|
On Tue, Sep 29, 2009 at 02:35:15PM +0200, Hannes Eder wrote:
> The following series implements full NAT support for IPVS. The
> approach is via a minimal change to IPVS (make friends with
> nf_conntrack) and adding a netfilter matcher, kernel- and user-space
> part, i.e. xt_ipvs and libxt_ipvs.
Its a bit late in the day for me to review the code, but I have a few
quick comments.
>
> Example usage:
>
> % ipvsadm -A -t 192.168.100.30:80 -s rr
> % ipvsadm -a -t 192.168.100.30:80 -r 192.168.10.20:80 -m
> # ...
>
> # Source NAT for VIP 192.168.100.30:80
> % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> > --vport 80 -j SNAT --to-source 192.168.10.10
>
> or SNAT-ing only a specific real server:
>
> % iptables -t nat -A POSTROUTING --dst 192.168.11.20 \
> > -m ipvs --vaddr 192.168.100.30/32 -j SNAT --to-source 192.168.10.10
If the iptables rule is not in place does LVS just use
its old NAT behaviour?
> First of all, thanks for all the feedback. This is the changelog for v2:
>
> - Make ip_vs_ftp work again. Setup nf_conntrack expectations for
> related data connections (based on Julian's patch see
> http://www.ssi.bg/~ja/nfct/) and let nf_conntrack/nf_nat do the
> packet mangling and the TCP sequence adjusting.
>
> This change rises the question how to deal with ip_vs_sync? Does it
> work together with conntrackd? Wild idea: what about getting rid of
> ip_vs_sync and piggy packing all on nf_conntrack and use conntrackd?
>
> Any comments on this?
That sounds like a reasonable suggestion.
I think that ip_vs_sync came along before conntrackd
and no one has given much thought to merging the functionality.
> - xt_ipvs: add new rule '--vportctl port' to match the VIP port of the
> controlling connection, e.g. port 21 for FTP. Can be used to match
> a related data connection for FTP:
>
> # SNAT FTP control connection
> % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> > --vport 21 -j SNAT --to-source 192.168.10.10
>
> # SNAT FTP passive data connection
> % iptables -t nat -A POSTROUTING -m ipvs --vaddr 192.168.100.30/32 \
> > --vportctl 21 -j SNAT --to-source 192.168.10.10
>
> - xt_ipvs: use 'par->family' instead of 'skb->protocol'
>
> - xt_ipvs: add ipvs_mt_check and restrict to NFPROTO_IPV4 and NFPROTO_IPV6
>
> - Call nf_conntrack_alter_reply(), so helper lookup is performed based
> on the changed tuple.
>
> Changes to the linux kernel (rebased to next-20090925):
>
> Hannes Eder (3):
> netfilter: xt_ipvs (netfilter matcher for IPVS)
> IPVS: make friends with nf_conntrack
> IPVS: make FTP work with full NAT support
>
>
> include/linux/netfilter/xt_ipvs.h | 25 +++++
> include/net/ip_vs.h | 2
> net/netfilter/Kconfig | 9 ++
> net/netfilter/Makefile | 1
> net/netfilter/ipvs/Kconfig | 4 -
> net/netfilter/ipvs/ip_vs_app.c | 43 ---------
> net/netfilter/ipvs/ip_vs_core.c | 37 -------
> net/netfilter/ipvs/ip_vs_ftp.c | 178 ++++++++++++++++++++++++++++++++---
> net/netfilter/ipvs/ip_vs_proto.c | 1
> net/netfilter/ipvs/ip_vs_xmit.c | 30 ++++++
> net/netfilter/xt_ipvs.c | 187
> +++++++++++++++++++++++++++++++++++++
> 11 files changed, 418 insertions(+), 99 deletions(-)
> create mode 100644 include/linux/netfilter/xt_ipvs.h
> create mode 100644 net/netfilter/xt_ipvs.c
>
>
> Changes to iptables (relative to 1.4.5):
>
> Hannes Eder (1):
> libxt_ipvs: user-space lib for netfilter matcher xt_ipvs
>
> configure.ac | 11 +
> extensions/libxt_ipvs.c | 365
> +++++++++++++++++++++++++++++++++++++
> extensions/libxt_ipvs.man | 24 ++
> include/linux/netfilter/xt_ipvs.h | 25 +++
> 4 files changed, 422 insertions(+), 3 deletions(-)
> create mode 100644 extensions/libxt_ipvs.c
> create mode 100644 extensions/libxt_ipvs.man
> create mode 100644 include/linux/netfilter/xt_ipvs.h
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
