2 * ip_vs_nfct.c: Netfilter connection tracking support for IPVS
4 * Portions Copyright (C) 2001-2002
5 * Antefacto Ltd, 181 Parnell St, Dublin 1, Ireland.
7 * Portions Copyright (C) 2003-2010
11 * This code is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 * Ben North <ben@redfrontdoor.org>
27 * Julian Anastasov <ja@ssi.bg> Reorganize and sync with latest kernels
28 * Hannes Eder <heder@google.com> Extend NFCT support for FTP, ipvs match
33 * - provide conntrack confirmation for new and related connections, by
34 * this way we can see their proper conntrack state in all hooks
35 * - support for all forwarding methods, not only NAT
36 * - FTP support (NAT), ability to support other NAT apps with expectations
37 * - to correctly create expectations for related NAT connections the proper
38 * NF conntrack support must be already installed, eg. ip_vs_ftp requires
39 * nf_conntrack_ftp ... iptables_nat for the same ports (but no iptables
40 * NAT rules are needed)
41 * - alter reply for NAT when forwarding packet in original direction:
42 * conntrack from client in NEW or RELATED (Passive FTP DATA) state or
43 * when RELATED conntrack is created from real server (Active FTP DATA)
44 * - if iptables_nat is not loaded the Passive FTP will not work (the
45 * PASV response can not be NAT-ed) but Active FTP should work
49 #define KMSG_COMPONENT "IPVS"
50 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
52 #include <linux/module.h>
53 #include <linux/types.h>
54 #include <linux/kernel.h>
55 #include <linux/errno.h>
56 #include <linux/compiler.h>
57 #include <linux/vmalloc.h>
58 #include <linux/skbuff.h>
60 #include <linux/netfilter.h>
61 #include <linux/netfilter_ipv4.h>
62 #include <net/ip_vs.h>
63 #include <net/netfilter/nf_conntrack_core.h>
64 #include <net/netfilter/nf_conntrack_expect.h>
65 #include <net/netfilter/nf_conntrack_seqadj.h>
66 #include <net/netfilter/nf_conntrack_helper.h>
67 #include <net/netfilter/nf_conntrack_zones.h>
70 #define FMT_TUPLE "%pI4:%u->%pI4:%u/%u"
71 #define ARG_TUPLE(T) &(T)->src.u3.ip, ntohs((T)->src.u.all), \
72 &(T)->dst.u3.ip, ntohs((T)->dst.u.all), \
75 #define FMT_CONN "%pI4:%u->%pI4:%u->%pI4:%u/%u:%u"
76 #define ARG_CONN(C) &((C)->caddr.ip), ntohs((C)->cport), \
77 &((C)->vaddr.ip), ntohs((C)->vport), \
78 &((C)->daddr.ip), ntohs((C)->dport), \
79 (C)->protocol, (C)->state
82 ip_vs_update_conntrack(struct sk_buff
*skb
, struct ip_vs_conn
*cp
, int outin
)
84 enum ip_conntrack_info ctinfo
;
85 struct nf_conn
*ct
= nf_ct_get(skb
, &ctinfo
);
86 struct nf_conntrack_tuple new_tuple
;
88 if (ct
== NULL
|| nf_ct_is_confirmed(ct
) || nf_ct_is_untracked(ct
) ||
92 /* Never alter conntrack for non-NAT conns */
93 if (IP_VS_FWD_METHOD(cp
) != IP_VS_CONN_F_MASQ
)
96 /* Alter reply only in original direction */
97 if (CTINFO2DIR(ctinfo
) != IP_CT_DIR_ORIGINAL
)
100 /* Applications may adjust TCP seqs */
101 if (cp
->app
&& nf_ct_protonum(ct
) == IPPROTO_TCP
&&
102 !nfct_seqadj(ct
) && !nfct_seqadj_ext_add(ct
))
106 * The connection is not yet in the hashtable, so we update it.
107 * CIP->VIP will remain the same, so leave the tuple in
108 * IP_CT_DIR_ORIGINAL untouched. When the reply comes back from the
109 * real-server we will see RIP->DIP.
111 new_tuple
= ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
;
113 * This will also take care of UDP and other protocols.
116 new_tuple
.src
.u3
= cp
->daddr
;
117 if (new_tuple
.dst
.protonum
!= IPPROTO_ICMP
&&
118 new_tuple
.dst
.protonum
!= IPPROTO_ICMPV6
)
119 new_tuple
.src
.u
.tcp
.port
= cp
->dport
;
121 new_tuple
.dst
.u3
= cp
->vaddr
;
122 if (new_tuple
.dst
.protonum
!= IPPROTO_ICMP
&&
123 new_tuple
.dst
.protonum
!= IPPROTO_ICMPV6
)
124 new_tuple
.dst
.u
.tcp
.port
= cp
->vport
;
126 IP_VS_DBG(7, "%s: Updating conntrack ct=%p, status=0x%lX, "
127 "ctinfo=%d, old reply=" FMT_TUPLE
128 ", new reply=" FMT_TUPLE
", cp=" FMT_CONN
"\n",
129 __func__
, ct
, ct
->status
, ctinfo
,
130 ARG_TUPLE(&ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
),
131 ARG_TUPLE(&new_tuple
), ARG_CONN(cp
));
132 nf_conntrack_alter_reply(ct
, &new_tuple
);
135 int ip_vs_confirm_conntrack(struct sk_buff
*skb
)
137 return nf_conntrack_confirm(skb
);
141 * Called from init_conntrack() as expectfn handler.
143 static void ip_vs_nfct_expect_callback(struct nf_conn
*ct
,
144 struct nf_conntrack_expect
*exp
)
146 struct nf_conntrack_tuple
*orig
, new_reply
;
147 struct ip_vs_conn
*cp
;
148 struct ip_vs_conn_param p
;
149 struct net
*net
= nf_ct_net(ct
);
151 if (exp
->tuple
.src
.l3num
!= PF_INET
)
155 * We assume that no NF locks are held before this callback.
156 * ip_vs_conn_out_get and ip_vs_conn_in_get should match their
157 * expectations even if they use wildcard values, now we provide the
158 * actual values from the newly created original conntrack direction.
159 * The conntrack is confirmed when packet reaches IPVS hooks.
163 orig
= &ct
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
;
164 ip_vs_conn_fill_param(net
, exp
->tuple
.src
.l3num
, orig
->dst
.protonum
,
165 &orig
->src
.u3
, orig
->src
.u
.tcp
.port
,
166 &orig
->dst
.u3
, orig
->dst
.u
.tcp
.port
, &p
);
167 cp
= ip_vs_conn_out_get(&p
);
169 /* Change reply CLIENT->RS to CLIENT->VS */
170 new_reply
= ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
;
171 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE
", "
172 FMT_TUPLE
", found inout cp=" FMT_CONN
"\n",
173 __func__
, ct
, ct
->status
,
174 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
176 new_reply
.dst
.u3
= cp
->vaddr
;
177 new_reply
.dst
.u
.tcp
.port
= cp
->vport
;
178 IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE
", " FMT_TUPLE
179 ", inout cp=" FMT_CONN
"\n",
181 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
187 cp
= ip_vs_conn_in_get(&p
);
189 /* Change reply VS->CLIENT to RS->CLIENT */
190 new_reply
= ct
->tuplehash
[IP_CT_DIR_REPLY
].tuple
;
191 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE
", "
192 FMT_TUPLE
", found outin cp=" FMT_CONN
"\n",
193 __func__
, ct
, ct
->status
,
194 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
196 new_reply
.src
.u3
= cp
->daddr
;
197 new_reply
.src
.u
.tcp
.port
= cp
->dport
;
198 IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE
", "
199 FMT_TUPLE
", outin cp=" FMT_CONN
"\n",
201 ARG_TUPLE(orig
), ARG_TUPLE(&new_reply
),
206 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuple=" FMT_TUPLE
207 " - unknown expect\n",
208 __func__
, ct
, ct
->status
, ARG_TUPLE(orig
));
212 /* Never alter conntrack for non-NAT conns */
213 if (IP_VS_FWD_METHOD(cp
) == IP_VS_CONN_F_MASQ
)
214 nf_conntrack_alter_reply(ct
, &new_reply
);
220 * Create NF conntrack expectation with wildcard (optional) source port.
221 * Then the default callback function will alter the reply and will confirm
222 * the conntrack entry when the first packet comes.
223 * Use port 0 to expect connection from any port.
225 void ip_vs_nfct_expect_related(struct sk_buff
*skb
, struct nf_conn
*ct
,
226 struct ip_vs_conn
*cp
, u_int8_t proto
,
227 const __be16 port
, int from_rs
)
229 struct nf_conntrack_expect
*exp
;
231 if (ct
== NULL
|| nf_ct_is_untracked(ct
))
234 exp
= nf_ct_expect_alloc(ct
);
238 nf_ct_expect_init(exp
, NF_CT_EXPECT_CLASS_DEFAULT
, nf_ct_l3num(ct
),
239 from_rs
? &cp
->daddr
: &cp
->caddr
,
240 from_rs
? &cp
->caddr
: &cp
->vaddr
,
241 proto
, port
? &port
: NULL
,
242 from_rs
? &cp
->cport
: &cp
->vport
);
244 exp
->expectfn
= ip_vs_nfct_expect_callback
;
246 IP_VS_DBG(7, "%s: ct=%p, expect tuple=" FMT_TUPLE
"\n",
247 __func__
, ct
, ARG_TUPLE(&exp
->tuple
));
248 nf_ct_expect_related(exp
);
249 nf_ct_expect_put(exp
);
251 EXPORT_SYMBOL(ip_vs_nfct_expect_related
);
254 * Our connection was terminated, try to drop the conntrack immediately
256 void ip_vs_conn_drop_conntrack(struct ip_vs_conn
*cp
)
258 struct nf_conntrack_tuple_hash
*h
;
260 struct nf_conntrack_tuple tuple
;
265 tuple
= (struct nf_conntrack_tuple
) {
266 .dst
= { .protonum
= cp
->protocol
, .dir
= IP_CT_DIR_ORIGINAL
} };
267 tuple
.src
.u3
= cp
->caddr
;
268 tuple
.src
.u
.all
= cp
->cport
;
269 tuple
.src
.l3num
= cp
->af
;
270 tuple
.dst
.u3
= cp
->vaddr
;
271 tuple
.dst
.u
.all
= cp
->vport
;
273 IP_VS_DBG(7, "%s: dropping conntrack with tuple=" FMT_TUPLE
274 " for conn " FMT_CONN
"\n",
275 __func__
, ARG_TUPLE(&tuple
), ARG_CONN(cp
));
277 h
= nf_conntrack_find_get(ip_vs_conn_net(cp
), NF_CT_DEFAULT_ZONE
,
280 ct
= nf_ct_tuplehash_to_ctrack(h
);
281 /* Show what happens instead of calling nf_ct_kill() */
282 if (del_timer(&ct
->timeout
)) {
283 IP_VS_DBG(7, "%s: ct=%p, deleted conntrack timer for tuple="
285 __func__
, ct
, ARG_TUPLE(&tuple
));
286 if (ct
->timeout
.function
)
287 ct
->timeout
.function(ct
->timeout
.data
);
289 IP_VS_DBG(7, "%s: ct=%p, no conntrack timer for tuple="
291 __func__
, ct
, ARG_TUPLE(&tuple
));
295 IP_VS_DBG(7, "%s: no conntrack for tuple=" FMT_TUPLE
"\n",
296 __func__
, ARG_TUPLE(&tuple
));