Am 16.10.2010 09:58, schrieb Simon Horman: > From: Hans Schillstrom <hans.schillstrom@xxxxxxxxxxxx> > > ipvs: IPv6 tunnel mode > > IPv6 encapsulation uses a bad source address for the tunnel. > i.e. VIP will be used as local-addr and encap. dst addr. > Decapsulation will not accept this. > > Example > LVS (eth1 2003::2:0:1/96, VIP 2003::2:0:100) > (eth0 2003::1:0:1/96) > RS (ethX 2003::1:0:5/96) > > tcpdump > 2003::2:0:100 > 2003::1:0:5: > IP6 (hlim 63, next-header TCP (6) payload length: 40) > 2003::3:0:10.50991 > 2003::2:0:100.http: Flags [S], cksum 0x7312 > (correct), seq 3006460279, win 5760, options [mss 1440,sackOK,TS val > 1904932 ecr 0,nop,wscale 3], length 0 > > In Linux IPv6 impl. you can't have a tunnel with an any cast address > receiving packets (I have not tried to interpret RFC 2473) > To have receive capabilities the tunnel must have: > - Local address set as multicast addr or an unicast addr > - Remote address set as an unicast addr. > - Loop back addres or Link local address are not allowed. > > This causes us to setup a tunnel in the Real Server with the > LVS as the remote address, here you can't use the VIP address since it's > used inside the tunnel. > > Solution > Use outgoing interface IPv6 address (match against the destination). > i.e. use ip6_route_output() to look up the route cache and > then use ipv6_dev_get_saddr(...) to set the source address of the > encapsulated packet. > > Additionally, cache the results in new destination > fields: dst_cookie and dst_saddr and properly check the > returned dst from ip6_route_output. We now add xfrm_lookup > call only for the tunneling method where the source address > is a local one. > > Signed-off-by:Hans Schillstrom <hans.schillstrom@xxxxxxxxxxxx> > > --- > > Original patch by Hans Schillstrom. > Check dst state and cache results for IPv6 by Julian Anastasov. > Subsequent revisions made by Hans Schillstrom: > > * v1 > > This is Julian's patch with a slightly edited version of the description > from Hans's original patch. > > * v2 > > Updated changelog as per commends from Julian > > * v3 > > Flowi dest address used as destination instead of rt6_info in > +ip_vs_tunnel_xmit_v6() > rt6_info somtimes contains a netw address insted of a tunnel > > * v4 > > Update destination as recommended from Julian > i.e. use &cp->daddr.in6 > > * v4.1 Simon Horman > Fix patch corruption > > Patrick, please consider this for nf-next-2.6 Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
