Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752067AbZI2NMJ (ORCPT ); Tue, 29 Sep 2009 09:12:09 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751089AbZI2NMI (ORCPT ); Tue, 29 Sep 2009 09:12:08 -0400 Received: from smtp-out.google.com ([216.239.33.17]:51614 "EHLO smtp-out.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750698AbZI2NMG (ORCPT ); Tue, 29 Sep 2009 09:12:06 -0400 DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=subject:to:from:cc:date:message-id:user-agent: mime-version:content-type:content-transfer-encoding; b=jo9kDKy+IjbDSLb0cOsIaXQVlajyRVRuwm2gkOrRt0iu6/72RZsUiEqcKk7NnuAwU 1LfBVuhGC5L+waib8BB4w== Subject: [PATCH v2 0/4] IPVS full NAT support + netfilter 'ipvs' match support To: lvs-devel@vger.kernel.org From: Hannes Eder Cc: Wensong Zhang , Julius Volz , lvs-users@linuxvirtualserver.org, Laurent Grawet , Jean-Luc Fortemaison , linux-kernel@vger.kernel.org, Jan Engelhardt , Julian Anastasov , Simon Horman , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, =?ISO-8859-1?Q?Fabien_Duch=EAne?= , Joseph Mack NA3T , Patrick McHardy Date: Tue, 29 Sep 2009 14:35:15 +0200 Message-ID: <20090929123501.13798.84004.stgit@jazzy.zrh.corp.google.com> User-Agent: StGit/0.15-rc2-7-gba5c-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3680 Lines: 95 The following series implements full NAT support for IPVS. The approach is via a minimal change to IPVS (make friends with nf_conntrack) and adding a netfilter matcher, kernel- and user-space part, i.e. xt_ipvs and libxt_ipvs. Example usage: % ipvsadm -A -t 192.168.100.30:80 -s rr % ipvsadm -a -t 192.168.100.30:80 -r 192.168.10.20:80 -m # ... # Source NAT for VIP 192.168.100.30:80 % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ > --vport 80 -j SNAT --to-source 192.168.10.10 or SNAT-ing only a specific real server: % iptables -t nat -A POSTROUTING --dst 192.168.11.20 \ > -m ipvs --vaddr 192.168.100.30/32 -j SNAT --to-source 192.168.10.10 First of all, thanks for all the feedback. This is the changelog for v2: - Make ip_vs_ftp work again. Setup nf_conntrack expectations for related data connections (based on Julian's patch see http://www.ssi.bg/~ja/nfct/) and let nf_conntrack/nf_nat do the packet mangling and the TCP sequence adjusting. This change rises the question how to deal with ip_vs_sync? Does it work together with conntrackd? Wild idea: what about getting rid of ip_vs_sync and piggy packing all on nf_conntrack and use conntrackd? Any comments on this? - xt_ipvs: add new rule '--vportctl port' to match the VIP port of the controlling connection, e.g. port 21 for FTP. Can be used to match a related data connection for FTP: # SNAT FTP control connection % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ > --vport 21 -j SNAT --to-source 192.168.10.10 # SNAT FTP passive data connection % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ > --vportctl 21 -j SNAT --to-source 192.168.10.10 - xt_ipvs: use 'par->family' instead of 'skb->protocol' - xt_ipvs: add ipvs_mt_check and restrict to NFPROTO_IPV4 and NFPROTO_IPV6 - Call nf_conntrack_alter_reply(), so helper lookup is performed based on the changed tuple. Changes to the linux kernel (rebased to next-20090925): Hannes Eder (3): netfilter: xt_ipvs (netfilter matcher for IPVS) IPVS: make friends with nf_conntrack IPVS: make FTP work with full NAT support include/linux/netfilter/xt_ipvs.h | 25 +++++ include/net/ip_vs.h | 2 net/netfilter/Kconfig | 9 ++ net/netfilter/Makefile | 1 net/netfilter/ipvs/Kconfig | 4 - net/netfilter/ipvs/ip_vs_app.c | 43 --------- net/netfilter/ipvs/ip_vs_core.c | 37 ------- net/netfilter/ipvs/ip_vs_ftp.c | 178 ++++++++++++++++++++++++++++++++--- net/netfilter/ipvs/ip_vs_proto.c | 1 net/netfilter/ipvs/ip_vs_xmit.c | 30 ++++++ net/netfilter/xt_ipvs.c | 187 +++++++++++++++++++++++++++++++++++++ 11 files changed, 418 insertions(+), 99 deletions(-) create mode 100644 include/linux/netfilter/xt_ipvs.h create mode 100644 net/netfilter/xt_ipvs.c Changes to iptables (relative to 1.4.5): Hannes Eder (1): libxt_ipvs: user-space lib for netfilter matcher xt_ipvs configure.ac | 11 + extensions/libxt_ipvs.c | 365 +++++++++++++++++++++++++++++++++++++ extensions/libxt_ipvs.man | 24 ++ include/linux/netfilter/xt_ipvs.h | 25 +++ 4 files changed, 422 insertions(+), 3 deletions(-) create mode 100644 extensions/libxt_ipvs.c create mode 100644 extensions/libxt_ipvs.man create mode 100644 include/linux/netfilter/xt_ipvs.h -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/