Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753071AbZI2Ov5 (ORCPT ); Tue, 29 Sep 2009 10:51:57 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752395AbZI2Ov4 (ORCPT ); Tue, 29 Sep 2009 10:51:56 -0400 Received: from kirsty.vergenet.net ([202.4.237.240]:38503 "EHLO kirsty.vergenet.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752009AbZI2Ovy (ORCPT ); Tue, 29 Sep 2009 10:51:54 -0400 Date: Wed, 30 Sep 2009 00:51:56 +1000 From: Simon Horman To: Hannes Eder Cc: lvs-devel@vger.kernel.org, Wensong Zhang , Julius Volz , lvs-users@linuxvirtualserver.org, Laurent Grawet , Jean-Luc Fortemaison , linux-kernel@vger.kernel.org, Jan Engelhardt , Julian Anastasov , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, Fabien =?utf-8?Q?Duch=C3=AAne?= , Joseph Mack NA3T , Patrick McHardy Subject: Re: [PATCH v2 0/4] IPVS full NAT support + netfilter 'ipvs' match support Message-ID: <20090929145156.GB19797@verge.net.au> Mail-Followup-To: Hannes Eder , lvs-devel@vger.kernel.org, Wensong Zhang , Julius Volz , lvs-users@linuxvirtualserver.org, Laurent Grawet , Jean-Luc Fortemaison , linux-kernel@vger.kernel.org, Jan Engelhardt , Julian Anastasov , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, Fabien =?utf-8?Q?Duch=C3=AAne?= , Joseph Mack NA3T , Patrick McHardy References: <20090929123501.13798.84004.stgit@jazzy.zrh.corp.google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20090929123501.13798.84004.stgit@jazzy.zrh.corp.google.com> User-Agent: Mutt/1.5.20 (2009-06-14) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4254 Lines: 107 On Tue, Sep 29, 2009 at 02:35:15PM +0200, Hannes Eder wrote: > The following series implements full NAT support for IPVS. The > approach is via a minimal change to IPVS (make friends with > nf_conntrack) and adding a netfilter matcher, kernel- and user-space > part, i.e. xt_ipvs and libxt_ipvs. Its a bit late in the day for me to review the code, but I have a few quick comments. > > Example usage: > > % ipvsadm -A -t 192.168.100.30:80 -s rr > % ipvsadm -a -t 192.168.100.30:80 -r 192.168.10.20:80 -m > # ... > > # Source NAT for VIP 192.168.100.30:80 > % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ > > --vport 80 -j SNAT --to-source 192.168.10.10 > > or SNAT-ing only a specific real server: > > % iptables -t nat -A POSTROUTING --dst 192.168.11.20 \ > > -m ipvs --vaddr 192.168.100.30/32 -j SNAT --to-source 192.168.10.10 If the iptables rule is not in place does LVS just use its old NAT behaviour? > First of all, thanks for all the feedback. This is the changelog for v2: > > - Make ip_vs_ftp work again. Setup nf_conntrack expectations for > related data connections (based on Julian's patch see > http://www.ssi.bg/~ja/nfct/) and let nf_conntrack/nf_nat do the > packet mangling and the TCP sequence adjusting. > > This change rises the question how to deal with ip_vs_sync? Does it > work together with conntrackd? Wild idea: what about getting rid of > ip_vs_sync and piggy packing all on nf_conntrack and use conntrackd? > > Any comments on this? That sounds like a reasonable suggestion. I think that ip_vs_sync came along before conntrackd and no one has given much thought to merging the functionality. > - xt_ipvs: add new rule '--vportctl port' to match the VIP port of the > controlling connection, e.g. port 21 for FTP. Can be used to match > a related data connection for FTP: > > # SNAT FTP control connection > % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ > > --vport 21 -j SNAT --to-source 192.168.10.10 > > # SNAT FTP passive data connection > % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \ > > --vportctl 21 -j SNAT --to-source 192.168.10.10 > > - xt_ipvs: use 'par->family' instead of 'skb->protocol' > > - xt_ipvs: add ipvs_mt_check and restrict to NFPROTO_IPV4 and NFPROTO_IPV6 > > - Call nf_conntrack_alter_reply(), so helper lookup is performed based > on the changed tuple. > > Changes to the linux kernel (rebased to next-20090925): > > Hannes Eder (3): > netfilter: xt_ipvs (netfilter matcher for IPVS) > IPVS: make friends with nf_conntrack > IPVS: make FTP work with full NAT support > > > include/linux/netfilter/xt_ipvs.h | 25 +++++ > include/net/ip_vs.h | 2 > net/netfilter/Kconfig | 9 ++ > net/netfilter/Makefile | 1 > net/netfilter/ipvs/Kconfig | 4 - > net/netfilter/ipvs/ip_vs_app.c | 43 --------- > net/netfilter/ipvs/ip_vs_core.c | 37 ------- > net/netfilter/ipvs/ip_vs_ftp.c | 178 ++++++++++++++++++++++++++++++++--- > net/netfilter/ipvs/ip_vs_proto.c | 1 > net/netfilter/ipvs/ip_vs_xmit.c | 30 ++++++ > net/netfilter/xt_ipvs.c | 187 +++++++++++++++++++++++++++++++++++++ > 11 files changed, 418 insertions(+), 99 deletions(-) > create mode 100644 include/linux/netfilter/xt_ipvs.h > create mode 100644 net/netfilter/xt_ipvs.c > > > Changes to iptables (relative to 1.4.5): > > Hannes Eder (1): > libxt_ipvs: user-space lib for netfilter matcher xt_ipvs > > configure.ac | 11 + > extensions/libxt_ipvs.c | 365 +++++++++++++++++++++++++++++++++++++ > extensions/libxt_ipvs.man | 24 ++ > include/linux/netfilter/xt_ipvs.h | 25 +++ > 4 files changed, 422 insertions(+), 3 deletions(-) > create mode 100644 extensions/libxt_ipvs.c > create mode 100644 extensions/libxt_ipvs.man > create mode 100644 include/linux/netfilter/xt_ipvs.h -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/