On Tue, Apr 28, 2009 at 05:28:06PM +0200, Jan Engelhardt wrote:
>
> On Tuesday 2009-04-28 17:00, Simon Horman wrote:
> >> >Index: net-next-2.6/net/netfilter/ipvs/ip_vs_conn.c
> >> >===================================================================
> >> >--- net-next-2.6.orig/net/netfilter/ipvs/ip_vs_conn.c 2009-04-28 20:37:48.000000000 +1000
> >> >+++ net-next-2.6/net/netfilter/ipvs/ip_vs_conn.c 2009-04-28 20:37:51.000000000 +1000
> >> >@@ -260,7 +260,10 @@ struct ip_vs_conn *ip_vs_ct_in_get
> >> > list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
> >> > if (cp->af == af &&
> >> > ip_vs_addr_equal(af, s_addr, &cp->caddr) &&
> >> >- ip_vs_addr_equal(af, d_addr, &cp->vaddr) &&
> >> >+ /* protocol should only be IPPROTO_IP if
> >> >+ * d_addr is a fwmark */
> >> >+ ip_vs_addr_equal(protocol == IPPROTO_IP ? AF_UNSPEC : af,
> >> >+ d_addr, &cp->vaddr) &&
> >>
> >> What about IPPROTO_IPV6?
> >
> >I believe that the value IPPROTO_IP is only used in the case of fwmark.
> >Here is a explanation of why.
> >
> >1) If a fwmark in use, then it is set to IPPROTO_IP when dealing
> > with templates for persistance.
> >2) If the entry is created by the FTP helper, IPPROTO_TCP is used.
> >3) If the entry is created by syncrhonisation of the table of another
> > machine, then the protocol used in the foreign entry is used -
> > which would have been set by one of these 4 cases.
> >4) Otherwise the value of iph.protocol is used.
>
> That sounds a bit like whenever you get an IPIP packet,
> IPVS will erroneously think it is operating on an fwmark-based address.
Unless I am missing something, if the protcol of the skb is IPPROTO_IPIP
then ip_vs_in() will return NF_ACCEPT and it won't go through
any code paths that use the logic above.
iph.protocol needs to be matched by ip_vs_proto_get(),
which means it needs to be one of:
IPPROTO_TCP
IPPROTO_UDP
IPPROTO_AH
IPPROTO_ESP
IPPROTO_ICMP is also handled, basically by extracting the embeded
header and then checking its iph.protocol with ip_vs_proto_get()
In other words IPVS only knows how to load balance TCP, UDP, AH and ESP,
and handle related ICMP traffic.
--
Simon Horman
VA Linux Systems Japan K.K. Satellite Lab in Sydney, Australia
H: www.vergenet.net/~horms/ W: www.valinux.co.jp/en
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
