* [PATCH 3/3] ipvs: make rerouting optional with snat_reroute
@ 2010-09-16 20:49 Julian Anastasov
2010-09-19 12:02 ` Simon Horman
2010-09-21 15:39 ` Patrick McHardy
0 siblings, 2 replies; 3+ messages in thread
From: Julian Anastasov @ 2010-09-16 20:49 UTC (permalink / raw)
To: Simon Horman; +Cc: Patrick McHardy, lvs-devel, netfilter-devel
Add new sysctl flag "snat_reroute". Recent kernels use
ip_route_me_harder() to route LVS-NAT responses properly by
VIP when there are multiple paths to client. But setups
that do not have alternative default routes can skip this
routing lookup by using snat_reroute=0.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
---
diff -urp net-next-2.6-e548833-nfct/linux/include/net/ip_vs.h linux/include/net/ip_vs.h
--- net-next-2.6-e548833-nfct/linux/include/net/ip_vs.h 2010-09-16 09:02:25.000000000 +0300
+++ linux/include/net/ip_vs.h 2010-09-16 09:03:48.000000000 +0300
@@ -801,6 +801,7 @@ extern int sysctl_ip_vs_expire_quiescent
extern int sysctl_ip_vs_sync_threshold[2];
extern int sysctl_ip_vs_nat_icmp_send;
extern int sysctl_ip_vs_conntrack;
+extern int sysctl_ip_vs_snat_reroute;
extern struct ip_vs_stats ip_vs_stats;
extern const struct ctl_path net_vs_ctl_path[];
diff -urp net-next-2.6-e548833-nfct/linux/net/netfilter/ipvs/ip_vs_core.c linux/net/netfilter/ipvs/ip_vs_core.c
--- net-next-2.6-e548833-nfct/linux/net/netfilter/ipvs/ip_vs_core.c 2010-09-16 09:02:25.000000000 +0300
+++ linux/net/netfilter/ipvs/ip_vs_core.c 2010-09-16 09:07:13.000000000 +0300
@@ -929,20 +929,31 @@ handle_response(int af, struct sk_buff *
ip_send_check(ip_hdr(skb));
}
+ /*
+ * nf_iterate does not expect change in the skb->dst->dev.
+ * It looks like it is not fatal to enable this code for hooks
+ * where our handlers are at the end of the chain list and
+ * when all next handlers use skb->dst->dev and not outdev.
+ * It will definitely route properly the inout NAT traffic
+ * when multiple paths are used.
+ */
+
/* For policy routing, packets originating from this
* machine itself may be routed differently to packets
* passing through. We want this packet to be routed as
* if it came from this machine itself. So re-compute
* the routing information.
*/
+ if (sysctl_ip_vs_snat_reroute) {
#ifdef CONFIG_IP_VS_IPV6
- if (af == AF_INET6) {
- if (ip6_route_me_harder(skb) != 0)
- goto drop;
- } else
+ if (af == AF_INET6) {
+ if (ip6_route_me_harder(skb) != 0)
+ goto drop;
+ } else
#endif
- if (ip_route_me_harder(skb, RTN_LOCAL) != 0)
- goto drop;
+ if (ip_route_me_harder(skb, RTN_LOCAL) != 0)
+ goto drop;
+ }
IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
@@ -991,8 +1002,13 @@ ip_vs_out(unsigned int hooknum, struct s
if (unlikely(iph.protocol == IPPROTO_ICMPV6)) {
int related, verdict = ip_vs_out_icmp_v6(skb, &related);
- if (related)
+ if (related) {
+ if (sysctl_ip_vs_snat_reroute &&
+ NF_ACCEPT == verdict &&
+ ip6_route_me_harder(skb))
+ verdict = NF_DROP;
return verdict;
+ }
ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
}
} else
@@ -1000,8 +1016,13 @@ ip_vs_out(unsigned int hooknum, struct s
if (unlikely(iph.protocol == IPPROTO_ICMP)) {
int related, verdict = ip_vs_out_icmp(skb, &related);
- if (related)
+ if (related) {
+ if (sysctl_ip_vs_snat_reroute &&
+ NF_ACCEPT == verdict &&
+ ip_route_me_harder(skb, RTN_LOCAL))
+ verdict = NF_DROP;
return verdict;
+ }
ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
}
diff -urp net-next-2.6-e548833-nfct/linux/net/netfilter/ipvs/ip_vs_ctl.c linux/net/netfilter/ipvs/ip_vs_ctl.c
--- net-next-2.6-e548833-nfct/linux/net/netfilter/ipvs/ip_vs_ctl.c 2010-09-16 09:02:25.000000000 +0300
+++ linux/net/netfilter/ipvs/ip_vs_ctl.c 2010-09-16 09:08:47.000000000 +0300
@@ -91,6 +91,7 @@ int sysctl_ip_vs_nat_icmp_send = 0;
#ifdef CONFIG_IP_VS_NFCT
int sysctl_ip_vs_conntrack;
#endif
+int sysctl_ip_vs_snat_reroute = 1;
#ifdef CONFIG_IP_VS_DEBUG
@@ -1599,6 +1600,13 @@ static struct ctl_table vs_vars[] = {
.mode = 0644,
.proc_handler = proc_do_defense_mode,
},
+ {
+ .procname = "snat_reroute",
+ .data = &sysctl_ip_vs_snat_reroute,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = &proc_dointvec,
+ },
#if 0
{
.procname = "timeout_established",
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 3/3] ipvs: make rerouting optional with snat_reroute
2010-09-16 20:49 [PATCH 3/3] ipvs: make rerouting optional with snat_reroute Julian Anastasov
@ 2010-09-19 12:02 ` Simon Horman
2010-09-21 15:39 ` Patrick McHardy
1 sibling, 0 replies; 3+ messages in thread
From: Simon Horman @ 2010-09-19 12:02 UTC (permalink / raw)
To: Julian Anastasov; +Cc: Patrick McHardy, lvs-devel, netfilter-devel
On Thu, Sep 16, 2010 at 11:49:52PM +0300, Julian Anastasov wrote:
>
> Add new sysctl flag "snat_reroute". Recent kernels use
> ip_route_me_harder() to route LVS-NAT responses properly by
> VIP when there are multiple paths to client. But setups
> that do not have alternative default routes can skip this
> routing lookup by using snat_reroute=0.
>
> Signed-off-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 3/3] ipvs: make rerouting optional with snat_reroute
2010-09-16 20:49 [PATCH 3/3] ipvs: make rerouting optional with snat_reroute Julian Anastasov
2010-09-19 12:02 ` Simon Horman
@ 2010-09-21 15:39 ` Patrick McHardy
1 sibling, 0 replies; 3+ messages in thread
From: Patrick McHardy @ 2010-09-21 15:39 UTC (permalink / raw)
To: Julian Anastasov; +Cc: Simon Horman, lvs-devel, netfilter-devel
Am 16.09.2010 22:49, schrieb Julian Anastasov:
> Add new sysctl flag "snat_reroute". Recent kernels use
> ip_route_me_harder() to route LVS-NAT responses properly by
> VIP when there are multiple paths to client. But setups
> that do not have alternative default routes can skip this
> routing lookup by using snat_reroute=0.
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-09-21 15:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-09-16 20:49 [PATCH 3/3] ipvs: make rerouting optional with snat_reroute Julian Anastasov
2010-09-19 12:02 ` Simon Horman
2010-09-21 15:39 ` Patrick McHardy
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.