Pileus Git - ~andy/linux/blob - net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <linux/nsproxy.h>
  42 #include <net/ip.h>
  43 #ifdef CONFIG_IP_VS_IPV6
  44 #include <net/ipv6.h>
  45 #include <net/ip6_route.h>
  46 #endif
  47 #include <net/route.h>
  48 #include <net/sock.h>
  49 #include <net/genetlink.h>
  50
  51 #include <asm/uaccess.h>
  52
  53 #include <net/ip_vs.h>
  54
  55 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  56 static DEFINE_MUTEX(__ip_vs_mutex);
  57
  58 /* lock for service table */
  59 static DEFINE_RWLOCK(__ip_vs_svc_lock);
  60
  61 /* sysctl variables */
  62
  63 #ifdef CONFIG_IP_VS_DEBUG
  64 static int sysctl_ip_vs_debug_level = 0;
  65
  66 int ip_vs_get_debug_level(void)
  67 {
  68         return sysctl_ip_vs_debug_level;
  69 }
  70 #endif
  71
  72
  73 /*  Protos */
  74 static void __ip_vs_del_service(struct ip_vs_service *svc);
  75
  76
  77 #ifdef CONFIG_IP_VS_IPV6
  78 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
  79 static bool __ip_vs_addr_is_local_v6(struct net *net,
  80                                      const struct in6_addr *addr)
  81 {
  82         struct flowi6 fl6 = {
  83                 .daddr = *addr,
  84         };
  85         struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
  86         bool is_local;
  87
  88         is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
  89
  90         dst_release(dst);
  91         return is_local;
  92 }
  93 #endif
  94
  95 #ifdef CONFIG_SYSCTL
  96 /*
  97  *      update_defense_level is called from keventd and from sysctl,
  98  *      so it needs to protect itself from softirqs
  99  */
 100 static void update_defense_level(struct netns_ipvs *ipvs)
 101 {
 102         struct sysinfo i;
 103         static int old_secure_tcp = 0;
 104         int availmem;
 105         int nomem;
 106         int to_change = -1;
 107
 108         /* we only count free and buffered memory (in pages) */
 109         si_meminfo(&i);
 110         availmem = i.freeram + i.bufferram;
 111         /* however in linux 2.5 the i.bufferram is total page cache size,
 112            we need adjust it */
 113         /* si_swapinfo(&i); */
 114         /* availmem = availmem - (i.totalswap - i.freeswap); */
 115
 116         nomem = (availmem < ipvs->sysctl_amemthresh);
 117
 118         local_bh_disable();
 119
 120         /* drop_entry */
 121         spin_lock(&ipvs->dropentry_lock);
 122         switch (ipvs->sysctl_drop_entry) {
 123         case 0:
 124                 atomic_set(&ipvs->dropentry, 0);
 125                 break;
 126         case 1:
 127                 if (nomem) {
 128                         atomic_set(&ipvs->dropentry, 1);
 129                         ipvs->sysctl_drop_entry = 2;
 130                 } else {
 131                         atomic_set(&ipvs->dropentry, 0);
 132                 }
 133                 break;
 134         case 2:
 135                 if (nomem) {
 136                         atomic_set(&ipvs->dropentry, 1);
 137                 } else {
 138                         atomic_set(&ipvs->dropentry, 0);
 139                         ipvs->sysctl_drop_entry = 1;
 140                 };
 141                 break;
 142         case 3:
 143                 atomic_set(&ipvs->dropentry, 1);
 144                 break;
 145         }
 146         spin_unlock(&ipvs->dropentry_lock);
 147
 148         /* drop_packet */
 149         spin_lock(&ipvs->droppacket_lock);
 150         switch (ipvs->sysctl_drop_packet) {
 151         case 0:
 152                 ipvs->drop_rate = 0;
 153                 break;
 154         case 1:
 155                 if (nomem) {
 156                         ipvs->drop_rate = ipvs->drop_counter
 157                                 = ipvs->sysctl_amemthresh /
 158                                 (ipvs->sysctl_amemthresh-availmem);
 159                         ipvs->sysctl_drop_packet = 2;
 160                 } else {
 161                         ipvs->drop_rate = 0;
 162                 }
 163                 break;
 164         case 2:
 165                 if (nomem) {
 166                         ipvs->drop_rate = ipvs->drop_counter
 167                                 = ipvs->sysctl_amemthresh /
 168                                 (ipvs->sysctl_amemthresh-availmem);
 169                 } else {
 170                         ipvs->drop_rate = 0;
 171                         ipvs->sysctl_drop_packet = 1;
 172                 }
 173                 break;
 174         case 3:
 175                 ipvs->drop_rate = ipvs->sysctl_am_droprate;
 176                 break;
 177         }
 178         spin_unlock(&ipvs->droppacket_lock);
 179
 180         /* secure_tcp */
 181         spin_lock(&ipvs->securetcp_lock);
 182         switch (ipvs->sysctl_secure_tcp) {
 183         case 0:
 184                 if (old_secure_tcp >= 2)
 185                         to_change = 0;
 186                 break;
 187         case 1:
 188                 if (nomem) {
 189                         if (old_secure_tcp < 2)
 190                                 to_change = 1;
 191                         ipvs->sysctl_secure_tcp = 2;
 192                 } else {
 193                         if (old_secure_tcp >= 2)
 194                                 to_change = 0;
 195                 }
 196                 break;
 197         case 2:
 198                 if (nomem) {
 199                         if (old_secure_tcp < 2)
 200                                 to_change = 1;
 201                 } else {
 202                         if (old_secure_tcp >= 2)
 203                                 to_change = 0;
 204                         ipvs->sysctl_secure_tcp = 1;
 205                 }
 206                 break;
 207         case 3:
 208                 if (old_secure_tcp < 2)
 209                         to_change = 1;
 210                 break;
 211         }
 212         old_secure_tcp = ipvs->sysctl_secure_tcp;
 213         if (to_change >= 0)
 214                 ip_vs_protocol_timeout_change(ipvs,
 215                                               ipvs->sysctl_secure_tcp > 1);
 216         spin_unlock(&ipvs->securetcp_lock);
 217
 218         local_bh_enable();
 219 }
 220
 221
 222 /*
 223  *      Timer for checking the defense
 224  */
 225 #define DEFENSE_TIMER_PERIOD    1*HZ
 226
 227 static void defense_work_handler(struct work_struct *work)
 228 {
 229         struct netns_ipvs *ipvs =
 230                 container_of(work, struct netns_ipvs, defense_work.work);
 231
 232         update_defense_level(ipvs);
 233         if (atomic_read(&ipvs->dropentry))
 234                 ip_vs_random_dropentry(ipvs->net);
 235         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
 236 }
 237 #endif
 238
 239 int
 240 ip_vs_use_count_inc(void)
 241 {
 242         return try_module_get(THIS_MODULE);
 243 }
 244
 245 void
 246 ip_vs_use_count_dec(void)
 247 {
 248         module_put(THIS_MODULE);
 249 }
 250
 251
 252 /*
 253  *      Hash table: for virtual service lookups
 254  */
 255 #define IP_VS_SVC_TAB_BITS 8
 256 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 257 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 258
 259 /* the service table hashed by <protocol, addr, port> */
 260 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 261 /* the service table hashed by fwmark */
 262 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 263
 264
 265 /*
 266  *      Returns hash value for virtual service
 267  */
 268 static inline unsigned int
 269 ip_vs_svc_hashkey(struct net *net, int af, unsigned int proto,
 270                   const union nf_inet_addr *addr, __be16 port)
 271 {
 272         register unsigned int porth = ntohs(port);
 273         __be32 addr_fold = addr->ip;
 274
 275 #ifdef CONFIG_IP_VS_IPV6
 276         if (af == AF_INET6)
 277                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 278                             addr->ip6[2]^addr->ip6[3];
 279 #endif
 280         addr_fold ^= ((size_t)net>>8);
 281
 282         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
 283                 & IP_VS_SVC_TAB_MASK;
 284 }
 285
 286 /*
 287  *      Returns hash value of fwmark for virtual service lookup
 288  */
 289 static inline unsigned int ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
 290 {
 291         return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
 292 }
 293
 294 /*
 295  *      Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
 296  *      or in the ip_vs_svc_fwm_table by fwmark.
 297  *      Should be called with locked tables.
 298  */
 299 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 300 {
 301         unsigned int hash;
 302
 303         if (svc->flags & IP_VS_SVC_F_HASHED) {
 304                 pr_err("%s(): request for already hashed, called from %pF\n",
 305                        __func__, __builtin_return_address(0));
 306                 return 0;
 307         }
 308
 309         if (svc->fwmark == 0) {
 310                 /*
 311                  *  Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
 312                  */
 313                 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
 314                                          &svc->addr, svc->port);
 315                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
 316         } else {
 317                 /*
 318                  *  Hash it by fwmark in svc_fwm_table
 319                  */
 320                 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
 321                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 322         }
 323
 324         svc->flags |= IP_VS_SVC_F_HASHED;
 325         /* increase its refcnt because it is referenced by the svc table */
 326         atomic_inc(&svc->refcnt);
 327         return 1;
 328 }
 329
 330
 331 /*
 332  *      Unhashes a service from svc_table / svc_fwm_table.
 333  *      Should be called with locked tables.
 334  */
 335 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 336 {
 337         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 338                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 339                        __func__, __builtin_return_address(0));
 340                 return 0;
 341         }
 342
 343         if (svc->fwmark == 0) {
 344                 /* Remove it from the svc_table table */
 345                 list_del(&svc->s_list);
 346         } else {
 347                 /* Remove it from the svc_fwm_table table */
 348                 list_del(&svc->f_list);
 349         }
 350
 351         svc->flags &= ~IP_VS_SVC_F_HASHED;
 352         atomic_dec(&svc->refcnt);
 353         return 1;
 354 }
 355
 356
 357 /*
 358  *      Get service by {netns, proto,addr,port} in the service table.
 359  */
 360 static inline struct ip_vs_service *
 361 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
 362                      const union nf_inet_addr *vaddr, __be16 vport)
 363 {
 364         unsigned int hash;
 365         struct ip_vs_service *svc;
 366
 367         /* Check for "full" addressed entries */
 368         hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
 369
 370         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
 371                 if ((svc->af == af)
 372                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 373                     && (svc->port == vport)
 374                     && (svc->protocol == protocol)
 375                     && net_eq(svc->net, net)) {
 376                         /* HIT */
 377                         return svc;
 378                 }
 379         }
 380
 381         return NULL;
 382 }
 383
 384
 385 /*
 386  *      Get service by {fwmark} in the service table.
 387  */
 388 static inline struct ip_vs_service *
 389 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
 390 {
 391         unsigned int hash;
 392         struct ip_vs_service *svc;
 393
 394         /* Check for fwmark addressed entries */
 395         hash = ip_vs_svc_fwm_hashkey(net, fwmark);
 396
 397         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 398                 if (svc->fwmark == fwmark && svc->af == af
 399                     && net_eq(svc->net, net)) {
 400                         /* HIT */
 401                         return svc;
 402                 }
 403         }
 404
 405         return NULL;
 406 }
 407
 408 struct ip_vs_service *
 409 ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
 410                   const union nf_inet_addr *vaddr, __be16 vport)
 411 {
 412         struct ip_vs_service *svc;
 413         struct netns_ipvs *ipvs = net_ipvs(net);
 414
 415         read_lock(&__ip_vs_svc_lock);
 416
 417         /*
 418          *      Check the table hashed by fwmark first
 419          */
 420         if (fwmark) {
 421                 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
 422                 if (svc)
 423                         goto out;
 424         }
 425
 426         /*
 427          *      Check the table hashed by <protocol,addr,port>
 428          *      for "full" addressed entries
 429          */
 430         svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
 431
 432         if (svc == NULL
 433             && protocol == IPPROTO_TCP
 434             && atomic_read(&ipvs->ftpsvc_counter)
 435             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 436                 /*
 437                  * Check if ftp service entry exists, the packet
 438                  * might belong to FTP data connections.
 439                  */
 440                 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
 441         }
 442
 443         if (svc == NULL
 444             && atomic_read(&ipvs->nullsvc_counter)) {
 445                 /*
 446                  * Check if the catch-all port (port zero) exists
 447                  */
 448                 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
 449         }
 450
 451   out:
 452         if (svc)
 453                 atomic_inc(&svc->usecnt);
 454         read_unlock(&__ip_vs_svc_lock);
 455
 456         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 457                       fwmark, ip_vs_proto_name(protocol),
 458                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 459                       svc ? "hit" : "not hit");
 460
 461         return svc;
 462 }
 463
 464
 465 static inline void
 466 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 467 {
 468         atomic_inc(&svc->refcnt);
 469         dest->svc = svc;
 470 }
 471
 472 static void
 473 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 474 {
 475         struct ip_vs_service *svc = dest->svc;
 476
 477         dest->svc = NULL;
 478         if (atomic_dec_and_test(&svc->refcnt)) {
 479                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
 480                               svc->fwmark,
 481                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
 482                               ntohs(svc->port), atomic_read(&svc->usecnt));
 483                 free_percpu(svc->stats.cpustats);
 484                 kfree(svc);
 485         }
 486 }
 487
 488
 489 /*
 490  *      Returns hash value for real service
 491  */
 492 static inline unsigned int ip_vs_rs_hashkey(int af,
 493                                             const union nf_inet_addr *addr,
 494                                             __be16 port)
 495 {
 496         register unsigned int porth = ntohs(port);
 497         __be32 addr_fold = addr->ip;
 498
 499 #ifdef CONFIG_IP_VS_IPV6
 500         if (af == AF_INET6)
 501                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 502                             addr->ip6[2]^addr->ip6[3];
 503 #endif
 504
 505         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 506                 & IP_VS_RTAB_MASK;
 507 }
 508
 509 /*
 510  *      Hashes ip_vs_dest in rs_table by <proto,addr,port>.
 511  *      should be called with locked tables.
 512  */
 513 static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
 514 {
 515         unsigned int hash;
 516
 517         if (!list_empty(&dest->d_list)) {
 518                 return 0;
 519         }
 520
 521         /*
 522          *      Hash by proto,addr,port,
 523          *      which are the parameters of the real service.
 524          */
 525         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 526
 527         list_add(&dest->d_list, &ipvs->rs_table[hash]);
 528
 529         return 1;
 530 }
 531
 532 /*
 533  *      UNhashes ip_vs_dest from rs_table.
 534  *      should be called with locked tables.
 535  */
 536 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
 537 {
 538         /*
 539          * Remove it from the rs_table table.
 540          */
 541         if (!list_empty(&dest->d_list)) {
 542                 list_del(&dest->d_list);
 543                 INIT_LIST_HEAD(&dest->d_list);
 544         }
 545
 546         return 1;
 547 }
 548
 549 /*
 550  *      Lookup real service by <proto,addr,port> in the real service table.
 551  */
 552 struct ip_vs_dest *
 553 ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
 554                           const union nf_inet_addr *daddr,
 555                           __be16 dport)
 556 {
 557         struct netns_ipvs *ipvs = net_ipvs(net);
 558         unsigned int hash;
 559         struct ip_vs_dest *dest;
 560
 561         /*
 562          *      Check for "full" addressed entries
 563          *      Return the first found entry
 564          */
 565         hash = ip_vs_rs_hashkey(af, daddr, dport);
 566
 567         read_lock(&ipvs->rs_lock);
 568         list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
 569                 if ((dest->af == af)
 570                     && ip_vs_addr_equal(af, &dest->addr, daddr)
 571                     && (dest->port == dport)
 572                     && ((dest->protocol == protocol) ||
 573                         dest->vfwmark)) {
 574                         /* HIT */
 575                         read_unlock(&ipvs->rs_lock);
 576                         return dest;
 577                 }
 578         }
 579         read_unlock(&ipvs->rs_lock);
 580
 581         return NULL;
 582 }
 583
 584 /*
 585  *      Lookup destination by {addr,port} in the given service
 586  */
 587 static struct ip_vs_dest *
 588 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 589                   __be16 dport)
 590 {
 591         struct ip_vs_dest *dest;
 592
 593         /*
 594          * Find the destination for the given service
 595          */
 596         list_for_each_entry(dest, &svc->destinations, n_list) {
 597                 if ((dest->af == svc->af)
 598                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 599                     && (dest->port == dport)) {
 600                         /* HIT */
 601                         return dest;
 602                 }
 603         }
 604
 605         return NULL;
 606 }
 607
 608 /*
 609  * Find destination by {daddr,dport,vaddr,protocol}
 610  * Cretaed to be used in ip_vs_process_message() in
 611  * the backup synchronization daemon. It finds the
 612  * destination to be bound to the received connection
 613  * on the backup.
 614  *
 615  * ip_vs_lookup_real_service() looked promissing, but
 616  * seems not working as expected.
 617  */
 618 struct ip_vs_dest *ip_vs_find_dest(struct net  *net, int af,
 619                                    const union nf_inet_addr *daddr,
 620                                    __be16 dport,
 621                                    const union nf_inet_addr *vaddr,
 622                                    __be16 vport, __u16 protocol, __u32 fwmark,
 623                                    __u32 flags)
 624 {
 625         struct ip_vs_dest *dest;
 626         struct ip_vs_service *svc;
 627         __be16 port = dport;
 628
 629         svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
 630         if (!svc)
 631                 return NULL;
 632         if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
 633                 port = 0;
 634         dest = ip_vs_lookup_dest(svc, daddr, port);
 635         if (!dest)
 636                 dest = ip_vs_lookup_dest(svc, daddr, port ^ dport);
 637         if (dest)
 638                 atomic_inc(&dest->refcnt);
 639         ip_vs_service_put(svc);
 640         return dest;
 641 }
 642
 643 /*
 644  *  Lookup dest by {svc,addr,port} in the destination trash.
 645  *  The destination trash is used to hold the destinations that are removed
 646  *  from the service table but are still referenced by some conn entries.
 647  *  The reason to add the destination trash is when the dest is temporary
 648  *  down (either by administrator or by monitor program), the dest can be
 649  *  picked back from the trash, the remaining connections to the dest can
 650  *  continue, and the counting information of the dest is also useful for
 651  *  scheduling.
 652  */
 653 static struct ip_vs_dest *
 654 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 655                      __be16 dport)
 656 {
 657         struct ip_vs_dest *dest, *nxt;
 658         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 659
 660         /*
 661          * Find the destination in trash
 662          */
 663         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 664                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 665                               "dest->refcnt=%d\n",
 666                               dest->vfwmark,
 667                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 668                               ntohs(dest->port),
 669                               atomic_read(&dest->refcnt));
 670                 if (dest->af == svc->af &&
 671                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 672                     dest->port == dport &&
 673                     dest->vfwmark == svc->fwmark &&
 674                     dest->protocol == svc->protocol &&
 675                     (svc->fwmark ||
 676                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 677                       dest->vport == svc->port))) {
 678                         /* HIT */
 679                         return dest;
 680                 }
 681
 682                 /*
 683                  * Try to purge the destination from trash if not referenced
 684                  */
 685                 if (atomic_read(&dest->refcnt) == 1) {
 686                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
 687                                       "from trash\n",
 688                                       dest->vfwmark,
 689                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
 690                                       ntohs(dest->port));
 691                         list_del(&dest->n_list);
 692                         ip_vs_dst_reset(dest);
 693                         __ip_vs_unbind_svc(dest);
 694                         free_percpu(dest->stats.cpustats);
 695                         kfree(dest);
 696                 }
 697         }
 698
 699         return NULL;
 700 }
 701
 702
 703 /*
 704  *  Clean up all the destinations in the trash
 705  *  Called by the ip_vs_control_cleanup()
 706  *
 707  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 708  *  the service tables must have been flushed and all the connections
 709  *  are expired, and the refcnt of each destination in the trash must
 710  *  be 1, so we simply release them here.
 711  */
 712 static void ip_vs_trash_cleanup(struct net *net)
 713 {
 714         struct ip_vs_dest *dest, *nxt;
 715         struct netns_ipvs *ipvs = net_ipvs(net);
 716
 717         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 718                 list_del(&dest->n_list);
 719                 ip_vs_dst_reset(dest);
 720                 __ip_vs_unbind_svc(dest);
 721                 free_percpu(dest->stats.cpustats);
 722                 kfree(dest);
 723         }
 724 }
 725
 726 static void
 727 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
 728 {
 729 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
 730
 731         spin_lock_bh(&src->lock);
 732
 733         IP_VS_SHOW_STATS_COUNTER(conns);
 734         IP_VS_SHOW_STATS_COUNTER(inpkts);
 735         IP_VS_SHOW_STATS_COUNTER(outpkts);
 736         IP_VS_SHOW_STATS_COUNTER(inbytes);
 737         IP_VS_SHOW_STATS_COUNTER(outbytes);
 738
 739         ip_vs_read_estimator(dst, src);
 740
 741         spin_unlock_bh(&src->lock);
 742 }
 743
 744 static void
 745 ip_vs_zero_stats(struct ip_vs_stats *stats)
 746 {
 747         spin_lock_bh(&stats->lock);
 748
 749         /* get current counters as zero point, rates are zeroed */
 750
 751 #define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
 752
 753         IP_VS_ZERO_STATS_COUNTER(conns);
 754         IP_VS_ZERO_STATS_COUNTER(inpkts);
 755         IP_VS_ZERO_STATS_COUNTER(outpkts);
 756         IP_VS_ZERO_STATS_COUNTER(inbytes);
 757         IP_VS_ZERO_STATS_COUNTER(outbytes);
 758
 759         ip_vs_zero_estimator(stats);
 760
 761         spin_unlock_bh(&stats->lock);
 762 }
 763
 764 /*
 765  *      Update a destination in the given service
 766  */
 767 static void
 768 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
 769                     struct ip_vs_dest_user_kern *udest, int add)
 770 {
 771         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 772         int conn_flags;
 773
 774         /* set the weight and the flags */
 775         atomic_set(&dest->weight, udest->weight);
 776         conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
 777         conn_flags |= IP_VS_CONN_F_INACTIVE;
 778
 779         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 780         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
 781                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 782         } else {
 783                 /*
 784                  *    Put the real service in rs_table if not present.
 785                  *    For now only for NAT!
 786                  */
 787                 write_lock_bh(&ipvs->rs_lock);
 788                 ip_vs_rs_hash(ipvs, dest);
 789                 write_unlock_bh(&ipvs->rs_lock);
 790         }
 791         atomic_set(&dest->conn_flags, conn_flags);
 792
 793         /* bind the service */
 794         if (!dest->svc) {
 795                 __ip_vs_bind_svc(dest, svc);
 796         } else {
 797                 if (dest->svc != svc) {
 798                         __ip_vs_unbind_svc(dest);
 799                         ip_vs_zero_stats(&dest->stats);
 800                         __ip_vs_bind_svc(dest, svc);
 801                 }
 802         }
 803
 804         /* set the dest status flags */
 805         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 806
 807         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 808                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 809         dest->u_threshold = udest->u_threshold;
 810         dest->l_threshold = udest->l_threshold;
 811
 812         spin_lock_bh(&dest->dst_lock);
 813         ip_vs_dst_reset(dest);
 814         spin_unlock_bh(&dest->dst_lock);
 815
 816         if (add)
 817                 ip_vs_start_estimator(svc->net, &dest->stats);
 818
 819         write_lock_bh(&__ip_vs_svc_lock);
 820
 821         /* Wait until all other svc users go away */
 822         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
 823
 824         if (add) {
 825                 list_add(&dest->n_list, &svc->destinations);
 826                 svc->num_dests++;
 827         }
 828
 829         /* call the update_service, because server weight may be changed */
 830         if (svc->scheduler->update_service)
 831                 svc->scheduler->update_service(svc);
 832
 833         write_unlock_bh(&__ip_vs_svc_lock);
 834 }
 835
 836
 837 /*
 838  *      Create a destination for the given service
 839  */
 840 static int
 841 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 842                struct ip_vs_dest **dest_p)
 843 {
 844         struct ip_vs_dest *dest;
 845         unsigned int atype;
 846
 847         EnterFunction(2);
 848
 849 #ifdef CONFIG_IP_VS_IPV6
 850         if (svc->af == AF_INET6) {
 851                 atype = ipv6_addr_type(&udest->addr.in6);
 852                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 853                         atype & IPV6_ADDR_LINKLOCAL) &&
 854                         !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
 855                         return -EINVAL;
 856         } else
 857 #endif
 858         {
 859                 atype = inet_addr_type(svc->net, udest->addr.ip);
 860                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 861                         return -EINVAL;
 862         }
 863
 864         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
 865         if (dest == NULL)
 866                 return -ENOMEM;
 867
 868         dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
 869         if (!dest->stats.cpustats)
 870                 goto err_alloc;
 871
 872         dest->af = svc->af;
 873         dest->protocol = svc->protocol;
 874         dest->vaddr = svc->addr;
 875         dest->vport = svc->port;
 876         dest->vfwmark = svc->fwmark;
 877         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 878         dest->port = udest->port;
 879
 880         atomic_set(&dest->activeconns, 0);
 881         atomic_set(&dest->inactconns, 0);
 882         atomic_set(&dest->persistconns, 0);
 883         atomic_set(&dest->refcnt, 1);
 884
 885         INIT_LIST_HEAD(&dest->d_list);
 886         spin_lock_init(&dest->dst_lock);
 887         spin_lock_init(&dest->stats.lock);
 888         __ip_vs_update_dest(svc, dest, udest, 1);
 889
 890         *dest_p = dest;
 891
 892         LeaveFunction(2);
 893         return 0;
 894
 895 err_alloc:
 896         kfree(dest);
 897         return -ENOMEM;
 898 }
 899
 900
 901 /*
 902  *      Add a destination into an existing service
 903  */
 904 static int
 905 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 906 {
 907         struct ip_vs_dest *dest;
 908         union nf_inet_addr daddr;
 909         __be16 dport = udest->port;
 910         int ret;
 911
 912         EnterFunction(2);
 913
 914         if (udest->weight < 0) {
 915                 pr_err("%s(): server weight less than zero\n", __func__);
 916                 return -ERANGE;
 917         }
 918
 919         if (udest->l_threshold > udest->u_threshold) {
 920                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 921                         __func__);
 922                 return -ERANGE;
 923         }
 924
 925         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 926
 927         /*
 928          * Check if the dest already exists in the list
 929          */
 930         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 931
 932         if (dest != NULL) {
 933                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 934                 return -EEXIST;
 935         }
 936
 937         /*
 938          * Check if the dest already exists in the trash and
 939          * is from the same service
 940          */
 941         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 942
 943         if (dest != NULL) {
 944                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 945                               "dest->refcnt=%d, service %u/%s:%u\n",
 946                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 947                               atomic_read(&dest->refcnt),
 948                               dest->vfwmark,
 949                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 950                               ntohs(dest->vport));
 951
 952                 /*
 953                  * Get the destination from the trash
 954                  */
 955                 list_del(&dest->n_list);
 956
 957                 __ip_vs_update_dest(svc, dest, udest, 1);
 958                 ret = 0;
 959         } else {
 960                 /*
 961                  * Allocate and initialize the dest structure
 962                  */
 963                 ret = ip_vs_new_dest(svc, udest, &dest);
 964         }
 965         LeaveFunction(2);
 966
 967         return ret;
 968 }
 969
 970
 971 /*
 972  *      Edit a destination in the given service
 973  */
 974 static int
 975 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 976 {
 977         struct ip_vs_dest *dest;
 978         union nf_inet_addr daddr;
 979         __be16 dport = udest->port;
 980
 981         EnterFunction(2);
 982
 983         if (udest->weight < 0) {
 984                 pr_err("%s(): server weight less than zero\n", __func__);
 985                 return -ERANGE;
 986         }
 987
 988         if (udest->l_threshold > udest->u_threshold) {
 989                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 990                         __func__);
 991                 return -ERANGE;
 992         }
 993
 994         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 995
 996         /*
 997          *  Lookup the destination list
 998          */
 999         dest = ip_vs_lookup_dest(svc, &daddr, dport);
1000
1001         if (dest == NULL) {
1002                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1003                 return -ENOENT;
1004         }
1005
1006         __ip_vs_update_dest(svc, dest, udest, 0);
1007         LeaveFunction(2);
1008
1009         return 0;
1010 }
1011
1012
1013 /*
1014  *      Delete a destination (must be already unlinked from the service)
1015  */
1016 static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1017 {
1018         struct netns_ipvs *ipvs = net_ipvs(net);
1019
1020         ip_vs_stop_estimator(net, &dest->stats);
1021
1022         /*
1023          *  Remove it from the d-linked list with the real services.
1024          */
1025         write_lock_bh(&ipvs->rs_lock);
1026         ip_vs_rs_unhash(dest);
1027         write_unlock_bh(&ipvs->rs_lock);
1028
1029         /*
1030          *  Decrease the refcnt of the dest, and free the dest
1031          *  if nobody refers to it (refcnt=0). Otherwise, throw
1032          *  the destination into the trash.
1033          */
1034         if (atomic_dec_and_test(&dest->refcnt)) {
1035                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1036                               dest->vfwmark,
1037                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1038                               ntohs(dest->port));
1039                 ip_vs_dst_reset(dest);
1040                 /* simply decrease svc->refcnt here, let the caller check
1041                    and release the service if nobody refers to it.
1042                    Only user context can release destination and service,
1043                    and only one user context can update virtual service at a
1044                    time, so the operation here is OK */
1045                 atomic_dec(&dest->svc->refcnt);
1046                 free_percpu(dest->stats.cpustats);
1047                 kfree(dest);
1048         } else {
1049                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1050                               "dest->refcnt=%d\n",
1051                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1052                               ntohs(dest->port),
1053                               atomic_read(&dest->refcnt));
1054                 list_add(&dest->n_list, &ipvs->dest_trash);
1055                 atomic_inc(&dest->refcnt);
1056         }
1057 }
1058
1059
1060 /*
1061  *      Unlink a destination from the given service
1062  */
1063 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1064                                 struct ip_vs_dest *dest,
1065                                 int svcupd)
1066 {
1067         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1068
1069         /*
1070          *  Remove it from the d-linked destination list.
1071          */
1072         list_del(&dest->n_list);
1073         svc->num_dests--;
1074
1075         /*
1076          *  Call the update_service function of its scheduler
1077          */
1078         if (svcupd && svc->scheduler->update_service)
1079                         svc->scheduler->update_service(svc);
1080 }
1081
1082
1083 /*
1084  *      Delete a destination server in the given service
1085  */
1086 static int
1087 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1088 {
1089         struct ip_vs_dest *dest;
1090         __be16 dport = udest->port;
1091
1092         EnterFunction(2);
1093
1094         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1095
1096         if (dest == NULL) {
1097                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1098                 return -ENOENT;
1099         }
1100
1101         write_lock_bh(&__ip_vs_svc_lock);
1102
1103         /*
1104          *      Wait until all other svc users go away.
1105          */
1106         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1107
1108         /*
1109          *      Unlink dest from the service
1110          */
1111         __ip_vs_unlink_dest(svc, dest, 1);
1112
1113         write_unlock_bh(&__ip_vs_svc_lock);
1114
1115         /*
1116          *      Delete the destination
1117          */
1118         __ip_vs_del_dest(svc->net, dest);
1119
1120         LeaveFunction(2);
1121
1122         return 0;
1123 }
1124
1125
1126 /*
1127  *      Add a service into the service hash table
1128  */
1129 static int
1130 ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
1131                   struct ip_vs_service **svc_p)
1132 {
1133         int ret = 0;
1134         struct ip_vs_scheduler *sched = NULL;
1135         struct ip_vs_pe *pe = NULL;
1136         struct ip_vs_service *svc = NULL;
1137         struct netns_ipvs *ipvs = net_ipvs(net);
1138
1139         /* increase the module use count */
1140         ip_vs_use_count_inc();
1141
1142         /* Lookup the scheduler by 'u->sched_name' */
1143         sched = ip_vs_scheduler_get(u->sched_name);
1144         if (sched == NULL) {
1145                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1146                 ret = -ENOENT;
1147                 goto out_err;
1148         }
1149
1150         if (u->pe_name && *u->pe_name) {
1151                 pe = ip_vs_pe_getbyname(u->pe_name);
1152                 if (pe == NULL) {
1153                         pr_info("persistence engine module ip_vs_pe_%s "
1154                                 "not found\n", u->pe_name);
1155                         ret = -ENOENT;
1156                         goto out_err;
1157                 }
1158         }
1159
1160 #ifdef CONFIG_IP_VS_IPV6
1161         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1162                 ret = -EINVAL;
1163                 goto out_err;
1164         }
1165 #endif
1166
1167         svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1168         if (svc == NULL) {
1169                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1170                 ret = -ENOMEM;
1171                 goto out_err;
1172         }
1173         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1174         if (!svc->stats.cpustats)
1175                 goto out_err;
1176
1177         /* I'm the first user of the service */
1178         atomic_set(&svc->usecnt, 0);
1179         atomic_set(&svc->refcnt, 0);
1180
1181         svc->af = u->af;
1182         svc->protocol = u->protocol;
1183         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1184         svc->port = u->port;
1185         svc->fwmark = u->fwmark;
1186         svc->flags = u->flags;
1187         svc->timeout = u->timeout * HZ;
1188         svc->netmask = u->netmask;
1189         svc->net = net;
1190
1191         INIT_LIST_HEAD(&svc->destinations);
1192         rwlock_init(&svc->sched_lock);
1193         spin_lock_init(&svc->stats.lock);
1194
1195         /* Bind the scheduler */
1196         ret = ip_vs_bind_scheduler(svc, sched);
1197         if (ret)
1198                 goto out_err;
1199         sched = NULL;
1200
1201         /* Bind the ct retriever */
1202         ip_vs_bind_pe(svc, pe);
1203         pe = NULL;
1204
1205         /* Update the virtual service counters */
1206         if (svc->port == FTPPORT)
1207                 atomic_inc(&ipvs->ftpsvc_counter);
1208         else if (svc->port == 0)
1209                 atomic_inc(&ipvs->nullsvc_counter);
1210
1211         ip_vs_start_estimator(net, &svc->stats);
1212
1213         /* Count only IPv4 services for old get/setsockopt interface */
1214         if (svc->af == AF_INET)
1215                 ipvs->num_services++;
1216
1217         /* Hash the service into the service table */
1218         write_lock_bh(&__ip_vs_svc_lock);
1219         ip_vs_svc_hash(svc);
1220         write_unlock_bh(&__ip_vs_svc_lock);
1221
1222         *svc_p = svc;
1223         /* Now there is a service - full throttle */
1224         ipvs->enable = 1;
1225         return 0;
1226
1227
1228  out_err:
1229         if (svc != NULL) {
1230                 ip_vs_unbind_scheduler(svc);
1231                 if (svc->inc) {
1232                         local_bh_disable();
1233                         ip_vs_app_inc_put(svc->inc);
1234                         local_bh_enable();
1235                 }
1236                 if (svc->stats.cpustats)
1237                         free_percpu(svc->stats.cpustats);
1238                 kfree(svc);
1239         }
1240         ip_vs_scheduler_put(sched);
1241         ip_vs_pe_put(pe);
1242
1243         /* decrease the module use count */
1244         ip_vs_use_count_dec();
1245
1246         return ret;
1247 }
1248
1249
1250 /*
1251  *      Edit a service and bind it with a new scheduler
1252  */
1253 static int
1254 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1255 {
1256         struct ip_vs_scheduler *sched, *old_sched;
1257         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1258         int ret = 0;
1259
1260         /*
1261          * Lookup the scheduler, by 'u->sched_name'
1262          */
1263         sched = ip_vs_scheduler_get(u->sched_name);
1264         if (sched == NULL) {
1265                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1266                 return -ENOENT;
1267         }
1268         old_sched = sched;
1269
1270         if (u->pe_name && *u->pe_name) {
1271                 pe = ip_vs_pe_getbyname(u->pe_name);
1272                 if (pe == NULL) {
1273                         pr_info("persistence engine module ip_vs_pe_%s "
1274                                 "not found\n", u->pe_name);
1275                         ret = -ENOENT;
1276                         goto out;
1277                 }
1278                 old_pe = pe;
1279         }
1280
1281 #ifdef CONFIG_IP_VS_IPV6
1282         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1283                 ret = -EINVAL;
1284                 goto out;
1285         }
1286 #endif
1287
1288         write_lock_bh(&__ip_vs_svc_lock);
1289
1290         /*
1291          * Wait until all other svc users go away.
1292          */
1293         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1294
1295         /*
1296          * Set the flags and timeout value
1297          */
1298         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1299         svc->timeout = u->timeout * HZ;
1300         svc->netmask = u->netmask;
1301
1302         old_sched = svc->scheduler;
1303         if (sched != old_sched) {
1304                 /*
1305                  * Unbind the old scheduler
1306                  */
1307                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1308                         old_sched = sched;
1309                         goto out_unlock;
1310                 }
1311
1312                 /*
1313                  * Bind the new scheduler
1314                  */
1315                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1316                         /*
1317                          * If ip_vs_bind_scheduler fails, restore the old
1318                          * scheduler.
1319                          * The main reason of failure is out of memory.
1320                          *
1321                          * The question is if the old scheduler can be
1322                          * restored all the time. TODO: if it cannot be
1323                          * restored some time, we must delete the service,
1324                          * otherwise the system may crash.
1325                          */
1326                         ip_vs_bind_scheduler(svc, old_sched);
1327                         old_sched = sched;
1328                         goto out_unlock;
1329                 }
1330         }
1331
1332         old_pe = svc->pe;
1333         if (pe != old_pe) {
1334                 ip_vs_unbind_pe(svc);
1335                 ip_vs_bind_pe(svc, pe);
1336         }
1337
1338 out_unlock:
1339         write_unlock_bh(&__ip_vs_svc_lock);
1340 out:
1341         ip_vs_scheduler_put(old_sched);
1342         ip_vs_pe_put(old_pe);
1343         return ret;
1344 }
1345
1346
1347 /*
1348  *      Delete a service from the service list
1349  *      - The service must be unlinked, unlocked and not referenced!
1350  *      - We are called under _bh lock
1351  */
1352 static void __ip_vs_del_service(struct ip_vs_service *svc)
1353 {
1354         struct ip_vs_dest *dest, *nxt;
1355         struct ip_vs_scheduler *old_sched;
1356         struct ip_vs_pe *old_pe;
1357         struct netns_ipvs *ipvs = net_ipvs(svc->net);
1358
1359         pr_info("%s: enter\n", __func__);
1360
1361         /* Count only IPv4 services for old get/setsockopt interface */
1362         if (svc->af == AF_INET)
1363                 ipvs->num_services--;
1364
1365         ip_vs_stop_estimator(svc->net, &svc->stats);
1366
1367         /* Unbind scheduler */
1368         old_sched = svc->scheduler;
1369         ip_vs_unbind_scheduler(svc);
1370         ip_vs_scheduler_put(old_sched);
1371
1372         /* Unbind persistence engine */
1373         old_pe = svc->pe;
1374         ip_vs_unbind_pe(svc);
1375         ip_vs_pe_put(old_pe);
1376
1377         /* Unbind app inc */
1378         if (svc->inc) {
1379                 ip_vs_app_inc_put(svc->inc);
1380                 svc->inc = NULL;
1381         }
1382
1383         /*
1384          *    Unlink the whole destination list
1385          */
1386         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1387                 __ip_vs_unlink_dest(svc, dest, 0);
1388                 __ip_vs_del_dest(svc->net, dest);
1389         }
1390
1391         /*
1392          *    Update the virtual service counters
1393          */
1394         if (svc->port == FTPPORT)
1395                 atomic_dec(&ipvs->ftpsvc_counter);
1396         else if (svc->port == 0)
1397                 atomic_dec(&ipvs->nullsvc_counter);
1398
1399         /*
1400          *    Free the service if nobody refers to it
1401          */
1402         if (atomic_read(&svc->refcnt) == 0) {
1403                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1404                               svc->fwmark,
1405                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
1406                               ntohs(svc->port), atomic_read(&svc->usecnt));
1407                 free_percpu(svc->stats.cpustats);
1408                 kfree(svc);
1409         }
1410
1411         /* decrease the module use count */
1412         ip_vs_use_count_dec();
1413 }
1414
1415 /*
1416  * Unlink a service from list and try to delete it if its refcnt reached 0
1417  */
1418 static void ip_vs_unlink_service(struct ip_vs_service *svc)
1419 {
1420         /*
1421          * Unhash it from the service table
1422          */
1423         write_lock_bh(&__ip_vs_svc_lock);
1424
1425         ip_vs_svc_unhash(svc);
1426
1427         /*
1428          * Wait until all the svc users go away.
1429          */
1430         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1431
1432         __ip_vs_del_service(svc);
1433
1434         write_unlock_bh(&__ip_vs_svc_lock);
1435 }
1436
1437 /*
1438  *      Delete a service from the service list
1439  */
1440 static int ip_vs_del_service(struct ip_vs_service *svc)
1441 {
1442         if (svc == NULL)
1443                 return -EEXIST;
1444         ip_vs_unlink_service(svc);
1445
1446         return 0;
1447 }
1448
1449
1450 /*
1451  *      Flush all the virtual services
1452  */
1453 static int ip_vs_flush(struct net *net)
1454 {
1455         int idx;
1456         struct ip_vs_service *svc, *nxt;
1457
1458         /*
1459          * Flush the service table hashed by <netns,protocol,addr,port>
1460          */
1461         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1462                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1463                                          s_list) {
1464                         if (net_eq(svc->net, net))
1465                                 ip_vs_unlink_service(svc);
1466                 }
1467         }
1468
1469         /*
1470          * Flush the service table hashed by fwmark
1471          */
1472         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1473                 list_for_each_entry_safe(svc, nxt,
1474                                          &ip_vs_svc_fwm_table[idx], f_list) {
1475                         if (net_eq(svc->net, net))
1476                                 ip_vs_unlink_service(svc);
1477                 }
1478         }
1479
1480         return 0;
1481 }
1482
1483 /*
1484  *      Delete service by {netns} in the service table.
1485  *      Called by __ip_vs_cleanup()
1486  */
1487 void ip_vs_service_net_cleanup(struct net *net)
1488 {
1489         EnterFunction(2);
1490         /* Check for "full" addressed entries */
1491         mutex_lock(&__ip_vs_mutex);
1492         ip_vs_flush(net);
1493         mutex_unlock(&__ip_vs_mutex);
1494         LeaveFunction(2);
1495 }
1496 /*
1497  * Release dst hold by dst_cache
1498  */
1499 static inline void
1500 __ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1501 {
1502         spin_lock_bh(&dest->dst_lock);
1503         if (dest->dst_cache && dest->dst_cache->dev == dev) {
1504                 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1505                               dev->name,
1506                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1507                               ntohs(dest->port),
1508                               atomic_read(&dest->refcnt));
1509                 ip_vs_dst_reset(dest);
1510         }
1511         spin_unlock_bh(&dest->dst_lock);
1512
1513 }
1514 /*
1515  * Netdev event receiver
1516  * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1517  * a device that is "unregister" it must be released.
1518  */
1519 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1520                             void *ptr)
1521 {
1522         struct net_device *dev = ptr;
1523         struct net *net = dev_net(dev);
1524         struct netns_ipvs *ipvs = net_ipvs(net);
1525         struct ip_vs_service *svc;
1526         struct ip_vs_dest *dest;
1527         unsigned int idx;
1528
1529         if (event != NETDEV_UNREGISTER || !ipvs)
1530                 return NOTIFY_DONE;
1531         IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1532         EnterFunction(2);
1533         mutex_lock(&__ip_vs_mutex);
1534         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1535                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1536                         if (net_eq(svc->net, net)) {
1537                                 list_for_each_entry(dest, &svc->destinations,
1538                                                     n_list) {
1539                                         __ip_vs_dev_reset(dest, dev);
1540                                 }
1541                         }
1542                 }
1543
1544                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1545                         if (net_eq(svc->net, net)) {
1546                                 list_for_each_entry(dest, &svc->destinations,
1547                                                     n_list) {
1548                                         __ip_vs_dev_reset(dest, dev);
1549                                 }
1550                         }
1551
1552                 }
1553         }
1554
1555         list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
1556                 __ip_vs_dev_reset(dest, dev);
1557         }
1558         mutex_unlock(&__ip_vs_mutex);
1559         LeaveFunction(2);
1560         return NOTIFY_DONE;
1561 }
1562
1563 /*
1564  *      Zero counters in a service or all services
1565  */
1566 static int ip_vs_zero_service(struct ip_vs_service *svc)
1567 {
1568         struct ip_vs_dest *dest;
1569
1570         write_lock_bh(&__ip_vs_svc_lock);
1571         list_for_each_entry(dest, &svc->destinations, n_list) {
1572                 ip_vs_zero_stats(&dest->stats);
1573         }
1574         ip_vs_zero_stats(&svc->stats);
1575         write_unlock_bh(&__ip_vs_svc_lock);
1576         return 0;
1577 }
1578
1579 static int ip_vs_zero_all(struct net *net)
1580 {
1581         int idx;
1582         struct ip_vs_service *svc;
1583
1584         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1585                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1586                         if (net_eq(svc->net, net))
1587                                 ip_vs_zero_service(svc);
1588                 }
1589         }
1590
1591         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1592                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1593                         if (net_eq(svc->net, net))
1594                                 ip_vs_zero_service(svc);
1595                 }
1596         }
1597
1598         ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1599         return 0;
1600 }
1601
1602 #ifdef CONFIG_SYSCTL
1603
1604 static int zero;
1605 static int three = 3;
1606
1607 static int
1608 proc_do_defense_mode(ctl_table *table, int write,
1609                      void __user *buffer, size_t *lenp, loff_t *ppos)
1610 {
1611         struct net *net = current->nsproxy->net_ns;
1612         int *valp = table->data;
1613         int val = *valp;
1614         int rc;
1615
1616         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1617         if (write && (*valp != val)) {
1618                 if ((*valp < 0) || (*valp > 3)) {
1619                         /* Restore the correct value */
1620                         *valp = val;
1621                 } else {
1622                         update_defense_level(net_ipvs(net));
1623                 }
1624         }
1625         return rc;
1626 }
1627
1628 static int
1629 proc_do_sync_threshold(ctl_table *table, int write,
1630                        void __user *buffer, size_t *lenp, loff_t *ppos)
1631 {
1632         int *valp = table->data;
1633         int val[2];
1634         int rc;
1635
1636         /* backup the value first */
1637         memcpy(val, valp, sizeof(val));
1638
1639         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1640         if (write && (valp[0] < 0 || valp[1] < 0 ||
1641             (valp[0] >= valp[1] && valp[1]))) {
1642                 /* Restore the correct value */
1643                 memcpy(valp, val, sizeof(val));
1644         }
1645         return rc;
1646 }
1647
1648 static int
1649 proc_do_sync_mode(ctl_table *table, int write,
1650                      void __user *buffer, size_t *lenp, loff_t *ppos)
1651 {
1652         int *valp = table->data;
1653         int val = *valp;
1654         int rc;
1655
1656         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1657         if (write && (*valp != val)) {
1658                 if ((*valp < 0) || (*valp > 1)) {
1659                         /* Restore the correct value */
1660                         *valp = val;
1661                 }
1662         }
1663         return rc;
1664 }
1665
1666 static int
1667 proc_do_sync_ports(ctl_table *table, int write,
1668                    void __user *buffer, size_t *lenp, loff_t *ppos)
1669 {
1670         int *valp = table->data;
1671         int val = *valp;
1672         int rc;
1673
1674         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1675         if (write && (*valp != val)) {
1676                 if (*valp < 1 || !is_power_of_2(*valp)) {
1677                         /* Restore the correct value */
1678                         *valp = val;
1679                 }
1680         }
1681         return rc;
1682 }
1683
1684 /*
1685  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1686  *      Do not change order or insert new entries without
1687  *      align with netns init in ip_vs_control_net_init()
1688  */
1689
1690 static struct ctl_table vs_vars[] = {
1691         {
1692                 .procname       = "amemthresh",
1693                 .maxlen         = sizeof(int),
1694                 .mode           = 0644,
1695                 .proc_handler   = proc_dointvec,
1696         },
1697         {
1698                 .procname       = "am_droprate",
1699                 .maxlen         = sizeof(int),
1700                 .mode           = 0644,
1701                 .proc_handler   = proc_dointvec,
1702         },
1703         {
1704                 .procname       = "drop_entry",
1705                 .maxlen         = sizeof(int),
1706                 .mode           = 0644,
1707                 .proc_handler   = proc_do_defense_mode,
1708         },
1709         {
1710                 .procname       = "drop_packet",
1711                 .maxlen         = sizeof(int),
1712                 .mode           = 0644,
1713                 .proc_handler   = proc_do_defense_mode,
1714         },
1715 #ifdef CONFIG_IP_VS_NFCT
1716         {
1717                 .procname       = "conntrack",
1718                 .maxlen         = sizeof(int),
1719                 .mode           = 0644,
1720                 .proc_handler   = &proc_dointvec,
1721         },
1722 #endif
1723         {
1724                 .procname       = "secure_tcp",
1725                 .maxlen         = sizeof(int),
1726                 .mode           = 0644,
1727                 .proc_handler   = proc_do_defense_mode,
1728         },
1729         {
1730                 .procname       = "snat_reroute",
1731                 .maxlen         = sizeof(int),
1732                 .mode           = 0644,
1733                 .proc_handler   = &proc_dointvec,
1734         },
1735         {
1736                 .procname       = "sync_version",
1737                 .maxlen         = sizeof(int),
1738                 .mode           = 0644,
1739                 .proc_handler   = &proc_do_sync_mode,
1740         },
1741         {
1742                 .procname       = "sync_ports",
1743                 .maxlen         = sizeof(int),
1744                 .mode           = 0644,
1745                 .proc_handler   = &proc_do_sync_ports,
1746         },
1747         {
1748                 .procname       = "sync_qlen_max",
1749                 .maxlen         = sizeof(int),
1750                 .mode           = 0644,
1751                 .proc_handler   = proc_dointvec,
1752         },
1753         {
1754                 .procname       = "sync_sock_size",
1755                 .maxlen         = sizeof(int),
1756                 .mode           = 0644,
1757                 .proc_handler   = proc_dointvec,
1758         },
1759         {
1760                 .procname       = "cache_bypass",
1761                 .maxlen         = sizeof(int),
1762                 .mode           = 0644,
1763                 .proc_handler   = proc_dointvec,
1764         },
1765         {
1766                 .procname       = "expire_nodest_conn",
1767                 .maxlen         = sizeof(int),
1768                 .mode           = 0644,
1769                 .proc_handler   = proc_dointvec,
1770         },
1771         {
1772                 .procname       = "expire_quiescent_template",
1773                 .maxlen         = sizeof(int),
1774                 .mode           = 0644,
1775                 .proc_handler   = proc_dointvec,
1776         },
1777         {
1778                 .procname       = "sync_threshold",
1779                 .maxlen         =
1780                         sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1781                 .mode           = 0644,
1782                 .proc_handler   = proc_do_sync_threshold,
1783         },
1784         {
1785                 .procname       = "sync_refresh_period",
1786                 .maxlen         = sizeof(int),
1787                 .mode           = 0644,
1788                 .proc_handler   = proc_dointvec_jiffies,
1789         },
1790         {
1791                 .procname       = "sync_retries",
1792                 .maxlen         = sizeof(int),
1793                 .mode           = 0644,
1794                 .proc_handler   = proc_dointvec_minmax,
1795                 .extra1         = &zero,
1796                 .extra2         = &three,
1797         },
1798         {
1799                 .procname       = "nat_icmp_send",
1800                 .maxlen         = sizeof(int),
1801                 .mode           = 0644,
1802                 .proc_handler   = proc_dointvec,
1803         },
1804 #ifdef CONFIG_IP_VS_DEBUG
1805         {
1806                 .procname       = "debug_level",
1807                 .data           = &sysctl_ip_vs_debug_level,
1808                 .maxlen         = sizeof(int),
1809                 .mode           = 0644,
1810                 .proc_handler   = proc_dointvec,
1811         },
1812 #endif
1813 #if 0
1814         {
1815                 .procname       = "timeout_established",
1816                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1817                 .maxlen         = sizeof(int),
1818                 .mode           = 0644,
1819                 .proc_handler   = proc_dointvec_jiffies,
1820         },
1821         {
1822                 .procname       = "timeout_synsent",
1823                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1824                 .maxlen         = sizeof(int),
1825                 .mode           = 0644,
1826                 .proc_handler   = proc_dointvec_jiffies,
1827         },
1828         {
1829                 .procname       = "timeout_synrecv",
1830                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1831                 .maxlen         = sizeof(int),
1832                 .mode           = 0644,
1833                 .proc_handler   = proc_dointvec_jiffies,
1834         },
1835         {
1836                 .procname       = "timeout_finwait",
1837                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1838                 .maxlen         = sizeof(int),
1839                 .mode           = 0644,
1840                 .proc_handler   = proc_dointvec_jiffies,
1841         },
1842         {
1843                 .procname       = "timeout_timewait",
1844                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1845                 .maxlen         = sizeof(int),
1846                 .mode           = 0644,
1847                 .proc_handler   = proc_dointvec_jiffies,
1848         },
1849         {
1850                 .procname       = "timeout_close",
1851                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1852                 .maxlen         = sizeof(int),
1853                 .mode           = 0644,
1854                 .proc_handler   = proc_dointvec_jiffies,
1855         },
1856         {
1857                 .procname       = "timeout_closewait",
1858                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1859                 .maxlen         = sizeof(int),
1860                 .mode           = 0644,
1861                 .proc_handler   = proc_dointvec_jiffies,
1862         },
1863         {
1864                 .procname       = "timeout_lastack",
1865                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1866                 .maxlen         = sizeof(int),
1867                 .mode           = 0644,
1868                 .proc_handler   = proc_dointvec_jiffies,
1869         },
1870         {
1871                 .procname       = "timeout_listen",
1872                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1873                 .maxlen         = sizeof(int),
1874                 .mode           = 0644,
1875                 .proc_handler   = proc_dointvec_jiffies,
1876         },
1877         {
1878                 .procname       = "timeout_synack",
1879                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1880                 .maxlen         = sizeof(int),
1881                 .mode           = 0644,
1882                 .proc_handler   = proc_dointvec_jiffies,
1883         },
1884         {
1885                 .procname       = "timeout_udp",
1886                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1887                 .maxlen         = sizeof(int),
1888                 .mode           = 0644,
1889                 .proc_handler   = proc_dointvec_jiffies,
1890         },
1891         {
1892                 .procname       = "timeout_icmp",
1893                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1894                 .maxlen         = sizeof(int),
1895                 .mode           = 0644,
1896                 .proc_handler   = proc_dointvec_jiffies,
1897         },
1898 #endif
1899         { }
1900 };
1901
1902 #endif
1903
1904 #ifdef CONFIG_PROC_FS
1905
1906 struct ip_vs_iter {
1907         struct seq_net_private p;  /* Do not move this, netns depends upon it*/
1908         struct list_head *table;
1909         int bucket;
1910 };
1911
1912 /*
1913  *      Write the contents of the VS rule table to a PROCfs file.
1914  *      (It is kept just for backward compatibility)
1915  */
1916 static inline const char *ip_vs_fwd_name(unsigned int flags)
1917 {
1918         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1919         case IP_VS_CONN_F_LOCALNODE:
1920                 return "Local";
1921         case IP_VS_CONN_F_TUNNEL:
1922                 return "Tunnel";
1923         case IP_VS_CONN_F_DROUTE:
1924                 return "Route";
1925         default:
1926                 return "Masq";
1927         }
1928 }
1929
1930
1931 /* Get the Nth entry in the two lists */
1932 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1933 {
1934         struct net *net = seq_file_net(seq);
1935         struct ip_vs_iter *iter = seq->private;
1936         int idx;
1937         struct ip_vs_service *svc;
1938
1939         /* look in hash by protocol */
1940         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1941                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1942                         if (net_eq(svc->net, net) && pos-- == 0) {
1943                                 iter->table = ip_vs_svc_table;
1944                                 iter->bucket = idx;
1945                                 return svc;
1946                         }
1947                 }
1948         }
1949
1950         /* keep looking in fwmark */
1951         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1952                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1953                         if (net_eq(svc->net, net) && pos-- == 0) {
1954                                 iter->table = ip_vs_svc_fwm_table;
1955                                 iter->bucket = idx;
1956                                 return svc;
1957                         }
1958                 }
1959         }
1960
1961         return NULL;
1962 }
1963
1964 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1965 __acquires(__ip_vs_svc_lock)
1966 {
1967
1968         read_lock_bh(&__ip_vs_svc_lock);
1969         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1970 }
1971
1972
1973 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1974 {
1975         struct list_head *e;
1976         struct ip_vs_iter *iter;
1977         struct ip_vs_service *svc;
1978
1979         ++*pos;
1980         if (v == SEQ_START_TOKEN)
1981                 return ip_vs_info_array(seq,0);
1982
1983         svc = v;
1984         iter = seq->private;
1985
1986         if (iter->table == ip_vs_svc_table) {
1987                 /* next service in table hashed by protocol */
1988                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1989                         return list_entry(e, struct ip_vs_service, s_list);
1990
1991
1992                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1993                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1994                                             s_list) {
1995                                 return svc;
1996                         }
1997                 }
1998
1999                 iter->table = ip_vs_svc_fwm_table;
2000                 iter->bucket = -1;
2001                 goto scan_fwmark;
2002         }
2003
2004         /* next service in hashed by fwmark */
2005         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
2006                 return list_entry(e, struct ip_vs_service, f_list);
2007
2008  scan_fwmark:
2009         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2010                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
2011                                     f_list)
2012                         return svc;
2013         }
2014
2015         return NULL;
2016 }
2017
2018 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
2019 __releases(__ip_vs_svc_lock)
2020 {
2021         read_unlock_bh(&__ip_vs_svc_lock);
2022 }
2023
2024
2025 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
2026 {
2027         if (v == SEQ_START_TOKEN) {
2028                 seq_printf(seq,
2029                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
2030                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2031                 seq_puts(seq,
2032                          "Prot LocalAddress:Port Scheduler Flags\n");
2033                 seq_puts(seq,
2034                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
2035         } else {
2036                 const struct ip_vs_service *svc = v;
2037                 const struct ip_vs_iter *iter = seq->private;
2038                 const struct ip_vs_dest *dest;
2039
2040                 if (iter->table == ip_vs_svc_table) {
2041 #ifdef CONFIG_IP_VS_IPV6
2042                         if (svc->af == AF_INET6)
2043                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
2044                                            ip_vs_proto_name(svc->protocol),
2045                                            &svc->addr.in6,
2046                                            ntohs(svc->port),
2047                                            svc->scheduler->name);
2048                         else
2049 #endif
2050                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
2051                                            ip_vs_proto_name(svc->protocol),
2052                                            ntohl(svc->addr.ip),
2053                                            ntohs(svc->port),
2054                                            svc->scheduler->name,
2055                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2056                 } else {
2057                         seq_printf(seq, "FWM  %08X %s %s",
2058                                    svc->fwmark, svc->scheduler->name,
2059                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2060                 }
2061
2062                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2063                         seq_printf(seq, "persistent %d %08X\n",
2064                                 svc->timeout,
2065                                 ntohl(svc->netmask));
2066                 else
2067                         seq_putc(seq, '\n');
2068
2069                 list_for_each_entry(dest, &svc->destinations, n_list) {
2070 #ifdef CONFIG_IP_VS_IPV6
2071                         if (dest->af == AF_INET6)
2072                                 seq_printf(seq,
2073                                            "  -> [%pI6]:%04X"
2074                                            "      %-7s %-6d %-10d %-10d\n",
2075                                            &dest->addr.in6,
2076                                            ntohs(dest->port),
2077                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2078                                            atomic_read(&dest->weight),
2079                                            atomic_read(&dest->activeconns),
2080                                            atomic_read(&dest->inactconns));
2081                         else
2082 #endif
2083                                 seq_printf(seq,
2084                                            "  -> %08X:%04X      "
2085                                            "%-7s %-6d %-10d %-10d\n",
2086                                            ntohl(dest->addr.ip),
2087                                            ntohs(dest->port),
2088                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2089                                            atomic_read(&dest->weight),
2090                                            atomic_read(&dest->activeconns),
2091                                            atomic_read(&dest->inactconns));
2092
2093                 }
2094         }
2095         return 0;
2096 }
2097
2098 static const struct seq_operations ip_vs_info_seq_ops = {
2099         .start = ip_vs_info_seq_start,
2100         .next  = ip_vs_info_seq_next,
2101         .stop  = ip_vs_info_seq_stop,
2102         .show  = ip_vs_info_seq_show,
2103 };
2104
2105 static int ip_vs_info_open(struct inode *inode, struct file *file)
2106 {
2107         return seq_open_net(inode, file, &ip_vs_info_seq_ops,
2108                         sizeof(struct ip_vs_iter));
2109 }
2110
2111 static const struct file_operations ip_vs_info_fops = {
2112         .owner   = THIS_MODULE,
2113         .open    = ip_vs_info_open,
2114         .read    = seq_read,
2115         .llseek  = seq_lseek,
2116         .release = seq_release_net,
2117 };
2118
2119 static int ip_vs_stats_show(struct seq_file *seq, void *v)
2120 {
2121         struct net *net = seq_file_single_net(seq);
2122         struct ip_vs_stats_user show;
2123
2124 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2125         seq_puts(seq,
2126                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
2127         seq_printf(seq,
2128                    "   Conns  Packets  Packets            Bytes            Bytes\n");
2129
2130         ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2131         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2132                    show.inpkts, show.outpkts,
2133                    (unsigned long long) show.inbytes,
2134                    (unsigned long long) show.outbytes);
2135
2136 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2137         seq_puts(seq,
2138                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2139         seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2140                         show.cps, show.inpps, show.outpps,
2141                         show.inbps, show.outbps);
2142
2143         return 0;
2144 }
2145
2146 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2147 {
2148         return single_open_net(inode, file, ip_vs_stats_show);
2149 }
2150
2151 static const struct file_operations ip_vs_stats_fops = {
2152         .owner = THIS_MODULE,
2153         .open = ip_vs_stats_seq_open,
2154         .read = seq_read,
2155         .llseek = seq_lseek,
2156         .release = single_release_net,
2157 };
2158
2159 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2160 {
2161         struct net *net = seq_file_single_net(seq);
2162         struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2163         struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
2164         struct ip_vs_stats_user rates;
2165         int i;
2166
2167 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2168         seq_puts(seq,
2169                  "       Total Incoming Outgoing         Incoming         Outgoing\n");
2170         seq_printf(seq,
2171                    "CPU    Conns  Packets  Packets            Bytes            Bytes\n");
2172
2173         for_each_possible_cpu(i) {
2174                 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2175                 unsigned int start;
2176                 __u64 inbytes, outbytes;
2177
2178                 do {
2179                         start = u64_stats_fetch_begin_bh(&u->syncp);
2180                         inbytes = u->ustats.inbytes;
2181                         outbytes = u->ustats.outbytes;
2182                 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2183
2184                 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2185                            i, u->ustats.conns, u->ustats.inpkts,
2186                            u->ustats.outpkts, (__u64)inbytes,
2187                            (__u64)outbytes);
2188         }
2189
2190         spin_lock_bh(&tot_stats->lock);
2191
2192         seq_printf(seq, "  ~ %8X %8X %8X %16LX %16LX\n\n",
2193                    tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2194                    tot_stats->ustats.outpkts,
2195                    (unsigned long long) tot_stats->ustats.inbytes,
2196                    (unsigned long long) tot_stats->ustats.outbytes);
2197
2198         ip_vs_read_estimator(&rates, tot_stats);
2199
2200         spin_unlock_bh(&tot_stats->lock);
2201
2202 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2203         seq_puts(seq,
2204                    "     Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2205         seq_printf(seq, "    %8X %8X %8X %16X %16X\n",
2206                         rates.cps,
2207                         rates.inpps,
2208                         rates.outpps,
2209                         rates.inbps,
2210                         rates.outbps);
2211
2212         return 0;
2213 }
2214
2215 static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2216 {
2217         return single_open_net(inode, file, ip_vs_stats_percpu_show);
2218 }
2219
2220 static const struct file_operations ip_vs_stats_percpu_fops = {
2221         .owner = THIS_MODULE,
2222         .open = ip_vs_stats_percpu_seq_open,
2223         .read = seq_read,
2224         .llseek = seq_lseek,
2225         .release = single_release_net,
2226 };
2227 #endif
2228
2229 /*
2230  *      Set timeout values for tcp tcpfin udp in the timeout_table.
2231  */
2232 static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
2233 {
2234 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2235         struct ip_vs_proto_data *pd;
2236 #endif
2237
2238         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2239                   u->tcp_timeout,
2240                   u->tcp_fin_timeout,
2241                   u->udp_timeout);
2242
2243 #ifdef CONFIG_IP_VS_PROTO_TCP
2244         if (u->tcp_timeout) {
2245                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2246                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2247                         = u->tcp_timeout * HZ;
2248         }
2249
2250         if (u->tcp_fin_timeout) {
2251                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2252                 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2253                         = u->tcp_fin_timeout * HZ;
2254         }
2255 #endif
2256
2257 #ifdef CONFIG_IP_VS_PROTO_UDP
2258         if (u->udp_timeout) {
2259                 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2260                 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2261                         = u->udp_timeout * HZ;
2262         }
2263 #endif
2264         return 0;
2265 }
2266
2267
2268 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2269 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2270 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2271                                  sizeof(struct ip_vs_dest_user))
2272 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2273 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2274 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2275
2276 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2277         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2278         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2279         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2280         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2281         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2282         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2283         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2284         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2285         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2286         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2287         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2288 };
2289
2290 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2291                                   struct ip_vs_service_user *usvc_compat)
2292 {
2293         memset(usvc, 0, sizeof(*usvc));
2294
2295         usvc->af                = AF_INET;
2296         usvc->protocol          = usvc_compat->protocol;
2297         usvc->addr.ip           = usvc_compat->addr;
2298         usvc->port              = usvc_compat->port;
2299         usvc->fwmark            = usvc_compat->fwmark;
2300
2301         /* Deep copy of sched_name is not needed here */
2302         usvc->sched_name        = usvc_compat->sched_name;
2303
2304         usvc->flags             = usvc_compat->flags;
2305         usvc->timeout           = usvc_compat->timeout;
2306         usvc->netmask           = usvc_compat->netmask;
2307 }
2308
2309 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2310                                    struct ip_vs_dest_user *udest_compat)
2311 {
2312         memset(udest, 0, sizeof(*udest));
2313
2314         udest->addr.ip          = udest_compat->addr;
2315         udest->port             = udest_compat->port;
2316         udest->conn_flags       = udest_compat->conn_flags;
2317         udest->weight           = udest_compat->weight;
2318         udest->u_threshold      = udest_compat->u_threshold;
2319         udest->l_threshold      = udest_compat->l_threshold;
2320 }
2321
2322 static int
2323 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2324 {
2325         struct net *net = sock_net(sk);
2326         int ret;
2327         unsigned char arg[MAX_ARG_LEN];
2328         struct ip_vs_service_user *usvc_compat;
2329         struct ip_vs_service_user_kern usvc;
2330         struct ip_vs_service *svc;
2331         struct ip_vs_dest_user *udest_compat;
2332         struct ip_vs_dest_user_kern udest;
2333         struct netns_ipvs *ipvs = net_ipvs(net);
2334
2335         if (!capable(CAP_NET_ADMIN))
2336                 return -EPERM;
2337
2338         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2339                 return -EINVAL;
2340         if (len < 0 || len >  MAX_ARG_LEN)
2341                 return -EINVAL;
2342         if (len != set_arglen[SET_CMDID(cmd)]) {
2343                 pr_err("set_ctl: len %u != %u\n",
2344                        len, set_arglen[SET_CMDID(cmd)]);
2345                 return -EINVAL;
2346         }
2347
2348         if (copy_from_user(arg, user, len) != 0)
2349                 return -EFAULT;
2350
2351         /* increase the module use count */
2352         ip_vs_use_count_inc();
2353
2354         /* Handle daemons since they have another lock */
2355         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2356             cmd == IP_VS_SO_SET_STOPDAEMON) {
2357                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2358
2359                 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2360                         ret = -ERESTARTSYS;
2361                         goto out_dec;
2362                 }
2363                 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2364                         ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2365                                                 dm->syncid);
2366                 else
2367                         ret = stop_sync_thread(net, dm->state);
2368                 mutex_unlock(&ipvs->sync_mutex);
2369                 goto out_dec;
2370         }
2371
2372         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2373                 ret = -ERESTARTSYS;
2374                 goto out_dec;
2375         }
2376
2377         if (cmd == IP_VS_SO_SET_FLUSH) {
2378                 /* Flush the virtual service */
2379                 ret = ip_vs_flush(net);
2380                 goto out_unlock;
2381         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2382                 /* Set timeout values for (tcp tcpfin udp) */
2383                 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
2384                 goto out_unlock;
2385         }
2386
2387         usvc_compat = (struct ip_vs_service_user *)arg;
2388         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2389
2390         /* We only use the new structs internally, so copy userspace compat
2391          * structs to extended internal versions */
2392         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2393         ip_vs_copy_udest_compat(&udest, udest_compat);
2394
2395         if (cmd == IP_VS_SO_SET_ZERO) {
2396                 /* if no service address is set, zero counters in all */
2397                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2398                         ret = ip_vs_zero_all(net);
2399                         goto out_unlock;
2400                 }
2401         }
2402
2403         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2404         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2405             usvc.protocol != IPPROTO_SCTP) {
2406                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2407                        usvc.protocol, &usvc.addr.ip,
2408                        ntohs(usvc.port), usvc.sched_name);
2409                 ret = -EFAULT;
2410                 goto out_unlock;
2411         }
2412
2413         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2414         if (usvc.fwmark == 0)
2415                 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
2416                                            &usvc.addr, usvc.port);
2417         else
2418                 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
2419
2420         if (cmd != IP_VS_SO_SET_ADD
2421             && (svc == NULL || svc->protocol != usvc.protocol)) {
2422                 ret = -ESRCH;
2423                 goto out_unlock;
2424         }
2425
2426         switch (cmd) {
2427         case IP_VS_SO_SET_ADD:
2428                 if (svc != NULL)
2429                         ret = -EEXIST;
2430                 else
2431                         ret = ip_vs_add_service(net, &usvc, &svc);
2432                 break;
2433         case IP_VS_SO_SET_EDIT:
2434                 ret = ip_vs_edit_service(svc, &usvc);
2435                 break;
2436         case IP_VS_SO_SET_DEL:
2437                 ret = ip_vs_del_service(svc);
2438                 if (!ret)
2439                         goto out_unlock;
2440                 break;
2441         case IP_VS_SO_SET_ZERO:
2442                 ret = ip_vs_zero_service(svc);
2443                 break;
2444         case IP_VS_SO_SET_ADDDEST:
2445                 ret = ip_vs_add_dest(svc, &udest);
2446                 break;
2447         case IP_VS_SO_SET_EDITDEST:
2448                 ret = ip_vs_edit_dest(svc, &udest);
2449                 break;
2450         case IP_VS_SO_SET_DELDEST:
2451                 ret = ip_vs_del_dest(svc, &udest);
2452                 break;
2453         default:
2454                 ret = -EINVAL;
2455         }
2456
2457   out_unlock:
2458         mutex_unlock(&__ip_vs_mutex);
2459   out_dec:
2460         /* decrease the module use count */
2461         ip_vs_use_count_dec();
2462
2463         return ret;
2464 }
2465
2466
2467 static void
2468 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2469 {
2470         dst->protocol = src->protocol;
2471         dst->addr = src->addr.ip;
2472         dst->port = src->port;
2473         dst->fwmark = src->fwmark;
2474         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2475         dst->flags = src->flags;
2476         dst->timeout = src->timeout / HZ;
2477         dst->netmask = src->netmask;
2478         dst->num_dests = src->num_dests;
2479         ip_vs_copy_stats(&dst->stats, &src->stats);
2480 }
2481
2482 static inline int
2483 __ip_vs_get_service_entries(struct net *net,
2484                             const struct ip_vs_get_services *get,
2485                             struct ip_vs_get_services __user *uptr)
2486 {
2487         int idx, count=0;
2488         struct ip_vs_service *svc;
2489         struct ip_vs_service_entry entry;
2490         int ret = 0;
2491
2492         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2493                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2494                         /* Only expose IPv4 entries to old interface */
2495                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2496                                 continue;
2497
2498                         if (count >= get->num_services)
2499                                 goto out;
2500                         memset(&entry, 0, sizeof(entry));
2501                         ip_vs_copy_service(&entry, svc);
2502                         if (copy_to_user(&uptr->entrytable[count],
2503                                          &entry, sizeof(entry))) {
2504                                 ret = -EFAULT;
2505                                 goto out;
2506                         }
2507                         count++;
2508                 }
2509         }
2510
2511         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2512                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2513                         /* Only expose IPv4 entries to old interface */
2514                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2515                                 continue;
2516
2517                         if (count >= get->num_services)
2518                                 goto out;
2519                         memset(&entry, 0, sizeof(entry));
2520                         ip_vs_copy_service(&entry, svc);
2521                         if (copy_to_user(&uptr->entrytable[count],
2522                                          &entry, sizeof(entry))) {
2523                                 ret = -EFAULT;
2524                                 goto out;
2525                         }
2526                         count++;
2527                 }
2528         }
2529 out:
2530         return ret;
2531 }
2532
2533 static inline int
2534 __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
2535                          struct ip_vs_get_dests __user *uptr)
2536 {
2537         struct ip_vs_service *svc;
2538         union nf_inet_addr addr = { .ip = get->addr };
2539         int ret = 0;
2540
2541         if (get->fwmark)
2542                 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
2543         else
2544                 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
2545                                            get->port);
2546
2547         if (svc) {
2548                 int count = 0;
2549                 struct ip_vs_dest *dest;
2550                 struct ip_vs_dest_entry entry;
2551
2552                 list_for_each_entry(dest, &svc->destinations, n_list) {
2553                         if (count >= get->num_dests)
2554                                 break;
2555
2556                         entry.addr = dest->addr.ip;
2557                         entry.port = dest->port;
2558                         entry.conn_flags = atomic_read(&dest->conn_flags);
2559                         entry.weight = atomic_read(&dest->weight);
2560                         entry.u_threshold = dest->u_threshold;
2561                         entry.l_threshold = dest->l_threshold;
2562                         entry.activeconns = atomic_read(&dest->activeconns);
2563                         entry.inactconns = atomic_read(&dest->inactconns);
2564                         entry.persistconns = atomic_read(&dest->persistconns);
2565                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2566                         if (copy_to_user(&uptr->entrytable[count],
2567                                          &entry, sizeof(entry))) {
2568                                 ret = -EFAULT;
2569                                 break;
2570                         }
2571                         count++;
2572                 }
2573         } else
2574                 ret = -ESRCH;
2575         return ret;
2576 }
2577
2578 static inline void
2579 __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
2580 {
2581 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2582         struct ip_vs_proto_data *pd;
2583 #endif
2584
2585 #ifdef CONFIG_IP_VS_PROTO_TCP
2586         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2587         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2588         u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2589 #endif
2590 #ifdef CONFIG_IP_VS_PROTO_UDP
2591         pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2592         u->udp_timeout =
2593                         pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2594 #endif
2595 }
2596
2597
2598 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2599 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2600 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2601 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2602 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2603 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2604 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2605
2606 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2607         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2608         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2609         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2610         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2611         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2612         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2613         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2614 };
2615
2616 static int
2617 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2618 {
2619         unsigned char arg[128];
2620         int ret = 0;
2621         unsigned int copylen;
2622         struct net *net = sock_net(sk);
2623         struct netns_ipvs *ipvs = net_ipvs(net);
2624
2625         BUG_ON(!net);
2626         if (!capable(CAP_NET_ADMIN))
2627                 return -EPERM;
2628
2629         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2630                 return -EINVAL;
2631
2632         if (*len < get_arglen[GET_CMDID(cmd)]) {
2633                 pr_err("get_ctl: len %u < %u\n",
2634                        *len, get_arglen[GET_CMDID(cmd)]);
2635                 return -EINVAL;
2636         }
2637
2638         copylen = get_arglen[GET_CMDID(cmd)];
2639         if (copylen > 128)
2640                 return -EINVAL;
2641
2642         if (copy_from_user(arg, user, copylen) != 0)
2643                 return -EFAULT;
2644         /*
2645          * Handle daemons first since it has its own locking
2646          */
2647         if (cmd == IP_VS_SO_GET_DAEMON) {
2648                 struct ip_vs_daemon_user d[2];
2649
2650                 memset(&d, 0, sizeof(d));
2651                 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2652                         return -ERESTARTSYS;
2653
2654                 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2655                         d[0].state = IP_VS_STATE_MASTER;
2656                         strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2657                                 sizeof(d[0].mcast_ifn));
2658                         d[0].syncid = ipvs->master_syncid;
2659                 }
2660                 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2661                         d[1].state = IP_VS_STATE_BACKUP;
2662                         strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2663                                 sizeof(d[1].mcast_ifn));
2664                         d[1].syncid = ipvs->backup_syncid;
2665                 }
2666                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2667                         ret = -EFAULT;
2668                 mutex_unlock(&ipvs->sync_mutex);
2669                 return ret;
2670         }
2671
2672         if (mutex_lock_interruptible(&__ip_vs_mutex))
2673                 return -ERESTARTSYS;
2674
2675         switch (cmd) {
2676         case IP_VS_SO_GET_VERSION:
2677         {
2678                 char buf[64];
2679
2680                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2681                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2682                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2683                         ret = -EFAULT;
2684                         goto out;
2685                 }
2686                 *len = strlen(buf)+1;
2687         }
2688         break;
2689
2690         case IP_VS_SO_GET_INFO:
2691         {
2692                 struct ip_vs_getinfo info;
2693                 info.version = IP_VS_VERSION_CODE;
2694                 info.size = ip_vs_conn_tab_size;
2695                 info.num_services = ipvs->num_services;
2696                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2697                         ret = -EFAULT;
2698         }
2699         break;
2700
2701         case IP_VS_SO_GET_SERVICES:
2702         {
2703                 struct ip_vs_get_services *get;
2704                 int size;
2705
2706                 get = (struct ip_vs_get_services *)arg;
2707                 size = sizeof(*get) +
2708                         sizeof(struct ip_vs_service_entry) * get->num_services;
2709                 if (*len != size) {
2710                         pr_err("length: %u != %u\n", *len, size);
2711                         ret = -EINVAL;
2712                         goto out;
2713                 }
2714                 ret = __ip_vs_get_service_entries(net, get, user);
2715         }
2716         break;
2717
2718         case IP_VS_SO_GET_SERVICE:
2719         {
2720                 struct ip_vs_service_entry *entry;
2721                 struct ip_vs_service *svc;
2722                 union nf_inet_addr addr;
2723
2724                 entry = (struct ip_vs_service_entry *)arg;
2725                 addr.ip = entry->addr;
2726                 if (entry->fwmark)
2727                         svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
2728                 else
2729                         svc = __ip_vs_service_find(net, AF_INET,
2730                                                    entry->protocol, &addr,
2731                                                    entry->port);
2732                 if (svc) {
2733                         ip_vs_copy_service(entry, svc);
2734                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2735                                 ret = -EFAULT;
2736                 } else
2737                         ret = -ESRCH;
2738         }
2739         break;
2740
2741         case IP_VS_SO_GET_DESTS:
2742         {
2743                 struct ip_vs_get_dests *get;
2744                 int size;
2745
2746                 get = (struct ip_vs_get_dests *)arg;
2747                 size = sizeof(*get) +
2748                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2749                 if (*len != size) {
2750                         pr_err("length: %u != %u\n", *len, size);
2751                         ret = -EINVAL;
2752                         goto out;
2753                 }
2754                 ret = __ip_vs_get_dest_entries(net, get, user);
2755         }
2756         break;
2757
2758         case IP_VS_SO_GET_TIMEOUT:
2759         {
2760                 struct ip_vs_timeout_user t;
2761
2762                 __ip_vs_get_timeouts(net, &t);
2763                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2764                         ret = -EFAULT;
2765         }
2766         break;
2767
2768         default:
2769                 ret = -EINVAL;
2770         }
2771
2772 out:
2773         mutex_unlock(&__ip_vs_mutex);
2774         return ret;
2775 }
2776
2777
2778 static struct nf_sockopt_ops ip_vs_sockopts = {
2779         .pf             = PF_INET,
2780         .set_optmin     = IP_VS_BASE_CTL,
2781         .set_optmax     = IP_VS_SO_SET_MAX+1,
2782         .set            = do_ip_vs_set_ctl,
2783         .get_optmin     = IP_VS_BASE_CTL,
2784         .get_optmax     = IP_VS_SO_GET_MAX+1,
2785         .get            = do_ip_vs_get_ctl,
2786         .owner          = THIS_MODULE,
2787 };
2788
2789 /*
2790  * Generic Netlink interface
2791  */
2792
2793 /* IPVS genetlink family */
2794 static struct genl_family ip_vs_genl_family = {
2795         .id             = GENL_ID_GENERATE,
2796         .hdrsize        = 0,
2797         .name           = IPVS_GENL_NAME,
2798         .version        = IPVS_GENL_VERSION,
2799         .maxattr        = IPVS_CMD_MAX,
2800         .netnsok        = true,         /* Make ipvsadm to work on netns */
2801 };
2802
2803 /* Policy used for first-level command attributes */
2804 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2805         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2806         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2807         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2808         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2809         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2810         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2811 };
2812
2813 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2814 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2815         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2816         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2817                                             .len = IP_VS_IFNAME_MAXLEN },
2818         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2819 };
2820
2821 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2822 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2823         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2824         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2825         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2826                                             .len = sizeof(union nf_inet_addr) },
2827         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2828         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2829         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2830                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2831         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
2832                                             .len = IP_VS_PENAME_MAXLEN },
2833         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2834                                             .len = sizeof(struct ip_vs_flags) },
2835         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2836         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2837         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2838 };
2839
2840 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2841 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2842         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2843                                             .len = sizeof(union nf_inet_addr) },
2844         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2845         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2846         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2847         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2848         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2849         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2850         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2851         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2852         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2853 };
2854
2855 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2856                                  struct ip_vs_stats *stats)
2857 {
2858         struct ip_vs_stats_user ustats;
2859         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2860         if (!nl_stats)
2861                 return -EMSGSIZE;
2862
2863         ip_vs_copy_stats(&ustats, stats);
2864
2865         if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns) ||
2866             nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts) ||
2867             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts) ||
2868             nla_put_u64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes) ||
2869             nla_put_u64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes) ||
2870             nla_put_u32(skb, IPVS_STATS_ATTR_CPS, ustats.cps) ||
2871             nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps) ||
2872             nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps) ||
2873             nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps) ||
2874             nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps))
2875                 goto nla_put_failure;
2876         nla_nest_end(skb, nl_stats);
2877
2878         return 0;
2879
2880 nla_put_failure:
2881         nla_nest_cancel(skb, nl_stats);
2882         return -EMSGSIZE;
2883 }
2884
2885 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2886                                    struct ip_vs_service *svc)
2887 {
2888         struct nlattr *nl_service;
2889         struct ip_vs_flags flags = { .flags = svc->flags,
2890                                      .mask = ~0 };
2891
2892         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2893         if (!nl_service)
2894                 return -EMSGSIZE;
2895
2896         if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
2897                 goto nla_put_failure;
2898         if (svc->fwmark) {
2899                 if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
2900                         goto nla_put_failure;
2901         } else {
2902                 if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
2903                     nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
2904                     nla_put_u16(skb, IPVS_SVC_ATTR_PORT, svc->port))
2905                         goto nla_put_failure;
2906         }
2907
2908         if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name) ||
2909             (svc->pe &&
2910              nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name)) ||
2911             nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
2912             nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
2913             nla_put_u32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
2914                 goto nla_put_failure;
2915         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2916                 goto nla_put_failure;
2917
2918         nla_nest_end(skb, nl_service);
2919
2920         return 0;
2921
2922 nla_put_failure:
2923         nla_nest_cancel(skb, nl_service);
2924         return -EMSGSIZE;
2925 }
2926
2927 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2928                                    struct ip_vs_service *svc,
2929                                    struct netlink_callback *cb)
2930 {
2931         void *hdr;
2932
2933         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2934                           &ip_vs_genl_family, NLM_F_MULTI,
2935                           IPVS_CMD_NEW_SERVICE);
2936         if (!hdr)
2937                 return -EMSGSIZE;
2938
2939         if (ip_vs_genl_fill_service(skb, svc) < 0)
2940                 goto nla_put_failure;
2941
2942         return genlmsg_end(skb, hdr);
2943
2944 nla_put_failure:
2945         genlmsg_cancel(skb, hdr);
2946         return -EMSGSIZE;
2947 }
2948
2949 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2950                                     struct netlink_callback *cb)
2951 {
2952         int idx = 0, i;
2953         int start = cb->args[0];
2954         struct ip_vs_service *svc;
2955         struct net *net = skb_sknet(skb);
2956
2957         mutex_lock(&__ip_vs_mutex);
2958         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2959                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2960                         if (++idx <= start || !net_eq(svc->net, net))
2961                                 continue;
2962                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2963                                 idx--;
2964                                 goto nla_put_failure;
2965                         }
2966                 }
2967         }
2968
2969         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2970                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2971                         if (++idx <= start || !net_eq(svc->net, net))
2972                                 continue;
2973                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2974                                 idx--;
2975                                 goto nla_put_failure;
2976                         }
2977                 }
2978         }
2979
2980 nla_put_failure:
2981         mutex_unlock(&__ip_vs_mutex);
2982         cb->args[0] = idx;
2983
2984         return skb->len;
2985 }
2986
2987 static int ip_vs_genl_parse_service(struct net *net,
2988                                     struct ip_vs_service_user_kern *usvc,
2989                                     struct nlattr *nla, int full_entry,
2990                                     struct ip_vs_service **ret_svc)
2991 {
2992         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2993         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2994         struct ip_vs_service *svc;
2995
2996         /* Parse mandatory identifying service fields first */
2997         if (nla == NULL ||
2998             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2999                 return -EINVAL;
3000
3001         nla_af          = attrs[IPVS_SVC_ATTR_AF];
3002         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
3003         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
3004         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
3005         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
3006
3007         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
3008                 return -EINVAL;
3009
3010         memset(usvc, 0, sizeof(*usvc));
3011
3012         usvc->af = nla_get_u16(nla_af);
3013 #ifdef CONFIG_IP_VS_IPV6
3014         if (usvc->af != AF_INET && usvc->af != AF_INET6)
3015 #else
3016         if (usvc->af != AF_INET)
3017 #endif
3018                 return -EAFNOSUPPORT;
3019
3020         if (nla_fwmark) {
3021                 usvc->protocol = IPPROTO_TCP;
3022                 usvc->fwmark = nla_get_u32(nla_fwmark);
3023         } else {
3024                 usvc->protocol = nla_get_u16(nla_protocol);
3025                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
3026                 usvc->port = nla_get_u16(nla_port);
3027                 usvc->fwmark = 0;
3028         }
3029
3030         if (usvc->fwmark)
3031                 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
3032         else
3033                 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
3034                                            &usvc->addr, usvc->port);
3035         *ret_svc = svc;
3036
3037         /* If a full entry was requested, check for the additional fields */
3038         if (full_entry) {
3039                 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
3040                               *nla_netmask;
3041                 struct ip_vs_flags flags;
3042
3043                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
3044                 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
3045                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
3046                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
3047                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
3048
3049                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3050                         return -EINVAL;
3051
3052                 nla_memcpy(&flags, nla_flags, sizeof(flags));
3053
3054                 /* prefill flags from service if it already exists */
3055                 if (svc)
3056                         usvc->flags = svc->flags;
3057
3058                 /* set new flags from userland */
3059                 usvc->flags = (usvc->flags & ~flags.mask) |
3060                               (flags.flags & flags.mask);
3061                 usvc->sched_name = nla_data(nla_sched);
3062                 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3063                 usvc->timeout = nla_get_u32(nla_timeout);
3064                 usvc->netmask = nla_get_u32(nla_netmask);
3065         }
3066
3067         return 0;
3068 }
3069
3070 static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3071                                                      struct nlattr *nla)
3072 {
3073         struct ip_vs_service_user_kern usvc;
3074         struct ip_vs_service *svc;
3075         int ret;
3076
3077         ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
3078         return ret ? ERR_PTR(ret) : svc;
3079 }
3080
3081 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3082 {
3083         struct nlattr *nl_dest;
3084
3085         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3086         if (!nl_dest)
3087                 return -EMSGSIZE;
3088
3089         if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
3090             nla_put_u16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
3091             nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3092                         (atomic_read(&dest->conn_flags) &
3093                          IP_VS_CONN_F_FWD_MASK)) ||
3094             nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
3095                         atomic_read(&dest->weight)) ||
3096             nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
3097             nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
3098             nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3099                         atomic_read(&dest->activeconns)) ||
3100             nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3101                         atomic_read(&dest->inactconns)) ||
3102             nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3103                         atomic_read(&dest->persistconns)))
3104                 goto nla_put_failure;
3105         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3106                 goto nla_put_failure;
3107
3108         nla_nest_end(skb, nl_dest);
3109
3110         return 0;
3111
3112 nla_put_failure:
3113         nla_nest_cancel(skb, nl_dest);
3114         return -EMSGSIZE;
3115 }
3116
3117 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3118                                 struct netlink_callback *cb)
3119 {
3120         void *hdr;
3121
3122         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3123                           &ip_vs_genl_family, NLM_F_MULTI,
3124                           IPVS_CMD_NEW_DEST);
3125         if (!hdr)
3126                 return -EMSGSIZE;
3127
3128         if (ip_vs_genl_fill_dest(skb, dest) < 0)
3129                 goto nla_put_failure;
3130
3131         return genlmsg_end(skb, hdr);
3132
3133 nla_put_failure:
3134         genlmsg_cancel(skb, hdr);
3135         return -EMSGSIZE;
3136 }
3137
3138 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3139                                  struct netlink_callback *cb)
3140 {
3141         int idx = 0;
3142         int start = cb->args[0];
3143         struct ip_vs_service *svc;
3144         struct ip_vs_dest *dest;
3145         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3146         struct net *net = skb_sknet(skb);
3147
3148         mutex_lock(&__ip_vs_mutex);
3149
3150         /* Try to find the service for which to dump destinations */
3151         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3152                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3153                 goto out_err;
3154
3155
3156         svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
3157         if (IS_ERR(svc) || svc == NULL)
3158                 goto out_err;
3159
3160         /* Dump the destinations */
3161         list_for_each_entry(dest, &svc->destinations, n_list) {
3162                 if (++idx <= start)
3163                         continue;
3164                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3165                         idx--;
3166                         goto nla_put_failure;
3167                 }
3168         }
3169
3170 nla_put_failure:
3171         cb->args[0] = idx;
3172
3173 out_err:
3174         mutex_unlock(&__ip_vs_mutex);
3175
3176         return skb->len;
3177 }
3178
3179 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3180                                  struct nlattr *nla, int full_entry)
3181 {
3182         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3183         struct nlattr *nla_addr, *nla_port;
3184
3185         /* Parse mandatory identifying destination fields first */
3186         if (nla == NULL ||
3187             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3188                 return -EINVAL;
3189
3190         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
3191         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
3192
3193         if (!(nla_addr && nla_port))
3194                 return -EINVAL;
3195
3196         memset(udest, 0, sizeof(*udest));
3197
3198         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3199         udest->port = nla_get_u16(nla_port);
3200
3201         /* If a full entry was requested, check for the additional fields */
3202         if (full_entry) {
3203                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3204                               *nla_l_thresh;
3205
3206                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3207                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
3208                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
3209                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
3210
3211                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3212                         return -EINVAL;
3213
3214                 udest->conn_flags = nla_get_u32(nla_fwd)
3215                                     & IP_VS_CONN_F_FWD_MASK;
3216                 udest->weight = nla_get_u32(nla_weight);
3217                 udest->u_threshold = nla_get_u32(nla_u_thresh);
3218                 udest->l_threshold = nla_get_u32(nla_l_thresh);
3219         }
3220
3221         return 0;
3222 }
3223
3224 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3225                                   const char *mcast_ifn, __be32 syncid)
3226 {
3227         struct nlattr *nl_daemon;
3228
3229         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3230         if (!nl_daemon)
3231                 return -EMSGSIZE;
3232
3233         if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
3234             nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn) ||
3235             nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid))
3236                 goto nla_put_failure;
3237         nla_nest_end(skb, nl_daemon);
3238
3239         return 0;
3240
3241 nla_put_failure:
3242         nla_nest_cancel(skb, nl_daemon);
3243         return -EMSGSIZE;
3244 }
3245
3246 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3247                                   const char *mcast_ifn, __be32 syncid,
3248                                   struct netlink_callback *cb)
3249 {
3250         void *hdr;
3251         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3252                           &ip_vs_genl_family, NLM_F_MULTI,
3253                           IPVS_CMD_NEW_DAEMON);
3254         if (!hdr)
3255                 return -EMSGSIZE;
3256
3257         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3258                 goto nla_put_failure;
3259
3260         return genlmsg_end(skb, hdr);
3261
3262 nla_put_failure:
3263         genlmsg_cancel(skb, hdr);
3264         return -EMSGSIZE;
3265 }
3266
3267 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3268                                    struct netlink_callback *cb)
3269 {
3270         struct net *net = skb_sknet(skb);
3271         struct netns_ipvs *ipvs = net_ipvs(net);
3272
3273         mutex_lock(&ipvs->sync_mutex);
3274         if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3275                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3276                                            ipvs->master_mcast_ifn,
3277                                            ipvs->master_syncid, cb) < 0)
3278                         goto nla_put_failure;
3279
3280                 cb->args[0] = 1;
3281         }
3282
3283         if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3284                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3285                                            ipvs->backup_mcast_ifn,
3286                                            ipvs->backup_syncid, cb) < 0)
3287                         goto nla_put_failure;
3288
3289                 cb->args[1] = 1;
3290         }
3291
3292 nla_put_failure:
3293         mutex_unlock(&ipvs->sync_mutex);
3294
3295         return skb->len;
3296 }
3297
3298 static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
3299 {
3300         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3301               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3302               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3303                 return -EINVAL;
3304
3305         return start_sync_thread(net,
3306                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3307                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3308                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3309 }
3310
3311 static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
3312 {
3313         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3314                 return -EINVAL;
3315
3316         return stop_sync_thread(net,
3317                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3318 }
3319
3320 static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
3321 {
3322         struct ip_vs_timeout_user t;
3323
3324         __ip_vs_get_timeouts(net, &t);
3325
3326         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3327                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3328
3329         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3330                 t.tcp_fin_timeout =
3331                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3332
3333         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3334                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3335
3336         return ip_vs_set_timeout(net, &t);
3337 }
3338
3339 static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3340 {
3341         int ret = 0, cmd;
3342         struct net *net;
3343         struct netns_ipvs *ipvs;
3344
3345         net = skb_sknet(skb);
3346         ipvs = net_ipvs(net);
3347         cmd = info->genlhdr->cmd;
3348
3349         if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3350                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3351
3352                 mutex_lock(&ipvs->sync_mutex);
3353                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3354                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3355                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3356                                      ip_vs_daemon_policy)) {
3357                         ret = -EINVAL;
3358                         goto out;
3359                 }
3360
3361                 if (cmd == IPVS_CMD_NEW_DAEMON)
3362                         ret = ip_vs_genl_new_daemon(net, daemon_attrs);
3363                 else
3364                         ret = ip_vs_genl_del_daemon(net, daemon_attrs);
3365 out:
3366                 mutex_unlock(&ipvs->sync_mutex);
3367         }
3368         return ret;
3369 }
3370
3371 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3372 {
3373         struct ip_vs_service *svc = NULL;
3374         struct ip_vs_service_user_kern usvc;
3375         struct ip_vs_dest_user_kern udest;
3376         int ret = 0, cmd;
3377         int need_full_svc = 0, need_full_dest = 0;
3378         struct net *net;
3379
3380         net = skb_sknet(skb);
3381         cmd = info->genlhdr->cmd;
3382
3383         mutex_lock(&__ip_vs_mutex);
3384
3385         if (cmd == IPVS_CMD_FLUSH) {
3386                 ret = ip_vs_flush(net);
3387                 goto out;
3388         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3389                 ret = ip_vs_genl_set_config(net, info->attrs);
3390                 goto out;
3391         } else if (cmd == IPVS_CMD_ZERO &&
3392                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3393                 ret = ip_vs_zero_all(net);
3394                 goto out;
3395         }
3396
3397         /* All following commands require a service argument, so check if we
3398          * received a valid one. We need a full service specification when
3399          * adding / editing a service. Only identifying members otherwise. */
3400         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3401                 need_full_svc = 1;
3402
3403         ret = ip_vs_genl_parse_service(net, &usvc,
3404                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3405                                        need_full_svc, &svc);
3406         if (ret)
3407                 goto out;
3408
3409         /* Unless we're adding a new service, the service must already exist */
3410         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3411                 ret = -ESRCH;
3412                 goto out;
3413         }
3414
3415         /* Destination commands require a valid destination argument. For
3416          * adding / editing a destination, we need a full destination
3417          * specification. */
3418         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3419             cmd == IPVS_CMD_DEL_DEST) {
3420                 if (cmd != IPVS_CMD_DEL_DEST)
3421                         need_full_dest = 1;
3422
3423                 ret = ip_vs_genl_parse_dest(&udest,
3424                                             info->attrs[IPVS_CMD_ATTR_DEST],
3425                                             need_full_dest);
3426                 if (ret)
3427                         goto out;
3428         }
3429
3430         switch (cmd) {
3431         case IPVS_CMD_NEW_SERVICE:
3432                 if (svc == NULL)
3433                         ret = ip_vs_add_service(net, &usvc, &svc);
3434                 else
3435                         ret = -EEXIST;
3436                 break;
3437         case IPVS_CMD_SET_SERVICE:
3438                 ret = ip_vs_edit_service(svc, &usvc);
3439                 break;
3440         case IPVS_CMD_DEL_SERVICE:
3441                 ret = ip_vs_del_service(svc);
3442                 /* do not use svc, it can be freed */
3443                 break;
3444         case IPVS_CMD_NEW_DEST:
3445                 ret = ip_vs_add_dest(svc, &udest);
3446                 break;
3447         case IPVS_CMD_SET_DEST:
3448                 ret = ip_vs_edit_dest(svc, &udest);
3449                 break;
3450         case IPVS_CMD_DEL_DEST:
3451                 ret = ip_vs_del_dest(svc, &udest);
3452                 break;
3453         case IPVS_CMD_ZERO:
3454                 ret = ip_vs_zero_service(svc);
3455                 break;
3456         default:
3457                 ret = -EINVAL;
3458         }
3459
3460 out:
3461         mutex_unlock(&__ip_vs_mutex);
3462
3463         return ret;
3464 }
3465
3466 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3467 {
3468         struct sk_buff *msg;
3469         void *reply;
3470         int ret, cmd, reply_cmd;
3471         struct net *net;
3472
3473         net = skb_sknet(skb);
3474         cmd = info->genlhdr->cmd;
3475
3476         if (cmd == IPVS_CMD_GET_SERVICE)
3477                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3478         else if (cmd == IPVS_CMD_GET_INFO)
3479                 reply_cmd = IPVS_CMD_SET_INFO;
3480         else if (cmd == IPVS_CMD_GET_CONFIG)
3481                 reply_cmd = IPVS_CMD_SET_CONFIG;
3482         else {
3483                 pr_err("unknown Generic Netlink command\n");
3484                 return -EINVAL;
3485         }
3486
3487         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3488         if (!msg)
3489                 return -ENOMEM;
3490
3491         mutex_lock(&__ip_vs_mutex);
3492
3493         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3494         if (reply == NULL)
3495                 goto nla_put_failure;
3496
3497         switch (cmd) {
3498         case IPVS_CMD_GET_SERVICE:
3499         {
3500                 struct ip_vs_service *svc;
3501
3502                 svc = ip_vs_genl_find_service(net,
3503                                               info->attrs[IPVS_CMD_ATTR_SERVICE]);
3504                 if (IS_ERR(svc)) {
3505                         ret = PTR_ERR(svc);
3506                         goto out_err;
3507                 } else if (svc) {
3508                         ret = ip_vs_genl_fill_service(msg, svc);
3509                         if (ret)
3510                                 goto nla_put_failure;
3511                 } else {
3512                         ret = -ESRCH;
3513                         goto out_err;
3514                 }
3515
3516                 break;
3517         }
3518
3519         case IPVS_CMD_GET_CONFIG:
3520         {
3521                 struct ip_vs_timeout_user t;
3522
3523                 __ip_vs_get_timeouts(net, &t);
3524 #ifdef CONFIG_IP_VS_PROTO_TCP
3525                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
3526                                 t.tcp_timeout) ||
3527                     nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3528                                 t.tcp_fin_timeout))
3529                         goto nla_put_failure;
3530 #endif
3531 #ifdef CONFIG_IP_VS_PROTO_UDP
3532                 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
3533                         goto nla_put_failure;
3534 #endif
3535
3536                 break;
3537         }
3538
3539         case IPVS_CMD_GET_INFO:
3540                 if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
3541                                 IP_VS_VERSION_CODE) ||
3542                     nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3543                                 ip_vs_conn_tab_size))
3544                         goto nla_put_failure;
3545                 break;
3546         }
3547
3548         genlmsg_end(msg, reply);
3549         ret = genlmsg_reply(msg, info);
3550         goto out;
3551
3552 nla_put_failure:
3553         pr_err("not enough space in Netlink message\n");
3554         ret = -EMSGSIZE;
3555
3556 out_err:
3557         nlmsg_free(msg);
3558 out:
3559         mutex_unlock(&__ip_vs_mutex);
3560
3561         return ret;
3562 }
3563
3564
3565 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3566         {
3567                 .cmd    = IPVS_CMD_NEW_SERVICE,
3568                 .flags  = GENL_ADMIN_PERM,
3569                 .policy = ip_vs_cmd_policy,
3570                 .doit   = ip_vs_genl_set_cmd,
3571         },
3572         {
3573                 .cmd    = IPVS_CMD_SET_SERVICE,
3574                 .flags  = GENL_ADMIN_PERM,
3575                 .policy = ip_vs_cmd_policy,
3576                 .doit   = ip_vs_genl_set_cmd,
3577         },
3578         {
3579                 .cmd    = IPVS_CMD_DEL_SERVICE,
3580                 .flags  = GENL_ADMIN_PERM,
3581                 .policy = ip_vs_cmd_policy,
3582                 .doit   = ip_vs_genl_set_cmd,
3583         },
3584         {
3585                 .cmd    = IPVS_CMD_GET_SERVICE,
3586                 .flags  = GENL_ADMIN_PERM,
3587                 .doit   = ip_vs_genl_get_cmd,
3588                 .dumpit = ip_vs_genl_dump_services,
3589                 .policy = ip_vs_cmd_policy,
3590         },
3591         {
3592                 .cmd    = IPVS_CMD_NEW_DEST,
3593                 .flags  = GENL_ADMIN_PERM,
3594                 .policy = ip_vs_cmd_policy,
3595                 .doit   = ip_vs_genl_set_cmd,
3596         },
3597         {
3598                 .cmd    = IPVS_CMD_SET_DEST,
3599                 .flags  = GENL_ADMIN_PERM,
3600                 .policy = ip_vs_cmd_policy,
3601                 .doit   = ip_vs_genl_set_cmd,
3602         },
3603         {
3604                 .cmd    = IPVS_CMD_DEL_DEST,
3605                 .flags  = GENL_ADMIN_PERM,
3606                 .policy = ip_vs_cmd_policy,
3607                 .doit   = ip_vs_genl_set_cmd,
3608         },
3609         {
3610                 .cmd    = IPVS_CMD_GET_DEST,
3611                 .flags  = GENL_ADMIN_PERM,
3612                 .policy = ip_vs_cmd_policy,
3613                 .dumpit = ip_vs_genl_dump_dests,
3614         },
3615         {
3616                 .cmd    = IPVS_CMD_NEW_DAEMON,
3617                 .flags  = GENL_ADMIN_PERM,
3618                 .policy = ip_vs_cmd_policy,
3619                 .doit   = ip_vs_genl_set_daemon,
3620         },
3621         {
3622                 .cmd    = IPVS_CMD_DEL_DAEMON,
3623                 .flags  = GENL_ADMIN_PERM,
3624                 .policy = ip_vs_cmd_policy,
3625                 .doit   = ip_vs_genl_set_daemon,
3626         },
3627         {
3628                 .cmd    = IPVS_CMD_GET_DAEMON,
3629                 .flags  = GENL_ADMIN_PERM,
3630                 .dumpit = ip_vs_genl_dump_daemons,
3631         },
3632         {
3633                 .cmd    = IPVS_CMD_SET_CONFIG,
3634                 .flags  = GENL_ADMIN_PERM,
3635                 .policy = ip_vs_cmd_policy,
3636                 .doit   = ip_vs_genl_set_cmd,
3637         },
3638         {
3639                 .cmd    = IPVS_CMD_GET_CONFIG,
3640                 .flags  = GENL_ADMIN_PERM,
3641                 .doit   = ip_vs_genl_get_cmd,
3642         },
3643         {
3644                 .cmd    = IPVS_CMD_GET_INFO,
3645                 .flags  = GENL_ADMIN_PERM,
3646                 .doit   = ip_vs_genl_get_cmd,
3647         },
3648         {
3649                 .cmd    = IPVS_CMD_ZERO,
3650                 .flags  = GENL_ADMIN_PERM,
3651                 .policy = ip_vs_cmd_policy,
3652                 .doit   = ip_vs_genl_set_cmd,
3653         },
3654         {
3655                 .cmd    = IPVS_CMD_FLUSH,
3656                 .flags  = GENL_ADMIN_PERM,
3657                 .doit   = ip_vs_genl_set_cmd,
3658         },
3659 };
3660
3661 static int __init ip_vs_genl_register(void)
3662 {
3663         return genl_register_family_with_ops(&ip_vs_genl_family,
3664                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3665 }
3666
3667 static void ip_vs_genl_unregister(void)
3668 {
3669         genl_unregister_family(&ip_vs_genl_family);
3670 }
3671
3672 /* End of Generic Netlink interface definitions */
3673
3674 /*
3675  * per netns intit/exit func.
3676  */
3677 #ifdef CONFIG_SYSCTL
3678 int __net_init ip_vs_control_net_init_sysctl(struct net *net)
3679 {
3680         int idx;
3681         struct netns_ipvs *ipvs = net_ipvs(net);
3682         struct ctl_table *tbl;
3683
3684         atomic_set(&ipvs->dropentry, 0);
3685         spin_lock_init(&ipvs->dropentry_lock);
3686         spin_lock_init(&ipvs->droppacket_lock);
3687         spin_lock_init(&ipvs->securetcp_lock);
3688
3689         if (!net_eq(net, &init_net)) {
3690                 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3691                 if (tbl == NULL)
3692                         return -ENOMEM;
3693         } else
3694                 tbl = vs_vars;
3695         /* Initialize sysctl defaults */
3696         idx = 0;
3697         ipvs->sysctl_amemthresh = 1024;
3698         tbl[idx++].data = &ipvs->sysctl_amemthresh;
3699         ipvs->sysctl_am_droprate = 10;
3700         tbl[idx++].data = &ipvs->sysctl_am_droprate;
3701         tbl[idx++].data = &ipvs->sysctl_drop_entry;
3702         tbl[idx++].data = &ipvs->sysctl_drop_packet;
3703 #ifdef CONFIG_IP_VS_NFCT
3704         tbl[idx++].data = &ipvs->sysctl_conntrack;
3705 #endif
3706         tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3707         ipvs->sysctl_snat_reroute = 1;
3708         tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3709         ipvs->sysctl_sync_ver = 1;
3710         tbl[idx++].data = &ipvs->sysctl_sync_ver;
3711         ipvs->sysctl_sync_ports = 1;
3712         tbl[idx++].data = &ipvs->sysctl_sync_ports;
3713         ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
3714         tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
3715         ipvs->sysctl_sync_sock_size = 0;
3716         tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
3717         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3718         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3719         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3720         ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3721         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3722         tbl[idx].data = &ipvs->sysctl_sync_threshold;
3723         tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3724         ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
3725         tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
3726         ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
3727         tbl[idx++].data = &ipvs->sysctl_sync_retries;
3728         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3729
3730
3731         ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
3732         if (ipvs->sysctl_hdr == NULL) {
3733                 if (!net_eq(net, &init_net))
3734                         kfree(tbl);
3735                 return -ENOMEM;
3736         }
3737         ip_vs_start_estimator(net, &ipvs->tot_stats);
3738         ipvs->sysctl_tbl = tbl;
3739         /* Schedule defense work */
3740         INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3741         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
3742
3743         return 0;
3744 }
3745
3746 void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
3747 {
3748         struct netns_ipvs *ipvs = net_ipvs(net);
3749
3750         cancel_delayed_work_sync(&ipvs->defense_work);
3751         cancel_work_sync(&ipvs->defense_work.work);
3752         unregister_net_sysctl_table(ipvs->sysctl_hdr);
3753 }
3754
3755 #else
3756
3757 int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3758 void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
3759
3760 #endif
3761
3762 static struct notifier_block ip_vs_dst_notifier = {
3763         .notifier_call = ip_vs_dst_event,
3764 };
3765
3766 int __net_init ip_vs_control_net_init(struct net *net)
3767 {
3768         int idx;
3769         struct netns_ipvs *ipvs = net_ipvs(net);
3770
3771         rwlock_init(&ipvs->rs_lock);
3772
3773         /* Initialize rs_table */
3774         for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3775                 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3776
3777         INIT_LIST_HEAD(&ipvs->dest_trash);
3778         atomic_set(&ipvs->ftpsvc_counter, 0);
3779         atomic_set(&ipvs->nullsvc_counter, 0);
3780
3781         /* procfs stats */
3782         ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
3783         if (!ipvs->tot_stats.cpustats)
3784                 return -ENOMEM;
3785
3786         spin_lock_init(&ipvs->tot_stats.lock);
3787
3788         proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
3789         proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
3790         proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
3791                              &ip_vs_stats_percpu_fops);
3792
3793         if (ip_vs_control_net_init_sysctl(net))
3794                 goto err;
3795
3796         return 0;
3797
3798 err:
3799         free_percpu(ipvs->tot_stats.cpustats);
3800         return -ENOMEM;
3801 }
3802
3803 void __net_exit ip_vs_control_net_cleanup(struct net *net)
3804 {
3805         struct netns_ipvs *ipvs = net_ipvs(net);
3806
3807         ip_vs_trash_cleanup(net);
3808         ip_vs_stop_estimator(net, &ipvs->tot_stats);
3809         ip_vs_control_net_cleanup_sysctl(net);
3810         proc_net_remove(net, "ip_vs_stats_percpu");
3811         proc_net_remove(net, "ip_vs_stats");
3812         proc_net_remove(net, "ip_vs");
3813         free_percpu(ipvs->tot_stats.cpustats);
3814 }
3815
3816 int __init ip_vs_register_nl_ioctl(void)
3817 {
3818         int ret;
3819
3820         ret = nf_register_sockopt(&ip_vs_sockopts);
3821         if (ret) {
3822                 pr_err("cannot register sockopt.\n");
3823                 goto err_sock;
3824         }
3825
3826         ret = ip_vs_genl_register();
3827         if (ret) {
3828                 pr_err("cannot register Generic Netlink interface.\n");
3829                 goto err_genl;
3830         }
3831         return 0;
3832
3833 err_genl:
3834         nf_unregister_sockopt(&ip_vs_sockopts);
3835 err_sock:
3836         return ret;
3837 }
3838
3839 void ip_vs_unregister_nl_ioctl(void)
3840 {
3841         ip_vs_genl_unregister();
3842         nf_unregister_sockopt(&ip_vs_sockopts);
3843 }
3844
3845 int __init ip_vs_control_init(void)
3846 {
3847         int idx;
3848         int ret;
3849
3850         EnterFunction(2);
3851
3852         /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
3853         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
3854                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3855                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3856         }
3857
3858         smp_wmb();      /* Do we really need it now ? */
3859
3860         ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3861         if (ret < 0)
3862                 return ret;
3863
3864         LeaveFunction(2);
3865         return 0;
3866 }
3867
3868
3869 void ip_vs_control_cleanup(void)
3870 {
3871         EnterFunction(2);
3872         unregister_netdevice_notifier(&ip_vs_dst_notifier);
3873         LeaveFunction(2);
3874 }