Commit 73348fed authored by Haishuang Yan's avatar Haishuang Yan Committed by Pablo Neira Ayuso
Browse files

ipvs: optimize tunnel dumps for icmp errors 



After strip GRE/UDP tunnel header for icmp errors, it's better to show
"GRE/UDP" instead of "IPIP" in debug message.

Signed-off-by: default avatarHaishuang Yan <yanhaishuang@cmss.chinamobile.com>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6b36d482

net/netfilter/ipvs/ip_vs_core.c

+26 −20
Original line number Diff line number Diff line
@@ -1661,8 +1661,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
	struct ip_vs_protocol *pp;

	struct ip_vs_proto_data *pd;

	unsigned int offset, offset2, ihl, verdict;

	bool ipip, new_cp = false;

	bool tunnel, new_cp = false;

	union nf_inet_addr *raddr;

	char *outer_proto;



	*related = 1;
@@ -1703,8 +1704,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
		return NF_ACCEPT; /* The packet looks wrong, ignore */

	raddr = (union nf_inet_addr *)&cih->daddr;



	/* Special case for errors for IPIP packets */

	ipip = false;

	/* Special case for errors for IPIP/UDP/GRE tunnel packets */

	tunnel = false;

	if (cih->protocol == IPPROTO_IPIP) {

		struct ip_vs_dest *dest;
@@ -1721,7 +1722,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
		cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);

		if (cih == NULL)

			return NF_ACCEPT; /* The packet looks wrong, ignore */

		ipip = true;

		tunnel = true;

		outer_proto = "IPIP";

	} else if ((cih->protocol == IPPROTO_UDP ||	/* Can be UDP encap */

		    cih->protocol == IPPROTO_GRE) &&	/* Can be GRE encap */

		   /* Error for our tunnel must arrive at LOCAL_IN */
@@ -1729,16 +1731,19 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
		__u8 iproto;

		int ulen;



		/* Non-first fragment has no UDP header */

		/* Non-first fragment has no UDP/GRE header */

		if (unlikely(cih->frag_off & htons(IP_OFFSET)))

			return NF_ACCEPT;

		offset2 = offset + cih->ihl * 4;

		if (cih->protocol == IPPROTO_UDP)

		if (cih->protocol == IPPROTO_UDP) {

			ulen = ipvs_udp_decap(ipvs, skb, offset2, AF_INET,

					      raddr, &iproto);

		else

			outer_proto = "UDP";

		} else {

			ulen = ipvs_gre_decap(ipvs, skb, offset2, AF_INET,

					      raddr, &iproto);

			outer_proto = "GRE";

		}

		if (ulen > 0) {

			/* Skip IP and UDP/GRE tunnel headers */

			offset = offset2 + ulen;
@@ -1747,7 +1752,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
						 &_ciph);

			if (cih && cih->version == 4 && cih->ihl >= 5 &&

			    iproto == IPPROTO_IPIP)

				ipip = true;

				tunnel = true;

			else

				return NF_ACCEPT;

		}
@@ -1767,11 +1772,11 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
		      "Checking incoming ICMP for");



	offset2 = offset;

	ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !ipip, &ciph);

	ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !tunnel, &ciph);

	offset = ciph.len;



	/* The embedded headers contain source and dest in reverse order.

	 * For IPIP this is error for request, not for reply.

	 * For IPIP/UDP/GRE tunnel this is error for request, not for reply.

	 */

	cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto,

			     ipvs, AF_INET, skb, &ciph);
@@ -1779,7 +1784,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
	if (!cp) {

		int v;



		if (ipip || !sysctl_schedule_icmp(ipvs))

		if (tunnel || !sysctl_schedule_icmp(ipvs))

			return NF_ACCEPT;



		if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph))
@@ -1797,7 +1802,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
		goto out;

	}



	if (ipip) {

	if (tunnel) {

		__be32 info = ic->un.gateway;

		__u8 type = ic->type;

		__u8 code = ic->code;
@@ -1809,17 +1814,18 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
			u32 mtu = ntohs(ic->un.frag.mtu);

			__be16 frag_off = cih->frag_off;



			/* Strip outer IP and ICMP, go to IPIP header */

			/* Strip outer IP and ICMP, go to IPIP/UDP/GRE header */

			if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL)

				goto ignore_ipip;

				goto ignore_tunnel;

			offset2 -= ihl + sizeof(_icmph);

			skb_reset_network_header(skb);

			IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",

				&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, mtu);

			IP_VS_DBG(12, "ICMP for %s %pI4->%pI4: mtu=%u\n",

				  outer_proto, &ip_hdr(skb)->saddr,

				  &ip_hdr(skb)->daddr, mtu);

			ipv4_update_pmtu(skb, ipvs->net, mtu, 0, 0);

			/* Client uses PMTUD? */

			if (!(frag_off & htons(IP_DF)))

				goto ignore_ipip;

				goto ignore_tunnel;

			/* Prefer the resulting PMTU */

			if (dest) {

				struct ip_vs_dest_dst *dest_dst;
@@ -1832,11 +1838,11 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
				mtu -= sizeof(struct iphdr);

			info = htonl(mtu);

		}

		/* Strip outer IP, ICMP and IPIP, go to IP header of

		/* Strip outer IP, ICMP and IPIP/UDP/GRE, go to IP header of

		 * original request.

		 */

		if (pskb_pull(skb, offset2) == NULL)

			goto ignore_ipip;

			goto ignore_tunnel;

		skb_reset_network_header(skb);

		IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",

			&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
@@ -1845,7 +1851,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, 
		/* ICMP can be shorter but anyways, account it */

		ip_vs_out_stats(cp, skb);



ignore_ipip:

ignore_tunnel:

		consume_skb(skb);

		verdict = NF_STOLEN;

		goto out;

CRA Git | Maintained and supported by SUSTech CRA and CCSE