net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <linux/nsproxy.h>
  42 #include <net/ip.h>
  43 #ifdef CONFIG_IP_VS_IPV6
  44 #include <net/ipv6.h>
  45 #include <net/ip6_route.h>
  46 #endif
  47 #include <net/route.h>
  48 #include <net/sock.h>
  49 #include <net/genetlink.h>
  50
  51 #include <asm/uaccess.h>
  52
  53 #include <net/ip_vs.h>
  54
  55 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  56 static DEFINE_MUTEX(__ip_vs_mutex);
  57
  58 /* sysctl variables */
  59
  60 #ifdef CONFIG_IP_VS_DEBUG
  61 static int sysctl_ip_vs_debug_level = 0;
  62
  63 int ip_vs_get_debug_level(void)
  64 {
  65         return sysctl_ip_vs_debug_level;
  66 }
  67 #endif
  68
  69
  70 /*  Protos */
  71 static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup);
  72
  73
  74 #ifdef CONFIG_IP_VS_IPV6
  75 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
  76 static bool __ip_vs_addr_is_local_v6(struct net *net,
  77                                      const struct in6_addr *addr)
  78 {
  79         struct flowi6 fl6 = {
  80                 .daddr = *addr,
  81         };
  82         struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
  83         bool is_local;
  84
  85         is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
  86
  87         dst_release(dst);
  88         return is_local;
  89 }
  90 #endif
  91
  92 #ifdef CONFIG_SYSCTL
  93 /*
  94  *      update_defense_level is called from keventd and from sysctl,
  95  *      so it needs to protect itself from softirqs
  96  */
  97 static void update_defense_level(struct netns_ipvs *ipvs)
  98 {
  99         struct sysinfo i;
 100         static int old_secure_tcp = 0;
 101         int availmem;
 102         int nomem;
 103         int to_change = -1;
 104
 105         /* we only count free and buffered memory (in pages) */
 106         si_meminfo(&i);
 107         availmem = i.freeram + i.bufferram;
 108         /* however in linux 2.5 the i.bufferram is total page cache size,
 109            we need adjust it */
 110         /* si_swapinfo(&i); */
 111         /* availmem = availmem - (i.totalswap - i.freeswap); */
 112
 113         nomem = (availmem < ipvs->sysctl_amemthresh);
 114
 115         local_bh_disable();
 116
 117         /* drop_entry */
 118         spin_lock(&ipvs->dropentry_lock);
 119         switch (ipvs->sysctl_drop_entry) {
 120         case 0:
 121                 atomic_set(&ipvs->dropentry, 0);
 122                 break;
 123         case 1:
 124                 if (nomem) {
 125                         atomic_set(&ipvs->dropentry, 1);
 126                         ipvs->sysctl_drop_entry = 2;
 127                 } else {
 128                         atomic_set(&ipvs->dropentry, 0);
 129                 }
 130                 break;
 131         case 2:
 132                 if (nomem) {
 133                         atomic_set(&ipvs->dropentry, 1);
 134                 } else {
 135                         atomic_set(&ipvs->dropentry, 0);
 136                         ipvs->sysctl_drop_entry = 1;
 137                 };
 138                 break;
 139         case 3:
 140                 atomic_set(&ipvs->dropentry, 1);
 141                 break;
 142         }
 143         spin_unlock(&ipvs->dropentry_lock);
 144
 145         /* drop_packet */
 146         spin_lock(&ipvs->droppacket_lock);
 147         switch (ipvs->sysctl_drop_packet) {
 148         case 0:
 149                 ipvs->drop_rate = 0;
 150                 break;
 151         case 1:
 152                 if (nomem) {
 153                         ipvs->drop_rate = ipvs->drop_counter
 154                                 = ipvs->sysctl_amemthresh /
 155                                 (ipvs->sysctl_amemthresh-availmem);
 156                         ipvs->sysctl_drop_packet = 2;
 157                 } else {
 158                         ipvs->drop_rate = 0;
 159                 }
 160                 break;
 161         case 2:
 162                 if (nomem) {
 163                         ipvs->drop_rate = ipvs->drop_counter
 164                                 = ipvs->sysctl_amemthresh /
 165                                 (ipvs->sysctl_amemthresh-availmem);
 166                 } else {
 167                         ipvs->drop_rate = 0;
 168                         ipvs->sysctl_drop_packet = 1;
 169                 }
 170                 break;
 171         case 3:
 172                 ipvs->drop_rate = ipvs->sysctl_am_droprate;
 173                 break;
 174         }
 175         spin_unlock(&ipvs->droppacket_lock);
 176
 177         /* secure_tcp */
 178         spin_lock(&ipvs->securetcp_lock);
 179         switch (ipvs->sysctl_secure_tcp) {
 180         case 0:
 181                 if (old_secure_tcp >= 2)
 182                         to_change = 0;
 183                 break;
 184         case 1:
 185                 if (nomem) {
 186                         if (old_secure_tcp < 2)
 187                                 to_change = 1;
 188                         ipvs->sysctl_secure_tcp = 2;
 189                 } else {
 190                         if (old_secure_tcp >= 2)
 191                                 to_change = 0;
 192                 }
 193                 break;
 194         case 2:
 195                 if (nomem) {
 196                         if (old_secure_tcp < 2)
 197                                 to_change = 1;
 198                 } else {
 199                         if (old_secure_tcp >= 2)
 200                                 to_change = 0;
 201                         ipvs->sysctl_secure_tcp = 1;
 202                 }
 203                 break;
 204         case 3:
 205                 if (old_secure_tcp < 2)
 206                         to_change = 1;
 207                 break;
 208         }
 209         old_secure_tcp = ipvs->sysctl_secure_tcp;
 210         if (to_change >= 0)
 211                 ip_vs_protocol_timeout_change(ipvs,
 212                                               ipvs->sysctl_secure_tcp > 1);
 213         spin_unlock(&ipvs->securetcp_lock);
 214
 215         local_bh_enable();
 216 }
 217
 218
 219 /*
 220  *      Timer for checking the defense
 221  */
 222 #define DEFENSE_TIMER_PERIOD    1*HZ
 223
 224 static void defense_work_handler(struct work_struct *work)
 225 {
 226         struct netns_ipvs *ipvs =
 227                 container_of(work, struct netns_ipvs, defense_work.work);
 228
 229         update_defense_level(ipvs);
 230         if (atomic_read(&ipvs->dropentry))
 231                 ip_vs_random_dropentry(ipvs->net);
 232         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
 233 }
 234 #endif
 235
 236 int
 237 ip_vs_use_count_inc(void)
 238 {
 239         return try_module_get(THIS_MODULE);
 240 }
 241
 242 void
 243 ip_vs_use_count_dec(void)
 244 {
 245         module_put(THIS_MODULE);
 246 }
 247
 248
 249 /*
 250  *      Hash table: for virtual service lookups
 251  */
 252 #define IP_VS_SVC_TAB_BITS 8
 253 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 254 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 255
 256 /* the service table hashed by <protocol, addr, port> */
 257 static struct hlist_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 258 /* the service table hashed by fwmark */
 259 static struct hlist_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 260
 261
 262 /*
 263  *      Returns hash value for virtual service
 264  */
 265 static inline unsigned int
 266 ip_vs_svc_hashkey(struct net *net, int af, unsigned int proto,
 267                   const union nf_inet_addr *addr, __be16 port)
 268 {
 269         register unsigned int porth = ntohs(port);
 270         __be32 addr_fold = addr->ip;
 271         __u32 ahash;
 272
 273 #ifdef CONFIG_IP_VS_IPV6
 274         if (af == AF_INET6)
 275                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 276                             addr->ip6[2]^addr->ip6[3];
 277 #endif
 278         ahash = ntohl(addr_fold);
 279         ahash ^= ((size_t) net >> 8);
 280
 281         return (proto ^ ahash ^ (porth >> IP_VS_SVC_TAB_BITS) ^ porth) &
 282                IP_VS_SVC_TAB_MASK;
 283 }
 284
 285 /*
 286  *      Returns hash value of fwmark for virtual service lookup
 287  */
 288 static inline unsigned int ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
 289 {
 290         return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
 291 }
 292
 293 /*
 294  *      Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
 295  *      or in the ip_vs_svc_fwm_table by fwmark.
 296  *      Should be called with locked tables.
 297  */
 298 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 299 {
 300         unsigned int hash;
 301
 302         if (svc->flags & IP_VS_SVC_F_HASHED) {
 303                 pr_err("%s(): request for already hashed, called from %pF\n",
 304                        __func__, __builtin_return_address(0));
 305                 return 0;
 306         }
 307
 308         if (svc->fwmark == 0) {
 309                 /*
 310                  *  Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
 311                  */
 312                 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
 313                                          &svc->addr, svc->port);
 314                 hlist_add_head_rcu(&svc->s_list, &ip_vs_svc_table[hash]);
 315         } else {
 316                 /*
 317                  *  Hash it by fwmark in svc_fwm_table
 318                  */
 319                 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
 320                 hlist_add_head_rcu(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 321         }
 322
 323         svc->flags |= IP_VS_SVC_F_HASHED;
 324         /* increase its refcnt because it is referenced by the svc table */
 325         atomic_inc(&svc->refcnt);
 326         return 1;
 327 }
 328
 329
 330 /*
 331  *      Unhashes a service from svc_table / svc_fwm_table.
 332  *      Should be called with locked tables.
 333  */
 334 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 335 {
 336         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 337                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 338                        __func__, __builtin_return_address(0));
 339                 return 0;
 340         }
 341
 342         if (svc->fwmark == 0) {
 343                 /* Remove it from the svc_table table */
 344                 hlist_del_rcu(&svc->s_list);
 345         } else {
 346                 /* Remove it from the svc_fwm_table table */
 347                 hlist_del_rcu(&svc->f_list);
 348         }
 349
 350         svc->flags &= ~IP_VS_SVC_F_HASHED;
 351         atomic_dec(&svc->refcnt);
 352         return 1;
 353 }
 354
 355
 356 /*
 357  *      Get service by {netns, proto,addr,port} in the service table.
 358  */
 359 static inline struct ip_vs_service *
 360 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
 361                      const union nf_inet_addr *vaddr, __be16 vport)
 362 {
 363         unsigned int hash;
 364         struct ip_vs_service *svc;
 365
 366         /* Check for "full" addressed entries */
 367         hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
 368
 369         hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[hash], s_list) {
 370                 if ((svc->af == af)
 371                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 372                     && (svc->port == vport)
 373                     && (svc->protocol == protocol)
 374                     && net_eq(svc->net, net)) {
 375                         /* HIT */
 376                         return svc;
 377                 }
 378         }
 379
 380         return NULL;
 381 }
 382
 383
 384 /*
 385  *      Get service by {fwmark} in the service table.
 386  */
 387 static inline struct ip_vs_service *
 388 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
 389 {
 390         unsigned int hash;
 391         struct ip_vs_service *svc;
 392
 393         /* Check for fwmark addressed entries */
 394         hash = ip_vs_svc_fwm_hashkey(net, fwmark);
 395
 396         hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 397                 if (svc->fwmark == fwmark && svc->af == af
 398                     && net_eq(svc->net, net)) {
 399                         /* HIT */
 400                         return svc;
 401                 }
 402         }
 403
 404         return NULL;
 405 }
 406
 407 /* Find service, called under RCU lock */
 408 struct ip_vs_service *
 409 ip_vs_service_find(struct net *net, int af, __u32 fwmark, __u16 protocol,
 410                    const union nf_inet_addr *vaddr, __be16 vport)
 411 {
 412         struct ip_vs_service *svc;
 413         struct netns_ipvs *ipvs = net_ipvs(net);
 414
 415         /*
 416          *      Check the table hashed by fwmark first
 417          */
 418         if (fwmark) {
 419                 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
 420                 if (svc)
 421                         goto out;
 422         }
 423
 424         /*
 425          *      Check the table hashed by <protocol,addr,port>
 426          *      for "full" addressed entries
 427          */
 428         svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
 429
 430         if (svc == NULL
 431             && protocol == IPPROTO_TCP
 432             && atomic_read(&ipvs->ftpsvc_counter)
 433             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 434                 /*
 435                  * Check if ftp service entry exists, the packet
 436                  * might belong to FTP data connections.
 437                  */
 438                 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
 439         }
 440
 441         if (svc == NULL
 442             && atomic_read(&ipvs->nullsvc_counter)) {
 443                 /*
 444                  * Check if the catch-all port (port zero) exists
 445                  */
 446                 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
 447         }
 448
 449   out:
 450         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 451                       fwmark, ip_vs_proto_name(protocol),
 452                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 453                       svc ? "hit" : "not hit");
 454
 455         return svc;
 456 }
 457
 458
 459 static inline void
 460 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 461 {
 462         atomic_inc(&svc->refcnt);
 463         rcu_assign_pointer(dest->svc, svc);
 464 }
 465
 466 static void ip_vs_service_free(struct ip_vs_service *svc)
 467 {
 468         if (svc->stats.cpustats)
 469                 free_percpu(svc->stats.cpustats);
 470         kfree(svc);
 471 }
 472
 473 static void ip_vs_service_rcu_free(struct rcu_head *head)
 474 {
 475         struct ip_vs_service *svc;
 476
 477         svc = container_of(head, struct ip_vs_service, rcu_head);
 478         ip_vs_service_free(svc);
 479 }
 480
 481 static void __ip_vs_svc_put(struct ip_vs_service *svc, bool do_delay)
 482 {
 483         if (atomic_dec_and_test(&svc->refcnt)) {
 484                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
 485                               svc->fwmark,
 486                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
 487                               ntohs(svc->port));
 488                 if (do_delay)
 489                         call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
 490                 else
 491                         ip_vs_service_free(svc);
 492         }
 493 }
 494
 495
 496 /*
 497  *      Returns hash value for real service
 498  */
 499 static inline unsigned int ip_vs_rs_hashkey(int af,
 500                                             const union nf_inet_addr *addr,
 501                                             __be16 port)
 502 {
 503         register unsigned int porth = ntohs(port);
 504         __be32 addr_fold = addr->ip;
 505
 506 #ifdef CONFIG_IP_VS_IPV6
 507         if (af == AF_INET6)
 508                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 509                             addr->ip6[2]^addr->ip6[3];
 510 #endif
 511
 512         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 513                 & IP_VS_RTAB_MASK;
 514 }
 515
 516 /* Hash ip_vs_dest in rs_table by <proto,addr,port>. */
 517 static void ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
 518 {
 519         unsigned int hash;
 520
 521         if (dest->in_rs_table)
 522                 return;
 523
 524         /*
 525          *      Hash by proto,addr,port,
 526          *      which are the parameters of the real service.
 527          */
 528         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 529
 530         hlist_add_head_rcu(&dest->d_list, &ipvs->rs_table[hash]);
 531         dest->in_rs_table = 1;
 532 }
 533
 534 /* Unhash ip_vs_dest from rs_table. */
 535 static void ip_vs_rs_unhash(struct ip_vs_dest *dest)
 536 {
 537         /*
 538          * Remove it from the rs_table table.
 539          */
 540         if (dest->in_rs_table) {
 541                 hlist_del_rcu(&dest->d_list);
 542                 dest->in_rs_table = 0;
 543         }
 544 }
 545
 546 /* Check if real service by <proto,addr,port> is present */
 547 bool ip_vs_has_real_service(struct net *net, int af, __u16 protocol,
 548                             const union nf_inet_addr *daddr, __be16 dport)
 549 {
 550         struct netns_ipvs *ipvs = net_ipvs(net);
 551         unsigned int hash;
 552         struct ip_vs_dest *dest;
 553
 554         /* Check for "full" addressed entries */
 555         hash = ip_vs_rs_hashkey(af, daddr, dport);
 556
 557         rcu_read_lock();
 558         hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
 559                 if (dest->port == dport &&
 560                     dest->af == af &&
 561                     ip_vs_addr_equal(af, &dest->addr, daddr) &&
 562                     (dest->protocol == protocol || dest->vfwmark)) {
 563                         /* HIT */
 564                         rcu_read_unlock();
 565                         return true;
 566                 }
 567         }
 568         rcu_read_unlock();
 569
 570         return false;
 571 }
 572
 573 /* Lookup destination by {addr,port} in the given service
 574  * Called under RCU lock.
 575  */
 576 static struct ip_vs_dest *
 577 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 578                   __be16 dport)
 579 {
 580         struct ip_vs_dest *dest;
 581
 582         /*
 583          * Find the destination for the given service
 584          */
 585         list_for_each_entry_rcu(dest, &svc->destinations, n_list) {
 586                 if ((dest->af == svc->af)
 587                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 588                     && (dest->port == dport)) {
 589                         /* HIT */
 590                         return dest;
 591                 }
 592         }
 593
 594         return NULL;
 595 }
 596
 597 /*
 598  * Find destination by {daddr,dport,vaddr,protocol}
 599  * Created to be used in ip_vs_process_message() in
 600  * the backup synchronization daemon. It finds the
 601  * destination to be bound to the received connection
 602  * on the backup.
 603  * Called under RCU lock, no refcnt is returned.
 604  */
 605 struct ip_vs_dest *ip_vs_find_dest(struct net  *net, int af,
 606                                    const union nf_inet_addr *daddr,
 607                                    __be16 dport,
 608                                    const union nf_inet_addr *vaddr,
 609                                    __be16 vport, __u16 protocol, __u32 fwmark,
 610                                    __u32 flags)
 611 {
 612         struct ip_vs_dest *dest;
 613         struct ip_vs_service *svc;
 614         __be16 port = dport;
 615
 616         svc = ip_vs_service_find(net, af, fwmark, protocol, vaddr, vport);
 617         if (!svc)
 618                 return NULL;
 619         if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
 620                 port = 0;
 621         dest = ip_vs_lookup_dest(svc, daddr, port);
 622         if (!dest)
 623                 dest = ip_vs_lookup_dest(svc, daddr, port ^ dport);
 624         return dest;
 625 }
 626
 627 void ip_vs_dest_dst_rcu_free(struct rcu_head *head)
 628 {
 629         struct ip_vs_dest_dst *dest_dst = container_of(head,
 630                                                        struct ip_vs_dest_dst,
 631                                                        rcu_head);
 632
 633         dst_release(dest_dst->dst_cache);
 634         kfree(dest_dst);
 635 }
 636
 637 /* Release dest_dst and dst_cache for dest in user context */
 638 static void __ip_vs_dst_cache_reset(struct ip_vs_dest *dest)
 639 {
 640         struct ip_vs_dest_dst *old;
 641
 642         old = rcu_dereference_protected(dest->dest_dst, 1);
 643         if (old) {
 644                 RCU_INIT_POINTER(dest->dest_dst, NULL);
 645                 call_rcu(&old->rcu_head, ip_vs_dest_dst_rcu_free);
 646         }
 647 }
 648
 649 /*
 650  *  Lookup dest by {svc,addr,port} in the destination trash.
 651  *  The destination trash is used to hold the destinations that are removed
 652  *  from the service table but are still referenced by some conn entries.
 653  *  The reason to add the destination trash is when the dest is temporary
 654  *  down (either by administrator or by monitor program), the dest can be
 655  *  picked back from the trash, the remaining connections to the dest can
 656  *  continue, and the counting information of the dest is also useful for
 657  *  scheduling.
 658  */
 659 static struct ip_vs_dest *
 660 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 661                      __be16 dport)
 662 {
 663         struct ip_vs_dest *dest;
 664         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 665
 666         /*
 667          * Find the destination in trash
 668          */
 669         spin_lock_bh(&ipvs->dest_trash_lock);
 670         list_for_each_entry(dest, &ipvs->dest_trash, t_list) {
 671                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 672                               "dest->refcnt=%d\n",
 673                               dest->vfwmark,
 674                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 675                               ntohs(dest->port),
 676                               atomic_read(&dest->refcnt));
 677                 if (dest->af == svc->af &&
 678                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 679                     dest->port == dport &&
 680                     dest->vfwmark == svc->fwmark &&
 681                     dest->protocol == svc->protocol &&
 682                     (svc->fwmark ||
 683                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 684                       dest->vport == svc->port))) {
 685                         /* HIT */
 686                         list_del(&dest->t_list);
 687                         ip_vs_dest_hold(dest);
 688                         goto out;
 689                 }
 690         }
 691
 692         dest = NULL;
 693
 694 out:
 695         spin_unlock_bh(&ipvs->dest_trash_lock);
 696
 697         return dest;
 698 }
 699
 700 static void ip_vs_dest_free(struct ip_vs_dest *dest)
 701 {
 702         struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1);
 703
 704         __ip_vs_dst_cache_reset(dest);
 705         __ip_vs_svc_put(svc, false);
 706         free_percpu(dest->stats.cpustats);
 707         ip_vs_dest_put_and_free(dest);
 708 }
 709
 710 /*
 711  *  Clean up all the destinations in the trash
 712  *  Called by the ip_vs_control_cleanup()
 713  *
 714  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 715  *  the service tables must have been flushed and all the connections
 716  *  are expired, and the refcnt of each destination in the trash must
 717  *  be 0, so we simply release them here.
 718  */
 719 static void ip_vs_trash_cleanup(struct net *net)
 720 {
 721         struct ip_vs_dest *dest, *nxt;
 722         struct netns_ipvs *ipvs = net_ipvs(net);
 723
 724         del_timer_sync(&ipvs->dest_trash_timer);
 725         /* No need to use dest_trash_lock */
 726         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) {
 727                 list_del(&dest->t_list);
 728                 ip_vs_dest_free(dest);
 729         }
 730 }
 731
 732 static void
 733 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
 734 {
 735 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
 736
 737         spin_lock_bh(&src->lock);
 738
 739         IP_VS_SHOW_STATS_COUNTER(conns);
 740         IP_VS_SHOW_STATS_COUNTER(inpkts);
 741         IP_VS_SHOW_STATS_COUNTER(outpkts);
 742         IP_VS_SHOW_STATS_COUNTER(inbytes);
 743         IP_VS_SHOW_STATS_COUNTER(outbytes);
 744
 745         ip_vs_read_estimator(dst, src);
 746
 747         spin_unlock_bh(&src->lock);
 748 }
 749
 750 static void
 751 ip_vs_zero_stats(struct ip_vs_stats *stats)
 752 {
 753         spin_lock_bh(&stats->lock);
 754
 755         /* get current counters as zero point, rates are zeroed */
 756
 757 #define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
 758
 759         IP_VS_ZERO_STATS_COUNTER(conns);
 760         IP_VS_ZERO_STATS_COUNTER(inpkts);
 761         IP_VS_ZERO_STATS_COUNTER(outpkts);
 762         IP_VS_ZERO_STATS_COUNTER(inbytes);
 763         IP_VS_ZERO_STATS_COUNTER(outbytes);
 764
 765         ip_vs_zero_estimator(stats);
 766
 767         spin_unlock_bh(&stats->lock);
 768 }
 769
 770 /*
 771  *      Update a destination in the given service
 772  */
 773 static void
 774 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
 775                     struct ip_vs_dest_user_kern *udest, int add)
 776 {
 777         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 778         struct ip_vs_service *old_svc;
 779         struct ip_vs_scheduler *sched;
 780         int conn_flags;
 781
 782         /* set the weight and the flags */
 783         atomic_set(&dest->weight, udest->weight);
 784         conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
 785         conn_flags |= IP_VS_CONN_F_INACTIVE;
 786
 787         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 788         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
 789                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 790         } else {
 791                 /*
 792                  *    Put the real service in rs_table if not present.
 793                  *    For now only for NAT!
 794                  */
 795                 ip_vs_rs_hash(ipvs, dest);
 796         }
 797         atomic_set(&dest->conn_flags, conn_flags);
 798
 799         /* bind the service */
 800         old_svc = rcu_dereference_protected(dest->svc, 1);
 801         if (!old_svc) {
 802                 __ip_vs_bind_svc(dest, svc);
 803         } else {
 804                 if (old_svc != svc) {
 805                         ip_vs_zero_stats(&dest->stats);
 806                         __ip_vs_bind_svc(dest, svc);
 807                         __ip_vs_svc_put(old_svc, true);
 808                 }
 809         }
 810
 811         /* set the dest status flags */
 812         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 813
 814         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 815                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 816         dest->u_threshold = udest->u_threshold;
 817         dest->l_threshold = udest->l_threshold;
 818
 819         spin_lock_bh(&dest->dst_lock);
 820         __ip_vs_dst_cache_reset(dest);
 821         spin_unlock_bh(&dest->dst_lock);
 822
 823         sched = rcu_dereference_protected(svc->scheduler, 1);
 824         if (add) {
 825                 ip_vs_start_estimator(svc->net, &dest->stats);
 826                 list_add_rcu(&dest->n_list, &svc->destinations);
 827                 svc->num_dests++;
 828                 if (sched->add_dest)
 829                         sched->add_dest(svc, dest);
 830         } else {
 831                 if (sched->upd_dest)
 832                         sched->upd_dest(svc, dest);
 833         }
 834 }
 835
 836
 837 /*
 838  *      Create a destination for the given service
 839  */
 840 static int
 841 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 842                struct ip_vs_dest **dest_p)
 843 {
 844         struct ip_vs_dest *dest;
 845         unsigned int atype;
 846
 847         EnterFunction(2);
 848
 849 #ifdef CONFIG_IP_VS_IPV6
 850         if (svc->af == AF_INET6) {
 851                 atype = ipv6_addr_type(&udest->addr.in6);
 852                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 853                         atype & IPV6_ADDR_LINKLOCAL) &&
 854                         !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
 855                         return -EINVAL;
 856         } else
 857 #endif
 858         {
 859                 atype = inet_addr_type(svc->net, udest->addr.ip);
 860                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 861                         return -EINVAL;
 862         }
 863
 864         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
 865         if (dest == NULL)
 866                 return -ENOMEM;
 867
 868         dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
 869         if (!dest->stats.cpustats)
 870                 goto err_alloc;
 871
 872         dest->af = svc->af;
 873         dest->protocol = svc->protocol;
 874         dest->vaddr = svc->addr;
 875         dest->vport = svc->port;
 876         dest->vfwmark = svc->fwmark;
 877         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 878         dest->port = udest->port;
 879
 880         atomic_set(&dest->activeconns, 0);
 881         atomic_set(&dest->inactconns, 0);
 882         atomic_set(&dest->persistconns, 0);
 883         atomic_set(&dest->refcnt, 1);
 884
 885         INIT_HLIST_NODE(&dest->d_list);
 886         spin_lock_init(&dest->dst_lock);
 887         spin_lock_init(&dest->stats.lock);
 888         __ip_vs_update_dest(svc, dest, udest, 1);
 889
 890         *dest_p = dest;
 891
 892         LeaveFunction(2);
 893         return 0;
 894
 895 err_alloc:
 896         kfree(dest);
 897         return -ENOMEM;
 898 }
 899
 900
 901 /*
 902  *      Add a destination into an existing service
 903  */
 904 static int
 905 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 906 {
 907         struct ip_vs_dest *dest;
 908         union nf_inet_addr daddr;
 909         __be16 dport = udest->port;
 910         int ret;
 911
 912         EnterFunction(2);
 913
 914         if (udest->weight < 0) {
 915                 pr_err("%s(): server weight less than zero\n", __func__);
 916                 return -ERANGE;
 917         }
 918
 919         if (udest->l_threshold > udest->u_threshold) {
 920                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 921                         __func__);
 922                 return -ERANGE;
 923         }
 924
 925         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 926
 927         /* We use function that requires RCU lock */
 928         rcu_read_lock();
 929         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 930         rcu_read_unlock();
 931
 932         if (dest != NULL) {
 933                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 934                 return -EEXIST;
 935         }
 936
 937         /*
 938          * Check if the dest already exists in the trash and
 939          * is from the same service
 940          */
 941         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 942
 943         if (dest != NULL) {
 944                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 945                               "dest->refcnt=%d, service %u/%s:%u\n",
 946                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 947                               atomic_read(&dest->refcnt),
 948                               dest->vfwmark,
 949                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 950                               ntohs(dest->vport));
 951
 952                 __ip_vs_update_dest(svc, dest, udest, 1);
 953                 ret = 0;
 954         } else {
 955                 /*
 956                  * Allocate and initialize the dest structure
 957                  */
 958                 ret = ip_vs_new_dest(svc, udest, &dest);
 959         }
 960         LeaveFunction(2);
 961
 962         return ret;
 963 }
 964
 965
 966 /*
 967  *      Edit a destination in the given service
 968  */
 969 static int
 970 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 971 {
 972         struct ip_vs_dest *dest;
 973         union nf_inet_addr daddr;
 974         __be16 dport = udest->port;
 975
 976         EnterFunction(2);
 977
 978         if (udest->weight < 0) {
 979                 pr_err("%s(): server weight less than zero\n", __func__);
 980                 return -ERANGE;
 981         }
 982
 983         if (udest->l_threshold > udest->u_threshold) {
 984                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 985                         __func__);
 986                 return -ERANGE;
 987         }
 988
 989         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 990
 991         /* We use function that requires RCU lock */
 992         rcu_read_lock();
 993         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 994         rcu_read_unlock();
 995
 996         if (dest == NULL) {
 997                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
 998                 return -ENOENT;
 999         }
1000
1001         __ip_vs_update_dest(svc, dest, udest, 0);
1002         LeaveFunction(2);
1003
1004         return 0;
1005 }
1006
1007 /*
1008  *      Delete a destination (must be already unlinked from the service)
1009  */
1010 static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest,
1011                              bool cleanup)
1012 {
1013         struct netns_ipvs *ipvs = net_ipvs(net);
1014
1015         ip_vs_stop_estimator(net, &dest->stats);
1016
1017         /*
1018          *  Remove it from the d-linked list with the real services.
1019          */
1020         ip_vs_rs_unhash(dest);
1021
1022         spin_lock_bh(&ipvs->dest_trash_lock);
1023         IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n",
1024                       IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port),
1025                       atomic_read(&dest->refcnt));
1026         if (list_empty(&ipvs->dest_trash) && !cleanup)
1027                 mod_timer(&ipvs->dest_trash_timer,
1028                           jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
1029         /* dest lives in trash without reference */
1030         list_add(&dest->t_list, &ipvs->dest_trash);
1031         dest->idle_start = 0;
1032         spin_unlock_bh(&ipvs->dest_trash_lock);
1033         ip_vs_dest_put(dest);
1034 }
1035
1036
1037 /*
1038  *      Unlink a destination from the given service
1039  */
1040 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1041                                 struct ip_vs_dest *dest,
1042                                 int svcupd)
1043 {
1044         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1045
1046         /*
1047          *  Remove it from the d-linked destination list.
1048          */
1049         list_del_rcu(&dest->n_list);
1050         svc->num_dests--;
1051
1052         if (svcupd) {
1053                 struct ip_vs_scheduler *sched;
1054
1055                 sched = rcu_dereference_protected(svc->scheduler, 1);
1056                 if (sched->del_dest)
1057                         sched->del_dest(svc, dest);
1058         }
1059 }
1060
1061
1062 /*
1063  *      Delete a destination server in the given service
1064  */
1065 static int
1066 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1067 {
1068         struct ip_vs_dest *dest;
1069         __be16 dport = udest->port;
1070
1071         EnterFunction(2);
1072
1073         /* We use function that requires RCU lock */
1074         rcu_read_lock();
1075         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1076         rcu_read_unlock();
1077
1078         if (dest == NULL) {
1079                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1080                 return -ENOENT;
1081         }
1082
1083         /*
1084          *      Unlink dest from the service
1085          */
1086         __ip_vs_unlink_dest(svc, dest, 1);
1087
1088         /*
1089          *      Delete the destination
1090          */
1091         __ip_vs_del_dest(svc->net, dest, false);
1092
1093         LeaveFunction(2);
1094
1095         return 0;
1096 }
1097
1098 static void ip_vs_dest_trash_expire(unsigned long data)
1099 {
1100         struct net *net = (struct net *) data;
1101         struct netns_ipvs *ipvs = net_ipvs(net);
1102         struct ip_vs_dest *dest, *next;
1103         unsigned long now = jiffies;
1104
1105         spin_lock(&ipvs->dest_trash_lock);
1106         list_for_each_entry_safe(dest, next, &ipvs->dest_trash, t_list) {
1107                 if (atomic_read(&dest->refcnt) > 0)
1108                         continue;
1109                 if (dest->idle_start) {
1110                         if (time_before(now, dest->idle_start +
1111                                              IP_VS_DEST_TRASH_PERIOD))
1112                                 continue;
1113                 } else {
1114                         dest->idle_start = max(1UL, now);
1115                         continue;
1116                 }
1117                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u from trash\n",
1118                               dest->vfwmark,
1119                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1120                               ntohs(dest->port));
1121                 list_del(&dest->t_list);
1122                 ip_vs_dest_free(dest);
1123         }
1124         if (!list_empty(&ipvs->dest_trash))
1125                 mod_timer(&ipvs->dest_trash_timer,
1126                           jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
1127         spin_unlock(&ipvs->dest_trash_lock);
1128 }
1129
1130 /*
1131  *      Add a service into the service hash table
1132  */
1133 static int
1134 ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
1135                   struct ip_vs_service **svc_p)
1136 {
1137         int ret = 0;
1138         struct ip_vs_scheduler *sched = NULL;
1139         struct ip_vs_pe *pe = NULL;
1140         struct ip_vs_service *svc = NULL;
1141         struct netns_ipvs *ipvs = net_ipvs(net);
1142
1143         /* increase the module use count */
1144         ip_vs_use_count_inc();
1145
1146         /* Lookup the scheduler by 'u->sched_name' */
1147         sched = ip_vs_scheduler_get(u->sched_name);
1148         if (sched == NULL) {
1149                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1150                 ret = -ENOENT;
1151                 goto out_err;
1152         }
1153
1154         if (u->pe_name && *u->pe_name) {
1155                 pe = ip_vs_pe_getbyname(u->pe_name);
1156                 if (pe == NULL) {
1157                         pr_info("persistence engine module ip_vs_pe_%s "
1158                                 "not found\n", u->pe_name);
1159                         ret = -ENOENT;
1160                         goto out_err;
1161                 }
1162         }
1163
1164 #ifdef CONFIG_IP_VS_IPV6
1165         if (u->af == AF_INET6) {
1166                 __u32 plen = (__force __u32) u->netmask;
1167
1168                 if (plen < 1 || plen > 128) {
1169                         ret = -EINVAL;
1170                         goto out_err;
1171                 }
1172         }
1173 #endif
1174
1175         svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1176         if (svc == NULL) {
1177                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1178                 ret = -ENOMEM;
1179                 goto out_err;
1180         }
1181         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1182         if (!svc->stats.cpustats) {
1183                 ret = -ENOMEM;
1184                 goto out_err;
1185         }
1186
1187         /* I'm the first user of the service */
1188         atomic_set(&svc->refcnt, 0);
1189
1190         svc->af = u->af;
1191         svc->protocol = u->protocol;
1192         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1193         svc->port = u->port;
1194         svc->fwmark = u->fwmark;
1195         svc->flags = u->flags;
1196         svc->timeout = u->timeout * HZ;
1197         svc->netmask = u->netmask;
1198         svc->net = net;
1199
1200         INIT_LIST_HEAD(&svc->destinations);
1201         spin_lock_init(&svc->sched_lock);
1202         spin_lock_init(&svc->stats.lock);
1203
1204         /* Bind the scheduler */
1205         ret = ip_vs_bind_scheduler(svc, sched);
1206         if (ret)
1207                 goto out_err;
1208         sched = NULL;
1209
1210         /* Bind the ct retriever */
1211         RCU_INIT_POINTER(svc->pe, pe);
1212         pe = NULL;
1213
1214         /* Update the virtual service counters */
1215         if (svc->port == FTPPORT)
1216                 atomic_inc(&ipvs->ftpsvc_counter);
1217         else if (svc->port == 0)
1218                 atomic_inc(&ipvs->nullsvc_counter);
1219
1220         ip_vs_start_estimator(net, &svc->stats);
1221
1222         /* Count only IPv4 services for old get/setsockopt interface */
1223         if (svc->af == AF_INET)
1224                 ipvs->num_services++;
1225
1226         /* Hash the service into the service table */
1227         ip_vs_svc_hash(svc);
1228
1229         *svc_p = svc;
1230         /* Now there is a service - full throttle */
1231         ipvs->enable = 1;
1232         return 0;
1233
1234
1235  out_err:
1236         if (svc != NULL) {
1237                 ip_vs_unbind_scheduler(svc, sched);
1238                 ip_vs_service_free(svc);
1239         }
1240         ip_vs_scheduler_put(sched);
1241         ip_vs_pe_put(pe);
1242
1243         /* decrease the module use count */
1244         ip_vs_use_count_dec();
1245
1246         return ret;
1247 }
1248
1249
1250 /*
1251  *      Edit a service and bind it with a new scheduler
1252  */
1253 static int
1254 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1255 {
1256         struct ip_vs_scheduler *sched, *old_sched;
1257         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1258         int ret = 0;
1259
1260         /*
1261          * Lookup the scheduler, by 'u->sched_name'
1262          */
1263         sched = ip_vs_scheduler_get(u->sched_name);
1264         if (sched == NULL) {
1265                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1266                 return -ENOENT;
1267         }
1268         old_sched = sched;
1269
1270         if (u->pe_name && *u->pe_name) {
1271                 pe = ip_vs_pe_getbyname(u->pe_name);
1272                 if (pe == NULL) {
1273                         pr_info("persistence engine module ip_vs_pe_%s "
1274                                 "not found\n", u->pe_name);
1275                         ret = -ENOENT;
1276                         goto out;
1277                 }
1278                 old_pe = pe;
1279         }
1280
1281 #ifdef CONFIG_IP_VS_IPV6
1282         if (u->af == AF_INET6) {
1283                 __u32 plen = (__force __u32) u->netmask;
1284
1285                 if (plen < 1 || plen > 128) {
1286                         ret = -EINVAL;
1287                         goto out;
1288                 }
1289         }
1290 #endif
1291
1292         old_sched = rcu_dereference_protected(svc->scheduler, 1);
1293         if (sched != old_sched) {
1294                 /* Bind the new scheduler */
1295                 ret = ip_vs_bind_scheduler(svc, sched);
1296                 if (ret) {
1297                         old_sched = sched;
1298                         goto out;
1299                 }
1300                 /* Unbind the old scheduler on success */
1301                 ip_vs_unbind_scheduler(svc, old_sched);
1302         }
1303
1304         /*
1305          * Set the flags and timeout value
1306          */
1307         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1308         svc->timeout = u->timeout * HZ;
1309         svc->netmask = u->netmask;
1310
1311         old_pe = rcu_dereference_protected(svc->pe, 1);
1312         if (pe != old_pe)
1313                 rcu_assign_pointer(svc->pe, pe);
1314
1315 out:
1316         ip_vs_scheduler_put(old_sched);
1317         ip_vs_pe_put(old_pe);
1318         return ret;
1319 }
1320
1321 /*
1322  *      Delete a service from the service list
1323  *      - The service must be unlinked, unlocked and not referenced!
1324  *      - We are called under _bh lock
1325  */
1326 static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
1327 {
1328         struct ip_vs_dest *dest, *nxt;
1329         struct ip_vs_scheduler *old_sched;
1330         struct ip_vs_pe *old_pe;
1331         struct netns_ipvs *ipvs = net_ipvs(svc->net);
1332
1333         pr_info("%s: enter\n", __func__);
1334
1335         /* Count only IPv4 services for old get/setsockopt interface */
1336         if (svc->af == AF_INET)
1337                 ipvs->num_services--;
1338
1339         ip_vs_stop_estimator(svc->net, &svc->stats);
1340
1341         /* Unbind scheduler */
1342         old_sched = rcu_dereference_protected(svc->scheduler, 1);
1343         ip_vs_unbind_scheduler(svc, old_sched);
1344         ip_vs_scheduler_put(old_sched);
1345
1346         /* Unbind persistence engine, keep svc->pe */
1347         old_pe = rcu_dereference_protected(svc->pe, 1);
1348         ip_vs_pe_put(old_pe);
1349
1350         /*
1351          *    Unlink the whole destination list
1352          */
1353         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1354                 __ip_vs_unlink_dest(svc, dest, 0);
1355                 __ip_vs_del_dest(svc->net, dest, cleanup);
1356         }
1357
1358         /*
1359          *    Update the virtual service counters
1360          */
1361         if (svc->port == FTPPORT)
1362                 atomic_dec(&ipvs->ftpsvc_counter);
1363         else if (svc->port == 0)
1364                 atomic_dec(&ipvs->nullsvc_counter);
1365
1366         /*
1367          *    Free the service if nobody refers to it
1368          */
1369         __ip_vs_svc_put(svc, true);
1370
1371         /* decrease the module use count */
1372         ip_vs_use_count_dec();
1373 }
1374
1375 /*
1376  * Unlink a service from list and try to delete it if its refcnt reached 0
1377  */
1378 static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup)
1379 {
1380         /* Hold svc to avoid double release from dest_trash */
1381         atomic_inc(&svc->refcnt);
1382         /*
1383          * Unhash it from the service table
1384          */
1385         ip_vs_svc_unhash(svc);
1386
1387         __ip_vs_del_service(svc, cleanup);
1388 }
1389
1390 /*
1391  *      Delete a service from the service list
1392  */
1393 static int ip_vs_del_service(struct ip_vs_service *svc)
1394 {
1395         if (svc == NULL)
1396                 return -EEXIST;
1397         ip_vs_unlink_service(svc, false);
1398
1399         return 0;
1400 }
1401
1402
1403 /*
1404  *      Flush all the virtual services
1405  */
1406 static int ip_vs_flush(struct net *net, bool cleanup)
1407 {
1408         int idx;
1409         struct ip_vs_service *svc;
1410         struct hlist_node *n;
1411
1412         /*
1413          * Flush the service table hashed by <netns,protocol,addr,port>
1414          */
1415         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1416                 hlist_for_each_entry_safe(svc, n, &ip_vs_svc_table[idx],
1417                                           s_list) {
1418                         if (net_eq(svc->net, net))
1419                                 ip_vs_unlink_service(svc, cleanup);
1420                 }
1421         }
1422
1423         /*
1424          * Flush the service table hashed by fwmark
1425          */
1426         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1427                 hlist_for_each_entry_safe(svc, n, &ip_vs_svc_fwm_table[idx],
1428                                           f_list) {
1429                         if (net_eq(svc->net, net))
1430                                 ip_vs_unlink_service(svc, cleanup);
1431                 }
1432         }
1433
1434         return 0;
1435 }
1436
1437 /*
1438  *      Delete service by {netns} in the service table.
1439  *      Called by __ip_vs_cleanup()
1440  */
1441 void ip_vs_service_net_cleanup(struct net *net)
1442 {
1443         EnterFunction(2);
1444         /* Check for "full" addressed entries */
1445         mutex_lock(&__ip_vs_mutex);
1446         ip_vs_flush(net, true);
1447         mutex_unlock(&__ip_vs_mutex);
1448         LeaveFunction(2);
1449 }
1450
1451 /* Put all references for device (dst_cache) */
1452 static inline void
1453 ip_vs_forget_dev(struct ip_vs_dest *dest, struct net_device *dev)
1454 {
1455         struct ip_vs_dest_dst *dest_dst;
1456
1457         spin_lock_bh(&dest->dst_lock);
1458         dest_dst = rcu_dereference_protected(dest->dest_dst, 1);
1459         if (dest_dst && dest_dst->dst_cache->dev == dev) {
1460                 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1461                               dev->name,
1462                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1463                               ntohs(dest->port),
1464                               atomic_read(&dest->refcnt));
1465                 __ip_vs_dst_cache_reset(dest);
1466         }
1467         spin_unlock_bh(&dest->dst_lock);
1468
1469 }
1470 /* Netdev event receiver
1471  * Currently only NETDEV_DOWN is handled to release refs to cached dsts
1472  */
1473 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1474                            void *ptr)
1475 {
1476         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1477         struct net *net = dev_net(dev);
1478         struct netns_ipvs *ipvs = net_ipvs(net);
1479         struct ip_vs_service *svc;
1480         struct ip_vs_dest *dest;
1481         unsigned int idx;
1482
1483         if (event != NETDEV_DOWN || !ipvs)
1484                 return NOTIFY_DONE;
1485         IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1486         EnterFunction(2);
1487         mutex_lock(&__ip_vs_mutex);
1488         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1489                 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1490                         if (net_eq(svc->net, net)) {
1491                                 list_for_each_entry(dest, &svc->destinations,
1492                                                     n_list) {
1493                                         ip_vs_forget_dev(dest, dev);
1494                                 }
1495                         }
1496                 }
1497
1498                 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1499                         if (net_eq(svc->net, net)) {
1500                                 list_for_each_entry(dest, &svc->destinations,
1501                                                     n_list) {
1502                                         ip_vs_forget_dev(dest, dev);
1503                                 }
1504                         }
1505
1506                 }
1507         }
1508
1509         spin_lock_bh(&ipvs->dest_trash_lock);
1510         list_for_each_entry(dest, &ipvs->dest_trash, t_list) {
1511                 ip_vs_forget_dev(dest, dev);
1512         }
1513         spin_unlock_bh(&ipvs->dest_trash_lock);
1514         mutex_unlock(&__ip_vs_mutex);
1515         LeaveFunction(2);
1516         return NOTIFY_DONE;
1517 }
1518
1519 /*
1520  *      Zero counters in a service or all services
1521  */
1522 static int ip_vs_zero_service(struct ip_vs_service *svc)
1523 {
1524         struct ip_vs_dest *dest;
1525
1526         list_for_each_entry(dest, &svc->destinations, n_list) {
1527                 ip_vs_zero_stats(&dest->stats);
1528         }
1529         ip_vs_zero_stats(&svc->stats);
1530         return 0;
1531 }
1532
1533 static int ip_vs_zero_all(struct net *net)
1534 {
1535         int idx;
1536         struct ip_vs_service *svc;
1537
1538         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1539                 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1540                         if (net_eq(svc->net, net))
1541                                 ip_vs_zero_service(svc);
1542                 }
1543         }
1544
1545         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1546                 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1547                         if (net_eq(svc->net, net))
1548                                 ip_vs_zero_service(svc);
1549                 }
1550         }
1551
1552         ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1553         return 0;
1554 }
1555
1556 #ifdef CONFIG_SYSCTL
1557
1558 static int zero;
1559 static int three = 3;
1560
1561 static int
1562 proc_do_defense_mode(struct ctl_table *table, int write,
1563                      void __user *buffer, size_t *lenp, loff_t *ppos)
1564 {
1565         struct net *net = current->nsproxy->net_ns;
1566         int *valp = table->data;
1567         int val = *valp;
1568         int rc;
1569
1570         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1571         if (write && (*valp != val)) {
1572                 if ((*valp < 0) || (*valp > 3)) {
1573                         /* Restore the correct value */
1574                         *valp = val;
1575                 } else {
1576                         update_defense_level(net_ipvs(net));
1577                 }
1578         }
1579         return rc;
1580 }
1581
1582 static int
1583 proc_do_sync_threshold(struct ctl_table *table, int write,
1584                        void __user *buffer, size_t *lenp, loff_t *ppos)
1585 {
1586         int *valp = table->data;
1587         int val[2];
1588         int rc;
1589
1590         /* backup the value first */
1591         memcpy(val, valp, sizeof(val));
1592
1593         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1594         if (write && (valp[0] < 0 || valp[1] < 0 ||
1595             (valp[0] >= valp[1] && valp[1]))) {
1596                 /* Restore the correct value */
1597                 memcpy(valp, val, sizeof(val));
1598         }
1599         return rc;
1600 }
1601
1602 static int
1603 proc_do_sync_mode(struct ctl_table *table, int write,
1604                      void __user *buffer, size_t *lenp, loff_t *ppos)
1605 {
1606         int *valp = table->data;
1607         int val = *valp;
1608         int rc;
1609
1610         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1611         if (write && (*valp != val)) {
1612                 if ((*valp < 0) || (*valp > 1)) {
1613                         /* Restore the correct value */
1614                         *valp = val;
1615                 }
1616         }
1617         return rc;
1618 }
1619
1620 static int
1621 proc_do_sync_ports(struct ctl_table *table, int write,
1622                    void __user *buffer, size_t *lenp, loff_t *ppos)
1623 {
1624         int *valp = table->data;
1625         int val = *valp;
1626         int rc;
1627
1628         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1629         if (write && (*valp != val)) {
1630                 if (*valp < 1 || !is_power_of_2(*valp)) {
1631                         /* Restore the correct value */
1632                         *valp = val;
1633                 }
1634         }
1635         return rc;
1636 }
1637
1638 /*
1639  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1640  *      Do not change order or insert new entries without
1641  *      align with netns init in ip_vs_control_net_init()
1642  */
1643
1644 static struct ctl_table vs_vars[] = {
1645         {
1646                 .procname       = "amemthresh",
1647                 .maxlen         = sizeof(int),
1648                 .mode           = 0644,
1649                 .proc_handler   = proc_dointvec,
1650         },
1651         {
1652                 .procname       = "am_droprate",
1653                 .maxlen         = sizeof(int),
1654                 .mode           = 0644,
1655                 .proc_handler   = proc_dointvec,
1656         },
1657         {
1658                 .procname       = "drop_entry",
1659                 .maxlen         = sizeof(int),
1660                 .mode           = 0644,
1661                 .proc_handler   = proc_do_defense_mode,
1662         },
1663         {
1664                 .procname       = "drop_packet",
1665                 .maxlen         = sizeof(int),
1666                 .mode           = 0644,
1667                 .proc_handler   = proc_do_defense_mode,
1668         },
1669 #ifdef CONFIG_IP_VS_NFCT
1670         {
1671                 .procname       = "conntrack",
1672                 .maxlen         = sizeof(int),
1673                 .mode           = 0644,
1674                 .proc_handler   = &proc_dointvec,
1675         },
1676 #endif
1677         {
1678                 .procname       = "secure_tcp",
1679                 .maxlen         = sizeof(int),
1680                 .mode           = 0644,
1681                 .proc_handler   = proc_do_defense_mode,
1682         },
1683         {
1684                 .procname       = "snat_reroute",
1685                 .maxlen         = sizeof(int),
1686                 .mode           = 0644,
1687                 .proc_handler   = &proc_dointvec,
1688         },
1689         {
1690                 .procname       = "sync_version",
1691                 .maxlen         = sizeof(int),
1692                 .mode           = 0644,
1693                 .proc_handler   = &proc_do_sync_mode,
1694         },
1695         {
1696                 .procname       = "sync_ports",
1697                 .maxlen         = sizeof(int),
1698                 .mode           = 0644,
1699                 .proc_handler   = &proc_do_sync_ports,
1700         },
1701         {
1702                 .procname       = "sync_persist_mode",
1703                 .maxlen         = sizeof(int),
1704                 .mode           = 0644,
1705                 .proc_handler   = proc_dointvec,
1706         },
1707         {
1708                 .procname       = "sync_qlen_max",
1709                 .maxlen         = sizeof(unsigned long),
1710                 .mode           = 0644,
1711                 .proc_handler   = proc_doulongvec_minmax,
1712         },
1713         {
1714                 .procname       = "sync_sock_size",
1715                 .maxlen         = sizeof(int),
1716                 .mode           = 0644,
1717                 .proc_handler   = proc_dointvec,
1718         },
1719         {
1720                 .procname       = "cache_bypass",
1721                 .maxlen         = sizeof(int),
1722                 .mode           = 0644,
1723                 .proc_handler   = proc_dointvec,
1724         },
1725         {
1726                 .procname       = "expire_nodest_conn",
1727                 .maxlen         = sizeof(int),
1728                 .mode           = 0644,
1729                 .proc_handler   = proc_dointvec,
1730         },
1731         {
1732                 .procname       = "sloppy_tcp",
1733                 .maxlen         = sizeof(int),
1734                 .mode           = 0644,
1735                 .proc_handler   = proc_dointvec,
1736         },
1737         {
1738                 .procname       = "sloppy_sctp",
1739                 .maxlen         = sizeof(int),
1740                 .mode           = 0644,
1741                 .proc_handler   = proc_dointvec,
1742         },
1743         {
1744                 .procname       = "expire_quiescent_template",
1745                 .maxlen         = sizeof(int),
1746                 .mode           = 0644,
1747                 .proc_handler   = proc_dointvec,
1748         },
1749         {
1750                 .procname       = "sync_threshold",
1751                 .maxlen         =
1752                         sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1753                 .mode           = 0644,
1754                 .proc_handler   = proc_do_sync_threshold,
1755         },
1756         {
1757                 .procname       = "sync_refresh_period",
1758                 .maxlen         = sizeof(int),
1759                 .mode           = 0644,
1760                 .proc_handler   = proc_dointvec_jiffies,
1761         },
1762         {
1763                 .procname       = "sync_retries",
1764                 .maxlen         = sizeof(int),
1765                 .mode           = 0644,
1766                 .proc_handler   = proc_dointvec_minmax,
1767                 .extra1         = &zero,
1768                 .extra2         = &three,
1769         },
1770         {
1771                 .procname       = "nat_icmp_send",
1772                 .maxlen         = sizeof(int),
1773                 .mode           = 0644,
1774                 .proc_handler   = proc_dointvec,
1775         },
1776         {
1777                 .procname       = "pmtu_disc",
1778                 .maxlen         = sizeof(int),
1779                 .mode           = 0644,
1780                 .proc_handler   = proc_dointvec,
1781         },
1782         {
1783                 .procname       = "backup_only",
1784                 .maxlen         = sizeof(int),
1785                 .mode           = 0644,
1786                 .proc_handler   = proc_dointvec,
1787         },
1788 #ifdef CONFIG_IP_VS_DEBUG
1789         {
1790                 .procname       = "debug_level",
1791                 .data           = &sysctl_ip_vs_debug_level,
1792                 .maxlen         = sizeof(int),
1793                 .mode           = 0644,
1794                 .proc_handler   = proc_dointvec,
1795         },
1796 #endif
1797 #if 0
1798         {
1799                 .procname       = "timeout_established",
1800                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1801                 .maxlen         = sizeof(int),
1802                 .mode           = 0644,
1803                 .proc_handler   = proc_dointvec_jiffies,
1804         },
1805         {
1806                 .procname       = "timeout_synsent",
1807                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1808                 .maxlen         = sizeof(int),
1809                 .mode           = 0644,
1810                 .proc_handler   = proc_dointvec_jiffies,
1811         },
1812         {
1813                 .procname       = "timeout_synrecv",
1814                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1815                 .maxlen         = sizeof(int),
1816                 .mode           = 0644,
1817                 .proc_handler   = proc_dointvec_jiffies,
1818         },
1819         {
1820                 .procname       = "timeout_finwait",
1821                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1822                 .maxlen         = sizeof(int),
1823                 .mode           = 0644,
1824                 .proc_handler   = proc_dointvec_jiffies,
1825         },
1826         {
1827                 .procname       = "timeout_timewait",
1828                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1829                 .maxlen         = sizeof(int),
1830                 .mode           = 0644,
1831                 .proc_handler   = proc_dointvec_jiffies,
1832         },
1833         {
1834                 .procname       = "timeout_close",
1835                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1836                 .maxlen         = sizeof(int),
1837                 .mode           = 0644,
1838                 .proc_handler   = proc_dointvec_jiffies,
1839         },
1840         {
1841                 .procname       = "timeout_closewait",
1842                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1843                 .maxlen         = sizeof(int),
1844                 .mode           = 0644,
1845                 .proc_handler   = proc_dointvec_jiffies,
1846         },
1847         {
1848                 .procname       = "timeout_lastack",
1849                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1850                 .maxlen         = sizeof(int),
1851                 .mode           = 0644,
1852                 .proc_handler   = proc_dointvec_jiffies,
1853         },
1854         {
1855                 .procname       = "timeout_listen",
1856                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1857                 .maxlen         = sizeof(int),
1858                 .mode           = 0644,
1859                 .proc_handler   = proc_dointvec_jiffies,
1860         },
1861         {
1862                 .procname       = "timeout_synack",
1863                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1864                 .maxlen         = sizeof(int),
1865                 .mode           = 0644,
1866                 .proc_handler   = proc_dointvec_jiffies,
1867         },
1868         {
1869                 .procname       = "timeout_udp",
1870                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1871                 .maxlen         = sizeof(int),
1872                 .mode           = 0644,
1873                 .proc_handler   = proc_dointvec_jiffies,
1874         },
1875         {
1876                 .procname       = "timeout_icmp",
1877                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1878                 .maxlen         = sizeof(int),
1879                 .mode           = 0644,
1880                 .proc_handler   = proc_dointvec_jiffies,
1881         },
1882 #endif
1883         { }
1884 };
1885
1886 #endif
1887
1888 #ifdef CONFIG_PROC_FS
1889
1890 struct ip_vs_iter {
1891         struct seq_net_private p;  /* Do not move this, netns depends upon it*/
1892         struct hlist_head *table;
1893         int bucket;
1894 };
1895
1896 /*
1897  *      Write the contents of the VS rule table to a PROCfs file.
1898  *      (It is kept just for backward compatibility)
1899  */
1900 static inline const char *ip_vs_fwd_name(unsigned int flags)
1901 {
1902         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1903         case IP_VS_CONN_F_LOCALNODE:
1904                 return "Local";
1905         case IP_VS_CONN_F_TUNNEL:
1906                 return "Tunnel";
1907         case IP_VS_CONN_F_DROUTE:
1908                 return "Route";
1909         default:
1910                 return "Masq";
1911         }
1912 }
1913
1914
1915 /* Get the Nth entry in the two lists */
1916 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1917 {
1918         struct net *net = seq_file_net(seq);
1919         struct ip_vs_iter *iter = seq->private;
1920         int idx;
1921         struct ip_vs_service *svc;
1922
1923         /* look in hash by protocol */
1924         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1925                 hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[idx], s_list) {
1926                         if (net_eq(svc->net, net) && pos-- == 0) {
1927                                 iter->table = ip_vs_svc_table;
1928                                 iter->bucket = idx;
1929                                 return svc;
1930                         }
1931                 }
1932         }
1933
1934         /* keep looking in fwmark */
1935         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1936                 hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[idx],
1937                                          f_list) {
1938                         if (net_eq(svc->net, net) && pos-- == 0) {
1939                                 iter->table = ip_vs_svc_fwm_table;
1940                                 iter->bucket = idx;
1941                                 return svc;
1942                         }
1943                 }
1944         }
1945
1946         return NULL;
1947 }
1948
1949 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1950         __acquires(RCU)
1951 {
1952         rcu_read_lock();
1953         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1954 }
1955
1956
1957 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1958 {
1959         struct hlist_node *e;
1960         struct ip_vs_iter *iter;
1961         struct ip_vs_service *svc;
1962
1963         ++*pos;
1964         if (v == SEQ_START_TOKEN)
1965                 return ip_vs_info_array(seq,0);
1966
1967         svc = v;
1968         iter = seq->private;
1969
1970         if (iter->table == ip_vs_svc_table) {
1971                 /* next service in table hashed by protocol */
1972                 e = rcu_dereference(hlist_next_rcu(&svc->s_list));
1973                 if (e)
1974                         return hlist_entry(e, struct ip_vs_service, s_list);
1975
1976                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1977                         hlist_for_each_entry_rcu(svc,
1978                                                  &ip_vs_svc_table[iter->bucket],
1979                                                  s_list) {
1980                                 return svc;
1981                         }
1982                 }
1983
1984                 iter->table = ip_vs_svc_fwm_table;
1985                 iter->bucket = -1;
1986                 goto scan_fwmark;
1987         }
1988
1989         /* next service in hashed by fwmark */
1990         e = rcu_dereference(hlist_next_rcu(&svc->f_list));
1991         if (e)
1992                 return hlist_entry(e, struct ip_vs_service, f_list);
1993
1994  scan_fwmark:
1995         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1996                 hlist_for_each_entry_rcu(svc,
1997                                          &ip_vs_svc_fwm_table[iter->bucket],
1998                                          f_list)
1999                         return svc;
2000         }
2001
2002         return NULL;
2003 }
2004
2005 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
2006         __releases(RCU)
2007 {
2008         rcu_read_unlock();
2009 }
2010
2011
2012 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
2013 {
2014         if (v == SEQ_START_TOKEN) {
2015                 seq_printf(seq,
2016                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
2017                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2018                 seq_puts(seq,
2019                          "Prot LocalAddress:Port Scheduler Flags\n");
2020                 seq_puts(seq,
2021                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
2022         } else {
2023                 const struct ip_vs_service *svc = v;
2024                 const struct ip_vs_iter *iter = seq->private;
2025                 const struct ip_vs_dest *dest;
2026                 struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
2027
2028                 if (iter->table == ip_vs_svc_table) {
2029 #ifdef CONFIG_IP_VS_IPV6
2030                         if (svc->af == AF_INET6)
2031                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
2032                                            ip_vs_proto_name(svc->protocol),
2033                                            &svc->addr.in6,
2034                                            ntohs(svc->port),
2035                                            sched->name);
2036                         else
2037 #endif
2038                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
2039                                            ip_vs_proto_name(svc->protocol),
2040                                            ntohl(svc->addr.ip),
2041                                            ntohs(svc->port),
2042                                            sched->name,
2043                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2044                 } else {
2045                         seq_printf(seq, "FWM  %08X %s %s",
2046                                    svc->fwmark, sched->name,
2047                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2048                 }
2049
2050                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2051                         seq_printf(seq, "persistent %d %08X\n",
2052                                 svc->timeout,
2053                                 ntohl(svc->netmask));
2054                 else
2055                         seq_putc(seq, '\n');
2056
2057                 list_for_each_entry_rcu(dest, &svc->destinations, n_list) {
2058 #ifdef CONFIG_IP_VS_IPV6
2059                         if (dest->af == AF_INET6)
2060                                 seq_printf(seq,
2061                                            "  -> [%pI6]:%04X"
2062                                            "      %-7s %-6d %-10d %-10d\n",
2063                                            &dest->addr.in6,
2064                                            ntohs(dest->port),
2065                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2066                                            atomic_read(&dest->weight),
2067                                            atomic_read(&dest->activeconns),
2068                                            atomic_read(&dest->inactconns));
2069                         else
2070 #endif
2071                                 seq_printf(seq,
2072                                            "  -> %08X:%04X      "
2073                                            "%-7s %-6d %-10d %-10d\n",
2074                                            ntohl(dest->addr.ip),
2075                                            ntohs(dest->port),
2076                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2077                                            atomic_read(&dest->weight),
2078                                            atomic_read(&dest->activeconns),
2079                                            atomic_read(&dest->inactconns));
2080
2081                 }
2082         }
2083         return 0;
2084 }
2085
2086 static const struct seq_operations ip_vs_info_seq_ops = {
2087         .start = ip_vs_info_seq_start,
2088         .next  = ip_vs_info_seq_next,
2089         .stop  = ip_vs_info_seq_stop,
2090         .show  = ip_vs_info_seq_show,
2091 };
2092
2093 static int ip_vs_info_open(struct inode *inode, struct file *file)
2094 {
2095         return seq_open_net(inode, file, &ip_vs_info_seq_ops,
2096                         sizeof(struct ip_vs_iter));
2097 }
2098
2099 static const struct file_operations ip_vs_info_fops = {
2100         .owner   = THIS_MODULE,
2101         .open    = ip_vs_info_open,
2102         .read    = seq_read,
2103         .llseek  = seq_lseek,
2104         .release = seq_release_net,
2105 };
2106
2107 static int ip_vs_stats_show(struct seq_file *seq, void *v)
2108 {
2109         struct net *net = seq_file_single_net(seq);
2110         struct ip_vs_stats_user show;
2111
2112 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2113         seq_puts(seq,
2114                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
2115         seq_printf(seq,
2116                    "   Conns  Packets  Packets            Bytes            Bytes\n");
2117
2118         ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2119         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2120                    show.inpkts, show.outpkts,
2121                    (unsigned long long) show.inbytes,
2122                    (unsigned long long) show.outbytes);
2123
2124 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2125         seq_puts(seq,
2126                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2127         seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2128                         show.cps, show.inpps, show.outpps,
2129                         show.inbps, show.outbps);
2130
2131         return 0;
2132 }
2133
2134 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2135 {
2136         return single_open_net(inode, file, ip_vs_stats_show);
2137 }
2138
2139 static const struct file_operations ip_vs_stats_fops = {
2140         .owner = THIS_MODULE,
2141         .open = ip_vs_stats_seq_open,
2142         .read = seq_read,
2143         .llseek = seq_lseek,
2144         .release = single_release_net,
2145 };
2146
2147 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2148 {
2149         struct net *net = seq_file_single_net(seq);
2150         struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2151         struct ip_vs_cpu_stats __percpu *cpustats = tot_stats->cpustats;
2152         struct ip_vs_stats_user rates;
2153         int i;
2154
2155 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2156         seq_puts(seq,
2157                  "       Total Incoming Outgoing         Incoming         Outgoing\n");
2158         seq_printf(seq,
2159                    "CPU    Conns  Packets  Packets            Bytes            Bytes\n");
2160
2161         for_each_possible_cpu(i) {
2162                 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2163                 unsigned int start;
2164                 __u64 inbytes, outbytes;
2165
2166                 do {
2167                         start = u64_stats_fetch_begin_bh(&u->syncp);
2168                         inbytes = u->ustats.inbytes;
2169                         outbytes = u->ustats.outbytes;
2170                 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2171
2172                 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2173                            i, u->ustats.conns, u->ustats.inpkts,
2174                            u->ustats.outpkts, (__u64)inbytes,
2175                            (__u64)outbytes);
2176         }
2177
2178         spin_lock_bh(&tot_stats->lock);
2179
2180         seq_printf(seq, "  ~ %8X %8X %8X %16LX %16LX\n\n",
2181                    tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2182                    tot_stats->ustats.outpkts,
2183                    (unsigned long long) tot_stats->ustats.inbytes,
2184                    (unsigned long long) tot_stats->ustats.outbytes);
2185
2186         ip_vs_read_estimator(&rates, tot_stats);
2187
2188         spin_unlock_bh(&tot_stats->lock);
2189
2190 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2191         seq_puts(seq,
2192                    "     Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2193         seq_printf(seq, "    %8X %8X %8X %16X %16X\n",
2194                         rates.cps,
2195                         rates.inpps,
2196                         rates.outpps,
2197                         rates.inbps,
2198                         rates.outbps);
2199
2200         return 0;
2201 }
2202
2203 static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2204 {
2205         return single_open_net(inode, file, ip_vs_stats_percpu_show);
2206 }
2207
2208 static const struct file_operations ip_vs_stats_percpu_fops = {
2209         .owner = THIS_MODULE,
2210         .open = ip_vs_stats_percpu_seq_open,
2211         .read = seq_read,
2212         .llseek = seq_lseek,
2213         .release = single_release_net,
2214 };
2215 #endif
2216
2217 /*
2218  *      Set timeout values for tcp tcpfin udp in the timeout_table.
2219  */
2220 static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
2221 {
2222 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2223         struct ip_vs_proto_data *pd;
2224 #endif
2225
2226         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2227                   u->tcp_timeout,
2228                   u->tcp_fin_timeout,
2229                   u->udp_timeout);
2230
2231 #ifdef CONFIG_IP_VS_PROTO_TCP
2232         if (u->tcp_timeout) {
2233                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2234                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2235                         = u->tcp_timeout * HZ;
2236         }
2237
2238         if (u->tcp_fin_timeout) {
2239                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2240                 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2241                         = u->tcp_fin_timeout * HZ;
2242         }
2243 #endif
2244
2245 #ifdef CONFIG_IP_VS_PROTO_UDP
2246         if (u->udp_timeout) {
2247                 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2248                 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2249                         = u->udp_timeout * HZ;
2250         }
2251 #endif
2252         return 0;
2253 }
2254
2255
2256 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2257 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2258 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2259                                  sizeof(struct ip_vs_dest_user))
2260 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2261 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2262 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2263
2264 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2265         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2266         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2267         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2268         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2269         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2270         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2271         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2272         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2273         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2274         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2275         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2276 };
2277
2278 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2279                                   struct ip_vs_service_user *usvc_compat)
2280 {
2281         memset(usvc, 0, sizeof(*usvc));
2282
2283         usvc->af                = AF_INET;
2284         usvc->protocol          = usvc_compat->protocol;
2285         usvc->addr.ip           = usvc_compat->addr;
2286         usvc->port              = usvc_compat->port;
2287         usvc->fwmark            = usvc_compat->fwmark;
2288
2289         /* Deep copy of sched_name is not needed here */
2290         usvc->sched_name        = usvc_compat->sched_name;
2291
2292         usvc->flags             = usvc_compat->flags;
2293         usvc->timeout           = usvc_compat->timeout;
2294         usvc->netmask           = usvc_compat->netmask;
2295 }
2296
2297 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2298                                    struct ip_vs_dest_user *udest_compat)
2299 {
2300         memset(udest, 0, sizeof(*udest));
2301
2302         udest->addr.ip          = udest_compat->addr;
2303         udest->port             = udest_compat->port;
2304         udest->conn_flags       = udest_compat->conn_flags;
2305         udest->weight           = udest_compat->weight;
2306         udest->u_threshold      = udest_compat->u_threshold;
2307         udest->l_threshold      = udest_compat->l_threshold;
2308 }
2309
2310 static int
2311 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2312 {
2313         struct net *net = sock_net(sk);
2314         int ret;
2315         unsigned char arg[MAX_ARG_LEN];
2316         struct ip_vs_service_user *usvc_compat;
2317         struct ip_vs_service_user_kern usvc;
2318         struct ip_vs_service *svc;
2319         struct ip_vs_dest_user *udest_compat;
2320         struct ip_vs_dest_user_kern udest;
2321         struct netns_ipvs *ipvs = net_ipvs(net);
2322
2323         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2324                 return -EPERM;
2325
2326         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2327                 return -EINVAL;
2328         if (len < 0 || len >  MAX_ARG_LEN)
2329                 return -EINVAL;
2330         if (len != set_arglen[SET_CMDID(cmd)]) {
2331                 pr_err("set_ctl: len %u != %u\n",
2332                        len, set_arglen[SET_CMDID(cmd)]);
2333                 return -EINVAL;
2334         }
2335
2336         if (copy_from_user(arg, user, len) != 0)
2337                 return -EFAULT;
2338
2339         /* increase the module use count */
2340         ip_vs_use_count_inc();
2341
2342         /* Handle daemons since they have another lock */
2343         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2344             cmd == IP_VS_SO_SET_STOPDAEMON) {
2345                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2346
2347                 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2348                         ret = -ERESTARTSYS;
2349                         goto out_dec;
2350                 }
2351                 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2352                         ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2353                                                 dm->syncid);
2354                 else
2355                         ret = stop_sync_thread(net, dm->state);
2356                 mutex_unlock(&ipvs->sync_mutex);
2357                 goto out_dec;
2358         }
2359
2360         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2361                 ret = -ERESTARTSYS;
2362                 goto out_dec;
2363         }
2364
2365         if (cmd == IP_VS_SO_SET_FLUSH) {
2366                 /* Flush the virtual service */
2367                 ret = ip_vs_flush(net, false);
2368                 goto out_unlock;
2369         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2370                 /* Set timeout values for (tcp tcpfin udp) */
2371                 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
2372                 goto out_unlock;
2373         }
2374
2375         usvc_compat = (struct ip_vs_service_user *)arg;
2376         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2377
2378         /* We only use the new structs internally, so copy userspace compat
2379          * structs to extended internal versions */
2380         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2381         ip_vs_copy_udest_compat(&udest, udest_compat);
2382
2383         if (cmd == IP_VS_SO_SET_ZERO) {
2384                 /* if no service address is set, zero counters in all */
2385                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2386                         ret = ip_vs_zero_all(net);
2387                         goto out_unlock;
2388                 }
2389         }
2390
2391         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2392         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2393             usvc.protocol != IPPROTO_SCTP) {
2394                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2395                        usvc.protocol, &usvc.addr.ip,
2396                        ntohs(usvc.port), usvc.sched_name);
2397                 ret = -EFAULT;
2398                 goto out_unlock;
2399         }
2400
2401         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2402         rcu_read_lock();
2403         if (usvc.fwmark == 0)
2404                 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
2405                                            &usvc.addr, usvc.port);
2406         else
2407                 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
2408         rcu_read_unlock();
2409
2410         if (cmd != IP_VS_SO_SET_ADD
2411             && (svc == NULL || svc->protocol != usvc.protocol)) {
2412                 ret = -ESRCH;
2413                 goto out_unlock;
2414         }
2415
2416         switch (cmd) {
2417         case IP_VS_SO_SET_ADD:
2418                 if (svc != NULL)
2419                         ret = -EEXIST;
2420                 else
2421                         ret = ip_vs_add_service(net, &usvc, &svc);
2422                 break;
2423         case IP_VS_SO_SET_EDIT:
2424                 ret = ip_vs_edit_service(svc, &usvc);
2425                 break;
2426         case IP_VS_SO_SET_DEL:
2427                 ret = ip_vs_del_service(svc);
2428                 if (!ret)
2429                         goto out_unlock;
2430                 break;
2431         case IP_VS_SO_SET_ZERO:
2432                 ret = ip_vs_zero_service(svc);
2433                 break;
2434         case IP_VS_SO_SET_ADDDEST:
2435                 ret = ip_vs_add_dest(svc, &udest);
2436                 break;
2437         case IP_VS_SO_SET_EDITDEST:
2438                 ret = ip_vs_edit_dest(svc, &udest);
2439                 break;
2440         case IP_VS_SO_SET_DELDEST:
2441                 ret = ip_vs_del_dest(svc, &udest);
2442                 break;
2443         default:
2444                 ret = -EINVAL;
2445         }
2446
2447   out_unlock:
2448         mutex_unlock(&__ip_vs_mutex);
2449   out_dec:
2450         /* decrease the module use count */
2451         ip_vs_use_count_dec();
2452
2453         return ret;
2454 }
2455
2456
2457 static void
2458 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2459 {
2460         struct ip_vs_scheduler *sched;
2461
2462         sched = rcu_dereference_protected(src->scheduler, 1);
2463         dst->protocol = src->protocol;
2464         dst->addr = src->addr.ip;
2465         dst->port = src->port;
2466         dst->fwmark = src->fwmark;
2467         strlcpy(dst->sched_name, sched->name, sizeof(dst->sched_name));
2468         dst->flags = src->flags;
2469         dst->timeout = src->timeout / HZ;
2470         dst->netmask = src->netmask;
2471         dst->num_dests = src->num_dests;
2472         ip_vs_copy_stats(&dst->stats, &src->stats);
2473 }
2474
2475 static inline int
2476 __ip_vs_get_service_entries(struct net *net,
2477                             const struct ip_vs_get_services *get,
2478                             struct ip_vs_get_services __user *uptr)
2479 {
2480         int idx, count=0;
2481         struct ip_vs_service *svc;
2482         struct ip_vs_service_entry entry;
2483         int ret = 0;
2484
2485         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2486                 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2487                         /* Only expose IPv4 entries to old interface */
2488                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2489                                 continue;
2490
2491                         if (count >= get->num_services)
2492                                 goto out;
2493                         memset(&entry, 0, sizeof(entry));
2494                         ip_vs_copy_service(&entry, svc);
2495                         if (copy_to_user(&uptr->entrytable[count],
2496                                          &entry, sizeof(entry))) {
2497                                 ret = -EFAULT;
2498                                 goto out;
2499                         }
2500                         count++;
2501                 }
2502         }
2503
2504         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2505                 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2506                         /* Only expose IPv4 entries to old interface */
2507                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2508                                 continue;
2509
2510                         if (count >= get->num_services)
2511                                 goto out;
2512                         memset(&entry, 0, sizeof(entry));
2513                         ip_vs_copy_service(&entry, svc);
2514                         if (copy_to_user(&uptr->entrytable[count],
2515                                          &entry, sizeof(entry))) {
2516                                 ret = -EFAULT;
2517                                 goto out;
2518                         }
2519                         count++;
2520                 }
2521         }
2522 out:
2523         return ret;
2524 }
2525
2526 static inline int
2527 __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
2528                          struct ip_vs_get_dests __user *uptr)
2529 {
2530         struct ip_vs_service *svc;
2531         union nf_inet_addr addr = { .ip = get->addr };
2532         int ret = 0;
2533
2534         rcu_read_lock();
2535         if (get->fwmark)
2536                 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
2537         else
2538                 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
2539                                            get->port);
2540         rcu_read_unlock();
2541
2542         if (svc) {
2543                 int count = 0;
2544                 struct ip_vs_dest *dest;
2545                 struct ip_vs_dest_entry entry;
2546
2547                 memset(&entry, 0, sizeof(entry));
2548                 list_for_each_entry(dest, &svc->destinations, n_list) {
2549                         if (count >= get->num_dests)
2550                                 break;
2551
2552                         entry.addr = dest->addr.ip;
2553                         entry.port = dest->port;
2554                         entry.conn_flags = atomic_read(&dest->conn_flags);
2555                         entry.weight = atomic_read(&dest->weight);
2556                         entry.u_threshold = dest->u_threshold;
2557                         entry.l_threshold = dest->l_threshold;
2558                         entry.activeconns = atomic_read(&dest->activeconns);
2559                         entry.inactconns = atomic_read(&dest->inactconns);
2560                         entry.persistconns = atomic_read(&dest->persistconns);
2561                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2562                         if (copy_to_user(&uptr->entrytable[count],
2563                                          &entry, sizeof(entry))) {
2564                                 ret = -EFAULT;
2565                                 break;
2566                         }
2567                         count++;
2568                 }
2569         } else
2570                 ret = -ESRCH;
2571         return ret;
2572 }
2573
2574 static inline void
2575 __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
2576 {
2577 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2578         struct ip_vs_proto_data *pd;
2579 #endif
2580
2581         memset(u, 0, sizeof (*u));
2582
2583 #ifdef CONFIG_IP_VS_PROTO_TCP
2584         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2585         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2586         u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2587 #endif
2588 #ifdef CONFIG_IP_VS_PROTO_UDP
2589         pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2590         u->udp_timeout =
2591                         pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2592 #endif
2593 }
2594
2595
2596 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2597 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2598 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2599 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2600 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2601 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2602 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2603
2604 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2605         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2606         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2607         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2608         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2609         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2610         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2611         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2612 };
2613
2614 static int
2615 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2616 {
2617         unsigned char arg[128];
2618         int ret = 0;
2619         unsigned int copylen;
2620         struct net *net = sock_net(sk);
2621         struct netns_ipvs *ipvs = net_ipvs(net);
2622
2623         BUG_ON(!net);
2624         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2625                 return -EPERM;
2626
2627         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2628                 return -EINVAL;
2629
2630         if (*len < get_arglen[GET_CMDID(cmd)]) {
2631                 pr_err("get_ctl: len %u < %u\n",
2632                        *len, get_arglen[GET_CMDID(cmd)]);
2633                 return -EINVAL;
2634         }
2635
2636         copylen = get_arglen[GET_CMDID(cmd)];
2637         if (copylen > 128)
2638                 return -EINVAL;
2639
2640         if (copy_from_user(arg, user, copylen) != 0)
2641                 return -EFAULT;
2642         /*
2643          * Handle daemons first since it has its own locking
2644          */
2645         if (cmd == IP_VS_SO_GET_DAEMON) {
2646                 struct ip_vs_daemon_user d[2];
2647
2648                 memset(&d, 0, sizeof(d));
2649                 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2650                         return -ERESTARTSYS;
2651
2652                 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2653                         d[0].state = IP_VS_STATE_MASTER;
2654                         strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2655                                 sizeof(d[0].mcast_ifn));
2656                         d[0].syncid = ipvs->master_syncid;
2657                 }
2658                 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2659                         d[1].state = IP_VS_STATE_BACKUP;
2660                         strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2661                                 sizeof(d[1].mcast_ifn));
2662                         d[1].syncid = ipvs->backup_syncid;
2663                 }
2664                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2665                         ret = -EFAULT;
2666                 mutex_unlock(&ipvs->sync_mutex);
2667                 return ret;
2668         }
2669
2670         if (mutex_lock_interruptible(&__ip_vs_mutex))
2671                 return -ERESTARTSYS;
2672
2673         switch (cmd) {
2674         case IP_VS_SO_GET_VERSION:
2675         {
2676                 char buf[64];
2677
2678                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2679                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2680                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2681                         ret = -EFAULT;
2682                         goto out;
2683                 }
2684                 *len = strlen(buf)+1;
2685         }
2686         break;
2687
2688         case IP_VS_SO_GET_INFO:
2689         {
2690                 struct ip_vs_getinfo info;
2691                 info.version = IP_VS_VERSION_CODE;
2692                 info.size = ip_vs_conn_tab_size;
2693                 info.num_services = ipvs->num_services;
2694                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2695                         ret = -EFAULT;
2696         }
2697         break;
2698
2699         case IP_VS_SO_GET_SERVICES:
2700         {
2701                 struct ip_vs_get_services *get;
2702                 int size;
2703
2704                 get = (struct ip_vs_get_services *)arg;
2705                 size = sizeof(*get) +
2706                         sizeof(struct ip_vs_service_entry) * get->num_services;
2707                 if (*len != size) {
2708                         pr_err("length: %u != %u\n", *len, size);
2709                         ret = -EINVAL;
2710                         goto out;
2711                 }
2712                 ret = __ip_vs_get_service_entries(net, get, user);
2713         }
2714         break;
2715
2716         case IP_VS_SO_GET_SERVICE:
2717         {
2718                 struct ip_vs_service_entry *entry;
2719                 struct ip_vs_service *svc;
2720                 union nf_inet_addr addr;
2721
2722                 entry = (struct ip_vs_service_entry *)arg;
2723                 addr.ip = entry->addr;
2724                 rcu_read_lock();
2725                 if (entry->fwmark)
2726                         svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
2727                 else
2728                         svc = __ip_vs_service_find(net, AF_INET,
2729                                                    entry->protocol, &addr,
2730                                                    entry->port);
2731                 rcu_read_unlock();
2732                 if (svc) {
2733                         ip_vs_copy_service(entry, svc);
2734                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2735                                 ret = -EFAULT;
2736                 } else
2737                         ret = -ESRCH;
2738         }
2739         break;
2740
2741         case IP_VS_SO_GET_DESTS:
2742         {
2743                 struct ip_vs_get_dests *get;
2744                 int size;
2745
2746                 get = (struct ip_vs_get_dests *)arg;
2747                 size = sizeof(*get) +
2748                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2749                 if (*len != size) {
2750                         pr_err("length: %u != %u\n", *len, size);
2751                         ret = -EINVAL;
2752                         goto out;
2753                 }
2754                 ret = __ip_vs_get_dest_entries(net, get, user);
2755         }
2756         break;
2757
2758         case IP_VS_SO_GET_TIMEOUT:
2759         {
2760                 struct ip_vs_timeout_user t;
2761
2762                 __ip_vs_get_timeouts(net, &t);
2763                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2764                         ret = -EFAULT;
2765         }
2766         break;
2767
2768         default:
2769                 ret = -EINVAL;
2770         }
2771
2772 out:
2773         mutex_unlock(&__ip_vs_mutex);
2774         return ret;
2775 }
2776
2777
2778 static struct nf_sockopt_ops ip_vs_sockopts = {
2779         .pf             = PF_INET,
2780         .set_optmin     = IP_VS_BASE_CTL,
2781         .set_optmax     = IP_VS_SO_SET_MAX+1,
2782         .set            = do_ip_vs_set_ctl,
2783         .get_optmin     = IP_VS_BASE_CTL,
2784         .get_optmax     = IP_VS_SO_GET_MAX+1,
2785         .get            = do_ip_vs_get_ctl,
2786         .owner          = THIS_MODULE,
2787 };
2788
2789 /*
2790  * Generic Netlink interface
2791  */
2792
2793 /* IPVS genetlink family */
2794 static struct genl_family ip_vs_genl_family = {
2795         .id             = GENL_ID_GENERATE,
2796         .hdrsize        = 0,
2797         .name           = IPVS_GENL_NAME,
2798         .version        = IPVS_GENL_VERSION,
2799         .maxattr        = IPVS_CMD_MAX,
2800         .netnsok        = true,         /* Make ipvsadm to work on netns */
2801 };
2802
2803 /* Policy used for first-level command attributes */
2804 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2805         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2806         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2807         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2808         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2809         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2810         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2811 };
2812
2813 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2814 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2815         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2816         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2817                                             .len = IP_VS_IFNAME_MAXLEN },
2818         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2819 };
2820
2821 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2822 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2823         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2824         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2825         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2826                                             .len = sizeof(union nf_inet_addr) },
2827         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2828         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2829         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2830                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2831         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
2832                                             .len = IP_VS_PENAME_MAXLEN },
2833         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2834                                             .len = sizeof(struct ip_vs_flags) },
2835         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2836         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2837         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2838 };
2839
2840 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2841 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2842         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2843                                             .len = sizeof(union nf_inet_addr) },
2844         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2845         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2846         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2847         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2848         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2849         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2850         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2851         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2852         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2853 };
2854
2855 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2856                                  struct ip_vs_stats *stats)
2857 {
2858         struct ip_vs_stats_user ustats;
2859         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2860         if (!nl_stats)
2861                 return -EMSGSIZE;
2862
2863         ip_vs_copy_stats(&ustats, stats);
2864
2865         if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns) ||
2866             nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts) ||
2867             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts) ||
2868             nla_put_u64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes) ||
2869             nla_put_u64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes) ||
2870             nla_put_u32(skb, IPVS_STATS_ATTR_CPS, ustats.cps) ||
2871             nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps) ||
2872             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps) ||
2873             nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps) ||
2874             nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps))
2875                 goto nla_put_failure;
2876         nla_nest_end(skb, nl_stats);
2877
2878         return 0;
2879
2880 nla_put_failure:
2881         nla_nest_cancel(skb, nl_stats);
2882         return -EMSGSIZE;
2883 }
2884
2885 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2886                                    struct ip_vs_service *svc)
2887 {
2888         struct ip_vs_scheduler *sched;
2889         struct ip_vs_pe *pe;
2890         struct nlattr *nl_service;
2891         struct ip_vs_flags flags = { .flags = svc->flags,
2892                                      .mask = ~0 };
2893
2894         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2895         if (!nl_service)
2896                 return -EMSGSIZE;
2897
2898         if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
2899                 goto nla_put_failure;
2900         if (svc->fwmark) {
2901                 if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
2902                         goto nla_put_failure;
2903         } else {
2904                 if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
2905                     nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
2906                     nla_put_be16(skb, IPVS_SVC_ATTR_PORT, svc->port))
2907                         goto nla_put_failure;
2908         }
2909
2910         sched = rcu_dereference_protected(svc->scheduler, 1);
2911         pe = rcu_dereference_protected(svc->pe, 1);
2912         if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched->name) ||
2913             (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
2914             nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
2915             nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
2916             nla_put_be32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
2917                 goto nla_put_failure;
2918         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2919                 goto nla_put_failure;
2920
2921         nla_nest_end(skb, nl_service);
2922
2923         return 0;
2924
2925 nla_put_failure:
2926         nla_nest_cancel(skb, nl_service);
2927         return -EMSGSIZE;
2928 }
2929
2930 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2931                                    struct ip_vs_service *svc,
2932                                    struct netlink_callback *cb)
2933 {
2934         void *hdr;
2935
2936         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
2937                           &ip_vs_genl_family, NLM_F_MULTI,
2938                           IPVS_CMD_NEW_SERVICE);
2939         if (!hdr)
2940                 return -EMSGSIZE;
2941
2942         if (ip_vs_genl_fill_service(skb, svc) < 0)
2943                 goto nla_put_failure;
2944
2945         return genlmsg_end(skb, hdr);
2946
2947 nla_put_failure:
2948         genlmsg_cancel(skb, hdr);
2949         return -EMSGSIZE;
2950 }
2951
2952 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2953                                     struct netlink_callback *cb)
2954 {
2955         int idx = 0, i;
2956         int start = cb->args[0];
2957         struct ip_vs_service *svc;
2958         struct net *net = skb_sknet(skb);
2959
2960         mutex_lock(&__ip_vs_mutex);
2961         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2962                 hlist_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2963                         if (++idx <= start || !net_eq(svc->net, net))
2964                                 continue;
2965                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2966                                 idx--;
2967                                 goto nla_put_failure;
2968                         }
2969                 }
2970         }
2971
2972         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2973                 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2974                         if (++idx <= start || !net_eq(svc->net, net))
2975                                 continue;
2976                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2977                                 idx--;
2978                                 goto nla_put_failure;
2979                         }
2980                 }
2981         }
2982
2983 nla_put_failure:
2984         mutex_unlock(&__ip_vs_mutex);
2985         cb->args[0] = idx;
2986
2987         return skb->len;
2988 }
2989
2990 static int ip_vs_genl_parse_service(struct net *net,
2991                                     struct ip_vs_service_user_kern *usvc,
2992                                     struct nlattr *nla, int full_entry,
2993                                     struct ip_vs_service **ret_svc)
2994 {
2995         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2996         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2997         struct ip_vs_service *svc;
2998
2999         /* Parse mandatory identifying service fields first */
3000         if (nla == NULL ||
3001             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
3002                 return -EINVAL;
3003
3004         nla_af          = attrs[IPVS_SVC_ATTR_AF];
3005         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
3006         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
3007         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
3008         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
3009
3010         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
3011                 return -EINVAL;
3012
3013         memset(usvc, 0, sizeof(*usvc));
3014
3015         usvc->af = nla_get_u16(nla_af);
3016 #ifdef CONFIG_IP_VS_IPV6
3017         if (usvc->af != AF_INET && usvc->af != AF_INET6)
3018 #else
3019         if (usvc->af != AF_INET)
3020 #endif
3021                 return -EAFNOSUPPORT;
3022
3023         if (nla_fwmark) {
3024                 usvc->protocol = IPPROTO_TCP;
3025                 usvc->fwmark = nla_get_u32(nla_fwmark);
3026         } else {
3027                 usvc->protocol = nla_get_u16(nla_protocol);
3028                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
3029                 usvc->port = nla_get_be16(nla_port);
3030                 usvc->fwmark = 0;
3031         }
3032
3033         rcu_read_lock();
3034         if (usvc->fwmark)
3035                 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
3036         else
3037                 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
3038                                            &usvc->addr, usvc->port);
3039         rcu_read_unlock();
3040         *ret_svc = svc;
3041
3042         /* If a full entry was requested, check for the additional fields */
3043         if (full_entry) {
3044                 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
3045                               *nla_netmask;
3046                 struct ip_vs_flags flags;
3047
3048                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
3049                 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
3050                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
3051                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
3052                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
3053
3054                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3055                         return -EINVAL;
3056
3057                 nla_memcpy(&flags, nla_flags, sizeof(flags));
3058
3059                 /* prefill flags from service if it already exists */
3060                 if (svc)
3061                         usvc->flags = svc->flags;
3062
3063                 /* set new flags from userland */
3064                 usvc->flags = (usvc->flags & ~flags.mask) |
3065                               (flags.flags & flags.mask);
3066                 usvc->sched_name = nla_data(nla_sched);
3067                 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3068                 usvc->timeout = nla_get_u32(nla_timeout);
3069                 usvc->netmask = nla_get_be32(nla_netmask);
3070         }
3071
3072         return 0;
3073 }
3074
3075 static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3076                                                      struct nlattr *nla)
3077 {
3078         struct ip_vs_service_user_kern usvc;
3079         struct ip_vs_service *svc;
3080         int ret;
3081
3082         ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
3083         return ret ? ERR_PTR(ret) : svc;
3084 }
3085
3086 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3087 {
3088         struct nlattr *nl_dest;
3089
3090         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3091         if (!nl_dest)
3092                 return -EMSGSIZE;
3093
3094         if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
3095             nla_put_be16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
3096             nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3097                         (atomic_read(&dest->conn_flags) &
3098                          IP_VS_CONN_F_FWD_MASK)) ||
3099             nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
3100                         atomic_read(&dest->weight)) ||
3101             nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
3102             nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
3103             nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3104                         atomic_read(&dest->activeconns)) ||
3105             nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3106                         atomic_read(&dest->inactconns)) ||
3107             nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3108                         atomic_read(&dest->persistconns)))
3109                 goto nla_put_failure;
3110         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3111                 goto nla_put_failure;
3112
3113         nla_nest_end(skb, nl_dest);
3114
3115         return 0;
3116
3117 nla_put_failure:
3118         nla_nest_cancel(skb, nl_dest);
3119         return -EMSGSIZE;
3120 }
3121
3122 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3123                                 struct netlink_callback *cb)
3124 {
3125         void *hdr;
3126
3127         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3128                           &ip_vs_genl_family, NLM_F_MULTI,
3129                           IPVS_CMD_NEW_DEST);
3130         if (!hdr)
3131                 return -EMSGSIZE;
3132
3133         if (ip_vs_genl_fill_dest(skb, dest) < 0)
3134                 goto nla_put_failure;
3135
3136         return genlmsg_end(skb, hdr);
3137
3138 nla_put_failure:
3139         genlmsg_cancel(skb, hdr);
3140         return -EMSGSIZE;
3141 }
3142
3143 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3144                                  struct netlink_callback *cb)
3145 {
3146         int idx = 0;
3147         int start = cb->args[0];
3148         struct ip_vs_service *svc;
3149         struct ip_vs_dest *dest;
3150         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3151         struct net *net = skb_sknet(skb);
3152
3153         mutex_lock(&__ip_vs_mutex);
3154
3155         /* Try to find the service for which to dump destinations */
3156         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3157                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3158                 goto out_err;
3159
3160
3161         svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
3162         if (IS_ERR(svc) || svc == NULL)
3163                 goto out_err;
3164
3165         /* Dump the destinations */
3166         list_for_each_entry(dest, &svc->destinations, n_list) {
3167                 if (++idx <= start)
3168                         continue;
3169                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3170                         idx--;
3171                         goto nla_put_failure;
3172                 }
3173         }
3174
3175 nla_put_failure:
3176         cb->args[0] = idx;
3177
3178 out_err:
3179         mutex_unlock(&__ip_vs_mutex);
3180
3181         return skb->len;
3182 }
3183
3184 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3185                                  struct nlattr *nla, int full_entry)
3186 {
3187         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3188         struct nlattr *nla_addr, *nla_port;
3189
3190         /* Parse mandatory identifying destination fields first */
3191         if (nla == NULL ||
3192             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3193                 return -EINVAL;
3194
3195         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
3196         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
3197
3198         if (!(nla_addr && nla_port))
3199                 return -EINVAL;
3200
3201         memset(udest, 0, sizeof(*udest));
3202
3203         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3204         udest->port = nla_get_be16(nla_port);
3205
3206         /* If a full entry was requested, check for the additional fields */
3207         if (full_entry) {
3208                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3209                               *nla_l_thresh;
3210
3211                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3212                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
3213                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
3214                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
3215
3216                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3217                         return -EINVAL;
3218
3219                 udest->conn_flags = nla_get_u32(nla_fwd)
3220                                     & IP_VS_CONN_F_FWD_MASK;
3221                 udest->weight = nla_get_u32(nla_weight);
3222                 udest->u_threshold = nla_get_u32(nla_u_thresh);
3223                 udest->l_threshold = nla_get_u32(nla_l_thresh);
3224         }
3225
3226         return 0;
3227 }
3228
3229 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __u32 state,
3230                                   const char *mcast_ifn, __u32 syncid)
3231 {
3232         struct nlattr *nl_daemon;
3233
3234         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3235         if (!nl_daemon)
3236                 return -EMSGSIZE;
3237
3238         if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
3239             nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn) ||
3240             nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid))
3241                 goto nla_put_failure;
3242         nla_nest_end(skb, nl_daemon);
3243
3244         return 0;
3245
3246 nla_put_failure:
3247         nla_nest_cancel(skb, nl_daemon);
3248         return -EMSGSIZE;
3249 }
3250
3251 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __u32 state,
3252                                   const char *mcast_ifn, __u32 syncid,
3253                                   struct netlink_callback *cb)
3254 {
3255         void *hdr;
3256         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3257                           &ip_vs_genl_family, NLM_F_MULTI,
3258                           IPVS_CMD_NEW_DAEMON);
3259         if (!hdr)
3260                 return -EMSGSIZE;
3261
3262         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3263                 goto nla_put_failure;
3264
3265         return genlmsg_end(skb, hdr);
3266
3267 nla_put_failure:
3268         genlmsg_cancel(skb, hdr);
3269         return -EMSGSIZE;
3270 }
3271
3272 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3273                                    struct netlink_callback *cb)
3274 {
3275         struct net *net = skb_sknet(skb);
3276         struct netns_ipvs *ipvs = net_ipvs(net);
3277
3278         mutex_lock(&ipvs->sync_mutex);
3279         if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3280                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3281                                            ipvs->master_mcast_ifn,
3282                                            ipvs->master_syncid, cb) < 0)
3283                         goto nla_put_failure;
3284
3285                 cb->args[0] = 1;
3286         }
3287
3288         if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3289                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3290                                            ipvs->backup_mcast_ifn,
3291                                            ipvs->backup_syncid, cb) < 0)
3292                         goto nla_put_failure;
3293
3294                 cb->args[1] = 1;
3295         }
3296
3297 nla_put_failure:
3298         mutex_unlock(&ipvs->sync_mutex);
3299
3300         return skb->len;
3301 }
3302
3303 static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
3304 {
3305         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3306               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3307               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3308                 return -EINVAL;
3309
3310         return start_sync_thread(net,
3311                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3312                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3313                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3314 }
3315
3316 static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
3317 {
3318         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3319                 return -EINVAL;
3320
3321         return stop_sync_thread(net,
3322                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3323 }
3324
3325 static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
3326 {
3327         struct ip_vs_timeout_user t;
3328
3329         __ip_vs_get_timeouts(net, &t);
3330
3331         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3332                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3333
3334         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3335                 t.tcp_fin_timeout =
3336                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3337
3338         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3339                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3340
3341         return ip_vs_set_timeout(net, &t);
3342 }
3343
3344 static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3345 {
3346         int ret = 0, cmd;
3347         struct net *net;
3348         struct netns_ipvs *ipvs;
3349
3350         net = skb_sknet(skb);
3351         ipvs = net_ipvs(net);
3352         cmd = info->genlhdr->cmd;
3353
3354         if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3355                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3356
3357                 mutex_lock(&ipvs->sync_mutex);
3358                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3359                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3360                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3361                                      ip_vs_daemon_policy)) {
3362                         ret = -EINVAL;
3363                         goto out;
3364                 }
3365
3366                 if (cmd == IPVS_CMD_NEW_DAEMON)
3367                         ret = ip_vs_genl_new_daemon(net, daemon_attrs);
3368                 else
3369                         ret = ip_vs_genl_del_daemon(net, daemon_attrs);
3370 out:
3371                 mutex_unlock(&ipvs->sync_mutex);
3372         }
3373         return ret;
3374 }
3375
3376 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3377 {
3378         struct ip_vs_service *svc = NULL;
3379         struct ip_vs_service_user_kern usvc;
3380         struct ip_vs_dest_user_kern udest;
3381         int ret = 0, cmd;
3382         int need_full_svc = 0, need_full_dest = 0;
3383         struct net *net;
3384
3385         net = skb_sknet(skb);
3386         cmd = info->genlhdr->cmd;
3387
3388         mutex_lock(&__ip_vs_mutex);
3389
3390         if (cmd == IPVS_CMD_FLUSH) {
3391                 ret = ip_vs_flush(net, false);
3392                 goto out;
3393         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3394                 ret = ip_vs_genl_set_config(net, info->attrs);
3395                 goto out;
3396         } else if (cmd == IPVS_CMD_ZERO &&
3397                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3398                 ret = ip_vs_zero_all(net);
3399                 goto out;
3400         }
3401
3402         /* All following commands require a service argument, so check if we
3403          * received a valid one. We need a full service specification when
3404          * adding / editing a service. Only identifying members otherwise. */
3405         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3406                 need_full_svc = 1;
3407
3408         ret = ip_vs_genl_parse_service(net, &usvc,
3409                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3410                                        need_full_svc, &svc);
3411         if (ret)
3412                 goto out;
3413
3414         /* Unless we're adding a new service, the service must already exist */
3415         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3416                 ret = -ESRCH;
3417                 goto out;
3418         }
3419
3420         /* Destination commands require a valid destination argument. For
3421          * adding / editing a destination, we need a full destination
3422          * specification. */
3423         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3424             cmd == IPVS_CMD_DEL_DEST) {
3425                 if (cmd != IPVS_CMD_DEL_DEST)
3426                         need_full_dest = 1;
3427
3428                 ret = ip_vs_genl_parse_dest(&udest,
3429                                             info->attrs[IPVS_CMD_ATTR_DEST],
3430                                             need_full_dest);
3431                 if (ret)
3432                         goto out;
3433         }
3434
3435         switch (cmd) {
3436         case IPVS_CMD_NEW_SERVICE:
3437                 if (svc == NULL)
3438                         ret = ip_vs_add_service(net, &usvc, &svc);
3439                 else
3440                         ret = -EEXIST;
3441                 break;
3442         case IPVS_CMD_SET_SERVICE:
3443                 ret = ip_vs_edit_service(svc, &usvc);
3444                 break;
3445         case IPVS_CMD_DEL_SERVICE:
3446                 ret = ip_vs_del_service(svc);
3447                 /* do not use svc, it can be freed */
3448                 break;
3449         case IPVS_CMD_NEW_DEST:
3450                 ret = ip_vs_add_dest(svc, &udest);
3451                 break;
3452         case IPVS_CMD_SET_DEST:
3453                 ret = ip_vs_edit_dest(svc, &udest);
3454                 break;
3455         case IPVS_CMD_DEL_DEST:
3456                 ret = ip_vs_del_dest(svc, &udest);
3457                 break;
3458         case IPVS_CMD_ZERO:
3459                 ret = ip_vs_zero_service(svc);
3460                 break;
3461         default:
3462                 ret = -EINVAL;
3463         }
3464
3465 out:
3466         mutex_unlock(&__ip_vs_mutex);
3467
3468         return ret;
3469 }
3470
3471 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3472 {
3473         struct sk_buff *msg;
3474         void *reply;
3475         int ret, cmd, reply_cmd;
3476         struct net *net;
3477
3478         net = skb_sknet(skb);
3479         cmd = info->genlhdr->cmd;
3480
3481         if (cmd == IPVS_CMD_GET_SERVICE)
3482                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3483         else if (cmd == IPVS_CMD_GET_INFO)
3484                 reply_cmd = IPVS_CMD_SET_INFO;
3485         else if (cmd == IPVS_CMD_GET_CONFIG)
3486                 reply_cmd = IPVS_CMD_SET_CONFIG;
3487         else {
3488                 pr_err("unknown Generic Netlink command\n");
3489                 return -EINVAL;
3490         }
3491
3492         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3493         if (!msg)
3494                 return -ENOMEM;
3495
3496         mutex_lock(&__ip_vs_mutex);
3497
3498         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3499         if (reply == NULL)
3500                 goto nla_put_failure;
3501
3502         switch (cmd) {
3503         case IPVS_CMD_GET_SERVICE:
3504         {
3505                 struct ip_vs_service *svc;
3506
3507                 svc = ip_vs_genl_find_service(net,
3508                                               info->attrs[IPVS_CMD_ATTR_SERVICE]);
3509                 if (IS_ERR(svc)) {
3510                         ret = PTR_ERR(svc);
3511                         goto out_err;
3512                 } else if (svc) {
3513                         ret = ip_vs_genl_fill_service(msg, svc);
3514                         if (ret)
3515                                 goto nla_put_failure;
3516                 } else {
3517                         ret = -ESRCH;
3518                         goto out_err;
3519                 }
3520
3521                 break;
3522         }
3523
3524         case IPVS_CMD_GET_CONFIG:
3525         {
3526                 struct ip_vs_timeout_user t;
3527
3528                 __ip_vs_get_timeouts(net, &t);
3529 #ifdef CONFIG_IP_VS_PROTO_TCP
3530                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
3531                                 t.tcp_timeout) ||
3532                     nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3533                                 t.tcp_fin_timeout))
3534                         goto nla_put_failure;
3535 #endif
3536 #ifdef CONFIG_IP_VS_PROTO_UDP
3537                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
3538                         goto nla_put_failure;
3539 #endif
3540
3541                 break;
3542         }
3543
3544         case IPVS_CMD_GET_INFO:
3545                 if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
3546                                 IP_VS_VERSION_CODE) ||
3547                     nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3548                                 ip_vs_conn_tab_size))
3549                         goto nla_put_failure;
3550                 break;
3551         }
3552
3553         genlmsg_end(msg, reply);
3554         ret = genlmsg_reply(msg, info);
3555         goto out;
3556
3557 nla_put_failure:
3558         pr_err("not enough space in Netlink message\n");
3559         ret = -EMSGSIZE;
3560
3561 out_err:
3562         nlmsg_free(msg);
3563 out:
3564         mutex_unlock(&__ip_vs_mutex);
3565
3566         return ret;
3567 }
3568
3569
3570 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3571         {
3572                 .cmd    = IPVS_CMD_NEW_SERVICE,
3573                 .flags  = GENL_ADMIN_PERM,
3574                 .policy = ip_vs_cmd_policy,
3575                 .doit   = ip_vs_genl_set_cmd,
3576         },
3577         {
3578                 .cmd    = IPVS_CMD_SET_SERVICE,
3579                 .flags  = GENL_ADMIN_PERM,
3580                 .policy = ip_vs_cmd_policy,
3581                 .doit   = ip_vs_genl_set_cmd,
3582         },
3583         {
3584                 .cmd    = IPVS_CMD_DEL_SERVICE,
3585                 .flags  = GENL_ADMIN_PERM,
3586                 .policy = ip_vs_cmd_policy,
3587                 .doit   = ip_vs_genl_set_cmd,
3588         },
3589         {
3590                 .cmd    = IPVS_CMD_GET_SERVICE,
3591                 .flags  = GENL_ADMIN_PERM,
3592                 .doit   = ip_vs_genl_get_cmd,
3593                 .dumpit = ip_vs_genl_dump_services,
3594                 .policy = ip_vs_cmd_policy,
3595         },
3596         {
3597                 .cmd    = IPVS_CMD_NEW_DEST,
3598                 .flags  = GENL_ADMIN_PERM,
3599                 .policy = ip_vs_cmd_policy,
3600                 .doit   = ip_vs_genl_set_cmd,
3601         },
3602         {
3603                 .cmd    = IPVS_CMD_SET_DEST,
3604                 .flags  = GENL_ADMIN_PERM,
3605                 .policy = ip_vs_cmd_policy,
3606                 .doit   = ip_vs_genl_set_cmd,
3607         },
3608         {
3609                 .cmd    = IPVS_CMD_DEL_DEST,
3610                 .flags  = GENL_ADMIN_PERM,
3611                 .policy = ip_vs_cmd_policy,
3612                 .doit   = ip_vs_genl_set_cmd,
3613         },
3614         {
3615                 .cmd    = IPVS_CMD_GET_DEST,
3616                 .flags  = GENL_ADMIN_PERM,
3617                 .policy = ip_vs_cmd_policy,
3618                 .dumpit = ip_vs_genl_dump_dests,
3619         },
3620         {
3621                 .cmd    = IPVS_CMD_NEW_DAEMON,
3622                 .flags  = GENL_ADMIN_PERM,
3623                 .policy = ip_vs_cmd_policy,
3624                 .doit   = ip_vs_genl_set_daemon,
3625         },
3626         {
3627                 .cmd    = IPVS_CMD_DEL_DAEMON,
3628                 .flags  = GENL_ADMIN_PERM,
3629                 .policy = ip_vs_cmd_policy,
3630                 .doit   = ip_vs_genl_set_daemon,
3631         },
3632         {
3633                 .cmd    = IPVS_CMD_GET_DAEMON,
3634                 .flags  = GENL_ADMIN_PERM,
3635                 .dumpit = ip_vs_genl_dump_daemons,
3636         },
3637         {
3638                 .cmd    = IPVS_CMD_SET_CONFIG,
3639                 .flags  = GENL_ADMIN_PERM,
3640                 .policy = ip_vs_cmd_policy,
3641                 .doit   = ip_vs_genl_set_cmd,
3642         },
3643         {
3644                 .cmd    = IPVS_CMD_GET_CONFIG,
3645                 .flags  = GENL_ADMIN_PERM,
3646                 .doit   = ip_vs_genl_get_cmd,
3647         },
3648         {
3649                 .cmd    = IPVS_CMD_GET_INFO,
3650                 .flags  = GENL_ADMIN_PERM,
3651                 .doit   = ip_vs_genl_get_cmd,
3652         },
3653         {
3654                 .cmd    = IPVS_CMD_ZERO,
3655                 .flags  = GENL_ADMIN_PERM,
3656                 .policy = ip_vs_cmd_policy,
3657                 .doit   = ip_vs_genl_set_cmd,
3658         },
3659         {
3660                 .cmd    = IPVS_CMD_FLUSH,
3661                 .flags  = GENL_ADMIN_PERM,
3662                 .doit   = ip_vs_genl_set_cmd,
3663         },
3664 };
3665
3666 static int __init ip_vs_genl_register(void)
3667 {
3668         return genl_register_family_with_ops(&ip_vs_genl_family,
3669                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3670 }
3671
3672 static void ip_vs_genl_unregister(void)
3673 {
3674         genl_unregister_family(&ip_vs_genl_family);
3675 }
3676
3677 /* End of Generic Netlink interface definitions */
3678
3679 /*
3680  * per netns intit/exit func.
3681  */
3682 #ifdef CONFIG_SYSCTL
3683 static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
3684 {
3685         int idx;
3686         struct netns_ipvs *ipvs = net_ipvs(net);
3687         struct ctl_table *tbl;
3688
3689         atomic_set(&ipvs->dropentry, 0);
3690         spin_lock_init(&ipvs->dropentry_lock);
3691         spin_lock_init(&ipvs->droppacket_lock);
3692         spin_lock_init(&ipvs->securetcp_lock);
3693
3694         if (!net_eq(net, &init_net)) {
3695                 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3696                 if (tbl == NULL)
3697                         return -ENOMEM;
3698
3699                 /* Don't export sysctls to unprivileged users */
3700                 if (net->user_ns != &init_user_ns)
3701                         tbl[0].procname = NULL;
3702         } else
3703                 tbl = vs_vars;
3704         /* Initialize sysctl defaults */
3705         idx = 0;
3706         ipvs->sysctl_amemthresh = 1024;
3707         tbl[idx++].data = &ipvs->sysctl_amemthresh;
3708         ipvs->sysctl_am_droprate = 10;
3709         tbl[idx++].data = &ipvs->sysctl_am_droprate;
3710         tbl[idx++].data = &ipvs->sysctl_drop_entry;
3711         tbl[idx++].data = &ipvs->sysctl_drop_packet;
3712 #ifdef CONFIG_IP_VS_NFCT
3713         tbl[idx++].data = &ipvs->sysctl_conntrack;
3714 #endif
3715         tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3716         ipvs->sysctl_snat_reroute = 1;
3717         tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3718         ipvs->sysctl_sync_ver = 1;
3719         tbl[idx++].data = &ipvs->sysctl_sync_ver;
3720         ipvs->sysctl_sync_ports = 1;
3721         tbl[idx++].data = &ipvs->sysctl_sync_ports;
3722         tbl[idx++].data = &ipvs->sysctl_sync_persist_mode;
3723         ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
3724         tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
3725         ipvs->sysctl_sync_sock_size = 0;
3726         tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
3727         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3728         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3729         tbl[idx++].data = &ipvs->sysctl_sloppy_tcp;
3730         tbl[idx++].data = &ipvs->sysctl_sloppy_sctp;
3731         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3732         ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3733         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3734         tbl[idx].data = &ipvs->sysctl_sync_threshold;
3735         tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3736         ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
3737         tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
3738         ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
3739         tbl[idx++].data = &ipvs->sysctl_sync_retries;
3740         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3741         ipvs->sysctl_pmtu_disc = 1;
3742         tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
3743         tbl[idx++].data = &ipvs->sysctl_backup_only;
3744
3745
3746         ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
3747         if (ipvs->sysctl_hdr == NULL) {
3748                 if (!net_eq(net, &init_net))
3749                         kfree(tbl);
3750                 return -ENOMEM;
3751         }
3752         ip_vs_start_estimator(net, &ipvs->tot_stats);
3753         ipvs->sysctl_tbl = tbl;
3754         /* Schedule defense work */
3755         INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3756         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
3757
3758         return 0;
3759 }
3760
3761 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
3762 {
3763         struct netns_ipvs *ipvs = net_ipvs(net);
3764
3765         cancel_delayed_work_sync(&ipvs->defense_work);
3766         cancel_work_sync(&ipvs->defense_work.work);
3767         unregister_net_sysctl_table(ipvs->sysctl_hdr);
3768 }
3769
3770 #else
3771
3772 static int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3773 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
3774
3775 #endif
3776
3777 static struct notifier_block ip_vs_dst_notifier = {
3778         .notifier_call = ip_vs_dst_event,
3779 };
3780
3781 int __net_init ip_vs_control_net_init(struct net *net)
3782 {
3783         int idx;
3784         struct netns_ipvs *ipvs = net_ipvs(net);
3785
3786         /* Initialize rs_table */
3787         for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3788                 INIT_HLIST_HEAD(&ipvs->rs_table[idx]);
3789
3790         INIT_LIST_HEAD(&ipvs->dest_trash);
3791         spin_lock_init(&ipvs->dest_trash_lock);
3792         setup_timer(&ipvs->dest_trash_timer, ip_vs_dest_trash_expire,
3793                     (unsigned long) net);
3794         atomic_set(&ipvs->ftpsvc_counter, 0);
3795         atomic_set(&ipvs->nullsvc_counter, 0);
3796
3797         /* procfs stats */
3798         ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
3799         if (!ipvs->tot_stats.cpustats)
3800                 return -ENOMEM;
3801
3802         spin_lock_init(&ipvs->tot_stats.lock);
3803
3804         proc_create("ip_vs", 0, net->proc_net, &ip_vs_info_fops);
3805         proc_create("ip_vs_stats", 0, net->proc_net, &ip_vs_stats_fops);
3806         proc_create("ip_vs_stats_percpu", 0, net->proc_net,
3807                     &ip_vs_stats_percpu_fops);
3808
3809         if (ip_vs_control_net_init_sysctl(net))
3810                 goto err;
3811
3812         return 0;
3813
3814 err:
3815         free_percpu(ipvs->tot_stats.cpustats);
3816         return -ENOMEM;
3817 }
3818
3819 void __net_exit ip_vs_control_net_cleanup(struct net *net)
3820 {
3821         struct netns_ipvs *ipvs = net_ipvs(net);
3822
3823         ip_vs_trash_cleanup(net);
3824         ip_vs_stop_estimator(net, &ipvs->tot_stats);
3825         ip_vs_control_net_cleanup_sysctl(net);
3826         remove_proc_entry("ip_vs_stats_percpu", net->proc_net);
3827         remove_proc_entry("ip_vs_stats", net->proc_net);
3828         remove_proc_entry("ip_vs", net->proc_net);
3829         free_percpu(ipvs->tot_stats.cpustats);
3830 }
3831
3832 int __init ip_vs_register_nl_ioctl(void)
3833 {
3834         int ret;
3835
3836         ret = nf_register_sockopt(&ip_vs_sockopts);
3837         if (ret) {
3838                 pr_err("cannot register sockopt.\n");
3839                 goto err_sock;
3840         }
3841
3842         ret = ip_vs_genl_register();
3843         if (ret) {
3844                 pr_err("cannot register Generic Netlink interface.\n");
3845                 goto err_genl;
3846         }
3847         return 0;
3848
3849 err_genl:
3850         nf_unregister_sockopt(&ip_vs_sockopts);
3851 err_sock:
3852         return ret;
3853 }
3854
3855 void ip_vs_unregister_nl_ioctl(void)
3856 {
3857         ip_vs_genl_unregister();
3858         nf_unregister_sockopt(&ip_vs_sockopts);
3859 }
3860
3861 int __init ip_vs_control_init(void)
3862 {
3863         int idx;
3864         int ret;
3865
3866         EnterFunction(2);
3867
3868         /* Initialize svc_table, ip_vs_svc_fwm_table */
3869         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3870                 INIT_HLIST_HEAD(&ip_vs_svc_table[idx]);
3871                 INIT_HLIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3872         }
3873
3874         smp_wmb();      /* Do we really need it now ? */
3875
3876         ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3877         if (ret < 0)
3878                 return ret;
3879
3880         LeaveFunction(2);
3881         return 0;
3882 }
3883
3884
3885 void ip_vs_control_cleanup(void)
3886 {
3887         EnterFunction(2);
3888         unregister_netdevice_notifier(&ip_vs_dst_notifier);
3889         LeaveFunction(2);
3890 }