[PATCH 6/6] move ipvs to PRE/POSTROUTING

[Jason Stubbs <j.stubbs@xxxxxxxxxxxxxxx>]

Aliasing LOCALNODE to MASQ means that traffic entering the OUTPUT chain
may be replies for a LVS-NAT'd connection. This patch adds the same
hooks that de-LVS packets at the start of PREROUTING to the start of
OUTPUT too.

-- 
Jason Stubbs <j.stubbs@xxxxxxxxxxxxxxx>
LINKTHINK INC.
東京都渋谷区桜ヶ丘町22-14 N.E.S S棟 3F
TEL 03-5728-4772  FAX 03-5728-4773

diff -urp linux.5.localmasq/net/ipv4/ipvs/ip_vs_core.c linux.6.localhooks/net/ipv4/ipvs/ip_vs_core.c
--- linux.5.localmasq/net/ipv4/ipvs/ip_vs_core.c	2008-04-15 13:07:04.000000000 +0900
+++ linux.6.localhooks/net/ipv4/ipvs/ip_vs_core.c	2008-04-15 13:16:34.159728801 +0900
@@ -1008,6 +1008,25 @@ static struct nf_hook_ops ip_vs_forward_
 	.owner		= THIS_MODULE,
 	.pf		= PF_INET,
 	.hooknum        = NF_IP_PRE_ROUTING,
+	.priority       = NF_IP_PRI_FIRST + 1,
+};
+
+/* After packet filtering, change source only for VS/NAT */
+static struct nf_hook_ops ip_vs_local_out_ops = {
+	.hook		= ip_vs_out,
+	.owner		= THIS_MODULE,
+	.pf		= PF_INET,
+	.hooknum        = NF_IP_LOCAL_OUT,
+	.priority       = NF_IP_PRI_FIRST,
+};
+
+/* After packet filtering (but before ip_vs_out_icmp), catch icmp
+   destined for 0.0.0.0/0, which is for incoming IPVS connections */
+static struct nf_hook_ops ip_vs_local_icmp_ops = {
+	.hook		= ip_vs_forward_icmp,
+	.owner		= THIS_MODULE,
+	.pf		= PF_INET,
+	.hooknum        = NF_IP_LOCAL_OUT,
 	.priority       = NF_IP_PRI_FIRST,
 };
 
@@ -1050,15 +1069,32 @@ static int __init ip_vs_init(void)
 		IP_VS_ERR("can't register out hook.\n");
 		goto cleanup_inops;
 	}
+
 	ret = nf_register_hook(&ip_vs_forward_icmp_ops);
 	if (ret < 0) {
 		IP_VS_ERR("can't register forward_icmp hook.\n");
 		goto cleanup_outops;
 	}
 
+	ret = nf_register_hook(&ip_vs_local_out_ops);
+	if (ret < 0) {
+		IP_VS_ERR("can't register local out hook.\n");
+		goto cleanup_icmpops;
+	}
+
+	ret = nf_register_hook(&ip_vs_local_icmp_ops);
+	if (ret < 0) {
+		IP_VS_ERR("can't register local icmp hook.\n");
+		goto cleanup_localout;
+	}
+
 	IP_VS_INFO("ipvs loaded.\n");
 	return ret;
 
+  cleanup_localout:
+    nf_unregister_hook(&ip_vs_local_out_ops);
+  cleanup_icmpops:
+    nf_unregister_hook(&ip_vs_forward_icmp_ops);
   cleanup_outops:
 	nf_unregister_hook(&ip_vs_out_ops);
   cleanup_inops:
@@ -1076,6 +1112,8 @@ static int __init ip_vs_init(void)
 
 static void __exit ip_vs_cleanup(void)
 {
+	nf_unregister_hook(&ip_vs_local_icmp_ops);
+	nf_unregister_hook(&ip_vs_local_out_ops);
 	nf_unregister_hook(&ip_vs_forward_icmp_ops);
 	nf_unregister_hook(&ip_vs_out_ops);
 	nf_unregister_hook(&ip_vs_in_ops);