[patch v2.2 0/4] IPVS full NAT support + netfilter 'ipvs' match support

To: lvs-devel@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, netfilter@xxxxxxxxxxxxxxx
Subject: [patch v2.2 0/4] IPVS full NAT support + netfilter 'ipvs' match support
Cc: Wensong Zhang <wensong@xxxxxxxxxxxx>, Julius Volz <julius.volz@xxxxxxxxx>, Patrick McHardy <kaber@xxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>, Hannes Eder <heder@xxxxxxxxxx>
From: Simon Horman <horms@xxxxxxxxxxxx>
Date: Sat, 01 May 2010 13:20:14 +1000
[re-reposting without bogus headers that vger dislikes]

This is a repost of a patch-series posted by Hannes Eder last Steptember.
This is v2 of the patch series and I don't see any outstanding objections to
it in the mailing list archives. I would like it considered for inclusion
in the nf-next-2.6 kernel tree and iptables.

The original cover-email from Hannes follows.
The diffstat output has been updated to reflect minor up-porting by me.

From:   Hannes Eder <heder@xxxxxxxxxx>

The following series implements full NAT support for IPVS.  The
approach is via a minimal change to IPVS (make friends with
nf_conntrack) and adding a netfilter matcher, kernel- and user-space
part, i.e. xt_ipvs and libxt_ipvs.

Example usage:

% ipvsadm -A -t -s rr
% ipvsadm -a -t -r -m
# ...

# Source NAT for VIP
% iptables -t nat -A POSTROUTING -m ipvs --vaddr \
> --vport 80 -j SNAT --to-source

or SNAT-ing only a specific real server:

% iptables -t nat -A POSTROUTING --dst \
> -m ipvs --vaddr -j SNAT --to-source

First of all, thanks for all the feedback.  This is the changelog for v2:

- Make ip_vs_ftp work again.  Setup nf_conntrack expectations for
  related data connections (based on Julian's patch see and let nf_conntrack/nf_nat do the
  packet mangling and the TCP sequence adjusting.

  This change rises the question how to deal with ip_vs_sync?  Does it
  work together with conntrackd?  Wild idea: what about getting rid of
  ip_vs_sync and piggy packing all on nf_conntrack and use conntrackd?

  Any comments on this?

- xt_ipvs: add new rule '--vportctl port' to match the VIP port of the
  controlling connection, e.g. port 21 for FTP.  Can be used to match
  a related data connection for FTP:

  # SNAT FTP control connection
  % iptables -t nat -A POSTROUTING -m ipvs --vaddr \
  > --vport 21 -j SNAT --to-source
  # SNAT FTP passive data connection
  % iptables -t nat -A POSTROUTING -m ipvs --vaddr \
  > --vportctl 21 -j SNAT --to-source

- xt_ipvs: use 'par->family' instead of 'skb->protocol'

- xt_ipvs: add ipvs_mt_check and restrict to NFPROTO_IPV4 and NFPROTO_IPV6

- Call nf_conntrack_alter_reply(), so helper lookup is performed based
  on the changed tuple.

Changes to the linux kernel (rebased to next-20090925):

Hannes Eder (3):
      netfilter: xt_ipvs (netfilter matcher for IPVS)
      IPVS: make friends with nf_conntrack
      IPVS: make FTP work with full NAT support

 include/linux/netfilter/xt_ipvs.h |   25 +++++
 include/net/ip_vs.h               |    2 
 net/netfilter/Kconfig             |    9 ++
 net/netfilter/Makefile            |    1 
 net/netfilter/ipvs/Kconfig        |    4 -
 net/netfilter/ipvs/ip_vs_app.c    |   43 ---------
 net/netfilter/ipvs/ip_vs_core.c   |   37 -------
 net/netfilter/ipvs/ip_vs_ftp.c    |  178 ++++++++++++++++++++++++++++++++---
 net/netfilter/ipvs/ip_vs_proto.c  |    1 
 net/netfilter/ipvs/ip_vs_xmit.c   |   30 ++++++
 net/netfilter/xt_ipvs.c           |  187 +++++++++++++++++++++++++++++++++++++
 11 files changed, 418 insertions(+), 99 deletions(-)
 create mode 100644 include/linux/netfilter/xt_ipvs.h
 create mode 100644 net/netfilter/xt_ipvs.c

Changes to iptables (relative to 1.4.5):

Hannes Eder (1):
      libxt_ipvs: user-space lib for netfilter matcher xt_ipvs                      |   10 1
 extensions/libxt_ipvs.c           |  365 +++++++++++++++++++++++++++++++++++++
 extensions/         |   24 ++
 include/linux/netfilter/xt_ipvs.h |   25 +++
 4 files changed, 422 insertions(+), 2 deletions(-)
 create mode 100644 extensions/libxt_ipvs.c
 create mode 100644 extensions/
 create mode 100644 include/linux/netfilter/xt_ipvs.h

To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at

<Prev in Thread] Current Thread [Next in Thread>