ipvs: support scheduling inverse and icmp SCTP packets

In the event of an icmp packet, take only the ports instead of trying to
grab the full header.

In the event of an inverse packet, use the source address and port.

Signed-off-by: Alex Gartrell <agartrell@fb.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>

diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index cd2984f3dad704fe8dd8db95b475bac26a366f49..2026fca7e1c36f12db1351e7c14e9eba8ad8b8e1 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -18,22 +18,24 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
        struct netns_ipvs *ipvs;
        sctp_chunkhdr_t _schunkh, *sch;
        sctp_sctphdr_t *sh, _sctph;
-
-       if (ip_vs_iph_icmp(iph)) {
-               /* TEMPORARY - do not schedule icmp yet */
-               *verdict = NF_ACCEPT;
-               return 0;
-       }
-
-       sh = skb_header_pointer(skb, iph->len, sizeof(_sctph), &_sctph);
-       if (sh == NULL) {
-               *verdict = NF_DROP;
-               return 0;
+       __be16 _ports[2], *ports = NULL;
+
+       if (likely(!ip_vs_iph_icmp(iph))) {
+               sh = skb_header_pointer(skb, iph->len, sizeof(_sctph), &_sctph);
+               if (sh) {
+                       sch = skb_header_pointer(
+                               skb, iph->len + sizeof(sctp_sctphdr_t),
+                               sizeof(_schunkh), &_schunkh);
+                       if (sch && (sch->type == SCTP_CID_INIT ||
+                                   sysctl_sloppy_sctp(ipvs)))
+                               ports = &sh->source;
+               }
+       } else {
+               ports = skb_header_pointer(
+                       skb, iph->len, sizeof(_ports), &_ports);
        }
 
-       sch = skb_header_pointer(skb, iph->len + sizeof(sctp_sctphdr_t),
-                                sizeof(_schunkh), &_schunkh);
-       if (sch == NULL) {
+       if (!ports) {
                *verdict = NF_DROP;
                return 0;
        }
@@ -41,9 +43,13 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
        net = skb_net(skb);
        ipvs = net_ipvs(net);
        rcu_read_lock();
-       if ((sch->type == SCTP_CID_INIT || sysctl_sloppy_sctp(ipvs)) &&
-           (svc = ip_vs_service_find(net, af, skb->mark, iph->protocol,
-                                     &iph->daddr, sh->dest))) {
+       if (likely(!ip_vs_iph_inverse(iph)))
+               svc = ip_vs_service_find(net, af, skb->mark, iph->protocol,
+                                        &iph->daddr, ports[1]);
+       else
+               svc = ip_vs_service_find(net, af, skb->mark, iph->protocol,
+                                        &iph->saddr, ports[0]);
+       if (svc) {
                int ignored;
 
                if (ip_vs_todrop(ipvs)) {