Merge tag 'ipvs-for-v4.7' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs-next (6cd54fc6) · Commits · 戴 / test

include/net/ip_vs.h

+17 −0

Original line number	Diff line number	Diff line
		@@ -731,6 +731,12 @@ struct ip_vs_pe {
		u32 (hashkey_raw)(const struct ip_vs_conn_param p, u32 initval,
		bool inverse);
		int (show_pe_data)(const struct ip_vs_conn cp, char *buf);
		/* create connections for real-server outgoing packets */
		struct ip_vs_conn* (conn_out)(struct ip_vs_service svc,
		struct ip_vs_dest *dest,
		struct sk_buff *skb,
		const struct ip_vs_iphdr *iph,
		__be16 dport, __be16 cport);
		};

		/* The application module object (a.k.a. app incarnation) */
		@@ -874,6 +880,7 @@ struct netns_ipvs {
		/* Service counters */
		atomic_t ftpsvc_counter;
		atomic_t nullsvc_counter;
		atomic_t conn_out_counter;

		#ifdef CONFIG_SYSCTL
		/* 1/rate drop and drop-entry variables */
		@@ -1147,6 +1154,12 @@ static inline int sysctl_cache_bypass(struct netns_ipvs *ipvs)
		*/
		const char *ip_vs_proto_name(unsigned int proto);
		void ip_vs_init_hash_table(struct list_head *table, int rows);
		struct ip_vs_conn ip_vs_new_conn_out(struct ip_vs_service svc,
		struct ip_vs_dest *dest,
		struct sk_buff *skb,
		const struct ip_vs_iphdr *iph,
		__be16 dport,
		__be16 cport);
		#define IP_VS_INIT_HASH_TABLE(t) ip_vs_init_hash_table((t), ARRAY_SIZE((t)))

		#define IP_VS_APP_TYPE_FTP 1
		@@ -1378,6 +1391,10 @@ ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u32 fwmark, __u16 protocol
		bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol,
		const union nf_inet_addr *daddr, __be16 dport);

		struct ip_vs_dest *
		ip_vs_find_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol,
		const union nf_inet_addr *daddr, __be16 dport);

		int ip_vs_use_count_inc(void);
		void ip_vs_use_count_dec(void);
		int ip_vs_register_nl_ioctl(void);

net/netfilter/ipvs/ip_vs_conn.c

+25 −4

Original line number	Diff line number	Diff line
		@@ -104,6 +104,7 @@ static inline void ct_write_unlock_bh(unsigned int key)
		spin_unlock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
		}

		static void ip_vs_conn_expire(unsigned long data);

		/*
		* Returns hash value for IPVS connection entry
		@@ -453,10 +454,16 @@ ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af,
		}
		EXPORT_SYMBOL_GPL(ip_vs_conn_out_get_proto);

		static void __ip_vs_conn_put_notimer(struct ip_vs_conn *cp)
		{
		__ip_vs_conn_put(cp);
		ip_vs_conn_expire((unsigned long)cp);
		}

		/*
		* Put back the conn and restart its timer with its timeout
		*/
		void ip_vs_conn_put(struct ip_vs_conn *cp)
		static void __ip_vs_conn_put_timer(struct ip_vs_conn *cp)
		{
		unsigned long t = (cp->flags & IP_VS_CONN_F_ONE_PACKET) ?
		0 : cp->timeout;
		@@ -465,6 +472,16 @@ void ip_vs_conn_put(struct ip_vs_conn *cp)
		__ip_vs_conn_put(cp);
		}

		void ip_vs_conn_put(struct ip_vs_conn *cp)
		{
		if ((cp->flags & IP_VS_CONN_F_ONE_PACKET) &&
		(atomic_read(&cp->refcnt) == 1) &&
		!timer_pending(&cp->timer))
		/* expire connection immediately */
		__ip_vs_conn_put_notimer(cp);
		else
		__ip_vs_conn_put_timer(cp);
		}

		/*
		* Fill a no_client_port connection with a client port number
		@@ -819,7 +836,8 @@ static void ip_vs_conn_expire(unsigned long data)
		if (cp->control)
		ip_vs_control_del(cp);

		if (cp->flags & IP_VS_CONN_F_NFCT) {
		if ((cp->flags & IP_VS_CONN_F_NFCT) &&
		!(cp->flags & IP_VS_CONN_F_ONE_PACKET)) {
		/* Do not access conntracks during subsys cleanup
		* because nf_conntrack_find_get can not be used after
		* conntrack cleanup for the net.
		@@ -834,6 +852,9 @@ static void ip_vs_conn_expire(unsigned long data)
		ip_vs_unbind_dest(cp);
		if (cp->flags & IP_VS_CONN_F_NO_CPORT)
		atomic_dec(&ip_vs_conn_no_cport_cnt);
		if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
		ip_vs_conn_rcu_free(&cp->rcu_head);
		else
		call_rcu(&cp->rcu_head, ip_vs_conn_rcu_free);
		atomic_dec(&ipvs->conn_count);
		return;
		@@ -850,7 +871,7 @@ static void ip_vs_conn_expire(unsigned long data)
		if (ipvs->sync_state & IP_VS_STATE_MASTER)
		ip_vs_sync_conn(ipvs, cp, sysctl_sync_threshold(ipvs));

		ip_vs_conn_put(cp);
		__ip_vs_conn_put_timer(cp);
		}

		/* Modify timer, so that it expires as soon as possible.

net/netfilter/ipvs/ip_vs_core.c

+154 −0

Original line number	Diff line number	Diff line
		@@ -68,6 +68,7 @@ EXPORT_SYMBOL(ip_vs_conn_put);
		#ifdef CONFIG_IP_VS_DEBUG
		EXPORT_SYMBOL(ip_vs_get_debug_level);
		#endif
		EXPORT_SYMBOL(ip_vs_new_conn_out);

		static int ip_vs_net_id __read_mostly;
		/* netns cnt used for uniqueness */
		@@ -1100,6 +1101,143 @@ static inline bool is_new_conn_expected(const struct ip_vs_conn *cp,
		}
		}

		/* Generic function to create new connections for outgoing RS packets
		*
		* Pre-requisites for successful connection creation:
		* 1) Virtual Service is NOT fwmark based:
		* In fwmark-VS actual vaddr and vport are unknown to IPVS
		* 2) Real Server and Virtual Service were NOT configured without port:
		* This is to allow match of different VS to the same RS ip-addr
		*/
		struct ip_vs_conn ip_vs_new_conn_out(struct ip_vs_service svc,
		struct ip_vs_dest *dest,
		struct sk_buff *skb,
		const struct ip_vs_iphdr *iph,
		__be16 dport,
		__be16 cport)
		{
		struct ip_vs_conn_param param;
		struct ip_vs_conn ct = NULL, cp = NULL;
		const union nf_inet_addr vaddr, daddr, *caddr;
		union nf_inet_addr snet;
		__be16 vport;
		unsigned int flags;

		EnterFunction(12);
		vaddr = &svc->addr;
		vport = svc->port;
		daddr = &iph->saddr;
		caddr = &iph->daddr;

		/* check pre-requisites are satisfied */
		if (svc->fwmark)
		return NULL;
		if (!vport \|\| !dport)
		return NULL;

		/* for persistent service first create connection template */
		if (svc->flags & IP_VS_SVC_F_PERSISTENT) {
		/* apply netmask the same way ingress-side does */
		#ifdef CONFIG_IP_VS_IPV6
		if (svc->af == AF_INET6)
		ipv6_addr_prefix(&snet.in6, &caddr->in6,
		(__force __u32)svc->netmask);
		else
		#endif
		snet.ip = caddr->ip & svc->netmask;
		/* fill params and create template if not existent */
		if (ip_vs_conn_fill_param_persist(svc, skb, iph->protocol,
		&snet, 0, vaddr,
		vport, &param) < 0)
		return NULL;
		ct = ip_vs_ct_in_get(&param);
		if (!ct) {
		ct = ip_vs_conn_new(&param, dest->af, daddr, dport,
		IP_VS_CONN_F_TEMPLATE, dest, 0);
		if (!ct) {
		kfree(param.pe_data);
		return NULL;
		}
		ct->timeout = svc->timeout;
		} else {
		kfree(param.pe_data);
		}
		}

		/* connection flags */
		flags = ((svc->flags & IP_VS_SVC_F_ONEPACKET) &&
		iph->protocol == IPPROTO_UDP) ? IP_VS_CONN_F_ONE_PACKET : 0;
		/* create connection */
		ip_vs_conn_fill_param(svc->ipvs, svc->af, iph->protocol,
		caddr, cport, vaddr, vport, &param);
		cp = ip_vs_conn_new(&param, dest->af, daddr, dport, flags, dest, 0);
		if (!cp) {
		if (ct)
		ip_vs_conn_put(ct);
		return NULL;
		}
		if (ct) {
		ip_vs_control_add(cp, ct);
		ip_vs_conn_put(ct);
		}
		ip_vs_conn_stats(cp, svc);

		/* return connection (will be used to handle outgoing packet) */
		IP_VS_DBG_BUF(6, "New connection RS-initiated:%c c:%s:%u v:%s:%u "
		"d:%s:%u conn->flags:%X conn->refcnt:%d\n",
		ip_vs_fwd_tag(cp),
		IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport),
		IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport),
		IP_VS_DBG_ADDR(cp->af, &cp->daddr), ntohs(cp->dport),
		cp->flags, atomic_read(&cp->refcnt));
		LeaveFunction(12);
		return cp;
		}

		/* Handle outgoing packets which are considered requests initiated by
		* real servers, so that subsequent responses from external client can be
		* routed to the right real server.
		* Used also for outgoing responses in OPS mode.
		*
		* Connection management is handled by persistent-engine specific callback.
		*/
		static struct ip_vs_conn *__ip_vs_rs_conn_out(unsigned int hooknum,
		struct netns_ipvs *ipvs,
		int af, struct sk_buff *skb,
		const struct ip_vs_iphdr *iph)
		{
		struct ip_vs_dest *dest;
		struct ip_vs_conn *cp = NULL;
		__be16 _ports[2], *pptr;

		if (hooknum == NF_INET_LOCAL_IN)
		return NULL;

		pptr = frag_safe_skb_hp(skb, iph->len,
		sizeof(_ports), _ports, iph);
		if (!pptr)
		return NULL;

		rcu_read_lock();
		dest = ip_vs_find_real_service(ipvs, af, iph->protocol,
		&iph->saddr, pptr[0]);
		if (dest) {
		struct ip_vs_service *svc;
		struct ip_vs_pe *pe;

		svc = rcu_dereference(dest->svc);
		if (svc) {
		pe = rcu_dereference(svc->pe);
		if (pe && pe->conn_out)
		cp = pe->conn_out(svc, dest, skb, iph,
		pptr[0], pptr[1]);
		}
		}
		rcu_read_unlock();

		return cp;
		}

		/* Handle response packets: rewrite addresses and send away...
		*/
		static unsigned int
		@@ -1245,6 +1383,22 @@ ip_vs_out(struct netns_ipvs ipvs, unsigned int hooknum, struct sk_buff skb, in

		if (likely(cp))
		return handle_response(af, skb, pd, cp, &iph, hooknum);

		/* Check for real-server-started requests */
		if (atomic_read(&ipvs->conn_out_counter)) {
		/* Currently only for UDP:
		* connection oriented protocols typically use
		* ephemeral ports for outgoing connections, so
		* related incoming responses would not match any VS
		*/
		if (pp->protocol == IPPROTO_UDP) {
		cp = __ip_vs_rs_conn_out(hooknum, ipvs, af, skb, &iph);
		if (likely(cp))
		return handle_response(af, skb, pd, cp, &iph,
		hooknum);
		}
		}

		if (sysctl_nat_icmp_send(ipvs) &&
		(pp->protocol == IPPROTO_TCP \|\|
		pp->protocol == IPPROTO_UDP \|\|

net/netfilter/ipvs/ip_vs_ctl.c

+45 −1

Original line number	Diff line number	Diff line
		@@ -567,6 +567,36 @@ bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol,
		return false;
		}

		/* Find real service record by <proto,addr,port>.
		* In case of multiple records with the same <proto,addr,port>, only
		* the first found record is returned.
		*
		* To be called under RCU lock.
		*/
		struct ip_vs_dest ip_vs_find_real_service(struct netns_ipvs ipvs, int af,
		__u16 protocol,
		const union nf_inet_addr *daddr,
		__be16 dport)
		{
		unsigned int hash;
		struct ip_vs_dest *dest;

		/* Check for "full" addressed entries */
		hash = ip_vs_rs_hashkey(af, daddr, dport);

		hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
		if (dest->port == dport &&
		dest->af == af &&
		ip_vs_addr_equal(af, &dest->addr, daddr) &&
		(dest->protocol == protocol \|\| dest->vfwmark)) {
		/* HIT */
		return dest;
		}
		}

		return NULL;
		}

		/* Lookup destination by {addr,port} in the given service
		* Called under RCU lock.
		*/
		@@ -1253,6 +1283,8 @@ ip_vs_add_service(struct netns_ipvs ipvs, struct ip_vs_service_user_kern u,
		atomic_inc(&ipvs->ftpsvc_counter);
		else if (svc->port == 0)
		atomic_inc(&ipvs->nullsvc_counter);
		if (svc->pe && svc->pe->conn_out)
		atomic_inc(&ipvs->conn_out_counter);

		ip_vs_start_estimator(ipvs, &svc->stats);

		@@ -1293,6 +1325,7 @@ ip_vs_edit_service(struct ip_vs_service svc, struct ip_vs_service_user_kern u)
		struct ip_vs_scheduler sched = NULL, old_sched;
		struct ip_vs_pe pe = NULL, old_pe = NULL;
		int ret = 0;
		bool new_pe_conn_out, old_pe_conn_out;

		/*
		* Lookup the scheduler, by 'u->sched_name'
		@@ -1355,8 +1388,16 @@ ip_vs_edit_service(struct ip_vs_service svc, struct ip_vs_service_user_kern u)
		svc->netmask = u->netmask;

		old_pe = rcu_dereference_protected(svc->pe, 1);
		if (pe != old_pe)
		if (pe != old_pe) {
		rcu_assign_pointer(svc->pe, pe);
		/* check for optional methods in new pe */
		new_pe_conn_out = (pe && pe->conn_out) ? true : false;
		old_pe_conn_out = (old_pe && old_pe->conn_out) ? true : false;
		if (new_pe_conn_out && !old_pe_conn_out)
		atomic_inc(&svc->ipvs->conn_out_counter);
		if (old_pe_conn_out && !new_pe_conn_out)
		atomic_dec(&svc->ipvs->conn_out_counter);
		}

		out:
		ip_vs_scheduler_put(old_sched);
		@@ -1389,6 +1430,8 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)

		/* Unbind persistence engine, keep svc->pe */
		old_pe = rcu_dereference_protected(svc->pe, 1);
		if (old_pe && old_pe->conn_out)
		atomic_dec(&ipvs->conn_out_counter);
		ip_vs_pe_put(old_pe);

		/*
		@@ -3957,6 +4000,7 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
		(unsigned long) ipvs);
		atomic_set(&ipvs->ftpsvc_counter, 0);
		atomic_set(&ipvs->nullsvc_counter, 0);
		atomic_set(&ipvs->conn_out_counter, 0);

		/* procfs stats */
		ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);

net/netfilter/ipvs/ip_vs_nfct.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -93,6 +93,10 @@ ip_vs_update_conntrack(struct sk_buff skb, struct ip_vs_conn cp, int outin)
		if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
		return;

		/* Never alter conntrack for OPS conns (no reply is expected) */
		if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
		return;

		/* Alter reply only in original direction */
		if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
		return;

Admin message