ipvs: take care of return value from protocol init_netns
[linux-2.6.git] / net / netfilter / ipvs / ip_vs_proto_udp.c
1 /*
2  * ip_vs_proto_udp.c:   UDP load balancing support for IPVS
3  *
4  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
5  *              Julian Anastasov <ja@ssi.bg>
6  *
7  *              This program is free software; you can redistribute it and/or
8  *              modify it under the terms of the GNU General Public License
9  *              as published by the Free Software Foundation; either version
10  *              2 of the License, or (at your option) any later version.
11  *
12  * Changes:     Hans Schillstrom <hans.schillstrom@ericsson.com>
13  *              Network name space (netns) aware.
14  *
15  */
16
17 #define KMSG_COMPONENT "IPVS"
18 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
19
20 #include <linux/in.h>
21 #include <linux/ip.h>
22 #include <linux/kernel.h>
23 #include <linux/netfilter.h>
24 #include <linux/netfilter_ipv4.h>
25 #include <linux/udp.h>
26
27 #include <net/ip_vs.h>
28 #include <net/ip.h>
29 #include <net/ip6_checksum.h>
30
31 static int
32 udp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
33                   int *verdict, struct ip_vs_conn **cpp)
34 {
35         struct net *net;
36         struct ip_vs_service *svc;
37         struct udphdr _udph, *uh;
38         struct ip_vs_iphdr iph;
39
40         ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
41
42         uh = skb_header_pointer(skb, iph.len, sizeof(_udph), &_udph);
43         if (uh == NULL) {
44                 *verdict = NF_DROP;
45                 return 0;
46         }
47         net = skb_net(skb);
48         svc = ip_vs_service_get(net, af, skb->mark, iph.protocol,
49                                 &iph.daddr, uh->dest);
50         if (svc) {
51                 int ignored;
52
53                 if (ip_vs_todrop(net_ipvs(net))) {
54                         /*
55                          * It seems that we are very loaded.
56                          * We have to drop this packet :(
57                          */
58                         ip_vs_service_put(svc);
59                         *verdict = NF_DROP;
60                         return 0;
61                 }
62
63                 /*
64                  * Let the virtual server select a real server for the
65                  * incoming connection, and create a connection entry.
66                  */
67                 *cpp = ip_vs_schedule(svc, skb, pd, &ignored);
68                 if (!*cpp && ignored <= 0) {
69                         if (!ignored)
70                                 *verdict = ip_vs_leave(svc, skb, pd);
71                         else {
72                                 ip_vs_service_put(svc);
73                                 *verdict = NF_DROP;
74                         }
75                         return 0;
76                 }
77                 ip_vs_service_put(svc);
78         }
79         /* NF_ACCEPT */
80         return 1;
81 }
82
83
84 static inline void
85 udp_fast_csum_update(int af, struct udphdr *uhdr,
86                      const union nf_inet_addr *oldip,
87                      const union nf_inet_addr *newip,
88                      __be16 oldport, __be16 newport)
89 {
90 #ifdef CONFIG_IP_VS_IPV6
91         if (af == AF_INET6)
92                 uhdr->check =
93                         csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
94                                          ip_vs_check_diff2(oldport, newport,
95                                                 ~csum_unfold(uhdr->check))));
96         else
97 #endif
98                 uhdr->check =
99                         csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
100                                          ip_vs_check_diff2(oldport, newport,
101                                                 ~csum_unfold(uhdr->check))));
102         if (!uhdr->check)
103                 uhdr->check = CSUM_MANGLED_0;
104 }
105
106 static inline void
107 udp_partial_csum_update(int af, struct udphdr *uhdr,
108                      const union nf_inet_addr *oldip,
109                      const union nf_inet_addr *newip,
110                      __be16 oldlen, __be16 newlen)
111 {
112 #ifdef CONFIG_IP_VS_IPV6
113         if (af == AF_INET6)
114                 uhdr->check =
115                         ~csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
116                                          ip_vs_check_diff2(oldlen, newlen,
117                                                 csum_unfold(uhdr->check))));
118         else
119 #endif
120         uhdr->check =
121                 ~csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
122                                 ip_vs_check_diff2(oldlen, newlen,
123                                                 csum_unfold(uhdr->check))));
124 }
125
126
127 static int
128 udp_snat_handler(struct sk_buff *skb,
129                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
130 {
131         struct udphdr *udph;
132         unsigned int udphoff;
133         int oldlen;
134         int payload_csum = 0;
135
136 #ifdef CONFIG_IP_VS_IPV6
137         if (cp->af == AF_INET6)
138                 udphoff = sizeof(struct ipv6hdr);
139         else
140 #endif
141                 udphoff = ip_hdrlen(skb);
142         oldlen = skb->len - udphoff;
143
144         /* csum_check requires unshared skb */
145         if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
146                 return 0;
147
148         if (unlikely(cp->app != NULL)) {
149                 int ret;
150
151                 /* Some checks before mangling */
152                 if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
153                         return 0;
154
155                 /*
156                  *      Call application helper if needed
157                  */
158                 if (!(ret = ip_vs_app_pkt_out(cp, skb)))
159                         return 0;
160                 /* ret=2: csum update is needed after payload mangling */
161                 if (ret == 1)
162                         oldlen = skb->len - udphoff;
163                 else
164                         payload_csum = 1;
165         }
166
167         udph = (void *)skb_network_header(skb) + udphoff;
168         udph->source = cp->vport;
169
170         /*
171          *      Adjust UDP checksums
172          */
173         if (skb->ip_summed == CHECKSUM_PARTIAL) {
174                 udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
175                                         htons(oldlen),
176                                         htons(skb->len - udphoff));
177         } else if (!payload_csum && (udph->check != 0)) {
178                 /* Only port and addr are changed, do fast csum update */
179                 udp_fast_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
180                                      cp->dport, cp->vport);
181                 if (skb->ip_summed == CHECKSUM_COMPLETE)
182                         skb->ip_summed = (cp->app && pp->csum_check) ?
183                                          CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
184         } else {
185                 /* full checksum calculation */
186                 udph->check = 0;
187                 skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
188 #ifdef CONFIG_IP_VS_IPV6
189                 if (cp->af == AF_INET6)
190                         udph->check = csum_ipv6_magic(&cp->vaddr.in6,
191                                                       &cp->caddr.in6,
192                                                       skb->len - udphoff,
193                                                       cp->protocol, skb->csum);
194                 else
195 #endif
196                         udph->check = csum_tcpudp_magic(cp->vaddr.ip,
197                                                         cp->caddr.ip,
198                                                         skb->len - udphoff,
199                                                         cp->protocol,
200                                                         skb->csum);
201                 if (udph->check == 0)
202                         udph->check = CSUM_MANGLED_0;
203                 skb->ip_summed = CHECKSUM_UNNECESSARY;
204                 IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
205                           pp->name, udph->check,
206                           (char*)&(udph->check) - (char*)udph);
207         }
208         return 1;
209 }
210
211
212 static int
213 udp_dnat_handler(struct sk_buff *skb,
214                  struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
215 {
216         struct udphdr *udph;
217         unsigned int udphoff;
218         int oldlen;
219         int payload_csum = 0;
220
221 #ifdef CONFIG_IP_VS_IPV6
222         if (cp->af == AF_INET6)
223                 udphoff = sizeof(struct ipv6hdr);
224         else
225 #endif
226                 udphoff = ip_hdrlen(skb);
227         oldlen = skb->len - udphoff;
228
229         /* csum_check requires unshared skb */
230         if (!skb_make_writable(skb, udphoff+sizeof(*udph)))
231                 return 0;
232
233         if (unlikely(cp->app != NULL)) {
234                 int ret;
235
236                 /* Some checks before mangling */
237                 if (pp->csum_check && !pp->csum_check(cp->af, skb, pp))
238                         return 0;
239
240                 /*
241                  *      Attempt ip_vs_app call.
242                  *      It will fix ip_vs_conn
243                  */
244                 if (!(ret = ip_vs_app_pkt_in(cp, skb)))
245                         return 0;
246                 /* ret=2: csum update is needed after payload mangling */
247                 if (ret == 1)
248                         oldlen = skb->len - udphoff;
249                 else
250                         payload_csum = 1;
251         }
252
253         udph = (void *)skb_network_header(skb) + udphoff;
254         udph->dest = cp->dport;
255
256         /*
257          *      Adjust UDP checksums
258          */
259         if (skb->ip_summed == CHECKSUM_PARTIAL) {
260                 udp_partial_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
261                                         htons(oldlen),
262                                         htons(skb->len - udphoff));
263         } else if (!payload_csum && (udph->check != 0)) {
264                 /* Only port and addr are changed, do fast csum update */
265                 udp_fast_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
266                                      cp->vport, cp->dport);
267                 if (skb->ip_summed == CHECKSUM_COMPLETE)
268                         skb->ip_summed = (cp->app && pp->csum_check) ?
269                                          CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
270         } else {
271                 /* full checksum calculation */
272                 udph->check = 0;
273                 skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
274 #ifdef CONFIG_IP_VS_IPV6
275                 if (cp->af == AF_INET6)
276                         udph->check = csum_ipv6_magic(&cp->caddr.in6,
277                                                       &cp->daddr.in6,
278                                                       skb->len - udphoff,
279                                                       cp->protocol, skb->csum);
280                 else
281 #endif
282                         udph->check = csum_tcpudp_magic(cp->caddr.ip,
283                                                         cp->daddr.ip,
284                                                         skb->len - udphoff,
285                                                         cp->protocol,
286                                                         skb->csum);
287                 if (udph->check == 0)
288                         udph->check = CSUM_MANGLED_0;
289                 skb->ip_summed = CHECKSUM_UNNECESSARY;
290         }
291         return 1;
292 }
293
294
295 static int
296 udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
297 {
298         struct udphdr _udph, *uh;
299         unsigned int udphoff;
300
301 #ifdef CONFIG_IP_VS_IPV6
302         if (af == AF_INET6)
303                 udphoff = sizeof(struct ipv6hdr);
304         else
305 #endif
306                 udphoff = ip_hdrlen(skb);
307
308         uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph);
309         if (uh == NULL)
310                 return 0;
311
312         if (uh->check != 0) {
313                 switch (skb->ip_summed) {
314                 case CHECKSUM_NONE:
315                         skb->csum = skb_checksum(skb, udphoff,
316                                                  skb->len - udphoff, 0);
317                 case CHECKSUM_COMPLETE:
318 #ifdef CONFIG_IP_VS_IPV6
319                         if (af == AF_INET6) {
320                                 if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
321                                                     &ipv6_hdr(skb)->daddr,
322                                                     skb->len - udphoff,
323                                                     ipv6_hdr(skb)->nexthdr,
324                                                     skb->csum)) {
325                                         IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
326                                                          "Failed checksum for");
327                                         return 0;
328                                 }
329                         } else
330 #endif
331                                 if (csum_tcpudp_magic(ip_hdr(skb)->saddr,
332                                                       ip_hdr(skb)->daddr,
333                                                       skb->len - udphoff,
334                                                       ip_hdr(skb)->protocol,
335                                                       skb->csum)) {
336                                         IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
337                                                          "Failed checksum for");
338                                         return 0;
339                                 }
340                         break;
341                 default:
342                         /* No need to checksum. */
343                         break;
344                 }
345         }
346         return 1;
347 }
348
349 static inline __u16 udp_app_hashkey(__be16 port)
350 {
351         return (((__force u16)port >> UDP_APP_TAB_BITS) ^ (__force u16)port)
352                 & UDP_APP_TAB_MASK;
353 }
354
355
356 static int udp_register_app(struct net *net, struct ip_vs_app *inc)
357 {
358         struct ip_vs_app *i;
359         __u16 hash;
360         __be16 port = inc->port;
361         int ret = 0;
362         struct netns_ipvs *ipvs = net_ipvs(net);
363         struct ip_vs_proto_data *pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
364
365         hash = udp_app_hashkey(port);
366
367
368         spin_lock_bh(&ipvs->udp_app_lock);
369         list_for_each_entry(i, &ipvs->udp_apps[hash], p_list) {
370                 if (i->port == port) {
371                         ret = -EEXIST;
372                         goto out;
373                 }
374         }
375         list_add(&inc->p_list, &ipvs->udp_apps[hash]);
376         atomic_inc(&pd->appcnt);
377
378   out:
379         spin_unlock_bh(&ipvs->udp_app_lock);
380         return ret;
381 }
382
383
384 static void
385 udp_unregister_app(struct net *net, struct ip_vs_app *inc)
386 {
387         struct ip_vs_proto_data *pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
388         struct netns_ipvs *ipvs = net_ipvs(net);
389
390         spin_lock_bh(&ipvs->udp_app_lock);
391         atomic_dec(&pd->appcnt);
392         list_del(&inc->p_list);
393         spin_unlock_bh(&ipvs->udp_app_lock);
394 }
395
396
397 static int udp_app_conn_bind(struct ip_vs_conn *cp)
398 {
399         struct netns_ipvs *ipvs = net_ipvs(ip_vs_conn_net(cp));
400         int hash;
401         struct ip_vs_app *inc;
402         int result = 0;
403
404         /* Default binding: bind app only for NAT */
405         if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
406                 return 0;
407
408         /* Lookup application incarnations and bind the right one */
409         hash = udp_app_hashkey(cp->vport);
410
411         spin_lock(&ipvs->udp_app_lock);
412         list_for_each_entry(inc, &ipvs->udp_apps[hash], p_list) {
413                 if (inc->port == cp->vport) {
414                         if (unlikely(!ip_vs_app_inc_get(inc)))
415                                 break;
416                         spin_unlock(&ipvs->udp_app_lock);
417
418                         IP_VS_DBG_BUF(9, "%s(): Binding conn %s:%u->"
419                                       "%s:%u to app %s on port %u\n",
420                                       __func__,
421                                       IP_VS_DBG_ADDR(cp->af, &cp->caddr),
422                                       ntohs(cp->cport),
423                                       IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
424                                       ntohs(cp->vport),
425                                       inc->name, ntohs(inc->port));
426
427                         cp->app = inc;
428                         if (inc->init_conn)
429                                 result = inc->init_conn(inc, cp);
430                         goto out;
431                 }
432         }
433         spin_unlock(&ipvs->udp_app_lock);
434
435   out:
436         return result;
437 }
438
439
440 static const int udp_timeouts[IP_VS_UDP_S_LAST+1] = {
441         [IP_VS_UDP_S_NORMAL]            =       5*60*HZ,
442         [IP_VS_UDP_S_LAST]              =       2*HZ,
443 };
444
445 static const char *const udp_state_name_table[IP_VS_UDP_S_LAST+1] = {
446         [IP_VS_UDP_S_NORMAL]            =       "UDP",
447         [IP_VS_UDP_S_LAST]              =       "BUG!",
448 };
449
450 static const char * udp_state_name(int state)
451 {
452         if (state >= IP_VS_UDP_S_LAST)
453                 return "ERR!";
454         return udp_state_name_table[state] ? udp_state_name_table[state] : "?";
455 }
456
457 static void
458 udp_state_transition(struct ip_vs_conn *cp, int direction,
459                      const struct sk_buff *skb,
460                      struct ip_vs_proto_data *pd)
461 {
462         if (unlikely(!pd)) {
463                 pr_err("UDP no ns data\n");
464                 return;
465         }
466
467         cp->timeout = pd->timeout_table[IP_VS_UDP_S_NORMAL];
468 }
469
470 static int __udp_init(struct net *net, struct ip_vs_proto_data *pd)
471 {
472         struct netns_ipvs *ipvs = net_ipvs(net);
473
474         ip_vs_init_hash_table(ipvs->udp_apps, UDP_APP_TAB_SIZE);
475         spin_lock_init(&ipvs->udp_app_lock);
476         pd->timeout_table = ip_vs_create_timeout_table((int *)udp_timeouts,
477                                                         sizeof(udp_timeouts));
478         if (!pd->timeout_table)
479                 return -ENOMEM;
480         return 0;
481 }
482
483 static void __udp_exit(struct net *net, struct ip_vs_proto_data *pd)
484 {
485         kfree(pd->timeout_table);
486 }
487
488
489 struct ip_vs_protocol ip_vs_protocol_udp = {
490         .name =                 "UDP",
491         .protocol =             IPPROTO_UDP,
492         .num_states =           IP_VS_UDP_S_LAST,
493         .dont_defrag =          0,
494         .init =                 NULL,
495         .exit =                 NULL,
496         .init_netns =           __udp_init,
497         .exit_netns =           __udp_exit,
498         .conn_schedule =        udp_conn_schedule,
499         .conn_in_get =          ip_vs_conn_in_get_proto,
500         .conn_out_get =         ip_vs_conn_out_get_proto,
501         .snat_handler =         udp_snat_handler,
502         .dnat_handler =         udp_dnat_handler,
503         .csum_check =           udp_csum_check,
504         .state_transition =     udp_state_transition,
505         .state_name =           udp_state_name,
506         .register_app =         udp_register_app,
507         .unregister_app =       udp_unregister_app,
508         .app_conn_bind =        udp_app_conn_bind,
509         .debug_packet =         ip_vs_tcpudp_debug_packet,
510         .timeout_change =       NULL,
511 };