Patchwork [06/34] ipvs: no need to reroute anymore on DNAT over loopback

login
register
mail settings
Submitter Simon Horman
Date March 29, 2013, 4:11 a.m.
Message ID <1364530311-11512-7-git-send-email-horms@verge.net.au>
Download mbox | patch
Permalink /patch/232278/
State Accepted
Headers show

Comments

Simon Horman - March 29, 2013, 4:11 a.m.
From: Julian Anastasov <ja@ssi.bg>

After commit 70e7341673 (ipv4: Show that ip_send_reply()
is purely unicast routine.) we do not need to reroute DNAT-ed
traffic over loopback because reply uses iph daddr and not
rt_spec_dst.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off by: Hans Schillstrom <hans@schillstrom.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
 net/netfilter/ipvs/ip_vs_xmit.c |   58 ++-------------------------------------
 1 file changed, 2 insertions(+), 56 deletions(-)
Sergei Shtylyov - March 29, 2013, 2:44 p.m.
Hello.

On 29-03-2013 8:11, Simon Horman wrote:

> From: Julian Anastasov <ja@ssi.bg>

> After commit 70e7341673 (ipv4: Show that ip_send_reply()
> is purely unicast routine.) we do not need to reroute DNAT-ed
> traffic over loopback because reply uses iph daddr and not
> rt_spec_dst.

> Signed-off-by: Julian Anastasov <ja@ssi.bg>
> Signed-off by: Hans Schillstrom <hans@schillstrom.com>
> Signed-off-by: Simon Horman <horms@verge.net.au>
> ---
>   net/netfilter/ipvs/ip_vs_xmit.c |   58 ++-------------------------------------
>   1 file changed, 2 insertions(+), 56 deletions(-)

> diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
> index 6448a2e..c942d36 100644
> --- a/net/netfilter/ipvs/ip_vs_xmit.c
> +++ b/net/netfilter/ipvs/ip_vs_xmit.c
[...]
> @@ -635,16 +597,8 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
>   		/* drop old route */
>   		skb_dst_drop(skb);
>   		skb_dst_set(skb, &rt->dst);
> -	} else {
> +	} else

    {} should be kept after *else*, according to Documentation/CodingStyle, 
chapter 3.

>   		ip_rt_put(rt);
> -		/*
> -		 * Some IPv4 replies get local address from routes,
> -		 * not from iph, so while we DNAT after routing
> -		 * we need this second input/output route.
> -		 */
> -		if (!__ip_vs_reroute_locally(skb))
> -			goto tx_error;
> -	}
>
>   	IP_VS_DBG_PKT(10, AF_INET, pp, skb, 0, "After DNAT");
>
> @@ -1269,16 +1223,8 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
>   		/* drop the old route when skb is not shared */
>   		skb_dst_drop(skb);
>   		skb_dst_set(skb, &rt->dst);
> -	} else {
> +	} else

    Same here.

>   		ip_rt_put(rt);
> -		/*
> -		 * Some IPv4 replies get local address from routes,
> -		 * not from iph, so while we DNAT after routing
> -		 * we need this second input/output route.
> -		 */
> -		if (!__ip_vs_reroute_locally(skb))
> -			goto tx_error;
> -	}
>
>   	/* Another hack: avoid icmp_send in ip_fragment */
>   	skb->local_df = 1;
>

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Julian Anastasov - March 29, 2013, 9:47 p.m.
Hello,

On Fri, 29 Mar 2013, Sergei Shtylyov wrote:

> On 29-03-2013 8:11, Simon Horman wrote:
> 
> > From: Julian Anastasov <ja@ssi.bg>
> 
> > After commit 70e7341673 (ipv4: Show that ip_send_reply()
> > is purely unicast routine.) we do not need to reroute DNAT-ed
> > traffic over loopback because reply uses iph daddr and not
> > rt_spec_dst.
> 
> > Signed-off-by: Julian Anastasov <ja@ssi.bg>
> > Signed-off by: Hans Schillstrom <hans@schillstrom.com>
> > Signed-off-by: Simon Horman <horms@verge.net.au>
> > ---
> >   net/netfilter/ipvs/ip_vs_xmit.c |   58
> > ++-------------------------------------
> >   1 file changed, 2 insertions(+), 56 deletions(-)
> 
> > diff --git a/net/netfilter/ipvs/ip_vs_xmit.c
> > b/net/netfilter/ipvs/ip_vs_xmit.c
> > index 6448a2e..c942d36 100644
> > --- a/net/netfilter/ipvs/ip_vs_xmit.c
> > +++ b/net/netfilter/ipvs/ip_vs_xmit.c
> [...]
> > @@ -635,16 +597,8 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn
> > *cp,
> >   		/* drop old route */
> >   		skb_dst_drop(skb);
> >   		skb_dst_set(skb, &rt->dst);
> > -	} else {
> > +	} else
> 
>    {} should be kept after *else*, according to Documentation/CodingStyle,
> chapter 3.

	Sigh. I missed this rule from Nov 2011.
It seems checkpatch.pl can not stop such crimes to occur :)

> >   		ip_rt_put(rt);
> > -		/*
> > -		 * Some IPv4 replies get local address from routes,
> > -		 * not from iph, so while we DNAT after routing
> > -		 * we need this second input/output route.
> > -		 */
> > -		if (!__ip_vs_reroute_locally(skb))
> > -			goto tx_error;
> > -	}
> > 
> >   	IP_VS_DBG_PKT(10, AF_INET, pp, skb, 0, "After DNAT");
> > 
> > @@ -1269,16 +1223,8 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct
> > ip_vs_conn *cp,
> >   		/* drop the old route when skb is not shared */
> >   		skb_dst_drop(skb);
> >   		skb_dst_set(skb, &rt->dst);
> > -	} else {
> > +	} else
> 
>    Same here.
> 
> >   		ip_rt_put(rt);
> > -		/*
> > -		 * Some IPv4 replies get local address from routes,
> > -		 * not from iph, so while we DNAT after routing
> > -		 * we need this second input/output route.
> > -		 */
> > -		if (!__ip_vs_reroute_locally(skb))
> > -			goto tx_error;
> > -	}
> > 
> >   	/* Another hack: avoid icmp_send in ip_fragment */
> >   	skb->local_df = 1;

Regards

--
Julian Anastasov <ja@ssi.bg>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 6448a2e..c942d36 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -207,44 +207,6 @@  __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
 	return rt;
 }
 
-/* Reroute packet to local IPv4 stack after DNAT */
-static int
-__ip_vs_reroute_locally(struct sk_buff *skb)
-{
-	struct rtable *rt = skb_rtable(skb);
-	struct net_device *dev = rt->dst.dev;
-	struct net *net = dev_net(dev);
-	struct iphdr *iph = ip_hdr(skb);
-
-	if (rt_is_input_route(rt)) {
-		unsigned long orefdst = skb->_skb_refdst;
-
-		if (ip_route_input(skb, iph->daddr, iph->saddr,
-				   iph->tos, skb->dev))
-			return 0;
-		refdst_drop(orefdst);
-	} else {
-		struct flowi4 fl4 = {
-			.daddr = iph->daddr,
-			.saddr = iph->saddr,
-			.flowi4_tos = RT_TOS(iph->tos),
-			.flowi4_mark = skb->mark,
-		};
-
-		rt = ip_route_output_key(net, &fl4);
-		if (IS_ERR(rt))
-			return 0;
-		if (!(rt->rt_flags & RTCF_LOCAL)) {
-			ip_rt_put(rt);
-			return 0;
-		}
-		/* Drop old route. */
-		skb_dst_drop(skb);
-		skb_dst_set(skb, &rt->dst);
-	}
-	return 1;
-}
-
 #ifdef CONFIG_IP_VS_IPV6
 
 static inline int __ip_vs_is_local_route6(struct rt6_info *rt)
@@ -635,16 +597,8 @@  ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 		/* drop old route */
 		skb_dst_drop(skb);
 		skb_dst_set(skb, &rt->dst);
-	} else {
+	} else
 		ip_rt_put(rt);
-		/*
-		 * Some IPv4 replies get local address from routes,
-		 * not from iph, so while we DNAT after routing
-		 * we need this second input/output route.
-		 */
-		if (!__ip_vs_reroute_locally(skb))
-			goto tx_error;
-	}
 
 	IP_VS_DBG_PKT(10, AF_INET, pp, skb, 0, "After DNAT");
 
@@ -1269,16 +1223,8 @@  ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 		/* drop the old route when skb is not shared */
 		skb_dst_drop(skb);
 		skb_dst_set(skb, &rt->dst);
-	} else {
+	} else
 		ip_rt_put(rt);
-		/*
-		 * Some IPv4 replies get local address from routes,
-		 * not from iph, so while we DNAT after routing
-		 * we need this second input/output route.
-		 */
-		if (!__ip_vs_reroute_locally(skb))
-			goto tx_error;
-	}
 
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;