~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/ipvs/ip_vs_ctl.c

Version: ~ [ linux-5.1-rc5 ] ~ [ linux-5.0.7 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.34 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.111 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.168 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.178 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.138 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.65 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * IPVS         An implementation of the IP virtual server support for the
  3  *              LINUX operating system.  IPVS is now implemented as a module
  4  *              over the NetFilter framework. IPVS can be used to build a
  5  *              high-performance and highly available server based on a
  6  *              cluster of servers.
  7  *
  8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
  9  *              Peter Kese <peter.kese@ijs.si>
 10  *              Julian Anastasov <ja@ssi.bg>
 11  *
 12  *              This program is free software; you can redistribute it and/or
 13  *              modify it under the terms of the GNU General Public License
 14  *              as published by the Free Software Foundation; either version
 15  *              2 of the License, or (at your option) any later version.
 16  *
 17  * Changes:
 18  *
 19  */
 20 
 21 #define KMSG_COMPONENT "IPVS"
 22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 23 
 24 #include <linux/module.h>
 25 #include <linux/init.h>
 26 #include <linux/types.h>
 27 #include <linux/capability.h>
 28 #include <linux/fs.h>
 29 #include <linux/sysctl.h>
 30 #include <linux/proc_fs.h>
 31 #include <linux/workqueue.h>
 32 #include <linux/swap.h>
 33 #include <linux/seq_file.h>
 34 #include <linux/slab.h>
 35 
 36 #include <linux/netfilter.h>
 37 #include <linux/netfilter_ipv4.h>
 38 #include <linux/mutex.h>
 39 
 40 #include <net/net_namespace.h>
 41 #include <linux/nsproxy.h>
 42 #include <net/ip.h>
 43 #ifdef CONFIG_IP_VS_IPV6
 44 #include <net/ipv6.h>
 45 #include <net/ip6_route.h>
 46 #endif
 47 #include <net/route.h>
 48 #include <net/sock.h>
 49 #include <net/genetlink.h>
 50 
 51 #include <asm/uaccess.h>
 52 
 53 #include <net/ip_vs.h>
 54 
 55 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
 56 static DEFINE_MUTEX(__ip_vs_mutex);
 57 
 58 /* lock for service table */
 59 static DEFINE_RWLOCK(__ip_vs_svc_lock);
 60 
 61 /* sysctl variables */
 62 
 63 #ifdef CONFIG_IP_VS_DEBUG
 64 static int sysctl_ip_vs_debug_level = 0;
 65 
 66 int ip_vs_get_debug_level(void)
 67 {
 68         return sysctl_ip_vs_debug_level;
 69 }
 70 #endif
 71 
 72 
 73 /*  Protos */
 74 static void __ip_vs_del_service(struct ip_vs_service *svc);
 75 
 76 
 77 #ifdef CONFIG_IP_VS_IPV6
 78 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
 79 static int __ip_vs_addr_is_local_v6(struct net *net,
 80                                     const struct in6_addr *addr)
 81 {
 82         struct rt6_info *rt;
 83         struct flowi6 fl6 = {
 84                 .daddr = *addr,
 85         };
 86 
 87         rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
 88         if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
 89                 return 1;
 90 
 91         return 0;
 92 }
 93 #endif
 94 
 95 #ifdef CONFIG_SYSCTL
 96 /*
 97  *      update_defense_level is called from keventd and from sysctl,
 98  *      so it needs to protect itself from softirqs
 99  */
100 static void update_defense_level(struct netns_ipvs *ipvs)
101 {
102         struct sysinfo i;
103         static int old_secure_tcp = 0;
104         int availmem;
105         int nomem;
106         int to_change = -1;
107 
108         /* we only count free and buffered memory (in pages) */
109         si_meminfo(&i);
110         availmem = i.freeram + i.bufferram;
111         /* however in linux 2.5 the i.bufferram is total page cache size,
112            we need adjust it */
113         /* si_swapinfo(&i); */
114         /* availmem = availmem - (i.totalswap - i.freeswap); */
115 
116         nomem = (availmem < ipvs->sysctl_amemthresh);
117 
118         local_bh_disable();
119 
120         /* drop_entry */
121         spin_lock(&ipvs->dropentry_lock);
122         switch (ipvs->sysctl_drop_entry) {
123         case 0:
124                 atomic_set(&ipvs->dropentry, 0);
125                 break;
126         case 1:
127                 if (nomem) {
128                         atomic_set(&ipvs->dropentry, 1);
129                         ipvs->sysctl_drop_entry = 2;
130                 } else {
131                         atomic_set(&ipvs->dropentry, 0);
132                 }
133                 break;
134         case 2:
135                 if (nomem) {
136                         atomic_set(&ipvs->dropentry, 1);
137                 } else {
138                         atomic_set(&ipvs->dropentry, 0);
139                         ipvs->sysctl_drop_entry = 1;
140                 };
141                 break;
142         case 3:
143                 atomic_set(&ipvs->dropentry, 1);
144                 break;
145         }
146         spin_unlock(&ipvs->dropentry_lock);
147 
148         /* drop_packet */
149         spin_lock(&ipvs->droppacket_lock);
150         switch (ipvs->sysctl_drop_packet) {
151         case 0:
152                 ipvs->drop_rate = 0;
153                 break;
154         case 1:
155                 if (nomem) {
156                         ipvs->drop_rate = ipvs->drop_counter
157                                 = ipvs->sysctl_amemthresh /
158                                 (ipvs->sysctl_amemthresh-availmem);
159                         ipvs->sysctl_drop_packet = 2;
160                 } else {
161                         ipvs->drop_rate = 0;
162                 }
163                 break;
164         case 2:
165                 if (nomem) {
166                         ipvs->drop_rate = ipvs->drop_counter
167                                 = ipvs->sysctl_amemthresh /
168                                 (ipvs->sysctl_amemthresh-availmem);
169                 } else {
170                         ipvs->drop_rate = 0;
171                         ipvs->sysctl_drop_packet = 1;
172                 }
173                 break;
174         case 3:
175                 ipvs->drop_rate = ipvs->sysctl_am_droprate;
176                 break;
177         }
178         spin_unlock(&ipvs->droppacket_lock);
179 
180         /* secure_tcp */
181         spin_lock(&ipvs->securetcp_lock);
182         switch (ipvs->sysctl_secure_tcp) {
183         case 0:
184                 if (old_secure_tcp >= 2)
185                         to_change = 0;
186                 break;
187         case 1:
188                 if (nomem) {
189                         if (old_secure_tcp < 2)
190                                 to_change = 1;
191                         ipvs->sysctl_secure_tcp = 2;
192                 } else {
193                         if (old_secure_tcp >= 2)
194                                 to_change = 0;
195                 }
196                 break;
197         case 2:
198                 if (nomem) {
199                         if (old_secure_tcp < 2)
200                                 to_change = 1;
201                 } else {
202                         if (old_secure_tcp >= 2)
203                                 to_change = 0;
204                         ipvs->sysctl_secure_tcp = 1;
205                 }
206                 break;
207         case 3:
208                 if (old_secure_tcp < 2)
209                         to_change = 1;
210                 break;
211         }
212         old_secure_tcp = ipvs->sysctl_secure_tcp;
213         if (to_change >= 0)
214                 ip_vs_protocol_timeout_change(ipvs,
215                                               ipvs->sysctl_secure_tcp > 1);
216         spin_unlock(&ipvs->securetcp_lock);
217 
218         local_bh_enable();
219 }
220 
221 
222 /*
223  *      Timer for checking the defense
224  */
225 #define DEFENSE_TIMER_PERIOD    1*HZ
226 
227 static void defense_work_handler(struct work_struct *work)
228 {
229         struct netns_ipvs *ipvs =
230                 container_of(work, struct netns_ipvs, defense_work.work);
231 
232         update_defense_level(ipvs);
233         if (atomic_read(&ipvs->dropentry))
234                 ip_vs_random_dropentry(ipvs->net);
235         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
236 }
237 #endif
238 
239 int
240 ip_vs_use_count_inc(void)
241 {
242         return try_module_get(THIS_MODULE);
243 }
244 
245 void
246 ip_vs_use_count_dec(void)
247 {
248         module_put(THIS_MODULE);
249 }
250 
251 
252 /*
253  *      Hash table: for virtual service lookups
254  */
255 #define IP_VS_SVC_TAB_BITS 8
256 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
257 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
258 
259 /* the service table hashed by <protocol, addr, port> */
260 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
261 /* the service table hashed by fwmark */
262 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
263 
264 
265 /*
266  *      Returns hash value for virtual service
267  */
268 static inline unsigned
269 ip_vs_svc_hashkey(struct net *net, int af, unsigned proto,
270                   const union nf_inet_addr *addr, __be16 port)
271 {
272         register unsigned porth = ntohs(port);
273         __be32 addr_fold = addr->ip;
274 
275 #ifdef CONFIG_IP_VS_IPV6
276         if (af == AF_INET6)
277                 addr_fold = addr->ip6[0]^addr->ip6[1]^
278                             addr->ip6[2]^addr->ip6[3];
279 #endif
280         addr_fold ^= ((size_t)net>>8);
281 
282         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
283                 & IP_VS_SVC_TAB_MASK;
284 }
285 
286 /*
287  *      Returns hash value of fwmark for virtual service lookup
288  */
289 static inline unsigned ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
290 {
291         return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
292 }
293 
294 /*
295  *      Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
296  *      or in the ip_vs_svc_fwm_table by fwmark.
297  *      Should be called with locked tables.
298  */
299 static int ip_vs_svc_hash(struct ip_vs_service *svc)
300 {
301         unsigned hash;
302 
303         if (svc->flags & IP_VS_SVC_F_HASHED) {
304                 pr_err("%s(): request for already hashed, called from %pF\n",
305                        __func__, __builtin_return_address(0));
306                 return 0;
307         }
308 
309         if (svc->fwmark == 0) {
310                 /*
311                  *  Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
312                  */
313                 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
314                                          &svc->addr, svc->port);
315                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
316         } else {
317                 /*
318                  *  Hash it by fwmark in svc_fwm_table
319                  */
320                 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
321                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
322         }
323 
324         svc->flags |= IP_VS_SVC_F_HASHED;
325         /* increase its refcnt because it is referenced by the svc table */
326         atomic_inc(&svc->refcnt);
327         return 1;
328 }
329 
330 
331 /*
332  *      Unhashes a service from svc_table / svc_fwm_table.
333  *      Should be called with locked tables.
334  */
335 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
336 {
337         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
338                 pr_err("%s(): request for unhash flagged, called from %pF\n",
339                        __func__, __builtin_return_address(0));
340                 return 0;
341         }
342 
343         if (svc->fwmark == 0) {
344                 /* Remove it from the svc_table table */
345                 list_del(&svc->s_list);
346         } else {
347                 /* Remove it from the svc_fwm_table table */
348                 list_del(&svc->f_list);
349         }
350 
351         svc->flags &= ~IP_VS_SVC_F_HASHED;
352         atomic_dec(&svc->refcnt);
353         return 1;
354 }
355 
356 
357 /*
358  *      Get service by {netns, proto,addr,port} in the service table.
359  */
360 static inline struct ip_vs_service *
361 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
362                      const union nf_inet_addr *vaddr, __be16 vport)
363 {
364         unsigned hash;
365         struct ip_vs_service *svc;
366 
367         /* Check for "full" addressed entries */
368         hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
369 
370         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
371                 if ((svc->af == af)
372                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
373                     && (svc->port == vport)
374                     && (svc->protocol == protocol)
375                     && net_eq(svc->net, net)) {
376                         /* HIT */
377                         return svc;
378                 }
379         }
380 
381         return NULL;
382 }
383 
384 
385 /*
386  *      Get service by {fwmark} in the service table.
387  */
388 static inline struct ip_vs_service *
389 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
390 {
391         unsigned hash;
392         struct ip_vs_service *svc;
393 
394         /* Check for fwmark addressed entries */
395         hash = ip_vs_svc_fwm_hashkey(net, fwmark);
396 
397         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
398                 if (svc->fwmark == fwmark && svc->af == af
399                     && net_eq(svc->net, net)) {
400                         /* HIT */
401                         return svc;
402                 }
403         }
404 
405         return NULL;
406 }
407 
408 struct ip_vs_service *
409 ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
410                   const union nf_inet_addr *vaddr, __be16 vport)
411 {
412         struct ip_vs_service *svc;
413         struct netns_ipvs *ipvs = net_ipvs(net);
414 
415         read_lock(&__ip_vs_svc_lock);
416 
417         /*
418          *      Check the table hashed by fwmark first
419          */
420         if (fwmark) {
421                 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
422                 if (svc)
423                         goto out;
424         }
425 
426         /*
427          *      Check the table hashed by <protocol,addr,port>
428          *      for "full" addressed entries
429          */
430         svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
431 
432         if (svc == NULL
433             && protocol == IPPROTO_TCP
434             && atomic_read(&ipvs->ftpsvc_counter)
435             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
436                 /*
437                  * Check if ftp service entry exists, the packet
438                  * might belong to FTP data connections.
439                  */
440                 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
441         }
442 
443         if (svc == NULL
444             && atomic_read(&ipvs->nullsvc_counter)) {
445                 /*
446                  * Check if the catch-all port (port zero) exists
447                  */
448                 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
449         }
450 
451   out:
452         if (svc)
453                 atomic_inc(&svc->usecnt);
454         read_unlock(&__ip_vs_svc_lock);
455 
456         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
457                       fwmark, ip_vs_proto_name(protocol),
458                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
459                       svc ? "hit" : "not hit");
460 
461         return svc;
462 }
463 
464 
465 static inline void
466 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
467 {
468         atomic_inc(&svc->refcnt);
469         dest->svc = svc;
470 }
471 
472 static void
473 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
474 {
475         struct ip_vs_service *svc = dest->svc;
476 
477         dest->svc = NULL;
478         if (atomic_dec_and_test(&svc->refcnt)) {
479                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
480                               svc->fwmark,
481                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
482                               ntohs(svc->port), atomic_read(&svc->usecnt));
483                 free_percpu(svc->stats.cpustats);
484                 kfree(svc);
485         }
486 }
487 
488 
489 /*
490  *      Returns hash value for real service
491  */
492 static inline unsigned ip_vs_rs_hashkey(int af,
493                                             const union nf_inet_addr *addr,
494                                             __be16 port)
495 {
496         register unsigned porth = ntohs(port);
497         __be32 addr_fold = addr->ip;
498 
499 #ifdef CONFIG_IP_VS_IPV6
500         if (af == AF_INET6)
501                 addr_fold = addr->ip6[0]^addr->ip6[1]^
502                             addr->ip6[2]^addr->ip6[3];
503 #endif
504 
505         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
506                 & IP_VS_RTAB_MASK;
507 }
508 
509 /*
510  *      Hashes ip_vs_dest in rs_table by <proto,addr,port>.
511  *      should be called with locked tables.
512  */
513 static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
514 {
515         unsigned hash;
516 
517         if (!list_empty(&dest->d_list)) {
518                 return 0;
519         }
520 
521         /*
522          *      Hash by proto,addr,port,
523          *      which are the parameters of the real service.
524          */
525         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
526 
527         list_add(&dest->d_list, &ipvs->rs_table[hash]);
528 
529         return 1;
530 }
531 
532 /*
533  *      UNhashes ip_vs_dest from rs_table.
534  *      should be called with locked tables.
535  */
536 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
537 {
538         /*
539          * Remove it from the rs_table table.
540          */
541         if (!list_empty(&dest->d_list)) {
542                 list_del(&dest->d_list);
543                 INIT_LIST_HEAD(&dest->d_list);
544         }
545 
546         return 1;
547 }
548 
549 /*
550  *      Lookup real service by <proto,addr,port> in the real service table.
551  */
552 struct ip_vs_dest *
553 ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
554                           const union nf_inet_addr *daddr,
555                           __be16 dport)
556 {
557         struct netns_ipvs *ipvs = net_ipvs(net);
558         unsigned hash;
559         struct ip_vs_dest *dest;
560 
561         /*
562          *      Check for "full" addressed entries
563          *      Return the first found entry
564          */
565         hash = ip_vs_rs_hashkey(af, daddr, dport);
566 
567         read_lock(&ipvs->rs_lock);
568         list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
569                 if ((dest->af == af)
570                     && ip_vs_addr_equal(af, &dest->addr, daddr)
571                     && (dest->port == dport)
572                     && ((dest->protocol == protocol) ||
573                         dest->vfwmark)) {
574                         /* HIT */
575                         read_unlock(&ipvs->rs_lock);
576                         return dest;
577                 }
578         }
579         read_unlock(&ipvs->rs_lock);
580 
581         return NULL;
582 }
583 
584 /*
585  *      Lookup destination by {addr,port} in the given service
586  */
587 static struct ip_vs_dest *
588 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
589                   __be16 dport)
590 {
591         struct ip_vs_dest *dest;
592 
593         /*
594          * Find the destination for the given service
595          */
596         list_for_each_entry(dest, &svc->destinations, n_list) {
597                 if ((dest->af == svc->af)
598                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
599                     && (dest->port == dport)) {
600                         /* HIT */
601                         return dest;
602                 }
603         }
604 
605         return NULL;
606 }
607 
608 /*
609  * Find destination by {daddr,dport,vaddr,protocol}
610  * Cretaed to be used in ip_vs_process_message() in
611  * the backup synchronization daemon. It finds the
612  * destination to be bound to the received connection
613  * on the backup.
614  *
615  * ip_vs_lookup_real_service() looked promissing, but
616  * seems not working as expected.
617  */
618 struct ip_vs_dest *ip_vs_find_dest(struct net  *net, int af,
619                                    const union nf_inet_addr *daddr,
620                                    __be16 dport,
621                                    const union nf_inet_addr *vaddr,
622                                    __be16 vport, __u16 protocol, __u32 fwmark)
623 {
624         struct ip_vs_dest *dest;
625         struct ip_vs_service *svc;
626 
627         svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
628         if (!svc)
629                 return NULL;
630         dest = ip_vs_lookup_dest(svc, daddr, dport);
631         if (dest)
632                 atomic_inc(&dest->refcnt);
633         ip_vs_service_put(svc);
634         return dest;
635 }
636 
637 /*
638  *  Lookup dest by {svc,addr,port} in the destination trash.
639  *  The destination trash is used to hold the destinations that are removed
640  *  from the service table but are still referenced by some conn entries.
641  *  The reason to add the destination trash is when the dest is temporary
642  *  down (either by administrator or by monitor program), the dest can be
643  *  picked back from the trash, the remaining connections to the dest can
644  *  continue, and the counting information of the dest is also useful for
645  *  scheduling.
646  */
647 static struct ip_vs_dest *
648 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
649                      __be16 dport)
650 {
651         struct ip_vs_dest *dest, *nxt;
652         struct netns_ipvs *ipvs = net_ipvs(svc->net);
653 
654         /*
655          * Find the destination in trash
656          */
657         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
658                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
659                               "dest->refcnt=%d\n",
660                               dest->vfwmark,
661                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
662                               ntohs(dest->port),
663                               atomic_read(&dest->refcnt));
664                 if (dest->af == svc->af &&
665                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
666                     dest->port == dport &&
667                     dest->vfwmark == svc->fwmark &&
668                     dest->protocol == svc->protocol &&
669                     (svc->fwmark ||
670                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
671                       dest->vport == svc->port))) {
672                         /* HIT */
673                         return dest;
674                 }
675 
676                 /*
677                  * Try to purge the destination from trash if not referenced
678                  */
679                 if (atomic_read(&dest->refcnt) == 1) {
680                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
681                                       "from trash\n",
682                                       dest->vfwmark,
683                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
684                                       ntohs(dest->port));
685                         list_del(&dest->n_list);
686                         ip_vs_dst_reset(dest);
687                         __ip_vs_unbind_svc(dest);
688                         free_percpu(dest->stats.cpustats);
689                         kfree(dest);
690                 }
691         }
692 
693         return NULL;
694 }
695 
696 
697 /*
698  *  Clean up all the destinations in the trash
699  *  Called by the ip_vs_control_cleanup()
700  *
701  *  When the ip_vs_control_clearup is activated by ipvs module exit,
702  *  the service tables must have been flushed and all the connections
703  *  are expired, and the refcnt of each destination in the trash must
704  *  be 1, so we simply release them here.
705  */
706 static void ip_vs_trash_cleanup(struct net *net)
707 {
708         struct ip_vs_dest *dest, *nxt;
709         struct netns_ipvs *ipvs = net_ipvs(net);
710 
711         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
712                 list_del(&dest->n_list);
713                 ip_vs_dst_reset(dest);
714                 __ip_vs_unbind_svc(dest);
715                 free_percpu(dest->stats.cpustats);
716                 kfree(dest);
717         }
718 }
719 
720 static void
721 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
722 {
723 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
724 
725         spin_lock_bh(&src->lock);
726 
727         IP_VS_SHOW_STATS_COUNTER(conns);
728         IP_VS_SHOW_STATS_COUNTER(inpkts);
729         IP_VS_SHOW_STATS_COUNTER(outpkts);
730         IP_VS_SHOW_STATS_COUNTER(inbytes);
731         IP_VS_SHOW_STATS_COUNTER(outbytes);
732 
733         ip_vs_read_estimator(dst, src);
734 
735         spin_unlock_bh(&src->lock);
736 }
737 
738 static void
739 ip_vs_zero_stats(struct ip_vs_stats *stats)
740 {
741         spin_lock_bh(&stats->lock);
742 
743         /* get current counters as zero point, rates are zeroed */
744 
745 #define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
746 
747         IP_VS_ZERO_STATS_COUNTER(conns);
748         IP_VS_ZERO_STATS_COUNTER(inpkts);
749         IP_VS_ZERO_STATS_COUNTER(outpkts);
750         IP_VS_ZERO_STATS_COUNTER(inbytes);
751         IP_VS_ZERO_STATS_COUNTER(outbytes);
752 
753         ip_vs_zero_estimator(stats);
754 
755         spin_unlock_bh(&stats->lock);
756 }
757 
758 /*
759  *      Update a destination in the given service
760  */
761 static void
762 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
763                     struct ip_vs_dest_user_kern *udest, int add)
764 {
765         struct netns_ipvs *ipvs = net_ipvs(svc->net);
766         int conn_flags;
767 
768         /* set the weight and the flags */
769         atomic_set(&dest->weight, udest->weight);
770         conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
771         conn_flags |= IP_VS_CONN_F_INACTIVE;
772 
773         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
774         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
775                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
776         } else {
777                 /*
778                  *    Put the real service in rs_table if not present.
779                  *    For now only for NAT!
780                  */
781                 write_lock_bh(&ipvs->rs_lock);
782                 ip_vs_rs_hash(ipvs, dest);
783                 write_unlock_bh(&ipvs->rs_lock);
784         }
785         atomic_set(&dest->conn_flags, conn_flags);
786 
787         /* bind the service */
788         if (!dest->svc) {
789                 __ip_vs_bind_svc(dest, svc);
790         } else {
791                 if (dest->svc != svc) {
792                         __ip_vs_unbind_svc(dest);
793                         ip_vs_zero_stats(&dest->stats);
794                         __ip_vs_bind_svc(dest, svc);
795                 }
796         }
797 
798         /* set the dest status flags */
799         dest->flags |= IP_VS_DEST_F_AVAILABLE;
800 
801         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
802                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
803         dest->u_threshold = udest->u_threshold;
804         dest->l_threshold = udest->l_threshold;
805 
806         spin_lock_bh(&dest->dst_lock);
807         ip_vs_dst_reset(dest);
808         spin_unlock_bh(&dest->dst_lock);
809 
810         if (add)
811                 ip_vs_start_estimator(svc->net, &dest->stats);
812 
813         write_lock_bh(&__ip_vs_svc_lock);
814 
815         /* Wait until all other svc users go away */
816         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
817 
818         if (add) {
819                 list_add(&dest->n_list, &svc->destinations);
820                 svc->num_dests++;
821         }
822 
823         /* call the update_service, because server weight may be changed */
824         if (svc->scheduler->update_service)
825                 svc->scheduler->update_service(svc);
826 
827         write_unlock_bh(&__ip_vs_svc_lock);
828 }
829 
830 
831 /*
832  *      Create a destination for the given service
833  */
834 static int
835 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
836                struct ip_vs_dest **dest_p)
837 {
838         struct ip_vs_dest *dest;
839         unsigned atype;
840 
841         EnterFunction(2);
842 
843 #ifdef CONFIG_IP_VS_IPV6
844         if (svc->af == AF_INET6) {
845                 atype = ipv6_addr_type(&udest->addr.in6);
846                 if ((!(atype & IPV6_ADDR_UNICAST) ||
847                         atype & IPV6_ADDR_LINKLOCAL) &&
848                         !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
849                         return -EINVAL;
850         } else
851 #endif
852         {
853                 atype = inet_addr_type(svc->net, udest->addr.ip);
854                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
855                         return -EINVAL;
856         }
857 
858         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
859         if (dest == NULL) {
860                 pr_err("%s(): no memory.\n", __func__);
861                 return -ENOMEM;
862         }
863         dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
864         if (!dest->stats.cpustats) {
865                 pr_err("%s() alloc_percpu failed\n", __func__);
866                 goto err_alloc;
867         }
868 
869         dest->af = svc->af;
870         dest->protocol = svc->protocol;
871         dest->vaddr = svc->addr;
872         dest->vport = svc->port;
873         dest->vfwmark = svc->fwmark;
874         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
875         dest->port = udest->port;
876 
877         atomic_set(&dest->activeconns, 0);
878         atomic_set(&dest->inactconns, 0);
879         atomic_set(&dest->persistconns, 0);
880         atomic_set(&dest->refcnt, 1);
881 
882         INIT_LIST_HEAD(&dest->d_list);
883         spin_lock_init(&dest->dst_lock);
884         spin_lock_init(&dest->stats.lock);
885         __ip_vs_update_dest(svc, dest, udest, 1);
886 
887         *dest_p = dest;
888 
889         LeaveFunction(2);
890         return 0;
891 
892 err_alloc:
893         kfree(dest);
894         return -ENOMEM;
895 }
896 
897 
898 /*
899  *      Add a destination into an existing service
900  */
901 static int
902 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
903 {
904         struct ip_vs_dest *dest;
905         union nf_inet_addr daddr;
906         __be16 dport = udest->port;
907         int ret;
908 
909         EnterFunction(2);
910 
911         if (udest->weight < 0) {
912                 pr_err("%s(): server weight less than zero\n", __func__);
913                 return -ERANGE;
914         }
915 
916         if (udest->l_threshold > udest->u_threshold) {
917                 pr_err("%s(): lower threshold is higher than upper threshold\n",
918                         __func__);
919                 return -ERANGE;
920         }
921 
922         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
923 
924         /*
925          * Check if the dest already exists in the list
926          */
927         dest = ip_vs_lookup_dest(svc, &daddr, dport);
928 
929         if (dest != NULL) {
930                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
931                 return -EEXIST;
932         }
933 
934         /*
935          * Check if the dest already exists in the trash and
936          * is from the same service
937          */
938         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
939 
940         if (dest != NULL) {
941                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
942                               "dest->refcnt=%d, service %u/%s:%u\n",
943                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
944                               atomic_read(&dest->refcnt),
945                               dest->vfwmark,
946                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
947                               ntohs(dest->vport));
948 
949                 /*
950                  * Get the destination from the trash
951                  */
952                 list_del(&dest->n_list);
953 
954                 __ip_vs_update_dest(svc, dest, udest, 1);
955                 ret = 0;
956         } else {
957                 /*
958                  * Allocate and initialize the dest structure
959                  */
960                 ret = ip_vs_new_dest(svc, udest, &dest);
961         }
962         LeaveFunction(2);
963 
964         return ret;
965 }
966 
967 
968 /*
969  *      Edit a destination in the given service
970  */
971 static int
972 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
973 {
974         struct ip_vs_dest *dest;
975         union nf_inet_addr daddr;
976         __be16 dport = udest->port;
977 
978         EnterFunction(2);
979 
980         if (udest->weight < 0) {
981                 pr_err("%s(): server weight less than zero\n", __func__);
982                 return -ERANGE;
983         }
984 
985         if (udest->l_threshold > udest->u_threshold) {
986                 pr_err("%s(): lower threshold is higher than upper threshold\n",
987                         __func__);
988                 return -ERANGE;
989         }
990 
991         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
992 
993         /*
994          *  Lookup the destination list
995          */
996         dest = ip_vs_lookup_dest(svc, &daddr, dport);
997 
998         if (dest == NULL) {
999                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1000                 return -ENOENT;
1001         }
1002 
1003         __ip_vs_update_dest(svc, dest, udest, 0);
1004         LeaveFunction(2);
1005 
1006         return 0;
1007 }
1008 
1009 
1010 /*
1011  *      Delete a destination (must be already unlinked from the service)
1012  */
1013 static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1014 {
1015         struct netns_ipvs *ipvs = net_ipvs(net);
1016 
1017         ip_vs_stop_estimator(net, &dest->stats);
1018 
1019         /*
1020          *  Remove it from the d-linked list with the real services.
1021          */
1022         write_lock_bh(&ipvs->rs_lock);
1023         ip_vs_rs_unhash(dest);
1024         write_unlock_bh(&ipvs->rs_lock);
1025 
1026         /*
1027          *  Decrease the refcnt of the dest, and free the dest
1028          *  if nobody refers to it (refcnt=0). Otherwise, throw
1029          *  the destination into the trash.
1030          */
1031         if (atomic_dec_and_test(&dest->refcnt)) {
1032                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1033                               dest->vfwmark,
1034                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1035                               ntohs(dest->port));
1036                 ip_vs_dst_reset(dest);
1037                 /* simply decrease svc->refcnt here, let the caller check
1038                    and release the service if nobody refers to it.
1039                    Only user context can release destination and service,
1040                    and only one user context can update virtual service at a
1041                    time, so the operation here is OK */
1042                 atomic_dec(&dest->svc->refcnt);
1043                 free_percpu(dest->stats.cpustats);
1044                 kfree(dest);
1045         } else {
1046                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1047                               "dest->refcnt=%d\n",
1048                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1049                               ntohs(dest->port),
1050                               atomic_read(&dest->refcnt));
1051                 list_add(&dest->n_list, &ipvs->dest_trash);
1052                 atomic_inc(&dest->refcnt);
1053         }
1054 }
1055 
1056 
1057 /*
1058  *      Unlink a destination from the given service
1059  */
1060 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1061                                 struct ip_vs_dest *dest,
1062                                 int svcupd)
1063 {
1064         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1065 
1066         /*
1067          *  Remove it from the d-linked destination list.
1068          */
1069         list_del(&dest->n_list);
1070         svc->num_dests--;
1071 
1072         /*
1073          *  Call the update_service function of its scheduler
1074          */
1075         if (svcupd && svc->scheduler->update_service)
1076                         svc->scheduler->update_service(svc);
1077 }
1078 
1079 
1080 /*
1081  *      Delete a destination server in the given service
1082  */
1083 static int
1084 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1085 {
1086         struct ip_vs_dest *dest;
1087         __be16 dport = udest->port;
1088 
1089         EnterFunction(2);
1090 
1091         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1092 
1093         if (dest == NULL) {
1094                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1095                 return -ENOENT;
1096         }
1097 
1098         write_lock_bh(&__ip_vs_svc_lock);
1099 
1100         /*
1101          *      Wait until all other svc users go away.
1102          */
1103         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1104 
1105         /*
1106          *      Unlink dest from the service
1107          */
1108         __ip_vs_unlink_dest(svc, dest, 1);
1109 
1110         write_unlock_bh(&__ip_vs_svc_lock);
1111 
1112         /*
1113          *      Delete the destination
1114          */
1115         __ip_vs_del_dest(svc->net, dest);
1116 
1117         LeaveFunction(2);
1118 
1119         return 0;
1120 }
1121 
1122 
1123 /*
1124  *      Add a service into the service hash table
1125  */
1126 static int
1127 ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
1128                   struct ip_vs_service **svc_p)
1129 {
1130         int ret = 0;
1131         struct ip_vs_scheduler *sched = NULL;
1132         struct ip_vs_pe *pe = NULL;
1133         struct ip_vs_service *svc = NULL;
1134         struct netns_ipvs *ipvs = net_ipvs(net);
1135 
1136         /* increase the module use count */
1137         ip_vs_use_count_inc();
1138 
1139         /* Lookup the scheduler by 'u->sched_name' */
1140         sched = ip_vs_scheduler_get(u->sched_name);
1141         if (sched == NULL) {
1142                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1143                 ret = -ENOENT;
1144                 goto out_err;
1145         }
1146 
1147         if (u->pe_name && *u->pe_name) {
1148                 pe = ip_vs_pe_getbyname(u->pe_name);
1149                 if (pe == NULL) {
1150                         pr_info("persistence engine module ip_vs_pe_%s "
1151                                 "not found\n", u->pe_name);
1152                         ret = -ENOENT;
1153                         goto out_err;
1154                 }
1155         }
1156 
1157 #ifdef CONFIG_IP_VS_IPV6
1158         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1159                 ret = -EINVAL;
1160                 goto out_err;
1161         }
1162 #endif
1163 
1164         svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1165         if (svc == NULL) {
1166                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1167                 ret = -ENOMEM;
1168                 goto out_err;
1169         }
1170         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1171         if (!svc->stats.cpustats) {
1172                 pr_err("%s() alloc_percpu failed\n", __func__);
1173                 goto out_err;
1174         }
1175 
1176         /* I'm the first user of the service */
1177         atomic_set(&svc->usecnt, 0);
1178         atomic_set(&svc->refcnt, 0);
1179 
1180         svc->af = u->af;
1181         svc->protocol = u->protocol;
1182         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1183         svc->port = u->port;
1184         svc->fwmark = u->fwmark;
1185         svc->flags = u->flags;
1186         svc->timeout = u->timeout * HZ;
1187         svc->netmask = u->netmask;
1188         svc->net = net;
1189 
1190         INIT_LIST_HEAD(&svc->destinations);
1191         rwlock_init(&svc->sched_lock);
1192         spin_lock_init(&svc->stats.lock);
1193 
1194         /* Bind the scheduler */
1195         ret = ip_vs_bind_scheduler(svc, sched);
1196         if (ret)
1197                 goto out_err;
1198         sched = NULL;
1199 
1200         /* Bind the ct retriever */
1201         ip_vs_bind_pe(svc, pe);
1202         pe = NULL;
1203 
1204         /* Update the virtual service counters */
1205         if (svc->port == FTPPORT)
1206                 atomic_inc(&ipvs->ftpsvc_counter);
1207         else if (svc->port == 0)
1208                 atomic_inc(&ipvs->nullsvc_counter);
1209 
1210         ip_vs_start_estimator(net, &svc->stats);
1211 
1212         /* Count only IPv4 services for old get/setsockopt interface */
1213         if (svc->af == AF_INET)
1214                 ipvs->num_services++;
1215 
1216         /* Hash the service into the service table */
1217         write_lock_bh(&__ip_vs_svc_lock);
1218         ip_vs_svc_hash(svc);
1219         write_unlock_bh(&__ip_vs_svc_lock);
1220 
1221         *svc_p = svc;
1222         /* Now there is a service - full throttle */
1223         ipvs->enable = 1;
1224         return 0;
1225 
1226 
1227  out_err:
1228         if (svc != NULL) {
1229                 ip_vs_unbind_scheduler(svc);
1230                 if (svc->inc) {
1231                         local_bh_disable();
1232                         ip_vs_app_inc_put(svc->inc);
1233                         local_bh_enable();
1234                 }
1235                 if (svc->stats.cpustats)
1236                         free_percpu(svc->stats.cpustats);
1237                 kfree(svc);
1238         }
1239         ip_vs_scheduler_put(sched);
1240         ip_vs_pe_put(pe);
1241 
1242         /* decrease the module use count */
1243         ip_vs_use_count_dec();
1244 
1245         return ret;
1246 }
1247 
1248 
1249 /*
1250  *      Edit a service and bind it with a new scheduler
1251  */
1252 static int
1253 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1254 {
1255         struct ip_vs_scheduler *sched, *old_sched;
1256         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1257         int ret = 0;
1258 
1259         /*
1260          * Lookup the scheduler, by 'u->sched_name'
1261          */
1262         sched = ip_vs_scheduler_get(u->sched_name);
1263         if (sched == NULL) {
1264                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1265                 return -ENOENT;
1266         }
1267         old_sched = sched;
1268 
1269         if (u->pe_name && *u->pe_name) {
1270                 pe = ip_vs_pe_getbyname(u->pe_name);
1271                 if (pe == NULL) {
1272                         pr_info("persistence engine module ip_vs_pe_%s "
1273                                 "not found\n", u->pe_name);
1274                         ret = -ENOENT;
1275                         goto out;
1276                 }
1277                 old_pe = pe;
1278         }
1279 
1280 #ifdef CONFIG_IP_VS_IPV6
1281         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1282                 ret = -EINVAL;
1283                 goto out;
1284         }
1285 #endif
1286 
1287         write_lock_bh(&__ip_vs_svc_lock);
1288 
1289         /*
1290          * Wait until all other svc users go away.
1291          */
1292         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1293 
1294         /*
1295          * Set the flags and timeout value
1296          */
1297         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1298         svc->timeout = u->timeout * HZ;
1299         svc->netmask = u->netmask;
1300 
1301         old_sched = svc->scheduler;
1302         if (sched != old_sched) {
1303                 /*
1304                  * Unbind the old scheduler
1305                  */
1306                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1307                         old_sched = sched;
1308                         goto out_unlock;
1309                 }
1310 
1311                 /*
1312                  * Bind the new scheduler
1313                  */
1314                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1315                         /*
1316                          * If ip_vs_bind_scheduler fails, restore the old
1317                          * scheduler.
1318                          * The main reason of failure is out of memory.
1319                          *
1320                          * The question is if the old scheduler can be
1321                          * restored all the time. TODO: if it cannot be
1322                          * restored some time, we must delete the service,
1323                          * otherwise the system may crash.
1324                          */
1325                         ip_vs_bind_scheduler(svc, old_sched);
1326                         old_sched = sched;
1327                         goto out_unlock;
1328                 }
1329         }
1330 
1331         old_pe = svc->pe;
1332         if (pe != old_pe) {
1333                 ip_vs_unbind_pe(svc);
1334                 ip_vs_bind_pe(svc, pe);
1335         }
1336 
1337   out_unlock:
1338         write_unlock_bh(&__ip_vs_svc_lock);
1339   out:
1340         ip_vs_scheduler_put(old_sched);
1341         ip_vs_pe_put(old_pe);
1342         return ret;
1343 }
1344 
1345 
1346 /*
1347  *      Delete a service from the service list
1348  *      - The service must be unlinked, unlocked and not referenced!
1349  *      - We are called under _bh lock
1350  */
1351 static void __ip_vs_del_service(struct ip_vs_service *svc)
1352 {
1353         struct ip_vs_dest *dest, *nxt;
1354         struct ip_vs_scheduler *old_sched;
1355         struct ip_vs_pe *old_pe;
1356         struct netns_ipvs *ipvs = net_ipvs(svc->net);
1357 
1358         pr_info("%s: enter\n", __func__);
1359 
1360         /* Count only IPv4 services for old get/setsockopt interface */
1361         if (svc->af == AF_INET)
1362                 ipvs->num_services--;
1363 
1364         ip_vs_stop_estimator(svc->net, &svc->stats);
1365 
1366         /* Unbind scheduler */
1367         old_sched = svc->scheduler;
1368         ip_vs_unbind_scheduler(svc);
1369         ip_vs_scheduler_put(old_sched);
1370 
1371         /* Unbind persistence engine */
1372         old_pe = svc->pe;
1373         ip_vs_unbind_pe(svc);
1374         ip_vs_pe_put(old_pe);
1375 
1376         /* Unbind app inc */
1377         if (svc->inc) {
1378                 ip_vs_app_inc_put(svc->inc);
1379                 svc->inc = NULL;
1380         }
1381 
1382         /*
1383          *    Unlink the whole destination list
1384          */
1385         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1386                 __ip_vs_unlink_dest(svc, dest, 0);
1387                 __ip_vs_del_dest(svc->net, dest);
1388         }
1389 
1390         /*
1391          *    Update the virtual service counters
1392          */
1393         if (svc->port == FTPPORT)
1394                 atomic_dec(&ipvs->ftpsvc_counter);
1395         else if (svc->port == 0)
1396                 atomic_dec(&ipvs->nullsvc_counter);
1397 
1398         /*
1399          *    Free the service if nobody refers to it
1400          */
1401         if (atomic_read(&svc->refcnt) == 0) {
1402                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1403                               svc->fwmark,
1404                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
1405                               ntohs(svc->port), atomic_read(&svc->usecnt));
1406                 free_percpu(svc->stats.cpustats);
1407                 kfree(svc);
1408         }
1409 
1410         /* decrease the module use count */
1411         ip_vs_use_count_dec();
1412 }
1413 
1414 /*
1415  * Unlink a service from list and try to delete it if its refcnt reached 0
1416  */
1417 static void ip_vs_unlink_service(struct ip_vs_service *svc)
1418 {
1419         /*
1420          * Unhash it from the service table
1421          */
1422         write_lock_bh(&__ip_vs_svc_lock);
1423 
1424         ip_vs_svc_unhash(svc);
1425 
1426         /*
1427          * Wait until all the svc users go away.
1428          */
1429         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1430 
1431         __ip_vs_del_service(svc);
1432 
1433         write_unlock_bh(&__ip_vs_svc_lock);
1434 }
1435 
1436 /*
1437  *      Delete a service from the service list
1438  */
1439 static int ip_vs_del_service(struct ip_vs_service *svc)
1440 {
1441         if (svc == NULL)
1442                 return -EEXIST;
1443         ip_vs_unlink_service(svc);
1444 
1445         return 0;
1446 }
1447 
1448 
1449 /*
1450  *      Flush all the virtual services
1451  */
1452 static int ip_vs_flush(struct net *net)
1453 {
1454         int idx;
1455         struct ip_vs_service *svc, *nxt;
1456 
1457         /*
1458          * Flush the service table hashed by <netns,protocol,addr,port>
1459          */
1460         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1461                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1462                                          s_list) {
1463                         if (net_eq(svc->net, net))
1464                                 ip_vs_unlink_service(svc);
1465                 }
1466         }
1467 
1468         /*
1469          * Flush the service table hashed by fwmark
1470          */
1471         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1472                 list_for_each_entry_safe(svc, nxt,
1473                                          &ip_vs_svc_fwm_table[idx], f_list) {
1474                         if (net_eq(svc->net, net))
1475                                 ip_vs_unlink_service(svc);
1476                 }
1477         }
1478 
1479         return 0;
1480 }
1481 
1482 /*
1483  *      Delete service by {netns} in the service table.
1484  *      Called by __ip_vs_cleanup()
1485  */
1486 void __ip_vs_service_cleanup(struct net *net)
1487 {
1488         EnterFunction(2);
1489         /* Check for "full" addressed entries */
1490         mutex_lock(&__ip_vs_mutex);
1491         ip_vs_flush(net);
1492         mutex_unlock(&__ip_vs_mutex);
1493         LeaveFunction(2);
1494 }
1495 /*
1496  * Release dst hold by dst_cache
1497  */
1498 static inline void
1499 __ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1500 {
1501         spin_lock_bh(&dest->dst_lock);
1502         if (dest->dst_cache && dest->dst_cache->dev == dev) {
1503                 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1504                               dev->name,
1505                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1506                               ntohs(dest->port),
1507                               atomic_read(&dest->refcnt));
1508                 ip_vs_dst_reset(dest);
1509         }
1510         spin_unlock_bh(&dest->dst_lock);
1511 
1512 }
1513 /*
1514  * Netdev event receiver
1515  * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1516  * a device that is "unregister" it must be released.
1517  */
1518 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1519                             void *ptr)
1520 {
1521         struct net_device *dev = ptr;
1522         struct net *net = dev_net(dev);
1523         struct netns_ipvs *ipvs = net_ipvs(net);
1524         struct ip_vs_service *svc;
1525         struct ip_vs_dest *dest;
1526         unsigned int idx;
1527 
1528         if (event != NETDEV_UNREGISTER || !ipvs)
1529                 return NOTIFY_DONE;
1530         IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1531         EnterFunction(2);
1532         mutex_lock(&__ip_vs_mutex);
1533         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1534                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1535                         if (net_eq(svc->net, net)) {
1536                                 list_for_each_entry(dest, &svc->destinations,
1537                                                     n_list) {
1538                                         __ip_vs_dev_reset(dest, dev);
1539                                 }
1540                         }
1541                 }
1542 
1543                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1544                         if (net_eq(svc->net, net)) {
1545                                 list_for_each_entry(dest, &svc->destinations,
1546                                                     n_list) {
1547                                         __ip_vs_dev_reset(dest, dev);
1548                                 }
1549                         }
1550 
1551                 }
1552         }
1553 
1554         list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
1555                 __ip_vs_dev_reset(dest, dev);
1556         }
1557         mutex_unlock(&__ip_vs_mutex);
1558         LeaveFunction(2);
1559         return NOTIFY_DONE;
1560 }
1561 
1562 /*
1563  *      Zero counters in a service or all services
1564  */
1565 static int ip_vs_zero_service(struct ip_vs_service *svc)
1566 {
1567         struct ip_vs_dest *dest;
1568 
1569         write_lock_bh(&__ip_vs_svc_lock);
1570         list_for_each_entry(dest, &svc->destinations, n_list) {
1571                 ip_vs_zero_stats(&dest->stats);
1572         }
1573         ip_vs_zero_stats(&svc->stats);
1574         write_unlock_bh(&__ip_vs_svc_lock);
1575         return 0;
1576 }
1577 
1578 static int ip_vs_zero_all(struct net *net)
1579 {
1580         int idx;
1581         struct ip_vs_service *svc;
1582 
1583         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1584                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1585                         if (net_eq(svc->net, net))
1586                                 ip_vs_zero_service(svc);
1587                 }
1588         }
1589 
1590         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1591                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1592                         if (net_eq(svc->net, net))
1593                                 ip_vs_zero_service(svc);
1594                 }
1595         }
1596 
1597         ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1598         return 0;
1599 }
1600 
1601 #ifdef CONFIG_SYSCTL
1602 static int
1603 proc_do_defense_mode(ctl_table *table, int write,
1604                      void __user *buffer, size_t *lenp, loff_t *ppos)
1605 {
1606         struct net *net = current->nsproxy->net_ns;
1607         int *valp = table->data;
1608         int val = *valp;
1609         int rc;
1610 
1611         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1612         if (write && (*valp != val)) {
1613                 if ((*valp < 0) || (*valp > 3)) {
1614                         /* Restore the correct value */
1615                         *valp = val;
1616                 } else {
1617                         update_defense_level(net_ipvs(net));
1618                 }
1619         }
1620         return rc;
1621 }
1622 
1623 static int
1624 proc_do_sync_threshold(ctl_table *table, int write,
1625                        void __user *buffer, size_t *lenp, loff_t *ppos)
1626 {
1627         int *valp = table->data;
1628         int val[2];
1629         int rc;
1630 
1631         /* backup the value first */
1632         memcpy(val, valp, sizeof(val));
1633 
1634         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1635         if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1636                 /* Restore the correct value */
1637                 memcpy(valp, val, sizeof(val));
1638         }
1639         return rc;
1640 }
1641 
1642 static int
1643 proc_do_sync_mode(ctl_table *table, int write,
1644                      void __user *buffer, size_t *lenp, loff_t *ppos)
1645 {
1646         int *valp = table->data;
1647         int val = *valp;
1648         int rc;
1649 
1650         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1651         if (write && (*valp != val)) {
1652                 if ((*valp < 0) || (*valp > 1)) {
1653                         /* Restore the correct value */
1654                         *valp = val;
1655                 } else {
1656                         struct net *net = current->nsproxy->net_ns;
1657                         ip_vs_sync_switch_mode(net, val);
1658                 }
1659         }
1660         return rc;
1661 }
1662 
1663 /*
1664  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1665  *      Do not change order or insert new entries without
1666  *      align with netns init in __ip_vs_control_init()
1667  */
1668 
1669 static struct ctl_table vs_vars[] = {
1670         {
1671                 .procname       = "amemthresh",
1672                 .maxlen         = sizeof(int),
1673                 .mode           = 0644,
1674                 .proc_handler   = proc_dointvec,
1675         },
1676         {
1677                 .procname       = "am_droprate",
1678                 .maxlen         = sizeof(int),
1679                 .mode           = 0644,
1680                 .proc_handler   = proc_dointvec,
1681         },
1682         {
1683                 .procname       = "drop_entry",
1684                 .maxlen         = sizeof(int),
1685                 .mode           = 0644,
1686                 .proc_handler   = proc_do_defense_mode,
1687         },
1688         {
1689                 .procname       = "drop_packet",
1690                 .maxlen         = sizeof(int),
1691                 .mode           = 0644,
1692                 .proc_handler   = proc_do_defense_mode,
1693         },
1694 #ifdef CONFIG_IP_VS_NFCT
1695         {
1696                 .procname       = "conntrack",
1697                 .maxlen         = sizeof(int),
1698                 .mode           = 0644,
1699                 .proc_handler   = &proc_dointvec,
1700         },
1701 #endif
1702         {
1703                 .procname       = "secure_tcp",
1704                 .maxlen         = sizeof(int),
1705                 .mode           = 0644,
1706                 .proc_handler   = proc_do_defense_mode,
1707         },
1708         {
1709                 .procname       = "snat_reroute",
1710                 .maxlen         = sizeof(int),
1711                 .mode           = 0644,
1712                 .proc_handler   = &proc_dointvec,
1713         },
1714         {
1715                 .procname       = "sync_version",
1716                 .maxlen         = sizeof(int),
1717                 .mode           = 0644,
1718                 .proc_handler   = &proc_do_sync_mode,
1719         },
1720         {
1721                 .procname       = "cache_bypass",
1722                 .maxlen         = sizeof(int),
1723                 .mode           = 0644,
1724                 .proc_handler   = proc_dointvec,
1725         },
1726         {
1727                 .procname       = "expire_nodest_conn",
1728                 .maxlen         = sizeof(int),
1729                 .mode           = 0644,
1730                 .proc_handler   = proc_dointvec,
1731         },
1732         {
1733                 .procname       = "expire_quiescent_template",
1734                 .maxlen         = sizeof(int),
1735                 .mode           = 0644,
1736                 .proc_handler   = proc_dointvec,
1737         },
1738         {
1739                 .procname       = "sync_threshold",
1740                 .maxlen         =
1741                         sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1742                 .mode           = 0644,
1743                 .proc_handler   = proc_do_sync_threshold,
1744         },
1745         {
1746                 .procname       = "nat_icmp_send",
1747                 .maxlen         = sizeof(int),
1748                 .mode           = 0644,
1749                 .proc_handler   = proc_dointvec,
1750         },
1751 #ifdef CONFIG_IP_VS_DEBUG
1752         {
1753                 .procname       = "debug_level",
1754                 .data           = &sysctl_ip_vs_debug_level,
1755                 .maxlen         = sizeof(int),
1756                 .mode           = 0644,
1757                 .proc_handler   = proc_dointvec,
1758         },
1759 #endif
1760 #if 0
1761         {
1762                 .procname       = "timeout_established",
1763                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1764                 .maxlen         = sizeof(int),
1765                 .mode           = 0644,
1766                 .proc_handler   = proc_dointvec_jiffies,
1767         },
1768         {
1769                 .procname       = "timeout_synsent",
1770                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1771                 .maxlen         = sizeof(int),
1772                 .mode           = 0644,
1773                 .proc_handler   = proc_dointvec_jiffies,
1774         },
1775         {
1776                 .procname       = "timeout_synrecv",
1777                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1778                 .maxlen         = sizeof(int),
1779                 .mode           = 0644,
1780                 .proc_handler   = proc_dointvec_jiffies,
1781         },
1782         {
1783                 .procname       = "timeout_finwait",
1784                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1785                 .maxlen         = sizeof(int),
1786                 .mode           = 0644,
1787                 .proc_handler   = proc_dointvec_jiffies,
1788         },
1789         {
1790                 .procname       = "timeout_timewait",
1791                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1792                 .maxlen         = sizeof(int),
1793                 .mode           = 0644,
1794                 .proc_handler   = proc_dointvec_jiffies,
1795         },
1796         {
1797                 .procname       = "timeout_close",
1798                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1799                 .maxlen         = sizeof(int),
1800                 .mode           = 0644,
1801                 .proc_handler   = proc_dointvec_jiffies,
1802         },
1803         {
1804                 .procname       = "timeout_closewait",
1805                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1806                 .maxlen         = sizeof(int),
1807                 .mode           = 0644,
1808                 .proc_handler   = proc_dointvec_jiffies,
1809         },
1810         {
1811                 .procname       = "timeout_lastack",
1812                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1813                 .maxlen         = sizeof(int),
1814                 .mode           = 0644,
1815                 .proc_handler   = proc_dointvec_jiffies,
1816         },
1817         {
1818                 .procname       = "timeout_listen",
1819                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1820                 .maxlen         = sizeof(int),
1821                 .mode           = 0644,
1822                 .proc_handler   = proc_dointvec_jiffies,
1823         },
1824         {
1825                 .procname       = "timeout_synack",
1826                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1827                 .maxlen         = sizeof(int),
1828                 .mode           = 0644,
1829                 .proc_handler   = proc_dointvec_jiffies,
1830         },
1831         {
1832                 .procname       = "timeout_udp",
1833                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1834                 .maxlen         = sizeof(int),
1835                 .mode           = 0644,
1836                 .proc_handler   = proc_dointvec_jiffies,
1837         },
1838         {
1839                 .procname       = "timeout_icmp",
1840                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1841                 .maxlen         = sizeof(int),
1842                 .mode           = 0644,
1843                 .proc_handler   = proc_dointvec_jiffies,
1844         },
1845 #endif
1846         { }
1847 };
1848 
1849 const struct ctl_path net_vs_ctl_path[] = {
1850         { .procname = "net", },
1851         { .procname = "ipv4", },
1852         { .procname = "vs", },
1853         { }
1854 };
1855 EXPORT_SYMBOL_GPL(net_vs_ctl_path);
1856 #endif
1857 
1858 #ifdef CONFIG_PROC_FS
1859 
1860 struct ip_vs_iter {
1861         struct seq_net_private p;  /* Do not move this, netns depends upon it*/
1862         struct list_head *table;
1863         int bucket;
1864 };
1865 
1866 /*
1867  *      Write the contents of the VS rule table to a PROCfs file.
1868  *      (It is kept just for backward compatibility)
1869  */
1870 static inline const char *ip_vs_fwd_name(unsigned flags)
1871 {
1872         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1873         case IP_VS_CONN_F_LOCALNODE:
1874                 return "Local";
1875         case IP_VS_CONN_F_TUNNEL:
1876                 return "Tunnel";
1877         case IP_VS_CONN_F_DROUTE:
1878                 return "Route";
1879         default:
1880                 return "Masq";
1881         }
1882 }
1883 
1884 
1885 /* Get the Nth entry in the two lists */
1886 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1887 {
1888         struct net *net = seq_file_net(seq);
1889         struct ip_vs_iter *iter = seq->private;
1890         int idx;
1891         struct ip_vs_service *svc;
1892 
1893         /* look in hash by protocol */
1894         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1895                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1896                         if (net_eq(svc->net, net) && pos-- == 0) {
1897                                 iter->table = ip_vs_svc_table;
1898                                 iter->bucket = idx;
1899                                 return svc;
1900                         }
1901                 }
1902         }
1903 
1904         /* keep looking in fwmark */
1905         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1906                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1907                         if (net_eq(svc->net, net) && pos-- == 0) {
1908                                 iter->table = ip_vs_svc_fwm_table;
1909                                 iter->bucket = idx;
1910                                 return svc;
1911                         }
1912                 }
1913         }
1914 
1915         return NULL;
1916 }
1917 
1918 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1919 __acquires(__ip_vs_svc_lock)
1920 {
1921 
1922         read_lock_bh(&__ip_vs_svc_lock);
1923         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1924 }
1925 
1926 
1927 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1928 {
1929         struct list_head *e;
1930         struct ip_vs_iter *iter;
1931         struct ip_vs_service *svc;
1932 
1933         ++*pos;
1934         if (v == SEQ_START_TOKEN)
1935                 return ip_vs_info_array(seq,0);
1936 
1937         svc = v;
1938         iter = seq->private;
1939 
1940         if (iter->table == ip_vs_svc_table) {
1941                 /* next service in table hashed by protocol */
1942                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1943                         return list_entry(e, struct ip_vs_service, s_list);
1944 
1945 
1946                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1947                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1948                                             s_list) {
1949                                 return svc;
1950                         }
1951                 }
1952 
1953                 iter->table = ip_vs_svc_fwm_table;
1954                 iter->bucket = -1;
1955                 goto scan_fwmark;
1956         }
1957 
1958         /* next service in hashed by fwmark */
1959         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1960                 return list_entry(e, struct ip_vs_service, f_list);
1961 
1962  scan_fwmark:
1963         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1964                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1965                                     f_list)
1966                         return svc;
1967         }
1968 
1969         return NULL;
1970 }
1971 
1972 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
1973 __releases(__ip_vs_svc_lock)
1974 {
1975         read_unlock_bh(&__ip_vs_svc_lock);
1976 }
1977 
1978 
1979 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1980 {
1981         if (v == SEQ_START_TOKEN) {
1982                 seq_printf(seq,
1983                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
1984                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1985                 seq_puts(seq,
1986                          "Prot LocalAddress:Port Scheduler Flags\n");
1987                 seq_puts(seq,
1988                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1989         } else {
1990                 const struct ip_vs_service *svc = v;
1991                 const struct ip_vs_iter *iter = seq->private;
1992                 const struct ip_vs_dest *dest;
1993 
1994                 if (iter->table == ip_vs_svc_table) {
1995 #ifdef CONFIG_IP_VS_IPV6
1996                         if (svc->af == AF_INET6)
1997                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
1998                                            ip_vs_proto_name(svc->protocol),
1999                                            &svc->addr.in6,
2000                                            ntohs(svc->port),
2001                                            svc->scheduler->name);
2002                         else
2003 #endif
2004                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
2005                                            ip_vs_proto_name(svc->protocol),
2006                                            ntohl(svc->addr.ip),
2007                                            ntohs(svc->port),
2008                                            svc->scheduler->name,
2009                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2010                 } else {
2011                         seq_printf(seq, "FWM  %08X %s %s",
2012                                    svc->fwmark, svc->scheduler->name,
2013                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2014                 }
2015 
2016                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2017                         seq_printf(seq, "persistent %d %08X\n",
2018                                 svc->timeout,
2019                                 ntohl(svc->netmask));
2020                 else
2021                         seq_putc(seq, '\n');
2022 
2023                 list_for_each_entry(dest, &svc->destinations, n_list) {
2024 #ifdef CONFIG_IP_VS_IPV6
2025                         if (dest->af == AF_INET6)
2026                                 seq_printf(seq,
2027                                            "  -> [%pI6]:%04X"
2028                                            "      %-7s %-6d %-10d %-10d\n",
2029                                            &dest->addr.in6,
2030                                            ntohs(dest->port),
2031                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2032                                            atomic_read(&dest->weight),
2033                                            atomic_read(&dest->activeconns),
2034                                            atomic_read(&dest->inactconns));
2035                         else
2036 #endif
2037                                 seq_printf(seq,
2038                                            "  -> %08X:%04X      "
2039                                            "%-7s %-6d %-10d %-10d\n",
2040                                            ntohl(dest->addr.ip),
2041                                            ntohs(dest->port),
2042                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2043                                            atomic_read(&dest->weight),
2044                                            atomic_read(&dest->activeconns),
2045                                            atomic_read(&dest->inactconns));
2046 
2047                 }
2048         }
2049         return 0;
2050 }
2051 
2052 static const struct seq_operations ip_vs_info_seq_ops = {
2053         .start = ip_vs_info_seq_start,
2054         .next  = ip_vs_info_seq_next,
2055         .stop  = ip_vs_info_seq_stop,
2056         .show  = ip_vs_info_seq_show,
2057 };
2058 
2059 static int ip_vs_info_open(struct inode *inode, struct file *file)
2060 {
2061         return seq_open_net(inode, file, &ip_vs_info_seq_ops,
2062                         sizeof(struct ip_vs_iter));
2063 }
2064 
2065 static const struct file_operations ip_vs_info_fops = {
2066         .owner   = THIS_MODULE,
2067         .open    = ip_vs_info_open,
2068         .read    = seq_read,
2069         .llseek  = seq_lseek,
2070         .release = seq_release_net,
2071 };
2072 
2073 static int ip_vs_stats_show(struct seq_file *seq, void *v)
2074 {
2075         struct net *net = seq_file_single_net(seq);
2076         struct ip_vs_stats_user show;
2077 
2078 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2079         seq_puts(seq,
2080                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
2081         seq_printf(seq,
2082                    "   Conns  Packets  Packets            Bytes            Bytes\n");
2083 
2084         ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2085         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2086                    show.inpkts, show.outpkts,
2087                    (unsigned long long) show.inbytes,
2088                    (unsigned long long) show.outbytes);
2089 
2090 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2091         seq_puts(seq,
2092                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2093         seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2094                         show.cps, show.inpps, show.outpps,
2095                         show.inbps, show.outbps);
2096 
2097         return 0;
2098 }
2099 
2100 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2101 {
2102         return single_open_net(inode, file, ip_vs_stats_show);
2103 }
2104 
2105 static const struct file_operations ip_vs_stats_fops = {
2106         .owner = THIS_MODULE,
2107         .open = ip_vs_stats_seq_open,
2108         .read = seq_read,
2109         .llseek = seq_lseek,
2110         .release = single_release_net,
2111 };
2112 
2113 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2114 {
2115         struct net *net = seq_file_single_net(seq);
2116         struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2117         struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
2118         struct ip_vs_stats_user rates;
2119         int i;
2120 
2121 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2122         seq_puts(seq,
2123                  "       Total Incoming Outgoing         Incoming         Outgoing\n");
2124         seq_printf(seq,
2125                    "CPU    Conns  Packets  Packets            Bytes            Bytes\n");
2126 
2127         for_each_possible_cpu(i) {
2128                 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2129                 unsigned int start;
2130                 __u64 inbytes, outbytes;
2131 
2132                 do {
2133                         start = u64_stats_fetch_begin_bh(&u->syncp);
2134                         inbytes = u->ustats.inbytes;
2135                         outbytes = u->ustats.outbytes;
2136                 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2137 
2138                 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2139                            i, u->ustats.conns, u->ustats.inpkts,
2140                            u->ustats.outpkts, (__u64)inbytes,
2141                            (__u64)outbytes);
2142         }
2143 
2144         spin_lock_bh(&tot_stats->lock);
2145 
2146         seq_printf(seq, "  ~ %8X %8X %8X %16LX %16LX\n\n",
2147                    tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2148                    tot_stats->ustats.outpkts,
2149                    (unsigned long long) tot_stats->ustats.inbytes,
2150                    (unsigned long long) tot_stats->ustats.outbytes);
2151 
2152         ip_vs_read_estimator(&rates, tot_stats);
2153 
2154         spin_unlock_bh(&tot_stats->lock);
2155 
2156 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2157         seq_puts(seq,
2158                    "     Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2159         seq_printf(seq, "    %8X %8X %8X %16X %16X\n",
2160                         rates.cps,
2161                         rates.inpps,
2162                         rates.outpps,
2163                         rates.inbps,
2164                         rates.outbps);
2165 
2166         return 0;
2167 }
2168 
2169 static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2170 {
2171         return single_open_net(inode, file, ip_vs_stats_percpu_show);
2172 }
2173 
2174 static const struct file_operations ip_vs_stats_percpu_fops = {
2175         .owner = THIS_MODULE,
2176         .open = ip_vs_stats_percpu_seq_open,
2177         .read = seq_read,
2178         .llseek = seq_lseek,
2179         .release = single_release_net,
2180 };
2181 #endif
2182 
2183 /*
2184  *      Set timeout values for tcp tcpfin udp in the timeout_table.
2185  */
2186 static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
2187 {
2188 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2189         struct ip_vs_proto_data *pd;
2190 #endif
2191 
2192         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2193                   u->tcp_timeout,
2194                   u->tcp_fin_timeout,
2195                   u->udp_timeout);
2196 
2197 #ifdef CONFIG_IP_VS_PROTO_TCP
2198         if (u->tcp_timeout) {
2199                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2200                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2201                         = u->tcp_timeout * HZ;
2202         }
2203 
2204         if (u->tcp_fin_timeout) {
2205                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2206                 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2207                         = u->tcp_fin_timeout * HZ;
2208         }
2209 #endif
2210 
2211 #ifdef CONFIG_IP_VS_PROTO_UDP
2212         if (u->udp_timeout) {
2213                 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2214                 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2215                         = u->udp_timeout * HZ;
2216         }
2217 #endif
2218         return 0;
2219 }
2220 
2221 
2222 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2223 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2224 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2225                                  sizeof(struct ip_vs_dest_user))
2226 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2227 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2228 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2229 
2230 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2231         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2232         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2233         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2234         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2235         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2236         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2237         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2238         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2239         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2240         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2241         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2242 };
2243 
2244 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2245                                   struct ip_vs_service_user *usvc_compat)
2246 {
2247         memset(usvc, 0, sizeof(*usvc));
2248 
2249         usvc->af                = AF_INET;
2250         usvc->protocol          = usvc_compat->protocol;
2251         usvc->addr.ip           = usvc_compat->addr;
2252         usvc->port              = usvc_compat->port;
2253         usvc->fwmark            = usvc_compat->fwmark;
2254 
2255         /* Deep copy of sched_name is not needed here */
2256         usvc->sched_name        = usvc_compat->sched_name;
2257 
2258         usvc->flags             = usvc_compat->flags;
2259         usvc->timeout           = usvc_compat->timeout;
2260         usvc->netmask           = usvc_compat->netmask;
2261 }
2262 
2263 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2264                                    struct ip_vs_dest_user *udest_compat)
2265 {
2266         memset(udest, 0, sizeof(*udest));
2267 
2268         udest->addr.ip          = udest_compat->addr;
2269         udest->port             = udest_compat->port;
2270         udest->conn_flags       = udest_compat->conn_flags;
2271         udest->weight           = udest_compat->weight;
2272         udest->u_threshold      = udest_compat->u_threshold;
2273         udest->l_threshold      = udest_compat->l_threshold;
2274 }
2275 
2276 static int
2277 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2278 {
2279         struct net *net = sock_net(sk);
2280         int ret;
2281         unsigned char arg[MAX_ARG_LEN];
2282         struct ip_vs_service_user *usvc_compat;
2283         struct ip_vs_service_user_kern usvc;
2284         struct ip_vs_service *svc;
2285         struct ip_vs_dest_user *udest_compat;
2286         struct ip_vs_dest_user_kern udest;
2287 
2288         if (!capable(CAP_NET_ADMIN))
2289                 return -EPERM;
2290 
2291         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2292                 return -EINVAL;
2293         if (len < 0 || len >  MAX_ARG_LEN)
2294                 return -EINVAL;
2295         if (len != set_arglen[SET_CMDID(cmd)]) {
2296                 pr_err("set_ctl: len %u != %u\n",
2297                        len, set_arglen[SET_CMDID(cmd)]);
2298                 return -EINVAL;
2299         }
2300 
2301         if (copy_from_user(arg, user, len) != 0)
2302                 return -EFAULT;
2303 
2304         /* increase the module use count */
2305         ip_vs_use_count_inc();
2306 
2307         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2308                 ret = -ERESTARTSYS;
2309                 goto out_dec;
2310         }
2311 
2312         if (cmd == IP_VS_SO_SET_FLUSH) {
2313                 /* Flush the virtual service */
2314                 ret = ip_vs_flush(net);
2315                 goto out_unlock;
2316         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2317                 /* Set timeout values for (tcp tcpfin udp) */
2318                 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
2319                 goto out_unlock;
2320         } else if (cmd == IP_VS_SO_SET_STARTDAEMON) {
2321                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2322                 ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2323                                         dm->syncid);
2324                 goto out_unlock;
2325         } else if (cmd == IP_VS_SO_SET_STOPDAEMON) {
2326                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2327                 ret = stop_sync_thread(net, dm->state);
2328                 goto out_unlock;
2329         }
2330 
2331         usvc_compat = (struct ip_vs_service_user *)arg;
2332         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2333 
2334         /* We only use the new structs internally, so copy userspace compat
2335          * structs to extended internal versions */
2336         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2337         ip_vs_copy_udest_compat(&udest, udest_compat);
2338 
2339         if (cmd == IP_VS_SO_SET_ZERO) {
2340                 /* if no service address is set, zero counters in all */
2341                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2342                         ret = ip_vs_zero_all(net);
2343                         goto out_unlock;
2344                 }
2345         }
2346 
2347         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2348         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2349             usvc.protocol != IPPROTO_SCTP) {
2350                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2351                        usvc.protocol, &usvc.addr.ip,
2352                        ntohs(usvc.port), usvc.sched_name);
2353                 ret = -EFAULT;
2354                 goto out_unlock;
2355         }
2356 
2357         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2358         if (usvc.fwmark == 0)
2359                 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
2360                                            &usvc.addr, usvc.port);
2361         else
2362                 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
2363 
2364         if (cmd != IP_VS_SO_SET_ADD
2365             && (svc == NULL || svc->protocol != usvc.protocol)) {
2366                 ret = -ESRCH;
2367                 goto out_unlock;
2368         }
2369 
2370         switch (cmd) {
2371         case IP_VS_SO_SET_ADD:
2372                 if (svc != NULL)
2373                         ret = -EEXIST;
2374                 else
2375                         ret = ip_vs_add_service(net, &usvc, &svc);
2376                 break;
2377         case IP_VS_SO_SET_EDIT:
2378                 ret = ip_vs_edit_service(svc, &usvc);
2379                 break;
2380         case IP_VS_SO_SET_DEL:
2381                 ret = ip_vs_del_service(svc);
2382                 if (!ret)
2383                         goto out_unlock;
2384                 break;
2385         case IP_VS_SO_SET_ZERO:
2386                 ret = ip_vs_zero_service(svc);
2387                 break;
2388         case IP_VS_SO_SET_ADDDEST:
2389                 ret = ip_vs_add_dest(svc, &udest);
2390                 break;
2391         case IP_VS_SO_SET_EDITDEST:
2392                 ret = ip_vs_edit_dest(svc, &udest);
2393                 break;
2394         case IP_VS_SO_SET_DELDEST:
2395                 ret = ip_vs_del_dest(svc, &udest);
2396                 break;
2397         default:
2398                 ret = -EINVAL;
2399         }
2400 
2401   out_unlock:
2402         mutex_unlock(&__ip_vs_mutex);
2403   out_dec:
2404         /* decrease the module use count */
2405         ip_vs_use_count_dec();
2406 
2407         return ret;
2408 }
2409 
2410 
2411 static void
2412 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2413 {
2414         dst->protocol = src->protocol;
2415         dst->addr = src->addr.ip;
2416         dst->port = src->port;
2417         dst->fwmark = src->fwmark;
2418         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2419         dst->flags = src->flags;
2420         dst->timeout = src->timeout / HZ;
2421         dst->netmask = src->netmask;
2422         dst->num_dests = src->num_dests;
2423         ip_vs_copy_stats(&dst->stats, &src->stats);
2424 }
2425 
2426 static inline int
2427 __ip_vs_get_service_entries(struct net *net,
2428                             const struct ip_vs_get_services *get,
2429                             struct ip_vs_get_services __user *uptr)
2430 {
2431         int idx, count=0;
2432         struct ip_vs_service *svc;
2433         struct ip_vs_service_entry entry;
2434         int ret = 0;
2435 
2436         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2437                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2438                         /* Only expose IPv4 entries to old interface */
2439                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2440                                 continue;
2441 
2442                         if (count >= get->num_services)
2443                                 goto out;
2444                         memset(&entry, 0, sizeof(entry));
2445                         ip_vs_copy_service(&entry, svc);
2446                         if (copy_to_user(&uptr->entrytable[count],
2447                                          &entry, sizeof(entry))) {
2448                                 ret = -EFAULT;
2449                                 goto out;
2450                         }
2451                         count++;
2452                 }
2453         }
2454 
2455         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2456                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2457                         /* Only expose IPv4 entries to old interface */
2458                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2459                                 continue;
2460 
2461                         if (count >= get->num_services)
2462                                 goto out;
2463                         memset(&entry, 0, sizeof(entry));
2464                         ip_vs_copy_service(&entry, svc);
2465                         if (copy_to_user(&uptr->entrytable[count],
2466                                          &entry, sizeof(entry))) {
2467                                 ret = -EFAULT;
2468                                 goto out;
2469                         }
2470                         count++;
2471                 }
2472         }
2473   out:
2474         return ret;
2475 }
2476 
2477 static inline int
2478 __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
2479                          struct ip_vs_get_dests __user *uptr)
2480 {
2481         struct ip_vs_service *svc;
2482         union nf_inet_addr addr = { .ip = get->addr };
2483         int ret = 0;
2484 
2485         if (get->fwmark)
2486                 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
2487         else
2488                 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
2489                                            get->port);
2490 
2491         if (svc) {
2492                 int count = 0;
2493                 struct ip_vs_dest *dest;
2494                 struct ip_vs_dest_entry entry;
2495 
2496                 list_for_each_entry(dest, &svc->destinations, n_list) {
2497                         if (count >= get->num_dests)
2498                                 break;
2499 
2500                         entry.addr = dest->addr.ip;
2501                         entry.port = dest->port;
2502                         entry.conn_flags = atomic_read(&dest->conn_flags);
2503                         entry.weight = atomic_read(&dest->weight);
2504                         entry.u_threshold = dest->u_threshold;
2505                         entry.l_threshold = dest->l_threshold;
2506                         entry.activeconns = atomic_read(&dest->activeconns);
2507                         entry.inactconns = atomic_read(&dest->inactconns);
2508                         entry.persistconns = atomic_read(&dest->persistconns);
2509                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2510                         if (copy_to_user(&uptr->entrytable[count],
2511                                          &entry, sizeof(entry))) {
2512                                 ret = -EFAULT;
2513                                 break;
2514                         }
2515                         count++;
2516                 }
2517         } else
2518                 ret = -ESRCH;
2519         return ret;
2520 }
2521 
2522 static inline void
2523 __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
2524 {
2525 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2526         struct ip_vs_proto_data *pd;
2527 #endif
2528 
2529 #ifdef CONFIG_IP_VS_PROTO_TCP
2530         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2531         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2532         u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2533 #endif
2534 #ifdef CONFIG_IP_VS_PROTO_UDP
2535         pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2536         u->udp_timeout =
2537                         pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2538 #endif
2539 }
2540 
2541 
2542 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2543 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2544 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2545 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2546 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2547 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2548 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2549 
2550 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2551         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2552         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2553         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2554         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2555         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2556         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2557         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2558 };
2559 
2560 static int
2561 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2562 {
2563         unsigned char arg[128];
2564         int ret = 0;
2565         unsigned int copylen;
2566         struct net *net = sock_net(sk);
2567         struct netns_ipvs *ipvs = net_ipvs(net);
2568 
2569         BUG_ON(!net);
2570         if (!capable(CAP_NET_ADMIN))
2571                 return -EPERM;
2572 
2573         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2574                 return -EINVAL;
2575 
2576         if (*len < get_arglen[GET_CMDID(cmd)]) {
2577                 pr_err("get_ctl: len %u < %u\n",
2578                        *len, get_arglen[GET_CMDID(cmd)]);
2579                 return -EINVAL;
2580         }
2581 
2582         copylen = get_arglen[GET_CMDID(cmd)];
2583         if (copylen > 128)
2584                 return -EINVAL;
2585 
2586         if (copy_from_user(arg, user, copylen) != 0)
2587                 return -EFAULT;
2588 
2589         if (mutex_lock_interruptible(&__ip_vs_mutex))
2590                 return -ERESTARTSYS;
2591 
2592         switch (cmd) {
2593         case IP_VS_SO_GET_VERSION:
2594         {
2595                 char buf[64];
2596 
2597                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2598                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2599                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2600                         ret = -EFAULT;
2601                         goto out;
2602                 }
2603                 *len = strlen(buf)+1;
2604         }
2605         break;
2606 
2607         case IP_VS_SO_GET_INFO:
2608         {
2609                 struct ip_vs_getinfo info;
2610                 info.version = IP_VS_VERSION_CODE;
2611                 info.size = ip_vs_conn_tab_size;
2612                 info.num_services = ipvs->num_services;
2613                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2614                         ret = -EFAULT;
2615         }
2616         break;
2617 
2618         case IP_VS_SO_GET_SERVICES:
2619         {
2620                 struct ip_vs_get_services *get;
2621                 int size;
2622 
2623                 get = (struct ip_vs_get_services *)arg;
2624                 size = sizeof(*get) +
2625                         sizeof(struct ip_vs_service_entry) * get->num_services;
2626                 if (*len != size) {
2627                         pr_err("length: %u != %u\n", *len, size);
2628                         ret = -EINVAL;
2629                         goto out;
2630                 }
2631                 ret = __ip_vs_get_service_entries(net, get, user);
2632         }
2633         break;
2634 
2635         case IP_VS_SO_GET_SERVICE:
2636         {
2637                 struct ip_vs_service_entry *entry;
2638                 struct ip_vs_service *svc;
2639                 union nf_inet_addr addr;
2640 
2641                 entry = (struct ip_vs_service_entry *)arg;
2642                 addr.ip = entry->addr;
2643                 if (entry->fwmark)
2644                         svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
2645                 else
2646                         svc = __ip_vs_service_find(net, AF_INET,
2647                                                    entry->protocol, &addr,
2648                                                    entry->port);
2649                 if (svc) {
2650                         ip_vs_copy_service(entry, svc);
2651                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2652                                 ret = -EFAULT;
2653                 } else
2654                         ret = -ESRCH;
2655         }
2656         break;
2657 
2658         case IP_VS_SO_GET_DESTS:
2659         {
2660                 struct ip_vs_get_dests *get;
2661                 int size;
2662 
2663                 get = (struct ip_vs_get_dests *)arg;
2664                 size = sizeof(*get) +
2665                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2666                 if (*len != size) {
2667                         pr_err("length: %u != %u\n", *len, size);
2668                         ret = -EINVAL;
2669                         goto out;
2670                 }
2671                 ret = __ip_vs_get_dest_entries(net, get, user);
2672         }
2673         break;
2674 
2675         case IP_VS_SO_GET_TIMEOUT:
2676         {
2677                 struct ip_vs_timeout_user t;
2678 
2679                 memset(&t, 0, sizeof(t));
2680                 __ip_vs_get_timeouts(net, &t);
2681                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2682                         ret = -EFAULT;
2683         }
2684         break;
2685 
2686         case IP_VS_SO_GET_DAEMON:
2687         {
2688                 struct ip_vs_daemon_user d[2];
2689 
2690                 memset(&d, 0, sizeof(d));
2691                 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2692                         d[0].state = IP_VS_STATE_MASTER;
2693                         strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2694                                 sizeof(d[0].mcast_ifn));
2695                         d[0].syncid = ipvs->master_syncid;
2696                 }
2697                 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2698                         d[1].state = IP_VS_STATE_BACKUP;
2699                         strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2700                                 sizeof(d[1].mcast_ifn));
2701                         d[1].syncid = ipvs->backup_syncid;
2702                 }
2703                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2704                         ret = -EFAULT;
2705         }
2706         break;
2707 
2708         default:
2709                 ret = -EINVAL;
2710         }
2711 
2712   out:
2713         mutex_unlock(&__ip_vs_mutex);
2714         return ret;
2715 }
2716 
2717 
2718 static struct nf_sockopt_ops ip_vs_sockopts = {
2719         .pf             = PF_INET,
2720         .set_optmin     = IP_VS_BASE_CTL,
2721         .set_optmax     = IP_VS_SO_SET_MAX+1,
2722         .set            = do_ip_vs_set_ctl,
2723         .get_optmin     = IP_VS_BASE_CTL,
2724         .get_optmax     = IP_VS_SO_GET_MAX+1,
2725         .get            = do_ip_vs_get_ctl,
2726         .owner          = THIS_MODULE,
2727 };
2728 
2729 /*
2730  * Generic Netlink interface
2731  */
2732 
2733 /* IPVS genetlink family */
2734 static struct genl_family ip_vs_genl_family = {
2735         .id             = GENL_ID_GENERATE,
2736         .hdrsize        = 0,
2737         .name           = IPVS_GENL_NAME,
2738         .version        = IPVS_GENL_VERSION,
2739         .maxattr        = IPVS_CMD_MAX,
2740         .netnsok        = true,         /* Make ipvsadm to work on netns */
2741 };
2742 
2743 /* Policy used for first-level command attributes */
2744 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2745         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2746         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2747         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2748         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2749         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2750         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2751 };
2752 
2753 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2754 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2755         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2756         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2757                                             .len = IP_VS_IFNAME_MAXLEN },
2758         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2759 };
2760 
2761 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2762 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2763         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2764         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2765         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2766                                             .len = sizeof(union nf_inet_addr) },
2767         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2768         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2769         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2770                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2771         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
2772                                             .len = IP_VS_PENAME_MAXLEN },
2773         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2774                                             .len = sizeof(struct ip_vs_flags) },
2775         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2776         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2777         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2778 };
2779 
2780 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2781 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2782         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2783                                             .len = sizeof(union nf_inet_addr) },
2784         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2785         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2786         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2787         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2788         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2789         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2790         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2791         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2792         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2793 };
2794 
2795 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2796                                  struct ip_vs_stats *stats)
2797 {
2798         struct ip_vs_stats_user ustats;
2799         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2800         if (!nl_stats)
2801                 return -EMSGSIZE;
2802 
2803         ip_vs_copy_stats(&ustats, stats);
2804 
2805         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns);
2806         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts);
2807         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts);
2808         NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes);
2809         NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes);
2810         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, ustats.cps);
2811         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps);
2812         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps);
2813         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps);
2814         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps);
2815 
2816         nla_nest_end(skb, nl_stats);
2817 
2818         return 0;
2819 
2820 nla_put_failure:
2821         nla_nest_cancel(skb, nl_stats);
2822         return -EMSGSIZE;
2823 }
2824 
2825 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2826                                    struct ip_vs_service *svc)
2827 {
2828         struct nlattr *nl_service;
2829         struct ip_vs_flags flags = { .flags = svc->flags,
2830                                      .mask = ~0 };
2831 
2832         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2833         if (!nl_service)
2834                 return -EMSGSIZE;
2835 
2836         NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
2837 
2838         if (svc->fwmark) {
2839                 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2840         } else {
2841                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2842                 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2843                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2844         }
2845 
2846         NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
2847         if (svc->pe)
2848                 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name);
2849         NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2850         NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2851         NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2852 
2853         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2854                 goto nla_put_failure;
2855 
2856         nla_nest_end(skb, nl_service);
2857 
2858         return 0;
2859 
2860 nla_put_failure:
2861         nla_nest_cancel(skb, nl_service);
2862         return -EMSGSIZE;
2863 }
2864 
2865 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2866                                    struct ip_vs_service *svc,
2867                                    struct netlink_callback *cb)
2868 {
2869         void *hdr;
2870 
2871         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2872                           &ip_vs_genl_family, NLM_F_MULTI,
2873                           IPVS_CMD_NEW_SERVICE);
2874         if (!hdr)
2875                 return -EMSGSIZE;
2876 
2877         if (ip_vs_genl_fill_service(skb, svc) < 0)
2878                 goto nla_put_failure;
2879 
2880         return genlmsg_end(skb, hdr);
2881 
2882 nla_put_failure:
2883         genlmsg_cancel(skb, hdr);
2884         return -EMSGSIZE;
2885 }
2886 
2887 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2888                                     struct netlink_callback *cb)
2889 {
2890         int idx = 0, i;
2891         int start = cb->args[0];
2892         struct ip_vs_service *svc;
2893         struct net *net = skb_sknet(skb);
2894 
2895         mutex_lock(&__ip_vs_mutex);
2896         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2897                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2898                         if (++idx <= start || !net_eq(svc->net, net))
2899                                 continue;
2900                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2901                                 idx--;
2902                                 goto nla_put_failure;
2903                         }
2904                 }
2905         }
2906 
2907         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2908                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2909                         if (++idx <= start || !net_eq(svc->net, net))
2910                                 continue;
2911                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2912                                 idx--;
2913                                 goto nla_put_failure;
2914                         }
2915                 }
2916         }
2917 
2918 nla_put_failure:
2919         mutex_unlock(&__ip_vs_mutex);
2920         cb->args[0] = idx;
2921 
2922         return skb->len;
2923 }
2924 
2925 static int ip_vs_genl_parse_service(struct net *net,
2926                                     struct ip_vs_service_user_kern *usvc,
2927                                     struct nlattr *nla, int full_entry,
2928                                     struct ip_vs_service **ret_svc)
2929 {
2930         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2931         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2932         struct ip_vs_service *svc;
2933 
2934         /* Parse mandatory identifying service fields first */
2935         if (nla == NULL ||
2936             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2937                 return -EINVAL;
2938 
2939         nla_af          = attrs[IPVS_SVC_ATTR_AF];
2940         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
2941         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
2942         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
2943         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
2944 
2945         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2946                 return -EINVAL;
2947 
2948         memset(usvc, 0, sizeof(*usvc));
2949 
2950         usvc->af = nla_get_u16(nla_af);
2951 #ifdef CONFIG_IP_VS_IPV6
2952         if (usvc->af != AF_INET && usvc->af != AF_INET6)
2953 #else
2954         if (usvc->af != AF_INET)
2955 #endif
2956                 return -EAFNOSUPPORT;
2957 
2958         if (nla_fwmark) {
2959                 usvc->protocol = IPPROTO_TCP;
2960                 usvc->fwmark = nla_get_u32(nla_fwmark);
2961         } else {
2962                 usvc->protocol = nla_get_u16(nla_protocol);
2963                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2964                 usvc->port = nla_get_u16(nla_port);
2965                 usvc->fwmark = 0;
2966         }
2967 
2968         if (usvc->fwmark)
2969                 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
2970         else
2971                 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
2972                                            &usvc->addr, usvc->port);
2973         *ret_svc = svc;
2974 
2975         /* If a full entry was requested, check for the additional fields */
2976         if (full_entry) {
2977                 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
2978                               *nla_netmask;
2979                 struct ip_vs_flags flags;
2980 
2981                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
2982                 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
2983                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2984                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2985                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2986 
2987                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
2988                         return -EINVAL;
2989 
2990                 nla_memcpy(&flags, nla_flags, sizeof(flags));
2991 
2992                 /* prefill flags from service if it already exists */
2993                 if (svc)
2994                         usvc->flags = svc->flags;
2995 
2996                 /* set new flags from userland */
2997                 usvc->flags = (usvc->flags & ~flags.mask) |
2998                               (flags.flags & flags.mask);
2999                 usvc->sched_name = nla_data(nla_sched);
3000                 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3001                 usvc->timeout = nla_get_u32(nla_timeout);
3002                 usvc->netmask = nla_get_u32(nla_netmask);
3003         }
3004 
3005         return 0;
3006 }
3007 
3008 static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3009                                                      struct nlattr *nla)
3010 {
3011         struct ip_vs_service_user_kern usvc;
3012         struct ip_vs_service *svc;
3013         int ret;
3014 
3015         ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
3016         return ret ? ERR_PTR(ret) : svc;
3017 }
3018 
3019 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3020 {
3021         struct nlattr *nl_dest;
3022 
3023         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3024         if (!nl_dest)
3025                 return -EMSGSIZE;
3026 
3027         NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
3028         NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
3029 
3030         NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3031                     atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
3032         NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
3033         NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
3034         NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
3035         NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3036                     atomic_read(&dest->activeconns));
3037         NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3038                     atomic_read(&dest->inactconns));
3039         NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3040                     atomic_read(&dest->persistconns));
3041 
3042         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3043                 goto nla_put_failure;
3044 
3045         nla_nest_end(skb, nl_dest);
3046 
3047         return 0;
3048 
3049 nla_put_failure:
3050         nla_nest_cancel(skb, nl_dest);
3051         return -EMSGSIZE;
3052 }
3053 
3054 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3055                                 struct netlink_callback *cb)
3056 {
3057         void *hdr;
3058 
3059         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3060                           &ip_vs_genl_family, NLM_F_MULTI,
3061                           IPVS_CMD_NEW_DEST);
3062         if (!hdr)
3063                 return -EMSGSIZE;
3064 
3065         if (ip_vs_genl_fill_dest(skb, dest) < 0)
3066                 goto nla_put_failure;
3067 
3068         return genlmsg_end(skb, hdr);
3069 
3070 nla_put_failure:
3071         genlmsg_cancel(skb, hdr);
3072         return -EMSGSIZE;
3073 }
3074 
3075 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3076                                  struct netlink_callback *cb)
3077 {
3078         int idx = 0;
3079         int start = cb->args[0];
3080         struct ip_vs_service *svc;
3081         struct ip_vs_dest *dest;
3082         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3083         struct net *net = skb_sknet(skb);
3084 
3085         mutex_lock(&__ip_vs_mutex);
3086 
3087         /* Try to find the service for which to dump destinations */
3088         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3089                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3090                 goto out_err;
3091 
3092 
3093         svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
3094         if (IS_ERR(svc) || svc == NULL)
3095                 goto out_err;
3096 
3097         /* Dump the destinations */
3098         list_for_each_entry(dest, &svc->destinations, n_list) {
3099                 if (++idx <= start)
3100                         continue;
3101                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3102                         idx--;
3103                         goto nla_put_failure;
3104                 }
3105         }
3106 
3107 nla_put_failure:
3108         cb->args[0] = idx;
3109 
3110 out_err:
3111         mutex_unlock(&__ip_vs_mutex);
3112 
3113         return skb->len;
3114 }
3115 
3116 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3117                                  struct nlattr *nla, int full_entry)
3118 {
3119         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3120         struct nlattr *nla_addr, *nla_port;
3121 
3122         /* Parse mandatory identifying destination fields first */
3123         if (nla == NULL ||
3124             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3125                 return -EINVAL;
3126 
3127         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
3128         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
3129 
3130         if (!(nla_addr && nla_port))
3131                 return -EINVAL;
3132 
3133         memset(udest, 0, sizeof(*udest));
3134 
3135         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3136         udest->port = nla_get_u16(nla_port);
3137 
3138         /* If a full entry was requested, check for the additional fields */
3139         if (full_entry) {
3140                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3141                               *nla_l_thresh;
3142 
3143                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3144                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
3145                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
3146                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
3147 
3148                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3149                         return -EINVAL;
3150 
3151                 udest->conn_flags = nla_get_u32(nla_fwd)
3152                                     & IP_VS_CONN_F_FWD_MASK;
3153                 udest->weight = nla_get_u32(nla_weight);
3154                 udest->u_threshold = nla_get_u32(nla_u_thresh);
3155                 udest->l_threshold = nla_get_u32(nla_l_thresh);
3156         }
3157 
3158         return 0;
3159 }
3160 
3161 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3162                                   const char *mcast_ifn, __be32 syncid)
3163 {
3164         struct nlattr *nl_daemon;
3165 
3166         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3167         if (!nl_daemon)
3168                 return -EMSGSIZE;
3169 
3170         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
3171         NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
3172         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
3173 
3174         nla_nest_end(skb, nl_daemon);
3175 
3176         return 0;
3177 
3178 nla_put_failure:
3179         nla_nest_cancel(skb, nl_daemon);
3180         return -EMSGSIZE;
3181 }
3182 
3183 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3184                                   const char *mcast_ifn, __be32 syncid,
3185                                   struct netlink_callback *cb)
3186 {
3187         void *hdr;
3188         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3189                           &ip_vs_genl_family, NLM_F_MULTI,
3190                           IPVS_CMD_NEW_DAEMON);
3191         if (!hdr)
3192                 return -EMSGSIZE;
3193 
3194         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3195                 goto nla_put_failure;
3196 
3197         return genlmsg_end(skb, hdr);
3198 
3199 nla_put_failure:
3200         genlmsg_cancel(skb, hdr);
3201         return -EMSGSIZE;
3202 }
3203 
3204 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3205                                    struct netlink_callback *cb)
3206 {
3207         struct net *net = skb_sknet(skb);
3208         struct netns_ipvs *ipvs = net_ipvs(net);
3209 
3210         mutex_lock(&__ip_vs_mutex);
3211         if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3212                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3213                                            ipvs->master_mcast_ifn,
3214                                            ipvs->master_syncid, cb) < 0)
3215                         goto nla_put_failure;
3216 
3217                 cb->args[0] = 1;
3218         }
3219 
3220         if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3221                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3222                                            ipvs->backup_mcast_ifn,
3223                                            ipvs->backup_syncid, cb) < 0)
3224                         goto nla_put_failure;
3225 
3226                 cb->args[1] = 1;
3227         }
3228 
3229 nla_put_failure:
3230         mutex_unlock(&__ip_vs_mutex);
3231 
3232         return skb->len;
3233 }
3234 
3235 static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
3236 {
3237         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3238               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3239               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3240                 return -EINVAL;
3241 
3242         return start_sync_thread(net,
3243                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3244                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3245                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3246 }
3247 
3248 static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
3249 {
3250         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3251                 return -EINVAL;
3252 
3253         return stop_sync_thread(net,
3254                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3255 }
3256 
3257 static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
3258 {
3259         struct ip_vs_timeout_user t;
3260 
3261         __ip_vs_get_timeouts(net, &t);
3262 
3263         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3264                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3265 
3266         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3267                 t.tcp_fin_timeout =
3268                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3269 
3270         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3271                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3272 
3273         return ip_vs_set_timeout(net, &t);
3274 }
3275 
3276 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3277 {
3278         struct ip_vs_service *svc = NULL;
3279         struct ip_vs_service_user_kern usvc;
3280         struct ip_vs_dest_user_kern udest;
3281         int ret = 0, cmd;
3282         int need_full_svc = 0, need_full_dest = 0;
3283         struct net *net;
3284         struct netns_ipvs *ipvs;
3285 
3286         net = skb_sknet(skb);
3287         ipvs = net_ipvs(net);
3288         cmd = info->genlhdr->cmd;
3289 
3290         mutex_lock(&__ip_vs_mutex);
3291 
3292         if (cmd == IPVS_CMD_FLUSH) {
3293                 ret = ip_vs_flush(net);
3294                 goto out;
3295         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3296                 ret = ip_vs_genl_set_config(net, info->attrs);
3297                 goto out;
3298         } else if (cmd == IPVS_CMD_NEW_DAEMON ||
3299                    cmd == IPVS_CMD_DEL_DAEMON) {
3300 
3301                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3302 
3303                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3304                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3305                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3306                                      ip_vs_daemon_policy)) {
3307                         ret = -EINVAL;
3308                         goto out;
3309                 }
3310 
3311                 if (cmd == IPVS_CMD_NEW_DAEMON)
3312                         ret = ip_vs_genl_new_daemon(net, daemon_attrs);
3313                 else
3314                         ret = ip_vs_genl_del_daemon(net, daemon_attrs);
3315                 goto out;
3316         } else if (cmd == IPVS_CMD_ZERO &&
3317                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3318                 ret = ip_vs_zero_all(net);
3319                 goto out;
3320         }
3321 
3322         /* All following commands require a service argument, so check if we
3323          * received a valid one. We need a full service specification when
3324          * adding / editing a service. Only identifying members otherwise. */
3325         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3326                 need_full_svc = 1;
3327 
3328         ret = ip_vs_genl_parse_service(net, &usvc,
3329                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3330                                        need_full_svc, &svc);
3331         if (ret)
3332                 goto out;
3333 
3334         /* Unless we're adding a new service, the service must already exist */
3335         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3336                 ret = -ESRCH;
3337                 goto out;
3338         }
3339 
3340         /* Destination commands require a valid destination argument. For
3341          * adding / editing a destination, we need a full destination
3342          * specification. */
3343         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3344             cmd == IPVS_CMD_DEL_DEST) {
3345                 if (cmd != IPVS_CMD_DEL_DEST)
3346                         need_full_dest = 1;
3347 
3348                 ret = ip_vs_genl_parse_dest(&udest,
3349                                             info->attrs[IPVS_CMD_ATTR_DEST],
3350                                             need_full_dest);
3351                 if (ret)
3352                         goto out;
3353         }
3354 
3355         switch (cmd) {
3356         case IPVS_CMD_NEW_SERVICE:
3357                 if (svc == NULL)
3358                         ret = ip_vs_add_service(net, &usvc, &svc);
3359                 else
3360                         ret = -EEXIST;
3361                 break;
3362         case IPVS_CMD_SET_SERVICE:
3363                 ret = ip_vs_edit_service(svc, &usvc);
3364                 break;
3365         case IPVS_CMD_DEL_SERVICE:
3366                 ret = ip_vs_del_service(svc);
3367                 /* do not use svc, it can be freed */
3368                 break;
3369         case IPVS_CMD_NEW_DEST:
3370                 ret = ip_vs_add_dest(svc, &udest);
3371                 break;
3372         case IPVS_CMD_SET_DEST:
3373                 ret = ip_vs_edit_dest(svc, &udest);
3374                 break;
3375         case IPVS_CMD_DEL_DEST:
3376                 ret = ip_vs_del_dest(svc, &udest);
3377                 break;
3378         case IPVS_CMD_ZERO:
3379                 ret = ip_vs_zero_service(svc);
3380                 break;
3381         default:
3382                 ret = -EINVAL;
3383         }
3384 
3385 out:
3386         mutex_unlock(&__ip_vs_mutex);
3387 
3388         return ret;
3389 }
3390 
3391 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3392 {
3393         struct sk_buff *msg;
3394         void *reply;
3395         int ret, cmd, reply_cmd;
3396         struct net *net;
3397         struct netns_ipvs *ipvs;
3398 
3399         net = skb_sknet(skb);
3400         ipvs = net_ipvs(net);
3401         cmd = info->genlhdr->cmd;
3402 
3403         if (cmd == IPVS_CMD_GET_SERVICE)
3404                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3405         else if (cmd == IPVS_CMD_GET_INFO)
3406                 reply_cmd = IPVS_CMD_SET_INFO;
3407         else if (cmd == IPVS_CMD_GET_CONFIG)
3408                 reply_cmd = IPVS_CMD_SET_CONFIG;
3409         else {
3410                 pr_err("unknown Generic Netlink command\n");
3411                 return -EINVAL;
3412         }
3413 
3414         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3415         if (!msg)
3416                 return -ENOMEM;
3417 
3418         mutex_lock(&__ip_vs_mutex);
3419 
3420         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3421         if (reply == NULL)
3422                 goto nla_put_failure;
3423 
3424         switch (cmd) {
3425         case IPVS_CMD_GET_SERVICE:
3426         {
3427                 struct ip_vs_service *svc;
3428 
3429                 svc = ip_vs_genl_find_service(net,
3430                                               info->attrs[IPVS_CMD_ATTR_SERVICE]);
3431                 if (IS_ERR(svc)) {
3432                         ret = PTR_ERR(svc);
3433                         goto out_err;
3434                 } else if (svc) {
3435                         ret = ip_vs_genl_fill_service(msg, svc);
3436                         if (ret)
3437                                 goto nla_put_failure;
3438                 } else {
3439                         ret = -ESRCH;
3440                         goto out_err;
3441                 }
3442 
3443                 break;
3444         }
3445 
3446         case IPVS_CMD_GET_CONFIG:
3447         {
3448                 struct ip_vs_timeout_user t;
3449 
3450                 __ip_vs_get_timeouts(net, &t);
3451 #ifdef CONFIG_IP_VS_PROTO_TCP
3452                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3453                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3454                             t.tcp_fin_timeout);
3455 #endif
3456 #ifdef CONFIG_IP_VS_PROTO_UDP
3457                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3458 #endif
3459 
3460                 break;
3461         }
3462 
3463         case IPVS_CMD_GET_INFO:
3464                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3465                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3466                             ip_vs_conn_tab_size);
3467                 break;
3468         }
3469 
3470         genlmsg_end(msg, reply);
3471         ret = genlmsg_reply(msg, info);
3472         goto out;
3473 
3474 nla_put_failure:
3475         pr_err("not enough space in Netlink message\n");
3476         ret = -EMSGSIZE;
3477 
3478 out_err:
3479         nlmsg_free(msg);
3480 out:
3481         mutex_unlock(&__ip_vs_mutex);
3482 
3483         return ret;
3484 }
3485 
3486 
3487 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3488         {
3489                 .cmd    = IPVS_CMD_NEW_SERVICE,
3490                 .flags  = GENL_ADMIN_PERM,
3491                 .policy = ip_vs_cmd_policy,
3492                 .doit   = ip_vs_genl_set_cmd,
3493         },
3494         {
3495                 .cmd    = IPVS_CMD_SET_SERVICE,
3496                 .flags  = GENL_ADMIN_PERM,
3497                 .policy = ip_vs_cmd_policy,
3498                 .doit   = ip_vs_genl_set_cmd,
3499         },
3500         {
3501                 .cmd    = IPVS_CMD_DEL_SERVICE,
3502                 .flags  = GENL_ADMIN_PERM,
3503                 .policy = ip_vs_cmd_policy,
3504                 .doit   = ip_vs_genl_set_cmd,
3505         },
3506         {
3507                 .cmd    = IPVS_CMD_GET_SERVICE,
3508                 .flags  = GENL_ADMIN_PERM,
3509                 .doit   = ip_vs_genl_get_cmd,
3510                 .dumpit = ip_vs_genl_dump_services,
3511                 .policy = ip_vs_cmd_policy,
3512         },
3513         {
3514                 .cmd    = IPVS_CMD_NEW_DEST,
3515                 .flags  = GENL_ADMIN_PERM,
3516                 .policy = ip_vs_cmd_policy,
3517                 .doit   = ip_vs_genl_set_cmd,
3518         },
3519         {
3520                 .cmd    = IPVS_CMD_SET_DEST,
3521                 .flags  = GENL_ADMIN_PERM,
3522                 .policy = ip_vs_cmd_policy,
3523                 .doit   = ip_vs_genl_set_cmd,
3524         },
3525         {
3526                 .cmd    = IPVS_CMD_DEL_DEST,
3527                 .flags  = GENL_ADMIN_PERM,
3528                 .policy = ip_vs_cmd_policy,
3529                 .doit   = ip_vs_genl_set_cmd,
3530         },
3531         {
3532                 .cmd    = IPVS_CMD_GET_DEST,
3533                 .flags  = GENL_ADMIN_PERM,
3534                 .policy = ip_vs_cmd_policy,
3535                 .dumpit = ip_vs_genl_dump_dests,
3536         },
3537         {
3538                 .cmd    = IPVS_CMD_NEW_DAEMON,
3539                 .flags  = GENL_ADMIN_PERM,
3540                 .policy = ip_vs_cmd_policy,
3541                 .doit   = ip_vs_genl_set_cmd,
3542         },
3543         {
3544                 .cmd    = IPVS_CMD_DEL_DAEMON,
3545                 .flags  = GENL_ADMIN_PERM,
3546                 .policy = ip_vs_cmd_policy,
3547                 .doit   = ip_vs_genl_set_cmd,
3548         },
3549         {
3550                 .cmd    = IPVS_CMD_GET_DAEMON,
3551                 .flags  = GENL_ADMIN_PERM,
3552                 .dumpit = ip_vs_genl_dump_daemons,
3553         },
3554         {
3555                 .cmd    = IPVS_CMD_SET_CONFIG,
3556                 .flags  = GENL_ADMIN_PERM,
3557                 .policy = ip_vs_cmd_policy,
3558                 .doit   = ip_vs_genl_set_cmd,
3559         },
3560         {
3561                 .cmd    = IPVS_CMD_GET_CONFIG,
3562                 .flags  = GENL_ADMIN_PERM,
3563                 .doit   = ip_vs_genl_get_cmd,
3564         },
3565         {
3566                 .cmd    = IPVS_CMD_GET_INFO,
3567                 .flags  = GENL_ADMIN_PERM,
3568                 .doit   = ip_vs_genl_get_cmd,
3569         },
3570         {
3571                 .cmd    = IPVS_CMD_ZERO,
3572                 .flags  = GENL_ADMIN_PERM,
3573                 .policy = ip_vs_cmd_policy,
3574                 .doit   = ip_vs_genl_set_cmd,
3575         },
3576         {
3577                 .cmd    = IPVS_CMD_FLUSH,
3578                 .flags  = GENL_ADMIN_PERM,
3579                 .doit   = ip_vs_genl_set_cmd,
3580         },
3581 };
3582 
3583 static int __init ip_vs_genl_register(void)
3584 {
3585         return genl_register_family_with_ops(&ip_vs_genl_family,
3586                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3587 }
3588 
3589 static void ip_vs_genl_unregister(void)
3590 {
3591         genl_unregister_family(&ip_vs_genl_family);
3592 }
3593 
3594 /* End of Generic Netlink interface definitions */
3595 
3596 /*
3597  * per netns intit/exit func.
3598  */
3599 #ifdef CONFIG_SYSCTL
3600 int __net_init __ip_vs_control_init_sysctl(struct net *net)
3601 {
3602         int idx;
3603         struct netns_ipvs *ipvs = net_ipvs(net);
3604         struct ctl_table *tbl;
3605 
3606         atomic_set(&ipvs->dropentry, 0);
3607         spin_lock_init(&ipvs->dropentry_lock);
3608         spin_lock_init(&ipvs->droppacket_lock);
3609         spin_lock_init(&ipvs->securetcp_lock);
3610 
3611         if (!net_eq(net, &init_net)) {
3612                 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3613                 if (tbl == NULL)
3614                         return -ENOMEM;
3615         } else
3616                 tbl = vs_vars;
3617         /* Initialize sysctl defaults */
3618         idx = 0;
3619         ipvs->sysctl_amemthresh = 1024;
3620         tbl[idx++].data = &ipvs->sysctl_amemthresh;
3621         ipvs->sysctl_am_droprate = 10;
3622         tbl[idx++].data = &ipvs->sysctl_am_droprate;
3623         tbl[idx++].data = &ipvs->sysctl_drop_entry;
3624         tbl[idx++].data = &ipvs->sysctl_drop_packet;
3625 #ifdef CONFIG_IP_VS_NFCT
3626         tbl[idx++].data = &ipvs->sysctl_conntrack;
3627 #endif
3628         tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3629         ipvs->sysctl_snat_reroute = 1;
3630         tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3631         ipvs->sysctl_sync_ver = 1;
3632         tbl[idx++].data = &ipvs->sysctl_sync_ver;
3633         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3634         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3635         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3636         ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3637         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3638         tbl[idx].data = &ipvs->sysctl_sync_threshold;
3639         tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3640         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3641 
3642 
3643         ipvs->sysctl_hdr = register_net_sysctl_table(net, net_vs_ctl_path,
3644                                                      tbl);
3645         if (ipvs->sysctl_hdr == NULL) {
3646                 if (!net_eq(net, &init_net))
3647                         kfree(tbl);
3648                 return -ENOMEM;
3649         }
3650         ip_vs_start_estimator(net, &ipvs->tot_stats);
3651         ipvs->sysctl_tbl = tbl;
3652         /* Schedule defense work */
3653         INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3654         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
3655 
3656         return 0;
3657 }
3658 
3659 void __net_init __ip_vs_control_cleanup_sysctl(struct net *net)
3660 {
3661         struct netns_ipvs *ipvs = net_ipvs(net);
3662 
3663         cancel_delayed_work_sync(&ipvs->defense_work);
3664         cancel_work_sync(&ipvs->defense_work.work);
3665         unregister_net_sysctl_table(ipvs->sysctl_hdr);
3666 }
3667 
3668 #else
3669 
3670 int __net_init __ip_vs_control_init_sysctl(struct net *net) { return 0; }
3671 void __net_init __ip_vs_control_cleanup_sysctl(struct net *net) { }
3672 
3673 #endif
3674 
3675 static struct notifier_block ip_vs_dst_notifier = {
3676         .notifier_call = ip_vs_dst_event,
3677 };
3678 
3679 int __net_init __ip_vs_control_init(struct net *net)
3680 {
3681         int idx;
3682         struct netns_ipvs *ipvs = net_ipvs(net);
3683 
3684         ipvs->rs_lock = __RW_LOCK_UNLOCKED(ipvs->rs_lock);
3685 
3686         /* Initialize rs_table */
3687         for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3688                 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3689 
3690         INIT_LIST_HEAD(&ipvs->dest_trash);
3691         atomic_set(&ipvs->ftpsvc_counter, 0);
3692         atomic_set(&ipvs->nullsvc_counter, 0);
3693 
3694         /* procfs stats */
3695         ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
3696         if (!ipvs->tot_stats.cpustats) {
3697                 pr_err("%s(): alloc_percpu.\n", __func__);
3698                 return -ENOMEM;
3699         }
3700         spin_lock_init(&ipvs->tot_stats.lock);
3701 
3702         proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
3703         proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
3704         proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
3705                              &ip_vs_stats_percpu_fops);
3706 
3707         if (__ip_vs_control_init_sysctl(net))
3708                 goto err;
3709 
3710         return 0;
3711 
3712 err:
3713         free_percpu(ipvs->tot_stats.cpustats);
3714         return -ENOMEM;
3715 }
3716 
3717 void __net_exit __ip_vs_control_cleanup(struct net *net)
3718 {
3719         struct netns_ipvs *ipvs = net_ipvs(net);
3720 
3721         ip_vs_trash_cleanup(net);
3722         ip_vs_stop_estimator(net, &ipvs->tot_stats);
3723         __ip_vs_control_cleanup_sysctl(net);
3724         proc_net_remove(net, "ip_vs_stats_percpu");
3725         proc_net_remove(net, "ip_vs_stats");
3726         proc_net_remove(net, "ip_vs");
3727         free_percpu(ipvs->tot_stats.cpustats);
3728 }
3729 
3730 int __init ip_vs_control_init(void)
3731 {
3732         int idx;
3733         int ret;
3734 
3735         EnterFunction(2);
3736 
3737         /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
3738         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
3739                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3740                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3741         }
3742 
3743         smp_wmb();      /* Do we really need it now ? */
3744 
3745         ret = nf_register_sockopt(&ip_vs_sockopts);
3746         if (ret) {
3747                 pr_err("cannot register sockopt.\n");
3748                 goto err_sock;
3749         }
3750 
3751         ret = ip_vs_genl_register();
3752         if (ret) {
3753                 pr_err("cannot register Generic Netlink interface.\n");
3754                 goto err_genl;
3755         }
3756 
3757         ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3758         if (ret < 0)
3759                 goto err_notf;
3760 
3761         LeaveFunction(2);
3762         return 0;
3763 
3764 err_notf:
3765         ip_vs_genl_unregister();
3766 err_genl:
3767         nf_unregister_sockopt(&ip_vs_sockopts);
3768 err_sock:
3769         return ret;
3770 }
3771 
3772 
3773 void ip_vs_control_cleanup(void)
3774 {
3775         EnterFunction(2);
3776         unregister_netdevice_notifier(&ip_vs_dst_notifier);
3777         ip_vs_genl_unregister();
3778         nf_unregister_sockopt(&ip_vs_sockopts);
3779         LeaveFunction(2);
3780 }
3781 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp