]> bbs.cooldavid.org Git - net-next-2.6.git/blame - net/netfilter/ipvs/ip_vs_ctl.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
net: more Kconfig whitespace cleanup
[net-next-2.6.git] / net / netfilter / ipvs / ip_vs_ctl.c
CommitLineData
1da177e4
LT		 1/*
2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the NetFilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
6 * cluster of servers.
7 *
1da177e4
LT		 8 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
9 * Peter Kese <peter.kese@ijs.si>
10 * Julian Anastasov <ja@ssi.bg>
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 *
17 * Changes:
18 *
19 */
20
9aada7ac
HE		 21#define KMSG_COMPONENT "IPVS"
22#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
23
1da177e4
LT		 24#include <linux/module.h>
25#include <linux/init.h>
26#include <linux/types.h>
4fc268d2 27#include <linux/capability.h>
1da177e4
LT		 28#include <linux/fs.h>
29#include <linux/sysctl.h>
30#include <linux/proc_fs.h>
31#include <linux/workqueue.h>
32#include <linux/swap.h>
1da177e4 33#include <linux/seq_file.h>
5a0e3ad6 34#include <linux/slab.h>
1da177e4
LT		 35
36#include <linux/netfilter.h>
37#include <linux/netfilter_ipv4.h>
14cc3e2b 38#include <linux/mutex.h>
1da177e4 39
457c4cbc 40#include <net/net_namespace.h>
1da177e4 41#include <net/ip.h>
09571c7a
VB		 42#ifdef CONFIG_IP_VS_IPV6
43#include <net/ipv6.h>
44#include <net/ip6_route.h>
45#endif
14c85021 46#include <net/route.h>
1da177e4 47#include <net/sock.h>
9a812198 48#include <net/genetlink.h>
1da177e4
LT		 49
50#include <asm/uaccess.h>
51
52#include <net/ip_vs.h>
53
54/* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
14cc3e2b 55static DEFINE_MUTEX(__ip_vs_mutex);
1da177e4
LT		 56
57/* lock for service table */
58static DEFINE_RWLOCK(__ip_vs_svc_lock);
59
60/* lock for table with the real services */
61static DEFINE_RWLOCK(__ip_vs_rs_lock);
62
63/* lock for state and timeout tables */
4f72816e 64static DEFINE_SPINLOCK(ip_vs_securetcp_lock);
1da177e4
LT		 65
66/* lock for drop entry handling */
67static DEFINE_SPINLOCK(__ip_vs_dropentry_lock);
68
69/* lock for drop packet handling */
70static DEFINE_SPINLOCK(__ip_vs_droppacket_lock);
71
72/* 1/rate drop and drop-entry variables */
73int ip_vs_drop_rate = 0;
74int ip_vs_drop_counter = 0;
75static atomic_t ip_vs_dropentry = ATOMIC_INIT(0);
76
77/* number of virtual services */
78static int ip_vs_num_services = 0;
79
80/* sysctl variables */
81static int sysctl_ip_vs_drop_entry = 0;
82static int sysctl_ip_vs_drop_packet = 0;
83static int sysctl_ip_vs_secure_tcp = 0;
84static int sysctl_ip_vs_amemthresh = 1024;
85static int sysctl_ip_vs_am_droprate = 10;
86int sysctl_ip_vs_cache_bypass = 0;
87int sysctl_ip_vs_expire_nodest_conn = 0;
88int sysctl_ip_vs_expire_quiescent_template = 0;
89int sysctl_ip_vs_sync_threshold[2] = { 3, 50 };
90int sysctl_ip_vs_nat_icmp_send = 0;
f4bc17cd
JA		 91#ifdef CONFIG_IP_VS_NFCT
92int sysctl_ip_vs_conntrack;
93#endif
8a803040 94int sysctl_ip_vs_snat_reroute = 1;
1da177e4
LT		 95
96
97#ifdef CONFIG_IP_VS_DEBUG
98static int sysctl_ip_vs_debug_level = 0;
99
100int ip_vs_get_debug_level(void)
101{
102 return sysctl_ip_vs_debug_level;
103}
104#endif
105
09571c7a
VB		 106#ifdef CONFIG_IP_VS_IPV6
107/* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
108static int __ip_vs_addr_is_local_v6(const struct in6_addr *addr)
109{
110 struct rt6_info *rt;
111 struct flowi fl = {
112 .oif = 0,
113 .nl_u = {
114 .ip6_u = {
115 .daddr = *addr,
116 .saddr = { .s6_addr32 = {0, 0, 0, 0} }, } },
117 };
118
119 rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
120 if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
121 return 1;
122
123 return 0;
124}
125#endif
1da177e4 126/*
af9debd4
JA		 127 * update_defense_level is called from keventd and from sysctl,
128 * so it needs to protect itself from softirqs
1da177e4
LT		 129 */
130static void update_defense_level(void)
131{
132 struct sysinfo i;
133 static int old_secure_tcp = 0;
134 int availmem;
135 int nomem;
136 int to_change = -1;
137
138 /* we only count free and buffered memory (in pages) */
139 si_meminfo(&i);
140 availmem = i.freeram + i.bufferram;
141 /* however in linux 2.5 the i.bufferram is total page cache size,
142 we need adjust it */
143 /* si_swapinfo(&i); */
144 /* availmem = availmem - (i.totalswap - i.freeswap); */
145
146 nomem = (availmem < sysctl_ip_vs_amemthresh);
147
af9debd4
JA		 148 local_bh_disable();
149
1da177e4
LT		 150 /* drop_entry */
151 spin_lock(&__ip_vs_dropentry_lock);
152 switch (sysctl_ip_vs_drop_entry) {
153 case 0:
154 atomic_set(&ip_vs_dropentry, 0);
155 break;
156 case 1:
157 if (nomem) {
158 atomic_set(&ip_vs_dropentry, 1);
159 sysctl_ip_vs_drop_entry = 2;
160 } else {
161 atomic_set(&ip_vs_dropentry, 0);
162 }
163 break;
164 case 2:
165 if (nomem) {
166 atomic_set(&ip_vs_dropentry, 1);
167 } else {
168 atomic_set(&ip_vs_dropentry, 0);
169 sysctl_ip_vs_drop_entry = 1;
170 };
171 break;
172 case 3:
173 atomic_set(&ip_vs_dropentry, 1);
174 break;
175 }
176 spin_unlock(&__ip_vs_dropentry_lock);
177
178 /* drop_packet */
179 spin_lock(&__ip_vs_droppacket_lock);
180 switch (sysctl_ip_vs_drop_packet) {
181 case 0:
182 ip_vs_drop_rate = 0;
183 break;
184 case 1:
185 if (nomem) {
186 ip_vs_drop_rate = ip_vs_drop_counter
187 = sysctl_ip_vs_amemthresh /
188 (sysctl_ip_vs_amemthresh-availmem);
189 sysctl_ip_vs_drop_packet = 2;
190 } else {
191 ip_vs_drop_rate = 0;
192 }
193 break;
194 case 2:
195 if (nomem) {
196 ip_vs_drop_rate = ip_vs_drop_counter
197 = sysctl_ip_vs_amemthresh /
198 (sysctl_ip_vs_amemthresh-availmem);
199 } else {
200 ip_vs_drop_rate = 0;
201 sysctl_ip_vs_drop_packet = 1;
202 }
203 break;
204 case 3:
205 ip_vs_drop_rate = sysctl_ip_vs_am_droprate;
206 break;
207 }
208 spin_unlock(&__ip_vs_droppacket_lock);
209
210 /* secure_tcp */
4f72816e 211 spin_lock(&ip_vs_securetcp_lock);
1da177e4
LT		 212 switch (sysctl_ip_vs_secure_tcp) {
213 case 0:
214 if (old_secure_tcp >= 2)
215 to_change = 0;
216 break;
217 case 1:
218 if (nomem) {
219 if (old_secure_tcp < 2)
220 to_change = 1;
221 sysctl_ip_vs_secure_tcp = 2;
222 } else {
223 if (old_secure_tcp >= 2)
224 to_change = 0;
225 }
226 break;
227 case 2:
228 if (nomem) {
229 if (old_secure_tcp < 2)
230 to_change = 1;
231 } else {
232 if (old_secure_tcp >= 2)
233 to_change = 0;
234 sysctl_ip_vs_secure_tcp = 1;
235 }
236 break;
237 case 3:
238 if (old_secure_tcp < 2)
239 to_change = 1;
240 break;
241 }
242 old_secure_tcp = sysctl_ip_vs_secure_tcp;
243 if (to_change >= 0)
244 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
4f72816e 245 spin_unlock(&ip_vs_securetcp_lock);
af9debd4
JA		 246
247 local_bh_enable();
1da177e4
LT		 248}
249
250
251/*
252 * Timer for checking the defense
253 */
254#define DEFENSE_TIMER_PERIOD 1*HZ
c4028958
DH		 255static void defense_work_handler(struct work_struct *work);
256static DECLARE_DELAYED_WORK(defense_work, defense_work_handler);
1da177e4 257
c4028958 258static void defense_work_handler(struct work_struct *work)
1da177e4
LT		 259{
260 update_defense_level();
261 if (atomic_read(&ip_vs_dropentry))
262 ip_vs_random_dropentry();
263
264 schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
265}
266
267int
268ip_vs_use_count_inc(void)
269{
270 return try_module_get(THIS_MODULE);
271}
272
273void
274ip_vs_use_count_dec(void)
275{
276 module_put(THIS_MODULE);
277}
278
279
280/*
281 * Hash table: for virtual service lookups
282 */
283#define IP_VS_SVC_TAB_BITS 8
284#define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
285#define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
286
287/* the service table hashed by <protocol, addr, port> */
288static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
289/* the service table hashed by fwmark */
290static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
291
292/*
293 * Hash table: for real service lookups
294 */
295#define IP_VS_RTAB_BITS 4
296#define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
297#define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
298
299static struct list_head ip_vs_rtable[IP_VS_RTAB_SIZE];
300
301/*
302 * Trash for destinations
303 */
304static LIST_HEAD(ip_vs_dest_trash);
305
306/*
307 * FTP & NULL virtual service counters
308 */
309static atomic_t ip_vs_ftpsvc_counter = ATOMIC_INIT(0);
310static atomic_t ip_vs_nullsvc_counter = ATOMIC_INIT(0);
311
312
313/*
314 * Returns hash value for virtual service
315 */
316static __inline__ unsigned
b18610de
JV		 317ip_vs_svc_hashkey(int af, unsigned proto, const union nf_inet_addr *addr,
318 __be16 port)
1da177e4
LT		 319{
320 register unsigned porth = ntohs(port);
b18610de 321 __be32 addr_fold = addr->ip;
1da177e4 322
b18610de
JV		 323#ifdef CONFIG_IP_VS_IPV6
324 if (af == AF_INET6)
325 addr_fold = addr->ip6[0]^addr->ip6[1]^
326 addr->ip6[2]^addr->ip6[3];
327#endif
328
329 return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
1da177e4
LT		 330 & IP_VS_SVC_TAB_MASK;
331}
332
333/*
334 * Returns hash value of fwmark for virtual service lookup
335 */
336static __inline__ unsigned ip_vs_svc_fwm_hashkey(__u32 fwmark)
337{
338 return fwmark & IP_VS_SVC_TAB_MASK;
339}
340
341/*
342 * Hashes a service in the ip_vs_svc_table by <proto,addr,port>
343 * or in the ip_vs_svc_fwm_table by fwmark.
344 * Should be called with locked tables.
345 */
346static int ip_vs_svc_hash(struct ip_vs_service *svc)
347{
348 unsigned hash;
349
350 if (svc->flags & IP_VS_SVC_F_HASHED) {
1e3e238e
HE		 351 pr_err("%s(): request for already hashed, called from %pF\n",
352 __func__, __builtin_return_address(0));
1da177e4
LT		 353 return 0;
354 }
355
356 if (svc->fwmark == 0) {
357 /*
358 * Hash it by <protocol,addr,port> in ip_vs_svc_table
359 */
b18610de 360 hash = ip_vs_svc_hashkey(svc->af, svc->protocol, &svc->addr,
e7ade46a 361 svc->port);
1da177e4
LT		 362 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
363 } else {
364 /*
365 * Hash it by fwmark in ip_vs_svc_fwm_table
366 */
367 hash = ip_vs_svc_fwm_hashkey(svc->fwmark);
368 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
369 }
370
371 svc->flags |= IP_VS_SVC_F_HASHED;
372 /* increase its refcnt because it is referenced by the svc table */
373 atomic_inc(&svc->refcnt);
374 return 1;
375}
376
377
378/*
379 * Unhashes a service from ip_vs_svc_table/ip_vs_svc_fwm_table.
380 * Should be called with locked tables.
381 */
382static int ip_vs_svc_unhash(struct ip_vs_service *svc)
383{
384 if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
1e3e238e
HE		 385 pr_err("%s(): request for unhash flagged, called from %pF\n",
386 __func__, __builtin_return_address(0));
1da177e4
LT		 387 return 0;
388 }
389
390 if (svc->fwmark == 0) {
391 /* Remove it from the ip_vs_svc_table table */
392 list_del(&svc->s_list);
393 } else {
394 /* Remove it from the ip_vs_svc_fwm_table table */
395 list_del(&svc->f_list);
396 }
397
398 svc->flags &= ~IP_VS_SVC_F_HASHED;
399 atomic_dec(&svc->refcnt);
400 return 1;
401}
402
403
404/*
405 * Get service by {proto,addr,port} in the service table.
406 */
b18610de 407static inline struct ip_vs_service *
26c15cfd 408__ip_vs_service_find(int af, __u16 protocol, const union nf_inet_addr *vaddr,
b18610de 409 __be16 vport)
1da177e4
LT		 410{
411 unsigned hash;
412 struct ip_vs_service *svc;
413
414 /* Check for "full" addressed entries */
b18610de 415 hash = ip_vs_svc_hashkey(af, protocol, vaddr, vport);
1da177e4
LT		 416
417 list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
b18610de
JV		 418 if ((svc->af == af)
419 && ip_vs_addr_equal(af, &svc->addr, vaddr)
1da177e4
LT		 420 && (svc->port == vport)
421 && (svc->protocol == protocol)) {
422 /* HIT */
1da177e4
LT		 423 return svc;
424 }
425 }
426
427 return NULL;
428}
429
430
431/*
432 * Get service by {fwmark} in the service table.
433 */
b18610de 434static inline struct ip_vs_service *
26c15cfd 435__ip_vs_svc_fwm_find(int af, __u32 fwmark)
1da177e4
LT		 436{
437 unsigned hash;
438 struct ip_vs_service *svc;
439
440 /* Check for fwmark addressed entries */
441 hash = ip_vs_svc_fwm_hashkey(fwmark);
442
443 list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
b18610de 444 if (svc->fwmark == fwmark && svc->af == af) {
1da177e4 445 /* HIT */
1da177e4
LT		 446 return svc;
447 }
448 }
449
450 return NULL;
451}
452
453struct ip_vs_service *
3c2e0505
JV		 454ip_vs_service_get(int af, __u32 fwmark, __u16 protocol,
455 const union nf_inet_addr *vaddr, __be16 vport)
1da177e4
LT		 456{
457 struct ip_vs_service *svc;
3c2e0505 458
1da177e4
LT		 459 read_lock(&__ip_vs_svc_lock);
460
461 /*
462 * Check the table hashed by fwmark first
463 */
26c15cfd 464 if (fwmark && (svc = __ip_vs_svc_fwm_find(af, fwmark)))
1da177e4
LT		 465 goto out;
466
467 /*
468 * Check the table hashed by <protocol,addr,port>
469 * for "full" addressed entries
470 */
26c15cfd 471 svc = __ip_vs_service_find(af, protocol, vaddr, vport);
1da177e4
LT		 472
473 if (svc == NULL
474 && protocol == IPPROTO_TCP
475 && atomic_read(&ip_vs_ftpsvc_counter)
476 && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
477 /*
478 * Check if ftp service entry exists, the packet
479 * might belong to FTP data connections.
480 */
26c15cfd 481 svc = __ip_vs_service_find(af, protocol, vaddr, FTPPORT);
1da177e4
LT		 482 }
483
484 if (svc == NULL
485 && atomic_read(&ip_vs_nullsvc_counter)) {
486 /*
487 * Check if the catch-all port (port zero) exists
488 */
26c15cfd 489 svc = __ip_vs_service_find(af, protocol, vaddr, 0);
1da177e4
LT		 490 }
491
492 out:
26c15cfd
JA		 493 if (svc)
494 atomic_inc(&svc->usecnt);
1da177e4
LT		 495 read_unlock(&__ip_vs_svc_lock);
496
3c2e0505
JV		 497 IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
498 fwmark, ip_vs_proto_name(protocol),
499 IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
500 svc ? "hit" : "not hit");
1da177e4
LT		 501
502 return svc;
503}
504
505
506static inline void
507__ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
508{
509 atomic_inc(&svc->refcnt);
510 dest->svc = svc;
511}
512
26c15cfd 513static void
1da177e4
LT		 514__ip_vs_unbind_svc(struct ip_vs_dest *dest)
515{
516 struct ip_vs_service *svc = dest->svc;
517
518 dest->svc = NULL;
26c15cfd
JA		 519 if (atomic_dec_and_test(&svc->refcnt)) {
520 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
521 svc->fwmark,
522 IP_VS_DBG_ADDR(svc->af, &svc->addr),
523 ntohs(svc->port), atomic_read(&svc->usecnt));
1da177e4 524 kfree(svc);
26c15cfd 525 }
1da177e4
LT		 526}
527
528
529/*
530 * Returns hash value for real service
531 */
7937df15
JV		 532static inline unsigned ip_vs_rs_hashkey(int af,
533 const union nf_inet_addr *addr,
534 __be16 port)
1da177e4
LT		 535{
536 register unsigned porth = ntohs(port);
7937df15
JV		 537 __be32 addr_fold = addr->ip;
538
539#ifdef CONFIG_IP_VS_IPV6
540 if (af == AF_INET6)
541 addr_fold = addr->ip6[0]^addr->ip6[1]^
542 addr->ip6[2]^addr->ip6[3];
543#endif
1da177e4 544
7937df15 545 return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
1da177e4
LT		 546 & IP_VS_RTAB_MASK;
547}
548
549/*
550 * Hashes ip_vs_dest in ip_vs_rtable by <proto,addr,port>.
551 * should be called with locked tables.
552 */
553static int ip_vs_rs_hash(struct ip_vs_dest *dest)
554{
555 unsigned hash;
556
557 if (!list_empty(&dest->d_list)) {
558 return 0;
559 }
560
561 /*
562 * Hash by proto,addr,port,
563 * which are the parameters of the real service.
564 */
7937df15
JV		 565 hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
566
1da177e4
LT		 567 list_add(&dest->d_list, &ip_vs_rtable[hash]);
568
569 return 1;
570}
571
572/*
573 * UNhashes ip_vs_dest from ip_vs_rtable.
574 * should be called with locked tables.
575 */
576static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
577{
578 /*
579 * Remove it from the ip_vs_rtable table.
580 */
581 if (!list_empty(&dest->d_list)) {
582 list_del(&dest->d_list);
583 INIT_LIST_HEAD(&dest->d_list);
584 }
585
586 return 1;
587}
588
589/*
590 * Lookup real service by <proto,addr,port> in the real service table.
591 */
592struct ip_vs_dest *
7937df15
JV		 593ip_vs_lookup_real_service(int af, __u16 protocol,
594 const union nf_inet_addr *daddr,
595 __be16 dport)
1da177e4
LT		 596{
597 unsigned hash;
598 struct ip_vs_dest *dest;
599
600 /*
601 * Check for "full" addressed entries
602 * Return the first found entry
603 */
7937df15 604 hash = ip_vs_rs_hashkey(af, daddr, dport);
1da177e4
LT		 605
606 read_lock(&__ip_vs_rs_lock);
607 list_for_each_entry(dest, &ip_vs_rtable[hash], d_list) {
7937df15
JV		 608 if ((dest->af == af)
609 && ip_vs_addr_equal(af, &dest->addr, daddr)
1da177e4
LT		 610 && (dest->port == dport)
611 && ((dest->protocol == protocol) ||
612 dest->vfwmark)) {
613 /* HIT */
614 read_unlock(&__ip_vs_rs_lock);
615 return dest;
616 }
617 }
618 read_unlock(&__ip_vs_rs_lock);
619
620 return NULL;
621}
622
623/*
624 * Lookup destination by {addr,port} in the given service
625 */
626static struct ip_vs_dest *
7937df15
JV		 627ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
628 __be16 dport)
1da177e4
LT		 629{
630 struct ip_vs_dest *dest;
631
632 /*
633 * Find the destination for the given service
634 */
635 list_for_each_entry(dest, &svc->destinations, n_list) {
7937df15
JV		 636 if ((dest->af == svc->af)
637 && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
638 && (dest->port == dport)) {
1da177e4
LT		 639 /* HIT */
640 return dest;
641 }
642 }
643
644 return NULL;
645}
646
1e356f9c
RB		 647/*
648 * Find destination by {daddr,dport,vaddr,protocol}
649 * Cretaed to be used in ip_vs_process_message() in
650 * the backup synchronization daemon. It finds the
651 * destination to be bound to the received connection
652 * on the backup.
653 *
654 * ip_vs_lookup_real_service() looked promissing, but
655 * seems not working as expected.
656 */
7937df15
JV		 657struct ip_vs_dest *ip_vs_find_dest(int af, const union nf_inet_addr *daddr,
658 __be16 dport,
659 const union nf_inet_addr *vaddr,
660 __be16 vport, __u16 protocol)
1e356f9c
RB		 661{
662 struct ip_vs_dest *dest;
663 struct ip_vs_service *svc;
664
7937df15 665 svc = ip_vs_service_get(af, 0, protocol, vaddr, vport);
1e356f9c
RB		 666 if (!svc)
667 return NULL;
668 dest = ip_vs_lookup_dest(svc, daddr, dport);
669 if (dest)
670 atomic_inc(&dest->refcnt);
671 ip_vs_service_put(svc);
672 return dest;
673}
1da177e4
LT		 674
675/*
676 * Lookup dest by {svc,addr,port} in the destination trash.
677 * The destination trash is used to hold the destinations that are removed
678 * from the service table but are still referenced by some conn entries.
679 * The reason to add the destination trash is when the dest is temporary
680 * down (either by administrator or by monitor program), the dest can be
681 * picked back from the trash, the remaining connections to the dest can
682 * continue, and the counting information of the dest is also useful for
683 * scheduling.
684 */
685static struct ip_vs_dest *
7937df15
JV		 686ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
687 __be16 dport)
1da177e4
LT		 688{
689 struct ip_vs_dest *dest, *nxt;
690
691 /*
692 * Find the destination in trash
693 */
694 list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
7937df15
JV		 695 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
696 "dest->refcnt=%d\n",
697 dest->vfwmark,
698 IP_VS_DBG_ADDR(svc->af, &dest->addr),
699 ntohs(dest->port),
700 atomic_read(&dest->refcnt));
701 if (dest->af == svc->af &&
702 ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
1da177e4
LT		 703 dest->port == dport &&
704 dest->vfwmark == svc->fwmark &&
705 dest->protocol == svc->protocol &&
706 (svc->fwmark ||
7937df15 707 (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
1da177e4
LT		 708 dest->vport == svc->port))) {
709 /* HIT */
710 return dest;
711 }
712
713 /*
714 * Try to purge the destination from trash if not referenced
715 */
716 if (atomic_read(&dest->refcnt) == 1) {
7937df15
JV		 717 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
718 "from trash\n",
719 dest->vfwmark,
720 IP_VS_DBG_ADDR(svc->af, &dest->addr),
721 ntohs(dest->port));
1da177e4
LT		 722 list_del(&dest->n_list);
723 ip_vs_dst_reset(dest);
724 __ip_vs_unbind_svc(dest);
725 kfree(dest);
726 }
727 }
728
729 return NULL;
730}
731
732
733/*
734 * Clean up all the destinations in the trash
735 * Called by the ip_vs_control_cleanup()
736 *
737 * When the ip_vs_control_clearup is activated by ipvs module exit,
738 * the service tables must have been flushed and all the connections
739 * are expired, and the refcnt of each destination in the trash must
740 * be 1, so we simply release them here.
741 */
742static void ip_vs_trash_cleanup(void)
743{
744 struct ip_vs_dest *dest, *nxt;
745
746 list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
747 list_del(&dest->n_list);
748 ip_vs_dst_reset(dest);
749 __ip_vs_unbind_svc(dest);
750 kfree(dest);
751 }
752}
753
754
755static void
756ip_vs_zero_stats(struct ip_vs_stats *stats)
757{
758 spin_lock_bh(&stats->lock);
e93615d0 759
e9c0ce23 760 memset(&stats->ustats, 0, sizeof(stats->ustats));
1da177e4 761 ip_vs_zero_estimator(stats);
e93615d0 762
3a14a313 763 spin_unlock_bh(&stats->lock);
1da177e4
LT		 764}
765
766/*
767 * Update a destination in the given service
768 */
769static void
26c15cfd
JA		 770__ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
771 struct ip_vs_dest_user_kern *udest, int add)
1da177e4
LT		 772{
773 int conn_flags;
774
775 /* set the weight and the flags */
776 atomic_set(&dest->weight, udest->weight);
3575792e
JA		 777 conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
778 conn_flags |= IP_VS_CONN_F_INACTIVE;
1da177e4 779
1da177e4 780 /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
3575792e 781 if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
1da177e4
LT		 782 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
783 } else {
784 /*
785 * Put the real service in ip_vs_rtable if not present.
786 * For now only for NAT!
787 */
788 write_lock_bh(&__ip_vs_rs_lock);
789 ip_vs_rs_hash(dest);
790 write_unlock_bh(&__ip_vs_rs_lock);
791 }
792 atomic_set(&dest->conn_flags, conn_flags);
793
794 /* bind the service */
795 if (!dest->svc) {
796 __ip_vs_bind_svc(dest, svc);
797 } else {
798 if (dest->svc != svc) {
799 __ip_vs_unbind_svc(dest);
800 ip_vs_zero_stats(&dest->stats);
801 __ip_vs_bind_svc(dest, svc);
802 }
803 }
804
805 /* set the dest status flags */
806 dest->flags |= IP_VS_DEST_F_AVAILABLE;
807
808 if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
809 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
810 dest->u_threshold = udest->u_threshold;
811 dest->l_threshold = udest->l_threshold;
26c15cfd 812
fc604767
JA		 813 spin_lock(&dest->dst_lock);
814 ip_vs_dst_reset(dest);
815 spin_unlock(&dest->dst_lock);
816
26c15cfd
JA		 817 if (add)
818 ip_vs_new_estimator(&dest->stats);
819
820 write_lock_bh(&__ip_vs_svc_lock);
821
822 /* Wait until all other svc users go away */
823 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
824
825 if (add) {
826 list_add(&dest->n_list, &svc->destinations);
827 svc->num_dests++;
828 }
829
830 /* call the update_service, because server weight may be changed */
831 if (svc->scheduler->update_service)
832 svc->scheduler->update_service(svc);
833
834 write_unlock_bh(&__ip_vs_svc_lock);
1da177e4
LT		 835}
836
837
838/*
839 * Create a destination for the given service
840 */
841static int
c860c6b1 842ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
1da177e4
LT		 843 struct ip_vs_dest **dest_p)
844{
845 struct ip_vs_dest *dest;
846 unsigned atype;
847
848 EnterFunction(2);
849
09571c7a
VB		 850#ifdef CONFIG_IP_VS_IPV6
851 if (svc->af == AF_INET6) {
852 atype = ipv6_addr_type(&udest->addr.in6);
3bfb92f4
SW		 853 if ((!(atype & IPV6_ADDR_UNICAST) ||
854 atype & IPV6_ADDR_LINKLOCAL) &&
09571c7a
VB		 855 !__ip_vs_addr_is_local_v6(&udest->addr.in6))
856 return -EINVAL;
857 } else
858#endif
859 {
860 atype = inet_addr_type(&init_net, udest->addr.ip);
861 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
862 return -EINVAL;
863 }
1da177e4 864
dee06e47 865 dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
1da177e4 866 if (dest == NULL) {
1e3e238e 867 pr_err("%s(): no memory.\n", __func__);
1da177e4
LT		 868 return -ENOMEM;
869 }
1da177e4 870
c860c6b1 871 dest->af = svc->af;
1da177e4 872 dest->protocol = svc->protocol;
c860c6b1 873 dest->vaddr = svc->addr;
1da177e4
LT		 874 dest->vport = svc->port;
875 dest->vfwmark = svc->fwmark;
c860c6b1 876 ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
1da177e4
LT		 877 dest->port = udest->port;
878
879 atomic_set(&dest->activeconns, 0);
880 atomic_set(&dest->inactconns, 0);
881 atomic_set(&dest->persistconns, 0);
26c15cfd 882 atomic_set(&dest->refcnt, 1);
1da177e4
LT		 883
884 INIT_LIST_HEAD(&dest->d_list);
885 spin_lock_init(&dest->dst_lock);
886 spin_lock_init(&dest->stats.lock);
26c15cfd 887 __ip_vs_update_dest(svc, dest, udest, 1);
1da177e4
LT		 888
889 *dest_p = dest;
890
891 LeaveFunction(2);
892 return 0;
893}
894
895
896/*
897 * Add a destination into an existing service
898 */
899static int
c860c6b1 900ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 901{
902 struct ip_vs_dest *dest;
c860c6b1 903 union nf_inet_addr daddr;
014d730d 904 __be16 dport = udest->port;
1da177e4
LT		 905 int ret;
906
907 EnterFunction(2);
908
909 if (udest->weight < 0) {
1e3e238e 910 pr_err("%s(): server weight less than zero\n", __func__);
1da177e4
LT		 911 return -ERANGE;
912 }
913
914 if (udest->l_threshold > udest->u_threshold) {
1e3e238e
HE		 915 pr_err("%s(): lower threshold is higher than upper threshold\n",
916 __func__);
1da177e4
LT		 917 return -ERANGE;
918 }
919
c860c6b1
JV		 920 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
921
1da177e4
LT		 922 /*
923 * Check if the dest already exists in the list
924 */
7937df15
JV		 925 dest = ip_vs_lookup_dest(svc, &daddr, dport);
926
1da177e4 927 if (dest != NULL) {
1e3e238e 928 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
1da177e4
LT		 929 return -EEXIST;
930 }
931
932 /*
933 * Check if the dest already exists in the trash and
934 * is from the same service
935 */
7937df15
JV		 936 dest = ip_vs_trash_get_dest(svc, &daddr, dport);
937
1da177e4 938 if (dest != NULL) {
cfc78c5a
JV		 939 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
940 "dest->refcnt=%d, service %u/%s:%u\n",
941 IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
942 atomic_read(&dest->refcnt),
943 dest->vfwmark,
944 IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
945 ntohs(dest->vport));
946
1da177e4
LT		 947 /*
948 * Get the destination from the trash
949 */
950 list_del(&dest->n_list);
951
26c15cfd
JA		 952 __ip_vs_update_dest(svc, dest, udest, 1);
953 ret = 0;
954 } else {
1da177e4 955 /*
26c15cfd 956 * Allocate and initialize the dest structure
1da177e4 957 */
26c15cfd 958 ret = ip_vs_new_dest(svc, udest, &dest);
1da177e4 959 }
1da177e4
LT		 960 LeaveFunction(2);
961
26c15cfd 962 return ret;
1da177e4
LT		 963}
964
965
966/*
967 * Edit a destination in the given service
968 */
969static int
c860c6b1 970ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 971{
972 struct ip_vs_dest *dest;
c860c6b1 973 union nf_inet_addr daddr;
014d730d 974 __be16 dport = udest->port;
1da177e4
LT		 975
976 EnterFunction(2);
977
978 if (udest->weight < 0) {
1e3e238e 979 pr_err("%s(): server weight less than zero\n", __func__);
1da177e4
LT		 980 return -ERANGE;
981 }
982
983 if (udest->l_threshold > udest->u_threshold) {
1e3e238e
HE		 984 pr_err("%s(): lower threshold is higher than upper threshold\n",
985 __func__);
1da177e4
LT		 986 return -ERANGE;
987 }
988
c860c6b1
JV		 989 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
990
1da177e4
LT		 991 /*
992 * Lookup the destination list
993 */
7937df15
JV		 994 dest = ip_vs_lookup_dest(svc, &daddr, dport);
995
1da177e4 996 if (dest == NULL) {
1e3e238e 997 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1da177e4
LT		 998 return -ENOENT;
999 }
1000
26c15cfd 1001 __ip_vs_update_dest(svc, dest, udest, 0);
1da177e4
LT		 1002 LeaveFunction(2);
1003
1004 return 0;
1005}
1006
1007
1008/*
1009 * Delete a destination (must be already unlinked from the service)
1010 */
1011static void __ip_vs_del_dest(struct ip_vs_dest *dest)
1012{
1013 ip_vs_kill_estimator(&dest->stats);
1014
1015 /*
1016 * Remove it from the d-linked list with the real services.
1017 */
1018 write_lock_bh(&__ip_vs_rs_lock);
1019 ip_vs_rs_unhash(dest);
1020 write_unlock_bh(&__ip_vs_rs_lock);
1021
1022 /*
1023 * Decrease the refcnt of the dest, and free the dest
1024 * if nobody refers to it (refcnt=0). Otherwise, throw
1025 * the destination into the trash.
1026 */
1027 if (atomic_dec_and_test(&dest->refcnt)) {
26c15cfd
JA		 1028 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1029 dest->vfwmark,
1030 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1031 ntohs(dest->port));
1da177e4
LT		 1032 ip_vs_dst_reset(dest);
1033 /* simply decrease svc->refcnt here, let the caller check
1034 and release the service if nobody refers to it.
1035 Only user context can release destination and service,
1036 and only one user context can update virtual service at a
1037 time, so the operation here is OK */
1038 atomic_dec(&dest->svc->refcnt);
1039 kfree(dest);
1040 } else {
cfc78c5a
JV		 1041 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1042 "dest->refcnt=%d\n",
1043 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1044 ntohs(dest->port),
1045 atomic_read(&dest->refcnt));
1da177e4
LT		 1046 list_add(&dest->n_list, &ip_vs_dest_trash);
1047 atomic_inc(&dest->refcnt);
1048 }
1049}
1050
1051
1052/*
1053 * Unlink a destination from the given service
1054 */
1055static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1056 struct ip_vs_dest *dest,
1057 int svcupd)
1058{
1059 dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1060
1061 /*
1062 * Remove it from the d-linked destination list.
1063 */
1064 list_del(&dest->n_list);
1065 svc->num_dests--;
82dfb6f3
SW		 1066
1067 /*
1068 * Call the update_service function of its scheduler
1069 */
1070 if (svcupd && svc->scheduler->update_service)
1071 svc->scheduler->update_service(svc);
1da177e4
LT		 1072}
1073
1074
1075/*
1076 * Delete a destination server in the given service
1077 */
1078static int
c860c6b1 1079ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1da177e4
LT		 1080{
1081 struct ip_vs_dest *dest;
014d730d 1082 __be16 dport = udest->port;
1da177e4
LT		 1083
1084 EnterFunction(2);
1085
7937df15 1086 dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
c860c6b1 1087
1da177e4 1088 if (dest == NULL) {
1e3e238e 1089 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1da177e4
LT		 1090 return -ENOENT;
1091 }
1092
1093 write_lock_bh(&__ip_vs_svc_lock);
1094
1095 /*
1096 * Wait until all other svc users go away.
1097 */
26c15cfd 1098 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1099
1100 /*
1101 * Unlink dest from the service
1102 */
1103 __ip_vs_unlink_dest(svc, dest, 1);
1104
1105 write_unlock_bh(&__ip_vs_svc_lock);
1106
1107 /*
1108 * Delete the destination
1109 */
1110 __ip_vs_del_dest(dest);
1111
1112 LeaveFunction(2);
1113
1114 return 0;
1115}
1116
1117
1118/*
1119 * Add a service into the service hash table
1120 */
1121static int
c860c6b1
JV		 1122ip_vs_add_service(struct ip_vs_service_user_kern *u,
1123 struct ip_vs_service **svc_p)
1da177e4
LT		 1124{
1125 int ret = 0;
1126 struct ip_vs_scheduler *sched = NULL;
0d1e71b0 1127 struct ip_vs_pe *pe = NULL;
1da177e4
LT		 1128 struct ip_vs_service *svc = NULL;
1129
1130 /* increase the module use count */
1131 ip_vs_use_count_inc();
1132
1133 /* Lookup the scheduler by 'u->sched_name' */
1134 sched = ip_vs_scheduler_get(u->sched_name);
1135 if (sched == NULL) {
1e3e238e 1136 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1da177e4 1137 ret = -ENOENT;
6e08bfb8 1138 goto out_err;
1da177e4
LT		 1139 }
1140
0d1e71b0
SH		 1141 if (u->pe_name && *u->pe_name) {
1142 pe = ip_vs_pe_get(u->pe_name);
1143 if (pe == NULL) {
1144 pr_info("persistence engine module ip_vs_pe_%s "
1145 "not found\n", u->pe_name);
1146 ret = -ENOENT;
1147 goto out_err;
1148 }
1149 }
1150
f94fd041 1151#ifdef CONFIG_IP_VS_IPV6
48148938
JV		 1152 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1153 ret = -EINVAL;
1154 goto out_err;
f94fd041
JV		 1155 }
1156#endif
1157
dee06e47 1158 svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1da177e4 1159 if (svc == NULL) {
1e3e238e 1160 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1da177e4
LT		 1161 ret = -ENOMEM;
1162 goto out_err;
1163 }
1da177e4
LT		 1164
1165 /* I'm the first user of the service */
26c15cfd 1166 atomic_set(&svc->usecnt, 0);
1da177e4
LT		 1167 atomic_set(&svc->refcnt, 0);
1168
c860c6b1 1169 svc->af = u->af;
1da177e4 1170 svc->protocol = u->protocol;
c860c6b1 1171 ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1da177e4
LT		 1172 svc->port = u->port;
1173 svc->fwmark = u->fwmark;
1174 svc->flags = u->flags;
1175 svc->timeout = u->timeout * HZ;
1176 svc->netmask = u->netmask;
1177
1178 INIT_LIST_HEAD(&svc->destinations);
1179 rwlock_init(&svc->sched_lock);
1180 spin_lock_init(&svc->stats.lock);
1181
1182 /* Bind the scheduler */
1183 ret = ip_vs_bind_scheduler(svc, sched);
1184 if (ret)
1185 goto out_err;
1186 sched = NULL;
1187
0d1e71b0
SH		 1188 /* Bind the ct retriever */
1189 ip_vs_bind_pe(svc, pe);
1190 pe = NULL;
1191
1da177e4
LT		 1192 /* Update the virtual service counters */
1193 if (svc->port == FTPPORT)
1194 atomic_inc(&ip_vs_ftpsvc_counter);
1195 else if (svc->port == 0)
1196 atomic_inc(&ip_vs_nullsvc_counter);
1197
1198 ip_vs_new_estimator(&svc->stats);
f94fd041
JV		 1199
1200 /* Count only IPv4 services for old get/setsockopt interface */
1201 if (svc->af == AF_INET)
1202 ip_vs_num_services++;
1da177e4
LT		 1203
1204 /* Hash the service into the service table */
1205 write_lock_bh(&__ip_vs_svc_lock);
1206 ip_vs_svc_hash(svc);
1207 write_unlock_bh(&__ip_vs_svc_lock);
1208
1209 *svc_p = svc;
1210 return 0;
1211
6e08bfb8 1212 out_err:
1da177e4 1213 if (svc != NULL) {
2fabf35b 1214 ip_vs_unbind_scheduler(svc);
1da177e4
LT		 1215 if (svc->inc) {
1216 local_bh_disable();
1217 ip_vs_app_inc_put(svc->inc);
1218 local_bh_enable();
1219 }
1220 kfree(svc);
1221 }
1222 ip_vs_scheduler_put(sched);
0d1e71b0 1223 ip_vs_pe_put(pe);
1da177e4 1224
1da177e4
LT		 1225 /* decrease the module use count */
1226 ip_vs_use_count_dec();
1227
1228 return ret;
1229}
1230
1231
1232/*
1233 * Edit a service and bind it with a new scheduler
1234 */
1235static int
c860c6b1 1236ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1da177e4
LT		 1237{
1238 struct ip_vs_scheduler *sched, *old_sched;
0d1e71b0 1239 struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1da177e4
LT		 1240 int ret = 0;
1241
1242 /*
1243 * Lookup the scheduler, by 'u->sched_name'
1244 */
1245 sched = ip_vs_scheduler_get(u->sched_name);
1246 if (sched == NULL) {
1e3e238e 1247 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1da177e4
LT		 1248 return -ENOENT;
1249 }
1250 old_sched = sched;
1251
0d1e71b0
SH		 1252 if (u->pe_name && *u->pe_name) {
1253 pe = ip_vs_pe_get(u->pe_name);
1254 if (pe == NULL) {
1255 pr_info("persistence engine module ip_vs_pe_%s "
1256 "not found\n", u->pe_name);
1257 ret = -ENOENT;
1258 goto out;
1259 }
1260 old_pe = pe;
1261 }
1262
f94fd041 1263#ifdef CONFIG_IP_VS_IPV6
48148938
JV		 1264 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1265 ret = -EINVAL;
1266 goto out;
f94fd041
JV		 1267 }
1268#endif
1269
1da177e4
LT		 1270 write_lock_bh(&__ip_vs_svc_lock);
1271
1272 /*
1273 * Wait until all other svc users go away.
1274 */
26c15cfd 1275 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1276
1277 /*
1278 * Set the flags and timeout value
1279 */
1280 svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1281 svc->timeout = u->timeout * HZ;
1282 svc->netmask = u->netmask;
1283
1284 old_sched = svc->scheduler;
1285 if (sched != old_sched) {
1286 /*
1287 * Unbind the old scheduler
1288 */
1289 if ((ret = ip_vs_unbind_scheduler(svc))) {
1290 old_sched = sched;
9e691ed6 1291 goto out_unlock;
1da177e4
LT		 1292 }
1293
1294 /*
1295 * Bind the new scheduler
1296 */
1297 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1298 /*
1299 * If ip_vs_bind_scheduler fails, restore the old
1300 * scheduler.
1301 * The main reason of failure is out of memory.
1302 *
1303 * The question is if the old scheduler can be
1304 * restored all the time. TODO: if it cannot be
1305 * restored some time, we must delete the service,
1306 * otherwise the system may crash.
1307 */
1308 ip_vs_bind_scheduler(svc, old_sched);
1309 old_sched = sched;
9e691ed6 1310 goto out_unlock;
1da177e4
LT		 1311 }
1312 }
1313
0d1e71b0
SH		 1314 old_pe = svc->pe;
1315 if (pe != old_pe) {
1316 ip_vs_unbind_pe(svc);
1317 ip_vs_bind_pe(svc, pe);
1318 }
1319
9e691ed6 1320 out_unlock:
1da177e4 1321 write_unlock_bh(&__ip_vs_svc_lock);
9e691ed6 1322 out:
6e08bfb8 1323 ip_vs_scheduler_put(old_sched);
0d1e71b0 1324 ip_vs_pe_put(old_pe);
1da177e4
LT		 1325 return ret;
1326}
1327
1328
1329/*
1330 * Delete a service from the service list
1331 * - The service must be unlinked, unlocked and not referenced!
1332 * - We are called under _bh lock
1333 */
1334static void __ip_vs_del_service(struct ip_vs_service *svc)
1335{
1336 struct ip_vs_dest *dest, *nxt;
1337 struct ip_vs_scheduler *old_sched;
0d1e71b0
SH		 1338 struct ip_vs_pe *old_pe;
1339
1340 pr_info("%s: enter\n", __func__);
1da177e4 1341
f94fd041
JV		 1342 /* Count only IPv4 services for old get/setsockopt interface */
1343 if (svc->af == AF_INET)
1344 ip_vs_num_services--;
1345
1da177e4
LT		 1346 ip_vs_kill_estimator(&svc->stats);
1347
1348 /* Unbind scheduler */
1349 old_sched = svc->scheduler;
1350 ip_vs_unbind_scheduler(svc);
6e08bfb8 1351 ip_vs_scheduler_put(old_sched);
1da177e4 1352
0d1e71b0
SH		 1353 /* Unbind persistence engine */
1354 old_pe = svc->pe;
1355 ip_vs_unbind_pe(svc);
1356 ip_vs_pe_put(old_pe);
1357
1da177e4
LT		 1358 /* Unbind app inc */
1359 if (svc->inc) {
1360 ip_vs_app_inc_put(svc->inc);
1361 svc->inc = NULL;
1362 }
1363
1364 /*
1365 * Unlink the whole destination list
1366 */
1367 list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1368 __ip_vs_unlink_dest(svc, dest, 0);
1369 __ip_vs_del_dest(dest);
1370 }
1371
1372 /*
1373 * Update the virtual service counters
1374 */
1375 if (svc->port == FTPPORT)
1376 atomic_dec(&ip_vs_ftpsvc_counter);
1377 else if (svc->port == 0)
1378 atomic_dec(&ip_vs_nullsvc_counter);
1379
1380 /*
1381 * Free the service if nobody refers to it
1382 */
26c15cfd
JA		 1383 if (atomic_read(&svc->refcnt) == 0) {
1384 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1385 svc->fwmark,
1386 IP_VS_DBG_ADDR(svc->af, &svc->addr),
1387 ntohs(svc->port), atomic_read(&svc->usecnt));
1da177e4 1388 kfree(svc);
26c15cfd 1389 }
1da177e4
LT		 1390
1391 /* decrease the module use count */
1392 ip_vs_use_count_dec();
1393}
1394
1395/*
26c15cfd 1396 * Unlink a service from list and try to delete it if its refcnt reached 0
1da177e4 1397 */
26c15cfd 1398static void ip_vs_unlink_service(struct ip_vs_service *svc)
1da177e4 1399{
1da177e4
LT		 1400 /*
1401 * Unhash it from the service table
1402 */
1403 write_lock_bh(&__ip_vs_svc_lock);
1404
1405 ip_vs_svc_unhash(svc);
1406
1407 /*
1408 * Wait until all the svc users go away.
1409 */
26c15cfd 1410 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1da177e4
LT		 1411
1412 __ip_vs_del_service(svc);
1413
1414 write_unlock_bh(&__ip_vs_svc_lock);
26c15cfd
JA		 1415}
1416
1417/*
1418 * Delete a service from the service list
1419 */
1420static int ip_vs_del_service(struct ip_vs_service *svc)
1421{
1422 if (svc == NULL)
1423 return -EEXIST;
1424 ip_vs_unlink_service(svc);
1da177e4
LT		 1425
1426 return 0;
1427}
1428
1429
1430/*
1431 * Flush all the virtual services
1432 */
1433static int ip_vs_flush(void)
1434{
1435 int idx;
1436 struct ip_vs_service *svc, *nxt;
1437
1438 /*
1439 * Flush the service table hashed by <protocol,addr,port>
1440 */
1441 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1442 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx], s_list) {
26c15cfd 1443 ip_vs_unlink_service(svc);
1da177e4
LT		 1444 }
1445 }
1446
1447 /*
1448 * Flush the service table hashed by fwmark
1449 */
1450 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1451 list_for_each_entry_safe(svc, nxt,
1452 &ip_vs_svc_fwm_table[idx], f_list) {
26c15cfd 1453 ip_vs_unlink_service(svc);
1da177e4
LT		 1454 }
1455 }
1456
1457 return 0;
1458}
1459
1460
1461/*
1462 * Zero counters in a service or all services
1463 */
1464static int ip_vs_zero_service(struct ip_vs_service *svc)
1465{
1466 struct ip_vs_dest *dest;
1467
1468 write_lock_bh(&__ip_vs_svc_lock);
1469 list_for_each_entry(dest, &svc->destinations, n_list) {
1470 ip_vs_zero_stats(&dest->stats);
1471 }
1472 ip_vs_zero_stats(&svc->stats);
1473 write_unlock_bh(&__ip_vs_svc_lock);
1474 return 0;
1475}
1476
1477static int ip_vs_zero_all(void)
1478{
1479 int idx;
1480 struct ip_vs_service *svc;
1481
1482 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1483 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1484 ip_vs_zero_service(svc);
1485 }
1486 }
1487
1488 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1489 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1490 ip_vs_zero_service(svc);
1491 }
1492 }
1493
1494 ip_vs_zero_stats(&ip_vs_stats);
1495 return 0;
1496}
1497
1498
1499static int
8d65af78 1500proc_do_defense_mode(ctl_table *table, int write,
1da177e4
LT		 1501 void __user *buffer, size_t *lenp, loff_t *ppos)
1502{
1503 int *valp = table->data;
1504 int val = *valp;
1505 int rc;
1506
8d65af78 1507 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1da177e4
LT		 1508 if (write && (*valp != val)) {
1509 if ((*valp < 0) || (*valp > 3)) {
1510 /* Restore the correct value */
1511 *valp = val;
1512 } else {
1da177e4 1513 update_defense_level();
1da177e4
LT		 1514 }
1515 }
1516 return rc;
1517}
1518
1519
1520static int
8d65af78 1521proc_do_sync_threshold(ctl_table *table, int write,
1da177e4
LT		 1522 void __user *buffer, size_t *lenp, loff_t *ppos)
1523{
1524 int *valp = table->data;
1525 int val[2];
1526 int rc;
1527
1528 /* backup the value first */
1529 memcpy(val, valp, sizeof(val));
1530
8d65af78 1531 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1da177e4
LT		 1532 if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1533 /* Restore the correct value */
1534 memcpy(valp, val, sizeof(val));
1535 }
1536 return rc;
1537}
1538
1539
1540/*
1541 * IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1542 */
1543
1544static struct ctl_table vs_vars[] = {
1545 {
1da177e4
LT		 1546 .procname = "amemthresh",
1547 .data = &sysctl_ip_vs_amemthresh,
1548 .maxlen = sizeof(int),
1549 .mode = 0644,
6d9f239a 1550 .proc_handler = proc_dointvec,
1da177e4
LT		 1551 },
1552#ifdef CONFIG_IP_VS_DEBUG
1553 {
1da177e4
LT		 1554 .procname = "debug_level",
1555 .data = &sysctl_ip_vs_debug_level,
1556 .maxlen = sizeof(int),
1557 .mode = 0644,
6d9f239a 1558 .proc_handler = proc_dointvec,
1da177e4
LT		 1559 },
1560#endif
1561 {
1da177e4
LT		 1562 .procname = "am_droprate",
1563 .data = &sysctl_ip_vs_am_droprate,
1564 .maxlen = sizeof(int),
1565 .mode = 0644,
6d9f239a 1566 .proc_handler = proc_dointvec,
1da177e4
LT		 1567 },
1568 {
1da177e4
LT		 1569 .procname = "drop_entry",
1570 .data = &sysctl_ip_vs_drop_entry,
1571 .maxlen = sizeof(int),
1572 .mode = 0644,
6d9f239a 1573 .proc_handler = proc_do_defense_mode,
1da177e4
LT		 1574 },
1575 {
1da177e4
LT		 1576 .procname = "drop_packet",
1577 .data = &sysctl_ip_vs_drop_packet,
1578 .maxlen = sizeof(int),
1579 .mode = 0644,
6d9f239a 1580 .proc_handler = proc_do_defense_mode,
1da177e4 1581 },
f4bc17cd
JA		 1582#ifdef CONFIG_IP_VS_NFCT
1583 {
1584 .procname = "conntrack",
1585 .data = &sysctl_ip_vs_conntrack,
1586 .maxlen = sizeof(int),
1587 .mode = 0644,
1588 .proc_handler = &proc_dointvec,
1589 },
1590#endif
1da177e4 1591 {
1da177e4
LT		 1592 .procname = "secure_tcp",
1593 .data = &sysctl_ip_vs_secure_tcp,
1594 .maxlen = sizeof(int),
1595 .mode = 0644,
6d9f239a 1596 .proc_handler = proc_do_defense_mode,
1da177e4 1597 },
8a803040
JA		 1598 {
1599 .procname = "snat_reroute",
1600 .data = &sysctl_ip_vs_snat_reroute,
1601 .maxlen = sizeof(int),
1602 .mode = 0644,
1603 .proc_handler = &proc_dointvec,
1604 },
1da177e4
LT		 1605#if 0
1606 {
1da177e4
LT		 1607 .procname = "timeout_established",
1608 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1609 .maxlen = sizeof(int),
1610 .mode = 0644,
6d9f239a 1611 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1612 },
1613 {
1da177e4
LT		 1614 .procname = "timeout_synsent",
1615 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1616 .maxlen = sizeof(int),
1617 .mode = 0644,
6d9f239a 1618 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1619 },
1620 {
1da177e4
LT		 1621 .procname = "timeout_synrecv",
1622 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1623 .maxlen = sizeof(int),
1624 .mode = 0644,
6d9f239a 1625 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1626 },
1627 {
1da177e4
LT		 1628 .procname = "timeout_finwait",
1629 .data = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1630 .maxlen = sizeof(int),
1631 .mode = 0644,
6d9f239a 1632 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1633 },
1634 {
1da177e4
LT		 1635 .procname = "timeout_timewait",
1636 .data = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1637 .maxlen = sizeof(int),
1638 .mode = 0644,
6d9f239a 1639 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1640 },
1641 {
1da177e4
LT		 1642 .procname = "timeout_close",
1643 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1644 .maxlen = sizeof(int),
1645 .mode = 0644,
6d9f239a 1646 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1647 },
1648 {
1da177e4
LT		 1649 .procname = "timeout_closewait",
1650 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1651 .maxlen = sizeof(int),
1652 .mode = 0644,
6d9f239a 1653 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1654 },
1655 {
1da177e4
LT		 1656 .procname = "timeout_lastack",
1657 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1658 .maxlen = sizeof(int),
1659 .mode = 0644,
6d9f239a 1660 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1661 },
1662 {
1da177e4
LT		 1663 .procname = "timeout_listen",
1664 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1665 .maxlen = sizeof(int),
1666 .mode = 0644,
6d9f239a 1667 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1668 },
1669 {
1da177e4
LT		 1670 .procname = "timeout_synack",
1671 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1672 .maxlen = sizeof(int),
1673 .mode = 0644,
6d9f239a 1674 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1675 },
1676 {
1da177e4
LT		 1677 .procname = "timeout_udp",
1678 .data = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1679 .maxlen = sizeof(int),
1680 .mode = 0644,
6d9f239a 1681 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1682 },
1683 {
1da177e4
LT		 1684 .procname = "timeout_icmp",
1685 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1686 .maxlen = sizeof(int),
1687 .mode = 0644,
6d9f239a 1688 .proc_handler = proc_dointvec_jiffies,
1da177e4
LT		 1689 },
1690#endif
1691 {
1da177e4
LT		 1692 .procname = "cache_bypass",
1693 .data = &sysctl_ip_vs_cache_bypass,
1694 .maxlen = sizeof(int),
1695 .mode = 0644,
6d9f239a 1696 .proc_handler = proc_dointvec,
1da177e4
LT		 1697 },
1698 {
1da177e4
LT		 1699 .procname = "expire_nodest_conn",
1700 .data = &sysctl_ip_vs_expire_nodest_conn,
1701 .maxlen = sizeof(int),
1702 .mode = 0644,
6d9f239a 1703 .proc_handler = proc_dointvec,
1da177e4
LT		 1704 },
1705 {
1da177e4
LT		 1706 .procname = "expire_quiescent_template",
1707 .data = &sysctl_ip_vs_expire_quiescent_template,
1708 .maxlen = sizeof(int),
1709 .mode = 0644,
6d9f239a 1710 .proc_handler = proc_dointvec,
1da177e4
LT		 1711 },
1712 {
1da177e4
LT		 1713 .procname = "sync_threshold",
1714 .data = &sysctl_ip_vs_sync_threshold,
1715 .maxlen = sizeof(sysctl_ip_vs_sync_threshold),
1716 .mode = 0644,
6d9f239a 1717 .proc_handler = proc_do_sync_threshold,
1da177e4
LT		 1718 },
1719 {
1da177e4
LT		 1720 .procname = "nat_icmp_send",
1721 .data = &sysctl_ip_vs_nat_icmp_send,
1722 .maxlen = sizeof(int),
1723 .mode = 0644,
6d9f239a 1724 .proc_handler = proc_dointvec,
1da177e4 1725 },
f8572d8f 1726 { }
1da177e4
LT		 1727};
1728
5587da55 1729const struct ctl_path net_vs_ctl_path[] = {
f8572d8f
EB		 1730 { .procname = "net", },
1731 { .procname = "ipv4", },
90754f8e
PE		 1732 { .procname = "vs", },
1733 { }
1da177e4 1734};
90754f8e 1735EXPORT_SYMBOL_GPL(net_vs_ctl_path);
1da177e4
LT		 1736
1737static struct ctl_table_header * sysctl_header;
1738
1739#ifdef CONFIG_PROC_FS
1740
1741struct ip_vs_iter {
1742 struct list_head *table;
1743 int bucket;
1744};
1745
1746/*
1747 * Write the contents of the VS rule table to a PROCfs file.
1748 * (It is kept just for backward compatibility)
1749 */
1750static inline const char *ip_vs_fwd_name(unsigned flags)
1751{
1752 switch (flags & IP_VS_CONN_F_FWD_MASK) {
1753 case IP_VS_CONN_F_LOCALNODE:
1754 return "Local";
1755 case IP_VS_CONN_F_TUNNEL:
1756 return "Tunnel";
1757 case IP_VS_CONN_F_DROUTE:
1758 return "Route";
1759 default:
1760 return "Masq";
1761 }
1762}
1763
1764
1765/* Get the Nth entry in the two lists */
1766static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1767{
1768 struct ip_vs_iter *iter = seq->private;
1769 int idx;
1770 struct ip_vs_service *svc;
1771
1772 /* look in hash by protocol */
1773 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1774 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1775 if (pos-- == 0){
1776 iter->table = ip_vs_svc_table;
1777 iter->bucket = idx;
1778 return svc;
1779 }
1780 }
1781 }
1782
1783 /* keep looking in fwmark */
1784 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1785 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1786 if (pos-- == 0) {
1787 iter->table = ip_vs_svc_fwm_table;
1788 iter->bucket = idx;
1789 return svc;
1790 }
1791 }
1792 }
1793
1794 return NULL;
1795}
1796
1797static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
563e94f0 1798__acquires(__ip_vs_svc_lock)
1da177e4
LT		 1799{
1800
1801 read_lock_bh(&__ip_vs_svc_lock);
1802 return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1803}
1804
1805
1806static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1807{
1808 struct list_head *e;
1809 struct ip_vs_iter *iter;
1810 struct ip_vs_service *svc;
1811
1812 ++*pos;
1813 if (v == SEQ_START_TOKEN)
1814 return ip_vs_info_array(seq,0);
1815
1816 svc = v;
1817 iter = seq->private;
1818
1819 if (iter->table == ip_vs_svc_table) {
1820 /* next service in table hashed by protocol */
1821 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1822 return list_entry(e, struct ip_vs_service, s_list);
1823
1824
1825 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1826 list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1827 s_list) {
1828 return svc;
1829 }
1830 }
1831
1832 iter->table = ip_vs_svc_fwm_table;
1833 iter->bucket = -1;
1834 goto scan_fwmark;
1835 }
1836
1837 /* next service in hashed by fwmark */
1838 if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1839 return list_entry(e, struct ip_vs_service, f_list);
1840
1841 scan_fwmark:
1842 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1843 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1844 f_list)
1845 return svc;
1846 }
1847
1848 return NULL;
1849}
1850
1851static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
563e94f0 1852__releases(__ip_vs_svc_lock)
1da177e4
LT		 1853{
1854 read_unlock_bh(&__ip_vs_svc_lock);
1855}
1856
1857
1858static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1859{
1860 if (v == SEQ_START_TOKEN) {
1861 seq_printf(seq,
1862 "IP Virtual Server version %d.%d.%d (size=%d)\n",
6f7edb48 1863 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1da177e4
LT		 1864 seq_puts(seq,
1865 "Prot LocalAddress:Port Scheduler Flags\n");
1866 seq_puts(seq,
1867 " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1868 } else {
1869 const struct ip_vs_service *svc = v;
1870 const struct ip_vs_iter *iter = seq->private;
1871 const struct ip_vs_dest *dest;
1872
667a5f18
VB		 1873 if (iter->table == ip_vs_svc_table) {
1874#ifdef CONFIG_IP_VS_IPV6
1875 if (svc->af == AF_INET6)
5b095d98 1876 seq_printf(seq, "%s [%pI6]:%04X %s ",
667a5f18 1877 ip_vs_proto_name(svc->protocol),
38ff4fa4 1878 &svc->addr.in6,
667a5f18
VB		 1879 ntohs(svc->port),
1880 svc->scheduler->name);
1881 else
1882#endif
26ec037f 1883 seq_printf(seq, "%s %08X:%04X %s %s ",
667a5f18
VB		 1884 ip_vs_proto_name(svc->protocol),
1885 ntohl(svc->addr.ip),
1886 ntohs(svc->port),
26ec037f
NC		 1887 svc->scheduler->name,
1888 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
667a5f18 1889 } else {
26ec037f
NC		 1890 seq_printf(seq, "FWM %08X %s %s",
1891 svc->fwmark, svc->scheduler->name,
1892 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
667a5f18 1893 }
1da177e4
LT		 1894
1895 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
1896 seq_printf(seq, "persistent %d %08X\n",
1897 svc->timeout,
1898 ntohl(svc->netmask));
1899 else
1900 seq_putc(seq, '\n');
1901
1902 list_for_each_entry(dest, &svc->destinations, n_list) {
667a5f18
VB		 1903#ifdef CONFIG_IP_VS_IPV6
1904 if (dest->af == AF_INET6)
1905 seq_printf(seq,
5b095d98 1906 " -> [%pI6]:%04X"
667a5f18 1907 " %-7s %-6d %-10d %-10d\n",
38ff4fa4 1908 &dest->addr.in6,
667a5f18
VB		 1909 ntohs(dest->port),
1910 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1911 atomic_read(&dest->weight),
1912 atomic_read(&dest->activeconns),
1913 atomic_read(&dest->inactconns));
1914 else
1915#endif
1916 seq_printf(seq,
1917 " -> %08X:%04X "
1918 "%-7s %-6d %-10d %-10d\n",
1919 ntohl(dest->addr.ip),
1920 ntohs(dest->port),
1921 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1922 atomic_read(&dest->weight),
1923 atomic_read(&dest->activeconns),
1924 atomic_read(&dest->inactconns));
1925
1da177e4
LT		 1926 }
1927 }
1928 return 0;
1929}
1930
56b3d975 1931static const struct seq_operations ip_vs_info_seq_ops = {
1da177e4
LT		 1932 .start = ip_vs_info_seq_start,
1933 .next = ip_vs_info_seq_next,
1934 .stop = ip_vs_info_seq_stop,
1935 .show = ip_vs_info_seq_show,
1936};
1937
1938static int ip_vs_info_open(struct inode *inode, struct file *file)
1939{
cf7732e4
PE		 1940 return seq_open_private(file, &ip_vs_info_seq_ops,
1941 sizeof(struct ip_vs_iter));
1da177e4
LT		 1942}
1943
9a32144e 1944static const struct file_operations ip_vs_info_fops = {
1da177e4
LT		 1945 .owner = THIS_MODULE,
1946 .open = ip_vs_info_open,
1947 .read = seq_read,
1948 .llseek = seq_lseek,
1949 .release = seq_release_private,
1950};
1951
1952#endif
1953
519e49e8
SW		 1954struct ip_vs_stats ip_vs_stats = {
1955 .lock = __SPIN_LOCK_UNLOCKED(ip_vs_stats.lock),
1956};
1da177e4
LT		 1957
1958#ifdef CONFIG_PROC_FS
1959static int ip_vs_stats_show(struct seq_file *seq, void *v)
1960{
1961
1962/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
1963 seq_puts(seq,
1964 " Total Incoming Outgoing Incoming Outgoing\n");
1965 seq_printf(seq,
1966 " Conns Packets Packets Bytes Bytes\n");
1967
1968 spin_lock_bh(&ip_vs_stats.lock);
e9c0ce23
SW		 1969 seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", ip_vs_stats.ustats.conns,
1970 ip_vs_stats.ustats.inpkts, ip_vs_stats.ustats.outpkts,
1971 (unsigned long long) ip_vs_stats.ustats.inbytes,
1972 (unsigned long long) ip_vs_stats.ustats.outbytes);
1da177e4
LT		 1973
1974/* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
1975 seq_puts(seq,
1976 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
1977 seq_printf(seq,"%8X %8X %8X %16X %16X\n",
e9c0ce23
SW		 1978 ip_vs_stats.ustats.cps,
1979 ip_vs_stats.ustats.inpps,
1980 ip_vs_stats.ustats.outpps,
1981 ip_vs_stats.ustats.inbps,
1982 ip_vs_stats.ustats.outbps);
1da177e4
LT		 1983 spin_unlock_bh(&ip_vs_stats.lock);
1984
1985 return 0;
1986}
1987
1988static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
1989{
1990 return single_open(file, ip_vs_stats_show, NULL);
1991}
1992
9a32144e 1993static const struct file_operations ip_vs_stats_fops = {
1da177e4
LT		 1994 .owner = THIS_MODULE,
1995 .open = ip_vs_stats_seq_open,
1996 .read = seq_read,
1997 .llseek = seq_lseek,
1998 .release = single_release,
1999};
2000
2001#endif
2002
2003/*
2004 * Set timeout values for tcp tcpfin udp in the timeout_table.
2005 */
2006static int ip_vs_set_timeout(struct ip_vs_timeout_user *u)
2007{
2008 IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2009 u->tcp_timeout,
2010 u->tcp_fin_timeout,
2011 u->udp_timeout);
2012
2013#ifdef CONFIG_IP_VS_PROTO_TCP
2014 if (u->tcp_timeout) {
2015 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED]
2016 = u->tcp_timeout * HZ;
2017 }
2018
2019 if (u->tcp_fin_timeout) {
2020 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT]
2021 = u->tcp_fin_timeout * HZ;
2022 }
2023#endif
2024
2025#ifdef CONFIG_IP_VS_PROTO_UDP
2026 if (u->udp_timeout) {
2027 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL]
2028 = u->udp_timeout * HZ;
2029 }
2030#endif
2031 return 0;
2032}
2033
2034
2035#define SET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2036#define SERVICE_ARG_LEN (sizeof(struct ip_vs_service_user))
2037#define SVCDEST_ARG_LEN (sizeof(struct ip_vs_service_user) + \
2038 sizeof(struct ip_vs_dest_user))
2039#define TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2040#define DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user))
2041#define MAX_ARG_LEN SVCDEST_ARG_LEN
2042
9b5b5cff 2043static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
1da177e4
LT		 2044 [SET_CMDID(IP_VS_SO_SET_ADD)] = SERVICE_ARG_LEN,
2045 [SET_CMDID(IP_VS_SO_SET_EDIT)] = SERVICE_ARG_LEN,
2046 [SET_CMDID(IP_VS_SO_SET_DEL)] = SERVICE_ARG_LEN,
2047 [SET_CMDID(IP_VS_SO_SET_FLUSH)] = 0,
2048 [SET_CMDID(IP_VS_SO_SET_ADDDEST)] = SVCDEST_ARG_LEN,
2049 [SET_CMDID(IP_VS_SO_SET_DELDEST)] = SVCDEST_ARG_LEN,
2050 [SET_CMDID(IP_VS_SO_SET_EDITDEST)] = SVCDEST_ARG_LEN,
2051 [SET_CMDID(IP_VS_SO_SET_TIMEOUT)] = TIMEOUT_ARG_LEN,
2052 [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)] = DAEMON_ARG_LEN,
2053 [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)] = DAEMON_ARG_LEN,
2054 [SET_CMDID(IP_VS_SO_SET_ZERO)] = SERVICE_ARG_LEN,
2055};
2056
c860c6b1
JV		 2057static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2058 struct ip_vs_service_user *usvc_compat)
2059{
0d1e71b0
SH		 2060 memset(usvc, 0, sizeof(*usvc));
2061
c860c6b1
JV		 2062 usvc->af = AF_INET;
2063 usvc->protocol = usvc_compat->protocol;
2064 usvc->addr.ip = usvc_compat->addr;
2065 usvc->port = usvc_compat->port;
2066 usvc->fwmark = usvc_compat->fwmark;
2067
2068 /* Deep copy of sched_name is not needed here */
2069 usvc->sched_name = usvc_compat->sched_name;
2070
2071 usvc->flags = usvc_compat->flags;
2072 usvc->timeout = usvc_compat->timeout;
2073 usvc->netmask = usvc_compat->netmask;
2074}
2075
2076static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2077 struct ip_vs_dest_user *udest_compat)
2078{
0d1e71b0
SH		 2079 memset(udest, 0, sizeof(*udest));
2080
c860c6b1
JV		 2081 udest->addr.ip = udest_compat->addr;
2082 udest->port = udest_compat->port;
2083 udest->conn_flags = udest_compat->conn_flags;
2084 udest->weight = udest_compat->weight;
2085 udest->u_threshold = udest_compat->u_threshold;
2086 udest->l_threshold = udest_compat->l_threshold;
2087}
2088
1da177e4
LT		 2089static int
2090do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2091{
2092 int ret;
2093 unsigned char arg[MAX_ARG_LEN];
c860c6b1
JV		 2094 struct ip_vs_service_user *usvc_compat;
2095 struct ip_vs_service_user_kern usvc;
1da177e4 2096 struct ip_vs_service *svc;
c860c6b1
JV		 2097 struct ip_vs_dest_user *udest_compat;
2098 struct ip_vs_dest_user_kern udest;
1da177e4
LT		 2099
2100 if (!capable(CAP_NET_ADMIN))
2101 return -EPERM;
2102
04bcef2a
AV		 2103 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2104 return -EINVAL;
2105 if (len < 0 || len > MAX_ARG_LEN)
2106 return -EINVAL;
1da177e4 2107 if (len != set_arglen[SET_CMDID(cmd)]) {
1e3e238e
HE		 2108 pr_err("set_ctl: len %u != %u\n",
2109 len, set_arglen[SET_CMDID(cmd)]);
1da177e4
LT		 2110 return -EINVAL;
2111 }
2112
2113 if (copy_from_user(arg, user, len) != 0)
2114 return -EFAULT;
2115
2116 /* increase the module use count */
2117 ip_vs_use_count_inc();
2118
14cc3e2b 2119 if (mutex_lock_interruptible(&__ip_vs_mutex)) {
1da177e4
LT		 2120 ret = -ERESTARTSYS;
2121 goto out_dec;
2122 }
2123
2124 if (cmd == IP_VS_SO_SET_FLUSH) {
2125 /* Flush the virtual service */
2126 ret = ip_vs_flush();
2127 goto out_unlock;
2128 } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2129 /* Set timeout values for (tcp tcpfin udp) */
2130 ret = ip_vs_set_timeout((struct ip_vs_timeout_user *)arg);
2131 goto out_unlock;
2132 } else if (cmd == IP_VS_SO_SET_STARTDAEMON) {
2133 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2134 ret = start_sync_thread(dm->state, dm->mcast_ifn, dm->syncid);
2135 goto out_unlock;
2136 } else if (cmd == IP_VS_SO_SET_STOPDAEMON) {
2137 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2138 ret = stop_sync_thread(dm->state);
2139 goto out_unlock;
2140 }
2141
c860c6b1
JV		 2142 usvc_compat = (struct ip_vs_service_user *)arg;
2143 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2144
2145 /* We only use the new structs internally, so copy userspace compat
2146 * structs to extended internal versions */
2147 ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2148 ip_vs_copy_udest_compat(&udest, udest_compat);
1da177e4
LT		 2149
2150 if (cmd == IP_VS_SO_SET_ZERO) {
2151 /* if no service address is set, zero counters in all */
c860c6b1 2152 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
1da177e4
LT		 2153 ret = ip_vs_zero_all();
2154 goto out_unlock;
2155 }
2156 }
2157
2906f66a
VMR		 2158 /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2159 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2160 usvc.protocol != IPPROTO_SCTP) {
1e3e238e
HE		 2161 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2162 usvc.protocol, &usvc.addr.ip,
2163 ntohs(usvc.port), usvc.sched_name);
1da177e4
LT		 2164 ret = -EFAULT;
2165 goto out_unlock;
2166 }
2167
2168 /* Lookup the exact service by <protocol, addr, port> or fwmark */
c860c6b1 2169 if (usvc.fwmark == 0)
26c15cfd
JA		 2170 svc = __ip_vs_service_find(usvc.af, usvc.protocol,
2171 &usvc.addr, usvc.port);
1da177e4 2172 else
26c15cfd 2173 svc = __ip_vs_svc_fwm_find(usvc.af, usvc.fwmark);
1da177e4
LT		 2174
2175 if (cmd != IP_VS_SO_SET_ADD
c860c6b1 2176 && (svc == NULL || svc->protocol != usvc.protocol)) {
1da177e4 2177 ret = -ESRCH;
26c15cfd 2178 goto out_unlock;
1da177e4
LT		 2179 }
2180
2181 switch (cmd) {
2182 case IP_VS_SO_SET_ADD:
2183 if (svc != NULL)
2184 ret = -EEXIST;
2185 else
c860c6b1 2186 ret = ip_vs_add_service(&usvc, &svc);
1da177e4
LT		 2187 break;
2188 case IP_VS_SO_SET_EDIT:
c860c6b1 2189 ret = ip_vs_edit_service(svc, &usvc);
1da177e4
LT		 2190 break;
2191 case IP_VS_SO_SET_DEL:
2192 ret = ip_vs_del_service(svc);
2193 if (!ret)
2194 goto out_unlock;
2195 break;
2196 case IP_VS_SO_SET_ZERO:
2197 ret = ip_vs_zero_service(svc);
2198 break;
2199 case IP_VS_SO_SET_ADDDEST:
c860c6b1 2200 ret = ip_vs_add_dest(svc, &udest);
1da177e4
LT		 2201 break;
2202 case IP_VS_SO_SET_EDITDEST:
c860c6b1 2203 ret = ip_vs_edit_dest(svc, &udest);
1da177e4
LT		 2204 break;
2205 case IP_VS_SO_SET_DELDEST:
c860c6b1 2206 ret = ip_vs_del_dest(svc, &udest);
1da177e4
LT		 2207 break;
2208 default:
2209 ret = -EINVAL;
2210 }
2211
1da177e4 2212 out_unlock:
14cc3e2b 2213 mutex_unlock(&__ip_vs_mutex);
1da177e4
LT		 2214 out_dec:
2215 /* decrease the module use count */
2216 ip_vs_use_count_dec();
2217
2218 return ret;
2219}
2220
2221
2222static void
2223ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
2224{
2225 spin_lock_bh(&src->lock);
e9c0ce23 2226 memcpy(dst, &src->ustats, sizeof(*dst));
1da177e4
LT		 2227 spin_unlock_bh(&src->lock);
2228}
2229
2230static void
2231ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2232{
2233 dst->protocol = src->protocol;
e7ade46a 2234 dst->addr = src->addr.ip;
1da177e4
LT		 2235 dst->port = src->port;
2236 dst->fwmark = src->fwmark;
4da62fc7 2237 strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
1da177e4
LT		 2238 dst->flags = src->flags;
2239 dst->timeout = src->timeout / HZ;
2240 dst->netmask = src->netmask;
2241 dst->num_dests = src->num_dests;
2242 ip_vs_copy_stats(&dst->stats, &src->stats);
2243}
2244
2245static inline int
2246__ip_vs_get_service_entries(const struct ip_vs_get_services *get,
2247 struct ip_vs_get_services __user *uptr)
2248{
2249 int idx, count=0;
2250 struct ip_vs_service *svc;
2251 struct ip_vs_service_entry entry;
2252 int ret = 0;
2253
2254 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2255 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
f94fd041
JV		 2256 /* Only expose IPv4 entries to old interface */
2257 if (svc->af != AF_INET)
2258 continue;
2259
1da177e4
LT		 2260 if (count >= get->num_services)
2261 goto out;
4da62fc7 2262 memset(&entry, 0, sizeof(entry));
1da177e4
LT		 2263 ip_vs_copy_service(&entry, svc);
2264 if (copy_to_user(&uptr->entrytable[count],
2265 &entry, sizeof(entry))) {
2266 ret = -EFAULT;
2267 goto out;
2268 }
2269 count++;
2270 }
2271 }
2272
2273 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2274 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
f94fd041
JV		 2275 /* Only expose IPv4 entries to old interface */
2276 if (svc->af != AF_INET)
2277 continue;
2278
1da177e4
LT		 2279 if (count >= get->num_services)
2280 goto out;
4da62fc7 2281 memset(&entry, 0, sizeof(entry));
1da177e4
LT		 2282 ip_vs_copy_service(&entry, svc);
2283 if (copy_to_user(&uptr->entrytable[count],
2284 &entry, sizeof(entry))) {
2285 ret = -EFAULT;
2286 goto out;
2287 }
2288 count++;
2289 }
2290 }
2291 out:
2292 return ret;
2293}
2294
2295static inline int
2296__ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
2297 struct ip_vs_get_dests __user *uptr)
2298{
2299 struct ip_vs_service *svc;
b18610de 2300 union nf_inet_addr addr = { .ip = get->addr };
1da177e4
LT		 2301 int ret = 0;
2302
2303 if (get->fwmark)
26c15cfd 2304 svc = __ip_vs_svc_fwm_find(AF_INET, get->fwmark);
1da177e4 2305 else
26c15cfd
JA		 2306 svc = __ip_vs_service_find(AF_INET, get->protocol, &addr,
2307 get->port);
b18610de 2308
1da177e4
LT		 2309 if (svc) {
2310 int count = 0;
2311 struct ip_vs_dest *dest;
2312 struct ip_vs_dest_entry entry;
2313
2314 list_for_each_entry(dest, &svc->destinations, n_list) {
2315 if (count >= get->num_dests)
2316 break;
2317
e7ade46a 2318 entry.addr = dest->addr.ip;
1da177e4
LT		 2319 entry.port = dest->port;
2320 entry.conn_flags = atomic_read(&dest->conn_flags);
2321 entry.weight = atomic_read(&dest->weight);
2322 entry.u_threshold = dest->u_threshold;
2323 entry.l_threshold = dest->l_threshold;
2324 entry.activeconns = atomic_read(&dest->activeconns);
2325 entry.inactconns = atomic_read(&dest->inactconns);
2326 entry.persistconns = atomic_read(&dest->persistconns);
2327 ip_vs_copy_stats(&entry.stats, &dest->stats);
2328 if (copy_to_user(&uptr->entrytable[count],
2329 &entry, sizeof(entry))) {
2330 ret = -EFAULT;
2331 break;
2332 }
2333 count++;
2334 }
1da177e4
LT		 2335 } else
2336 ret = -ESRCH;
2337 return ret;
2338}
2339
2340static inline void
2341__ip_vs_get_timeouts(struct ip_vs_timeout_user *u)
2342{
2343#ifdef CONFIG_IP_VS_PROTO_TCP
2344 u->tcp_timeout =
2345 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2346 u->tcp_fin_timeout =
2347 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2348#endif
2349#ifdef CONFIG_IP_VS_PROTO_UDP
2350 u->udp_timeout =
2351 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2352#endif
2353}
2354
2355
2356#define GET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2357#define GET_INFO_ARG_LEN (sizeof(struct ip_vs_getinfo))
2358#define GET_SERVICES_ARG_LEN (sizeof(struct ip_vs_get_services))
2359#define GET_SERVICE_ARG_LEN (sizeof(struct ip_vs_service_entry))
2360#define GET_DESTS_ARG_LEN (sizeof(struct ip_vs_get_dests))
2361#define GET_TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2362#define GET_DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user) * 2)
2363
9b5b5cff 2364static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
1da177e4
LT		 2365 [GET_CMDID(IP_VS_SO_GET_VERSION)] = 64,
2366 [GET_CMDID(IP_VS_SO_GET_INFO)] = GET_INFO_ARG_LEN,
2367 [GET_CMDID(IP_VS_SO_GET_SERVICES)] = GET_SERVICES_ARG_LEN,
2368 [GET_CMDID(IP_VS_SO_GET_SERVICE)] = GET_SERVICE_ARG_LEN,
2369 [GET_CMDID(IP_VS_SO_GET_DESTS)] = GET_DESTS_ARG_LEN,
2370 [GET_CMDID(IP_VS_SO_GET_TIMEOUT)] = GET_TIMEOUT_ARG_LEN,
2371 [GET_CMDID(IP_VS_SO_GET_DAEMON)] = GET_DAEMON_ARG_LEN,
2372};
2373
2374static int
2375do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2376{
2377 unsigned char arg[128];
2378 int ret = 0;
04bcef2a 2379 unsigned int copylen;
1da177e4
LT		 2380
2381 if (!capable(CAP_NET_ADMIN))
2382 return -EPERM;
2383
04bcef2a
AV		 2384 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2385 return -EINVAL;
2386
1da177e4 2387 if (*len < get_arglen[GET_CMDID(cmd)]) {
1e3e238e
HE		 2388 pr_err("get_ctl: len %u < %u\n",
2389 *len, get_arglen[GET_CMDID(cmd)]);
1da177e4
LT		 2390 return -EINVAL;
2391 }
2392
04bcef2a
AV		 2393 copylen = get_arglen[GET_CMDID(cmd)];
2394 if (copylen > 128)
2395 return -EINVAL;
2396
2397 if (copy_from_user(arg, user, copylen) != 0)
1da177e4
LT		 2398 return -EFAULT;
2399
14cc3e2b 2400 if (mutex_lock_interruptible(&__ip_vs_mutex))
1da177e4
LT		 2401 return -ERESTARTSYS;
2402
2403 switch (cmd) {
2404 case IP_VS_SO_GET_VERSION:
2405 {
2406 char buf[64];
2407
2408 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
6f7edb48 2409 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1da177e4
LT		 2410 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2411 ret = -EFAULT;
2412 goto out;
2413 }
2414 *len = strlen(buf)+1;
2415 }
2416 break;
2417
2418 case IP_VS_SO_GET_INFO:
2419 {
2420 struct ip_vs_getinfo info;
2421 info.version = IP_VS_VERSION_CODE;
6f7edb48 2422 info.size = ip_vs_conn_tab_size;
1da177e4
LT		 2423 info.num_services = ip_vs_num_services;
2424 if (copy_to_user(user, &info, sizeof(info)) != 0)
2425 ret = -EFAULT;
2426 }
2427 break;
2428
2429 case IP_VS_SO_GET_SERVICES:
2430 {
2431 struct ip_vs_get_services *get;
2432 int size;
2433
2434 get = (struct ip_vs_get_services *)arg;
2435 size = sizeof(*get) +
2436 sizeof(struct ip_vs_service_entry) * get->num_services;
2437 if (*len != size) {
1e3e238e 2438 pr_err("length: %u != %u\n", *len, size);
1da177e4
LT		 2439 ret = -EINVAL;
2440 goto out;
2441 }
2442 ret = __ip_vs_get_service_entries(get, user);
2443 }
2444 break;
2445
2446 case IP_VS_SO_GET_SERVICE:
2447 {
2448 struct ip_vs_service_entry *entry;
2449 struct ip_vs_service *svc;
b18610de 2450 union nf_inet_addr addr;
1da177e4
LT		 2451
2452 entry = (struct ip_vs_service_entry *)arg;
b18610de 2453 addr.ip = entry->addr;
1da177e4 2454 if (entry->fwmark)
26c15cfd 2455 svc = __ip_vs_svc_fwm_find(AF_INET, entry->fwmark);
1da177e4 2456 else
26c15cfd
JA		 2457 svc = __ip_vs_service_find(AF_INET, entry->protocol,
2458 &addr, entry->port);
1da177e4
LT		 2459 if (svc) {
2460 ip_vs_copy_service(entry, svc);
2461 if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2462 ret = -EFAULT;
1da177e4
LT		 2463 } else
2464 ret = -ESRCH;
2465 }
2466 break;
2467
2468 case IP_VS_SO_GET_DESTS:
2469 {
2470 struct ip_vs_get_dests *get;
2471 int size;
2472
2473 get = (struct ip_vs_get_dests *)arg;
2474 size = sizeof(*get) +
2475 sizeof(struct ip_vs_dest_entry) * get->num_dests;
2476 if (*len != size) {
1e3e238e 2477 pr_err("length: %u != %u\n", *len, size);
1da177e4
LT		 2478 ret = -EINVAL;
2479 goto out;
2480 }
2481 ret = __ip_vs_get_dest_entries(get, user);
2482 }
2483 break;
2484
2485 case IP_VS_SO_GET_TIMEOUT:
2486 {
2487 struct ip_vs_timeout_user t;
2488
2489 __ip_vs_get_timeouts(&t);
2490 if (copy_to_user(user, &t, sizeof(t)) != 0)
2491 ret = -EFAULT;
2492 }
2493 break;
2494
2495 case IP_VS_SO_GET_DAEMON:
2496 {
2497 struct ip_vs_daemon_user d[2];
2498
2499 memset(&d, 0, sizeof(d));
2500 if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
2501 d[0].state = IP_VS_STATE_MASTER;
4da62fc7 2502 strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
1da177e4
LT		 2503 d[0].syncid = ip_vs_master_syncid;
2504 }
2505 if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
2506 d[1].state = IP_VS_STATE_BACKUP;
4da62fc7 2507 strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
1da177e4
LT		 2508 d[1].syncid = ip_vs_backup_syncid;
2509 }
2510 if (copy_to_user(user, &d, sizeof(d)) != 0)
2511 ret = -EFAULT;
2512 }
2513 break;
2514
2515 default:
2516 ret = -EINVAL;
2517 }
2518
2519 out:
14cc3e2b 2520 mutex_unlock(&__ip_vs_mutex);
1da177e4
LT		 2521 return ret;
2522}
2523
2524
2525static struct nf_sockopt_ops ip_vs_sockopts = {
2526 .pf = PF_INET,
2527 .set_optmin = IP_VS_BASE_CTL,
2528 .set_optmax = IP_VS_SO_SET_MAX+1,
2529 .set = do_ip_vs_set_ctl,
2530 .get_optmin = IP_VS_BASE_CTL,
2531 .get_optmax = IP_VS_SO_GET_MAX+1,
2532 .get = do_ip_vs_get_ctl,
16fcec35 2533 .owner = THIS_MODULE,
1da177e4
LT		 2534};
2535
9a812198
JV		 2536/*
2537 * Generic Netlink interface
2538 */
2539
2540/* IPVS genetlink family */
2541static struct genl_family ip_vs_genl_family = {
2542 .id = GENL_ID_GENERATE,
2543 .hdrsize = 0,
2544 .name = IPVS_GENL_NAME,
2545 .version = IPVS_GENL_VERSION,
2546 .maxattr = IPVS_CMD_MAX,
2547};
2548
2549/* Policy used for first-level command attributes */
2550static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2551 [IPVS_CMD_ATTR_SERVICE] = { .type = NLA_NESTED },
2552 [IPVS_CMD_ATTR_DEST] = { .type = NLA_NESTED },
2553 [IPVS_CMD_ATTR_DAEMON] = { .type = NLA_NESTED },
2554 [IPVS_CMD_ATTR_TIMEOUT_TCP] = { .type = NLA_U32 },
2555 [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2556 [IPVS_CMD_ATTR_TIMEOUT_UDP] = { .type = NLA_U32 },
2557};
2558
2559/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2560static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2561 [IPVS_DAEMON_ATTR_STATE] = { .type = NLA_U32 },
2562 [IPVS_DAEMON_ATTR_MCAST_IFN] = { .type = NLA_NUL_STRING,
2563 .len = IP_VS_IFNAME_MAXLEN },
2564 [IPVS_DAEMON_ATTR_SYNC_ID] = { .type = NLA_U32 },
2565};
2566
2567/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2568static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2569 [IPVS_SVC_ATTR_AF] = { .type = NLA_U16 },
2570 [IPVS_SVC_ATTR_PROTOCOL] = { .type = NLA_U16 },
2571 [IPVS_SVC_ATTR_ADDR] = { .type = NLA_BINARY,
2572 .len = sizeof(union nf_inet_addr) },
2573 [IPVS_SVC_ATTR_PORT] = { .type = NLA_U16 },
2574 [IPVS_SVC_ATTR_FWMARK] = { .type = NLA_U32 },
2575 [IPVS_SVC_ATTR_SCHED_NAME] = { .type = NLA_NUL_STRING,
2576 .len = IP_VS_SCHEDNAME_MAXLEN },
0d1e71b0
SH		 2577 [IPVS_SVC_ATTR_PE_NAME] = { .type = NLA_NUL_STRING,
2578 .len = IP_VS_PENAME_MAXLEN },
9a812198
JV		 2579 [IPVS_SVC_ATTR_FLAGS] = { .type = NLA_BINARY,
2580 .len = sizeof(struct ip_vs_flags) },
2581 [IPVS_SVC_ATTR_TIMEOUT] = { .type = NLA_U32 },
2582 [IPVS_SVC_ATTR_NETMASK] = { .type = NLA_U32 },
2583 [IPVS_SVC_ATTR_STATS] = { .type = NLA_NESTED },
2584};
2585
2586/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2587static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2588 [IPVS_DEST_ATTR_ADDR] = { .type = NLA_BINARY,
2589 .len = sizeof(union nf_inet_addr) },
2590 [IPVS_DEST_ATTR_PORT] = { .type = NLA_U16 },
2591 [IPVS_DEST_ATTR_FWD_METHOD] = { .type = NLA_U32 },
2592 [IPVS_DEST_ATTR_WEIGHT] = { .type = NLA_U32 },
2593 [IPVS_DEST_ATTR_U_THRESH] = { .type = NLA_U32 },
2594 [IPVS_DEST_ATTR_L_THRESH] = { .type = NLA_U32 },
2595 [IPVS_DEST_ATTR_ACTIVE_CONNS] = { .type = NLA_U32 },
2596 [IPVS_DEST_ATTR_INACT_CONNS] = { .type = NLA_U32 },
2597 [IPVS_DEST_ATTR_PERSIST_CONNS] = { .type = NLA_U32 },
2598 [IPVS_DEST_ATTR_STATS] = { .type = NLA_NESTED },
2599};
2600
2601static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2602 struct ip_vs_stats *stats)
2603{
2604 struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2605 if (!nl_stats)
2606 return -EMSGSIZE;
2607
2608 spin_lock_bh(&stats->lock);
2609
e9c0ce23
SW		 2610 NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, stats->ustats.conns);
2611 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, stats->ustats.inpkts);
2612 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, stats->ustats.outpkts);
2613 NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, stats->ustats.inbytes);
2614 NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, stats->ustats.outbytes);
2615 NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, stats->ustats.cps);
2616 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, stats->ustats.inpps);
2617 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, stats->ustats.outpps);
2618 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, stats->ustats.inbps);
2619 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, stats->ustats.outbps);
9a812198
JV		 2620
2621 spin_unlock_bh(&stats->lock);
2622
2623 nla_nest_end(skb, nl_stats);
2624
2625 return 0;
2626
2627nla_put_failure:
2628 spin_unlock_bh(&stats->lock);
2629 nla_nest_cancel(skb, nl_stats);
2630 return -EMSGSIZE;
2631}
2632
2633static int ip_vs_genl_fill_service(struct sk_buff *skb,
2634 struct ip_vs_service *svc)
2635{
2636 struct nlattr *nl_service;
2637 struct ip_vs_flags flags = { .flags = svc->flags,
2638 .mask = ~0 };
2639
2640 nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2641 if (!nl_service)
2642 return -EMSGSIZE;
2643
f94fd041 2644 NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
9a812198
JV		 2645
2646 if (svc->fwmark) {
2647 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2648 } else {
2649 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2650 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2651 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2652 }
2653
2654 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
0d1e71b0
SH		 2655 if (svc->pe)
2656 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name);
9a812198
JV		 2657 NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2658 NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2659 NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2660
2661 if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2662 goto nla_put_failure;
2663
2664 nla_nest_end(skb, nl_service);
2665
2666 return 0;
2667
2668nla_put_failure:
2669 nla_nest_cancel(skb, nl_service);
2670 return -EMSGSIZE;
2671}
2672
2673static int ip_vs_genl_dump_service(struct sk_buff *skb,
2674 struct ip_vs_service *svc,
2675 struct netlink_callback *cb)
2676{
2677 void *hdr;
2678
2679 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2680 &ip_vs_genl_family, NLM_F_MULTI,
2681 IPVS_CMD_NEW_SERVICE);
2682 if (!hdr)
2683 return -EMSGSIZE;
2684
2685 if (ip_vs_genl_fill_service(skb, svc) < 0)
2686 goto nla_put_failure;
2687
2688 return genlmsg_end(skb, hdr);
2689
2690nla_put_failure:
2691 genlmsg_cancel(skb, hdr);
2692 return -EMSGSIZE;
2693}
2694
2695static int ip_vs_genl_dump_services(struct sk_buff *skb,
2696 struct netlink_callback *cb)
2697{
2698 int idx = 0, i;
2699 int start = cb->args[0];
2700 struct ip_vs_service *svc;
2701
2702 mutex_lock(&__ip_vs_mutex);
2703 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2704 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2705 if (++idx <= start)
2706 continue;
2707 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2708 idx--;
2709 goto nla_put_failure;
2710 }
2711 }
2712 }
2713
2714 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2715 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2716 if (++idx <= start)
2717 continue;
2718 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2719 idx--;
2720 goto nla_put_failure;
2721 }
2722 }
2723 }
2724
2725nla_put_failure:
2726 mutex_unlock(&__ip_vs_mutex);
2727 cb->args[0] = idx;
2728
2729 return skb->len;
2730}
2731
c860c6b1 2732static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
26c15cfd
JA		 2733 struct nlattr *nla, int full_entry,
2734 struct ip_vs_service **ret_svc)
9a812198
JV		 2735{
2736 struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2737 struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
26c15cfd 2738 struct ip_vs_service *svc;
9a812198
JV		 2739
2740 /* Parse mandatory identifying service fields first */
2741 if (nla == NULL ||
2742 nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2743 return -EINVAL;
2744
2745 nla_af = attrs[IPVS_SVC_ATTR_AF];
2746 nla_protocol = attrs[IPVS_SVC_ATTR_PROTOCOL];
2747 nla_addr = attrs[IPVS_SVC_ATTR_ADDR];
2748 nla_port = attrs[IPVS_SVC_ATTR_PORT];
2749 nla_fwmark = attrs[IPVS_SVC_ATTR_FWMARK];
2750
2751 if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2752 return -EINVAL;
2753
258c8893
SH		 2754 memset(usvc, 0, sizeof(*usvc));
2755
c860c6b1 2756 usvc->af = nla_get_u16(nla_af);
f94fd041
JV		 2757#ifdef CONFIG_IP_VS_IPV6
2758 if (usvc->af != AF_INET && usvc->af != AF_INET6)
2759#else
2760 if (usvc->af != AF_INET)
2761#endif
9a812198
JV		 2762 return -EAFNOSUPPORT;
2763
2764 if (nla_fwmark) {
2765 usvc->protocol = IPPROTO_TCP;
2766 usvc->fwmark = nla_get_u32(nla_fwmark);
2767 } else {
2768 usvc->protocol = nla_get_u16(nla_protocol);
2769 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2770 usvc->port = nla_get_u16(nla_port);
2771 usvc->fwmark = 0;
2772 }
2773
26c15cfd
JA		 2774 if (usvc->fwmark)
2775 svc = __ip_vs_svc_fwm_find(usvc->af, usvc->fwmark);
2776 else
2777 svc = __ip_vs_service_find(usvc->af, usvc->protocol,
2778 &usvc->addr, usvc->port);
2779 *ret_svc = svc;
2780
9a812198
JV		 2781 /* If a full entry was requested, check for the additional fields */
2782 if (full_entry) {
0d1e71b0 2783 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
9a812198
JV		 2784 *nla_netmask;
2785 struct ip_vs_flags flags;
9a812198
JV		 2786
2787 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
0d1e71b0 2788 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
9a812198
JV		 2789 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2790 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2791 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2792
2793 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
2794 return -EINVAL;
2795
2796 nla_memcpy(&flags, nla_flags, sizeof(flags));
2797
2798 /* prefill flags from service if it already exists */
26c15cfd 2799 if (svc)
9a812198 2800 usvc->flags = svc->flags;
9a812198
JV		 2801
2802 /* set new flags from userland */
2803 usvc->flags = (usvc->flags & ~flags.mask) |
2804 (flags.flags & flags.mask);
c860c6b1 2805 usvc->sched_name = nla_data(nla_sched);
0d1e71b0 2806 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
9a812198
JV		 2807 usvc->timeout = nla_get_u32(nla_timeout);
2808 usvc->netmask = nla_get_u32(nla_netmask);
2809 }
2810
2811 return 0;
2812}
2813
2814static struct ip_vs_service *ip_vs_genl_find_service(struct nlattr *nla)
2815{
c860c6b1 2816 struct ip_vs_service_user_kern usvc;
26c15cfd 2817 struct ip_vs_service *svc;
9a812198
JV		 2818 int ret;
2819
26c15cfd
JA		 2820 ret = ip_vs_genl_parse_service(&usvc, nla, 0, &svc);
2821 return ret ? ERR_PTR(ret) : svc;
9a812198
JV		 2822}
2823
2824static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
2825{
2826 struct nlattr *nl_dest;
2827
2828 nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
2829 if (!nl_dest)
2830 return -EMSGSIZE;
2831
2832 NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
2833 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
2834
2835 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
2836 atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
2837 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
2838 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
2839 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
2840 NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
2841 atomic_read(&dest->activeconns));
2842 NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
2843 atomic_read(&dest->inactconns));
2844 NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
2845 atomic_read(&dest->persistconns));
2846
2847 if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
2848 goto nla_put_failure;
2849
2850 nla_nest_end(skb, nl_dest);
2851
2852 return 0;
2853
2854nla_put_failure:
2855 nla_nest_cancel(skb, nl_dest);
2856 return -EMSGSIZE;
2857}
2858
2859static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
2860 struct netlink_callback *cb)
2861{
2862 void *hdr;
2863
2864 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2865 &ip_vs_genl_family, NLM_F_MULTI,
2866 IPVS_CMD_NEW_DEST);
2867 if (!hdr)
2868 return -EMSGSIZE;
2869
2870 if (ip_vs_genl_fill_dest(skb, dest) < 0)
2871 goto nla_put_failure;
2872
2873 return genlmsg_end(skb, hdr);
2874
2875nla_put_failure:
2876 genlmsg_cancel(skb, hdr);
2877 return -EMSGSIZE;
2878}
2879
2880static int ip_vs_genl_dump_dests(struct sk_buff *skb,
2881 struct netlink_callback *cb)
2882{
2883 int idx = 0;
2884 int start = cb->args[0];
2885 struct ip_vs_service *svc;
2886 struct ip_vs_dest *dest;
2887 struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
2888
2889 mutex_lock(&__ip_vs_mutex);
2890
2891 /* Try to find the service for which to dump destinations */
2892 if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
2893 IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
2894 goto out_err;
2895
2896 svc = ip_vs_genl_find_service(attrs[IPVS_CMD_ATTR_SERVICE]);
2897 if (IS_ERR(svc) || svc == NULL)
2898 goto out_err;
2899
2900 /* Dump the destinations */
2901 list_for_each_entry(dest, &svc->destinations, n_list) {
2902 if (++idx <= start)
2903 continue;
2904 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
2905 idx--;
2906 goto nla_put_failure;
2907 }
2908 }
2909
2910nla_put_failure:
2911 cb->args[0] = idx;
9a812198
JV		 2912
2913out_err:
2914 mutex_unlock(&__ip_vs_mutex);
2915
2916 return skb->len;
2917}
2918
c860c6b1 2919static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
9a812198
JV		 2920 struct nlattr *nla, int full_entry)
2921{
2922 struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
2923 struct nlattr *nla_addr, *nla_port;
2924
2925 /* Parse mandatory identifying destination fields first */
2926 if (nla == NULL ||
2927 nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
2928 return -EINVAL;
2929
2930 nla_addr = attrs[IPVS_DEST_ATTR_ADDR];
2931 nla_port = attrs[IPVS_DEST_ATTR_PORT];
2932
2933 if (!(nla_addr && nla_port))
2934 return -EINVAL;
2935
258c8893
SH		 2936 memset(udest, 0, sizeof(*udest));
2937
9a812198
JV		 2938 nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
2939 udest->port = nla_get_u16(nla_port);
2940
2941 /* If a full entry was requested, check for the additional fields */
2942 if (full_entry) {
2943 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
2944 *nla_l_thresh;
2945
2946 nla_fwd = attrs[IPVS_DEST_ATTR_FWD_METHOD];
2947 nla_weight = attrs[IPVS_DEST_ATTR_WEIGHT];
2948 nla_u_thresh = attrs[IPVS_DEST_ATTR_U_THRESH];
2949 nla_l_thresh = attrs[IPVS_DEST_ATTR_L_THRESH];
2950
2951 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
2952 return -EINVAL;
2953
2954 udest->conn_flags = nla_get_u32(nla_fwd)
2955 & IP_VS_CONN_F_FWD_MASK;
2956 udest->weight = nla_get_u32(nla_weight);
2957 udest->u_threshold = nla_get_u32(nla_u_thresh);
2958 udest->l_threshold = nla_get_u32(nla_l_thresh);
2959 }
2960
2961 return 0;
2962}
2963
2964static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
2965 const char *mcast_ifn, __be32 syncid)
2966{
2967 struct nlattr *nl_daemon;
2968
2969 nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
2970 if (!nl_daemon)
2971 return -EMSGSIZE;
2972
2973 NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
2974 NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
2975 NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
2976
2977 nla_nest_end(skb, nl_daemon);
2978
2979 return 0;
2980
2981nla_put_failure:
2982 nla_nest_cancel(skb, nl_daemon);
2983 return -EMSGSIZE;
2984}
2985
2986static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
2987 const char *mcast_ifn, __be32 syncid,
2988 struct netlink_callback *cb)
2989{
2990 void *hdr;
2991 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2992 &ip_vs_genl_family, NLM_F_MULTI,
2993 IPVS_CMD_NEW_DAEMON);
2994 if (!hdr)
2995 return -EMSGSIZE;
2996
2997 if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
2998 goto nla_put_failure;
2999
3000 return genlmsg_end(skb, hdr);
3001
3002nla_put_failure:
3003 genlmsg_cancel(skb, hdr);
3004 return -EMSGSIZE;
3005}
3006
3007static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3008 struct netlink_callback *cb)
3009{
3010 mutex_lock(&__ip_vs_mutex);
3011 if ((ip_vs_sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3012 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3013 ip_vs_master_mcast_ifn,
3014 ip_vs_master_syncid, cb) < 0)
3015 goto nla_put_failure;
3016
3017 cb->args[0] = 1;
3018 }
3019
3020 if ((ip_vs_sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3021 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3022 ip_vs_backup_mcast_ifn,
3023 ip_vs_backup_syncid, cb) < 0)
3024 goto nla_put_failure;
3025
3026 cb->args[1] = 1;
3027 }
3028
3029nla_put_failure:
3030 mutex_unlock(&__ip_vs_mutex);
3031
3032 return skb->len;
3033}
3034
3035static int ip_vs_genl_new_daemon(struct nlattr **attrs)
3036{
3037 if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3038 attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3039 attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3040 return -EINVAL;
3041
3042 return start_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3043 nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3044 nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3045}
3046
3047static int ip_vs_genl_del_daemon(struct nlattr **attrs)
3048{
3049 if (!attrs[IPVS_DAEMON_ATTR_STATE])
3050 return -EINVAL;
3051
3052 return stop_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3053}
3054
3055static int ip_vs_genl_set_config(struct nlattr **attrs)
3056{
3057 struct ip_vs_timeout_user t;
3058
3059 __ip_vs_get_timeouts(&t);
3060
3061 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3062 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3063
3064 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3065 t.tcp_fin_timeout =
3066 nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3067
3068 if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3069 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3070
3071 return ip_vs_set_timeout(&t);
3072}
3073
3074static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3075{
3076 struct ip_vs_service *svc = NULL;
c860c6b1
JV		 3077 struct ip_vs_service_user_kern usvc;
3078 struct ip_vs_dest_user_kern udest;
9a812198
JV		 3079 int ret = 0, cmd;
3080 int need_full_svc = 0, need_full_dest = 0;
3081
3082 cmd = info->genlhdr->cmd;
3083
3084 mutex_lock(&__ip_vs_mutex);
3085
3086 if (cmd == IPVS_CMD_FLUSH) {
3087 ret = ip_vs_flush();
3088 goto out;
3089 } else if (cmd == IPVS_CMD_SET_CONFIG) {
3090 ret = ip_vs_genl_set_config(info->attrs);
3091 goto out;
3092 } else if (cmd == IPVS_CMD_NEW_DAEMON ||
3093 cmd == IPVS_CMD_DEL_DAEMON) {
3094
3095 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3096
3097 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3098 nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3099 info->attrs[IPVS_CMD_ATTR_DAEMON],
3100 ip_vs_daemon_policy)) {
3101 ret = -EINVAL;
3102 goto out;
3103 }
3104
3105 if (cmd == IPVS_CMD_NEW_DAEMON)
3106 ret = ip_vs_genl_new_daemon(daemon_attrs);
3107 else
3108 ret = ip_vs_genl_del_daemon(daemon_attrs);
3109 goto out;
3110 } else if (cmd == IPVS_CMD_ZERO &&
3111 !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3112 ret = ip_vs_zero_all();
3113 goto out;
3114 }
3115
3116 /* All following commands require a service argument, so check if we
3117 * received a valid one. We need a full service specification when
3118 * adding / editing a service. Only identifying members otherwise. */
3119 if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3120 need_full_svc = 1;
3121
3122 ret = ip_vs_genl_parse_service(&usvc,
3123 info->attrs[IPVS_CMD_ATTR_SERVICE],
26c15cfd 3124 need_full_svc, &svc);
9a812198
JV		 3125 if (ret)
3126 goto out;
3127
9a812198
JV		 3128 /* Unless we're adding a new service, the service must already exist */
3129 if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3130 ret = -ESRCH;
3131 goto out;
3132 }
3133
3134 /* Destination commands require a valid destination argument. For
3135 * adding / editing a destination, we need a full destination
3136 * specification. */
3137 if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3138 cmd == IPVS_CMD_DEL_DEST) {
3139 if (cmd != IPVS_CMD_DEL_DEST)
3140 need_full_dest = 1;
3141
3142 ret = ip_vs_genl_parse_dest(&udest,
3143 info->attrs[IPVS_CMD_ATTR_DEST],
3144 need_full_dest);
3145 if (ret)
3146 goto out;
3147 }
3148
3149 switch (cmd) {
3150 case IPVS_CMD_NEW_SERVICE:
3151 if (svc == NULL)
3152 ret = ip_vs_add_service(&usvc, &svc);
3153 else
3154 ret = -EEXIST;
3155 break;
3156 case IPVS_CMD_SET_SERVICE:
3157 ret = ip_vs_edit_service(svc, &usvc);
3158 break;
3159 case IPVS_CMD_DEL_SERVICE:
3160 ret = ip_vs_del_service(svc);
26c15cfd 3161 /* do not use svc, it can be freed */
9a812198
JV		 3162 break;
3163 case IPVS_CMD_NEW_DEST:
3164 ret = ip_vs_add_dest(svc, &udest);
3165 break;
3166 case IPVS_CMD_SET_DEST:
3167 ret = ip_vs_edit_dest(svc, &udest);
3168 break;
3169 case IPVS_CMD_DEL_DEST:
3170 ret = ip_vs_del_dest(svc, &udest);
3171 break;
3172 case IPVS_CMD_ZERO:
3173 ret = ip_vs_zero_service(svc);
3174 break;
3175 default:
3176 ret = -EINVAL;
3177 }
3178
3179out:
9a812198
JV		 3180 mutex_unlock(&__ip_vs_mutex);
3181
3182 return ret;
3183}
3184
3185static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3186{
3187 struct sk_buff *msg;
3188 void *reply;
3189 int ret, cmd, reply_cmd;
3190
3191 cmd = info->genlhdr->cmd;
3192
3193 if (cmd == IPVS_CMD_GET_SERVICE)
3194 reply_cmd = IPVS_CMD_NEW_SERVICE;
3195 else if (cmd == IPVS_CMD_GET_INFO)
3196 reply_cmd = IPVS_CMD_SET_INFO;
3197 else if (cmd == IPVS_CMD_GET_CONFIG)
3198 reply_cmd = IPVS_CMD_SET_CONFIG;
3199 else {
1e3e238e 3200 pr_err("unknown Generic Netlink command\n");
9a812198
JV		 3201 return -EINVAL;
3202 }
3203
3204 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3205 if (!msg)
3206 return -ENOMEM;
3207
3208 mutex_lock(&__ip_vs_mutex);
3209
3210 reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3211 if (reply == NULL)
3212 goto nla_put_failure;
3213
3214 switch (cmd) {
3215 case IPVS_CMD_GET_SERVICE:
3216 {
3217 struct ip_vs_service *svc;
3218
3219 svc = ip_vs_genl_find_service(info->attrs[IPVS_CMD_ATTR_SERVICE]);
3220 if (IS_ERR(svc)) {
3221 ret = PTR_ERR(svc);
3222 goto out_err;
3223 } else if (svc) {
3224 ret = ip_vs_genl_fill_service(msg, svc);
9a812198
JV		 3225 if (ret)
3226 goto nla_put_failure;
3227 } else {
3228 ret = -ESRCH;
3229 goto out_err;
3230 }
3231
3232 break;
3233 }
3234
3235 case IPVS_CMD_GET_CONFIG:
3236 {
3237 struct ip_vs_timeout_user t;
3238
3239 __ip_vs_get_timeouts(&t);
3240#ifdef CONFIG_IP_VS_PROTO_TCP
3241 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3242 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3243 t.tcp_fin_timeout);
3244#endif
3245#ifdef CONFIG_IP_VS_PROTO_UDP
3246 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3247#endif
3248
3249 break;
3250 }
3251
3252 case IPVS_CMD_GET_INFO:
3253 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3254 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
6f7edb48 3255 ip_vs_conn_tab_size);
9a812198
JV		 3256 break;
3257 }
3258
3259 genlmsg_end(msg, reply);
134e6375 3260 ret = genlmsg_reply(msg, info);
9a812198
JV		 3261 goto out;
3262
3263nla_put_failure:
1e3e238e 3264 pr_err("not enough space in Netlink message\n");
9a812198
JV		 3265 ret = -EMSGSIZE;
3266
3267out_err:
3268 nlmsg_free(msg);
3269out:
3270 mutex_unlock(&__ip_vs_mutex);
3271
3272 return ret;
3273}
3274
3275
3276static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3277 {
3278 .cmd = IPVS_CMD_NEW_SERVICE,
3279 .flags = GENL_ADMIN_PERM,
3280 .policy = ip_vs_cmd_policy,
3281 .doit = ip_vs_genl_set_cmd,
3282 },
3283 {
3284 .cmd = IPVS_CMD_SET_SERVICE,
3285 .flags = GENL_ADMIN_PERM,
3286 .policy = ip_vs_cmd_policy,
3287 .doit = ip_vs_genl_set_cmd,
3288 },
3289 {
3290 .cmd = IPVS_CMD_DEL_SERVICE,
3291 .flags = GENL_ADMIN_PERM,
3292 .policy = ip_vs_cmd_policy,
3293 .doit = ip_vs_genl_set_cmd,
3294 },
3295 {
3296 .cmd = IPVS_CMD_GET_SERVICE,
3297 .flags = GENL_ADMIN_PERM,
3298 .doit = ip_vs_genl_get_cmd,
3299 .dumpit = ip_vs_genl_dump_services,
3300 .policy = ip_vs_cmd_policy,
3301 },
3302 {
3303 .cmd = IPVS_CMD_NEW_DEST,
3304 .flags = GENL_ADMIN_PERM,
3305 .policy = ip_vs_cmd_policy,
3306 .doit = ip_vs_genl_set_cmd,
3307 },
3308 {
3309 .cmd = IPVS_CMD_SET_DEST,
3310 .flags = GENL_ADMIN_PERM,
3311 .policy = ip_vs_cmd_policy,
3312 .doit = ip_vs_genl_set_cmd,
3313 },
3314 {
3315 .cmd = IPVS_CMD_DEL_DEST,
3316 .flags = GENL_ADMIN_PERM,
3317 .policy = ip_vs_cmd_policy,
3318 .doit = ip_vs_genl_set_cmd,
3319 },
3320 {
3321 .cmd = IPVS_CMD_GET_DEST,
3322 .flags = GENL_ADMIN_PERM,
3323 .policy = ip_vs_cmd_policy,
3324 .dumpit = ip_vs_genl_dump_dests,
3325 },
3326 {
3327 .cmd = IPVS_CMD_NEW_DAEMON,
3328 .flags = GENL_ADMIN_PERM,
3329 .policy = ip_vs_cmd_policy,
3330 .doit = ip_vs_genl_set_cmd,
3331 },
3332 {
3333 .cmd = IPVS_CMD_DEL_DAEMON,
3334 .flags = GENL_ADMIN_PERM,
3335 .policy = ip_vs_cmd_policy,
3336 .doit = ip_vs_genl_set_cmd,
3337 },
3338 {
3339 .cmd = IPVS_CMD_GET_DAEMON,
3340 .flags = GENL_ADMIN_PERM,
3341 .dumpit = ip_vs_genl_dump_daemons,
3342 },
3343 {
3344 .cmd = IPVS_CMD_SET_CONFIG,
3345 .flags = GENL_ADMIN_PERM,
3346 .policy = ip_vs_cmd_policy,
3347 .doit = ip_vs_genl_set_cmd,
3348 },
3349 {
3350 .cmd = IPVS_CMD_GET_CONFIG,
3351 .flags = GENL_ADMIN_PERM,
3352 .doit = ip_vs_genl_get_cmd,
3353 },
3354 {
3355 .cmd = IPVS_CMD_GET_INFO,
3356 .flags = GENL_ADMIN_PERM,
3357 .doit = ip_vs_genl_get_cmd,
3358 },
3359 {
3360 .cmd = IPVS_CMD_ZERO,
3361 .flags = GENL_ADMIN_PERM,
3362 .policy = ip_vs_cmd_policy,
3363 .doit = ip_vs_genl_set_cmd,
3364 },
3365 {
3366 .cmd = IPVS_CMD_FLUSH,
3367 .flags = GENL_ADMIN_PERM,
3368 .doit = ip_vs_genl_set_cmd,
3369 },
3370};
3371
3372static int __init ip_vs_genl_register(void)
3373{
8f698d54
MM		 3374 return genl_register_family_with_ops(&ip_vs_genl_family,
3375 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
9a812198
JV		 3376}
3377
3378static void ip_vs_genl_unregister(void)
3379{
3380 genl_unregister_family(&ip_vs_genl_family);
3381}
3382
3383/* End of Generic Netlink interface definitions */
3384
1da177e4 3385
048cf48b 3386int __init ip_vs_control_init(void)
1da177e4
LT		 3387{
3388 int ret;
3389 int idx;
3390
3391 EnterFunction(2);
3392
d86bef73
EB		 3393 /* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */
3394 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3395 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3396 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3397 }
3398 for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++) {
3399 INIT_LIST_HEAD(&ip_vs_rtable[idx]);
3400 }
3401 smp_wmb();
3402
1da177e4
LT		 3403 ret = nf_register_sockopt(&ip_vs_sockopts);
3404 if (ret) {
1e3e238e 3405 pr_err("cannot register sockopt.\n");
1da177e4
LT		 3406 return ret;
3407 }
3408
9a812198
JV		 3409 ret = ip_vs_genl_register();
3410 if (ret) {
1e3e238e 3411 pr_err("cannot register Generic Netlink interface.\n");
9a812198
JV		 3412 nf_unregister_sockopt(&ip_vs_sockopts);
3413 return ret;
3414 }
3415
457c4cbc
EB		 3416 proc_net_fops_create(&init_net, "ip_vs", 0, &ip_vs_info_fops);
3417 proc_net_fops_create(&init_net, "ip_vs_stats",0, &ip_vs_stats_fops);
1da177e4 3418
90754f8e 3419 sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars);
1da177e4 3420
1da177e4
LT		 3421 ip_vs_new_estimator(&ip_vs_stats);
3422
3423 /* Hook the defense timer */
3424 schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
3425
3426 LeaveFunction(2);
3427 return 0;
3428}
3429
3430
3431void ip_vs_control_cleanup(void)
3432{
3433 EnterFunction(2);
3434 ip_vs_trash_cleanup();
3435 cancel_rearming_delayed_work(&defense_work);
28e53bdd 3436 cancel_work_sync(&defense_work.work);
1da177e4
LT		 3437 ip_vs_kill_estimator(&ip_vs_stats);
3438 unregister_sysctl_table(sysctl_header);
457c4cbc
EB		 3439 proc_net_remove(&init_net, "ip_vs_stats");
3440 proc_net_remove(&init_net, "ip_vs");
9a812198 3441 ip_vs_genl_unregister();
1da177e4
LT		 3442 nf_unregister_sockopt(&ip_vs_sockopts);
3443 LeaveFunction(2);
3444}
Clone of davem's net-next-2.6 tree