing]. */
327 hash
= clusterip_hashfn(skb
, cipinfo
->config
);
334 case IP_CT_RELATED_REPLY
:
335 /* FIXME: we don't handle expectations at the moment.
336 * They can arrive on a different node than
337 * the master connection (e.g. FTP passive mode) */
338 case IP_CT_ESTABLISHED
:
339 case IP_CT_ESTABLISHED_REPLY
:
341 default: /* Prevent gcc warnings */
346 nf_ct_dump_tuple_ip(&ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
);
348 pr_debug("hash=%u ct_hash=%u ", hash
, ct
->mark
);
349 if (!clusterip_responsible(cipinfo
->config
, hash
)) {
350 pr_debug("not responsible\n");
353 pr_debug("responsible\n");
355 /* despite being received via linklayer multicast, this is
356 * actually a unicast IP packet. TCP doesn't like PACKET_MULTICAST */
357 skb
->pkt_type
= PACKET_HOST
;
362 static int clusterip_tg_check(const struct xt_tgchk_param
*par
)
364 struct ipt_clusterip_tgt_info
*cipinfo
= par
->targinfo
;
365 const struct ipt_entry
*e
= par
->entryinfo
;
366 struct clusterip_config
*config
;
369 if (cipinfo
->hash_mode
!= CLUSTERIP_HASHMODE_SIP
&&
370 cipinfo
->hash_mode
!= CLUSTERIP_HASHMODE_SIP_SPT
&&
371 cipinfo
->hash_mode
!= CLUSTERIP_HASHMODE_SIP_SPT_DPT
) {
372 pr_info("unknown mode %u\n", cipinfo
->hash_mode
);
376 if (e
->ip
.dmsk
.s_addr
!= htonl(0xffffffff) ||
377 e
->ip
.dst
.s_addr
== 0) {
378 pr_info("Please specify destination IP\n");
382 /* FIXME: further sanity checks */
384 config
= clusterip_config_find_get(&init_net
, e
->ip
.dst
.s_addr
, 1);
386 if (!(cipinfo
->flags
& CLUSTERIP_FLAG_NEW
)) {
387 pr_info("no config found for %pI4, need 'new'\n",
391 struct net_device
*dev
;
393 if (e
->ip
.iniface
[0] == '\0') {
394 pr_info("Please specify an interface name\n");
398 dev
= dev_get_by_name(&init_net
, e
->ip
.iniface
);
400 pr_info("no such interface %s\n",
405 config
= clusterip_config_init(cipinfo
,
406 e
->ip
.dst
.s_addr
, dev
);
411 dev_mc_add(config
->dev
, config
->clustermac
);
414 cipinfo
->config
= config
;
416 ret
= nf_ct_l3proto_try_module_get(par
->family
);
418 pr_info("cannot load conntrack support for proto=%u\n",
423 /* drop reference count of cluster config when rule is deleted */
424 static void clusterip_tg_destroy(const struct xt_tgdtor_param
*par
)
426 const struct ipt_clusterip_tgt_info
*cipinfo
= par
->targinfo
;
428 /* if no more entries are referencing the config, remove it
429 * from the list and destroy the proc entry */
430 clusterip_config_entry_put(cipinfo
->config
);
432 clusterip_config_put(cipinfo
->config
);
434 nf_ct_l3proto_module_put(par
->family
);
438 struct compat_ipt_clusterip_tgt_info
441 u_int8_t clustermac
[6];
442 u_int16_t num_total_nodes
;
443 u_int16_t num_local_nodes
;
444 u_int16_t local_nodes
[CLUSTERIP_MAX_NODES
];
446 u_int32_t hash_initval
;
447 compat_uptr_t config
;
449 #endif /* CONFIG_COMPAT */
451 static struct xt_target clusterip_tg_reg __read_mostly
= {
453 .family
= NFPROTO_IPV4
,
454 .target
= clusterip_tg
,
455 .checkentry
= clusterip_tg_check
,
456 .destroy
= clusterip_tg_destroy
,
457 .targetsize
= sizeof(struct ipt_clusterip_tgt_info
),
459 .compatsize
= sizeof(struct compat_ipt_clusterip_tgt_info
),
460 #endif /* CONFIG_COMPAT */
465 /***********************************************************************
467 ***********************************************************************/
469 /* hardcoded for 48bit ethernet and 32bit ipv4 addresses */
471 u_int8_t src_hw
[ETH_ALEN
];
473 u_int8_t dst_hw
[ETH_ALEN
];
478 static void arp_print(struct arp_payload
*payload
)
480 #define HBUFFERLEN 30
481 char hbuffer
[HBUFFERLEN
];
484 for (k
=0, j
=0; k
< HBUFFERLEN
-3 && j
< ETH_ALEN
; j
++) {
485 hbuffer
[k
++] = hex_asc_hi(payload
->src_hw
[j
]);
486 hbuffer
[k
++] = hex_asc_lo(payload
->src_hw
[j
]);
491 pr_debug("src %pI4@%s, dst %pI4\n",
492 &payload
->src_ip
, hbuffer
, &payload
->dst_ip
);
497 arp_mangle(unsigned int hook
,
499 const struct net_device
*in
,
500 const struct net_device
*out
,
501 int (*okfn
)(struct sk_buff
*))
503 struct arphdr
*arp
= arp_hdr(skb
);
504 struct arp_payload
*payload
;
505 struct clusterip_config
*c
;
507 /* we don't care about non-ethernet and non-ipv4 ARP */
508 if (arp
->ar_hrd
!= htons(ARPHRD_ETHER
) ||
509 arp
->ar_pro
!= htons(ETH_P_IP
) ||
510 arp
->ar_pln
!= 4 || arp
->ar_hln
!= ETH_ALEN
)
513 /* we only want to mangle arp requests and replies */
514 if (arp
->ar_op
!= htons(ARPOP_REPLY
) &&
515 arp
->ar_op
!= htons(ARPOP_REQUEST
))
518 payload
= (void *)(arp
+1);
520 /* if there is no clusterip configuration for the arp reply's
521 * source ip, we don't want to mangle it */
522 c
= clusterip_config_find_get(&init_net
, payload
->src_ip
, 0);
526 /* normally the linux kernel always replies to arp queries of
527 * addresses on different interfacs. However, in the CLUSTERIP case
528 * this wouldn't work, since we didn't subscribe the mcast group on
529 * other interfaces */
531 pr_debug("not mangling arp reply on different "
532 "interface: cip'%s'-skb'%s'\n",
533 c
->dev
->name
, out
->name
);
534 clusterip_config_put(c
);
538 /* mangle reply hardware address */
539 memcpy(payload
->src_hw
, c
->clustermac
, arp
->ar_hln
);
542 pr_debug("mangled arp reply: ");
546 clusterip_config_put(c
);
551 static struct nf_hook_ops cip_arp_ops __read_mostly
= {
554 .hooknum
= NF_ARP_OUT
,
558 /***********************************************************************
560 ***********************************************************************/
562 #ifdef CONFIG_PROC_FS
564 struct clusterip_seq_position
{
565 unsigned int pos
; /* position */
566 unsigned int weight
; /* number of bits set == size */
567 unsigned int bit
; /* current bit */
568 unsigned long val
; /* current value */
571 static void *clusterip_seq_start(struct seq_file
*s
, loff_t
*pos
)
573 struct clusterip_config
*c
= s
->private;
575 u_int32_t local_nodes
;
576 struct clusterip_seq_position
*idx
;
578 /* FIXME: possible race */
579 local_nodes
= c
->local_nodes
;
580 weight
= hweight32(local_nodes
);
584 idx
= kmalloc(sizeof(struct clusterip_seq_position
), GFP_KERNEL
);
586 return ERR_PTR(-ENOMEM
);
589 idx
->weight
= weight
;
590 idx
->bit
= ffs(local_nodes
);
591 idx
->val
= local_nodes
;
592 clear_bit(idx
->bit
- 1, &idx
->val
);
597 static void *clusterip_seq_next(struct seq_file
*s
, void *v
, loff_t
*pos
)
599 struct clusterip_seq_position
*idx
= v
;
602 if (*pos
>= idx
->weight
) {
606 idx
->bit
= ffs(idx
->val
);
607 clear_bit(idx
->bit
- 1, &idx
->val
);
611 static void clusterip_seq_stop(struct seq_file
*s
, void *v
)
617 static int clusterip_seq_show(struct seq_file
*s
, void *v
)
619 struct clusterip_seq_position
*idx
= v
;
624 seq_printf(s
, "%u", idx
->bit
);
626 if (idx
->pos
== idx
->weight
- 1)
632 static const struct seq_operations clusterip_seq_ops
= {
633 .start
= clusterip_seq_start
,
634 .next
= clusterip_seq_next
,
635 .stop
= clusterip_seq_stop
,
636 .show
= clusterip_seq_show
,
639 static int clusterip_proc_open(struct inode
*inode
, struct file
*file
)
641 int ret
= seq_open(file
, &clusterip_seq_ops
);
644 struct seq_file
*sf
= file
->private_data
;
645 struct clusterip_config
*c
= PDE_DATA(inode
);
649 clusterip_config_get(c
);
655 static int clusterip_proc_release(struct inode
*inode
, struct file
*file
)
657 struct clusterip_config
*c
= PDE_DATA(inode
);
660 ret
= seq_release(inode
, file
);
663 clusterip_config_put(c
);
668 static ssize_t
clusterip_proc_write(struct file
*file
, const char __user
*input
,
669 size_t size
, loff_t
*ofs
)
671 struct clusterip_config
*c
= PDE_DATA(file_inode(file
));
672 #define PROC_WRITELEN 10
673 char buffer
[PROC_WRITELEN
+1];
674 unsigned long nodenum
;
677 if (size
> PROC_WRITELEN
)
679 if (copy_from_user(buffer
, input
, size
))
683 if (*buffer
== '+') {
684 rc
= kstrtoul(buffer
+1, 10, &nodenum
);
687 if (clusterip_add_node(c
, nodenum
))
689 } else if (*buffer
== '-') {
690 rc
= kstrtoul(buffer
+1, 10, &nodenum
);
693 if (clusterip_del_node(c
, nodenum
))
701 static const struct file_operations clusterip_proc_fops
= {
702 .owner
= THIS_MODULE
,
703 .open
= clusterip_proc_open
,
705 .write
= clusterip_proc_write
,
707 .release
= clusterip_proc_release
,
710 #endif /* CONFIG_PROC_FS */
712 static int clusterip_net_init(struct net
*net
)
714 struct clusterip_net
*cn
= net_generic(net
, clusterip_net_id
);
716 INIT_LIST_HEAD(&cn
->configs
);
718 spin_lock_init(&cn
->lock
);
720 #ifdef CONFIG_PROC_FS
721 cn
->procdir
= proc_mkdir("ipt_CLUSTERIP", net
->proc_net
);
723 pr_err("Unable to proc dir entry\n");
726 #endif /* CONFIG_PROC_FS */
731 static void clusterip_net_exit(struct net
*net
)
733 #ifdef CONFIG_PROC_FS
734 struct clusterip_net
*cn
= net_generic(net
, clusterip_net_id
);
735 proc_remove(cn
->procdir
);
739 static struct pernet_operations clusterip_net_ops
= {
740 .init
= clusterip_net_init
,
741 .exit
= clusterip_net_exit
,
742 .id
= &clusterip_net_id
,
743 .size
= sizeof(struct clusterip_net
),
746 static int __init
clusterip_tg_init(void)
750 ret
= register_pernet_subsys(&clusterip_net_ops
);
754 ret
= xt_register_target(&clusterip_tg_reg
);
758 ret
= nf_register_hook(&cip_arp_ops
);
762 pr_info("ClusterIP Version %s loaded successfully\n",
768 xt_unregister_target(&clusterip_tg_reg
);
770 unregister_pernet_subsys(&clusterip_net_ops
);
774 static void __exit
clusterip_tg_exit(void)
776 pr_info("ClusterIP Version %s unloading\n", CLUSTERIP_VERSION
);
778 nf_unregister_hook(&cip_arp_ops
);
779 xt_unregister_target(&clusterip_tg_reg
);
780 unregister_pernet_subsys(&clusterip_net_ops
);
782 /* Wait for completion of call_rcu_bh()'s (clusterip_config_rcu_free) */
786 module_init(clusterip_tg_init
);
787 module_exit(clusterip_tg_exit
);