[GitHub/moto-9609/android_kernel_motorola_exynos9610.git] / net / ipv4 / ipvs / ip_vs_proto_tcp.c

/*
 * ip_vs_proto_tcp.c:	TCP load balancing support for IPVS
 *
 * Version:     $Id: ip_vs_proto_tcp.c,v 1.3 2002/11/30 01:50:35 wensong Exp $
 *
 * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
 *              Julian Anastasov <ja@ssi.bg>
 *
 *              This program is free software; you can redistribute it and/or
 *              modify it under the terms of the GNU General Public License
 *              as published by the Free Software Foundation; either version
 *              2 of the License, or (at your option) any later version.
 *
 * Changes:
 *
 */

#include <linux/kernel.h>
#include <linux/ip.h>
#include <linux/tcp.h>                  /* for tcphdr */
#include <net/ip.h>
#include <net/tcp.h>                    /* for csum_tcpudp_magic */
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>

#include <net/ip_vs.h>


static struct ip_vs_conn *
tcp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	__be16 _ports[2], *pptr;

	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	if (pptr == NULL)
		return NULL;

	if (likely(!inverse)) {
		return ip_vs_conn_in_get(iph->protocol,
					 iph->saddr, pptr[0],
					 iph->daddr, pptr[1]);
	} else {
		return ip_vs_conn_in_get(iph->protocol,
					 iph->daddr, pptr[1],
					 iph->saddr, pptr[0]);
	}
}

static struct ip_vs_conn *
tcp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		 const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	__be16 _ports[2], *pptr;

	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	if (pptr == NULL)
		return NULL;

	if (likely(!inverse)) {
		return ip_vs_conn_out_get(iph->protocol,
					  iph->saddr, pptr[0],
					  iph->daddr, pptr[1]);
	} else {
		return ip_vs_conn_out_get(iph->protocol,
					  iph->daddr, pptr[1],
					  iph->saddr, pptr[0]);
	}
}


static int
tcp_conn_schedule(struct sk_buff *skb,
		  struct ip_vs_protocol *pp,
		  int *verdict, struct ip_vs_conn **cpp)
{
	struct ip_vs_service *svc;
	struct tcphdr _tcph, *th;

	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
	if (th == NULL) {
		*verdict = NF_DROP;
		return 0;
	}

	if (th->syn &&
	    (svc = ip_vs_service_get(skb->mark, ip_hdr(skb)->protocol,
				     ip_hdr(skb)->daddr, th->dest))) {
		if (ip_vs_todrop()) {
			/*
			 * It seems that we are very loaded.
			 * We have to drop this packet :(
			 */
			ip_vs_service_put(svc);
			*verdict = NF_DROP;
			return 0;
		}

		/*
		 * Let the virtual server select a real server for the
		 * incoming connection, and create a connection entry.
		 */
		*cpp = ip_vs_schedule(svc, skb);
		if (!*cpp) {
			*verdict = ip_vs_leave(svc, skb, pp);
			return 0;
		}
		ip_vs_service_put(svc);
	}
	return 1;
}


static inline void
tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
		     __be16 oldport, __be16 newport)
{
	tcph->check =
		csum_fold(ip_vs_check_diff4(oldip, newip,
				 ip_vs_check_diff2(oldport, newport,
						~csum_unfold(tcph->check))));
}


static int
tcp_snat_handler(struct sk_buff *skb,
		 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
{
	struct tcphdr *tcph;
	const unsigned int tcphoff = ip_hdrlen(skb);

	/* csum_check requires unshared skb */
	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		/* Some checks before mangling */
		if (pp->csum_check && !pp->csum_check(skb, pp))
			return 0;

		/* Call application helper if needed */
		if (!ip_vs_app_pkt_out(cp, skb))
			return 0;
	}

	tcph = (void *)ip_hdr(skb) + tcphoff;
	tcph->source = cp->vport;

	/* Adjust TCP checksums */
	if (!cp->app) {
		/* Only port and addr are changed, do fast csum update */
		tcp_fast_csum_update(tcph, cp->daddr, cp->vaddr,
				     cp->dport, cp->vport);
		if (skb->ip_summed == CHECKSUM_COMPLETE)
			skb->ip_summed = CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		tcph->check = 0;
		skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
		tcph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
						skb->len - tcphoff,
						cp->protocol, skb->csum);
		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
			  pp->name, tcph->check,
			  (char*)&(tcph->check) - (char*)tcph);
	}
	return 1;
}


static int
tcp_dnat_handler(struct sk_buff *skb,
		 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
{
	struct tcphdr *tcph;
	const unsigned int tcphoff = ip_hdrlen(skb);

	/* csum_check requires unshared skb */
	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		/* Some checks before mangling */
		if (pp->csum_check && !pp->csum_check(skb, pp))
			return 0;

		/*
		 *	Attempt ip_vs_app call.
		 *	It will fix ip_vs_conn and iph ack_seq stuff
		 */
		if (!ip_vs_app_pkt_in(cp, skb))
			return 0;
	}

	tcph = (void *)ip_hdr(skb) + tcphoff;
	tcph->dest = cp->dport;

	/*
	 *	Adjust TCP checksums
	 */
	if (!cp->app) {
		/* Only port and addr are changed, do fast csum update */
		tcp_fast_csum_update(tcph, cp->vaddr, cp->daddr,
				     cp->vport, cp->dport);
		if (skb->ip_summed == CHECKSUM_COMPLETE)
			skb->ip_summed = CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		tcph->check = 0;
		skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
		tcph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
						skb->len - tcphoff,
						cp->protocol, skb->csum);
		skb->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return 1;
}


static int
tcp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
{
	const unsigned int tcphoff = ip_hdrlen(skb);

	switch (skb->ip_summed) {
	case CHECKSUM_NONE:
		skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
	case CHECKSUM_COMPLETE:
		if (csum_tcpudp_magic(ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
				      skb->len - tcphoff,
				      ip_hdr(skb)->protocol, skb->csum)) {
			IP_VS_DBG_RL_PKT(0, pp, skb, 0,
					 "Failed checksum for");
			return 0;
		}
		break;
	default:
		/* No need to checksum. */
		break;
	}

	return 1;
}


#define TCP_DIR_INPUT		0
#define TCP_DIR_OUTPUT		4
#define TCP_DIR_INPUT_ONLY	8

static const int tcp_state_off[IP_VS_DIR_LAST] = {
	[IP_VS_DIR_INPUT]		=	TCP_DIR_INPUT,
	[IP_VS_DIR_OUTPUT]		=	TCP_DIR_OUTPUT,
	[IP_VS_DIR_INPUT_ONLY]		=	TCP_DIR_INPUT_ONLY,
};

/*
 *	Timeout table[state]
 */
static int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
	[IP_VS_TCP_S_NONE]		=	2*HZ,
	[IP_VS_TCP_S_ESTABLISHED]	=	15*60*HZ,
	[IP_VS_TCP_S_SYN_SENT]		=	2*60*HZ,
	[IP_VS_TCP_S_SYN_RECV]		=	1*60*HZ,
	[IP_VS_TCP_S_FIN_WAIT]		=	2*60*HZ,
	[IP_VS_TCP_S_TIME_WAIT]		=	2*60*HZ,
	[IP_VS_TCP_S_CLOSE]		=	10*HZ,
	[IP_VS_TCP_S_CLOSE_WAIT]	=	60*HZ,
	[IP_VS_TCP_S_LAST_ACK]		=	30*HZ,
	[IP_VS_TCP_S_LISTEN]		=	2*60*HZ,
	[IP_VS_TCP_S_SYNACK]		=	120*HZ,
	[IP_VS_TCP_S_LAST]		=	2*HZ,
};

static char * tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
	[IP_VS_TCP_S_NONE]		=	"NONE",
	[IP_VS_TCP_S_ESTABLISHED]	=	"ESTABLISHED",
	[IP_VS_TCP_S_SYN_SENT]		=	"SYN_SENT",
	[IP_VS_TCP_S_SYN_RECV]		=	"SYN_RECV",
	[IP_VS_TCP_S_FIN_WAIT]		=	"FIN_WAIT",
	[IP_VS_TCP_S_TIME_WAIT]		=	"TIME_WAIT",
	[IP_VS_TCP_S_CLOSE]		=	"CLOSE",
	[IP_VS_TCP_S_CLOSE_WAIT]	=	"CLOSE_WAIT",
	[IP_VS_TCP_S_LAST_ACK]		=	"LAST_ACK",
	[IP_VS_TCP_S_LISTEN]		=	"LISTEN",
	[IP_VS_TCP_S_SYNACK]		=	"SYNACK",
	[IP_VS_TCP_S_LAST]		=	"BUG!",
};

#define sNO IP_VS_TCP_S_NONE
#define sES IP_VS_TCP_S_ESTABLISHED
#define sSS IP_VS_TCP_S_SYN_SENT
#define sSR IP_VS_TCP_S_SYN_RECV
#define sFW IP_VS_TCP_S_FIN_WAIT
#define sTW IP_VS_TCP_S_TIME_WAIT
#define sCL IP_VS_TCP_S_CLOSE
#define sCW IP_VS_TCP_S_CLOSE_WAIT
#define sLA IP_VS_TCP_S_LAST_ACK
#define sLI IP_VS_TCP_S_LISTEN
#define sSA IP_VS_TCP_S_SYNACK

struct tcp_states_t {
	int next_state[IP_VS_TCP_S_LAST];
};

static const char * tcp_state_name(int state)
{
	if (state >= IP_VS_TCP_S_LAST)
		return "ERR!";
	return tcp_state_name_table[state] ? tcp_state_name_table[state] : "?";
}

static struct tcp_states_t tcp_states [] = {
/*	INPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
/*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},

/*	OUTPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSS, sES, sSS, sSR, sSS, sSS, sSS, sSS, sSS, sLI, sSR }},
/*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
/*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},

/*	INPUT-ONLY */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
/*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
};

static struct tcp_states_t tcp_states_dos [] = {
/*	INPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
/*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
/*ack*/ {{sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},

/*	OUTPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSS, sES, sSS, sSA, sSS, sSS, sSS, sSS, sSS, sLI, sSA }},
/*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
/*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},

/*	INPUT-ONLY */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
/*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
};

static struct tcp_states_t *tcp_state_table = tcp_states;


static void tcp_timeout_change(struct ip_vs_protocol *pp, int flags)
{
	int on = (flags & 1);		/* secure_tcp */

	/*
	** FIXME: change secure_tcp to independent sysctl var
	** or make it per-service or per-app because it is valid
	** for most if not for all of the applications. Something
	** like "capabilities" (flags) for each object.
	*/
	tcp_state_table = (on? tcp_states_dos : tcp_states);
}

static int
tcp_set_state_timeout(struct ip_vs_protocol *pp, char *sname, int to)
{
	return ip_vs_set_state_timeout(pp->timeout_table, IP_VS_TCP_S_LAST,
				       tcp_state_name_table, sname, to);
}

static inline int tcp_state_idx(struct tcphdr *th)
{
	if (th->rst)
		return 3;
	if (th->syn)
		return 0;
	if (th->fin)
		return 1;
	if (th->ack)
		return 2;
	return -1;
}

static inline void
set_tcp_state(struct ip_vs_protocol *pp, struct ip_vs_conn *cp,
	      int direction, struct tcphdr *th)
{
	int state_idx;
	int new_state = IP_VS_TCP_S_CLOSE;
	int state_off = tcp_state_off[direction];

	/*
	 *    Update state offset to INPUT_ONLY if necessary
	 *    or delete NO_OUTPUT flag if output packet detected
	 */
	if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
		if (state_off == TCP_DIR_OUTPUT)
			cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
		else
			state_off = TCP_DIR_INPUT_ONLY;
	}

	if ((state_idx = tcp_state_idx(th)) < 0) {
		IP_VS_DBG(8, "tcp_state_idx=%d!!!\n", state_idx);
		goto tcp_state_out;
	}

	new_state = tcp_state_table[state_off+state_idx].next_state[cp->state];

  tcp_state_out:
	if (new_state != cp->state) {
		struct ip_vs_dest *dest = cp->dest;

		IP_VS_DBG(8, "%s %s [%c%c%c%c] %u.%u.%u.%u:%d->"
			  "%u.%u.%u.%u:%d state: %s->%s conn->refcnt:%d\n",
			  pp->name,
			  (state_off==TCP_DIR_OUTPUT)?"output ":"input ",
			  th->syn? 'S' : '.',
			  th->fin? 'F' : '.',
			  th->ack? 'A' : '.',
			  th->rst? 'R' : '.',
			  NIPQUAD(cp->daddr), ntohs(cp->dport),
			  NIPQUAD(cp->caddr), ntohs(cp->cport),
			  tcp_state_name(cp->state),
			  tcp_state_name(new_state),
			  atomic_read(&cp->refcnt));
		if (dest) {
			if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
			    (new_state != IP_VS_TCP_S_ESTABLISHED)) {
				atomic_dec(&dest->activeconns);
				atomic_inc(&dest->inactconns);
				cp->flags |= IP_VS_CONN_F_INACTIVE;
			} else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
				   (new_state == IP_VS_TCP_S_ESTABLISHED)) {
				atomic_inc(&dest->activeconns);
				atomic_dec(&dest->inactconns);
				cp->flags &= ~IP_VS_CONN_F_INACTIVE;
			}
		}
	}

	cp->timeout = pp->timeout_table[cp->state = new_state];
}


/*
 *	Handle state transitions
 */
static int
tcp_state_transition(struct ip_vs_conn *cp, int direction,
		     const struct sk_buff *skb,
		     struct ip_vs_protocol *pp)
{
	struct tcphdr _tcph, *th;

	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
	if (th == NULL)
		return 0;

	spin_lock(&cp->lock);
	set_tcp_state(pp, cp, direction, th);
	spin_unlock(&cp->lock);

	return 1;
}


/*
 *	Hash table for TCP application incarnations
 */
#define	TCP_APP_TAB_BITS	4
#define	TCP_APP_TAB_SIZE	(1 << TCP_APP_TAB_BITS)
#define	TCP_APP_TAB_MASK	(TCP_APP_TAB_SIZE - 1)

static struct list_head tcp_apps[TCP_APP_TAB_SIZE];
static DEFINE_SPINLOCK(tcp_app_lock);

static inline __u16 tcp_app_hashkey(__be16 port)
{
	return (((__force u16)port >> TCP_APP_TAB_BITS) ^ (__force u16)port)
		& TCP_APP_TAB_MASK;
}


static int tcp_register_app(struct ip_vs_app *inc)
{
	struct ip_vs_app *i;
	__u16 hash;
	__be16 port = inc->port;
	int ret = 0;

	hash = tcp_app_hashkey(port);

	spin_lock_bh(&tcp_app_lock);
	list_for_each_entry(i, &tcp_apps[hash], p_list) {
		if (i->port == port) {
			ret = -EEXIST;
			goto out;
		}
	}
	list_add(&inc->p_list, &tcp_apps[hash]);
	atomic_inc(&ip_vs_protocol_tcp.appcnt);

  out:
	spin_unlock_bh(&tcp_app_lock);
	return ret;
}


static void
tcp_unregister_app(struct ip_vs_app *inc)
{
	spin_lock_bh(&tcp_app_lock);
	atomic_dec(&ip_vs_protocol_tcp.appcnt);
	list_del(&inc->p_list);
	spin_unlock_bh(&tcp_app_lock);
}


static int
tcp_app_conn_bind(struct ip_vs_conn *cp)
{
	int hash;
	struct ip_vs_app *inc;
	int result = 0;

	/* Default binding: bind app only for NAT */
	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
		return 0;

	/* Lookup application incarnations and bind the right one */
	hash = tcp_app_hashkey(cp->vport);

	spin_lock(&tcp_app_lock);
	list_for_each_entry(inc, &tcp_apps[hash], p_list) {
		if (inc->port == cp->vport) {
			if (unlikely(!ip_vs_app_inc_get(inc)))
				break;
			spin_unlock(&tcp_app_lock);

			IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
				  "%u.%u.%u.%u:%u to app %s on port %u\n",
				  __func__,
				  NIPQUAD(cp->caddr), ntohs(cp->cport),
				  NIPQUAD(cp->vaddr), ntohs(cp->vport),
				  inc->name, ntohs(inc->port));
			cp->app = inc;
			if (inc->init_conn)
				result = inc->init_conn(inc, cp);
			goto out;
		}
	}
	spin_unlock(&tcp_app_lock);

  out:
	return result;
}


/*
 *	Set LISTEN timeout. (ip_vs_conn_put will setup timer)
 */
void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
{
	spin_lock(&cp->lock);
	cp->state = IP_VS_TCP_S_LISTEN;
	cp->timeout = ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_LISTEN];
	spin_unlock(&cp->lock);
}


static void ip_vs_tcp_init(struct ip_vs_protocol *pp)
{
	IP_VS_INIT_HASH_TABLE(tcp_apps);
	pp->timeout_table = tcp_timeouts;
}


static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
{
}


struct ip_vs_protocol ip_vs_protocol_tcp = {
	.name =			"TCP",
	.protocol =		IPPROTO_TCP,
	.dont_defrag =		0,
	.appcnt =		ATOMIC_INIT(0),
	.init =			ip_vs_tcp_init,
	.exit =			ip_vs_tcp_exit,
	.register_app =		tcp_register_app,
	.unregister_app =	tcp_unregister_app,
	.conn_schedule =	tcp_conn_schedule,
	.conn_in_get =		tcp_conn_in_get,
	.conn_out_get =		tcp_conn_out_get,
	.snat_handler =		tcp_snat_handler,
	.dnat_handler =		tcp_dnat_handler,
	.csum_check =		tcp_csum_check,
	.state_name =		tcp_state_name,
	.state_transition =	tcp_state_transition,
	.app_conn_bind =	tcp_app_conn_bind,
	.debug_packet =		ip_vs_tcpudp_debug_packet,
	.timeout_change =	tcp_timeout_change,
	.set_state_timeout =	tcp_set_state_timeout,
};
Commit	Line	Data
1da177e4 LT	1	/*
	2	* ip_vs_proto_tcp.c: TCP load balancing support for IPVS
	3	*
	4	* Version: $Id: ip_vs_proto_tcp.c,v 1.3 2002/11/30 01:50:35 wensong Exp $
	5	*
	6	* Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
	7	* Julian Anastasov <ja@ssi.bg>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* as published by the Free Software Foundation; either version
	12	* 2 of the License, or (at your option) any later version.
	13	*
	14	* Changes:
	15	*
	16	*/
	17
	18	#include <linux/kernel.h>
	19	#include <linux/ip.h>
	20	#include <linux/tcp.h> /* for tcphdr */
	21	#include <net/ip.h>
	22	#include <net/tcp.h> /* for csum_tcpudp_magic */
af1e1cf0	23	#include <linux/netfilter.h>
1da177e4 LT	24	#include <linux/netfilter_ipv4.h>
	25
	26	#include <net/ip_vs.h>
	27
	28
	29	static struct ip_vs_conn *
	30	tcp_conn_in_get(const struct sk_buff skb, struct ip_vs_protocol pp,
	31	const struct iphdr *iph, unsigned int proto_off, int inverse)
	32	{
014d730d	33	__be16 _ports[2], *pptr;
1da177e4 LT	34
	35	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	36	if (pptr == NULL)
	37	return NULL;
	38
	39	if (likely(!inverse)) {
	40	return ip_vs_conn_in_get(iph->protocol,
	41	iph->saddr, pptr[0],
	42	iph->daddr, pptr[1]);
	43	} else {
	44	return ip_vs_conn_in_get(iph->protocol,
	45	iph->daddr, pptr[1],
	46	iph->saddr, pptr[0]);
	47	}
	48	}
	49
	50	static struct ip_vs_conn *
	51	tcp_conn_out_get(const struct sk_buff skb, struct ip_vs_protocol pp,
	52	const struct iphdr *iph, unsigned int proto_off, int inverse)
	53	{
014d730d	54	__be16 _ports[2], *pptr;
1da177e4 LT	55
	56	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	57	if (pptr == NULL)
	58	return NULL;
	59
	60	if (likely(!inverse)) {
	61	return ip_vs_conn_out_get(iph->protocol,
	62	iph->saddr, pptr[0],
	63	iph->daddr, pptr[1]);
	64	} else {
	65	return ip_vs_conn_out_get(iph->protocol,
	66	iph->daddr, pptr[1],
	67	iph->saddr, pptr[0]);
	68	}
	69	}
	70
	71
	72	static int
	73	tcp_conn_schedule(struct sk_buff *skb,
	74	struct ip_vs_protocol *pp,
	75	int verdict, struct ip_vs_conn *cpp)
	76	{
	77	struct ip_vs_service *svc;
	78	struct tcphdr _tcph, *th;
	79
c9bdd4b5	80	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
1da177e4 LT	81	if (th == NULL) {
	82	*verdict = NF_DROP;
	83	return 0;
	84	}
	85
	86	if (th->syn &&
eddc9ec5 ACM	87	(svc = ip_vs_service_get(skb->mark, ip_hdr(skb)->protocol,
eddc9ec5 ACM	88	ip_hdr(skb)->daddr, th->dest))) {
1da177e4 LT	89	if (ip_vs_todrop()) {
	90	/*
	91	* It seems that we are very loaded.
	92	* We have to drop this packet :(
	93	*/
	94	ip_vs_service_put(svc);
	95	*verdict = NF_DROP;
	96	return 0;
	97	}
	98
	99	/*
	100	* Let the virtual server select a real server for the
	101	* incoming connection, and create a connection entry.
	102	*/
	103	*cpp = ip_vs_schedule(svc, skb);
	104	if (!*cpp) {
	105	*verdict = ip_vs_leave(svc, skb, pp);
	106	return 0;
	107	}
	108	ip_vs_service_put(svc);
	109	}
	110	return 1;
	111	}
	112
	113
	114	static inline void
014d730d AV	115	tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
014d730d AV	116	__be16 oldport, __be16 newport)
1da177e4 LT	117	{
1da177e4 LT	118	tcph->check =
f9214b26 AV	119	csum_fold(ip_vs_check_diff4(oldip, newip,
	120	ip_vs_check_diff2(oldport, newport,
	121	~csum_unfold(tcph->check))));
1da177e4 LT	122	}
	123
	124
	125	static int
3db05fea	126	tcp_snat_handler(struct sk_buff *skb,
1da177e4 LT	127	struct ip_vs_protocol pp, struct ip_vs_conn cp)
	128	{
	129	struct tcphdr *tcph;
3db05fea	130	const unsigned int tcphoff = ip_hdrlen(skb);
1da177e4 LT	131
1da177e4 LT	132	/* csum_check requires unshared skb */
3db05fea	133	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
1da177e4 LT	134	return 0;
	135
	136	if (unlikely(cp->app != NULL)) {
	137	/* Some checks before mangling */
3db05fea	138	if (pp->csum_check && !pp->csum_check(skb, pp))
1da177e4 LT	139	return 0;
	140
	141	/* Call application helper if needed */
3db05fea	142	if (!ip_vs_app_pkt_out(cp, skb))
1da177e4 LT	143	return 0;
	144	}
	145
3db05fea	146	tcph = (void *)ip_hdr(skb) + tcphoff;
1da177e4 LT	147	tcph->source = cp->vport;
	148
	149	/* Adjust TCP checksums */
	150	if (!cp->app) {
	151	/* Only port and addr are changed, do fast csum update */
	152	tcp_fast_csum_update(tcph, cp->daddr, cp->vaddr,
	153	cp->dport, cp->vport);
3db05fea HX	154	if (skb->ip_summed == CHECKSUM_COMPLETE)
3db05fea HX	155	skb->ip_summed = CHECKSUM_NONE;
1da177e4 LT	156	} else {
	157	/* full checksum calculation */
	158	tcph->check = 0;
3db05fea	159	skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
1da177e4	160	tcph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
3db05fea HX	161	skb->len - tcphoff,
3db05fea HX	162	cp->protocol, skb->csum);
1da177e4 LT	163	IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
	164	pp->name, tcph->check,
	165	(char)&(tcph->check) - (char)tcph);
	166	}
	167	return 1;
	168	}
	169
	170
	171	static int
3db05fea	172	tcp_dnat_handler(struct sk_buff *skb,
1da177e4 LT	173	struct ip_vs_protocol pp, struct ip_vs_conn cp)
	174	{
	175	struct tcphdr *tcph;
3db05fea	176	const unsigned int tcphoff = ip_hdrlen(skb);
1da177e4 LT	177
1da177e4 LT	178	/* csum_check requires unshared skb */
3db05fea	179	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
1da177e4 LT	180	return 0;
	181
	182	if (unlikely(cp->app != NULL)) {
	183	/* Some checks before mangling */
3db05fea	184	if (pp->csum_check && !pp->csum_check(skb, pp))
1da177e4 LT	185	return 0;
	186
	187	/*
	188	* Attempt ip_vs_app call.
	189	* It will fix ip_vs_conn and iph ack_seq stuff
	190	*/
3db05fea	191	if (!ip_vs_app_pkt_in(cp, skb))
1da177e4 LT	192	return 0;
	193	}
	194
3db05fea	195	tcph = (void *)ip_hdr(skb) + tcphoff;
1da177e4 LT	196	tcph->dest = cp->dport;
	197
	198	/*
	199	* Adjust TCP checksums
	200	*/
	201	if (!cp->app) {
	202	/* Only port and addr are changed, do fast csum update */
	203	tcp_fast_csum_update(tcph, cp->vaddr, cp->daddr,
	204	cp->vport, cp->dport);
3db05fea HX	205	if (skb->ip_summed == CHECKSUM_COMPLETE)
3db05fea HX	206	skb->ip_summed = CHECKSUM_NONE;
1da177e4 LT	207	} else {
	208	/* full checksum calculation */
	209	tcph->check = 0;
3db05fea	210	skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
1da177e4	211	tcph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
3db05fea HX	212	skb->len - tcphoff,
	213	cp->protocol, skb->csum);
	214	skb->ip_summed = CHECKSUM_UNNECESSARY;
1da177e4 LT	215	}
	216	return 1;
	217	}
	218
	219
	220	static int
	221	tcp_csum_check(struct sk_buff skb, struct ip_vs_protocol pp)
	222	{
c9bdd4b5	223	const unsigned int tcphoff = ip_hdrlen(skb);
1da177e4 LT	224
	225	switch (skb->ip_summed) {
	226	case CHECKSUM_NONE:
	227	skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
84fa7933	228	case CHECKSUM_COMPLETE:
eddc9ec5	229	if (csum_tcpudp_magic(ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
1da177e4	230	skb->len - tcphoff,
eddc9ec5	231	ip_hdr(skb)->protocol, skb->csum)) {
1da177e4 LT	232	IP_VS_DBG_RL_PKT(0, pp, skb, 0,
	233	"Failed checksum for");
	234	return 0;
	235	}
	236	break;
	237	default:
84fa7933	238	/* No need to checksum. */
1da177e4 LT	239	break;
	240	}
	241
	242	return 1;
	243	}
	244
	245
	246	#define TCP_DIR_INPUT 0
	247	#define TCP_DIR_OUTPUT 4
	248	#define TCP_DIR_INPUT_ONLY 8
	249
9b5b5cff	250	static const int tcp_state_off[IP_VS_DIR_LAST] = {
1da177e4 LT	251	[IP_VS_DIR_INPUT] = TCP_DIR_INPUT,
	252	[IP_VS_DIR_OUTPUT] = TCP_DIR_OUTPUT,
	253	[IP_VS_DIR_INPUT_ONLY] = TCP_DIR_INPUT_ONLY,
	254	};
	255
	256	/*
	257	* Timeout table[state]
	258	*/
	259	static int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
	260	[IP_VS_TCP_S_NONE] = 2*HZ,
	261	[IP_VS_TCP_S_ESTABLISHED] = 1560HZ,
	262	[IP_VS_TCP_S_SYN_SENT] = 260HZ,
	263	[IP_VS_TCP_S_SYN_RECV] = 160HZ,
	264	[IP_VS_TCP_S_FIN_WAIT] = 260HZ,
	265	[IP_VS_TCP_S_TIME_WAIT] = 260HZ,
	266	[IP_VS_TCP_S_CLOSE] = 10*HZ,
	267	[IP_VS_TCP_S_CLOSE_WAIT] = 60*HZ,
	268	[IP_VS_TCP_S_LAST_ACK] = 30*HZ,
	269	[IP_VS_TCP_S_LISTEN] = 260HZ,
	270	[IP_VS_TCP_S_SYNACK] = 120*HZ,
	271	[IP_VS_TCP_S_LAST] = 2*HZ,
	272	};
	273
1da177e4 LT	274	static char * tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
	275	[IP_VS_TCP_S_NONE] = "NONE",
	276	[IP_VS_TCP_S_ESTABLISHED] = "ESTABLISHED",
	277	[IP_VS_TCP_S_SYN_SENT] = "SYN_SENT",
	278	[IP_VS_TCP_S_SYN_RECV] = "SYN_RECV",
	279	[IP_VS_TCP_S_FIN_WAIT] = "FIN_WAIT",
	280	[IP_VS_TCP_S_TIME_WAIT] = "TIME_WAIT",
	281	[IP_VS_TCP_S_CLOSE] = "CLOSE",
	282	[IP_VS_TCP_S_CLOSE_WAIT] = "CLOSE_WAIT",
	283	[IP_VS_TCP_S_LAST_ACK] = "LAST_ACK",
	284	[IP_VS_TCP_S_LISTEN] = "LISTEN",
	285	[IP_VS_TCP_S_SYNACK] = "SYNACK",
	286	[IP_VS_TCP_S_LAST] = "BUG!",
	287	};
	288
	289	#define sNO IP_VS_TCP_S_NONE
	290	#define sES IP_VS_TCP_S_ESTABLISHED
	291	#define sSS IP_VS_TCP_S_SYN_SENT
	292	#define sSR IP_VS_TCP_S_SYN_RECV
	293	#define sFW IP_VS_TCP_S_FIN_WAIT
	294	#define sTW IP_VS_TCP_S_TIME_WAIT
	295	#define sCL IP_VS_TCP_S_CLOSE
	296	#define sCW IP_VS_TCP_S_CLOSE_WAIT
	297	#define sLA IP_VS_TCP_S_LAST_ACK
	298	#define sLI IP_VS_TCP_S_LISTEN
	299	#define sSA IP_VS_TCP_S_SYNACK
	300
	301	struct tcp_states_t {
	302	int next_state[IP_VS_TCP_S_LAST];
	303	};
	304
	305	static const char * tcp_state_name(int state)
	306	{
	307	if (state >= IP_VS_TCP_S_LAST)
	308	return "ERR!";
	309	return tcp_state_name_table[state] ? tcp_state_name_table[state] : "?";
	310	}
	311
	312	static struct tcp_states_t tcp_states [] = {
	313	/* INPUT */
	314	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	315	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
	316	/fin/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
	317	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
	318	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},
	319
	320	/* OUTPUT */
	321	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	322	/syn/ {{sSS, sES, sSS, sSR, sSS, sSS, sSS, sSS, sSS, sLI, sSR }},
	323	/fin/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
	324	/ack/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
	325	/rst/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
	326
	327	/* INPUT-ONLY */
	328	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	329	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
	330	/fin/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
	331	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
	332	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
	333	};
	334
	335	static struct tcp_states_t tcp_states_dos [] = {
	336	/* INPUT */
	337	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
338	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
339	/fin/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
340	/ack/ {{sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
341	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
342
343	/* OUTPUT */
344	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
345	/syn/ {{sSS, sES, sSS, sSA, sSS, sSS, sSS, sSS, sSS, sLI, sSA }},
346	/fin/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
347	/ack/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
348	/rst/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
349
350	/* INPUT-ONLY */
351	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
352	/syn/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
353	/fin/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
354	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
355	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
356	};
357
358	static struct tcp_states_t *tcp_state_table = tcp_states;
359
360
361	static void tcp_timeout_change(struct ip_vs_protocol *pp, int flags)
362	{
363	int on = (flags & 1); /* secure_tcp */
364
365	/*
366	** FIXME: change secure_tcp to independent sysctl var
367	** or make it per-service or per-app because it is valid
368	** for most if not for all of the applications. Something
369	** like "capabilities" (flags) for each object.
370	*/
371	tcp_state_table = (on? tcp_states_dos : tcp_states);
372	}
373
374	static int
375	tcp_set_state_timeout(struct ip_vs_protocol pp, char sname, int to)
376	{
377	return ip_vs_set_state_timeout(pp->timeout_table, IP_VS_TCP_S_LAST,
378	tcp_state_name_table, sname, to);
379	}
380
381	static inline int tcp_state_idx(struct tcphdr *th)
382	{
383	if (th->rst)
384	return 3;
385	if (th->syn)
386	return 0;
387	if (th->fin)
388	return 1;
389	if (th->ack)
390	return 2;
391	return -1;
392	}
393
394	static inline void
395	set_tcp_state(struct ip_vs_protocol pp, struct ip_vs_conn cp,
396	int direction, struct tcphdr *th)
397	{
398	int state_idx;
399	int new_state = IP_VS_TCP_S_CLOSE;
400	int state_off = tcp_state_off[direction];
401
402	/*
403	* Update state offset to INPUT_ONLY if necessary
404	* or delete NO_OUTPUT flag if output packet detected
405	*/
406	if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
407	if (state_off == TCP_DIR_OUTPUT)
408	cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
409	else
410	state_off = TCP_DIR_INPUT_ONLY;
411	}
412
413	if ((state_idx = tcp_state_idx(th)) < 0) {
414	IP_VS_DBG(8, "tcp_state_idx=%d!!!\n", state_idx);
415	goto tcp_state_out;
416	}
417
418	new_state = tcp_state_table[state_off+state_idx].next_state[cp->state];
419
420	tcp_state_out:
421	if (new_state != cp->state) {
422	struct ip_vs_dest *dest = cp->dest;
423
424	IP_VS_DBG(8, "%s %s [%c%c%c%c] %u.%u.%u.%u:%d->"
4b5bdf5c	425	"%u.%u.%u.%u:%d state: %s->%s conn->refcnt:%d\n",
1da177e4 LT	426	pp->name,
	427	(state_off==TCP_DIR_OUTPUT)?"output ":"input ",
	428	th->syn? 'S' : '.',
	429	th->fin? 'F' : '.',
	430	th->ack? 'A' : '.',
	431	th->rst? 'R' : '.',
	432	NIPQUAD(cp->daddr), ntohs(cp->dport),
	433	NIPQUAD(cp->caddr), ntohs(cp->cport),
	434	tcp_state_name(cp->state),
	435	tcp_state_name(new_state),
	436	atomic_read(&cp->refcnt));
	437	if (dest) {
	438	if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
	439	(new_state != IP_VS_TCP_S_ESTABLISHED)) {
	440	atomic_dec(&dest->activeconns);
	441	atomic_inc(&dest->inactconns);
	442	cp->flags \|= IP_VS_CONN_F_INACTIVE;
	443	} else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
	444	(new_state == IP_VS_TCP_S_ESTABLISHED)) {
	445	atomic_inc(&dest->activeconns);
	446	atomic_dec(&dest->inactconns);
	447	cp->flags &= ~IP_VS_CONN_F_INACTIVE;
	448	}
	449	}
	450	}
	451
	452	cp->timeout = pp->timeout_table[cp->state = new_state];
	453	}
	454
	455
	456	/*
	457	* Handle state transitions
	458	*/
	459	static int
	460	tcp_state_transition(struct ip_vs_conn *cp, int direction,
	461	const struct sk_buff *skb,
	462	struct ip_vs_protocol *pp)
	463	{
	464	struct tcphdr _tcph, *th;
	465
c9bdd4b5	466	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
1da177e4 LT	467	if (th == NULL)
	468	return 0;
	469
	470	spin_lock(&cp->lock);
	471	set_tcp_state(pp, cp, direction, th);
	472	spin_unlock(&cp->lock);
	473
	474	return 1;
	475	}
	476
	477
	478	/*
	479	* Hash table for TCP application incarnations
	480	*/
	481	#define TCP_APP_TAB_BITS 4
	482	#define TCP_APP_TAB_SIZE (1 << TCP_APP_TAB_BITS)
	483	#define TCP_APP_TAB_MASK (TCP_APP_TAB_SIZE - 1)
	484
	485	static struct list_head tcp_apps[TCP_APP_TAB_SIZE];
	486	static DEFINE_SPINLOCK(tcp_app_lock);
	487
75e7ce66	488	static inline __u16 tcp_app_hashkey(__be16 port)
1da177e4	489	{
75e7ce66 AV	490	return (((__force u16)port >> TCP_APP_TAB_BITS) ^ (__force u16)port)
75e7ce66 AV	491	& TCP_APP_TAB_MASK;
1da177e4 LT	492	}
	493
	494
	495	static int tcp_register_app(struct ip_vs_app *inc)
	496	{
	497	struct ip_vs_app *i;
75e7ce66 AV	498	__u16 hash;
75e7ce66 AV	499	__be16 port = inc->port;
1da177e4 LT	500	int ret = 0;
	501
	502	hash = tcp_app_hashkey(port);
	503
	504	spin_lock_bh(&tcp_app_lock);
	505	list_for_each_entry(i, &tcp_apps[hash], p_list) {
	506	if (i->port == port) {
	507	ret = -EEXIST;
	508	goto out;
	509	}
	510	}
	511	list_add(&inc->p_list, &tcp_apps[hash]);
	512	atomic_inc(&ip_vs_protocol_tcp.appcnt);
	513
	514	out:
	515	spin_unlock_bh(&tcp_app_lock);
	516	return ret;
	517	}
	518
	519
	520	static void
	521	tcp_unregister_app(struct ip_vs_app *inc)
	522	{
	523	spin_lock_bh(&tcp_app_lock);
	524	atomic_dec(&ip_vs_protocol_tcp.appcnt);
	525	list_del(&inc->p_list);
	526	spin_unlock_bh(&tcp_app_lock);
	527	}
	528
	529
	530	static int
	531	tcp_app_conn_bind(struct ip_vs_conn *cp)
	532	{
	533	int hash;
	534	struct ip_vs_app *inc;
	535	int result = 0;
	536
	537	/* Default binding: bind app only for NAT */
	538	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
	539	return 0;
	540
	541	/* Lookup application incarnations and bind the right one */
	542	hash = tcp_app_hashkey(cp->vport);
	543
	544	spin_lock(&tcp_app_lock);
	545	list_for_each_entry(inc, &tcp_apps[hash], p_list) {
	546	if (inc->port == cp->vport) {
	547	if (unlikely(!ip_vs_app_inc_get(inc)))
	548	break;
	549	spin_unlock(&tcp_app_lock);
	550
	551	IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
	552	"%u.%u.%u.%u:%u to app %s on port %u\n",
0dc47877	553	__func__,
1da177e4 LT	554	NIPQUAD(cp->caddr), ntohs(cp->cport),
	555	NIPQUAD(cp->vaddr), ntohs(cp->vport),
	556	inc->name, ntohs(inc->port));
	557	cp->app = inc;
	558	if (inc->init_conn)
	559	result = inc->init_conn(inc, cp);
	560	goto out;
	561	}
	562	}
	563	spin_unlock(&tcp_app_lock);
	564
	565	out:
	566	return result;
	567	}
	568
	569
	570	/*
	571	* Set LISTEN timeout. (ip_vs_conn_put will setup timer)
	572	*/
	573	void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
	574	{
	575	spin_lock(&cp->lock);
	576	cp->state = IP_VS_TCP_S_LISTEN;
	577	cp->timeout = ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_LISTEN];
	578	spin_unlock(&cp->lock);
	579	}
	580
	581
ba602a81	582	static void ip_vs_tcp_init(struct ip_vs_protocol *pp)
1da177e4 LT	583	{
	584	IP_VS_INIT_HASH_TABLE(tcp_apps);
	585	pp->timeout_table = tcp_timeouts;
	586	}
	587
	588
ba602a81	589	static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
1da177e4 LT	590	{
	591	}
	592
	593
	594	struct ip_vs_protocol ip_vs_protocol_tcp = {
	595	.name = "TCP",
	596	.protocol = IPPROTO_TCP,
	597	.dont_defrag = 0,
	598	.appcnt = ATOMIC_INIT(0),
ba602a81 DM	599	.init = ip_vs_tcp_init,
ba602a81 DM	600	.exit = ip_vs_tcp_exit,
1da177e4 LT	601	.register_app = tcp_register_app,
	602	.unregister_app = tcp_unregister_app,
	603	.conn_schedule = tcp_conn_schedule,
	604	.conn_in_get = tcp_conn_in_get,
	605	.conn_out_get = tcp_conn_out_get,
	606	.snat_handler = tcp_snat_handler,
	607	.dnat_handler = tcp_dnat_handler,
	608	.csum_check = tcp_csum_check,
	609	.state_name = tcp_state_name,
	610	.state_transition = tcp_state_transition,
	611	.app_conn_bind = tcp_app_conn_bind,
	612	.debug_packet = ip_vs_tcpudp_debug_packet,
	613	.timeout_change = tcp_timeout_change,
	614	.set_state_timeout = tcp_set_state_timeout,
	615	};