projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
ipvs: avoid routing by TOS for real server
[deliverable/linux.git] / net / netfilter / ipvs / ip_vs_ctl.c
CommitLineData
1da177e4
LT		 1/*
2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the NetFilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
6 * cluster of servers.
7 *
1da177e4
LT		 8 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
9 * Peter Kese <peter.kese@ijs.si>
10 * Julian Anastasov <ja@ssi.bg>
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 *
17 * Changes:
18 *
19 */
20
9aada7ac
HE		 21#define KMSG_COMPONENT "IPVS"
22#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
23
1da177e4
LT		 24#include <linux/module.h>
25#include <linux/init.h>
26#include <linux/types.h>
4fc268d2 27#include <linux/capability.h>
1da177e4
LT		 28#include <linux/fs.h>
29#include <linux/sysctl.h>
30#include <linux/proc_fs.h>
31#include <linux/workqueue.h>
32#include <linux/swap.h>
1da177e4 33#include <linux/seq_file.h>
5a0e3ad6 34#include <linux/slab.h>
1da177e4
LT		 35
36#include <linux/netfilter.h>
37#include <linux/netfilter_ipv4.h>
14cc3e2b 38#include <linux/mutex.h>
1da177e4 39
457c4cbc 40#include <net/net_namespace.h>
9330419d 41#include <linux/nsproxy.h>
1da177e4 42#include <net/ip.h>
09571c7a
VB		 43#ifdef CONFIG_IP_VS_IPV6
44#include <net/ipv6.h>
45#include <net/ip6_route.h>
46#endif
14c85021 47#include <net/route.h>
1da177e4 48#include <net/sock.h>
9a812198 49#include <net/genetlink.h>
1da177e4
LT		 50
51#include <asm/uaccess.h>
52
53#include <net/ip_vs.h>
54
55/* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
14cc3e2b 56static DEFINE_MUTEX(__ip_vs_mutex);
1da177e4
LT		 57
58/* lock for service table */
59static DEFINE_RWLOCK(__ip_vs_svc_lock);
60
1da177e4 61/* sysctl variables */
1da177e4
LT		 62
63#ifdef CONFIG_IP_VS_DEBUG
64static int sysctl_ip_vs_debug_level = 0;
65
66int ip_vs_get_debug_level(void)
67{
68 return sysctl_ip_vs_debug_level;
69}
70#endif
71
7a4f0761
HS		 72
73/* Protos */
74static void __ip_vs_del_service(struct ip_vs_service *svc);
75
76
09571c7a
VB		 77#ifdef CONFIG_IP_VS_IPV6
78/* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
c24584c0
ED		 79static bool __ip_vs_addr_is_local_v6(struct net *net,
80 const struct in6_addr *addr)
09571c7a 81{
4c9483b2
DM		 82 struct flowi6 fl6 = {
83 .daddr = *addr,
09571c7a 84 };
c24584c0
ED		 85 struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
86 bool is_local;
09571c7a 87
c24584c0 88 is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
09571c7a 89
c24584c0
ED		 90 dst_release(dst);
91 return is_local;
09571c7a
VB		 92}
93#endif
14e40546
SH		 94
95#ifdef CONFIG_SYSCTL
1da177e4 96/*
af9debd4
JA		 97 * update_defense_level is called from keventd and from sysctl,
98 * so it needs to protect itself from softirqs
1da177e4 99 */
9330419d 100static void update_defense_level(struct netns_ipvs *ipvs)
1da177e4
LT		 101{
102 struct sysinfo i;
103 static int old_secure_tcp = 0;
104 int availmem;
105 int nomem;
106 int to_change = -1;
107
108 /* we only count free and buffered memory (in pages) */
109 si_meminfo(&i);
110 availmem = i.freeram + i.bufferram;
111 /* however in linux 2.5 the i.bufferram is total page cache size,
112 we need adjust it */
113 /* si_swapinfo(&i); */
114 /* availmem = availmem - (i.totalswap - i.freeswap); */
115
a0840e2e 116 nomem = (availmem < ipvs->sysctl_amemthresh);
1da177e4 117
af9debd4
JA		 118 local_bh_disable();
119
1da177e4 120 /* drop_entry */
a0840e2e
HS		 121 spin_lock(&ipvs->dropentry_lock);
122 switch (ipvs->sysctl_drop_entry) {
1da177e4 123 case 0:
a0840e2e 124 atomic_set(&ipvs->dropentry, 0);
1da177e4
LT		 125 break;
126 case 1:
127 if (nomem) {
a0840e2e
HS		 128 atomic_set(&ipvs->dropentry, 1);
129 ipvs->sysctl_drop_entry = 2;
1da177e4 130 } else {
a0840e2e 131 atomic_set(&ipvs->dropentry, 0);
1da177e4
LT		 132 }
133 break;
134 case 2:
135 if (nomem) {
a0840e2e 136 atomic_set(&ipvs->dropentry, 1);
1da177e4 137 } else {
a0840e2e
HS		 138 atomic_set(&ipvs->dropentry, 0);
139 ipvs->sysctl_drop_entry = 1;
1da177e4
LT		 140 };
141 break;
142 case 3:
a0840e2e 143 atomic_set(&ipvs->dropentry, 1);
1da177e4
LT		 144 break;
145 }
a0840e2e 146 spin_unlock(&ipvs->dropentry_lock);
1da177e4
LT		 147
148 /* drop_packet */
a0840e2e
HS		 149 spin_lock(&ipvs->droppacket_lock);
150 switch (ipvs->sysctl_drop_packet) {
1da177e4 151 case 0:
a0840e2e 152 ipvs->drop_rate = 0;
1da177e4
LT		 153 break;
154 case 1:
155 if (nomem) {
a0840e2e
HS		 156 ipvs->drop_rate = ipvs->drop_counter
157 = ipvs->sysctl_amemthresh /
158 (ipvs->sysctl_amemthresh-availmem);
159 ipvs->sysctl_drop_packet = 2;
1da177e4 160 } else {
a0840e2e 161 ipvs->drop_rate = 0;
1da177e4
LT		 162 }
163 break;
164 case 2:
165 if (nomem) {
a0840e2e
HS		 166 ipvs->drop_rate = ipvs->drop_counter
167 = ipvs->sysctl_amemthresh /
168 (ipvs->sysctl_amemthresh-availmem);
1da177e4 169 } else {
a0840e2e
HS		 170 ipvs->drop_rate = 0;
171 ipvs->sysctl_drop_packet = 1;
1da177e4
LT		 172 }
173 break;
174 case 3:
a0840e2e 175 ipvs->drop_rate = ipvs->sysctl_am_droprate;
1da177e4
LT		 176 break;
177 }
a0840e2e 178 spin_unlock(&ipvs->droppacket_lock);
1da177e4
LT		 179
180 /* secure_tcp */
a0840e2e
HS		 181 spin_lock(&ipvs->securetcp_lock);
182 switch (ipvs->sysctl_secure_tcp) {
1da177e4
LT		 183 case 0:
184 if (old_secure_tcp >= 2)
185 to_change = 0;
186 break;
187 case 1:
188 if (nomem) {
189 if (old_secure_tcp < 2)
190 to_change = 1;
a0840e2e 191 ipvs->sysctl_secure_tcp = 2;
1da177e4
LT		 192 } else {
193 if (old_secure_tcp >= 2)
194 to_change = 0;
195 }
196 break;
197 case 2:
198 if (nomem) {
199 if (old_secure_tcp < 2)
200 to_change = 1;
201 } else {
202 if (old_secure_tcp >= 2)
203 to_change = 0;
a0840e2e 204 ipvs->sysctl_secure_tcp = 1;
1da177e4
LT		 205 }
206 break;
207 case 3:
208 if (old_secure_tcp < 2)
209 to_change = 1;
210 break;
211 }
a0840e2e 212 old_secure_tcp = ipvs->sysctl_secure_tcp;
1da177e4 213 if (to_change >= 0)
9330419d 214 ip_vs_protocol_timeout_change(ipvs,
a0840e2e
HS		 215 ipvs->sysctl_secure_tcp > 1);
216 spin_unlock(&ipvs->securetcp_lock);
af9debd4
JA		 217
218 local_bh_enable();
1da177e4
LT		 219}
220
221
222/*
223 * Timer for checking the defense
224 */
225#define DEFENSE_TIMER_PERIOD 1*HZ
1da177e4 226
c4028958 227static void defense_work_handler(struct work_struct *work)
1da177e4 228{
f6340ee0
HS		 229 struct netns_ipvs *ipvs =
230 container_of(work, struct netns_ipvs, defense_work.work);
9330419d
HS		 231
232 update_defense_level(ipvs);
a0840e2e 233 if (atomic_read(&ipvs->dropentry))
f6340ee0
HS		 234 ip_vs_random_dropentry(ipvs->net);
235 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
1da177e4 236}
14e40546 237#endif
1da177e4
LT		 238
239int
240ip_vs_use_count_inc(void)
241{
242 return try_module_get(THIS_MODULE);
243}
244
245void
246ip_vs_use_count_dec(void)
247{
248 module_put(THIS_MODULE);
249}
250
251
252/*
253 * Hash table: for virtual service lookups
254 */
255#define IP_VS_SVC_TAB_BITS 8
256#define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
257#define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
258
259/* the service table hashed by <protocol, addr, port> */
260static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
261/* the service table hashed by fwmark */
262static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
263
1da177e4
LT		 264
265/*
266 * Returns hash value for virtual service
267 */
95c96174
ED		 268static inline unsigned int
269ip_vs_svc_hashkey(struct net *net, int af, unsigned int proto,
fc723250 270 const union nf_inet_addr *addr, __be16 port)
1da177e4 271{
95c96174 272 register unsigned int porth = ntohs(port);
b18610de 273 __be32 addr_fold = addr->ip;
e9836f24 274 __u32 ahash;
1da177e4 275
b18610de
JV		 276#ifdef CONFIG_IP_VS_IPV6
277 if (af == AF_INET6)
278 addr_fold = addr->ip6[0]^addr->ip6[1]^
279 addr->ip6[2]^addr->ip6[3];
280#endif
e9836f24
JA		 281 ahash = ntohl(addr_fold);
282 ahash ^= ((size_t) net >> 8);
b18610de 283
e9836f24
JA		 284 return (proto ^ ahash ^ (porth >> IP_VS_SVC_TAB_BITS) ^ porth) &
285 IP_VS_SVC_TAB_MASK;
1da177e4
LT		 286}
287
288/*
289 * Returns hash value of fwmark for virtual service lookup
290 */
95c96174 291static inline unsigned int ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
1da177e4 292{
fc723250 293 return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
1da177e4
LT		 294}
295
296/*
fc723250 297 * Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
1da177e4
LT		 298 * or in the ip_vs_svc_fwm_table by fwmark.
299 * Should be called with locked tables.
300 */
301static int ip_vs_svc_hash(struct ip_vs_service *svc)
302{
95c96174 303 unsigned int hash;
1da177e4
LT		 304
305 if (svc->flags & IP_VS_SVC_F_HASHED) {
1e3e238e
HE		 306 pr_err("%s(): request for already hashed, called from %pF\n",
307 __func__, __builtin_return_address(0));
1da177e4
LT		 308 return 0;
309 }
310
311 if (svc->fwmark == 0) {
312 /*
fc723250 313 * Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
1da177e4 314 */
fc723250
HS		 315 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
316 &svc->addr, svc->port);
1da177e4
LT		 317 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
318 } else {
319 /*
fc723250 320 * Hash it by fwmark in svc_fwm_table
1da177e4 321 */
fc723250 322 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
1da177e4
LT		 323 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
324 }
325
326 svc->flags |= IP_VS_SVC_F_HASHED;
327 /* increase its refcnt because it is referenced by the svc table */
328 atomic_inc(&svc->refcnt);
329 return 1;
330}
331
332
333/*
fc723250 334 * Unhashes a service from svc_table / svc_fwm_table.
1da177e4
LT		 335 * Should be called with locked tables.
336 */
337static int ip_vs_svc_unhash(struct ip_vs_service *svc)
338{
339 if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
1e3e238e
HE		 340 pr_err("%s(): request for unhash flagged, called from %pF\n",
341 __func__, __builtin_return_address(0));
1da177e4
LT		 342 return 0;
343 }
344
345 if (svc->fwmark == 0) {
fc723250 346 /* Remove it from the svc_table table */
1da177e4
LT		 347 list_del(&svc->s_list);
348 } else {
fc723250 349 /* Remove it from the svc_fwm_table table */
1da177e4
LT		 350 list_del(&svc->f_list);
351 }
352
353 svc->flags &= ~IP_VS_SVC_F_HASHED;
354 atomic_dec(&svc->refcnt);
355 return 1;
356}
357
358
359/*
fc723250 360 * Get service by {netns, proto,addr,port} in the service table.
1da177e4 361 */
b18610de 362static inline struct ip_vs_service *
fc723250
HS		 363__ip_vs_service_find(struct net *net, int af, __u16 protocol,
364 const union nf_inet_addr *vaddr, __be16 vport)
1da177e4 365{
95c96174 366 unsigned int hash;
1da177e4
LT		 367 struct ip_vs_service *svc;
368
369 /* Check for "full" addressed entries */
fc723250 370 hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
1da177e4
LT		 371
372 list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
b18610de
JV		 373 if ((svc->af == af)
374 && ip_vs_addr_equal(af, &svc->addr, vaddr)
1da177e4 375 && (svc->port == vport)
fc723250
HS		 376 && (svc->protocol == protocol)
377 && net_eq(svc->net, net)) {
1da177e4 378 /* HIT */
1da177e4
LT		 379 return svc;
380 }
381 }
382
383 return NULL;
384}
385
386
387/*
388 * Get service by {fwmark} in the service table.
389 */
b18610de 390static inline struct ip_vs_service *
fc723250 391__ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
1da177e4 392{
95c96174 393 unsigned int hash;
1da177e4
LT		 394 struct ip_vs_service *svc;
395
396 /* Check for fwmark addressed entries */
fc723250 397 hash = ip_vs_svc_fwm_hashkey(net, fwmark);
1da177e4
LT		 398
399 list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
fc723250
HS		 400 if (svc->fwmark == fwmark && svc->af == af
401 && net_eq(svc->net, net)) {
1da177e4 402 /* HIT */
1da177e4
LT		 403 return svc;
404 }
405 }
406
407 return NULL;
408}
409
410struct ip_vs_service *
fc723250 411ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
3c2e0505 412 const union nf_inet_addr *vaddr, __be16 vport)
1da177e4
LT		 413{
414 struct ip_vs_service *svc;
763f8d0e 415 struct netns_ipvs *ipvs = net_ipvs(net);
3c2e0505 416
1da177e4
LT		 417 read_lock(&__ip_vs_svc_lock);
418
419 /*
420 * Check the table hashed by fwmark first
421 */
097fc76a
JA		 422 if (fwmark) {
423 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
424 if (svc)
425 goto out;
426 }
1da177e4
LT		 427
428 /*
429 * Check the table hashed by <protocol,addr,port>
430 * for "full" addressed entries
431 */
fc723250 432 svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
1da177e4
LT		 433
434 if (svc == NULL
435 && protocol == IPPROTO_TCP
763f8d0e 436 && atomic_read(&ipvs->ftpsvc_counter)
1da177e4
LT		 437 && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
438 /*
439 * Check if ftp service entry exists, the packet
440 * might belong to FTP data connections.
441 */
fc723250 442 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
1da177e4
LT		 443 }
444
445 if (svc == NULL
763f8d0e 446 && atomic_read(&ipvs->nullsvc_counter)) {
1da177e4
LT		 447 /*
448 * Check if the catch-all port (port zero) exists
449 */
fc723250 450 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
1da177e4
LT		 451 }
452
453 out:
26c15cfd
JA		 454 if (svc)
455 atomic_inc(&svc->usecnt);
1da177e4
LT		 456 read_unlock(&__ip_vs_svc_lock);
457
3c2e0505
JV		 458 IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
459 fwmark, ip_vs_proto_name(protocol),
460 IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
461 svc ? "hit" : "not hit");
1da177e4
LT		 462
463 return svc;
464}
465
466
467static inline void
468__ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
469{
470 atomic_inc(&svc->refcnt);
471 dest->svc = svc;
472}
473
26c15cfd 474static void
1da177e4
LT		 475__ip_vs_unbind_svc(struct ip_vs_dest *dest)
476{
477 struct ip_vs_service *svc = dest->svc;
478
479 dest->svc = NULL;
26c15cfd
JA		 480 if (atomic_dec_and_test(&svc->refcnt)) {
481 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
482 svc->fwmark,
483 IP_VS_DBG_ADDR(svc->af, &svc->addr),
484 ntohs(svc->port), atomic_read(&svc->usecnt));
b17fc996 485 free_percpu(svc->stats.cpustats);
1da177e4 486 kfree(svc);
26c15cfd 487 }
1da177e4
LT		 488}
489
490
491/*
492 * Returns hash value for real service
493 */
95c96174 494static inline unsigned int ip_vs_rs_hashkey(int af,
7937df15
JV		 495 const union nf_inet_addr *addr,
496 __be16 port)
1da177e4 497{
95c96174 498 register unsigned int porth = ntohs(port);
7937df15
JV		 499 __be32 addr_fold = addr->ip;
500
501#ifdef CONFIG_IP_VS_IPV6
502 if (af == AF_INET6)
503 addr_fold = addr->ip6[0]^addr->ip6[1]^
504 addr->ip6[2]^addr->ip6[3];
505#endif
1da177e4 506
7937df15 507 return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
1da177e4
LT		 508 & IP_VS_RTAB_MASK;
509}
510
511/*
fc723250 512 * Hashes ip_vs_dest in rs_table by <proto,addr,port>.
1da177e4
LT		 513 * should be called with locked tables.
514 */
fc723250 515static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
1da177e4 516{
95c96174 517 unsigned int hash;
1da177e4
LT		 518
519 if (!list_empty(&dest->d_list)) {
520 return 0;
521 }
522
523 /*
524 * Hash by proto,addr,port,
525 * which are the parameters of the real service.
526 */
7937df15
JV		 527 hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
528
fc723250 529 list_add(&dest->d_list, &ipvs->rs_table[hash]);
1da177e4
LT		 530
531 return 1;
532}
533
534/*
fc723250 535 * UNhashes ip_vs_dest from rs_table.
1da177e4
LT		 536 * should be called with locked tables.
537 */
538static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
539{
540 /*
fc723250 541 * Remove it from the rs_table table.
1da177e4
LT		 542 */
543 if (!list_empty(&dest->d_list)) {
0edd9488 544 list_del_init(&dest->d_list);
1da177e4
LT		 545 }
546
547 return 1;
548}
549
550/*
551 * Lookup real service by <proto,addr,port> in the real service table.
552 */
553struct ip_vs_dest *
fc723250 554ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
7937df15
JV		 555 const union nf_inet_addr *daddr,
556 __be16 dport)
1da177e4 557{
fc723250 558 struct netns_ipvs *ipvs = net_ipvs(net);
95c96174 559 unsigned int hash;
1da177e4
LT		 560 struct ip_vs_dest *dest;
561
562 /*
563 * Check for "full" addressed entries
564 * Return the first found entry
565 */
7937df15 566 hash = ip_vs_rs_hashkey(af, daddr, dport);
1da177e4 567
a0840e2e 568 read_lock(&ipvs->rs_lock);
fc723250 569 list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
7937df15
JV		 570 if ((dest->af == af)
571 && ip_vs_addr_equal(af, &dest->addr, daddr)
1da177e4
LT		 572 && (dest->port == dport)
573 && ((dest->protocol == protocol) ||
574 dest->vfwmark)) {
575 /* HIT */
a0840e2e 576 read_unlock(&ipvs->rs_lock);
1da177e4
LT		 577 return dest;
578 }
579 }
a0840e2e 580 read_unlock(&ipvs->rs_lock);
1da177e4
LT		 581
582 return NULL;
583}
584
585/*
586 * Lookup destination by {addr,port} in the given service
587 */
588static struct ip_vs_dest *
7937df15
JV		 589ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
590 __be16 dport)
1da177e4
LT		 591{
592 struct ip_vs_dest *dest;
593
594 /*
595 * Find the destination for the given service
596 */
597 list_for_each_entry(dest, &svc->destinations, n_list) {
7937df15
JV		 598 if ((dest->af == svc->af)
599 && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
600 && (dest->port == dport)) {
1da177e4
LT		 601 /* HIT */
602 return dest;
603 }
604 }
605
606 return NULL;
607}
608
1e356f9c
RB		 609/*
610 * Find destination by {daddr,dport,vaddr,protocol}
611 * Cretaed to be used in ip_vs_process_message() in
612 * the backup synchronization daemon. It finds the
613 * destination to be bound to the received connection
614 * on the backup.
615 *
616 * ip_vs_lookup_real_service() looked promissing, but
617 * seems not working as expected.
618 */
fc723250
HS		 619struct ip_vs_dest *ip_vs_find_dest(struct net *net, int af,
620 const union nf_inet_addr *daddr,
7937df15
JV		 621 __be16 dport,
622 const union nf_inet_addr *vaddr,
52793dbe
JA		 623 __be16 vport, __u16 protocol, __u32 fwmark,
624 __u32 flags)
1e356f9c
RB		 625{
626 struct ip_vs_dest *dest;
627 struct ip_vs_service *svc;
52793dbe 628 __be16 port = dport;
1e356f9c 629
fc723250 630 svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
1e356f9c
RB		 631 if (!svc)
632 return NULL;
52793dbe
JA		 633 if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
634 port = 0;
635 dest = ip_vs_lookup_dest(svc, daddr, port);
636 if (!dest)
637 dest = ip_vs_lookup_dest(svc, daddr, port ^ dport);
1e356f9c
RB		 638 if (dest)
639 atomic_inc(&dest->refcnt);
640 ip_vs_service_put(svc);
641 return dest;
642}
1da177e4
LT		 643
644/*
645 * Lookup dest by {svc,addr,port} in the destination trash.
646 * The destination trash is used to hold the destinations that are removed
647 * from the service table but are still referenced by some conn entries.
648 * The reason to add the destination trash is when the dest is temporary
649 * down (either by administrator or by monitor program), the dest can be
650 * picked back from the trash, the remaining connections to the dest can
651 * continue, and the counting information of the dest is also useful for
652 * scheduling.
653 */
654static struct ip_vs_dest *
7937df15
JV		 655ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
656 __be16 dport)
1da177e4
LT		 657{
658 struct ip_vs_dest *dest, *nxt;
f2431e6e 659 struct netns_ipvs *ipvs = net_ipvs(svc->net);
1da177e4
LT		 660
661 /*
662 * Find the destination in trash
663 */
f2431e6e 664 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
7937df15
JV		 665 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
666 "dest->refcnt=%d\n",
667 dest->vfwmark,
668 IP_VS_DBG_ADDR(svc->af, &dest->addr),
669 ntohs(dest->port),
670 atomic_read(&dest->refcnt));
671 if (dest->af == svc->af &&
672 ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
1da177e4
LT		 673 dest->port == dport &&
674 dest->vfwmark == svc->fwmark &&
675 dest->protocol == svc->protocol &&
676 (svc->fwmark ||
7937df15 677 (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
1da177e4
LT		 678 dest->vport == svc->port))) {
679 /* HIT */
680 return dest;
681 }
682
683 /*
684 * Try to purge the destination from trash if not referenced
685 */
686 if (atomic_read(&dest->refcnt) == 1) {
7937df15
JV		 687 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
688 "from trash\n",
689 dest->vfwmark,
690 IP_VS_DBG_ADDR(svc->af, &dest->addr),
691 ntohs(dest->port));
1da177e4
LT		 692 list_del(&dest->n_list);
693 ip_vs_dst_reset(dest);
694 __ip_vs_unbind_svc(dest);
b17fc996 695 free_percpu(dest->stats.cpustats);
1da177e4
LT		 696 kfree(dest);
697 }
698 }
699
700 return NULL;
701}
702
703
704/*
705 * Clean up all the destinations in the trash
706 * Called by the ip_vs_control_cleanup()
707 *
708 * When the ip_vs_control_clearup is activated by ipvs module exit,
709 * the service tables must have been flushed and all the connections
710 * are expired, and the refcnt of each destination in the trash must
711 * be 1, so we simply release them here.
712 */
f2431e6e 713static void ip_vs_trash_cleanup(struct net *net)
1da177e4
LT		 714{
715 struct ip_vs_dest *dest, *nxt;
f2431e6e 716 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4 717
f2431e6e 718 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
1da177e4
LT		 719 list_del(&dest->n_list);
720 ip_vs_dst_reset(dest);
721 __ip_vs_unbind_svc(dest);
b17fc996 722 free_percpu(dest->stats.cpustats);
1da177e4
LT		 723 kfree(dest);
724 }
725}
726
55a3d4e1
JA		 727static void
728ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
729{
730#define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
55a3d4e1
JA		 731
732 spin_lock_bh(&src->lock);
733
734 IP_VS_SHOW_STATS_COUNTER(conns);
735 IP_VS_SHOW_STATS_COUNTER(inpkts);
736 IP_VS_SHOW_STATS_COUNTER(outpkts);
737 IP_VS_SHOW_STATS_COUNTER(inbytes);
738 IP_VS_SHOW_STATS_COUNTER(outbytes);
739
ea9f22cc 740 ip_vs_read_estimator(dst, src);
55a3d4e1
JA		 741
742 spin_unlock_bh(&src->lock);
743}
1da177e4
LT		 744
745static void
746ip_vs_zero_stats(struct ip_vs_stats *stats)
747{
748 spin_lock_bh(&stats->lock);
e93615d0 749
55a3d4e1
JA		 750 /* get current counters as zero point, rates are zeroed */
751
752#define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
55a3d4e1
JA		 753
754 IP_VS_ZERO_STATS_COUNTER(conns);
755 IP_VS_ZERO_STATS_COUNTER(inpkts);
756 IP_VS_ZERO_STATS_COUNTER(outpkts);
757 IP_VS_ZERO_STATS_COUNTER(inbytes);
758 IP_VS_ZERO_STATS_COUNTER(outbytes);
759
1da177e4 760 ip_vs_zero_estimator(stats);
e93615d0 761
3a14a313 762 spin_unlock_bh(&stats->lock);
1da177e4
LT		 763}
764
765/*
766 * Update a destination in the given service
767 */
768static void
26c15cfd
JA		 769__ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
770 struct ip_vs_dest_user_kern *udest, int add)
1da177e4 771{
fc723250 772 struct netns_ipvs *ipvs = net_ipvs(svc->net);
1da177e4
LT		 773 int conn_flags;
774
775 /* set the weight and the flags */
776 atomic_set(&dest->weight, udest->weight);
3575792e
JA		 777 conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
778 conn_flags |= IP_VS_CONN_F_INACTIVE;
1da177e4 779
1da177e4 780 /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
3575792e 781 if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
1da177e4
LT		 782 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
783 } else {
784 /*
fc723250 785 * Put the real service in rs_table if not present.
1da177e4
LT		 786 * For now only for NAT!
787 */
a0840e2e 788 write_lock_bh(&ipvs->rs_lock);
fc723250 789 ip_vs_rs_hash(ipvs, dest);
a0840e2e 790 write_unlock_bh(&ipvs->rs_lock);
1da177e4
LT		 791 }
792 atomic_set(&dest->conn_flags, conn_flags);
793
794 /* bind the service */
795 if (!dest->svc) {
796 __ip_vs_bind_svc(dest, svc);
797 } else {
798 if (dest->svc != svc) {
799 __ip_vs_unbind_svc(dest);
800 ip_vs_zero_stats(&dest->stats);
801 __ip_vs_bind_svc(dest, svc);
802 }
803 }
804
805 /* set the dest status flags */
806 dest->flags |= IP_VS_DEST_F_AVAILABLE;
807
808 if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
809 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
810 dest->u_threshold = udest->u_threshold;
811 dest->l_threshold = udest->l_threshold;
26c15cfd 812
ff75f40f 813 spin_lock_bh(&dest->dst_lock);
fc604767 814 ip_vs_dst_reset(dest);
ff75f40f 815 spin_unlock_bh(&dest->dst_lock);
fc604767 816
26c15cfd 817 if (add)
6ef757f9 818 ip_vs_start_estimator(svc->net, &dest->stats);
26c15cfd
JA		 819
820 write_lock_bh(&__ip_vs_svc_lock);
821
822 /* Wait until all other svc users go away */
823 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
824
825 if (add) {
826 list_add(&dest->n_list, &svc->destinations);
827 svc->num_dests++;
828 }
829
830 /* call the update_service, because server weight may be changed */
831 if (svc->scheduler->update_service)
832 svc->scheduler->update_service(svc);
833
834 write_unlock_bh(&__ip_vs_svc_lock);
1da177e4
LT		 835}
836
837
838/*
839 * Create a destination for the given service
840 */
841static int
c860c6b1 842ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
1da177e4
LT		 843 struct ip_vs_dest **dest_p)
844{
845 struct ip_vs_dest *dest;
95c96174 846 unsigned int atype;
1da177e4
LT		 847
848 EnterFunction(2);
849
09571c7a
VB		 850#ifdef CONFIG_IP_VS_IPV6
851 if (svc->af == AF_INET6) {
852 atype = ipv6_addr_type(&udest->addr.in6);
3bfb92f4
SW		 853 if ((!(atype & IPV6_ADDR_UNICAST) ||
854 atype & IPV6_ADDR_LINKLOCAL) &&
4a98480b 855 !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
09571c7a
VB		 856 return -EINVAL;
857 } else
858#endif
859 {
4a98480b 860 atype = inet_addr_type(svc->net, udest->addr.ip);
09571c7a
VB		 861 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
862 return -EINVAL;
863 }
1da177e4 864
dee06e47 865 dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
0a9ee813 866 if (dest == NULL)
1da177e4 867 return -ENOMEM;
0a9ee813 868
b17fc996 869 dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
0a9ee813 870 if (!dest->stats.cpustats)
b17fc996 871 goto err_alloc;
1da177e4 872
c860c6b1 873 dest->af = svc->af;
1da177e4 874 dest->protocol = svc->protocol;
c860c6b1 875 dest->vaddr = svc->addr;
1da177e4
LT		 876 dest->vport = svc->port;
877 dest->vfwmark = svc->fwmark;
c860c6b1 878 ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
1da177e4
LT		 879 dest->port = udest->port;
880
881 atomic_set(&dest->activeconns, 0);
882 atomic_set(&dest->inactconns, 0);
883 atomic_set(&dest->persistconns, 0);
26c15cfd 884 atomic_set(&dest->refcnt, 1);
1da177e4
LT		 885
886 INIT_LIST_HEAD(&dest->d_list);
887 spin_lock_init(&dest->dst_lock);
888 spin_lock_init(&dest->stats.lock);
26c15cfd 889 __ip_vs_update_dest(svc, dest, udest, 1);
1da177e4
LT		 890
891 *dest_p = dest;
892
893 LeaveFunction(2);
894 return 0;
b17fc996
HS		 895
896err_alloc:
897 kfree(dest);
898 return -ENOMEM;
1da177e4
LT		 899}
900
901
902/*
903 * Add a destination into an existing service
904 */
905static int
c860c6b1 906ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 907{
908 struct ip_vs_dest *dest;
c860c6b1 909 union nf_inet_addr daddr;
014d730d 910 __be16 dport = udest->port;
1da177e4
LT		 911 int ret;
912
913 EnterFunction(2);
914
915 if (udest->weight < 0) {
1e3e238e 916 pr_err("%s(): server weight less than zero\n", __func__);
1da177e4
LT		 917 return -ERANGE;
918 }
919
920 if (udest->l_threshold > udest->u_threshold) {
1e3e238e
HE		 921 pr_err("%s(): lower threshold is higher than upper threshold\n",
922 __func__);
1da177e4
LT		 923 return -ERANGE;
924 }
925
c860c6b1
JV		 926 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
927
1da177e4
LT		 928 /*
929 * Check if the dest already exists in the list
930 */
7937df15
JV		 931 dest = ip_vs_lookup_dest(svc, &daddr, dport);
932
1da177e4 933 if (dest != NULL) {
1e3e238e 934 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
1da177e4
LT		 935 return -EEXIST;
936 }
937
938 /*
939 * Check if the dest already exists in the trash and
940 * is from the same service
941 */
7937df15
JV		 942 dest = ip_vs_trash_get_dest(svc, &daddr, dport);
943
1da177e4 944 if (dest != NULL) {
cfc78c5a
JV		 945 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
946 "dest->refcnt=%d, service %u/%s:%u\n",
947 IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
948 atomic_read(&dest->refcnt),
949 dest->vfwmark,
950 IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
951 ntohs(dest->vport));
952
1da177e4
LT		 953 /*
954 * Get the destination from the trash
955 */
956 list_del(&dest->n_list);
957
26c15cfd
JA		 958 __ip_vs_update_dest(svc, dest, udest, 1);
959 ret = 0;
960 } else {
1da177e4 961 /*
26c15cfd 962 * Allocate and initialize the dest structure
1da177e4 963 */
26c15cfd 964 ret = ip_vs_new_dest(svc, udest, &dest);
1da177e4 965 }
1da177e4
LT		 966 LeaveFunction(2);
967
26c15cfd 968 return ret;
1da177e4
LT		 969}
970
971
972/*
973 * Edit a destination in the given service
974 */
975static int
c860c6b1 976ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 977{
978 struct ip_vs_dest *dest;
c860c6b1 979 union nf_inet_addr daddr;
014d730d 980 __be16 dport = udest->port;
1da177e4
LT		 981
982 EnterFunction(2);
983
984 if (udest->weight < 0) {
1e3e238e 985 pr_err("%s(): server weight less than zero\n", __func__);
1da177e4
LT		 986 return -ERANGE;
987 }
988
989 if (udest->l_threshold > udest->u_threshold) {
1e3e238e
HE		 990 pr_err("%s(): lower threshold is higher than upper threshold\n",
991 __func__);
1da177e4
LT		 992 return -ERANGE;
993 }
994
c860c6b1
JV		 995 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
996
1da177e4
LT		 997 /*
998 * Lookup the destination list
999 */
7937df15
JV		 1000 dest = ip_vs_lookup_dest(svc, &daddr, dport);
1001
1da177e4 1002 if (dest == NULL) {
1e3e238e 1003 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1da177e4
LT		 1004 return -ENOENT;
1005 }
1006
26c15cfd 1007 __ip_vs_update_dest(svc, dest, udest, 0);
1da177e4
LT		 1008 LeaveFunction(2);
1009
1010 return 0;
1011}
1012
1013
1014/*
1015 * Delete a destination (must be already unlinked from the service)
1016 */
29c2026f 1017static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1da177e4 1018{
a0840e2e
HS		 1019 struct netns_ipvs *ipvs = net_ipvs(net);
1020
6ef757f9 1021 ip_vs_stop_estimator(net, &dest->stats);
1da177e4
LT		 1022
1023 /*
1024 * Remove it from the d-linked list with the real services.
1025 */
a0840e2e 1026 write_lock_bh(&ipvs->rs_lock);
1da177e4 1027 ip_vs_rs_unhash(dest);
a0840e2e 1028 write_unlock_bh(&ipvs->rs_lock);
1da177e4
LT		 1029
1030 /*
1031 * Decrease the refcnt of the dest, and free the dest
1032 * if nobody refers to it (refcnt=0). Otherwise, throw
1033 * the destination into the trash.
1034 */
1035 if (atomic_dec_and_test(&dest->refcnt)) {
26c15cfd
JA		 1036 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1037 dest->vfwmark,
1038 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1039 ntohs(dest->port));
1da177e4
LT		 1040 ip_vs_dst_reset(dest);
1041 /* simply decrease svc->refcnt here, let the caller check
1042 and release the service if nobody refers to it.
1043 Only user context can release destination and service,
1044 and only one user context can update virtual service at a
1045 time, so the operation here is OK */
1046 atomic_dec(&dest->svc->refcnt);
b17fc996 1047 free_percpu(dest->stats.cpustats);
1da177e4
LT		 1048 kfree(dest);
1049 } else {
cfc78c5a
JV		 1050 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1051 "dest->refcnt=%d\n",
1052 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1053 ntohs(dest->port),
1054 atomic_read(&dest->refcnt));
f2431e6e 1055 list_add(&dest->n_list, &ipvs->dest_trash);
1da177e4
LT		 1056 atomic_inc(&dest->refcnt);
1057 }
1058}
1059
1060
1061/*
1062 * Unlink a destination from the given service
1063 */
1064static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1065 struct ip_vs_dest *dest,
1066 int svcupd)
1067{
1068 dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1069
1070 /*
1071 * Remove it from the d-linked destination list.
1072 */
1073 list_del(&dest->n_list);
1074 svc->num_dests--;
82dfb6f3
SW		 1075
1076 /*
1077 * Call the update_service function of its scheduler
1078 */
1079 if (svcupd && svc->scheduler->update_service)
1080 svc->scheduler->update_service(svc);
1da177e4
LT		 1081}
1082
1083
1084/*
1085 * Delete a destination server in the given service
1086 */
1087static int
c860c6b1 1088ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 1089{
1090 struct ip_vs_dest *dest;
014d730d 1091 __be16 dport = udest->port;
1da177e4
LT		 1092
1093 EnterFunction(2);
1094
7937df15 1095 dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
c860c6b1 1096
1da177e4 1097 if (dest == NULL) {
1e3e238e 1098 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1da177e4
LT		 1099 return -ENOENT;
1100 }
1101
1102 write_lock_bh(&__ip_vs_svc_lock);
1103
1104 /*
1105 * Wait until all other svc users go away.
1106 */
26c15cfd 1107 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1108
1109 /*
1110 * Unlink dest from the service
1111 */
1112 __ip_vs_unlink_dest(svc, dest, 1);
1113
1114 write_unlock_bh(&__ip_vs_svc_lock);
1115
1116 /*
1117 * Delete the destination
1118 */
a0840e2e 1119 __ip_vs_del_dest(svc->net, dest);
1da177e4
LT		 1120
1121 LeaveFunction(2);
1122
1123 return 0;
1124}
1125
1126
1127/*
1128 * Add a service into the service hash table
1129 */
1130static int
fc723250 1131ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
c860c6b1 1132 struct ip_vs_service **svc_p)
1da177e4
LT		 1133{
1134 int ret = 0;
1135 struct ip_vs_scheduler *sched = NULL;
0d1e71b0 1136 struct ip_vs_pe *pe = NULL;
1da177e4 1137 struct ip_vs_service *svc = NULL;
a0840e2e 1138 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4
LT		 1139
1140 /* increase the module use count */
1141 ip_vs_use_count_inc();
1142
1143 /* Lookup the scheduler by 'u->sched_name' */
1144 sched = ip_vs_scheduler_get(u->sched_name);
1145 if (sched == NULL) {
1e3e238e 1146 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1da177e4 1147 ret = -ENOENT;
6e08bfb8 1148 goto out_err;
1da177e4
LT		 1149 }
1150
0d1e71b0 1151 if (u->pe_name && *u->pe_name) {
e9e5eee8 1152 pe = ip_vs_pe_getbyname(u->pe_name);
0d1e71b0
SH		 1153 if (pe == NULL) {
1154 pr_info("persistence engine module ip_vs_pe_%s "
1155 "not found\n", u->pe_name);
1156 ret = -ENOENT;
1157 goto out_err;
1158 }
1159 }
1160
f94fd041 1161#ifdef CONFIG_IP_VS_IPV6
48148938
JV		 1162 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1163 ret = -EINVAL;
1164 goto out_err;
f94fd041
JV		 1165 }
1166#endif
1167
dee06e47 1168 svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1da177e4 1169 if (svc == NULL) {
1e3e238e 1170 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1da177e4
LT		 1171 ret = -ENOMEM;
1172 goto out_err;
1173 }
b17fc996 1174 svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
0a54e939
JL		 1175 if (!svc->stats.cpustats) {
1176 ret = -ENOMEM;
b17fc996 1177 goto out_err;
0a54e939 1178 }
1da177e4
LT		 1179
1180 /* I'm the first user of the service */
26c15cfd 1181 atomic_set(&svc->usecnt, 0);
1da177e4
LT		 1182 atomic_set(&svc->refcnt, 0);
1183
c860c6b1 1184 svc->af = u->af;
1da177e4 1185 svc->protocol = u->protocol;
c860c6b1 1186 ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1da177e4
LT		 1187 svc->port = u->port;
1188 svc->fwmark = u->fwmark;
1189 svc->flags = u->flags;
1190 svc->timeout = u->timeout * HZ;
1191 svc->netmask = u->netmask;
fc723250 1192 svc->net = net;
1da177e4
LT		 1193
1194 INIT_LIST_HEAD(&svc->destinations);
1195 rwlock_init(&svc->sched_lock);
1196 spin_lock_init(&svc->stats.lock);
1197
1198 /* Bind the scheduler */
1199 ret = ip_vs_bind_scheduler(svc, sched);
1200 if (ret)
1201 goto out_err;
1202 sched = NULL;
1203
0d1e71b0
SH		 1204 /* Bind the ct retriever */
1205 ip_vs_bind_pe(svc, pe);
1206 pe = NULL;
1207
1da177e4
LT		 1208 /* Update the virtual service counters */
1209 if (svc->port == FTPPORT)
763f8d0e 1210 atomic_inc(&ipvs->ftpsvc_counter);
1da177e4 1211 else if (svc->port == 0)
763f8d0e 1212 atomic_inc(&ipvs->nullsvc_counter);
1da177e4 1213
6ef757f9 1214 ip_vs_start_estimator(net, &svc->stats);
f94fd041
JV		 1215
1216 /* Count only IPv4 services for old get/setsockopt interface */
1217 if (svc->af == AF_INET)
a0840e2e 1218 ipvs->num_services++;
1da177e4
LT		 1219
1220 /* Hash the service into the service table */
1221 write_lock_bh(&__ip_vs_svc_lock);
1222 ip_vs_svc_hash(svc);
1223 write_unlock_bh(&__ip_vs_svc_lock);
1224
1225 *svc_p = svc;
7a4f0761
HS		 1226 /* Now there is a service - full throttle */
1227 ipvs->enable = 1;
1da177e4
LT		 1228 return 0;
1229
b17fc996 1230
6e08bfb8 1231 out_err:
1da177e4 1232 if (svc != NULL) {
2fabf35b 1233 ip_vs_unbind_scheduler(svc);
1da177e4
LT		 1234 if (svc->inc) {
1235 local_bh_disable();
1236 ip_vs_app_inc_put(svc->inc);
1237 local_bh_enable();
1238 }
b17fc996
HS		 1239 if (svc->stats.cpustats)
1240 free_percpu(svc->stats.cpustats);
1da177e4
LT		 1241 kfree(svc);
1242 }
1243 ip_vs_scheduler_put(sched);
0d1e71b0 1244 ip_vs_pe_put(pe);
1da177e4 1245
1da177e4
LT		 1246 /* decrease the module use count */
1247 ip_vs_use_count_dec();
1248
1249 return ret;
1250}
1251
1252
1253/*
1254 * Edit a service and bind it with a new scheduler
1255 */
1256static int
c860c6b1 1257ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1da177e4
LT		 1258{
1259 struct ip_vs_scheduler *sched, *old_sched;
0d1e71b0 1260 struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1da177e4
LT		 1261 int ret = 0;
1262
1263 /*
1264 * Lookup the scheduler, by 'u->sched_name'
1265 */
1266 sched = ip_vs_scheduler_get(u->sched_name);
1267 if (sched == NULL) {
1e3e238e 1268 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1da177e4
LT		 1269 return -ENOENT;
1270 }
1271 old_sched = sched;
1272
0d1e71b0 1273 if (u->pe_name && *u->pe_name) {
e9e5eee8 1274 pe = ip_vs_pe_getbyname(u->pe_name);
0d1e71b0
SH		 1275 if (pe == NULL) {
1276 pr_info("persistence engine module ip_vs_pe_%s "
1277 "not found\n", u->pe_name);
1278 ret = -ENOENT;
1279 goto out;
1280 }
1281 old_pe = pe;
1282 }
1283
f94fd041 1284#ifdef CONFIG_IP_VS_IPV6
48148938
JV		 1285 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1286 ret = -EINVAL;
1287 goto out;
f94fd041
JV		 1288 }
1289#endif
1290
1da177e4
LT		 1291 write_lock_bh(&__ip_vs_svc_lock);
1292
1293 /*
1294 * Wait until all other svc users go away.
1295 */
26c15cfd 1296 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1297
1298 /*
1299 * Set the flags and timeout value
1300 */
1301 svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1302 svc->timeout = u->timeout * HZ;
1303 svc->netmask = u->netmask;
1304
1305 old_sched = svc->scheduler;
1306 if (sched != old_sched) {
1307 /*
1308 * Unbind the old scheduler
1309 */
1310 if ((ret = ip_vs_unbind_scheduler(svc))) {
1311 old_sched = sched;
9e691ed6 1312 goto out_unlock;
1da177e4
LT		 1313 }
1314
1315 /*
1316 * Bind the new scheduler
1317 */
1318 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1319 /*
1320 * If ip_vs_bind_scheduler fails, restore the old
1321 * scheduler.
1322 * The main reason of failure is out of memory.
1323 *
1324 * The question is if the old scheduler can be
1325 * restored all the time. TODO: if it cannot be
1326 * restored some time, we must delete the service,
1327 * otherwise the system may crash.
1328 */
1329 ip_vs_bind_scheduler(svc, old_sched);
1330 old_sched = sched;
9e691ed6 1331 goto out_unlock;
1da177e4
LT		 1332 }
1333 }
1334
0d1e71b0
SH		 1335 old_pe = svc->pe;
1336 if (pe != old_pe) {
1337 ip_vs_unbind_pe(svc);
1338 ip_vs_bind_pe(svc, pe);
1339 }
1340
552ad65a 1341out_unlock:
1da177e4 1342 write_unlock_bh(&__ip_vs_svc_lock);
552ad65a 1343out:
6e08bfb8 1344 ip_vs_scheduler_put(old_sched);
0d1e71b0 1345 ip_vs_pe_put(old_pe);
1da177e4
LT		 1346 return ret;
1347}
1348
1349
1350/*
1351 * Delete a service from the service list
1352 * - The service must be unlinked, unlocked and not referenced!
1353 * - We are called under _bh lock
1354 */
1355static void __ip_vs_del_service(struct ip_vs_service *svc)
1356{
1357 struct ip_vs_dest *dest, *nxt;
1358 struct ip_vs_scheduler *old_sched;
0d1e71b0 1359 struct ip_vs_pe *old_pe;
a0840e2e 1360 struct netns_ipvs *ipvs = net_ipvs(svc->net);
0d1e71b0
SH		 1361
1362 pr_info("%s: enter\n", __func__);
1da177e4 1363
f94fd041
JV		 1364 /* Count only IPv4 services for old get/setsockopt interface */
1365 if (svc->af == AF_INET)
a0840e2e 1366 ipvs->num_services--;
f94fd041 1367
6ef757f9 1368 ip_vs_stop_estimator(svc->net, &svc->stats);
1da177e4
LT		 1369
1370 /* Unbind scheduler */
1371 old_sched = svc->scheduler;
1372 ip_vs_unbind_scheduler(svc);
6e08bfb8 1373 ip_vs_scheduler_put(old_sched);
1da177e4 1374
0d1e71b0
SH		 1375 /* Unbind persistence engine */
1376 old_pe = svc->pe;
1377 ip_vs_unbind_pe(svc);
1378 ip_vs_pe_put(old_pe);
1379
1da177e4
LT		 1380 /* Unbind app inc */
1381 if (svc->inc) {
1382 ip_vs_app_inc_put(svc->inc);
1383 svc->inc = NULL;
1384 }
1385
1386 /*
1387 * Unlink the whole destination list
1388 */
1389 list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1390 __ip_vs_unlink_dest(svc, dest, 0);
29c2026f 1391 __ip_vs_del_dest(svc->net, dest);
1da177e4
LT		 1392 }
1393
1394 /*
1395 * Update the virtual service counters
1396 */
1397 if (svc->port == FTPPORT)
763f8d0e 1398 atomic_dec(&ipvs->ftpsvc_counter);
1da177e4 1399 else if (svc->port == 0)
763f8d0e 1400 atomic_dec(&ipvs->nullsvc_counter);
1da177e4
LT		 1401
1402 /*
1403 * Free the service if nobody refers to it
1404 */
26c15cfd
JA		 1405 if (atomic_read(&svc->refcnt) == 0) {
1406 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1407 svc->fwmark,
1408 IP_VS_DBG_ADDR(svc->af, &svc->addr),
1409 ntohs(svc->port), atomic_read(&svc->usecnt));
b17fc996 1410 free_percpu(svc->stats.cpustats);
1da177e4 1411 kfree(svc);
26c15cfd 1412 }
1da177e4
LT		 1413
1414 /* decrease the module use count */
1415 ip_vs_use_count_dec();
1416}
1417
1418/*
26c15cfd 1419 * Unlink a service from list and try to delete it if its refcnt reached 0
1da177e4 1420 */
26c15cfd 1421static void ip_vs_unlink_service(struct ip_vs_service *svc)
1da177e4 1422{
1da177e4
LT		 1423 /*
1424 * Unhash it from the service table
1425 */
1426 write_lock_bh(&__ip_vs_svc_lock);
1427
1428 ip_vs_svc_unhash(svc);
1429
1430 /*
1431 * Wait until all the svc users go away.
1432 */
26c15cfd 1433 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1434
1435 __ip_vs_del_service(svc);
1436
1437 write_unlock_bh(&__ip_vs_svc_lock);
26c15cfd
JA		 1438}
1439
1440/*
1441 * Delete a service from the service list
1442 */
1443static int ip_vs_del_service(struct ip_vs_service *svc)
1444{
1445 if (svc == NULL)
1446 return -EEXIST;
1447 ip_vs_unlink_service(svc);
1da177e4
LT		 1448
1449 return 0;
1450}
1451
1452
1453/*
1454 * Flush all the virtual services
1455 */
fc723250 1456static int ip_vs_flush(struct net *net)
1da177e4
LT		 1457{
1458 int idx;
1459 struct ip_vs_service *svc, *nxt;
1460
1461 /*
fc723250 1462 * Flush the service table hashed by <netns,protocol,addr,port>
1da177e4
LT		 1463 */
1464 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
fc723250
HS		 1465 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1466 s_list) {
1467 if (net_eq(svc->net, net))
1468 ip_vs_unlink_service(svc);
1da177e4
LT		 1469 }
1470 }
1471
1472 /*
1473 * Flush the service table hashed by fwmark
1474 */
1475 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1476 list_for_each_entry_safe(svc, nxt,
1477 &ip_vs_svc_fwm_table[idx], f_list) {
fc723250
HS		 1478 if (net_eq(svc->net, net))
1479 ip_vs_unlink_service(svc);
1da177e4
LT		 1480 }
1481 }
1482
1483 return 0;
1484}
1485
7a4f0761
HS		 1486/*
1487 * Delete service by {netns} in the service table.
1488 * Called by __ip_vs_cleanup()
1489 */
503cf15a 1490void ip_vs_service_net_cleanup(struct net *net)
7a4f0761
HS		 1491{
1492 EnterFunction(2);
1493 /* Check for "full" addressed entries */
1494 mutex_lock(&__ip_vs_mutex);
1495 ip_vs_flush(net);
1496 mutex_unlock(&__ip_vs_mutex);
1497 LeaveFunction(2);
1498}
1499/*
1500 * Release dst hold by dst_cache
1501 */
1502static inline void
1503__ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1504{
1505 spin_lock_bh(&dest->dst_lock);
1506 if (dest->dst_cache && dest->dst_cache->dev == dev) {
1507 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1508 dev->name,
1509 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1510 ntohs(dest->port),
1511 atomic_read(&dest->refcnt));
1512 ip_vs_dst_reset(dest);
1513 }
1514 spin_unlock_bh(&dest->dst_lock);
1515
1516}
1517/*
1518 * Netdev event receiver
1519 * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1520 * a device that is "unregister" it must be released.
1521 */
1522static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1523 void *ptr)
1524{
1525 struct net_device *dev = ptr;
1526 struct net *net = dev_net(dev);
283283c4 1527 struct netns_ipvs *ipvs = net_ipvs(net);
7a4f0761
HS		 1528 struct ip_vs_service *svc;
1529 struct ip_vs_dest *dest;
1530 unsigned int idx;
1531
283283c4 1532 if (event != NETDEV_UNREGISTER || !ipvs)
7a4f0761
HS		 1533 return NOTIFY_DONE;
1534 IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1535 EnterFunction(2);
1536 mutex_lock(&__ip_vs_mutex);
1537 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1538 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1539 if (net_eq(svc->net, net)) {
1540 list_for_each_entry(dest, &svc->destinations,
1541 n_list) {
1542 __ip_vs_dev_reset(dest, dev);
1543 }
1544 }
1545 }
1546
1547 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1548 if (net_eq(svc->net, net)) {
1549 list_for_each_entry(dest, &svc->destinations,
1550 n_list) {
1551 __ip_vs_dev_reset(dest, dev);
1552 }
1553 }
1554
1555 }
1556 }
1557
283283c4 1558 list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
7a4f0761
HS		 1559 __ip_vs_dev_reset(dest, dev);
1560 }
1561 mutex_unlock(&__ip_vs_mutex);
1562 LeaveFunction(2);
1563 return NOTIFY_DONE;
1564}
1da177e4
LT		 1565
1566/*
1567 * Zero counters in a service or all services
1568 */
1569static int ip_vs_zero_service(struct ip_vs_service *svc)
1570{
1571 struct ip_vs_dest *dest;
1572
1573 write_lock_bh(&__ip_vs_svc_lock);
1574 list_for_each_entry(dest, &svc->destinations, n_list) {
1575 ip_vs_zero_stats(&dest->stats);
1576 }
1577 ip_vs_zero_stats(&svc->stats);
1578 write_unlock_bh(&__ip_vs_svc_lock);
1579 return 0;
1580}
1581
fc723250 1582static int ip_vs_zero_all(struct net *net)
1da177e4
LT		 1583{
1584 int idx;
1585 struct ip_vs_service *svc;
1586
1587 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1588 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
fc723250
HS		 1589 if (net_eq(svc->net, net))
1590 ip_vs_zero_service(svc);
1da177e4
LT		 1591 }
1592 }
1593
1594 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1595 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
fc723250
HS		 1596 if (net_eq(svc->net, net))
1597 ip_vs_zero_service(svc);
1da177e4
LT		 1598 }
1599 }
1600
2a0751af 1601 ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1da177e4
LT		 1602 return 0;
1603}
1604
14e40546 1605#ifdef CONFIG_SYSCTL
749c42b6
JA		 1606
1607static int zero;
1608static int three = 3;
1609
1da177e4 1610static int
8d65af78 1611proc_do_defense_mode(ctl_table *table, int write,
1da177e4
LT		 1612 void __user *buffer, size_t *lenp, loff_t *ppos)
1613{
9330419d 1614 struct net *net = current->nsproxy->net_ns;
1da177e4
LT		 1615 int *valp = table->data;
1616 int val = *valp;
1617 int rc;
1618
8d65af78 1619 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1da177e4
LT		 1620 if (write && (*valp != val)) {
1621 if ((*valp < 0) || (*valp > 3)) {
1622 /* Restore the correct value */
1623 *valp = val;
1624 } else {
9330419d 1625 update_defense_level(net_ipvs(net));
1da177e4
LT		 1626 }
1627 }
1628 return rc;
1629}
1630
1da177e4 1631static int
8d65af78 1632proc_do_sync_threshold(ctl_table *table, int write,
1da177e4
LT		 1633 void __user *buffer, size_t *lenp, loff_t *ppos)
1634{
1635 int *valp = table->data;
1636 int val[2];
1637 int rc;
1638
1639 /* backup the value first */
1640 memcpy(val, valp, sizeof(val));
1641
8d65af78 1642 rc = proc_dointvec(table, write, buffer, lenp, ppos);
749c42b6
JA		 1643 if (write && (valp[0] < 0 || valp[1] < 0 ||
1644 (valp[0] >= valp[1] && valp[1]))) {
1da177e4
LT		 1645 /* Restore the correct value */
1646 memcpy(valp, val, sizeof(val));
1647 }
1648 return rc;
1649}
1650
b880c1f0
HS		 1651static int
1652proc_do_sync_mode(ctl_table *table, int write,
1653 void __user *buffer, size_t *lenp, loff_t *ppos)
1654{
1655 int *valp = table->data;
1656 int val = *valp;
1657 int rc;
1658
1659 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1660 if (write && (*valp != val)) {
1661 if ((*valp < 0) || (*valp > 1)) {
1662 /* Restore the correct value */
1663 *valp = val;
f73181c8
PNA		 1664 }
1665 }
1666 return rc;
1667}
1668
1669static int
1670proc_do_sync_ports(ctl_table *table, int write,
1671 void __user *buffer, size_t *lenp, loff_t *ppos)
1672{
1673 int *valp = table->data;
1674 int val = *valp;
1675 int rc;
1676
1677 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1678 if (write && (*valp != val)) {
1679 if (*valp < 1 || !is_power_of_2(*valp)) {
1680 /* Restore the correct value */
1681 *valp = val;
b880c1f0
HS		 1682 }
1683 }
1684 return rc;
1685}
1da177e4
LT		 1686
1687/*
1688 * IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
a0840e2e 1689 * Do not change order or insert new entries without
503cf15a 1690 * align with netns init in ip_vs_control_net_init()
1da177e4
LT		 1691 */
1692
1693static struct ctl_table vs_vars[] = {
1694 {
1da177e4 1695 .procname = "amemthresh",
1da177e4
LT		 1696 .maxlen = sizeof(int),
1697 .mode = 0644,
6d9f239a 1698 .proc_handler = proc_dointvec,
1da177e4 1699 },
1da177e4 1700 {
1da177e4 1701 .procname = "am_droprate",
1da177e4
LT		 1702 .maxlen = sizeof(int),
1703 .mode = 0644,
6d9f239a 1704 .proc_handler = proc_dointvec,
1da177e4
LT		 1705 },
1706 {
1da177e4 1707 .procname = "drop_entry",
1da177e4
LT		 1708 .maxlen = sizeof(int),
1709 .mode = 0644,
6d9f239a 1710 .proc_handler = proc_do_defense_mode,
1da177e4
LT		 1711 },
1712 {
1da177e4 1713 .procname = "drop_packet",
1da177e4
LT		 1714 .maxlen = sizeof(int),
1715 .mode = 0644,
6d9f239a 1716 .proc_handler = proc_do_defense_mode,
1da177e4 1717 },
f4bc17cd
JA		 1718#ifdef CONFIG_IP_VS_NFCT
1719 {
1720 .procname = "conntrack",
f4bc17cd
JA		 1721 .maxlen = sizeof(int),
1722 .mode = 0644,
1723 .proc_handler = &proc_dointvec,
1724 },
1725#endif
1da177e4 1726 {
1da177e4 1727 .procname = "secure_tcp",
1da177e4
LT		 1728 .maxlen = sizeof(int),
1729 .mode = 0644,
6d9f239a 1730 .proc_handler = proc_do_defense_mode,
1da177e4 1731 },
8a803040
JA		 1732 {
1733 .procname = "snat_reroute",
8a803040
JA		 1734 .maxlen = sizeof(int),
1735 .mode = 0644,
1736 .proc_handler = &proc_dointvec,
1737 },
b880c1f0
HS		 1738 {
1739 .procname = "sync_version",
b880c1f0
HS		 1740 .maxlen = sizeof(int),
1741 .mode = 0644,
1742 .proc_handler = &proc_do_sync_mode,
1743 },
f73181c8
PNA		 1744 {
1745 .procname = "sync_ports",
1746 .maxlen = sizeof(int),
1747 .mode = 0644,
1748 .proc_handler = &proc_do_sync_ports,
1749 },
1c003b15
PNA		 1750 {
1751 .procname = "sync_qlen_max",
1752 .maxlen = sizeof(int),
1753 .mode = 0644,
1754 .proc_handler = proc_dointvec,
1755 },
1756 {
1757 .procname = "sync_sock_size",
1758 .maxlen = sizeof(int),
1759 .mode = 0644,
1760 .proc_handler = proc_dointvec,
1761 },
a0840e2e
HS		 1762 {
1763 .procname = "cache_bypass",
1764 .maxlen = sizeof(int),
1765 .mode = 0644,
1766 .proc_handler = proc_dointvec,
1767 },
1768 {
1769 .procname = "expire_nodest_conn",
1770 .maxlen = sizeof(int),
1771 .mode = 0644,
1772 .proc_handler = proc_dointvec,
1773 },
1774 {
1775 .procname = "expire_quiescent_template",
1776 .maxlen = sizeof(int),
1777 .mode = 0644,
1778 .proc_handler = proc_dointvec,
1779 },
1780 {
1781 .procname = "sync_threshold",
1782 .maxlen =
1783 sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1784 .mode = 0644,
1785 .proc_handler = proc_do_sync_threshold,
1786 },
749c42b6
JA		 1787 {
1788 .procname = "sync_refresh_period",
1789 .maxlen = sizeof(int),
1790 .mode = 0644,
1791 .proc_handler = proc_dointvec_jiffies,
1792 },
1793 {
1794 .procname = "sync_retries",
1795 .maxlen = sizeof(int),
1796 .mode = 0644,
1797 .proc_handler = proc_dointvec_minmax,
1798 .extra1 = &zero,
1799 .extra2 = &three,
1800 },
a0840e2e
HS		 1801 {
1802 .procname = "nat_icmp_send",
1803 .maxlen = sizeof(int),
1804 .mode = 0644,
1805 .proc_handler = proc_dointvec,
1806 },
3654e611
JA		 1807 {
1808 .procname = "pmtu_disc",
1809 .maxlen = sizeof(int),
1810 .mode = 0644,
1811 .proc_handler = proc_dointvec,
1812 },
0c12582f
JA		 1813 {
1814 .procname = "backup_only",
1815 .maxlen = sizeof(int),
1816 .mode = 0644,
1817 .proc_handler = proc_dointvec,
1818 },
a0840e2e
HS		 1819#ifdef CONFIG_IP_VS_DEBUG
1820 {
1821 .procname = "debug_level",
1822 .data = &sysctl_ip_vs_debug_level,
1823 .maxlen = sizeof(int),
1824 .mode = 0644,
1825 .proc_handler = proc_dointvec,
1826 },
1827#endif
1da177e4
LT		 1828#if 0
1829 {
1da177e4
LT		 1830 .procname = "timeout_established",
1831 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1832 .maxlen = sizeof(int),
1833 .mode = 0644,
6d9f239a 1834 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1835 },
1836 {
1da177e4
LT		 1837 .procname = "timeout_synsent",
1838 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1839 .maxlen = sizeof(int),
1840 .mode = 0644,
6d9f239a 1841 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1842 },
1843 {
1da177e4
LT		 1844 .procname = "timeout_synrecv",
1845 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1846 .maxlen = sizeof(int),
1847 .mode = 0644,
6d9f239a 1848 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1849 },
1850 {
1da177e4
LT		 1851 .procname = "timeout_finwait",
1852 .data = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1853 .maxlen = sizeof(int),
1854 .mode = 0644,
6d9f239a 1855 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1856 },
1857 {
1da177e4
LT		 1858 .procname = "timeout_timewait",
1859 .data = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1860 .maxlen = sizeof(int),
1861 .mode = 0644,
6d9f239a 1862 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1863 },
1864 {
1da177e4
LT		 1865 .procname = "timeout_close",
1866 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1867 .maxlen = sizeof(int),
1868 .mode = 0644,
6d9f239a 1869 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1870 },
1871 {
1da177e4
LT		 1872 .procname = "timeout_closewait",
1873 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1874 .maxlen = sizeof(int),
1875 .mode = 0644,
6d9f239a 1876 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1877 },
1878 {
1da177e4
LT		 1879 .procname = "timeout_lastack",
1880 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1881 .maxlen = sizeof(int),
1882 .mode = 0644,
6d9f239a 1883 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1884 },
1885 {
1da177e4
LT		 1886 .procname = "timeout_listen",
1887 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1888 .maxlen = sizeof(int),
1889 .mode = 0644,
6d9f239a 1890 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1891 },
1892 {
1da177e4
LT		 1893 .procname = "timeout_synack",
1894 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1895 .maxlen = sizeof(int),
1896 .mode = 0644,
6d9f239a 1897 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1898 },
1899 {
1da177e4
LT		 1900 .procname = "timeout_udp",
1901 .data = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1902 .maxlen = sizeof(int),
1903 .mode = 0644,
6d9f239a 1904 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1905 },
1906 {
1da177e4
LT		 1907 .procname = "timeout_icmp",
1908 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1909 .maxlen = sizeof(int),
1910 .mode = 0644,
6d9f239a 1911 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1912 },
1913#endif
f8572d8f 1914 { }
1da177e4
LT		 1915};
1916
14e40546 1917#endif
1da177e4 1918
1da177e4
LT		 1919#ifdef CONFIG_PROC_FS
1920
1921struct ip_vs_iter {
fc723250 1922 struct seq_net_private p; /* Do not move this, netns depends upon it*/
1da177e4
LT		 1923 struct list_head *table;
1924 int bucket;
1925};
1926
1927/*
1928 * Write the contents of the VS rule table to a PROCfs file.
1929 * (It is kept just for backward compatibility)
1930 */
95c96174 1931static inline const char *ip_vs_fwd_name(unsigned int flags)
1da177e4
LT		 1932{
1933 switch (flags & IP_VS_CONN_F_FWD_MASK) {
1934 case IP_VS_CONN_F_LOCALNODE:
1935 return "Local";
1936 case IP_VS_CONN_F_TUNNEL:
1937 return "Tunnel";
1938 case IP_VS_CONN_F_DROUTE:
1939 return "Route";
1940 default:
1941 return "Masq";
1942 }
1943}
1944
1945
1946/* Get the Nth entry in the two lists */
1947static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1948{
fc723250 1949 struct net *net = seq_file_net(seq);
1da177e4
LT		 1950 struct ip_vs_iter *iter = seq->private;
1951 int idx;
1952 struct ip_vs_service *svc;
1953
1954 /* look in hash by protocol */
1955 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1956 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
fc723250 1957 if (net_eq(svc->net, net) && pos-- == 0) {
1da177e4
LT		 1958 iter->table = ip_vs_svc_table;
1959 iter->bucket = idx;
1960 return svc;
1961 }
1962 }
1963 }
1964
1965 /* keep looking in fwmark */
1966 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1967 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
fc723250 1968 if (net_eq(svc->net, net) && pos-- == 0) {
1da177e4
LT		 1969 iter->table = ip_vs_svc_fwm_table;
1970 iter->bucket = idx;
1971 return svc;
1972 }
1973 }
1974 }
1975
1976 return NULL;
1977}
1978
1979static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
563e94f0 1980__acquires(__ip_vs_svc_lock)
1da177e4
LT		 1981{
1982
1983 read_lock_bh(&__ip_vs_svc_lock);
1984 return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1985}
1986
1987
1988static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1989{
1990 struct list_head *e;
1991 struct ip_vs_iter *iter;
1992 struct ip_vs_service *svc;
1993
1994 ++*pos;
1995 if (v == SEQ_START_TOKEN)
1996 return ip_vs_info_array(seq,0);
1997
1998 svc = v;
1999 iter = seq->private;
2000
2001 if (iter->table == ip_vs_svc_table) {
2002 /* next service in table hashed by protocol */
2003 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
2004 return list_entry(e, struct ip_vs_service, s_list);
2005
2006
2007 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2008 list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
2009 s_list) {
2010 return svc;
2011 }
2012 }
2013
2014 iter->table = ip_vs_svc_fwm_table;
2015 iter->bucket = -1;
2016 goto scan_fwmark;
2017 }
2018
2019 /* next service in hashed by fwmark */
2020 if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
2021 return list_entry(e, struct ip_vs_service, f_list);
2022
2023 scan_fwmark:
2024 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2025 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
2026 f_list)
2027 return svc;
2028 }
2029
2030 return NULL;
2031}
2032
2033static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
563e94f0 2034__releases(__ip_vs_svc_lock)
1da177e4
LT		 2035{
2036 read_unlock_bh(&__ip_vs_svc_lock);
2037}
2038
2039
2040static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
2041{
2042 if (v == SEQ_START_TOKEN) {
2043 seq_printf(seq,
2044 "IP Virtual Server version %d.%d.%d (size=%d)\n",
6f7edb48 2045 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1da177e4
LT		 2046 seq_puts(seq,
2047 "Prot LocalAddress:Port Scheduler Flags\n");
2048 seq_puts(seq,
2049 " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
2050 } else {
2051 const struct ip_vs_service *svc = v;
2052 const struct ip_vs_iter *iter = seq->private;
2053 const struct ip_vs_dest *dest;
2054
667a5f18
VB		 2055 if (iter->table == ip_vs_svc_table) {
2056#ifdef CONFIG_IP_VS_IPV6
2057 if (svc->af == AF_INET6)
5b095d98 2058 seq_printf(seq, "%s [%pI6]:%04X %s ",
667a5f18 2059 ip_vs_proto_name(svc->protocol),
38ff4fa4 2060 &svc->addr.in6,
667a5f18
VB		 2061 ntohs(svc->port),
2062 svc->scheduler->name);
2063 else
2064#endif
26ec037f 2065 seq_printf(seq, "%s %08X:%04X %s %s ",
667a5f18
VB		 2066 ip_vs_proto_name(svc->protocol),
2067 ntohl(svc->addr.ip),
2068 ntohs(svc->port),
26ec037f
NC		 2069 svc->scheduler->name,
2070 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
667a5f18 2071 } else {
26ec037f
NC		 2072 seq_printf(seq, "FWM %08X %s %s",
2073 svc->fwmark, svc->scheduler->name,
2074 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
667a5f18 2075 }
1da177e4
LT		 2076
2077 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2078 seq_printf(seq, "persistent %d %08X\n",
2079 svc->timeout,
2080 ntohl(svc->netmask));
2081 else
2082 seq_putc(seq, '\n');
2083
2084 list_for_each_entry(dest, &svc->destinations, n_list) {
667a5f18
VB		 2085#ifdef CONFIG_IP_VS_IPV6
2086 if (dest->af == AF_INET6)
2087 seq_printf(seq,
5b095d98 2088 " -> [%pI6]:%04X"
667a5f18 2089 " %-7s %-6d %-10d %-10d\n",
38ff4fa4 2090 &dest->addr.in6,
667a5f18
VB		 2091 ntohs(dest->port),
2092 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2093 atomic_read(&dest->weight),
2094 atomic_read(&dest->activeconns),
2095 atomic_read(&dest->inactconns));
2096 else
2097#endif
2098 seq_printf(seq,
2099 " -> %08X:%04X "
2100 "%-7s %-6d %-10d %-10d\n",
2101 ntohl(dest->addr.ip),
2102 ntohs(dest->port),
2103 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2104 atomic_read(&dest->weight),
2105 atomic_read(&dest->activeconns),
2106 atomic_read(&dest->inactconns));
2107
1da177e4
LT		 2108 }
2109 }
2110 return 0;
2111}
2112
56b3d975 2113static const struct seq_operations ip_vs_info_seq_ops = {
1da177e4
LT		 2114 .start = ip_vs_info_seq_start,
2115 .next = ip_vs_info_seq_next,
2116 .stop = ip_vs_info_seq_stop,
2117 .show = ip_vs_info_seq_show,
2118};
2119
2120static int ip_vs_info_open(struct inode *inode, struct file *file)
2121{
fc723250 2122 return seq_open_net(inode, file, &ip_vs_info_seq_ops,
cf7732e4 2123 sizeof(struct ip_vs_iter));
1da177e4
LT		 2124}
2125
9a32144e 2126static const struct file_operations ip_vs_info_fops = {
1da177e4
LT		 2127 .owner = THIS_MODULE,
2128 .open = ip_vs_info_open,
2129 .read = seq_read,
2130 .llseek = seq_lseek,
0f08190f 2131 .release = seq_release_net,
1da177e4
LT		 2132};
2133
1da177e4
LT		 2134static int ip_vs_stats_show(struct seq_file *seq, void *v)
2135{
b17fc996 2136 struct net *net = seq_file_single_net(seq);
55a3d4e1 2137 struct ip_vs_stats_user show;
1da177e4
LT		 2138
2139/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2140 seq_puts(seq,
2141 " Total Incoming Outgoing Incoming Outgoing\n");
2142 seq_printf(seq,
2143 " Conns Packets Packets Bytes Bytes\n");
2144
55a3d4e1
JA		 2145 ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2146 seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2147 show.inpkts, show.outpkts,
2148 (unsigned long long) show.inbytes,
2149 (unsigned long long) show.outbytes);
1da177e4
LT		 2150
2151/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2152 seq_puts(seq,
2153 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
55a3d4e1
JA		 2154 seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2155 show.cps, show.inpps, show.outpps,
2156 show.inbps, show.outbps);
1da177e4
LT		 2157
2158 return 0;
2159}
2160
2161static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2162{
fc723250 2163 return single_open_net(inode, file, ip_vs_stats_show);
1da177e4
LT		 2164}
2165
9a32144e 2166static const struct file_operations ip_vs_stats_fops = {
1da177e4
LT		 2167 .owner = THIS_MODULE,
2168 .open = ip_vs_stats_seq_open,
2169 .read = seq_read,
2170 .llseek = seq_lseek,
0f08190f 2171 .release = single_release_net,
1da177e4
LT		 2172};
2173
b17fc996
HS		 2174static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2175{
2176 struct net *net = seq_file_single_net(seq);
2a0751af
JA		 2177 struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2178 struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
ea9f22cc 2179 struct ip_vs_stats_user rates;
b17fc996
HS		 2180 int i;
2181
2182/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2183 seq_puts(seq,
2184 " Total Incoming Outgoing Incoming Outgoing\n");
2185 seq_printf(seq,
2186 "CPU Conns Packets Packets Bytes Bytes\n");
2187
2188 for_each_possible_cpu(i) {
2a0751af
JA		 2189 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2190 unsigned int start;
2191 __u64 inbytes, outbytes;
2192
2193 do {
2194 start = u64_stats_fetch_begin_bh(&u->syncp);
2195 inbytes = u->ustats.inbytes;
2196 outbytes = u->ustats.outbytes;
2197 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2198
b17fc996 2199 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2a0751af
JA		 2200 i, u->ustats.conns, u->ustats.inpkts,
2201 u->ustats.outpkts, (__u64)inbytes,
2202 (__u64)outbytes);
b17fc996
HS		 2203 }
2204
2205 spin_lock_bh(&tot_stats->lock);
ea9f22cc 2206
b17fc996
HS		 2207 seq_printf(seq, " ~ %8X %8X %8X %16LX %16LX\n\n",
2208 tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2209 tot_stats->ustats.outpkts,
2210 (unsigned long long) tot_stats->ustats.inbytes,
2211 (unsigned long long) tot_stats->ustats.outbytes);
2212
ea9f22cc
JA		 2213 ip_vs_read_estimator(&rates, tot_stats);
2214
2215 spin_unlock_bh(&tot_stats->lock);
2216
b17fc996
HS		 2217/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2218 seq_puts(seq,
2219 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
2220 seq_printf(seq, " %8X %8X %8X %16X %16X\n",
ea9f22cc
JA		 2221 rates.cps,
2222 rates.inpps,
2223 rates.outpps,
2224 rates.inbps,
2225 rates.outbps);
b17fc996
HS		 2226
2227 return 0;
2228}
2229
2230static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2231{
2232 return single_open_net(inode, file, ip_vs_stats_percpu_show);
2233}
2234
2235static const struct file_operations ip_vs_stats_percpu_fops = {
2236 .owner = THIS_MODULE,
2237 .open = ip_vs_stats_percpu_seq_open,
2238 .read = seq_read,
2239 .llseek = seq_lseek,
0f08190f 2240 .release = single_release_net,
b17fc996 2241};
1da177e4
LT		 2242#endif
2243
2244/*
2245 * Set timeout values for tcp tcpfin udp in the timeout_table.
2246 */
9330419d 2247static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
1da177e4 2248{
091bb34c 2249#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
9330419d 2250 struct ip_vs_proto_data *pd;
091bb34c 2251#endif
9330419d 2252
1da177e4
LT		 2253 IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2254 u->tcp_timeout,
2255 u->tcp_fin_timeout,
2256 u->udp_timeout);
2257
2258#ifdef CONFIG_IP_VS_PROTO_TCP
2259 if (u->tcp_timeout) {
9330419d
HS		 2260 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2261 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
1da177e4
LT		 2262 = u->tcp_timeout * HZ;
2263 }
2264
2265 if (u->tcp_fin_timeout) {
9330419d
HS		 2266 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2267 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
1da177e4
LT		 2268 = u->tcp_fin_timeout * HZ;
2269 }
2270#endif
2271
2272#ifdef CONFIG_IP_VS_PROTO_UDP
2273 if (u->udp_timeout) {
9330419d
HS		 2274 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2275 pd->timeout_table[IP_VS_UDP_S_NORMAL]
1da177e4
LT		 2276 = u->udp_timeout * HZ;
2277 }
2278#endif
2279 return 0;
2280}
2281
2282
2283#define SET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2284#define SERVICE_ARG_LEN (sizeof(struct ip_vs_service_user))
2285#define SVCDEST_ARG_LEN (sizeof(struct ip_vs_service_user) + \
2286 sizeof(struct ip_vs_dest_user))
2287#define TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2288#define DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user))
2289#define MAX_ARG_LEN SVCDEST_ARG_LEN
2290
9b5b5cff 2291static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
1da177e4
LT		 2292 [SET_CMDID(IP_VS_SO_SET_ADD)] = SERVICE_ARG_LEN,
2293 [SET_CMDID(IP_VS_SO_SET_EDIT)] = SERVICE_ARG_LEN,
2294 [SET_CMDID(IP_VS_SO_SET_DEL)] = SERVICE_ARG_LEN,
2295 [SET_CMDID(IP_VS_SO_SET_FLUSH)] = 0,
2296 [SET_CMDID(IP_VS_SO_SET_ADDDEST)] = SVCDEST_ARG_LEN,
2297 [SET_CMDID(IP_VS_SO_SET_DELDEST)] = SVCDEST_ARG_LEN,
2298 [SET_CMDID(IP_VS_SO_SET_EDITDEST)] = SVCDEST_ARG_LEN,
2299 [SET_CMDID(IP_VS_SO_SET_TIMEOUT)] = TIMEOUT_ARG_LEN,
2300 [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)] = DAEMON_ARG_LEN,
2301 [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)] = DAEMON_ARG_LEN,
2302 [SET_CMDID(IP_VS_SO_SET_ZERO)] = SERVICE_ARG_LEN,
2303};
2304
c860c6b1
JV		 2305static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2306 struct ip_vs_service_user *usvc_compat)
2307{
0d1e71b0
SH		 2308 memset(usvc, 0, sizeof(*usvc));
2309
c860c6b1
JV		 2310 usvc->af = AF_INET;
2311 usvc->protocol = usvc_compat->protocol;
2312 usvc->addr.ip = usvc_compat->addr;
2313 usvc->port = usvc_compat->port;
2314 usvc->fwmark = usvc_compat->fwmark;
2315
2316 /* Deep copy of sched_name is not needed here */
2317 usvc->sched_name = usvc_compat->sched_name;
2318
2319 usvc->flags = usvc_compat->flags;
2320 usvc->timeout = usvc_compat->timeout;
2321 usvc->netmask = usvc_compat->netmask;
2322}
2323
2324static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2325 struct ip_vs_dest_user *udest_compat)
2326{
0d1e71b0
SH		 2327 memset(udest, 0, sizeof(*udest));
2328
c860c6b1
JV		 2329 udest->addr.ip = udest_compat->addr;
2330 udest->port = udest_compat->port;
2331 udest->conn_flags = udest_compat->conn_flags;
2332 udest->weight = udest_compat->weight;
2333 udest->u_threshold = udest_compat->u_threshold;
2334 udest->l_threshold = udest_compat->l_threshold;
2335}
2336
1da177e4
LT		 2337static int
2338do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2339{
fc723250 2340 struct net *net = sock_net(sk);
1da177e4
LT		 2341 int ret;
2342 unsigned char arg[MAX_ARG_LEN];
c860c6b1
JV		 2343 struct ip_vs_service_user *usvc_compat;
2344 struct ip_vs_service_user_kern usvc;
1da177e4 2345 struct ip_vs_service *svc;
c860c6b1
JV		 2346 struct ip_vs_dest_user *udest_compat;
2347 struct ip_vs_dest_user_kern udest;
ae1d48b2 2348 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4 2349
df008c91 2350 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1da177e4
LT		 2351 return -EPERM;
2352
04bcef2a
AV		 2353 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2354 return -EINVAL;
2355 if (len < 0 || len > MAX_ARG_LEN)
2356 return -EINVAL;
1da177e4 2357 if (len != set_arglen[SET_CMDID(cmd)]) {
1e3e238e
HE		 2358 pr_err("set_ctl: len %u != %u\n",
2359 len, set_arglen[SET_CMDID(cmd)]);
1da177e4
LT		 2360 return -EINVAL;
2361 }
2362
2363 if (copy_from_user(arg, user, len) != 0)
2364 return -EFAULT;
2365
2366 /* increase the module use count */
2367 ip_vs_use_count_inc();
2368
ae1d48b2
HS		 2369 /* Handle daemons since they have another lock */
2370 if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2371 cmd == IP_VS_SO_SET_STOPDAEMON) {
2372 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2373
2374 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2375 ret = -ERESTARTSYS;
2376 goto out_dec;
2377 }
2378 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2379 ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2380 dm->syncid);
2381 else
2382 ret = stop_sync_thread(net, dm->state);
2383 mutex_unlock(&ipvs->sync_mutex);
2384 goto out_dec;
2385 }
2386
14cc3e2b 2387 if (mutex_lock_interruptible(&__ip_vs_mutex)) {
1da177e4
LT		 2388 ret = -ERESTARTSYS;
2389 goto out_dec;
2390 }
2391
2392 if (cmd == IP_VS_SO_SET_FLUSH) {
2393 /* Flush the virtual service */
fc723250 2394 ret = ip_vs_flush(net);
1da177e4
LT		 2395 goto out_unlock;
2396 } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2397 /* Set timeout values for (tcp tcpfin udp) */
9330419d 2398 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
1da177e4 2399 goto out_unlock;
1da177e4
LT		 2400 }
2401
c860c6b1
JV		 2402 usvc_compat = (struct ip_vs_service_user *)arg;
2403 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2404
2405 /* We only use the new structs internally, so copy userspace compat
2406 * structs to extended internal versions */
2407 ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2408 ip_vs_copy_udest_compat(&udest, udest_compat);
1da177e4
LT		 2409
2410 if (cmd == IP_VS_SO_SET_ZERO) {
2411 /* if no service address is set, zero counters in all */
c860c6b1 2412 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
fc723250 2413 ret = ip_vs_zero_all(net);
1da177e4
LT		 2414 goto out_unlock;
2415 }
2416 }
2417
2906f66a
VMR		 2418 /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2419 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2420 usvc.protocol != IPPROTO_SCTP) {
1e3e238e
HE		 2421 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2422 usvc.protocol, &usvc.addr.ip,
2423 ntohs(usvc.port), usvc.sched_name);
1da177e4
LT		 2424 ret = -EFAULT;
2425 goto out_unlock;
2426 }
2427
2428 /* Lookup the exact service by <protocol, addr, port> or fwmark */
c860c6b1 2429 if (usvc.fwmark == 0)
fc723250 2430 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
26c15cfd 2431 &usvc.addr, usvc.port);
1da177e4 2432 else
fc723250 2433 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
1da177e4
LT		 2434
2435 if (cmd != IP_VS_SO_SET_ADD
c860c6b1 2436 && (svc == NULL || svc->protocol != usvc.protocol)) {
1da177e4 2437 ret = -ESRCH;
26c15cfd 2438 goto out_unlock;
1da177e4
LT		 2439 }
2440
2441 switch (cmd) {
2442 case IP_VS_SO_SET_ADD:
2443 if (svc != NULL)
2444 ret = -EEXIST;
2445 else
fc723250 2446 ret = ip_vs_add_service(net, &usvc, &svc);
1da177e4
LT		 2447 break;
2448 case IP_VS_SO_SET_EDIT:
c860c6b1 2449 ret = ip_vs_edit_service(svc, &usvc);
1da177e4
LT		 2450 break;
2451 case IP_VS_SO_SET_DEL:
2452 ret = ip_vs_del_service(svc);
2453 if (!ret)
2454 goto out_unlock;
2455 break;
2456 case IP_VS_SO_SET_ZERO:
2457 ret = ip_vs_zero_service(svc);
2458 break;
2459 case IP_VS_SO_SET_ADDDEST:
c860c6b1 2460 ret = ip_vs_add_dest(svc, &udest);
1da177e4
LT		 2461 break;
2462 case IP_VS_SO_SET_EDITDEST:
c860c6b1 2463 ret = ip_vs_edit_dest(svc, &udest);
1da177e4
LT		 2464 break;
2465 case IP_VS_SO_SET_DELDEST:
c860c6b1 2466 ret = ip_vs_del_dest(svc, &udest);
1da177e4
LT		 2467 break;
2468 default:
2469 ret = -EINVAL;
2470 }
2471
1da177e4 2472 out_unlock:
14cc3e2b 2473 mutex_unlock(&__ip_vs_mutex);
1da177e4
LT		 2474 out_dec:
2475 /* decrease the module use count */
2476 ip_vs_use_count_dec();
2477
2478 return ret;
2479}
2480
2481
1da177e4
LT		 2482static void
2483ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2484{
2485 dst->protocol = src->protocol;
e7ade46a 2486 dst->addr = src->addr.ip;
1da177e4
LT		 2487 dst->port = src->port;
2488 dst->fwmark = src->fwmark;
4da62fc7 2489 strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
1da177e4
LT		 2490 dst->flags = src->flags;
2491 dst->timeout = src->timeout / HZ;
2492 dst->netmask = src->netmask;
2493 dst->num_dests = src->num_dests;
2494 ip_vs_copy_stats(&dst->stats, &src->stats);
2495}
2496
2497static inline int
fc723250
HS		 2498__ip_vs_get_service_entries(struct net *net,
2499 const struct ip_vs_get_services *get,
1da177e4
LT		 2500 struct ip_vs_get_services __user *uptr)
2501{
2502 int idx, count=0;
2503 struct ip_vs_service *svc;
2504 struct ip_vs_service_entry entry;
2505 int ret = 0;
2506
2507 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2508 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
f94fd041 2509 /* Only expose IPv4 entries to old interface */
fc723250 2510 if (svc->af != AF_INET || !net_eq(svc->net, net))
f94fd041
JV		 2511 continue;
2512
1da177e4
LT		 2513 if (count >= get->num_services)
2514 goto out;
4da62fc7 2515 memset(&entry, 0, sizeof(entry));
1da177e4
LT		 2516 ip_vs_copy_service(&entry, svc);
2517 if (copy_to_user(&uptr->entrytable[count],
2518 &entry, sizeof(entry))) {
2519 ret = -EFAULT;
2520 goto out;
2521 }
2522 count++;
2523 }
2524 }
2525
2526 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2527 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
f94fd041 2528 /* Only expose IPv4 entries to old interface */
fc723250 2529 if (svc->af != AF_INET || !net_eq(svc->net, net))
f94fd041
JV		 2530 continue;
2531
1da177e4
LT		 2532 if (count >= get->num_services)
2533 goto out;
4da62fc7 2534 memset(&entry, 0, sizeof(entry));
1da177e4
LT		 2535 ip_vs_copy_service(&entry, svc);
2536 if (copy_to_user(&uptr->entrytable[count],
2537 &entry, sizeof(entry))) {
2538 ret = -EFAULT;
2539 goto out;
2540 }
2541 count++;
2542 }
2543 }
552ad65a 2544out:
1da177e4
LT		 2545 return ret;
2546}
2547
2548static inline int
fc723250 2549__ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
1da177e4
LT		 2550 struct ip_vs_get_dests __user *uptr)
2551{
2552 struct ip_vs_service *svc;
b18610de 2553 union nf_inet_addr addr = { .ip = get->addr };
1da177e4
LT		 2554 int ret = 0;
2555
2556 if (get->fwmark)
fc723250 2557 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
1da177e4 2558 else
fc723250 2559 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
26c15cfd 2560 get->port);
b18610de 2561
1da177e4
LT		 2562 if (svc) {
2563 int count = 0;
2564 struct ip_vs_dest *dest;
2565 struct ip_vs_dest_entry entry;
2566
2567 list_for_each_entry(dest, &svc->destinations, n_list) {
2568 if (count >= get->num_dests)
2569 break;
2570
e7ade46a 2571 entry.addr = dest->addr.ip;
1da177e4
LT		 2572 entry.port = dest->port;
2573 entry.conn_flags = atomic_read(&dest->conn_flags);
2574 entry.weight = atomic_read(&dest->weight);
2575 entry.u_threshold = dest->u_threshold;
2576 entry.l_threshold = dest->l_threshold;
2577 entry.activeconns = atomic_read(&dest->activeconns);
2578 entry.inactconns = atomic_read(&dest->inactconns);
2579 entry.persistconns = atomic_read(&dest->persistconns);
2580 ip_vs_copy_stats(&entry.stats, &dest->stats);
2581 if (copy_to_user(&uptr->entrytable[count],
2582 &entry, sizeof(entry))) {
2583 ret = -EFAULT;
2584 break;
2585 }
2586 count++;
2587 }
1da177e4
LT		 2588 } else
2589 ret = -ESRCH;
2590 return ret;
2591}
2592
2593static inline void
9330419d 2594__ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
1da177e4 2595{
091bb34c 2596#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
9330419d 2597 struct ip_vs_proto_data *pd;
091bb34c 2598#endif
9330419d 2599
b61a602e
AB		 2600 memset(u, 0, sizeof (*u));
2601
1da177e4 2602#ifdef CONFIG_IP_VS_PROTO_TCP
9330419d
HS		 2603 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2604 u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2605 u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
1da177e4
LT		 2606#endif
2607#ifdef CONFIG_IP_VS_PROTO_UDP
9330419d 2608 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
1da177e4 2609 u->udp_timeout =
9330419d 2610 pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
1da177e4
LT		 2611#endif
2612}
2613
2614
2615#define GET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2616#define GET_INFO_ARG_LEN (sizeof(struct ip_vs_getinfo))
2617#define GET_SERVICES_ARG_LEN (sizeof(struct ip_vs_get_services))
2618#define GET_SERVICE_ARG_LEN (sizeof(struct ip_vs_service_entry))
2619#define GET_DESTS_ARG_LEN (sizeof(struct ip_vs_get_dests))
2620#define GET_TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2621#define GET_DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user) * 2)
2622
9b5b5cff 2623static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
1da177e4
LT		 2624 [GET_CMDID(IP_VS_SO_GET_VERSION)] = 64,
2625 [GET_CMDID(IP_VS_SO_GET_INFO)] = GET_INFO_ARG_LEN,
2626 [GET_CMDID(IP_VS_SO_GET_SERVICES)] = GET_SERVICES_ARG_LEN,
2627 [GET_CMDID(IP_VS_SO_GET_SERVICE)] = GET_SERVICE_ARG_LEN,
2628 [GET_CMDID(IP_VS_SO_GET_DESTS)] = GET_DESTS_ARG_LEN,
2629 [GET_CMDID(IP_VS_SO_GET_TIMEOUT)] = GET_TIMEOUT_ARG_LEN,
2630 [GET_CMDID(IP_VS_SO_GET_DAEMON)] = GET_DAEMON_ARG_LEN,
2631};
2632
2633static int
2634do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2635{
2636 unsigned char arg[128];
2637 int ret = 0;
04bcef2a 2638 unsigned int copylen;
fc723250 2639 struct net *net = sock_net(sk);
f131315f 2640 struct netns_ipvs *ipvs = net_ipvs(net);
1da177e4 2641
fc723250 2642 BUG_ON(!net);
df008c91 2643 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1da177e4
LT		 2644 return -EPERM;
2645
04bcef2a
AV		 2646 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2647 return -EINVAL;
2648
1da177e4 2649 if (*len < get_arglen[GET_CMDID(cmd)]) {
1e3e238e
HE		 2650 pr_err("get_ctl: len %u < %u\n",
2651 *len, get_arglen[GET_CMDID(cmd)]);
1da177e4
LT		 2652 return -EINVAL;
2653 }
2654
04bcef2a
AV		 2655 copylen = get_arglen[GET_CMDID(cmd)];
2656 if (copylen > 128)
2657 return -EINVAL;
2658
2659 if (copy_from_user(arg, user, copylen) != 0)
1da177e4 2660 return -EFAULT;
ae1d48b2
HS		 2661 /*
2662 * Handle daemons first since it has its own locking
2663 */
2664 if (cmd == IP_VS_SO_GET_DAEMON) {
2665 struct ip_vs_daemon_user d[2];
2666
2667 memset(&d, 0, sizeof(d));
2668 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2669 return -ERESTARTSYS;
2670
2671 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2672 d[0].state = IP_VS_STATE_MASTER;
2673 strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2674 sizeof(d[0].mcast_ifn));
2675 d[0].syncid = ipvs->master_syncid;
2676 }
2677 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2678 d[1].state = IP_VS_STATE_BACKUP;
2679 strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2680 sizeof(d[1].mcast_ifn));
2681 d[1].syncid = ipvs->backup_syncid;
2682 }
2683 if (copy_to_user(user, &d, sizeof(d)) != 0)
2684 ret = -EFAULT;
2685 mutex_unlock(&ipvs->sync_mutex);
2686 return ret;
2687 }
1da177e4 2688
14cc3e2b 2689 if (mutex_lock_interruptible(&__ip_vs_mutex))
1da177e4
LT		 2690 return -ERESTARTSYS;
2691
2692 switch (cmd) {
2693 case IP_VS_SO_GET_VERSION:
2694 {
2695 char buf[64];
2696
2697 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
6f7edb48 2698 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1da177e4
LT		 2699 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2700 ret = -EFAULT;
2701 goto out;
2702 }
2703 *len = strlen(buf)+1;
2704 }
2705 break;
2706
2707 case IP_VS_SO_GET_INFO:
2708 {
2709 struct ip_vs_getinfo info;
2710 info.version = IP_VS_VERSION_CODE;
6f7edb48 2711 info.size = ip_vs_conn_tab_size;
a0840e2e 2712 info.num_services = ipvs->num_services;
1da177e4
LT		 2713 if (copy_to_user(user, &info, sizeof(info)) != 0)
2714 ret = -EFAULT;
2715 }
2716 break;
2717
2718 case IP_VS_SO_GET_SERVICES:
2719 {
2720 struct ip_vs_get_services *get;
2721 int size;
2722
2723 get = (struct ip_vs_get_services *)arg;
2724 size = sizeof(*get) +
2725 sizeof(struct ip_vs_service_entry) * get->num_services;
2726 if (*len != size) {
1e3e238e 2727 pr_err("length: %u != %u\n", *len, size);
1da177e4
LT		 2728 ret = -EINVAL;
2729 goto out;
2730 }
fc723250 2731 ret = __ip_vs_get_service_entries(net, get, user);
1da177e4
LT		 2732 }
2733 break;
2734
2735 case IP_VS_SO_GET_SERVICE:
2736 {
2737 struct ip_vs_service_entry *entry;
2738 struct ip_vs_service *svc;
b18610de 2739 union nf_inet_addr addr;
1da177e4
LT		 2740
2741 entry = (struct ip_vs_service_entry *)arg;
b18610de 2742 addr.ip = entry->addr;
1da177e4 2743 if (entry->fwmark)
fc723250 2744 svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
1da177e4 2745 else
fc723250
HS		 2746 svc = __ip_vs_service_find(net, AF_INET,
2747 entry->protocol, &addr,
2748 entry->port);
1da177e4
LT		 2749 if (svc) {
2750 ip_vs_copy_service(entry, svc);
2751 if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2752 ret = -EFAULT;
1da177e4
LT		 2753 } else
2754 ret = -ESRCH;
2755 }
2756 break;
2757
2758 case IP_VS_SO_GET_DESTS:
2759 {
2760 struct ip_vs_get_dests *get;
2761 int size;
2762
2763 get = (struct ip_vs_get_dests *)arg;
2764 size = sizeof(*get) +
2765 sizeof(struct ip_vs_dest_entry) * get->num_dests;
2766 if (*len != size) {
1e3e238e 2767 pr_err("length: %u != %u\n", *len, size);
1da177e4
LT		 2768 ret = -EINVAL;
2769 goto out;
2770 }
fc723250 2771 ret = __ip_vs_get_dest_entries(net, get, user);
1da177e4
LT		 2772 }
2773 break;
2774
2775 case IP_VS_SO_GET_TIMEOUT:
2776 {
2777 struct ip_vs_timeout_user t;
2778
9330419d 2779 __ip_vs_get_timeouts(net, &t);
1da177e4
LT		 2780 if (copy_to_user(user, &t, sizeof(t)) != 0)
2781 ret = -EFAULT;
2782 }
2783 break;
2784
1da177e4
LT		 2785 default:
2786 ret = -EINVAL;
2787 }
2788
552ad65a 2789out:
14cc3e2b 2790 mutex_unlock(&__ip_vs_mutex);
1da177e4
LT		 2791 return ret;
2792}
2793
2794
2795static struct nf_sockopt_ops ip_vs_sockopts = {
2796 .pf = PF_INET,
2797 .set_optmin = IP_VS_BASE_CTL,
2798 .set_optmax = IP_VS_SO_SET_MAX+1,
2799 .set = do_ip_vs_set_ctl,
2800 .get_optmin = IP_VS_BASE_CTL,
2801 .get_optmax = IP_VS_SO_GET_MAX+1,
2802 .get = do_ip_vs_get_ctl,
16fcec35 2803 .owner = THIS_MODULE,
1da177e4
LT		 2804};
2805
9a812198
JV		 2806/*
2807 * Generic Netlink interface
2808 */
2809
2810/* IPVS genetlink family */
2811static struct genl_family ip_vs_genl_family = {
2812 .id = GENL_ID_GENERATE,
2813 .hdrsize = 0,
2814 .name = IPVS_GENL_NAME,
2815 .version = IPVS_GENL_VERSION,
2816 .maxattr = IPVS_CMD_MAX,
c6d2d445 2817 .netnsok = true, /* Make ipvsadm to work on netns */
9a812198
JV		 2818};
2819
2820/* Policy used for first-level command attributes */
2821static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2822 [IPVS_CMD_ATTR_SERVICE] = { .type = NLA_NESTED },
2823 [IPVS_CMD_ATTR_DEST] = { .type = NLA_NESTED },
2824 [IPVS_CMD_ATTR_DAEMON] = { .type = NLA_NESTED },
2825 [IPVS_CMD_ATTR_TIMEOUT_TCP] = { .type = NLA_U32 },
2826 [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2827 [IPVS_CMD_ATTR_TIMEOUT_UDP] = { .type = NLA_U32 },
2828};
2829
2830/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2831static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2832 [IPVS_DAEMON_ATTR_STATE] = { .type = NLA_U32 },
2833 [IPVS_DAEMON_ATTR_MCAST_IFN] = { .type = NLA_NUL_STRING,
2834 .len = IP_VS_IFNAME_MAXLEN },
2835 [IPVS_DAEMON_ATTR_SYNC_ID] = { .type = NLA_U32 },
2836};
2837
2838/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2839static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2840 [IPVS_SVC_ATTR_AF] = { .type = NLA_U16 },
2841 [IPVS_SVC_ATTR_PROTOCOL] = { .type = NLA_U16 },
2842 [IPVS_SVC_ATTR_ADDR] = { .type = NLA_BINARY,
2843 .len = sizeof(union nf_inet_addr) },
2844 [IPVS_SVC_ATTR_PORT] = { .type = NLA_U16 },
2845 [IPVS_SVC_ATTR_FWMARK] = { .type = NLA_U32 },
2846 [IPVS_SVC_ATTR_SCHED_NAME] = { .type = NLA_NUL_STRING,
2847 .len = IP_VS_SCHEDNAME_MAXLEN },
0d1e71b0
SH		 2848 [IPVS_SVC_ATTR_PE_NAME] = { .type = NLA_NUL_STRING,
2849 .len = IP_VS_PENAME_MAXLEN },
9a812198
JV		 2850 [IPVS_SVC_ATTR_FLAGS] = { .type = NLA_BINARY,
2851 .len = sizeof(struct ip_vs_flags) },
2852 [IPVS_SVC_ATTR_TIMEOUT] = { .type = NLA_U32 },
2853 [IPVS_SVC_ATTR_NETMASK] = { .type = NLA_U32 },
2854 [IPVS_SVC_ATTR_STATS] = { .type = NLA_NESTED },
2855};
2856
2857/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2858static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2859 [IPVS_DEST_ATTR_ADDR] = { .type = NLA_BINARY,
2860 .len = sizeof(union nf_inet_addr) },
2861 [IPVS_DEST_ATTR_PORT] = { .type = NLA_U16 },
2862 [IPVS_DEST_ATTR_FWD_METHOD] = { .type = NLA_U32 },
2863 [IPVS_DEST_ATTR_WEIGHT] = { .type = NLA_U32 },
2864 [IPVS_DEST_ATTR_U_THRESH] = { .type = NLA_U32 },
2865 [IPVS_DEST_ATTR_L_THRESH] = { .type = NLA_U32 },
2866 [IPVS_DEST_ATTR_ACTIVE_CONNS] = { .type = NLA_U32 },
2867 [IPVS_DEST_ATTR_INACT_CONNS] = { .type = NLA_U32 },
2868 [IPVS_DEST_ATTR_PERSIST_CONNS] = { .type = NLA_U32 },
2869 [IPVS_DEST_ATTR_STATS] = { .type = NLA_NESTED },
2870};
2871
2872static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2873 struct ip_vs_stats *stats)
2874{
55a3d4e1 2875 struct ip_vs_stats_user ustats;
9a812198
JV		 2876 struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2877 if (!nl_stats)
2878 return -EMSGSIZE;
2879
55a3d4e1 2880 ip_vs_copy_stats(&ustats, stats);
9a812198 2881
969e8e25
DM		 2882 if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns) ||
2883 nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts) ||
2884 nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts) ||
2885 nla_put_u64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes) ||
2886 nla_put_u64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes) ||
2887 nla_put_u32(skb, IPVS_STATS_ATTR_CPS, ustats.cps) ||
2888 nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps) ||
2889 nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps) ||
2890 nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps) ||
2891 nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps))
2892 goto nla_put_failure;
9a812198
JV		 2893 nla_nest_end(skb, nl_stats);
2894
2895 return 0;
2896
2897nla_put_failure:
9a812198
JV		 2898 nla_nest_cancel(skb, nl_stats);
2899 return -EMSGSIZE;
2900}
2901
2902static int ip_vs_genl_fill_service(struct sk_buff *skb,
2903 struct ip_vs_service *svc)
2904{
2905 struct nlattr *nl_service;
2906 struct ip_vs_flags flags = { .flags = svc->flags,
2907 .mask = ~0 };
2908
2909 nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2910 if (!nl_service)
2911 return -EMSGSIZE;
2912
969e8e25
DM		 2913 if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
2914 goto nla_put_failure;
9a812198 2915 if (svc->fwmark) {
969e8e25
DM		 2916 if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
2917 goto nla_put_failure;
9a812198 2918 } else {
969e8e25
DM		 2919 if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
2920 nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
2921 nla_put_u16(skb, IPVS_SVC_ATTR_PORT, svc->port))
2922 goto nla_put_failure;
9a812198
JV		 2923 }
2924
969e8e25
DM		 2925 if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name) ||
2926 (svc->pe &&
2927 nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name)) ||
2928 nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
2929 nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
2930 nla_put_u32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
2931 goto nla_put_failure;
9a812198
JV		 2932 if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2933 goto nla_put_failure;
2934
2935 nla_nest_end(skb, nl_service);
2936
2937 return 0;
2938
2939nla_put_failure:
2940 nla_nest_cancel(skb, nl_service);
2941 return -EMSGSIZE;
2942}
2943
2944static int ip_vs_genl_dump_service(struct sk_buff *skb,
2945 struct ip_vs_service *svc,
2946 struct netlink_callback *cb)
2947{
2948 void *hdr;
2949
15e47304 2950 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
9a812198
JV		 2951 &ip_vs_genl_family, NLM_F_MULTI,
2952 IPVS_CMD_NEW_SERVICE);
2953 if (!hdr)
2954 return -EMSGSIZE;
2955
2956 if (ip_vs_genl_fill_service(skb, svc) < 0)
2957 goto nla_put_failure;
2958
2959 return genlmsg_end(skb, hdr);
2960
2961nla_put_failure:
2962 genlmsg_cancel(skb, hdr);
2963 return -EMSGSIZE;
2964}
2965
2966static int ip_vs_genl_dump_services(struct sk_buff *skb,
2967 struct netlink_callback *cb)
2968{
2969 int idx = 0, i;
2970 int start = cb->args[0];
2971 struct ip_vs_service *svc;
fc723250 2972 struct net *net = skb_sknet(skb);
9a812198
JV		 2973
2974 mutex_lock(&__ip_vs_mutex);
2975 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2976 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
fc723250 2977 if (++idx <= start || !net_eq(svc->net, net))
9a812198
JV		 2978 continue;
2979 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2980 idx--;
2981 goto nla_put_failure;
2982 }
2983 }
2984 }
2985
2986 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2987 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
fc723250 2988 if (++idx <= start || !net_eq(svc->net, net))
9a812198
JV		 2989 continue;
2990 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2991 idx--;
2992 goto nla_put_failure;
2993 }
2994 }
2995 }
2996
2997nla_put_failure:
2998 mutex_unlock(&__ip_vs_mutex);
2999 cb->args[0] = idx;
3000
3001 return skb->len;
3002}
3003
fc723250
HS		 3004static int ip_vs_genl_parse_service(struct net *net,
3005 struct ip_vs_service_user_kern *usvc,
26c15cfd
JA		 3006 struct nlattr *nla, int full_entry,
3007 struct ip_vs_service **ret_svc)
9a812198
JV		 3008{
3009 struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
3010 struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
26c15cfd 3011 struct ip_vs_service *svc;
9a812198
JV		 3012
3013 /* Parse mandatory identifying service fields first */
3014 if (nla == NULL ||
3015 nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
3016 return -EINVAL;
3017
3018 nla_af = attrs[IPVS_SVC_ATTR_AF];
3019 nla_protocol = attrs[IPVS_SVC_ATTR_PROTOCOL];
3020 nla_addr = attrs[IPVS_SVC_ATTR_ADDR];
3021 nla_port = attrs[IPVS_SVC_ATTR_PORT];
3022 nla_fwmark = attrs[IPVS_SVC_ATTR_FWMARK];
3023
3024 if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
3025 return -EINVAL;
3026
258c8893
SH		 3027 memset(usvc, 0, sizeof(*usvc));
3028
c860c6b1 3029 usvc->af = nla_get_u16(nla_af);
f94fd041
JV		 3030#ifdef CONFIG_IP_VS_IPV6
3031 if (usvc->af != AF_INET && usvc->af != AF_INET6)
3032#else
3033 if (usvc->af != AF_INET)
3034#endif
9a812198
JV		 3035 return -EAFNOSUPPORT;
3036
3037 if (nla_fwmark) {
3038 usvc->protocol = IPPROTO_TCP;
3039 usvc->fwmark = nla_get_u32(nla_fwmark);
3040 } else {
3041 usvc->protocol = nla_get_u16(nla_protocol);
3042 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
3043 usvc->port = nla_get_u16(nla_port);
3044 usvc->fwmark = 0;
3045 }
3046
26c15cfd 3047 if (usvc->fwmark)
fc723250 3048 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
26c15cfd 3049 else
fc723250 3050 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
26c15cfd
JA		 3051 &usvc->addr, usvc->port);
3052 *ret_svc = svc;
3053
9a812198
JV		 3054 /* If a full entry was requested, check for the additional fields */
3055 if (full_entry) {
0d1e71b0 3056 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
9a812198
JV		 3057 *nla_netmask;
3058 struct ip_vs_flags flags;
9a812198
JV		 3059
3060 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
0d1e71b0 3061 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
9a812198
JV		 3062 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
3063 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
3064 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
3065
3066 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3067 return -EINVAL;
3068
3069 nla_memcpy(&flags, nla_flags, sizeof(flags));
3070
3071 /* prefill flags from service if it already exists */
26c15cfd 3072 if (svc)
9a812198 3073 usvc->flags = svc->flags;
9a812198
JV		 3074
3075 /* set new flags from userland */
3076 usvc->flags = (usvc->flags & ~flags.mask) |
3077 (flags.flags & flags.mask);
c860c6b1 3078 usvc->sched_name = nla_data(nla_sched);
0d1e71b0 3079 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
9a812198
JV		 3080 usvc->timeout = nla_get_u32(nla_timeout);
3081 usvc->netmask = nla_get_u32(nla_netmask);
3082 }
3083
3084 return 0;
3085}
3086
fc723250
HS		 3087static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3088 struct nlattr *nla)
9a812198 3089{
c860c6b1 3090 struct ip_vs_service_user_kern usvc;
26c15cfd 3091 struct ip_vs_service *svc;
9a812198
JV		 3092 int ret;
3093
fc723250 3094 ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
26c15cfd 3095 return ret ? ERR_PTR(ret) : svc;
9a812198
JV		 3096}
3097
3098static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3099{
3100 struct nlattr *nl_dest;
3101
3102 nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3103 if (!nl_dest)
3104 return -EMSGSIZE;
3105
969e8e25
DM		 3106 if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
3107 nla_put_u16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
3108 nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3109 (atomic_read(&dest->conn_flags) &
3110 IP_VS_CONN_F_FWD_MASK)) ||
3111 nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
3112 atomic_read(&dest->weight)) ||
3113 nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
3114 nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
3115 nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3116 atomic_read(&dest->activeconns)) ||
3117 nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3118 atomic_read(&dest->inactconns)) ||
3119 nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3120 atomic_read(&dest->persistconns)))
3121 goto nla_put_failure;
9a812198
JV		 3122 if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3123 goto nla_put_failure;
3124
3125 nla_nest_end(skb, nl_dest);
3126
3127 return 0;
3128
3129nla_put_failure:
3130 nla_nest_cancel(skb, nl_dest);
3131 return -EMSGSIZE;
3132}
3133
3134static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3135 struct netlink_callback *cb)
3136{
3137 void *hdr;
3138
15e47304 3139 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
9a812198
JV		 3140 &ip_vs_genl_family, NLM_F_MULTI,
3141 IPVS_CMD_NEW_DEST);
3142 if (!hdr)
3143 return -EMSGSIZE;
3144
3145 if (ip_vs_genl_fill_dest(skb, dest) < 0)
3146 goto nla_put_failure;
3147
3148 return genlmsg_end(skb, hdr);
3149
3150nla_put_failure:
3151 genlmsg_cancel(skb, hdr);
3152 return -EMSGSIZE;
3153}
3154
3155static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3156 struct netlink_callback *cb)
3157{
3158 int idx = 0;
3159 int start = cb->args[0];
3160 struct ip_vs_service *svc;
3161 struct ip_vs_dest *dest;
3162 struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
a0840e2e 3163 struct net *net = skb_sknet(skb);
9a812198
JV		 3164
3165 mutex_lock(&__ip_vs_mutex);
3166
3167 /* Try to find the service for which to dump destinations */
3168 if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3169 IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3170 goto out_err;
3171
a0840e2e 3172
fc723250 3173 svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
9a812198
JV		 3174 if (IS_ERR(svc) || svc == NULL)
3175 goto out_err;
3176
3177 /* Dump the destinations */
3178 list_for_each_entry(dest, &svc->destinations, n_list) {
3179 if (++idx <= start)
3180 continue;
3181 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3182 idx--;
3183 goto nla_put_failure;
3184 }
3185 }
3186
3187nla_put_failure:
3188 cb->args[0] = idx;
9a812198
JV		 3189
3190out_err:
3191 mutex_unlock(&__ip_vs_mutex);
3192
3193 return skb->len;
3194}
3195
c860c6b1 3196static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
9a812198
JV		 3197 struct nlattr *nla, int full_entry)
3198{
3199 struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3200 struct nlattr *nla_addr, *nla_port;
3201
3202 /* Parse mandatory identifying destination fields first */
3203 if (nla == NULL ||
3204 nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3205 return -EINVAL;
3206
3207 nla_addr = attrs[IPVS_DEST_ATTR_ADDR];
3208 nla_port = attrs[IPVS_DEST_ATTR_PORT];
3209
3210 if (!(nla_addr && nla_port))
3211 return -EINVAL;
3212
258c8893
SH		 3213 memset(udest, 0, sizeof(*udest));
3214
9a812198
JV		 3215 nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3216 udest->port = nla_get_u16(nla_port);
3217
3218 /* If a full entry was requested, check for the additional fields */
3219 if (full_entry) {
3220 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3221 *nla_l_thresh;
3222
3223 nla_fwd = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3224 nla_weight = attrs[IPVS_DEST_ATTR_WEIGHT];
3225 nla_u_thresh = attrs[IPVS_DEST_ATTR_U_THRESH];
3226 nla_l_thresh = attrs[IPVS_DEST_ATTR_L_THRESH];
3227
3228 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3229 return -EINVAL;
3230
3231 udest->conn_flags = nla_get_u32(nla_fwd)
3232 & IP_VS_CONN_F_FWD_MASK;
3233 udest->weight = nla_get_u32(nla_weight);
3234 udest->u_threshold = nla_get_u32(nla_u_thresh);
3235 udest->l_threshold = nla_get_u32(nla_l_thresh);
3236 }
3237
3238 return 0;
3239}
3240
3241static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3242 const char *mcast_ifn, __be32 syncid)
3243{
3244 struct nlattr *nl_daemon;
3245
3246 nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3247 if (!nl_daemon)
3248 return -EMSGSIZE;
3249
969e8e25
DM		 3250 if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
3251 nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn) ||
3252 nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid))
3253 goto nla_put_failure;
9a812198
JV		 3254 nla_nest_end(skb, nl_daemon);
3255
3256 return 0;
3257
3258nla_put_failure:
3259 nla_nest_cancel(skb, nl_daemon);
3260 return -EMSGSIZE;
3261}
3262
3263static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3264 const char *mcast_ifn, __be32 syncid,
3265 struct netlink_callback *cb)
3266{
3267 void *hdr;
15e47304 3268 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
9a812198
JV		 3269 &ip_vs_genl_family, NLM_F_MULTI,
3270 IPVS_CMD_NEW_DAEMON);
3271 if (!hdr)
3272 return -EMSGSIZE;
3273
3274 if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3275 goto nla_put_failure;
3276
3277 return genlmsg_end(skb, hdr);
3278
3279nla_put_failure:
3280 genlmsg_cancel(skb, hdr);
3281 return -EMSGSIZE;
3282}
3283
3284static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3285 struct netlink_callback *cb)
3286{
a09d1977 3287 struct net *net = skb_sknet(skb);
f131315f
HS		 3288 struct netns_ipvs *ipvs = net_ipvs(net);
3289
ae1d48b2 3290 mutex_lock(&ipvs->sync_mutex);
f131315f 3291 if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
9a812198 3292 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
f131315f
HS		 3293 ipvs->master_mcast_ifn,
3294 ipvs->master_syncid, cb) < 0)
9a812198
JV		 3295 goto nla_put_failure;
3296
3297 cb->args[0] = 1;
3298 }
3299
f131315f 3300 if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
9a812198 3301 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
f131315f
HS		 3302 ipvs->backup_mcast_ifn,
3303 ipvs->backup_syncid, cb) < 0)
9a812198
JV		 3304 goto nla_put_failure;
3305
3306 cb->args[1] = 1;
3307 }
3308
3309nla_put_failure:
ae1d48b2 3310 mutex_unlock(&ipvs->sync_mutex);
9a812198
JV		 3311
3312 return skb->len;
3313}
3314
f131315f 3315static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
9a812198
JV		 3316{
3317 if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3318 attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3319 attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3320 return -EINVAL;
3321
f131315f
HS		 3322 return start_sync_thread(net,
3323 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
9a812198
JV		 3324 nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3325 nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3326}
3327
f131315f 3328static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
9a812198
JV		 3329{
3330 if (!attrs[IPVS_DAEMON_ATTR_STATE])
3331 return -EINVAL;
3332
f131315f
HS		 3333 return stop_sync_thread(net,
3334 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
9a812198
JV		 3335}
3336
9330419d 3337static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
9a812198
JV		 3338{
3339 struct ip_vs_timeout_user t;
3340
9330419d 3341 __ip_vs_get_timeouts(net, &t);
9a812198
JV		 3342
3343 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3344 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3345
3346 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3347 t.tcp_fin_timeout =
3348 nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3349
3350 if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3351 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3352
9330419d 3353 return ip_vs_set_timeout(net, &t);
9a812198
JV		 3354}
3355
ae1d48b2 3356static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
9a812198 3357{
9a812198 3358 int ret = 0, cmd;
fc723250 3359 struct net *net;
a0840e2e 3360 struct netns_ipvs *ipvs;
9a812198 3361
fc723250 3362 net = skb_sknet(skb);
a0840e2e 3363 ipvs = net_ipvs(net);
9a812198
JV		 3364 cmd = info->genlhdr->cmd;
3365
ae1d48b2 3366 if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
9a812198
JV		 3367 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3368
ae1d48b2 3369 mutex_lock(&ipvs->sync_mutex);
9a812198
JV		 3370 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3371 nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3372 info->attrs[IPVS_CMD_ATTR_DAEMON],
3373 ip_vs_daemon_policy)) {
3374 ret = -EINVAL;
3375 goto out;
3376 }
3377
3378 if (cmd == IPVS_CMD_NEW_DAEMON)
f131315f 3379 ret = ip_vs_genl_new_daemon(net, daemon_attrs);
9a812198 3380 else
f131315f 3381 ret = ip_vs_genl_del_daemon(net, daemon_attrs);
ae1d48b2
HS		 3382out:
3383 mutex_unlock(&ipvs->sync_mutex);
3384 }
3385 return ret;
3386}
3387
3388static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3389{
3390 struct ip_vs_service *svc = NULL;
3391 struct ip_vs_service_user_kern usvc;
3392 struct ip_vs_dest_user_kern udest;
3393 int ret = 0, cmd;
3394 int need_full_svc = 0, need_full_dest = 0;
3395 struct net *net;
ae1d48b2
HS		 3396
3397 net = skb_sknet(skb);
ae1d48b2
HS		 3398 cmd = info->genlhdr->cmd;
3399
3400 mutex_lock(&__ip_vs_mutex);
3401
3402 if (cmd == IPVS_CMD_FLUSH) {
3403 ret = ip_vs_flush(net);
3404 goto out;
3405 } else if (cmd == IPVS_CMD_SET_CONFIG) {
3406 ret = ip_vs_genl_set_config(net, info->attrs);
9a812198
JV		 3407 goto out;
3408 } else if (cmd == IPVS_CMD_ZERO &&
3409 !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
fc723250 3410 ret = ip_vs_zero_all(net);
9a812198
JV		 3411 goto out;
3412 }
3413
3414 /* All following commands require a service argument, so check if we
3415 * received a valid one. We need a full service specification when
3416 * adding / editing a service. Only identifying members otherwise. */
3417 if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3418 need_full_svc = 1;
3419
fc723250 3420 ret = ip_vs_genl_parse_service(net, &usvc,
9a812198 3421 info->attrs[IPVS_CMD_ATTR_SERVICE],
26c15cfd 3422 need_full_svc, &svc);
9a812198
JV		 3423 if (ret)
3424 goto out;
3425
9a812198
JV		 3426 /* Unless we're adding a new service, the service must already exist */
3427 if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3428 ret = -ESRCH;
3429 goto out;
3430 }
3431
3432 /* Destination commands require a valid destination argument. For
3433 * adding / editing a destination, we need a full destination
3434 * specification. */
3435 if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3436 cmd == IPVS_CMD_DEL_DEST) {
3437 if (cmd != IPVS_CMD_DEL_DEST)
3438 need_full_dest = 1;
3439
3440 ret = ip_vs_genl_parse_dest(&udest,
3441 info->attrs[IPVS_CMD_ATTR_DEST],
3442 need_full_dest);
3443 if (ret)
3444 goto out;
3445 }
3446
3447 switch (cmd) {
3448 case IPVS_CMD_NEW_SERVICE:
3449 if (svc == NULL)
fc723250 3450 ret = ip_vs_add_service(net, &usvc, &svc);
9a812198
JV		 3451 else
3452 ret = -EEXIST;
3453 break;
3454 case IPVS_CMD_SET_SERVICE:
3455 ret = ip_vs_edit_service(svc, &usvc);
3456 break;
3457 case IPVS_CMD_DEL_SERVICE:
3458 ret = ip_vs_del_service(svc);
26c15cfd 3459 /* do not use svc, it can be freed */
9a812198
JV		 3460 break;
3461 case IPVS_CMD_NEW_DEST:
3462 ret = ip_vs_add_dest(svc, &udest);
3463 break;
3464 case IPVS_CMD_SET_DEST:
3465 ret = ip_vs_edit_dest(svc, &udest);
3466 break;
3467 case IPVS_CMD_DEL_DEST:
3468 ret = ip_vs_del_dest(svc, &udest);
3469 break;
3470 case IPVS_CMD_ZERO:
3471 ret = ip_vs_zero_service(svc);
3472 break;
3473 default:
3474 ret = -EINVAL;
3475 }
3476
3477out:
9a812198
JV		 3478 mutex_unlock(&__ip_vs_mutex);
3479
3480 return ret;
3481}
3482
3483static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3484{
3485 struct sk_buff *msg;
3486 void *reply;
3487 int ret, cmd, reply_cmd;
fc723250 3488 struct net *net;
9a812198 3489
fc723250 3490 net = skb_sknet(skb);
9a812198
JV		 3491 cmd = info->genlhdr->cmd;
3492
3493 if (cmd == IPVS_CMD_GET_SERVICE)
3494 reply_cmd = IPVS_CMD_NEW_SERVICE;
3495 else if (cmd == IPVS_CMD_GET_INFO)
3496 reply_cmd = IPVS_CMD_SET_INFO;
3497 else if (cmd == IPVS_CMD_GET_CONFIG)
3498 reply_cmd = IPVS_CMD_SET_CONFIG;
3499 else {
1e3e238e 3500 pr_err("unknown Generic Netlink command\n");
9a812198
JV		 3501 return -EINVAL;
3502 }
3503
3504 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3505 if (!msg)
3506 return -ENOMEM;
3507
3508 mutex_lock(&__ip_vs_mutex);
3509
3510 reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3511 if (reply == NULL)
3512 goto nla_put_failure;
3513
3514 switch (cmd) {
3515 case IPVS_CMD_GET_SERVICE:
3516 {
3517 struct ip_vs_service *svc;
3518
fc723250
HS		 3519 svc = ip_vs_genl_find_service(net,
3520 info->attrs[IPVS_CMD_ATTR_SERVICE]);
9a812198
JV		 3521 if (IS_ERR(svc)) {
3522 ret = PTR_ERR(svc);
3523 goto out_err;
3524 } else if (svc) {
3525 ret = ip_vs_genl_fill_service(msg, svc);
9a812198
JV		 3526 if (ret)
3527 goto nla_put_failure;
3528 } else {
3529 ret = -ESRCH;
3530 goto out_err;
3531 }
3532
3533 break;
3534 }
3535
3536 case IPVS_CMD_GET_CONFIG:
3537 {
3538 struct ip_vs_timeout_user t;
3539
9330419d 3540 __ip_vs_get_timeouts(net, &t);
9a812198 3541#ifdef CONFIG_IP_VS_PROTO_TCP
969e8e25
DM		 3542 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
3543 t.tcp_timeout) ||
3544 nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3545 t.tcp_fin_timeout))
3546 goto nla_put_failure;
9a812198
JV		 3547#endif
3548#ifdef CONFIG_IP_VS_PROTO_UDP
969e8e25
DM		 3549 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
3550 goto nla_put_failure;
9a812198
JV		 3551#endif
3552
3553 break;
3554 }
3555
3556 case IPVS_CMD_GET_INFO:
969e8e25
DM		 3557 if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
3558 IP_VS_VERSION_CODE) ||
3559 nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3560 ip_vs_conn_tab_size))
3561 goto nla_put_failure;
9a812198
JV		 3562 break;
3563 }
3564
3565 genlmsg_end(msg, reply);
134e6375 3566 ret = genlmsg_reply(msg, info);
9a812198
JV		 3567 goto out;
3568
3569nla_put_failure:
1e3e238e 3570 pr_err("not enough space in Netlink message\n");
9a812198
JV		 3571 ret = -EMSGSIZE;
3572
3573out_err:
3574 nlmsg_free(msg);
3575out:
3576 mutex_unlock(&__ip_vs_mutex);
3577
3578 return ret;
3579}
3580
3581
3582static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3583 {
3584 .cmd = IPVS_CMD_NEW_SERVICE,
3585 .flags = GENL_ADMIN_PERM,
3586 .policy = ip_vs_cmd_policy,
3587 .doit = ip_vs_genl_set_cmd,
3588 },
3589 {
3590 .cmd = IPVS_CMD_SET_SERVICE,
3591 .flags = GENL_ADMIN_PERM,
3592 .policy = ip_vs_cmd_policy,
3593 .doit = ip_vs_genl_set_cmd,
3594 },
3595 {
3596 .cmd = IPVS_CMD_DEL_SERVICE,
3597 .flags = GENL_ADMIN_PERM,
3598 .policy = ip_vs_cmd_policy,
3599 .doit = ip_vs_genl_set_cmd,
3600 },
3601 {
3602 .cmd = IPVS_CMD_GET_SERVICE,
3603 .flags = GENL_ADMIN_PERM,
3604 .doit = ip_vs_genl_get_cmd,
3605 .dumpit = ip_vs_genl_dump_services,
3606 .policy = ip_vs_cmd_policy,
3607 },
3608 {
3609 .cmd = IPVS_CMD_NEW_DEST,
3610 .flags = GENL_ADMIN_PERM,
3611 .policy = ip_vs_cmd_policy,
3612 .doit = ip_vs_genl_set_cmd,
3613 },
3614 {
3615 .cmd = IPVS_CMD_SET_DEST,
3616 .flags = GENL_ADMIN_PERM,
3617 .policy = ip_vs_cmd_policy,
3618 .doit = ip_vs_genl_set_cmd,
3619 },
3620 {
3621 .cmd = IPVS_CMD_DEL_DEST,
3622 .flags = GENL_ADMIN_PERM,
3623 .policy = ip_vs_cmd_policy,
3624 .doit = ip_vs_genl_set_cmd,
3625 },
3626 {
3627 .cmd = IPVS_CMD_GET_DEST,
3628 .flags = GENL_ADMIN_PERM,
3629 .policy = ip_vs_cmd_policy,
3630 .dumpit = ip_vs_genl_dump_dests,
3631 },
3632 {
3633 .cmd = IPVS_CMD_NEW_DAEMON,
3634 .flags = GENL_ADMIN_PERM,
3635 .policy = ip_vs_cmd_policy,
ae1d48b2 3636 .doit = ip_vs_genl_set_daemon,
9a812198
JV		 3637 },
3638 {
3639 .cmd = IPVS_CMD_DEL_DAEMON,
3640 .flags = GENL_ADMIN_PERM,
3641 .policy = ip_vs_cmd_policy,
ae1d48b2 3642 .doit = ip_vs_genl_set_daemon,
9a812198
JV		 3643 },
3644 {
3645 .cmd = IPVS_CMD_GET_DAEMON,
3646 .flags = GENL_ADMIN_PERM,
3647 .dumpit = ip_vs_genl_dump_daemons,
3648 },
3649 {
3650 .cmd = IPVS_CMD_SET_CONFIG,
3651 .flags = GENL_ADMIN_PERM,
3652 .policy = ip_vs_cmd_policy,
3653 .doit = ip_vs_genl_set_cmd,
3654 },
3655 {
3656 .cmd = IPVS_CMD_GET_CONFIG,
3657 .flags = GENL_ADMIN_PERM,
3658 .doit = ip_vs_genl_get_cmd,
3659 },
3660 {
3661 .cmd = IPVS_CMD_GET_INFO,
3662 .flags = GENL_ADMIN_PERM,
3663 .doit = ip_vs_genl_get_cmd,
3664 },
3665 {
3666 .cmd = IPVS_CMD_ZERO,
3667 .flags = GENL_ADMIN_PERM,
3668 .policy = ip_vs_cmd_policy,
3669 .doit = ip_vs_genl_set_cmd,
3670 },
3671 {
3672 .cmd = IPVS_CMD_FLUSH,
3673 .flags = GENL_ADMIN_PERM,
3674 .doit = ip_vs_genl_set_cmd,
3675 },
3676};
3677
3678static int __init ip_vs_genl_register(void)
3679{
8f698d54
MM		 3680 return genl_register_family_with_ops(&ip_vs_genl_family,
3681 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
9a812198
JV		 3682}
3683
3684static void ip_vs_genl_unregister(void)
3685{
3686 genl_unregister_family(&ip_vs_genl_family);
3687}
3688
3689/* End of Generic Netlink interface definitions */
3690
61b1ab45
HS		 3691/*
3692 * per netns intit/exit func.
3693 */
14e40546 3694#ifdef CONFIG_SYSCTL
2b2d2808 3695static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
61b1ab45 3696{
fc723250
HS		 3697 int idx;
3698 struct netns_ipvs *ipvs = net_ipvs(net);
a0840e2e 3699 struct ctl_table *tbl;
fc723250 3700
a0840e2e
HS		 3701 atomic_set(&ipvs->dropentry, 0);
3702 spin_lock_init(&ipvs->dropentry_lock);
3703 spin_lock_init(&ipvs->droppacket_lock);
3704 spin_lock_init(&ipvs->securetcp_lock);
a0840e2e
HS		 3705
3706 if (!net_eq(net, &init_net)) {
3707 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3708 if (tbl == NULL)
14e40546 3709 return -ENOMEM;
464dc801
EB		 3710
3711 /* Don't export sysctls to unprivileged users */
3712 if (net->user_ns != &init_user_ns)
3713 tbl[0].procname = NULL;
a0840e2e
HS		 3714 } else
3715 tbl = vs_vars;
3716 /* Initialize sysctl defaults */
3717 idx = 0;
3718 ipvs->sysctl_amemthresh = 1024;
3719 tbl[idx++].data = &ipvs->sysctl_amemthresh;
3720 ipvs->sysctl_am_droprate = 10;
3721 tbl[idx++].data = &ipvs->sysctl_am_droprate;
3722 tbl[idx++].data = &ipvs->sysctl_drop_entry;
3723 tbl[idx++].data = &ipvs->sysctl_drop_packet;
3724#ifdef CONFIG_IP_VS_NFCT
3725 tbl[idx++].data = &ipvs->sysctl_conntrack;
3726#endif
3727 tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3728 ipvs->sysctl_snat_reroute = 1;
3729 tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3730 ipvs->sysctl_sync_ver = 1;
3731 tbl[idx++].data = &ipvs->sysctl_sync_ver;
f73181c8
PNA		 3732 ipvs->sysctl_sync_ports = 1;
3733 tbl[idx++].data = &ipvs->sysctl_sync_ports;
1c003b15
PNA		 3734 ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
3735 tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
3736 ipvs->sysctl_sync_sock_size = 0;
3737 tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
a0840e2e
HS		 3738 tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3739 tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3740 tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
59e0350e
SH		 3741 ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3742 ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
a0840e2e
HS		 3743 tbl[idx].data = &ipvs->sysctl_sync_threshold;
3744 tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
749c42b6
JA		 3745 ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
3746 tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
3747 ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
3748 tbl[idx++].data = &ipvs->sysctl_sync_retries;
a0840e2e 3749 tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3654e611
JA		 3750 ipvs->sysctl_pmtu_disc = 1;
3751 tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
0c12582f 3752 tbl[idx++].data = &ipvs->sysctl_backup_only;
a0840e2e
HS		 3753
3754
ec8f23ce 3755 ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
0443929f
SH		 3756 if (ipvs->sysctl_hdr == NULL) {
3757 if (!net_eq(net, &init_net))
3758 kfree(tbl);
14e40546 3759 return -ENOMEM;
0443929f 3760 }
6ef757f9 3761 ip_vs_start_estimator(net, &ipvs->tot_stats);
a0840e2e 3762 ipvs->sysctl_tbl = tbl;
f6340ee0
HS		 3763 /* Schedule defense work */
3764 INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3765 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
61b1ab45 3766
61b1ab45 3767 return 0;
61b1ab45
HS		 3768}
3769
2b2d2808 3770static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
61b1ab45 3771{
b17fc996
HS		 3772 struct netns_ipvs *ipvs = net_ipvs(net);
3773
f2431e6e
HS		 3774 cancel_delayed_work_sync(&ipvs->defense_work);
3775 cancel_work_sync(&ipvs->defense_work.work);
a0840e2e 3776 unregister_net_sysctl_table(ipvs->sysctl_hdr);
14e40546
SH		 3777}
3778
3779#else
3780
2b2d2808
CG		 3781static int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3782static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
14e40546 3783
0443929f 3784#endif
14e40546 3785
7a4f0761
HS		 3786static struct notifier_block ip_vs_dst_notifier = {
3787 .notifier_call = ip_vs_dst_event,
3788};
3789
503cf15a 3790int __net_init ip_vs_control_net_init(struct net *net)
14e40546
SH		 3791{
3792 int idx;
3793 struct netns_ipvs *ipvs = net_ipvs(net);
3794
3458e21c 3795 rwlock_init(&ipvs->rs_lock);
14e40546
SH		 3796
3797 /* Initialize rs_table */
3798 for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3799 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3800
3801 INIT_LIST_HEAD(&ipvs->dest_trash);
3802 atomic_set(&ipvs->ftpsvc_counter, 0);
3803 atomic_set(&ipvs->nullsvc_counter, 0);
3804
3805 /* procfs stats */
3806 ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
0a9ee813 3807 if (!ipvs->tot_stats.cpustats)
14e40546 3808 return -ENOMEM;
0a9ee813 3809
14e40546
SH		 3810 spin_lock_init(&ipvs->tot_stats.lock);
3811
d4beaa66
G		 3812 proc_create("ip_vs", 0, net->proc_net, &ip_vs_info_fops);
3813 proc_create("ip_vs_stats", 0, net->proc_net, &ip_vs_stats_fops);
3814 proc_create("ip_vs_stats_percpu", 0, net->proc_net,
3815 &ip_vs_stats_percpu_fops);
14e40546 3816
503cf15a 3817 if (ip_vs_control_net_init_sysctl(net))
14e40546
SH		 3818 goto err;
3819
3820 return 0;
3821
3822err:
2a0751af 3823 free_percpu(ipvs->tot_stats.cpustats);
61b1ab45
HS		 3824 return -ENOMEM;
3825}
3826
503cf15a 3827void __net_exit ip_vs_control_net_cleanup(struct net *net)
61b1ab45 3828{
b17fc996
HS		 3829 struct netns_ipvs *ipvs = net_ipvs(net);
3830
f2431e6e 3831 ip_vs_trash_cleanup(net);
6ef757f9 3832 ip_vs_stop_estimator(net, &ipvs->tot_stats);
503cf15a 3833 ip_vs_control_net_cleanup_sysctl(net);
ece31ffd
G		 3834 remove_proc_entry("ip_vs_stats_percpu", net->proc_net);
3835 remove_proc_entry("ip_vs_stats", net->proc_net);
3836 remove_proc_entry("ip_vs", net->proc_net);
2a0751af 3837 free_percpu(ipvs->tot_stats.cpustats);
61b1ab45
HS		 3838}
3839
8537de8a 3840int __init ip_vs_register_nl_ioctl(void)
1da177e4 3841{
fc723250 3842 int ret;
1da177e4 3843
1da177e4
LT		 3844 ret = nf_register_sockopt(&ip_vs_sockopts);
3845 if (ret) {
1e3e238e 3846 pr_err("cannot register sockopt.\n");
7a4f0761 3847 goto err_sock;
1da177e4
LT		 3848 }
3849
9a812198
JV		 3850 ret = ip_vs_genl_register();
3851 if (ret) {
1e3e238e 3852 pr_err("cannot register Generic Netlink interface.\n");
7a4f0761 3853 goto err_genl;
9a812198 3854 }
1da177e4 3855 return 0;
fc723250 3856
7a4f0761
HS		 3857err_genl:
3858 nf_unregister_sockopt(&ip_vs_sockopts);
3859err_sock:
fc723250 3860 return ret;
1da177e4
LT		 3861}
3862
8537de8a
HS		 3863void ip_vs_unregister_nl_ioctl(void)
3864{
3865 ip_vs_genl_unregister();
3866 nf_unregister_sockopt(&ip_vs_sockopts);
3867}
3868
3869int __init ip_vs_control_init(void)
3870{
3871 int idx;
3872 int ret;
3873
3874 EnterFunction(2);
3875
3876 /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
3877 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3878 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3879 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3880 }
3881
3882 smp_wmb(); /* Do we really need it now ? */
3883
3884 ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3885 if (ret < 0)
3886 return ret;
3887
3888 LeaveFunction(2);
3889 return 0;
3890}
3891
1da177e4
LT		 3892
3893void ip_vs_control_cleanup(void)
3894{
3895 EnterFunction(2);
7676e345 3896 unregister_netdevice_notifier(&ip_vs_dst_notifier);
1da177e4
LT		 3897 LeaveFunction(2);
3898}
Linux kernel - Deliverables
This page took 1.13131 seconds and 5 git commands to generate.