2 * ip_vs_nfct.c: Netfilter connection tracking support for IPVS
4 * Portions Copyright (C) 2001-2002
5 * Antefacto Ltd, 181 Parnell St, Dublin 1, Ireland.
7 * Portions Copyright (C) 2003-2010
11 * This code is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
27 * Ben North <ben@redfrontdoor.org>
28 * Julian Anastasov <ja@ssi.bg> Reorganize and sync with latest kernels
29 * Hannes Eder <heder@google.com> Extend NFCT support for FTP, ipvs match
34 * - provide conntrack confirmation for new and related connections, by
35 * this way we can see their proper conntrack state in all hooks
36 * - support for all forwarding methods, not only NAT
37 * - FTP support (NAT), ability to support other NAT apps with expectations
38 * - to correctly create expectations for related NAT connections the proper
39 * NF conntrack support must be already installed, eg. ip_vs_ftp requires
40 * nf_conntrack_ftp ... iptables_nat for the same ports (but no iptables
41 * NAT rules are needed)
42 * - alter reply for NAT when forwarding packet in original direction:
43 * conntrack from client in NEW or RELATED (Passive FTP DATA) state or
44 * when RELATED conntrack is created from real server (Active FTP DATA)
45 * - if iptables_nat is not loaded the Passive FTP will not work (the
46 * PASV response can not be NAT-ed) but Active FTP should work
50 #define KMSG_COMPONENT "IPVS"
51 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
53 #include <linux/module.h>
54 #include <linux/types.h>
55 #include <linux/kernel.h>
56 #include <linux/errno.h>
57 #include <linux/compiler.h>
58 #include <linux/vmalloc.h>
59 #include <linux/skbuff.h>
61 #include <linux/netfilter.h>
62 #include <linux/netfilter_ipv4.h>
63 #include <net/ip_vs.h>
64 #include <net/netfilter/nf_conntrack_core.h>
65 #include <net/netfilter/nf_conntrack_expect.h>
66 #include <net/netfilter/nf_conntrack_seqadj.h>
67 #include <net/netfilter/nf_conntrack_helper.h>
68 #include <net/netfilter/nf_conntrack_zones.h>
71 #define FMT_TUPLE "%pI4:%u->%pI4:%u/%u"
72 #define ARG_TUPLE(T) &(T)->src.u3.ip, ntohs((T)->src.u.all), \
73 &(T)->dst.u3.ip, ntohs((T)->dst.u.all), \
76 #define FMT_CONN "%pI4:%u->%pI4:%u->%pI4:%u/%u:%u"
77 #define ARG_CONN(C) &((C)->caddr.ip), ntohs((C)->cport), \
78 &((C)->vaddr.ip), ntohs((C)->vport), \
79 &((C)->daddr.ip), ntohs((C)->dport), \
80 (C)->protocol, (C)->state
83 ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin)
85 enum ip_conntrack_info ctinfo;
86 struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
87 struct nf_conntrack_tuple new_tuple;
89 if (ct == NULL || nf_ct_is_confirmed(ct) || nf_ct_is_untracked(ct) ||
93 /* Never alter conntrack for non-NAT conns */
94 if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
97 /* Alter reply only in original direction */
98 if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
101 /* Applications may adjust TCP seqs */
102 if (cp->app && nf_ct_protonum(ct) == IPPROTO_TCP &&
103 !nfct_seqadj(ct) && !nfct_seqadj_ext_add(ct))
107 * The connection is not yet in the hashtable, so we update it.
108 * CIP->VIP will remain the same, so leave the tuple in
109 * IP_CT_DIR_ORIGINAL untouched. When the reply comes back from the
110 * real-server we will see RIP->DIP.
112 new_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
114 * This will also take care of UDP and other protocols.
117 new_tuple.src.u3 = cp->daddr;
118 if (new_tuple.dst.protonum != IPPROTO_ICMP &&
119 new_tuple.dst.protonum != IPPROTO_ICMPV6)
120 new_tuple.src.u.tcp.port = cp->dport;
122 new_tuple.dst.u3 = cp->vaddr;
123 if (new_tuple.dst.protonum != IPPROTO_ICMP &&
124 new_tuple.dst.protonum != IPPROTO_ICMPV6)
125 new_tuple.dst.u.tcp.port = cp->vport;
127 IP_VS_DBG(7, "%s: Updating conntrack ct=%p, status=0x%lX, "
128 "ctinfo=%d, old reply=" FMT_TUPLE
129 ", new reply=" FMT_TUPLE ", cp=" FMT_CONN "\n",
130 __func__, ct, ct->status, ctinfo,
131 ARG_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple),
132 ARG_TUPLE(&new_tuple), ARG_CONN(cp));
133 nf_conntrack_alter_reply(ct, &new_tuple);
136 int ip_vs_confirm_conntrack(struct sk_buff *skb)
138 return nf_conntrack_confirm(skb);
142 * Called from init_conntrack() as expectfn handler.
144 static void ip_vs_nfct_expect_callback(struct nf_conn *ct,
145 struct nf_conntrack_expect *exp)
147 struct nf_conntrack_tuple *orig, new_reply;
148 struct ip_vs_conn *cp;
149 struct ip_vs_conn_param p;
150 struct net *net = nf_ct_net(ct);
152 if (exp->tuple.src.l3num != PF_INET)
156 * We assume that no NF locks are held before this callback.
157 * ip_vs_conn_out_get and ip_vs_conn_in_get should match their
158 * expectations even if they use wildcard values, now we provide the
159 * actual values from the newly created original conntrack direction.
160 * The conntrack is confirmed when packet reaches IPVS hooks.
164 orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
165 ip_vs_conn_fill_param(net, exp->tuple.src.l3num, orig->dst.protonum,
166 &orig->src.u3, orig->src.u.tcp.port,
167 &orig->dst.u3, orig->dst.u.tcp.port, &p);
168 cp = ip_vs_conn_out_get(&p);
170 /* Change reply CLIENT->RS to CLIENT->VS */
171 new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
172 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
173 FMT_TUPLE ", found inout cp=" FMT_CONN "\n",
174 __func__, ct, ct->status,
175 ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
177 new_reply.dst.u3 = cp->vaddr;
178 new_reply.dst.u.tcp.port = cp->vport;
179 IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE ", " FMT_TUPLE
180 ", inout cp=" FMT_CONN "\n",
182 ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
188 cp = ip_vs_conn_in_get(&p);
190 /* Change reply VS->CLIENT to RS->CLIENT */
191 new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
192 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
193 FMT_TUPLE ", found outin cp=" FMT_CONN "\n",
194 __func__, ct, ct->status,
195 ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
197 new_reply.src.u3 = cp->daddr;
198 new_reply.src.u.tcp.port = cp->dport;
199 IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE ", "
200 FMT_TUPLE ", outin cp=" FMT_CONN "\n",
202 ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
207 IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuple=" FMT_TUPLE
208 " - unknown expect\n",
209 __func__, ct, ct->status, ARG_TUPLE(orig));
213 /* Never alter conntrack for non-NAT conns */
214 if (IP_VS_FWD_METHOD(cp) == IP_VS_CONN_F_MASQ)
215 nf_conntrack_alter_reply(ct, &new_reply);
221 * Create NF conntrack expectation with wildcard (optional) source port.
222 * Then the default callback function will alter the reply and will confirm
223 * the conntrack entry when the first packet comes.
224 * Use port 0 to expect connection from any port.
226 void ip_vs_nfct_expect_related(struct sk_buff *skb, struct nf_conn *ct,
227 struct ip_vs_conn *cp, u_int8_t proto,
228 const __be16 port, int from_rs)
230 struct nf_conntrack_expect *exp;
232 if (ct == NULL || nf_ct_is_untracked(ct))
235 exp = nf_ct_expect_alloc(ct);
239 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
240 from_rs ? &cp->daddr : &cp->caddr,
241 from_rs ? &cp->caddr : &cp->vaddr,
242 proto, port ? &port : NULL,
243 from_rs ? &cp->cport : &cp->vport);
245 exp->expectfn = ip_vs_nfct_expect_callback;
247 IP_VS_DBG(7, "%s: ct=%p, expect tuple=" FMT_TUPLE "\n",
248 __func__, ct, ARG_TUPLE(&exp->tuple));
249 nf_ct_expect_related(exp);
250 nf_ct_expect_put(exp);
252 EXPORT_SYMBOL(ip_vs_nfct_expect_related);
255 * Our connection was terminated, try to drop the conntrack immediately
257 void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
259 struct nf_conntrack_tuple_hash *h;
261 struct nf_conntrack_tuple tuple;
266 tuple = (struct nf_conntrack_tuple) {
267 .dst = { .protonum = cp->protocol, .dir = IP_CT_DIR_ORIGINAL } };
268 tuple.src.u3 = cp->caddr;
269 tuple.src.u.all = cp->cport;
270 tuple.src.l3num = cp->af;
271 tuple.dst.u3 = cp->vaddr;
272 tuple.dst.u.all = cp->vport;
274 IP_VS_DBG(7, "%s: dropping conntrack with tuple=" FMT_TUPLE
275 " for conn " FMT_CONN "\n",
276 __func__, ARG_TUPLE(&tuple), ARG_CONN(cp));
278 h = nf_conntrack_find_get(ip_vs_conn_net(cp), NF_CT_DEFAULT_ZONE,
281 ct = nf_ct_tuplehash_to_ctrack(h);
282 /* Show what happens instead of calling nf_ct_kill() */
283 if (del_timer(&ct->timeout)) {
284 IP_VS_DBG(7, "%s: ct=%p, deleted conntrack timer for tuple="
286 __func__, ct, ARG_TUPLE(&tuple));
287 if (ct->timeout.function)
288 ct->timeout.function(ct->timeout.data);
290 IP_VS_DBG(7, "%s: ct=%p, no conntrack timer for tuple="
292 __func__, ct, ARG_TUPLE(&tuple));
296 IP_VS_DBG(7, "%s: no conntrack for tuple=" FMT_TUPLE "\n",
297 __func__, ARG_TUPLE(&tuple));