net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <linux/nsproxy.h>
  42 #include <net/ip.h>
  43 #ifdef CONFIG_IP_VS_IPV6
  44 #include <net/ipv6.h>
  45 #include <net/ip6_route.h>
  46 #endif
  47 #include <net/route.h>
  48 #include <net/sock.h>
  49 #include <net/genetlink.h>
  50
  51 #include <asm/uaccess.h>
  52
  53 #include <net/ip_vs.h>
  54
  55 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  56 static DEFINE_MUTEX(__ip_vs_mutex);
  57
  58 /* lock for service table */
  59 static DEFINE_RWLOCK(__ip_vs_svc_lock);
  60
  61 /* sysctl variables */
  62
  63 #ifdef CONFIG_IP_VS_DEBUG
  64 static int sysctl_ip_vs_debug_level = 0;
  65
  66 int ip_vs_get_debug_level(void)
  67 {
  68         return sysctl_ip_vs_debug_level;
  69 }
  70 #endif
  71
  72
  73 /*  Protos */
  74 static void __ip_vs_del_service(struct ip_vs_service *svc);
  75
  76
  77 #ifdef CONFIG_IP_VS_IPV6
  78 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
  79 static bool __ip_vs_addr_is_local_v6(struct net *net,
  80                                      const struct in6_addr *addr)
  81 {
  82         struct flowi6 fl6 = {
  83                 .daddr = *addr,
  84         };
  85         struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
  86         bool is_local;
  87
  88         is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
  89
  90         dst_release(dst);
  91         return is_local;
  92 }
  93 #endif
  94
  95 #ifdef CONFIG_SYSCTL
  96 /*
  97  *      update_defense_level is called from keventd and from sysctl,
  98  *      so it needs to protect itself from softirqs
  99  */
 100 static void update_defense_level(struct netns_ipvs *ipvs)
 101 {
 102         struct sysinfo i;
 103         static int old_secure_tcp = 0;
 104         int availmem;
 105         int nomem;
 106         int to_change = -1;
 107
 108         /* we only count free and buffered memory (in pages) */
 109         si_meminfo(&i);
 110         availmem = i.freeram + i.bufferram;
 111         /* however in linux 2.5 the i.bufferram is total page cache size,
 112            we need adjust it */
 113         /* si_swapinfo(&i); */
 114         /* availmem = availmem - (i.totalswap - i.freeswap); */
 115
 116         nomem = (availmem < ipvs->sysctl_amemthresh);
 117
 118         local_bh_disable();
 119
 120         /* drop_entry */
 121         spin_lock(&ipvs->dropentry_lock);
 122         switch (ipvs->sysctl_drop_entry) {
 123         case 0:
 124                 atomic_set(&ipvs->dropentry, 0);
 125                 break;
 126         case 1:
 127                 if (nomem) {
 128                         atomic_set(&ipvs->dropentry, 1);
 129                         ipvs->sysctl_drop_entry = 2;
 130                 } else {
 131                         atomic_set(&ipvs->dropentry, 0);
 132                 }
 133                 break;
 134         case 2:
 135                 if (nomem) {
 136                         atomic_set(&ipvs->dropentry, 1);
 137                 } else {
 138                         atomic_set(&ipvs->dropentry, 0);
 139                         ipvs->sysctl_drop_entry = 1;
 140                 };
 141                 break;
 142         case 3:
 143                 atomic_set(&ipvs->dropentry, 1);
 144                 break;
 145         }
 146         spin_unlock(&ipvs->dropentry_lock);
 147
 148         /* drop_packet */
 149         spin_lock(&ipvs->droppacket_lock);
 150         switch (ipvs->sysctl_drop_packet) {
 151         case 0:
 152                 ipvs->drop_rate = 0;
 153                 break;
 154         case 1:
 155                 if (nomem) {
 156                         ipvs->drop_rate = ipvs->drop_counter
 157                                 = ipvs->sysctl_amemthresh /
 158                                 (ipvs->sysctl_amemthresh-availmem);
 159                         ipvs->sysctl_drop_packet = 2;
 160                 } else {
 161                         ipvs->drop_rate = 0;
 162                 }
 163                 break;
 164         case 2:
 165                 if (nomem) {
 166                         ipvs->drop_rate = ipvs->drop_counter
 167                                 = ipvs->sysctl_amemthresh /
 168                                 (ipvs->sysctl_amemthresh-availmem);
 169                 } else {
 170                         ipvs->drop_rate = 0;
 171                         ipvs->sysctl_drop_packet = 1;
 172                 }
 173                 break;
 174         case 3:
 175                 ipvs->drop_rate = ipvs->sysctl_am_droprate;
 176                 break;
 177         }
 178         spin_unlock(&ipvs->droppacket_lock);
 179
 180         /* secure_tcp */
 181         spin_lock(&ipvs->securetcp_lock);
 182         switch (ipvs->sysctl_secure_tcp) {
 183         case 0:
 184                 if (old_secure_tcp >= 2)
 185                         to_change = 0;
 186                 break;
 187         case 1:
 188                 if (nomem) {
 189                         if (old_secure_tcp < 2)
 190                                 to_change = 1;
 191                         ipvs->sysctl_secure_tcp = 2;
 192                 } else {
 193                         if (old_secure_tcp >= 2)
 194                                 to_change = 0;
 195                 }
 196                 break;
 197         case 2:
 198                 if (nomem) {
 199                         if (old_secure_tcp < 2)
 200                                 to_change = 1;
 201                 } else {
 202                         if (old_secure_tcp >= 2)
 203                                 to_change = 0;
 204                         ipvs->sysctl_secure_tcp = 1;
 205                 }
 206                 break;
 207         case 3:
 208                 if (old_secure_tcp < 2)
 209                         to_change = 1;
 210                 break;
 211         }
 212         old_secure_tcp = ipvs->sysctl_secure_tcp;
 213         if (to_change >= 0)
 214                 ip_vs_protocol_timeout_change(ipvs,
 215                                               ipvs->sysctl_secure_tcp > 1);
 216         spin_unlock(&ipvs->securetcp_lock);
 217
 218         local_bh_enable();
 219 }
 220
 221
 222 /*
 223  *      Timer for checking the defense
 224  */
 225 #define DEFENSE_TIMER_PERIOD    1*HZ
 226
 227 static void defense_work_handler(struct work_struct *work)
 228 {
 229         struct netns_ipvs *ipvs =
 230                 container_of(work, struct netns_ipvs, defense_work.work);
 231
 232         update_defense_level(ipvs);
 233         if (atomic_read(&ipvs->dropentry))
 234                 ip_vs_random_dropentry(ipvs->net);
 235         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
 236 }
 237 #endif
 238
 239 int
 240 ip_vs_use_count_inc(void)
 241 {
 242         return try_module_get(THIS_MODULE);
 243 }
 244
 245 void
 246 ip_vs_use_count_dec(void)
 247 {
 248         module_put(THIS_MODULE);
 249 }
 250
 251
 252 /*
 253  *      Hash table: for virtual service lookups
 254  */
 255 #define IP_VS_SVC_TAB_BITS 8
 256 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 257 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 258
 259 /* the service table hashed by <protocol, addr, port> */
 260 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 261 /* the service table hashed by fwmark */
 262 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 263
 264
 265 /*
 266  *      Returns hash value for virtual service
 267  */
 268 static inline unsigned int
 269 ip_vs_svc_hashkey(struct net *net, int af, unsigned int proto,
 270                   const union nf_inet_addr *addr, __be16 port)
 271 {
 272         register unsigned int porth = ntohs(port);
 273         __be32 addr_fold = addr->ip;
 274
 275 #ifdef CONFIG_IP_VS_IPV6
 276         if (af == AF_INET6)
 277                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 278                             addr->ip6[2]^addr->ip6[3];
 279 #endif
 280         addr_fold ^= ((size_t)net>>8);
 281
 282         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
 283                 & IP_VS_SVC_TAB_MASK;
 284 }
 285
 286 /*
 287  *      Returns hash value of fwmark for virtual service lookup
 288  */
 289 static inline unsigned int ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
 290 {
 291         return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
 292 }
 293
 294 /*
 295  *      Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
 296  *      or in the ip_vs_svc_fwm_table by fwmark.
 297  *      Should be called with locked tables.
 298  */
 299 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 300 {
 301         unsigned int hash;
 302
 303         if (svc->flags & IP_VS_SVC_F_HASHED) {
 304                 pr_err("%s(): request for already hashed, called from %pF\n",
 305                        __func__, __builtin_return_address(0));
 306                 return 0;
 307         }
 308
 309         if (svc->fwmark == 0) {
 310                 /*
 311                  *  Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
 312                  */
 313                 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
 314                                          &svc->addr, svc->port);
 315                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
 316         } else {
 317                 /*
 318                  *  Hash it by fwmark in svc_fwm_table
 319                  */
 320                 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
 321                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 322         }
 323
 324         svc->flags |= IP_VS_SVC_F_HASHED;
 325         /* increase its refcnt because it is referenced by the svc table */
 326         atomic_inc(&svc->refcnt);
 327         return 1;
 328 }
 329
 330
 331 /*
 332  *      Unhashes a service from svc_table / svc_fwm_table.
 333  *      Should be called with locked tables.
 334  */
 335 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 336 {
 337         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 338                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 339                        __func__, __builtin_return_address(0));
 340                 return 0;
 341         }
 342
 343         if (svc->fwmark == 0) {
 344                 /* Remove it from the svc_table table */
 345                 list_del(&svc->s_list);
 346         } else {
 347                 /* Remove it from the svc_fwm_table table */
 348                 list_del(&svc->f_list);
 349         }
 350
 351         svc->flags &= ~IP_VS_SVC_F_HASHED;
 352         atomic_dec(&svc->refcnt);
 353         return 1;
 354 }
 355
 356
 357 /*
 358  *      Get service by {netns, proto,addr,port} in the service table.
 359  */
 360 static inline struct ip_vs_service *
 361 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
 362                      const union nf_inet_addr *vaddr, __be16 vport)
 363 {
 364         unsigned int hash;
 365         struct ip_vs_service *svc;
 366
 367         /* Check for "full" addressed entries */
 368         hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
 369
 370         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
 371                 if ((svc->af == af)
 372                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 373                     && (svc->port == vport)
 374                     && (svc->protocol == protocol)
 375                     && net_eq(svc->net, net)) {
 376                         /* HIT */
 377                         return svc;
 378                 }
 379         }
 380
 381         return NULL;
 382 }
 383
 384
 385 /*
 386  *      Get service by {fwmark} in the service table.
 387  */
 388 static inline struct ip_vs_service *
 389 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
 390 {
 391         unsigned int hash;
 392         struct ip_vs_service *svc;
 393
 394         /* Check for fwmark addressed entries */
 395         hash = ip_vs_svc_fwm_hashkey(net, fwmark);
 396
 397         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 398                 if (svc->fwmark == fwmark && svc->af == af
 399                     && net_eq(svc->net, net)) {
 400                         /* HIT */
 401                         return svc;
 402                 }
 403         }
 404
 405         return NULL;
 406 }
 407
 408 struct ip_vs_service *
 409 ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
 410                   const union nf_inet_addr *vaddr, __be16 vport)
 411 {
 412         struct ip_vs_service *svc;
 413         struct netns_ipvs *ipvs = net_ipvs(net);
 414
 415         read_lock(&__ip_vs_svc_lock);
 416
 417         /*
 418          *      Check the table hashed by fwmark first
 419          */
 420         if (fwmark) {
 421                 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
 422                 if (svc)
 423                         goto out;
 424         }
 425
 426         /*
 427          *      Check the table hashed by <protocol,addr,port>
 428          *      for "full" addressed entries
 429          */
 430         svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
 431
 432         if (svc == NULL
 433             && protocol == IPPROTO_TCP
 434             && atomic_read(&ipvs->ftpsvc_counter)
 435             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 436                 /*
 437                  * Check if ftp service entry exists, the packet
 438                  * might belong to FTP data connections.
 439                  */
 440                 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
 441         }
 442
 443         if (svc == NULL
 444             && atomic_read(&ipvs->nullsvc_counter)) {
 445                 /*
 446                  * Check if the catch-all port (port zero) exists
 447                  */
 448                 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
 449         }
 450
 451   out:
 452         if (svc)
 453                 atomic_inc(&svc->usecnt);
 454         read_unlock(&__ip_vs_svc_lock);
 455
 456         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 457                       fwmark, ip_vs_proto_name(protocol),
 458                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 459                       svc ? "hit" : "not hit");
 460
 461         return svc;
 462 }
 463
 464
 465 static inline void
 466 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 467 {
 468         atomic_inc(&svc->refcnt);
 469         dest->svc = svc;
 470 }
 471
 472 static void
 473 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 474 {
 475         struct ip_vs_service *svc = dest->svc;
 476
 477         dest->svc = NULL;
 478         if (atomic_dec_and_test(&svc->refcnt)) {
 479                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
 480                               svc->fwmark,
 481                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
 482                               ntohs(svc->port), atomic_read(&svc->usecnt));
 483                 free_percpu(svc->stats.cpustats);
 484                 kfree(svc);
 485         }
 486 }
 487
 488
 489 /*
 490  *      Returns hash value for real service
 491  */
 492 static inline unsigned int ip_vs_rs_hashkey(int af,
 493                                             const union nf_inet_addr *addr,
 494                                             __be16 port)
 495 {
 496         register unsigned int porth = ntohs(port);
 497         __be32 addr_fold = addr->ip;
 498
 499 #ifdef CONFIG_IP_VS_IPV6
 500         if (af == AF_INET6)
 501                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 502                             addr->ip6[2]^addr->ip6[3];
 503 #endif
 504
 505         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 506                 & IP_VS_RTAB_MASK;
 507 }
 508
 509 /*
 510  *      Hashes ip_vs_dest in rs_table by <proto,addr,port>.
 511  *      should be called with locked tables.
 512  */
 513 static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
 514 {
 515         unsigned int hash;
 516
 517         if (!list_empty(&dest->d_list)) {
 518                 return 0;
 519         }
 520
 521         /*
 522          *      Hash by proto,addr,port,
 523          *      which are the parameters of the real service.
 524          */
 525         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 526
 527         list_add(&dest->d_list, &ipvs->rs_table[hash]);
 528
 529         return 1;
 530 }
 531
 532 /*
 533  *      UNhashes ip_vs_dest from rs_table.
 534  *      should be called with locked tables.
 535  */
 536 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
 537 {
 538         /*
 539          * Remove it from the rs_table table.
 540          */
 541         if (!list_empty(&dest->d_list)) {
 542                 list_del(&dest->d_list);
 543                 INIT_LIST_HEAD(&dest->d_list);
 544         }
 545
 546         return 1;
 547 }
 548
 549 /*
 550  *      Lookup real service by <proto,addr,port> in the real service table.
 551  */
 552 struct ip_vs_dest *
 553 ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
 554                           const union nf_inet_addr *daddr,
 555                           __be16 dport)
 556 {
 557         struct netns_ipvs *ipvs = net_ipvs(net);
 558         unsigned int hash;
 559         struct ip_vs_dest *dest;
 560
 561         /*
 562          *      Check for "full" addressed entries
 563          *      Return the first found entry
 564          */
 565         hash = ip_vs_rs_hashkey(af, daddr, dport);
 566
 567         read_lock(&ipvs->rs_lock);
 568         list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
 569                 if ((dest->af == af)
 570                     && ip_vs_addr_equal(af, &dest->addr, daddr)
 571                     && (dest->port == dport)
 572                     && ((dest->protocol == protocol) ||
 573                         dest->vfwmark)) {
 574                         /* HIT */
 575                         read_unlock(&ipvs->rs_lock);
 576                         return dest;
 577                 }
 578         }
 579         read_unlock(&ipvs->rs_lock);
 580
 581         return NULL;
 582 }
 583
 584 /*
 585  *      Lookup destination by {addr,port} in the given service
 586  */
 587 static struct ip_vs_dest *
 588 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 589                   __be16 dport)
 590 {
 591         struct ip_vs_dest *dest;
 592
 593         /*
 594          * Find the destination for the given service
 595          */
 596         list_for_each_entry(dest, &svc->destinations, n_list) {
 597                 if ((dest->af == svc->af)
 598                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 599                     && (dest->port == dport)) {
 600                         /* HIT */
 601                         return dest;
 602                 }
 603         }
 604
 605         return NULL;
 606 }
 607
 608 /*
 609  * Find destination by {daddr,dport,vaddr,protocol}
 610  * Cretaed to be used in ip_vs_process_message() in
 611  * the backup synchronization daemon. It finds the
 612  * destination to be bound to the received connection
 613  * on the backup.
 614  *
 615  * ip_vs_lookup_real_service() looked promissing, but
 616  * seems not working as expected.
 617  */
 618 struct ip_vs_dest *ip_vs_find_dest(struct net  *net, int af,
 619                                    const union nf_inet_addr *daddr,
 620                                    __be16 dport,
 621                                    const union nf_inet_addr *vaddr,
 622                                    __be16 vport, __u16 protocol, __u32 fwmark,
 623                                    __u32 flags)
 624 {
 625         struct ip_vs_dest *dest;
 626         struct ip_vs_service *svc;
 627         __be16 port = dport;
 628
 629         svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
 630         if (!svc)
 631                 return NULL;
 632         if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
 633                 port = 0;
 634         dest = ip_vs_lookup_dest(svc, daddr, port);
 635         if (!dest)
 636                 dest = ip_vs_lookup_dest(svc, daddr, port ^ dport);
 637         if (dest)
 638                 atomic_inc(&dest->refcnt);
 639         ip_vs_service_put(svc);
 640         return dest;
 641 }
 642
 643 /*
 644  *  Lookup dest by {svc,addr,port} in the destination trash.
 645  *  The destination trash is used to hold the destinations that are removed
 646  *  from the service table but are still referenced by some conn entries.
 647  *  The reason to add the destination trash is when the dest is temporary
 648  *  down (either by administrator or by monitor program), the dest can be
 649  *  picked back from the trash, the remaining connections to the dest can
 650  *  continue, and the counting information of the dest is also useful for
 651  *  scheduling.
 652  */
 653 static struct ip_vs_dest *
 654 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 655                      __be16 dport)
 656 {
 657         struct ip_vs_dest *dest, *nxt;
 658         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 659
 660         /*
 661          * Find the destination in trash
 662          */
 663         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 664                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 665                               "dest->refcnt=%d\n",
 666                               dest->vfwmark,
 667                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 668                               ntohs(dest->port),
 669                               atomic_read(&dest->refcnt));
 670                 if (dest->af == svc->af &&
 671                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 672                     dest->port == dport &&
 673                     dest->vfwmark == svc->fwmark &&
 674                     dest->protocol == svc->protocol &&
 675                     (svc->fwmark ||
 676                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 677                       dest->vport == svc->port))) {
 678                         /* HIT */
 679                         return dest;
 680                 }
 681
 682                 /*
 683                  * Try to purge the destination from trash if not referenced
 684                  */
 685                 if (atomic_read(&dest->refcnt) == 1) {
 686                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
 687                                       "from trash\n",
 688                                       dest->vfwmark,
 689                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
 690                                       ntohs(dest->port));
 691                         list_del(&dest->n_list);
 692                         ip_vs_dst_reset(dest);
 693                         __ip_vs_unbind_svc(dest);
 694                         free_percpu(dest->stats.cpustats);
 695                         kfree(dest);
 696                 }
 697         }
 698
 699         return NULL;
 700 }
 701
 702
 703 /*
 704  *  Clean up all the destinations in the trash
 705  *  Called by the ip_vs_control_cleanup()
 706  *
 707  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 708  *  the service tables must have been flushed and all the connections
 709  *  are expired, and the refcnt of each destination in the trash must
 710  *  be 1, so we simply release them here.
 711  */
 712 static void ip_vs_trash_cleanup(struct net *net)
 713 {
 714         struct ip_vs_dest *dest, *nxt;
 715         struct netns_ipvs *ipvs = net_ipvs(net);
 716
 717         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 718                 list_del(&dest->n_list);
 719                 ip_vs_dst_reset(dest);
 720                 __ip_vs_unbind_svc(dest);
 721                 free_percpu(dest->stats.cpustats);
 722                 kfree(dest);
 723         }
 724 }
 725
 726 static void
 727 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
 728 {
 729 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
 730
 731         spin_lock_bh(&src->lock);
 732
 733         IP_VS_SHOW_STATS_COUNTER(conns);
 734         IP_VS_SHOW_STATS_COUNTER(inpkts);
 735         IP_VS_SHOW_STATS_COUNTER(outpkts);
 736         IP_VS_SHOW_STATS_COUNTER(inbytes);
 737         IP_VS_SHOW_STATS_COUNTER(outbytes);
 738
 739         ip_vs_read_estimator(dst, src);
 740
 741         spin_unlock_bh(&src->lock);
 742 }
 743
 744 static void
 745 ip_vs_zero_stats(struct ip_vs_stats *stats)
 746 {
 747         spin_lock_bh(&stats->lock);
 748
 749         /* get current counters as zero point, rates are zeroed */
 750
 751 #define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
 752
 753         IP_VS_ZERO_STATS_COUNTER(conns);
 754         IP_VS_ZERO_STATS_COUNTER(inpkts);
 755         IP_VS_ZERO_STATS_COUNTER(outpkts);
 756         IP_VS_ZERO_STATS_COUNTER(inbytes);
 757         IP_VS_ZERO_STATS_COUNTER(outbytes);
 758
 759         ip_vs_zero_estimator(stats);
 760
 761         spin_unlock_bh(&stats->lock);
 762 }
 763
 764 /*
 765  *      Update a destination in the given service
 766  */
 767 static void
 768 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
 769                     struct ip_vs_dest_user_kern *udest, int add)
 770 {
 771         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 772         int conn_flags;
 773
 774         /* set the weight and the flags */
 775         atomic_set(&dest->weight, udest->weight);
 776         conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
 777         conn_flags |= IP_VS_CONN_F_INACTIVE;
 778
 779         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 780         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
 781                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 782         } else {
 783                 /*
 784                  *    Put the real service in rs_table if not present.
 785                  *    For now only for NAT!
 786                  */
 787                 write_lock_bh(&ipvs->rs_lock);
 788                 ip_vs_rs_hash(ipvs, dest);
 789                 write_unlock_bh(&ipvs->rs_lock);
 790         }
 791         atomic_set(&dest->conn_flags, conn_flags);
 792
 793         /* bind the service */
 794         if (!dest->svc) {
 795                 __ip_vs_bind_svc(dest, svc);
 796         } else {
 797                 if (dest->svc != svc) {
 798                         __ip_vs_unbind_svc(dest);
 799                         ip_vs_zero_stats(&dest->stats);
 800                         __ip_vs_bind_svc(dest, svc);
 801                 }
 802         }
 803
 804         /* set the dest status flags */
 805         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 806
 807         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 808                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 809         dest->u_threshold = udest->u_threshold;
 810         dest->l_threshold = udest->l_threshold;
 811
 812         spin_lock_bh(&dest->dst_lock);
 813         ip_vs_dst_reset(dest);
 814         spin_unlock_bh(&dest->dst_lock);
 815
 816         if (add)
 817                 ip_vs_start_estimator(svc->net, &dest->stats);
 818
 819         write_lock_bh(&__ip_vs_svc_lock);
 820
 821         /* Wait until all other svc users go away */
 822         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
 823
 824         if (add) {
 825                 list_add(&dest->n_list, &svc->destinations);
 826                 svc->num_dests++;
 827         }
 828
 829         /* call the update_service, because server weight may be changed */
 830         if (svc->scheduler->update_service)
 831                 svc->scheduler->update_service(svc);
 832
 833         write_unlock_bh(&__ip_vs_svc_lock);
 834 }
 835
 836
 837 /*
 838  *      Create a destination for the given service
 839  */
 840 static int
 841 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 842                struct ip_vs_dest **dest_p)
 843 {
 844         struct ip_vs_dest *dest;
 845         unsigned int atype;
 846
 847         EnterFunction(2);
 848
 849 #ifdef CONFIG_IP_VS_IPV6
 850         if (svc->af == AF_INET6) {
 851                 atype = ipv6_addr_type(&udest->addr.in6);
 852                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 853                         atype & IPV6_ADDR_LINKLOCAL) &&
 854                         !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
 855                         return -EINVAL;
 856         } else
 857 #endif
 858         {
 859                 atype = inet_addr_type(svc->net, udest->addr.ip);
 860                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 861                         return -EINVAL;
 862         }
 863
 864         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
 865         if (dest == NULL)
 866                 return -ENOMEM;
 867
 868         dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
 869         if (!dest->stats.cpustats)
 870                 goto err_alloc;
 871
 872         dest->af = svc->af;
 873         dest->protocol = svc->protocol;
 874         dest->vaddr = svc->addr;
 875         dest->vport = svc->port;
 876         dest->vfwmark = svc->fwmark;
 877         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 878         dest->port = udest->port;
 879
 880         atomic_set(&dest->activeconns, 0);
 881         atomic_set(&dest->inactconns, 0);
 882         atomic_set(&dest->persistconns, 0);
 883         atomic_set(&dest->refcnt, 1);
 884
 885         INIT_LIST_HEAD(&dest->d_list);
 886         spin_lock_init(&dest->dst_lock);
 887         spin_lock_init(&dest->stats.lock);
 888         __ip_vs_update_dest(svc, dest, udest, 1);
 889
 890         *dest_p = dest;
 891
 892         LeaveFunction(2);
 893         return 0;
 894
 895 err_alloc:
 896         kfree(dest);
 897         return -ENOMEM;
 898 }
 899
 900
 901 /*
 902  *      Add a destination into an existing service
 903  */
 904 static int
 905 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 906 {
 907         struct ip_vs_dest *dest;
 908         union nf_inet_addr daddr;
 909         __be16 dport = udest->port;
 910         int ret;
 911
 912         EnterFunction(2);
 913
 914         if (udest->weight < 0) {
 915                 pr_err("%s(): server weight less than zero\n", __func__);
 916                 return -ERANGE;
 917         }
 918
 919         if (udest->l_threshold > udest->u_threshold) {
 920                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 921                         __func__);
 922                 return -ERANGE;
 923         }
 924
 925         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 926
 927         /*
 928          * Check if the dest already exists in the list
 929          */
 930         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 931
 932         if (dest != NULL) {
 933                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 934                 return -EEXIST;
 935         }
 936
 937         /*
 938          * Check if the dest already exists in the trash and
 939          * is from the same service
 940          */
 941         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 942
 943         if (dest != NULL) {
 944                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 945                               "dest->refcnt=%d, service %u/%s:%u\n",
 946                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 947                               atomic_read(&dest->refcnt),
 948                               dest->vfwmark,
 949                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 950                               ntohs(dest->vport));
 951
 952                 /*
 953                  * Get the destination from the trash
 954                  */
 955                 list_del(&dest->n_list);
 956
 957                 __ip_vs_update_dest(svc, dest, udest, 1);
 958                 ret = 0;
 959         } else {
 960                 /*
 961                  * Allocate and initialize the dest structure
 962                  */
 963                 ret = ip_vs_new_dest(svc, udest, &dest);
 964         }
 965         LeaveFunction(2);
 966
 967         return ret;
 968 }
 969
 970
 971 /*
 972  *      Edit a destination in the given service
 973  */
 974 static int
 975 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 976 {
 977         struct ip_vs_dest *dest;
 978         union nf_inet_addr daddr;
 979         __be16 dport = udest->port;
 980
 981         EnterFunction(2);
 982
 983         if (udest->weight < 0) {
 984                 pr_err("%s(): server weight less than zero\n", __func__);
 985                 return -ERANGE;
 986         }
 987
 988         if (udest->l_threshold > udest->u_threshold) {
 989                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 990                         __func__);
 991                 return -ERANGE;
 992         }
 993
 994         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 995
 996         /*
 997          *  Lookup the destination list
 998          */
 999         dest = ip_vs_lookup_dest(svc, &daddr, dport);
1000
1001         if (dest == NULL) {
1002                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1003                 return -ENOENT;
1004         }
1005
1006         __ip_vs_update_dest(svc, dest, udest, 0);
1007         LeaveFunction(2);
1008
1009         return 0;
1010 }
1011
1012
1013 /*
1014  *      Delete a destination (must be already unlinked from the service)
1015  */
1016 static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1017 {
1018         struct netns_ipvs *ipvs = net_ipvs(net);
1019
1020         ip_vs_stop_estimator(net, &dest->stats);
1021
1022         /*
1023          *  Remove it from the d-linked list with the real services.
1024          */
1025         write_lock_bh(&ipvs->rs_lock);
1026         ip_vs_rs_unhash(dest);
1027         write_unlock_bh(&ipvs->rs_lock);
1028
1029         /*
1030          *  Decrease the refcnt of the dest, and free the dest
1031          *  if nobody refers to it (refcnt=0). Otherwise, throw
1032          *  the destination into the trash.
1033          */
1034         if (atomic_dec_and_test(&dest->refcnt)) {
1035                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1036                               dest->vfwmark,
1037                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1038                               ntohs(dest->port));
1039                 ip_vs_dst_reset(dest);
1040                 /* simply decrease svc->refcnt here, let the caller check
1041                    and release the service if nobody refers to it.
1042                    Only user context can release destination and service,
1043                    and only one user context can update virtual service at a
1044                    time, so the operation here is OK */
1045                 atomic_dec(&dest->svc->refcnt);
1046                 free_percpu(dest->stats.cpustats);
1047                 kfree(dest);
1048         } else {
1049                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1050                               "dest->refcnt=%d\n",
1051                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1052                               ntohs(dest->port),
1053                               atomic_read(&dest->refcnt));
1054                 list_add(&dest->n_list, &ipvs->dest_trash);
1055                 atomic_inc(&dest->refcnt);
1056         }
1057 }
1058
1059
1060 /*
1061  *      Unlink a destination from the given service
1062  */
1063 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1064                                 struct ip_vs_dest *dest,
1065                                 int svcupd)
1066 {
1067         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1068
1069         /*
1070          *  Remove it from the d-linked destination list.
1071          */
1072         list_del(&dest->n_list);
1073         svc->num_dests--;
1074
1075         /*
1076          *  Call the update_service function of its scheduler
1077          */
1078         if (svcupd && svc->scheduler->update_service)
1079                         svc->scheduler->update_service(svc);
1080 }
1081
1082
1083 /*
1084  *      Delete a destination server in the given service
1085  */
1086 static int
1087 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1088 {
1089         struct ip_vs_dest *dest;
1090         __be16 dport = udest->port;
1091
1092         EnterFunction(2);
1093
1094         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1095
1096         if (dest == NULL) {
1097                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1098                 return -ENOENT;
1099         }
1100
1101         write_lock_bh(&__ip_vs_svc_lock);
1102
1103         /*
1104          *      Wait until all other svc users go away.
1105          */
1106         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1107
1108         /*
1109          *      Unlink dest from the service
1110          */
1111         __ip_vs_unlink_dest(svc, dest, 1);
1112
1113         write_unlock_bh(&__ip_vs_svc_lock);
1114
1115         /*
1116          *      Delete the destination
1117          */
1118         __ip_vs_del_dest(svc->net, dest);
1119
1120         LeaveFunction(2);
1121
1122         return 0;
1123 }
1124
1125
1126 /*
1127  *      Add a service into the service hash table
1128  */
1129 static int
1130 ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
1131                   struct ip_vs_service **svc_p)
1132 {
1133         int ret = 0;
1134         struct ip_vs_scheduler *sched = NULL;
1135         struct ip_vs_pe *pe = NULL;
1136         struct ip_vs_service *svc = NULL;
1137         struct netns_ipvs *ipvs = net_ipvs(net);
1138
1139         /* increase the module use count */
1140         ip_vs_use_count_inc();
1141
1142         /* Lookup the scheduler by 'u->sched_name' */
1143         sched = ip_vs_scheduler_get(u->sched_name);
1144         if (sched == NULL) {
1145                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1146                 ret = -ENOENT;
1147                 goto out_err;
1148         }
1149
1150         if (u->pe_name && *u->pe_name) {
1151                 pe = ip_vs_pe_getbyname(u->pe_name);
1152                 if (pe == NULL) {
1153                         pr_info("persistence engine module ip_vs_pe_%s "
1154                                 "not found\n", u->pe_name);
1155                         ret = -ENOENT;
1156                         goto out_err;
1157                 }
1158         }
1159
1160 #ifdef CONFIG_IP_VS_IPV6
1161         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1162                 ret = -EINVAL;
1163                 goto out_err;
1164         }
1165 #endif
1166
1167         svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1168         if (svc == NULL) {
1169                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1170                 ret = -ENOMEM;
1171                 goto out_err;
1172         }
1173         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1174         if (!svc->stats.cpustats)
1175                 goto out_err;
1176
1177         /* I'm the first user of the service */
1178         atomic_set(&svc->usecnt, 0);
1179         atomic_set(&svc->refcnt, 0);
1180
1181         svc->af = u->af;
1182         svc->protocol = u->protocol;
1183         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1184         svc->port = u->port;
1185         svc->fwmark = u->fwmark;
1186         svc->flags = u->flags;
1187         svc->timeout = u->timeout * HZ;
1188         svc->netmask = u->netmask;
1189         svc->net = net;
1190
1191         INIT_LIST_HEAD(&svc->destinations);
1192         rwlock_init(&svc->sched_lock);
1193         spin_lock_init(&svc->stats.lock);
1194
1195         /* Bind the scheduler */
1196         ret = ip_vs_bind_scheduler(svc, sched);
1197         if (ret)
1198                 goto out_err;
1199         sched = NULL;
1200
1201         /* Bind the ct retriever */
1202         ip_vs_bind_pe(svc, pe);
1203         pe = NULL;
1204
1205         /* Update the virtual service counters */
1206         if (svc->port == FTPPORT)
1207                 atomic_inc(&ipvs->ftpsvc_counter);
1208         else if (svc->port == 0)
1209                 atomic_inc(&ipvs->nullsvc_counter);
1210
1211         ip_vs_start_estimator(net, &svc->stats);
1212
1213         /* Count only IPv4 services for old get/setsockopt interface */
1214         if (svc->af == AF_INET)
1215                 ipvs->num_services++;
1216
1217         /* Hash the service into the service table */
1218         write_lock_bh(&__ip_vs_svc_lock);
1219         ip_vs_svc_hash(svc);
1220         write_unlock_bh(&__ip_vs_svc_lock);
1221
1222         *svc_p = svc;
1223         /* Now there is a service - full throttle */
1224         ipvs->enable = 1;
1225         return 0;
1226
1227
1228  out_err:
1229         if (svc != NULL) {
1230                 ip_vs_unbind_scheduler(svc);
1231                 if (svc->inc) {
1232                         local_bh_disable();
1233                         ip_vs_app_inc_put(svc->inc);
1234                         local_bh_enable();
1235                 }
1236                 if (svc->stats.cpustats)
1237                         free_percpu(svc->stats.cpustats);
1238                 kfree(svc);
1239         }
1240         ip_vs_scheduler_put(sched);
1241         ip_vs_pe_put(pe);
1242
1243         /* decrease the module use count */
1244         ip_vs_use_count_dec();
1245
1246         return ret;
1247 }
1248
1249
1250 /*
1251  *      Edit a service and bind it with a new scheduler
1252  */
1253 static int
1254 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1255 {
1256         struct ip_vs_scheduler *sched, *old_sched;
1257         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1258         int ret = 0;
1259
1260         /*
1261          * Lookup the scheduler, by 'u->sched_name'
1262          */
1263         sched = ip_vs_scheduler_get(u->sched_name);
1264         if (sched == NULL) {
1265                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1266                 return -ENOENT;
1267         }
1268         old_sched = sched;
1269
1270         if (u->pe_name && *u->pe_name) {
1271                 pe = ip_vs_pe_getbyname(u->pe_name);
1272                 if (pe == NULL) {
1273                         pr_info("persistence engine module ip_vs_pe_%s "
1274                                 "not found\n", u->pe_name);
1275                         ret = -ENOENT;
1276                         goto out;
1277                 }
1278                 old_pe = pe;
1279         }
1280
1281 #ifdef CONFIG_IP_VS_IPV6
1282         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1283                 ret = -EINVAL;
1284                 goto out;
1285         }
1286 #endif
1287
1288         write_lock_bh(&__ip_vs_svc_lock);
1289
1290         /*
1291          * Wait until all other svc users go away.
1292          */
1293         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1294
1295         /*
1296          * Set the flags and timeout value
1297          */
1298         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1299         svc->timeout = u->timeout * HZ;
1300         svc->netmask = u->netmask;
1301
1302         old_sched = svc->scheduler;
1303         if (sched != old_sched) {
1304                 /*
1305                  * Unbind the old scheduler
1306                  */
1307                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1308                         old_sched = sched;
1309                         goto out_unlock;
1310                 }
1311
1312                 /*
1313                  * Bind the new scheduler
1314                  */
1315                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1316                         /*
1317                          * If ip_vs_bind_scheduler fails, restore the old
1318                          * scheduler.
1319                          * The main reason of failure is out of memory.
1320                          *
1321                          * The question is if the old scheduler can be
1322                          * restored all the time. TODO: if it cannot be
1323                          * restored some time, we must delete the service,
1324                          * otherwise the system may crash.
1325                          */
1326                         ip_vs_bind_scheduler(svc, old_sched);
1327                         old_sched = sched;
1328                         goto out_unlock;
1329                 }
1330         }
1331
1332         old_pe = svc->pe;
1333         if (pe != old_pe) {
1334                 ip_vs_unbind_pe(svc);
1335                 ip_vs_bind_pe(svc, pe);
1336         }
1337
1338 out_unlock:
1339         write_unlock_bh(&__ip_vs_svc_lock);
1340 out:
1341         ip_vs_scheduler_put(old_sched);
1342         ip_vs_pe_put(old_pe);
1343         return ret;
1344 }
1345
1346
1347 /*
1348  *      Delete a service from the service list
1349  *      - The service must be unlinked, unlocked and not referenced!
1350  *      - We are called under _bh lock
1351  */
1352 static void __ip_vs_del_service(struct ip_vs_service *svc)
1353 {
1354         struct ip_vs_dest *dest, *nxt;
1355         struct ip_vs_scheduler *old_sched;
1356         struct ip_vs_pe *old_pe;
1357         struct netns_ipvs *ipvs = net_ipvs(svc->net);
1358
1359         pr_info("%s: enter\n", __func__);
1360
1361         /* Count only IPv4 services for old get/setsockopt interface */
1362         if (svc->af == AF_INET)
1363                 ipvs->num_services--;
1364
1365         ip_vs_stop_estimator(svc->net, &svc->stats);
1366
1367         /* Unbind scheduler */
1368         old_sched = svc->scheduler;
1369         ip_vs_unbind_scheduler(svc);
1370         ip_vs_scheduler_put(old_sched);
1371
1372         /* Unbind persistence engine */
1373         old_pe = svc->pe;
1374         ip_vs_unbind_pe(svc);
1375         ip_vs_pe_put(old_pe);
1376
1377         /* Unbind app inc */
1378         if (svc->inc) {
1379                 ip_vs_app_inc_put(svc->inc);
1380                 svc->inc = NULL;
1381         }
1382
1383         /*
1384          *    Unlink the whole destination list
1385          */
1386         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1387                 __ip_vs_unlink_dest(svc, dest, 0);
1388                 __ip_vs_del_dest(svc->net, dest);
1389         }
1390
1391         /*
1392          *    Update the virtual service counters
1393          */
1394         if (svc->port == FTPPORT)
1395                 atomic_dec(&ipvs->ftpsvc_counter);
1396         else if (svc->port == 0)
1397                 atomic_dec(&ipvs->nullsvc_counter);
1398
1399         /*
1400          *    Free the service if nobody refers to it
1401          */
1402         if (atomic_read(&svc->refcnt) == 0) {
1403                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1404                               svc->fwmark,
1405                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
1406                               ntohs(svc->port), atomic_read(&svc->usecnt));
1407                 free_percpu(svc->stats.cpustats);
1408                 kfree(svc);
1409         }
1410
1411         /* decrease the module use count */
1412         ip_vs_use_count_dec();
1413 }
1414
1415 /*
1416  * Unlink a service from list and try to delete it if its refcnt reached 0
1417  */
1418 static void ip_vs_unlink_service(struct ip_vs_service *svc)
1419 {
1420         /*
1421          * Unhash it from the service table
1422          */
1423         write_lock_bh(&__ip_vs_svc_lock);
1424
1425         ip_vs_svc_unhash(svc);
1426
1427         /*
1428          * Wait until all the svc users go away.
1429          */
1430         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1431
1432         __ip_vs_del_service(svc);
1433
1434         write_unlock_bh(&__ip_vs_svc_lock);
1435 }
1436
1437 /*
1438  *      Delete a service from the service list
1439  */
1440 static int ip_vs_del_service(struct ip_vs_service *svc)
1441 {
1442         if (svc == NULL)
1443                 return -EEXIST;
1444         ip_vs_unlink_service(svc);
1445
1446         return 0;
1447 }
1448
1449
1450 /*
1451  *      Flush all the virtual services
1452  */
1453 static int ip_vs_flush(struct net *net)
1454 {
1455         int idx;
1456         struct ip_vs_service *svc, *nxt;
1457
1458         /*
1459          * Flush the service table hashed by <netns,protocol,addr,port>
1460          */
1461         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1462                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1463                                          s_list) {
1464                         if (net_eq(svc->net, net))
1465                                 ip_vs_unlink_service(svc);
1466                 }
1467         }
1468
1469         /*
1470          * Flush the service table hashed by fwmark
1471          */
1472         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1473                 list_for_each_entry_safe(svc, nxt,
1474                                          &ip_vs_svc_fwm_table[idx], f_list) {
1475                         if (net_eq(svc->net, net))
1476                                 ip_vs_unlink_service(svc);
1477                 }
1478         }
1479
1480         return 0;
1481 }
1482
1483 /*
1484  *      Delete service by {netns} in the service table.
1485  *      Called by __ip_vs_cleanup()
1486  */
1487 void ip_vs_service_net_cleanup(struct net *net)
1488 {
1489         EnterFunction(2);
1490         /* Check for "full" addressed entries */
1491         mutex_lock(&__ip_vs_mutex);
1492         ip_vs_flush(net);
1493         mutex_unlock(&__ip_vs_mutex);
1494         LeaveFunction(2);
1495 }
1496 /*
1497  * Release dst hold by dst_cache
1498  */
1499 static inline void
1500 __ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1501 {
1502         spin_lock_bh(&dest->dst_lock);
1503         if (dest->dst_cache && dest->dst_cache->dev == dev) {
1504                 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1505                               dev->name,
1506                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1507                               ntohs(dest->port),
1508                               atomic_read(&dest->refcnt));
1509                 ip_vs_dst_reset(dest);
1510         }
1511         spin_unlock_bh(&dest->dst_lock);
1512
1513 }
1514 /*
1515  * Netdev event receiver
1516  * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1517  * a device that is "unregister" it must be released.
1518  */
1519 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1520                             void *ptr)
1521 {
1522         struct net_device *dev = ptr;
1523         struct net *net = dev_net(dev);
1524         struct netns_ipvs *ipvs = net_ipvs(net);
1525         struct ip_vs_service *svc;
1526         struct ip_vs_dest *dest;
1527         unsigned int idx;
1528
1529         if (event != NETDEV_UNREGISTER || !ipvs)
1530                 return NOTIFY_DONE;
1531         IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1532         EnterFunction(2);
1533         mutex_lock(&__ip_vs_mutex);
1534         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1535                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1536                         if (net_eq(svc->net, net)) {
1537                                 list_for_each_entry(dest, &svc->destinations,
1538                                                     n_list) {
1539                                         __ip_vs_dev_reset(dest, dev);
1540                                 }
1541                         }
1542                 }
1543
1544                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1545                         if (net_eq(svc->net, net)) {
1546                                 list_for_each_entry(dest, &svc->destinations,
1547                                                     n_list) {
1548                                         __ip_vs_dev_reset(dest, dev);
1549                                 }
1550                         }
1551
1552                 }
1553         }
1554
1555         list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
1556                 __ip_vs_dev_reset(dest, dev);
1557         }
1558         mutex_unlock(&__ip_vs_mutex);
1559         LeaveFunction(2);
1560         return NOTIFY_DONE;
1561 }
1562
1563 /*
1564  *      Zero counters in a service or all services
1565  */
1566 static int ip_vs_zero_service(struct ip_vs_service *svc)
1567 {
1568         struct ip_vs_dest *dest;
1569
1570         write_lock_bh(&__ip_vs_svc_lock);
1571         list_for_each_entry(dest, &svc->destinations, n_list) {
1572                 ip_vs_zero_stats(&dest->stats);
1573         }
1574         ip_vs_zero_stats(&svc->stats);
1575         write_unlock_bh(&__ip_vs_svc_lock);
1576         return 0;
1577 }
1578
1579 static int ip_vs_zero_all(struct net *net)
1580 {
1581         int idx;
1582         struct ip_vs_service *svc;
1583
1584         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1585                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1586                         if (net_eq(svc->net, net))
1587                                 ip_vs_zero_service(svc);
1588                 }
1589         }
1590
1591         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1592                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1593                         if (net_eq(svc->net, net))
1594                                 ip_vs_zero_service(svc);
1595                 }
1596         }
1597
1598         ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1599         return 0;
1600 }
1601
1602 #ifdef CONFIG_SYSCTL
1603
1604 static int zero;
1605 static int three = 3;
1606
1607 static int
1608 proc_do_defense_mode(ctl_table *table, int write,
1609                      void __user *buffer, size_t *lenp, loff_t *ppos)
1610 {
1611         struct net *net = current->nsproxy->net_ns;
1612         int *valp = table->data;
1613         int val = *valp;
1614         int rc;
1615
1616         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1617         if (write && (*valp != val)) {
1618                 if ((*valp < 0) || (*valp > 3)) {
1619                         /* Restore the correct value */
1620                         *valp = val;
1621                 } else {
1622                         update_defense_level(net_ipvs(net));
1623                 }
1624         }
1625         return rc;
1626 }
1627
1628 static int
1629 proc_do_sync_threshold(ctl_table *table, int write,
1630                        void __user *buffer, size_t *lenp, loff_t *ppos)
1631 {
1632         int *valp = table->data;
1633         int val[2];
1634         int rc;
1635
1636         /* backup the value first */
1637         memcpy(val, valp, sizeof(val));
1638
1639         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1640         if (write && (valp[0] < 0 || valp[1] < 0 ||
1641             (valp[0] >= valp[1] && valp[1]))) {
1642                 /* Restore the correct value */
1643                 memcpy(valp, val, sizeof(val));
1644         }
1645         return rc;
1646 }
1647
1648 static int
1649 proc_do_sync_mode(ctl_table *table, int write,
1650                      void __user *buffer, size_t *lenp, loff_t *ppos)
1651 {
1652         int *valp = table->data;
1653         int val = *valp;
1654         int rc;
1655
1656         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1657         if (write && (*valp != val)) {
1658                 if ((*valp < 0) || (*valp > 1)) {
1659                         /* Restore the correct value */
1660                         *valp = val;
1661                 }
1662         }
1663         return rc;
1664 }
1665
1666 static int
1667 proc_do_sync_ports(ctl_table *table, int write,
1668                    void __user *buffer, size_t *lenp, loff_t *ppos)
1669 {
1670         int *valp = table->data;
1671         int val = *valp;
1672         int rc;
1673
1674         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1675         if (write && (*valp != val)) {
1676                 if (*valp < 1 || !is_power_of_2(*valp)) {
1677                         /* Restore the correct value */
1678                         *valp = val;
1679                 }
1680         }
1681         return rc;
1682 }
1683
1684 /*
1685  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1686  *      Do not change order or insert new entries without
1687  *      align with netns init in ip_vs_control_net_init()
1688  */
1689
1690 static struct ctl_table vs_vars[] = {
1691         {
1692                 .procname       = "amemthresh",
1693                 .maxlen         = sizeof(int),
1694                 .mode           = 0644,
1695                 .proc_handler   = proc_dointvec,
1696         },
1697         {
1698                 .procname       = "am_droprate",
1699                 .maxlen         = sizeof(int),
1700                 .mode           = 0644,
1701                 .proc_handler   = proc_dointvec,
1702         },
1703         {
1704                 .procname       = "drop_entry",
1705                 .maxlen         = sizeof(int),
1706                 .mode           = 0644,
1707                 .proc_handler   = proc_do_defense_mode,
1708         },
1709         {
1710                 .procname       = "drop_packet",
1711                 .maxlen         = sizeof(int),
1712                 .mode           = 0644,
1713                 .proc_handler   = proc_do_defense_mode,
1714         },
1715 #ifdef CONFIG_IP_VS_NFCT
1716         {
1717                 .procname       = "conntrack",
1718                 .maxlen         = sizeof(int),
1719                 .mode           = 0644,
1720                 .proc_handler   = &proc_dointvec,
1721         },
1722 #endif
1723         {
1724                 .procname       = "secure_tcp",
1725                 .maxlen         = sizeof(int),
1726                 .mode           = 0644,
1727                 .proc_handler   = proc_do_defense_mode,
1728         },
1729         {
1730                 .procname       = "snat_reroute",
1731                 .maxlen         = sizeof(int),
1732                 .mode           = 0644,
1733                 .proc_handler   = &proc_dointvec,
1734         },
1735         {
1736                 .procname       = "sync_version",
1737                 .maxlen         = sizeof(int),
1738                 .mode           = 0644,
1739                 .proc_handler   = &proc_do_sync_mode,
1740         },
1741         {
1742                 .procname       = "sync_ports",
1743                 .maxlen         = sizeof(int),
1744                 .mode           = 0644,
1745                 .proc_handler   = &proc_do_sync_ports,
1746         },
1747         {
1748                 .procname       = "sync_qlen_max",
1749                 .maxlen         = sizeof(int),
1750                 .mode           = 0644,
1751                 .proc_handler   = proc_dointvec,
1752         },
1753         {
1754                 .procname       = "sync_sock_size",
1755                 .maxlen         = sizeof(int),
1756                 .mode           = 0644,
1757                 .proc_handler   = proc_dointvec,
1758         },
1759         {
1760                 .procname       = "cache_bypass",
1761                 .maxlen         = sizeof(int),
1762                 .mode           = 0644,
1763                 .proc_handler   = proc_dointvec,
1764         },
1765         {
1766                 .procname       = "expire_nodest_conn",
1767                 .maxlen         = sizeof(int),
1768                 .mode           = 0644,
1769                 .proc_handler   = proc_dointvec,
1770         },
1771         {
1772                 .procname       = "expire_quiescent_template",
1773                 .maxlen         = sizeof(int),
1774                 .mode           = 0644,
1775                 .proc_handler   = proc_dointvec,
1776         },
1777         {
1778                 .procname       = "sync_threshold",
1779                 .maxlen         =
1780                         sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1781                 .mode           = 0644,
1782                 .proc_handler   = proc_do_sync_threshold,
1783         },
1784         {
1785                 .procname       = "sync_refresh_period",
1786                 .maxlen         = sizeof(int),
1787                 .mode           = 0644,
1788                 .proc_handler   = proc_dointvec_jiffies,
1789         },
1790         {
1791                 .procname       = "sync_retries",
1792                 .maxlen         = sizeof(int),
1793                 .mode           = 0644,
1794                 .proc_handler   = proc_dointvec_minmax,
1795                 .extra1         = &zero,
1796                 .extra2         = &three,
1797         },
1798         {
1799                 .procname       = "nat_icmp_send",
1800                 .maxlen         = sizeof(int),
1801                 .mode           = 0644,
1802                 .proc_handler   = proc_dointvec,
1803         },
1804         {
1805                 .procname       = "pmtu_disc",
1806                 .maxlen         = sizeof(int),
1807                 .mode           = 0644,
1808                 .proc_handler   = proc_dointvec,
1809         },
1810 #ifdef CONFIG_IP_VS_DEBUG
1811         {
1812                 .procname       = "debug_level",
1813                 .data           = &sysctl_ip_vs_debug_level,
1814                 .maxlen         = sizeof(int),
1815                 .mode           = 0644,
1816                 .proc_handler   = proc_dointvec,
1817         },
1818 #endif
1819 #if 0
1820         {
1821                 .procname       = "timeout_established",
1822                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1823                 .maxlen         = sizeof(int),
1824                 .mode           = 0644,
1825                 .proc_handler   = proc_dointvec_jiffies,
1826         },
1827         {
1828                 .procname       = "timeout_synsent",
1829                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1830                 .maxlen         = sizeof(int),
1831                 .mode           = 0644,
1832                 .proc_handler   = proc_dointvec_jiffies,
1833         },
1834         {
1835                 .procname       = "timeout_synrecv",
1836                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1837                 .maxlen         = sizeof(int),
1838                 .mode           = 0644,
1839                 .proc_handler   = proc_dointvec_jiffies,
1840         },
1841         {
1842                 .procname       = "timeout_finwait",
1843                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1844                 .maxlen         = sizeof(int),
1845                 .mode           = 0644,
1846                 .proc_handler   = proc_dointvec_jiffies,
1847         },
1848         {
1849                 .procname       = "timeout_timewait",
1850                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1851                 .maxlen         = sizeof(int),
1852                 .mode           = 0644,
1853                 .proc_handler   = proc_dointvec_jiffies,
1854         },
1855         {
1856                 .procname       = "timeout_close",
1857                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1858                 .maxlen         = sizeof(int),
1859                 .mode           = 0644,
1860                 .proc_handler   = proc_dointvec_jiffies,
1861         },
1862         {
1863                 .procname       = "timeout_closewait",
1864                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1865                 .maxlen         = sizeof(int),
1866                 .mode           = 0644,
1867                 .proc_handler   = proc_dointvec_jiffies,
1868         },
1869         {
1870                 .procname       = "timeout_lastack",
1871                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1872                 .maxlen         = sizeof(int),
1873                 .mode           = 0644,
1874                 .proc_handler   = proc_dointvec_jiffies,
1875         },
1876         {
1877                 .procname       = "timeout_listen",
1878                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1879                 .maxlen         = sizeof(int),
1880                 .mode           = 0644,
1881                 .proc_handler   = proc_dointvec_jiffies,
1882         },
1883         {
1884                 .procname       = "timeout_synack",
1885                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1886                 .maxlen         = sizeof(int),
1887                 .mode           = 0644,
1888                 .proc_handler   = proc_dointvec_jiffies,
1889         },
1890         {
1891                 .procname       = "timeout_udp",
1892                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1893                 .maxlen         = sizeof(int),
1894                 .mode           = 0644,
1895                 .proc_handler   = proc_dointvec_jiffies,
1896         },
1897         {
1898                 .procname       = "timeout_icmp",
1899                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1900                 .maxlen         = sizeof(int),
1901                 .mode           = 0644,
1902                 .proc_handler   = proc_dointvec_jiffies,
1903         },
1904 #endif
1905         { }
1906 };
1907
1908 #endif
1909
1910 #ifdef CONFIG_PROC_FS
1911
1912 struct ip_vs_iter {
1913         struct seq_net_private p;  /* Do not move this, netns depends upon it*/
1914         struct list_head *table;
1915         int bucket;
1916 };
1917
1918 /*
1919  *      Write the contents of the VS rule table to a PROCfs file.
1920  *      (It is kept just for backward compatibility)
1921  */
1922 static inline const char *ip_vs_fwd_name(unsigned int flags)
1923 {
1924         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1925         case IP_VS_CONN_F_LOCALNODE:
1926                 return "Local";
1927         case IP_VS_CONN_F_TUNNEL:
1928                 return "Tunnel";
1929         case IP_VS_CONN_F_DROUTE:
1930                 return "Route";
1931         default:
1932                 return "Masq";
1933         }
1934 }
1935
1936
1937 /* Get the Nth entry in the two lists */
1938 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1939 {
1940         struct net *net = seq_file_net(seq);
1941         struct ip_vs_iter *iter = seq->private;
1942         int idx;
1943         struct ip_vs_service *svc;
1944
1945         /* look in hash by protocol */
1946         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1947                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1948                         if (net_eq(svc->net, net) && pos-- == 0) {
1949                                 iter->table = ip_vs_svc_table;
1950                                 iter->bucket = idx;
1951                                 return svc;
1952                         }
1953                 }
1954         }
1955
1956         /* keep looking in fwmark */
1957         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1958                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1959                         if (net_eq(svc->net, net) && pos-- == 0) {
1960                                 iter->table = ip_vs_svc_fwm_table;
1961                                 iter->bucket = idx;
1962                                 return svc;
1963                         }
1964                 }
1965         }
1966
1967         return NULL;
1968 }
1969
1970 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1971 __acquires(__ip_vs_svc_lock)
1972 {
1973
1974         read_lock_bh(&__ip_vs_svc_lock);
1975         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1976 }
1977
1978
1979 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1980 {
1981         struct list_head *e;
1982         struct ip_vs_iter *iter;
1983         struct ip_vs_service *svc;
1984
1985         ++*pos;
1986         if (v == SEQ_START_TOKEN)
1987                 return ip_vs_info_array(seq,0);
1988
1989         svc = v;
1990         iter = seq->private;
1991
1992         if (iter->table == ip_vs_svc_table) {
1993                 /* next service in table hashed by protocol */
1994                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1995                         return list_entry(e, struct ip_vs_service, s_list);
1996
1997
1998                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1999                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
2000                                             s_list) {
2001                                 return svc;
2002                         }
2003                 }
2004
2005                 iter->table = ip_vs_svc_fwm_table;
2006                 iter->bucket = -1;
2007                 goto scan_fwmark;
2008         }
2009
2010         /* next service in hashed by fwmark */
2011         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
2012                 return list_entry(e, struct ip_vs_service, f_list);
2013
2014  scan_fwmark:
2015         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2016                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
2017                                     f_list)
2018                         return svc;
2019         }
2020
2021         return NULL;
2022 }
2023
2024 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
2025 __releases(__ip_vs_svc_lock)
2026 {
2027         read_unlock_bh(&__ip_vs_svc_lock);
2028 }
2029
2030
2031 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
2032 {
2033         if (v == SEQ_START_TOKEN) {
2034                 seq_printf(seq,
2035                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
2036                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2037                 seq_puts(seq,
2038                          "Prot LocalAddress:Port Scheduler Flags\n");
2039                 seq_puts(seq,
2040                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
2041         } else {
2042                 const struct ip_vs_service *svc = v;
2043                 const struct ip_vs_iter *iter = seq->private;
2044                 const struct ip_vs_dest *dest;
2045
2046                 if (iter->table == ip_vs_svc_table) {
2047 #ifdef CONFIG_IP_VS_IPV6
2048                         if (svc->af == AF_INET6)
2049                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
2050                                            ip_vs_proto_name(svc->protocol),
2051                                            &svc->addr.in6,
2052                                            ntohs(svc->port),
2053                                            svc->scheduler->name);
2054                         else
2055 #endif
2056                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
2057                                            ip_vs_proto_name(svc->protocol),
2058                                            ntohl(svc->addr.ip),
2059                                            ntohs(svc->port),
2060                                            svc->scheduler->name,
2061                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2062                 } else {
2063                         seq_printf(seq, "FWM  %08X %s %s",
2064                                    svc->fwmark, svc->scheduler->name,
2065                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2066                 }
2067
2068                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2069                         seq_printf(seq, "persistent %d %08X\n",
2070                                 svc->timeout,
2071                                 ntohl(svc->netmask));
2072                 else
2073                         seq_putc(seq, '\n');
2074
2075                 list_for_each_entry(dest, &svc->destinations, n_list) {
2076 #ifdef CONFIG_IP_VS_IPV6
2077                         if (dest->af == AF_INET6)
2078                                 seq_printf(seq,
2079                                            "  -> [%pI6]:%04X"
2080                                            "      %-7s %-6d %-10d %-10d\n",
2081                                            &dest->addr.in6,
2082                                            ntohs(dest->port),
2083                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2084                                            atomic_read(&dest->weight),
2085                                            atomic_read(&dest->activeconns),
2086                                            atomic_read(&dest->inactconns));
2087                         else
2088 #endif
2089                                 seq_printf(seq,
2090                                            "  -> %08X:%04X      "
2091                                            "%-7s %-6d %-10d %-10d\n",
2092                                            ntohl(dest->addr.ip),
2093                                            ntohs(dest->port),
2094                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2095                                            atomic_read(&dest->weight),
2096                                            atomic_read(&dest->activeconns),
2097                                            atomic_read(&dest->inactconns));
2098
2099                 }
2100         }
2101         return 0;
2102 }
2103
2104 static const struct seq_operations ip_vs_info_seq_ops = {
2105         .start = ip_vs_info_seq_start,
2106         .next  = ip_vs_info_seq_next,
2107         .stop  = ip_vs_info_seq_stop,
2108         .show  = ip_vs_info_seq_show,
2109 };
2110
2111 static int ip_vs_info_open(struct inode *inode, struct file *file)
2112 {
2113         return seq_open_net(inode, file, &ip_vs_info_seq_ops,
2114                         sizeof(struct ip_vs_iter));
2115 }
2116
2117 static const struct file_operations ip_vs_info_fops = {
2118         .owner   = THIS_MODULE,
2119         .open    = ip_vs_info_open,
2120         .read    = seq_read,
2121         .llseek  = seq_lseek,
2122         .release = seq_release_net,
2123 };
2124
2125 static int ip_vs_stats_show(struct seq_file *seq, void *v)
2126 {
2127         struct net *net = seq_file_single_net(seq);
2128         struct ip_vs_stats_user show;
2129
2130 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2131         seq_puts(seq,
2132                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
2133         seq_printf(seq,
2134                    "   Conns  Packets  Packets            Bytes            Bytes\n");
2135
2136         ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2137         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2138                    show.inpkts, show.outpkts,
2139                    (unsigned long long) show.inbytes,
2140                    (unsigned long long) show.outbytes);
2141
2142 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2143         seq_puts(seq,
2144                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2145         seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2146                         show.cps, show.inpps, show.outpps,
2147                         show.inbps, show.outbps);
2148
2149         return 0;
2150 }
2151
2152 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2153 {
2154         return single_open_net(inode, file, ip_vs_stats_show);
2155 }
2156
2157 static const struct file_operations ip_vs_stats_fops = {
2158         .owner = THIS_MODULE,
2159         .open = ip_vs_stats_seq_open,
2160         .read = seq_read,
2161         .llseek = seq_lseek,
2162         .release = single_release_net,
2163 };
2164
2165 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2166 {
2167         struct net *net = seq_file_single_net(seq);
2168         struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2169         struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
2170         struct ip_vs_stats_user rates;
2171         int i;
2172
2173 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2174         seq_puts(seq,
2175                  "       Total Incoming Outgoing         Incoming         Outgoing\n");
2176         seq_printf(seq,
2177                    "CPU    Conns  Packets  Packets            Bytes            Bytes\n");
2178
2179         for_each_possible_cpu(i) {
2180                 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2181                 unsigned int start;
2182                 __u64 inbytes, outbytes;
2183
2184                 do {
2185                         start = u64_stats_fetch_begin_bh(&u->syncp);
2186                         inbytes = u->ustats.inbytes;
2187                         outbytes = u->ustats.outbytes;
2188                 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2189
2190                 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2191                            i, u->ustats.conns, u->ustats.inpkts,
2192                            u->ustats.outpkts, (__u64)inbytes,
2193                            (__u64)outbytes);
2194         }
2195
2196         spin_lock_bh(&tot_stats->lock);
2197
2198         seq_printf(seq, "  ~ %8X %8X %8X %16LX %16LX\n\n",
2199                    tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2200                    tot_stats->ustats.outpkts,
2201                    (unsigned long long) tot_stats->ustats.inbytes,
2202                    (unsigned long long) tot_stats->ustats.outbytes);
2203
2204         ip_vs_read_estimator(&rates, tot_stats);
2205
2206         spin_unlock_bh(&tot_stats->lock);
2207
2208 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2209         seq_puts(seq,
2210                    "     Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2211         seq_printf(seq, "    %8X %8X %8X %16X %16X\n",
2212                         rates.cps,
2213                         rates.inpps,
2214                         rates.outpps,
2215                         rates.inbps,
2216                         rates.outbps);
2217
2218         return 0;
2219 }
2220
2221 static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2222 {
2223         return single_open_net(inode, file, ip_vs_stats_percpu_show);
2224 }
2225
2226 static const struct file_operations ip_vs_stats_percpu_fops = {
2227         .owner = THIS_MODULE,
2228         .open = ip_vs_stats_percpu_seq_open,
2229         .read = seq_read,
2230         .llseek = seq_lseek,
2231         .release = single_release_net,
2232 };
2233 #endif
2234
2235 /*
2236  *      Set timeout values for tcp tcpfin udp in the timeout_table.
2237  */
2238 static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
2239 {
2240 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2241         struct ip_vs_proto_data *pd;
2242 #endif
2243
2244         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2245                   u->tcp_timeout,
2246                   u->tcp_fin_timeout,
2247                   u->udp_timeout);
2248
2249 #ifdef CONFIG_IP_VS_PROTO_TCP
2250         if (u->tcp_timeout) {
2251                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2252                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2253                         = u->tcp_timeout * HZ;
2254         }
2255
2256         if (u->tcp_fin_timeout) {
2257                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2258                 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2259                         = u->tcp_fin_timeout * HZ;
2260         }
2261 #endif
2262
2263 #ifdef CONFIG_IP_VS_PROTO_UDP
2264         if (u->udp_timeout) {
2265                 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2266                 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2267                         = u->udp_timeout * HZ;
2268         }
2269 #endif
2270         return 0;
2271 }
2272
2273
2274 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2275 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2276 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2277                                  sizeof(struct ip_vs_dest_user))
2278 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2279 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2280 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2281
2282 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2283         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2284         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2285         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2286         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2287         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2288         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2289         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2290         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2291         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2292         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2293         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2294 };
2295
2296 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2297                                   struct ip_vs_service_user *usvc_compat)
2298 {
2299         memset(usvc, 0, sizeof(*usvc));
2300
2301         usvc->af                = AF_INET;
2302         usvc->protocol          = usvc_compat->protocol;
2303         usvc->addr.ip           = usvc_compat->addr;
2304         usvc->port              = usvc_compat->port;
2305         usvc->fwmark            = usvc_compat->fwmark;
2306
2307         /* Deep copy of sched_name is not needed here */
2308         usvc->sched_name        = usvc_compat->sched_name;
2309
2310         usvc->flags             = usvc_compat->flags;
2311         usvc->timeout           = usvc_compat->timeout;
2312         usvc->netmask           = usvc_compat->netmask;
2313 }
2314
2315 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2316                                    struct ip_vs_dest_user *udest_compat)
2317 {
2318         memset(udest, 0, sizeof(*udest));
2319
2320         udest->addr.ip          = udest_compat->addr;
2321         udest->port             = udest_compat->port;
2322         udest->conn_flags       = udest_compat->conn_flags;
2323         udest->weight           = udest_compat->weight;
2324         udest->u_threshold      = udest_compat->u_threshold;
2325         udest->l_threshold      = udest_compat->l_threshold;
2326 }
2327
2328 static int
2329 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2330 {
2331         struct net *net = sock_net(sk);
2332         int ret;
2333         unsigned char arg[MAX_ARG_LEN];
2334         struct ip_vs_service_user *usvc_compat;
2335         struct ip_vs_service_user_kern usvc;
2336         struct ip_vs_service *svc;
2337         struct ip_vs_dest_user *udest_compat;
2338         struct ip_vs_dest_user_kern udest;
2339         struct netns_ipvs *ipvs = net_ipvs(net);
2340
2341         if (!capable(CAP_NET_ADMIN))
2342                 return -EPERM;
2343
2344         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2345                 return -EINVAL;
2346         if (len < 0 || len >  MAX_ARG_LEN)
2347                 return -EINVAL;
2348         if (len != set_arglen[SET_CMDID(cmd)]) {
2349                 pr_err("set_ctl: len %u != %u\n",
2350                        len, set_arglen[SET_CMDID(cmd)]);
2351                 return -EINVAL;
2352         }
2353
2354         if (copy_from_user(arg, user, len) != 0)
2355                 return -EFAULT;
2356
2357         /* increase the module use count */
2358         ip_vs_use_count_inc();
2359
2360         /* Handle daemons since they have another lock */
2361         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2362             cmd == IP_VS_SO_SET_STOPDAEMON) {
2363                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2364
2365                 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2366                         ret = -ERESTARTSYS;
2367                         goto out_dec;
2368                 }
2369                 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2370                         ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2371                                                 dm->syncid);
2372                 else
2373                         ret = stop_sync_thread(net, dm->state);
2374                 mutex_unlock(&ipvs->sync_mutex);
2375                 goto out_dec;
2376         }
2377
2378         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2379                 ret = -ERESTARTSYS;
2380                 goto out_dec;
2381         }
2382
2383         if (cmd == IP_VS_SO_SET_FLUSH) {
2384                 /* Flush the virtual service */
2385                 ret = ip_vs_flush(net);
2386                 goto out_unlock;
2387         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2388                 /* Set timeout values for (tcp tcpfin udp) */
2389                 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
2390                 goto out_unlock;
2391         }
2392
2393         usvc_compat = (struct ip_vs_service_user *)arg;
2394         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2395
2396         /* We only use the new structs internally, so copy userspace compat
2397          * structs to extended internal versions */
2398         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2399         ip_vs_copy_udest_compat(&udest, udest_compat);
2400
2401         if (cmd == IP_VS_SO_SET_ZERO) {
2402                 /* if no service address is set, zero counters in all */
2403                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2404                         ret = ip_vs_zero_all(net);
2405                         goto out_unlock;
2406                 }
2407         }
2408
2409         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2410         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2411             usvc.protocol != IPPROTO_SCTP) {
2412                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2413                        usvc.protocol, &usvc.addr.ip,
2414                        ntohs(usvc.port), usvc.sched_name);
2415                 ret = -EFAULT;
2416                 goto out_unlock;
2417         }
2418
2419         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2420         if (usvc.fwmark == 0)
2421                 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
2422                                            &usvc.addr, usvc.port);
2423         else
2424                 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
2425
2426         if (cmd != IP_VS_SO_SET_ADD
2427             && (svc == NULL || svc->protocol != usvc.protocol)) {
2428                 ret = -ESRCH;
2429                 goto out_unlock;
2430         }
2431
2432         switch (cmd) {
2433         case IP_VS_SO_SET_ADD:
2434                 if (svc != NULL)
2435                         ret = -EEXIST;
2436                 else
2437                         ret = ip_vs_add_service(net, &usvc, &svc);
2438                 break;
2439         case IP_VS_SO_SET_EDIT:
2440                 ret = ip_vs_edit_service(svc, &usvc);
2441                 break;
2442         case IP_VS_SO_SET_DEL:
2443                 ret = ip_vs_del_service(svc);
2444                 if (!ret)
2445                         goto out_unlock;
2446                 break;
2447         case IP_VS_SO_SET_ZERO:
2448                 ret = ip_vs_zero_service(svc);
2449                 break;
2450         case IP_VS_SO_SET_ADDDEST:
2451                 ret = ip_vs_add_dest(svc, &udest);
2452                 break;
2453         case IP_VS_SO_SET_EDITDEST:
2454                 ret = ip_vs_edit_dest(svc, &udest);
2455                 break;
2456         case IP_VS_SO_SET_DELDEST:
2457                 ret = ip_vs_del_dest(svc, &udest);
2458                 break;
2459         default:
2460                 ret = -EINVAL;
2461         }
2462
2463   out_unlock:
2464         mutex_unlock(&__ip_vs_mutex);
2465   out_dec:
2466         /* decrease the module use count */
2467         ip_vs_use_count_dec();
2468
2469         return ret;
2470 }
2471
2472
2473 static void
2474 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2475 {
2476         dst->protocol = src->protocol;
2477         dst->addr = src->addr.ip;
2478         dst->port = src->port;
2479         dst->fwmark = src->fwmark;
2480         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2481         dst->flags = src->flags;
2482         dst->timeout = src->timeout / HZ;
2483         dst->netmask = src->netmask;
2484         dst->num_dests = src->num_dests;
2485         ip_vs_copy_stats(&dst->stats, &src->stats);
2486 }
2487
2488 static inline int
2489 __ip_vs_get_service_entries(struct net *net,
2490                             const struct ip_vs_get_services *get,
2491                             struct ip_vs_get_services __user *uptr)
2492 {
2493         int idx, count=0;
2494         struct ip_vs_service *svc;
2495         struct ip_vs_service_entry entry;
2496         int ret = 0;
2497
2498         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2499                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2500                         /* Only expose IPv4 entries to old interface */
2501                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2502                                 continue;
2503
2504                         if (count >= get->num_services)
2505                                 goto out;
2506                         memset(&entry, 0, sizeof(entry));
2507                         ip_vs_copy_service(&entry, svc);
2508                         if (copy_to_user(&uptr->entrytable[count],
2509                                          &entry, sizeof(entry))) {
2510                                 ret = -EFAULT;
2511                                 goto out;
2512                         }
2513                         count++;
2514                 }
2515         }
2516
2517         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2518                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2519                         /* Only expose IPv4 entries to old interface */
2520                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2521                                 continue;
2522
2523                         if (count >= get->num_services)
2524                                 goto out;
2525                         memset(&entry, 0, sizeof(entry));
2526                         ip_vs_copy_service(&entry, svc);
2527                         if (copy_to_user(&uptr->entrytable[count],
2528                                          &entry, sizeof(entry))) {
2529                                 ret = -EFAULT;
2530                                 goto out;
2531                         }
2532                         count++;
2533                 }
2534         }
2535 out:
2536         return ret;
2537 }
2538
2539 static inline int
2540 __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
2541                          struct ip_vs_get_dests __user *uptr)
2542 {
2543         struct ip_vs_service *svc;
2544         union nf_inet_addr addr = { .ip = get->addr };
2545         int ret = 0;
2546
2547         if (get->fwmark)
2548                 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
2549         else
2550                 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
2551                                            get->port);
2552
2553         if (svc) {
2554                 int count = 0;
2555                 struct ip_vs_dest *dest;
2556                 struct ip_vs_dest_entry entry;
2557
2558                 list_for_each_entry(dest, &svc->destinations, n_list) {
2559                         if (count >= get->num_dests)
2560                                 break;
2561
2562                         entry.addr = dest->addr.ip;
2563                         entry.port = dest->port;
2564                         entry.conn_flags = atomic_read(&dest->conn_flags);
2565                         entry.weight = atomic_read(&dest->weight);
2566                         entry.u_threshold = dest->u_threshold;
2567                         entry.l_threshold = dest->l_threshold;
2568                         entry.activeconns = atomic_read(&dest->activeconns);
2569                         entry.inactconns = atomic_read(&dest->inactconns);
2570                         entry.persistconns = atomic_read(&dest->persistconns);
2571                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2572                         if (copy_to_user(&uptr->entrytable[count],
2573                                          &entry, sizeof(entry))) {
2574                                 ret = -EFAULT;
2575                                 break;
2576                         }
2577                         count++;
2578                 }
2579         } else
2580                 ret = -ESRCH;
2581         return ret;
2582 }
2583
2584 static inline void
2585 __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
2586 {
2587 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2588         struct ip_vs_proto_data *pd;
2589 #endif
2590
2591 #ifdef CONFIG_IP_VS_PROTO_TCP
2592         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2593         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2594         u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2595 #endif
2596 #ifdef CONFIG_IP_VS_PROTO_UDP
2597         pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2598         u->udp_timeout =
2599                         pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2600 #endif
2601 }
2602
2603
2604 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2605 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2606 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2607 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2608 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2609 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2610 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2611
2612 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2613         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2614         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2615         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2616         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2617         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2618         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2619         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2620 };
2621
2622 static int
2623 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2624 {
2625         unsigned char arg[128];
2626         int ret = 0;
2627         unsigned int copylen;
2628         struct net *net = sock_net(sk);
2629         struct netns_ipvs *ipvs = net_ipvs(net);
2630
2631         BUG_ON(!net);
2632         if (!capable(CAP_NET_ADMIN))
2633                 return -EPERM;
2634
2635         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2636                 return -EINVAL;
2637
2638         if (*len < get_arglen[GET_CMDID(cmd)]) {
2639                 pr_err("get_ctl: len %u < %u\n",
2640                        *len, get_arglen[GET_CMDID(cmd)]);
2641                 return -EINVAL;
2642         }
2643
2644         copylen = get_arglen[GET_CMDID(cmd)];
2645         if (copylen > 128)
2646                 return -EINVAL;
2647
2648         if (copy_from_user(arg, user, copylen) != 0)
2649                 return -EFAULT;
2650         /*
2651          * Handle daemons first since it has its own locking
2652          */
2653         if (cmd == IP_VS_SO_GET_DAEMON) {
2654                 struct ip_vs_daemon_user d[2];
2655
2656                 memset(&d, 0, sizeof(d));
2657                 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2658                         return -ERESTARTSYS;
2659
2660                 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2661                         d[0].state = IP_VS_STATE_MASTER;
2662                         strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2663                                 sizeof(d[0].mcast_ifn));
2664                         d[0].syncid = ipvs->master_syncid;
2665                 }
2666                 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2667                         d[1].state = IP_VS_STATE_BACKUP;
2668                         strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2669                                 sizeof(d[1].mcast_ifn));
2670                         d[1].syncid = ipvs->backup_syncid;
2671                 }
2672                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2673                         ret = -EFAULT;
2674                 mutex_unlock(&ipvs->sync_mutex);
2675                 return ret;
2676         }
2677
2678         if (mutex_lock_interruptible(&__ip_vs_mutex))
2679                 return -ERESTARTSYS;
2680
2681         switch (cmd) {
2682         case IP_VS_SO_GET_VERSION:
2683         {
2684                 char buf[64];
2685
2686                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2687                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2688                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2689                         ret = -EFAULT;
2690                         goto out;
2691                 }
2692                 *len = strlen(buf)+1;
2693         }
2694         break;
2695
2696         case IP_VS_SO_GET_INFO:
2697         {
2698                 struct ip_vs_getinfo info;
2699                 info.version = IP_VS_VERSION_CODE;
2700                 info.size = ip_vs_conn_tab_size;
2701                 info.num_services = ipvs->num_services;
2702                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2703                         ret = -EFAULT;
2704         }
2705         break;
2706
2707         case IP_VS_SO_GET_SERVICES:
2708         {
2709                 struct ip_vs_get_services *get;
2710                 int size;
2711
2712                 get = (struct ip_vs_get_services *)arg;
2713                 size = sizeof(*get) +
2714                         sizeof(struct ip_vs_service_entry) * get->num_services;
2715                 if (*len != size) {
2716                         pr_err("length: %u != %u\n", *len, size);
2717                         ret = -EINVAL;
2718                         goto out;
2719                 }
2720                 ret = __ip_vs_get_service_entries(net, get, user);
2721         }
2722         break;
2723
2724         case IP_VS_SO_GET_SERVICE:
2725         {
2726                 struct ip_vs_service_entry *entry;
2727                 struct ip_vs_service *svc;
2728                 union nf_inet_addr addr;
2729
2730                 entry = (struct ip_vs_service_entry *)arg;
2731                 addr.ip = entry->addr;
2732                 if (entry->fwmark)
2733                         svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
2734                 else
2735                         svc = __ip_vs_service_find(net, AF_INET,
2736                                                    entry->protocol, &addr,
2737                                                    entry->port);
2738                 if (svc) {
2739                         ip_vs_copy_service(entry, svc);
2740                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2741                                 ret = -EFAULT;
2742                 } else
2743                         ret = -ESRCH;
2744         }
2745         break;
2746
2747         case IP_VS_SO_GET_DESTS:
2748         {
2749                 struct ip_vs_get_dests *get;
2750                 int size;
2751
2752                 get = (struct ip_vs_get_dests *)arg;
2753                 size = sizeof(*get) +
2754                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2755                 if (*len != size) {
2756                         pr_err("length: %u != %u\n", *len, size);
2757                         ret = -EINVAL;
2758                         goto out;
2759                 }
2760                 ret = __ip_vs_get_dest_entries(net, get, user);
2761         }
2762         break;
2763
2764         case IP_VS_SO_GET_TIMEOUT:
2765         {
2766                 struct ip_vs_timeout_user t;
2767
2768                 __ip_vs_get_timeouts(net, &t);
2769                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2770                         ret = -EFAULT;
2771         }
2772         break;
2773
2774         default:
2775                 ret = -EINVAL;
2776         }
2777
2778 out:
2779         mutex_unlock(&__ip_vs_mutex);
2780         return ret;
2781 }
2782
2783
2784 static struct nf_sockopt_ops ip_vs_sockopts = {
2785         .pf             = PF_INET,
2786         .set_optmin     = IP_VS_BASE_CTL,
2787         .set_optmax     = IP_VS_SO_SET_MAX+1,
2788         .set            = do_ip_vs_set_ctl,
2789         .get_optmin     = IP_VS_BASE_CTL,
2790         .get_optmax     = IP_VS_SO_GET_MAX+1,
2791         .get            = do_ip_vs_get_ctl,
2792         .owner          = THIS_MODULE,
2793 };
2794
2795 /*
2796  * Generic Netlink interface
2797  */
2798
2799 /* IPVS genetlink family */
2800 static struct genl_family ip_vs_genl_family = {
2801         .id             = GENL_ID_GENERATE,
2802         .hdrsize        = 0,
2803         .name           = IPVS_GENL_NAME,
2804         .version        = IPVS_GENL_VERSION,
2805         .maxattr        = IPVS_CMD_MAX,
2806         .netnsok        = true,         /* Make ipvsadm to work on netns */
2807 };
2808
2809 /* Policy used for first-level command attributes */
2810 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2811         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2812         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2813         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2814         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2815         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2816         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2817 };
2818
2819 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2820 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2821         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2822         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2823                                             .len = IP_VS_IFNAME_MAXLEN },
2824         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2825 };
2826
2827 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2828 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2829         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2830         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2831         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2832                                             .len = sizeof(union nf_inet_addr) },
2833         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2834         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2835         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2836                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2837         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
2838                                             .len = IP_VS_PENAME_MAXLEN },
2839         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2840                                             .len = sizeof(struct ip_vs_flags) },
2841         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2842         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2843         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2844 };
2845
2846 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2847 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2848         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2849                                             .len = sizeof(union nf_inet_addr) },
2850         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2851         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2852         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2853         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2854         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2855         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2856         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2857         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2858         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2859 };
2860
2861 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2862                                  struct ip_vs_stats *stats)
2863 {
2864         struct ip_vs_stats_user ustats;
2865         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2866         if (!nl_stats)
2867                 return -EMSGSIZE;
2868
2869         ip_vs_copy_stats(&ustats, stats);
2870
2871         if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns) ||
2872             nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts) ||
2873             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts) ||
2874             nla_put_u64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes) ||
2875             nla_put_u64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes) ||
2876             nla_put_u32(skb, IPVS_STATS_ATTR_CPS, ustats.cps) ||
2877             nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps) ||
2878             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps) ||
2879             nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps) ||
2880             nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps))
2881                 goto nla_put_failure;
2882         nla_nest_end(skb, nl_stats);
2883
2884         return 0;
2885
2886 nla_put_failure:
2887         nla_nest_cancel(skb, nl_stats);
2888         return -EMSGSIZE;
2889 }
2890
2891 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2892                                    struct ip_vs_service *svc)
2893 {
2894         struct nlattr *nl_service;
2895         struct ip_vs_flags flags = { .flags = svc->flags,
2896                                      .mask = ~0 };
2897
2898         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2899         if (!nl_service)
2900                 return -EMSGSIZE;
2901
2902         if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
2903                 goto nla_put_failure;
2904         if (svc->fwmark) {
2905                 if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
2906                         goto nla_put_failure;
2907         } else {
2908                 if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
2909                     nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
2910                     nla_put_u16(skb, IPVS_SVC_ATTR_PORT, svc->port))
2911                         goto nla_put_failure;
2912         }
2913
2914         if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name) ||
2915             (svc->pe &&
2916              nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name)) ||
2917             nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
2918             nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
2919             nla_put_u32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
2920                 goto nla_put_failure;
2921         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2922                 goto nla_put_failure;
2923
2924         nla_nest_end(skb, nl_service);
2925
2926         return 0;
2927
2928 nla_put_failure:
2929         nla_nest_cancel(skb, nl_service);
2930         return -EMSGSIZE;
2931 }
2932
2933 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2934                                    struct ip_vs_service *svc,
2935                                    struct netlink_callback *cb)
2936 {
2937         void *hdr;
2938
2939         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2940                           &ip_vs_genl_family, NLM_F_MULTI,
2941                           IPVS_CMD_NEW_SERVICE);
2942         if (!hdr)
2943                 return -EMSGSIZE;
2944
2945         if (ip_vs_genl_fill_service(skb, svc) < 0)
2946                 goto nla_put_failure;
2947
2948         return genlmsg_end(skb, hdr);
2949
2950 nla_put_failure:
2951         genlmsg_cancel(skb, hdr);
2952         return -EMSGSIZE;
2953 }
2954
2955 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2956                                     struct netlink_callback *cb)
2957 {
2958         int idx = 0, i;
2959         int start = cb->args[0];
2960         struct ip_vs_service *svc;
2961         struct net *net = skb_sknet(skb);
2962
2963         mutex_lock(&__ip_vs_mutex);
2964         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2965                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2966                         if (++idx <= start || !net_eq(svc->net, net))
2967                                 continue;
2968                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2969                                 idx--;
2970                                 goto nla_put_failure;
2971                         }
2972                 }
2973         }
2974
2975         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2976                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2977                         if (++idx <= start || !net_eq(svc->net, net))
2978                                 continue;
2979                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2980                                 idx--;
2981                                 goto nla_put_failure;
2982                         }
2983                 }
2984         }
2985
2986 nla_put_failure:
2987         mutex_unlock(&__ip_vs_mutex);
2988         cb->args[0] = idx;
2989
2990         return skb->len;
2991 }
2992
2993 static int ip_vs_genl_parse_service(struct net *net,
2994                                     struct ip_vs_service_user_kern *usvc,
2995                                     struct nlattr *nla, int full_entry,
2996                                     struct ip_vs_service **ret_svc)
2997 {
2998         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2999         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
3000         struct ip_vs_service *svc;
3001
3002         /* Parse mandatory identifying service fields first */
3003         if (nla == NULL ||
3004             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
3005                 return -EINVAL;
3006
3007         nla_af          = attrs[IPVS_SVC_ATTR_AF];
3008         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
3009         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
3010         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
3011         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
3012
3013         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
3014                 return -EINVAL;
3015
3016         memset(usvc, 0, sizeof(*usvc));
3017
3018         usvc->af = nla_get_u16(nla_af);
3019 #ifdef CONFIG_IP_VS_IPV6
3020         if (usvc->af != AF_INET && usvc->af != AF_INET6)
3021 #else
3022         if (usvc->af != AF_INET)
3023 #endif
3024                 return -EAFNOSUPPORT;
3025
3026         if (nla_fwmark) {
3027                 usvc->protocol = IPPROTO_TCP;
3028                 usvc->fwmark = nla_get_u32(nla_fwmark);
3029         } else {
3030                 usvc->protocol = nla_get_u16(nla_protocol);
3031                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
3032                 usvc->port = nla_get_u16(nla_port);
3033                 usvc->fwmark = 0;
3034         }
3035
3036         if (usvc->fwmark)
3037                 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
3038         else
3039                 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
3040                                            &usvc->addr, usvc->port);
3041         *ret_svc = svc;
3042
3043         /* If a full entry was requested, check for the additional fields */
3044         if (full_entry) {
3045                 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
3046                               *nla_netmask;
3047                 struct ip_vs_flags flags;
3048
3049                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
3050                 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
3051                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
3052                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
3053                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
3054
3055                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3056                         return -EINVAL;
3057
3058                 nla_memcpy(&flags, nla_flags, sizeof(flags));
3059
3060                 /* prefill flags from service if it already exists */
3061                 if (svc)
3062                         usvc->flags = svc->flags;
3063
3064                 /* set new flags from userland */
3065                 usvc->flags = (usvc->flags & ~flags.mask) |
3066                               (flags.flags & flags.mask);
3067                 usvc->sched_name = nla_data(nla_sched);
3068                 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3069                 usvc->timeout = nla_get_u32(nla_timeout);
3070                 usvc->netmask = nla_get_u32(nla_netmask);
3071         }
3072
3073         return 0;
3074 }
3075
3076 static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3077                                                      struct nlattr *nla)
3078 {
3079         struct ip_vs_service_user_kern usvc;
3080         struct ip_vs_service *svc;
3081         int ret;
3082
3083         ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
3084         return ret ? ERR_PTR(ret) : svc;
3085 }
3086
3087 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3088 {
3089         struct nlattr *nl_dest;
3090
3091         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3092         if (!nl_dest)
3093                 return -EMSGSIZE;
3094
3095         if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
3096             nla_put_u16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
3097             nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3098                         (atomic_read(&dest->conn_flags) &
3099                          IP_VS_CONN_F_FWD_MASK)) ||
3100             nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
3101                         atomic_read(&dest->weight)) ||
3102             nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
3103             nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
3104             nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3105                         atomic_read(&dest->activeconns)) ||
3106             nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3107                         atomic_read(&dest->inactconns)) ||
3108             nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3109                         atomic_read(&dest->persistconns)))
3110                 goto nla_put_failure;
3111         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3112                 goto nla_put_failure;
3113
3114         nla_nest_end(skb, nl_dest);
3115
3116         return 0;
3117
3118 nla_put_failure:
3119         nla_nest_cancel(skb, nl_dest);
3120         return -EMSGSIZE;
3121 }
3122
3123 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3124                                 struct netlink_callback *cb)
3125 {
3126         void *hdr;
3127
3128         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3129                           &ip_vs_genl_family, NLM_F_MULTI,
3130                           IPVS_CMD_NEW_DEST);
3131         if (!hdr)
3132                 return -EMSGSIZE;
3133
3134         if (ip_vs_genl_fill_dest(skb, dest) < 0)
3135                 goto nla_put_failure;
3136
3137         return genlmsg_end(skb, hdr);
3138
3139 nla_put_failure:
3140         genlmsg_cancel(skb, hdr);
3141         return -EMSGSIZE;
3142 }
3143
3144 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3145                                  struct netlink_callback *cb)
3146 {
3147         int idx = 0;
3148         int start = cb->args[0];
3149         struct ip_vs_service *svc;
3150         struct ip_vs_dest *dest;
3151         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3152         struct net *net = skb_sknet(skb);
3153
3154         mutex_lock(&__ip_vs_mutex);
3155
3156         /* Try to find the service for which to dump destinations */
3157         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3158                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3159                 goto out_err;
3160
3161
3162         svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
3163         if (IS_ERR(svc) || svc == NULL)
3164                 goto out_err;
3165
3166         /* Dump the destinations */
3167         list_for_each_entry(dest, &svc->destinations, n_list) {
3168                 if (++idx <= start)
3169                         continue;
3170                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3171                         idx--;
3172                         goto nla_put_failure;
3173                 }
3174         }
3175
3176 nla_put_failure:
3177         cb->args[0] = idx;
3178
3179 out_err:
3180         mutex_unlock(&__ip_vs_mutex);
3181
3182         return skb->len;
3183 }
3184
3185 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3186                                  struct nlattr *nla, int full_entry)
3187 {
3188         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3189         struct nlattr *nla_addr, *nla_port;
3190
3191         /* Parse mandatory identifying destination fields first */
3192         if (nla == NULL ||
3193             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3194                 return -EINVAL;
3195
3196         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
3197         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
3198
3199         if (!(nla_addr && nla_port))
3200                 return -EINVAL;
3201
3202         memset(udest, 0, sizeof(*udest));
3203
3204         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3205         udest->port = nla_get_u16(nla_port);
3206
3207         /* If a full entry was requested, check for the additional fields */
3208         if (full_entry) {
3209                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3210                               *nla_l_thresh;
3211
3212                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3213                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
3214                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
3215                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
3216
3217                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3218                         return -EINVAL;
3219
3220                 udest->conn_flags = nla_get_u32(nla_fwd)
3221                                     & IP_VS_CONN_F_FWD_MASK;
3222                 udest->weight = nla_get_u32(nla_weight);
3223                 udest->u_threshold = nla_get_u32(nla_u_thresh);
3224                 udest->l_threshold = nla_get_u32(nla_l_thresh);
3225         }
3226
3227         return 0;
3228 }
3229
3230 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3231                                   const char *mcast_ifn, __be32 syncid)
3232 {
3233         struct nlattr *nl_daemon;
3234
3235         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3236         if (!nl_daemon)
3237                 return -EMSGSIZE;
3238
3239         if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
3240             nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn) ||
3241             nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid))
3242                 goto nla_put_failure;
3243         nla_nest_end(skb, nl_daemon);
3244
3245         return 0;
3246
3247 nla_put_failure:
3248         nla_nest_cancel(skb, nl_daemon);
3249         return -EMSGSIZE;
3250 }
3251
3252 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3253                                   const char *mcast_ifn, __be32 syncid,
3254                                   struct netlink_callback *cb)
3255 {
3256         void *hdr;
3257         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3258                           &ip_vs_genl_family, NLM_F_MULTI,
3259                           IPVS_CMD_NEW_DAEMON);
3260         if (!hdr)
3261                 return -EMSGSIZE;
3262
3263         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3264                 goto nla_put_failure;
3265
3266         return genlmsg_end(skb, hdr);
3267
3268 nla_put_failure:
3269         genlmsg_cancel(skb, hdr);
3270         return -EMSGSIZE;
3271 }
3272
3273 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3274                                    struct netlink_callback *cb)
3275 {
3276         struct net *net = skb_sknet(skb);
3277         struct netns_ipvs *ipvs = net_ipvs(net);
3278
3279         mutex_lock(&ipvs->sync_mutex);
3280         if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3281                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3282                                            ipvs->master_mcast_ifn,
3283                                            ipvs->master_syncid, cb) < 0)
3284                         goto nla_put_failure;
3285
3286                 cb->args[0] = 1;
3287         }
3288
3289         if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3290                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3291                                            ipvs->backup_mcast_ifn,
3292                                            ipvs->backup_syncid, cb) < 0)
3293                         goto nla_put_failure;
3294
3295                 cb->args[1] = 1;
3296         }
3297
3298 nla_put_failure:
3299         mutex_unlock(&ipvs->sync_mutex);
3300
3301         return skb->len;
3302 }
3303
3304 static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
3305 {
3306         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3307               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3308               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3309                 return -EINVAL;
3310
3311         return start_sync_thread(net,
3312                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3313                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3314                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3315 }
3316
3317 static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
3318 {
3319         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3320                 return -EINVAL;
3321
3322         return stop_sync_thread(net,
3323                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3324 }
3325
3326 static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
3327 {
3328         struct ip_vs_timeout_user t;
3329
3330         __ip_vs_get_timeouts(net, &t);
3331
3332         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3333                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3334
3335         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3336                 t.tcp_fin_timeout =
3337                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3338
3339         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3340                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3341
3342         return ip_vs_set_timeout(net, &t);
3343 }
3344
3345 static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3346 {
3347         int ret = 0, cmd;
3348         struct net *net;
3349         struct netns_ipvs *ipvs;
3350
3351         net = skb_sknet(skb);
3352         ipvs = net_ipvs(net);
3353         cmd = info->genlhdr->cmd;
3354
3355         if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3356                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3357
3358                 mutex_lock(&ipvs->sync_mutex);
3359                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3360                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3361                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3362                                      ip_vs_daemon_policy)) {
3363                         ret = -EINVAL;
3364                         goto out;
3365                 }
3366
3367                 if (cmd == IPVS_CMD_NEW_DAEMON)
3368                         ret = ip_vs_genl_new_daemon(net, daemon_attrs);
3369                 else
3370                         ret = ip_vs_genl_del_daemon(net, daemon_attrs);
3371 out:
3372                 mutex_unlock(&ipvs->sync_mutex);
3373         }
3374         return ret;
3375 }
3376
3377 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3378 {
3379         struct ip_vs_service *svc = NULL;
3380         struct ip_vs_service_user_kern usvc;
3381         struct ip_vs_dest_user_kern udest;
3382         int ret = 0, cmd;
3383         int need_full_svc = 0, need_full_dest = 0;
3384         struct net *net;
3385
3386         net = skb_sknet(skb);
3387         cmd = info->genlhdr->cmd;
3388
3389         mutex_lock(&__ip_vs_mutex);
3390
3391         if (cmd == IPVS_CMD_FLUSH) {
3392                 ret = ip_vs_flush(net);
3393                 goto out;
3394         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3395                 ret = ip_vs_genl_set_config(net, info->attrs);
3396                 goto out;
3397         } else if (cmd == IPVS_CMD_ZERO &&
3398                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3399                 ret = ip_vs_zero_all(net);
3400                 goto out;
3401         }
3402
3403         /* All following commands require a service argument, so check if we
3404          * received a valid one. We need a full service specification when
3405          * adding / editing a service. Only identifying members otherwise. */
3406         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3407                 need_full_svc = 1;
3408
3409         ret = ip_vs_genl_parse_service(net, &usvc,
3410                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3411                                        need_full_svc, &svc);
3412         if (ret)
3413                 goto out;
3414
3415         /* Unless we're adding a new service, the service must already exist */
3416         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3417                 ret = -ESRCH;
3418                 goto out;
3419         }
3420
3421         /* Destination commands require a valid destination argument. For
3422          * adding / editing a destination, we need a full destination
3423          * specification. */
3424         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3425             cmd == IPVS_CMD_DEL_DEST) {
3426                 if (cmd != IPVS_CMD_DEL_DEST)
3427                         need_full_dest = 1;
3428
3429                 ret = ip_vs_genl_parse_dest(&udest,
3430                                             info->attrs[IPVS_CMD_ATTR_DEST],
3431                                             need_full_dest);
3432                 if (ret)
3433                         goto out;
3434         }
3435
3436         switch (cmd) {
3437         case IPVS_CMD_NEW_SERVICE:
3438                 if (svc == NULL)
3439                         ret = ip_vs_add_service(net, &usvc, &svc);
3440                 else
3441                         ret = -EEXIST;
3442                 break;
3443         case IPVS_CMD_SET_SERVICE:
3444                 ret = ip_vs_edit_service(svc, &usvc);
3445                 break;
3446         case IPVS_CMD_DEL_SERVICE:
3447                 ret = ip_vs_del_service(svc);
3448                 /* do not use svc, it can be freed */
3449                 break;
3450         case IPVS_CMD_NEW_DEST:
3451                 ret = ip_vs_add_dest(svc, &udest);
3452                 break;
3453         case IPVS_CMD_SET_DEST:
3454                 ret = ip_vs_edit_dest(svc, &udest);
3455                 break;
3456         case IPVS_CMD_DEL_DEST:
3457                 ret = ip_vs_del_dest(svc, &udest);
3458                 break;
3459         case IPVS_CMD_ZERO:
3460                 ret = ip_vs_zero_service(svc);
3461                 break;
3462         default:
3463                 ret = -EINVAL;
3464         }
3465
3466 out:
3467         mutex_unlock(&__ip_vs_mutex);
3468
3469         return ret;
3470 }
3471
3472 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3473 {
3474         struct sk_buff *msg;
3475         void *reply;
3476         int ret, cmd, reply_cmd;
3477         struct net *net;
3478
3479         net = skb_sknet(skb);
3480         cmd = info->genlhdr->cmd;
3481
3482         if (cmd == IPVS_CMD_GET_SERVICE)
3483                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3484         else if (cmd == IPVS_CMD_GET_INFO)
3485                 reply_cmd = IPVS_CMD_SET_INFO;
3486         else if (cmd == IPVS_CMD_GET_CONFIG)
3487                 reply_cmd = IPVS_CMD_SET_CONFIG;
3488         else {
3489                 pr_err("unknown Generic Netlink command\n");
3490                 return -EINVAL;
3491         }
3492
3493         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3494         if (!msg)
3495                 return -ENOMEM;
3496
3497         mutex_lock(&__ip_vs_mutex);
3498
3499         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3500         if (reply == NULL)
3501                 goto nla_put_failure;
3502
3503         switch (cmd) {
3504         case IPVS_CMD_GET_SERVICE:
3505         {
3506                 struct ip_vs_service *svc;
3507
3508                 svc = ip_vs_genl_find_service(net,
3509                                               info->attrs[IPVS_CMD_ATTR_SERVICE]);
3510                 if (IS_ERR(svc)) {
3511                         ret = PTR_ERR(svc);
3512                         goto out_err;
3513                 } else if (svc) {
3514                         ret = ip_vs_genl_fill_service(msg, svc);
3515                         if (ret)
3516                                 goto nla_put_failure;
3517                 } else {
3518                         ret = -ESRCH;
3519                         goto out_err;
3520                 }
3521
3522                 break;
3523         }
3524
3525         case IPVS_CMD_GET_CONFIG:
3526         {
3527                 struct ip_vs_timeout_user t;
3528
3529                 __ip_vs_get_timeouts(net, &t);
3530 #ifdef CONFIG_IP_VS_PROTO_TCP
3531                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
3532                                 t.tcp_timeout) ||
3533                     nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3534                                 t.tcp_fin_timeout))
3535                         goto nla_put_failure;
3536 #endif
3537 #ifdef CONFIG_IP_VS_PROTO_UDP
3538                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
3539                         goto nla_put_failure;
3540 #endif
3541
3542                 break;
3543         }
3544
3545         case IPVS_CMD_GET_INFO:
3546                 if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
3547                                 IP_VS_VERSION_CODE) ||
3548                     nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3549                                 ip_vs_conn_tab_size))
3550                         goto nla_put_failure;
3551                 break;
3552         }
3553
3554         genlmsg_end(msg, reply);
3555         ret = genlmsg_reply(msg, info);
3556         goto out;
3557
3558 nla_put_failure:
3559         pr_err("not enough space in Netlink message\n");
3560         ret = -EMSGSIZE;
3561
3562 out_err:
3563         nlmsg_free(msg);
3564 out:
3565         mutex_unlock(&__ip_vs_mutex);
3566
3567         return ret;
3568 }
3569
3570
3571 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3572         {
3573                 .cmd    = IPVS_CMD_NEW_SERVICE,
3574                 .flags  = GENL_ADMIN_PERM,
3575                 .policy = ip_vs_cmd_policy,
3576                 .doit   = ip_vs_genl_set_cmd,
3577         },
3578         {
3579                 .cmd    = IPVS_CMD_SET_SERVICE,
3580                 .flags  = GENL_ADMIN_PERM,
3581                 .policy = ip_vs_cmd_policy,
3582                 .doit   = ip_vs_genl_set_cmd,
3583         },
3584         {
3585                 .cmd    = IPVS_CMD_DEL_SERVICE,
3586                 .flags  = GENL_ADMIN_PERM,
3587                 .policy = ip_vs_cmd_policy,
3588                 .doit   = ip_vs_genl_set_cmd,
3589         },
3590         {
3591                 .cmd    = IPVS_CMD_GET_SERVICE,
3592                 .flags  = GENL_ADMIN_PERM,
3593                 .doit   = ip_vs_genl_get_cmd,
3594                 .dumpit = ip_vs_genl_dump_services,
3595                 .policy = ip_vs_cmd_policy,
3596         },
3597         {
3598                 .cmd    = IPVS_CMD_NEW_DEST,
3599                 .flags  = GENL_ADMIN_PERM,
3600                 .policy = ip_vs_cmd_policy,
3601                 .doit   = ip_vs_genl_set_cmd,
3602         },
3603         {
3604                 .cmd    = IPVS_CMD_SET_DEST,
3605                 .flags  = GENL_ADMIN_PERM,
3606                 .policy = ip_vs_cmd_policy,
3607                 .doit   = ip_vs_genl_set_cmd,
3608         },
3609         {
3610                 .cmd    = IPVS_CMD_DEL_DEST,
3611                 .flags  = GENL_ADMIN_PERM,
3612                 .policy = ip_vs_cmd_policy,
3613                 .doit   = ip_vs_genl_set_cmd,
3614         },
3615         {
3616                 .cmd    = IPVS_CMD_GET_DEST,
3617                 .flags  = GENL_ADMIN_PERM,
3618                 .policy = ip_vs_cmd_policy,
3619                 .dumpit = ip_vs_genl_dump_dests,
3620         },
3621         {
3622                 .cmd    = IPVS_CMD_NEW_DAEMON,
3623                 .flags  = GENL_ADMIN_PERM,
3624                 .policy = ip_vs_cmd_policy,
3625                 .doit   = ip_vs_genl_set_daemon,
3626         },
3627         {
3628                 .cmd    = IPVS_CMD_DEL_DAEMON,
3629                 .flags  = GENL_ADMIN_PERM,
3630                 .policy = ip_vs_cmd_policy,
3631                 .doit   = ip_vs_genl_set_daemon,
3632         },
3633         {
3634                 .cmd    = IPVS_CMD_GET_DAEMON,
3635                 .flags  = GENL_ADMIN_PERM,
3636                 .dumpit = ip_vs_genl_dump_daemons,
3637         },
3638         {
3639                 .cmd    = IPVS_CMD_SET_CONFIG,
3640                 .flags  = GENL_ADMIN_PERM,
3641                 .policy = ip_vs_cmd_policy,
3642                 .doit   = ip_vs_genl_set_cmd,
3643         },
3644         {
3645                 .cmd    = IPVS_CMD_GET_CONFIG,
3646                 .flags  = GENL_ADMIN_PERM,
3647                 .doit   = ip_vs_genl_get_cmd,
3648         },
3649         {
3650                 .cmd    = IPVS_CMD_GET_INFO,
3651                 .flags  = GENL_ADMIN_PERM,
3652                 .doit   = ip_vs_genl_get_cmd,
3653         },
3654         {
3655                 .cmd    = IPVS_CMD_ZERO,
3656                 .flags  = GENL_ADMIN_PERM,
3657                 .policy = ip_vs_cmd_policy,
3658                 .doit   = ip_vs_genl_set_cmd,
3659         },
3660         {
3661                 .cmd    = IPVS_CMD_FLUSH,
3662                 .flags  = GENL_ADMIN_PERM,
3663                 .doit   = ip_vs_genl_set_cmd,
3664         },
3665 };
3666
3667 static int __init ip_vs_genl_register(void)
3668 {
3669         return genl_register_family_with_ops(&ip_vs_genl_family,
3670                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3671 }
3672
3673 static void ip_vs_genl_unregister(void)
3674 {
3675         genl_unregister_family(&ip_vs_genl_family);
3676 }
3677
3678 /* End of Generic Netlink interface definitions */
3679
3680 /*
3681  * per netns intit/exit func.
3682  */
3683 #ifdef CONFIG_SYSCTL
3684 static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
3685 {
3686         int idx;
3687         struct netns_ipvs *ipvs = net_ipvs(net);
3688         struct ctl_table *tbl;
3689
3690         atomic_set(&ipvs->dropentry, 0);
3691         spin_lock_init(&ipvs->dropentry_lock);
3692         spin_lock_init(&ipvs->droppacket_lock);
3693         spin_lock_init(&ipvs->securetcp_lock);
3694
3695         if (!net_eq(net, &init_net)) {
3696                 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3697                 if (tbl == NULL)
3698                         return -ENOMEM;
3699         } else
3700                 tbl = vs_vars;
3701         /* Initialize sysctl defaults */
3702         idx = 0;
3703         ipvs->sysctl_amemthresh = 1024;
3704         tbl[idx++].data = &ipvs->sysctl_amemthresh;
3705         ipvs->sysctl_am_droprate = 10;
3706         tbl[idx++].data = &ipvs->sysctl_am_droprate;
3707         tbl[idx++].data = &ipvs->sysctl_drop_entry;
3708         tbl[idx++].data = &ipvs->sysctl_drop_packet;
3709 #ifdef CONFIG_IP_VS_NFCT
3710         tbl[idx++].data = &ipvs->sysctl_conntrack;
3711 #endif
3712         tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3713         ipvs->sysctl_snat_reroute = 1;
3714         tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3715         ipvs->sysctl_sync_ver = 1;
3716         tbl[idx++].data = &ipvs->sysctl_sync_ver;
3717         ipvs->sysctl_sync_ports = 1;
3718         tbl[idx++].data = &ipvs->sysctl_sync_ports;
3719         ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
3720         tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
3721         ipvs->sysctl_sync_sock_size = 0;
3722         tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
3723         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3724         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3725         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3726         ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3727         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3728         tbl[idx].data = &ipvs->sysctl_sync_threshold;
3729         tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3730         ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
3731         tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
3732         ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
3733         tbl[idx++].data = &ipvs->sysctl_sync_retries;
3734         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3735         ipvs->sysctl_pmtu_disc = 1;
3736         tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
3737
3738
3739         ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
3740         if (ipvs->sysctl_hdr == NULL) {
3741                 if (!net_eq(net, &init_net))
3742                         kfree(tbl);
3743                 return -ENOMEM;
3744         }
3745         ip_vs_start_estimator(net, &ipvs->tot_stats);
3746         ipvs->sysctl_tbl = tbl;
3747         /* Schedule defense work */
3748         INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3749         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
3750
3751         return 0;
3752 }
3753
3754 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
3755 {
3756         struct netns_ipvs *ipvs = net_ipvs(net);
3757
3758         cancel_delayed_work_sync(&ipvs->defense_work);
3759         cancel_work_sync(&ipvs->defense_work.work);
3760         unregister_net_sysctl_table(ipvs->sysctl_hdr);
3761 }
3762
3763 #else
3764
3765 static int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3766 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
3767
3768 #endif
3769
3770 static struct notifier_block ip_vs_dst_notifier = {
3771         .notifier_call = ip_vs_dst_event,
3772 };
3773
3774 int __net_init ip_vs_control_net_init(struct net *net)
3775 {
3776         int idx;
3777         struct netns_ipvs *ipvs = net_ipvs(net);
3778
3779         rwlock_init(&ipvs->rs_lock);
3780
3781         /* Initialize rs_table */
3782         for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3783                 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3784
3785         INIT_LIST_HEAD(&ipvs->dest_trash);
3786         atomic_set(&ipvs->ftpsvc_counter, 0);
3787         atomic_set(&ipvs->nullsvc_counter, 0);
3788
3789         /* procfs stats */
3790         ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
3791         if (!ipvs->tot_stats.cpustats)
3792                 return -ENOMEM;
3793
3794         spin_lock_init(&ipvs->tot_stats.lock);
3795
3796         proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
3797         proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
3798         proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
3799                              &ip_vs_stats_percpu_fops);
3800
3801         if (ip_vs_control_net_init_sysctl(net))
3802                 goto err;
3803
3804         return 0;
3805
3806 err:
3807         free_percpu(ipvs->tot_stats.cpustats);
3808         return -ENOMEM;
3809 }
3810
3811 void __net_exit ip_vs_control_net_cleanup(struct net *net)
3812 {
3813         struct netns_ipvs *ipvs = net_ipvs(net);
3814
3815         ip_vs_trash_cleanup(net);
3816         ip_vs_stop_estimator(net, &ipvs->tot_stats);
3817         ip_vs_control_net_cleanup_sysctl(net);
3818         proc_net_remove(net, "ip_vs_stats_percpu");
3819         proc_net_remove(net, "ip_vs_stats");
3820         proc_net_remove(net, "ip_vs");
3821         free_percpu(ipvs->tot_stats.cpustats);
3822 }
3823
3824 int __init ip_vs_register_nl_ioctl(void)
3825 {
3826         int ret;
3827
3828         ret = nf_register_sockopt(&ip_vs_sockopts);
3829         if (ret) {
3830                 pr_err("cannot register sockopt.\n");
3831                 goto err_sock;
3832         }
3833
3834         ret = ip_vs_genl_register();
3835         if (ret) {
3836                 pr_err("cannot register Generic Netlink interface.\n");
3837                 goto err_genl;
3838         }
3839         return 0;
3840
3841 err_genl:
3842         nf_unregister_sockopt(&ip_vs_sockopts);
3843 err_sock:
3844         return ret;
3845 }
3846
3847 void ip_vs_unregister_nl_ioctl(void)
3848 {
3849         ip_vs_genl_unregister();
3850         nf_unregister_sockopt(&ip_vs_sockopts);
3851 }
3852
3853 int __init ip_vs_control_init(void)
3854 {
3855         int idx;
3856         int ret;
3857
3858         EnterFunction(2);
3859
3860         /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
3861         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3862                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3863                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3864         }
3865
3866         smp_wmb();      /* Do we really need it now ? */
3867
3868         ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3869         if (ret < 0)
3870                 return ret;
3871
3872         LeaveFunction(2);
3873         return 0;
3874 }
3875
3876
3877 void ip_vs_control_cleanup(void)
3878 {
3879         EnterFunction(2);
3880         unregister_netdevice_notifier(&ip_vs_dst_notifier);
3881         LeaveFunction(2);
3882 }