net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <net/ip.h>
  42 #ifdef CONFIG_IP_VS_IPV6
  43 #include <net/ipv6.h>
  44 #include <net/ip6_route.h>
  45 #endif
  46 #include <net/route.h>
  47 #include <net/sock.h>
  48 #include <net/genetlink.h>
  49
  50 #include <asm/uaccess.h>
  51
  52 #include <net/ip_vs.h>
  53
  54 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  55 static DEFINE_MUTEX(__ip_vs_mutex);
  56
  57 /* lock for service table */
  58 static DEFINE_RWLOCK(__ip_vs_svc_lock);
  59
  60 /* lock for table with the real services */
  61 static DEFINE_RWLOCK(__ip_vs_rs_lock);
  62
  63 /* lock for state and timeout tables */
  64 static DEFINE_SPINLOCK(ip_vs_securetcp_lock);
  65
  66 /* lock for drop entry handling */
  67 static DEFINE_SPINLOCK(__ip_vs_dropentry_lock);
  68
  69 /* lock for drop packet handling */
  70 static DEFINE_SPINLOCK(__ip_vs_droppacket_lock);
  71
  72 /* 1/rate drop and drop-entry variables */
  73 int ip_vs_drop_rate = 0;
  74 int ip_vs_drop_counter = 0;
  75 static atomic_t ip_vs_dropentry = ATOMIC_INIT(0);
  76
  77 /* number of virtual services */
  78 static int ip_vs_num_services = 0;
  79
  80 /* sysctl variables */
  81 static int sysctl_ip_vs_drop_entry = 0;
  82 static int sysctl_ip_vs_drop_packet = 0;
  83 static int sysctl_ip_vs_secure_tcp = 0;
  84 static int sysctl_ip_vs_amemthresh = 1024;
  85 static int sysctl_ip_vs_am_droprate = 10;
  86 int sysctl_ip_vs_cache_bypass = 0;
  87 int sysctl_ip_vs_expire_nodest_conn = 0;
  88 int sysctl_ip_vs_expire_quiescent_template = 0;
  89 int sysctl_ip_vs_sync_threshold[2] = { 3, 50 };
  90 int sysctl_ip_vs_nat_icmp_send = 0;
  91
  92
  93 #ifdef CONFIG_IP_VS_DEBUG
  94 static int sysctl_ip_vs_debug_level = 0;
  95
  96 int ip_vs_get_debug_level(void)
  97 {
  98         return sysctl_ip_vs_debug_level;
  99 }
 100 #endif
 101
 102 #ifdef CONFIG_IP_VS_IPV6
 103 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
 104 static int __ip_vs_addr_is_local_v6(const struct in6_addr *addr)
 105 {
 106         struct rt6_info *rt;
 107         struct flowi fl = {
 108                 .oif = 0,
 109                 .nl_u = {
 110                         .ip6_u = {
 111                                 .daddr = *addr,
 112                                 .saddr = { .s6_addr32 = {0, 0, 0, 0} }, } },
 113         };
 114
 115         rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
 116         if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
 117                         return 1;
 118
 119         return 0;
 120 }
 121 #endif
 122 /*
 123  *      update_defense_level is called from keventd and from sysctl,
 124  *      so it needs to protect itself from softirqs
 125  */
 126 static void update_defense_level(void)
 127 {
 128         struct sysinfo i;
 129         static int old_secure_tcp = 0;
 130         int availmem;
 131         int nomem;
 132         int to_change = -1;
 133
 134         /* we only count free and buffered memory (in pages) */
 135         si_meminfo(&i);
 136         availmem = i.freeram + i.bufferram;
 137         /* however in linux 2.5 the i.bufferram is total page cache size,
 138            we need adjust it */
 139         /* si_swapinfo(&i); */
 140         /* availmem = availmem - (i.totalswap - i.freeswap); */
 141
 142         nomem = (availmem < sysctl_ip_vs_amemthresh);
 143
 144         local_bh_disable();
 145
 146         /* drop_entry */
 147         spin_lock(&__ip_vs_dropentry_lock);
 148         switch (sysctl_ip_vs_drop_entry) {
 149         case 0:
 150                 atomic_set(&ip_vs_dropentry, 0);
 151                 break;
 152         case 1:
 153                 if (nomem) {
 154                         atomic_set(&ip_vs_dropentry, 1);
 155                         sysctl_ip_vs_drop_entry = 2;
 156                 } else {
 157                         atomic_set(&ip_vs_dropentry, 0);
 158                 }
 159                 break;
 160         case 2:
 161                 if (nomem) {
 162                         atomic_set(&ip_vs_dropentry, 1);
 163                 } else {
 164                         atomic_set(&ip_vs_dropentry, 0);
 165                         sysctl_ip_vs_drop_entry = 1;
 166                 };
 167                 break;
 168         case 3:
 169                 atomic_set(&ip_vs_dropentry, 1);
 170                 break;
 171         }
 172         spin_unlock(&__ip_vs_dropentry_lock);
 173
 174         /* drop_packet */
 175         spin_lock(&__ip_vs_droppacket_lock);
 176         switch (sysctl_ip_vs_drop_packet) {
 177         case 0:
 178                 ip_vs_drop_rate = 0;
 179                 break;
 180         case 1:
 181                 if (nomem) {
 182                         ip_vs_drop_rate = ip_vs_drop_counter
 183                                 = sysctl_ip_vs_amemthresh /
 184                                 (sysctl_ip_vs_amemthresh-availmem);
 185                         sysctl_ip_vs_drop_packet = 2;
 186                 } else {
 187                         ip_vs_drop_rate = 0;
 188                 }
 189                 break;
 190         case 2:
 191                 if (nomem) {
 192                         ip_vs_drop_rate = ip_vs_drop_counter
 193                                 = sysctl_ip_vs_amemthresh /
 194                                 (sysctl_ip_vs_amemthresh-availmem);
 195                 } else {
 196                         ip_vs_drop_rate = 0;
 197                         sysctl_ip_vs_drop_packet = 1;
 198                 }
 199                 break;
 200         case 3:
 201                 ip_vs_drop_rate = sysctl_ip_vs_am_droprate;
 202                 break;
 203         }
 204         spin_unlock(&__ip_vs_droppacket_lock);
 205
 206         /* secure_tcp */
 207         spin_lock(&ip_vs_securetcp_lock);
 208         switch (sysctl_ip_vs_secure_tcp) {
 209         case 0:
 210                 if (old_secure_tcp >= 2)
 211                         to_change = 0;
 212                 break;
 213         case 1:
 214                 if (nomem) {
 215                         if (old_secure_tcp < 2)
 216                                 to_change = 1;
 217                         sysctl_ip_vs_secure_tcp = 2;
 218                 } else {
 219                         if (old_secure_tcp >= 2)
 220                                 to_change = 0;
 221                 }
 222                 break;
 223         case 2:
 224                 if (nomem) {
 225                         if (old_secure_tcp < 2)
 226                                 to_change = 1;
 227                 } else {
 228                         if (old_secure_tcp >= 2)
 229                                 to_change = 0;
 230                         sysctl_ip_vs_secure_tcp = 1;
 231                 }
 232                 break;
 233         case 3:
 234                 if (old_secure_tcp < 2)
 235                         to_change = 1;
 236                 break;
 237         }
 238         old_secure_tcp = sysctl_ip_vs_secure_tcp;
 239         if (to_change >= 0)
 240                 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
 241         spin_unlock(&ip_vs_securetcp_lock);
 242
 243         local_bh_enable();
 244 }
 245
 246
 247 /*
 248  *      Timer for checking the defense
 249  */
 250 #define DEFENSE_TIMER_PERIOD    1*HZ
 251 static void defense_work_handler(struct work_struct *work);
 252 static DECLARE_DELAYED_WORK(defense_work, defense_work_handler);
 253
 254 static void defense_work_handler(struct work_struct *work)
 255 {
 256         update_defense_level();
 257         if (atomic_read(&ip_vs_dropentry))
 258                 ip_vs_random_dropentry();
 259
 260         schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
 261 }
 262
 263 int
 264 ip_vs_use_count_inc(void)
 265 {
 266         return try_module_get(THIS_MODULE);
 267 }
 268
 269 void
 270 ip_vs_use_count_dec(void)
 271 {
 272         module_put(THIS_MODULE);
 273 }
 274
 275
 276 /*
 277  *      Hash table: for virtual service lookups
 278  */
 279 #define IP_VS_SVC_TAB_BITS 8
 280 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 281 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 282
 283 /* the service table hashed by <protocol, addr, port> */
 284 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 285 /* the service table hashed by fwmark */
 286 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 287
 288 /*
 289  *      Hash table: for real service lookups
 290  */
 291 #define IP_VS_RTAB_BITS 4
 292 #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
 293 #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
 294
 295 static struct list_head ip_vs_rtable[IP_VS_RTAB_SIZE];
 296
 297 /*
 298  *      Trash for destinations
 299  */
 300 static LIST_HEAD(ip_vs_dest_trash);
 301
 302 /*
 303  *      FTP & NULL virtual service counters
 304  */
 305 static atomic_t ip_vs_ftpsvc_counter = ATOMIC_INIT(0);
 306 static atomic_t ip_vs_nullsvc_counter = ATOMIC_INIT(0);
 307
 308
 309 /*
 310  *      Returns hash value for virtual service
 311  */
 312 static __inline__ unsigned
 313 ip_vs_svc_hashkey(int af, unsigned proto, const union nf_inet_addr *addr,
 314                   __be16 port)
 315 {
 316         register unsigned porth = ntohs(port);
 317         __be32 addr_fold = addr->ip;
 318
 319 #ifdef CONFIG_IP_VS_IPV6
 320         if (af == AF_INET6)
 321                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 322                             addr->ip6[2]^addr->ip6[3];
 323 #endif
 324
 325         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
 326                 & IP_VS_SVC_TAB_MASK;
 327 }
 328
 329 /*
 330  *      Returns hash value of fwmark for virtual service lookup
 331  */
 332 static __inline__ unsigned ip_vs_svc_fwm_hashkey(__u32 fwmark)
 333 {
 334         return fwmark & IP_VS_SVC_TAB_MASK;
 335 }
 336
 337 /*
 338  *      Hashes a service in the ip_vs_svc_table by <proto,addr,port>
 339  *      or in the ip_vs_svc_fwm_table by fwmark.
 340  *      Should be called with locked tables.
 341  */
 342 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 343 {
 344         unsigned hash;
 345
 346         if (svc->flags & IP_VS_SVC_F_HASHED) {
 347                 pr_err("%s(): request for already hashed, called from %pF\n",
 348                        __func__, __builtin_return_address(0));
 349                 return 0;
 350         }
 351
 352         if (svc->fwmark == 0) {
 353                 /*
 354                  *  Hash it by <protocol,addr,port> in ip_vs_svc_table
 355                  */
 356                 hash = ip_vs_svc_hashkey(svc->af, svc->protocol, &svc->addr,
 357                                          svc->port);
 358                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
 359         } else {
 360                 /*
 361                  *  Hash it by fwmark in ip_vs_svc_fwm_table
 362                  */
 363                 hash = ip_vs_svc_fwm_hashkey(svc->fwmark);
 364                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 365         }
 366
 367         svc->flags |= IP_VS_SVC_F_HASHED;
 368         /* increase its refcnt because it is referenced by the svc table */
 369         atomic_inc(&svc->refcnt);
 370         return 1;
 371 }
 372
 373
 374 /*
 375  *      Unhashes a service from ip_vs_svc_table/ip_vs_svc_fwm_table.
 376  *      Should be called with locked tables.
 377  */
 378 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 379 {
 380         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 381                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 382                        __func__, __builtin_return_address(0));
 383                 return 0;
 384         }
 385
 386         if (svc->fwmark == 0) {
 387                 /* Remove it from the ip_vs_svc_table table */
 388                 list_del(&svc->s_list);
 389         } else {
 390                 /* Remove it from the ip_vs_svc_fwm_table table */
 391                 list_del(&svc->f_list);
 392         }
 393
 394         svc->flags &= ~IP_VS_SVC_F_HASHED;
 395         atomic_dec(&svc->refcnt);
 396         return 1;
 397 }
 398
 399
 400 /*
 401  *      Get service by {proto,addr,port} in the service table.
 402  */
 403 static inline struct ip_vs_service *
 404 __ip_vs_service_get(int af, __u16 protocol, const union nf_inet_addr *vaddr,
 405                     __be16 vport)
 406 {
 407         unsigned hash;
 408         struct ip_vs_service *svc;
 409
 410         /* Check for "full" addressed entries */
 411         hash = ip_vs_svc_hashkey(af, protocol, vaddr, vport);
 412
 413         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
 414                 if ((svc->af == af)
 415                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 416                     && (svc->port == vport)
 417                     && (svc->protocol == protocol)) {
 418                         /* HIT */
 419                         atomic_inc(&svc->usecnt);
 420                         return svc;
 421                 }
 422         }
 423
 424         return NULL;
 425 }
 426
 427
 428 /*
 429  *      Get service by {fwmark} in the service table.
 430  */
 431 static inline struct ip_vs_service *
 432 __ip_vs_svc_fwm_get(int af, __u32 fwmark)
 433 {
 434         unsigned hash;
 435         struct ip_vs_service *svc;
 436
 437         /* Check for fwmark addressed entries */
 438         hash = ip_vs_svc_fwm_hashkey(fwmark);
 439
 440         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 441                 if (svc->fwmark == fwmark && svc->af == af) {
 442                         /* HIT */
 443                         atomic_inc(&svc->usecnt);
 444                         return svc;
 445                 }
 446         }
 447
 448         return NULL;
 449 }
 450
 451 struct ip_vs_service *
 452 ip_vs_service_get(int af, __u32 fwmark, __u16 protocol,
 453                   const union nf_inet_addr *vaddr, __be16 vport)
 454 {
 455         struct ip_vs_service *svc;
 456
 457         read_lock(&__ip_vs_svc_lock);
 458
 459         /*
 460          *      Check the table hashed by fwmark first
 461          */
 462         if (fwmark && (svc = __ip_vs_svc_fwm_get(af, fwmark)))
 463                 goto out;
 464
 465         /*
 466          *      Check the table hashed by <protocol,addr,port>
 467          *      for "full" addressed entries
 468          */
 469         svc = __ip_vs_service_get(af, protocol, vaddr, vport);
 470
 471         if (svc == NULL
 472             && protocol == IPPROTO_TCP
 473             && atomic_read(&ip_vs_ftpsvc_counter)
 474             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 475                 /*
 476                  * Check if ftp service entry exists, the packet
 477                  * might belong to FTP data connections.
 478                  */
 479                 svc = __ip_vs_service_get(af, protocol, vaddr, FTPPORT);
 480         }
 481
 482         if (svc == NULL
 483             && atomic_read(&ip_vs_nullsvc_counter)) {
 484                 /*
 485                  * Check if the catch-all port (port zero) exists
 486                  */
 487                 svc = __ip_vs_service_get(af, protocol, vaddr, 0);
 488         }
 489
 490   out:
 491         read_unlock(&__ip_vs_svc_lock);
 492
 493         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 494                       fwmark, ip_vs_proto_name(protocol),
 495                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 496                       svc ? "hit" : "not hit");
 497
 498         return svc;
 499 }
 500
 501
 502 static inline void
 503 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 504 {
 505         atomic_inc(&svc->refcnt);
 506         dest->svc = svc;
 507 }
 508
 509 static inline void
 510 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 511 {
 512         struct ip_vs_service *svc = dest->svc;
 513
 514         dest->svc = NULL;
 515         if (atomic_dec_and_test(&svc->refcnt))
 516                 kfree(svc);
 517 }
 518
 519
 520 /*
 521  *      Returns hash value for real service
 522  */
 523 static inline unsigned ip_vs_rs_hashkey(int af,
 524                                             const union nf_inet_addr *addr,
 525                                             __be16 port)
 526 {
 527         register unsigned porth = ntohs(port);
 528         __be32 addr_fold = addr->ip;
 529
 530 #ifdef CONFIG_IP_VS_IPV6
 531         if (af == AF_INET6)
 532                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 533                             addr->ip6[2]^addr->ip6[3];
 534 #endif
 535
 536         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 537                 & IP_VS_RTAB_MASK;
 538 }
 539
 540 /*
 541  *      Hashes ip_vs_dest in ip_vs_rtable by <proto,addr,port>.
 542  *      should be called with locked tables.
 543  */
 544 static int ip_vs_rs_hash(struct ip_vs_dest *dest)
 545 {
 546         unsigned hash;
 547
 548         if (!list_empty(&dest->d_list)) {
 549                 return 0;
 550         }
 551
 552         /*
 553          *      Hash by proto,addr,port,
 554          *      which are the parameters of the real service.
 555          */
 556         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 557
 558         list_add(&dest->d_list, &ip_vs_rtable[hash]);
 559
 560         return 1;
 561 }
 562
 563 /*
 564  *      UNhashes ip_vs_dest from ip_vs_rtable.
 565  *      should be called with locked tables.
 566  */
 567 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
 568 {
 569         /*
 570          * Remove it from the ip_vs_rtable table.
 571          */
 572         if (!list_empty(&dest->d_list)) {
 573                 list_del(&dest->d_list);
 574                 INIT_LIST_HEAD(&dest->d_list);
 575         }
 576
 577         return 1;
 578 }
 579
 580 /*
 581  *      Lookup real service by <proto,addr,port> in the real service table.
 582  */
 583 struct ip_vs_dest *
 584 ip_vs_lookup_real_service(int af, __u16 protocol,
 585                           const union nf_inet_addr *daddr,
 586                           __be16 dport)
 587 {
 588         unsigned hash;
 589         struct ip_vs_dest *dest;
 590
 591         /*
 592          *      Check for "full" addressed entries
 593          *      Return the first found entry
 594          */
 595         hash = ip_vs_rs_hashkey(af, daddr, dport);
 596
 597         read_lock(&__ip_vs_rs_lock);
 598         list_for_each_entry(dest, &ip_vs_rtable[hash], d_list) {
 599                 if ((dest->af == af)
 600                     && ip_vs_addr_equal(af, &dest->addr, daddr)
 601                     && (dest->port == dport)
 602                     && ((dest->protocol == protocol) ||
 603                         dest->vfwmark)) {
 604                         /* HIT */
 605                         read_unlock(&__ip_vs_rs_lock);
 606                         return dest;
 607                 }
 608         }
 609         read_unlock(&__ip_vs_rs_lock);
 610
 611         return NULL;
 612 }
 613
 614 /*
 615  *      Lookup destination by {addr,port} in the given service
 616  */
 617 static struct ip_vs_dest *
 618 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 619                   __be16 dport)
 620 {
 621         struct ip_vs_dest *dest;
 622
 623         /*
 624          * Find the destination for the given service
 625          */
 626         list_for_each_entry(dest, &svc->destinations, n_list) {
 627                 if ((dest->af == svc->af)
 628                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 629                     && (dest->port == dport)) {
 630                         /* HIT */
 631                         return dest;
 632                 }
 633         }
 634
 635         return NULL;
 636 }
 637
 638 /*
 639  * Find destination by {daddr,dport,vaddr,protocol}
 640  * Cretaed to be used in ip_vs_process_message() in
 641  * the backup synchronization daemon. It finds the
 642  * destination to be bound to the received connection
 643  * on the backup.
 644  *
 645  * ip_vs_lookup_real_service() looked promissing, but
 646  * seems not working as expected.
 647  */
 648 struct ip_vs_dest *ip_vs_find_dest(int af, const union nf_inet_addr *daddr,
 649                                    __be16 dport,
 650                                    const union nf_inet_addr *vaddr,
 651                                    __be16 vport, __u16 protocol)
 652 {
 653         struct ip_vs_dest *dest;
 654         struct ip_vs_service *svc;
 655
 656         svc = ip_vs_service_get(af, 0, protocol, vaddr, vport);
 657         if (!svc)
 658                 return NULL;
 659         dest = ip_vs_lookup_dest(svc, daddr, dport);
 660         if (dest)
 661                 atomic_inc(&dest->refcnt);
 662         ip_vs_service_put(svc);
 663         return dest;
 664 }
 665
 666 /*
 667  *  Lookup dest by {svc,addr,port} in the destination trash.
 668  *  The destination trash is used to hold the destinations that are removed
 669  *  from the service table but are still referenced by some conn entries.
 670  *  The reason to add the destination trash is when the dest is temporary
 671  *  down (either by administrator or by monitor program), the dest can be
 672  *  picked back from the trash, the remaining connections to the dest can
 673  *  continue, and the counting information of the dest is also useful for
 674  *  scheduling.
 675  */
 676 static struct ip_vs_dest *
 677 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 678                      __be16 dport)
 679 {
 680         struct ip_vs_dest *dest, *nxt;
 681
 682         /*
 683          * Find the destination in trash
 684          */
 685         list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
 686                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 687                               "dest->refcnt=%d\n",
 688                               dest->vfwmark,
 689                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 690                               ntohs(dest->port),
 691                               atomic_read(&dest->refcnt));
 692                 if (dest->af == svc->af &&
 693                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 694                     dest->port == dport &&
 695                     dest->vfwmark == svc->fwmark &&
 696                     dest->protocol == svc->protocol &&
 697                     (svc->fwmark ||
 698                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 699                       dest->vport == svc->port))) {
 700                         /* HIT */
 701                         return dest;
 702                 }
 703
 704                 /*
 705                  * Try to purge the destination from trash if not referenced
 706                  */
 707                 if (atomic_read(&dest->refcnt) == 1) {
 708                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
 709                                       "from trash\n",
 710                                       dest->vfwmark,
 711                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
 712                                       ntohs(dest->port));
 713                         list_del(&dest->n_list);
 714                         ip_vs_dst_reset(dest);
 715                         __ip_vs_unbind_svc(dest);
 716                         kfree(dest);
 717                 }
 718         }
 719
 720         return NULL;
 721 }
 722
 723
 724 /*
 725  *  Clean up all the destinations in the trash
 726  *  Called by the ip_vs_control_cleanup()
 727  *
 728  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 729  *  the service tables must have been flushed and all the connections
 730  *  are expired, and the refcnt of each destination in the trash must
 731  *  be 1, so we simply release them here.
 732  */
 733 static void ip_vs_trash_cleanup(void)
 734 {
 735         struct ip_vs_dest *dest, *nxt;
 736
 737         list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
 738                 list_del(&dest->n_list);
 739                 ip_vs_dst_reset(dest);
 740                 __ip_vs_unbind_svc(dest);
 741                 kfree(dest);
 742         }
 743 }
 744
 745
 746 static void
 747 ip_vs_zero_stats(struct ip_vs_stats *stats)
 748 {
 749         spin_lock_bh(&stats->lock);
 750
 751         memset(&stats->ustats, 0, sizeof(stats->ustats));
 752         ip_vs_zero_estimator(stats);
 753
 754         spin_unlock_bh(&stats->lock);
 755 }
 756
 757 /*
 758  *      Update a destination in the given service
 759  */
 760 static void
 761 __ip_vs_update_dest(struct ip_vs_service *svc,
 762                     struct ip_vs_dest *dest, struct ip_vs_dest_user_kern *udest)
 763 {
 764         int conn_flags;
 765
 766         /* set the weight and the flags */
 767         atomic_set(&dest->weight, udest->weight);
 768         conn_flags = udest->conn_flags | IP_VS_CONN_F_INACTIVE;
 769
 770         /* check if local node and update the flags */
 771 #ifdef CONFIG_IP_VS_IPV6
 772         if (svc->af == AF_INET6) {
 773                 if (__ip_vs_addr_is_local_v6(&udest->addr.in6)) {
 774                         conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
 775                                 | IP_VS_CONN_F_LOCALNODE;
 776                 }
 777         } else
 778 #endif
 779                 if (inet_addr_type(&init_net, udest->addr.ip) == RTN_LOCAL) {
 780                         conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
 781                                 | IP_VS_CONN_F_LOCALNODE;
 782                 }
 783
 784         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 785         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != 0) {
 786                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 787         } else {
 788                 /*
 789                  *    Put the real service in ip_vs_rtable if not present.
 790                  *    For now only for NAT!
 791                  */
 792                 write_lock_bh(&__ip_vs_rs_lock);
 793                 ip_vs_rs_hash(dest);
 794                 write_unlock_bh(&__ip_vs_rs_lock);
 795         }
 796         atomic_set(&dest->conn_flags, conn_flags);
 797
 798         /* bind the service */
 799         if (!dest->svc) {
 800                 __ip_vs_bind_svc(dest, svc);
 801         } else {
 802                 if (dest->svc != svc) {
 803                         __ip_vs_unbind_svc(dest);
 804                         ip_vs_zero_stats(&dest->stats);
 805                         __ip_vs_bind_svc(dest, svc);
 806                 }
 807         }
 808
 809         /* set the dest status flags */
 810         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 811
 812         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 813                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 814         dest->u_threshold = udest->u_threshold;
 815         dest->l_threshold = udest->l_threshold;
 816 }
 817
 818
 819 /*
 820  *      Create a destination for the given service
 821  */
 822 static int
 823 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 824                struct ip_vs_dest **dest_p)
 825 {
 826         struct ip_vs_dest *dest;
 827         unsigned atype;
 828
 829         EnterFunction(2);
 830
 831 #ifdef CONFIG_IP_VS_IPV6
 832         if (svc->af == AF_INET6) {
 833                 atype = ipv6_addr_type(&udest->addr.in6);
 834                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 835                         atype & IPV6_ADDR_LINKLOCAL) &&
 836                         !__ip_vs_addr_is_local_v6(&udest->addr.in6))
 837                         return -EINVAL;
 838         } else
 839 #endif
 840         {
 841                 atype = inet_addr_type(&init_net, udest->addr.ip);
 842                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 843                         return -EINVAL;
 844         }
 845
 846         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
 847         if (dest == NULL) {
 848                 pr_err("%s(): no memory.\n", __func__);
 849                 return -ENOMEM;
 850         }
 851
 852         dest->af = svc->af;
 853         dest->protocol = svc->protocol;
 854         dest->vaddr = svc->addr;
 855         dest->vport = svc->port;
 856         dest->vfwmark = svc->fwmark;
 857         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 858         dest->port = udest->port;
 859
 860         atomic_set(&dest->activeconns, 0);
 861         atomic_set(&dest->inactconns, 0);
 862         atomic_set(&dest->persistconns, 0);
 863         atomic_set(&dest->refcnt, 0);
 864
 865         INIT_LIST_HEAD(&dest->d_list);
 866         spin_lock_init(&dest->dst_lock);
 867         spin_lock_init(&dest->stats.lock);
 868         __ip_vs_update_dest(svc, dest, udest);
 869         ip_vs_new_estimator(&dest->stats);
 870
 871         *dest_p = dest;
 872
 873         LeaveFunction(2);
 874         return 0;
 875 }
 876
 877
 878 /*
 879  *      Add a destination into an existing service
 880  */
 881 static int
 882 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 883 {
 884         struct ip_vs_dest *dest;
 885         union nf_inet_addr daddr;
 886         __be16 dport = udest->port;
 887         int ret;
 888
 889         EnterFunction(2);
 890
 891         if (udest->weight < 0) {
 892                 pr_err("%s(): server weight less than zero\n", __func__);
 893                 return -ERANGE;
 894         }
 895
 896         if (udest->l_threshold > udest->u_threshold) {
 897                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 898                         __func__);
 899                 return -ERANGE;
 900         }
 901
 902         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 903
 904         /*
 905          * Check if the dest already exists in the list
 906          */
 907         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 908
 909         if (dest != NULL) {
 910                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 911                 return -EEXIST;
 912         }
 913
 914         /*
 915          * Check if the dest already exists in the trash and
 916          * is from the same service
 917          */
 918         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 919
 920         if (dest != NULL) {
 921                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 922                               "dest->refcnt=%d, service %u/%s:%u\n",
 923                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 924                               atomic_read(&dest->refcnt),
 925                               dest->vfwmark,
 926                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 927                               ntohs(dest->vport));
 928
 929                 __ip_vs_update_dest(svc, dest, udest);
 930
 931                 /*
 932                  * Get the destination from the trash
 933                  */
 934                 list_del(&dest->n_list);
 935
 936                 ip_vs_new_estimator(&dest->stats);
 937
 938                 write_lock_bh(&__ip_vs_svc_lock);
 939
 940                 /*
 941                  * Wait until all other svc users go away.
 942                  */
 943                 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 944
 945                 list_add(&dest->n_list, &svc->destinations);
 946                 svc->num_dests++;
 947
 948                 /* call the update_service function of its scheduler */
 949                 if (svc->scheduler->update_service)
 950                         svc->scheduler->update_service(svc);
 951
 952                 write_unlock_bh(&__ip_vs_svc_lock);
 953                 return 0;
 954         }
 955
 956         /*
 957          * Allocate and initialize the dest structure
 958          */
 959         ret = ip_vs_new_dest(svc, udest, &dest);
 960         if (ret) {
 961                 return ret;
 962         }
 963
 964         /*
 965          * Add the dest entry into the list
 966          */
 967         atomic_inc(&dest->refcnt);
 968
 969         write_lock_bh(&__ip_vs_svc_lock);
 970
 971         /*
 972          * Wait until all other svc users go away.
 973          */
 974         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 975
 976         list_add(&dest->n_list, &svc->destinations);
 977         svc->num_dests++;
 978
 979         /* call the update_service function of its scheduler */
 980         if (svc->scheduler->update_service)
 981                 svc->scheduler->update_service(svc);
 982
 983         write_unlock_bh(&__ip_vs_svc_lock);
 984
 985         LeaveFunction(2);
 986
 987         return 0;
 988 }
 989
 990
 991 /*
 992  *      Edit a destination in the given service
 993  */
 994 static int
 995 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 996 {
 997         struct ip_vs_dest *dest;
 998         union nf_inet_addr daddr;
 999         __be16 dport = udest->port;
1000
1001         EnterFunction(2);
1002
1003         if (udest->weight < 0) {
1004                 pr_err("%s(): server weight less than zero\n", __func__);
1005                 return -ERANGE;
1006         }
1007
1008         if (udest->l_threshold > udest->u_threshold) {
1009                 pr_err("%s(): lower threshold is higher than upper threshold\n",
1010                         __func__);
1011                 return -ERANGE;
1012         }
1013
1014         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
1015
1016         /*
1017          *  Lookup the destination list
1018          */
1019         dest = ip_vs_lookup_dest(svc, &daddr, dport);
1020
1021         if (dest == NULL) {
1022                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1023                 return -ENOENT;
1024         }
1025
1026         __ip_vs_update_dest(svc, dest, udest);
1027
1028         write_lock_bh(&__ip_vs_svc_lock);
1029
1030         /* Wait until all other svc users go away */
1031         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1032
1033         /* call the update_service, because server weight may be changed */
1034         if (svc->scheduler->update_service)
1035                 svc->scheduler->update_service(svc);
1036
1037         write_unlock_bh(&__ip_vs_svc_lock);
1038
1039         LeaveFunction(2);
1040
1041         return 0;
1042 }
1043
1044
1045 /*
1046  *      Delete a destination (must be already unlinked from the service)
1047  */
1048 static void __ip_vs_del_dest(struct ip_vs_dest *dest)
1049 {
1050         ip_vs_kill_estimator(&dest->stats);
1051
1052         /*
1053          *  Remove it from the d-linked list with the real services.
1054          */
1055         write_lock_bh(&__ip_vs_rs_lock);
1056         ip_vs_rs_unhash(dest);
1057         write_unlock_bh(&__ip_vs_rs_lock);
1058
1059         /*
1060          *  Decrease the refcnt of the dest, and free the dest
1061          *  if nobody refers to it (refcnt=0). Otherwise, throw
1062          *  the destination into the trash.
1063          */
1064         if (atomic_dec_and_test(&dest->refcnt)) {
1065                 ip_vs_dst_reset(dest);
1066                 /* simply decrease svc->refcnt here, let the caller check
1067                    and release the service if nobody refers to it.
1068                    Only user context can release destination and service,
1069                    and only one user context can update virtual service at a
1070                    time, so the operation here is OK */
1071                 atomic_dec(&dest->svc->refcnt);
1072                 kfree(dest);
1073         } else {
1074                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1075                               "dest->refcnt=%d\n",
1076                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1077                               ntohs(dest->port),
1078                               atomic_read(&dest->refcnt));
1079                 list_add(&dest->n_list, &ip_vs_dest_trash);
1080                 atomic_inc(&dest->refcnt);
1081         }
1082 }
1083
1084
1085 /*
1086  *      Unlink a destination from the given service
1087  */
1088 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1089                                 struct ip_vs_dest *dest,
1090                                 int svcupd)
1091 {
1092         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1093
1094         /*
1095          *  Remove it from the d-linked destination list.
1096          */
1097         list_del(&dest->n_list);
1098         svc->num_dests--;
1099
1100         /*
1101          *  Call the update_service function of its scheduler
1102          */
1103         if (svcupd && svc->scheduler->update_service)
1104                         svc->scheduler->update_service(svc);
1105 }
1106
1107
1108 /*
1109  *      Delete a destination server in the given service
1110  */
1111 static int
1112 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1113 {
1114         struct ip_vs_dest *dest;
1115         __be16 dport = udest->port;
1116
1117         EnterFunction(2);
1118
1119         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1120
1121         if (dest == NULL) {
1122                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1123                 return -ENOENT;
1124         }
1125
1126         write_lock_bh(&__ip_vs_svc_lock);
1127
1128         /*
1129          *      Wait until all other svc users go away.
1130          */
1131         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1132
1133         /*
1134          *      Unlink dest from the service
1135          */
1136         __ip_vs_unlink_dest(svc, dest, 1);
1137
1138         write_unlock_bh(&__ip_vs_svc_lock);
1139
1140         /*
1141          *      Delete the destination
1142          */
1143         __ip_vs_del_dest(dest);
1144
1145         LeaveFunction(2);
1146
1147         return 0;
1148 }
1149
1150
1151 /*
1152  *      Add a service into the service hash table
1153  */
1154 static int
1155 ip_vs_add_service(struct ip_vs_service_user_kern *u,
1156                   struct ip_vs_service **svc_p)
1157 {
1158         int ret = 0;
1159         struct ip_vs_scheduler *sched = NULL;
1160         struct ip_vs_service *svc = NULL;
1161
1162         /* increase the module use count */
1163         ip_vs_use_count_inc();
1164
1165         /* Lookup the scheduler by 'u->sched_name' */
1166         sched = ip_vs_scheduler_get(u->sched_name);
1167         if (sched == NULL) {
1168                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1169                 ret = -ENOENT;
1170                 goto out_mod_dec;
1171         }
1172
1173 #ifdef CONFIG_IP_VS_IPV6
1174         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1175                 ret = -EINVAL;
1176                 goto out_err;
1177         }
1178 #endif
1179
1180         svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1181         if (svc == NULL) {
1182                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1183                 ret = -ENOMEM;
1184                 goto out_err;
1185         }
1186
1187         /* I'm the first user of the service */
1188         atomic_set(&svc->usecnt, 1);
1189         atomic_set(&svc->refcnt, 0);
1190
1191         svc->af = u->af;
1192         svc->protocol = u->protocol;
1193         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1194         svc->port = u->port;
1195         svc->fwmark = u->fwmark;
1196         svc->flags = u->flags;
1197         svc->timeout = u->timeout * HZ;
1198         svc->netmask = u->netmask;
1199
1200         INIT_LIST_HEAD(&svc->destinations);
1201         rwlock_init(&svc->sched_lock);
1202         spin_lock_init(&svc->stats.lock);
1203
1204         /* Bind the scheduler */
1205         ret = ip_vs_bind_scheduler(svc, sched);
1206         if (ret)
1207                 goto out_err;
1208         sched = NULL;
1209
1210         /* Update the virtual service counters */
1211         if (svc->port == FTPPORT)
1212                 atomic_inc(&ip_vs_ftpsvc_counter);
1213         else if (svc->port == 0)
1214                 atomic_inc(&ip_vs_nullsvc_counter);
1215
1216         ip_vs_new_estimator(&svc->stats);
1217
1218         /* Count only IPv4 services for old get/setsockopt interface */
1219         if (svc->af == AF_INET)
1220                 ip_vs_num_services++;
1221
1222         /* Hash the service into the service table */
1223         write_lock_bh(&__ip_vs_svc_lock);
1224         ip_vs_svc_hash(svc);
1225         write_unlock_bh(&__ip_vs_svc_lock);
1226
1227         *svc_p = svc;
1228         return 0;
1229
1230   out_err:
1231         if (svc != NULL) {
1232                 if (svc->scheduler)
1233                         ip_vs_unbind_scheduler(svc);
1234                 if (svc->inc) {
1235                         local_bh_disable();
1236                         ip_vs_app_inc_put(svc->inc);
1237                         local_bh_enable();
1238                 }
1239                 kfree(svc);
1240         }
1241         ip_vs_scheduler_put(sched);
1242
1243   out_mod_dec:
1244         /* decrease the module use count */
1245         ip_vs_use_count_dec();
1246
1247         return ret;
1248 }
1249
1250
1251 /*
1252  *      Edit a service and bind it with a new scheduler
1253  */
1254 static int
1255 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1256 {
1257         struct ip_vs_scheduler *sched, *old_sched;
1258         int ret = 0;
1259
1260         /*
1261          * Lookup the scheduler, by 'u->sched_name'
1262          */
1263         sched = ip_vs_scheduler_get(u->sched_name);
1264         if (sched == NULL) {
1265                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1266                 return -ENOENT;
1267         }
1268         old_sched = sched;
1269
1270 #ifdef CONFIG_IP_VS_IPV6
1271         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1272                 ret = -EINVAL;
1273                 goto out;
1274         }
1275 #endif
1276
1277         write_lock_bh(&__ip_vs_svc_lock);
1278
1279         /*
1280          * Wait until all other svc users go away.
1281          */
1282         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1283
1284         /*
1285          * Set the flags and timeout value
1286          */
1287         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1288         svc->timeout = u->timeout * HZ;
1289         svc->netmask = u->netmask;
1290
1291         old_sched = svc->scheduler;
1292         if (sched != old_sched) {
1293                 /*
1294                  * Unbind the old scheduler
1295                  */
1296                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1297                         old_sched = sched;
1298                         goto out_unlock;
1299                 }
1300
1301                 /*
1302                  * Bind the new scheduler
1303                  */
1304                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1305                         /*
1306                          * If ip_vs_bind_scheduler fails, restore the old
1307                          * scheduler.
1308                          * The main reason of failure is out of memory.
1309                          *
1310                          * The question is if the old scheduler can be
1311                          * restored all the time. TODO: if it cannot be
1312                          * restored some time, we must delete the service,
1313                          * otherwise the system may crash.
1314                          */
1315                         ip_vs_bind_scheduler(svc, old_sched);
1316                         old_sched = sched;
1317                         goto out_unlock;
1318                 }
1319         }
1320
1321   out_unlock:
1322         write_unlock_bh(&__ip_vs_svc_lock);
1323 #ifdef CONFIG_IP_VS_IPV6
1324   out:
1325 #endif
1326
1327         if (old_sched)
1328                 ip_vs_scheduler_put(old_sched);
1329
1330         return ret;
1331 }
1332
1333
1334 /*
1335  *      Delete a service from the service list
1336  *      - The service must be unlinked, unlocked and not referenced!
1337  *      - We are called under _bh lock
1338  */
1339 static void __ip_vs_del_service(struct ip_vs_service *svc)
1340 {
1341         struct ip_vs_dest *dest, *nxt;
1342         struct ip_vs_scheduler *old_sched;
1343
1344         /* Count only IPv4 services for old get/setsockopt interface */
1345         if (svc->af == AF_INET)
1346                 ip_vs_num_services--;
1347
1348         ip_vs_kill_estimator(&svc->stats);
1349
1350         /* Unbind scheduler */
1351         old_sched = svc->scheduler;
1352         ip_vs_unbind_scheduler(svc);
1353         if (old_sched)
1354                 ip_vs_scheduler_put(old_sched);
1355
1356         /* Unbind app inc */
1357         if (svc->inc) {
1358                 ip_vs_app_inc_put(svc->inc);
1359                 svc->inc = NULL;
1360         }
1361
1362         /*
1363          *    Unlink the whole destination list
1364          */
1365         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1366                 __ip_vs_unlink_dest(svc, dest, 0);
1367                 __ip_vs_del_dest(dest);
1368         }
1369
1370         /*
1371          *    Update the virtual service counters
1372          */
1373         if (svc->port == FTPPORT)
1374                 atomic_dec(&ip_vs_ftpsvc_counter);
1375         else if (svc->port == 0)
1376                 atomic_dec(&ip_vs_nullsvc_counter);
1377
1378         /*
1379          *    Free the service if nobody refers to it
1380          */
1381         if (atomic_read(&svc->refcnt) == 0)
1382                 kfree(svc);
1383
1384         /* decrease the module use count */
1385         ip_vs_use_count_dec();
1386 }
1387
1388 /*
1389  *      Delete a service from the service list
1390  */
1391 static int ip_vs_del_service(struct ip_vs_service *svc)
1392 {
1393         if (svc == NULL)
1394                 return -EEXIST;
1395
1396         /*
1397          * Unhash it from the service table
1398          */
1399         write_lock_bh(&__ip_vs_svc_lock);
1400
1401         ip_vs_svc_unhash(svc);
1402
1403         /*
1404          * Wait until all the svc users go away.
1405          */
1406         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1407
1408         __ip_vs_del_service(svc);
1409
1410         write_unlock_bh(&__ip_vs_svc_lock);
1411
1412         return 0;
1413 }
1414
1415
1416 /*
1417  *      Flush all the virtual services
1418  */
1419 static int ip_vs_flush(void)
1420 {
1421         int idx;
1422         struct ip_vs_service *svc, *nxt;
1423
1424         /*
1425          * Flush the service table hashed by <protocol,addr,port>
1426          */
1427         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1428                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx], s_list) {
1429                         write_lock_bh(&__ip_vs_svc_lock);
1430                         ip_vs_svc_unhash(svc);
1431                         /*
1432                          * Wait until all the svc users go away.
1433                          */
1434                         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1435                         __ip_vs_del_service(svc);
1436                         write_unlock_bh(&__ip_vs_svc_lock);
1437                 }
1438         }
1439
1440         /*
1441          * Flush the service table hashed by fwmark
1442          */
1443         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1444                 list_for_each_entry_safe(svc, nxt,
1445                                          &ip_vs_svc_fwm_table[idx], f_list) {
1446                         write_lock_bh(&__ip_vs_svc_lock);
1447                         ip_vs_svc_unhash(svc);
1448                         /*
1449                          * Wait until all the svc users go away.
1450                          */
1451                         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1452                         __ip_vs_del_service(svc);
1453                         write_unlock_bh(&__ip_vs_svc_lock);
1454                 }
1455         }
1456
1457         return 0;
1458 }
1459
1460
1461 /*
1462  *      Zero counters in a service or all services
1463  */
1464 static int ip_vs_zero_service(struct ip_vs_service *svc)
1465 {
1466         struct ip_vs_dest *dest;
1467
1468         write_lock_bh(&__ip_vs_svc_lock);
1469         list_for_each_entry(dest, &svc->destinations, n_list) {
1470                 ip_vs_zero_stats(&dest->stats);
1471         }
1472         ip_vs_zero_stats(&svc->stats);
1473         write_unlock_bh(&__ip_vs_svc_lock);
1474         return 0;
1475 }
1476
1477 static int ip_vs_zero_all(void)
1478 {
1479         int idx;
1480         struct ip_vs_service *svc;
1481
1482         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1483                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1484                         ip_vs_zero_service(svc);
1485                 }
1486         }
1487
1488         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1489                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1490                         ip_vs_zero_service(svc);
1491                 }
1492         }
1493
1494         ip_vs_zero_stats(&ip_vs_stats);
1495         return 0;
1496 }
1497
1498
1499 static int
1500 proc_do_defense_mode(ctl_table *table, int write,
1501                      void __user *buffer, size_t *lenp, loff_t *ppos)
1502 {
1503         int *valp = table->data;
1504         int val = *valp;
1505         int rc;
1506
1507         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1508         if (write && (*valp != val)) {
1509                 if ((*valp < 0) || (*valp > 3)) {
1510                         /* Restore the correct value */
1511                         *valp = val;
1512                 } else {
1513                         update_defense_level();
1514                 }
1515         }
1516         return rc;
1517 }
1518
1519
1520 static int
1521 proc_do_sync_threshold(ctl_table *table, int write,
1522                        void __user *buffer, size_t *lenp, loff_t *ppos)
1523 {
1524         int *valp = table->data;
1525         int val[2];
1526         int rc;
1527
1528         /* backup the value first */
1529         memcpy(val, valp, sizeof(val));
1530
1531         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1532         if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1533                 /* Restore the correct value */
1534                 memcpy(valp, val, sizeof(val));
1535         }
1536         return rc;
1537 }
1538
1539
1540 /*
1541  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1542  */
1543
1544 static struct ctl_table vs_vars[] = {
1545         {
1546                 .procname       = "amemthresh",
1547                 .data           = &sysctl_ip_vs_amemthresh,
1548                 .maxlen         = sizeof(int),
1549                 .mode           = 0644,
1550                 .proc_handler   = proc_dointvec,
1551         },
1552 #ifdef CONFIG_IP_VS_DEBUG
1553         {
1554                 .procname       = "debug_level",
1555                 .data           = &sysctl_ip_vs_debug_level,
1556                 .maxlen         = sizeof(int),
1557                 .mode           = 0644,
1558                 .proc_handler   = proc_dointvec,
1559         },
1560 #endif
1561         {
1562                 .procname       = "am_droprate",
1563                 .data           = &sysctl_ip_vs_am_droprate,
1564                 .maxlen         = sizeof(int),
1565                 .mode           = 0644,
1566                 .proc_handler   = proc_dointvec,
1567         },
1568         {
1569                 .procname       = "drop_entry",
1570                 .data           = &sysctl_ip_vs_drop_entry,
1571                 .maxlen         = sizeof(int),
1572                 .mode           = 0644,
1573                 .proc_handler   = proc_do_defense_mode,
1574         },
1575         {
1576                 .procname       = "drop_packet",
1577                 .data           = &sysctl_ip_vs_drop_packet,
1578                 .maxlen         = sizeof(int),
1579                 .mode           = 0644,
1580                 .proc_handler   = proc_do_defense_mode,
1581         },
1582         {
1583                 .procname       = "secure_tcp",
1584                 .data           = &sysctl_ip_vs_secure_tcp,
1585                 .maxlen         = sizeof(int),
1586                 .mode           = 0644,
1587                 .proc_handler   = proc_do_defense_mode,
1588         },
1589 #if 0
1590         {
1591                 .procname       = "timeout_established",
1592                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1593                 .maxlen         = sizeof(int),
1594                 .mode           = 0644,
1595                 .proc_handler   = proc_dointvec_jiffies,
1596         },
1597         {
1598                 .procname       = "timeout_synsent",
1599                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1600                 .maxlen         = sizeof(int),
1601                 .mode           = 0644,
1602                 .proc_handler   = proc_dointvec_jiffies,
1603         },
1604         {
1605                 .procname       = "timeout_synrecv",
1606                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1607                 .maxlen         = sizeof(int),
1608                 .mode           = 0644,
1609                 .proc_handler   = proc_dointvec_jiffies,
1610         },
1611         {
1612                 .procname       = "timeout_finwait",
1613                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1614                 .maxlen         = sizeof(int),
1615                 .mode           = 0644,
1616                 .proc_handler   = proc_dointvec_jiffies,
1617         },
1618         {
1619                 .procname       = "timeout_timewait",
1620                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1621                 .maxlen         = sizeof(int),
1622                 .mode           = 0644,
1623                 .proc_handler   = proc_dointvec_jiffies,
1624         },
1625         {
1626                 .procname       = "timeout_close",
1627                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1628                 .maxlen         = sizeof(int),
1629                 .mode           = 0644,
1630                 .proc_handler   = proc_dointvec_jiffies,
1631         },
1632         {
1633                 .procname       = "timeout_closewait",
1634                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1635                 .maxlen         = sizeof(int),
1636                 .mode           = 0644,
1637                 .proc_handler   = proc_dointvec_jiffies,
1638         },
1639         {
1640                 .procname       = "timeout_lastack",
1641                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1642                 .maxlen         = sizeof(int),
1643                 .mode           = 0644,
1644                 .proc_handler   = proc_dointvec_jiffies,
1645         },
1646         {
1647                 .procname       = "timeout_listen",
1648                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1649                 .maxlen         = sizeof(int),
1650                 .mode           = 0644,
1651                 .proc_handler   = proc_dointvec_jiffies,
1652         },
1653         {
1654                 .procname       = "timeout_synack",
1655                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1656                 .maxlen         = sizeof(int),
1657                 .mode           = 0644,
1658                 .proc_handler   = proc_dointvec_jiffies,
1659         },
1660         {
1661                 .procname       = "timeout_udp",
1662                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1663                 .maxlen         = sizeof(int),
1664                 .mode           = 0644,
1665                 .proc_handler   = proc_dointvec_jiffies,
1666         },
1667         {
1668                 .procname       = "timeout_icmp",
1669                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1670                 .maxlen         = sizeof(int),
1671                 .mode           = 0644,
1672                 .proc_handler   = proc_dointvec_jiffies,
1673         },
1674 #endif
1675         {
1676                 .procname       = "cache_bypass",
1677                 .data           = &sysctl_ip_vs_cache_bypass,
1678                 .maxlen         = sizeof(int),
1679                 .mode           = 0644,
1680                 .proc_handler   = proc_dointvec,
1681         },
1682         {
1683                 .procname       = "expire_nodest_conn",
1684                 .data           = &sysctl_ip_vs_expire_nodest_conn,
1685                 .maxlen         = sizeof(int),
1686                 .mode           = 0644,
1687                 .proc_handler   = proc_dointvec,
1688         },
1689         {
1690                 .procname       = "expire_quiescent_template",
1691                 .data           = &sysctl_ip_vs_expire_quiescent_template,
1692                 .maxlen         = sizeof(int),
1693                 .mode           = 0644,
1694                 .proc_handler   = proc_dointvec,
1695         },
1696         {
1697                 .procname       = "sync_threshold",
1698                 .data           = &sysctl_ip_vs_sync_threshold,
1699                 .maxlen         = sizeof(sysctl_ip_vs_sync_threshold),
1700                 .mode           = 0644,
1701                 .proc_handler   = proc_do_sync_threshold,
1702         },
1703         {
1704                 .procname       = "nat_icmp_send",
1705                 .data           = &sysctl_ip_vs_nat_icmp_send,
1706                 .maxlen         = sizeof(int),
1707                 .mode           = 0644,
1708                 .proc_handler   = proc_dointvec,
1709         },
1710         { }
1711 };
1712
1713 const struct ctl_path net_vs_ctl_path[] = {
1714         { .procname = "net", },
1715         { .procname = "ipv4", },
1716         { .procname = "vs", },
1717         { }
1718 };
1719 EXPORT_SYMBOL_GPL(net_vs_ctl_path);
1720
1721 static struct ctl_table_header * sysctl_header;
1722
1723 #ifdef CONFIG_PROC_FS
1724
1725 struct ip_vs_iter {
1726         struct list_head *table;
1727         int bucket;
1728 };
1729
1730 /*
1731  *      Write the contents of the VS rule table to a PROCfs file.
1732  *      (It is kept just for backward compatibility)
1733  */
1734 static inline const char *ip_vs_fwd_name(unsigned flags)
1735 {
1736         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1737         case IP_VS_CONN_F_LOCALNODE:
1738                 return "Local";
1739         case IP_VS_CONN_F_TUNNEL:
1740                 return "Tunnel";
1741         case IP_VS_CONN_F_DROUTE:
1742                 return "Route";
1743         default:
1744                 return "Masq";
1745         }
1746 }
1747
1748
1749 /* Get the Nth entry in the two lists */
1750 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1751 {
1752         struct ip_vs_iter *iter = seq->private;
1753         int idx;
1754         struct ip_vs_service *svc;
1755
1756         /* look in hash by protocol */
1757         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1758                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1759                         if (pos-- == 0){
1760                                 iter->table = ip_vs_svc_table;
1761                                 iter->bucket = idx;
1762                                 return svc;
1763                         }
1764                 }
1765         }
1766
1767         /* keep looking in fwmark */
1768         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1769                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1770                         if (pos-- == 0) {
1771                                 iter->table = ip_vs_svc_fwm_table;
1772                                 iter->bucket = idx;
1773                                 return svc;
1774                         }
1775                 }
1776         }
1777
1778         return NULL;
1779 }
1780
1781 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1782 __acquires(__ip_vs_svc_lock)
1783 {
1784
1785         read_lock_bh(&__ip_vs_svc_lock);
1786         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1787 }
1788
1789
1790 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1791 {
1792         struct list_head *e;
1793         struct ip_vs_iter *iter;
1794         struct ip_vs_service *svc;
1795
1796         ++*pos;
1797         if (v == SEQ_START_TOKEN)
1798                 return ip_vs_info_array(seq,0);
1799
1800         svc = v;
1801         iter = seq->private;
1802
1803         if (iter->table == ip_vs_svc_table) {
1804                 /* next service in table hashed by protocol */
1805                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1806                         return list_entry(e, struct ip_vs_service, s_list);
1807
1808
1809                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1810                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1811                                             s_list) {
1812                                 return svc;
1813                         }
1814                 }
1815
1816                 iter->table = ip_vs_svc_fwm_table;
1817                 iter->bucket = -1;
1818                 goto scan_fwmark;
1819         }
1820
1821         /* next service in hashed by fwmark */
1822         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1823                 return list_entry(e, struct ip_vs_service, f_list);
1824
1825  scan_fwmark:
1826         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1827                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1828                                     f_list)
1829                         return svc;
1830         }
1831
1832         return NULL;
1833 }
1834
1835 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
1836 __releases(__ip_vs_svc_lock)
1837 {
1838         read_unlock_bh(&__ip_vs_svc_lock);
1839 }
1840
1841
1842 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1843 {
1844         if (v == SEQ_START_TOKEN) {
1845                 seq_printf(seq,
1846                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
1847                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1848                 seq_puts(seq,
1849                          "Prot LocalAddress:Port Scheduler Flags\n");
1850                 seq_puts(seq,
1851                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1852         } else {
1853                 const struct ip_vs_service *svc = v;
1854                 const struct ip_vs_iter *iter = seq->private;
1855                 const struct ip_vs_dest *dest;
1856
1857                 if (iter->table == ip_vs_svc_table) {
1858 #ifdef CONFIG_IP_VS_IPV6
1859                         if (svc->af == AF_INET6)
1860                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
1861                                            ip_vs_proto_name(svc->protocol),
1862                                            &svc->addr.in6,
1863                                            ntohs(svc->port),
1864                                            svc->scheduler->name);
1865                         else
1866 #endif
1867                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
1868                                            ip_vs_proto_name(svc->protocol),
1869                                            ntohl(svc->addr.ip),
1870                                            ntohs(svc->port),
1871                                            svc->scheduler->name,
1872                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
1873                 } else {
1874                         seq_printf(seq, "FWM  %08X %s %s",
1875                                    svc->fwmark, svc->scheduler->name,
1876                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
1877                 }
1878
1879                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
1880                         seq_printf(seq, "persistent %d %08X\n",
1881                                 svc->timeout,
1882                                 ntohl(svc->netmask));
1883                 else
1884                         seq_putc(seq, '\n');
1885
1886                 list_for_each_entry(dest, &svc->destinations, n_list) {
1887 #ifdef CONFIG_IP_VS_IPV6
1888                         if (dest->af == AF_INET6)
1889                                 seq_printf(seq,
1890                                            "  -> [%pI6]:%04X"
1891                                            "      %-7s %-6d %-10d %-10d\n",
1892                                            &dest->addr.in6,
1893                                            ntohs(dest->port),
1894                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1895                                            atomic_read(&dest->weight),
1896                                            atomic_read(&dest->activeconns),
1897                                            atomic_read(&dest->inactconns));
1898                         else
1899 #endif
1900                                 seq_printf(seq,
1901                                            "  -> %08X:%04X      "
1902                                            "%-7s %-6d %-10d %-10d\n",
1903                                            ntohl(dest->addr.ip),
1904                                            ntohs(dest->port),
1905                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1906                                            atomic_read(&dest->weight),
1907                                            atomic_read(&dest->activeconns),
1908                                            atomic_read(&dest->inactconns));
1909
1910                 }
1911         }
1912         return 0;
1913 }
1914
1915 static const struct seq_operations ip_vs_info_seq_ops = {
1916         .start = ip_vs_info_seq_start,
1917         .next  = ip_vs_info_seq_next,
1918         .stop  = ip_vs_info_seq_stop,
1919         .show  = ip_vs_info_seq_show,
1920 };
1921
1922 static int ip_vs_info_open(struct inode *inode, struct file *file)
1923 {
1924         return seq_open_private(file, &ip_vs_info_seq_ops,
1925                         sizeof(struct ip_vs_iter));
1926 }
1927
1928 static const struct file_operations ip_vs_info_fops = {
1929         .owner   = THIS_MODULE,
1930         .open    = ip_vs_info_open,
1931         .read    = seq_read,
1932         .llseek  = seq_lseek,
1933         .release = seq_release_private,
1934 };
1935
1936 #endif
1937
1938 struct ip_vs_stats ip_vs_stats = {
1939         .lock = __SPIN_LOCK_UNLOCKED(ip_vs_stats.lock),
1940 };
1941
1942 #ifdef CONFIG_PROC_FS
1943 static int ip_vs_stats_show(struct seq_file *seq, void *v)
1944 {
1945
1946 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
1947         seq_puts(seq,
1948                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
1949         seq_printf(seq,
1950                    "   Conns  Packets  Packets            Bytes            Bytes\n");
1951
1952         spin_lock_bh(&ip_vs_stats.lock);
1953         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", ip_vs_stats.ustats.conns,
1954                    ip_vs_stats.ustats.inpkts, ip_vs_stats.ustats.outpkts,
1955                    (unsigned long long) ip_vs_stats.ustats.inbytes,
1956                    (unsigned long long) ip_vs_stats.ustats.outbytes);
1957
1958 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
1959         seq_puts(seq,
1960                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
1961         seq_printf(seq,"%8X %8X %8X %16X %16X\n",
1962                         ip_vs_stats.ustats.cps,
1963                         ip_vs_stats.ustats.inpps,
1964                         ip_vs_stats.ustats.outpps,
1965                         ip_vs_stats.ustats.inbps,
1966                         ip_vs_stats.ustats.outbps);
1967         spin_unlock_bh(&ip_vs_stats.lock);
1968
1969         return 0;
1970 }
1971
1972 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
1973 {
1974         return single_open(file, ip_vs_stats_show, NULL);
1975 }
1976
1977 static const struct file_operations ip_vs_stats_fops = {
1978         .owner = THIS_MODULE,
1979         .open = ip_vs_stats_seq_open,
1980         .read = seq_read,
1981         .llseek = seq_lseek,
1982         .release = single_release,
1983 };
1984
1985 #endif
1986
1987 /*
1988  *      Set timeout values for tcp tcpfin udp in the timeout_table.
1989  */
1990 static int ip_vs_set_timeout(struct ip_vs_timeout_user *u)
1991 {
1992         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
1993                   u->tcp_timeout,
1994                   u->tcp_fin_timeout,
1995                   u->udp_timeout);
1996
1997 #ifdef CONFIG_IP_VS_PROTO_TCP
1998         if (u->tcp_timeout) {
1999                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED]
2000                         = u->tcp_timeout * HZ;
2001         }
2002
2003         if (u->tcp_fin_timeout) {
2004                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT]
2005                         = u->tcp_fin_timeout * HZ;
2006         }
2007 #endif
2008
2009 #ifdef CONFIG_IP_VS_PROTO_UDP
2010         if (u->udp_timeout) {
2011                 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL]
2012                         = u->udp_timeout * HZ;
2013         }
2014 #endif
2015         return 0;
2016 }
2017
2018
2019 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2020 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2021 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2022                                  sizeof(struct ip_vs_dest_user))
2023 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2024 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2025 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2026
2027 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2028         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2029         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2030         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2031         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2032         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2033         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2034         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2035         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2036         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2037         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2038         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2039 };
2040
2041 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2042                                   struct ip_vs_service_user *usvc_compat)
2043 {
2044         usvc->af                = AF_INET;
2045         usvc->protocol          = usvc_compat->protocol;
2046         usvc->addr.ip           = usvc_compat->addr;
2047         usvc->port              = usvc_compat->port;
2048         usvc->fwmark            = usvc_compat->fwmark;
2049
2050         /* Deep copy of sched_name is not needed here */
2051         usvc->sched_name        = usvc_compat->sched_name;
2052
2053         usvc->flags             = usvc_compat->flags;
2054         usvc->timeout           = usvc_compat->timeout;
2055         usvc->netmask           = usvc_compat->netmask;
2056 }
2057
2058 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2059                                    struct ip_vs_dest_user *udest_compat)
2060 {
2061         udest->addr.ip          = udest_compat->addr;
2062         udest->port             = udest_compat->port;
2063         udest->conn_flags       = udest_compat->conn_flags;
2064         udest->weight           = udest_compat->weight;
2065         udest->u_threshold      = udest_compat->u_threshold;
2066         udest->l_threshold      = udest_compat->l_threshold;
2067 }
2068
2069 static int
2070 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2071 {
2072         int ret;
2073         unsigned char arg[MAX_ARG_LEN];
2074         struct ip_vs_service_user *usvc_compat;
2075         struct ip_vs_service_user_kern usvc;
2076         struct ip_vs_service *svc;
2077         struct ip_vs_dest_user *udest_compat;
2078         struct ip_vs_dest_user_kern udest;
2079
2080         if (!capable(CAP_NET_ADMIN))
2081                 return -EPERM;
2082
2083         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2084                 return -EINVAL;
2085         if (len < 0 || len >  MAX_ARG_LEN)
2086                 return -EINVAL;
2087         if (len != set_arglen[SET_CMDID(cmd)]) {
2088                 pr_err("set_ctl: len %u != %u\n",
2089                        len, set_arglen[SET_CMDID(cmd)]);
2090                 return -EINVAL;
2091         }
2092
2093         if (copy_from_user(arg, user, len) != 0)
2094                 return -EFAULT;
2095
2096         /* increase the module use count */
2097         ip_vs_use_count_inc();
2098
2099         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2100                 ret = -ERESTARTSYS;
2101                 goto out_dec;
2102         }
2103
2104         if (cmd == IP_VS_SO_SET_FLUSH) {
2105                 /* Flush the virtual service */
2106                 ret = ip_vs_flush();
2107                 goto out_unlock;
2108         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2109                 /* Set timeout values for (tcp tcpfin udp) */
2110                 ret = ip_vs_set_timeout((struct ip_vs_timeout_user *)arg);
2111                 goto out_unlock;
2112         } else if (cmd == IP_VS_SO_SET_STARTDAEMON) {
2113                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2114                 ret = start_sync_thread(dm->state, dm->mcast_ifn, dm->syncid);
2115                 goto out_unlock;
2116         } else if (cmd == IP_VS_SO_SET_STOPDAEMON) {
2117                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2118                 ret = stop_sync_thread(dm->state);
2119                 goto out_unlock;
2120         }
2121
2122         usvc_compat = (struct ip_vs_service_user *)arg;
2123         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2124
2125         /* We only use the new structs internally, so copy userspace compat
2126          * structs to extended internal versions */
2127         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2128         ip_vs_copy_udest_compat(&udest, udest_compat);
2129
2130         if (cmd == IP_VS_SO_SET_ZERO) {
2131                 /* if no service address is set, zero counters in all */
2132                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2133                         ret = ip_vs_zero_all();
2134                         goto out_unlock;
2135                 }
2136         }
2137
2138         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2139         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2140             usvc.protocol != IPPROTO_SCTP) {
2141                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2142                        usvc.protocol, &usvc.addr.ip,
2143                        ntohs(usvc.port), usvc.sched_name);
2144                 ret = -EFAULT;
2145                 goto out_unlock;
2146         }
2147
2148         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2149         if (usvc.fwmark == 0)
2150                 svc = __ip_vs_service_get(usvc.af, usvc.protocol,
2151                                           &usvc.addr, usvc.port);
2152         else
2153                 svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
2154
2155         if (cmd != IP_VS_SO_SET_ADD
2156             && (svc == NULL || svc->protocol != usvc.protocol)) {
2157                 ret = -ESRCH;
2158                 goto out_drop_service;
2159         }
2160
2161         switch (cmd) {
2162         case IP_VS_SO_SET_ADD:
2163                 if (svc != NULL)
2164                         ret = -EEXIST;
2165                 else
2166                         ret = ip_vs_add_service(&usvc, &svc);
2167                 break;
2168         case IP_VS_SO_SET_EDIT:
2169                 ret = ip_vs_edit_service(svc, &usvc);
2170                 break;
2171         case IP_VS_SO_SET_DEL:
2172                 ret = ip_vs_del_service(svc);
2173                 if (!ret)
2174                         goto out_unlock;
2175                 break;
2176         case IP_VS_SO_SET_ZERO:
2177                 ret = ip_vs_zero_service(svc);
2178                 break;
2179         case IP_VS_SO_SET_ADDDEST:
2180                 ret = ip_vs_add_dest(svc, &udest);
2181                 break;
2182         case IP_VS_SO_SET_EDITDEST:
2183                 ret = ip_vs_edit_dest(svc, &udest);
2184                 break;
2185         case IP_VS_SO_SET_DELDEST:
2186                 ret = ip_vs_del_dest(svc, &udest);
2187                 break;
2188         default:
2189                 ret = -EINVAL;
2190         }
2191
2192 out_drop_service:
2193         if (svc)
2194                 ip_vs_service_put(svc);
2195
2196   out_unlock:
2197         mutex_unlock(&__ip_vs_mutex);
2198   out_dec:
2199         /* decrease the module use count */
2200         ip_vs_use_count_dec();
2201
2202         return ret;
2203 }
2204
2205
2206 static void
2207 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
2208 {
2209         spin_lock_bh(&src->lock);
2210         memcpy(dst, &src->ustats, sizeof(*dst));
2211         spin_unlock_bh(&src->lock);
2212 }
2213
2214 static void
2215 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2216 {
2217         dst->protocol = src->protocol;
2218         dst->addr = src->addr.ip;
2219         dst->port = src->port;
2220         dst->fwmark = src->fwmark;
2221         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2222         dst->flags = src->flags;
2223         dst->timeout = src->timeout / HZ;
2224         dst->netmask = src->netmask;
2225         dst->num_dests = src->num_dests;
2226         ip_vs_copy_stats(&dst->stats, &src->stats);
2227 }
2228
2229 static inline int
2230 __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
2231                             struct ip_vs_get_services __user *uptr)
2232 {
2233         int idx, count=0;
2234         struct ip_vs_service *svc;
2235         struct ip_vs_service_entry entry;
2236         int ret = 0;
2237
2238         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2239                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2240                         /* Only expose IPv4 entries to old interface */
2241                         if (svc->af != AF_INET)
2242                                 continue;
2243
2244                         if (count >= get->num_services)
2245                                 goto out;
2246                         memset(&entry, 0, sizeof(entry));
2247                         ip_vs_copy_service(&entry, svc);
2248                         if (copy_to_user(&uptr->entrytable[count],
2249                                          &entry, sizeof(entry))) {
2250                                 ret = -EFAULT;
2251                                 goto out;
2252                         }
2253                         count++;
2254                 }
2255         }
2256
2257         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2258                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2259                         /* Only expose IPv4 entries to old interface */
2260                         if (svc->af != AF_INET)
2261                                 continue;
2262
2263                         if (count >= get->num_services)
2264                                 goto out;
2265                         memset(&entry, 0, sizeof(entry));
2266                         ip_vs_copy_service(&entry, svc);
2267                         if (copy_to_user(&uptr->entrytable[count],
2268                                          &entry, sizeof(entry))) {
2269                                 ret = -EFAULT;
2270                                 goto out;
2271                         }
2272                         count++;
2273                 }
2274         }
2275   out:
2276         return ret;
2277 }
2278
2279 static inline int
2280 __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
2281                          struct ip_vs_get_dests __user *uptr)
2282 {
2283         struct ip_vs_service *svc;
2284         union nf_inet_addr addr = { .ip = get->addr };
2285         int ret = 0;
2286
2287         if (get->fwmark)
2288                 svc = __ip_vs_svc_fwm_get(AF_INET, get->fwmark);
2289         else
2290                 svc = __ip_vs_service_get(AF_INET, get->protocol, &addr,
2291                                           get->port);
2292
2293         if (svc) {
2294                 int count = 0;
2295                 struct ip_vs_dest *dest;
2296                 struct ip_vs_dest_entry entry;
2297
2298                 list_for_each_entry(dest, &svc->destinations, n_list) {
2299                         if (count >= get->num_dests)
2300                                 break;
2301
2302                         entry.addr = dest->addr.ip;
2303                         entry.port = dest->port;
2304                         entry.conn_flags = atomic_read(&dest->conn_flags);
2305                         entry.weight = atomic_read(&dest->weight);
2306                         entry.u_threshold = dest->u_threshold;
2307                         entry.l_threshold = dest->l_threshold;
2308                         entry.activeconns = atomic_read(&dest->activeconns);
2309                         entry.inactconns = atomic_read(&dest->inactconns);
2310                         entry.persistconns = atomic_read(&dest->persistconns);
2311                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2312                         if (copy_to_user(&uptr->entrytable[count],
2313                                          &entry, sizeof(entry))) {
2314                                 ret = -EFAULT;
2315                                 break;
2316                         }
2317                         count++;
2318                 }
2319                 ip_vs_service_put(svc);
2320         } else
2321                 ret = -ESRCH;
2322         return ret;
2323 }
2324
2325 static inline void
2326 __ip_vs_get_timeouts(struct ip_vs_timeout_user *u)
2327 {
2328 #ifdef CONFIG_IP_VS_PROTO_TCP
2329         u->tcp_timeout =
2330                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2331         u->tcp_fin_timeout =
2332                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2333 #endif
2334 #ifdef CONFIG_IP_VS_PROTO_UDP
2335         u->udp_timeout =
2336                 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2337 #endif
2338 }
2339
2340
2341 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2342 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2343 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2344 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2345 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2346 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2347 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2348
2349 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2350         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2351         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2352         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2353         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2354         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2355         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2356         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2357 };
2358
2359 static int
2360 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2361 {
2362         unsigned char arg[128];
2363         int ret = 0;
2364         unsigned int copylen;
2365
2366         if (!capable(CAP_NET_ADMIN))
2367                 return -EPERM;
2368
2369         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2370                 return -EINVAL;
2371
2372         if (*len < get_arglen[GET_CMDID(cmd)]) {
2373                 pr_err("get_ctl: len %u < %u\n",
2374                        *len, get_arglen[GET_CMDID(cmd)]);
2375                 return -EINVAL;
2376         }
2377
2378         copylen = get_arglen[GET_CMDID(cmd)];
2379         if (copylen > 128)
2380                 return -EINVAL;
2381
2382         if (copy_from_user(arg, user, copylen) != 0)
2383                 return -EFAULT;
2384
2385         if (mutex_lock_interruptible(&__ip_vs_mutex))
2386                 return -ERESTARTSYS;
2387
2388         switch (cmd) {
2389         case IP_VS_SO_GET_VERSION:
2390         {
2391                 char buf[64];
2392
2393                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2394                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2395                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2396                         ret = -EFAULT;
2397                         goto out;
2398                 }
2399                 *len = strlen(buf)+1;
2400         }
2401         break;
2402
2403         case IP_VS_SO_GET_INFO:
2404         {
2405                 struct ip_vs_getinfo info;
2406                 info.version = IP_VS_VERSION_CODE;
2407                 info.size = ip_vs_conn_tab_size;
2408                 info.num_services = ip_vs_num_services;
2409                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2410                         ret = -EFAULT;
2411         }
2412         break;
2413
2414         case IP_VS_SO_GET_SERVICES:
2415         {
2416                 struct ip_vs_get_services *get;
2417                 int size;
2418
2419                 get = (struct ip_vs_get_services *)arg;
2420                 size = sizeof(*get) +
2421                         sizeof(struct ip_vs_service_entry) * get->num_services;
2422                 if (*len != size) {
2423                         pr_err("length: %u != %u\n", *len, size);
2424                         ret = -EINVAL;
2425                         goto out;
2426                 }
2427                 ret = __ip_vs_get_service_entries(get, user);
2428         }
2429         break;
2430
2431         case IP_VS_SO_GET_SERVICE:
2432         {
2433                 struct ip_vs_service_entry *entry;
2434                 struct ip_vs_service *svc;
2435                 union nf_inet_addr addr;
2436
2437                 entry = (struct ip_vs_service_entry *)arg;
2438                 addr.ip = entry->addr;
2439                 if (entry->fwmark)
2440                         svc = __ip_vs_svc_fwm_get(AF_INET, entry->fwmark);
2441                 else
2442                         svc = __ip_vs_service_get(AF_INET, entry->protocol,
2443                                                   &addr, entry->port);
2444                 if (svc) {
2445                         ip_vs_copy_service(entry, svc);
2446                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2447                                 ret = -EFAULT;
2448                         ip_vs_service_put(svc);
2449                 } else
2450                         ret = -ESRCH;
2451         }
2452         break;
2453
2454         case IP_VS_SO_GET_DESTS:
2455         {
2456                 struct ip_vs_get_dests *get;
2457                 int size;
2458
2459                 get = (struct ip_vs_get_dests *)arg;
2460                 size = sizeof(*get) +
2461                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2462                 if (*len != size) {
2463                         pr_err("length: %u != %u\n", *len, size);
2464                         ret = -EINVAL;
2465                         goto out;
2466                 }
2467                 ret = __ip_vs_get_dest_entries(get, user);
2468         }
2469         break;
2470
2471         case IP_VS_SO_GET_TIMEOUT:
2472         {
2473                 struct ip_vs_timeout_user t;
2474
2475                 __ip_vs_get_timeouts(&t);
2476                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2477                         ret = -EFAULT;
2478         }
2479         break;
2480
2481         case IP_VS_SO_GET_DAEMON:
2482         {
2483                 struct ip_vs_daemon_user d[2];
2484
2485                 memset(&d, 0, sizeof(d));
2486                 if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
2487                         d[0].state = IP_VS_STATE_MASTER;
2488                         strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
2489                         d[0].syncid = ip_vs_master_syncid;
2490                 }
2491                 if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
2492                         d[1].state = IP_VS_STATE_BACKUP;
2493                         strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
2494                         d[1].syncid = ip_vs_backup_syncid;
2495                 }
2496                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2497                         ret = -EFAULT;
2498         }
2499         break;
2500
2501         default:
2502                 ret = -EINVAL;
2503         }
2504
2505   out:
2506         mutex_unlock(&__ip_vs_mutex);
2507         return ret;
2508 }
2509
2510
2511 static struct nf_sockopt_ops ip_vs_sockopts = {
2512         .pf             = PF_INET,
2513         .set_optmin     = IP_VS_BASE_CTL,
2514         .set_optmax     = IP_VS_SO_SET_MAX+1,
2515         .set            = do_ip_vs_set_ctl,
2516         .get_optmin     = IP_VS_BASE_CTL,
2517         .get_optmax     = IP_VS_SO_GET_MAX+1,
2518         .get            = do_ip_vs_get_ctl,
2519         .owner          = THIS_MODULE,
2520 };
2521
2522 /*
2523  * Generic Netlink interface
2524  */
2525
2526 /* IPVS genetlink family */
2527 static struct genl_family ip_vs_genl_family = {
2528         .id             = GENL_ID_GENERATE,
2529         .hdrsize        = 0,
2530         .name           = IPVS_GENL_NAME,
2531         .version        = IPVS_GENL_VERSION,
2532         .maxattr        = IPVS_CMD_MAX,
2533 };
2534
2535 /* Policy used for first-level command attributes */
2536 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2537         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2538         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2539         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2540         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2541         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2542         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2543 };
2544
2545 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2546 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2547         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2548         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2549                                             .len = IP_VS_IFNAME_MAXLEN },
2550         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2551 };
2552
2553 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2554 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2555         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2556         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2557         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2558                                             .len = sizeof(union nf_inet_addr) },
2559         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2560         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2561         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2562                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2563         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2564                                             .len = sizeof(struct ip_vs_flags) },
2565         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2566         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2567         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2568 };
2569
2570 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2571 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2572         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2573                                             .len = sizeof(union nf_inet_addr) },
2574         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2575         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2576         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2577         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2578         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2579         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2580         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2581         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2582         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2583 };
2584
2585 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2586                                  struct ip_vs_stats *stats)
2587 {
2588         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2589         if (!nl_stats)
2590                 return -EMSGSIZE;
2591
2592         spin_lock_bh(&stats->lock);
2593
2594         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, stats->ustats.conns);
2595         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, stats->ustats.inpkts);
2596         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, stats->ustats.outpkts);
2597         NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, stats->ustats.inbytes);
2598         NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, stats->ustats.outbytes);
2599         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, stats->ustats.cps);
2600         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, stats->ustats.inpps);
2601         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, stats->ustats.outpps);
2602         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, stats->ustats.inbps);
2603         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, stats->ustats.outbps);
2604
2605         spin_unlock_bh(&stats->lock);
2606
2607         nla_nest_end(skb, nl_stats);
2608
2609         return 0;
2610
2611 nla_put_failure:
2612         spin_unlock_bh(&stats->lock);
2613         nla_nest_cancel(skb, nl_stats);
2614         return -EMSGSIZE;
2615 }
2616
2617 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2618                                    struct ip_vs_service *svc)
2619 {
2620         struct nlattr *nl_service;
2621         struct ip_vs_flags flags = { .flags = svc->flags,
2622                                      .mask = ~0 };
2623
2624         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2625         if (!nl_service)
2626                 return -EMSGSIZE;
2627
2628         NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
2629
2630         if (svc->fwmark) {
2631                 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2632         } else {
2633                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2634                 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2635                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2636         }
2637
2638         NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
2639         NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2640         NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2641         NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2642
2643         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2644                 goto nla_put_failure;
2645
2646         nla_nest_end(skb, nl_service);
2647
2648         return 0;
2649
2650 nla_put_failure:
2651         nla_nest_cancel(skb, nl_service);
2652         return -EMSGSIZE;
2653 }
2654
2655 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2656                                    struct ip_vs_service *svc,
2657                                    struct netlink_callback *cb)
2658 {
2659         void *hdr;
2660
2661         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2662                           &ip_vs_genl_family, NLM_F_MULTI,
2663                           IPVS_CMD_NEW_SERVICE);
2664         if (!hdr)
2665                 return -EMSGSIZE;
2666
2667         if (ip_vs_genl_fill_service(skb, svc) < 0)
2668                 goto nla_put_failure;
2669
2670         return genlmsg_end(skb, hdr);
2671
2672 nla_put_failure:
2673         genlmsg_cancel(skb, hdr);
2674         return -EMSGSIZE;
2675 }
2676
2677 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2678                                     struct netlink_callback *cb)
2679 {
2680         int idx = 0, i;
2681         int start = cb->args[0];
2682         struct ip_vs_service *svc;
2683
2684         mutex_lock(&__ip_vs_mutex);
2685         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2686                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2687                         if (++idx <= start)
2688                                 continue;
2689                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2690                                 idx--;
2691                                 goto nla_put_failure;
2692                         }
2693                 }
2694         }
2695
2696         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2697                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2698                         if (++idx <= start)
2699                                 continue;
2700                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2701                                 idx--;
2702                                 goto nla_put_failure;
2703                         }
2704                 }
2705         }
2706
2707 nla_put_failure:
2708         mutex_unlock(&__ip_vs_mutex);
2709         cb->args[0] = idx;
2710
2711         return skb->len;
2712 }
2713
2714 static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
2715                                     struct nlattr *nla, int full_entry)
2716 {
2717         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2718         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2719
2720         /* Parse mandatory identifying service fields first */
2721         if (nla == NULL ||
2722             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2723                 return -EINVAL;
2724
2725         nla_af          = attrs[IPVS_SVC_ATTR_AF];
2726         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
2727         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
2728         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
2729         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
2730
2731         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2732                 return -EINVAL;
2733
2734         memset(usvc, 0, sizeof(*usvc));
2735
2736         usvc->af = nla_get_u16(nla_af);
2737 #ifdef CONFIG_IP_VS_IPV6
2738         if (usvc->af != AF_INET && usvc->af != AF_INET6)
2739 #else
2740         if (usvc->af != AF_INET)
2741 #endif
2742                 return -EAFNOSUPPORT;
2743
2744         if (nla_fwmark) {
2745                 usvc->protocol = IPPROTO_TCP;
2746                 usvc->fwmark = nla_get_u32(nla_fwmark);
2747         } else {
2748                 usvc->protocol = nla_get_u16(nla_protocol);
2749                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2750                 usvc->port = nla_get_u16(nla_port);
2751                 usvc->fwmark = 0;
2752         }
2753
2754         /* If a full entry was requested, check for the additional fields */
2755         if (full_entry) {
2756                 struct nlattr *nla_sched, *nla_flags, *nla_timeout,
2757                               *nla_netmask;
2758                 struct ip_vs_flags flags;
2759                 struct ip_vs_service *svc;
2760
2761                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
2762                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2763                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2764                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2765
2766                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
2767                         return -EINVAL;
2768
2769                 nla_memcpy(&flags, nla_flags, sizeof(flags));
2770
2771                 /* prefill flags from service if it already exists */
2772                 if (usvc->fwmark)
2773                         svc = __ip_vs_svc_fwm_get(usvc->af, usvc->fwmark);
2774                 else
2775                         svc = __ip_vs_service_get(usvc->af, usvc->protocol,
2776                                                   &usvc->addr, usvc->port);
2777                 if (svc) {
2778                         usvc->flags = svc->flags;
2779                         ip_vs_service_put(svc);
2780                 } else
2781                         usvc->flags = 0;
2782
2783                 /* set new flags from userland */
2784                 usvc->flags = (usvc->flags & ~flags.mask) |
2785                               (flags.flags & flags.mask);
2786                 usvc->sched_name = nla_data(nla_sched);
2787                 usvc->timeout = nla_get_u32(nla_timeout);
2788                 usvc->netmask = nla_get_u32(nla_netmask);
2789         }
2790
2791         return 0;
2792 }
2793
2794 static struct ip_vs_service *ip_vs_genl_find_service(struct nlattr *nla)
2795 {
2796         struct ip_vs_service_user_kern usvc;
2797         int ret;
2798
2799         ret = ip_vs_genl_parse_service(&usvc, nla, 0);
2800         if (ret)
2801                 return ERR_PTR(ret);
2802
2803         if (usvc.fwmark)
2804                 return __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
2805         else
2806                 return __ip_vs_service_get(usvc.af, usvc.protocol,
2807                                            &usvc.addr, usvc.port);
2808 }
2809
2810 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
2811 {
2812         struct nlattr *nl_dest;
2813
2814         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
2815         if (!nl_dest)
2816                 return -EMSGSIZE;
2817
2818         NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
2819         NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
2820
2821         NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
2822                     atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
2823         NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
2824         NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
2825         NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
2826         NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
2827                     atomic_read(&dest->activeconns));
2828         NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
2829                     atomic_read(&dest->inactconns));
2830         NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
2831                     atomic_read(&dest->persistconns));
2832
2833         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
2834                 goto nla_put_failure;
2835
2836         nla_nest_end(skb, nl_dest);
2837
2838         return 0;
2839
2840 nla_put_failure:
2841         nla_nest_cancel(skb, nl_dest);
2842         return -EMSGSIZE;
2843 }
2844
2845 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
2846                                 struct netlink_callback *cb)
2847 {
2848         void *hdr;
2849
2850         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2851                           &ip_vs_genl_family, NLM_F_MULTI,
2852                           IPVS_CMD_NEW_DEST);
2853         if (!hdr)
2854                 return -EMSGSIZE;
2855
2856         if (ip_vs_genl_fill_dest(skb, dest) < 0)
2857                 goto nla_put_failure;
2858
2859         return genlmsg_end(skb, hdr);
2860
2861 nla_put_failure:
2862         genlmsg_cancel(skb, hdr);
2863         return -EMSGSIZE;
2864 }
2865
2866 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
2867                                  struct netlink_callback *cb)
2868 {
2869         int idx = 0;
2870         int start = cb->args[0];
2871         struct ip_vs_service *svc;
2872         struct ip_vs_dest *dest;
2873         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
2874
2875         mutex_lock(&__ip_vs_mutex);
2876
2877         /* Try to find the service for which to dump destinations */
2878         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
2879                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
2880                 goto out_err;
2881
2882         svc = ip_vs_genl_find_service(attrs[IPVS_CMD_ATTR_SERVICE]);
2883         if (IS_ERR(svc) || svc == NULL)
2884                 goto out_err;
2885
2886         /* Dump the destinations */
2887         list_for_each_entry(dest, &svc->destinations, n_list) {
2888                 if (++idx <= start)
2889                         continue;
2890                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
2891                         idx--;
2892                         goto nla_put_failure;
2893                 }
2894         }
2895
2896 nla_put_failure:
2897         cb->args[0] = idx;
2898         ip_vs_service_put(svc);
2899
2900 out_err:
2901         mutex_unlock(&__ip_vs_mutex);
2902
2903         return skb->len;
2904 }
2905
2906 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
2907                                  struct nlattr *nla, int full_entry)
2908 {
2909         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
2910         struct nlattr *nla_addr, *nla_port;
2911
2912         /* Parse mandatory identifying destination fields first */
2913         if (nla == NULL ||
2914             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
2915                 return -EINVAL;
2916
2917         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
2918         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
2919
2920         if (!(nla_addr && nla_port))
2921                 return -EINVAL;
2922
2923         memset(udest, 0, sizeof(*udest));
2924
2925         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
2926         udest->port = nla_get_u16(nla_port);
2927
2928         /* If a full entry was requested, check for the additional fields */
2929         if (full_entry) {
2930                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
2931                               *nla_l_thresh;
2932
2933                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
2934                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
2935                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
2936                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
2937
2938                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
2939                         return -EINVAL;
2940
2941                 udest->conn_flags = nla_get_u32(nla_fwd)
2942                                     & IP_VS_CONN_F_FWD_MASK;
2943                 udest->weight = nla_get_u32(nla_weight);
2944                 udest->u_threshold = nla_get_u32(nla_u_thresh);
2945                 udest->l_threshold = nla_get_u32(nla_l_thresh);
2946         }
2947
2948         return 0;
2949 }
2950
2951 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
2952                                   const char *mcast_ifn, __be32 syncid)
2953 {
2954         struct nlattr *nl_daemon;
2955
2956         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
2957         if (!nl_daemon)
2958                 return -EMSGSIZE;
2959
2960         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
2961         NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
2962         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
2963
2964         nla_nest_end(skb, nl_daemon);
2965
2966         return 0;
2967
2968 nla_put_failure:
2969         nla_nest_cancel(skb, nl_daemon);
2970         return -EMSGSIZE;
2971 }
2972
2973 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
2974                                   const char *mcast_ifn, __be32 syncid,
2975                                   struct netlink_callback *cb)
2976 {
2977         void *hdr;
2978         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2979                           &ip_vs_genl_family, NLM_F_MULTI,
2980                           IPVS_CMD_NEW_DAEMON);
2981         if (!hdr)
2982                 return -EMSGSIZE;
2983
2984         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
2985                 goto nla_put_failure;
2986
2987         return genlmsg_end(skb, hdr);
2988
2989 nla_put_failure:
2990         genlmsg_cancel(skb, hdr);
2991         return -EMSGSIZE;
2992 }
2993
2994 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
2995                                    struct netlink_callback *cb)
2996 {
2997         mutex_lock(&__ip_vs_mutex);
2998         if ((ip_vs_sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
2999                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3000                                            ip_vs_master_mcast_ifn,
3001                                            ip_vs_master_syncid, cb) < 0)
3002                         goto nla_put_failure;
3003
3004                 cb->args[0] = 1;
3005         }
3006
3007         if ((ip_vs_sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3008                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3009                                            ip_vs_backup_mcast_ifn,
3010                                            ip_vs_backup_syncid, cb) < 0)
3011                         goto nla_put_failure;
3012
3013                 cb->args[1] = 1;
3014         }
3015
3016 nla_put_failure:
3017         mutex_unlock(&__ip_vs_mutex);
3018
3019         return skb->len;
3020 }
3021
3022 static int ip_vs_genl_new_daemon(struct nlattr **attrs)
3023 {
3024         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3025               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3026               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3027                 return -EINVAL;
3028
3029         return start_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3030                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3031                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3032 }
3033
3034 static int ip_vs_genl_del_daemon(struct nlattr **attrs)
3035 {
3036         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3037                 return -EINVAL;
3038
3039         return stop_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3040 }
3041
3042 static int ip_vs_genl_set_config(struct nlattr **attrs)
3043 {
3044         struct ip_vs_timeout_user t;
3045
3046         __ip_vs_get_timeouts(&t);
3047
3048         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3049                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3050
3051         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3052                 t.tcp_fin_timeout =
3053                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3054
3055         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3056                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3057
3058         return ip_vs_set_timeout(&t);
3059 }
3060
3061 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3062 {
3063         struct ip_vs_service *svc = NULL;
3064         struct ip_vs_service_user_kern usvc;
3065         struct ip_vs_dest_user_kern udest;
3066         int ret = 0, cmd;
3067         int need_full_svc = 0, need_full_dest = 0;
3068
3069         cmd = info->genlhdr->cmd;
3070
3071         mutex_lock(&__ip_vs_mutex);
3072
3073         if (cmd == IPVS_CMD_FLUSH) {
3074                 ret = ip_vs_flush();
3075                 goto out;
3076         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3077                 ret = ip_vs_genl_set_config(info->attrs);
3078                 goto out;
3079         } else if (cmd == IPVS_CMD_NEW_DAEMON ||
3080                    cmd == IPVS_CMD_DEL_DAEMON) {
3081
3082                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3083
3084                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3085                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3086                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3087                                      ip_vs_daemon_policy)) {
3088                         ret = -EINVAL;
3089                         goto out;
3090                 }
3091
3092                 if (cmd == IPVS_CMD_NEW_DAEMON)
3093                         ret = ip_vs_genl_new_daemon(daemon_attrs);
3094                 else
3095                         ret = ip_vs_genl_del_daemon(daemon_attrs);
3096                 goto out;
3097         } else if (cmd == IPVS_CMD_ZERO &&
3098                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3099                 ret = ip_vs_zero_all();
3100                 goto out;
3101         }
3102
3103         /* All following commands require a service argument, so check if we
3104          * received a valid one. We need a full service specification when
3105          * adding / editing a service. Only identifying members otherwise. */
3106         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3107                 need_full_svc = 1;
3108
3109         ret = ip_vs_genl_parse_service(&usvc,
3110                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3111                                        need_full_svc);
3112         if (ret)
3113                 goto out;
3114
3115         /* Lookup the exact service by <protocol, addr, port> or fwmark */
3116         if (usvc.fwmark == 0)
3117                 svc = __ip_vs_service_get(usvc.af, usvc.protocol,
3118                                           &usvc.addr, usvc.port);
3119         else
3120                 svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
3121
3122         /* Unless we're adding a new service, the service must already exist */
3123         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3124                 ret = -ESRCH;
3125                 goto out;
3126         }
3127
3128         /* Destination commands require a valid destination argument. For
3129          * adding / editing a destination, we need a full destination
3130          * specification. */
3131         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3132             cmd == IPVS_CMD_DEL_DEST) {
3133                 if (cmd != IPVS_CMD_DEL_DEST)
3134                         need_full_dest = 1;
3135
3136                 ret = ip_vs_genl_parse_dest(&udest,
3137                                             info->attrs[IPVS_CMD_ATTR_DEST],
3138                                             need_full_dest);
3139                 if (ret)
3140                         goto out;
3141         }
3142
3143         switch (cmd) {
3144         case IPVS_CMD_NEW_SERVICE:
3145                 if (svc == NULL)
3146                         ret = ip_vs_add_service(&usvc, &svc);
3147                 else
3148                         ret = -EEXIST;
3149                 break;
3150         case IPVS_CMD_SET_SERVICE:
3151                 ret = ip_vs_edit_service(svc, &usvc);
3152                 break;
3153         case IPVS_CMD_DEL_SERVICE:
3154                 ret = ip_vs_del_service(svc);
3155                 break;
3156         case IPVS_CMD_NEW_DEST:
3157                 ret = ip_vs_add_dest(svc, &udest);
3158                 break;
3159         case IPVS_CMD_SET_DEST:
3160                 ret = ip_vs_edit_dest(svc, &udest);
3161                 break;
3162         case IPVS_CMD_DEL_DEST:
3163                 ret = ip_vs_del_dest(svc, &udest);
3164                 break;
3165         case IPVS_CMD_ZERO:
3166                 ret = ip_vs_zero_service(svc);
3167                 break;
3168         default:
3169                 ret = -EINVAL;
3170         }
3171
3172 out:
3173         if (svc)
3174                 ip_vs_service_put(svc);
3175         mutex_unlock(&__ip_vs_mutex);
3176
3177         return ret;
3178 }
3179
3180 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3181 {
3182         struct sk_buff *msg;
3183         void *reply;
3184         int ret, cmd, reply_cmd;
3185
3186         cmd = info->genlhdr->cmd;
3187
3188         if (cmd == IPVS_CMD_GET_SERVICE)
3189                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3190         else if (cmd == IPVS_CMD_GET_INFO)
3191                 reply_cmd = IPVS_CMD_SET_INFO;
3192         else if (cmd == IPVS_CMD_GET_CONFIG)
3193                 reply_cmd = IPVS_CMD_SET_CONFIG;
3194         else {
3195                 pr_err("unknown Generic Netlink command\n");
3196                 return -EINVAL;
3197         }
3198
3199         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3200         if (!msg)
3201                 return -ENOMEM;
3202
3203         mutex_lock(&__ip_vs_mutex);
3204
3205         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3206         if (reply == NULL)
3207                 goto nla_put_failure;
3208
3209         switch (cmd) {
3210         case IPVS_CMD_GET_SERVICE:
3211         {
3212                 struct ip_vs_service *svc;
3213
3214                 svc = ip_vs_genl_find_service(info->attrs[IPVS_CMD_ATTR_SERVICE]);
3215                 if (IS_ERR(svc)) {
3216                         ret = PTR_ERR(svc);
3217                         goto out_err;
3218                 } else if (svc) {
3219                         ret = ip_vs_genl_fill_service(msg, svc);
3220                         ip_vs_service_put(svc);
3221                         if (ret)
3222                                 goto nla_put_failure;
3223                 } else {
3224                         ret = -ESRCH;
3225                         goto out_err;
3226                 }
3227
3228                 break;
3229         }
3230
3231         case IPVS_CMD_GET_CONFIG:
3232         {
3233                 struct ip_vs_timeout_user t;
3234
3235                 __ip_vs_get_timeouts(&t);
3236 #ifdef CONFIG_IP_VS_PROTO_TCP
3237                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3238                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3239                             t.tcp_fin_timeout);
3240 #endif
3241 #ifdef CONFIG_IP_VS_PROTO_UDP
3242                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3243 #endif
3244
3245                 break;
3246         }
3247
3248         case IPVS_CMD_GET_INFO:
3249                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3250                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3251                             ip_vs_conn_tab_size);
3252                 break;
3253         }
3254
3255         genlmsg_end(msg, reply);
3256         ret = genlmsg_reply(msg, info);
3257         goto out;
3258
3259 nla_put_failure:
3260         pr_err("not enough space in Netlink message\n");
3261         ret = -EMSGSIZE;
3262
3263 out_err:
3264         nlmsg_free(msg);
3265 out:
3266         mutex_unlock(&__ip_vs_mutex);
3267
3268         return ret;
3269 }
3270
3271
3272 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3273         {
3274                 .cmd    = IPVS_CMD_NEW_SERVICE,
3275                 .flags  = GENL_ADMIN_PERM,
3276                 .policy = ip_vs_cmd_policy,
3277                 .doit   = ip_vs_genl_set_cmd,
3278         },
3279         {
3280                 .cmd    = IPVS_CMD_SET_SERVICE,
3281                 .flags  = GENL_ADMIN_PERM,
3282                 .policy = ip_vs_cmd_policy,
3283                 .doit   = ip_vs_genl_set_cmd,
3284         },
3285         {
3286                 .cmd    = IPVS_CMD_DEL_SERVICE,
3287                 .flags  = GENL_ADMIN_PERM,
3288                 .policy = ip_vs_cmd_policy,
3289                 .doit   = ip_vs_genl_set_cmd,
3290         },
3291         {
3292                 .cmd    = IPVS_CMD_GET_SERVICE,
3293                 .flags  = GENL_ADMIN_PERM,
3294                 .doit   = ip_vs_genl_get_cmd,
3295                 .dumpit = ip_vs_genl_dump_services,
3296                 .policy = ip_vs_cmd_policy,
3297         },
3298         {
3299                 .cmd    = IPVS_CMD_NEW_DEST,
3300                 .flags  = GENL_ADMIN_PERM,
3301                 .policy = ip_vs_cmd_policy,
3302                 .doit   = ip_vs_genl_set_cmd,
3303         },
3304         {
3305                 .cmd    = IPVS_CMD_SET_DEST,
3306                 .flags  = GENL_ADMIN_PERM,
3307                 .policy = ip_vs_cmd_policy,
3308                 .doit   = ip_vs_genl_set_cmd,
3309         },
3310         {
3311                 .cmd    = IPVS_CMD_DEL_DEST,
3312                 .flags  = GENL_ADMIN_PERM,
3313                 .policy = ip_vs_cmd_policy,
3314                 .doit   = ip_vs_genl_set_cmd,
3315         },
3316         {
3317                 .cmd    = IPVS_CMD_GET_DEST,
3318                 .flags  = GENL_ADMIN_PERM,
3319                 .policy = ip_vs_cmd_policy,
3320                 .dumpit = ip_vs_genl_dump_dests,
3321         },
3322         {
3323                 .cmd    = IPVS_CMD_NEW_DAEMON,
3324                 .flags  = GENL_ADMIN_PERM,
3325                 .policy = ip_vs_cmd_policy,
3326                 .doit   = ip_vs_genl_set_cmd,
3327         },
3328         {
3329                 .cmd    = IPVS_CMD_DEL_DAEMON,
3330                 .flags  = GENL_ADMIN_PERM,
3331                 .policy = ip_vs_cmd_policy,
3332                 .doit   = ip_vs_genl_set_cmd,
3333         },
3334         {
3335                 .cmd    = IPVS_CMD_GET_DAEMON,
3336                 .flags  = GENL_ADMIN_PERM,
3337                 .dumpit = ip_vs_genl_dump_daemons,
3338         },
3339         {
3340                 .cmd    = IPVS_CMD_SET_CONFIG,
3341                 .flags  = GENL_ADMIN_PERM,
3342                 .policy = ip_vs_cmd_policy,
3343                 .doit   = ip_vs_genl_set_cmd,
3344         },
3345         {
3346                 .cmd    = IPVS_CMD_GET_CONFIG,
3347                 .flags  = GENL_ADMIN_PERM,
3348                 .doit   = ip_vs_genl_get_cmd,
3349         },
3350         {
3351                 .cmd    = IPVS_CMD_GET_INFO,
3352                 .flags  = GENL_ADMIN_PERM,
3353                 .doit   = ip_vs_genl_get_cmd,
3354         },
3355         {
3356                 .cmd    = IPVS_CMD_ZERO,
3357                 .flags  = GENL_ADMIN_PERM,
3358                 .policy = ip_vs_cmd_policy,
3359                 .doit   = ip_vs_genl_set_cmd,
3360         },
3361         {
3362                 .cmd    = IPVS_CMD_FLUSH,
3363                 .flags  = GENL_ADMIN_PERM,
3364                 .doit   = ip_vs_genl_set_cmd,
3365         },
3366 };
3367
3368 static int __init ip_vs_genl_register(void)
3369 {
3370         return genl_register_family_with_ops(&ip_vs_genl_family,
3371                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3372 }
3373
3374 static void ip_vs_genl_unregister(void)
3375 {
3376         genl_unregister_family(&ip_vs_genl_family);
3377 }
3378
3379 /* End of Generic Netlink interface definitions */
3380
3381
3382 int __init ip_vs_control_init(void)
3383 {
3384         int ret;
3385         int idx;
3386
3387         EnterFunction(2);
3388
3389         ret = nf_register_sockopt(&ip_vs_sockopts);
3390         if (ret) {
3391                 pr_err("cannot register sockopt.\n");
3392                 return ret;
3393         }
3394
3395         ret = ip_vs_genl_register();
3396         if (ret) {
3397                 pr_err("cannot register Generic Netlink interface.\n");
3398                 nf_unregister_sockopt(&ip_vs_sockopts);
3399                 return ret;
3400         }
3401
3402         proc_net_fops_create(&init_net, "ip_vs", 0, &ip_vs_info_fops);
3403         proc_net_fops_create(&init_net, "ip_vs_stats",0, &ip_vs_stats_fops);
3404
3405         sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars);
3406
3407         /* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */
3408         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
3409                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3410                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3411         }
3412         for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++)  {
3413                 INIT_LIST_HEAD(&ip_vs_rtable[idx]);
3414         }
3415
3416         ip_vs_new_estimator(&ip_vs_stats);
3417
3418         /* Hook the defense timer */
3419         schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
3420
3421         LeaveFunction(2);
3422         return 0;
3423 }
3424
3425
3426 void ip_vs_control_cleanup(void)
3427 {
3428         EnterFunction(2);
3429         ip_vs_trash_cleanup();
3430         cancel_rearming_delayed_work(&defense_work);
3431         cancel_work_sync(&defense_work.work);
3432         ip_vs_kill_estimator(&ip_vs_stats);
3433         unregister_sysctl_table(sysctl_header);
3434         proc_net_remove(&init_net, "ip_vs_stats");
3435         proc_net_remove(&init_net, "ip_vs");
3436         ip_vs_genl_unregister();
3437         nf_unregister_sockopt(&ip_vs_sockopts);
3438         LeaveFunction(2);
3439 }