From: "longguang.yue" <bigclouds@163.com> To: unlisted-recipients:; (no To-header on input) Cc: ja@ssi.bg, kuba@kernel.org, wensong@linux-vs.org, horms@verge.net.au, pablo@netfilter.org, kadlec@netfilter.org, fw@strlen.de, davem@davemloft.net, lvs-devel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, yuelongguang@gmail.com, "longguang.yue" <bigclouds@163.com> Subject: [PATCH v5] ipvs: Add traffic statistic up even it is VS/DR or VS/TUN mode Date: Sun, 4 Oct 2020 12:13:00 +0800 [thread overview] Message-ID: <20201004041300.75850-1-bigclouds@163.com> (raw) In-Reply-To: <alpine.LFD.2.23.451.2010022149210.4429@ja.home.ssi.bg> It's ipvs's duty to do traffic statistic if packets get hit, no matter what mode it is. ---------------------- Changes in v1: support DR/TUN mode statistic Changes in v2: ip_vs_conn_out_get handles DR/TUN mode's conn Changes in v3: fix checkpatch Changes in v4, v5: restructure and optimise this feature ---------------------- Signed-off-by: longguang.yue <bigclouds@163.com> --- net/netfilter/ipvs/ip_vs_conn.c | 18 +++++++++++++++--- net/netfilter/ipvs/ip_vs_core.c | 17 ++++++----------- 2 files changed, 21 insertions(+), 14 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c index a90b8eac16ac..af08ca2d9174 100644 --- a/net/netfilter/ipvs/ip_vs_conn.c +++ b/net/netfilter/ipvs/ip_vs_conn.c @@ -401,6 +401,8 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p) struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) { unsigned int hash; + __be16 sport; + const union nf_inet_addr *saddr; struct ip_vs_conn *cp, *ret=NULL; /* @@ -411,10 +413,20 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) rcu_read_lock(); hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[hash], c_list) { - if (p->vport == cp->cport && p->cport == cp->dport && - cp->af == p->af && + if (p->vport != cp->cport) + continue; + + if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) { + sport = cp->vport; + saddr = &cp->vaddr; + } else { + sport = cp->dport; + saddr = &cp->daddr; + } + + if (p->cport == sport && cp->af == p->af && ip_vs_addr_equal(p->af, p->vaddr, &cp->caddr) && - ip_vs_addr_equal(p->af, p->caddr, &cp->daddr) && + ip_vs_addr_equal(p->af, p->caddr, saddr) && p->protocol == cp->protocol && cp->ipvs == p->ipvs) { if (!__ip_vs_conn_get(cp)) diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c index e3668a6e54e4..494ea1fcf4d8 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -875,7 +875,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb, unsigned int verdict = NF_DROP; if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) - goto ignore_cp; + goto after_nat; /* Ensure the checksum is correct */ if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) { @@ -900,7 +900,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb, if (ip_vs_route_me_harder(cp->ipvs, af, skb, hooknum)) goto out; - +after_nat: /* do the statistics and put it back */ ip_vs_out_stats(cp, skb); @@ -909,8 +909,6 @@ static int handle_response_icmp(int af, struct sk_buff *skb, ip_vs_notrack(skb); else ip_vs_update_conntrack(skb, cp, 0); - -ignore_cp: verdict = NF_ACCEPT; out: @@ -1276,6 +1274,9 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, { struct ip_vs_protocol *pp = pd->pp; + if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) + goto after_nat; + IP_VS_DBG_PKT(11, af, pp, skb, iph->off, "Outgoing packet"); if (skb_ensure_writable(skb, iph->len)) @@ -1316,6 +1317,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, IP_VS_DBG_PKT(10, af, pp, skb, iph->off, "After SNAT"); +after_nat: ip_vs_out_stats(cp, skb); ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd); skb->ipvs_property = 1; @@ -1413,8 +1415,6 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in ipvs, af, skb, &iph); if (likely(cp)) { - if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) - goto ignore_cp; return handle_response(af, skb, pd, cp, &iph, hooknum); } @@ -1475,14 +1475,9 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in } } -out: IP_VS_DBG_PKT(12, af, pp, skb, iph.off, "ip_vs_out: packet continues traversal as normal"); return NF_ACCEPT; - -ignore_cp: - __ip_vs_conn_put(cp); - goto out; } /* -- 2.20.1 (Apple Git-117)
WARNING: multiple messages have this Message-ID (diff)
From: "longguang.yue" <bigclouds@163.com> Cc: ja@ssi.bg, kuba@kernel.org, wensong@linux-vs.org, horms@verge.net.au, pablo@netfilter.org, kadlec@netfilter.org, fw@strlen.de, davem@davemloft.net, lvs-devel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, yuelongguang@gmail.com, "longguang.yue" <bigclouds@163.com> Subject: [PATCH v5] ipvs: Add traffic statistic up even it is VS/DR or VS/TUN mode Date: Sun, 4 Oct 2020 12:13:00 +0800 [thread overview] Message-ID: <20201004041300.75850-1-bigclouds@163.com> (raw) In-Reply-To: <alpine.LFD.2.23.451.2010022149210.4429@ja.home.ssi.bg> It's ipvs's duty to do traffic statistic if packets get hit, no matter what mode it is. ---------------------- Changes in v1: support DR/TUN mode statistic Changes in v2: ip_vs_conn_out_get handles DR/TUN mode's conn Changes in v3: fix checkpatch Changes in v4, v5: restructure and optimise this feature ---------------------- Signed-off-by: longguang.yue <bigclouds@163.com> --- net/netfilter/ipvs/ip_vs_conn.c | 18 +++++++++++++++--- net/netfilter/ipvs/ip_vs_core.c | 17 ++++++----------- 2 files changed, 21 insertions(+), 14 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c index a90b8eac16ac..af08ca2d9174 100644 --- a/net/netfilter/ipvs/ip_vs_conn.c +++ b/net/netfilter/ipvs/ip_vs_conn.c @@ -401,6 +401,8 @@ struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p) struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) { unsigned int hash; + __be16 sport; + const union nf_inet_addr *saddr; struct ip_vs_conn *cp, *ret=NULL; /* @@ -411,10 +413,20 @@ struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) rcu_read_lock(); hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[hash], c_list) { - if (p->vport == cp->cport && p->cport == cp->dport && - cp->af == p->af && + if (p->vport != cp->cport) + continue; + + if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) { + sport = cp->vport; + saddr = &cp->vaddr; + } else { + sport = cp->dport; + saddr = &cp->daddr; + } + + if (p->cport == sport && cp->af == p->af && ip_vs_addr_equal(p->af, p->vaddr, &cp->caddr) && - ip_vs_addr_equal(p->af, p->caddr, &cp->daddr) && + ip_vs_addr_equal(p->af, p->caddr, saddr) && p->protocol == cp->protocol && cp->ipvs == p->ipvs) { if (!__ip_vs_conn_get(cp)) diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c index e3668a6e54e4..494ea1fcf4d8 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -875,7 +875,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb, unsigned int verdict = NF_DROP; if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) - goto ignore_cp; + goto after_nat; /* Ensure the checksum is correct */ if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) { @@ -900,7 +900,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb, if (ip_vs_route_me_harder(cp->ipvs, af, skb, hooknum)) goto out; - +after_nat: /* do the statistics and put it back */ ip_vs_out_stats(cp, skb); @@ -909,8 +909,6 @@ static int handle_response_icmp(int af, struct sk_buff *skb, ip_vs_notrack(skb); else ip_vs_update_conntrack(skb, cp, 0); - -ignore_cp: verdict = NF_ACCEPT; out: @@ -1276,6 +1274,9 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, { struct ip_vs_protocol *pp = pd->pp; + if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) + goto after_nat; + IP_VS_DBG_PKT(11, af, pp, skb, iph->off, "Outgoing packet"); if (skb_ensure_writable(skb, iph->len)) @@ -1316,6 +1317,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, IP_VS_DBG_PKT(10, af, pp, skb, iph->off, "After SNAT"); +after_nat: ip_vs_out_stats(cp, skb); ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd); skb->ipvs_property = 1; @@ -1413,8 +1415,6 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in ipvs, af, skb, &iph); if (likely(cp)) { - if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) - goto ignore_cp; return handle_response(af, skb, pd, cp, &iph, hooknum); } @@ -1475,14 +1475,9 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in } } -out: IP_VS_DBG_PKT(12, af, pp, skb, iph.off, "ip_vs_out: packet continues traversal as normal"); return NF_ACCEPT;
next prev parent reply other threads:[~2020-10-04 4:30 UTC|newest] Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-09-29 5:03 [PATCH] ipvs: Add traffic statistic up even it is VS/DR or VS/TUN mode longguang.yue 2020-09-29 5:03 ` longguang.yue 2020-09-29 5:17 ` yue longguang 2020-09-29 8:18 ` [PATCH v2] " longguang.yue 2020-09-29 8:18 ` longguang.yue 2020-09-29 14:41 ` Jakub Kicinski 2020-09-30 1:26 ` [PATCH v3] " longguang.yue 2020-09-30 1:26 ` longguang.yue 2020-09-30 18:19 ` Julian Anastasov 2020-10-02 17:17 ` [PATCH v4] " longguang.yue 2020-10-02 17:17 ` longguang.yue 2020-10-02 19:26 ` Julian Anastasov 2020-10-04 4:13 ` longguang.yue [this message] 2020-10-04 4:13 ` [PATCH v5] " longguang.yue 2020-10-04 12:25 ` Julian Anastasov 2020-10-04 15:07 ` [PATCH v6] ipvs: inspect reply packets from DR/TUN real servers longguang.yue 2020-10-04 15:07 ` longguang.yue 2020-10-05 6:49 ` [PATCH v7] " longguang.yue 2020-10-05 20:17 ` Julian Anastasov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20201004041300.75850-1-bigclouds@163.com \ --to=bigclouds@163.com \ --cc=coreteam@netfilter.org \ --cc=davem@davemloft.net \ --cc=fw@strlen.de \ --cc=horms@verge.net.au \ --cc=ja@ssi.bg \ --cc=kadlec@netfilter.org \ --cc=kuba@kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=lvs-devel@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=pablo@netfilter.org \ --cc=wensong@linux-vs.org \ --cc=yuelongguang@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.