1
2
3
4
5
6
7
8
9
10
11
12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13#include <linux/module.h>
14#include <linux/proc_fs.h>
15#include <linux/jhash.h>
16#include <linux/bitops.h>
17#include <linux/skbuff.h>
18#include <linux/slab.h>
19#include <linux/ip.h>
20#include <linux/tcp.h>
21#include <linux/udp.h>
22#include <linux/icmp.h>
23#include <linux/if_arp.h>
24#include <linux/seq_file.h>
25#include <linux/netfilter_arp.h>
26#include <linux/netfilter/x_tables.h>
27#include <linux/netfilter_ipv4/ip_tables.h>
28#include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
29#include <net/netfilter/nf_conntrack.h>
30#include <net/net_namespace.h>
31#include <net/netns/generic.h>
32#include <net/checksum.h>
33#include <net/ip.h>
34
35#define CLUSTERIP_VERSION "0.8"
36
37MODULE_LICENSE("GPL");
38MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
39MODULE_DESCRIPTION("Xtables: CLUSTERIP target");
40
41struct clusterip_config {
42 struct list_head list;
43 atomic_t refcount;
44 atomic_t entries;
45
46
47 __be32 clusterip;
48 u_int8_t clustermac[ETH_ALEN];
49 struct net_device *dev;
50 u_int16_t num_total_nodes;
51 unsigned long local_nodes;
52
53#ifdef CONFIG_PROC_FS
54 struct proc_dir_entry *pde;
55#endif
56 enum clusterip_hashmode hash_mode;
57 u_int32_t hash_initval;
58 struct rcu_head rcu;
59};
60
61#ifdef CONFIG_PROC_FS
62static const struct file_operations clusterip_proc_fops;
63#endif
64
65static int clusterip_net_id __read_mostly;
66
67struct clusterip_net {
68 struct list_head configs;
69
70 spinlock_t lock;
71
72#ifdef CONFIG_PROC_FS
73 struct proc_dir_entry *procdir;
74#endif
75};
76
77static inline void
78clusterip_config_get(struct clusterip_config *c)
79{
80 atomic_inc(&c->refcount);
81}
82
83
84static void clusterip_config_rcu_free(struct rcu_head *head)
85{
86 kfree(container_of(head, struct clusterip_config, rcu));
87}
88
89static inline void
90clusterip_config_put(struct clusterip_config *c)
91{
92 if (atomic_dec_and_test(&c->refcount))
93 call_rcu_bh(&c->rcu, clusterip_config_rcu_free);
94}
95
96
97
98
99static inline void
100clusterip_config_entry_put(struct clusterip_config *c)
101{
102 struct net *net = dev_net(c->dev);
103 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
104
105 local_bh_disable();
106 if (atomic_dec_and_lock(&c->entries, &cn->lock)) {
107 list_del_rcu(&c->list);
108 spin_unlock(&cn->lock);
109 local_bh_enable();
110
111 dev_mc_del(c->dev, c->clustermac);
112 dev_put(c->dev);
113
114
115
116
117#ifdef CONFIG_PROC_FS
118 proc_remove(c->pde);
119#endif
120 return;
121 }
122 local_bh_enable();
123}
124
125static struct clusterip_config *
126__clusterip_config_find(struct net *net, __be32 clusterip)
127{
128 struct clusterip_config *c;
129 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
130
131 list_for_each_entry_rcu(c, &cn->configs, list) {
132 if (c->clusterip == clusterip)
133 return c;
134 }
135
136 return NULL;
137}
138
139static inline struct clusterip_config *
140clusterip_config_find_get(struct net *net, __be32 clusterip, int entry)
141{
142 struct clusterip_config *c;
143
144 rcu_read_lock_bh();
145 c = __clusterip_config_find(net, clusterip);
146 if (c) {
147 if (unlikely(!atomic_inc_not_zero(&c->refcount)))
148 c = NULL;
149 else if (entry)
150 atomic_inc(&c->entries);
151 }
152 rcu_read_unlock_bh();
153
154 return c;
155}
156
157static void
158clusterip_config_init_nodelist(struct clusterip_config *c,
159 const struct ipt_clusterip_tgt_info *i)
160{
161 int n;
162
163 for (n = 0; n < i->num_local_nodes; n++)
164 set_bit(i->local_nodes[n] - 1, &c->local_nodes);
165}
166
167static struct clusterip_config *
168clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
169 struct net_device *dev)
170{
171 struct clusterip_config *c;
172 struct clusterip_net *cn = net_generic(dev_net(dev), clusterip_net_id);
173
174 c = kzalloc(sizeof(*c), GFP_ATOMIC);
175 if (!c)
176 return NULL;
177
178 c->dev = dev;
179 c->clusterip = ip;
180 memcpy(&c->clustermac, &i->clustermac, ETH_ALEN);
181 c->num_total_nodes = i->num_total_nodes;
182 clusterip_config_init_nodelist(c, i);
183 c->hash_mode = i->hash_mode;
184 c->hash_initval = i->hash_initval;
185 atomic_set(&c->refcount, 1);
186 atomic_set(&c->entries, 1);
187
188#ifdef CONFIG_PROC_FS
189 {
190 char buffer[16];
191
192
193 sprintf(buffer, "%pI4", &ip);
194 c->pde = proc_create_data(buffer, S_IWUSR|S_IRUSR,
195 cn->procdir,
196 &clusterip_proc_fops, c);
197 if (!c->pde) {
198 kfree(c);
199 return NULL;
200 }
201 }
202#endif
203
204 spin_lock_bh(&cn->lock);
205 list_add_rcu(&c->list, &cn->configs);
206 spin_unlock_bh(&cn->lock);
207
208 return c;
209}
210
211#ifdef CONFIG_PROC_FS
212static int
213clusterip_add_node(struct clusterip_config *c, u_int16_t nodenum)
214{
215
216 if (nodenum == 0 ||
217 nodenum > c->num_total_nodes)
218 return 1;
219
220
221 if (test_and_set_bit(nodenum - 1, &c->local_nodes))
222 return 1;
223
224 return 0;
225}
226
227static bool
228clusterip_del_node(struct clusterip_config *c, u_int16_t nodenum)
229{
230 if (nodenum == 0 ||
231 nodenum > c->num_total_nodes)
232 return true;
233
234 if (test_and_clear_bit(nodenum - 1, &c->local_nodes))
235 return false;
236
237 return true;
238}
239#endif
240
241static inline u_int32_t
242clusterip_hashfn(const struct sk_buff *skb,
243 const struct clusterip_config *config)
244{
245 const struct iphdr *iph = ip_hdr(skb);
246 unsigned long hashval;
247 u_int16_t sport = 0, dport = 0;
248 int poff;
249
250 poff = proto_ports_offset(iph->protocol);
251 if (poff >= 0) {
252 const u_int16_t *ports;
253 u16 _ports[2];
254
255 ports = skb_header_pointer(skb, iph->ihl * 4 + poff, 4, _ports);
256 if (ports) {
257 sport = ports[0];
258 dport = ports[1];
259 }
260 } else {
261 net_info_ratelimited("unknown protocol %u\n", iph->protocol);
262 }
263
264 switch (config->hash_mode) {
265 case CLUSTERIP_HASHMODE_SIP:
266 hashval = jhash_1word(ntohl(iph->saddr),
267 config->hash_initval);
268 break;
269 case CLUSTERIP_HASHMODE_SIP_SPT:
270 hashval = jhash_2words(ntohl(iph->saddr), sport,
271 config->hash_initval);
272 break;
273 case CLUSTERIP_HASHMODE_SIP_SPT_DPT:
274 hashval = jhash_3words(ntohl(iph->saddr), sport, dport,
275 config->hash_initval);
276 break;
277 default:
278
279 hashval = 0;
280
281
282 pr_info("unknown mode %u\n", config->hash_mode);
283 BUG();
284 break;
285 }
286
287
288 return reciprocal_scale(hashval, config->num_total_nodes) + 1;
289}
290
291static inline int
292clusterip_responsible(const struct clusterip_config *config, u_int32_t hash)
293{
294 return test_bit(hash - 1, &config->local_nodes);
295}
296
297
298
299
300
301static unsigned int
302clusterip_tg(struct sk_buff *skb, const struct xt_action_param *par)
303{
304 const struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
305 struct nf_conn *ct;
306 enum ip_conntrack_info ctinfo;
307 u_int32_t hash;
308
309
310
311
312
313 ct = nf_ct_get(skb, &ctinfo);
314 if (ct == NULL)
315 return NF_DROP;
316
317
318
319 if (ip_hdr(skb)->protocol == IPPROTO_ICMP &&
320 (ctinfo == IP_CT_RELATED ||
321 ctinfo == IP_CT_RELATED_REPLY))
322 return XT_CONTINUE;
323
324
325
326
327
328 hash = clusterip_hashfn(skb, cipinfo->config);
329
330 switch (ctinfo) {
331 case IP_CT_NEW:
332 ct->mark = hash;
333 break;
334 case IP_CT_RELATED:
335 case IP_CT_RELATED_REPLY:
336
337
338
339 case IP_CT_ESTABLISHED:
340 case IP_CT_ESTABLISHED_REPLY:
341 break;
342 default:
343 break;
344 }
345
346#ifdef DEBUG
347 nf_ct_dump_tuple_ip(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
348#endif
349 pr_debug("hash=%u ct_hash=%u ", hash, ct->mark);
350 if (!clusterip_responsible(cipinfo->config, hash)) {
351 pr_debug("not responsible\n");
352 return NF_DROP;
353 }
354 pr_debug("responsible\n");
355
356
357
358 skb->pkt_type = PACKET_HOST;
359
360 return XT_CONTINUE;
361}
362
363static int clusterip_tg_check(const struct xt_tgchk_param *par)
364{
365 struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
366 const struct ipt_entry *e = par->entryinfo;
367 struct clusterip_config *config;
368 int ret;
369
370 if (par->nft_compat) {
371 pr_err("cannot use CLUSTERIP target from nftables compat\n");
372 return -EOPNOTSUPP;
373 }
374
375 if (cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP &&
376 cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT &&
377 cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT_DPT) {
378 pr_info("unknown mode %u\n", cipinfo->hash_mode);
379 return -EINVAL;
380
381 }
382 if (e->ip.dmsk.s_addr != htonl(0xffffffff) ||
383 e->ip.dst.s_addr == 0) {
384 pr_info("Please specify destination IP\n");
385 return -EINVAL;
386 }
387
388
389
390 config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1);
391 if (!config) {
392 if (!(cipinfo->flags & CLUSTERIP_FLAG_NEW)) {
393 pr_info("no config found for %pI4, need 'new'\n",
394 &e->ip.dst.s_addr);
395 return -EINVAL;
396 } else {
397 struct net_device *dev;
398
399 if (e->ip.iniface[0] == '\0') {
400 pr_info("Please specify an interface name\n");
401 return -EINVAL;
402 }
403
404 dev = dev_get_by_name(par->net, e->ip.iniface);
405 if (!dev) {
406 pr_info("no such interface %s\n",
407 e->ip.iniface);
408 return -ENOENT;
409 }
410
411 config = clusterip_config_init(cipinfo,
412 e->ip.dst.s_addr, dev);
413 if (!config) {
414 dev_put(dev);
415 return -ENOMEM;
416 }
417 dev_mc_add(config->dev, config->clustermac);
418 }
419 }
420 cipinfo->config = config;
421
422 ret = nf_ct_l3proto_try_module_get(par->family);
423 if (ret < 0)
424 pr_info("cannot load conntrack support for proto=%u\n",
425 par->family);
426
427 if (!par->net->xt.clusterip_deprecated_warning) {
428 pr_info("ipt_CLUSTERIP is deprecated and it will removed soon, "
429 "use xt_cluster instead\n");
430 par->net->xt.clusterip_deprecated_warning = true;
431 }
432
433 return ret;
434}
435
436
437static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
438{
439 const struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
440
441
442
443 clusterip_config_entry_put(cipinfo->config);
444
445 clusterip_config_put(cipinfo->config);
446
447 nf_ct_l3proto_module_put(par->family);
448}
449
450#ifdef CONFIG_COMPAT
451struct compat_ipt_clusterip_tgt_info
452{
453 u_int32_t flags;
454 u_int8_t clustermac[6];
455 u_int16_t num_total_nodes;
456 u_int16_t num_local_nodes;
457 u_int16_t local_nodes[CLUSTERIP_MAX_NODES];
458 u_int32_t hash_mode;
459 u_int32_t hash_initval;
460 compat_uptr_t config;
461};
462#endif
463
464static struct xt_target clusterip_tg_reg __read_mostly = {
465 .name = "CLUSTERIP",
466 .family = NFPROTO_IPV4,
467 .target = clusterip_tg,
468 .checkentry = clusterip_tg_check,
469 .destroy = clusterip_tg_destroy,
470 .targetsize = sizeof(struct ipt_clusterip_tgt_info),
471#ifdef CONFIG_COMPAT
472 .compatsize = sizeof(struct compat_ipt_clusterip_tgt_info),
473#endif
474 .me = THIS_MODULE
475};
476
477
478
479
480
481
482
483struct arp_payload {
484 u_int8_t src_hw[ETH_ALEN];
485 __be32 src_ip;
486 u_int8_t dst_hw[ETH_ALEN];
487 __be32 dst_ip;
488} __packed;
489
490#ifdef DEBUG
491static void arp_print(struct arp_payload *payload)
492{
493#define HBUFFERLEN 30
494 char hbuffer[HBUFFERLEN];
495 int j, k;
496
497 for (k = 0, j = 0; k < HBUFFERLEN - 3 && j < ETH_ALEN; j++) {
498 hbuffer[k++] = hex_asc_hi(payload->src_hw[j]);
499 hbuffer[k++] = hex_asc_lo(payload->src_hw[j]);
500 hbuffer[k++] = ':';
501 }
502 hbuffer[--k] = '\0';
503
504 pr_debug("src %pI4@%s, dst %pI4\n",
505 &payload->src_ip, hbuffer, &payload->dst_ip);
506}
507#endif
508
509static unsigned int
510arp_mangle(void *priv,
511 struct sk_buff *skb,
512 const struct nf_hook_state *state)
513{
514 struct arphdr *arp = arp_hdr(skb);
515 struct arp_payload *payload;
516 struct clusterip_config *c;
517 struct net *net = state->net;
518
519
520 if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
521 arp->ar_pro != htons(ETH_P_IP) ||
522 arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
523 return NF_ACCEPT;
524
525
526 if (arp->ar_op != htons(ARPOP_REPLY) &&
527 arp->ar_op != htons(ARPOP_REQUEST))
528 return NF_ACCEPT;
529
530 payload = (void *)(arp+1);
531
532
533
534 c = clusterip_config_find_get(net, payload->src_ip, 0);
535 if (!c)
536 return NF_ACCEPT;
537
538
539
540
541
542 if (c->dev != state->out) {
543 pr_debug("not mangling arp reply on different "
544 "interface: cip'%s'-skb'%s'\n",
545 c->dev->name, state->out->name);
546 clusterip_config_put(c);
547 return NF_ACCEPT;
548 }
549
550
551 memcpy(payload->src_hw, c->clustermac, arp->ar_hln);
552
553#ifdef DEBUG
554 pr_debug("mangled arp reply: ");
555 arp_print(payload);
556#endif
557
558 clusterip_config_put(c);
559
560 return NF_ACCEPT;
561}
562
563static struct nf_hook_ops cip_arp_ops __read_mostly = {
564 .hook = arp_mangle,
565 .pf = NFPROTO_ARP,
566 .hooknum = NF_ARP_OUT,
567 .priority = -1
568};
569
570
571
572
573
574#ifdef CONFIG_PROC_FS
575
576struct clusterip_seq_position {
577 unsigned int pos;
578 unsigned int weight;
579 unsigned int bit;
580 unsigned long val;
581};
582
583static void *clusterip_seq_start(struct seq_file *s, loff_t *pos)
584{
585 struct clusterip_config *c = s->private;
586 unsigned int weight;
587 u_int32_t local_nodes;
588 struct clusterip_seq_position *idx;
589
590
591 local_nodes = c->local_nodes;
592 weight = hweight32(local_nodes);
593 if (*pos >= weight)
594 return NULL;
595
596 idx = kmalloc(sizeof(struct clusterip_seq_position), GFP_KERNEL);
597 if (!idx)
598 return ERR_PTR(-ENOMEM);
599
600 idx->pos = *pos;
601 idx->weight = weight;
602 idx->bit = ffs(local_nodes);
603 idx->val = local_nodes;
604 clear_bit(idx->bit - 1, &idx->val);
605
606 return idx;
607}
608
609static void *clusterip_seq_next(struct seq_file *s, void *v, loff_t *pos)
610{
611 struct clusterip_seq_position *idx = v;
612
613 *pos = ++idx->pos;
614 if (*pos >= idx->weight) {
615 kfree(v);
616 return NULL;
617 }
618 idx->bit = ffs(idx->val);
619 clear_bit(idx->bit - 1, &idx->val);
620 return idx;
621}
622
623static void clusterip_seq_stop(struct seq_file *s, void *v)
624{
625 if (!IS_ERR(v))
626 kfree(v);
627}
628
629static int clusterip_seq_show(struct seq_file *s, void *v)
630{
631 struct clusterip_seq_position *idx = v;
632
633 if (idx->pos != 0)
634 seq_putc(s, ',');
635
636 seq_printf(s, "%u", idx->bit);
637
638 if (idx->pos == idx->weight - 1)
639 seq_putc(s, '\n');
640
641 return 0;
642}
643
644static const struct seq_operations clusterip_seq_ops = {
645 .start = clusterip_seq_start,
646 .next = clusterip_seq_next,
647 .stop = clusterip_seq_stop,
648 .show = clusterip_seq_show,
649};
650
651static int clusterip_proc_open(struct inode *inode, struct file *file)
652{
653 int ret = seq_open(file, &clusterip_seq_ops);
654
655 if (!ret) {
656 struct seq_file *sf = file->private_data;
657 struct clusterip_config *c = PDE_DATA(inode);
658
659 sf->private = c;
660
661 clusterip_config_get(c);
662 }
663
664 return ret;
665}
666
667static int clusterip_proc_release(struct inode *inode, struct file *file)
668{
669 struct clusterip_config *c = PDE_DATA(inode);
670 int ret;
671
672 ret = seq_release(inode, file);
673
674 if (!ret)
675 clusterip_config_put(c);
676
677 return ret;
678}
679
680static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
681 size_t size, loff_t *ofs)
682{
683 struct clusterip_config *c = PDE_DATA(file_inode(file));
684#define PROC_WRITELEN 10
685 char buffer[PROC_WRITELEN+1];
686 unsigned long nodenum;
687 int rc;
688
689 if (size > PROC_WRITELEN)
690 return -EIO;
691 if (copy_from_user(buffer, input, size))
692 return -EFAULT;
693 buffer[size] = 0;
694
695 if (*buffer == '+') {
696 rc = kstrtoul(buffer+1, 10, &nodenum);
697 if (rc)
698 return rc;
699 if (clusterip_add_node(c, nodenum))
700 return -ENOMEM;
701 } else if (*buffer == '-') {
702 rc = kstrtoul(buffer+1, 10, &nodenum);
703 if (rc)
704 return rc;
705 if (clusterip_del_node(c, nodenum))
706 return -ENOENT;
707 } else
708 return -EIO;
709
710 return size;
711}
712
713static const struct file_operations clusterip_proc_fops = {
714 .owner = THIS_MODULE,
715 .open = clusterip_proc_open,
716 .read = seq_read,
717 .write = clusterip_proc_write,
718 .llseek = seq_lseek,
719 .release = clusterip_proc_release,
720};
721
722#endif
723
724static int clusterip_net_init(struct net *net)
725{
726 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
727
728 INIT_LIST_HEAD(&cn->configs);
729
730 spin_lock_init(&cn->lock);
731
732#ifdef CONFIG_PROC_FS
733 cn->procdir = proc_mkdir("ipt_CLUSTERIP", net->proc_net);
734 if (!cn->procdir) {
735 pr_err("Unable to proc dir entry\n");
736 return -ENOMEM;
737 }
738#endif
739
740 return 0;
741}
742
743static void clusterip_net_exit(struct net *net)
744{
745#ifdef CONFIG_PROC_FS
746 struct clusterip_net *cn = net_generic(net, clusterip_net_id);
747 proc_remove(cn->procdir);
748#endif
749}
750
751static struct pernet_operations clusterip_net_ops = {
752 .init = clusterip_net_init,
753 .exit = clusterip_net_exit,
754 .id = &clusterip_net_id,
755 .size = sizeof(struct clusterip_net),
756};
757
758static int __init clusterip_tg_init(void)
759{
760 int ret;
761
762 ret = register_pernet_subsys(&clusterip_net_ops);
763 if (ret < 0)
764 return ret;
765
766 ret = xt_register_target(&clusterip_tg_reg);
767 if (ret < 0)
768 goto cleanup_subsys;
769
770 ret = nf_register_hook(&cip_arp_ops);
771 if (ret < 0)
772 goto cleanup_target;
773
774 pr_info("ClusterIP Version %s loaded successfully\n",
775 CLUSTERIP_VERSION);
776
777 return 0;
778
779cleanup_target:
780 xt_unregister_target(&clusterip_tg_reg);
781cleanup_subsys:
782 unregister_pernet_subsys(&clusterip_net_ops);
783 return ret;
784}
785
786static void __exit clusterip_tg_exit(void)
787{
788 pr_info("ClusterIP Version %s unloading\n", CLUSTERIP_VERSION);
789
790 nf_unregister_hook(&cip_arp_ops);
791 xt_unregister_target(&clusterip_tg_reg);
792 unregister_pernet_subsys(&clusterip_net_ops);
793
794
795 rcu_barrier_bh();
796}
797
798module_init(clusterip_tg_init);
799module_exit(clusterip_tg_exit);
800