Commit d4383f04 authored by Jesper Dangaard Brouer's avatar Jesper Dangaard Brouer Committed by Simon Horman
Browse files

ipvs: API change to avoid rescan of IPv6 exthdr 



Reduce the number of times we scan/skip the IPv6 exthdrs.

This patch contains a lot of API changes.  This is done, to avoid
repeating the scan of finding the IPv6 headers, via ipv6_find_hdr(),
which is called by ip_vs_fill_iph_skb().

Finding the IPv6 headers is done as early as possible, and passed on
as a pointer "struct ip_vs_iphdr *" to the affected functions.

This patch reduce/removes 19 calls to ip_vs_fill_iph_skb().

Notice, I have choosen, not to change the API of function
pointer "(*schedule)" (in struct ip_vs_scheduler) as it can be
used by external schedulers, via {un,}register_ip_vs_scheduler.
Only 4 out of 10 schedulers use info from ip_vs_iphdr*, and when
they do, they are only interested in iph->{s,d}addr.

Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
parent 2f74713d

include/net/ip_vs.h

+41 −40
Original line number Diff line number Diff line
@@ -487,27 +487,26 @@ struct ip_vs_protocol { 


	int (*conn_schedule)(int af, struct sk_buff *skb,

			     struct ip_vs_proto_data *pd,

			     int *verdict, struct ip_vs_conn **cpp);

			     int *verdict, struct ip_vs_conn **cpp,

			     struct ip_vs_iphdr *iph);



	struct ip_vs_conn *

	(*conn_in_get)(int af,

		       const struct sk_buff *skb,

		       const struct ip_vs_iphdr *iph,

		       unsigned int proto_off,

		       int inverse);



	struct ip_vs_conn *

	(*conn_out_get)(int af,

			const struct sk_buff *skb,

			const struct ip_vs_iphdr *iph,

			unsigned int proto_off,

			int inverse);



	int (*snat_handler)(struct sk_buff *skb,

			    struct ip_vs_protocol *pp, struct ip_vs_conn *cp);

	int (*snat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp,

			    struct ip_vs_conn *cp, struct ip_vs_iphdr *iph);



	int (*dnat_handler)(struct sk_buff *skb,

			    struct ip_vs_protocol *pp, struct ip_vs_conn *cp);

	int (*dnat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp,

			    struct ip_vs_conn *cp, struct ip_vs_iphdr *iph);



	int (*csum_check)(int af, struct sk_buff *skb,

			  struct ip_vs_protocol *pp);
@@ -607,7 +606,7 @@ struct ip_vs_conn { 
	   NF_ACCEPT can be returned when destination is local.

	 */

	int (*packet_xmit)(struct sk_buff *skb, struct ip_vs_conn *cp,

			   struct ip_vs_protocol *pp);

			   struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);



	/* Note: we can group the following members into a structure,

	   in order to save more space, and the following members are
@@ -858,13 +857,11 @@ struct ip_vs_app { 


	struct ip_vs_conn *

	(*conn_in_get)(const struct sk_buff *skb, struct ip_vs_app *app,

		       const struct iphdr *iph, unsigned int proto_off,

		       int inverse);

		       const struct iphdr *iph, int inverse);



	struct ip_vs_conn *

	(*conn_out_get)(const struct sk_buff *skb, struct ip_vs_app *app,

			const struct iphdr *iph, unsigned int proto_off,

			int inverse);

			const struct iphdr *iph, int inverse);



	int (*state_transition)(struct ip_vs_conn *cp, int direction,

				const struct sk_buff *skb,
@@ -1163,14 +1160,12 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p); 


struct ip_vs_conn * ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,

					    const struct ip_vs_iphdr *iph,

					    unsigned int proto_off,

					    int inverse);



struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p);



struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,

					     const struct ip_vs_iphdr *iph,

					     unsigned int proto_off,

					     int inverse);



/* put back the conn without restarting its timer */
@@ -1343,9 +1338,10 @@ extern struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name); 
extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);

extern struct ip_vs_conn *

ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,

	       struct ip_vs_proto_data *pd, int *ignored);

	       struct ip_vs_proto_data *pd, int *ignored,

	       struct ip_vs_iphdr *iph);

extern int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,

			struct ip_vs_proto_data *pd);

			struct ip_vs_proto_data *pd, struct ip_vs_iphdr *iph);



extern void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg);
@@ -1404,33 +1400,38 @@ extern void ip_vs_read_estimator(struct ip_vs_stats_user *dst, 
/*

 *	Various IPVS packet transmitters (from ip_vs_xmit.c)

 */

extern int ip_vs_null_xmit

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_bypass_xmit

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_nat_xmit

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_tunnel_xmit

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_dr_xmit

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_icmp_xmit

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,

 int offset, unsigned int hooknum);

extern int ip_vs_null_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,

			   struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);

extern int ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,

			     struct ip_vs_protocol *pp,

			     struct ip_vs_iphdr *iph);

extern int ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,

			  struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);

extern int ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,

			     struct ip_vs_protocol *pp,

			     struct ip_vs_iphdr *iph);

extern int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,

			 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);

extern int ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,

			   struct ip_vs_protocol *pp, int offset,

			   unsigned int hooknum, struct ip_vs_iphdr *iph);

extern void ip_vs_dst_reset(struct ip_vs_dest *dest);



#ifdef CONFIG_IP_VS_IPV6

extern int ip_vs_bypass_xmit_v6

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_nat_xmit_v6

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_tunnel_xmit_v6

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_dr_xmit_v6

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp);

extern int ip_vs_icmp_xmit_v6

(struct sk_buff *skb, struct ip_vs_conn *cp, struct ip_vs_protocol *pp,

 int offset, unsigned int hooknum);

extern int ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,

				struct ip_vs_protocol *pp,

				struct ip_vs_iphdr *iph);

extern int ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,

			     struct ip_vs_protocol *pp,

			     struct ip_vs_iphdr *iph);

extern int ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,

				struct ip_vs_protocol *pp,

				struct ip_vs_iphdr *iph);

extern int ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,

			    struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph);

extern int ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,

			      struct ip_vs_protocol *pp, int offset,

			      unsigned int hooknum, struct ip_vs_iphdr *iph);

#endif



#ifdef CONFIG_SYSCTL

net/netfilter/ipvs/ip_vs_conn.c

+6 −9
Original line number Diff line number Diff line
@@ -308,13 +308,12 @@ struct ip_vs_conn *ip_vs_conn_in_get(const struct ip_vs_conn_param *p) 
static int

ip_vs_conn_fill_param_proto(int af, const struct sk_buff *skb,

			    const struct ip_vs_iphdr *iph,

			    unsigned int proto_off, int inverse,

			    struct ip_vs_conn_param *p)

			    int inverse, struct ip_vs_conn_param *p)

{

	__be16 _ports[2], *pptr;

	struct net *net = skb_net(skb);



	pptr = frag_safe_skb_hp(skb, proto_off, sizeof(_ports), _ports, iph);

	pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports, iph);

	if (pptr == NULL)

		return 1;
@@ -329,12 +328,11 @@ ip_vs_conn_fill_param_proto(int af, const struct sk_buff *skb, 


struct ip_vs_conn *

ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,

			const struct ip_vs_iphdr *iph,

			unsigned int proto_off, int inverse)

			const struct ip_vs_iphdr *iph, int inverse)

{

	struct ip_vs_conn_param p;



	if (ip_vs_conn_fill_param_proto(af, skb, iph, proto_off, inverse, &p))

	if (ip_vs_conn_fill_param_proto(af, skb, iph, inverse, &p))

		return NULL;



	return ip_vs_conn_in_get(&p);
@@ -432,12 +430,11 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) 


struct ip_vs_conn *

ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,

			 const struct ip_vs_iphdr *iph,

			 unsigned int proto_off, int inverse)

			 const struct ip_vs_iphdr *iph, int inverse)

{

	struct ip_vs_conn_param p;



	if (ip_vs_conn_fill_param_proto(af, skb, iph, proto_off, inverse, &p))

	if (ip_vs_conn_fill_param_proto(af, skb, iph, inverse, &p))

		return NULL;



	return ip_vs_conn_out_get(&p);

net/netfilter/ipvs/ip_vs_core.c

+51 −65
Original line number Diff line number Diff line
@@ -222,11 +222,10 @@ ip_vs_conn_fill_param_persist(const struct ip_vs_service *svc, 
 */

static struct ip_vs_conn *

ip_vs_sched_persist(struct ip_vs_service *svc,

		    struct sk_buff *skb,

		    __be16 src_port, __be16 dst_port, int *ignored)

		    struct sk_buff *skb, __be16 src_port, __be16 dst_port,

		    int *ignored, struct ip_vs_iphdr *iph)

{

	struct ip_vs_conn *cp = NULL;

	struct ip_vs_iphdr iph;

	struct ip_vs_dest *dest;

	struct ip_vs_conn *ct;

	__be16 dport = 0;		/* destination port to forward */
@@ -236,20 +235,18 @@ ip_vs_sched_persist(struct ip_vs_service *svc, 
	union nf_inet_addr snet;	/* source network of the client,

					   after masking */



	ip_vs_fill_iph_skb(svc->af, skb, &iph);



	/* Mask saddr with the netmask to adjust template granularity */

#ifdef CONFIG_IP_VS_IPV6

	if (svc->af == AF_INET6)

		ipv6_addr_prefix(&snet.in6, &iph.saddr.in6, svc->netmask);

		ipv6_addr_prefix(&snet.in6, &iph->saddr.in6, svc->netmask);

	else

#endif

		snet.ip = iph.saddr.ip & svc->netmask;

		snet.ip = iph->saddr.ip & svc->netmask;



	IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "

		      "mnet %s\n",

		      IP_VS_DBG_ADDR(svc->af, &iph.saddr), ntohs(src_port),

		      IP_VS_DBG_ADDR(svc->af, &iph.daddr), ntohs(dst_port),

		      IP_VS_DBG_ADDR(svc->af, &iph->saddr), ntohs(src_port),

		      IP_VS_DBG_ADDR(svc->af, &iph->daddr), ntohs(dst_port),

		      IP_VS_DBG_ADDR(svc->af, &snet));



	/*
@@ -266,8 +263,8 @@ ip_vs_sched_persist(struct ip_vs_service *svc, 
	 * is created for other persistent services.

	 */

	{

		int protocol = iph.protocol;

		const union nf_inet_addr *vaddr = &iph.daddr;

		int protocol = iph->protocol;

		const union nf_inet_addr *vaddr = &iph->daddr;

		__be16 vport = 0;



		if (dst_port == svc->port) {
@@ -342,14 +339,14 @@ ip_vs_sched_persist(struct ip_vs_service *svc, 
		dport = dest->port;



	flags = (svc->flags & IP_VS_SVC_F_ONEPACKET

		 && iph.protocol == IPPROTO_UDP)?

		 && iph->protocol == IPPROTO_UDP) ?

		IP_VS_CONN_F_ONE_PACKET : 0;



	/*

	 *    Create a new connection according to the template

	 */

	ip_vs_conn_fill_param(svc->net, svc->af, iph.protocol, &iph.saddr,

			      src_port, &iph.daddr, dst_port, &param);

	ip_vs_conn_fill_param(svc->net, svc->af, iph->protocol, &iph->saddr,

			      src_port, &iph->daddr, dst_port, &param);



	cp = ip_vs_conn_new(&param, &dest->addr, dport, flags, dest, skb->mark);

	if (cp == NULL) {
@@ -392,22 +389,20 @@ ip_vs_sched_persist(struct ip_vs_service *svc, 
 */

struct ip_vs_conn *

ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,

	       struct ip_vs_proto_data *pd, int *ignored)

	       struct ip_vs_proto_data *pd, int *ignored,

	       struct ip_vs_iphdr *iph)

{

	struct ip_vs_protocol *pp = pd->pp;

	struct ip_vs_conn *cp = NULL;

	struct ip_vs_iphdr iph;

	struct ip_vs_dest *dest;

	__be16 _ports[2], *pptr;

	unsigned int flags;



	*ignored = 1;



	/*

	 * IPv6 frags, only the first hit here.

	 */

	ip_vs_fill_iph_skb(svc->af, skb, &iph);

	pptr = frag_safe_skb_hp(skb, iph.len, sizeof(_ports), _ports, &iph);

	pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports, iph);

	if (pptr == NULL)

		return NULL;
@@ -427,7 +422,7 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 
	 *    Do not schedule replies from local real server.

	 */

	if ((!skb->dev || skb->dev->flags & IFF_LOOPBACK) &&

	    (cp = pp->conn_in_get(svc->af, skb, &iph, iph.len, 1))) {

	    (cp = pp->conn_in_get(svc->af, skb, iph, 1))) {

		IP_VS_DBG_PKT(12, svc->af, pp, skb, 0,

			      "Not scheduling reply for existing connection");

		__ip_vs_conn_put(cp);
@@ -438,7 +433,8 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 
	 *    Persistent service

	 */

	if (svc->flags & IP_VS_SVC_F_PERSISTENT)

		return ip_vs_sched_persist(svc, skb, pptr[0], pptr[1], ignored);

		return ip_vs_sched_persist(svc, skb, pptr[0], pptr[1], ignored,

					   iph);



	*ignored = 0;
@@ -460,7 +456,7 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 
	}



	flags = (svc->flags & IP_VS_SVC_F_ONEPACKET

		 && iph.protocol == IPPROTO_UDP)?

		 && iph->protocol == IPPROTO_UDP) ?

		IP_VS_CONN_F_ONE_PACKET : 0;



	/*
@@ -469,9 +465,9 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 
	{

		struct ip_vs_conn_param p;



		ip_vs_conn_fill_param(svc->net, svc->af, iph.protocol,

				      &iph.saddr, pptr[0], &iph.daddr, pptr[1],

				      &p);

		ip_vs_conn_fill_param(svc->net, svc->af, iph->protocol,

				      &iph->saddr, pptr[0], &iph->daddr,

				      pptr[1], &p);

		cp = ip_vs_conn_new(&p, &dest->addr,

				    dest->port ? dest->port : pptr[1],

				    flags, dest, skb->mark);
@@ -500,18 +496,16 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 
 *  no destination is available for a new connection.

 */

int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,

		struct ip_vs_proto_data *pd)

		struct ip_vs_proto_data *pd, struct ip_vs_iphdr *iph)

{

	__be16 _ports[2], *pptr;

	struct ip_vs_iphdr iph;

#ifdef CONFIG_SYSCTL

	struct net *net;

	struct netns_ipvs *ipvs;

	int unicast;

#endif



	ip_vs_fill_iph_skb(svc->af, skb, &iph);

	pptr = frag_safe_skb_hp(skb, iph.len, sizeof(_ports), _ports, &iph);

	pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports, iph);

	if (pptr == NULL) {

		ip_vs_service_put(svc);

		return NF_DROP;
@@ -522,10 +516,10 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, 


#ifdef CONFIG_IP_VS_IPV6

	if (svc->af == AF_INET6)

		unicast = ipv6_addr_type(&iph.daddr.in6) & IPV6_ADDR_UNICAST;

		unicast = ipv6_addr_type(&iph->daddr.in6) & IPV6_ADDR_UNICAST;

	else

#endif

		unicast = (inet_addr_type(net, iph.daddr.ip) == RTN_UNICAST);

		unicast = (inet_addr_type(net, iph->daddr.ip) == RTN_UNICAST);



	/* if it is fwmark-based service, the cache_bypass sysctl is up

	   and the destination is a non-local unicast, then create
@@ -535,7 +529,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, 
		int ret;

		struct ip_vs_conn *cp;

		unsigned int flags = (svc->flags & IP_VS_SVC_F_ONEPACKET &&

				      iph.protocol == IPPROTO_UDP)?

				      iph->protocol == IPPROTO_UDP) ?

				      IP_VS_CONN_F_ONE_PACKET : 0;

		union nf_inet_addr daddr =  { .all = { 0, 0, 0, 0 } };
@@ -545,9 +539,9 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, 
		IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__);

		{

			struct ip_vs_conn_param p;

			ip_vs_conn_fill_param(svc->net, svc->af, iph.protocol,

					      &iph.saddr, pptr[0],

					      &iph.daddr, pptr[1], &p);

			ip_vs_conn_fill_param(svc->net, svc->af, iph->protocol,

					      &iph->saddr, pptr[0],

					      &iph->daddr, pptr[1], &p);

			cp = ip_vs_conn_new(&p, &daddr, 0,

					    IP_VS_CONN_F_BYPASS | flags,

					    NULL, skb->mark);
@@ -562,7 +556,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, 
		ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);



		/* transmit the first SYN packet */

		ret = cp->packet_xmit(skb, cp, pd->pp);

		ret = cp->packet_xmit(skb, cp, pd->pp, iph);

		/* do not touch skb anymore */



		atomic_inc(&cp->in_pkts);
@@ -908,7 +902,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related, 
	ip_vs_fill_ip4hdr(cih, &ciph);

	ciph.len += offset;

	/* The embedded headers contain source and dest in reverse order */

	cp = pp->conn_out_get(AF_INET, skb, &ciph, offset, 1);

	cp = pp->conn_out_get(AF_INET, skb, &ciph, 1);

	if (!cp)

		return NF_ACCEPT;
@@ -919,7 +913,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related, 


#ifdef CONFIG_IP_VS_IPV6

static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related,

			     unsigned int hooknum)

			     unsigned int hooknum, struct ip_vs_iphdr *ipvsh)

{

	struct icmp6hdr	_icmph, *ic;

	struct ipv6hdr _ip6h, *ip6h; /* The ip header contained within ICMP */
@@ -929,10 +923,6 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related, 
	union nf_inet_addr snet;

	unsigned int writable;



	struct ip_vs_iphdr ipvsh_stack;

	struct ip_vs_iphdr *ipvsh = &ipvsh_stack;

	ip_vs_fill_iph_skb(AF_INET6, skb, ipvsh);



	*related = 1;

	ic = frag_safe_skb_hp(skb, ipvsh->len, sizeof(_icmph), &_icmph, ipvsh);

	if (ic == NULL)
@@ -976,7 +966,7 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related, 
		return NF_ACCEPT;



	/* The embedded headers contain source and dest in reverse order */

	cp = pp->conn_out_get(AF_INET6, skb, &ciph, ciph.len, 1);

	cp = pp->conn_out_get(AF_INET6, skb, &ciph, 1);

	if (!cp)

		return NF_ACCEPT;
@@ -1016,17 +1006,17 @@ static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len) 
 */

static unsigned int

handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,

		struct ip_vs_conn *cp, int ihl)

		struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)

{

	struct ip_vs_protocol *pp = pd->pp;



	IP_VS_DBG_PKT(11, af, pp, skb, 0, "Outgoing packet");



	if (!skb_make_writable(skb, ihl))

	if (!skb_make_writable(skb, iph->len))

		goto drop;



	/* mangle the packet */

	if (pp->snat_handler && !pp->snat_handler(skb, pp, cp))

	if (pp->snat_handler && !pp->snat_handler(skb, pp, cp, iph))

		goto drop;



#ifdef CONFIG_IP_VS_IPV6
@@ -1125,7 +1115,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af) 
		if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {

			int related;

			int verdict = ip_vs_out_icmp_v6(skb, &related,

							hooknum);

							hooknum, &iph);



			if (related)

				return verdict;
@@ -1160,10 +1150,10 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af) 
	/*

	 * Check if the packet belongs to an existing entry

	 */

	cp = pp->conn_out_get(af, skb, &iph, iph.len, 0);

	cp = pp->conn_out_get(af, skb, &iph, 0);



	if (likely(cp))

		return handle_response(af, skb, pd, cp, iph.len);

		return handle_response(af, skb, pd, cp, &iph);

	if (sysctl_nat_icmp_send(net) &&

	    (pp->protocol == IPPROTO_TCP ||

	     pp->protocol == IPPROTO_UDP ||
@@ -1375,7 +1365,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) 
	/* The embedded headers contain source and dest in reverse order.

	 * For IPIP this is error for request, not for reply.

	 */

	cp = pp->conn_in_get(AF_INET, skb, &ciph, offset, ipip ? 0 : 1);

	cp = pp->conn_in_get(AF_INET, skb, &ciph, ipip ? 0 : 1);

	if (!cp)

		return NF_ACCEPT;
@@ -1444,7 +1434,7 @@ ignore_ipip: 
	ip_vs_in_stats(cp, skb);

	if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)

		offset += 2 * sizeof(__u16);

	verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum);

	verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum, &ciph);



out:

	__ip_vs_conn_put(cp);
@@ -1453,8 +1443,8 @@ out: 
}



#ifdef CONFIG_IP_VS_IPV6

static int

ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)

static int ip_vs_in_icmp_v6(struct sk_buff *skb, int *related,

			    unsigned int hooknum, struct ip_vs_iphdr *iph)

{

	struct net *net = NULL;

	struct ipv6hdr _ip6h, *ip6h;
@@ -1465,10 +1455,6 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum) 
	struct ip_vs_proto_data *pd;

	unsigned int offs_ciph, writable, verdict;



	struct ip_vs_iphdr iph_stack;

	struct ip_vs_iphdr *iph = &iph_stack;

	ip_vs_fill_iph_skb(AF_INET6, skb, iph);



	*related = 1;



	ic = frag_safe_skb_hp(skb, iph->len, sizeof(_icmph), &_icmph, iph);
@@ -1525,7 +1511,7 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum) 
	/* The embedded headers contain source and dest in reverse order

	 * if not from localhost

	 */

	cp = pp->conn_in_get(AF_INET6, skb, &ciph, ciph.len,

	cp = pp->conn_in_get(AF_INET6, skb, &ciph,

			     (hooknum == NF_INET_LOCAL_OUT) ? 0 : 1);



	if (!cp)
@@ -1546,7 +1532,7 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum) 
	    IPPROTO_SCTP == ciph.protocol)

		writable += 2 * sizeof(__u16); /* Also mangle ports */



	verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, writable, hooknum);

	verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, writable, hooknum, &ciph);



	__ip_vs_conn_put(cp);
@@ -1616,7 +1602,8 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) 
		}

		if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {

			int related;

			int verdict = ip_vs_in_icmp_v6(skb, &related, hooknum);

			int verdict = ip_vs_in_icmp_v6(skb, &related, hooknum,

						       &iph);



			if (related)

				return verdict;
@@ -1639,8 +1626,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) 
	/*

	 * Check if the packet belongs to an existing connection entry

	 */

	cp = pp->conn_in_get(af, skb, &iph, iph.len, 0);



	cp = pp->conn_in_get(af, skb, &iph, 0);

	if (unlikely(!cp) && !iph.fragoffs) {

		/* No (second) fragments need to enter here, as nf_defrag_ipv6

		 * replayed fragment zero will already have created the cp
@@ -1648,7 +1634,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) 
		int v;



		/* Schedule and create new connection entry into &cp */

		if (!pp->conn_schedule(af, skb, pd, &v, &cp))

		if (!pp->conn_schedule(af, skb, pd, &v, &cp, &iph))

			return v;

	}
@@ -1686,7 +1672,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) 
	ip_vs_in_stats(cp, skb);

	ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);

	if (cp->packet_xmit)

		ret = cp->packet_xmit(skb, cp, pp);

		ret = cp->packet_xmit(skb, cp, pp, &iph);

		/* do not touch skb anymore */

	else {

		IP_VS_DBG_RL("warning: packet_xmit is null");
@@ -1860,7 +1846,7 @@ ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb, 
	if (!net_ipvs(net)->enable)

		return NF_ACCEPT;



	return ip_vs_in_icmp_v6(skb, &r, hooknum);

	return ip_vs_in_icmp_v6(skb, &r, hooknum, &iphdr);

}

#endif

net/netfilter/ipvs/ip_vs_proto_ah_esp.c

+4 −5
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ ah_esp_conn_fill_param_proto(struct net *net, int af, 


static struct ip_vs_conn *

ah_esp_conn_in_get(int af, const struct sk_buff *skb,

		   const struct ip_vs_iphdr *iph, unsigned int proto_off,

		   const struct ip_vs_iphdr *iph,

		   int inverse)

{

	struct ip_vs_conn *cp;
@@ -85,9 +85,7 @@ ah_esp_conn_in_get(int af, const struct sk_buff *skb, 


static struct ip_vs_conn *

ah_esp_conn_out_get(int af, const struct sk_buff *skb,

		    const struct ip_vs_iphdr *iph,

		    unsigned int proto_off,

		    int inverse)

		    const struct ip_vs_iphdr *iph, int inverse)

{

	struct ip_vs_conn *cp;

	struct ip_vs_conn_param p;
@@ -110,7 +108,8 @@ ah_esp_conn_out_get(int af, const struct sk_buff *skb, 


static int

ah_esp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,

		     int *verdict, struct ip_vs_conn **cpp)

		     int *verdict, struct ip_vs_conn **cpp,

		     struct ip_vs_iphdr *iph)

{

	/*

	 * AH/ESP is only related traffic. Pass the packet to IP stack.

net/netfilter/ipvs/ip_vs_proto_sctp.c

+16 −26
Original line number Diff line number Diff line
@@ -10,28 +10,26 @@ 


static int

sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,

		   int *verdict, struct ip_vs_conn **cpp)

		   int *verdict, struct ip_vs_conn **cpp,

		   struct ip_vs_iphdr *iph)

{

	struct net *net;

	struct ip_vs_service *svc;

	sctp_chunkhdr_t _schunkh, *sch;

	sctp_sctphdr_t *sh, _sctph;

	struct ip_vs_iphdr iph;



	ip_vs_fill_iph_skb(af, skb, &iph);



	sh = skb_header_pointer(skb, iph.len, sizeof(_sctph), &_sctph);

	sh = skb_header_pointer(skb, iph->len, sizeof(_sctph), &_sctph);

	if (sh == NULL)

		return 0;



	sch = skb_header_pointer(skb, iph.len + sizeof(sctp_sctphdr_t),

	sch = skb_header_pointer(skb, iph->len + sizeof(sctp_sctphdr_t),

				 sizeof(_schunkh), &_schunkh);

	if (sch == NULL)

		return 0;

	net = skb_net(skb);

	if ((sch->type == SCTP_CID_INIT) &&

	    (svc = ip_vs_service_get(net, af, skb->mark, iph.protocol,

				     &iph.daddr, sh->dest))) {

	    (svc = ip_vs_service_get(net, af, skb->mark, iph->protocol,

				     &iph->daddr, sh->dest))) {

		int ignored;



		if (ip_vs_todrop(net_ipvs(net))) {
@@ -47,10 +45,10 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, 
		 * Let the virtual server select a real server for the

		 * incoming connection, and create a connection entry.

		 */

		*cpp = ip_vs_schedule(svc, skb, pd, &ignored);

		*cpp = ip_vs_schedule(svc, skb, pd, &ignored, iph);

		if (!*cpp && ignored <= 0) {

			if (!ignored)

				*verdict = ip_vs_leave(svc, skb, pd);

				*verdict = ip_vs_leave(svc, skb, pd, iph);

			else {

				ip_vs_service_put(svc);

				*verdict = NF_DROP;
@@ -64,20 +62,16 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, 
}



static int

sctp_snat_handler(struct sk_buff *skb,

		  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)

sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,

		  struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)

{

	sctp_sctphdr_t *sctph;

	unsigned int sctphoff;

	unsigned int sctphoff = iph->len;

	struct sk_buff *iter;

	__be32 crc32;



	struct ip_vs_iphdr iph;

	ip_vs_fill_iph_skb(cp->af, skb, &iph);

	sctphoff = iph.len;



#ifdef CONFIG_IP_VS_IPV6

	if (cp->af == AF_INET6 && iph.fragoffs)

	if (cp->af == AF_INET6 && iph->fragoffs)

		return 1;

#endif
@@ -110,20 +104,16 @@ sctp_snat_handler(struct sk_buff *skb, 
}



static int

sctp_dnat_handler(struct sk_buff *skb,

		  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)

sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,

		  struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)

{

	sctp_sctphdr_t *sctph;

	unsigned int sctphoff;

	unsigned int sctphoff = iph->len;

	struct sk_buff *iter;

	__be32 crc32;



	struct ip_vs_iphdr iph;

	ip_vs_fill_iph_skb(cp->af, skb, &iph);

	sctphoff = iph.len;



#ifdef CONFIG_IP_VS_IPV6

	if (cp->af == AF_INET6 && iph.fragoffs)

	if (cp->af == AF_INET6 && iph->fragoffs)

		return 1;

#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE