net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <net/ip.h>
  42 #ifdef CONFIG_IP_VS_IPV6
  43 #include <net/ipv6.h>
  44 #include <net/ip6_route.h>
  45 #endif
  46 #include <net/route.h>
  47 #include <net/sock.h>
  48 #include <net/genetlink.h>
  49
  50 #include <asm/uaccess.h>
  51
  52 #include <net/ip_vs.h>
  53
  54 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  55 static DEFINE_MUTEX(__ip_vs_mutex);
  56
  57 /* lock for service table */
  58 static DEFINE_RWLOCK(__ip_vs_svc_lock);
  59
  60 /* lock for table with the real services */
  61 static DEFINE_RWLOCK(__ip_vs_rs_lock);
  62
  63 /* lock for state and timeout tables */
  64 static DEFINE_RWLOCK(__ip_vs_securetcp_lock);
  65
  66 /* lock for drop entry handling */
  67 static DEFINE_SPINLOCK(__ip_vs_dropentry_lock);
  68
  69 /* lock for drop packet handling */
  70 static DEFINE_SPINLOCK(__ip_vs_droppacket_lock);
  71
  72 /* 1/rate drop and drop-entry variables */
  73 int ip_vs_drop_rate = 0;
  74 int ip_vs_drop_counter = 0;
  75 static atomic_t ip_vs_dropentry = ATOMIC_INIT(0);
  76
  77 /* number of virtual services */
  78 static int ip_vs_num_services = 0;
  79
  80 /* sysctl variables */
  81 static int sysctl_ip_vs_drop_entry = 0;
  82 static int sysctl_ip_vs_drop_packet = 0;
  83 static int sysctl_ip_vs_secure_tcp = 0;
  84 static int sysctl_ip_vs_amemthresh = 1024;
  85 static int sysctl_ip_vs_am_droprate = 10;
  86 int sysctl_ip_vs_cache_bypass = 0;
  87 int sysctl_ip_vs_expire_nodest_conn = 0;
  88 int sysctl_ip_vs_expire_quiescent_template = 0;
  89 int sysctl_ip_vs_sync_threshold[2] = { 3, 50 };
  90 int sysctl_ip_vs_nat_icmp_send = 0;
  91
  92
  93 #ifdef CONFIG_IP_VS_DEBUG
  94 static int sysctl_ip_vs_debug_level = 0;
  95
  96 int ip_vs_get_debug_level(void)
  97 {
  98         return sysctl_ip_vs_debug_level;
  99 }
 100 #endif
 101
 102 #ifdef CONFIG_IP_VS_IPV6
 103 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
 104 static int __ip_vs_addr_is_local_v6(const struct in6_addr *addr)
 105 {
 106         struct rt6_info *rt;
 107         struct flowi fl = {
 108                 .oif = 0,
 109                 .nl_u = {
 110                         .ip6_u = {
 111                                 .daddr = *addr,
 112                                 .saddr = { .s6_addr32 = {0, 0, 0, 0} }, } },
 113         };
 114
 115         rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
 116         if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
 117                         return 1;
 118
 119         return 0;
 120 }
 121 #endif
 122 /*
 123  *      update_defense_level is called from keventd and from sysctl,
 124  *      so it needs to protect itself from softirqs
 125  */
 126 static void update_defense_level(void)
 127 {
 128         struct sysinfo i;
 129         static int old_secure_tcp = 0;
 130         int availmem;
 131         int nomem;
 132         int to_change = -1;
 133
 134         /* we only count free and buffered memory (in pages) */
 135         si_meminfo(&i);
 136         availmem = i.freeram + i.bufferram;
 137         /* however in linux 2.5 the i.bufferram is total page cache size,
 138            we need adjust it */
 139         /* si_swapinfo(&i); */
 140         /* availmem = availmem - (i.totalswap - i.freeswap); */
 141
 142         nomem = (availmem < sysctl_ip_vs_amemthresh);
 143
 144         local_bh_disable();
 145
 146         /* drop_entry */
 147         spin_lock(&__ip_vs_dropentry_lock);
 148         switch (sysctl_ip_vs_drop_entry) {
 149         case 0:
 150                 atomic_set(&ip_vs_dropentry, 0);
 151                 break;
 152         case 1:
 153                 if (nomem) {
 154                         atomic_set(&ip_vs_dropentry, 1);
 155                         sysctl_ip_vs_drop_entry = 2;
 156                 } else {
 157                         atomic_set(&ip_vs_dropentry, 0);
 158                 }
 159                 break;
 160         case 2:
 161                 if (nomem) {
 162                         atomic_set(&ip_vs_dropentry, 1);
 163                 } else {
 164                         atomic_set(&ip_vs_dropentry, 0);
 165                         sysctl_ip_vs_drop_entry = 1;
 166                 };
 167                 break;
 168         case 3:
 169                 atomic_set(&ip_vs_dropentry, 1);
 170                 break;
 171         }
 172         spin_unlock(&__ip_vs_dropentry_lock);
 173
 174         /* drop_packet */
 175         spin_lock(&__ip_vs_droppacket_lock);
 176         switch (sysctl_ip_vs_drop_packet) {
 177         case 0:
 178                 ip_vs_drop_rate = 0;
 179                 break;
 180         case 1:
 181                 if (nomem) {
 182                         ip_vs_drop_rate = ip_vs_drop_counter
 183                                 = sysctl_ip_vs_amemthresh /
 184                                 (sysctl_ip_vs_amemthresh-availmem);
 185                         sysctl_ip_vs_drop_packet = 2;
 186                 } else {
 187                         ip_vs_drop_rate = 0;
 188                 }
 189                 break;
 190         case 2:
 191                 if (nomem) {
 192                         ip_vs_drop_rate = ip_vs_drop_counter
 193                                 = sysctl_ip_vs_amemthresh /
 194                                 (sysctl_ip_vs_amemthresh-availmem);
 195                 } else {
 196                         ip_vs_drop_rate = 0;
 197                         sysctl_ip_vs_drop_packet = 1;
 198                 }
 199                 break;
 200         case 3:
 201                 ip_vs_drop_rate = sysctl_ip_vs_am_droprate;
 202                 break;
 203         }
 204         spin_unlock(&__ip_vs_droppacket_lock);
 205
 206         /* secure_tcp */
 207         write_lock(&__ip_vs_securetcp_lock);
 208         switch (sysctl_ip_vs_secure_tcp) {
 209         case 0:
 210                 if (old_secure_tcp >= 2)
 211                         to_change = 0;
 212                 break;
 213         case 1:
 214                 if (nomem) {
 215                         if (old_secure_tcp < 2)
 216                                 to_change = 1;
 217                         sysctl_ip_vs_secure_tcp = 2;
 218                 } else {
 219                         if (old_secure_tcp >= 2)
 220                                 to_change = 0;
 221                 }
 222                 break;
 223         case 2:
 224                 if (nomem) {
 225                         if (old_secure_tcp < 2)
 226                                 to_change = 1;
 227                 } else {
 228                         if (old_secure_tcp >= 2)
 229                                 to_change = 0;
 230                         sysctl_ip_vs_secure_tcp = 1;
 231                 }
 232                 break;
 233         case 3:
 234                 if (old_secure_tcp < 2)
 235                         to_change = 1;
 236                 break;
 237         }
 238         old_secure_tcp = sysctl_ip_vs_secure_tcp;
 239         if (to_change >= 0)
 240                 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
 241         write_unlock(&__ip_vs_securetcp_lock);
 242
 243         local_bh_enable();
 244 }
 245
 246
 247 /*
 248  *      Timer for checking the defense
 249  */
 250 #define DEFENSE_TIMER_PERIOD    1*HZ
 251 static void defense_work_handler(struct work_struct *work);
 252 static DECLARE_DELAYED_WORK(defense_work, defense_work_handler);
 253
 254 static void defense_work_handler(struct work_struct *work)
 255 {
 256         update_defense_level();
 257         if (atomic_read(&ip_vs_dropentry))
 258                 ip_vs_random_dropentry();
 259
 260         schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
 261 }
 262
 263 int
 264 ip_vs_use_count_inc(void)
 265 {
 266         return try_module_get(THIS_MODULE);
 267 }
 268
 269 void
 270 ip_vs_use_count_dec(void)
 271 {
 272         module_put(THIS_MODULE);
 273 }
 274
 275
 276 /*
 277  *      Hash table: for virtual service lookups
 278  */
 279 #define IP_VS_SVC_TAB_BITS 8
 280 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 281 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 282
 283 /* the service table hashed by <protocol, addr, port> */
 284 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 285 /* the service table hashed by fwmark */
 286 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 287
 288 /*
 289  *      Hash table: for real service lookups
 290  */
 291 #define IP_VS_RTAB_BITS 4
 292 #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
 293 #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
 294
 295 static struct list_head ip_vs_rtable[IP_VS_RTAB_SIZE];
 296
 297 /*
 298  *      Trash for destinations
 299  */
 300 static LIST_HEAD(ip_vs_dest_trash);
 301
 302 /*
 303  *      FTP & NULL virtual service counters
 304  */
 305 static atomic_t ip_vs_ftpsvc_counter = ATOMIC_INIT(0);
 306 static atomic_t ip_vs_nullsvc_counter = ATOMIC_INIT(0);
 307
 308
 309 /*
 310  *      Returns hash value for virtual service
 311  */
 312 static __inline__ unsigned
 313 ip_vs_svc_hashkey(int af, unsigned proto, const union nf_inet_addr *addr,
 314                   __be16 port)
 315 {
 316         register unsigned porth = ntohs(port);
 317         __be32 addr_fold = addr->ip;
 318
 319 #ifdef CONFIG_IP_VS_IPV6
 320         if (af == AF_INET6)
 321                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 322                             addr->ip6[2]^addr->ip6[3];
 323 #endif
 324
 325         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
 326                 & IP_VS_SVC_TAB_MASK;
 327 }
 328
 329 /*
 330  *      Returns hash value of fwmark for virtual service lookup
 331  */
 332 static __inline__ unsigned ip_vs_svc_fwm_hashkey(__u32 fwmark)
 333 {
 334         return fwmark & IP_VS_SVC_TAB_MASK;
 335 }
 336
 337 /*
 338  *      Hashes a service in the ip_vs_svc_table by <proto,addr,port>
 339  *      or in the ip_vs_svc_fwm_table by fwmark.
 340  *      Should be called with locked tables.
 341  */
 342 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 343 {
 344         unsigned hash;
 345
 346         if (svc->flags & IP_VS_SVC_F_HASHED) {
 347                 pr_err("%s(): request for already hashed, called from %pF\n",
 348                        __func__, __builtin_return_address(0));
 349                 return 0;
 350         }
 351
 352         if (svc->fwmark == 0) {
 353                 /*
 354                  *  Hash it by <protocol,addr,port> in ip_vs_svc_table
 355                  */
 356                 hash = ip_vs_svc_hashkey(svc->af, svc->protocol, &svc->addr,
 357                                          svc->port);
 358                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
 359         } else {
 360                 /*
 361                  *  Hash it by fwmark in ip_vs_svc_fwm_table
 362                  */
 363                 hash = ip_vs_svc_fwm_hashkey(svc->fwmark);
 364                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 365         }
 366
 367         svc->flags |= IP_VS_SVC_F_HASHED;
 368         /* increase its refcnt because it is referenced by the svc table */
 369         atomic_inc(&svc->refcnt);
 370         return 1;
 371 }
 372
 373
 374 /*
 375  *      Unhashes a service from ip_vs_svc_table/ip_vs_svc_fwm_table.
 376  *      Should be called with locked tables.
 377  */
 378 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 379 {
 380         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 381                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 382                        __func__, __builtin_return_address(0));
 383                 return 0;
 384         }
 385
 386         if (svc->fwmark == 0) {
 387                 /* Remove it from the ip_vs_svc_table table */
 388                 list_del(&svc->s_list);
 389         } else {
 390                 /* Remove it from the ip_vs_svc_fwm_table table */
 391                 list_del(&svc->f_list);
 392         }
 393
 394         svc->flags &= ~IP_VS_SVC_F_HASHED;
 395         atomic_dec(&svc->refcnt);
 396         return 1;
 397 }
 398
 399
 400 /*
 401  *      Get service by {proto,addr,port} in the service table.
 402  */
 403 static inline struct ip_vs_service *
 404 __ip_vs_service_get(int af, __u16 protocol, const union nf_inet_addr *vaddr,
 405                     __be16 vport)
 406 {
 407         unsigned hash;
 408         struct ip_vs_service *svc;
 409
 410         /* Check for "full" addressed entries */
 411         hash = ip_vs_svc_hashkey(af, protocol, vaddr, vport);
 412
 413         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
 414                 if ((svc->af == af)
 415                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 416                     && (svc->port == vport)
 417                     && (svc->protocol == protocol)) {
 418                         /* HIT */
 419                         atomic_inc(&svc->usecnt);
 420                         return svc;
 421                 }
 422         }
 423
 424         return NULL;
 425 }
 426
 427
 428 /*
 429  *      Get service by {fwmark} in the service table.
 430  */
 431 static inline struct ip_vs_service *
 432 __ip_vs_svc_fwm_get(int af, __u32 fwmark)
 433 {
 434         unsigned hash;
 435         struct ip_vs_service *svc;
 436
 437         /* Check for fwmark addressed entries */
 438         hash = ip_vs_svc_fwm_hashkey(fwmark);
 439
 440         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 441                 if (svc->fwmark == fwmark && svc->af == af) {
 442                         /* HIT */
 443                         atomic_inc(&svc->usecnt);
 444                         return svc;
 445                 }
 446         }
 447
 448         return NULL;
 449 }
 450
 451 struct ip_vs_service *
 452 ip_vs_service_get(int af, __u32 fwmark, __u16 protocol,
 453                   const union nf_inet_addr *vaddr, __be16 vport)
 454 {
 455         struct ip_vs_service *svc;
 456
 457         read_lock(&__ip_vs_svc_lock);
 458
 459         /*
 460          *      Check the table hashed by fwmark first
 461          */
 462         if (fwmark && (svc = __ip_vs_svc_fwm_get(af, fwmark)))
 463                 goto out;
 464
 465         /*
 466          *      Check the table hashed by <protocol,addr,port>
 467          *      for "full" addressed entries
 468          */
 469         svc = __ip_vs_service_get(af, protocol, vaddr, vport);
 470
 471         if (svc == NULL
 472             && protocol == IPPROTO_TCP
 473             && atomic_read(&ip_vs_ftpsvc_counter)
 474             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 475                 /*
 476                  * Check if ftp service entry exists, the packet
 477                  * might belong to FTP data connections.
 478                  */
 479                 svc = __ip_vs_service_get(af, protocol, vaddr, FTPPORT);
 480         }
 481
 482         if (svc == NULL
 483             && atomic_read(&ip_vs_nullsvc_counter)) {
 484                 /*
 485                  * Check if the catch-all port (port zero) exists
 486                  */
 487                 svc = __ip_vs_service_get(af, protocol, vaddr, 0);
 488         }
 489
 490   out:
 491         read_unlock(&__ip_vs_svc_lock);
 492
 493         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 494                       fwmark, ip_vs_proto_name(protocol),
 495                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 496                       svc ? "hit" : "not hit");
 497
 498         return svc;
 499 }
 500
 501
 502 static inline void
 503 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 504 {
 505         atomic_inc(&svc->refcnt);
 506         dest->svc = svc;
 507 }
 508
 509 static inline void
 510 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 511 {
 512         struct ip_vs_service *svc = dest->svc;
 513
 514         dest->svc = NULL;
 515         if (atomic_dec_and_test(&svc->refcnt))
 516                 kfree(svc);
 517 }
 518
 519
 520 /*
 521  *      Returns hash value for real service
 522  */
 523 static inline unsigned ip_vs_rs_hashkey(int af,
 524                                             const union nf_inet_addr *addr,
 525                                             __be16 port)
 526 {
 527         register unsigned porth = ntohs(port);
 528         __be32 addr_fold = addr->ip;
 529
 530 #ifdef CONFIG_IP_VS_IPV6
 531         if (af == AF_INET6)
 532                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 533                             addr->ip6[2]^addr->ip6[3];
 534 #endif
 535
 536         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 537                 & IP_VS_RTAB_MASK;
 538 }
 539
 540 /*
 541  *      Hashes ip_vs_dest in ip_vs_rtable by <proto,addr,port>.
 542  *      should be called with locked tables.
 543  */
 544 static int ip_vs_rs_hash(struct ip_vs_dest *dest)
 545 {
 546         unsigned hash;
 547
 548         if (!list_empty(&dest->d_list)) {
 549                 return 0;
 550         }
 551
 552         /*
 553          *      Hash by proto,addr,port,
 554          *      which are the parameters of the real service.
 555          */
 556         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 557
 558         list_add(&dest->d_list, &ip_vs_rtable[hash]);
 559
 560         return 1;
 561 }
 562
 563 /*
 564  *      UNhashes ip_vs_dest from ip_vs_rtable.
 565  *      should be called with locked tables.
 566  */
 567 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
 568 {
 569         /*
 570          * Remove it from the ip_vs_rtable table.
 571          */
 572         if (!list_empty(&dest->d_list)) {
 573                 list_del(&dest->d_list);
 574                 INIT_LIST_HEAD(&dest->d_list);
 575         }
 576
 577         return 1;
 578 }
 579
 580 /*
 581  *      Lookup real service by <proto,addr,port> in the real service table.
 582  */
 583 struct ip_vs_dest *
 584 ip_vs_lookup_real_service(int af, __u16 protocol,
 585                           const union nf_inet_addr *daddr,
 586                           __be16 dport)
 587 {
 588         unsigned hash;
 589         struct ip_vs_dest *dest;
 590
 591         /*
 592          *      Check for "full" addressed entries
 593          *      Return the first found entry
 594          */
 595         hash = ip_vs_rs_hashkey(af, daddr, dport);
 596
 597         read_lock(&__ip_vs_rs_lock);
 598         list_for_each_entry(dest, &ip_vs_rtable[hash], d_list) {
 599                 if ((dest->af == af)
 600                     && ip_vs_addr_equal(af, &dest->addr, daddr)
 601                     && (dest->port == dport)
 602                     && ((dest->protocol == protocol) ||
 603                         dest->vfwmark)) {
 604                         /* HIT */
 605                         read_unlock(&__ip_vs_rs_lock);
 606                         return dest;
 607                 }
 608         }
 609         read_unlock(&__ip_vs_rs_lock);
 610
 611         return NULL;
 612 }
 613
 614 /*
 615  *      Lookup destination by {addr,port} in the given service
 616  */
 617 static struct ip_vs_dest *
 618 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 619                   __be16 dport)
 620 {
 621         struct ip_vs_dest *dest;
 622
 623         /*
 624          * Find the destination for the given service
 625          */
 626         list_for_each_entry(dest, &svc->destinations, n_list) {
 627                 if ((dest->af == svc->af)
 628                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 629                     && (dest->port == dport)) {
 630                         /* HIT */
 631                         return dest;
 632                 }
 633         }
 634
 635         return NULL;
 636 }
 637
 638 /*
 639  * Find destination by {daddr,dport,vaddr,protocol}
 640  * Cretaed to be used in ip_vs_process_message() in
 641  * the backup synchronization daemon. It finds the
 642  * destination to be bound to the received connection
 643  * on the backup.
 644  *
 645  * ip_vs_lookup_real_service() looked promissing, but
 646  * seems not working as expected.
 647  */
 648 struct ip_vs_dest *ip_vs_find_dest(int af, const union nf_inet_addr *daddr,
 649                                    __be16 dport,
 650                                    const union nf_inet_addr *vaddr,
 651                                    __be16 vport, __u16 protocol)
 652 {
 653         struct ip_vs_dest *dest;
 654         struct ip_vs_service *svc;
 655
 656         svc = ip_vs_service_get(af, 0, protocol, vaddr, vport);
 657         if (!svc)
 658                 return NULL;
 659         dest = ip_vs_lookup_dest(svc, daddr, dport);
 660         if (dest)
 661                 atomic_inc(&dest->refcnt);
 662         ip_vs_service_put(svc);
 663         return dest;
 664 }
 665
 666 /*
 667  *  Lookup dest by {svc,addr,port} in the destination trash.
 668  *  The destination trash is used to hold the destinations that are removed
 669  *  from the service table but are still referenced by some conn entries.
 670  *  The reason to add the destination trash is when the dest is temporary
 671  *  down (either by administrator or by monitor program), the dest can be
 672  *  picked back from the trash, the remaining connections to the dest can
 673  *  continue, and the counting information of the dest is also useful for
 674  *  scheduling.
 675  */
 676 static struct ip_vs_dest *
 677 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 678                      __be16 dport)
 679 {
 680         struct ip_vs_dest *dest, *nxt;
 681
 682         /*
 683          * Find the destination in trash
 684          */
 685         list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
 686                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 687                               "dest->refcnt=%d\n",
 688                               dest->vfwmark,
 689                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 690                               ntohs(dest->port),
 691                               atomic_read(&dest->refcnt));
 692                 if (dest->af == svc->af &&
 693                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 694                     dest->port == dport &&
 695                     dest->vfwmark == svc->fwmark &&
 696                     dest->protocol == svc->protocol &&
 697                     (svc->fwmark ||
 698                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 699                       dest->vport == svc->port))) {
 700                         /* HIT */
 701                         return dest;
 702                 }
 703
 704                 /*
 705                  * Try to purge the destination from trash if not referenced
 706                  */
 707                 if (atomic_read(&dest->refcnt) == 1) {
 708                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
 709                                       "from trash\n",
 710                                       dest->vfwmark,
 711                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
 712                                       ntohs(dest->port));
 713                         list_del(&dest->n_list);
 714                         ip_vs_dst_reset(dest);
 715                         __ip_vs_unbind_svc(dest);
 716                         kfree(dest);
 717                 }
 718         }
 719
 720         return NULL;
 721 }
 722
 723
 724 /*
 725  *  Clean up all the destinations in the trash
 726  *  Called by the ip_vs_control_cleanup()
 727  *
 728  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 729  *  the service tables must have been flushed and all the connections
 730  *  are expired, and the refcnt of each destination in the trash must
 731  *  be 1, so we simply release them here.
 732  */
 733 static void ip_vs_trash_cleanup(void)
 734 {
 735         struct ip_vs_dest *dest, *nxt;
 736
 737         list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
 738                 list_del(&dest->n_list);
 739                 ip_vs_dst_reset(dest);
 740                 __ip_vs_unbind_svc(dest);
 741                 kfree(dest);
 742         }
 743 }
 744
 745
 746 static void
 747 ip_vs_zero_stats(struct ip_vs_stats *stats)
 748 {
 749         spin_lock_bh(&stats->lock);
 750
 751         memset(&stats->ustats, 0, sizeof(stats->ustats));
 752         ip_vs_zero_estimator(stats);
 753
 754         spin_unlock_bh(&stats->lock);
 755 }
 756
 757 /*
 758  *      Update a destination in the given service
 759  */
 760 static void
 761 __ip_vs_update_dest(struct ip_vs_service *svc,
 762                     struct ip_vs_dest *dest, struct ip_vs_dest_user_kern *udest)
 763 {
 764         int conn_flags;
 765
 766         /* set the weight and the flags */
 767         atomic_set(&dest->weight, udest->weight);
 768         conn_flags = udest->conn_flags | IP_VS_CONN_F_INACTIVE;
 769
 770         /* check if local node and update the flags */
 771 #ifdef CONFIG_IP_VS_IPV6
 772         if (svc->af == AF_INET6) {
 773                 if (__ip_vs_addr_is_local_v6(&udest->addr.in6)) {
 774                         conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
 775                                 | IP_VS_CONN_F_LOCALNODE;
 776                 }
 777         } else
 778 #endif
 779                 if (inet_addr_type(&init_net, udest->addr.ip) == RTN_LOCAL) {
 780                         conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
 781                                 | IP_VS_CONN_F_LOCALNODE;
 782                 }
 783
 784         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 785         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != 0) {
 786                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 787         } else {
 788                 /*
 789                  *    Put the real service in ip_vs_rtable if not present.
 790                  *    For now only for NAT!
 791                  */
 792                 write_lock_bh(&__ip_vs_rs_lock);
 793                 ip_vs_rs_hash(dest);
 794                 write_unlock_bh(&__ip_vs_rs_lock);
 795         }
 796         atomic_set(&dest->conn_flags, conn_flags);
 797
 798         /* bind the service */
 799         if (!dest->svc) {
 800                 __ip_vs_bind_svc(dest, svc);
 801         } else {
 802                 if (dest->svc != svc) {
 803                         __ip_vs_unbind_svc(dest);
 804                         ip_vs_zero_stats(&dest->stats);
 805                         __ip_vs_bind_svc(dest, svc);
 806                 }
 807         }
 808
 809         /* set the dest status flags */
 810         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 811
 812         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 813                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 814         dest->u_threshold = udest->u_threshold;
 815         dest->l_threshold = udest->l_threshold;
 816 }
 817
 818
 819 /*
 820  *      Create a destination for the given service
 821  */
 822 static int
 823 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 824                struct ip_vs_dest **dest_p)
 825 {
 826         struct ip_vs_dest *dest;
 827         unsigned atype;
 828
 829         EnterFunction(2);
 830
 831 #ifdef CONFIG_IP_VS_IPV6
 832         if (svc->af == AF_INET6) {
 833                 atype = ipv6_addr_type(&udest->addr.in6);
 834                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 835                         atype & IPV6_ADDR_LINKLOCAL) &&
 836                         !__ip_vs_addr_is_local_v6(&udest->addr.in6))
 837                         return -EINVAL;
 838         } else
 839 #endif
 840         {
 841                 atype = inet_addr_type(&init_net, udest->addr.ip);
 842                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 843                         return -EINVAL;
 844         }
 845
 846         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
 847         if (dest == NULL) {
 848                 pr_err("%s(): no memory.\n", __func__);
 849                 return -ENOMEM;
 850         }
 851
 852         dest->af = svc->af;
 853         dest->protocol = svc->protocol;
 854         dest->vaddr = svc->addr;
 855         dest->vport = svc->port;
 856         dest->vfwmark = svc->fwmark;
 857         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 858         dest->port = udest->port;
 859
 860         atomic_set(&dest->activeconns, 0);
 861         atomic_set(&dest->inactconns, 0);
 862         atomic_set(&dest->persistconns, 0);
 863         atomic_set(&dest->refcnt, 0);
 864
 865         INIT_LIST_HEAD(&dest->d_list);
 866         spin_lock_init(&dest->dst_lock);
 867         spin_lock_init(&dest->stats.lock);
 868         __ip_vs_update_dest(svc, dest, udest);
 869         ip_vs_new_estimator(&dest->stats);
 870
 871         *dest_p = dest;
 872
 873         LeaveFunction(2);
 874         return 0;
 875 }
 876
 877
 878 /*
 879  *      Add a destination into an existing service
 880  */
 881 static int
 882 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 883 {
 884         struct ip_vs_dest *dest;
 885         union nf_inet_addr daddr;
 886         __be16 dport = udest->port;
 887         int ret;
 888
 889         EnterFunction(2);
 890
 891         if (udest->weight < 0) {
 892                 pr_err("%s(): server weight less than zero\n", __func__);
 893                 return -ERANGE;
 894         }
 895
 896         if (udest->l_threshold > udest->u_threshold) {
 897                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 898                         __func__);
 899                 return -ERANGE;
 900         }
 901
 902         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 903
 904         /*
 905          * Check if the dest already exists in the list
 906          */
 907         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 908
 909         if (dest != NULL) {
 910                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 911                 return -EEXIST;
 912         }
 913
 914         /*
 915          * Check if the dest already exists in the trash and
 916          * is from the same service
 917          */
 918         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 919
 920         if (dest != NULL) {
 921                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 922                               "dest->refcnt=%d, service %u/%s:%u\n",
 923                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 924                               atomic_read(&dest->refcnt),
 925                               dest->vfwmark,
 926                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 927                               ntohs(dest->vport));
 928
 929                 __ip_vs_update_dest(svc, dest, udest);
 930
 931                 /*
 932                  * Get the destination from the trash
 933                  */
 934                 list_del(&dest->n_list);
 935
 936                 ip_vs_new_estimator(&dest->stats);
 937
 938                 write_lock_bh(&__ip_vs_svc_lock);
 939
 940                 /*
 941                  * Wait until all other svc users go away.
 942                  */
 943                 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 944
 945                 list_add(&dest->n_list, &svc->destinations);
 946                 svc->num_dests++;
 947
 948                 /* call the update_service function of its scheduler */
 949                 if (svc->scheduler->update_service)
 950                         svc->scheduler->update_service(svc);
 951
 952                 write_unlock_bh(&__ip_vs_svc_lock);
 953                 return 0;
 954         }
 955
 956         /*
 957          * Allocate and initialize the dest structure
 958          */
 959         ret = ip_vs_new_dest(svc, udest, &dest);
 960         if (ret) {
 961                 return ret;
 962         }
 963
 964         /*
 965          * Add the dest entry into the list
 966          */
 967         atomic_inc(&dest->refcnt);
 968
 969         write_lock_bh(&__ip_vs_svc_lock);
 970
 971         /*
 972          * Wait until all other svc users go away.
 973          */
 974         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 975
 976         list_add(&dest->n_list, &svc->destinations);
 977         svc->num_dests++;
 978
 979         /* call the update_service function of its scheduler */
 980         if (svc->scheduler->update_service)
 981                 svc->scheduler->update_service(svc);
 982
 983         write_unlock_bh(&__ip_vs_svc_lock);
 984
 985         LeaveFunction(2);
 986
 987         return 0;
 988 }
 989
 990
 991 /*
 992  *      Edit a destination in the given service
 993  */
 994 static int
 995 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 996 {
 997         struct ip_vs_dest *dest;
 998         union nf_inet_addr daddr;
 999         __be16 dport = udest->port;
1000
1001         EnterFunction(2);
1002
1003         if (udest->weight < 0) {
1004                 pr_err("%s(): server weight less than zero\n", __func__);
1005                 return -ERANGE;
1006         }
1007
1008         if (udest->l_threshold > udest->u_threshold) {
1009                 pr_err("%s(): lower threshold is higher than upper threshold\n",
1010                         __func__);
1011                 return -ERANGE;
1012         }
1013
1014         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
1015
1016         /*
1017          *  Lookup the destination list
1018          */
1019         dest = ip_vs_lookup_dest(svc, &daddr, dport);
1020
1021         if (dest == NULL) {
1022                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1023                 return -ENOENT;
1024         }
1025
1026         __ip_vs_update_dest(svc, dest, udest);
1027
1028         write_lock_bh(&__ip_vs_svc_lock);
1029
1030         /* Wait until all other svc users go away */
1031         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1032
1033         /* call the update_service, because server weight may be changed */
1034         if (svc->scheduler->update_service)
1035                 svc->scheduler->update_service(svc);
1036
1037         write_unlock_bh(&__ip_vs_svc_lock);
1038
1039         LeaveFunction(2);
1040
1041         return 0;
1042 }
1043
1044
1045 /*
1046  *      Delete a destination (must be already unlinked from the service)
1047  */
1048 static void __ip_vs_del_dest(struct ip_vs_dest *dest)
1049 {
1050         ip_vs_kill_estimator(&dest->stats);
1051
1052         /*
1053          *  Remove it from the d-linked list with the real services.
1054          */
1055         write_lock_bh(&__ip_vs_rs_lock);
1056         ip_vs_rs_unhash(dest);
1057         write_unlock_bh(&__ip_vs_rs_lock);
1058
1059         /*
1060          *  Decrease the refcnt of the dest, and free the dest
1061          *  if nobody refers to it (refcnt=0). Otherwise, throw
1062          *  the destination into the trash.
1063          */
1064         if (atomic_dec_and_test(&dest->refcnt)) {
1065                 ip_vs_dst_reset(dest);
1066                 /* simply decrease svc->refcnt here, let the caller check
1067                    and release the service if nobody refers to it.
1068                    Only user context can release destination and service,
1069                    and only one user context can update virtual service at a
1070                    time, so the operation here is OK */
1071                 atomic_dec(&dest->svc->refcnt);
1072                 kfree(dest);
1073         } else {
1074                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1075                               "dest->refcnt=%d\n",
1076                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1077                               ntohs(dest->port),
1078                               atomic_read(&dest->refcnt));
1079                 list_add(&dest->n_list, &ip_vs_dest_trash);
1080                 atomic_inc(&dest->refcnt);
1081         }
1082 }
1083
1084
1085 /*
1086  *      Unlink a destination from the given service
1087  */
1088 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1089                                 struct ip_vs_dest *dest,
1090                                 int svcupd)
1091 {
1092         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1093
1094         /*
1095          *  Remove it from the d-linked destination list.
1096          */
1097         list_del(&dest->n_list);
1098         svc->num_dests--;
1099
1100         /*
1101          *  Call the update_service function of its scheduler
1102          */
1103         if (svcupd && svc->scheduler->update_service)
1104                         svc->scheduler->update_service(svc);
1105 }
1106
1107
1108 /*
1109  *      Delete a destination server in the given service
1110  */
1111 static int
1112 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1113 {
1114         struct ip_vs_dest *dest;
1115         __be16 dport = udest->port;
1116
1117         EnterFunction(2);
1118
1119         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1120
1121         if (dest == NULL) {
1122                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1123                 return -ENOENT;
1124         }
1125
1126         write_lock_bh(&__ip_vs_svc_lock);
1127
1128         /*
1129          *      Wait until all other svc users go away.
1130          */
1131         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1132
1133         /*
1134          *      Unlink dest from the service
1135          */
1136         __ip_vs_unlink_dest(svc, dest, 1);
1137
1138         write_unlock_bh(&__ip_vs_svc_lock);
1139
1140         /*
1141          *      Delete the destination
1142          */
1143         __ip_vs_del_dest(dest);
1144
1145         LeaveFunction(2);
1146
1147         return 0;
1148 }
1149
1150
1151 /*
1152  *      Add a service into the service hash table
1153  */
1154 static int
1155 ip_vs_add_service(struct ip_vs_service_user_kern *u,
1156                   struct ip_vs_service **svc_p)
1157 {
1158         int ret = 0;
1159         struct ip_vs_scheduler *sched = NULL;
1160         struct ip_vs_service *svc = NULL;
1161
1162         /* increase the module use count */
1163         ip_vs_use_count_inc();
1164
1165         /* Lookup the scheduler by 'u->sched_name' */
1166         sched = ip_vs_scheduler_get(u->sched_name);
1167         if (sched == NULL) {
1168                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1169                 ret = -ENOENT;
1170                 goto out_mod_dec;
1171         }
1172
1173 #ifdef CONFIG_IP_VS_IPV6
1174         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1175                 ret = -EINVAL;
1176                 goto out_err;
1177         }
1178 #endif
1179
1180         svc = kzalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
1181         if (svc == NULL) {
1182                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1183                 ret = -ENOMEM;
1184                 goto out_err;
1185         }
1186
1187         /* I'm the first user of the service */
1188         atomic_set(&svc->usecnt, 1);
1189         atomic_set(&svc->refcnt, 0);
1190
1191         svc->af = u->af;
1192         svc->protocol = u->protocol;
1193         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1194         svc->port = u->port;
1195         svc->fwmark = u->fwmark;
1196         svc->flags = u->flags;
1197         svc->timeout = u->timeout * HZ;
1198         svc->netmask = u->netmask;
1199
1200         INIT_LIST_HEAD(&svc->destinations);
1201         rwlock_init(&svc->sched_lock);
1202         spin_lock_init(&svc->stats.lock);
1203
1204         /* Bind the scheduler */
1205         ret = ip_vs_bind_scheduler(svc, sched);
1206         if (ret)
1207                 goto out_err;
1208         sched = NULL;
1209
1210         /* Update the virtual service counters */
1211         if (svc->port == FTPPORT)
1212                 atomic_inc(&ip_vs_ftpsvc_counter);
1213         else if (svc->port == 0)
1214                 atomic_inc(&ip_vs_nullsvc_counter);
1215
1216         ip_vs_new_estimator(&svc->stats);
1217
1218         /* Count only IPv4 services for old get/setsockopt interface */
1219         if (svc->af == AF_INET)
1220                 ip_vs_num_services++;
1221
1222         /* Hash the service into the service table */
1223         write_lock_bh(&__ip_vs_svc_lock);
1224         ip_vs_svc_hash(svc);
1225         write_unlock_bh(&__ip_vs_svc_lock);
1226
1227         *svc_p = svc;
1228         return 0;
1229
1230   out_err:
1231         if (svc != NULL) {
1232                 if (svc->scheduler)
1233                         ip_vs_unbind_scheduler(svc);
1234                 if (svc->inc) {
1235                         local_bh_disable();
1236                         ip_vs_app_inc_put(svc->inc);
1237                         local_bh_enable();
1238                 }
1239                 kfree(svc);
1240         }
1241         ip_vs_scheduler_put(sched);
1242
1243   out_mod_dec:
1244         /* decrease the module use count */
1245         ip_vs_use_count_dec();
1246
1247         return ret;
1248 }
1249
1250
1251 /*
1252  *      Edit a service and bind it with a new scheduler
1253  */
1254 static int
1255 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1256 {
1257         struct ip_vs_scheduler *sched, *old_sched;
1258         int ret = 0;
1259
1260         /*
1261          * Lookup the scheduler, by 'u->sched_name'
1262          */
1263         sched = ip_vs_scheduler_get(u->sched_name);
1264         if (sched == NULL) {
1265                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1266                 return -ENOENT;
1267         }
1268         old_sched = sched;
1269
1270 #ifdef CONFIG_IP_VS_IPV6
1271         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1272                 ret = -EINVAL;
1273                 goto out;
1274         }
1275 #endif
1276
1277         write_lock_bh(&__ip_vs_svc_lock);
1278
1279         /*
1280          * Wait until all other svc users go away.
1281          */
1282         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1283
1284         /*
1285          * Set the flags and timeout value
1286          */
1287         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1288         svc->timeout = u->timeout * HZ;
1289         svc->netmask = u->netmask;
1290
1291         old_sched = svc->scheduler;
1292         if (sched != old_sched) {
1293                 /*
1294                  * Unbind the old scheduler
1295                  */
1296                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1297                         old_sched = sched;
1298                         goto out_unlock;
1299                 }
1300
1301                 /*
1302                  * Bind the new scheduler
1303                  */
1304                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1305                         /*
1306                          * If ip_vs_bind_scheduler fails, restore the old
1307                          * scheduler.
1308                          * The main reason of failure is out of memory.
1309                          *
1310                          * The question is if the old scheduler can be
1311                          * restored all the time. TODO: if it cannot be
1312                          * restored some time, we must delete the service,
1313                          * otherwise the system may crash.
1314                          */
1315                         ip_vs_bind_scheduler(svc, old_sched);
1316                         old_sched = sched;
1317                         goto out_unlock;
1318                 }
1319         }
1320
1321   out_unlock:
1322         write_unlock_bh(&__ip_vs_svc_lock);
1323 #ifdef CONFIG_IP_VS_IPV6
1324   out:
1325 #endif
1326
1327         if (old_sched)
1328                 ip_vs_scheduler_put(old_sched);
1329
1330         return ret;
1331 }
1332
1333
1334 /*
1335  *      Delete a service from the service list
1336  *      - The service must be unlinked, unlocked and not referenced!
1337  *      - We are called under _bh lock
1338  */
1339 static void __ip_vs_del_service(struct ip_vs_service *svc)
1340 {
1341         struct ip_vs_dest *dest, *nxt;
1342         struct ip_vs_scheduler *old_sched;
1343
1344         /* Count only IPv4 services for old get/setsockopt interface */
1345         if (svc->af == AF_INET)
1346                 ip_vs_num_services--;
1347
1348         ip_vs_kill_estimator(&svc->stats);
1349
1350         /* Unbind scheduler */
1351         old_sched = svc->scheduler;
1352         ip_vs_unbind_scheduler(svc);
1353         if (old_sched)
1354                 ip_vs_scheduler_put(old_sched);
1355
1356         /* Unbind app inc */
1357         if (svc->inc) {
1358                 ip_vs_app_inc_put(svc->inc);
1359                 svc->inc = NULL;
1360         }
1361
1362         /*
1363          *    Unlink the whole destination list
1364          */
1365         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1366                 __ip_vs_unlink_dest(svc, dest, 0);
1367                 __ip_vs_del_dest(dest);
1368         }
1369
1370         /*
1371          *    Update the virtual service counters
1372          */
1373         if (svc->port == FTPPORT)
1374                 atomic_dec(&ip_vs_ftpsvc_counter);
1375         else if (svc->port == 0)
1376                 atomic_dec(&ip_vs_nullsvc_counter);
1377
1378         /*
1379          *    Free the service if nobody refers to it
1380          */
1381         if (atomic_read(&svc->refcnt) == 0)
1382                 kfree(svc);
1383
1384         /* decrease the module use count */
1385         ip_vs_use_count_dec();
1386 }
1387
1388 /*
1389  *      Delete a service from the service list
1390  */
1391 static int ip_vs_del_service(struct ip_vs_service *svc)
1392 {
1393         if (svc == NULL)
1394                 return -EEXIST;
1395
1396         /*
1397          * Unhash it from the service table
1398          */
1399         write_lock_bh(&__ip_vs_svc_lock);
1400
1401         ip_vs_svc_unhash(svc);
1402
1403         /*
1404          * Wait until all the svc users go away.
1405          */
1406         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1407
1408         __ip_vs_del_service(svc);
1409
1410         write_unlock_bh(&__ip_vs_svc_lock);
1411
1412         return 0;
1413 }
1414
1415
1416 /*
1417  *      Flush all the virtual services
1418  */
1419 static int ip_vs_flush(void)
1420 {
1421         int idx;
1422         struct ip_vs_service *svc, *nxt;
1423
1424         /*
1425          * Flush the service table hashed by <protocol,addr,port>
1426          */
1427         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1428                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx], s_list) {
1429                         write_lock_bh(&__ip_vs_svc_lock);
1430                         ip_vs_svc_unhash(svc);
1431                         /*
1432                          * Wait until all the svc users go away.
1433                          */
1434                         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1435                         __ip_vs_del_service(svc);
1436                         write_unlock_bh(&__ip_vs_svc_lock);
1437                 }
1438         }
1439
1440         /*
1441          * Flush the service table hashed by fwmark
1442          */
1443         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1444                 list_for_each_entry_safe(svc, nxt,
1445                                          &ip_vs_svc_fwm_table[idx], f_list) {
1446                         write_lock_bh(&__ip_vs_svc_lock);
1447                         ip_vs_svc_unhash(svc);
1448                         /*
1449                          * Wait until all the svc users go away.
1450                          */
1451                         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1452                         __ip_vs_del_service(svc);
1453                         write_unlock_bh(&__ip_vs_svc_lock);
1454                 }
1455         }
1456
1457         return 0;
1458 }
1459
1460
1461 /*
1462  *      Zero counters in a service or all services
1463  */
1464 static int ip_vs_zero_service(struct ip_vs_service *svc)
1465 {
1466         struct ip_vs_dest *dest;
1467
1468         write_lock_bh(&__ip_vs_svc_lock);
1469         list_for_each_entry(dest, &svc->destinations, n_list) {
1470                 ip_vs_zero_stats(&dest->stats);
1471         }
1472         ip_vs_zero_stats(&svc->stats);
1473         write_unlock_bh(&__ip_vs_svc_lock);
1474         return 0;
1475 }
1476
1477 static int ip_vs_zero_all(void)
1478 {
1479         int idx;
1480         struct ip_vs_service *svc;
1481
1482         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1483                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1484                         ip_vs_zero_service(svc);
1485                 }
1486         }
1487
1488         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1489                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1490                         ip_vs_zero_service(svc);
1491                 }
1492         }
1493
1494         ip_vs_zero_stats(&ip_vs_stats);
1495         return 0;
1496 }
1497
1498
1499 static int
1500 proc_do_defense_mode(ctl_table *table, int write,
1501                      void __user *buffer, size_t *lenp, loff_t *ppos)
1502 {
1503         int *valp = table->data;
1504         int val = *valp;
1505         int rc;
1506
1507         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1508         if (write && (*valp != val)) {
1509                 if ((*valp < 0) || (*valp > 3)) {
1510                         /* Restore the correct value */
1511                         *valp = val;
1512                 } else {
1513                         update_defense_level();
1514                 }
1515         }
1516         return rc;
1517 }
1518
1519
1520 static int
1521 proc_do_sync_threshold(ctl_table *table, int write,
1522                        void __user *buffer, size_t *lenp, loff_t *ppos)
1523 {
1524         int *valp = table->data;
1525         int val[2];
1526         int rc;
1527
1528         /* backup the value first */
1529         memcpy(val, valp, sizeof(val));
1530
1531         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1532         if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1533                 /* Restore the correct value */
1534                 memcpy(valp, val, sizeof(val));
1535         }
1536         return rc;
1537 }
1538
1539
1540 /*
1541  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1542  */
1543
1544 static struct ctl_table vs_vars[] = {
1545         {
1546                 .procname       = "amemthresh",
1547                 .data           = &sysctl_ip_vs_amemthresh,
1548                 .maxlen         = sizeof(int),
1549                 .mode           = 0644,
1550                 .proc_handler   = proc_dointvec,
1551         },
1552 #ifdef CONFIG_IP_VS_DEBUG
1553         {
1554                 .procname       = "debug_level",
1555                 .data           = &sysctl_ip_vs_debug_level,
1556                 .maxlen         = sizeof(int),
1557                 .mode           = 0644,
1558                 .proc_handler   = proc_dointvec,
1559         },
1560 #endif
1561         {
1562                 .procname       = "am_droprate",
1563                 .data           = &sysctl_ip_vs_am_droprate,
1564                 .maxlen         = sizeof(int),
1565                 .mode           = 0644,
1566                 .proc_handler   = proc_dointvec,
1567         },
1568         {
1569                 .procname       = "drop_entry",
1570                 .data           = &sysctl_ip_vs_drop_entry,
1571                 .maxlen         = sizeof(int),
1572                 .mode           = 0644,
1573                 .proc_handler   = proc_do_defense_mode,
1574         },
1575         {
1576                 .procname       = "drop_packet",
1577                 .data           = &sysctl_ip_vs_drop_packet,
1578                 .maxlen         = sizeof(int),
1579                 .mode           = 0644,
1580                 .proc_handler   = proc_do_defense_mode,
1581         },
1582         {
1583                 .procname       = "secure_tcp",
1584                 .data           = &sysctl_ip_vs_secure_tcp,
1585                 .maxlen         = sizeof(int),
1586                 .mode           = 0644,
1587                 .proc_handler   = proc_do_defense_mode,
1588         },
1589 #if 0
1590         {
1591                 .procname       = "timeout_established",
1592                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1593                 .maxlen         = sizeof(int),
1594                 .mode           = 0644,
1595                 .proc_handler   = proc_dointvec_jiffies,
1596         },
1597         {
1598                 .procname       = "timeout_synsent",
1599                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1600                 .maxlen         = sizeof(int),
1601                 .mode           = 0644,
1602                 .proc_handler   = proc_dointvec_jiffies,
1603         },
1604         {
1605                 .procname       = "timeout_synrecv",
1606                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1607                 .maxlen         = sizeof(int),
1608                 .mode           = 0644,
1609                 .proc_handler   = proc_dointvec_jiffies,
1610         },
1611         {
1612                 .procname       = "timeout_finwait",
1613                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1614                 .maxlen         = sizeof(int),
1615                 .mode           = 0644,
1616                 .proc_handler   = proc_dointvec_jiffies,
1617         },
1618         {
1619                 .procname       = "timeout_timewait",
1620                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1621                 .maxlen         = sizeof(int),
1622                 .mode           = 0644,
1623                 .proc_handler   = proc_dointvec_jiffies,
1624         },
1625         {
1626                 .procname       = "timeout_close",
1627                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1628                 .maxlen         = sizeof(int),
1629                 .mode           = 0644,
1630                 .proc_handler   = proc_dointvec_jiffies,
1631         },
1632         {
1633                 .procname       = "timeout_closewait",
1634                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1635                 .maxlen         = sizeof(int),
1636                 .mode           = 0644,
1637                 .proc_handler   = proc_dointvec_jiffies,
1638         },
1639         {
1640                 .procname       = "timeout_lastack",
1641                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1642                 .maxlen         = sizeof(int),
1643                 .mode           = 0644,
1644                 .proc_handler   = proc_dointvec_jiffies,
1645         },
1646         {
1647                 .procname       = "timeout_listen",
1648                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1649                 .maxlen         = sizeof(int),
1650                 .mode           = 0644,
1651                 .proc_handler   = proc_dointvec_jiffies,
1652         },
1653         {
1654                 .procname       = "timeout_synack",
1655                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1656                 .maxlen         = sizeof(int),
1657                 .mode           = 0644,
1658                 .proc_handler   = proc_dointvec_jiffies,
1659         },
1660         {
1661                 .procname       = "timeout_udp",
1662                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1663                 .maxlen         = sizeof(int),
1664                 .mode           = 0644,
1665                 .proc_handler   = proc_dointvec_jiffies,
1666         },
1667         {
1668                 .procname       = "timeout_icmp",
1669                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1670                 .maxlen         = sizeof(int),
1671                 .mode           = 0644,
1672                 .proc_handler   = proc_dointvec_jiffies,
1673         },
1674 #endif
1675         {
1676                 .procname       = "cache_bypass",
1677                 .data           = &sysctl_ip_vs_cache_bypass,
1678                 .maxlen         = sizeof(int),
1679                 .mode           = 0644,
1680                 .proc_handler   = proc_dointvec,
1681         },
1682         {
1683                 .procname       = "expire_nodest_conn",
1684                 .data           = &sysctl_ip_vs_expire_nodest_conn,
1685                 .maxlen         = sizeof(int),
1686                 .mode           = 0644,
1687                 .proc_handler   = proc_dointvec,
1688         },
1689         {
1690                 .procname       = "expire_quiescent_template",
1691                 .data           = &sysctl_ip_vs_expire_quiescent_template,
1692                 .maxlen         = sizeof(int),
1693                 .mode           = 0644,
1694                 .proc_handler   = proc_dointvec,
1695         },
1696         {
1697                 .procname       = "sync_threshold",
1698                 .data           = &sysctl_ip_vs_sync_threshold,
1699                 .maxlen         = sizeof(sysctl_ip_vs_sync_threshold),
1700                 .mode           = 0644,
1701                 .proc_handler   = proc_do_sync_threshold,
1702         },
1703         {
1704                 .procname       = "nat_icmp_send",
1705                 .data           = &sysctl_ip_vs_nat_icmp_send,
1706                 .maxlen         = sizeof(int),
1707                 .mode           = 0644,
1708                 .proc_handler   = proc_dointvec,
1709         },
1710         { }
1711 };
1712
1713 const struct ctl_path net_vs_ctl_path[] = {
1714         { .procname = "net", },
1715         { .procname = "ipv4", },
1716         { .procname = "vs", },
1717         { }
1718 };
1719 EXPORT_SYMBOL_GPL(net_vs_ctl_path);
1720
1721 static struct ctl_table_header * sysctl_header;
1722
1723 #ifdef CONFIG_PROC_FS
1724
1725 struct ip_vs_iter {
1726         struct list_head *table;
1727         int bucket;
1728 };
1729
1730 /*
1731  *      Write the contents of the VS rule table to a PROCfs file.
1732  *      (It is kept just for backward compatibility)
1733  */
1734 static inline const char *ip_vs_fwd_name(unsigned flags)
1735 {
1736         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1737         case IP_VS_CONN_F_LOCALNODE:
1738                 return "Local";
1739         case IP_VS_CONN_F_TUNNEL:
1740                 return "Tunnel";
1741         case IP_VS_CONN_F_DROUTE:
1742                 return "Route";
1743         default:
1744                 return "Masq";
1745         }
1746 }
1747
1748
1749 /* Get the Nth entry in the two lists */
1750 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1751 {
1752         struct ip_vs_iter *iter = seq->private;
1753         int idx;
1754         struct ip_vs_service *svc;
1755
1756         /* look in hash by protocol */
1757         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1758                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1759                         if (pos-- == 0){
1760                                 iter->table = ip_vs_svc_table;
1761                                 iter->bucket = idx;
1762                                 return svc;
1763                         }
1764                 }
1765         }
1766
1767         /* keep looking in fwmark */
1768         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1769                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1770                         if (pos-- == 0) {
1771                                 iter->table = ip_vs_svc_fwm_table;
1772                                 iter->bucket = idx;
1773                                 return svc;
1774                         }
1775                 }
1776         }
1777
1778         return NULL;
1779 }
1780
1781 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1782 __acquires(__ip_vs_svc_lock)
1783 {
1784
1785         read_lock_bh(&__ip_vs_svc_lock);
1786         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1787 }
1788
1789
1790 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1791 {
1792         struct list_head *e;
1793         struct ip_vs_iter *iter;
1794         struct ip_vs_service *svc;
1795
1796         ++*pos;
1797         if (v == SEQ_START_TOKEN)
1798                 return ip_vs_info_array(seq,0);
1799
1800         svc = v;
1801         iter = seq->private;
1802
1803         if (iter->table == ip_vs_svc_table) {
1804                 /* next service in table hashed by protocol */
1805                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1806                         return list_entry(e, struct ip_vs_service, s_list);
1807
1808
1809                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1810                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1811                                             s_list) {
1812                                 return svc;
1813                         }
1814                 }
1815
1816                 iter->table = ip_vs_svc_fwm_table;
1817                 iter->bucket = -1;
1818                 goto scan_fwmark;
1819         }
1820
1821         /* next service in hashed by fwmark */
1822         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1823                 return list_entry(e, struct ip_vs_service, f_list);
1824
1825  scan_fwmark:
1826         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1827                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1828                                     f_list)
1829                         return svc;
1830         }
1831
1832         return NULL;
1833 }
1834
1835 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
1836 __releases(__ip_vs_svc_lock)
1837 {
1838         read_unlock_bh(&__ip_vs_svc_lock);
1839 }
1840
1841
1842 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1843 {
1844         if (v == SEQ_START_TOKEN) {
1845                 seq_printf(seq,
1846                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
1847                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1848                 seq_puts(seq,
1849                          "Prot LocalAddress:Port Scheduler Flags\n");
1850                 seq_puts(seq,
1851                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1852         } else {
1853                 const struct ip_vs_service *svc = v;
1854                 const struct ip_vs_iter *iter = seq->private;
1855                 const struct ip_vs_dest *dest;
1856
1857                 if (iter->table == ip_vs_svc_table) {
1858 #ifdef CONFIG_IP_VS_IPV6
1859                         if (svc->af == AF_INET6)
1860                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
1861                                            ip_vs_proto_name(svc->protocol),
1862                                            &svc->addr.in6,
1863                                            ntohs(svc->port),
1864                                            svc->scheduler->name);
1865                         else
1866 #endif
1867                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
1868                                            ip_vs_proto_name(svc->protocol),
1869                                            ntohl(svc->addr.ip),
1870                                            ntohs(svc->port),
1871                                            svc->scheduler->name,
1872                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
1873                 } else {
1874                         seq_printf(seq, "FWM  %08X %s %s",
1875                                    svc->fwmark, svc->scheduler->name,
1876                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
1877                 }
1878
1879                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
1880                         seq_printf(seq, "persistent %d %08X\n",
1881                                 svc->timeout,
1882                                 ntohl(svc->netmask));
1883                 else
1884                         seq_putc(seq, '\n');
1885
1886                 list_for_each_entry(dest, &svc->destinations, n_list) {
1887 #ifdef CONFIG_IP_VS_IPV6
1888                         if (dest->af == AF_INET6)
1889                                 seq_printf(seq,
1890                                            "  -> [%pI6]:%04X"
1891                                            "      %-7s %-6d %-10d %-10d\n",
1892                                            &dest->addr.in6,
1893                                            ntohs(dest->port),
1894                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1895                                            atomic_read(&dest->weight),
1896                                            atomic_read(&dest->activeconns),
1897                                            atomic_read(&dest->inactconns));
1898                         else
1899 #endif
1900                                 seq_printf(seq,
1901                                            "  -> %08X:%04X      "
1902                                            "%-7s %-6d %-10d %-10d\n",
1903                                            ntohl(dest->addr.ip),
1904                                            ntohs(dest->port),
1905                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1906                                            atomic_read(&dest->weight),
1907                                            atomic_read(&dest->activeconns),
1908                                            atomic_read(&dest->inactconns));
1909
1910                 }
1911         }
1912         return 0;
1913 }
1914
1915 static const struct seq_operations ip_vs_info_seq_ops = {
1916         .start = ip_vs_info_seq_start,
1917         .next  = ip_vs_info_seq_next,
1918         .stop  = ip_vs_info_seq_stop,
1919         .show  = ip_vs_info_seq_show,
1920 };
1921
1922 static int ip_vs_info_open(struct inode *inode, struct file *file)
1923 {
1924         return seq_open_private(file, &ip_vs_info_seq_ops,
1925                         sizeof(struct ip_vs_iter));
1926 }
1927
1928 static const struct file_operations ip_vs_info_fops = {
1929         .owner   = THIS_MODULE,
1930         .open    = ip_vs_info_open,
1931         .read    = seq_read,
1932         .llseek  = seq_lseek,
1933         .release = seq_release_private,
1934 };
1935
1936 #endif
1937
1938 struct ip_vs_stats ip_vs_stats = {
1939         .lock = __SPIN_LOCK_UNLOCKED(ip_vs_stats.lock),
1940 };
1941
1942 #ifdef CONFIG_PROC_FS
1943 static int ip_vs_stats_show(struct seq_file *seq, void *v)
1944 {
1945
1946 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
1947         seq_puts(seq,
1948                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
1949         seq_printf(seq,
1950                    "   Conns  Packets  Packets            Bytes            Bytes\n");
1951
1952         spin_lock_bh(&ip_vs_stats.lock);
1953         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", ip_vs_stats.ustats.conns,
1954                    ip_vs_stats.ustats.inpkts, ip_vs_stats.ustats.outpkts,
1955                    (unsigned long long) ip_vs_stats.ustats.inbytes,
1956                    (unsigned long long) ip_vs_stats.ustats.outbytes);
1957
1958 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
1959         seq_puts(seq,
1960                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
1961         seq_printf(seq,"%8X %8X %8X %16X %16X\n",
1962                         ip_vs_stats.ustats.cps,
1963                         ip_vs_stats.ustats.inpps,
1964                         ip_vs_stats.ustats.outpps,
1965                         ip_vs_stats.ustats.inbps,
1966                         ip_vs_stats.ustats.outbps);
1967         spin_unlock_bh(&ip_vs_stats.lock);
1968
1969         return 0;
1970 }
1971
1972 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
1973 {
1974         return single_open(file, ip_vs_stats_show, NULL);
1975 }
1976
1977 static const struct file_operations ip_vs_stats_fops = {
1978         .owner = THIS_MODULE,
1979         .open = ip_vs_stats_seq_open,
1980         .read = seq_read,
1981         .llseek = seq_lseek,
1982         .release = single_release,
1983 };
1984
1985 #endif
1986
1987 /*
1988  *      Set timeout values for tcp tcpfin udp in the timeout_table.
1989  */
1990 static int ip_vs_set_timeout(struct ip_vs_timeout_user *u)
1991 {
1992         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
1993                   u->tcp_timeout,
1994                   u->tcp_fin_timeout,
1995                   u->udp_timeout);
1996
1997 #ifdef CONFIG_IP_VS_PROTO_TCP
1998         if (u->tcp_timeout) {
1999                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED]
2000                         = u->tcp_timeout * HZ;
2001         }
2002
2003         if (u->tcp_fin_timeout) {
2004                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT]
2005                         = u->tcp_fin_timeout * HZ;
2006         }
2007 #endif
2008
2009 #ifdef CONFIG_IP_VS_PROTO_UDP
2010         if (u->udp_timeout) {
2011                 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL]
2012                         = u->udp_timeout * HZ;
2013         }
2014 #endif
2015         return 0;
2016 }
2017
2018
2019 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2020 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2021 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2022                                  sizeof(struct ip_vs_dest_user))
2023 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2024 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2025 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2026
2027 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2028         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2029         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2030         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2031         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2032         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2033         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2034         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2035         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2036         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2037         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2038         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2039 };
2040
2041 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2042                                   struct ip_vs_service_user *usvc_compat)
2043 {
2044         usvc->af                = AF_INET;
2045         usvc->protocol          = usvc_compat->protocol;
2046         usvc->addr.ip           = usvc_compat->addr;
2047         usvc->port              = usvc_compat->port;
2048         usvc->fwmark            = usvc_compat->fwmark;
2049
2050         /* Deep copy of sched_name is not needed here */
2051         usvc->sched_name        = usvc_compat->sched_name;
2052
2053         usvc->flags             = usvc_compat->flags;
2054         usvc->timeout           = usvc_compat->timeout;
2055         usvc->netmask           = usvc_compat->netmask;
2056 }
2057
2058 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2059                                    struct ip_vs_dest_user *udest_compat)
2060 {
2061         udest->addr.ip          = udest_compat->addr;
2062         udest->port             = udest_compat->port;
2063         udest->conn_flags       = udest_compat->conn_flags;
2064         udest->weight           = udest_compat->weight;
2065         udest->u_threshold      = udest_compat->u_threshold;
2066         udest->l_threshold      = udest_compat->l_threshold;
2067 }
2068
2069 static int
2070 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2071 {
2072         int ret;
2073         unsigned char arg[MAX_ARG_LEN];
2074         struct ip_vs_service_user *usvc_compat;
2075         struct ip_vs_service_user_kern usvc;
2076         struct ip_vs_service *svc;
2077         struct ip_vs_dest_user *udest_compat;
2078         struct ip_vs_dest_user_kern udest;
2079
2080         if (!capable(CAP_NET_ADMIN))
2081                 return -EPERM;
2082
2083         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2084                 return -EINVAL;
2085         if (len < 0 || len >  MAX_ARG_LEN)
2086                 return -EINVAL;
2087         if (len != set_arglen[SET_CMDID(cmd)]) {
2088                 pr_err("set_ctl: len %u != %u\n",
2089                        len, set_arglen[SET_CMDID(cmd)]);
2090                 return -EINVAL;
2091         }
2092
2093         if (copy_from_user(arg, user, len) != 0)
2094                 return -EFAULT;
2095
2096         /* increase the module use count */
2097         ip_vs_use_count_inc();
2098
2099         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2100                 ret = -ERESTARTSYS;
2101                 goto out_dec;
2102         }
2103
2104         if (cmd == IP_VS_SO_SET_FLUSH) {
2105                 /* Flush the virtual service */
2106                 ret = ip_vs_flush();
2107                 goto out_unlock;
2108         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2109                 /* Set timeout values for (tcp tcpfin udp) */
2110                 ret = ip_vs_set_timeout((struct ip_vs_timeout_user *)arg);
2111                 goto out_unlock;
2112         } else if (cmd == IP_VS_SO_SET_STARTDAEMON) {
2113                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2114                 ret = start_sync_thread(dm->state, dm->mcast_ifn, dm->syncid);
2115                 goto out_unlock;
2116         } else if (cmd == IP_VS_SO_SET_STOPDAEMON) {
2117                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2118                 ret = stop_sync_thread(dm->state);
2119                 goto out_unlock;
2120         }
2121
2122         usvc_compat = (struct ip_vs_service_user *)arg;
2123         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2124
2125         /* We only use the new structs internally, so copy userspace compat
2126          * structs to extended internal versions */
2127         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2128         ip_vs_copy_udest_compat(&udest, udest_compat);
2129
2130         if (cmd == IP_VS_SO_SET_ZERO) {
2131                 /* if no service address is set, zero counters in all */
2132                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2133                         ret = ip_vs_zero_all();
2134                         goto out_unlock;
2135                 }
2136         }
2137
2138         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2139         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2140             usvc.protocol != IPPROTO_SCTP) {
2141                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2142                        usvc.protocol, &usvc.addr.ip,
2143                        ntohs(usvc.port), usvc.sched_name);
2144                 ret = -EFAULT;
2145                 goto out_unlock;
2146         }
2147
2148         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2149         if (usvc.fwmark == 0)
2150                 svc = __ip_vs_service_get(usvc.af, usvc.protocol,
2151                                           &usvc.addr, usvc.port);
2152         else
2153                 svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
2154
2155         if (cmd != IP_VS_SO_SET_ADD
2156             && (svc == NULL || svc->protocol != usvc.protocol)) {
2157                 ret = -ESRCH;
2158                 goto out_unlock;
2159         }
2160
2161         switch (cmd) {
2162         case IP_VS_SO_SET_ADD:
2163                 if (svc != NULL)
2164                         ret = -EEXIST;
2165                 else
2166                         ret = ip_vs_add_service(&usvc, &svc);
2167                 break;
2168         case IP_VS_SO_SET_EDIT:
2169                 ret = ip_vs_edit_service(svc, &usvc);
2170                 break;
2171         case IP_VS_SO_SET_DEL:
2172                 ret = ip_vs_del_service(svc);
2173                 if (!ret)
2174                         goto out_unlock;
2175                 break;
2176         case IP_VS_SO_SET_ZERO:
2177                 ret = ip_vs_zero_service(svc);
2178                 break;
2179         case IP_VS_SO_SET_ADDDEST:
2180                 ret = ip_vs_add_dest(svc, &udest);
2181                 break;
2182         case IP_VS_SO_SET_EDITDEST:
2183                 ret = ip_vs_edit_dest(svc, &udest);
2184                 break;
2185         case IP_VS_SO_SET_DELDEST:
2186                 ret = ip_vs_del_dest(svc, &udest);
2187                 break;
2188         default:
2189                 ret = -EINVAL;
2190         }
2191
2192         if (svc)
2193                 ip_vs_service_put(svc);
2194
2195   out_unlock:
2196         mutex_unlock(&__ip_vs_mutex);
2197   out_dec:
2198         /* decrease the module use count */
2199         ip_vs_use_count_dec();
2200
2201         return ret;
2202 }
2203
2204
2205 static void
2206 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
2207 {
2208         spin_lock_bh(&src->lock);
2209         memcpy(dst, &src->ustats, sizeof(*dst));
2210         spin_unlock_bh(&src->lock);
2211 }
2212
2213 static void
2214 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2215 {
2216         dst->protocol = src->protocol;
2217         dst->addr = src->addr.ip;
2218         dst->port = src->port;
2219         dst->fwmark = src->fwmark;
2220         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2221         dst->flags = src->flags;
2222         dst->timeout = src->timeout / HZ;
2223         dst->netmask = src->netmask;
2224         dst->num_dests = src->num_dests;
2225         ip_vs_copy_stats(&dst->stats, &src->stats);
2226 }
2227
2228 static inline int
2229 __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
2230                             struct ip_vs_get_services __user *uptr)
2231 {
2232         int idx, count=0;
2233         struct ip_vs_service *svc;
2234         struct ip_vs_service_entry entry;
2235         int ret = 0;
2236
2237         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2238                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2239                         /* Only expose IPv4 entries to old interface */
2240                         if (svc->af != AF_INET)
2241                                 continue;
2242
2243                         if (count >= get->num_services)
2244                                 goto out;
2245                         memset(&entry, 0, sizeof(entry));
2246                         ip_vs_copy_service(&entry, svc);
2247                         if (copy_to_user(&uptr->entrytable[count],
2248                                          &entry, sizeof(entry))) {
2249                                 ret = -EFAULT;
2250                                 goto out;
2251                         }
2252                         count++;
2253                 }
2254         }
2255
2256         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2257                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2258                         /* Only expose IPv4 entries to old interface */
2259                         if (svc->af != AF_INET)
2260                                 continue;
2261
2262                         if (count >= get->num_services)
2263                                 goto out;
2264                         memset(&entry, 0, sizeof(entry));
2265                         ip_vs_copy_service(&entry, svc);
2266                         if (copy_to_user(&uptr->entrytable[count],
2267                                          &entry, sizeof(entry))) {
2268                                 ret = -EFAULT;
2269                                 goto out;
2270                         }
2271                         count++;
2272                 }
2273         }
2274   out:
2275         return ret;
2276 }
2277
2278 static inline int
2279 __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
2280                          struct ip_vs_get_dests __user *uptr)
2281 {
2282         struct ip_vs_service *svc;
2283         union nf_inet_addr addr = { .ip = get->addr };
2284         int ret = 0;
2285
2286         if (get->fwmark)
2287                 svc = __ip_vs_svc_fwm_get(AF_INET, get->fwmark);
2288         else
2289                 svc = __ip_vs_service_get(AF_INET, get->protocol, &addr,
2290                                           get->port);
2291
2292         if (svc) {
2293                 int count = 0;
2294                 struct ip_vs_dest *dest;
2295                 struct ip_vs_dest_entry entry;
2296
2297                 list_for_each_entry(dest, &svc->destinations, n_list) {
2298                         if (count >= get->num_dests)
2299                                 break;
2300
2301                         entry.addr = dest->addr.ip;
2302                         entry.port = dest->port;
2303                         entry.conn_flags = atomic_read(&dest->conn_flags);
2304                         entry.weight = atomic_read(&dest->weight);
2305                         entry.u_threshold = dest->u_threshold;
2306                         entry.l_threshold = dest->l_threshold;
2307                         entry.activeconns = atomic_read(&dest->activeconns);
2308                         entry.inactconns = atomic_read(&dest->inactconns);
2309                         entry.persistconns = atomic_read(&dest->persistconns);
2310                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2311                         if (copy_to_user(&uptr->entrytable[count],
2312                                          &entry, sizeof(entry))) {
2313                                 ret = -EFAULT;
2314                                 break;
2315                         }
2316                         count++;
2317                 }
2318                 ip_vs_service_put(svc);
2319         } else
2320                 ret = -ESRCH;
2321         return ret;
2322 }
2323
2324 static inline void
2325 __ip_vs_get_timeouts(struct ip_vs_timeout_user *u)
2326 {
2327 #ifdef CONFIG_IP_VS_PROTO_TCP
2328         u->tcp_timeout =
2329                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2330         u->tcp_fin_timeout =
2331                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2332 #endif
2333 #ifdef CONFIG_IP_VS_PROTO_UDP
2334         u->udp_timeout =
2335                 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2336 #endif
2337 }
2338
2339
2340 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2341 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2342 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2343 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2344 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2345 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2346 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2347
2348 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2349         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2350         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2351         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2352         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2353         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2354         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2355         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2356 };
2357
2358 static int
2359 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2360 {
2361         unsigned char arg[128];
2362         int ret = 0;
2363         unsigned int copylen;
2364
2365         if (!capable(CAP_NET_ADMIN))
2366                 return -EPERM;
2367
2368         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2369                 return -EINVAL;
2370
2371         if (*len < get_arglen[GET_CMDID(cmd)]) {
2372                 pr_err("get_ctl: len %u < %u\n",
2373                        *len, get_arglen[GET_CMDID(cmd)]);
2374                 return -EINVAL;
2375         }
2376
2377         copylen = get_arglen[GET_CMDID(cmd)];
2378         if (copylen > 128)
2379                 return -EINVAL;
2380
2381         if (copy_from_user(arg, user, copylen) != 0)
2382                 return -EFAULT;
2383
2384         if (mutex_lock_interruptible(&__ip_vs_mutex))
2385                 return -ERESTARTSYS;
2386
2387         switch (cmd) {
2388         case IP_VS_SO_GET_VERSION:
2389         {
2390                 char buf[64];
2391
2392                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2393                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2394                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2395                         ret = -EFAULT;
2396                         goto out;
2397                 }
2398                 *len = strlen(buf)+1;
2399         }
2400         break;
2401
2402         case IP_VS_SO_GET_INFO:
2403         {
2404                 struct ip_vs_getinfo info;
2405                 info.version = IP_VS_VERSION_CODE;
2406                 info.size = ip_vs_conn_tab_size;
2407                 info.num_services = ip_vs_num_services;
2408                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2409                         ret = -EFAULT;
2410         }
2411         break;
2412
2413         case IP_VS_SO_GET_SERVICES:
2414         {
2415                 struct ip_vs_get_services *get;
2416                 int size;
2417
2418                 get = (struct ip_vs_get_services *)arg;
2419                 size = sizeof(*get) +
2420                         sizeof(struct ip_vs_service_entry) * get->num_services;
2421                 if (*len != size) {
2422                         pr_err("length: %u != %u\n", *len, size);
2423                         ret = -EINVAL;
2424                         goto out;
2425                 }
2426                 ret = __ip_vs_get_service_entries(get, user);
2427         }
2428         break;
2429
2430         case IP_VS_SO_GET_SERVICE:
2431         {
2432                 struct ip_vs_service_entry *entry;
2433                 struct ip_vs_service *svc;
2434                 union nf_inet_addr addr;
2435
2436                 entry = (struct ip_vs_service_entry *)arg;
2437                 addr.ip = entry->addr;
2438                 if (entry->fwmark)
2439                         svc = __ip_vs_svc_fwm_get(AF_INET, entry->fwmark);
2440                 else
2441                         svc = __ip_vs_service_get(AF_INET, entry->protocol,
2442                                                   &addr, entry->port);
2443                 if (svc) {
2444                         ip_vs_copy_service(entry, svc);
2445                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2446                                 ret = -EFAULT;
2447                         ip_vs_service_put(svc);
2448                 } else
2449                         ret = -ESRCH;
2450         }
2451         break;
2452
2453         case IP_VS_SO_GET_DESTS:
2454         {
2455                 struct ip_vs_get_dests *get;
2456                 int size;
2457
2458                 get = (struct ip_vs_get_dests *)arg;
2459                 size = sizeof(*get) +
2460                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2461                 if (*len != size) {
2462                         pr_err("length: %u != %u\n", *len, size);
2463                         ret = -EINVAL;
2464                         goto out;
2465                 }
2466                 ret = __ip_vs_get_dest_entries(get, user);
2467         }
2468         break;
2469
2470         case IP_VS_SO_GET_TIMEOUT:
2471         {
2472                 struct ip_vs_timeout_user t;
2473
2474                 __ip_vs_get_timeouts(&t);
2475                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2476                         ret = -EFAULT;
2477         }
2478         break;
2479
2480         case IP_VS_SO_GET_DAEMON:
2481         {
2482                 struct ip_vs_daemon_user d[2];
2483
2484                 memset(&d, 0, sizeof(d));
2485                 if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
2486                         d[0].state = IP_VS_STATE_MASTER;
2487                         strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
2488                         d[0].syncid = ip_vs_master_syncid;
2489                 }
2490                 if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
2491                         d[1].state = IP_VS_STATE_BACKUP;
2492                         strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
2493                         d[1].syncid = ip_vs_backup_syncid;
2494                 }
2495                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2496                         ret = -EFAULT;
2497         }
2498         break;
2499
2500         default:
2501                 ret = -EINVAL;
2502         }
2503
2504   out:
2505         mutex_unlock(&__ip_vs_mutex);
2506         return ret;
2507 }
2508
2509
2510 static struct nf_sockopt_ops ip_vs_sockopts = {
2511         .pf             = PF_INET,
2512         .set_optmin     = IP_VS_BASE_CTL,
2513         .set_optmax     = IP_VS_SO_SET_MAX+1,
2514         .set            = do_ip_vs_set_ctl,
2515         .get_optmin     = IP_VS_BASE_CTL,
2516         .get_optmax     = IP_VS_SO_GET_MAX+1,
2517         .get            = do_ip_vs_get_ctl,
2518         .owner          = THIS_MODULE,
2519 };
2520
2521 /*
2522  * Generic Netlink interface
2523  */
2524
2525 /* IPVS genetlink family */
2526 static struct genl_family ip_vs_genl_family = {
2527         .id             = GENL_ID_GENERATE,
2528         .hdrsize        = 0,
2529         .name           = IPVS_GENL_NAME,
2530         .version        = IPVS_GENL_VERSION,
2531         .maxattr        = IPVS_CMD_MAX,
2532 };
2533
2534 /* Policy used for first-level command attributes */
2535 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2536         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2537         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2538         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2539         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2540         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2541         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2542 };
2543
2544 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2545 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2546         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2547         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2548                                             .len = IP_VS_IFNAME_MAXLEN },
2549         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2550 };
2551
2552 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2553 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2554         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2555         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2556         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2557                                             .len = sizeof(union nf_inet_addr) },
2558         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2559         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2560         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2561                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2562         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2563                                             .len = sizeof(struct ip_vs_flags) },
2564         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2565         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2566         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2567 };
2568
2569 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2570 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2571         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2572                                             .len = sizeof(union nf_inet_addr) },
2573         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2574         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2575         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2576         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2577         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2578         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2579         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2580         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2581         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2582 };
2583
2584 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2585                                  struct ip_vs_stats *stats)
2586 {
2587         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2588         if (!nl_stats)
2589                 return -EMSGSIZE;
2590
2591         spin_lock_bh(&stats->lock);
2592
2593         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, stats->ustats.conns);
2594         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, stats->ustats.inpkts);
2595         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, stats->ustats.outpkts);
2596         NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, stats->ustats.inbytes);
2597         NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, stats->ustats.outbytes);
2598         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, stats->ustats.cps);
2599         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, stats->ustats.inpps);
2600         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, stats->ustats.outpps);
2601         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, stats->ustats.inbps);
2602         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, stats->ustats.outbps);
2603
2604         spin_unlock_bh(&stats->lock);
2605
2606         nla_nest_end(skb, nl_stats);
2607
2608         return 0;
2609
2610 nla_put_failure:
2611         spin_unlock_bh(&stats->lock);
2612         nla_nest_cancel(skb, nl_stats);
2613         return -EMSGSIZE;
2614 }
2615
2616 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2617                                    struct ip_vs_service *svc)
2618 {
2619         struct nlattr *nl_service;
2620         struct ip_vs_flags flags = { .flags = svc->flags,
2621                                      .mask = ~0 };
2622
2623         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2624         if (!nl_service)
2625                 return -EMSGSIZE;
2626
2627         NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
2628
2629         if (svc->fwmark) {
2630                 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2631         } else {
2632                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2633                 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2634                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2635         }
2636
2637         NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
2638         NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2639         NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2640         NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2641
2642         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2643                 goto nla_put_failure;
2644
2645         nla_nest_end(skb, nl_service);
2646
2647         return 0;
2648
2649 nla_put_failure:
2650         nla_nest_cancel(skb, nl_service);
2651         return -EMSGSIZE;
2652 }
2653
2654 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2655                                    struct ip_vs_service *svc,
2656                                    struct netlink_callback *cb)
2657 {
2658         void *hdr;
2659
2660         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2661                           &ip_vs_genl_family, NLM_F_MULTI,
2662                           IPVS_CMD_NEW_SERVICE);
2663         if (!hdr)
2664                 return -EMSGSIZE;
2665
2666         if (ip_vs_genl_fill_service(skb, svc) < 0)
2667                 goto nla_put_failure;
2668
2669         return genlmsg_end(skb, hdr);
2670
2671 nla_put_failure:
2672         genlmsg_cancel(skb, hdr);
2673         return -EMSGSIZE;
2674 }
2675
2676 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2677                                     struct netlink_callback *cb)
2678 {
2679         int idx = 0, i;
2680         int start = cb->args[0];
2681         struct ip_vs_service *svc;
2682
2683         mutex_lock(&__ip_vs_mutex);
2684         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2685                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2686                         if (++idx <= start)
2687                                 continue;
2688                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2689                                 idx--;
2690                                 goto nla_put_failure;
2691                         }
2692                 }
2693         }
2694
2695         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2696                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2697                         if (++idx <= start)
2698                                 continue;
2699                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2700                                 idx--;
2701                                 goto nla_put_failure;
2702                         }
2703                 }
2704         }
2705
2706 nla_put_failure:
2707         mutex_unlock(&__ip_vs_mutex);
2708         cb->args[0] = idx;
2709
2710         return skb->len;
2711 }
2712
2713 static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
2714                                     struct nlattr *nla, int full_entry)
2715 {
2716         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2717         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2718
2719         /* Parse mandatory identifying service fields first */
2720         if (nla == NULL ||
2721             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2722                 return -EINVAL;
2723
2724         nla_af          = attrs[IPVS_SVC_ATTR_AF];
2725         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
2726         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
2727         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
2728         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
2729
2730         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2731                 return -EINVAL;
2732
2733         memset(usvc, 0, sizeof(*usvc));
2734
2735         usvc->af = nla_get_u16(nla_af);
2736 #ifdef CONFIG_IP_VS_IPV6
2737         if (usvc->af != AF_INET && usvc->af != AF_INET6)
2738 #else
2739         if (usvc->af != AF_INET)
2740 #endif
2741                 return -EAFNOSUPPORT;
2742
2743         if (nla_fwmark) {
2744                 usvc->protocol = IPPROTO_TCP;
2745                 usvc->fwmark = nla_get_u32(nla_fwmark);
2746         } else {
2747                 usvc->protocol = nla_get_u16(nla_protocol);
2748                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2749                 usvc->port = nla_get_u16(nla_port);
2750                 usvc->fwmark = 0;
2751         }
2752
2753         /* If a full entry was requested, check for the additional fields */
2754         if (full_entry) {
2755                 struct nlattr *nla_sched, *nla_flags, *nla_timeout,
2756                               *nla_netmask;
2757                 struct ip_vs_flags flags;
2758                 struct ip_vs_service *svc;
2759
2760                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
2761                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2762                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2763                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2764
2765                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
2766                         return -EINVAL;
2767
2768                 nla_memcpy(&flags, nla_flags, sizeof(flags));
2769
2770                 /* prefill flags from service if it already exists */
2771                 if (usvc->fwmark)
2772                         svc = __ip_vs_svc_fwm_get(usvc->af, usvc->fwmark);
2773                 else
2774                         svc = __ip_vs_service_get(usvc->af, usvc->protocol,
2775                                                   &usvc->addr, usvc->port);
2776                 if (svc) {
2777                         usvc->flags = svc->flags;
2778                         ip_vs_service_put(svc);
2779                 } else
2780                         usvc->flags = 0;
2781
2782                 /* set new flags from userland */
2783                 usvc->flags = (usvc->flags & ~flags.mask) |
2784                               (flags.flags & flags.mask);
2785                 usvc->sched_name = nla_data(nla_sched);
2786                 usvc->timeout = nla_get_u32(nla_timeout);
2787                 usvc->netmask = nla_get_u32(nla_netmask);
2788         }
2789
2790         return 0;
2791 }
2792
2793 static struct ip_vs_service *ip_vs_genl_find_service(struct nlattr *nla)
2794 {
2795         struct ip_vs_service_user_kern usvc;
2796         int ret;
2797
2798         ret = ip_vs_genl_parse_service(&usvc, nla, 0);
2799         if (ret)
2800                 return ERR_PTR(ret);
2801
2802         if (usvc.fwmark)
2803                 return __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
2804         else
2805                 return __ip_vs_service_get(usvc.af, usvc.protocol,
2806                                            &usvc.addr, usvc.port);
2807 }
2808
2809 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
2810 {
2811         struct nlattr *nl_dest;
2812
2813         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
2814         if (!nl_dest)
2815                 return -EMSGSIZE;
2816
2817         NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
2818         NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
2819
2820         NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
2821                     atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
2822         NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
2823         NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
2824         NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
2825         NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
2826                     atomic_read(&dest->activeconns));
2827         NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
2828                     atomic_read(&dest->inactconns));
2829         NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
2830                     atomic_read(&dest->persistconns));
2831
2832         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
2833                 goto nla_put_failure;
2834
2835         nla_nest_end(skb, nl_dest);
2836
2837         return 0;
2838
2839 nla_put_failure:
2840         nla_nest_cancel(skb, nl_dest);
2841         return -EMSGSIZE;
2842 }
2843
2844 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
2845                                 struct netlink_callback *cb)
2846 {
2847         void *hdr;
2848
2849         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2850                           &ip_vs_genl_family, NLM_F_MULTI,
2851                           IPVS_CMD_NEW_DEST);
2852         if (!hdr)
2853                 return -EMSGSIZE;
2854
2855         if (ip_vs_genl_fill_dest(skb, dest) < 0)
2856                 goto nla_put_failure;
2857
2858         return genlmsg_end(skb, hdr);
2859
2860 nla_put_failure:
2861         genlmsg_cancel(skb, hdr);
2862         return -EMSGSIZE;
2863 }
2864
2865 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
2866                                  struct netlink_callback *cb)
2867 {
2868         int idx = 0;
2869         int start = cb->args[0];
2870         struct ip_vs_service *svc;
2871         struct ip_vs_dest *dest;
2872         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
2873
2874         mutex_lock(&__ip_vs_mutex);
2875
2876         /* Try to find the service for which to dump destinations */
2877         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
2878                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
2879                 goto out_err;
2880
2881         svc = ip_vs_genl_find_service(attrs[IPVS_CMD_ATTR_SERVICE]);
2882         if (IS_ERR(svc) || svc == NULL)
2883                 goto out_err;
2884
2885         /* Dump the destinations */
2886         list_for_each_entry(dest, &svc->destinations, n_list) {
2887                 if (++idx <= start)
2888                         continue;
2889                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
2890                         idx--;
2891                         goto nla_put_failure;
2892                 }
2893         }
2894
2895 nla_put_failure:
2896         cb->args[0] = idx;
2897         ip_vs_service_put(svc);
2898
2899 out_err:
2900         mutex_unlock(&__ip_vs_mutex);
2901
2902         return skb->len;
2903 }
2904
2905 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
2906                                  struct nlattr *nla, int full_entry)
2907 {
2908         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
2909         struct nlattr *nla_addr, *nla_port;
2910
2911         /* Parse mandatory identifying destination fields first */
2912         if (nla == NULL ||
2913             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
2914                 return -EINVAL;
2915
2916         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
2917         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
2918
2919         if (!(nla_addr && nla_port))
2920                 return -EINVAL;
2921
2922         memset(udest, 0, sizeof(*udest));
2923
2924         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
2925         udest->port = nla_get_u16(nla_port);
2926
2927         /* If a full entry was requested, check for the additional fields */
2928         if (full_entry) {
2929                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
2930                               *nla_l_thresh;
2931
2932                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
2933                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
2934                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
2935                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
2936
2937                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
2938                         return -EINVAL;
2939
2940                 udest->conn_flags = nla_get_u32(nla_fwd)
2941                                     & IP_VS_CONN_F_FWD_MASK;
2942                 udest->weight = nla_get_u32(nla_weight);
2943                 udest->u_threshold = nla_get_u32(nla_u_thresh);
2944                 udest->l_threshold = nla_get_u32(nla_l_thresh);
2945         }
2946
2947         return 0;
2948 }
2949
2950 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
2951                                   const char *mcast_ifn, __be32 syncid)
2952 {
2953         struct nlattr *nl_daemon;
2954
2955         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
2956         if (!nl_daemon)
2957                 return -EMSGSIZE;
2958
2959         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
2960         NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
2961         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
2962
2963         nla_nest_end(skb, nl_daemon);
2964
2965         return 0;
2966
2967 nla_put_failure:
2968         nla_nest_cancel(skb, nl_daemon);
2969         return -EMSGSIZE;
2970 }
2971
2972 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
2973                                   const char *mcast_ifn, __be32 syncid,
2974                                   struct netlink_callback *cb)
2975 {
2976         void *hdr;
2977         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2978                           &ip_vs_genl_family, NLM_F_MULTI,
2979                           IPVS_CMD_NEW_DAEMON);
2980         if (!hdr)
2981                 return -EMSGSIZE;
2982
2983         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
2984                 goto nla_put_failure;
2985
2986         return genlmsg_end(skb, hdr);
2987
2988 nla_put_failure:
2989         genlmsg_cancel(skb, hdr);
2990         return -EMSGSIZE;
2991 }
2992
2993 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
2994                                    struct netlink_callback *cb)
2995 {
2996         mutex_lock(&__ip_vs_mutex);
2997         if ((ip_vs_sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
2998                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
2999                                            ip_vs_master_mcast_ifn,
3000                                            ip_vs_master_syncid, cb) < 0)
3001                         goto nla_put_failure;
3002
3003                 cb->args[0] = 1;
3004         }
3005
3006         if ((ip_vs_sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3007                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3008                                            ip_vs_backup_mcast_ifn,
3009                                            ip_vs_backup_syncid, cb) < 0)
3010                         goto nla_put_failure;
3011
3012                 cb->args[1] = 1;
3013         }
3014
3015 nla_put_failure:
3016         mutex_unlock(&__ip_vs_mutex);
3017
3018         return skb->len;
3019 }
3020
3021 static int ip_vs_genl_new_daemon(struct nlattr **attrs)
3022 {
3023         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3024               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3025               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3026                 return -EINVAL;
3027
3028         return start_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3029                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3030                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3031 }
3032
3033 static int ip_vs_genl_del_daemon(struct nlattr **attrs)
3034 {
3035         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3036                 return -EINVAL;
3037
3038         return stop_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3039 }
3040
3041 static int ip_vs_genl_set_config(struct nlattr **attrs)
3042 {
3043         struct ip_vs_timeout_user t;
3044
3045         __ip_vs_get_timeouts(&t);
3046
3047         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3048                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3049
3050         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3051                 t.tcp_fin_timeout =
3052                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3053
3054         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3055                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3056
3057         return ip_vs_set_timeout(&t);
3058 }
3059
3060 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3061 {
3062         struct ip_vs_service *svc = NULL;
3063         struct ip_vs_service_user_kern usvc;
3064         struct ip_vs_dest_user_kern udest;
3065         int ret = 0, cmd;
3066         int need_full_svc = 0, need_full_dest = 0;
3067
3068         cmd = info->genlhdr->cmd;
3069
3070         mutex_lock(&__ip_vs_mutex);
3071
3072         if (cmd == IPVS_CMD_FLUSH) {
3073                 ret = ip_vs_flush();
3074                 goto out;
3075         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3076                 ret = ip_vs_genl_set_config(info->attrs);
3077                 goto out;
3078         } else if (cmd == IPVS_CMD_NEW_DAEMON ||
3079                    cmd == IPVS_CMD_DEL_DAEMON) {
3080
3081                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3082
3083                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3084                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3085                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3086                                      ip_vs_daemon_policy)) {
3087                         ret = -EINVAL;
3088                         goto out;
3089                 }
3090
3091                 if (cmd == IPVS_CMD_NEW_DAEMON)
3092                         ret = ip_vs_genl_new_daemon(daemon_attrs);
3093                 else
3094                         ret = ip_vs_genl_del_daemon(daemon_attrs);
3095                 goto out;
3096         } else if (cmd == IPVS_CMD_ZERO &&
3097                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3098                 ret = ip_vs_zero_all();
3099                 goto out;
3100         }
3101
3102         /* All following commands require a service argument, so check if we
3103          * received a valid one. We need a full service specification when
3104          * adding / editing a service. Only identifying members otherwise. */
3105         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3106                 need_full_svc = 1;
3107
3108         ret = ip_vs_genl_parse_service(&usvc,
3109                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3110                                        need_full_svc);
3111         if (ret)
3112                 goto out;
3113
3114         /* Lookup the exact service by <protocol, addr, port> or fwmark */
3115         if (usvc.fwmark == 0)
3116                 svc = __ip_vs_service_get(usvc.af, usvc.protocol,
3117                                           &usvc.addr, usvc.port);
3118         else
3119                 svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
3120
3121         /* Unless we're adding a new service, the service must already exist */
3122         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3123                 ret = -ESRCH;
3124                 goto out;
3125         }
3126
3127         /* Destination commands require a valid destination argument. For
3128          * adding / editing a destination, we need a full destination
3129          * specification. */
3130         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3131             cmd == IPVS_CMD_DEL_DEST) {
3132                 if (cmd != IPVS_CMD_DEL_DEST)
3133                         need_full_dest = 1;
3134
3135                 ret = ip_vs_genl_parse_dest(&udest,
3136                                             info->attrs[IPVS_CMD_ATTR_DEST],
3137                                             need_full_dest);
3138                 if (ret)
3139                         goto out;
3140         }
3141
3142         switch (cmd) {
3143         case IPVS_CMD_NEW_SERVICE:
3144                 if (svc == NULL)
3145                         ret = ip_vs_add_service(&usvc, &svc);
3146                 else
3147                         ret = -EEXIST;
3148                 break;
3149         case IPVS_CMD_SET_SERVICE:
3150                 ret = ip_vs_edit_service(svc, &usvc);
3151                 break;
3152         case IPVS_CMD_DEL_SERVICE:
3153                 ret = ip_vs_del_service(svc);
3154                 break;
3155         case IPVS_CMD_NEW_DEST:
3156                 ret = ip_vs_add_dest(svc, &udest);
3157                 break;
3158         case IPVS_CMD_SET_DEST:
3159                 ret = ip_vs_edit_dest(svc, &udest);
3160                 break;
3161         case IPVS_CMD_DEL_DEST:
3162                 ret = ip_vs_del_dest(svc, &udest);
3163                 break;
3164         case IPVS_CMD_ZERO:
3165                 ret = ip_vs_zero_service(svc);
3166                 break;
3167         default:
3168                 ret = -EINVAL;
3169         }
3170
3171 out:
3172         if (svc)
3173                 ip_vs_service_put(svc);
3174         mutex_unlock(&__ip_vs_mutex);
3175
3176         return ret;
3177 }
3178
3179 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3180 {
3181         struct sk_buff *msg;
3182         void *reply;
3183         int ret, cmd, reply_cmd;
3184
3185         cmd = info->genlhdr->cmd;
3186
3187         if (cmd == IPVS_CMD_GET_SERVICE)
3188                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3189         else if (cmd == IPVS_CMD_GET_INFO)
3190                 reply_cmd = IPVS_CMD_SET_INFO;
3191         else if (cmd == IPVS_CMD_GET_CONFIG)
3192                 reply_cmd = IPVS_CMD_SET_CONFIG;
3193         else {
3194                 pr_err("unknown Generic Netlink command\n");
3195                 return -EINVAL;
3196         }
3197
3198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3199         if (!msg)
3200                 return -ENOMEM;
3201
3202         mutex_lock(&__ip_vs_mutex);
3203
3204         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3205         if (reply == NULL)
3206                 goto nla_put_failure;
3207
3208         switch (cmd) {
3209         case IPVS_CMD_GET_SERVICE:
3210         {
3211                 struct ip_vs_service *svc;
3212
3213                 svc = ip_vs_genl_find_service(info->attrs[IPVS_CMD_ATTR_SERVICE]);
3214                 if (IS_ERR(svc)) {
3215                         ret = PTR_ERR(svc);
3216                         goto out_err;
3217                 } else if (svc) {
3218                         ret = ip_vs_genl_fill_service(msg, svc);
3219                         ip_vs_service_put(svc);
3220                         if (ret)
3221                                 goto nla_put_failure;
3222                 } else {
3223                         ret = -ESRCH;
3224                         goto out_err;
3225                 }
3226
3227                 break;
3228         }
3229
3230         case IPVS_CMD_GET_CONFIG:
3231         {
3232                 struct ip_vs_timeout_user t;
3233
3234                 __ip_vs_get_timeouts(&t);
3235 #ifdef CONFIG_IP_VS_PROTO_TCP
3236                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3237                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3238                             t.tcp_fin_timeout);
3239 #endif
3240 #ifdef CONFIG_IP_VS_PROTO_UDP
3241                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3242 #endif
3243
3244                 break;
3245         }
3246
3247         case IPVS_CMD_GET_INFO:
3248                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3249                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3250                             ip_vs_conn_tab_size);
3251                 break;
3252         }
3253
3254         genlmsg_end(msg, reply);
3255         ret = genlmsg_reply(msg, info);
3256         goto out;
3257
3258 nla_put_failure:
3259         pr_err("not enough space in Netlink message\n");
3260         ret = -EMSGSIZE;
3261
3262 out_err:
3263         nlmsg_free(msg);
3264 out:
3265         mutex_unlock(&__ip_vs_mutex);
3266
3267         return ret;
3268 }
3269
3270
3271 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3272         {
3273                 .cmd    = IPVS_CMD_NEW_SERVICE,
3274                 .flags  = GENL_ADMIN_PERM,
3275                 .policy = ip_vs_cmd_policy,
3276                 .doit   = ip_vs_genl_set_cmd,
3277         },
3278         {
3279                 .cmd    = IPVS_CMD_SET_SERVICE,
3280                 .flags  = GENL_ADMIN_PERM,
3281                 .policy = ip_vs_cmd_policy,
3282                 .doit   = ip_vs_genl_set_cmd,
3283         },
3284         {
3285                 .cmd    = IPVS_CMD_DEL_SERVICE,
3286                 .flags  = GENL_ADMIN_PERM,
3287                 .policy = ip_vs_cmd_policy,
3288                 .doit   = ip_vs_genl_set_cmd,
3289         },
3290         {
3291                 .cmd    = IPVS_CMD_GET_SERVICE,
3292                 .flags  = GENL_ADMIN_PERM,
3293                 .doit   = ip_vs_genl_get_cmd,
3294                 .dumpit = ip_vs_genl_dump_services,
3295                 .policy = ip_vs_cmd_policy,
3296         },
3297         {
3298                 .cmd    = IPVS_CMD_NEW_DEST,
3299                 .flags  = GENL_ADMIN_PERM,
3300                 .policy = ip_vs_cmd_policy,
3301                 .doit   = ip_vs_genl_set_cmd,
3302         },
3303         {
3304                 .cmd    = IPVS_CMD_SET_DEST,
3305                 .flags  = GENL_ADMIN_PERM,
3306                 .policy = ip_vs_cmd_policy,
3307                 .doit   = ip_vs_genl_set_cmd,
3308         },
3309         {
3310                 .cmd    = IPVS_CMD_DEL_DEST,
3311                 .flags  = GENL_ADMIN_PERM,
3312                 .policy = ip_vs_cmd_policy,
3313                 .doit   = ip_vs_genl_set_cmd,
3314         },
3315         {
3316                 .cmd    = IPVS_CMD_GET_DEST,
3317                 .flags  = GENL_ADMIN_PERM,
3318                 .policy = ip_vs_cmd_policy,
3319                 .dumpit = ip_vs_genl_dump_dests,
3320         },
3321         {
3322                 .cmd    = IPVS_CMD_NEW_DAEMON,
3323                 .flags  = GENL_ADMIN_PERM,
3324                 .policy = ip_vs_cmd_policy,
3325                 .doit   = ip_vs_genl_set_cmd,
3326         },
3327         {
3328                 .cmd    = IPVS_CMD_DEL_DAEMON,
3329                 .flags  = GENL_ADMIN_PERM,
3330                 .policy = ip_vs_cmd_policy,
3331                 .doit   = ip_vs_genl_set_cmd,
3332         },
3333         {
3334                 .cmd    = IPVS_CMD_GET_DAEMON,
3335                 .flags  = GENL_ADMIN_PERM,
3336                 .dumpit = ip_vs_genl_dump_daemons,
3337         },
3338         {
3339                 .cmd    = IPVS_CMD_SET_CONFIG,
3340                 .flags  = GENL_ADMIN_PERM,
3341                 .policy = ip_vs_cmd_policy,
3342                 .doit   = ip_vs_genl_set_cmd,
3343         },
3344         {
3345                 .cmd    = IPVS_CMD_GET_CONFIG,
3346                 .flags  = GENL_ADMIN_PERM,
3347                 .doit   = ip_vs_genl_get_cmd,
3348         },
3349         {
3350                 .cmd    = IPVS_CMD_GET_INFO,
3351                 .flags  = GENL_ADMIN_PERM,
3352                 .doit   = ip_vs_genl_get_cmd,
3353         },
3354         {
3355                 .cmd    = IPVS_CMD_ZERO,
3356                 .flags  = GENL_ADMIN_PERM,
3357                 .policy = ip_vs_cmd_policy,
3358                 .doit   = ip_vs_genl_set_cmd,
3359         },
3360         {
3361                 .cmd    = IPVS_CMD_FLUSH,
3362                 .flags  = GENL_ADMIN_PERM,
3363                 .doit   = ip_vs_genl_set_cmd,
3364         },
3365 };
3366
3367 static int __init ip_vs_genl_register(void)
3368 {
3369         return genl_register_family_with_ops(&ip_vs_genl_family,
3370                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3371 }
3372
3373 static void ip_vs_genl_unregister(void)
3374 {
3375         genl_unregister_family(&ip_vs_genl_family);
3376 }
3377
3378 /* End of Generic Netlink interface definitions */
3379
3380
3381 int __init ip_vs_control_init(void)
3382 {
3383         int ret;
3384         int idx;
3385
3386         EnterFunction(2);
3387
3388         ret = nf_register_sockopt(&ip_vs_sockopts);
3389         if (ret) {
3390                 pr_err("cannot register sockopt.\n");
3391                 return ret;
3392         }
3393
3394         ret = ip_vs_genl_register();
3395         if (ret) {
3396                 pr_err("cannot register Generic Netlink interface.\n");
3397                 nf_unregister_sockopt(&ip_vs_sockopts);
3398                 return ret;
3399         }
3400
3401         proc_net_fops_create(&init_net, "ip_vs", 0, &ip_vs_info_fops);
3402         proc_net_fops_create(&init_net, "ip_vs_stats",0, &ip_vs_stats_fops);
3403
3404         sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars);
3405
3406         /* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */
3407         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
3408                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3409                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3410         }
3411         for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++)  {
3412                 INIT_LIST_HEAD(&ip_vs_rtable[idx]);
3413         }
3414
3415         ip_vs_new_estimator(&ip_vs_stats);
3416
3417         /* Hook the defense timer */
3418         schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
3419
3420         LeaveFunction(2);
3421         return 0;
3422 }
3423
3424
3425 void ip_vs_control_cleanup(void)
3426 {
3427         EnterFunction(2);
3428         ip_vs_trash_cleanup();
3429         cancel_rearming_delayed_work(&defense_work);
3430         cancel_work_sync(&defense_work.work);
3431         ip_vs_kill_estimator(&ip_vs_stats);
3432         unregister_sysctl_table(sysctl_header);
3433         proc_net_remove(&init_net, "ip_vs_stats");
3434         proc_net_remove(&init_net, "ip_vs");
3435         ip_vs_genl_unregister();
3436         nf_unregister_sockopt(&ip_vs_sockopts);
3437         LeaveFunction(2);
3438 }