[net-next-2.6.git] / net / ipv4 / ipvs / ip_vs_proto_tcp.c

/*
 * ip_vs_proto_tcp.c:	TCP load balancing support for IPVS
 *
 * Version:     $Id: ip_vs_proto_tcp.c,v 1.3 2002/11/30 01:50:35 wensong Exp $
 *
 * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
 *              Julian Anastasov <ja@ssi.bg>
 *
 *              This program is free software; you can redistribute it and/or
 *              modify it under the terms of the GNU General Public License
 *              as published by the Free Software Foundation; either version
 *              2 of the License, or (at your option) any later version.
 *
 * Changes:
 *
 */

#include <linux/kernel.h>
#include <linux/ip.h>
#include <linux/tcp.h>                  /* for tcphdr */
#include <net/ip.h>
#include <net/tcp.h>                    /* for csum_tcpudp_magic */
#include <linux/netfilter_ipv4.h>

#include <net/ip_vs.h>


static struct ip_vs_conn *
tcp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	__be16 _ports[2], *pptr;

	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	if (pptr == NULL)
		return NULL;

	if (likely(!inverse)) {
		return ip_vs_conn_in_get(iph->protocol,
					 iph->saddr, pptr[0],
					 iph->daddr, pptr[1]);
	} else {
		return ip_vs_conn_in_get(iph->protocol,
					 iph->daddr, pptr[1],
					 iph->saddr, pptr[0]);
	}
}

static struct ip_vs_conn *
tcp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		 const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	__be16 _ports[2], *pptr;

	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	if (pptr == NULL)
		return NULL;

	if (likely(!inverse)) {
		return ip_vs_conn_out_get(iph->protocol,
					  iph->saddr, pptr[0],
					  iph->daddr, pptr[1]);
	} else {
		return ip_vs_conn_out_get(iph->protocol,
					  iph->daddr, pptr[1],
					  iph->saddr, pptr[0]);
	}
}


static int
tcp_conn_schedule(struct sk_buff *skb,
		  struct ip_vs_protocol *pp,
		  int *verdict, struct ip_vs_conn **cpp)
{
	struct ip_vs_service *svc;
	struct tcphdr _tcph, *th;

	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
	if (th == NULL) {
		*verdict = NF_DROP;
		return 0;
	}

	if (th->syn &&
	    (svc = ip_vs_service_get(skb->mark, skb->nh.iph->protocol,
				     skb->nh.iph->daddr, th->dest))) {
		if (ip_vs_todrop()) {
			/*
			 * It seems that we are very loaded.
			 * We have to drop this packet :(
			 */
			ip_vs_service_put(svc);
			*verdict = NF_DROP;
			return 0;
		}

		/*
		 * Let the virtual server select a real server for the
		 * incoming connection, and create a connection entry.
		 */
		*cpp = ip_vs_schedule(svc, skb);
		if (!*cpp) {
			*verdict = ip_vs_leave(svc, skb, pp);
			return 0;
		}
		ip_vs_service_put(svc);
	}
	return 1;
}


static inline void
tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
		     __be16 oldport, __be16 newport)
{
	tcph->check =
		csum_fold(ip_vs_check_diff4(oldip, newip,
				 ip_vs_check_diff2(oldport, newport,
						~csum_unfold(tcph->check))));
}


static int
tcp_snat_handler(struct sk_buff **pskb,
		 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
{
	struct tcphdr *tcph;
	const unsigned int tcphoff = ip_hdrlen(*pskb);

	/* csum_check requires unshared skb */
	if (!ip_vs_make_skb_writable(pskb, tcphoff+sizeof(*tcph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		/* Some checks before mangling */
		if (pp->csum_check && !pp->csum_check(*pskb, pp))
			return 0;

		/* Call application helper if needed */
		if (!ip_vs_app_pkt_out(cp, pskb))
			return 0;
	}

	tcph = (void *)(*pskb)->nh.iph + tcphoff;
	tcph->source = cp->vport;

	/* Adjust TCP checksums */
	if (!cp->app) {
		/* Only port and addr are changed, do fast csum update */
		tcp_fast_csum_update(tcph, cp->daddr, cp->vaddr,
				     cp->dport, cp->vport);
		if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
			(*pskb)->ip_summed = CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		tcph->check = 0;
		(*pskb)->csum = skb_checksum(*pskb, tcphoff,
					     (*pskb)->len - tcphoff, 0);
		tcph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
						(*pskb)->len - tcphoff,
						cp->protocol,
						(*pskb)->csum);
		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
			  pp->name, tcph->check,
			  (char*)&(tcph->check) - (char*)tcph);
	}
	return 1;
}


static int
tcp_dnat_handler(struct sk_buff **pskb,
		 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
{
	struct tcphdr *tcph;
	const unsigned int tcphoff = ip_hdrlen(*pskb);

	/* csum_check requires unshared skb */
	if (!ip_vs_make_skb_writable(pskb, tcphoff+sizeof(*tcph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		/* Some checks before mangling */
		if (pp->csum_check && !pp->csum_check(*pskb, pp))
			return 0;

		/*
		 *	Attempt ip_vs_app call.
		 *	It will fix ip_vs_conn and iph ack_seq stuff
		 */
		if (!ip_vs_app_pkt_in(cp, pskb))
			return 0;
	}

	tcph = (void *)(*pskb)->nh.iph + tcphoff;
	tcph->dest = cp->dport;

	/*
	 *	Adjust TCP checksums
	 */
	if (!cp->app) {
		/* Only port and addr are changed, do fast csum update */
		tcp_fast_csum_update(tcph, cp->vaddr, cp->daddr,
				     cp->vport, cp->dport);
		if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
			(*pskb)->ip_summed = CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		tcph->check = 0;
		(*pskb)->csum = skb_checksum(*pskb, tcphoff,
					     (*pskb)->len - tcphoff, 0);
		tcph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
						(*pskb)->len - tcphoff,
						cp->protocol,
						(*pskb)->csum);
		(*pskb)->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return 1;
}


static int
tcp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
{
	const unsigned int tcphoff = ip_hdrlen(skb);

	switch (skb->ip_summed) {
	case CHECKSUM_NONE:
		skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
	case CHECKSUM_COMPLETE:
		if (csum_tcpudp_magic(skb->nh.iph->saddr, skb->nh.iph->daddr,
				      skb->len - tcphoff,
				      skb->nh.iph->protocol, skb->csum)) {
			IP_VS_DBG_RL_PKT(0, pp, skb, 0,
					 "Failed checksum for");
			return 0;
		}
		break;
	default:
		/* No need to checksum. */
		break;
	}

	return 1;
}


#define TCP_DIR_INPUT		0
#define TCP_DIR_OUTPUT		4
#define TCP_DIR_INPUT_ONLY	8

static const int tcp_state_off[IP_VS_DIR_LAST] = {
	[IP_VS_DIR_INPUT]		=	TCP_DIR_INPUT,
	[IP_VS_DIR_OUTPUT]		=	TCP_DIR_OUTPUT,
	[IP_VS_DIR_INPUT_ONLY]		=	TCP_DIR_INPUT_ONLY,
};

/*
 *	Timeout table[state]
 */
static int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
	[IP_VS_TCP_S_NONE]		=	2*HZ,
	[IP_VS_TCP_S_ESTABLISHED]	=	15*60*HZ,
	[IP_VS_TCP_S_SYN_SENT]		=	2*60*HZ,
	[IP_VS_TCP_S_SYN_RECV]		=	1*60*HZ,
	[IP_VS_TCP_S_FIN_WAIT]		=	2*60*HZ,
	[IP_VS_TCP_S_TIME_WAIT]		=	2*60*HZ,
	[IP_VS_TCP_S_CLOSE]		=	10*HZ,
	[IP_VS_TCP_S_CLOSE_WAIT]	=	60*HZ,
	[IP_VS_TCP_S_LAST_ACK]		=	30*HZ,
	[IP_VS_TCP_S_LISTEN]		=	2*60*HZ,
	[IP_VS_TCP_S_SYNACK]		=	120*HZ,
	[IP_VS_TCP_S_LAST]		=	2*HZ,
};

static char * tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
	[IP_VS_TCP_S_NONE]		=	"NONE",
	[IP_VS_TCP_S_ESTABLISHED]	=	"ESTABLISHED",
	[IP_VS_TCP_S_SYN_SENT]		=	"SYN_SENT",
	[IP_VS_TCP_S_SYN_RECV]		=	"SYN_RECV",
	[IP_VS_TCP_S_FIN_WAIT]		=	"FIN_WAIT",
	[IP_VS_TCP_S_TIME_WAIT]		=	"TIME_WAIT",
	[IP_VS_TCP_S_CLOSE]		=	"CLOSE",
	[IP_VS_TCP_S_CLOSE_WAIT]	=	"CLOSE_WAIT",
	[IP_VS_TCP_S_LAST_ACK]		=	"LAST_ACK",
	[IP_VS_TCP_S_LISTEN]		=	"LISTEN",
	[IP_VS_TCP_S_SYNACK]		=	"SYNACK",
	[IP_VS_TCP_S_LAST]		=	"BUG!",
};

#define sNO IP_VS_TCP_S_NONE
#define sES IP_VS_TCP_S_ESTABLISHED
#define sSS IP_VS_TCP_S_SYN_SENT
#define sSR IP_VS_TCP_S_SYN_RECV
#define sFW IP_VS_TCP_S_FIN_WAIT
#define sTW IP_VS_TCP_S_TIME_WAIT
#define sCL IP_VS_TCP_S_CLOSE
#define sCW IP_VS_TCP_S_CLOSE_WAIT
#define sLA IP_VS_TCP_S_LAST_ACK
#define sLI IP_VS_TCP_S_LISTEN
#define sSA IP_VS_TCP_S_SYNACK

struct tcp_states_t {
	int next_state[IP_VS_TCP_S_LAST];
};

static const char * tcp_state_name(int state)
{
	if (state >= IP_VS_TCP_S_LAST)
		return "ERR!";
	return tcp_state_name_table[state] ? tcp_state_name_table[state] : "?";
}

static struct tcp_states_t tcp_states [] = {
/*	INPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
/*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},

/*	OUTPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSS, sES, sSS, sSR, sSS, sSS, sSS, sSS, sSS, sLI, sSR }},
/*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
/*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},

/*	INPUT-ONLY */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
/*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
};

static struct tcp_states_t tcp_states_dos [] = {
/*	INPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
/*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
/*ack*/ {{sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},

/*	OUTPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSS, sES, sSS, sSA, sSS, sSS, sSS, sSS, sSS, sLI, sSA }},
/*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
/*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},

/*	INPUT-ONLY */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
/*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
};

static struct tcp_states_t *tcp_state_table = tcp_states;


static void tcp_timeout_change(struct ip_vs_protocol *pp, int flags)
{
	int on = (flags & 1);		/* secure_tcp */

	/*
	** FIXME: change secure_tcp to independent sysctl var
	** or make it per-service or per-app because it is valid
	** for most if not for all of the applications. Something
	** like "capabilities" (flags) for each object.
	*/
	tcp_state_table = (on? tcp_states_dos : tcp_states);
}

static int
tcp_set_state_timeout(struct ip_vs_protocol *pp, char *sname, int to)
{
	return ip_vs_set_state_timeout(pp->timeout_table, IP_VS_TCP_S_LAST,
				       tcp_state_name_table, sname, to);
}

static inline int tcp_state_idx(struct tcphdr *th)
{
	if (th->rst)
		return 3;
	if (th->syn)
		return 0;
	if (th->fin)
		return 1;
	if (th->ack)
		return 2;
	return -1;
}

static inline void
set_tcp_state(struct ip_vs_protocol *pp, struct ip_vs_conn *cp,
	      int direction, struct tcphdr *th)
{
	int state_idx;
	int new_state = IP_VS_TCP_S_CLOSE;
	int state_off = tcp_state_off[direction];

	/*
	 *    Update state offset to INPUT_ONLY if necessary
	 *    or delete NO_OUTPUT flag if output packet detected
	 */
	if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
		if (state_off == TCP_DIR_OUTPUT)
			cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
		else
			state_off = TCP_DIR_INPUT_ONLY;
	}

	if ((state_idx = tcp_state_idx(th)) < 0) {
		IP_VS_DBG(8, "tcp_state_idx=%d!!!\n", state_idx);
		goto tcp_state_out;
	}

	new_state = tcp_state_table[state_off+state_idx].next_state[cp->state];

  tcp_state_out:
	if (new_state != cp->state) {
		struct ip_vs_dest *dest = cp->dest;

		IP_VS_DBG(8, "%s %s [%c%c%c%c] %u.%u.%u.%u:%d->"
			  "%u.%u.%u.%u:%d state: %s->%s conn->refcnt:%d\n",
			  pp->name,
			  (state_off==TCP_DIR_OUTPUT)?"output ":"input ",
			  th->syn? 'S' : '.',
			  th->fin? 'F' : '.',
			  th->ack? 'A' : '.',
			  th->rst? 'R' : '.',
			  NIPQUAD(cp->daddr), ntohs(cp->dport),
			  NIPQUAD(cp->caddr), ntohs(cp->cport),
			  tcp_state_name(cp->state),
			  tcp_state_name(new_state),
			  atomic_read(&cp->refcnt));
		if (dest) {
			if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
			    (new_state != IP_VS_TCP_S_ESTABLISHED)) {
				atomic_dec(&dest->activeconns);
				atomic_inc(&dest->inactconns);
				cp->flags |= IP_VS_CONN_F_INACTIVE;
			} else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
				   (new_state == IP_VS_TCP_S_ESTABLISHED)) {
				atomic_inc(&dest->activeconns);
				atomic_dec(&dest->inactconns);
				cp->flags &= ~IP_VS_CONN_F_INACTIVE;
			}
		}
	}

	cp->timeout = pp->timeout_table[cp->state = new_state];
}


/*
 *	Handle state transitions
 */
static int
tcp_state_transition(struct ip_vs_conn *cp, int direction,
		     const struct sk_buff *skb,
		     struct ip_vs_protocol *pp)
{
	struct tcphdr _tcph, *th;

	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
	if (th == NULL)
		return 0;

	spin_lock(&cp->lock);
	set_tcp_state(pp, cp, direction, th);
	spin_unlock(&cp->lock);

	return 1;
}


/*
 *	Hash table for TCP application incarnations
 */
#define	TCP_APP_TAB_BITS	4
#define	TCP_APP_TAB_SIZE	(1 << TCP_APP_TAB_BITS)
#define	TCP_APP_TAB_MASK	(TCP_APP_TAB_SIZE - 1)

static struct list_head tcp_apps[TCP_APP_TAB_SIZE];
static DEFINE_SPINLOCK(tcp_app_lock);

static inline __u16 tcp_app_hashkey(__be16 port)
{
	return (((__force u16)port >> TCP_APP_TAB_BITS) ^ (__force u16)port)
		& TCP_APP_TAB_MASK;
}


static int tcp_register_app(struct ip_vs_app *inc)
{
	struct ip_vs_app *i;
	__u16 hash;
	__be16 port = inc->port;
	int ret = 0;

	hash = tcp_app_hashkey(port);

	spin_lock_bh(&tcp_app_lock);
	list_for_each_entry(i, &tcp_apps[hash], p_list) {
		if (i->port == port) {
			ret = -EEXIST;
			goto out;
		}
	}
	list_add(&inc->p_list, &tcp_apps[hash]);
	atomic_inc(&ip_vs_protocol_tcp.appcnt);

  out:
	spin_unlock_bh(&tcp_app_lock);
	return ret;
}


static void
tcp_unregister_app(struct ip_vs_app *inc)
{
	spin_lock_bh(&tcp_app_lock);
	atomic_dec(&ip_vs_protocol_tcp.appcnt);
	list_del(&inc->p_list);
	spin_unlock_bh(&tcp_app_lock);
}


static int
tcp_app_conn_bind(struct ip_vs_conn *cp)
{
	int hash;
	struct ip_vs_app *inc;
	int result = 0;

	/* Default binding: bind app only for NAT */
	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
		return 0;

	/* Lookup application incarnations and bind the right one */
	hash = tcp_app_hashkey(cp->vport);

	spin_lock(&tcp_app_lock);
	list_for_each_entry(inc, &tcp_apps[hash], p_list) {
		if (inc->port == cp->vport) {
			if (unlikely(!ip_vs_app_inc_get(inc)))
				break;
			spin_unlock(&tcp_app_lock);

			IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
				  "%u.%u.%u.%u:%u to app %s on port %u\n",
				  __FUNCTION__,
				  NIPQUAD(cp->caddr), ntohs(cp->cport),
				  NIPQUAD(cp->vaddr), ntohs(cp->vport),
				  inc->name, ntohs(inc->port));
			cp->app = inc;
			if (inc->init_conn)
				result = inc->init_conn(inc, cp);
			goto out;
		}
	}
	spin_unlock(&tcp_app_lock);

  out:
	return result;
}


/*
 *	Set LISTEN timeout. (ip_vs_conn_put will setup timer)
 */
void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
{
	spin_lock(&cp->lock);
	cp->state = IP_VS_TCP_S_LISTEN;
	cp->timeout = ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_LISTEN];
	spin_unlock(&cp->lock);
}


static void ip_vs_tcp_init(struct ip_vs_protocol *pp)
{
	IP_VS_INIT_HASH_TABLE(tcp_apps);
	pp->timeout_table = tcp_timeouts;
}


static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
{
}


struct ip_vs_protocol ip_vs_protocol_tcp = {
	.name =			"TCP",
	.protocol =		IPPROTO_TCP,
	.dont_defrag =		0,
	.appcnt =		ATOMIC_INIT(0),
	.init =			ip_vs_tcp_init,
	.exit =			ip_vs_tcp_exit,
	.register_app =		tcp_register_app,
	.unregister_app =	tcp_unregister_app,
	.conn_schedule =	tcp_conn_schedule,
	.conn_in_get =		tcp_conn_in_get,
	.conn_out_get =		tcp_conn_out_get,
	.snat_handler =		tcp_snat_handler,
	.dnat_handler =		tcp_dnat_handler,
	.csum_check =		tcp_csum_check,
	.state_name =		tcp_state_name,
	.state_transition =	tcp_state_transition,
	.app_conn_bind =	tcp_app_conn_bind,
	.debug_packet =		ip_vs_tcpudp_debug_packet,
	.timeout_change =	tcp_timeout_change,
	.set_state_timeout =	tcp_set_state_timeout,
};
Commit	Line	Data
1da177e4 LT	1	/*
	2	* ip_vs_proto_tcp.c: TCP load balancing support for IPVS
	3	*
	4	* Version: $Id: ip_vs_proto_tcp.c,v 1.3 2002/11/30 01:50:35 wensong Exp $
	5	*
	6	* Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
	7	* Julian Anastasov <ja@ssi.bg>
	8	*
	9	* This program is free software; you can redistribute it and/or
	10	* modify it under the terms of the GNU General Public License
	11	* as published by the Free Software Foundation; either version
	12	* 2 of the License, or (at your option) any later version.
	13	*
	14	* Changes:
	15	*
	16	*/
	17
	18	#include <linux/kernel.h>
	19	#include <linux/ip.h>
	20	#include <linux/tcp.h> /* for tcphdr */
	21	#include <net/ip.h>
	22	#include <net/tcp.h> /* for csum_tcpudp_magic */
	23	#include <linux/netfilter_ipv4.h>
	24
	25	#include <net/ip_vs.h>
	26
	27
	28	static struct ip_vs_conn *
	29	tcp_conn_in_get(const struct sk_buff skb, struct ip_vs_protocol pp,
	30	const struct iphdr *iph, unsigned int proto_off, int inverse)
	31	{
014d730d	32	__be16 _ports[2], *pptr;
1da177e4 LT	33
	34	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	35	if (pptr == NULL)
	36	return NULL;
	37
	38	if (likely(!inverse)) {
	39	return ip_vs_conn_in_get(iph->protocol,
	40	iph->saddr, pptr[0],
	41	iph->daddr, pptr[1]);
	42	} else {
	43	return ip_vs_conn_in_get(iph->protocol,
	44	iph->daddr, pptr[1],
	45	iph->saddr, pptr[0]);
	46	}
	47	}
	48
	49	static struct ip_vs_conn *
	50	tcp_conn_out_get(const struct sk_buff skb, struct ip_vs_protocol pp,
	51	const struct iphdr *iph, unsigned int proto_off, int inverse)
	52	{
014d730d	53	__be16 _ports[2], *pptr;
1da177e4 LT	54
	55	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	56	if (pptr == NULL)
	57	return NULL;
	58
	59	if (likely(!inverse)) {
	60	return ip_vs_conn_out_get(iph->protocol,
	61	iph->saddr, pptr[0],
	62	iph->daddr, pptr[1]);
	63	} else {
	64	return ip_vs_conn_out_get(iph->protocol,
	65	iph->daddr, pptr[1],
	66	iph->saddr, pptr[0]);
	67	}
	68	}
	69
	70
	71	static int
	72	tcp_conn_schedule(struct sk_buff *skb,
	73	struct ip_vs_protocol *pp,
	74	int verdict, struct ip_vs_conn *cpp)
	75	{
	76	struct ip_vs_service *svc;
	77	struct tcphdr _tcph, *th;
	78
c9bdd4b5	79	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
1da177e4 LT	80	if (th == NULL) {
	81	*verdict = NF_DROP;
	82	return 0;
	83	}
	84
	85	if (th->syn &&
82e91ffe	86	(svc = ip_vs_service_get(skb->mark, skb->nh.iph->protocol,
1da177e4 LT	87	skb->nh.iph->daddr, th->dest))) {
	88	if (ip_vs_todrop()) {
	89	/*
	90	* It seems that we are very loaded.
	91	* We have to drop this packet :(
	92	*/
	93	ip_vs_service_put(svc);
	94	*verdict = NF_DROP;
	95	return 0;
	96	}
	97
	98	/*
	99	* Let the virtual server select a real server for the
	100	* incoming connection, and create a connection entry.
	101	*/
	102	*cpp = ip_vs_schedule(svc, skb);
	103	if (!*cpp) {
	104	*verdict = ip_vs_leave(svc, skb, pp);
	105	return 0;
	106	}
	107	ip_vs_service_put(svc);
	108	}
	109	return 1;
	110	}
	111
	112
	113	static inline void
014d730d AV	114	tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
014d730d AV	115	__be16 oldport, __be16 newport)
1da177e4 LT	116	{
1da177e4 LT	117	tcph->check =
f9214b26 AV	118	csum_fold(ip_vs_check_diff4(oldip, newip,
	119	ip_vs_check_diff2(oldport, newport,
	120	~csum_unfold(tcph->check))));
1da177e4 LT	121	}
	122
	123
	124	static int
	125	tcp_snat_handler(struct sk_buff **pskb,
	126	struct ip_vs_protocol pp, struct ip_vs_conn cp)
	127	{
	128	struct tcphdr *tcph;
c9bdd4b5	129	const unsigned int tcphoff = ip_hdrlen(*pskb);
1da177e4 LT	130
	131	/* csum_check requires unshared skb */
	132	if (!ip_vs_make_skb_writable(pskb, tcphoff+sizeof(*tcph)))
	133	return 0;
	134
	135	if (unlikely(cp->app != NULL)) {
	136	/* Some checks before mangling */
	137	if (pp->csum_check && !pp->csum_check(*pskb, pp))
	138	return 0;
	139
	140	/* Call application helper if needed */
	141	if (!ip_vs_app_pkt_out(cp, pskb))
	142	return 0;
	143	}
	144
	145	tcph = (void )(pskb)->nh.iph + tcphoff;
	146	tcph->source = cp->vport;
	147
	148	/* Adjust TCP checksums */
	149	if (!cp->app) {
	150	/* Only port and addr are changed, do fast csum update */
	151	tcp_fast_csum_update(tcph, cp->daddr, cp->vaddr,
	152	cp->dport, cp->vport);
84fa7933	153	if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
1da177e4 LT	154	(*pskb)->ip_summed = CHECKSUM_NONE;
	155	} else {
	156	/* full checksum calculation */
	157	tcph->check = 0;
	158	(pskb)->csum = skb_checksum(pskb, tcphoff,
	159	(*pskb)->len - tcphoff, 0);
	160	tcph->check = csum_tcpudp_magic(cp->vaddr, cp->caddr,
	161	(*pskb)->len - tcphoff,
	162	cp->protocol,
	163	(*pskb)->csum);
	164	IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
	165	pp->name, tcph->check,
	166	(char)&(tcph->check) - (char)tcph);
	167	}
	168	return 1;
	169	}
	170
	171
	172	static int
	173	tcp_dnat_handler(struct sk_buff **pskb,
	174	struct ip_vs_protocol pp, struct ip_vs_conn cp)
	175	{
	176	struct tcphdr *tcph;
c9bdd4b5	177	const unsigned int tcphoff = ip_hdrlen(*pskb);
1da177e4 LT	178
	179	/* csum_check requires unshared skb */
	180	if (!ip_vs_make_skb_writable(pskb, tcphoff+sizeof(*tcph)))
	181	return 0;
	182
	183	if (unlikely(cp->app != NULL)) {
	184	/* Some checks before mangling */
	185	if (pp->csum_check && !pp->csum_check(*pskb, pp))
	186	return 0;
	187
	188	/*
	189	* Attempt ip_vs_app call.
	190	* It will fix ip_vs_conn and iph ack_seq stuff
	191	*/
	192	if (!ip_vs_app_pkt_in(cp, pskb))
	193	return 0;
	194	}
	195
	196	tcph = (void )(pskb)->nh.iph + tcphoff;
	197	tcph->dest = cp->dport;
	198
	199	/*
	200	* Adjust TCP checksums
	201	*/
	202	if (!cp->app) {
	203	/* Only port and addr are changed, do fast csum update */
	204	tcp_fast_csum_update(tcph, cp->vaddr, cp->daddr,
	205	cp->vport, cp->dport);
84fa7933	206	if ((*pskb)->ip_summed == CHECKSUM_COMPLETE)
1da177e4 LT	207	(*pskb)->ip_summed = CHECKSUM_NONE;
	208	} else {
	209	/* full checksum calculation */
	210	tcph->check = 0;
	211	(pskb)->csum = skb_checksum(pskb, tcphoff,
	212	(*pskb)->len - tcphoff, 0);
	213	tcph->check = csum_tcpudp_magic(cp->caddr, cp->daddr,
	214	(*pskb)->len - tcphoff,
	215	cp->protocol,
	216	(*pskb)->csum);
	217	(*pskb)->ip_summed = CHECKSUM_UNNECESSARY;
	218	}
	219	return 1;
	220	}
	221
	222
	223	static int
	224	tcp_csum_check(struct sk_buff skb, struct ip_vs_protocol pp)
	225	{
c9bdd4b5	226	const unsigned int tcphoff = ip_hdrlen(skb);
1da177e4 LT	227
	228	switch (skb->ip_summed) {
	229	case CHECKSUM_NONE:
	230	skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
84fa7933	231	case CHECKSUM_COMPLETE:
1da177e4 LT	232	if (csum_tcpudp_magic(skb->nh.iph->saddr, skb->nh.iph->daddr,
	233	skb->len - tcphoff,
	234	skb->nh.iph->protocol, skb->csum)) {
	235	IP_VS_DBG_RL_PKT(0, pp, skb, 0,
	236	"Failed checksum for");
	237	return 0;
	238	}
	239	break;
	240	default:
84fa7933	241	/* No need to checksum. */
1da177e4 LT	242	break;
	243	}
	244
	245	return 1;
	246	}
	247
	248
	249	#define TCP_DIR_INPUT 0
	250	#define TCP_DIR_OUTPUT 4
	251	#define TCP_DIR_INPUT_ONLY 8
	252
9b5b5cff	253	static const int tcp_state_off[IP_VS_DIR_LAST] = {
1da177e4 LT	254	[IP_VS_DIR_INPUT] = TCP_DIR_INPUT,
	255	[IP_VS_DIR_OUTPUT] = TCP_DIR_OUTPUT,
	256	[IP_VS_DIR_INPUT_ONLY] = TCP_DIR_INPUT_ONLY,
	257	};
	258
	259	/*
	260	* Timeout table[state]
	261	*/
	262	static int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
	263	[IP_VS_TCP_S_NONE] = 2*HZ,
	264	[IP_VS_TCP_S_ESTABLISHED] = 1560HZ,
	265	[IP_VS_TCP_S_SYN_SENT] = 260HZ,
	266	[IP_VS_TCP_S_SYN_RECV] = 160HZ,
	267	[IP_VS_TCP_S_FIN_WAIT] = 260HZ,
	268	[IP_VS_TCP_S_TIME_WAIT] = 260HZ,
	269	[IP_VS_TCP_S_CLOSE] = 10*HZ,
	270	[IP_VS_TCP_S_CLOSE_WAIT] = 60*HZ,
	271	[IP_VS_TCP_S_LAST_ACK] = 30*HZ,
	272	[IP_VS_TCP_S_LISTEN] = 260HZ,
	273	[IP_VS_TCP_S_SYNACK] = 120*HZ,
	274	[IP_VS_TCP_S_LAST] = 2*HZ,
	275	};
	276
1da177e4 LT	277	static char * tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
	278	[IP_VS_TCP_S_NONE] = "NONE",
	279	[IP_VS_TCP_S_ESTABLISHED] = "ESTABLISHED",
	280	[IP_VS_TCP_S_SYN_SENT] = "SYN_SENT",
	281	[IP_VS_TCP_S_SYN_RECV] = "SYN_RECV",
	282	[IP_VS_TCP_S_FIN_WAIT] = "FIN_WAIT",
	283	[IP_VS_TCP_S_TIME_WAIT] = "TIME_WAIT",
	284	[IP_VS_TCP_S_CLOSE] = "CLOSE",
	285	[IP_VS_TCP_S_CLOSE_WAIT] = "CLOSE_WAIT",
	286	[IP_VS_TCP_S_LAST_ACK] = "LAST_ACK",
	287	[IP_VS_TCP_S_LISTEN] = "LISTEN",
	288	[IP_VS_TCP_S_SYNACK] = "SYNACK",
	289	[IP_VS_TCP_S_LAST] = "BUG!",
	290	};
	291
	292	#define sNO IP_VS_TCP_S_NONE
	293	#define sES IP_VS_TCP_S_ESTABLISHED
	294	#define sSS IP_VS_TCP_S_SYN_SENT
	295	#define sSR IP_VS_TCP_S_SYN_RECV
	296	#define sFW IP_VS_TCP_S_FIN_WAIT
	297	#define sTW IP_VS_TCP_S_TIME_WAIT
	298	#define sCL IP_VS_TCP_S_CLOSE
	299	#define sCW IP_VS_TCP_S_CLOSE_WAIT
	300	#define sLA IP_VS_TCP_S_LAST_ACK
	301	#define sLI IP_VS_TCP_S_LISTEN
	302	#define sSA IP_VS_TCP_S_SYNACK
	303
	304	struct tcp_states_t {
	305	int next_state[IP_VS_TCP_S_LAST];
	306	};
	307
	308	static const char * tcp_state_name(int state)
	309	{
	310	if (state >= IP_VS_TCP_S_LAST)
	311	return "ERR!";
	312	return tcp_state_name_table[state] ? tcp_state_name_table[state] : "?";
	313	}
	314
	315	static struct tcp_states_t tcp_states [] = {
	316	/* INPUT */
	317	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	318	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
	319	/fin/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
	320	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
	321	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},
	322
	323	/* OUTPUT */
	324	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	325	/syn/ {{sSS, sES, sSS, sSR, sSS, sSS, sSS, sSS, sSS, sLI, sSR }},
	326	/fin/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
	327	/ack/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
	328	/rst/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
	329
	330	/* INPUT-ONLY */
	331	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	332	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
	333	/fin/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
	334	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
	335	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
	336	};
	337
	338	static struct tcp_states_t tcp_states_dos [] = {
	339	/* INPUT */
	340	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
341	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
342	/fin/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
343	/ack/ {{sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
344	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
345
346	/* OUTPUT */
347	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
348	/syn/ {{sSS, sES, sSS, sSA, sSS, sSS, sSS, sSS, sSS, sLI, sSA }},
349	/fin/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
350	/ack/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
351	/rst/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
352
353	/* INPUT-ONLY */
354	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
355	/syn/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
356	/fin/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
357	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
358	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
359	};
360
361	static struct tcp_states_t *tcp_state_table = tcp_states;
362
363
364	static void tcp_timeout_change(struct ip_vs_protocol *pp, int flags)
365	{
366	int on = (flags & 1); /* secure_tcp */
367
368	/*
369	** FIXME: change secure_tcp to independent sysctl var
370	** or make it per-service or per-app because it is valid
371	** for most if not for all of the applications. Something
372	** like "capabilities" (flags) for each object.
373	*/
374	tcp_state_table = (on? tcp_states_dos : tcp_states);
375	}
376
377	static int
378	tcp_set_state_timeout(struct ip_vs_protocol pp, char sname, int to)
379	{
380	return ip_vs_set_state_timeout(pp->timeout_table, IP_VS_TCP_S_LAST,
381	tcp_state_name_table, sname, to);
382	}
383
384	static inline int tcp_state_idx(struct tcphdr *th)
385	{
386	if (th->rst)
387	return 3;
388	if (th->syn)
389	return 0;
390	if (th->fin)
391	return 1;
392	if (th->ack)
393	return 2;
394	return -1;
395	}
396
397	static inline void
398	set_tcp_state(struct ip_vs_protocol pp, struct ip_vs_conn cp,
399	int direction, struct tcphdr *th)
400	{
401	int state_idx;
402	int new_state = IP_VS_TCP_S_CLOSE;
403	int state_off = tcp_state_off[direction];
404
405	/*
406	* Update state offset to INPUT_ONLY if necessary
407	* or delete NO_OUTPUT flag if output packet detected
408	*/
409	if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
410	if (state_off == TCP_DIR_OUTPUT)
411	cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
412	else
413	state_off = TCP_DIR_INPUT_ONLY;
414	}
415
416	if ((state_idx = tcp_state_idx(th)) < 0) {
417	IP_VS_DBG(8, "tcp_state_idx=%d!!!\n", state_idx);
418	goto tcp_state_out;
419	}
420
421	new_state = tcp_state_table[state_off+state_idx].next_state[cp->state];
422
423	tcp_state_out:
424	if (new_state != cp->state) {
425	struct ip_vs_dest *dest = cp->dest;
426
427	IP_VS_DBG(8, "%s %s [%c%c%c%c] %u.%u.%u.%u:%d->"
4b5bdf5c	428	"%u.%u.%u.%u:%d state: %s->%s conn->refcnt:%d\n",
1da177e4 LT	429	pp->name,
	430	(state_off==TCP_DIR_OUTPUT)?"output ":"input ",
	431	th->syn? 'S' : '.',
	432	th->fin? 'F' : '.',
	433	th->ack? 'A' : '.',
	434	th->rst? 'R' : '.',
	435	NIPQUAD(cp->daddr), ntohs(cp->dport),
	436	NIPQUAD(cp->caddr), ntohs(cp->cport),
	437	tcp_state_name(cp->state),
	438	tcp_state_name(new_state),
	439	atomic_read(&cp->refcnt));
	440	if (dest) {
	441	if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
	442	(new_state != IP_VS_TCP_S_ESTABLISHED)) {
	443	atomic_dec(&dest->activeconns);
	444	atomic_inc(&dest->inactconns);
	445	cp->flags \|= IP_VS_CONN_F_INACTIVE;
	446	} else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
	447	(new_state == IP_VS_TCP_S_ESTABLISHED)) {
	448	atomic_inc(&dest->activeconns);
	449	atomic_dec(&dest->inactconns);
	450	cp->flags &= ~IP_VS_CONN_F_INACTIVE;
	451	}
	452	}
	453	}
	454
	455	cp->timeout = pp->timeout_table[cp->state = new_state];
	456	}
	457
	458
	459	/*
	460	* Handle state transitions
	461	*/
	462	static int
	463	tcp_state_transition(struct ip_vs_conn *cp, int direction,
	464	const struct sk_buff *skb,
	465	struct ip_vs_protocol *pp)
	466	{
	467	struct tcphdr _tcph, *th;
	468
c9bdd4b5	469	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
1da177e4 LT	470	if (th == NULL)
	471	return 0;
	472
	473	spin_lock(&cp->lock);
	474	set_tcp_state(pp, cp, direction, th);
	475	spin_unlock(&cp->lock);
	476
	477	return 1;
	478	}
	479
	480
	481	/*
	482	* Hash table for TCP application incarnations
	483	*/
	484	#define TCP_APP_TAB_BITS 4
	485	#define TCP_APP_TAB_SIZE (1 << TCP_APP_TAB_BITS)
	486	#define TCP_APP_TAB_MASK (TCP_APP_TAB_SIZE - 1)
	487
	488	static struct list_head tcp_apps[TCP_APP_TAB_SIZE];
	489	static DEFINE_SPINLOCK(tcp_app_lock);
	490
75e7ce66	491	static inline __u16 tcp_app_hashkey(__be16 port)
1da177e4	492	{
75e7ce66 AV	493	return (((__force u16)port >> TCP_APP_TAB_BITS) ^ (__force u16)port)
75e7ce66 AV	494	& TCP_APP_TAB_MASK;
1da177e4 LT	495	}
	496
	497
	498	static int tcp_register_app(struct ip_vs_app *inc)
	499	{
	500	struct ip_vs_app *i;
75e7ce66 AV	501	__u16 hash;
75e7ce66 AV	502	__be16 port = inc->port;
1da177e4 LT	503	int ret = 0;
	504
	505	hash = tcp_app_hashkey(port);
	506
	507	spin_lock_bh(&tcp_app_lock);
	508	list_for_each_entry(i, &tcp_apps[hash], p_list) {
	509	if (i->port == port) {
	510	ret = -EEXIST;
	511	goto out;
	512	}
	513	}
	514	list_add(&inc->p_list, &tcp_apps[hash]);
	515	atomic_inc(&ip_vs_protocol_tcp.appcnt);
	516
	517	out:
	518	spin_unlock_bh(&tcp_app_lock);
	519	return ret;
	520	}
	521
	522
	523	static void
	524	tcp_unregister_app(struct ip_vs_app *inc)
	525	{
	526	spin_lock_bh(&tcp_app_lock);
	527	atomic_dec(&ip_vs_protocol_tcp.appcnt);
	528	list_del(&inc->p_list);
	529	spin_unlock_bh(&tcp_app_lock);
	530	}
	531
	532
	533	static int
	534	tcp_app_conn_bind(struct ip_vs_conn *cp)
	535	{
	536	int hash;
	537	struct ip_vs_app *inc;
	538	int result = 0;
	539
	540	/* Default binding: bind app only for NAT */
	541	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
	542	return 0;
	543
	544	/* Lookup application incarnations and bind the right one */
	545	hash = tcp_app_hashkey(cp->vport);
	546
	547	spin_lock(&tcp_app_lock);
	548	list_for_each_entry(inc, &tcp_apps[hash], p_list) {
	549	if (inc->port == cp->vport) {
	550	if (unlikely(!ip_vs_app_inc_get(inc)))
	551	break;
	552	spin_unlock(&tcp_app_lock);
	553
	554	IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
	555	"%u.%u.%u.%u:%u to app %s on port %u\n",
	556	__FUNCTION__,
	557	NIPQUAD(cp->caddr), ntohs(cp->cport),
	558	NIPQUAD(cp->vaddr), ntohs(cp->vport),
	559	inc->name, ntohs(inc->port));
	560	cp->app = inc;
	561	if (inc->init_conn)
	562	result = inc->init_conn(inc, cp);
	563	goto out;
	564	}
	565	}
	566	spin_unlock(&tcp_app_lock);
567
568	out:
569	return result;
570	}
571
572
573	/*
574	* Set LISTEN timeout. (ip_vs_conn_put will setup timer)
575	*/
576	void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
577	{
578	spin_lock(&cp->lock);
579	cp->state = IP_VS_TCP_S_LISTEN;
580	cp->timeout = ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_LISTEN];
581	spin_unlock(&cp->lock);
582	}
583
584
ba602a81	585	static void ip_vs_tcp_init(struct ip_vs_protocol *pp)
1da177e4 LT	586	{
	587	IP_VS_INIT_HASH_TABLE(tcp_apps);
	588	pp->timeout_table = tcp_timeouts;
	589	}
	590
	591
ba602a81	592	static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
1da177e4 LT	593	{
	594	}
	595
	596
	597	struct ip_vs_protocol ip_vs_protocol_tcp = {
	598	.name = "TCP",
	599	.protocol = IPPROTO_TCP,
	600	.dont_defrag = 0,
	601	.appcnt = ATOMIC_INIT(0),
ba602a81 DM	602	.init = ip_vs_tcp_init,
ba602a81 DM	603	.exit = ip_vs_tcp_exit,
1da177e4 LT	604	.register_app = tcp_register_app,
	605	.unregister_app = tcp_unregister_app,
	606	.conn_schedule = tcp_conn_schedule,
	607	.conn_in_get = tcp_conn_in_get,
	608	.conn_out_get = tcp_conn_out_get,
	609	.snat_handler = tcp_snat_handler,
	610	.dnat_handler = tcp_dnat_handler,
	611	.csum_check = tcp_csum_check,
	612	.state_name = tcp_state_name,
	613	.state_transition = tcp_state_transition,
	614	.app_conn_bind = tcp_app_conn_bind,
	615	.debug_packet = ip_vs_tcpudp_debug_packet,
	616	.timeout_change = tcp_timeout_change,
	617	.set_state_timeout = tcp_set_state_timeout,
	618	};