ip_vs_ctl.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * IPVS         An implementation of the IP virtual server support for the
   4 *              LINUX operating system.  IPVS is now implemented as a module
   5 *              over the NetFilter framework. IPVS can be used to build a
   6 *              high-performance and highly available server based on a
   7 *              cluster of servers.
   8 *
   9 * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
  10 *              Peter Kese <peter.kese@ijs.si>
  11 *              Julian Anastasov <ja@ssi.bg>
  12 *
  13 * Changes:
  14 */
  15
  16#define pr_fmt(fmt) "IPVS: " fmt
  17
  18#include <linux/module.h>
  19#include <linux/init.h>
  20#include <linux/types.h>
  21#include <linux/capability.h>
  22#include <linux/fs.h>
  23#include <linux/sysctl.h>
  24#include <linux/proc_fs.h>
  25#include <linux/workqueue.h>
  26#include <linux/seq_file.h>
  27#include <linux/slab.h>
  28
  29#include <linux/netfilter.h>
  30#include <linux/netfilter_ipv4.h>
  31#include <linux/mutex.h>
  32
  33#include <net/net_namespace.h>
  34#include <linux/nsproxy.h>
  35#include <net/ip.h>
  36#ifdef CONFIG_IP_VS_IPV6
  37#include <net/ipv6.h>
  38#include <net/ip6_route.h>
  39#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
  40#endif
  41#include <net/route.h>
  42#include <net/sock.h>
  43#include <net/genetlink.h>
  44
  45#include <linux/uaccess.h>
  46
  47#include <net/ip_vs.h>
  48
  49MODULE_ALIAS_GENL_FAMILY(IPVS_GENL_NAME);
  50
  51DEFINE_MUTEX(__ip_vs_mutex); /* Serialize configuration with sockopt/netlink */
  52
  53/* sysctl variables */
  54
  55#ifdef CONFIG_IP_VS_DEBUG
  56static int sysctl_ip_vs_debug_level = 0;
  57
  58int ip_vs_get_debug_level(void)
  59{
  60	return sysctl_ip_vs_debug_level;
  61}
  62#endif
  63
  64
  65/*  Protos */
  66static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup);
  67
  68
  69#ifdef CONFIG_IP_VS_IPV6
  70/* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
  71static bool __ip_vs_addr_is_local_v6(struct net *net,
  72				     const struct in6_addr *addr)
  73{
  74	struct flowi6 fl6 = {
  75		.daddr = *addr,
  76	};
  77	struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
  78	bool is_local;
  79
  80	is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
  81
  82	dst_release(dst);
  83	return is_local;
  84}
  85#endif
  86
  87#ifdef CONFIG_SYSCTL
  88/*
  89 *	update_defense_level is called from keventd and from sysctl,
  90 *	so it needs to protect itself from softirqs
  91 */
  92static void update_defense_level(struct netns_ipvs *ipvs)
  93{
  94	struct sysinfo i;
  95	int availmem;
  96	int amemthresh;
  97	int nomem;
  98	int to_change = -1;
  99
 100	/* we only count free and buffered memory (in pages) */
 101	si_meminfo(&i);
 102	availmem = i.freeram + i.bufferram;
 103	/* however in linux 2.5 the i.bufferram is total page cache size,
 104	   we need adjust it */
 105	/* si_swapinfo(&i); */
 106	/* availmem = availmem - (i.totalswap - i.freeswap); */
 107
 108	amemthresh = max(READ_ONCE(ipvs->sysctl_amemthresh), 0);
 109	nomem = (availmem < amemthresh);
 110
 111	local_bh_disable();
 112
 113	/* drop_entry */
 114	spin_lock(&ipvs->dropentry_lock);
 115	switch (ipvs->sysctl_drop_entry) {
 116	case 0:
 117		atomic_set(&ipvs->dropentry, 0);
 118		break;
 119	case 1:
 120		if (nomem) {
 121			atomic_set(&ipvs->dropentry, 1);
 122			ipvs->sysctl_drop_entry = 2;
 123		} else {
 124			atomic_set(&ipvs->dropentry, 0);
 125		}
 126		break;
 127	case 2:
 128		if (nomem) {
 129			atomic_set(&ipvs->dropentry, 1);
 130		} else {
 131			atomic_set(&ipvs->dropentry, 0);
 132			ipvs->sysctl_drop_entry = 1;
 133		}
 134		break;
 135	case 3:
 136		atomic_set(&ipvs->dropentry, 1);
 137		break;
 138	}
 139	spin_unlock(&ipvs->dropentry_lock);
 140
 141	/* drop_packet */
 142	spin_lock(&ipvs->droppacket_lock);
 143	switch (ipvs->sysctl_drop_packet) {
 144	case 0:
 145		ipvs->drop_rate = 0;
 146		break;
 147	case 1:
 148		if (nomem) {
 149			ipvs->drop_counter = amemthresh / (amemthresh - availmem);
 150			ipvs->drop_rate = ipvs->drop_counter;
 151			ipvs->sysctl_drop_packet = 2;
 152		} else {
 153			ipvs->drop_rate = 0;
 154		}
 155		break;
 156	case 2:
 157		if (nomem) {
 158			ipvs->drop_counter = amemthresh / (amemthresh - availmem);
 159			ipvs->drop_rate = ipvs->drop_counter;
 160		} else {
 161			ipvs->drop_rate = 0;
 162			ipvs->sysctl_drop_packet = 1;
 163		}
 164		break;
 165	case 3:
 166		ipvs->drop_rate = ipvs->sysctl_am_droprate;
 167		break;
 168	}
 169	spin_unlock(&ipvs->droppacket_lock);
 170
 171	/* secure_tcp */
 172	spin_lock(&ipvs->securetcp_lock);
 173	switch (ipvs->sysctl_secure_tcp) {
 174	case 0:
 175		if (ipvs->old_secure_tcp >= 2)
 176			to_change = 0;
 177		break;
 178	case 1:
 179		if (nomem) {
 180			if (ipvs->old_secure_tcp < 2)
 181				to_change = 1;
 182			ipvs->sysctl_secure_tcp = 2;
 183		} else {
 184			if (ipvs->old_secure_tcp >= 2)
 185				to_change = 0;
 186		}
 187		break;
 188	case 2:
 189		if (nomem) {
 190			if (ipvs->old_secure_tcp < 2)
 191				to_change = 1;
 192		} else {
 193			if (ipvs->old_secure_tcp >= 2)
 194				to_change = 0;
 195			ipvs->sysctl_secure_tcp = 1;
 196		}
 197		break;
 198	case 3:
 199		if (ipvs->old_secure_tcp < 2)
 200			to_change = 1;
 201		break;
 202	}
 203	ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
 204	if (to_change >= 0)
 205		ip_vs_protocol_timeout_change(ipvs,
 206					      ipvs->sysctl_secure_tcp > 1);
 207	spin_unlock(&ipvs->securetcp_lock);
 208
 209	local_bh_enable();
 210}
 211
 212/* Handler for delayed work for expiring no
 213 * destination connections
 214 */
 215static void expire_nodest_conn_handler(struct work_struct *work)
 216{
 217	struct netns_ipvs *ipvs;
 218
 219	ipvs = container_of(work, struct netns_ipvs,
 220			    expire_nodest_conn_work.work);
 221	ip_vs_expire_nodest_conn_flush(ipvs);
 222}
 223
 224/*
 225 *	Timer for checking the defense
 226 */
 227#define DEFENSE_TIMER_PERIOD	1*HZ
 228
 229static void defense_work_handler(struct work_struct *work)
 230{
 231	struct netns_ipvs *ipvs =
 232		container_of(work, struct netns_ipvs, defense_work.work);
 233
 234	update_defense_level(ipvs);
 235	if (atomic_read(&ipvs->dropentry))
 236		ip_vs_random_dropentry(ipvs);
 237	queue_delayed_work(system_long_wq, &ipvs->defense_work,
 238			   DEFENSE_TIMER_PERIOD);
 239}
 240#endif
 241
 242static void est_reload_work_handler(struct work_struct *work)
 243{
 244	struct netns_ipvs *ipvs =
 245		container_of(work, struct netns_ipvs, est_reload_work.work);
 246	int genid_done = atomic_read(&ipvs->est_genid_done);
 247	unsigned long delay = HZ / 10;	/* repeat startups after failure */
 248	bool repeat = false;
 249	int genid;
 250	int id;
 251
 252	mutex_lock(&ipvs->est_mutex);
 253	genid = atomic_read(&ipvs->est_genid);
 254	for (id = 0; id < ipvs->est_kt_count; id++) {
 255		struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
 256
 257		/* netns clean up started, abort delayed work */
 258		if (!READ_ONCE(ipvs->enable))
 259			goto unlock;
 260		if (!kd)
 261			continue;
 262		/* New config ? Stop kthread tasks */
 263		if (genid != genid_done)
 264			ip_vs_est_kthread_stop(kd);
 265		if (!kd->task && !ip_vs_est_stopped(ipvs)) {
 266			/* Do not start kthreads above 0 in calc phase */
 267			if ((!id || !ipvs->est_calc_phase) &&
 268			    ip_vs_est_kthread_start(ipvs, kd) < 0)
 269				repeat = true;
 270		}
 271	}
 272
 273	atomic_set(&ipvs->est_genid_done, genid);
 274
 275	if (repeat)
 276		queue_delayed_work(system_long_wq, &ipvs->est_reload_work,
 277				   delay);
 278
 279unlock:
 280	mutex_unlock(&ipvs->est_mutex);
 281}
 282
 283int
 284ip_vs_use_count_inc(void)
 285{
 286	return try_module_get(THIS_MODULE);
 287}
 288
 289void
 290ip_vs_use_count_dec(void)
 291{
 292	module_put(THIS_MODULE);
 293}
 294
 295
 296/*
 297 *	Hash table: for virtual service lookups
 298 */
 299#define IP_VS_SVC_TAB_BITS 8
 300#define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 301#define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 302
 303/* the service table hashed by <protocol, addr, port> */
 304static struct hlist_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 305/* the service table hashed by fwmark */
 306static struct hlist_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 307
 308
 309/*
 310 *	Returns hash value for virtual service
 311 */
 312static inline unsigned int
 313ip_vs_svc_hashkey(struct netns_ipvs *ipvs, int af, unsigned int proto,
 314		  const union nf_inet_addr *addr, __be16 port)
 315{
 316	unsigned int porth = ntohs(port);
 317	__be32 addr_fold = addr->ip;
 318	__u32 ahash;
 319
 320#ifdef CONFIG_IP_VS_IPV6
 321	if (af == AF_INET6)
 322		addr_fold = addr->ip6[0]^addr->ip6[1]^
 323			    addr->ip6[2]^addr->ip6[3];
 324#endif
 325	ahash = ntohl(addr_fold);
 326	ahash ^= ((size_t) ipvs >> 8);
 327
 328	return (proto ^ ahash ^ (porth >> IP_VS_SVC_TAB_BITS) ^ porth) &
 329	       IP_VS_SVC_TAB_MASK;
 330}
 331
 332/*
 333 *	Returns hash value of fwmark for virtual service lookup
 334 */
 335static inline unsigned int ip_vs_svc_fwm_hashkey(struct netns_ipvs *ipvs, __u32 fwmark)
 336{
 337	return (((size_t)ipvs>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
 338}
 339
 340/*
 341 *	Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
 342 *	or in the ip_vs_svc_fwm_table by fwmark.
 343 *	Should be called with locked tables.
 344 */
 345static int ip_vs_svc_hash(struct ip_vs_service *svc)
 346{
 347	unsigned int hash;
 348
 349	if (svc->flags & IP_VS_SVC_F_HASHED) {
 350		pr_err("%s(): request for already hashed, called from %pS\n",
 351		       __func__, __builtin_return_address(0));
 352		return 0;
 353	}
 354
 355	if (svc->fwmark == 0) {
 356		/*
 357		 *  Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
 358		 */
 359		hash = ip_vs_svc_hashkey(svc->ipvs, svc->af, svc->protocol,
 360					 &svc->addr, svc->port);
 361		hlist_add_head_rcu(&svc->s_list, &ip_vs_svc_table[hash]);
 362	} else {
 363		/*
 364		 *  Hash it by fwmark in svc_fwm_table
 365		 */
 366		hash = ip_vs_svc_fwm_hashkey(svc->ipvs, svc->fwmark);
 367		hlist_add_head_rcu(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 368	}
 369
 370	svc->flags |= IP_VS_SVC_F_HASHED;
 371	/* increase its refcnt because it is referenced by the svc table */
 372	atomic_inc(&svc->refcnt);
 373	return 1;
 374}
 375
 376
 377/*
 378 *	Unhashes a service from svc_table / svc_fwm_table.
 379 *	Should be called with locked tables.
 380 */
 381static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 382{
 383	if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 384		pr_err("%s(): request for unhash flagged, called from %pS\n",
 385		       __func__, __builtin_return_address(0));
 386		return 0;
 387	}
 388
 389	if (svc->fwmark == 0) {
 390		/* Remove it from the svc_table table */
 391		hlist_del_rcu(&svc->s_list);
 392	} else {
 393		/* Remove it from the svc_fwm_table table */
 394		hlist_del_rcu(&svc->f_list);
 395	}
 396
 397	svc->flags &= ~IP_VS_SVC_F_HASHED;
 398	atomic_dec(&svc->refcnt);
 399	return 1;
 400}
 401
 402
 403/*
 404 *	Get service by {netns, proto,addr,port} in the service table.
 405 */
 406static inline struct ip_vs_service *
 407__ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u16 protocol,
 408		     const union nf_inet_addr *vaddr, __be16 vport)
 409{
 410	unsigned int hash;
 411	struct ip_vs_service *svc;
 412
 413	/* Check for "full" addressed entries */
 414	hash = ip_vs_svc_hashkey(ipvs, af, protocol, vaddr, vport);
 415
 416	hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[hash], s_list) {
 417		if ((svc->af == af)
 418		    && ip_vs_addr_equal(af, &svc->addr, vaddr)
 419		    && (svc->port == vport)
 420		    && (svc->protocol == protocol)
 421		    && (svc->ipvs == ipvs)) {
 422			/* HIT */
 423			return svc;
 424		}
 425	}
 426
 427	return NULL;
 428}
 429
 430
 431/*
 432 *	Get service by {fwmark} in the service table.
 433 */
 434static inline struct ip_vs_service *
 435__ip_vs_svc_fwm_find(struct netns_ipvs *ipvs, int af, __u32 fwmark)
 436{
 437	unsigned int hash;
 438	struct ip_vs_service *svc;
 439
 440	/* Check for fwmark addressed entries */
 441	hash = ip_vs_svc_fwm_hashkey(ipvs, fwmark);
 442
 443	hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 444		if (svc->fwmark == fwmark && svc->af == af
 445		    && (svc->ipvs == ipvs)) {
 446			/* HIT */
 447			return svc;
 448		}
 449	}
 450
 451	return NULL;
 452}
 453
 454/* Find service, called under RCU lock */
 455struct ip_vs_service *
 456ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u32 fwmark, __u16 protocol,
 457		   const union nf_inet_addr *vaddr, __be16 vport)
 458{
 459	struct ip_vs_service *svc;
 460
 461	/*
 462	 *	Check the table hashed by fwmark first
 463	 */
 464	if (fwmark) {
 465		svc = __ip_vs_svc_fwm_find(ipvs, af, fwmark);
 466		if (svc)
 467			goto out;
 468	}
 469
 470	/*
 471	 *	Check the table hashed by <protocol,addr,port>
 472	 *	for "full" addressed entries
 473	 */
 474	svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, vport);
 475
 476	if (!svc && protocol == IPPROTO_TCP &&
 477	    atomic_read(&ipvs->ftpsvc_counter) &&
 478	    (vport == FTPDATA || !inet_port_requires_bind_service(ipvs->net, ntohs(vport)))) {
 479		/*
 480		 * Check if ftp service entry exists, the packet
 481		 * might belong to FTP data connections.
 482		 */
 483		svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, FTPPORT);
 484	}
 485
 486	if (svc == NULL
 487	    && atomic_read(&ipvs->nullsvc_counter)) {
 488		/*
 489		 * Check if the catch-all port (port zero) exists
 490		 */
 491		svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, 0);
 492	}
 493
 494  out:
 495	IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 496		      fwmark, ip_vs_proto_name(protocol),
 497		      IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 498		      svc ? "hit" : "not hit");
 499
 500	return svc;
 501}
 502
 503
 504static inline void
 505__ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 506{
 507	atomic_inc(&svc->refcnt);
 508	rcu_assign_pointer(dest->svc, svc);
 509}
 510
 511static void ip_vs_service_free(struct ip_vs_service *svc)
 512{
 513	ip_vs_stats_release(&svc->stats);
 514	kfree(svc);
 515}
 516
 517static void ip_vs_service_rcu_free(struct rcu_head *head)
 518{
 519	struct ip_vs_service *svc;
 520
 521	svc = container_of(head, struct ip_vs_service, rcu_head);
 522	ip_vs_service_free(svc);
 523}
 524
 525static void __ip_vs_svc_put(struct ip_vs_service *svc)
 526{
 527	if (atomic_dec_and_test(&svc->refcnt)) {
 528		IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n",
 529			      svc->fwmark,
 530			      IP_VS_DBG_ADDR(svc->af, &svc->addr),
 531			      ntohs(svc->port));
 532		call_rcu(&svc->rcu_head, ip_vs_service_rcu_free);
 533	}
 534}
 535
 536
 537/*
 538 *	Returns hash value for real service
 539 */
 540static inline unsigned int ip_vs_rs_hashkey(int af,
 541					    const union nf_inet_addr *addr,
 542					    __be16 port)
 543{
 544	unsigned int porth = ntohs(port);
 545	__be32 addr_fold = addr->ip;
 546
 547#ifdef CONFIG_IP_VS_IPV6
 548	if (af == AF_INET6)
 549		addr_fold = addr->ip6[0]^addr->ip6[1]^
 550			    addr->ip6[2]^addr->ip6[3];
 551#endif
 552
 553	return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 554		& IP_VS_RTAB_MASK;
 555}
 556
 557/* Hash ip_vs_dest in rs_table by <proto,addr,port>. */
 558static void ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
 559{
 560	unsigned int hash;
 561	__be16 port;
 562
 563	if (dest->in_rs_table)
 564		return;
 565
 566	switch (IP_VS_DFWD_METHOD(dest)) {
 567	case IP_VS_CONN_F_MASQ:
 568		port = dest->port;
 569		break;
 570	case IP_VS_CONN_F_TUNNEL:
 571		switch (dest->tun_type) {
 572		case IP_VS_CONN_F_TUNNEL_TYPE_GUE:
 573			port = dest->tun_port;
 574			break;
 575		case IP_VS_CONN_F_TUNNEL_TYPE_IPIP:
 576		case IP_VS_CONN_F_TUNNEL_TYPE_GRE:
 577			port = 0;
 578			break;
 579		default:
 580			return;
 581		}
 582		break;
 583	default:
 584		return;
 585	}
 586
 587	/*
 588	 *	Hash by proto,addr,port,
 589	 *	which are the parameters of the real service.
 590	 */
 591	hash = ip_vs_rs_hashkey(dest->af, &dest->addr, port);
 592
 593	hlist_add_head_rcu(&dest->d_list, &ipvs->rs_table[hash]);
 594	dest->in_rs_table = 1;
 595}
 596
 597/* Unhash ip_vs_dest from rs_table. */
 598static void ip_vs_rs_unhash(struct ip_vs_dest *dest)
 599{
 600	/*
 601	 * Remove it from the rs_table table.
 602	 */
 603	if (dest->in_rs_table) {
 604		hlist_del_rcu(&dest->d_list);
 605		dest->in_rs_table = 0;
 606	}
 607}
 608
 609/* Check if real service by <proto,addr,port> is present */
 610bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol,
 611			    const union nf_inet_addr *daddr, __be16 dport)
 612{
 613	unsigned int hash;
 614	struct ip_vs_dest *dest;
 615
 616	/* Check for "full" addressed entries */
 617	hash = ip_vs_rs_hashkey(af, daddr, dport);
 618
 619	hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
 620		if (dest->port == dport &&
 621		    dest->af == af &&
 622		    ip_vs_addr_equal(af, &dest->addr, daddr) &&
 623		    (dest->protocol == protocol || dest->vfwmark) &&
 624		    IP_VS_DFWD_METHOD(dest) == IP_VS_CONN_F_MASQ) {
 625			/* HIT */
 626			return true;
 627		}
 628	}
 629
 630	return false;
 631}
 632
 633/* Find real service record by <proto,addr,port>.
 634 * In case of multiple records with the same <proto,addr,port>, only
 635 * the first found record is returned.
 636 *
 637 * To be called under RCU lock.
 638 */
 639struct ip_vs_dest *ip_vs_find_real_service(struct netns_ipvs *ipvs, int af,
 640					   __u16 protocol,
 641					   const union nf_inet_addr *daddr,
 642					   __be16 dport)
 643{
 644	unsigned int hash;
 645	struct ip_vs_dest *dest;
 646
 647	/* Check for "full" addressed entries */
 648	hash = ip_vs_rs_hashkey(af, daddr, dport);
 649
 650	hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
 651		if (dest->port == dport &&
 652		    dest->af == af &&
 653		    ip_vs_addr_equal(af, &dest->addr, daddr) &&
 654		    (dest->protocol == protocol || dest->vfwmark) &&
 655		    IP_VS_DFWD_METHOD(dest) == IP_VS_CONN_F_MASQ) {
 656			/* HIT */
 657			return dest;
 658		}
 659	}
 660
 661	return NULL;
 662}
 663
 664/* Find real service record by <af,addr,tun_port>.
 665 * In case of multiple records with the same <af,addr,tun_port>, only
 666 * the first found record is returned.
 667 *
 668 * To be called under RCU lock.
 669 */
 670struct ip_vs_dest *ip_vs_find_tunnel(struct netns_ipvs *ipvs, int af,
 671				     const union nf_inet_addr *daddr,
 672				     __be16 tun_port)
 673{
 674	struct ip_vs_dest *dest;
 675	unsigned int hash;
 676
 677	/* Check for "full" addressed entries */
 678	hash = ip_vs_rs_hashkey(af, daddr, tun_port);
 679
 680	hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) {
 681		if (dest->tun_port == tun_port &&
 682		    dest->af == af &&
 683		    ip_vs_addr_equal(af, &dest->addr, daddr) &&
 684		    IP_VS_DFWD_METHOD(dest) == IP_VS_CONN_F_TUNNEL) {
 685			/* HIT */
 686			return dest;
 687		}
 688	}
 689
 690	return NULL;
 691}
 692
 693/* Lookup destination by {addr,port} in the given service
 694 * Called under RCU lock.
 695 */
 696static struct ip_vs_dest *
 697ip_vs_lookup_dest(struct ip_vs_service *svc, int dest_af,
 698		  const union nf_inet_addr *daddr, __be16 dport)
 699{
 700	struct ip_vs_dest *dest;
 701
 702	/*
 703	 * Find the destination for the given service
 704	 */
 705	list_for_each_entry_rcu(dest, &svc->destinations, n_list) {
 706		if ((dest->af == dest_af) &&
 707		    ip_vs_addr_equal(dest_af, &dest->addr, daddr) &&
 708		    (dest->port == dport)) {
 709			/* HIT */
 710			return dest;
 711		}
 712	}
 713
 714	return NULL;
 715}
 716
 717/*
 718 * Find destination by {daddr,dport,vaddr,protocol}
 719 * Created to be used in ip_vs_process_message() in
 720 * the backup synchronization daemon. It finds the
 721 * destination to be bound to the received connection
 722 * on the backup.
 723 * Called under RCU lock, no refcnt is returned.
 724 */
 725struct ip_vs_dest *ip_vs_find_dest(struct netns_ipvs *ipvs, int svc_af, int dest_af,
 726				   const union nf_inet_addr *daddr,
 727				   __be16 dport,
 728				   const union nf_inet_addr *vaddr,
 729				   __be16 vport, __u16 protocol, __u32 fwmark,
 730				   __u32 flags)
 731{
 732	struct ip_vs_dest *dest;
 733	struct ip_vs_service *svc;
 734	__be16 port = dport;
 735
 736	svc = ip_vs_service_find(ipvs, svc_af, fwmark, protocol, vaddr, vport);
 737	if (!svc)
 738		return NULL;
 739	if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ)
 740		port = 0;
 741	dest = ip_vs_lookup_dest(svc, dest_af, daddr, port);
 742	if (!dest)
 743		dest = ip_vs_lookup_dest(svc, dest_af, daddr, port ^ dport);
 744	return dest;
 745}
 746
 747void ip_vs_dest_dst_rcu_free(struct rcu_head *head)
 748{
 749	struct ip_vs_dest_dst *dest_dst = container_of(head,
 750						       struct ip_vs_dest_dst,
 751						       rcu_head);
 752
 753	dst_release(dest_dst->dst_cache);
 754	kfree(dest_dst);
 755}
 756
 757/* Release dest_dst and dst_cache for dest in user context */
 758static void __ip_vs_dst_cache_reset(struct ip_vs_dest *dest)
 759{
 760	struct ip_vs_dest_dst *old;
 761
 762	old = rcu_dereference_protected(dest->dest_dst, 1);
 763	if (old) {
 764		RCU_INIT_POINTER(dest->dest_dst, NULL);
 765		call_rcu(&old->rcu_head, ip_vs_dest_dst_rcu_free);
 766	}
 767}
 768
 769/*
 770 *  Lookup dest by {svc,addr,port} in the destination trash.
 771 *  The destination trash is used to hold the destinations that are removed
 772 *  from the service table but are still referenced by some conn entries.
 773 *  The reason to add the destination trash is when the dest is temporary
 774 *  down (either by administrator or by monitor program), the dest can be
 775 *  picked back from the trash, the remaining connections to the dest can
 776 *  continue, and the counting information of the dest is also useful for
 777 *  scheduling.
 778 */
 779static struct ip_vs_dest *
 780ip_vs_trash_get_dest(struct ip_vs_service *svc, int dest_af,
 781		     const union nf_inet_addr *daddr, __be16 dport)
 782{
 783	struct ip_vs_dest *dest;
 784	struct netns_ipvs *ipvs = svc->ipvs;
 785
 786	/*
 787	 * Find the destination in trash
 788	 */
 789	spin_lock_bh(&ipvs->dest_trash_lock);
 790	list_for_each_entry(dest, &ipvs->dest_trash, t_list) {
 791		IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 792			      "dest->refcnt=%d\n",
 793			      dest->vfwmark,
 794			      IP_VS_DBG_ADDR(dest->af, &dest->addr),
 795			      ntohs(dest->port),
 796			      refcount_read(&dest->refcnt));
 797		if (dest->af == dest_af &&
 798		    ip_vs_addr_equal(dest_af, &dest->addr, daddr) &&
 799		    dest->port == dport &&
 800		    dest->vfwmark == svc->fwmark &&
 801		    dest->protocol == svc->protocol &&
 802		    (svc->fwmark ||
 803		     (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 804		      dest->vport == svc->port))) {
 805			/* HIT */
 806			list_del(&dest->t_list);
 807			goto out;
 808		}
 809	}
 810
 811	dest = NULL;
 812
 813out:
 814	spin_unlock_bh(&ipvs->dest_trash_lock);
 815
 816	return dest;
 817}
 818
 819static void ip_vs_dest_rcu_free(struct rcu_head *head)
 820{
 821	struct ip_vs_dest *dest;
 822
 823	dest = container_of(head, struct ip_vs_dest, rcu_head);
 824	ip_vs_stats_release(&dest->stats);
 825	ip_vs_dest_put_and_free(dest);
 826}
 827
 828static void ip_vs_dest_free(struct ip_vs_dest *dest)
 829{
 830	struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1);
 831
 832	__ip_vs_dst_cache_reset(dest);
 833	__ip_vs_svc_put(svc);
 834	call_rcu(&dest->rcu_head, ip_vs_dest_rcu_free);
 835}
 836
 837/*
 838 *  Clean up all the destinations in the trash
 839 *  Called by the ip_vs_control_cleanup()
 840 *
 841 *  When the ip_vs_control_clearup is activated by ipvs module exit,
 842 *  the service tables must have been flushed and all the connections
 843 *  are expired, and the refcnt of each destination in the trash must
 844 *  be 1, so we simply release them here.
 845 */
 846static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs)
 847{
 848	struct ip_vs_dest *dest, *nxt;
 849
 850	timer_delete_sync(&ipvs->dest_trash_timer);
 851	/* No need to use dest_trash_lock */
 852	list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) {
 853		list_del(&dest->t_list);
 854		ip_vs_dest_free(dest);
 855	}
 856}
 857
 858static void ip_vs_stats_rcu_free(struct rcu_head *head)
 859{
 860	struct ip_vs_stats_rcu *rs = container_of(head,
 861						  struct ip_vs_stats_rcu,
 862						  rcu_head);
 863
 864	ip_vs_stats_release(&rs->s);
 865	kfree(rs);
 866}
 867
 868static void
 869ip_vs_copy_stats(struct ip_vs_kstats *dst, struct ip_vs_stats *src)
 870{
 871#define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->kstats.c - src->kstats0.c
 872
 873	spin_lock(&src->lock);
 874
 875	IP_VS_SHOW_STATS_COUNTER(conns);
 876	IP_VS_SHOW_STATS_COUNTER(inpkts);
 877	IP_VS_SHOW_STATS_COUNTER(outpkts);
 878	IP_VS_SHOW_STATS_COUNTER(inbytes);
 879	IP_VS_SHOW_STATS_COUNTER(outbytes);
 880
 881	ip_vs_read_estimator(dst, src);
 882
 883	spin_unlock(&src->lock);
 884}
 885
 886static void
 887ip_vs_export_stats_user(struct ip_vs_stats_user *dst, struct ip_vs_kstats *src)
 888{
 889	dst->conns = (u32)src->conns;
 890	dst->inpkts = (u32)src->inpkts;
 891	dst->outpkts = (u32)src->outpkts;
 892	dst->inbytes = src->inbytes;
 893	dst->outbytes = src->outbytes;
 894	dst->cps = (u32)src->cps;
 895	dst->inpps = (u32)src->inpps;
 896	dst->outpps = (u32)src->outpps;
 897	dst->inbps = (u32)src->inbps;
 898	dst->outbps = (u32)src->outbps;
 899}
 900
 901static void
 902ip_vs_zero_stats(struct ip_vs_stats *stats)
 903{
 904	spin_lock(&stats->lock);
 905
 906	/* get current counters as zero point, rates are zeroed */
 907
 908#define IP_VS_ZERO_STATS_COUNTER(c) stats->kstats0.c = stats->kstats.c
 909
 910	IP_VS_ZERO_STATS_COUNTER(conns);
 911	IP_VS_ZERO_STATS_COUNTER(inpkts);
 912	IP_VS_ZERO_STATS_COUNTER(outpkts);
 913	IP_VS_ZERO_STATS_COUNTER(inbytes);
 914	IP_VS_ZERO_STATS_COUNTER(outbytes);
 915
 916	ip_vs_zero_estimator(stats);
 917
 918	spin_unlock(&stats->lock);
 919}
 920
 921/* Allocate fields after kzalloc */
 922int ip_vs_stats_init_alloc(struct ip_vs_stats *s)
 923{
 924	int i;
 925
 926	spin_lock_init(&s->lock);
 927	s->cpustats = alloc_percpu(struct ip_vs_cpu_stats);
 928	if (!s->cpustats)
 929		return -ENOMEM;
 930
 931	for_each_possible_cpu(i) {
 932		struct ip_vs_cpu_stats *cs = per_cpu_ptr(s->cpustats, i);
 933
 934		u64_stats_init(&cs->syncp);
 935	}
 936	return 0;
 937}
 938
 939struct ip_vs_stats *ip_vs_stats_alloc(void)
 940{
 941	struct ip_vs_stats *s = kzalloc(sizeof(*s), GFP_KERNEL);
 942
 943	if (s && ip_vs_stats_init_alloc(s) >= 0)
 944		return s;
 945	kfree(s);
 946	return NULL;
 947}
 948
 949void ip_vs_stats_release(struct ip_vs_stats *stats)
 950{
 951	free_percpu(stats->cpustats);
 952}
 953
 954void ip_vs_stats_free(struct ip_vs_stats *stats)
 955{
 956	if (stats) {
 957		ip_vs_stats_release(stats);
 958		kfree(stats);
 959	}
 960}
 961
 962/*
 963 *	Update a destination in the given service
 964 */
 965static void
 966__ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
 967		    struct ip_vs_dest_user_kern *udest, int add)
 968{
 969	struct netns_ipvs *ipvs = svc->ipvs;
 970	struct ip_vs_service *old_svc;
 971	struct ip_vs_scheduler *sched;
 972	int conn_flags;
 973
 974	/* We cannot modify an address and change the address family */
 975	BUG_ON(!add && udest->af != dest->af);
 976
 977	if (add && udest->af != svc->af)
 978		ipvs->mixed_address_family_dests++;
 979
 980	/* keep the last_weight with latest non-0 weight */
 981	if (add || udest->weight != 0)
 982		atomic_set(&dest->last_weight, udest->weight);
 983
 984	/* set the weight and the flags */
 985	atomic_set(&dest->weight, udest->weight);
 986	conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
 987	conn_flags |= IP_VS_CONN_F_INACTIVE;
 988
 989	/* Need to rehash? */
 990	if ((udest->conn_flags & IP_VS_CONN_F_FWD_MASK) !=
 991	    IP_VS_DFWD_METHOD(dest) ||
 992	    udest->tun_type != dest->tun_type ||
 993	    udest->tun_port != dest->tun_port)
 994		ip_vs_rs_unhash(dest);
 995
 996	/* set the tunnel info */
 997	dest->tun_type = udest->tun_type;
 998	dest->tun_port = udest->tun_port;
 999	dest->tun_flags = udest->tun_flags;
1000
1001	/* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
1002	if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
1003		conn_flags |= IP_VS_CONN_F_NOOUTPUT;
1004	} else {
1005		/* FTP-NAT requires conntrack for mangling */
1006		if (svc->port == FTPPORT)
1007			ip_vs_register_conntrack(svc);
1008	}
1009	atomic_set(&dest->conn_flags, conn_flags);
1010	/* Put the real service in rs_table if not present. */
1011	ip_vs_rs_hash(ipvs, dest);
1012
1013	/* bind the service */
1014	old_svc = rcu_dereference_protected(dest->svc, 1);
1015	if (!old_svc) {
1016		__ip_vs_bind_svc(dest, svc);
1017	} else {
1018		if (old_svc != svc) {
1019			ip_vs_zero_stats(&dest->stats);
1020			__ip_vs_bind_svc(dest, svc);
1021			__ip_vs_svc_put(old_svc);
1022		}
1023	}
1024
1025	/* set the dest status flags */
1026	dest->flags |= IP_VS_DEST_F_AVAILABLE;
1027
1028	if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
1029		dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
1030	dest->u_threshold = udest->u_threshold;
1031	dest->l_threshold = udest->l_threshold;
1032
1033	dest->af = udest->af;
1034
1035	spin_lock_bh(&dest->dst_lock);
1036	__ip_vs_dst_cache_reset(dest);
1037	spin_unlock_bh(&dest->dst_lock);
1038
1039	if (add) {
1040		list_add_rcu(&dest->n_list, &svc->destinations);
1041		svc->num_dests++;
1042		sched = rcu_dereference_protected(svc->scheduler, 1);
1043		if (sched && sched->add_dest)
1044			sched->add_dest(svc, dest);
1045	} else {
1046		sched = rcu_dereference_protected(svc->scheduler, 1);
1047		if (sched && sched->upd_dest)
1048			sched->upd_dest(svc, dest);
1049	}
1050}
1051
1052
1053/*
1054 *	Create a destination for the given service
1055 */
1056static int
1057ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1058{
1059	struct ip_vs_dest *dest;
1060	unsigned int atype;
1061	int ret;
1062
1063#ifdef CONFIG_IP_VS_IPV6
1064	if (udest->af == AF_INET6) {
1065		atype = ipv6_addr_type(&udest->addr.in6);
1066		if ((!(atype & IPV6_ADDR_UNICAST) ||
1067			atype & IPV6_ADDR_LINKLOCAL) &&
1068			!__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6))
1069			return -EINVAL;
1070
1071		ret = nf_defrag_ipv6_enable(svc->ipvs->net);
1072		if (ret)
1073			return ret;
1074	} else
1075#endif
1076	{
1077		atype = inet_addr_type(svc->ipvs->net, udest->addr.ip);
1078		if (atype != RTN_LOCAL && atype != RTN_UNICAST)
1079			return -EINVAL;
1080	}
1081
1082	dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
1083	if (dest == NULL)
1084		return -ENOMEM;
1085
1086	ret = ip_vs_stats_init_alloc(&dest->stats);
1087	if (ret < 0)
1088		goto err_alloc;
1089
1090	ret = ip_vs_start_estimator(svc->ipvs, &dest->stats);
1091	if (ret < 0)
1092		goto err_stats;
1093
1094	dest->af = udest->af;
1095	dest->protocol = svc->protocol;
1096	dest->vaddr = svc->addr;
1097	dest->vport = svc->port;
1098	dest->vfwmark = svc->fwmark;
1099	ip_vs_addr_copy(udest->af, &dest->addr, &udest->addr);
1100	dest->port = udest->port;
1101
1102	atomic_set(&dest->activeconns, 0);
1103	atomic_set(&dest->inactconns, 0);
1104	atomic_set(&dest->persistconns, 0);
1105	refcount_set(&dest->refcnt, 1);
1106
1107	INIT_HLIST_NODE(&dest->d_list);
1108	spin_lock_init(&dest->dst_lock);
1109	__ip_vs_update_dest(svc, dest, udest, 1);
1110
1111	return 0;
1112
1113err_stats:
1114	ip_vs_stats_release(&dest->stats);
1115
1116err_alloc:
1117	kfree(dest);
1118	return ret;
1119}
1120
1121
1122/*
1123 *	Add a destination into an existing service
1124 */
1125static int
1126ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1127{
1128	struct ip_vs_dest *dest;
1129	union nf_inet_addr daddr;
1130	__be16 dport = udest->port;
1131	int ret;
1132
1133	if (udest->weight < 0) {
1134		pr_err("%s(): server weight less than zero\n", __func__);
1135		return -ERANGE;
1136	}
1137
1138	if (udest->l_threshold > udest->u_threshold) {
1139		pr_err("%s(): lower threshold is higher than upper threshold\n",
1140			__func__);
1141		return -ERANGE;
1142	}
1143
1144	if (udest->tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) {
1145		if (udest->tun_port == 0) {
1146			pr_err("%s(): tunnel port is zero\n", __func__);
1147			return -EINVAL;
1148		}
1149	}
1150
1151	ip_vs_addr_copy(udest->af, &daddr, &udest->addr);
1152
1153	/* We use function that requires RCU lock */
1154	rcu_read_lock();
1155	dest = ip_vs_lookup_dest(svc, udest->af, &daddr, dport);
1156	rcu_read_unlock();
1157
1158	if (dest != NULL) {
1159		IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
1160		return -EEXIST;
1161	}
1162
1163	/*
1164	 * Check if the dest already exists in the trash and
1165	 * is from the same service
1166	 */
1167	dest = ip_vs_trash_get_dest(svc, udest->af, &daddr, dport);
1168
1169	if (dest != NULL) {
1170		IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
1171			      "dest->refcnt=%d, service %u/%s:%u\n",
1172			      IP_VS_DBG_ADDR(udest->af, &daddr), ntohs(dport),
1173			      refcount_read(&dest->refcnt),
1174			      dest->vfwmark,
1175			      IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
1176			      ntohs(dest->vport));
1177
1178		ret = ip_vs_start_estimator(svc->ipvs, &dest->stats);
1179		if (ret < 0)
1180			return ret;
1181		__ip_vs_update_dest(svc, dest, udest, 1);
1182	} else {
1183		/*
1184		 * Allocate and initialize the dest structure
1185		 */
1186		ret = ip_vs_new_dest(svc, udest);
1187	}
1188
1189	return ret;
1190}
1191
1192
1193/*
1194 *	Edit a destination in the given service
1195 */
1196static int
1197ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1198{
1199	struct ip_vs_dest *dest;
1200	union nf_inet_addr daddr;
1201	__be16 dport = udest->port;
1202
1203	if (udest->weight < 0) {
1204		pr_err("%s(): server weight less than zero\n", __func__);
1205		return -ERANGE;
1206	}
1207
1208	if (udest->l_threshold > udest->u_threshold) {
1209		pr_err("%s(): lower threshold is higher than upper threshold\n",
1210			__func__);
1211		return -ERANGE;
1212	}
1213
1214	if (udest->tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) {
1215		if (udest->tun_port == 0) {
1216			pr_err("%s(): tunnel port is zero\n", __func__);
1217			return -EINVAL;
1218		}
1219	}
1220
1221	ip_vs_addr_copy(udest->af, &daddr, &udest->addr);
1222
1223	/* We use function that requires RCU lock */
1224	rcu_read_lock();
1225	dest = ip_vs_lookup_dest(svc, udest->af, &daddr, dport);
1226	rcu_read_unlock();
1227
1228	if (dest == NULL) {
1229		IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1230		return -ENOENT;
1231	}
1232
1233	__ip_vs_update_dest(svc, dest, udest, 0);
1234
1235	return 0;
1236}
1237
1238/*
1239 *	Delete a destination (must be already unlinked from the service)
1240 */
1241static void __ip_vs_del_dest(struct netns_ipvs *ipvs, struct ip_vs_dest *dest,
1242			     bool cleanup)
1243{
1244	ip_vs_stop_estimator(ipvs, &dest->stats);
1245
1246	/*
1247	 *  Remove it from the d-linked list with the real services.
1248	 */
1249	ip_vs_rs_unhash(dest);
1250
1251	spin_lock_bh(&ipvs->dest_trash_lock);
1252	IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n",
1253		      IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port),
1254		      refcount_read(&dest->refcnt));
1255	if (list_empty(&ipvs->dest_trash) && !cleanup)
1256		mod_timer(&ipvs->dest_trash_timer,
1257			  jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
1258	/* dest lives in trash with reference */
1259	list_add(&dest->t_list, &ipvs->dest_trash);
1260	dest->idle_start = 0;
1261	spin_unlock_bh(&ipvs->dest_trash_lock);
1262
1263	/* Queue up delayed work to expire all no destination connections.
1264	 * No-op when CONFIG_SYSCTL is disabled.
1265	 */
1266	if (!cleanup)
1267		ip_vs_enqueue_expire_nodest_conns(ipvs);
1268}
1269
1270
1271/*
1272 *	Unlink a destination from the given service
1273 */
1274static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1275				struct ip_vs_dest *dest,
1276				int svcupd)
1277{
1278	dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1279
1280	/*
1281	 *  Remove it from the d-linked destination list.
1282	 */
1283	list_del_rcu(&dest->n_list);
1284	svc->num_dests--;
1285
1286	if (dest->af != svc->af)
1287		svc->ipvs->mixed_address_family_dests--;
1288
1289	if (svcupd) {
1290		struct ip_vs_scheduler *sched;
1291
1292		sched = rcu_dereference_protected(svc->scheduler, 1);
1293		if (sched && sched->del_dest)
1294			sched->del_dest(svc, dest);
1295	}
1296}
1297
1298
1299/*
1300 *	Delete a destination server in the given service
1301 */
1302static int
1303ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1304{
1305	struct ip_vs_dest *dest;
1306	__be16 dport = udest->port;
1307
1308	/* We use function that requires RCU lock */
1309	rcu_read_lock();
1310	dest = ip_vs_lookup_dest(svc, udest->af, &udest->addr, dport);
1311	rcu_read_unlock();
1312
1313	if (dest == NULL) {
1314		IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1315		return -ENOENT;
1316	}
1317
1318	/*
1319	 *	Unlink dest from the service
1320	 */
1321	__ip_vs_unlink_dest(svc, dest, 1);
1322
1323	/*
1324	 *	Delete the destination
1325	 */
1326	__ip_vs_del_dest(svc->ipvs, dest, false);
1327
1328	return 0;
1329}
1330
1331static void ip_vs_dest_trash_expire(struct timer_list *t)
1332{
1333	struct netns_ipvs *ipvs = timer_container_of(ipvs, t,
1334						     dest_trash_timer);
1335	struct ip_vs_dest *dest, *next;
1336	unsigned long now = jiffies;
1337
1338	spin_lock(&ipvs->dest_trash_lock);
1339	list_for_each_entry_safe(dest, next, &ipvs->dest_trash, t_list) {
1340		if (refcount_read(&dest->refcnt) > 1)
1341			continue;
1342		if (dest->idle_start) {
1343			if (time_before(now, dest->idle_start +
1344					     IP_VS_DEST_TRASH_PERIOD))
1345				continue;
1346		} else {
1347			dest->idle_start = max(1UL, now);
1348			continue;
1349		}
1350		IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u from trash\n",
1351			      dest->vfwmark,
1352			      IP_VS_DBG_ADDR(dest->af, &dest->addr),
1353			      ntohs(dest->port));
1354		list_del(&dest->t_list);
1355		ip_vs_dest_free(dest);
1356	}
1357	if (!list_empty(&ipvs->dest_trash))
1358		mod_timer(&ipvs->dest_trash_timer,
1359			  jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1));
1360	spin_unlock(&ipvs->dest_trash_lock);
1361}
1362
1363/*
1364 *	Add a service into the service hash table
1365 */
1366static int
1367ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
1368		  struct ip_vs_service **svc_p)
1369{
1370	int ret = 0;
1371	struct ip_vs_scheduler *sched = NULL;
1372	struct ip_vs_pe *pe = NULL;
1373	struct ip_vs_service *svc = NULL;
1374	int ret_hooks = -1;
1375
1376	/* increase the module use count */
1377	if (!ip_vs_use_count_inc())
1378		return -ENOPROTOOPT;
1379
1380	/* Lookup the scheduler by 'u->sched_name' */
1381	if (strcmp(u->sched_name, "none")) {
1382		sched = ip_vs_scheduler_get(u->sched_name);
1383		if (!sched) {
1384			pr_info("Scheduler module ip_vs_%s not found\n",
1385				u->sched_name);
1386			ret = -ENOENT;
1387			goto out_err;
1388		}
1389	}
1390
1391	if (u->pe_name && *u->pe_name) {
1392		pe = ip_vs_pe_getbyname(u->pe_name);
1393		if (pe == NULL) {
1394			pr_info("persistence engine module ip_vs_pe_%s "
1395				"not found\n", u->pe_name);
1396			ret = -ENOENT;
1397			goto out_err;
1398		}
1399	}
1400
1401#ifdef CONFIG_IP_VS_IPV6
1402	if (u->af == AF_INET6) {
1403		__u32 plen = (__force __u32) u->netmask;
1404
1405		if (plen < 1 || plen > 128) {
1406			ret = -EINVAL;
1407			goto out_err;
1408		}
1409
1410		ret = nf_defrag_ipv6_enable(ipvs->net);
1411		if (ret)
1412			goto out_err;
1413	}
1414#endif
1415
1416	if ((u->af == AF_INET && !ipvs->num_services) ||
1417	    (u->af == AF_INET6 && !ipvs->num_services6)) {
1418		ret = ip_vs_register_hooks(ipvs, u->af);
1419		if (ret < 0)
1420			goto out_err;
1421		ret_hooks = ret;
1422	}
1423
1424	svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1425	if (svc == NULL) {
1426		IP_VS_DBG(1, "%s(): no memory\n", __func__);
1427		ret = -ENOMEM;
1428		goto out_err;
1429	}
1430	ret = ip_vs_stats_init_alloc(&svc->stats);
1431	if (ret < 0)
1432		goto out_err;
1433
1434	/* I'm the first user of the service */
1435	atomic_set(&svc->refcnt, 0);
1436
1437	svc->af = u->af;
1438	svc->protocol = u->protocol;
1439	ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1440	svc->port = u->port;
1441	svc->fwmark = u->fwmark;
1442	svc->flags = u->flags & ~IP_VS_SVC_F_HASHED;
1443	svc->timeout = u->timeout * HZ;
1444	svc->netmask = u->netmask;
1445	svc->ipvs = ipvs;
1446
1447	INIT_LIST_HEAD(&svc->destinations);
1448	spin_lock_init(&svc->sched_lock);
1449
1450	/* Bind the scheduler */
1451	if (sched) {
1452		ret = ip_vs_bind_scheduler(svc, sched);
1453		if (ret)
1454			goto out_err;
1455	}
1456
1457	ret = ip_vs_start_estimator(ipvs, &svc->stats);
1458	if (ret < 0)
1459		goto out_err;
1460
1461	/* Update the virtual service counters */
1462	if (svc->port == FTPPORT)
1463		atomic_inc(&ipvs->ftpsvc_counter);
1464	else if (svc->port == 0)
1465		atomic_inc(&ipvs->nullsvc_counter);
1466	if (pe && pe->conn_out)
1467		atomic_inc(&ipvs->conn_out_counter);
1468
1469	/* Bind the ct retriever */
1470	RCU_INIT_POINTER(svc->pe, pe);
1471	pe = NULL;
1472
1473	/* Count only IPv4 services for old get/setsockopt interface */
1474	if (svc->af == AF_INET)
1475		ipvs->num_services++;
1476	else if (svc->af == AF_INET6)
1477		ipvs->num_services6++;
1478
1479	/* Hash the service into the service table */
1480	ip_vs_svc_hash(svc);
1481
1482	*svc_p = svc;
1483
1484	if (!READ_ONCE(ipvs->enable)) {
1485		/* Now there is a service - full throttle */
1486		WRITE_ONCE(ipvs->enable, 1);
1487
1488		/* Start estimation for first time */
1489		ip_vs_est_reload_start(ipvs);
1490	}
1491
1492	return 0;
1493
1494
1495 out_err:
1496	if (ret_hooks >= 0)
1497		ip_vs_unregister_hooks(ipvs, u->af);
1498	if (svc != NULL) {
1499		ip_vs_unbind_scheduler(svc, sched);
1500		ip_vs_service_free(svc);
1501	}
1502	ip_vs_scheduler_put(sched);
1503	ip_vs_pe_put(pe);
1504
1505	/* decrease the module use count */
1506	ip_vs_use_count_dec();
1507
1508	return ret;
1509}
1510
1511
1512/*
1513 *	Edit a service and bind it with a new scheduler
1514 */
1515static int
1516ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1517{
1518	struct ip_vs_scheduler *sched = NULL, *old_sched;
1519	struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1520	int ret = 0;
1521	bool new_pe_conn_out, old_pe_conn_out;
1522
1523	/*
1524	 * Lookup the scheduler, by 'u->sched_name'
1525	 */
1526	if (strcmp(u->sched_name, "none")) {
1527		sched = ip_vs_scheduler_get(u->sched_name);
1528		if (!sched) {
1529			pr_info("Scheduler module ip_vs_%s not found\n",
1530				u->sched_name);
1531			return -ENOENT;
1532		}
1533	}
1534	old_sched = sched;
1535
1536	if (u->pe_name && *u->pe_name) {
1537		pe = ip_vs_pe_getbyname(u->pe_name);
1538		if (pe == NULL) {
1539			pr_info("persistence engine module ip_vs_pe_%s "
1540				"not found\n", u->pe_name);
1541			ret = -ENOENT;
1542			goto out;
1543		}
1544		old_pe = pe;
1545	}
1546
1547#ifdef CONFIG_IP_VS_IPV6
1548	if (u->af == AF_INET6) {
1549		__u32 plen = (__force __u32) u->netmask;
1550
1551		if (plen < 1 || plen > 128) {
1552			ret = -EINVAL;
1553			goto out;
1554		}
1555	}
1556#endif
1557
1558	old_sched = rcu_dereference_protected(svc->scheduler, 1);
1559	if (sched != old_sched) {
1560		if (old_sched) {
1561			ip_vs_unbind_scheduler(svc, old_sched);
1562			RCU_INIT_POINTER(svc->scheduler, NULL);
1563			/* Wait all svc->sched_data users */
1564			synchronize_rcu();
1565		}
1566		/* Bind the new scheduler */
1567		if (sched) {
1568			ret = ip_vs_bind_scheduler(svc, sched);
1569			if (ret) {
1570				ip_vs_scheduler_put(sched);
1571				goto out;
1572			}
1573		}
1574	}
1575
1576	/*
1577	 * Set the flags and timeout value
1578	 */
1579	svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1580	svc->timeout = u->timeout * HZ;
1581	svc->netmask = u->netmask;
1582
1583	old_pe = rcu_dereference_protected(svc->pe, 1);
1584	if (pe != old_pe) {
1585		rcu_assign_pointer(svc->pe, pe);
1586		/* check for optional methods in new pe */
1587		new_pe_conn_out = (pe && pe->conn_out) ? true : false;
1588		old_pe_conn_out = (old_pe && old_pe->conn_out) ? true : false;
1589		if (new_pe_conn_out && !old_pe_conn_out)
1590			atomic_inc(&svc->ipvs->conn_out_counter);
1591		if (old_pe_conn_out && !new_pe_conn_out)
1592			atomic_dec(&svc->ipvs->conn_out_counter);
1593	}
1594
1595out:
1596	ip_vs_scheduler_put(old_sched);
1597	ip_vs_pe_put(old_pe);
1598	return ret;
1599}
1600
1601/*
1602 *	Delete a service from the service list
1603 *	- The service must be unlinked, unlocked and not referenced!
1604 *	- We are called under _bh lock
1605 */
1606static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
1607{
1608	struct ip_vs_dest *dest, *nxt;
1609	struct ip_vs_scheduler *old_sched;
1610	struct ip_vs_pe *old_pe;
1611	struct netns_ipvs *ipvs = svc->ipvs;
1612
1613	if (svc->af == AF_INET) {
1614		ipvs->num_services--;
1615		if (!ipvs->num_services)
1616			ip_vs_unregister_hooks(ipvs, svc->af);
1617	} else if (svc->af == AF_INET6) {
1618		ipvs->num_services6--;
1619		if (!ipvs->num_services6)
1620			ip_vs_unregister_hooks(ipvs, svc->af);
1621	}
1622
1623	ip_vs_stop_estimator(svc->ipvs, &svc->stats);
1624
1625	/* Unbind scheduler */
1626	old_sched = rcu_dereference_protected(svc->scheduler, 1);
1627	ip_vs_unbind_scheduler(svc, old_sched);
1628	ip_vs_scheduler_put(old_sched);
1629
1630	/* Unbind persistence engine, keep svc->pe */
1631	old_pe = rcu_dereference_protected(svc->pe, 1);
1632	if (old_pe && old_pe->conn_out)
1633		atomic_dec(&ipvs->conn_out_counter);
1634	ip_vs_pe_put(old_pe);
1635
1636	/*
1637	 *    Unlink the whole destination list
1638	 */
1639	list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1640		__ip_vs_unlink_dest(svc, dest, 0);
1641		__ip_vs_del_dest(svc->ipvs, dest, cleanup);
1642	}
1643
1644	/*
1645	 *    Update the virtual service counters
1646	 */
1647	if (svc->port == FTPPORT)
1648		atomic_dec(&ipvs->ftpsvc_counter);
1649	else if (svc->port == 0)
1650		atomic_dec(&ipvs->nullsvc_counter);
1651
1652	/*
1653	 *    Free the service if nobody refers to it
1654	 */
1655	__ip_vs_svc_put(svc);
1656
1657	/* decrease the module use count */
1658	ip_vs_use_count_dec();
1659}
1660
1661/*
1662 * Unlink a service from list and try to delete it if its refcnt reached 0
1663 */
1664static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup)
1665{
1666	ip_vs_unregister_conntrack(svc);
1667	/* Hold svc to avoid double release from dest_trash */
1668	atomic_inc(&svc->refcnt);
1669	/*
1670	 * Unhash it from the service table
1671	 */
1672	ip_vs_svc_unhash(svc);
1673
1674	__ip_vs_del_service(svc, cleanup);
1675}
1676
1677/*
1678 *	Delete a service from the service list
1679 */
1680static int ip_vs_del_service(struct ip_vs_service *svc)
1681{
1682	if (svc == NULL)
1683		return -EEXIST;
1684	ip_vs_unlink_service(svc, false);
1685
1686	return 0;
1687}
1688
1689
1690/*
1691 *	Flush all the virtual services
1692 */
1693static int ip_vs_flush(struct netns_ipvs *ipvs, bool cleanup)
1694{
1695	int idx;
1696	struct ip_vs_service *svc;
1697	struct hlist_node *n;
1698
1699	/*
1700	 * Flush the service table hashed by <netns,protocol,addr,port>
1701	 */
1702	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1703		hlist_for_each_entry_safe(svc, n, &ip_vs_svc_table[idx],
1704					  s_list) {
1705			if (svc->ipvs == ipvs)
1706				ip_vs_unlink_service(svc, cleanup);
1707		}
1708	}
1709
1710	/*
1711	 * Flush the service table hashed by fwmark
1712	 */
1713	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1714		hlist_for_each_entry_safe(svc, n, &ip_vs_svc_fwm_table[idx],
1715					  f_list) {
1716			if (svc->ipvs == ipvs)
1717				ip_vs_unlink_service(svc, cleanup);
1718		}
1719	}
1720
1721	return 0;
1722}
1723
1724/*
1725 *	Delete service by {netns} in the service table.
1726 *	Called by __ip_vs_batch_cleanup()
1727 */
1728void ip_vs_service_nets_cleanup(struct list_head *net_list)
1729{
1730	struct netns_ipvs *ipvs;
1731	struct net *net;
1732
1733	/* Check for "full" addressed entries */
1734	mutex_lock(&__ip_vs_mutex);
1735	list_for_each_entry(net, net_list, exit_list) {
1736		ipvs = net_ipvs(net);
1737		ip_vs_flush(ipvs, true);
1738	}
1739	mutex_unlock(&__ip_vs_mutex);
1740}
1741
1742/* Put all references for device (dst_cache) */
1743static inline void
1744ip_vs_forget_dev(struct ip_vs_dest *dest, struct net_device *dev)
1745{
1746	struct ip_vs_dest_dst *dest_dst;
1747
1748	spin_lock_bh(&dest->dst_lock);
1749	dest_dst = rcu_dereference_protected(dest->dest_dst, 1);
1750	if (dest_dst && dest_dst->dst_cache->dev == dev) {
1751		IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1752			      dev->name,
1753			      IP_VS_DBG_ADDR(dest->af, &dest->addr),
1754			      ntohs(dest->port),
1755			      refcount_read(&dest->refcnt));
1756		__ip_vs_dst_cache_reset(dest);
1757	}
1758	spin_unlock_bh(&dest->dst_lock);
1759
1760}
1761/* Netdev event receiver
1762 * Currently only NETDEV_DOWN is handled to release refs to cached dsts
1763 */
1764static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1765			   void *ptr)
1766{
1767	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1768	struct net *net = dev_net(dev);
1769	struct netns_ipvs *ipvs = net_ipvs(net);
1770	struct ip_vs_service *svc;
1771	struct ip_vs_dest *dest;
1772	unsigned int idx;
1773
1774	if (event != NETDEV_DOWN || !ipvs)
1775		return NOTIFY_DONE;
1776	IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1777	mutex_lock(&__ip_vs_mutex);
1778	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1779		hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1780			if (svc->ipvs == ipvs) {
1781				list_for_each_entry(dest, &svc->destinations,
1782						    n_list) {
1783					ip_vs_forget_dev(dest, dev);
1784				}
1785			}
1786		}
1787
1788		hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1789			if (svc->ipvs == ipvs) {
1790				list_for_each_entry(dest, &svc->destinations,
1791						    n_list) {
1792					ip_vs_forget_dev(dest, dev);
1793				}
1794			}
1795
1796		}
1797	}
1798
1799	spin_lock_bh(&ipvs->dest_trash_lock);
1800	list_for_each_entry(dest, &ipvs->dest_trash, t_list) {
1801		ip_vs_forget_dev(dest, dev);
1802	}
1803	spin_unlock_bh(&ipvs->dest_trash_lock);
1804	mutex_unlock(&__ip_vs_mutex);
1805	return NOTIFY_DONE;
1806}
1807
1808/*
1809 *	Zero counters in a service or all services
1810 */
1811static int ip_vs_zero_service(struct ip_vs_service *svc)
1812{
1813	struct ip_vs_dest *dest;
1814
1815	list_for_each_entry(dest, &svc->destinations, n_list) {
1816		ip_vs_zero_stats(&dest->stats);
1817	}
1818	ip_vs_zero_stats(&svc->stats);
1819	return 0;
1820}
1821
1822static int ip_vs_zero_all(struct netns_ipvs *ipvs)
1823{
1824	int idx;
1825	struct ip_vs_service *svc;
1826
1827	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1828		hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1829			if (svc->ipvs == ipvs)
1830				ip_vs_zero_service(svc);
1831		}
1832	}
1833
1834	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1835		hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1836			if (svc->ipvs == ipvs)
1837				ip_vs_zero_service(svc);
1838		}
1839	}
1840
1841	ip_vs_zero_stats(&ipvs->tot_stats->s);
1842	return 0;
1843}
1844
1845#ifdef CONFIG_SYSCTL
1846
1847static int
1848proc_do_defense_mode(const struct ctl_table *table, int write,
1849		     void *buffer, size_t *lenp, loff_t *ppos)
1850{
1851	struct netns_ipvs *ipvs = table->extra2;
1852	int *valp = table->data;
1853	int val = *valp;
1854	int rc;
1855
1856	struct ctl_table tmp = {
1857		.data = &val,
1858		.maxlen = sizeof(int),
1859		.mode = table->mode,
1860	};
1861
1862	rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
1863	if (write && (*valp != val)) {
1864		if (val < 0 || val > 3) {
1865			rc = -EINVAL;
1866		} else {
1867			*valp = val;
1868			update_defense_level(ipvs);
1869		}
1870	}
1871	return rc;
1872}
1873
1874static int
1875proc_do_sync_threshold(const struct ctl_table *table, int write,
1876		       void *buffer, size_t *lenp, loff_t *ppos)
1877{
1878	struct netns_ipvs *ipvs = table->extra2;
1879	int *valp = table->data;
1880	int val[2];
1881	int rc;
1882	struct ctl_table tmp = {
1883		.data = &val,
1884		.maxlen = table->maxlen,
1885		.mode = table->mode,
1886	};
1887
1888	mutex_lock(&ipvs->sync_mutex);
1889	memcpy(val, valp, sizeof(val));
1890	rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
1891	if (write) {
1892		if (val[0] < 0 || val[1] < 0 ||
1893		    (val[0] >= val[1] && val[1]))
1894			rc = -EINVAL;
1895		else
1896			memcpy(valp, val, sizeof(val));
1897	}
1898	mutex_unlock(&ipvs->sync_mutex);
1899	return rc;
1900}
1901
1902static int
1903proc_do_sync_ports(const struct ctl_table *table, int write,
1904		   void *buffer, size_t *lenp, loff_t *ppos)
1905{
1906	int *valp = table->data;
1907	int val = *valp;
1908	int rc;
1909
1910	struct ctl_table tmp = {
1911		.data = &val,
1912		.maxlen = sizeof(int),
1913		.mode = table->mode,
1914	};
1915
1916	rc = proc_dointvec(&tmp, write, buffer, lenp, ppos);
1917	if (write && (*valp != val)) {
1918		if (val < 1 || !is_power_of_2(val))
1919			rc = -EINVAL;
1920		else
1921			*valp = val;
1922	}
1923	return rc;
1924}
1925
1926static int ipvs_proc_est_cpumask_set(const struct ctl_table *table,
1927				     void *buffer)
1928{
1929	struct netns_ipvs *ipvs = table->extra2;
1930	cpumask_var_t *valp = table->data;
1931	cpumask_var_t newmask;
1932	int ret;
1933
1934	if (!zalloc_cpumask_var(&newmask, GFP_KERNEL))
1935		return -ENOMEM;
1936
1937	ret = cpulist_parse(buffer, newmask);
1938	if (ret)
1939		goto out;
1940
1941	mutex_lock(&ipvs->est_mutex);
1942
1943	if (!ipvs->est_cpulist_valid) {
1944		if (!zalloc_cpumask_var(valp, GFP_KERNEL)) {
1945			ret = -ENOMEM;
1946			goto unlock;
1947		}
1948		ipvs->est_cpulist_valid = 1;
1949	}
1950	cpumask_and(newmask, newmask, &current->cpus_mask);
1951	cpumask_copy(*valp, newmask);
1952	/* est_max_threads may depend on cpulist size */
1953	ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
1954	ipvs->est_calc_phase = 1;
1955	ip_vs_est_reload_start(ipvs);
1956
1957unlock:
1958	mutex_unlock(&ipvs->est_mutex);
1959
1960out:
1961	free_cpumask_var(newmask);
1962	return ret;
1963}
1964
1965static int ipvs_proc_est_cpumask_get(const struct ctl_table *table,
1966				     void *buffer, size_t size)
1967{
1968	struct netns_ipvs *ipvs = table->extra2;
1969	cpumask_var_t *valp = table->data;
1970	struct cpumask *mask;
1971	int ret;
1972
1973	mutex_lock(&ipvs->est_mutex);
1974
1975	if (ipvs->est_cpulist_valid)
1976		mask = *valp;
1977	else
1978		mask = (struct cpumask *)housekeeping_cpumask(HK_TYPE_KTHREAD);
1979	ret = scnprintf(buffer, size, "%*pbl\n", cpumask_pr_args(mask));
1980
1981	mutex_unlock(&ipvs->est_mutex);
1982
1983	return ret;
1984}
1985
1986static int ipvs_proc_est_cpulist(const struct ctl_table *table, int write,
1987				 void *buffer, size_t *lenp, loff_t *ppos)
1988{
1989	int ret;
1990
1991	/* Ignore both read and write(append) if *ppos not 0 */
1992	if (*ppos || !*lenp) {
1993		*lenp = 0;
1994		return 0;
1995	}
1996	if (write) {
1997		/* proc_sys_call_handler() appends terminator */
1998		ret = ipvs_proc_est_cpumask_set(table, buffer);
1999		if (ret >= 0)
2000			*ppos += *lenp;
2001	} else {
2002		/* proc_sys_call_handler() allocates 1 byte for terminator */
2003		ret = ipvs_proc_est_cpumask_get(table, buffer, *lenp + 1);
2004		if (ret >= 0) {
2005			*lenp = ret;
2006			*ppos += *lenp;
2007			ret = 0;
2008		}
2009	}
2010	return ret;
2011}
2012
2013static int ipvs_proc_est_nice(const struct ctl_table *table, int write,
2014			      void *buffer, size_t *lenp, loff_t *ppos)
2015{
2016	struct netns_ipvs *ipvs = table->extra2;
2017	int *valp = table->data;
2018	int val = *valp;
2019	int ret;
2020
2021	struct ctl_table tmp_table = {
2022		.data = &val,
2023		.maxlen = sizeof(int),
2024		.mode = table->mode,
2025	};
2026
2027	ret = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);
2028	if (write && ret >= 0) {
2029		if (val < MIN_NICE || val > MAX_NICE) {
2030			ret = -EINVAL;
2031		} else {
2032			mutex_lock(&ipvs->est_mutex);
2033			if (*valp != val) {
2034				*valp = val;
2035				ip_vs_est_reload_start(ipvs);
2036			}
2037			mutex_unlock(&ipvs->est_mutex);
2038		}
2039	}
2040	return ret;
2041}
2042
2043static int ipvs_proc_run_estimation(const struct ctl_table *table, int write,
2044				    void *buffer, size_t *lenp, loff_t *ppos)
2045{
2046	struct netns_ipvs *ipvs = table->extra2;
2047	int *valp = table->data;
2048	int val = *valp;
2049	int ret;
2050
2051	struct ctl_table tmp_table = {
2052		.data = &val,
2053		.maxlen = sizeof(int),
2054		.mode = table->mode,
2055	};
2056
2057	ret = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);
2058	if (write && ret >= 0) {
2059		mutex_lock(&ipvs->est_mutex);
2060		if (*valp != val) {
2061			*valp = val;
2062			ip_vs_est_reload_start(ipvs);
2063		}
2064		mutex_unlock(&ipvs->est_mutex);
2065	}
2066	return ret;
2067}
2068
2069/*
2070 *	IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
2071 *	Do not change order or insert new entries without
2072 *	align with netns init in ip_vs_control_net_init()
2073 */
2074
2075static struct ctl_table vs_vars[] = {
2076	{
2077		.procname	= "amemthresh",
2078		.maxlen		= sizeof(int),
2079		.mode		= 0644,
2080		.proc_handler	= proc_dointvec,
2081	},
2082	{
2083		.procname	= "am_droprate",
2084		.maxlen		= sizeof(int),
2085		.mode		= 0644,
2086		.proc_handler	= proc_dointvec,
2087	},
2088	{
2089		.procname	= "drop_entry",
2090		.maxlen		= sizeof(int),
2091		.mode		= 0644,
2092		.proc_handler	= proc_do_defense_mode,
2093	},
2094	{
2095		.procname	= "drop_packet",
2096		.maxlen		= sizeof(int),
2097		.mode		= 0644,
2098		.proc_handler	= proc_do_defense_mode,
2099	},
2100#ifdef CONFIG_IP_VS_NFCT
2101	{
2102		.procname	= "conntrack",
2103		.maxlen		= sizeof(int),
2104		.mode		= 0644,
2105		.proc_handler	= &proc_dointvec,
2106	},
2107#endif
2108	{
2109		.procname	= "secure_tcp",
2110		.maxlen		= sizeof(int),
2111		.mode		= 0644,
2112		.proc_handler	= proc_do_defense_mode,
2113	},
2114	{
2115		.procname	= "snat_reroute",
2116		.maxlen		= sizeof(int),
2117		.mode		= 0644,
2118		.proc_handler	= &proc_dointvec,
2119	},
2120	{
2121		.procname	= "sync_version",
2122		.maxlen		= sizeof(int),
2123		.mode		= 0644,
2124		.proc_handler	= proc_dointvec_minmax,
2125		.extra1		= SYSCTL_ZERO,
2126		.extra2		= SYSCTL_ONE,
2127	},
2128	{
2129		.procname	= "sync_ports",
2130		.maxlen		= sizeof(int),
2131		.mode		= 0644,
2132		.proc_handler	= proc_do_sync_ports,
2133	},
2134	{
2135		.procname	= "sync_persist_mode",
2136		.maxlen		= sizeof(int),
2137		.mode		= 0644,
2138		.proc_handler	= proc_dointvec,
2139	},
2140	{
2141		.procname	= "sync_qlen_max",
2142		.maxlen		= sizeof(unsigned long),
2143		.mode		= 0644,
2144		.proc_handler	= proc_doulongvec_minmax,
2145	},
2146	{
2147		.procname	= "sync_sock_size",
2148		.maxlen		= sizeof(int),
2149		.mode		= 0644,
2150		.proc_handler	= proc_dointvec,
2151	},
2152	{
2153		.procname	= "cache_bypass",
2154		.maxlen		= sizeof(int),
2155		.mode		= 0644,
2156		.proc_handler	= proc_dointvec,
2157	},
2158	{
2159		.procname	= "expire_nodest_conn",
2160		.maxlen		= sizeof(int),
2161		.mode		= 0644,
2162		.proc_handler	= proc_dointvec,
2163	},
2164	{
2165		.procname	= "sloppy_tcp",
2166		.maxlen		= sizeof(int),
2167		.mode		= 0644,
2168		.proc_handler	= proc_dointvec,
2169	},
2170	{
2171		.procname	= "sloppy_sctp",
2172		.maxlen		= sizeof(int),
2173		.mode		= 0644,
2174		.proc_handler	= proc_dointvec,
2175	},
2176	{
2177		.procname	= "expire_quiescent_template",
2178		.maxlen		= sizeof(int),
2179		.mode		= 0644,
2180		.proc_handler	= proc_dointvec,
2181	},
2182	{
2183		.procname	= "sync_threshold",
2184		.maxlen		=
2185			sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
2186		.mode		= 0644,
2187		.proc_handler	= proc_do_sync_threshold,
2188	},
2189	{
2190		.procname	= "sync_refresh_period",
2191		.maxlen		= sizeof(int),
2192		.mode		= 0644,
2193		.proc_handler	= proc_dointvec_jiffies,
2194	},
2195	{
2196		.procname	= "sync_retries",
2197		.maxlen		= sizeof(int),
2198		.mode		= 0644,
2199		.proc_handler	= proc_dointvec_minmax,
2200		.extra1		= SYSCTL_ZERO,
2201		.extra2		= SYSCTL_THREE,
2202	},
2203	{
2204		.procname	= "nat_icmp_send",
2205		.maxlen		= sizeof(int),
2206		.mode		= 0644,
2207		.proc_handler	= proc_dointvec,
2208	},
2209	{
2210		.procname	= "pmtu_disc",
2211		.maxlen		= sizeof(int),
2212		.mode		= 0644,
2213		.proc_handler	= proc_dointvec,
2214	},
2215	{
2216		.procname	= "backup_only",
2217		.maxlen		= sizeof(int),
2218		.mode		= 0644,
2219		.proc_handler	= proc_dointvec,
2220	},
2221	{
2222		.procname	= "conn_reuse_mode",
2223		.maxlen		= sizeof(int),
2224		.mode		= 0644,
2225		.proc_handler	= proc_dointvec,
2226	},
2227	{
2228		.procname	= "schedule_icmp",
2229		.maxlen		= sizeof(int),
2230		.mode		= 0644,
2231		.proc_handler	= proc_dointvec,
2232	},
2233	{
2234		.procname	= "ignore_tunneled",
2235		.maxlen		= sizeof(int),
2236		.mode		= 0644,
2237		.proc_handler	= proc_dointvec,
2238	},
2239	{
2240		.procname	= "run_estimation",
2241		.maxlen		= sizeof(int),
2242		.mode		= 0644,
2243		.proc_handler	= ipvs_proc_run_estimation,
2244	},
2245	{
2246		.procname	= "est_cpulist",
2247		.maxlen		= NR_CPUS,	/* unused */
2248		.mode		= 0644,
2249		.proc_handler	= ipvs_proc_est_cpulist,
2250	},
2251	{
2252		.procname	= "est_nice",
2253		.maxlen		= sizeof(int),
2254		.mode		= 0644,
2255		.proc_handler	= ipvs_proc_est_nice,
2256	},
2257#ifdef CONFIG_IP_VS_DEBUG
2258	{
2259		.procname	= "debug_level",
2260		.data		= &sysctl_ip_vs_debug_level,
2261		.maxlen		= sizeof(int),
2262		.mode		= 0644,
2263		.proc_handler	= proc_dointvec,
2264	},
2265#endif
2266};
2267
2268#endif
2269
2270#ifdef CONFIG_PROC_FS
2271
2272struct ip_vs_iter {
2273	struct seq_net_private p;  /* Do not move this, netns depends upon it*/
2274	struct hlist_head *table;
2275	int bucket;
2276};
2277
2278/*
2279 *	Write the contents of the VS rule table to a PROCfs file.
2280 *	(It is kept just for backward compatibility)
2281 */
2282static inline const char *ip_vs_fwd_name(unsigned int flags)
2283{
2284	switch (flags & IP_VS_CONN_F_FWD_MASK) {
2285	case IP_VS_CONN_F_LOCALNODE:
2286		return "Local";
2287	case IP_VS_CONN_F_TUNNEL:
2288		return "Tunnel";
2289	case IP_VS_CONN_F_DROUTE:
2290		return "Route";
2291	default:
2292		return "Masq";
2293	}
2294}
2295
2296
2297/* Get the Nth entry in the two lists */
2298static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
2299{
2300	struct net *net = seq_file_net(seq);
2301	struct netns_ipvs *ipvs = net_ipvs(net);
2302	struct ip_vs_iter *iter = seq->private;
2303	int idx;
2304	struct ip_vs_service *svc;
2305
2306	/* look in hash by protocol */
2307	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2308		hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[idx], s_list) {
2309			if ((svc->ipvs == ipvs) && pos-- == 0) {
2310				iter->table = ip_vs_svc_table;
2311				iter->bucket = idx;
2312				return svc;
2313			}
2314		}
2315	}
2316
2317	/* keep looking in fwmark */
2318	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2319		hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[idx],
2320					 f_list) {
2321			if ((svc->ipvs == ipvs) && pos-- == 0) {
2322				iter->table = ip_vs_svc_fwm_table;
2323				iter->bucket = idx;
2324				return svc;
2325			}
2326		}
2327	}
2328
2329	return NULL;
2330}
2331
2332static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
2333	__acquires(RCU)
2334{
2335	rcu_read_lock();
2336	return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
2337}
2338
2339
2340static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2341{
2342	struct hlist_node *e;
2343	struct ip_vs_iter *iter;
2344	struct ip_vs_service *svc;
2345
2346	++*pos;
2347	if (v == SEQ_START_TOKEN)
2348		return ip_vs_info_array(seq,0);
2349
2350	svc = v;
2351	iter = seq->private;
2352
2353	if (iter->table == ip_vs_svc_table) {
2354		/* next service in table hashed by protocol */
2355		e = rcu_dereference(hlist_next_rcu(&svc->s_list));
2356		if (e)
2357			return hlist_entry(e, struct ip_vs_service, s_list);
2358
2359		while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2360			hlist_for_each_entry_rcu(svc,
2361						 &ip_vs_svc_table[iter->bucket],
2362						 s_list) {
2363				return svc;
2364			}
2365		}
2366
2367		iter->table = ip_vs_svc_fwm_table;
2368		iter->bucket = -1;
2369		goto scan_fwmark;
2370	}
2371
2372	/* next service in hashed by fwmark */
2373	e = rcu_dereference(hlist_next_rcu(&svc->f_list));
2374	if (e)
2375		return hlist_entry(e, struct ip_vs_service, f_list);
2376
2377 scan_fwmark:
2378	while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
2379		hlist_for_each_entry_rcu(svc,
2380					 &ip_vs_svc_fwm_table[iter->bucket],
2381					 f_list)
2382			return svc;
2383	}
2384
2385	return NULL;
2386}
2387
2388static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
2389	__releases(RCU)
2390{
2391	rcu_read_unlock();
2392}
2393
2394
2395static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
2396{
2397	if (v == SEQ_START_TOKEN) {
2398		seq_printf(seq,
2399			"IP Virtual Server version %d.%d.%d (size=%d)\n",
2400			NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2401		seq_puts(seq,
2402			 "Prot LocalAddress:Port Scheduler Flags\n");
2403		seq_puts(seq,
2404			 "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
2405	} else {
2406		struct net *net = seq_file_net(seq);
2407		struct netns_ipvs *ipvs = net_ipvs(net);
2408		const struct ip_vs_service *svc = v;
2409		const struct ip_vs_iter *iter = seq->private;
2410		const struct ip_vs_dest *dest;
2411		struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
2412		char *sched_name = sched ? sched->name : "none";
2413
2414		if (svc->ipvs != ipvs)
2415			return 0;
2416		if (iter->table == ip_vs_svc_table) {
2417#ifdef CONFIG_IP_VS_IPV6
2418			if (svc->af == AF_INET6)
2419				seq_printf(seq, "%s  [%pI6]:%04X %s ",
2420					   ip_vs_proto_name(svc->protocol),
2421					   &svc->addr.in6,
2422					   ntohs(svc->port),
2423					   sched_name);
2424			else
2425#endif
2426				seq_printf(seq, "%s  %08X:%04X %s %s ",
2427					   ip_vs_proto_name(svc->protocol),
2428					   ntohl(svc->addr.ip),
2429					   ntohs(svc->port),
2430					   sched_name,
2431					   (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2432		} else {
2433			seq_printf(seq, "FWM  %08X %s %s",
2434				   svc->fwmark, sched_name,
2435				   (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2436		}
2437
2438		if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2439			seq_printf(seq, "persistent %d %08X\n",
2440				svc->timeout,
2441				ntohl(svc->netmask));
2442		else
2443			seq_putc(seq, '\n');
2444
2445		list_for_each_entry_rcu(dest, &svc->destinations, n_list) {
2446#ifdef CONFIG_IP_VS_IPV6
2447			if (dest->af == AF_INET6)
2448				seq_printf(seq,
2449					   "  -> [%pI6]:%04X"
2450					   "      %-7s %-6d %-10d %-10d\n",
2451					   &dest->addr.in6,
2452					   ntohs(dest->port),
2453					   ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2454					   atomic_read(&dest->weight),
2455					   atomic_read(&dest->activeconns),
2456					   atomic_read(&dest->inactconns));
2457			else
2458#endif
2459				seq_printf(seq,
2460					   "  -> %08X:%04X      "
2461					   "%-7s %-6d %-10d %-10d\n",
2462					   ntohl(dest->addr.ip),
2463					   ntohs(dest->port),
2464					   ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2465					   atomic_read(&dest->weight),
2466					   atomic_read(&dest->activeconns),
2467					   atomic_read(&dest->inactconns));
2468
2469		}
2470	}
2471	return 0;
2472}
2473
2474static const struct seq_operations ip_vs_info_seq_ops = {
2475	.start = ip_vs_info_seq_start,
2476	.next  = ip_vs_info_seq_next,
2477	.stop  = ip_vs_info_seq_stop,
2478	.show  = ip_vs_info_seq_show,
2479};
2480
2481static int ip_vs_stats_show(struct seq_file *seq, void *v)
2482{
2483	struct net *net = seq_file_single_net(seq);
2484	struct ip_vs_kstats show;
2485
2486/*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2487	seq_puts(seq,
2488		 "   Total Incoming Outgoing         Incoming         Outgoing\n");
2489	seq_puts(seq,
2490		 "   Conns  Packets  Packets            Bytes            Bytes\n");
2491
2492	ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats->s);
2493	seq_printf(seq, "%8LX %8LX %8LX %16LX %16LX\n\n",
2494		   (unsigned long long)show.conns,
2495		   (unsigned long long)show.inpkts,
2496		   (unsigned long long)show.outpkts,
2497		   (unsigned long long)show.inbytes,
2498		   (unsigned long long)show.outbytes);
2499
2500/*                01234567 01234567 01234567 0123456701234567 0123456701234567*/
2501	seq_puts(seq,
2502		 " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2503	seq_printf(seq, "%8LX %8LX %8LX %16LX %16LX\n",
2504		   (unsigned long long)show.cps,
2505		   (unsigned long long)show.inpps,
2506		   (unsigned long long)show.outpps,
2507		   (unsigned long long)show.inbps,
2508		   (unsigned long long)show.outbps);
2509
2510	return 0;
2511}
2512
2513static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2514{
2515	struct net *net = seq_file_single_net(seq);
2516	struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats->s;
2517	struct ip_vs_cpu_stats __percpu *cpustats = tot_stats->cpustats;
2518	struct ip_vs_kstats kstats;
2519	int i;
2520
2521/*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2522	seq_puts(seq,
2523		 "       Total Incoming Outgoing         Incoming         Outgoing\n");
2524	seq_puts(seq,
2525		 "CPU    Conns  Packets  Packets            Bytes            Bytes\n");
2526
2527	for_each_possible_cpu(i) {
2528		struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2529		unsigned int start;
2530		u64 conns, inpkts, outpkts, inbytes, outbytes;
2531
2532		do {
2533			start = u64_stats_fetch_begin(&u->syncp);
2534			conns = u64_stats_read(&u->cnt.conns);
2535			inpkts = u64_stats_read(&u->cnt.inpkts);
2536			outpkts = u64_stats_read(&u->cnt.outpkts);
2537			inbytes = u64_stats_read(&u->cnt.inbytes);
2538			outbytes = u64_stats_read(&u->cnt.outbytes);
2539		} while (u64_stats_fetch_retry(&u->syncp, start));
2540
2541		seq_printf(seq, "%3X %8LX %8LX %8LX %16LX %16LX\n",
2542			   i, (u64)conns, (u64)inpkts,
2543			   (u64)outpkts, (u64)inbytes,
2544			   (u64)outbytes);
2545	}
2546
2547	ip_vs_copy_stats(&kstats, tot_stats);
2548
2549	seq_printf(seq, "  ~ %8LX %8LX %8LX %16LX %16LX\n\n",
2550		   (unsigned long long)kstats.conns,
2551		   (unsigned long long)kstats.inpkts,
2552		   (unsigned long long)kstats.outpkts,
2553		   (unsigned long long)kstats.inbytes,
2554		   (unsigned long long)kstats.outbytes);
2555
2556/*                ... 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2557	seq_puts(seq,
2558		 "     Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2559	seq_printf(seq, "    %8LX %8LX %8LX %16LX %16LX\n",
2560		   kstats.cps,
2561		   kstats.inpps,
2562		   kstats.outpps,
2563		   kstats.inbps,
2564		   kstats.outbps);
2565
2566	return 0;
2567}
2568#endif
2569
2570/*
2571 *	Set timeout values for tcp tcpfin udp in the timeout_table.
2572 */
2573static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user *u)
2574{
2575#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2576	struct ip_vs_proto_data *pd;
2577#endif
2578
2579	IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2580		  u->tcp_timeout,
2581		  u->tcp_fin_timeout,
2582		  u->udp_timeout);
2583
2584#ifdef CONFIG_IP_VS_PROTO_TCP
2585	if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) ||
2586	    u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) {
2587		return -EINVAL;
2588	}
2589#endif
2590
2591#ifdef CONFIG_IP_VS_PROTO_UDP
2592	if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ))
2593		return -EINVAL;
2594#endif
2595
2596#ifdef CONFIG_IP_VS_PROTO_TCP
2597	if (u->tcp_timeout) {
2598		pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
2599		pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2600			= u->tcp_timeout * HZ;
2601	}
2602
2603	if (u->tcp_fin_timeout) {
2604		pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
2605		pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2606			= u->tcp_fin_timeout * HZ;
2607	}
2608#endif
2609
2610#ifdef CONFIG_IP_VS_PROTO_UDP
2611	if (u->udp_timeout) {
2612		pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
2613		pd->timeout_table[IP_VS_UDP_S_NORMAL]
2614			= u->udp_timeout * HZ;
2615	}
2616#endif
2617	return 0;
2618}
2619
2620#define CMDID(cmd)		(cmd - IP_VS_BASE_CTL)
2621
2622struct ip_vs_svcdest_user {
2623	struct ip_vs_service_user	s;
2624	struct ip_vs_dest_user		d;
2625};
2626
2627static const unsigned char set_arglen[CMDID(IP_VS_SO_SET_MAX) + 1] = {
2628	[CMDID(IP_VS_SO_SET_ADD)]         = sizeof(struct ip_vs_service_user),
2629	[CMDID(IP_VS_SO_SET_EDIT)]        = sizeof(struct ip_vs_service_user),
2630	[CMDID(IP_VS_SO_SET_DEL)]         = sizeof(struct ip_vs_service_user),
2631	[CMDID(IP_VS_SO_SET_ADDDEST)]     = sizeof(struct ip_vs_svcdest_user),
2632	[CMDID(IP_VS_SO_SET_DELDEST)]     = sizeof(struct ip_vs_svcdest_user),
2633	[CMDID(IP_VS_SO_SET_EDITDEST)]    = sizeof(struct ip_vs_svcdest_user),
2634	[CMDID(IP_VS_SO_SET_TIMEOUT)]     = sizeof(struct ip_vs_timeout_user),
2635	[CMDID(IP_VS_SO_SET_STARTDAEMON)] = sizeof(struct ip_vs_daemon_user),
2636	[CMDID(IP_VS_SO_SET_STOPDAEMON)]  = sizeof(struct ip_vs_daemon_user),
2637	[CMDID(IP_VS_SO_SET_ZERO)]        = sizeof(struct ip_vs_service_user),
2638};
2639
2640union ip_vs_set_arglen {
2641	struct ip_vs_service_user	field_IP_VS_SO_SET_ADD;
2642	struct ip_vs_service_user	field_IP_VS_SO_SET_EDIT;
2643	struct ip_vs_service_user	field_IP_VS_SO_SET_DEL;
2644	struct ip_vs_svcdest_user	field_IP_VS_SO_SET_ADDDEST;
2645	struct ip_vs_svcdest_user	field_IP_VS_SO_SET_DELDEST;
2646	struct ip_vs_svcdest_user	field_IP_VS_SO_SET_EDITDEST;
2647	struct ip_vs_timeout_user	field_IP_VS_SO_SET_TIMEOUT;
2648	struct ip_vs_daemon_user	field_IP_VS_SO_SET_STARTDAEMON;
2649	struct ip_vs_daemon_user	field_IP_VS_SO_SET_STOPDAEMON;
2650	struct ip_vs_service_user	field_IP_VS_SO_SET_ZERO;
2651};
2652
2653#define MAX_SET_ARGLEN	sizeof(union ip_vs_set_arglen)
2654
2655static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2656				  struct ip_vs_service_user *usvc_compat)
2657{
2658	memset(usvc, 0, sizeof(*usvc));
2659
2660	usvc->af		= AF_INET;
2661	usvc->protocol		= usvc_compat->protocol;
2662	usvc->addr.ip		= usvc_compat->addr;
2663	usvc->port		= usvc_compat->port;
2664	usvc->fwmark		= usvc_compat->fwmark;
2665
2666	/* Deep copy of sched_name is not needed here */
2667	usvc->sched_name	= usvc_compat->sched_name;
2668
2669	usvc->flags		= usvc_compat->flags;
2670	usvc->timeout		= usvc_compat->timeout;
2671	usvc->netmask		= usvc_compat->netmask;
2672}
2673
2674static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2675				   struct ip_vs_dest_user *udest_compat)
2676{
2677	memset(udest, 0, sizeof(*udest));
2678
2679	udest->addr.ip		= udest_compat->addr;
2680	udest->port		= udest_compat->port;
2681	udest->conn_flags	= udest_compat->conn_flags;
2682	udest->weight		= udest_compat->weight;
2683	udest->u_threshold	= udest_compat->u_threshold;
2684	udest->l_threshold	= udest_compat->l_threshold;
2685	udest->af		= AF_INET;
2686	udest->tun_type		= IP_VS_CONN_F_TUNNEL_TYPE_IPIP;
2687}
2688
2689static int
2690do_ip_vs_set_ctl(struct sock *sk, int cmd, sockptr_t ptr, unsigned int len)
2691{
2692	struct net *net = sock_net(sk);
2693	int ret;
2694	unsigned char arg[MAX_SET_ARGLEN];
2695	struct ip_vs_service_user *usvc_compat;
2696	struct ip_vs_service_user_kern usvc;
2697	struct ip_vs_service *svc;
2698	struct ip_vs_dest_user *udest_compat;
2699	struct ip_vs_dest_user_kern udest;
2700	struct netns_ipvs *ipvs = net_ipvs(net);
2701
2702	BUILD_BUG_ON(sizeof(arg) > 255);
2703	if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2704		return -EPERM;
2705
2706	if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2707		return -EINVAL;
2708	if (len != set_arglen[CMDID(cmd)]) {
2709		IP_VS_DBG(1, "set_ctl: len %u != %u\n",
2710			  len, set_arglen[CMDID(cmd)]);
2711		return -EINVAL;
2712	}
2713
2714	if (copy_from_sockptr(arg, ptr, len) != 0)
2715		return -EFAULT;
2716
2717	/* Handle daemons since they have another lock */
2718	if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2719	    cmd == IP_VS_SO_SET_STOPDAEMON) {
2720		struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2721
2722		if (cmd == IP_VS_SO_SET_STARTDAEMON) {
2723			struct ipvs_sync_daemon_cfg cfg;
2724
2725			memset(&cfg, 0, sizeof(cfg));
2726			ret = -EINVAL;
2727			if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
2728				    sizeof(cfg.mcast_ifn)) <= 0)
2729				return ret;
2730			cfg.syncid = dm->syncid;
2731			ret = start_sync_thread(ipvs, &cfg, dm->state);
2732		} else {
2733			ret = stop_sync_thread(ipvs, dm->state);
2734		}
2735		return ret;
2736	}
2737
2738	mutex_lock(&__ip_vs_mutex);
2739	if (cmd == IP_VS_SO_SET_FLUSH) {
2740		/* Flush the virtual service */
2741		ret = ip_vs_flush(ipvs, false);
2742		goto out_unlock;
2743	} else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2744		/* Set timeout values for (tcp tcpfin udp) */
2745		ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
2746		goto out_unlock;
2747	} else if (!len) {
2748		/* No more commands with len == 0 below */
2749		ret = -EINVAL;
2750		goto out_unlock;
2751	}
2752
2753	usvc_compat = (struct ip_vs_service_user *)arg;
2754	udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2755
2756	/* We only use the new structs internally, so copy userspace compat
2757	 * structs to extended internal versions */
2758	ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2759	ip_vs_copy_udest_compat(&udest, udest_compat);
2760
2761	if (cmd == IP_VS_SO_SET_ZERO) {
2762		/* if no service address is set, zero counters in all */
2763		if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2764			ret = ip_vs_zero_all(ipvs);
2765			goto out_unlock;
2766		}
2767	}
2768
2769	if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) &&
2770	    strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) ==
2771	    IP_VS_SCHEDNAME_MAXLEN) {
2772		ret = -EINVAL;
2773		goto out_unlock;
2774	}
2775
2776	/* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2777	if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2778	    usvc.protocol != IPPROTO_SCTP) {
2779		pr_err("set_ctl: invalid protocol: %d %pI4:%d\n",
2780		       usvc.protocol, &usvc.addr.ip,
2781		       ntohs(usvc.port));
2782		ret = -EFAULT;
2783		goto out_unlock;
2784	}
2785
2786	/* Lookup the exact service by <protocol, addr, port> or fwmark */
2787	rcu_read_lock();
2788	if (usvc.fwmark == 0)
2789		svc = __ip_vs_service_find(ipvs, usvc.af, usvc.protocol,
2790					   &usvc.addr, usvc.port);
2791	else
2792		svc = __ip_vs_svc_fwm_find(ipvs, usvc.af, usvc.fwmark);
2793	rcu_read_unlock();
2794
2795	if (cmd != IP_VS_SO_SET_ADD
2796	    && (svc == NULL || svc->protocol != usvc.protocol)) {
2797		ret = -ESRCH;
2798		goto out_unlock;
2799	}
2800
2801	switch (cmd) {
2802	case IP_VS_SO_SET_ADD:
2803		if (svc != NULL)
2804			ret = -EEXIST;
2805		else
2806			ret = ip_vs_add_service(ipvs, &usvc, &svc);
2807		break;
2808	case IP_VS_SO_SET_EDIT:
2809		ret = ip_vs_edit_service(svc, &usvc);
2810		break;
2811	case IP_VS_SO_SET_DEL:
2812		ret = ip_vs_del_service(svc);
2813		if (!ret)
2814			goto out_unlock;
2815		break;
2816	case IP_VS_SO_SET_ZERO:
2817		ret = ip_vs_zero_service(svc);
2818		break;
2819	case IP_VS_SO_SET_ADDDEST:
2820		ret = ip_vs_add_dest(svc, &udest);
2821		break;
2822	case IP_VS_SO_SET_EDITDEST:
2823		ret = ip_vs_edit_dest(svc, &udest);
2824		break;
2825	case IP_VS_SO_SET_DELDEST:
2826		ret = ip_vs_del_dest(svc, &udest);
2827		break;
2828	default:
2829		WARN_ON_ONCE(1);
2830		ret = -EINVAL;
2831		break;
2832	}
2833
2834  out_unlock:
2835	mutex_unlock(&__ip_vs_mutex);
2836	return ret;
2837}
2838
2839
2840static void
2841ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2842{
2843	struct ip_vs_scheduler *sched;
2844	struct ip_vs_kstats kstats;
2845	char *sched_name;
2846
2847	sched = rcu_dereference_protected(src->scheduler, 1);
2848	sched_name = sched ? sched->name : "none";
2849	dst->protocol = src->protocol;
2850	dst->addr = src->addr.ip;
2851	dst->port = src->port;
2852	dst->fwmark = src->fwmark;
2853	strscpy(dst->sched_name, sched_name, sizeof(dst->sched_name));
2854	dst->flags = src->flags;
2855	dst->timeout = src->timeout / HZ;
2856	dst->netmask = src->netmask;
2857	dst->num_dests = src->num_dests;
2858	ip_vs_copy_stats(&kstats, &src->stats);
2859	ip_vs_export_stats_user(&dst->stats, &kstats);
2860}
2861
2862static inline int
2863__ip_vs_get_service_entries(struct netns_ipvs *ipvs,
2864			    const struct ip_vs_get_services *get,
2865			    struct ip_vs_get_services __user *uptr)
2866{
2867	int idx, count=0;
2868	struct ip_vs_service *svc;
2869	struct ip_vs_service_entry entry;
2870	int ret = 0;
2871
2872	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2873		hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2874			/* Only expose IPv4 entries to old interface */
2875			if (svc->af != AF_INET || (svc->ipvs != ipvs))
2876				continue;
2877
2878			if (count >= get->num_services)
2879				goto out;
2880			memset(&entry, 0, sizeof(entry));
2881			ip_vs_copy_service(&entry, svc);
2882			if (copy_to_user(&uptr->entrytable[count],
2883					 &entry, sizeof(entry))) {
2884				ret = -EFAULT;
2885				goto out;
2886			}
2887			count++;
2888		}
2889	}
2890
2891	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2892		hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2893			/* Only expose IPv4 entries to old interface */
2894			if (svc->af != AF_INET || (svc->ipvs != ipvs))
2895				continue;
2896
2897			if (count >= get->num_services)
2898				goto out;
2899			memset(&entry, 0, sizeof(entry));
2900			ip_vs_copy_service(&entry, svc);
2901			if (copy_to_user(&uptr->entrytable[count],
2902					 &entry, sizeof(entry))) {
2903				ret = -EFAULT;
2904				goto out;
2905			}
2906			count++;
2907		}
2908	}
2909out:
2910	return ret;
2911}
2912
2913static inline int
2914__ip_vs_get_dest_entries(struct netns_ipvs *ipvs, const struct ip_vs_get_dests *get,
2915			 struct ip_vs_get_dests __user *uptr)
2916{
2917	struct ip_vs_service *svc;
2918	union nf_inet_addr addr = { .ip = get->addr };
2919	int ret = 0;
2920
2921	rcu_read_lock();
2922	if (get->fwmark)
2923		svc = __ip_vs_svc_fwm_find(ipvs, AF_INET, get->fwmark);
2924	else
2925		svc = __ip_vs_service_find(ipvs, AF_INET, get->protocol, &addr,
2926					   get->port);
2927	rcu_read_unlock();
2928
2929	if (svc) {
2930		int count = 0;
2931		struct ip_vs_dest *dest;
2932		struct ip_vs_dest_entry entry;
2933		struct ip_vs_kstats kstats;
2934
2935		memset(&entry, 0, sizeof(entry));
2936		list_for_each_entry(dest, &svc->destinations, n_list) {
2937			if (count >= get->num_dests)
2938				break;
2939
2940			/* Cannot expose heterogeneous members via sockopt
2941			 * interface
2942			 */
2943			if (dest->af != svc->af)
2944				continue;
2945
2946			entry.addr = dest->addr.ip;
2947			entry.port = dest->port;
2948			entry.conn_flags = atomic_read(&dest->conn_flags);
2949			entry.weight = atomic_read(&dest->weight);
2950			entry.u_threshold = dest->u_threshold;
2951			entry.l_threshold = dest->l_threshold;
2952			entry.activeconns = atomic_read(&dest->activeconns);
2953			entry.inactconns = atomic_read(&dest->inactconns);
2954			entry.persistconns = atomic_read(&dest->persistconns);
2955			ip_vs_copy_stats(&kstats, &dest->stats);
2956			ip_vs_export_stats_user(&entry.stats, &kstats);
2957			if (copy_to_user(&uptr->entrytable[count],
2958					 &entry, sizeof(entry))) {
2959				ret = -EFAULT;
2960				break;
2961			}
2962			count++;
2963		}
2964	} else
2965		ret = -ESRCH;
2966	return ret;
2967}
2968
2969static inline void
2970__ip_vs_get_timeouts(struct netns_ipvs *ipvs, struct ip_vs_timeout_user *u)
2971{
2972#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2973	struct ip_vs_proto_data *pd;
2974#endif
2975
2976	memset(u, 0, sizeof (*u));
2977
2978#ifdef CONFIG_IP_VS_PROTO_TCP
2979	pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
2980	u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2981	u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2982#endif
2983#ifdef CONFIG_IP_VS_PROTO_UDP
2984	pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP);
2985	u->udp_timeout =
2986			pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2987#endif
2988}
2989
2990static const unsigned char get_arglen[CMDID(IP_VS_SO_GET_MAX) + 1] = {
2991	[CMDID(IP_VS_SO_GET_VERSION)]  = 64,
2992	[CMDID(IP_VS_SO_GET_INFO)]     = sizeof(struct ip_vs_getinfo),
2993	[CMDID(IP_VS_SO_GET_SERVICES)] = sizeof(struct ip_vs_get_services),
2994	[CMDID(IP_VS_SO_GET_SERVICE)]  = sizeof(struct ip_vs_service_entry),
2995	[CMDID(IP_VS_SO_GET_DESTS)]    = sizeof(struct ip_vs_get_dests),
2996	[CMDID(IP_VS_SO_GET_TIMEOUT)]  = sizeof(struct ip_vs_timeout_user),
2997	[CMDID(IP_VS_SO_GET_DAEMON)]   = 2 * sizeof(struct ip_vs_daemon_user),
2998};
2999
3000union ip_vs_get_arglen {
3001	char				field_IP_VS_SO_GET_VERSION[64];
3002	struct ip_vs_getinfo		field_IP_VS_SO_GET_INFO;
3003	struct ip_vs_get_services	field_IP_VS_SO_GET_SERVICES;
3004	struct ip_vs_service_entry	field_IP_VS_SO_GET_SERVICE;
3005	struct ip_vs_get_dests		field_IP_VS_SO_GET_DESTS;
3006	struct ip_vs_timeout_user	field_IP_VS_SO_GET_TIMEOUT;
3007	struct ip_vs_daemon_user	field_IP_VS_SO_GET_DAEMON[2];
3008};
3009
3010#define MAX_GET_ARGLEN	sizeof(union ip_vs_get_arglen)
3011
3012static int
3013do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
3014{
3015	unsigned char arg[MAX_GET_ARGLEN];
3016	int ret = 0;
3017	unsigned int copylen;
3018	struct net *net = sock_net(sk);
3019	struct netns_ipvs *ipvs = net_ipvs(net);
3020
3021	BUG_ON(!net);
3022	BUILD_BUG_ON(sizeof(arg) > 255);
3023	if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
3024		return -EPERM;
3025
3026	if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
3027		return -EINVAL;
3028
3029	copylen = get_arglen[CMDID(cmd)];
3030	if (*len < (int) copylen) {
3031		IP_VS_DBG(1, "get_ctl: len %d < %u\n", *len, copylen);
3032		return -EINVAL;
3033	}
3034
3035	if (copy_from_user(arg, user, copylen) != 0)
3036		return -EFAULT;
3037	/*
3038	 * Handle daemons first since it has its own locking
3039	 */
3040	if (cmd == IP_VS_SO_GET_DAEMON) {
3041		struct ip_vs_daemon_user d[2];
3042
3043		memset(&d, 0, sizeof(d));
3044		mutex_lock(&ipvs->sync_mutex);
3045		if (ipvs->sync_state & IP_VS_STATE_MASTER) {
3046			d[0].state = IP_VS_STATE_MASTER;
3047			strscpy(d[0].mcast_ifn, ipvs->mcfg.mcast_ifn,
3048				sizeof(d[0].mcast_ifn));
3049			d[0].syncid = ipvs->mcfg.syncid;
3050		}
3051		if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
3052			d[1].state = IP_VS_STATE_BACKUP;
3053			strscpy(d[1].mcast_ifn, ipvs->bcfg.mcast_ifn,
3054				sizeof(d[1].mcast_ifn));
3055			d[1].syncid = ipvs->bcfg.syncid;
3056		}
3057		if (copy_to_user(user, &d, sizeof(d)) != 0)
3058			ret = -EFAULT;
3059		mutex_unlock(&ipvs->sync_mutex);
3060		return ret;
3061	}
3062
3063	mutex_lock(&__ip_vs_mutex);
3064	switch (cmd) {
3065	case IP_VS_SO_GET_VERSION:
3066	{
3067		char buf[64];
3068
3069		sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
3070			NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
3071		if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
3072			ret = -EFAULT;
3073			goto out;
3074		}
3075		*len = strlen(buf)+1;
3076	}
3077	break;
3078
3079	case IP_VS_SO_GET_INFO:
3080	{
3081		struct ip_vs_getinfo info;
3082		info.version = IP_VS_VERSION_CODE;
3083		info.size = ip_vs_conn_tab_size;
3084		info.num_services = ipvs->num_services;
3085		if (copy_to_user(user, &info, sizeof(info)) != 0)
3086			ret = -EFAULT;
3087	}
3088	break;
3089
3090	case IP_VS_SO_GET_SERVICES:
3091	{
3092		struct ip_vs_get_services *get;
3093		size_t size;
3094
3095		get = (struct ip_vs_get_services *)arg;
3096		size = struct_size(get, entrytable, get->num_services);
3097		if (*len != size) {
3098			pr_err("length: %u != %zu\n", *len, size);
3099			ret = -EINVAL;
3100			goto out;
3101		}
3102		ret = __ip_vs_get_service_entries(ipvs, get, user);
3103	}
3104	break;
3105
3106	case IP_VS_SO_GET_SERVICE:
3107	{
3108		struct ip_vs_service_entry *entry;
3109		struct ip_vs_service *svc;
3110		union nf_inet_addr addr;
3111
3112		entry = (struct ip_vs_service_entry *)arg;
3113		addr.ip = entry->addr;
3114		rcu_read_lock();
3115		if (entry->fwmark)
3116			svc = __ip_vs_svc_fwm_find(ipvs, AF_INET, entry->fwmark);
3117		else
3118			svc = __ip_vs_service_find(ipvs, AF_INET,
3119						   entry->protocol, &addr,
3120						   entry->port);
3121		rcu_read_unlock();
3122		if (svc) {
3123			ip_vs_copy_service(entry, svc);
3124			if (copy_to_user(user, entry, sizeof(*entry)) != 0)
3125				ret = -EFAULT;
3126		} else
3127			ret = -ESRCH;
3128	}
3129	break;
3130
3131	case IP_VS_SO_GET_DESTS:
3132	{
3133		struct ip_vs_get_dests *get;
3134		size_t size;
3135
3136		get = (struct ip_vs_get_dests *)arg;
3137		size = struct_size(get, entrytable, get->num_dests);
3138		if (*len != size) {
3139			pr_err("length: %u != %zu\n", *len, size);
3140			ret = -EINVAL;
3141			goto out;
3142		}
3143		ret = __ip_vs_get_dest_entries(ipvs, get, user);
3144	}
3145	break;
3146
3147	case IP_VS_SO_GET_TIMEOUT:
3148	{
3149		struct ip_vs_timeout_user t;
3150
3151		__ip_vs_get_timeouts(ipvs, &t);
3152		if (copy_to_user(user, &t, sizeof(t)) != 0)
3153			ret = -EFAULT;
3154	}
3155	break;
3156
3157	default:
3158		ret = -EINVAL;
3159	}
3160
3161out:
3162	mutex_unlock(&__ip_vs_mutex);
3163	return ret;
3164}
3165
3166
3167static struct nf_sockopt_ops ip_vs_sockopts = {
3168	.pf		= PF_INET,
3169	.set_optmin	= IP_VS_BASE_CTL,
3170	.set_optmax	= IP_VS_SO_SET_MAX+1,
3171	.set		= do_ip_vs_set_ctl,
3172	.get_optmin	= IP_VS_BASE_CTL,
3173	.get_optmax	= IP_VS_SO_GET_MAX+1,
3174	.get		= do_ip_vs_get_ctl,
3175	.owner		= THIS_MODULE,
3176};
3177
3178/*
3179 * Generic Netlink interface
3180 */
3181
3182/* IPVS genetlink family */
3183static struct genl_family ip_vs_genl_family;
3184
3185/* Policy used for first-level command attributes */
3186static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
3187	[IPVS_CMD_ATTR_SERVICE]		= { .type = NLA_NESTED },
3188	[IPVS_CMD_ATTR_DEST]		= { .type = NLA_NESTED },
3189	[IPVS_CMD_ATTR_DAEMON]		= { .type = NLA_NESTED },
3190	[IPVS_CMD_ATTR_TIMEOUT_TCP]	= { .type = NLA_U32 },
3191	[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]	= { .type = NLA_U32 },
3192	[IPVS_CMD_ATTR_TIMEOUT_UDP]	= { .type = NLA_U32 },
3193};
3194
3195/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
3196static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
3197	[IPVS_DAEMON_ATTR_STATE]	= { .type = NLA_U32 },
3198	[IPVS_DAEMON_ATTR_MCAST_IFN]	= { .type = NLA_NUL_STRING,
3199					    .len = IP_VS_IFNAME_MAXLEN - 1 },
3200	[IPVS_DAEMON_ATTR_SYNC_ID]	= { .type = NLA_U32 },
3201	[IPVS_DAEMON_ATTR_SYNC_MAXLEN]	= { .type = NLA_U16 },
3202	[IPVS_DAEMON_ATTR_MCAST_GROUP]	= { .type = NLA_U32 },
3203	[IPVS_DAEMON_ATTR_MCAST_GROUP6]	= { .len = sizeof(struct in6_addr) },
3204	[IPVS_DAEMON_ATTR_MCAST_PORT]	= { .type = NLA_U16 },
3205	[IPVS_DAEMON_ATTR_MCAST_TTL]	= { .type = NLA_U8 },
3206};
3207
3208/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
3209static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
3210	[IPVS_SVC_ATTR_AF]		= { .type = NLA_U16 },
3211	[IPVS_SVC_ATTR_PROTOCOL]	= { .type = NLA_U16 },
3212	[IPVS_SVC_ATTR_ADDR]		= { .type = NLA_BINARY,
3213					    .len = sizeof(union nf_inet_addr) },
3214	[IPVS_SVC_ATTR_PORT]		= { .type = NLA_U16 },
3215	[IPVS_SVC_ATTR_FWMARK]		= { .type = NLA_U32 },
3216	[IPVS_SVC_ATTR_SCHED_NAME]	= { .type = NLA_NUL_STRING,
3217					    .len = IP_VS_SCHEDNAME_MAXLEN - 1 },
3218	[IPVS_SVC_ATTR_PE_NAME]		= { .type = NLA_NUL_STRING,
3219					    .len = IP_VS_PENAME_MAXLEN },
3220	[IPVS_SVC_ATTR_FLAGS]		= { .type = NLA_BINARY,
3221					    .len = sizeof(struct ip_vs_flags) },
3222	[IPVS_SVC_ATTR_TIMEOUT]		= { .type = NLA_U32 },
3223	[IPVS_SVC_ATTR_NETMASK]		= { .type = NLA_U32 },
3224	[IPVS_SVC_ATTR_STATS]		= { .type = NLA_NESTED },
3225};
3226
3227/* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
3228static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
3229	[IPVS_DEST_ATTR_ADDR]		= { .type = NLA_BINARY,
3230					    .len = sizeof(union nf_inet_addr) },
3231	[IPVS_DEST_ATTR_PORT]		= { .type = NLA_U16 },
3232	[IPVS_DEST_ATTR_FWD_METHOD]	= { .type = NLA_U32 },
3233	[IPVS_DEST_ATTR_WEIGHT]		= { .type = NLA_U32 },
3234	[IPVS_DEST_ATTR_U_THRESH]	= { .type = NLA_U32 },
3235	[IPVS_DEST_ATTR_L_THRESH]	= { .type = NLA_U32 },
3236	[IPVS_DEST_ATTR_ACTIVE_CONNS]	= { .type = NLA_U32 },
3237	[IPVS_DEST_ATTR_INACT_CONNS]	= { .type = NLA_U32 },
3238	[IPVS_DEST_ATTR_PERSIST_CONNS]	= { .type = NLA_U32 },
3239	[IPVS_DEST_ATTR_STATS]		= { .type = NLA_NESTED },
3240	[IPVS_DEST_ATTR_ADDR_FAMILY]	= { .type = NLA_U16 },
3241	[IPVS_DEST_ATTR_TUN_TYPE]	= { .type = NLA_U8 },
3242	[IPVS_DEST_ATTR_TUN_PORT]	= { .type = NLA_U16 },
3243	[IPVS_DEST_ATTR_TUN_FLAGS]	= { .type = NLA_U16 },
3244};
3245
3246static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
3247				 struct ip_vs_kstats *kstats)
3248{
3249	struct nlattr *nl_stats = nla_nest_start_noflag(skb, container_type);
3250
3251	if (!nl_stats)
3252		return -EMSGSIZE;
3253
3254	if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, (u32)kstats->conns) ||
3255	    nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, (u32)kstats->inpkts) ||
3256	    nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, (u32)kstats->outpkts) ||
3257	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBYTES, kstats->inbytes,
3258			      IPVS_STATS_ATTR_PAD) ||
3259	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBYTES, kstats->outbytes,
3260			      IPVS_STATS_ATTR_PAD) ||
3261	    nla_put_u32(skb, IPVS_STATS_ATTR_CPS, (u32)kstats->cps) ||
3262	    nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, (u32)kstats->inpps) ||
3263	    nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, (u32)kstats->outpps) ||
3264	    nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, (u32)kstats->inbps) ||
3265	    nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, (u32)kstats->outbps))
3266		goto nla_put_failure;
3267	nla_nest_end(skb, nl_stats);
3268
3269	return 0;
3270
3271nla_put_failure:
3272	nla_nest_cancel(skb, nl_stats);
3273	return -EMSGSIZE;
3274}
3275
3276static int ip_vs_genl_fill_stats64(struct sk_buff *skb, int container_type,
3277				   struct ip_vs_kstats *kstats)
3278{
3279	struct nlattr *nl_stats = nla_nest_start_noflag(skb, container_type);
3280
3281	if (!nl_stats)
3282		return -EMSGSIZE;
3283
3284	if (nla_put_u64_64bit(skb, IPVS_STATS_ATTR_CONNS, kstats->conns,
3285			      IPVS_STATS_ATTR_PAD) ||
3286	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INPKTS, kstats->inpkts,
3287			      IPVS_STATS_ATTR_PAD) ||
3288	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTPKTS, kstats->outpkts,
3289			      IPVS_STATS_ATTR_PAD) ||
3290	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBYTES, kstats->inbytes,
3291			      IPVS_STATS_ATTR_PAD) ||
3292	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBYTES, kstats->outbytes,
3293			      IPVS_STATS_ATTR_PAD) ||
3294	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_CPS, kstats->cps,
3295			      IPVS_STATS_ATTR_PAD) ||
3296	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INPPS, kstats->inpps,
3297			      IPVS_STATS_ATTR_PAD) ||
3298	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTPPS, kstats->outpps,
3299			      IPVS_STATS_ATTR_PAD) ||
3300	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBPS, kstats->inbps,
3301			      IPVS_STATS_ATTR_PAD) ||
3302	    nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBPS, kstats->outbps,
3303			      IPVS_STATS_ATTR_PAD))
3304		goto nla_put_failure;
3305	nla_nest_end(skb, nl_stats);
3306
3307	return 0;
3308
3309nla_put_failure:
3310	nla_nest_cancel(skb, nl_stats);
3311	return -EMSGSIZE;
3312}
3313
3314static int ip_vs_genl_fill_service(struct sk_buff *skb,
3315				   struct ip_vs_service *svc)
3316{
3317	struct ip_vs_scheduler *sched;
3318	struct ip_vs_pe *pe;
3319	struct nlattr *nl_service;
3320	struct ip_vs_flags flags = { .flags = svc->flags,
3321				     .mask = ~0 };
3322	struct ip_vs_kstats kstats;
3323	char *sched_name;
3324
3325	nl_service = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_SERVICE);
3326	if (!nl_service)
3327		return -EMSGSIZE;
3328
3329	if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af))
3330		goto nla_put_failure;
3331	if (svc->fwmark) {
3332		if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark))
3333			goto nla_put_failure;
3334	} else {
3335		if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) ||
3336		    nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) ||
3337		    nla_put_be16(skb, IPVS_SVC_ATTR_PORT, svc->port))
3338			goto nla_put_failure;
3339	}
3340
3341	sched = rcu_dereference_protected(svc->scheduler, 1);
3342	sched_name = sched ? sched->name : "none";
3343	pe = rcu_dereference_protected(svc->pe, 1);
3344	if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||
3345	    (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
3346	    nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
3347	    nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
3348	    nla_put_be32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask))
3349		goto nla_put_failure;
3350	ip_vs_copy_stats(&kstats, &svc->stats);
3351	if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &kstats))
3352		goto nla_put_failure;
3353	if (ip_vs_genl_fill_stats64(skb, IPVS_SVC_ATTR_STATS64, &kstats))
3354		goto nla_put_failure;
3355
3356	nla_nest_end(skb, nl_service);
3357
3358	return 0;
3359
3360nla_put_failure:
3361	nla_nest_cancel(skb, nl_service);
3362	return -EMSGSIZE;
3363}
3364
3365static int ip_vs_genl_dump_service(struct sk_buff *skb,
3366				   struct ip_vs_service *svc,
3367				   struct netlink_callback *cb)
3368{
3369	void *hdr;
3370
3371	hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3372			  &ip_vs_genl_family, NLM_F_MULTI,
3373			  IPVS_CMD_NEW_SERVICE);
3374	if (!hdr)
3375		return -EMSGSIZE;
3376
3377	if (ip_vs_genl_fill_service(skb, svc) < 0)
3378		goto nla_put_failure;
3379
3380	genlmsg_end(skb, hdr);
3381	return 0;
3382
3383nla_put_failure:
3384	genlmsg_cancel(skb, hdr);
3385	return -EMSGSIZE;
3386}
3387
3388static int ip_vs_genl_dump_services(struct sk_buff *skb,
3389				    struct netlink_callback *cb)
3390{
3391	int idx = 0, i;
3392	int start = cb->args[0];
3393	struct ip_vs_service *svc;
3394	struct net *net = sock_net(skb->sk);
3395	struct netns_ipvs *ipvs = net_ipvs(net);
3396
3397	mutex_lock(&__ip_vs_mutex);
3398	for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
3399		hlist_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
3400			if (++idx <= start || (svc->ipvs != ipvs))
3401				continue;
3402			if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
3403				idx--;
3404				goto nla_put_failure;
3405			}
3406		}
3407	}
3408
3409	for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
3410		hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
3411			if (++idx <= start || (svc->ipvs != ipvs))
3412				continue;
3413			if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
3414				idx--;
3415				goto nla_put_failure;
3416			}
3417		}
3418	}
3419
3420nla_put_failure:
3421	mutex_unlock(&__ip_vs_mutex);
3422	cb->args[0] = idx;
3423
3424	return skb->len;
3425}
3426
3427static bool ip_vs_is_af_valid(int af)
3428{
3429	if (af == AF_INET)
3430		return true;
3431#ifdef CONFIG_IP_VS_IPV6
3432	if (af == AF_INET6 && ipv6_mod_enabled())
3433		return true;
3434#endif
3435	return false;
3436}
3437
3438static int ip_vs_genl_parse_service(struct netns_ipvs *ipvs,
3439				    struct ip_vs_service_user_kern *usvc,
3440				    struct nlattr *nla, bool full_entry,
3441				    struct ip_vs_service **ret_svc)
3442{
3443	struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
3444	struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
3445	struct ip_vs_service *svc;
3446
3447	/* Parse mandatory identifying service fields first */
3448	if (nla == NULL ||
3449	    nla_parse_nested_deprecated(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy, NULL))
3450		return -EINVAL;
3451
3452	nla_af		= attrs[IPVS_SVC_ATTR_AF];
3453	nla_protocol	= attrs[IPVS_SVC_ATTR_PROTOCOL];
3454	nla_addr	= attrs[IPVS_SVC_ATTR_ADDR];
3455	nla_port	= attrs[IPVS_SVC_ATTR_PORT];
3456	nla_fwmark	= attrs[IPVS_SVC_ATTR_FWMARK];
3457
3458	if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
3459		return -EINVAL;
3460
3461	memset(usvc, 0, sizeof(*usvc));
3462
3463	usvc->af = nla_get_u16(nla_af);
3464	if (!ip_vs_is_af_valid(usvc->af))
3465		return -EAFNOSUPPORT;
3466
3467	if (nla_fwmark) {
3468		usvc->protocol = IPPROTO_TCP;
3469		usvc->fwmark = nla_get_u32(nla_fwmark);
3470	} else {
3471		usvc->protocol = nla_get_u16(nla_protocol);
3472		nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
3473		usvc->port = nla_get_be16(nla_port);
3474		usvc->fwmark = 0;
3475	}
3476
3477	rcu_read_lock();
3478	if (usvc->fwmark)
3479		svc = __ip_vs_svc_fwm_find(ipvs, usvc->af, usvc->fwmark);
3480	else
3481		svc = __ip_vs_service_find(ipvs, usvc->af, usvc->protocol,
3482					   &usvc->addr, usvc->port);
3483	rcu_read_unlock();
3484	*ret_svc = svc;
3485
3486	/* If a full entry was requested, check for the additional fields */
3487	if (full_entry) {
3488		struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
3489			      *nla_netmask;
3490		struct ip_vs_flags flags;
3491
3492		nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
3493		nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
3494		nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
3495		nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
3496		nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
3497
3498		if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3499			return -EINVAL;
3500
3501		nla_memcpy(&flags, nla_flags, sizeof(flags));
3502
3503		/* prefill flags from service if it already exists */
3504		if (svc)
3505			usvc->flags = svc->flags;
3506
3507		/* set new flags from userland */
3508		usvc->flags = (usvc->flags & ~flags.mask) |
3509			      (flags.flags & flags.mask);
3510		usvc->sched_name = nla_data(nla_sched);
3511		usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3512		usvc->timeout = nla_get_u32(nla_timeout);
3513		usvc->netmask = nla_get_be32(nla_netmask);
3514	}
3515
3516	return 0;
3517}
3518
3519static struct ip_vs_service *ip_vs_genl_find_service(struct netns_ipvs *ipvs,
3520						     struct nlattr *nla)
3521{
3522	struct ip_vs_service_user_kern usvc;
3523	struct ip_vs_service *svc;
3524	int ret;
3525
3526	ret = ip_vs_genl_parse_service(ipvs, &usvc, nla, false, &svc);
3527	return ret ? ERR_PTR(ret) : svc;
3528}
3529
3530static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3531{
3532	struct nlattr *nl_dest;
3533	struct ip_vs_kstats kstats;
3534
3535	nl_dest = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_DEST);
3536	if (!nl_dest)
3537		return -EMSGSIZE;
3538
3539	if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
3540	    nla_put_be16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
3541	    nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3542			(atomic_read(&dest->conn_flags) &
3543			 IP_VS_CONN_F_FWD_MASK)) ||
3544	    nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
3545			atomic_read(&dest->weight)) ||
3546	    nla_put_u8(skb, IPVS_DEST_ATTR_TUN_TYPE,
3547		       dest->tun_type) ||
3548	    nla_put_be16(skb, IPVS_DEST_ATTR_TUN_PORT,
3549			 dest->tun_port) ||
3550	    nla_put_u16(skb, IPVS_DEST_ATTR_TUN_FLAGS,
3551			dest->tun_flags) ||
3552	    nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) ||
3553	    nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) ||
3554	    nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3555			atomic_read(&dest->activeconns)) ||
3556	    nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3557			atomic_read(&dest->inactconns)) ||
3558	    nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3559			atomic_read(&dest->persistconns)) ||
3560	    nla_put_u16(skb, IPVS_DEST_ATTR_ADDR_FAMILY, dest->af))
3561		goto nla_put_failure;
3562	ip_vs_copy_stats(&kstats, &dest->stats);
3563	if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &kstats))
3564		goto nla_put_failure;
3565	if (ip_vs_genl_fill_stats64(skb, IPVS_DEST_ATTR_STATS64, &kstats))
3566		goto nla_put_failure;
3567
3568	nla_nest_end(skb, nl_dest);
3569
3570	return 0;
3571
3572nla_put_failure:
3573	nla_nest_cancel(skb, nl_dest);
3574	return -EMSGSIZE;
3575}
3576
3577static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3578				struct netlink_callback *cb)
3579{
3580	void *hdr;
3581
3582	hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3583			  &ip_vs_genl_family, NLM_F_MULTI,
3584			  IPVS_CMD_NEW_DEST);
3585	if (!hdr)
3586		return -EMSGSIZE;
3587
3588	if (ip_vs_genl_fill_dest(skb, dest) < 0)
3589		goto nla_put_failure;
3590
3591	genlmsg_end(skb, hdr);
3592	return 0;
3593
3594nla_put_failure:
3595	genlmsg_cancel(skb, hdr);
3596	return -EMSGSIZE;
3597}
3598
3599static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3600				 struct netlink_callback *cb)
3601{
3602	int idx = 0;
3603	int start = cb->args[0];
3604	struct ip_vs_service *svc;
3605	struct ip_vs_dest *dest;
3606	struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3607	struct net *net = sock_net(skb->sk);
3608	struct netns_ipvs *ipvs = net_ipvs(net);
3609
3610	mutex_lock(&__ip_vs_mutex);
3611
3612	/* Try to find the service for which to dump destinations */
3613	if (nlmsg_parse_deprecated(cb->nlh, GENL_HDRLEN, attrs, IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy, cb->extack))
3614		goto out_err;
3615
3616
3617	svc = ip_vs_genl_find_service(ipvs, attrs[IPVS_CMD_ATTR_SERVICE]);
3618	if (IS_ERR_OR_NULL(svc))
3619		goto out_err;
3620
3621	/* Dump the destinations */
3622	list_for_each_entry(dest, &svc->destinations, n_list) {
3623		if (++idx <= start)
3624			continue;
3625		if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3626			idx--;
3627			goto nla_put_failure;
3628		}
3629	}
3630
3631nla_put_failure:
3632	cb->args[0] = idx;
3633
3634out_err:
3635	mutex_unlock(&__ip_vs_mutex);
3636
3637	return skb->len;
3638}
3639
3640static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3641				 struct nlattr *nla, bool full_entry)
3642{
3643	struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3644	struct nlattr *nla_addr, *nla_port;
3645	struct nlattr *nla_addr_family;
3646
3647	/* Parse mandatory identifying destination fields first */
3648	if (nla == NULL ||
3649	    nla_parse_nested_deprecated(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy, NULL))
3650		return -EINVAL;
3651
3652	nla_addr	= attrs[IPVS_DEST_ATTR_ADDR];
3653	nla_port	= attrs[IPVS_DEST_ATTR_PORT];
3654	nla_addr_family	= attrs[IPVS_DEST_ATTR_ADDR_FAMILY];
3655
3656	if (!(nla_addr && nla_port))
3657		return -EINVAL;
3658
3659	memset(udest, 0, sizeof(*udest));
3660
3661	nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3662	udest->port = nla_get_be16(nla_port);
3663
3664	udest->af = nla_get_u16_default(nla_addr_family, 0);
3665
3666	/* If a full entry was requested, check for the additional fields */
3667	if (full_entry) {
3668		struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3669			      *nla_l_thresh, *nla_tun_type, *nla_tun_port,
3670			      *nla_tun_flags;
3671
3672		nla_fwd		= attrs[IPVS_DEST_ATTR_FWD_METHOD];
3673		nla_weight	= attrs[IPVS_DEST_ATTR_WEIGHT];
3674		nla_u_thresh	= attrs[IPVS_DEST_ATTR_U_THRESH];
3675		nla_l_thresh	= attrs[IPVS_DEST_ATTR_L_THRESH];
3676		nla_tun_type	= attrs[IPVS_DEST_ATTR_TUN_TYPE];
3677		nla_tun_port	= attrs[IPVS_DEST_ATTR_TUN_PORT];
3678		nla_tun_flags	= attrs[IPVS_DEST_ATTR_TUN_FLAGS];
3679
3680		if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3681			return -EINVAL;
3682
3683		udest->conn_flags = nla_get_u32(nla_fwd)
3684				    & IP_VS_CONN_F_FWD_MASK;
3685		udest->weight = nla_get_u32(nla_weight);
3686		udest->u_threshold = nla_get_u32(nla_u_thresh);
3687		udest->l_threshold = nla_get_u32(nla_l_thresh);
3688
3689		if (nla_tun_type)
3690			udest->tun_type = nla_get_u8(nla_tun_type);
3691
3692		if (nla_tun_port)
3693			udest->tun_port = nla_get_be16(nla_tun_port);
3694
3695		if (nla_tun_flags)
3696			udest->tun_flags = nla_get_u16(nla_tun_flags);
3697	}
3698
3699	return 0;
3700}
3701
3702static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __u32 state,
3703				  struct ipvs_sync_daemon_cfg *c)
3704{
3705	struct nlattr *nl_daemon;
3706
3707	nl_daemon = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_DAEMON);
3708	if (!nl_daemon)
3709		return -EMSGSIZE;
3710
3711	if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) ||
3712	    nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, c->mcast_ifn) ||
3713	    nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, c->syncid) ||
3714	    nla_put_u16(skb, IPVS_DAEMON_ATTR_SYNC_MAXLEN, c->sync_maxlen) ||
3715	    nla_put_u16(skb, IPVS_DAEMON_ATTR_MCAST_PORT, c->mcast_port) ||
3716	    nla_put_u8(skb, IPVS_DAEMON_ATTR_MCAST_TTL, c->mcast_ttl))
3717		goto nla_put_failure;
3718#ifdef CONFIG_IP_VS_IPV6
3719	if (c->mcast_af == AF_INET6) {
3720		if (nla_put_in6_addr(skb, IPVS_DAEMON_ATTR_MCAST_GROUP6,
3721				     &c->mcast_group.in6))
3722			goto nla_put_failure;
3723	} else
3724#endif
3725		if (c->mcast_af == AF_INET &&
3726		    nla_put_in_addr(skb, IPVS_DAEMON_ATTR_MCAST_GROUP,
3727				    c->mcast_group.ip))
3728			goto nla_put_failure;
3729	nla_nest_end(skb, nl_daemon);
3730
3731	return 0;
3732
3733nla_put_failure:
3734	nla_nest_cancel(skb, nl_daemon);
3735	return -EMSGSIZE;
3736}
3737
3738static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __u32 state,
3739				  struct ipvs_sync_daemon_cfg *c,
3740				  struct netlink_callback *cb)
3741{
3742	void *hdr;
3743	hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3744			  &ip_vs_genl_family, NLM_F_MULTI,
3745			  IPVS_CMD_NEW_DAEMON);
3746	if (!hdr)
3747		return -EMSGSIZE;
3748
3749	if (ip_vs_genl_fill_daemon(skb, state, c))
3750		goto nla_put_failure;
3751
3752	genlmsg_end(skb, hdr);
3753	return 0;
3754
3755nla_put_failure:
3756	genlmsg_cancel(skb, hdr);
3757	return -EMSGSIZE;
3758}
3759
3760static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3761				   struct netlink_callback *cb)
3762{
3763	struct net *net = sock_net(skb->sk);
3764	struct netns_ipvs *ipvs = net_ipvs(net);
3765
3766	mutex_lock(&ipvs->sync_mutex);
3767	if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3768		if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3769					   &ipvs->mcfg, cb) < 0)
3770			goto nla_put_failure;
3771
3772		cb->args[0] = 1;
3773	}
3774
3775	if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3776		if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3777					   &ipvs->bcfg, cb) < 0)
3778			goto nla_put_failure;
3779
3780		cb->args[1] = 1;
3781	}
3782
3783nla_put_failure:
3784	mutex_unlock(&ipvs->sync_mutex);
3785
3786	return skb->len;
3787}
3788
3789static int ip_vs_genl_new_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
3790{
3791	struct ipvs_sync_daemon_cfg c;
3792	struct nlattr *a;
3793	int ret;
3794
3795	memset(&c, 0, sizeof(c));
3796	if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3797	      attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3798	      attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3799		return -EINVAL;
3800	strscpy(c.mcast_ifn, nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3801		sizeof(c.mcast_ifn));
3802	c.syncid = nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]);
3803
3804	a = attrs[IPVS_DAEMON_ATTR_SYNC_MAXLEN];
3805	if (a)
3806		c.sync_maxlen = nla_get_u16(a);
3807
3808	a = attrs[IPVS_DAEMON_ATTR_MCAST_GROUP];
3809	if (a) {
3810		c.mcast_af = AF_INET;
3811		c.mcast_group.ip = nla_get_in_addr(a);
3812		if (!ipv4_is_multicast(c.mcast_group.ip))
3813			return -EINVAL;
3814	} else {
3815		a = attrs[IPVS_DAEMON_ATTR_MCAST_GROUP6];
3816		if (a) {
3817#ifdef CONFIG_IP_VS_IPV6
3818			int addr_type;
3819
3820			c.mcast_af = AF_INET6;
3821			c.mcast_group.in6 = nla_get_in6_addr(a);
3822			addr_type = ipv6_addr_type(&c.mcast_group.in6);
3823			if (!(addr_type & IPV6_ADDR_MULTICAST))
3824				return -EINVAL;
3825#else
3826			return -EAFNOSUPPORT;
3827#endif
3828		}
3829	}
3830
3831	a = attrs[IPVS_DAEMON_ATTR_MCAST_PORT];
3832	if (a)
3833		c.mcast_port = nla_get_u16(a);
3834
3835	a = attrs[IPVS_DAEMON_ATTR_MCAST_TTL];
3836	if (a)
3837		c.mcast_ttl = nla_get_u8(a);
3838
3839	/* The synchronization protocol is incompatible with mixed family
3840	 * services
3841	 */
3842	if (ipvs->mixed_address_family_dests > 0)
3843		return -EINVAL;
3844
3845	ret = start_sync_thread(ipvs, &c,
3846				nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3847	return ret;
3848}
3849
3850static int ip_vs_genl_del_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs)
3851{
3852	int ret;
3853
3854	if (!attrs[IPVS_DAEMON_ATTR_STATE])
3855		return -EINVAL;
3856
3857	ret = stop_sync_thread(ipvs,
3858			       nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3859	return ret;
3860}
3861
3862static int ip_vs_genl_set_config(struct netns_ipvs *ipvs, struct nlattr **attrs)
3863{
3864	struct ip_vs_timeout_user t;
3865
3866	__ip_vs_get_timeouts(ipvs, &t);
3867
3868	if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3869		t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3870
3871	if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3872		t.tcp_fin_timeout =
3873			nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3874
3875	if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3876		t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3877
3878	return ip_vs_set_timeout(ipvs, &t);
3879}
3880
3881static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3882{
3883	int ret = -EINVAL, cmd;
3884	struct net *net = sock_net(skb->sk);
3885	struct netns_ipvs *ipvs = net_ipvs(net);
3886
3887	cmd = info->genlhdr->cmd;
3888
3889	if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3890		struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3891
3892		if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3893		    nla_parse_nested_deprecated(daemon_attrs, IPVS_DAEMON_ATTR_MAX, info->attrs[IPVS_CMD_ATTR_DAEMON], ip_vs_daemon_policy, info->extack))
3894			goto out;
3895
3896		if (cmd == IPVS_CMD_NEW_DAEMON)
3897			ret = ip_vs_genl_new_daemon(ipvs, daemon_attrs);
3898		else
3899			ret = ip_vs_genl_del_daemon(ipvs, daemon_attrs);
3900	}
3901
3902out:
3903	return ret;
3904}
3905
3906static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3907{
3908	bool need_full_svc = false, need_full_dest = false;
3909	struct ip_vs_service *svc = NULL;
3910	struct ip_vs_service_user_kern usvc;
3911	struct ip_vs_dest_user_kern udest;
3912	int ret = 0, cmd;
3913	struct net *net = sock_net(skb->sk);
3914	struct netns_ipvs *ipvs = net_ipvs(net);
3915
3916	cmd = info->genlhdr->cmd;
3917
3918	mutex_lock(&__ip_vs_mutex);
3919
3920	if (cmd == IPVS_CMD_FLUSH) {
3921		ret = ip_vs_flush(ipvs, false);
3922		goto out;
3923	} else if (cmd == IPVS_CMD_SET_CONFIG) {
3924		ret = ip_vs_genl_set_config(ipvs, info->attrs);
3925		goto out;
3926	} else if (cmd == IPVS_CMD_ZERO &&
3927		   !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3928		ret = ip_vs_zero_all(ipvs);
3929		goto out;
3930	}
3931
3932	/* All following commands require a service argument, so check if we
3933	 * received a valid one. We need a full service specification when
3934	 * adding / editing a service. Only identifying members otherwise. */
3935	if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3936		need_full_svc = true;
3937
3938	ret = ip_vs_genl_parse_service(ipvs, &usvc,
3939				       info->attrs[IPVS_CMD_ATTR_SERVICE],
3940				       need_full_svc, &svc);
3941	if (ret)
3942		goto out;
3943
3944	/* Unless we're adding a new service, the service must already exist */
3945	if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3946		ret = -ESRCH;
3947		goto out;
3948	}
3949
3950	/* Destination commands require a valid destination argument. For
3951	 * adding / editing a destination, we need a full destination
3952	 * specification. */
3953	if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3954	    cmd == IPVS_CMD_DEL_DEST) {
3955		if (cmd != IPVS_CMD_DEL_DEST)
3956			need_full_dest = true;
3957
3958		ret = ip_vs_genl_parse_dest(&udest,
3959					    info->attrs[IPVS_CMD_ATTR_DEST],
3960					    need_full_dest);
3961		if (ret)
3962			goto out;
3963
3964		/* Old protocols did not allow the user to specify address
3965		 * family, so we set it to zero instead.  We also didn't
3966		 * allow heterogeneous pools in the old code, so it's safe
3967		 * to assume that this will have the same address family as
3968		 * the service.
3969		 */
3970		if (udest.af == 0)
3971			udest.af = svc->af;
3972
3973		if (!ip_vs_is_af_valid(udest.af)) {
3974			ret = -EAFNOSUPPORT;
3975			goto out;
3976		}
3977
3978		if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
3979			/* The synchronization protocol is incompatible
3980			 * with mixed family services
3981			 */
3982			if (ipvs->sync_state) {
3983				ret = -EINVAL;
3984				goto out;
3985			}
3986
3987			/* Which connection types do we support? */
3988			switch (udest.conn_flags) {
3989			case IP_VS_CONN_F_TUNNEL:
3990				/* We are able to forward this */
3991				break;
3992			default:
3993				ret = -EINVAL;
3994				goto out;
3995			}
3996		}
3997	}
3998
3999	switch (cmd) {
4000	case IPVS_CMD_NEW_SERVICE:
4001		if (svc == NULL)
4002			ret = ip_vs_add_service(ipvs, &usvc, &svc);
4003		else
4004			ret = -EEXIST;
4005		break;
4006	case IPVS_CMD_SET_SERVICE:
4007		ret = ip_vs_edit_service(svc, &usvc);
4008		break;
4009	case IPVS_CMD_DEL_SERVICE:
4010		ret = ip_vs_del_service(svc);
4011		/* do not use svc, it can be freed */
4012		break;
4013	case IPVS_CMD_NEW_DEST:
4014		ret = ip_vs_add_dest(svc, &udest);
4015		break;
4016	case IPVS_CMD_SET_DEST:
4017		ret = ip_vs_edit_dest(svc, &udest);
4018		break;
4019	case IPVS_CMD_DEL_DEST:
4020		ret = ip_vs_del_dest(svc, &udest);
4021		break;
4022	case IPVS_CMD_ZERO:
4023		ret = ip_vs_zero_service(svc);
4024		break;
4025	default:
4026		ret = -EINVAL;
4027	}
4028
4029out:
4030	mutex_unlock(&__ip_vs_mutex);
4031
4032	return ret;
4033}
4034
4035static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
4036{
4037	struct sk_buff *msg;
4038	void *reply;
4039	int ret, cmd, reply_cmd;
4040	struct net *net = sock_net(skb->sk);
4041	struct netns_ipvs *ipvs = net_ipvs(net);
4042
4043	cmd = info->genlhdr->cmd;
4044
4045	if (cmd == IPVS_CMD_GET_SERVICE)
4046		reply_cmd = IPVS_CMD_NEW_SERVICE;
4047	else if (cmd == IPVS_CMD_GET_INFO)
4048		reply_cmd = IPVS_CMD_SET_INFO;
4049	else if (cmd == IPVS_CMD_GET_CONFIG)
4050		reply_cmd = IPVS_CMD_SET_CONFIG;
4051	else {
4052		pr_err("unknown Generic Netlink command\n");
4053		return -EINVAL;
4054	}
4055
4056	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4057	if (!msg)
4058		return -ENOMEM;
4059
4060	mutex_lock(&__ip_vs_mutex);
4061
4062	reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
4063	if (reply == NULL)
4064		goto nla_put_failure;
4065
4066	switch (cmd) {
4067	case IPVS_CMD_GET_SERVICE:
4068	{
4069		struct ip_vs_service *svc;
4070
4071		svc = ip_vs_genl_find_service(ipvs,
4072					      info->attrs[IPVS_CMD_ATTR_SERVICE]);
4073		if (IS_ERR(svc)) {
4074			ret = PTR_ERR(svc);
4075			goto out_err;
4076		} else if (svc) {
4077			ret = ip_vs_genl_fill_service(msg, svc);
4078			if (ret)
4079				goto nla_put_failure;
4080		} else {
4081			ret = -ESRCH;
4082			goto out_err;
4083		}
4084
4085		break;
4086	}
4087
4088	case IPVS_CMD_GET_CONFIG:
4089	{
4090		struct ip_vs_timeout_user t;
4091
4092		__ip_vs_get_timeouts(ipvs, &t);
4093#ifdef CONFIG_IP_VS_PROTO_TCP
4094		if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP,
4095				t.tcp_timeout) ||
4096		    nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
4097				t.tcp_fin_timeout))
4098			goto nla_put_failure;
4099#endif
4100#ifdef CONFIG_IP_VS_PROTO_UDP
4101		if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout))
4102			goto nla_put_failure;
4103#endif
4104
4105		break;
4106	}
4107
4108	case IPVS_CMD_GET_INFO:
4109		if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION,
4110				IP_VS_VERSION_CODE) ||
4111		    nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
4112				ip_vs_conn_tab_size))
4113			goto nla_put_failure;
4114		break;
4115	}
4116
4117	genlmsg_end(msg, reply);
4118	ret = genlmsg_reply(msg, info);
4119	goto out;
4120
4121nla_put_failure:
4122	pr_err("not enough space in Netlink message\n");
4123	ret = -EMSGSIZE;
4124
4125out_err:
4126	nlmsg_free(msg);
4127out:
4128	mutex_unlock(&__ip_vs_mutex);
4129
4130	return ret;
4131}
4132
4133
4134static const struct genl_small_ops ip_vs_genl_ops[] = {
4135	{
4136		.cmd	= IPVS_CMD_NEW_SERVICE,
4137		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4138		.flags	= GENL_ADMIN_PERM,
4139		.doit	= ip_vs_genl_set_cmd,
4140	},
4141	{
4142		.cmd	= IPVS_CMD_SET_SERVICE,
4143		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4144		.flags	= GENL_ADMIN_PERM,
4145		.doit	= ip_vs_genl_set_cmd,
4146	},
4147	{
4148		.cmd	= IPVS_CMD_DEL_SERVICE,
4149		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4150		.flags	= GENL_ADMIN_PERM,
4151		.doit	= ip_vs_genl_set_cmd,
4152	},
4153	{
4154		.cmd	= IPVS_CMD_GET_SERVICE,
4155		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4156		.flags	= GENL_ADMIN_PERM,
4157		.doit	= ip_vs_genl_get_cmd,
4158		.dumpit	= ip_vs_genl_dump_services,
4159	},
4160	{
4161		.cmd	= IPVS_CMD_NEW_DEST,
4162		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4163		.flags	= GENL_ADMIN_PERM,
4164		.doit	= ip_vs_genl_set_cmd,
4165	},
4166	{
4167		.cmd	= IPVS_CMD_SET_DEST,
4168		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4169		.flags	= GENL_ADMIN_PERM,
4170		.doit	= ip_vs_genl_set_cmd,
4171	},
4172	{
4173		.cmd	= IPVS_CMD_DEL_DEST,
4174		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4175		.flags	= GENL_ADMIN_PERM,
4176		.doit	= ip_vs_genl_set_cmd,
4177	},
4178	{
4179		.cmd	= IPVS_CMD_GET_DEST,
4180		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4181		.flags	= GENL_ADMIN_PERM,
4182		.dumpit	= ip_vs_genl_dump_dests,
4183	},
4184	{
4185		.cmd	= IPVS_CMD_NEW_DAEMON,
4186		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4187		.flags	= GENL_ADMIN_PERM,
4188		.doit	= ip_vs_genl_set_daemon,
4189	},
4190	{
4191		.cmd	= IPVS_CMD_DEL_DAEMON,
4192		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4193		.flags	= GENL_ADMIN_PERM,
4194		.doit	= ip_vs_genl_set_daemon,
4195	},
4196	{
4197		.cmd	= IPVS_CMD_GET_DAEMON,
4198		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4199		.flags	= GENL_ADMIN_PERM,
4200		.dumpit	= ip_vs_genl_dump_daemons,
4201	},
4202	{
4203		.cmd	= IPVS_CMD_SET_CONFIG,
4204		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4205		.flags	= GENL_ADMIN_PERM,
4206		.doit	= ip_vs_genl_set_cmd,
4207	},
4208	{
4209		.cmd	= IPVS_CMD_GET_CONFIG,
4210		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4211		.flags	= GENL_ADMIN_PERM,
4212		.doit	= ip_vs_genl_get_cmd,
4213	},
4214	{
4215		.cmd	= IPVS_CMD_GET_INFO,
4216		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4217		.flags	= GENL_ADMIN_PERM,
4218		.doit	= ip_vs_genl_get_cmd,
4219	},
4220	{
4221		.cmd	= IPVS_CMD_ZERO,
4222		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4223		.flags	= GENL_ADMIN_PERM,
4224		.doit	= ip_vs_genl_set_cmd,
4225	},
4226	{
4227		.cmd	= IPVS_CMD_FLUSH,
4228		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
4229		.flags	= GENL_ADMIN_PERM,
4230		.doit	= ip_vs_genl_set_cmd,
4231	},
4232};
4233
4234static struct genl_family ip_vs_genl_family __ro_after_init = {
4235	.hdrsize	= 0,
4236	.name		= IPVS_GENL_NAME,
4237	.version	= IPVS_GENL_VERSION,
4238	.maxattr	= IPVS_CMD_ATTR_MAX,
4239	.policy = ip_vs_cmd_policy,
4240	.netnsok        = true,         /* Make ipvsadm to work on netns */
4241	.module		= THIS_MODULE,
4242	.small_ops	= ip_vs_genl_ops,
4243	.n_small_ops	= ARRAY_SIZE(ip_vs_genl_ops),
4244	.resv_start_op	= IPVS_CMD_FLUSH + 1,
4245};
4246
4247static int __init ip_vs_genl_register(void)
4248{
4249	return genl_register_family(&ip_vs_genl_family);
4250}
4251
4252static void ip_vs_genl_unregister(void)
4253{
4254	genl_unregister_family(&ip_vs_genl_family);
4255}
4256
4257/* End of Generic Netlink interface definitions */
4258
4259/*
4260 * per netns intit/exit func.
4261 */
4262#ifdef CONFIG_SYSCTL
4263static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
4264{
4265	struct net *net = ipvs->net;
4266	struct ctl_table *tbl;
4267	int idx, ret;
4268	size_t ctl_table_size = ARRAY_SIZE(vs_vars);
4269	bool unpriv = net->user_ns != &init_user_ns;
4270
4271	atomic_set(&ipvs->dropentry, 0);
4272	spin_lock_init(&ipvs->dropentry_lock);
4273	spin_lock_init(&ipvs->droppacket_lock);
4274	spin_lock_init(&ipvs->securetcp_lock);
4275	INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
4276	INIT_DELAYED_WORK(&ipvs->expire_nodest_conn_work,
4277			  expire_nodest_conn_handler);
4278	ipvs->est_stopped = 0;
4279
4280	if (!net_eq(net, &init_net)) {
4281		tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
4282		if (tbl == NULL)
4283			return -ENOMEM;
4284	} else
4285		tbl = vs_vars;
4286	/* Initialize sysctl defaults */
4287	for (idx = 0; idx < ARRAY_SIZE(vs_vars); idx++) {
4288		if (tbl[idx].proc_handler == proc_do_defense_mode)
4289			tbl[idx].extra2 = ipvs;
4290	}
4291	idx = 0;
4292	ipvs->sysctl_amemthresh = 1024;
4293	tbl[idx++].data = &ipvs->sysctl_amemthresh;
4294	ipvs->sysctl_am_droprate = 10;
4295	tbl[idx++].data = &ipvs->sysctl_am_droprate;
4296	tbl[idx++].data = &ipvs->sysctl_drop_entry;
4297	tbl[idx++].data = &ipvs->sysctl_drop_packet;
4298#ifdef CONFIG_IP_VS_NFCT
4299	tbl[idx++].data = &ipvs->sysctl_conntrack;
4300#endif
4301	tbl[idx++].data = &ipvs->sysctl_secure_tcp;
4302	ipvs->sysctl_snat_reroute = 1;
4303	tbl[idx++].data = &ipvs->sysctl_snat_reroute;
4304	ipvs->sysctl_sync_ver = 1;
4305	tbl[idx++].data = &ipvs->sysctl_sync_ver;
4306	ipvs->sysctl_sync_ports = 1;
4307	tbl[idx++].data = &ipvs->sysctl_sync_ports;
4308	tbl[idx++].data = &ipvs->sysctl_sync_persist_mode;
4309
4310	ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32;
4311	if (unpriv)
4312		tbl[idx].mode = 0444;
4313	tbl[idx++].data = &ipvs->sysctl_sync_qlen_max;
4314
4315	ipvs->sysctl_sync_sock_size = 0;
4316	if (unpriv)
4317		tbl[idx].mode = 0444;
4318	tbl[idx++].data = &ipvs->sysctl_sync_sock_size;
4319
4320	tbl[idx++].data = &ipvs->sysctl_cache_bypass;
4321	tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
4322	tbl[idx++].data = &ipvs->sysctl_sloppy_tcp;
4323	tbl[idx++].data = &ipvs->sysctl_sloppy_sctp;
4324	tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
4325	ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
4326	ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
4327	tbl[idx].data = &ipvs->sysctl_sync_threshold;
4328	tbl[idx].extra2 = ipvs;
4329	tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
4330	ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD;
4331	tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
4332	ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
4333	tbl[idx++].data = &ipvs->sysctl_sync_retries;
4334	tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
4335	ipvs->sysctl_pmtu_disc = 1;
4336	tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
4337	tbl[idx++].data = &ipvs->sysctl_backup_only;
4338	ipvs->sysctl_conn_reuse_mode = 1;
4339	tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
4340	tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
4341	tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
4342
4343	ipvs->sysctl_run_estimation = 1;
4344	if (unpriv)
4345		tbl[idx].mode = 0444;
4346	tbl[idx].extra2 = ipvs;
4347	tbl[idx++].data = &ipvs->sysctl_run_estimation;
4348
4349	ipvs->est_cpulist_valid = 0;
4350	if (unpriv)
4351		tbl[idx].mode = 0444;
4352	tbl[idx].extra2 = ipvs;
4353	tbl[idx++].data = &ipvs->sysctl_est_cpulist;
4354
4355	ipvs->sysctl_est_nice = IPVS_EST_NICE;
4356	if (unpriv)
4357		tbl[idx].mode = 0444;
4358	tbl[idx].extra2 = ipvs;
4359	tbl[idx++].data = &ipvs->sysctl_est_nice;
4360
4361#ifdef CONFIG_IP_VS_DEBUG
4362	/* Global sysctls must be ro in non-init netns */
4363	if (!net_eq(net, &init_net))
4364		tbl[idx++].mode = 0444;
4365#endif
4366
4367	ret = -ENOMEM;
4368	ipvs->sysctl_hdr = register_net_sysctl_sz(net, "net/ipv4/vs", tbl,
4369						  ctl_table_size);
4370	if (!ipvs->sysctl_hdr)
4371		goto err;
4372	ipvs->sysctl_tbl = tbl;
4373
4374	ret = ip_vs_start_estimator(ipvs, &ipvs->tot_stats->s);
4375	if (ret < 0)
4376		goto err;
4377
4378	/* Schedule defense work */
4379	queue_delayed_work(system_long_wq, &ipvs->defense_work,
4380			   DEFENSE_TIMER_PERIOD);
4381
4382	return 0;
4383
4384err:
4385	unregister_net_sysctl_table(ipvs->sysctl_hdr);
4386	if (!net_eq(net, &init_net))
4387		kfree(tbl);
4388	return ret;
4389}
4390
4391static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs)
4392{
4393	struct net *net = ipvs->net;
4394
4395	cancel_delayed_work_sync(&ipvs->expire_nodest_conn_work);
4396	cancel_delayed_work_sync(&ipvs->defense_work);
4397	cancel_work_sync(&ipvs->defense_work.work);
4398	unregister_net_sysctl_table(ipvs->sysctl_hdr);
4399	ip_vs_stop_estimator(ipvs, &ipvs->tot_stats->s);
4400
4401	if (ipvs->est_cpulist_valid)
4402		free_cpumask_var(ipvs->sysctl_est_cpulist);
4403
4404	if (!net_eq(net, &init_net))
4405		kfree(ipvs->sysctl_tbl);
4406}
4407
4408#else
4409
4410static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) { return 0; }
4411static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs) { }
4412
4413#endif
4414
4415static struct notifier_block ip_vs_dst_notifier = {
4416	.notifier_call = ip_vs_dst_event,
4417#ifdef CONFIG_IP_VS_IPV6
4418	.priority = ADDRCONF_NOTIFY_PRIORITY + 5,
4419#endif
4420};
4421
4422int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
4423{
4424	int ret = -ENOMEM;
4425	int idx;
4426
4427	/* Initialize rs_table */
4428	for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
4429		INIT_HLIST_HEAD(&ipvs->rs_table[idx]);
4430
4431	INIT_LIST_HEAD(&ipvs->dest_trash);
4432	spin_lock_init(&ipvs->dest_trash_lock);
4433	timer_setup(&ipvs->dest_trash_timer, ip_vs_dest_trash_expire, 0);
4434	atomic_set(&ipvs->ftpsvc_counter, 0);
4435	atomic_set(&ipvs->nullsvc_counter, 0);
4436	atomic_set(&ipvs->conn_out_counter, 0);
4437
4438	INIT_DELAYED_WORK(&ipvs->est_reload_work, est_reload_work_handler);
4439
4440	/* procfs stats */
4441	ipvs->tot_stats = kzalloc(sizeof(*ipvs->tot_stats), GFP_KERNEL);
4442	if (!ipvs->tot_stats)
4443		goto out;
4444	if (ip_vs_stats_init_alloc(&ipvs->tot_stats->s) < 0)
4445		goto err_tot_stats;
4446
4447#ifdef CONFIG_PROC_FS
4448	if (!proc_create_net("ip_vs", 0, ipvs->net->proc_net,
4449			     &ip_vs_info_seq_ops, sizeof(struct ip_vs_iter)))
4450		goto err_vs;
4451	if (!proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net,
4452				    ip_vs_stats_show, NULL))
4453		goto err_stats;
4454	if (!proc_create_net_single("ip_vs_stats_percpu", 0,
4455				    ipvs->net->proc_net,
4456				    ip_vs_stats_percpu_show, NULL))
4457		goto err_percpu;
4458#endif
4459
4460	ret = ip_vs_control_net_init_sysctl(ipvs);
4461	if (ret < 0)
4462		goto err;
4463
4464	return 0;
4465
4466err:
4467#ifdef CONFIG_PROC_FS
4468	remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net);
4469
4470err_percpu:
4471	remove_proc_entry("ip_vs_stats", ipvs->net->proc_net);
4472
4473err_stats:
4474	remove_proc_entry("ip_vs", ipvs->net->proc_net);
4475
4476err_vs:
4477#endif
4478	ip_vs_stats_release(&ipvs->tot_stats->s);
4479
4480err_tot_stats:
4481	kfree(ipvs->tot_stats);
4482
4483out:
4484	return ret;
4485}
4486
4487void __net_exit ip_vs_control_net_cleanup(struct netns_ipvs *ipvs)
4488{
4489	ip_vs_trash_cleanup(ipvs);
4490	ip_vs_control_net_cleanup_sysctl(ipvs);
4491	cancel_delayed_work_sync(&ipvs->est_reload_work);
4492#ifdef CONFIG_PROC_FS
4493	remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net);
4494	remove_proc_entry("ip_vs_stats", ipvs->net->proc_net);
4495	remove_proc_entry("ip_vs", ipvs->net->proc_net);
4496#endif
4497	call_rcu(&ipvs->tot_stats->rcu_head, ip_vs_stats_rcu_free);
4498}
4499
4500int __init ip_vs_register_nl_ioctl(void)
4501{
4502	int ret;
4503
4504	ret = nf_register_sockopt(&ip_vs_sockopts);
4505	if (ret) {
4506		pr_err("cannot register sockopt.\n");
4507		goto err_sock;
4508	}
4509
4510	ret = ip_vs_genl_register();
4511	if (ret) {
4512		pr_err("cannot register Generic Netlink interface.\n");
4513		goto err_genl;
4514	}
4515	return 0;
4516
4517err_genl:
4518	nf_unregister_sockopt(&ip_vs_sockopts);
4519err_sock:
4520	return ret;
4521}
4522
4523void ip_vs_unregister_nl_ioctl(void)
4524{
4525	ip_vs_genl_unregister();
4526	nf_unregister_sockopt(&ip_vs_sockopts);
4527}
4528
4529int __init ip_vs_control_init(void)
4530{
4531	int idx;
4532	int ret;
4533
4534	/* Initialize svc_table, ip_vs_svc_fwm_table */
4535	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
4536		INIT_HLIST_HEAD(&ip_vs_svc_table[idx]);
4537		INIT_HLIST_HEAD(&ip_vs_svc_fwm_table[idx]);
4538	}
4539
4540	smp_wmb();	/* Do we really need it now ? */
4541
4542	ret = register_netdevice_notifier(&ip_vs_dst_notifier);
4543	if (ret < 0)
4544		return ret;
4545
4546	return 0;
4547}
4548
4549
4550void ip_vs_control_cleanup(void)
4551{
4552	unregister_netdevice_notifier(&ip_vs_dst_notifier);
4553	/* relying on common rcu_barrier() in ip_vs_cleanup() */
4554}