?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netfilter: Remove unnecessary OOM logging messages
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / netfilter / ipvs / ip_vs_ctl.c
blob008bf97cc91a58b14a0ef9fd6924eb6f71063f11
1 /*
2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the NetFilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
6 * cluster of servers.
7 *
8 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
9 * Peter Kese <peter.kese@ijs.si>
10 * Julian Anastasov <ja@ssi.bg>
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 *
17 * Changes:
18 *
19 */
20
21 #define KMSG_COMPONENT "IPVS"
22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
23
24 #include <linux/module.h>
25 #include <linux/init.h>
26 #include <linux/types.h>
27 #include <linux/capability.h>
28 #include <linux/fs.h>
29 #include <linux/sysctl.h>
30 #include <linux/proc_fs.h>
31 #include <linux/workqueue.h>
32 #include <linux/swap.h>
33 #include <linux/seq_file.h>
34 #include <linux/slab.h>
35
36 #include <linux/netfilter.h>
37 #include <linux/netfilter_ipv4.h>
38 #include <linux/mutex.h>
39
40 #include <net/net_namespace.h>
41 #include <linux/nsproxy.h>
42 #include <net/ip.h>
43 #ifdef CONFIG_IP_VS_IPV6
44 #include <net/ipv6.h>
45 #include <net/ip6_route.h>
46 #endif
47 #include <net/route.h>
48 #include <net/sock.h>
49 #include <net/genetlink.h>
50
51 #include <asm/uaccess.h>
52
53 #include <net/ip_vs.h>
54
55 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
56 static DEFINE_MUTEX(__ip_vs_mutex);
57
58 /* lock for service table */
59 static DEFINE_RWLOCK(__ip_vs_svc_lock);
60
61 /* sysctl variables */
62
63 #ifdef CONFIG_IP_VS_DEBUG
64 static int sysctl_ip_vs_debug_level = 0;
65
66 int ip_vs_get_debug_level(void)
67 {
68 return sysctl_ip_vs_debug_level;
69 }
70 #endif
71
72
73 /* Protos */
74 static void __ip_vs_del_service(struct ip_vs_service *svc);
75
76
77 #ifdef CONFIG_IP_VS_IPV6
78 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
79 static int __ip_vs_addr_is_local_v6(struct net *net,
80 const struct in6_addr *addr)
81 {
82 struct rt6_info *rt;
83 struct flowi6 fl6 = {
84 .daddr = *addr,
85 };
86
87 rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
88 if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
89 return 1;
90
91 return 0;
92 }
93 #endif
94
95 #ifdef CONFIG_SYSCTL
96 /*
97 * update_defense_level is called from keventd and from sysctl,
98 * so it needs to protect itself from softirqs
99 */
100 static void update_defense_level(struct netns_ipvs *ipvs)
101 {
102 struct sysinfo i;
103 static int old_secure_tcp = 0;
104 int availmem;
105 int nomem;
106 int to_change = -1;
107
108 /* we only count free and buffered memory (in pages) */
109 si_meminfo(&i);
110 availmem = i.freeram + i.bufferram;
111 /* however in linux 2.5 the i.bufferram is total page cache size,
112 we need adjust it */
113 /* si_swapinfo(&i); */
114 /* availmem = availmem - (i.totalswap - i.freeswap); */
115
116 nomem = (availmem < ipvs->sysctl_amemthresh);
117
118 local_bh_disable();
119
120 /* drop_entry */
121 spin_lock(&ipvs->dropentry_lock);
122 switch (ipvs->sysctl_drop_entry) {
123 case 0:
124 atomic_set(&ipvs->dropentry, 0);
125 break;
126 case 1:
127 if (nomem) {
128 atomic_set(&ipvs->dropentry, 1);
129 ipvs->sysctl_drop_entry = 2;
130 } else {
131 atomic_set(&ipvs->dropentry, 0);
132 }
133 break;
134 case 2:
135 if (nomem) {
136 atomic_set(&ipvs->dropentry, 1);
137 } else {
138 atomic_set(&ipvs->dropentry, 0);
139 ipvs->sysctl_drop_entry = 1;
140 };
141 break;
142 case 3:
143 atomic_set(&ipvs->dropentry, 1);
144 break;
145 }
146 spin_unlock(&ipvs->dropentry_lock);
147
148 /* drop_packet */
149 spin_lock(&ipvs->droppacket_lock);
150 switch (ipvs->sysctl_drop_packet) {
151 case 0:
152 ipvs->drop_rate = 0;
153 break;
154 case 1:
155 if (nomem) {
156 ipvs->drop_rate = ipvs->drop_counter
157 = ipvs->sysctl_amemthresh /
158 (ipvs->sysctl_amemthresh-availmem);
159 ipvs->sysctl_drop_packet = 2;
160 } else {
161 ipvs->drop_rate = 0;
162 }
163 break;
164 case 2:
165 if (nomem) {
166 ipvs->drop_rate = ipvs->drop_counter
167 = ipvs->sysctl_amemthresh /
168 (ipvs->sysctl_amemthresh-availmem);
169 } else {
170 ipvs->drop_rate = 0;
171 ipvs->sysctl_drop_packet = 1;
172 }
173 break;
174 case 3:
175 ipvs->drop_rate = ipvs->sysctl_am_droprate;
176 break;
177 }
178 spin_unlock(&ipvs->droppacket_lock);
179
180 /* secure_tcp */
181 spin_lock(&ipvs->securetcp_lock);
182 switch (ipvs->sysctl_secure_tcp) {
183 case 0:
184 if (old_secure_tcp >= 2)
185 to_change = 0;
186 break;
187 case 1:
188 if (nomem) {
189 if (old_secure_tcp < 2)
190 to_change = 1;
191 ipvs->sysctl_secure_tcp = 2;
192 } else {
193 if (old_secure_tcp >= 2)
194 to_change = 0;
195 }
196 break;
197 case 2:
198 if (nomem) {
199 if (old_secure_tcp < 2)
200 to_change = 1;
201 } else {
202 if (old_secure_tcp >= 2)
203 to_change = 0;
204 ipvs->sysctl_secure_tcp = 1;
205 }
206 break;
207 case 3:
208 if (old_secure_tcp < 2)
209 to_change = 1;
210 break;
211 }
212 old_secure_tcp = ipvs->sysctl_secure_tcp;
213 if (to_change >= 0)
214 ip_vs_protocol_timeout_change(ipvs,
215 ipvs->sysctl_secure_tcp > 1);
216 spin_unlock(&ipvs->securetcp_lock);
217
218 local_bh_enable();
219 }
220
221
222 /*
223 * Timer for checking the defense
224 */
225 #define DEFENSE_TIMER_PERIOD 1*HZ
226
227 static void defense_work_handler(struct work_struct *work)
228 {
229 struct netns_ipvs *ipvs =
230 container_of(work, struct netns_ipvs, defense_work.work);
231
232 update_defense_level(ipvs);
233 if (atomic_read(&ipvs->dropentry))
234 ip_vs_random_dropentry(ipvs->net);
235 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
236 }
237 #endif
238
239 int
240 ip_vs_use_count_inc(void)
241 {
242 return try_module_get(THIS_MODULE);
243 }
244
245 void
246 ip_vs_use_count_dec(void)
247 {
248 module_put(THIS_MODULE);
249 }
250
251
252 /*
253 * Hash table: for virtual service lookups
254 */
255 #define IP_VS_SVC_TAB_BITS 8
256 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
257 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
258
259 /* the service table hashed by <protocol, addr, port> */
260 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
261 /* the service table hashed by fwmark */
262 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
263
264
265 /*
266 * Returns hash value for virtual service
267 */
268 static inline unsigned
269 ip_vs_svc_hashkey(struct net *net, int af, unsigned proto,
270 const union nf_inet_addr *addr, __be16 port)
271 {
272 register unsigned porth = ntohs(port);
273 __be32 addr_fold = addr->ip;
274
275 #ifdef CONFIG_IP_VS_IPV6
276 if (af == AF_INET6)
277 addr_fold = addr->ip6[0]^addr->ip6[1]^
278 addr->ip6[2]^addr->ip6[3];
279 #endif
280 addr_fold ^= ((size_t)net>>8);
281
282 return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
283 & IP_VS_SVC_TAB_MASK;
284 }
285
286 /*
287 * Returns hash value of fwmark for virtual service lookup
288 */
289 static inline unsigned ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
290 {
291 return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
292 }
293
294 /*
295 * Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
296 * or in the ip_vs_svc_fwm_table by fwmark.
297 * Should be called with locked tables.
298 */
299 static int ip_vs_svc_hash(struct ip_vs_service *svc)
300 {
301 unsigned hash;
302
303 if (svc->flags & IP_VS_SVC_F_HASHED) {
304 pr_err("%s(): request for already hashed, called from %pF\n",
305 __func__, __builtin_return_address(0));
306 return 0;
307 }
308
309 if (svc->fwmark == 0) {
310 /*
311 * Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
312 */
313 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
314 &svc->addr, svc->port);
315 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
316 } else {
317 /*
318 * Hash it by fwmark in svc_fwm_table
319 */
320 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
321 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
322 }
323
324 svc->flags |= IP_VS_SVC_F_HASHED;
325 /* increase its refcnt because it is referenced by the svc table */
326 atomic_inc(&svc->refcnt);
327 return 1;
328 }
329
330
331 /*
332 * Unhashes a service from svc_table / svc_fwm_table.
333 * Should be called with locked tables.
334 */
335 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
336 {
337 if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
338 pr_err("%s(): request for unhash flagged, called from %pF\n",
339 __func__, __builtin_return_address(0));
340 return 0;
341 }
342
343 if (svc->fwmark == 0) {
344 /* Remove it from the svc_table table */
345 list_del(&svc->s_list);
346 } else {
347 /* Remove it from the svc_fwm_table table */
348 list_del(&svc->f_list);
349 }
350
351 svc->flags &= ~IP_VS_SVC_F_HASHED;
352 atomic_dec(&svc->refcnt);
353 return 1;
354 }
355
356
357 /*
358 * Get service by {netns, proto,addr,port} in the service table.
359 */
360 static inline struct ip_vs_service *
361 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
362 const union nf_inet_addr *vaddr, __be16 vport)
363 {
364 unsigned hash;
365 struct ip_vs_service *svc;
366
367 /* Check for "full" addressed entries */
368 hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
369
370 list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
371 if ((svc->af == af)
372 && ip_vs_addr_equal(af, &svc->addr, vaddr)
373 && (svc->port == vport)
374 && (svc->protocol == protocol)
375 && net_eq(svc->net, net)) {
376 /* HIT */
377 return svc;
378 }
379 }
380
381 return NULL;
382 }
383
384
385 /*
386 * Get service by {fwmark} in the service table.
387 */
388 static inline struct ip_vs_service *
389 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
390 {
391 unsigned hash;
392 struct ip_vs_service *svc;
393
394 /* Check for fwmark addressed entries */
395 hash = ip_vs_svc_fwm_hashkey(net, fwmark);
396
397 list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
398 if (svc->fwmark == fwmark && svc->af == af
399 && net_eq(svc->net, net)) {
400 /* HIT */
401 return svc;
402 }
403 }
404
405 return NULL;
406 }
407
408 struct ip_vs_service *
409 ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
410 const union nf_inet_addr *vaddr, __be16 vport)
411 {
412 struct ip_vs_service *svc;
413 struct netns_ipvs *ipvs = net_ipvs(net);
414
415 read_lock(&__ip_vs_svc_lock);
416
417 /*
418 * Check the table hashed by fwmark first
419 */
420 if (fwmark) {
421 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
422 if (svc)
423 goto out;
424 }
425
426 /*
427 * Check the table hashed by <protocol,addr,port>
428 * for "full" addressed entries
429 */
430 svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
431
432 if (svc == NULL
433 && protocol == IPPROTO_TCP
434 && atomic_read(&ipvs->ftpsvc_counter)
435 && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
436 /*
437 * Check if ftp service entry exists, the packet
438 * might belong to FTP data connections.
439 */
440 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
441 }
442
443 if (svc == NULL
444 && atomic_read(&ipvs->nullsvc_counter)) {
445 /*
446 * Check if the catch-all port (port zero) exists
447 */
448 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
449 }
450
451 out:
452 if (svc)
453 atomic_inc(&svc->usecnt);
454 read_unlock(&__ip_vs_svc_lock);
455
456 IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
457 fwmark, ip_vs_proto_name(protocol),
458 IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
459 svc ? "hit" : "not hit");
460
461 return svc;
462 }
463
464
465 static inline void
466 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
467 {
468 atomic_inc(&svc->refcnt);
469 dest->svc = svc;
470 }
471
472 static void
473 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
474 {
475 struct ip_vs_service *svc = dest->svc;
476
477 dest->svc = NULL;
478 if (atomic_dec_and_test(&svc->refcnt)) {
479 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
480 svc->fwmark,
481 IP_VS_DBG_ADDR(svc->af, &svc->addr),
482 ntohs(svc->port), atomic_read(&svc->usecnt));
483 free_percpu(svc->stats.cpustats);
484 kfree(svc);
485 }
486 }
487
488
489 /*
490 * Returns hash value for real service
491 */
492 static inline unsigned ip_vs_rs_hashkey(int af,
493 const union nf_inet_addr *addr,
494 __be16 port)
495 {
496 register unsigned porth = ntohs(port);
497 __be32 addr_fold = addr->ip;
498
499 #ifdef CONFIG_IP_VS_IPV6
500 if (af == AF_INET6)
501 addr_fold = addr->ip6[0]^addr->ip6[1]^
502 addr->ip6[2]^addr->ip6[3];
503 #endif
504
505 return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
506 & IP_VS_RTAB_MASK;
507 }
508
509 /*
510 * Hashes ip_vs_dest in rs_table by <proto,addr,port>.
511 * should be called with locked tables.
512 */
513 static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
514 {
515 unsigned hash;
516
517 if (!list_empty(&dest->d_list)) {
518 return 0;
519 }
520
521 /*
522 * Hash by proto,addr,port,
523 * which are the parameters of the real service.
524 */
525 hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
526
527 list_add(&dest->d_list, &ipvs->rs_table[hash]);
528
529 return 1;
530 }
531
532 /*
533 * UNhashes ip_vs_dest from rs_table.
534 * should be called with locked tables.
535 */
536 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
537 {
538 /*
539 * Remove it from the rs_table table.
540 */
541 if (!list_empty(&dest->d_list)) {
542 list_del(&dest->d_list);
543 INIT_LIST_HEAD(&dest->d_list);
544 }
545
546 return 1;
547 }
548
549 /*
550 * Lookup real service by <proto,addr,port> in the real service table.
551 */
552 struct ip_vs_dest *
553 ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
554 const union nf_inet_addr *daddr,
555 __be16 dport)
556 {
557 struct netns_ipvs *ipvs = net_ipvs(net);
558 unsigned hash;
559 struct ip_vs_dest *dest;
560
561 /*
562 * Check for "full" addressed entries
563 * Return the first found entry
564 */
565 hash = ip_vs_rs_hashkey(af, daddr, dport);
566
567 read_lock(&ipvs->rs_lock);
568 list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
569 if ((dest->af == af)
570 && ip_vs_addr_equal(af, &dest->addr, daddr)
571 && (dest->port == dport)
572 && ((dest->protocol == protocol) ||
573 dest->vfwmark)) {
574 /* HIT */
575 read_unlock(&ipvs->rs_lock);
576 return dest;
577 }
578 }
579 read_unlock(&ipvs->rs_lock);
580
581 return NULL;
582 }
583
584 /*
585 * Lookup destination by {addr,port} in the given service
586 */
587 static struct ip_vs_dest *
588 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
589 __be16 dport)
590 {
591 struct ip_vs_dest *dest;
592
593 /*
594 * Find the destination for the given service
595 */
596 list_for_each_entry(dest, &svc->destinations, n_list) {
597 if ((dest->af == svc->af)
598 && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
599 && (dest->port == dport)) {
600 /* HIT */
601 return dest;
602 }
603 }
604
605 return NULL;
606 }
607
608 /*
609 * Find destination by {daddr,dport,vaddr,protocol}
610 * Cretaed to be used in ip_vs_process_message() in
611 * the backup synchronization daemon. It finds the
612 * destination to be bound to the received connection
613 * on the backup.
614 *
615 * ip_vs_lookup_real_service() looked promissing, but
616 * seems not working as expected.
617 */
618 struct ip_vs_dest *ip_vs_find_dest(struct net *net, int af,
619 const union nf_inet_addr *daddr,
620 __be16 dport,
621 const union nf_inet_addr *vaddr,
622 __be16 vport, __u16 protocol, __u32 fwmark)
623 {
624 struct ip_vs_dest *dest;
625 struct ip_vs_service *svc;
626
627 svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
628 if (!svc)
629 return NULL;
630 dest = ip_vs_lookup_dest(svc, daddr, dport);
631 if (dest)
632 atomic_inc(&dest->refcnt);
633 ip_vs_service_put(svc);
634 return dest;
635 }
636
637 /*
638 * Lookup dest by {svc,addr,port} in the destination trash.
639 * The destination trash is used to hold the destinations that are removed
640 * from the service table but are still referenced by some conn entries.
641 * The reason to add the destination trash is when the dest is temporary
642 * down (either by administrator or by monitor program), the dest can be
643 * picked back from the trash, the remaining connections to the dest can
644 * continue, and the counting information of the dest is also useful for
645 * scheduling.
646 */
647 static struct ip_vs_dest *
648 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
649 __be16 dport)
650 {
651 struct ip_vs_dest *dest, *nxt;
652 struct netns_ipvs *ipvs = net_ipvs(svc->net);
653
654 /*
655 * Find the destination in trash
656 */
657 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
658 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
659 "dest->refcnt=%d\n",
660 dest->vfwmark,
661 IP_VS_DBG_ADDR(svc->af, &dest->addr),
662 ntohs(dest->port),
663 atomic_read(&dest->refcnt));
664 if (dest->af == svc->af &&
665 ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
666 dest->port == dport &&
667 dest->vfwmark == svc->fwmark &&
668 dest->protocol == svc->protocol &&
669 (svc->fwmark ||
670 (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
671 dest->vport == svc->port))) {
672 /* HIT */
673 return dest;
674 }
675
676 /*
677 * Try to purge the destination from trash if not referenced
678 */
679 if (atomic_read(&dest->refcnt) == 1) {
680 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
681 "from trash\n",
682 dest->vfwmark,
683 IP_VS_DBG_ADDR(svc->af, &dest->addr),
684 ntohs(dest->port));
685 list_del(&dest->n_list);
686 ip_vs_dst_reset(dest);
687 __ip_vs_unbind_svc(dest);
688 free_percpu(dest->stats.cpustats);
689 kfree(dest);
690 }
691 }
692
693 return NULL;
694 }
695
696
697 /*
698 * Clean up all the destinations in the trash
699 * Called by the ip_vs_control_cleanup()
700 *
701 * When the ip_vs_control_clearup is activated by ipvs module exit,
702 * the service tables must have been flushed and all the connections
703 * are expired, and the refcnt of each destination in the trash must
704 * be 1, so we simply release them here.
705 */
706 static void ip_vs_trash_cleanup(struct net *net)
707 {
708 struct ip_vs_dest *dest, *nxt;
709 struct netns_ipvs *ipvs = net_ipvs(net);
710
711 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
712 list_del(&dest->n_list);
713 ip_vs_dst_reset(dest);
714 __ip_vs_unbind_svc(dest);
715 free_percpu(dest->stats.cpustats);
716 kfree(dest);
717 }
718 }
719
720 static void
721 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
722 {
723 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
724
725 spin_lock_bh(&src->lock);
726
727 IP_VS_SHOW_STATS_COUNTER(conns);
728 IP_VS_SHOW_STATS_COUNTER(inpkts);
729 IP_VS_SHOW_STATS_COUNTER(outpkts);
730 IP_VS_SHOW_STATS_COUNTER(inbytes);
731 IP_VS_SHOW_STATS_COUNTER(outbytes);
732
733 ip_vs_read_estimator(dst, src);
734
735 spin_unlock_bh(&src->lock);
736 }
737
738 static void
739 ip_vs_zero_stats(struct ip_vs_stats *stats)
740 {
741 spin_lock_bh(&stats->lock);
742
743 /* get current counters as zero point, rates are zeroed */
744
745 #define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
746
747 IP_VS_ZERO_STATS_COUNTER(conns);
748 IP_VS_ZERO_STATS_COUNTER(inpkts);
749 IP_VS_ZERO_STATS_COUNTER(outpkts);
750 IP_VS_ZERO_STATS_COUNTER(inbytes);
751 IP_VS_ZERO_STATS_COUNTER(outbytes);
752
753 ip_vs_zero_estimator(stats);
754
755 spin_unlock_bh(&stats->lock);
756 }
757
758 /*
759 * Update a destination in the given service
760 */
761 static void
762 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
763 struct ip_vs_dest_user_kern *udest, int add)
764 {
765 struct netns_ipvs *ipvs = net_ipvs(svc->net);
766 int conn_flags;
767
768 /* set the weight and the flags */
769 atomic_set(&dest->weight, udest->weight);
770 conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
771 conn_flags |= IP_VS_CONN_F_INACTIVE;
772
773 /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
774 if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
775 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
776 } else {
777 /*
778 * Put the real service in rs_table if not present.
779 * For now only for NAT!
780 */
781 write_lock_bh(&ipvs->rs_lock);
782 ip_vs_rs_hash(ipvs, dest);
783 write_unlock_bh(&ipvs->rs_lock);
784 }
785 atomic_set(&dest->conn_flags, conn_flags);
786
787 /* bind the service */
788 if (!dest->svc) {
789 __ip_vs_bind_svc(dest, svc);
790 } else {
791 if (dest->svc != svc) {
792 __ip_vs_unbind_svc(dest);
793 ip_vs_zero_stats(&dest->stats);
794 __ip_vs_bind_svc(dest, svc);
795 }
796 }
797
798 /* set the dest status flags */
799 dest->flags |= IP_VS_DEST_F_AVAILABLE;
800
801 if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
802 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
803 dest->u_threshold = udest->u_threshold;
804 dest->l_threshold = udest->l_threshold;
805
806 spin_lock_bh(&dest->dst_lock);
807 ip_vs_dst_reset(dest);
808 spin_unlock_bh(&dest->dst_lock);
809
810 if (add)
811 ip_vs_start_estimator(svc->net, &dest->stats);
812
813 write_lock_bh(&__ip_vs_svc_lock);
814
815 /* Wait until all other svc users go away */
816 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
817
818 if (add) {
819 list_add(&dest->n_list, &svc->destinations);
820 svc->num_dests++;
821 }
822
823 /* call the update_service, because server weight may be changed */
824 if (svc->scheduler->update_service)
825 svc->scheduler->update_service(svc);
826
827 write_unlock_bh(&__ip_vs_svc_lock);
828 }
829
830
831 /*
832 * Create a destination for the given service
833 */
834 static int
835 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
836 struct ip_vs_dest **dest_p)
837 {
838 struct ip_vs_dest *dest;
839 unsigned atype;
840
841 EnterFunction(2);
842
843 #ifdef CONFIG_IP_VS_IPV6
844 if (svc->af == AF_INET6) {
845 atype = ipv6_addr_type(&udest->addr.in6);
846 if ((!(atype & IPV6_ADDR_UNICAST) ||
847 atype & IPV6_ADDR_LINKLOCAL) &&
848 !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
849 return -EINVAL;
850 } else
851 #endif
852 {
853 atype = inet_addr_type(svc->net, udest->addr.ip);
854 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
855 return -EINVAL;
856 }
857
858 dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
859 if (dest == NULL)
860 return -ENOMEM;
861
862 dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
863 if (!dest->stats.cpustats)
864 goto err_alloc;
865
866 dest->af = svc->af;
867 dest->protocol = svc->protocol;
868 dest->vaddr = svc->addr;
869 dest->vport = svc->port;
870 dest->vfwmark = svc->fwmark;
871 ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
872 dest->port = udest->port;
873
874 atomic_set(&dest->activeconns, 0);
875 atomic_set(&dest->inactconns, 0);
876 atomic_set(&dest->persistconns, 0);
877 atomic_set(&dest->refcnt, 1);
878
879 INIT_LIST_HEAD(&dest->d_list);
880 spin_lock_init(&dest->dst_lock);
881 spin_lock_init(&dest->stats.lock);
882 __ip_vs_update_dest(svc, dest, udest, 1);
883
884 *dest_p = dest;
885
886 LeaveFunction(2);
887 return 0;
888
889 err_alloc:
890 kfree(dest);
891 return -ENOMEM;
892 }
893
894
895 /*
896 * Add a destination into an existing service
897 */
898 static int
899 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
900 {
901 struct ip_vs_dest *dest;
902 union nf_inet_addr daddr;
903 __be16 dport = udest->port;
904 int ret;
905
906 EnterFunction(2);
907
908 if (udest->weight < 0) {
909 pr_err("%s(): server weight less than zero\n", __func__);
910 return -ERANGE;
911 }
912
913 if (udest->l_threshold > udest->u_threshold) {
914 pr_err("%s(): lower threshold is higher than upper threshold\n",
915 __func__);
916 return -ERANGE;
917 }
918
919 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
920
921 /*
922 * Check if the dest already exists in the list
923 */
924 dest = ip_vs_lookup_dest(svc, &daddr, dport);
925
926 if (dest != NULL) {
927 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
928 return -EEXIST;
929 }
930
931 /*
932 * Check if the dest already exists in the trash and
933 * is from the same service
934 */
935 dest = ip_vs_trash_get_dest(svc, &daddr, dport);
936
937 if (dest != NULL) {
938 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
939 "dest->refcnt=%d, service %u/%s:%u\n",
940 IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
941 atomic_read(&dest->refcnt),
942 dest->vfwmark,
943 IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
944 ntohs(dest->vport));
945
946 /*
947 * Get the destination from the trash
948 */
949 list_del(&dest->n_list);
950
951 __ip_vs_update_dest(svc, dest, udest, 1);
952 ret = 0;
953 } else {
954 /*
955 * Allocate and initialize the dest structure
956 */
957 ret = ip_vs_new_dest(svc, udest, &dest);
958 }
959 LeaveFunction(2);
960
961 return ret;
962 }
963
964
965 /*
966 * Edit a destination in the given service
967 */
968 static int
969 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
970 {
971 struct ip_vs_dest *dest;
972 union nf_inet_addr daddr;
973 __be16 dport = udest->port;
974
975 EnterFunction(2);
976
977 if (udest->weight < 0) {
978 pr_err("%s(): server weight less than zero\n", __func__);
979 return -ERANGE;
980 }
981
982 if (udest->l_threshold > udest->u_threshold) {
983 pr_err("%s(): lower threshold is higher than upper threshold\n",
984 __func__);
985 return -ERANGE;
986 }
987
988 ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
989
990 /*
991 * Lookup the destination list
992 */
993 dest = ip_vs_lookup_dest(svc, &daddr, dport);
994
995 if (dest == NULL) {
996 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
997 return -ENOENT;
998 }
999
1000 __ip_vs_update_dest(svc, dest, udest, 0);
1001 LeaveFunction(2);
1002
1003 return 0;
1004 }
1005
1006
1007 /*
1008 * Delete a destination (must be already unlinked from the service)
1009 */
1010 static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1011 {
1012 struct netns_ipvs *ipvs = net_ipvs(net);
1013
1014 ip_vs_stop_estimator(net, &dest->stats);
1015
1016 /*
1017 * Remove it from the d-linked list with the real services.
1018 */
1019 write_lock_bh(&ipvs->rs_lock);
1020 ip_vs_rs_unhash(dest);
1021 write_unlock_bh(&ipvs->rs_lock);
1022
1023 /*
1024 * Decrease the refcnt of the dest, and free the dest
1025 * if nobody refers to it (refcnt=0). Otherwise, throw
1026 * the destination into the trash.
1027 */
1028 if (atomic_dec_and_test(&dest->refcnt)) {
1029 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1030 dest->vfwmark,
1031 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1032 ntohs(dest->port));
1033 ip_vs_dst_reset(dest);
1034 /* simply decrease svc->refcnt here, let the caller check
1035 and release the service if nobody refers to it.
1036 Only user context can release destination and service,
1037 and only one user context can update virtual service at a
1038 time, so the operation here is OK */
1039 atomic_dec(&dest->svc->refcnt);
1040 free_percpu(dest->stats.cpustats);
1041 kfree(dest);
1042 } else {
1043 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1044 "dest->refcnt=%d\n",
1045 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1046 ntohs(dest->port),
1047 atomic_read(&dest->refcnt));
1048 list_add(&dest->n_list, &ipvs->dest_trash);
1049 atomic_inc(&dest->refcnt);
1050 }
1051 }
1052
1053
1054 /*
1055 * Unlink a destination from the given service
1056 */
1057 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1058 struct ip_vs_dest *dest,
1059 int svcupd)
1060 {
1061 dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1062
1063 /*
1064 * Remove it from the d-linked destination list.
1065 */
1066 list_del(&dest->n_list);
1067 svc->num_dests--;
1068
1069 /*
1070 * Call the update_service function of its scheduler
1071 */
1072 if (svcupd && svc->scheduler->update_service)
1073 svc->scheduler->update_service(svc);
1074 }
1075
1076
1077 /*
1078 * Delete a destination server in the given service
1079 */
1080 static int
1081 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1082 {
1083 struct ip_vs_dest *dest;
1084 __be16 dport = udest->port;
1085
1086 EnterFunction(2);
1087
1088 dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1089
1090 if (dest == NULL) {
1091 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1092 return -ENOENT;
1093 }
1094
1095 write_lock_bh(&__ip_vs_svc_lock);
1096
1097 /*
1098 * Wait until all other svc users go away.
1099 */
1100 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1101
1102 /*
1103 * Unlink dest from the service
1104 */
1105 __ip_vs_unlink_dest(svc, dest, 1);
1106
1107 write_unlock_bh(&__ip_vs_svc_lock);
1108
1109 /*
1110 * Delete the destination
1111 */
1112 __ip_vs_del_dest(svc->net, dest);
1113
1114 LeaveFunction(2);
1115
1116 return 0;
1117 }
1118
1119
1120 /*
1121 * Add a service into the service hash table
1122 */
1123 static int
1124 ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
1125 struct ip_vs_service **svc_p)
1126 {
1127 int ret = 0;
1128 struct ip_vs_scheduler *sched = NULL;
1129 struct ip_vs_pe *pe = NULL;
1130 struct ip_vs_service *svc = NULL;
1131 struct netns_ipvs *ipvs = net_ipvs(net);
1132
1133 /* increase the module use count */
1134 ip_vs_use_count_inc();
1135
1136 /* Lookup the scheduler by 'u->sched_name' */
1137 sched = ip_vs_scheduler_get(u->sched_name);
1138 if (sched == NULL) {
1139 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1140 ret = -ENOENT;
1141 goto out_err;
1142 }
1143
1144 if (u->pe_name && *u->pe_name) {
1145 pe = ip_vs_pe_getbyname(u->pe_name);
1146 if (pe == NULL) {
1147 pr_info("persistence engine module ip_vs_pe_%s "
1148 "not found\n", u->pe_name);
1149 ret = -ENOENT;
1150 goto out_err;
1151 }
1152 }
1153
1154 #ifdef CONFIG_IP_VS_IPV6
1155 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1156 ret = -EINVAL;
1157 goto out_err;
1158 }
1159 #endif
1160
1161 svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1162 if (svc == NULL) {
1163 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1164 ret = -ENOMEM;
1165 goto out_err;
1166 }
1167 svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1168 if (!svc->stats.cpustats)
1169 goto out_err;
1170
1171 /* I'm the first user of the service */
1172 atomic_set(&svc->usecnt, 0);
1173 atomic_set(&svc->refcnt, 0);
1174
1175 svc->af = u->af;
1176 svc->protocol = u->protocol;
1177 ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1178 svc->port = u->port;
1179 svc->fwmark = u->fwmark;
1180 svc->flags = u->flags;
1181 svc->timeout = u->timeout * HZ;
1182 svc->netmask = u->netmask;
1183 svc->net = net;
1184
1185 INIT_LIST_HEAD(&svc->destinations);
1186 rwlock_init(&svc->sched_lock);
1187 spin_lock_init(&svc->stats.lock);
1188
1189 /* Bind the scheduler */
1190 ret = ip_vs_bind_scheduler(svc, sched);
1191 if (ret)
1192 goto out_err;
1193 sched = NULL;
1194
1195 /* Bind the ct retriever */
1196 ip_vs_bind_pe(svc, pe);
1197 pe = NULL;
1198
1199 /* Update the virtual service counters */
1200 if (svc->port == FTPPORT)
1201 atomic_inc(&ipvs->ftpsvc_counter);
1202 else if (svc->port == 0)
1203 atomic_inc(&ipvs->nullsvc_counter);
1204
1205 ip_vs_start_estimator(net, &svc->stats);
1206
1207 /* Count only IPv4 services for old get/setsockopt interface */
1208 if (svc->af == AF_INET)
1209 ipvs->num_services++;
1210
1211 /* Hash the service into the service table */
1212 write_lock_bh(&__ip_vs_svc_lock);
1213 ip_vs_svc_hash(svc);
1214 write_unlock_bh(&__ip_vs_svc_lock);
1215
1216 *svc_p = svc;
1217 /* Now there is a service - full throttle */
1218 ipvs->enable = 1;
1219 return 0;
1220
1221
1222 out_err:
1223 if (svc != NULL) {
1224 ip_vs_unbind_scheduler(svc);
1225 if (svc->inc) {
1226 local_bh_disable();
1227 ip_vs_app_inc_put(svc->inc);
1228 local_bh_enable();
1229 }
1230 if (svc->stats.cpustats)
1231 free_percpu(svc->stats.cpustats);
1232 kfree(svc);
1233 }
1234 ip_vs_scheduler_put(sched);
1235 ip_vs_pe_put(pe);
1236
1237 /* decrease the module use count */
1238 ip_vs_use_count_dec();
1239
1240 return ret;
1241 }
1242
1243
1244 /*
1245 * Edit a service and bind it with a new scheduler
1246 */
1247 static int
1248 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1249 {
1250 struct ip_vs_scheduler *sched, *old_sched;
1251 struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1252 int ret = 0;
1253
1254 /*
1255 * Lookup the scheduler, by 'u->sched_name'
1256 */
1257 sched = ip_vs_scheduler_get(u->sched_name);
1258 if (sched == NULL) {
1259 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1260 return -ENOENT;
1261 }
1262 old_sched = sched;
1263
1264 if (u->pe_name && *u->pe_name) {
1265 pe = ip_vs_pe_getbyname(u->pe_name);
1266 if (pe == NULL) {
1267 pr_info("persistence engine module ip_vs_pe_%s "
1268 "not found\n", u->pe_name);
1269 ret = -ENOENT;
1270 goto out;
1271 }
1272 old_pe = pe;
1273 }
1274
1275 #ifdef CONFIG_IP_VS_IPV6
1276 if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1277 ret = -EINVAL;
1278 goto out;
1279 }
1280 #endif
1281
1282 write_lock_bh(&__ip_vs_svc_lock);
1283
1284 /*
1285 * Wait until all other svc users go away.
1286 */
1287 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1288
1289 /*
1290 * Set the flags and timeout value
1291 */
1292 svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1293 svc->timeout = u->timeout * HZ;
1294 svc->netmask = u->netmask;
1295
1296 old_sched = svc->scheduler;
1297 if (sched != old_sched) {
1298 /*
1299 * Unbind the old scheduler
1300 */
1301 if ((ret = ip_vs_unbind_scheduler(svc))) {
1302 old_sched = sched;
1303 goto out_unlock;
1304 }
1305
1306 /*
1307 * Bind the new scheduler
1308 */
1309 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1310 /*
1311 * If ip_vs_bind_scheduler fails, restore the old
1312 * scheduler.
1313 * The main reason of failure is out of memory.
1314 *
1315 * The question is if the old scheduler can be
1316 * restored all the time. TODO: if it cannot be
1317 * restored some time, we must delete the service,
1318 * otherwise the system may crash.
1319 */
1320 ip_vs_bind_scheduler(svc, old_sched);
1321 old_sched = sched;
1322 goto out_unlock;
1323 }
1324 }
1325
1326 old_pe = svc->pe;
1327 if (pe != old_pe) {
1328 ip_vs_unbind_pe(svc);
1329 ip_vs_bind_pe(svc, pe);
1330 }
1331
1332 out_unlock:
1333 write_unlock_bh(&__ip_vs_svc_lock);
1334 out:
1335 ip_vs_scheduler_put(old_sched);
1336 ip_vs_pe_put(old_pe);
1337 return ret;
1338 }
1339
1340
1341 /*
1342 * Delete a service from the service list
1343 * - The service must be unlinked, unlocked and not referenced!
1344 * - We are called under _bh lock
1345 */
1346 static void __ip_vs_del_service(struct ip_vs_service *svc)
1347 {
1348 struct ip_vs_dest *dest, *nxt;
1349 struct ip_vs_scheduler *old_sched;
1350 struct ip_vs_pe *old_pe;
1351 struct netns_ipvs *ipvs = net_ipvs(svc->net);
1352
1353 pr_info("%s: enter\n", __func__);
1354
1355 /* Count only IPv4 services for old get/setsockopt interface */
1356 if (svc->af == AF_INET)
1357 ipvs->num_services--;
1358
1359 ip_vs_stop_estimator(svc->net, &svc->stats);
1360
1361 /* Unbind scheduler */
1362 old_sched = svc->scheduler;
1363 ip_vs_unbind_scheduler(svc);
1364 ip_vs_scheduler_put(old_sched);
1365
1366 /* Unbind persistence engine */
1367 old_pe = svc->pe;
1368 ip_vs_unbind_pe(svc);
1369 ip_vs_pe_put(old_pe);
1370
1371 /* Unbind app inc */
1372 if (svc->inc) {
1373 ip_vs_app_inc_put(svc->inc);
1374 svc->inc = NULL;
1375 }
1376
1377 /*
1378 * Unlink the whole destination list
1379 */
1380 list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1381 __ip_vs_unlink_dest(svc, dest, 0);
1382 __ip_vs_del_dest(svc->net, dest);
1383 }
1384
1385 /*
1386 * Update the virtual service counters
1387 */
1388 if (svc->port == FTPPORT)
1389 atomic_dec(&ipvs->ftpsvc_counter);
1390 else if (svc->port == 0)
1391 atomic_dec(&ipvs->nullsvc_counter);
1392
1393 /*
1394 * Free the service if nobody refers to it
1395 */
1396 if (atomic_read(&svc->refcnt) == 0) {
1397 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1398 svc->fwmark,
1399 IP_VS_DBG_ADDR(svc->af, &svc->addr),
1400 ntohs(svc->port), atomic_read(&svc->usecnt));
1401 free_percpu(svc->stats.cpustats);
1402 kfree(svc);
1403 }
1404
1405 /* decrease the module use count */
1406 ip_vs_use_count_dec();
1407 }
1408
1409 /*
1410 * Unlink a service from list and try to delete it if its refcnt reached 0
1411 */
1412 static void ip_vs_unlink_service(struct ip_vs_service *svc)
1413 {
1414 /*
1415 * Unhash it from the service table
1416 */
1417 write_lock_bh(&__ip_vs_svc_lock);
1418
1419 ip_vs_svc_unhash(svc);
1420
1421 /*
1422 * Wait until all the svc users go away.
1423 */
1424 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1425
1426 __ip_vs_del_service(svc);
1427
1428 write_unlock_bh(&__ip_vs_svc_lock);
1429 }
1430
1431 /*
1432 * Delete a service from the service list
1433 */
1434 static int ip_vs_del_service(struct ip_vs_service *svc)
1435 {
1436 if (svc == NULL)
1437 return -EEXIST;
1438 ip_vs_unlink_service(svc);
1439
1440 return 0;
1441 }
1442
1443
1444 /*
1445 * Flush all the virtual services
1446 */
1447 static int ip_vs_flush(struct net *net)
1448 {
1449 int idx;
1450 struct ip_vs_service *svc, *nxt;
1451
1452 /*
1453 * Flush the service table hashed by <netns,protocol,addr,port>
1454 */
1455 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1456 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1457 s_list) {
1458 if (net_eq(svc->net, net))
1459 ip_vs_unlink_service(svc);
1460 }
1461 }
1462
1463 /*
1464 * Flush the service table hashed by fwmark
1465 */
1466 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1467 list_for_each_entry_safe(svc, nxt,
1468 &ip_vs_svc_fwm_table[idx], f_list) {
1469 if (net_eq(svc->net, net))
1470 ip_vs_unlink_service(svc);
1471 }
1472 }
1473
1474 return 0;
1475 }
1476
1477 /*
1478 * Delete service by {netns} in the service table.
1479 * Called by __ip_vs_cleanup()
1480 */
1481 void ip_vs_service_net_cleanup(struct net *net)
1482 {
1483 EnterFunction(2);
1484 /* Check for "full" addressed entries */
1485 mutex_lock(&__ip_vs_mutex);
1486 ip_vs_flush(net);
1487 mutex_unlock(&__ip_vs_mutex);
1488 LeaveFunction(2);
1489 }
1490 /*
1491 * Release dst hold by dst_cache
1492 */
1493 static inline void
1494 __ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1495 {
1496 spin_lock_bh(&dest->dst_lock);
1497 if (dest->dst_cache && dest->dst_cache->dev == dev) {
1498 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1499 dev->name,
1500 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1501 ntohs(dest->port),
1502 atomic_read(&dest->refcnt));
1503 ip_vs_dst_reset(dest);
1504 }
1505 spin_unlock_bh(&dest->dst_lock);
1506
1507 }
1508 /*
1509 * Netdev event receiver
1510 * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1511 * a device that is "unregister" it must be released.
1512 */
1513 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1514 void *ptr)
1515 {
1516 struct net_device *dev = ptr;
1517 struct net *net = dev_net(dev);
1518 struct ip_vs_service *svc;
1519 struct ip_vs_dest *dest;
1520 unsigned int idx;
1521
1522 if (event != NETDEV_UNREGISTER)
1523 return NOTIFY_DONE;
1524 IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1525 EnterFunction(2);
1526 mutex_lock(&__ip_vs_mutex);
1527 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1528 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1529 if (net_eq(svc->net, net)) {
1530 list_for_each_entry(dest, &svc->destinations,
1531 n_list) {
1532 __ip_vs_dev_reset(dest, dev);
1533 }
1534 }
1535 }
1536
1537 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1538 if (net_eq(svc->net, net)) {
1539 list_for_each_entry(dest, &svc->destinations,
1540 n_list) {
1541 __ip_vs_dev_reset(dest, dev);
1542 }
1543 }
1544
1545 }
1546 }
1547
1548 list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
1549 __ip_vs_dev_reset(dest, dev);
1550 }
1551 mutex_unlock(&__ip_vs_mutex);
1552 LeaveFunction(2);
1553 return NOTIFY_DONE;
1554 }
1555
1556 /*
1557 * Zero counters in a service or all services
1558 */
1559 static int ip_vs_zero_service(struct ip_vs_service *svc)
1560 {
1561 struct ip_vs_dest *dest;
1562
1563 write_lock_bh(&__ip_vs_svc_lock);
1564 list_for_each_entry(dest, &svc->destinations, n_list) {
1565 ip_vs_zero_stats(&dest->stats);
1566 }
1567 ip_vs_zero_stats(&svc->stats);
1568 write_unlock_bh(&__ip_vs_svc_lock);
1569 return 0;
1570 }
1571
1572 static int ip_vs_zero_all(struct net *net)
1573 {
1574 int idx;
1575 struct ip_vs_service *svc;
1576
1577 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1578 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1579 if (net_eq(svc->net, net))
1580 ip_vs_zero_service(svc);
1581 }
1582 }
1583
1584 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1585 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1586 if (net_eq(svc->net, net))
1587 ip_vs_zero_service(svc);
1588 }
1589 }
1590
1591 ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1592 return 0;
1593 }
1594
1595 #ifdef CONFIG_SYSCTL
1596 static int
1597 proc_do_defense_mode(ctl_table *table, int write,
1598 void __user *buffer, size_t *lenp, loff_t *ppos)
1599 {
1600 struct net *net = current->nsproxy->net_ns;
1601 int *valp = table->data;
1602 int val = *valp;
1603 int rc;
1604
1605 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1606 if (write && (*valp != val)) {
1607 if ((*valp < 0) || (*valp > 3)) {
1608 /* Restore the correct value */
1609 *valp = val;
1610 } else {
1611 update_defense_level(net_ipvs(net));
1612 }
1613 }
1614 return rc;
1615 }
1616
1617 static int
1618 proc_do_sync_threshold(ctl_table *table, int write,
1619 void __user *buffer, size_t *lenp, loff_t *ppos)
1620 {
1621 int *valp = table->data;
1622 int val[2];
1623 int rc;
1624
1625 /* backup the value first */
1626 memcpy(val, valp, sizeof(val));
1627
1628 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1629 if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1630 /* Restore the correct value */
1631 memcpy(valp, val, sizeof(val));
1632 }
1633 return rc;
1634 }
1635
1636 static int
1637 proc_do_sync_mode(ctl_table *table, int write,
1638 void __user *buffer, size_t *lenp, loff_t *ppos)
1639 {
1640 int *valp = table->data;
1641 int val = *valp;
1642 int rc;
1643
1644 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1645 if (write && (*valp != val)) {
1646 if ((*valp < 0) || (*valp > 1)) {
1647 /* Restore the correct value */
1648 *valp = val;
1649 } else {
1650 struct net *net = current->nsproxy->net_ns;
1651 ip_vs_sync_switch_mode(net, val);
1652 }
1653 }
1654 return rc;
1655 }
1656
1657 /*
1658 * IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1659 * Do not change order or insert new entries without
1660 * align with netns init in ip_vs_control_net_init()
1661 */
1662
1663 static struct ctl_table vs_vars[] = {
1664 {
1665 .procname = "amemthresh",
1666 .maxlen = sizeof(int),
1667 .mode = 0644,
1668 .proc_handler = proc_dointvec,
1669 },
1670 {
1671 .procname = "am_droprate",
1672 .maxlen = sizeof(int),
1673 .mode = 0644,
1674 .proc_handler = proc_dointvec,
1675 },
1676 {
1677 .procname = "drop_entry",
1678 .maxlen = sizeof(int),
1679 .mode = 0644,
1680 .proc_handler = proc_do_defense_mode,
1681 },
1682 {
1683 .procname = "drop_packet",
1684 .maxlen = sizeof(int),
1685 .mode = 0644,
1686 .proc_handler = proc_do_defense_mode,
1687 },
1688 #ifdef CONFIG_IP_VS_NFCT
1689 {
1690 .procname = "conntrack",
1691 .maxlen = sizeof(int),
1692 .mode = 0644,
1693 .proc_handler = &proc_dointvec,
1694 },
1695 #endif
1696 {
1697 .procname = "secure_tcp",
1698 .maxlen = sizeof(int),
1699 .mode = 0644,
1700 .proc_handler = proc_do_defense_mode,
1701 },
1702 {
1703 .procname = "snat_reroute",
1704 .maxlen = sizeof(int),
1705 .mode = 0644,
1706 .proc_handler = &proc_dointvec,
1707 },
1708 {
1709 .procname = "sync_version",
1710 .maxlen = sizeof(int),
1711 .mode = 0644,
1712 .proc_handler = &proc_do_sync_mode,
1713 },
1714 {
1715 .procname = "cache_bypass",
1716 .maxlen = sizeof(int),
1717 .mode = 0644,
1718 .proc_handler = proc_dointvec,
1719 },
1720 {
1721 .procname = "expire_nodest_conn",
1722 .maxlen = sizeof(int),
1723 .mode = 0644,
1724 .proc_handler = proc_dointvec,
1725 },
1726 {
1727 .procname = "expire_quiescent_template",
1728 .maxlen = sizeof(int),
1729 .mode = 0644,
1730 .proc_handler = proc_dointvec,
1731 },
1732 {
1733 .procname = "sync_threshold",
1734 .maxlen =
1735 sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1736 .mode = 0644,
1737 .proc_handler = proc_do_sync_threshold,
1738 },
1739 {
1740 .procname = "nat_icmp_send",
1741 .maxlen = sizeof(int),
1742 .mode = 0644,
1743 .proc_handler = proc_dointvec,
1744 },
1745 #ifdef CONFIG_IP_VS_DEBUG
1746 {
1747 .procname = "debug_level",
1748 .data = &sysctl_ip_vs_debug_level,
1749 .maxlen = sizeof(int),
1750 .mode = 0644,
1751 .proc_handler = proc_dointvec,
1752 },
1753 #endif
1754 #if 0
1755 {
1756 .procname = "timeout_established",
1757 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1758 .maxlen = sizeof(int),
1759 .mode = 0644,
1760 .proc_handler = proc_dointvec_jiffies,
1761 },
1762 {
1763 .procname = "timeout_synsent",
1764 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1765 .maxlen = sizeof(int),
1766 .mode = 0644,
1767 .proc_handler = proc_dointvec_jiffies,
1768 },
1769 {
1770 .procname = "timeout_synrecv",
1771 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1772 .maxlen = sizeof(int),
1773 .mode = 0644,
1774 .proc_handler = proc_dointvec_jiffies,
1775 },
1776 {
1777 .procname = "timeout_finwait",
1778 .data = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1779 .maxlen = sizeof(int),
1780 .mode = 0644,
1781 .proc_handler = proc_dointvec_jiffies,
1782 },
1783 {
1784 .procname = "timeout_timewait",
1785 .data = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1786 .maxlen = sizeof(int),
1787 .mode = 0644,
1788 .proc_handler = proc_dointvec_jiffies,
1789 },
1790 {
1791 .procname = "timeout_close",
1792 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1793 .maxlen = sizeof(int),
1794 .mode = 0644,
1795 .proc_handler = proc_dointvec_jiffies,
1796 },
1797 {
1798 .procname = "timeout_closewait",
1799 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1800 .maxlen = sizeof(int),
1801 .mode = 0644,
1802 .proc_handler = proc_dointvec_jiffies,
1803 },
1804 {
1805 .procname = "timeout_lastack",
1806 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1807 .maxlen = sizeof(int),
1808 .mode = 0644,
1809 .proc_handler = proc_dointvec_jiffies,
1810 },
1811 {
1812 .procname = "timeout_listen",
1813 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1814 .maxlen = sizeof(int),
1815 .mode = 0644,
1816 .proc_handler = proc_dointvec_jiffies,
1817 },
1818 {
1819 .procname = "timeout_synack",
1820 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1821 .maxlen = sizeof(int),
1822 .mode = 0644,
1823 .proc_handler = proc_dointvec_jiffies,
1824 },
1825 {
1826 .procname = "timeout_udp",
1827 .data = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1828 .maxlen = sizeof(int),
1829 .mode = 0644,
1830 .proc_handler = proc_dointvec_jiffies,
1831 },
1832 {
1833 .procname = "timeout_icmp",
1834 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1835 .maxlen = sizeof(int),
1836 .mode = 0644,
1837 .proc_handler = proc_dointvec_jiffies,
1838 },
1839 #endif
1840 { }
1841 };
1842
1843 const struct ctl_path net_vs_ctl_path[] = {
1844 { .procname = "net", },
1845 { .procname = "ipv4", },
1846 { .procname = "vs", },
1847 { }
1848 };
1849 EXPORT_SYMBOL_GPL(net_vs_ctl_path);
1850 #endif
1851
1852 #ifdef CONFIG_PROC_FS
1853
1854 struct ip_vs_iter {
1855 struct seq_net_private p; /* Do not move this, netns depends upon it*/
1856 struct list_head *table;
1857 int bucket;
1858 };
1859
1860 /*
1861 * Write the contents of the VS rule table to a PROCfs file.
1862 * (It is kept just for backward compatibility)
1863 */
1864 static inline const char *ip_vs_fwd_name(unsigned flags)
1865 {
1866 switch (flags & IP_VS_CONN_F_FWD_MASK) {
1867 case IP_VS_CONN_F_LOCALNODE:
1868 return "Local";
1869 case IP_VS_CONN_F_TUNNEL:
1870 return "Tunnel";
1871 case IP_VS_CONN_F_DROUTE:
1872 return "Route";
1873 default:
1874 return "Masq";
1875 }
1876 }
1877
1878
1879 /* Get the Nth entry in the two lists */
1880 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1881 {
1882 struct net *net = seq_file_net(seq);
1883 struct ip_vs_iter *iter = seq->private;
1884 int idx;
1885 struct ip_vs_service *svc;
1886
1887 /* look in hash by protocol */
1888 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1889 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1890 if (net_eq(svc->net, net) && pos-- == 0) {
1891 iter->table = ip_vs_svc_table;
1892 iter->bucket = idx;
1893 return svc;
1894 }
1895 }
1896 }
1897
1898 /* keep looking in fwmark */
1899 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1900 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1901 if (net_eq(svc->net, net) && pos-- == 0) {
1902 iter->table = ip_vs_svc_fwm_table;
1903 iter->bucket = idx;
1904 return svc;
1905 }
1906 }
1907 }
1908
1909 return NULL;
1910 }
1911
1912 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1913 __acquires(__ip_vs_svc_lock)
1914 {
1915
1916 read_lock_bh(&__ip_vs_svc_lock);
1917 return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1918 }
1919
1920
1921 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1922 {
1923 struct list_head *e;
1924 struct ip_vs_iter *iter;
1925 struct ip_vs_service *svc;
1926
1927 ++*pos;
1928 if (v == SEQ_START_TOKEN)
1929 return ip_vs_info_array(seq,0);
1930
1931 svc = v;
1932 iter = seq->private;
1933
1934 if (iter->table == ip_vs_svc_table) {
1935 /* next service in table hashed by protocol */
1936 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1937 return list_entry(e, struct ip_vs_service, s_list);
1938
1939
1940 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1941 list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1942 s_list) {
1943 return svc;
1944 }
1945 }
1946
1947 iter->table = ip_vs_svc_fwm_table;
1948 iter->bucket = -1;
1949 goto scan_fwmark;
1950 }
1951
1952 /* next service in hashed by fwmark */
1953 if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1954 return list_entry(e, struct ip_vs_service, f_list);
1955
1956 scan_fwmark:
1957 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1958 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1959 f_list)
1960 return svc;
1961 }
1962
1963 return NULL;
1964 }
1965
1966 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
1967 __releases(__ip_vs_svc_lock)
1968 {
1969 read_unlock_bh(&__ip_vs_svc_lock);
1970 }
1971
1972
1973 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1974 {
1975 if (v == SEQ_START_TOKEN) {
1976 seq_printf(seq,
1977 "IP Virtual Server version %d.%d.%d (size=%d)\n",
1978 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1979 seq_puts(seq,
1980 "Prot LocalAddress:Port Scheduler Flags\n");
1981 seq_puts(seq,
1982 " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1983 } else {
1984 const struct ip_vs_service *svc = v;
1985 const struct ip_vs_iter *iter = seq->private;
1986 const struct ip_vs_dest *dest;
1987
1988 if (iter->table == ip_vs_svc_table) {
1989 #ifdef CONFIG_IP_VS_IPV6
1990 if (svc->af == AF_INET6)
1991 seq_printf(seq, "%s [%pI6]:%04X %s ",
1992 ip_vs_proto_name(svc->protocol),
1993 &svc->addr.in6,
1994 ntohs(svc->port),
1995 svc->scheduler->name);
1996 else
1997 #endif
1998 seq_printf(seq, "%s %08X:%04X %s %s ",
1999 ip_vs_proto_name(svc->protocol),
2000 ntohl(svc->addr.ip),
2001 ntohs(svc->port),
2002 svc->scheduler->name,
2003 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2004 } else {
2005 seq_printf(seq, "FWM %08X %s %s",
2006 svc->fwmark, svc->scheduler->name,
2007 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2008 }
2009
2010 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2011 seq_printf(seq, "persistent %d %08X\n",
2012 svc->timeout,
2013 ntohl(svc->netmask));
2014 else
2015 seq_putc(seq, '\n');
2016
2017 list_for_each_entry(dest, &svc->destinations, n_list) {
2018 #ifdef CONFIG_IP_VS_IPV6
2019 if (dest->af == AF_INET6)
2020 seq_printf(seq,
2021 " -> [%pI6]:%04X"
2022 " %-7s %-6d %-10d %-10d\n",
2023 &dest->addr.in6,
2024 ntohs(dest->port),
2025 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2026 atomic_read(&dest->weight),
2027 atomic_read(&dest->activeconns),
2028 atomic_read(&dest->inactconns));
2029 else
2030 #endif
2031 seq_printf(seq,
2032 " -> %08X:%04X "
2033 "%-7s %-6d %-10d %-10d\n",
2034 ntohl(dest->addr.ip),
2035 ntohs(dest->port),
2036 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2037 atomic_read(&dest->weight),
2038 atomic_read(&dest->activeconns),
2039 atomic_read(&dest->inactconns));
2040
2041 }
2042 }
2043 return 0;
2044 }
2045
2046 static const struct seq_operations ip_vs_info_seq_ops = {
2047 .start = ip_vs_info_seq_start,
2048 .next = ip_vs_info_seq_next,
2049 .stop = ip_vs_info_seq_stop,
2050 .show = ip_vs_info_seq_show,
2051 };
2052
2053 static int ip_vs_info_open(struct inode *inode, struct file *file)
2054 {
2055 return seq_open_net(inode, file, &ip_vs_info_seq_ops,
2056 sizeof(struct ip_vs_iter));
2057 }
2058
2059 static const struct file_operations ip_vs_info_fops = {
2060 .owner = THIS_MODULE,
2061 .open = ip_vs_info_open,
2062 .read = seq_read,
2063 .llseek = seq_lseek,
2064 .release = seq_release_net,
2065 };
2066
2067 static int ip_vs_stats_show(struct seq_file *seq, void *v)
2068 {
2069 struct net *net = seq_file_single_net(seq);
2070 struct ip_vs_stats_user show;
2071
2072 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2073 seq_puts(seq,
2074 " Total Incoming Outgoing Incoming Outgoing\n");
2075 seq_printf(seq,
2076 " Conns Packets Packets Bytes Bytes\n");
2077
2078 ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2079 seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2080 show.inpkts, show.outpkts,
2081 (unsigned long long) show.inbytes,
2082 (unsigned long long) show.outbytes);
2083
2084 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2085 seq_puts(seq,
2086 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
2087 seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2088 show.cps, show.inpps, show.outpps,
2089 show.inbps, show.outbps);
2090
2091 return 0;
2092 }
2093
2094 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2095 {
2096 return single_open_net(inode, file, ip_vs_stats_show);
2097 }
2098
2099 static const struct file_operations ip_vs_stats_fops = {
2100 .owner = THIS_MODULE,
2101 .open = ip_vs_stats_seq_open,
2102 .read = seq_read,
2103 .llseek = seq_lseek,
2104 .release = single_release_net,
2105 };
2106
2107 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2108 {
2109 struct net *net = seq_file_single_net(seq);
2110 struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2111 struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
2112 struct ip_vs_stats_user rates;
2113 int i;
2114
2115 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2116 seq_puts(seq,
2117 " Total Incoming Outgoing Incoming Outgoing\n");
2118 seq_printf(seq,
2119 "CPU Conns Packets Packets Bytes Bytes\n");
2120
2121 for_each_possible_cpu(i) {
2122 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2123 unsigned int start;
2124 __u64 inbytes, outbytes;
2125
2126 do {
2127 start = u64_stats_fetch_begin_bh(&u->syncp);
2128 inbytes = u->ustats.inbytes;
2129 outbytes = u->ustats.outbytes;
2130 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2131
2132 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2133 i, u->ustats.conns, u->ustats.inpkts,
2134 u->ustats.outpkts, (__u64)inbytes,
2135 (__u64)outbytes);
2136 }
2137
2138 spin_lock_bh(&tot_stats->lock);
2139
2140 seq_printf(seq, " ~ %8X %8X %8X %16LX %16LX\n\n",
2141 tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2142 tot_stats->ustats.outpkts,
2143 (unsigned long long) tot_stats->ustats.inbytes,
2144 (unsigned long long) tot_stats->ustats.outbytes);
2145
2146 ip_vs_read_estimator(&rates, tot_stats);
2147
2148 spin_unlock_bh(&tot_stats->lock);
2149
2150 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2151 seq_puts(seq,
2152 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
2153 seq_printf(seq, " %8X %8X %8X %16X %16X\n",
2154 rates.cps,
2155 rates.inpps,
2156 rates.outpps,
2157 rates.inbps,
2158 rates.outbps);
2159
2160 return 0;
2161 }
2162
2163 static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2164 {
2165 return single_open_net(inode, file, ip_vs_stats_percpu_show);
2166 }
2167
2168 static const struct file_operations ip_vs_stats_percpu_fops = {
2169 .owner = THIS_MODULE,
2170 .open = ip_vs_stats_percpu_seq_open,
2171 .read = seq_read,
2172 .llseek = seq_lseek,
2173 .release = single_release_net,
2174 };
2175 #endif
2176
2177 /*
2178 * Set timeout values for tcp tcpfin udp in the timeout_table.
2179 */
2180 static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
2181 {
2182 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2183 struct ip_vs_proto_data *pd;
2184 #endif
2185
2186 IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2187 u->tcp_timeout,
2188 u->tcp_fin_timeout,
2189 u->udp_timeout);
2190
2191 #ifdef CONFIG_IP_VS_PROTO_TCP
2192 if (u->tcp_timeout) {
2193 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2194 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2195 = u->tcp_timeout * HZ;
2196 }
2197
2198 if (u->tcp_fin_timeout) {
2199 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2200 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2201 = u->tcp_fin_timeout * HZ;
2202 }
2203 #endif
2204
2205 #ifdef CONFIG_IP_VS_PROTO_UDP
2206 if (u->udp_timeout) {
2207 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2208 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2209 = u->udp_timeout * HZ;
2210 }
2211 #endif
2212 return 0;
2213 }
2214
2215
2216 #define SET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2217 #define SERVICE_ARG_LEN (sizeof(struct ip_vs_service_user))
2218 #define SVCDEST_ARG_LEN (sizeof(struct ip_vs_service_user) + \
2219 sizeof(struct ip_vs_dest_user))
2220 #define TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2221 #define DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user))
2222 #define MAX_ARG_LEN SVCDEST_ARG_LEN
2223
2224 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2225 [SET_CMDID(IP_VS_SO_SET_ADD)] = SERVICE_ARG_LEN,
2226 [SET_CMDID(IP_VS_SO_SET_EDIT)] = SERVICE_ARG_LEN,
2227 [SET_CMDID(IP_VS_SO_SET_DEL)] = SERVICE_ARG_LEN,
2228 [SET_CMDID(IP_VS_SO_SET_FLUSH)] = 0,
2229 [SET_CMDID(IP_VS_SO_SET_ADDDEST)] = SVCDEST_ARG_LEN,
2230 [SET_CMDID(IP_VS_SO_SET_DELDEST)] = SVCDEST_ARG_LEN,
2231 [SET_CMDID(IP_VS_SO_SET_EDITDEST)] = SVCDEST_ARG_LEN,
2232 [SET_CMDID(IP_VS_SO_SET_TIMEOUT)] = TIMEOUT_ARG_LEN,
2233 [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)] = DAEMON_ARG_LEN,
2234 [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)] = DAEMON_ARG_LEN,
2235 [SET_CMDID(IP_VS_SO_SET_ZERO)] = SERVICE_ARG_LEN,
2236 };
2237
2238 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2239 struct ip_vs_service_user *usvc_compat)
2240 {
2241 memset(usvc, 0, sizeof(*usvc));
2242
2243 usvc->af = AF_INET;
2244 usvc->protocol = usvc_compat->protocol;
2245 usvc->addr.ip = usvc_compat->addr;
2246 usvc->port = usvc_compat->port;
2247 usvc->fwmark = usvc_compat->fwmark;
2248
2249 /* Deep copy of sched_name is not needed here */
2250 usvc->sched_name = usvc_compat->sched_name;
2251
2252 usvc->flags = usvc_compat->flags;
2253 usvc->timeout = usvc_compat->timeout;
2254 usvc->netmask = usvc_compat->netmask;
2255 }
2256
2257 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2258 struct ip_vs_dest_user *udest_compat)
2259 {
2260 memset(udest, 0, sizeof(*udest));
2261
2262 udest->addr.ip = udest_compat->addr;
2263 udest->port = udest_compat->port;
2264 udest->conn_flags = udest_compat->conn_flags;
2265 udest->weight = udest_compat->weight;
2266 udest->u_threshold = udest_compat->u_threshold;
2267 udest->l_threshold = udest_compat->l_threshold;
2268 }
2269
2270 static int
2271 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2272 {
2273 struct net *net = sock_net(sk);
2274 int ret;
2275 unsigned char arg[MAX_ARG_LEN];
2276 struct ip_vs_service_user *usvc_compat;
2277 struct ip_vs_service_user_kern usvc;
2278 struct ip_vs_service *svc;
2279 struct ip_vs_dest_user *udest_compat;
2280 struct ip_vs_dest_user_kern udest;
2281 struct netns_ipvs *ipvs = net_ipvs(net);
2282
2283 if (!capable(CAP_NET_ADMIN))
2284 return -EPERM;
2285
2286 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2287 return -EINVAL;
2288 if (len < 0 || len > MAX_ARG_LEN)
2289 return -EINVAL;
2290 if (len != set_arglen[SET_CMDID(cmd)]) {
2291 pr_err("set_ctl: len %u != %u\n",
2292 len, set_arglen[SET_CMDID(cmd)]);
2293 return -EINVAL;
2294 }
2295
2296 if (copy_from_user(arg, user, len) != 0)
2297 return -EFAULT;
2298
2299 /* increase the module use count */
2300 ip_vs_use_count_inc();
2301
2302 /* Handle daemons since they have another lock */
2303 if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2304 cmd == IP_VS_SO_SET_STOPDAEMON) {
2305 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2306
2307 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2308 ret = -ERESTARTSYS;
2309 goto out_dec;
2310 }
2311 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2312 ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2313 dm->syncid);
2314 else
2315 ret = stop_sync_thread(net, dm->state);
2316 mutex_unlock(&ipvs->sync_mutex);
2317 goto out_dec;
2318 }
2319
2320 if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2321 ret = -ERESTARTSYS;
2322 goto out_dec;
2323 }
2324
2325 if (cmd == IP_VS_SO_SET_FLUSH) {
2326 /* Flush the virtual service */
2327 ret = ip_vs_flush(net);
2328 goto out_unlock;
2329 } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2330 /* Set timeout values for (tcp tcpfin udp) */
2331 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
2332 goto out_unlock;
2333 }
2334
2335 usvc_compat = (struct ip_vs_service_user *)arg;
2336 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2337
2338 /* We only use the new structs internally, so copy userspace compat
2339 * structs to extended internal versions */
2340 ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2341 ip_vs_copy_udest_compat(&udest, udest_compat);
2342
2343 if (cmd == IP_VS_SO_SET_ZERO) {
2344 /* if no service address is set, zero counters in all */
2345 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2346 ret = ip_vs_zero_all(net);
2347 goto out_unlock;
2348 }
2349 }
2350
2351 /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2352 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2353 usvc.protocol != IPPROTO_SCTP) {
2354 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2355 usvc.protocol, &usvc.addr.ip,
2356 ntohs(usvc.port), usvc.sched_name);
2357 ret = -EFAULT;
2358 goto out_unlock;
2359 }
2360
2361 /* Lookup the exact service by <protocol, addr, port> or fwmark */
2362 if (usvc.fwmark == 0)
2363 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
2364 &usvc.addr, usvc.port);
2365 else
2366 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
2367
2368 if (cmd != IP_VS_SO_SET_ADD
2369 && (svc == NULL || svc->protocol != usvc.protocol)) {
2370 ret = -ESRCH;
2371 goto out_unlock;
2372 }
2373
2374 switch (cmd) {
2375 case IP_VS_SO_SET_ADD:
2376 if (svc != NULL)
2377 ret = -EEXIST;
2378 else
2379 ret = ip_vs_add_service(net, &usvc, &svc);
2380 break;
2381 case IP_VS_SO_SET_EDIT:
2382 ret = ip_vs_edit_service(svc, &usvc);
2383 break;
2384 case IP_VS_SO_SET_DEL:
2385 ret = ip_vs_del_service(svc);
2386 if (!ret)
2387 goto out_unlock;
2388 break;
2389 case IP_VS_SO_SET_ZERO:
2390 ret = ip_vs_zero_service(svc);
2391 break;
2392 case IP_VS_SO_SET_ADDDEST:
2393 ret = ip_vs_add_dest(svc, &udest);
2394 break;
2395 case IP_VS_SO_SET_EDITDEST:
2396 ret = ip_vs_edit_dest(svc, &udest);
2397 break;
2398 case IP_VS_SO_SET_DELDEST:
2399 ret = ip_vs_del_dest(svc, &udest);
2400 break;
2401 default:
2402 ret = -EINVAL;
2403 }
2404
2405 out_unlock:
2406 mutex_unlock(&__ip_vs_mutex);
2407 out_dec:
2408 /* decrease the module use count */
2409 ip_vs_use_count_dec();
2410
2411 return ret;
2412 }
2413
2414
2415 static void
2416 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2417 {
2418 dst->protocol = src->protocol;
2419 dst->addr = src->addr.ip;
2420 dst->port = src->port;
2421 dst->fwmark = src->fwmark;
2422 strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2423 dst->flags = src->flags;
2424 dst->timeout = src->timeout / HZ;
2425 dst->netmask = src->netmask;
2426 dst->num_dests = src->num_dests;
2427 ip_vs_copy_stats(&dst->stats, &src->stats);
2428 }
2429
2430 static inline int
2431 __ip_vs_get_service_entries(struct net *net,
2432 const struct ip_vs_get_services *get,
2433 struct ip_vs_get_services __user *uptr)
2434 {
2435 int idx, count=0;
2436 struct ip_vs_service *svc;
2437 struct ip_vs_service_entry entry;
2438 int ret = 0;
2439
2440 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2441 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2442 /* Only expose IPv4 entries to old interface */
2443 if (svc->af != AF_INET || !net_eq(svc->net, net))
2444 continue;
2445
2446 if (count >= get->num_services)
2447 goto out;
2448 memset(&entry, 0, sizeof(entry));
2449 ip_vs_copy_service(&entry, svc);
2450 if (copy_to_user(&uptr->entrytable[count],
2451 &entry, sizeof(entry))) {
2452 ret = -EFAULT;
2453 goto out;
2454 }
2455 count++;
2456 }
2457 }
2458
2459 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2460 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2461 /* Only expose IPv4 entries to old interface */
2462 if (svc->af != AF_INET || !net_eq(svc->net, net))
2463 continue;
2464
2465 if (count >= get->num_services)
2466 goto out;
2467 memset(&entry, 0, sizeof(entry));
2468 ip_vs_copy_service(&entry, svc);
2469 if (copy_to_user(&uptr->entrytable[count],
2470 &entry, sizeof(entry))) {
2471 ret = -EFAULT;
2472 goto out;
2473 }
2474 count++;
2475 }
2476 }
2477 out:
2478 return ret;
2479 }
2480
2481 static inline int
2482 __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
2483 struct ip_vs_get_dests __user *uptr)
2484 {
2485 struct ip_vs_service *svc;
2486 union nf_inet_addr addr = { .ip = get->addr };
2487 int ret = 0;
2488
2489 if (get->fwmark)
2490 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
2491 else
2492 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
2493 get->port);
2494
2495 if (svc) {
2496 int count = 0;
2497 struct ip_vs_dest *dest;
2498 struct ip_vs_dest_entry entry;
2499
2500 list_for_each_entry(dest, &svc->destinations, n_list) {
2501 if (count >= get->num_dests)
2502 break;
2503
2504 entry.addr = dest->addr.ip;
2505 entry.port = dest->port;
2506 entry.conn_flags = atomic_read(&dest->conn_flags);
2507 entry.weight = atomic_read(&dest->weight);
2508 entry.u_threshold = dest->u_threshold;
2509 entry.l_threshold = dest->l_threshold;
2510 entry.activeconns = atomic_read(&dest->activeconns);
2511 entry.inactconns = atomic_read(&dest->inactconns);
2512 entry.persistconns = atomic_read(&dest->persistconns);
2513 ip_vs_copy_stats(&entry.stats, &dest->stats);
2514 if (copy_to_user(&uptr->entrytable[count],
2515 &entry, sizeof(entry))) {
2516 ret = -EFAULT;
2517 break;
2518 }
2519 count++;
2520 }
2521 } else
2522 ret = -ESRCH;
2523 return ret;
2524 }
2525
2526 static inline void
2527 __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
2528 {
2529 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2530 struct ip_vs_proto_data *pd;
2531 #endif
2532
2533 #ifdef CONFIG_IP_VS_PROTO_TCP
2534 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2535 u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2536 u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2537 #endif
2538 #ifdef CONFIG_IP_VS_PROTO_UDP
2539 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2540 u->udp_timeout =
2541 pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2542 #endif
2543 }
2544
2545
2546 #define GET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2547 #define GET_INFO_ARG_LEN (sizeof(struct ip_vs_getinfo))
2548 #define GET_SERVICES_ARG_LEN (sizeof(struct ip_vs_get_services))
2549 #define GET_SERVICE_ARG_LEN (sizeof(struct ip_vs_service_entry))
2550 #define GET_DESTS_ARG_LEN (sizeof(struct ip_vs_get_dests))
2551 #define GET_TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2552 #define GET_DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user) * 2)
2553
2554 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2555 [GET_CMDID(IP_VS_SO_GET_VERSION)] = 64,
2556 [GET_CMDID(IP_VS_SO_GET_INFO)] = GET_INFO_ARG_LEN,
2557 [GET_CMDID(IP_VS_SO_GET_SERVICES)] = GET_SERVICES_ARG_LEN,
2558 [GET_CMDID(IP_VS_SO_GET_SERVICE)] = GET_SERVICE_ARG_LEN,
2559 [GET_CMDID(IP_VS_SO_GET_DESTS)] = GET_DESTS_ARG_LEN,
2560 [GET_CMDID(IP_VS_SO_GET_TIMEOUT)] = GET_TIMEOUT_ARG_LEN,
2561 [GET_CMDID(IP_VS_SO_GET_DAEMON)] = GET_DAEMON_ARG_LEN,
2562 };
2563
2564 static int
2565 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2566 {
2567 unsigned char arg[128];
2568 int ret = 0;
2569 unsigned int copylen;
2570 struct net *net = sock_net(sk);
2571 struct netns_ipvs *ipvs = net_ipvs(net);
2572
2573 BUG_ON(!net);
2574 if (!capable(CAP_NET_ADMIN))
2575 return -EPERM;
2576
2577 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2578 return -EINVAL;
2579
2580 if (*len < get_arglen[GET_CMDID(cmd)]) {
2581 pr_err("get_ctl: len %u < %u\n",
2582 *len, get_arglen[GET_CMDID(cmd)]);
2583 return -EINVAL;
2584 }
2585
2586 copylen = get_arglen[GET_CMDID(cmd)];
2587 if (copylen > 128)
2588 return -EINVAL;
2589
2590 if (copy_from_user(arg, user, copylen) != 0)
2591 return -EFAULT;
2592 /*
2593 * Handle daemons first since it has its own locking
2594 */
2595 if (cmd == IP_VS_SO_GET_DAEMON) {
2596 struct ip_vs_daemon_user d[2];
2597
2598 memset(&d, 0, sizeof(d));
2599 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2600 return -ERESTARTSYS;
2601
2602 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2603 d[0].state = IP_VS_STATE_MASTER;
2604 strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2605 sizeof(d[0].mcast_ifn));
2606 d[0].syncid = ipvs->master_syncid;
2607 }
2608 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2609 d[1].state = IP_VS_STATE_BACKUP;
2610 strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2611 sizeof(d[1].mcast_ifn));
2612 d[1].syncid = ipvs->backup_syncid;
2613 }
2614 if (copy_to_user(user, &d, sizeof(d)) != 0)
2615 ret = -EFAULT;
2616 mutex_unlock(&ipvs->sync_mutex);
2617 return ret;
2618 }
2619
2620 if (mutex_lock_interruptible(&__ip_vs_mutex))
2621 return -ERESTARTSYS;
2622
2623 switch (cmd) {
2624 case IP_VS_SO_GET_VERSION:
2625 {
2626 char buf[64];
2627
2628 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2629 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2630 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2631 ret = -EFAULT;
2632 goto out;
2633 }
2634 *len = strlen(buf)+1;
2635 }
2636 break;
2637
2638 case IP_VS_SO_GET_INFO:
2639 {
2640 struct ip_vs_getinfo info;
2641 info.version = IP_VS_VERSION_CODE;
2642 info.size = ip_vs_conn_tab_size;
2643 info.num_services = ipvs->num_services;
2644 if (copy_to_user(user, &info, sizeof(info)) != 0)
2645 ret = -EFAULT;
2646 }
2647 break;
2648
2649 case IP_VS_SO_GET_SERVICES:
2650 {
2651 struct ip_vs_get_services *get;
2652 int size;
2653
2654 get = (struct ip_vs_get_services *)arg;
2655 size = sizeof(*get) +
2656 sizeof(struct ip_vs_service_entry) * get->num_services;
2657 if (*len != size) {
2658 pr_err("length: %u != %u\n", *len, size);
2659 ret = -EINVAL;
2660 goto out;
2661 }
2662 ret = __ip_vs_get_service_entries(net, get, user);
2663 }
2664 break;
2665
2666 case IP_VS_SO_GET_SERVICE:
2667 {
2668 struct ip_vs_service_entry *entry;
2669 struct ip_vs_service *svc;
2670 union nf_inet_addr addr;
2671
2672 entry = (struct ip_vs_service_entry *)arg;
2673 addr.ip = entry->addr;
2674 if (entry->fwmark)
2675 svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
2676 else
2677 svc = __ip_vs_service_find(net, AF_INET,
2678 entry->protocol, &addr,
2679 entry->port);
2680 if (svc) {
2681 ip_vs_copy_service(entry, svc);
2682 if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2683 ret = -EFAULT;
2684 } else
2685 ret = -ESRCH;
2686 }
2687 break;
2688
2689 case IP_VS_SO_GET_DESTS:
2690 {
2691 struct ip_vs_get_dests *get;
2692 int size;
2693
2694 get = (struct ip_vs_get_dests *)arg;
2695 size = sizeof(*get) +
2696 sizeof(struct ip_vs_dest_entry) * get->num_dests;
2697 if (*len != size) {
2698 pr_err("length: %u != %u\n", *len, size);
2699 ret = -EINVAL;
2700 goto out;
2701 }
2702 ret = __ip_vs_get_dest_entries(net, get, user);
2703 }
2704 break;
2705
2706 case IP_VS_SO_GET_TIMEOUT:
2707 {
2708 struct ip_vs_timeout_user t;
2709
2710 __ip_vs_get_timeouts(net, &t);
2711 if (copy_to_user(user, &t, sizeof(t)) != 0)
2712 ret = -EFAULT;
2713 }
2714 break;
2715
2716 default:
2717 ret = -EINVAL;
2718 }
2719
2720 out:
2721 mutex_unlock(&__ip_vs_mutex);
2722 return ret;
2723 }
2724
2725
2726 static struct nf_sockopt_ops ip_vs_sockopts = {
2727 .pf = PF_INET,
2728 .set_optmin = IP_VS_BASE_CTL,
2729 .set_optmax = IP_VS_SO_SET_MAX+1,
2730 .set = do_ip_vs_set_ctl,
2731 .get_optmin = IP_VS_BASE_CTL,
2732 .get_optmax = IP_VS_SO_GET_MAX+1,
2733 .get = do_ip_vs_get_ctl,
2734 .owner = THIS_MODULE,
2735 };
2736
2737 /*
2738 * Generic Netlink interface
2739 */
2740
2741 /* IPVS genetlink family */
2742 static struct genl_family ip_vs_genl_family = {
2743 .id = GENL_ID_GENERATE,
2744 .hdrsize = 0,
2745 .name = IPVS_GENL_NAME,
2746 .version = IPVS_GENL_VERSION,
2747 .maxattr = IPVS_CMD_MAX,
2748 .netnsok = true, /* Make ipvsadm to work on netns */
2749 };
2750
2751 /* Policy used for first-level command attributes */
2752 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2753 [IPVS_CMD_ATTR_SERVICE] = { .type = NLA_NESTED },
2754 [IPVS_CMD_ATTR_DEST] = { .type = NLA_NESTED },
2755 [IPVS_CMD_ATTR_DAEMON] = { .type = NLA_NESTED },
2756 [IPVS_CMD_ATTR_TIMEOUT_TCP] = { .type = NLA_U32 },
2757 [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2758 [IPVS_CMD_ATTR_TIMEOUT_UDP] = { .type = NLA_U32 },
2759 };
2760
2761 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2762 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2763 [IPVS_DAEMON_ATTR_STATE] = { .type = NLA_U32 },
2764 [IPVS_DAEMON_ATTR_MCAST_IFN] = { .type = NLA_NUL_STRING,
2765 .len = IP_VS_IFNAME_MAXLEN },
2766 [IPVS_DAEMON_ATTR_SYNC_ID] = { .type = NLA_U32 },
2767 };
2768
2769 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2770 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2771 [IPVS_SVC_ATTR_AF] = { .type = NLA_U16 },
2772 [IPVS_SVC_ATTR_PROTOCOL] = { .type = NLA_U16 },
2773 [IPVS_SVC_ATTR_ADDR] = { .type = NLA_BINARY,
2774 .len = sizeof(union nf_inet_addr) },
2775 [IPVS_SVC_ATTR_PORT] = { .type = NLA_U16 },
2776 [IPVS_SVC_ATTR_FWMARK] = { .type = NLA_U32 },
2777 [IPVS_SVC_ATTR_SCHED_NAME] = { .type = NLA_NUL_STRING,
2778 .len = IP_VS_SCHEDNAME_MAXLEN },
2779 [IPVS_SVC_ATTR_PE_NAME] = { .type = NLA_NUL_STRING,
2780 .len = IP_VS_PENAME_MAXLEN },
2781 [IPVS_SVC_ATTR_FLAGS] = { .type = NLA_BINARY,
2782 .len = sizeof(struct ip_vs_flags) },
2783 [IPVS_SVC_ATTR_TIMEOUT] = { .type = NLA_U32 },
2784 [IPVS_SVC_ATTR_NETMASK] = { .type = NLA_U32 },
2785 [IPVS_SVC_ATTR_STATS] = { .type = NLA_NESTED },
2786 };
2787
2788 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2789 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2790 [IPVS_DEST_ATTR_ADDR] = { .type = NLA_BINARY,
2791 .len = sizeof(union nf_inet_addr) },
2792 [IPVS_DEST_ATTR_PORT] = { .type = NLA_U16 },
2793 [IPVS_DEST_ATTR_FWD_METHOD] = { .type = NLA_U32 },
2794 [IPVS_DEST_ATTR_WEIGHT] = { .type = NLA_U32 },
2795 [IPVS_DEST_ATTR_U_THRESH] = { .type = NLA_U32 },
2796 [IPVS_DEST_ATTR_L_THRESH] = { .type = NLA_U32 },
2797 [IPVS_DEST_ATTR_ACTIVE_CONNS] = { .type = NLA_U32 },
2798 [IPVS_DEST_ATTR_INACT_CONNS] = { .type = NLA_U32 },
2799 [IPVS_DEST_ATTR_PERSIST_CONNS] = { .type = NLA_U32 },
2800 [IPVS_DEST_ATTR_STATS] = { .type = NLA_NESTED },
2801 };
2802
2803 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2804 struct ip_vs_stats *stats)
2805 {
2806 struct ip_vs_stats_user ustats;
2807 struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2808 if (!nl_stats)
2809 return -EMSGSIZE;
2810
2811 ip_vs_copy_stats(&ustats, stats);
2812
2813 NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns);
2814 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts);
2815 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts);
2816 NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes);
2817 NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes);
2818 NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, ustats.cps);
2819 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps);
2820 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps);
2821 NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps);
2822 NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps);
2823
2824 nla_nest_end(skb, nl_stats);
2825
2826 return 0;
2827
2828 nla_put_failure:
2829 nla_nest_cancel(skb, nl_stats);
2830 return -EMSGSIZE;
2831 }
2832
2833 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2834 struct ip_vs_service *svc)
2835 {
2836 struct nlattr *nl_service;
2837 struct ip_vs_flags flags = { .flags = svc->flags,
2838 .mask = ~0 };
2839
2840 nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2841 if (!nl_service)
2842 return -EMSGSIZE;
2843
2844 NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
2845
2846 if (svc->fwmark) {
2847 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2848 } else {
2849 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2850 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2851 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2852 }
2853
2854 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
2855 if (svc->pe)
2856 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name);
2857 NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2858 NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2859 NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2860
2861 if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2862 goto nla_put_failure;
2863
2864 nla_nest_end(skb, nl_service);
2865
2866 return 0;
2867
2868 nla_put_failure:
2869 nla_nest_cancel(skb, nl_service);
2870 return -EMSGSIZE;
2871 }
2872
2873 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2874 struct ip_vs_service *svc,
2875 struct netlink_callback *cb)
2876 {
2877 void *hdr;
2878
2879 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2880 &ip_vs_genl_family, NLM_F_MULTI,
2881 IPVS_CMD_NEW_SERVICE);
2882 if (!hdr)
2883 return -EMSGSIZE;
2884
2885 if (ip_vs_genl_fill_service(skb, svc) < 0)
2886 goto nla_put_failure;
2887
2888 return genlmsg_end(skb, hdr);
2889
2890 nla_put_failure:
2891 genlmsg_cancel(skb, hdr);
2892 return -EMSGSIZE;
2893 }
2894
2895 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2896 struct netlink_callback *cb)
2897 {
2898 int idx = 0, i;
2899 int start = cb->args[0];
2900 struct ip_vs_service *svc;
2901 struct net *net = skb_sknet(skb);
2902
2903 mutex_lock(&__ip_vs_mutex);
2904 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2905 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2906 if (++idx <= start || !net_eq(svc->net, net))
2907 continue;
2908 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2909 idx--;
2910 goto nla_put_failure;
2911 }
2912 }
2913 }
2914
2915 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2916 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2917 if (++idx <= start || !net_eq(svc->net, net))
2918 continue;
2919 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2920 idx--;
2921 goto nla_put_failure;
2922 }
2923 }
2924 }
2925
2926 nla_put_failure:
2927 mutex_unlock(&__ip_vs_mutex);
2928 cb->args[0] = idx;
2929
2930 return skb->len;
2931 }
2932
2933 static int ip_vs_genl_parse_service(struct net *net,
2934 struct ip_vs_service_user_kern *usvc,
2935 struct nlattr *nla, int full_entry,
2936 struct ip_vs_service **ret_svc)
2937 {
2938 struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2939 struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2940 struct ip_vs_service *svc;
2941
2942 /* Parse mandatory identifying service fields first */
2943 if (nla == NULL ||
2944 nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2945 return -EINVAL;
2946
2947 nla_af = attrs[IPVS_SVC_ATTR_AF];
2948 nla_protocol = attrs[IPVS_SVC_ATTR_PROTOCOL];
2949 nla_addr = attrs[IPVS_SVC_ATTR_ADDR];
2950 nla_port = attrs[IPVS_SVC_ATTR_PORT];
2951 nla_fwmark = attrs[IPVS_SVC_ATTR_FWMARK];
2952
2953 if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2954 return -EINVAL;
2955
2956 memset(usvc, 0, sizeof(*usvc));
2957
2958 usvc->af = nla_get_u16(nla_af);
2959 #ifdef CONFIG_IP_VS_IPV6
2960 if (usvc->af != AF_INET && usvc->af != AF_INET6)
2961 #else
2962 if (usvc->af != AF_INET)
2963 #endif
2964 return -EAFNOSUPPORT;
2965
2966 if (nla_fwmark) {
2967 usvc->protocol = IPPROTO_TCP;
2968 usvc->fwmark = nla_get_u32(nla_fwmark);
2969 } else {
2970 usvc->protocol = nla_get_u16(nla_protocol);
2971 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2972 usvc->port = nla_get_u16(nla_port);
2973 usvc->fwmark = 0;
2974 }
2975
2976 if (usvc->fwmark)
2977 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
2978 else
2979 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
2980 &usvc->addr, usvc->port);
2981 *ret_svc = svc;
2982
2983 /* If a full entry was requested, check for the additional fields */
2984 if (full_entry) {
2985 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
2986 *nla_netmask;
2987 struct ip_vs_flags flags;
2988
2989 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
2990 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
2991 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2992 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2993 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2994
2995 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
2996 return -EINVAL;
2997
2998 nla_memcpy(&flags, nla_flags, sizeof(flags));
2999
3000 /* prefill flags from service if it already exists */
3001 if (svc)
3002 usvc->flags = svc->flags;
3003
3004 /* set new flags from userland */
3005 usvc->flags = (usvc->flags & ~flags.mask) |
3006 (flags.flags & flags.mask);
3007 usvc->sched_name = nla_data(nla_sched);
3008 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3009 usvc->timeout = nla_get_u32(nla_timeout);
3010 usvc->netmask = nla_get_u32(nla_netmask);
3011 }
3012
3013 return 0;
3014 }
3015
3016 static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3017 struct nlattr *nla)
3018 {
3019 struct ip_vs_service_user_kern usvc;
3020 struct ip_vs_service *svc;
3021 int ret;
3022
3023 ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
3024 return ret ? ERR_PTR(ret) : svc;
3025 }
3026
3027 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3028 {
3029 struct nlattr *nl_dest;
3030
3031 nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3032 if (!nl_dest)
3033 return -EMSGSIZE;
3034
3035 NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
3036 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
3037
3038 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3039 atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
3040 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
3041 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
3042 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
3043 NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3044 atomic_read(&dest->activeconns));
3045 NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3046 atomic_read(&dest->inactconns));
3047 NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3048 atomic_read(&dest->persistconns));
3049
3050 if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3051 goto nla_put_failure;
3052
3053 nla_nest_end(skb, nl_dest);
3054
3055 return 0;
3056
3057 nla_put_failure:
3058 nla_nest_cancel(skb, nl_dest);
3059 return -EMSGSIZE;
3060 }
3061
3062 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3063 struct netlink_callback *cb)
3064 {
3065 void *hdr;
3066
3067 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3068 &ip_vs_genl_family, NLM_F_MULTI,
3069 IPVS_CMD_NEW_DEST);
3070 if (!hdr)
3071 return -EMSGSIZE;
3072
3073 if (ip_vs_genl_fill_dest(skb, dest) < 0)
3074 goto nla_put_failure;
3075
3076 return genlmsg_end(skb, hdr);
3077
3078 nla_put_failure:
3079 genlmsg_cancel(skb, hdr);
3080 return -EMSGSIZE;
3081 }
3082
3083 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3084 struct netlink_callback *cb)
3085 {
3086 int idx = 0;
3087 int start = cb->args[0];
3088 struct ip_vs_service *svc;
3089 struct ip_vs_dest *dest;
3090 struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3091 struct net *net = skb_sknet(skb);
3092
3093 mutex_lock(&__ip_vs_mutex);
3094
3095 /* Try to find the service for which to dump destinations */
3096 if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3097 IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3098 goto out_err;
3099
3100
3101 svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
3102 if (IS_ERR(svc) || svc == NULL)
3103 goto out_err;
3104
3105 /* Dump the destinations */
3106 list_for_each_entry(dest, &svc->destinations, n_list) {
3107 if (++idx <= start)
3108 continue;
3109 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3110 idx--;
3111 goto nla_put_failure;
3112 }
3113 }
3114
3115 nla_put_failure:
3116 cb->args[0] = idx;
3117
3118 out_err:
3119 mutex_unlock(&__ip_vs_mutex);
3120
3121 return skb->len;
3122 }
3123
3124 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3125 struct nlattr *nla, int full_entry)
3126 {
3127 struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3128 struct nlattr *nla_addr, *nla_port;
3129
3130 /* Parse mandatory identifying destination fields first */
3131 if (nla == NULL ||
3132 nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3133 return -EINVAL;
3134
3135 nla_addr = attrs[IPVS_DEST_ATTR_ADDR];
3136 nla_port = attrs[IPVS_DEST_ATTR_PORT];
3137
3138 if (!(nla_addr && nla_port))
3139 return -EINVAL;
3140
3141 memset(udest, 0, sizeof(*udest));
3142
3143 nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3144 udest->port = nla_get_u16(nla_port);
3145
3146 /* If a full entry was requested, check for the additional fields */
3147 if (full_entry) {
3148 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3149 *nla_l_thresh;
3150
3151 nla_fwd = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3152 nla_weight = attrs[IPVS_DEST_ATTR_WEIGHT];
3153 nla_u_thresh = attrs[IPVS_DEST_ATTR_U_THRESH];
3154 nla_l_thresh = attrs[IPVS_DEST_ATTR_L_THRESH];
3155
3156 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3157 return -EINVAL;
3158
3159 udest->conn_flags = nla_get_u32(nla_fwd)
3160 & IP_VS_CONN_F_FWD_MASK;
3161 udest->weight = nla_get_u32(nla_weight);
3162 udest->u_threshold = nla_get_u32(nla_u_thresh);
3163 udest->l_threshold = nla_get_u32(nla_l_thresh);
3164 }
3165
3166 return 0;
3167 }
3168
3169 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3170 const char *mcast_ifn, __be32 syncid)
3171 {
3172 struct nlattr *nl_daemon;
3173
3174 nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3175 if (!nl_daemon)
3176 return -EMSGSIZE;
3177
3178 NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
3179 NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
3180 NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
3181
3182 nla_nest_end(skb, nl_daemon);
3183
3184 return 0;
3185
3186 nla_put_failure:
3187 nla_nest_cancel(skb, nl_daemon);
3188 return -EMSGSIZE;
3189 }
3190
3191 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3192 const char *mcast_ifn, __be32 syncid,
3193 struct netlink_callback *cb)
3194 {
3195 void *hdr;
3196 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3197 &ip_vs_genl_family, NLM_F_MULTI,
3198 IPVS_CMD_NEW_DAEMON);
3199 if (!hdr)
3200 return -EMSGSIZE;
3201
3202 if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3203 goto nla_put_failure;
3204
3205 return genlmsg_end(skb, hdr);
3206
3207 nla_put_failure:
3208 genlmsg_cancel(skb, hdr);
3209 return -EMSGSIZE;
3210 }
3211
3212 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3213 struct netlink_callback *cb)
3214 {
3215 struct net *net = skb_sknet(skb);
3216 struct netns_ipvs *ipvs = net_ipvs(net);
3217
3218 mutex_lock(&ipvs->sync_mutex);
3219 if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3220 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3221 ipvs->master_mcast_ifn,
3222 ipvs->master_syncid, cb) < 0)
3223 goto nla_put_failure;
3224
3225 cb->args[0] = 1;
3226 }
3227
3228 if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3229 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3230 ipvs->backup_mcast_ifn,
3231 ipvs->backup_syncid, cb) < 0)
3232 goto nla_put_failure;
3233
3234 cb->args[1] = 1;
3235 }
3236
3237 nla_put_failure:
3238 mutex_unlock(&ipvs->sync_mutex);
3239
3240 return skb->len;
3241 }
3242
3243 static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
3244 {
3245 if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3246 attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3247 attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3248 return -EINVAL;
3249
3250 return start_sync_thread(net,
3251 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3252 nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3253 nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3254 }
3255
3256 static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
3257 {
3258 if (!attrs[IPVS_DAEMON_ATTR_STATE])
3259 return -EINVAL;
3260
3261 return stop_sync_thread(net,
3262 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3263 }
3264
3265 static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
3266 {
3267 struct ip_vs_timeout_user t;
3268
3269 __ip_vs_get_timeouts(net, &t);
3270
3271 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3272 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3273
3274 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3275 t.tcp_fin_timeout =
3276 nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3277
3278 if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3279 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3280
3281 return ip_vs_set_timeout(net, &t);
3282 }
3283
3284 static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3285 {
3286 int ret = 0, cmd;
3287 struct net *net;
3288 struct netns_ipvs *ipvs;
3289
3290 net = skb_sknet(skb);
3291 ipvs = net_ipvs(net);
3292 cmd = info->genlhdr->cmd;
3293
3294 if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3295 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3296
3297 mutex_lock(&ipvs->sync_mutex);
3298 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3299 nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3300 info->attrs[IPVS_CMD_ATTR_DAEMON],
3301 ip_vs_daemon_policy)) {
3302 ret = -EINVAL;
3303 goto out;
3304 }
3305
3306 if (cmd == IPVS_CMD_NEW_DAEMON)
3307 ret = ip_vs_genl_new_daemon(net, daemon_attrs);
3308 else
3309 ret = ip_vs_genl_del_daemon(net, daemon_attrs);
3310 out:
3311 mutex_unlock(&ipvs->sync_mutex);
3312 }
3313 return ret;
3314 }
3315
3316 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3317 {
3318 struct ip_vs_service *svc = NULL;
3319 struct ip_vs_service_user_kern usvc;
3320 struct ip_vs_dest_user_kern udest;
3321 int ret = 0, cmd;
3322 int need_full_svc = 0, need_full_dest = 0;
3323 struct net *net;
3324
3325 net = skb_sknet(skb);
3326 cmd = info->genlhdr->cmd;
3327
3328 mutex_lock(&__ip_vs_mutex);
3329
3330 if (cmd == IPVS_CMD_FLUSH) {
3331 ret = ip_vs_flush(net);
3332 goto out;
3333 } else if (cmd == IPVS_CMD_SET_CONFIG) {
3334 ret = ip_vs_genl_set_config(net, info->attrs);
3335 goto out;
3336 } else if (cmd == IPVS_CMD_ZERO &&
3337 !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3338 ret = ip_vs_zero_all(net);
3339 goto out;
3340 }
3341
3342 /* All following commands require a service argument, so check if we
3343 * received a valid one. We need a full service specification when
3344 * adding / editing a service. Only identifying members otherwise. */
3345 if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3346 need_full_svc = 1;
3347
3348 ret = ip_vs_genl_parse_service(net, &usvc,
3349 info->attrs[IPVS_CMD_ATTR_SERVICE],
3350 need_full_svc, &svc);
3351 if (ret)
3352 goto out;
3353
3354 /* Unless we're adding a new service, the service must already exist */
3355 if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3356 ret = -ESRCH;
3357 goto out;
3358 }
3359
3360 /* Destination commands require a valid destination argument. For
3361 * adding / editing a destination, we need a full destination
3362 * specification. */
3363 if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3364 cmd == IPVS_CMD_DEL_DEST) {
3365 if (cmd != IPVS_CMD_DEL_DEST)
3366 need_full_dest = 1;
3367
3368 ret = ip_vs_genl_parse_dest(&udest,
3369 info->attrs[IPVS_CMD_ATTR_DEST],
3370 need_full_dest);
3371 if (ret)
3372 goto out;
3373 }
3374
3375 switch (cmd) {
3376 case IPVS_CMD_NEW_SERVICE:
3377 if (svc == NULL)
3378 ret = ip_vs_add_service(net, &usvc, &svc);
3379 else
3380 ret = -EEXIST;
3381 break;
3382 case IPVS_CMD_SET_SERVICE:
3383 ret = ip_vs_edit_service(svc, &usvc);
3384 break;
3385 case IPVS_CMD_DEL_SERVICE:
3386 ret = ip_vs_del_service(svc);
3387 /* do not use svc, it can be freed */
3388 break;
3389 case IPVS_CMD_NEW_DEST:
3390 ret = ip_vs_add_dest(svc, &udest);
3391 break;
3392 case IPVS_CMD_SET_DEST:
3393 ret = ip_vs_edit_dest(svc, &udest);
3394 break;
3395 case IPVS_CMD_DEL_DEST:
3396 ret = ip_vs_del_dest(svc, &udest);
3397 break;
3398 case IPVS_CMD_ZERO:
3399 ret = ip_vs_zero_service(svc);
3400 break;
3401 default:
3402 ret = -EINVAL;
3403 }
3404
3405 out:
3406 mutex_unlock(&__ip_vs_mutex);
3407
3408 return ret;
3409 }
3410
3411 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3412 {
3413 struct sk_buff *msg;
3414 void *reply;
3415 int ret, cmd, reply_cmd;
3416 struct net *net;
3417
3418 net = skb_sknet(skb);
3419 cmd = info->genlhdr->cmd;
3420
3421 if (cmd == IPVS_CMD_GET_SERVICE)
3422 reply_cmd = IPVS_CMD_NEW_SERVICE;
3423 else if (cmd == IPVS_CMD_GET_INFO)
3424 reply_cmd = IPVS_CMD_SET_INFO;
3425 else if (cmd == IPVS_CMD_GET_CONFIG)
3426 reply_cmd = IPVS_CMD_SET_CONFIG;
3427 else {
3428 pr_err("unknown Generic Netlink command\n");
3429 return -EINVAL;
3430 }
3431
3432 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3433 if (!msg)
3434 return -ENOMEM;
3435
3436 mutex_lock(&__ip_vs_mutex);
3437
3438 reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3439 if (reply == NULL)
3440 goto nla_put_failure;
3441
3442 switch (cmd) {
3443 case IPVS_CMD_GET_SERVICE:
3444 {
3445 struct ip_vs_service *svc;
3446
3447 svc = ip_vs_genl_find_service(net,
3448 info->attrs[IPVS_CMD_ATTR_SERVICE]);
3449 if (IS_ERR(svc)) {
3450 ret = PTR_ERR(svc);
3451 goto out_err;
3452 } else if (svc) {
3453 ret = ip_vs_genl_fill_service(msg, svc);
3454 if (ret)
3455 goto nla_put_failure;
3456 } else {
3457 ret = -ESRCH;
3458 goto out_err;
3459 }
3460
3461 break;
3462 }
3463
3464 case IPVS_CMD_GET_CONFIG:
3465 {
3466 struct ip_vs_timeout_user t;
3467
3468 __ip_vs_get_timeouts(net, &t);
3469 #ifdef CONFIG_IP_VS_PROTO_TCP
3470 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3471 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3472 t.tcp_fin_timeout);
3473 #endif
3474 #ifdef CONFIG_IP_VS_PROTO_UDP
3475 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3476 #endif
3477
3478 break;
3479 }
3480
3481 case IPVS_CMD_GET_INFO:
3482 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3483 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3484 ip_vs_conn_tab_size);
3485 break;
3486 }
3487
3488 genlmsg_end(msg, reply);
3489 ret = genlmsg_reply(msg, info);
3490 goto out;
3491
3492 nla_put_failure:
3493 pr_err("not enough space in Netlink message\n");
3494 ret = -EMSGSIZE;
3495
3496 out_err:
3497 nlmsg_free(msg);
3498 out:
3499 mutex_unlock(&__ip_vs_mutex);
3500
3501 return ret;
3502 }
3503
3504
3505 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3506 {
3507 .cmd = IPVS_CMD_NEW_SERVICE,
3508 .flags = GENL_ADMIN_PERM,
3509 .policy = ip_vs_cmd_policy,
3510 .doit = ip_vs_genl_set_cmd,
3511 },
3512 {
3513 .cmd = IPVS_CMD_SET_SERVICE,
3514 .flags = GENL_ADMIN_PERM,
3515 .policy = ip_vs_cmd_policy,
3516 .doit = ip_vs_genl_set_cmd,
3517 },
3518 {
3519 .cmd = IPVS_CMD_DEL_SERVICE,
3520 .flags = GENL_ADMIN_PERM,
3521 .policy = ip_vs_cmd_policy,
3522 .doit = ip_vs_genl_set_cmd,
3523 },
3524 {
3525 .cmd = IPVS_CMD_GET_SERVICE,
3526 .flags = GENL_ADMIN_PERM,
3527 .doit = ip_vs_genl_get_cmd,
3528 .dumpit = ip_vs_genl_dump_services,
3529 .policy = ip_vs_cmd_policy,
3530 },
3531 {
3532 .cmd = IPVS_CMD_NEW_DEST,
3533 .flags = GENL_ADMIN_PERM,
3534 .policy = ip_vs_cmd_policy,
3535 .doit = ip_vs_genl_set_cmd,
3536 },
3537 {
3538 .cmd = IPVS_CMD_SET_DEST,
3539 .flags = GENL_ADMIN_PERM,
3540 .policy = ip_vs_cmd_policy,
3541 .doit = ip_vs_genl_set_cmd,
3542 },
3543 {
3544 .cmd = IPVS_CMD_DEL_DEST,
3545 .flags = GENL_ADMIN_PERM,
3546 .policy = ip_vs_cmd_policy,
3547 .doit = ip_vs_genl_set_cmd,
3548 },
3549 {
3550 .cmd = IPVS_CMD_GET_DEST,
3551 .flags = GENL_ADMIN_PERM,
3552 .policy = ip_vs_cmd_policy,
3553 .dumpit = ip_vs_genl_dump_dests,
3554 },
3555 {
3556 .cmd = IPVS_CMD_NEW_DAEMON,
3557 .flags = GENL_ADMIN_PERM,
3558 .policy = ip_vs_cmd_policy,
3559 .doit = ip_vs_genl_set_daemon,
3560 },
3561 {
3562 .cmd = IPVS_CMD_DEL_DAEMON,
3563 .flags = GENL_ADMIN_PERM,
3564 .policy = ip_vs_cmd_policy,
3565 .doit = ip_vs_genl_set_daemon,
3566 },
3567 {
3568 .cmd = IPVS_CMD_GET_DAEMON,
3569 .flags = GENL_ADMIN_PERM,
3570 .dumpit = ip_vs_genl_dump_daemons,
3571 },
3572 {
3573 .cmd = IPVS_CMD_SET_CONFIG,
3574 .flags = GENL_ADMIN_PERM,
3575 .policy = ip_vs_cmd_policy,
3576 .doit = ip_vs_genl_set_cmd,
3577 },
3578 {
3579 .cmd = IPVS_CMD_GET_CONFIG,
3580 .flags = GENL_ADMIN_PERM,
3581 .doit = ip_vs_genl_get_cmd,
3582 },
3583 {
3584 .cmd = IPVS_CMD_GET_INFO,
3585 .flags = GENL_ADMIN_PERM,
3586 .doit = ip_vs_genl_get_cmd,
3587 },
3588 {
3589 .cmd = IPVS_CMD_ZERO,
3590 .flags = GENL_ADMIN_PERM,
3591 .policy = ip_vs_cmd_policy,
3592 .doit = ip_vs_genl_set_cmd,
3593 },
3594 {
3595 .cmd = IPVS_CMD_FLUSH,
3596 .flags = GENL_ADMIN_PERM,
3597 .doit = ip_vs_genl_set_cmd,
3598 },
3599 };
3600
3601 static int __init ip_vs_genl_register(void)
3602 {
3603 return genl_register_family_with_ops(&ip_vs_genl_family,
3604 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3605 }
3606
3607 static void ip_vs_genl_unregister(void)
3608 {
3609 genl_unregister_family(&ip_vs_genl_family);
3610 }
3611
3612 /* End of Generic Netlink interface definitions */
3613
3614 /*
3615 * per netns intit/exit func.
3616 */
3617 #ifdef CONFIG_SYSCTL
3618 int __net_init ip_vs_control_net_init_sysctl(struct net *net)
3619 {
3620 int idx;
3621 struct netns_ipvs *ipvs = net_ipvs(net);
3622 struct ctl_table *tbl;
3623
3624 atomic_set(&ipvs->dropentry, 0);
3625 spin_lock_init(&ipvs->dropentry_lock);
3626 spin_lock_init(&ipvs->droppacket_lock);
3627 spin_lock_init(&ipvs->securetcp_lock);
3628
3629 if (!net_eq(net, &init_net)) {
3630 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3631 if (tbl == NULL)
3632 return -ENOMEM;
3633 } else
3634 tbl = vs_vars;
3635 /* Initialize sysctl defaults */
3636 idx = 0;
3637 ipvs->sysctl_amemthresh = 1024;
3638 tbl[idx++].data = &ipvs->sysctl_amemthresh;
3639 ipvs->sysctl_am_droprate = 10;
3640 tbl[idx++].data = &ipvs->sysctl_am_droprate;
3641 tbl[idx++].data = &ipvs->sysctl_drop_entry;
3642 tbl[idx++].data = &ipvs->sysctl_drop_packet;
3643 #ifdef CONFIG_IP_VS_NFCT
3644 tbl[idx++].data = &ipvs->sysctl_conntrack;
3645 #endif
3646 tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3647 ipvs->sysctl_snat_reroute = 1;
3648 tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3649 ipvs->sysctl_sync_ver = 1;
3650 tbl[idx++].data = &ipvs->sysctl_sync_ver;
3651 tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3652 tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3653 tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3654 ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3655 ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3656 tbl[idx].data = &ipvs->sysctl_sync_threshold;
3657 tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3658 tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3659
3660
3661 ipvs->sysctl_hdr = register_net_sysctl_table(net, net_vs_ctl_path,
3662 tbl);
3663 if (ipvs->sysctl_hdr == NULL) {
3664 if (!net_eq(net, &init_net))
3665 kfree(tbl);
3666 return -ENOMEM;
3667 }
3668 ip_vs_start_estimator(net, &ipvs->tot_stats);
3669 ipvs->sysctl_tbl = tbl;
3670 /* Schedule defense work */
3671 INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3672 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
3673
3674 return 0;
3675 }
3676
3677 void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
3678 {
3679 struct netns_ipvs *ipvs = net_ipvs(net);
3680
3681 cancel_delayed_work_sync(&ipvs->defense_work);
3682 cancel_work_sync(&ipvs->defense_work.work);
3683 unregister_net_sysctl_table(ipvs->sysctl_hdr);
3684 }
3685
3686 #else
3687
3688 int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3689 void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net) { }
3690
3691 #endif
3692
3693 static struct notifier_block ip_vs_dst_notifier = {
3694 .notifier_call = ip_vs_dst_event,
3695 };
3696
3697 int __net_init ip_vs_control_net_init(struct net *net)
3698 {
3699 int idx;
3700 struct netns_ipvs *ipvs = net_ipvs(net);
3701
3702 rwlock_init(&ipvs->rs_lock);
3703
3704 /* Initialize rs_table */
3705 for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3706 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3707
3708 INIT_LIST_HEAD(&ipvs->dest_trash);
3709 atomic_set(&ipvs->ftpsvc_counter, 0);
3710 atomic_set(&ipvs->nullsvc_counter, 0);
3711
3712 /* procfs stats */
3713 ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
3714 if (!ipvs->tot_stats.cpustats)
3715 return -ENOMEM;
3716
3717 spin_lock_init(&ipvs->tot_stats.lock);
3718
3719 proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
3720 proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
3721 proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
3722 &ip_vs_stats_percpu_fops);
3723
3724 if (ip_vs_control_net_init_sysctl(net))
3725 goto err;
3726
3727 return 0;
3728
3729 err:
3730 free_percpu(ipvs->tot_stats.cpustats);
3731 return -ENOMEM;
3732 }
3733
3734 void __net_exit ip_vs_control_net_cleanup(struct net *net)
3735 {
3736 struct netns_ipvs *ipvs = net_ipvs(net);
3737
3738 ip_vs_trash_cleanup(net);
3739 ip_vs_stop_estimator(net, &ipvs->tot_stats);
3740 ip_vs_control_net_cleanup_sysctl(net);
3741 proc_net_remove(net, "ip_vs_stats_percpu");
3742 proc_net_remove(net, "ip_vs_stats");
3743 proc_net_remove(net, "ip_vs");
3744 free_percpu(ipvs->tot_stats.cpustats);
3745 }
3746
3747 int __init ip_vs_control_init(void)
3748 {
3749 int idx;
3750 int ret;
3751
3752 EnterFunction(2);
3753
3754 /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
3755 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3756 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3757 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3758 }
3759
3760 smp_wmb(); /* Do we really need it now ? */
3761
3762 ret = nf_register_sockopt(&ip_vs_sockopts);
3763 if (ret) {
3764 pr_err("cannot register sockopt.\n");
3765 goto err_sock;
3766 }
3767
3768 ret = ip_vs_genl_register();
3769 if (ret) {
3770 pr_err("cannot register Generic Netlink interface.\n");
3771 goto err_genl;
3772 }
3773
3774 ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3775 if (ret < 0)
3776 goto err_notf;
3777
3778 LeaveFunction(2);
3779 return 0;
3780
3781 err_notf:
3782 ip_vs_genl_unregister();
3783 err_genl:
3784 nf_unregister_sockopt(&ip_vs_sockopts);
3785 err_sock:
3786 return ret;
3787 }
3788
3789
3790 void ip_vs_control_cleanup(void)
3791 {
3792 EnterFunction(2);
3793 unregister_netdevice_notifier(&ip_vs_dst_notifier);
3794 ip_vs_genl_unregister();
3795 nf_unregister_sockopt(&ip_vs_sockopts);
3796 LeaveFunction(2);
3797 }
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree