1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16#define KMSG_COMPONENT "IPVS"
17#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
18
19#include <linux/module.h>
20#include <linux/init.h>
21#include <linux/types.h>
22#include <linux/capability.h>
23#include <linux/fs.h>
24#include <linux/sysctl.h>
25#include <linux/proc_fs.h>
26#include <linux/workqueue.h>
27#include <linux/swap.h>
28#include <linux/seq_file.h>
29#include <linux/slab.h>
30
31#include <linux/netfilter.h>
32#include <linux/netfilter_ipv4.h>
33#include <linux/mutex.h>
34
35#include <net/net_namespace.h>
36#include <linux/nsproxy.h>
37#include <net/ip.h>
38#ifdef CONFIG_IP_VS_IPV6
39#include <net/ipv6.h>
40#include <net/ip6_route.h>
41#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
42#endif
43#include <net/route.h>
44#include <net/sock.h>
45#include <net/genetlink.h>
46
47#include <linux/uaccess.h>
48
49#include <net/ip_vs.h>
50
51
52static DEFINE_MUTEX(__ip_vs_mutex);
53
54
55
56#ifdef CONFIG_IP_VS_DEBUG
57static int sysctl_ip_vs_debug_level = 0;
58
59int ip_vs_get_debug_level(void)
60{
61 return sysctl_ip_vs_debug_level;
62}
63#endif
64
65
66
67static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup);
68
69
70#ifdef CONFIG_IP_VS_IPV6
71
72static bool __ip_vs_addr_is_local_v6(struct net *net,
73 const struct in6_addr *addr)
74{
75 struct flowi6 fl6 = {
76 .daddr = *addr,
77 };
78 struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
79 bool is_local;
80
81 is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
82
83 dst_release(dst);
84 return is_local;
85}
86#endif
87
88#ifdef CONFIG_SYSCTL
89
90
91
92
93static void update_defense_level(struct netns_ipvs *ipvs)
94{
95 struct sysinfo i;
96 static int old_secure_tcp = 0;
97 int availmem;
98 int nomem;
99 int to_change = -1;
100
101
102 si_meminfo(&i);
103 availmem = i.freeram + i.bufferram;
104
105
106
107
108
109 nomem = (availmem < ipvs->sysctl_amemthresh);
110
111 local_bh_disable();
112
113
114 spin_lock(&ipvs->dropentry_lock);
115 switch (ipvs->sysctl_drop_entry) {
116 case 0:
117 atomic_set(&ipvs->dropentry, 0);
118 break;
119 case 1:
120 if (nomem) {
121 atomic_set(&ipvs->dropentry, 1);
122 ipvs->sysctl_drop_entry = 2;
123 } else {
124 atomic_set(&ipvs->dropentry, 0);
125 }
126 break;
127 case 2:
128 if (nomem) {
129 atomic_set(&ipvs->dropentry, 1);
130 } else {
131 atomic_set(&ipvs->dropentry, 0);
132 ipvs->sysctl_drop_entry = 1;
133 }
134 break;
135 case 3:
136 atomic_set(&ipvs->dropentry, 1);
137 break;
138 }
139 spin_unlock(&ipvs->dropentry_lock);
140
141
142 spin_lock(&ipvs->droppacket_lock);
143 switch (ipvs->sysctl_drop_packet) {
144 case 0:
145 ipvs->drop_rate = 0;
146 break;
147 case 1:
148 if (nomem) {
149 ipvs->drop_rate = ipvs->drop_counter
150 = ipvs->sysctl_amemthresh /
151 (ipvs->sysctl_amemthresh-availmem);
152 ipvs->sysctl_drop_packet = 2;
153 } else {
154 ipvs->drop_rate = 0;
155 }
156 break;
157 case 2:
158 if (nomem) {
159 ipvs->drop_rate = ipvs->drop_counter
160 = ipvs->sysctl_amemthresh /
161 (ipvs->sysctl_amemthresh-availmem);
162 } else {
163 ipvs->drop_rate = 0;
164 ipvs->sysctl_drop_packet = 1;
165 }
166 break;
167 case 3:
168 ipvs->drop_rate = ipvs->sysctl_am_droprate;
169 break;
170 }
171 spin_unlock(&ipvs->droppacket_lock);
172
173
174 spin_lock(&ipvs->securetcp_lock);
175 switch (ipvs->sysctl_secure_tcp) {
176 case 0:
177 if (old_secure_tcp >= 2)
178 to_change = 0;
179 break;
180 case 1:
181 if (nomem) {
182 if (old_secure_tcp < 2)
183 to_change = 1;
184 ipvs->sysctl_secure_tcp = 2;
185 } else {
186 if (old_secure_tcp >= 2)
187 to_change = 0;
188 }
189 break;
190 case 2:
191 if (nomem) {
192 if (old_secure_tcp < 2)
193 to_change = 1;
194 } else {
195 if (old_secure_tcp >= 2)
196 to_change = 0;
197 ipvs->sysctl_secure_tcp = 1;
198 }
199 break;
200 case 3:
201 if (old_secure_tcp < 2)
202 to_change = 1;
203 break;
204 }
205 old_secure_tcp = ipvs->sysctl_secure_tcp;
206 if (to_change >= 0)
207 ip_vs_protocol_timeout_change(ipvs,
208 ipvs->sysctl_secure_tcp > 1);
209 spin_unlock(&ipvs->securetcp_lock);
210
211 local_bh_enable();
212}
213
214
215
216
217
218#define DEFENSE_TIMER_PERIOD 1*HZ
219
220static void defense_work_handler(struct work_struct *work)
221{
222 struct netns_ipvs *ipvs =
223 container_of(work, struct netns_ipvs, defense_work.work);
224
225 update_defense_level(ipvs);
226 if (atomic_read(&ipvs->dropentry))
227 ip_vs_random_dropentry(ipvs);
228 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
229}
230#endif
231
232int
233ip_vs_use_count_inc(void)
234{
235 return try_module_get(THIS_MODULE);
236}
237
238void
239ip_vs_use_count_dec(void)
240{
241 module_put(THIS_MODULE);
242}
243
244
245
246
247
248#define IP_VS_SVC_TAB_BITS 8
249#define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
250#define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
251
252
253static struct hlist_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
254
255static struct hlist_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
256
257
258
259
260
261static inline unsigned int
262ip_vs_svc_hashkey(struct netns_ipvs *ipvs, int af, unsigned int proto,
263 const union nf_inet_addr *addr, __be16 port)
264{
265 register unsigned int porth = ntohs(port);
266 __be32 addr_fold = addr->ip;
267 __u32 ahash;
268
269#ifdef CONFIG_IP_VS_IPV6
270 if (af == AF_INET6)
271 addr_fold = addr->ip6[0]^addr->ip6[1]^
272 addr->ip6[2]^addr->ip6[3];
273#endif
274 ahash = ntohl(addr_fold);
275 ahash ^= ((size_t) ipvs >> 8);
276
277 return (proto ^ ahash ^ (porth >> IP_VS_SVC_TAB_BITS) ^ porth) &
278 IP_VS_SVC_TAB_MASK;
279}
280
281
282
283
284static inline unsigned int ip_vs_svc_fwm_hashkey(struct netns_ipvs *ipvs, __u32 fwmark)
285{
286 return (((size_t)ipvs>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
287}
288
289
290
291
292
293
294static int ip_vs_svc_hash(struct ip_vs_service *svc)
295{
296 unsigned int hash;
297
298 if (svc->flags & IP_VS_SVC_F_HASHED) {
299 pr_err("%s(): request for already hashed, called from %pS\n",
300 __func__, __builtin_return_address(0));
301 return 0;
302 }
303
304 if (svc->fwmark == 0) {
305
306
307
308 hash = ip_vs_svc_hashkey(svc->ipvs, svc->af, svc->protocol,
309 &svc->addr, svc->port);
310 hlist_add_head_rcu(&svc->s_list, &ip_vs_svc_table[hash]);
311 } else {
312
313
314
315 hash = ip_vs_svc_fwm_hashkey(svc->ipvs, svc->fwmark);
316 hlist_add_head_rcu(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
317 }
318
319 svc->flags |= IP_VS_SVC_F_HASHED;
320
321 atomic_inc(&svc->refcnt);
322 return 1;
323}
324
325
326
327
328
329
330static int ip_vs_svc_unhash(struct ip_vs_service *svc)
331{
332 if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
333 pr_err("%s(): request for unhash flagged, called from %pS\n",
334 __func__, __builtin_return_address(0));
335 return 0;
336 }
337
338 if (svc->fwmark == 0) {
339
340 hlist_del_rcu(&svc->s_list);
341 } else {
342
343 hlist_del_rcu(&svc->f_list);
344 }
345
346 svc->flags &= ~IP_VS_SVC_F_HASHED;
347 atomic_dec(&svc->refcnt);
348 return 1;
349}
350
351
352
353
354
355static inline struct ip_vs_service *
356__ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u16 protocol,
357 const union nf_inet_addr *vaddr, __be16 vport)
358{
359 unsigned int hash;
360 struct ip_vs_service *svc;
361
362
363 hash = ip_vs_svc_hashkey(ipvs, af, protocol, vaddr, vport);
364
365 hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[hash], s_list) {
366 if ((svc->af == af)
367 && ip_vs_addr_equal(af, &svc->addr, vaddr)
368 && (svc->port == vport)
369 && (svc->protocol == protocol)
370 && (svc->ipvs == ipvs)) {
371
372 return svc;
373 }
374 }
375
376 return NULL;
377}
378
379
380
381
382
383static inline struct ip_vs_service *
384__ip_vs_svc_fwm_find(struct netns_ipvs *ipvs, int af, __u32 fwmark)
385{
386 unsigned int hash;
387 struct ip_vs_service *svc;
388
389
390 hash = ip_vs_svc_fwm_hashkey(ipvs, fwmark);
391
392 hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[hash], f_list) {
393 if (svc->fwmark == fwmark && svc->af == af
394 && (svc->ipvs == ipvs)) {
395
396 return svc;
397 }
398 }
399
400 return NULL;
401}
402
403
404struct ip_vs_service *
405ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u32 fwmark, __u16 protocol,
406 const union nf_inet_addr *vaddr, __be16 vport)
407{
408 struct ip_vs_service *svc;
409
410
411
412
413 if (fwmark) {
414 svc = __ip_vs_svc_fwm_find(ipvs, af, fwmark);
415 if (svc)
416 goto out;
417 }
418
419
420
421
422
423 svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, vport);
424
425 if (!svc && protocol == IPPROTO_TCP &&
426 atomic_read(&ipvs->ftpsvc_counter) &&
427 (vport == FTPDATA || ntohs(vport) >= inet_prot_sock(ipvs->net))) {
428
429
430
431
432 svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, FTPPORT);
433 }
434
435 if (svc == NULL
436 && atomic_read(&ipvs->nullsvc_counter)) {
437
438
439
440 svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, 0);
441 }
442
443 out:
444 IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
445 fwmark, ip_vs_proto_name(protocol),
446 IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
447 svc ? "hit" : "not hit");
448
449 return svc;
450}
451
452
453static inline void
454__ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
455{
456 atomic_inc(&svc->refcnt);
457 rcu_assign_pointer(dest->svc, svc);
458}
459
460static void ip_vs_service_free(struct ip_vs_service *svc)
461{
462 free_percpu(svc->stats.cpustats);
463 kfree(svc);
464}
465
466static void ip_vs_service_rcu_free(struct rcu_head *head)
467{
468 struct ip_vs_service *svc;
469
470 svc = container_of(head, struct ip_vs_service, rcu_head);
471 ip_vs_service_free(svc);
472}
473
474static void __ip_vs_svc_put(struct ip_vs_service *svc, bool do_delay)
475{
476 if (atomic_dec_and_test(&svc->refcnt)) {
477 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
478 svc->fwmark,
479 IP_VS_DBG_ADDR(svc->af, &svc->addr),
480 ntohs(svc->port));
481 if (do_delay)
482 call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
483 else
484 ip_vs_service_free(svc);
485 }
486}
487
488
489
490
491
492static inline unsigned int ip_vs_rs_hashkey(int af,
493 const union nf_inet_addr *addr,
494 __be16 port)
495{
496 register unsigned int porth = ntohs(port);
497 __be32 addr_fold = addr->ip;
498
499#ifdef CONFIG_IP_VS_IPV6
500 if (af == AF_INET6)
501 addr_fold = addr->ip6[0]^addr->ip6[1]^
502 addr->ip6[2]^addr->ip6[3];
503#endif
504
505 return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
506 & IP_VS_RTAB_MASK;
507}
508
509
510static void ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
511{
512 unsigned int hash;
513
514 if (dest->in_rs_table)
515 return;
516
517
518
519
520
521 hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
522
523 hlist_add_head_rcu(&dest->d_list, &ipvs->rs_table[hash]);
524 dest->in_rs_table = 1;
525}
526
527
528static void ip_vs_rs_unhash(struct ip_vs_dest *dest)
529{
530
531
532
533 if (dest->in_rs_table) {
534 hlist_del_rcu(&dest->d_list);
535 dest->in_rs_table = 0;
536 }
537}
538
539
540bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol,
541 const union nf_inet_addr *daddr, __be16 dport)
542{
543 unsigned int hash;
544 struct ip_vs_dest *dest;
545
546
547 hash = ip_vs_rs_hashkey(af, daddr, dport);
548
549 hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
550 if (dest->port == dport &&
551 dest->af == af &&
552 ip_vs_addr_equal(af, &dest->addr, daddr) &&
553 (dest->protocol == protocol || dest->vfwmark)) {
554
555 return true;
556 }
557 }
558
559 return false;
560}
561
562
563
564
565
566
567
568struct ip_vs_dest *ip_vs_find_real_service(struct netns_ipvs *ipvs, int af,
569 __u16 protocol,
570 const union nf_inet_addr *daddr,
571 __be16 dport)
572{
573 unsigned int hash;
574 struct ip_vs_dest *dest;
575
576
577 hash = ip_vs_rs_hashkey(af, daddr, dport);
578
579 hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
580 if (dest->port == dport &&
581 dest->af == af &&
582 ip_vs_addr_equal(af, &dest->addr, daddr) &&
583 (dest->protocol == protocol || dest->vfwmark)) {
584
585 return dest;
586 }
587 }
588
589 return NULL;
590}
591
592
593
594
595static struct ip_vs_dest *
596ip_vs_lookup_dest(struct ip_vs_service *svc, int dest_af,
597 const union nf_inet_addr *daddr, __be16 dport)
598{
599 struct ip_vs_dest *dest;
600
601
602
603
604 list_for_each_entry_rcu(dest, &svc->destinations, n_list) {
605 if ((dest->af == dest_af) &&
606 ip_vs_addr_equal(dest_af, &dest->addr, daddr) &&
607 (dest->port == dport)) {
608
609 return dest;
610 }
611 }
612
613 return NULL;
614}
615
616
617
618
619
620
621
622
623
624struct ip_vs_dest *ip_vs_find_dest(struct netns_ipvs *ipvs, int svc_af, int dest_af,
625 const union nf_inet_addr *daddr,
626 __be16 dport,
627 const union nf_inet_addr *vaddr,
628 __be16 vport, __u16 protocol, __u32 fwmark,
629 __u32 flags)
630{
631 struct ip_vs_dest *dest;
632 struct ip_vs_service *svc;
633 __be16 port = dport;
634
635 svc = ip_vs_service_find(ipvs, svc_af, fwmark, protocol, vaddr, vport);
636 if (!svc)
637 return NULL;
638 if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
639 port = 0;
640 dest = ip_vs_lookup_dest(svc, dest_af, daddr, port);
641 if (!dest)
642 dest = ip_vs_lookup_dest(svc, dest_af, daddr, port ^ dport);
643 return dest;
644}
645
646void ip_vs_dest_dst_rcu_free(struct rcu_head *head)
647{
648 struct ip_vs_dest_dst *dest_dst = container_of(head,
649 struct ip_vs_dest_dst,
650 rcu_head);
651
652 dst_release(dest_dst->dst_cache);
653 kfree(dest_dst);
654}
655
656
657static void __ip_vs_dst_cache_reset(struct ip_vs_dest *dest)
658{
659 struct ip_vs_dest_dst *old;
660
661 old = rcu_dereference_protected(dest->dest_dst, 1);
662 if (old) {
663 RCU_INIT_POINTER(dest->dest_dst, NULL);
664 call_rcu(&old->rcu_head, ip_vs_dest_dst_rcu_free);
665 }
666}
667
668
669
670
671
672
673
674
675
676
677
678static struct ip_vs_dest *
679ip_vs_trash_get_dest(struct ip_vs_service *svc, int dest_af,
680 const union nf_inet_addr *daddr, __be16 dport)
681{
682 struct ip_vs_dest *dest;
683 struct netns_ipvs *ipvs = svc->ipvs;
684
685
686
687
688 spin_lock_bh(&ipvs->dest_trash_lock);
689 list_for_each_entry(dest, &ipvs->dest_trash, t_list) {
690 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
691 "dest->refcnt=%d\n",
692 dest->vfwmark,
693 IP_VS_DBG_ADDR(dest->af, &dest->addr),
694 ntohs(dest->port),
695 refcount_read(&dest->refcnt));
696 if (dest->af == dest_af &&
697 ip_vs_addr_equal(dest_af, &dest->addr, daddr) &&
698 dest->port == dport &&
699 dest->vfwmark == svc->fwmark &&
700 dest->protocol == svc->protocol &&
701 (svc->fwmark ||
702 (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
703 dest->vport == svc->port))) {
704
705 list_del(&dest->t_list);
706 goto out;
707 }
708 }
709
710 dest = NULL;
711
712out:
713 spin_unlock_bh(&ipvs->dest_trash_lock);
714
715 return dest;
716}
717
718static void ip_vs_dest_free(struct ip_vs_dest *dest)
719{
720 struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1);
721
722 __ip_vs_dst_cache_reset(dest);
723 __ip_vs_svc_put(svc, false);
724 free_percpu(dest->stats.cpustats);
725 ip_vs_dest_put_and_free(dest);
726}
727
728
729
730
731
732
733
734
735
736
737static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs)
738{
739 struct ip_vs_dest *dest, *nxt;
740
741 del_timer_sync(&ipvs->dest_trash_timer);
742
743 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) {
744 list_del(&dest->t_list);
745 ip_vs_dest_free(dest);
746 }
747}
748
749static void
750ip_vs_copy_stats(struct ip_vs_kstats *dst, struct ip_vs_stats *src)
751{
752#define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->kstats.c - src->kstats0.c
753
754 spin_lock_bh(&src->lock);
755
756 IP_VS_SHOW_STATS_COUNTER(conns);
757 IP_VS_SHOW_STATS_COUNTER(inpkts);
758 IP_VS_SHOW_STATS_COUNTER(outpkts);
759 IP_VS_SHOW_STATS_COUNTER(inbytes);
760 IP_VS_SHOW_STATS_COUNTER(outbytes);
761
762 ip_vs_read_estimator(dst, src);
763
764 spin_unlock_bh(&src->lock);
765}
766
767static void
768ip_vs_export_stats_user(struct ip_vs_stats_user *dst, struct ip_vs_kstats *src)
769{
770 dst->conns = (u32)src->conns;
771 dst->inpkts = (u32)src->inpkts;
772 dst->outpkts = (u32)src->outpkts;
773 dst->inbytes = src->inbytes;
774 dst->outbytes = src->outbytes;
775 dst->cps = (u32)src->cps;
776 dst->inpps = (u32)src->inpps;
777 dst->outpps = (u32)src->outpps;
778 dst->inbps = (u32)src->inbps;
779 dst->outbps = (u32)src->outbps;
780}
781
782static void
783ip_vs_zero_stats(struct ip_vs_stats *stats)
784{
785 spin_lock_bh(&stats->lock);
786
787
788
789#define IP_VS_ZERO_STATS_COUNTER(c) stats->kstats0.c = stats->kstats.c
790
791 IP_VS_ZERO_STATS_COUNTER(conns);
792 IP_VS_ZERO_STATS_COUNTER(inpkts);
793 IP_VS_ZERO_STATS_COUNTER(outpkts);
794 IP_VS_ZERO_STATS_COUNTER(inbytes);
795 IP_VS_ZERO_STATS_COUNTER(outbytes);
796
797 ip_vs_zero_estimator(stats);
798
799 spin_unlock_bh(&stats->lock);
800}
801
802
803
804
805static void
806__ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
807 struct ip_vs_dest_user_kern *udest, int add)
808{
809 struct netns_ipvs *ipvs = svc->ipvs;
810 struct ip_vs_service *old_svc;
811 struct ip_vs_scheduler *sched;
812 int conn_flags;
813
814
815 BUG_ON(!add && udest->af != dest->af);
816
817 if (add && udest->af != svc->af)
818 ipvs->mixed_address_family_dests++;
819
820
821 if (add || udest->weight != 0)
822 atomic_set(&dest->last_weight, udest->weight);
823
824
825 atomic_set(&dest->weight, udest->weight);
826 conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
827 conn_flags |= IP_VS_CONN_F_INACTIVE;
828
829
830 dest->tun_type = udest->tun_type;
831 dest->tun_port = udest->tun_port;
832
833
834 if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
835 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
836 } else {
837
838
839
840
841 ip_vs_rs_hash(ipvs, dest);
842
843 if (svc->port == FTPPORT)
844 ip_vs_register_conntrack(svc);
845 }
846 atomic_set(&dest->conn_flags, conn_flags);
847
848
849 old_svc = rcu_dereference_protected(dest->svc, 1);
850 if (!old_svc) {
851 __ip_vs_bind_svc(dest, svc);
852 } else {
853 if (old_svc != svc) {
854 ip_vs_zero_stats(&dest->stats);
855 __ip_vs_bind_svc(dest, svc);
856 __ip_vs_svc_put(old_svc, true);
857 }
858 }
859
860
861 dest->flags |= IP_VS_DEST_F_AVAILABLE;
862
863 if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
864 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
865 dest->u_threshold = udest->u_threshold;
866 dest->l_threshold = udest->l_threshold;
867
868 dest->af = udest->af;
869
870 spin_lock_bh(&dest->dst_lock);
871 __ip_vs_dst_cache_reset(dest);
872 spin_unlock_bh(&dest->dst_lock);
873
874 if (add) {
875 ip_vs_start_estimator(svc->ipvs, &dest->stats);
876 list_add_rcu(&dest->n_list, &svc->destinations);
877 svc->num_dests++;
878 sched = rcu_dereference_protected(svc->scheduler, 1);
879 if (sched && sched->add_dest)
880 sched->add_dest(svc, dest);
881 } else {
882 sched = rcu_dereference_protected(svc->scheduler, 1);
883 if (sched && sched->upd_dest)
884 sched->upd_dest(svc, dest);
885 }
886}
887
888
889
890
891
892static int
893ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
894 struct ip_vs_dest **dest_p)
895{
896 struct ip_vs_dest *dest;
897 unsigned int atype, i;
898
899 EnterFunction(2);
900
901#ifdef CONFIG_IP_VS_IPV6
902 if (udest->af == AF_INET6) {
903 int ret;
904
905 atype = ipv6_addr_type(&udest->addr.in6);
906 if ((!(atype & IPV6_ADDR_UNICAST) ||
907 atype & IPV6_ADDR_LINKLOCAL) &&
908 !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6))
909 return -EINVAL;
910
911 ret = nf_defrag_ipv6_enable(svc->ipvs->net);
912 if (ret)
913 return ret;
914 } else
915#endif
916 {
917 atype = inet_addr_type(svc->ipvs->net, udest->addr.ip);
918 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
919 return -EINVAL;
920 }
921
922 dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
923 if (dest == NULL)
924 return -ENOMEM;
925
926 dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
927 if (!dest->stats.cpustats)
928 goto err_alloc;
929
930 for_each_possible_cpu(i) {
931 struct ip_vs_cpu_stats *ip_vs_dest_stats;
932 ip_vs_dest_stats = per_cpu_ptr(dest->stats.cpustats, i);
933 u64_stats_init(&ip_vs_dest_stats->syncp);
934 }
935
936 dest->af = udest->af;
937 dest->protocol = svc->protocol;
938 dest->vaddr = svc->addr;
939 dest->vport = svc->port;
940 dest->vfwmark = svc->fwmark;
941 ip_vs_addr_copy(udest->af, &dest->addr, &udest->addr);
942 dest->port = udest->port;
943
944 atomic_set(&dest->activeconns, 0);
945 atomic_set(&dest->inactconns, 0);
946 atomic_set(&dest->persistconns, 0);
947 refcount_set(&dest->refcnt, 1);
948
949 INIT_HLIST_NODE(&dest->d_list);
950 spin_lock_init(&dest->dst_lock);
951 spin_lock_init(&dest->stats.lock);
952 __ip_vs_update_dest(svc, dest, udest, 1);
953
954 *dest_p = dest;
955
956 LeaveFunction(2);
957 return 0;
958
959err_alloc:
960 kfree(dest);
961 return -ENOMEM;
962}
963
964
965
966
967
968static int
969ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
970{
971 struct ip_vs_dest *dest;
972 union nf_inet_addr daddr;
973 __be16 dport = udest->port;
974 int ret;
975
976 EnterFunction(2);
977
978 if (udest->weight < 0) {
979 pr_err("%s(): server weight less than zero\n", __func__);
980 return -ERANGE;
981 }
982
983 if (udest->l_threshold > udest->u_threshold) {
984 pr_err("%s(): lower threshold is higher than upper threshold\n",
985 __func__);
986 return -ERANGE;
987 }
988
989 if (udest->tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) {
990 if (udest->tun_port == 0) {
991 pr_err("%s(): tunnel port is zero\n", __func__);
992 return -EINVAL;
993 }
994 }
995
996 ip_vs_addr_copy(udest->af, &daddr, &udest->addr);
997
998
999 rcu_read_lock();
1000 dest = ip_vs_lookup_dest(svc, udest->af, &daddr, dport);
1001 rcu_read_unlock();
1002
1003 if (dest != NULL) {
1004 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
1005 return -EEXIST;
1006 }
1007
1008
1009
1010
1011
1012 dest = ip_vs_trash_get_dest(svc, udest->af, &daddr, dport);
1013
1014 if (dest != NULL) {
1015 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
1016 "dest->refcnt=%d, service %u/%s:%u\n",
1017 IP_VS_DBG_ADDR(udest->af, &daddr), ntohs(dport),
1018 refcount_read(&dest->refcnt),
1019 dest->vfwmark,
1020 IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
1021 ntohs(dest->vport));
1022
1023 __ip_vs_update_dest(svc, dest, udest, 1);
1024 ret = 0;
1025 } else {
1026
1027
1028
1029 ret = ip_vs_new_dest(svc, udest, &dest);
1030 }
1031 LeaveFunction(2);
1032
1033 return ret;
1034}
1035
1036
1037
1038
1039
1040static int
1041ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1042{
1043 struct ip_vs_dest *dest;
1044 union nf_inet_addr daddr;
1045 __be16 dport = udest->port;
1046
1047 EnterFunction(2);
1048
1049 if (udest->weight < 0) {
1050 pr_err("%s(): server weight less than zero\n", __func__);
1051 return -ERANGE;
1052 }
1053
1054 if (udest->l_threshold > udest->u_threshold) {
1055 pr_err("%s(): lower threshold is higher than upper threshold\n",
1056 __func__);
1057 return -ERANGE;
1058 }
1059
1060 if (udest->tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) {
1061 if (udest->tun_port == 0) {
1062 pr_err("%s(): tunnel port is zero\n", __func__);
1063 return -EINVAL;
1064 }
1065 }
1066
1067 ip_vs_addr_copy(udest->af, &daddr, &udest->addr);
1068
1069
1070 rcu_read_lock();
1071 dest = ip_vs_lookup_dest(svc, udest->af, &daddr, dport);
1072 rcu_read_unlock();
1073
1074 if (dest == NULL) {
1075 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1076 return -ENOENT;
1077 }
1078
1079 __ip_vs_update_dest(svc, dest, udest, 0);
1080 LeaveFunction(2);
1081
1082 return 0;
1083}
1084
1085
1086
1087
1088static void __ip_vs_del_dest(struct netns_ipvs *ipvs, struct ip_vs_dest *dest,
1089 bool cleanup)
1090{
1091 ip_vs_stop_estimator(ipvs, &dest->stats);
1092
1093
1094
1095
1096 ip_vs_rs_unhash(dest);
1097
1098 spin_lock_bh(&ipvs->dest_trash_lock);
1099 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n",
1100 IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port),
1101 refcount_read(&dest->refcnt));
1102 if (list_empty(&ipvs->dest_trash) && !cleanup)
1103 mod_timer(&ipvs->dest_trash_timer,
1104 jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
1105
1106 list_add(&dest->t_list, &ipvs->dest_trash);
1107 dest->idle_start = 0;
1108 spin_unlock_bh(&ipvs->dest_trash_lock);
1109}
1110
1111
1112
1113
1114
1115static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1116 struct ip_vs_dest *dest,
1117 int svcupd)
1118{
1119 dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1120
1121
1122
1123
1124 list_del_rcu(&dest->n_list);
1125 svc->num_dests--;
1126
1127 if (dest->af != svc->af)
1128 svc->ipvs->mixed_address_family_dests--;
1129
1130 if (svcupd) {
1131 struct ip_vs_scheduler *sched;
1132
1133 sched = rcu_dereference_protected(svc->scheduler, 1);
1134 if (sched && sched->del_dest)
1135 sched->del_dest(svc, dest);
1136 }
1137}
1138
1139
1140
1141
1142
1143static int
1144ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1145{
1146 struct ip_vs_dest *dest;
1147 __be16 dport = udest->port;
1148
1149 EnterFunction(2);
1150
1151
1152 rcu_read_lock();
1153 dest = ip_vs_lookup_dest(svc, udest->af, &udest->addr, dport);
1154 rcu_read_unlock();
1155
1156 if (dest == NULL) {
1157 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1158 return -ENOENT;
1159 }
1160
1161
1162
1163
1164 __ip_vs_unlink_dest(svc, dest, 1);
1165
1166
1167
1168
1169 __ip_vs_del_dest(svc->ipvs, dest, false);
1170
1171 LeaveFunction(2);
1172
1173 return 0;
1174}
1175
1176static void ip_vs_dest_trash_expire(struct timer_list *t)
1177{
1178 struct netns_ipvs *ipvs = from_timer(ipvs, t, dest_trash_timer);
1179 struct ip_vs_dest *dest, *next;
1180 unsigned long now = jiffies;
1181
1182 spin_lock(&ipvs->dest_trash_lock);
1183 list_for_each_entry_safe(dest, next, &ipvs->dest_trash, t_list) {
1184 if (refcount_read(&dest->refcnt) > 1)
1185 continue;
1186 if (dest->idle_start) {
1187 if (time_before(now, dest->idle_start +
1188 IP_VS_DEST_TRASH_PERIOD))
1189 continue;
1190 } else {
1191 dest->idle_start = max(1UL, now);
1192 continue;
1193 }
1194 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u from trash\n",
1195 dest->vfwmark,
1196 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1197 ntohs(dest->port));
1198 list_del(&dest->t_list);
1199 ip_vs_dest_free(dest);
1200 }
1201 if (!list_empty(&ipvs->dest_trash))
1202 mod_timer(&ipvs->dest_trash_timer,
1203 jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
1204 spin_unlock(&ipvs->dest_trash_lock);
1205}
1206
1207
1208
1209
1210static int
1211ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
1212 struct ip_vs_service **svc_p)
1213{
1214 int ret = 0, i;
1215 struct ip_vs_scheduler *sched = NULL;
1216 struct ip_vs_pe *pe = NULL;
1217 struct ip_vs_service *svc = NULL;
1218
1219
1220 ip_vs_use_count_inc();
1221
1222
1223 if (strcmp(u->sched_name, "none")) {
1224 sched = ip_vs_scheduler_get(u->sched_name);
1225 if (!sched) {
1226 pr_info("Scheduler module ip_vs_%s not found\n",
1227 u->sched_name);
1228 ret = -ENOENT;
1229 goto out_err;
1230 }
1231 }
1232
1233 if (u->pe_name && *u->pe_name) {
1234 pe = ip_vs_pe_getbyname(u->pe_name);
1235 if (pe == NULL) {
1236 pr_info("persistence engine module ip_vs_pe_%s "
1237 "not found\n", u->pe_name);
1238 ret = -ENOENT;
1239 goto out_err;
1240 }
1241 }
1242
1243#ifdef CONFIG_IP_VS_IPV6
1244 if (u->af == AF_INET6) {
1245 __u32 plen = (__force __u32) u->netmask;
1246
1247 if (plen < 1 || plen > 128) {
1248 ret = -EINVAL;
1249 goto out_err;
1250 }
1251
1252 ret = nf_defrag_ipv6_enable(ipvs->net);
1253 if (ret)
1254 goto out_err;
1255 }
1256#endif
1257
1258 svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1259 if (svc == NULL) {
1260 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1261 ret = -ENOMEM;
1262 goto out_err;
1263 }
1264 svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1265 if (!svc->stats.cpustats) {
1266 ret = -ENOMEM;
1267 goto out_err;
1268 }
1269
1270 for_each_possible_cpu(i) {
1271 struct ip_vs_cpu_stats *ip_vs_stats;
1272 ip_vs_stats = per_cpu_ptr(svc->stats.cpustats, i);
1273 u64_stats_init(&ip_vs_stats->syncp);
1274 }
1275
1276
1277
1278 atomic_set(&svc->refcnt, 0);
1279
1280 svc->af = u->af;
1281 svc->protocol = u->protocol;
1282 ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1283 svc->port = u->port;
1284 svc->fwmark = u->fwmark;
1285 svc->flags = u->flags;
1286 svc->timeout = u->timeout * HZ;
1287 svc->netmask = u->netmask;
1288 svc->ipvs = ipvs;
1289
1290 INIT_LIST_HEAD(&svc->destinations);
1291 spin_lock_init(&svc->sched_lock);
1292 spin_lock_init(&svc->stats.lock);
1293
1294
1295 if (sched) {
1296 ret = ip_vs_bind_scheduler(svc, sched);
1297 if (ret)
1298 goto out_err;
1299 sched = NULL;
1300 }
1301
1302
1303 RCU_INIT_POINTER(svc->pe, pe);
1304 pe = NULL;
1305
1306
1307 if (svc->port == FTPPORT)
1308 atomic_inc(&ipvs->ftpsvc_counter);
1309 else if (svc->port == 0)
1310 atomic_inc(&ipvs->nullsvc_counter);
1311 if (svc->pe && svc->pe->conn_out)
1312 atomic_inc(&ipvs->conn_out_counter);
1313
1314 ip_vs_start_estimator(ipvs, &svc->stats);
1315
1316
1317 if (svc->af == AF_INET)
1318 ipvs->num_services++;
1319
1320
1321 ip_vs_svc_hash(svc);
1322
1323 *svc_p = svc;
1324
1325 ipvs->enable = 1;
1326 return 0;
1327
1328
1329 out_err:
1330 if (svc != NULL) {
1331 ip_vs_unbind_scheduler(svc, sched);
1332 ip_vs_service_free(svc);
1333 }
1334 ip_vs_scheduler_put(sched);
1335 ip_vs_pe_put(pe);
1336
1337
1338 ip_vs_use_count_dec();
1339
1340 return ret;
1341}
1342
1343
1344
1345
1346
1347static int
1348ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1349{
1350 struct ip_vs_scheduler *sched = NULL, *old_sched;
1351 struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1352 int ret = 0;
1353 bool new_pe_conn_out, old_pe_conn_out;
1354
1355
1356
1357
1358 if (strcmp(u->sched_name, "none")) {
1359 sched = ip_vs_scheduler_get(u->sched_name);
1360 if (!sched) {
1361 pr_info("Scheduler module ip_vs_%s not found\n",
1362 u->sched_name);
1363 return -ENOENT;
1364 }
1365 }
1366 old_sched = sched;
1367
1368 if (u->pe_name && *u->pe_name) {
1369 pe = ip_vs_pe_getbyname(u->pe_name);
1370 if (pe == NULL) {
1371 pr_info("persistence engine module ip_vs_pe_%s "
1372 "not found\n", u->pe_name);
1373 ret = -ENOENT;
1374 goto out;
1375 }
1376 old_pe = pe;
1377 }
1378
1379#ifdef CONFIG_IP_VS_IPV6
1380 if (u->af == AF_INET6) {
1381 __u32 plen = (__force __u32) u->netmask;
1382
1383 if (plen < 1 || plen > 128) {
1384 ret = -EINVAL;
1385 goto out;
1386 }
1387 }
1388#endif
1389
1390 old_sched = rcu_dereference_protected(svc->scheduler, 1);
1391 if (sched != old_sched) {
1392 if (old_sched) {
1393 ip_vs_unbind_scheduler(svc, old_sched);
1394 RCU_INIT_POINTER(svc->scheduler, NULL);
1395
1396 synchronize_rcu();
1397 }
1398
1399 if (sched) {
1400 ret = ip_vs_bind_scheduler(svc, sched);
1401 if (ret) {
1402 ip_vs_scheduler_put(sched);
1403 goto out;
1404 }
1405 }
1406 }
1407
1408
1409
1410
1411 svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1412 svc->timeout = u->timeout * HZ;
1413 svc->netmask = u->netmask;
1414
1415 old_pe = rcu_dereference_protected(svc->pe, 1);
1416 if (pe != old_pe) {
1417 rcu_assign_pointer(svc->pe, pe);
1418
1419 new_pe_conn_out = (pe && pe->conn_out) ? true : false;
1420 old_pe_conn_out = (old_pe && old_pe->conn_out) ? true : false;
1421 if (new_pe_conn_out && !old_pe_conn_out)
1422 atomic_inc(&svc->ipvs->conn_out_counter);
1423 if (old_pe_conn_out && !new_pe_conn_out)
1424 atomic_dec(&svc->ipvs->conn_out_counter);
1425 }
1426
1427out:
1428 ip_vs_scheduler_put(old_sched);
1429 ip_vs_pe_put(old_pe);
1430 return ret;
1431}
1432
1433
1434
1435
1436
1437
1438static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
1439{
1440 struct ip_vs_dest *dest, *nxt;
1441 struct ip_vs_scheduler *old_sched;
1442 struct ip_vs_pe *old_pe;
1443 struct netns_ipvs *ipvs = svc->ipvs;
1444
1445
1446 if (svc->af == AF_INET)
1447 ipvs->num_services--;
1448
1449 ip_vs_stop_estimator(svc->ipvs, &svc->stats);
1450
1451
1452 old_sched = rcu_dereference_protected(svc->scheduler, 1);
1453 ip_vs_unbind_scheduler(svc, old_sched);
1454 ip_vs_scheduler_put(old_sched);
1455
1456
1457 old_pe = rcu_dereference_protected(svc->pe, 1);
1458 if (old_pe && old_pe->conn_out)
1459 atomic_dec(&ipvs->conn_out_counter);
1460 ip_vs_pe_put(old_pe);
1461
1462
1463
1464
1465 list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1466 __ip_vs_unlink_dest(svc, dest, 0);
1467 __ip_vs_del_dest(svc->ipvs, dest, cleanup);
1468 }
1469
1470
1471
1472
1473 if (svc->port == FTPPORT)
1474 atomic_dec(&ipvs->ftpsvc_counter);
1475 else if (svc->port == 0)
1476 atomic_dec(&ipvs->nullsvc_counter);
1477
1478
1479
1480
1481 __ip_vs_svc_put(svc, true);
1482
1483
1484 ip_vs_use_count_dec();
1485}
1486
1487
1488
1489
1490static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup)
1491{
1492 ip_vs_unregister_conntrack(svc);
1493
1494 atomic_inc(&svc->refcnt);
1495
1496
1497
1498 ip_vs_svc_unhash(svc);
1499
1500 __ip_vs_del_service(svc, cleanup);
1501}
1502
1503
1504
1505
1506static int ip_vs_del_service(struct ip_vs_service *svc)
1507{
1508 if (svc == NULL)
1509 return -EEXIST;
1510 ip_vs_unlink_service(svc, false);
1511
1512 return 0;
1513}
1514
1515
1516
1517
1518
1519static int ip_vs_flush(struct netns_ipvs *ipvs, bool cleanup)
1520{
1521 int idx;
1522 struct ip_vs_service *svc;
1523 struct hlist_node *n;
1524
1525
1526
1527
1528 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1529 hlist_for_each_entry_safe(svc, n, &ip_vs_svc_table[idx],
1530 s_list) {
1531 if (svc->ipvs == ipvs)
1532 ip_vs_unlink_service(svc, cleanup);
1533 }
1534 }
1535
1536
1537
1538
1539 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1540 hlist_for_each_entry_safe(svc, n, &ip_vs_svc_fwm_table[idx],
1541 f_list) {
1542 if (svc->ipvs == ipvs)
1543 ip_vs_unlink_service(svc, cleanup);
1544 }
1545 }
1546
1547 return 0;
1548}
1549
1550
1551
1552
1553
1554void ip_vs_service_net_cleanup(struct netns_ipvs *ipvs)
1555{
1556 EnterFunction(2);
1557
1558 mutex_lock(&__ip_vs_mutex);
1559 ip_vs_flush(ipvs, true);
1560 mutex_unlock(&__ip_vs_mutex);
1561 LeaveFunction(2);
1562}
1563
1564
1565static inline void
1566ip_vs_forget_dev(struct ip_vs_dest *dest, struct net_device *dev)
1567{
1568 struct ip_vs_dest_dst *dest_dst;
1569
1570 spin_lock_bh(&dest->dst_lock);
1571 dest_dst = rcu_dereference_protected(dest->dest_dst, 1);
1572 if (dest_dst && dest_dst->dst_cache->dev == dev) {
1573 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1574 dev->name,
1575 IP_VS_DBG_ADDR(dest->af, &dest->addr),
1576 ntohs(dest->port),
1577 refcount_read(&dest->refcnt));
1578 __ip_vs_dst_cache_reset(dest);
1579 }
1580 spin_unlock_bh(&dest->dst_lock);
1581
1582}
1583
1584
1585
1586static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1587 void *ptr)
1588{
1589 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1590 struct net *net = dev_net(dev);
1591 struct netns_ipvs *ipvs = net_ipvs(net);
1592 struct ip_vs_service *svc;
1593 struct ip_vs_dest *dest;
1594 unsigned int idx;
1595
1596 if (event != NETDEV_DOWN || !ipvs)
1597 return NOTIFY_DONE;
1598 IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1599 EnterFunction(2);
1600 mutex_lock(&__ip_vs_mutex);
1601 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1602 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1603 if (svc->ipvs == ipvs) {
1604 list_for_each_entry(dest, &svc->destinations,
1605 n_list) {
1606 ip_vs_forget_dev(dest, dev);
1607 }
1608 }
1609 }
1610
1611 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1612 if (svc->ipvs == ipvs) {
1613 list_for_each_entry(dest, &svc->destinations,
1614 n_list) {
1615 ip_vs_forget_dev(dest, dev);
1616 }
1617 }
1618
1619 }
1620 }
1621
1622 spin_lock_bh(&ipvs->dest_trash_lock);
1623 list_for_each_entry(dest, &ipvs->dest_trash, t_list) {
1624 ip_vs_forget_dev(dest, dev);
1625 }
1626 spin_unlock_bh(&ipvs->dest_trash_lock);
1627 mutex_unlock(&__ip_vs_mutex);
1628 LeaveFunction(2);
1629 return NOTIFY_DONE;
1630}
1631
1632
1633
1634
1635static int ip_vs_zero_service(struct ip_vs_service *svc)
1636{
1637 struct ip_vs_dest *dest;
1638
1639 list_for_each_entry(dest, &svc->destinations, n_list) {
1640 ip_vs_zero_stats(&dest->stats);
1641 }
1642 ip_vs_zero_stats(&svc->stats);
1643 return 0;
1644}
1645
1646static int ip_vs_zero_all(struct netns_ipvs *ipvs)
1647{
1648 int idx;
1649 struct ip_vs_service *svc;
1650
1651 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1652 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1653 if (svc->ipvs == ipvs)
1654 ip_vs_zero_service(svc);
1655 }
1656 }
1657
1658 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1659 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1660 if (svc->ipvs == ipvs)
1661 ip_vs_zero_service(svc);
1662 }
1663 }
1664
1665 ip_vs_zero_stats(&ipvs->tot_stats);
1666 return 0;
1667}
1668
1669#ifdef CONFIG_SYSCTL
1670
1671static int zero;
1672static int three = 3;
1673
1674static int
1675proc_do_defense_mode(struct ctl_table *table, int write,
1676 void __user *buffer, size_t *lenp, loff_t *ppos)
1677{
1678 struct netns_ipvs *ipvs = table->extra2;
1679 int *valp = table->data;
1680 int val = *valp;
1681 int rc;
1682
1683 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1684 if (write && (*valp != val)) {
1685 if ((*valp < 0) || (*valp > 3)) {
1686
1687 *valp = val;
1688 } else {
1689 update_defense_level(ipvs);
1690 }
1691 }
1692 return rc;
1693}
1694
1695static int
1696proc_do_sync_threshold(struct ctl_table *table, int write,
1697 void __user *buffer, size_t *lenp, loff_t *ppos)
1698{
1699 int *valp = table->data;
1700 int val[2];
1701 int rc;
1702
1703
1704 memcpy(val, valp, sizeof(val));
1705
1706 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1707 if (write && (valp[0] < 0 || valp[1] < 0 ||
1708 (valp[0] >= valp[1] && valp[1]))) {
1709
1710 memcpy(valp, val, sizeof(val));
1711 }
1712 return rc;
1713}
1714
1715static int
1716proc_do_sync_mode(struct ctl_table *table, int write,
1717 void __user *buffer, size_t *lenp, loff_t *ppos)
1718{
1719 int *valp = table->data;
1720 int val = *valp;
1721 int rc;
1722
1723 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1724 if (write && (*valp != val)) {
1725 if ((*valp < 0) || (*valp > 1)) {
1726
1727 *valp = val;
1728 }
1729 }
1730 return rc;
1731}
1732
1733static int
1734proc_do_sync_ports(struct ctl_table *table, int write,
1735 void __user *buffer, size_t *lenp, loff_t *ppos)
1736{
1737 int *valp = table->data;
1738 int val = *valp;
1739 int rc;
1740
1741 rc = proc_dointvec(table, write, buffer, lenp, ppos);
1742 if (write && (*valp != val)) {
1743 if (*valp < 1 || !is_power_of_2(*valp)) {
1744
1745 *valp = val;
1746 }
1747 }
1748 return rc;
1749}
1750
1751
1752
1753
1754
1755
1756
1757static struct ctl_table vs_vars[] = {
1758 {
1759 .procname = "amemthresh",
1760 .maxlen = sizeof(int),
1761 .mode = 0644,
1762 .proc_handler = proc_dointvec,
1763 },
1764 {
1765 .procname = "am_droprate",
1766 .maxlen = sizeof(int),
1767 .mode = 0644,
1768 .proc_handler = proc_dointvec,
1769 },
1770 {
1771 .procname = "drop_entry",
1772 .maxlen = sizeof(int),
1773 .mode = 0644,
1774 .proc_handler = proc_do_defense_mode,
1775 },
1776 {
1777 .procname = "drop_packet",
1778 .maxlen = sizeof(int),
1779 .mode = 0644,
1780 .proc_handler = proc_do_defense_mode,
1781 },
1782#ifdef CONFIG_IP_VS_NFCT
1783 {
1784 .procname = "conntrack",
1785 .maxlen = sizeof(int),
1786 .mode = 0644,
1787 .proc_handler = &proc_dointvec,
1788 },
1789#endif
1790 {
1791 .procname = "secure_tcp",
1792 .maxlen = sizeof(int),
1793 .mode = 0644,
1794 .proc_handler = proc_do_defense_mode,
1795 },
1796 {
1797 .procname = "snat_reroute",
1798 .maxlen = sizeof(int),
1799 .mode = 0644,
1800 .proc_handler = &proc_dointvec,
1801 },
1802 {
1803 .procname = "sync_version",
1804 .maxlen = sizeof(int),
1805 .mode = 0644,
1806 .proc_handler = proc_do_sync_mode,
1807 },
1808 {
1809 .procname = "sync_ports",
1810 .maxlen = sizeof(int),
1811 .mode = 0644,
1812 .proc_handler = proc_do_sync_ports,
1813 },
1814 {
1815 .procname = "sync_persist_mode",
1816 .maxlen = sizeof(int),
1817 .mode = 0644,
1818 .proc_handler = proc_dointvec,
1819 },
1820 {
1821 .procname = "sync_qlen_max",
1822 .maxlen = sizeof(unsigned long),
1823 .mode = 0644,
1824 .proc_handler = proc_doulongvec_minmax,
1825 },
1826 {
1827 .procname = "sync_sock_size",
1828 .maxlen = sizeof(int),
1829 .mode = 0644,
1830 .proc_handler = proc_dointvec,
1831 },
1832 {
1833 .procname = "cache_bypass",
1834 .maxlen = sizeof(int),
1835 .mode = 0644,
1836 .proc_handler = proc_dointvec,
1837 },
1838 {
1839 .procname = "expire_nodest_conn",
1840 .maxlen = sizeof(int),
1841 .mode = 0644,
1842 .proc_handler = proc_dointvec,
1843 },
1844 {
1845 .procname = "sloppy_tcp",
1846 .maxlen = sizeof(int),
1847 .mode = 0644,
1848 .proc_handler = proc_dointvec,
1849 },
1850 {
1851 .procname = "sloppy_sctp",
1852 .maxlen = sizeof(int),
1853 .mode = 0644,
1854 .proc_handler = proc_dointvec,
1855 },
1856 {
1857 .procname = "expire_quiescent_template",
1858 .maxlen = sizeof(int),
1859 .mode = 0644,
1860 .proc_handler = proc_dointvec,
1861 },
1862 {
1863 .procname = "sync_threshold",
1864 .maxlen =
1865 sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1866 .mode = 0644,
1867 .proc_handler = proc_do_sync_threshold,
1868 },
1869 {
1870 .procname = "sync_refresh_period",
1871 .maxlen = sizeof(int),
1872 .mode = 0644,
1873 .proc_handler = proc_dointvec_jiffies,
1874 },
1875 {
1876 .procname = "sync_retries",
1877 .maxlen = sizeof(int),
1878 .mode = 0644,
1879 .proc_handler = proc_dointvec_minmax,
1880 .extra1 = &zero,
1881 .extra2 = &three,
1882 },
1883 {
1884 .procname = "nat_icmp_send",
1885 .maxlen = sizeof(int),
1886 .mode = 0644,
1887 .proc_handler = proc_dointvec,
1888 },
1889 {
1890 .procname = "pmtu_disc",
1891 .maxlen = sizeof(int),
1892 .mode = 0644,
1893 .proc_handler = proc_dointvec,
1894 },
1895 {
1896 .procname = "backup_only",
1897 .maxlen = sizeof(int),
1898 .mode = 0644,
1899 .proc_handler = proc_dointvec,
1900 },
1901 {
1902 .procname = "conn_reuse_mode",
1903 .maxlen = sizeof(int),
1904 .mode = 0644,
1905 .proc_handler = proc_dointvec,
1906 },
1907 {
1908 .procname = "schedule_icmp",
1909 .maxlen = sizeof(int),
1910 .mode = 0644,
1911 .proc_handler = proc_dointvec,
1912 },
1913 {
1914 .procname = "ignore_tunneled",
1915 .maxlen = sizeof(int),
1916 .mode = 0644,
1917 .proc_handler = proc_dointvec,
1918 },
1919#ifdef CONFIG_IP_VS_DEBUG
1920 {
1921 .procname = "debug_level",
1922 .data = &sysctl_ip_vs_debug_level,
1923 .maxlen = sizeof(int),
1924 .mode = 0644,
1925 .proc_handler = proc_dointvec,
1926 },
1927#endif
1928 { }
1929};
1930
1931#endif
1932
1933#ifdef CONFIG_PROC_FS
1934
1935struct ip_vs_iter {
1936 struct seq_net_private p;
1937 struct hlist_head *table;
1938 int bucket;
1939};
1940
1941
1942
1943
1944
1945static inline const char *ip_vs_fwd_name(unsigned int flags)
1946{
1947 switch (flags & IP_VS_CONN_F_FWD_MASK) {
1948 case IP_VS_CONN_F_LOCALNODE:
1949 return "Local";
1950 case IP_VS_CONN_F_TUNNEL:
1951 return "Tunnel";
1952 case IP_VS_CONN_F_DROUTE:
1953 return "Route";
1954 default:
1955 return "Masq";
1956 }
1957}
1958
1959
1960
1961static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1962{
1963 struct net *net = seq_file_net(seq);
1964 struct netns_ipvs *ipvs = net_ipvs(net);
1965 struct ip_vs_iter *iter = seq->private;
1966 int idx;
1967 struct ip_vs_service *svc;
1968
1969
1970 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1971 hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[idx], s_list) {
1972 if ((svc->ipvs == ipvs) && pos-- == 0) {
1973 iter->table = ip_vs_svc_table;
1974 iter->bucket = idx;
1975 return svc;
1976 }
1977 }
1978 }
1979
1980
1981 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1982 hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[idx],
1983 f_list) {
1984 if ((svc->ipvs == ipvs) && pos-- == 0) {
1985 iter->table = ip_vs_svc_fwm_table;
1986 iter->bucket = idx;
1987 return svc;
1988 }
1989 }
1990 }
1991
1992 return NULL;
1993}
1994
1995static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1996 __acquires(RCU)
1997{
1998 rcu_read_lock();
1999 return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
2000}
2001
2002
2003static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2004{
2005 struct hlist_node *e;
2006 struct ip_vs_iter *iter;
2007 struct ip_vs_service *svc;
2008
2009 ++*pos;
2010 if (v == SEQ_START_TOKEN)
2011 return ip_vs_info_array(seq,0);
2012
2013 svc = v;
2014 iter = seq->private;
2015
2016 if (iter->table == ip_vs_svc_table) {
2017
2018 e = rcu_dereference(hlist_next_rcu(&svc->s_list));
2019 if (e)
2020 return hlist_entry(e, struct ip_vs_service, s_list);
2021
2022 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2023 hlist_for_each_entry_rcu(svc,
2024 &ip_vs_svc_table[iter->bucket],
2025 s_list) {
2026 return svc;
2027 }
2028 }
2029
2030 iter->table = ip_vs_svc_fwm_table;
2031 iter->bucket = -1;
2032 goto scan_fwmark;
2033 }
2034
2035
2036 e = rcu_dereference(hlist_next_rcu(&svc->f_list));
2037 if (e)
2038 return hlist_entry(e, struct ip_vs_service, f_list);
2039
2040 scan_fwmark:
2041 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2042 hlist_for_each_entry_rcu(svc,
2043 &ip_vs_svc_fwm_table[iter->bucket],
2044 f_list)
2045 return svc;
2046 }
2047
2048 return NULL;
2049}
2050
2051static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
2052 __releases(RCU)
2053{
2054 rcu_read_unlock();
2055}
2056
2057
2058static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
2059{
2060 if (v == SEQ_START_TOKEN) {
2061 seq_printf(seq,
2062 "IP Virtual Server version %d.%d.%d (size=%d)\n",
2063 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2064 seq_puts(seq,
2065 "Prot LocalAddress:Port Scheduler Flags\n");
2066 seq_puts(seq,
2067 " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
2068 } else {
2069 struct net *net = seq_file_net(seq);
2070 struct netns_ipvs *ipvs = net_ipvs(net);
2071 const struct ip_vs_service *svc = v;
2072 const struct ip_vs_iter *iter = seq->private;
2073 const struct ip_vs_dest *dest;
2074 struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
2075 char *sched_name = sched ? sched->name : "none";
2076
2077 if (svc->ipvs != ipvs)
2078 return 0;
2079 if (iter->table == ip_vs_svc_table) {
2080#ifdef CONFIG_IP_VS_IPV6
2081 if (svc->af == AF_INET6)
2082 seq_printf(seq, "%s [%pI6]:%04X %s ",
2083 ip_vs_proto_name(svc->protocol),
2084 &svc->addr.in6,
2085 ntohs(svc->port),
2086 sched_name);
2087 else
2088#endif
2089 seq_printf(seq, "%s %08X:%04X %s %s ",
2090 ip_vs_proto_name(svc->protocol),
2091 ntohl(svc->addr.ip),
2092 ntohs(svc->port),
2093 sched_name,
2094 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2095 } else {
2096 seq_printf(seq, "FWM %08X %s %s",
2097 svc->fwmark, sched_name,
2098 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2099 }
2100
2101 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2102 seq_printf(seq, "persistent %d %08X\n",
2103 svc->timeout,
2104 ntohl(svc->netmask));
2105 else
2106 seq_putc(seq, '\n');
2107
2108 list_for_each_entry_rcu(dest, &svc->destinations, n_list) {
2109#ifdef CONFIG_IP_VS_IPV6
2110 if (dest->af == AF_INET6)
2111 seq_printf(seq,
2112 " -> [%pI6]:%04X"
2113 " %-7s %-6d %-10d %-10d\n",
2114 &dest->addr.in6,
2115 ntohs(dest->port),
2116 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2117 atomic_read(&dest->weight),
2118 atomic_read(&dest->activeconns),
2119 atomic_read(&dest->inactconns));
2120 else
2121#endif
2122 seq_printf(seq,
2123 " -> %08X:%04X "
2124 "%-7s %-6d %-10d %-10d\n",
2125 ntohl(dest->addr.ip),
2126 ntohs(dest->port),
2127 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2128 atomic_read(&dest->weight),
2129 atomic_read(&dest->activeconns),
2130 atomic_read(&dest->inactconns));
2131
2132 }
2133 }
2134 return 0;
2135}
2136
2137static const struct seq_operations ip_vs_info_seq_ops = {
2138 .start = ip_vs_info_seq_start,
2139 .next = ip_vs_info_seq_next,
2140 .stop = ip_vs_info_seq_stop,
2141 .show = ip_vs_info_seq_show,
2142};
2143
2144static int ip_vs_stats_show(struct seq_file *seq, void *v)
2145{
2146 struct net *net = seq_file_single_net(seq);
2147 struct ip_vs_kstats show;
2148
2149
2150 seq_puts(seq,
2151 " Total Incoming Outgoing Incoming Outgoing\n");
2152 seq_puts(seq,
2153 " Conns Packets Packets Bytes Bytes\n");
2154
2155 ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2156 seq_printf(seq, "%8LX %8LX %8LX %16LX %16LX\n\n",
2157 (unsigned long long)show.conns,
2158 (unsigned long long)show.inpkts,
2159 (unsigned long long)show.outpkts,
2160 (unsigned long long)show.inbytes,
2161 (unsigned long long)show.outbytes);
2162
2163
2164 seq_puts(seq,
2165 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
2166 seq_printf(seq, "%8LX %8LX %8LX %16LX %16LX\n",
2167 (unsigned long long)show.cps,
2168 (unsigned long long)show.inpps,
2169 (unsigned long long)show.outpps,
2170 (unsigned long long)show.inbps,
2171 (unsigned long long)show.outbps);
2172
2173 return 0;
2174}
2175
2176static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2177{
2178 struct net *net = seq_file_single_net(seq);
2179 struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2180 struct ip_vs_cpu_stats __percpu *cpustats = tot_stats->cpustats;
2181 struct ip_vs_kstats kstats;
2182 int i;
2183
2184
2185 seq_puts(seq,
2186 " Total Incoming Outgoing Incoming Outgoing\n");
2187 seq_puts(seq,
2188 "CPU Conns Packets Packets Bytes Bytes\n");
2189
2190 for_each_possible_cpu(i) {
2191 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2192 unsigned int start;
2193 u64 conns, inpkts, outpkts, inbytes, outbytes;
2194
2195 do {
2196 start = u64_stats_fetch_begin_irq(&u->syncp);
2197 conns = u->cnt.conns;
2198 inpkts = u->cnt.inpkts;
2199 outpkts = u->cnt.outpkts;
2200 inbytes = u->cnt.inbytes;
2201 outbytes = u->cnt.outbytes;
2202 } while (u64_stats_fetch_retry_irq(&u->syncp, start));
2203
2204 seq_printf(seq, "%3X %8LX %8LX %8LX %16LX %16LX\n",
2205 i, (u64)conns, (u64)inpkts,
2206 (u64)outpkts, (u64)inbytes,
2207 (u64)outbytes);
2208 }
2209
2210 ip_vs_copy_stats(&kstats, tot_stats);
2211
2212 seq_printf(seq, " ~ %8LX %8LX %8LX %16LX %16LX\n\n",
2213 (unsigned long long)kstats.conns,
2214 (unsigned long long)kstats.inpkts,
2215 (unsigned long long)kstats.outpkts,
2216 (unsigned long long)kstats.inbytes,
2217 (unsigned long long)kstats.outbytes);
2218
2219
2220 seq_puts(seq,
2221 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
2222 seq_printf(seq, " %8LX %8LX %8LX %16LX %16LX\n",
2223 kstats.cps,
2224 kstats.inpps,
2225 kstats.outpps,
2226 kstats.inbps,
2227 kstats.outbps);
2228
2229 return 0;
2230}
2231#endif
2232
2233
2234
2235
2236static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user *u)
2237{
2238#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2239 struct ip_vs_proto_data *pd;
2240#endif
2241
2242 IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2243 u->tcp_timeout,
2244 u->tcp_fin_timeout,
2245 u->udp_timeout);
2246
2247#ifdef CONFIG_IP_VS_PROTO_TCP
2248 if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) ||
2249 u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) {
2250 return -EINVAL;
2251 }
2252#endif
2253
2254#ifdef CONFIG_IP_VS_PROTO_UDP
2255 if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ))
2256 return -EINVAL;
2257#endif
2258
2259#ifdef CONFIG_IP_VS_PROTO_TCP
2260 if (u->tcp_timeout) {
2261 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
2262 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2263 = u->tcp_timeout * HZ;
2264 }
2265
2266 if (u->tcp_fin_timeout) {
2267 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
2268 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2269 = u->tcp_fin_timeout * HZ;
2270 }
2271#endif
2272
2273#ifdef CONFIG_IP_VS_PROTO_UDP
2274 if (u->udp_timeout) {
2275 pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
2276 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2277 = u->udp_timeout * HZ;
2278 }
2279#endif
2280 return 0;
2281}
2282
2283#define CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2284
2285struct ip_vs_svcdest_user {
2286 struct ip_vs_service_user s;
2287 struct ip_vs_dest_user d;
2288};
2289
2290static const unsigned char set_arglen[CMDID(IP_VS_SO_SET_MAX) + 1] = {
2291 [CMDID(IP_VS_SO_SET_ADD)] = sizeof(struct ip_vs_service_user),
2292 [CMDID(IP_VS_SO_SET_EDIT)] = sizeof(struct ip_vs_service_user),
2293 [CMDID(IP_VS_SO_SET_DEL)] = sizeof(struct ip_vs_service_user),
2294 [CMDID(IP_VS_SO_SET_ADDDEST)] = sizeof(struct ip_vs_svcdest_user),
2295 [CMDID(IP_VS_SO_SET_DELDEST)] = sizeof(struct ip_vs_svcdest_user),
2296 [CMDID(IP_VS_SO_SET_EDITDEST)] = sizeof(struct ip_vs_svcdest_user),
2297 [CMDID(IP_VS_SO_SET_TIMEOUT)] = sizeof(struct ip_vs_timeout_user),
2298 [CMDID(IP_VS_SO_SET_STARTDAEMON)] = sizeof(struct ip_vs_daemon_user),
2299 [CMDID(IP_VS_SO_SET_STOPDAEMON)] = sizeof(struct ip_vs_daemon_user),
2300 [CMDID(IP_VS_SO_SET_ZERO)] = sizeof(struct ip_vs_service_user),
2301};
2302
2303union ip_vs_set_arglen {
2304 struct ip_vs_service_user field_IP_VS_SO_SET_ADD;
2305 struct ip_vs_service_user field_IP_VS_SO_SET_EDIT;
2306 struct ip_vs_service_user field_IP_VS_SO_SET_DEL;
2307 struct ip_vs_svcdest_user field_IP_VS_SO_SET_ADDDEST;
2308 struct ip_vs_svcdest_user field_IP_VS_SO_SET_DELDEST;
2309 struct ip_vs_svcdest_user field_IP_VS_SO_SET_EDITDEST;
2310 struct ip_vs_timeout_user field_IP_VS_SO_SET_TIMEOUT;
2311 struct ip_vs_daemon_user field_IP_VS_SO_SET_STARTDAEMON;
2312 struct ip_vs_daemon_user field_IP_VS_SO_SET_STOPDAEMON;
2313 struct ip_vs_service_user field_IP_VS_SO_SET_ZERO;
2314};
2315
2316#define MAX_SET_ARGLEN sizeof(union ip_vs_set_arglen)
2317
2318static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2319 struct ip_vs_service_user *usvc_compat)
2320{
2321 memset(usvc, 0, sizeof(*usvc));
2322
2323 usvc->af = AF_INET;
2324 usvc->protocol = usvc_compat->protocol;
2325 usvc->addr.ip = usvc_compat->addr;
2326 usvc->port = usvc_compat->port;
2327 usvc->fwmark = usvc_compat->fwmark;
2328
2329
2330 usvc->sched_name = usvc_compat->sched_name;
2331
2332 usvc->flags = usvc_compat->flags;
2333 usvc->timeout = usvc_compat->timeout;
2334 usvc->netmask = usvc_compat->netmask;
2335}
2336
2337static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2338 struct ip_vs_dest_user *udest_compat)
2339{
2340 memset(udest, 0, sizeof(*udest));
2341
2342 udest->addr.ip = udest_compat->addr;
2343 udest->port = udest_compat->port;
2344 udest->conn_flags = udest_compat->conn_flags;
2345 udest->weight = udest_compat->weight;
2346 udest->u_threshold = udest_compat->u_threshold;
2347 udest->l_threshold = udest_compat->l_threshold;
2348 udest->af = AF_INET;
2349 udest->tun_type = IP_VS_CONN_F_TUNNEL_TYPE_IPIP;
2350}
2351
2352static int
2353do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2354{
2355 struct net *net = sock_net(sk);
2356 int ret;
2357 unsigned char arg[MAX_SET_ARGLEN];
2358 struct ip_vs_service_user *usvc_compat;
2359 struct ip_vs_service_user_kern usvc;
2360 struct ip_vs_service *svc;
2361 struct ip_vs_dest_user *udest_compat;
2362 struct ip_vs_dest_user_kern udest;
2363 struct netns_ipvs *ipvs = net_ipvs(net);
2364
2365 BUILD_BUG_ON(sizeof(arg) > 255);
2366 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2367 return -EPERM;
2368
2369 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2370 return -EINVAL;
2371 if (len != set_arglen[CMDID(cmd)]) {
2372 IP_VS_DBG(1, "set_ctl: len %u != %u\n",
2373 len, set_arglen[CMDID(cmd)]);
2374 return -EINVAL;
2375 }
2376
2377 if (copy_from_user(arg, user, len) != 0)
2378 return -EFAULT;
2379
2380
2381 ip_vs_use_count_inc();
2382
2383
2384 if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2385 cmd == IP_VS_SO_SET_STOPDAEMON) {
2386 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2387
2388 if (cmd == IP_VS_SO_SET_STARTDAEMON) {
2389 struct ipvs_sync_daemon_cfg cfg;
2390
2391 memset(&cfg, 0, sizeof(cfg));
2392 ret = -EINVAL;
2393 if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
2394 sizeof(cfg.mcast_ifn)) <= 0)
2395 goto out_dec;
2396 cfg.syncid = dm->syncid;
2397 ret = start_sync_thread(ipvs, &cfg, dm->state);
2398 } else {
2399 mutex_lock(&ipvs->sync_mutex);
2400 ret = stop_sync_thread(ipvs, dm->state);
2401 mutex_unlock(&ipvs->sync_mutex);
2402 }
2403 goto out_dec;
2404 }
2405
2406 mutex_lock(&__ip_vs_mutex);
2407 if (cmd == IP_VS_SO_SET_FLUSH) {
2408
2409 ret = ip_vs_flush(ipvs, false);
2410 goto out_unlock;
2411 } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2412
2413 ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
2414 goto out_unlock;
2415 }
2416
2417 usvc_compat = (struct ip_vs_service_user *)arg;
2418 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2419
2420
2421
2422 ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2423 ip_vs_copy_udest_compat(&udest, udest_compat);
2424
2425 if (cmd == IP_VS_SO_SET_ZERO) {
2426
2427 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2428 ret = ip_vs_zero_all(ipvs);
2429 goto out_unlock;
2430 }
2431 }
2432
2433 if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) &&
2434 strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) ==
2435 IP_VS_SCHEDNAME_MAXLEN) {
2436 ret = -EINVAL;
2437 goto out_unlock;
2438 }
2439
2440
2441 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2442 usvc.protocol != IPPROTO_SCTP) {
2443 pr_err("set_ctl: invalid protocol: %d %pI4:%d\n",
2444 usvc.protocol, &usvc.addr.ip,
2445 ntohs(usvc.port));
2446 ret = -EFAULT;
2447 goto out_unlock;
2448 }
2449
2450
2451 rcu_read_lock();
2452 if (usvc.fwmark == 0)
2453 svc = __ip_vs_service_find(ipvs, usvc.af, usvc.protocol,
2454 &usvc.addr, usvc.port);
2455 else
2456 svc = __ip_vs_svc_fwm_find(ipvs, usvc.af, usvc.fwmark);
2457 rcu_read_unlock();
2458
2459 if (cmd != IP_VS_SO_SET_ADD
2460 && (svc == NULL || svc->protocol != usvc.protocol)) {
2461 ret = -ESRCH;
2462 goto out_unlock;
2463 }
2464
2465 switch (cmd) {
2466 case IP_VS_SO_SET_ADD:
2467 if (svc != NULL)
2468 ret = -EEXIST;
2469 else
2470 ret = ip_vs_add_service(ipvs, &usvc, &svc);
2471 break;
2472 case IP_VS_SO_SET_EDIT:
2473 ret = ip_vs_edit_service(svc, &usvc);
2474 break;
2475 case IP_VS_SO_SET_DEL:
2476 ret = ip_vs_del_service(svc);
2477 if (!ret)
2478 goto out_unlock;
2479 break;
2480 case IP_VS_SO_SET_ZERO:
2481 ret = ip_vs_zero_service(svc);
2482 break;
2483 case IP_VS_SO_SET_ADDDEST:
2484 ret = ip_vs_add_dest(svc, &udest);
2485 break;
2486 case IP_VS_SO_SET_EDITDEST:
2487 ret = ip_vs_edit_dest(svc, &udest);
2488 break;
2489 case IP_VS_SO_SET_DELDEST:
2490 ret = ip_vs_del_dest(svc, &udest);
2491 break;
2492 default:
2493 ret = -EINVAL;
2494 }
2495
2496 out_unlock:
2497 mutex_unlock(&__ip_vs_mutex);
2498 out_dec:
2499
2500 ip_vs_use_count_dec();
2501
2502 return ret;
2503}
2504
2505
2506static void
2507ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2508{
2509 struct ip_vs_scheduler *sched;
2510 struct ip_vs_kstats kstats;
2511 char *sched_name;
2512
2513 sched = rcu_dereference_protected(src->scheduler, 1);
2514 sched_name = sched ? sched->name : "none";
2515 dst->protocol = src->protocol;
2516 dst->addr = src->addr.ip;
2517 dst->port = src->port;
2518 dst->fwmark = src->fwmark;
2519 strlcpy(dst->sched_name, sched_name, sizeof(dst->sched_name));
2520 dst->flags = src->flags;
2521 dst->timeout = src->timeout / HZ;
2522 dst->netmask = src->netmask;
2523 dst->num_dests = src->num_dests;
2524 ip_vs_copy_stats(&kstats, &src->stats);
2525 ip_vs_export_stats_user(&dst->stats, &kstats);
2526}
2527
2528static inline int
2529__ip_vs_get_service_entries(struct netns_ipvs *ipvs,
2530 const struct ip_vs_get_services *get,
2531 struct ip_vs_get_services __user *uptr)
2532{
2533 int idx, count=0;
2534 struct ip_vs_service *svc;
2535 struct ip_vs_service_entry entry;
2536 int ret = 0;
2537
2538 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2539 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2540
2541 if (svc->af != AF_INET || (svc->ipvs != ipvs))
2542 continue;
2543
2544 if (count >= get->num_services)
2545 goto out;
2546 memset(&entry, 0, sizeof(entry));
2547 ip_vs_copy_service(&entry, svc);
2548 if (copy_to_user(&uptr->entrytable[count],
2549 &entry, sizeof(entry))) {
2550 ret = -EFAULT;
2551 goto out;
2552 }
2553 count++;
2554 }
2555 }
2556
2557 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2558 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2559
2560 if (svc->af != AF_INET || (svc->ipvs != ipvs))
2561 continue;
2562
2563 if (count >= get->num_services)
2564 goto out;
2565 memset(&entry, 0, sizeof(entry));
2566 ip_vs_copy_service(&entry, svc);
2567 if (copy_to_user(&uptr->entrytable[count],
2568 &entry, sizeof(entry))) {
2569 ret = -EFAULT;
2570 goto out;
2571 }
2572 count++;
2573 }
2574 }
2575out:
2576 return ret;
2577}
2578
2579static inline int
2580__ip_vs_get_dest_entries(struct netns_ipvs *ipvs, const struct ip_vs_get_dests *get,
2581 struct ip_vs_get_dests __user *uptr)
2582{
2583 struct ip_vs_service *svc;
2584 union nf_inet_addr addr = { .ip = get->addr };
2585 int ret = 0;
2586
2587 rcu_read_lock();
2588 if (get->fwmark)
2589 svc = __ip_vs_svc_fwm_find(ipvs, AF_INET, get->fwmark);
2590 else
2591 svc = __ip_vs_service_find(ipvs, AF_INET, get->protocol, &addr,
2592 get->port);
2593 rcu_read_unlock();
2594
2595 if (svc) {
2596 int count = 0;
2597 struct ip_vs_dest *dest;
2598 struct ip_vs_dest_entry entry;
2599 struct ip_vs_kstats kstats;
2600
2601 memset(&entry, 0, sizeof(entry));
2602 list_for_each_entry(dest, &svc->destinations, n_list) {
2603 if (count >= get->num_dests)
2604 break;
2605
2606
2607
2608
2609 if (dest->af != svc->af)
2610 continue;
2611
2612 entry.addr = dest->addr.ip;
2613 entry.port = dest->port;
2614 entry.conn_flags = atomic_read(&dest->conn_flags);
2615 entry.weight = atomic_read(&dest->weight);
2616 entry.u_threshold = dest->u_threshold;
2617 entry.l_threshold = dest->l_threshold;
2618 entry.activeconns = atomic_read(&dest->activeconns);
2619 entry.inactconns = atomic_read(&dest->inactconns);
2620 entry.persistconns = atomic_read(&dest->persistconns);
2621 ip_vs_copy_stats(&kstats, &dest->stats);
2622 ip_vs_export_stats_user(&entry.stats, &kstats);
2623 if (copy_to_user(&uptr->entrytable[count],
2624 &entry, sizeof(entry))) {
2625 ret = -EFAULT;
2626 break;
2627 }
2628 count++;
2629 }
2630 } else
2631 ret = -ESRCH;
2632 return ret;
2633}
2634
2635static inline void
2636__ip_vs_get_timeouts(struct netns_ipvs *ipvs, struct ip_vs_timeout_user *u)
2637{
2638#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2639 struct ip_vs_proto_data *pd;
2640#endif
2641
2642 memset(u, 0, sizeof (*u));
2643
2644#ifdef CONFIG_IP_VS_PROTO_TCP
2645 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
2646 u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2647 u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2648#endif
2649#ifdef CONFIG_IP_VS_PROTO_UDP
2650 pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
2651 u->udp_timeout =
2652 pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2653#endif
2654}
2655
2656static const unsigned char get_arglen[CMDID(IP_VS_SO_GET_MAX) + 1] = {
2657 [CMDID(IP_VS_SO_GET_VERSION)] = 64,
2658 [CMDID(IP_VS_SO_GET_INFO)] = sizeof(struct ip_vs_getinfo),
2659 [CMDID(IP_VS_SO_GET_SERVICES)] = sizeof(struct ip_vs_get_services),
2660 [CMDID(IP_VS_SO_GET_SERVICE)] = sizeof(struct ip_vs_service_entry),
2661 [CMDID(IP_VS_SO_GET_DESTS)] = sizeof(struct ip_vs_get_dests),
2662 [CMDID(IP_VS_SO_GET_TIMEOUT)] = sizeof(struct ip_vs_timeout_user),
2663 [CMDID(IP_VS_SO_GET_DAEMON)] = 2 * sizeof(struct ip_vs_daemon_user),
2664};
2665
2666union ip_vs_get_arglen {
2667 char field_IP_VS_SO_GET_VERSION[64];
2668 struct ip_vs_getinfo field_IP_VS_SO_GET_INFO;
2669 struct ip_vs_get_services field_IP_VS_SO_GET_SERVICES;
2670 struct ip_vs_service_entry field_IP_VS_SO_GET_SERVICE;
2671 struct ip_vs_get_dests field_IP_VS_SO_GET_DESTS;
2672 struct ip_vs_timeout_user field_IP_VS_SO_GET_TIMEOUT;
2673 struct ip_vs_daemon_user field_IP_VS_SO_GET_DAEMON[2];
2674};
2675
2676#define MAX_GET_ARGLEN sizeof(union ip_vs_get_arglen)
2677
2678static int
2679do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2680{
2681 unsigned char arg[MAX_GET_ARGLEN];
2682 int ret = 0;
2683 unsigned int copylen;
2684 struct net *net = sock_net(sk);
2685 struct netns_ipvs *ipvs = net_ipvs(net);
2686
2687 BUG_ON(!net);
2688 BUILD_BUG_ON(sizeof(arg) > 255);
2689 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2690 return -EPERM;
2691
2692 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2693 return -EINVAL;
2694
2695 copylen = get_arglen[CMDID(cmd)];
2696 if (*len < (int) copylen) {
2697 IP_VS_DBG(1, "get_ctl: len %d < %u\n", *len, copylen);
2698 return -EINVAL;
2699 }
2700
2701 if (copy_from_user(arg, user, copylen) != 0)
2702 return -EFAULT;
2703
2704
2705
2706 if (cmd == IP_VS_SO_GET_DAEMON) {
2707 struct ip_vs_daemon_user d[2];
2708
2709 memset(&d, 0, sizeof(d));
2710 mutex_lock(&ipvs->sync_mutex);
2711 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2712 d[0].state = IP_VS_STATE_MASTER;
2713 strlcpy(d[0].mcast_ifn, ipvs->mcfg.mcast_ifn,
2714 sizeof(d[0].mcast_ifn));
2715 d[0].syncid = ipvs->mcfg.syncid;
2716 }
2717 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2718 d[1].state = IP_VS_STATE_BACKUP;
2719 strlcpy(d[1].mcast_ifn, ipvs->bcfg.mcast_ifn,
2720 sizeof(d[1].mcast_ifn));
2721 d[1].syncid = ipvs->bcfg.syncid;
2722 }
2723 if (copy_to_user(user, &d, sizeof(d)) != 0)
2724 ret = -EFAULT;
2725 mutex_unlock(&ipvs->sync_mutex);
2726 return ret;
2727 }
2728
2729 mutex_lock(&__ip_vs_mutex);
2730 switch (cmd) {
2731 case IP_VS_SO_GET_VERSION:
2732 {
2733 char buf[64];
2734
2735 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2736 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2737 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2738 ret = -EFAULT;
2739 goto out;
2740 }
2741 *len = strlen(buf)+1;
2742 }
2743 break;
2744
2745 case IP_VS_SO_GET_INFO:
2746 {
2747 struct ip_vs_getinfo info;
2748 info.version = IP_VS_VERSION_CODE;
2749 info.size = ip_vs_conn_tab_size;
2750 info.num_services = ipvs->num_services;
2751 if (copy_to_user(user, &info, sizeof(info)) != 0)
2752 ret = -EFAULT;
2753 }
2754 break;
2755
2756 case IP_VS_SO_GET_SERVICES:
2757 {
2758 struct ip_vs_get_services *get;
2759 int size;
2760
2761 get = (struct ip_vs_get_services *)arg;
2762 size = struct_size(get, entrytable, get->num_services);
2763 if (*len != size) {
2764 pr_err("length: %u != %u\n", *len, size);
2765 ret = -EINVAL;
2766 goto out;
2767 }
2768 ret = __ip_vs_get_service_entries(ipvs, get, user);
2769 }
2770 break;
2771
2772 case IP_VS_SO_GET_SERVICE:
2773 {
2774 struct ip_vs_service_entry *entry;
2775 struct ip_vs_service *svc;
2776 union nf_inet_addr addr;
2777
2778 entry = (struct ip_vs_service_entry *)arg;
2779 addr.ip = entry->addr;
2780 rcu_read_lock();
2781 if (entry->fwmark)
2782 svc = __ip_vs_svc_fwm_find(ipvs, AF_INET, entry->fwmark);
2783 else
2784 svc = __ip_vs_service_find(ipvs, AF_INET,
2785 entry->protocol, &addr,
2786 entry->port);
2787 rcu_read_unlock();
2788 if (svc) {
2789 ip_vs_copy_service(entry, svc);
2790 if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2791 ret = -EFAULT;
2792 } else
2793 ret = -ESRCH;
2794 }
2795 break;
2796
2797 case IP_VS_SO_GET_DESTS:
2798 {
2799 struct ip_vs_get_dests *get;
2800 int size;
2801
2802 get = (struct ip_vs_get_dests *)arg;
2803 size = struct_size(get, entrytable, get->num_dests);
2804 if (*len != size) {
2805 pr_err("length: %u != %u\n", *len, size);
2806 ret = -EINVAL;
2807 goto out;
2808 }
2809 ret = __ip_vs_get_dest_entries(ipvs, get, user);
2810 }
2811 break;
2812
2813 case IP_VS_SO_GET_TIMEOUT:
2814 {
2815 struct ip_vs_timeout_user t;
2816
2817 __ip_vs_get_timeouts(ipvs, &t);
2818 if (copy_to_user(user, &t, sizeof(t)) != 0)
2819 ret = -EFAULT;
2820 }
2821 break;
2822
2823 default:
2824 ret = -EINVAL;
2825 }
2826
2827out:
2828 mutex_unlock(&__ip_vs_mutex);
2829 return ret;
2830}
2831
2832
2833static struct nf_sockopt_ops ip_vs_sockopts = {
2834 .pf = PF_INET,
2835 .set_optmin = IP_VS_BASE_CTL,
2836 .set_optmax = IP_VS_SO_SET_MAX+1,
2837 .set = do_ip_vs_set_ctl,
2838 .get_optmin = IP_VS_BASE_CTL,
2839 .get_optmax = IP_VS_SO_GET_MAX+1,
2840 .get = do_ip_vs_get_ctl,
2841 .owner = THIS_MODULE,
2842};
2843
2844
2845
2846
2847
2848
2849static struct genl_family ip_vs_genl_family;
2850
2851
2852static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2853 [IPVS_CMD_ATTR_SERVICE] = { .type = NLA_NESTED },
2854 [IPVS_CMD_ATTR_DEST] = { .type = NLA_NESTED },
2855 [IPVS_CMD_ATTR_DAEMON] = { .type = NLA_NESTED },
2856 [IPVS_CMD_ATTR_TIMEOUT_TCP] = { .type = NLA_U32 },
2857 [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2858 [IPVS_CMD_ATTR_TIMEOUT_UDP] = { .type = NLA_U32 },
2859};
2860
2861
2862static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2863 [IPVS_DAEMON_ATTR_STATE] = { .type = NLA_U32 },
2864 [IPVS_DAEMON_ATTR_MCAST_IFN] = { .type = NLA_NUL_STRING,
2865 .len = IP_VS_IFNAME_MAXLEN - 1 },
2866 [IPVS_DAEMON_ATTR_SYNC_ID] = { .type = NLA_U32 },
2867 [IPVS_DAEMON_ATTR_SYNC_MAXLEN] = { .type = NLA_U16 },
2868 [IPVS_DAEMON_ATTR_MCAST_GROUP] = { .type = NLA_U32 },
2869 [IPVS_DAEMON_ATTR_MCAST_GROUP6] = { .len = sizeof(struct in6_addr) },
2870 [IPVS_DAEMON_ATTR_MCAST_PORT] = { .type = NLA_U16 },
2871 [IPVS_DAEMON_ATTR_MCAST_TTL] = { .type = NLA_U8 },
2872};
2873
2874
2875static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2876 [IPVS_SVC_ATTR_AF] = { .type = NLA_U16 },
2877 [IPVS_SVC_ATTR_PROTOCOL] = { .type = NLA_U16 },
2878 [IPVS_SVC_ATTR_ADDR] = { .type = NLA_BINARY,
2879 .len = sizeof(union nf_inet_addr) },
2880 [IPVS_SVC_ATTR_PORT] = { .type = NLA_U16 },
2881 [IPVS_SVC_ATTR_FWMARK] = { .type = NLA_U32 },
2882 [IPVS_SVC_ATTR_SCHED_NAME] = { .type = NLA_NUL_STRING,
2883 .len = IP_VS_SCHEDNAME_MAXLEN - 1 },
2884 [IPVS_SVC_ATTR_PE_NAME] = { .type = NLA_NUL_STRING,
2885 .len = IP_VS_PENAME_MAXLEN },
2886 [IPVS_SVC_ATTR_FLAGS] = { .type = NLA_BINARY,
2887 .len = sizeof(struct ip_vs_flags) },
2888 [IPVS_SVC_ATTR_TIMEOUT] = { .type = NLA_U32 },
2889 [IPVS_SVC_ATTR_NETMASK] = { .type = NLA_U32 },
2890 [IPVS_SVC_ATTR_STATS] = { .type = NLA_NESTED },
2891};
2892
2893
2894static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2895 [IPVS_DEST_ATTR_ADDR] = { .type = NLA_BINARY,
2896 .len = sizeof(union nf_inet_addr) },
2897 [IPVS_DEST_ATTR_PORT] = { .type = NLA_U16 },
2898 [IPVS_DEST_ATTR_FWD_METHOD] = { .type = NLA_U32 },
2899 [IPVS_DEST_ATTR_WEIGHT] = { .type = NLA_U32 },
2900 [IPVS_DEST_ATTR_U_THRESH] = { .type = NLA_U32 },
2901 [IPVS_DEST_ATTR_L_THRESH] = { .type = NLA_U32 },
2902 [IPVS_DEST_ATTR_ACTIVE_CONNS] = { .type = NLA_U32 },
2903 [IPVS_DEST_ATTR_INACT_CONNS] = { .type = NLA_U32 },
2904 [IPVS_DEST_ATTR_PERSIST_CONNS] = { .type = NLA_U32 },
2905 [IPVS_DEST_ATTR_STATS] = { .type = NLA_NESTED },
2906 [IPVS_DEST_ATTR_ADDR_FAMILY] = { .type = NLA_U16 },
2907 [IPVS_DEST_ATTR_TUN_TYPE] = { .type = NLA_U8 },
2908 [IPVS_DEST_ATTR_TUN_PORT] = { .type = NLA_U16 },
2909};
2910
2911static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2912 struct ip_vs_kstats *kstats)
2913{
2914 struct nlattr *nl_stats = nla_nest_start_noflag(skb, container_type);
2915
2916 if (!nl_stats)
2917 return -EMSGSIZE;
2918
2919 if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, (u32)kstats->conns) ||
2920 nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, (u32)kstats->inpkts) ||
2921 nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, (u32)kstats->outpkts) ||
2922 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBYTES, kstats->inbytes,
2923 IPVS_STATS_ATTR_PAD) ||
2924 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBYTES, kstats->outbytes,
2925 IPVS_STATS_ATTR_PAD) ||
2926 nla_put_u32(skb, IPVS_STATS_ATTR_CPS, (u32)kstats->cps) ||
2927 nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, (u32)kstats->inpps) ||
2928 nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, (u32)kstats->outpps) ||
2929 nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, (u32)kstats->inbps) ||
2930 nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, (u32)kstats->outbps))
2931 goto nla_put_failure;
2932 nla_nest_end(skb, nl_stats);
2933
2934 return 0;
2935
2936nla_put_failure:
2937 nla_nest_cancel(skb, nl_stats);
2938 return -EMSGSIZE;
2939}
2940
2941static int ip_vs_genl_fill_stats64(struct sk_buff *skb, int container_type,
2942 struct ip_vs_kstats *kstats)
2943{
2944 struct nlattr *nl_stats = nla_nest_start_noflag(skb, container_type);
2945
2946 if (!nl_stats)
2947 return -EMSGSIZE;
2948
2949 if (nla_put_u64_64bit(skb, IPVS_STATS_ATTR_CONNS, kstats->conns,
2950 IPVS_STATS_ATTR_PAD) ||
2951 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INPKTS, kstats->inpkts,
2952 IPVS_STATS_ATTR_PAD) ||
2953 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTPKTS, kstats->outpkts,
2954 IPVS_STATS_ATTR_PAD) ||
2955 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBYTES, kstats->inbytes,
2956 IPVS_STATS_ATTR_PAD) ||
2957 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBYTES, kstats->outbytes,
2958 IPVS_STATS_ATTR_PAD) ||
2959 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_CPS, kstats->cps,
2960 IPVS_STATS_ATTR_PAD) ||
2961 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INPPS, kstats->inpps,
2962 IPVS_STATS_ATTR_PAD) ||
2963 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTPPS, kstats->outpps,
2964 IPVS_STATS_ATTR_PAD) ||
2965 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBPS, kstats->inbps,
2966 IPVS_STATS_ATTR_PAD) ||
2967 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBPS, kstats->outbps,
2968 IPVS_STATS_ATTR_PAD))
2969 goto nla_put_failure;
2970 nla_nest_end(skb, nl_stats);
2971
2972 return 0;
2973
2974nla_put_failure:
2975 nla_nest_cancel(skb, nl_stats);
2976 return -EMSGSIZE;
2977}
2978
2979static int ip_vs_genl_fill_service(struct sk_buff *skb,
2980 struct ip_vs_service *svc)
2981{
2982 struct ip_vs_scheduler *sched;
2983 struct ip_vs_pe *pe;
2984 struct nlattr *nl_service;
2985 struct ip_vs_flags flags = { .flags = svc->flags,
2986 .mask = ~0 };
2987 struct ip_vs_kstats kstats;
2988 char *sched_name;
2989
2990 nl_service = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_SERVICE);
2991 if (!nl_service)
2992 return -EMSGSIZE;
2993
2994 if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
2995 goto nla_put_failure;
2996 if (svc->fwmark) {
2997 if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
2998 goto nla_put_failure;
2999 } else {
3000 if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
3001 nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
3002 nla_put_be16(skb, IPVS_SVC_ATTR_PORT, svc->port))
3003 goto nla_put_failure;
3004 }
3005
3006 sched = rcu_dereference_protected(svc->scheduler, 1);
3007 sched_name = sched ? sched->name : "none";
3008 pe = rcu_dereference_protected(svc->pe, 1);
3009 if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||
3010 (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
3011 nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
3012 nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
3013 nla_put_be32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
3014 goto nla_put_failure;
3015 ip_vs_copy_stats(&kstats, &svc->stats);
3016 if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &kstats))
3017 goto nla_put_failure;
3018 if (ip_vs_genl_fill_stats64(skb, IPVS_SVC_ATTR_STATS64, &kstats))
3019 goto nla_put_failure;
3020
3021 nla_nest_end(skb, nl_service);
3022
3023 return 0;
3024
3025nla_put_failure:
3026 nla_nest_cancel(skb, nl_service);
3027 return -EMSGSIZE;
3028}
3029
3030static int ip_vs_genl_dump_service(struct sk_buff *skb,
3031 struct ip_vs_service *svc,
3032 struct netlink_callback *cb)
3033{
3034 void *hdr;
3035
3036 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3037 &ip_vs_genl_family, NLM_F_MULTI,
3038 IPVS_CMD_NEW_SERVICE);
3039 if (!hdr)
3040 return -EMSGSIZE;
3041
3042 if (ip_vs_genl_fill_service(skb, svc) < 0)
3043 goto nla_put_failure;
3044
3045 genlmsg_end(skb, hdr);
3046 return 0;
3047
3048nla_put_failure:
3049 genlmsg_cancel(skb, hdr);
3050 return -EMSGSIZE;
3051}
3052
3053static int ip_vs_genl_dump_services(struct sk_buff *skb,
3054 struct netlink_callback *cb)
3055{
3056 int idx = 0, i;
3057 int start = cb->args[0];
3058 struct ip_vs_service *svc;
3059 struct net *net = sock_net(skb->sk);
3060 struct netns_ipvs *ipvs = net_ipvs(net);
3061
3062 mutex_lock(&__ip_vs_mutex);
3063 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
3064 hlist_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
3065 if (++idx <= start || (svc->ipvs != ipvs))
3066 continue;
3067 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
3068 idx--;
3069 goto nla_put_failure;
3070 }
3071 }
3072 }
3073
3074 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
3075 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
3076 if (++idx <= start || (svc->ipvs != ipvs))
3077 continue;
3078 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
3079 idx--;
3080 goto nla_put_failure;
3081 }
3082 }
3083 }
3084
3085nla_put_failure:
3086 mutex_unlock(&__ip_vs_mutex);
3087 cb->args[0] = idx;
3088
3089 return skb->len;
3090}
3091
3092static bool ip_vs_is_af_valid(int af)
3093{
3094 if (af == AF_INET)
3095 return true;
3096#ifdef CONFIG_IP_VS_IPV6
3097 if (af == AF_INET6 && ipv6_mod_enabled())
3098 return true;
3099#endif
3100 return false;
3101}
3102
3103static int ip_vs_genl_parse_service(struct netns_ipvs *ipvs,
3104 struct ip_vs_service_user_kern *usvc,
3105 struct nlattr *nla, bool full_entry,
3106 struct ip_vs_service **ret_svc)
3107{
3108 struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
3109 struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
3110 struct ip_vs_service *svc;
3111
3112
3113 if (nla == NULL ||
3114 nla_parse_nested_deprecated(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy, NULL))
3115 return -EINVAL;
3116
3117 nla_af = attrs[IPVS_SVC_ATTR_AF];
3118 nla_protocol = attrs[IPVS_SVC_ATTR_PROTOCOL];
3119 nla_addr = attrs[IPVS_SVC_ATTR_ADDR];
3120 nla_port = attrs[IPVS_SVC_ATTR_PORT];
3121 nla_fwmark = attrs[IPVS_SVC_ATTR_FWMARK];
3122
3123 if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
3124 return -EINVAL;
3125
3126 memset(usvc, 0, sizeof(*usvc));
3127
3128 usvc->af = nla_get_u16(nla_af);
3129 if (!ip_vs_is_af_valid(usvc->af))
3130 return -EAFNOSUPPORT;
3131
3132 if (nla_fwmark) {
3133 usvc->protocol = IPPROTO_TCP;
3134 usvc->fwmark = nla_get_u32(nla_fwmark);
3135 } else {
3136 usvc->protocol = nla_get_u16(nla_protocol);
3137 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
3138 usvc->port = nla_get_be16(nla_port);
3139 usvc->fwmark = 0;
3140 }
3141
3142 rcu_read_lock();
3143 if (usvc->fwmark)
3144 svc = __ip_vs_svc_fwm_find(ipvs, usvc->af, usvc->fwmark);
3145 else
3146 svc = __ip_vs_service_find(ipvs, usvc->af, usvc->protocol,
3147 &usvc->addr, usvc->port);
3148 rcu_read_unlock();
3149 *ret_svc = svc;
3150
3151
3152 if (full_entry) {
3153 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
3154 *nla_netmask;
3155 struct ip_vs_flags flags;
3156
3157 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
3158 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
3159 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
3160 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
3161 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
3162
3163 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3164 return -EINVAL;
3165
3166 nla_memcpy(&flags, nla_flags, sizeof(flags));
3167
3168
3169 if (svc)
3170 usvc->flags = svc->flags;
3171
3172
3173 usvc->flags = (usvc->flags & ~flags.mask) |
3174 (flags.flags & flags.mask);
3175 usvc->sched_name = nla_data(nla_sched);
3176 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3177 usvc->timeout = nla_get_u32(nla_timeout);
3178 usvc->netmask = nla_get_be32(nla_netmask);
3179 }
3180
3181 return 0;
3182}
3183
3184static struct ip_vs_service *ip_vs_genl_find_service(struct netns_ipvs *ipvs,
3185 struct nlattr *nla)
3186{
3187 struct ip_vs_service_user_kern usvc;
3188 struct ip_vs_service *svc;
3189 int ret;
3190
3191 ret = ip_vs_genl_parse_service(ipvs, &usvc, nla, false, &svc);
3192 return ret ? ERR_PTR(ret) : svc;
3193}
3194
3195static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3196{
3197 struct nlattr *nl_dest;
3198 struct ip_vs_kstats kstats;
3199
3200 nl_dest = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_DEST);
3201 if (!nl_dest)
3202 return -EMSGSIZE;
3203
3204 if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
3205 nla_put_be16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
3206 nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3207 (atomic_read(&dest->conn_flags) &
3208 IP_VS_CONN_F_FWD_MASK)) ||
3209 nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
3210 atomic_read(&dest->weight)) ||
3211 nla_put_u8(skb, IPVS_DEST_ATTR_TUN_TYPE,
3212 dest->tun_type) ||
3213 nla_put_be16(skb, IPVS_DEST_ATTR_TUN_PORT,
3214 dest->tun_port) ||
3215 nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
3216 nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
3217 nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3218 atomic_read(&dest->activeconns)) ||
3219 nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3220 atomic_read(&dest->inactconns)) ||
3221 nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3222 atomic_read(&dest->persistconns)) ||
3223 nla_put_u16(skb, IPVS_DEST_ATTR_ADDR_FAMILY, dest->af))
3224 goto nla_put_failure;
3225 ip_vs_copy_stats(&kstats, &dest->stats);
3226 if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &kstats))
3227 goto nla_put_failure;
3228 if (ip_vs_genl_fill_stats64(skb, IPVS_DEST_ATTR_STATS64, &kstats))
3229 goto nla_put_failure;
3230
3231 nla_nest_end(skb, nl_dest);
3232
3233 return 0;
3234
3235nla_put_failure:
3236 nla_nest_cancel(skb, nl_dest);
3237 return -EMSGSIZE;
3238}
3239
3240static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3241 struct netlink_callback *cb)
3242{
3243 void *hdr;
3244
3245 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3246 &ip_vs_genl_family, NLM_F_MULTI,
3247 IPVS_CMD_NEW_DEST);
3248 if (!hdr)
3249 return -EMSGSIZE;
3250
3251 if (ip_vs_genl_fill_dest(skb, dest) < 0)
3252 goto nla_put_failure;
3253
3254 genlmsg_end(skb, hdr);
3255 return 0;
3256
3257nla_put_failure:
3258 genlmsg_cancel(skb, hdr);
3259 return -EMSGSIZE;
3260}
3261
3262static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3263 struct netlink_callback *cb)
3264{
3265 int idx = 0;
3266 int start = cb->args[0];
3267 struct ip_vs_service *svc;
3268 struct ip_vs_dest *dest;
3269 struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3270 struct net *net = sock_net(skb->sk);
3271 struct netns_ipvs *ipvs = net_ipvs(net);
3272
3273 mutex_lock(&__ip_vs_mutex);
3274
3275
3276 if (nlmsg_parse_deprecated(cb->nlh, GENL_HDRLEN, attrs, IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy, cb->extack))
3277 goto out_err;
3278
3279
3280 svc = ip_vs_genl_find_service(ipvs, attrs[IPVS_CMD_ATTR_SERVICE]);
3281 if (IS_ERR_OR_NULL(svc))
3282 goto out_err;
3283
3284
3285 list_for_each_entry(dest, &svc->destinations, n_list) {
3286 if (++idx <= start)
3287 continue;
3288 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3289 idx--;
3290 goto nla_put_failure;
3291 }
3292 }
3293
3294nla_put_failure:
3295 cb->args[0] = idx;
3296
3297out_err:
3298 mutex_unlock(&__ip_vs_mutex);
3299
3300 return skb->len;
3301}
3302
3303static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3304 struct nlattr *nla, bool full_entry)
3305{
3306 struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3307 struct nlattr *nla_addr, *nla_port;
3308 struct nlattr *nla_addr_family;
3309
3310
3311 if (nla == NULL ||
3312 nla_parse_nested_deprecated(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy, NULL))
3313 return -EINVAL;
3314
3315 nla_addr = attrs[IPVS_DEST_ATTR_ADDR];
3316 nla_port = attrs[IPVS_DEST_ATTR_PORT];
3317 nla_addr_family = attrs[IPVS_DEST_ATTR_ADDR_FAMILY];
3318
3319 if (!(nla_addr && nla_port))
3320 return -EINVAL;
3321
3322 memset(udest, 0, sizeof(*udest));
3323
3324 nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3325 udest->port = nla_get_be16(nla_port);
3326
3327 if (nla_addr_family)
3328 udest->af = nla_get_u16(nla_addr_family);
3329 else
3330 udest->af = 0;
3331
3332
3333 if (full_entry) {
3334 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3335 *nla_l_thresh, *nla_tun_type, *nla_tun_port;
3336
3337 nla_fwd = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3338 nla_weight = attrs[IPVS_DEST_ATTR_WEIGHT];
3339 nla_u_thresh = attrs[IPVS_DEST_ATTR_U_THRESH];
3340 nla_l_thresh = attrs[IPVS_DEST_ATTR_L_THRESH];
3341 nla_tun_type = attrs[IPVS_DEST_ATTR_TUN_TYPE];
3342 nla_tun_port = attrs[IPVS_DEST_ATTR_TUN_PORT];
3343
3344 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3345 return -EINVAL;
3346
3347 udest->conn_flags = nla_get_u32(nla_fwd)
3348 & IP_VS_CONN_F_FWD_MASK;
3349 udest->weight = nla_get_u32(nla_weight);
3350 udest->u_threshold = nla_get_u32(nla_u_thresh);
3351 udest->l_threshold = nla_get_u32(nla_l_thresh);
3352
3353 if (nla_tun_type)
3354 udest->tun_type = nla_get_u8(nla_tun_type);
3355
3356 if (nla_tun_port)
3357 udest->tun_port = nla_get_be16(nla_tun_port);
3358 }
3359
3360 return 0;
3361}
3362
3363static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __u32 state,
3364 struct ipvs_sync_daemon_cfg *c)
3365{
3366 struct nlattr *nl_daemon;
3367
3368 nl_daemon = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_DAEMON);
3369 if (!nl_daemon)
3370 return -EMSGSIZE;
3371
3372 if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
3373 nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, c->mcast_ifn) ||
3374 nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, c->syncid) ||
3375 nla_put_u16(skb, IPVS_DAEMON_ATTR_SYNC_MAXLEN, c->sync_maxlen) ||
3376 nla_put_u16(skb, IPVS_DAEMON_ATTR_MCAST_PORT, c->mcast_port) ||
3377 nla_put_u8(skb, IPVS_DAEMON_ATTR_MCAST_TTL, c->mcast_ttl))
3378 goto nla_put_failure;
3379#ifdef CONFIG_IP_VS_IPV6
3380 if (c->mcast_af == AF_INET6) {
3381 if (nla_put_in6_addr(skb, IPVS_DAEMON_ATTR_MCAST_GROUP6,
3382 &c->mcast_group.in6))
3383 goto nla_put_failure;
3384 } else
3385#endif
3386 if (c->mcast_af == AF_INET &&
3387 nla_put_in_addr(skb, IPVS_DAEMON_ATTR_MCAST_GROUP,
3388 c->mcast_group.ip))
3389 goto nla_put_failure;
3390 nla_nest_end(skb, nl_daemon);
3391
3392 return 0;
3393
3394nla_put_failure:
3395 nla_nest_cancel(skb, nl_daemon);
3396 return -EMSGSIZE;
3397}
3398
3399static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __u32 state,
3400 struct ipvs_sync_daemon_cfg *c,
3401 struct netlink_callback *cb)
3402{
3403 void *hdr;
3404 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3405 &ip_vs_genl_family, NLM_F_MULTI,
3406 IPVS_CMD_NEW_DAEMON);
3407 if (!hdr)
3408 return -EMSGSIZE;
3409
3410 if (ip_vs_genl_fill_daemon(skb, state, c))
3411 goto nla_put_failure;
3412
3413 genlmsg_end(skb, hdr);
3414 return 0;
3415
3416nla_put_failure:
3417 genlmsg_cancel(skb, hdr);
3418 return -EMSGSIZE;
3419}
3420
3421static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3422 struct netlink_callback *cb)
3423{
3424 struct net *net = sock_net(skb->sk);
3425 struct netns_ipvs *ipvs = net_ipvs(net);
3426
3427 mutex_lock(&ipvs->sync_mutex);
3428 if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3429 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3430 &ipvs->mcfg, cb) < 0)
3431 goto nla_put_failure;
3432
3433 cb->args[0] = 1;
3434 }
3435
3436 if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3437 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3438 &ipvs->bcfg, cb) < 0)
3439 goto nla_put_failure;
3440
3441 cb->args[1] = 1;
3442 }
3443
3444nla_put_failure:
3445 mutex_unlock(&ipvs->sync_mutex);
3446
3447 return skb->len;
3448}
3449
3450static int ip_vs_genl_new_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
3451{
3452 struct ipvs_sync_daemon_cfg c;
3453 struct nlattr *a;
3454 int ret;
3455
3456 memset(&c, 0, sizeof(c));
3457 if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3458 attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3459 attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3460 return -EINVAL;
3461 strlcpy(c.mcast_ifn, nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3462 sizeof(c.mcast_ifn));
3463 c.syncid = nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]);
3464
3465 a = attrs[IPVS_DAEMON_ATTR_SYNC_MAXLEN];
3466 if (a)
3467 c.sync_maxlen = nla_get_u16(a);
3468
3469 a = attrs[IPVS_DAEMON_ATTR_MCAST_GROUP];
3470 if (a) {
3471 c.mcast_af = AF_INET;
3472 c.mcast_group.ip = nla_get_in_addr(a);
3473 if (!ipv4_is_multicast(c.mcast_group.ip))
3474 return -EINVAL;
3475 } else {
3476 a = attrs[IPVS_DAEMON_ATTR_MCAST_GROUP6];
3477 if (a) {
3478#ifdef CONFIG_IP_VS_IPV6
3479 int addr_type;
3480
3481 c.mcast_af = AF_INET6;
3482 c.mcast_group.in6 = nla_get_in6_addr(a);
3483 addr_type = ipv6_addr_type(&c.mcast_group.in6);
3484 if (!(addr_type & IPV6_ADDR_MULTICAST))
3485 return -EINVAL;
3486#else
3487 return -EAFNOSUPPORT;
3488#endif
3489 }
3490 }
3491
3492 a = attrs[IPVS_DAEMON_ATTR_MCAST_PORT];
3493 if (a)
3494 c.mcast_port = nla_get_u16(a);
3495
3496 a = attrs[IPVS_DAEMON_ATTR_MCAST_TTL];
3497 if (a)
3498 c.mcast_ttl = nla_get_u8(a);
3499
3500
3501
3502
3503 if (ipvs->mixed_address_family_dests > 0)
3504 return -EINVAL;
3505
3506 ret = start_sync_thread(ipvs, &c,
3507 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3508 return ret;
3509}
3510
3511static int ip_vs_genl_del_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
3512{
3513 int ret;
3514
3515 if (!attrs[IPVS_DAEMON_ATTR_STATE])
3516 return -EINVAL;
3517
3518 mutex_lock(&ipvs->sync_mutex);
3519 ret = stop_sync_thread(ipvs,
3520 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3521 mutex_unlock(&ipvs->sync_mutex);
3522 return ret;
3523}
3524
3525static int ip_vs_genl_set_config(struct netns_ipvs *ipvs, struct nlattr **attrs)
3526{
3527 struct ip_vs_timeout_user t;
3528
3529 __ip_vs_get_timeouts(ipvs, &t);
3530
3531 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3532 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3533
3534 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3535 t.tcp_fin_timeout =
3536 nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3537
3538 if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3539 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3540
3541 return ip_vs_set_timeout(ipvs, &t);
3542}
3543
3544static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3545{
3546 int ret = -EINVAL, cmd;
3547 struct net *net = sock_net(skb->sk);
3548 struct netns_ipvs *ipvs = net_ipvs(net);
3549
3550 cmd = info->genlhdr->cmd;
3551
3552 if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3553 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3554
3555 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3556 nla_parse_nested_deprecated(daemon_attrs, IPVS_DAEMON_ATTR_MAX, info->attrs[IPVS_CMD_ATTR_DAEMON], ip_vs_daemon_policy, info->extack))
3557 goto out;
3558
3559 if (cmd == IPVS_CMD_NEW_DAEMON)
3560 ret = ip_vs_genl_new_daemon(ipvs, daemon_attrs);
3561 else
3562 ret = ip_vs_genl_del_daemon(ipvs, daemon_attrs);
3563 }
3564
3565out:
3566 return ret;
3567}
3568
3569static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3570{
3571 bool need_full_svc = false, need_full_dest = false;
3572 struct ip_vs_service *svc = NULL;
3573 struct ip_vs_service_user_kern usvc;
3574 struct ip_vs_dest_user_kern udest;
3575 int ret = 0, cmd;
3576 struct net *net = sock_net(skb->sk);
3577 struct netns_ipvs *ipvs = net_ipvs(net);
3578
3579 cmd = info->genlhdr->cmd;
3580
3581 mutex_lock(&__ip_vs_mutex);
3582
3583 if (cmd == IPVS_CMD_FLUSH) {
3584 ret = ip_vs_flush(ipvs, false);
3585 goto out;
3586 } else if (cmd == IPVS_CMD_SET_CONFIG) {
3587 ret = ip_vs_genl_set_config(ipvs, info->attrs);
3588 goto out;
3589 } else if (cmd == IPVS_CMD_ZERO &&
3590 !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3591 ret = ip_vs_zero_all(ipvs);
3592 goto out;
3593 }
3594
3595
3596
3597
3598 if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3599 need_full_svc = true;
3600
3601 ret = ip_vs_genl_parse_service(ipvs, &usvc,
3602 info->attrs[IPVS_CMD_ATTR_SERVICE],
3603 need_full_svc, &svc);
3604 if (ret)
3605 goto out;
3606
3607
3608 if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3609 ret = -ESRCH;
3610 goto out;
3611 }
3612
3613
3614
3615
3616 if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3617 cmd == IPVS_CMD_DEL_DEST) {
3618 if (cmd != IPVS_CMD_DEL_DEST)
3619 need_full_dest = true;
3620
3621 ret = ip_vs_genl_parse_dest(&udest,
3622 info->attrs[IPVS_CMD_ATTR_DEST],
3623 need_full_dest);
3624 if (ret)
3625 goto out;
3626
3627
3628
3629
3630
3631
3632
3633 if (udest.af == 0)
3634 udest.af = svc->af;
3635
3636 if (!ip_vs_is_af_valid(udest.af)) {
3637 ret = -EAFNOSUPPORT;
3638 goto out;
3639 }
3640
3641 if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
3642
3643
3644
3645 if (ipvs->sync_state) {
3646 ret = -EINVAL;
3647 goto out;
3648 }
3649
3650
3651 switch (udest.conn_flags) {
3652 case IP_VS_CONN_F_TUNNEL:
3653
3654 break;
3655 default:
3656 ret = -EINVAL;
3657 goto out;
3658 }
3659 }
3660 }
3661
3662 switch (cmd) {
3663 case IPVS_CMD_NEW_SERVICE:
3664 if (svc == NULL)
3665 ret = ip_vs_add_service(ipvs, &usvc, &svc);
3666 else
3667 ret = -EEXIST;
3668 break;
3669 case IPVS_CMD_SET_SERVICE:
3670 ret = ip_vs_edit_service(svc, &usvc);
3671 break;
3672 case IPVS_CMD_DEL_SERVICE:
3673 ret = ip_vs_del_service(svc);
3674
3675 break;
3676 case IPVS_CMD_NEW_DEST:
3677 ret = ip_vs_add_dest(svc, &udest);
3678 break;
3679 case IPVS_CMD_SET_DEST:
3680 ret = ip_vs_edit_dest(svc, &udest);
3681 break;
3682 case IPVS_CMD_DEL_DEST:
3683 ret = ip_vs_del_dest(svc, &udest);
3684 break;
3685 case IPVS_CMD_ZERO:
3686 ret = ip_vs_zero_service(svc);
3687 break;
3688 default:
3689 ret = -EINVAL;
3690 }
3691
3692out:
3693 mutex_unlock(&__ip_vs_mutex);
3694
3695 return ret;
3696}
3697
3698static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3699{
3700 struct sk_buff *msg;
3701 void *reply;
3702 int ret, cmd, reply_cmd;
3703 struct net *net = sock_net(skb->sk);
3704 struct netns_ipvs *ipvs = net_ipvs(net);
3705
3706 cmd = info->genlhdr->cmd;
3707
3708 if (cmd == IPVS_CMD_GET_SERVICE)
3709 reply_cmd = IPVS_CMD_NEW_SERVICE;
3710 else if (cmd == IPVS_CMD_GET_INFO)
3711 reply_cmd = IPVS_CMD_SET_INFO;
3712 else if (cmd == IPVS_CMD_GET_CONFIG)
3713 reply_cmd = IPVS_CMD_SET_CONFIG;
3714 else {
3715 pr_err("unknown Generic Netlink command\n");
3716 return -EINVAL;
3717 }
3718
3719 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3720 if (!msg)
3721 return -ENOMEM;
3722
3723 mutex_lock(&__ip_vs_mutex);
3724
3725 reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3726 if (reply == NULL)
3727 goto nla_put_failure;
3728
3729 switch (cmd) {
3730 case IPVS_CMD_GET_SERVICE:
3731 {
3732 struct ip_vs_service *svc;
3733
3734 svc = ip_vs_genl_find_service(ipvs,
3735 info->attrs[IPVS_CMD_ATTR_SERVICE]);
3736 if (IS_ERR(svc)) {
3737 ret = PTR_ERR(svc);
3738 goto out_err;
3739 } else if (svc) {
3740 ret = ip_vs_genl_fill_service(msg, svc);
3741 if (ret)
3742 goto nla_put_failure;
3743 } else {
3744 ret = -ESRCH;
3745 goto out_err;
3746 }
3747
3748 break;
3749 }
3750
3751 case IPVS_CMD_GET_CONFIG:
3752 {
3753 struct ip_vs_timeout_user t;
3754
3755 __ip_vs_get_timeouts(ipvs, &t);
3756#ifdef CONFIG_IP_VS_PROTO_TCP
3757 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
3758 t.tcp_timeout) ||
3759 nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3760 t.tcp_fin_timeout))
3761 goto nla_put_failure;
3762#endif
3763#ifdef CONFIG_IP_VS_PROTO_UDP
3764 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
3765 goto nla_put_failure;
3766#endif
3767
3768 break;
3769 }
3770
3771 case IPVS_CMD_GET_INFO:
3772 if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
3773 IP_VS_VERSION_CODE) ||
3774 nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3775 ip_vs_conn_tab_size))
3776 goto nla_put_failure;
3777 break;
3778 }
3779
3780 genlmsg_end(msg, reply);
3781 ret = genlmsg_reply(msg, info);
3782 goto out;
3783
3784nla_put_failure:
3785 pr_err("not enough space in Netlink message\n");
3786 ret = -EMSGSIZE;
3787
3788out_err:
3789 nlmsg_free(msg);
3790out:
3791 mutex_unlock(&__ip_vs_mutex);
3792
3793 return ret;
3794}
3795
3796
3797static const struct genl_ops ip_vs_genl_ops[] = {
3798 {
3799 .cmd = IPVS_CMD_NEW_SERVICE,
3800 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3801 .flags = GENL_ADMIN_PERM,
3802 .doit = ip_vs_genl_set_cmd,
3803 },
3804 {
3805 .cmd = IPVS_CMD_SET_SERVICE,
3806 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3807 .flags = GENL_ADMIN_PERM,
3808 .doit = ip_vs_genl_set_cmd,
3809 },
3810 {
3811 .cmd = IPVS_CMD_DEL_SERVICE,
3812 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3813 .flags = GENL_ADMIN_PERM,
3814 .doit = ip_vs_genl_set_cmd,
3815 },
3816 {
3817 .cmd = IPVS_CMD_GET_SERVICE,
3818 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3819 .flags = GENL_ADMIN_PERM,
3820 .doit = ip_vs_genl_get_cmd,
3821 .dumpit = ip_vs_genl_dump_services,
3822 },
3823 {
3824 .cmd = IPVS_CMD_NEW_DEST,
3825 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3826 .flags = GENL_ADMIN_PERM,
3827 .doit = ip_vs_genl_set_cmd,
3828 },
3829 {
3830 .cmd = IPVS_CMD_SET_DEST,
3831 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3832 .flags = GENL_ADMIN_PERM,
3833 .doit = ip_vs_genl_set_cmd,
3834 },
3835 {
3836 .cmd = IPVS_CMD_DEL_DEST,
3837 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3838 .flags = GENL_ADMIN_PERM,
3839 .doit = ip_vs_genl_set_cmd,
3840 },
3841 {
3842 .cmd = IPVS_CMD_GET_DEST,
3843 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3844 .flags = GENL_ADMIN_PERM,
3845 .dumpit = ip_vs_genl_dump_dests,
3846 },
3847 {
3848 .cmd = IPVS_CMD_NEW_DAEMON,
3849 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3850 .flags = GENL_ADMIN_PERM,
3851 .doit = ip_vs_genl_set_daemon,
3852 },
3853 {
3854 .cmd = IPVS_CMD_DEL_DAEMON,
3855 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3856 .flags = GENL_ADMIN_PERM,
3857 .doit = ip_vs_genl_set_daemon,
3858 },
3859 {
3860 .cmd = IPVS_CMD_GET_DAEMON,
3861 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3862 .flags = GENL_ADMIN_PERM,
3863 .dumpit = ip_vs_genl_dump_daemons,
3864 },
3865 {
3866 .cmd = IPVS_CMD_SET_CONFIG,
3867 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3868 .flags = GENL_ADMIN_PERM,
3869 .doit = ip_vs_genl_set_cmd,
3870 },
3871 {
3872 .cmd = IPVS_CMD_GET_CONFIG,
3873 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3874 .flags = GENL_ADMIN_PERM,
3875 .doit = ip_vs_genl_get_cmd,
3876 },
3877 {
3878 .cmd = IPVS_CMD_GET_INFO,
3879 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3880 .flags = GENL_ADMIN_PERM,
3881 .doit = ip_vs_genl_get_cmd,
3882 },
3883 {
3884 .cmd = IPVS_CMD_ZERO,
3885 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3886 .flags = GENL_ADMIN_PERM,
3887 .doit = ip_vs_genl_set_cmd,
3888 },
3889 {
3890 .cmd = IPVS_CMD_FLUSH,
3891 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3892 .flags = GENL_ADMIN_PERM,
3893 .doit = ip_vs_genl_set_cmd,
3894 },
3895};
3896
3897static struct genl_family ip_vs_genl_family __ro_after_init = {
3898 .hdrsize = 0,
3899 .name = IPVS_GENL_NAME,
3900 .version = IPVS_GENL_VERSION,
3901 .maxattr = IPVS_CMD_ATTR_MAX,
3902 .policy = ip_vs_cmd_policy,
3903 .netnsok = true,
3904 .module = THIS_MODULE,
3905 .ops = ip_vs_genl_ops,
3906 .n_ops = ARRAY_SIZE(ip_vs_genl_ops),
3907};
3908
3909static int __init ip_vs_genl_register(void)
3910{
3911 return genl_register_family(&ip_vs_genl_family);
3912}
3913
3914static void ip_vs_genl_unregister(void)
3915{
3916 genl_unregister_family(&ip_vs_genl_family);
3917}
3918
3919
3920
3921
3922
3923
3924#ifdef CONFIG_SYSCTL
3925static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
3926{
3927 struct net *net = ipvs->net;
3928 int idx;
3929 struct ctl_table *tbl;
3930
3931 atomic_set(&ipvs->dropentry, 0);
3932 spin_lock_init(&ipvs->dropentry_lock);
3933 spin_lock_init(&ipvs->droppacket_lock);
3934 spin_lock_init(&ipvs->securetcp_lock);
3935
3936 if (!net_eq(net, &init_net)) {
3937 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3938 if (tbl == NULL)
3939 return -ENOMEM;
3940
3941
3942 if (net->user_ns != &init_user_ns)
3943 tbl[0].procname = NULL;
3944 } else
3945 tbl = vs_vars;
3946
3947 for (idx = 0; idx < ARRAY_SIZE(vs_vars); idx++) {
3948 if (tbl[idx].proc_handler == proc_do_defense_mode)
3949 tbl[idx].extra2 = ipvs;
3950 }
3951 idx = 0;
3952 ipvs->sysctl_amemthresh = 1024;
3953 tbl[idx++].data = &ipvs->sysctl_amemthresh;
3954 ipvs->sysctl_am_droprate = 10;
3955 tbl[idx++].data = &ipvs->sysctl_am_droprate;
3956 tbl[idx++].data = &ipvs->sysctl_drop_entry;
3957 tbl[idx++].data = &ipvs->sysctl_drop_packet;
3958#ifdef CONFIG_IP_VS_NFCT
3959 tbl[idx++].data = &ipvs->sysctl_conntrack;
3960#endif
3961 tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3962 ipvs->sysctl_snat_reroute = 1;
3963 tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3964 ipvs->sysctl_sync_ver = 1;
3965 tbl[idx++].data = &ipvs->sysctl_sync_ver;
3966 ipvs->sysctl_sync_ports = 1;
3967 tbl[idx++].data = &ipvs->sysctl_sync_ports;
3968 tbl[idx++].data = &ipvs->sysctl_sync_persist_mode;
3969 ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
3970 tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
3971 ipvs->sysctl_sync_sock_size = 0;
3972 tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
3973 tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3974 tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3975 tbl[idx++].data = &ipvs->sysctl_sloppy_tcp;
3976 tbl[idx++].data = &ipvs->sysctl_sloppy_sctp;
3977 tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3978 ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3979 ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3980 tbl[idx].data = &ipvs->sysctl_sync_threshold;
3981 tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3982 ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
3983 tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
3984 ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
3985 tbl[idx++].data = &ipvs->sysctl_sync_retries;
3986 tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3987 ipvs->sysctl_pmtu_disc = 1;
3988 tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
3989 tbl[idx++].data = &ipvs->sysctl_backup_only;
3990 ipvs->sysctl_conn_reuse_mode = 1;
3991 tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
3992 tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
3993 tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
3994
3995 ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
3996 if (ipvs->sysctl_hdr == NULL) {
3997 if (!net_eq(net, &init_net))
3998 kfree(tbl);
3999 return -ENOMEM;
4000 }
4001 ip_vs_start_estimator(ipvs, &ipvs->tot_stats);
4002 ipvs->sysctl_tbl = tbl;
4003
4004 INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
4005 schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
4006
4007 return 0;
4008}
4009
4010static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs)
4011{
4012 struct net *net = ipvs->net;
4013
4014 cancel_delayed_work_sync(&ipvs->defense_work);
4015 cancel_work_sync(&ipvs->defense_work.work);
4016 unregister_net_sysctl_table(ipvs->sysctl_hdr);
4017 ip_vs_stop_estimator(ipvs, &ipvs->tot_stats);
4018
4019 if (!net_eq(net, &init_net))
4020 kfree(ipvs->sysctl_tbl);
4021}
4022
4023#else
4024
4025static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) { return 0; }
4026static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs) { }
4027
4028#endif
4029
4030static struct notifier_block ip_vs_dst_notifier = {
4031 .notifier_call = ip_vs_dst_event,
4032#ifdef CONFIG_IP_VS_IPV6
4033 .priority = ADDRCONF_NOTIFY_PRIORITY + 5,
4034#endif
4035};
4036
4037int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
4038{
4039 int i, idx;
4040
4041
4042 for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
4043 INIT_HLIST_HEAD(&ipvs->rs_table[idx]);
4044
4045 INIT_LIST_HEAD(&ipvs->dest_trash);
4046 spin_lock_init(&ipvs->dest_trash_lock);
4047 timer_setup(&ipvs->dest_trash_timer, ip_vs_dest_trash_expire, 0);
4048 atomic_set(&ipvs->ftpsvc_counter, 0);
4049 atomic_set(&ipvs->nullsvc_counter, 0);
4050 atomic_set(&ipvs->conn_out_counter, 0);
4051
4052
4053 ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
4054 if (!ipvs->tot_stats.cpustats)
4055 return -ENOMEM;
4056
4057 for_each_possible_cpu(i) {
4058 struct ip_vs_cpu_stats *ipvs_tot_stats;
4059 ipvs_tot_stats = per_cpu_ptr(ipvs->tot_stats.cpustats, i);
4060 u64_stats_init(&ipvs_tot_stats->syncp);
4061 }
4062
4063 spin_lock_init(&ipvs->tot_stats.lock);
4064
4065 proc_create_net("ip_vs", 0, ipvs->net->proc_net, &ip_vs_info_seq_ops,
4066 sizeof(struct ip_vs_iter));
4067 proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net,
4068 ip_vs_stats_show, NULL);
4069 proc_create_net_single("ip_vs_stats_percpu", 0, ipvs->net->proc_net,
4070 ip_vs_stats_percpu_show, NULL);
4071
4072 if (ip_vs_control_net_init_sysctl(ipvs))
4073 goto err;
4074
4075 return 0;
4076
4077err:
4078 free_percpu(ipvs->tot_stats.cpustats);
4079 return -ENOMEM;
4080}
4081
4082void __net_exit ip_vs_control_net_cleanup(struct netns_ipvs *ipvs)
4083{
4084 ip_vs_trash_cleanup(ipvs);
4085 ip_vs_control_net_cleanup_sysctl(ipvs);
4086 remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net);
4087 remove_proc_entry("ip_vs_stats", ipvs->net->proc_net);
4088 remove_proc_entry("ip_vs", ipvs->net->proc_net);
4089 free_percpu(ipvs->tot_stats.cpustats);
4090}
4091
4092int __init ip_vs_register_nl_ioctl(void)
4093{
4094 int ret;
4095
4096 ret = nf_register_sockopt(&ip_vs_sockopts);
4097 if (ret) {
4098 pr_err("cannot register sockopt.\n");
4099 goto err_sock;
4100 }
4101
4102 ret = ip_vs_genl_register();
4103 if (ret) {
4104 pr_err("cannot register Generic Netlink interface.\n");
4105 goto err_genl;
4106 }
4107 return 0;
4108
4109err_genl:
4110 nf_unregister_sockopt(&ip_vs_sockopts);
4111err_sock:
4112 return ret;
4113}
4114
4115void ip_vs_unregister_nl_ioctl(void)
4116{
4117 ip_vs_genl_unregister();
4118 nf_unregister_sockopt(&ip_vs_sockopts);
4119}
4120
4121int __init ip_vs_control_init(void)
4122{
4123 int idx;
4124 int ret;
4125
4126 EnterFunction(2);
4127
4128
4129 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
4130 INIT_HLIST_HEAD(&ip_vs_svc_table[idx]);
4131 INIT_HLIST_HEAD(&ip_vs_svc_fwm_table[idx]);
4132 }
4133
4134 smp_wmb();
4135
4136 ret = register_netdevice_notifier(&ip_vs_dst_notifier);
4137 if (ret < 0)
4138 return ret;
4139
4140 LeaveFunction(2);
4141 return 0;
4142}
4143
4144
4145void ip_vs_control_cleanup(void)
4146{
4147 EnterFunction(2);
4148 unregister_netdevice_notifier(&ip_vs_dst_notifier);
4149 LeaveFunction(2);
4150}
4151