1
2
3
4
5
6
7
8
9
10
11
12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13#include <linux/module.h>
14#include <linux/proc_fs.h>
15#include <linux/jhash.h>
16#include <linux/bitops.h>
17#include <linux/skbuff.h>
18#include <linux/slab.h>
19#include <linux/ip.h>
20#include <linux/tcp.h>
21#include <linux/udp.h>
22#include <linux/icmp.h>
23#include <linux/if_arp.h>
24#include <linux/seq_file.h>
25#include <linux/netfilter_arp.h>
26#include <linux/netfilter/x_tables.h>
27#include <linux/netfilter_ipv4/ip_tables.h>
28#include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
29#include <net/netfilter/nf_conntrack.h>
30#include <net/net_namespace.h>
31#include <net/netns/generic.h>
32#include <net/checksum.h>
33#include <net/ip.h>
34
35#define CLUSTERIP_VERSION "0.8"
36
37MODULE_LICENSE("GPL");
38MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
39MODULE_DESCRIPTION("Xtables: CLUSTERIP target");
40
41struct clusterip_config {
42 struct list_head list;
43 atomic_t refcount;
44 atomic_t entries;
45
46
47 __be32 clusterip;
48 u_int8_t clustermac[ETH_ALEN];
49 struct net_device *dev;
50 u_int16_t num_total_nodes;
51 unsigned long local_nodes;
52
53#ifdef CONFIG_PROC_FS
54 struct proc_dir_entry *pde;
55#endif
56 enum clusterip_hashmode hash_mode;
57 u_int32_t hash_initval;
58 struct rcu_head rcu;
59};
60
61#ifdef CONFIG_PROC_FS
62static const struct file_operations clusterip_proc_fops;
63#endif
64
65static unsigned int clusterip_net_id __read_mostly;
66
67struct clusterip_net {
68 struct list_head configs;
69
70 spinlock_t lock;
71
72#ifdef CONFIG_PROC_FS
73 struct proc_dir_entry *procdir;
74#endif
75};
76
77static inline void
78clusterip_config_get(struct clusterip_config *c)
79{
80 atomic_inc(&c->refcount);
81}
82
83
84static void clusterip_config_rcu_free(struct rcu_head *head)
85{
86 kfree(container_of(head, struct clusterip_config, rcu));
87}
88
89static inline void
90clusterip_config_put(struct clusterip_config *c)
91{
92 if (atomic_dec_and_test(&c->refcount))
93 call_rcu_bh(&c->rcu, clusterip_config_rcu_free);
94}
95
96
97
98
99static inline void
100clusterip_config_entry_put(struct clusterip_config *c)
101{
102 struct net *net = dev_net(c->dev);
103 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
104
105 local_bh_disable();
106 if (atomic_dec_and_lock(&c->entries, &cn->lock)) {
107 list_del_rcu(&c->list);
108 spin_unlock(&cn->lock);
109 local_bh_enable();
110
111 dev_mc_del(c->dev, c->clustermac);
112 dev_put(c->dev);
113
114
115
116
117#ifdef CONFIG_PROC_FS
118 proc_remove(c->pde);
119#endif
120 return;
121 }
122 local_bh_enable();
123}
124
125static struct clusterip_config *
126__clusterip_config_find(struct net *net, __be32 clusterip)
127{
128 struct clusterip_config *c;
129 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
130
131 list_for_each_entry_rcu(c, &cn->configs, list) {
132 if (c->clusterip == clusterip)
133 return c;
134 }
135
136 return NULL;
137}
138
139static inline struct clusterip_config *
140clusterip_config_find_get(struct net *net, __be32 clusterip, int entry)
141{
142 struct clusterip_config *c;
143
144 rcu_read_lock_bh();
145 c = __clusterip_config_find(net, clusterip);
146 if (c) {
147#ifdef CONFIG_PROC_FS
148 if (!c->pde)
149 c = NULL;
150 else
151#endif
152 if (unlikely(!atomic_inc_not_zero(&c->refcount)))
153 c = NULL;
154 else if (entry)
155 atomic_inc(&c->entries);
156 }
157 rcu_read_unlock_bh();
158
159 return c;
160}
161
162static void
163clusterip_config_init_nodelist(struct clusterip_config *c,
164 const struct ipt_clusterip_tgt_info *i)
165{
166 int n;
167
168 for (n = 0; n < i->num_local_nodes; n++)
169 set_bit(i->local_nodes[n] - 1, &c->local_nodes);
170}
171
172static struct clusterip_config *
173clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
174 struct net_device *dev)
175{
176 struct net *net = dev_net(dev);
177 struct clusterip_config *c;
178 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
179
180 c = kzalloc(sizeof(*c), GFP_ATOMIC);
181 if (!c)
182 return ERR_PTR(-ENOMEM);
183
184 c->dev = dev;
185 c->clusterip = ip;
186 memcpy(&c->clustermac, &i->clustermac, ETH_ALEN);
187 c->num_total_nodes = i->num_total_nodes;
188 clusterip_config_init_nodelist(c, i);
189 c->hash_mode = i->hash_mode;
190 c->hash_initval = i->hash_initval;
191 atomic_set(&c->refcount, 1);
192 atomic_set(&c->entries, 1);
193
194 spin_lock_bh(&cn->lock);
195 if (__clusterip_config_find(net, ip)) {
196 spin_unlock_bh(&cn->lock);
197 kfree(c);
198
199 return ERR_PTR(-EBUSY);
200 }
201
202 list_add_rcu(&c->list, &cn->configs);
203 spin_unlock_bh(&cn->lock);
204
205#ifdef CONFIG_PROC_FS
206 {
207 char buffer[16];
208
209
210 sprintf(buffer, "%pI4", &ip);
211 c->pde = proc_create_data(buffer, S_IWUSR|S_IRUSR,
212 cn->procdir,
213 &clusterip_proc_fops, c);
214 if (!c->pde) {
215 spin_lock_bh(&cn->lock);
216 list_del_rcu(&c->list);
217 spin_unlock_bh(&cn->lock);
218 kfree(c);
219
220 return ERR_PTR(-ENOMEM);
221 }
222 }
223#endif
224
225 return c;
226}
227
228#ifdef CONFIG_PROC_FS
229static int
230clusterip_add_node(struct clusterip_config *c, u_int16_t nodenum)
231{
232
233 if (nodenum == 0 ||
234 nodenum > c->num_total_nodes)
235 return 1;
236
237
238 if (test_and_set_bit(nodenum - 1, &c->local_nodes))
239 return 1;
240
241 return 0;
242}
243
244static bool
245clusterip_del_node(struct clusterip_config *c, u_int16_t nodenum)
246{
247 if (nodenum == 0 ||
248 nodenum > c->num_total_nodes)
249 return true;
250
251 if (test_and_clear_bit(nodenum - 1, &c->local_nodes))
252 return false;
253
254 return true;
255}
256#endif
257
258static inline u_int32_t
259clusterip_hashfn(const struct sk_buff *skb,
260 const struct clusterip_config *config)
261{
262 const struct iphdr *iph = ip_hdr(skb);
263 unsigned long hashval;
264 u_int16_t sport = 0, dport = 0;
265 int poff;
266
267 poff = proto_ports_offset(iph->protocol);
268 if (poff >= 0) {
269 const u_int16_t *ports;
270 u16 _ports[2];
271
272 ports = skb_header_pointer(skb, iph->ihl * 4 + poff, 4, _ports);
273 if (ports) {
274 sport = ports[0];
275 dport = ports[1];
276 }
277 } else {
278 net_info_ratelimited("unknown protocol %u\n", iph->protocol);
279 }
280
281 switch (config->hash_mode) {
282 case CLUSTERIP_HASHMODE_SIP:
283 hashval = jhash_1word(ntohl(iph->saddr),
284 config->hash_initval);
285 break;
286 case CLUSTERIP_HASHMODE_SIP_SPT:
287 hashval = jhash_2words(ntohl(iph->saddr), sport,
288 config->hash_initval);
289 break;
290 case CLUSTERIP_HASHMODE_SIP_SPT_DPT:
291 hashval = jhash_3words(ntohl(iph->saddr), sport, dport,
292 config->hash_initval);
293 break;
294 default:
295
296 hashval = 0;
297
298
299 pr_info("unknown mode %u\n", config->hash_mode);
300 BUG();
301 break;
302 }
303
304
305 return reciprocal_scale(hashval, config->num_total_nodes) + 1;
306}
307
308static inline int
309clusterip_responsible(const struct clusterip_config *config, u_int32_t hash)
310{
311 return test_bit(hash - 1, &config->local_nodes);
312}
313
314
315
316
317
318static unsigned int
319clusterip_tg(struct sk_buff *skb, const struct xt_action_param *par)
320{
321 const struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
322 struct nf_conn *ct;
323 enum ip_conntrack_info ctinfo;
324 u_int32_t hash;
325
326
327
328
329
330 ct = nf_ct_get(skb, &ctinfo);
331 if (ct == NULL)
332 return NF_DROP;
333
334
335
336 if (ip_hdr(skb)->protocol == IPPROTO_ICMP &&
337 (ctinfo == IP_CT_RELATED ||
338 ctinfo == IP_CT_RELATED_REPLY))
339 return XT_CONTINUE;
340
341
342
343
344
345 hash = clusterip_hashfn(skb, cipinfo->config);
346
347 switch (ctinfo) {
348 case IP_CT_NEW:
349 ct->mark = hash;
350 break;
351 case IP_CT_RELATED:
352 case IP_CT_RELATED_REPLY:
353
354
355
356 case IP_CT_ESTABLISHED:
357 case IP_CT_ESTABLISHED_REPLY:
358 break;
359 default:
360 break;
361 }
362
363#ifdef DEBUG
364 nf_ct_dump_tuple_ip(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
365#endif
366 pr_debug("hash=%u ct_hash=%u ", hash, ct->mark);
367 if (!clusterip_responsible(cipinfo->config, hash)) {
368 pr_debug("not responsible\n");
369 return NF_DROP;
370 }
371 pr_debug("responsible\n");
372
373
374
375 skb->pkt_type = PACKET_HOST;
376
377 return XT_CONTINUE;
378}
379
380static int clusterip_tg_check(const struct xt_tgchk_param *par)
381{
382 struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
383 const struct ipt_entry *e = par->entryinfo;
384 struct clusterip_config *config;
385 int ret;
386
387 if (par->nft_compat) {
388 pr_err("cannot use CLUSTERIP target from nftables compat\n");
389 return -EOPNOTSUPP;
390 }
391
392 if (cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP &&
393 cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT &&
394 cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT_DPT) {
395 pr_info("unknown mode %u\n", cipinfo->hash_mode);
396 return -EINVAL;
397
398 }
399 if (e->ip.dmsk.s_addr != htonl(0xffffffff) ||
400 e->ip.dst.s_addr == 0) {
401 pr_info("Please specify destination IP\n");
402 return -EINVAL;
403 }
404
405
406
407 config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1);
408 if (!config) {
409 if (!(cipinfo->flags & CLUSTERIP_FLAG_NEW)) {
410 pr_info("no config found for %pI4, need 'new'\n",
411 &e->ip.dst.s_addr);
412 return -EINVAL;
413 } else {
414 struct net_device *dev;
415
416 if (e->ip.iniface[0] == '\0') {
417 pr_info("Please specify an interface name\n");
418 return -EINVAL;
419 }
420
421 dev = dev_get_by_name(par->net, e->ip.iniface);
422 if (!dev) {
423 pr_info("no such interface %s\n",
424 e->ip.iniface);
425 return -ENOENT;
426 }
427
428 config = clusterip_config_init(cipinfo,
429 e->ip.dst.s_addr, dev);
430 if (IS_ERR(config)) {
431 dev_put(dev);
432 return PTR_ERR(config);
433 }
434 dev_mc_add(config->dev, config->clustermac);
435 }
436 }
437 cipinfo->config = config;
438
439 ret = nf_ct_netns_get(par->net, par->family);
440 if (ret < 0)
441 pr_info("cannot load conntrack support for proto=%u\n",
442 par->family);
443
444 if (!par->net->xt.clusterip_deprecated_warning) {
445 pr_info("ipt_CLUSTERIP is deprecated and it will removed soon, "
446 "use xt_cluster instead\n");
447 par->net->xt.clusterip_deprecated_warning = true;
448 }
449
450 return ret;
451}
452
453
454static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
455{
456 const struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
457
458
459
460 clusterip_config_entry_put(cipinfo->config);
461
462 clusterip_config_put(cipinfo->config);
463
464 nf_ct_netns_put(par->net, par->family);
465}
466
467#ifdef CONFIG_COMPAT
468struct compat_ipt_clusterip_tgt_info
469{
470 u_int32_t flags;
471 u_int8_t clustermac[6];
472 u_int16_t num_total_nodes;
473 u_int16_t num_local_nodes;
474 u_int16_t local_nodes[CLUSTERIP_MAX_NODES];
475 u_int32_t hash_mode;
476 u_int32_t hash_initval;
477 compat_uptr_t config;
478};
479#endif
480
481static struct xt_target clusterip_tg_reg __read_mostly = {
482 .name = "CLUSTERIP",
483 .family = NFPROTO_IPV4,
484 .target = clusterip_tg,
485 .checkentry = clusterip_tg_check,
486 .destroy = clusterip_tg_destroy,
487 .targetsize = sizeof(struct ipt_clusterip_tgt_info),
488 .usersize = offsetof(struct ipt_clusterip_tgt_info, config),
489#ifdef CONFIG_COMPAT
490 .compatsize = sizeof(struct compat_ipt_clusterip_tgt_info),
491#endif
492 .me = THIS_MODULE
493};
494
495
496
497
498
499
500
501struct arp_payload {
502 u_int8_t src_hw[ETH_ALEN];
503 __be32 src_ip;
504 u_int8_t dst_hw[ETH_ALEN];
505 __be32 dst_ip;
506} __packed;
507
508#ifdef DEBUG
509static void arp_print(struct arp_payload *payload)
510{
511#define HBUFFERLEN 30
512 char hbuffer[HBUFFERLEN];
513 int j, k;
514
515 for (k = 0, j = 0; k < HBUFFERLEN - 3 && j < ETH_ALEN; j++) {
516 hbuffer[k++] = hex_asc_hi(payload->src_hw[j]);
517 hbuffer[k++] = hex_asc_lo(payload->src_hw[j]);
518 hbuffer[k++] = ':';
519 }
520 hbuffer[--k] = '\0';
521
522 pr_debug("src %pI4@%s, dst %pI4\n",
523 &payload->src_ip, hbuffer, &payload->dst_ip);
524}
525#endif
526
527static unsigned int
528arp_mangle(void *priv,
529 struct sk_buff *skb,
530 const struct nf_hook_state *state)
531{
532 struct arphdr *arp = arp_hdr(skb);
533 struct arp_payload *payload;
534 struct clusterip_config *c;
535 struct net *net = state->net;
536
537
538 if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
539 arp->ar_pro != htons(ETH_P_IP) ||
540 arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
541 return NF_ACCEPT;
542
543
544 if (arp->ar_op != htons(ARPOP_REPLY) &&
545 arp->ar_op != htons(ARPOP_REQUEST))
546 return NF_ACCEPT;
547
548 payload = (void *)(arp+1);
549
550
551
552 c = clusterip_config_find_get(net, payload->src_ip, 0);
553 if (!c)
554 return NF_ACCEPT;
555
556
557
558
559
560 if (c->dev != state->out) {
561 pr_debug("not mangling arp reply on different "
562 "interface: cip'%s'-skb'%s'\n",
563 c->dev->name, state->out->name);
564 clusterip_config_put(c);
565 return NF_ACCEPT;
566 }
567
568
569 memcpy(payload->src_hw, c->clustermac, arp->ar_hln);
570
571#ifdef DEBUG
572 pr_debug("mangled arp reply: ");
573 arp_print(payload);
574#endif
575
576 clusterip_config_put(c);
577
578 return NF_ACCEPT;
579}
580
581static struct nf_hook_ops cip_arp_ops __read_mostly = {
582 .hook = arp_mangle,
583 .pf = NFPROTO_ARP,
584 .hooknum = NF_ARP_OUT,
585 .priority = -1
586};
587
588
589
590
591
592#ifdef CONFIG_PROC_FS
593
594struct clusterip_seq_position {
595 unsigned int pos;
596 unsigned int weight;
597 unsigned int bit;
598 unsigned long val;
599};
600
601static void *clusterip_seq_start(struct seq_file *s, loff_t *pos)
602{
603 struct clusterip_config *c = s->private;
604 unsigned int weight;
605 u_int32_t local_nodes;
606 struct clusterip_seq_position *idx;
607
608
609 local_nodes = c->local_nodes;
610 weight = hweight32(local_nodes);
611 if (*pos >= weight)
612 return NULL;
613
614 idx = kmalloc(sizeof(struct clusterip_seq_position), GFP_KERNEL);
615 if (!idx)
616 return ERR_PTR(-ENOMEM);
617
618 idx->pos = *pos;
619 idx->weight = weight;
620 idx->bit = ffs(local_nodes);
621 idx->val = local_nodes;
622 clear_bit(idx->bit - 1, &idx->val);
623
624 return idx;
625}
626
627static void *clusterip_seq_next(struct seq_file *s, void *v, loff_t *pos)
628{
629 struct clusterip_seq_position *idx = v;
630
631 *pos = ++idx->pos;
632 if (*pos >= idx->weight) {
633 kfree(v);
634 return NULL;
635 }
636 idx->bit = ffs(idx->val);
637 clear_bit(idx->bit - 1, &idx->val);
638 return idx;
639}
640
641static void clusterip_seq_stop(struct seq_file *s, void *v)
642{
643 if (!IS_ERR(v))
644 kfree(v);
645}
646
647static int clusterip_seq_show(struct seq_file *s, void *v)
648{
649 struct clusterip_seq_position *idx = v;
650
651 if (idx->pos != 0)
652 seq_putc(s, ',');
653
654 seq_printf(s, "%u", idx->bit);
655
656 if (idx->pos == idx->weight - 1)
657 seq_putc(s, '\n');
658
659 return 0;
660}
661
662static const struct seq_operations clusterip_seq_ops = {
663 .start = clusterip_seq_start,
664 .next = clusterip_seq_next,
665 .stop = clusterip_seq_stop,
666 .show = clusterip_seq_show,
667};
668
669static int clusterip_proc_open(struct inode *inode, struct file *file)
670{
671 int ret = seq_open(file, &clusterip_seq_ops);
672
673 if (!ret) {
674 struct seq_file *sf = file->private_data;
675 struct clusterip_config *c = PDE_DATA(inode);
676
677 sf->private = c;
678
679 clusterip_config_get(c);
680 }
681
682 return ret;
683}
684
685static int clusterip_proc_release(struct inode *inode, struct file *file)
686{
687 struct clusterip_config *c = PDE_DATA(inode);
688 int ret;
689
690 ret = seq_release(inode, file);
691
692 if (!ret)
693 clusterip_config_put(c);
694
695 return ret;
696}
697
698static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
699 size_t size, loff_t *ofs)
700{
701 struct clusterip_config *c = PDE_DATA(file_inode(file));
702#define PROC_WRITELEN 10
703 char buffer[PROC_WRITELEN+1];
704 unsigned long nodenum;
705 int rc;
706
707 if (size > PROC_WRITELEN)
708 return -EIO;
709 if (copy_from_user(buffer, input, size))
710 return -EFAULT;
711 buffer[size] = 0;
712
713 if (*buffer == '+') {
714 rc = kstrtoul(buffer+1, 10, &nodenum);
715 if (rc)
716 return rc;
717 if (clusterip_add_node(c, nodenum))
718 return -ENOMEM;
719 } else if (*buffer == '-') {
720 rc = kstrtoul(buffer+1, 10, &nodenum);
721 if (rc)
722 return rc;
723 if (clusterip_del_node(c, nodenum))
724 return -ENOENT;
725 } else
726 return -EIO;
727
728 return size;
729}
730
731static const struct file_operations clusterip_proc_fops = {
732 .owner = THIS_MODULE,
733 .open = clusterip_proc_open,
734 .read = seq_read,
735 .write = clusterip_proc_write,
736 .llseek = seq_lseek,
737 .release = clusterip_proc_release,
738};
739
740#endif
741
742static int clusterip_net_init(struct net *net)
743{
744 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
745
746 INIT_LIST_HEAD(&cn->configs);
747
748 spin_lock_init(&cn->lock);
749
750#ifdef CONFIG_PROC_FS
751 cn->procdir = proc_mkdir("ipt_CLUSTERIP", net->proc_net);
752 if (!cn->procdir) {
753 pr_err("Unable to proc dir entry\n");
754 return -ENOMEM;
755 }
756#endif
757
758 return 0;
759}
760
761static void clusterip_net_exit(struct net *net)
762{
763#ifdef CONFIG_PROC_FS
764 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
765 proc_remove(cn->procdir);
766#endif
767}
768
769static struct pernet_operations clusterip_net_ops = {
770 .init = clusterip_net_init,
771 .exit = clusterip_net_exit,
772 .id = &clusterip_net_id,
773 .size = sizeof(struct clusterip_net),
774};
775
776static int __init clusterip_tg_init(void)
777{
778 int ret;
779
780 ret = register_pernet_subsys(&clusterip_net_ops);
781 if (ret < 0)
782 return ret;
783
784 ret = xt_register_target(&clusterip_tg_reg);
785 if (ret < 0)
786 goto cleanup_subsys;
787
788 ret = nf_register_hook(&cip_arp_ops);
789 if (ret < 0)
790 goto cleanup_target;
791
792 pr_info("ClusterIP Version %s loaded successfully\n",
793 CLUSTERIP_VERSION);
794
795 return 0;
796
797cleanup_target:
798 xt_unregister_target(&clusterip_tg_reg);
799cleanup_subsys:
800 unregister_pernet_subsys(&clusterip_net_ops);
801 return ret;
802}
803
804static void __exit clusterip_tg_exit(void)
805{
806 pr_info("ClusterIP Version %s unloading\n", CLUSTERIP_VERSION);
807
808 nf_unregister_hook(&cip_arp_ops);
809 xt_unregister_target(&clusterip_tg_reg);
810 unregister_pernet_subsys(&clusterip_net_ops);
811
812
813 rcu_barrier_bh();
814}
815
816module_init(clusterip_tg_init);
817module_exit(clusterip_tg_exit);
818