ipvs: API change to avoid rescan of IPv6 exthdr (d4383f04) · Commits · e / devices / android_kernel_sony_msm8998

include/net/ip_vs.h

+41 −40

Original line number	Original line	Diff line number	Diff line
	@@ -487,27 +487,26 @@ struct ip_vs_protocol {

	int (conn_schedule)(int af, struct sk_buff skb,		int (conn_schedule)(int af, struct sk_buff skb,
	struct ip_vs_proto_data *pd,		struct ip_vs_proto_data *pd,
	int verdict, struct ip_vs_conn *cpp);		int verdict, struct ip_vs_conn *cpp,
			struct ip_vs_iphdr *iph);

	struct ip_vs_conn *		struct ip_vs_conn *
	(*conn_in_get)(int af,		(*conn_in_get)(int af,
	const struct sk_buff *skb,		const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph,
	unsigned int proto_off,
	int inverse);		int inverse);

	struct ip_vs_conn *		struct ip_vs_conn *
	(*conn_out_get)(int af,		(*conn_out_get)(int af,
	const struct sk_buff *skb,		const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph,
	unsigned int proto_off,
	int inverse);		int inverse);

	int (snat_handler)(struct sk_buff skb,		int (snat_handler)(struct sk_buff skb, struct ip_vs_protocol *pp,
	struct ip_vs_protocol pp, struct ip_vs_conn cp);		struct ip_vs_conn cp, struct ip_vs_iphdr iph);

	int (dnat_handler)(struct sk_buff skb,		int (dnat_handler)(struct sk_buff skb, struct ip_vs_protocol *pp,
	struct ip_vs_protocol pp, struct ip_vs_conn cp);		struct ip_vs_conn cp, struct ip_vs_iphdr iph);

	int (csum_check)(int af, struct sk_buff skb,		int (csum_check)(int af, struct sk_buff skb,
	struct ip_vs_protocol *pp);		struct ip_vs_protocol *pp);
	@@ -607,7 +606,7 @@ struct ip_vs_conn {
	NF_ACCEPT can be returned when destination is local.		NF_ACCEPT can be returned when destination is local.
	*/		*/
	int (packet_xmit)(struct sk_buff skb, struct ip_vs_conn *cp,		int (packet_xmit)(struct sk_buff skb, struct ip_vs_conn *cp,
	struct ip_vs_protocol *pp);		struct ip_vs_protocol pp, struct ip_vs_iphdr iph);

	/* Note: we can group the following members into a structure,		/* Note: we can group the following members into a structure,
	in order to save more space, and the following members are		in order to save more space, and the following members are
	@@ -858,13 +857,11 @@ struct ip_vs_app {

	struct ip_vs_conn *		struct ip_vs_conn *
	(conn_in_get)(const struct sk_buff skb, struct ip_vs_app *app,		(conn_in_get)(const struct sk_buff skb, struct ip_vs_app *app,
	const struct iphdr *iph, unsigned int proto_off,		const struct iphdr *iph, int inverse);
	int inverse);

	struct ip_vs_conn *		struct ip_vs_conn *
	(conn_out_get)(const struct sk_buff skb, struct ip_vs_app *app,		(conn_out_get)(const struct sk_buff skb, struct ip_vs_app *app,
	const struct iphdr *iph, unsigned int proto_off,		const struct iphdr *iph, int inverse);
	int inverse);

	int (state_transition)(struct ip_vs_conn cp, int direction,		int (state_transition)(struct ip_vs_conn cp, int direction,
	const struct sk_buff *skb,		const struct sk_buff *skb,
	@@ -1163,14 +1160,12 @@ struct ip_vs_conn ip_vs_ct_in_get(const struct ip_vs_conn_param p);

	struct ip_vs_conn * ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,		struct ip_vs_conn * ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph,
	unsigned int proto_off,
	int inverse);		int inverse);

	struct ip_vs_conn ip_vs_conn_out_get(const struct ip_vs_conn_param p);		struct ip_vs_conn ip_vs_conn_out_get(const struct ip_vs_conn_param p);

	struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,		struct ip_vs_conn * ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph,
	unsigned int proto_off,
	int inverse);		int inverse);

	/* put back the conn without restarting its timer */		/* put back the conn without restarting its timer */
	@@ -1343,9 +1338,10 @@ extern struct ip_vs_scheduler ip_vs_scheduler_get(const char sched_name);
	extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);		extern void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler);
	extern struct ip_vs_conn *		extern struct ip_vs_conn *
	ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,		ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,
	struct ip_vs_proto_data pd, int ignored);		struct ip_vs_proto_data pd, int ignored,
			struct ip_vs_iphdr *iph);
	extern int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,		extern int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,
	struct ip_vs_proto_data *pd);		struct ip_vs_proto_data pd, struct ip_vs_iphdr iph);

	extern void ip_vs_scheduler_err(struct ip_vs_service svc, const char msg);		extern void ip_vs_scheduler_err(struct ip_vs_service svc, const char msg);

	@@ -1404,33 +1400,38 @@ extern void ip_vs_read_estimator(struct ip_vs_stats_user *dst,
	/*		/*
	* Various IPVS packet transmitters (from ip_vs_xmit.c)		* Various IPVS packet transmitters (from ip_vs_xmit.c)
	*/		*/
	extern int ip_vs_null_xmit		extern int ip_vs_null_xmit(struct sk_buff skb, struct ip_vs_conn cp,
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		struct ip_vs_protocol pp, struct ip_vs_iphdr iph);
	extern int ip_vs_bypass_xmit		extern int ip_vs_bypass_xmit(struct sk_buff skb, struct ip_vs_conn cp,
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		struct ip_vs_protocol *pp,
	extern int ip_vs_nat_xmit		struct ip_vs_iphdr *iph);
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		extern int ip_vs_nat_xmit(struct sk_buff skb, struct ip_vs_conn cp,
	extern int ip_vs_tunnel_xmit		struct ip_vs_protocol pp, struct ip_vs_iphdr iph);
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		extern int ip_vs_tunnel_xmit(struct sk_buff skb, struct ip_vs_conn cp,
	extern int ip_vs_dr_xmit		struct ip_vs_protocol *pp,
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		struct ip_vs_iphdr *iph);
	extern int ip_vs_icmp_xmit		extern int ip_vs_dr_xmit(struct sk_buff skb, struct ip_vs_conn cp,
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp,		struct ip_vs_protocol pp, struct ip_vs_iphdr iph);
	int offset, unsigned int hooknum);		extern int ip_vs_icmp_xmit(struct sk_buff skb, struct ip_vs_conn cp,
			struct ip_vs_protocol *pp, int offset,
			unsigned int hooknum, struct ip_vs_iphdr *iph);
	extern void ip_vs_dst_reset(struct ip_vs_dest *dest);		extern void ip_vs_dst_reset(struct ip_vs_dest *dest);

	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	extern int ip_vs_bypass_xmit_v6		extern int ip_vs_bypass_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		struct ip_vs_protocol *pp,
	extern int ip_vs_nat_xmit_v6		struct ip_vs_iphdr *iph);
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		extern int ip_vs_nat_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
	extern int ip_vs_tunnel_xmit_v6		struct ip_vs_protocol *pp,
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		struct ip_vs_iphdr *iph);
	extern int ip_vs_dr_xmit_v6		extern int ip_vs_tunnel_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp);		struct ip_vs_protocol *pp,
	extern int ip_vs_icmp_xmit_v6		struct ip_vs_iphdr *iph);
	(struct sk_buff skb, struct ip_vs_conn cp, struct ip_vs_protocol *pp,		extern int ip_vs_dr_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
	int offset, unsigned int hooknum);		struct ip_vs_protocol pp, struct ip_vs_iphdr iph);
			extern int ip_vs_icmp_xmit_v6(struct sk_buff skb, struct ip_vs_conn cp,
			struct ip_vs_protocol *pp, int offset,
			unsigned int hooknum, struct ip_vs_iphdr *iph);
	#endif		#endif

	#ifdef CONFIG_SYSCTL		#ifdef CONFIG_SYSCTL

net/netfilter/ipvs/ip_vs_conn.c

+6 −9

Original line number	Original line	Diff line number	Diff line
	@@ -308,13 +308,12 @@ struct ip_vs_conn ip_vs_conn_in_get(const struct ip_vs_conn_param p)
	static int		static int
	ip_vs_conn_fill_param_proto(int af, const struct sk_buff *skb,		ip_vs_conn_fill_param_proto(int af, const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph,
	unsigned int proto_off, int inverse,		int inverse, struct ip_vs_conn_param *p)
	struct ip_vs_conn_param *p)
	{		{
	__be16 _ports[2], *pptr;		__be16 _ports[2], *pptr;
	struct net *net = skb_net(skb);		struct net *net = skb_net(skb);

	pptr = frag_safe_skb_hp(skb, proto_off, sizeof(_ports), _ports, iph);		pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports, iph);
	if (pptr == NULL)		if (pptr == NULL)
	return 1;		return 1;

	@@ -329,12 +328,11 @@ ip_vs_conn_fill_param_proto(int af, const struct sk_buff *skb,

	struct ip_vs_conn *		struct ip_vs_conn *
	ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,		ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph, int inverse)
	unsigned int proto_off, int inverse)
	{		{
	struct ip_vs_conn_param p;		struct ip_vs_conn_param p;

	if (ip_vs_conn_fill_param_proto(af, skb, iph, proto_off, inverse, &p))		if (ip_vs_conn_fill_param_proto(af, skb, iph, inverse, &p))
	return NULL;		return NULL;

	return ip_vs_conn_in_get(&p);		return ip_vs_conn_in_get(&p);
	@@ -432,12 +430,11 @@ struct ip_vs_conn ip_vs_conn_out_get(const struct ip_vs_conn_param p)

	struct ip_vs_conn *		struct ip_vs_conn *
	ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,		ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph, int inverse)
	unsigned int proto_off, int inverse)
	{		{
	struct ip_vs_conn_param p;		struct ip_vs_conn_param p;

	if (ip_vs_conn_fill_param_proto(af, skb, iph, proto_off, inverse, &p))		if (ip_vs_conn_fill_param_proto(af, skb, iph, inverse, &p))
	return NULL;		return NULL;

	return ip_vs_conn_out_get(&p);		return ip_vs_conn_out_get(&p);

net/netfilter/ipvs/ip_vs_core.c

+51 −65

Original line number	Original line	Diff line number	Diff line
	@@ -222,11 +222,10 @@ ip_vs_conn_fill_param_persist(const struct ip_vs_service *svc,
	*/		*/
	static struct ip_vs_conn *		static struct ip_vs_conn *
	ip_vs_sched_persist(struct ip_vs_service *svc,		ip_vs_sched_persist(struct ip_vs_service *svc,
	struct sk_buff *skb,		struct sk_buff *skb, __be16 src_port, __be16 dst_port,
	__be16 src_port, __be16 dst_port, int *ignored)		int ignored, struct ip_vs_iphdr iph)
	{		{
	struct ip_vs_conn *cp = NULL;		struct ip_vs_conn *cp = NULL;
	struct ip_vs_iphdr iph;
	struct ip_vs_dest *dest;		struct ip_vs_dest *dest;
	struct ip_vs_conn *ct;		struct ip_vs_conn *ct;
	__be16 dport = 0; /* destination port to forward */		__be16 dport = 0; /* destination port to forward */
	@@ -236,20 +235,18 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
	union nf_inet_addr snet; /* source network of the client,		union nf_inet_addr snet; /* source network of the client,
	after masking */		after masking */

	ip_vs_fill_iph_skb(svc->af, skb, &iph);

	/* Mask saddr with the netmask to adjust template granularity */		/* Mask saddr with the netmask to adjust template granularity */
	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	if (svc->af == AF_INET6)		if (svc->af == AF_INET6)
	ipv6_addr_prefix(&snet.in6, &iph.saddr.in6, svc->netmask);		ipv6_addr_prefix(&snet.in6, &iph->saddr.in6, svc->netmask);
	else		else
	#endif		#endif
	snet.ip = iph.saddr.ip & svc->netmask;		snet.ip = iph->saddr.ip & svc->netmask;

	IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "		IP_VS_DBG_BUF(6, "p-schedule: src %s:%u dest %s:%u "
	"mnet %s\n",		"mnet %s\n",
	IP_VS_DBG_ADDR(svc->af, &iph.saddr), ntohs(src_port),		IP_VS_DBG_ADDR(svc->af, &iph->saddr), ntohs(src_port),
	IP_VS_DBG_ADDR(svc->af, &iph.daddr), ntohs(dst_port),		IP_VS_DBG_ADDR(svc->af, &iph->daddr), ntohs(dst_port),
	IP_VS_DBG_ADDR(svc->af, &snet));		IP_VS_DBG_ADDR(svc->af, &snet));

	/*		/*
	@@ -266,8 +263,8 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
	* is created for other persistent services.		* is created for other persistent services.
	*/		*/
	{		{
	int protocol = iph.protocol;		int protocol = iph->protocol;
	const union nf_inet_addr *vaddr = &iph.daddr;		const union nf_inet_addr *vaddr = &iph->daddr;
	__be16 vport = 0;		__be16 vport = 0;

	if (dst_port == svc->port) {		if (dst_port == svc->port) {
	@@ -342,14 +339,14 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
	dport = dest->port;		dport = dest->port;

	flags = (svc->flags & IP_VS_SVC_F_ONEPACKET		flags = (svc->flags & IP_VS_SVC_F_ONEPACKET
	&& iph.protocol == IPPROTO_UDP)?		&& iph->protocol == IPPROTO_UDP) ?
	IP_VS_CONN_F_ONE_PACKET : 0;		IP_VS_CONN_F_ONE_PACKET : 0;

	/*		/*
	* Create a new connection according to the template		* Create a new connection according to the template
	*/		*/
	ip_vs_conn_fill_param(svc->net, svc->af, iph.protocol, &iph.saddr,		ip_vs_conn_fill_param(svc->net, svc->af, iph->protocol, &iph->saddr,
	src_port, &iph.daddr, dst_port, &param);		src_port, &iph->daddr, dst_port, &param);

	cp = ip_vs_conn_new(&param, &dest->addr, dport, flags, dest, skb->mark);		cp = ip_vs_conn_new(&param, &dest->addr, dport, flags, dest, skb->mark);
	if (cp == NULL) {		if (cp == NULL) {
	@@ -392,22 +389,20 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
	*/		*/
	struct ip_vs_conn *		struct ip_vs_conn *
	ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,		ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,
	struct ip_vs_proto_data pd, int ignored)		struct ip_vs_proto_data pd, int ignored,
			struct ip_vs_iphdr *iph)
	{		{
	struct ip_vs_protocol *pp = pd->pp;		struct ip_vs_protocol *pp = pd->pp;
	struct ip_vs_conn *cp = NULL;		struct ip_vs_conn *cp = NULL;
	struct ip_vs_iphdr iph;
	struct ip_vs_dest *dest;		struct ip_vs_dest *dest;
	__be16 _ports[2], *pptr;		__be16 _ports[2], *pptr;
	unsigned int flags;		unsigned int flags;

	*ignored = 1;		*ignored = 1;

	/*		/*
	* IPv6 frags, only the first hit here.		* IPv6 frags, only the first hit here.
	*/		*/
	ip_vs_fill_iph_skb(svc->af, skb, &iph);		pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports, iph);
	pptr = frag_safe_skb_hp(skb, iph.len, sizeof(_ports), _ports, &iph);
	if (pptr == NULL)		if (pptr == NULL)
	return NULL;		return NULL;

	@@ -427,7 +422,7 @@ ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,
	* Do not schedule replies from local real server.		* Do not schedule replies from local real server.
	*/		*/
	if ((!skb->dev \|\| skb->dev->flags & IFF_LOOPBACK) &&		if ((!skb->dev \|\| skb->dev->flags & IFF_LOOPBACK) &&
	(cp = pp->conn_in_get(svc->af, skb, &iph, iph.len, 1))) {		(cp = pp->conn_in_get(svc->af, skb, iph, 1))) {
	IP_VS_DBG_PKT(12, svc->af, pp, skb, 0,		IP_VS_DBG_PKT(12, svc->af, pp, skb, 0,
	"Not scheduling reply for existing connection");		"Not scheduling reply for existing connection");
	__ip_vs_conn_put(cp);		__ip_vs_conn_put(cp);
	@@ -438,7 +433,8 @@ ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,
	* Persistent service		* Persistent service
	*/		*/
	if (svc->flags & IP_VS_SVC_F_PERSISTENT)		if (svc->flags & IP_VS_SVC_F_PERSISTENT)
	return ip_vs_sched_persist(svc, skb, pptr[0], pptr[1], ignored);		return ip_vs_sched_persist(svc, skb, pptr[0], pptr[1], ignored,
			iph);

	*ignored = 0;		*ignored = 0;

	@@ -460,7 +456,7 @@ ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,
	}		}

	flags = (svc->flags & IP_VS_SVC_F_ONEPACKET		flags = (svc->flags & IP_VS_SVC_F_ONEPACKET
	&& iph.protocol == IPPROTO_UDP)?		&& iph->protocol == IPPROTO_UDP) ?
	IP_VS_CONN_F_ONE_PACKET : 0;		IP_VS_CONN_F_ONE_PACKET : 0;

	/*		/*
	@@ -469,9 +465,9 @@ ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,
	{		{
	struct ip_vs_conn_param p;		struct ip_vs_conn_param p;

	ip_vs_conn_fill_param(svc->net, svc->af, iph.protocol,		ip_vs_conn_fill_param(svc->net, svc->af, iph->protocol,
	&iph.saddr, pptr[0], &iph.daddr, pptr[1],		&iph->saddr, pptr[0], &iph->daddr,
	&p);		pptr[1], &p);
	cp = ip_vs_conn_new(&p, &dest->addr,		cp = ip_vs_conn_new(&p, &dest->addr,
	dest->port ? dest->port : pptr[1],		dest->port ? dest->port : pptr[1],
	flags, dest, skb->mark);		flags, dest, skb->mark);
	@@ -500,18 +496,16 @@ ip_vs_schedule(struct ip_vs_service svc, struct sk_buff skb,
	* no destination is available for a new connection.		* no destination is available for a new connection.
	*/		*/
	int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,		int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,
	struct ip_vs_proto_data *pd)		struct ip_vs_proto_data pd, struct ip_vs_iphdr iph)
	{		{
	__be16 _ports[2], *pptr;		__be16 _ports[2], *pptr;
	struct ip_vs_iphdr iph;
	#ifdef CONFIG_SYSCTL		#ifdef CONFIG_SYSCTL
	struct net *net;		struct net *net;
	struct netns_ipvs *ipvs;		struct netns_ipvs *ipvs;
	int unicast;		int unicast;
	#endif		#endif

	ip_vs_fill_iph_skb(svc->af, skb, &iph);		pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports, iph);
	pptr = frag_safe_skb_hp(skb, iph.len, sizeof(_ports), _ports, &iph);
	if (pptr == NULL) {		if (pptr == NULL) {
	ip_vs_service_put(svc);		ip_vs_service_put(svc);
	return NF_DROP;		return NF_DROP;
	@@ -522,10 +516,10 @@ int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,

	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	if (svc->af == AF_INET6)		if (svc->af == AF_INET6)
	unicast = ipv6_addr_type(&iph.daddr.in6) & IPV6_ADDR_UNICAST;		unicast = ipv6_addr_type(&iph->daddr.in6) & IPV6_ADDR_UNICAST;
	else		else
	#endif		#endif
	unicast = (inet_addr_type(net, iph.daddr.ip) == RTN_UNICAST);		unicast = (inet_addr_type(net, iph->daddr.ip) == RTN_UNICAST);

	/* if it is fwmark-based service, the cache_bypass sysctl is up		/* if it is fwmark-based service, the cache_bypass sysctl is up
	and the destination is a non-local unicast, then create		and the destination is a non-local unicast, then create
	@@ -535,7 +529,7 @@ int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,
	int ret;		int ret;
	struct ip_vs_conn *cp;		struct ip_vs_conn *cp;
	unsigned int flags = (svc->flags & IP_VS_SVC_F_ONEPACKET &&		unsigned int flags = (svc->flags & IP_VS_SVC_F_ONEPACKET &&
	iph.protocol == IPPROTO_UDP)?		iph->protocol == IPPROTO_UDP) ?
	IP_VS_CONN_F_ONE_PACKET : 0;		IP_VS_CONN_F_ONE_PACKET : 0;
	union nf_inet_addr daddr = { .all = { 0, 0, 0, 0 } };		union nf_inet_addr daddr = { .all = { 0, 0, 0, 0 } };

	@@ -545,9 +539,9 @@ int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,
	IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__);		IP_VS_DBG(6, "%s(): create a cache_bypass entry\n", __func__);
	{		{
	struct ip_vs_conn_param p;		struct ip_vs_conn_param p;
	ip_vs_conn_fill_param(svc->net, svc->af, iph.protocol,		ip_vs_conn_fill_param(svc->net, svc->af, iph->protocol,
	&iph.saddr, pptr[0],		&iph->saddr, pptr[0],
	&iph.daddr, pptr[1], &p);		&iph->daddr, pptr[1], &p);
	cp = ip_vs_conn_new(&p, &daddr, 0,		cp = ip_vs_conn_new(&p, &daddr, 0,
	IP_VS_CONN_F_BYPASS \| flags,		IP_VS_CONN_F_BYPASS \| flags,
	NULL, skb->mark);		NULL, skb->mark);
	@@ -562,7 +556,7 @@ int ip_vs_leave(struct ip_vs_service svc, struct sk_buff skb,
	ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);		ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);

	/* transmit the first SYN packet */		/* transmit the first SYN packet */
	ret = cp->packet_xmit(skb, cp, pd->pp);		ret = cp->packet_xmit(skb, cp, pd->pp, iph);
	/* do not touch skb anymore */		/* do not touch skb anymore */

	atomic_inc(&cp->in_pkts);		atomic_inc(&cp->in_pkts);
	@@ -908,7 +902,7 @@ static int ip_vs_out_icmp(struct sk_buff skb, int related,
	ip_vs_fill_ip4hdr(cih, &ciph);		ip_vs_fill_ip4hdr(cih, &ciph);
	ciph.len += offset;		ciph.len += offset;
	/* The embedded headers contain source and dest in reverse order */		/* The embedded headers contain source and dest in reverse order */
	cp = pp->conn_out_get(AF_INET, skb, &ciph, offset, 1);		cp = pp->conn_out_get(AF_INET, skb, &ciph, 1);
	if (!cp)		if (!cp)
	return NF_ACCEPT;		return NF_ACCEPT;

	@@ -919,7 +913,7 @@ static int ip_vs_out_icmp(struct sk_buff skb, int related,

	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	static int ip_vs_out_icmp_v6(struct sk_buff skb, int related,		static int ip_vs_out_icmp_v6(struct sk_buff skb, int related,
	unsigned int hooknum)		unsigned int hooknum, struct ip_vs_iphdr *ipvsh)
	{		{
	struct icmp6hdr _icmph, *ic;		struct icmp6hdr _icmph, *ic;
	struct ipv6hdr _ip6h, ip6h; / The ip header contained within ICMP */		struct ipv6hdr _ip6h, ip6h; / The ip header contained within ICMP */
	@@ -929,10 +923,6 @@ static int ip_vs_out_icmp_v6(struct sk_buff skb, int related,
	union nf_inet_addr snet;		union nf_inet_addr snet;
	unsigned int writable;		unsigned int writable;

	struct ip_vs_iphdr ipvsh_stack;
	struct ip_vs_iphdr *ipvsh = &ipvsh_stack;
	ip_vs_fill_iph_skb(AF_INET6, skb, ipvsh);

	*related = 1;		*related = 1;
	ic = frag_safe_skb_hp(skb, ipvsh->len, sizeof(_icmph), &_icmph, ipvsh);		ic = frag_safe_skb_hp(skb, ipvsh->len, sizeof(_icmph), &_icmph, ipvsh);
	if (ic == NULL)		if (ic == NULL)
	@@ -976,7 +966,7 @@ static int ip_vs_out_icmp_v6(struct sk_buff skb, int related,
	return NF_ACCEPT;		return NF_ACCEPT;

	/* The embedded headers contain source and dest in reverse order */		/* The embedded headers contain source and dest in reverse order */
	cp = pp->conn_out_get(AF_INET6, skb, &ciph, ciph.len, 1);		cp = pp->conn_out_get(AF_INET6, skb, &ciph, 1);
	if (!cp)		if (!cp)
	return NF_ACCEPT;		return NF_ACCEPT;

	@@ -1016,17 +1006,17 @@ static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
	*/		*/
	static unsigned int		static unsigned int
	handle_response(int af, struct sk_buff skb, struct ip_vs_proto_data pd,		handle_response(int af, struct sk_buff skb, struct ip_vs_proto_data pd,
	struct ip_vs_conn *cp, int ihl)		struct ip_vs_conn cp, struct ip_vs_iphdr iph)
	{		{
	struct ip_vs_protocol *pp = pd->pp;		struct ip_vs_protocol *pp = pd->pp;

	IP_VS_DBG_PKT(11, af, pp, skb, 0, "Outgoing packet");		IP_VS_DBG_PKT(11, af, pp, skb, 0, "Outgoing packet");

	if (!skb_make_writable(skb, ihl))		if (!skb_make_writable(skb, iph->len))
	goto drop;		goto drop;

	/* mangle the packet */		/* mangle the packet */
	if (pp->snat_handler && !pp->snat_handler(skb, pp, cp))		if (pp->snat_handler && !pp->snat_handler(skb, pp, cp, iph))
	goto drop;		goto drop;

	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	@@ -1125,7 +1115,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af)
	if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {		if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
	int related;		int related;
	int verdict = ip_vs_out_icmp_v6(skb, &related,		int verdict = ip_vs_out_icmp_v6(skb, &related,
	hooknum);		hooknum, &iph);

	if (related)		if (related)
	return verdict;		return verdict;
	@@ -1160,10 +1150,10 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af)
	/*		/*
	* Check if the packet belongs to an existing entry		* Check if the packet belongs to an existing entry
	*/		*/
	cp = pp->conn_out_get(af, skb, &iph, iph.len, 0);		cp = pp->conn_out_get(af, skb, &iph, 0);

	if (likely(cp))		if (likely(cp))
	return handle_response(af, skb, pd, cp, iph.len);		return handle_response(af, skb, pd, cp, &iph);
	if (sysctl_nat_icmp_send(net) &&		if (sysctl_nat_icmp_send(net) &&
	(pp->protocol == IPPROTO_TCP \|\|		(pp->protocol == IPPROTO_TCP \|\|
	pp->protocol == IPPROTO_UDP \|\|		pp->protocol == IPPROTO_UDP \|\|
	@@ -1375,7 +1365,7 @@ ip_vs_in_icmp(struct sk_buff skb, int related, unsigned int hooknum)
	/* The embedded headers contain source and dest in reverse order.		/* The embedded headers contain source and dest in reverse order.
	* For IPIP this is error for request, not for reply.		* For IPIP this is error for request, not for reply.
	*/		*/
	cp = pp->conn_in_get(AF_INET, skb, &ciph, offset, ipip ? 0 : 1);		cp = pp->conn_in_get(AF_INET, skb, &ciph, ipip ? 0 : 1);
	if (!cp)		if (!cp)
	return NF_ACCEPT;		return NF_ACCEPT;

	@@ -1444,7 +1434,7 @@ ignore_ipip:
	ip_vs_in_stats(cp, skb);		ip_vs_in_stats(cp, skb);
	if (IPPROTO_TCP == cih->protocol \|\| IPPROTO_UDP == cih->protocol)		if (IPPROTO_TCP == cih->protocol \|\| IPPROTO_UDP == cih->protocol)
	offset += 2 * sizeof(__u16);		offset += 2 * sizeof(__u16);
	verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum);		verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum, &ciph);

	out:		out:
	__ip_vs_conn_put(cp);		__ip_vs_conn_put(cp);
	@@ -1453,8 +1443,8 @@ out:
	}		}

	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	static int		static int ip_vs_in_icmp_v6(struct sk_buff skb, int related,
	ip_vs_in_icmp_v6(struct sk_buff skb, int related, unsigned int hooknum)		unsigned int hooknum, struct ip_vs_iphdr *iph)
	{		{
	struct net *net = NULL;		struct net *net = NULL;
	struct ipv6hdr _ip6h, *ip6h;		struct ipv6hdr _ip6h, *ip6h;
	@@ -1465,10 +1455,6 @@ ip_vs_in_icmp_v6(struct sk_buff skb, int related, unsigned int hooknum)
	struct ip_vs_proto_data *pd;		struct ip_vs_proto_data *pd;
	unsigned int offs_ciph, writable, verdict;		unsigned int offs_ciph, writable, verdict;

	struct ip_vs_iphdr iph_stack;
	struct ip_vs_iphdr *iph = &iph_stack;
	ip_vs_fill_iph_skb(AF_INET6, skb, iph);

	*related = 1;		*related = 1;

	ic = frag_safe_skb_hp(skb, iph->len, sizeof(_icmph), &_icmph, iph);		ic = frag_safe_skb_hp(skb, iph->len, sizeof(_icmph), &_icmph, iph);
	@@ -1525,7 +1511,7 @@ ip_vs_in_icmp_v6(struct sk_buff skb, int related, unsigned int hooknum)
	/* The embedded headers contain source and dest in reverse order		/* The embedded headers contain source and dest in reverse order
	* if not from localhost		* if not from localhost
	*/		*/
	cp = pp->conn_in_get(AF_INET6, skb, &ciph, ciph.len,		cp = pp->conn_in_get(AF_INET6, skb, &ciph,
	(hooknum == NF_INET_LOCAL_OUT) ? 0 : 1);		(hooknum == NF_INET_LOCAL_OUT) ? 0 : 1);

	if (!cp)		if (!cp)
	@@ -1546,7 +1532,7 @@ ip_vs_in_icmp_v6(struct sk_buff skb, int related, unsigned int hooknum)
	IPPROTO_SCTP == ciph.protocol)		IPPROTO_SCTP == ciph.protocol)
	writable += 2 * sizeof(__u16); /* Also mangle ports */		writable += 2 * sizeof(__u16); /* Also mangle ports */

	verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, writable, hooknum);		verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, writable, hooknum, &ciph);

	__ip_vs_conn_put(cp);		__ip_vs_conn_put(cp);

	@@ -1616,7 +1602,8 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
	}		}
	if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {		if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
	int related;		int related;
	int verdict = ip_vs_in_icmp_v6(skb, &related, hooknum);		int verdict = ip_vs_in_icmp_v6(skb, &related, hooknum,
			&iph);

	if (related)		if (related)
	return verdict;		return verdict;
	@@ -1639,8 +1626,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
	/*		/*
	* Check if the packet belongs to an existing connection entry		* Check if the packet belongs to an existing connection entry
	*/		*/
	cp = pp->conn_in_get(af, skb, &iph, iph.len, 0);		cp = pp->conn_in_get(af, skb, &iph, 0);

	if (unlikely(!cp) && !iph.fragoffs) {		if (unlikely(!cp) && !iph.fragoffs) {
	/* No (second) fragments need to enter here, as nf_defrag_ipv6		/* No (second) fragments need to enter here, as nf_defrag_ipv6
	* replayed fragment zero will already have created the cp		* replayed fragment zero will already have created the cp
	@@ -1648,7 +1634,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
	int v;		int v;

	/* Schedule and create new connection entry into &cp */		/* Schedule and create new connection entry into &cp */
	if (!pp->conn_schedule(af, skb, pd, &v, &cp))		if (!pp->conn_schedule(af, skb, pd, &v, &cp, &iph))
	return v;		return v;
	}		}

	@@ -1686,7 +1672,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
	ip_vs_in_stats(cp, skb);		ip_vs_in_stats(cp, skb);
	ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);		ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);
	if (cp->packet_xmit)		if (cp->packet_xmit)
	ret = cp->packet_xmit(skb, cp, pp);		ret = cp->packet_xmit(skb, cp, pp, &iph);
	/* do not touch skb anymore */		/* do not touch skb anymore */
	else {		else {
	IP_VS_DBG_RL("warning: packet_xmit is null");		IP_VS_DBG_RL("warning: packet_xmit is null");
	@@ -1860,7 +1846,7 @@ ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb,
	if (!net_ipvs(net)->enable)		if (!net_ipvs(net)->enable)
	return NF_ACCEPT;		return NF_ACCEPT;

	return ip_vs_in_icmp_v6(skb, &r, hooknum);		return ip_vs_in_icmp_v6(skb, &r, hooknum, &iphdr);
	}		}
	#endif		#endif

net/netfilter/ipvs/ip_vs_proto_ah_esp.c

+4 −5

Original line number	Original line	Diff line number	Diff line
	@@ -57,7 +57,7 @@ ah_esp_conn_fill_param_proto(struct net *net, int af,

	static struct ip_vs_conn *		static struct ip_vs_conn *
	ah_esp_conn_in_get(int af, const struct sk_buff *skb,		ah_esp_conn_in_get(int af, const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph, unsigned int proto_off,		const struct ip_vs_iphdr *iph,
	int inverse)		int inverse)
	{		{
	struct ip_vs_conn *cp;		struct ip_vs_conn *cp;
	@@ -85,9 +85,7 @@ ah_esp_conn_in_get(int af, const struct sk_buff *skb,

	static struct ip_vs_conn *		static struct ip_vs_conn *
	ah_esp_conn_out_get(int af, const struct sk_buff *skb,		ah_esp_conn_out_get(int af, const struct sk_buff *skb,
	const struct ip_vs_iphdr *iph,		const struct ip_vs_iphdr *iph, int inverse)
	unsigned int proto_off,
	int inverse)
	{		{
	struct ip_vs_conn *cp;		struct ip_vs_conn *cp;
	struct ip_vs_conn_param p;		struct ip_vs_conn_param p;
	@@ -110,7 +108,8 @@ ah_esp_conn_out_get(int af, const struct sk_buff *skb,

	static int		static int
	ah_esp_conn_schedule(int af, struct sk_buff skb, struct ip_vs_proto_data pd,		ah_esp_conn_schedule(int af, struct sk_buff skb, struct ip_vs_proto_data pd,
	int verdict, struct ip_vs_conn *cpp)		int verdict, struct ip_vs_conn *cpp,
			struct ip_vs_iphdr *iph)
	{		{
	/*		/*
	* AH/ESP is only related traffic. Pass the packet to IP stack.		* AH/ESP is only related traffic. Pass the packet to IP stack.

net/netfilter/ipvs/ip_vs_proto_sctp.c

+16 −26

Original line number	Original line	Diff line number	Diff line
	@@ -10,28 +10,26 @@

	static int		static int
	sctp_conn_schedule(int af, struct sk_buff skb, struct ip_vs_proto_data pd,		sctp_conn_schedule(int af, struct sk_buff skb, struct ip_vs_proto_data pd,
	int verdict, struct ip_vs_conn *cpp)		int verdict, struct ip_vs_conn *cpp,
			struct ip_vs_iphdr *iph)
	{		{
	struct net *net;		struct net *net;
	struct ip_vs_service *svc;		struct ip_vs_service *svc;
	sctp_chunkhdr_t _schunkh, *sch;		sctp_chunkhdr_t _schunkh, *sch;
	sctp_sctphdr_t *sh, _sctph;		sctp_sctphdr_t *sh, _sctph;
	struct ip_vs_iphdr iph;

	ip_vs_fill_iph_skb(af, skb, &iph);		sh = skb_header_pointer(skb, iph->len, sizeof(_sctph), &_sctph);

	sh = skb_header_pointer(skb, iph.len, sizeof(_sctph), &_sctph);
	if (sh == NULL)		if (sh == NULL)
	return 0;		return 0;

	sch = skb_header_pointer(skb, iph.len + sizeof(sctp_sctphdr_t),		sch = skb_header_pointer(skb, iph->len + sizeof(sctp_sctphdr_t),
	sizeof(_schunkh), &_schunkh);		sizeof(_schunkh), &_schunkh);
	if (sch == NULL)		if (sch == NULL)
	return 0;		return 0;
	net = skb_net(skb);		net = skb_net(skb);
	if ((sch->type == SCTP_CID_INIT) &&		if ((sch->type == SCTP_CID_INIT) &&
	(svc = ip_vs_service_get(net, af, skb->mark, iph.protocol,		(svc = ip_vs_service_get(net, af, skb->mark, iph->protocol,
	&iph.daddr, sh->dest))) {		&iph->daddr, sh->dest))) {
	int ignored;		int ignored;

	if (ip_vs_todrop(net_ipvs(net))) {		if (ip_vs_todrop(net_ipvs(net))) {
	@@ -47,10 +45,10 @@ sctp_conn_schedule(int af, struct sk_buff skb, struct ip_vs_proto_data pd,
	* Let the virtual server select a real server for the		* Let the virtual server select a real server for the
	* incoming connection, and create a connection entry.		* incoming connection, and create a connection entry.
	*/		*/
	*cpp = ip_vs_schedule(svc, skb, pd, &ignored);		*cpp = ip_vs_schedule(svc, skb, pd, &ignored, iph);
	if (!*cpp && ignored <= 0) {		if (!*cpp && ignored <= 0) {
	if (!ignored)		if (!ignored)
	*verdict = ip_vs_leave(svc, skb, pd);		*verdict = ip_vs_leave(svc, skb, pd, iph);
	else {		else {
	ip_vs_service_put(svc);		ip_vs_service_put(svc);
	*verdict = NF_DROP;		*verdict = NF_DROP;
	@@ -64,20 +62,16 @@ sctp_conn_schedule(int af, struct sk_buff skb, struct ip_vs_proto_data pd,
	}		}

	static int		static int
	sctp_snat_handler(struct sk_buff *skb,		sctp_snat_handler(struct sk_buff skb, struct ip_vs_protocol pp,
	struct ip_vs_protocol pp, struct ip_vs_conn cp)		struct ip_vs_conn cp, struct ip_vs_iphdr iph)
	{		{
	sctp_sctphdr_t *sctph;		sctp_sctphdr_t *sctph;
	unsigned int sctphoff;		unsigned int sctphoff = iph->len;
	struct sk_buff *iter;		struct sk_buff *iter;
	__be32 crc32;		__be32 crc32;

	struct ip_vs_iphdr iph;
	ip_vs_fill_iph_skb(cp->af, skb, &iph);
	sctphoff = iph.len;

	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	if (cp->af == AF_INET6 && iph.fragoffs)		if (cp->af == AF_INET6 && iph->fragoffs)
	return 1;		return 1;
	#endif		#endif

	@@ -110,20 +104,16 @@ sctp_snat_handler(struct sk_buff *skb,
	}		}

	static int		static int
	sctp_dnat_handler(struct sk_buff *skb,		sctp_dnat_handler(struct sk_buff skb, struct ip_vs_protocol pp,
	struct ip_vs_protocol pp, struct ip_vs_conn cp)		struct ip_vs_conn cp, struct ip_vs_iphdr iph)
	{		{
	sctp_sctphdr_t *sctph;		sctp_sctphdr_t *sctph;
	unsigned int sctphoff;		unsigned int sctphoff = iph->len;
	struct sk_buff *iter;		struct sk_buff *iter;
	__be32 crc32;		__be32 crc32;

	struct ip_vs_iphdr iph;
	ip_vs_fill_iph_skb(cp->af, skb, &iph);
	sctphoff = iph.len;

	#ifdef CONFIG_IP_VS_IPV6		#ifdef CONFIG_IP_VS_IPV6
	if (cp->af == AF_INET6 && iph.fragoffs)		if (cp->af == AF_INET6 && iph->fragoffs)
	return 1;		return 1;
	#endif		#endif