ip_vs实现分析2
2016-12-08 14:24
375 查看
本文档的Copyleft归yfydz所有，使用GPL发布，可以自由拷贝，转载，转载时请保持文档的完整性，严禁用于任何商业用途。
msn: yfydz_no1@hotmail.com
来源：http://yfydz.cublog.cn
4. 模块初始化
初始化函数先初始化ipvs的各种处理机制，然后将ipvs的处理函数挂接到netfilter架构中。
/* net/ipv4/ipvs/ip_vs_core.c */
static int __init ip_vs_init(void)
{
int ret;
// ioctl初始化
ret = ip_vs_control_init();
if (ret < 0) {
IP_VS_ERR("can't setup control.\n");
goto cleanup_nothing;
}
// 协议初始化
ip_vs_protocol_init();
// 应用层辅助协议初始化
ret = ip_vs_app_init();
if (ret < 0) {
IP_VS_ERR("can't setup application helper.\n");
goto cleanup_protocol;
}
// ipvs连接初始化
ret = ip_vs_conn_init();
if (ret < 0) {
IP_VS_ERR("can't setup connection table.\n");
goto cleanup_app;
}
// 下面分别挂接各个处理点到netfilter架构中
ret = nf_register_hook(&ip_vs_in_ops);
if (ret < 0) {
IP_VS_ERR("can't register in hook.\n");
goto cleanup_conn;
}
ret = nf_register_hook(&ip_vs_out_ops);
if (ret < 0) {
IP_VS_ERR("can't register out hook.\n");
goto cleanup_inops;
}
ret = nf_register_hook(&ip_vs_post_routing_ops);
if (ret < 0) {
IP_VS_ERR("can't register post_routing hook.\n");
goto cleanup_outops;
}
ret = nf_register_hook(&ip_vs_forward_icmp_ops);
if (ret < 0) {
IP_VS_ERR("can't register forward_icmp hook.\n");
goto cleanup_postroutingops;
}
IP_VS_INFO("ipvs loaded.\n");
return ret;
// 以下是如果初始化出现失败时依次进行释放
cleanup_postroutingops:
nf_unregister_hook(&ip_vs_post_routing_ops);
cleanup_outops:
nf_unregister_hook(&ip_vs_out_ops);
cleanup_inops:
nf_unregister_hook(&ip_vs_in_ops);
cleanup_conn:
ip_vs_conn_cleanup();
cleanup_app:
ip_vs_app_cleanup();
cleanup_protocol:
ip_vs_protocol_cleanup();
ip_vs_control_cleanup();
cleanup_nothing:
return ret;
}
4.1 ip_vs_control_init
/* net/ipv4/ipvs/ip_vs_ctl.c */
int ip_vs_control_init(void)
{
int ret;
int idx;
EnterFunction(2);
// 登记ipvs的sockopt控制,这样用户空间可通过setsockopt函数来和ipvs进行通信
ret = nf_register_sockopt(&ip_vs_sockopts);
if (ret) {
IP_VS_ERR("cannot register sockopt.\n");
return ret;
}
// 建立/proc/net/ip_vs和/proc/net/ip_vs_stats只读项
proc_net_fops_create("ip_vs", 0, &ip_vs_info_fops);
proc_net_fops_create("ip_vs_stats",0, &ip_vs_stats_fops);
// 建立/proc/sys/net/ipv4/vs目录下的各可读写控制参数
sysctl_header = register_sysctl_table(vs_root_table, 0);
// 初始化各种双向链表
// svc_table是根据协议地址端口等信息进行服务结构struct ip_vs_service查找的HASH表
// svc_fwm_table是根据数据包的nfmark信息进行服务结构struct ip_vs_service查找的HASH表
/* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */
for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
}
// rtable是目的结构struct ip_vs_dest的HASH链表
for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++) {
INIT_LIST_HEAD(&ip_vs_rtable[idx]);
}
// ipvs统计信息
memset(&ip_vs_stats, 0, sizeof(ip_vs_stats));
// 统计锁
spin_lock_init(&ip_vs_stats.lock);
// 对当前统计信息建立一个预估器,可用于计算服务器的性能参数
ip_vs_new_estimator(&ip_vs_stats);
/* Hook the defense timer */
// 挂一个定时操作，根据系统当前负载情况定时调整系统参数
schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
LeaveFunction(2);
return 0;
}
4.2 ip_vs_protocol_init
/* net/ipv4/ipvs/ip_vs_proto.c */
int ip_vs_protocol_init(void)
{
// 挂接ipvs能进行均衡处理的各种协议,目前支持TCP/UDP/AH/ESP
// 最好还要增加GRE,在PPTP服务器中使用
char protocols[64];
#define REGISTER_PROTOCOL(p) \
do { \
register_ip_vs_protocol(p); \
strcat(protocols, ", "); \
strcat(protocols, (p)->name); \
} while (0)
// 0,1字符是给", "预留的
protocols[0] = '\0';
protocols[2] = '\0';
// 登记各种协议
#ifdef CONFIG_IP_VS_PROTO_TCP
REGISTER_PROTOCOL(&ip_vs_protocol_tcp);
#endif
#ifdef CONFIG_IP_VS_PROTO_UDP
REGISTER_PROTOCOL(&ip_vs_protocol_udp);
#endif
#ifdef CONFIG_IP_VS_PROTO_AH
REGISTER_PROTOCOL(&ip_vs_protocol_ah);
#endif
#ifdef CONFIG_IP_VS_PROTO_ESP
REGISTER_PROTOCOL(&ip_vs_protocol_esp);
#endif
// 第0,1字符分别为逗号','和空格' ',从第2字符起才是真正数据串
IP_VS_INFO("Registered protocols (%s)\n", &protocols[2]);
return 0;
}
register_ip_vs_protocol()函数就是把ip_vs_protocol结构挂接到协议HASH表中，不过其实没几个协议，没必要用HASH，直接数组就行了，Linux内核中缺省好象也只支持32种IP协议。
/*
* register an ipvs protocol
*/
static int register_ip_vs_protocol(struct ip_vs_protocol *pp)
{
unsigned hash = IP_VS_PROTO_HASH(pp->protocol);
// 把新协议节点挂接到HASH链表头
pp->next = ip_vs_proto_table[hash];
ip_vs_proto_table[hash] = pp;
// 调用该协议的初始化函数
if (pp->init != NULL)
pp->init(pp);
return 0;
}
4.3 ip_vs_app_init
IPVS应用初始化
/* net/ipv4/ipvs/ip_vs_app.c */
int ip_vs_app_init(void)
{
/* we will replace it with proc_net_ipvs_create() soon */
// 该函数就是建立一个/proc/net/ip_vs_app项
proc_net_fops_create("ip_vs_app", 0, &ip_vs_app_fops);
return 0;
}
4.4 ip_vs_conn_init
IPVS连接初始化
/* net/ipv4/ipvs/ip_vs_conn.c */
int ip_vs_conn_init(void)
{
int idx;
/*
* Allocate the connection hash table and initialize its list heads
*/
// ipvs连接HASH表
ip_vs_conn_tab = vmalloc(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head));
if (!ip_vs_conn_tab)
return -ENOMEM;
/* Allocate ip_vs_conn slab cache */
// ipvs连接cache,由于使用cache在内存块释放时并不真正释放，而是cache起来，
// 因此重新分配时速度更快
ip_vs_conn_cachep = kmem_cache_create("ip_vs_conn",
sizeof(struct ip_vs_conn), 0,
SLAB_HWCACHE_ALIGN, NULL, NULL);
if (!ip_vs_conn_cachep) {
vfree(ip_vs_conn_tab);
return -ENOMEM;
}
IP_VS_INFO("Connection hash table configured "
"(size=%d, memory=%ldKbytes)\n",
IP_VS_CONN_TAB_SIZE,
(long)(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head))/1024);
IP_VS_DBG(0, "Each connection entry needs %Zd bytes at least\n",
sizeof(struct ip_vs_conn));
// 初始化各HASH链表头
for (idx = 0; idx < IP_VS_CONN_TAB_SIZE; idx++) {
INIT_LIST_HEAD(&ip_vs_conn_tab[idx]);
}
// 初始化各读写锁
for (idx = 0; idx < CT_LOCKARRAY_SIZE; idx++) {
rwlock_init(&__ip_vs_conntbl_lock_array[idx].l);
}
// 建立/proc/net/ip_vs_conn项
proc_net_fops_create("ip_vs_conn", 0, &ip_vs_conn_fops);
/* calculate the random value for connection hash */
// 初始随机数
get_random_bytes(&ip_vs_conn_rnd, sizeof(ip_vs_conn_rnd));
return 0;
}
4.5 netfilter挂接点
nf_hook_ops分别在FORWARD点挂2个, INPUT点和POST_ROUTING点各挂一个
/* net/ipv4/ipvs/ip_vs_core.c */
4.5.1 ip_vs_in_ops
/* After packet filtering, forward packet through VS/DR, VS/TUN,
or VS/NAT(change destination), so that filtering rules can be
applied to IPVS. */
static struct nf_hook_ops ip_vs_in_ops = {
.hook = ip_vs_in,
.owner = THIS_MODULE,
.pf = PF_INET,
// INPUT点
.hooknum = NF_IP_LOCAL_IN,
// 此优先级低于filter
.priority = 100,
};
ip_vs_in()这个函数对进入本机的包进行处理.
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* Check if it's for virtual services, look it up,
* and send it on its way...
*/
static unsigned int
ip_vs_in(unsigned int hooknum, struct sk_buff **pskb,
const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct sk_buff *skb = *pskb;
struct iphdr *iph;
struct ip_vs_protocol *pp;
struct ip_vs_conn *cp;
int ret, restart;
int ihl;
/*
* Big tappo: only PACKET_HOST (neither loopback nor mcasts)
* ... don't know why 1st test DOES NOT include 2nd (?)
*/
if (unlikely(skb->pkt_type != PACKET_HOST
|| skb->dev == &loopback_dev || skb->sk)) {
// input不处理目的非本机的包
IP_VS_DBG(12, "packet type=%d proto=%d daddr=%d.%d.%d.%d ignored\n",
skb->pkt_type,
skb->nh.iph->protocol,
NIPQUAD(skb->nh.iph->daddr));
return NF_ACCEPT;
}
iph = skb->nh.iph;
if (unlikely(iph->protocol == IPPROTO_ICMP)) {
// 如果是ICMP，可能是指示连接错误的ICMP信息，调用ip_vs_in_icmp进行检查
// 是否是相关的ICMP信息
int related, verdict = ip_vs_in_icmp(pskb, &related, hooknum);
if (related)
return verdict;
// 非相关ICMP，恢复处理流程
// 但其实ipvs是不均衡ICMP信息的，后面就返回了
skb = *pskb;
iph = skb->nh.iph;
}
/* Protocol supported? */
// 获取协议支持模块，由于只支持TCP、UDP、AH和ESP，如果是ICMP，返回为NULL
pp = ip_vs_proto_get(iph->protocol);
if (unlikely(!pp))
return NF_ACCEPT;
ihl = iph->ihl << 2;
/*
* Check if the packet belongs to an existing connection entry
*/
// 找到和该skb相关的ipvs连接，类似netfilter的根据tuple查找连接，
// 不过sk_buff结构中没有增加nfct那样能直接指向连接的成员
// 对TCP协议来说是tcp_conn_in_get()
cp = pp->conn_in_get(skb, pp, iph, ihl, 0);
if (unlikely(!cp)) {
int v;
// 如果没有连接, 表明是新连接, 调用IPVS连接的conn_schedule调度连接分配和处理
// 连接调度要根据调度算法选择一个真实目的服务器，然后建立新的IPVS连接
// 对TCP协议来说是tcp_conn_schedule()
if (!pp->conn_schedule(skb, pp, &v, &cp))
return v;
}
if (unlikely(!cp)) {
// 这种情况主要是没内存空间了，IPVS没提供主动删除连接的机制
/* sorry, all this trouble for a no-hit :) */
IP_VS_DBG_PKT(12, pp, skb, 0,
"packet continues traversal as normal");
return NF_ACCEPT;
}
IP_VS_DBG_PKT(11, pp, skb, 0, "Incoming packet");
/* Check the server status */
if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
/* the destination server is not available */
// 对于目的服务器失效的包丢弃
if (sysctl_ip_vs_expire_nodest_conn) {
/* try to expire the connection immediately */
ip_vs_conn_expire_now(cp);
}
/* don't restart its timer, and silently
drop the packet. */
__ip_vs_conn_put(cp);
return NF_DROP;
}
// 连接信息统计
ip_vs_in_stats(cp, skb);
// 进行连接状态的迁移, restart这个参数其实没用
// 对TCP协议来说是调用tcp_state_transition
restart = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
if (cp->packet_xmit)
// 将包发送出去, 具体xmit的实现在ip_vs_xmit.c中实现,
// NAT模式下为 ip_vs_nat_xmit;
// 通道模式下为 ip_vs_tunnel_xmit;
// 直接路由模式下为: ip_vs_dr_xmit;
// 本机数据为: ip_vs_null_xmit;
// 旁路模式下为: ip_vs_bypass_xmit;
// 函数成功时基本都返回NF_STOLEN使netfilter不再处理该包
// 所以对于NAT模式，应该是不需要配置DNAT规则的，请求方向数据也不经过FORWARD链
ret = cp->packet_xmit(skb, cp, pp);
/* do not touch skb anymore */
else {
IP_VS_DBG_RL("warning: packet_xmit is null");
ret = NF_ACCEPT;
}
/* increase its packet counter and check if it is needed
to be synchronized */
atomic_inc(&cp->in_pkts);
// 在进行均衡器热备时将连接信息要从MASTER传递到SLAVE，使系统切换时
// 连接不丢弃，但还是要有一定条件才进行同步
if ((ip_vs_sync_state & IP_VS_STATE_MASTER) &&
// 同步状态类型为主机
(cp->protocol != IPPROTO_TCP ||
cp->state == IP_VS_TCP_S_ESTABLISHED) &&
// 非TCP连接或是已经建立的连接
(atomic_read(&cp->in_pkts) % sysctl_ip_vs_sync_threshold[1]
== sysctl_ip_vs_sync_threshold[0]))
// 当前连接的包数为N*thres[1]+thres[0]时
// 进行连接的同步
ip_vs_sync_conn(cp);
// 调整连接超时,释放连接计数
ip_vs_conn_put(cp);
return ret;
}
4.5.2 ip_vs_out_ops
/* After packet filtering, change source only for VS/NAT */
static struct nf_hook_ops ip_vs_out_ops = {
.hook = ip_vs_out,
.owner = THIS_MODULE,
.pf = PF_INET,
// FORWARD点
.hooknum = NF_IP_FORWARD,
// 此优先级低于filter
.priority = 100,
};
ip_vs_out()这个函数对转发包进行处理, 只用在NAT模式的均衡处理，TUNNEL和DR方式下都是直接发送了，实际处理的只是服务器返回的回应包，而客户端请求的包是不经过这里的，但如果设置了DNAT规则，数据包在PREROUTING点进行了目的地址修改，这样就不会再进入INPUT点而是直接转到FORWARD点处理，这时时针对该包的IPVS连接是没有建立的。
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* It is hooked at the NF_IP_FORWARD chain, used only for VS/NAT.
* Check if outgoing packet belongs to the established ip_vs_conn,
* rewrite addresses of the packet and send it on its way...
*/
static unsigned int
ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct sk_buff *skb = *pskb;
struct iphdr *iph;
struct ip_vs_protocol *pp;
struct ip_vs_conn *cp;
int ihl;
EnterFunction(11);
// 这个标志只占一位
// 标志设上就是已经经过IPVS处理了，直接返回
if (skb->ipvs_property)
return NF_ACCEPT;
iph = skb->nh.iph;
if (unlikely(iph->protocol == IPPROTO_ICMP)) {
// 处理可能的连接相关ICMP错误信息,如地址端口不可达等
int related, verdict = ip_vs_out_icmp(pskb, &related);
if (related)
return verdict;
skb = *pskb;
iph = skb->nh.iph;
}
// 取得IPVS协议, tcp/udp/ah/esp之一
pp = ip_vs_proto_get(iph->protocol);
if (unlikely(!pp))
return NF_ACCEPT;
/* reassemble IP fragments */
if (unlikely(iph->frag_off & __constant_htons(IP_MF|IP_OFFSET) &&
!pp->dont_defrag)) {
// 如果是碎片包进行重组,基本不可能,因为数据包进入netfilter时就要进行碎片重组
skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT);
if (!skb)
return NF_STOLEN;
iph = skb->nh.iph;
*pskb = skb;
}
ihl = iph->ihl << 2;
/*
* Check if the packet belongs to an existing entry
*/
// 查找IPVS连接
cp = pp->conn_out_get(skb, pp, iph, ihl, 0);
if (unlikely(!cp)) {
// 没找到IPVS连接,可能是请求方向的包经过DNAT过来的
if (sysctl_ip_vs_nat_icmp_send &&
(pp->protocol == IPPROTO_TCP ||
pp->protocol == IPPROTO_UDP)) {
__u16 _ports[2], *pptr;
pptr = skb_header_pointer(skb, ihl,
sizeof(_ports), _ports);
if (pptr == NULL)
return NF_ACCEPT; /* Not for me */
// 用源地址，源端口来查真实服务器结构，如果是请求方向是找不到的
// 这种情况下数据包就不再被IPVS处理
if (ip_vs_lookup_real_service(iph->protocol,
iph->saddr, pptr[0])) {
/*
* Notify the real server: there is no
* existing entry if it is not RST
* packet or not TCP packet.
*/
if (iph->protocol != IPPROTO_TCP
|| !is_tcp_reset(skb)) {
icmp_send(skb,ICMP_DEST_UNREACH,
ICMP_PORT_UNREACH, 0);
return NF_DROP;
}
}
}
IP_VS_DBG_PKT(12, pp, skb, 0,
"packet continues traversal as normal");
return NF_ACCEPT;
}
// 找到连接，该包是服务器的回应包
IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
// skb数据包要求是可写的
if (!ip_vs_make_skb_writable(pskb, ihl))
goto drop;
/* mangle the packet */
// 修改协议部分信息，如TCP、UDP的端口
if (pp->snat_handler && !pp->snat_handler(pskb, pp, cp))
goto drop;
// 修改源地址, 由于是服务器的返回包，只修改源地址
skb = *pskb;
skb->nh.iph->saddr = cp->vaddr;
ip_send_check(skb->nh.iph);
IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
// IPVS输出统计
ip_vs_out_stats(cp, skb);
ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
ip_vs_conn_put(cp);
// 对该包设置标志表示IPVS处理过了
skb->ipvs_property = 1;
LeaveFunction(11);
return NF_ACCEPT;
drop:
ip_vs_conn_put(cp);
kfree_skb(*pskb);
return NF_STOLEN;
}
4.5.3 ip_vs_post_routing_ops
/* Before the netfilter connection tracking, exit from POST_ROUTING */
static struct nf_hook_ops ip_vs_post_routing_ops = {
.hook = ip_vs_post_routing,
.owner = THIS_MODULE,
.pf = PF_INET,
// POSTROUTING点
.hooknum = NF_IP_POST_ROUTING,
// 在源NAT之前进行
.priority = NF_IP_PRI_NAT_SRC-1,
};
ip_vs_post_routing()这个函数对最后要发出的包进行检查，这个包是经过FORWARD链的，源地址已经被IPVS修改过了，不用再被netfilter进行修改。如果是IPVS处理过的包,直接跳出POSTROUTING点, 不再继续可能的该点的更低优先级的hook点操作，即不用进行netfilter标准的SNAT操作。
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* It is hooked before NF_IP_PRI_NAT_SRC at the NF_IP_POST_ROUTING
* chain, and is used for VS/NAT.
* It detects packets for VS/NAT connections and sends the packets
* immediately. This can avoid that iptable_nat mangles the packets
* for VS/NAT.
*/
static unsigned int ip_vs_post_routing(unsigned int hooknum,
struct sk_buff **pskb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
// 如果没被IPVS处理过，继续后续hook点操作
if (!((*pskb)->ipvs_property))
return NF_ACCEPT;
/* The packet was sent from IPVS, exit this chain */
// NF_STOP和NF_ACCEPT的区别就是STOP就不继续后面的低优先级的hook_ops的操作了
return NF_STOP;
}
4.5.4 ip_vs_forward_icmp_ops
/* After packet filtering (but before ip_vs_out_icmp), catch icmp
destined for 0.0.0.0/0, which is for incoming IPVS connections */
static struct nf_hook_ops ip_vs_forward_icmp_ops = {
.hook = ip_vs_forward_icmp,
.owner = THIS_MODULE,
.pf = PF_INET,
// FORWARD点
.hooknum = NF_IP_FORWARD,
// 在ip_vs_out_ops之前进行
.priority = 99,
};
ip_vs_forward_icmp()这个函数对转发的ICMP包进行处理, 处理由于服务器失效而引起的网络或端口不可达的ICMP信息,其他和服务器无关的ICMP信息不处理
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* It is hooked at the NF_IP_FORWARD chain, in order to catch ICMP
* related packets destined for 0.0.0.0/0.
* When fwmark-based virtual service is used, such as transparent
* cache cluster, TCP packets can be marked and routed to ip_vs_in,
* but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
* sent to ip_vs_in_icmp. So, catch them at the NF_IP_FORWARD chain
* and send them to ip_vs_in_icmp.
*/
static unsigned int
ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff **pskb,
const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
int r;
if ((*pskb)->nh.iph->protocol != IPPROTO_ICMP)
return NF_ACCEPT;
// 实际调用ip_vs_in_icmp()来处理数据包
return ip_vs_in_icmp(pskb, &r, hooknum);
}
/*
* Handle ICMP messages in the outside-to-inside direction (incoming).
* Find any that might be relevant, check against existing connections,
* forward to the right destination host if relevant.
* Currently handles error types - unreachable, quench, ttl exceeded.
*/
static int
ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum)
{
struct sk_buff *skb = *pskb;
struct iphdr *iph;
struct icmphdr _icmph, *ic;
struct iphdr _ciph, *cih; /* The ip header contained within the ICMP */
struct ip_vs_conn *cp;
struct ip_vs_protocol *pp;
unsigned int offset, ihl, verdict;
// 这个参数指示该ICMP包是否和IPVS的连接相关
*related = 1;
/* reassemble IP fragments */
if (skb->nh.iph->frag_off & __constant_htons(IP_MF|IP_OFFSET)) {
// 进行碎片重组
skb = ip_vs_gather_frags(skb,
hooknum == NF_IP_LOCAL_IN ?
IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD);
if (!skb)
return NF_STOLEN;
*pskb = skb;
}
iph = skb->nh.iph;
offset = ihl = iph->ihl * 4;
ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
if (ic == NULL)
return NF_DROP;
IP_VS_DBG(12, "Incoming ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
ic->type, ntohs(icmp_id(ic)),
NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
/*
* Work through seeing if this is for us.
* These checks are supposed to be in an order that means easy
* things are checked first to speed up processing.... however
* this means that some packets will manage to get a long way
* down this stack and then be rejected, but that's life.
*/
if ((ic->type != ICMP_DEST_UNREACH) &&
(ic->type != ICMP_SOURCE_QUENCH) &&
(ic->type != ICMP_TIME_EXCEEDED)) {
// 如果不是这三种ICMP信息,则该skb与IPVS无关
*related = 0;
return NF_ACCEPT;
}
/* Now find the contained IP header */
offset += sizeof(_icmph);
cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
if (cih == NULL)
return NF_ACCEPT; /* The packet looks wrong, ignore */
// 找的是ICMP信息中包含的原始包中的协议,而不是ICMP
pp = ip_vs_proto_get(cih->protocol);
if (!pp)
return NF_ACCEPT;
/* Is the embedded protocol header present? */
// 如果是碎片不处理直接返回
if (unlikely(cih->frag_off & __constant_htons(IP_OFFSET) &&
pp->dont_defrag))
return NF_ACCEPT;
IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMP for");
offset += cih->ihl * 4;
/* The embedded headers contain source and dest in reverse order */
// 查找IPVS连接
cp = pp->conn_in_get(skb, pp, cih, offset, 1);
if (!cp)
return NF_ACCEPT;
// 缺省的裁定结果是丢弃包
verdict = NF_DROP;
/* Ensure the checksum is correct */
if (skb->ip_summed != CHECKSUM_UNNECESSARY &&
// 检查一下IP头的校验和
ip_vs_checksum_complete(skb, ihl)) {
/* Failed checksum! */
IP_VS_DBG(1, "Incoming ICMP: failed checksum from %d.%d.%d.%d!\n",
NIPQUAD(iph->saddr));
goto out;
}
/* do the statistics and put it back */
// 进行输入统计
ip_vs_in_stats(cp, skb);
// 如果内部协议是TCP/UDP,发送偏移量要包括前4个字节: 源端口和目的端口
if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
offset += 2 * sizeof(__u16);
// 发送ICMP
verdict = ip_vs_icmp_xmit(skb, cp, pp, offset);
/* do not touch skb anymore */
out:
__ip_vs_conn_put(cp);
return verdict;
}
/* net/ipv4/ipvs/ip_vs_xmit.c */
/*
* ICMP packet transmitter
* called by the ip_vs_in_icmp
*/
int
ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
struct ip_vs_protocol *pp, int offset)
{
struct rtable *rt; /* Route to the other host */
int mtu;
int rc;
EnterFunction(10);
/* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
forwarded directly here, because there is no need to
translate address/port back */
if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
// 如果不是NAT情况的IPVS连接, 即是TUNNEL或DR，直接调用连接的发送函数发送
if (cp->packet_xmit)
rc = cp->packet_xmit(skb, cp, pp);
else
rc = NF_ACCEPT;
/* do not touch skb anymore */
atomic_inc(&cp->in_pkts);
goto out;
}
/*
* mangle and send the packet here (only for VS/NAT)
*/
// 查找路由
if (!(rt = __ip_vs_get_out_rt(cp, RT_TOS(skb->nh.iph->tos))))
goto tx_error_icmp;
/* MTU checking */
mtu = dst_mtu(&rt->u.dst);
if ((skb->len > mtu) && (skb->nh.iph->frag_off&__constant_htons(IP_DF))) {
// 数据包过长超过MTU,但又是不允许分片的,发送ICMP出错包
ip_rt_put(rt);
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
IP_VS_DBG_RL("ip_vs_in_icmp(): frag needed\n");
goto tx_error;
}
/* copy-on-write the packet before mangling it */
// 让skb可写
if (!ip_vs_make_skb_writable(&skb, offset))
goto tx_error_put;
// skb留出足够的硬件头空间
if (skb_cow(skb, rt->u.dst.dev->hard_header_len))
goto tx_error_put;
/* drop the old route when skb is not shared */
dst_release(skb->dst);
skb->dst = &rt->u.dst;
// 修改ICMP包
ip_vs_nat_icmp(skb, pp, cp, 0);
/* Another hack: avoid icmp_send in ip_fragment */
skb->local_df = 1;
// 将该包用OUTPUT点的hook_ops进行处理
IP_VS_XMIT(skb, rt);
// NF_STOLEN表示该skb不用返回到正常的IP栈了
rc = NF_STOLEN;
goto out;
tx_error_icmp:
dst_link_failure(skb);
tx_error:
dev_kfree_skb(skb);
rc = NF_STOLEN;
out:
LeaveFunction(10);
return rc;
tx_error_put:
ip_rt_put(rt);
goto tx_error;
}
msn: yfydz_no1@hotmail.com
来源：http://yfydz.cublog.cn
4. 模块初始化
初始化函数先初始化ipvs的各种处理机制，然后将ipvs的处理函数挂接到netfilter架构中。
/* net/ipv4/ipvs/ip_vs_core.c */
static int __init ip_vs_init(void)
{
int ret;
// ioctl初始化
ret = ip_vs_control_init();
if (ret < 0) {
IP_VS_ERR("can't setup control.\n");
goto cleanup_nothing;
}
// 协议初始化
ip_vs_protocol_init();
// 应用层辅助协议初始化
ret = ip_vs_app_init();
if (ret < 0) {
IP_VS_ERR("can't setup application helper.\n");
goto cleanup_protocol;
}
// ipvs连接初始化
ret = ip_vs_conn_init();
if (ret < 0) {
IP_VS_ERR("can't setup connection table.\n");
goto cleanup_app;
}
// 下面分别挂接各个处理点到netfilter架构中
ret = nf_register_hook(&ip_vs_in_ops);
if (ret < 0) {
IP_VS_ERR("can't register in hook.\n");
goto cleanup_conn;
}
ret = nf_register_hook(&ip_vs_out_ops);
if (ret < 0) {
IP_VS_ERR("can't register out hook.\n");
goto cleanup_inops;
}
ret = nf_register_hook(&ip_vs_post_routing_ops);
if (ret < 0) {
IP_VS_ERR("can't register post_routing hook.\n");
goto cleanup_outops;
}
ret = nf_register_hook(&ip_vs_forward_icmp_ops);
if (ret < 0) {
IP_VS_ERR("can't register forward_icmp hook.\n");
goto cleanup_postroutingops;
}
IP_VS_INFO("ipvs loaded.\n");
return ret;
// 以下是如果初始化出现失败时依次进行释放
cleanup_postroutingops:
nf_unregister_hook(&ip_vs_post_routing_ops);
cleanup_outops:
nf_unregister_hook(&ip_vs_out_ops);
cleanup_inops:
nf_unregister_hook(&ip_vs_in_ops);
cleanup_conn:
ip_vs_conn_cleanup();
cleanup_app:
ip_vs_app_cleanup();
cleanup_protocol:
ip_vs_protocol_cleanup();
ip_vs_control_cleanup();
cleanup_nothing:
return ret;
}
4.1 ip_vs_control_init
/* net/ipv4/ipvs/ip_vs_ctl.c */
int ip_vs_control_init(void)
{
int ret;
int idx;
EnterFunction(2);
// 登记ipvs的sockopt控制,这样用户空间可通过setsockopt函数来和ipvs进行通信
ret = nf_register_sockopt(&ip_vs_sockopts);
if (ret) {
IP_VS_ERR("cannot register sockopt.\n");
return ret;
}
// 建立/proc/net/ip_vs和/proc/net/ip_vs_stats只读项
proc_net_fops_create("ip_vs", 0, &ip_vs_info_fops);
proc_net_fops_create("ip_vs_stats",0, &ip_vs_stats_fops);
// 建立/proc/sys/net/ipv4/vs目录下的各可读写控制参数
sysctl_header = register_sysctl_table(vs_root_table, 0);
// 初始化各种双向链表
// svc_table是根据协议地址端口等信息进行服务结构struct ip_vs_service查找的HASH表
// svc_fwm_table是根据数据包的nfmark信息进行服务结构struct ip_vs_service查找的HASH表
/* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */
for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
}
// rtable是目的结构struct ip_vs_dest的HASH链表
for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++) {
INIT_LIST_HEAD(&ip_vs_rtable[idx]);
}
// ipvs统计信息
memset(&ip_vs_stats, 0, sizeof(ip_vs_stats));
// 统计锁
spin_lock_init(&ip_vs_stats.lock);
// 对当前统计信息建立一个预估器,可用于计算服务器的性能参数
ip_vs_new_estimator(&ip_vs_stats);
/* Hook the defense timer */
// 挂一个定时操作，根据系统当前负载情况定时调整系统参数
schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
LeaveFunction(2);
return 0;
}
4.2 ip_vs_protocol_init
/* net/ipv4/ipvs/ip_vs_proto.c */
int ip_vs_protocol_init(void)
{
// 挂接ipvs能进行均衡处理的各种协议,目前支持TCP/UDP/AH/ESP
// 最好还要增加GRE,在PPTP服务器中使用
char protocols[64];
#define REGISTER_PROTOCOL(p) \
do { \
register_ip_vs_protocol(p); \
strcat(protocols, ", "); \
strcat(protocols, (p)->name); \
} while (0)
// 0,1字符是给", "预留的
protocols[0] = '\0';
protocols[2] = '\0';
// 登记各种协议
#ifdef CONFIG_IP_VS_PROTO_TCP
REGISTER_PROTOCOL(&ip_vs_protocol_tcp);
#endif
#ifdef CONFIG_IP_VS_PROTO_UDP
REGISTER_PROTOCOL(&ip_vs_protocol_udp);
#endif
#ifdef CONFIG_IP_VS_PROTO_AH
REGISTER_PROTOCOL(&ip_vs_protocol_ah);
#endif
#ifdef CONFIG_IP_VS_PROTO_ESP
REGISTER_PROTOCOL(&ip_vs_protocol_esp);
#endif
// 第0,1字符分别为逗号','和空格' ',从第2字符起才是真正数据串
IP_VS_INFO("Registered protocols (%s)\n", &protocols[2]);
return 0;
}
register_ip_vs_protocol()函数就是把ip_vs_protocol结构挂接到协议HASH表中，不过其实没几个协议，没必要用HASH，直接数组就行了，Linux内核中缺省好象也只支持32种IP协议。
/*
* register an ipvs protocol
*/
static int register_ip_vs_protocol(struct ip_vs_protocol *pp)
{
unsigned hash = IP_VS_PROTO_HASH(pp->protocol);
// 把新协议节点挂接到HASH链表头
pp->next = ip_vs_proto_table[hash];
ip_vs_proto_table[hash] = pp;
// 调用该协议的初始化函数
if (pp->init != NULL)
pp->init(pp);
return 0;
}
4.3 ip_vs_app_init
IPVS应用初始化
/* net/ipv4/ipvs/ip_vs_app.c */
int ip_vs_app_init(void)
{
/* we will replace it with proc_net_ipvs_create() soon */
// 该函数就是建立一个/proc/net/ip_vs_app项
proc_net_fops_create("ip_vs_app", 0, &ip_vs_app_fops);
return 0;
}
4.4 ip_vs_conn_init
IPVS连接初始化
/* net/ipv4/ipvs/ip_vs_conn.c */
int ip_vs_conn_init(void)
{
int idx;
/*
* Allocate the connection hash table and initialize its list heads
*/
// ipvs连接HASH表
ip_vs_conn_tab = vmalloc(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head));
if (!ip_vs_conn_tab)
return -ENOMEM;
/* Allocate ip_vs_conn slab cache */
// ipvs连接cache,由于使用cache在内存块释放时并不真正释放，而是cache起来，
// 因此重新分配时速度更快
ip_vs_conn_cachep = kmem_cache_create("ip_vs_conn",
sizeof(struct ip_vs_conn), 0,
SLAB_HWCACHE_ALIGN, NULL, NULL);
if (!ip_vs_conn_cachep) {
vfree(ip_vs_conn_tab);
return -ENOMEM;
}
IP_VS_INFO("Connection hash table configured "
"(size=%d, memory=%ldKbytes)\n",
IP_VS_CONN_TAB_SIZE,
(long)(IP_VS_CONN_TAB_SIZE*sizeof(struct list_head))/1024);
IP_VS_DBG(0, "Each connection entry needs %Zd bytes at least\n",
sizeof(struct ip_vs_conn));
// 初始化各HASH链表头
for (idx = 0; idx < IP_VS_CONN_TAB_SIZE; idx++) {
INIT_LIST_HEAD(&ip_vs_conn_tab[idx]);
}
// 初始化各读写锁
for (idx = 0; idx < CT_LOCKARRAY_SIZE; idx++) {
rwlock_init(&__ip_vs_conntbl_lock_array[idx].l);
}
// 建立/proc/net/ip_vs_conn项
proc_net_fops_create("ip_vs_conn", 0, &ip_vs_conn_fops);
/* calculate the random value for connection hash */
// 初始随机数
get_random_bytes(&ip_vs_conn_rnd, sizeof(ip_vs_conn_rnd));
return 0;
}
4.5 netfilter挂接点
nf_hook_ops分别在FORWARD点挂2个, INPUT点和POST_ROUTING点各挂一个
/* net/ipv4/ipvs/ip_vs_core.c */
4.5.1 ip_vs_in_ops
/* After packet filtering, forward packet through VS/DR, VS/TUN,
or VS/NAT(change destination), so that filtering rules can be
applied to IPVS. */
static struct nf_hook_ops ip_vs_in_ops = {
.hook = ip_vs_in,
.owner = THIS_MODULE,
.pf = PF_INET,
// INPUT点
.hooknum = NF_IP_LOCAL_IN,
// 此优先级低于filter
.priority = 100,
};
ip_vs_in()这个函数对进入本机的包进行处理.
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* Check if it's for virtual services, look it up,
* and send it on its way...
*/
static unsigned int
ip_vs_in(unsigned int hooknum, struct sk_buff **pskb,
const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct sk_buff *skb = *pskb;
struct iphdr *iph;
struct ip_vs_protocol *pp;
struct ip_vs_conn *cp;
int ret, restart;
int ihl;
/*
* Big tappo: only PACKET_HOST (neither loopback nor mcasts)
* ... don't know why 1st test DOES NOT include 2nd (?)
*/
if (unlikely(skb->pkt_type != PACKET_HOST
|| skb->dev == &loopback_dev || skb->sk)) {
// input不处理目的非本机的包
IP_VS_DBG(12, "packet type=%d proto=%d daddr=%d.%d.%d.%d ignored\n",
skb->pkt_type,
skb->nh.iph->protocol,
NIPQUAD(skb->nh.iph->daddr));
return NF_ACCEPT;
}
iph = skb->nh.iph;
if (unlikely(iph->protocol == IPPROTO_ICMP)) {
// 如果是ICMP，可能是指示连接错误的ICMP信息，调用ip_vs_in_icmp进行检查
// 是否是相关的ICMP信息
int related, verdict = ip_vs_in_icmp(pskb, &related, hooknum);
if (related)
return verdict;
// 非相关ICMP，恢复处理流程
// 但其实ipvs是不均衡ICMP信息的，后面就返回了
skb = *pskb;
iph = skb->nh.iph;
}
/* Protocol supported? */
// 获取协议支持模块，由于只支持TCP、UDP、AH和ESP，如果是ICMP，返回为NULL
pp = ip_vs_proto_get(iph->protocol);
if (unlikely(!pp))
return NF_ACCEPT;
ihl = iph->ihl << 2;
/*
* Check if the packet belongs to an existing connection entry
*/
// 找到和该skb相关的ipvs连接，类似netfilter的根据tuple查找连接，
// 不过sk_buff结构中没有增加nfct那样能直接指向连接的成员
// 对TCP协议来说是tcp_conn_in_get()
cp = pp->conn_in_get(skb, pp, iph, ihl, 0);
if (unlikely(!cp)) {
int v;
// 如果没有连接, 表明是新连接, 调用IPVS连接的conn_schedule调度连接分配和处理
// 连接调度要根据调度算法选择一个真实目的服务器，然后建立新的IPVS连接
// 对TCP协议来说是tcp_conn_schedule()
if (!pp->conn_schedule(skb, pp, &v, &cp))
return v;
}
if (unlikely(!cp)) {
// 这种情况主要是没内存空间了，IPVS没提供主动删除连接的机制
/* sorry, all this trouble for a no-hit :) */
IP_VS_DBG_PKT(12, pp, skb, 0,
"packet continues traversal as normal");
return NF_ACCEPT;
}
IP_VS_DBG_PKT(11, pp, skb, 0, "Incoming packet");
/* Check the server status */
if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
/* the destination server is not available */
// 对于目的服务器失效的包丢弃
if (sysctl_ip_vs_expire_nodest_conn) {
/* try to expire the connection immediately */
ip_vs_conn_expire_now(cp);
}
/* don't restart its timer, and silently
drop the packet. */
__ip_vs_conn_put(cp);
return NF_DROP;
}
// 连接信息统计
ip_vs_in_stats(cp, skb);
// 进行连接状态的迁移, restart这个参数其实没用
// 对TCP协议来说是调用tcp_state_transition
restart = ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pp);
if (cp->packet_xmit)
// 将包发送出去, 具体xmit的实现在ip_vs_xmit.c中实现,
// NAT模式下为 ip_vs_nat_xmit;
// 通道模式下为 ip_vs_tunnel_xmit;
// 直接路由模式下为: ip_vs_dr_xmit;
// 本机数据为: ip_vs_null_xmit;
// 旁路模式下为: ip_vs_bypass_xmit;
// 函数成功时基本都返回NF_STOLEN使netfilter不再处理该包
// 所以对于NAT模式，应该是不需要配置DNAT规则的，请求方向数据也不经过FORWARD链
ret = cp->packet_xmit(skb, cp, pp);
/* do not touch skb anymore */
else {
IP_VS_DBG_RL("warning: packet_xmit is null");
ret = NF_ACCEPT;
}
/* increase its packet counter and check if it is needed
to be synchronized */
atomic_inc(&cp->in_pkts);
// 在进行均衡器热备时将连接信息要从MASTER传递到SLAVE，使系统切换时
// 连接不丢弃，但还是要有一定条件才进行同步
if ((ip_vs_sync_state & IP_VS_STATE_MASTER) &&
// 同步状态类型为主机
(cp->protocol != IPPROTO_TCP ||
cp->state == IP_VS_TCP_S_ESTABLISHED) &&
// 非TCP连接或是已经建立的连接
(atomic_read(&cp->in_pkts) % sysctl_ip_vs_sync_threshold[1]
== sysctl_ip_vs_sync_threshold[0]))
// 当前连接的包数为N*thres[1]+thres[0]时
// 进行连接的同步
ip_vs_sync_conn(cp);
// 调整连接超时,释放连接计数
ip_vs_conn_put(cp);
return ret;
}
4.5.2 ip_vs_out_ops
/* After packet filtering, change source only for VS/NAT */
static struct nf_hook_ops ip_vs_out_ops = {
.hook = ip_vs_out,
.owner = THIS_MODULE,
.pf = PF_INET,
// FORWARD点
.hooknum = NF_IP_FORWARD,
// 此优先级低于filter
.priority = 100,
};
ip_vs_out()这个函数对转发包进行处理, 只用在NAT模式的均衡处理，TUNNEL和DR方式下都是直接发送了，实际处理的只是服务器返回的回应包，而客户端请求的包是不经过这里的，但如果设置了DNAT规则，数据包在PREROUTING点进行了目的地址修改，这样就不会再进入INPUT点而是直接转到FORWARD点处理，这时时针对该包的IPVS连接是没有建立的。
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* It is hooked at the NF_IP_FORWARD chain, used only for VS/NAT.
* Check if outgoing packet belongs to the established ip_vs_conn,
* rewrite addresses of the packet and send it on its way...
*/
static unsigned int
ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct sk_buff *skb = *pskb;
struct iphdr *iph;
struct ip_vs_protocol *pp;
struct ip_vs_conn *cp;
int ihl;
EnterFunction(11);
// 这个标志只占一位
// 标志设上就是已经经过IPVS处理了，直接返回
if (skb->ipvs_property)
return NF_ACCEPT;
iph = skb->nh.iph;
if (unlikely(iph->protocol == IPPROTO_ICMP)) {
// 处理可能的连接相关ICMP错误信息,如地址端口不可达等
int related, verdict = ip_vs_out_icmp(pskb, &related);
if (related)
return verdict;
skb = *pskb;
iph = skb->nh.iph;
}
// 取得IPVS协议, tcp/udp/ah/esp之一
pp = ip_vs_proto_get(iph->protocol);
if (unlikely(!pp))
return NF_ACCEPT;
/* reassemble IP fragments */
if (unlikely(iph->frag_off & __constant_htons(IP_MF|IP_OFFSET) &&
!pp->dont_defrag)) {
// 如果是碎片包进行重组,基本不可能,因为数据包进入netfilter时就要进行碎片重组
skb = ip_vs_gather_frags(skb, IP_DEFRAG_VS_OUT);
if (!skb)
return NF_STOLEN;
iph = skb->nh.iph;
*pskb = skb;
}
ihl = iph->ihl << 2;
/*
* Check if the packet belongs to an existing entry
*/
// 查找IPVS连接
cp = pp->conn_out_get(skb, pp, iph, ihl, 0);
if (unlikely(!cp)) {
// 没找到IPVS连接,可能是请求方向的包经过DNAT过来的
if (sysctl_ip_vs_nat_icmp_send &&
(pp->protocol == IPPROTO_TCP ||
pp->protocol == IPPROTO_UDP)) {
__u16 _ports[2], *pptr;
pptr = skb_header_pointer(skb, ihl,
sizeof(_ports), _ports);
if (pptr == NULL)
return NF_ACCEPT; /* Not for me */
// 用源地址，源端口来查真实服务器结构，如果是请求方向是找不到的
// 这种情况下数据包就不再被IPVS处理
if (ip_vs_lookup_real_service(iph->protocol,
iph->saddr, pptr[0])) {
/*
* Notify the real server: there is no
* existing entry if it is not RST
* packet or not TCP packet.
*/
if (iph->protocol != IPPROTO_TCP
|| !is_tcp_reset(skb)) {
icmp_send(skb,ICMP_DEST_UNREACH,
ICMP_PORT_UNREACH, 0);
return NF_DROP;
}
}
}
IP_VS_DBG_PKT(12, pp, skb, 0,
"packet continues traversal as normal");
return NF_ACCEPT;
}
// 找到连接，该包是服务器的回应包
IP_VS_DBG_PKT(11, pp, skb, 0, "Outgoing packet");
// skb数据包要求是可写的
if (!ip_vs_make_skb_writable(pskb, ihl))
goto drop;
/* mangle the packet */
// 修改协议部分信息，如TCP、UDP的端口
if (pp->snat_handler && !pp->snat_handler(pskb, pp, cp))
goto drop;
// 修改源地址, 由于是服务器的返回包，只修改源地址
skb = *pskb;
skb->nh.iph->saddr = cp->vaddr;
ip_send_check(skb->nh.iph);
IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
// IPVS输出统计
ip_vs_out_stats(cp, skb);
ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
ip_vs_conn_put(cp);
// 对该包设置标志表示IPVS处理过了
skb->ipvs_property = 1;
LeaveFunction(11);
return NF_ACCEPT;
drop:
ip_vs_conn_put(cp);
kfree_skb(*pskb);
return NF_STOLEN;
}
4.5.3 ip_vs_post_routing_ops
/* Before the netfilter connection tracking, exit from POST_ROUTING */
static struct nf_hook_ops ip_vs_post_routing_ops = {
.hook = ip_vs_post_routing,
.owner = THIS_MODULE,
.pf = PF_INET,
// POSTROUTING点
.hooknum = NF_IP_POST_ROUTING,
// 在源NAT之前进行
.priority = NF_IP_PRI_NAT_SRC-1,
};
ip_vs_post_routing()这个函数对最后要发出的包进行检查，这个包是经过FORWARD链的，源地址已经被IPVS修改过了，不用再被netfilter进行修改。如果是IPVS处理过的包,直接跳出POSTROUTING点, 不再继续可能的该点的更低优先级的hook点操作，即不用进行netfilter标准的SNAT操作。
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* It is hooked before NF_IP_PRI_NAT_SRC at the NF_IP_POST_ROUTING
* chain, and is used for VS/NAT.
* It detects packets for VS/NAT connections and sends the packets
* immediately. This can avoid that iptable_nat mangles the packets
* for VS/NAT.
*/
static unsigned int ip_vs_post_routing(unsigned int hooknum,
struct sk_buff **pskb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
// 如果没被IPVS处理过，继续后续hook点操作
if (!((*pskb)->ipvs_property))
return NF_ACCEPT;
/* The packet was sent from IPVS, exit this chain */
// NF_STOP和NF_ACCEPT的区别就是STOP就不继续后面的低优先级的hook_ops的操作了
return NF_STOP;
}
4.5.4 ip_vs_forward_icmp_ops
/* After packet filtering (but before ip_vs_out_icmp), catch icmp
destined for 0.0.0.0/0, which is for incoming IPVS connections */
static struct nf_hook_ops ip_vs_forward_icmp_ops = {
.hook = ip_vs_forward_icmp,
.owner = THIS_MODULE,
.pf = PF_INET,
// FORWARD点
.hooknum = NF_IP_FORWARD,
// 在ip_vs_out_ops之前进行
.priority = 99,
};
ip_vs_forward_icmp()这个函数对转发的ICMP包进行处理, 处理由于服务器失效而引起的网络或端口不可达的ICMP信息,其他和服务器无关的ICMP信息不处理
/* net/ipv4/ipvs/ip_vs_core.c */
/*
* It is hooked at the NF_IP_FORWARD chain, in order to catch ICMP
* related packets destined for 0.0.0.0/0.
* When fwmark-based virtual service is used, such as transparent
* cache cluster, TCP packets can be marked and routed to ip_vs_in,
* but ICMP destined for 0.0.0.0/0 cannot not be easily marked and
* sent to ip_vs_in_icmp. So, catch them at the NF_IP_FORWARD chain
* and send them to ip_vs_in_icmp.
*/
static unsigned int
ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff **pskb,
const struct net_device *in, const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
int r;
if ((*pskb)->nh.iph->protocol != IPPROTO_ICMP)
return NF_ACCEPT;
// 实际调用ip_vs_in_icmp()来处理数据包
return ip_vs_in_icmp(pskb, &r, hooknum);
}
/*
* Handle ICMP messages in the outside-to-inside direction (incoming).
* Find any that might be relevant, check against existing connections,
* forward to the right destination host if relevant.
* Currently handles error types - unreachable, quench, ttl exceeded.
*/
static int
ip_vs_in_icmp(struct sk_buff **pskb, int *related, unsigned int hooknum)
{
struct sk_buff *skb = *pskb;
struct iphdr *iph;
struct icmphdr _icmph, *ic;
struct iphdr _ciph, *cih; /* The ip header contained within the ICMP */
struct ip_vs_conn *cp;
struct ip_vs_protocol *pp;
unsigned int offset, ihl, verdict;
// 这个参数指示该ICMP包是否和IPVS的连接相关
*related = 1;
/* reassemble IP fragments */
if (skb->nh.iph->frag_off & __constant_htons(IP_MF|IP_OFFSET)) {
// 进行碎片重组
skb = ip_vs_gather_frags(skb,
hooknum == NF_IP_LOCAL_IN ?
IP_DEFRAG_VS_IN : IP_DEFRAG_VS_FWD);
if (!skb)
return NF_STOLEN;
*pskb = skb;
}
iph = skb->nh.iph;
offset = ihl = iph->ihl * 4;
ic = skb_header_pointer(skb, offset, sizeof(_icmph), &_icmph);
if (ic == NULL)
return NF_DROP;
IP_VS_DBG(12, "Incoming ICMP (%d,%d) %u.%u.%u.%u->%u.%u.%u.%u\n",
ic->type, ntohs(icmp_id(ic)),
NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
/*
* Work through seeing if this is for us.
* These checks are supposed to be in an order that means easy
* things are checked first to speed up processing.... however
* this means that some packets will manage to get a long way
* down this stack and then be rejected, but that's life.
*/
if ((ic->type != ICMP_DEST_UNREACH) &&
(ic->type != ICMP_SOURCE_QUENCH) &&
(ic->type != ICMP_TIME_EXCEEDED)) {
// 如果不是这三种ICMP信息,则该skb与IPVS无关
*related = 0;
return NF_ACCEPT;
}
/* Now find the contained IP header */
offset += sizeof(_icmph);
cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
if (cih == NULL)
return NF_ACCEPT; /* The packet looks wrong, ignore */
// 找的是ICMP信息中包含的原始包中的协议,而不是ICMP
pp = ip_vs_proto_get(cih->protocol);
if (!pp)
return NF_ACCEPT;
/* Is the embedded protocol header present? */
// 如果是碎片不处理直接返回
if (unlikely(cih->frag_off & __constant_htons(IP_OFFSET) &&
pp->dont_defrag))
return NF_ACCEPT;
IP_VS_DBG_PKT(11, pp, skb, offset, "Checking incoming ICMP for");
offset += cih->ihl * 4;
/* The embedded headers contain source and dest in reverse order */
// 查找IPVS连接
cp = pp->conn_in_get(skb, pp, cih, offset, 1);
if (!cp)
return NF_ACCEPT;
// 缺省的裁定结果是丢弃包
verdict = NF_DROP;
/* Ensure the checksum is correct */
if (skb->ip_summed != CHECKSUM_UNNECESSARY &&
// 检查一下IP头的校验和
ip_vs_checksum_complete(skb, ihl)) {
/* Failed checksum! */
IP_VS_DBG(1, "Incoming ICMP: failed checksum from %d.%d.%d.%d!\n",
NIPQUAD(iph->saddr));
goto out;
}
/* do the statistics and put it back */
// 进行输入统计
ip_vs_in_stats(cp, skb);
// 如果内部协议是TCP/UDP,发送偏移量要包括前4个字节: 源端口和目的端口
if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
offset += 2 * sizeof(__u16);
// 发送ICMP
verdict = ip_vs_icmp_xmit(skb, cp, pp, offset);
/* do not touch skb anymore */
out:
__ip_vs_conn_put(cp);
return verdict;
}
/* net/ipv4/ipvs/ip_vs_xmit.c */
/*
* ICMP packet transmitter
* called by the ip_vs_in_icmp
*/
int
ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
struct ip_vs_protocol *pp, int offset)
{
struct rtable *rt; /* Route to the other host */
int mtu;
int rc;
EnterFunction(10);
/* The ICMP packet for VS/TUN, VS/DR and LOCALNODE will be
forwarded directly here, because there is no need to
translate address/port back */
if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
// 如果不是NAT情况的IPVS连接, 即是TUNNEL或DR，直接调用连接的发送函数发送
if (cp->packet_xmit)
rc = cp->packet_xmit(skb, cp, pp);
else
rc = NF_ACCEPT;
/* do not touch skb anymore */
atomic_inc(&cp->in_pkts);
goto out;
}
/*
* mangle and send the packet here (only for VS/NAT)
*/
// 查找路由
if (!(rt = __ip_vs_get_out_rt(cp, RT_TOS(skb->nh.iph->tos))))
goto tx_error_icmp;
/* MTU checking */
mtu = dst_mtu(&rt->u.dst);
if ((skb->len > mtu) && (skb->nh.iph->frag_off&__constant_htons(IP_DF))) {
// 数据包过长超过MTU,但又是不允许分片的,发送ICMP出错包
ip_rt_put(rt);
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
IP_VS_DBG_RL("ip_vs_in_icmp(): frag needed\n");
goto tx_error;
}
/* copy-on-write the packet before mangling it */
// 让skb可写
if (!ip_vs_make_skb_writable(&skb, offset))
goto tx_error_put;
// skb留出足够的硬件头空间
if (skb_cow(skb, rt->u.dst.dev->hard_header_len))
goto tx_error_put;
/* drop the old route when skb is not shared */
dst_release(skb->dst);
skb->dst = &rt->u.dst;
// 修改ICMP包
ip_vs_nat_icmp(skb, pp, cp, 0);
/* Another hack: avoid icmp_send in ip_fragment */
skb->local_df = 1;
// 将该包用OUTPUT点的hook_ops进行处理
IP_VS_XMIT(skb, rt);
// NF_STOLEN表示该skb不用返回到正常的IP栈了
rc = NF_STOLEN;
goto out;
tx_error_icmp:
dst_link_failure(skb);
tx_error:
dev_kfree_skb(skb);
rc = NF_STOLEN;
out:
LeaveFunction(10);
return rc;
tx_error_put:
ip_rt_put(rt);
goto tx_error;
}
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 