net/netfilter/ipvs/ip_vs_ctl.c

   1 /*
   2  * IPVS         An implementation of the IP virtual server support for the
   3  *              LINUX operating system.  IPVS is now implemented as a module
   4  *              over the NetFilter framework. IPVS can be used to build a
   5  *              high-performance and highly available server based on a
   6  *              cluster of servers.
   7  *
   8  * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
   9  *              Peter Kese <peter.kese@ijs.si>
  10  *              Julian Anastasov <ja@ssi.bg>
  11  *
  12  *              This program is free software; you can redistribute it and/or
  13  *              modify it under the terms of the GNU General Public License
  14  *              as published by the Free Software Foundation; either version
  15  *              2 of the License, or (at your option) any later version.
  16  *
  17  * Changes:
  18  *
  19  */
  20
  21 #define KMSG_COMPONENT "IPVS"
  22 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
  23
  24 #include <linux/module.h>
  25 #include <linux/init.h>
  26 #include <linux/types.h>
  27 #include <linux/capability.h>
  28 #include <linux/fs.h>
  29 #include <linux/sysctl.h>
  30 #include <linux/proc_fs.h>
  31 #include <linux/workqueue.h>
  32 #include <linux/swap.h>
  33 #include <linux/seq_file.h>
  34 #include <linux/slab.h>
  35
  36 #include <linux/netfilter.h>
  37 #include <linux/netfilter_ipv4.h>
  38 #include <linux/mutex.h>
  39
  40 #include <net/net_namespace.h>
  41 #include <linux/nsproxy.h>
  42 #include <net/ip.h>
  43 #ifdef CONFIG_IP_VS_IPV6
  44 #include <net/ipv6.h>
  45 #include <net/ip6_route.h>
  46 #endif
  47 #include <net/route.h>
  48 #include <net/sock.h>
  49 #include <net/genetlink.h>
  50
  51 #include <asm/uaccess.h>
  52
  53 #include <net/ip_vs.h>
  54
  55 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
  56 static DEFINE_MUTEX(__ip_vs_mutex);
  57
  58 /* lock for service table */
  59 static DEFINE_RWLOCK(__ip_vs_svc_lock);
  60
  61 /* sysctl variables */
  62
  63 #ifdef CONFIG_IP_VS_DEBUG
  64 static int sysctl_ip_vs_debug_level = 0;
  65
  66 int ip_vs_get_debug_level(void)
  67 {
  68         return sysctl_ip_vs_debug_level;
  69 }
  70 #endif
  71
  72
  73 /*  Protos */
  74 static void __ip_vs_del_service(struct ip_vs_service *svc);
  75
  76
  77 #ifdef CONFIG_IP_VS_IPV6
  78 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
  79 static int __ip_vs_addr_is_local_v6(struct net *net,
  80                                     const struct in6_addr *addr)
  81 {
  82         struct rt6_info *rt;
  83         struct flowi6 fl6 = {
  84                 .daddr = *addr,
  85         };
  86
  87         rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
  88         if (rt && rt->rt6i_dev && (rt->rt6i_dev->flags & IFF_LOOPBACK))
  89                 return 1;
  90
  91         return 0;
  92 }
  93 #endif
  94
  95 #ifdef CONFIG_SYSCTL
  96 /*
  97  *      update_defense_level is called from keventd and from sysctl,
  98  *      so it needs to protect itself from softirqs
  99  */
 100 static void update_defense_level(struct netns_ipvs *ipvs)
 101 {
 102         struct sysinfo i;
 103         static int old_secure_tcp = 0;
 104         int availmem;
 105         int nomem;
 106         int to_change = -1;
 107
 108         /* we only count free and buffered memory (in pages) */
 109         si_meminfo(&i);
 110         availmem = i.freeram + i.bufferram;
 111         /* however in linux 2.5 the i.bufferram is total page cache size,
 112            we need adjust it */
 113         /* si_swapinfo(&i); */
 114         /* availmem = availmem - (i.totalswap - i.freeswap); */
 115
 116         nomem = (availmem < ipvs->sysctl_amemthresh);
 117
 118         local_bh_disable();
 119
 120         /* drop_entry */
 121         spin_lock(&ipvs->dropentry_lock);
 122         switch (ipvs->sysctl_drop_entry) {
 123         case 0:
 124                 atomic_set(&ipvs->dropentry, 0);
 125                 break;
 126         case 1:
 127                 if (nomem) {
 128                         atomic_set(&ipvs->dropentry, 1);
 129                         ipvs->sysctl_drop_entry = 2;
 130                 } else {
 131                         atomic_set(&ipvs->dropentry, 0);
 132                 }
 133                 break;
 134         case 2:
 135                 if (nomem) {
 136                         atomic_set(&ipvs->dropentry, 1);
 137                 } else {
 138                         atomic_set(&ipvs->dropentry, 0);
 139                         ipvs->sysctl_drop_entry = 1;
 140                 };
 141                 break;
 142         case 3:
 143                 atomic_set(&ipvs->dropentry, 1);
 144                 break;
 145         }
 146         spin_unlock(&ipvs->dropentry_lock);
 147
 148         /* drop_packet */
 149         spin_lock(&ipvs->droppacket_lock);
 150         switch (ipvs->sysctl_drop_packet) {
 151         case 0:
 152                 ipvs->drop_rate = 0;
 153                 break;
 154         case 1:
 155                 if (nomem) {
 156                         ipvs->drop_rate = ipvs->drop_counter
 157                                 = ipvs->sysctl_amemthresh /
 158                                 (ipvs->sysctl_amemthresh-availmem);
 159                         ipvs->sysctl_drop_packet = 2;
 160                 } else {
 161                         ipvs->drop_rate = 0;
 162                 }
 163                 break;
 164         case 2:
 165                 if (nomem) {
 166                         ipvs->drop_rate = ipvs->drop_counter
 167                                 = ipvs->sysctl_amemthresh /
 168                                 (ipvs->sysctl_amemthresh-availmem);
 169                 } else {
 170                         ipvs->drop_rate = 0;
 171                         ipvs->sysctl_drop_packet = 1;
 172                 }
 173                 break;
 174         case 3:
 175                 ipvs->drop_rate = ipvs->sysctl_am_droprate;
 176                 break;
 177         }
 178         spin_unlock(&ipvs->droppacket_lock);
 179
 180         /* secure_tcp */
 181         spin_lock(&ipvs->securetcp_lock);
 182         switch (ipvs->sysctl_secure_tcp) {
 183         case 0:
 184                 if (old_secure_tcp >= 2)
 185                         to_change = 0;
 186                 break;
 187         case 1:
 188                 if (nomem) {
 189                         if (old_secure_tcp < 2)
 190                                 to_change = 1;
 191                         ipvs->sysctl_secure_tcp = 2;
 192                 } else {
 193                         if (old_secure_tcp >= 2)
 194                                 to_change = 0;
 195                 }
 196                 break;
 197         case 2:
 198                 if (nomem) {
 199                         if (old_secure_tcp < 2)
 200                                 to_change = 1;
 201                 } else {
 202                         if (old_secure_tcp >= 2)
 203                                 to_change = 0;
 204                         ipvs->sysctl_secure_tcp = 1;
 205                 }
 206                 break;
 207         case 3:
 208                 if (old_secure_tcp < 2)
 209                         to_change = 1;
 210                 break;
 211         }
 212         old_secure_tcp = ipvs->sysctl_secure_tcp;
 213         if (to_change >= 0)
 214                 ip_vs_protocol_timeout_change(ipvs,
 215                                               ipvs->sysctl_secure_tcp > 1);
 216         spin_unlock(&ipvs->securetcp_lock);
 217
 218         local_bh_enable();
 219 }
 220
 221
 222 /*
 223  *      Timer for checking the defense
 224  */
 225 #define DEFENSE_TIMER_PERIOD    1*HZ
 226
 227 static void defense_work_handler(struct work_struct *work)
 228 {
 229         struct netns_ipvs *ipvs =
 230                 container_of(work, struct netns_ipvs, defense_work.work);
 231
 232         update_defense_level(ipvs);
 233         if (atomic_read(&ipvs->dropentry))
 234                 ip_vs_random_dropentry(ipvs->net);
 235         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
 236 }
 237 #endif
 238
 239 int
 240 ip_vs_use_count_inc(void)
 241 {
 242         return try_module_get(THIS_MODULE);
 243 }
 244
 245 void
 246 ip_vs_use_count_dec(void)
 247 {
 248         module_put(THIS_MODULE);
 249 }
 250
 251
 252 /*
 253  *      Hash table: for virtual service lookups
 254  */
 255 #define IP_VS_SVC_TAB_BITS 8
 256 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
 257 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
 258
 259 /* the service table hashed by <protocol, addr, port> */
 260 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
 261 /* the service table hashed by fwmark */
 262 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
 263
 264
 265 /*
 266  *      Returns hash value for virtual service
 267  */
 268 static inline unsigned
 269 ip_vs_svc_hashkey(struct net *net, int af, unsigned proto,
 270                   const union nf_inet_addr *addr, __be16 port)
 271 {
 272         register unsigned porth = ntohs(port);
 273         __be32 addr_fold = addr->ip;
 274
 275 #ifdef CONFIG_IP_VS_IPV6
 276         if (af == AF_INET6)
 277                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 278                             addr->ip6[2]^addr->ip6[3];
 279 #endif
 280         addr_fold ^= ((size_t)net>>8);
 281
 282         return (proto^ntohl(addr_fold)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
 283                 & IP_VS_SVC_TAB_MASK;
 284 }
 285
 286 /*
 287  *      Returns hash value of fwmark for virtual service lookup
 288  */
 289 static inline unsigned ip_vs_svc_fwm_hashkey(struct net *net, __u32 fwmark)
 290 {
 291         return (((size_t)net>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK;
 292 }
 293
 294 /*
 295  *      Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port>
 296  *      or in the ip_vs_svc_fwm_table by fwmark.
 297  *      Should be called with locked tables.
 298  */
 299 static int ip_vs_svc_hash(struct ip_vs_service *svc)
 300 {
 301         unsigned hash;
 302
 303         if (svc->flags & IP_VS_SVC_F_HASHED) {
 304                 pr_err("%s(): request for already hashed, called from %pF\n",
 305                        __func__, __builtin_return_address(0));
 306                 return 0;
 307         }
 308
 309         if (svc->fwmark == 0) {
 310                 /*
 311                  *  Hash it by <netns,protocol,addr,port> in ip_vs_svc_table
 312                  */
 313                 hash = ip_vs_svc_hashkey(svc->net, svc->af, svc->protocol,
 314                                          &svc->addr, svc->port);
 315                 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
 316         } else {
 317                 /*
 318                  *  Hash it by fwmark in svc_fwm_table
 319                  */
 320                 hash = ip_vs_svc_fwm_hashkey(svc->net, svc->fwmark);
 321                 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
 322         }
 323
 324         svc->flags |= IP_VS_SVC_F_HASHED;
 325         /* increase its refcnt because it is referenced by the svc table */
 326         atomic_inc(&svc->refcnt);
 327         return 1;
 328 }
 329
 330
 331 /*
 332  *      Unhashes a service from svc_table / svc_fwm_table.
 333  *      Should be called with locked tables.
 334  */
 335 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
 336 {
 337         if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
 338                 pr_err("%s(): request for unhash flagged, called from %pF\n",
 339                        __func__, __builtin_return_address(0));
 340                 return 0;
 341         }
 342
 343         if (svc->fwmark == 0) {
 344                 /* Remove it from the svc_table table */
 345                 list_del(&svc->s_list);
 346         } else {
 347                 /* Remove it from the svc_fwm_table table */
 348                 list_del(&svc->f_list);
 349         }
 350
 351         svc->flags &= ~IP_VS_SVC_F_HASHED;
 352         atomic_dec(&svc->refcnt);
 353         return 1;
 354 }
 355
 356
 357 /*
 358  *      Get service by {netns, proto,addr,port} in the service table.
 359  */
 360 static inline struct ip_vs_service *
 361 __ip_vs_service_find(struct net *net, int af, __u16 protocol,
 362                      const union nf_inet_addr *vaddr, __be16 vport)
 363 {
 364         unsigned hash;
 365         struct ip_vs_service *svc;
 366
 367         /* Check for "full" addressed entries */
 368         hash = ip_vs_svc_hashkey(net, af, protocol, vaddr, vport);
 369
 370         list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
 371                 if ((svc->af == af)
 372                     && ip_vs_addr_equal(af, &svc->addr, vaddr)
 373                     && (svc->port == vport)
 374                     && (svc->protocol == protocol)
 375                     && net_eq(svc->net, net)) {
 376                         /* HIT */
 377                         return svc;
 378                 }
 379         }
 380
 381         return NULL;
 382 }
 383
 384
 385 /*
 386  *      Get service by {fwmark} in the service table.
 387  */
 388 static inline struct ip_vs_service *
 389 __ip_vs_svc_fwm_find(struct net *net, int af, __u32 fwmark)
 390 {
 391         unsigned hash;
 392         struct ip_vs_service *svc;
 393
 394         /* Check for fwmark addressed entries */
 395         hash = ip_vs_svc_fwm_hashkey(net, fwmark);
 396
 397         list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
 398                 if (svc->fwmark == fwmark && svc->af == af
 399                     && net_eq(svc->net, net)) {
 400                         /* HIT */
 401                         return svc;
 402                 }
 403         }
 404
 405         return NULL;
 406 }
 407
 408 struct ip_vs_service *
 409 ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
 410                   const union nf_inet_addr *vaddr, __be16 vport)
 411 {
 412         struct ip_vs_service *svc;
 413         struct netns_ipvs *ipvs = net_ipvs(net);
 414
 415         read_lock(&__ip_vs_svc_lock);
 416
 417         /*
 418          *      Check the table hashed by fwmark first
 419          */
 420         if (fwmark) {
 421                 svc = __ip_vs_svc_fwm_find(net, af, fwmark);
 422                 if (svc)
 423                         goto out;
 424         }
 425
 426         /*
 427          *      Check the table hashed by <protocol,addr,port>
 428          *      for "full" addressed entries
 429          */
 430         svc = __ip_vs_service_find(net, af, protocol, vaddr, vport);
 431
 432         if (svc == NULL
 433             && protocol == IPPROTO_TCP
 434             && atomic_read(&ipvs->ftpsvc_counter)
 435             && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
 436                 /*
 437                  * Check if ftp service entry exists, the packet
 438                  * might belong to FTP data connections.
 439                  */
 440                 svc = __ip_vs_service_find(net, af, protocol, vaddr, FTPPORT);
 441         }
 442
 443         if (svc == NULL
 444             && atomic_read(&ipvs->nullsvc_counter)) {
 445                 /*
 446                  * Check if the catch-all port (port zero) exists
 447                  */
 448                 svc = __ip_vs_service_find(net, af, protocol, vaddr, 0);
 449         }
 450
 451   out:
 452         if (svc)
 453                 atomic_inc(&svc->usecnt);
 454         read_unlock(&__ip_vs_svc_lock);
 455
 456         IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n",
 457                       fwmark, ip_vs_proto_name(protocol),
 458                       IP_VS_DBG_ADDR(af, vaddr), ntohs(vport),
 459                       svc ? "hit" : "not hit");
 460
 461         return svc;
 462 }
 463
 464
 465 static inline void
 466 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
 467 {
 468         atomic_inc(&svc->refcnt);
 469         dest->svc = svc;
 470 }
 471
 472 static void
 473 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 474 {
 475         struct ip_vs_service *svc = dest->svc;
 476
 477         dest->svc = NULL;
 478         if (atomic_dec_and_test(&svc->refcnt)) {
 479                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
 480                               svc->fwmark,
 481                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
 482                               ntohs(svc->port), atomic_read(&svc->usecnt));
 483                 free_percpu(svc->stats.cpustats);
 484                 kfree(svc);
 485         }
 486 }
 487
 488
 489 /*
 490  *      Returns hash value for real service
 491  */
 492 static inline unsigned ip_vs_rs_hashkey(int af,
 493                                             const union nf_inet_addr *addr,
 494                                             __be16 port)
 495 {
 496         register unsigned porth = ntohs(port);
 497         __be32 addr_fold = addr->ip;
 498
 499 #ifdef CONFIG_IP_VS_IPV6
 500         if (af == AF_INET6)
 501                 addr_fold = addr->ip6[0]^addr->ip6[1]^
 502                             addr->ip6[2]^addr->ip6[3];
 503 #endif
 504
 505         return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth)
 506                 & IP_VS_RTAB_MASK;
 507 }
 508
 509 /*
 510  *      Hashes ip_vs_dest in rs_table by <proto,addr,port>.
 511  *      should be called with locked tables.
 512  */
 513 static int ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest)
 514 {
 515         unsigned hash;
 516
 517         if (!list_empty(&dest->d_list)) {
 518                 return 0;
 519         }
 520
 521         /*
 522          *      Hash by proto,addr,port,
 523          *      which are the parameters of the real service.
 524          */
 525         hash = ip_vs_rs_hashkey(dest->af, &dest->addr, dest->port);
 526
 527         list_add(&dest->d_list, &ipvs->rs_table[hash]);
 528
 529         return 1;
 530 }
 531
 532 /*
 533  *      UNhashes ip_vs_dest from rs_table.
 534  *      should be called with locked tables.
 535  */
 536 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
 537 {
 538         /*
 539          * Remove it from the rs_table table.
 540          */
 541         if (!list_empty(&dest->d_list)) {
 542                 list_del(&dest->d_list);
 543                 INIT_LIST_HEAD(&dest->d_list);
 544         }
 545
 546         return 1;
 547 }
 548
 549 /*
 550  *      Lookup real service by <proto,addr,port> in the real service table.
 551  */
 552 struct ip_vs_dest *
 553 ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
 554                           const union nf_inet_addr *daddr,
 555                           __be16 dport)
 556 {
 557         struct netns_ipvs *ipvs = net_ipvs(net);
 558         unsigned hash;
 559         struct ip_vs_dest *dest;
 560
 561         /*
 562          *      Check for "full" addressed entries
 563          *      Return the first found entry
 564          */
 565         hash = ip_vs_rs_hashkey(af, daddr, dport);
 566
 567         read_lock(&ipvs->rs_lock);
 568         list_for_each_entry(dest, &ipvs->rs_table[hash], d_list) {
 569                 if ((dest->af == af)
 570                     && ip_vs_addr_equal(af, &dest->addr, daddr)
 571                     && (dest->port == dport)
 572                     && ((dest->protocol == protocol) ||
 573                         dest->vfwmark)) {
 574                         /* HIT */
 575                         read_unlock(&ipvs->rs_lock);
 576                         return dest;
 577                 }
 578         }
 579         read_unlock(&ipvs->rs_lock);
 580
 581         return NULL;
 582 }
 583
 584 /*
 585  *      Lookup destination by {addr,port} in the given service
 586  */
 587 static struct ip_vs_dest *
 588 ip_vs_lookup_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 589                   __be16 dport)
 590 {
 591         struct ip_vs_dest *dest;
 592
 593         /*
 594          * Find the destination for the given service
 595          */
 596         list_for_each_entry(dest, &svc->destinations, n_list) {
 597                 if ((dest->af == svc->af)
 598                     && ip_vs_addr_equal(svc->af, &dest->addr, daddr)
 599                     && (dest->port == dport)) {
 600                         /* HIT */
 601                         return dest;
 602                 }
 603         }
 604
 605         return NULL;
 606 }
 607
 608 /*
 609  * Find destination by {daddr,dport,vaddr,protocol}
 610  * Cretaed to be used in ip_vs_process_message() in
 611  * the backup synchronization daemon. It finds the
 612  * destination to be bound to the received connection
 613  * on the backup.
 614  *
 615  * ip_vs_lookup_real_service() looked promissing, but
 616  * seems not working as expected.
 617  */
 618 struct ip_vs_dest *ip_vs_find_dest(struct net  *net, int af,
 619                                    const union nf_inet_addr *daddr,
 620                                    __be16 dport,
 621                                    const union nf_inet_addr *vaddr,
 622                                    __be16 vport, __u16 protocol, __u32 fwmark)
 623 {
 624         struct ip_vs_dest *dest;
 625         struct ip_vs_service *svc;
 626
 627         svc = ip_vs_service_get(net, af, fwmark, protocol, vaddr, vport);
 628         if (!svc)
 629                 return NULL;
 630         dest = ip_vs_lookup_dest(svc, daddr, dport);
 631         if (dest)
 632                 atomic_inc(&dest->refcnt);
 633         ip_vs_service_put(svc);
 634         return dest;
 635 }
 636
 637 /*
 638  *  Lookup dest by {svc,addr,port} in the destination trash.
 639  *  The destination trash is used to hold the destinations that are removed
 640  *  from the service table but are still referenced by some conn entries.
 641  *  The reason to add the destination trash is when the dest is temporary
 642  *  down (either by administrator or by monitor program), the dest can be
 643  *  picked back from the trash, the remaining connections to the dest can
 644  *  continue, and the counting information of the dest is also useful for
 645  *  scheduling.
 646  */
 647 static struct ip_vs_dest *
 648 ip_vs_trash_get_dest(struct ip_vs_service *svc, const union nf_inet_addr *daddr,
 649                      __be16 dport)
 650 {
 651         struct ip_vs_dest *dest, *nxt;
 652         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 653
 654         /*
 655          * Find the destination in trash
 656          */
 657         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 658                 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, "
 659                               "dest->refcnt=%d\n",
 660                               dest->vfwmark,
 661                               IP_VS_DBG_ADDR(svc->af, &dest->addr),
 662                               ntohs(dest->port),
 663                               atomic_read(&dest->refcnt));
 664                 if (dest->af == svc->af &&
 665                     ip_vs_addr_equal(svc->af, &dest->addr, daddr) &&
 666                     dest->port == dport &&
 667                     dest->vfwmark == svc->fwmark &&
 668                     dest->protocol == svc->protocol &&
 669                     (svc->fwmark ||
 670                      (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) &&
 671                       dest->vport == svc->port))) {
 672                         /* HIT */
 673                         return dest;
 674                 }
 675
 676                 /*
 677                  * Try to purge the destination from trash if not referenced
 678                  */
 679                 if (atomic_read(&dest->refcnt) == 1) {
 680                         IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u "
 681                                       "from trash\n",
 682                                       dest->vfwmark,
 683                                       IP_VS_DBG_ADDR(svc->af, &dest->addr),
 684                                       ntohs(dest->port));
 685                         list_del(&dest->n_list);
 686                         ip_vs_dst_reset(dest);
 687                         __ip_vs_unbind_svc(dest);
 688                         free_percpu(dest->stats.cpustats);
 689                         kfree(dest);
 690                 }
 691         }
 692
 693         return NULL;
 694 }
 695
 696
 697 /*
 698  *  Clean up all the destinations in the trash
 699  *  Called by the ip_vs_control_cleanup()
 700  *
 701  *  When the ip_vs_control_clearup is activated by ipvs module exit,
 702  *  the service tables must have been flushed and all the connections
 703  *  are expired, and the refcnt of each destination in the trash must
 704  *  be 1, so we simply release them here.
 705  */
 706 static void ip_vs_trash_cleanup(struct net *net)
 707 {
 708         struct ip_vs_dest *dest, *nxt;
 709         struct netns_ipvs *ipvs = net_ipvs(net);
 710
 711         list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, n_list) {
 712                 list_del(&dest->n_list);
 713                 ip_vs_dst_reset(dest);
 714                 __ip_vs_unbind_svc(dest);
 715                 free_percpu(dest->stats.cpustats);
 716                 kfree(dest);
 717         }
 718 }
 719
 720 static void
 721 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
 722 {
 723 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->ustats.c - src->ustats0.c
 724
 725         spin_lock_bh(&src->lock);
 726
 727         IP_VS_SHOW_STATS_COUNTER(conns);
 728         IP_VS_SHOW_STATS_COUNTER(inpkts);
 729         IP_VS_SHOW_STATS_COUNTER(outpkts);
 730         IP_VS_SHOW_STATS_COUNTER(inbytes);
 731         IP_VS_SHOW_STATS_COUNTER(outbytes);
 732
 733         ip_vs_read_estimator(dst, src);
 734
 735         spin_unlock_bh(&src->lock);
 736 }
 737
 738 static void
 739 ip_vs_zero_stats(struct ip_vs_stats *stats)
 740 {
 741         spin_lock_bh(&stats->lock);
 742
 743         /* get current counters as zero point, rates are zeroed */
 744
 745 #define IP_VS_ZERO_STATS_COUNTER(c) stats->ustats0.c = stats->ustats.c
 746
 747         IP_VS_ZERO_STATS_COUNTER(conns);
 748         IP_VS_ZERO_STATS_COUNTER(inpkts);
 749         IP_VS_ZERO_STATS_COUNTER(outpkts);
 750         IP_VS_ZERO_STATS_COUNTER(inbytes);
 751         IP_VS_ZERO_STATS_COUNTER(outbytes);
 752
 753         ip_vs_zero_estimator(stats);
 754
 755         spin_unlock_bh(&stats->lock);
 756 }
 757
 758 /*
 759  *      Update a destination in the given service
 760  */
 761 static void
 762 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
 763                     struct ip_vs_dest_user_kern *udest, int add)
 764 {
 765         struct netns_ipvs *ipvs = net_ipvs(svc->net);
 766         int conn_flags;
 767
 768         /* set the weight and the flags */
 769         atomic_set(&dest->weight, udest->weight);
 770         conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
 771         conn_flags |= IP_VS_CONN_F_INACTIVE;
 772
 773         /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
 774         if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) {
 775                 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
 776         } else {
 777                 /*
 778                  *    Put the real service in rs_table if not present.
 779                  *    For now only for NAT!
 780                  */
 781                 write_lock_bh(&ipvs->rs_lock);
 782                 ip_vs_rs_hash(ipvs, dest);
 783                 write_unlock_bh(&ipvs->rs_lock);
 784         }
 785         atomic_set(&dest->conn_flags, conn_flags);
 786
 787         /* bind the service */
 788         if (!dest->svc) {
 789                 __ip_vs_bind_svc(dest, svc);
 790         } else {
 791                 if (dest->svc != svc) {
 792                         __ip_vs_unbind_svc(dest);
 793                         ip_vs_zero_stats(&dest->stats);
 794                         __ip_vs_bind_svc(dest, svc);
 795                 }
 796         }
 797
 798         /* set the dest status flags */
 799         dest->flags |= IP_VS_DEST_F_AVAILABLE;
 800
 801         if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
 802                 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
 803         dest->u_threshold = udest->u_threshold;
 804         dest->l_threshold = udest->l_threshold;
 805
 806         spin_lock_bh(&dest->dst_lock);
 807         ip_vs_dst_reset(dest);
 808         spin_unlock_bh(&dest->dst_lock);
 809
 810         if (add)
 811                 ip_vs_start_estimator(svc->net, &dest->stats);
 812
 813         write_lock_bh(&__ip_vs_svc_lock);
 814
 815         /* Wait until all other svc users go away */
 816         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
 817
 818         if (add) {
 819                 list_add(&dest->n_list, &svc->destinations);
 820                 svc->num_dests++;
 821         }
 822
 823         /* call the update_service, because server weight may be changed */
 824         if (svc->scheduler->update_service)
 825                 svc->scheduler->update_service(svc);
 826
 827         write_unlock_bh(&__ip_vs_svc_lock);
 828 }
 829
 830
 831 /*
 832  *      Create a destination for the given service
 833  */
 834 static int
 835 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest,
 836                struct ip_vs_dest **dest_p)
 837 {
 838         struct ip_vs_dest *dest;
 839         unsigned atype;
 840
 841         EnterFunction(2);
 842
 843 #ifdef CONFIG_IP_VS_IPV6
 844         if (svc->af == AF_INET6) {
 845                 atype = ipv6_addr_type(&udest->addr.in6);
 846                 if ((!(atype & IPV6_ADDR_UNICAST) ||
 847                         atype & IPV6_ADDR_LINKLOCAL) &&
 848                         !__ip_vs_addr_is_local_v6(svc->net, &udest->addr.in6))
 849                         return -EINVAL;
 850         } else
 851 #endif
 852         {
 853                 atype = inet_addr_type(svc->net, udest->addr.ip);
 854                 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
 855                         return -EINVAL;
 856         }
 857
 858         dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
 859         if (dest == NULL) {
 860                 pr_err("%s(): no memory.\n", __func__);
 861                 return -ENOMEM;
 862         }
 863         dest->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
 864         if (!dest->stats.cpustats) {
 865                 pr_err("%s() alloc_percpu failed\n", __func__);
 866                 goto err_alloc;
 867         }
 868
 869         dest->af = svc->af;
 870         dest->protocol = svc->protocol;
 871         dest->vaddr = svc->addr;
 872         dest->vport = svc->port;
 873         dest->vfwmark = svc->fwmark;
 874         ip_vs_addr_copy(svc->af, &dest->addr, &udest->addr);
 875         dest->port = udest->port;
 876
 877         atomic_set(&dest->activeconns, 0);
 878         atomic_set(&dest->inactconns, 0);
 879         atomic_set(&dest->persistconns, 0);
 880         atomic_set(&dest->refcnt, 1);
 881
 882         INIT_LIST_HEAD(&dest->d_list);
 883         spin_lock_init(&dest->dst_lock);
 884         spin_lock_init(&dest->stats.lock);
 885         __ip_vs_update_dest(svc, dest, udest, 1);
 886
 887         *dest_p = dest;
 888
 889         LeaveFunction(2);
 890         return 0;
 891
 892 err_alloc:
 893         kfree(dest);
 894         return -ENOMEM;
 895 }
 896
 897
 898 /*
 899  *      Add a destination into an existing service
 900  */
 901 static int
 902 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 903 {
 904         struct ip_vs_dest *dest;
 905         union nf_inet_addr daddr;
 906         __be16 dport = udest->port;
 907         int ret;
 908
 909         EnterFunction(2);
 910
 911         if (udest->weight < 0) {
 912                 pr_err("%s(): server weight less than zero\n", __func__);
 913                 return -ERANGE;
 914         }
 915
 916         if (udest->l_threshold > udest->u_threshold) {
 917                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 918                         __func__);
 919                 return -ERANGE;
 920         }
 921
 922         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 923
 924         /*
 925          * Check if the dest already exists in the list
 926          */
 927         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 928
 929         if (dest != NULL) {
 930                 IP_VS_DBG(1, "%s(): dest already exists\n", __func__);
 931                 return -EEXIST;
 932         }
 933
 934         /*
 935          * Check if the dest already exists in the trash and
 936          * is from the same service
 937          */
 938         dest = ip_vs_trash_get_dest(svc, &daddr, dport);
 939
 940         if (dest != NULL) {
 941                 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, "
 942                               "dest->refcnt=%d, service %u/%s:%u\n",
 943                               IP_VS_DBG_ADDR(svc->af, &daddr), ntohs(dport),
 944                               atomic_read(&dest->refcnt),
 945                               dest->vfwmark,
 946                               IP_VS_DBG_ADDR(svc->af, &dest->vaddr),
 947                               ntohs(dest->vport));
 948
 949                 /*
 950                  * Get the destination from the trash
 951                  */
 952                 list_del(&dest->n_list);
 953
 954                 __ip_vs_update_dest(svc, dest, udest, 1);
 955                 ret = 0;
 956         } else {
 957                 /*
 958                  * Allocate and initialize the dest structure
 959                  */
 960                 ret = ip_vs_new_dest(svc, udest, &dest);
 961         }
 962         LeaveFunction(2);
 963
 964         return ret;
 965 }
 966
 967
 968 /*
 969  *      Edit a destination in the given service
 970  */
 971 static int
 972 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 973 {
 974         struct ip_vs_dest *dest;
 975         union nf_inet_addr daddr;
 976         __be16 dport = udest->port;
 977
 978         EnterFunction(2);
 979
 980         if (udest->weight < 0) {
 981                 pr_err("%s(): server weight less than zero\n", __func__);
 982                 return -ERANGE;
 983         }
 984
 985         if (udest->l_threshold > udest->u_threshold) {
 986                 pr_err("%s(): lower threshold is higher than upper threshold\n",
 987                         __func__);
 988                 return -ERANGE;
 989         }
 990
 991         ip_vs_addr_copy(svc->af, &daddr, &udest->addr);
 992
 993         /*
 994          *  Lookup the destination list
 995          */
 996         dest = ip_vs_lookup_dest(svc, &daddr, dport);
 997
 998         if (dest == NULL) {
 999                 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__);
1000                 return -ENOENT;
1001         }
1002
1003         __ip_vs_update_dest(svc, dest, udest, 0);
1004         LeaveFunction(2);
1005
1006         return 0;
1007 }
1008
1009
1010 /*
1011  *      Delete a destination (must be already unlinked from the service)
1012  */
1013 static void __ip_vs_del_dest(struct net *net, struct ip_vs_dest *dest)
1014 {
1015         struct netns_ipvs *ipvs = net_ipvs(net);
1016
1017         ip_vs_stop_estimator(net, &dest->stats);
1018
1019         /*
1020          *  Remove it from the d-linked list with the real services.
1021          */
1022         write_lock_bh(&ipvs->rs_lock);
1023         ip_vs_rs_unhash(dest);
1024         write_unlock_bh(&ipvs->rs_lock);
1025
1026         /*
1027          *  Decrease the refcnt of the dest, and free the dest
1028          *  if nobody refers to it (refcnt=0). Otherwise, throw
1029          *  the destination into the trash.
1030          */
1031         if (atomic_dec_and_test(&dest->refcnt)) {
1032                 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u\n",
1033                               dest->vfwmark,
1034                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1035                               ntohs(dest->port));
1036                 ip_vs_dst_reset(dest);
1037                 /* simply decrease svc->refcnt here, let the caller check
1038                    and release the service if nobody refers to it.
1039                    Only user context can release destination and service,
1040                    and only one user context can update virtual service at a
1041                    time, so the operation here is OK */
1042                 atomic_dec(&dest->svc->refcnt);
1043                 free_percpu(dest->stats.cpustats);
1044                 kfree(dest);
1045         } else {
1046                 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, "
1047                               "dest->refcnt=%d\n",
1048                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1049                               ntohs(dest->port),
1050                               atomic_read(&dest->refcnt));
1051                 list_add(&dest->n_list, &ipvs->dest_trash);
1052                 atomic_inc(&dest->refcnt);
1053         }
1054 }
1055
1056
1057 /*
1058  *      Unlink a destination from the given service
1059  */
1060 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
1061                                 struct ip_vs_dest *dest,
1062                                 int svcupd)
1063 {
1064         dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
1065
1066         /*
1067          *  Remove it from the d-linked destination list.
1068          */
1069         list_del(&dest->n_list);
1070         svc->num_dests--;
1071
1072         /*
1073          *  Call the update_service function of its scheduler
1074          */
1075         if (svcupd && svc->scheduler->update_service)
1076                         svc->scheduler->update_service(svc);
1077 }
1078
1079
1080 /*
1081  *      Delete a destination server in the given service
1082  */
1083 static int
1084 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
1085 {
1086         struct ip_vs_dest *dest;
1087         __be16 dport = udest->port;
1088
1089         EnterFunction(2);
1090
1091         dest = ip_vs_lookup_dest(svc, &udest->addr, dport);
1092
1093         if (dest == NULL) {
1094                 IP_VS_DBG(1, "%s(): destination not found!\n", __func__);
1095                 return -ENOENT;
1096         }
1097
1098         write_lock_bh(&__ip_vs_svc_lock);
1099
1100         /*
1101          *      Wait until all other svc users go away.
1102          */
1103         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1104
1105         /*
1106          *      Unlink dest from the service
1107          */
1108         __ip_vs_unlink_dest(svc, dest, 1);
1109
1110         write_unlock_bh(&__ip_vs_svc_lock);
1111
1112         /*
1113          *      Delete the destination
1114          */
1115         __ip_vs_del_dest(svc->net, dest);
1116
1117         LeaveFunction(2);
1118
1119         return 0;
1120 }
1121
1122
1123 /*
1124  *      Add a service into the service hash table
1125  */
1126 static int
1127 ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
1128                   struct ip_vs_service **svc_p)
1129 {
1130         int ret = 0;
1131         struct ip_vs_scheduler *sched = NULL;
1132         struct ip_vs_pe *pe = NULL;
1133         struct ip_vs_service *svc = NULL;
1134         struct netns_ipvs *ipvs = net_ipvs(net);
1135
1136         /* increase the module use count */
1137         ip_vs_use_count_inc();
1138
1139         /* Lookup the scheduler by 'u->sched_name' */
1140         sched = ip_vs_scheduler_get(u->sched_name);
1141         if (sched == NULL) {
1142                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1143                 ret = -ENOENT;
1144                 goto out_err;
1145         }
1146
1147         if (u->pe_name && *u->pe_name) {
1148                 pe = ip_vs_pe_getbyname(u->pe_name);
1149                 if (pe == NULL) {
1150                         pr_info("persistence engine module ip_vs_pe_%s "
1151                                 "not found\n", u->pe_name);
1152                         ret = -ENOENT;
1153                         goto out_err;
1154                 }
1155         }
1156
1157 #ifdef CONFIG_IP_VS_IPV6
1158         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1159                 ret = -EINVAL;
1160                 goto out_err;
1161         }
1162 #endif
1163
1164         svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
1165         if (svc == NULL) {
1166                 IP_VS_DBG(1, "%s(): no memory\n", __func__);
1167                 ret = -ENOMEM;
1168                 goto out_err;
1169         }
1170         svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
1171         if (!svc->stats.cpustats) {
1172                 pr_err("%s() alloc_percpu failed\n", __func__);
1173                 goto out_err;
1174         }
1175
1176         /* I'm the first user of the service */
1177         atomic_set(&svc->usecnt, 0);
1178         atomic_set(&svc->refcnt, 0);
1179
1180         svc->af = u->af;
1181         svc->protocol = u->protocol;
1182         ip_vs_addr_copy(svc->af, &svc->addr, &u->addr);
1183         svc->port = u->port;
1184         svc->fwmark = u->fwmark;
1185         svc->flags = u->flags;
1186         svc->timeout = u->timeout * HZ;
1187         svc->netmask = u->netmask;
1188         svc->net = net;
1189
1190         INIT_LIST_HEAD(&svc->destinations);
1191         rwlock_init(&svc->sched_lock);
1192         spin_lock_init(&svc->stats.lock);
1193
1194         /* Bind the scheduler */
1195         ret = ip_vs_bind_scheduler(svc, sched);
1196         if (ret)
1197                 goto out_err;
1198         sched = NULL;
1199
1200         /* Bind the ct retriever */
1201         ip_vs_bind_pe(svc, pe);
1202         pe = NULL;
1203
1204         /* Update the virtual service counters */
1205         if (svc->port == FTPPORT)
1206                 atomic_inc(&ipvs->ftpsvc_counter);
1207         else if (svc->port == 0)
1208                 atomic_inc(&ipvs->nullsvc_counter);
1209
1210         ip_vs_start_estimator(net, &svc->stats);
1211
1212         /* Count only IPv4 services for old get/setsockopt interface */
1213         if (svc->af == AF_INET)
1214                 ipvs->num_services++;
1215
1216         /* Hash the service into the service table */
1217         write_lock_bh(&__ip_vs_svc_lock);
1218         ip_vs_svc_hash(svc);
1219         write_unlock_bh(&__ip_vs_svc_lock);
1220
1221         *svc_p = svc;
1222         /* Now there is a service - full throttle */
1223         ipvs->enable = 1;
1224         return 0;
1225
1226
1227  out_err:
1228         if (svc != NULL) {
1229                 ip_vs_unbind_scheduler(svc);
1230                 if (svc->inc) {
1231                         local_bh_disable();
1232                         ip_vs_app_inc_put(svc->inc);
1233                         local_bh_enable();
1234                 }
1235                 if (svc->stats.cpustats)
1236                         free_percpu(svc->stats.cpustats);
1237                 kfree(svc);
1238         }
1239         ip_vs_scheduler_put(sched);
1240         ip_vs_pe_put(pe);
1241
1242         /* decrease the module use count */
1243         ip_vs_use_count_dec();
1244
1245         return ret;
1246 }
1247
1248
1249 /*
1250  *      Edit a service and bind it with a new scheduler
1251  */
1252 static int
1253 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
1254 {
1255         struct ip_vs_scheduler *sched, *old_sched;
1256         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
1257         int ret = 0;
1258
1259         /*
1260          * Lookup the scheduler, by 'u->sched_name'
1261          */
1262         sched = ip_vs_scheduler_get(u->sched_name);
1263         if (sched == NULL) {
1264                 pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
1265                 return -ENOENT;
1266         }
1267         old_sched = sched;
1268
1269         if (u->pe_name && *u->pe_name) {
1270                 pe = ip_vs_pe_getbyname(u->pe_name);
1271                 if (pe == NULL) {
1272                         pr_info("persistence engine module ip_vs_pe_%s "
1273                                 "not found\n", u->pe_name);
1274                         ret = -ENOENT;
1275                         goto out;
1276                 }
1277                 old_pe = pe;
1278         }
1279
1280 #ifdef CONFIG_IP_VS_IPV6
1281         if (u->af == AF_INET6 && (u->netmask < 1 || u->netmask > 128)) {
1282                 ret = -EINVAL;
1283                 goto out;
1284         }
1285 #endif
1286
1287         write_lock_bh(&__ip_vs_svc_lock);
1288
1289         /*
1290          * Wait until all other svc users go away.
1291          */
1292         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1293
1294         /*
1295          * Set the flags and timeout value
1296          */
1297         svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1298         svc->timeout = u->timeout * HZ;
1299         svc->netmask = u->netmask;
1300
1301         old_sched = svc->scheduler;
1302         if (sched != old_sched) {
1303                 /*
1304                  * Unbind the old scheduler
1305                  */
1306                 if ((ret = ip_vs_unbind_scheduler(svc))) {
1307                         old_sched = sched;
1308                         goto out_unlock;
1309                 }
1310
1311                 /*
1312                  * Bind the new scheduler
1313                  */
1314                 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1315                         /*
1316                          * If ip_vs_bind_scheduler fails, restore the old
1317                          * scheduler.
1318                          * The main reason of failure is out of memory.
1319                          *
1320                          * The question is if the old scheduler can be
1321                          * restored all the time. TODO: if it cannot be
1322                          * restored some time, we must delete the service,
1323                          * otherwise the system may crash.
1324                          */
1325                         ip_vs_bind_scheduler(svc, old_sched);
1326                         old_sched = sched;
1327                         goto out_unlock;
1328                 }
1329         }
1330
1331         old_pe = svc->pe;
1332         if (pe != old_pe) {
1333                 ip_vs_unbind_pe(svc);
1334                 ip_vs_bind_pe(svc, pe);
1335         }
1336
1337 out_unlock:
1338         write_unlock_bh(&__ip_vs_svc_lock);
1339 out:
1340         ip_vs_scheduler_put(old_sched);
1341         ip_vs_pe_put(old_pe);
1342         return ret;
1343 }
1344
1345
1346 /*
1347  *      Delete a service from the service list
1348  *      - The service must be unlinked, unlocked and not referenced!
1349  *      - We are called under _bh lock
1350  */
1351 static void __ip_vs_del_service(struct ip_vs_service *svc)
1352 {
1353         struct ip_vs_dest *dest, *nxt;
1354         struct ip_vs_scheduler *old_sched;
1355         struct ip_vs_pe *old_pe;
1356         struct netns_ipvs *ipvs = net_ipvs(svc->net);
1357
1358         pr_info("%s: enter\n", __func__);
1359
1360         /* Count only IPv4 services for old get/setsockopt interface */
1361         if (svc->af == AF_INET)
1362                 ipvs->num_services--;
1363
1364         ip_vs_stop_estimator(svc->net, &svc->stats);
1365
1366         /* Unbind scheduler */
1367         old_sched = svc->scheduler;
1368         ip_vs_unbind_scheduler(svc);
1369         ip_vs_scheduler_put(old_sched);
1370
1371         /* Unbind persistence engine */
1372         old_pe = svc->pe;
1373         ip_vs_unbind_pe(svc);
1374         ip_vs_pe_put(old_pe);
1375
1376         /* Unbind app inc */
1377         if (svc->inc) {
1378                 ip_vs_app_inc_put(svc->inc);
1379                 svc->inc = NULL;
1380         }
1381
1382         /*
1383          *    Unlink the whole destination list
1384          */
1385         list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1386                 __ip_vs_unlink_dest(svc, dest, 0);
1387                 __ip_vs_del_dest(svc->net, dest);
1388         }
1389
1390         /*
1391          *    Update the virtual service counters
1392          */
1393         if (svc->port == FTPPORT)
1394                 atomic_dec(&ipvs->ftpsvc_counter);
1395         else if (svc->port == 0)
1396                 atomic_dec(&ipvs->nullsvc_counter);
1397
1398         /*
1399          *    Free the service if nobody refers to it
1400          */
1401         if (atomic_read(&svc->refcnt) == 0) {
1402                 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u usecnt=%d\n",
1403                               svc->fwmark,
1404                               IP_VS_DBG_ADDR(svc->af, &svc->addr),
1405                               ntohs(svc->port), atomic_read(&svc->usecnt));
1406                 free_percpu(svc->stats.cpustats);
1407                 kfree(svc);
1408         }
1409
1410         /* decrease the module use count */
1411         ip_vs_use_count_dec();
1412 }
1413
1414 /*
1415  * Unlink a service from list and try to delete it if its refcnt reached 0
1416  */
1417 static void ip_vs_unlink_service(struct ip_vs_service *svc)
1418 {
1419         /*
1420          * Unhash it from the service table
1421          */
1422         write_lock_bh(&__ip_vs_svc_lock);
1423
1424         ip_vs_svc_unhash(svc);
1425
1426         /*
1427          * Wait until all the svc users go away.
1428          */
1429         IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1430
1431         __ip_vs_del_service(svc);
1432
1433         write_unlock_bh(&__ip_vs_svc_lock);
1434 }
1435
1436 /*
1437  *      Delete a service from the service list
1438  */
1439 static int ip_vs_del_service(struct ip_vs_service *svc)
1440 {
1441         if (svc == NULL)
1442                 return -EEXIST;
1443         ip_vs_unlink_service(svc);
1444
1445         return 0;
1446 }
1447
1448
1449 /*
1450  *      Flush all the virtual services
1451  */
1452 static int ip_vs_flush(struct net *net)
1453 {
1454         int idx;
1455         struct ip_vs_service *svc, *nxt;
1456
1457         /*
1458          * Flush the service table hashed by <netns,protocol,addr,port>
1459          */
1460         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1461                 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx],
1462                                          s_list) {
1463                         if (net_eq(svc->net, net))
1464                                 ip_vs_unlink_service(svc);
1465                 }
1466         }
1467
1468         /*
1469          * Flush the service table hashed by fwmark
1470          */
1471         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1472                 list_for_each_entry_safe(svc, nxt,
1473                                          &ip_vs_svc_fwm_table[idx], f_list) {
1474                         if (net_eq(svc->net, net))
1475                                 ip_vs_unlink_service(svc);
1476                 }
1477         }
1478
1479         return 0;
1480 }
1481
1482 /*
1483  *      Delete service by {netns} in the service table.
1484  *      Called by __ip_vs_cleanup()
1485  */
1486 void ip_vs_service_net_cleanup(struct net *net)
1487 {
1488         EnterFunction(2);
1489         /* Check for "full" addressed entries */
1490         mutex_lock(&__ip_vs_mutex);
1491         ip_vs_flush(net);
1492         mutex_unlock(&__ip_vs_mutex);
1493         LeaveFunction(2);
1494 }
1495 /*
1496  * Release dst hold by dst_cache
1497  */
1498 static inline void
1499 __ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1500 {
1501         spin_lock_bh(&dest->dst_lock);
1502         if (dest->dst_cache && dest->dst_cache->dev == dev) {
1503                 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1504                               dev->name,
1505                               IP_VS_DBG_ADDR(dest->af, &dest->addr),
1506                               ntohs(dest->port),
1507                               atomic_read(&dest->refcnt));
1508                 ip_vs_dst_reset(dest);
1509         }
1510         spin_unlock_bh(&dest->dst_lock);
1511
1512 }
1513 /*
1514  * Netdev event receiver
1515  * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1516  * a device that is "unregister" it must be released.
1517  */
1518 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1519                             void *ptr)
1520 {
1521         struct net_device *dev = ptr;
1522         struct net *net = dev_net(dev);
1523         struct ip_vs_service *svc;
1524         struct ip_vs_dest *dest;
1525         unsigned int idx;
1526
1527         if (event != NETDEV_UNREGISTER)
1528                 return NOTIFY_DONE;
1529         IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1530         EnterFunction(2);
1531         mutex_lock(&__ip_vs_mutex);
1532         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1533                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1534                         if (net_eq(svc->net, net)) {
1535                                 list_for_each_entry(dest, &svc->destinations,
1536                                                     n_list) {
1537                                         __ip_vs_dev_reset(dest, dev);
1538                                 }
1539                         }
1540                 }
1541
1542                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1543                         if (net_eq(svc->net, net)) {
1544                                 list_for_each_entry(dest, &svc->destinations,
1545                                                     n_list) {
1546                                         __ip_vs_dev_reset(dest, dev);
1547                                 }
1548                         }
1549
1550                 }
1551         }
1552
1553         list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
1554                 __ip_vs_dev_reset(dest, dev);
1555         }
1556         mutex_unlock(&__ip_vs_mutex);
1557         LeaveFunction(2);
1558         return NOTIFY_DONE;
1559 }
1560
1561 /*
1562  *      Zero counters in a service or all services
1563  */
1564 static int ip_vs_zero_service(struct ip_vs_service *svc)
1565 {
1566         struct ip_vs_dest *dest;
1567
1568         write_lock_bh(&__ip_vs_svc_lock);
1569         list_for_each_entry(dest, &svc->destinations, n_list) {
1570                 ip_vs_zero_stats(&dest->stats);
1571         }
1572         ip_vs_zero_stats(&svc->stats);
1573         write_unlock_bh(&__ip_vs_svc_lock);
1574         return 0;
1575 }
1576
1577 static int ip_vs_zero_all(struct net *net)
1578 {
1579         int idx;
1580         struct ip_vs_service *svc;
1581
1582         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1583                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1584                         if (net_eq(svc->net, net))
1585                                 ip_vs_zero_service(svc);
1586                 }
1587         }
1588
1589         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1590                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1591                         if (net_eq(svc->net, net))
1592                                 ip_vs_zero_service(svc);
1593                 }
1594         }
1595
1596         ip_vs_zero_stats(&net_ipvs(net)->tot_stats);
1597         return 0;
1598 }
1599
1600 #ifdef CONFIG_SYSCTL
1601 static int
1602 proc_do_defense_mode(ctl_table *table, int write,
1603                      void __user *buffer, size_t *lenp, loff_t *ppos)
1604 {
1605         struct net *net = current->nsproxy->net_ns;
1606         int *valp = table->data;
1607         int val = *valp;
1608         int rc;
1609
1610         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1611         if (write && (*valp != val)) {
1612                 if ((*valp < 0) || (*valp > 3)) {
1613                         /* Restore the correct value */
1614                         *valp = val;
1615                 } else {
1616                         update_defense_level(net_ipvs(net));
1617                 }
1618         }
1619         return rc;
1620 }
1621
1622 static int
1623 proc_do_sync_threshold(ctl_table *table, int write,
1624                        void __user *buffer, size_t *lenp, loff_t *ppos)
1625 {
1626         int *valp = table->data;
1627         int val[2];
1628         int rc;
1629
1630         /* backup the value first */
1631         memcpy(val, valp, sizeof(val));
1632
1633         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1634         if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1635                 /* Restore the correct value */
1636                 memcpy(valp, val, sizeof(val));
1637         }
1638         return rc;
1639 }
1640
1641 static int
1642 proc_do_sync_mode(ctl_table *table, int write,
1643                      void __user *buffer, size_t *lenp, loff_t *ppos)
1644 {
1645         int *valp = table->data;
1646         int val = *valp;
1647         int rc;
1648
1649         rc = proc_dointvec(table, write, buffer, lenp, ppos);
1650         if (write && (*valp != val)) {
1651                 if ((*valp < 0) || (*valp > 1)) {
1652                         /* Restore the correct value */
1653                         *valp = val;
1654                 } else {
1655                         struct net *net = current->nsproxy->net_ns;
1656                         ip_vs_sync_switch_mode(net, val);
1657                 }
1658         }
1659         return rc;
1660 }
1661
1662 /*
1663  *      IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1664  *      Do not change order or insert new entries without
1665  *      align with netns init in ip_vs_control_net_init()
1666  */
1667
1668 static struct ctl_table vs_vars[] = {
1669         {
1670                 .procname       = "amemthresh",
1671                 .maxlen         = sizeof(int),
1672                 .mode           = 0644,
1673                 .proc_handler   = proc_dointvec,
1674         },
1675         {
1676                 .procname       = "am_droprate",
1677                 .maxlen         = sizeof(int),
1678                 .mode           = 0644,
1679                 .proc_handler   = proc_dointvec,
1680         },
1681         {
1682                 .procname       = "drop_entry",
1683                 .maxlen         = sizeof(int),
1684                 .mode           = 0644,
1685                 .proc_handler   = proc_do_defense_mode,
1686         },
1687         {
1688                 .procname       = "drop_packet",
1689                 .maxlen         = sizeof(int),
1690                 .mode           = 0644,
1691                 .proc_handler   = proc_do_defense_mode,
1692         },
1693 #ifdef CONFIG_IP_VS_NFCT
1694         {
1695                 .procname       = "conntrack",
1696                 .maxlen         = sizeof(int),
1697                 .mode           = 0644,
1698                 .proc_handler   = &proc_dointvec,
1699         },
1700 #endif
1701         {
1702                 .procname       = "secure_tcp",
1703                 .maxlen         = sizeof(int),
1704                 .mode           = 0644,
1705                 .proc_handler   = proc_do_defense_mode,
1706         },
1707         {
1708                 .procname       = "snat_reroute",
1709                 .maxlen         = sizeof(int),
1710                 .mode           = 0644,
1711                 .proc_handler   = &proc_dointvec,
1712         },
1713         {
1714                 .procname       = "sync_version",
1715                 .maxlen         = sizeof(int),
1716                 .mode           = 0644,
1717                 .proc_handler   = &proc_do_sync_mode,
1718         },
1719         {
1720                 .procname       = "cache_bypass",
1721                 .maxlen         = sizeof(int),
1722                 .mode           = 0644,
1723                 .proc_handler   = proc_dointvec,
1724         },
1725         {
1726                 .procname       = "expire_nodest_conn",
1727                 .maxlen         = sizeof(int),
1728                 .mode           = 0644,
1729                 .proc_handler   = proc_dointvec,
1730         },
1731         {
1732                 .procname       = "expire_quiescent_template",
1733                 .maxlen         = sizeof(int),
1734                 .mode           = 0644,
1735                 .proc_handler   = proc_dointvec,
1736         },
1737         {
1738                 .procname       = "sync_threshold",
1739                 .maxlen         =
1740                         sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold),
1741                 .mode           = 0644,
1742                 .proc_handler   = proc_do_sync_threshold,
1743         },
1744         {
1745                 .procname       = "nat_icmp_send",
1746                 .maxlen         = sizeof(int),
1747                 .mode           = 0644,
1748                 .proc_handler   = proc_dointvec,
1749         },
1750 #ifdef CONFIG_IP_VS_DEBUG
1751         {
1752                 .procname       = "debug_level",
1753                 .data           = &sysctl_ip_vs_debug_level,
1754                 .maxlen         = sizeof(int),
1755                 .mode           = 0644,
1756                 .proc_handler   = proc_dointvec,
1757         },
1758 #endif
1759 #if 0
1760         {
1761                 .procname       = "timeout_established",
1762                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1763                 .maxlen         = sizeof(int),
1764                 .mode           = 0644,
1765                 .proc_handler   = proc_dointvec_jiffies,
1766         },
1767         {
1768                 .procname       = "timeout_synsent",
1769                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1770                 .maxlen         = sizeof(int),
1771                 .mode           = 0644,
1772                 .proc_handler   = proc_dointvec_jiffies,
1773         },
1774         {
1775                 .procname       = "timeout_synrecv",
1776                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1777                 .maxlen         = sizeof(int),
1778                 .mode           = 0644,
1779                 .proc_handler   = proc_dointvec_jiffies,
1780         },
1781         {
1782                 .procname       = "timeout_finwait",
1783                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1784                 .maxlen         = sizeof(int),
1785                 .mode           = 0644,
1786                 .proc_handler   = proc_dointvec_jiffies,
1787         },
1788         {
1789                 .procname       = "timeout_timewait",
1790                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1791                 .maxlen         = sizeof(int),
1792                 .mode           = 0644,
1793                 .proc_handler   = proc_dointvec_jiffies,
1794         },
1795         {
1796                 .procname       = "timeout_close",
1797                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1798                 .maxlen         = sizeof(int),
1799                 .mode           = 0644,
1800                 .proc_handler   = proc_dointvec_jiffies,
1801         },
1802         {
1803                 .procname       = "timeout_closewait",
1804                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1805                 .maxlen         = sizeof(int),
1806                 .mode           = 0644,
1807                 .proc_handler   = proc_dointvec_jiffies,
1808         },
1809         {
1810                 .procname       = "timeout_lastack",
1811                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1812                 .maxlen         = sizeof(int),
1813                 .mode           = 0644,
1814                 .proc_handler   = proc_dointvec_jiffies,
1815         },
1816         {
1817                 .procname       = "timeout_listen",
1818                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1819                 .maxlen         = sizeof(int),
1820                 .mode           = 0644,
1821                 .proc_handler   = proc_dointvec_jiffies,
1822         },
1823         {
1824                 .procname       = "timeout_synack",
1825                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1826                 .maxlen         = sizeof(int),
1827                 .mode           = 0644,
1828                 .proc_handler   = proc_dointvec_jiffies,
1829         },
1830         {
1831                 .procname       = "timeout_udp",
1832                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1833                 .maxlen         = sizeof(int),
1834                 .mode           = 0644,
1835                 .proc_handler   = proc_dointvec_jiffies,
1836         },
1837         {
1838                 .procname       = "timeout_icmp",
1839                 .data   = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1840                 .maxlen         = sizeof(int),
1841                 .mode           = 0644,
1842                 .proc_handler   = proc_dointvec_jiffies,
1843         },
1844 #endif
1845         { }
1846 };
1847
1848 const struct ctl_path net_vs_ctl_path[] = {
1849         { .procname = "net", },
1850         { .procname = "ipv4", },
1851         { .procname = "vs", },
1852         { }
1853 };
1854 EXPORT_SYMBOL_GPL(net_vs_ctl_path);
1855 #endif
1856
1857 #ifdef CONFIG_PROC_FS
1858
1859 struct ip_vs_iter {
1860         struct seq_net_private p;  /* Do not move this, netns depends upon it*/
1861         struct list_head *table;
1862         int bucket;
1863 };
1864
1865 /*
1866  *      Write the contents of the VS rule table to a PROCfs file.
1867  *      (It is kept just for backward compatibility)
1868  */
1869 static inline const char *ip_vs_fwd_name(unsigned flags)
1870 {
1871         switch (flags & IP_VS_CONN_F_FWD_MASK) {
1872         case IP_VS_CONN_F_LOCALNODE:
1873                 return "Local";
1874         case IP_VS_CONN_F_TUNNEL:
1875                 return "Tunnel";
1876         case IP_VS_CONN_F_DROUTE:
1877                 return "Route";
1878         default:
1879                 return "Masq";
1880         }
1881 }
1882
1883
1884 /* Get the Nth entry in the two lists */
1885 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1886 {
1887         struct net *net = seq_file_net(seq);
1888         struct ip_vs_iter *iter = seq->private;
1889         int idx;
1890         struct ip_vs_service *svc;
1891
1892         /* look in hash by protocol */
1893         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1894                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1895                         if (net_eq(svc->net, net) && pos-- == 0) {
1896                                 iter->table = ip_vs_svc_table;
1897                                 iter->bucket = idx;
1898                                 return svc;
1899                         }
1900                 }
1901         }
1902
1903         /* keep looking in fwmark */
1904         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1905                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1906                         if (net_eq(svc->net, net) && pos-- == 0) {
1907                                 iter->table = ip_vs_svc_fwm_table;
1908                                 iter->bucket = idx;
1909                                 return svc;
1910                         }
1911                 }
1912         }
1913
1914         return NULL;
1915 }
1916
1917 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1918 __acquires(__ip_vs_svc_lock)
1919 {
1920
1921         read_lock_bh(&__ip_vs_svc_lock);
1922         return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1923 }
1924
1925
1926 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1927 {
1928         struct list_head *e;
1929         struct ip_vs_iter *iter;
1930         struct ip_vs_service *svc;
1931
1932         ++*pos;
1933         if (v == SEQ_START_TOKEN)
1934                 return ip_vs_info_array(seq,0);
1935
1936         svc = v;
1937         iter = seq->private;
1938
1939         if (iter->table == ip_vs_svc_table) {
1940                 /* next service in table hashed by protocol */
1941                 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1942                         return list_entry(e, struct ip_vs_service, s_list);
1943
1944
1945                 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1946                         list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1947                                             s_list) {
1948                                 return svc;
1949                         }
1950                 }
1951
1952                 iter->table = ip_vs_svc_fwm_table;
1953                 iter->bucket = -1;
1954                 goto scan_fwmark;
1955         }
1956
1957         /* next service in hashed by fwmark */
1958         if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1959                 return list_entry(e, struct ip_vs_service, f_list);
1960
1961  scan_fwmark:
1962         while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1963                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1964                                     f_list)
1965                         return svc;
1966         }
1967
1968         return NULL;
1969 }
1970
1971 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
1972 __releases(__ip_vs_svc_lock)
1973 {
1974         read_unlock_bh(&__ip_vs_svc_lock);
1975 }
1976
1977
1978 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1979 {
1980         if (v == SEQ_START_TOKEN) {
1981                 seq_printf(seq,
1982                         "IP Virtual Server version %d.%d.%d (size=%d)\n",
1983                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
1984                 seq_puts(seq,
1985                          "Prot LocalAddress:Port Scheduler Flags\n");
1986                 seq_puts(seq,
1987                          "  -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1988         } else {
1989                 const struct ip_vs_service *svc = v;
1990                 const struct ip_vs_iter *iter = seq->private;
1991                 const struct ip_vs_dest *dest;
1992
1993                 if (iter->table == ip_vs_svc_table) {
1994 #ifdef CONFIG_IP_VS_IPV6
1995                         if (svc->af == AF_INET6)
1996                                 seq_printf(seq, "%s  [%pI6]:%04X %s ",
1997                                            ip_vs_proto_name(svc->protocol),
1998                                            &svc->addr.in6,
1999                                            ntohs(svc->port),
2000                                            svc->scheduler->name);
2001                         else
2002 #endif
2003                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
2004                                            ip_vs_proto_name(svc->protocol),
2005                                            ntohl(svc->addr.ip),
2006                                            ntohs(svc->port),
2007                                            svc->scheduler->name,
2008                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2009                 } else {
2010                         seq_printf(seq, "FWM  %08X %s %s",
2011                                    svc->fwmark, svc->scheduler->name,
2012                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
2013                 }
2014
2015                 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
2016                         seq_printf(seq, "persistent %d %08X\n",
2017                                 svc->timeout,
2018                                 ntohl(svc->netmask));
2019                 else
2020                         seq_putc(seq, '\n');
2021
2022                 list_for_each_entry(dest, &svc->destinations, n_list) {
2023 #ifdef CONFIG_IP_VS_IPV6
2024                         if (dest->af == AF_INET6)
2025                                 seq_printf(seq,
2026                                            "  -> [%pI6]:%04X"
2027                                            "      %-7s %-6d %-10d %-10d\n",
2028                                            &dest->addr.in6,
2029                                            ntohs(dest->port),
2030                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2031                                            atomic_read(&dest->weight),
2032                                            atomic_read(&dest->activeconns),
2033                                            atomic_read(&dest->inactconns));
2034                         else
2035 #endif
2036                                 seq_printf(seq,
2037                                            "  -> %08X:%04X      "
2038                                            "%-7s %-6d %-10d %-10d\n",
2039                                            ntohl(dest->addr.ip),
2040                                            ntohs(dest->port),
2041                                            ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
2042                                            atomic_read(&dest->weight),
2043                                            atomic_read(&dest->activeconns),
2044                                            atomic_read(&dest->inactconns));
2045
2046                 }
2047         }
2048         return 0;
2049 }
2050
2051 static const struct seq_operations ip_vs_info_seq_ops = {
2052         .start = ip_vs_info_seq_start,
2053         .next  = ip_vs_info_seq_next,
2054         .stop  = ip_vs_info_seq_stop,
2055         .show  = ip_vs_info_seq_show,
2056 };
2057
2058 static int ip_vs_info_open(struct inode *inode, struct file *file)
2059 {
2060         return seq_open_net(inode, file, &ip_vs_info_seq_ops,
2061                         sizeof(struct ip_vs_iter));
2062 }
2063
2064 static const struct file_operations ip_vs_info_fops = {
2065         .owner   = THIS_MODULE,
2066         .open    = ip_vs_info_open,
2067         .read    = seq_read,
2068         .llseek  = seq_lseek,
2069         .release = seq_release_net,
2070 };
2071
2072 static int ip_vs_stats_show(struct seq_file *seq, void *v)
2073 {
2074         struct net *net = seq_file_single_net(seq);
2075         struct ip_vs_stats_user show;
2076
2077 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2078         seq_puts(seq,
2079                  "   Total Incoming Outgoing         Incoming         Outgoing\n");
2080         seq_printf(seq,
2081                    "   Conns  Packets  Packets            Bytes            Bytes\n");
2082
2083         ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats);
2084         seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", show.conns,
2085                    show.inpkts, show.outpkts,
2086                    (unsigned long long) show.inbytes,
2087                    (unsigned long long) show.outbytes);
2088
2089 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2090         seq_puts(seq,
2091                    " Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2092         seq_printf(seq, "%8X %8X %8X %16X %16X\n",
2093                         show.cps, show.inpps, show.outpps,
2094                         show.inbps, show.outbps);
2095
2096         return 0;
2097 }
2098
2099 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
2100 {
2101         return single_open_net(inode, file, ip_vs_stats_show);
2102 }
2103
2104 static const struct file_operations ip_vs_stats_fops = {
2105         .owner = THIS_MODULE,
2106         .open = ip_vs_stats_seq_open,
2107         .read = seq_read,
2108         .llseek = seq_lseek,
2109         .release = single_release_net,
2110 };
2111
2112 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v)
2113 {
2114         struct net *net = seq_file_single_net(seq);
2115         struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats;
2116         struct ip_vs_cpu_stats *cpustats = tot_stats->cpustats;
2117         struct ip_vs_stats_user rates;
2118         int i;
2119
2120 /*               01234567 01234567 01234567 0123456701234567 0123456701234567 */
2121         seq_puts(seq,
2122                  "       Total Incoming Outgoing         Incoming         Outgoing\n");
2123         seq_printf(seq,
2124                    "CPU    Conns  Packets  Packets            Bytes            Bytes\n");
2125
2126         for_each_possible_cpu(i) {
2127                 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i);
2128                 unsigned int start;
2129                 __u64 inbytes, outbytes;
2130
2131                 do {
2132                         start = u64_stats_fetch_begin_bh(&u->syncp);
2133                         inbytes = u->ustats.inbytes;
2134                         outbytes = u->ustats.outbytes;
2135                 } while (u64_stats_fetch_retry_bh(&u->syncp, start));
2136
2137                 seq_printf(seq, "%3X %8X %8X %8X %16LX %16LX\n",
2138                            i, u->ustats.conns, u->ustats.inpkts,
2139                            u->ustats.outpkts, (__u64)inbytes,
2140                            (__u64)outbytes);
2141         }
2142
2143         spin_lock_bh(&tot_stats->lock);
2144
2145         seq_printf(seq, "  ~ %8X %8X %8X %16LX %16LX\n\n",
2146                    tot_stats->ustats.conns, tot_stats->ustats.inpkts,
2147                    tot_stats->ustats.outpkts,
2148                    (unsigned long long) tot_stats->ustats.inbytes,
2149                    (unsigned long long) tot_stats->ustats.outbytes);
2150
2151         ip_vs_read_estimator(&rates, tot_stats);
2152
2153         spin_unlock_bh(&tot_stats->lock);
2154
2155 /*                 01234567 01234567 01234567 0123456701234567 0123456701234567 */
2156         seq_puts(seq,
2157                    "     Conns/s   Pkts/s   Pkts/s          Bytes/s          Bytes/s\n");
2158         seq_printf(seq, "    %8X %8X %8X %16X %16X\n",
2159                         rates.cps,
2160                         rates.inpps,
2161                         rates.outpps,
2162                         rates.inbps,
2163                         rates.outbps);
2164
2165         return 0;
2166 }
2167
2168 static int ip_vs_stats_percpu_seq_open(struct inode *inode, struct file *file)
2169 {
2170         return single_open_net(inode, file, ip_vs_stats_percpu_show);
2171 }
2172
2173 static const struct file_operations ip_vs_stats_percpu_fops = {
2174         .owner = THIS_MODULE,
2175         .open = ip_vs_stats_percpu_seq_open,
2176         .read = seq_read,
2177         .llseek = seq_lseek,
2178         .release = single_release_net,
2179 };
2180 #endif
2181
2182 /*
2183  *      Set timeout values for tcp tcpfin udp in the timeout_table.
2184  */
2185 static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u)
2186 {
2187 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2188         struct ip_vs_proto_data *pd;
2189 #endif
2190
2191         IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
2192                   u->tcp_timeout,
2193                   u->tcp_fin_timeout,
2194                   u->udp_timeout);
2195
2196 #ifdef CONFIG_IP_VS_PROTO_TCP
2197         if (u->tcp_timeout) {
2198                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2199                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
2200                         = u->tcp_timeout * HZ;
2201         }
2202
2203         if (u->tcp_fin_timeout) {
2204                 pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2205                 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT]
2206                         = u->tcp_fin_timeout * HZ;
2207         }
2208 #endif
2209
2210 #ifdef CONFIG_IP_VS_PROTO_UDP
2211         if (u->udp_timeout) {
2212                 pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2213                 pd->timeout_table[IP_VS_UDP_S_NORMAL]
2214                         = u->udp_timeout * HZ;
2215         }
2216 #endif
2217         return 0;
2218 }
2219
2220
2221 #define SET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2222 #define SERVICE_ARG_LEN         (sizeof(struct ip_vs_service_user))
2223 #define SVCDEST_ARG_LEN         (sizeof(struct ip_vs_service_user) +    \
2224                                  sizeof(struct ip_vs_dest_user))
2225 #define TIMEOUT_ARG_LEN         (sizeof(struct ip_vs_timeout_user))
2226 #define DAEMON_ARG_LEN          (sizeof(struct ip_vs_daemon_user))
2227 #define MAX_ARG_LEN             SVCDEST_ARG_LEN
2228
2229 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
2230         [SET_CMDID(IP_VS_SO_SET_ADD)]           = SERVICE_ARG_LEN,
2231         [SET_CMDID(IP_VS_SO_SET_EDIT)]          = SERVICE_ARG_LEN,
2232         [SET_CMDID(IP_VS_SO_SET_DEL)]           = SERVICE_ARG_LEN,
2233         [SET_CMDID(IP_VS_SO_SET_FLUSH)]         = 0,
2234         [SET_CMDID(IP_VS_SO_SET_ADDDEST)]       = SVCDEST_ARG_LEN,
2235         [SET_CMDID(IP_VS_SO_SET_DELDEST)]       = SVCDEST_ARG_LEN,
2236         [SET_CMDID(IP_VS_SO_SET_EDITDEST)]      = SVCDEST_ARG_LEN,
2237         [SET_CMDID(IP_VS_SO_SET_TIMEOUT)]       = TIMEOUT_ARG_LEN,
2238         [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)]   = DAEMON_ARG_LEN,
2239         [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)]    = DAEMON_ARG_LEN,
2240         [SET_CMDID(IP_VS_SO_SET_ZERO)]          = SERVICE_ARG_LEN,
2241 };
2242
2243 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc,
2244                                   struct ip_vs_service_user *usvc_compat)
2245 {
2246         memset(usvc, 0, sizeof(*usvc));
2247
2248         usvc->af                = AF_INET;
2249         usvc->protocol          = usvc_compat->protocol;
2250         usvc->addr.ip           = usvc_compat->addr;
2251         usvc->port              = usvc_compat->port;
2252         usvc->fwmark            = usvc_compat->fwmark;
2253
2254         /* Deep copy of sched_name is not needed here */
2255         usvc->sched_name        = usvc_compat->sched_name;
2256
2257         usvc->flags             = usvc_compat->flags;
2258         usvc->timeout           = usvc_compat->timeout;
2259         usvc->netmask           = usvc_compat->netmask;
2260 }
2261
2262 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest,
2263                                    struct ip_vs_dest_user *udest_compat)
2264 {
2265         memset(udest, 0, sizeof(*udest));
2266
2267         udest->addr.ip          = udest_compat->addr;
2268         udest->port             = udest_compat->port;
2269         udest->conn_flags       = udest_compat->conn_flags;
2270         udest->weight           = udest_compat->weight;
2271         udest->u_threshold      = udest_compat->u_threshold;
2272         udest->l_threshold      = udest_compat->l_threshold;
2273 }
2274
2275 static int
2276 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2277 {
2278         struct net *net = sock_net(sk);
2279         int ret;
2280         unsigned char arg[MAX_ARG_LEN];
2281         struct ip_vs_service_user *usvc_compat;
2282         struct ip_vs_service_user_kern usvc;
2283         struct ip_vs_service *svc;
2284         struct ip_vs_dest_user *udest_compat;
2285         struct ip_vs_dest_user_kern udest;
2286         struct netns_ipvs *ipvs = net_ipvs(net);
2287
2288         if (!capable(CAP_NET_ADMIN))
2289                 return -EPERM;
2290
2291         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
2292                 return -EINVAL;
2293         if (len < 0 || len >  MAX_ARG_LEN)
2294                 return -EINVAL;
2295         if (len != set_arglen[SET_CMDID(cmd)]) {
2296                 pr_err("set_ctl: len %u != %u\n",
2297                        len, set_arglen[SET_CMDID(cmd)]);
2298                 return -EINVAL;
2299         }
2300
2301         if (copy_from_user(arg, user, len) != 0)
2302                 return -EFAULT;
2303
2304         /* increase the module use count */
2305         ip_vs_use_count_inc();
2306
2307         /* Handle daemons since they have another lock */
2308         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
2309             cmd == IP_VS_SO_SET_STOPDAEMON) {
2310                 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
2311
2312                 if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
2313                         ret = -ERESTARTSYS;
2314                         goto out_dec;
2315                 }
2316                 if (cmd == IP_VS_SO_SET_STARTDAEMON)
2317                         ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
2318                                                 dm->syncid);
2319                 else
2320                         ret = stop_sync_thread(net, dm->state);
2321                 mutex_unlock(&ipvs->sync_mutex);
2322                 goto out_dec;
2323         }
2324
2325         if (mutex_lock_interruptible(&__ip_vs_mutex)) {
2326                 ret = -ERESTARTSYS;
2327                 goto out_dec;
2328         }
2329
2330         if (cmd == IP_VS_SO_SET_FLUSH) {
2331                 /* Flush the virtual service */
2332                 ret = ip_vs_flush(net);
2333                 goto out_unlock;
2334         } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
2335                 /* Set timeout values for (tcp tcpfin udp) */
2336                 ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
2337                 goto out_unlock;
2338         }
2339
2340         usvc_compat = (struct ip_vs_service_user *)arg;
2341         udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1);
2342
2343         /* We only use the new structs internally, so copy userspace compat
2344          * structs to extended internal versions */
2345         ip_vs_copy_usvc_compat(&usvc, usvc_compat);
2346         ip_vs_copy_udest_compat(&udest, udest_compat);
2347
2348         if (cmd == IP_VS_SO_SET_ZERO) {
2349                 /* if no service address is set, zero counters in all */
2350                 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) {
2351                         ret = ip_vs_zero_all(net);
2352                         goto out_unlock;
2353                 }
2354         }
2355
2356         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
2357         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
2358             usvc.protocol != IPPROTO_SCTP) {
2359                 pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
2360                        usvc.protocol, &usvc.addr.ip,
2361                        ntohs(usvc.port), usvc.sched_name);
2362                 ret = -EFAULT;
2363                 goto out_unlock;
2364         }
2365
2366         /* Lookup the exact service by <protocol, addr, port> or fwmark */
2367         if (usvc.fwmark == 0)
2368                 svc = __ip_vs_service_find(net, usvc.af, usvc.protocol,
2369                                            &usvc.addr, usvc.port);
2370         else
2371                 svc = __ip_vs_svc_fwm_find(net, usvc.af, usvc.fwmark);
2372
2373         if (cmd != IP_VS_SO_SET_ADD
2374             && (svc == NULL || svc->protocol != usvc.protocol)) {
2375                 ret = -ESRCH;
2376                 goto out_unlock;
2377         }
2378
2379         switch (cmd) {
2380         case IP_VS_SO_SET_ADD:
2381                 if (svc != NULL)
2382                         ret = -EEXIST;
2383                 else
2384                         ret = ip_vs_add_service(net, &usvc, &svc);
2385                 break;
2386         case IP_VS_SO_SET_EDIT:
2387                 ret = ip_vs_edit_service(svc, &usvc);
2388                 break;
2389         case IP_VS_SO_SET_DEL:
2390                 ret = ip_vs_del_service(svc);
2391                 if (!ret)
2392                         goto out_unlock;
2393                 break;
2394         case IP_VS_SO_SET_ZERO:
2395                 ret = ip_vs_zero_service(svc);
2396                 break;
2397         case IP_VS_SO_SET_ADDDEST:
2398                 ret = ip_vs_add_dest(svc, &udest);
2399                 break;
2400         case IP_VS_SO_SET_EDITDEST:
2401                 ret = ip_vs_edit_dest(svc, &udest);
2402                 break;
2403         case IP_VS_SO_SET_DELDEST:
2404                 ret = ip_vs_del_dest(svc, &udest);
2405                 break;
2406         default:
2407                 ret = -EINVAL;
2408         }
2409
2410   out_unlock:
2411         mutex_unlock(&__ip_vs_mutex);
2412   out_dec:
2413         /* decrease the module use count */
2414         ip_vs_use_count_dec();
2415
2416         return ret;
2417 }
2418
2419
2420 static void
2421 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2422 {
2423         dst->protocol = src->protocol;
2424         dst->addr = src->addr.ip;
2425         dst->port = src->port;
2426         dst->fwmark = src->fwmark;
2427         strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2428         dst->flags = src->flags;
2429         dst->timeout = src->timeout / HZ;
2430         dst->netmask = src->netmask;
2431         dst->num_dests = src->num_dests;
2432         ip_vs_copy_stats(&dst->stats, &src->stats);
2433 }
2434
2435 static inline int
2436 __ip_vs_get_service_entries(struct net *net,
2437                             const struct ip_vs_get_services *get,
2438                             struct ip_vs_get_services __user *uptr)
2439 {
2440         int idx, count=0;
2441         struct ip_vs_service *svc;
2442         struct ip_vs_service_entry entry;
2443         int ret = 0;
2444
2445         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2446                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2447                         /* Only expose IPv4 entries to old interface */
2448                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2449                                 continue;
2450
2451                         if (count >= get->num_services)
2452                                 goto out;
2453                         memset(&entry, 0, sizeof(entry));
2454                         ip_vs_copy_service(&entry, svc);
2455                         if (copy_to_user(&uptr->entrytable[count],
2456                                          &entry, sizeof(entry))) {
2457                                 ret = -EFAULT;
2458                                 goto out;
2459                         }
2460                         count++;
2461                 }
2462         }
2463
2464         for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2465                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2466                         /* Only expose IPv4 entries to old interface */
2467                         if (svc->af != AF_INET || !net_eq(svc->net, net))
2468                                 continue;
2469
2470                         if (count >= get->num_services)
2471                                 goto out;
2472                         memset(&entry, 0, sizeof(entry));
2473                         ip_vs_copy_service(&entry, svc);
2474                         if (copy_to_user(&uptr->entrytable[count],
2475                                          &entry, sizeof(entry))) {
2476                                 ret = -EFAULT;
2477                                 goto out;
2478                         }
2479                         count++;
2480                 }
2481         }
2482 out:
2483         return ret;
2484 }
2485
2486 static inline int
2487 __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
2488                          struct ip_vs_get_dests __user *uptr)
2489 {
2490         struct ip_vs_service *svc;
2491         union nf_inet_addr addr = { .ip = get->addr };
2492         int ret = 0;
2493
2494         if (get->fwmark)
2495                 svc = __ip_vs_svc_fwm_find(net, AF_INET, get->fwmark);
2496         else
2497                 svc = __ip_vs_service_find(net, AF_INET, get->protocol, &addr,
2498                                            get->port);
2499
2500         if (svc) {
2501                 int count = 0;
2502                 struct ip_vs_dest *dest;
2503                 struct ip_vs_dest_entry entry;
2504
2505                 list_for_each_entry(dest, &svc->destinations, n_list) {
2506                         if (count >= get->num_dests)
2507                                 break;
2508
2509                         entry.addr = dest->addr.ip;
2510                         entry.port = dest->port;
2511                         entry.conn_flags = atomic_read(&dest->conn_flags);
2512                         entry.weight = atomic_read(&dest->weight);
2513                         entry.u_threshold = dest->u_threshold;
2514                         entry.l_threshold = dest->l_threshold;
2515                         entry.activeconns = atomic_read(&dest->activeconns);
2516                         entry.inactconns = atomic_read(&dest->inactconns);
2517                         entry.persistconns = atomic_read(&dest->persistconns);
2518                         ip_vs_copy_stats(&entry.stats, &dest->stats);
2519                         if (copy_to_user(&uptr->entrytable[count],
2520                                          &entry, sizeof(entry))) {
2521                                 ret = -EFAULT;
2522                                 break;
2523                         }
2524                         count++;
2525                 }
2526         } else
2527                 ret = -ESRCH;
2528         return ret;
2529 }
2530
2531 static inline void
2532 __ip_vs_get_timeouts(struct net *net, struct ip_vs_timeout_user *u)
2533 {
2534 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP)
2535         struct ip_vs_proto_data *pd;
2536 #endif
2537
2538 #ifdef CONFIG_IP_VS_PROTO_TCP
2539         pd = ip_vs_proto_data_get(net, IPPROTO_TCP);
2540         u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2541         u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2542 #endif
2543 #ifdef CONFIG_IP_VS_PROTO_UDP
2544         pd = ip_vs_proto_data_get(net, IPPROTO_UDP);
2545         u->udp_timeout =
2546                         pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2547 #endif
2548 }
2549
2550
2551 #define GET_CMDID(cmd)          (cmd - IP_VS_BASE_CTL)
2552 #define GET_INFO_ARG_LEN        (sizeof(struct ip_vs_getinfo))
2553 #define GET_SERVICES_ARG_LEN    (sizeof(struct ip_vs_get_services))
2554 #define GET_SERVICE_ARG_LEN     (sizeof(struct ip_vs_service_entry))
2555 #define GET_DESTS_ARG_LEN       (sizeof(struct ip_vs_get_dests))
2556 #define GET_TIMEOUT_ARG_LEN     (sizeof(struct ip_vs_timeout_user))
2557 #define GET_DAEMON_ARG_LEN      (sizeof(struct ip_vs_daemon_user) * 2)
2558
2559 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2560         [GET_CMDID(IP_VS_SO_GET_VERSION)]       = 64,
2561         [GET_CMDID(IP_VS_SO_GET_INFO)]          = GET_INFO_ARG_LEN,
2562         [GET_CMDID(IP_VS_SO_GET_SERVICES)]      = GET_SERVICES_ARG_LEN,
2563         [GET_CMDID(IP_VS_SO_GET_SERVICE)]       = GET_SERVICE_ARG_LEN,
2564         [GET_CMDID(IP_VS_SO_GET_DESTS)]         = GET_DESTS_ARG_LEN,
2565         [GET_CMDID(IP_VS_SO_GET_TIMEOUT)]       = GET_TIMEOUT_ARG_LEN,
2566         [GET_CMDID(IP_VS_SO_GET_DAEMON)]        = GET_DAEMON_ARG_LEN,
2567 };
2568
2569 static int
2570 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2571 {
2572         unsigned char arg[128];
2573         int ret = 0;
2574         unsigned int copylen;
2575         struct net *net = sock_net(sk);
2576         struct netns_ipvs *ipvs = net_ipvs(net);
2577
2578         BUG_ON(!net);
2579         if (!capable(CAP_NET_ADMIN))
2580                 return -EPERM;
2581
2582         if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)
2583                 return -EINVAL;
2584
2585         if (*len < get_arglen[GET_CMDID(cmd)]) {
2586                 pr_err("get_ctl: len %u < %u\n",
2587                        *len, get_arglen[GET_CMDID(cmd)]);
2588                 return -EINVAL;
2589         }
2590
2591         copylen = get_arglen[GET_CMDID(cmd)];
2592         if (copylen > 128)
2593                 return -EINVAL;
2594
2595         if (copy_from_user(arg, user, copylen) != 0)
2596                 return -EFAULT;
2597         /*
2598          * Handle daemons first since it has its own locking
2599          */
2600         if (cmd == IP_VS_SO_GET_DAEMON) {
2601                 struct ip_vs_daemon_user d[2];
2602
2603                 memset(&d, 0, sizeof(d));
2604                 if (mutex_lock_interruptible(&ipvs->sync_mutex))
2605                         return -ERESTARTSYS;
2606
2607                 if (ipvs->sync_state & IP_VS_STATE_MASTER) {
2608                         d[0].state = IP_VS_STATE_MASTER;
2609                         strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
2610                                 sizeof(d[0].mcast_ifn));
2611                         d[0].syncid = ipvs->master_syncid;
2612                 }
2613                 if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
2614                         d[1].state = IP_VS_STATE_BACKUP;
2615                         strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
2616                                 sizeof(d[1].mcast_ifn));
2617                         d[1].syncid = ipvs->backup_syncid;
2618                 }
2619                 if (copy_to_user(user, &d, sizeof(d)) != 0)
2620                         ret = -EFAULT;
2621                 mutex_unlock(&ipvs->sync_mutex);
2622                 return ret;
2623         }
2624
2625         if (mutex_lock_interruptible(&__ip_vs_mutex))
2626                 return -ERESTARTSYS;
2627
2628         switch (cmd) {
2629         case IP_VS_SO_GET_VERSION:
2630         {
2631                 char buf[64];
2632
2633                 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2634                         NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size);
2635                 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2636                         ret = -EFAULT;
2637                         goto out;
2638                 }
2639                 *len = strlen(buf)+1;
2640         }
2641         break;
2642
2643         case IP_VS_SO_GET_INFO:
2644         {
2645                 struct ip_vs_getinfo info;
2646                 info.version = IP_VS_VERSION_CODE;
2647                 info.size = ip_vs_conn_tab_size;
2648                 info.num_services = ipvs->num_services;
2649                 if (copy_to_user(user, &info, sizeof(info)) != 0)
2650                         ret = -EFAULT;
2651         }
2652         break;
2653
2654         case IP_VS_SO_GET_SERVICES:
2655         {
2656                 struct ip_vs_get_services *get;
2657                 int size;
2658
2659                 get = (struct ip_vs_get_services *)arg;
2660                 size = sizeof(*get) +
2661                         sizeof(struct ip_vs_service_entry) * get->num_services;
2662                 if (*len != size) {
2663                         pr_err("length: %u != %u\n", *len, size);
2664                         ret = -EINVAL;
2665                         goto out;
2666                 }
2667                 ret = __ip_vs_get_service_entries(net, get, user);
2668         }
2669         break;
2670
2671         case IP_VS_SO_GET_SERVICE:
2672         {
2673                 struct ip_vs_service_entry *entry;
2674                 struct ip_vs_service *svc;
2675                 union nf_inet_addr addr;
2676
2677                 entry = (struct ip_vs_service_entry *)arg;
2678                 addr.ip = entry->addr;
2679                 if (entry->fwmark)
2680                         svc = __ip_vs_svc_fwm_find(net, AF_INET, entry->fwmark);
2681                 else
2682                         svc = __ip_vs_service_find(net, AF_INET,
2683                                                    entry->protocol, &addr,
2684                                                    entry->port);
2685                 if (svc) {
2686                         ip_vs_copy_service(entry, svc);
2687                         if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2688                                 ret = -EFAULT;
2689                 } else
2690                         ret = -ESRCH;
2691         }
2692         break;
2693
2694         case IP_VS_SO_GET_DESTS:
2695         {
2696                 struct ip_vs_get_dests *get;
2697                 int size;
2698
2699                 get = (struct ip_vs_get_dests *)arg;
2700                 size = sizeof(*get) +
2701                         sizeof(struct ip_vs_dest_entry) * get->num_dests;
2702                 if (*len != size) {
2703                         pr_err("length: %u != %u\n", *len, size);
2704                         ret = -EINVAL;
2705                         goto out;
2706                 }
2707                 ret = __ip_vs_get_dest_entries(net, get, user);
2708         }
2709         break;
2710
2711         case IP_VS_SO_GET_TIMEOUT:
2712         {
2713                 struct ip_vs_timeout_user t;
2714
2715                 __ip_vs_get_timeouts(net, &t);
2716                 if (copy_to_user(user, &t, sizeof(t)) != 0)
2717                         ret = -EFAULT;
2718         }
2719         break;
2720
2721         default:
2722                 ret = -EINVAL;
2723         }
2724
2725 out:
2726         mutex_unlock(&__ip_vs_mutex);
2727         return ret;
2728 }
2729
2730
2731 static struct nf_sockopt_ops ip_vs_sockopts = {
2732         .pf             = PF_INET,
2733         .set_optmin     = IP_VS_BASE_CTL,
2734         .set_optmax     = IP_VS_SO_SET_MAX+1,
2735         .set            = do_ip_vs_set_ctl,
2736         .get_optmin     = IP_VS_BASE_CTL,
2737         .get_optmax     = IP_VS_SO_GET_MAX+1,
2738         .get            = do_ip_vs_get_ctl,
2739         .owner          = THIS_MODULE,
2740 };
2741
2742 /*
2743  * Generic Netlink interface
2744  */
2745
2746 /* IPVS genetlink family */
2747 static struct genl_family ip_vs_genl_family = {
2748         .id             = GENL_ID_GENERATE,
2749         .hdrsize        = 0,
2750         .name           = IPVS_GENL_NAME,
2751         .version        = IPVS_GENL_VERSION,
2752         .maxattr        = IPVS_CMD_MAX,
2753         .netnsok        = true,         /* Make ipvsadm to work on netns */
2754 };
2755
2756 /* Policy used for first-level command attributes */
2757 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
2758         [IPVS_CMD_ATTR_SERVICE]         = { .type = NLA_NESTED },
2759         [IPVS_CMD_ATTR_DEST]            = { .type = NLA_NESTED },
2760         [IPVS_CMD_ATTR_DAEMON]          = { .type = NLA_NESTED },
2761         [IPVS_CMD_ATTR_TIMEOUT_TCP]     = { .type = NLA_U32 },
2762         [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 },
2763         [IPVS_CMD_ATTR_TIMEOUT_UDP]     = { .type = NLA_U32 },
2764 };
2765
2766 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */
2767 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
2768         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
2769         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
2770                                             .len = IP_VS_IFNAME_MAXLEN },
2771         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
2772 };
2773
2774 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */
2775 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
2776         [IPVS_SVC_ATTR_AF]              = { .type = NLA_U16 },
2777         [IPVS_SVC_ATTR_PROTOCOL]        = { .type = NLA_U16 },
2778         [IPVS_SVC_ATTR_ADDR]            = { .type = NLA_BINARY,
2779                                             .len = sizeof(union nf_inet_addr) },
2780         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
2781         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
2782         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
2783                                             .len = IP_VS_SCHEDNAME_MAXLEN },
2784         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
2785                                             .len = IP_VS_PENAME_MAXLEN },
2786         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
2787                                             .len = sizeof(struct ip_vs_flags) },
2788         [IPVS_SVC_ATTR_TIMEOUT]         = { .type = NLA_U32 },
2789         [IPVS_SVC_ATTR_NETMASK]         = { .type = NLA_U32 },
2790         [IPVS_SVC_ATTR_STATS]           = { .type = NLA_NESTED },
2791 };
2792
2793 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */
2794 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = {
2795         [IPVS_DEST_ATTR_ADDR]           = { .type = NLA_BINARY,
2796                                             .len = sizeof(union nf_inet_addr) },
2797         [IPVS_DEST_ATTR_PORT]           = { .type = NLA_U16 },
2798         [IPVS_DEST_ATTR_FWD_METHOD]     = { .type = NLA_U32 },
2799         [IPVS_DEST_ATTR_WEIGHT]         = { .type = NLA_U32 },
2800         [IPVS_DEST_ATTR_U_THRESH]       = { .type = NLA_U32 },
2801         [IPVS_DEST_ATTR_L_THRESH]       = { .type = NLA_U32 },
2802         [IPVS_DEST_ATTR_ACTIVE_CONNS]   = { .type = NLA_U32 },
2803         [IPVS_DEST_ATTR_INACT_CONNS]    = { .type = NLA_U32 },
2804         [IPVS_DEST_ATTR_PERSIST_CONNS]  = { .type = NLA_U32 },
2805         [IPVS_DEST_ATTR_STATS]          = { .type = NLA_NESTED },
2806 };
2807
2808 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type,
2809                                  struct ip_vs_stats *stats)
2810 {
2811         struct ip_vs_stats_user ustats;
2812         struct nlattr *nl_stats = nla_nest_start(skb, container_type);
2813         if (!nl_stats)
2814                 return -EMSGSIZE;
2815
2816         ip_vs_copy_stats(&ustats, stats);
2817
2818         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CONNS, ustats.conns);
2819         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPKTS, ustats.inpkts);
2820         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPKTS, ustats.outpkts);
2821         NLA_PUT_U64(skb, IPVS_STATS_ATTR_INBYTES, ustats.inbytes);
2822         NLA_PUT_U64(skb, IPVS_STATS_ATTR_OUTBYTES, ustats.outbytes);
2823         NLA_PUT_U32(skb, IPVS_STATS_ATTR_CPS, ustats.cps);
2824         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INPPS, ustats.inpps);
2825         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTPPS, ustats.outpps);
2826         NLA_PUT_U32(skb, IPVS_STATS_ATTR_INBPS, ustats.inbps);
2827         NLA_PUT_U32(skb, IPVS_STATS_ATTR_OUTBPS, ustats.outbps);
2828
2829         nla_nest_end(skb, nl_stats);
2830
2831         return 0;
2832
2833 nla_put_failure:
2834         nla_nest_cancel(skb, nl_stats);
2835         return -EMSGSIZE;
2836 }
2837
2838 static int ip_vs_genl_fill_service(struct sk_buff *skb,
2839                                    struct ip_vs_service *svc)
2840 {
2841         struct nlattr *nl_service;
2842         struct ip_vs_flags flags = { .flags = svc->flags,
2843                                      .mask = ~0 };
2844
2845         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
2846         if (!nl_service)
2847                 return -EMSGSIZE;
2848
2849         NLA_PUT_U16(skb, IPVS_SVC_ATTR_AF, svc->af);
2850
2851         if (svc->fwmark) {
2852                 NLA_PUT_U32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark);
2853         } else {
2854                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol);
2855                 NLA_PUT(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr);
2856                 NLA_PUT_U16(skb, IPVS_SVC_ATTR_PORT, svc->port);
2857         }
2858
2859         NLA_PUT_STRING(skb, IPVS_SVC_ATTR_SCHED_NAME, svc->scheduler->name);
2860         if (svc->pe)
2861                 NLA_PUT_STRING(skb, IPVS_SVC_ATTR_PE_NAME, svc->pe->name);
2862         NLA_PUT(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags);
2863         NLA_PUT_U32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ);
2864         NLA_PUT_U32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask);
2865
2866         if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &svc->stats))
2867                 goto nla_put_failure;
2868
2869         nla_nest_end(skb, nl_service);
2870
2871         return 0;
2872
2873 nla_put_failure:
2874         nla_nest_cancel(skb, nl_service);
2875         return -EMSGSIZE;
2876 }
2877
2878 static int ip_vs_genl_dump_service(struct sk_buff *skb,
2879                                    struct ip_vs_service *svc,
2880                                    struct netlink_callback *cb)
2881 {
2882         void *hdr;
2883
2884         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
2885                           &ip_vs_genl_family, NLM_F_MULTI,
2886                           IPVS_CMD_NEW_SERVICE);
2887         if (!hdr)
2888                 return -EMSGSIZE;
2889
2890         if (ip_vs_genl_fill_service(skb, svc) < 0)
2891                 goto nla_put_failure;
2892
2893         return genlmsg_end(skb, hdr);
2894
2895 nla_put_failure:
2896         genlmsg_cancel(skb, hdr);
2897         return -EMSGSIZE;
2898 }
2899
2900 static int ip_vs_genl_dump_services(struct sk_buff *skb,
2901                                     struct netlink_callback *cb)
2902 {
2903         int idx = 0, i;
2904         int start = cb->args[0];
2905         struct ip_vs_service *svc;
2906         struct net *net = skb_sknet(skb);
2907
2908         mutex_lock(&__ip_vs_mutex);
2909         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2910                 list_for_each_entry(svc, &ip_vs_svc_table[i], s_list) {
2911                         if (++idx <= start || !net_eq(svc->net, net))
2912                                 continue;
2913                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2914                                 idx--;
2915                                 goto nla_put_failure;
2916                         }
2917                 }
2918         }
2919
2920         for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) {
2921                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) {
2922                         if (++idx <= start || !net_eq(svc->net, net))
2923                                 continue;
2924                         if (ip_vs_genl_dump_service(skb, svc, cb) < 0) {
2925                                 idx--;
2926                                 goto nla_put_failure;
2927                         }
2928                 }
2929         }
2930
2931 nla_put_failure:
2932         mutex_unlock(&__ip_vs_mutex);
2933         cb->args[0] = idx;
2934
2935         return skb->len;
2936 }
2937
2938 static int ip_vs_genl_parse_service(struct net *net,
2939                                     struct ip_vs_service_user_kern *usvc,
2940                                     struct nlattr *nla, int full_entry,
2941                                     struct ip_vs_service **ret_svc)
2942 {
2943         struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1];
2944         struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr;
2945         struct ip_vs_service *svc;
2946
2947         /* Parse mandatory identifying service fields first */
2948         if (nla == NULL ||
2949             nla_parse_nested(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy))
2950                 return -EINVAL;
2951
2952         nla_af          = attrs[IPVS_SVC_ATTR_AF];
2953         nla_protocol    = attrs[IPVS_SVC_ATTR_PROTOCOL];
2954         nla_addr        = attrs[IPVS_SVC_ATTR_ADDR];
2955         nla_port        = attrs[IPVS_SVC_ATTR_PORT];
2956         nla_fwmark      = attrs[IPVS_SVC_ATTR_FWMARK];
2957
2958         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
2959                 return -EINVAL;
2960
2961         memset(usvc, 0, sizeof(*usvc));
2962
2963         usvc->af = nla_get_u16(nla_af);
2964 #ifdef CONFIG_IP_VS_IPV6
2965         if (usvc->af != AF_INET && usvc->af != AF_INET6)
2966 #else
2967         if (usvc->af != AF_INET)
2968 #endif
2969                 return -EAFNOSUPPORT;
2970
2971         if (nla_fwmark) {
2972                 usvc->protocol = IPPROTO_TCP;
2973                 usvc->fwmark = nla_get_u32(nla_fwmark);
2974         } else {
2975                 usvc->protocol = nla_get_u16(nla_protocol);
2976                 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr));
2977                 usvc->port = nla_get_u16(nla_port);
2978                 usvc->fwmark = 0;
2979         }
2980
2981         if (usvc->fwmark)
2982                 svc = __ip_vs_svc_fwm_find(net, usvc->af, usvc->fwmark);
2983         else
2984                 svc = __ip_vs_service_find(net, usvc->af, usvc->protocol,
2985                                            &usvc->addr, usvc->port);
2986         *ret_svc = svc;
2987
2988         /* If a full entry was requested, check for the additional fields */
2989         if (full_entry) {
2990                 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout,
2991                               *nla_netmask;
2992                 struct ip_vs_flags flags;
2993
2994                 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME];
2995                 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME];
2996                 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS];
2997                 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT];
2998                 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK];
2999
3000                 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask))
3001                         return -EINVAL;
3002
3003                 nla_memcpy(&flags, nla_flags, sizeof(flags));
3004
3005                 /* prefill flags from service if it already exists */
3006                 if (svc)
3007                         usvc->flags = svc->flags;
3008
3009                 /* set new flags from userland */
3010                 usvc->flags = (usvc->flags & ~flags.mask) |
3011                               (flags.flags & flags.mask);
3012                 usvc->sched_name = nla_data(nla_sched);
3013                 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL;
3014                 usvc->timeout = nla_get_u32(nla_timeout);
3015                 usvc->netmask = nla_get_u32(nla_netmask);
3016         }
3017
3018         return 0;
3019 }
3020
3021 static struct ip_vs_service *ip_vs_genl_find_service(struct net *net,
3022                                                      struct nlattr *nla)
3023 {
3024         struct ip_vs_service_user_kern usvc;
3025         struct ip_vs_service *svc;
3026         int ret;
3027
3028         ret = ip_vs_genl_parse_service(net, &usvc, nla, 0, &svc);
3029         return ret ? ERR_PTR(ret) : svc;
3030 }
3031
3032 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
3033 {
3034         struct nlattr *nl_dest;
3035
3036         nl_dest = nla_nest_start(skb, IPVS_CMD_ATTR_DEST);
3037         if (!nl_dest)
3038                 return -EMSGSIZE;
3039
3040         NLA_PUT(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr);
3041         NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
3042
3043         NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
3044                     atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
3045         NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
3046         NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
3047         NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
3048         NLA_PUT_U32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS,
3049                     atomic_read(&dest->activeconns));
3050         NLA_PUT_U32(skb, IPVS_DEST_ATTR_INACT_CONNS,
3051                     atomic_read(&dest->inactconns));
3052         NLA_PUT_U32(skb, IPVS_DEST_ATTR_PERSIST_CONNS,
3053                     atomic_read(&dest->persistconns));
3054
3055         if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &dest->stats))
3056                 goto nla_put_failure;
3057
3058         nla_nest_end(skb, nl_dest);
3059
3060         return 0;
3061
3062 nla_put_failure:
3063         nla_nest_cancel(skb, nl_dest);
3064         return -EMSGSIZE;
3065 }
3066
3067 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest,
3068                                 struct netlink_callback *cb)
3069 {
3070         void *hdr;
3071
3072         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3073                           &ip_vs_genl_family, NLM_F_MULTI,
3074                           IPVS_CMD_NEW_DEST);
3075         if (!hdr)
3076                 return -EMSGSIZE;
3077
3078         if (ip_vs_genl_fill_dest(skb, dest) < 0)
3079                 goto nla_put_failure;
3080
3081         return genlmsg_end(skb, hdr);
3082
3083 nla_put_failure:
3084         genlmsg_cancel(skb, hdr);
3085         return -EMSGSIZE;
3086 }
3087
3088 static int ip_vs_genl_dump_dests(struct sk_buff *skb,
3089                                  struct netlink_callback *cb)
3090 {
3091         int idx = 0;
3092         int start = cb->args[0];
3093         struct ip_vs_service *svc;
3094         struct ip_vs_dest *dest;
3095         struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1];
3096         struct net *net = skb_sknet(skb);
3097
3098         mutex_lock(&__ip_vs_mutex);
3099
3100         /* Try to find the service for which to dump destinations */
3101         if (nlmsg_parse(cb->nlh, GENL_HDRLEN, attrs,
3102                         IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy))
3103                 goto out_err;
3104
3105
3106         svc = ip_vs_genl_find_service(net, attrs[IPVS_CMD_ATTR_SERVICE]);
3107         if (IS_ERR(svc) || svc == NULL)
3108                 goto out_err;
3109
3110         /* Dump the destinations */
3111         list_for_each_entry(dest, &svc->destinations, n_list) {
3112                 if (++idx <= start)
3113                         continue;
3114                 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) {
3115                         idx--;
3116                         goto nla_put_failure;
3117                 }
3118         }
3119
3120 nla_put_failure:
3121         cb->args[0] = idx;
3122
3123 out_err:
3124         mutex_unlock(&__ip_vs_mutex);
3125
3126         return skb->len;
3127 }
3128
3129 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
3130                                  struct nlattr *nla, int full_entry)
3131 {
3132         struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1];
3133         struct nlattr *nla_addr, *nla_port;
3134
3135         /* Parse mandatory identifying destination fields first */
3136         if (nla == NULL ||
3137             nla_parse_nested(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy))
3138                 return -EINVAL;
3139
3140         nla_addr        = attrs[IPVS_DEST_ATTR_ADDR];
3141         nla_port        = attrs[IPVS_DEST_ATTR_PORT];
3142
3143         if (!(nla_addr && nla_port))
3144                 return -EINVAL;
3145
3146         memset(udest, 0, sizeof(*udest));
3147
3148         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
3149         udest->port = nla_get_u16(nla_port);
3150
3151         /* If a full entry was requested, check for the additional fields */
3152         if (full_entry) {
3153                 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh,
3154                               *nla_l_thresh;
3155
3156                 nla_fwd         = attrs[IPVS_DEST_ATTR_FWD_METHOD];
3157                 nla_weight      = attrs[IPVS_DEST_ATTR_WEIGHT];
3158                 nla_u_thresh    = attrs[IPVS_DEST_ATTR_U_THRESH];
3159                 nla_l_thresh    = attrs[IPVS_DEST_ATTR_L_THRESH];
3160
3161                 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh))
3162                         return -EINVAL;
3163
3164                 udest->conn_flags = nla_get_u32(nla_fwd)
3165                                     & IP_VS_CONN_F_FWD_MASK;
3166                 udest->weight = nla_get_u32(nla_weight);
3167                 udest->u_threshold = nla_get_u32(nla_u_thresh);
3168                 udest->l_threshold = nla_get_u32(nla_l_thresh);
3169         }
3170
3171         return 0;
3172 }
3173
3174 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __be32 state,
3175                                   const char *mcast_ifn, __be32 syncid)
3176 {
3177         struct nlattr *nl_daemon;
3178
3179         nl_daemon = nla_nest_start(skb, IPVS_CMD_ATTR_DAEMON);
3180         if (!nl_daemon)
3181                 return -EMSGSIZE;
3182
3183         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_STATE, state);
3184         NLA_PUT_STRING(skb, IPVS_DAEMON_ATTR_MCAST_IFN, mcast_ifn);
3185         NLA_PUT_U32(skb, IPVS_DAEMON_ATTR_SYNC_ID, syncid);
3186
3187         nla_nest_end(skb, nl_daemon);
3188
3189         return 0;
3190
3191 nla_put_failure:
3192         nla_nest_cancel(skb, nl_daemon);
3193         return -EMSGSIZE;
3194 }
3195
3196 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __be32 state,
3197                                   const char *mcast_ifn, __be32 syncid,
3198                                   struct netlink_callback *cb)
3199 {
3200         void *hdr;
3201         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq,
3202                           &ip_vs_genl_family, NLM_F_MULTI,
3203                           IPVS_CMD_NEW_DAEMON);
3204         if (!hdr)
3205                 return -EMSGSIZE;
3206
3207         if (ip_vs_genl_fill_daemon(skb, state, mcast_ifn, syncid))
3208                 goto nla_put_failure;
3209
3210         return genlmsg_end(skb, hdr);
3211
3212 nla_put_failure:
3213         genlmsg_cancel(skb, hdr);
3214         return -EMSGSIZE;
3215 }
3216
3217 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
3218                                    struct netlink_callback *cb)
3219 {
3220         struct net *net = skb_sknet(skb);
3221         struct netns_ipvs *ipvs = net_ipvs(net);
3222
3223         mutex_lock(&ipvs->sync_mutex);
3224         if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
3225                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
3226                                            ipvs->master_mcast_ifn,
3227                                            ipvs->master_syncid, cb) < 0)
3228                         goto nla_put_failure;
3229
3230                 cb->args[0] = 1;
3231         }
3232
3233         if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) {
3234                 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP,
3235                                            ipvs->backup_mcast_ifn,
3236                                            ipvs->backup_syncid, cb) < 0)
3237                         goto nla_put_failure;
3238
3239                 cb->args[1] = 1;
3240         }
3241
3242 nla_put_failure:
3243         mutex_unlock(&ipvs->sync_mutex);
3244
3245         return skb->len;
3246 }
3247
3248 static int ip_vs_genl_new_daemon(struct net *net, struct nlattr **attrs)
3249 {
3250         if (!(attrs[IPVS_DAEMON_ATTR_STATE] &&
3251               attrs[IPVS_DAEMON_ATTR_MCAST_IFN] &&
3252               attrs[IPVS_DAEMON_ATTR_SYNC_ID]))
3253                 return -EINVAL;
3254
3255         return start_sync_thread(net,
3256                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]),
3257                                  nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]),
3258                                  nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]));
3259 }
3260
3261 static int ip_vs_genl_del_daemon(struct net *net, struct nlattr **attrs)
3262 {
3263         if (!attrs[IPVS_DAEMON_ATTR_STATE])
3264                 return -EINVAL;
3265
3266         return stop_sync_thread(net,
3267                                 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE]));
3268 }
3269
3270 static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
3271 {
3272         struct ip_vs_timeout_user t;
3273
3274         __ip_vs_get_timeouts(net, &t);
3275
3276         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP])
3277                 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]);
3278
3279         if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN])
3280                 t.tcp_fin_timeout =
3281                         nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]);
3282
3283         if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP])
3284                 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]);
3285
3286         return ip_vs_set_timeout(net, &t);
3287 }
3288
3289 static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
3290 {
3291         int ret = 0, cmd;
3292         struct net *net;
3293         struct netns_ipvs *ipvs;
3294
3295         net = skb_sknet(skb);
3296         ipvs = net_ipvs(net);
3297         cmd = info->genlhdr->cmd;
3298
3299         if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
3300                 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
3301
3302                 mutex_lock(&ipvs->sync_mutex);
3303                 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
3304                     nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
3305                                      info->attrs[IPVS_CMD_ATTR_DAEMON],
3306                                      ip_vs_daemon_policy)) {
3307                         ret = -EINVAL;
3308                         goto out;
3309                 }
3310
3311                 if (cmd == IPVS_CMD_NEW_DAEMON)
3312                         ret = ip_vs_genl_new_daemon(net, daemon_attrs);
3313                 else
3314                         ret = ip_vs_genl_del_daemon(net, daemon_attrs);
3315 out:
3316                 mutex_unlock(&ipvs->sync_mutex);
3317         }
3318         return ret;
3319 }
3320
3321 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
3322 {
3323         struct ip_vs_service *svc = NULL;
3324         struct ip_vs_service_user_kern usvc;
3325         struct ip_vs_dest_user_kern udest;
3326         int ret = 0, cmd;
3327         int need_full_svc = 0, need_full_dest = 0;
3328         struct net *net;
3329         struct netns_ipvs *ipvs;
3330
3331         net = skb_sknet(skb);
3332         ipvs = net_ipvs(net);
3333         cmd = info->genlhdr->cmd;
3334
3335         mutex_lock(&__ip_vs_mutex);
3336
3337         if (cmd == IPVS_CMD_FLUSH) {
3338                 ret = ip_vs_flush(net);
3339                 goto out;
3340         } else if (cmd == IPVS_CMD_SET_CONFIG) {
3341                 ret = ip_vs_genl_set_config(net, info->attrs);
3342                 goto out;
3343         } else if (cmd == IPVS_CMD_ZERO &&
3344                    !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
3345                 ret = ip_vs_zero_all(net);
3346                 goto out;
3347         }
3348
3349         /* All following commands require a service argument, so check if we
3350          * received a valid one. We need a full service specification when
3351          * adding / editing a service. Only identifying members otherwise. */
3352         if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE)
3353                 need_full_svc = 1;
3354
3355         ret = ip_vs_genl_parse_service(net, &usvc,
3356                                        info->attrs[IPVS_CMD_ATTR_SERVICE],
3357                                        need_full_svc, &svc);
3358         if (ret)
3359                 goto out;
3360
3361         /* Unless we're adding a new service, the service must already exist */
3362         if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) {
3363                 ret = -ESRCH;
3364                 goto out;
3365         }
3366
3367         /* Destination commands require a valid destination argument. For
3368          * adding / editing a destination, we need a full destination
3369          * specification. */
3370         if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST ||
3371             cmd == IPVS_CMD_DEL_DEST) {
3372                 if (cmd != IPVS_CMD_DEL_DEST)
3373                         need_full_dest = 1;
3374
3375                 ret = ip_vs_genl_parse_dest(&udest,
3376                                             info->attrs[IPVS_CMD_ATTR_DEST],
3377                                             need_full_dest);
3378                 if (ret)
3379                         goto out;
3380         }
3381
3382         switch (cmd) {
3383         case IPVS_CMD_NEW_SERVICE:
3384                 if (svc == NULL)
3385                         ret = ip_vs_add_service(net, &usvc, &svc);
3386                 else
3387                         ret = -EEXIST;
3388                 break;
3389         case IPVS_CMD_SET_SERVICE:
3390                 ret = ip_vs_edit_service(svc, &usvc);
3391                 break;
3392         case IPVS_CMD_DEL_SERVICE:
3393                 ret = ip_vs_del_service(svc);
3394                 /* do not use svc, it can be freed */
3395                 break;
3396         case IPVS_CMD_NEW_DEST:
3397                 ret = ip_vs_add_dest(svc, &udest);
3398                 break;
3399         case IPVS_CMD_SET_DEST:
3400                 ret = ip_vs_edit_dest(svc, &udest);
3401                 break;
3402         case IPVS_CMD_DEL_DEST:
3403                 ret = ip_vs_del_dest(svc, &udest);
3404                 break;
3405         case IPVS_CMD_ZERO:
3406                 ret = ip_vs_zero_service(svc);
3407                 break;
3408         default:
3409                 ret = -EINVAL;
3410         }
3411
3412 out:
3413         mutex_unlock(&__ip_vs_mutex);
3414
3415         return ret;
3416 }
3417
3418 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info)
3419 {
3420         struct sk_buff *msg;
3421         void *reply;
3422         int ret, cmd, reply_cmd;
3423         struct net *net;
3424         struct netns_ipvs *ipvs;
3425
3426         net = skb_sknet(skb);
3427         ipvs = net_ipvs(net);
3428         cmd = info->genlhdr->cmd;
3429
3430         if (cmd == IPVS_CMD_GET_SERVICE)
3431                 reply_cmd = IPVS_CMD_NEW_SERVICE;
3432         else if (cmd == IPVS_CMD_GET_INFO)
3433                 reply_cmd = IPVS_CMD_SET_INFO;
3434         else if (cmd == IPVS_CMD_GET_CONFIG)
3435                 reply_cmd = IPVS_CMD_SET_CONFIG;
3436         else {
3437                 pr_err("unknown Generic Netlink command\n");
3438                 return -EINVAL;
3439         }
3440
3441         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3442         if (!msg)
3443                 return -ENOMEM;
3444
3445         mutex_lock(&__ip_vs_mutex);
3446
3447         reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd);
3448         if (reply == NULL)
3449                 goto nla_put_failure;
3450
3451         switch (cmd) {
3452         case IPVS_CMD_GET_SERVICE:
3453         {
3454                 struct ip_vs_service *svc;
3455
3456                 svc = ip_vs_genl_find_service(net,
3457                                               info->attrs[IPVS_CMD_ATTR_SERVICE]);
3458                 if (IS_ERR(svc)) {
3459                         ret = PTR_ERR(svc);
3460                         goto out_err;
3461                 } else if (svc) {
3462                         ret = ip_vs_genl_fill_service(msg, svc);
3463                         if (ret)
3464                                 goto nla_put_failure;
3465                 } else {
3466                         ret = -ESRCH;
3467                         goto out_err;
3468                 }
3469
3470                 break;
3471         }
3472
3473         case IPVS_CMD_GET_CONFIG:
3474         {
3475                 struct ip_vs_timeout_user t;
3476
3477                 __ip_vs_get_timeouts(net, &t);
3478 #ifdef CONFIG_IP_VS_PROTO_TCP
3479                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, t.tcp_timeout);
3480                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN,
3481                             t.tcp_fin_timeout);
3482 #endif
3483 #ifdef CONFIG_IP_VS_PROTO_UDP
3484                 NLA_PUT_U32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout);
3485 #endif
3486
3487                 break;
3488         }
3489
3490         case IPVS_CMD_GET_INFO:
3491                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_VERSION, IP_VS_VERSION_CODE);
3492                 NLA_PUT_U32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE,
3493                             ip_vs_conn_tab_size);
3494                 break;
3495         }
3496
3497         genlmsg_end(msg, reply);
3498         ret = genlmsg_reply(msg, info);
3499         goto out;
3500
3501 nla_put_failure:
3502         pr_err("not enough space in Netlink message\n");
3503         ret = -EMSGSIZE;
3504
3505 out_err:
3506         nlmsg_free(msg);
3507 out:
3508         mutex_unlock(&__ip_vs_mutex);
3509
3510         return ret;
3511 }
3512
3513
3514 static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
3515         {
3516                 .cmd    = IPVS_CMD_NEW_SERVICE,
3517                 .flags  = GENL_ADMIN_PERM,
3518                 .policy = ip_vs_cmd_policy,
3519                 .doit   = ip_vs_genl_set_cmd,
3520         },
3521         {
3522                 .cmd    = IPVS_CMD_SET_SERVICE,
3523                 .flags  = GENL_ADMIN_PERM,
3524                 .policy = ip_vs_cmd_policy,
3525                 .doit   = ip_vs_genl_set_cmd,
3526         },
3527         {
3528                 .cmd    = IPVS_CMD_DEL_SERVICE,
3529                 .flags  = GENL_ADMIN_PERM,
3530                 .policy = ip_vs_cmd_policy,
3531                 .doit   = ip_vs_genl_set_cmd,
3532         },
3533         {
3534                 .cmd    = IPVS_CMD_GET_SERVICE,
3535                 .flags  = GENL_ADMIN_PERM,
3536                 .doit   = ip_vs_genl_get_cmd,
3537                 .dumpit = ip_vs_genl_dump_services,
3538                 .policy = ip_vs_cmd_policy,
3539         },
3540         {
3541                 .cmd    = IPVS_CMD_NEW_DEST,
3542                 .flags  = GENL_ADMIN_PERM,
3543                 .policy = ip_vs_cmd_policy,
3544                 .doit   = ip_vs_genl_set_cmd,
3545         },
3546         {
3547                 .cmd    = IPVS_CMD_SET_DEST,
3548                 .flags  = GENL_ADMIN_PERM,
3549                 .policy = ip_vs_cmd_policy,
3550                 .doit   = ip_vs_genl_set_cmd,
3551         },
3552         {
3553                 .cmd    = IPVS_CMD_DEL_DEST,
3554                 .flags  = GENL_ADMIN_PERM,
3555                 .policy = ip_vs_cmd_policy,
3556                 .doit   = ip_vs_genl_set_cmd,
3557         },
3558         {
3559                 .cmd    = IPVS_CMD_GET_DEST,
3560                 .flags  = GENL_ADMIN_PERM,
3561                 .policy = ip_vs_cmd_policy,
3562                 .dumpit = ip_vs_genl_dump_dests,
3563         },
3564         {
3565                 .cmd    = IPVS_CMD_NEW_DAEMON,
3566                 .flags  = GENL_ADMIN_PERM,
3567                 .policy = ip_vs_cmd_policy,
3568                 .doit   = ip_vs_genl_set_daemon,
3569         },
3570         {
3571                 .cmd    = IPVS_CMD_DEL_DAEMON,
3572                 .flags  = GENL_ADMIN_PERM,
3573                 .policy = ip_vs_cmd_policy,
3574                 .doit   = ip_vs_genl_set_daemon,
3575         },
3576         {
3577                 .cmd    = IPVS_CMD_GET_DAEMON,
3578                 .flags  = GENL_ADMIN_PERM,
3579                 .dumpit = ip_vs_genl_dump_daemons,
3580         },
3581         {
3582                 .cmd    = IPVS_CMD_SET_CONFIG,
3583                 .flags  = GENL_ADMIN_PERM,
3584                 .policy = ip_vs_cmd_policy,
3585                 .doit   = ip_vs_genl_set_cmd,
3586         },
3587         {
3588                 .cmd    = IPVS_CMD_GET_CONFIG,
3589                 .flags  = GENL_ADMIN_PERM,
3590                 .doit   = ip_vs_genl_get_cmd,
3591         },
3592         {
3593                 .cmd    = IPVS_CMD_GET_INFO,
3594                 .flags  = GENL_ADMIN_PERM,
3595                 .doit   = ip_vs_genl_get_cmd,
3596         },
3597         {
3598                 .cmd    = IPVS_CMD_ZERO,
3599                 .flags  = GENL_ADMIN_PERM,
3600                 .policy = ip_vs_cmd_policy,
3601                 .doit   = ip_vs_genl_set_cmd,
3602         },
3603         {
3604                 .cmd    = IPVS_CMD_FLUSH,
3605                 .flags  = GENL_ADMIN_PERM,
3606                 .doit   = ip_vs_genl_set_cmd,
3607         },
3608 };
3609
3610 static int __init ip_vs_genl_register(void)
3611 {
3612         return genl_register_family_with_ops(&ip_vs_genl_family,
3613                 ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
3614 }
3615
3616 static void ip_vs_genl_unregister(void)
3617 {
3618         genl_unregister_family(&ip_vs_genl_family);
3619 }
3620
3621 /* End of Generic Netlink interface definitions */
3622
3623 /*
3624  * per netns intit/exit func.
3625  */
3626 #ifdef CONFIG_SYSCTL
3627 int __net_init ip_vs_control_net_init_sysctl(struct net *net)
3628 {
3629         int idx;
3630         struct netns_ipvs *ipvs = net_ipvs(net);
3631         struct ctl_table *tbl;
3632
3633         atomic_set(&ipvs->dropentry, 0);
3634         spin_lock_init(&ipvs->dropentry_lock);
3635         spin_lock_init(&ipvs->droppacket_lock);
3636         spin_lock_init(&ipvs->securetcp_lock);
3637
3638         if (!net_eq(net, &init_net)) {
3639                 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL);
3640                 if (tbl == NULL)
3641                         return -ENOMEM;
3642         } else
3643                 tbl = vs_vars;
3644         /* Initialize sysctl defaults */
3645         idx = 0;
3646         ipvs->sysctl_amemthresh = 1024;
3647         tbl[idx++].data = &ipvs->sysctl_amemthresh;
3648         ipvs->sysctl_am_droprate = 10;
3649         tbl[idx++].data = &ipvs->sysctl_am_droprate;
3650         tbl[idx++].data = &ipvs->sysctl_drop_entry;
3651         tbl[idx++].data = &ipvs->sysctl_drop_packet;
3652 #ifdef CONFIG_IP_VS_NFCT
3653         tbl[idx++].data = &ipvs->sysctl_conntrack;
3654 #endif
3655         tbl[idx++].data = &ipvs->sysctl_secure_tcp;
3656         ipvs->sysctl_snat_reroute = 1;
3657         tbl[idx++].data = &ipvs->sysctl_snat_reroute;
3658         ipvs->sysctl_sync_ver = 1;
3659         tbl[idx++].data = &ipvs->sysctl_sync_ver;
3660         tbl[idx++].data = &ipvs->sysctl_cache_bypass;
3661         tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn;
3662         tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template;
3663         ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD;
3664         ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD;
3665         tbl[idx].data = &ipvs->sysctl_sync_threshold;
3666         tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold);
3667         tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
3668
3669
3670         ipvs->sysctl_hdr = register_net_sysctl_table(net, net_vs_ctl_path,
3671                                                      tbl);
3672         if (ipvs->sysctl_hdr == NULL) {
3673                 if (!net_eq(net, &init_net))
3674                         kfree(tbl);
3675                 return -ENOMEM;
3676         }
3677         ip_vs_start_estimator(net, &ipvs->tot_stats);
3678         ipvs->sysctl_tbl = tbl;
3679         /* Schedule defense work */
3680         INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler);
3681         schedule_delayed_work(&ipvs->defense_work, DEFENSE_TIMER_PERIOD);
3682
3683         return 0;
3684 }
3685
3686 void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
3687 {
3688         struct netns_ipvs *ipvs = net_ipvs(net);
3689
3690         cancel_delayed_work_sync(&ipvs->defense_work);
3691         cancel_work_sync(&ipvs->defense_work.work);
3692         unregister_net_sysctl_table(ipvs->sysctl_hdr);
3693 }
3694
3695 #else
3696
3697 int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
3698 void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net) { }
3699
3700 #endif
3701
3702 static struct notifier_block ip_vs_dst_notifier = {
3703         .notifier_call = ip_vs_dst_event,
3704 };
3705
3706 int __net_init ip_vs_control_net_init(struct net *net)
3707 {
3708         int idx;
3709         struct netns_ipvs *ipvs = net_ipvs(net);
3710
3711         rwlock_init(&ipvs->rs_lock);
3712
3713         /* Initialize rs_table */
3714         for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
3715                 INIT_LIST_HEAD(&ipvs->rs_table[idx]);
3716
3717         INIT_LIST_HEAD(&ipvs->dest_trash);
3718         atomic_set(&ipvs->ftpsvc_counter, 0);
3719         atomic_set(&ipvs->nullsvc_counter, 0);
3720
3721         /* procfs stats */
3722         ipvs->tot_stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
3723         if (!ipvs->tot_stats.cpustats) {
3724                 pr_err("%s(): alloc_percpu.\n", __func__);
3725                 return -ENOMEM;
3726         }
3727         spin_lock_init(&ipvs->tot_stats.lock);
3728
3729         proc_net_fops_create(net, "ip_vs", 0, &ip_vs_info_fops);
3730         proc_net_fops_create(net, "ip_vs_stats", 0, &ip_vs_stats_fops);
3731         proc_net_fops_create(net, "ip_vs_stats_percpu", 0,
3732                              &ip_vs_stats_percpu_fops);
3733
3734         if (ip_vs_control_net_init_sysctl(net))
3735                 goto err;
3736
3737         return 0;
3738
3739 err:
3740         free_percpu(ipvs->tot_stats.cpustats);
3741         return -ENOMEM;
3742 }
3743
3744 void __net_exit ip_vs_control_net_cleanup(struct net *net)
3745 {
3746         struct netns_ipvs *ipvs = net_ipvs(net);
3747
3748         ip_vs_trash_cleanup(net);
3749         ip_vs_stop_estimator(net, &ipvs->tot_stats);
3750         ip_vs_control_net_cleanup_sysctl(net);
3751         proc_net_remove(net, "ip_vs_stats_percpu");
3752         proc_net_remove(net, "ip_vs_stats");
3753         proc_net_remove(net, "ip_vs");
3754         free_percpu(ipvs->tot_stats.cpustats);
3755 }
3756
3757 int __init ip_vs_control_init(void)
3758 {
3759         int idx;
3760         int ret;
3761
3762         EnterFunction(2);
3763
3764         /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
3765         for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
3766                 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
3767                 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
3768         }
3769
3770         smp_wmb();      /* Do we really need it now ? */
3771
3772         ret = nf_register_sockopt(&ip_vs_sockopts);
3773         if (ret) {
3774                 pr_err("cannot register sockopt.\n");
3775                 goto err_sock;
3776         }
3777
3778         ret = ip_vs_genl_register();
3779         if (ret) {
3780                 pr_err("cannot register Generic Netlink interface.\n");
3781                 goto err_genl;
3782         }
3783
3784         ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3785         if (ret < 0)
3786                 goto err_notf;
3787
3788         LeaveFunction(2);
3789         return 0;
3790
3791 err_notf:
3792         ip_vs_genl_unregister();
3793 err_genl:
3794         nf_unregister_sockopt(&ip_vs_sockopts);
3795 err_sock:
3796         return ret;
3797 }
3798
3799
3800 void ip_vs_control_cleanup(void)
3801 {
3802         EnterFunction(2);
3803         unregister_netdevice_notifier(&ip_vs_dst_notifier);
3804         ip_vs_genl_unregister();
3805         nf_unregister_sockopt(&ip_vs_sockopts);
3806         LeaveFunction(2);
3807 }