net/netfilter/ipvs/ip_vs_proto_udp.c

   1 /*
   2  * ip_vs_proto_udp.c:   UDP load balancing support for IPVS
   3  *
   4  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   5  *              Julian Anastasov <ja@ssi.bg>
   6  *
   7  *              This program is free software; you can redistribute it and/or
   8  *              modify it under the terms of the GNU General Public License
   9  *              as published by the Free Software Foundation; either version
  10  *              2 of the License, or (at your option) any later version.
  11  *
  12  * Changes:     Hans Schillstrom <hans.schillstrom@ericsson.com>
  13  *              Network name space (netns) aware.
  14  *
  15  */
  16
  17 #define KMSG_COMPONENT "IPVS"
  18 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  19
  20 #include <linux/in.h>
  21 #include <linux/ip.h>
  22 #include <linux/kernel.h>
  23 #include <linux/netfilter.h>
  24 #include <linux/netfilter_ipv4.h>
  25 #include <linux/udp.h>
  26
  27 #include <net/ip_vs.h>
  28 #include <net/ip.h>
  29 #include <net/ip6_checksum.h>
  30
  31 static int
  32 udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
  33                   struct ip_vs_proto_data *pd,
  34                   int *verdict, struct ip_vs_conn **cpp,
  35                   struct ip_vs_iphdr *iph)
  36 {
  37         struct ip_vs_service *svc;
  38         struct udphdr _udph, *uh;
  39         __be16 _ports[2], *ports = NULL;
  40
  41         if (likely(!ip_vs_iph_icmp(iph))) {
  42                 /* IPv6 fragments, only first fragment will hit this */
  43                 uh = skb_header_pointer(skb, iph->len, sizeof(_udph), &_udph);
  44                 if (uh)
  45                         ports = &uh->source;
  46         } else {
  47                 ports = skb_header_pointer(
  48                         skb, iph->len, sizeof(_ports), &_ports);
  49         }
  50
  51         if (!ports) {
  52                 *verdict = NF_DROP;
  53                 return 0;
  54         }
  55
  56         if (likely(!ip_vs_iph_inverse(iph)))
  57                 svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
  58                                          &iph->daddr, ports[1]);
  59         else
  60                 svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
  61                                          &iph->saddr, ports[0]);
  62
  63         if (svc) {
  64                 int ignored;
  65
  66                 if (ip_vs_todrop(ipvs)) {
  67                         /*
  68                          * It seems that we are very loaded.
  69                          * We have to drop this packet :(
  70                          */
  71                         *verdict = NF_DROP;
  72                         return 0;
  73                 }
  74
  75                 /*
  76                  * Let the virtual server select a real server for the
  77                  * incoming connection, and create a connection entry.
  78                  */
  79                 *cpp = ip_vs_schedule(svc, skb, pd, &ignored, iph);
  80                 if (!*cpp && ignored <= 0) {
  81                         if (!ignored)
  82                                 *verdict = ip_vs_leave(svc, skb, pd, iph);
  83                         else
  84                                 *verdict = NF_DROP;
  85                         return 0;
  86                 }
  87         }
  88         /* NF_ACCEPT */
  89         return 1;
  90 }
  91
  92
  93 static inline void
  94 udp_fast_csum_update(int af, struct udphdr *uhdr,
  95                      const union nf_inet_addr *oldip,
  96                      const union nf_inet_addr *newip,
  97                      __be16 oldport, __be16 newport)
  98 {
  99 #ifdef CONFIG_IP_VS_IPV6
 100         if (af == AF_INET6)
 101                 uhdr->check =
 102                         csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
 103                                          ip_vs_check_diff2(oldport, newport,
 104                                                 ~csum_unfold(uhdr->check))));
 105         else
 106 #endif
 107                 uhdr->check =
 108                         csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
 109                                          ip_vs_check_diff2(oldport, newport,
 110                                                 ~csum_unfold(uhdr->check))));
 111         if (!uhdr->check)
 112                 uhdr->check = CSUM_MANGLED_0;
 113 }
 114
 115 static inline void
 116 udp_partial_csum_update(int af, struct udphdr *uhdr,
 117                      const union nf_inet_addr *oldip,
 118                      const union nf_inet_addr *newip,
 119                      __be16 oldlen, __be16 newlen)
 120 {
 121 #ifdef CONFIG_IP_VS_IPV6
 122         if (af == AF_INET6)
 123                 uhdr->check =
 124                         ~csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
 125                                          ip_vs_check_diff2(oldlen, newlen,
 126                                                 csum_unfold(uhdr->check))));
 127         else
 128 #endif
 129         uhdr->check =
 130                 ~csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
 131                                 ip_vs_check_diff2(oldlen, newlen,
 132                                                 csum_unfold(uhdr->check))));
 133 }
 134
 135
 136 static int
 137 udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 138                  struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
 139 {
 140         struct udphdr *udph;
 141         unsigned int udphoff = iph->len;
 142         int oldlen;
 143         int payload_csum = 0;
 144
 145 #ifdef CONFIG_IP_VS_IPV6
 146         if (cp->af == AF_INET6 && iph->fragoffs)
 147                 return 1;
 148 #endif
 149         oldlen = skb->len - udphoff;
 150
 151         /* csum_check requires unshared skb */
 152         if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
 153                 return 0;
 154
 155         if (unlikely(cp->app != NULL)) {
 156                 int ret;
 157
 158                 /* Some checks before mangling */
 159                 if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
 160                         return 0;
 161
 162                 /*
 163                  *      Call application helper if needed
 164                  */
 165                 if (!(ret = ip_vs_app_pkt_out(cp, skb)))
 166                         return 0;
 167                 /* ret=2: csum update is needed after payload mangling */
 168                 if (ret == 1)
 169                         oldlen = skb->len - udphoff;
 170                 else
 171                         payload_csum = 1;
 172         }
 173
 174         udph = (void *)skb_network_header(skb) + udphoff;
 175         udph->source = cp->vport;
 176
 177         /*
 178          *      Adjust UDP checksums
 179          */
 180         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 181                 udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
 182                                         htons(oldlen),
 183                                         htons(skb->len - udphoff));
 184         } else if (!payload_csum && (udph->check != 0)) {
 185                 /* Only port and addr are changed, do fast csum update */
 186                 udp_fast_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
 187                                      cp->dport, cp->vport);
 188                 if (skb->ip_summed == CHECKSUM_COMPLETE)
 189                         skb->ip_summed = (cp->app && pp->csum_check) ?
 190                                          CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
 191         } else {
 192                 /* full checksum calculation */
 193                 udph->check = 0;
 194                 skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
 195 #ifdef CONFIG_IP_VS_IPV6
 196                 if (cp->af == AF_INET6)
 197                         udph->check = csum_ipv6_magic(&cp->vaddr.in6,
 198                                                       &cp->caddr.in6,
 199                                                       skb->len - udphoff,
 200                                                       cp->protocol, skb->csum);
 201                 else
 202 #endif
 203                         udph->check = csum_tcpudp_magic(cp->vaddr.ip,
 204                                                         cp->caddr.ip,
 205                                                         skb->len - udphoff,
 206                                                         cp->protocol,
 207                                                         skb->csum);
 208                 if (udph->check == 0)
 209                         udph->check = CSUM_MANGLED_0;
 210                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 211                 IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
 212                           pp->name, udph->check,
 213                           (char*)&(udph->check) - (char*)udph);
 214         }
 215         return 1;
 216 }
 217
 218
 219 static int
 220 udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 221                  struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
 222 {
 223         struct udphdr *udph;
 224         unsigned int udphoff = iph->len;
 225         int oldlen;
 226         int payload_csum = 0;
 227
 228 #ifdef CONFIG_IP_VS_IPV6
 229         if (cp->af == AF_INET6 && iph->fragoffs)
 230                 return 1;
 231 #endif
 232         oldlen = skb->len - udphoff;
 233
 234         /* csum_check requires unshared skb */
 235         if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
 236                 return 0;
 237
 238         if (unlikely(cp->app != NULL)) {
 239                 int ret;
 240
 241                 /* Some checks before mangling */
 242                 if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
 243                         return 0;
 244
 245                 /*
 246                  *      Attempt ip_vs_app call.
 247                  *      It will fix ip_vs_conn
 248                  */
 249                 if (!(ret = ip_vs_app_pkt_in(cp, skb)))
 250                         return 0;
 251                 /* ret=2: csum update is needed after payload mangling */
 252                 if (ret == 1)
 253                         oldlen = skb->len - udphoff;
 254                 else
 255                         payload_csum = 1;
 256         }
 257
 258         udph = (void *)skb_network_header(skb) + udphoff;
 259         udph->dest = cp->dport;
 260
 261         /*
 262          *      Adjust UDP checksums
 263          */
 264         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 265                 udp_partial_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
 266                                         htons(oldlen),
 267                                         htons(skb->len - udphoff));
 268         } else if (!payload_csum && (udph->check != 0)) {
 269                 /* Only port and addr are changed, do fast csum update */
 270                 udp_fast_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
 271                                      cp->vport, cp->dport);
 272                 if (skb->ip_summed == CHECKSUM_COMPLETE)
 273                         skb->ip_summed = (cp->app && pp->csum_check) ?
 274                                          CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
 275         } else {
 276                 /* full checksum calculation */
 277                 udph->check = 0;
 278                 skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
 279 #ifdef CONFIG_IP_VS_IPV6
 280                 if (cp->af == AF_INET6)
 281                         udph->check = csum_ipv6_magic(&cp->caddr.in6,
 282                                                       &cp->daddr.in6,
 283                                                       skb->len - udphoff,
 284                                                       cp->protocol, skb->csum);
 285                 else
 286 #endif
 287                         udph->check = csum_tcpudp_magic(cp->caddr.ip,
 288                                                         cp->daddr.ip,
 289                                                         skb->len - udphoff,
 290                                                         cp->protocol,
 291                                                         skb->csum);
 292                 if (udph->check == 0)
 293                         udph->check = CSUM_MANGLED_0;
 294                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 295         }
 296         return 1;
 297 }
 298
 299
 300 static int
 301 udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
 302 {
 303         struct udphdr _udph, *uh;
 304         unsigned int udphoff;
 305
 306 #ifdef CONFIG_IP_VS_IPV6
 307         if (af == AF_INET6)
 308                 udphoff = sizeof(struct ipv6hdr);
 309         else
 310 #endif
 311                 udphoff = ip_hdrlen(skb);
 312
 313         uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph);
 314         if (uh == NULL)
 315                 return 0;
 316
 317         if (uh->check != 0) {
 318                 switch (skb->ip_summed) {
 319                 case CHECKSUM_NONE:
 320                         skb->csum = skb_checksum(skb, udphoff,
 321                                                  skb->len - udphoff, 0);
 322                 case CHECKSUM_COMPLETE:
 323 #ifdef CONFIG_IP_VS_IPV6
 324                         if (af == AF_INET6) {
 325                                 if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
 326                                                     &ipv6_hdr(skb)->daddr,
 327                                                     skb->len - udphoff,
 328                                                     ipv6_hdr(skb)->nexthdr,
 329                                                     skb->csum)) {
 330                                         IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
 331                                                          "Failed checksum for");
 332                                         return 0;
 333                                 }
 334                         } else
 335 #endif
 336                                 if (csum_tcpudp_magic(ip_hdr(skb)->saddr,
 337                                                       ip_hdr(skb)->daddr,
 338                                                       skb->len - udphoff,
 339                                                       ip_hdr(skb)->protocol,
 340                                                       skb->csum)) {
 341                                         IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
 342                                                          "Failed checksum for");
 343                                         return 0;
 344                                 }
 345                         break;
 346                 default:
 347                         /* No need to checksum. */
 348                         break;
 349                 }
 350         }
 351         return 1;
 352 }
 353
 354 static inline __u16 udp_app_hashkey(__be16 port)
 355 {
 356         return (((__force u16)port >> UDP_APP_TAB_BITS) ^ (__force u16)port)
 357                 & UDP_APP_TAB_MASK;
 358 }
 359
 360
 361 static int udp_register_app(struct netns_ipvs *ipvs, struct ip_vs_app *inc)
 362 {
 363         struct ip_vs_app *i;
 364         __u16 hash;
 365         __be16 port = inc->port;
 366         int ret = 0;
 367         struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
 368
 369         hash = udp_app_hashkey(port);
 370
 371         list_for_each_entry(i, &ipvs->udp_apps[hash], p_list) {
 372                 if (i->port == port) {
 373                         ret = -EEXIST;
 374                         goto out;
 375                 }
 376         }
 377         list_add_rcu(&inc->p_list, &ipvs->udp_apps[hash]);
 378         atomic_inc(&pd->appcnt);
 379
 380   out:
 381         return ret;
 382 }
 383
 384
 385 static void
 386 udp_unregister_app(struct netns_ipvs *ipvs, struct ip_vs_app *inc)
 387 {
 388         struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
 389
 390         atomic_dec(&pd->appcnt);
 391         list_del_rcu(&inc->p_list);
 392 }
 393
 394
 395 static int udp_app_conn_bind(struct ip_vs_conn *cp)
 396 {
 397         struct netns_ipvs *ipvs = cp->ipvs;
 398         int hash;
 399         struct ip_vs_app *inc;
 400         int result = 0;
 401
 402         /* Default binding: bind app only for NAT */
 403         if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
 404                 return 0;
 405
 406         /* Lookup application incarnations and bind the right one */
 407         hash = udp_app_hashkey(cp->vport);
 408
 409         list_for_each_entry_rcu(inc, &ipvs->udp_apps[hash], p_list) {
 410                 if (inc->port == cp->vport) {
 411                         if (unlikely(!ip_vs_app_inc_get(inc)))
 412                                 break;
 413
 414                         IP_VS_DBG_BUF(9, "%s(): Binding conn %s:%u->"
 415                                       "%s:%u to app %s on port %u\n",
 416                                       __func__,
 417                                       IP_VS_DBG_ADDR(cp->af, &cp->caddr),
 418                                       ntohs(cp->cport),
 419                                       IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
 420                                       ntohs(cp->vport),
 421                                       inc->name, ntohs(inc->port));
 422
 423                         cp->app = inc;
 424                         if (inc->init_conn)
 425                                 result = inc->init_conn(inc, cp);
 426                         break;
 427                 }
 428         }
 429
 430         return result;
 431 }
 432
 433
 434 static const int udp_timeouts[IP_VS_UDP_S_LAST+1] = {
 435         [IP_VS_UDP_S_NORMAL]            =       5*60*HZ,
 436         [IP_VS_UDP_S_LAST]              =       2*HZ,
 437 };
 438
 439 static const char *const udp_state_name_table[IP_VS_UDP_S_LAST+1] = {
 440         [IP_VS_UDP_S_NORMAL]            =       "UDP",
 441         [IP_VS_UDP_S_LAST]              =       "BUG!",
 442 };
 443
 444 static const char * udp_state_name(int state)
 445 {
 446         if (state >= IP_VS_UDP_S_LAST)
 447                 return "ERR!";
 448         return udp_state_name_table[state] ? udp_state_name_table[state] : "?";
 449 }
 450
 451 static void
 452 udp_state_transition(struct ip_vs_conn *cp, int direction,
 453                      const struct sk_buff *skb,
 454                      struct ip_vs_proto_data *pd)
 455 {
 456         if (unlikely(!pd)) {
 457                 pr_err("UDP no ns data\n");
 458                 return;
 459         }
 460
 461         cp->timeout = pd->timeout_table[IP_VS_UDP_S_NORMAL];
 462 }
 463
 464 static int __udp_init(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd)
 465 {
 466         ip_vs_init_hash_table(ipvs->udp_apps, UDP_APP_TAB_SIZE);
 467         pd->timeout_table = ip_vs_create_timeout_table((int *)udp_timeouts,
 468                                                         sizeof(udp_timeouts));
 469         if (!pd->timeout_table)
 470                 return -ENOMEM;
 471         return 0;
 472 }
 473
 474 static void __udp_exit(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd)
 475 {
 476         kfree(pd->timeout_table);
 477 }
 478
 479
 480 struct ip_vs_protocol ip_vs_protocol_udp = {
 481         .name =                 "UDP",
 482         .protocol =             IPPROTO_UDP,
 483         .num_states =           IP_VS_UDP_S_LAST,
 484         .dont_defrag =          0,
 485         .init =                 NULL,
 486         .exit =                 NULL,
 487         .init_netns =           __udp_init,
 488         .exit_netns =           __udp_exit,
 489         .conn_schedule =        udp_conn_schedule,
 490         .conn_in_get =          ip_vs_conn_in_get_proto,
 491         .conn_out_get =         ip_vs_conn_out_get_proto,
 492         .snat_handler =         udp_snat_handler,
 493         .dnat_handler =         udp_dnat_handler,
 494         .csum_check =           udp_csum_check,
 495         .state_transition =     udp_state_transition,
 496         .state_name =           udp_state_name,
 497         .register_app =         udp_register_app,
 498         .unregister_app =       udp_unregister_app,
 499         .app_conn_bind =        udp_app_conn_bind,
 500         .debug_packet =         ip_vs_tcpudp_debug_packet,
 501         .timeout_change =       NULL,
 502 };