net/netfilter/ipvs/ip_vs_conn.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the Netfilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
  18  * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
  19  * and others. Many code here is taken from IP MASQ code of kernel 2.2.
  20  *
  21  * Changes:
  22  *
  23  */
  24
  25 #define KMSG_COMPONENT "IPVS"
  26 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  27
  28 #include <linux/interrupt.h>
  29 #include <linux/in.h>
  30 #include <linux/net.h>
  31 #include <linux/kernel.h>
  32 #include <linux/module.h>
  33 #include <linux/vmalloc.h>
  34 #include <linux/proc_fs.h>              /* for proc_net_* */
  35 #include <linux/slab.h>
  36 #include <linux/seq_file.h>
  37 #include <linux/jhash.h>
  38 #include <linux/random.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <net/ip_vs.h>
  42
  43
  44 #ifndef CONFIG_IP_VS_TAB_BITS
  45 #define CONFIG_IP_VS_TAB_BITS   12
  46 #endif
  47
  48 /*
  49  * Connection hash size. Default is what was selected at compile time.
  50 */
  51 int ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
  52 module_param_named(conn_tab_bits, ip_vs_conn_tab_bits, int, 0444);
  53 MODULE_PARM_DESC(conn_tab_bits, "Set connections' hash size");
  54
  55 /* size and mask values */
  56 int ip_vs_conn_tab_size;
  57 int ip_vs_conn_tab_mask;
  58
  59 /*
  60  *  Connection hash table: for input and output packets lookups of IPVS
  61  */
  62 static struct list_head *ip_vs_conn_tab;
  63
  64 /*  SLAB cache for IPVS connections */
  65 static struct kmem_cache *ip_vs_conn_cachep __read_mostly;
  66
  67 /*  counter for current IPVS connections */
  68 static atomic_t ip_vs_conn_count = ATOMIC_INIT(0);
  69
  70 /*  counter for no client port connections */
  71 static atomic_t ip_vs_conn_no_cport_cnt = ATOMIC_INIT(0);
  72
  73 /* random value for IPVS connection hash */
  74 static unsigned int ip_vs_conn_rnd;
  75
  76 /*
  77  *  Fine locking granularity for big connection hash table
  78  */
  79 #define CT_LOCKARRAY_BITS  4
  80 #define CT_LOCKARRAY_SIZE  (1<<CT_LOCKARRAY_BITS)
  81 #define CT_LOCKARRAY_MASK  (CT_LOCKARRAY_SIZE-1)
  82
  83 struct ip_vs_aligned_lock
  84 {
  85         rwlock_t        l;
  86 } __attribute__((__aligned__(SMP_CACHE_BYTES)));
  87
  88 /* lock array for conn table */
  89 static struct ip_vs_aligned_lock
  90 __ip_vs_conntbl_lock_array[CT_LOCKARRAY_SIZE] __cacheline_aligned;
  91
  92 static inline void ct_read_lock(unsigned key)
  93 {
  94         read_lock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
  95 }
  96
  97 static inline void ct_read_unlock(unsigned key)
  98 {
  99         read_unlock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 100 }
 101
 102 static inline void ct_write_lock(unsigned key)
 103 {
 104         write_lock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 105 }
 106
 107 static inline void ct_write_unlock(unsigned key)
 108 {
 109         write_unlock(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 110 }
 111
 112 static inline void ct_read_lock_bh(unsigned key)
 113 {
 114         read_lock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 115 }
 116
 117 static inline void ct_read_unlock_bh(unsigned key)
 118 {
 119         read_unlock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 120 }
 121
 122 static inline void ct_write_lock_bh(unsigned key)
 123 {
 124         write_lock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 125 }
 126
 127 static inline void ct_write_unlock_bh(unsigned key)
 128 {
 129         write_unlock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l);
 130 }
 131
 132
 133 /*
 134  *      Returns hash value for IPVS connection entry
 135  */
 136 static unsigned int ip_vs_conn_hashkey(int af, unsigned proto,
 137                                        const union nf_inet_addr *addr,
 138                                        __be16 port)
 139 {
 140 #ifdef CONFIG_IP_VS_IPV6
 141         if (af == AF_INET6)
 142                 return jhash_3words(jhash(addr, 16, ip_vs_conn_rnd),
 143                                     (__force u32)port, proto, ip_vs_conn_rnd)
 144                         & ip_vs_conn_tab_mask;
 145 #endif
 146         return jhash_3words((__force u32)addr->ip, (__force u32)port, proto,
 147                             ip_vs_conn_rnd)
 148                 & ip_vs_conn_tab_mask;
 149 }
 150
 151 static unsigned int ip_vs_conn_hashkey_param(const struct ip_vs_conn_param *p,
 152                                              bool inverse)
 153 {
 154         const union nf_inet_addr *addr;
 155         __be16 port;
 156
 157         if (p->pe_data && p->pe->hashkey_raw)
 158                 return p->pe->hashkey_raw(p, ip_vs_conn_rnd, inverse) &
 159                         ip_vs_conn_tab_mask;
 160
 161         if (likely(!inverse)) {
 162                 addr = p->caddr;
 163                 port = p->cport;
 164         } else {
 165                 addr = p->vaddr;
 166                 port = p->vport;
 167         }
 168
 169         return ip_vs_conn_hashkey(p->af, p->protocol, addr, port);
 170 }
 171
 172 static unsigned int ip_vs_conn_hashkey_conn(const struct ip_vs_conn *cp)
 173 {
 174         struct ip_vs_conn_param p;
 175
 176         ip_vs_conn_fill_param(cp->af, cp->protocol, &cp->caddr, cp->cport,
 177                               NULL, 0, &p);
 178
 179         if (cp->dest && cp->dest->svc->pe) {
 180                 p.pe = cp->dest->svc->pe;
 181                 p.pe_data = cp->pe_data;
 182                 p.pe_data_len = cp->pe_data_len;
 183         }
 184
 185         return ip_vs_conn_hashkey_param(&p, false);
 186 }
 187
 188 /*
 189  *      Hashes ip_vs_conn in ip_vs_conn_tab by proto,addr,port.
 190  *      returns bool success.
 191  */
 192 static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
 193 {
 194         unsigned hash;
 195         int ret;
 196
 197         if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
 198                 return 0;
 199
 200         /* Hash by protocol, client address and port */
 201         hash = ip_vs_conn_hashkey_conn(cp);
 202
 203         ct_write_lock(hash);
 204         spin_lock(&cp->lock);
 205
 206         if (!(cp->flags & IP_VS_CONN_F_HASHED)) {
 207                 list_add(&cp->c_list, &ip_vs_conn_tab[hash]);
 208                 cp->flags |= IP_VS_CONN_F_HASHED;
 209                 atomic_inc(&cp->refcnt);
 210                 ret = 1;
 211         } else {
 212                 pr_err("%s(): request for already hashed, called from %pF\n",
 213                        __func__, __builtin_return_address(0));
 214                 ret = 0;
 215         }
 216
 217         spin_unlock(&cp->lock);
 218         ct_write_unlock(hash);
 219
 220         return ret;
 221 }
 222
 223
 224 /*
 225  *      UNhashes ip_vs_conn from ip_vs_conn_tab.
 226  *      returns bool success.
 227  */
 228 static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
 229 {
 230         unsigned hash;
 231         int ret;
 232
 233         /* unhash it and decrease its reference counter */
 234         hash = ip_vs_conn_hashkey_conn(cp);
 235
 236         ct_write_lock(hash);
 237         spin_lock(&cp->lock);
 238
 239         if (cp->flags & IP_VS_CONN_F_HASHED) {
 240                 list_del(&cp->c_list);
 241                 cp->flags &= ~IP_VS_CONN_F_HASHED;
 242                 atomic_dec(&cp->refcnt);
 243                 ret = 1;
 244         } else
 245                 ret = 0;
 246
 247         spin_unlock(&cp->lock);
 248         ct_write_unlock(hash);
 249
 250         return ret;
 251 }
 252
 253
 254 /*
 255  *  Gets ip_vs_conn associated with supplied parameters in the ip_vs_conn_tab.
 256  *  Called for pkts coming from OUTside-to-INside.
 257  *      p->caddr, p->cport: pkt source address (foreign host)
 258  *      p->vaddr, p->vport: pkt dest address (load balancer)
 259  */
 260 static inline struct ip_vs_conn *
 261 __ip_vs_conn_in_get(const struct ip_vs_conn_param *p)
 262 {
 263         unsigned hash;
 264         struct ip_vs_conn *cp;
 265
 266         hash = ip_vs_conn_hashkey_param(p, false);
 267
 268         ct_read_lock(hash);
 269
 270         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
 271                 if (cp->af == p->af &&
 272                     ip_vs_addr_equal(p->af, p->caddr, &cp->caddr) &&
 273                     ip_vs_addr_equal(p->af, p->vaddr, &cp->vaddr) &&
 274                     p->cport == cp->cport && p->vport == cp->vport &&
 275                     ((!p->cport) ^ (!(cp->flags & IP_VS_CONN_F_NO_CPORT))) &&
 276                     p->protocol == cp->protocol) {
 277                         /* HIT */
 278                         atomic_inc(&cp->refcnt);
 279                         ct_read_unlock(hash);
 280                         return cp;
 281                 }
 282         }
 283
 284         ct_read_unlock(hash);
 285
 286         return NULL;
 287 }
 288
 289 struct ip_vs_conn *ip_vs_conn_in_get(const struct ip_vs_conn_param *p)
 290 {
 291         struct ip_vs_conn *cp;
 292
 293         cp = __ip_vs_conn_in_get(p);
 294         if (!cp && atomic_read(&ip_vs_conn_no_cport_cnt)) {
 295                 struct ip_vs_conn_param cport_zero_p = *p;
 296                 cport_zero_p.cport = 0;
 297                 cp = __ip_vs_conn_in_get(&cport_zero_p);
 298         }
 299
 300         IP_VS_DBG_BUF(9, "lookup/in %s %s:%d->%s:%d %s\n",
 301                       ip_vs_proto_name(p->protocol),
 302                       IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport),
 303                       IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport),
 304                       cp ? "hit" : "not hit");
 305
 306         return cp;
 307 }
 308
 309 static int
 310 ip_vs_conn_fill_param_proto(int af, const struct sk_buff *skb,
 311                             const struct ip_vs_iphdr *iph,
 312                             unsigned int proto_off, int inverse,
 313                             struct ip_vs_conn_param *p)
 314 {
 315         __be16 _ports[2], *pptr;
 316
 317         pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
 318         if (pptr == NULL)
 319                 return 1;
 320
 321         if (likely(!inverse))
 322                 ip_vs_conn_fill_param(af, iph->protocol, &iph->saddr, pptr[0],
 323                                       &iph->daddr, pptr[1], p);
 324         else
 325                 ip_vs_conn_fill_param(af, iph->protocol, &iph->daddr, pptr[1],
 326                                       &iph->saddr, pptr[0], p);
 327         return 0;
 328 }
 329
 330 struct ip_vs_conn *
 331 ip_vs_conn_in_get_proto(int af, const struct sk_buff *skb,
 332                         struct ip_vs_protocol *pp,
 333                         const struct ip_vs_iphdr *iph,
 334                         unsigned int proto_off, int inverse)
 335 {
 336         struct ip_vs_conn_param p;
 337
 338         if (ip_vs_conn_fill_param_proto(af, skb, iph, proto_off, inverse, &p))
 339                 return NULL;
 340
 341         return ip_vs_conn_in_get(&p);
 342 }
 343 EXPORT_SYMBOL_GPL(ip_vs_conn_in_get_proto);
 344
 345 /* Get reference to connection template */
 346 struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p)
 347 {
 348         unsigned hash;
 349         struct ip_vs_conn *cp;
 350
 351         hash = ip_vs_conn_hashkey_param(p, false);
 352
 353         ct_read_lock(hash);
 354
 355         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
 356                 if (p->pe_data && p->pe->ct_match) {
 357                         if (p->pe->ct_match(p, cp))
 358                                 goto out;
 359                         continue;
 360                 }
 361
 362                 if (cp->af == p->af &&
 363                     ip_vs_addr_equal(p->af, p->caddr, &cp->caddr) &&
 364                     /* protocol should only be IPPROTO_IP if
 365                      * p->vaddr is a fwmark */
 366                     ip_vs_addr_equal(p->protocol == IPPROTO_IP ? AF_UNSPEC :
 367                                      p->af, p->vaddr, &cp->vaddr) &&
 368                     p->cport == cp->cport && p->vport == cp->vport &&
 369                     cp->flags & IP_VS_CONN_F_TEMPLATE &&
 370                     p->protocol == cp->protocol)
 371                         goto out;
 372         }
 373         cp = NULL;
 374
 375   out:
 376         if (cp)
 377                 atomic_inc(&cp->refcnt);
 378         ct_read_unlock(hash);
 379
 380         IP_VS_DBG_BUF(9, "template lookup/in %s %s:%d->%s:%d %s\n",
 381                       ip_vs_proto_name(p->protocol),
 382                       IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport),
 383                       IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport),
 384                       cp ? "hit" : "not hit");
 385
 386         return cp;
 387 }
 388
 389 /* Gets ip_vs_conn associated with supplied parameters in the ip_vs_conn_tab.
 390  * Called for pkts coming from inside-to-OUTside.
 391  *      p->caddr, p->cport: pkt source address (inside host)
 392  *      p->vaddr, p->vport: pkt dest address (foreign host) */
 393 struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p)
 394 {
 395         unsigned hash;
 396         struct ip_vs_conn *cp, *ret=NULL;
 397
 398         /*
 399          *      Check for "full" addressed entries
 400          */
 401         hash = ip_vs_conn_hashkey_param(p, true);
 402
 403         ct_read_lock(hash);
 404
 405         list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
 406                 if (cp->af == p->af &&
 407                     ip_vs_addr_equal(p->af, p->vaddr, &cp->caddr) &&
 408                     ip_vs_addr_equal(p->af, p->caddr, &cp->daddr) &&
 409                     p->vport == cp->cport && p->cport == cp->dport &&
 410                     p->protocol == cp->protocol) {
 411                         /* HIT */
 412                         atomic_inc(&cp->refcnt);
 413                         ret = cp;
 414                         break;
 415                 }
 416         }
 417
 418         ct_read_unlock(hash);
 419
 420         IP_VS_DBG_BUF(9, "lookup/out %s %s:%d->%s:%d %s\n",
 421                       ip_vs_proto_name(p->protocol),
 422                       IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport),
 423                       IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport),
 424                       ret ? "hit" : "not hit");
 425
 426         return ret;
 427 }
 428
 429 struct ip_vs_conn *
 430 ip_vs_conn_out_get_proto(int af, const struct sk_buff *skb,
 431                          struct ip_vs_protocol *pp,
 432                          const struct ip_vs_iphdr *iph,
 433                          unsigned int proto_off, int inverse)
 434 {
 435         struct ip_vs_conn_param p;
 436
 437         if (ip_vs_conn_fill_param_proto(af, skb, iph, proto_off, inverse, &p))
 438                 return NULL;
 439
 440         return ip_vs_conn_out_get(&p);
 441 }
 442 EXPORT_SYMBOL_GPL(ip_vs_conn_out_get_proto);
 443
 444 /*
 445  *      Put back the conn and restart its timer with its timeout
 446  */
 447 void ip_vs_conn_put(struct ip_vs_conn *cp)
 448 {
 449         unsigned long t = (cp->flags & IP_VS_CONN_F_ONE_PACKET) ?
 450                 0 : cp->timeout;
 451         mod_timer(&cp->timer, jiffies+t);
 452
 453         __ip_vs_conn_put(cp);
 454 }
 455
 456
 457 /*
 458  *      Fill a no_client_port connection with a client port number
 459  */
 460 void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport)
 461 {
 462         if (ip_vs_conn_unhash(cp)) {
 463                 spin_lock(&cp->lock);
 464                 if (cp->flags & IP_VS_CONN_F_NO_CPORT) {
 465                         atomic_dec(&ip_vs_conn_no_cport_cnt);
 466                         cp->flags &= ~IP_VS_CONN_F_NO_CPORT;
 467                         cp->cport = cport;
 468                 }
 469                 spin_unlock(&cp->lock);
 470
 471                 /* hash on new dport */
 472                 ip_vs_conn_hash(cp);
 473         }
 474 }
 475
 476
 477 /*
 478  *      Bind a connection entry with the corresponding packet_xmit.
 479  *      Called by ip_vs_conn_new.
 480  */
 481 static inline void ip_vs_bind_xmit(struct ip_vs_conn *cp)
 482 {
 483         switch (IP_VS_FWD_METHOD(cp)) {
 484         case IP_VS_CONN_F_MASQ:
 485                 cp->packet_xmit = ip_vs_nat_xmit;
 486                 break;
 487
 488         case IP_VS_CONN_F_TUNNEL:
 489                 cp->packet_xmit = ip_vs_tunnel_xmit;
 490                 break;
 491
 492         case IP_VS_CONN_F_DROUTE:
 493                 cp->packet_xmit = ip_vs_dr_xmit;
 494                 break;
 495
 496         case IP_VS_CONN_F_LOCALNODE:
 497                 cp->packet_xmit = ip_vs_null_xmit;
 498                 break;
 499
 500         case IP_VS_CONN_F_BYPASS:
 501                 cp->packet_xmit = ip_vs_bypass_xmit;
 502                 break;
 503         }
 504 }
 505
 506 #ifdef CONFIG_IP_VS_IPV6
 507 static inline void ip_vs_bind_xmit_v6(struct ip_vs_conn *cp)
 508 {
 509         switch (IP_VS_FWD_METHOD(cp)) {
 510         case IP_VS_CONN_F_MASQ:
 511                 cp->packet_xmit = ip_vs_nat_xmit_v6;
 512                 break;
 513
 514         case IP_VS_CONN_F_TUNNEL:
 515                 cp->packet_xmit = ip_vs_tunnel_xmit_v6;
 516                 break;
 517
 518         case IP_VS_CONN_F_DROUTE:
 519                 cp->packet_xmit = ip_vs_dr_xmit_v6;
 520                 break;
 521
 522         case IP_VS_CONN_F_LOCALNODE:
 523                 cp->packet_xmit = ip_vs_null_xmit;
 524                 break;
 525
 526         case IP_VS_CONN_F_BYPASS:
 527                 cp->packet_xmit = ip_vs_bypass_xmit_v6;
 528                 break;
 529         }
 530 }
 531 #endif
 532
 533
 534 static inline int ip_vs_dest_totalconns(struct ip_vs_dest *dest)
 535 {
 536         return atomic_read(&dest->activeconns)
 537                 + atomic_read(&dest->inactconns);
 538 }
 539
 540 /*
 541  *      Bind a connection entry with a virtual service destination
 542  *      Called just after a new connection entry is created.
 543  */
 544 static inline void
 545 ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
 546 {
 547         unsigned int conn_flags;
 548
 549         /* if dest is NULL, then return directly */
 550         if (!dest)
 551                 return;
 552
 553         /* Increase the refcnt counter of the dest */
 554         atomic_inc(&dest->refcnt);
 555
 556         conn_flags = atomic_read(&dest->conn_flags);
 557         if (cp->protocol != IPPROTO_UDP)
 558                 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
 559         /* Bind with the destination and its corresponding transmitter */
 560         if (cp->flags & IP_VS_CONN_F_SYNC) {
 561                 /* if the connection is not template and is created
 562                  * by sync, preserve the activity flag.
 563                  */
 564                 if (!(cp->flags & IP_VS_CONN_F_TEMPLATE))
 565                         conn_flags &= ~IP_VS_CONN_F_INACTIVE;
 566                 /* connections inherit forwarding method from dest */
 567                 cp->flags &= ~IP_VS_CONN_F_FWD_MASK;
 568         }
 569         cp->flags |= conn_flags;
 570         cp->dest = dest;
 571
 572         IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
 573                       "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
 574                       "dest->refcnt:%d\n",
 575                       ip_vs_proto_name(cp->protocol),
 576                       IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport),
 577                       IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport),
 578                       IP_VS_DBG_ADDR(cp->af, &cp->daddr), ntohs(cp->dport),
 579                       ip_vs_fwd_tag(cp), cp->state,
 580                       cp->flags, atomic_read(&cp->refcnt),
 581                       atomic_read(&dest->refcnt));
 582
 583         /* Update the connection counters */
 584         if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
 585                 /* It is a normal connection, so increase the inactive
 586                    connection counter because it is in TCP SYNRECV
 587                    state (inactive) or other protocol inacive state */
 588                 if ((cp->flags & IP_VS_CONN_F_SYNC) &&
 589                     (!(cp->flags & IP_VS_CONN_F_INACTIVE)))
 590                         atomic_inc(&dest->activeconns);
 591                 else
 592                         atomic_inc(&dest->inactconns);
 593         } else {
 594                 /* It is a persistent connection/template, so increase
 595                    the peristent connection counter */
 596                 atomic_inc(&dest->persistconns);
 597         }
 598
 599         if (dest->u_threshold != 0 &&
 600             ip_vs_dest_totalconns(dest) >= dest->u_threshold)
 601                 dest->flags |= IP_VS_DEST_F_OVERLOAD;
 602 }
 603
 604
 605 /*
 606  * Check if there is a destination for the connection, if so
 607  * bind the connection to the destination.
 608  */
 609 struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp)
 610 {
 611         struct ip_vs_dest *dest;
 612
 613         if ((cp) && (!cp->dest)) {
 614                 dest = ip_vs_find_dest(cp->af, &cp->daddr, cp->dport,
 615                                        &cp->vaddr, cp->vport,
 616                                        cp->protocol);
 617                 ip_vs_bind_dest(cp, dest);
 618                 return dest;
 619         } else
 620                 return NULL;
 621 }
 622
 623
 624 /*
 625  *      Unbind a connection entry with its VS destination
 626  *      Called by the ip_vs_conn_expire function.
 627  */
 628 static inline void ip_vs_unbind_dest(struct ip_vs_conn *cp)
 629 {
 630         struct ip_vs_dest *dest = cp->dest;
 631
 632         if (!dest)
 633                 return;
 634
 635         IP_VS_DBG_BUF(7, "Unbind-dest %s c:%s:%d v:%s:%d "
 636                       "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
 637                       "dest->refcnt:%d\n",
 638                       ip_vs_proto_name(cp->protocol),
 639                       IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport),
 640                       IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport),
 641                       IP_VS_DBG_ADDR(cp->af, &cp->daddr), ntohs(cp->dport),
 642                       ip_vs_fwd_tag(cp), cp->state,
 643                       cp->flags, atomic_read(&cp->refcnt),
 644                       atomic_read(&dest->refcnt));
 645
 646         /* Update the connection counters */
 647         if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
 648                 /* It is a normal connection, so decrease the inactconns
 649                    or activeconns counter */
 650                 if (cp->flags & IP_VS_CONN_F_INACTIVE) {
 651                         atomic_dec(&dest->inactconns);
 652                 } else {
 653                         atomic_dec(&dest->activeconns);
 654                 }
 655         } else {
 656                 /* It is a persistent connection/template, so decrease
 657                    the peristent connection counter */
 658                 atomic_dec(&dest->persistconns);
 659         }
 660
 661         if (dest->l_threshold != 0) {
 662                 if (ip_vs_dest_totalconns(dest) < dest->l_threshold)
 663                         dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 664         } else if (dest->u_threshold != 0) {
 665                 if (ip_vs_dest_totalconns(dest) * 4 < dest->u_threshold * 3)
 666                         dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 667         } else {
 668                 if (dest->flags & IP_VS_DEST_F_OVERLOAD)
 669                         dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 670         }
 671
 672         /*
 673          * Simply decrease the refcnt of the dest, because the
 674          * dest will be either in service's destination list
 675          * or in the trash.
 676          */
 677         atomic_dec(&dest->refcnt);
 678 }
 679
 680
 681 /*
 682  *      Checking if the destination of a connection template is available.
 683  *      If available, return 1, otherwise invalidate this connection
 684  *      template and return 0.
 685  */
 686 int ip_vs_check_template(struct ip_vs_conn *ct)
 687 {
 688         struct ip_vs_dest *dest = ct->dest;
 689
 690         /*
 691          * Checking the dest server status.
 692          */
 693         if ((dest == NULL) ||
 694             !(dest->flags & IP_VS_DEST_F_AVAILABLE) ||
 695             (sysctl_ip_vs_expire_quiescent_template &&
 696              (atomic_read(&dest->weight) == 0))) {
 697                 IP_VS_DBG_BUF(9, "check_template: dest not available for "
 698                               "protocol %s s:%s:%d v:%s:%d "
 699                               "-> d:%s:%d\n",
 700                               ip_vs_proto_name(ct->protocol),
 701                               IP_VS_DBG_ADDR(ct->af, &ct->caddr),
 702                               ntohs(ct->cport),
 703                               IP_VS_DBG_ADDR(ct->af, &ct->vaddr),
 704                               ntohs(ct->vport),
 705                               IP_VS_DBG_ADDR(ct->af, &ct->daddr),
 706                               ntohs(ct->dport));
 707
 708                 /*
 709                  * Invalidate the connection template
 710                  */
 711                 if (ct->vport != htons(0xffff)) {
 712                         if (ip_vs_conn_unhash(ct)) {
 713                                 ct->dport = htons(0xffff);
 714                                 ct->vport = htons(0xffff);
 715                                 ct->cport = 0;
 716                                 ip_vs_conn_hash(ct);
 717                         }
 718                 }
 719
 720                 /*
 721                  * Simply decrease the refcnt of the template,
 722                  * don't restart its timer.
 723                  */
 724                 atomic_dec(&ct->refcnt);
 725                 return 0;
 726         }
 727         return 1;
 728 }
 729
 730 static void ip_vs_conn_expire(unsigned long data)
 731 {
 732         struct ip_vs_conn *cp = (struct ip_vs_conn *)data;
 733
 734         cp->timeout = 60*HZ;
 735
 736         /*
 737          *      hey, I'm using it
 738          */
 739         atomic_inc(&cp->refcnt);
 740
 741         /*
 742          *      do I control anybody?
 743          */
 744         if (atomic_read(&cp->n_control))
 745                 goto expire_later;
 746
 747         /*
 748          *      unhash it if it is hashed in the conn table
 749          */
 750         if (!ip_vs_conn_unhash(cp) && !(cp->flags & IP_VS_CONN_F_ONE_PACKET))
 751                 goto expire_later;
 752
 753         /*
 754          *      refcnt==1 implies I'm the only one referrer
 755          */
 756         if (likely(atomic_read(&cp->refcnt) == 1)) {
 757                 /* delete the timer if it is activated by other users */
 758                 if (timer_pending(&cp->timer))
 759                         del_timer(&cp->timer);
 760
 761                 /* does anybody control me? */
 762                 if (cp->control)
 763                         ip_vs_control_del(cp);
 764
 765                 if (cp->flags & IP_VS_CONN_F_NFCT)
 766                         ip_vs_conn_drop_conntrack(cp);
 767
 768                 kfree(cp->pe_data);
 769                 if (unlikely(cp->app != NULL))
 770                         ip_vs_unbind_app(cp);
 771                 ip_vs_unbind_dest(cp);
 772                 if (cp->flags & IP_VS_CONN_F_NO_CPORT)
 773                         atomic_dec(&ip_vs_conn_no_cport_cnt);
 774                 atomic_dec(&ip_vs_conn_count);
 775
 776                 kmem_cache_free(ip_vs_conn_cachep, cp);
 777                 return;
 778         }
 779
 780         /* hash it back to the table */
 781         ip_vs_conn_hash(cp);
 782
 783   expire_later:
 784         IP_VS_DBG(7, "delayed: conn->refcnt-1=%d conn->n_control=%d\n",
 785                   atomic_read(&cp->refcnt)-1,
 786                   atomic_read(&cp->n_control));
 787
 788         ip_vs_conn_put(cp);
 789 }
 790
 791
 792 void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
 793 {
 794         if (del_timer(&cp->timer))
 795                 mod_timer(&cp->timer, jiffies);
 796 }
 797
 798
 799 /*
 800  *      Create a new connection entry and hash it into the ip_vs_conn_tab
 801  */
 802 struct ip_vs_conn *
 803 ip_vs_conn_new(const struct ip_vs_conn_param *p,
 804                const union nf_inet_addr *daddr, __be16 dport, unsigned flags,
 805                struct ip_vs_dest *dest)
 806 {
 807         struct ip_vs_conn *cp;
 808         struct ip_vs_protocol *pp = ip_vs_proto_get(p->protocol);
 809
 810         cp = kmem_cache_zalloc(ip_vs_conn_cachep, GFP_ATOMIC);
 811         if (cp == NULL) {
 812                 IP_VS_ERR_RL("%s(): no memory\n", __func__);
 813                 return NULL;
 814         }
 815
 816         INIT_LIST_HEAD(&cp->c_list);
 817         setup_timer(&cp->timer, ip_vs_conn_expire, (unsigned long)cp);
 818         cp->af             = p->af;
 819         cp->protocol       = p->protocol;
 820         ip_vs_addr_copy(p->af, &cp->caddr, p->caddr);
 821         cp->cport          = p->cport;
 822         ip_vs_addr_copy(p->af, &cp->vaddr, p->vaddr);
 823         cp->vport          = p->vport;
 824         /* proto should only be IPPROTO_IP if d_addr is a fwmark */
 825         ip_vs_addr_copy(p->protocol == IPPROTO_IP ? AF_UNSPEC : p->af,
 826                         &cp->daddr, daddr);
 827         cp->dport          = dport;
 828         cp->flags          = flags;
 829         if (flags & IP_VS_CONN_F_TEMPLATE && p->pe_data) {
 830                 cp->pe_data = p->pe_data;
 831                 cp->pe_data_len = p->pe_data_len;
 832         }
 833         spin_lock_init(&cp->lock);
 834
 835         /*
 836          * Set the entry is referenced by the current thread before hashing
 837          * it in the table, so that other thread run ip_vs_random_dropentry
 838          * but cannot drop this entry.
 839          */
 840         atomic_set(&cp->refcnt, 1);
 841
 842         atomic_set(&cp->n_control, 0);
 843         atomic_set(&cp->in_pkts, 0);
 844
 845         atomic_inc(&ip_vs_conn_count);
 846         if (flags & IP_VS_CONN_F_NO_CPORT)
 847                 atomic_inc(&ip_vs_conn_no_cport_cnt);
 848
 849         /* Bind the connection with a destination server */
 850         ip_vs_bind_dest(cp, dest);
 851
 852         /* Set its state and timeout */
 853         cp->state = 0;
 854         cp->timeout = 3*HZ;
 855
 856         /* Bind its packet transmitter */
 857 #ifdef CONFIG_IP_VS_IPV6
 858         if (p->af == AF_INET6)
 859                 ip_vs_bind_xmit_v6(cp);
 860         else
 861 #endif
 862                 ip_vs_bind_xmit(cp);
 863
 864         if (unlikely(pp && atomic_read(&pp->appcnt)))
 865                 ip_vs_bind_app(cp, pp);
 866
 867         /*
 868          * Allow conntrack to be preserved. By default, conntrack
 869          * is created and destroyed for every packet.
 870          * Sometimes keeping conntrack can be useful for
 871          * IP_VS_CONN_F_ONE_PACKET too.
 872          */
 873
 874         if (ip_vs_conntrack_enabled())
 875                 cp->flags |= IP_VS_CONN_F_NFCT;
 876
 877         /* Hash it in the ip_vs_conn_tab finally */
 878         ip_vs_conn_hash(cp);
 879
 880         return cp;
 881 }
 882
 883 /*
 884  *      /proc/net/ip_vs_conn entries
 885  */
 886 #ifdef CONFIG_PROC_FS
 887
 888 static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos)
 889 {
 890         int idx;
 891         struct ip_vs_conn *cp;
 892
 893         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
 894                 ct_read_lock_bh(idx);
 895                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
 896                         if (pos-- == 0) {
 897                                 seq->private = &ip_vs_conn_tab[idx];
 898                         return cp;
 899                         }
 900                 }
 901                 ct_read_unlock_bh(idx);
 902         }
 903
 904         return NULL;
 905 }
 906
 907 static void *ip_vs_conn_seq_start(struct seq_file *seq, loff_t *pos)
 908 {
 909         seq->private = NULL;
 910         return *pos ? ip_vs_conn_array(seq, *pos - 1) :SEQ_START_TOKEN;
 911 }
 912
 913 static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 914 {
 915         struct ip_vs_conn *cp = v;
 916         struct list_head *e, *l = seq->private;
 917         int idx;
 918
 919         ++*pos;
 920         if (v == SEQ_START_TOKEN)
 921                 return ip_vs_conn_array(seq, 0);
 922
 923         /* more on same hash chain? */
 924         if ((e = cp->c_list.next) != l)
 925                 return list_entry(e, struct ip_vs_conn, c_list);
 926
 927         idx = l - ip_vs_conn_tab;
 928         ct_read_unlock_bh(idx);
 929
 930         while (++idx < ip_vs_conn_tab_size) {
 931                 ct_read_lock_bh(idx);
 932                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
 933                         seq->private = &ip_vs_conn_tab[idx];
 934                         return cp;
 935                 }
 936                 ct_read_unlock_bh(idx);
 937         }
 938         seq->private = NULL;
 939         return NULL;
 940 }
 941
 942 static void ip_vs_conn_seq_stop(struct seq_file *seq, void *v)
 943 {
 944         struct list_head *l = seq->private;
 945
 946         if (l)
 947                 ct_read_unlock_bh(l - ip_vs_conn_tab);
 948 }
 949
 950 static int ip_vs_conn_seq_show(struct seq_file *seq, void *v)
 951 {
 952
 953         if (v == SEQ_START_TOKEN)
 954                 seq_puts(seq,
 955    "Pro FromIP   FPrt ToIP     TPrt DestIP   DPrt State       Expires PEName PEData\n");
 956         else {
 957                 const struct ip_vs_conn *cp = v;
 958                 char pe_data[IP_VS_PENAME_MAXLEN + IP_VS_PEDATA_MAXLEN + 3];
 959                 size_t len = 0;
 960
 961                 if (cp->dest && cp->pe_data &&
 962                     cp->dest->svc->pe->show_pe_data) {
 963                         pe_data[0] = ' ';
 964                         len = strlen(cp->dest->svc->pe->name);
 965                         memcpy(pe_data + 1, cp->dest->svc->pe->name, len);
 966                         pe_data[len + 1] = ' ';
 967                         len += 2;
 968                         len += cp->dest->svc->pe->show_pe_data(cp,
 969                                                                pe_data + len);
 970                 }
 971                 pe_data[len] = '\0';
 972
 973 #ifdef CONFIG_IP_VS_IPV6
 974                 if (cp->af == AF_INET6)
 975                         seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X "
 976                                 "%pI6 %04X %-11s %7lu%s\n",
 977                                 ip_vs_proto_name(cp->protocol),
 978                                 &cp->caddr.in6, ntohs(cp->cport),
 979                                 &cp->vaddr.in6, ntohs(cp->vport),
 980                                 &cp->daddr.in6, ntohs(cp->dport),
 981                                 ip_vs_state_name(cp->protocol, cp->state),
 982                                 (cp->timer.expires-jiffies)/HZ, pe_data);
 983                 else
 984 #endif
 985                         seq_printf(seq,
 986                                 "%-3s %08X %04X %08X %04X"
 987                                 " %08X %04X %-11s %7lu%s\n",
 988                                 ip_vs_proto_name(cp->protocol),
 989                                 ntohl(cp->caddr.ip), ntohs(cp->cport),
 990                                 ntohl(cp->vaddr.ip), ntohs(cp->vport),
 991                                 ntohl(cp->daddr.ip), ntohs(cp->dport),
 992                                 ip_vs_state_name(cp->protocol, cp->state),
 993                                 (cp->timer.expires-jiffies)/HZ, pe_data);
 994         }
 995         return 0;
 996 }
 997
 998 static const struct seq_operations ip_vs_conn_seq_ops = {
 999         .start = ip_vs_conn_seq_start,
1000         .next  = ip_vs_conn_seq_next,
1001         .stop  = ip_vs_conn_seq_stop,
1002         .show  = ip_vs_conn_seq_show,
1003 };
1004
1005 static int ip_vs_conn_open(struct inode *inode, struct file *file)
1006 {
1007         return seq_open(file, &ip_vs_conn_seq_ops);
1008 }
1009
1010 static const struct file_operations ip_vs_conn_fops = {
1011         .owner   = THIS_MODULE,
1012         .open    = ip_vs_conn_open,
1013         .read    = seq_read,
1014         .llseek  = seq_lseek,
1015         .release = seq_release,
1016 };
1017
1018 static const char *ip_vs_origin_name(unsigned flags)
1019 {
1020         if (flags & IP_VS_CONN_F_SYNC)
1021                 return "SYNC";
1022         else
1023                 return "LOCAL";
1024 }
1025
1026 static int ip_vs_conn_sync_seq_show(struct seq_file *seq, void *v)
1027 {
1028
1029         if (v == SEQ_START_TOKEN)
1030                 seq_puts(seq,
1031    "Pro FromIP   FPrt ToIP     TPrt DestIP   DPrt State       Origin Expires\n");
1032         else {
1033                 const struct ip_vs_conn *cp = v;
1034
1035 #ifdef CONFIG_IP_VS_IPV6
1036                 if (cp->af == AF_INET6)
1037                         seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X %pI6 %04X %-11s %-6s %7lu\n",
1038                                 ip_vs_proto_name(cp->protocol),
1039                                 &cp->caddr.in6, ntohs(cp->cport),
1040                                 &cp->vaddr.in6, ntohs(cp->vport),
1041                                 &cp->daddr.in6, ntohs(cp->dport),
1042                                 ip_vs_state_name(cp->protocol, cp->state),
1043                                 ip_vs_origin_name(cp->flags),
1044                                 (cp->timer.expires-jiffies)/HZ);
1045                 else
1046 #endif
1047                         seq_printf(seq,
1048                                 "%-3s %08X %04X %08X %04X "
1049                                 "%08X %04X %-11s %-6s %7lu\n",
1050                                 ip_vs_proto_name(cp->protocol),
1051                                 ntohl(cp->caddr.ip), ntohs(cp->cport),
1052                                 ntohl(cp->vaddr.ip), ntohs(cp->vport),
1053                                 ntohl(cp->daddr.ip), ntohs(cp->dport),
1054                                 ip_vs_state_name(cp->protocol, cp->state),
1055                                 ip_vs_origin_name(cp->flags),
1056                                 (cp->timer.expires-jiffies)/HZ);
1057         }
1058         return 0;
1059 }
1060
1061 static const struct seq_operations ip_vs_conn_sync_seq_ops = {
1062         .start = ip_vs_conn_seq_start,
1063         .next  = ip_vs_conn_seq_next,
1064         .stop  = ip_vs_conn_seq_stop,
1065         .show  = ip_vs_conn_sync_seq_show,
1066 };
1067
1068 static int ip_vs_conn_sync_open(struct inode *inode, struct file *file)
1069 {
1070         return seq_open(file, &ip_vs_conn_sync_seq_ops);
1071 }
1072
1073 static const struct file_operations ip_vs_conn_sync_fops = {
1074         .owner   = THIS_MODULE,
1075         .open    = ip_vs_conn_sync_open,
1076         .read    = seq_read,
1077         .llseek  = seq_lseek,
1078         .release = seq_release,
1079 };
1080
1081 #endif
1082
1083
1084 /*
1085  *      Randomly drop connection entries before running out of memory
1086  */
1087 static inline int todrop_entry(struct ip_vs_conn *cp)
1088 {
1089         /*
1090          * The drop rate array needs tuning for real environments.
1091          * Called from timer bh only => no locking
1092          */
1093         static const char todrop_rate[9] = {0, 1, 2, 3, 4, 5, 6, 7, 8};
1094         static char todrop_counter[9] = {0};
1095         int i;
1096
1097         /* if the conn entry hasn't lasted for 60 seconds, don't drop it.
1098            This will leave enough time for normal connection to get
1099            through. */
1100         if (time_before(cp->timeout + jiffies, cp->timer.expires + 60*HZ))
1101                 return 0;
1102
1103         /* Don't drop the entry if its number of incoming packets is not
1104            located in [0, 8] */
1105         i = atomic_read(&cp->in_pkts);
1106         if (i > 8 || i < 0) return 0;
1107
1108         if (!todrop_rate[i]) return 0;
1109         if (--todrop_counter[i] > 0) return 0;
1110
1111         todrop_counter[i] = todrop_rate[i];
1112         return 1;
1113 }
1114
1115 /* Called from keventd and must protect itself from softirqs */
1116 void ip_vs_random_dropentry(void)
1117 {
1118         int idx;
1119         struct ip_vs_conn *cp;
1120
1121         /*
1122          * Randomly scan 1/32 of the whole table every second
1123          */
1124         for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) {
1125                 unsigned hash = net_random() & ip_vs_conn_tab_mask;
1126
1127                 /*
1128                  *  Lock is actually needed in this loop.
1129                  */
1130                 ct_write_lock_bh(hash);
1131
1132                 list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
1133                         if (cp->flags & IP_VS_CONN_F_TEMPLATE)
1134                                 /* connection template */
1135                                 continue;
1136
1137                         if (cp->protocol == IPPROTO_TCP) {
1138                                 switch(cp->state) {
1139                                 case IP_VS_TCP_S_SYN_RECV:
1140                                 case IP_VS_TCP_S_SYNACK:
1141                                         break;
1142
1143                                 case IP_VS_TCP_S_ESTABLISHED:
1144                                         if (todrop_entry(cp))
1145                                                 break;
1146                                         continue;
1147
1148                                 default:
1149                                         continue;
1150                                 }
1151                         } else {
1152                                 if (!todrop_entry(cp))
1153                                         continue;
1154                         }
1155
1156                         IP_VS_DBG(4, "del connection\n");
1157                         ip_vs_conn_expire_now(cp);
1158                         if (cp->control) {
1159                                 IP_VS_DBG(4, "del conn template\n");
1160                                 ip_vs_conn_expire_now(cp->control);
1161                         }
1162                 }
1163                 ct_write_unlock_bh(hash);
1164         }
1165 }
1166
1167
1168 /*
1169  *      Flush all the connection entries in the ip_vs_conn_tab
1170  */
1171 static void ip_vs_conn_flush(void)
1172 {
1173         int idx;
1174         struct ip_vs_conn *cp;
1175
1176   flush_again:
1177         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
1178                 /*
1179                  *  Lock is actually needed in this loop.
1180                  */
1181                 ct_write_lock_bh(idx);
1182
1183                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
1184
1185                         IP_VS_DBG(4, "del connection\n");
1186                         ip_vs_conn_expire_now(cp);
1187                         if (cp->control) {
1188                                 IP_VS_DBG(4, "del conn template\n");
1189                                 ip_vs_conn_expire_now(cp->control);
1190                         }
1191                 }
1192                 ct_write_unlock_bh(idx);
1193         }
1194
1195         /* the counter may be not NULL, because maybe some conn entries
1196            are run by slow timer handler or unhashed but still referred */
1197         if (atomic_read(&ip_vs_conn_count) != 0) {
1198                 schedule();
1199                 goto flush_again;
1200         }
1201 }
1202
1203
1204 int __init ip_vs_conn_init(void)
1205 {
1206         int idx;
1207
1208         /* Compute size and mask */
1209         ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
1210         ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
1211
1212         /*
1213          * Allocate the connection hash table and initialize its list heads
1214          */
1215         ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size *
1216                                  sizeof(struct list_head));
1217         if (!ip_vs_conn_tab)
1218                 return -ENOMEM;
1219
1220         /* Allocate ip_vs_conn slab cache */
1221         ip_vs_conn_cachep = kmem_cache_create("ip_vs_conn",
1222                                               sizeof(struct ip_vs_conn), 0,
1223                                               SLAB_HWCACHE_ALIGN, NULL);
1224         if (!ip_vs_conn_cachep) {
1225                 vfree(ip_vs_conn_tab);
1226                 return -ENOMEM;
1227         }
1228
1229         pr_info("Connection hash table configured "
1230                 "(size=%d, memory=%ldKbytes)\n",
1231                 ip_vs_conn_tab_size,
1232                 (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024);
1233         IP_VS_DBG(0, "Each connection entry needs %Zd bytes at least\n",
1234                   sizeof(struct ip_vs_conn));
1235
1236         for (idx = 0; idx < ip_vs_conn_tab_size; idx++) {
1237                 INIT_LIST_HEAD(&ip_vs_conn_tab[idx]);
1238         }
1239
1240         for (idx = 0; idx < CT_LOCKARRAY_SIZE; idx++)  {
1241                 rwlock_init(&__ip_vs_conntbl_lock_array[idx].l);
1242         }
1243
1244         proc_net_fops_create(&init_net, "ip_vs_conn", 0, &ip_vs_conn_fops);
1245         proc_net_fops_create(&init_net, "ip_vs_conn_sync", 0, &ip_vs_conn_sync_fops);
1246
1247         /* calculate the random value for connection hash */
1248         get_random_bytes(&ip_vs_conn_rnd, sizeof(ip_vs_conn_rnd));
1249
1250         return 0;
1251 }
1252
1253
1254 void ip_vs_conn_cleanup(void)
1255 {
1256         /* flush all the connection entries first */
1257         ip_vs_conn_flush();
1258
1259         /* Release the empty cache */
1260         kmem_cache_destroy(ip_vs_conn_cachep);
1261         proc_net_remove(&init_net, "ip_vs_conn");
1262         proc_net_remove(&init_net, "ip_vs_conn_sync");
1263         vfree(ip_vs_conn_tab);
1264 }