Doug / smarc-fsl-linux-kernel | Embedian Git Server

Commit 545b29019c8959c805abfe8194d47e989f1a6e5f

Authored by David S. Miller 2012-11-17 01:42:43 +0800

Exists in smarc-l5.0.0_1.0.0-ga and in 5 other branches

Merge branch 'master' of git://1984.lsi.us.es/nf-next

Conflicts:
	net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

Minor conflict due to some IS_ENABLED conversions done
in net-next.

Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 7 changed files Inline Diff

include/uapi/linux/in6.h
include/uapi/linux/netfilter_ipv6/ip6_tables.h
net/ipv4/netfilter/iptable_nat.c
net/ipv6/netfilter/ip6table_nat.c
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
net/netfilter/ipvs/ip_vs_nfct.c
net/netfilter/ipvs/ip_vs_xmit.c

include/uapi/linux/in6.h

Diff comments View file @ 545b290

 /*
  *	Types and definitions for AF_INET6
  *	Linux INET6 implementation
  *
  *	Authors:
  *	Pedro Roque		<roque@di.fc.ul.pt>
  *
  *	Sources:
  *	IPv6 Program Interfaces for BSD Systems
  *      <draft-ietf-ipngwg-bsd-api-05.txt>
  *
  *	Advanced Sockets API for IPv6
  *	<draft-stevens-advanced-api-00.txt>
  *
  *	This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
  *      2 of the License, or (at your option) any later version.
  */
 #ifndef _UAPI_LINUX_IN6_H
 #define _UAPI_LINUX_IN6_H
 #include <linux/types.h>
 /*
  *	IPv6 address structure
  */
 struct in6_addr {
 	union {
 		__u8		u6_addr8[16];
 		__be16		u6_addr16[8];
 		__be32		u6_addr32[4];
 	} in6_u;
 #define s6_addr			in6_u.u6_addr8
 #define s6_addr16		in6_u.u6_addr16
 #define s6_addr32		in6_u.u6_addr32
 };
 /* IPv6 Wildcard Address (::) and Loopback Address (::1) defined in RFC2553
  * NOTE: Be aware the IN6ADDR_* constants and in6addr_* externals are defined
  * in network byte order, not in host byte order as are the IPv4 equivalents
  */
 struct sockaddr_in6 {
 	unsigned short int	sin6_family;    /* AF_INET6 */
 	__be16			sin6_port;      /* Transport layer port # */
 	__be32			sin6_flowinfo;  /* IPv6 flow information */
 	struct in6_addr		sin6_addr;      /* IPv6 address */
 	__u32			sin6_scope_id;  /* scope id (new in RFC2553) */
 };
 struct ipv6_mreq {
 	/* IPv6 multicast address of group */
 	struct in6_addr ipv6mr_multiaddr;
 	/* local IPv6 address of interface */
 	int		ipv6mr_ifindex;
 };
 #define ipv6mr_acaddr	ipv6mr_multiaddr
 struct in6_flowlabel_req {
 	struct in6_addr	flr_dst;
 	__be32	flr_label;
 	__u8	flr_action;
 	__u8	flr_share;
 	__u16	flr_flags;
 	__u16 	flr_expires;
 	__u16	flr_linger;
 	__u32	__flr_pad;
 	/* Options in format of IPV6_PKTOPTIONS */
 };
 #define IPV6_FL_A_GET	0
 #define IPV6_FL_A_PUT	1
 #define IPV6_FL_A_RENEW	2
 #define IPV6_FL_F_CREATE	1
 #define IPV6_FL_F_EXCL		2
 #define IPV6_FL_S_NONE		0
 #define IPV6_FL_S_EXCL		1
 #define IPV6_FL_S_PROCESS	2
 #define IPV6_FL_S_USER		3
 #define IPV6_FL_S_ANY		255
 /*
  *	Bitmask constant declarations to help applications select out the
  *	flow label and priority fields.
  *
  *	Note that this are in host byte order while the flowinfo field of
  *	sockaddr_in6 is in network byte order.
  */
 #define IPV6_FLOWINFO_FLOWLABEL		0x000fffff
 #define IPV6_FLOWINFO_PRIORITY		0x0ff00000
 /* These definitions are obsolete */
 #define IPV6_PRIORITY_UNCHARACTERIZED	0x0000
 #define IPV6_PRIORITY_FILLER		0x0100
 #define IPV6_PRIORITY_UNATTENDED	0x0200
 #define IPV6_PRIORITY_RESERVED1		0x0300
 #define IPV6_PRIORITY_BULK		0x0400
 #define IPV6_PRIORITY_RESERVED2		0x0500
 #define IPV6_PRIORITY_INTERACTIVE	0x0600
 #define IPV6_PRIORITY_CONTROL		0x0700
 #define IPV6_PRIORITY_8			0x0800
 #define IPV6_PRIORITY_9			0x0900
 #define IPV6_PRIORITY_10		0x0a00
 #define IPV6_PRIORITY_11		0x0b00
 #define IPV6_PRIORITY_12		0x0c00
 #define IPV6_PRIORITY_13		0x0d00
 #define IPV6_PRIORITY_14		0x0e00
 #define IPV6_PRIORITY_15		0x0f00
 /*
  *	IPV6 extension headers
  */
 #define IPPROTO_HOPOPTS		0	/* IPv6 hop-by-hop options	*/
 #define IPPROTO_ROUTING		43	/* IPv6 routing header		*/
 #define IPPROTO_FRAGMENT	44	/* IPv6 fragmentation header	*/
 #define IPPROTO_ICMPV6		58	/* ICMPv6			*/
 #define IPPROTO_NONE		59	/* IPv6 no next header		*/
 #define IPPROTO_DSTOPTS		60	/* IPv6 destination options	*/
 #define IPPROTO_MH		135	/* IPv6 mobility header		*/
 /*
  *	IPv6 TLV options.
  */
 #define IPV6_TLV_PAD1		0
 #define IPV6_TLV_PADN		1
 #define IPV6_TLV_ROUTERALERT	5
 #define IPV6_TLV_JUMBO		194
 #define IPV6_TLV_HAO		201	/* home address option */
 /*
  *	IPV6 socket options
  */
 #define IPV6_ADDRFORM		1
 #define IPV6_2292PKTINFO	2
 #define IPV6_2292HOPOPTS	3
 #define IPV6_2292DSTOPTS	4
 #define IPV6_2292RTHDR		5
 #define IPV6_2292PKTOPTIONS	6
 #define IPV6_CHECKSUM		7
 #define IPV6_2292HOPLIMIT	8
 #define IPV6_NEXTHOP		9
 #define IPV6_AUTHHDR		10	/* obsolete */
 #define IPV6_FLOWINFO		11
 #define IPV6_UNICAST_HOPS	16
 #define IPV6_MULTICAST_IF	17
 #define IPV6_MULTICAST_HOPS	18
 #define IPV6_MULTICAST_LOOP	19
 #define IPV6_ADD_MEMBERSHIP	20
 #define IPV6_DROP_MEMBERSHIP	21
 #define IPV6_ROUTER_ALERT	22
 #define IPV6_MTU_DISCOVER	23
 #define IPV6_MTU		24
 #define IPV6_RECVERR		25
 #define IPV6_V6ONLY		26
 #define IPV6_JOIN_ANYCAST	27
 #define IPV6_LEAVE_ANYCAST	28
 /* IPV6_MTU_DISCOVER values */
 #define IPV6_PMTUDISC_DONT		0
 #define IPV6_PMTUDISC_WANT		1
 #define IPV6_PMTUDISC_DO		2
 #define IPV6_PMTUDISC_PROBE		3
 /* Flowlabel */
 #define IPV6_FLOWLABEL_MGR	32
 #define IPV6_FLOWINFO_SEND	33
 #define IPV6_IPSEC_POLICY	34
 #define IPV6_XFRM_POLICY	35
 /*
  * Multicast:
  * Following socket options are shared between IPv4 and IPv6.
  *
  * MCAST_JOIN_GROUP		42
  * MCAST_BLOCK_SOURCE		43
  * MCAST_UNBLOCK_SOURCE		44
  * MCAST_LEAVE_GROUP		45
  * MCAST_JOIN_SOURCE_GROUP	46
  * MCAST_LEAVE_SOURCE_GROUP	47
  * MCAST_MSFILTER		48
  */
 /*
  * Advanced API (RFC3542) (1)
  *
  * Note: IPV6_RECVRTHDRDSTOPTS does not exist. see net/ipv6/datagram.c.
  */
 #define IPV6_RECVPKTINFO	49
 #define IPV6_PKTINFO		50
 #define IPV6_RECVHOPLIMIT	51
 #define IPV6_HOPLIMIT		52
 #define IPV6_RECVHOPOPTS	53
 #define IPV6_HOPOPTS		54
 #define IPV6_RTHDRDSTOPTS	55
 #define IPV6_RECVRTHDR		56
 #define IPV6_RTHDR		57
 #define IPV6_RECVDSTOPTS	58
 #define IPV6_DSTOPTS		59
 #define IPV6_RECVPATHMTU	60
 #define IPV6_PATHMTU		61
 #define IPV6_DONTFRAG		62
 #if 0	/* not yet */
 #define IPV6_USE_MIN_MTU	63
 #endif
 /*
  * Netfilter (1)
  *
  * Following socket options are used in ip6_tables;
  * see include/linux/netfilter_ipv6/ip6_tables.h.
  *
  * IP6T_SO_SET_REPLACE / IP6T_SO_GET_INFO		64
  * IP6T_SO_SET_ADD_COUNTERS / IP6T_SO_GET_ENTRIES	65
  */
 /*
  * Advanced API (RFC3542) (2)
  */
 #define IPV6_RECVTCLASS		66
 #define IPV6_TCLASS		67
 /*
  * Netfilter (2)
  *
  * Following socket options are used in ip6_tables;
  * see include/linux/netfilter_ipv6/ip6_tables.h.
  *
  * IP6T_SO_GET_REVISION_MATCH	68
  * IP6T_SO_GET_REVISION_TARGET	69
+ * IP6T_SO_ORIGINAL_DST		80
  */
 /* RFC5014: Source address selection */
 #define IPV6_ADDR_PREFERENCES	72
 #define IPV6_PREFER_SRC_TMP		0x0001
 #define IPV6_PREFER_SRC_PUBLIC		0x0002
 #define IPV6_PREFER_SRC_PUBTMP_DEFAULT	0x0100
 #define IPV6_PREFER_SRC_COA		0x0004
 #define IPV6_PREFER_SRC_HOME		0x0400
 #define IPV6_PREFER_SRC_CGA		0x0008
 #define IPV6_PREFER_SRC_NONCGA		0x0800
 /* RFC5082: Generalized Ttl Security Mechanism */
 #define IPV6_MINHOPCOUNT		73
 #define IPV6_ORIGDSTADDR        74
 #define IPV6_RECVORIGDSTADDR    IPV6_ORIGDSTADDR
 #define IPV6_TRANSPARENT        75
 #define IPV6_UNICAST_IF         76
 /*
  * Multicast Routing:
  * see include/linux/mroute6.h.
  *
  * MRT6_INIT			200
  * MRT6_DONE			201
  * MRT6_ADD_MIF			202
  * MRT6_DEL_MIF			203
  * MRT6_ADD_MFC			204
  * MRT6_DEL_MFC			205
  * MRT6_VERSION			206
  * MRT6_ASSERT			207
  * MRT6_PIM			208
  * (reserved)			209
  */
 #endif /* _UAPI_LINUX_IN6_H */

include/uapi/linux/netfilter_ipv6/ip6_tables.h

Diff comments View file @ 545b290

 /*
  * 25-Jul-1998 Major changes to allow for ip chain table
  *
  * 3-Jan-2000 Named tables to allow packet selection for different uses.
  */
 /*
  * 	Format of an IP6 firewall descriptor
  *
  * 	src, dst, src_mask, dst_mask are always stored in network byte order.
  * 	flags are stored in host byte order (of course).
  * 	Port numbers are stored in HOST byte order.
  */
 #ifndef _UAPI_IP6_TABLES_H
 #define _UAPI_IP6_TABLES_H
 #include <linux/types.h>
 #include <linux/compiler.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter/x_tables.h>
 #ifndef __KERNEL__
 #define IP6T_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
 #define IP6T_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
 #define ip6t_match xt_match
 #define ip6t_target xt_target
 #define ip6t_table xt_table
 #define ip6t_get_revision xt_get_revision
 #define ip6t_entry_match xt_entry_match
 #define ip6t_entry_target xt_entry_target
 #define ip6t_standard_target xt_standard_target
 #define ip6t_error_target xt_error_target
 #define ip6t_counters xt_counters
 #define IP6T_CONTINUE XT_CONTINUE
 #define IP6T_RETURN XT_RETURN
 /* Pre-iptables-1.4.0 */
 #include <linux/netfilter/xt_tcpudp.h>
 #define ip6t_tcp xt_tcp
 #define ip6t_udp xt_udp
 #define IP6T_TCP_INV_SRCPT	XT_TCP_INV_SRCPT
 #define IP6T_TCP_INV_DSTPT	XT_TCP_INV_DSTPT
 #define IP6T_TCP_INV_FLAGS	XT_TCP_INV_FLAGS
 #define IP6T_TCP_INV_OPTION	XT_TCP_INV_OPTION
 #define IP6T_TCP_INV_MASK	XT_TCP_INV_MASK
 #define IP6T_UDP_INV_SRCPT	XT_UDP_INV_SRCPT
 #define IP6T_UDP_INV_DSTPT	XT_UDP_INV_DSTPT
 #define IP6T_UDP_INV_MASK	XT_UDP_INV_MASK
 #define ip6t_counters_info xt_counters_info
 #define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
 #define IP6T_ERROR_TARGET XT_ERROR_TARGET
 #define IP6T_MATCH_ITERATE(e, fn, args...) \
 	XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
 #define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
 	XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
 #endif
 /* Yes, Virginia, you have to zero the padding. */
 struct ip6t_ip6 {
 	/* Source and destination IP6 addr */
 	struct in6_addr src, dst;
 	/* Mask for src and dest IP6 addr */
 	struct in6_addr smsk, dmsk;
 	char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
 	unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
 	/* Upper protocol number
 	 * - The allowed value is 0 (any) or protocol number of last parsable
 	 *   header, which is 50 (ESP), 59 (No Next Header), 135 (MH), or
 	 *   the non IPv6 extension headers.
 	 * - The protocol numbers of IPv6 extension headers except of ESP and
 	 *   MH do not match any packets.
 	 * - You also need to set IP6T_FLAGS_PROTO to "flags" to check protocol.
 	 */
 	__u16 proto;
 	/* TOS to match iff flags & IP6T_F_TOS */
 	__u8 tos;
 	/* Flags word */
 	__u8 flags;
 	/* Inverse flags */
 	__u8 invflags;
 };
 /* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
 #define IP6T_F_PROTO		0x01	/* Set if rule cares about upper
 					   protocols */
 #define IP6T_F_TOS		0x02	/* Match the TOS. */
 #define IP6T_F_GOTO		0x04	/* Set if jump is a goto */
 #define IP6T_F_MASK		0x07	/* All possible flag bits mask. */
 /* Values for "inv" field in struct ip6t_ip6. */
 #define IP6T_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
 #define IP6T_INV_VIA_OUT		0x02	/* Invert the sense of OUT IFACE */
 #define IP6T_INV_TOS		0x04	/* Invert the sense of TOS. */
 #define IP6T_INV_SRCIP		0x08	/* Invert the sense of SRC IP. */
 #define IP6T_INV_DSTIP		0x10	/* Invert the sense of DST OP. */
 #define IP6T_INV_FRAG		0x20	/* Invert the sense of FRAG. */
 #define IP6T_INV_PROTO		XT_INV_PROTO
 #define IP6T_INV_MASK		0x7F	/* All possible flag bits mask. */
 /* This structure defines each of the firewall rules.  Consists of 3
    parts which are 1) general IP header stuff 2) match specific
    stuff 3) the target to perform if the rule matches */
 struct ip6t_entry {
 	struct ip6t_ip6 ipv6;
 	/* Mark with fields that we care about. */
 	unsigned int nfcache;
 	/* Size of ipt_entry + matches */
 	__u16 target_offset;
 	/* Size of ipt_entry + matches + target */
 	__u16 next_offset;
 	/* Back pointer */
 	unsigned int comefrom;
 	/* Packet and byte counters. */
 	struct xt_counters counters;
 	/* The matches (if any), then the target. */
 	unsigned char elems[0];
 };
 /* Standard entry */
 struct ip6t_standard {
 	struct ip6t_entry entry;
 	struct xt_standard_target target;
 };
 struct ip6t_error {
 	struct ip6t_entry entry;
 	struct xt_error_target target;
 };
 #define IP6T_ENTRY_INIT(__size)						       \
 {									       \
 	.target_offset	= sizeof(struct ip6t_entry),			       \
 	.next_offset	= (__size),					       \
 }
 #define IP6T_STANDARD_INIT(__verdict)					       \
 {									       \
 	.entry		= IP6T_ENTRY_INIT(sizeof(struct ip6t_standard)),       \
 	.target		= XT_TARGET_INIT(XT_STANDARD_TARGET,		       \
 					 sizeof(struct xt_standard_target)),   \
 	.target.verdict	= -(__verdict) - 1,				       \
 }
 #define IP6T_ERROR_INIT							       \
 {									       \
 	.entry		= IP6T_ENTRY_INIT(sizeof(struct ip6t_error)),	       \
 	.target		= XT_TARGET_INIT(XT_ERROR_TARGET,		       \
 					 sizeof(struct xt_error_target)),      \
 	.target.errorname = "ERROR",					       \
 }
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use
  * a raw socket for this. Instead we check rights in the calls.
  *
  * ATTENTION: check linux/in6.h before adding new number here.
  */
 #define IP6T_BASE_CTL			64
 #define IP6T_SO_SET_REPLACE		(IP6T_BASE_CTL)
 #define IP6T_SO_SET_ADD_COUNTERS	(IP6T_BASE_CTL + 1)
 #define IP6T_SO_SET_MAX			IP6T_SO_SET_ADD_COUNTERS
 #define IP6T_SO_GET_INFO		(IP6T_BASE_CTL)
 #define IP6T_SO_GET_ENTRIES		(IP6T_BASE_CTL + 1)
 #define IP6T_SO_GET_REVISION_MATCH	(IP6T_BASE_CTL + 4)
 #define IP6T_SO_GET_REVISION_TARGET	(IP6T_BASE_CTL + 5)
 #define IP6T_SO_GET_MAX			IP6T_SO_GET_REVISION_TARGET
+/* obtain original address if REDIRECT'd connection */
+#define IP6T_SO_ORIGINAL_DST            80
 /* ICMP matching stuff */
 struct ip6t_icmp {
 	__u8 type;				/* type to match */
 	__u8 code[2];				/* range of code */
 	__u8 invflags;				/* Inverse flags */
 };
 /* Values for "inv" field for struct ipt_icmp. */
 #define IP6T_ICMP_INV	0x01	/* Invert the sense of type/code test */
 /* The argument to IP6T_SO_GET_INFO */
 struct ip6t_getinfo {
 	/* Which table: caller fills this in. */
 	char name[XT_TABLE_MAXNAMELEN];
 	/* Kernel fills these in. */
 	/* Which hook entry points are valid: bitmask */
 	unsigned int valid_hooks;
 	/* Hook entry points: one per netfilter hook. */
 	unsigned int hook_entry[NF_INET_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_INET_NUMHOOKS];
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Size of entries. */
 	unsigned int size;
 };
 /* The argument to IP6T_SO_SET_REPLACE. */
 struct ip6t_replace {
 	/* Which table. */
 	char name[XT_TABLE_MAXNAMELEN];
 	/* Which hook entry points are valid: bitmask.  You can't
            change this. */
 	unsigned int valid_hooks;
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Total size of new entries */
 	unsigned int size;
 	/* Hook entry points. */
 	unsigned int hook_entry[NF_INET_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_INET_NUMHOOKS];
 	/* Information about old entries: */
 	/* Number of counters (must be equal to current number of entries). */
 	unsigned int num_counters;
 	/* The old entries' counters. */
 	struct xt_counters __user *counters;
 	/* The entries (hang off end: not really an array). */
 	struct ip6t_entry entries[0];
 };
 /* The argument to IP6T_SO_GET_ENTRIES. */
 struct ip6t_get_entries {
 	/* Which table: user fills this in. */
 	char name[XT_TABLE_MAXNAMELEN];
 	/* User fills this in: total entry size. */
 	unsigned int size;
 	/* The entries. */
 	struct ip6t_entry entrytable[0];
 };
 /* Helper functions */
 static __inline__ struct xt_entry_target *
 ip6t_get_target(struct ip6t_entry *e)
 {
 	return (void *)e + e->target_offset;
 }
 /*
  *	Main firewall chains definitions and global var's definitions.
  */
 #endif /* _UAPI_IP6_TABLES_H */

net/ipv4/netfilter/iptable_nat.c

Diff comments View file @ 545b290

 /* (C) 1999-2001 Paul `Rusty' Russell
  * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
  * (C) 2011 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/ip.h>
 #include <net/ip.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l3proto.h>
 static const struct xt_table nf_nat_ipv4_table = {
 	.name		= "nat",
 	.valid_hooks	= (1 << NF_INET_PRE_ROUTING) |
 			  (1 << NF_INET_POST_ROUTING) |
 			  (1 << NF_INET_LOCAL_OUT) |
 			  (1 << NF_INET_LOCAL_IN),
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV4,
 };
 static unsigned int alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 {
 	/* Force range to this IP; let proto decide mapping for
 	 * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
 	 */
 	struct nf_nat_range range;
 	range.flags = 0;
 	pr_debug("Allocating NULL binding for %p (%pI4)\n", ct,
 		 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
 		 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
 		 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
 	return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
 }
 static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
 				     const struct net_device *in,
 				     const struct net_device *out,
 				     struct nf_conn *ct)
 {
 	struct net *net = nf_ct_net(ct);
 	unsigned int ret;
 	ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
 	if (ret == NF_ACCEPT) {
 		if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
 			ret = alloc_null_binding(ct, hooknum);
 	}
 	return ret;
 }
 static unsigned int
 nf_nat_ipv4_fn(unsigned int hooknum,
 	       struct sk_buff *skb,
 	       const struct net_device *in,
 	       const struct net_device *out,
 	       int (*okfn)(struct sk_buff *))
 {
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn_nat *nat;
 	/* maniptype == SRC for postrouting. */
 	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
 	/* We never see fragments: conntrack defrags on pre-routing
 	 * and local-out, and nf_nat_out protects post-routing.
 	 */
 	NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
 	ct = nf_ct_get(skb, &ctinfo);
 	/* Can't track?  It's not due to stress, or conntrack would
 	 * have dropped it.  Hence it's the user's responsibilty to
 	 * packet filter it out, or implement conntrack/NAT for that
 	 * protocol. 8) --RR
 	 */
 	if (!ct)
 		return NF_ACCEPT;
 	/* Don't try to NAT if this packet is not conntracked */
 	if (nf_ct_is_untracked(ct))
 		return NF_ACCEPT;
 	nat = nfct_nat(ct);
 	if (!nat) {
 		/* NAT module was loaded late. */
 		if (nf_ct_is_confirmed(ct))
 			return NF_ACCEPT;
 		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
 		if (nat == NULL) {
 			pr_debug("failed to add NAT extension\n");
 			return NF_ACCEPT;
 		}
 	}
 	switch (ctinfo) {
 	case IP_CT_RELATED:
 	case IP_CT_RELATED_REPLY:
 		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
 			if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
 							   hooknum))
 				return NF_DROP;
 			else
 				return NF_ACCEPT;
 		}
 		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
 	case IP_CT_NEW:
 		/* Seen it before?  This can happen for loopback, retrans,
 		 * or local packets.
 		 */
 		if (!nf_nat_initialized(ct, maniptype)) {
 			unsigned int ret;
 			ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
 			if (ret != NF_ACCEPT)
 				return ret;
 		} else
 			pr_debug("Already setup manip %s for ct %p\n",
 				 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
 				 ct);
 		break;
 	default:
 		/* ESTABLISHED */
 		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
 			     ctinfo == IP_CT_ESTABLISHED_REPLY);
 	}
 	return nf_nat_packet(ct, ctinfo, hooknum, skb);
 }
 static unsigned int
 nf_nat_ipv4_in(unsigned int hooknum,
 	       struct sk_buff *skb,
 	       const struct net_device *in,
 	       const struct net_device *out,
 	       int (*okfn)(struct sk_buff *))
 {
 	unsigned int ret;
 	__be32 daddr = ip_hdr(skb)->daddr;
 	ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
 	if (ret != NF_DROP && ret != NF_STOLEN &&
 	    daddr != ip_hdr(skb)->daddr)
 		skb_dst_drop(skb);
 	return ret;
 }
 static unsigned int
 nf_nat_ipv4_out(unsigned int hooknum,
 		struct sk_buff *skb,
 		const struct net_device *in,
 		const struct net_device *out,
 		int (*okfn)(struct sk_buff *))
 {
 #ifdef CONFIG_XFRM
 	const struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 #endif
 	unsigned int ret;
 	/* root is playing with raw sockets. */
 	if (skb->len < sizeof(struct iphdr) ||
 	    ip_hdrlen(skb) < sizeof(struct iphdr))
 		return NF_ACCEPT;
 	ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
 #ifdef CONFIG_XFRM
 	if (ret != NF_DROP && ret != NF_STOLEN &&
 	    !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
 	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 		if ((ct->tuplehash[dir].tuple.src.u3.ip !=
 		     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
 		    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
 		     ct->tuplehash[dir].tuple.src.u.all !=
 		     ct->tuplehash[!dir].tuple.dst.u.all))
 			if (nf_xfrm_me_harder(skb, AF_INET) < 0)
 				ret = NF_DROP;
 	}
 #endif
 	return ret;
 }
 static unsigned int
 nf_nat_ipv4_local_fn(unsigned int hooknum,
 		     struct sk_buff *skb,
 		     const struct net_device *in,
 		     const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
 	const struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	unsigned int ret;
 	/* root is playing with raw sockets. */
 	if (skb->len < sizeof(struct iphdr) ||
 	    ip_hdrlen(skb) < sizeof(struct iphdr))
 		return NF_ACCEPT;
 	ret = nf_nat_ipv4_fn(hooknum, skb, in, out, okfn);
 	if (ret != NF_DROP && ret != NF_STOLEN &&
 	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 		if (ct->tuplehash[dir].tuple.dst.u3.ip !=
 		    ct->tuplehash[!dir].tuple.src.u3.ip) {
 			if (ip_route_me_harder(skb, RTN_UNSPEC))
 				ret = NF_DROP;
 		}
 #ifdef CONFIG_XFRM
 		else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
 			 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
 			 ct->tuplehash[dir].tuple.dst.u.all !=
 			 ct->tuplehash[!dir].tuple.src.u.all)
 			if (nf_xfrm_me_harder(skb, AF_INET) < 0)
 				ret = NF_DROP;
 #endif
 	}
 	return ret;
 }
 static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
 	/* Before packet filtering, change destination */
 	{
 		.hook		= nf_nat_ipv4_in,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},
 	/* After packet filtering, change source */
 	{
 		.hook		= nf_nat_ipv4_out,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP_PRI_NAT_SRC,
 	},
 	/* Before packet filtering, change destination */
 	{
 		.hook		= nf_nat_ipv4_local_fn,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},
 	/* After packet filtering, change source */
 	{
 		.hook		= nf_nat_ipv4_fn,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP_PRI_NAT_SRC,
 	},
 };
 static int __net_init iptable_nat_net_init(struct net *net)
 {
 	struct ipt_replace *repl;
 	repl = ipt_alloc_initial_table(&nf_nat_ipv4_table);
 	if (repl == NULL)
 		return -ENOMEM;
 	net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl);
 	kfree(repl);
-	if (IS_ERR(net->ipv4.nat_table))
+	return PTR_RET(net->ipv4.nat_table);
-		return PTR_ERR(net->ipv4.nat_table);
-	return 0;
 }
 static void __net_exit iptable_nat_net_exit(struct net *net)
 {
 	ipt_unregister_table(net, net->ipv4.nat_table);
 }
 static struct pernet_operations iptable_nat_net_ops = {
 	.init	= iptable_nat_net_init,
 	.exit	= iptable_nat_net_exit,
 };
 static int __init iptable_nat_init(void)
 {
 	int err;
 	err = register_pernet_subsys(&iptable_nat_net_ops);
 	if (err < 0)
 		goto err1;
 	err = nf_register_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));
 	if (err < 0)
 		goto err2;
 	return 0;
 err2:
 	unregister_pernet_subsys(&iptable_nat_net_ops);
 err1:
 	return err;
 }
 static void __exit iptable_nat_exit(void)
 {
 	nf_unregister_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));
 	unregister_pernet_subsys(&iptable_nat_net_ops);
 }
 module_init(iptable_nat_init);
 module_exit(iptable_nat_exit);
 MODULE_LICENSE("GPL");

net/ipv6/netfilter/ip6table_nat.c

Diff comments View file @ 545b290

 /*
  * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
  * Based on Rusty Russell's IPv4 NAT code. Development of IPv6 NAT
  * funded by Astaro.
  */
 #include <linux/module.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/ipv6.h>
 #include <net/ipv6.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l3proto.h>
 static const struct xt_table nf_nat_ipv6_table = {
 	.name		= "nat",
 	.valid_hooks	= (1 << NF_INET_PRE_ROUTING) |
 			  (1 << NF_INET_POST_ROUTING) |
 			  (1 << NF_INET_LOCAL_OUT) |
 			  (1 << NF_INET_LOCAL_IN),
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV6,
 };
 static unsigned int alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 {
 	/* Force range to this IP; let proto decide mapping for
 	 * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
 	 */
 	struct nf_nat_range range;
 	range.flags = 0;
 	pr_debug("Allocating NULL binding for %p (%pI6)\n", ct,
 		 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
 		 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip6 :
 		 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip6);
 	return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
 }
 static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
 				     const struct net_device *in,
 				     const struct net_device *out,
 				     struct nf_conn *ct)
 {
 	struct net *net = nf_ct_net(ct);
 	unsigned int ret;
 	ret = ip6t_do_table(skb, hooknum, in, out, net->ipv6.ip6table_nat);
 	if (ret == NF_ACCEPT) {
 		if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
 			ret = alloc_null_binding(ct, hooknum);
 	}
 	return ret;
 }
 static unsigned int
 nf_nat_ipv6_fn(unsigned int hooknum,
 	       struct sk_buff *skb,
 	       const struct net_device *in,
 	       const struct net_device *out,
 	       int (*okfn)(struct sk_buff *))
 {
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	struct nf_conn_nat *nat;
 	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
 	__be16 frag_off;
 	int hdrlen;
 	u8 nexthdr;
 	ct = nf_ct_get(skb, &ctinfo);
 	/* Can't track?  It's not due to stress, or conntrack would
 	 * have dropped it.  Hence it's the user's responsibilty to
 	 * packet filter it out, or implement conntrack/NAT for that
 	 * protocol. 8) --RR
 	 */
 	if (!ct)
 		return NF_ACCEPT;
 	/* Don't try to NAT if this packet is not conntracked */
 	if (nf_ct_is_untracked(ct))
 		return NF_ACCEPT;
 	nat = nfct_nat(ct);
 	if (!nat) {
 		/* NAT module was loaded late. */
 		if (nf_ct_is_confirmed(ct))
 			return NF_ACCEPT;
 		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
 		if (nat == NULL) {
 			pr_debug("failed to add NAT extension\n");
 			return NF_ACCEPT;
 		}
 	}
 	switch (ctinfo) {
 	case IP_CT_RELATED:
 	case IP_CT_RELATED_REPLY:
 		nexthdr = ipv6_hdr(skb)->nexthdr;
 		hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 					  &nexthdr, &frag_off);
 		if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
 			if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo,
 							     hooknum, hdrlen))
 				return NF_DROP;
 			else
 				return NF_ACCEPT;
 		}
 		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
 	case IP_CT_NEW:
 		/* Seen it before?  This can happen for loopback, retrans,
 		 * or local packets.
 		 */
 		if (!nf_nat_initialized(ct, maniptype)) {
 			unsigned int ret;
 			ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
 			if (ret != NF_ACCEPT)
 				return ret;
 		} else
 			pr_debug("Already setup manip %s for ct %p\n",
 				 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
 				 ct);
 		break;
 	default:
 		/* ESTABLISHED */
 		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
 			     ctinfo == IP_CT_ESTABLISHED_REPLY);
 	}
 	return nf_nat_packet(ct, ctinfo, hooknum, skb);
 }
 static unsigned int
 nf_nat_ipv6_in(unsigned int hooknum,
 	       struct sk_buff *skb,
 	       const struct net_device *in,
 	       const struct net_device *out,
 	       int (*okfn)(struct sk_buff *))
 {
 	unsigned int ret;
 	struct in6_addr daddr = ipv6_hdr(skb)->daddr;
 	ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
 	if (ret != NF_DROP && ret != NF_STOLEN &&
 	    ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr))
 		skb_dst_drop(skb);
 	return ret;
 }
 static unsigned int
 nf_nat_ipv6_out(unsigned int hooknum,
 		struct sk_buff *skb,
 		const struct net_device *in,
 		const struct net_device *out,
 		int (*okfn)(struct sk_buff *))
 {
 #ifdef CONFIG_XFRM
 	const struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 #endif
 	unsigned int ret;
 	/* root is playing with raw sockets. */
 	if (skb->len < sizeof(struct ipv6hdr))
 		return NF_ACCEPT;
 	ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
 #ifdef CONFIG_XFRM
 	if (ret != NF_DROP && ret != NF_STOLEN &&
 	    !(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
 	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
 				      &ct->tuplehash[!dir].tuple.dst.u3) ||
 		    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
 		     ct->tuplehash[dir].tuple.src.u.all !=
 		     ct->tuplehash[!dir].tuple.dst.u.all))
 			if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
 				ret = NF_DROP;
 	}
 #endif
 	return ret;
 }
 static unsigned int
 nf_nat_ipv6_local_fn(unsigned int hooknum,
 		     struct sk_buff *skb,
 		     const struct net_device *in,
 		     const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
 	const struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	unsigned int ret;
 	/* root is playing with raw sockets. */
 	if (skb->len < sizeof(struct ipv6hdr))
 		return NF_ACCEPT;
 	ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
 	if (ret != NF_DROP && ret != NF_STOLEN &&
 	    (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
 		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 		if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
 				      &ct->tuplehash[!dir].tuple.src.u3)) {
 			if (ip6_route_me_harder(skb))
 				ret = NF_DROP;
 		}
 #ifdef CONFIG_XFRM
 		else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
 			 ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
 			 ct->tuplehash[dir].tuple.dst.u.all !=
 			 ct->tuplehash[!dir].tuple.src.u.all)
 			if (nf_xfrm_me_harder(skb, AF_INET6))
 				ret = NF_DROP;
 #endif
 	}
 	return ret;
 }
 static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
 	/* Before packet filtering, change destination */
 	{
 		.hook		= nf_nat_ipv6_in,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP6_PRI_NAT_DST,
 	},
 	/* After packet filtering, change source */
 	{
 		.hook		= nf_nat_ipv6_out,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP6_PRI_NAT_SRC,
 	},
 	/* Before packet filtering, change destination */
 	{
 		.hook		= nf_nat_ipv6_local_fn,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP6_PRI_NAT_DST,
 	},
 	/* After packet filtering, change source */
 	{
 		.hook		= nf_nat_ipv6_fn,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP6_PRI_NAT_SRC,
 	},
 };
 static int __net_init ip6table_nat_net_init(struct net *net)
 {
 	struct ip6t_replace *repl;
 	repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
 	if (repl == NULL)
 		return -ENOMEM;
 	net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
 	kfree(repl);
-	if (IS_ERR(net->ipv6.ip6table_nat))
+	return PTR_RET(net->ipv6.ip6table_nat);
-		return PTR_ERR(net->ipv6.ip6table_nat);
-	return 0;
 }
 static void __net_exit ip6table_nat_net_exit(struct net *net)
 {
 	ip6t_unregister_table(net, net->ipv6.ip6table_nat);
 }
 static struct pernet_operations ip6table_nat_net_ops = {
 	.init	= ip6table_nat_net_init,
 	.exit	= ip6table_nat_net_exit,
 };
 static int __init ip6table_nat_init(void)
 {
 	int err;
 	err = register_pernet_subsys(&ip6table_nat_net_ops);
 	if (err < 0)
 		goto err1;
 	err = nf_register_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
 	if (err < 0)
 		goto err2;
 	return 0;
 err2:
 	unregister_pernet_subsys(&ip6table_nat_net_ops);
 err1:
 	return err;
 }
 static void __exit ip6table_nat_exit(void)
 {
 	nf_unregister_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
 	unregister_pernet_subsys(&ip6table_nat_net_ops);
 }
 module_init(ip6table_nat_init);
 module_exit(ip6table_nat_exit);
 MODULE_LICENSE("GPL");

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

Diff comments View file @ 545b290

 /*
  * Copyright (C)2004 USAGI/WIDE Project
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
  * Author:
  *	Yasuyuki Kozakai @USAGI <yasuyuki.kozakai@toshiba.co.jp>
  */
 #include <linux/types.h>
 #include <linux/ipv6.h>
 #include <linux/in6.h>
 #include <linux/netfilter.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/icmp.h>
 #include <net/ipv6.h>
 #include <net/inet_frag.h>
 #include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #include <net/netfilter/nf_log.h>
 static bool ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
 			      struct nf_conntrack_tuple *tuple)
 {
 	const u_int32_t *ap;
 	u_int32_t _addrs[8];
 	ap = skb_header_pointer(skb, nhoff + offsetof(struct ipv6hdr, saddr),
 				sizeof(_addrs), _addrs);
 	if (ap == NULL)
 		return false;
 	memcpy(tuple->src.u3.ip6, ap, sizeof(tuple->src.u3.ip6));
 	memcpy(tuple->dst.u3.ip6, ap + 4, sizeof(tuple->dst.u3.ip6));
 	return true;
 }
 static bool ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
 			      const struct nf_conntrack_tuple *orig)
 {
 	memcpy(tuple->src.u3.ip6, orig->dst.u3.ip6, sizeof(tuple->src.u3.ip6));
 	memcpy(tuple->dst.u3.ip6, orig->src.u3.ip6, sizeof(tuple->dst.u3.ip6));
 	return true;
 }
 static int ipv6_print_tuple(struct seq_file *s,
 			    const struct nf_conntrack_tuple *tuple)
 {
 	return seq_printf(s, "src=%pI6 dst=%pI6 ",
 			  tuple->src.u3.ip6, tuple->dst.u3.ip6);
 }
 static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
 			    unsigned int *dataoff, u_int8_t *protonum)
 {
 	unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
 	__be16 frag_off;
 	int protoff;
 	u8 nexthdr;
 	if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
 			  &nexthdr, sizeof(nexthdr)) != 0) {
 		pr_debug("ip6_conntrack_core: can't get nexthdr\n");
 		return -NF_ACCEPT;
 	}
 	protoff = ipv6_skip_exthdr(skb, extoff, &nexthdr, &frag_off);
 	/*
 	 * (protoff == skb->len) mean that the packet doesn't have no data
 	 * except of IPv6 & ext headers. but it's tracked anyway. - YK
 	 */
 	if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
 		pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
 		return -NF_ACCEPT;
 	}
 	*dataoff = protoff;
 	*protonum = nexthdr;
 	return NF_ACCEPT;
 }
 static unsigned int ipv6_helper(unsigned int hooknum,
 				struct sk_buff *skb,
 				const struct net_device *in,
 				const struct net_device *out,
 				int (*okfn)(struct sk_buff *))
 {
 	struct nf_conn *ct;
 	const struct nf_conn_help *help;
 	const struct nf_conntrack_helper *helper;
 	enum ip_conntrack_info ctinfo;
 	unsigned int ret;
 	__be16 frag_off;
 	int protoff;
 	u8 nexthdr;
 	/* This is where we call the helper: as the packet goes out. */
 	ct = nf_ct_get(skb, &ctinfo);
 	if (!ct || ctinfo == IP_CT_RELATED_REPLY)
 		return NF_ACCEPT;
 	help = nfct_help(ct);
 	if (!help)
 		return NF_ACCEPT;
 	/* rcu_read_lock()ed by nf_hook_slow */
 	helper = rcu_dereference(help->helper);
 	if (!helper)
 		return NF_ACCEPT;
 	nexthdr = ipv6_hdr(skb)->nexthdr;
 	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
 				   &frag_off);
 	if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
 		pr_debug("proto header not found\n");
 		return NF_ACCEPT;
 	}
 	ret = helper->help(skb, protoff, ct, ctinfo);
 	if (ret != NF_ACCEPT && (ret & NF_VERDICT_MASK) != NF_QUEUE) {
 		nf_log_packet(NFPROTO_IPV6, hooknum, skb, in, out, NULL,
 			      "nf_ct_%s: dropping packet", helper->name);
 	}
 	return ret;
 }
 static unsigned int ipv6_confirm(unsigned int hooknum,
 				 struct sk_buff *skb,
 				 const struct net_device *in,
 				 const struct net_device *out,
 				 int (*okfn)(struct sk_buff *))
 {
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	unsigned char pnum = ipv6_hdr(skb)->nexthdr;
 	int protoff;
 	__be16 frag_off;
 	ct = nf_ct_get(skb, &ctinfo);
 	if (!ct || ctinfo == IP_CT_RELATED_REPLY)
 		goto out;
 	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
 				   &frag_off);
 	if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
 		pr_debug("proto header not found\n");
 		goto out;
 	}
 	/* adjust seqs for loopback traffic only in outgoing direction */
 	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
 	    !nf_is_loopback_packet(skb)) {
 		typeof(nf_nat_seq_adjust_hook) seq_adjust;
 		seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
 		if (!seq_adjust ||
 		    !seq_adjust(skb, ct, ctinfo, protoff)) {
 			NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
 			return NF_DROP;
 		}
 	}
 out:
 	/* We've seen it coming out the other side: confirm it */
 	return nf_conntrack_confirm(skb);
 }
 static unsigned int __ipv6_conntrack_in(struct net *net,
 					unsigned int hooknum,
 					struct sk_buff *skb,
 					const struct net_device *in,
 					const struct net_device *out,
 					int (*okfn)(struct sk_buff *))
 {
 	struct sk_buff *reasm = skb->nfct_reasm;
 	const struct nf_conn_help *help;
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	/* This packet is fragmented and has reassembled packet. */
 	if (reasm) {
 		/* Reassembled packet isn't parsed yet ? */
 		if (!reasm->nfct) {
 			unsigned int ret;
 			ret = nf_conntrack_in(net, PF_INET6, hooknum, reasm);
 			if (ret != NF_ACCEPT)
 				return ret;
 		}
 		/* Conntrack helpers need the entire reassembled packet in the
 		 * POST_ROUTING hook. In case of unconfirmed connections NAT
 		 * might reassign a helper, so the entire packet is also
 		 * required.
 		 */
 		ct = nf_ct_get(reasm, &ctinfo);
 		if (ct != NULL && !nf_ct_is_untracked(ct)) {
 			help = nfct_help(ct);
 			if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {
 				nf_conntrack_get_reasm(skb);
 				NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,
 					       (struct net_device *)in,
 					       (struct net_device *)out,
 					       okfn, NF_IP6_PRI_CONNTRACK + 1);
 				return NF_DROP_ERR(-ECANCELED);
 			}
 		}
 		nf_conntrack_get(reasm->nfct);
 		skb->nfct = reasm->nfct;
 		skb->nfctinfo = reasm->nfctinfo;
 		return NF_ACCEPT;
 	}
 	return nf_conntrack_in(net, PF_INET6, hooknum, skb);
 }
 static unsigned int ipv6_conntrack_in(unsigned int hooknum,
 				      struct sk_buff *skb,
 				      const struct net_device *in,
 				      const struct net_device *out,
 				      int (*okfn)(struct sk_buff *))
 {
 	return __ipv6_conntrack_in(dev_net(in), hooknum, skb, in, out, okfn);
 }
 static unsigned int ipv6_conntrack_local(unsigned int hooknum,
 					 struct sk_buff *skb,
 					 const struct net_device *in,
 					 const struct net_device *out,
 					 int (*okfn)(struct sk_buff *))
 {
 	/* root is playing with raw sockets. */
 	if (skb->len < sizeof(struct ipv6hdr)) {
 		net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
 		return NF_ACCEPT;
 	}
 	return __ipv6_conntrack_in(dev_net(out), hooknum, skb, in, out, okfn);
 }
 static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
 	{
 		.hook		= ipv6_conntrack_in,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP6_PRI_CONNTRACK,
 	},
 	{
 		.hook		= ipv6_conntrack_local,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP6_PRI_CONNTRACK,
 	},
 	{
 		.hook		= ipv6_helper,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP6_PRI_CONNTRACK_HELPER,
 	},
 	{
 		.hook		= ipv6_confirm,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP6_PRI_LAST,
 	},
 	{
 		.hook		= ipv6_helper,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP6_PRI_CONNTRACK_HELPER,
 	},
 	{
 		.hook		= ipv6_confirm,
 		.owner		= THIS_MODULE,
 		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP6_PRI_LAST-1,
 	},
 };
+static int
+ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
+{
+	const struct inet_sock *inet = inet_sk(sk);
+	const struct ipv6_pinfo *inet6 = inet6_sk(sk);
+	const struct nf_conntrack_tuple_hash *h;
+	struct sockaddr_in6 sin6;
+	struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
+	struct nf_conn *ct;
+	tuple.src.u3.in6 = inet6->rcv_saddr;
+	tuple.src.u.tcp.port = inet->inet_sport;
+	tuple.dst.u3.in6 = inet6->daddr;
+	tuple.dst.u.tcp.port = inet->inet_dport;
+	tuple.dst.protonum = sk->sk_protocol;
+	if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP)
+		return -ENOPROTOOPT;
+	if (*len < 0 || (unsigned int) *len < sizeof(sin6))
+		return -EINVAL;
+	h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
+	if (!h) {
+		pr_debug("IP6T_SO_ORIGINAL_DST: Can't find %pI6c/%u-%pI6c/%u.\n",
+			 &tuple.src.u3.ip6, ntohs(tuple.src.u.tcp.port),
+			 &tuple.dst.u3.ip6, ntohs(tuple.dst.u.tcp.port));
+		return -ENOENT;
+	}
+	ct = nf_ct_tuplehash_to_ctrack(h);
+	sin6.sin6_family = AF_INET6;
+	sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
+	sin6.sin6_flowinfo = inet6->flow_label & IPV6_FLOWINFO_MASK;
+	memcpy(&sin6.sin6_addr,
+		&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
+					sizeof(sin6.sin6_addr));
+	nf_ct_put(ct);
+	if (ipv6_addr_type(&sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
+		sin6.sin6_scope_id = sk->sk_bound_dev_if;
+	else
+		sin6.sin6_scope_id = 0;
+	return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
+}
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 static int ipv6_tuple_to_nlattr(struct sk_buff *skb,
 				const struct nf_conntrack_tuple *tuple)
 {
 	if (nla_put(skb, CTA_IP_V6_SRC, sizeof(u_int32_t) * 4,
 		    &tuple->src.u3.ip6) ||
 	    nla_put(skb, CTA_IP_V6_DST, sizeof(u_int32_t) * 4,
 		    &tuple->dst.u3.ip6))
 		goto nla_put_failure;
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static const struct nla_policy ipv6_nla_policy[CTA_IP_MAX+1] = {
 	[CTA_IP_V6_SRC]	= { .len = sizeof(u_int32_t)*4 },
 	[CTA_IP_V6_DST]	= { .len = sizeof(u_int32_t)*4 },
 };
 static int ipv6_nlattr_to_tuple(struct nlattr *tb[],
 				struct nf_conntrack_tuple *t)
 {
 	if (!tb[CTA_IP_V6_SRC] || !tb[CTA_IP_V6_DST])
 		return -EINVAL;
 	memcpy(&t->src.u3.ip6, nla_data(tb[CTA_IP_V6_SRC]),
 	       sizeof(u_int32_t) * 4);
 	memcpy(&t->dst.u3.ip6, nla_data(tb[CTA_IP_V6_DST]),
 	       sizeof(u_int32_t) * 4);
 	return 0;
 }
 static int ipv6_nlattr_tuple_size(void)
 {
 	return nla_policy_len(ipv6_nla_policy, CTA_IP_MAX + 1);
 }
 #endif
 struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
 	.l3proto		= PF_INET6,
 	.name			= "ipv6",
 	.pkt_to_tuple		= ipv6_pkt_to_tuple,
 	.invert_tuple		= ipv6_invert_tuple,
 	.print_tuple		= ipv6_print_tuple,
 	.get_l4proto		= ipv6_get_l4proto,
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 	.tuple_to_nlattr	= ipv6_tuple_to_nlattr,
 	.nlattr_tuple_size	= ipv6_nlattr_tuple_size,
 	.nlattr_to_tuple	= ipv6_nlattr_to_tuple,
 	.nla_policy		= ipv6_nla_policy,
 #endif
 	.me			= THIS_MODULE,
 };
 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
+static struct nf_sockopt_ops so_getorigdst6 = {
+	.pf		= NFPROTO_IPV6,
+	.get_optmin	= IP6T_SO_ORIGINAL_DST,
+	.get_optmax	= IP6T_SO_ORIGINAL_DST + 1,
+	.get		= ipv6_getorigdst,
+	.owner		= THIS_MODULE,
+};
 static int ipv6_net_init(struct net *net)
 {
 	int ret = 0;
 	ret = nf_conntrack_l4proto_register(net,
 					    &nf_conntrack_l4proto_tcp6);
 	if (ret < 0) {
 		printk(KERN_ERR "nf_conntrack_l4proto_tcp6: protocol register failed\n");
 		goto out;
 	}
 	ret = nf_conntrack_l4proto_register(net,
 					    &nf_conntrack_l4proto_udp6);
 	if (ret < 0) {
 		printk(KERN_ERR "nf_conntrack_l4proto_udp6: protocol register failed\n");
 		goto cleanup_tcp6;
 	}
 	ret = nf_conntrack_l4proto_register(net,
 					    &nf_conntrack_l4proto_icmpv6);
 	if (ret < 0) {
 		printk(KERN_ERR "nf_conntrack_l4proto_icmp6: protocol register failed\n");
 		goto cleanup_udp6;
 	}
 	ret = nf_conntrack_l3proto_register(net,
 					    &nf_conntrack_l3proto_ipv6);
 	if (ret < 0) {
 		printk(KERN_ERR "nf_conntrack_l3proto_ipv6: protocol register failed\n");
 		goto cleanup_icmpv6;
 	}
 	return 0;
  cleanup_icmpv6:
 	nf_conntrack_l4proto_unregister(net,
 					&nf_conntrack_l4proto_icmpv6);
  cleanup_udp6:
 	nf_conntrack_l4proto_unregister(net,
 					&nf_conntrack_l4proto_udp6);
  cleanup_tcp6:
 	nf_conntrack_l4proto_unregister(net,
 					&nf_conntrack_l4proto_tcp6);
  out:
 	return ret;
 }
 static void ipv6_net_exit(struct net *net)
 {
 	nf_conntrack_l3proto_unregister(net,
 					&nf_conntrack_l3proto_ipv6);
 	nf_conntrack_l4proto_unregister(net,
 					&nf_conntrack_l4proto_icmpv6);
 	nf_conntrack_l4proto_unregister(net,
 					&nf_conntrack_l4proto_udp6);
 	nf_conntrack_l4proto_unregister(net,
 					&nf_conntrack_l4proto_tcp6);
 }
 static struct pernet_operations ipv6_net_ops = {
 	.init = ipv6_net_init,
 	.exit = ipv6_net_exit,
 };
 static int __init nf_conntrack_l3proto_ipv6_init(void)
 {
 	int ret = 0;
 	need_conntrack();
 	nf_defrag_ipv6_enable();
+	ret = nf_register_sockopt(&so_getorigdst6);
+	if (ret < 0) {
+		pr_err("Unable to register netfilter socket option\n");
+		return ret;
+	}
 	ret = register_pernet_subsys(&ipv6_net_ops);
 	if (ret < 0)
 		goto cleanup_pernet;
 	ret = nf_register_hooks(ipv6_conntrack_ops,
 				ARRAY_SIZE(ipv6_conntrack_ops));
 	if (ret < 0) {
 		pr_err("nf_conntrack_ipv6: can't register pre-routing defrag "
 		       "hook.\n");
 		goto cleanup_ipv6;
 	}
 	return ret;
  cleanup_ipv6:
 	unregister_pernet_subsys(&ipv6_net_ops);
  cleanup_pernet:
+	nf_unregister_sockopt(&so_getorigdst6);
 	return ret;
 }
 static void __exit nf_conntrack_l3proto_ipv6_fini(void)
 {
 	synchronize_net();
 	nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
 	unregister_pernet_subsys(&ipv6_net_ops);
+	nf_unregister_sockopt(&so_getorigdst6);
 }
 module_init(nf_conntrack_l3proto_ipv6_init);
 module_exit(nf_conntrack_l3proto_ipv6_fini);

net/netfilter/ipvs/ip_vs_nfct.c

Diff comments View file @ 545b290

net/netfilter/ipvs/ip_vs_xmit.c

Diff comments View file @ 545b290

1	/*	1	/*
2	* ip_vs_xmit.c: various packet transmitters for IPVS	2	* ip_vs_xmit.c: various packet transmitters for IPVS
3	*	3	*
4	* Authors: Wensong Zhang <wensong@linuxvirtualserver.org>	4	* Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
5	* Julian Anastasov <ja@ssi.bg>	5	* Julian Anastasov <ja@ssi.bg>
6	*	6	*
7	* This program is free software; you can redistribute it and/or	7	* This program is free software; you can redistribute it and/or
8	* modify it under the terms of the GNU General Public License	8	* modify it under the terms of the GNU General Public License
9	* as published by the Free Software Foundation; either version	9	* as published by the Free Software Foundation; either version
10	* 2 of the License, or (at your option) any later version.	10	* 2 of the License, or (at your option) any later version.
11	*	11	*
12	* Changes:	12	* Changes:
13	*	13	*
14	* Description of forwarding methods:	14	* Description of forwarding methods:
15	* - all transmitters are called from LOCAL_IN (remote clients) and	15	* - all transmitters are called from LOCAL_IN (remote clients) and
16	* LOCAL_OUT (local clients) but for ICMP can be called from FORWARD	16	* LOCAL_OUT (local clients) but for ICMP can be called from FORWARD
17	* - not all connections have destination server, for example,	17	* - not all connections have destination server, for example,
18	* connections in backup server when fwmark is used	18	* connections in backup server when fwmark is used
19	* - bypass connections use daddr from packet	19	* - bypass connections use daddr from packet
20	* LOCAL_OUT rules:	20	* LOCAL_OUT rules:
21	* - skb->dev is NULL, skb->protocol is not set (both are set in POST_ROUTING)	21	* - skb->dev is NULL, skb->protocol is not set (both are set in POST_ROUTING)
22	* - skb->pkt_type is not set yet	22	* - skb->pkt_type is not set yet
23	* - the only place where we can see skb->sk != NULL	23	* - the only place where we can see skb->sk != NULL
24	*/	24	*/
25		25
26	#define KMSG_COMPONENT "IPVS"	26	#define KMSG_COMPONENT "IPVS"
27	#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt	27	#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
28		28
29	#include <linux/kernel.h>	29	#include <linux/kernel.h>
30	#include <linux/slab.h>	30	#include <linux/slab.h>
31	#include <linux/tcp.h> /* for tcphdr */	31	#include <linux/tcp.h> /* for tcphdr */
32	#include <net/ip.h>	32	#include <net/ip.h>
33	#include <net/tcp.h> /* for csum_tcpudp_magic */	33	#include <net/tcp.h> /* for csum_tcpudp_magic */
34	#include <net/udp.h>	34	#include <net/udp.h>
35	#include <net/icmp.h> /* for icmp_send */	35	#include <net/icmp.h> /* for icmp_send */
36	#include <net/route.h> /* for ip_route_output */	36	#include <net/route.h> /* for ip_route_output */
37	#include <net/ipv6.h>	37	#include <net/ipv6.h>
38	#include <net/ip6_route.h>	38	#include <net/ip6_route.h>
39	#include <net/addrconf.h>	39	#include <net/addrconf.h>
40	#include <linux/icmpv6.h>	40	#include <linux/icmpv6.h>
41	#include <linux/netfilter.h>	41	#include <linux/netfilter.h>
42	#include <linux/netfilter_ipv4.h>	42	#include <linux/netfilter_ipv4.h>
43		43
44	#include <net/ip_vs.h>	44	#include <net/ip_vs.h>
45		45
46	enum {	46	enum {
47	IP_VS_RT_MODE_LOCAL = 1, /* Allow local dest */	47	IP_VS_RT_MODE_LOCAL = 1, /* Allow local dest */
48	IP_VS_RT_MODE_NON_LOCAL = 2, /* Allow non-local dest */	48	IP_VS_RT_MODE_NON_LOCAL = 2, /* Allow non-local dest */
49	IP_VS_RT_MODE_RDR = 4, /* Allow redirect from remote daddr to	49	IP_VS_RT_MODE_RDR = 4, /* Allow redirect from remote daddr to
50	* local	50	* local
51	*/	51	*/
52	IP_VS_RT_MODE_CONNECT = 8, /* Always bind route to saddr */	52	IP_VS_RT_MODE_CONNECT = 8, /* Always bind route to saddr */
53	IP_VS_RT_MODE_KNOWN_NH = 16,/* Route via remote addr */	53	IP_VS_RT_MODE_KNOWN_NH = 16,/* Route via remote addr */
54	};	54	};
55		55
56	/*	56	/*
57	* Destination cache to speed up outgoing route lookup	57	* Destination cache to speed up outgoing route lookup
58	*/	58	*/
59	static inline void	59	static inline void
60	__ip_vs_dst_set(struct ip_vs_dest dest, u32 rtos, struct dst_entry dst,	60	__ip_vs_dst_set(struct ip_vs_dest dest, u32 rtos, struct dst_entry dst,
61	u32 dst_cookie)	61	u32 dst_cookie)
62	{	62	{
63	struct dst_entry *old_dst;	63	struct dst_entry *old_dst;
64		64
65	old_dst = dest->dst_cache;	65	old_dst = dest->dst_cache;
66	dest->dst_cache = dst;	66	dest->dst_cache = dst;
67	dest->dst_rtos = rtos;	67	dest->dst_rtos = rtos;
68	dest->dst_cookie = dst_cookie;	68	dest->dst_cookie = dst_cookie;
69	dst_release(old_dst);	69	dst_release(old_dst);
70	}	70	}
71		71
72	static inline struct dst_entry *	72	static inline struct dst_entry *
73	__ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos)	73	__ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos)
74	{	74	{
75	struct dst_entry *dst = dest->dst_cache;	75	struct dst_entry *dst = dest->dst_cache;
76		76
77	if (!dst)	77	if (!dst)
78	return NULL;	78	return NULL;
79	if ((dst->obsolete \|\| rtos != dest->dst_rtos) &&	79	if ((dst->obsolete \|\| rtos != dest->dst_rtos) &&
80	dst->ops->check(dst, dest->dst_cookie) == NULL) {	80	dst->ops->check(dst, dest->dst_cookie) == NULL) {
81	dest->dst_cache = NULL;	81	dest->dst_cache = NULL;
82	dst_release(dst);	82	dst_release(dst);
83	return NULL;	83	return NULL;
84	}	84	}
85	dst_hold(dst);	85	dst_hold(dst);
86	return dst;	86	return dst;
87	}	87	}
88		88
89	static inline bool	89	static inline bool
90	__mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu)	90	__mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu)
91	{	91	{
92	if (IP6CB(skb)->frag_max_size) {	92	if (IP6CB(skb)->frag_max_size) {
93	/* frag_max_size tell us that, this packet have been	93	/* frag_max_size tell us that, this packet have been
94	* defragmented by netfilter IPv6 conntrack module.	94	* defragmented by netfilter IPv6 conntrack module.
95	*/	95	*/
96	if (IP6CB(skb)->frag_max_size > mtu)	96	if (IP6CB(skb)->frag_max_size > mtu)
97	return true; /* largest fragment violate MTU */	97	return true; /* largest fragment violate MTU */
98	}	98	}
99	else if (skb->len > mtu && !skb_is_gso(skb)) {	99	else if (skb->len > mtu && !skb_is_gso(skb)) {
100	return true; /* Packet size violate MTU size */	100	return true; /* Packet size violate MTU size */
101	}	101	}
102	return false;	102	return false;
103	}	103	}
104		104
105	/* Get route to daddr, update saddr, optionally bind route to saddr /	105	/* Get route to daddr, update saddr, optionally bind route to saddr /
106	static struct rtable do_output_route4(struct net net, __be32 daddr,	106	static struct rtable do_output_route4(struct net net, __be32 daddr,
107	u32 rtos, int rt_mode, __be32 *saddr)	107	u32 rtos, int rt_mode, __be32 *saddr)
108	{	108	{
109	struct flowi4 fl4;	109	struct flowi4 fl4;
110	struct rtable *rt;	110	struct rtable *rt;
111	int loop = 0;	111	int loop = 0;
112		112
113	memset(&fl4, 0, sizeof(fl4));	113	memset(&fl4, 0, sizeof(fl4));
114	fl4.daddr = daddr;	114	fl4.daddr = daddr;
115	fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;	115	fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
116	fl4.flowi4_tos = rtos;	116	fl4.flowi4_tos = rtos;
117	fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?	117	fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
118	FLOWI_FLAG_KNOWN_NH : 0;	118	FLOWI_FLAG_KNOWN_NH : 0;
119		119
120	retry:	120	retry:
121	rt = ip_route_output_key(net, &fl4);	121	rt = ip_route_output_key(net, &fl4);
122	if (IS_ERR(rt)) {	122	if (IS_ERR(rt)) {
123	/* Invalid saddr ? */	123	/* Invalid saddr ? */
124	if (PTR_ERR(rt) == -EINVAL && *saddr &&	124	if (PTR_ERR(rt) == -EINVAL && *saddr &&
125	rt_mode & IP_VS_RT_MODE_CONNECT && !loop) {	125	rt_mode & IP_VS_RT_MODE_CONNECT && !loop) {
126	*saddr = 0;	126	*saddr = 0;
127	flowi4_update_output(&fl4, 0, rtos, daddr, 0);	127	flowi4_update_output(&fl4, 0, rtos, daddr, 0);
128	goto retry;	128	goto retry;
129	}	129	}
130	IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n", &daddr);	130	IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n", &daddr);
131	return NULL;	131	return NULL;
132	} else if (!*saddr && rt_mode & IP_VS_RT_MODE_CONNECT && fl4.saddr) {	132	} else if (!*saddr && rt_mode & IP_VS_RT_MODE_CONNECT && fl4.saddr) {
133	ip_rt_put(rt);	133	ip_rt_put(rt);
134	*saddr = fl4.saddr;	134	*saddr = fl4.saddr;
135	flowi4_update_output(&fl4, 0, rtos, daddr, fl4.saddr);	135	flowi4_update_output(&fl4, 0, rtos, daddr, fl4.saddr);
136	loop++;	136	loop++;
137	goto retry;	137	goto retry;
138	}	138	}
139	*saddr = fl4.saddr;	139	*saddr = fl4.saddr;
140	return rt;	140	return rt;
141	}	141	}
142		142
143	/* Get route to destination or remote server */	143	/* Get route to destination or remote server */
144	static struct rtable *	144	static struct rtable *
145	__ip_vs_get_out_rt(struct sk_buff skb, struct ip_vs_dest dest,	145	__ip_vs_get_out_rt(struct sk_buff skb, struct ip_vs_dest dest,
146	__be32 daddr, u32 rtos, int rt_mode, __be32 *ret_saddr)	146	__be32 daddr, u32 rtos, int rt_mode, __be32 *ret_saddr)
147	{	147	{
148	struct net *net = dev_net(skb_dst(skb)->dev);	148	struct net *net = dev_net(skb_dst(skb)->dev);
149	struct rtable rt; / Route to the other host */	149	struct rtable rt; / Route to the other host */
150	struct rtable ort; / Original route */	150	struct rtable ort; / Original route */
151	int local;	151	int local;
152		152
153	if (dest) {	153	if (dest) {
154	spin_lock(&dest->dst_lock);	154	spin_lock(&dest->dst_lock);
155	if (!(rt = (struct rtable *)	155	if (!(rt = (struct rtable *)
156	__ip_vs_dst_check(dest, rtos))) {	156	__ip_vs_dst_check(dest, rtos))) {
157	rt = do_output_route4(net, dest->addr.ip, rtos,	157	rt = do_output_route4(net, dest->addr.ip, rtos,
158	rt_mode, &dest->dst_saddr.ip);	158	rt_mode, &dest->dst_saddr.ip);
159	if (!rt) {	159	if (!rt) {
160	spin_unlock(&dest->dst_lock);	160	spin_unlock(&dest->dst_lock);
161	return NULL;	161	return NULL;
162	}	162	}
163	__ip_vs_dst_set(dest, rtos, dst_clone(&rt->dst), 0);	163	__ip_vs_dst_set(dest, rtos, dst_clone(&rt->dst), 0);
164	IP_VS_DBG(10, "new dst %pI4, src %pI4, refcnt=%d, "	164	IP_VS_DBG(10, "new dst %pI4, src %pI4, refcnt=%d, "
165	"rtos=%X\n",	165	"rtos=%X\n",
166	&dest->addr.ip, &dest->dst_saddr.ip,	166	&dest->addr.ip, &dest->dst_saddr.ip,
167	atomic_read(&rt->dst.__refcnt), rtos);	167	atomic_read(&rt->dst.__refcnt), rtos);
168	}	168	}
169	daddr = dest->addr.ip;	169	daddr = dest->addr.ip;
170	if (ret_saddr)	170	if (ret_saddr)
171	*ret_saddr = dest->dst_saddr.ip;	171	*ret_saddr = dest->dst_saddr.ip;
172	spin_unlock(&dest->dst_lock);	172	spin_unlock(&dest->dst_lock);
173	} else {	173	} else {
174	__be32 saddr = htonl(INADDR_ANY);	174	__be32 saddr = htonl(INADDR_ANY);
175		175
176	/* For such unconfigured boxes avoid many route lookups	176	/* For such unconfigured boxes avoid many route lookups
177	* for performance reasons because we do not remember saddr	177	* for performance reasons because we do not remember saddr
178	*/	178	*/
179	rt_mode &= ~IP_VS_RT_MODE_CONNECT;	179	rt_mode &= ~IP_VS_RT_MODE_CONNECT;
180	rt = do_output_route4(net, daddr, rtos, rt_mode, &saddr);	180	rt = do_output_route4(net, daddr, rtos, rt_mode, &saddr);
181	if (!rt)	181	if (!rt)
182	return NULL;	182	return NULL;
183	if (ret_saddr)	183	if (ret_saddr)
184	*ret_saddr = saddr;	184	*ret_saddr = saddr;
185	}	185	}
186		186
187	local = rt->rt_flags & RTCF_LOCAL;	187	local = rt->rt_flags & RTCF_LOCAL;
188	if (!((local ? IP_VS_RT_MODE_LOCAL : IP_VS_RT_MODE_NON_LOCAL) &	188	if (!((local ? IP_VS_RT_MODE_LOCAL : IP_VS_RT_MODE_NON_LOCAL) &
189	rt_mode)) {	189	rt_mode)) {
190	IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI4\n",	190	IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI4\n",
191	(rt->rt_flags & RTCF_LOCAL) ?	191	(rt->rt_flags & RTCF_LOCAL) ?
192	"local":"non-local", &daddr);	192	"local":"non-local", &daddr);
193	ip_rt_put(rt);	193	ip_rt_put(rt);
194	return NULL;	194	return NULL;
195	}	195	}
196	if (local && !(rt_mode & IP_VS_RT_MODE_RDR) &&	196	if (local && !(rt_mode & IP_VS_RT_MODE_RDR) &&
197	!((ort = skb_rtable(skb)) && ort->rt_flags & RTCF_LOCAL)) {	197	!((ort = skb_rtable(skb)) && ort->rt_flags & RTCF_LOCAL)) {
198	IP_VS_DBG_RL("Redirect from non-local address %pI4 to local "	198	IP_VS_DBG_RL("Redirect from non-local address %pI4 to local "
199	"requires NAT method, dest: %pI4\n",	199	"requires NAT method, dest: %pI4\n",
200	&ip_hdr(skb)->daddr, &daddr);	200	&ip_hdr(skb)->daddr, &daddr);
201	ip_rt_put(rt);	201	ip_rt_put(rt);
202	return NULL;	202	return NULL;
203	}	203	}
204	if (unlikely(!local && ipv4_is_loopback(ip_hdr(skb)->saddr))) {	204	if (unlikely(!local && ipv4_is_loopback(ip_hdr(skb)->saddr))) {
205	IP_VS_DBG_RL("Stopping traffic from loopback address %pI4 "	205	IP_VS_DBG_RL("Stopping traffic from loopback address %pI4 "
206	"to non-local address, dest: %pI4\n",	206	"to non-local address, dest: %pI4\n",
207	&ip_hdr(skb)->saddr, &daddr);	207	&ip_hdr(skb)->saddr, &daddr);
208	ip_rt_put(rt);	208	ip_rt_put(rt);
209	return NULL;	209	return NULL;
210	}	210	}
211		211
212	return rt;	212	return rt;
213	}	213	}
214		214
215	/* Reroute packet to local IPv4 stack after DNAT */	215	/* Reroute packet to local IPv4 stack after DNAT */
216	static int	216	static int
217	__ip_vs_reroute_locally(struct sk_buff *skb)	217	__ip_vs_reroute_locally(struct sk_buff *skb)
218	{	218	{
219	struct rtable *rt = skb_rtable(skb);	219	struct rtable *rt = skb_rtable(skb);
220	struct net_device *dev = rt->dst.dev;	220	struct net_device *dev = rt->dst.dev;
221	struct net *net = dev_net(dev);	221	struct net *net = dev_net(dev);
222	struct iphdr *iph = ip_hdr(skb);	222	struct iphdr *iph = ip_hdr(skb);
223		223
224	if (rt_is_input_route(rt)) {	224	if (rt_is_input_route(rt)) {
225	unsigned long orefdst = skb->_skb_refdst;	225	unsigned long orefdst = skb->_skb_refdst;
226		226
227	if (ip_route_input(skb, iph->daddr, iph->saddr,	227	if (ip_route_input(skb, iph->daddr, iph->saddr,
228	iph->tos, skb->dev))	228	iph->tos, skb->dev))
229	return 0;	229	return 0;
230	refdst_drop(orefdst);	230	refdst_drop(orefdst);
231	} else {	231	} else {
232	struct flowi4 fl4 = {	232	struct flowi4 fl4 = {
233	.daddr = iph->daddr,	233	.daddr = iph->daddr,
234	.saddr = iph->saddr,	234	.saddr = iph->saddr,
235	.flowi4_tos = RT_TOS(iph->tos),	235	.flowi4_tos = RT_TOS(iph->tos),
236	.flowi4_mark = skb->mark,	236	.flowi4_mark = skb->mark,
237	};	237	};
238		238
239	rt = ip_route_output_key(net, &fl4);	239	rt = ip_route_output_key(net, &fl4);
240	if (IS_ERR(rt))	240	if (IS_ERR(rt))
241	return 0;	241	return 0;
242	if (!(rt->rt_flags & RTCF_LOCAL)) {	242	if (!(rt->rt_flags & RTCF_LOCAL)) {
243	ip_rt_put(rt);	243	ip_rt_put(rt);
244	return 0;	244	return 0;
245	}	245	}
246	/* Drop old route. */	246	/* Drop old route. */
247	skb_dst_drop(skb);	247	skb_dst_drop(skb);
248	skb_dst_set(skb, &rt->dst);	248	skb_dst_set(skb, &rt->dst);
249	}	249	}
250	return 1;	250	return 1;
251	}	251	}
252		252
253	#ifdef CONFIG_IP_VS_IPV6	253	#ifdef CONFIG_IP_VS_IPV6
254		254
255	static inline int __ip_vs_is_local_route6(struct rt6_info *rt)	255	static inline int __ip_vs_is_local_route6(struct rt6_info *rt)
256	{	256	{
257	return rt->dst.dev && rt->dst.dev->flags & IFF_LOOPBACK;	257	return rt->dst.dev && rt->dst.dev->flags & IFF_LOOPBACK;
258	}	258	}
259		259
260	static struct dst_entry *	260	static struct dst_entry *
261	__ip_vs_route_output_v6(struct net net, struct in6_addr daddr,	261	__ip_vs_route_output_v6(struct net net, struct in6_addr daddr,
262	struct in6_addr *ret_saddr, int do_xfrm)	262	struct in6_addr *ret_saddr, int do_xfrm)
263	{	263	{
264	struct dst_entry *dst;	264	struct dst_entry *dst;
265	struct flowi6 fl6 = {	265	struct flowi6 fl6 = {
266	.daddr = *daddr,	266	.daddr = *daddr,
267	};	267	};
268		268
269	dst = ip6_route_output(net, NULL, &fl6);	269	dst = ip6_route_output(net, NULL, &fl6);
270	if (dst->error)	270	if (dst->error)
271	goto out_err;	271	goto out_err;
272	if (!ret_saddr)	272	if (!ret_saddr)
273	return dst;	273	return dst;
274	if (ipv6_addr_any(&fl6.saddr) &&	274	if (ipv6_addr_any(&fl6.saddr) &&
275	ipv6_dev_get_saddr(net, ip6_dst_idev(dst)->dev,	275	ipv6_dev_get_saddr(net, ip6_dst_idev(dst)->dev,
276	&fl6.daddr, 0, &fl6.saddr) < 0)	276	&fl6.daddr, 0, &fl6.saddr) < 0)
277	goto out_err;	277	goto out_err;
278	if (do_xfrm) {	278	if (do_xfrm) {
279	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);	279	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
280	if (IS_ERR(dst)) {	280	if (IS_ERR(dst)) {
281	dst = NULL;	281	dst = NULL;
282	goto out_err;	282	goto out_err;
283	}	283	}
284	}	284	}
285	*ret_saddr = fl6.saddr;	285	*ret_saddr = fl6.saddr;
286	return dst;	286	return dst;
287		287
288	out_err:	288	out_err:
289	dst_release(dst);	289	dst_release(dst);
290	IP_VS_DBG_RL("ip6_route_output error, dest: %pI6\n", daddr);	290	IP_VS_DBG_RL("ip6_route_output error, dest: %pI6\n", daddr);
291	return NULL;	291	return NULL;
292	}	292	}
293		293
294	/*	294	/*
295	* Get route to destination or remote server	295	* Get route to destination or remote server
296	*/	296	*/
297	static struct rt6_info *	297	static struct rt6_info *
298	__ip_vs_get_out_rt_v6(struct sk_buff skb, struct ip_vs_dest dest,	298	__ip_vs_get_out_rt_v6(struct sk_buff skb, struct ip_vs_dest dest,
299	struct in6_addr daddr, struct in6_addr ret_saddr,	299	struct in6_addr daddr, struct in6_addr ret_saddr,
300	int do_xfrm, int rt_mode)	300	int do_xfrm, int rt_mode)
301	{	301	{
302	struct net *net = dev_net(skb_dst(skb)->dev);	302	struct net *net = dev_net(skb_dst(skb)->dev);
303	struct rt6_info rt; / Route to the other host */	303	struct rt6_info rt; / Route to the other host */
304	struct rt6_info ort; / Original route */	304	struct rt6_info ort; / Original route */
305	struct dst_entry *dst;	305	struct dst_entry *dst;
306	int local;	306	int local;
307		307
308	if (dest) {	308	if (dest) {
309	spin_lock(&dest->dst_lock);	309	spin_lock(&dest->dst_lock);
310	rt = (struct rt6_info *)__ip_vs_dst_check(dest, 0);	310	rt = (struct rt6_info *)__ip_vs_dst_check(dest, 0);
311	if (!rt) {	311	if (!rt) {
312	u32 cookie;	312	u32 cookie;
313		313
314	dst = __ip_vs_route_output_v6(net, &dest->addr.in6,	314	dst = __ip_vs_route_output_v6(net, &dest->addr.in6,
315	&dest->dst_saddr.in6,	315	&dest->dst_saddr.in6,
316	do_xfrm);	316	do_xfrm);
317	if (!dst) {	317	if (!dst) {
318	spin_unlock(&dest->dst_lock);	318	spin_unlock(&dest->dst_lock);
319	return NULL;	319	return NULL;
320	}	320	}
321	rt = (struct rt6_info *) dst;	321	rt = (struct rt6_info *) dst;
322	cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;	322	cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
323	__ip_vs_dst_set(dest, 0, dst_clone(&rt->dst), cookie);	323	__ip_vs_dst_set(dest, 0, dst_clone(&rt->dst), cookie);
324	IP_VS_DBG(10, "new dst %pI6, src %pI6, refcnt=%d\n",	324	IP_VS_DBG(10, "new dst %pI6, src %pI6, refcnt=%d\n",
325	&dest->addr.in6, &dest->dst_saddr.in6,	325	&dest->addr.in6, &dest->dst_saddr.in6,
326	atomic_read(&rt->dst.__refcnt));	326	atomic_read(&rt->dst.__refcnt));
327	}	327	}
328	if (ret_saddr)	328	if (ret_saddr)
329	*ret_saddr = dest->dst_saddr.in6;	329	*ret_saddr = dest->dst_saddr.in6;
330	spin_unlock(&dest->dst_lock);	330	spin_unlock(&dest->dst_lock);
331	} else {	331	} else {
332	dst = __ip_vs_route_output_v6(net, daddr, ret_saddr, do_xfrm);	332	dst = __ip_vs_route_output_v6(net, daddr, ret_saddr, do_xfrm);
333	if (!dst)	333	if (!dst)
334	return NULL;	334	return NULL;
335	rt = (struct rt6_info *) dst;	335	rt = (struct rt6_info *) dst;
336	}	336	}
337		337
338	local = __ip_vs_is_local_route6(rt);	338	local = __ip_vs_is_local_route6(rt);
339	if (!((local ? IP_VS_RT_MODE_LOCAL : IP_VS_RT_MODE_NON_LOCAL) &	339	if (!((local ? IP_VS_RT_MODE_LOCAL : IP_VS_RT_MODE_NON_LOCAL) &
340	rt_mode)) {	340	rt_mode)) {
341	IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI6c\n",	341	IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI6c\n",
342	local ? "local":"non-local", daddr);	342	local ? "local":"non-local", daddr);
343	dst_release(&rt->dst);	343	dst_release(&rt->dst);
344	return NULL;	344	return NULL;
345	}	345	}
346	if (local && !(rt_mode & IP_VS_RT_MODE_RDR) &&	346	if (local && !(rt_mode & IP_VS_RT_MODE_RDR) &&
347	!((ort = (struct rt6_info *) skb_dst(skb)) &&	347	!((ort = (struct rt6_info *) skb_dst(skb)) &&
348	__ip_vs_is_local_route6(ort))) {	348	__ip_vs_is_local_route6(ort))) {
349	IP_VS_DBG_RL("Redirect from non-local address %pI6c to local "	349	IP_VS_DBG_RL("Redirect from non-local address %pI6c to local "
350	"requires NAT method, dest: %pI6c\n",	350	"requires NAT method, dest: %pI6c\n",
351	&ipv6_hdr(skb)->daddr, daddr);	351	&ipv6_hdr(skb)->daddr, daddr);
352	dst_release(&rt->dst);	352	dst_release(&rt->dst);
353	return NULL;	353	return NULL;
354	}	354	}
355	if (unlikely(!local && (!skb->dev \|\| skb->dev->flags & IFF_LOOPBACK) &&	355	if (unlikely(!local && (!skb->dev \|\| skb->dev->flags & IFF_LOOPBACK) &&
356	ipv6_addr_type(&ipv6_hdr(skb)->saddr) &	356	ipv6_addr_type(&ipv6_hdr(skb)->saddr) &
357	IPV6_ADDR_LOOPBACK)) {	357	IPV6_ADDR_LOOPBACK)) {
358	IP_VS_DBG_RL("Stopping traffic from loopback address %pI6c "	358	IP_VS_DBG_RL("Stopping traffic from loopback address %pI6c "
359	"to non-local address, dest: %pI6c\n",	359	"to non-local address, dest: %pI6c\n",
360	&ipv6_hdr(skb)->saddr, daddr);	360	&ipv6_hdr(skb)->saddr, daddr);
361	dst_release(&rt->dst);	361	dst_release(&rt->dst);
362	return NULL;	362	return NULL;
363	}	363	}
364		364
365	return rt;	365	return rt;
366	}	366	}
367	#endif	367	#endif
368		368
369		369
370	/*	370	/*
371	* Release dest->dst_cache before a dest is removed	371	* Release dest->dst_cache before a dest is removed
372	*/	372	*/
373	void	373	void
374	ip_vs_dst_reset(struct ip_vs_dest *dest)	374	ip_vs_dst_reset(struct ip_vs_dest *dest)
375	{	375	{
376	struct dst_entry *old_dst;	376	struct dst_entry *old_dst;
377		377
378	old_dst = dest->dst_cache;	378	old_dst = dest->dst_cache;
379	dest->dst_cache = NULL;	379	dest->dst_cache = NULL;
380	dst_release(old_dst);	380	dst_release(old_dst);
381	dest->dst_saddr.ip = 0;	381	dest->dst_saddr.ip = 0;
382	}	382	}
383		383
384	#define IP_VS_XMIT_TUNNEL(skb, cp) \	384	#define IP_VS_XMIT_TUNNEL(skb, cp) \
385	({ \	385	({ \
386	int __ret = NF_ACCEPT; \	386	int __ret = NF_ACCEPT; \
387	\	387	\
388	(skb)->ipvs_property = 1; \	388	(skb)->ipvs_property = 1; \
389	if (unlikely((cp)->flags & IP_VS_CONN_F_NFCT)) \	389	if (unlikely((cp)->flags & IP_VS_CONN_F_NFCT)) \
390	__ret = ip_vs_confirm_conntrack(skb); \	390	__ret = ip_vs_confirm_conntrack(skb); \
391	if (__ret == NF_ACCEPT) { \	391	if (__ret == NF_ACCEPT) { \
392	nf_reset(skb); \	392	nf_reset(skb); \
393	skb_forward_csum(skb); \	393	skb_forward_csum(skb); \
394	} \	394	} \
395	__ret; \	395	__ret; \
396	})	396	})
397		397
398	#define IP_VS_XMIT_NAT(pf, skb, cp, local) \	398	#define IP_VS_XMIT_NAT(pf, skb, cp, local) \
399	do { \	399	do { \
400	(skb)->ipvs_property = 1; \	400	(skb)->ipvs_property = 1; \
401	if (likely(!((cp)->flags & IP_VS_CONN_F_NFCT))) \	401	if (likely(!((cp)->flags & IP_VS_CONN_F_NFCT))) \
402	ip_vs_notrack(skb); \	402	ip_vs_notrack(skb); \
403	else \	403	else \
404	ip_vs_update_conntrack(skb, cp, 1); \	404	ip_vs_update_conntrack(skb, cp, 1); \
405	if (local) \	405	if (local) \
406	return NF_ACCEPT; \	406	return NF_ACCEPT; \
407	skb_forward_csum(skb); \	407	skb_forward_csum(skb); \
408	NF_HOOK(pf, NF_INET_LOCAL_OUT, (skb), NULL, \	408	NF_HOOK(pf, NF_INET_LOCAL_OUT, (skb), NULL, \
409	skb_dst(skb)->dev, dst_output); \	409	skb_dst(skb)->dev, dst_output); \
410	} while (0)	410	} while (0)
411		411
412	#define IP_VS_XMIT(pf, skb, cp, local) \	412	#define IP_VS_XMIT(pf, skb, cp, local) \
413	do { \	413	do { \
414	(skb)->ipvs_property = 1; \	414	(skb)->ipvs_property = 1; \
415	if (likely(!((cp)->flags & IP_VS_CONN_F_NFCT))) \	415	if (likely(!((cp)->flags & IP_VS_CONN_F_NFCT))) \
416	ip_vs_notrack(skb); \	416	ip_vs_notrack(skb); \
417	if (local) \	417	if (local) \
418	return NF_ACCEPT; \	418	return NF_ACCEPT; \
419	skb_forward_csum(skb); \	419	skb_forward_csum(skb); \
420	NF_HOOK(pf, NF_INET_LOCAL_OUT, (skb), NULL, \	420	NF_HOOK(pf, NF_INET_LOCAL_OUT, (skb), NULL, \
421	skb_dst(skb)->dev, dst_output); \	421	skb_dst(skb)->dev, dst_output); \
422	} while (0)	422	} while (0)
423		423
424		424
425	/*	425	/*
426	* NULL transmitter (do nothing except return NF_ACCEPT)	426	* NULL transmitter (do nothing except return NF_ACCEPT)
427	*/	427	*/
428	int	428	int
429	ip_vs_null_xmit(struct sk_buff skb, struct ip_vs_conn cp,	429	ip_vs_null_xmit(struct sk_buff skb, struct ip_vs_conn cp,
430	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)	430	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)
431	{	431	{
432	/* we do not touch skb and do not need pskb ptr */	432	/* we do not touch skb and do not need pskb ptr */
433	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);	433	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);
434	}	434	}
435		435
436		436
437	/*	437	/*
438	* Bypass transmitter	438	* Bypass transmitter
439	* Let packets bypass the destination when the destination is not	439	* Let packets bypass the destination when the destination is not
440	* available, it may be only used in transparent cache cluster.	440	* available, it may be only used in transparent cache cluster.
441	*/	441	*/
442	int	442	int
443	ip_vs_bypass_xmit(struct sk_buff skb, struct ip_vs_conn cp,	443	ip_vs_bypass_xmit(struct sk_buff skb, struct ip_vs_conn cp,
444	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)	444	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)
445	{	445	{
446	struct rtable rt; / Route to the other host */	446	struct rtable rt; / Route to the other host */
447	struct iphdr *iph = ip_hdr(skb);	447	struct iphdr *iph = ip_hdr(skb);
448	int mtu;	448	int mtu;
449		449
450	EnterFunction(10);	450	EnterFunction(10);
451		451
452	if (!(rt = __ip_vs_get_out_rt(skb, NULL, iph->daddr, RT_TOS(iph->tos),	452	if (!(rt = __ip_vs_get_out_rt(skb, NULL, iph->daddr, RT_TOS(iph->tos),
453	IP_VS_RT_MODE_NON_LOCAL, NULL)))	453	IP_VS_RT_MODE_NON_LOCAL, NULL)))
454	goto tx_error_icmp;	454	goto tx_error_icmp;
455		455
456	/* MTU checking */	456	/* MTU checking */
457	mtu = dst_mtu(&rt->dst);	457	mtu = dst_mtu(&rt->dst);
458	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&	458	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&
459	!skb_is_gso(skb)) {	459	!skb_is_gso(skb)) {
460	ip_rt_put(rt);	460	ip_rt_put(rt);
461	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));	461	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
462	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	462	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
463	goto tx_error;	463	goto tx_error;
464	}	464	}
465		465
466	/*	466	/*
467	* Call ip_send_check because we are not sure it is called	467	* Call ip_send_check because we are not sure it is called
468	* after ip_defrag. Is copy-on-write needed?	468	* after ip_defrag. Is copy-on-write needed?
469	*/	469	*/
470	if (unlikely((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)) {	470	if (unlikely((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)) {
471	ip_rt_put(rt);	471	ip_rt_put(rt);
472	return NF_STOLEN;	472	return NF_STOLEN;
473	}	473	}
474	ip_send_check(ip_hdr(skb));	474	ip_send_check(ip_hdr(skb));
475		475
476	/* drop old route */	476	/* drop old route */
477	skb_dst_drop(skb);	477	skb_dst_drop(skb);
478	skb_dst_set(skb, &rt->dst);	478	skb_dst_set(skb, &rt->dst);
479		479
480	/* Another hack: avoid icmp_send in ip_fragment */	480	/* Another hack: avoid icmp_send in ip_fragment */
481	skb->local_df = 1;	481	skb->local_df = 1;
482		482
483	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 0);	483	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 0);
484		484
485	LeaveFunction(10);	485	LeaveFunction(10);
486	return NF_STOLEN;	486	return NF_STOLEN;
487		487
488	tx_error_icmp:	488	tx_error_icmp:
489	dst_link_failure(skb);	489	dst_link_failure(skb);
490	tx_error:	490	tx_error:
491	kfree_skb(skb);	491	kfree_skb(skb);
492	LeaveFunction(10);	492	LeaveFunction(10);
493	return NF_STOLEN;	493	return NF_STOLEN;
494	}	494	}
495		495
496	#ifdef CONFIG_IP_VS_IPV6	496	#ifdef CONFIG_IP_VS_IPV6
497	int	497	int
498	ip_vs_bypass_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,	498	ip_vs_bypass_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
499	struct ip_vs_protocol pp, struct ip_vs_iphdr iph)	499	struct ip_vs_protocol pp, struct ip_vs_iphdr iph)
500	{	500	{
501	struct rt6_info rt; / Route to the other host */	501	struct rt6_info rt; / Route to the other host */
502	int mtu;	502	int mtu;
503		503
504	EnterFunction(10);	504	EnterFunction(10);
505		505
506	rt = __ip_vs_get_out_rt_v6(skb, NULL, &iph->daddr.in6, NULL, 0,	506	rt = __ip_vs_get_out_rt_v6(skb, NULL, &iph->daddr.in6, NULL, 0,
507	IP_VS_RT_MODE_NON_LOCAL);	507	IP_VS_RT_MODE_NON_LOCAL);
508	if (!rt)	508	if (!rt)
509	goto tx_error_icmp;	509	goto tx_error_icmp;
510		510
511	/* MTU checking */	511	/* MTU checking */
512	mtu = dst_mtu(&rt->dst);	512	mtu = dst_mtu(&rt->dst);
513	if (__mtu_check_toobig_v6(skb, mtu)) {	513	if (__mtu_check_toobig_v6(skb, mtu)) {
514	if (!skb->dev) {	514	if (!skb->dev) {
515	struct net *net = dev_net(skb_dst(skb)->dev);	515	struct net *net = dev_net(skb_dst(skb)->dev);
516		516
517	skb->dev = net->loopback_dev;	517	skb->dev = net->loopback_dev;
518	}	518	}
519	/* only send ICMP too big on first fragment */	519	/* only send ICMP too big on first fragment */
520	if (!iph->fragoffs)	520	if (!iph->fragoffs)
521	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	521	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
522	dst_release(&rt->dst);	522	dst_release(&rt->dst);
523	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	523	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
524	goto tx_error;	524	goto tx_error;
525	}	525	}
526		526
527	/*	527	/*
528	* Call ip_send_check because we are not sure it is called	528	* Call ip_send_check because we are not sure it is called
529	* after ip_defrag. Is copy-on-write needed?	529	* after ip_defrag. Is copy-on-write needed?
530	*/	530	*/
531	skb = skb_share_check(skb, GFP_ATOMIC);	531	skb = skb_share_check(skb, GFP_ATOMIC);
532	if (unlikely(skb == NULL)) {	532	if (unlikely(skb == NULL)) {
533	dst_release(&rt->dst);	533	dst_release(&rt->dst);
534	return NF_STOLEN;	534	return NF_STOLEN;
535	}	535	}
536		536
537	/* drop old route */	537	/* drop old route */
538	skb_dst_drop(skb);	538	skb_dst_drop(skb);
539	skb_dst_set(skb, &rt->dst);	539	skb_dst_set(skb, &rt->dst);
540		540
541	/* Another hack: avoid icmp_send in ip_fragment */	541	/* Another hack: avoid icmp_send in ip_fragment */
542	skb->local_df = 1;	542	skb->local_df = 1;
543		543
544	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 0);	544	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 0);
545		545
546	LeaveFunction(10);	546	LeaveFunction(10);
547	return NF_STOLEN;	547	return NF_STOLEN;
548		548
549	tx_error_icmp:	549	tx_error_icmp:
550	dst_link_failure(skb);	550	dst_link_failure(skb);
551	tx_error:	551	tx_error:
552	kfree_skb(skb);	552	kfree_skb(skb);
553	LeaveFunction(10);	553	LeaveFunction(10);
554	return NF_STOLEN;	554	return NF_STOLEN;
555	}	555	}
556	#endif	556	#endif
557		557
558	/*	558	/*
559	* NAT transmitter (only for outside-to-inside nat forwarding)	559	* NAT transmitter (only for outside-to-inside nat forwarding)
560	* Not used for related ICMP	560	* Not used for related ICMP
561	*/	561	*/
562	int	562	int
563	ip_vs_nat_xmit(struct sk_buff skb, struct ip_vs_conn cp,	563	ip_vs_nat_xmit(struct sk_buff skb, struct ip_vs_conn cp,
564	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)	564	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)
565	{	565	{
566	struct rtable rt; / Route to the other host */	566	struct rtable rt; / Route to the other host */
567	int mtu;	567	int mtu;
568	struct iphdr *iph = ip_hdr(skb);	568	struct iphdr *iph = ip_hdr(skb);
569	int local;	569	int local;
570		570
571	EnterFunction(10);	571	EnterFunction(10);
572		572
573	/* check if it is a connection of no-client-port */	573	/* check if it is a connection of no-client-port */
574	if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {	574	if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {
575	__be16 _pt, *p;	575	__be16 _pt, *p;
576	p = skb_header_pointer(skb, iph->ihl*4, sizeof(_pt), &_pt);	576	p = skb_header_pointer(skb, iph->ihl*4, sizeof(_pt), &_pt);
577	if (p == NULL)	577	if (p == NULL)
578	goto tx_error;	578	goto tx_error;
579	ip_vs_conn_fill_cport(cp, *p);	579	ip_vs_conn_fill_cport(cp, *p);
580	IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p));	580	IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p));
581	}	581	}
582		582
583	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,	583	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
584	RT_TOS(iph->tos),	584	RT_TOS(iph->tos),
585	IP_VS_RT_MODE_LOCAL \|	585	IP_VS_RT_MODE_LOCAL \|
586	IP_VS_RT_MODE_NON_LOCAL \|	586	IP_VS_RT_MODE_NON_LOCAL \|
587	IP_VS_RT_MODE_RDR, NULL)))	587	IP_VS_RT_MODE_RDR, NULL)))
588	goto tx_error_icmp;	588	goto tx_error_icmp;
589	local = rt->rt_flags & RTCF_LOCAL;	589	local = rt->rt_flags & RTCF_LOCAL;
590	/*	590	/*
591	* Avoid duplicate tuple in reply direction for NAT traffic	591	* Avoid duplicate tuple in reply direction for NAT traffic
592	* to local address when connection is sync-ed	592	* to local address when connection is sync-ed
593	*/	593	*/
594	#if IS_ENABLED(CONFIG_NF_CONNTRACK)	594	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
595	if (cp->flags & IP_VS_CONN_F_SYNC && local) {	595	if (cp->flags & IP_VS_CONN_F_SYNC && local) {
596	enum ip_conntrack_info ctinfo;	596	enum ip_conntrack_info ctinfo;
597	struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);	597	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
598		598
599	if (ct && !nf_ct_is_untracked(ct)) {	599	if (ct && !nf_ct_is_untracked(ct)) {
600	IP_VS_DBG_RL_PKT(10, AF_INET, pp, skb, 0,	600	IP_VS_DBG_RL_PKT(10, AF_INET, pp, skb, 0,
601	"ip_vs_nat_xmit(): "	601	"ip_vs_nat_xmit(): "
602	"stopping DNAT to local address");	602	"stopping DNAT to local address");
603	goto tx_error_put;	603	goto tx_error_put;
604	}	604	}
605	}	605	}
606	#endif	606	#endif
607		607
608	/* From world but DNAT to loopback address? */	608	/* From world but DNAT to loopback address? */
609	if (local && ipv4_is_loopback(cp->daddr.ip) &&	609	if (local && ipv4_is_loopback(cp->daddr.ip) &&
610	rt_is_input_route(skb_rtable(skb))) {	610	rt_is_input_route(skb_rtable(skb))) {
611	IP_VS_DBG_RL_PKT(1, AF_INET, pp, skb, 0, "ip_vs_nat_xmit(): "	611	IP_VS_DBG_RL_PKT(1, AF_INET, pp, skb, 0, "ip_vs_nat_xmit(): "
612	"stopping DNAT to loopback address");	612	"stopping DNAT to loopback address");
613	goto tx_error_put;	613	goto tx_error_put;
614	}	614	}
615		615
616	/* MTU checking */	616	/* MTU checking */
617	mtu = dst_mtu(&rt->dst);	617	mtu = dst_mtu(&rt->dst);
618	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&	618	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&
619	!skb_is_gso(skb)) {	619	!skb_is_gso(skb)) {
620	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));	620	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
621	IP_VS_DBG_RL_PKT(0, AF_INET, pp, skb, 0,	621	IP_VS_DBG_RL_PKT(0, AF_INET, pp, skb, 0,
622	"ip_vs_nat_xmit(): frag needed for");	622	"ip_vs_nat_xmit(): frag needed for");
623	goto tx_error_put;	623	goto tx_error_put;
624	}	624	}
625		625
626	/* copy-on-write the packet before mangling it */	626	/* copy-on-write the packet before mangling it */
627	if (!skb_make_writable(skb, sizeof(struct iphdr)))	627	if (!skb_make_writable(skb, sizeof(struct iphdr)))
628	goto tx_error_put;	628	goto tx_error_put;
629		629
630	if (skb_cow(skb, rt->dst.dev->hard_header_len))	630	if (skb_cow(skb, rt->dst.dev->hard_header_len))
631	goto tx_error_put;	631	goto tx_error_put;
632		632
633	/* mangle the packet */	633	/* mangle the packet */
634	if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp, ipvsh))	634	if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp, ipvsh))
635	goto tx_error_put;	635	goto tx_error_put;
636	ip_hdr(skb)->daddr = cp->daddr.ip;	636	ip_hdr(skb)->daddr = cp->daddr.ip;
637	ip_send_check(ip_hdr(skb));	637	ip_send_check(ip_hdr(skb));
638		638
639	if (!local) {	639	if (!local) {
640	/* drop old route */	640	/* drop old route */
641	skb_dst_drop(skb);	641	skb_dst_drop(skb);
642	skb_dst_set(skb, &rt->dst);	642	skb_dst_set(skb, &rt->dst);
643	} else {	643	} else {
644	ip_rt_put(rt);	644	ip_rt_put(rt);
645	/*	645	/*
646	* Some IPv4 replies get local address from routes,	646	* Some IPv4 replies get local address from routes,
647	* not from iph, so while we DNAT after routing	647	* not from iph, so while we DNAT after routing
648	* we need this second input/output route.	648	* we need this second input/output route.
649	*/	649	*/
650	if (!__ip_vs_reroute_locally(skb))	650	if (!__ip_vs_reroute_locally(skb))
651	goto tx_error;	651	goto tx_error;
652	}	652	}
653		653
654	IP_VS_DBG_PKT(10, AF_INET, pp, skb, 0, "After DNAT");	654	IP_VS_DBG_PKT(10, AF_INET, pp, skb, 0, "After DNAT");
655		655
656	/* FIXME: when application helper enlarges the packet and the length	656	/* FIXME: when application helper enlarges the packet and the length
657	is larger than the MTU of outgoing device, there will be still	657	is larger than the MTU of outgoing device, there will be still
658	MTU problem. */	658	MTU problem. */
659		659
660	/* Another hack: avoid icmp_send in ip_fragment */	660	/* Another hack: avoid icmp_send in ip_fragment */
661	skb->local_df = 1;	661	skb->local_df = 1;
662		662
663	IP_VS_XMIT_NAT(NFPROTO_IPV4, skb, cp, local);	663	IP_VS_XMIT_NAT(NFPROTO_IPV4, skb, cp, local);
664		664
665	LeaveFunction(10);	665	LeaveFunction(10);
666	return NF_STOLEN;	666	return NF_STOLEN;
667		667
668	tx_error_icmp:	668	tx_error_icmp:
669	dst_link_failure(skb);	669	dst_link_failure(skb);
670	tx_error:	670	tx_error:
671	kfree_skb(skb);	671	kfree_skb(skb);
672	LeaveFunction(10);	672	LeaveFunction(10);
673	return NF_STOLEN;	673	return NF_STOLEN;
674	tx_error_put:	674	tx_error_put:
675	ip_rt_put(rt);	675	ip_rt_put(rt);
676	goto tx_error;	676	goto tx_error;
677	}	677	}
678		678
679	#ifdef CONFIG_IP_VS_IPV6	679	#ifdef CONFIG_IP_VS_IPV6
680	int	680	int
681	ip_vs_nat_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,	681	ip_vs_nat_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
682	struct ip_vs_protocol pp, struct ip_vs_iphdr iph)	682	struct ip_vs_protocol pp, struct ip_vs_iphdr iph)
683	{	683	{
684	struct rt6_info rt; / Route to the other host */	684	struct rt6_info rt; / Route to the other host */
685	int mtu;	685	int mtu;
686	int local;	686	int local;
687		687
688	EnterFunction(10);	688	EnterFunction(10);
689		689
690	/* check if it is a connection of no-client-port */	690	/* check if it is a connection of no-client-port */
691	if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT && !iph->fragoffs)) {	691	if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT && !iph->fragoffs)) {
692	__be16 _pt, *p;	692	__be16 _pt, *p;
693	p = skb_header_pointer(skb, iph->len, sizeof(_pt), &_pt);	693	p = skb_header_pointer(skb, iph->len, sizeof(_pt), &_pt);
694	if (p == NULL)	694	if (p == NULL)
695	goto tx_error;	695	goto tx_error;
696	ip_vs_conn_fill_cport(cp, *p);	696	ip_vs_conn_fill_cport(cp, *p);
697	IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p));	697	IP_VS_DBG(10, "filled cport=%d\n", ntohs(*p));
698	}	698	}
699		699
700	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,	700	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
701	0, (IP_VS_RT_MODE_LOCAL \|	701	0, (IP_VS_RT_MODE_LOCAL \|
702	IP_VS_RT_MODE_NON_LOCAL \|	702	IP_VS_RT_MODE_NON_LOCAL \|
703	IP_VS_RT_MODE_RDR))))	703	IP_VS_RT_MODE_RDR))))
704	goto tx_error_icmp;	704	goto tx_error_icmp;
705	local = __ip_vs_is_local_route6(rt);	705	local = __ip_vs_is_local_route6(rt);
706	/*	706	/*
707	* Avoid duplicate tuple in reply direction for NAT traffic	707	* Avoid duplicate tuple in reply direction for NAT traffic
708	* to local address when connection is sync-ed	708	* to local address when connection is sync-ed
709	*/	709	*/
710	#if IS_ENABLED(CONFIG_NF_CONNTRACK)	710	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
711	if (cp->flags & IP_VS_CONN_F_SYNC && local) {	711	if (cp->flags & IP_VS_CONN_F_SYNC && local) {
712	enum ip_conntrack_info ctinfo;	712	enum ip_conntrack_info ctinfo;
713	struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);	713	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
714		714
715	if (ct && !nf_ct_is_untracked(ct)) {	715	if (ct && !nf_ct_is_untracked(ct)) {
716	IP_VS_DBG_RL_PKT(10, AF_INET6, pp, skb, 0,	716	IP_VS_DBG_RL_PKT(10, AF_INET6, pp, skb, 0,
717	"ip_vs_nat_xmit_v6(): "	717	"ip_vs_nat_xmit_v6(): "
718	"stopping DNAT to local address");	718	"stopping DNAT to local address");
719	goto tx_error_put;	719	goto tx_error_put;
720	}	720	}
721	}	721	}
722	#endif	722	#endif
723		723
724	/* From world but DNAT to loopback address? */	724	/* From world but DNAT to loopback address? */
725	if (local && skb->dev && !(skb->dev->flags & IFF_LOOPBACK) &&	725	if (local && skb->dev && !(skb->dev->flags & IFF_LOOPBACK) &&
726	ipv6_addr_type(&rt->rt6i_dst.addr) & IPV6_ADDR_LOOPBACK) {	726	ipv6_addr_type(&rt->rt6i_dst.addr) & IPV6_ADDR_LOOPBACK) {
727	IP_VS_DBG_RL_PKT(1, AF_INET6, pp, skb, 0,	727	IP_VS_DBG_RL_PKT(1, AF_INET6, pp, skb, 0,
728	"ip_vs_nat_xmit_v6(): "	728	"ip_vs_nat_xmit_v6(): "
729	"stopping DNAT to loopback address");	729	"stopping DNAT to loopback address");
730	goto tx_error_put;	730	goto tx_error_put;
731	}	731	}
732		732
733	/* MTU checking */	733	/* MTU checking */
734	mtu = dst_mtu(&rt->dst);	734	mtu = dst_mtu(&rt->dst);
735	if (__mtu_check_toobig_v6(skb, mtu)) {	735	if (__mtu_check_toobig_v6(skb, mtu)) {
736	if (!skb->dev) {	736	if (!skb->dev) {
737	struct net *net = dev_net(skb_dst(skb)->dev);	737	struct net *net = dev_net(skb_dst(skb)->dev);
738		738
739	skb->dev = net->loopback_dev;	739	skb->dev = net->loopback_dev;
740	}	740	}
741	/* only send ICMP too big on first fragment */	741	/* only send ICMP too big on first fragment */
742	if (!iph->fragoffs)	742	if (!iph->fragoffs)
743	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	743	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
744	IP_VS_DBG_RL_PKT(0, AF_INET6, pp, skb, 0,	744	IP_VS_DBG_RL_PKT(0, AF_INET6, pp, skb, 0,
745	"ip_vs_nat_xmit_v6(): frag needed for");	745	"ip_vs_nat_xmit_v6(): frag needed for");
746	goto tx_error_put;	746	goto tx_error_put;
747	}	747	}
748		748
749	/* copy-on-write the packet before mangling it */	749	/* copy-on-write the packet before mangling it */
750	if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))	750	if (!skb_make_writable(skb, sizeof(struct ipv6hdr)))
751	goto tx_error_put;	751	goto tx_error_put;
752		752
753	if (skb_cow(skb, rt->dst.dev->hard_header_len))	753	if (skb_cow(skb, rt->dst.dev->hard_header_len))
754	goto tx_error_put;	754	goto tx_error_put;
755		755
756	/* mangle the packet */	756	/* mangle the packet */
757	if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp, iph))	757	if (pp->dnat_handler && !pp->dnat_handler(skb, pp, cp, iph))
758	goto tx_error;	758	goto tx_error;
759	ipv6_hdr(skb)->daddr = cp->daddr.in6;	759	ipv6_hdr(skb)->daddr = cp->daddr.in6;
760		760
761	if (!local \|\| !skb->dev) {	761	if (!local \|\| !skb->dev) {
762	/* drop the old route when skb is not shared */	762	/* drop the old route when skb is not shared */
763	skb_dst_drop(skb);	763	skb_dst_drop(skb);
764	skb_dst_set(skb, &rt->dst);	764	skb_dst_set(skb, &rt->dst);
765	} else {	765	} else {
766	/* destined to loopback, do we need to change route? */	766	/* destined to loopback, do we need to change route? */
767	dst_release(&rt->dst);	767	dst_release(&rt->dst);
768	}	768	}
769		769
770	IP_VS_DBG_PKT(10, AF_INET6, pp, skb, 0, "After DNAT");	770	IP_VS_DBG_PKT(10, AF_INET6, pp, skb, 0, "After DNAT");
771		771
772	/* FIXME: when application helper enlarges the packet and the length	772	/* FIXME: when application helper enlarges the packet and the length
773	is larger than the MTU of outgoing device, there will be still	773	is larger than the MTU of outgoing device, there will be still
774	MTU problem. */	774	MTU problem. */
775		775
776	/* Another hack: avoid icmp_send in ip_fragment */	776	/* Another hack: avoid icmp_send in ip_fragment */
777	skb->local_df = 1;	777	skb->local_df = 1;
778		778
779	IP_VS_XMIT_NAT(NFPROTO_IPV6, skb, cp, local);	779	IP_VS_XMIT_NAT(NFPROTO_IPV6, skb, cp, local);
780		780
781	LeaveFunction(10);	781	LeaveFunction(10);
782	return NF_STOLEN;	782	return NF_STOLEN;
783		783
784	tx_error_icmp:	784	tx_error_icmp:
785	dst_link_failure(skb);	785	dst_link_failure(skb);
786	tx_error:	786	tx_error:
787	LeaveFunction(10);	787	LeaveFunction(10);
788	kfree_skb(skb);	788	kfree_skb(skb);
789	return NF_STOLEN;	789	return NF_STOLEN;
790	tx_error_put:	790	tx_error_put:
791	dst_release(&rt->dst);	791	dst_release(&rt->dst);
792	goto tx_error;	792	goto tx_error;
793	}	793	}
794	#endif	794	#endif
795		795
796		796
797	/*	797	/*
798	* IP Tunneling transmitter	798	* IP Tunneling transmitter
799	*	799	*
800	* This function encapsulates the packet in a new IP packet, its	800	* This function encapsulates the packet in a new IP packet, its
801	* destination will be set to cp->daddr. Most code of this function	801	* destination will be set to cp->daddr. Most code of this function
802	* is taken from ipip.c.	802	* is taken from ipip.c.
803	*	803	*
804	* It is used in VS/TUN cluster. The load balancer selects a real	804	* It is used in VS/TUN cluster. The load balancer selects a real
805	* server from a cluster based on a scheduling algorithm,	805	* server from a cluster based on a scheduling algorithm,
806	* encapsulates the request packet and forwards it to the selected	806	* encapsulates the request packet and forwards it to the selected
807	* server. For example, all real servers are configured with	807	* server. For example, all real servers are configured with
808	* "ifconfig tunl0 <Virtual IP Address> up". When the server receives	808	* "ifconfig tunl0 <Virtual IP Address> up". When the server receives
809	* the encapsulated packet, it will decapsulate the packet, processe	809	* the encapsulated packet, it will decapsulate the packet, processe
810	* the request and return the response packets directly to the client	810	* the request and return the response packets directly to the client
811	* without passing the load balancer. This can greatly increase the	811	* without passing the load balancer. This can greatly increase the
812	* scalability of virtual server.	812	* scalability of virtual server.
813	*	813	*
814	* Used for ANY protocol	814	* Used for ANY protocol
815	*/	815	*/
816	int	816	int
817	ip_vs_tunnel_xmit(struct sk_buff skb, struct ip_vs_conn cp,	817	ip_vs_tunnel_xmit(struct sk_buff skb, struct ip_vs_conn cp,
818	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)	818	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)
819	{	819	{
820	struct netns_ipvs *ipvs = net_ipvs(skb_net(skb));	820	struct netns_ipvs *ipvs = net_ipvs(skb_net(skb));
821	struct rtable rt; / Route to the other host */	821	struct rtable rt; / Route to the other host */
822	__be32 saddr; /* Source for tunnel */	822	__be32 saddr; /* Source for tunnel */
823	struct net_device tdev; / Device to other host */	823	struct net_device tdev; / Device to other host */
824	struct iphdr *old_iph = ip_hdr(skb);	824	struct iphdr *old_iph = ip_hdr(skb);
825	u8 tos = old_iph->tos;	825	u8 tos = old_iph->tos;
826	__be16 df;	826	__be16 df;
827	struct iphdr iph; / Our new IP header */	827	struct iphdr iph; / Our new IP header */
828	unsigned int max_headroom; /* The extra header space needed */	828	unsigned int max_headroom; /* The extra header space needed */
829	int mtu;	829	int mtu;
830	int ret;	830	int ret;
831		831
832	EnterFunction(10);	832	EnterFunction(10);
833		833
834	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,	834	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
835	RT_TOS(tos), IP_VS_RT_MODE_LOCAL \|	835	RT_TOS(tos), IP_VS_RT_MODE_LOCAL \|
836	IP_VS_RT_MODE_NON_LOCAL \|	836	IP_VS_RT_MODE_NON_LOCAL \|
837	IP_VS_RT_MODE_CONNECT,	837	IP_VS_RT_MODE_CONNECT,
838	&saddr)))	838	&saddr)))
839	goto tx_error_icmp;	839	goto tx_error_icmp;
840	if (rt->rt_flags & RTCF_LOCAL) {	840	if (rt->rt_flags & RTCF_LOCAL) {
841	ip_rt_put(rt);	841	ip_rt_put(rt);
842	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);	842	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);
843	}	843	}
844		844
845	tdev = rt->dst.dev;	845	tdev = rt->dst.dev;
846		846
847	mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr);	847	mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr);
848	if (mtu < 68) {	848	if (mtu < 68) {
849	IP_VS_DBG_RL("%s(): mtu less than 68\n", __func__);	849	IP_VS_DBG_RL("%s(): mtu less than 68\n", __func__);
850	goto tx_error_put;	850	goto tx_error_put;
851	}	851	}
852	if (rt_is_output_route(skb_rtable(skb)))	852	if (rt_is_output_route(skb_rtable(skb)))
853	skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);	853	skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
854		854
855	/* Copy DF, reset fragment offset and MF */	855	/* Copy DF, reset fragment offset and MF */
856	df = sysctl_pmtu_disc(ipvs) ? old_iph->frag_off & htons(IP_DF) : 0;	856	df = sysctl_pmtu_disc(ipvs) ? old_iph->frag_off & htons(IP_DF) : 0;
857		857
858	if (df && mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb)) {	858	if (df && mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb)) {
859	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));	859	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
860	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	860	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
861	goto tx_error_put;	861	goto tx_error_put;
862	}	862	}
863		863
864	/*	864	/*
865	* Okay, now see if we can stuff it in the buffer as-is.	865	* Okay, now see if we can stuff it in the buffer as-is.
866	*/	866	*/
867	max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct iphdr);	867	max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct iphdr);
868		868
869	if (skb_headroom(skb) < max_headroom	869	if (skb_headroom(skb) < max_headroom
870	\|\| skb_cloned(skb) \|\| skb_shared(skb)) {	870	\|\| skb_cloned(skb) \|\| skb_shared(skb)) {
871	struct sk_buff *new_skb =	871	struct sk_buff *new_skb =
872	skb_realloc_headroom(skb, max_headroom);	872	skb_realloc_headroom(skb, max_headroom);
873	if (!new_skb) {	873	if (!new_skb) {
874	ip_rt_put(rt);	874	ip_rt_put(rt);
875	kfree_skb(skb);	875	kfree_skb(skb);
876	IP_VS_ERR_RL("%s(): no memory\n", __func__);	876	IP_VS_ERR_RL("%s(): no memory\n", __func__);
877	return NF_STOLEN;	877	return NF_STOLEN;
878	}	878	}
879	consume_skb(skb);	879	consume_skb(skb);
880	skb = new_skb;	880	skb = new_skb;
881	old_iph = ip_hdr(skb);	881	old_iph = ip_hdr(skb);
882	}	882	}
883		883
884	skb->transport_header = skb->network_header;	884	skb->transport_header = skb->network_header;
885		885
886	/* fix old IP header checksum */	886	/* fix old IP header checksum */
887	ip_send_check(old_iph);	887	ip_send_check(old_iph);
888		888
889	skb_push(skb, sizeof(struct iphdr));	889	skb_push(skb, sizeof(struct iphdr));
890	skb_reset_network_header(skb);	890	skb_reset_network_header(skb);
891	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));	891	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
892		892
893	/* drop old route */	893	/* drop old route */
894	skb_dst_drop(skb);	894	skb_dst_drop(skb);
895	skb_dst_set(skb, &rt->dst);	895	skb_dst_set(skb, &rt->dst);
896		896
897	/*	897	/*
898	* Push down and install the IPIP header.	898	* Push down and install the IPIP header.
899	*/	899	*/
900	iph = ip_hdr(skb);	900	iph = ip_hdr(skb);
901	iph->version = 4;	901	iph->version = 4;
902	iph->ihl = sizeof(struct iphdr)>>2;	902	iph->ihl = sizeof(struct iphdr)>>2;
903	iph->frag_off = df;	903	iph->frag_off = df;
904	iph->protocol = IPPROTO_IPIP;	904	iph->protocol = IPPROTO_IPIP;
905	iph->tos = tos;	905	iph->tos = tos;
906	iph->daddr = cp->daddr.ip;	906	iph->daddr = cp->daddr.ip;
907	iph->saddr = saddr;	907	iph->saddr = saddr;
908	iph->ttl = old_iph->ttl;	908	iph->ttl = old_iph->ttl;
909	ip_select_ident(iph, &rt->dst, NULL);	909	ip_select_ident(iph, &rt->dst, NULL);
910		910
911	/* Another hack: avoid icmp_send in ip_fragment */	911	/* Another hack: avoid icmp_send in ip_fragment */
912	skb->local_df = 1;	912	skb->local_df = 1;
913		913
914	ret = IP_VS_XMIT_TUNNEL(skb, cp);	914	ret = IP_VS_XMIT_TUNNEL(skb, cp);
915	if (ret == NF_ACCEPT)	915	if (ret == NF_ACCEPT)
916	ip_local_out(skb);	916	ip_local_out(skb);
917	else if (ret == NF_DROP)	917	else if (ret == NF_DROP)
918	kfree_skb(skb);	918	kfree_skb(skb);
919		919
920	LeaveFunction(10);	920	LeaveFunction(10);
921		921
922	return NF_STOLEN;	922	return NF_STOLEN;
923		923
924	tx_error_icmp:	924	tx_error_icmp:
925	dst_link_failure(skb);	925	dst_link_failure(skb);
926	tx_error:	926	tx_error:
927	kfree_skb(skb);	927	kfree_skb(skb);
928	LeaveFunction(10);	928	LeaveFunction(10);
929	return NF_STOLEN;	929	return NF_STOLEN;
930	tx_error_put:	930	tx_error_put:
931	ip_rt_put(rt);	931	ip_rt_put(rt);
932	goto tx_error;	932	goto tx_error;
933	}	933	}
934		934
935	#ifdef CONFIG_IP_VS_IPV6	935	#ifdef CONFIG_IP_VS_IPV6
936	int	936	int
937	ip_vs_tunnel_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,	937	ip_vs_tunnel_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
938	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)	938	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)
939	{	939	{
940	struct rt6_info rt; / Route to the other host */	940	struct rt6_info rt; / Route to the other host */
941	struct in6_addr saddr; /* Source for tunnel */	941	struct in6_addr saddr; /* Source for tunnel */
942	struct net_device tdev; / Device to other host */	942	struct net_device tdev; / Device to other host */
943	struct ipv6hdr *old_iph = ipv6_hdr(skb);	943	struct ipv6hdr *old_iph = ipv6_hdr(skb);
944	struct ipv6hdr iph; / Our new IP header */	944	struct ipv6hdr iph; / Our new IP header */
945	unsigned int max_headroom; /* The extra header space needed */	945	unsigned int max_headroom; /* The extra header space needed */
946	int mtu;	946	int mtu;
947	int ret;	947	int ret;
948		948
949	EnterFunction(10);	949	EnterFunction(10);
950		950
951	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6,	951	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6,
952	&saddr, 1, (IP_VS_RT_MODE_LOCAL \|	952	&saddr, 1, (IP_VS_RT_MODE_LOCAL \|
953	IP_VS_RT_MODE_NON_LOCAL))))	953	IP_VS_RT_MODE_NON_LOCAL))))
954	goto tx_error_icmp;	954	goto tx_error_icmp;
955	if (__ip_vs_is_local_route6(rt)) {	955	if (__ip_vs_is_local_route6(rt)) {
956	dst_release(&rt->dst);	956	dst_release(&rt->dst);
957	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 1);	957	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 1);
958	}	958	}
959		959
960	tdev = rt->dst.dev;	960	tdev = rt->dst.dev;
961		961
962	mtu = dst_mtu(&rt->dst) - sizeof(struct ipv6hdr);	962	mtu = dst_mtu(&rt->dst) - sizeof(struct ipv6hdr);
963	if (mtu < IPV6_MIN_MTU) {	963	if (mtu < IPV6_MIN_MTU) {
964	IP_VS_DBG_RL("%s(): mtu less than %d\n", __func__,	964	IP_VS_DBG_RL("%s(): mtu less than %d\n", __func__,
965	IPV6_MIN_MTU);	965	IPV6_MIN_MTU);
966	goto tx_error_put;	966	goto tx_error_put;
967	}	967	}
968	if (skb_dst(skb))	968	if (skb_dst(skb))
969	skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);	969	skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
970		970
971	/* MTU checking: Notice that 'mtu' have been adjusted before hand */	971	/* MTU checking: Notice that 'mtu' have been adjusted before hand */
972	if (__mtu_check_toobig_v6(skb, mtu)) {	972	if (__mtu_check_toobig_v6(skb, mtu)) {
973	if (!skb->dev) {	973	if (!skb->dev) {
974	struct net *net = dev_net(skb_dst(skb)->dev);	974	struct net *net = dev_net(skb_dst(skb)->dev);
975		975
976	skb->dev = net->loopback_dev;	976	skb->dev = net->loopback_dev;
977	}	977	}
978	/* only send ICMP too big on first fragment */	978	/* only send ICMP too big on first fragment */
979	if (!ipvsh->fragoffs)	979	if (!ipvsh->fragoffs)
980	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	980	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
981	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	981	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
982	goto tx_error_put;	982	goto tx_error_put;
983	}	983	}
984		984
985	/*	985	/*
986	* Okay, now see if we can stuff it in the buffer as-is.	986	* Okay, now see if we can stuff it in the buffer as-is.
987	*/	987	*/
988	max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct ipv6hdr);	988	max_headroom = LL_RESERVED_SPACE(tdev) + sizeof(struct ipv6hdr);
989		989
990	if (skb_headroom(skb) < max_headroom	990	if (skb_headroom(skb) < max_headroom
991	\|\| skb_cloned(skb) \|\| skb_shared(skb)) {	991	\|\| skb_cloned(skb) \|\| skb_shared(skb)) {
992	struct sk_buff *new_skb =	992	struct sk_buff *new_skb =
993	skb_realloc_headroom(skb, max_headroom);	993	skb_realloc_headroom(skb, max_headroom);
994	if (!new_skb) {	994	if (!new_skb) {
995	dst_release(&rt->dst);	995	dst_release(&rt->dst);
996	kfree_skb(skb);	996	kfree_skb(skb);
997	IP_VS_ERR_RL("%s(): no memory\n", __func__);	997	IP_VS_ERR_RL("%s(): no memory\n", __func__);
998	return NF_STOLEN;	998	return NF_STOLEN;
999	}	999	}
1000	consume_skb(skb);	1000	consume_skb(skb);
1001	skb = new_skb;	1001	skb = new_skb;
1002	old_iph = ipv6_hdr(skb);	1002	old_iph = ipv6_hdr(skb);
1003	}	1003	}
1004		1004
1005	skb->transport_header = skb->network_header;	1005	skb->transport_header = skb->network_header;
1006		1006
1007	skb_push(skb, sizeof(struct ipv6hdr));	1007	skb_push(skb, sizeof(struct ipv6hdr));
1008	skb_reset_network_header(skb);	1008	skb_reset_network_header(skb);
1009	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));	1009	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1010		1010
1011	/* drop old route */	1011	/* drop old route */
1012	skb_dst_drop(skb);	1012	skb_dst_drop(skb);
1013	skb_dst_set(skb, &rt->dst);	1013	skb_dst_set(skb, &rt->dst);
1014		1014
1015	/*	1015	/*
1016	* Push down and install the IPIP header.	1016	* Push down and install the IPIP header.
1017	*/	1017	*/
1018	iph = ipv6_hdr(skb);	1018	iph = ipv6_hdr(skb);
1019	iph->version = 6;	1019	iph->version = 6;
1020	iph->nexthdr = IPPROTO_IPV6;	1020	iph->nexthdr = IPPROTO_IPV6;
1021	iph->payload_len = old_iph->payload_len;	1021	iph->payload_len = old_iph->payload_len;
1022	be16_add_cpu(&iph->payload_len, sizeof(*old_iph));	1022	be16_add_cpu(&iph->payload_len, sizeof(*old_iph));
1023	iph->priority = old_iph->priority;	1023	iph->priority = old_iph->priority;
1024	memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl));	1024	memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl));
1025	iph->daddr = cp->daddr.in6;	1025	iph->daddr = cp->daddr.in6;
1026	iph->saddr = saddr;	1026	iph->saddr = saddr;
1027	iph->hop_limit = old_iph->hop_limit;	1027	iph->hop_limit = old_iph->hop_limit;
1028		1028
1029	/* Another hack: avoid icmp_send in ip_fragment */	1029	/* Another hack: avoid icmp_send in ip_fragment */
1030	skb->local_df = 1;	1030	skb->local_df = 1;
1031		1031
1032	ret = IP_VS_XMIT_TUNNEL(skb, cp);	1032	ret = IP_VS_XMIT_TUNNEL(skb, cp);
1033	if (ret == NF_ACCEPT)	1033	if (ret == NF_ACCEPT)
1034	ip6_local_out(skb);	1034	ip6_local_out(skb);
1035	else if (ret == NF_DROP)	1035	else if (ret == NF_DROP)
1036	kfree_skb(skb);	1036	kfree_skb(skb);
1037		1037
1038	LeaveFunction(10);	1038	LeaveFunction(10);
1039		1039
1040	return NF_STOLEN;	1040	return NF_STOLEN;
1041		1041
1042	tx_error_icmp:	1042	tx_error_icmp:
1043	dst_link_failure(skb);	1043	dst_link_failure(skb);
1044	tx_error:	1044	tx_error:
1045	kfree_skb(skb);	1045	kfree_skb(skb);
1046	LeaveFunction(10);	1046	LeaveFunction(10);
1047	return NF_STOLEN;	1047	return NF_STOLEN;
1048	tx_error_put:	1048	tx_error_put:
1049	dst_release(&rt->dst);	1049	dst_release(&rt->dst);
1050	goto tx_error;	1050	goto tx_error;
1051	}	1051	}
1052	#endif	1052	#endif
1053		1053
1054		1054
1055	/*	1055	/*
1056	* Direct Routing transmitter	1056	* Direct Routing transmitter
1057	* Used for ANY protocol	1057	* Used for ANY protocol
1058	*/	1058	*/
1059	int	1059	int
1060	ip_vs_dr_xmit(struct sk_buff skb, struct ip_vs_conn cp,	1060	ip_vs_dr_xmit(struct sk_buff skb, struct ip_vs_conn cp,
1061	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)	1061	struct ip_vs_protocol pp, struct ip_vs_iphdr ipvsh)
1062	{	1062	{
1063	struct rtable rt; / Route to the other host */	1063	struct rtable rt; / Route to the other host */
1064	struct iphdr *iph = ip_hdr(skb);	1064	struct iphdr *iph = ip_hdr(skb);
1065	int mtu;	1065	int mtu;
1066		1066
1067	EnterFunction(10);	1067	EnterFunction(10);
1068		1068
1069	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,	1069	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
1070	RT_TOS(iph->tos),	1070	RT_TOS(iph->tos),
1071	IP_VS_RT_MODE_LOCAL \|	1071	IP_VS_RT_MODE_LOCAL \|
1072	IP_VS_RT_MODE_NON_LOCAL \|	1072	IP_VS_RT_MODE_NON_LOCAL \|
1073	IP_VS_RT_MODE_KNOWN_NH, NULL)))	1073	IP_VS_RT_MODE_KNOWN_NH, NULL)))
1074	goto tx_error_icmp;	1074	goto tx_error_icmp;
1075	if (rt->rt_flags & RTCF_LOCAL) {	1075	if (rt->rt_flags & RTCF_LOCAL) {
1076	ip_rt_put(rt);	1076	ip_rt_put(rt);
1077	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);	1077	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 1);
1078	}	1078	}
1079		1079
1080	/* MTU checking */	1080	/* MTU checking */
1081	mtu = dst_mtu(&rt->dst);	1081	mtu = dst_mtu(&rt->dst);
1082	if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu &&	1082	if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu &&
1083	!skb_is_gso(skb)) {	1083	!skb_is_gso(skb)) {
1084	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));	1084	icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
1085	ip_rt_put(rt);	1085	ip_rt_put(rt);
1086	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	1086	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1087	goto tx_error;	1087	goto tx_error;
1088	}	1088	}
1089		1089
1090	/*	1090	/*
1091	* Call ip_send_check because we are not sure it is called	1091	* Call ip_send_check because we are not sure it is called
1092	* after ip_defrag. Is copy-on-write needed?	1092	* after ip_defrag. Is copy-on-write needed?
1093	*/	1093	*/
1094	if (unlikely((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)) {	1094	if (unlikely((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)) {
1095	ip_rt_put(rt);	1095	ip_rt_put(rt);
1096	return NF_STOLEN;	1096	return NF_STOLEN;
1097	}	1097	}
1098	ip_send_check(ip_hdr(skb));	1098	ip_send_check(ip_hdr(skb));
1099		1099
1100	/* drop old route */	1100	/* drop old route */
1101	skb_dst_drop(skb);	1101	skb_dst_drop(skb);
1102	skb_dst_set(skb, &rt->dst);	1102	skb_dst_set(skb, &rt->dst);
1103		1103
1104	/* Another hack: avoid icmp_send in ip_fragment */	1104	/* Another hack: avoid icmp_send in ip_fragment */
1105	skb->local_df = 1;	1105	skb->local_df = 1;
1106		1106
1107	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 0);	1107	IP_VS_XMIT(NFPROTO_IPV4, skb, cp, 0);
1108		1108
1109	LeaveFunction(10);	1109	LeaveFunction(10);
1110	return NF_STOLEN;	1110	return NF_STOLEN;
1111		1111
1112	tx_error_icmp:	1112	tx_error_icmp:
1113	dst_link_failure(skb);	1113	dst_link_failure(skb);
1114	tx_error:	1114	tx_error:
1115	kfree_skb(skb);	1115	kfree_skb(skb);
1116	LeaveFunction(10);	1116	LeaveFunction(10);
1117	return NF_STOLEN;	1117	return NF_STOLEN;
1118	}	1118	}
1119		1119
1120	#ifdef CONFIG_IP_VS_IPV6	1120	#ifdef CONFIG_IP_VS_IPV6
1121	int	1121	int
1122	ip_vs_dr_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,	1122	ip_vs_dr_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
1123	struct ip_vs_protocol pp, struct ip_vs_iphdr iph)	1123	struct ip_vs_protocol pp, struct ip_vs_iphdr iph)
1124	{	1124	{
1125	struct rt6_info rt; / Route to the other host */	1125	struct rt6_info rt; / Route to the other host */
1126	int mtu;	1126	int mtu;
1127		1127
1128	EnterFunction(10);	1128	EnterFunction(10);
1129		1129
1130	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,	1130	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
1131	0, (IP_VS_RT_MODE_LOCAL \|	1131	0, (IP_VS_RT_MODE_LOCAL \|
1132	IP_VS_RT_MODE_NON_LOCAL))))	1132	IP_VS_RT_MODE_NON_LOCAL))))
1133	goto tx_error_icmp;	1133	goto tx_error_icmp;
1134	if (__ip_vs_is_local_route6(rt)) {	1134	if (__ip_vs_is_local_route6(rt)) {
1135	dst_release(&rt->dst);	1135	dst_release(&rt->dst);
1136	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 1);	1136	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 1);
1137	}	1137	}
1138		1138
1139	/* MTU checking */	1139	/* MTU checking */
1140	mtu = dst_mtu(&rt->dst);	1140	mtu = dst_mtu(&rt->dst);
1141	if (__mtu_check_toobig_v6(skb, mtu)) {	1141	if (__mtu_check_toobig_v6(skb, mtu)) {
1142	if (!skb->dev) {	1142	if (!skb->dev) {
1143	struct net *net = dev_net(skb_dst(skb)->dev);	1143	struct net *net = dev_net(skb_dst(skb)->dev);
1144		1144
1145	skb->dev = net->loopback_dev;	1145	skb->dev = net->loopback_dev;
1146	}	1146	}
1147	/* only send ICMP too big on first fragment */	1147	/* only send ICMP too big on first fragment */
1148	if (!iph->fragoffs)	1148	if (!iph->fragoffs)
1149	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	1149	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1150	dst_release(&rt->dst);	1150	dst_release(&rt->dst);
1151	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	1151	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1152	goto tx_error;	1152	goto tx_error;
1153	}	1153	}
1154		1154
1155	/*	1155	/*
1156	* Call ip_send_check because we are not sure it is called	1156	* Call ip_send_check because we are not sure it is called
1157	* after ip_defrag. Is copy-on-write needed?	1157	* after ip_defrag. Is copy-on-write needed?
1158	*/	1158	*/
1159	skb = skb_share_check(skb, GFP_ATOMIC);	1159	skb = skb_share_check(skb, GFP_ATOMIC);
1160	if (unlikely(skb == NULL)) {	1160	if (unlikely(skb == NULL)) {
1161	dst_release(&rt->dst);	1161	dst_release(&rt->dst);
1162	return NF_STOLEN;	1162	return NF_STOLEN;
1163	}	1163	}
1164		1164
1165	/* drop old route */	1165	/* drop old route */
1166	skb_dst_drop(skb);	1166	skb_dst_drop(skb);
1167	skb_dst_set(skb, &rt->dst);	1167	skb_dst_set(skb, &rt->dst);
1168		1168
1169	/* Another hack: avoid icmp_send in ip_fragment */	1169	/* Another hack: avoid icmp_send in ip_fragment */
1170	skb->local_df = 1;	1170	skb->local_df = 1;
1171		1171
1172	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 0);	1172	IP_VS_XMIT(NFPROTO_IPV6, skb, cp, 0);
1173		1173
1174	LeaveFunction(10);	1174	LeaveFunction(10);
1175	return NF_STOLEN;	1175	return NF_STOLEN;
1176		1176
1177	tx_error_icmp:	1177	tx_error_icmp:
1178	dst_link_failure(skb);	1178	dst_link_failure(skb);
1179	tx_error:	1179	tx_error:
1180	kfree_skb(skb);	1180	kfree_skb(skb);
1181	LeaveFunction(10);	1181	LeaveFunction(10);
1182	return NF_STOLEN;	1182	return NF_STOLEN;
1183	}	1183	}
1184	#endif	1184	#endif
1185		1185
1186		1186
1187	/*	1187	/*
1188	* ICMP packet transmitter	1188	* ICMP packet transmitter
1189	* called by the ip_vs_in_icmp	1189	* called by the ip_vs_in_icmp
1190	*/	1190	*/
1191	int	1191	int
1192	ip_vs_icmp_xmit(struct sk_buff skb, struct ip_vs_conn cp,	1192	ip_vs_icmp_xmit(struct sk_buff skb, struct ip_vs_conn cp,
1193	struct ip_vs_protocol *pp, int offset, unsigned int hooknum,	1193	struct ip_vs_protocol *pp, int offset, unsigned int hooknum,
1194	struct ip_vs_iphdr *iph)	1194	struct ip_vs_iphdr *iph)
1195	{	1195	{
1196	struct rtable rt; / Route to the other host */	1196	struct rtable rt; / Route to the other host */
1197	int mtu;	1197	int mtu;
1198	int rc;	1198	int rc;
1199	int local;	1199	int local;
1200	int rt_mode;	1200	int rt_mode;
1201		1201
1202	EnterFunction(10);	1202	EnterFunction(10);
1203		1203
1204	/* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be	1204	/* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
1205	forwarded directly here, because there is no need to	1205	forwarded directly here, because there is no need to
1206	translate address/port back */	1206	translate address/port back */
1207	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {	1207	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
1208	if (cp->packet_xmit)	1208	if (cp->packet_xmit)
1209	rc = cp->packet_xmit(skb, cp, pp, iph);	1209	rc = cp->packet_xmit(skb, cp, pp, iph);
1210	else	1210	else
1211	rc = NF_ACCEPT;	1211	rc = NF_ACCEPT;
1212	/* do not touch skb anymore */	1212	/* do not touch skb anymore */
1213	atomic_inc(&cp->in_pkts);	1213	atomic_inc(&cp->in_pkts);
1214	goto out;	1214	goto out;
1215	}	1215	}
1216		1216
1217	/*	1217	/*
1218	* mangle and send the packet here (only for VS/NAT)	1218	* mangle and send the packet here (only for VS/NAT)
1219	*/	1219	*/
1220		1220
1221	/* LOCALNODE from FORWARD hook is not supported */	1221	/* LOCALNODE from FORWARD hook is not supported */
1222	rt_mode = (hooknum != NF_INET_FORWARD) ?	1222	rt_mode = (hooknum != NF_INET_FORWARD) ?
1223	IP_VS_RT_MODE_LOCAL \| IP_VS_RT_MODE_NON_LOCAL \|	1223	IP_VS_RT_MODE_LOCAL \| IP_VS_RT_MODE_NON_LOCAL \|
1224	IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;	1224	IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;
1225	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,	1225	if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
1226	RT_TOS(ip_hdr(skb)->tos),	1226	RT_TOS(ip_hdr(skb)->tos),
1227	rt_mode, NULL)))	1227	rt_mode, NULL)))
1228	goto tx_error_icmp;	1228	goto tx_error_icmp;
1229	local = rt->rt_flags & RTCF_LOCAL;	1229	local = rt->rt_flags & RTCF_LOCAL;
1230		1230
1231	/*	1231	/*
1232	* Avoid duplicate tuple in reply direction for NAT traffic	1232	* Avoid duplicate tuple in reply direction for NAT traffic
1233	* to local address when connection is sync-ed	1233	* to local address when connection is sync-ed
1234	*/	1234	*/
1235	#if IS_ENABLED(CONFIG_NF_CONNTRACK)	1235	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
1236	if (cp->flags & IP_VS_CONN_F_SYNC && local) {	1236	if (cp->flags & IP_VS_CONN_F_SYNC && local) {
1237	enum ip_conntrack_info ctinfo;	1237	enum ip_conntrack_info ctinfo;
1238	struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);	1238	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1239		1239
1240	if (ct && !nf_ct_is_untracked(ct)) {	1240	if (ct && !nf_ct_is_untracked(ct)) {
1241	IP_VS_DBG(10, "%s(): "	1241	IP_VS_DBG(10, "%s(): "
1242	"stopping DNAT to local address %pI4\n",	1242	"stopping DNAT to local address %pI4\n",
1243	__func__, &cp->daddr.ip);	1243	__func__, &cp->daddr.ip);
1244	goto tx_error_put;	1244	goto tx_error_put;
1245	}	1245	}
1246	}	1246	}
1247	#endif	1247	#endif
1248		1248
1249	/* From world but DNAT to loopback address? */	1249	/* From world but DNAT to loopback address? */
1250	if (local && ipv4_is_loopback(cp->daddr.ip) &&	1250	if (local && ipv4_is_loopback(cp->daddr.ip) &&
1251	rt_is_input_route(skb_rtable(skb))) {	1251	rt_is_input_route(skb_rtable(skb))) {
1252	IP_VS_DBG(1, "%s(): "	1252	IP_VS_DBG(1, "%s(): "
1253	"stopping DNAT to loopback %pI4\n",	1253	"stopping DNAT to loopback %pI4\n",
1254	__func__, &cp->daddr.ip);	1254	__func__, &cp->daddr.ip);
1255	goto tx_error_put;	1255	goto tx_error_put;
1256	}	1256	}
1257		1257
1258	/* MTU checking */	1258	/* MTU checking */
1259	mtu = dst_mtu(&rt->dst);	1259	mtu = dst_mtu(&rt->dst);
1260	if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF)) &&	1260	if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF)) &&
1261	!skb_is_gso(skb)) {	1261	!skb_is_gso(skb)) {
1262	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));	1262	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
1263	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	1263	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1264	goto tx_error_put;	1264	goto tx_error_put;
1265	}	1265	}
1266		1266
1267	/* copy-on-write the packet before mangling it */	1267	/* copy-on-write the packet before mangling it */
1268	if (!skb_make_writable(skb, offset))	1268	if (!skb_make_writable(skb, offset))
1269	goto tx_error_put;	1269	goto tx_error_put;
1270		1270
1271	if (skb_cow(skb, rt->dst.dev->hard_header_len))	1271	if (skb_cow(skb, rt->dst.dev->hard_header_len))
1272	goto tx_error_put;	1272	goto tx_error_put;
1273		1273
1274	ip_vs_nat_icmp(skb, pp, cp, 0);	1274	ip_vs_nat_icmp(skb, pp, cp, 0);
1275		1275
1276	if (!local) {	1276	if (!local) {
1277	/* drop the old route when skb is not shared */	1277	/* drop the old route when skb is not shared */
1278	skb_dst_drop(skb);	1278	skb_dst_drop(skb);
1279	skb_dst_set(skb, &rt->dst);	1279	skb_dst_set(skb, &rt->dst);
1280	} else {	1280	} else {
1281	ip_rt_put(rt);	1281	ip_rt_put(rt);
1282	/*	1282	/*
1283	* Some IPv4 replies get local address from routes,	1283	* Some IPv4 replies get local address from routes,
1284	* not from iph, so while we DNAT after routing	1284	* not from iph, so while we DNAT after routing
1285	* we need this second input/output route.	1285	* we need this second input/output route.
1286	*/	1286	*/
1287	if (!__ip_vs_reroute_locally(skb))	1287	if (!__ip_vs_reroute_locally(skb))
1288	goto tx_error;	1288	goto tx_error;
1289	}	1289	}
1290		1290
1291	/* Another hack: avoid icmp_send in ip_fragment */	1291	/* Another hack: avoid icmp_send in ip_fragment */
1292	skb->local_df = 1;	1292	skb->local_df = 1;
1293		1293
1294	IP_VS_XMIT_NAT(NFPROTO_IPV4, skb, cp, local);	1294	IP_VS_XMIT_NAT(NFPROTO_IPV4, skb, cp, local);
1295		1295
1296	rc = NF_STOLEN;	1296	rc = NF_STOLEN;
1297	goto out;	1297	goto out;
1298		1298
1299	tx_error_icmp:	1299	tx_error_icmp:
1300	dst_link_failure(skb);	1300	dst_link_failure(skb);
1301	tx_error:	1301	tx_error:
1302	dev_kfree_skb(skb);	1302	dev_kfree_skb(skb);
1303	rc = NF_STOLEN;	1303	rc = NF_STOLEN;
1304	out:	1304	out:
1305	LeaveFunction(10);	1305	LeaveFunction(10);
1306	return rc;	1306	return rc;
1307	tx_error_put:	1307	tx_error_put:
1308	ip_rt_put(rt);	1308	ip_rt_put(rt);
1309	goto tx_error;	1309	goto tx_error;
1310	}	1310	}
1311		1311
1312	#ifdef CONFIG_IP_VS_IPV6	1312	#ifdef CONFIG_IP_VS_IPV6
1313	int	1313	int
1314	ip_vs_icmp_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,	1314	ip_vs_icmp_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
1315	struct ip_vs_protocol *pp, int offset, unsigned int hooknum,	1315	struct ip_vs_protocol *pp, int offset, unsigned int hooknum,
1316	struct ip_vs_iphdr *iph)	1316	struct ip_vs_iphdr *iph)
1317	{	1317	{
1318	struct rt6_info rt; / Route to the other host */	1318	struct rt6_info rt; / Route to the other host */
1319	int mtu;	1319	int mtu;
1320	int rc;	1320	int rc;
1321	int local;	1321	int local;
1322	int rt_mode;	1322	int rt_mode;
1323		1323
1324	EnterFunction(10);	1324	EnterFunction(10);
1325		1325
1326	/* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be	1326	/* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
1327	forwarded directly here, because there is no need to	1327	forwarded directly here, because there is no need to
1328	translate address/port back */	1328	translate address/port back */
1329	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {	1329	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
1330	if (cp->packet_xmit)	1330	if (cp->packet_xmit)
1331	rc = cp->packet_xmit(skb, cp, pp, iph);	1331	rc = cp->packet_xmit(skb, cp, pp, iph);
1332	else	1332	else
1333	rc = NF_ACCEPT;	1333	rc = NF_ACCEPT;
1334	/* do not touch skb anymore */	1334	/* do not touch skb anymore */
1335	atomic_inc(&cp->in_pkts);	1335	atomic_inc(&cp->in_pkts);
1336	goto out;	1336	goto out;
1337	}	1337	}
1338		1338
1339	/*	1339	/*
1340	* mangle and send the packet here (only for VS/NAT)	1340	* mangle and send the packet here (only for VS/NAT)
1341	*/	1341	*/
1342		1342
1343	/* LOCALNODE from FORWARD hook is not supported */	1343	/* LOCALNODE from FORWARD hook is not supported */
1344	rt_mode = (hooknum != NF_INET_FORWARD) ?	1344	rt_mode = (hooknum != NF_INET_FORWARD) ?
1345	IP_VS_RT_MODE_LOCAL \| IP_VS_RT_MODE_NON_LOCAL \|	1345	IP_VS_RT_MODE_LOCAL \| IP_VS_RT_MODE_NON_LOCAL \|
1346	IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;	1346	IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;
1347	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,	1347	if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
1348	0, rt_mode)))	1348	0, rt_mode)))
1349	goto tx_error_icmp;	1349	goto tx_error_icmp;
1350		1350
1351	local = __ip_vs_is_local_route6(rt);	1351	local = __ip_vs_is_local_route6(rt);
1352	/*	1352	/*
1353	* Avoid duplicate tuple in reply direction for NAT traffic	1353	* Avoid duplicate tuple in reply direction for NAT traffic
1354	* to local address when connection is sync-ed	1354	* to local address when connection is sync-ed
1355	*/	1355	*/
1356	#if IS_ENABLED(CONFIG_NF_CONNTRACK)	1356	#if IS_ENABLED(CONFIG_NF_CONNTRACK)
1357	if (cp->flags & IP_VS_CONN_F_SYNC && local) {	1357	if (cp->flags & IP_VS_CONN_F_SYNC && local) {
1358	enum ip_conntrack_info ctinfo;	1358	enum ip_conntrack_info ctinfo;
1359	struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);	1359	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
1360		1360
1361	if (ct && !nf_ct_is_untracked(ct)) {	1361	if (ct && !nf_ct_is_untracked(ct)) {
1362	IP_VS_DBG(10, "%s(): "	1362	IP_VS_DBG(10, "%s(): "
1363	"stopping DNAT to local address %pI6\n",	1363	"stopping DNAT to local address %pI6\n",
1364	__func__, &cp->daddr.in6);	1364	__func__, &cp->daddr.in6);
1365	goto tx_error_put;	1365	goto tx_error_put;
1366	}	1366	}
1367	}	1367	}
1368	#endif	1368	#endif
1369		1369
1370	/* From world but DNAT to loopback address? */	1370	/* From world but DNAT to loopback address? */
1371	if (local && skb->dev && !(skb->dev->flags & IFF_LOOPBACK) &&	1371	if (local && skb->dev && !(skb->dev->flags & IFF_LOOPBACK) &&
1372	ipv6_addr_type(&rt->rt6i_dst.addr) & IPV6_ADDR_LOOPBACK) {	1372	ipv6_addr_type(&rt->rt6i_dst.addr) & IPV6_ADDR_LOOPBACK) {
1373	IP_VS_DBG(1, "%s(): "	1373	IP_VS_DBG(1, "%s(): "
1374	"stopping DNAT to loopback %pI6\n",	1374	"stopping DNAT to loopback %pI6\n",
1375	__func__, &cp->daddr.in6);	1375	__func__, &cp->daddr.in6);
1376	goto tx_error_put;	1376	goto tx_error_put;
1377	}	1377	}
1378		1378
1379	/* MTU checking */	1379	/* MTU checking */
1380	mtu = dst_mtu(&rt->dst);	1380	mtu = dst_mtu(&rt->dst);
1381	if (__mtu_check_toobig_v6(skb, mtu)) {	1381	if (__mtu_check_toobig_v6(skb, mtu)) {
1382	if (!skb->dev) {	1382	if (!skb->dev) {
1383	struct net *net = dev_net(skb_dst(skb)->dev);	1383	struct net *net = dev_net(skb_dst(skb)->dev);
1384		1384
1385	skb->dev = net->loopback_dev;	1385	skb->dev = net->loopback_dev;
1386	}	1386	}
1387	/* only send ICMP too big on first fragment */	1387	/* only send ICMP too big on first fragment */
1388	if (!iph->fragoffs)	1388	if (!iph->fragoffs)
1389	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);	1389	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1390	IP_VS_DBG_RL("%s(): frag needed\n", __func__);	1390	IP_VS_DBG_RL("%s(): frag needed\n", __func__);
1391	goto tx_error_put;	1391	goto tx_error_put;
1392	}	1392	}
1393		1393
1394	/* copy-on-write the packet before mangling it */	1394	/* copy-on-write the packet before mangling it */
1395	if (!skb_make_writable(skb, offset))	1395	if (!skb_make_writable(skb, offset))
1396	goto tx_error_put;	1396	goto tx_error_put;
1397		1397
1398	if (skb_cow(skb, rt->dst.dev->hard_header_len))	1398	if (skb_cow(skb, rt->dst.dev->hard_header_len))
1399	goto tx_error_put;	1399	goto tx_error_put;
1400		1400
1401	ip_vs_nat_icmp_v6(skb, pp, cp, 0);	1401	ip_vs_nat_icmp_v6(skb, pp, cp, 0);
1402		1402
1403	if (!local \|\| !skb->dev) {	1403	if (!local \|\| !skb->dev) {
1404	/* drop the old route when skb is not shared */	1404	/* drop the old route when skb is not shared */
1405	skb_dst_drop(skb);	1405	skb_dst_drop(skb);
1406	skb_dst_set(skb, &rt->dst);	1406	skb_dst_set(skb, &rt->dst);
1407	} else {	1407	} else {
1408	/* destined to loopback, do we need to change route? */	1408	/* destined to loopback, do we need to change route? */
1409	dst_release(&rt->dst);	1409	dst_release(&rt->dst);
1410	}	1410	}
1411		1411
1412	/* Another hack: avoid icmp_send in ip_fragment */	1412	/* Another hack: avoid icmp_send in ip_fragment */
1413	skb->local_df = 1;	1413	skb->local_df = 1;
1414		1414
1415	IP_VS_XMIT_NAT(NFPROTO_IPV6, skb, cp, local);	1415	IP_VS_XMIT_NAT(NFPROTO_IPV6, skb, cp, local);
1416		1416
1417	rc = NF_STOLEN;	1417	rc = NF_STOLEN;
1418	goto out;	1418	goto out;
1419		1419
1420	tx_error_icmp:	1420	tx_error_icmp:
1421	dst_link_failure(skb);	1421	dst_link_failure(skb);
1422	tx_error:	1422	tx_error:
1423	dev_kfree_skb(skb);	1423	dev_kfree_skb(skb);
1424	rc = NF_STOLEN;	1424	rc = NF_STOLEN;
1425	out:	1425	out:
1426	LeaveFunction(10);	1426	LeaveFunction(10);
1427	return rc;	1427	return rc;
1428	tx_error_put:	1428	tx_error_put:
1429	dst_release(&rt->dst);	1429	dst_release(&rt->dst);
1430	goto tx_error;	1430	goto tx_error;
1431	}	1431	}
1432	#endif	1432	#endif
1433		1433

1	/*	1	/*
2	* ip_vs_nfct.c: Netfilter connection tracking support for IPVS	2	* ip_vs_nfct.c: Netfilter connection tracking support for IPVS
3	*	3	*
4	* Portions Copyright (C) 2001-2002	4	* Portions Copyright (C) 2001-2002
5	* Antefacto Ltd, 181 Parnell St, Dublin 1, Ireland.	5	* Antefacto Ltd, 181 Parnell St, Dublin 1, Ireland.
6	*	6	*
7	* Portions Copyright (C) 2003-2010	7	* Portions Copyright (C) 2003-2010
8	* Julian Anastasov	8	* Julian Anastasov
9	*	9	*
10	*	10	*
11	* This code is free software; you can redistribute it and/or modify	11	* This code is free software; you can redistribute it and/or modify
12	* it under the terms of the GNU General Public License as published by	12	* it under the terms of the GNU General Public License as published by
13	* the Free Software Foundation; either version 2 of the License, or	13	* the Free Software Foundation; either version 2 of the License, or
14	* (at your option) any later version.	14	* (at your option) any later version.
15	*	15	*
16	* This program is distributed in the hope that it will be useful,	16	* This program is distributed in the hope that it will be useful,
17	* but WITHOUT ANY WARRANTY; without even the implied warranty of	17	* but WITHOUT ANY WARRANTY; without even the implied warranty of
18	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	18	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	* GNU General Public License for more details.	19	* GNU General Public License for more details.
20	*	20	*
21	* You should have received a copy of the GNU General Public License	21	* You should have received a copy of the GNU General Public License
22	* along with this program; if not, write to the Free Software	22	* along with this program; if not, write to the Free Software
23	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	23	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24	*	24	*
25	*	25	*
26	* Authors:	26	* Authors:
27	* Ben North <ben@redfrontdoor.org>	27	* Ben North <ben@redfrontdoor.org>
28	* Julian Anastasov <ja@ssi.bg> Reorganize and sync with latest kernels	28	* Julian Anastasov <ja@ssi.bg> Reorganize and sync with latest kernels
29	* Hannes Eder <heder@google.com> Extend NFCT support for FTP, ipvs match	29	* Hannes Eder <heder@google.com> Extend NFCT support for FTP, ipvs match
30	*	30	*
31	*	31	*
32	* Current status:	32	* Current status:
33	*	33	*
34	* - provide conntrack confirmation for new and related connections, by	34	* - provide conntrack confirmation for new and related connections, by
35	* this way we can see their proper conntrack state in all hooks	35	* this way we can see their proper conntrack state in all hooks
36	* - support for all forwarding methods, not only NAT	36	* - support for all forwarding methods, not only NAT
37	* - FTP support (NAT), ability to support other NAT apps with expectations	37	* - FTP support (NAT), ability to support other NAT apps with expectations
38	* - to correctly create expectations for related NAT connections the proper	38	* - to correctly create expectations for related NAT connections the proper
39	* NF conntrack support must be already installed, eg. ip_vs_ftp requires	39	* NF conntrack support must be already installed, eg. ip_vs_ftp requires
40	* nf_conntrack_ftp ... iptables_nat for the same ports (but no iptables	40	* nf_conntrack_ftp ... iptables_nat for the same ports (but no iptables
41	* NAT rules are needed)	41	* NAT rules are needed)
42	* - alter reply for NAT when forwarding packet in original direction:	42	* - alter reply for NAT when forwarding packet in original direction:
43	* conntrack from client in NEW or RELATED (Passive FTP DATA) state or	43	* conntrack from client in NEW or RELATED (Passive FTP DATA) state or
44	* when RELATED conntrack is created from real server (Active FTP DATA)	44	* when RELATED conntrack is created from real server (Active FTP DATA)
45	* - if iptables_nat is not loaded the Passive FTP will not work (the	45	* - if iptables_nat is not loaded the Passive FTP will not work (the
46	* PASV response can not be NAT-ed) but Active FTP should work	46	* PASV response can not be NAT-ed) but Active FTP should work
47	*	47	*
48	*/	48	*/
49		49
50	#define KMSG_COMPONENT "IPVS"	50	#define KMSG_COMPONENT "IPVS"
51	#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt	51	#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
52		52
53	#include <linux/module.h>	53	#include <linux/module.h>
54	#include <linux/types.h>	54	#include <linux/types.h>
55	#include <linux/kernel.h>	55	#include <linux/kernel.h>
56	#include <linux/errno.h>	56	#include <linux/errno.h>
57	#include <linux/compiler.h>	57	#include <linux/compiler.h>
58	#include <linux/vmalloc.h>	58	#include <linux/vmalloc.h>
59	#include <linux/skbuff.h>	59	#include <linux/skbuff.h>
60	#include <net/ip.h>	60	#include <net/ip.h>
61	#include <linux/netfilter.h>	61	#include <linux/netfilter.h>
62	#include <linux/netfilter_ipv4.h>	62	#include <linux/netfilter_ipv4.h>
63	#include <net/ip_vs.h>	63	#include <net/ip_vs.h>
64	#include <net/netfilter/nf_conntrack_core.h>	64	#include <net/netfilter/nf_conntrack_core.h>
65	#include <net/netfilter/nf_conntrack_expect.h>	65	#include <net/netfilter/nf_conntrack_expect.h>
66	#include <net/netfilter/nf_conntrack_helper.h>	66	#include <net/netfilter/nf_conntrack_helper.h>
67	#include <net/netfilter/nf_conntrack_zones.h>	67	#include <net/netfilter/nf_conntrack_zones.h>
68		68
69		69
70	#define FMT_TUPLE "%pI4:%u->%pI4:%u/%u"	70	#define FMT_TUPLE "%pI4:%u->%pI4:%u/%u"
71	#define ARG_TUPLE(T) &(T)->src.u3.ip, ntohs((T)->src.u.all), \	71	#define ARG_TUPLE(T) &(T)->src.u3.ip, ntohs((T)->src.u.all), \
72	&(T)->dst.u3.ip, ntohs((T)->dst.u.all), \	72	&(T)->dst.u3.ip, ntohs((T)->dst.u.all), \
73	(T)->dst.protonum	73	(T)->dst.protonum
74		74
75	#define FMT_CONN "%pI4:%u->%pI4:%u->%pI4:%u/%u:%u"	75	#define FMT_CONN "%pI4:%u->%pI4:%u->%pI4:%u/%u:%u"
76	#define ARG_CONN(C) &((C)->caddr.ip), ntohs((C)->cport), \	76	#define ARG_CONN(C) &((C)->caddr.ip), ntohs((C)->cport), \
77	&((C)->vaddr.ip), ntohs((C)->vport), \	77	&((C)->vaddr.ip), ntohs((C)->vport), \
78	&((C)->daddr.ip), ntohs((C)->dport), \	78	&((C)->daddr.ip), ntohs((C)->dport), \
79	(C)->protocol, (C)->state	79	(C)->protocol, (C)->state
80		80
81	void	81	void
82	ip_vs_update_conntrack(struct sk_buff skb, struct ip_vs_conn cp, int outin)	82	ip_vs_update_conntrack(struct sk_buff skb, struct ip_vs_conn cp, int outin)
83	{	83	{
84	enum ip_conntrack_info ctinfo;	84	enum ip_conntrack_info ctinfo;
85	struct nf_conn *ct = ct = nf_ct_get(skb, &ctinfo);	85	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
86	struct nf_conntrack_tuple new_tuple;	86	struct nf_conntrack_tuple new_tuple;
87		87
88	if (ct == NULL \|\| nf_ct_is_confirmed(ct) \|\| nf_ct_is_untracked(ct) \|\|	88	if (ct == NULL \|\| nf_ct_is_confirmed(ct) \|\| nf_ct_is_untracked(ct) \|\|
89	nf_ct_is_dying(ct))	89	nf_ct_is_dying(ct))
90	return;	90	return;
91		91
92	/* Never alter conntrack for non-NAT conns */	92	/* Never alter conntrack for non-NAT conns */
93	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)	93	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
94	return;	94	return;
95		95
96	/* Alter reply only in original direction */	96	/* Alter reply only in original direction */
97	if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)	97	if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
98	return;	98	return;
99		99
100	/*	100	/*
101	* The connection is not yet in the hashtable, so we update it.	101	* The connection is not yet in the hashtable, so we update it.
102	* CIP->VIP will remain the same, so leave the tuple in	102	* CIP->VIP will remain the same, so leave the tuple in
103	* IP_CT_DIR_ORIGINAL untouched. When the reply comes back from the	103	* IP_CT_DIR_ORIGINAL untouched. When the reply comes back from the
104	* real-server we will see RIP->DIP.	104	* real-server we will see RIP->DIP.
105	*/	105	*/
106	new_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;	106	new_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
107	/*	107	/*
108	* This will also take care of UDP and other protocols.	108	* This will also take care of UDP and other protocols.
109	*/	109	*/
110	if (outin) {	110	if (outin) {
111	new_tuple.src.u3 = cp->daddr;	111	new_tuple.src.u3 = cp->daddr;
112	if (new_tuple.dst.protonum != IPPROTO_ICMP &&	112	if (new_tuple.dst.protonum != IPPROTO_ICMP &&
113	new_tuple.dst.protonum != IPPROTO_ICMPV6)	113	new_tuple.dst.protonum != IPPROTO_ICMPV6)
114	new_tuple.src.u.tcp.port = cp->dport;	114	new_tuple.src.u.tcp.port = cp->dport;
115	} else {	115	} else {
116	new_tuple.dst.u3 = cp->vaddr;	116	new_tuple.dst.u3 = cp->vaddr;
117	if (new_tuple.dst.protonum != IPPROTO_ICMP &&	117	if (new_tuple.dst.protonum != IPPROTO_ICMP &&
118	new_tuple.dst.protonum != IPPROTO_ICMPV6)	118	new_tuple.dst.protonum != IPPROTO_ICMPV6)
119	new_tuple.dst.u.tcp.port = cp->vport;	119	new_tuple.dst.u.tcp.port = cp->vport;
120	}	120	}
121	IP_VS_DBG(7, "%s: Updating conntrack ct=%p, status=0x%lX, "	121	IP_VS_DBG(7, "%s: Updating conntrack ct=%p, status=0x%lX, "
122	"ctinfo=%d, old reply=" FMT_TUPLE	122	"ctinfo=%d, old reply=" FMT_TUPLE
123	", new reply=" FMT_TUPLE ", cp=" FMT_CONN "\n",	123	", new reply=" FMT_TUPLE ", cp=" FMT_CONN "\n",
124	__func__, ct, ct->status, ctinfo,	124	__func__, ct, ct->status, ctinfo,
125	ARG_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple),	125	ARG_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple),
126	ARG_TUPLE(&new_tuple), ARG_CONN(cp));	126	ARG_TUPLE(&new_tuple), ARG_CONN(cp));
127	nf_conntrack_alter_reply(ct, &new_tuple);	127	nf_conntrack_alter_reply(ct, &new_tuple);
128	}	128	}
129		129
130	int ip_vs_confirm_conntrack(struct sk_buff *skb)	130	int ip_vs_confirm_conntrack(struct sk_buff *skb)
131	{	131	{
132	return nf_conntrack_confirm(skb);	132	return nf_conntrack_confirm(skb);
133	}	133	}
134		134
135	/*	135	/*
136	* Called from init_conntrack() as expectfn handler.	136	* Called from init_conntrack() as expectfn handler.
137	*/	137	*/
138	static void ip_vs_nfct_expect_callback(struct nf_conn *ct,	138	static void ip_vs_nfct_expect_callback(struct nf_conn *ct,
139	struct nf_conntrack_expect *exp)	139	struct nf_conntrack_expect *exp)
140	{	140	{
141	struct nf_conntrack_tuple *orig, new_reply;	141	struct nf_conntrack_tuple *orig, new_reply;
142	struct ip_vs_conn *cp;	142	struct ip_vs_conn *cp;
143	struct ip_vs_conn_param p;	143	struct ip_vs_conn_param p;
144	struct net *net = nf_ct_net(ct);	144	struct net *net = nf_ct_net(ct);
145		145
146	if (exp->tuple.src.l3num != PF_INET)	146	if (exp->tuple.src.l3num != PF_INET)
147	return;	147	return;
148		148
149	/*	149	/*
150	* We assume that no NF locks are held before this callback.	150	* We assume that no NF locks are held before this callback.
151	* ip_vs_conn_out_get and ip_vs_conn_in_get should match their	151	* ip_vs_conn_out_get and ip_vs_conn_in_get should match their
152	* expectations even if they use wildcard values, now we provide the	152	* expectations even if they use wildcard values, now we provide the
153	* actual values from the newly created original conntrack direction.	153	* actual values from the newly created original conntrack direction.
154	* The conntrack is confirmed when packet reaches IPVS hooks.	154	* The conntrack is confirmed when packet reaches IPVS hooks.
155	*/	155	*/
156		156
157	/* RS->CLIENT */	157	/* RS->CLIENT */
158	orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;	158	orig = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
159	ip_vs_conn_fill_param(net, exp->tuple.src.l3num, orig->dst.protonum,	159	ip_vs_conn_fill_param(net, exp->tuple.src.l3num, orig->dst.protonum,
160	&orig->src.u3, orig->src.u.tcp.port,	160	&orig->src.u3, orig->src.u.tcp.port,
161	&orig->dst.u3, orig->dst.u.tcp.port, &p);	161	&orig->dst.u3, orig->dst.u.tcp.port, &p);
162	cp = ip_vs_conn_out_get(&p);	162	cp = ip_vs_conn_out_get(&p);
163	if (cp) {	163	if (cp) {
164	/* Change reply CLIENT->RS to CLIENT->VS */	164	/* Change reply CLIENT->RS to CLIENT->VS */
165	new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;	165	new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
166	IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "	166	IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
167	FMT_TUPLE ", found inout cp=" FMT_CONN "\n",	167	FMT_TUPLE ", found inout cp=" FMT_CONN "\n",
168	__func__, ct, ct->status,	168	__func__, ct, ct->status,
169	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),	169	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
170	ARG_CONN(cp));	170	ARG_CONN(cp));
171	new_reply.dst.u3 = cp->vaddr;	171	new_reply.dst.u3 = cp->vaddr;
172	new_reply.dst.u.tcp.port = cp->vport;	172	new_reply.dst.u.tcp.port = cp->vport;
173	IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE ", " FMT_TUPLE	173	IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE ", " FMT_TUPLE
174	", inout cp=" FMT_CONN "\n",	174	", inout cp=" FMT_CONN "\n",
175	__func__, ct,	175	__func__, ct,
176	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),	176	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
177	ARG_CONN(cp));	177	ARG_CONN(cp));
178	goto alter;	178	goto alter;
179	}	179	}
180		180
181	/* CLIENT->VS */	181	/* CLIENT->VS */
182	cp = ip_vs_conn_in_get(&p);	182	cp = ip_vs_conn_in_get(&p);
183	if (cp) {	183	if (cp) {
184	/* Change reply VS->CLIENT to RS->CLIENT */	184	/* Change reply VS->CLIENT to RS->CLIENT */
185	new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;	185	new_reply = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
186	IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "	186	IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuples=" FMT_TUPLE ", "
187	FMT_TUPLE ", found outin cp=" FMT_CONN "\n",	187	FMT_TUPLE ", found outin cp=" FMT_CONN "\n",
188	__func__, ct, ct->status,	188	__func__, ct, ct->status,
189	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),	189	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
190	ARG_CONN(cp));	190	ARG_CONN(cp));
191	new_reply.src.u3 = cp->daddr;	191	new_reply.src.u3 = cp->daddr;
192	new_reply.src.u.tcp.port = cp->dport;	192	new_reply.src.u.tcp.port = cp->dport;
193	IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE ", "	193	IP_VS_DBG(7, "%s: ct=%p, new tuples=" FMT_TUPLE ", "
194	FMT_TUPLE ", outin cp=" FMT_CONN "\n",	194	FMT_TUPLE ", outin cp=" FMT_CONN "\n",
195	__func__, ct,	195	__func__, ct,
196	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),	196	ARG_TUPLE(orig), ARG_TUPLE(&new_reply),
197	ARG_CONN(cp));	197	ARG_CONN(cp));
198	goto alter;	198	goto alter;
199	}	199	}
200		200
201	IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuple=" FMT_TUPLE	201	IP_VS_DBG(7, "%s: ct=%p, status=0x%lX, tuple=" FMT_TUPLE
202	" - unknown expect\n",	202	" - unknown expect\n",
203	__func__, ct, ct->status, ARG_TUPLE(orig));	203	__func__, ct, ct->status, ARG_TUPLE(orig));
204	return;	204	return;
205		205
206	alter:	206	alter:
207	/* Never alter conntrack for non-NAT conns */	207	/* Never alter conntrack for non-NAT conns */
208	if (IP_VS_FWD_METHOD(cp) == IP_VS_CONN_F_MASQ)	208	if (IP_VS_FWD_METHOD(cp) == IP_VS_CONN_F_MASQ)
209	nf_conntrack_alter_reply(ct, &new_reply);	209	nf_conntrack_alter_reply(ct, &new_reply);
210	ip_vs_conn_put(cp);	210	ip_vs_conn_put(cp);
211	return;	211	return;
212	}	212	}
213		213
214	/*	214	/*
215	* Create NF conntrack expectation with wildcard (optional) source port.	215	* Create NF conntrack expectation with wildcard (optional) source port.
216	* Then the default callback function will alter the reply and will confirm	216	* Then the default callback function will alter the reply and will confirm
217	* the conntrack entry when the first packet comes.	217	* the conntrack entry when the first packet comes.
218	* Use port 0 to expect connection from any port.	218	* Use port 0 to expect connection from any port.
219	*/	219	*/
220	void ip_vs_nfct_expect_related(struct sk_buff skb, struct nf_conn ct,	220	void ip_vs_nfct_expect_related(struct sk_buff skb, struct nf_conn ct,
221	struct ip_vs_conn *cp, u_int8_t proto,	221	struct ip_vs_conn *cp, u_int8_t proto,
222	const __be16 port, int from_rs)	222	const __be16 port, int from_rs)
223	{	223	{
224	struct nf_conntrack_expect *exp;	224	struct nf_conntrack_expect *exp;
225		225
226	if (ct == NULL \|\| nf_ct_is_untracked(ct))	226	if (ct == NULL \|\| nf_ct_is_untracked(ct))
227	return;	227	return;
228		228
229	exp = nf_ct_expect_alloc(ct);	229	exp = nf_ct_expect_alloc(ct);
230	if (!exp)	230	if (!exp)
231	return;	231	return;
232		232
233	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),	233	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, nf_ct_l3num(ct),
234	from_rs ? &cp->daddr : &cp->caddr,	234	from_rs ? &cp->daddr : &cp->caddr,
235	from_rs ? &cp->caddr : &cp->vaddr,	235	from_rs ? &cp->caddr : &cp->vaddr,
236	proto, port ? &port : NULL,	236	proto, port ? &port : NULL,
237	from_rs ? &cp->cport : &cp->vport);	237	from_rs ? &cp->cport : &cp->vport);
238		238
239	exp->expectfn = ip_vs_nfct_expect_callback;	239	exp->expectfn = ip_vs_nfct_expect_callback;
240		240
241	IP_VS_DBG(7, "%s: ct=%p, expect tuple=" FMT_TUPLE "\n",	241	IP_VS_DBG(7, "%s: ct=%p, expect tuple=" FMT_TUPLE "\n",
242	__func__, ct, ARG_TUPLE(&exp->tuple));	242	__func__, ct, ARG_TUPLE(&exp->tuple));
243	nf_ct_expect_related(exp);	243	nf_ct_expect_related(exp);
244	nf_ct_expect_put(exp);	244	nf_ct_expect_put(exp);
245	}	245	}
246	EXPORT_SYMBOL(ip_vs_nfct_expect_related);	246	EXPORT_SYMBOL(ip_vs_nfct_expect_related);
247		247
248	/*	248	/*
249	* Our connection was terminated, try to drop the conntrack immediately	249	* Our connection was terminated, try to drop the conntrack immediately
250	*/	250	*/
251	void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)	251	void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp)
252	{	252	{
253	struct nf_conntrack_tuple_hash *h;	253	struct nf_conntrack_tuple_hash *h;
254	struct nf_conn *ct;	254	struct nf_conn *ct;
255	struct nf_conntrack_tuple tuple;	255	struct nf_conntrack_tuple tuple;
256		256
257	if (!cp->cport)	257	if (!cp->cport)
258	return;	258	return;
259		259
260	tuple = (struct nf_conntrack_tuple) {	260	tuple = (struct nf_conntrack_tuple) {
261	.dst = { .protonum = cp->protocol, .dir = IP_CT_DIR_ORIGINAL } };	261	.dst = { .protonum = cp->protocol, .dir = IP_CT_DIR_ORIGINAL } };
262	tuple.src.u3 = cp->caddr;	262	tuple.src.u3 = cp->caddr;
263	tuple.src.u.all = cp->cport;	263	tuple.src.u.all = cp->cport;
264	tuple.src.l3num = cp->af;	264	tuple.src.l3num = cp->af;
265	tuple.dst.u3 = cp->vaddr;	265	tuple.dst.u3 = cp->vaddr;
266	tuple.dst.u.all = cp->vport;	266	tuple.dst.u.all = cp->vport;
267		267
268	IP_VS_DBG(7, "%s: dropping conntrack with tuple=" FMT_TUPLE	268	IP_VS_DBG(7, "%s: dropping conntrack with tuple=" FMT_TUPLE
269	" for conn " FMT_CONN "\n",	269	" for conn " FMT_CONN "\n",
270	__func__, ARG_TUPLE(&tuple), ARG_CONN(cp));	270	__func__, ARG_TUPLE(&tuple), ARG_CONN(cp));
271		271
272	h = nf_conntrack_find_get(ip_vs_conn_net(cp), NF_CT_DEFAULT_ZONE,	272	h = nf_conntrack_find_get(ip_vs_conn_net(cp), NF_CT_DEFAULT_ZONE,
273	&tuple);	273	&tuple);
274	if (h) {	274	if (h) {
275	ct = nf_ct_tuplehash_to_ctrack(h);	275	ct = nf_ct_tuplehash_to_ctrack(h);
276	/* Show what happens instead of calling nf_ct_kill() */	276	/* Show what happens instead of calling nf_ct_kill() */
277	if (del_timer(&ct->timeout)) {	277	if (del_timer(&ct->timeout)) {
278	IP_VS_DBG(7, "%s: ct=%p, deleted conntrack timer for tuple="	278	IP_VS_DBG(7, "%s: ct=%p, deleted conntrack timer for tuple="
279	FMT_TUPLE "\n",	279	FMT_TUPLE "\n",
280	__func__, ct, ARG_TUPLE(&tuple));	280	__func__, ct, ARG_TUPLE(&tuple));
281	if (ct->timeout.function)	281	if (ct->timeout.function)
282	ct->timeout.function(ct->timeout.data);	282	ct->timeout.function(ct->timeout.data);
283	} else {	283	} else {
284	IP_VS_DBG(7, "%s: ct=%p, no conntrack timer for tuple="	284	IP_VS_DBG(7, "%s: ct=%p, no conntrack timer for tuple="
285	FMT_TUPLE "\n",	285	FMT_TUPLE "\n",
286	__func__, ct, ARG_TUPLE(&tuple));	286	__func__, ct, ARG_TUPLE(&tuple));
287	}	287	}
288	nf_ct_put(ct);	288	nf_ct_put(ct);
289	} else {	289	} else {
290	IP_VS_DBG(7, "%s: no conntrack for tuple=" FMT_TUPLE "\n",	290	IP_VS_DBG(7, "%s: no conntrack for tuple=" FMT_TUPLE "\n",
291	__func__, ARG_TUPLE(&tuple));	291	__func__, ARG_TUPLE(&tuple));
292	}	292	}
293	}	293	}
294		294
295		295