pax_global_header 0000666 0000000 0000000 00000000064 13475421131 0014513 g ustar 00root root 0000000 0000000 52 comment=de6bf028fd14d0dfa4c426860cb02ef26cbbc587
nftlb-0.5/ 0000775 0000000 0000000 00000000000 13475421131 0012464 5 ustar 00root root 0000000 0000000 nftlb-0.5/.gitignore 0000664 0000000 0000000 00000000273 13475421131 0014456 0 ustar 00root root 0000000 0000000 # Generated by autoconf/configure/automake
*.m4
Makefile
Makefile.in
stamp-h1
config.h.in
config.h.in~
config.log
config.status
configure
autom4te.cache
build-aux/
libnftables.pc
libtool
nftlb-0.5/LICENSE 0000664 0000000 0000000 00000103330 13475421131 0013471 0 ustar 00root root 0000000 0000000 GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
Copyright (C) 2007 Free Software Foundation, Inc.
Copyright (C)
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published
by the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see },
{ },
{ ... }
],
"policies" : [
{ },
{ },
{ ... }
]
}
```
Where every farm object has the following attributes:
```
{
"name" : "", *Name of the service (required)*
"iface" : "", *Input interface (only required for DSR)*
"oface" : "", *Output interface (only required for DSR)*
"family": "", *Family of the virtual service (ipv4 by default)*
"ether-addr": "", *Physical address of the virtual service (only required for DSR)*
"virtual-addr": "", *IP address for the virtual service (required)*
"virtual-ports": "", *Port list separated by commas or ranges separated by a hyphen*
"source-addr": "", *Source IP address instead of masquerading*
"mode": "", *Topology to be implemented (required)*
"protocol": "", *Protocol to be used by the virtual service (tcp by default)*
"scheduler": "", *Scheduler to be used (round robin by default)*
"sched-param": "", *Hash input parameters (none by default)*
"persistence": "", *Configured stickiness between client and backend (none by default)*
"persist-ttl": "", *Stickiness timeout in seconds (60 by default)*
"helper": "", *L7 helper to be used (none by default)*
"log": "", *Enable logging (none by default)*
"mark": "", *Set mark mask for the farm (none by default)*
"priority": "", *Priority availability for backends > 0 (1 by default)*
"new-rtlimit": "", *Number of new connections per second per service (disabled by default)*
"new-rtlimit-burst": "", *Number of burst packets (disabled by default)*
"rst-rtlimit": "", *Number of tcp resets per second allowed (disabled by default)*
"est-connlimit": "", *Number of established connections allowed (disabled by default)*
"tcp-strict": "", *Option to avoid bogus TCP attacks (disabled by default)*
"queue": "", *Number of the queue to send the packets to userspace (disabled by default)*
"state": "", *Set the status of the virtual service (up by default)*
"backends" : [ *List of backends*
{},
{},
{...}
],
"policies" : [ *List of policies*
{
"name" : "",
},
{...}
]
}
```
Where every backend object has the following attributes:
```
{
"name" : "", *Name of the backend (required)*
"ether-addr": "", *Physical address of the backend (only required for DSR)*
"ip-addr": "", *IP address for the backend (required, except for DSR)*
"port": "", *Backend port to redirect the connections*
"weight": "", *Weight of the backend (1 by default)*
"priority": "", *Priority availability for the backend > 0 (1 by default)*
"mark": "", *Set mark mask for the backend (none by default)*
"est-connlimit": "", *Number of established connections allowed per backend (disabled by default)*
"state": "", *Set the status of the backend (up by default)*
}
```
Where every policy object has the following attributes:
```
{
"name" : "", *Name of the policy (required)*
"type": "", *Policy type*
"elements" : [ *List of IPs or networks*
{
"data" : ""
},
{...}
]
}
```
You can find some examples in the *tests/* folder.
### API examples
Once launched nftlb you can manage it through the API.
Virtual service listing.
```
curl -H "Key: " http://:5555/farms
```
Setup a new virtual service.
```
curl -H "Key: " -X POST http://:5555/farms -d "@tests/008_snat_ipv4_all_rr.json"
```
Add a new backend into a virtual service.
```
curl -H "Key: " -X POST http://:5555/farms -d '{"farms" : [ { "name" : "myfarm", "backends" : [ { "name" : "mynewbck", "ip-addr" : "192.168.0.150", "state" : "up" } ] } ] }'
```
Delete a virtual service.
```
curl -H "Key: " -X DELETE http://:5555/farms/lb01
```
Delete a backend of a virtual service.
```
curl -H "Key: " -X DELETE http://:5555/farms/lb01/backends/bck1
```
## Support
Please refer to the [netfilter users mailing list](http://netfilter.org/mailinglists.html#ml-user)
nftlb-0.5/configure.ac 0000664 0000000 0000000 00000001373 13475421131 0014756 0 ustar 00root root 0000000 0000000 AC_INIT([nftlb], [0.5], [netfilter-devel@vger.kernel.org])
AC_CONFIG_AUX_DIR([build-aux])
AC_CONFIG_MACRO_DIR([m4])
AM_INIT_AUTOMAKE([-Wall foreign subdir-objects
tar-pax no-dist-gzip dist-bzip2 1.6])
dnl kernel style compile messages
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
AC_PROG_CC
AC_PROG_MKDIR_P
AM_PROG_AR
AM_PROG_LIBTOOL
AC_PROG_INSTALL
AC_PROG_LN_S
AC_PROG_SED
PKG_CHECK_MODULES([LIBNFTABLES], [libnftables >= 0.9])
PKG_CHECK_MODULES([LIBJSON], [jansson >= 2.3])
PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.4])
AC_CHECK_HEADER([ev.h], [EVENTINC="-include ev.h"],
[AC_CHECK_HEADER([libev/ev.h],
[EVENTINC="-include libev/ev.h"],
[AC_MSG_ERROR([ev.h not found])])])
AC_CONFIG_FILES([Makefile src/Makefile])
AC_OUTPUT
nftlb-0.5/include/ 0000775 0000000 0000000 00000000000 13475421131 0014107 5 ustar 00root root 0000000 0000000 nftlb-0.5/include/backends.h 0000664 0000000 0000000 00000003547 13475421131 0016043 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
int loop_init(void);
int loop_run(void);
struct ev_loop *get_loop(void);
struct ev_io *events_get_ntlnk(void);
struct ev_io *events_create_ntlnk(void);
void events_delete_ntlnk(void);
struct ev_io *events_get_srv(void);
struct ev_io *events_create_srv(void);
void events_delete_srv(void);
#endif /* _EVENTS_H_ */
nftlb-0.5/include/farmpolicy.h 0000664 0000000 0000000 00000003055 13475421131 0016430 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#define prefetch(x) ((void)0)
#define LIST_POISON1 ((void *)0x12345678)
#define LIST_POISON2 ((void *)0x87654321)
/*
* Simple doubly linked list implementation.
*
* Some of the internal functions ("__xxx") are useful when
* manipulating whole lists rather than single entries, as
* sometimes we already know the next/prev entries and we can
* generate better code by using them directly rather than
* using the generic single-entry routines.
*/
struct list_head {
struct list_head *next, *prev;
};
#define LIST_HEAD_INIT(name) { &(name), &(name) }
#define LIST_HEAD(name) \
struct list_head name = LIST_HEAD_INIT(name)
#define container_of(ptr, type, member) ({ \
typeof( ((type *)0)->member ) *__mptr = (ptr); \
(type *)( (void *)__mptr - offsetof(type,member) );})
static inline void init_list_head(struct list_head *list)
{
list->next = list;
list->prev = list;
}
/*
* Insert a new entry between two known consecutive entries.
*
* This is only for internal list manipulation where we know
* the prev/next entries already!
*/
static inline void __list_add(struct list_head *new,
struct list_head *prev,
struct list_head *next)
{
next->prev = new;
new->next = next;
new->prev = prev;
prev->next = new;
}
/**
* list_add - add a new entry
* @new: new entry to be added
* @head: list head to add it after
*
* Insert a new entry after the specified head.
* This is good for implementing stacks.
*/
static inline void list_add(struct list_head *new, struct list_head *head)
{
__list_add(new, head, head->next);
}
/**
* list_add_tail - add a new entry
* @new: new entry to be added
* @head: list head to add it before
*
* Insert a new entry before the specified head.
* This is useful for implementing queues.
*/
static inline void list_add_tail(struct list_head *new, struct list_head *head)
{
__list_add(new, head->prev, head);
}
/*
* Delete a list entry by making the prev/next entries
* point to each other.
*
* This is only for internal list manipulation where we know
* the prev/next entries already!
*/
static inline void __list_del(struct list_head * prev, struct list_head * next)
{
next->prev = prev;
prev->next = next;
}
/**
* list_del - deletes entry from list.
* @entry: the element to delete from the list.
* Note: list_empty() on entry does not return true after this, the entry is
* in an undefined state.
*/
static inline void list_del(struct list_head *entry)
{
__list_del(entry->prev, entry->next);
entry->next = LIST_POISON1;
entry->prev = LIST_POISON2;
}
/**
* list_replace - replace old entry by new one
* @old : the element to be replaced
* @new : the new element to insert
*
* If @old was empty, it will be overwritten.
*/
static inline void list_replace(struct list_head *old,
struct list_head *new)
{
new->next = old->next;
new->next->prev = new;
new->prev = old->prev;
new->prev->next = new;
}
static inline void list_replace_init(struct list_head *old,
struct list_head *new)
{
list_replace(old, new);
init_list_head(old);
}
/**
* list_del_init - deletes entry from list and reinitialize it.
* @entry: the element to delete from the list.
*/
static inline void list_del_init(struct list_head *entry)
{
__list_del(entry->prev, entry->next);
init_list_head(entry);
}
/**
* list_move - delete from one list and add as another's head
* @list: the entry to move
* @head: the head that will precede our entry
*/
static inline void list_move(struct list_head *list, struct list_head *head)
{
__list_del(list->prev, list->next);
list_add(list, head);
}
/**
* list_move_tail - delete from one list and add as another's tail
* @list: the entry to move
* @head: the head that will follow our entry
*/
static inline void list_move_tail(struct list_head *list,
struct list_head *head)
{
__list_del(list->prev, list->next);
list_add_tail(list, head);
}
/**
* list_is_last - tests whether @list is the last entry in list @head
* @list: the entry to test
* @head: the head of the list
*/
static inline int list_is_last(const struct list_head *list,
const struct list_head *head)
{
return list->next == head;
}
/**
* list_empty - tests whether a list is empty
* @head: the list to test.
*/
static inline int list_empty(const struct list_head *head)
{
return head->next == head;
}
/**
* list_empty_careful - tests whether a list is empty and not being modified
* @head: the list to test
*
* Description:
* tests whether a list is empty _and_ checks that no other CPU might be
* in the process of modifying either member (next or prev)
*
* NOTE: using list_empty_careful() without synchronization
* can only be safe if the only activity that can happen
* to the list entry is list_del_init(). Eg. it cannot be used
* if another CPU could re-list_add() it.
*/
static inline int list_empty_careful(const struct list_head *head)
{
struct list_head *next = head->next;
return (next == head) && (next == head->prev);
}
/**
* list_is_singular - tests whether a list has just one entry.
* @head: the list to test.
*/
static inline int list_is_singular(const struct list_head *head)
{
return !list_empty(head) && (head->next == head->prev);
}
static inline void __list_cut_position(struct list_head *list,
struct list_head *head, struct list_head *entry)
{
struct list_head *new_first = entry->next;
list->next = head->next;
list->next->prev = list;
list->prev = entry;
entry->next = list;
head->next = new_first;
new_first->prev = head;
}
/**
* list_cut_position - cut a list into two
* @list: a new list to add all removed entries
* @head: a list with entries
* @entry: an entry within head, could be the head itself
* and if so we won't cut the list
*
* This helper moves the initial part of @head, up to and
* including @entry, from @head to @list. You should
* pass on @entry an element you know is on @head. @list
* should be an empty list or a list you do not care about
* losing its data.
*
*/
static inline void list_cut_position(struct list_head *list,
struct list_head *head, struct list_head *entry)
{
if (list_empty(head))
return;
if (list_is_singular(head) &&
(head->next != entry && head != entry))
return;
if (entry == head)
init_list_head(list);
else
__list_cut_position(list, head, entry);
}
static inline void __list_splice(const struct list_head *list,
struct list_head *prev,
struct list_head *next)
{
struct list_head *first = list->next;
struct list_head *last = list->prev;
first->prev = prev;
prev->next = first;
last->next = next;
next->prev = last;
}
/**
* list_splice - join two lists, this is designed for stacks
* @list: the new list to add.
* @head: the place to add it in the first list.
*/
static inline void list_splice(const struct list_head *list,
struct list_head *head)
{
if (!list_empty(list))
__list_splice(list, head, head->next);
}
/**
* list_splice_tail - join two lists, each list being a queue
* @list: the new list to add.
* @head: the place to add it in the first list.
*/
static inline void list_splice_tail(struct list_head *list,
struct list_head *head)
{
if (!list_empty(list))
__list_splice(list, head->prev, head);
}
/**
* list_splice_init - join two lists and reinitialise the emptied list.
* @list: the new list to add.
* @head: the place to add it in the first list.
*
* The list at @list is reinitialised
*/
static inline void list_splice_init(struct list_head *list,
struct list_head *head)
{
if (!list_empty(list)) {
__list_splice(list, head, head->next);
init_list_head(list);
}
}
/**
* list_splice_tail_init - join two lists and reinitialise the emptied list
* @list: the new list to add.
* @head: the place to add it in the first list.
*
* Each of the lists is a queue.
* The list at @list is reinitialised
*/
static inline void list_splice_tail_init(struct list_head *list,
struct list_head *head)
{
if (!list_empty(list)) {
__list_splice(list, head->prev, head);
init_list_head(list);
}
}
/**
* list_entry - get the struct for this entry
* @ptr: the &struct list_head pointer.
* @type: the type of the struct this is embedded in.
* @member: the name of the list_struct within the struct.
*/
#define list_entry(ptr, type, member) \
container_of(ptr, type, member)
/**
* list_first_entry - get the first element from a list
* @ptr: the list head to take the element from.
* @type: the type of the struct this is embedded in.
* @member: the name of the list_struct within the struct.
*
* Note, that list is expected to be not empty.
*/
#define list_first_entry(ptr, type, member) \
list_entry((ptr)->next, type, member)
/**
* list_for_each_entry - iterate over list of given type
* @pos: the type * to use as a loop cursor.
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*/
#define list_for_each_entry(pos, head, member) \
for (pos = list_entry((head)->next, typeof(*pos), member); \
prefetch(pos->member.next), &pos->member != (head); \
pos = list_entry(pos->member.next, typeof(*pos), member))
/**
* list_for_each_entry_reverse - iterate backwards over list of given type.
* @pos: the type * to use as a loop cursor.
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*/
#define list_for_each_entry_reverse(pos, head, member) \
for (pos = list_entry((head)->prev, typeof(*pos), member); \
prefetch(pos->member.prev), &pos->member != (head); \
pos = list_entry(pos->member.prev, typeof(*pos), member))
/**
* list_prepare_entry - prepare a pos entry for use in list_for_each_entry_continue()
* @pos: the type * to use as a start point
* @head: the head of the list
* @member: the name of the list_struct within the struct.
*
* Prepares a pos entry for use as a start point in list_for_each_entry_continue().
*/
#define list_prepare_entry(pos, head, member) \
((pos) ? : list_entry(head, typeof(*pos), member))
/**
* list_for_each_entry_continue - continue iteration over list of given type
* @pos: the type * to use as a loop cursor.
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*
* Continue to iterate over list of given type, continuing after
* the current position.
*/
#define list_for_each_entry_continue(pos, head, member) \
for (pos = list_entry(pos->member.next, typeof(*pos), member); \
prefetch(pos->member.next), &pos->member != (head); \
pos = list_entry(pos->member.next, typeof(*pos), member))
/**
* list_for_each_entry_continue_reverse - iterate backwards from the given point
* @pos: the type * to use as a loop cursor.
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*
* Start to iterate over list of given type backwards, continuing after
* the current position.
*/
#define list_for_each_entry_continue_reverse(pos, head, member) \
for (pos = list_entry(pos->member.prev, typeof(*pos), member); \
prefetch(pos->member.prev), &pos->member != (head); \
pos = list_entry(pos->member.prev, typeof(*pos), member))
/**
* list_for_each_entry_from - iterate over list of given type from the current point
* @pos: the type * to use as a loop cursor.
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*
* Iterate over list of given type, continuing from current position.
*/
#define list_for_each_entry_from(pos, head, member) \
for (; prefetch(pos->member.next), &pos->member != (head); \
pos = list_entry(pos->member.next, typeof(*pos), member))
/**
* list_for_each_entry_safe - iterate over list of given type safe against removal of list entry
* @pos: the type * to use as a loop cursor.
* @n: another type * to use as temporary storage
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*/
#define list_for_each_entry_safe(pos, n, head, member) \
for (pos = list_entry((head)->next, typeof(*pos), member), \
n = list_entry(pos->member.next, typeof(*pos), member); \
&pos->member != (head); \
pos = n, n = list_entry(n->member.next, typeof(*n), member))
/**
* list_for_each_entry_safe_continue
* @pos: the type * to use as a loop cursor.
* @n: another type * to use as temporary storage
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*
* Iterate over list of given type, continuing after current point,
* safe against removal of list entry.
*/
#define list_for_each_entry_safe_continue(pos, n, head, member) \
for (pos = list_entry(pos->member.next, typeof(*pos), member), \
n = list_entry(pos->member.next, typeof(*pos), member); \
&pos->member != (head); \
pos = n, n = list_entry(n->member.next, typeof(*n), member))
/**
* list_for_each_entry_safe_from
* @pos: the type * to use as a loop cursor.
* @n: another type * to use as temporary storage
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*
* Iterate over list of given type from current point, safe against
* removal of list entry.
*/
#define list_for_each_entry_safe_from(pos, n, head, member) \
for (n = list_entry(pos->member.next, typeof(*pos), member); \
&pos->member != (head); \
pos = n, n = list_entry(n->member.next, typeof(*n), member))
/**
* list_for_each_entry_safe_reverse
* @pos: the type * to use as a loop cursor.
* @n: another type * to use as temporary storage
* @head: the head for your list.
* @member: the name of the list_struct within the struct.
*
* Iterate backwards over list of given type, safe against removal
* of list entry.
*/
#define list_for_each_entry_safe_reverse(pos, n, head, member) \
for (pos = list_entry((head)->prev, typeof(*pos), member), \
n = list_entry(pos->member.prev, typeof(*pos), member); \
&pos->member != (head); \
pos = n, n = list_entry(n->member.prev, typeof(*n), member))
/*
* Double linked lists with a single pointer list head.
* Mostly useful for hash tables where the two pointer list head is
* too wasteful.
* You lose the ability to access the tail in O(1).
*/
struct hlist_head {
struct hlist_node *first;
};
struct hlist_node {
struct hlist_node *next, **pprev;
};
#define HLIST_HEAD_INIT { .first = NULL }
#define HLIST_HEAD(name) struct hlist_head name = { .first = NULL }
#define init_hlist_head(ptr) ((ptr)->first = NULL)
static inline void init_hlist_node(struct hlist_node *h)
{
h->next = NULL;
h->pprev = NULL;
}
static inline int hlist_unhashed(const struct hlist_node *h)
{
return !h->pprev;
}
static inline int hlist_empty(const struct hlist_head *h)
{
return !h->first;
}
static inline void __hlist_del(struct hlist_node *n)
{
struct hlist_node *next = n->next;
struct hlist_node **pprev = n->pprev;
*pprev = next;
if (next)
next->pprev = pprev;
}
static inline void hlist_del(struct hlist_node *n)
{
__hlist_del(n);
n->next = LIST_POISON1;
n->pprev = LIST_POISON2;
}
static inline void hlist_del_init(struct hlist_node *n)
{
if (!hlist_unhashed(n)) {
__hlist_del(n);
init_hlist_node(n);
}
}
static inline void hlist_add_head(struct hlist_node *n, struct hlist_head *h)
{
struct hlist_node *first = h->first;
n->next = first;
if (first)
first->pprev = &n->next;
h->first = n;
n->pprev = &h->first;
}
/* next must be != NULL */
static inline void hlist_add_before(struct hlist_node *n,
struct hlist_node *next)
{
n->pprev = next->pprev;
n->next = next;
next->pprev = &n->next;
*(n->pprev) = n;
}
static inline void hlist_add_after(struct hlist_node *n,
struct hlist_node *next)
{
next->next = n->next;
n->next = next;
next->pprev = &n->next;
if(next->next)
next->next->pprev = &next->next;
}
#define hlist_entry(ptr, type, member) container_of(ptr,type,member)
#define hlist_for_each(pos, head) \
for (pos = (head)->first; pos && ({ prefetch(pos->next); 1; }); \
pos = pos->next)
#define hlist_for_each_safe(pos, n, head) \
for (pos = (head)->first; pos && ({ n = pos->next; 1; }); \
pos = n)
/**
* hlist_for_each_entry - iterate over list of given type
* @tpos: the type * to use as a loop cursor.
* @pos: the &struct hlist_node to use as a loop cursor.
* @head: the head for your list.
* @member: the name of the hlist_node within the struct.
*/
#define hlist_for_each_entry(tpos, pos, head, member) \
for (pos = (head)->first; \
pos && ({ prefetch(pos->next); 1;}) && \
({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
pos = pos->next)
/**
* hlist_for_each_entry_continue - iterate over a hlist continuing after current point
* @tpos: the type * to use as a loop cursor.
* @pos: the &struct hlist_node to use as a loop cursor.
* @member: the name of the hlist_node within the struct.
*/
#define hlist_for_each_entry_continue(tpos, pos, member) \
for (pos = (pos)->next; \
pos && ({ prefetch(pos->next); 1;}) && \
({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
pos = pos->next)
/**
* hlist_for_each_entry_from - iterate over a hlist continuing from current point
* @tpos: the type * to use as a loop cursor.
* @pos: the &struct hlist_node to use as a loop cursor.
* @member: the name of the hlist_node within the struct.
*/
#define hlist_for_each_entry_from(tpos, pos, member) \
for (; pos && ({ prefetch(pos->next); 1;}) && \
({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
pos = pos->next)
/**
* hlist_for_each_entry_safe - iterate over list of given type safe against removal of list entry
* @tpos: the type * to use as a loop cursor.
* @pos: the &struct hlist_node to use as a loop cursor.
* @n: another &struct hlist_node to use as temporary storage
* @head: the head for your list.
* @member: the name of the hlist_node within the struct.
*/
#define hlist_for_each_entry_safe(tpos, pos, n, head, member) \
for (pos = (head)->first; \
pos && ({ n = pos->next; 1; }) && \
({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
pos = n)
#endif
nftlb-0.5/include/network.h 0000664 0000000 0000000 00000002557 13475421131 0015762 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
*/
#ifndef LIB_NFTABLES_H
#define LIB_NFTABLES_H
#define _GNU_SOURCE
#include
#include
#include
#ifdef __cplusplus
extern "C" {
#endif
struct nft_ctx;
enum nft_debug_level {
NFT_DEBUG_SCANNER = 0x1,
NFT_DEBUG_PARSER = 0x2,
NFT_DEBUG_EVALUATION = 0x4,
NFT_DEBUG_NETLINK = 0x8,
NFT_DEBUG_MNL = 0x10,
NFT_DEBUG_PROTO_CTX = 0x20,
NFT_DEBUG_SEGTREE = 0x40,
};
/**
* Possible flags to pass to nft_ctx_new()
*/
#define NFT_CTX_DEFAULT 0
struct nft_ctx *nft_ctx_new(uint32_t flags);
void nft_ctx_free(struct nft_ctx *ctx);
bool nft_ctx_get_dry_run(struct nft_ctx *ctx);
void nft_ctx_set_dry_run(struct nft_ctx *ctx, bool dry);
enum {
NFT_CTX_OUTPUT_REVERSEDNS = (1 << 0),
NFT_CTX_OUTPUT_SERVICE = (1 << 1),
NFT_CTX_OUTPUT_STATELESS = (1 << 2),
NFT_CTX_OUTPUT_HANDLE = (1 << 3),
NFT_CTX_OUTPUT_JSON = (1 << 4),
NFT_CTX_OUTPUT_ECHO = (1 << 5),
NFT_CTX_OUTPUT_GUID = (1 << 6),
NFT_CTX_OUTPUT_NUMERIC_PROTO = (1 << 7),
NFT_CTX_OUTPUT_NUMERIC_PRIO = (1 << 8),
NFT_CTX_OUTPUT_NUMERIC_SYMBOL = (1 << 9),
NFT_CTX_OUTPUT_NUMERIC_ALL = (NFT_CTX_OUTPUT_NUMERIC_PROTO |
NFT_CTX_OUTPUT_NUMERIC_PRIO |
NFT_CTX_OUTPUT_NUMERIC_SYMBOL),
};
unsigned int nft_ctx_output_get_flags(struct nft_ctx *ctx);
void nft_ctx_output_set_flags(struct nft_ctx *ctx, unsigned int flags);
unsigned int nft_ctx_output_get_debug(struct nft_ctx *ctx);
void nft_ctx_output_set_debug(struct nft_ctx *ctx, unsigned int mask);
FILE *nft_ctx_set_output(struct nft_ctx *ctx, FILE *fp);
int nft_ctx_buffer_output(struct nft_ctx *ctx);
int nft_ctx_unbuffer_output(struct nft_ctx *ctx);
const char *nft_ctx_get_output_buffer(struct nft_ctx *ctx);
FILE *nft_ctx_set_error(struct nft_ctx *ctx, FILE *fp);
int nft_ctx_buffer_error(struct nft_ctx *ctx);
int nft_ctx_unbuffer_error(struct nft_ctx *ctx);
const char *nft_ctx_get_error_buffer(struct nft_ctx *ctx);
int nft_ctx_add_include_path(struct nft_ctx *ctx, const char *path);
void nft_ctx_clear_include_paths(struct nft_ctx *ctx);
int nft_run_cmd_from_buffer(struct nft_ctx *nft, const char *buf);
int nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename);
#ifdef __cplusplus
} /* extern "C" */
#endif
#endif /* LIB_NFTABLES_H */
nftlb-0.5/include/objects.h 0000664 0000000 0000000 00000007530 13475421131 0015716 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include "backends.h"
#include "farms.h"
#include "objects.h"
#include "network.h"
static struct backend * backend_create(struct farm *f, char *name)
{
struct backend *b = (struct backend *)malloc(sizeof(struct backend));
if (!b) {
syslog(LOG_ERR, "Backend memory allocation error");
return NULL;
}
b->parent = f;
obj_set_attribute_string(name, &b->name);
b->fqdn = DEFAULT_FQDN;
b->ethaddr = DEFAULT_ETHADDR;
b->ipaddr = DEFAULT_IPADDR;
b->port = DEFAULT_PORT;
b->weight = DEFAULT_WEIGHT;
b->priority = DEFAULT_PRIORITY;
b->mark = DEFAULT_MARK;
b->estconnlimit = DEFAULT_ESTCONNLIMIT;
b->state = DEFAULT_BACKEND_STATE;
b->action = DEFAULT_ACTION;
list_add_tail(&b->list, &f->backends);
f->total_bcks++;
return b;
}
static int backend_delete_node(struct backend *b)
{
list_del(&b->list);
if (b->name)
free(b->name);
if (b->fqdn && strcmp(b->fqdn, "") != 0)
free(b->fqdn);
if (b->ipaddr && strcmp(b->ipaddr, "") != 0)
free(b->ipaddr);
if (b->ethaddr && strcmp(b->ethaddr, "") != 0)
free(b->ethaddr);
if (b->port && strcmp(b->port, "") != 0)
free(b->port);
free(b);
return 0;
}
static int backend_delete(struct backend *b)
{
// TODO: Stop backend && reload farm && rulerize()
backend_delete_node(b);
return 0;
}
void backend_s_print(struct farm *f)
{
struct backend *b;
list_for_each_entry(b, &f->backends, list) {
syslog(LOG_DEBUG," [backend] ");
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_NAME, b->name);
if (b->fqdn)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_FQDN, b->fqdn);
if (b->ipaddr)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_IPADDR, b->ipaddr);
if (b->ethaddr)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_ETHADDR, b->ethaddr);
if (b->port)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_PORT, b->port);
syslog(LOG_DEBUG," [%s] 0x%x", CONFIG_KEY_MARK, b->mark);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_ESTCONNLIMIT, b->estconnlimit);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_WEIGHT, b->weight);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_PRIORITY, b->priority);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_STATE, obj_print_state(b->state));
syslog(LOG_DEBUG," *[%s] %d", CONFIG_KEY_ACTION, b->action);
}
}
struct backend * backend_lookup_by_name(struct farm *f, const char *name)
{
struct backend *b;
list_for_each_entry(b, &f->backends, list) {
if (strcmp(b->name, name) == 0)
return b;
}
return NULL;
}
static int backend_set_ipaddr_from_ether(struct backend *b)
{
struct farm *f = b->parent;
int ret = -1;
unsigned char dst_ethaddr[ETH_HW_ADDR_LEN];
unsigned char src_ethaddr[ETH_HW_ADDR_LEN];
char streth[ETH_HW_STR_LEN] = {};
if (!farm_is_ingress_mode(f))
return 0;
if (f->iethaddr == DEFAULT_ETHADDR ||
b->ipaddr == DEFAULT_IPADDR ||
f->ofidx == DEFAULT_IFIDX)
return -1;
sscanf(f->iethaddr, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx", &src_ethaddr[0], &src_ethaddr[1], &src_ethaddr[2], &src_ethaddr[3], &src_ethaddr[4], &src_ethaddr[5]);
ret = net_get_neigh_ether((unsigned char **) &dst_ethaddr, src_ethaddr, f->family, f->virtaddr, b->ipaddr, f->ofidx);
if (ret == 0) {
sprintf(streth, "%02x:%02x:%02x:%02x:%02x:%02x", dst_ethaddr[0],
dst_ethaddr[1], dst_ethaddr[2], dst_ethaddr[3], dst_ethaddr[4], dst_ethaddr[5]);
syslog(LOG_DEBUG, "%s():%d: discovered ether address for %s is %s", __FUNCTION__, __LINE__, b->name, streth);
obj_set_attribute_string(streth, &b->ethaddr);
}
return ret;
}
static int backend_set_weight(struct backend *b, int new_value)
{
struct farm *f = b->parent;
int old_value = b->weight;
syslog(LOG_DEBUG, "%s():%d: current value is %d, but new value will be %d",
__FUNCTION__, __LINE__, old_value, new_value);
b->weight = new_value;
if (backend_is_available(b))
f->total_weight += (b->weight-old_value);
return 0;
}
static int backend_set_estconnlimit(struct backend *b, int new_value)
{
int old_value = b->estconnlimit;
syslog(LOG_DEBUG, "%s():%d: current value is %d, but new value will be %d",
__FUNCTION__, __LINE__, old_value, new_value);
if (new_value == old_value)
return 0;
b->estconnlimit = new_value;
return 0;
}
static int backend_set_priority(struct backend *b, int new_value)
{
struct farm *f = b->parent;
int old_value = b->priority;
syslog(LOG_DEBUG, "%s():%d: current value is %d, but new value will be %d",
__FUNCTION__, __LINE__, old_value, new_value);
if (backend_is_available(b) &&
new_value > f->priority) {
f->bcks_available--;
if (f->bcks_available < 0)
f->bcks_available = 0;
f->total_weight -= b->weight;
if (f->total_weight < 0)
f->total_weight = 0;
}
else if (old_value > f->priority &&
backend_is_available(b)) {
f->bcks_available++;
f->total_weight += b->weight;
}
b->priority = new_value;
return 0;
}
static int backend_s_set_marked(struct farm *f)
{
struct backend *b;
syslog(LOG_DEBUG, "%s():%d: finding marked backends for %s", __FUNCTION__, __LINE__, f->name);
list_for_each_entry(b, &f->backends, list) {
if (b->mark != DEFAULT_MARK) {
f->bcks_are_marked = 1;
return 1;
}
}
f->bcks_are_marked = 0;
return 0;
}
static int backend_s_set_ports(struct farm *f)
{
struct backend *b;
syslog(LOG_DEBUG, "%s():%d: finding backends with port for %s", __FUNCTION__, __LINE__, f->name);
list_for_each_entry(b, &f->backends, list) {
if (strcmp(b->port, DEFAULT_PORT) != 0) {
f->bcks_have_port = 1;
return 1;
}
}
f->bcks_have_port = 0;
return 0;
}
static int backend_set_mark(struct backend *b, int new_value)
{
int old_value = b->mark;
syslog(LOG_DEBUG, "%s():%d: current value is %d, but new value will be %d",
__FUNCTION__, __LINE__, old_value, new_value);
b->mark = new_value;
if (b->mark != DEFAULT_MARK)
b->parent->bcks_are_marked = 1;
else
backend_s_set_marked(b->parent);
return 0;
}
static int backend_set_port(struct backend *b, char *new_value)
{
char *old_value = b->port;
syslog(LOG_DEBUG, "%s():%d: current value is %s, but new value will be %s",
__FUNCTION__, __LINE__, old_value, new_value);
obj_set_attribute_string(new_value, &b->port);
if (strcmp(b->port, DEFAULT_PORT) != 0)
b->parent->bcks_have_port = 1;
else
backend_s_set_ports(b->parent);
return 0;
}
static int backend_set_ipaddr(struct backend *b, char *new_value)
{
char *old_value = b->ipaddr;
syslog(LOG_DEBUG, "%s():%d: current value is %s, but new value will be %s",
__FUNCTION__, __LINE__, old_value, new_value);
obj_set_attribute_string(new_value, &b->ipaddr);
obj_set_attribute_string("", &b->ethaddr);
if (farm_set_ifinfo(b->parent, KEY_OFACE) == -1 ||
backend_set_ipaddr_from_ether(b) == -1) {
syslog(LOG_DEBUG, "%s():%d: backend %s comes to OFF", __FUNCTION__, __LINE__, b->name);
backend_set_state(b, VALUE_STATE_CONFERR);
} else {
if (b->state == VALUE_STATE_CONFERR)
backend_set_state(b, VALUE_STATE_UP);
}
return 0;
}
static int backend_validate(struct backend *b)
{
struct farm *f = b->parent;
syslog(LOG_DEBUG, "%s():%d: validating backend %s of farm %s",
__FUNCTION__, __LINE__, b->name, f->name);
if (farm_is_ingress_mode(f) &&
(!b->ethaddr || strcmp(b->ethaddr, "") == 0))
return 0;
if (!b->ipaddr || strcmp(b->ipaddr, "") == 0)
return 0;
return 1;
}
static int backend_is_usable(struct backend *b)
{
struct farm *f = b->parent;
syslog(LOG_DEBUG, "%s():%d: backend %s state is %s and priority %d",
__FUNCTION__, __LINE__, b->name, obj_print_state(b->state), b->priority);
return (b->state == VALUE_STATE_UP) &&
(b->priority <= f->priority);
}
int backend_is_available(struct backend *b)
{
syslog(LOG_DEBUG, "%s():%d: backend %s state is %s and priority %d",
__FUNCTION__, __LINE__, b->name, obj_print_state(b->state), b->priority);
return (backend_is_usable(b) &&
backend_validate(b));
}
int backend_set_action(struct backend *b, int action)
{
int is_actionated = 0;
syslog(LOG_DEBUG, "%s():%d: bck %s action %d state %d - new action %d",
__FUNCTION__, __LINE__, b->name, b->action, b->state, action);
if (action == ACTION_DELETE) {
backend_delete(b);
return 1;
}
if (action == ACTION_STOP) {
if (b->state == VALUE_STATE_UP)
{
b->action = action;
is_actionated = 1;
}
backend_set_state(b, VALUE_STATE_OFF);
return is_actionated;
}
if (action == ACTION_START) {
if (b->state != VALUE_STATE_UP)
{
b->action = action;
is_actionated = 1;
}
backend_set_state(b, VALUE_STATE_UP);
return is_actionated;
}
if (b->action > action) {
b->action = action;
return 1;
}
return is_actionated;
}
int backend_s_set_action(struct farm *f, int action)
{
struct backend *b, *next;
list_for_each_entry_safe(b, next, &f->backends, list)
backend_set_action(b, action);
return 0;
}
int backend_s_delete(struct farm *f)
{
struct backend *b, *next;
list_for_each_entry_safe(b, next, &f->backends, list)
backend_delete(b);
f->total_bcks = 0;
f->bcks_available = 0;
f->total_weight = 0;
return 0;
}
int backend_s_validate(struct farm *f)
{
struct backend *b, *next;
int valid = 0;
list_for_each_entry_safe(b, next, &f->backends, list) {
valid = backend_validate(b);
if (b->state == VALUE_STATE_CONFERR && valid)
backend_set_state(b, VALUE_STATE_UP);
}
return 0;
}
int backend_set_attribute(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct backend *b;
if (!cur->fptr)
return PARSER_OBJ_UNKNOWN;
if (c->key != KEY_NAME && !cur->bptr)
return PARSER_OBJ_UNKNOWN;
b = cur->bptr;
switch (c->key) {
case KEY_NAME:
b = backend_lookup_by_name(cur->fptr, c->str_value);
if (!b) {
b = backend_create(cur->fptr, c->str_value);
if (!b)
return -1;
}
cur->bptr = b;
break;
case KEY_NEWNAME:
obj_set_attribute_string(c->str_value, &b->name);
break;
case KEY_FQDN:
obj_set_attribute_string(c->str_value, &b->fqdn);
break;
case KEY_IPADDR:
backend_set_ipaddr(b, c->str_value);
break;
case KEY_ETHADDR:
obj_set_attribute_string(c->str_value, &b->ethaddr);
break;
case KEY_PORT:
backend_set_port(b, c->str_value);
break;
case KEY_WEIGHT:
backend_set_weight(b, c->int_value);
break;
case KEY_PRIORITY:
backend_set_priority(b, c->int_value);
break;
case KEY_MARK:
backend_set_mark(b, c->int_value);
break;
case KEY_STATE:
backend_set_state(b, c->int_value);
break;
case KEY_ESTCONNLIMIT:
backend_set_estconnlimit(b, c->int_value);
break;
case KEY_ACTION:
backend_set_action(b, c->int_value);
break;
default:
return -1;
}
return PARSER_OK;
}
static int backend_switch(struct backend *b, int new_state)
{
struct farm *f = b->parent;
syslog(LOG_DEBUG, "%s():%d: backend %s switched to %s",
__FUNCTION__, __LINE__, b->name, obj_print_state(new_state));
if (b->state == VALUE_STATE_UP) {
f->total_weight += b->weight;
f->bcks_available++;
b->action = ACTION_START;
farm_set_action(f, ACTION_RELOAD);
} else {
f->total_weight -= b->weight;
if (f->total_weight < 0)
f->total_weight = 0;
f->bcks_available--;
if (f->bcks_available < 0)
f->bcks_available = 0;
b->action = ACTION_STOP;
farm_set_action(f, ACTION_RELOAD);
}
return 0;
}
int backend_set_state(struct backend *b, int new_value)
{
int old_value = b->state;
syslog(LOG_DEBUG, "%s():%d: backend %s current value is %s, but new value will be %s",
__FUNCTION__, __LINE__, b->name, obj_print_state(old_value), obj_print_state(new_value));
if (old_value == new_value)
return 0;
switch (new_value) {
case VALUE_STATE_UP:
b->state = new_value;
if (!backend_validate(b)) {
b->state = VALUE_STATE_CONFERR;
return 0;
}
if (backend_is_usable(b))
backend_switch(b, new_value);
break;
default:
if (backend_is_usable(b)) {
b->state = new_value;
backend_switch(b, new_value);
} else
b->state = new_value;
break;
}
return 0;
}
int backend_s_set_ether_by_ipaddr(struct farm *f, const char *ip_bck, char *ether_bck)
{
struct backend *b;
int changed = 0;
list_for_each_entry(b, &f->backends, list) {
if (strcmp(b->ipaddr, ip_bck) != 0)
continue;
syslog(LOG_DEBUG, "%s():%d: backend with ip address %s found", __FUNCTION__, __LINE__, ip_bck);
if (!b->ethaddr || (b->ethaddr && strcmp(b->ethaddr, ether_bck) != 0)) {
obj_set_attribute_string(ether_bck, &b->ethaddr);
backend_set_state(b, VALUE_STATE_UP);
changed = 1;
syslog(LOG_INFO, "%s():%d: ether address changed for backend %s with %s", __FUNCTION__, __LINE__, b->name, ether_bck);
}
}
return changed;
}
int backend_s_find_ethers(struct farm *f)
{
struct backend *b;
int changed = 0;
syslog(LOG_DEBUG, "%s():%d: finding backends for %s", __FUNCTION__, __LINE__, f->name);
list_for_each_entry(b, &f->backends, list) {
if (!backend_is_usable(b) || backend_validate(b))
continue;
if (backend_set_ipaddr_from_ether(b) == -1)
backend_set_state(b, VALUE_STATE_CONFERR);
else
backend_set_state(b, VALUE_STATE_UP);
}
return changed;
}
struct backend * backend_get_first(struct farm *f)
{
if (list_empty(&f->backends))
return NULL;
return list_first_entry(&f->backends, struct backend, list);
}
int bck_pre_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farm *f;
struct backend *b;
if (!cur->fptr || !cur->bptr)
return -1;
f = cur->fptr;
b = cur->bptr;
syslog(LOG_DEBUG, "%s():%d: pre actionable backend %s of farm %s with param %d", __FUNCTION__, __LINE__, b->name, f->name, c->key);
if (b->state != VALUE_STATE_UP && c->key != KEY_STATE)
return 1;
switch (c->key) {
case KEY_NAME:
break;
case KEY_ETHADDR:
case KEY_IPADDR:
case KEY_PORT:
case KEY_PRIORITY:
case KEY_ESTCONNLIMIT:
if (backend_set_action(b, ACTION_STOP) &&
farm_set_action(f, ACTION_RELOAD)) {
farm_rulerize(f);
}
break;
case KEY_STATE:
case KEY_MARK:
case KEY_WEIGHT:
default:
break;
}
return 0;
}
int bck_pos_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farm *f;
struct backend *b;
if (!cur->fptr || !cur->bptr)
return -1;
f = cur->fptr;
b = cur->bptr;
syslog(LOG_DEBUG, "%s():%d: pos actionable backend %s of farm %s with param %d", __FUNCTION__, __LINE__, b->name, f->name, c->key);
switch (c->key) {
case KEY_NAME:
break;
case KEY_ETHADDR:
case KEY_IPADDR:
case KEY_PORT:
case KEY_PRIORITY:
case KEY_ESTCONNLIMIT:
if (backend_set_action(b, ACTION_START) &&
farm_set_action(f, ACTION_RELOAD)) {
farm_rulerize(f);
}
break;
case KEY_STATE:
case KEY_MARK:
case KEY_WEIGHT:
farm_set_action(f, ACTION_RELOAD);
break;
default:
break;
}
return 0;
}
nftlb-0.5/src/config.c 0000664 0000000 0000000 00000056105 13475421131 0014673 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include
#include
#include
#include "config.h"
#include "farms.h"
#include "backends.h"
#include "farmpolicy.h"
#include "policies.h"
#include "elements.h"
#define CONFIG_MAXBUF 4096
static int config_json(json_t *element, int level, int source, int key);
struct config_pair c;
static void init_pair(struct config_pair *c)
{
c->level = -1;
c->key = -1;
c->str_value = NULL;
c->int_value = -1;
}
static void config_dump_int(char *buf, int value)
{
sprintf(buf, "%d", value);
}
static void config_dump_hex(char *buf, int value)
{
sprintf(buf, "0x%x", value);
}
static int config_value_family(const char *value)
{
if (strcmp(value, CONFIG_VALUE_FAMILY_IPV4) == 0)
return VALUE_FAMILY_IPV4;
if (strcmp(value, CONFIG_VALUE_FAMILY_IPV6) == 0)
return VALUE_FAMILY_IPV6;
if (strcmp(value, CONFIG_VALUE_FAMILY_INET) == 0)
return VALUE_FAMILY_INET;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_FAMILY_IPV4;
}
static int config_value_mode(const char *value)
{
if (strcmp(value, CONFIG_VALUE_MODE_SNAT) == 0)
return VALUE_MODE_SNAT;
if (strcmp(value, CONFIG_VALUE_MODE_DNAT) == 0)
return VALUE_MODE_DNAT;
if (strcmp(value, CONFIG_VALUE_MODE_DSR) == 0)
return VALUE_MODE_DSR;
if (strcmp(value, CONFIG_VALUE_MODE_STLSDNAT) == 0)
return VALUE_MODE_STLSDNAT;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_MODE_SNAT;
}
static int config_value_proto(const char *value)
{
if (strcmp(value, CONFIG_VALUE_PROTO_TCP) == 0)
return VALUE_PROTO_TCP;
if (strcmp(value, CONFIG_VALUE_PROTO_UDP) == 0)
return VALUE_PROTO_UDP;
if (strcmp(value, CONFIG_VALUE_PROTO_SCTP) == 0)
return VALUE_PROTO_SCTP;
if (strcmp(value, CONFIG_VALUE_PROTO_ALL) == 0)
return VALUE_PROTO_ALL;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_PROTO_TCP;
}
static int config_value_sched(const char *value)
{
if (strcmp(value, CONFIG_VALUE_SCHED_RR) == 0)
return VALUE_SCHED_RR;
if (strcmp(value, CONFIG_VALUE_SCHED_WEIGHT) == 0)
return VALUE_SCHED_WEIGHT;
if (strcmp(value, CONFIG_VALUE_SCHED_HASH) == 0)
return VALUE_SCHED_HASH;
if (strcmp(value, CONFIG_VALUE_SCHED_SYMHASH) == 0)
return VALUE_SCHED_SYMHASH;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_SCHED_RR;
}
static int config_value_meta(const char *value)
{
int mask = 0;
if (strstr(value, CONFIG_VALUE_META_NONE) != NULL) {
mask = VALUE_META_NONE;
return mask;
}
if (strstr(value, CONFIG_VALUE_META_SRCIP) != NULL)
mask |= VALUE_META_SRCIP;
if (strstr(value, CONFIG_VALUE_META_DSTIP) != NULL)
mask |= VALUE_META_DSTIP;
if (strstr(value, CONFIG_VALUE_META_SRCPORT) != NULL)
mask |= VALUE_META_SRCPORT;
if (strstr(value, CONFIG_VALUE_META_DSTPORT) != NULL)
mask |= VALUE_META_DSTPORT;
if (strstr(value, CONFIG_VALUE_META_SRCMAC) != NULL)
mask |= VALUE_META_SRCMAC;
if (strstr(value, CONFIG_VALUE_META_DSTMAC) != NULL)
mask |= VALUE_META_DSTMAC;
return mask;
}
static int config_value_helper(const char *value)
{
if (strcmp(value, CONFIG_VALUE_HELPER_NONE) == 0)
return VALUE_HELPER_NONE;
if (strcmp(value, CONFIG_VALUE_HELPER_AMANDA) == 0)
return VALUE_HELPER_AMANDA;
if (strcmp(value, CONFIG_VALUE_HELPER_FTP) == 0)
return VALUE_HELPER_FTP;
if (strcmp(value, CONFIG_VALUE_HELPER_H323) == 0)
return VALUE_HELPER_H323;
if (strcmp(value, CONFIG_VALUE_HELPER_IRC) == 0)
return VALUE_HELPER_IRC;
if (strcmp(value, CONFIG_VALUE_HELPER_NETBIOSNS) == 0)
return VALUE_HELPER_NETBIOSNS;
if (strcmp(value, CONFIG_VALUE_HELPER_PPTP) == 0)
return VALUE_HELPER_PPTP;
if (strcmp(value, CONFIG_VALUE_HELPER_SANE) == 0)
return VALUE_HELPER_SANE;
if (strcmp(value, CONFIG_VALUE_HELPER_SIP) == 0)
return VALUE_HELPER_SIP;
if (strcmp(value, CONFIG_VALUE_HELPER_SNMP) == 0)
return VALUE_HELPER_SNMP;
if (strcmp(value, CONFIG_VALUE_HELPER_TFTP) == 0)
return VALUE_HELPER_TFTP;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_HELPER_NONE;
}
static int config_value_log(const char *value)
{
int logmask = 0;
if (strstr(value, CONFIG_VALUE_LOG_NONE) != NULL) {
logmask = VALUE_LOG_NONE;
return logmask;
}
if (strstr(value, CONFIG_VALUE_LOG_INPUT) != NULL)
logmask |= VALUE_LOG_INPUT;
if (strstr(value, CONFIG_VALUE_LOG_FORWARD) != NULL)
logmask |= VALUE_LOG_FORWARD;
if (strstr(value, CONFIG_VALUE_LOG_OUTPUT) != NULL)
logmask |= VALUE_LOG_OUTPUT;
return logmask;
}
static int config_value_switch(const char *value)
{
if (strcmp(value, CONFIG_VALUE_SWITCH_ON) == 0)
return VALUE_SWITCH_ON;
else
return VALUE_SWITCH_OFF;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_SWITCH_OFF;
}
static int config_value_state(const char *value)
{
if (strcmp(value, CONFIG_VALUE_STATE_UP) == 0)
return VALUE_STATE_UP;
if (strcmp(value, CONFIG_VALUE_STATE_DOWN) == 0)
return VALUE_STATE_DOWN;
if (strcmp(value, CONFIG_VALUE_STATE_OFF) == 0)
return VALUE_STATE_OFF;
if (strcmp(value, CONFIG_VALUE_STATE_CONFERR) == 0)
return VALUE_STATE_CONFERR;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_STATE_UP;
}
static int config_value_action(const char *value)
{
if (strcmp(value, CONFIG_VALUE_ACTION_STOP) == 0)
return ACTION_STOP;
if (strcmp(value, CONFIG_VALUE_ACTION_DELETE) == 0)
return ACTION_DELETE;
if (strcmp(value, CONFIG_VALUE_ACTION_START) == 0)
return ACTION_START;
if (strcmp(value, CONFIG_VALUE_ACTION_RELOAD) == 0)
return ACTION_RELOAD;
return ACTION_NONE;
}
static int config_value_type(const char *value)
{
if (strcmp(value, CONFIG_VALUE_POLICIES_TYPE_BL) == 0)
return VALUE_TYPE_BLACK;
if (strcmp(value, CONFIG_VALUE_POLICIES_TYPE_WL) == 0)
return VALUE_TYPE_WHITE;
syslog(LOG_INFO, "%s():%d: parsing unknown value'%s', using defaults", __FUNCTION__, __LINE__, value);
return VALUE_TYPE_BLACK;
}
static int config_value(const char *value)
{
int ret = PARSER_VALID_FAILED;
int new_int_value;
switch(c.key) {
case KEY_FAMILY:
c.int_value = config_value_family(value);
ret = PARSER_OK;
break;
case KEY_MODE:
c.int_value = config_value_mode(value);
ret = PARSER_OK;
break;
case KEY_PROTO:
c.int_value = config_value_proto(value);
ret = PARSER_OK;
break;
case KEY_SCHED:
c.int_value = config_value_sched(value);
ret = PARSER_OK;
break;
case KEY_SCHEDPARAM:
case KEY_PERSISTENCE:
c.int_value = config_value_meta(value);
ret = PARSER_OK;
break;
case KEY_HELPER:
c.int_value = config_value_helper(value);
ret = PARSER_OK;
break;
case KEY_LOG:
c.int_value = config_value_log(value);
ret = PARSER_OK;
break;
case KEY_MARK:
c.int_value = (int)strtol(value, NULL, 16);
ret = PARSER_OK;
break;
case KEY_STATE:
c.int_value = config_value_state(value);
ret = PARSER_OK;
break;
case KEY_WEIGHT:
case KEY_PRIORITY:
new_int_value = atoi(value);
if (new_int_value >= 1) {
c.int_value = new_int_value;
ret = PARSER_OK;
}
break;
case KEY_PERSISTTM:
case KEY_NEWRTLIMIT:
case KEY_NEWRTLIMITBURST:
case KEY_RSTRTLIMIT:
case KEY_RSTRTLIMITBURST:
case KEY_ESTCONNLIMIT:
case KEY_TIMEOUT:
new_int_value = atoi(value);
if (new_int_value >= 0) {
c.int_value = new_int_value;
ret = PARSER_OK;
}
break;
case KEY_QUEUE:
new_int_value = atoi(value);
if (new_int_value >= -1) {
c.int_value = new_int_value;
ret = PARSER_OK;
}
break;
case KEY_ACTION:
c.int_value = config_value_action(value);
ret = PARSER_OK;
break;
case KEY_TCPSTRICT:
c.int_value = config_value_switch(value);
ret = PARSER_OK;
break;
case KEY_TYPE:
c.int_value = config_value_type(value);
ret = PARSER_OK;
break;
case KEY_NAME:
case KEY_NEWNAME:
case KEY_IFACE:
case KEY_OFACE:
case KEY_ETHADDR:
case KEY_VIRTADDR:
case KEY_VIRTPORTS:
case KEY_IPADDR:
case KEY_SRCADDR:
case KEY_PORT:
case KEY_DATA:
c.str_value = (char *)value;
ret = PARSER_OK;
break;
default:
syslog(LOG_ERR, "%s():%d: unknown parsed key %d", __FUNCTION__, __LINE__, c.key);
ret = PARSER_OBJ_UNKNOWN;
break;
}
return ret;
}
static int config_key(const char *key)
{
if (strcmp(key, CONFIG_KEY_FARMS) == 0)
return KEY_FARMS;
if (strcmp(key, CONFIG_KEY_NAME) == 0)
return KEY_NAME;
if (strcmp(key, CONFIG_KEY_NEWNAME) == 0)
return KEY_NEWNAME;
if (strcmp(key, CONFIG_KEY_FQDN) == 0)
return KEY_FQDN;
if (strcmp(key, CONFIG_KEY_IFACE) == 0)
return KEY_IFACE;
if (strcmp(key, CONFIG_KEY_OFACE) == 0)
return KEY_OFACE;
if (strcmp(key, CONFIG_KEY_FAMILY) == 0)
return KEY_FAMILY;
if (strcmp(key, CONFIG_KEY_ETHADDR) == 0)
return KEY_ETHADDR;
if (strcmp(key, CONFIG_KEY_VIRTADDR) == 0)
return KEY_VIRTADDR;
if (strcmp(key, CONFIG_KEY_VIRTPORTS) == 0)
return KEY_VIRTPORTS;
if (strcmp(key, CONFIG_KEY_IPADDR) == 0)
return KEY_IPADDR;
if (strcmp(key, CONFIG_KEY_SRCADDR) == 0)
return KEY_SRCADDR;
if (strcmp(key, CONFIG_KEY_PORT) == 0)
return KEY_PORT;
if (strcmp(key, CONFIG_KEY_MODE) == 0)
return KEY_MODE;
if (strcmp(key, CONFIG_KEY_PROTO) == 0)
return KEY_PROTO;
if (strcmp(key, CONFIG_KEY_SCHED) == 0)
return KEY_SCHED;
if (strcmp(key, CONFIG_KEY_SCHEDPARAM) == 0)
return KEY_SCHEDPARAM;
if (strcmp(key, CONFIG_KEY_PERSIST) == 0)
return KEY_PERSISTENCE;
if (strcmp(key, CONFIG_KEY_PERSISTTM) == 0)
return KEY_PERSISTTM;
if (strcmp(key, CONFIG_KEY_HELPER) == 0)
return KEY_HELPER;
if (strcmp(key, CONFIG_KEY_LOG) == 0)
return KEY_LOG;
if (strcmp(key, CONFIG_KEY_MARK) == 0)
return KEY_MARK;
if (strcmp(key, CONFIG_KEY_STATE) == 0)
return KEY_STATE;
if (strcmp(key, CONFIG_KEY_BCKS) == 0)
return KEY_BCKS;
if (strcmp(key, CONFIG_KEY_WEIGHT) == 0)
return KEY_WEIGHT;
if (strcmp(key, CONFIG_KEY_PRIORITY) == 0)
return KEY_PRIORITY;
if (strcmp(key, CONFIG_KEY_ACTION) == 0)
return KEY_ACTION;
if (strcmp(key, CONFIG_KEY_NEWRTLIMIT) == 0)
return KEY_NEWRTLIMIT;
if (strcmp(key, CONFIG_KEY_NEWRTLIMITBURST) == 0)
return KEY_NEWRTLIMITBURST;
if (strcmp(key, CONFIG_KEY_RSTRTLIMIT) == 0)
return KEY_RSTRTLIMIT;
if (strcmp(key, CONFIG_KEY_RSTRTLIMITBURST) == 0)
return KEY_RSTRTLIMITBURST;
if (strcmp(key, CONFIG_KEY_ESTCONNLIMIT) == 0)
return KEY_ESTCONNLIMIT;
if (strcmp(key, CONFIG_KEY_TCPSTRICT) == 0)
return KEY_TCPSTRICT;
if (strcmp(key, CONFIG_KEY_QUEUE) == 0)
return KEY_QUEUE;
if (strcmp(key, CONFIG_KEY_POLICIES) == 0)
return KEY_POLICIES;
if (strcmp(key, CONFIG_KEY_TYPE) == 0)
return KEY_TYPE;
if (strcmp(key, CONFIG_KEY_TIMEOUT) == 0)
return KEY_TIMEOUT;
if (strcmp(key, CONFIG_KEY_ELEMENTS) == 0)
return KEY_ELEMENTS;
if (strcmp(key, CONFIG_KEY_DATA) == 0)
return KEY_DATA;
if (strcmp(key, CONFIG_KEY_TIME) == 0)
return KEY_TIME;
syslog(LOG_ERR, "%s():%d: unknown key '%s'", __FUNCTION__, __LINE__, key);
return -1;
}
static int jump_config_value(int level, int key)
{
if ((level == LEVEL_INIT && key != KEY_FARMS && key != KEY_POLICIES) ||
(key == KEY_BCKS && level != LEVEL_FARMS) ||
(key == KEY_POLICIES && level != LEVEL_FARMS && level != LEVEL_INIT) ||
(key == KEY_ELEMENTS && level != LEVEL_POLICIES))
return -1;
return 0;
}
static int config_json_object(json_t *element, int level, int source)
{
const char *key;
json_t *value;
int ret = PARSER_OK;
json_object_foreach(element, key, value) {
c.level = level;
c.key = config_key(key);
if (ret)
return ret;
if (jump_config_value(level, c.key) == 0) {
ret = config_json(value, level, source, c.key);
if (ret) {
syslog(LOG_ERR, "%s():%d: error parsing object in level %d", __FUNCTION__, __LINE__, c.level);
return ret;
}
}
}
return ret;
}
static int config_json_array(json_t *element, int level, int source)
{
size_t size = json_array_size(element);
size_t i;
int ret = PARSER_OK;
for (i = 0; i < size && ret == PARSER_OK; i++) {
ret = config_json(json_array_get(element, i), level, source, -1);
}
return ret;
}
static int config_json_string(json_t *element, int level, int source)
{
int ret;
ret = config_value(json_string_value(element));
if (ret != PARSER_OK)
return ret;
syslog(LOG_DEBUG, "%s():%d: %d(level) %d(key) %s(value) %d(value)", __FUNCTION__, __LINE__, c.level, c.key, c.str_value, c.int_value);
ret = obj_set_attribute(&c, source);
init_pair(&c);
return ret;
}
static int config_json(json_t *element, int level, int source, int key)
{
int ret = PARSER_OK;
syslog(LOG_DEBUG, "%s():%d: %d(level) %d(source)", __FUNCTION__, __LINE__, level, source);
switch (json_typeof(element)) {
case JSON_OBJECT:
ret = config_json_object(element, level, source);
break;
case JSON_ARRAY:
if (level == LEVEL_INIT && key == KEY_FARMS)
level = LEVEL_FARMS;
if (level == LEVEL_INIT && key == KEY_POLICIES)
level = LEVEL_POLICIES;
if (level == LEVEL_FARMS && key == KEY_BCKS)
level = LEVEL_BCKS;
if (level == LEVEL_FARMS && key == KEY_POLICIES)
level = LEVEL_FARMPOLICY;
if (level == LEVEL_POLICIES && key == KEY_ELEMENTS)
level = LEVEL_ELEMENTS;
ret = config_json_array(element, level, source);
if (level == LEVEL_FARMS || level == LEVEL_POLICIES)
level = LEVEL_INIT;
if (level == LEVEL_BCKS || level == LEVEL_FARMPOLICY)
level = LEVEL_FARMS;
if (level == LEVEL_ELEMENTS)
level = LEVEL_POLICIES;
break;
case JSON_STRING:
ret = config_json_string(element, level, source);
break;
default:
fprintf(stderr, "Configuration file unknown element type %d\n", json_typeof(element));
syslog(LOG_ERR, "Configuration file unknown element type %d", json_typeof(element));
}
return ret;
}
void config_pair_init(struct config_pair *c)
{
if (!c)
return;
c->level = -1;
c->key = -1;
c->str_value = NULL;
c->int_value = -1;
}
int config_file(const char *file)
{
FILE *fd;
json_error_t error;
json_t *root;
int ret = PARSER_OK;
fd = fopen(file, "r");
if (fd == NULL) {
fprintf(stderr, "Error open configuration file %s\n", file);
syslog(LOG_ERR, "Error open configuration file %s", file);
return PARSER_FAILED;
}
root = json_loadf(fd, JSON_ALLOW_NUL, &error);
if (root) {
ret = config_json(root, LEVEL_INIT, CONFIG_SRC_FILE, -1);
json_decref(root);
} else {
fprintf(stderr, "Configuration file error '%s' on line %d: %s", file, error.line, error.text);
syslog(LOG_ERR, "Configuration file error '%s' on line %d: %s", file, error.line, error.text);
ret = PARSER_FAILED;
}
fclose(fd);
return ret;
}
int config_buffer(const char *buf)
{
json_error_t error;
json_t *root;
int ret = PARSER_OK;
syslog(LOG_NOTICE, "%s():%d: received buffer %d : %s", __FUNCTION__, __LINE__, (int)strlen(buf), buf);
root = json_loadb(buf, strlen(buf), JSON_ALLOW_NUL, &error);
if (root) {
ret = config_json(root, LEVEL_INIT, CONFIG_SRC_BUFFER, -1);
json_decref(root);
} else {
syslog(LOG_ERR, "Configuration error on line %d: %s", error.line, error.text);
ret = PARSER_FAILED;
}
return ret;
}
static void add_dump_obj(json_t *obj, const char *name, char *value)
{
if (value == NULL)
return;
json_object_set_new(obj, name, json_string(value));
}
static void add_dump_list(json_t *obj, const char *objname, int object,
struct list_head *head, char *name)
{
struct farm *f;
struct backend *b;
struct farmpolicy *fp;
struct policy *p;
struct element *e;
json_t *jarray = json_array();
json_t *item;
char value[10];
char buf[100] = {};
switch (object) {
case LEVEL_FARMS:
list_for_each_entry(f, head, list) {
if (name != NULL && (strcmp(name, "") != 0) && (strcmp(f->name, name) != 0))
continue;
item = json_object();
add_dump_obj(item, CONFIG_KEY_NAME, f->name);
add_dump_obj(item, CONFIG_KEY_FAMILY, obj_print_family(f->family));
add_dump_obj(item, CONFIG_KEY_VIRTADDR, f->virtaddr);
add_dump_obj(item, CONFIG_KEY_VIRTPORTS, f->virtports);
if (f->srcaddr)
add_dump_obj(item, CONFIG_KEY_SRCADDR, f->srcaddr);
else
add_dump_obj(item, CONFIG_KEY_SRCADDR, "");
add_dump_obj(item, CONFIG_KEY_MODE, obj_print_mode(f->mode));
add_dump_obj(item, CONFIG_KEY_PROTO, obj_print_proto(f->protocol));
add_dump_obj(item, CONFIG_KEY_SCHED, obj_print_sched(f->scheduler));
obj_print_meta(f->schedparam, (char *)buf);
add_dump_obj(item, CONFIG_KEY_SCHEDPARAM, buf);
buf[0] = '\0';
obj_print_meta(f->persistence, (char *)buf);
add_dump_obj(item, CONFIG_KEY_PERSIST, buf);
buf[0] = '\0';
config_dump_int(value, f->persistttl);
add_dump_obj(item, CONFIG_KEY_PERSISTTM, value);
add_dump_obj(item, CONFIG_KEY_HELPER, obj_print_helper(f->helper));
obj_print_log(f->log, (char *)buf);
add_dump_obj(item, CONFIG_KEY_LOG, buf);
config_dump_hex(value, f->mark);
add_dump_obj(item, CONFIG_KEY_MARK, value);
config_dump_int(value, f->priority);
add_dump_obj(item, CONFIG_KEY_PRIORITY, value);
add_dump_obj(item, CONFIG_KEY_STATE, obj_print_state(f->state));
config_dump_int(value, f->newrtlimit);
add_dump_obj(item, CONFIG_KEY_NEWRTLIMIT, value);
config_dump_int(value, f->newrtlimitbst);
add_dump_obj(item, CONFIG_KEY_NEWRTLIMITBURST, value);
config_dump_int(value, f->rstrtlimit);
add_dump_obj(item, CONFIG_KEY_RSTRTLIMIT, value);
config_dump_int(value, f->rstrtlimitbst);
add_dump_obj(item, CONFIG_KEY_RSTRTLIMITBURST, value);
config_dump_int(value, f->estconnlimit);
add_dump_obj(item, CONFIG_KEY_ESTCONNLIMIT, value);
add_dump_obj(item, CONFIG_KEY_TCPSTRICT, obj_print_switch(f->tcpstrict));
config_dump_int(value, f->queue);
add_dump_obj(item, CONFIG_KEY_QUEUE, value);
add_dump_list(item, CONFIG_KEY_BCKS, LEVEL_BCKS, &f->backends, NULL);
add_dump_list(item, CONFIG_KEY_POLICIES, LEVEL_FARMPOLICY, &f->policies, NULL);
json_array_append_new(jarray, item);
}
break;
case LEVEL_BCKS:
list_for_each_entry(b, head, list) {
item = json_object();
add_dump_obj(item, CONFIG_KEY_NAME, b->name);
add_dump_obj(item, CONFIG_KEY_IPADDR, b->ipaddr);
add_dump_obj(item, CONFIG_KEY_PORT, b->port);
config_dump_int(value, b->weight);
add_dump_obj(item, CONFIG_KEY_WEIGHT, value);
config_dump_int(value, b->priority);
add_dump_obj(item, CONFIG_KEY_PRIORITY, value);
config_dump_hex(value, b->mark);
add_dump_obj(item, CONFIG_KEY_MARK, value);
config_dump_int(value, b->estconnlimit);
add_dump_obj(item, CONFIG_KEY_ESTCONNLIMIT, value);
add_dump_obj(item, CONFIG_KEY_STATE, obj_print_state(b->state));
json_array_append_new(jarray, item);
}
break;
case LEVEL_FARMPOLICY:
list_for_each_entry(fp, head, list) {
item = json_object();
add_dump_obj(item, "name", fp->policy->name);
json_array_append_new(jarray, item);
}
break;
case LEVEL_POLICIES:
list_for_each_entry(p, head, list) {
if (name != NULL && (strcmp(name, "") != 0) && (strcmp(p->name, name) != 0))
continue;
item = json_object();
add_dump_obj(item, "name", p->name);
add_dump_obj(item, "type", obj_print_policy_type(p->type));
config_dump_int(value, p->timeout);
add_dump_obj(item, "timeout", value);
config_dump_int(value, p->priority);
add_dump_obj(item, "priority", value);
config_dump_int(value, p->used);
add_dump_obj(item, "used", value);
add_dump_list(item, CONFIG_KEY_ELEMENTS, LEVEL_ELEMENTS, &p->elements, NULL);
json_array_append_new(jarray, item);
}
break;
case LEVEL_ELEMENTS:
list_for_each_entry(e, head, list) {
item = json_object();
add_dump_obj(item, "data", e->data);
add_dump_obj(item, "time", e->time);
json_array_append_new(jarray, item);
}
break;
default:
return;
}
json_object_set_new(obj, objname, jarray);
return;
}
int config_print_farms(char **buf, char *name)
{
struct list_head *farms = obj_get_farms();
json_t* jdata = json_object();
add_dump_list(jdata, CONFIG_KEY_FARMS, LEVEL_FARMS, farms, name);
*buf = json_dumps(jdata, JSON_INDENT(8));
json_decref(jdata);
if (*buf == NULL)
return -1;
return 0;
}
int config_print_policies(char **buf, char *name)
{
struct list_head *policies = obj_get_policies();
json_t* jdata = json_object();
add_dump_list(jdata, CONFIG_KEY_POLICIES, LEVEL_POLICIES, policies, name);
*buf = json_dumps(jdata, JSON_INDENT(8));
json_decref(jdata);
if (*buf == NULL)
return -1;
return 0;
}
int config_set_farm_action(const char *name, const char *value)
{
struct farm *f;
if (!name || strcmp(name, "") == 0)
return farm_s_set_action(config_value_action(value));
f = farm_lookup_by_name(name);
if (!f)
return -1;
return farm_set_action(f, config_value_action(value));
}
int config_set_backend_action(const char *fname, const char *bname, const char *value)
{
struct farm *f;
struct backend *b;
if (!fname || strcmp(fname, "") == 0)
return -1;
f = farm_lookup_by_name(fname);
if (!f)
return -1;
if (!bname || strcmp(bname, "") == 0)
return backend_s_set_action(f, config_value_action(value));
b = backend_lookup_by_name(f, bname);
if (!b)
return -1;
return backend_set_action(b, config_value_action(value));
}
int config_set_fpolicy_action(const char *fname, const char *fpname, const char *value)
{
struct farm *f;
struct farmpolicy *fp;
if (!fname || strcmp(fname, "") == 0)
return -1;
f = farm_lookup_by_name(fname);
if (!f)
return -1;
if (!fpname || strcmp(fpname, "") == 0)
return farmpolicy_s_set_action(f, config_value_action(value));
fp = farmpolicy_lookup_by_name(f, fpname);
if (!fp)
return -1;
farmpolicy_set_action(fp, config_value_action(value));
return 0;
}
int config_set_policy_action(const char *name, const char *value)
{
struct policy *p;
if (!name || strcmp(name, "") == 0)
return policy_s_set_action(config_value_action(value));
p = policy_lookup_by_name(name);
if (!p)
return -1;
return policy_set_action(p, config_value_action(value));
}
int config_set_element_action(const char *pname, const char *edata, const char *value)
{
struct policy *p;
struct element *e;
if (!pname || strcmp(pname, "") == 0)
return -1;
p = policy_lookup_by_name(pname);
if (!p)
return -1;
if (!edata || strcmp(edata, "") == 0)
return element_s_set_action(p, config_value_action(value));
e = element_lookup_by_name(p, edata);
if (!e)
return -1;
return element_set_action(e, config_value_action(value));
}
void config_print_response(char **buf, const char *message)
{
if (buf != NULL && *buf != NULL)
sprintf(*buf, "{\"response\": \"%s\"}", message);
}
nftlb-0.5/src/elements.c 0000664 0000000 0000000 00000007774 13475421131 0015252 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include "elements.h"
#include "policies.h"
#include "objects.h"
static struct element * element_create(struct policy *p, char *data)
{
struct element *e = (struct element *)malloc(sizeof(struct element));
if (!e) {
syslog(LOG_ERR, "Element memory allocation error");
return NULL;
}
e->policy = p;
obj_set_attribute_string(data, &e->data);
e->time = DEFAULT_ELEMENT_TIME;
e->action = DEFAULT_ACTION;
list_add_tail(&e->list, &p->elements);
p->total_elem++;
return e;
}
static int element_delete_node(struct element *e)
{
list_del(&e->list);
if (e->data)
free(e->data);
if (e->time && strcmp(e->time, "") != 0)
free(e->time);
free(e);
return 0;
}
static int element_delete(struct element *e)
{
struct policy *p = e->policy;
p->total_elem--;
policy_set_action(p, ACTION_RELOAD);
element_delete_node(e);
return 0;
}
void element_s_print(struct policy *p)
{
struct element *e;
list_for_each_entry(e, &p->elements, list) {
syslog(LOG_DEBUG," [element] ");
syslog(LOG_DEBUG," [data] %s", e->data);
if (p->timeout && e->time && strcmp(e->time, "") != 0)
syslog(LOG_DEBUG," [time] %s", e->time);
syslog(LOG_DEBUG," *[action] %d", e->action);
}
}
struct element * element_lookup_by_name(struct policy *p, const char *data)
{
struct element *e;
list_for_each_entry(e, &p->elements, list) {
if (strcmp(e->data, data) == 0)
return e;
}
return NULL;
}
int element_set_action(struct element *e, int action)
{
syslog(LOG_DEBUG, "%s():%d: element %s action is %d - new action %d", __FUNCTION__, __LINE__, e->data, e->action, action);
if (action == ACTION_DELETE) {
element_delete(e);
return 1;
}
if (e->action != action) {
e->action = action;
return 1;
}
return 0;
}
int element_s_set_action(struct policy *p, int action)
{
struct element *e, *next;
list_for_each_entry_safe(e, next, &p->elements, list)
element_set_action(e, action);
return 0;
}
int element_s_delete(struct policy *p)
{
struct element *e, *next;
list_for_each_entry_safe(e, next, &p->elements, list)
element_delete(e);
p->total_elem = 0;
return 0;
}
int element_set_attribute(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct element *e;
if (!cur->pptr)
return PARSER_OBJ_UNKNOWN;
if (c->key != KEY_DATA && !cur->eptr)
return PARSER_OBJ_UNKNOWN;
e = cur->eptr;
switch (c->key) {
case KEY_DATA:
e = element_lookup_by_name(cur->pptr, c->str_value);
if (!e) {
e = element_create(cur->pptr, c->str_value);
if (!e)
return -1;
}
cur->eptr = e;
break;
case KEY_TIME:
obj_set_attribute_string(c->str_value, &e->time);
break;
case KEY_ACTION:
element_set_action(e, c->int_value);
break;
default:
return -1;
}
return 0;
}
int element_pos_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct policy *p;
struct element *e;
if (!cur->pptr || !cur->eptr)
return -1;
p = cur->pptr;
e = cur->eptr;
syslog(LOG_DEBUG, "%s():%d: pos actionable element %s of policy %s with param %d", __FUNCTION__, __LINE__, e->data, p->name, c->key);
policy_set_action(p, ACTION_RELOAD);
return 0;
}
nftlb-0.5/src/events.c 0000664 0000000 0000000 00000003421 13475421131 0014723 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
struct events_stct {
struct ev_loop *loop;
struct ev_io *srv_accept;
struct ev_io *net_ntlnk;
};
static struct events_stct st_ev;
int loop_init(void)
{
st_ev.loop = ev_default_loop(0);
return 0;
}
int loop_run(void)
{
while (1)
ev_loop(st_ev.loop, 0);
return 0;
}
struct ev_loop *get_loop(void)
{
return st_ev.loop;
}
struct ev_io *events_get_ntlnk(void)
{
return st_ev.net_ntlnk;
}
struct ev_io *events_create_ntlnk(void)
{
st_ev.net_ntlnk = (struct ev_io *)malloc(sizeof(struct ev_io));
return st_ev.net_ntlnk;
}
void events_delete_ntlnk(void)
{
if (st_ev.net_ntlnk)
free(st_ev.net_ntlnk);
}
struct ev_io *events_get_srv(void)
{
return st_ev.srv_accept;
}
struct ev_io *events_create_srv(void)
{
st_ev.srv_accept = (struct ev_io *)malloc(sizeof(struct ev_io));
return st_ev.srv_accept;
}
void events_delete_srv(void)
{
if (st_ev.srv_accept)
free(st_ev.srv_accept);
}
nftlb-0.5/src/farmpolicy.c 0000664 0000000 0000000 00000011205 13475421131 0015563 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include "farmpolicy.h"
#include "farms.h"
#include "objects.h"
#include "network.h"
static struct farmpolicy * farmpolicy_create(struct farm *f, struct policy *p)
{
struct farmpolicy *fp = (struct farmpolicy *)malloc(sizeof(struct farmpolicy));
if (!fp) {
syslog(LOG_ERR, "Farm Policy memory allocation error");
return NULL;
}
fp->farm = f;
fp->policy = p;
fp->action = DEFAULT_ACTION;
p->used++;
f->policies_action = DEFAULT_ACTION;
if (f->policies_used > 0 && f->action == ACTION_RELOAD)
f->policies_action = ACTION_RELOAD;
f->policies_used++;
list_add_tail(&fp->list, &f->policies);
return fp;
}
static int farmpolicy_delete(struct farmpolicy *fp)
{
list_del(&fp->list);
if (fp->farm->policies_used > 0)
fp->farm->policies_used--;
if (fp->policy->used > 0)
fp->policy->used--;
fp->farm->policies_action = ACTION_STOP;
if (fp->farm->policies_used > 0 && fp->farm->action == ACTION_RELOAD)
fp->farm->policies_action = ACTION_RELOAD;
free(fp);
return 0;
}
void farmpolicy_s_print(struct farm *f)
{
struct farmpolicy *fp;
list_for_each_entry(fp, &f->policies, list) {
syslog(LOG_DEBUG," [policy] ");
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_NAME, fp->policy->name);
syslog(LOG_DEBUG," *[%s] %d", CONFIG_KEY_ACTION, fp->action);
}
}
struct farmpolicy * farmpolicy_lookup_by_name(struct farm *f, const char *name)
{
struct farmpolicy *fp;
list_for_each_entry(fp, &f->policies, list) {
if (strcmp(fp->policy->name, name) == 0)
return fp;
}
return NULL;
}
int farmpolicy_set_action(struct farmpolicy *fp, int action)
{
if ((action == ACTION_DELETE) || (action == ACTION_STOP)) {
farmpolicy_delete(fp);
return 1;
}
if (fp->action != action) {
fp->action = action;
fp->farm->policies_action = action;
return 1;
}
return 0;
}
int farmpolicy_s_set_action(struct farm *f, int action)
{
struct farmpolicy *fp, *next;
list_for_each_entry_safe(fp, next, &f->policies, list)
farmpolicy_set_action(fp, action);
fp->farm->policies_action = action;
return 0;
}
int farmpolicy_s_delete(struct farm *f)
{
struct farmpolicy *fp, *next;
list_for_each_entry_safe(fp, next, &f->policies, list)
farmpolicy_delete(fp);
return 0;
}
int farmpolicy_s_lookup_policy_action(struct farm *f, char *name, int action)
{
struct farmpolicy *fp;
fp = farmpolicy_lookup_by_name(f, name);
if (fp)
farmpolicy_set_action(fp, action);
return 0;
}
int farmpolicy_set_attribute(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farmpolicy *fp = cur->fpptr;
struct policy *p;
if (!cur->fptr)
return PARSER_OBJ_UNKNOWN;
switch (c->key) {
case KEY_NAME:
p = policy_lookup_by_name(c->str_value);
if (!p)
return -1;
fp = farmpolicy_lookup_by_name(cur->fptr, c->str_value);
if (fp)
return 0;
fp = farmpolicy_create(cur->fptr, p);
cur->fpptr = fp;
if (fp->farm->policies_used > 0 && fp->farm->iface == DEFAULT_IFNAME)
farm_set_ifinfo(fp->farm, KEY_IFACE);
break;
default:
return PARSER_STRUCT_FAILED;
}
return PARSER_OK;
}
int farmpolicy_pre_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farm *f;
if (!cur->fptr)
return -1;
f = cur->fptr;
syslog(LOG_DEBUG, "%s():%d: pre actionable farm policy for farm %s", __FUNCTION__, __LINE__, f->name);
farm_set_action(f, ACTION_RELOAD);
return 0;
}
int farmpolicy_pos_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farmpolicy *fp;
struct farm *f;
if (!cur->fpptr || !cur->fptr)
return -1;
fp = cur->fpptr;
f = cur->fptr;
syslog(LOG_DEBUG, "%s():%d: pos actionable farm policy %s for farm %s with param %d", __FUNCTION__, __LINE__, fp->policy->name, f->name, c->key);
farm_set_action(f, ACTION_RELOAD);
return 0;
}
nftlb-0.5/src/farms.c 0000664 0000000 0000000 00000053503 13475421131 0014535 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include
#include "farms.h"
#include "backends.h"
#include "farmpolicy.h"
#include "objects.h"
#include "config.h"
#include "nft.h"
#include "network.h"
static struct farm * farm_create(char *name)
{
struct list_head *farms = obj_get_farms();
struct farm *pfarm = (struct farm *)malloc(sizeof(struct farm));
if (!pfarm) {
syslog(LOG_ERR, "Farm memory allocation error");
return NULL;
}
obj_set_attribute_string(name, &pfarm->name);
pfarm->fqdn = DEFAULT_FQDN;
pfarm->iface = DEFAULT_IFNAME;
pfarm->oface = DEFAULT_IFNAME;
pfarm->iethaddr = DEFAULT_ETHADDR;
pfarm->oethaddr = DEFAULT_ETHADDR;
pfarm->ifidx = DEFAULT_IFIDX;
pfarm->ofidx = DEFAULT_IFIDX;
pfarm->virtaddr = DEFAULT_VIRTADDR;
pfarm->virtports = DEFAULT_VIRTPORTS;
pfarm->srcaddr = DEFAULT_SRCADDR;
pfarm->family = DEFAULT_FAMILY;
pfarm->mode = DEFAULT_MODE;
pfarm->protocol = DEFAULT_PROTO;
pfarm->scheduler = DEFAULT_SCHED;
pfarm->schedparam = DEFAULT_SCHEDPARAM;
pfarm->persistence = DEFAULT_PERSIST;
pfarm->persistttl = DEFAULT_PERSISTTM;
pfarm->helper = DEFAULT_HELPER;
pfarm->log = DEFAULT_LOG;
pfarm->mark = DEFAULT_MARK;
pfarm->state = DEFAULT_FARM_STATE;
pfarm->action = DEFAULT_ACTION;
pfarm->reload_action = VALUE_RLD_NONE;
init_list_head(&pfarm->backends);
init_list_head(&pfarm->policies);
pfarm->total_weight = 0;
pfarm->priority = DEFAULT_PRIORITY;
pfarm->newrtlimit = DEFAULT_NEWRTLIMIT;
pfarm->newrtlimitbst = DEFAULT_RTLIMITBURST;
pfarm->rstrtlimit = DEFAULT_RSTRTLIMIT;
pfarm->rstrtlimitbst = DEFAULT_RTLIMITBURST;
pfarm->estconnlimit = DEFAULT_ESTCONNLIMIT;
pfarm->tcpstrict = DEFAULT_TCPSTRICT;
pfarm->queue = DEFAULT_QUEUE;
pfarm->total_bcks = 0;
pfarm->bcks_available = 0;
pfarm->bcks_are_marked = 0;
pfarm->bcks_have_port = 0;
pfarm->policies_used = 0;
pfarm->policies_action = ACTION_NONE;
list_add_tail(&pfarm->list, farms);
obj_set_total_farms(obj_get_total_farms() + 1);
return pfarm;
}
static int farm_delete(struct farm *pfarm)
{
backend_s_delete(pfarm);
farmpolicy_s_delete(pfarm);
list_del(&pfarm->list);
if (pfarm->name && strcmp(pfarm->name, "") != 0)
free(pfarm->name);
if (pfarm->fqdn && strcmp(pfarm->fqdn, "") != 0)
free(pfarm->fqdn);
if (pfarm->iface && strcmp(pfarm->iface, "") != 0)
free(pfarm->iface);
if (pfarm->oface && strcmp(pfarm->oface, "") != 0)
free(pfarm->oface);
if (pfarm->iethaddr && strcmp(pfarm->iethaddr, "") != 0)
free(pfarm->iethaddr);
if (pfarm->oethaddr && strcmp(pfarm->oethaddr, "") != 0)
free(pfarm->oethaddr);
if (pfarm->virtaddr && strcmp(pfarm->virtaddr, "") != 0)
free(pfarm->virtaddr);
if (pfarm->virtports && strcmp(pfarm->virtports, "") != 0)
free(pfarm->virtports);
free(pfarm);
obj_set_total_farms(obj_get_total_farms() - 1);
return 0;
}
static int farm_validate(struct farm *f)
{
syslog(LOG_DEBUG, "%s():%d: validating farm %s",
__FUNCTION__, __LINE__, f->name);
if (!f->virtaddr || strcmp(f->virtaddr, "") == 0)
return 0;
if (farm_needs_policies(f) &&
(!f->iface || (strcmp(f->iface, "") == 0))) {
return 0;
}
if (farm_is_ingress_mode(f) &&
(!f->iface || (strcmp(f->iface, "") == 0))) {
return 0;
}
if (farm_is_ingress_mode(f) &&
(!f->iethaddr || strcmp(f->iethaddr, "") == 0))
return 0;
return 1;
}
static int farm_is_available(struct farm *f)
{
syslog(LOG_DEBUG, "%s():%d: farm %s state is %s",
__FUNCTION__, __LINE__, f->name, obj_print_state(f->state));
return (f->state == VALUE_STATE_UP) && farm_validate(f);
}
static int farm_s_update_dsr_counter(void)
{
struct list_head *farms = obj_get_farms();
struct farm *f;
int dsrcount = 0;
int curcount = obj_get_dsr_counter();
syslog(LOG_DEBUG, "%s():%d: updating dsr counter", __FUNCTION__, __LINE__);
list_for_each_entry(f, farms, list) {
if (farm_is_ingress_mode(f))
dsrcount++;
}
if (dsrcount != curcount)
syslog(LOG_DEBUG, "%s():%d: farm dsr counter becomes %d", __FUNCTION__, __LINE__, dsrcount);
obj_set_dsr_counter(dsrcount);
return dsrcount;
}
static void farm_manage_eventd(void)
{
farm_s_update_dsr_counter();
if (obj_get_dsr_counter() && !net_get_event_enabled()) {
net_eventd_init();
}
if (!obj_get_dsr_counter() && net_get_event_enabled()) {
net_eventd_stop();
}
}
static int farm_set_netinfo(struct farm *f)
{
syslog(LOG_DEBUG, "%s():%d: farm %s", __FUNCTION__, __LINE__, f->name);
if (f->state != VALUE_STATE_UP) {
syslog(LOG_INFO, "%s():%d: farm %s doesn't require low level network info", __FUNCTION__, __LINE__, f->name);
return -1;
}
if (farm_is_ingress_mode(f) &&
farm_set_ifinfo(f, KEY_IFACE) == 0 &&
farm_set_ifinfo(f, KEY_OFACE) == 0 ) {
farm_manage_eventd();
backend_s_find_ethers(f);
}
if (farm_needs_policies(f))
farm_set_ifinfo(f, KEY_IFACE);
return 0;
}
static int farm_set_mark(struct farm *f, int new_value)
{
int old_value = f->mark;
syslog(LOG_DEBUG, "%s():%d: farm %s old mark %d new mark %d", __FUNCTION__, __LINE__, f->name, old_value, new_value);
if (f->mode != VALUE_MODE_DNAT && f->mode != VALUE_MODE_SNAT) {
syslog(LOG_ERR, "%s():%d: mark for farm %s not available for the current mode %d", __FUNCTION__, __LINE__, f->name, f->mode);
return 0;
}
if (new_value & NFTLB_POSTROUTING_MARK) {
syslog(LOG_ERR, "%s():%d: mark 0x%x for farm %s conflicts with the POSTROUTING mark 0x%x", __FUNCTION__, __LINE__, f->mark, f->name, NFTLB_POSTROUTING_MARK);
return 0;
}
f->mark = new_value;
return 0;
}
static int farm_set_state(struct farm *f, int new_value)
{
int old_value = f->state;
syslog(LOG_DEBUG, "%s():%d: farm %s old state %d new state %d", __FUNCTION__, __LINE__, f->name, old_value, new_value);
if (old_value != VALUE_STATE_UP &&
new_value == VALUE_STATE_UP) {
farm_set_action(f, ACTION_START);
farm_set_netinfo(f);
}
if (old_value == VALUE_STATE_UP &&
new_value != VALUE_STATE_UP) {
farm_set_action(f, ACTION_STOP);
farm_manage_eventd();
}
f->state = new_value;
return 0;
}
static int farm_set_mode(struct farm *f, int new_value)
{
int old_value = f->mode;
syslog(LOG_DEBUG, "%s():%d: farm %s old mode %d new mode %d", __FUNCTION__, __LINE__, f->name, old_value, new_value);
if (old_value != new_value) {
f->mode = new_value;
farm_set_netinfo(f);
backend_s_validate(f);
}
return 0;
}
static int farm_set_port(struct farm *f, char *new_value)
{
syslog(LOG_DEBUG, "%s():%d: farm %s old port %s new port %s", __FUNCTION__, __LINE__, f->name, f->virtports, new_value);
if (strcmp(new_value, "0") != 0)
obj_set_attribute_string(new_value, &f->virtports);
if (strcmp(new_value, "") == 0)
f->protocol = VALUE_PROTO_ALL;
return 0;
}
static int farm_set_sched(struct farm *f, int new_value)
{
int old_value = f->scheduler;
syslog(LOG_DEBUG, "%s():%d: farm %s old scheduler %d new scheduler %d", __FUNCTION__, __LINE__, f->name, old_value, new_value);
f->scheduler = new_value;
if (f->scheduler == VALUE_SCHED_HASH && f->schedparam == VALUE_META_NONE) {
f->schedparam = VALUE_META_SRCIP;
}
if (f->scheduler != VALUE_SCHED_HASH) {
f->schedparam = VALUE_META_NONE;
}
return 0;
}
static int farm_strim_netface(char *name)
{
char *ptr;
if ((ptr = strstr(name, ":")) != NULL) {
*ptr = '\0';
return 1;
}
return 0;
}
static void farm_print(struct farm *f)
{
char buf[100] = {};
syslog(LOG_DEBUG," [farm] ");
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_NAME, f->name);
if (f->fqdn)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_FQDN, f->fqdn);
if (f->iface)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_IFACE, f->iface);
if (f->iethaddr)
syslog(LOG_DEBUG," [i-%s] %s", CONFIG_KEY_ETHADDR, f->iethaddr);
syslog(LOG_DEBUG," *[ifidx] %d", f->ifidx);
if (f->oface)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_OFACE, f->oface);
if (f->oethaddr)
syslog(LOG_DEBUG," [o-%s] %s", CONFIG_KEY_ETHADDR, f->oethaddr);
syslog(LOG_DEBUG," *[ofidx] %d", f->ofidx);
if (f->virtaddr)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_VIRTADDR, f->virtaddr);
if (f->virtports)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_VIRTPORTS, f->virtports);
if (f->srcaddr)
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_SRCADDR, f->srcaddr);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_FAMILY, obj_print_family(f->family));
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_MODE, obj_print_mode(f->mode));
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_PROTO, obj_print_proto(f->protocol));
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_SCHED, obj_print_sched(f->scheduler));
obj_print_meta(f->schedparam, (char *)buf);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_SCHEDPARAM, buf);
buf[0] = '\0';
obj_print_meta(f->persistence, (char *)buf);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_PERSIST, buf);
buf[0] = '\0';
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_PERSISTTM, f->persistttl);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_HELPER, obj_print_helper(f->helper));
obj_print_log(f->log, (char *)buf);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_LOG, buf);
syslog(LOG_DEBUG," [%s] 0x%x", CONFIG_KEY_MARK, f->mark);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_STATE, obj_print_state(f->state));
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_PRIORITY, f->priority);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_NEWRTLIMIT, f->newrtlimit);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_NEWRTLIMITBURST, f->newrtlimitbst);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_RSTRTLIMIT, f->rstrtlimit);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_RSTRTLIMITBURST, f->rstrtlimitbst);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_ESTCONNLIMIT, f->estconnlimit);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_TCPSTRICT, obj_print_switch(f->tcpstrict));
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_QUEUE, f->queue);
syslog(LOG_DEBUG," *[total_weight] %d", f->total_weight);
syslog(LOG_DEBUG," *[total_bcks] %d", f->total_bcks);
syslog(LOG_DEBUG," *[bcks_available] %d", f->bcks_available);
syslog(LOG_DEBUG," *[bcks_are_marked] %d", f->bcks_are_marked);
syslog(LOG_DEBUG," *[bcks_have_port] %d", f->bcks_have_port);
syslog(LOG_DEBUG," *[policies_action] %d", f->policies_action);
syslog(LOG_DEBUG," *[policies_used] %d", f->policies_used);
syslog(LOG_DEBUG," *[%s] %d", CONFIG_KEY_ACTION, f->action);
syslog(LOG_DEBUG," *[reload_action] %x", f->reload_action);
if (f->total_bcks != 0)
backend_s_print(f);
farmpolicy_s_print(f);
}
static int farm_set_newrtlimit(struct farm *f, int new_value)
{
if (f->newrtlimit == new_value)
return PARSER_IDEM_VALUE;
if (new_value == 0)
f->reload_action |= VALUE_RLD_NEWRTLIMIT_STOP;
else
f->reload_action |= VALUE_RLD_NEWRTLIMIT_START;
f->newrtlimit = new_value;
return PARSER_OK;
}
static int farm_set_rstrtlimit(struct farm *f, int new_value)
{
if (f->rstrtlimit == new_value)
return PARSER_IDEM_VALUE;
if (new_value == 0)
f->reload_action |= VALUE_RLD_RSTRTLIMIT_STOP;
else
f->reload_action |= VALUE_RLD_RSTRTLIMIT_START;
f->rstrtlimit = new_value;
return PARSER_OK;
}
static int farm_set_estconnlimit(struct farm *f, int new_value)
{
if (f->estconnlimit == new_value)
return PARSER_IDEM_VALUE;
if (new_value == 0)
f->reload_action |= VALUE_RLD_ESTCONNLIMIT_STOP;
else
f->reload_action |= VALUE_RLD_ESTCONNLIMIT_START;
f->estconnlimit = new_value;
return PARSER_OK;
}
void farm_s_print(void)
{
struct list_head *farms = obj_get_farms();
struct farm *f;
list_for_each_entry(f, farms, list) {
farm_print(f);
}
}
struct farm * farm_lookup_by_name(const char *name)
{
struct list_head *farms = obj_get_farms();
struct farm *f;
list_for_each_entry(f, farms, list) {
if (strcmp(f->name, name) == 0)
return f;
}
return NULL;
}
int farm_is_ingress_mode(struct farm *f)
{
return (f->mode == VALUE_MODE_DSR || f->mode == VALUE_MODE_STLSDNAT);
}
int farm_needs_policies(struct farm *f)
{
return (f->policies_used > 0) || (f->policies_action != ACTION_NONE);
}
int farm_set_ifinfo(struct farm *f, int key)
{
unsigned char ether[ETH_HW_ADDR_LEN];
char streth[ETH_HW_STR_LEN] = {};
char if_str[IFNAMSIZ];
struct backend *b;
char **ether_addr;
int if_index;
int ret = 0;
syslog(LOG_DEBUG, "%s():%d: farm %s set interface info for interface key %d", __FUNCTION__, __LINE__, f->name, key);
if (!(farm_is_ingress_mode(f) || (farm_needs_policies(f) && key == KEY_IFACE))) {
syslog(LOG_DEBUG, "%s():%d: farm %s is not in ingress mode", __FUNCTION__, __LINE__, f->name);
return 0;
}
switch (key) {
case KEY_IFACE:
ret = net_get_local_ifname_per_vip(f->virtaddr, if_str);
if (ret != 0) {
syslog(LOG_ERR, "%s():%d: inbound interface not found with VIP %s by farm %s", __FUNCTION__, __LINE__, f->virtaddr, f->name);
return -1;
}
obj_set_attribute_string(if_str, &f->iface);
farm_strim_netface(f->iface);
if_index = if_nametoindex(f->iface);
if (if_index == 0) {
syslog(LOG_ERR, "%s():%d: index of the inbound interface %s in farm %s not found", __FUNCTION__, __LINE__, f->iface, f->name);
return -1;
}
f->ifidx = if_index;
ether_addr = &f->iethaddr;
net_get_local_ifinfo((unsigned char **)ðer, f->iface);
farm_strim_netface(f->iface);
sprintf(streth, "%02x:%02x:%02x:%02x:%02x:%02x", ether[0],
ether[1], ether[2], ether[3], ether[4], ether[5]);
obj_set_attribute_string(streth, ether_addr);
break;
case KEY_OFACE:
ether_addr = &f->oethaddr;
b = backend_get_first(f);
if (!b || b->ipaddr == DEFAULT_IPADDR) {
syslog(LOG_ERR, "%s():%d: there is no backend yet in the farm %s", __FUNCTION__, __LINE__, f->name);
return 0;
}
ret = net_get_local_ifidx_per_remote_host(b->ipaddr, &if_index);
if (ret == -1) {
syslog(LOG_ERR, "%s():%d: unable to get the outbound interface to %s for the farm %s", __FUNCTION__, __LINE__, b->ipaddr, f->name);
return -1;
}
f->ofidx = if_index;
if (if_indextoname(if_index, if_str) == NULL) {
syslog(LOG_ERR, "%s():%d: unable to get the outbound interface name with index %d required by the farm %s", __FUNCTION__, __LINE__, if_index, f->name);
return -1;
}
obj_set_attribute_string(if_str, &f->oface);
farm_strim_netface(f->oface);
if_index = if_nametoindex(f->oface);
if (if_index == 0) {
syslog(LOG_ERR, "%s():%d: index of outbound interface %s in farm %s is not found", __FUNCTION__, __LINE__, f->oface, f->name);
return -1;
}
f->ofidx = if_index;
break;
}
return 0;
}
int farm_pre_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farm *f;
if (!cur->fptr)
return -1;
f = cur->fptr;
syslog(LOG_DEBUG, "%s():%d: pre actionable farm %s with param %d", __FUNCTION__, __LINE__, f->name, c->key);
switch (c->key) {
case KEY_NAME:
break;
case KEY_NEWNAME:
case KEY_FAMILY:
case KEY_VIRTADDR:
case KEY_VIRTPORTS:
case KEY_SRCADDR:
case KEY_MODE:
case KEY_PROTO:
case KEY_PERSISTENCE:
case KEY_PERSISTTM:
if (farm_set_action(f, ACTION_STOP))
farm_rulerize(f);
break;
default:
return 0;
}
return 0;
}
int farm_pos_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farm *f;
if (!cur->fptr)
return -1;
f = cur->fptr;
syslog(LOG_DEBUG, "%s():%d: pos actionable farm %s with param %d", __FUNCTION__, __LINE__, f->name, c->key);
switch (c->key) {
case KEY_NAME:
break;
case KEY_NEWNAME:
case KEY_FAMILY:
case KEY_VIRTADDR:
case KEY_VIRTPORTS:
case KEY_SRCADDR:
case KEY_MODE:
case KEY_PROTO:
case KEY_PERSISTENCE:
case KEY_PERSISTTM:
farm_set_action(f, ACTION_START);
break;
case KEY_STATE:
break;
default:
farm_set_action(f, ACTION_RELOAD);
return 0;
}
return 0;
}
int farm_set_attribute(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct farm *f;
struct farm *nf;
int ret = PARSER_FAILED;
if (c->key != KEY_NAME && !cur->fptr)
return PARSER_OBJ_UNKNOWN;
f = cur->fptr;
switch (c->key) {
case KEY_NAME:
f = farm_lookup_by_name(c->str_value);
if (!f) {
f = farm_create(c->str_value);
if (!f)
return -1;
}
cur->fptr = f;
ret = PARSER_OK;
break;
case KEY_NEWNAME:
nf = farm_lookup_by_name(c->str_value);
if (!nf) {
free(f->name);
obj_set_attribute_string(c->str_value, &f->name);
}
ret = PARSER_OK;
break;
case KEY_FQDN:
ret = obj_set_attribute_string(c->str_value, &f->fqdn);
break;
case KEY_IFACE:
ret = obj_set_attribute_string(c->str_value, &f->iface);
farm_strim_netface(f->iface);
break;
case KEY_OFACE:
ret = obj_set_attribute_string(c->str_value, &f->oface);
farm_strim_netface(f->oface);
break;
case KEY_FAMILY:
f->family = c->int_value;
ret = PARSER_OK;
break;
case KEY_ETHADDR:
ret = obj_set_attribute_string(c->str_value, &f->iethaddr);
break;
case KEY_VIRTADDR:
ret = obj_set_attribute_string(c->str_value, &f->virtaddr);
farm_set_netinfo(f);
break;
case KEY_VIRTPORTS:
ret = farm_set_port(f, c->str_value);
break;
case KEY_SRCADDR:
ret = obj_set_attribute_string(c->str_value, &f->srcaddr);
break;
case KEY_MODE:
ret = farm_set_mode(f, c->int_value);
break;
case KEY_PROTO:
f->protocol = c->int_value;
ret = PARSER_OK;
break;
case KEY_SCHED:
ret = farm_set_sched(f, c->int_value);
break;
case KEY_SCHEDPARAM:
f->schedparam = c->int_value;
ret = PARSER_OK;
break;
case KEY_PERSISTENCE:
f->persistence = c->int_value;
ret = PARSER_OK;
break;
case KEY_PERSISTTM:
f->persistttl = c->int_value;
ret = PARSER_OK;
break;
case KEY_PRIORITY:
f->priority = c->int_value;
ret = PARSER_OK;
break;
case KEY_HELPER:
f->helper = c->int_value;
ret = PARSER_OK;
break;
case KEY_LOG:
f->log = c->int_value;
ret = PARSER_OK;
break;
case KEY_MARK:
ret = farm_set_mark(f, c->int_value);
break;
case KEY_STATE:
ret = farm_set_state(f, c->int_value);
break;
case KEY_ACTION:
ret = farm_set_action(f, c->int_value);
break;
case KEY_NEWRTLIMIT:
ret = farm_set_newrtlimit(f, c->int_value);
break;
case KEY_NEWRTLIMITBURST:
f->newrtlimitbst = c->int_value;
ret = PARSER_OK;
break;
case KEY_RSTRTLIMIT:
ret = farm_set_rstrtlimit(f, c->int_value);
break;
case KEY_RSTRTLIMITBURST:
f->rstrtlimitbst = c->int_value;
ret = PARSER_OK;
break;
case KEY_ESTCONNLIMIT:
ret = farm_set_estconnlimit(f, c->int_value);
break;
case KEY_TCPSTRICT:
f->tcpstrict = c->int_value;
ret = PARSER_OK;
break;
case KEY_QUEUE:
f->queue = c->int_value;
ret = PARSER_OK;
break;
default:
return PARSER_STRUCT_FAILED;
}
return ret;
}
int farm_set_action(struct farm *f, int action)
{
syslog(LOG_DEBUG, "%s():%d: farm %s action is %d - new action %d", __FUNCTION__, __LINE__, f->name, f->action, action);
if (action == ACTION_STOP && f->state != VALUE_STATE_UP)
return 0;
if (action == ACTION_RELOAD && f->state != VALUE_STATE_UP)
action = ACTION_START;
if (action != ACTION_NONE && action != ACTION_RELOAD && f->policies_used != 0)
f->policies_action = action;
if (action == ACTION_DELETE) {
farm_delete(f);
return 1;
}
if (f->action > action) {
farm_manage_eventd();
f->action = action;
farm_set_netinfo(f);
backend_s_validate(f);
return 1;
}
return 0;
}
int farm_s_set_action(int action)
{
struct list_head *farms = obj_get_farms();
struct farm *f, *next;
list_for_each_entry_safe(f, next, farms, list)
farm_set_action(f, action);
if (action == ACTION_DELETE)
nft_reset();
return 0;
}
int farm_get_masquerade(struct farm *f)
{
int masq = (f->mode == VALUE_MODE_SNAT && (f->srcaddr == DEFAULT_SRCADDR || strcmp(f->srcaddr, "") == 0));
syslog(LOG_DEBUG, "%s():%d: farm %s masquerade %d", __FUNCTION__, __LINE__, f->name, masq);
return masq;
}
void farm_s_set_backend_ether_by_oifidx(int interface_idx, const char * ip_bck, char * ether_bck)
{
struct list_head *farms = obj_get_farms();
struct farm *f;
syslog(LOG_DEBUG, "%s():%d: updating farms with backends ip address %s and ether address %s", __FUNCTION__, __LINE__, ip_bck, ether_bck);
list_for_each_entry(f, farms, list) {
syslog(LOG_DEBUG, "%s():%d: farm with oifidx %d found", __FUNCTION__, __LINE__, interface_idx);
if (!farm_validate(f)) {
syslog(LOG_INFO, "%s():%d: farm %s doesn't validate", __FUNCTION__, __LINE__, f->name);
farm_set_state(f, VALUE_STATE_CONFERR);
continue;
}
if (backend_s_set_ether_by_ipaddr(f, ip_bck, ether_bck)) {
f->ofidx = interface_idx;
farm_set_action(f, ACTION_RELOAD);
farm_rulerize(f);
}
}
}
int farm_s_lookup_policy_action(char *name, int action)
{
struct list_head *farms = obj_get_farms();
struct farm *f, *next;
list_for_each_entry_safe(f, next, farms, list)
farmpolicy_s_lookup_policy_action(f, name, action);
return 0;
}
int farm_rulerize(struct farm *f)
{
syslog(LOG_DEBUG, "%s():%d: rulerize farm %s", __FUNCTION__, __LINE__, f->name);
farm_print(f);
if ((f->action == ACTION_START || f->action == ACTION_RELOAD) &&
!farm_is_available(f)) {
syslog(LOG_INFO, "%s():%d: farm %s won't be rulerized", __FUNCTION__, __LINE__, f->name);
if (f->state == VALUE_STATE_UP)
farm_set_state(f, VALUE_STATE_CONFERR);
return -1;
}
return nft_rulerize(f);
}
int farm_s_rulerize(void)
{
struct farm *f;
int ret = 0;
syslog(LOG_DEBUG, "%s():%d: rulerize everything", __FUNCTION__, __LINE__);
struct list_head *farms = obj_get_farms();
list_for_each_entry(f, farms, list) {
ret = ret || farm_rulerize(f);
}
return ret;
}
nftlb-0.5/src/main.c 0000664 0000000 0000000 00000007527 13475421131 0014356 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include
#include
#include
#include "config.h"
#include "objects.h"
#include "server.h"
#include "events.h"
#include "network.h"
#define NFTLB_SERVER_MODE 0
#define NFTLB_EXIT_MODE 1
#define NFTLB_LOGLEVEL_DEFAULT LOG_NOTICE
static void print_usage(const char *prog_name)
{
fprintf(stderr,
"%s, nftables load balancer - Version %s\n"
"(c) 2018 by Laura Garcia \n"
"Usage: %s\n"
" [ -h | --help ] Show this help\n"
" [ -l | --log ] Set the syslog level\n"
" [ -c | --config ] Launch with the given configuration file\n"
" [ -k | --key ] Set the authentication key, otherwise it'll be generated\n"
" [ -e | --exit ] Don't execute the server\n"
" [ -6 | --ipv6 ] Enable IPv6 listening port\n"
" [ -H | --host ] Set the host for the listening port\n"
" [ -P | --port ] Set the port for the listening port\n"
, prog_name, VERSION, prog_name);
}
static const struct option options[] = {
{ .name = "help", .has_arg = 0, .val = 'h' },
{ .name = "log", .has_arg = 1, .val = 'l' },
{ .name = "config", .has_arg = 1, .val = 'c' },
{ .name = "key", .has_arg = 1, .val = 'k' },
{ .name = "exit", .has_arg = 0, .val = 'e' },
{ .name = "ipv6", .has_arg = 0, .val = '6' },
{ .name = "host", .has_arg = 1, .val = 'H' },
{ .name = "port", .has_arg = 1, .val = 'P' },
{ NULL },
};
static void nftlb_sighandler(int signo)
{
syslog(LOG_INFO, "shutting down %s, bye", PACKAGE);
server_fini();
exit(EXIT_SUCCESS);
}
int main(int argc, char *argv[])
{
int mode = NFTLB_SERVER_MODE;
int c;
int loglevel = NFTLB_LOGLEVEL_DEFAULT;
const char *config = NULL;
while ((c = getopt_long(argc, argv, "hl:c:k:e6H:P:", options, NULL)) != -1) {
switch (c) {
case 'h':
print_usage(argv[0]);
return EXIT_SUCCESS;
case 'l':
loglevel = atoi(optarg);
break;
case 'c':
config = optarg;
break;
case 'k':
server_set_key(optarg);
sprintf(optarg, "%*s", (int)strlen(optarg) - 1, " ");
break;
case 'e':
mode = NFTLB_EXIT_MODE;
break;
case '6':
server_set_ipv6();
break;
case 'H':
server_set_host(optarg);
break;
case 'P':
server_set_port(atoi(optarg));
break;
default:
fprintf(stderr, "Unknown option -%c\n", optopt);
syslog(LOG_ERR, "Unknown option -%c", optopt);
return EXIT_FAILURE;
}
}
if (signal(SIGINT, nftlb_sighandler) == SIG_ERR ||
signal(SIGTERM, nftlb_sighandler) == SIG_ERR ||
signal(SIGPIPE, SIG_IGN) == SIG_ERR)
return EXIT_FAILURE;
setlogmask(LOG_UPTO(loglevel));
objects_init();
loop_init();
if (config && config_file(config) != 0)
return EXIT_FAILURE;
if (loglevel > NFTLB_LOGLEVEL_DEFAULT)
obj_print();
obj_rulerize();
if (mode == NFTLB_EXIT_MODE)
return EXIT_SUCCESS;
if (server_init() != 0) {
fprintf(stderr, "Cannot start server-ev: %s\n", strerror(errno));
return EXIT_FAILURE;
}
loop_run();
return EXIT_SUCCESS;
}
nftlb-0.5/src/network.c 0000664 0000000 0000000 00000041751 13475421131 0015120 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include "network.h"
#include "events.h"
#include "farms.h"
#define IP_ADDR_LEN 4
#define IP6_ADDR_LEN 16
#define ICMP_PROTO 1
#define ICMP_PACKETSIZE 64
#define ARP_TABLE_RETRY_SLEEP 1000
#define GET_INET_LEN(family) ((family == AF_INET6) ? IP6_ADDR_LEN : IP_ADDR_LEN)
static int net_event_enabled;
struct net_io {
ev_io *io;
struct rtgenmsg *rt;
struct nlmsghdr *nlh;
};
static struct net_io io_handle;
struct mnl_socket *nl;
struct icmp_packet
{
struct icmphdr hdr;
char data[ICMP_PACKETSIZE - sizeof(struct icmphdr)];
};
struct ntl_data {
unsigned char family;
struct in6_addr *src_ipaddr;
unsigned char src_ethaddr[ETH_HW_ADDR_LEN];
struct in6_addr *dst_ipaddr;
unsigned char dst_ethaddr[ETH_HW_ADDR_LEN];
int oifidx;
};
struct ntl_request {
struct mnl_socket *nl;
struct nlmsghdr *nlh;
struct rtgenmsg *rt;
struct rtmsg *rtm;
unsigned int portid;
int msgtype;
char *buf;
void *cb;
void *data;
};
static int send_ping(void *data)
{
struct ntl_data *sdata = data;
struct sockaddr_in remote_addr;
struct icmp_packet pckt;
ssize_t ret = 0;
int sock;
syslog(LOG_DEBUG, "%s():%d: sending ping", __FUNCTION__, __LINE__);
bzero(&remote_addr, sizeof(remote_addr));
remote_addr.sin_family = sdata->family;
remote_addr.sin_port = 0;
memcpy(&remote_addr.sin_addr.s_addr, &sdata->dst_ipaddr->s6_addr, GET_INET_LEN(sdata->family) * sizeof(unsigned char));
sock = socket(PF_INET, SOCK_RAW, ICMP_PROTO);
if (sock < 0) {
syslog(LOG_ERR, "%s():%d: open socket error", __FUNCTION__, __LINE__);
ret = -1;
goto out;
}
bzero(&pckt, sizeof(pckt));
pckt.hdr.type = ICMP_ECHO;
pckt.hdr.un.echo.id = 1;
bzero(pckt.data, ICMP_PACKETSIZE - sizeof(struct icmphdr));
pckt.hdr.un.echo.sequence = 1;
if (sendto(sock, &pckt, sizeof(pckt), 0, (struct sockaddr *) &remote_addr, sizeof(remote_addr)) <= 0) {
syslog(LOG_ERR, "%s():%d: sendto error", __FUNCTION__, __LINE__);
ret = -1;
}
out:
if (ret && sock > 0) {
syslog(LOG_DEBUG, "%s():%d: cleanup socket", __FUNCTION__, __LINE__);
close(sock);
}
return ret;
}
static int data_attr_neigh_cb(const struct nlattr *attr, void *data)
{
const struct nlattr **tb = data;
int type = mnl_attr_get_type(attr);
if (mnl_attr_type_valid(attr, NDA_MAX) < 0)
return MNL_CB_OK;
switch(type) {
case NDA_DST:
case NDA_LLADDR:
if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0) {
syslog(LOG_ERR, "%s():%d: mnl_attr_validate error", __FUNCTION__, __LINE__);
return MNL_CB_ERROR;
}
break;
default:
return MNL_CB_ERROR;
}
tb[type] = attr;
return MNL_CB_OK;
}
static int data_getdst_neigh_cb(const struct nlmsghdr *nlh, void *data)
{
struct nlattr *tb[NDA_MAX + 1] = {};
struct ndmsg *ndm = mnl_nlmsg_get_payload(nlh);
struct in6_addr *ipaddr;
void *ethaddr;
char out[INET6_ADDRSTRLEN];
char out1[INET6_ADDRSTRLEN];
struct ntl_data *sdata = data;
syslog(LOG_DEBUG, "%s():%d: getting ethernet address destination", __FUNCTION__, __LINE__);
mnl_attr_parse(nlh, sizeof(*ndm), data_attr_neigh_cb, tb);
if (!tb[NDA_DST])
return MNL_CB_OK;
ipaddr = mnl_attr_get_payload(tb[NDA_DST]);
inet_ntop(AF_INET, ipaddr, out, INET6_ADDRSTRLEN);
inet_ntop(AF_INET, sdata->dst_ipaddr, out1, INET6_ADDRSTRLEN);
if (memcmp(ipaddr, sdata->dst_ipaddr, GET_INET_LEN(sdata->family)) == 0 &&
((ndm->ndm_state & NUD_REACHABLE) || (ndm->ndm_state & NUD_PERMANENT) || (ndm->ndm_state & NUD_STALE))) {
mnl_attr_parse(nlh, sizeof(*ndm), data_attr_neigh_cb, tb);
if (tb[NDA_LLADDR]) {
ethaddr = mnl_attr_get_payload(tb[NDA_LLADDR]);
memcpy(&sdata->dst_ethaddr, ethaddr, 6);
syslog(LOG_INFO, "%s():%d: get ether address index=%d family=%d dst=%s eth=%02x:%02x:%02x:%02x:%02x:%02x sts=%d",
__FUNCTION__, __LINE__,
ndm->ndm_ifindex, ndm->ndm_family, out, sdata->dst_ethaddr[0],
sdata->dst_ethaddr[1], sdata->dst_ethaddr[2], sdata->dst_ethaddr[3],
sdata->dst_ethaddr[4], sdata->dst_ethaddr[5], ndm->ndm_state);
}
return MNL_CB_STOP;
}
return MNL_CB_OK;
}
static int data_route_attr_cb(const struct nlattr *attr, void *data)
{
const struct nlattr **tb = data;
int type = mnl_attr_get_type(attr);
if (mnl_attr_type_valid(attr, RTA_MAX) < 0)
return MNL_CB_OK;
switch(type) {
case RTA_TABLE:
case RTA_DST:
case RTA_SRC:
case RTA_OIF:
case RTA_FLOW:
case RTA_PREFSRC:
case RTA_GATEWAY:
case RTA_PRIORITY:
if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) {
syslog(LOG_ERR, "%s():%d: mnl_attr_validate error", __FUNCTION__, __LINE__);
return MNL_CB_ERROR;
}
break;
case RTA_METRICS:
if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) {
syslog(LOG_ERR, "%s():%d: mnl_attr_validate error", __FUNCTION__, __LINE__);
return MNL_CB_ERROR;
}
break;
}
tb[type] = attr;
return MNL_CB_OK;
}
static int data_getdst_route_cb(const struct nlmsghdr *nlh, void *data)
{
struct nlattr *tb[RTA_MAX + 1] = {};
struct rtmsg *rm = mnl_nlmsg_get_payload(nlh);
struct ntl_data *sdata = data;
syslog(LOG_DEBUG, "%s():%d: getting interface route destination", __FUNCTION__, __LINE__);
mnl_attr_parse(nlh, sizeof(*rm), data_route_attr_cb, tb);
if (tb[RTA_OIF]) {
sdata->oifidx = mnl_attr_get_u32(tb[RTA_OIF]);
syslog(LOG_INFO, "%s():%d: get routing interface to destination is %u", __FUNCTION__, __LINE__, sdata->oifidx);
return MNL_CB_STOP;
}
return MNL_CB_STOP;
}
static int ntl_request(struct ntl_request *ntl)
{
int ret, out = 0;
ntl->nl = mnl_socket_open(NETLINK_ROUTE);
if (ntl->nl == NULL) {
syslog(LOG_ERR, "%s():%d: mnl_socket_open error", __FUNCTION__, __LINE__);
return -1;
}
if (mnl_socket_bind(ntl->nl, 0, MNL_SOCKET_AUTOPID) < 0) {
syslog(LOG_ERR, "%s():%d: mnl_socket_bind error", __FUNCTION__, __LINE__);
return -1;
}
ntl->portid = mnl_socket_get_portid(ntl->nl);
if (mnl_socket_sendto(ntl->nl, ntl->nlh, ntl->nlh->nlmsg_len) < 0) {
syslog(LOG_ERR, "%s():%d: mnl_socket_sendto error", __FUNCTION__, __LINE__);
return -1;
}
ret = mnl_socket_recvfrom(ntl->nl, ntl->buf, MNL_SOCKET_BUFFER_SIZE);
while (ret > 0) {
ret = mnl_cb_run(ntl->buf, ret, ntl->nlh->nlmsg_seq, ntl->portid, ntl->cb, ntl->data);
if (ret <= MNL_CB_STOP) {
out = 0 | out;
goto end;
} else {
out = -1;
}
ret = mnl_socket_recvfrom(ntl->nl, ntl->buf, MNL_SOCKET_BUFFER_SIZE);
}
if (ret == -1) {
syslog(LOG_ERR, "%s():%d: mnl_socket_recvfrom error", __FUNCTION__, __LINE__);
ret = -1;
}
end:
mnl_socket_close(ntl->nl);
return out;
}
int net_get_neigh_ether(unsigned char **dst_ethaddr, unsigned char *src_ethaddr, unsigned char family, char *src_ipaddr, char *dst_ipaddr, int outdev)
{
struct ntl_request ntl;
struct ntl_data *data;
int ret = 0;
syslog(LOG_DEBUG, "%s():%d: source mac address %s source ip address %s destination ip address %s", __FUNCTION__, __LINE__, src_ethaddr, src_ipaddr, dst_ipaddr);
ntl.buf = (char *) malloc(MNL_SOCKET_BUFFER_SIZE);
ntl.nlh = mnl_nlmsg_put_header(ntl.buf);
ntl.nlh->nlmsg_type = RTM_GETNEIGH;
ntl.nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP;
ntl.nlh->nlmsg_seq = time(NULL);
ntl.rt = mnl_nlmsg_put_extra_header(ntl.nlh, sizeof(struct rtgenmsg));
ntl.rt->rtgen_family = AF_INET;
ntl.cb = data_getdst_neigh_cb;
syslog(LOG_DEBUG, "%s():%d: source ether is %02x:%02x:%02x:%02x:%02x:%02x",
__FUNCTION__, __LINE__, src_ethaddr[0], src_ethaddr[1], src_ethaddr[2],
src_ethaddr[3], src_ethaddr[4], src_ethaddr[5]);
data = (struct ntl_data *)calloc(1, sizeof(struct ntl_data));
if (!data) {
syslog(LOG_ERR, "%s():%d: memory allocation error", __FUNCTION__, __LINE__);
return -1;
}
ntl.data = (void *)data;
data->dst_ipaddr = (struct in6_addr *)calloc(1, sizeof(struct in6_addr));
if (!data->dst_ipaddr){
syslog(LOG_ERR, "%s():%d: memory allocation error", __FUNCTION__, __LINE__);
return -1;
}
if (family != 0)
data->family = AF_INET6;
else
data->family = AF_INET;
if (inet_pton(data->family, dst_ipaddr, data->dst_ipaddr) <= 0) {
syslog(LOG_ERR, "%s():%d: network translation error for %s", __FUNCTION__, __LINE__, dst_ipaddr);
return -1;
}
data->oifidx = outdev;
ret = ntl_request(&ntl);
if (ret != 0) {
ret = -1;
syslog(LOG_DEBUG, "%s():%d: not found, send ping for %s", __FUNCTION__, __LINE__, dst_ipaddr);
data->src_ipaddr = (struct in6_addr *)calloc(1, sizeof(struct in6_addr));
if (!data->src_ipaddr){
syslog(LOG_ERR, "%s():%d: memory allocation error", __FUNCTION__, __LINE__);
return ret;
}
if (inet_pton(data->family, src_ipaddr, data->src_ipaddr) <= 0) {
syslog(LOG_ERR, "%s():%d: network translation error for %s", __FUNCTION__, __LINE__, src_ipaddr);
return ret;
}
memcpy(data->src_ethaddr, src_ethaddr, ETH_HW_ADDR_LEN);
send_ping(data);
free(data->src_ipaddr);
}
memcpy(dst_ethaddr, data->dst_ethaddr, ETH_HW_ADDR_LEN);
free(ntl.buf);
free(data->dst_ipaddr);
free(data);
return ret;
}
int net_get_local_ifidx_per_remote_host(char *dst_ipaddr, int *outdev)
{
struct ntl_request ntl;
struct ntl_data *data;
struct sockaddr_in addr;
int ret = 0;
syslog(LOG_DEBUG, "%s():%d: dst ip address is %s", __FUNCTION__, __LINE__, dst_ipaddr);
ntl.buf = (char *) malloc(MNL_SOCKET_BUFFER_SIZE);
ntl.nlh = mnl_nlmsg_put_header(ntl.buf);
ntl.nlh->nlmsg_type = RTM_GETROUTE;
ntl.nlh->nlmsg_flags = NLM_F_REQUEST;
ntl.nlh->nlmsg_seq = time(NULL);
ntl.rtm = mnl_nlmsg_put_extra_header(ntl.nlh, sizeof(struct rtmsg));
ntl.rtm->rtm_family = AF_INET;
ntl.rtm->rtm_dst_len = 32;
ntl.rtm->rtm_src_len = 0;
ntl.rtm->rtm_tos = 0;
ntl.rtm->rtm_protocol = RTPROT_UNSPEC;
ntl.rtm->rtm_table = RT_TABLE_UNSPEC;
ntl.rtm->rtm_type = RTN_UNSPEC;
ntl.rtm->rtm_scope = RT_SCOPE_UNIVERSE;
ntl.rtm->rtm_flags = RTM_F_LOOKUP_TABLE;
data = (struct ntl_data *)calloc(1, sizeof(struct ntl_data));
if (!data) {
syslog(LOG_ERR, "%s():%d: memory allocation error", __FUNCTION__, __LINE__);
return -1;
}
data->dst_ipaddr = (struct in6_addr *)calloc(1, sizeof(struct in6_addr));
if (!data->dst_ipaddr){
syslog(LOG_ERR, "%s():%d: memory allocation error", __FUNCTION__, __LINE__);
return -1;
}
ntl.cb = data_getdst_route_cb;
ntl.data = (void *)data;
data->family = ntl.rtm->rtm_family;
if (!inet_pton(AF_INET, dst_ipaddr, &(addr.sin_addr))) {
syslog(LOG_ERR, "%s():%d: network translation error for %s", __FUNCTION__, __LINE__, dst_ipaddr);
return -1;
}
mnl_attr_put(ntl.nlh, RTA_DST, sizeof(uint32_t), &addr.sin_addr.s_addr);
ret = ntl_request(&ntl);
if (ret != 0) {
syslog(LOG_ERR, "%s():%d: not found route to %s", __FUNCTION__, __LINE__, dst_ipaddr);
return -1;
}
syslog(LOG_DEBUG, "%s():%d: found route to %s via %d", __FUNCTION__, __LINE__, dst_ipaddr, data->oifidx);
*outdev = data->oifidx;
free(ntl.buf);
free(data->dst_ipaddr);
free(data);
return ret;
}
int net_get_local_ifinfo(unsigned char **ether, const char *indev)
{
int ret = -1;
struct ifreq ifr;
int sd;
syslog(LOG_DEBUG, "%s():%d: netlink get local interface info for %s", __FUNCTION__, __LINE__, indev);
sd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
if (sd <= 0) {
syslog(LOG_ERR, "%s():%d: open socket error", __FUNCTION__, __LINE__);
goto out;
}
strcpy(ifr.ifr_name, indev);
if (ioctl(sd, SIOCGIFHWADDR, &ifr) == -1) {
syslog(LOG_ERR, "%s():%d: ioctl SIOCGIFHWADDR error", __FUNCTION__, __LINE__);
goto out;
}
memcpy(ether, ifr.ifr_hwaddr.sa_data, ETH_HW_ADDR_LEN * sizeof(unsigned char));
ret = 0;
out:
if (sd > 0)
close(sd);
return ret;
}
int net_get_local_ifname_per_vip(char *strvip, char *outdev)
{
int ret = -1;
struct sockaddr_storage addr;
struct ifconf ifc;
struct ifreq *ifr;
char buf[16384];
int sd = 0;
int i, found = 0;
size_t len;
struct sockaddr_in *ipaddr;
if (strcmp(strvip, "") == 0) {
syslog(LOG_ERR, "%s():%d: vip is not set yet", __FUNCTION__, __LINE__);
goto out;
}
syslog(LOG_DEBUG, "%s():%d: netlink get local interface name for %s", __FUNCTION__, __LINE__, strvip);
inet_aton(strvip, &((struct sockaddr_in *) &addr)->sin_addr);
sd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
if (sd <= 0) {
syslog(LOG_ERR, "%s():%d: open socket error", __FUNCTION__, __LINE__);
goto out;
}
ifc.ifc_len = sizeof(buf);
ifc.ifc_buf = buf;
if (ioctl(sd, SIOCGIFCONF, &ifc) == -1) {
syslog(LOG_ERR, "%s():%d: ioctl SIOCGIFCONF error", __FUNCTION__, __LINE__);
goto out;
}
ifr = ifc.ifc_req;
for(i = 0; i < ifc.ifc_len && !found;) {
len = sizeof(*ifr);
ipaddr = (struct sockaddr_in*)&((*ifr).ifr_addr);
if (ipaddr->sin_addr.s_addr == ((struct sockaddr_in *) &addr)->sin_addr.s_addr) {
found = 1;
strcpy(outdev, ifr->ifr_name);
ret = 0;
}
ifr = (struct ifreq*)((char*)ifr+len);
i += len;
}
syslog(LOG_DEBUG, "%s():%d: netlink get local interface name is %s", __FUNCTION__, __LINE__, outdev);
out:
if (sd > 0)
close(sd);
return ret;
}
static int data_getev_cb(const struct nlmsghdr *nlh, void *data)
{
struct nlattr *tb[NDA_MAX + 1] = {};
struct ndmsg *ndm = mnl_nlmsg_get_payload(nlh);
struct in6_addr *ipaddr;
char str_ipaddr[INET6_ADDRSTRLEN];
void *ethaddr;
unsigned char dst_ethaddr[ETH_HW_ADDR_LEN];
char streth[ETH_HW_STR_LEN] = {};
syslog(LOG_DEBUG, "%s():%d: netlink read new info", __FUNCTION__, __LINE__);
if (nlh->nlmsg_type != RTM_NEWNEIGH)
return MNL_CB_STOP;
mnl_attr_parse(nlh, sizeof(*ndm), data_attr_neigh_cb, tb);
if (tb[NDA_DST]) {
ipaddr = mnl_attr_get_payload(tb[NDA_DST]);
inet_ntop(AF_INET, ipaddr, str_ipaddr, INET6_ADDRSTRLEN);
}
if (tb[NDA_LLADDR]) {
ethaddr = mnl_attr_get_payload(tb[NDA_LLADDR]);
memcpy(dst_ethaddr, ethaddr, ETH_HW_ADDR_LEN);
sprintf(streth, "%02x:%02x:%02x:%02x:%02x:%02x", dst_ethaddr[0], dst_ethaddr[1],
dst_ethaddr[2], dst_ethaddr[3], dst_ethaddr[4], dst_ethaddr[5]);
if ((ndm->ndm_state & NUD_REACHABLE) || (ndm->ndm_state & NUD_PERMANENT))
farm_s_set_backend_ether_by_oifidx(ndm->ndm_ifindex, str_ipaddr, streth);
syslog(LOG_DEBUG, "%s():%d: [NEW NEIGH] family=%u ifindex=%u state=%u dstaddr=%s macaddr=%s",
__FUNCTION__, __LINE__, ndm->ndm_family, ndm->ndm_ifindex, ndm->ndm_state, str_ipaddr,
streth);
}
return MNL_CB_STOP;
}
static void ntlk_cb(struct ev_loop *loop, struct ev_io *watcher, int revents)
{
char buf[MNL_SOCKET_BUFFER_SIZE];
int ret, out;
syslog(LOG_DEBUG, "%s():%d: netlink callback executed", __FUNCTION__, __LINE__);
ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
while (ret > 0) {
ret = mnl_cb_run(buf, ret, 0, 0, data_getev_cb, NULL);
if (ret <= MNL_CB_STOP) {
out = 0 | out;
return;
} else {
out = -1;
}
ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
}
if (ret == -1) {
syslog(LOG_ERR, "%s():%d: netlink error", __FUNCTION__, __LINE__);
ret = -1;
}
}
int net_eventd_init(void)
{
char buf[MNL_SOCKET_BUFFER_SIZE];
int sock;
struct ev_loop *st_ev_loop = get_loop();
syslog(LOG_DEBUG, "%s():%d: net eventd launched", __FUNCTION__, __LINE__);
io_handle.io = events_create_ntlnk();
io_handle.nlh = mnl_nlmsg_put_header(buf);
io_handle.nlh->nlmsg_type = RTM_GETNEIGH;
io_handle.nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP;
io_handle.nlh->nlmsg_seq = time(NULL);
io_handle.rt = mnl_nlmsg_put_extra_header(io_handle.nlh, sizeof(struct rtgenmsg));
io_handle.rt->rtgen_family = AF_INET;
nl = mnl_socket_open(NETLINK_ROUTE);
if (nl == NULL) {
syslog(LOG_ERR, "%s():%d: mnl_socket_open error", __FUNCTION__, __LINE__);
return -1;
}
sock = mnl_socket_get_fd(nl);
if (mnl_socket_bind(nl, RTM_GETNEIGH, MNL_SOCKET_AUTOPID) < 0) {
syslog(LOG_ERR, "%s():%d: mnl_socket_bind error", __FUNCTION__, __LINE__);
return -1;
}
ev_io_init(io_handle.io, ntlk_cb, sock, EV_READ);
ev_io_start(st_ev_loop, io_handle.io);
net_event_enabled = 1;
return 0;
}
int net_eventd_stop(void)
{
struct ev_loop *st_ev_loop = get_loop();
syslog(LOG_DEBUG, "%s():%d: net eventd stopped", __FUNCTION__, __LINE__);
ev_io_stop(st_ev_loop, io_handle.io);
mnl_socket_close(nl);
if (io_handle.io)
free(io_handle.io);
net_event_enabled = 0;
return 0;
}
int net_get_event_enabled(void)
{
syslog(LOG_DEBUG, "%s():%d: net eventd is %d", __FUNCTION__, __LINE__, net_event_enabled);
return net_event_enabled;
}
nftlb-0.5/src/nft.c 0000664 0000000 0000000 00000170612 13475421131 0014215 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#define NFTLB_MAX_CMD 2048
#define NFTLB_MAX_IFACES 100
#define NFTLB_TABLE_NAME "nftlb"
#define NFTLB_TABLE_PREROUTING "prerouting"
#define NFTLB_TABLE_POSTROUTING "postrouting"
#define NFTLB_TABLE_INGRESS "ingress"
#define NFTLB_TABLE_FILTER "filter"
#define NFTLB_TYPE_NONE ""
#define NFTLB_TYPE_NAT "nat"
#define NFTLB_TYPE_FILTER "filter"
#define NFTLB_TYPE_NETDEV "netdev"
#define NFTLB_HOOK_PREROUTING "prerouting"
#define NFTLB_HOOK_POSTROUTING "postrouting"
#define NFTLB_HOOK_INGRESS "ingress"
#define NFTLB_HOOK_FILTER "filter"
#define NFTLB_PREROUTING_PRIO 0
#define NFTLB_POSTROUTING_PRIO 100
#define NFTLB_INGRESS_PRIO 100
#define NFTLB_FILTER_PRIO -150
#define NFTLB_RAW_PRIO -300
#define NFTLB_IPV4_PROTOCOL "protocol"
#define NFTLB_IPV6_PROTOCOL "nexthdr"
#define NFTLB_UDP_PROTO "udp"
#define NFTLB_TCP_PROTO "tcp"
#define NFTLB_SCTP_PROTO "sctp"
#define NFTLB_UDP_SERVICES_MAP "udp-services"
#define NFTLB_TCP_SERVICES_MAP "tcp-services"
#define NFTLB_SCTP_SERVICES_MAP "sctp-services"
#define NFTLB_IP_SERVICES_MAP "services"
#define NFTLB_UDP_SERVICES6_MAP "udp-services6"
#define NFTLB_TCP_SERVICES6_MAP "tcp-services6"
#define NFTLB_SCTP_SERVICES6_MAP "sctp-services6"
#define NFTLB_IP_SERVICES6_MAP "services6"
#define NFTLB_MAP_KEY_TYPE 0
#define NFTLB_MAP_KEY_RULE 1
#define NFTLB_MAP_TYPE_IPV4 "ipv4_addr"
#define NFTLB_MAP_TYPE_IPV6 "ipv6_addr"
#define NFTLB_MAP_TYPE_INETSRV "inet_service"
#define NFTLB_MAP_TYPE_MAC "ether_addr"
#define NFTLB_IPV4_FAMILY "ip"
#define NFTLB_IPV6_FAMILY "ip6"
#define NFTLB_NETDEV_FAMILY "netdev"
#define NFTLB_IPV4_ACTIVE (1 << 0)
#define NFTLB_IPV4_UDP_ACTIVE (1 << 1)
#define NFTLB_IPV4_TCP_ACTIVE (1 << 2)
#define NFTLB_IPV4_SCTP_ACTIVE (1 << 3)
#define NFTLB_IPV4_IP_ACTIVE (1 << 4)
#define NFTLB_IPV6_ACTIVE (1 << 5)
#define NFTLB_IPV6_UDP_ACTIVE (1 << 6)
#define NFTLB_IPV6_TCP_ACTIVE (1 << 7)
#define NFTLB_IPV6_SCTP_ACTIVE (1 << 8)
#define NFTLB_IPV6_IP_ACTIVE (1 << 9)
#define NFTLB_NFT_DADDR "daddr"
#define NFTLB_NFT_DPORT "dport"
#define NFTLB_NFT_SADDR "saddr"
#define NFTLB_NFT_SPORT "sport"
#define NFTLB_NFT_VERDICT_DROP "drop"
#define NFTLB_NFT_VERDICT_ACCEPT "accept"
#define NFTLB_NFT_PREFIX_POLICY_BL "BL"
#define NFTLB_NFT_PREFIX_POLICY_WL "WL"
#define NFTLB_NFT_ACTION_ADD "add"
#define NFTLB_NFT_ACTION_DEL "delete"
#define NFTLB_NFT_ACTION_FLUSH "flush"
enum map_modes {
BCK_MAP_NONE,
BCK_MAP_IPADDR,
BCK_MAP_ETHADDR,
BCK_MAP_WEIGHT,
BCK_MAP_MARK,
BCK_MAP_IPADDR_PORT,
BCK_MAP_NAME,
BCK_MAP_SRCIPADDR,
BCK_MAP_BCK_IPADDR,
BCK_MAP_BCK_IPADDR_F_PORT,
BCK_MAP_BCK_IPADDR_BF_PORT
};
struct if_base_rule {
char *ifname;
unsigned int active;
};
struct if_base_rule * ndv_base_rules[NFTLB_MAX_IFACES];
unsigned int n_ndv_base_rules = 0;
unsigned int nat_base_rules = 0;
unsigned int filter_base_rules = 0;
static int exec_cmd(char *cmd)
{
struct nft_ctx *ctx;
int error;
if (strlen(cmd) == 0 || strcmp(cmd, "") == 0)
return 0;
syslog(LOG_NOTICE, "nft command exec : %s", cmd);
ctx = nft_ctx_new(0);
nft_ctx_buffer_error(ctx);
error = nft_run_cmd_from_buffer(ctx, cmd);
if (error)
syslog(LOG_ERR, "nft command error : %s", nft_ctx_get_error_buffer(ctx));
nft_ctx_unbuffer_error(ctx);
nft_ctx_free(ctx);
return error;
}
static char * print_nft_service(int family, int proto)
{
if (family == VALUE_FAMILY_IPV6) {
switch (proto) {
case VALUE_PROTO_TCP:
return NFTLB_TCP_SERVICES6_MAP;
case VALUE_PROTO_UDP:
return NFTLB_UDP_SERVICES6_MAP;
case VALUE_PROTO_SCTP:
return NFTLB_SCTP_SERVICES6_MAP;
default:
return NFTLB_IP_SERVICES6_MAP;
}
} else {
switch (proto) {
case VALUE_PROTO_TCP:
return NFTLB_TCP_SERVICES_MAP;
case VALUE_PROTO_UDP:
return NFTLB_UDP_SERVICES_MAP;
case VALUE_PROTO_SCTP:
return NFTLB_SCTP_SERVICES_MAP;
default:
return NFTLB_IP_SERVICES_MAP;
}
}
}
static char * print_nft_family_type(int family)
{
switch (family) {
case VALUE_FAMILY_IPV6:
return NFTLB_MAP_TYPE_IPV6;
default:
return NFTLB_MAP_TYPE_IPV4;
}
}
static char * print_nft_family(int family)
{
switch (family) {
case VALUE_FAMILY_IPV6:
return NFTLB_IPV6_FAMILY;
default:
return NFTLB_IPV4_FAMILY;
}
}
static char * print_nft_family_protocol(int family)
{
switch (family) {
case VALUE_FAMILY_IPV6:
return NFTLB_IPV6_PROTOCOL;
default:
return NFTLB_IPV4_PROTOCOL;
}
}
static char * print_nft_table_family(int family, int mode)
{
if (mode == VALUE_MODE_DSR || mode == VALUE_MODE_STLSDNAT)
return NFTLB_NETDEV_FAMILY;
else if (family == VALUE_FAMILY_IPV6)
return NFTLB_IPV6_FAMILY;
else
return NFTLB_IPV4_FAMILY;
}
static char * print_nft_protocol(int protocol)
{
switch (protocol) {
case VALUE_PROTO_UDP:
return NFTLB_UDP_PROTO;
case VALUE_PROTO_SCTP:
return NFTLB_SCTP_PROTO;
default:
return NFTLB_TCP_PROTO;
}
}
static char * print_nft_verdict(enum type type)
{
if (type == VALUE_TYPE_WHITE)
return NFTLB_NFT_VERDICT_ACCEPT;
else
return NFTLB_NFT_VERDICT_DROP;
}
static char * print_nft_prefix_policy(enum type type)
{
if (type == VALUE_TYPE_WHITE)
return NFTLB_NFT_PREFIX_POLICY_WL;
else
return NFTLB_NFT_PREFIX_POLICY_BL;
}
static void get_range_ports(const char *ptr, int *first, int *last)
{
sscanf(ptr, "%d-%d[^,]", first, last);
}
static struct if_base_rule * get_ndv_base(char *ifname)
{
unsigned int i;
for (i = 0; i < n_ndv_base_rules; i++) {
if (strcmp(ndv_base_rules[i]->ifname, ifname) == 0)
return ndv_base_rules[i];
}
return NULL;
}
static struct if_base_rule * add_ndv_base(char *ifname)
{
struct if_base_rule *ifentry;
if (n_ndv_base_rules == NFTLB_MAX_IFACES)
return NULL;
ifentry = (struct if_base_rule *)malloc(sizeof(struct if_base_rule));
if (!ifentry)
return NULL;
ndv_base_rules[n_ndv_base_rules] = ifentry;
n_ndv_base_rules++;
ifentry->ifname = (char *)malloc(strlen(ifname));
if (!ifentry->ifname)
return NULL;
sprintf(ifentry->ifname, "%s", ifname);
ifentry->active = 0;
return ifentry;
}
static int reset_ndv_base(void)
{
unsigned int i;
for (i = 0; i < n_ndv_base_rules; i++) {
if (ndv_base_rules[i]->ifname)
free(ndv_base_rules[i]->ifname);
if (ndv_base_rules[i])
free(ndv_base_rules[i]);
}
return 0;
}
static unsigned int get_rules_needed(int family, int protocol, int key)
{
unsigned int ret = 0;
if (family == VALUE_FAMILY_IPV4 || family == VALUE_FAMILY_INET) {
switch (protocol) {
case VALUE_PROTO_UDP:
ret |= NFTLB_IPV4_ACTIVE | NFTLB_IPV4_UDP_ACTIVE;
break;
case VALUE_PROTO_TCP:
ret |= NFTLB_IPV4_ACTIVE | NFTLB_IPV4_TCP_ACTIVE;
break;
case VALUE_PROTO_SCTP:
ret |= NFTLB_IPV4_ACTIVE | NFTLB_IPV4_SCTP_ACTIVE;
break;
default:
ret |= NFTLB_IPV4_ACTIVE | NFTLB_IPV4_IP_ACTIVE;
break;
}
}
if (family == VALUE_FAMILY_IPV6 || family == VALUE_FAMILY_INET) {
switch (protocol) {
case VALUE_PROTO_UDP:
ret |= NFTLB_IPV6_ACTIVE | NFTLB_IPV6_UDP_ACTIVE;
break;
case VALUE_PROTO_TCP:
ret |= NFTLB_IPV6_ACTIVE | NFTLB_IPV6_TCP_ACTIVE;
break;
case VALUE_PROTO_SCTP:
ret |= NFTLB_IPV6_ACTIVE | NFTLB_IPV6_SCTP_ACTIVE;
break;
default:
ret |= NFTLB_IPV6_ACTIVE | NFTLB_IPV6_IP_ACTIVE;
break;
}
}
return ret;
}
static int need_filter(struct farm *f)
{
return (!farm_is_ingress_mode(f)) && (f->helper != DEFAULT_HELPER || f->bcks_are_marked || f->mark != DEFAULT_MARK || farm_get_masquerade(f) ||
f->newrtlimit != DEFAULT_NEWRTLIMIT || f->rstrtlimit != DEFAULT_RSTRTLIMIT || f->estconnlimit != DEFAULT_ESTCONNLIMIT ||
f->tcpstrict != DEFAULT_TCPSTRICT || f->queue != DEFAULT_QUEUE || f->persistence != DEFAULT_PERSIST ||
(f->srcaddr != DEFAULT_SRCADDR && strcmp(f->srcaddr, "") != 0));
}
static int run_base_table(struct sbuffer *buf, char *family_str)
{
concat_buf(buf, " ; add table %s %s", family_str, NFTLB_TABLE_NAME);
return 0;
}
static int run_base_chain_ndv(struct sbuffer *buf, struct farm *f, int key)
{
struct if_base_rule *if_base;
unsigned int rules_needed;
char *if_str = f->iface;
char *addr_str = NFTLB_NFT_DADDR;
char *port_str = NFTLB_NFT_DPORT;
char chain[255] = { 0 };
if (key == KEY_OFACE) {
if_str = f->oface;
addr_str = NFTLB_NFT_SADDR;
port_str = NFTLB_NFT_SPORT;
}
sprintf(chain, "%s-%s", NFTLB_TABLE_INGRESS, if_str);
rules_needed = get_rules_needed(f->family, f->protocol, key);
if_base = get_ndv_base(if_str);
if (!if_base)
if_base = add_ndv_base(if_str);
if (((rules_needed & NFTLB_IPV4_ACTIVE) && !(if_base->active & NFTLB_IPV4_ACTIVE)) ||
((rules_needed & NFTLB_IPV6_ACTIVE) && !(if_base->active & NFTLB_IPV6_ACTIVE))) {
concat_buf(buf, " ; add chain %s %s %s { type %s hook %s device %s priority %d ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_TYPE_FILTER, NFTLB_HOOK_INGRESS, if_str, NFTLB_INGRESS_PRIO);
if_base->active |= NFTLB_IPV4_ACTIVE;
if_base->active |= NFTLB_IPV6_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_UDP_ACTIVE) && !(if_base->active & NFTLB_IPV4_UDP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s %s . %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV4_FAMILY, addr_str, NFTLB_UDP_PROTO, port_str, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str);
if_base->active |= NFTLB_IPV4_UDP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_TCP_ACTIVE) && !(if_base->active & NFTLB_IPV4_TCP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s %s . %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV4_FAMILY, addr_str, NFTLB_TCP_PROTO, port_str, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str);
if_base->active |= NFTLB_IPV4_TCP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_SCTP_ACTIVE) && !(if_base->active & NFTLB_IPV4_SCTP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s %s . %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV4_FAMILY, addr_str, NFTLB_SCTP_PROTO, port_str, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str);
if_base->active |= NFTLB_IPV4_SCTP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_UDP_ACTIVE) && !(if_base->active & NFTLB_IPV6_UDP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s %s . %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV6_FAMILY, addr_str, NFTLB_UDP_PROTO, port_str, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str);
if_base->active |= NFTLB_IPV6_UDP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_TCP_ACTIVE) && !(if_base->active & NFTLB_IPV6_TCP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s %s . %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV6_FAMILY, addr_str, NFTLB_TCP_PROTO, port_str, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str);
if_base->active |= NFTLB_IPV6_TCP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_SCTP_ACTIVE) && !(if_base->active & NFTLB_IPV6_SCTP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s %s . %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV6_FAMILY, addr_str, NFTLB_SCTP_PROTO, port_str, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str);
if_base->active |= NFTLB_IPV6_SCTP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_IP_ACTIVE) && !(if_base->active & NFTLB_IPV4_IP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str, NFTLB_MAP_TYPE_IPV4);
concat_buf(buf, " ; add rule %s %s %s %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV4_FAMILY, addr_str, print_nft_service(VALUE_FAMILY_IPV4, f->protocol), if_str);
if_base->active |= NFTLB_IPV4_IP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_IP_ACTIVE) && !(if_base->active & NFTLB_IPV6_IP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s : verdict ;}", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str, NFTLB_MAP_TYPE_IPV6);
concat_buf(buf, " ; add rule %s %s %s %s %s vmap @%s-%s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, NFTLB_IPV6_FAMILY, addr_str, print_nft_service(VALUE_FAMILY_IPV6, f->protocol), if_str);
if_base->active |= NFTLB_IPV6_IP_ACTIVE;
}
return 0;
}
static int run_base_nat(struct sbuffer *buf, struct farm *f)
{
unsigned int rules_needed = get_rules_needed(f->family, f->protocol, KEY_IFACE);
if ((rules_needed & NFTLB_IPV4_ACTIVE) && !(nat_base_rules & NFTLB_IPV4_ACTIVE)) {
run_base_table(buf, NFTLB_IPV4_FAMILY);
concat_buf(buf, " ; add chain %s %s %s { type %s hook %s priority %d ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_TYPE_NAT, NFTLB_HOOK_PREROUTING, NFTLB_PREROUTING_PRIO);
concat_buf(buf, " ; add chain %s %s %s { type %s hook %s priority %d ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_TYPE_NAT, NFTLB_HOOK_POSTROUTING, NFTLB_POSTROUTING_PRIO);
concat_buf(buf, " ; add rule %s %s %s ct mark and 0x%x == 0x%x masquerade", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_POSTROUTING_MARK, NFTLB_POSTROUTING_MARK);
nat_base_rules |= NFTLB_IPV4_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_ACTIVE) && !(nat_base_rules & NFTLB_IPV6_ACTIVE)) {
run_base_table(buf, NFTLB_IPV6_FAMILY);
concat_buf(buf, " ; add chain %s %s %s { type %s hook %s priority %d ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_TYPE_NAT, NFTLB_HOOK_PREROUTING, NFTLB_PREROUTING_PRIO);
concat_buf(buf, " ; add chain %s %s %s { type %s hook %s priority %d ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_TYPE_NAT, NFTLB_HOOK_POSTROUTING, NFTLB_POSTROUTING_PRIO);
concat_buf(buf, " ; add rule %s %s %s ct mark and 0x%x == 0x%x masquerade", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_POSTROUTING_MARK, NFTLB_POSTROUTING_MARK);
nat_base_rules |= NFTLB_IPV6_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_UDP_ACTIVE) && !(nat_base_rules & NFTLB_IPV4_UDP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_UDP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV4_FAMILY, NFTLB_UDP_PROTO, NFTLB_TYPE_NAT, NFTLB_UDP_SERVICES_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s . %s : %s ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_UDP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV, NFTLB_MAP_TYPE_IPV4);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr . %s dport map @%s-back", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV4_FAMILY, NFTLB_UDP_PROTO, NFTLB_UDP_SERVICES_MAP);
nat_base_rules |= NFTLB_IPV4_UDP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_TCP_ACTIVE) && !(nat_base_rules & NFTLB_IPV4_TCP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_TCP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV4_FAMILY, NFTLB_TCP_PROTO, NFTLB_TYPE_NAT, NFTLB_TCP_SERVICES_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s . %s : %s ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TCP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV, NFTLB_MAP_TYPE_IPV4);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr . %s dport map @%s-back", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV4_FAMILY, NFTLB_TCP_PROTO, NFTLB_TCP_SERVICES_MAP);
nat_base_rules |= NFTLB_IPV4_TCP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_SCTP_ACTIVE) && !(nat_base_rules & NFTLB_IPV4_SCTP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_SCTP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV4_FAMILY, NFTLB_SCTP_PROTO, NFTLB_TYPE_NAT, NFTLB_SCTP_SERVICES_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s . %s : %s ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_SCTP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV, NFTLB_MAP_TYPE_IPV4);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr . %s dport map @%s-back", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV4_FAMILY, NFTLB_SCTP_PROTO, NFTLB_SCTP_SERVICES_MAP);
nat_base_rules |= NFTLB_IPV4_SCTP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_IP_ACTIVE) && !(nat_base_rules & NFTLB_IPV4_IP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_IP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4);
concat_buf(buf, " ; add rule %s %s %s %s daddr vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV4_FAMILY, NFTLB_TYPE_NAT, NFTLB_IP_SERVICES_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s : %s ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_IP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_IPV4);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr map @%s-back", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV4_FAMILY, NFTLB_IP_SERVICES_MAP);
nat_base_rules |= NFTLB_IPV4_IP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_UDP_ACTIVE) && !(nat_base_rules & NFTLB_IPV6_UDP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_UDP_SERVICES6_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV6_FAMILY, NFTLB_UDP_PROTO, NFTLB_TYPE_NAT, NFTLB_UDP_SERVICES6_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s . %s : %s ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_UDP_SERVICES6_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV, NFTLB_MAP_TYPE_IPV6);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr . %s dport map @%s-back", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV6_FAMILY, NFTLB_UDP_PROTO, NFTLB_UDP_SERVICES6_MAP);
nat_base_rules |= NFTLB_IPV6_UDP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_TCP_ACTIVE) && !(nat_base_rules & NFTLB_IPV6_TCP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_TCP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV6_FAMILY, NFTLB_TCP_PROTO, NFTLB_TYPE_NAT, NFTLB_TCP_SERVICES_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s . %s : %s ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TCP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV, NFTLB_MAP_TYPE_IPV6);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr . %s dport map @%s-back", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV6_FAMILY, NFTLB_TCP_PROTO, NFTLB_TCP_SERVICES_MAP);
nat_base_rules |= NFTLB_IPV6_TCP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_SCTP_ACTIVE) && !(nat_base_rules & NFTLB_IPV6_SCTP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_SCTP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV6_FAMILY, NFTLB_SCTP_PROTO, NFTLB_TYPE_NAT, NFTLB_SCTP_SERVICES_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s . %s : %s ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_SCTP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV, NFTLB_MAP_TYPE_IPV6);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr . %s dport map @%s-back", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV6_FAMILY, NFTLB_SCTP_PROTO, NFTLB_SCTP_SERVICES_MAP);
nat_base_rules |= NFTLB_IPV6_SCTP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_IP_ACTIVE) && !(nat_base_rules & NFTLB_IPV6_IP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_NAT, NFTLB_IP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6);
concat_buf(buf, " ; add rule %s %s %s %s daddr vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_PREROUTING, NFTLB_IPV6_FAMILY, NFTLB_TYPE_NAT, NFTLB_IP_SERVICES_MAP);
concat_buf(buf, " ; add map %s %s %s-back { type %s : %s ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_IP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_IPV6);
concat_buf(buf, " ; add rule %s %s %s snat to %s daddr map @%s-back", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_POSTROUTING, NFTLB_IPV6_FAMILY, NFTLB_IP_SERVICES_MAP);
nat_base_rules |= NFTLB_IPV6_IP_ACTIVE;
}
return 0;
}
static int run_base_filter(struct sbuffer *buf, struct farm *f)
{
unsigned int rules_needed = get_rules_needed(f->family, f->protocol, KEY_IFACE);
if ((rules_needed & NFTLB_IPV4_ACTIVE) && !(filter_base_rules & NFTLB_IPV4_ACTIVE)) {
run_base_table(buf, NFTLB_IPV4_FAMILY);
concat_buf(buf, " ; add chain %s %s %s { type %s hook %s priority %d ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_TYPE_FILTER, NFTLB_HOOK_PREROUTING, NFTLB_FILTER_PRIO);
concat_buf(buf, " ; add rule %s %s %s mark set ct mark", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER);
filter_base_rules |= NFTLB_IPV4_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_ACTIVE) && !(filter_base_rules & NFTLB_IPV6_ACTIVE)) {
run_base_table(buf, NFTLB_IPV6_FAMILY);
concat_buf(buf, " ; add chain %s %s %s { type %s hook %s priority %d ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_TYPE_FILTER, NFTLB_HOOK_PREROUTING, NFTLB_FILTER_PRIO);
concat_buf(buf, " ; add rule %s %s %s mark set ct mark", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER);
filter_base_rules |= NFTLB_IPV6_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_UDP_ACTIVE) && !(filter_base_rules & NFTLB_IPV4_UDP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_UDP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV4_FAMILY, NFTLB_UDP_PROTO, NFTLB_TYPE_FILTER, NFTLB_UDP_SERVICES_MAP);
filter_base_rules |= NFTLB_IPV4_UDP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_TCP_ACTIVE) && !(filter_base_rules & NFTLB_IPV4_TCP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_TCP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV4_FAMILY, NFTLB_TCP_PROTO, NFTLB_TYPE_FILTER, NFTLB_TCP_SERVICES_MAP);
filter_base_rules |= NFTLB_IPV4_TCP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_SCTP_ACTIVE) && !(filter_base_rules & NFTLB_IPV4_SCTP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_SCTP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV4_FAMILY, NFTLB_SCTP_PROTO, NFTLB_TYPE_FILTER, NFTLB_SCTP_SERVICES_MAP);
filter_base_rules |= NFTLB_IPV4_SCTP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV4_IP_ACTIVE) && !(filter_base_rules & NFTLB_IPV4_IP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s : verdict ;}", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_IP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV4);
concat_buf(buf, " ; add rule %s %s %s %s daddr vmap @%s-%s", NFTLB_IPV4_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV4_FAMILY, NFTLB_TYPE_FILTER, NFTLB_IP_SERVICES_MAP);
filter_base_rules |= NFTLB_IPV4_IP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_UDP_ACTIVE) && !(filter_base_rules & NFTLB_IPV6_UDP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_UDP_SERVICES6_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV6_FAMILY, NFTLB_UDP_PROTO, NFTLB_TYPE_FILTER, NFTLB_UDP_SERVICES6_MAP);
filter_base_rules |= NFTLB_IPV6_UDP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_TCP_ACTIVE) && !(filter_base_rules & NFTLB_IPV6_TCP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_TCP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV6_FAMILY, NFTLB_TCP_PROTO, NFTLB_TYPE_FILTER, NFTLB_TCP_SERVICES_MAP);
filter_base_rules |= NFTLB_IPV6_TCP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_SCTP_ACTIVE) && !(filter_base_rules & NFTLB_IPV6_SCTP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s . %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_SCTP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6, NFTLB_MAP_TYPE_INETSRV);
concat_buf(buf, " ; add rule %s %s %s %s daddr . %s dport vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV6_FAMILY, NFTLB_SCTP_PROTO, NFTLB_TYPE_FILTER, NFTLB_SCTP_SERVICES_MAP);
filter_base_rules |= NFTLB_IPV6_SCTP_ACTIVE;
}
if ((rules_needed & NFTLB_IPV6_IP_ACTIVE) && !(filter_base_rules & NFTLB_IPV6_IP_ACTIVE)) {
concat_buf(buf, " ; add map %s %s %s-%s { type %s : verdict ;}", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TYPE_FILTER, NFTLB_IP_SERVICES_MAP, NFTLB_MAP_TYPE_IPV6);
concat_buf(buf, " ; add rule %s %s %s %s daddr vmap @%s-%s", NFTLB_IPV6_FAMILY, NFTLB_TABLE_NAME, NFTLB_TABLE_FILTER, NFTLB_IPV6_FAMILY, NFTLB_TYPE_FILTER, NFTLB_IP_SERVICES_MAP);
filter_base_rules |= NFTLB_IPV6_IP_ACTIVE;
}
return 0;
}
static int run_farm_rules_gen_chains(struct sbuffer *buf, char *nft_family, char *chain, int action)
{
switch (action) {
case ACTION_RELOAD:
concat_buf(buf, " ; flush chain %s %s %s", nft_family, NFTLB_TABLE_NAME, chain);
break;
case ACTION_START:
concat_buf(buf, " ; add chain %s %s %s", nft_family, NFTLB_TABLE_NAME, chain);
break;
case ACTION_DELETE:
concat_buf(buf, " ; flush chain %s %s %s", nft_family, NFTLB_TABLE_NAME, chain);
concat_buf(buf, " ; delete chain %s %s %s", nft_family, NFTLB_TABLE_NAME, chain);
break;
default:
break;
}
return 0;
}
static int get_array_ports(int *port_list, struct farm *f)
{
int index = 0;
char *ptr;
int i, new;
int last = 0;
ptr = f->virtports;
while (ptr != NULL && *ptr != '\0') {
last = new = 0;
get_range_ports(ptr, &new, &last);
if (last == 0)
last = new;
if (new > last)
goto next;
for (i = new; i <= last; i++, index++)
port_list[index] = i;
next:
ptr = strchr(ptr, ',');
if (ptr != NULL)
ptr++;
}
return index;
}
static int run_farm_rules_gen_srv(struct sbuffer *buf, struct farm *f, char *nft_family, char *chain, char *service, int action, enum map_modes key_mode, enum map_modes data_mode)
{
int port_list[65535] = { 0 };
char action_str[255] = { 0 };
char data_str[255] = { 0 };
struct backend *b;
int nports;
int i;
switch (action) {
case ACTION_RELOAD:
case ACTION_START:
sprintf(action_str, "add");
break;
case ACTION_STOP:
case ACTION_DELETE:
sprintf(action_str, "delete");
break;
default:
break;
}
switch (data_mode) {
case BCK_MAP_SRCIPADDR:
sprintf(data_str, ": %s ", f->srcaddr);
break;
case BCK_MAP_NAME:
sprintf(data_str, ": goto %s ", chain);
break;
default:
break;
}
/* avoid port in cases of listening from all protocols */
if (f->protocol == VALUE_PROTO_ALL && key_mode == BCK_MAP_IPADDR_PORT)
key_mode = BCK_MAP_IPADDR;
if (f->protocol == VALUE_PROTO_ALL && (key_mode == BCK_MAP_BCK_IPADDR_F_PORT || key_mode == BCK_MAP_BCK_IPADDR_BF_PORT))
key_mode = BCK_MAP_BCK_IPADDR;
switch (key_mode) {
case BCK_MAP_IPADDR:
concat_buf(buf, " ; %s element %s %s %s { %s %s}", action_str, nft_family, NFTLB_TABLE_NAME, service, f->virtaddr, data_str);
break;
case BCK_MAP_BCK_IPADDR:
list_for_each_entry(b, &f->backends, list) {
if (b->action == ACTION_STOP || b->action == ACTION_DELETE) {
if (action == ACTION_START)
continue;
concat_buf(buf, " ; delete element %s %s %s { %s }", nft_family, NFTLB_TABLE_NAME, service, b->ipaddr);
}
if(!backend_is_available(b))
continue;
concat_buf(buf, " ; %s element %s %s %s { %s %s}", action_str, nft_family, NFTLB_TABLE_NAME, service, b->ipaddr, data_str);
}
break;
case BCK_MAP_IPADDR_PORT:
nports = get_array_ports(port_list, f);
for (i = 0; i < nports; i++)
concat_buf(buf, " ; %s element %s %s %s { %s . %d %s}", action_str, nft_family, NFTLB_TABLE_NAME, service, f->virtaddr, port_list[i], data_str);
break;
case BCK_MAP_BCK_IPADDR_F_PORT:
nports = get_array_ports(port_list, f);
for (i = 0; i < nports; i++) {
list_for_each_entry(b, &f->backends, list) {
if (b->action == ACTION_STOP || b->action == ACTION_DELETE || b->action == ACTION_RELOAD) {
if (action == ACTION_START)
continue;
concat_buf(buf, " ; delete element %s %s %s { %s . %d }", nft_family, NFTLB_TABLE_NAME, service, b->ipaddr, port_list[i]);
}
if(!backend_is_available(b))
continue;
concat_buf(buf, " ; %s element %s %s %s { %s . %d %s}", action_str, nft_family, NFTLB_TABLE_NAME, service, b->ipaddr, port_list[i], data_str);
}
}
break;
case BCK_MAP_BCK_IPADDR_BF_PORT:
list_for_each_entry(b, &f->backends, list) {
if (strcmp(b->port, DEFAULT_PORT) == 0) {
nports = get_array_ports(port_list, f);
for (i = 0; i < nports; i++) {
if (b->action == ACTION_STOP || b->action == ACTION_DELETE || b->action == ACTION_RELOAD) {
if (action == ACTION_START)
continue;
concat_buf(buf, " ; delete element %s %s %s { %s . %d }", nft_family, NFTLB_TABLE_NAME, service, b->ipaddr, port_list[i]);
}
if(!backend_is_available(b))
continue;
concat_buf(buf, " ; %s element %s %s %s { %s . %d %s}", action_str, nft_family, NFTLB_TABLE_NAME, service, b->ipaddr, port_list[i], data_str);
}
} else {
if (b->action == ACTION_STOP || b->action == ACTION_DELETE || b->action == ACTION_RELOAD) {
if (action == ACTION_START)
continue;
concat_buf(buf, " ; delete element %s %s %s { %s . %s }", nft_family, NFTLB_TABLE_NAME, service, b->ipaddr, b->port);
}
if(!backend_is_available(b))
continue;
concat_buf(buf, " ; %s element %s %s %s { %s . %s %s}", action_str, nft_family, NFTLB_TABLE_NAME, service, b->ipaddr, b->port, data_str);
}
}
break;
default:
return -1;
break;
}
return 0;
}
static int run_farm_snat(struct sbuffer *buf, struct farm *f, int family, int action)
{
char name[255] = { 0 };
if (f->mode != VALUE_MODE_SNAT || farm_get_masquerade(f))
return 0;
sprintf(name, "%s-back", print_nft_service(family, f->protocol));
run_farm_rules_gen_srv(buf, f, print_nft_table_family(family, f->mode), name, name, action, BCK_MAP_BCK_IPADDR_BF_PORT, BCK_MAP_SRCIPADDR);
return 0;
}
static int run_farm_stlsnat(struct sbuffer *buf, struct farm *f, int family, int action)
{
char action_str[255] = { 0 };
char chain[255] = { 0 };
char services[255] = { 0 };
sprintf(chain, "%s-back", f->name);
sprintf(services, "%s-%s", print_nft_service(family, f->protocol), f->oface);
switch (action) {
case ACTION_DELETE:
sprintf(action_str, "delete");
run_farm_rules_gen_srv(buf, f, print_nft_table_family(family, f->mode), chain, services, action, BCK_MAP_BCK_IPADDR_F_PORT, BCK_MAP_NAME);
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, action);
break;
default:
sprintf(action_str, "add");
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, action);
concat_buf(buf, " ; %s rule %s %s %s %s saddr set %s ether saddr set %s fwd to %s", action_str, print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, print_nft_family(family), f->virtaddr, f->iethaddr, f->iface);
run_farm_rules_gen_srv(buf, f, print_nft_table_family(family, f->mode), chain, services, action, BCK_MAP_BCK_IPADDR_F_PORT, BCK_MAP_NAME);
break;
}
return 0;
}
static int run_farm_rules_gen_meta_param(struct sbuffer *buf, struct farm *f, int family, int param, int type)
{
int items = 0;
if ((param & VALUE_META_NONE) ||
(param & VALUE_META_SRCIP)) {
(type == NFTLB_MAP_KEY_TYPE) ? concat_buf(buf, " %s", print_nft_family_type(family)) : concat_buf(buf, " %s saddr", print_nft_family(family));
items++;
}
if (param & VALUE_META_DSTIP) {
if (items)
concat_buf(buf, " .");
(type == NFTLB_MAP_KEY_TYPE) ? concat_buf(buf, " %s", print_nft_family_type(family)) : concat_buf(buf, " %s daddr", print_nft_family(family));
items++;
}
if (param & VALUE_META_SRCPORT) {
if (items)
concat_buf(buf, " .");
(type == NFTLB_MAP_KEY_TYPE) ? concat_buf(buf, " inet_service") : concat_buf(buf, " %s sport", print_nft_protocol(f->protocol));
items++;
}
if (param & VALUE_META_DSTPORT) {
if (items)
concat_buf(buf, " .");
(type == NFTLB_MAP_KEY_TYPE) ? concat_buf(buf, " inet_service") : concat_buf(buf, " %s dport", print_nft_protocol(f->protocol));
items++;
}
if (param & VALUE_META_SRCMAC) {
if (items)
concat_buf(buf, " .");
(type == NFTLB_MAP_KEY_TYPE) ? concat_buf(buf, " ether_addr") : concat_buf(buf, " ether saddr");
items++;
}
if (param & VALUE_META_DSTMAC) {
if (items)
concat_buf(buf, " .");
(type == NFTLB_MAP_KEY_TYPE) ? concat_buf(buf, " ether_addr") : concat_buf(buf, " ether daddr");
}
return 0;
}
static int run_farm_rules_gen_sched(struct sbuffer *buf, struct farm *f, int family)
{
switch (f->scheduler) {
case VALUE_SCHED_RR:
concat_buf(buf, " numgen inc mod %d", f->total_weight);
break;
case VALUE_SCHED_WEIGHT:
concat_buf(buf, " numgen random mod %d", f->total_weight);
break;
case VALUE_SCHED_HASH:
concat_buf(buf, " jhash");
run_farm_rules_gen_meta_param(buf, f, family, f->schedparam, NFTLB_MAP_KEY_RULE);
concat_buf(buf, " mod %d", f->total_weight);
break;
case VALUE_SCHED_SYMHASH:
if (f->bcks_available != 1) // FIXME: Control bug in nftables
concat_buf(buf, " symhash mod %d", f->total_weight);
break;
default:
return -1;
}
return 0;
}
static int get_farm_mark(struct farm *f)
{
int mark = f->mark;
if (farm_get_masquerade(f))
mark |= NFTLB_POSTROUTING_MARK;
return mark;
}
static int run_farm_rules_gen_bck_map(struct sbuffer *buf, struct farm *f, enum map_modes key_mode, enum map_modes data_mode)
{
struct backend *b;
int offset = get_farm_mark(f);
int i = 0;
int last = 0;
int new;
// FIXME: Control bug in nftables
if (f->scheduler == VALUE_SCHED_SYMHASH && f->bcks_available == 1) {
list_for_each_entry(b, &f->backends, list) {
if(!backend_is_available(b))
continue;
switch (data_mode) {
case BCK_MAP_MARK:
concat_buf(buf, " 0x%x", b->mark | offset);
break;
case BCK_MAP_ETHADDR:
concat_buf(buf, " %s", b->ethaddr);
break;
case BCK_MAP_IPADDR:
concat_buf(buf, " %s", b->ipaddr);
break;
default:
break;
}
}
return 0;
}
concat_buf(buf, " map {");
list_for_each_entry(b, &f->backends, list) {
if(!backend_is_available(b))
continue;
if (i != 0)
concat_buf(buf, ",");
switch (key_mode) {
case BCK_MAP_MARK:
concat_buf(buf, " 0x%x", b->mark | offset);
break;
case BCK_MAP_IPADDR:
concat_buf(buf, " %s", b->ipaddr);
break;
case BCK_MAP_WEIGHT:
new = last + b->weight - 1;
concat_buf(buf, " %d", last);
if (new != last)
concat_buf(buf, "-%d", new);
last = new + 1;
break;
default:
break;
}
concat_buf(buf, ":");
switch (data_mode) {
case BCK_MAP_MARK:
concat_buf(buf, " 0x%x", b->mark | offset);
break;
case BCK_MAP_ETHADDR:
concat_buf(buf, " %s", b->ethaddr);
break;
case BCK_MAP_IPADDR:
concat_buf(buf, " %s", b->ipaddr);
break;
default:
break;
}
i++;
}
concat_buf(buf, " }");
if (i == 0)
return -1;
return 0;
}
static void run_farm_helper(struct sbuffer *buf, struct farm *f, int family, int action, char *protocol)
{
switch (action) {
case ACTION_START:
concat_buf(buf, " ; add ct helper %s %s %s-%s { type \"%s\" protocol %s ; } ;", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, obj_print_helper(f->helper), protocol, obj_print_helper(f->helper), protocol);
break;
case ACTION_DELETE:
case ACTION_STOP:
concat_buf(buf, " ; delete ct helper %s %s %s-%s ; ", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, obj_print_helper(f->helper), protocol);
break;
case ACTION_RELOAD:
default:
break;
}
}
static int run_farm_rules_filter_helper(struct sbuffer *buf, struct farm *f, int family, char *chain, int action)
{
char protocol[255] = {0};
if (!(f->helper != DEFAULT_HELPER && (f->mode == VALUE_MODE_SNAT || f->mode == VALUE_MODE_DNAT)))
return 0;
if (f->protocol == VALUE_PROTO_TCP || f->protocol == VALUE_PROTO_ALL) {
sprintf(protocol, "tcp");
run_farm_helper(buf, f, family, action, protocol);
if (action == ACTION_START || action == ACTION_RELOAD)
concat_buf(buf, " ; add rule %s %s %s %s %s %s ct helper set %s-%s", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, print_nft_table_family(family, f->mode), print_nft_family_protocol(family), protocol, obj_print_helper(f->helper), protocol);
}
if (f->protocol == VALUE_PROTO_UDP || f->protocol == VALUE_PROTO_ALL) {
sprintf(protocol, "udp");
run_farm_helper(buf, f, family, action, protocol);
if (action == ACTION_START || action == ACTION_RELOAD)
concat_buf(buf, " ; add rule %s %s %s %s %s %s ct helper set %s-%s", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, print_nft_table_family(family, f->mode), print_nft_family_protocol(family), protocol, obj_print_helper(f->helper), protocol);
}
return 0;
}
static void run_farm_persistence(struct sbuffer *buf, struct farm *f, int family, int action)
{
switch (action) {
case ACTION_START:
concat_buf(buf, " ; add map %s %s persist-%s { type ", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, f->name);
run_farm_rules_gen_meta_param(buf, f, family, f->persistence, NFTLB_MAP_KEY_TYPE);
concat_buf(buf, " : mark; timeout %ds; }", f->persistttl);
break;
case ACTION_DELETE:
case ACTION_STOP:
concat_buf(buf, " ; delete map %s %s persist-%s", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, f->name);
break;
case ACTION_RELOAD:
default:
break;
}
}
static int run_farm_rules_filter_persistence(struct sbuffer *buf, struct farm *f, int family, char *chain, int action)
{
if (f->persistence == VALUE_META_NONE)
return 0;
run_farm_persistence(buf, f, family, action);
if ((action != ACTION_START && action != ACTION_RELOAD) || (!f->bcks_are_marked))
return 0;
concat_buf(buf, " ; add rule %s %s %s update @persist-%s { ", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, f->name);
run_farm_rules_gen_meta_param(buf, f, family, f->persistence, NFTLB_MAP_KEY_RULE);
concat_buf(buf, " : ct mark }");
return 0;
}
static void run_farm_meter(struct sbuffer *buf, struct farm *f, int family, char *name, int action)
{
switch (action) {
case ACTION_START:
concat_buf(buf, " ; add set %s %s %s { type %s ; flags dynamic ; } ;", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, name, print_nft_family_type(family));
break;
case ACTION_STOP:
concat_buf(buf, " ; delete set %s %s %s ; ", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, name);
break;
default:
break;
}
}
static int run_farm_rules_filter_policies(struct sbuffer *buf, struct farm *f, int family, char *chain, int action)
{
char meter_str[255] = {};
char burst_str[255] = {};
if ((action == ACTION_START || action == ACTION_RELOAD) && f->tcpstrict == VALUE_SWITCH_ON) {
sprintf(meter_str, "%s-%s", CONFIG_KEY_TCPSTRICT, f->name);
concat_buf(buf, " ; add rule %s %s %s ct state invalid log prefix \"%s\" drop",
print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, meter_str);
}
sprintf(meter_str, "%s-%s", CONFIG_KEY_NEWRTLIMIT, f->name);
if ((action == ACTION_START && f->newrtlimit != DEFAULT_NEWRTLIMIT) || (f->reload_action & VALUE_RLD_NEWRTLIMIT_START))
run_farm_meter(buf, f, family, meter_str, ACTION_START);
if (((action == ACTION_STOP || action == ACTION_DELETE) && f->newrtlimit != DEFAULT_NEWRTLIMIT) || (f->reload_action & VALUE_RLD_NEWRTLIMIT_STOP))
run_farm_meter(buf, f, family, meter_str, ACTION_STOP);
if ((action == ACTION_START || action == ACTION_RELOAD) && f->newrtlimit != DEFAULT_NEWRTLIMIT) {
if (f->newrtlimitbst != DEFAULT_RTLIMITBURST)
sprintf(burst_str, "burst %d packets ", f->newrtlimitbst);
concat_buf(buf, " ; add rule %s %s %s ct state new add @%s { ip saddr limit rate over %d/second %s} log prefix \"%s\" drop",
print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, meter_str, f->newrtlimit, burst_str, meter_str);
}
sprintf(meter_str, "%s-%s", CONFIG_KEY_RSTRTLIMIT, f->name);
if ((action == ACTION_START && f->rstrtlimit != DEFAULT_RSTRTLIMIT) || (f->reload_action & VALUE_RLD_RSTRTLIMIT_START))
run_farm_meter(buf, f, family, meter_str, ACTION_START);
if (((action == ACTION_STOP || action == ACTION_DELETE) && f->rstrtlimit != DEFAULT_RSTRTLIMIT) || (f->reload_action & VALUE_RLD_RSTRTLIMIT_STOP))
run_farm_meter(buf, f, family, meter_str, ACTION_STOP);
if ((action == ACTION_START || action == ACTION_RELOAD) && f->rstrtlimit != DEFAULT_RSTRTLIMIT) {
if (f->rstrtlimitbst != DEFAULT_RTLIMITBURST)
sprintf(burst_str, "burst %d packets ", f->rstrtlimitbst);
concat_buf(buf, " ; add rule %s %s %s tcp flags rst add @%s { ip saddr limit rate over %d/second %s} log prefix \"%s\" drop",
print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, meter_str, f->rstrtlimit, burst_str, meter_str);
}
sprintf(meter_str, "%s-%s", CONFIG_KEY_ESTCONNLIMIT, f->name);
if ((action == ACTION_START && f->estconnlimit != DEFAULT_ESTCONNLIMIT) || (f->reload_action & VALUE_RLD_ESTCONNLIMIT_START))
run_farm_meter(buf, f, family, meter_str, ACTION_START);
if (((action == ACTION_STOP || action == ACTION_DELETE) && f->estconnlimit != DEFAULT_ESTCONNLIMIT) || (f->reload_action & VALUE_RLD_ESTCONNLIMIT_STOP))
run_farm_meter(buf, f, family, meter_str, ACTION_STOP);
if ((action == ACTION_START || action == ACTION_RELOAD) && f->estconnlimit != DEFAULT_ESTCONNLIMIT)
concat_buf(buf, " ; add rule %s %s %s ct state new add @%s { ip saddr ct count over %d } log prefix \"%s\" drop",
print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, meter_str, f->estconnlimit, meter_str);
if ((action == ACTION_START || action == ACTION_RELOAD) && f->queue != DEFAULT_QUEUE) {
sprintf(meter_str, "%s-%s", CONFIG_KEY_QUEUE, f->name);
concat_buf(buf, " ; add rule %s %s %s tcp flags syn queue num %d bypass log prefix \"%s\"",
print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, f->queue, meter_str);
}
return 0;
}
static int run_farm_rules_gen_meter_per_bck(struct sbuffer *buf, struct farm *f, int family, char *chain, int action)
{
struct backend *b;
int offset = get_farm_mark(f);
char meter_str[255] = {};
list_for_each_entry(b, &f->backends, list) {
if (b->estconnlimit == 0)
continue;
sprintf(meter_str, "%s-%s-%s", CONFIG_KEY_ESTCONNLIMIT, f->name, b->name);
if (action == ACTION_START || b->action == ACTION_START)
run_farm_meter(buf, f, family, meter_str, ACTION_START);
if ((b->action == ACTION_STOP) || ((action == ACTION_STOP || action == ACTION_DELETE) && backend_is_available(b))) {
run_farm_meter(buf, f, family, meter_str, ACTION_STOP);
continue;
}
if (backend_is_available(b))
concat_buf(buf, " ; add rule %s %s %s ct mark 0x%x add @%s { ip saddr ct count over %d } log prefix \"%s\" drop",
print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, b->mark | offset, meter_str, b->estconnlimit, meter_str);
}
return 0;
}
static int run_farm_rules_filter_marks(struct sbuffer *buf, struct farm *f, int family, char *chain, int action)
{
int mark = get_farm_mark(f);
if (!f->bcks_are_marked && mark == DEFAULT_MARK)
return 0;
if ((action == ACTION_START || action == ACTION_RELOAD ) && f->bcks_available != 0) {
concat_buf(buf, " ; add rule %s %s %s", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain);
if (f->bcks_are_marked) {
concat_buf(buf, " ct mark set");
if (run_farm_rules_gen_sched(buf, f, family) == -1)
return -1;
run_farm_rules_gen_bck_map(buf, f, BCK_MAP_WEIGHT, BCK_MAP_MARK);
run_farm_rules_gen_meter_per_bck(buf, f, family, chain, action);
} else if (mark != DEFAULT_MARK) {
concat_buf(buf, " ct mark set");
concat_buf(buf, " 0x%x", mark);
}
} else if (action == ACTION_STOP || action == ACTION_DELETE || (action == ACTION_RELOAD && f->bcks_available == 0)) {
run_farm_rules_gen_meter_per_bck(buf, f, family, chain, action);
}
return 0;
}
static int run_farm_rules_filter(struct sbuffer *buf, struct farm *f, int family, int action)
{
char chain[255] = {0};
char service[255] = {0};
sprintf(chain, "%s-%s", NFTLB_TYPE_FILTER, f->name);
sprintf(service, "%s-%s", NFTLB_TYPE_FILTER, print_nft_service(family, f->protocol));
switch (action) {
case ACTION_START:
case ACTION_RELOAD:
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, action);
run_farm_rules_filter_policies(buf, f, family, chain, action);
run_farm_rules_filter_helper(buf, f, family, chain, action);
run_farm_rules_filter_marks(buf, f, family, chain, action);
run_farm_rules_filter_persistence(buf, f, family, chain, action);
if (action == ACTION_START)
run_farm_rules_gen_srv(buf, f, print_nft_table_family(family, f->mode), chain, service, action, BCK_MAP_IPADDR_PORT, BCK_MAP_NAME);
break;
case ACTION_DELETE:
case ACTION_STOP:
run_farm_rules_gen_srv(buf, f, print_nft_table_family(family, f->mode), chain, service, action, BCK_MAP_IPADDR_PORT, BCK_MAP_NONE);
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, action);
run_farm_rules_filter_persistence(buf, f, family, chain, action);
run_farm_rules_filter_marks(buf, f, family, chain, action);
run_farm_rules_filter_helper(buf, f, family, chain, action);
run_farm_rules_filter_policies(buf, f, family, chain, action);
break;
default:
break;
}
return 0;
}
static int run_farm_rules_ingress_policies(struct sbuffer *buf, struct farm *f, int family, char *chain)
{
struct farmpolicy *fp;
char prefix[255];
if (f->policies_action != ACTION_START && f->policies_action != ACTION_RELOAD)
return 0;
list_for_each_entry(fp, &f->policies, list) {
if (fp->policy->type != VALUE_TYPE_WHITE)
continue;
sprintf(prefix, "policy-%s-%s-%s", print_nft_prefix_policy(fp->policy->type), fp->policy->name, f->name);
concat_buf(buf, " ; add rule %s %s %s %s saddr @%s log prefix \"%s\" %s",
NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, print_nft_family(family), fp->policy->name, prefix, print_nft_verdict(fp->policy->type));
fp->action = ACTION_NONE;
}
list_for_each_entry(fp, &f->policies, list) {
if (fp->policy->type != VALUE_TYPE_BLACK)
continue;
sprintf(prefix, "policy-%s-%s-%s", print_nft_prefix_policy(fp->policy->type), fp->policy->name, f->name);
concat_buf(buf, " ; add rule %s %s %s %s saddr @%s log prefix \"%s\" %s",
NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, chain, print_nft_family(family), fp->policy->name, prefix, print_nft_verdict(fp->policy->type));
fp->action = ACTION_NONE;
}
return 0;
}
static int run_farm_ingress_policies(struct sbuffer *buf, struct farm *f, int family, int action)
{
char chain[255] = {0};
char service[255] = {0};
if (!farm_needs_policies(f))
return 0;
sprintf(chain, "%s", f->name);
sprintf(service, "%s-%s", print_nft_service(f->family, f->protocol), f->iface);
if (f->policies_action == ACTION_START) {
if (!farm_is_ingress_mode(f)) {
run_base_chain_ndv(buf, f, KEY_IFACE);
run_farm_rules_gen_chains(buf, NFTLB_NETDEV_FAMILY, chain, ACTION_START);
run_farm_rules_gen_srv(buf, f, NFTLB_NETDEV_FAMILY, chain, service, f->policies_action, BCK_MAP_IPADDR_PORT, BCK_MAP_NAME);
}
run_farm_rules_ingress_policies(buf, f, family, chain);
} else if (f->policies_action == ACTION_STOP && !farm_is_ingress_mode(f)) {
run_farm_rules_gen_srv(buf, f, NFTLB_NETDEV_FAMILY, chain, service, f->policies_action, BCK_MAP_IPADDR_PORT, BCK_MAP_NAME);
run_farm_rules_gen_chains(buf, NFTLB_NETDEV_FAMILY, chain, ACTION_DELETE);
} else if (f->policies_action == ACTION_RELOAD) {
if (!farm_is_ingress_mode(f)) {
run_base_chain_ndv(buf, f, KEY_IFACE);
run_farm_rules_gen_chains(buf, NFTLB_NETDEV_FAMILY, chain, ACTION_RELOAD);
}
run_farm_rules_ingress_policies(buf, f, family, chain);
} else {
}
f->policies_action = ACTION_NONE;
return 0;
}
static int run_farm_rules_gen_logs(struct sbuffer *buf, struct farm *f, int family, char *chain, int action)
{
if (f->log == VALUE_LOG_NONE)
return 0;
concat_buf(buf, " ; add rule %s %s %s", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain);
if (f->log & VALUE_LOG_INPUT)
concat_buf(buf, " log prefix \"INPUT-%s \"", chain);
// TODO: missing other log stages (forward, output)
return 0;
}
static int run_farm_rules_gen_nat_per_bck(struct sbuffer *buf, struct farm *f, int family, char *chain)
{
struct backend *b;
int offset = get_farm_mark(f);
list_for_each_entry(b, &f->backends, list) {
if(!backend_is_available(b))
continue;
concat_buf(buf, " ; add rule %s %s %s %s %s %s ct mark 0x%x dnat to %s", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, print_nft_table_family(family, f->mode), print_nft_family_protocol(family), print_nft_protocol(f->protocol), b->mark | offset, b->ipaddr);
if (strcmp(b->port, "") != 0)
concat_buf(buf, ":%s", b->port);
}
return 0;
}
static int run_farm_rules_gen_nat(struct sbuffer *buf, struct farm *f, int family, char *chain)
{
if (f->bcks_available == 0)
return 0;
switch (f->mode) {
case VALUE_MODE_DSR:
concat_buf(buf, " ; add rule %s %s %s ether saddr set %s ether daddr set", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, f->iethaddr);
run_farm_rules_gen_sched(buf, f, family);
run_farm_rules_gen_bck_map(buf, f, BCK_MAP_WEIGHT, BCK_MAP_ETHADDR);
concat_buf(buf, " fwd to %s", f->oface);
break;
case VALUE_MODE_STLSDNAT:
concat_buf(buf, " ; add rule %s %s %s %s daddr set", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain, print_nft_family(family));
run_farm_rules_gen_sched(buf, f, family);
run_farm_rules_gen_bck_map(buf, f, BCK_MAP_WEIGHT, BCK_MAP_IPADDR);
concat_buf(buf, " ether daddr set ip daddr");
run_farm_rules_gen_bck_map(buf, f, BCK_MAP_IPADDR, BCK_MAP_ETHADDR);
concat_buf(buf, " fwd to %s", f->oface);
break;
default:
if (!f->bcks_are_marked) {
concat_buf(buf, " ; add rule %s %s %s dnat to", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain);
run_farm_rules_gen_sched(buf, f, family);
run_farm_rules_gen_bck_map(buf, f, BCK_MAP_WEIGHT, BCK_MAP_IPADDR);
return 0;
}
if (!f->bcks_have_port) {
concat_buf(buf, " ; add rule %s %s %s dnat to", print_nft_table_family(family, f->mode), NFTLB_TABLE_NAME, chain);
concat_buf(buf, " ct mark");
run_farm_rules_gen_bck_map(buf, f, BCK_MAP_MARK, BCK_MAP_IPADDR);
return 0;
}
run_farm_rules_gen_nat_per_bck(buf, f, family, chain);
break;
}
return 0;
}
static int run_farm_rules(struct sbuffer *buf, struct farm *f, int family, int action)
{
char chain[255] = {0};
char service[255] = {0};
switch (f->mode) {
case VALUE_MODE_STLSDNAT:
sprintf(chain, "%s", f->name);
sprintf(service, "%s-%s", print_nft_service(family, f->protocol), f->iface);
run_base_table(buf, NFTLB_NETDEV_FAMILY);
run_base_chain_ndv(buf, f, KEY_OFACE);
run_base_chain_ndv(buf, f, KEY_IFACE);
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, action);
run_farm_ingress_policies(buf, f, family, action);
run_farm_rules_gen_logs(buf, f, family, chain, action);
run_farm_rules_gen_nat(buf, f, family, chain);
run_farm_stlsnat(buf, f, family, action);
break;
case VALUE_MODE_DSR:
sprintf(chain, "%s", f->name);
sprintf(service, "%s-%s", print_nft_service(family, f->protocol), f->iface);
run_base_table(buf, NFTLB_NETDEV_FAMILY);
run_base_chain_ndv(buf, f, KEY_IFACE);
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, action);
run_farm_ingress_policies(buf, f, family, action);
run_farm_rules_gen_logs(buf, f, family, chain, action);
run_farm_rules_gen_nat(buf, f, family, chain);
break;
default:
sprintf(chain, "%s-%s", NFTLB_TYPE_NAT, f->name);
sprintf(service, "%s-%s", NFTLB_TYPE_NAT, print_nft_service(family, f->protocol));
run_base_nat(buf, f);
if (need_filter(f)) {
run_base_filter(buf, f);
run_farm_rules_filter(buf, f, family, action);
}
run_farm_ingress_policies(buf, f, family, action);
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, action);
run_farm_rules_gen_logs(buf, f, family, chain, action);
run_farm_rules_gen_nat(buf, f, family, chain);
run_farm_snat(buf, f, family, action);
}
if (action == ACTION_START)
run_farm_rules_gen_srv(buf, f, print_nft_table_family(family, f->mode), chain, service, action, BCK_MAP_IPADDR_PORT, BCK_MAP_NAME);
return 0;
}
static int run_farm(struct sbuffer *buf, struct farm *f, int action)
{
if ((f->family == VALUE_FAMILY_IPV4) || (f->family == VALUE_FAMILY_INET)) {
run_farm_rules(buf, f, VALUE_FAMILY_IPV4, action);
}
if ((f->family == VALUE_FAMILY_IPV6) || (f->family == VALUE_FAMILY_INET)) {
run_farm_rules(buf, f, VALUE_FAMILY_IPV6, action);
}
return 0;
}
static int del_farm_rules(struct sbuffer *buf, struct farm *f, int family)
{
int ret = 0;
char chain[255] = {0};
char service[255] = {0};
char fchain[255] = {0};
char fservice[255] = {0};
if (farm_is_ingress_mode(f)) {
sprintf(chain, "%s", f->name);
sprintf(service, "%s-%s", print_nft_service(family, f->protocol), f->iface);
} else {
sprintf(chain, "%s-%s", NFTLB_TYPE_NAT, f->name);
sprintf(service, "%s-%s", NFTLB_TYPE_NAT, print_nft_service(family, f->protocol));
sprintf(fchain, "%s-%s", NFTLB_TYPE_FILTER, f->name);
sprintf(fservice, "%s-%s", NFTLB_TYPE_FILTER, print_nft_service(family, f->protocol));
}
if (need_filter(f))
run_farm_rules_filter(buf, f, family, ACTION_DELETE);
run_farm_rules_gen_srv(buf, f, print_nft_table_family(family, f->mode), chain, service, ACTION_DELETE, BCK_MAP_IPADDR_PORT, BCK_MAP_NONE);
run_farm_rules_gen_chains(buf, print_nft_table_family(family, f->mode), chain, ACTION_DELETE);
return ret;
}
static int del_farm(struct sbuffer *buf, struct farm *f)
{
int ret = 0;
if ((f->family == VALUE_FAMILY_IPV4) || (f->family == VALUE_FAMILY_INET)) {
run_farm_ingress_policies(buf, f, VALUE_FAMILY_IPV4, ACTION_STOP);
del_farm_rules(buf, f, VALUE_FAMILY_IPV4);
}
if ((f->family == VALUE_FAMILY_IPV6) || (f->family == VALUE_FAMILY_INET)) {
run_farm_ingress_policies(buf, f, VALUE_FAMILY_IPV6, ACTION_STOP);
del_farm_rules(buf, f, VALUE_FAMILY_IPV6);
}
if (f->mode == VALUE_MODE_SNAT) {
if ((f->family == VALUE_FAMILY_IPV4) || (f->family == VALUE_FAMILY_INET)) {
run_farm_snat(buf, f, VALUE_FAMILY_IPV4, ACTION_DELETE);
}
if ((f->family == VALUE_FAMILY_IPV6) || (f->family == VALUE_FAMILY_INET)) {
run_farm_snat(buf, f, VALUE_FAMILY_IPV6, ACTION_DELETE);
}
}
if (f->mode == VALUE_MODE_STLSDNAT) {
if ((f->family == VALUE_FAMILY_IPV4) || (f->family == VALUE_FAMILY_INET)) {
run_farm_stlsnat(buf, f, VALUE_FAMILY_IPV4, ACTION_DELETE);
}
if ((f->family == VALUE_FAMILY_IPV6) || (f->family == VALUE_FAMILY_INET)) {
run_farm_stlsnat(buf, f, VALUE_FAMILY_IPV6, ACTION_DELETE);
}
}
return ret;
}
static int nft_actions_done(struct farm *f)
{
struct backend *b;
list_for_each_entry(b, &f->backends, list)
b->action = ACTION_NONE;
f->action = ACTION_NONE;
f->reload_action = VALUE_RLD_NONE;
return 0;
}
int nft_reset(void)
{
struct sbuffer buf;
int ret = 0;
create_buf(&buf);
concat_buf(&buf, "flush ruleset");
exec_cmd(get_buf_data(&buf));
clean_buf(&buf);
reset_ndv_base();
n_ndv_base_rules = 0;
nat_base_rules = 0;
return ret;
}
int nft_rulerize(struct farm *f)
{
struct sbuffer buf;
int ret = 0;
create_buf(&buf);
switch (f->action) {
case ACTION_START:
case ACTION_RELOAD:
ret = run_farm(&buf, f, f->action);
break;
case ACTION_STOP:
case ACTION_DELETE:
ret = del_farm(&buf, f);
break;
case ACTION_NONE:
default:
break;
}
exec_cmd(get_buf_data(&buf));
clean_buf(&buf);
nft_actions_done(f);
return ret;
}
static int run_set_elements(struct sbuffer *buf, struct policy *p)
{
struct element *e;
char action_str[255] = "add";
list_for_each_entry(e, &p->elements, list) {
switch (p->action){
case ACTION_START:
concat_buf(buf, " ; add element %s %s %s { %s }", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, p->name, e->data);
break;
case ACTION_RELOAD:
if (e->action == ACTION_DELETE || e->action == ACTION_STOP)
sprintf(action_str, "delete");
concat_buf(buf, " ; %s element %s %s %s { %s }", action_str, NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, p->name, e->data);
sprintf(action_str, "add");
break;
default:
break;
}
e->action = ACTION_NONE;
}
return 0;
}
static int run_policy_set(struct sbuffer *buf, struct policy *p)
{
switch (p->action) {
case ACTION_START:
run_base_table(buf, NFTLB_NETDEV_FAMILY);
concat_buf(buf, " ; add set %s %s %s { type ipv4_addr ; flags interval ; }", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, p->name);
run_set_elements(buf, p);
break;
case ACTION_RELOAD:
run_set_elements(buf, p);
break;
case ACTION_STOP:
case ACTION_DELETE:
concat_buf(buf, " ; flush set %s %s %s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, p->name);
concat_buf(buf, " ; delete set %s %s %s", NFTLB_NETDEV_FAMILY, NFTLB_TABLE_NAME, p->name);
break;
case ACTION_NONE:
default:
break;
}
p->action = ACTION_NONE;
return 0;
}
int nft_rulerize_policies(struct policy *p)
{
struct sbuffer buf;
int ret = 0;
create_buf(&buf);
run_policy_set(&buf, p);
exec_cmd(get_buf_data(&buf));
clean_buf(&buf);
return ret;
}
nftlb-0.5/src/objects.c 0000664 0000000 0000000 00000017012 13475421131 0015051 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
struct obj_config current_obj;
struct list_head farms;
int total_farms = 0;
int dsr_counter = 0;
struct list_head policies;
int total_policies = 0;
void objects_init(void)
{
init_list_head(&farms);
init_list_head(&policies);
}
struct list_head * obj_get_farms(void)
{
return &farms;
}
struct list_head * obj_get_policies(void)
{
return &policies;
}
int obj_get_total_farms(void)
{
return total_farms;
}
void obj_set_total_farms(int new_value)
{
if (new_value >= 0)
total_farms = new_value;
}
int obj_get_total_policies(void)
{
return total_policies;
}
void obj_set_total_policies(int new_value)
{
if (new_value >= 0)
total_policies = new_value;
}
int obj_get_dsr_counter(void)
{
syslog(LOG_DEBUG, "%s():%d: current dsr counter is %d", __FUNCTION__, __LINE__, dsr_counter);
return dsr_counter;
}
void obj_set_dsr_counter(int new_value)
{
syslog(LOG_DEBUG, "%s():%d: new dsr counter is %d", __FUNCTION__, __LINE__, new_value);
if (new_value >= 0)
dsr_counter = new_value;
}
static void obj_config_init(void)
{
config_pair_init(current_obj.c);
current_obj.fptr = NULL;
current_obj.bptr = NULL;
current_obj.fpptr = NULL;
current_obj.pptr = NULL;
current_obj.eptr = NULL;
}
struct obj_config * obj_get_current_object(void)
{
return ¤t_obj;
}
char * obj_print_family(int family)
{
switch (family) {
case VALUE_FAMILY_IPV4:
return CONFIG_VALUE_FAMILY_IPV4;
case VALUE_FAMILY_IPV6:
return CONFIG_VALUE_FAMILY_IPV6;
case VALUE_FAMILY_INET:
return CONFIG_VALUE_FAMILY_INET;
default:
return NULL;
}
}
char * obj_print_mode(int mode)
{
switch (mode) {
case VALUE_MODE_SNAT:
return CONFIG_VALUE_MODE_SNAT;
case VALUE_MODE_DNAT:
return CONFIG_VALUE_MODE_DNAT;
case VALUE_MODE_DSR:
return CONFIG_VALUE_MODE_DSR;
case VALUE_MODE_STLSDNAT:
return CONFIG_VALUE_MODE_STLSDNAT;
default:
return NULL;
}
}
char * obj_print_proto(int protocol)
{
switch (protocol) {
case VALUE_PROTO_TCP:
return CONFIG_VALUE_PROTO_TCP;
case VALUE_PROTO_UDP:
return CONFIG_VALUE_PROTO_UDP;
case VALUE_PROTO_SCTP:
return CONFIG_VALUE_PROTO_SCTP;
case VALUE_PROTO_ALL:
return CONFIG_VALUE_PROTO_ALL;
default:
return NULL;
}
}
char * obj_print_sched(int scheduler)
{
switch (scheduler) {
case VALUE_SCHED_RR:
return CONFIG_VALUE_SCHED_RR;
case VALUE_SCHED_WEIGHT:
return CONFIG_VALUE_SCHED_WEIGHT;
case VALUE_SCHED_HASH:
return CONFIG_VALUE_SCHED_HASH;
case VALUE_SCHED_SYMHASH:
return CONFIG_VALUE_SCHED_SYMHASH;
default:
return NULL;
}
}
void obj_print_meta(int param, char* buf)
{
if (param == 0) {
sprintf(buf, "%s", CONFIG_VALUE_META_NONE);
return;
}
if (param & VALUE_META_SRCIP) {
strcat(buf, CONFIG_VALUE_META_SRCIP);
strcat(buf, " ");
}
if (param & VALUE_META_DSTIP) {
strcat(buf, CONFIG_VALUE_META_DSTIP);
strcat(buf, " ");
}
if (param & VALUE_META_SRCPORT) {
strcat(buf, CONFIG_VALUE_META_SRCPORT);
strcat(buf, " ");
}
if (param & VALUE_META_DSTPORT) {
strcat(buf, CONFIG_VALUE_META_DSTPORT);
strcat(buf, " ");
}
if (param & VALUE_META_SRCMAC) {
strcat(buf, CONFIG_VALUE_META_SRCMAC);
strcat(buf, " ");
}
if (param & VALUE_META_DSTMAC) {
strcat(buf, CONFIG_VALUE_META_DSTMAC);
strcat(buf, " ");
}
return;
}
char * obj_print_helper(int helper)
{
switch (helper) {
case VALUE_HELPER_NONE:
return CONFIG_VALUE_HELPER_NONE;
case VALUE_HELPER_AMANDA:
return CONFIG_VALUE_HELPER_AMANDA;
case VALUE_HELPER_FTP:
return CONFIG_VALUE_HELPER_FTP;
case VALUE_HELPER_H323:
return CONFIG_VALUE_HELPER_H323;
case VALUE_HELPER_IRC:
return CONFIG_VALUE_HELPER_IRC;
case VALUE_HELPER_NETBIOSNS:
return CONFIG_VALUE_HELPER_NETBIOSNS;
case VALUE_HELPER_PPTP:
return CONFIG_VALUE_HELPER_PPTP;
case VALUE_HELPER_SANE:
return CONFIG_VALUE_HELPER_SANE;
case VALUE_HELPER_SIP:
return CONFIG_VALUE_HELPER_SIP;
case VALUE_HELPER_SNMP:
return CONFIG_VALUE_HELPER_SNMP;
case VALUE_HELPER_TFTP:
return CONFIG_VALUE_HELPER_TFTP;
default:
return NULL;
}
}
void obj_print_log(int log, char* buf)
{
if (log == 0) {
sprintf(buf, "%s", CONFIG_VALUE_LOG_NONE);
return;
}
if (log & VALUE_LOG_INPUT)
sprintf(buf, "%s ", CONFIG_VALUE_LOG_INPUT);
if (log & VALUE_LOG_FORWARD) {
strcat(buf, CONFIG_VALUE_LOG_FORWARD);
strcat(buf, " ");
}
if (log & VALUE_LOG_OUTPUT)
strcat(buf, CONFIG_VALUE_LOG_OUTPUT);
return;
}
char * obj_print_state(int state)
{
switch (state) {
case VALUE_STATE_UP:
return CONFIG_VALUE_STATE_UP;
case VALUE_STATE_DOWN:
return CONFIG_VALUE_STATE_DOWN;
case VALUE_STATE_OFF:
return CONFIG_VALUE_STATE_OFF;
case VALUE_STATE_CONFERR:
return CONFIG_VALUE_STATE_CONFERR;
default:
return NULL;
}
}
char * obj_print_switch(int state)
{
switch (state) {
case VALUE_SWITCH_ON:
return CONFIG_VALUE_SWITCH_ON;
case VALUE_SWITCH_OFF:
return CONFIG_VALUE_SWITCH_OFF;
default:
return NULL;
}
}
int obj_set_attribute(struct config_pair *c, int actionable)
{
int ret;
int status;
syslog(LOG_DEBUG, "%s():%d: actionable is %d", __FUNCTION__, __LINE__, actionable);
switch (c->level) {
case LEVEL_FARMS:
if (actionable)
farm_pre_actionable(c);
ret = farm_set_attribute(c);
if (actionable && ret == PARSER_OK)
farm_pos_actionable(c);
break;
case LEVEL_BCKS:
if (actionable)
status = bck_pre_actionable(c);
ret = backend_set_attribute(c);
if (actionable && status == 0)
bck_pos_actionable(c);
break;
case LEVEL_FARMPOLICY:
if (actionable)
farmpolicy_pre_actionable(c);
ret = farmpolicy_set_attribute(c);
if (actionable)
farmpolicy_pos_actionable(c);
break;
case LEVEL_POLICIES:
if (actionable)
policy_pre_actionable(c);
ret = policy_set_attribute(c);
if (actionable)
policy_pos_actionable(c);
break;
case LEVEL_ELEMENTS:
ret = element_set_attribute(c);
if (actionable)
element_pos_actionable(c);
break;
default:
syslog(LOG_ERR, "%s():%d: unknown level %d", __FUNCTION__, __LINE__, c->level);
return PARSER_FAILED;
}
return ret;
}
int obj_set_attribute_string(char *src, char **dst)
{
*dst = (char *)malloc(strlen(src)+1);
if (!*dst) {
syslog(LOG_ERR, "Attribute memory allocation error");
return -1;
}
sprintf(*dst, "%s", src);
return 0;
}
void obj_print(void)
{
farm_s_print();
policies_s_print();
}
int obj_rulerize(void)
{
obj_config_init();
policy_s_rulerize();
return farm_s_rulerize();
}
char * obj_print_policy_type(int type)
{
switch (type) {
case VALUE_TYPE_BLACK:
return CONFIG_VALUE_POLICIES_TYPE_BL;
case VALUE_TYPE_WHITE:
return CONFIG_VALUE_POLICIES_TYPE_WL;
default:
return NULL;
}
}
nftlb-0.5/src/policies.c 0000664 0000000 0000000 00000012641 13475421131 0015232 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include "policies.h"
#include "elements.h"
#include "objects.h"
#include "config.h"
#include "nft.h"
static struct policy * policy_create(char *name)
{
struct list_head *policies = obj_get_policies();
struct policy *p = (struct policy *)malloc(sizeof(struct policy));
if (!p) {
syslog(LOG_ERR, "Policy memory allocation error");
return NULL;
}
obj_set_attribute_string(name, &p->name);
p->type = DEFAULT_POLICY_TYPE;
p->timeout = DEFAULT_POLICY_TIMEOUT;
p->priority = DEFAULT_POLICY_PRIORITY;
p->used = 0;
p->action = DEFAULT_ACTION;
init_list_head(&p->elements);
p->total_elem = 0;
list_add_tail(&p->list, policies);
obj_set_total_policies(obj_get_total_policies() + 1);
return p;
}
static int policy_delete(struct policy *p)
{
list_del(&p->list);
if (p->name && strcmp(p->name, "") != 0)
free(p->name);
free(p);
obj_set_total_policies(obj_get_total_policies() - 1);
return 0;
}
static void policy_print(struct policy *p)
{
syslog(LOG_DEBUG," [policy] ");
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_NAME, p->name);
syslog(LOG_DEBUG," [%s] %s", CONFIG_KEY_TYPE, obj_print_policy_type(p->type));
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_TIMEOUT, p->timeout);
syslog(LOG_DEBUG," [%s] %d", CONFIG_KEY_PRIORITY, p->priority);
syslog(LOG_DEBUG," *[used] %d", p->used);
syslog(LOG_DEBUG," *[total_elem] %d", p->total_elem);
syslog(LOG_DEBUG," *[%s] %d", CONFIG_KEY_ACTION, p->action);
if (p->total_elem != 0)
element_s_print(p);
}
void policies_s_print(void)
{
struct list_head *policies = obj_get_policies();
struct policy *p;
list_for_each_entry(p, policies, list) {
policy_print(p);
}
}
struct policy * policy_lookup_by_name(const char *name)
{
struct list_head *policies = obj_get_policies();
struct policy *p;
list_for_each_entry(p, policies, list) {
if (strcmp(p->name, name) == 0)
return p;
}
return NULL;
}
int policy_set_attribute(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct policy *p;
if (c->key != KEY_NAME && !cur->pptr)
return PARSER_OBJ_UNKNOWN;
p = cur->pptr;
switch (c->key) {
case KEY_NAME:
p = policy_lookup_by_name(c->str_value);
if (!p) {
p = policy_create(c->str_value);
if (!p)
return -1;
}
cur->pptr = p;
break;
case KEY_TYPE:
p->type = c->int_value;
break;
case KEY_TIMEOUT:
p->timeout = c->int_value;
break;
case KEY_PRIORITY:
p->priority = c->int_value;
break;
case KEY_ACTION:
policy_set_action(p, c->int_value);
break;
default:
return PARSER_STRUCT_FAILED;
}
return PARSER_OK;
}
int policy_set_action(struct policy *p, int action)
{
syslog(LOG_DEBUG, "%s():%d: policy %s set action %d", __FUNCTION__, __LINE__, p->name, action);
if (action == ACTION_DELETE) {
farm_s_lookup_policy_action(p->name, action);
policy_delete(p);
return 1;
}
if (p->action != action) {
p->action = action;
return 1;
}
return 0;
}
int policy_s_set_action(int action)
{
struct list_head *policies = obj_get_policies();
struct policy *p, *next;
list_for_each_entry_safe(p, next, policies, list)
policy_set_action(p, action);
return 0;
}
int policy_pre_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct policy *p;
if (!cur->pptr)
return -1;
p = cur->pptr;
syslog(LOG_DEBUG, "%s():%d: pos actionable policy %s with param %d action is %d", __FUNCTION__, __LINE__, p->name, c->key, p->action);
switch (c->key) {
case KEY_NAME:
case KEY_TYPE:
case KEY_TIMEOUT:
policy_set_action(p, ACTION_STOP);
break;
default:
policy_set_action(p, ACTION_RELOAD);
return 0;
}
return 0;
}
int policy_pos_actionable(struct config_pair *c)
{
struct obj_config *cur = obj_get_current_object();
struct policy *p;
if (!cur->pptr)
return -1;
p = cur->pptr;
syslog(LOG_DEBUG, "%s():%d: pos actionable policy %s with param %d action is %d", __FUNCTION__, __LINE__, p->name, c->key, p->action);
switch (c->key) {
case KEY_NAME:
case KEY_TYPE:
case KEY_TIMEOUT:
policy_set_action(p, ACTION_START);
break;
default:
policy_set_action(p, ACTION_RELOAD);
return 0;
}
return 0;
}
int policy_rulerize(struct policy *p)
{
syslog(LOG_DEBUG, "%s():%d: rulerize policy %s", __FUNCTION__, __LINE__, p->name);
policy_print(p);
return nft_rulerize_policies(p);
}
int policy_s_rulerize(void)
{
struct policy *p;
int ret = 0;
syslog(LOG_DEBUG, "%s():%d: rulerize all policies", __FUNCTION__, __LINE__);
struct list_head *policies = obj_get_policies();
list_for_each_entry(p, policies, list) {
ret = ret || policy_rulerize(p);
}
return ret;
}
nftlb-0.5/src/sbuffer.c 0000664 0000000 0000000 00000004612 13475421131 0015056 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include
#include "sbuffer.h"
int get_buf_size(struct sbuffer *buf)
{
return buf->size;
}
char * get_buf_next(struct sbuffer *buf)
{
return buf->data + buf->next;
}
int resize_buf(struct sbuffer *buf, int times)
{
char *pbuf;
int newsize;
if (times == 0)
return 0;
newsize = buf->size + (times * EXTRA_SIZE) + 1;
if (!buf->data)
return 1;
pbuf = (char *) realloc(buf->data, newsize);
if (!pbuf)
return 1;
buf->data = pbuf;
buf->size = newsize;
return 0;
}
int create_buf(struct sbuffer *buf)
{
buf->size = 0;
buf->next = 0;
buf->data = (char *) calloc(1, DEFAULT_BUFFER_SIZE);
if (!buf->data) {
return 1;
}
*buf->data = '\0';
buf->size = DEFAULT_BUFFER_SIZE;
return 0;
}
int isempty_buf(struct sbuffer *buf)
{
return (buf->data[0] == 0);
}
char *get_buf_data(struct sbuffer *buf)
{
return buf->data;
}
int clean_buf(struct sbuffer *buf)
{
if (buf->data)
free(buf->data);
buf->size = 0;
buf->next = 0;
return 0;
}
int concat_buf(struct sbuffer *buf, char *fmt, ...)
{
int times = 0;
int len;
va_list args;
char *pnext;
va_start(args, fmt);
len = vsnprintf(0, 0, fmt, args);
va_end(args);
if (buf->next + len >= buf->size)
times = ((buf->next + len - buf->size) / EXTRA_SIZE) + 1;
if (resize_buf(buf, times)) {
syslog(LOG_ERR, "Error resizing the buffer %d times from a size of %d!", times, buf->size);
return 1;
}
pnext = get_buf_next(buf);
va_start(args, fmt);
vsnprintf(pnext, len + 1, fmt, args);
va_end(args);
buf->next += len;
return 0;
}
nftlb-0.5/src/server.c 0000664 0000000 0000000 00000037055 13475421131 0014737 0 ustar 00root root 0000000 0000000 /*
* This file is part of nftlb, nftables load balancer.
*
* Copyright (C) ZEVENET SL.
* Author: Laura Garcia
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see
#include
#include
#include
#include
#include
#include
#include
#include "server.h"
#include "config.h"
#include "nft.h"
#include "events.h"
#include "sbuffer.h"
#define SRV_MAX_BUF 40960
#define SRV_MAX_HEADER 300
#define SRV_MAX_IDENT 200
#define SRV_KEY_LENGTH 16
#define SRV_PORT_DEF 5555
#define STR_GET_ACTION "GET"
#define STR_POST_ACTION "POST"
#define STR_PUT_ACTION "PUT"
#define STR_DELETE_ACTION "DELETE"
#define HTTP_PROTO "HTTP/1.1 "
#define HTTP_LINE_END "\r\n"
#define HTTP_HEADER_CONTENTLEN "Content-Length: "
#define HTTP_HEADER_KEY "Key: "
extern struct ev_io *srv_accept;
enum ws_methods {
WS_GET_ACTION,
WS_POST_ACTION,
WS_PUT_ACTION,
WS_DELETE_ACTION,
};
enum ws_responses {
WS_HTTP_500,
WS_HTTP_400,
WS_HTTP_401,
WS_HTTP_404,
WS_HTTP_200,
};
struct nftlb_http_state {
enum ws_methods method;
char uri[SRV_MAX_IDENT];
char *body;
enum ws_responses status_code;
char *body_response;
};
static const char *ws_str_responses[] = {
HTTP_PROTO "500 Internal Server Error" HTTP_LINE_END,
HTTP_PROTO "400 Bad Request" HTTP_LINE_END,
HTTP_PROTO "401 Unauthorized" HTTP_LINE_END,
HTTP_PROTO "404 Not Found" HTTP_LINE_END,
HTTP_PROTO "200 OK" HTTP_LINE_END,
};
struct nftlb_server {
int clients;
char *key;
int family;
char *host;
int port;
int sd;
};
static struct nftlb_server nftserver = {
.family = AF_INET,
.host = NULL,
.port = SRV_PORT_DEF,
};
static int auth_key(const char *recvkey)
{
return (strcmp(nftserver.key, recvkey) == 0);
}
static int get_request(int fd, struct sbuffer *buf, struct nftlb_http_state *state)
{
char method[SRV_MAX_IDENT] = {0};
char strkey[SRV_MAX_IDENT] = {0};
int contlength = 0;
int times = 0;
int total_read_size = 0;
char *ptr;
int size;
int head;
int bytes_left;
int cont_100 = 0;
if ((ptr = strstr(get_buf_data(buf), "Key: ")) == NULL) {
state->status_code = WS_HTTP_401;
return -1;
}
sscanf(ptr, "Key: %199[^\r\n]", strkey);
if (!auth_key(strkey)) {
state->status_code = WS_HTTP_401;
return -1;
}
sscanf(get_buf_data(buf), "%199[^ ] %199[^ ] ", method, state->uri);
if (strncmp(method, STR_GET_ACTION, 3) == 0) {
state->method = WS_GET_ACTION;
} else if (strncmp(method, STR_POST_ACTION, 4) == 0) {
state->method = WS_POST_ACTION;
} else if (strncmp(method, STR_PUT_ACTION, 5) == 0) {
state->method = WS_PUT_ACTION;
} else if (strncmp(method, STR_DELETE_ACTION, 6) == 0) {
state->method = WS_DELETE_ACTION;
} else {
state->status_code = WS_HTTP_500;
return -1;
}
if (state->method != WS_POST_ACTION &&
state->method != WS_PUT_ACTION)
return 0;
state->body = strstr(get_buf_data(buf), "\r\n\r\n");
if (!state->body) {
syslog(LOG_ERR, "Not found body section in the request");
state->status_code = WS_HTTP_400;
return -1;
}
state->body += 4;
head = state->body - get_buf_data(buf);
if ((ptr = strstr(get_buf_data(buf), "Expect: 100-continue")) != NULL) {
cont_100 = 1;
send(fd, "HTTP/1.1 100 Continue\r\n\r\n", 25, 0);
}
if ((ptr = strstr(get_buf_data(buf), "Content-Length: ")) != NULL) {
sscanf(ptr, "Content-Length: %i[^\r\n]", &contlength);
if (head + contlength >= get_buf_size(buf))
times = ((head + contlength - get_buf_size(buf)) / EXTRA_SIZE) + 1;
if (times == 0)
goto receive;
if (resize_buf(buf, times)) {
syslog(LOG_ERR, "Error resizing the buffer %d times from a size of %d!", times, get_buf_size(buf));
state->status_code = WS_HTTP_500;
return -1;
}
}
receive:
state->body = get_buf_data(buf) + head;
total_read_size = get_buf_next(buf) - state->body;
while ((total_read_size < contlength) || cont_100) {
cont_100 = 0;
bytes_left = EXTRA_SIZE;
if (contlength - total_read_size < EXTRA_SIZE)
bytes_left = contlength - total_read_size;
if (bytes_left <= 0)
goto final;
size = recv(fd, get_buf_next(buf), bytes_left, 0);
if (size <= 0)
goto final;
buf->next += size;
total_read_size += size;
}
final:
concat_buf(buf, "\0");
return 0;
}
static int send_get_response(struct nftlb_http_state *state)
{
char firstlevel[SRV_MAX_IDENT] = {0};
char secondlevel[SRV_MAX_IDENT] = {0};
char thirdlevel[SRV_MAX_IDENT] = {0};
char fourthlevel[SRV_MAX_IDENT] = {0};
sscanf(state->uri, "/%199[^/]/%199[^/]/%199[^/]/%199[^\n]",
firstlevel, secondlevel, thirdlevel, fourthlevel);
if (strcmp(firstlevel, CONFIG_KEY_FARMS) == 0) {
if (config_print_farms(&state->body_response, secondlevel) == 0) {
state->status_code = WS_HTTP_200;
return 0;
}
} else if (strcmp(firstlevel, CONFIG_KEY_POLICIES) == 0) {
if (config_print_policies(&state->body_response, secondlevel) == 0) {
state->status_code = WS_HTTP_200;
return 0;
}
}
state->status_code = WS_HTTP_500;
return -1;
}
static int send_delete_response(struct nftlb_http_state *state)
{
char firstlevel[SRV_MAX_IDENT] = {0};
char secondlevel[SRV_MAX_IDENT] = {0};
char thirdlevel[SRV_MAX_IDENT] = {0};
char fourthlevel[SRV_MAX_IDENT] = {0};
int ret;
sscanf(state->uri, "/%199[^/]/%199[^/]/%199[^/]/%199[^\n]",
firstlevel, secondlevel, thirdlevel, fourthlevel);
if (strcmp(firstlevel, CONFIG_KEY_FARMS) != 0 &&
strcmp(firstlevel, CONFIG_KEY_POLICIES) != 0) {
state->status_code = WS_HTTP_500;
return -1;
}
state->body_response = malloc(SRV_MAX_BUF);
if (!state->body_response) {
state->status_code = WS_HTTP_500;
return -1;
}
if (strcmp(firstlevel, CONFIG_KEY_FARMS) == 0 &&
strcmp(thirdlevel, CONFIG_KEY_BCKS) == 0) {
ret = config_set_backend_action(secondlevel, fourthlevel, CONFIG_VALUE_ACTION_STOP);
if (ret > 0)
ret = config_set_farm_action(secondlevel, CONFIG_VALUE_ACTION_RELOAD);
if (ret > 0)
obj_rulerize();
ret = config_set_backend_action(secondlevel, fourthlevel, CONFIG_VALUE_ACTION_DELETE);
if (ret < 0) {
config_print_response(&state->body_response,
"error deleting backend");
goto delete_end;
}
} else if (strcmp(firstlevel, CONFIG_KEY_FARMS) == 0 &&
strcmp(thirdlevel, CONFIG_KEY_POLICIES) == 0) {
ret = config_set_farm_action(secondlevel, CONFIG_VALUE_ACTION_RELOAD);
if (ret < 0) {
config_print_response(&state->body_response,
"error reloading farm");
goto delete_end;
}
ret = config_set_fpolicy_action(secondlevel, fourthlevel, CONFIG_VALUE_ACTION_DELETE);
if (ret != 0) {
config_print_response(&state->body_response,
"error stopping farm policy");
goto delete_end;
}
obj_rulerize();
} else if (strcmp(firstlevel, CONFIG_KEY_POLICIES) == 0 &&
strcmp(thirdlevel, CONFIG_KEY_ELEMENTS) == 0) {
ret = config_set_element_action(secondlevel, fourthlevel, CONFIG_VALUE_ACTION_STOP);
if (ret > 0)
ret = config_set_policy_action(secondlevel, CONFIG_VALUE_ACTION_RELOAD);
if (ret > 0)
obj_rulerize();
ret = config_set_element_action(secondlevel, fourthlevel, CONFIG_VALUE_ACTION_DELETE);
if (ret < 0) {
config_print_response(&state->body_response,
"error deleting policy element");
goto delete_end;
}
} else if (strcmp(firstlevel, CONFIG_KEY_FARMS) == 0 &&
strcmp(thirdlevel, "") == 0) {
ret = config_set_farm_action(secondlevel, CONFIG_VALUE_ACTION_STOP);
if (ret > 0)
obj_rulerize();
ret = config_set_farm_action(secondlevel, CONFIG_VALUE_ACTION_DELETE);
if (ret < 0) {
config_print_response(&state->body_response,
"error deleting farm");
goto delete_end;
}
} else if (strcmp(firstlevel, CONFIG_KEY_POLICIES) == 0 &&
strcmp(thirdlevel, "") == 0) {
ret = config_set_policy_action(secondlevel, CONFIG_VALUE_ACTION_STOP);
if (ret < 0) {
config_print_response(&state->body_response,
"error stopping policy");
goto delete_end;
}
obj_rulerize();
ret = config_set_policy_action(secondlevel, CONFIG_VALUE_ACTION_DELETE);
if (ret < 0) {
config_print_response(&state->body_response,
"error deleting policy");
goto delete_end;
}
} else {
state->status_code = WS_HTTP_500;
return -1;
}
config_print_response(&state->body_response, "success");
delete_end:
state->status_code = WS_HTTP_200;
return 0;
}
static int send_post_response(struct nftlb_http_state *state)
{
char firstlevel[SRV_MAX_IDENT] = {0};
sscanf(state->uri, "/%199[^\n]", firstlevel);
if ((strcmp(firstlevel, CONFIG_KEY_FARMS) != 0) &&
(strcmp(firstlevel, CONFIG_KEY_POLICIES) != 0)) {
state->status_code = WS_HTTP_404;
return -1;
}
state->body_response = malloc(SRV_MAX_BUF);
if (!state->body_response) {
state->status_code = WS_HTTP_500;
return -1;
}
switch (config_buffer(state->body)) {
case PARSER_OK:
break;
case PARSER_STRUCT_FAILED:
config_print_response(&state->body_response,
"the structure is invalid");
goto post_end;
break;
case PARSER_OBJ_UNKNOWN:
config_print_response(&state->body_response,
"the object to modify is unknown");
goto post_end;
break;
default:
config_print_response(&state->body_response,
"error parsing buffer");
goto post_end;
break;
}
if (obj_rulerize() != 0) {
config_print_response(&state->body_response,
"error generating rules");
goto post_end;
}
config_print_response(&state->body_response, "success");
post_end:
state->status_code = WS_HTTP_200;
return 0;
}
static int send_response(struct nftlb_http_state *state)
{
switch (state->method) {
case WS_GET_ACTION:
return send_get_response(state);
case WS_POST_ACTION:
case WS_PUT_ACTION:
return send_post_response(state);
case WS_DELETE_ACTION:
return send_delete_response(state);
default:
return -1;
}
}
/* If client doesn't send us anything in 30 seconds, close connection. */
#define NFTLB_CLIENT_TIMEOUT 30
struct nftlb_client {
struct ev_io io;
struct ev_timer timer;
struct sockaddr_in addr;
};
static void nftlb_client_release(struct ev_loop *loop, struct nftlb_client *cli)
{
ev_io_stop(loop, &cli->io);
close(cli->io.fd);
free(cli);
}
static void nftlb_http_send_response(struct ev_io *io,
struct nftlb_http_state *state, int size)
{
char response[SRV_MAX_HEADER];
sprintf(response, "%s%s%d%s%s", ws_str_responses[state->status_code],
HTTP_HEADER_CONTENTLEN, size,
HTTP_LINE_END, HTTP_LINE_END);
send(io->fd, response, strlen(response), 0);
}
static void nftlb_read_cb(struct ev_loop *loop, struct ev_io *io, int revents)
{
struct sbuffer buf;
struct nftlb_http_state state;
struct nftlb_client *cli;
ssize_t size;
if (EV_ERROR & revents) {
syslog(LOG_ERR, "Server got invalid event from client read");
return;
}
cli = container_of(io, struct nftlb_client, io);
state.body_response = NULL;
create_buf(&buf);
size = recv(io->fd, get_buf_data(&buf), DEFAULT_BUFFER_SIZE - 1, 0);
if (size < 0)
return;
buf.next = size;
if (size == 0) {
syslog(LOG_DEBUG, "connection closed by client %s:%hu\n",
inet_ntoa(cli->addr.sin_addr), ntohs(cli->addr.sin_port));
goto end;
}
if (get_request(io->fd, &buf, &state) < 0) {
nftlb_http_send_response(io, &state, 0);
goto end;
}
if (send_response(&state) < 0) {
nftlb_http_send_response(io, &state, 0);
goto end;
}
nftlb_http_send_response(io, &state, strlen(state.body_response));
send(io->fd, state.body_response, strlen(state.body_response), 0);
syslog(LOG_DEBUG, "connection closed by server %s:%hu\n",
inet_ntoa(cli->addr.sin_addr), ntohs(cli->addr.sin_port));
end:
if (state.body_response)
free(state.body_response);
clean_buf(&buf);
ev_timer_stop(loop, &cli->timer);
nftlb_client_release(loop, cli);
syslog(LOG_DEBUG, "%d client(s) connected", --nftserver.clients);
return;
}
static void nftlb_timer_cb(struct ev_loop *loop, ev_timer *timer, int events)
{
struct nftlb_client *cli;
cli = container_of(timer, struct nftlb_client, timer);
syslog(LOG_ERR, "timeout for client %s:%hu\n",
inet_ntoa(cli->addr.sin_addr), ntohs(cli->addr.sin_port));
nftlb_client_release(loop, cli);
}
static void accept_cb(struct ev_loop *loop, struct ev_io *io, int revents)
{
struct sockaddr_in client_addr;
socklen_t addrlen = sizeof(client_addr);
struct nftlb_client *cli;
int client_sd;
if (EV_ERROR & revents) {
syslog(LOG_ERR, "Server got an invalid event from client");
return;
}
client_sd = accept(io->fd, (struct sockaddr *)&client_addr, &addrlen);
if (client_sd < 0) {
syslog(LOG_ERR, "Server accept error");
return;
}
cli = malloc(sizeof(struct nftlb_client));
if (!cli) {
syslog(LOG_ERR, "No memory available to allocate new client");
return;
}
memcpy(&cli->addr, &client_addr, sizeof(cli->addr));
ev_io_init(&cli->io, nftlb_read_cb, client_sd, EV_READ);
ev_io_start(loop, &cli->io);
ev_timer_init(&cli->timer, nftlb_timer_cb, NFTLB_CLIENT_TIMEOUT, 0.);
ev_timer_start(loop, &cli->timer);
syslog(LOG_DEBUG, "connection from %s:%hu",
inet_ntoa(cli->addr.sin_addr), ntohs(cli->addr.sin_port));
syslog(LOG_DEBUG, "%d client(s) connected", ++nftserver.clients);
}
int server_init(void)
{
struct sockaddr_in addr = {};
socklen_t addrlen = sizeof(addr);
struct ev_loop *st_ev_loop = get_loop();
struct ev_io *st_ev_accept = events_create_srv();
int server_sd;
int yes = 1;
if (!nftserver.key)
server_set_key(NULL);
printf("Key: %s\n", nftserver.key);
server_sd = socket(nftserver.family, SOCK_STREAM, 0);
if (server_sd < 0) {
fprintf(stderr, "Server socket error\n");
syslog(LOG_ERR, "Server socket error");
return -1;
}
setsockopt(server_sd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int));
addr.sin_family = nftserver.family;
addr.sin_port = htons(nftserver.port);
if (nftserver.host == NULL)
addr.sin_addr.s_addr = INADDR_ANY;
else
inet_aton(nftserver.host, &addr.sin_addr);
if (bind(server_sd, (struct sockaddr *) &addr, addrlen) != 0) {
fprintf(stderr, "Server bind error\n");
syslog(LOG_ERR, "Server bind error");
return -1;
}
if (listen(server_sd, 2) < 0) {
fprintf(stderr, "Server listen error\n");
syslog(LOG_ERR, "Server listen error");
return -1;
}
nftserver.sd = server_sd;
ev_io_init(st_ev_accept, accept_cb, server_sd, EV_READ);
ev_io_start(st_ev_loop, st_ev_accept);
return 0;
}
void server_fini(void)
{
close(nftserver.sd);
}
void server_set_host(char *host)
{
nftserver.host = malloc(strlen(host)+1);
if (!nftserver.host) {
syslog(LOG_ERR, "No memory available to allocate the server host");
return;
}
sprintf(nftserver.host, "%s", host);
}
void server_set_port(int port)
{
nftserver.port = port;
}
void server_set_key(char *key)
{
int i;
if (!nftserver.key) {
nftserver.key = (char *)malloc(SRV_MAX_IDENT);
if (!nftserver.key) {
syslog(LOG_ERR, "No memory available to allocate the server key");
return;
}
}
if (!key) {
srand((unsigned int) time(0) + getpid());
for (i = 0; i < SRV_KEY_LENGTH; ++i)
nftserver.key[i] = rand() % 94 + 33;
nftserver.key[i] = '\0';
} else
snprintf(nftserver.key, SRV_MAX_IDENT, "%s", key);
}
void server_set_ipv6(void)
{
nftserver.family = AF_INET6;
}
nftlb-0.5/tests/ 0000775 0000000 0000000 00000000000 13475421131 0013626 5 ustar 00root root 0000000 0000000 nftlb-0.5/tests/001_snat_ipv4_tcp_weight.json 0000664 0000000 0000000 00000000775 13475421131 0021236 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/002_snat_ipv4_tcp_weight_serial.json 0000664 0000000 0000000 00000000627 13475421131 0022572 0 ustar 00root root 0000000 0000000 { "farms" : [ { "name" : "lb01", "family" : "ipv4", "virtual-addr" : "192.168.0.100", "virtual-ports" : "80", "mode" : "snat", "protocol" : "tcp", "scheduler" : "weight", "state" : "up", "backends" : [ { "name" : "bck0", "ip-addr" : "192.168.0.10", "weight" : "5", "priority" : "1", "state" : "up" }, { "name" : "bck1", "ip-addr" : "192.168.0.12", "weight" : "5", "priority" : "1", "state" : "up" } ] } ] }
nftlb-0.5/tests/003_snat_ipv4_tcp_weight_multi.json 0000664 0000000 0000000 00000001743 13475421131 0022446 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
},
{
"name" : "lb02",
"family" : "ipv4",
"virtual-addr" : "192.168.0.101",
"virtual-ports" : "82",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "rr",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.12",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.13",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/004_dsr_ipv4_tcp_hash.json 0000664 0000000 0000000 00000001231 13475421131 0020504 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80",
"mode" : "dsr",
"protocol" : "tcp",
"scheduler" : "hash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/005_dsr_ipv6_udp_rr.json 0000664 0000000 0000000 00000001303 13475421131 0020211 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv6",
"virtual-addr" : "2001:db8:0:1:1:1:1:1",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80",
"mode" : "dsr",
"protocol" : "udp",
"scheduler" : "rr",
"priority" : "1",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "2001:db8:0:1:1:1:1:2",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "2001:db8:0:1:1:1:1:3",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/006_dsr_ipv46_tcp_udp_hash_weight_multi.json 0000664 0000000 0000000 00000002555 13475421131 0024237 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.1.22",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80",
"mode" : "dsr",
"protocol" : "tcp",
"scheduler" : "hash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "2001:db8:0:1:1:1:1:2",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "2001:db8:0:1:1:1:1:3",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
},
{
"name" : "lb02",
"family" : "ipv6",
"iface" : "lo",
"oface" : "lo",
"virtual-addr" : "2001:db8:0:1:1:1:1:1",
"ether-addr" : "01:01:01:01:01:04",
"virtual-ports" : "80",
"mode" : "dsr",
"protocol" : "udp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "2001:db8:0:1:1:1:1:2",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "2001:db8:0:1:1:1:1:3",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/007_snat_ipv4_tcp_weight_prio.json 0000664 0000000 0000000 00000002221 13475421131 0022261 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck2",
"ip-addr" : "192.168.0.12",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck3",
"ip-addr" : "192.168.0.13",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck4",
"ip-addr" : "192.168.0.14",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck5",
"ip-addr" : "192.168.0.15",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck6",
"ip-addr" : "192.168.0.16",
"weight" : "5",
"priority" : "2",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/008_snat_ipv4_all_rr.json 0000664 0000000 0000000 00000002207 13475421131 0020353 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"mode" : "snat",
"protocol" : "all",
"scheduler" : "rr",
"priority" : "1",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck2",
"ip-addr" : "192.168.0.12",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck3",
"ip-addr" : "192.168.0.13",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck4",
"ip-addr" : "192.168.0.14",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck5",
"ip-addr" : "192.168.0.15",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck6",
"ip-addr" : "192.168.0.16",
"weight" : "5",
"priority" : "2",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/009_snat_ipv4_multiport_symhash.json 0000664 0000000 0000000 00000002225 13475421131 0022674 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80,81",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "symhash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck2",
"ip-addr" : "192.168.0.12",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck3",
"ip-addr" : "192.168.0.13",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck4",
"ip-addr" : "192.168.0.14",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck5",
"ip-addr" : "192.168.0.15",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck6",
"ip-addr" : "192.168.0.16",
"weight" : "5",
"priority" : "2",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/010_dsr_ipv4_multiport_tcp_symhash.json 0000664 0000000 0000000 00000001237 13475421131 0023357 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80-88",
"mode" : "dsr",
"protocol" : "tcp",
"scheduler" : "symhash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/011_dnat_ipv4_multiportlist_symhash.json 0000664 0000000 0000000 00000002236 13475421131 0023544 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80-88,90-95,96",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "symhash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck2",
"ip-addr" : "192.168.0.12",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck3",
"ip-addr" : "192.168.0.13",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck4",
"ip-addr" : "192.168.0.14",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck5",
"ip-addr" : "192.168.0.15",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck6",
"ip-addr" : "192.168.0.16",
"weight" : "5",
"priority" : "2",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/012_dnat_ipv4_tcp_hash.json 0000664 0000000 0000000 00000000773 13475421131 0020653 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "hash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/013_dnat_ipv4_tcp_weighted_rr.json 0000664 0000000 0000000 00000001612 13475421131 0022225 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.56.101",
"virtual-ports" : "80",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "2",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "1",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck2",
"ip-addr" : "192.168.0.12",
"weight" : "1",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck3",
"ip-addr" : "192.168.0.13",
"weight" : "2",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck4",
"ip-addr" : "192.168.0.14",
"weight" : "1",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/014_stlsdnat_ipv4_multiportlist_symhash.json 0000664 0000000 0000000 00000003016 13475421131 0024452 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.154",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80-88,90-95,96",
"mode" : "stlsdnat",
"protocol" : "tcp",
"scheduler" : "symhash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck2",
"ip-addr" : "192.168.0.12",
"ether-addr" : "04:04:04:04:04:04",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck3",
"ip-addr" : "192.168.0.13",
"ether-addr" : "05:05:05:05:05:05",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck4",
"ip-addr" : "192.168.0.14",
"ether-addr" : "06:06:06:06:06:06",
"weight" : "5",
"priority" : "2",
"state" : "up"
},
{
"name" : "bck5",
"ip-addr" : "192.168.0.15",
"ether-addr" : "07:07:07:07:07:07",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck6",
"ip-addr" : "192.168.0.16",
"ether-addr" : "08:08:08:08:08:08",
"weight" : "5",
"priority" : "2",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/015_stlsdnat_ipv4_tcp_hash.json 0000664 0000000 0000000 00000001236 13475421131 0021557 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80",
"mode" : "stlsdnat",
"protocol" : "tcp",
"scheduler" : "hash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/016_stlsdnat_ipv4_tcp_weighted_rr.json 0000664 0000000 0000000 00000002250 13475421131 0023135 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.56.101",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80",
"mode" : "stlsdnat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "2",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "1",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck2",
"ip-addr" : "192.168.0.12",
"ether-addr" : "04:04:04:04:04:04",
"weight" : "1",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck3",
"ip-addr" : "192.168.0.13",
"ether-addr" : "05:05:05:05:05:05",
"weight" : "2",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck4",
"ip-addr" : "192.168.0.14",
"ether-addr" : "06:06:06:06:06:06",
"weight" : "1",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/017_snat_ipv4_tcp_ftp_weight.json 0000664 0000000 0000000 00000001022 13475421131 0022100 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"helper" : "ftp",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/018_dnat_ipv4_udp_sip_rr_multiport.json 0000664 0000000 0000000 00000001053 13475421131 0023345 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.56.154",
"virtual-ports" : "5060-5066",
"mode" : "dnat",
"protocol" : "udp",
"scheduler" : "rr",
"helper" : "sip",
"priority" : "1",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.22",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.23",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/019_dnat_ipv6_udp_tftp_rr.json 0000664 0000000 0000000 00000001332 13475421131 0021413 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv6",
"iface" : "lo",
"oface" : "lo",
"virtual-addr" : "2001:db8:0:1:1:1:1:1",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "69",
"mode" : "dnat",
"protocol" : "udp",
"helper" : "tftp",
"scheduler" : "rr",
"priority" : "1",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "2001:db8:0:1:1:1:1:2",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "2001:db8:0:1:1:1:1:3",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/020_snat_ipv4_tcp_rr_log.json 0000664 0000000 0000000 00000001034 13475421131 0021221 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.1.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "rr",
"log" : "input forward output",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/021_dsr_ipv4_tcp_hash_log.json 0000664 0000000 0000000 00000001255 13475421131 0021352 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"ether-addr" : "01:01:01:01:01:01",
"virtual-ports" : "80",
"mode" : "dsr",
"protocol" : "tcp",
"log" : "input",
"scheduler" : "hash",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"ether-addr" : "02:02:02:02:02:02",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"ether-addr" : "03:03:03:03:03:03",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"iface" : "lo",
"oface" : "lo"
}
]
}
nftlb-0.5/tests/022_dnat_ipv4_tcp_weight_farm_mark.json 0000664 0000000 0000000 00000001023 13475421131 0023224 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "weight",
"mark" : "0xdead",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/023_snat_ipv4_tcp_weight_farm_mark.json 0000664 0000000 0000000 00000001023 13475421131 0023244 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"mark" : "0xdead",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/024_snat_ipv4_tcp_weight_bck_mark.json 0000664 0000000 0000000 00000001101 13475421131 0023054 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"mark" : "0xdead00",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "1",
"priority" : "1",
"mark" : "0x01",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "1",
"priority" : "1",
"mark" : "0x02",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/025_dnat_ipv4_tcp_weight_bck_mark.json 0000664 0000000 0000000 00000001101 13475421131 0023036 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "weight",
"mark" : "0xdead00",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "1",
"priority" : "1",
"mark" : "0x01",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "1",
"priority" : "1",
"mark" : "0x02",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/026_snat_ipv4_tcp_weight_nomasq.json 0000664 0000000 0000000 00000001041 13475421131 0022606 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"source-addr" : "192.168.0.101",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/027_snat_ipv4_udp_weight_nomasq_multiport.json 0000664 0000000 0000000 00000001044 13475421131 0024733 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80-82",
"source-addr" : "192.168.0.101",
"mode" : "snat",
"protocol" : "udp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/028_snat_ipv4_all_weight_nomasq.json 0000664 0000000 0000000 00000001006 13475421131 0022573 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"source-addr" : "192.168.0.101",
"mode" : "snat",
"protocol" : "all",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/029_dnat_ipv4_tcp_udp_multifarm_hash_params.json 0000664 0000000 0000000 00000002052 13475421131 0025146 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "hash",
"sched-param" : "dstip",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
},
{
"name" : "lb02",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "53",
"mode" : "dnat",
"protocol" : "udp",
"scheduler" : "hash",
"sched-param" : "srcip srcport srcmac",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/030_snat_ipv4_tcp_weight_bck_mark_srcip_empty.json 0000664 0000000 0000000 00000001130 13475421131 0025471 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"source-addr" : "",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"mark" : "0xdead00",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "1",
"priority" : "1",
"mark" : "0x01",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "1",
"priority" : "1",
"mark" : "0x02",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/031_snat_ipv4_tcp_weight_newrtlimit.json 0000664 0000000 0000000 00000001026 13475421131 0023505 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"new-rtlimit" : "10",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/032_snat_ipv4_tcp_weight_newrtlimit_burst.json 0000664 0000000 0000000 00000001064 13475421131 0024727 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"new-rtlimit" : "10",
"new-rtlimit-burst" : "3",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/033_snat_ipv4_tcp_weight_rstrtlimit.json 0000664 0000000 0000000 00000001025 13475421131 0023525 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"rst-rtlimit" : "5",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/034_snat_ipv4_tcp_weight_estconnlimit.json 0000664 0000000 0000000 00000001030 13475421131 0024015 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"est-connlimit" : "20",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/035_snat_ipv4_tcp_weight_tcpstrict.json 0000664 0000000 0000000 00000001025 13475421131 0023331 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"tcp-strict" : "on",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/036_snat_ipv4_tcp_weight_queue.json 0000664 0000000 0000000 00000001017 13475421131 0022440 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"queue" : "0",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/037_policies.json 0000664 0000000 0000000 00000001436 13475421131 0016725 0 ustar 00root root 0000000 0000000 {
"policies" : [
{
"name" : "black001",
"type" : "blacklist",
"timeout" : "5",
"priority" : "2",
"elements" : [
{
"data" : "192.168.200.100"
},
{
"data" : "192.168.40.100/24"
}
]
}
],
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "127.0.0.1",
"virtual-ports" : "80",
"mode" : "dnat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"weight" : "5",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"weight" : "5",
"priority" : "1",
"state" : "up"
}
],
"policies" : [
{
"name" : "black001"
}
]
}
]
}
nftlb-0.5/tests/038_snat_ipv4_tcp_weight_persistence_srcip_srcport.json 0000664 0000000 0000000 00000001230 13475421131 0026613 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"persistence" : "srcip srcport",
"persist-ttl" : "50",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"port" : "10",
"weight" : "5",
"mark" : "0x0000001",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"port" : "20",
"weight" : "5",
"mark" : "0x0000002",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/039_snat_ipv4_tcp_weight_bck_port.json 0000664 0000000 0000000 00000001133 13475421131 0023121 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"port" : "10",
"weight" : "5",
"mark" : "0x0000001",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.11",
"port" : "20",
"weight" : "5",
"mark" : "0x0000002",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/040_snat_ipv4_tcp_weight_bck_estconnlimit.json 0000664 0000000 0000000 00000001153 13475421131 0024637 0 ustar 00root root 0000000 0000000 {
"farms" : [
{
"name" : "lb01",
"family" : "ipv4",
"virtual-addr" : "192.168.0.100",
"virtual-ports" : "80",
"mode" : "snat",
"protocol" : "tcp",
"scheduler" : "weight",
"state" : "up",
"backends" : [
{
"name" : "bck0",
"ip-addr" : "192.168.0.10",
"est-connlimit" : "1",
"weight" : "1",
"mark" : "0x0000001",
"priority" : "1",
"state" : "up"
},
{
"name" : "bck1",
"ip-addr" : "192.168.0.20",
"est-connlimit" : "2",
"weight" : "2",
"mark" : "0x0000002",
"priority" : "1",
"state" : "up"
}
]
}
]
}
nftlb-0.5/tests/cmd/ 0000775 0000000 0000000 00000000000 13475421131 0014371 5 ustar 00root root 0000000 0000000 nftlb-0.5/tests/cmd/001_snat_ipv4_tcp_weight.nft 0000664 0000000 0000000 00000001664 13475421131 0021615 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/002_snat_ipv4_tcp_weight_serial.nft 0000664 0000000 0000000 00000001664 13475421131 0023155 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.12 }
}
}
nftlb-0.5/tests/cmd/003_snat_ipv4_tcp_weight_multi.nft 0000664 0000000 0000000 00000002101 13475421131 0023014 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01,
192.168.0.101 . 82 : goto nat-lb02 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
chain nat-lb02 {
dnat to numgen inc mod 10 map { 0-4 : 192.168.0.12, 5-9 : 192.168.0.13 }
}
}
nftlb-0.5/tests/cmd/004_dsr_ipv4_tcp_hash.nft 0000664 0000000 0000000 00000000665 13475421131 0021077 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip daddr . tcp dport vmap @tcp-services-lo
}
chain lb01 {
ether saddr set 01:01:01:01:01:01 ether daddr set jhash ip saddr mod 10 map { 0-4 : 02:02:02:02:02:02, 5-9 : 03:03:03:03:03:03 } fwd to "lo"
}
}
nftlb-0.5/tests/cmd/005_dsr_ipv6_udp_rr.nft 0000664 0000000 0000000 00000000673 13475421131 0020603 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map udp-services6-lo {
type ipv6_addr . inet_service : verdict
elements = { 2001:db8:0:1:1:1:1:1 . 80 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip6 daddr . udp dport vmap @udp-services6-lo
}
chain lb01 {
ether saddr set 01:01:01:01:01:01 ether daddr set numgen inc mod 10 map { 0-4 : 02:02:02:02:02:02, 5-9 : 03:03:03:03:03:03 } fwd to "lo"
}
}
nftlb-0.5/tests/cmd/006_dsr_ipv46_tcp_udp_hash_weight_multi.nft 0000664 0000000 0000000 00000001400 13475421131 0024604 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 192.168.1.22 . 80 : goto lb01 }
}
map udp-services6-lo {
type ipv6_addr . inet_service : verdict
elements = { 2001:db8:0:1:1:1:1:1 . 80 : goto lb02 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip daddr . tcp dport vmap @tcp-services-lo
ip6 daddr . udp dport vmap @udp-services6-lo
}
chain lb01 {
ether saddr set 01:01:01:01:01:01 ether daddr set jhash ip saddr mod 10 map { 0-4 : 02:02:02:02:02:02, 5-9 : 03:03:03:03:03:03 } fwd to "lo"
}
chain lb02 {
ether saddr set 01:01:01:01:01:04 ether daddr set numgen random mod 10 map { 0-4 : 02:02:02:02:02:02, 5-9 : 03:03:03:03:03:03 } fwd to "lo"
}
}
nftlb-0.5/tests/cmd/007_snat_ipv4_tcp_weight_prio.nft 0000664 0000000 0000000 00000001740 13475421131 0022647 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 20 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11, 10-14 : 192.168.0.13, 15-19 : 192.168.0.15 }
}
}
nftlb-0.5/tests/cmd/008_snat_ipv4_all_rr.nft 0000664 0000000 0000000 00000001552 13475421131 0020736 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-services {
type ipv4_addr : verdict
elements = { 192.168.0.100 : goto filter-lb01 }
}
map nat-services {
type ipv4_addr : verdict
elements = { 192.168.0.100 : goto nat-lb01 }
}
map services-back {
type ipv4_addr : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr vmap @filter-services
}
chain filter-lb01 {
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr vmap @nat-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr map @services-back
}
chain nat-lb01 {
dnat to numgen inc mod 20 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11, 10-14 : 192.168.0.13, 15-19 : 192.168.0.15 }
}
}
nftlb-0.5/tests/cmd/009_snat_ipv4_multiport_symhash.nft 0000664 0000000 0000000 00000002065 13475421131 0023257 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01,
192.168.0.100 . 81 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01,
192.168.0.100 . 81 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to symhash mod 20 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11, 10-14 : 192.168.0.13, 15-19 : 192.168.0.15 }
}
}
nftlb-0.5/tests/cmd/010_dsr_ipv4_multiport_tcp_symhash.nft 0000664 0000000 0000000 00000001356 13475421131 0023742 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto lb01,
192.168.0.100 . 81 : goto lb01,
192.168.0.100 . 82 : goto lb01,
192.168.0.100 . 83 : goto lb01,
192.168.0.100 . 84 : goto lb01,
192.168.0.100 . 85 : goto lb01,
192.168.0.100 . 86 : goto lb01,
192.168.0.100 . 87 : goto lb01,
192.168.0.100 . 88 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip daddr . tcp dport vmap @tcp-services-lo
}
chain lb01 {
ether saddr set 01:01:01:01:01:01 ether daddr set symhash mod 10 map { 0-4 : 02:02:02:02:02:02, 5-9 : 03:03:03:03:03:03 } fwd to "lo"
}
}
nftlb-0.5/tests/cmd/011_dnat_ipv4_multiportlist_symhash.nft 0000664 0000000 0000000 00000002441 13475421131 0024123 0 ustar 00root root 0000000 0000000 table ip nftlb {
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01,
192.168.0.100 . 81 : goto nat-lb01,
192.168.0.100 . 82 : goto nat-lb01,
192.168.0.100 . 83 : goto nat-lb01,
192.168.0.100 . 84 : goto nat-lb01,
192.168.0.100 . 85 : goto nat-lb01,
192.168.0.100 . 86 : goto nat-lb01,
192.168.0.100 . 87 : goto nat-lb01,
192.168.0.100 . 88 : goto nat-lb01,
192.168.0.100 . 90 : goto nat-lb01,
192.168.0.100 . 91 : goto nat-lb01,
192.168.0.100 . 92 : goto nat-lb01,
192.168.0.100 . 93 : goto nat-lb01,
192.168.0.100 . 94 : goto nat-lb01,
192.168.0.100 . 95 : goto nat-lb01,
192.168.0.100 . 96 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to symhash mod 20 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11, 10-14 : 192.168.0.13, 15-19 : 192.168.0.15 }
}
}
nftlb-0.5/tests/cmd/012_dnat_ipv4_tcp_hash.nft 0000664 0000000 0000000 00000001150 13475421131 0021222 0 ustar 00root root 0000000 0000000 table ip nftlb {
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to jhash ip saddr mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/013_dnat_ipv4_tcp_weighted_rr.nft 0000664 0000000 0000000 00000001235 13475421131 0022607 0 ustar 00root root 0000000 0000000 table ip nftlb {
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.56.101 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 7 map { 0-1 : 192.168.0.10, 2 : 192.168.0.11, 3 : 192.168.0.12, 4-5 : 192.168.0.13, 6 : 192.168.0.14 }
}
}
nftlb-0.5/tests/cmd/014_stlsdnat_ipv4_multiportlist_symhash.nft 0000664 0000000 0000000 00000010015 13475421131 0025030 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.10 . 80 : goto lb01-back,
192.168.0.10 . 81 : goto lb01-back,
192.168.0.10 . 82 : goto lb01-back,
192.168.0.10 . 83 : goto lb01-back,
192.168.0.10 . 84 : goto lb01-back,
192.168.0.10 . 85 : goto lb01-back,
192.168.0.10 . 86 : goto lb01-back,
192.168.0.10 . 87 : goto lb01-back,
192.168.0.10 . 88 : goto lb01-back,
192.168.0.10 . 90 : goto lb01-back,
192.168.0.10 . 91 : goto lb01-back,
192.168.0.10 . 92 : goto lb01-back,
192.168.0.10 . 93 : goto lb01-back,
192.168.0.10 . 94 : goto lb01-back,
192.168.0.10 . 95 : goto lb01-back,
192.168.0.10 . 96 : goto lb01-back,
192.168.0.11 . 80 : goto lb01-back,
192.168.0.11 . 81 : goto lb01-back,
192.168.0.11 . 82 : goto lb01-back,
192.168.0.11 . 83 : goto lb01-back,
192.168.0.11 . 84 : goto lb01-back,
192.168.0.11 . 85 : goto lb01-back,
192.168.0.11 . 86 : goto lb01-back,
192.168.0.11 . 87 : goto lb01-back,
192.168.0.11 . 88 : goto lb01-back,
192.168.0.11 . 90 : goto lb01-back,
192.168.0.11 . 91 : goto lb01-back,
192.168.0.11 . 92 : goto lb01-back,
192.168.0.11 . 93 : goto lb01-back,
192.168.0.11 . 94 : goto lb01-back,
192.168.0.11 . 95 : goto lb01-back,
192.168.0.11 . 96 : goto lb01-back,
192.168.0.13 . 80 : goto lb01-back,
192.168.0.13 . 81 : goto lb01-back,
192.168.0.13 . 82 : goto lb01-back,
192.168.0.13 . 83 : goto lb01-back,
192.168.0.13 . 84 : goto lb01-back,
192.168.0.13 . 85 : goto lb01-back,
192.168.0.13 . 86 : goto lb01-back,
192.168.0.13 . 87 : goto lb01-back,
192.168.0.13 . 88 : goto lb01-back,
192.168.0.13 . 90 : goto lb01-back,
192.168.0.13 . 91 : goto lb01-back,
192.168.0.13 . 92 : goto lb01-back,
192.168.0.13 . 93 : goto lb01-back,
192.168.0.13 . 94 : goto lb01-back,
192.168.0.13 . 95 : goto lb01-back,
192.168.0.13 . 96 : goto lb01-back,
192.168.0.15 . 80 : goto lb01-back,
192.168.0.15 . 81 : goto lb01-back,
192.168.0.15 . 82 : goto lb01-back,
192.168.0.15 . 83 : goto lb01-back,
192.168.0.15 . 84 : goto lb01-back,
192.168.0.15 . 85 : goto lb01-back,
192.168.0.15 . 86 : goto lb01-back,
192.168.0.15 . 87 : goto lb01-back,
192.168.0.15 . 88 : goto lb01-back,
192.168.0.15 . 90 : goto lb01-back,
192.168.0.15 . 91 : goto lb01-back,
192.168.0.15 . 92 : goto lb01-back,
192.168.0.15 . 93 : goto lb01-back,
192.168.0.15 . 94 : goto lb01-back,
192.168.0.15 . 95 : goto lb01-back,
192.168.0.15 . 96 : goto lb01-back,
192.168.0.154 . 80 : goto lb01,
192.168.0.154 . 81 : goto lb01,
192.168.0.154 . 82 : goto lb01,
192.168.0.154 . 83 : goto lb01,
192.168.0.154 . 84 : goto lb01,
192.168.0.154 . 85 : goto lb01,
192.168.0.154 . 86 : goto lb01,
192.168.0.154 . 87 : goto lb01,
192.168.0.154 . 88 : goto lb01,
192.168.0.154 . 90 : goto lb01,
192.168.0.154 . 91 : goto lb01,
192.168.0.154 . 92 : goto lb01,
192.168.0.154 . 93 : goto lb01,
192.168.0.154 . 94 : goto lb01,
192.168.0.154 . 95 : goto lb01,
192.168.0.154 . 96 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip saddr . tcp sport vmap @tcp-services-lo
}
chain lb01 {
ip daddr set symhash mod 20 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11, 10-14 : 192.168.0.13, 15-19 : 192.168.0.15 } ether daddr set ip daddr map { 192.168.0.10 : 02:02:02:02:02:02, 192.168.0.11 : 03:03:03:03:03:03, 192.168.0.13 : 05:05:05:05:05:05, 192.168.0.15 : 07:07:07:07:07:07 } fwd to "lo"
}
chain lb01-back {
ip saddr set 192.168.0.154 ether saddr set 01:01:01:01:01:01 fwd to "lo"
}
}
nftlb-0.5/tests/cmd/015_stlsdnat_ipv4_tcp_hash.nft 0000664 0000000 0000000 00000001244 13475421131 0022137 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.10 . 80 : goto lb01-back,
192.168.0.11 . 80 : goto lb01-back,
192.168.0.100 . 80 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip saddr . tcp sport vmap @tcp-services-lo
}
chain lb01 {
ip daddr set jhash ip saddr mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 } ether daddr set ip daddr map { 192.168.0.10 : 02:02:02:02:02:02, 192.168.0.11 : 03:03:03:03:03:03 } fwd to "lo"
}
chain lb01-back {
ip saddr set 192.168.0.100 ether saddr set 01:01:01:01:01:01 fwd to "lo"
}
}
nftlb-0.5/tests/cmd/016_stlsdnat_ipv4_tcp_weighted_rr.nft 0000664 0000000 0000000 00000001704 13475421131 0023521 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.10 . 80 : goto lb01-back,
192.168.0.11 . 80 : goto lb01-back,
192.168.0.12 . 80 : goto lb01-back,
192.168.0.13 . 80 : goto lb01-back,
192.168.0.14 . 80 : goto lb01-back,
192.168.56.101 . 80 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip saddr . tcp sport vmap @tcp-services-lo
}
chain lb01 {
ip daddr set numgen random mod 7 map { 0-1 : 192.168.0.10, 2 : 192.168.0.11, 3 : 192.168.0.12, 4-5 : 192.168.0.13, 6 : 192.168.0.14 } ether daddr set ip daddr map { 192.168.0.10 : 02:02:02:02:02:02, 192.168.0.11 : 03:03:03:03:03:03, 192.168.0.12 : 04:04:04:04:04:04, 192.168.0.13 : 05:05:05:05:05:05, 192.168.0.14 : 06:06:06:06:06:06 } fwd to "lo"
}
chain lb01-back {
ip saddr set 192.168.56.101 ether saddr set 01:01:01:01:01:01 fwd to "lo"
}
}
nftlb-0.5/tests/cmd/017_snat_ipv4_tcp_ftp_weight.nft 0000664 0000000 0000000 00000002036 13475421131 0022467 0 ustar 00root root 0000000 0000000 table ip nftlb {
ct helper ftp-tcp {
type "ftp" protocol tcp
l3proto ip
}
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ip protocol tcp ct helper set "ftp-tcp"
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/018_dnat_ipv4_udp_sip_rr_multiport.nft 0000664 0000000 0000000 00000003116 13475421131 0023730 0 ustar 00root root 0000000 0000000 table ip nftlb {
ct helper sip-udp {
type "sip" protocol udp
l3proto ip
}
map filter-udp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.56.154 . 5060 : goto filter-lb01,
192.168.56.154 . 5061 : goto filter-lb01,
192.168.56.154 . 5062 : goto filter-lb01,
192.168.56.154 . 5063 : goto filter-lb01,
192.168.56.154 . 5064 : goto filter-lb01,
192.168.56.154 . 5065 : goto filter-lb01,
192.168.56.154 . 5066 : goto filter-lb01 }
}
map nat-udp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.56.154 . 5060 : goto nat-lb01,
192.168.56.154 . 5061 : goto nat-lb01,
192.168.56.154 . 5062 : goto nat-lb01,
192.168.56.154 . 5063 : goto nat-lb01,
192.168.56.154 . 5064 : goto nat-lb01,
192.168.56.154 . 5065 : goto nat-lb01,
192.168.56.154 . 5066 : goto nat-lb01 }
}
map udp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . udp dport vmap @filter-udp-services
}
chain filter-lb01 {
ip protocol udp ct helper set "sip-udp"
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . udp dport vmap @nat-udp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . udp dport map @udp-services-back
}
chain nat-lb01 {
dnat to numgen inc mod 10 map { 0-4 : 192.168.0.22, 5-9 : 192.168.0.23 }
}
}
nftlb-0.5/tests/cmd/019_dnat_ipv6_udp_tftp_rr.nft 0000664 0000000 0000000 00000002056 13475421131 0022000 0 ustar 00root root 0000000 0000000 table ip6 nftlb {
ct helper tftp-udp {
type "tftp" protocol udp
l3proto ip6
}
map filter-udp-services6 {
type ipv6_addr . inet_service : verdict
elements = { 2001:db8:0:1:1:1:1:1 . 69 : goto filter-lb01 }
}
map nat-udp-services6 {
type ipv6_addr . inet_service : verdict
elements = { 2001:db8:0:1:1:1:1:1 . 69 : goto nat-lb01 }
}
map udp-services6-back {
type ipv6_addr . inet_service : ipv6_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip6 daddr . udp dport vmap @filter-udp-services6
}
chain filter-lb01 {
ip6 nexthdr udp ct helper set "tftp-udp"
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip6 daddr . udp dport vmap @nat-udp-services6
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip6 daddr . udp dport map @udp-services6-back
}
chain nat-lb01 {
dnat to numgen inc mod 10 map { 0-4 : 2001:db8:0:1:1:1:1:2, 5-9 : 2001:db8:0:1:1:1:1:3 }
}
}
nftlb-0.5/tests/cmd/020_snat_ipv4_tcp_rr_log.nft 0000664 0000000 0000000 00000001720 13475421131 0021604 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.1.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.1.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
log prefix "INPUT-nat-lb01 "
dnat to numgen inc mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/021_dsr_ipv4_tcp_hash_log.nft 0000664 0000000 0000000 00000000720 13475421131 0021727 0 ustar 00root root 0000000 0000000 table netdev nftlb {
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip daddr . tcp dport vmap @tcp-services-lo
}
chain lb01 {
log prefix "INPUT-lb01 "
ether saddr set 01:01:01:01:01:01 ether daddr set jhash ip saddr mod 10 map { 0-4 : 02:02:02:02:02:02, 5-9 : 03:03:03:03:03:03 } fwd to "lo"
}
}
nftlb-0.5/tests/cmd/022_dnat_ipv4_tcp_weight_farm_mark.nft 0000664 0000000 0000000 00000001664 13475421131 0023620 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x0000dead
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/023_snat_ipv4_tcp_weight_farm_mark.nft 0000664 0000000 0000000 00000001664 13475421131 0023640 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set 0x8000dead
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/024_snat_ipv4_tcp_weight_bck_mark.nft 0000664 0000000 0000000 00000001745 13475421131 0023453 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set numgen random mod 2 map { 0 : 0x80dead01, 1 : 0x80dead02 }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to ct mark map { 0x80dead01 : 192.168.0.10, 0x80dead02 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/025_dnat_ipv4_tcp_weight_bck_mark.nft 0000664 0000000 0000000 00000001745 13475421131 0023435 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set numgen random mod 2 map { 0 : 0x00dead01, 1 : 0x00dead02 }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to ct mark map { 0x00dead01 : 192.168.0.10, 0x00dead02 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/026_snat_ipv4_tcp_weight_nomasq.nft 0000664 0000000 0000000 00000001305 13475421131 0023172 0 ustar 00root root 0000000 0000000 table ip nftlb {
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
elements = { 192.168.0.10 . 80 : 192.168.0.101,
192.168.0.11 . 80 : 192.168.0.101 }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/027_snat_ipv4_udp_weight_nomasq_multiport.nft 0000664 0000000 0000000 00000001711 13475421131 0025315 0 ustar 00root root 0000000 0000000 table ip nftlb {
map nat-udp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01,
192.168.0.100 . 81 : goto nat-lb01,
192.168.0.100 . 82 : goto nat-lb01 }
}
map udp-services-back {
type ipv4_addr . inet_service : ipv4_addr
elements = { 192.168.0.10 . 80 : 192.168.0.101,
192.168.0.10 . 81 : 192.168.0.101,
192.168.0.10 . 82 : 192.168.0.101,
192.168.0.11 . 80 : 192.168.0.101,
192.168.0.11 . 81 : 192.168.0.101,
192.168.0.11 . 82 : 192.168.0.101 }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . udp dport vmap @nat-udp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . udp dport map @udp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/028_snat_ipv4_all_weight_nomasq.nft 0000664 0000000 0000000 00000001150 13475421131 0023154 0 ustar 00root root 0000000 0000000 table ip nftlb {
map nat-services {
type ipv4_addr : verdict
elements = { 192.168.0.100 : goto nat-lb01 }
}
map services-back {
type ipv4_addr : ipv4_addr
elements = { 192.168.0.10 : 192.168.0.101, 192.168.0.11 : 192.168.0.101 }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr vmap @nat-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr map @services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/029_dnat_ipv4_tcp_udp_multifarm_hash_params.nft 0000664 0000000 0000000 00000002041 13475421131 0025525 0 ustar 00root root 0000000 0000000 table ip nftlb {
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
map nat-udp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 53 : goto nat-lb02 }
}
map udp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
ip daddr . udp dport vmap @nat-udp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
snat to ip daddr . udp dport map @udp-services-back
}
chain nat-lb01 {
dnat to jhash ip daddr mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
chain nat-lb02 {
meta iiftype ether dnat to jhash ip saddr . udp sport . ether saddr mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/030_snat_ipv4_tcp_weight_bck_mark_srcip_empty.nft 0000664 0000000 0000000 00000001745 13475421131 0026066 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set numgen random mod 2 map { 0 : 0x80dead01, 1 : 0x80dead02 }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to ct mark map { 0x80dead01 : 192.168.0.10, 0x80dead02 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/031_snat_ipv4_tcp_weight_newrtlimit.nft 0000664 0000000 0000000 00000002057 13475421131 0024073 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct state new meter new-rtlimit-lb01 size 65535 { ip saddr limit rate over 10/second} log prefix "new-rtlimit-lb01" drop
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/032_snat_ipv4_tcp_weight_newrtlimit_burst.nft 0000664 0000000 0000000 00000002077 13475421131 0025315 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct state new meter new-rtlimit-lb01 size 65535 { ip saddr limit rate over 10/second burst 3 packets} log prefix "new-rtlimit-lb01" drop
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/033_snat_ipv4_tcp_weight_rstrtlimit.nft 0000664 0000000 0000000 00000002057 13475421131 0024114 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
tcp flags rst meter rst-rtlimit-lb01 size 65535 { ip saddr limit rate over 5/second} log prefix "rst-rtlimit-lb01" drop
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/034_snat_ipv4_tcp_weight_estconnlimit.nft 0000664 0000000 0000000 00000002053 13475421131 0024404 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct state new meter est-connlimit-lb01 size 65535 { ip saddr ct count over 20 } log prefix "est-connlimit-lb01" drop
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/035_snat_ipv4_tcp_weight_tcpstrict.nft 0000664 0000000 0000000 00000001751 13475421131 0023720 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct state invalid log prefix "tcp-strict-lb01" drop
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/036_snat_ipv4_tcp_weight_queue.nft 0000664 0000000 0000000 00000001757 13475421131 0023034 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
tcp flags syn queue num 0 bypass log prefix "queue-lb01"
ct mark set 0x80000000
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/037_policies.nft 0000664 0000000 0000000 00000002054 13475421131 0017303 0 ustar 00root root 0000000 0000000 table netdev nftlb {
set black001 {
type ipv4_addr
flags interval
elements = { 192.168.40.0/24, 192.168.200.100 }
}
map tcp-services-lo {
type ipv4_addr . inet_service : verdict
elements = { 127.0.0.1 . 80 : goto lb01 }
}
chain ingress-lo {
type filter hook ingress device "lo" priority 100; policy accept;
ip daddr . tcp dport vmap @tcp-services-lo
}
chain lb01 {
ip saddr @black001 log prefix "policy-BL-black001-lb01" drop
}
}
table ip nftlb {
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 127.0.0.1 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to numgen random mod 10 map { 0-4 : 192.168.0.10, 5-9 : 192.168.0.11 }
}
}
nftlb-0.5/tests/cmd/038_snat_ipv4_tcp_weight_persistence_srcip_srcport.nft 0000664 0000000 0000000 00000002251 13475421131 0027200 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map persist-lb01 {
type ipv4_addr . inet_service : mark
size 65535
timeout 50s
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set numgen random mod 10 map { 0-4 : 0x80000001, 5-9 : 0x80000002 }
update @persist-lb01 { ip saddr . tcp sport : ct mark }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
ip protocol tcp ct mark 0x80000001 dnat to 192.168.0.10:10
ip protocol tcp ct mark 0x80000002 dnat to 192.168.0.11:20
}
}
nftlb-0.5/tests/cmd/039_snat_ipv4_tcp_weight_bck_port.nft 0000664 0000000 0000000 00000002025 13475421131 0023503 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set numgen random mod 10 map { 0-4 : 0x80000001, 5-9 : 0x80000002 }
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
ip protocol tcp ct mark 0x80000001 dnat to 192.168.0.10:10
ip protocol tcp ct mark 0x80000002 dnat to 192.168.0.11:20
}
}
nftlb-0.5/tests/cmd/040_snat_ipv4_tcp_weight_bck_estconnlimit.nft 0000664 0000000 0000000 00000002337 13475421131 0025225 0 ustar 00root root 0000000 0000000 table ip nftlb {
map filter-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto filter-lb01 }
}
map nat-tcp-services {
type ipv4_addr . inet_service : verdict
elements = { 192.168.0.100 . 80 : goto nat-lb01 }
}
map tcp-services-back {
type ipv4_addr . inet_service : ipv4_addr
}
chain filter {
type filter hook prerouting priority mangle; policy accept;
meta mark set ct mark
ip daddr . tcp dport vmap @filter-tcp-services
}
chain filter-lb01 {
ct mark set numgen random mod 3 map { 0 : 0x80000001, 1-2 : 0x80000002 }
ct mark 0x80000001 meter est-connlimit-bck0 size 65535 { ip saddr ct count over 1 } log prefix "est-connlimit-bck0" drop
ct mark 0x80000002 meter est-connlimit-bck1 size 65535 { ip saddr ct count over 2 } log prefix "est-connlimit-bck1" drop
}
chain prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr . tcp dport vmap @nat-tcp-services
}
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ct mark 0x80000000/1 masquerade
snat to ip daddr . tcp dport map @tcp-services-back
}
chain nat-lb01 {
dnat to ct mark map { 0x80000001 : 192.168.0.10, 0x80000002 : 192.168.0.20 }
}
}
nftlb-0.5/tests/exec_tests.sh 0000775 0000000 0000000 00000002444 13475421131 0016337 0 ustar 00root root 0000000 0000000 #!/bin/bash
ARG="$1"
ARG2="$2"
NFTBIN="nft"
NFTLBIN="../src/nftlb"
APISERVER=0
APISRV_PORT=5555
APISRV_KEY="hola"
CURL=`which curl`
FILES=""
if [ "${ARG}" = "-s" -a -e "$CURL" ]; then
APISERVER=1
elif [[ ${ARG} =~ '.json' ]]; then
FILES="${ARG}"
elif [ "${ARG}" = "" ]; then
FILES="*.json"
fi
if [ "$FILES" = "" -a "${ARG2}" = "" ]; then
FILES="*.json"
fi
if [ $APISERVER -eq 1 ]; then
$NFTBIN flush ruleset
$NFTLBIN -k "$APISRV_KEY" -l 7 > /dev/null &
fi
for file in `ls ${FILES}`; do
echo -n "Executing test: ${file}... "
if [ $APISERVER -eq 1 ]; then
$CURL -H "Expect:" -H "Key: $APISRV_KEY" -X DELETE http://localhost:$APISRV_PORT/farms
$CURL -H "Expect:" -H "Key: $APISRV_KEY" -X POST http://localhost:$APISRV_PORT/farms -d "@$file"
statusexec=$?
else
$NFTBIN flush ruleset
$NFTLBIN -e -l 7 -c ${file}
statusexec=$?
fi
if [ $statusexec -ne 0 ]; then
echo -e "\e[31mNFT EXEC ERROR\e[0m"
continue;
fi
nftfile=`echo ${file} | awk -F'.' '{ print $1 }'`
if [ ! -f "cmd/$nftfile.nft" ]; then
echo "Dump file doesn't exist"
continue;
fi
diff -Nru "cmd/${nftfile}.nft" <($NFTBIN list ruleset)
statusnft=$?
if [ $statusnft -eq 0 ]; then
echo -e "\e[32mOK\e[0m"
else
echo -e "\e[31mNFT DUMP ERROR\e[0m"
fi
done
if [ $APISERVER -eq 1 ]; then
kill `pidof nftlb`
fi