[net-next-2.6.git] / net / ipv4 / ipvs / ip_vs_proto_tcp.c

/*
 * ip_vs_proto_tcp.c:	TCP load balancing support for IPVS
 *
 * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
 *              Julian Anastasov <ja@ssi.bg>
 *
 *              This program is free software; you can redistribute it and/or
 *              modify it under the terms of the GNU General Public License
 *              as published by the Free Software Foundation; either version
 *              2 of the License, or (at your option) any later version.
 *
 * Changes:
 *
 */

#include <linux/kernel.h>
#include <linux/ip.h>
#include <linux/tcp.h>                  /* for tcphdr */
#include <net/ip.h>
#include <net/tcp.h>                    /* for csum_tcpudp_magic */
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>

#include <net/ip_vs.h>


static struct ip_vs_conn *
tcp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	__be16 _ports[2], *pptr;

	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	if (pptr == NULL)
		return NULL;

	if (likely(!inverse)) {
		return ip_vs_conn_in_get(iph->protocol,
					 iph->saddr, pptr[0],
					 iph->daddr, pptr[1]);
	} else {
		return ip_vs_conn_in_get(iph->protocol,
					 iph->daddr, pptr[1],
					 iph->saddr, pptr[0]);
	}
}

static struct ip_vs_conn *
tcp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
		 const struct iphdr *iph, unsigned int proto_off, int inverse)
{
	__be16 _ports[2], *pptr;

	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	if (pptr == NULL)
		return NULL;

	if (likely(!inverse)) {
		return ip_vs_conn_out_get(iph->protocol,
					  iph->saddr, pptr[0],
					  iph->daddr, pptr[1]);
	} else {
		return ip_vs_conn_out_get(iph->protocol,
					  iph->daddr, pptr[1],
					  iph->saddr, pptr[0]);
	}
}


static int
tcp_conn_schedule(struct sk_buff *skb,
		  struct ip_vs_protocol *pp,
		  int *verdict, struct ip_vs_conn **cpp)
{
	struct ip_vs_service *svc;
	struct tcphdr _tcph, *th;
	struct ip_vs_iphdr iph;

	ip_vs_fill_iphdr(AF_INET, skb_network_header(skb), &iph);

	th = skb_header_pointer(skb, iph.len, sizeof(_tcph), &_tcph);
	if (th == NULL) {
		*verdict = NF_DROP;
		return 0;
	}

	if (th->syn &&
	    (svc = ip_vs_service_get(AF_INET, skb->mark, iph.protocol,
				     &iph.daddr, th->dest))) {
		if (ip_vs_todrop()) {
			/*
			 * It seems that we are very loaded.
			 * We have to drop this packet :(
			 */
			ip_vs_service_put(svc);
			*verdict = NF_DROP;
			return 0;
		}

		/*
		 * Let the virtual server select a real server for the
		 * incoming connection, and create a connection entry.
		 */
		*cpp = ip_vs_schedule(svc, skb);
		if (!*cpp) {
			*verdict = ip_vs_leave(svc, skb, pp);
			return 0;
		}
		ip_vs_service_put(svc);
	}
	return 1;
}


static inline void
tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
		     __be16 oldport, __be16 newport)
{
	tcph->check =
		csum_fold(ip_vs_check_diff4(oldip, newip,
				 ip_vs_check_diff2(oldport, newport,
						~csum_unfold(tcph->check))));
}


static int
tcp_snat_handler(struct sk_buff *skb,
		 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
{
	struct tcphdr *tcph;
	const unsigned int tcphoff = ip_hdrlen(skb);

	/* csum_check requires unshared skb */
	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		/* Some checks before mangling */
		if (pp->csum_check && !pp->csum_check(skb, pp))
			return 0;

		/* Call application helper if needed */
		if (!ip_vs_app_pkt_out(cp, skb))
			return 0;
	}

	tcph = (void *)ip_hdr(skb) + tcphoff;
	tcph->source = cp->vport;

	/* Adjust TCP checksums */
	if (!cp->app) {
		/* Only port and addr are changed, do fast csum update */
		tcp_fast_csum_update(tcph, cp->daddr.ip, cp->vaddr.ip,
				     cp->dport, cp->vport);
		if (skb->ip_summed == CHECKSUM_COMPLETE)
			skb->ip_summed = CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		tcph->check = 0;
		skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
		tcph->check = csum_tcpudp_magic(cp->vaddr.ip, cp->caddr.ip,
						skb->len - tcphoff,
						cp->protocol, skb->csum);
		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
			  pp->name, tcph->check,
			  (char*)&(tcph->check) - (char*)tcph);
	}
	return 1;
}


static int
tcp_dnat_handler(struct sk_buff *skb,
		 struct ip_vs_protocol *pp, struct ip_vs_conn *cp)
{
	struct tcphdr *tcph;
	const unsigned int tcphoff = ip_hdrlen(skb);

	/* csum_check requires unshared skb */
	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
		return 0;

	if (unlikely(cp->app != NULL)) {
		/* Some checks before mangling */
		if (pp->csum_check && !pp->csum_check(skb, pp))
			return 0;

		/*
		 *	Attempt ip_vs_app call.
		 *	It will fix ip_vs_conn and iph ack_seq stuff
		 */
		if (!ip_vs_app_pkt_in(cp, skb))
			return 0;
	}

	tcph = (void *)ip_hdr(skb) + tcphoff;
	tcph->dest = cp->dport;

	/*
	 *	Adjust TCP checksums
	 */
	if (!cp->app) {
		/* Only port and addr are changed, do fast csum update */
		tcp_fast_csum_update(tcph, cp->vaddr.ip, cp->daddr.ip,
				     cp->vport, cp->dport);
		if (skb->ip_summed == CHECKSUM_COMPLETE)
			skb->ip_summed = CHECKSUM_NONE;
	} else {
		/* full checksum calculation */
		tcph->check = 0;
		skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
		tcph->check = csum_tcpudp_magic(cp->caddr.ip, cp->daddr.ip,
						skb->len - tcphoff,
						cp->protocol, skb->csum);
		skb->ip_summed = CHECKSUM_UNNECESSARY;
	}
	return 1;
}


static int
tcp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
{
	const unsigned int tcphoff = ip_hdrlen(skb);

	switch (skb->ip_summed) {
	case CHECKSUM_NONE:
		skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
	case CHECKSUM_COMPLETE:
		if (csum_tcpudp_magic(ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
				      skb->len - tcphoff,
				      ip_hdr(skb)->protocol, skb->csum)) {
			IP_VS_DBG_RL_PKT(0, pp, skb, 0,
					 "Failed checksum for");
			return 0;
		}
		break;
	default:
		/* No need to checksum. */
		break;
	}

	return 1;
}


#define TCP_DIR_INPUT		0
#define TCP_DIR_OUTPUT		4
#define TCP_DIR_INPUT_ONLY	8

static const int tcp_state_off[IP_VS_DIR_LAST] = {
	[IP_VS_DIR_INPUT]		=	TCP_DIR_INPUT,
	[IP_VS_DIR_OUTPUT]		=	TCP_DIR_OUTPUT,
	[IP_VS_DIR_INPUT_ONLY]		=	TCP_DIR_INPUT_ONLY,
};

/*
 *	Timeout table[state]
 */
static int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
	[IP_VS_TCP_S_NONE]		=	2*HZ,
	[IP_VS_TCP_S_ESTABLISHED]	=	15*60*HZ,
	[IP_VS_TCP_S_SYN_SENT]		=	2*60*HZ,
	[IP_VS_TCP_S_SYN_RECV]		=	1*60*HZ,
	[IP_VS_TCP_S_FIN_WAIT]		=	2*60*HZ,
	[IP_VS_TCP_S_TIME_WAIT]		=	2*60*HZ,
	[IP_VS_TCP_S_CLOSE]		=	10*HZ,
	[IP_VS_TCP_S_CLOSE_WAIT]	=	60*HZ,
	[IP_VS_TCP_S_LAST_ACK]		=	30*HZ,
	[IP_VS_TCP_S_LISTEN]		=	2*60*HZ,
	[IP_VS_TCP_S_SYNACK]		=	120*HZ,
	[IP_VS_TCP_S_LAST]		=	2*HZ,
};

static char * tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
	[IP_VS_TCP_S_NONE]		=	"NONE",
	[IP_VS_TCP_S_ESTABLISHED]	=	"ESTABLISHED",
	[IP_VS_TCP_S_SYN_SENT]		=	"SYN_SENT",
	[IP_VS_TCP_S_SYN_RECV]		=	"SYN_RECV",
	[IP_VS_TCP_S_FIN_WAIT]		=	"FIN_WAIT",
	[IP_VS_TCP_S_TIME_WAIT]		=	"TIME_WAIT",
	[IP_VS_TCP_S_CLOSE]		=	"CLOSE",
	[IP_VS_TCP_S_CLOSE_WAIT]	=	"CLOSE_WAIT",
	[IP_VS_TCP_S_LAST_ACK]		=	"LAST_ACK",
	[IP_VS_TCP_S_LISTEN]		=	"LISTEN",
	[IP_VS_TCP_S_SYNACK]		=	"SYNACK",
	[IP_VS_TCP_S_LAST]		=	"BUG!",
};

#define sNO IP_VS_TCP_S_NONE
#define sES IP_VS_TCP_S_ESTABLISHED
#define sSS IP_VS_TCP_S_SYN_SENT
#define sSR IP_VS_TCP_S_SYN_RECV
#define sFW IP_VS_TCP_S_FIN_WAIT
#define sTW IP_VS_TCP_S_TIME_WAIT
#define sCL IP_VS_TCP_S_CLOSE
#define sCW IP_VS_TCP_S_CLOSE_WAIT
#define sLA IP_VS_TCP_S_LAST_ACK
#define sLI IP_VS_TCP_S_LISTEN
#define sSA IP_VS_TCP_S_SYNACK

struct tcp_states_t {
	int next_state[IP_VS_TCP_S_LAST];
};

static const char * tcp_state_name(int state)
{
	if (state >= IP_VS_TCP_S_LAST)
		return "ERR!";
	return tcp_state_name_table[state] ? tcp_state_name_table[state] : "?";
}

static struct tcp_states_t tcp_states [] = {
/*	INPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
/*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},

/*	OUTPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSS, sES, sSS, sSR, sSS, sSS, sSS, sSS, sSS, sLI, sSR }},
/*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
/*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},

/*	INPUT-ONLY */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
/*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
};

static struct tcp_states_t tcp_states_dos [] = {
/*	INPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
/*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
/*ack*/ {{sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},

/*	OUTPUT */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSS, sES, sSS, sSA, sSS, sSS, sSS, sSS, sSS, sLI, sSA }},
/*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
/*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
/*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},

/*	INPUT-ONLY */
/*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA	*/
/*syn*/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
/*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
/*ack*/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
/*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
};

static struct tcp_states_t *tcp_state_table = tcp_states;


static void tcp_timeout_change(struct ip_vs_protocol *pp, int flags)
{
	int on = (flags & 1);		/* secure_tcp */

	/*
	** FIXME: change secure_tcp to independent sysctl var
	** or make it per-service or per-app because it is valid
	** for most if not for all of the applications. Something
	** like "capabilities" (flags) for each object.
	*/
	tcp_state_table = (on? tcp_states_dos : tcp_states);
}

static int
tcp_set_state_timeout(struct ip_vs_protocol *pp, char *sname, int to)
{
	return ip_vs_set_state_timeout(pp->timeout_table, IP_VS_TCP_S_LAST,
				       tcp_state_name_table, sname, to);
}

static inline int tcp_state_idx(struct tcphdr *th)
{
	if (th->rst)
		return 3;
	if (th->syn)
		return 0;
	if (th->fin)
		return 1;
	if (th->ack)
		return 2;
	return -1;
}

static inline void
set_tcp_state(struct ip_vs_protocol *pp, struct ip_vs_conn *cp,
	      int direction, struct tcphdr *th)
{
	int state_idx;
	int new_state = IP_VS_TCP_S_CLOSE;
	int state_off = tcp_state_off[direction];

	/*
	 *    Update state offset to INPUT_ONLY if necessary
	 *    or delete NO_OUTPUT flag if output packet detected
	 */
	if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
		if (state_off == TCP_DIR_OUTPUT)
			cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
		else
			state_off = TCP_DIR_INPUT_ONLY;
	}

	if ((state_idx = tcp_state_idx(th)) < 0) {
		IP_VS_DBG(8, "tcp_state_idx=%d!!!\n", state_idx);
		goto tcp_state_out;
	}

	new_state = tcp_state_table[state_off+state_idx].next_state[cp->state];

  tcp_state_out:
	if (new_state != cp->state) {
		struct ip_vs_dest *dest = cp->dest;

		IP_VS_DBG(8, "%s %s [%c%c%c%c] %u.%u.%u.%u:%d->"
			  "%u.%u.%u.%u:%d state: %s->%s conn->refcnt:%d\n",
			  pp->name,
			  (state_off==TCP_DIR_OUTPUT)?"output ":"input ",
			  th->syn? 'S' : '.',
			  th->fin? 'F' : '.',
			  th->ack? 'A' : '.',
			  th->rst? 'R' : '.',
			  NIPQUAD(cp->daddr.ip), ntohs(cp->dport),
			  NIPQUAD(cp->caddr.ip), ntohs(cp->cport),
			  tcp_state_name(cp->state),
			  tcp_state_name(new_state),
			  atomic_read(&cp->refcnt));
		if (dest) {
			if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
			    (new_state != IP_VS_TCP_S_ESTABLISHED)) {
				atomic_dec(&dest->activeconns);
				atomic_inc(&dest->inactconns);
				cp->flags |= IP_VS_CONN_F_INACTIVE;
			} else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
				   (new_state == IP_VS_TCP_S_ESTABLISHED)) {
				atomic_inc(&dest->activeconns);
				atomic_dec(&dest->inactconns);
				cp->flags &= ~IP_VS_CONN_F_INACTIVE;
			}
		}
	}

	cp->timeout = pp->timeout_table[cp->state = new_state];
}


/*
 *	Handle state transitions
 */
static int
tcp_state_transition(struct ip_vs_conn *cp, int direction,
		     const struct sk_buff *skb,
		     struct ip_vs_protocol *pp)
{
	struct tcphdr _tcph, *th;

	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
	if (th == NULL)
		return 0;

	spin_lock(&cp->lock);
	set_tcp_state(pp, cp, direction, th);
	spin_unlock(&cp->lock);

	return 1;
}


/*
 *	Hash table for TCP application incarnations
 */
#define	TCP_APP_TAB_BITS	4
#define	TCP_APP_TAB_SIZE	(1 << TCP_APP_TAB_BITS)
#define	TCP_APP_TAB_MASK	(TCP_APP_TAB_SIZE - 1)

static struct list_head tcp_apps[TCP_APP_TAB_SIZE];
static DEFINE_SPINLOCK(tcp_app_lock);

static inline __u16 tcp_app_hashkey(__be16 port)
{
	return (((__force u16)port >> TCP_APP_TAB_BITS) ^ (__force u16)port)
		& TCP_APP_TAB_MASK;
}


static int tcp_register_app(struct ip_vs_app *inc)
{
	struct ip_vs_app *i;
	__u16 hash;
	__be16 port = inc->port;
	int ret = 0;

	hash = tcp_app_hashkey(port);

	spin_lock_bh(&tcp_app_lock);
	list_for_each_entry(i, &tcp_apps[hash], p_list) {
		if (i->port == port) {
			ret = -EEXIST;
			goto out;
		}
	}
	list_add(&inc->p_list, &tcp_apps[hash]);
	atomic_inc(&ip_vs_protocol_tcp.appcnt);

  out:
	spin_unlock_bh(&tcp_app_lock);
	return ret;
}


static void
tcp_unregister_app(struct ip_vs_app *inc)
{
	spin_lock_bh(&tcp_app_lock);
	atomic_dec(&ip_vs_protocol_tcp.appcnt);
	list_del(&inc->p_list);
	spin_unlock_bh(&tcp_app_lock);
}


static int
tcp_app_conn_bind(struct ip_vs_conn *cp)
{
	int hash;
	struct ip_vs_app *inc;
	int result = 0;

	/* Default binding: bind app only for NAT */
	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
		return 0;

	/* Lookup application incarnations and bind the right one */
	hash = tcp_app_hashkey(cp->vport);

	spin_lock(&tcp_app_lock);
	list_for_each_entry(inc, &tcp_apps[hash], p_list) {
		if (inc->port == cp->vport) {
			if (unlikely(!ip_vs_app_inc_get(inc)))
				break;
			spin_unlock(&tcp_app_lock);

			IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
				  "%u.%u.%u.%u:%u to app %s on port %u\n",
				  __func__,
				  NIPQUAD(cp->caddr.ip), ntohs(cp->cport),
				  NIPQUAD(cp->vaddr.ip), ntohs(cp->vport),
				  inc->name, ntohs(inc->port));
			cp->app = inc;
			if (inc->init_conn)
				result = inc->init_conn(inc, cp);
			goto out;
		}
	}
	spin_unlock(&tcp_app_lock);

  out:
	return result;
}


/*
 *	Set LISTEN timeout. (ip_vs_conn_put will setup timer)
 */
void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
{
	spin_lock(&cp->lock);
	cp->state = IP_VS_TCP_S_LISTEN;
	cp->timeout = ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_LISTEN];
	spin_unlock(&cp->lock);
}


static void ip_vs_tcp_init(struct ip_vs_protocol *pp)
{
	IP_VS_INIT_HASH_TABLE(tcp_apps);
	pp->timeout_table = tcp_timeouts;
}


static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
{
}


struct ip_vs_protocol ip_vs_protocol_tcp = {
	.name =			"TCP",
	.protocol =		IPPROTO_TCP,
	.num_states =		IP_VS_TCP_S_LAST,
	.dont_defrag =		0,
	.appcnt =		ATOMIC_INIT(0),
	.init =			ip_vs_tcp_init,
	.exit =			ip_vs_tcp_exit,
	.register_app =		tcp_register_app,
	.unregister_app =	tcp_unregister_app,
	.conn_schedule =	tcp_conn_schedule,
	.conn_in_get =		tcp_conn_in_get,
	.conn_out_get =		tcp_conn_out_get,
	.snat_handler =		tcp_snat_handler,
	.dnat_handler =		tcp_dnat_handler,
	.csum_check =		tcp_csum_check,
	.state_name =		tcp_state_name,
	.state_transition =	tcp_state_transition,
	.app_conn_bind =	tcp_app_conn_bind,
	.debug_packet =		ip_vs_tcpudp_debug_packet,
	.timeout_change =	tcp_timeout_change,
	.set_state_timeout =	tcp_set_state_timeout,
};
Commit	Line	Data
1da177e4 LT	1	/*
	2	* ip_vs_proto_tcp.c: TCP load balancing support for IPVS
	3	*
1da177e4 LT	4	* Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
	5	* Julian Anastasov <ja@ssi.bg>
	6	*
	7	* This program is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU General Public License
	9	* as published by the Free Software Foundation; either version
	10	* 2 of the License, or (at your option) any later version.
	11	*
	12	* Changes:
	13	*
	14	*/
	15
	16	#include <linux/kernel.h>
	17	#include <linux/ip.h>
	18	#include <linux/tcp.h> /* for tcphdr */
	19	#include <net/ip.h>
	20	#include <net/tcp.h> /* for csum_tcpudp_magic */
af1e1cf0	21	#include <linux/netfilter.h>
1da177e4 LT	22	#include <linux/netfilter_ipv4.h>
	23
	24	#include <net/ip_vs.h>
	25
	26
	27	static struct ip_vs_conn *
	28	tcp_conn_in_get(const struct sk_buff skb, struct ip_vs_protocol pp,
	29	const struct iphdr *iph, unsigned int proto_off, int inverse)
	30	{
014d730d	31	__be16 _ports[2], *pptr;
1da177e4 LT	32
	33	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	34	if (pptr == NULL)
	35	return NULL;
	36
	37	if (likely(!inverse)) {
	38	return ip_vs_conn_in_get(iph->protocol,
	39	iph->saddr, pptr[0],
	40	iph->daddr, pptr[1]);
	41	} else {
	42	return ip_vs_conn_in_get(iph->protocol,
	43	iph->daddr, pptr[1],
	44	iph->saddr, pptr[0]);
	45	}
	46	}
	47
	48	static struct ip_vs_conn *
	49	tcp_conn_out_get(const struct sk_buff skb, struct ip_vs_protocol pp,
	50	const struct iphdr *iph, unsigned int proto_off, int inverse)
	51	{
014d730d	52	__be16 _ports[2], *pptr;
1da177e4 LT	53
	54	pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
	55	if (pptr == NULL)
	56	return NULL;
	57
	58	if (likely(!inverse)) {
	59	return ip_vs_conn_out_get(iph->protocol,
	60	iph->saddr, pptr[0],
	61	iph->daddr, pptr[1]);
	62	} else {
	63	return ip_vs_conn_out_get(iph->protocol,
	64	iph->daddr, pptr[1],
	65	iph->saddr, pptr[0]);
	66	}
	67	}
	68
	69
	70	static int
	71	tcp_conn_schedule(struct sk_buff *skb,
	72	struct ip_vs_protocol *pp,
	73	int verdict, struct ip_vs_conn *cpp)
	74	{
	75	struct ip_vs_service *svc;
	76	struct tcphdr _tcph, *th;
3c2e0505	77	struct ip_vs_iphdr iph;
1da177e4	78
3c2e0505 JV	79	ip_vs_fill_iphdr(AF_INET, skb_network_header(skb), &iph);
	80
	81	th = skb_header_pointer(skb, iph.len, sizeof(_tcph), &_tcph);
1da177e4 LT	82	if (th == NULL) {
	83	*verdict = NF_DROP;
	84	return 0;
	85	}
	86
	87	if (th->syn &&
3c2e0505 JV	88	(svc = ip_vs_service_get(AF_INET, skb->mark, iph.protocol,
3c2e0505 JV	89	&iph.daddr, th->dest))) {
1da177e4 LT	90	if (ip_vs_todrop()) {
	91	/*
	92	* It seems that we are very loaded.
	93	* We have to drop this packet :(
	94	*/
	95	ip_vs_service_put(svc);
	96	*verdict = NF_DROP;
	97	return 0;
	98	}
	99
	100	/*
	101	* Let the virtual server select a real server for the
	102	* incoming connection, and create a connection entry.
	103	*/
	104	*cpp = ip_vs_schedule(svc, skb);
	105	if (!*cpp) {
	106	*verdict = ip_vs_leave(svc, skb, pp);
	107	return 0;
	108	}
	109	ip_vs_service_put(svc);
	110	}
	111	return 1;
	112	}
	113
	114
	115	static inline void
014d730d AV	116	tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
014d730d AV	117	__be16 oldport, __be16 newport)
1da177e4 LT	118	{
1da177e4 LT	119	tcph->check =
f9214b26 AV	120	csum_fold(ip_vs_check_diff4(oldip, newip,
	121	ip_vs_check_diff2(oldport, newport,
	122	~csum_unfold(tcph->check))));
1da177e4 LT	123	}
	124
	125
	126	static int
3db05fea	127	tcp_snat_handler(struct sk_buff *skb,
1da177e4 LT	128	struct ip_vs_protocol pp, struct ip_vs_conn cp)
	129	{
	130	struct tcphdr *tcph;
3db05fea	131	const unsigned int tcphoff = ip_hdrlen(skb);
1da177e4 LT	132
1da177e4 LT	133	/* csum_check requires unshared skb */
3db05fea	134	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
1da177e4 LT	135	return 0;
	136
	137	if (unlikely(cp->app != NULL)) {
	138	/* Some checks before mangling */
3db05fea	139	if (pp->csum_check && !pp->csum_check(skb, pp))
1da177e4 LT	140	return 0;
	141
	142	/* Call application helper if needed */
3db05fea	143	if (!ip_vs_app_pkt_out(cp, skb))
1da177e4 LT	144	return 0;
	145	}
	146
3db05fea	147	tcph = (void *)ip_hdr(skb) + tcphoff;
1da177e4 LT	148	tcph->source = cp->vport;
	149
	150	/* Adjust TCP checksums */
	151	if (!cp->app) {
	152	/* Only port and addr are changed, do fast csum update */
e7ade46a	153	tcp_fast_csum_update(tcph, cp->daddr.ip, cp->vaddr.ip,
1da177e4	154	cp->dport, cp->vport);
3db05fea HX	155	if (skb->ip_summed == CHECKSUM_COMPLETE)
3db05fea HX	156	skb->ip_summed = CHECKSUM_NONE;
1da177e4 LT	157	} else {
	158	/* full checksum calculation */
	159	tcph->check = 0;
3db05fea	160	skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
e7ade46a	161	tcph->check = csum_tcpudp_magic(cp->vaddr.ip, cp->caddr.ip,
3db05fea HX	162	skb->len - tcphoff,
3db05fea HX	163	cp->protocol, skb->csum);
1da177e4 LT	164	IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
	165	pp->name, tcph->check,
	166	(char)&(tcph->check) - (char)tcph);
	167	}
	168	return 1;
	169	}
	170
	171
	172	static int
3db05fea	173	tcp_dnat_handler(struct sk_buff *skb,
1da177e4 LT	174	struct ip_vs_protocol pp, struct ip_vs_conn cp)
	175	{
	176	struct tcphdr *tcph;
3db05fea	177	const unsigned int tcphoff = ip_hdrlen(skb);
1da177e4 LT	178
1da177e4 LT	179	/* csum_check requires unshared skb */
3db05fea	180	if (!skb_make_writable(skb, tcphoff+sizeof(*tcph)))
1da177e4 LT	181	return 0;
	182
	183	if (unlikely(cp->app != NULL)) {
	184	/* Some checks before mangling */
3db05fea	185	if (pp->csum_check && !pp->csum_check(skb, pp))
1da177e4 LT	186	return 0;
	187
	188	/*
	189	* Attempt ip_vs_app call.
	190	* It will fix ip_vs_conn and iph ack_seq stuff
	191	*/
3db05fea	192	if (!ip_vs_app_pkt_in(cp, skb))
1da177e4 LT	193	return 0;
	194	}
	195
3db05fea	196	tcph = (void *)ip_hdr(skb) + tcphoff;
1da177e4 LT	197	tcph->dest = cp->dport;
	198
	199	/*
	200	* Adjust TCP checksums
	201	*/
	202	if (!cp->app) {
	203	/* Only port and addr are changed, do fast csum update */
e7ade46a	204	tcp_fast_csum_update(tcph, cp->vaddr.ip, cp->daddr.ip,
1da177e4	205	cp->vport, cp->dport);
3db05fea HX	206	if (skb->ip_summed == CHECKSUM_COMPLETE)
3db05fea HX	207	skb->ip_summed = CHECKSUM_NONE;
1da177e4 LT	208	} else {
	209	/* full checksum calculation */
	210	tcph->check = 0;
3db05fea	211	skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
e7ade46a	212	tcph->check = csum_tcpudp_magic(cp->caddr.ip, cp->daddr.ip,
3db05fea HX	213	skb->len - tcphoff,
	214	cp->protocol, skb->csum);
	215	skb->ip_summed = CHECKSUM_UNNECESSARY;
1da177e4 LT	216	}
	217	return 1;
	218	}
	219
	220
	221	static int
	222	tcp_csum_check(struct sk_buff skb, struct ip_vs_protocol pp)
	223	{
c9bdd4b5	224	const unsigned int tcphoff = ip_hdrlen(skb);
1da177e4 LT	225
	226	switch (skb->ip_summed) {
	227	case CHECKSUM_NONE:
	228	skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
84fa7933	229	case CHECKSUM_COMPLETE:
eddc9ec5	230	if (csum_tcpudp_magic(ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
1da177e4	231	skb->len - tcphoff,
eddc9ec5	232	ip_hdr(skb)->protocol, skb->csum)) {
1da177e4 LT	233	IP_VS_DBG_RL_PKT(0, pp, skb, 0,
	234	"Failed checksum for");
	235	return 0;
	236	}
	237	break;
	238	default:
84fa7933	239	/* No need to checksum. */
1da177e4 LT	240	break;
	241	}
	242
	243	return 1;
	244	}
	245
	246
	247	#define TCP_DIR_INPUT 0
	248	#define TCP_DIR_OUTPUT 4
	249	#define TCP_DIR_INPUT_ONLY 8
	250
9b5b5cff	251	static const int tcp_state_off[IP_VS_DIR_LAST] = {
1da177e4 LT	252	[IP_VS_DIR_INPUT] = TCP_DIR_INPUT,
	253	[IP_VS_DIR_OUTPUT] = TCP_DIR_OUTPUT,
	254	[IP_VS_DIR_INPUT_ONLY] = TCP_DIR_INPUT_ONLY,
	255	};
	256
	257	/*
	258	* Timeout table[state]
	259	*/
	260	static int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
	261	[IP_VS_TCP_S_NONE] = 2*HZ,
	262	[IP_VS_TCP_S_ESTABLISHED] = 1560HZ,
	263	[IP_VS_TCP_S_SYN_SENT] = 260HZ,
	264	[IP_VS_TCP_S_SYN_RECV] = 160HZ,
	265	[IP_VS_TCP_S_FIN_WAIT] = 260HZ,
	266	[IP_VS_TCP_S_TIME_WAIT] = 260HZ,
	267	[IP_VS_TCP_S_CLOSE] = 10*HZ,
	268	[IP_VS_TCP_S_CLOSE_WAIT] = 60*HZ,
	269	[IP_VS_TCP_S_LAST_ACK] = 30*HZ,
	270	[IP_VS_TCP_S_LISTEN] = 260HZ,
	271	[IP_VS_TCP_S_SYNACK] = 120*HZ,
	272	[IP_VS_TCP_S_LAST] = 2*HZ,
	273	};
	274
1da177e4 LT	275	static char * tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
	276	[IP_VS_TCP_S_NONE] = "NONE",
	277	[IP_VS_TCP_S_ESTABLISHED] = "ESTABLISHED",
	278	[IP_VS_TCP_S_SYN_SENT] = "SYN_SENT",
	279	[IP_VS_TCP_S_SYN_RECV] = "SYN_RECV",
	280	[IP_VS_TCP_S_FIN_WAIT] = "FIN_WAIT",
	281	[IP_VS_TCP_S_TIME_WAIT] = "TIME_WAIT",
	282	[IP_VS_TCP_S_CLOSE] = "CLOSE",
	283	[IP_VS_TCP_S_CLOSE_WAIT] = "CLOSE_WAIT",
	284	[IP_VS_TCP_S_LAST_ACK] = "LAST_ACK",
	285	[IP_VS_TCP_S_LISTEN] = "LISTEN",
	286	[IP_VS_TCP_S_SYNACK] = "SYNACK",
	287	[IP_VS_TCP_S_LAST] = "BUG!",
	288	};
	289
	290	#define sNO IP_VS_TCP_S_NONE
	291	#define sES IP_VS_TCP_S_ESTABLISHED
	292	#define sSS IP_VS_TCP_S_SYN_SENT
	293	#define sSR IP_VS_TCP_S_SYN_RECV
	294	#define sFW IP_VS_TCP_S_FIN_WAIT
	295	#define sTW IP_VS_TCP_S_TIME_WAIT
	296	#define sCL IP_VS_TCP_S_CLOSE
	297	#define sCW IP_VS_TCP_S_CLOSE_WAIT
	298	#define sLA IP_VS_TCP_S_LAST_ACK
	299	#define sLI IP_VS_TCP_S_LISTEN
	300	#define sSA IP_VS_TCP_S_SYNACK
	301
	302	struct tcp_states_t {
	303	int next_state[IP_VS_TCP_S_LAST];
	304	};
	305
	306	static const char * tcp_state_name(int state)
	307	{
	308	if (state >= IP_VS_TCP_S_LAST)
	309	return "ERR!";
	310	return tcp_state_name_table[state] ? tcp_state_name_table[state] : "?";
	311	}
	312
	313	static struct tcp_states_t tcp_states [] = {
	314	/* INPUT */
	315	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	316	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
	317	/fin/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
	318	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
	319	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},
	320
	321	/* OUTPUT */
	322	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	323	/syn/ {{sSS, sES, sSS, sSR, sSS, sSS, sSS, sSS, sSS, sLI, sSR }},
	324	/fin/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
	325	/ack/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
	326	/rst/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
	327
	328	/* INPUT-ONLY */
	329	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
	330	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
	331	/fin/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
	332	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
	333	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
	334	};
	335
	336	static struct tcp_states_t tcp_states_dos [] = {
	337	/* INPUT */
	338	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
339	/syn/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
340	/fin/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
341	/ack/ {{sCL, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
342	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
343
344	/* OUTPUT */
345	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
346	/syn/ {{sSS, sES, sSS, sSA, sSS, sSS, sSS, sSS, sSS, sLI, sSA }},
347	/fin/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
348	/ack/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
349	/rst/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
350
351	/* INPUT-ONLY */
352	/* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
353	/syn/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
354	/fin/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
355	/ack/ {{sCL, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
356	/rst/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
357	};
358
359	static struct tcp_states_t *tcp_state_table = tcp_states;
360
361
362	static void tcp_timeout_change(struct ip_vs_protocol *pp, int flags)
363	{
364	int on = (flags & 1); /* secure_tcp */
365
366	/*
367	** FIXME: change secure_tcp to independent sysctl var
368	** or make it per-service or per-app because it is valid
369	** for most if not for all of the applications. Something
370	** like "capabilities" (flags) for each object.
371	*/
372	tcp_state_table = (on? tcp_states_dos : tcp_states);
373	}
374
375	static int
376	tcp_set_state_timeout(struct ip_vs_protocol pp, char sname, int to)
377	{
378	return ip_vs_set_state_timeout(pp->timeout_table, IP_VS_TCP_S_LAST,
379	tcp_state_name_table, sname, to);
380	}
381
382	static inline int tcp_state_idx(struct tcphdr *th)
383	{
384	if (th->rst)
385	return 3;
386	if (th->syn)
387	return 0;
388	if (th->fin)
389	return 1;
390	if (th->ack)
391	return 2;
392	return -1;
393	}
394
395	static inline void
396	set_tcp_state(struct ip_vs_protocol pp, struct ip_vs_conn cp,
397	int direction, struct tcphdr *th)
398	{
399	int state_idx;
400	int new_state = IP_VS_TCP_S_CLOSE;
401	int state_off = tcp_state_off[direction];
402
403	/*
404	* Update state offset to INPUT_ONLY if necessary
405	* or delete NO_OUTPUT flag if output packet detected
406	*/
407	if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
408	if (state_off == TCP_DIR_OUTPUT)
409	cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
410	else
411	state_off = TCP_DIR_INPUT_ONLY;
412	}
413
414	if ((state_idx = tcp_state_idx(th)) < 0) {
415	IP_VS_DBG(8, "tcp_state_idx=%d!!!\n", state_idx);
416	goto tcp_state_out;
417	}
418
419	new_state = tcp_state_table[state_off+state_idx].next_state[cp->state];
420
421	tcp_state_out:
422	if (new_state != cp->state) {
423	struct ip_vs_dest *dest = cp->dest;
424
425	IP_VS_DBG(8, "%s %s [%c%c%c%c] %u.%u.%u.%u:%d->"
4b5bdf5c	426	"%u.%u.%u.%u:%d state: %s->%s conn->refcnt:%d\n",
1da177e4 LT	427	pp->name,
	428	(state_off==TCP_DIR_OUTPUT)?"output ":"input ",
	429	th->syn? 'S' : '.',
	430	th->fin? 'F' : '.',
	431	th->ack? 'A' : '.',
	432	th->rst? 'R' : '.',
e7ade46a JV	433	NIPQUAD(cp->daddr.ip), ntohs(cp->dport),
e7ade46a JV	434	NIPQUAD(cp->caddr.ip), ntohs(cp->cport),
1da177e4 LT	435	tcp_state_name(cp->state),
	436	tcp_state_name(new_state),
	437	atomic_read(&cp->refcnt));
	438	if (dest) {
	439	if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
	440	(new_state != IP_VS_TCP_S_ESTABLISHED)) {
	441	atomic_dec(&dest->activeconns);
	442	atomic_inc(&dest->inactconns);
	443	cp->flags \|= IP_VS_CONN_F_INACTIVE;
	444	} else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
	445	(new_state == IP_VS_TCP_S_ESTABLISHED)) {
	446	atomic_inc(&dest->activeconns);
	447	atomic_dec(&dest->inactconns);
	448	cp->flags &= ~IP_VS_CONN_F_INACTIVE;
	449	}
	450	}
	451	}
	452
	453	cp->timeout = pp->timeout_table[cp->state = new_state];
	454	}
	455
	456
	457	/*
	458	* Handle state transitions
	459	*/
	460	static int
	461	tcp_state_transition(struct ip_vs_conn *cp, int direction,
	462	const struct sk_buff *skb,
	463	struct ip_vs_protocol *pp)
	464	{
	465	struct tcphdr _tcph, *th;
	466
c9bdd4b5	467	th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
1da177e4 LT	468	if (th == NULL)
	469	return 0;
	470
	471	spin_lock(&cp->lock);
	472	set_tcp_state(pp, cp, direction, th);
	473	spin_unlock(&cp->lock);
	474
	475	return 1;
	476	}
	477
	478
	479	/*
	480	* Hash table for TCP application incarnations
	481	*/
	482	#define TCP_APP_TAB_BITS 4
	483	#define TCP_APP_TAB_SIZE (1 << TCP_APP_TAB_BITS)
	484	#define TCP_APP_TAB_MASK (TCP_APP_TAB_SIZE - 1)
	485
	486	static struct list_head tcp_apps[TCP_APP_TAB_SIZE];
	487	static DEFINE_SPINLOCK(tcp_app_lock);
	488
75e7ce66	489	static inline __u16 tcp_app_hashkey(__be16 port)
1da177e4	490	{
75e7ce66 AV	491	return (((__force u16)port >> TCP_APP_TAB_BITS) ^ (__force u16)port)
75e7ce66 AV	492	& TCP_APP_TAB_MASK;
1da177e4 LT	493	}
	494
	495
	496	static int tcp_register_app(struct ip_vs_app *inc)
	497	{
	498	struct ip_vs_app *i;
75e7ce66 AV	499	__u16 hash;
75e7ce66 AV	500	__be16 port = inc->port;
1da177e4 LT	501	int ret = 0;
	502
	503	hash = tcp_app_hashkey(port);
	504
	505	spin_lock_bh(&tcp_app_lock);
	506	list_for_each_entry(i, &tcp_apps[hash], p_list) {
	507	if (i->port == port) {
	508	ret = -EEXIST;
	509	goto out;
	510	}
	511	}
	512	list_add(&inc->p_list, &tcp_apps[hash]);
	513	atomic_inc(&ip_vs_protocol_tcp.appcnt);
	514
	515	out:
	516	spin_unlock_bh(&tcp_app_lock);
	517	return ret;
	518	}
	519
	520
	521	static void
	522	tcp_unregister_app(struct ip_vs_app *inc)
	523	{
	524	spin_lock_bh(&tcp_app_lock);
	525	atomic_dec(&ip_vs_protocol_tcp.appcnt);
	526	list_del(&inc->p_list);
	527	spin_unlock_bh(&tcp_app_lock);
	528	}
	529
	530
	531	static int
	532	tcp_app_conn_bind(struct ip_vs_conn *cp)
	533	{
	534	int hash;
	535	struct ip_vs_app *inc;
	536	int result = 0;
	537
	538	/* Default binding: bind app only for NAT */
	539	if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
	540	return 0;
	541
	542	/* Lookup application incarnations and bind the right one */
	543	hash = tcp_app_hashkey(cp->vport);
	544
	545	spin_lock(&tcp_app_lock);
	546	list_for_each_entry(inc, &tcp_apps[hash], p_list) {
	547	if (inc->port == cp->vport) {
	548	if (unlikely(!ip_vs_app_inc_get(inc)))
	549	break;
	550	spin_unlock(&tcp_app_lock);
	551
	552	IP_VS_DBG(9, "%s: Binding conn %u.%u.%u.%u:%u->"
	553	"%u.%u.%u.%u:%u to app %s on port %u\n",
0dc47877	554	__func__,
e7ade46a JV	555	NIPQUAD(cp->caddr.ip), ntohs(cp->cport),
e7ade46a JV	556	NIPQUAD(cp->vaddr.ip), ntohs(cp->vport),
1da177e4 LT	557	inc->name, ntohs(inc->port));
	558	cp->app = inc;
	559	if (inc->init_conn)
	560	result = inc->init_conn(inc, cp);
	561	goto out;
	562	}
	563	}
	564	spin_unlock(&tcp_app_lock);
	565
	566	out:
	567	return result;
	568	}
	569
	570
	571	/*
	572	* Set LISTEN timeout. (ip_vs_conn_put will setup timer)
	573	*/
	574	void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
	575	{
	576	spin_lock(&cp->lock);
	577	cp->state = IP_VS_TCP_S_LISTEN;
	578	cp->timeout = ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_LISTEN];
	579	spin_unlock(&cp->lock);
	580	}
	581
	582
ba602a81	583	static void ip_vs_tcp_init(struct ip_vs_protocol *pp)
1da177e4 LT	584	{
	585	IP_VS_INIT_HASH_TABLE(tcp_apps);
	586	pp->timeout_table = tcp_timeouts;
	587	}
	588
	589
ba602a81	590	static void ip_vs_tcp_exit(struct ip_vs_protocol *pp)
1da177e4 LT	591	{
	592	}
	593
	594
	595	struct ip_vs_protocol ip_vs_protocol_tcp = {
	596	.name = "TCP",
	597	.protocol = IPPROTO_TCP,
2ad17def	598	.num_states = IP_VS_TCP_S_LAST,
1da177e4 LT	599	.dont_defrag = 0,
1da177e4 LT	600	.appcnt = ATOMIC_INIT(0),
ba602a81 DM	601	.init = ip_vs_tcp_init,
ba602a81 DM	602	.exit = ip_vs_tcp_exit,
1da177e4 LT	603	.register_app = tcp_register_app,
	604	.unregister_app = tcp_unregister_app,
	605	.conn_schedule = tcp_conn_schedule,
	606	.conn_in_get = tcp_conn_in_get,
	607	.conn_out_get = tcp_conn_out_get,
	608	.snat_handler = tcp_snat_handler,
	609	.dnat_handler = tcp_dnat_handler,
	610	.csum_check = tcp_csum_check,
	611	.state_name = tcp_state_name,
	612	.state_transition = tcp_state_transition,
	613	.app_conn_bind = tcp_app_conn_bind,
	614	.debug_packet = ip_vs_tcpudp_debug_packet,
	615	.timeout_change = tcp_timeout_change,
	616	.set_state_timeout = tcp_set_state_timeout,
	617	};