net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <linux/nsproxy.h>
  42 #include <net/ip.h>
  43 #ifdef CONFIG_IP_VS_IPV6
  44 #include <net/ipv6.h>
  45 #include <net/ip6_route.h>
  46 #endif
  47 #include <net/route.h>
  48 #include <net/sock.h>
  49 #include <net/genetlink.h>
  50
  51 #include <asm/uaccess.h>
  52
  53 #include <net/ip_vs.h>
  54
  55 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  56 static DEFINE_MUTEX(__ip_vs_mutex);
  57
  58 /* lock for service table */
  59 static DEFINE_RWLOCK(__ip_vs_svc_lock);
  60
  61 /* sysctl variables */
  62
  63 #ifdef CONFIG_IP_VS_DEBUG
  64 static int sysctl_ip_vs_debug_level = 0;
  65
  66 int ip_vs_get_debug_level(void)
  67 {
  68         return sysctl_ip_vs_debug_level;
  69 }
  70 #endif
  71
  72
  73 /*  Protos */
  74 static void __ip_vs_del_service(struct ip_vs_service *svc);
  75
  76
  77 #ifdef CONFIG_IP_VS_IPV6
  78 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
  79 static bool __ip_vs_addr_is_local_v6(struct net *net,
  80                                      const struct in6_addr *addr)
  81 {
  82         struct flowi6 fl6 = {
  83                 .daddr = *addr,
  84         };
  85         struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
  86         bool is_local;
  87
  88         is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
  89
  90         dst_release(dst);
  91         return is_local;
  92 }
  93 #endif
  94
  95 #ifdef CONFIG_SYSCTL
  96 /*
  97  *      update_defense_level is called from keventd and from sysctl,
  98  *      so it needs to protect itself from softirqs
  99  */
 100 static void update_defense_level(struct netns_ipvs *ipvs)
 101 {
 102         struct sysinfo i;
 103         static int old_secure_tcp = 0;
 104         int availmem;
 105         int nomem;
 106         int to_change = -1;
 107
 108         /* we only count free and buffered memory (in pages) */
 109         si_meminfo(&i);
 110         availmem = i.freeram + i.bufferram;
 111         /* however in linux 2.5 the i.bufferram is total page cache size,
 112            we need adjust it */
 113         /* si_swapinfo(&i); */
 114         /* availmem = availmem - (i.totalswap - i.freeswap); */
 115
 116         nomem = (availmem < ipvs->sysctl_amemthresh);
 117
 118         local_bh_disable();
 119
 120         /* drop_entry */
 121         spin_lock(&ipvs->dropentry_lock);
 122         switch (ipvs->sysctl_drop_entry) {
 123         case 0:
 124                 atomic_set(&ipvs->dropentry, 0);
 125                 break;
 126         case 1:
 127                 if (nomem) {
 128                         atomic_set(&ipvs->dropentry, 1);
 129                         ipvs->sysctl_drop_entry = 2;
 130                 } else {
 131                         atomic_set(&ipvs->dropentry, 0);
 132                 }
 133                 break;
 134         case 2:
 135                 if (nomem) {
 136                         atomic_set(&ipvs->dropentry, 1);
 137                 } else {
 138                         atomic_set(&ipvs->dropentry, 0);
 139                         ipvs->sysctl_drop_entry = 1;
 140                 };
 141                 break;
 142         case 3:
 143                 atomic_set(&ipvs->dropentry, 1);
 144                 break;
 145         }
 146         spin_unlock(&ipvs->dropentry_lock);
 147
 148         /* drop_packet */
 149         spin_lock(&ipvs->droppacket_lock);
 150         switch (ipvs->sysctl_drop_packet) {
 151         case 0:
 152                 ipvs->drop_rate = 0;
 153                 break;
 154         case 1:
 155                 if (nomem) {
 156                         ipvs->drop_rate = ipvs->drop_counter
 157                                 = ipvs->sysctl_amemthresh /
 158                                 (ipvs->sysctl_amemthresh-availmem);
 159                         ipvs->sysctl_drop_packet = 2;
 160                 } else {
 161                         ipvs->drop_rate = 0;
 162                 }
 163                 break;
 164         case 2:
 165                 if (nomem) {
 166                         ipvs->drop_rate = ipvs->drop_counter
 167                                 = ipvs->sysctl_amemthresh /
 168                                 (ipvs->sysctl_amemthresh-availmem);
 169                 } else {
 170                         ipvs->drop_rate = 0;
 171                         ipvs->sysctl_drop_packet = 1;
 172                 }
 173                 break;
 174         case 3:
 175                 ipvs->drop_rate = ipvs->sysctl_am_droprate;
 176                 break;
 177         }
 178         spin_unlock(&ipvs->droppacket_lock);
 179
 180         /* secure_tcp */
 181         spin_lock(&ipvs->securetcp_lock);
 182         switch (ipvs->sysctl_secure_tcp) {
 183         case 0:
 184                 if (old_secure_tcp >= 2)
 185                         to_change = 0;
 186                 break;
 187         case 1:
 188                 if (nomem) {
 189                         if (old_secure_tcp < 2)
 190                                 to_change = 1;
 191                         ipvs->sysctl_secure_tcp = 2;
 192                 } else {
 193                         if (old_secure_tcp >= 2)
 194                                 to_change = 0;
 195                 }
 196                 break;
 197         case 2:
 198                 if (nomem) {
 199                         if (old_secure_tcp < 2)
 200                                 to_change = 1;
 201                 } else {
 202                         if (old_secure_tcp >= 2)
 203                                 to_change = 0;
 204                         ipvs->sysctl_secure_tcp = 1;
 205                 }
 206                 break;
 207         case 3:
 208                 if (old_secure_tcp < 2)
 209                         to_change = 1;
 210                 break;
 211         }
 212         old_secure_tcp = ipvs->sysctl_secure_tcp;
 213         if (to_change >= 0)
 214                 ip_vs_protocol_timeout_change(ipvs,
 215                                               ipvs->sysctl_secure_tcp > 1);
 216         spin_unlock(&ipvs->securetcp_lock);
 217
 218         local_bh_enable();
 219 }
 220
 221
 222 /*
 223  *      Timer for checking the defense
 224  */
 225 #define DEFENSE_TIMER_PERIOD    1*HZ
 226
 227 static void defense_work_handler(struct work_struct *work)
 228 {
 229         struct netns_ipvs *ipvs =
 230                 container_of(work, struct netns_ipvs, defense_work.work);
 231
 232         update_defense_level(ipvs);
 233         if (atomic_read(&ipvs->dropentry))
 234                 ip_vs_random_dropentry(ipvs->net);
 235         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
 236 }
 237 #endif
 238
 239 int
 240 ip_vs_use_count_inc(void)
 241 {
 242         return try_module_get(THIS_MODULE);
 243 }
 244
 245 void
 246 ip_vs_use_count_dec(void)
 247 {
 248         module_put(THIS_MODULE);
 249 }
 250
 251
 252 /*
 253  *      Hash table: for virtual service lookups
 254  */
 255 #define IP_VS_SVC_TAB_BITS 8
 256 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 257 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 258
 259 /* the service table hashed by <protocol, addr, port> */
 260 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 261 /* the service table hashed by fwmark */
 262 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 263
 264
 265 /*
 266  *      Returns hash value for virtual service
 267  */
 268 static inline unsigned int
 269 ip_vs_svc_hashkey(struct net *net, int af, unsigned int proto,
 270                   const union nf_inet_addr *addr, __be16 port)
 271 {
 272         register unsigned int porth = ntohs(port);
 273         __be32 addr_fold = addr->ip;
 274
 275 #ifdef CONFIG_IP_VS_IPV6
 276         if (af == AF_INET6)
 277                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 278                             addr->ip6[2]^addr->ip6[3];
 279 #endif
 280         addr_fold ^= ((size_t)net>>8);
 281
 282         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
 283                 & IP_VS_SVC_TAB_MASK;
 284 }
 285
 286 /*
 287  *      Returns hash value of fwmark for virtual service lookup
 288  */
 289 static inline unsigned int ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
 290 {
 291         return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
 292 }
 293
 294 /*
 295  *      Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
 296  *      or in the ip_vs_svc_fwm_table by fwmark.
 297  *      Should be called with locked tables.
 298  */
 299 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 300 {
 301         unsigned int hash;
 302
 303         if (svc->flags & IP_VS_SVC_F_HASHED) {
 304                 pr_err("%s(): request for already hashed, called from %pF\n",
 305                        __func__, __builtin_return_address(0));
 306                 return 0;
 307         }
 308
 309         if (svc->fwmark == 0) {
 310                 /*
 311                  *  Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
 312                  */
 313                 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
 314                                          &svc->addr, svc->port);
 315                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
 316         } else {
 317                 /*
 318                  *  Hash it by fwmark in svc_fwm_table
 319                  */
 320                 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
 321                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 322         }
 323
 324         svc->flags |= IP_VS_SVC_F_HASHED;
 325         /* increase its refcnt because it is referenced by the svc table */
 326         atomic_inc(&svc->refcnt);
 327         return 1;
 328 }
 329
 330
 331 /*
 332  *      Unhashes a service from svc_table / svc_fwm_table.
 333  *      Should be called with locked tables.
 334  */
 335 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 336 {
 337         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 338                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 339                        __func__, __builtin_return_address(0));
 340                 return 0;
 341         }
 342
 343         if (svc->fwmark == 0) {
 344                 /* Remove it from the svc_table table */
 345                 list_del(&svc->s_list);
 346         } else {
 347                 /* Remove it from the svc_fwm_table table */
 348                 list_del(&svc->f_list);
 349         }
 350
 351         svc->flags &= ~IP_VS_SVC_F_HASHED;
 352         atomic_dec(&svc->refcnt);
 353         return 1;
 354 }
 355
 356
 357 /*
 358  *      Get service by {netns, proto,addr,port} in the service table.
 359  */
 360 static inline struct ip_vs_service *
 361 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
 362                      const union nf_inet_addr *vaddr, __be16 vport)
 363 {
 364         unsigned int hash;
 365         struct ip_vs_service *svc;
 366
 367         /* Check for "full" addressed entries */
 368         hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
 369
 370         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
 371                 if ((svc->af == af)
 372                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 373                     && (svc->port == vport)
 374                     && (svc->protocol == protocol)
 375                     && net_eq(svc->net, net)) {
 376                         /* HIT */
 377                         return svc;
 378                 }
 379         }
 380
 381         return NULL;
 382 }
 383
 384
 385 /*
 386  *      Get service by {fwmark} in the service table.
 387  */
 388 static inline struct ip_vs_service *
 389 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
 390 {
 391         unsigned int hash;
 392         struct ip_vs_service *svc;
 393
 394         /* Check for fwmark addressed entries */
 395         hash = ip_vs_svc_fwm_hashkey(net, fwmark);
 396
 397         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 398                 if (svc->fwmark == fwmark && svc->af == af
 399                     && net_eq(svc->net, net)) {
 400                         /* HIT */
 401                         return svc;
 402                 }
 403         }
 404
 405         return NULL;
 406 }
 407
 408 struct ip_vs_service *
 409 ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
 410                   const union nf_inet_addr *vaddr, __be16 vport)
 411 {
 412         struct ip_vs_service *svc;
 413         struct netns_ipvs *ipvs = net_ipvs(net);
 414
 415         read_lock(&__ip_vs_svc_lock);
 416
 417         /*
 418          *      Check the table hashed by fwmark first
 419          */
 420         if (fwmark) {
 421                 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
 422                 if (svc)
 423                         goto out;
 424         }
 425
 426         /*
 427          *      Check the table hashed by <protocol,addr,port>
 428          *      for "full" addressed entries
 429          */
 430         svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
 431
 432         if (svc == NULL
 433             && protocol == IPPROTO_TCP
 434             && atomic_read(&ipvs->ftpsvc_counter)
 435             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 436                 /*
 437                  * Check if ftp service entry exists, the packet
 438                  * might belong to FTP data connections.
 439                  */
 440                 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
 441         }
 442
 443         if (svc == NULL
 444             && atomic_read(&ipvs->nullsvc_counter)) {
 445                 /*
 446                  * Check if the catch-all port (port zero) exists
 447                  */
 448                 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
 449         }
 450
 451   out:
 452         if (svc)
 453                 atomic_inc(&svc->usecnt);
 454         read_unlock(&__ip_vs_svc_lock);
 455
 456         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 457                       fwmark, ip_vs_proto_name(protocol),
 458                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 459                       svc ? "hit" : "not hit");
 460
 461         return svc;
 462 }
 463
 464
 465 static inline void
 466 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 467 {
 468         atomic_inc(&svc->refcnt);
 469         dest->svc = svc;
 470 }
 471
 472 static void
 473 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 474 {
 475         struct ip_vs_service *svc = dest->svc;
 476
 477         dest->svc = NULL;
 478         if (atomic_dec_and_test(&svc->refcnt)) {
 479                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
 480                               svc->fwmark,
 481                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
 482                               ntohs(svc->port), atomic_read(&svc->usecnt));
 483                 free_percpu(svc->stats.cpustats);
 484                 kfree(svc);
 485         }
 486 }
 487
 488
 489 /*
 490  *      Returns hash value for real service
 491  */
 492 static inline unsigned int ip_vs_rs_hashkey(int af,
 493                                             const union nf_inet_addr *addr,
 494                                             __be16 port)
 495 {
 496         register unsigned int porth = ntohs(port);
 497         __be32 addr_fold = addr->ip;
 498
 499 #ifdef CONFIG_IP_VS_IPV6
 500         if (af == AF_INET6)
 501                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 502                             addr->ip6[2]^addr->ip6[3];
 503 #endif
 504
 505         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 506                 & IP_VS_RTAB_MASK;
 507 }
 508
 509 /*
 510  *      Hashes ip_vs_dest in rs_table by <proto,addr,port>.
 511  *      should be called with locked tables.
 512  */
 513 static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
 514 {
 515         unsigned int hash;
 516
 517         if (!list_empty(&dest->d_list)) {
 518                 return 0;
 519         }
 520
 521         /*
 522          *      Hash by proto,addr,port,
 523          *      which are the parameters of the real service.
 524          */
 525         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 526
 527         list_add(&dest->d_list, &ipvs->rs_table[hash]);
 528
 529         return 1;
 530 }
 531
 532 /*
 533  *      UNhashes ip_vs_dest from rs_table.
 534  *      should be called with locked tables.
 535  */
 536 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
 537 {
 538         /*
 539          * Remove it from the rs_table table.
 540          */
 541         if (!list_empty(&dest->d_list)) {
 542                 list_del(&dest->d_list);
 543                 INIT_LIST_HEAD(&dest->d_list);
 544         }
 545
 546         return 1;
 547 }
 548
 549 /*
 550  *      Lookup real service by <proto,addr,port> in the real service table.
 551  */
 552 struct ip_vs_dest *
 553 ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
 554                           const union nf_inet_addr *daddr,
 555                           __be16 dport)
 556 {
 557         struct netns_ipvs *ipvs = net_ipvs(net);
 558         unsigned int hash;
 559         struct ip_vs_dest *dest;
 560
 561         /*
 562          *      Check for "full" addressed entries
 563          *      Return the first found entry
 564          */
 565         hash = ip_vs_rs_hashkey(af, daddr, dport);
 566
 567         read_lock(&ipvs->rs_lock);
 568         list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
 569                 if ((dest->af == af)
 570                     && ip_vs_addr_equal(af, &dest->addr, daddr)
 571                     && (dest->port == dport)
 572                     && ((dest->protocol == protocol) ||
 573                         dest->vfwmark)) {
 574                         /* HIT */
 575                         read_unlock(&ipvs->rs_lock);
 576                         return dest;
 577                 }
 578         }
 579         read_unlock(&ipvs->rs_lock);
 580
 581         return NULL;
 582 }
 583
 584 /*
 585  *      Lookup destination by {addr,port} in the given service
 586  */
 587 static struct ip_vs_dest *
 588 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 589                   __be16 dport)
 590 {
 591         struct ip_vs_dest *dest;
 592
 593         /*
 594          * Find the destination for the given service
 595          */
 596         list_for_each_entry(dest, &svc->destinations, n_list) {
 597                 if ((dest->af == svc->af)
 598                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 599                     && (dest->port == dport)) {
 600                         /* HIT */
 601                         return dest;
 602                 }
 603         }
 604
 605         return NULL;
 606 }
 607
 608 /*
 609  * Find destination by {daddr,dport,vaddr,protocol}
 610  * Cretaed to be used in ip_vs_process_message() in
 611  * the backup synchronization daemon. It finds the
 612  * destination to be bound to the received connection
 613  * on the backup.
 614  *
 615  * ip_vs_lookup_real_service() looked promissing, but
 616  * seems not working as expected.
 617  */
 618 struct ip_vs_dest *ip_vs_find_dest(struct net  *net, int af,
 619                                    const union nf_inet_addr *daddr,
 620                                    __be16 dport,
 621                                    const union nf_inet_addr *vaddr,
 622                                    __be16 vport, __u16 protocol, __u32 fwmark,
 623                                    __u32 flags)
 624 {
 625         struct ip_vs_dest *dest;
 626         struct ip_vs_service *svc;
 627         __be16 port = dport;
 628
 629         svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
 630         if (!svc)
 631                 return NULL;
 632         if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
 633                 port = 0;
 634         dest = ip_vs_lookup_dest(svc, daddr, port);
 635         if (!dest)
 636                 dest = ip_vs_lookup_dest(svc, daddr, port ^ dport);
 637         if (dest)
 638                 atomic_inc(&dest->refcnt);
 639         ip_vs_service_put(svc);
 640         return dest;
 641 }
 642
 643 /*
 644  *  Lookup dest by {svc,addr,port} in the destination trash.
 645  *  The destination trash is used to hold the destinations that are removed
 646  *  from the service table but are still referenced by some conn entries.
 647  *  The reason to add the destination trash is when the dest is temporary
 648  *  down (either by administrator or by monitor program), the dest can be
 649  *  picked back from the trash, the remaining connections to the dest can
 650  *  continue, and the counting information of the dest is also useful for
 651  *  scheduling.
 652  */
 653 static struct ip_vs_dest *
 654 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 655                      __be16 dport)
 656 {
 657         struct ip_vs_dest *dest, *nxt;
 658         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 659
 660         /*
 661          * Find the destination in trash
 662          */
 663         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 664                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 665                               "dest->refcnt=%d\n",
 666                               dest->vfwmark,
 667                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 668                               ntohs(dest->port),
 669                               atomic_read(&dest->refcnt));
 670                 if (dest->af == svc->af &&
 671                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 672                     dest->port == dport &&
 673                     dest->vfwmark == svc->fwmark &&
 674                     dest->protocol == svc->protocol &&
 675                     (svc->fwmark ||
 676                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 677                       dest->vport == svc->port))) {
 678                         /* HIT */
 679                         return dest;
 680                 }
 681
 682                 /*
 683                  * Try to purge the destination from trash if not referenced
 684                  */
 685                 if (atomic_read(&dest->refcnt) == 1) {
 686                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
 687                                       "from trash\n",
 688                                       dest->vfwmark,
 689                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
 690                                       ntohs(dest->port));
 691                         list_del(&dest->n_list);
 692                         ip_vs_dst_reset(dest);
 693                         __ip_vs_unbind_svc(dest);
 694                         free_percpu(dest->stats.cpustats);
 695                         kfree(dest);
 696                 }
 697         }
 698
 699         return NULL;
 700 }
 701
 702
 703 /*
 704  *  Clean up all the destinations in the trash
 705  *  Called by the ip_vs_control_cleanup()
 706  *
 707  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 708  *  the service tables must have been flushed and all the connections
 709  *  are expired, and the refcnt of each destination in the trash must
 710  *  be 1, so we simply release them here.
 711  */
 712 static void ip_vs_trash_cleanup(struct net *net)
 713 {
 714         struct ip_vs_dest *dest, *nxt;
 715         struct netns_ipvs *ipvs = net_ipvs(net);
 716
 717         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 718                 list_del(&dest->n_list);
 719                 ip_vs_dst_reset(dest);
 720                 __ip_vs_unbind_svc(dest);
 721                 free_percpu(dest->stats.cpustats);
 722                 kfree(dest);
 723         }
 724 }
 725
 726 static void
 727 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
 728 {
 729 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
 730
 731         spin_lock_bh(&src->lock);
 732
 733         IP_VS_SHOW_STATS_COUNTER(conns);
 734         IP_VS_SHOW_STATS_COUNTER(inpkts);
 735         IP_VS_SHOW_STATS_COUNTER(outpkts);
 736         IP_VS_SHOW_STATS_COUNTER(inbytes);
 737         IP_VS_SHOW_STATS_COUNTER(outbytes);
 738
 739         ip_vs_read_estimator(dst, src);
 740
 741         spin_unlock_bh(&src->lock);
 742 }
 743
 744 static void
 745 ip_vs_zero_stats(struct ip_vs_stats *stats)
 746 {
 747         spin_lock_bh(&stats->lock);
 748
 749         /* get current counters as zero point, rates are zeroed */
 750
 751 #define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
 752
 753         IP_VS_ZERO_STATS_COUNTER(conns);
 754         IP_VS_ZERO_STATS_COUNTER(inpkts);
 755         IP_VS_ZERO_STATS_COUNTER(outpkts);
 756         IP_VS_ZERO_STATS_COUNTER(inbytes);
 757         IP_VS_ZERO_STATS_COUNTER(outbytes);
 758
 759         ip_vs_zero_estimator(stats);
 760
 761         spin_unlock_bh(&stats->lock);
 762 }
 763
 764 /*
 765  *      Update a destination in the given service
 766  */
 767 static void
 768 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
 769                     struct ip_vs_dest_user_kern *udest, int add)
 770 {
 771         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 772         int conn_flags;
 773
 774         /* set the weight and the flags */
 775         atomic_set(&dest->weight, udest->weight);
 776         conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
 777         conn_flags |= IP_VS_CONN_F_INACTIVE;
 778
 779         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 780         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
 781                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 782         } else {
 783                 /*
 784                  *    Put the real service in rs_table if not present.
 785                  *    For now only for NAT!
 786                  */
 787                 write_lock_bh(&ipvs->rs_lock);
 788                 ip_vs_rs_hash(ipvs, dest);
 789                 write_unlock_bh(&ipvs->rs_lock);
 790         }
 791         atomic_set(&dest->conn_flags, conn_flags);
 792
 793         /* bind the service */
 794         if (!dest->svc) {
 795                 __ip_vs_bind_svc(dest, svc);
 796         } else {
 797                 if (dest->svc != svc) {
 798                         __ip_vs_unbind_svc(dest);
 799                         ip_vs_zero_stats(&dest->stats);
 800                         __ip_vs_bind_svc(dest, svc);
 801                 }
 802         }
 803
 804         /* set the dest status flags */
 805         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 806
 807         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 808                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 809         dest->u_threshold = udest->u_threshold;
 810         dest->l_threshold = udest->l_threshold;
 811
 812         spin_lock_bh(&dest->dst_lock);
 813         ip_vs_dst_reset(dest);
 814         spin_unlock_bh(&dest->dst_lock);
 815
 816         if (add)
 817                 ip_vs_start_estimator(svc->net, &dest->stats);
 818
 819         write_lock_bh(&__ip_vs_svc_lock);
 820
 821         /* Wait until all other svc users go away */
 822         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
 823
 824         if (add) {
 825                 list_add(&dest->n_list, &svc->destinations);
 826                 svc->num_dests++;
 827         }
 828
 829         /* call the update_service, because server weight may be changed */
 830         if (svc->scheduler->update_service)
 831                 svc->scheduler->update_service(svc);
 832
 833         write_unlock_bh(&__ip_vs_svc_lock);
 834 }
 835
 836
 837 /*
 838  *      Create a destination for the given service
 839  */
 840 static int
 841 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 842                struct ip_vs_dest **dest_p)
 843 {
 844         struct ip_vs_dest *dest;
 845         unsigned int atype;
 846
 847         EnterFunction(2);
 848
 849 #ifdef CONFIG_IP_VS_IPV6
 850         if (svc->af == AF_INET6) {
 851                 atype = ipv6_addr_type(&udest->addr.in6);
 852                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 853                         atype & IPV6_ADDR_LINKLOCAL) &&
 854                         !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
 855                         return -EINVAL;
 856         } else
 857 #endif
 858         {
 859                 atype = inet_addr_type(svc->net, udest->addr.ip);
 860                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 861                         return -EINVAL;
 862         }
 863
 864         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
 865         if (dest == NULL)
 866                 return -ENOMEM;
 867
 868         dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
 869         if (!dest->stats.cpustats)
 870                 goto err_alloc;
 871
 872         dest->af = svc->af;
 873         dest->protocol = svc->protocol;
 874         dest->vaddr = svc->addr;
 875         dest->vport = svc->port;
 876         dest->vfwmark = svc->fwmark;
 877         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 878         dest->port = udest->port;
 879
 880         atomic_set(&dest->activeconns, 0);
 881         atomic_set(&dest->inactconns, 0);
 882         atomic_set(&dest->persistconns, 0);
 883         atomic_set(&dest->refcnt, 1);
 884
 885         INIT_LIST_HEAD(&dest->d_list);
 886         spin_lock_init(&dest->dst_lock);
 887         spin_lock_init(&dest->stats.lock);
 888         __ip_vs_update_dest(svc, dest, udest, 1);
 889
 890         *dest_p = dest;
 891
 892         LeaveFunction(2);
 893         return 0;
 894
 895 err_alloc:
 896         kfree(dest);
 897         return -ENOMEM;
 898 }
 899
 900
 901 /*
 902  *      Add a destination into an existing service
 903  */
 904 static int
 905 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 906 {
 907         struct ip_vs_dest *dest;
 908         union nf_inet_addr daddr;
 909         __be16 dport = udest->port;
 910         int ret;
 911
 912         EnterFunction(2);
 913
 914         if (udest->weight < 0) {
 915                 pr_err("%s(): server weight less than zero\n", __func__);
 916                 return -ERANGE;
 917         }
 918
 919         if (udest->l_threshold > udest->u_threshold) {
 920                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 921                         __func__);
 922                 return -ERANGE;
 923         }
 924
 925         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 926
 927         /*
 928          * Check if the dest already exists in the list
 929          */
 930         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 931
 932         if (dest != NULL) {
 933                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 934                 return -EEXIST;
 935         }
 936
 937         /*
 938          * Check if the dest already exists in the trash and
 939          * is from the same service
 940          */
 941         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 942
 943         if (dest != NULL) {
 944                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 945                               "dest->refcnt=%d, service %u/%s:%u\n",
 946                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 947                               atomic_read(&dest->refcnt),
 948                               dest->vfwmark,
 949                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 950                               ntohs(dest->vport));
 951
 952                 /*
 953                  * Get the destination from the trash
 954                  */
 955                 list_del(&dest->n_list);
 956
 957                 __ip_vs_update_dest(svc, dest, udest, 1);
 958                 ret = 0;
 959         } else {
 960                 /*
 961                  * Allocate and initialize the dest structure
 962                  */
 963                 ret = ip_vs_new_dest(svc, udest, &dest);
 964         }
 965         LeaveFunction(2);
 966
 967         return ret;
 968 }
 969
 970
 971 /*
 972  *      Edit a destination in the given service
 973  */
 974 static int
 975 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 976 {
 977         struct ip_vs_dest *dest;
 978         union nf_inet_addr daddr;
 979         __be16 dport = udest->port;
 980
 981         EnterFunction(2);
 982
 983         if (udest->weight < 0) {
 984                 pr_err("%s(): server weight less than zero\n", __func__);
 985                 return -ERANGE;
 986         }
 987
 988         if (udest->l_threshold > udest->u_threshold) {
 989                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 990                         __func__);
 991                 return -ERANGE;
 992         }
 993
 994         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 995
 996         /*
 997          *  Lookup the destination list
 998          */
 999         dest = ip_vs_lookup_dest(svc, &daddr, dport);
1000
1001         if (dest == NULL) {
1002                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1003                 return -ENOENT;
1004         }
1005
1006         __ip_vs_update_dest(svc, dest, udest, 0);
1007         LeaveFunction(2);
1008
1009         return 0;
1010 }
1011
1012
1013 /*
1014  *      Delete a destination (must be already unlinked from the service)
1015  */
1016 static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1017 {
1018         struct netns_ipvs *ipvs = net_ipvs(net);
1019
1020         ip_vs_stop_estimator(net, &dest->stats);
1021
1022         /*
1023          *  Remove it from the d-linked list with the real services.
1024          */
1025         write_lock_bh(&ipvs->rs_lock);
1026         ip_vs_rs_unhash(dest);
1027         write_unlock_bh(&ipvs->rs_lock);
1028
1029         /*
1030          *  Decrease the refcnt of the dest, and free the dest
1031          *  if nobody refers to it (refcnt=0). Otherwise, throw
1032          *  the destination into the trash.
1033          */
1034         if (atomic_dec_and_test(&dest->refcnt)) {
1035                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1036                               dest->vfwmark,
1037                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1038                               ntohs(dest->port));
1039                 ip_vs_dst_reset(dest);
1040                 /* simply decrease svc->refcnt here, let the caller check
1041                    and release the service if nobody refers to it.
1042                    Only user context can release destination and service,
1043                    and only one user context can update virtual service at a
1044                    time, so the operation here is OK */
1045                 atomic_dec(&dest->svc->refcnt);
1046                 free_percpu(dest->stats.cpustats);
1047                 kfree(dest);
1048         } else {
1049                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1050                               "dest->refcnt=%d\n",
1051                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1052                               ntohs(dest->port),
1053                               atomic_read(&dest->refcnt));
1054                 list_add(&dest->n_list, &ipvs->dest_trash);
1055                 atomic_inc(&dest->refcnt);
1056         }
1057 }
1058
1059
1060 /*
1061  *      Unlink a destination from the given service
1062  */
1063 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1064                                 struct ip_vs_dest *dest,
1065                                 int svcupd)
1066 {
1067         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1068
1069         /*
1070          *  Remove it from the d-linked destination list.
1071          */
1072         list_del(&dest->n_list);
1073         svc->num_dests--;
1074
1075         /*
1076          *  Call the update_service function of its scheduler
1077          */
1078         if (svcupd && svc->scheduler->update_service)
1079                         svc->scheduler->update_service(svc);
1080 }
1081
1082
1083 /*
1084  *      Delete a destination server in the given service
1085  */
1086 static int
1087 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1088 {
1089         struct ip_vs_dest *dest;
1090         __be16 dport = udest->port;
1091
1092         EnterFunction(2);
1093
1094         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1095
1096         if (dest == NULL) {
1097                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1098                 return -ENOENT;
1099         }
1100
1101         write_lock_bh(&__ip_vs_svc_lock);
1102
1103         /*
1104          *      Wait until all other svc users go away.
1105          */
1106         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1107
1108         /*
1109          *      Unlink dest from the service
1110          */
1111         __ip_vs_unlink_dest(svc, dest, 1);
1112
1113         write_unlock_bh(&__ip_vs_svc_lock);
1114
1115         /*
1116          *      Delete the destination
1117          */
1118         __ip_vs_del_dest(svc->net, dest);
1119
1120         LeaveFunction(2);
1121
1122         return 0;
1123 }
1124
1125
1126 /*
1127  *      Add a service into the service hash table
1128  */
1129 static int
1130 ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
1131                   struct ip_vs_service **svc_p)
1132 {
1133         int ret = 0;
1134         struct ip_vs_scheduler *sched = NULL;
1135         struct ip_vs_pe *pe = NULL;
1136         struct ip_vs_service *svc = NULL;
1137         struct netns_ipvs *ipvs = net_ipvs(net);
1138
1139         /* increase the module use count */
1140         ip_vs_use_count_inc();
1141
1142         /* Lookup the scheduler by 'u->sched_name' */
1143         sched = ip_vs_scheduler_get(u->sched_name);
1144         if (sched == NULL) {
1145                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1146                 ret = -ENOENT;
1147                 goto out_err;
1148         }
1149
1150         if (u->pe_name && *u->pe_name) {
1151                 pe = ip_vs_pe_getbyname(u->pe_name);
1152                 if (pe == NULL) {
1153                         pr_info("persistence engine module ip_vs_pe_%s "
1154                                 "not found\n", u->pe_name);
1155                         ret = -ENOENT;
1156                         goto out_err;
1157                 }
1158         }
1159
1160 #ifdef CONFIG_IP_VS_IPV6
1161         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1162                 ret = -EINVAL;
1163                 goto out_err;
1164         }
1165 #endif
1166
1167         svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1168         if (svc == NULL) {
1169                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1170                 ret = -ENOMEM;
1171                 goto out_err;
1172         }
1173         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1174         if (!svc->stats.cpustats)
1175                 goto out_err;
1176
1177         /* I'm the first user of the service */
1178         atomic_set(&svc->usecnt, 0);
1179         atomic_set(&svc->refcnt, 0);
1180
1181         svc->af = u->af;
1182         svc->protocol = u->protocol;
1183         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1184         svc->port = u->port;
1185         svc->fwmark = u->fwmark;
1186         svc->flags = u->flags;
1187         svc->timeout = u->timeout * HZ;
1188         svc->netmask = u->netmask;
1189         svc->net = net;
1190
1191         INIT_LIST_HEAD(&svc->destinations);
1192         rwlock_init(&svc->sched_lock);
1193         spin_lock_init(&svc->stats.lock);
1194
1195         /* Bind the scheduler */
1196         ret = ip_vs_bind_scheduler(svc, sched);
1197         if (ret)
1198                 goto out_err;
1199         sched = NULL;
1200
1201         /* Bind the ct retriever */
1202         ip_vs_bind_pe(svc, pe);
1203         pe = NULL;
1204
1205         /* Update the virtual service counters */
1206         if (svc->port == FTPPORT)
1207                 atomic_inc(&ipvs->ftpsvc_counter);
1208         else if (svc->port == 0)
1209                 atomic_inc(&ipvs->nullsvc_counter);
1210
1211         ip_vs_start_estimator(net, &svc->stats);
1212
1213         /* Count only IPv4 services for old get/setsockopt interface */
1214         if (svc->af == AF_INET)
1215                 ipvs->num_services++;
1216
1217         /* Hash the service into the service table */
1218         write_lock_bh(&__ip_vs_svc_lock);
1219         ip_vs_svc_hash(svc);
1220         write_unlock_bh(&__ip_vs_svc_lock);
1221
1222         *svc_p = svc;
1223         /* Now there is a service - full throttle */
1224         ipvs->enable = 1;
1225         return 0;
1226
1227
1228  out_err:
1229         if (svc != NULL) {
1230                 ip_vs_unbind_scheduler(svc);
1231                 if (svc->inc) {
1232                         local_bh_disable();
1233                         ip_vs_app_inc_put(svc->inc);
1234                         local_bh_enable();
1235                 }
1236                 if (svc->stats.cpustats)
1237                         free_percpu(svc->stats.cpustats);
1238                 kfree(svc);
1239         }
1240         ip_vs_scheduler_put(sched);
1241         ip_vs_pe_put(pe);
1242
1243         /* decrease the module use count */
1244         ip_vs_use_count_dec();
1245
1246         return ret;
1247 }
1248
1249
1250 /*
1251  *      Edit a service and bind it with a new scheduler
1252  */
1253 static int
1254 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1255 {
1256         struct ip_vs_scheduler *sched, *old_sched;
1257         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1258         int ret = 0;
1259
1260         /*
1261          * Lookup the scheduler, by 'u->sched_name'
1262          */
1263         sched = ip_vs_scheduler_get(u->sched_name);
1264         if (sched == NULL) {
1265                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1266                 return -ENOENT;
1267         }
1268         old_sched = sched;
1269
1270         if (u->pe_name && *u->pe_name) {
1271                 pe = ip_vs_pe_getbyname(u->pe_name);
1272                 if (pe == NULL) {
1273                         pr_info("persistence engine module ip_vs_pe_%s "
1274                                 "not found\n", u->pe_name);
1275                         ret = -ENOENT;
1276                         goto out;
1277                 }
1278                 old_pe = pe;
1279         }
1280
1281 #ifdef CONFIG_IP_VS_IPV6
1282         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1283                 ret = -EINVAL;
1284                 goto out;
1285         }
1286 #endif
1287
1288         write_lock_bh(&__ip_vs_svc_lock);
1289
1290         /*
1291          * Wait until all other svc users go away.
1292          */
1293         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1294
1295         /*
1296          * Set the flags and timeout value
1297          */
1298         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1299         svc->timeout = u->timeout * HZ;
1300         svc->netmask = u->netmask;
1301
1302         old_sched = svc->scheduler;
1303         if (sched != old_sched) {
1304                 /*
1305                  * Unbind the old scheduler
1306                  */
1307                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1308                         old_sched = sched;
1309                         goto out_unlock;
1310                 }
1311
1312                 /*
1313                  * Bind the new scheduler
1314                  */
1315                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1316                         /*
1317                          * If ip_vs_bind_scheduler fails, restore the old
1318                          * scheduler.
1319                          * The main reason of failure is out of memory.
1320                          *
1321                          * The question is if the old scheduler can be
1322                          * restored all the time. TODO: if it cannot be
1323                          * restored some time, we must delete the service,
1324                          * otherwise the system may crash.
1325                          */
1326                         ip_vs_bind_scheduler(svc, old_sched);
1327                         old_sched = sched;
1328                         goto out_unlock;
1329                 }
1330         }
1331
1332         old_pe = svc->pe;
1333         if (pe != old_pe) {
1334                 ip_vs_unbind_pe(svc);
1335                 ip_vs_bind_pe(svc, pe);
1336         }
1337
1338 out_unlock:
1339         write_unlock_bh(&__ip_vs_svc_lock);
1340 out:
1341         ip_vs_scheduler_put(old_sched);
1342         ip_vs_pe_put(old_pe);
1343         return ret;
1344 }
1345
1346
1347 /*
1348  *      Delete a service from the service list
1349  *      - The service must be unlinked, unlocked and not referenced!
1350  *      - We are called under _bh lock
1351  */
1352 static void __ip_vs_del_service(struct ip_vs_service *svc)
1353 {
1354         struct ip_vs_dest *dest, *nxt;
1355         struct ip_vs_scheduler *old_sched;
1356         struct ip_vs_pe *old_pe;
1357         struct netns_ipvs *ipvs = net_ipvs(svc->net);
1358
1359         pr_info("%s: enter\n", __func__);
1360
1361         /* Count only IPv4 services for old get/setsockopt interface */
1362         if (svc->af == AF_INET)
1363                 ipvs->num_services--;
1364
1365         ip_vs_stop_estimator(svc->net, &svc->stats);
1366
1367         /* Unbind scheduler */
1368         old_sched = svc->scheduler;
1369         ip_vs_unbind_scheduler(svc);
1370         ip_vs_scheduler_put(old_sched);
1371
1372         /* Unbind persistence engine */
1373         old_pe = svc->pe;
1374         ip_vs_unbind_pe(svc);
1375         ip_vs_pe_put(old_pe);
1376
1377         /* Unbind app inc */
1378         if (svc->inc) {
1379                 ip_vs_app_inc_put(svc->inc);
1380                 svc->inc = NULL;
1381         }
1382
1383         /*
1384          *    Unlink the whole destination list
1385          */
1386         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1387                 __ip_vs_unlink_dest(svc, dest, 0);
1388                 __ip_vs_del_dest(svc->net, dest);
1389         }
1390
1391         /*
1392          *    Update the virtual service counters
1393          */
1394         if (svc->port == FTPPORT)
1395                 atomic_dec(&ipvs->ftpsvc_counter);
1396         else if (svc->port == 0)
1397                 atomic_dec(&ipvs->nullsvc_counter);
1398
1399         /*
1400          *    Free the service if nobody refers to it
1401          */
1402         if (atomic_read(&svc->refcnt) == 0) {
1403                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1404                               svc->fwmark,
1405                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
1406                               ntohs(svc->port), atomic_read(&svc->usecnt));
1407                 free_percpu(svc->stats.cpustats);
1408                 kfree(svc);
1409         }
1410
1411         /* decrease the module use count */
1412         ip_vs_use_count_dec();
1413 }
1414
1415 /*
1416  * Unlink a service from list and try to delete it if its refcnt reached 0
1417  */
1418 static void ip_vs_unlink_service(struct ip_vs_service *svc)
1419 {
1420         /*
1421          * Unhash it from the service table
1422          */
1423         write_lock_bh(&__ip_vs_svc_lock);
1424
1425         ip_vs_svc_unhash(svc);
1426
1427         /*
1428          * Wait until all the svc users go away.
1429          */
1430         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1431
1432         __ip_vs_del_service(svc);
1433
1434         write_unlock_bh(&__ip_vs_svc_lock);
1435 }
1436
1437 /*
1438  *      Delete a service from the service list
1439  */
1440 static int ip_vs_del_service(struct ip_vs_service *svc)
1441 {
1442         if (svc == NULL)
1443                 return -EEXIST;
1444         ip_vs_unlink_service(svc);
1445
1446         return 0;
1447 }
1448
1449
1450 /*
1451  *      Flush all the virtual services
1452  */
1453 static int ip_vs_flush(struct net *net)
1454 {
1455         int idx;
1456         struct ip_vs_service *svc, *nxt;
1457
1458         /*
1459          * Flush the service table hashed by <netns,protocol,addr,port>
1460          */
1461         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1462                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1463                                          s_list) {
1464                         if (net_eq(svc->net, net))
1465                                 ip_vs_unlink_service(svc);
1466                 }
1467         }
1468
1469         /*
1470          * Flush the service table hashed by fwmark
1471          */
1472         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1473                 list_for_each_entry_safe(svc, nxt,
1474                                          &ip_vs_svc_fwm_table[idx], f_list) {
1475                         if (net_eq(svc->net, net))
1476                                 ip_vs_unlink_service(svc);
1477                 }
1478         }
1479
1480         return 0;
1481 }
1482
1483 /*
1484  *      Delete service by {netns} in the service table.
1485  *      Called by __ip_vs_cleanup()
1486  */
1487 void ip_vs_service_net_cleanup(struct net *net)
1488 {
1489         EnterFunction(2);
1490         /* Check for "full" addressed entries */
1491         mutex_lock(&__ip_vs_mutex);
1492         ip_vs_flush(net);
1493         mutex_unlock(&__ip_vs_mutex);
1494         LeaveFunction(2);
1495 }
1496 /*
1497  * Release dst hold by dst_cache
1498  */
1499 static inline void
1500 __ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1501 {
1502         spin_lock_bh(&dest->dst_lock);
1503         if (dest->dst_cache && dest->dst_cache->dev == dev) {
1504                 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1505                               dev->name,
1506                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1507                               ntohs(dest->port),
1508                               atomic_read(&dest->refcnt));
1509                 ip_vs_dst_reset(dest);
1510         }
1511         spin_unlock_bh(&dest->dst_lock);
1512
1513 }
1514 /*
1515  * Netdev event receiver
1516  * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1517  * a device that is "unregister" it must be released.
1518  */
1519 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1520                             void *ptr)
1521 {
1522         struct net_device *dev = ptr;
1523         struct net *net = dev_net(dev);
1524         struct netns_ipvs *ipvs = net_ipvs(net);
1525         struct ip_vs_service *svc;
1526         struct ip_vs_dest *dest;
1527         unsigned int idx;
1528
1529         if (event != NETDEV_UNREGISTER || !ipvs)
1530                 return NOTIFY_DONE;
1531         IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1532         EnterFunction(2);
1533         mutex_lock(&__ip_vs_mutex);
1534         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1535                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1536                         if (net_eq(svc->net, net)) {
1537                                 list_for_each_entry(dest, &svc->destinations,
1538                                                     n_list) {
1539                                         __ip_vs_dev_reset(dest, dev);
1540                                 }
1541                         }
1542                 }
1543
1544                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1545                         if (net_eq(svc->net, net)) {
1546                                 list_for_each_entry(dest, &svc->destinations,
1547                                                     n_list) {
1548                                         __ip_vs_dev_reset(dest, dev);
1549                                 }
1550                         }
1551
1552                 }
1553         }
1554
1555         list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
1556                 __ip_vs_dev_reset(dest, dev);
1557         }
1558         mutex_unlock(&__ip_vs_mutex);
1559         LeaveFunction(2);
1560         return NOTIFY_DONE;
1561 }
1562
1563 /*
1564  *      Zero counters in a service or all services
1565  */
1566 static int ip_vs_zero_service(struct ip_vs_service *svc)
1567 {
1568         struct ip_vs_dest *dest;
1569
1570         write_lock_bh(&__ip_vs_svc_lock);
1571         list_for_each_entry(dest, &svc->destinations, n_list) {
1572                 ip_vs_zero_stats(&dest->stats);
1573         }
1574         ip_vs_zero_stats(&svc->stats);
1575         write_unlock_bh(&__ip_vs_svc_lock);
1576         return 0;
1577 }
1578
1579 static int ip_vs_zero_all(struct net *net)
1580 {
1581         int idx;
1582         struct ip_vs_service *svc;
1583
1584         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1585                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1586                         if (net_eq(svc->net, net))
1587                                 ip_vs_zero_service(svc);
1588                 }
1589         }
1590
1591         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1592                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1593                         if (net_eq(svc->net, net))
1594                                 ip_vs_zero_service(svc);
1595                 }
1596         }
1597
1598         ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1599         return 0;
1600 }
1601
1602 #ifdef CONFIG_SYSCTL
1603
1604 static int zero;
1605 static int three = 3;
1606
1607 static int
1608 proc_do_defense_mode(ctl_table *table, int write,
1609                      void __user *buffer, size_t *lenp, loff_t *ppos)
1610 {
1611         struct net *net = current->nsproxy->net_ns;
1612         int *valp = table->data;
1613         int val = *valp;
1614         int rc;
1615
1616         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1617         if (write && (*valp != val)) {
1618                 if ((*valp < 0) || (*valp > 3)) {
1619                         /* Restore the correct value */
1620                         *valp = val;
1621                 } else {
1622                         update_defense_level(net_ipvs(net));
1623                 }
1624         }
1625         return rc;
1626 }
1627
1628 static int
1629 proc_do_sync_threshold(ctl_table *table, int write,
1630                        void __user *buffer, size_t *lenp, loff_t *ppos)
1631 {
1632         int *valp = table->data;
1633         int val[2];
1634         int rc;
1635
1636         /* backup the value first */
1637         memcpy(val, valp, sizeof(val));
1638
1639         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1640         if (write && (valp[0] < 0 || valp[1] < 0 ||
1641             (valp[0] >= valp[1] && valp[1]))) {
1642                 /* Restore the correct value */
1643                 memcpy(valp, val, sizeof(val));
1644         }
1645         return rc;
1646 }
1647
1648 static int
1649 proc_do_sync_mode(ctl_table *table, int write,
1650                      void __user *buffer, size_t *lenp, loff_t *ppos)
1651 {
1652         int *valp = table->data;
1653         int val = *valp;
1654         int rc;
1655
1656         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1657         if (write && (*valp != val)) {
1658                 if ((*valp < 0) || (*valp > 1)) {
1659                         /* Restore the correct value */
1660                         *valp = val;
1661                 }
1662         }
1663         return rc;
1664 }
1665
1666 static int
1667 proc_do_sync_ports(ctl_table *table, int write,
1668                    void __user *buffer, size_t *lenp, loff_t *ppos)
1669 {
1670         int *valp = table->data;
1671         int val = *valp;
1672         int rc;
1673
1674         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1675         if (write && (*valp != val)) {
1676                 if (*valp < 1 || !is_power_of_2(*valp)) {
1677                         /* Restore the correct value */
1678                         *valp = val;
1679                 }
1680         }
1681         return rc;
1682 }
1683
1684 /*
1685  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1686  *      Do not change order or insert new entries without
1687  *      align with netns init in ip_vs_control_net_init()
1688  */
1689
1690 static struct ctl_table vs_vars[] = {
1691         {
1692                 .procname       = "amemthresh",
1693                 .maxlen         = sizeof(int),
1694                 .mode           = 0644,
1695                 .proc_handler   = proc_dointvec,
1696         },
1697         {
1698                 .procname       = "am_droprate",
1699                 .maxlen         = sizeof(int),
1700                 .mode           = 0644,
1701                 .proc_handler   = proc_dointvec,
1702         },
1703         {
1704                 .procname       = "drop_entry",
1705                 .maxlen         = sizeof(int),
1706                 .mode           = 0644,
1707                 .proc_handler   = proc_do_defense_mode,
1708         },
1709         {
1710                 .procname       = "drop_packet",
1711                 .maxlen         = sizeof(int),
1712                 .mode           = 0644,
1713                 .proc_handler   = proc_do_defense_mode,
1714         },
1715 #ifdef CONFIG_IP_VS_NFCT
1716         {
1717                 .procname       = "conntrack",
1718                 .maxlen         = sizeof(int),
1719                 .mode           = 0644,
1720                 .proc_handler   = &proc_dointvec,
1721         },
1722 #endif
1723         {
1724                 .procname       = "secure_tcp",
1725                 .maxlen         = sizeof(int),
1726                 .mode           = 0644,
1727                 .proc_handler   = proc_do_defense_mode,
1728         },
1729         {
1730                 .procname       = "snat_reroute",
1731                 .maxlen         = sizeof(int),
1732                 .mode           = 0644,
1733                 .proc_handler   = &proc_dointvec,
1734         },
1735         {
1736                 .procname       = "sync_version",
1737                 .maxlen         = sizeof(int),
1738                 .mode           = 0644,
1739                 .proc_handler   = &proc_do_sync_mode,
1740         },
1741         {
1742                 .procname       = "sync_ports",
1743                 .maxlen         = sizeof(int),
1744                 .mode           = 0644,
1745                 .proc_handler   = &proc_do_sync_ports,
1746         },
1747         {
1748                 .procname       = "sync_qlen_max",
1749                 .maxlen         = sizeof(int),
1750                 .mode           = 0644,
1751                 .proc_handler   = proc_dointvec,
1752         },
1753         {
1754                 .procname       = "sync_sock_size",
1755                 .maxlen         = sizeof(int),
1756                 .mode           = 0644,
1757                 .proc_handler   = proc_dointvec,
1758         },
1759         {
1760                 .procname       = "cache_bypass",
1761                 .maxlen         = sizeof(int),
1762                 .mode           = 0644,
1763                 .proc_handler   = proc_dointvec,
1764         },
1765         {
1766                 .procname       = "expire_nodest_conn",
1767                 .maxlen         = sizeof(int),
1768                 .mode           = 0644,
1769                 .proc_handler   = proc_dointvec,
1770         },
1771         {
1772                 .procname       = "expire_quiescent_template",
1773                 .maxlen         = sizeof(int),
1774                 .mode           = 0644,
1775                 .proc_handler   = proc_dointvec,
1776         },
1777         {
1778                 .procname       = "sync_threshold",
1779                 .maxlen         =
1780                         sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1781                 .mode           = 0644,
1782                 .proc_handler   = proc_do_sync_threshold,
1783         },
1784         {
1785                 .procname       = "sync_refresh_period",
1786                 .maxlen         = sizeof(int),
1787                 .mode           = 0644,
1788                 .proc_handler   = proc_dointvec_jiffies,
1789         },
1790         {
1791                 .procname       = "sync_retries",
1792                 .maxlen         = sizeof(int),
1793                 .mode           = 0644,
1794                 .proc_handler   = proc_dointvec_minmax,
1795                 .extra1         = &zero,
1796                 .extra2         = &three,
1797         },
1798         {
1799                 .procname       = "nat_icmp_send",
1800                 .maxlen         = sizeof(int),
1801                 .mode           = 0644,
1802                 .proc_handler   = proc_dointvec,
1803         },
1804         {
1805                 .procname       = "pmtu_disc",
1806                 .maxlen         = sizeof(int),
1807                 .mode           = 0644,
1808                 .proc_handler   = proc_dointvec,
1809         },
1810 #ifdef CONFIG_IP_VS_DEBUG
1811         {
1812                 .procname       = "debug_level",
1813                 .data           = &sysctl_ip_vs_debug_level,
1814                 .maxlen         = sizeof(int),
1815                 .mode           = 0644,
1816                 .proc_handler   = proc_dointvec,
1817         },
1818 #endif
1819 #if 0
1820         {
1821                 .procname       = "timeout_established",
1822                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1823                 .maxlen         = sizeof(int),
1824                 .mode           = 0644,
1825                 .proc_handler   = proc_dointvec_jiffies,
1826         },
1827         {
1828                 .procname       = "timeout_synsent",
1829                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1830                 .maxlen         = sizeof(int),
1831                 .mode           = 0644,
1832                 .proc_handler   = proc_dointvec_jiffies,
1833         },
1834         {
1835                 .procname       = "timeout_synrecv",
1836                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1837                 .maxlen         = sizeof(int),
1838                 .mode           = 0644,
1839                 .proc_handler   = proc_dointvec_jiffies,
1840         },
1841         {
1842                 .procname       = "timeout_finwait",
1843                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1844                 .maxlen         = sizeof(int),
1845                 .mode           = 0644,
1846                 .proc_handler   = proc_dointvec_jiffies,
1847         },
1848         {
1849                 .procname       = "timeout_timewait",
1850                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1851                 .maxlen         = sizeof(int),
1852                 .mode           = 0644,
1853                 .proc_handler   = proc_dointvec_jiffies,
1854         },
1855         {
1856                 .procname       = "timeout_close",
1857                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1858                 .maxlen         = sizeof(int),
1859                 .mode           = 0644,
1860                 .proc_handler   = proc_dointvec_jiffies,
1861         },
1862         {
1863                 .procname       = "timeout_closewait",
1864                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1865                 .maxlen         = sizeof(int),
1866                 .mode           = 0644,
1867                 .proc_handler   = proc_dointvec_jiffies,
1868         },
1869         {
1870                 .procname       = "timeout_lastack",
1871                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1872                 .maxlen         = sizeof(int),
1873                 .mode           = 0644,
1874                 .proc_handler   = proc_dointvec_jiffies,
1875         },
1876         {
1877                 .procname       = "timeout_listen",
1878                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1879                 .maxlen         = sizeof(int),
1880                 .mode           = 0644,
1881                 .proc_handler   = proc_dointvec_jiffies,
1882         },
1883         {
1884                 .procname       = "timeout_synack",
1885                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1886                 .maxlen         = sizeof(int),
1887                 .mode           = 0644,
1888                 .proc_handler   = proc_dointvec_jiffies,
1889         },
1890         {
1891                 .procname       = "timeout_udp",
1892                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1893                 .maxlen         = sizeof(int),
1894                 .mode           = 0644,
1895                 .proc_handler   = proc_dointvec_jiffies,
1896         },
1897         {
1898                 .procname       = "timeout_icmp",
1899                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1900                 .maxlen         = sizeof(int),
1901                 .mode           = 0644,
1902                 .proc_handler   = proc_dointvec_jiffies,
1903         },
1904 #endif
1905         { }
1906 };
1907
1908 #endif
1909
1910 #ifdef CONFIG_PROC_FS
1911
1912 struct ip_vs_iter {
1913         struct seq_net_private p;  /* Do not move this, netns depends upon it*/
1914         struct list_head *table;
1915         int bucket;
1916 };
1917
1918 /*
1919  *      Write the contents of the VS rule table to a PROCfs file.
1920  *      (It is kept just for backward compatibility)
1921  */
1922 static inline const char *ip_vs_fwd_name(unsigned int flags)
1923 {
1924         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1925         case IP_VS_CONN_F_LOCALNODE:
1926                 return "Local";
1927         case IP_VS_CONN_F_TUNNEL:
1928                 return "Tunnel";
1929         case IP_VS_CONN_F_DROUTE:
1930                 return "Route";
1931         default:
1932                 return "Masq";
1933         }
1934 }
1935
1936
1937 /* Get the Nth entry in the two lists */
1938 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1939 {
1940         struct net *net = seq_file_net(seq);
1941         struct ip_vs_iter *iter = seq->private;
1942         int idx;
1943         struct ip_vs_service *svc;
1944
1945         /* look in hash by protocol */
1946         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1947                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1948                         if (net_eq(svc->net, net) && pos-- == 0) {
1949                                 iter->table = ip_vs_svc_table;
1950                                 iter->bucket = idx;
1951                                 return svc;
1952                         }
1953                 }
1954         }
1955
1956         /* keep looking in fwmark */
1957         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1958                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1959                         if (net_eq(svc->net, net) && pos-- == 0) {
1960                                 iter->table = ip_vs_svc_fwm_table;
1961                                 iter->bucket = idx;
1962                                 return svc;
1963                         }
1964                 }
1965         }
1966
1967         return NULL;
1968 }
1969
1970 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1971 __acquires(__ip_vs_svc_lock)
1972 {
1973
1974         read_lock_bh(&__ip_vs_svc_lock);
1975         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1976 }
1977
1978
1979 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1980 {
1981         struct list_head *e;
1982         struct ip_vs_iter *iter;
1983         struct ip_vs_service *svc;
1984
1985         ++*pos;
1986         if (v == SEQ_START_TOKEN)
1987                 return ip_vs_info_array(seq,0);
1988
1989         svc = v;
1990         iter = seq->private;
1991
1992         if (iter->table == ip_vs_svc_table) {
1993                 /* next service in table hashed by protocol */
1994                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1995                         return list_entry(e, struct ip_vs_service, s_list);
1996
1997
1998                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1999                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
2000                                             s_list) {
2001                                 return svc;
2002                         }
2003                 }
2004
2005                 iter->table = ip_vs_svc_fwm_table;
2006                 iter->bucket = -1;
2007                 goto scan_fwmark;
2008         }
2009
2010         /* next service in hashed by fwmark */
2011         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
2012                 return list_entry(e, struct ip_vs_service, f_list);
2013
2014  scan_fwmark:
2015         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2016                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
2017                                     f_list)
2018                         return svc;
2019         }
2020
2021         return NULL;
2022 }
2023
2024 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
2025 __releases(__ip_vs_svc_lock)
2026 {
2027         read_unlock_bh(&__ip_vs_svc_lock);
2028 }
2029
2030
2031 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
2032 {
2033         if (v == SEQ_START_TOKEN) {
2034                 seq_printf(seq,
2035                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
2036                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2037                 seq_puts(seq,
2038                          "Prot LocalAddress:Port Scheduler Flags\n");
2039                 seq_puts(seq,
2040                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
2041         } else {
2042                 const struct ip_vs_service *svc = v;
2043                 const struct ip_vs_iter *iter = seq->private;
2044                 const struct ip_vs_dest *dest;
2045
2046                 if (iter->table == ip_vs_svc_table) {
2047 #ifdef CONFIG_IP_VS_IPV6
2048                         if (svc->af == AF_INET6)
2049                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
2050                                            ip_vs_proto_name(svc->protocol),
2051                                            &svc->addr.in6,
2052                                            ntohs(svc->port),
2053                                            svc->scheduler->name);
2054                         else
2055 #endif
2056                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
2057                                            ip_vs_proto_name(svc->protocol),
2058                                            ntohl(svc->addr.ip),
2059                                            ntohs(svc->port),
2060                                            svc->scheduler->name,
2061                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2062                 } else {
2063                         seq_printf(seq, "FWM  %08X %s %s",
2064                                    svc->fwmark, svc->scheduler->name,
2065                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2066                 }
2067
2068                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2069                         seq_printf(seq, "persistent %d %08X\n",
2070                                 svc->timeout,
2071                                 ntohl(svc->netmask));
2072                 else
2073                         seq_putc(seq, '\n');
2074
2075                 list_for_each_entry(dest, &svc->destinations, n_list) {
2076 #ifdef CONFIG_IP_VS_IPV6
2077                         if (dest->af == AF_INET6)
2078                                 seq_printf(seq,
2079                                            "  -> [%pI6]:%04X"
2080                                            "      %-7s %-6d %-10d %-10d\n",
2081                                            &dest->addr.in6,
2082                                            ntohs(dest->port),
2083                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2084                                            atomic_read(&dest->weight),
2085                                            atomic_read(&dest->activeconns),
2086                                            atomic_read(&dest->inactconns));
2087                         else
2088 #endif
2089                                 seq_printf(seq,
2090                                            "  -> %08X:%04X      "
2091                                            "%-7s %-6d %-10d %-10d\n",
2092                                            ntohl(dest->addr.ip),
2093                                            ntohs(dest->port),
2094                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2095                                            atomic_read(&dest->weight),
2096                                            atomic_read(&dest->activeconns),
2097                                            atomic_read(&dest->inactconns));
2098
2099                 }
2100         }
2101         return 0;
2102 }
2103
2104 static const struct seq_operations ip_vs_info_seq_ops = {
2105         .start = ip_vs_info_seq_start,
2106         .next  = ip_vs_info_seq_next,
2107         .stop  = ip_vs_info_seq_stop,
2108         .show  = ip_vs_info_seq_show,
2109 };
2110
2111 static int ip_vs_info_open(struct inode *inode, struct file *file)
2112 {
2113         return seq_open_net(inode, file, &ip_vs_info_seq_ops,
2114                         sizeof(struct ip_vs_iter));
2115 }
2116
2117 static const struct file_operations ip_vs_info_fops = {
2118         .owner   = THIS_MODULE,
2119         .open    = ip_vs_info_open,
2120         .read    = seq_read,
2121         .llseek  = seq_lseek,
2122         .release = seq_release_net,
2123 };
2124
2125 static int ip_vs_stats_show(struct seq_file *seq, void *v)
2126 {
2127         struct net *net = seq_file_single_net(seq);
2128         struct ip_vs_stats_user show;
2129
2130 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2131         seq_puts(seq,
2132                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
2133         seq_printf(seq,
2134                    "   Conns  Packets  Packets            Bytes            Bytes\n");
2135
2136         ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2137         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2138                    show.inpkts, show.outpkts,
2139                    (unsigned long long) show.inbytes,
2140                    (unsigned long long) show.outbytes);
2141
2142 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2143         seq_puts(seq,
2144                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2145         seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2146                         show.cps, show.inpps, show.outpps,
2147                         show.inbps, show.outbps);
2148
2149         return 0;
2150 }
2151
2152 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2153 {
2154         return single_open_net(inode, file, ip_vs_stats_show);
2155 }
2156
2157 static const struct file_operations ip_vs_stats_fops = {
2158         .owner = THIS_MODULE,
2159         .open = ip_vs_stats_seq_open,
2160         .read = seq_read,
2161         .llseek = seq_lseek,
2162         .release = single_release_net,
2163 };
2164
2165 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2166 {
2167         struct net *net = seq_file_single_net(seq);
2168         struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2169         struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
2170         struct ip_vs_stats_user rates;
2171         int i;
2172
2173 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2174         seq_puts(seq,
2175                  "       Total Incoming Outgoing         Incoming         Outgoing\n");
2176         seq_printf(seq,
2177                    "CPU    Conns  Packets  Packets            Bytes            Bytes\n");
2178
2179         for_each_possible_cpu(i) {
2180                 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2181                 unsigned int start;
2182                 __u64 inbytes, outbytes;
2183
2184                 do {
2185                         start = u64_stats_fetch_begin_bh(&u->syncp);
2186                         inbytes = u->ustats.inbytes;
2187                         outbytes = u->ustats.outbytes;
2188                 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2189
2190                 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2191                            i, u->ustats.conns, u->ustats.inpkts,
2192                            u->ustats.outpkts, (__u64)inbytes,
2193                            (__u64)outbytes);
2194         }
2195
2196         spin_lock_bh(&tot_stats->lock);
2197
2198         seq_printf(seq, "  ~ %8X %8X %8X %16LX %16LX\n\n",
2199                    tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2200                    tot_stats->ustats.outpkts,
2201                    (unsigned long long) tot_stats->ustats.inbytes,
2202                    (unsigned long long) tot_stats->ustats.outbytes);
2203
2204         ip_vs_read_estimator(&rates, tot_stats);
2205
2206         spin_unlock_bh(&tot_stats->lock);
2207
2208 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2209         seq_puts(seq,
2210                    "     Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2211         seq_printf(seq, "    %8X %8X %8X %16X %16X\n",
2212                         rates.cps,
2213                         rates.inpps,
2214                         rates.outpps,
2215                         rates.inbps,
2216                         rates.outbps);
2217
2218         return 0;
2219 }
2220
2221 static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2222 {
2223         return single_open_net(inode, file, ip_vs_stats_percpu_show);
2224 }
2225
2226 static const struct file_operations ip_vs_stats_percpu_fops = {
2227         .owner = THIS_MODULE,
2228         .open = ip_vs_stats_percpu_seq_open,
2229         .read = seq_read,
2230         .llseek = seq_lseek,
2231         .release = single_release_net,
2232 };
2233 #endif
2234
2235 /*
2236  *      Set timeout values for tcp tcpfin udp in the timeout_table.
2237  */
2238 static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
2239 {
2240 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2241         struct ip_vs_proto_data *pd;
2242 #endif
2243
2244         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2245                   u->tcp_timeout,
2246                   u->tcp_fin_timeout,
2247                   u->udp_timeout);
2248
2249 #ifdef CONFIG_IP_VS_PROTO_TCP
2250         if (u->tcp_timeout) {
2251                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2252                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2253                         = u->tcp_timeout * HZ;
2254         }
2255
2256         if (u->tcp_fin_timeout) {
2257                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2258                 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2259                         = u->tcp_fin_timeout * HZ;
2260         }
2261 #endif
2262
2263 #ifdef CONFIG_IP_VS_PROTO_UDP
2264         if (u->udp_timeout) {
2265                 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2266                 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2267                         = u->udp_timeout * HZ;
2268         }
2269 #endif
2270         return 0;
2271 }
2272
2273
2274 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2275 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2276 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2277                                  sizeof(struct ip_vs_dest_user))
2278 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2279 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2280 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2281
2282 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2283         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2284         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2285         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2286         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2287         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2288         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2289         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2290         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2291         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2292         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2293         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2294 };
2295
2296 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2297                                   struct ip_vs_service_user *usvc_compat)
2298 {
2299         memset(usvc, 0, sizeof(*usvc));
2300
2301         usvc->af                = AF_INET;
2302         usvc->protocol          = usvc_compat->protocol;
2303         usvc->addr.ip           = usvc_compat->addr;
2304         usvc->port              = usvc_compat->port;
2305         usvc->fwmark            = usvc_compat->fwmark;
2306
2307         /* Deep copy of sched_name is not needed here */
2308         usvc->sched_name        = usvc_compat->sched_name;
2309
2310         usvc->flags             = usvc_compat->flags;
2311         usvc->timeout           = usvc_compat->timeout;
2312         usvc->netmask           = usvc_compat->netmask;
2313 }
2314
2315 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2316                                    struct ip_vs_dest_user *udest_compat)
2317 {
2318         memset(udest, 0, sizeof(*udest));
2319
2320         udest->addr.ip          = udest_compat->addr;
2321         udest->port             = udest_compat->port;
2322         udest->conn_flags       = udest_compat->conn_flags;
2323         udest->weight           = udest_compat->weight;
2324         udest->u_threshold      = udest_compat->u_threshold;
2325         udest->l_threshold      = udest_compat->l_threshold;
2326 }
2327
2328 static int
2329 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2330 {
2331         struct net *net = sock_net(sk);
2332         int ret;
2333         unsigned char arg[MAX_ARG_LEN];
2334         struct ip_vs_service_user *usvc_compat;
2335         struct ip_vs_service_user_kern usvc;
2336         struct ip_vs_service *svc;
2337         struct ip_vs_dest_user *udest_compat;
2338         struct ip_vs_dest_user_kern udest;
2339         struct netns_ipvs *ipvs = net_ipvs(net);
2340
2341         if (!capable(CAP_NET_ADMIN))
2342                 return -EPERM;
2343
2344         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2345                 return -EINVAL;
2346         if (len < 0 || len >  MAX_ARG_LEN)
2347                 return -EINVAL;
2348         if (len != set_arglen[SET_CMDID(cmd)]) {
2349                 pr_err("set_ctl: len %u != %u\n",
2350                        len, set_arglen[SET_CMDID(cmd)]);
2351                 return -EINVAL;
2352         }
2353
2354         if (copy_from_user(arg, user, len) != 0)
2355                 return -EFAULT;
2356
2357         /* increase the module use count */
2358         ip_vs_use_count_inc();
2359
2360         /* Handle daemons since they have another lock */
2361         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2362             cmd == IP_VS_SO_SET_STOPDAEMON) {
2363                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2364
2365                 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2366                         ret = -ERESTARTSYS;
2367                         goto out_dec;
2368                 }
2369                 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2370                         ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2371                                                 dm->syncid);
2372                 else
2373                         ret = stop_sync_thread(net, dm->state);
2374                 mutex_unlock(&ipvs->sync_mutex);
2375                 goto out_dec;
2376         }
2377
2378         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2379                 ret = -ERESTARTSYS;
2380                 goto out_dec;
2381         }
2382
2383         if (cmd == IP_VS_SO_SET_FLUSH) {
2384                 /* Flush the virtual service */
2385                 ret = ip_vs_flush(net);
2386                 goto out_unlock;
2387         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2388                 /* Set timeout values for (tcp tcpfin udp) */
2389                 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
2390                 goto out_unlock;
2391         }
2392
2393         usvc_compat = (struct ip_vs_service_user *)arg;
2394         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2395
2396         /* We only use the new structs internally, so copy userspace compat
2397          * structs to extended internal versions */
2398         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2399         ip_vs_copy_udest_compat(&udest, udest_compat);
2400
2401         if (cmd == IP_VS_SO_SET_ZERO) {
2402                 /* if no service address is set, zero counters in all */
2403                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2404                         ret = ip_vs_zero_all(net);
2405                         goto out_unlock;
2406                 }
2407         }
2408
2409         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2410         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2411             usvc.protocol != IPPROTO_SCTP) {
2412                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2413                        usvc.protocol, &usvc.addr.ip,
2414                        ntohs(usvc.port), usvc.sched_name);
2415                 ret = -EFAULT;
2416                 goto out_unlock;
2417         }
2418
2419         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2420         if (usvc.fwmark == 0)
2421                 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
2422                                            &usvc.addr, usvc.port);
2423         else
2424                 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
2425
2426         if (cmd != IP_VS_SO_SET_ADD
2427             && (svc == NULL || svc->protocol != usvc.protocol)) {
2428                 ret = -ESRCH;
2429                 goto out_unlock;
2430         }
2431
2432         switch (cmd) {
2433         case IP_VS_SO_SET_ADD:
2434                 if (svc != NULL)
2435                         ret = -EEXIST;
2436                 else
2437                         ret = ip_vs_add_service(net, &usvc, &svc);
2438                 break;
2439         case IP_VS_SO_SET_EDIT:
2440                 ret = ip_vs_edit_service(svc, &usvc);
2441                 break;
2442         case IP_VS_SO_SET_DEL:
2443                 ret = ip_vs_del_service(svc);
2444                 if (!ret)
2445                         goto out_unlock;
2446                 break;
2447         case IP_VS_SO_SET_ZERO:
2448                 ret = ip_vs_zero_service(svc);
2449                 break;
2450         case IP_VS_SO_SET_ADDDEST:
2451                 ret = ip_vs_add_dest(svc, &udest);
2452                 break;
2453         case IP_VS_SO_SET_EDITDEST:
2454                 ret = ip_vs_edit_dest(svc, &udest);
2455                 break;
2456         case IP_VS_SO_SET_DELDEST:
2457                 ret = ip_vs_del_dest(svc, &udest);
2458                 break;
2459         default:
2460                 ret = -EINVAL;
2461         }
2462
2463   out_unlock:
2464         mutex_unlock(&__ip_vs_mutex);
2465   out_dec:
2466         /* decrease the module use count */
2467         ip_vs_use_count_dec();
2468
2469         return ret;
2470 }
2471
2472
2473 static void
2474 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2475 {
2476         dst->protocol = src->protocol;
2477         dst->addr = src->addr.ip;
2478         dst->port = src->port;
2479         dst->fwmark = src->fwmark;
2480         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2481         dst->flags = src->flags;
2482         dst->timeout = src->timeout / HZ;
2483         dst->netmask = src->netmask;
2484         dst->num_dests = src->num_dests;
2485         ip_vs_copy_stats(&dst->stats, &src->stats);
2486 }
2487
2488 static inline int
2489 __ip_vs_get_service_entries(struct net *net,
2490                             const struct ip_vs_get_services *get,
2491                             struct ip_vs_get_services __user *uptr)
2492 {
2493         int idx, count=0;
2494         struct ip_vs_service *svc;
2495         struct ip_vs_service_entry entry;
2496         int ret = 0;
2497
2498         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2499                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2500                         /* Only expose IPv4 entries to old interface */
2501                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2502                                 continue;
2503
2504                         if (count >= get->num_services)
2505                                 goto out;
2506                         memset(&entry, 0, sizeof(entry));
2507                         ip_vs_copy_service(&entry, svc);
2508                         if (copy_to_user(&uptr->entrytable[count],
2509                                          &entry, sizeof(entry))) {
2510                                 ret = -EFAULT;
2511                                 goto out;
2512                         }
2513                         count++;
2514                 }
2515         }
2516
2517         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2518                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2519                         /* Only expose IPv4 entries to old interface */
2520                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2521                                 continue;
2522
2523                         if (count >= get->num_services)
2524                                 goto out;
2525                         memset(&entry, 0, sizeof(entry));
2526                         ip_vs_copy_service(&entry, svc);
2527                         if (copy_to_user(&uptr->entrytable[count],
2528                                          &entry, sizeof(entry))) {
2529                                 ret = -EFAULT;
2530                                 goto out;
2531                         }
2532                         count++;
2533                 }
2534         }
2535 out:
2536         return ret;
2537 }
2538
2539 static inline int
2540 __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
2541                          struct ip_vs_get_dests __user *uptr)
2542 {
2543         struct ip_vs_service *svc;
2544         union nf_inet_addr addr = { .ip = get->addr };
2545         int ret = 0;
2546
2547         if (get->fwmark)
2548                 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
2549         else
2550                 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
2551                                            get->port);
2552
2553         if (svc) {
2554                 int count = 0;
2555                 struct ip_vs_dest *dest;
2556                 struct ip_vs_dest_entry entry;
2557
2558                 list_for_each_entry(dest, &svc->destinations, n_list) {
2559                         if (count >= get->num_dests)
2560                                 break;
2561
2562                         entry.addr = dest->addr.ip;
2563                         entry.port = dest->port;
2564                         entry.conn_flags = atomic_read(&dest->conn_flags);
2565                         entry.weight = atomic_read(&dest->weight);
2566                         entry.u_threshold = dest->u_threshold;
2567                         entry.l_threshold = dest->l_threshold;
2568                         entry.activeconns = atomic_read(&dest->activeconns);
2569                         entry.inactconns = atomic_read(&dest->inactconns);
2570                         entry.persistconns = atomic_read(&dest->persistconns);
2571                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2572                         if (copy_to_user(&uptr->entrytable[count],
2573                                          &entry, sizeof(entry))) {
2574                                 ret = -EFAULT;
2575                                 break;
2576                         }
2577                         count++;
2578                 }
2579         } else
2580                 ret = -ESRCH;
2581         return ret;
2582 }
2583
2584 static inline void
2585 __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
2586 {
2587 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2588         struct ip_vs_proto_data *pd;
2589 #endif
2590
2591 #ifdef CONFIG_IP_VS_PROTO_TCP
2592         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2593         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2594         u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2595 #endif
2596 #ifdef CONFIG_IP_VS_PROTO_UDP
2597         pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2598         u->udp_timeout =
2599                         pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2600 #endif
2601 }
2602
2603
2604 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2605 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2606 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2607 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2608 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2609 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2610 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2611
2612 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2613         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2614         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2615         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2616         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2617         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2618         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2619         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2620 };
2621
2622 static int
2623 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2624 {
2625         unsigned char arg[128];
2626         int ret = 0;
2627         unsigned int copylen;
2628         struct net *net = sock_net(sk);
2629         struct netns_ipvs *ipvs = net_ipvs(net);
2630
2631         BUG_ON(!net);
2632         if (!capable(CAP_NET_ADMIN))
2633                 return -EPERM;
2634
2635         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2636                 return -EINVAL;
2637
2638         if (*len < get_arglen[GET_CMDID(cmd)]) {
2639                 pr_err("get_ctl: len %u < %u\n",
2640                        *len, get_arglen[GET_CMDID(cmd)]);
2641                 return -EINVAL;
2642         }
2643
2644         copylen = get_arglen[GET_CMDID(cmd)];
2645         if (copylen > 128)
2646                 return -EINVAL;
2647
2648         if (copy_from_user(arg, user, copylen) != 0)
2649                 return -EFAULT;
2650         /*
2651          * Handle daemons first since it has its own locking
2652          */
2653         if (cmd == IP_VS_SO_GET_DAEMON) {
2654                 struct ip_vs_daemon_user d[2];
2655
2656                 memset(&d, 0, sizeof(d));
2657                 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2658                         return -ERESTARTSYS;
2659
2660                 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2661                         d[0].state = IP_VS_STATE_MASTER;
2662                         strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2663                                 sizeof(d[0].mcast_ifn));
2664                         d[0].syncid = ipvs->master_syncid;
2665                 }
2666                 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2667                         d[1].state = IP_VS_STATE_BACKUP;
2668                         strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2669                                 sizeof(d[1].mcast_ifn));
2670                         d[1].syncid = ipvs->backup_syncid;
2671                 }
2672                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2673                         ret = -EFAULT;
2674                 mutex_unlock(&ipvs->sync_mutex);
2675                 return ret;
2676         }
2677
2678         if (mutex_lock_interruptible(&__ip_vs_mutex))
2679                 return -ERESTARTSYS;
2680
2681         switch (cmd) {
2682         case IP_VS_SO_GET_VERSION:
2683         {
2684                 char buf[64];
2685
2686                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2687                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2688                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2689                         ret = -EFAULT;
2690                         goto out;
2691                 }
2692                 *len = strlen(buf)+1;
2693         }
2694         break;
2695
2696         case IP_VS_SO_GET_INFO:
2697         {
2698                 struct ip_vs_getinfo info;
2699                 info.version = IP_VS_VERSION_CODE;
2700                 info.size = ip_vs_conn_tab_size;
2701                 info.num_services = ipvs->num_services;
2702                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2703                         ret = -EFAULT;
2704         }
2705         break;
2706
2707         case IP_VS_SO_GET_SERVICES:
2708         {
2709                 struct ip_vs_get_services *get;
2710                 int size;
2711
2712                 get = (struct ip_vs_get_services *)arg;
2713                 size = sizeof(*get) +
2714                         sizeof(struct ip_vs_service_entry) * get->num_services;
2715                 if (*len != size) {
2716                         pr_err("length: %u != %u\n", *len, size);
2717                         ret = -EINVAL;
2718                         goto out;
2719                 }
2720                 ret = __ip_vs_get_service_entries(net, get, user);
2721         }
2722         break;
2723
2724         case IP_VS_SO_GET_SERVICE:
2725         {
2726                 struct ip_vs_service_entry *entry;
2727                 struct ip_vs_service *svc;
2728                 union nf_inet_addr addr;
2729
2730                 entry = (struct ip_vs_service_entry *)arg;
2731                 addr.ip = entry->addr;
2732                 if (entry->fwmark)
2733                         svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
2734                 else
2735                         svc = __ip_vs_service_find(net, AF_INET,
2736                                                    entry->protocol, &addr,
2737                                                    entry->port);
2738                 if (svc) {
2739                         ip_vs_copy_service(entry, svc);
2740                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2741                                 ret = -EFAULT;
2742                 } else
2743                         ret = -ESRCH;
2744         }
2745         break;
2746
2747         case IP_VS_SO_GET_DESTS:
2748         {
2749                 struct ip_vs_get_dests *get;
2750                 int size;
2751
2752                 get = (struct ip_vs_get_dests *)arg;
2753                 size = sizeof(*get) +
2754                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2755                 if (*len != size) {
2756                         pr_err("length: %u != %u\n", *len, size);
2757                         ret = -EINVAL;
2758                         goto out;
2759                 }
2760                 ret = __ip_vs_get_dest_entries(net, get, user);
2761         }
2762         break;
2763
2764         case IP_VS_SO_GET_TIMEOUT:
2765         {
2766                 struct ip_vs_timeout_user t;
2767
2768                 memset(&t, 0, sizeof(t));
2769                 __ip_vs_get_timeouts(net, &t);
2770                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2771                         ret = -EFAULT;
2772         }
2773         break;
2774
2775         default:
2776                 ret = -EINVAL;
2777         }
2778
2779 out:
2780         mutex_unlock(&__ip_vs_mutex);
2781         return ret;
2782 }
2783
2784
2785 static struct nf_sockopt_ops ip_vs_sockopts = {
2786         .pf             = PF_INET,
2787         .set_optmin     = IP_VS_BASE_CTL,
2788         .set_optmax     = IP_VS_SO_SET_MAX+1,
2789         .set            = do_ip_vs_set_ctl,
2790         .get_optmin     = IP_VS_BASE_CTL,
2791         .get_optmax     = IP_VS_SO_GET_MAX+1,
2792         .get            = do_ip_vs_get_ctl,
2793         .owner          = THIS_MODULE,
2794 };
2795
2796 /*
2797  * Generic Netlink interface
2798  */
2799
2800 /* IPVS genetlink family */
2801 static struct genl_family ip_vs_genl_family = {
2802         .id             = GENL_ID_GENERATE,
2803         .hdrsize        = 0,
2804         .name           = IPVS_GENL_NAME,
2805         .version        = IPVS_GENL_VERSION,
2806         .maxattr        = IPVS_CMD_MAX,
2807         .netnsok        = true,         /* Make ipvsadm to work on netns */
2808 };
2809
2810 /* Policy used for first-level command attributes */
2811 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2812         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2813         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2814         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2815         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2816         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2817         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2818 };
2819
2820 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2821 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2822         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2823         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2824                                             .len = IP_VS_IFNAME_MAXLEN },
2825         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2826 };
2827
2828 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2829 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2830         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2831         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2832         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2833                                             .len = sizeof(union nf_inet_addr) },
2834         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2835         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2836         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2837                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2838         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
2839                                             .len = IP_VS_PENAME_MAXLEN },
2840         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2841                                             .len = sizeof(struct ip_vs_flags) },
2842         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2843         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2844         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2845 };
2846
2847 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2848 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2849         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2850                                             .len = sizeof(union nf_inet_addr) },
2851         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2852         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2853         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2854         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2855         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2856         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2857         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2858         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2859         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2860 };
2861
2862 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2863                                  struct ip_vs_stats *stats)
2864 {
2865         struct ip_vs_stats_user ustats;
2866         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2867         if (!nl_stats)
2868                 return -EMSGSIZE;
2869
2870         ip_vs_copy_stats(&ustats, stats);
2871
2872         if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns) ||
2873             nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts) ||
2874             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts) ||
2875             nla_put_u64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes) ||
2876             nla_put_u64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes) ||
2877             nla_put_u32(skb, IPVS_STATS_ATTR_CPS, ustats.cps) ||
2878             nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps) ||
2879             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps) ||
2880             nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps) ||
2881             nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps))
2882                 goto nla_put_failure;
2883         nla_nest_end(skb, nl_stats);
2884
2885         return 0;
2886
2887 nla_put_failure:
2888         nla_nest_cancel(skb, nl_stats);
2889         return -EMSGSIZE;
2890 }
2891
2892 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2893                                    struct ip_vs_service *svc)
2894 {
2895         struct nlattr *nl_service;
2896         struct ip_vs_flags flags = { .flags = svc->flags,
2897                                      .mask = ~0 };
2898
2899         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2900         if (!nl_service)
2901                 return -EMSGSIZE;
2902
2903         if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
2904                 goto nla_put_failure;
2905         if (svc->fwmark) {
2906                 if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
2907                         goto nla_put_failure;
2908         } else {
2909                 if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
2910                     nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
2911                     nla_put_u16(skb, IPVS_SVC_ATTR_PORT, svc->port))
2912                         goto nla_put_failure;
2913         }
2914
2915         if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name) ||
2916             (svc->pe &&
2917              nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name)) ||
2918             nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
2919             nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
2920             nla_put_u32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
2921                 goto nla_put_failure;
2922         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2923                 goto nla_put_failure;
2924
2925         nla_nest_end(skb, nl_service);
2926
2927         return 0;
2928
2929 nla_put_failure:
2930         nla_nest_cancel(skb, nl_service);
2931         return -EMSGSIZE;
2932 }
2933
2934 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2935                                    struct ip_vs_service *svc,
2936                                    struct netlink_callback *cb)
2937 {
2938         void *hdr;
2939
2940         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2941                           &ip_vs_genl_family, NLM_F_MULTI,
2942                           IPVS_CMD_NEW_SERVICE);
2943         if (!hdr)
2944                 return -EMSGSIZE;
2945
2946         if (ip_vs_genl_fill_service(skb, svc) < 0)
2947                 goto nla_put_failure;
2948
2949         return genlmsg_end(skb, hdr);
2950
2951 nla_put_failure:
2952         genlmsg_cancel(skb, hdr);
2953         return -EMSGSIZE;
2954 }
2955
2956 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2957                                     struct netlink_callback *cb)
2958 {
2959         int idx = 0, i;
2960         int start = cb->args[0];
2961         struct ip_vs_service *svc;
2962         struct net *net = skb_sknet(skb);
2963
2964         mutex_lock(&__ip_vs_mutex);
2965         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2966                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2967                         if (++idx <= start || !net_eq(svc->net, net))
2968                                 continue;
2969                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2970                                 idx--;
2971                                 goto nla_put_failure;
2972                         }
2973                 }
2974         }
2975
2976         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2977                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2978                         if (++idx <= start || !net_eq(svc->net, net))
2979                                 continue;
2980                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2981                                 idx--;
2982                                 goto nla_put_failure;
2983                         }
2984                 }
2985         }
2986
2987 nla_put_failure:
2988         mutex_unlock(&__ip_vs_mutex);
2989         cb->args[0] = idx;
2990
2991         return skb->len;
2992 }
2993
2994 static int ip_vs_genl_parse_service(struct net *net,
2995                                     struct ip_vs_service_user_kern *usvc,
2996                                     struct nlattr *nla, int full_entry,
2997                                     struct ip_vs_service **ret_svc)
2998 {
2999         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
3000         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
3001         struct ip_vs_service *svc;
3002
3003         /* Parse mandatory identifying service fields first */
3004         if (nla == NULL ||
3005             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
3006                 return -EINVAL;
3007
3008         nla_af          = attrs[IPVS_SVC_ATTR_AF];
3009         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
3010         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
3011         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
3012         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
3013
3014         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
3015                 return -EINVAL;
3016
3017         memset(usvc, 0, sizeof(*usvc));
3018
3019         usvc->af = nla_get_u16(nla_af);
3020 #ifdef CONFIG_IP_VS_IPV6
3021         if (usvc->af != AF_INET && usvc->af != AF_INET6)
3022 #else
3023         if (usvc->af != AF_INET)
3024 #endif
3025                 return -EAFNOSUPPORT;
3026
3027         if (nla_fwmark) {
3028                 usvc->protocol = IPPROTO_TCP;
3029                 usvc->fwmark = nla_get_u32(nla_fwmark);
3030         } else {
3031                 usvc->protocol = nla_get_u16(nla_protocol);
3032                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
3033                 usvc->port = nla_get_u16(nla_port);
3034                 usvc->fwmark = 0;
3035         }
3036
3037         if (usvc->fwmark)
3038                 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
3039         else
3040                 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
3041                                            &usvc->addr, usvc->port);
3042         *ret_svc = svc;
3043
3044         /* If a full entry was requested, check for the additional fields */
3045         if (full_entry) {
3046                 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
3047                               *nla_netmask;
3048                 struct ip_vs_flags flags;
3049
3050                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
3051                 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
3052                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
3053                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
3054                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
3055
3056                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3057                         return -EINVAL;
3058
3059                 nla_memcpy(&flags, nla_flags, sizeof(flags));
3060
3061                 /* prefill flags from service if it already exists */
3062                 if (svc)
3063                         usvc->flags = svc->flags;
3064
3065                 /* set new flags from userland */
3066                 usvc->flags = (usvc->flags & ~flags.mask) |
3067                               (flags.flags & flags.mask);
3068                 usvc->sched_name = nla_data(nla_sched);
3069                 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3070                 usvc->timeout = nla_get_u32(nla_timeout);
3071                 usvc->netmask = nla_get_u32(nla_netmask);
3072         }
3073
3074         return 0;
3075 }
3076
3077 static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3078                                                      struct nlattr *nla)
3079 {
3080         struct ip_vs_service_user_kern usvc;
3081         struct ip_vs_service *svc;
3082         int ret;
3083
3084         ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
3085         return ret ? ERR_PTR(ret) : svc;
3086 }
3087
3088 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3089 {
3090         struct nlattr *nl_dest;
3091
3092         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3093         if (!nl_dest)
3094                 return -EMSGSIZE;
3095
3096         if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
3097             nla_put_u16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
3098             nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3099                         (atomic_read(&dest->conn_flags) &
3100                          IP_VS_CONN_F_FWD_MASK)) ||
3101             nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
3102                         atomic_read(&dest->weight)) ||
3103             nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
3104             nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
3105             nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3106                         atomic_read(&dest->activeconns)) ||
3107             nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3108                         atomic_read(&dest->inactconns)) ||
3109             nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3110                         atomic_read(&dest->persistconns)))
3111                 goto nla_put_failure;
3112         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3113                 goto nla_put_failure;
3114
3115         nla_nest_end(skb, nl_dest);
3116
3117         return 0;
3118
3119 nla_put_failure:
3120         nla_nest_cancel(skb, nl_dest);
3121         return -EMSGSIZE;
3122 }
3123
3124 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3125                                 struct netlink_callback *cb)
3126 {
3127         void *hdr;
3128
3129         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3130                           &ip_vs_genl_family, NLM_F_MULTI,
3131                           IPVS_CMD_NEW_DEST);
3132         if (!hdr)
3133                 return -EMSGSIZE;
3134
3135         if (ip_vs_genl_fill_dest(skb, dest) < 0)
3136                 goto nla_put_failure;
3137
3138         return genlmsg_end(skb, hdr);
3139
3140 nla_put_failure:
3141         genlmsg_cancel(skb, hdr);
3142         return -EMSGSIZE;
3143 }
3144
3145 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3146                                  struct netlink_callback *cb)
3147 {
3148         int idx = 0;
3149         int start = cb->args[0];
3150         struct ip_vs_service *svc;
3151         struct ip_vs_dest *dest;
3152         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3153         struct net *net = skb_sknet(skb);
3154
3155         mutex_lock(&__ip_vs_mutex);
3156
3157         /* Try to find the service for which to dump destinations */
3158         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3159                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3160                 goto out_err;
3161
3162
3163         svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
3164         if (IS_ERR(svc) || svc == NULL)
3165                 goto out_err;
3166
3167         /* Dump the destinations */
3168         list_for_each_entry(dest, &svc->destinations, n_list) {
3169                 if (++idx <= start)
3170                         continue;
3171                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3172                         idx--;
3173                         goto nla_put_failure;
3174                 }
3175         }
3176
3177 nla_put_failure:
3178         cb->args[0] = idx;
3179
3180 out_err:
3181         mutex_unlock(&__ip_vs_mutex);
3182
3183         return skb->len;
3184 }
3185
3186 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3187                                  struct nlattr *nla, int full_entry)
3188 {
3189         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3190         struct nlattr *nla_addr, *nla_port;
3191
3192         /* Parse mandatory identifying destination fields first */
3193         if (nla == NULL ||
3194             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3195                 return -EINVAL;
3196
3197         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
3198         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
3199
3200         if (!(nla_addr && nla_port))
3201                 return -EINVAL;
3202
3203         memset(udest, 0, sizeof(*udest));
3204
3205         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3206         udest->port = nla_get_u16(nla_port);
3207
3208         /* If a full entry was requested, check for the additional fields */
3209         if (full_entry) {
3210                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3211                               *nla_l_thresh;
3212
3213                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3214                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
3215                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
3216                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
3217
3218                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3219                         return -EINVAL;
3220
3221                 udest->conn_flags = nla_get_u32(nla_fwd)
3222                                     & IP_VS_CONN_F_FWD_MASK;
3223                 udest->weight = nla_get_u32(nla_weight);
3224                 udest->u_threshold = nla_get_u32(nla_u_thresh);
3225                 udest->l_threshold = nla_get_u32(nla_l_thresh);
3226         }
3227
3228         return 0;
3229 }
3230
3231 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3232                                   const char *mcast_ifn, __be32 syncid)
3233 {
3234         struct nlattr *nl_daemon;
3235
3236         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3237         if (!nl_daemon)
3238                 return -EMSGSIZE;
3239
3240         if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
3241             nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn) ||
3242             nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid))
3243                 goto nla_put_failure;
3244         nla_nest_end(skb, nl_daemon);
3245
3246         return 0;
3247
3248 nla_put_failure:
3249         nla_nest_cancel(skb, nl_daemon);
3250         return -EMSGSIZE;
3251 }
3252
3253 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3254                                   const char *mcast_ifn, __be32 syncid,
3255                                   struct netlink_callback *cb)
3256 {
3257         void *hdr;
3258         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3259                           &ip_vs_genl_family, NLM_F_MULTI,
3260                           IPVS_CMD_NEW_DAEMON);
3261         if (!hdr)
3262                 return -EMSGSIZE;
3263
3264         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3265                 goto nla_put_failure;
3266
3267         return genlmsg_end(skb, hdr);
3268
3269 nla_put_failure:
3270         genlmsg_cancel(skb, hdr);
3271         return -EMSGSIZE;
3272 }
3273
3274 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3275                                    struct netlink_callback *cb)
3276 {
3277         struct net *net = skb_sknet(skb);
3278         struct netns_ipvs *ipvs = net_ipvs(net);
3279
3280         mutex_lock(&ipvs->sync_mutex);
3281         if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3282                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3283                                            ipvs->master_mcast_ifn,
3284                                            ipvs->master_syncid, cb) < 0)
3285                         goto nla_put_failure;
3286
3287                 cb->args[0] = 1;
3288         }
3289
3290         if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3291                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3292                                            ipvs->backup_mcast_ifn,
3293                                            ipvs->backup_syncid, cb) < 0)
3294                         goto nla_put_failure;
3295
3296                 cb->args[1] = 1;
3297         }
3298
3299 nla_put_failure:
3300         mutex_unlock(&ipvs->sync_mutex);
3301
3302         return skb->len;
3303 }
3304
3305 static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
3306 {
3307         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3308               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3309               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3310                 return -EINVAL;
3311
3312         return start_sync_thread(net,
3313                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3314                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3315                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3316 }
3317
3318 static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
3319 {
3320         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3321                 return -EINVAL;
3322
3323         return stop_sync_thread(net,
3324                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3325 }
3326
3327 static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
3328 {
3329         struct ip_vs_timeout_user t;
3330
3331         __ip_vs_get_timeouts(net, &t);
3332
3333         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3334                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3335
3336         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3337                 t.tcp_fin_timeout =
3338                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3339
3340         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3341                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3342
3343         return ip_vs_set_timeout(net, &t);
3344 }
3345
3346 static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3347 {
3348         int ret = 0, cmd;
3349         struct net *net;
3350         struct netns_ipvs *ipvs;
3351
3352         net = skb_sknet(skb);
3353         ipvs = net_ipvs(net);
3354         cmd = info->genlhdr->cmd;
3355
3356         if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3357                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3358
3359                 mutex_lock(&ipvs->sync_mutex);
3360                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3361                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3362                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3363                                      ip_vs_daemon_policy)) {
3364                         ret = -EINVAL;
3365                         goto out;
3366                 }
3367
3368                 if (cmd == IPVS_CMD_NEW_DAEMON)
3369                         ret = ip_vs_genl_new_daemon(net, daemon_attrs);
3370                 else
3371                         ret = ip_vs_genl_del_daemon(net, daemon_attrs);
3372 out:
3373                 mutex_unlock(&ipvs->sync_mutex);
3374         }
3375         return ret;
3376 }
3377
3378 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3379 {
3380         struct ip_vs_service *svc = NULL;
3381         struct ip_vs_service_user_kern usvc;
3382         struct ip_vs_dest_user_kern udest;
3383         int ret = 0, cmd;
3384         int need_full_svc = 0, need_full_dest = 0;
3385         struct net *net;
3386
3387         net = skb_sknet(skb);
3388         cmd = info->genlhdr->cmd;
3389
3390         mutex_lock(&__ip_vs_mutex);
3391
3392         if (cmd == IPVS_CMD_FLUSH) {
3393                 ret = ip_vs_flush(net);
3394                 goto out;
3395         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3396                 ret = ip_vs_genl_set_config(net, info->attrs);
3397                 goto out;
3398         } else if (cmd == IPVS_CMD_ZERO &&
3399                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3400                 ret = ip_vs_zero_all(net);
3401                 goto out;
3402         }
3403
3404         /* All following commands require a service argument, so check if we
3405          * received a valid one. We need a full service specification when
3406          * adding / editing a service. Only identifying members otherwise. */
3407         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3408                 need_full_svc = 1;
3409
3410         ret = ip_vs_genl_parse_service(net, &usvc,
3411                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3412                                        need_full_svc, &svc);
3413         if (ret)
3414                 goto out;
3415
3416         /* Unless we're adding a new service, the service must already exist */
3417         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3418                 ret = -ESRCH;
3419                 goto out;
3420         }
3421
3422         /* Destination commands require a valid destination argument. For
3423          * adding / editing a destination, we need a full destination
3424          * specification. */
3425         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3426             cmd == IPVS_CMD_DEL_DEST) {
3427                 if (cmd != IPVS_CMD_DEL_DEST)
3428                         need_full_dest = 1;
3429
3430                 ret = ip_vs_genl_parse_dest(&udest,
3431                                             info->attrs[IPVS_CMD_ATTR_DEST],
3432                                             need_full_dest);
3433                 if (ret)
3434                         goto out;
3435         }
3436
3437         switch (cmd) {
3438         case IPVS_CMD_NEW_SERVICE:
3439                 if (svc == NULL)
3440                         ret = ip_vs_add_service(net, &usvc, &svc);
3441                 else
3442                         ret = -EEXIST;
3443                 break;
3444         case IPVS_CMD_SET_SERVICE:
3445                 ret = ip_vs_edit_service(svc, &usvc);
3446                 break;
3447         case IPVS_CMD_DEL_SERVICE:
3448                 ret = ip_vs_del_service(svc);
3449                 /* do not use svc, it can be freed */
3450                 break;
3451         case IPVS_CMD_NEW_DEST:
3452                 ret = ip_vs_add_dest(svc, &udest);
3453                 break;
3454         case IPVS_CMD_SET_DEST:
3455                 ret = ip_vs_edit_dest(svc, &udest);
3456                 break;
3457         case IPVS_CMD_DEL_DEST:
3458                 ret = ip_vs_del_dest(svc, &udest);
3459                 break;
3460         case IPVS_CMD_ZERO:
3461                 ret = ip_vs_zero_service(svc);
3462                 break;
3463         default:
3464                 ret = -EINVAL;
3465         }
3466
3467 out:
3468         mutex_unlock(&__ip_vs_mutex);
3469
3470         return ret;
3471 }
3472
3473 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3474 {
3475         struct sk_buff *msg;
3476         void *reply;
3477         int ret, cmd, reply_cmd;
3478         struct net *net;
3479
3480         net = skb_sknet(skb);
3481         cmd = info->genlhdr->cmd;
3482
3483         if (cmd == IPVS_CMD_GET_SERVICE)
3484                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3485         else if (cmd == IPVS_CMD_GET_INFO)
3486                 reply_cmd = IPVS_CMD_SET_INFO;
3487         else if (cmd == IPVS_CMD_GET_CONFIG)
3488                 reply_cmd = IPVS_CMD_SET_CONFIG;
3489         else {
3490                 pr_err("unknown Generic Netlink command\n");
3491                 return -EINVAL;
3492         }
3493
3494         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3495         if (!msg)
3496                 return -ENOMEM;
3497
3498         mutex_lock(&__ip_vs_mutex);
3499
3500         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3501         if (reply == NULL)
3502                 goto nla_put_failure;
3503
3504         switch (cmd) {
3505         case IPVS_CMD_GET_SERVICE:
3506         {
3507                 struct ip_vs_service *svc;
3508
3509                 svc = ip_vs_genl_find_service(net,
3510                                               info->attrs[IPVS_CMD_ATTR_SERVICE]);
3511                 if (IS_ERR(svc)) {
3512                         ret = PTR_ERR(svc);
3513                         goto out_err;
3514                 } else if (svc) {
3515                         ret = ip_vs_genl_fill_service(msg, svc);
3516                         if (ret)
3517                                 goto nla_put_failure;
3518                 } else {
3519                         ret = -ESRCH;
3520                         goto out_err;
3521                 }
3522
3523                 break;
3524         }
3525
3526         case IPVS_CMD_GET_CONFIG:
3527         {
3528                 struct ip_vs_timeout_user t;
3529
3530                 __ip_vs_get_timeouts(net, &t);
3531 #ifdef CONFIG_IP_VS_PROTO_TCP
3532                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
3533                                 t.tcp_timeout) ||
3534                     nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3535                                 t.tcp_fin_timeout))
3536                         goto nla_put_failure;
3537 #endif
3538 #ifdef CONFIG_IP_VS_PROTO_UDP
3539                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
3540                         goto nla_put_failure;
3541 #endif
3542
3543                 break;
3544         }
3545
3546         case IPVS_CMD_GET_INFO:
3547                 if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
3548                                 IP_VS_VERSION_CODE) ||
3549                     nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3550                                 ip_vs_conn_tab_size))
3551                         goto nla_put_failure;
3552                 break;
3553         }
3554
3555         genlmsg_end(msg, reply);
3556         ret = genlmsg_reply(msg, info);
3557         goto out;
3558
3559 nla_put_failure:
3560         pr_err("not enough space in Netlink message\n");
3561         ret = -EMSGSIZE;
3562
3563 out_err:
3564         nlmsg_free(msg);
3565 out:
3566         mutex_unlock(&__ip_vs_mutex);
3567
3568         return ret;
3569 }
3570
3571
3572 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3573         {
3574                 .cmd    = IPVS_CMD_NEW_SERVICE,
3575                 .flags  = GENL_ADMIN_PERM,
3576                 .policy = ip_vs_cmd_policy,
3577                 .doit   = ip_vs_genl_set_cmd,
3578         },
3579         {
3580                 .cmd    = IPVS_CMD_SET_SERVICE,
3581                 .flags  = GENL_ADMIN_PERM,
3582                 .policy = ip_vs_cmd_policy,
3583                 .doit   = ip_vs_genl_set_cmd,
3584         },
3585         {
3586                 .cmd    = IPVS_CMD_DEL_SERVICE,
3587                 .flags  = GENL_ADMIN_PERM,
3588                 .policy = ip_vs_cmd_policy,
3589                 .doit   = ip_vs_genl_set_cmd,
3590         },
3591         {
3592                 .cmd    = IPVS_CMD_GET_SERVICE,
3593                 .flags  = GENL_ADMIN_PERM,
3594                 .doit   = ip_vs_genl_get_cmd,
3595                 .dumpit = ip_vs_genl_dump_services,
3596                 .policy = ip_vs_cmd_policy,
3597         },
3598         {
3599                 .cmd    = IPVS_CMD_NEW_DEST,
3600                 .flags  = GENL_ADMIN_PERM,
3601                 .policy = ip_vs_cmd_policy,
3602                 .doit   = ip_vs_genl_set_cmd,
3603         },
3604         {
3605                 .cmd    = IPVS_CMD_SET_DEST,
3606                 .flags  = GENL_ADMIN_PERM,
3607                 .policy = ip_vs_cmd_policy,
3608                 .doit   = ip_vs_genl_set_cmd,
3609         },
3610         {
3611                 .cmd    = IPVS_CMD_DEL_DEST,
3612                 .flags  = GENL_ADMIN_PERM,
3613                 .policy = ip_vs_cmd_policy,
3614                 .doit   = ip_vs_genl_set_cmd,
3615         },
3616         {
3617                 .cmd    = IPVS_CMD_GET_DEST,
3618                 .flags  = GENL_ADMIN_PERM,
3619                 .policy = ip_vs_cmd_policy,
3620                 .dumpit = ip_vs_genl_dump_dests,
3621         },
3622         {
3623                 .cmd    = IPVS_CMD_NEW_DAEMON,
3624                 .flags  = GENL_ADMIN_PERM,
3625                 .policy = ip_vs_cmd_policy,
3626                 .doit   = ip_vs_genl_set_daemon,
3627         },
3628         {
3629                 .cmd    = IPVS_CMD_DEL_DAEMON,
3630                 .flags  = GENL_ADMIN_PERM,
3631                 .policy = ip_vs_cmd_policy,
3632                 .doit   = ip_vs_genl_set_daemon,
3633         },
3634         {
3635                 .cmd    = IPVS_CMD_GET_DAEMON,
3636                 .flags  = GENL_ADMIN_PERM,
3637                 .dumpit = ip_vs_genl_dump_daemons,
3638         },
3639         {
3640                 .cmd    = IPVS_CMD_SET_CONFIG,
3641                 .flags  = GENL_ADMIN_PERM,
3642                 .policy = ip_vs_cmd_policy,
3643                 .doit   = ip_vs_genl_set_cmd,
3644         },
3645         {
3646                 .cmd    = IPVS_CMD_GET_CONFIG,
3647                 .flags  = GENL_ADMIN_PERM,
3648                 .doit   = ip_vs_genl_get_cmd,
3649         },
3650         {
3651                 .cmd    = IPVS_CMD_GET_INFO,
3652                 .flags  = GENL_ADMIN_PERM,
3653                 .doit   = ip_vs_genl_get_cmd,
3654         },
3655         {
3656                 .cmd    = IPVS_CMD_ZERO,
3657                 .flags  = GENL_ADMIN_PERM,
3658                 .policy = ip_vs_cmd_policy,
3659                 .doit   = ip_vs_genl_set_cmd,
3660         },
3661         {
3662                 .cmd    = IPVS_CMD_FLUSH,
3663                 .flags  = GENL_ADMIN_PERM,
3664                 .doit   = ip_vs_genl_set_cmd,
3665         },
3666 };
3667
3668 static int __init ip_vs_genl_register(void)
3669 {
3670         return genl_register_family_with_ops(&ip_vs_genl_family,
3671                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3672 }
3673
3674 static void ip_vs_genl_unregister(void)
3675 {
3676         genl_unregister_family(&ip_vs_genl_family);
3677 }
3678
3679 /* End of Generic Netlink interface definitions */
3680
3681 /*
3682  * per netns intit/exit func.
3683  */
3684 #ifdef CONFIG_SYSCTL
3685 static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
3686 {
3687         int idx;
3688         struct netns_ipvs *ipvs = net_ipvs(net);
3689         struct ctl_table *tbl;
3690
3691         atomic_set(&ipvs->dropentry, 0);
3692         spin_lock_init(&ipvs->dropentry_lock);
3693         spin_lock_init(&ipvs->droppacket_lock);
3694         spin_lock_init(&ipvs->securetcp_lock);
3695
3696         if (!net_eq(net, &init_net)) {
3697                 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3698                 if (tbl == NULL)
3699                         return -ENOMEM;
3700         } else
3701                 tbl = vs_vars;
3702         /* Initialize sysctl defaults */
3703         idx = 0;
3704         ipvs->sysctl_amemthresh = 1024;
3705         tbl[idx++].data = &ipvs->sysctl_amemthresh;
3706         ipvs->sysctl_am_droprate = 10;
3707         tbl[idx++].data = &ipvs->sysctl_am_droprate;
3708         tbl[idx++].data = &ipvs->sysctl_drop_entry;
3709         tbl[idx++].data = &ipvs->sysctl_drop_packet;
3710 #ifdef CONFIG_IP_VS_NFCT
3711         tbl[idx++].data = &ipvs->sysctl_conntrack;
3712 #endif
3713         tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3714         ipvs->sysctl_snat_reroute = 1;
3715         tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3716         ipvs->sysctl_sync_ver = 1;
3717         tbl[idx++].data = &ipvs->sysctl_sync_ver;
3718         ipvs->sysctl_sync_ports = 1;
3719         tbl[idx++].data = &ipvs->sysctl_sync_ports;
3720         ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
3721         tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
3722         ipvs->sysctl_sync_sock_size = 0;
3723         tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
3724         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3725         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3726         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3727         ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3728         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3729         tbl[idx].data = &ipvs->sysctl_sync_threshold;
3730         tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3731         ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
3732         tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
3733         ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
3734         tbl[idx++].data = &ipvs->sysctl_sync_retries;
3735         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3736         ipvs->sysctl_pmtu_disc = 1;
3737         tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
3738
3739
3740         ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
3741         if (ipvs->sysctl_hdr == NULL) {
3742                 if (!net_eq(net, &init_net))
3743                         kfree(tbl);
3744                 return -ENOMEM;
3745         }
3746         ip_vs_start_estimator(net, &ipvs->tot_stats);
3747         ipvs->sysctl_tbl = tbl;
3748         /* Schedule defense work */
3749         INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3750         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
3751
3752         return 0;
3753 }
3754
3755 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
3756 {
3757         struct netns_ipvs *ipvs = net_ipvs(net);
3758
3759         cancel_delayed_work_sync(&ipvs->defense_work);
3760         cancel_work_sync(&ipvs->defense_work.work);
3761         unregister_net_sysctl_table(ipvs->sysctl_hdr);
3762 }
3763
3764 #else
3765
3766 static int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3767 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
3768
3769 #endif
3770
3771 static struct notifier_block ip_vs_dst_notifier = {
3772         .notifier_call = ip_vs_dst_event,
3773 };
3774
3775 int __net_init ip_vs_control_net_init(struct net *net)
3776 {
3777         int idx;
3778         struct netns_ipvs *ipvs = net_ipvs(net);
3779
3780         rwlock_init(&ipvs->rs_lock);
3781
3782         /* Initialize rs_table */
3783         for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3784                 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3785
3786         INIT_LIST_HEAD(&ipvs->dest_trash);
3787         atomic_set(&ipvs->ftpsvc_counter, 0);
3788         atomic_set(&ipvs->nullsvc_counter, 0);
3789
3790         /* procfs stats */
3791         ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
3792         if (!ipvs->tot_stats.cpustats)
3793                 return -ENOMEM;
3794
3795         spin_lock_init(&ipvs->tot_stats.lock);
3796
3797         proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
3798         proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
3799         proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
3800                              &ip_vs_stats_percpu_fops);
3801
3802         if (ip_vs_control_net_init_sysctl(net))
3803                 goto err;
3804
3805         return 0;
3806
3807 err:
3808         free_percpu(ipvs->tot_stats.cpustats);
3809         return -ENOMEM;
3810 }
3811
3812 void __net_exit ip_vs_control_net_cleanup(struct net *net)
3813 {
3814         struct netns_ipvs *ipvs = net_ipvs(net);
3815
3816         ip_vs_trash_cleanup(net);
3817         ip_vs_stop_estimator(net, &ipvs->tot_stats);
3818         ip_vs_control_net_cleanup_sysctl(net);
3819         proc_net_remove(net, "ip_vs_stats_percpu");
3820         proc_net_remove(net, "ip_vs_stats");
3821         proc_net_remove(net, "ip_vs");
3822         free_percpu(ipvs->tot_stats.cpustats);
3823 }
3824
3825 int __init ip_vs_register_nl_ioctl(void)
3826 {
3827         int ret;
3828
3829         ret = nf_register_sockopt(&ip_vs_sockopts);
3830         if (ret) {
3831                 pr_err("cannot register sockopt.\n");
3832                 goto err_sock;
3833         }
3834
3835         ret = ip_vs_genl_register();
3836         if (ret) {
3837                 pr_err("cannot register Generic Netlink interface.\n");
3838                 goto err_genl;
3839         }
3840         return 0;
3841
3842 err_genl:
3843         nf_unregister_sockopt(&ip_vs_sockopts);
3844 err_sock:
3845         return ret;
3846 }
3847
3848 void ip_vs_unregister_nl_ioctl(void)
3849 {
3850         ip_vs_genl_unregister();
3851         nf_unregister_sockopt(&ip_vs_sockopts);
3852 }
3853
3854 int __init ip_vs_control_init(void)
3855 {
3856         int idx;
3857         int ret;
3858
3859         EnterFunction(2);
3860
3861         /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
3862         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3863                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3864                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3865         }
3866
3867         smp_wmb();      /* Do we really need it now ? */
3868
3869         ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3870         if (ret < 0)
3871                 return ret;
3872
3873         LeaveFunction(2);
3874         return 0;
3875 }
3876
3877
3878 void ip_vs_control_cleanup(void)
3879 {
3880         EnterFunction(2);
3881         unregister_netdevice_notifier(&ip_vs_dst_notifier);
3882         LeaveFunction(2);
3883 }