[linux-block.git] / net / netfilter / ipvs / ip_vs_proto_udp.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * ip_vs_proto_udp.c:	UDP load balancing support for IPVS
 *
 * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
 *              Julian Anastasov <ja@ssi.bg>
 *
 * Changes:     Hans Schillstrom <hans.schillstrom@ericsson.com>
 *              Network name space (netns) aware.
 */

#define KMSG_COMPONENT "IPVS"
#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt

#include <linux/in.h>
#include <linux/ip.h>
#include <linux/kernel.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/udp.h>
#include <linux/indirect_call_wrapper.h>

#include <net/ip_vs.h>
#include <net/ip.h>
#include <net/ip6_checksum.h>

static int
udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp);

static int
udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
		  struct ip_vs_proto_data *pd,
		  int *verdict, struct ip_vs_conn **cpp,
		  struct ip_vs_iphdr *iph)
{
	struct ip_vs_service *svc;
	struct udphdr _udph, *uh;
	__be16 _ports[2], *ports = NULL;

	if (likely(!ip_vs_iph_icmp(iph))) {
		/* IPv6 fragments, only first fragment will hit this */
		uh = skb_header_pointer(skb, iph->len, sizeof(_udph), &_udph);
		if (uh)
			ports = &uh->source;
	} else {
		ports = skb_header_pointer(
			skb, iph->len, sizeof(_ports), &_ports);
	}

	if (!ports) {
		*verdict = NF_DROP;
		return 0;
	}

	if (likely(!ip_vs_iph_inverse(iph)))
		svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
					 &iph->daddr, ports[1]);
	else
		svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
					 &iph->saddr, ports[0]);

	if (svc) {
		int ignored;

		if (ip_vs_todrop(ipvs)) {
			/*
			 * It seems that we are very loaded.
			 * We have to drop this packet :(
			 */
			*verdict = NF_DROP;
			return 0;
		}

		/*
		 * Let the virtual server select a real server for the
		 * incoming connection, and create a connection entry.
		 */
		*cpp = ip_vs_schedule(svc, skb, pd, &ignored, iph);
		if (!*cpp && ignored <= 0) {
			if (!ignored)
				*verdict = ip_vs_leave(svc, skb, pd, iph);
			else
				*verdict = NF_DROP;
			return 0;
		}
	}
	/* NF_ACCEPT */
	return 1;
}


static inline void
udp_fast_csum_update(int af, struct udphdr *uhdr,
		     const union nf_inet_addr *oldip,
		     const union nf_inet_addr *newip,
		     __be16 oldport, __be16 newport)
{
#ifdef CONFIG_IP_VS_IPV6
	if (af == AF_INET6)
		uhdr->check =
			csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
					 ip_vs_check_diff2(oldport, newport,
						~csum_unfold(uhdr->check))));
	else
#endif
		uhdr->check =
			csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
					 ip_vs_check_diff2(oldport, newport,
						~csum_unfold(uhdr->check))));
	if (!uhdr->check)
		uhdr->check = CSUM_MANGLED_0;
}

static inline void
udp_partial_csum_update(int af, struct udphdr *uhdr,
		     const union nf_inet_addr *oldip,
		     const union nf_inet_addr *newip,
		     __be16 oldlen, __be16 newlen)
{
#ifdef CONFIG_IP_VS_IPV6
	if (af == AF_INET6)
		uhdr->check =
			~csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
					 ip_vs_check_diff2(oldlen, newlen,
						csum_unfold(uhdr->check))));
	else
#endif
	uhdr->check =
		~csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
				ip_vs_check_diff2(oldlen, newlen,
						csum_unfold(uhdr->check))));
}


INDIRECT_CALLABLE_SCOPE int
udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
		 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
{
	struct udphdr *udph;
	unsigned int udphoff = iph->len;
	bool payload_csum = false;
	int oldlen;

#ifdef CONFIG_IP_VS_IPV6
	if (cp->af == AF_INET6 && iph->fragoffs)
		return 1;
#endif
	oldlen = skb->len - udphoff;

	/* csum_check requires unshared skb */
	if (skb_ensure_writable(skb, udphoff + sizeof(*udph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		int ret;

		/* Some checks before mangling */
		if (!udp_csum_check(cp->af, skb, pp))
			return 0;

		/*
		 *	Call application helper if needed
		 */
		if (!(ret = ip_vs_app_pkt_out(cp, skb, iph)))
			return 0;
		/* ret=2: csum update is needed after payload mangling */
		if (ret == 1)
			oldlen = skb->len - udphoff;
		else
			payload_csum = true;
	}

	udph = (void *)skb_network_header(skb) + udphoff;
	udph->source = cp->vport;

	/*
	 *	Adjust UDP checksums
	 */
	if (skb->ip_summed == CHECKSUM_PARTIAL) {
		udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
					htons(oldlen),
					htons(skb->len - udphoff));
	} else if (!payload_csum && (udph->check != 0)) {
		/* Only port and addr are changed, do fast csum update */
		udp_fast_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
				     cp->dport, cp->vport);
		if (skb->ip_summed == CHECKSUM_COMPLETE)
			skb->ip_summed = cp->app ?
					 CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		udph->check = 0;
		skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
#ifdef CONFIG_IP_VS_IPV6
		if (cp->af == AF_INET6)
			udph->check = csum_ipv6_magic(&cp->vaddr.in6,
						      &cp->caddr.in6,
						      skb->len - udphoff,
						      cp->protocol, skb->csum);
		else
#endif
			udph->check = csum_tcpudp_magic(cp->vaddr.ip,
							cp->caddr.ip,
							skb->len - udphoff,
							cp->protocol,
							skb->csum);
		if (udph->check == 0)
			udph->check = CSUM_MANGLED_0;
		skb->ip_summed = CHECKSUM_UNNECESSARY;
		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
			  pp->name, udph->check,
			  (char*)&(udph->check) - (char*)udph);
	}
	return 1;
}


static int
udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
		 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
{
	struct udphdr *udph;
	unsigned int udphoff = iph->len;
	bool payload_csum = false;
	int oldlen;

#ifdef CONFIG_IP_VS_IPV6
	if (cp->af == AF_INET6 && iph->fragoffs)
		return 1;
#endif
	oldlen = skb->len - udphoff;

	/* csum_check requires unshared skb */
	if (skb_ensure_writable(skb, udphoff + sizeof(*udph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		int ret;

		/* Some checks before mangling */
		if (!udp_csum_check(cp->af, skb, pp))
			return 0;

		/*
		 *	Attempt ip_vs_app call.
		 *	It will fix ip_vs_conn
		 */
		if (!(ret = ip_vs_app_pkt_in(cp, skb, iph)))
			return 0;
		/* ret=2: csum update is needed after payload mangling */
		if (ret == 1)
			oldlen = skb->len - udphoff;
		else
			payload_csum = true;
	}

	udph = (void *)skb_network_header(skb) + udphoff;
	udph->dest = cp->dport;

	/*
	 *	Adjust UDP checksums
	 */
	if (skb->ip_summed == CHECKSUM_PARTIAL) {
		udp_partial_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
					htons(oldlen),
					htons(skb->len - udphoff));
	} else if (!payload_csum && (udph->check != 0)) {
		/* Only port and addr are changed, do fast csum update */
		udp_fast_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
				     cp->vport, cp->dport);
		if (skb->ip_summed == CHECKSUM_COMPLETE)
			skb->ip_summed = cp->app ?
					 CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		udph->check = 0;
		skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
#ifdef CONFIG_IP_VS_IPV6
		if (cp->af == AF_INET6)
			udph->check = csum_ipv6_magic(&cp->caddr.in6,
						      &cp->daddr.in6,
						      skb->len - udphoff,
						      cp->protocol, skb->csum);
		else
#endif
			udph->check = csum_tcpudp_magic(cp->caddr.ip,
							cp->daddr.ip,
							skb->len - udphoff,
							cp->protocol,
							skb->csum);
		if (udph->check == 0)
			udph->check = CSUM_MANGLED_0;
		skb->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return 1;
}


static int
udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)
{
	struct udphdr _udph, *uh;
	unsigned int udphoff;

#ifdef CONFIG_IP_VS_IPV6
	if (af == AF_INET6)
		udphoff = sizeof(struct ipv6hdr);
	else
#endif
		udphoff = ip_hdrlen(skb);

	uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph);
	if (uh == NULL)
		return 0;

	if (uh->check != 0) {
		switch (skb->ip_summed) {
		case CHECKSUM_NONE:
			skb->csum = skb_checksum(skb, udphoff,
						 skb->len - udphoff, 0);
			fallthrough;
		case CHECKSUM_COMPLETE:
#ifdef CONFIG_IP_VS_IPV6
			if (af == AF_INET6) {
				if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
						    &ipv6_hdr(skb)->daddr,
						    skb->len - udphoff,
						    ipv6_hdr(skb)->nexthdr,
						    skb->csum)) {
					IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
							 "Failed checksum for");
					return 0;
				}
			} else
#endif
				if (csum_tcpudp_magic(ip_hdr(skb)->saddr,
						      ip_hdr(skb)->daddr,
						      skb->len - udphoff,
						      ip_hdr(skb)->protocol,
						      skb->csum)) {
					IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
							 "Failed checksum for");
					return 0;
				}
			break;
		default:
			/* No need to checksum. */
			break;
		}
	}
	return 1;
}

static inline __u16 udp_app_hashkey(__be16 port)
{
	return (((__force u16)port >> UDP_APP_TAB_BITS) ^ (__force u16)port)
		& UDP_APP_TAB_MASK;
}


static int udp_register_app(struct netns_ipvs *ipvs, struct ip_vs_app *inc)
{
	struct ip_vs_app *i;
	__u16 hash;
	__be16 port = inc->port;
	int ret = 0;
	struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);

	hash = udp_app_hashkey(port);

	list_for_each_entry(i, &ipvs->udp_apps[hash], p_list) {
		if (i->port == port) {
			ret = -EEXIST;
			goto out;
		}
	}
	list_add_rcu(&inc->p_list, &ipvs->udp_apps[hash]);
	atomic_inc(&pd->appcnt);

  out:
	return ret;
}


static void
udp_unregister_app(struct netns_ipvs *ipvs, struct ip_vs_app *inc)
{
	struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);

	atomic_dec(&pd->appcnt);
	list_del_rcu(&inc->p_list);
}


static int udp_app_conn_bind(struct ip_vs_conn *cp)
{
	struct netns_ipvs *ipvs = cp->ipvs;
	int hash;
	struct ip_vs_app *inc;
	int result = 0;

	/* Default binding: bind app only for NAT */
	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
		return 0;

	/* Lookup application incarnations and bind the right one */
	hash = udp_app_hashkey(cp->vport);

	list_for_each_entry_rcu(inc, &ipvs->udp_apps[hash], p_list) {
		if (inc->port == cp->vport) {
			if (unlikely(!ip_vs_app_inc_get(inc)))
				break;

			IP_VS_DBG_BUF(9, "%s(): Binding conn %s:%u->"
				      "%s:%u to app %s on port %u\n",
				      __func__,
				      IP_VS_DBG_ADDR(cp->af, &cp->caddr),
				      ntohs(cp->cport),
				      IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
				      ntohs(cp->vport),
				      inc->name, ntohs(inc->port));

			cp->app = inc;
			if (inc->init_conn)
				result = inc->init_conn(inc, cp);
			break;
		}
	}

	return result;
}


static const int udp_timeouts[IP_VS_UDP_S_LAST+1] = {
	[IP_VS_UDP_S_NORMAL]		=	5*60*HZ,
	[IP_VS_UDP_S_LAST]		=	2*HZ,
};

static const char *const udp_state_name_table[IP_VS_UDP_S_LAST+1] = {
	[IP_VS_UDP_S_NORMAL]		=	"UDP",
	[IP_VS_UDP_S_LAST]		=	"BUG!",
};

static const char * udp_state_name(int state)
{
	if (state >= IP_VS_UDP_S_LAST)
		return "ERR!";
	return udp_state_name_table[state] ? udp_state_name_table[state] : "?";
}

static void
udp_state_transition(struct ip_vs_conn *cp, int direction,
		     const struct sk_buff *skb,
		     struct ip_vs_proto_data *pd)
{
	if (unlikely(!pd)) {
		pr_err("UDP no ns data\n");
		return;
	}

	cp->timeout = pd->timeout_table[IP_VS_UDP_S_NORMAL];
	if (direction == IP_VS_DIR_OUTPUT)
		ip_vs_control_assure_ct(cp);
}

static int __udp_init(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd)
{
	ip_vs_init_hash_table(ipvs->udp_apps, UDP_APP_TAB_SIZE);
	pd->timeout_table = ip_vs_create_timeout_table((int *)udp_timeouts,
							sizeof(udp_timeouts));
	if (!pd->timeout_table)
		return -ENOMEM;
	return 0;
}

static void __udp_exit(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd)
{
	kfree(pd->timeout_table);
}


struct ip_vs_protocol ip_vs_protocol_udp = {
	.name =			"UDP",
	.protocol =		IPPROTO_UDP,
	.num_states =		IP_VS_UDP_S_LAST,
	.dont_defrag =		0,
	.init =			NULL,
	.exit =			NULL,
	.init_netns =		__udp_init,
	.exit_netns =		__udp_exit,
	.conn_schedule =	udp_conn_schedule,
	.conn_in_get =		ip_vs_conn_in_get_proto,
	.conn_out_get =		ip_vs_conn_out_get_proto,
	.snat_handler =		udp_snat_handler,
	.dnat_handler =		udp_dnat_handler,
	.state_transition =	udp_state_transition,
	.state_name =		udp_state_name,
	.register_app =		udp_register_app,
	.unregister_app =	udp_unregister_app,
	.app_conn_bind =	udp_app_conn_bind,
	.debug_packet =		ip_vs_tcpudp_debug_packet,
	.timeout_change =	NULL,
};
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 LT	2	/*
	3	* ip_vs_proto_udp.c: UDP load balancing support for IPVS
	4	*
1da177e4 LT	5	* Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
	6	* Julian Anastasov <ja@ssi.bg>
	7	*
78b16bde HS	8	* Changes: Hans Schillstrom <hans.schillstrom@ericsson.com>
78b16bde HS	9	* Network name space (netns) aware.
1da177e4 LT	10	*/
1da177e4 LT	11
9aada7ac HE	12	#define KMSG_COMPONENT "IPVS"
	13	#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
	14
14c85021 ACM	15	#include <linux/in.h>
14c85021 ACM	16	#include <linux/ip.h>
1da177e4	17	#include <linux/kernel.h>
af1e1cf0	18	#include <linux/netfilter.h>
1da177e4	19	#include <linux/netfilter_ipv4.h>
14c85021	20	#include <linux/udp.h>
6ecd7548	21	#include <linux/indirect_call_wrapper.h>
1da177e4 LT	22
1da177e4 LT	23	#include <net/ip_vs.h>
c9bdd4b5	24	#include <net/ip.h>
63f2c046	25	#include <net/ip6_checksum.h>
1da177e4	26
fe19a8fe MC	27	static int
	28	udp_csum_check(int af, struct sk_buff skb, struct ip_vs_protocol pp);
	29
1da177e4	30	static int
d8f44c33 EB	31	udp_conn_schedule(struct netns_ipvs ipvs, int af, struct sk_buff skb,
d8f44c33 EB	32	struct ip_vs_proto_data *pd,
d4383f04 JDB	33	int verdict, struct ip_vs_conn *cpp,
d4383f04 JDB	34	struct ip_vs_iphdr *iph)
1da177e4 LT	35	{
	36	struct ip_vs_service *svc;
	37	struct udphdr _udph, *uh;
2b0f39ef	38	__be16 _ports[2], *ports = NULL;
1da177e4	39
2b0f39ef AG	40	if (likely(!ip_vs_iph_icmp(iph))) {
	41	/* IPv6 fragments, only first fragment will hit this */
	42	uh = skb_header_pointer(skb, iph->len, sizeof(_udph), &_udph);
	43	if (uh)
	44	ports = &uh->source;
	45	} else {
	46	ports = skb_header_pointer(
	47	skb, iph->len, sizeof(_ports), &_ports);
6044eeff AG	48	}
6044eeff AG	49
2b0f39ef	50	if (!ports) {
1da177e4 LT	51	*verdict = NF_DROP;
	52	return 0;
	53	}
2b0f39ef	54
2b0f39ef	55	if (likely(!ip_vs_iph_inverse(iph)))
0a4fd6ce	56	svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
2b0f39ef AG	57	&iph->daddr, ports[1]);
2b0f39ef AG	58	else
0a4fd6ce	59	svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
2b0f39ef AG	60	&iph->saddr, ports[0]);
2b0f39ef AG	61
3c2e0505	62	if (svc) {
190ecd27 JA	63	int ignored;
190ecd27 JA	64
d8f44c33	65	if (ip_vs_todrop(ipvs)) {
1da177e4 LT	66	/*
	67	* It seems that we are very loaded.
	68	* We have to drop this packet :(
	69	*/
1da177e4 LT	70	*verdict = NF_DROP;
	71	return 0;
	72	}
	73
	74	/*
	75	* Let the virtual server select a real server for the
	76	* incoming connection, and create a connection entry.
	77	*/
d4383f04	78	*cpp = ip_vs_schedule(svc, skb, pd, &ignored, iph);
a5959d53 HS	79	if (!*cpp && ignored <= 0) {
a5959d53 HS	80	if (!ignored)
d4383f04	81	*verdict = ip_vs_leave(svc, skb, pd, iph);
ceec4c38	82	else
a5959d53	83	*verdict = NF_DROP;
1da177e4 LT	84	return 0;
1da177e4 LT	85	}
1da177e4	86	}
a5959d53	87	/* NF_ACCEPT */
1da177e4 LT	88	return 1;
	89	}
	90
	91
	92	static inline void
0bbdd42b JV	93	udp_fast_csum_update(int af, struct udphdr *uhdr,
	94	const union nf_inet_addr *oldip,
	95	const union nf_inet_addr *newip,
014d730d	96	__be16 oldport, __be16 newport)
1da177e4	97	{
0bbdd42b JV	98	#ifdef CONFIG_IP_VS_IPV6
	99	if (af == AF_INET6)
	100	uhdr->check =
	101	csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
	102	ip_vs_check_diff2(oldport, newport,
	103	~csum_unfold(uhdr->check))));
	104	else
	105	#endif
	106	uhdr->check =
	107	csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
	108	ip_vs_check_diff2(oldport, newport,
	109	~csum_unfold(uhdr->check))));
1da177e4	110	if (!uhdr->check)
f6ab0288	111	uhdr->check = CSUM_MANGLED_0;
1da177e4 LT	112	}
1da177e4 LT	113
503e81f6 SH	114	static inline void
	115	udp_partial_csum_update(int af, struct udphdr *uhdr,
	116	const union nf_inet_addr *oldip,
	117	const union nf_inet_addr *newip,
	118	__be16 oldlen, __be16 newlen)
	119	{
	120	#ifdef CONFIG_IP_VS_IPV6
	121	if (af == AF_INET6)
	122	uhdr->check =
5bc9068e	123	~csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
503e81f6	124	ip_vs_check_diff2(oldlen, newlen,
5bc9068e	125	csum_unfold(uhdr->check))));
503e81f6 SH	126	else
	127	#endif
	128	uhdr->check =
5bc9068e	129	~csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
503e81f6	130	ip_vs_check_diff2(oldlen, newlen,
5bc9068e	131	csum_unfold(uhdr->check))));
503e81f6 SH	132	}
	133
	134
6ecd7548	135	INDIRECT_CALLABLE_SCOPE int
d4383f04 JDB	136	udp_snat_handler(struct sk_buff skb, struct ip_vs_protocol pp,
d4383f04 JDB	137	struct ip_vs_conn cp, struct ip_vs_iphdr iph)
1da177e4 LT	138	{
1da177e4 LT	139	struct udphdr *udph;
d4383f04	140	unsigned int udphoff = iph->len;
f25a9b85	141	bool payload_csum = false;
503e81f6	142	int oldlen;
0bbdd42b JV	143
0bbdd42b JV	144	#ifdef CONFIG_IP_VS_IPV6
d4383f04	145	if (cp->af == AF_INET6 && iph->fragoffs)
63dca2c0	146	return 1;
0bbdd42b	147	#endif
503e81f6	148	oldlen = skb->len - udphoff;
1da177e4 LT	149
1da177e4 LT	150	/* csum_check requires unshared skb */
ec0974df	151	if (skb_ensure_writable(skb, udphoff + sizeof(*udph)))
1da177e4 LT	152	return 0;
	153
	154	if (unlikely(cp->app != NULL)) {
8b27b10f JA	155	int ret;
8b27b10f JA	156
1da177e4	157	/* Some checks before mangling */
fe19a8fe	158	if (!udp_csum_check(cp->af, skb, pp))
1da177e4 LT	159	return 0;
	160
	161	/*
	162	* Call application helper if needed
	163	*/
d12e1229	164	if (!(ret = ip_vs_app_pkt_out(cp, skb, iph)))
1da177e4	165	return 0;
8b27b10f JA	166	/* ret=2: csum update is needed after payload mangling */
	167	if (ret == 1)
	168	oldlen = skb->len - udphoff;
	169	else
f25a9b85	170	payload_csum = true;
1da177e4 LT	171	}
1da177e4 LT	172
0bbdd42b	173	udph = (void *)skb_network_header(skb) + udphoff;
1da177e4 LT	174	udph->source = cp->vport;
	175
	176	/*
	177	* Adjust UDP checksums
	178	*/
503e81f6 SH	179	if (skb->ip_summed == CHECKSUM_PARTIAL) {
503e81f6 SH	180	udp_partial_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
ca62059b HH	181	htons(oldlen),
ca62059b HH	182	htons(skb->len - udphoff));
8b27b10f	183	} else if (!payload_csum && (udph->check != 0)) {
1da177e4	184	/* Only port and addr are changed, do fast csum update */
0bbdd42b	185	udp_fast_csum_update(cp->af, udph, &cp->daddr, &cp->vaddr,
1da177e4	186	cp->dport, cp->vport);
3db05fea	187	if (skb->ip_summed == CHECKSUM_COMPLETE)
fe19a8fe	188	skb->ip_summed = cp->app ?
8b27b10f	189	CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
1da177e4 LT	190	} else {
	191	/* full checksum calculation */
	192	udph->check = 0;
3db05fea	193	skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
0bbdd42b JV	194	#ifdef CONFIG_IP_VS_IPV6
	195	if (cp->af == AF_INET6)
	196	udph->check = csum_ipv6_magic(&cp->vaddr.in6,
	197	&cp->caddr.in6,
	198	skb->len - udphoff,
	199	cp->protocol, skb->csum);
	200	else
	201	#endif
	202	udph->check = csum_tcpudp_magic(cp->vaddr.ip,
	203	cp->caddr.ip,
	204	skb->len - udphoff,
	205	cp->protocol,
	206	skb->csum);
1da177e4	207	if (udph->check == 0)
f6ab0288	208	udph->check = CSUM_MANGLED_0;
8b27b10f	209	skb->ip_summed = CHECKSUM_UNNECESSARY;
1da177e4 LT	210	IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
	211	pp->name, udph->check,
	212	(char)&(udph->check) - (char)udph);
	213	}
	214	return 1;
	215	}
	216
	217
	218	static int
d4383f04 JDB	219	udp_dnat_handler(struct sk_buff skb, struct ip_vs_protocol pp,
d4383f04 JDB	220	struct ip_vs_conn cp, struct ip_vs_iphdr iph)
1da177e4 LT	221	{
1da177e4 LT	222	struct udphdr *udph;
d4383f04	223	unsigned int udphoff = iph->len;
f25a9b85	224	bool payload_csum = false;
503e81f6	225	int oldlen;
0bbdd42b JV	226
0bbdd42b JV	227	#ifdef CONFIG_IP_VS_IPV6
d4383f04	228	if (cp->af == AF_INET6 && iph->fragoffs)
63dca2c0	229	return 1;
0bbdd42b	230	#endif
503e81f6	231	oldlen = skb->len - udphoff;
1da177e4 LT	232
1da177e4 LT	233	/* csum_check requires unshared skb */
ec0974df	234	if (skb_ensure_writable(skb, udphoff + sizeof(*udph)))
1da177e4 LT	235	return 0;
	236
	237	if (unlikely(cp->app != NULL)) {
8b27b10f JA	238	int ret;
8b27b10f JA	239
1da177e4	240	/* Some checks before mangling */
fe19a8fe	241	if (!udp_csum_check(cp->af, skb, pp))
1da177e4 LT	242	return 0;
	243
	244	/*
	245	* Attempt ip_vs_app call.
	246	* It will fix ip_vs_conn
	247	*/
d12e1229	248	if (!(ret = ip_vs_app_pkt_in(cp, skb, iph)))
1da177e4	249	return 0;
8b27b10f JA	250	/* ret=2: csum update is needed after payload mangling */
	251	if (ret == 1)
	252	oldlen = skb->len - udphoff;
	253	else
f25a9b85	254	payload_csum = true;
1da177e4 LT	255	}
1da177e4 LT	256
0bbdd42b	257	udph = (void *)skb_network_header(skb) + udphoff;
1da177e4 LT	258	udph->dest = cp->dport;
	259
	260	/*
	261	* Adjust UDP checksums
	262	*/
503e81f6	263	if (skb->ip_summed == CHECKSUM_PARTIAL) {
5bc9068e	264	udp_partial_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
ca62059b HH	265	htons(oldlen),
ca62059b HH	266	htons(skb->len - udphoff));
8b27b10f	267	} else if (!payload_csum && (udph->check != 0)) {
1da177e4	268	/* Only port and addr are changed, do fast csum update */
0bbdd42b	269	udp_fast_csum_update(cp->af, udph, &cp->vaddr, &cp->daddr,
1da177e4	270	cp->vport, cp->dport);
3db05fea	271	if (skb->ip_summed == CHECKSUM_COMPLETE)
fe19a8fe	272	skb->ip_summed = cp->app ?
8b27b10f	273	CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
1da177e4 LT	274	} else {
	275	/* full checksum calculation */
	276	udph->check = 0;
3db05fea	277	skb->csum = skb_checksum(skb, udphoff, skb->len - udphoff, 0);
0bbdd42b JV	278	#ifdef CONFIG_IP_VS_IPV6
	279	if (cp->af == AF_INET6)
	280	udph->check = csum_ipv6_magic(&cp->caddr.in6,
	281	&cp->daddr.in6,
	282	skb->len - udphoff,
	283	cp->protocol, skb->csum);
	284	else
	285	#endif
	286	udph->check = csum_tcpudp_magic(cp->caddr.ip,
	287	cp->daddr.ip,
	288	skb->len - udphoff,
	289	cp->protocol,
	290	skb->csum);
1da177e4	291	if (udph->check == 0)
f6ab0288	292	udph->check = CSUM_MANGLED_0;
3db05fea	293	skb->ip_summed = CHECKSUM_UNNECESSARY;
1da177e4 LT	294	}
	295	return 1;
	296	}
	297
	298
	299	static int
51ef348b	300	udp_csum_check(int af, struct sk_buff skb, struct ip_vs_protocol pp)
1da177e4 LT	301	{
1da177e4 LT	302	struct udphdr _udph, *uh;
51ef348b JV	303	unsigned int udphoff;
	304
	305	#ifdef CONFIG_IP_VS_IPV6
	306	if (af == AF_INET6)
	307	udphoff = sizeof(struct ipv6hdr);
	308	else
	309	#endif
	310	udphoff = ip_hdrlen(skb);
1da177e4 LT	311
	312	uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph);
	313	if (uh == NULL)
	314	return 0;
	315
	316	if (uh->check != 0) {
	317	switch (skb->ip_summed) {
	318	case CHECKSUM_NONE:
	319	skb->csum = skb_checksum(skb, udphoff,
	320	skb->len - udphoff, 0);
df561f66	321	fallthrough;
84fa7933	322	case CHECKSUM_COMPLETE:
51ef348b JV	323	#ifdef CONFIG_IP_VS_IPV6
	324	if (af == AF_INET6) {
	325	if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
	326	&ipv6_hdr(skb)->daddr,
	327	skb->len - udphoff,
	328	ipv6_hdr(skb)->nexthdr,
	329	skb->csum)) {
0d79641a	330	IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
51ef348b JV	331	"Failed checksum for");
	332	return 0;
	333	}
	334	} else
	335	#endif
	336	if (csum_tcpudp_magic(ip_hdr(skb)->saddr,
	337	ip_hdr(skb)->daddr,
	338	skb->len - udphoff,
	339	ip_hdr(skb)->protocol,
	340	skb->csum)) {
0d79641a	341	IP_VS_DBG_RL_PKT(0, af, pp, skb, 0,
51ef348b JV	342	"Failed checksum for");
	343	return 0;
	344	}
1da177e4 LT	345	break;
1da177e4 LT	346	default:
84fa7933	347	/* No need to checksum. */
1da177e4 LT	348	break;
	349	}
	350	}
	351	return 1;
	352	}
	353
75e7ce66	354	static inline __u16 udp_app_hashkey(__be16 port)
1da177e4	355	{
75e7ce66 AV	356	return (((__force u16)port >> UDP_APP_TAB_BITS) ^ (__force u16)port)
75e7ce66 AV	357	& UDP_APP_TAB_MASK;
1da177e4 LT	358	}
	359
	360
19648918	361	static int udp_register_app(struct netns_ipvs ipvs, struct ip_vs_app inc)
1da177e4 LT	362	{
1da177e4 LT	363	struct ip_vs_app *i;
75e7ce66 AV	364	__u16 hash;
75e7ce66 AV	365	__be16 port = inc->port;
1da177e4	366	int ret = 0;
18d6ade6	367	struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
1da177e4 LT	368
	369	hash = udp_app_hashkey(port);
	370
78b16bde	371	list_for_each_entry(i, &ipvs->udp_apps[hash], p_list) {
1da177e4 LT	372	if (i->port == port) {
	373	ret = -EEXIST;
	374	goto out;
	375	}
	376	}
363c97d7	377	list_add_rcu(&inc->p_list, &ipvs->udp_apps[hash]);
9bbac6a9	378	atomic_inc(&pd->appcnt);
1da177e4 LT	379
1da177e4 LT	380	out:
1da177e4 LT	381	return ret;
	382	}
	383
	384
	385	static void
19648918	386	udp_unregister_app(struct netns_ipvs ipvs, struct ip_vs_app inc)
1da177e4	387	{
19648918	388	struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
78b16bde	389
9bbac6a9	390	atomic_dec(&pd->appcnt);
363c97d7	391	list_del_rcu(&inc->p_list);
1da177e4 LT	392	}
	393
	394
	395	static int udp_app_conn_bind(struct ip_vs_conn *cp)
	396	{
58dbc6f2	397	struct netns_ipvs *ipvs = cp->ipvs;
1da177e4 LT	398	int hash;
	399	struct ip_vs_app *inc;
	400	int result = 0;
	401
	402	/* Default binding: bind app only for NAT */
	403	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
	404	return 0;
	405
	406	/* Lookup application incarnations and bind the right one */
	407	hash = udp_app_hashkey(cp->vport);
	408
363c97d7	409	list_for_each_entry_rcu(inc, &ipvs->udp_apps[hash], p_list) {
1da177e4 LT	410	if (inc->port == cp->vport) {
	411	if (unlikely(!ip_vs_app_inc_get(inc)))
	412	break;
1da177e4	413
1e3e238e	414	IP_VS_DBG_BUF(9, "%s(): Binding conn %s:%u->"
cfc78c5a JV	415	"%s:%u to app %s on port %u\n",
	416	__func__,
	417	IP_VS_DBG_ADDR(cp->af, &cp->caddr),
	418	ntohs(cp->cport),
	419	IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
	420	ntohs(cp->vport),
	421	inc->name, ntohs(inc->port));
	422
1da177e4 LT	423	cp->app = inc;
	424	if (inc->init_conn)
	425	result = inc->init_conn(inc, cp);
0b35f603	426	break;
1da177e4 LT	427	}
1da177e4 LT	428	}
1da177e4	429
1da177e4 LT	430	return result;
	431	}
	432
	433
78b16bde	434	static const int udp_timeouts[IP_VS_UDP_S_LAST+1] = {
1da177e4 LT	435	[IP_VS_UDP_S_NORMAL] = 560HZ,
	436	[IP_VS_UDP_S_LAST] = 2*HZ,
	437	};
	438
36cbd3dc	439	static const char *const udp_state_name_table[IP_VS_UDP_S_LAST+1] = {
1da177e4 LT	440	[IP_VS_UDP_S_NORMAL] = "UDP",
	441	[IP_VS_UDP_S_LAST] = "BUG!",
	442	};
	443
1da177e4 LT	444	static const char * udp_state_name(int state)
	445	{
	446	if (state >= IP_VS_UDP_S_LAST)
	447	return "ERR!";
	448	return udp_state_name_table[state] ? udp_state_name_table[state] : "?";
	449	}
	450
4a516f11	451	static void
1da177e4 LT	452	udp_state_transition(struct ip_vs_conn *cp, int direction,
1da177e4 LT	453	const struct sk_buff *skb,
9330419d	454	struct ip_vs_proto_data *pd)
1da177e4	455	{
78b16bde HS	456	if (unlikely(!pd)) {
78b16bde HS	457	pr_err("UDP no ns data\n");
4a516f11	458	return;
78b16bde HS	459	}
	460
	461	cp->timeout = pd->timeout_table[IP_VS_UDP_S_NORMAL];
27541143 JA	462	if (direction == IP_VS_DIR_OUTPUT)
27541143 JA	463	ip_vs_control_assure_ct(cp);
1da177e4 LT	464	}
1da177e4 LT	465
1281a9c2	466	static int __udp_init(struct netns_ipvs ipvs, struct ip_vs_proto_data pd)
1da177e4	467	{
78b16bde	468	ip_vs_init_hash_table(ipvs->udp_apps, UDP_APP_TAB_SIZE);
78b16bde HS	469	pd->timeout_table = ip_vs_create_timeout_table((int *)udp_timeouts,
78b16bde HS	470	sizeof(udp_timeouts));
582b8e3e HS	471	if (!pd->timeout_table)
	472	return -ENOMEM;
	473	return 0;
1da177e4 LT	474	}
1da177e4 LT	475
1281a9c2	476	static void __udp_exit(struct netns_ipvs ipvs, struct ip_vs_proto_data pd)
1da177e4	477	{
78b16bde	478	kfree(pd->timeout_table);
1da177e4 LT	479	}
	480
	481
	482	struct ip_vs_protocol ip_vs_protocol_udp = {
	483	.name = "UDP",
	484	.protocol = IPPROTO_UDP,
2ad17def	485	.num_states = IP_VS_UDP_S_LAST,
1da177e4	486	.dont_defrag = 0,
78b16bde HS	487	.init = NULL,
	488	.exit = NULL,
	489	.init_netns = __udp_init,
	490	.exit_netns = __udp_exit,
1da177e4	491	.conn_schedule = udp_conn_schedule,
5c0d2374 SH	492	.conn_in_get = ip_vs_conn_in_get_proto,
5c0d2374 SH	493	.conn_out_get = ip_vs_conn_out_get_proto,
1da177e4 LT	494	.snat_handler = udp_snat_handler,
1da177e4 LT	495	.dnat_handler = udp_dnat_handler,
1da177e4 LT	496	.state_transition = udp_state_transition,
	497	.state_name = udp_state_name,
	498	.register_app = udp_register_app,
	499	.unregister_app = udp_unregister_app,
	500	.app_conn_bind = udp_app_conn_bind,
	501	.debug_packet = ip_vs_tcpudp_debug_packet,
	502	.timeout_change = NULL,
1da177e4	503	};