net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <net/ip.h>
  42 #ifdef CONFIG_IP_VS_IPV6
  43 #include <net/ipv6.h>
  44 #include <net/ip6_route.h>
  45 #endif
  46 #include <net/route.h>
  47 #include <net/sock.h>
  48 #include <net/genetlink.h>
  49
  50 #include <asm/uaccess.h>
  51
  52 #include <net/ip_vs.h>
  53
  54 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  55 static DEFINE_MUTEX(__ip_vs_mutex);
  56
  57 /* lock for service table */
  58 static DEFINE_RWLOCK(__ip_vs_svc_lock);
  59
  60 /* lock for table with the real services */
  61 static DEFINE_RWLOCK(__ip_vs_rs_lock);
  62
  63 /* lock for state and timeout tables */
  64 static DEFINE_RWLOCK(__ip_vs_securetcp_lock);
  65
  66 /* lock for drop entry handling */
  67 static DEFINE_SPINLOCK(__ip_vs_dropentry_lock);
  68
  69 /* lock for drop packet handling */
  70 static DEFINE_SPINLOCK(__ip_vs_droppacket_lock);
  71
  72 /* 1/rate drop and drop-entry variables */
  73 int ip_vs_drop_rate = 0;
  74 int ip_vs_drop_counter = 0;
  75 static atomic_t ip_vs_dropentry = ATOMIC_INIT(0);
  76
  77 /* number of virtual services */
  78 static int ip_vs_num_services = 0;
  79
  80 /* sysctl variables */
  81 static int sysctl_ip_vs_drop_entry = 0;
  82 static int sysctl_ip_vs_drop_packet = 0;
  83 static int sysctl_ip_vs_secure_tcp = 0;
  84 static int sysctl_ip_vs_amemthresh = 1024;
  85 static int sysctl_ip_vs_am_droprate = 10;
  86 int sysctl_ip_vs_cache_bypass = 0;
  87 int sysctl_ip_vs_expire_nodest_conn = 0;
  88 int sysctl_ip_vs_expire_quiescent_template = 0;
  89 int sysctl_ip_vs_sync_threshold[2] = { 3, 50 };
  90 int sysctl_ip_vs_nat_icmp_send = 0;
  91
  92
  93 #ifdef CONFIG_IP_VS_DEBUG
  94 static int sysctl_ip_vs_debug_level = 0;
  95
  96 int ip_vs_get_debug_level(void)
  97 {
  98         return sysctl_ip_vs_debug_level;
  99 }
 100 #endif
 101
 102 #ifdef CONFIG_IP_VS_IPV6
 103 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
 104 static int __ip_vs_addr_is_local_v6(const struct in6_addr *addr)
 105 {
 106         struct rt6_info *rt;
 107         struct flowi fl = {
 108                 .oif = 0,
 109                 .nl_u = {
 110                         .ip6_u = {
 111                                 .daddr = *addr,
 112                                 .saddr = { .s6_addr32 = {0, 0, 0, 0} }, } },
 113         };
 114
 115         rt = (struct rt6_info *)ip6_route_output(&init_net, NULL, &fl);
 116         if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
 117                         return 1;
 118
 119         return 0;
 120 }
 121 #endif
 122 /*
 123  *      update_defense_level is called from keventd and from sysctl,
 124  *      so it needs to protect itself from softirqs
 125  */
 126 static void update_defense_level(void)
 127 {
 128         struct sysinfo i;
 129         static int old_secure_tcp = 0;
 130         int availmem;
 131         int nomem;
 132         int to_change = -1;
 133
 134         /* we only count free and buffered memory (in pages) */
 135         si_meminfo(&i);
 136         availmem = i.freeram + i.bufferram;
 137         /* however in linux 2.5 the i.bufferram is total page cache size,
 138            we need adjust it */
 139         /* si_swapinfo(&i); */
 140         /* availmem = availmem - (i.totalswap - i.freeswap); */
 141
 142         nomem = (availmem < sysctl_ip_vs_amemthresh);
 143
 144         local_bh_disable();
 145
 146         /* drop_entry */
 147         spin_lock(&__ip_vs_dropentry_lock);
 148         switch (sysctl_ip_vs_drop_entry) {
 149         case 0:
 150                 atomic_set(&ip_vs_dropentry, 0);
 151                 break;
 152         case 1:
 153                 if (nomem) {
 154                         atomic_set(&ip_vs_dropentry, 1);
 155                         sysctl_ip_vs_drop_entry = 2;
 156                 } else {
 157                         atomic_set(&ip_vs_dropentry, 0);
 158                 }
 159                 break;
 160         case 2:
 161                 if (nomem) {
 162                         atomic_set(&ip_vs_dropentry, 1);
 163                 } else {
 164                         atomic_set(&ip_vs_dropentry, 0);
 165                         sysctl_ip_vs_drop_entry = 1;
 166                 };
 167                 break;
 168         case 3:
 169                 atomic_set(&ip_vs_dropentry, 1);
 170                 break;
 171         }
 172         spin_unlock(&__ip_vs_dropentry_lock);
 173
 174         /* drop_packet */
 175         spin_lock(&__ip_vs_droppacket_lock);
 176         switch (sysctl_ip_vs_drop_packet) {
 177         case 0:
 178                 ip_vs_drop_rate = 0;
 179                 break;
 180         case 1:
 181                 if (nomem) {
 182                         ip_vs_drop_rate = ip_vs_drop_counter
 183                                 = sysctl_ip_vs_amemthresh /
 184                                 (sysctl_ip_vs_amemthresh-availmem);
 185                         sysctl_ip_vs_drop_packet = 2;
 186                 } else {
 187                         ip_vs_drop_rate = 0;
 188                 }
 189                 break;
 190         case 2:
 191                 if (nomem) {
 192                         ip_vs_drop_rate = ip_vs_drop_counter
 193                                 = sysctl_ip_vs_amemthresh /
 194                                 (sysctl_ip_vs_amemthresh-availmem);
 195                 } else {
 196                         ip_vs_drop_rate = 0;
 197                         sysctl_ip_vs_drop_packet = 1;
 198                 }
 199                 break;
 200         case 3:
 201                 ip_vs_drop_rate = sysctl_ip_vs_am_droprate;
 202                 break;
 203         }
 204         spin_unlock(&__ip_vs_droppacket_lock);
 205
 206         /* secure_tcp */
 207         write_lock(&__ip_vs_securetcp_lock);
 208         switch (sysctl_ip_vs_secure_tcp) {
 209         case 0:
 210                 if (old_secure_tcp >= 2)
 211                         to_change = 0;
 212                 break;
 213         case 1:
 214                 if (nomem) {
 215                         if (old_secure_tcp < 2)
 216                                 to_change = 1;
 217                         sysctl_ip_vs_secure_tcp = 2;
 218                 } else {
 219                         if (old_secure_tcp >= 2)
 220                                 to_change = 0;
 221                 }
 222                 break;
 223         case 2:
 224                 if (nomem) {
 225                         if (old_secure_tcp < 2)
 226                                 to_change = 1;
 227                 } else {
 228                         if (old_secure_tcp >= 2)
 229                                 to_change = 0;
 230                         sysctl_ip_vs_secure_tcp = 1;
 231                 }
 232                 break;
 233         case 3:
 234                 if (old_secure_tcp < 2)
 235                         to_change = 1;
 236                 break;
 237         }
 238         old_secure_tcp = sysctl_ip_vs_secure_tcp;
 239         if (to_change >= 0)
 240                 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
 241         write_unlock(&__ip_vs_securetcp_lock);
 242
 243         local_bh_enable();
 244 }
 245
 246
 247 /*
 248  *      Timer for checking the defense
 249  */
 250 #define DEFENSE_TIMER_PERIOD    1*HZ
 251 static void defense_work_handler(struct work_struct *work);
 252 static DECLARE_DELAYED_WORK(defense_work, defense_work_handler);
 253
 254 static void defense_work_handler(struct work_struct *work)
 255 {
 256         update_defense_level();
 257         if (atomic_read(&ip_vs_dropentry))
 258                 ip_vs_random_dropentry();
 259
 260         schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
 261 }
 262
 263 int
 264 ip_vs_use_count_inc(void)
 265 {
 266         return try_module_get(THIS_MODULE);
 267 }
 268
 269 void
 270 ip_vs_use_count_dec(void)
 271 {
 272         module_put(THIS_MODULE);
 273 }
 274
 275
 276 /*
 277  *      Hash table: for virtual service lookups
 278  */
 279 #define IP_VS_SVC_TAB_BITS 8
 280 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 281 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 282
 283 /* the service table hashed by <protocol, addr, port> */
 284 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 285 /* the service table hashed by fwmark */
 286 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 287
 288 /*
 289  *      Hash table: for real service lookups
 290  */
 291 #define IP_VS_RTAB_BITS 4
 292 #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
 293 #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
 294
 295 static struct list_head ip_vs_rtable[IP_VS_RTAB_SIZE];
 296
 297 /*
 298  *      Trash for destinations
 299  */
 300 static LIST_HEAD(ip_vs_dest_trash);
 301
 302 /*
 303  *      FTP & NULL virtual service counters
 304  */
 305 static atomic_t ip_vs_ftpsvc_counter = ATOMIC_INIT(0);
 306 static atomic_t ip_vs_nullsvc_counter = ATOMIC_INIT(0);
 307
 308
 309 /*
 310  *      Returns hash value for virtual service
 311  */
 312 static __inline__ unsigned
 313 ip_vs_svc_hashkey(int af, unsigned proto, const union nf_inet_addr *addr,
 314                   __be16 port)
 315 {
 316         register unsigned porth = ntohs(port);
 317         __be32 addr_fold = addr->ip;
 318
 319 #ifdef CONFIG_IP_VS_IPV6
 320         if (af == AF_INET6)
 321                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 322                             addr->ip6[2]^addr->ip6[3];
 323 #endif
 324
 325         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
 326                 & IP_VS_SVC_TAB_MASK;
 327 }
 328
 329 /*
 330  *      Returns hash value of fwmark for virtual service lookup
 331  */
 332 static __inline__ unsigned ip_vs_svc_fwm_hashkey(__u32 fwmark)
 333 {
 334         return fwmark & IP_VS_SVC_TAB_MASK;
 335 }
 336
 337 /*
 338  *      Hashes a service in the ip_vs_svc_table by <proto,addr,port>
 339  *      or in the ip_vs_svc_fwm_table by fwmark.
 340  *      Should be called with locked tables.
 341  */
 342 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 343 {
 344         unsigned hash;
 345
 346         if (svc->flags & IP_VS_SVC_F_HASHED) {
 347                 pr_err("%s(): request for already hashed, called from %pF\n",
 348                        __func__, __builtin_return_address(0));
 349                 return 0;
 350         }
 351
 352         if (svc->fwmark == 0) {
 353                 /*
 354                  *  Hash it by <protocol,addr,port> in ip_vs_svc_table
 355                  */
 356                 hash = ip_vs_svc_hashkey(svc->af, svc->protocol, &svc->addr,
 357                                          svc->port);
 358                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
 359         } else {
 360                 /*
 361                  *  Hash it by fwmark in ip_vs_svc_fwm_table
 362                  */
 363                 hash = ip_vs_svc_fwm_hashkey(svc->fwmark);
 364                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 365         }
 366
 367         svc->flags |= IP_VS_SVC_F_HASHED;
 368         /* increase its refcnt because it is referenced by the svc table */
 369         atomic_inc(&svc->refcnt);
 370         return 1;
 371 }
 372
 373
 374 /*
 375  *      Unhashes a service from ip_vs_svc_table/ip_vs_svc_fwm_table.
 376  *      Should be called with locked tables.
 377  */
 378 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 379 {
 380         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 381                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 382                        __func__, __builtin_return_address(0));
 383                 return 0;
 384         }
 385
 386         if (svc->fwmark == 0) {
 387                 /* Remove it from the ip_vs_svc_table table */
 388                 list_del(&svc->s_list);
 389         } else {
 390                 /* Remove it from the ip_vs_svc_fwm_table table */
 391                 list_del(&svc->f_list);
 392         }
 393
 394         svc->flags &= ~IP_VS_SVC_F_HASHED;
 395         atomic_dec(&svc->refcnt);
 396         return 1;
 397 }
 398
 399
 400 /*
 401  *      Get service by {proto,addr,port} in the service table.
 402  */
 403 static inline struct ip_vs_service *
 404 __ip_vs_service_get(int af, __u16 protocol, const union nf_inet_addr *vaddr,
 405                     __be16 vport)
 406 {
 407         unsigned hash;
 408         struct ip_vs_service *svc;
 409
 410         /* Check for "full" addressed entries */
 411         hash = ip_vs_svc_hashkey(af, protocol, vaddr, vport);
 412
 413         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
 414                 if ((svc->af == af)
 415                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 416                     && (svc->port == vport)
 417                     && (svc->protocol == protocol)) {
 418                         /* HIT */
 419                         atomic_inc(&svc->usecnt);
 420                         return svc;
 421                 }
 422         }
 423
 424         return NULL;
 425 }
 426
 427
 428 /*
 429  *      Get service by {fwmark} in the service table.
 430  */
 431 static inline struct ip_vs_service *
 432 __ip_vs_svc_fwm_get(int af, __u32 fwmark)
 433 {
 434         unsigned hash;
 435         struct ip_vs_service *svc;
 436
 437         /* Check for fwmark addressed entries */
 438         hash = ip_vs_svc_fwm_hashkey(fwmark);
 439
 440         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 441                 if (svc->fwmark == fwmark && svc->af == af) {
 442                         /* HIT */
 443                         atomic_inc(&svc->usecnt);
 444                         return svc;
 445                 }
 446         }
 447
 448         return NULL;
 449 }
 450
 451 struct ip_vs_service *
 452 ip_vs_service_get(int af, __u32 fwmark, __u16 protocol,
 453                   const union nf_inet_addr *vaddr, __be16 vport)
 454 {
 455         struct ip_vs_service *svc;
 456
 457         read_lock(&__ip_vs_svc_lock);
 458
 459         /*
 460          *      Check the table hashed by fwmark first
 461          */
 462         if (fwmark && (svc = __ip_vs_svc_fwm_get(af, fwmark)))
 463                 goto out;
 464
 465         /*
 466          *      Check the table hashed by <protocol,addr,port>
 467          *      for "full" addressed entries
 468          */
 469         svc = __ip_vs_service_get(af, protocol, vaddr, vport);
 470
 471         if (svc == NULL
 472             && protocol == IPPROTO_TCP
 473             && atomic_read(&ip_vs_ftpsvc_counter)
 474             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 475                 /*
 476                  * Check if ftp service entry exists, the packet
 477                  * might belong to FTP data connections.
 478                  */
 479                 svc = __ip_vs_service_get(af, protocol, vaddr, FTPPORT);
 480         }
 481
 482         if (svc == NULL
 483             && atomic_read(&ip_vs_nullsvc_counter)) {
 484                 /*
 485                  * Check if the catch-all port (port zero) exists
 486                  */
 487                 svc = __ip_vs_service_get(af, protocol, vaddr, 0);
 488         }
 489
 490   out:
 491         read_unlock(&__ip_vs_svc_lock);
 492
 493         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 494                       fwmark, ip_vs_proto_name(protocol),
 495                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 496                       svc ? "hit" : "not hit");
 497
 498         return svc;
 499 }
 500
 501
 502 static inline void
 503 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 504 {
 505         atomic_inc(&svc->refcnt);
 506         dest->svc = svc;
 507 }
 508
 509 static inline void
 510 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 511 {
 512         struct ip_vs_service *svc = dest->svc;
 513
 514         dest->svc = NULL;
 515         if (atomic_dec_and_test(&svc->refcnt))
 516                 kfree(svc);
 517 }
 518
 519
 520 /*
 521  *      Returns hash value for real service
 522  */
 523 static inline unsigned ip_vs_rs_hashkey(int af,
 524                                             const union nf_inet_addr *addr,
 525                                             __be16 port)
 526 {
 527         register unsigned porth = ntohs(port);
 528         __be32 addr_fold = addr->ip;
 529
 530 #ifdef CONFIG_IP_VS_IPV6
 531         if (af == AF_INET6)
 532                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 533                             addr->ip6[2]^addr->ip6[3];
 534 #endif
 535
 536         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 537                 & IP_VS_RTAB_MASK;
 538 }
 539
 540 /*
 541  *      Hashes ip_vs_dest in ip_vs_rtable by <proto,addr,port>.
 542  *      should be called with locked tables.
 543  */
 544 static int ip_vs_rs_hash(struct ip_vs_dest *dest)
 545 {
 546         unsigned hash;
 547
 548         if (!list_empty(&dest->d_list)) {
 549                 return 0;
 550         }
 551
 552         /*
 553          *      Hash by proto,addr,port,
 554          *      which are the parameters of the real service.
 555          */
 556         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 557
 558         list_add(&dest->d_list, &ip_vs_rtable[hash]);
 559
 560         return 1;
 561 }
 562
 563 /*
 564  *      UNhashes ip_vs_dest from ip_vs_rtable.
 565  *      should be called with locked tables.
 566  */
 567 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
 568 {
 569         /*
 570          * Remove it from the ip_vs_rtable table.
 571          */
 572         if (!list_empty(&dest->d_list)) {
 573                 list_del(&dest->d_list);
 574                 INIT_LIST_HEAD(&dest->d_list);
 575         }
 576
 577         return 1;
 578 }
 579
 580 /*
 581  *      Lookup real service by <proto,addr,port> in the real service table.
 582  */
 583 struct ip_vs_dest *
 584 ip_vs_lookup_real_service(int af, __u16 protocol,
 585                           const union nf_inet_addr *daddr,
 586                           __be16 dport)
 587 {
 588         unsigned hash;
 589         struct ip_vs_dest *dest;
 590
 591         /*
 592          *      Check for "full" addressed entries
 593          *      Return the first found entry
 594          */
 595         hash = ip_vs_rs_hashkey(af, daddr, dport);
 596
 597         read_lock(&__ip_vs_rs_lock);
 598         list_for_each_entry(dest, &ip_vs_rtable[hash], d_list) {
 599                 if ((dest->af == af)
 600                     && ip_vs_addr_equal(af, &dest->addr, daddr)
 601                     && (dest->port == dport)
 602                     && ((dest->protocol == protocol) ||
 603                         dest->vfwmark)) {
 604                         /* HIT */
 605                         read_unlock(&__ip_vs_rs_lock);
 606                         return dest;
 607                 }
 608         }
 609         read_unlock(&__ip_vs_rs_lock);
 610
 611         return NULL;
 612 }
 613
 614 /*
 615  *      Lookup destination by {addr,port} in the given service
 616  */
 617 static struct ip_vs_dest *
 618 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 619                   __be16 dport)
 620 {
 621         struct ip_vs_dest *dest;
 622
 623         /*
 624          * Find the destination for the given service
 625          */
 626         list_for_each_entry(dest, &svc->destinations, n_list) {
 627                 if ((dest->af == svc->af)
 628                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 629                     && (dest->port == dport)) {
 630                         /* HIT */
 631                         return dest;
 632                 }
 633         }
 634
 635         return NULL;
 636 }
 637
 638 /*
 639  * Find destination by {daddr,dport,vaddr,protocol}
 640  * Cretaed to be used in ip_vs_process_message() in
 641  * the backup synchronization daemon. It finds the
 642  * destination to be bound to the received connection
 643  * on the backup.
 644  *
 645  * ip_vs_lookup_real_service() looked promissing, but
 646  * seems not working as expected.
 647  */
 648 struct ip_vs_dest *ip_vs_find_dest(int af, const union nf_inet_addr *daddr,
 649                                    __be16 dport,
 650                                    const union nf_inet_addr *vaddr,
 651                                    __be16 vport, __u16 protocol)
 652 {
 653         struct ip_vs_dest *dest;
 654         struct ip_vs_service *svc;
 655
 656         svc = ip_vs_service_get(af, 0, protocol, vaddr, vport);
 657         if (!svc)
 658                 return NULL;
 659         dest = ip_vs_lookup_dest(svc, daddr, dport);
 660         if (dest)
 661                 atomic_inc(&dest->refcnt);
 662         ip_vs_service_put(svc);
 663         return dest;
 664 }
 665
 666 /*
 667  *  Lookup dest by {svc,addr,port} in the destination trash.
 668  *  The destination trash is used to hold the destinations that are removed
 669  *  from the service table but are still referenced by some conn entries.
 670  *  The reason to add the destination trash is when the dest is temporary
 671  *  down (either by administrator or by monitor program), the dest can be
 672  *  picked back from the trash, the remaining connections to the dest can
 673  *  continue, and the counting information of the dest is also useful for
 674  *  scheduling.
 675  */
 676 static struct ip_vs_dest *
 677 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 678                      __be16 dport)
 679 {
 680         struct ip_vs_dest *dest, *nxt;
 681
 682         /*
 683          * Find the destination in trash
 684          */
 685         list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
 686                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 687                               "dest->refcnt=%d\n",
 688                               dest->vfwmark,
 689                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 690                               ntohs(dest->port),
 691                               atomic_read(&dest->refcnt));
 692                 if (dest->af == svc->af &&
 693                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 694                     dest->port == dport &&
 695                     dest->vfwmark == svc->fwmark &&
 696                     dest->protocol == svc->protocol &&
 697                     (svc->fwmark ||
 698                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 699                       dest->vport == svc->port))) {
 700                         /* HIT */
 701                         return dest;
 702                 }
 703
 704                 /*
 705                  * Try to purge the destination from trash if not referenced
 706                  */
 707                 if (atomic_read(&dest->refcnt) == 1) {
 708                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
 709                                       "from trash\n",
 710                                       dest->vfwmark,
 711                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
 712                                       ntohs(dest->port));
 713                         list_del(&dest->n_list);
 714                         ip_vs_dst_reset(dest);
 715                         __ip_vs_unbind_svc(dest);
 716                         kfree(dest);
 717                 }
 718         }
 719
 720         return NULL;
 721 }
 722
 723
 724 /*
 725  *  Clean up all the destinations in the trash
 726  *  Called by the ip_vs_control_cleanup()
 727  *
 728  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 729  *  the service tables must have been flushed and all the connections
 730  *  are expired, and the refcnt of each destination in the trash must
 731  *  be 1, so we simply release them here.
 732  */
 733 static void ip_vs_trash_cleanup(void)
 734 {
 735         struct ip_vs_dest *dest, *nxt;
 736
 737         list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
 738                 list_del(&dest->n_list);
 739                 ip_vs_dst_reset(dest);
 740                 __ip_vs_unbind_svc(dest);
 741                 kfree(dest);
 742         }
 743 }
 744
 745
 746 static void
 747 ip_vs_zero_stats(struct ip_vs_stats *stats)
 748 {
 749         spin_lock_bh(&stats->lock);
 750
 751         memset(&stats->ustats, 0, sizeof(stats->ustats));
 752         ip_vs_zero_estimator(stats);
 753
 754         spin_unlock_bh(&stats->lock);
 755 }
 756
 757 /*
 758  *      Update a destination in the given service
 759  */
 760 static void
 761 __ip_vs_update_dest(struct ip_vs_service *svc,
 762                     struct ip_vs_dest *dest, struct ip_vs_dest_user_kern *udest)
 763 {
 764         int conn_flags;
 765
 766         /* set the weight and the flags */
 767         atomic_set(&dest->weight, udest->weight);
 768         conn_flags = udest->conn_flags | IP_VS_CONN_F_INACTIVE;
 769
 770         /* check if local node and update the flags */
 771 #ifdef CONFIG_IP_VS_IPV6
 772         if (svc->af == AF_INET6) {
 773                 if (__ip_vs_addr_is_local_v6(&udest->addr.in6)) {
 774                         conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
 775                                 | IP_VS_CONN_F_LOCALNODE;
 776                 }
 777         } else
 778 #endif
 779                 if (inet_addr_type(&init_net, udest->addr.ip) == RTN_LOCAL) {
 780                         conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
 781                                 | IP_VS_CONN_F_LOCALNODE;
 782                 }
 783
 784         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 785         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != 0) {
 786                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 787         } else {
 788                 /*
 789                  *    Put the real service in ip_vs_rtable if not present.
 790                  *    For now only for NAT!
 791                  */
 792                 write_lock_bh(&__ip_vs_rs_lock);
 793                 ip_vs_rs_hash(dest);
 794                 write_unlock_bh(&__ip_vs_rs_lock);
 795         }
 796         atomic_set(&dest->conn_flags, conn_flags);
 797
 798         /* bind the service */
 799         if (!dest->svc) {
 800                 __ip_vs_bind_svc(dest, svc);
 801         } else {
 802                 if (dest->svc != svc) {
 803                         __ip_vs_unbind_svc(dest);
 804                         ip_vs_zero_stats(&dest->stats);
 805                         __ip_vs_bind_svc(dest, svc);
 806                 }
 807         }
 808
 809         /* set the dest status flags */
 810         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 811
 812         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 813                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 814         dest->u_threshold = udest->u_threshold;
 815         dest->l_threshold = udest->l_threshold;
 816 }
 817
 818
 819 /*
 820  *      Create a destination for the given service
 821  */
 822 static int
 823 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 824                struct ip_vs_dest **dest_p)
 825 {
 826         struct ip_vs_dest *dest;
 827         unsigned atype;
 828
 829         EnterFunction(2);
 830
 831 #ifdef CONFIG_IP_VS_IPV6
 832         if (svc->af == AF_INET6) {
 833                 atype = ipv6_addr_type(&udest->addr.in6);
 834                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 835                         atype & IPV6_ADDR_LINKLOCAL) &&
 836                         !__ip_vs_addr_is_local_v6(&udest->addr.in6))
 837                         return -EINVAL;
 838         } else
 839 #endif
 840         {
 841                 atype = inet_addr_type(&init_net, udest->addr.ip);
 842                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 843                         return -EINVAL;
 844         }
 845
 846         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
 847         if (dest == NULL) {
 848                 pr_err("%s(): no memory.\n", __func__);
 849                 return -ENOMEM;
 850         }
 851
 852         dest->af = svc->af;
 853         dest->protocol = svc->protocol;
 854         dest->vaddr = svc->addr;
 855         dest->vport = svc->port;
 856         dest->vfwmark = svc->fwmark;
 857         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 858         dest->port = udest->port;
 859
 860         atomic_set(&dest->activeconns, 0);
 861         atomic_set(&dest->inactconns, 0);
 862         atomic_set(&dest->persistconns, 0);
 863         atomic_set(&dest->refcnt, 0);
 864
 865         INIT_LIST_HEAD(&dest->d_list);
 866         spin_lock_init(&dest->dst_lock);
 867         spin_lock_init(&dest->stats.lock);
 868         __ip_vs_update_dest(svc, dest, udest);
 869         ip_vs_new_estimator(&dest->stats);
 870
 871         *dest_p = dest;
 872
 873         LeaveFunction(2);
 874         return 0;
 875 }
 876
 877
 878 /*
 879  *      Add a destination into an existing service
 880  */
 881 static int
 882 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 883 {
 884         struct ip_vs_dest *dest;
 885         union nf_inet_addr daddr;
 886         __be16 dport = udest->port;
 887         int ret;
 888
 889         EnterFunction(2);
 890
 891         if (udest->weight < 0) {
 892                 pr_err("%s(): server weight less than zero\n", __func__);
 893                 return -ERANGE;
 894         }
 895
 896         if (udest->l_threshold > udest->u_threshold) {
 897                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 898                         __func__);
 899                 return -ERANGE;
 900         }
 901
 902         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 903
 904         /*
 905          * Check if the dest already exists in the list
 906          */
 907         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 908
 909         if (dest != NULL) {
 910                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 911                 return -EEXIST;
 912         }
 913
 914         /*
 915          * Check if the dest already exists in the trash and
 916          * is from the same service
 917          */
 918         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 919
 920         if (dest != NULL) {
 921                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 922                               "dest->refcnt=%d, service %u/%s:%u\n",
 923                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 924                               atomic_read(&dest->refcnt),
 925                               dest->vfwmark,
 926                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 927                               ntohs(dest->vport));
 928
 929                 __ip_vs_update_dest(svc, dest, udest);
 930
 931                 /*
 932                  * Get the destination from the trash
 933                  */
 934                 list_del(&dest->n_list);
 935
 936                 ip_vs_new_estimator(&dest->stats);
 937
 938                 write_lock_bh(&__ip_vs_svc_lock);
 939
 940                 /*
 941                  * Wait until all other svc users go away.
 942                  */
 943                 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 944
 945                 list_add(&dest->n_list, &svc->destinations);
 946                 svc->num_dests++;
 947
 948                 /* call the update_service function of its scheduler */
 949                 if (svc->scheduler->update_service)
 950                         svc->scheduler->update_service(svc);
 951
 952                 write_unlock_bh(&__ip_vs_svc_lock);
 953                 return 0;
 954         }
 955
 956         /*
 957          * Allocate and initialize the dest structure
 958          */
 959         ret = ip_vs_new_dest(svc, udest, &dest);
 960         if (ret) {
 961                 return ret;
 962         }
 963
 964         /*
 965          * Add the dest entry into the list
 966          */
 967         atomic_inc(&dest->refcnt);
 968
 969         write_lock_bh(&__ip_vs_svc_lock);
 970
 971         /*
 972          * Wait until all other svc users go away.
 973          */
 974         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 975
 976         list_add(&dest->n_list, &svc->destinations);
 977         svc->num_dests++;
 978
 979         /* call the update_service function of its scheduler */
 980         if (svc->scheduler->update_service)
 981                 svc->scheduler->update_service(svc);
 982
 983         write_unlock_bh(&__ip_vs_svc_lock);
 984
 985         LeaveFunction(2);
 986
 987         return 0;
 988 }
 989
 990
 991 /*
 992  *      Edit a destination in the given service
 993  */
 994 static int
 995 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 996 {
 997         struct ip_vs_dest *dest;
 998         union nf_inet_addr daddr;
 999         __be16 dport = udest->port;
1000
1001         EnterFunction(2);
1002
1003         if (udest->weight < 0) {
1004                 pr_err("%s(): server weight less than zero\n", __func__);
1005                 return -ERANGE;
1006         }
1007
1008         if (udest->l_threshold > udest->u_threshold) {
1009                 pr_err("%s(): lower threshold is higher than upper threshold\n",
1010                         __func__);
1011                 return -ERANGE;
1012         }
1013
1014         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
1015
1016         /*
1017          *  Lookup the destination list
1018          */
1019         dest = ip_vs_lookup_dest(svc, &daddr, dport);
1020
1021         if (dest == NULL) {
1022                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1023                 return -ENOENT;
1024         }
1025
1026         __ip_vs_update_dest(svc, dest, udest);
1027
1028         write_lock_bh(&__ip_vs_svc_lock);
1029
1030         /* Wait until all other svc users go away */
1031         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1032
1033         /* call the update_service, because server weight may be changed */
1034         if (svc->scheduler->update_service)
1035                 svc->scheduler->update_service(svc);
1036
1037         write_unlock_bh(&__ip_vs_svc_lock);
1038
1039         LeaveFunction(2);
1040
1041         return 0;
1042 }
1043
1044
1045 /*
1046  *      Delete a destination (must be already unlinked from the service)
1047  */
1048 static void __ip_vs_del_dest(struct ip_vs_dest *dest)
1049 {
1050         ip_vs_kill_estimator(&dest->stats);
1051
1052         /*
1053          *  Remove it from the d-linked list with the real services.
1054          */
1055         write_lock_bh(&__ip_vs_rs_lock);
1056         ip_vs_rs_unhash(dest);
1057         write_unlock_bh(&__ip_vs_rs_lock);
1058
1059         /*
1060          *  Decrease the refcnt of the dest, and free the dest
1061          *  if nobody refers to it (refcnt=0). Otherwise, throw
1062          *  the destination into the trash.
1063          */
1064         if (atomic_dec_and_test(&dest->refcnt)) {
1065                 ip_vs_dst_reset(dest);
1066                 /* simply decrease svc->refcnt here, let the caller check
1067                    and release the service if nobody refers to it.
1068                    Only user context can release destination and service,
1069                    and only one user context can update virtual service at a
1070                    time, so the operation here is OK */
1071                 atomic_dec(&dest->svc->refcnt);
1072                 kfree(dest);
1073         } else {
1074                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1075                               "dest->refcnt=%d\n",
1076                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1077                               ntohs(dest->port),
1078                               atomic_read(&dest->refcnt));
1079                 list_add(&dest->n_list, &ip_vs_dest_trash);
1080                 atomic_inc(&dest->refcnt);
1081         }
1082 }
1083
1084
1085 /*
1086  *      Unlink a destination from the given service
1087  */
1088 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1089                                 struct ip_vs_dest *dest,
1090                                 int svcupd)
1091 {
1092         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1093
1094         /*
1095          *  Remove it from the d-linked destination list.
1096          */
1097         list_del(&dest->n_list);
1098         svc->num_dests--;
1099
1100         /*
1101          *  Call the update_service function of its scheduler
1102          */
1103         if (svcupd && svc->scheduler->update_service)
1104                         svc->scheduler->update_service(svc);
1105 }
1106
1107
1108 /*
1109  *      Delete a destination server in the given service
1110  */
1111 static int
1112 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1113 {
1114         struct ip_vs_dest *dest;
1115         __be16 dport = udest->port;
1116
1117         EnterFunction(2);
1118
1119         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1120
1121         if (dest == NULL) {
1122                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1123                 return -ENOENT;
1124         }
1125
1126         write_lock_bh(&__ip_vs_svc_lock);
1127
1128         /*
1129          *      Wait until all other svc users go away.
1130          */
1131         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1132
1133         /*
1134          *      Unlink dest from the service
1135          */
1136         __ip_vs_unlink_dest(svc, dest, 1);
1137
1138         write_unlock_bh(&__ip_vs_svc_lock);
1139
1140         /*
1141          *      Delete the destination
1142          */
1143         __ip_vs_del_dest(dest);
1144
1145         LeaveFunction(2);
1146
1147         return 0;
1148 }
1149
1150
1151 /*
1152  *      Add a service into the service hash table
1153  */
1154 static int
1155 ip_vs_add_service(struct ip_vs_service_user_kern *u,
1156                   struct ip_vs_service **svc_p)
1157 {
1158         int ret = 0;
1159         struct ip_vs_scheduler *sched = NULL;
1160         struct ip_vs_service *svc = NULL;
1161
1162         /* increase the module use count */
1163         ip_vs_use_count_inc();
1164
1165         /* Lookup the scheduler by 'u->sched_name' */
1166         sched = ip_vs_scheduler_get(u->sched_name);
1167         if (sched == NULL) {
1168                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1169                 ret = -ENOENT;
1170                 goto out_mod_dec;
1171         }
1172
1173 #ifdef CONFIG_IP_VS_IPV6
1174         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1175                 ret = -EINVAL;
1176                 goto out_err;
1177         }
1178 #endif
1179
1180         svc = kzalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
1181         if (svc == NULL) {
1182                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1183                 ret = -ENOMEM;
1184                 goto out_err;
1185         }
1186
1187         /* I'm the first user of the service */
1188         atomic_set(&svc->usecnt, 1);
1189         atomic_set(&svc->refcnt, 0);
1190
1191         svc->af = u->af;
1192         svc->protocol = u->protocol;
1193         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1194         svc->port = u->port;
1195         svc->fwmark = u->fwmark;
1196         svc->flags = u->flags;
1197         svc->timeout = u->timeout * HZ;
1198         svc->netmask = u->netmask;
1199
1200         INIT_LIST_HEAD(&svc->destinations);
1201         rwlock_init(&svc->sched_lock);
1202         spin_lock_init(&svc->stats.lock);
1203
1204         /* Bind the scheduler */
1205         ret = ip_vs_bind_scheduler(svc, sched);
1206         if (ret)
1207                 goto out_err;
1208         sched = NULL;
1209
1210         /* Update the virtual service counters */
1211         if (svc->port == FTPPORT)
1212                 atomic_inc(&ip_vs_ftpsvc_counter);
1213         else if (svc->port == 0)
1214                 atomic_inc(&ip_vs_nullsvc_counter);
1215
1216         ip_vs_new_estimator(&svc->stats);
1217
1218         /* Count only IPv4 services for old get/setsockopt interface */
1219         if (svc->af == AF_INET)
1220                 ip_vs_num_services++;
1221
1222         /* Hash the service into the service table */
1223         write_lock_bh(&__ip_vs_svc_lock);
1224         ip_vs_svc_hash(svc);
1225         write_unlock_bh(&__ip_vs_svc_lock);
1226
1227         *svc_p = svc;
1228         return 0;
1229
1230   out_err:
1231         if (svc != NULL) {
1232                 if (svc->scheduler)
1233                         ip_vs_unbind_scheduler(svc);
1234                 if (svc->inc) {
1235                         local_bh_disable();
1236                         ip_vs_app_inc_put(svc->inc);
1237                         local_bh_enable();
1238                 }
1239                 kfree(svc);
1240         }
1241         ip_vs_scheduler_put(sched);
1242
1243   out_mod_dec:
1244         /* decrease the module use count */
1245         ip_vs_use_count_dec();
1246
1247         return ret;
1248 }
1249
1250
1251 /*
1252  *      Edit a service and bind it with a new scheduler
1253  */
1254 static int
1255 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1256 {
1257         struct ip_vs_scheduler *sched, *old_sched;
1258         int ret = 0;
1259
1260         /*
1261          * Lookup the scheduler, by 'u->sched_name'
1262          */
1263         sched = ip_vs_scheduler_get(u->sched_name);
1264         if (sched == NULL) {
1265                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1266                 return -ENOENT;
1267         }
1268         old_sched = sched;
1269
1270 #ifdef CONFIG_IP_VS_IPV6
1271         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1272                 ret = -EINVAL;
1273                 goto out;
1274         }
1275 #endif
1276
1277         write_lock_bh(&__ip_vs_svc_lock);
1278
1279         /*
1280          * Wait until all other svc users go away.
1281          */
1282         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1283
1284         /*
1285          * Set the flags and timeout value
1286          */
1287         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1288         svc->timeout = u->timeout * HZ;
1289         svc->netmask = u->netmask;
1290
1291         old_sched = svc->scheduler;
1292         if (sched != old_sched) {
1293                 /*
1294                  * Unbind the old scheduler
1295                  */
1296                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1297                         old_sched = sched;
1298                         goto out_unlock;
1299                 }
1300
1301                 /*
1302                  * Bind the new scheduler
1303                  */
1304                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1305                         /*
1306                          * If ip_vs_bind_scheduler fails, restore the old
1307                          * scheduler.
1308                          * The main reason of failure is out of memory.
1309                          *
1310                          * The question is if the old scheduler can be
1311                          * restored all the time. TODO: if it cannot be
1312                          * restored some time, we must delete the service,
1313                          * otherwise the system may crash.
1314                          */
1315                         ip_vs_bind_scheduler(svc, old_sched);
1316                         old_sched = sched;
1317                         goto out_unlock;
1318                 }
1319         }
1320
1321   out_unlock:
1322         write_unlock_bh(&__ip_vs_svc_lock);
1323 #ifdef CONFIG_IP_VS_IPV6
1324   out:
1325 #endif
1326
1327         if (old_sched)
1328                 ip_vs_scheduler_put(old_sched);
1329
1330         return ret;
1331 }
1332
1333
1334 /*
1335  *      Delete a service from the service list
1336  *      - The service must be unlinked, unlocked and not referenced!
1337  *      - We are called under _bh lock
1338  */
1339 static void __ip_vs_del_service(struct ip_vs_service *svc)
1340 {
1341         struct ip_vs_dest *dest, *nxt;
1342         struct ip_vs_scheduler *old_sched;
1343
1344         /* Count only IPv4 services for old get/setsockopt interface */
1345         if (svc->af == AF_INET)
1346                 ip_vs_num_services--;
1347
1348         ip_vs_kill_estimator(&svc->stats);
1349
1350         /* Unbind scheduler */
1351         old_sched = svc->scheduler;
1352         ip_vs_unbind_scheduler(svc);
1353         if (old_sched)
1354                 ip_vs_scheduler_put(old_sched);
1355
1356         /* Unbind app inc */
1357         if (svc->inc) {
1358                 ip_vs_app_inc_put(svc->inc);
1359                 svc->inc = NULL;
1360         }
1361
1362         /*
1363          *    Unlink the whole destination list
1364          */
1365         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1366                 __ip_vs_unlink_dest(svc, dest, 0);
1367                 __ip_vs_del_dest(dest);
1368         }
1369
1370         /*
1371          *    Update the virtual service counters
1372          */
1373         if (svc->port == FTPPORT)
1374                 atomic_dec(&ip_vs_ftpsvc_counter);
1375         else if (svc->port == 0)
1376                 atomic_dec(&ip_vs_nullsvc_counter);
1377
1378         /*
1379          *    Free the service if nobody refers to it
1380          */
1381         if (atomic_read(&svc->refcnt) == 0)
1382                 kfree(svc);
1383
1384         /* decrease the module use count */
1385         ip_vs_use_count_dec();
1386 }
1387
1388 /*
1389  *      Delete a service from the service list
1390  */
1391 static int ip_vs_del_service(struct ip_vs_service *svc)
1392 {
1393         if (svc == NULL)
1394                 return -EEXIST;
1395
1396         /*
1397          * Unhash it from the service table
1398          */
1399         write_lock_bh(&__ip_vs_svc_lock);
1400
1401         ip_vs_svc_unhash(svc);
1402
1403         /*
1404          * Wait until all the svc users go away.
1405          */
1406         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1407
1408         __ip_vs_del_service(svc);
1409
1410         write_unlock_bh(&__ip_vs_svc_lock);
1411
1412         return 0;
1413 }
1414
1415
1416 /*
1417  *      Flush all the virtual services
1418  */
1419 static int ip_vs_flush(void)
1420 {
1421         int idx;
1422         struct ip_vs_service *svc, *nxt;
1423
1424         /*
1425          * Flush the service table hashed by <protocol,addr,port>
1426          */
1427         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1428                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx], s_list) {
1429                         write_lock_bh(&__ip_vs_svc_lock);
1430                         ip_vs_svc_unhash(svc);
1431                         /*
1432                          * Wait until all the svc users go away.
1433                          */
1434                         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1435                         __ip_vs_del_service(svc);
1436                         write_unlock_bh(&__ip_vs_svc_lock);
1437                 }
1438         }
1439
1440         /*
1441          * Flush the service table hashed by fwmark
1442          */
1443         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1444                 list_for_each_entry_safe(svc, nxt,
1445                                          &ip_vs_svc_fwm_table[idx], f_list) {
1446                         write_lock_bh(&__ip_vs_svc_lock);
1447                         ip_vs_svc_unhash(svc);
1448                         /*
1449                          * Wait until all the svc users go away.
1450                          */
1451                         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1452                         __ip_vs_del_service(svc);
1453                         write_unlock_bh(&__ip_vs_svc_lock);
1454                 }
1455         }
1456
1457         return 0;
1458 }
1459
1460
1461 /*
1462  *      Zero counters in a service or all services
1463  */
1464 static int ip_vs_zero_service(struct ip_vs_service *svc)
1465 {
1466         struct ip_vs_dest *dest;
1467
1468         write_lock_bh(&__ip_vs_svc_lock);
1469         list_for_each_entry(dest, &svc->destinations, n_list) {
1470                 ip_vs_zero_stats(&dest->stats);
1471         }
1472         ip_vs_zero_stats(&svc->stats);
1473         write_unlock_bh(&__ip_vs_svc_lock);
1474         return 0;
1475 }
1476
1477 static int ip_vs_zero_all(void)
1478 {
1479         int idx;
1480         struct ip_vs_service *svc;
1481
1482         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1483                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1484                         ip_vs_zero_service(svc);
1485                 }
1486         }
1487
1488         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1489                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1490                         ip_vs_zero_service(svc);
1491                 }
1492         }
1493
1494         ip_vs_zero_stats(&ip_vs_stats);
1495         return 0;
1496 }
1497
1498
1499 static int
1500 proc_do_defense_mode(ctl_table *table, int write,
1501                      void __user *buffer, size_t *lenp, loff_t *ppos)
1502 {
1503         int *valp = table->data;
1504         int val = *valp;
1505         int rc;
1506
1507         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1508         if (write && (*valp != val)) {
1509                 if ((*valp < 0) || (*valp > 3)) {
1510                         /* Restore the correct value */
1511                         *valp = val;
1512                 } else {
1513                         update_defense_level();
1514                 }
1515         }
1516         return rc;
1517 }
1518
1519
1520 static int
1521 proc_do_sync_threshold(ctl_table *table, int write,
1522                        void __user *buffer, size_t *lenp, loff_t *ppos)
1523 {
1524         int *valp = table->data;
1525         int val[2];
1526         int rc;
1527
1528         /* backup the value first */
1529         memcpy(val, valp, sizeof(val));
1530
1531         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1532         if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1533                 /* Restore the correct value */
1534                 memcpy(valp, val, sizeof(val));
1535         }
1536         return rc;
1537 }
1538
1539
1540 /*
1541  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1542  */
1543
1544 static struct ctl_table vs_vars[] = {
1545         {
1546                 .procname       = "amemthresh",
1547                 .data           = &sysctl_ip_vs_amemthresh,
1548                 .maxlen         = sizeof(int),
1549                 .mode           = 0644,
1550                 .proc_handler   = proc_dointvec,
1551         },
1552 #ifdef CONFIG_IP_VS_DEBUG
1553         {
1554                 .procname       = "debug_level",
1555                 .data           = &sysctl_ip_vs_debug_level,
1556                 .maxlen         = sizeof(int),
1557                 .mode           = 0644,
1558                 .proc_handler   = proc_dointvec,
1559         },
1560 #endif
1561         {
1562                 .procname       = "am_droprate",
1563                 .data           = &sysctl_ip_vs_am_droprate,
1564                 .maxlen         = sizeof(int),
1565                 .mode           = 0644,
1566                 .proc_handler   = proc_dointvec,
1567         },
1568         {
1569                 .procname       = "drop_entry",
1570                 .data           = &sysctl_ip_vs_drop_entry,
1571                 .maxlen         = sizeof(int),
1572                 .mode           = 0644,
1573                 .proc_handler   = proc_do_defense_mode,
1574         },
1575         {
1576                 .procname       = "drop_packet",
1577                 .data           = &sysctl_ip_vs_drop_packet,
1578                 .maxlen         = sizeof(int),
1579                 .mode           = 0644,
1580                 .proc_handler   = proc_do_defense_mode,
1581         },
1582         {
1583                 .procname       = "secure_tcp",
1584                 .data           = &sysctl_ip_vs_secure_tcp,
1585                 .maxlen         = sizeof(int),
1586                 .mode           = 0644,
1587                 .proc_handler   = proc_do_defense_mode,
1588         },
1589 #if 0
1590         {
1591                 .procname       = "timeout_established",
1592                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1593                 .maxlen         = sizeof(int),
1594                 .mode           = 0644,
1595                 .proc_handler   = proc_dointvec_jiffies,
1596         },
1597         {
1598                 .procname       = "timeout_synsent",
1599                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1600                 .maxlen         = sizeof(int),
1601                 .mode           = 0644,
1602                 .proc_handler   = proc_dointvec_jiffies,
1603         },
1604         {
1605                 .procname       = "timeout_synrecv",
1606                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1607                 .maxlen         = sizeof(int),
1608                 .mode           = 0644,
1609                 .proc_handler   = proc_dointvec_jiffies,
1610         },
1611         {
1612                 .procname       = "timeout_finwait",
1613                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1614                 .maxlen         = sizeof(int),
1615                 .mode           = 0644,
1616                 .proc_handler   = proc_dointvec_jiffies,
1617         },
1618         {
1619                 .procname       = "timeout_timewait",
1620                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1621                 .maxlen         = sizeof(int),
1622                 .mode           = 0644,
1623                 .proc_handler   = proc_dointvec_jiffies,
1624         },
1625         {
1626                 .procname       = "timeout_close",
1627                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1628                 .maxlen         = sizeof(int),
1629                 .mode           = 0644,
1630                 .proc_handler   = proc_dointvec_jiffies,
1631         },
1632         {
1633                 .procname       = "timeout_closewait",
1634                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1635                 .maxlen         = sizeof(int),
1636                 .mode           = 0644,
1637                 .proc_handler   = proc_dointvec_jiffies,
1638         },
1639         {
1640                 .procname       = "timeout_lastack",
1641                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1642                 .maxlen         = sizeof(int),
1643                 .mode           = 0644,
1644                 .proc_handler   = proc_dointvec_jiffies,
1645         },
1646         {
1647                 .procname       = "timeout_listen",
1648                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1649                 .maxlen         = sizeof(int),
1650                 .mode           = 0644,
1651                 .proc_handler   = proc_dointvec_jiffies,
1652         },
1653         {
1654                 .procname       = "timeout_synack",
1655                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1656                 .maxlen         = sizeof(int),
1657                 .mode           = 0644,
1658                 .proc_handler   = proc_dointvec_jiffies,
1659         },
1660         {
1661                 .procname       = "timeout_udp",
1662                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1663                 .maxlen         = sizeof(int),
1664                 .mode           = 0644,
1665                 .proc_handler   = proc_dointvec_jiffies,
1666         },
1667         {
1668                 .procname       = "timeout_icmp",
1669                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1670                 .maxlen         = sizeof(int),
1671                 .mode           = 0644,
1672                 .proc_handler   = proc_dointvec_jiffies,
1673         },
1674 #endif
1675         {
1676                 .procname       = "cache_bypass",
1677                 .data           = &sysctl_ip_vs_cache_bypass,
1678                 .maxlen         = sizeof(int),
1679                 .mode           = 0644,
1680                 .proc_handler   = proc_dointvec,
1681         },
1682         {
1683                 .procname       = "expire_nodest_conn",
1684                 .data           = &sysctl_ip_vs_expire_nodest_conn,
1685                 .maxlen         = sizeof(int),
1686                 .mode           = 0644,
1687                 .proc_handler   = proc_dointvec,
1688         },
1689         {
1690                 .procname       = "expire_quiescent_template",
1691                 .data           = &sysctl_ip_vs_expire_quiescent_template,
1692                 .maxlen         = sizeof(int),
1693                 .mode           = 0644,
1694                 .proc_handler   = proc_dointvec,
1695         },
1696         {
1697                 .procname       = "sync_threshold",
1698                 .data           = &sysctl_ip_vs_sync_threshold,
1699                 .maxlen         = sizeof(sysctl_ip_vs_sync_threshold),
1700                 .mode           = 0644,
1701                 .proc_handler   = proc_do_sync_threshold,
1702         },
1703         {
1704                 .procname       = "nat_icmp_send",
1705                 .data           = &sysctl_ip_vs_nat_icmp_send,
1706                 .maxlen         = sizeof(int),
1707                 .mode           = 0644,
1708                 .proc_handler   = proc_dointvec,
1709         },
1710         { }
1711 };
1712
1713 const struct ctl_path net_vs_ctl_path[] = {
1714         { .procname = "net", },
1715         { .procname = "ipv4", },
1716         { .procname = "vs", },
1717         { }
1718 };
1719 EXPORT_SYMBOL_GPL(net_vs_ctl_path);
1720
1721 static struct ctl_table_header * sysctl_header;
1722
1723 #ifdef CONFIG_PROC_FS
1724
1725 struct ip_vs_iter {
1726         struct list_head *table;
1727         int bucket;
1728 };
1729
1730 /*
1731  *      Write the contents of the VS rule table to a PROCfs file.
1732  *      (It is kept just for backward compatibility)
1733  */
1734 static inline const char *ip_vs_fwd_name(unsigned flags)
1735 {
1736         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1737         case IP_VS_CONN_F_LOCALNODE:
1738                 return "Local";
1739         case IP_VS_CONN_F_TUNNEL:
1740                 return "Tunnel";
1741         case IP_VS_CONN_F_DROUTE:
1742                 return "Route";
1743         default:
1744                 return "Masq";
1745         }
1746 }
1747
1748
1749 /* Get the Nth entry in the two lists */
1750 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1751 {
1752         struct ip_vs_iter *iter = seq->private;
1753         int idx;
1754         struct ip_vs_service *svc;
1755
1756         /* look in hash by protocol */
1757         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1758                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1759                         if (pos-- == 0){
1760                                 iter->table = ip_vs_svc_table;
1761                                 iter->bucket = idx;
1762                                 return svc;
1763                         }
1764                 }
1765         }
1766
1767         /* keep looking in fwmark */
1768         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1769                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1770                         if (pos-- == 0) {
1771                                 iter->table = ip_vs_svc_fwm_table;
1772                                 iter->bucket = idx;
1773                                 return svc;
1774                         }
1775                 }
1776         }
1777
1778         return NULL;
1779 }
1780
1781 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1782 __acquires(__ip_vs_svc_lock)
1783 {
1784
1785         read_lock_bh(&__ip_vs_svc_lock);
1786         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1787 }
1788
1789
1790 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1791 {
1792         struct list_head *e;
1793         struct ip_vs_iter *iter;
1794         struct ip_vs_service *svc;
1795
1796         ++*pos;
1797         if (v == SEQ_START_TOKEN)
1798                 return ip_vs_info_array(seq,0);
1799
1800         svc = v;
1801         iter = seq->private;
1802
1803         if (iter->table == ip_vs_svc_table) {
1804                 /* next service in table hashed by protocol */
1805                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1806                         return list_entry(e, struct ip_vs_service, s_list);
1807
1808
1809                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1810                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1811                                             s_list) {
1812                                 return svc;
1813                         }
1814                 }
1815
1816                 iter->table = ip_vs_svc_fwm_table;
1817                 iter->bucket = -1;
1818                 goto scan_fwmark;
1819         }
1820
1821         /* next service in hashed by fwmark */
1822         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1823                 return list_entry(e, struct ip_vs_service, f_list);
1824
1825  scan_fwmark:
1826         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1827                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1828                                     f_list)
1829                         return svc;
1830         }
1831
1832         return NULL;
1833 }
1834
1835 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
1836 __releases(__ip_vs_svc_lock)
1837 {
1838         read_unlock_bh(&__ip_vs_svc_lock);
1839 }
1840
1841
1842 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1843 {
1844         if (v == SEQ_START_TOKEN) {
1845                 seq_printf(seq,
1846                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
1847                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1848                 seq_puts(seq,
1849                          "Prot LocalAddress:Port Scheduler Flags\n");
1850                 seq_puts(seq,
1851                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1852         } else {
1853                 const struct ip_vs_service *svc = v;
1854                 const struct ip_vs_iter *iter = seq->private;
1855                 const struct ip_vs_dest *dest;
1856
1857                 if (iter->table == ip_vs_svc_table) {
1858 #ifdef CONFIG_IP_VS_IPV6
1859                         if (svc->af == AF_INET6)
1860                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
1861                                            ip_vs_proto_name(svc->protocol),
1862                                            &svc->addr.in6,
1863                                            ntohs(svc->port),
1864                                            svc->scheduler->name);
1865                         else
1866 #endif
1867                                 seq_printf(seq, "%s  %08X:%04X %s ",
1868                                            ip_vs_proto_name(svc->protocol),
1869                                            ntohl(svc->addr.ip),
1870                                            ntohs(svc->port),
1871                                            svc->scheduler->name);
1872                 } else {
1873                         seq_printf(seq, "FWM  %08X %s ",
1874                                    svc->fwmark, svc->scheduler->name);
1875                 }
1876
1877                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
1878                         seq_printf(seq, "persistent %d %08X\n",
1879                                 svc->timeout,
1880                                 ntohl(svc->netmask));
1881                 else
1882                         seq_putc(seq, '\n');
1883
1884                 list_for_each_entry(dest, &svc->destinations, n_list) {
1885 #ifdef CONFIG_IP_VS_IPV6
1886                         if (dest->af == AF_INET6)
1887                                 seq_printf(seq,
1888                                            "  -> [%pI6]:%04X"
1889                                            "      %-7s %-6d %-10d %-10d\n",
1890                                            &dest->addr.in6,
1891                                            ntohs(dest->port),
1892                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1893                                            atomic_read(&dest->weight),
1894                                            atomic_read(&dest->activeconns),
1895                                            atomic_read(&dest->inactconns));
1896                         else
1897 #endif
1898                                 seq_printf(seq,
1899                                            "  -> %08X:%04X      "
1900                                            "%-7s %-6d %-10d %-10d\n",
1901                                            ntohl(dest->addr.ip),
1902                                            ntohs(dest->port),
1903                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1904                                            atomic_read(&dest->weight),
1905                                            atomic_read(&dest->activeconns),
1906                                            atomic_read(&dest->inactconns));
1907
1908                 }
1909         }
1910         return 0;
1911 }
1912
1913 static const struct seq_operations ip_vs_info_seq_ops = {
1914         .start = ip_vs_info_seq_start,
1915         .next  = ip_vs_info_seq_next,
1916         .stop  = ip_vs_info_seq_stop,
1917         .show  = ip_vs_info_seq_show,
1918 };
1919
1920 static int ip_vs_info_open(struct inode *inode, struct file *file)
1921 {
1922         return seq_open_private(file, &ip_vs_info_seq_ops,
1923                         sizeof(struct ip_vs_iter));
1924 }
1925
1926 static const struct file_operations ip_vs_info_fops = {
1927         .owner   = THIS_MODULE,
1928         .open    = ip_vs_info_open,
1929         .read    = seq_read,
1930         .llseek  = seq_lseek,
1931         .release = seq_release_private,
1932 };
1933
1934 #endif
1935
1936 struct ip_vs_stats ip_vs_stats = {
1937         .lock = __SPIN_LOCK_UNLOCKED(ip_vs_stats.lock),
1938 };
1939
1940 #ifdef CONFIG_PROC_FS
1941 static int ip_vs_stats_show(struct seq_file *seq, void *v)
1942 {
1943
1944 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
1945         seq_puts(seq,
1946                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
1947         seq_printf(seq,
1948                    "   Conns  Packets  Packets            Bytes            Bytes\n");
1949
1950         spin_lock_bh(&ip_vs_stats.lock);
1951         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", ip_vs_stats.ustats.conns,
1952                    ip_vs_stats.ustats.inpkts, ip_vs_stats.ustats.outpkts,
1953                    (unsigned long long) ip_vs_stats.ustats.inbytes,
1954                    (unsigned long long) ip_vs_stats.ustats.outbytes);
1955
1956 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
1957         seq_puts(seq,
1958                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
1959         seq_printf(seq,"%8X %8X %8X %16X %16X\n",
1960                         ip_vs_stats.ustats.cps,
1961                         ip_vs_stats.ustats.inpps,
1962                         ip_vs_stats.ustats.outpps,
1963                         ip_vs_stats.ustats.inbps,
1964                         ip_vs_stats.ustats.outbps);
1965         spin_unlock_bh(&ip_vs_stats.lock);
1966
1967         return 0;
1968 }
1969
1970 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
1971 {
1972         return single_open(file, ip_vs_stats_show, NULL);
1973 }
1974
1975 static const struct file_operations ip_vs_stats_fops = {
1976         .owner = THIS_MODULE,
1977         .open = ip_vs_stats_seq_open,
1978         .read = seq_read,
1979         .llseek = seq_lseek,
1980         .release = single_release,
1981 };
1982
1983 #endif
1984
1985 /*
1986  *      Set timeout values for tcp tcpfin udp in the timeout_table.
1987  */
1988 static int ip_vs_set_timeout(struct ip_vs_timeout_user *u)
1989 {
1990         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
1991                   u->tcp_timeout,
1992                   u->tcp_fin_timeout,
1993                   u->udp_timeout);
1994
1995 #ifdef CONFIG_IP_VS_PROTO_TCP
1996         if (u->tcp_timeout) {
1997                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED]
1998                         = u->tcp_timeout * HZ;
1999         }
2000
2001         if (u->tcp_fin_timeout) {
2002                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT]
2003                         = u->tcp_fin_timeout * HZ;
2004         }
2005 #endif
2006
2007 #ifdef CONFIG_IP_VS_PROTO_UDP
2008         if (u->udp_timeout) {
2009                 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL]
2010                         = u->udp_timeout * HZ;
2011         }
2012 #endif
2013         return 0;
2014 }
2015
2016
2017 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2018 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2019 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2020                                  sizeof(struct ip_vs_dest_user))
2021 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2022 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2023 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2024
2025 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2026         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2027         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2028         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2029         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2030         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2031         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2032         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2033         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2034         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2035         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2036         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2037 };
2038
2039 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2040                                   struct ip_vs_service_user *usvc_compat)
2041 {
2042         usvc->af                = AF_INET;
2043         usvc->protocol          = usvc_compat->protocol;
2044         usvc->addr.ip           = usvc_compat->addr;
2045         usvc->port              = usvc_compat->port;
2046         usvc->fwmark            = usvc_compat->fwmark;
2047
2048         /* Deep copy of sched_name is not needed here */
2049         usvc->sched_name        = usvc_compat->sched_name;
2050
2051         usvc->flags             = usvc_compat->flags;
2052         usvc->timeout           = usvc_compat->timeout;
2053         usvc->netmask           = usvc_compat->netmask;
2054 }
2055
2056 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2057                                    struct ip_vs_dest_user *udest_compat)
2058 {
2059         udest->addr.ip          = udest_compat->addr;
2060         udest->port             = udest_compat->port;
2061         udest->conn_flags       = udest_compat->conn_flags;
2062         udest->weight           = udest_compat->weight;
2063         udest->u_threshold      = udest_compat->u_threshold;
2064         udest->l_threshold      = udest_compat->l_threshold;
2065 }
2066
2067 static int
2068 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2069 {
2070         int ret;
2071         unsigned char arg[MAX_ARG_LEN];
2072         struct ip_vs_service_user *usvc_compat;
2073         struct ip_vs_service_user_kern usvc;
2074         struct ip_vs_service *svc;
2075         struct ip_vs_dest_user *udest_compat;
2076         struct ip_vs_dest_user_kern udest;
2077
2078         if (!capable(CAP_NET_ADMIN))
2079                 return -EPERM;
2080
2081         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2082                 return -EINVAL;
2083         if (len < 0 || len >  MAX_ARG_LEN)
2084                 return -EINVAL;
2085         if (len != set_arglen[SET_CMDID(cmd)]) {
2086                 pr_err("set_ctl: len %u != %u\n",
2087                        len, set_arglen[SET_CMDID(cmd)]);
2088                 return -EINVAL;
2089         }
2090
2091         if (copy_from_user(arg, user, len) != 0)
2092                 return -EFAULT;
2093
2094         /* increase the module use count */
2095         ip_vs_use_count_inc();
2096
2097         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2098                 ret = -ERESTARTSYS;
2099                 goto out_dec;
2100         }
2101
2102         if (cmd == IP_VS_SO_SET_FLUSH) {
2103                 /* Flush the virtual service */
2104                 ret = ip_vs_flush();
2105                 goto out_unlock;
2106         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2107                 /* Set timeout values for (tcp tcpfin udp) */
2108                 ret = ip_vs_set_timeout((struct ip_vs_timeout_user *)arg);
2109                 goto out_unlock;
2110         } else if (cmd == IP_VS_SO_SET_STARTDAEMON) {
2111                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2112                 ret = start_sync_thread(dm->state, dm->mcast_ifn, dm->syncid);
2113                 goto out_unlock;
2114         } else if (cmd == IP_VS_SO_SET_STOPDAEMON) {
2115                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2116                 ret = stop_sync_thread(dm->state);
2117                 goto out_unlock;
2118         }
2119
2120         usvc_compat = (struct ip_vs_service_user *)arg;
2121         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2122
2123         /* We only use the new structs internally, so copy userspace compat
2124          * structs to extended internal versions */
2125         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2126         ip_vs_copy_udest_compat(&udest, udest_compat);
2127
2128         if (cmd == IP_VS_SO_SET_ZERO) {
2129                 /* if no service address is set, zero counters in all */
2130                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2131                         ret = ip_vs_zero_all();
2132                         goto out_unlock;
2133                 }
2134         }
2135
2136         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2137         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2138             usvc.protocol != IPPROTO_SCTP) {
2139                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2140                        usvc.protocol, &usvc.addr.ip,
2141                        ntohs(usvc.port), usvc.sched_name);
2142                 ret = -EFAULT;
2143                 goto out_unlock;
2144         }
2145
2146         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2147         if (usvc.fwmark == 0)
2148                 svc = __ip_vs_service_get(usvc.af, usvc.protocol,
2149                                           &usvc.addr, usvc.port);
2150         else
2151                 svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
2152
2153         if (cmd != IP_VS_SO_SET_ADD
2154             && (svc == NULL || svc->protocol != usvc.protocol)) {
2155                 ret = -ESRCH;
2156                 goto out_unlock;
2157         }
2158
2159         switch (cmd) {
2160         case IP_VS_SO_SET_ADD:
2161                 if (svc != NULL)
2162                         ret = -EEXIST;
2163                 else
2164                         ret = ip_vs_add_service(&usvc, &svc);
2165                 break;
2166         case IP_VS_SO_SET_EDIT:
2167                 ret = ip_vs_edit_service(svc, &usvc);
2168                 break;
2169         case IP_VS_SO_SET_DEL:
2170                 ret = ip_vs_del_service(svc);
2171                 if (!ret)
2172                         goto out_unlock;
2173                 break;
2174         case IP_VS_SO_SET_ZERO:
2175                 ret = ip_vs_zero_service(svc);
2176                 break;
2177         case IP_VS_SO_SET_ADDDEST:
2178                 ret = ip_vs_add_dest(svc, &udest);
2179                 break;
2180         case IP_VS_SO_SET_EDITDEST:
2181                 ret = ip_vs_edit_dest(svc, &udest);
2182                 break;
2183         case IP_VS_SO_SET_DELDEST:
2184                 ret = ip_vs_del_dest(svc, &udest);
2185                 break;
2186         default:
2187                 ret = -EINVAL;
2188         }
2189
2190         if (svc)
2191                 ip_vs_service_put(svc);
2192
2193   out_unlock:
2194         mutex_unlock(&__ip_vs_mutex);
2195   out_dec:
2196         /* decrease the module use count */
2197         ip_vs_use_count_dec();
2198
2199         return ret;
2200 }
2201
2202
2203 static void
2204 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
2205 {
2206         spin_lock_bh(&src->lock);
2207         memcpy(dst, &src->ustats, sizeof(*dst));
2208         spin_unlock_bh(&src->lock);
2209 }
2210
2211 static void
2212 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2213 {
2214         dst->protocol = src->protocol;
2215         dst->addr = src->addr.ip;
2216         dst->port = src->port;
2217         dst->fwmark = src->fwmark;
2218         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2219         dst->flags = src->flags;
2220         dst->timeout = src->timeout / HZ;
2221         dst->netmask = src->netmask;
2222         dst->num_dests = src->num_dests;
2223         ip_vs_copy_stats(&dst->stats, &src->stats);
2224 }
2225
2226 static inline int
2227 __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
2228                             struct ip_vs_get_services __user *uptr)
2229 {
2230         int idx, count=0;
2231         struct ip_vs_service *svc;
2232         struct ip_vs_service_entry entry;
2233         int ret = 0;
2234
2235         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2236                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2237                         /* Only expose IPv4 entries to old interface */
2238                         if (svc->af != AF_INET)
2239                                 continue;
2240
2241                         if (count >= get->num_services)
2242                                 goto out;
2243                         memset(&entry, 0, sizeof(entry));
2244                         ip_vs_copy_service(&entry, svc);
2245                         if (copy_to_user(&uptr->entrytable[count],
2246                                          &entry, sizeof(entry))) {
2247                                 ret = -EFAULT;
2248                                 goto out;
2249                         }
2250                         count++;
2251                 }
2252         }
2253
2254         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2255                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2256                         /* Only expose IPv4 entries to old interface */
2257                         if (svc->af != AF_INET)
2258                                 continue;
2259
2260                         if (count >= get->num_services)
2261                                 goto out;
2262                         memset(&entry, 0, sizeof(entry));
2263                         ip_vs_copy_service(&entry, svc);
2264                         if (copy_to_user(&uptr->entrytable[count],
2265                                          &entry, sizeof(entry))) {
2266                                 ret = -EFAULT;
2267                                 goto out;
2268                         }
2269                         count++;
2270                 }
2271         }
2272   out:
2273         return ret;
2274 }
2275
2276 static inline int
2277 __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
2278                          struct ip_vs_get_dests __user *uptr)
2279 {
2280         struct ip_vs_service *svc;
2281         union nf_inet_addr addr = { .ip = get->addr };
2282         int ret = 0;
2283
2284         if (get->fwmark)
2285                 svc = __ip_vs_svc_fwm_get(AF_INET, get->fwmark);
2286         else
2287                 svc = __ip_vs_service_get(AF_INET, get->protocol, &addr,
2288                                           get->port);
2289
2290         if (svc) {
2291                 int count = 0;
2292                 struct ip_vs_dest *dest;
2293                 struct ip_vs_dest_entry entry;
2294
2295                 list_for_each_entry(dest, &svc->destinations, n_list) {
2296                         if (count >= get->num_dests)
2297                                 break;
2298
2299                         entry.addr = dest->addr.ip;
2300                         entry.port = dest->port;
2301                         entry.conn_flags = atomic_read(&dest->conn_flags);
2302                         entry.weight = atomic_read(&dest->weight);
2303                         entry.u_threshold = dest->u_threshold;
2304                         entry.l_threshold = dest->l_threshold;
2305                         entry.activeconns = atomic_read(&dest->activeconns);
2306                         entry.inactconns = atomic_read(&dest->inactconns);
2307                         entry.persistconns = atomic_read(&dest->persistconns);
2308                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2309                         if (copy_to_user(&uptr->entrytable[count],
2310                                          &entry, sizeof(entry))) {
2311                                 ret = -EFAULT;
2312                                 break;
2313                         }
2314                         count++;
2315                 }
2316                 ip_vs_service_put(svc);
2317         } else
2318                 ret = -ESRCH;
2319         return ret;
2320 }
2321
2322 static inline void
2323 __ip_vs_get_timeouts(struct ip_vs_timeout_user *u)
2324 {
2325 #ifdef CONFIG_IP_VS_PROTO_TCP
2326         u->tcp_timeout =
2327                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2328         u->tcp_fin_timeout =
2329                 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2330 #endif
2331 #ifdef CONFIG_IP_VS_PROTO_UDP
2332         u->udp_timeout =
2333                 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2334 #endif
2335 }
2336
2337
2338 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2339 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2340 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2341 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2342 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2343 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2344 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2345
2346 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2347         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2348         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2349         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2350         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2351         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2352         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2353         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2354 };
2355
2356 static int
2357 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2358 {
2359         unsigned char arg[128];
2360         int ret = 0;
2361         unsigned int copylen;
2362
2363         if (!capable(CAP_NET_ADMIN))
2364                 return -EPERM;
2365
2366         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2367                 return -EINVAL;
2368
2369         if (*len < get_arglen[GET_CMDID(cmd)]) {
2370                 pr_err("get_ctl: len %u < %u\n",
2371                        *len, get_arglen[GET_CMDID(cmd)]);
2372                 return -EINVAL;
2373         }
2374
2375         copylen = get_arglen[GET_CMDID(cmd)];
2376         if (copylen > 128)
2377                 return -EINVAL;
2378
2379         if (copy_from_user(arg, user, copylen) != 0)
2380                 return -EFAULT;
2381
2382         if (mutex_lock_interruptible(&__ip_vs_mutex))
2383                 return -ERESTARTSYS;
2384
2385         switch (cmd) {
2386         case IP_VS_SO_GET_VERSION:
2387         {
2388                 char buf[64];
2389
2390                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2391                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2392                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2393                         ret = -EFAULT;
2394                         goto out;
2395                 }
2396                 *len = strlen(buf)+1;
2397         }
2398         break;
2399
2400         case IP_VS_SO_GET_INFO:
2401         {
2402                 struct ip_vs_getinfo info;
2403                 info.version = IP_VS_VERSION_CODE;
2404                 info.size = ip_vs_conn_tab_size;
2405                 info.num_services = ip_vs_num_services;
2406                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2407                         ret = -EFAULT;
2408         }
2409         break;
2410
2411         case IP_VS_SO_GET_SERVICES:
2412         {
2413                 struct ip_vs_get_services *get;
2414                 int size;
2415
2416                 get = (struct ip_vs_get_services *)arg;
2417                 size = sizeof(*get) +
2418                         sizeof(struct ip_vs_service_entry) * get->num_services;
2419                 if (*len != size) {
2420                         pr_err("length: %u != %u\n", *len, size);
2421                         ret = -EINVAL;
2422                         goto out;
2423                 }
2424                 ret = __ip_vs_get_service_entries(get, user);
2425         }
2426         break;
2427
2428         case IP_VS_SO_GET_SERVICE:
2429         {
2430                 struct ip_vs_service_entry *entry;
2431                 struct ip_vs_service *svc;
2432                 union nf_inet_addr addr;
2433
2434                 entry = (struct ip_vs_service_entry *)arg;
2435                 addr.ip = entry->addr;
2436                 if (entry->fwmark)
2437                         svc = __ip_vs_svc_fwm_get(AF_INET, entry->fwmark);
2438                 else
2439                         svc = __ip_vs_service_get(AF_INET, entry->protocol,
2440                                                   &addr, entry->port);
2441                 if (svc) {
2442                         ip_vs_copy_service(entry, svc);
2443                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2444                                 ret = -EFAULT;
2445                         ip_vs_service_put(svc);
2446                 } else
2447                         ret = -ESRCH;
2448         }
2449         break;
2450
2451         case IP_VS_SO_GET_DESTS:
2452         {
2453                 struct ip_vs_get_dests *get;
2454                 int size;
2455
2456                 get = (struct ip_vs_get_dests *)arg;
2457                 size = sizeof(*get) +
2458                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2459                 if (*len != size) {
2460                         pr_err("length: %u != %u\n", *len, size);
2461                         ret = -EINVAL;
2462                         goto out;
2463                 }
2464                 ret = __ip_vs_get_dest_entries(get, user);
2465         }
2466         break;
2467
2468         case IP_VS_SO_GET_TIMEOUT:
2469         {
2470                 struct ip_vs_timeout_user t;
2471
2472                 __ip_vs_get_timeouts(&t);
2473                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2474                         ret = -EFAULT;
2475         }
2476         break;
2477
2478         case IP_VS_SO_GET_DAEMON:
2479         {
2480                 struct ip_vs_daemon_user d[2];
2481
2482                 memset(&d, 0, sizeof(d));
2483                 if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
2484                         d[0].state = IP_VS_STATE_MASTER;
2485                         strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
2486                         d[0].syncid = ip_vs_master_syncid;
2487                 }
2488                 if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
2489                         d[1].state = IP_VS_STATE_BACKUP;
2490                         strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
2491                         d[1].syncid = ip_vs_backup_syncid;
2492                 }
2493                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2494                         ret = -EFAULT;
2495         }
2496         break;
2497
2498         default:
2499                 ret = -EINVAL;
2500         }
2501
2502   out:
2503         mutex_unlock(&__ip_vs_mutex);
2504         return ret;
2505 }
2506
2507
2508 static struct nf_sockopt_ops ip_vs_sockopts = {
2509         .pf             = PF_INET,
2510         .set_optmin     = IP_VS_BASE_CTL,
2511         .set_optmax     = IP_VS_SO_SET_MAX+1,
2512         .set            = do_ip_vs_set_ctl,
2513         .get_optmin     = IP_VS_BASE_CTL,
2514         .get_optmax     = IP_VS_SO_GET_MAX+1,
2515         .get            = do_ip_vs_get_ctl,
2516         .owner          = THIS_MODULE,
2517 };
2518
2519 /*
2520  * Generic Netlink interface
2521  */
2522
2523 /* IPVS genetlink family */
2524 static struct genl_family ip_vs_genl_family = {
2525         .id             = GENL_ID_GENERATE,
2526         .hdrsize        = 0,
2527         .name           = IPVS_GENL_NAME,
2528         .version        = IPVS_GENL_VERSION,
2529         .maxattr        = IPVS_CMD_MAX,
2530 };
2531
2532 /* Policy used for first-level command attributes */
2533 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2534         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2535         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2536         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2537         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2538         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2539         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2540 };
2541
2542 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2543 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2544         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2545         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2546                                             .len = IP_VS_IFNAME_MAXLEN },
2547         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2548 };
2549
2550 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2551 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2552         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2553         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2554         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2555                                             .len = sizeof(union nf_inet_addr) },
2556         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2557         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2558         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2559                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2560         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2561                                             .len = sizeof(struct ip_vs_flags) },
2562         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2563         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2564         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2565 };
2566
2567 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2568 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2569         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2570                                             .len = sizeof(union nf_inet_addr) },
2571         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2572         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2573         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2574         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2575         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2576         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2577         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2578         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2579         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2580 };
2581
2582 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2583                                  struct ip_vs_stats *stats)
2584 {
2585         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2586         if (!nl_stats)
2587                 return -EMSGSIZE;
2588
2589         spin_lock_bh(&stats->lock);
2590
2591         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, stats->ustats.conns);
2592         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, stats->ustats.inpkts);
2593         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, stats->ustats.outpkts);
2594         NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, stats->ustats.inbytes);
2595         NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, stats->ustats.outbytes);
2596         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, stats->ustats.cps);
2597         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, stats->ustats.inpps);
2598         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, stats->ustats.outpps);
2599         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, stats->ustats.inbps);
2600         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, stats->ustats.outbps);
2601
2602         spin_unlock_bh(&stats->lock);
2603
2604         nla_nest_end(skb, nl_stats);
2605
2606         return 0;
2607
2608 nla_put_failure:
2609         spin_unlock_bh(&stats->lock);
2610         nla_nest_cancel(skb, nl_stats);
2611         return -EMSGSIZE;
2612 }
2613
2614 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2615                                    struct ip_vs_service *svc)
2616 {
2617         struct nlattr *nl_service;
2618         struct ip_vs_flags flags = { .flags = svc->flags,
2619                                      .mask = ~0 };
2620
2621         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2622         if (!nl_service)
2623                 return -EMSGSIZE;
2624
2625         NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
2626
2627         if (svc->fwmark) {
2628                 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2629         } else {
2630                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2631                 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2632                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2633         }
2634
2635         NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
2636         NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2637         NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2638         NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2639
2640         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2641                 goto nla_put_failure;
2642
2643         nla_nest_end(skb, nl_service);
2644
2645         return 0;
2646
2647 nla_put_failure:
2648         nla_nest_cancel(skb, nl_service);
2649         return -EMSGSIZE;
2650 }
2651
2652 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2653                                    struct ip_vs_service *svc,
2654                                    struct netlink_callback *cb)
2655 {
2656         void *hdr;
2657
2658         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2659                           &ip_vs_genl_family, NLM_F_MULTI,
2660                           IPVS_CMD_NEW_SERVICE);
2661         if (!hdr)
2662                 return -EMSGSIZE;
2663
2664         if (ip_vs_genl_fill_service(skb, svc) < 0)
2665                 goto nla_put_failure;
2666
2667         return genlmsg_end(skb, hdr);
2668
2669 nla_put_failure:
2670         genlmsg_cancel(skb, hdr);
2671         return -EMSGSIZE;
2672 }
2673
2674 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2675                                     struct netlink_callback *cb)
2676 {
2677         int idx = 0, i;
2678         int start = cb->args[0];
2679         struct ip_vs_service *svc;
2680
2681         mutex_lock(&__ip_vs_mutex);
2682         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2683                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2684                         if (++idx <= start)
2685                                 continue;
2686                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2687                                 idx--;
2688                                 goto nla_put_failure;
2689                         }
2690                 }
2691         }
2692
2693         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2694                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2695                         if (++idx <= start)
2696                                 continue;
2697                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2698                                 idx--;
2699                                 goto nla_put_failure;
2700                         }
2701                 }
2702         }
2703
2704 nla_put_failure:
2705         mutex_unlock(&__ip_vs_mutex);
2706         cb->args[0] = idx;
2707
2708         return skb->len;
2709 }
2710
2711 static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
2712                                     struct nlattr *nla, int full_entry)
2713 {
2714         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2715         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2716
2717         /* Parse mandatory identifying service fields first */
2718         if (nla == NULL ||
2719             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2720                 return -EINVAL;
2721
2722         nla_af          = attrs[IPVS_SVC_ATTR_AF];
2723         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
2724         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
2725         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
2726         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
2727
2728         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2729                 return -EINVAL;
2730
2731         memset(usvc, 0, sizeof(*usvc));
2732
2733         usvc->af = nla_get_u16(nla_af);
2734 #ifdef CONFIG_IP_VS_IPV6
2735         if (usvc->af != AF_INET && usvc->af != AF_INET6)
2736 #else
2737         if (usvc->af != AF_INET)
2738 #endif
2739                 return -EAFNOSUPPORT;
2740
2741         if (nla_fwmark) {
2742                 usvc->protocol = IPPROTO_TCP;
2743                 usvc->fwmark = nla_get_u32(nla_fwmark);
2744         } else {
2745                 usvc->protocol = nla_get_u16(nla_protocol);
2746                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2747                 usvc->port = nla_get_u16(nla_port);
2748                 usvc->fwmark = 0;
2749         }
2750
2751         /* If a full entry was requested, check for the additional fields */
2752         if (full_entry) {
2753                 struct nlattr *nla_sched, *nla_flags, *nla_timeout,
2754                               *nla_netmask;
2755                 struct ip_vs_flags flags;
2756                 struct ip_vs_service *svc;
2757
2758                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
2759                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2760                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2761                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2762
2763                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
2764                         return -EINVAL;
2765
2766                 nla_memcpy(&flags, nla_flags, sizeof(flags));
2767
2768                 /* prefill flags from service if it already exists */
2769                 if (usvc->fwmark)
2770                         svc = __ip_vs_svc_fwm_get(usvc->af, usvc->fwmark);
2771                 else
2772                         svc = __ip_vs_service_get(usvc->af, usvc->protocol,
2773                                                   &usvc->addr, usvc->port);
2774                 if (svc) {
2775                         usvc->flags = svc->flags;
2776                         ip_vs_service_put(svc);
2777                 } else
2778                         usvc->flags = 0;
2779
2780                 /* set new flags from userland */
2781                 usvc->flags = (usvc->flags & ~flags.mask) |
2782                               (flags.flags & flags.mask);
2783                 usvc->sched_name = nla_data(nla_sched);
2784                 usvc->timeout = nla_get_u32(nla_timeout);
2785                 usvc->netmask = nla_get_u32(nla_netmask);
2786         }
2787
2788         return 0;
2789 }
2790
2791 static struct ip_vs_service *ip_vs_genl_find_service(struct nlattr *nla)
2792 {
2793         struct ip_vs_service_user_kern usvc;
2794         int ret;
2795
2796         ret = ip_vs_genl_parse_service(&usvc, nla, 0);
2797         if (ret)
2798                 return ERR_PTR(ret);
2799
2800         if (usvc.fwmark)
2801                 return __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
2802         else
2803                 return __ip_vs_service_get(usvc.af, usvc.protocol,
2804                                            &usvc.addr, usvc.port);
2805 }
2806
2807 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
2808 {
2809         struct nlattr *nl_dest;
2810
2811         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
2812         if (!nl_dest)
2813                 return -EMSGSIZE;
2814
2815         NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
2816         NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
2817
2818         NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
2819                     atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
2820         NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
2821         NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
2822         NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
2823         NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
2824                     atomic_read(&dest->activeconns));
2825         NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
2826                     atomic_read(&dest->inactconns));
2827         NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
2828                     atomic_read(&dest->persistconns));
2829
2830         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
2831                 goto nla_put_failure;
2832
2833         nla_nest_end(skb, nl_dest);
2834
2835         return 0;
2836
2837 nla_put_failure:
2838         nla_nest_cancel(skb, nl_dest);
2839         return -EMSGSIZE;
2840 }
2841
2842 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
2843                                 struct netlink_callback *cb)
2844 {
2845         void *hdr;
2846
2847         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2848                           &ip_vs_genl_family, NLM_F_MULTI,
2849                           IPVS_CMD_NEW_DEST);
2850         if (!hdr)
2851                 return -EMSGSIZE;
2852
2853         if (ip_vs_genl_fill_dest(skb, dest) < 0)
2854                 goto nla_put_failure;
2855
2856         return genlmsg_end(skb, hdr);
2857
2858 nla_put_failure:
2859         genlmsg_cancel(skb, hdr);
2860         return -EMSGSIZE;
2861 }
2862
2863 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
2864                                  struct netlink_callback *cb)
2865 {
2866         int idx = 0;
2867         int start = cb->args[0];
2868         struct ip_vs_service *svc;
2869         struct ip_vs_dest *dest;
2870         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
2871
2872         mutex_lock(&__ip_vs_mutex);
2873
2874         /* Try to find the service for which to dump destinations */
2875         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
2876                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
2877                 goto out_err;
2878
2879         svc = ip_vs_genl_find_service(attrs[IPVS_CMD_ATTR_SERVICE]);
2880         if (IS_ERR(svc) || svc == NULL)
2881                 goto out_err;
2882
2883         /* Dump the destinations */
2884         list_for_each_entry(dest, &svc->destinations, n_list) {
2885                 if (++idx <= start)
2886                         continue;
2887                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
2888                         idx--;
2889                         goto nla_put_failure;
2890                 }
2891         }
2892
2893 nla_put_failure:
2894         cb->args[0] = idx;
2895         ip_vs_service_put(svc);
2896
2897 out_err:
2898         mutex_unlock(&__ip_vs_mutex);
2899
2900         return skb->len;
2901 }
2902
2903 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
2904                                  struct nlattr *nla, int full_entry)
2905 {
2906         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
2907         struct nlattr *nla_addr, *nla_port;
2908
2909         /* Parse mandatory identifying destination fields first */
2910         if (nla == NULL ||
2911             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
2912                 return -EINVAL;
2913
2914         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
2915         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
2916
2917         if (!(nla_addr && nla_port))
2918                 return -EINVAL;
2919
2920         memset(udest, 0, sizeof(*udest));
2921
2922         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
2923         udest->port = nla_get_u16(nla_port);
2924
2925         /* If a full entry was requested, check for the additional fields */
2926         if (full_entry) {
2927                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
2928                               *nla_l_thresh;
2929
2930                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
2931                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
2932                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
2933                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
2934
2935                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
2936                         return -EINVAL;
2937
2938                 udest->conn_flags = nla_get_u32(nla_fwd)
2939                                     & IP_VS_CONN_F_FWD_MASK;
2940                 udest->weight = nla_get_u32(nla_weight);
2941                 udest->u_threshold = nla_get_u32(nla_u_thresh);
2942                 udest->l_threshold = nla_get_u32(nla_l_thresh);
2943         }
2944
2945         return 0;
2946 }
2947
2948 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
2949                                   const char *mcast_ifn, __be32 syncid)
2950 {
2951         struct nlattr *nl_daemon;
2952
2953         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
2954         if (!nl_daemon)
2955                 return -EMSGSIZE;
2956
2957         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
2958         NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
2959         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
2960
2961         nla_nest_end(skb, nl_daemon);
2962
2963         return 0;
2964
2965 nla_put_failure:
2966         nla_nest_cancel(skb, nl_daemon);
2967         return -EMSGSIZE;
2968 }
2969
2970 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
2971                                   const char *mcast_ifn, __be32 syncid,
2972                                   struct netlink_callback *cb)
2973 {
2974         void *hdr;
2975         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2976                           &ip_vs_genl_family, NLM_F_MULTI,
2977                           IPVS_CMD_NEW_DAEMON);
2978         if (!hdr)
2979                 return -EMSGSIZE;
2980
2981         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
2982                 goto nla_put_failure;
2983
2984         return genlmsg_end(skb, hdr);
2985
2986 nla_put_failure:
2987         genlmsg_cancel(skb, hdr);
2988         return -EMSGSIZE;
2989 }
2990
2991 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
2992                                    struct netlink_callback *cb)
2993 {
2994         mutex_lock(&__ip_vs_mutex);
2995         if ((ip_vs_sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
2996                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
2997                                            ip_vs_master_mcast_ifn,
2998                                            ip_vs_master_syncid, cb) < 0)
2999                         goto nla_put_failure;
3000
3001                 cb->args[0] = 1;
3002         }
3003
3004         if ((ip_vs_sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3005                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3006                                            ip_vs_backup_mcast_ifn,
3007                                            ip_vs_backup_syncid, cb) < 0)
3008                         goto nla_put_failure;
3009
3010                 cb->args[1] = 1;
3011         }
3012
3013 nla_put_failure:
3014         mutex_unlock(&__ip_vs_mutex);
3015
3016         return skb->len;
3017 }
3018
3019 static int ip_vs_genl_new_daemon(struct nlattr **attrs)
3020 {
3021         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3022               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3023               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3024                 return -EINVAL;
3025
3026         return start_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3027                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3028                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3029 }
3030
3031 static int ip_vs_genl_del_daemon(struct nlattr **attrs)
3032 {
3033         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3034                 return -EINVAL;
3035
3036         return stop_sync_thread(nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3037 }
3038
3039 static int ip_vs_genl_set_config(struct nlattr **attrs)
3040 {
3041         struct ip_vs_timeout_user t;
3042
3043         __ip_vs_get_timeouts(&t);
3044
3045         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3046                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3047
3048         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3049                 t.tcp_fin_timeout =
3050                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3051
3052         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3053                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3054
3055         return ip_vs_set_timeout(&t);
3056 }
3057
3058 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3059 {
3060         struct ip_vs_service *svc = NULL;
3061         struct ip_vs_service_user_kern usvc;
3062         struct ip_vs_dest_user_kern udest;
3063         int ret = 0, cmd;
3064         int need_full_svc = 0, need_full_dest = 0;
3065
3066         cmd = info->genlhdr->cmd;
3067
3068         mutex_lock(&__ip_vs_mutex);
3069
3070         if (cmd == IPVS_CMD_FLUSH) {
3071                 ret = ip_vs_flush();
3072                 goto out;
3073         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3074                 ret = ip_vs_genl_set_config(info->attrs);
3075                 goto out;
3076         } else if (cmd == IPVS_CMD_NEW_DAEMON ||
3077                    cmd == IPVS_CMD_DEL_DAEMON) {
3078
3079                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3080
3081                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3082                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3083                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3084                                      ip_vs_daemon_policy)) {
3085                         ret = -EINVAL;
3086                         goto out;
3087                 }
3088
3089                 if (cmd == IPVS_CMD_NEW_DAEMON)
3090                         ret = ip_vs_genl_new_daemon(daemon_attrs);
3091                 else
3092                         ret = ip_vs_genl_del_daemon(daemon_attrs);
3093                 goto out;
3094         } else if (cmd == IPVS_CMD_ZERO &&
3095                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3096                 ret = ip_vs_zero_all();
3097                 goto out;
3098         }
3099
3100         /* All following commands require a service argument, so check if we
3101          * received a valid one. We need a full service specification when
3102          * adding / editing a service. Only identifying members otherwise. */
3103         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3104                 need_full_svc = 1;
3105
3106         ret = ip_vs_genl_parse_service(&usvc,
3107                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3108                                        need_full_svc);
3109         if (ret)
3110                 goto out;
3111
3112         /* Lookup the exact service by <protocol, addr, port> or fwmark */
3113         if (usvc.fwmark == 0)
3114                 svc = __ip_vs_service_get(usvc.af, usvc.protocol,
3115                                           &usvc.addr, usvc.port);
3116         else
3117                 svc = __ip_vs_svc_fwm_get(usvc.af, usvc.fwmark);
3118
3119         /* Unless we're adding a new service, the service must already exist */
3120         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3121                 ret = -ESRCH;
3122                 goto out;
3123         }
3124
3125         /* Destination commands require a valid destination argument. For
3126          * adding / editing a destination, we need a full destination
3127          * specification. */
3128         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3129             cmd == IPVS_CMD_DEL_DEST) {
3130                 if (cmd != IPVS_CMD_DEL_DEST)
3131                         need_full_dest = 1;
3132
3133                 ret = ip_vs_genl_parse_dest(&udest,
3134                                             info->attrs[IPVS_CMD_ATTR_DEST],
3135                                             need_full_dest);
3136                 if (ret)
3137                         goto out;
3138         }
3139
3140         switch (cmd) {
3141         case IPVS_CMD_NEW_SERVICE:
3142                 if (svc == NULL)
3143                         ret = ip_vs_add_service(&usvc, &svc);
3144                 else
3145                         ret = -EEXIST;
3146                 break;
3147         case IPVS_CMD_SET_SERVICE:
3148                 ret = ip_vs_edit_service(svc, &usvc);
3149                 break;
3150         case IPVS_CMD_DEL_SERVICE:
3151                 ret = ip_vs_del_service(svc);
3152                 break;
3153         case IPVS_CMD_NEW_DEST:
3154                 ret = ip_vs_add_dest(svc, &udest);
3155                 break;
3156         case IPVS_CMD_SET_DEST:
3157                 ret = ip_vs_edit_dest(svc, &udest);
3158                 break;
3159         case IPVS_CMD_DEL_DEST:
3160                 ret = ip_vs_del_dest(svc, &udest);
3161                 break;
3162         case IPVS_CMD_ZERO:
3163                 ret = ip_vs_zero_service(svc);
3164                 break;
3165         default:
3166                 ret = -EINVAL;
3167         }
3168
3169 out:
3170         if (svc)
3171                 ip_vs_service_put(svc);
3172         mutex_unlock(&__ip_vs_mutex);
3173
3174         return ret;
3175 }
3176
3177 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3178 {
3179         struct sk_buff *msg;
3180         void *reply;
3181         int ret, cmd, reply_cmd;
3182
3183         cmd = info->genlhdr->cmd;
3184
3185         if (cmd == IPVS_CMD_GET_SERVICE)
3186                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3187         else if (cmd == IPVS_CMD_GET_INFO)
3188                 reply_cmd = IPVS_CMD_SET_INFO;
3189         else if (cmd == IPVS_CMD_GET_CONFIG)
3190                 reply_cmd = IPVS_CMD_SET_CONFIG;
3191         else {
3192                 pr_err("unknown Generic Netlink command\n");
3193                 return -EINVAL;
3194         }
3195
3196         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3197         if (!msg)
3198                 return -ENOMEM;
3199
3200         mutex_lock(&__ip_vs_mutex);
3201
3202         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3203         if (reply == NULL)
3204                 goto nla_put_failure;
3205
3206         switch (cmd) {
3207         case IPVS_CMD_GET_SERVICE:
3208         {
3209                 struct ip_vs_service *svc;
3210
3211                 svc = ip_vs_genl_find_service(info->attrs[IPVS_CMD_ATTR_SERVICE]);
3212                 if (IS_ERR(svc)) {
3213                         ret = PTR_ERR(svc);
3214                         goto out_err;
3215                 } else if (svc) {
3216                         ret = ip_vs_genl_fill_service(msg, svc);
3217                         ip_vs_service_put(svc);
3218                         if (ret)
3219                                 goto nla_put_failure;
3220                 } else {
3221                         ret = -ESRCH;
3222                         goto out_err;
3223                 }
3224
3225                 break;
3226         }
3227
3228         case IPVS_CMD_GET_CONFIG:
3229         {
3230                 struct ip_vs_timeout_user t;
3231
3232                 __ip_vs_get_timeouts(&t);
3233 #ifdef CONFIG_IP_VS_PROTO_TCP
3234                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3235                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3236                             t.tcp_fin_timeout);
3237 #endif
3238 #ifdef CONFIG_IP_VS_PROTO_UDP
3239                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3240 #endif
3241
3242                 break;
3243         }
3244
3245         case IPVS_CMD_GET_INFO:
3246                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3247                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3248                             ip_vs_conn_tab_size);
3249                 break;
3250         }
3251
3252         genlmsg_end(msg, reply);
3253         ret = genlmsg_reply(msg, info);
3254         goto out;
3255
3256 nla_put_failure:
3257         pr_err("not enough space in Netlink message\n");
3258         ret = -EMSGSIZE;
3259
3260 out_err:
3261         nlmsg_free(msg);
3262 out:
3263         mutex_unlock(&__ip_vs_mutex);
3264
3265         return ret;
3266 }
3267
3268
3269 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3270         {
3271                 .cmd    = IPVS_CMD_NEW_SERVICE,
3272                 .flags  = GENL_ADMIN_PERM,
3273                 .policy = ip_vs_cmd_policy,
3274                 .doit   = ip_vs_genl_set_cmd,
3275         },
3276         {
3277                 .cmd    = IPVS_CMD_SET_SERVICE,
3278                 .flags  = GENL_ADMIN_PERM,
3279                 .policy = ip_vs_cmd_policy,
3280                 .doit   = ip_vs_genl_set_cmd,
3281         },
3282         {
3283                 .cmd    = IPVS_CMD_DEL_SERVICE,
3284                 .flags  = GENL_ADMIN_PERM,
3285                 .policy = ip_vs_cmd_policy,
3286                 .doit   = ip_vs_genl_set_cmd,
3287         },
3288         {
3289                 .cmd    = IPVS_CMD_GET_SERVICE,
3290                 .flags  = GENL_ADMIN_PERM,
3291                 .doit   = ip_vs_genl_get_cmd,
3292                 .dumpit = ip_vs_genl_dump_services,
3293                 .policy = ip_vs_cmd_policy,
3294         },
3295         {
3296                 .cmd    = IPVS_CMD_NEW_DEST,
3297                 .flags  = GENL_ADMIN_PERM,
3298                 .policy = ip_vs_cmd_policy,
3299                 .doit   = ip_vs_genl_set_cmd,
3300         },
3301         {
3302                 .cmd    = IPVS_CMD_SET_DEST,
3303                 .flags  = GENL_ADMIN_PERM,
3304                 .policy = ip_vs_cmd_policy,
3305                 .doit   = ip_vs_genl_set_cmd,
3306         },
3307         {
3308                 .cmd    = IPVS_CMD_DEL_DEST,
3309                 .flags  = GENL_ADMIN_PERM,
3310                 .policy = ip_vs_cmd_policy,
3311                 .doit   = ip_vs_genl_set_cmd,
3312         },
3313         {
3314                 .cmd    = IPVS_CMD_GET_DEST,
3315                 .flags  = GENL_ADMIN_PERM,
3316                 .policy = ip_vs_cmd_policy,
3317                 .dumpit = ip_vs_genl_dump_dests,
3318         },
3319         {
3320                 .cmd    = IPVS_CMD_NEW_DAEMON,
3321                 .flags  = GENL_ADMIN_PERM,
3322                 .policy = ip_vs_cmd_policy,
3323                 .doit   = ip_vs_genl_set_cmd,
3324         },
3325         {
3326                 .cmd    = IPVS_CMD_DEL_DAEMON,
3327                 .flags  = GENL_ADMIN_PERM,
3328                 .policy = ip_vs_cmd_policy,
3329                 .doit   = ip_vs_genl_set_cmd,
3330         },
3331         {
3332                 .cmd    = IPVS_CMD_GET_DAEMON,
3333                 .flags  = GENL_ADMIN_PERM,
3334                 .dumpit = ip_vs_genl_dump_daemons,
3335         },
3336         {
3337                 .cmd    = IPVS_CMD_SET_CONFIG,
3338                 .flags  = GENL_ADMIN_PERM,
3339                 .policy = ip_vs_cmd_policy,
3340                 .doit   = ip_vs_genl_set_cmd,
3341         },
3342         {
3343                 .cmd    = IPVS_CMD_GET_CONFIG,
3344                 .flags  = GENL_ADMIN_PERM,
3345                 .doit   = ip_vs_genl_get_cmd,
3346         },
3347         {
3348                 .cmd    = IPVS_CMD_GET_INFO,
3349                 .flags  = GENL_ADMIN_PERM,
3350                 .doit   = ip_vs_genl_get_cmd,
3351         },
3352         {
3353                 .cmd    = IPVS_CMD_ZERO,
3354                 .flags  = GENL_ADMIN_PERM,
3355                 .policy = ip_vs_cmd_policy,
3356                 .doit   = ip_vs_genl_set_cmd,
3357         },
3358         {
3359                 .cmd    = IPVS_CMD_FLUSH,
3360                 .flags  = GENL_ADMIN_PERM,
3361                 .doit   = ip_vs_genl_set_cmd,
3362         },
3363 };
3364
3365 static int __init ip_vs_genl_register(void)
3366 {
3367         return genl_register_family_with_ops(&ip_vs_genl_family,
3368                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3369 }
3370
3371 static void ip_vs_genl_unregister(void)
3372 {
3373         genl_unregister_family(&ip_vs_genl_family);
3374 }
3375
3376 /* End of Generic Netlink interface definitions */
3377
3378
3379 int __init ip_vs_control_init(void)
3380 {
3381         int ret;
3382         int idx;
3383
3384         EnterFunction(2);
3385
3386         ret = nf_register_sockopt(&ip_vs_sockopts);
3387         if (ret) {
3388                 pr_err("cannot register sockopt.\n");
3389                 return ret;
3390         }
3391
3392         ret = ip_vs_genl_register();
3393         if (ret) {
3394                 pr_err("cannot register Generic Netlink interface.\n");
3395                 nf_unregister_sockopt(&ip_vs_sockopts);
3396                 return ret;
3397         }
3398
3399         proc_net_fops_create(&init_net, "ip_vs", 0, &ip_vs_info_fops);
3400         proc_net_fops_create(&init_net, "ip_vs_stats",0, &ip_vs_stats_fops);
3401
3402         sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars);
3403
3404         /* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */
3405         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
3406                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3407                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3408         }
3409         for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++)  {
3410                 INIT_LIST_HEAD(&ip_vs_rtable[idx]);
3411         }
3412
3413         ip_vs_new_estimator(&ip_vs_stats);
3414
3415         /* Hook the defense timer */
3416         schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
3417
3418         LeaveFunction(2);
3419         return 0;
3420 }
3421
3422
3423 void ip_vs_control_cleanup(void)
3424 {
3425         EnterFunction(2);
3426         ip_vs_trash_cleanup();
3427         cancel_rearming_delayed_work(&defense_work);
3428         cancel_work_sync(&defense_work.work);
3429         ip_vs_kill_estimator(&ip_vs_stats);
3430         unregister_sysctl_table(sysctl_header);
3431         proc_net_remove(&init_net, "ip_vs_stats");
3432         proc_net_remove(&init_net, "ip_vs");
3433         ip_vs_genl_unregister();
3434         nf_unregister_sockopt(&ip_vs_sockopts);
3435         LeaveFunction(2);
3436 }