projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph...
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / netfilter / ipvs / ip_vs_ctl.c
CommitLineData
1da177e4
LT		 1/*
2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the NetFilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
6 * cluster of servers.
7 *
1da177e4
LT		 8 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
9 * Peter Kese <peter.kese@ijs.si>
10 * Julian Anastasov <ja@ssi.bg>
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 *
17 * Changes:
18 *
19 */
20
9aada7ac
HE		 21#define KMSG_COMPONENT "IPVS"
22#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
23
1da177e4
LT		 24#include <linux/module.h>
25#include <linux/init.h>
26#include <linux/types.h>
4fc268d2 27#include <linux/capability.h>
1da177e4
LT		 28#include <linux/fs.h>
29#include <linux/sysctl.h>
30#include <linux/proc_fs.h>
31#include <linux/workqueue.h>
32#include <linux/swap.h>
1da177e4 33#include <linux/seq_file.h>
5a0e3ad6 34#include <linux/slab.h>
1da177e4
LT		 35
36#include <linux/netfilter.h>
37#include <linux/netfilter_ipv4.h>
14cc3e2b 38#include <linux/mutex.h>
1da177e4 39
457c4cbc 40#include <net/net_namespace.h>
9330419d 41#include <linux/nsproxy.h>
1da177e4 42#include <net/ip.h>
09571c7a
VB		 43#ifdef CONFIG_IP_VS_IPV6
44#include <net/ipv6.h>
45#include <net/ip6_route.h>
46#endif
14c85021 47#include <net/route.h>
1da177e4 48#include <net/sock.h>
9a812198 49#include <net/genetlink.h>
1da177e4
LT		 50
51#include <asm/uaccess.h>
52
53#include <net/ip_vs.h>
54
55/* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
14cc3e2b 56static DEFINE_MUTEX(__ip_vs_mutex);
1da177e4
LT		 57
58/* lock for service table */
59static DEFINE_RWLOCK(__ip_vs_svc_lock);
60
1da177e4 61/* sysctl variables */
1da177e4
LT		 62
63#ifdef CONFIG_IP_VS_DEBUG
64static int sysctl_ip_vs_debug_level = 0;
65
66int ip_vs_get_debug_level(void)
67{
68 return sysctl_ip_vs_debug_level;
69}
70#endif
71
7a4f0761
HS		 72
73/* Protos */
74static void __ip_vs_del_service(struct ip_vs_service *svc);
75
76
09571c7a
VB		 77#ifdef CONFIG_IP_VS_IPV6
78/* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
4a98480b
HS		 79static int __ip_vs_addr_is_local_v6(struct net *net,
80 const struct in6_addr *addr)
09571c7a
VB		 81{
82 struct rt6_info *rt;
4c9483b2
DM		 83 struct flowi6 fl6 = {
84 .daddr = *addr,
09571c7a
VB		 85 };
86
4c9483b2 87 rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
09571c7a 88 if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
4c9483b2 89 return 1;
09571c7a
VB		 90
91 return 0;
92}
93#endif
14e40546
SH		 94
95#ifdef CONFIG_SYSCTL
1da177e4 96/*
af9debd4
JA		 97 * update_defense_level is called from keventd and from sysctl,
98 * so it needs to protect itself from softirqs
1da177e4 99 */
9330419d 100static void update_defense_level(struct netns_ipvs *ipvs)
1da177e4
LT		 101{
102 struct sysinfo i;
103 static int old_secure_tcp = 0;
104 int availmem;
105 int nomem;
106 int to_change = -1;
107
108 /* we only count free and buffered memory (in pages) */
109 si_meminfo(&i);
110 availmem = i.freeram + i.bufferram;
111 /* however in linux 2.5 the i.bufferram is total page cache size,
112 we need adjust it */
113 /* si_swapinfo(&i); */
114 /* availmem = availmem - (i.totalswap - i.freeswap); */
115
a0840e2e 116 nomem = (availmem < ipvs->sysctl_amemthresh);
1da177e4 117
af9debd4
JA		 118 local_bh_disable();
119
1da177e4 120 /* drop_entry */
a0840e2e
HS		 121 spin_lock(&ipvs->dropentry_lock);
122 switch (ipvs->sysctl_drop_entry) {
1da177e4 123 case 0:
a0840e2e 124 atomic_set(&ipvs->dropentry, 0);
1da177e4
LT		 125 break;
126 case 1:
127 if (nomem) {
a0840e2e
HS		 128 atomic_set(&ipvs->dropentry, 1);
129 ipvs->sysctl_drop_entry = 2;
1da177e4 130 } else {
a0840e2e 131 atomic_set(&ipvs->dropentry, 0);
1da177e4
LT		 132 }
133 break;
134 case 2:
135 if (nomem) {
a0840e2e 136 atomic_set(&ipvs->dropentry, 1);
1da177e4 137 } else {
a0840e2e
HS		 138 atomic_set(&ipvs->dropentry, 0);
139 ipvs->sysctl_drop_entry = 1;
1da177e4
LT		 140 };
141 break;
142 case 3:
a0840e2e 143 atomic_set(&ipvs->dropentry, 1);
1da177e4
LT		 144 break;
145 }
a0840e2e 146 spin_unlock(&ipvs->dropentry_lock);
1da177e4
LT		 147
148 /* drop_packet */
a0840e2e
HS		 149 spin_lock(&ipvs->droppacket_lock);
150 switch (ipvs->sysctl_drop_packet) {
1da177e4 151 case 0:
a0840e2e 152 ipvs->drop_rate = 0;
1da177e4
LT		 153 break;
154 case 1:
155 if (nomem) {
a0840e2e
HS		 156 ipvs->drop_rate = ipvs->drop_counter
157 = ipvs->sysctl_amemthresh /
158 (ipvs->sysctl_amemthresh-availmem);
159 ipvs->sysctl_drop_packet = 2;
1da177e4 160 } else {
a0840e2e 161 ipvs->drop_rate = 0;
1da177e4
LT		 162 }
163 break;
164 case 2:
165 if (nomem) {
a0840e2e
HS		 166 ipvs->drop_rate = ipvs->drop_counter
167 = ipvs->sysctl_amemthresh /
168 (ipvs->sysctl_amemthresh-availmem);
1da177e4 169 } else {
a0840e2e
HS		 170 ipvs->drop_rate = 0;
171 ipvs->sysctl_drop_packet = 1;
1da177e4
LT		 172 }
173 break;
174 case 3:
a0840e2e 175 ipvs->drop_rate = ipvs->sysctl_am_droprate;
1da177e4
LT		 176 break;
177 }
a0840e2e 178 spin_unlock(&ipvs->droppacket_lock);
1da177e4
LT		 179
180 /* secure_tcp */
a0840e2e
HS		 181 spin_lock(&ipvs->securetcp_lock);
182 switch (ipvs->sysctl_secure_tcp) {
1da177e4
LT		 183 case 0:
184 if (old_secure_tcp >= 2)
185 to_change = 0;
186 break;
187 case 1:
188 if (nomem) {
189 if (old_secure_tcp < 2)
190 to_change = 1;
a0840e2e 191 ipvs->sysctl_secure_tcp = 2;
1da177e4
LT		 192 } else {
193 if (old_secure_tcp >= 2)
194 to_change = 0;
195 }
196 break;
197 case 2:
198 if (nomem) {
199 if (old_secure_tcp < 2)
200 to_change = 1;
201 } else {
202 if (old_secure_tcp >= 2)
203 to_change = 0;
a0840e2e 204 ipvs->sysctl_secure_tcp = 1;
1da177e4
LT		 205 }
206 break;
207 case 3:
208 if (old_secure_tcp < 2)
209 to_change = 1;
210 break;
211 }
a0840e2e 212 old_secure_tcp = ipvs->sysctl_secure_tcp;
1da177e4 213 if (to_change >= 0)
9330419d 214 ip_vs_protocol_timeout_change(ipvs,
a0840e2e
HS		 215 ipvs->sysctl_secure_tcp > 1);
216 spin_unlock(&ipvs->securetcp_lock);
af9debd4
JA		 217
218 local_bh_enable();
1da177e4
LT		 219}
220
221
222/*
223 * Timer for checking the defense
224 */
225#define DEFENSE_TIMER_PERIOD 1*HZ
1da177e4 226
c4028958 227static void defense_work_handler(struct work_struct *work)
1da177e4 228{
f6340ee0
HS		 229 struct netns_ipvs *ipvs =
230 container_of(work, struct netns_ipvs, defense_work.work);
9330419d
HS		 231
232 update_defense_level(ipvs);
a0840e2e 233 if (atomic_read(&ipvs->dropentry))
f6340ee0
HS		 234 ip_vs_random_dropentry(ipvs->net);
235 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
1da177e4 236}
14e40546 237#endif
1da177e4
LT		 238
239int
240ip_vs_use_count_inc(void)
241{
242 return try_module_get(THIS_MODULE);
243}
244
245void
246ip_vs_use_count_dec(void)
247{
248 module_put(THIS_MODULE);
249}
250
251
252/*
253 * Hash table: for virtual service lookups
254 */
255#define IP_VS_SVC_TAB_BITS 8
256#define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
257#define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
258
259/* the service table hashed by <protocol, addr, port> */
260static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
261/* the service table hashed by fwmark */
262static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
263
1da177e4
LT		 264
265/*
266 * Returns hash value for virtual service
267 */
fc723250
HS		 268static inline unsigned
269ip_vs_svc_hashkey(struct net *net, int af, unsigned proto,
270 const union nf_inet_addr *addr, __be16 port)
1da177e4
LT		 271{
272 register unsigned porth = ntohs(port);
b18610de 273 __be32 addr_fold = addr->ip;
1da177e4 274
b18610de
JV		 275#ifdef CONFIG_IP_VS_IPV6
276 if (af == AF_INET6)
277 addr_fold = addr->ip6[0]^addr->ip6[1]^
278 addr->ip6[2]^addr->ip6[3];
279#endif
fc723250 280 addr_fold ^= ((size_t)net>>8);
b18610de
JV		 281
282 return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
1da177e4
LT		 283 & IP_VS_SVC_TAB_MASK;
284}
285
286/*
287 * Returns hash value of fwmark for virtual service lookup
288 */
fc723250 289static inline unsigned ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
1da177e4 290{
fc723250 291 return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
1da177e4
LT		 292}
293
294/*
fc723250 295 * Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
1da177e4
LT		 296 * or in the ip_vs_svc_fwm_table by fwmark.
297 * Should be called with locked tables.
298 */
299static int ip_vs_svc_hash(struct ip_vs_service *svc)
300{
301 unsigned hash;
302
303 if (svc->flags & IP_VS_SVC_F_HASHED) {
1e3e238e
HE		 304 pr_err("%s(): request for already hashed, called from %pF\n",
305 __func__, __builtin_return_address(0));
1da177e4
LT		 306 return 0;
307 }
308
309 if (svc->fwmark == 0) {
310 /*
fc723250 311 * Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
1da177e4 312 */
fc723250
HS		 313 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
314 &svc->addr, svc->port);
1da177e4
LT		 315 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
316 } else {
317 /*
fc723250 318 * Hash it by fwmark in svc_fwm_table
1da177e4 319 */
fc723250 320 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
1da177e4
LT		 321 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
322 }
323
324 svc->flags |= IP_VS_SVC_F_HASHED;
325 /* increase its refcnt because it is referenced by the svc table */
326 atomic_inc(&svc->refcnt);
327 return 1;
328}
329
330
331/*
fc723250 332 * Unhashes a service from svc_table / svc_fwm_table.
1da177e4
LT		 333 * Should be called with locked tables.
334 */
335static int ip_vs_svc_unhash(struct ip_vs_service *svc)
336{
337 if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
1e3e238e
HE		 338 pr_err("%s(): request for unhash flagged, called from %pF\n",
339 __func__, __builtin_return_address(0));
1da177e4
LT		 340 return 0;
341 }
342
343 if (svc->fwmark == 0) {
fc723250 344 /* Remove it from the svc_table table */
1da177e4
LT		 345 list_del(&svc->s_list);
346 } else {
fc723250 347 /* Remove it from the svc_fwm_table table */
1da177e4
LT		 348 list_del(&svc->f_list);
349 }
350
351 svc->flags &= ~IP_VS_SVC_F_HASHED;
352 atomic_dec(&svc->refcnt);
353 return 1;
354}
355
356
357/*
fc723250 358 * Get service by {netns, proto,addr,port} in the service table.
1da177e4 359 */
b18610de 360static inline struct ip_vs_service *
fc723250
HS		 361__ip_vs_service_find(struct net *net, int af, __u16 protocol,
362 const union nf_inet_addr *vaddr, __be16 vport)
1da177e4
LT		 363{
364 unsigned hash;
365 struct ip_vs_service *svc;
366
367 /* Check for "full" addressed entries */
fc723250 368 hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
1da177e4
LT		 369
370 list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
b18610de
JV		 371 if ((svc->af == af)
372 && ip_vs_addr_equal(af, &svc->addr, vaddr)
1da177e4 373 && (svc->port == vport)
fc723250
HS		 374 && (svc->protocol == protocol)
375 && net_eq(svc->net, net)) {
1da177e4 376 /* HIT */
1da177e4
LT		 377 return svc;
378 }
379 }
380
381 return NULL;
382}
383
384
385/*
386 * Get service by {fwmark} in the service table.
387 */
b18610de 388static inline struct ip_vs_service *
fc723250 389__ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
1da177e4
LT		 390{
391 unsigned hash;
392 struct ip_vs_service *svc;
393
394 /* Check for fwmark addressed entries */
fc723250 395 hash = ip_vs_svc_fwm_hashkey(net, fwmark);
1da177e4
LT		 396
397 list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
fc723250
HS		 398 if (svc->fwmark == fwmark && svc->af == af
399 && net_eq(svc->net, net)) {
1da177e4 400 /* HIT */
1da177e4
LT		 401 return svc;
402 }
403 }
404
405 return NULL;
406}
407
408struct ip_vs_service *
fc723250 409ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
3c2e0505 410 const union nf_inet_addr *vaddr, __be16 vport)
1da177e4
LT		 411{
412 struct ip_vs_service *svc;
763f8d0e 413 struct netns_ipvs *ipvs = net_ipvs(net);
3c2e0505 414
1da177e4
LT		 415 read_lock(&__ip_vs_svc_lock);
416
417 /*
418 * Check the table hashed by fwmark first
419 */
097fc76a
JA		 420 if (fwmark) {
421 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
422 if (svc)
423 goto out;
424 }
1da177e4
LT		 425
426 /*
427 * Check the table hashed by <protocol,addr,port>
428 * for "full" addressed entries
429 */
fc723250 430 svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
1da177e4
LT		 431
432 if (svc == NULL
433 && protocol == IPPROTO_TCP
763f8d0e 434 && atomic_read(&ipvs->ftpsvc_counter)
1da177e4
LT		 435 && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
436 /*
437 * Check if ftp service entry exists, the packet
438 * might belong to FTP data connections.
439 */
fc723250 440 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
1da177e4
LT		 441 }
442
443 if (svc == NULL
763f8d0e 444 && atomic_read(&ipvs->nullsvc_counter)) {
1da177e4
LT		 445 /*
446 * Check if the catch-all port (port zero) exists
447 */
fc723250 448 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
1da177e4
LT		 449 }
450
451 out:
26c15cfd
JA		 452 if (svc)
453 atomic_inc(&svc->usecnt);
1da177e4
LT		 454 read_unlock(&__ip_vs_svc_lock);
455
3c2e0505
JV		 456 IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
457 fwmark, ip_vs_proto_name(protocol),
458 IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
459 svc ? "hit" : "not hit");
1da177e4
LT		 460
461 return svc;
462}
463
464
465static inline void
466__ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
467{
468 atomic_inc(&svc->refcnt);
469 dest->svc = svc;
470}
471
26c15cfd 472static void
1da177e4
LT		 473__ip_vs_unbind_svc(struct ip_vs_dest *dest)
474{
475 struct ip_vs_service *svc = dest->svc;
476
477 dest->svc = NULL;
26c15cfd
JA		 478 if (atomic_dec_and_test(&svc->refcnt)) {
479 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
480 svc->fwmark,
481 IP_VS_DBG_ADDR(svc->af, &svc->addr),
482 ntohs(svc->port), atomic_read(&svc->usecnt));
b17fc996 483 free_percpu(svc->stats.cpustats);
1da177e4 484 kfree(svc);
26c15cfd 485 }
1da177e4
LT		 486}
487
488
489/*
490 * Returns hash value for real service
491 */
7937df15
JV		 492static inline unsigned ip_vs_rs_hashkey(int af,
493 const union nf_inet_addr *addr,
494 __be16 port)
1da177e4
LT		 495{
496 register unsigned porth = ntohs(port);
7937df15
JV		 497 __be32 addr_fold = addr->ip;
498
499#ifdef CONFIG_IP_VS_IPV6
500 if (af == AF_INET6)
501 addr_fold = addr->ip6[0]^addr->ip6[1]^
502 addr->ip6[2]^addr->ip6[3];
503#endif
1da177e4 504
7937df15 505 return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
1da177e4
LT		 506 & IP_VS_RTAB_MASK;
507}
508
509/*
fc723250 510 * Hashes ip_vs_dest in rs_table by <proto,addr,port>.
1da177e4
LT		 511 * should be called with locked tables.
512 */
fc723250 513static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
1da177e4
LT		 514{
515 unsigned hash;
516
517 if (!list_empty(&dest->d_list)) {
518 return 0;
519 }
520
521 /*
522 * Hash by proto,addr,port,
523 * which are the parameters of the real service.
524 */
7937df15
JV		 525 hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
526
fc723250 527 list_add(&dest->d_list, &ipvs->rs_table[hash]);
1da177e4
LT		 528
529 return 1;
530}
531
532/*
fc723250 533 * UNhashes ip_vs_dest from rs_table.
1da177e4
LT		 534 * should be called with locked tables.
535 */
536static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
537{
538 /*
fc723250 539 * Remove it from the rs_table table.
1da177e4
LT		 540 */
541 if (!list_empty(&dest->d_list)) {
542 list_del(&dest->d_list);
543 INIT_LIST_HEAD(&dest->d_list);
544 }
545
546 return 1;
547}
548
549/*
550 * Lookup real service by <proto,addr,port> in the real service table.
551 */
552struct ip_vs_dest *
fc723250 553ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
7937df15
JV		 554 const union nf_inet_addr *daddr,
555 __be16 dport)
1da177e4 556{
fc723250 557 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4
LT		 558 unsigned hash;
559 struct ip_vs_dest *dest;
560
561 /*
562 * Check for "full" addressed entries
563 * Return the first found entry
564 */
7937df15 565 hash = ip_vs_rs_hashkey(af, daddr, dport);
1da177e4 566
a0840e2e 567 read_lock(&ipvs->rs_lock);
fc723250 568 list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
7937df15
JV		 569 if ((dest->af == af)
570 && ip_vs_addr_equal(af, &dest->addr, daddr)
1da177e4
LT		 571 && (dest->port == dport)
572 && ((dest->protocol == protocol) ||
573 dest->vfwmark)) {
574 /* HIT */
a0840e2e 575 read_unlock(&ipvs->rs_lock);
1da177e4
LT		 576 return dest;
577 }
578 }
a0840e2e 579 read_unlock(&ipvs->rs_lock);
1da177e4
LT		 580
581 return NULL;
582}
583
584/*
585 * Lookup destination by {addr,port} in the given service
586 */
587static struct ip_vs_dest *
7937df15
JV		 588ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
589 __be16 dport)
1da177e4
LT		 590{
591 struct ip_vs_dest *dest;
592
593 /*
594 * Find the destination for the given service
595 */
596 list_for_each_entry(dest, &svc->destinations, n_list) {
7937df15
JV		 597 if ((dest->af == svc->af)
598 && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
599 && (dest->port == dport)) {
1da177e4
LT		 600 /* HIT */
601 return dest;
602 }
603 }
604
605 return NULL;
606}
607
1e356f9c
RB		 608/*
609 * Find destination by {daddr,dport,vaddr,protocol}
610 * Cretaed to be used in ip_vs_process_message() in
611 * the backup synchronization daemon. It finds the
612 * destination to be bound to the received connection
613 * on the backup.
614 *
615 * ip_vs_lookup_real_service() looked promissing, but
616 * seems not working as expected.
617 */
fc723250
HS		 618struct ip_vs_dest *ip_vs_find_dest(struct net *net, int af,
619 const union nf_inet_addr *daddr,
7937df15
JV		 620 __be16 dport,
621 const union nf_inet_addr *vaddr,
0e051e68 622 __be16 vport, __u16 protocol, __u32 fwmark)
1e356f9c
RB		 623{
624 struct ip_vs_dest *dest;
625 struct ip_vs_service *svc;
626
fc723250 627 svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
1e356f9c
RB		 628 if (!svc)
629 return NULL;
630 dest = ip_vs_lookup_dest(svc, daddr, dport);
631 if (dest)
632 atomic_inc(&dest->refcnt);
633 ip_vs_service_put(svc);
634 return dest;
635}
1da177e4
LT		 636
637/*
638 * Lookup dest by {svc,addr,port} in the destination trash.
639 * The destination trash is used to hold the destinations that are removed
640 * from the service table but are still referenced by some conn entries.
641 * The reason to add the destination trash is when the dest is temporary
642 * down (either by administrator or by monitor program), the dest can be
643 * picked back from the trash, the remaining connections to the dest can
644 * continue, and the counting information of the dest is also useful for
645 * scheduling.
646 */
647static struct ip_vs_dest *
7937df15
JV		 648ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
649 __be16 dport)
1da177e4
LT		 650{
651 struct ip_vs_dest *dest, *nxt;
f2431e6e 652 struct netns_ipvs *ipvs = net_ipvs(svc->net);
1da177e4
LT		 653
654 /*
655 * Find the destination in trash
656 */
f2431e6e 657 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
7937df15
JV		 658 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
659 "dest->refcnt=%d\n",
660 dest->vfwmark,
661 IP_VS_DBG_ADDR(svc->af, &dest->addr),
662 ntohs(dest->port),
663 atomic_read(&dest->refcnt));
664 if (dest->af == svc->af &&
665 ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
1da177e4
LT		 666 dest->port == dport &&
667 dest->vfwmark == svc->fwmark &&
668 dest->protocol == svc->protocol &&
669 (svc->fwmark ||
7937df15 670 (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
1da177e4
LT		 671 dest->vport == svc->port))) {
672 /* HIT */
673 return dest;
674 }
675
676 /*
677 * Try to purge the destination from trash if not referenced
678 */
679 if (atomic_read(&dest->refcnt) == 1) {
7937df15
JV		 680 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
681 "from trash\n",
682 dest->vfwmark,
683 IP_VS_DBG_ADDR(svc->af, &dest->addr),
684 ntohs(dest->port));
1da177e4
LT		 685 list_del(&dest->n_list);
686 ip_vs_dst_reset(dest);
687 __ip_vs_unbind_svc(dest);
b17fc996 688 free_percpu(dest->stats.cpustats);
1da177e4
LT		 689 kfree(dest);
690 }
691 }
692
693 return NULL;
694}
695
696
697/*
698 * Clean up all the destinations in the trash
699 * Called by the ip_vs_control_cleanup()
700 *
701 * When the ip_vs_control_clearup is activated by ipvs module exit,
702 * the service tables must have been flushed and all the connections
703 * are expired, and the refcnt of each destination in the trash must
704 * be 1, so we simply release them here.
705 */
f2431e6e 706static void ip_vs_trash_cleanup(struct net *net)
1da177e4
LT		 707{
708 struct ip_vs_dest *dest, *nxt;
f2431e6e 709 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4 710
f2431e6e 711 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
1da177e4
LT		 712 list_del(&dest->n_list);
713 ip_vs_dst_reset(dest);
714 __ip_vs_unbind_svc(dest);
b17fc996 715 free_percpu(dest->stats.cpustats);
1da177e4
LT		 716 kfree(dest);
717 }
718}
719
55a3d4e1
JA		 720static void
721ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
722{
723#define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
55a3d4e1
JA		 724
725 spin_lock_bh(&src->lock);
726
727 IP_VS_SHOW_STATS_COUNTER(conns);
728 IP_VS_SHOW_STATS_COUNTER(inpkts);
729 IP_VS_SHOW_STATS_COUNTER(outpkts);
730 IP_VS_SHOW_STATS_COUNTER(inbytes);
731 IP_VS_SHOW_STATS_COUNTER(outbytes);
732
ea9f22cc 733 ip_vs_read_estimator(dst, src);
55a3d4e1
JA		 734
735 spin_unlock_bh(&src->lock);
736}
1da177e4
LT		 737
738static void
739ip_vs_zero_stats(struct ip_vs_stats *stats)
740{
741 spin_lock_bh(&stats->lock);
e93615d0 742
55a3d4e1
JA		 743 /* get current counters as zero point, rates are zeroed */
744
745#define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
55a3d4e1
JA		 746
747 IP_VS_ZERO_STATS_COUNTER(conns);
748 IP_VS_ZERO_STATS_COUNTER(inpkts);
749 IP_VS_ZERO_STATS_COUNTER(outpkts);
750 IP_VS_ZERO_STATS_COUNTER(inbytes);
751 IP_VS_ZERO_STATS_COUNTER(outbytes);
752
1da177e4 753 ip_vs_zero_estimator(stats);
e93615d0 754
3a14a313 755 spin_unlock_bh(&stats->lock);
1da177e4
LT		 756}
757
758/*
759 * Update a destination in the given service
760 */
761static void
26c15cfd
JA		 762__ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
763 struct ip_vs_dest_user_kern *udest, int add)
1da177e4 764{
fc723250 765 struct netns_ipvs *ipvs = net_ipvs(svc->net);
1da177e4
LT		 766 int conn_flags;
767
768 /* set the weight and the flags */
769 atomic_set(&dest->weight, udest->weight);
3575792e
JA		 770 conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
771 conn_flags |= IP_VS_CONN_F_INACTIVE;
1da177e4 772
1da177e4 773 /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
3575792e 774 if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
1da177e4
LT		 775 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
776 } else {
777 /*
fc723250 778 * Put the real service in rs_table if not present.
1da177e4
LT		 779 * For now only for NAT!
780 */
a0840e2e 781 write_lock_bh(&ipvs->rs_lock);
fc723250 782 ip_vs_rs_hash(ipvs, dest);
a0840e2e 783 write_unlock_bh(&ipvs->rs_lock);
1da177e4
LT		 784 }
785 atomic_set(&dest->conn_flags, conn_flags);
786
787 /* bind the service */
788 if (!dest->svc) {
789 __ip_vs_bind_svc(dest, svc);
790 } else {
791 if (dest->svc != svc) {
792 __ip_vs_unbind_svc(dest);
793 ip_vs_zero_stats(&dest->stats);
794 __ip_vs_bind_svc(dest, svc);
795 }
796 }
797
798 /* set the dest status flags */
799 dest->flags |= IP_VS_DEST_F_AVAILABLE;
800
801 if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
802 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
803 dest->u_threshold = udest->u_threshold;
804 dest->l_threshold = udest->l_threshold;
26c15cfd 805
ff75f40f 806 spin_lock_bh(&dest->dst_lock);
fc604767 807 ip_vs_dst_reset(dest);
ff75f40f 808 spin_unlock_bh(&dest->dst_lock);
fc604767 809
26c15cfd 810 if (add)
6ef757f9 811 ip_vs_start_estimator(svc->net, &dest->stats);
26c15cfd
JA		 812
813 write_lock_bh(&__ip_vs_svc_lock);
814
815 /* Wait until all other svc users go away */
816 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
817
818 if (add) {
819 list_add(&dest->n_list, &svc->destinations);
820 svc->num_dests++;
821 }
822
823 /* call the update_service, because server weight may be changed */
824 if (svc->scheduler->update_service)
825 svc->scheduler->update_service(svc);
826
827 write_unlock_bh(&__ip_vs_svc_lock);
1da177e4
LT		 828}
829
830
831/*
832 * Create a destination for the given service
833 */
834static int
c860c6b1 835ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
1da177e4
LT		 836 struct ip_vs_dest **dest_p)
837{
838 struct ip_vs_dest *dest;
839 unsigned atype;
840
841 EnterFunction(2);
842
09571c7a
VB		 843#ifdef CONFIG_IP_VS_IPV6
844 if (svc->af == AF_INET6) {
845 atype = ipv6_addr_type(&udest->addr.in6);
3bfb92f4
SW		 846 if ((!(atype & IPV6_ADDR_UNICAST) ||
847 atype & IPV6_ADDR_LINKLOCAL) &&
4a98480b 848 !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
09571c7a
VB		 849 return -EINVAL;
850 } else
851#endif
852 {
4a98480b 853 atype = inet_addr_type(svc->net, udest->addr.ip);
09571c7a
VB		 854 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
855 return -EINVAL;
856 }
1da177e4 857
dee06e47 858 dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
0a9ee813 859 if (dest == NULL)
1da177e4 860 return -ENOMEM;
0a9ee813 861
b17fc996 862 dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
0a9ee813 863 if (!dest->stats.cpustats)
b17fc996 864 goto err_alloc;
1da177e4 865
c860c6b1 866 dest->af = svc->af;
1da177e4 867 dest->protocol = svc->protocol;
c860c6b1 868 dest->vaddr = svc->addr;
1da177e4
LT		 869 dest->vport = svc->port;
870 dest->vfwmark = svc->fwmark;
c860c6b1 871 ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
1da177e4
LT		 872 dest->port = udest->port;
873
874 atomic_set(&dest->activeconns, 0);
875 atomic_set(&dest->inactconns, 0);
876 atomic_set(&dest->persistconns, 0);
26c15cfd 877 atomic_set(&dest->refcnt, 1);
1da177e4
LT		 878
879 INIT_LIST_HEAD(&dest->d_list);
880 spin_lock_init(&dest->dst_lock);
881 spin_lock_init(&dest->stats.lock);
26c15cfd 882 __ip_vs_update_dest(svc, dest, udest, 1);
1da177e4
LT		 883
884 *dest_p = dest;
885
886 LeaveFunction(2);
887 return 0;
b17fc996
HS		 888
889err_alloc:
890 kfree(dest);
891 return -ENOMEM;
1da177e4
LT		 892}
893
894
895/*
896 * Add a destination into an existing service
897 */
898static int
c860c6b1 899ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 900{
901 struct ip_vs_dest *dest;
c860c6b1 902 union nf_inet_addr daddr;
014d730d 903 __be16 dport = udest->port;
1da177e4
LT		 904 int ret;
905
906 EnterFunction(2);
907
908 if (udest->weight < 0) {
1e3e238e 909 pr_err("%s(): server weight less than zero\n", __func__);
1da177e4
LT		 910 return -ERANGE;
911 }
912
913 if (udest->l_threshold > udest->u_threshold) {
1e3e238e
HE		 914 pr_err("%s(): lower threshold is higher than upper threshold\n",
915 __func__);
1da177e4
LT		 916 return -ERANGE;
917 }
918
c860c6b1
JV		 919 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
920
1da177e4
LT		 921 /*
922 * Check if the dest already exists in the list
923 */
7937df15
JV		 924 dest = ip_vs_lookup_dest(svc, &daddr, dport);
925
1da177e4 926 if (dest != NULL) {
1e3e238e 927 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
1da177e4
LT		 928 return -EEXIST;
929 }
930
931 /*
932 * Check if the dest already exists in the trash and
933 * is from the same service
934 */
7937df15
JV		 935 dest = ip_vs_trash_get_dest(svc, &daddr, dport);
936
1da177e4 937 if (dest != NULL) {
cfc78c5a
JV		 938 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
939 "dest->refcnt=%d, service %u/%s:%u\n",
940 IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
941 atomic_read(&dest->refcnt),
942 dest->vfwmark,
943 IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
944 ntohs(dest->vport));
945
1da177e4
LT		 946 /*
947 * Get the destination from the trash
948 */
949 list_del(&dest->n_list);
950
26c15cfd
JA		 951 __ip_vs_update_dest(svc, dest, udest, 1);
952 ret = 0;
953 } else {
1da177e4 954 /*
26c15cfd 955 * Allocate and initialize the dest structure
1da177e4 956 */
26c15cfd 957 ret = ip_vs_new_dest(svc, udest, &dest);
1da177e4 958 }
1da177e4
LT		 959 LeaveFunction(2);
960
26c15cfd 961 return ret;
1da177e4
LT		 962}
963
964
965/*
966 * Edit a destination in the given service
967 */
968static int
c860c6b1 969ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 970{
971 struct ip_vs_dest *dest;
c860c6b1 972 union nf_inet_addr daddr;
014d730d 973 __be16 dport = udest->port;
1da177e4
LT		 974
975 EnterFunction(2);
976
977 if (udest->weight < 0) {
1e3e238e 978 pr_err("%s(): server weight less than zero\n", __func__);
1da177e4
LT		 979 return -ERANGE;
980 }
981
982 if (udest->l_threshold > udest->u_threshold) {
1e3e238e
HE		 983 pr_err("%s(): lower threshold is higher than upper threshold\n",
984 __func__);
1da177e4
LT		 985 return -ERANGE;
986 }
987
c860c6b1
JV		 988 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
989
1da177e4
LT		 990 /*
991 * Lookup the destination list
992 */
7937df15
JV		 993 dest = ip_vs_lookup_dest(svc, &daddr, dport);
994
1da177e4 995 if (dest == NULL) {
1e3e238e 996 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1da177e4
LT		 997 return -ENOENT;
998 }
999
26c15cfd 1000 __ip_vs_update_dest(svc, dest, udest, 0);
1da177e4
LT		 1001 LeaveFunction(2);
1002
1003 return 0;
1004}
1005
1006
1007/*
1008 * Delete a destination (must be already unlinked from the service)
1009 */
29c2026f 1010static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1da177e4 1011{
a0840e2e
HS		 1012 struct netns_ipvs *ipvs = net_ipvs(net);
1013
6ef757f9 1014 ip_vs_stop_estimator(net, &dest->stats);
1da177e4
LT		 1015
1016 /*
1017 * Remove it from the d-linked list with the real services.
1018 */
a0840e2e 1019 write_lock_bh(&ipvs->rs_lock);
1da177e4 1020 ip_vs_rs_unhash(dest);
a0840e2e 1021 write_unlock_bh(&ipvs->rs_lock);
1da177e4
LT		 1022
1023 /*
1024 * Decrease the refcnt of the dest, and free the dest
1025 * if nobody refers to it (refcnt=0). Otherwise, throw
1026 * the destination into the trash.
1027 */
1028 if (atomic_dec_and_test(&dest->refcnt)) {
26c15cfd
JA		 1029 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1030 dest->vfwmark,
1031 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1032 ntohs(dest->port));
1da177e4
LT		 1033 ip_vs_dst_reset(dest);
1034 /* simply decrease svc->refcnt here, let the caller check
1035 and release the service if nobody refers to it.
1036 Only user context can release destination and service,
1037 and only one user context can update virtual service at a
1038 time, so the operation here is OK */
1039 atomic_dec(&dest->svc->refcnt);
b17fc996 1040 free_percpu(dest->stats.cpustats);
1da177e4
LT		 1041 kfree(dest);
1042 } else {
cfc78c5a
JV		 1043 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1044 "dest->refcnt=%d\n",
1045 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1046 ntohs(dest->port),
1047 atomic_read(&dest->refcnt));
f2431e6e 1048 list_add(&dest->n_list, &ipvs->dest_trash);
1da177e4
LT		 1049 atomic_inc(&dest->refcnt);
1050 }
1051}
1052
1053
1054/*
1055 * Unlink a destination from the given service
1056 */
1057static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1058 struct ip_vs_dest *dest,
1059 int svcupd)
1060{
1061 dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1062
1063 /*
1064 * Remove it from the d-linked destination list.
1065 */
1066 list_del(&dest->n_list);
1067 svc->num_dests--;
82dfb6f3
SW		 1068
1069 /*
1070 * Call the update_service function of its scheduler
1071 */
1072 if (svcupd && svc->scheduler->update_service)
1073 svc->scheduler->update_service(svc);
1da177e4
LT		 1074}
1075
1076
1077/*
1078 * Delete a destination server in the given service
1079 */
1080static int
c860c6b1 1081ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 1082{
1083 struct ip_vs_dest *dest;
014d730d 1084 __be16 dport = udest->port;
1da177e4
LT		 1085
1086 EnterFunction(2);
1087
7937df15 1088 dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
c860c6b1 1089
1da177e4 1090 if (dest == NULL) {
1e3e238e 1091 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1da177e4
LT		 1092 return -ENOENT;
1093 }
1094
1095 write_lock_bh(&__ip_vs_svc_lock);
1096
1097 /*
1098 * Wait until all other svc users go away.
1099 */
26c15cfd 1100 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1101
1102 /*
1103 * Unlink dest from the service
1104 */
1105 __ip_vs_unlink_dest(svc, dest, 1);
1106
1107 write_unlock_bh(&__ip_vs_svc_lock);
1108
1109 /*
1110 * Delete the destination
1111 */
a0840e2e 1112 __ip_vs_del_dest(svc->net, dest);
1da177e4
LT		 1113
1114 LeaveFunction(2);
1115
1116 return 0;
1117}
1118
1119
1120/*
1121 * Add a service into the service hash table
1122 */
1123static int
fc723250 1124ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
c860c6b1 1125 struct ip_vs_service **svc_p)
1da177e4
LT		 1126{
1127 int ret = 0;
1128 struct ip_vs_scheduler *sched = NULL;
0d1e71b0 1129 struct ip_vs_pe *pe = NULL;
1da177e4 1130 struct ip_vs_service *svc = NULL;
a0840e2e 1131 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4
LT		 1132
1133 /* increase the module use count */
1134 ip_vs_use_count_inc();
1135
1136 /* Lookup the scheduler by 'u->sched_name' */
1137 sched = ip_vs_scheduler_get(u->sched_name);
1138 if (sched == NULL) {
1e3e238e 1139 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1da177e4 1140 ret = -ENOENT;
6e08bfb8 1141 goto out_err;
1da177e4
LT		 1142 }
1143
0d1e71b0 1144 if (u->pe_name && *u->pe_name) {
e9e5eee8 1145 pe = ip_vs_pe_getbyname(u->pe_name);
0d1e71b0
SH		 1146 if (pe == NULL) {
1147 pr_info("persistence engine module ip_vs_pe_%s "
1148 "not found\n", u->pe_name);
1149 ret = -ENOENT;
1150 goto out_err;
1151 }
1152 }
1153
f94fd041 1154#ifdef CONFIG_IP_VS_IPV6
48148938
JV		 1155 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1156 ret = -EINVAL;
1157 goto out_err;
f94fd041
JV		 1158 }
1159#endif
1160
dee06e47 1161 svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1da177e4 1162 if (svc == NULL) {
1e3e238e 1163 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1da177e4
LT		 1164 ret = -ENOMEM;
1165 goto out_err;
1166 }
b17fc996 1167 svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
0a9ee813 1168 if (!svc->stats.cpustats)
b17fc996 1169 goto out_err;
1da177e4
LT		 1170
1171 /* I'm the first user of the service */
26c15cfd 1172 atomic_set(&svc->usecnt, 0);
1da177e4
LT		 1173 atomic_set(&svc->refcnt, 0);
1174
c860c6b1 1175 svc->af = u->af;
1da177e4 1176 svc->protocol = u->protocol;
c860c6b1 1177 ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1da177e4
LT		 1178 svc->port = u->port;
1179 svc->fwmark = u->fwmark;
1180 svc->flags = u->flags;
1181 svc->timeout = u->timeout * HZ;
1182 svc->netmask = u->netmask;
fc723250 1183 svc->net = net;
1da177e4
LT		 1184
1185 INIT_LIST_HEAD(&svc->destinations);
1186 rwlock_init(&svc->sched_lock);
1187 spin_lock_init(&svc->stats.lock);
1188
1189 /* Bind the scheduler */
1190 ret = ip_vs_bind_scheduler(svc, sched);
1191 if (ret)
1192 goto out_err;
1193 sched = NULL;
1194
0d1e71b0
SH		 1195 /* Bind the ct retriever */
1196 ip_vs_bind_pe(svc, pe);
1197 pe = NULL;
1198
1da177e4
LT		 1199 /* Update the virtual service counters */
1200 if (svc->port == FTPPORT)
763f8d0e 1201 atomic_inc(&ipvs->ftpsvc_counter);
1da177e4 1202 else if (svc->port == 0)
763f8d0e 1203 atomic_inc(&ipvs->nullsvc_counter);
1da177e4 1204
6ef757f9 1205 ip_vs_start_estimator(net, &svc->stats);
f94fd041
JV		 1206
1207 /* Count only IPv4 services for old get/setsockopt interface */
1208 if (svc->af == AF_INET)
a0840e2e 1209 ipvs->num_services++;
1da177e4
LT		 1210
1211 /* Hash the service into the service table */
1212 write_lock_bh(&__ip_vs_svc_lock);
1213 ip_vs_svc_hash(svc);
1214 write_unlock_bh(&__ip_vs_svc_lock);
1215
1216 *svc_p = svc;
7a4f0761
HS		 1217 /* Now there is a service - full throttle */
1218 ipvs->enable = 1;
1da177e4
LT		 1219 return 0;
1220
b17fc996 1221
6e08bfb8 1222 out_err:
1da177e4 1223 if (svc != NULL) {
2fabf35b 1224 ip_vs_unbind_scheduler(svc);
1da177e4
LT		 1225 if (svc->inc) {
1226 local_bh_disable();
1227 ip_vs_app_inc_put(svc->inc);
1228 local_bh_enable();
1229 }
b17fc996
HS		 1230 if (svc->stats.cpustats)
1231 free_percpu(svc->stats.cpustats);
1da177e4
LT		 1232 kfree(svc);
1233 }
1234 ip_vs_scheduler_put(sched);
0d1e71b0 1235 ip_vs_pe_put(pe);
1da177e4 1236
1da177e4
LT		 1237 /* decrease the module use count */
1238 ip_vs_use_count_dec();
1239
1240 return ret;
1241}
1242
1243
1244/*
1245 * Edit a service and bind it with a new scheduler
1246 */
1247static int
c860c6b1 1248ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1da177e4
LT		 1249{
1250 struct ip_vs_scheduler *sched, *old_sched;
0d1e71b0 1251 struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1da177e4
LT		 1252 int ret = 0;
1253
1254 /*
1255 * Lookup the scheduler, by 'u->sched_name'
1256 */
1257 sched = ip_vs_scheduler_get(u->sched_name);
1258 if (sched == NULL) {
1e3e238e 1259 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1da177e4
LT		 1260 return -ENOENT;
1261 }
1262 old_sched = sched;
1263
0d1e71b0 1264 if (u->pe_name && *u->pe_name) {
e9e5eee8 1265 pe = ip_vs_pe_getbyname(u->pe_name);
0d1e71b0
SH		 1266 if (pe == NULL) {
1267 pr_info("persistence engine module ip_vs_pe_%s "
1268 "not found\n", u->pe_name);
1269 ret = -ENOENT;
1270 goto out;
1271 }
1272 old_pe = pe;
1273 }
1274
f94fd041 1275#ifdef CONFIG_IP_VS_IPV6
48148938
JV		 1276 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1277 ret = -EINVAL;
1278 goto out;
f94fd041
JV		 1279 }
1280#endif
1281
1da177e4
LT		 1282 write_lock_bh(&__ip_vs_svc_lock);
1283
1284 /*
1285 * Wait until all other svc users go away.
1286 */
26c15cfd 1287 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1288
1289 /*
1290 * Set the flags and timeout value
1291 */
1292 svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1293 svc->timeout = u->timeout * HZ;
1294 svc->netmask = u->netmask;
1295
1296 old_sched = svc->scheduler;
1297 if (sched != old_sched) {
1298 /*
1299 * Unbind the old scheduler
1300 */
1301 if ((ret = ip_vs_unbind_scheduler(svc))) {
1302 old_sched = sched;
9e691ed6 1303 goto out_unlock;
1da177e4
LT		 1304 }
1305
1306 /*
1307 * Bind the new scheduler
1308 */
1309 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1310 /*
1311 * If ip_vs_bind_scheduler fails, restore the old
1312 * scheduler.
1313 * The main reason of failure is out of memory.
1314 *
1315 * The question is if the old scheduler can be
1316 * restored all the time. TODO: if it cannot be
1317 * restored some time, we must delete the service,
1318 * otherwise the system may crash.
1319 */
1320 ip_vs_bind_scheduler(svc, old_sched);
1321 old_sched = sched;
9e691ed6 1322 goto out_unlock;
1da177e4
LT		 1323 }
1324 }
1325
0d1e71b0
SH		 1326 old_pe = svc->pe;
1327 if (pe != old_pe) {
1328 ip_vs_unbind_pe(svc);
1329 ip_vs_bind_pe(svc, pe);
1330 }
1331
552ad65a 1332out_unlock:
1da177e4 1333 write_unlock_bh(&__ip_vs_svc_lock);
552ad65a 1334out:
6e08bfb8 1335 ip_vs_scheduler_put(old_sched);
0d1e71b0 1336 ip_vs_pe_put(old_pe);
1da177e4
LT		 1337 return ret;
1338}
1339
1340
1341/*
1342 * Delete a service from the service list
1343 * - The service must be unlinked, unlocked and not referenced!
1344 * - We are called under _bh lock
1345 */
1346static void __ip_vs_del_service(struct ip_vs_service *svc)
1347{
1348 struct ip_vs_dest *dest, *nxt;
1349 struct ip_vs_scheduler *old_sched;
0d1e71b0 1350 struct ip_vs_pe *old_pe;
a0840e2e 1351 struct netns_ipvs *ipvs = net_ipvs(svc->net);
0d1e71b0
SH		 1352
1353 pr_info("%s: enter\n", __func__);
1da177e4 1354
f94fd041
JV		 1355 /* Count only IPv4 services for old get/setsockopt interface */
1356 if (svc->af == AF_INET)
a0840e2e 1357 ipvs->num_services--;
f94fd041 1358
6ef757f9 1359 ip_vs_stop_estimator(svc->net, &svc->stats);
1da177e4
LT		 1360
1361 /* Unbind scheduler */
1362 old_sched = svc->scheduler;
1363 ip_vs_unbind_scheduler(svc);
6e08bfb8 1364 ip_vs_scheduler_put(old_sched);
1da177e4 1365
0d1e71b0
SH		 1366 /* Unbind persistence engine */
1367 old_pe = svc->pe;
1368 ip_vs_unbind_pe(svc);
1369 ip_vs_pe_put(old_pe);
1370
1da177e4
LT		 1371 /* Unbind app inc */
1372 if (svc->inc) {
1373 ip_vs_app_inc_put(svc->inc);
1374 svc->inc = NULL;
1375 }
1376
1377 /*
1378 * Unlink the whole destination list
1379 */
1380 list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1381 __ip_vs_unlink_dest(svc, dest, 0);
29c2026f 1382 __ip_vs_del_dest(svc->net, dest);
1da177e4
LT		 1383 }
1384
1385 /*
1386 * Update the virtual service counters
1387 */
1388 if (svc->port == FTPPORT)
763f8d0e 1389 atomic_dec(&ipvs->ftpsvc_counter);
1da177e4 1390 else if (svc->port == 0)
763f8d0e 1391 atomic_dec(&ipvs->nullsvc_counter);
1da177e4
LT		 1392
1393 /*
1394 * Free the service if nobody refers to it
1395 */
26c15cfd
JA		 1396 if (atomic_read(&svc->refcnt) == 0) {
1397 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1398 svc->fwmark,
1399 IP_VS_DBG_ADDR(svc->af, &svc->addr),
1400 ntohs(svc->port), atomic_read(&svc->usecnt));
b17fc996 1401 free_percpu(svc->stats.cpustats);
1da177e4 1402 kfree(svc);
26c15cfd 1403 }
1da177e4
LT		 1404
1405 /* decrease the module use count */
1406 ip_vs_use_count_dec();
1407}
1408
1409/*
26c15cfd 1410 * Unlink a service from list and try to delete it if its refcnt reached 0
1da177e4 1411 */
26c15cfd 1412static void ip_vs_unlink_service(struct ip_vs_service *svc)
1da177e4 1413{
1da177e4
LT		 1414 /*
1415 * Unhash it from the service table
1416 */
1417 write_lock_bh(&__ip_vs_svc_lock);
1418
1419 ip_vs_svc_unhash(svc);
1420
1421 /*
1422 * Wait until all the svc users go away.
1423 */
26c15cfd 1424 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1425
1426 __ip_vs_del_service(svc);
1427
1428 write_unlock_bh(&__ip_vs_svc_lock);
26c15cfd
JA		 1429}
1430
1431/*
1432 * Delete a service from the service list
1433 */
1434static int ip_vs_del_service(struct ip_vs_service *svc)
1435{
1436 if (svc == NULL)
1437 return -EEXIST;
1438 ip_vs_unlink_service(svc);
1da177e4
LT		 1439
1440 return 0;
1441}
1442
1443
1444/*
1445 * Flush all the virtual services
1446 */
fc723250 1447static int ip_vs_flush(struct net *net)
1da177e4
LT		 1448{
1449 int idx;
1450 struct ip_vs_service *svc, *nxt;
1451
1452 /*
fc723250 1453 * Flush the service table hashed by <netns,protocol,addr,port>
1da177e4
LT		 1454 */
1455 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
fc723250
HS		 1456 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1457 s_list) {
1458 if (net_eq(svc->net, net))
1459 ip_vs_unlink_service(svc);
1da177e4
LT		 1460 }
1461 }
1462
1463 /*
1464 * Flush the service table hashed by fwmark
1465 */
1466 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1467 list_for_each_entry_safe(svc, nxt,
1468 &ip_vs_svc_fwm_table[idx], f_list) {
fc723250
HS		 1469 if (net_eq(svc->net, net))
1470 ip_vs_unlink_service(svc);
1da177e4
LT		 1471 }
1472 }
1473
1474 return 0;
1475}
1476
7a4f0761
HS		 1477/*
1478 * Delete service by {netns} in the service table.
1479 * Called by __ip_vs_cleanup()
1480 */
503cf15a 1481void ip_vs_service_net_cleanup(struct net *net)
7a4f0761
HS		 1482{
1483 EnterFunction(2);
1484 /* Check for "full" addressed entries */
1485 mutex_lock(&__ip_vs_mutex);
1486 ip_vs_flush(net);
1487 mutex_unlock(&__ip_vs_mutex);
1488 LeaveFunction(2);
1489}
1490/*
1491 * Release dst hold by dst_cache
1492 */
1493static inline void
1494__ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1495{
1496 spin_lock_bh(&dest->dst_lock);
1497 if (dest->dst_cache && dest->dst_cache->dev == dev) {
1498 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1499 dev->name,
1500 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1501 ntohs(dest->port),
1502 atomic_read(&dest->refcnt));
1503 ip_vs_dst_reset(dest);
1504 }
1505 spin_unlock_bh(&dest->dst_lock);
1506
1507}
1508/*
1509 * Netdev event receiver
1510 * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1511 * a device that is "unregister" it must be released.
1512 */
1513static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1514 void *ptr)
1515{
1516 struct net_device *dev = ptr;
1517 struct net *net = dev_net(dev);
1518 struct ip_vs_service *svc;
1519 struct ip_vs_dest *dest;
1520 unsigned int idx;
1521
1522 if (event != NETDEV_UNREGISTER)
1523 return NOTIFY_DONE;
1524 IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1525 EnterFunction(2);
1526 mutex_lock(&__ip_vs_mutex);
1527 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1528 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1529 if (net_eq(svc->net, net)) {
1530 list_for_each_entry(dest, &svc->destinations,
1531 n_list) {
1532 __ip_vs_dev_reset(dest, dev);
1533 }
1534 }
1535 }
1536
1537 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1538 if (net_eq(svc->net, net)) {
1539 list_for_each_entry(dest, &svc->destinations,
1540 n_list) {
1541 __ip_vs_dev_reset(dest, dev);
1542 }
1543 }
1544
1545 }
1546 }
1547
1548 list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
1549 __ip_vs_dev_reset(dest, dev);
1550 }
1551 mutex_unlock(&__ip_vs_mutex);
1552 LeaveFunction(2);
1553 return NOTIFY_DONE;
1554}
1da177e4
LT		 1555
1556/*
1557 * Zero counters in a service or all services
1558 */
1559static int ip_vs_zero_service(struct ip_vs_service *svc)
1560{
1561 struct ip_vs_dest *dest;
1562
1563 write_lock_bh(&__ip_vs_svc_lock);
1564 list_for_each_entry(dest, &svc->destinations, n_list) {
1565 ip_vs_zero_stats(&dest->stats);
1566 }
1567 ip_vs_zero_stats(&svc->stats);
1568 write_unlock_bh(&__ip_vs_svc_lock);
1569 return 0;
1570}
1571
fc723250 1572static int ip_vs_zero_all(struct net *net)
1da177e4
LT		 1573{
1574 int idx;
1575 struct ip_vs_service *svc;
1576
1577 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1578 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
fc723250
HS		 1579 if (net_eq(svc->net, net))
1580 ip_vs_zero_service(svc);
1da177e4
LT		 1581 }
1582 }
1583
1584 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1585 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
fc723250
HS		 1586 if (net_eq(svc->net, net))
1587 ip_vs_zero_service(svc);
1da177e4
LT		 1588 }
1589 }
1590
2a0751af 1591 ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1da177e4
LT		 1592 return 0;
1593}
1594
14e40546 1595#ifdef CONFIG_SYSCTL
1da177e4 1596static int
8d65af78 1597proc_do_defense_mode(ctl_table *table, int write,
1da177e4
LT		 1598 void __user *buffer, size_t *lenp, loff_t *ppos)
1599{
9330419d 1600 struct net *net = current->nsproxy->net_ns;
1da177e4
LT		 1601 int *valp = table->data;
1602 int val = *valp;
1603 int rc;
1604
8d65af78 1605 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1da177e4
LT		 1606 if (write && (*valp != val)) {
1607 if ((*valp < 0) || (*valp > 3)) {
1608 /* Restore the correct value */
1609 *valp = val;
1610 } else {
9330419d 1611 update_defense_level(net_ipvs(net));
1da177e4
LT		 1612 }
1613 }
1614 return rc;
1615}
1616
1da177e4 1617static int
8d65af78 1618proc_do_sync_threshold(ctl_table *table, int write,
1da177e4
LT		 1619 void __user *buffer, size_t *lenp, loff_t *ppos)
1620{
1621 int *valp = table->data;
1622 int val[2];
1623 int rc;
1624
1625 /* backup the value first */
1626 memcpy(val, valp, sizeof(val));
1627
8d65af78 1628 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1da177e4
LT		 1629 if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1630 /* Restore the correct value */
1631 memcpy(valp, val, sizeof(val));
1632 }
1633 return rc;
1634}
1635
b880c1f0
HS		 1636static int
1637proc_do_sync_mode(ctl_table *table, int write,
1638 void __user *buffer, size_t *lenp, loff_t *ppos)
1639{
1640 int *valp = table->data;
1641 int val = *valp;
1642 int rc;
1643
1644 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1645 if (write && (*valp != val)) {
1646 if ((*valp < 0) || (*valp > 1)) {
1647 /* Restore the correct value */
1648 *valp = val;
1649 } else {
f131315f
HS		 1650 struct net *net = current->nsproxy->net_ns;
1651 ip_vs_sync_switch_mode(net, val);
b880c1f0
HS		 1652 }
1653 }
1654 return rc;
1655}
1da177e4
LT		 1656
1657/*
1658 * IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
a0840e2e 1659 * Do not change order or insert new entries without
503cf15a 1660 * align with netns init in ip_vs_control_net_init()
1da177e4
LT		 1661 */
1662
1663static struct ctl_table vs_vars[] = {
1664 {
1da177e4 1665 .procname = "amemthresh",
1da177e4
LT		 1666 .maxlen = sizeof(int),
1667 .mode = 0644,
6d9f239a 1668 .proc_handler = proc_dointvec,
1da177e4 1669 },
1da177e4 1670 {
1da177e4 1671 .procname = "am_droprate",
1da177e4
LT		 1672 .maxlen = sizeof(int),
1673 .mode = 0644,
6d9f239a 1674 .proc_handler = proc_dointvec,
1da177e4
LT		 1675 },
1676 {
1da177e4 1677 .procname = "drop_entry",
1da177e4
LT		 1678 .maxlen = sizeof(int),
1679 .mode = 0644,
6d9f239a 1680 .proc_handler = proc_do_defense_mode,
1da177e4
LT		 1681 },
1682 {
1da177e4 1683 .procname = "drop_packet",
1da177e4
LT		 1684 .maxlen = sizeof(int),
1685 .mode = 0644,
6d9f239a 1686 .proc_handler = proc_do_defense_mode,
1da177e4 1687 },
f4bc17cd
JA		 1688#ifdef CONFIG_IP_VS_NFCT
1689 {
1690 .procname = "conntrack",
f4bc17cd
JA		 1691 .maxlen = sizeof(int),
1692 .mode = 0644,
1693 .proc_handler = &proc_dointvec,
1694 },
1695#endif
1da177e4 1696 {
1da177e4 1697 .procname = "secure_tcp",
1da177e4
LT		 1698 .maxlen = sizeof(int),
1699 .mode = 0644,
6d9f239a 1700 .proc_handler = proc_do_defense_mode,
1da177e4 1701 },
8a803040
JA		 1702 {
1703 .procname = "snat_reroute",
8a803040
JA		 1704 .maxlen = sizeof(int),
1705 .mode = 0644,
1706 .proc_handler = &proc_dointvec,
1707 },
b880c1f0
HS		 1708 {
1709 .procname = "sync_version",
b880c1f0
HS		 1710 .maxlen = sizeof(int),
1711 .mode = 0644,
1712 .proc_handler = &proc_do_sync_mode,
1713 },
a0840e2e
HS		 1714 {
1715 .procname = "cache_bypass",
1716 .maxlen = sizeof(int),
1717 .mode = 0644,
1718 .proc_handler = proc_dointvec,
1719 },
1720 {
1721 .procname = "expire_nodest_conn",
1722 .maxlen = sizeof(int),
1723 .mode = 0644,
1724 .proc_handler = proc_dointvec,
1725 },
1726 {
1727 .procname = "expire_quiescent_template",
1728 .maxlen = sizeof(int),
1729 .mode = 0644,
1730 .proc_handler = proc_dointvec,
1731 },
1732 {
1733 .procname = "sync_threshold",
1734 .maxlen =
1735 sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1736 .mode = 0644,
1737 .proc_handler = proc_do_sync_threshold,
1738 },
1739 {
1740 .procname = "nat_icmp_send",
1741 .maxlen = sizeof(int),
1742 .mode = 0644,
1743 .proc_handler = proc_dointvec,
1744 },
1745#ifdef CONFIG_IP_VS_DEBUG
1746 {
1747 .procname = "debug_level",
1748 .data = &sysctl_ip_vs_debug_level,
1749 .maxlen = sizeof(int),
1750 .mode = 0644,
1751 .proc_handler = proc_dointvec,
1752 },
1753#endif
1da177e4
LT		 1754#if 0
1755 {
1da177e4
LT		 1756 .procname = "timeout_established",
1757 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1758 .maxlen = sizeof(int),
1759 .mode = 0644,
6d9f239a 1760 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1761 },
1762 {
1da177e4
LT		 1763 .procname = "timeout_synsent",
1764 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1765 .maxlen = sizeof(int),
1766 .mode = 0644,
6d9f239a 1767 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1768 },
1769 {
1da177e4
LT		 1770 .procname = "timeout_synrecv",
1771 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1772 .maxlen = sizeof(int),
1773 .mode = 0644,
6d9f239a 1774 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1775 },
1776 {
1da177e4
LT		 1777 .procname = "timeout_finwait",
1778 .data = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1779 .maxlen = sizeof(int),
1780 .mode = 0644,
6d9f239a 1781 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1782 },
1783 {
1da177e4
LT		 1784 .procname = "timeout_timewait",
1785 .data = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1786 .maxlen = sizeof(int),
1787 .mode = 0644,
6d9f239a 1788 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1789 },
1790 {
1da177e4
LT		 1791 .procname = "timeout_close",
1792 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1793 .maxlen = sizeof(int),
1794 .mode = 0644,
6d9f239a 1795 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1796 },
1797 {
1da177e4
LT		 1798 .procname = "timeout_closewait",
1799 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1800 .maxlen = sizeof(int),
1801 .mode = 0644,
6d9f239a 1802 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1803 },
1804 {
1da177e4
LT		 1805 .procname = "timeout_lastack",
1806 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1807 .maxlen = sizeof(int),
1808 .mode = 0644,
6d9f239a 1809 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1810 },
1811 {
1da177e4
LT		 1812 .procname = "timeout_listen",
1813 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1814 .maxlen = sizeof(int),
1815 .mode = 0644,
6d9f239a 1816 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1817 },
1818 {
1da177e4
LT		 1819 .procname = "timeout_synack",
1820 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1821 .maxlen = sizeof(int),
1822 .mode = 0644,
6d9f239a 1823 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1824 },
1825 {
1da177e4
LT		 1826 .procname = "timeout_udp",
1827 .data = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1828 .maxlen = sizeof(int),
1829 .mode = 0644,
6d9f239a 1830 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1831 },
1832 {
1da177e4
LT		 1833 .procname = "timeout_icmp",
1834 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1835 .maxlen = sizeof(int),
1836 .mode = 0644,
6d9f239a 1837 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1838 },
1839#endif
f8572d8f 1840 { }
1da177e4
LT		 1841};
1842
5587da55 1843const struct ctl_path net_vs_ctl_path[] = {
f8572d8f
EB		 1844 { .procname = "net", },
1845 { .procname = "ipv4", },
90754f8e
PE		 1846 { .procname = "vs", },
1847 { }
1da177e4 1848};
90754f8e 1849EXPORT_SYMBOL_GPL(net_vs_ctl_path);
14e40546 1850#endif
1da177e4 1851
1da177e4
LT		 1852#ifdef CONFIG_PROC_FS
1853
1854struct ip_vs_iter {
fc723250 1855 struct seq_net_private p; /* Do not move this, netns depends upon it*/
1da177e4
LT		 1856 struct list_head *table;
1857 int bucket;
1858};
1859
1860/*
1861 * Write the contents of the VS rule table to a PROCfs file.
1862 * (It is kept just for backward compatibility)
1863 */
1864static inline const char *ip_vs_fwd_name(unsigned flags)
1865{
1866 switch (flags & IP_VS_CONN_F_FWD_MASK) {
1867 case IP_VS_CONN_F_LOCALNODE:
1868 return "Local";
1869 case IP_VS_CONN_F_TUNNEL:
1870 return "Tunnel";
1871 case IP_VS_CONN_F_DROUTE:
1872 return "Route";
1873 default:
1874 return "Masq";
1875 }
1876}
1877
1878
1879/* Get the Nth entry in the two lists */
1880static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1881{
fc723250 1882 struct net *net = seq_file_net(seq);
1da177e4
LT		 1883 struct ip_vs_iter *iter = seq->private;
1884 int idx;
1885 struct ip_vs_service *svc;
1886
1887 /* look in hash by protocol */
1888 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1889 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
fc723250 1890 if (net_eq(svc->net, net) && pos-- == 0) {
1da177e4
LT		 1891 iter->table = ip_vs_svc_table;
1892 iter->bucket = idx;
1893 return svc;
1894 }
1895 }
1896 }
1897
1898 /* keep looking in fwmark */
1899 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1900 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
fc723250 1901 if (net_eq(svc->net, net) && pos-- == 0) {
1da177e4
LT		 1902 iter->table = ip_vs_svc_fwm_table;
1903 iter->bucket = idx;
1904 return svc;
1905 }
1906 }
1907 }
1908
1909 return NULL;
1910}
1911
1912static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
563e94f0 1913__acquires(__ip_vs_svc_lock)
1da177e4
LT		 1914{
1915
1916 read_lock_bh(&__ip_vs_svc_lock);
1917 return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1918}
1919
1920
1921static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1922{
1923 struct list_head *e;
1924 struct ip_vs_iter *iter;
1925 struct ip_vs_service *svc;
1926
1927 ++*pos;
1928 if (v == SEQ_START_TOKEN)
1929 return ip_vs_info_array(seq,0);
1930
1931 svc = v;
1932 iter = seq->private;
1933
1934 if (iter->table == ip_vs_svc_table) {
1935 /* next service in table hashed by protocol */
1936 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1937 return list_entry(e, struct ip_vs_service, s_list);
1938
1939
1940 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1941 list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1942 s_list) {
1943 return svc;
1944 }
1945 }
1946
1947 iter->table = ip_vs_svc_fwm_table;
1948 iter->bucket = -1;
1949 goto scan_fwmark;
1950 }
1951
1952 /* next service in hashed by fwmark */
1953 if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1954 return list_entry(e, struct ip_vs_service, f_list);
1955
1956 scan_fwmark:
1957 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1958 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1959 f_list)
1960 return svc;
1961 }
1962
1963 return NULL;
1964}
1965
1966static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
563e94f0 1967__releases(__ip_vs_svc_lock)
1da177e4
LT		 1968{
1969 read_unlock_bh(&__ip_vs_svc_lock);
1970}
1971
1972
1973static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1974{
1975 if (v == SEQ_START_TOKEN) {
1976 seq_printf(seq,
1977 "IP Virtual Server version %d.%d.%d (size=%d)\n",
6f7edb48 1978 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1da177e4
LT		 1979 seq_puts(seq,
1980 "Prot LocalAddress:Port Scheduler Flags\n");
1981 seq_puts(seq,
1982 " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1983 } else {
1984 const struct ip_vs_service *svc = v;
1985 const struct ip_vs_iter *iter = seq->private;
1986 const struct ip_vs_dest *dest;
1987
667a5f18
VB		 1988 if (iter->table == ip_vs_svc_table) {
1989#ifdef CONFIG_IP_VS_IPV6
1990 if (svc->af == AF_INET6)
5b095d98 1991 seq_printf(seq, "%s [%pI6]:%04X %s ",
667a5f18 1992 ip_vs_proto_name(svc->protocol),
38ff4fa4 1993 &svc->addr.in6,
667a5f18
VB		 1994 ntohs(svc->port),
1995 svc->scheduler->name);
1996 else
1997#endif
26ec037f 1998 seq_printf(seq, "%s %08X:%04X %s %s ",
667a5f18
VB		 1999 ip_vs_proto_name(svc->protocol),
2000 ntohl(svc->addr.ip),
2001 ntohs(svc->port),
26ec037f
NC		 2002 svc->scheduler->name,
2003 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
667a5f18 2004 } else {
26ec037f
NC		 2005 seq_printf(seq, "FWM %08X %s %s",
2006 svc->fwmark, svc->scheduler->name,
2007 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
667a5f18 2008 }
1da177e4
LT		 2009
2010 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2011 seq_printf(seq, "persistent %d %08X\n",
2012 svc->timeout,
2013 ntohl(svc->netmask));
2014 else
2015 seq_putc(seq, '\n');
2016
2017 list_for_each_entry(dest, &svc->destinations, n_list) {
667a5f18
VB		 2018#ifdef CONFIG_IP_VS_IPV6
2019 if (dest->af == AF_INET6)
2020 seq_printf(seq,
5b095d98 2021 " -> [%pI6]:%04X"
667a5f18 2022 " %-7s %-6d %-10d %-10d\n",
38ff4fa4 2023 &dest->addr.in6,
667a5f18
VB		 2024 ntohs(dest->port),
2025 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2026 atomic_read(&dest->weight),
2027 atomic_read(&dest->activeconns),
2028 atomic_read(&dest->inactconns));
2029 else
2030#endif
2031 seq_printf(seq,
2032 " -> %08X:%04X "
2033 "%-7s %-6d %-10d %-10d\n",
2034 ntohl(dest->addr.ip),
2035 ntohs(dest->port),
2036 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2037 atomic_read(&dest->weight),
2038 atomic_read(&dest->activeconns),
2039 atomic_read(&dest->inactconns));
2040
1da177e4
LT		 2041 }
2042 }
2043 return 0;
2044}
2045
56b3d975 2046static const struct seq_operations ip_vs_info_seq_ops = {
1da177e4
LT		 2047 .start = ip_vs_info_seq_start,
2048 .next = ip_vs_info_seq_next,
2049 .stop = ip_vs_info_seq_stop,
2050 .show = ip_vs_info_seq_show,
2051};
2052
2053static int ip_vs_info_open(struct inode *inode, struct file *file)
2054{
fc723250 2055 return seq_open_net(inode, file, &ip_vs_info_seq_ops,
cf7732e4 2056 sizeof(struct ip_vs_iter));
1da177e4
LT		 2057}
2058
9a32144e 2059static const struct file_operations ip_vs_info_fops = {
1da177e4
LT		 2060 .owner = THIS_MODULE,
2061 .open = ip_vs_info_open,
2062 .read = seq_read,
2063 .llseek = seq_lseek,
0f08190f 2064 .release = seq_release_net,
1da177e4
LT		 2065};
2066
1da177e4
LT		 2067static int ip_vs_stats_show(struct seq_file *seq, void *v)
2068{
b17fc996 2069 struct net *net = seq_file_single_net(seq);
55a3d4e1 2070 struct ip_vs_stats_user show;
1da177e4
LT		 2071
2072/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2073 seq_puts(seq,
2074 " Total Incoming Outgoing Incoming Outgoing\n");
2075 seq_printf(seq,
2076 " Conns Packets Packets Bytes Bytes\n");
2077
55a3d4e1
JA		 2078 ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2079 seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2080 show.inpkts, show.outpkts,
2081 (unsigned long long) show.inbytes,
2082 (unsigned long long) show.outbytes);
1da177e4
LT		 2083
2084/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2085 seq_puts(seq,
2086 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
55a3d4e1
JA		 2087 seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2088 show.cps, show.inpps, show.outpps,
2089 show.inbps, show.outbps);
1da177e4
LT		 2090
2091 return 0;
2092}
2093
2094static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2095{
fc723250 2096 return single_open_net(inode, file, ip_vs_stats_show);
1da177e4
LT		 2097}
2098
9a32144e 2099static const struct file_operations ip_vs_stats_fops = {
1da177e4
LT		 2100 .owner = THIS_MODULE,
2101 .open = ip_vs_stats_seq_open,
2102 .read = seq_read,
2103 .llseek = seq_lseek,
0f08190f 2104 .release = single_release_net,
1da177e4
LT		 2105};
2106
b17fc996
HS		 2107static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2108{
2109 struct net *net = seq_file_single_net(seq);
2a0751af
JA		 2110 struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2111 struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
ea9f22cc 2112 struct ip_vs_stats_user rates;
b17fc996
HS		 2113 int i;
2114
2115/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2116 seq_puts(seq,
2117 " Total Incoming Outgoing Incoming Outgoing\n");
2118 seq_printf(seq,
2119 "CPU Conns Packets Packets Bytes Bytes\n");
2120
2121 for_each_possible_cpu(i) {
2a0751af
JA		 2122 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2123 unsigned int start;
2124 __u64 inbytes, outbytes;
2125
2126 do {
2127 start = u64_stats_fetch_begin_bh(&u->syncp);
2128 inbytes = u->ustats.inbytes;
2129 outbytes = u->ustats.outbytes;
2130 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2131
b17fc996 2132 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2a0751af
JA		 2133 i, u->ustats.conns, u->ustats.inpkts,
2134 u->ustats.outpkts, (__u64)inbytes,
2135 (__u64)outbytes);
b17fc996
HS		 2136 }
2137
2138 spin_lock_bh(&tot_stats->lock);
ea9f22cc 2139
b17fc996
HS		 2140 seq_printf(seq, " ~ %8X %8X %8X %16LX %16LX\n\n",
2141 tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2142 tot_stats->ustats.outpkts,
2143 (unsigned long long) tot_stats->ustats.inbytes,
2144 (unsigned long long) tot_stats->ustats.outbytes);
2145
ea9f22cc
JA		 2146 ip_vs_read_estimator(&rates, tot_stats);
2147
2148 spin_unlock_bh(&tot_stats->lock);
2149
b17fc996
HS		 2150/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2151 seq_puts(seq,
2152 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
2153 seq_printf(seq, " %8X %8X %8X %16X %16X\n",
ea9f22cc
JA		 2154 rates.cps,
2155 rates.inpps,
2156 rates.outpps,
2157 rates.inbps,
2158 rates.outbps);
b17fc996
HS		 2159
2160 return 0;
2161}
2162
2163static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2164{
2165 return single_open_net(inode, file, ip_vs_stats_percpu_show);
2166}
2167
2168static const struct file_operations ip_vs_stats_percpu_fops = {
2169 .owner = THIS_MODULE,
2170 .open = ip_vs_stats_percpu_seq_open,
2171 .read = seq_read,
2172 .llseek = seq_lseek,
0f08190f 2173 .release = single_release_net,
b17fc996 2174};
1da177e4
LT		 2175#endif
2176
2177/*
2178 * Set timeout values for tcp tcpfin udp in the timeout_table.
2179 */
9330419d 2180static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
1da177e4 2181{
091bb34c 2182#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
9330419d 2183 struct ip_vs_proto_data *pd;
091bb34c 2184#endif
9330419d 2185
1da177e4
LT		 2186 IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2187 u->tcp_timeout,
2188 u->tcp_fin_timeout,
2189 u->udp_timeout);
2190
2191#ifdef CONFIG_IP_VS_PROTO_TCP
2192 if (u->tcp_timeout) {
9330419d
HS		 2193 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2194 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
1da177e4
LT		 2195 = u->tcp_timeout * HZ;
2196 }
2197
2198 if (u->tcp_fin_timeout) {
9330419d
HS		 2199 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2200 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
1da177e4
LT		 2201 = u->tcp_fin_timeout * HZ;
2202 }
2203#endif
2204
2205#ifdef CONFIG_IP_VS_PROTO_UDP
2206 if (u->udp_timeout) {
9330419d
HS		 2207 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2208 pd->timeout_table[IP_VS_UDP_S_NORMAL]
1da177e4
LT		 2209 = u->udp_timeout * HZ;
2210 }
2211#endif
2212 return 0;
2213}
2214
2215
2216#define SET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2217#define SERVICE_ARG_LEN (sizeof(struct ip_vs_service_user))
2218#define SVCDEST_ARG_LEN (sizeof(struct ip_vs_service_user) + \
2219 sizeof(struct ip_vs_dest_user))
2220#define TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2221#define DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user))
2222#define MAX_ARG_LEN SVCDEST_ARG_LEN
2223
9b5b5cff 2224static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
1da177e4
LT		 2225 [SET_CMDID(IP_VS_SO_SET_ADD)] = SERVICE_ARG_LEN,
2226 [SET_CMDID(IP_VS_SO_SET_EDIT)] = SERVICE_ARG_LEN,
2227 [SET_CMDID(IP_VS_SO_SET_DEL)] = SERVICE_ARG_LEN,
2228 [SET_CMDID(IP_VS_SO_SET_FLUSH)] = 0,
2229 [SET_CMDID(IP_VS_SO_SET_ADDDEST)] = SVCDEST_ARG_LEN,
2230 [SET_CMDID(IP_VS_SO_SET_DELDEST)] = SVCDEST_ARG_LEN,
2231 [SET_CMDID(IP_VS_SO_SET_EDITDEST)] = SVCDEST_ARG_LEN,
2232 [SET_CMDID(IP_VS_SO_SET_TIMEOUT)] = TIMEOUT_ARG_LEN,
2233 [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)] = DAEMON_ARG_LEN,
2234 [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)] = DAEMON_ARG_LEN,
2235 [SET_CMDID(IP_VS_SO_SET_ZERO)] = SERVICE_ARG_LEN,
2236};
2237
c860c6b1
JV		 2238static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2239 struct ip_vs_service_user *usvc_compat)
2240{
0d1e71b0
SH		 2241 memset(usvc, 0, sizeof(*usvc));
2242
c860c6b1
JV		 2243 usvc->af = AF_INET;
2244 usvc->protocol = usvc_compat->protocol;
2245 usvc->addr.ip = usvc_compat->addr;
2246 usvc->port = usvc_compat->port;
2247 usvc->fwmark = usvc_compat->fwmark;
2248
2249 /* Deep copy of sched_name is not needed here */
2250 usvc->sched_name = usvc_compat->sched_name;
2251
2252 usvc->flags = usvc_compat->flags;
2253 usvc->timeout = usvc_compat->timeout;
2254 usvc->netmask = usvc_compat->netmask;
2255}
2256
2257static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2258 struct ip_vs_dest_user *udest_compat)
2259{
0d1e71b0
SH		 2260 memset(udest, 0, sizeof(*udest));
2261
c860c6b1
JV		 2262 udest->addr.ip = udest_compat->addr;
2263 udest->port = udest_compat->port;
2264 udest->conn_flags = udest_compat->conn_flags;
2265 udest->weight = udest_compat->weight;
2266 udest->u_threshold = udest_compat->u_threshold;
2267 udest->l_threshold = udest_compat->l_threshold;
2268}
2269
1da177e4
LT		 2270static int
2271do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2272{
fc723250 2273 struct net *net = sock_net(sk);
1da177e4
LT		 2274 int ret;
2275 unsigned char arg[MAX_ARG_LEN];
c860c6b1
JV		 2276 struct ip_vs_service_user *usvc_compat;
2277 struct ip_vs_service_user_kern usvc;
1da177e4 2278 struct ip_vs_service *svc;
c860c6b1
JV		 2279 struct ip_vs_dest_user *udest_compat;
2280 struct ip_vs_dest_user_kern udest;
ae1d48b2 2281 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4
LT		 2282
2283 if (!capable(CAP_NET_ADMIN))
2284 return -EPERM;
2285
04bcef2a
AV		 2286 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2287 return -EINVAL;
2288 if (len < 0 || len > MAX_ARG_LEN)
2289 return -EINVAL;
1da177e4 2290 if (len != set_arglen[SET_CMDID(cmd)]) {
1e3e238e
HE		 2291 pr_err("set_ctl: len %u != %u\n",
2292 len, set_arglen[SET_CMDID(cmd)]);
1da177e4
LT		 2293 return -EINVAL;
2294 }
2295
2296 if (copy_from_user(arg, user, len) != 0)
2297 return -EFAULT;
2298
2299 /* increase the module use count */
2300 ip_vs_use_count_inc();
2301
ae1d48b2
HS		 2302 /* Handle daemons since they have another lock */
2303 if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2304 cmd == IP_VS_SO_SET_STOPDAEMON) {
2305 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2306
2307 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2308 ret = -ERESTARTSYS;
2309 goto out_dec;
2310 }
2311 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2312 ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2313 dm->syncid);
2314 else
2315 ret = stop_sync_thread(net, dm->state);
2316 mutex_unlock(&ipvs->sync_mutex);
2317 goto out_dec;
2318 }
2319
14cc3e2b 2320 if (mutex_lock_interruptible(&__ip_vs_mutex)) {
1da177e4
LT		 2321 ret = -ERESTARTSYS;
2322 goto out_dec;
2323 }
2324
2325 if (cmd == IP_VS_SO_SET_FLUSH) {
2326 /* Flush the virtual service */
fc723250 2327 ret = ip_vs_flush(net);
1da177e4
LT		 2328 goto out_unlock;
2329 } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2330 /* Set timeout values for (tcp tcpfin udp) */
9330419d 2331 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
1da177e4 2332 goto out_unlock;
1da177e4
LT		 2333 }
2334
c860c6b1
JV		 2335 usvc_compat = (struct ip_vs_service_user *)arg;
2336 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2337
2338 /* We only use the new structs internally, so copy userspace compat
2339 * structs to extended internal versions */
2340 ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2341 ip_vs_copy_udest_compat(&udest, udest_compat);
1da177e4
LT		 2342
2343 if (cmd == IP_VS_SO_SET_ZERO) {
2344 /* if no service address is set, zero counters in all */
c860c6b1 2345 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
fc723250 2346 ret = ip_vs_zero_all(net);
1da177e4
LT		 2347 goto out_unlock;
2348 }
2349 }
2350
2906f66a
VMR		 2351 /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2352 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2353 usvc.protocol != IPPROTO_SCTP) {
1e3e238e
HE		 2354 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2355 usvc.protocol, &usvc.addr.ip,
2356 ntohs(usvc.port), usvc.sched_name);
1da177e4
LT		 2357 ret = -EFAULT;
2358 goto out_unlock;
2359 }
2360
2361 /* Lookup the exact service by <protocol, addr, port> or fwmark */
c860c6b1 2362 if (usvc.fwmark == 0)
fc723250 2363 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
26c15cfd 2364 &usvc.addr, usvc.port);
1da177e4 2365 else
fc723250 2366 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
1da177e4
LT		 2367
2368 if (cmd != IP_VS_SO_SET_ADD
c860c6b1 2369 && (svc == NULL || svc->protocol != usvc.protocol)) {
1da177e4 2370 ret = -ESRCH;
26c15cfd 2371 goto out_unlock;
1da177e4
LT		 2372 }
2373
2374 switch (cmd) {
2375 case IP_VS_SO_SET_ADD:
2376 if (svc != NULL)
2377 ret = -EEXIST;
2378 else
fc723250 2379 ret = ip_vs_add_service(net, &usvc, &svc);
1da177e4
LT		 2380 break;
2381 case IP_VS_SO_SET_EDIT:
c860c6b1 2382 ret = ip_vs_edit_service(svc, &usvc);
1da177e4
LT		 2383 break;
2384 case IP_VS_SO_SET_DEL:
2385 ret = ip_vs_del_service(svc);
2386 if (!ret)
2387 goto out_unlock;
2388 break;
2389 case IP_VS_SO_SET_ZERO:
2390 ret = ip_vs_zero_service(svc);
2391 break;
2392 case IP_VS_SO_SET_ADDDEST:
c860c6b1 2393 ret = ip_vs_add_dest(svc, &udest);
1da177e4
LT		 2394 break;
2395 case IP_VS_SO_SET_EDITDEST:
c860c6b1 2396 ret = ip_vs_edit_dest(svc, &udest);
1da177e4
LT		 2397 break;
2398 case IP_VS_SO_SET_DELDEST:
c860c6b1 2399 ret = ip_vs_del_dest(svc, &udest);
1da177e4
LT		 2400 break;
2401 default:
2402 ret = -EINVAL;
2403 }
2404
1da177e4 2405 out_unlock:
14cc3e2b 2406 mutex_unlock(&__ip_vs_mutex);
1da177e4
LT		 2407 out_dec:
2408 /* decrease the module use count */
2409 ip_vs_use_count_dec();
2410
2411 return ret;
2412}
2413
2414
1da177e4
LT		 2415static void
2416ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2417{
2418 dst->protocol = src->protocol;
e7ade46a 2419 dst->addr = src->addr.ip;
1da177e4
LT		 2420 dst->port = src->port;
2421 dst->fwmark = src->fwmark;
4da62fc7 2422 strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
1da177e4
LT		 2423 dst->flags = src->flags;
2424 dst->timeout = src->timeout / HZ;
2425 dst->netmask = src->netmask;
2426 dst->num_dests = src->num_dests;
2427 ip_vs_copy_stats(&dst->stats, &src->stats);
2428}
2429
2430static inline int
fc723250
HS		 2431__ip_vs_get_service_entries(struct net *net,
2432 const struct ip_vs_get_services *get,
1da177e4
LT		 2433 struct ip_vs_get_services __user *uptr)
2434{
2435 int idx, count=0;
2436 struct ip_vs_service *svc;
2437 struct ip_vs_service_entry entry;
2438 int ret = 0;
2439
2440 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2441 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
f94fd041 2442 /* Only expose IPv4 entries to old interface */
fc723250 2443 if (svc->af != AF_INET || !net_eq(svc->net, net))
f94fd041
JV		 2444 continue;
2445
1da177e4
LT		 2446 if (count >= get->num_services)
2447 goto out;
4da62fc7 2448 memset(&entry, 0, sizeof(entry));
1da177e4
LT		 2449 ip_vs_copy_service(&entry, svc);
2450 if (copy_to_user(&uptr->entrytable[count],
2451 &entry, sizeof(entry))) {
2452 ret = -EFAULT;
2453 goto out;
2454 }
2455 count++;
2456 }
2457 }
2458
2459 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2460 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
f94fd041 2461 /* Only expose IPv4 entries to old interface */
fc723250 2462 if (svc->af != AF_INET || !net_eq(svc->net, net))
f94fd041
JV		 2463 continue;
2464
1da177e4
LT		 2465 if (count >= get->num_services)
2466 goto out;
4da62fc7 2467 memset(&entry, 0, sizeof(entry));
1da177e4
LT		 2468 ip_vs_copy_service(&entry, svc);
2469 if (copy_to_user(&uptr->entrytable[count],
2470 &entry, sizeof(entry))) {
2471 ret = -EFAULT;
2472 goto out;
2473 }
2474 count++;
2475 }
2476 }
552ad65a 2477out:
1da177e4
LT		 2478 return ret;
2479}
2480
2481static inline int
fc723250 2482__ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
1da177e4
LT		 2483 struct ip_vs_get_dests __user *uptr)
2484{
2485 struct ip_vs_service *svc;
b18610de 2486 union nf_inet_addr addr = { .ip = get->addr };
1da177e4
LT		 2487 int ret = 0;
2488
2489 if (get->fwmark)
fc723250 2490 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
1da177e4 2491 else
fc723250 2492 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
26c15cfd 2493 get->port);
b18610de 2494
1da177e4
LT		 2495 if (svc) {
2496 int count = 0;
2497 struct ip_vs_dest *dest;
2498 struct ip_vs_dest_entry entry;
2499
2500 list_for_each_entry(dest, &svc->destinations, n_list) {
2501 if (count >= get->num_dests)
2502 break;
2503
e7ade46a 2504 entry.addr = dest->addr.ip;
1da177e4
LT		 2505 entry.port = dest->port;
2506 entry.conn_flags = atomic_read(&dest->conn_flags);
2507 entry.weight = atomic_read(&dest->weight);
2508 entry.u_threshold = dest->u_threshold;
2509 entry.l_threshold = dest->l_threshold;
2510 entry.activeconns = atomic_read(&dest->activeconns);
2511 entry.inactconns = atomic_read(&dest->inactconns);
2512 entry.persistconns = atomic_read(&dest->persistconns);
2513 ip_vs_copy_stats(&entry.stats, &dest->stats);
2514 if (copy_to_user(&uptr->entrytable[count],
2515 &entry, sizeof(entry))) {
2516 ret = -EFAULT;
2517 break;
2518 }
2519 count++;
2520 }
1da177e4
LT		 2521 } else
2522 ret = -ESRCH;
2523 return ret;
2524}
2525
2526static inline void
9330419d 2527__ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
1da177e4 2528{
091bb34c 2529#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
9330419d 2530 struct ip_vs_proto_data *pd;
091bb34c 2531#endif
9330419d 2532
1da177e4 2533#ifdef CONFIG_IP_VS_PROTO_TCP
9330419d
HS		 2534 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2535 u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2536 u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
1da177e4
LT		 2537#endif
2538#ifdef CONFIG_IP_VS_PROTO_UDP
9330419d 2539 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
1da177e4 2540 u->udp_timeout =
9330419d 2541 pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
1da177e4
LT		 2542#endif
2543}
2544
2545
2546#define GET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2547#define GET_INFO_ARG_LEN (sizeof(struct ip_vs_getinfo))
2548#define GET_SERVICES_ARG_LEN (sizeof(struct ip_vs_get_services))
2549#define GET_SERVICE_ARG_LEN (sizeof(struct ip_vs_service_entry))
2550#define GET_DESTS_ARG_LEN (sizeof(struct ip_vs_get_dests))
2551#define GET_TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2552#define GET_DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user) * 2)
2553
9b5b5cff 2554static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
1da177e4
LT		 2555 [GET_CMDID(IP_VS_SO_GET_VERSION)] = 64,
2556 [GET_CMDID(IP_VS_SO_GET_INFO)] = GET_INFO_ARG_LEN,
2557 [GET_CMDID(IP_VS_SO_GET_SERVICES)] = GET_SERVICES_ARG_LEN,
2558 [GET_CMDID(IP_VS_SO_GET_SERVICE)] = GET_SERVICE_ARG_LEN,
2559 [GET_CMDID(IP_VS_SO_GET_DESTS)] = GET_DESTS_ARG_LEN,
2560 [GET_CMDID(IP_VS_SO_GET_TIMEOUT)] = GET_TIMEOUT_ARG_LEN,
2561 [GET_CMDID(IP_VS_SO_GET_DAEMON)] = GET_DAEMON_ARG_LEN,
2562};
2563
2564static int
2565do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2566{
2567 unsigned char arg[128];
2568 int ret = 0;
04bcef2a 2569 unsigned int copylen;
fc723250 2570 struct net *net = sock_net(sk);
f131315f 2571 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4 2572
fc723250 2573 BUG_ON(!net);
1da177e4
LT		 2574 if (!capable(CAP_NET_ADMIN))
2575 return -EPERM;
2576
04bcef2a
AV		 2577 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2578 return -EINVAL;
2579
1da177e4 2580 if (*len < get_arglen[GET_CMDID(cmd)]) {
1e3e238e
HE		 2581 pr_err("get_ctl: len %u < %u\n",
2582 *len, get_arglen[GET_CMDID(cmd)]);
1da177e4
LT		 2583 return -EINVAL;
2584 }
2585
04bcef2a
AV		 2586 copylen = get_arglen[GET_CMDID(cmd)];
2587 if (copylen > 128)
2588 return -EINVAL;
2589
2590 if (copy_from_user(arg, user, copylen) != 0)
1da177e4 2591 return -EFAULT;
ae1d48b2
HS		 2592 /*
2593 * Handle daemons first since it has its own locking
2594 */
2595 if (cmd == IP_VS_SO_GET_DAEMON) {
2596 struct ip_vs_daemon_user d[2];
2597
2598 memset(&d, 0, sizeof(d));
2599 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2600 return -ERESTARTSYS;
2601
2602 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2603 d[0].state = IP_VS_STATE_MASTER;
2604 strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2605 sizeof(d[0].mcast_ifn));
2606 d[0].syncid = ipvs->master_syncid;
2607 }
2608 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2609 d[1].state = IP_VS_STATE_BACKUP;
2610 strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2611 sizeof(d[1].mcast_ifn));
2612 d[1].syncid = ipvs->backup_syncid;
2613 }
2614 if (copy_to_user(user, &d, sizeof(d)) != 0)
2615 ret = -EFAULT;
2616 mutex_unlock(&ipvs->sync_mutex);
2617 return ret;
2618 }
1da177e4 2619
14cc3e2b 2620 if (mutex_lock_interruptible(&__ip_vs_mutex))
1da177e4
LT		 2621 return -ERESTARTSYS;
2622
2623 switch (cmd) {
2624 case IP_VS_SO_GET_VERSION:
2625 {
2626 char buf[64];
2627
2628 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
6f7edb48 2629 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1da177e4
LT		 2630 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2631 ret = -EFAULT;
2632 goto out;
2633 }
2634 *len = strlen(buf)+1;
2635 }
2636 break;
2637
2638 case IP_VS_SO_GET_INFO:
2639 {
2640 struct ip_vs_getinfo info;
2641 info.version = IP_VS_VERSION_CODE;
6f7edb48 2642 info.size = ip_vs_conn_tab_size;
a0840e2e 2643 info.num_services = ipvs->num_services;
1da177e4
LT		 2644 if (copy_to_user(user, &info, sizeof(info)) != 0)
2645 ret = -EFAULT;
2646 }
2647 break;
2648
2649 case IP_VS_SO_GET_SERVICES:
2650 {
2651 struct ip_vs_get_services *get;
2652 int size;
2653
2654 get = (struct ip_vs_get_services *)arg;
2655 size = sizeof(*get) +
2656 sizeof(struct ip_vs_service_entry) * get->num_services;
2657 if (*len != size) {
1e3e238e 2658 pr_err("length: %u != %u\n", *len, size);
1da177e4
LT		 2659 ret = -EINVAL;
2660 goto out;
2661 }
fc723250 2662 ret = __ip_vs_get_service_entries(net, get, user);
1da177e4
LT		 2663 }
2664 break;
2665
2666 case IP_VS_SO_GET_SERVICE:
2667 {
2668 struct ip_vs_service_entry *entry;
2669 struct ip_vs_service *svc;
b18610de 2670 union nf_inet_addr addr;
1da177e4
LT		 2671
2672 entry = (struct ip_vs_service_entry *)arg;
b18610de 2673 addr.ip = entry->addr;
1da177e4 2674 if (entry->fwmark)
fc723250 2675 svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
1da177e4 2676 else
fc723250
HS		 2677 svc = __ip_vs_service_find(net, AF_INET,
2678 entry->protocol, &addr,
2679 entry->port);
1da177e4
LT		 2680 if (svc) {
2681 ip_vs_copy_service(entry, svc);
2682 if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2683 ret = -EFAULT;
1da177e4
LT		 2684 } else
2685 ret = -ESRCH;
2686 }
2687 break;
2688
2689 case IP_VS_SO_GET_DESTS:
2690 {
2691 struct ip_vs_get_dests *get;
2692 int size;
2693
2694 get = (struct ip_vs_get_dests *)arg;
2695 size = sizeof(*get) +
2696 sizeof(struct ip_vs_dest_entry) * get->num_dests;
2697 if (*len != size) {
1e3e238e 2698 pr_err("length: %u != %u\n", *len, size);
1da177e4
LT		 2699 ret = -EINVAL;
2700 goto out;
2701 }
fc723250 2702 ret = __ip_vs_get_dest_entries(net, get, user);
1da177e4
LT		 2703 }
2704 break;
2705
2706 case IP_VS_SO_GET_TIMEOUT:
2707 {
2708 struct ip_vs_timeout_user t;
2709
9330419d 2710 __ip_vs_get_timeouts(net, &t);
1da177e4
LT		 2711 if (copy_to_user(user, &t, sizeof(t)) != 0)
2712 ret = -EFAULT;
2713 }
2714 break;
2715
1da177e4
LT		 2716 default:
2717 ret = -EINVAL;
2718 }
2719
552ad65a 2720out:
14cc3e2b 2721 mutex_unlock(&__ip_vs_mutex);
1da177e4
LT		 2722 return ret;
2723}
2724
2725
2726static struct nf_sockopt_ops ip_vs_sockopts = {
2727 .pf = PF_INET,
2728 .set_optmin = IP_VS_BASE_CTL,
2729 .set_optmax = IP_VS_SO_SET_MAX+1,
2730 .set = do_ip_vs_set_ctl,
2731 .get_optmin = IP_VS_BASE_CTL,
2732 .get_optmax = IP_VS_SO_GET_MAX+1,
2733 .get = do_ip_vs_get_ctl,
16fcec35 2734 .owner = THIS_MODULE,
1da177e4
LT		 2735};
2736
9a812198
JV		 2737/*
2738 * Generic Netlink interface
2739 */
2740
2741/* IPVS genetlink family */
2742static struct genl_family ip_vs_genl_family = {
2743 .id = GENL_ID_GENERATE,
2744 .hdrsize = 0,
2745 .name = IPVS_GENL_NAME,
2746 .version = IPVS_GENL_VERSION,
2747 .maxattr = IPVS_CMD_MAX,
c6d2d445 2748 .netnsok = true, /* Make ipvsadm to work on netns */
9a812198
JV		 2749};
2750
2751/* Policy used for first-level command attributes */
2752static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2753 [IPVS_CMD_ATTR_SERVICE] = { .type = NLA_NESTED },
2754 [IPVS_CMD_ATTR_DEST] = { .type = NLA_NESTED },
2755 [IPVS_CMD_ATTR_DAEMON] = { .type = NLA_NESTED },
2756 [IPVS_CMD_ATTR_TIMEOUT_TCP] = { .type = NLA_U32 },
2757 [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2758 [IPVS_CMD_ATTR_TIMEOUT_UDP] = { .type = NLA_U32 },
2759};
2760
2761/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2762static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2763 [IPVS_DAEMON_ATTR_STATE] = { .type = NLA_U32 },
2764 [IPVS_DAEMON_ATTR_MCAST_IFN] = { .type = NLA_NUL_STRING,
2765 .len = IP_VS_IFNAME_MAXLEN },
2766 [IPVS_DAEMON_ATTR_SYNC_ID] = { .type = NLA_U32 },
2767};
2768
2769/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2770static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2771 [IPVS_SVC_ATTR_AF] = { .type = NLA_U16 },
2772 [IPVS_SVC_ATTR_PROTOCOL] = { .type = NLA_U16 },
2773 [IPVS_SVC_ATTR_ADDR] = { .type = NLA_BINARY,
2774 .len = sizeof(union nf_inet_addr) },
2775 [IPVS_SVC_ATTR_PORT] = { .type = NLA_U16 },
2776 [IPVS_SVC_ATTR_FWMARK] = { .type = NLA_U32 },
2777 [IPVS_SVC_ATTR_SCHED_NAME] = { .type = NLA_NUL_STRING,
2778 .len = IP_VS_SCHEDNAME_MAXLEN },
0d1e71b0
SH		 2779 [IPVS_SVC_ATTR_PE_NAME] = { .type = NLA_NUL_STRING,
2780 .len = IP_VS_PENAME_MAXLEN },
9a812198
JV		 2781 [IPVS_SVC_ATTR_FLAGS] = { .type = NLA_BINARY,
2782 .len = sizeof(struct ip_vs_flags) },
2783 [IPVS_SVC_ATTR_TIMEOUT] = { .type = NLA_U32 },
2784 [IPVS_SVC_ATTR_NETMASK] = { .type = NLA_U32 },
2785 [IPVS_SVC_ATTR_STATS] = { .type = NLA_NESTED },
2786};
2787
2788/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2789static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2790 [IPVS_DEST_ATTR_ADDR] = { .type = NLA_BINARY,
2791 .len = sizeof(union nf_inet_addr) },
2792 [IPVS_DEST_ATTR_PORT] = { .type = NLA_U16 },
2793 [IPVS_DEST_ATTR_FWD_METHOD] = { .type = NLA_U32 },
2794 [IPVS_DEST_ATTR_WEIGHT] = { .type = NLA_U32 },
2795 [IPVS_DEST_ATTR_U_THRESH] = { .type = NLA_U32 },
2796 [IPVS_DEST_ATTR_L_THRESH] = { .type = NLA_U32 },
2797 [IPVS_DEST_ATTR_ACTIVE_CONNS] = { .type = NLA_U32 },
2798 [IPVS_DEST_ATTR_INACT_CONNS] = { .type = NLA_U32 },
2799 [IPVS_DEST_ATTR_PERSIST_CONNS] = { .type = NLA_U32 },
2800 [IPVS_DEST_ATTR_STATS] = { .type = NLA_NESTED },
2801};
2802
2803static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2804 struct ip_vs_stats *stats)
2805{
55a3d4e1 2806 struct ip_vs_stats_user ustats;
9a812198
JV		 2807 struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2808 if (!nl_stats)
2809 return -EMSGSIZE;
2810
55a3d4e1 2811 ip_vs_copy_stats(&ustats, stats);
9a812198 2812
55a3d4e1
JA		 2813 NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns);
2814 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts);
2815 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts);
2816 NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes);
2817 NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes);
2818 NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, ustats.cps);
2819 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps);
2820 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps);
2821 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps);
2822 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps);
9a812198
JV		 2823
2824 nla_nest_end(skb, nl_stats);
2825
2826 return 0;
2827
2828nla_put_failure:
9a812198
JV		 2829 nla_nest_cancel(skb, nl_stats);
2830 return -EMSGSIZE;
2831}
2832
2833static int ip_vs_genl_fill_service(struct sk_buff *skb,
2834 struct ip_vs_service *svc)
2835{
2836 struct nlattr *nl_service;
2837 struct ip_vs_flags flags = { .flags = svc->flags,
2838 .mask = ~0 };
2839
2840 nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2841 if (!nl_service)
2842 return -EMSGSIZE;
2843
f94fd041 2844 NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
9a812198
JV		 2845
2846 if (svc->fwmark) {
2847 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2848 } else {
2849 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2850 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2851 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2852 }
2853
2854 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
0d1e71b0
SH		 2855 if (svc->pe)
2856 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name);
9a812198
JV		 2857 NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2858 NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2859 NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2860
2861 if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2862 goto nla_put_failure;
2863
2864 nla_nest_end(skb, nl_service);
2865
2866 return 0;
2867
2868nla_put_failure:
2869 nla_nest_cancel(skb, nl_service);
2870 return -EMSGSIZE;
2871}
2872
2873static int ip_vs_genl_dump_service(struct sk_buff *skb,
2874 struct ip_vs_service *svc,
2875 struct netlink_callback *cb)
2876{
2877 void *hdr;
2878
2879 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2880 &ip_vs_genl_family, NLM_F_MULTI,
2881 IPVS_CMD_NEW_SERVICE);
2882 if (!hdr)
2883 return -EMSGSIZE;
2884
2885 if (ip_vs_genl_fill_service(skb, svc) < 0)
2886 goto nla_put_failure;
2887
2888 return genlmsg_end(skb, hdr);
2889
2890nla_put_failure:
2891 genlmsg_cancel(skb, hdr);
2892 return -EMSGSIZE;
2893}
2894
2895static int ip_vs_genl_dump_services(struct sk_buff *skb,
2896 struct netlink_callback *cb)
2897{
2898 int idx = 0, i;
2899 int start = cb->args[0];
2900 struct ip_vs_service *svc;
fc723250 2901 struct net *net = skb_sknet(skb);
9a812198
JV		 2902
2903 mutex_lock(&__ip_vs_mutex);
2904 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2905 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
fc723250 2906 if (++idx <= start || !net_eq(svc->net, net))
9a812198
JV		 2907 continue;
2908 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2909 idx--;
2910 goto nla_put_failure;
2911 }
2912 }
2913 }
2914
2915 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2916 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
fc723250 2917 if (++idx <= start || !net_eq(svc->net, net))
9a812198
JV		 2918 continue;
2919 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2920 idx--;
2921 goto nla_put_failure;
2922 }
2923 }
2924 }
2925
2926nla_put_failure:
2927 mutex_unlock(&__ip_vs_mutex);
2928 cb->args[0] = idx;
2929
2930 return skb->len;
2931}
2932
fc723250
HS		 2933static int ip_vs_genl_parse_service(struct net *net,
2934 struct ip_vs_service_user_kern *usvc,
26c15cfd
JA		 2935 struct nlattr *nla, int full_entry,
2936 struct ip_vs_service **ret_svc)
9a812198
JV		 2937{
2938 struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2939 struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
26c15cfd 2940 struct ip_vs_service *svc;
9a812198
JV		 2941
2942 /* Parse mandatory identifying service fields first */
2943 if (nla == NULL ||
2944 nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2945 return -EINVAL;
2946
2947 nla_af = attrs[IPVS_SVC_ATTR_AF];
2948 nla_protocol = attrs[IPVS_SVC_ATTR_PROTOCOL];
2949 nla_addr = attrs[IPVS_SVC_ATTR_ADDR];
2950 nla_port = attrs[IPVS_SVC_ATTR_PORT];
2951 nla_fwmark = attrs[IPVS_SVC_ATTR_FWMARK];
2952
2953 if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2954 return -EINVAL;
2955
258c8893
SH		 2956 memset(usvc, 0, sizeof(*usvc));
2957
c860c6b1 2958 usvc->af = nla_get_u16(nla_af);
f94fd041
JV		 2959#ifdef CONFIG_IP_VS_IPV6
2960 if (usvc->af != AF_INET && usvc->af != AF_INET6)
2961#else
2962 if (usvc->af != AF_INET)
2963#endif
9a812198
JV		 2964 return -EAFNOSUPPORT;
2965
2966 if (nla_fwmark) {
2967 usvc->protocol = IPPROTO_TCP;
2968 usvc->fwmark = nla_get_u32(nla_fwmark);
2969 } else {
2970 usvc->protocol = nla_get_u16(nla_protocol);
2971 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2972 usvc->port = nla_get_u16(nla_port);
2973 usvc->fwmark = 0;
2974 }
2975
26c15cfd 2976 if (usvc->fwmark)
fc723250 2977 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
26c15cfd 2978 else
fc723250 2979 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
26c15cfd
JA		 2980 &usvc->addr, usvc->port);
2981 *ret_svc = svc;
2982
9a812198
JV		 2983 /* If a full entry was requested, check for the additional fields */
2984 if (full_entry) {
0d1e71b0 2985 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
9a812198
JV		 2986 *nla_netmask;
2987 struct ip_vs_flags flags;
9a812198
JV		 2988
2989 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
0d1e71b0 2990 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
9a812198
JV		 2991 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2992 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2993 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2994
2995 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
2996 return -EINVAL;
2997
2998 nla_memcpy(&flags, nla_flags, sizeof(flags));
2999
3000 /* prefill flags from service if it already exists */
26c15cfd 3001 if (svc)
9a812198 3002 usvc->flags = svc->flags;
9a812198
JV		 3003
3004 /* set new flags from userland */
3005 usvc->flags = (usvc->flags & ~flags.mask) |
3006 (flags.flags & flags.mask);
c860c6b1 3007 usvc->sched_name = nla_data(nla_sched);
0d1e71b0 3008 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
9a812198
JV		 3009 usvc->timeout = nla_get_u32(nla_timeout);
3010 usvc->netmask = nla_get_u32(nla_netmask);
3011 }
3012
3013 return 0;
3014}
3015
fc723250
HS		 3016static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3017 struct nlattr *nla)
9a812198 3018{
c860c6b1 3019 struct ip_vs_service_user_kern usvc;
26c15cfd 3020 struct ip_vs_service *svc;
9a812198
JV		 3021 int ret;
3022
fc723250 3023 ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
26c15cfd 3024 return ret ? ERR_PTR(ret) : svc;
9a812198
JV		 3025}
3026
3027static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3028{
3029 struct nlattr *nl_dest;
3030
3031 nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3032 if (!nl_dest)
3033 return -EMSGSIZE;
3034
3035 NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
3036 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
3037
3038 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3039 atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
3040 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
3041 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
3042 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
3043 NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3044 atomic_read(&dest->activeconns));
3045 NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3046 atomic_read(&dest->inactconns));
3047 NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3048 atomic_read(&dest->persistconns));
3049
3050 if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3051 goto nla_put_failure;
3052
3053 nla_nest_end(skb, nl_dest);
3054
3055 return 0;
3056
3057nla_put_failure:
3058 nla_nest_cancel(skb, nl_dest);
3059 return -EMSGSIZE;
3060}
3061
3062static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3063 struct netlink_callback *cb)
3064{
3065 void *hdr;
3066
3067 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3068 &ip_vs_genl_family, NLM_F_MULTI,
3069 IPVS_CMD_NEW_DEST);
3070 if (!hdr)
3071 return -EMSGSIZE;
3072
3073 if (ip_vs_genl_fill_dest(skb, dest) < 0)
3074 goto nla_put_failure;
3075
3076 return genlmsg_end(skb, hdr);
3077
3078nla_put_failure:
3079 genlmsg_cancel(skb, hdr);
3080 return -EMSGSIZE;
3081}
3082
3083static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3084 struct netlink_callback *cb)
3085{
3086 int idx = 0;
3087 int start = cb->args[0];
3088 struct ip_vs_service *svc;
3089 struct ip_vs_dest *dest;
3090 struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
a0840e2e 3091 struct net *net = skb_sknet(skb);
9a812198
JV		 3092
3093 mutex_lock(&__ip_vs_mutex);
3094
3095 /* Try to find the service for which to dump destinations */
3096 if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3097 IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3098 goto out_err;
3099
a0840e2e 3100
fc723250 3101 svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
9a812198
JV		 3102 if (IS_ERR(svc) || svc == NULL)
3103 goto out_err;
3104
3105 /* Dump the destinations */
3106 list_for_each_entry(dest, &svc->destinations, n_list) {
3107 if (++idx <= start)
3108 continue;
3109 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3110 idx--;
3111 goto nla_put_failure;
3112 }
3113 }
3114
3115nla_put_failure:
3116 cb->args[0] = idx;
9a812198
JV		 3117
3118out_err:
3119 mutex_unlock(&__ip_vs_mutex);
3120
3121 return skb->len;
3122}
3123
c860c6b1 3124static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
9a812198
JV		 3125 struct nlattr *nla, int full_entry)
3126{
3127 struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3128 struct nlattr *nla_addr, *nla_port;
3129
3130 /* Parse mandatory identifying destination fields first */
3131 if (nla == NULL ||
3132 nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3133 return -EINVAL;
3134
3135 nla_addr = attrs[IPVS_DEST_ATTR_ADDR];
3136 nla_port = attrs[IPVS_DEST_ATTR_PORT];
3137
3138 if (!(nla_addr && nla_port))
3139 return -EINVAL;
3140
258c8893
SH		 3141 memset(udest, 0, sizeof(*udest));
3142
9a812198
JV		 3143 nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3144 udest->port = nla_get_u16(nla_port);
3145
3146 /* If a full entry was requested, check for the additional fields */
3147 if (full_entry) {
3148 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3149 *nla_l_thresh;
3150
3151 nla_fwd = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3152 nla_weight = attrs[IPVS_DEST_ATTR_WEIGHT];
3153 nla_u_thresh = attrs[IPVS_DEST_ATTR_U_THRESH];
3154 nla_l_thresh = attrs[IPVS_DEST_ATTR_L_THRESH];
3155
3156 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3157 return -EINVAL;
3158
3159 udest->conn_flags = nla_get_u32(nla_fwd)
3160 & IP_VS_CONN_F_FWD_MASK;
3161 udest->weight = nla_get_u32(nla_weight);
3162 udest->u_threshold = nla_get_u32(nla_u_thresh);
3163 udest->l_threshold = nla_get_u32(nla_l_thresh);
3164 }
3165
3166 return 0;
3167}
3168
3169static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3170 const char *mcast_ifn, __be32 syncid)
3171{
3172 struct nlattr *nl_daemon;
3173
3174 nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3175 if (!nl_daemon)
3176 return -EMSGSIZE;
3177
3178 NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
3179 NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
3180 NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
3181
3182 nla_nest_end(skb, nl_daemon);
3183
3184 return 0;
3185
3186nla_put_failure:
3187 nla_nest_cancel(skb, nl_daemon);
3188 return -EMSGSIZE;
3189}
3190
3191static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3192 const char *mcast_ifn, __be32 syncid,
3193 struct netlink_callback *cb)
3194{
3195 void *hdr;
3196 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3197 &ip_vs_genl_family, NLM_F_MULTI,
3198 IPVS_CMD_NEW_DAEMON);
3199 if (!hdr)
3200 return -EMSGSIZE;
3201
3202 if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3203 goto nla_put_failure;
3204
3205 return genlmsg_end(skb, hdr);
3206
3207nla_put_failure:
3208 genlmsg_cancel(skb, hdr);
3209 return -EMSGSIZE;
3210}
3211
3212static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3213 struct netlink_callback *cb)
3214{
a09d1977 3215 struct net *net = skb_sknet(skb);
f131315f
HS		 3216 struct netns_ipvs *ipvs = net_ipvs(net);
3217
ae1d48b2 3218 mutex_lock(&ipvs->sync_mutex);
f131315f 3219 if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
9a812198 3220 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
f131315f
HS		 3221 ipvs->master_mcast_ifn,
3222 ipvs->master_syncid, cb) < 0)
9a812198
JV		 3223 goto nla_put_failure;
3224
3225 cb->args[0] = 1;
3226 }
3227
f131315f 3228 if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
9a812198 3229 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
f131315f
HS		 3230 ipvs->backup_mcast_ifn,
3231 ipvs->backup_syncid, cb) < 0)
9a812198
JV		 3232 goto nla_put_failure;
3233
3234 cb->args[1] = 1;
3235 }
3236
3237nla_put_failure:
ae1d48b2 3238 mutex_unlock(&ipvs->sync_mutex);
9a812198
JV		 3239
3240 return skb->len;
3241}
3242
f131315f 3243static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
9a812198
JV		 3244{
3245 if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3246 attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3247 attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3248 return -EINVAL;
3249
f131315f
HS		 3250 return start_sync_thread(net,
3251 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
9a812198
JV		 3252 nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3253 nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3254}
3255
f131315f 3256static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
9a812198
JV		 3257{
3258 if (!attrs[IPVS_DAEMON_ATTR_STATE])
3259 return -EINVAL;
3260
f131315f
HS		 3261 return stop_sync_thread(net,
3262 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
9a812198
JV		 3263}
3264
9330419d 3265static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
9a812198
JV		 3266{
3267 struct ip_vs_timeout_user t;
3268
9330419d 3269 __ip_vs_get_timeouts(net, &t);
9a812198
JV		 3270
3271 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3272 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3273
3274 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3275 t.tcp_fin_timeout =
3276 nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3277
3278 if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3279 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3280
9330419d 3281 return ip_vs_set_timeout(net, &t);
9a812198
JV		 3282}
3283
ae1d48b2 3284static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
9a812198 3285{
9a812198 3286 int ret = 0, cmd;
fc723250 3287 struct net *net;
a0840e2e 3288 struct netns_ipvs *ipvs;
9a812198 3289
fc723250 3290 net = skb_sknet(skb);
a0840e2e 3291 ipvs = net_ipvs(net);
9a812198
JV		 3292 cmd = info->genlhdr->cmd;
3293
ae1d48b2 3294 if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
9a812198
JV		 3295 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3296
ae1d48b2 3297 mutex_lock(&ipvs->sync_mutex);
9a812198
JV		 3298 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3299 nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3300 info->attrs[IPVS_CMD_ATTR_DAEMON],
3301 ip_vs_daemon_policy)) {
3302 ret = -EINVAL;
3303 goto out;
3304 }
3305
3306 if (cmd == IPVS_CMD_NEW_DAEMON)
f131315f 3307 ret = ip_vs_genl_new_daemon(net, daemon_attrs);
9a812198 3308 else
f131315f 3309 ret = ip_vs_genl_del_daemon(net, daemon_attrs);
ae1d48b2
HS		 3310out:
3311 mutex_unlock(&ipvs->sync_mutex);
3312 }
3313 return ret;
3314}
3315
3316static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3317{
3318 struct ip_vs_service *svc = NULL;
3319 struct ip_vs_service_user_kern usvc;
3320 struct ip_vs_dest_user_kern udest;
3321 int ret = 0, cmd;
3322 int need_full_svc = 0, need_full_dest = 0;
3323 struct net *net;
ae1d48b2
HS		 3324
3325 net = skb_sknet(skb);
ae1d48b2
HS		 3326 cmd = info->genlhdr->cmd;
3327
3328 mutex_lock(&__ip_vs_mutex);
3329
3330 if (cmd == IPVS_CMD_FLUSH) {
3331 ret = ip_vs_flush(net);
3332 goto out;
3333 } else if (cmd == IPVS_CMD_SET_CONFIG) {
3334 ret = ip_vs_genl_set_config(net, info->attrs);
9a812198
JV		 3335 goto out;
3336 } else if (cmd == IPVS_CMD_ZERO &&
3337 !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
fc723250 3338 ret = ip_vs_zero_all(net);
9a812198
JV		 3339 goto out;
3340 }
3341
3342 /* All following commands require a service argument, so check if we
3343 * received a valid one. We need a full service specification when
3344 * adding / editing a service. Only identifying members otherwise. */
3345 if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3346 need_full_svc = 1;
3347
fc723250 3348 ret = ip_vs_genl_parse_service(net, &usvc,
9a812198 3349 info->attrs[IPVS_CMD_ATTR_SERVICE],
26c15cfd 3350 need_full_svc, &svc);
9a812198
JV		 3351 if (ret)
3352 goto out;
3353
9a812198
JV		 3354 /* Unless we're adding a new service, the service must already exist */
3355 if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3356 ret = -ESRCH;
3357 goto out;
3358 }
3359
3360 /* Destination commands require a valid destination argument. For
3361 * adding / editing a destination, we need a full destination
3362 * specification. */
3363 if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3364 cmd == IPVS_CMD_DEL_DEST) {
3365 if (cmd != IPVS_CMD_DEL_DEST)
3366 need_full_dest = 1;
3367
3368 ret = ip_vs_genl_parse_dest(&udest,
3369 info->attrs[IPVS_CMD_ATTR_DEST],
3370 need_full_dest);
3371 if (ret)
3372 goto out;
3373 }
3374
3375 switch (cmd) {
3376 case IPVS_CMD_NEW_SERVICE:
3377 if (svc == NULL)
fc723250 3378 ret = ip_vs_add_service(net, &usvc, &svc);
9a812198
JV		 3379 else
3380 ret = -EEXIST;
3381 break;
3382 case IPVS_CMD_SET_SERVICE:
3383 ret = ip_vs_edit_service(svc, &usvc);
3384 break;
3385 case IPVS_CMD_DEL_SERVICE:
3386 ret = ip_vs_del_service(svc);
26c15cfd 3387 /* do not use svc, it can be freed */
9a812198
JV		 3388 break;
3389 case IPVS_CMD_NEW_DEST:
3390 ret = ip_vs_add_dest(svc, &udest);
3391 break;
3392 case IPVS_CMD_SET_DEST:
3393 ret = ip_vs_edit_dest(svc, &udest);
3394 break;
3395 case IPVS_CMD_DEL_DEST:
3396 ret = ip_vs_del_dest(svc, &udest);
3397 break;
3398 case IPVS_CMD_ZERO:
3399 ret = ip_vs_zero_service(svc);
3400 break;
3401 default:
3402 ret = -EINVAL;
3403 }
3404
3405out:
9a812198
JV		 3406 mutex_unlock(&__ip_vs_mutex);
3407
3408 return ret;
3409}
3410
3411static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3412{
3413 struct sk_buff *msg;
3414 void *reply;
3415 int ret, cmd, reply_cmd;
fc723250 3416 struct net *net;
9a812198 3417
fc723250 3418 net = skb_sknet(skb);
9a812198
JV		 3419 cmd = info->genlhdr->cmd;
3420
3421 if (cmd == IPVS_CMD_GET_SERVICE)
3422 reply_cmd = IPVS_CMD_NEW_SERVICE;
3423 else if (cmd == IPVS_CMD_GET_INFO)
3424 reply_cmd = IPVS_CMD_SET_INFO;
3425 else if (cmd == IPVS_CMD_GET_CONFIG)
3426 reply_cmd = IPVS_CMD_SET_CONFIG;
3427 else {
1e3e238e 3428 pr_err("unknown Generic Netlink command\n");
9a812198
JV		 3429 return -EINVAL;
3430 }
3431
3432 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3433 if (!msg)
3434 return -ENOMEM;
3435
3436 mutex_lock(&__ip_vs_mutex);
3437
3438 reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3439 if (reply == NULL)
3440 goto nla_put_failure;
3441
3442 switch (cmd) {
3443 case IPVS_CMD_GET_SERVICE:
3444 {
3445 struct ip_vs_service *svc;
3446
fc723250
HS		 3447 svc = ip_vs_genl_find_service(net,
3448 info->attrs[IPVS_CMD_ATTR_SERVICE]);
9a812198
JV		 3449 if (IS_ERR(svc)) {
3450 ret = PTR_ERR(svc);
3451 goto out_err;
3452 } else if (svc) {
3453 ret = ip_vs_genl_fill_service(msg, svc);
9a812198
JV		 3454 if (ret)
3455 goto nla_put_failure;
3456 } else {
3457 ret = -ESRCH;
3458 goto out_err;
3459 }
3460
3461 break;
3462 }
3463
3464 case IPVS_CMD_GET_CONFIG:
3465 {
3466 struct ip_vs_timeout_user t;
3467
9330419d 3468 __ip_vs_get_timeouts(net, &t);
9a812198
JV		 3469#ifdef CONFIG_IP_VS_PROTO_TCP
3470 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3471 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3472 t.tcp_fin_timeout);
3473#endif
3474#ifdef CONFIG_IP_VS_PROTO_UDP
3475 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3476#endif
3477
3478 break;
3479 }
3480
3481 case IPVS_CMD_GET_INFO:
3482 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3483 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
6f7edb48 3484 ip_vs_conn_tab_size);
9a812198
JV		 3485 break;
3486 }
3487
3488 genlmsg_end(msg, reply);
134e6375 3489 ret = genlmsg_reply(msg, info);
9a812198
JV		 3490 goto out;
3491
3492nla_put_failure:
1e3e238e 3493 pr_err("not enough space in Netlink message\n");
9a812198
JV		 3494 ret = -EMSGSIZE;
3495
3496out_err:
3497 nlmsg_free(msg);
3498out:
3499 mutex_unlock(&__ip_vs_mutex);
3500
3501 return ret;
3502}
3503
3504
3505static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3506 {
3507 .cmd = IPVS_CMD_NEW_SERVICE,
3508 .flags = GENL_ADMIN_PERM,
3509 .policy = ip_vs_cmd_policy,
3510 .doit = ip_vs_genl_set_cmd,
3511 },
3512 {
3513 .cmd = IPVS_CMD_SET_SERVICE,
3514 .flags = GENL_ADMIN_PERM,
3515 .policy = ip_vs_cmd_policy,
3516 .doit = ip_vs_genl_set_cmd,
3517 },
3518 {
3519 .cmd = IPVS_CMD_DEL_SERVICE,
3520 .flags = GENL_ADMIN_PERM,
3521 .policy = ip_vs_cmd_policy,
3522 .doit = ip_vs_genl_set_cmd,
3523 },
3524 {
3525 .cmd = IPVS_CMD_GET_SERVICE,
3526 .flags = GENL_ADMIN_PERM,
3527 .doit = ip_vs_genl_get_cmd,
3528 .dumpit = ip_vs_genl_dump_services,
3529 .policy = ip_vs_cmd_policy,
3530 },
3531 {
3532 .cmd = IPVS_CMD_NEW_DEST,
3533 .flags = GENL_ADMIN_PERM,
3534 .policy = ip_vs_cmd_policy,
3535 .doit = ip_vs_genl_set_cmd,
3536 },
3537 {
3538 .cmd = IPVS_CMD_SET_DEST,
3539 .flags = GENL_ADMIN_PERM,
3540 .policy = ip_vs_cmd_policy,
3541 .doit = ip_vs_genl_set_cmd,
3542 },
3543 {
3544 .cmd = IPVS_CMD_DEL_DEST,
3545 .flags = GENL_ADMIN_PERM,
3546 .policy = ip_vs_cmd_policy,
3547 .doit = ip_vs_genl_set_cmd,
3548 },
3549 {
3550 .cmd = IPVS_CMD_GET_DEST,
3551 .flags = GENL_ADMIN_PERM,
3552 .policy = ip_vs_cmd_policy,
3553 .dumpit = ip_vs_genl_dump_dests,
3554 },
3555 {
3556 .cmd = IPVS_CMD_NEW_DAEMON,
3557 .flags = GENL_ADMIN_PERM,
3558 .policy = ip_vs_cmd_policy,
ae1d48b2 3559 .doit = ip_vs_genl_set_daemon,
9a812198
JV		 3560 },
3561 {
3562 .cmd = IPVS_CMD_DEL_DAEMON,
3563 .flags = GENL_ADMIN_PERM,
3564 .policy = ip_vs_cmd_policy,
ae1d48b2 3565 .doit = ip_vs_genl_set_daemon,
9a812198
JV		 3566 },
3567 {
3568 .cmd = IPVS_CMD_GET_DAEMON,
3569 .flags = GENL_ADMIN_PERM,
3570 .dumpit = ip_vs_genl_dump_daemons,
3571 },
3572 {
3573 .cmd = IPVS_CMD_SET_CONFIG,
3574 .flags = GENL_ADMIN_PERM,
3575 .policy = ip_vs_cmd_policy,
3576 .doit = ip_vs_genl_set_cmd,
3577 },
3578 {
3579 .cmd = IPVS_CMD_GET_CONFIG,
3580 .flags = GENL_ADMIN_PERM,
3581 .doit = ip_vs_genl_get_cmd,
3582 },
3583 {
3584 .cmd = IPVS_CMD_GET_INFO,
3585 .flags = GENL_ADMIN_PERM,
3586 .doit = ip_vs_genl_get_cmd,
3587 },
3588 {
3589 .cmd = IPVS_CMD_ZERO,
3590 .flags = GENL_ADMIN_PERM,
3591 .policy = ip_vs_cmd_policy,
3592 .doit = ip_vs_genl_set_cmd,
3593 },
3594 {
3595 .cmd = IPVS_CMD_FLUSH,
3596 .flags = GENL_ADMIN_PERM,
3597 .doit = ip_vs_genl_set_cmd,
3598 },
3599};
3600
3601static int __init ip_vs_genl_register(void)
3602{
8f698d54
MM		 3603 return genl_register_family_with_ops(&ip_vs_genl_family,
3604 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
9a812198
JV		 3605}
3606
3607static void ip_vs_genl_unregister(void)
3608{
3609 genl_unregister_family(&ip_vs_genl_family);
3610}
3611
3612/* End of Generic Netlink interface definitions */
3613
61b1ab45
HS		 3614/*
3615 * per netns intit/exit func.
3616 */
14e40546 3617#ifdef CONFIG_SYSCTL
503cf15a 3618int __net_init ip_vs_control_net_init_sysctl(struct net *net)
61b1ab45 3619{
fc723250
HS		 3620 int idx;
3621 struct netns_ipvs *ipvs = net_ipvs(net);
a0840e2e 3622 struct ctl_table *tbl;
fc723250 3623
a0840e2e
HS		 3624 atomic_set(&ipvs->dropentry, 0);
3625 spin_lock_init(&ipvs->dropentry_lock);
3626 spin_lock_init(&ipvs->droppacket_lock);
3627 spin_lock_init(&ipvs->securetcp_lock);
a0840e2e
HS		 3628
3629 if (!net_eq(net, &init_net)) {
3630 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3631 if (tbl == NULL)
14e40546 3632 return -ENOMEM;
a0840e2e
HS		 3633 } else
3634 tbl = vs_vars;
3635 /* Initialize sysctl defaults */
3636 idx = 0;
3637 ipvs->sysctl_amemthresh = 1024;
3638 tbl[idx++].data = &ipvs->sysctl_amemthresh;
3639 ipvs->sysctl_am_droprate = 10;
3640 tbl[idx++].data = &ipvs->sysctl_am_droprate;
3641 tbl[idx++].data = &ipvs->sysctl_drop_entry;
3642 tbl[idx++].data = &ipvs->sysctl_drop_packet;
3643#ifdef CONFIG_IP_VS_NFCT
3644 tbl[idx++].data = &ipvs->sysctl_conntrack;
3645#endif
3646 tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3647 ipvs->sysctl_snat_reroute = 1;
3648 tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3649 ipvs->sysctl_sync_ver = 1;
3650 tbl[idx++].data = &ipvs->sysctl_sync_ver;
3651 tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3652 tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3653 tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
59e0350e
SH		 3654 ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3655 ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
a0840e2e
HS		 3656 tbl[idx].data = &ipvs->sysctl_sync_threshold;
3657 tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3658 tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3659
3660
3661 ipvs->sysctl_hdr = register_net_sysctl_table(net, net_vs_ctl_path,
07924709 3662 tbl);
0443929f
SH		 3663 if (ipvs->sysctl_hdr == NULL) {
3664 if (!net_eq(net, &init_net))
3665 kfree(tbl);
14e40546 3666 return -ENOMEM;
0443929f 3667 }
6ef757f9 3668 ip_vs_start_estimator(net, &ipvs->tot_stats);
a0840e2e 3669 ipvs->sysctl_tbl = tbl;
f6340ee0
HS		 3670 /* Schedule defense work */
3671 INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3672 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
61b1ab45 3673
61b1ab45 3674 return 0;
61b1ab45
HS		 3675}
3676
503cf15a 3677void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
61b1ab45 3678{
b17fc996
HS		 3679 struct netns_ipvs *ipvs = net_ipvs(net);
3680
f2431e6e
HS		 3681 cancel_delayed_work_sync(&ipvs->defense_work);
3682 cancel_work_sync(&ipvs->defense_work.work);
a0840e2e 3683 unregister_net_sysctl_table(ipvs->sysctl_hdr);
14e40546
SH		 3684}
3685
3686#else
3687
503cf15a
HS		 3688int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3689void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net) { }
14e40546 3690
0443929f 3691#endif
14e40546 3692
7a4f0761
HS		 3693static struct notifier_block ip_vs_dst_notifier = {
3694 .notifier_call = ip_vs_dst_event,
3695};
3696
503cf15a 3697int __net_init ip_vs_control_net_init(struct net *net)
14e40546
SH		 3698{
3699 int idx;
3700 struct netns_ipvs *ipvs = net_ipvs(net);
3701
3458e21c 3702 rwlock_init(&ipvs->rs_lock);
14e40546
SH		 3703
3704 /* Initialize rs_table */
3705 for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3706 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3707
3708 INIT_LIST_HEAD(&ipvs->dest_trash);
3709 atomic_set(&ipvs->ftpsvc_counter, 0);
3710 atomic_set(&ipvs->nullsvc_counter, 0);
3711
3712 /* procfs stats */
3713 ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
0a9ee813 3714 if (!ipvs->tot_stats.cpustats)
14e40546 3715 return -ENOMEM;
0a9ee813 3716
14e40546
SH		 3717 spin_lock_init(&ipvs->tot_stats.lock);
3718
3719 proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
3720 proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
3721 proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
3722 &ip_vs_stats_percpu_fops);
3723
503cf15a 3724 if (ip_vs_control_net_init_sysctl(net))
14e40546
SH		 3725 goto err;
3726
3727 return 0;
3728
3729err:
2a0751af 3730 free_percpu(ipvs->tot_stats.cpustats);
61b1ab45
HS		 3731 return -ENOMEM;
3732}
3733
503cf15a 3734void __net_exit ip_vs_control_net_cleanup(struct net *net)
61b1ab45 3735{
b17fc996
HS		 3736 struct netns_ipvs *ipvs = net_ipvs(net);
3737
f2431e6e 3738 ip_vs_trash_cleanup(net);
6ef757f9 3739 ip_vs_stop_estimator(net, &ipvs->tot_stats);
503cf15a 3740 ip_vs_control_net_cleanup_sysctl(net);
b17fc996 3741 proc_net_remove(net, "ip_vs_stats_percpu");
61b1ab45
HS		 3742 proc_net_remove(net, "ip_vs_stats");
3743 proc_net_remove(net, "ip_vs");
2a0751af 3744 free_percpu(ipvs->tot_stats.cpustats);
61b1ab45
HS		 3745}
3746
048cf48b 3747int __init ip_vs_control_init(void)
1da177e4 3748{
1da177e4 3749 int idx;
fc723250 3750 int ret;
1da177e4
LT		 3751
3752 EnterFunction(2);
3753
fc723250 3754 /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
d86bef73
EB		 3755 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3756 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3757 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3758 }
fc723250 3759
fc723250 3760 smp_wmb(); /* Do we really need it now ? */
d86bef73 3761
1da177e4
LT		 3762 ret = nf_register_sockopt(&ip_vs_sockopts);
3763 if (ret) {
1e3e238e 3764 pr_err("cannot register sockopt.\n");
7a4f0761 3765 goto err_sock;
1da177e4
LT		 3766 }
3767
9a812198
JV		 3768 ret = ip_vs_genl_register();
3769 if (ret) {
1e3e238e 3770 pr_err("cannot register Generic Netlink interface.\n");
7a4f0761 3771 goto err_genl;
9a812198
JV		 3772 }
3773
7a4f0761
HS		 3774 ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3775 if (ret < 0)
3776 goto err_notf;
3777
1da177e4
LT		 3778 LeaveFunction(2);
3779 return 0;
fc723250 3780
7a4f0761
HS		 3781err_notf:
3782 ip_vs_genl_unregister();
3783err_genl:
3784 nf_unregister_sockopt(&ip_vs_sockopts);
3785err_sock:
fc723250 3786 return ret;
1da177e4
LT		 3787}
3788
3789
3790void ip_vs_control_cleanup(void)
3791{
3792 EnterFunction(2);
7676e345 3793 unregister_netdevice_notifier(&ip_vs_dst_notifier);
9a812198 3794 ip_vs_genl_unregister();
1da177e4
LT		 3795 nf_unregister_sockopt(&ip_vs_sockopts);
3796 LeaveFunction(2);
3797}
kernel source for telekom puls (alcatel/mediatek)