xref: /linux/net/netfilter/ipvs/ip_vs_conn.c (revision fab183d632628381b466a41479489541ac0e29a0)

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 * IPVS         An implementation of the IP virtual server support for the
 *              LINUX operating system.  IPVS is now implemented as a module
 *              over the Netfilter framework. IPVS can be used to build a
 *              high-performance and highly available server based on a
 *              cluster of servers.
 *
 * Authors:     Wensong Zhang <wensong@linuxvirtualserver.org>
 *              Peter Kese <peter.kese@ijs.si>
 *              Julian Anastasov <ja@ssi.bg>
 *
 * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese,
 * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms
 * and others. Many code here is taken from IP MASQ code of kernel 2.2.
 *
 * Changes:
 */

#define pr_fmt(fmt) "IPVS: " fmt

#include <linux/interrupt.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/net.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/proc_fs.h>		/* for proc_net_* */
#include <linux/slab.h>
#include <linux/seq_file.h>
#include <linux/jhash.h>
#include <linux/random.h>
#include <linux/rcupdate_wait.h>

#include <net/net_namespace.h>
#include <net/ip_vs.h>


#ifndef CONFIG_IP_VS_TAB_BITS
#define CONFIG_IP_VS_TAB_BITS	12
#endif

/*
 * Connection hash size. Default is what was selected at compile time.
*/
static int ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
module_param_named(conn_tab_bits, ip_vs_conn_tab_bits, int, 0444);
MODULE_PARM_DESC(conn_tab_bits, "Set connections' hash size");

/* Max table size */
int ip_vs_conn_tab_size __read_mostly;

/*  SLAB cache for IPVS connections */
static struct kmem_cache *ip_vs_conn_cachep __read_mostly;

/* We need an addrstrlen that works with or without v6 */
#ifdef CONFIG_IP_VS_IPV6
#define IP_VS_ADDRSTRLEN INET6_ADDRSTRLEN
#else
#define IP_VS_ADDRSTRLEN (8+1)
#endif

/* Connection hashing:
 * - hash (add conn) and unhash (del conn) are safe for RCU readers walking
 * the bucket, they will not jump to another bucket or hash table and to miss
 * conns
 * - rehash (fill cport) hashes the conn to new bucket or even new table,
 * so we use seqcount to retry lookups on buckets where we delete
 * conns (unhash) because after hashing their next ptr can point to another
 * bucket or hash table
 * - hash table resize works like rehash but always rehashes into new table
 * - bit lock on bucket serializes all operations that modify the chain
 * - on resize, bucket from the old table is locked before bucket from the
 * new table
 * - cp->lock protects conn fields like cp->flags, cp->dest
 */

/**
 * conn_tab_lock - Lock conn_tab buckets for conn hash/unhash, not for rehash
 * @t:		hash table for hn0, new_tbl when new_hash=true
 * @t2:		hash table for hn1, new_tbl when new_hash2=true
 * @cp:		connection
 * @hash_key:	hash key for hn0
 * @hash_key2:	hash key for hn1
 * @use2:	using hn1 (double hashing) based on the forwarding method
 * @new_hash:	mode for hn0, hash node (true) or seek node (false)
 * @new_hash2:	mode for hn1, hash node (true) or seek node (false)
 * @head_ret:	returned head for hn0
 * @head2_ret:	returned head for hn1
 *
 * We support 3 modes:
 * - seek mode for both nodes, used for unhashing
 * - hash mode for both nodes, used for hashing
 * - seek hn0 and hash hn1, used when forwarding method is changed
 */
static __always_inline void
conn_tab_lock(struct ip_vs_rht *t, struct ip_vs_rht *t2, struct ip_vs_conn *cp,
	      u32 hash_key, u32 hash_key2, bool use2, bool new_hash,
	      bool new_hash2, struct hlist_bl_head **head_ret,
	      struct hlist_bl_head **head2_ret)
{
	struct hlist_bl_head *head, *head2;
	u32 hash_key_new, hash_key_new2;
	int idx = 0, idx2 = 0;

	/* Advance idx2 when new_hash is not set but hash_key2
	 * is for new table
	 */
	if (new_hash2 && use2 && t != t2)
		idx2++;

	if (!new_hash) {
		/* We need to lock the bucket in the right table */

retry:
		if (!ip_vs_rht_same_table(t, hash_key)) {
			/* It is already moved to new table */
			t = rcu_dereference(t->new_tbl);
			/* Rehashing works in two steps and we may detect
			 * both nodes in different tables, use idx/idx2
			 * for proper lock ordering for heads.
			 */
			idx++;
		}
	}
	if (use2 && !new_hash2 && !ip_vs_rht_same_table(t2, hash_key2)) {
		/* It is already moved to new table */
		t2 = rcu_dereference(t2->new_tbl);
		idx2++;
	}

	if (!use2)
		idx2 = idx;
	head = t->buckets + (hash_key & t->mask);
	head2 = use2 ? t2->buckets + (hash_key2 & t2->mask) : head;

	if (idx > idx2 || (head > head2 && idx == idx2)) {
		hlist_bl_lock(head2);
		hlist_bl_lock(head);
	} else {
		hlist_bl_lock(head);
		if (head != head2)
			hlist_bl_lock(head2);
	}
	if (!new_hash) {
		bool changed;

		/* Ensure hash_key is read under lock */
		hash_key_new = READ_ONCE(cp->hn0.hash_key);
		changed = hash_key != hash_key_new;
		if (use2 && !new_hash2) {
			hash_key_new2 = READ_ONCE(cp->hn1.hash_key);
			changed |= hash_key2 != hash_key_new2;
		} else {
			hash_key_new2 = hash_key2;
		}
		/* Hash changed ? */
		if (changed) {
			if (head != head2)
				hlist_bl_unlock(head2);
			hlist_bl_unlock(head);
			hash_key = hash_key_new;
			hash_key2 = hash_key_new2;
			goto retry;
		}
	}
	*head_ret = head;
	*head2_ret = head2;
}

static inline void conn_tab_unlock(struct hlist_bl_head *head,
				   struct hlist_bl_head *head2)
{
	if (head != head2)
		hlist_bl_unlock(head2);
	hlist_bl_unlock(head);
}

static void ip_vs_conn_expire(struct timer_list *t);

/*
 *	Returns hash value for IPVS connection entry
 */
static u32 ip_vs_conn_hashkey(struct ip_vs_rht *t, int af, unsigned int proto,
			      const union nf_inet_addr *addr, __be16 port,
			      const union nf_inet_addr *laddr, __be16 lport)
{
	u64 a = (u32)proto << 16 | (__force u32)port;
	u64 d;

#ifdef CONFIG_IP_VS_IPV6
	if (af == AF_INET6) {
		u64 b = (u64)addr->all[0] << 32 | addr->all[1];
		u64 c = (u64)addr->all[2] << 32 | addr->all[3];

		a |= (u64)laddr->all[2] << 32 ^ (__force u32)lport;
		c ^= laddr->all[1];
		d = (u64)laddr->all[0] << 32 | laddr->all[3];
		return (u32)siphash_4u64(a, b, c, d, &t->hash_key);
	}
#endif
	a |= (u64)addr->all[0] << 32;
	d = (u64)laddr->all[0] << 32 | (__force u32)lport;
	return (u32)siphash_2u64(a, d, &t->hash_key);
}

static unsigned int ip_vs_conn_hashkey_param(const struct ip_vs_conn_param *p,
					     struct ip_vs_rht *t, bool inverse)
{
	const union nf_inet_addr *laddr;
	const union nf_inet_addr *addr;
	__be16 lport;
	__be16 port;

	if (p->pe_data && p->pe->hashkey_raw)
		return p->pe->hashkey_raw(p, t, inverse);

	if (likely(!inverse)) {
		addr = p->caddr;
		port = p->cport;
		laddr = p->vaddr;
		lport = p->vport;
	} else {
		addr = p->vaddr;
		port = p->vport;
		laddr = p->caddr;
		lport = p->cport;
	}

	return ip_vs_conn_hashkey(t, p->af, p->protocol, addr, port, laddr,
				  lport);
}

static unsigned int ip_vs_conn_hashkey_conn(struct ip_vs_rht *t,
					    const struct ip_vs_conn *cp,
					    bool out)
{
	struct ip_vs_conn_param p;

	if (!out)
		ip_vs_conn_fill_param(cp->ipvs, cp->af, cp->protocol,
				      &cp->caddr, cp->cport, &cp->vaddr,
				      cp->vport, &p);
	else
		ip_vs_conn_fill_param(cp->ipvs, cp->af, cp->protocol,
				      &cp->daddr, cp->dport, &cp->caddr,
				      cp->cport, &p);

	if (cp->pe) {
		p.pe = cp->pe;
		p.pe_data = cp->pe_data;
		p.pe_data_len = cp->pe_data_len;
	}

	return ip_vs_conn_hashkey_param(&p, t, out);
}

/*	Hashes ip_vs_conn in conn_tab
 *	returns bool success.
 */
static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
{
	struct netns_ipvs *ipvs = cp->ipvs;
	struct hlist_bl_head *head, *head2;
	u32 hash_key, hash_key2;
	struct ip_vs_rht *t;
	u32 hash, hash2;
	bool use2;
	int ret;

	if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
		return 0;

	/* New entries go into recent table */
	t = rcu_dereference(ipvs->conn_tab);
	t = rcu_dereference(t->new_tbl);

	hash = ip_vs_conn_hashkey_conn(t, cp, false);
	hash_key = ip_vs_rht_build_hash_key(t, hash);
	if (ip_vs_conn_use_hash2(cp)) {
		hash2 = ip_vs_conn_hashkey_conn(t, cp, true);
		hash_key2 = ip_vs_rht_build_hash_key(t, hash2);
		use2 = true;
	} else {
		hash_key2 = hash_key;
		use2 = false;
	}

	local_bh_disable();
	conn_tab_lock(t, t, cp, hash_key, hash_key2, use2, true /* new_hash */,
		      true /* new_hash2 */, &head, &head2);

	cp->flags |= IP_VS_CONN_F_HASHED;
	WRITE_ONCE(cp->hn0.hash_key, hash_key);
	WRITE_ONCE(cp->hn1.hash_key, hash_key2);
	refcount_inc(&cp->refcnt);
	hlist_bl_add_head_rcu(&cp->hn0.node, head);
	if (use2)
		hlist_bl_add_head_rcu(&cp->hn1.node, head2);

	conn_tab_unlock(head, head2);
	local_bh_enable();
	ret = 1;

	/* Schedule resizing if load increases */
	if (atomic_read(&ipvs->conn_count) > t->u_thresh &&
	    !test_and_set_bit(IP_VS_WORK_CONN_RESIZE, &ipvs->work_flags))
		mod_delayed_work(system_dfl_long_wq, &ipvs->conn_resize_work, 0);

	return ret;
}

/* Try to unlink ip_vs_conn from conn_tab.
 * returns bool success.
 */
static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp)
{
	struct netns_ipvs *ipvs = cp->ipvs;
	struct hlist_bl_head *head, *head2;
	u32 hash_key, hash_key2;
	struct ip_vs_rht *t;
	bool ret = false;
	bool use2;

	if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
		return refcount_dec_if_one(&cp->refcnt);

	rcu_read_lock();
	local_bh_disable();

	t = rcu_dereference(ipvs->conn_tab);
	hash_key = READ_ONCE(cp->hn0.hash_key);
	hash_key2 = READ_ONCE(cp->hn1.hash_key);
	use2 = ip_vs_conn_use_hash2(cp);

	conn_tab_lock(t, t, cp, hash_key, hash_key2, use2, false /* new_hash */,
		      false /* new_hash2 */, &head, &head2);

	if (cp->flags & IP_VS_CONN_F_HASHED) {
		/* Decrease refcnt and unlink conn only if we are last user */
		if (use2 == ip_vs_conn_use_hash2(cp) &&
		    refcount_dec_if_one(&cp->refcnt)) {
			hlist_bl_del_rcu(&cp->hn0.node);
			if (use2)
				hlist_bl_del_rcu(&cp->hn1.node);
			cp->flags &= ~IP_VS_CONN_F_HASHED;
			ret = true;
		}
	}

	conn_tab_unlock(head, head2);

	local_bh_enable();
	rcu_read_unlock();

	return ret;
}


/*
 *  Gets ip_vs_conn associated with supplied parameters in the conn_tab.
 *  Called for pkts coming from OUTside-to-INside.
 *	p->caddr, p->cport: pkt source address (foreign host)
 *	p->vaddr, p->vport: pkt dest address (load balancer)
 */
static inline struct ip_vs_conn *
__ip_vs_conn_in_get(const struct ip_vs_conn_param *p)
{
	DECLARE_IP_VS_RHT_WALK_BUCKET_RCU();
	struct netns_ipvs *ipvs = p->ipvs;
	struct ip_vs_conn_hnode *hn;
	struct hlist_bl_head *head;
	struct ip_vs_rht *t, *pt;
	struct hlist_bl_node *e;
	struct ip_vs_conn *cp;
	u32 hash, hash_key;

	rcu_read_lock();

	ip_vs_rht_for_each_table_rcu(ipvs->conn_tab, t, pt) {
		hash = ip_vs_conn_hashkey_param(p, t, false);
		hash_key = ip_vs_rht_build_hash_key(t, hash);
		ip_vs_rht_walk_bucket_rcu(t, hash_key, head) {
			hlist_bl_for_each_entry_rcu(hn, e, head, node) {
				if (READ_ONCE(hn->hash_key) != hash_key ||
				    hn->dir != 0)
					continue;
				cp = ip_vs_hn0_to_conn(hn);
				if (p->cport == cp->cport &&
				    p->vport == cp->vport && cp->af == p->af &&
				    ip_vs_addr_equal(p->af, p->caddr,
						     &cp->caddr) &&
				    ip_vs_addr_equal(p->af, p->vaddr,
						     &cp->vaddr) &&
				    (!p->cport ^
				     (!(cp->flags & IP_VS_CONN_F_NO_CPORT))) &&
				    p->protocol == cp->protocol) {
					if (__ip_vs_conn_get(cp)) {
						/* HIT */
						rcu_read_unlock();
						return cp;
					}
				}
			}
		}
	}

	rcu_read_unlock();

	return NULL;
}

struct ip_vs_conn *ip_vs_conn_in_get(const struct ip_vs_conn_param *p)
{
	struct ip_vs_conn *cp;

	cp = __ip_vs_conn_in_get(p);
	if (!cp) {
		struct netns_ipvs *ipvs = p->ipvs;
		int af_id = ip_vs_af_index(p->af);

		if (atomic_read(&ipvs->no_cport_conns[af_id])) {
			struct ip_vs_conn_param cport_zero_p = *p;

			cport_zero_p.cport = 0;
			cp = __ip_vs_conn_in_get(&cport_zero_p);
		}
	}

	IP_VS_DBG_BUF(9, "lookup/in %s %s:%d->%s:%d %s\n",
		      ip_vs_proto_name(p->protocol),
		      IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport),
		      IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport),
		      cp ? "hit" : "not hit");

	return cp;
}

static int
ip_vs_conn_fill_param_proto(struct netns_ipvs *ipvs,
			    int af, const struct sk_buff *skb,
			    const struct ip_vs_iphdr *iph,
			    struct ip_vs_conn_param *p)
{
	__be16 _ports[2], *pptr;

	pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports);
	if (pptr == NULL)
		return 1;

	if (likely(!ip_vs_iph_inverse(iph)))
		ip_vs_conn_fill_param(ipvs, af, iph->protocol, &iph->saddr,
				      pptr[0], &iph->daddr, pptr[1], p);
	else
		ip_vs_conn_fill_param(ipvs, af, iph->protocol, &iph->daddr,
				      pptr[1], &iph->saddr, pptr[0], p);
	return 0;
}

struct ip_vs_conn *
ip_vs_conn_in_get_proto(struct netns_ipvs *ipvs, int af,
			const struct sk_buff *skb,
			const struct ip_vs_iphdr *iph)
{
	struct ip_vs_conn_param p;

	if (ip_vs_conn_fill_param_proto(ipvs, af, skb, iph, &p))
		return NULL;

	return ip_vs_conn_in_get(&p);
}
EXPORT_SYMBOL_GPL(ip_vs_conn_in_get_proto);

/* Get reference to connection template */
struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p)
{
	DECLARE_IP_VS_RHT_WALK_BUCKET_RCU();
	struct netns_ipvs *ipvs = p->ipvs;
	struct ip_vs_conn_hnode *hn;
	struct hlist_bl_head *head;
	struct ip_vs_rht *t, *pt;
	struct hlist_bl_node *e;
	struct ip_vs_conn *cp;
	u32 hash, hash_key;

	rcu_read_lock();

	ip_vs_rht_for_each_table_rcu(ipvs->conn_tab, t, pt) {
		hash = ip_vs_conn_hashkey_param(p, t, false);
		hash_key = ip_vs_rht_build_hash_key(t, hash);
		ip_vs_rht_walk_bucket_rcu(t, hash_key, head) {
			hlist_bl_for_each_entry_rcu(hn, e, head, node) {
				if (READ_ONCE(hn->hash_key) != hash_key ||
				    hn->dir != 0)
					continue;
				cp = ip_vs_hn0_to_conn(hn);
				if (unlikely(p->pe_data && p->pe->ct_match)) {
					if (p->pe == cp->pe &&
					    p->pe->ct_match(p, cp) &&
					    __ip_vs_conn_get(cp))
						goto out;
					continue;
				}
				if (cp->af == p->af &&
				    ip_vs_addr_equal(p->af, p->caddr,
						     &cp->caddr) &&
				    /* protocol should only be IPPROTO_IP if
				     * p->vaddr is a fwmark
				     */
				    ip_vs_addr_equal(p->protocol == IPPROTO_IP ?
						     AF_UNSPEC : p->af,
						     p->vaddr, &cp->vaddr) &&
				    p->vport == cp->vport &&
				    p->cport == cp->cport &&
				    cp->flags & IP_VS_CONN_F_TEMPLATE &&
				    p->protocol == cp->protocol &&
				    cp->dport != htons(0xffff)) {
					if (__ip_vs_conn_get(cp))
						goto out;
				}
			}
		}

	}
	cp = NULL;

  out:
	rcu_read_unlock();

	IP_VS_DBG_BUF(9, "template lookup/in %s %s:%d->%s:%d %s\n",
		      ip_vs_proto_name(p->protocol),
		      IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport),
		      IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport),
		      cp ? "hit" : "not hit");

	return cp;
}

/* Gets ip_vs_conn associated with supplied parameters in the conn_tab.
 * Called for pkts coming from inside-to-OUTside.
 *	p->caddr, p->cport: pkt source address (inside host)
 *	p->vaddr, p->vport: pkt dest address (foreign host) */
struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p)
{
	DECLARE_IP_VS_RHT_WALK_BUCKET_RCU();
	struct netns_ipvs *ipvs = p->ipvs;
	const union nf_inet_addr *saddr;
	struct ip_vs_conn_hnode *hn;
	struct hlist_bl_head *head;
	struct ip_vs_rht *t, *pt;
	struct hlist_bl_node *e;
	struct ip_vs_conn *cp;
	u32 hash, hash_key;
	__be16 sport;

	rcu_read_lock();

	ip_vs_rht_for_each_table_rcu(ipvs->conn_tab, t, pt) {
		hash = ip_vs_conn_hashkey_param(p, t, true);
		hash_key = ip_vs_rht_build_hash_key(t, hash);
		ip_vs_rht_walk_bucket_rcu(t, hash_key, head) {
			hlist_bl_for_each_entry_rcu(hn, e, head, node) {
				/* dir can be 0 for DR/TUN */
				if (READ_ONCE(hn->hash_key) != hash_key)
					continue;
				cp = ip_vs_hn_to_conn(hn);
				if (p->vport != cp->cport)
					continue;

				if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) {
					sport = cp->vport;
					saddr = &cp->vaddr;
				} else {
					sport = cp->dport;
					saddr = &cp->daddr;
				}

				if (p->cport == sport && cp->af == p->af &&
				    ip_vs_addr_equal(p->af, p->vaddr,
						     &cp->caddr) &&
				    ip_vs_addr_equal(p->af, p->caddr, saddr) &&
				    p->protocol == cp->protocol) {
					if (__ip_vs_conn_get(cp))
						goto out;
				}
			}
		}
	}
	cp = NULL;

out:
	rcu_read_unlock();

	IP_VS_DBG_BUF(9, "lookup/out %s %s:%d->%s:%d %s\n",
		      ip_vs_proto_name(p->protocol),
		      IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport),
		      IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport),
		      cp ? "hit" : "not hit");

	return cp;
}

struct ip_vs_conn *
ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af,
			 const struct sk_buff *skb,
			 const struct ip_vs_iphdr *iph)
{
	struct ip_vs_conn_param p;

	if (ip_vs_conn_fill_param_proto(ipvs, af, skb, iph, &p))
		return NULL;

	return ip_vs_conn_out_get(&p);
}
EXPORT_SYMBOL_GPL(ip_vs_conn_out_get_proto);

/*
 *      Put back the conn and restart its timer with its timeout
 */
static void __ip_vs_conn_put_timer(struct ip_vs_conn *cp)
{
	unsigned long t = (cp->flags & IP_VS_CONN_F_ONE_PACKET) ?
		0 : cp->timeout;
	mod_timer(&cp->timer, jiffies+t);

	__ip_vs_conn_put(cp);
}

void ip_vs_conn_put(struct ip_vs_conn *cp)
{
	if ((cp->flags & IP_VS_CONN_F_ONE_PACKET) &&
	    (refcount_read(&cp->refcnt) == 1) &&
	    !timer_pending(&cp->timer))
		/* expire connection immediately */
		ip_vs_conn_expire(&cp->timer);
	else
		__ip_vs_conn_put_timer(cp);
}

/*
 *	Fill a no_client_port connection with a client port number
 */
void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport)
{
	struct hlist_bl_head *head, *head2, *head_new;
	bool use2 = ip_vs_conn_use_hash2(cp);
	struct netns_ipvs *ipvs = cp->ipvs;
	int af_id = ip_vs_af_index(cp->af);
	u32 hash_r = 0, hash_key_r = 0;
	struct ip_vs_rht *t, *tp, *t2;
	struct ip_vs_conn_hnode *hn;
	u32 hash_key, hash_key_new;
	struct ip_vs_conn_param p;
	bool by_me = false;
	int ntbl;
	int dir;

restart:
	/* No packets from inside, so we can do it in 2 steps. */
	dir = use2 ? 1 : 0;

next_dir:
	if (dir)
		ip_vs_conn_fill_param(ipvs, cp->af, cp->protocol, &cp->daddr,
				      cp->dport, &cp->caddr, cport, &p);
	else
		ip_vs_conn_fill_param(ipvs, cp->af, cp->protocol, &cp->caddr,
				      cport, &cp->vaddr, cp->vport, &p);
	hn = dir ? &cp->hn1 : &cp->hn0;
	ntbl = 0;

	/* Attempt to rehash cp safely, by informing seqcount readers */
	t = rcu_dereference(ipvs->conn_tab);
	hash_key = READ_ONCE(hn->hash_key);
	tp = NULL;

retry:
	/* Moved to new table ? */
	if (!ip_vs_rht_same_table(t, hash_key)) {
		t = rcu_dereference(t->new_tbl);
		ntbl++;
		/* We are lost? */
		if (ntbl >= 2) {
			spin_lock_bh(&cp->lock);
			if (cp->flags & IP_VS_CONN_F_NO_CPORT && by_me)
				cp->cport = 0;
			/* hn1 will be rehashed on next packet */
			spin_unlock_bh(&cp->lock);
			IP_VS_ERR_RL("%s(): Too many ht changes for dir %d\n",
				     __func__, dir);
			return;
		}
	}

	/* Rehashing during resize? Use the recent table for adds */
	t2 = rcu_dereference(t->new_tbl);
	/* Calc new hash once per table */
	if (tp != t2) {
		hash_r = ip_vs_conn_hashkey_param(&p, t2, dir);
		hash_key_r = ip_vs_rht_build_hash_key(t2, hash_r);
		tp = t2;
	}
	head = t->buckets + (hash_key & t->mask);
	head2 = t2->buckets + (hash_key_r & t2->mask);
	head_new = head2;

	if (head > head2 && t == t2)
		swap(head, head2);

	/* Protect the cp->flags modification */
	spin_lock_bh(&cp->lock);

	/* Recheck the forwarding method under lock */
	if (use2 != ip_vs_conn_use_hash2(cp)) {
		use2 = !use2;
		if (use2) {
			spin_unlock_bh(&cp->lock);
			/* Restart with new use2 value */
			goto restart;
		}
		if (dir) {
			/* Not started yet, so just skip dir 1 */
			spin_unlock_bh(&cp->lock);
			dir--;
			goto next_dir;
		}
		/* Just finish dir 0 */
	}

	/* Lock seqcount only for the old bucket, even if we are on new table
	 * because it affects the del operation, not the adding.
	 */
	spin_lock(&t->lock[hash_key & t->lock_mask].l);
	preempt_disable_nested();
	write_seqcount_begin(&t->seqc[hash_key & t->seqc_mask]);

	/* Lock buckets in same (increasing) order */
	hlist_bl_lock(head);
	if (head != head2)
		hlist_bl_lock(head2);

	/* Ensure hash_key is read under lock */
	hash_key_new = READ_ONCE(hn->hash_key);
	/* Racing with another rehashing ? */
	if (unlikely(hash_key != hash_key_new)) {
		if (head != head2)
			hlist_bl_unlock(head2);
		hlist_bl_unlock(head);
		write_seqcount_end(&t->seqc[hash_key & t->seqc_mask]);
		preempt_enable_nested();
		spin_unlock(&t->lock[hash_key & t->lock_mask].l);
		spin_unlock_bh(&cp->lock);
		hash_key = hash_key_new;
		goto retry;
	}

	/* Fill cport once, even if multiple packets try to do it */
	if (cp->flags & IP_VS_CONN_F_NO_CPORT && (!cp->cport || by_me)) {
		/* If we race with resizing make sure cport is set for dir 1 */
		if (!cp->cport) {
			cp->cport = cport;
			by_me = true;
		}
		if (!dir) {
			atomic_dec(&ipvs->no_cport_conns[af_id]);
			cp->flags &= ~IP_VS_CONN_F_NO_CPORT;
		}
		/* We do not recalc hash_key_r under lock, we assume the
		 * parameters in cp do not change, i.e. cport is
		 * the only possible change.
		 */
		WRITE_ONCE(hn->hash_key, hash_key_r);
		if (!use2)
			WRITE_ONCE(cp->hn1.hash_key, hash_key_r);
		/* For dir=1 we do not check in flags if hn is already
		 * rehashed but this check will do it.
		 */
		if (head != head2) {
			hlist_bl_del_rcu(&hn->node);
			hlist_bl_add_head_rcu(&hn->node, head_new);
		}
	}

	if (head != head2)
		hlist_bl_unlock(head2);
	hlist_bl_unlock(head);
	write_seqcount_end(&t->seqc[hash_key & t->seqc_mask]);
	preempt_enable_nested();
	spin_unlock(&t->lock[hash_key & t->lock_mask].l);

	spin_unlock_bh(&cp->lock);
	if (dir-- && by_me)
		goto next_dir;
}

/* Change forwarding method for hashed conn */
static void ip_vs_conn_change_fwd_mask(struct ip_vs_conn *cp, u32 new_flags)
{
	struct netns_ipvs *ipvs = cp->ipvs;
	struct hlist_bl_head *head, *head2;
	u32 hash2, hash_key, hash_key2;
	struct ip_vs_rht *t, *t2;

	/* See ip_vs_conn_use_hash2() for reference */
	if ((cp->flags & IP_VS_CONN_F_TEMPLATE) ||
	    /* No change in double hashing ? */
	    (IP_VS_FWD_METHOD(cp) == IP_VS_CONN_F_MASQ) ==
	    ((new_flags & IP_VS_CONN_F_FWD_MASK) == IP_VS_CONN_F_MASQ)) {
		cp->flags = new_flags;
		return;
	}
	t = rcu_dereference(ipvs->conn_tab);
	if (ip_vs_conn_use_hash2(cp)) {
		/* Stop double hashing */
		hash_key = READ_ONCE(cp->hn0.hash_key);
		hash_key2 = READ_ONCE(cp->hn1.hash_key);

		conn_tab_lock(t, t, cp, hash_key, hash_key2, true /* use2 */,
			      false /* new_hash */, false /* new_hash2 */,
			      &head, &head2);

		/* Keep both hash keys in same table */
		hash_key = READ_ONCE(cp->hn0.hash_key);
		WRITE_ONCE(cp->hn1.hash_key, hash_key);
		hlist_bl_del_rcu(&cp->hn1.node);
		cp->flags = new_flags;

		conn_tab_unlock(head, head2);
	} else {
		/* Start double hashing */

		hash_key = READ_ONCE(cp->hn0.hash_key);

		t2 = rcu_dereference(t->new_tbl);
		hash2 = ip_vs_conn_hashkey_conn(t2, cp, true);
		hash_key2 = ip_vs_rht_build_hash_key(t2, hash2);

		/* Change the forwarding method under locked hn0 */
		conn_tab_lock(t, t2, cp, hash_key, hash_key2, true /* use2 */,
			      false /* new_hash */, true /* new_hash2 */,
			      &head, &head2);

		WRITE_ONCE(cp->hn1.hash_key, hash_key2);
		cp->flags = new_flags;
		hlist_bl_add_head_rcu(&cp->hn1.node, head2);

		conn_tab_unlock(head, head2);
	}
}

/* Get default load factor to map conn_count/u_thresh to t->size */
static int ip_vs_conn_default_load_factor(struct netns_ipvs *ipvs)
{
	int factor;

	if (net_eq(ipvs->net, &init_net))
		factor = -3;
	else
		factor = -1;
	/* Double hashing adds twice more nodes for NAT */
	factor--;
	return factor;
}

/* Get the desired conn_tab size */
int ip_vs_conn_desired_size(struct netns_ipvs *ipvs, struct ip_vs_rht *t,
			    int lfactor)
{
	return ip_vs_rht_desired_size(ipvs, t, atomic_read(&ipvs->conn_count),
				      lfactor, IP_VS_CONN_TAB_MIN_BITS,
				      ip_vs_conn_tab_bits);
}

/* Allocate conn_tab */
struct ip_vs_rht *ip_vs_conn_tab_alloc(struct netns_ipvs *ipvs, int buckets,
				       int lfactor)
{
	struct ip_vs_rht *t;
	int scounts, locks;

	/* scounts: affects readers during resize */
	scounts = clamp(buckets >> 6, 1, 256);
	/* locks: based on parallel IP_VS_CONN_F_NO_CPORT operations + resize */
	locks = clamp(8, 1, scounts);

	t = ip_vs_rht_alloc(buckets, scounts, locks);
	if (!t)
		return NULL;
	t->lfactor = lfactor;
	ip_vs_rht_set_thresholds(t, t->size, lfactor, IP_VS_CONN_TAB_MIN_BITS,
				 ip_vs_conn_tab_bits);
	return t;
}

/* conn_tab resizer work */
static void conn_resize_work_handler(struct work_struct *work)
{
	struct hlist_bl_head *head, *head2;
	unsigned int resched_score = 0;
	struct hlist_bl_node *cn, *nn;
	struct ip_vs_rht *t, *t_new;
	struct ip_vs_conn_hnode *hn;
	struct netns_ipvs *ipvs;
	struct ip_vs_conn *cp;
	bool more_work = false;
	u32 hash, hash_key;
	int limit = 0;
	int new_size;
	int lfactor;
	u32 bucket;

	ipvs = container_of(work, struct netns_ipvs, conn_resize_work.work);

	/* Allow work to be queued again */
	clear_bit(IP_VS_WORK_CONN_RESIZE, &ipvs->work_flags);
	t = rcu_dereference_protected(ipvs->conn_tab, 1);
	/* Do nothing if table is removed */
	if (!t)
		goto out;
	/* New table needs to be registered? BUG! */
	if (t != rcu_dereference_protected(t->new_tbl, 1))
		goto out;

	lfactor = sysctl_conn_lfactor(ipvs);
	/* Should we resize ? */
	new_size = ip_vs_conn_desired_size(ipvs, t, lfactor);
	if (new_size == t->size && lfactor == t->lfactor)
		goto out;

	t_new = ip_vs_conn_tab_alloc(ipvs, new_size, lfactor);
	if (!t_new) {
		more_work = true;
		goto out;
	}
	/* Flip the table_id */
	t_new->table_id = t->table_id ^ IP_VS_RHT_TABLE_ID_MASK;

	rcu_assign_pointer(t->new_tbl, t_new);

	/* Wait RCU readers to see the new table, we do not want new
	 * conns to go into old table and to be left there.
	 */
	synchronize_rcu();

	ip_vs_rht_for_each_bucket(t, bucket, head) {
same_bucket:
		if (++limit >= 16) {
			if (resched_score >= 100) {
				resched_score = 0;
				cond_resched();
			}
			limit = 0;
		}
		if (hlist_bl_empty(head)) {
			resched_score++;
			continue;
		}
		/* Preemption calls ahead... */
		resched_score = 0;

		/* seqcount_t usage considering PREEMPT_RT rules:
		 * - other writers (SoftIRQ) => serialize with spin_lock_bh
		 * - readers (SoftIRQ) => disable BHs
		 * - readers (processes) => preemption should be disabled
		 */
		spin_lock_bh(&t->lock[bucket & t->lock_mask].l);
		preempt_disable_nested();
		write_seqcount_begin(&t->seqc[bucket & t->seqc_mask]);
		hlist_bl_lock(head);

		hlist_bl_for_each_entry_safe(hn, cn, nn, head, node) {
			cp = ip_vs_hn_to_conn(hn);
			hash = ip_vs_conn_hashkey_conn(t_new, cp, hn->dir);
			hash_key = ip_vs_rht_build_hash_key(t_new, hash);

			head2 = t_new->buckets + (hash & t_new->mask);
			hlist_bl_lock(head2);
			/* t_new->seqc are not used at this stage, we race
			 * only with add/del, so only lock the bucket.
			 */
			hlist_bl_del_rcu(&hn->node);
			WRITE_ONCE(hn->hash_key, hash_key);
			/* Keep both hash keys in sync if no double hashing */
			if (!ip_vs_conn_use_hash2(cp))
				WRITE_ONCE(cp->hn1.hash_key, hash_key);
			hlist_bl_add_head_rcu(&hn->node, head2);
			hlist_bl_unlock(head2);
			/* Too long chain? Do it in steps */
			if (++limit >= 64)
				break;
		}

		hlist_bl_unlock(head);
		write_seqcount_end(&t->seqc[bucket & t->seqc_mask]);
		preempt_enable_nested();
		spin_unlock_bh(&t->lock[bucket & t->lock_mask].l);
		if (limit >= 64)
			goto same_bucket;
	}

	rcu_assign_pointer(ipvs->conn_tab, t_new);
	/* Inform readers that new table is installed */
	smp_mb__before_atomic();
	atomic_inc(&ipvs->conn_tab_changes);

	/* RCU readers should not see more than two tables in chain.
	 * To prevent new table to be attached wait here instead of
	 * freeing the old table in RCU callback.
	 */
	synchronize_rcu();
	ip_vs_rht_free(t);

out:
	/* Monitor if we need to shrink table */
	queue_delayed_work(system_dfl_long_wq, &ipvs->conn_resize_work,
			   more_work ? 1 : 2 * HZ);
}

/*
 *	Bind a connection entry with the corresponding packet_xmit.
 *	Called by ip_vs_conn_new.
 */
static inline void ip_vs_bind_xmit(struct ip_vs_conn *cp)
{
	switch (IP_VS_FWD_METHOD(cp)) {
	case IP_VS_CONN_F_MASQ:
		cp->packet_xmit = ip_vs_nat_xmit;
		break;

	case IP_VS_CONN_F_TUNNEL:
#ifdef CONFIG_IP_VS_IPV6
		if (cp->daf == AF_INET6)
			cp->packet_xmit = ip_vs_tunnel_xmit_v6;
		else
#endif
			cp->packet_xmit = ip_vs_tunnel_xmit;
		break;

	case IP_VS_CONN_F_DROUTE:
		cp->packet_xmit = ip_vs_dr_xmit;
		break;

	case IP_VS_CONN_F_LOCALNODE:
		cp->packet_xmit = ip_vs_null_xmit;
		break;

	case IP_VS_CONN_F_BYPASS:
		cp->packet_xmit = ip_vs_bypass_xmit;
		break;
	}
}

#ifdef CONFIG_IP_VS_IPV6
static inline void ip_vs_bind_xmit_v6(struct ip_vs_conn *cp)
{
	switch (IP_VS_FWD_METHOD(cp)) {
	case IP_VS_CONN_F_MASQ:
		cp->packet_xmit = ip_vs_nat_xmit_v6;
		break;

	case IP_VS_CONN_F_TUNNEL:
		if (cp->daf == AF_INET6)
			cp->packet_xmit = ip_vs_tunnel_xmit_v6;
		else
			cp->packet_xmit = ip_vs_tunnel_xmit;
		break;

	case IP_VS_CONN_F_DROUTE:
		cp->packet_xmit = ip_vs_dr_xmit_v6;
		break;

	case IP_VS_CONN_F_LOCALNODE:
		cp->packet_xmit = ip_vs_null_xmit;
		break;

	case IP_VS_CONN_F_BYPASS:
		cp->packet_xmit = ip_vs_bypass_xmit_v6;
		break;
	}
}
#endif


/*
 *	Bind a connection entry with a virtual service destination
 *	Called just after a new connection entry is created.
 */
static inline void
ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
{
	unsigned int conn_flags;
	__u32 flags;

	/* if dest is NULL, then return directly */
	if (!dest)
		return;

	/* Increase the refcnt counter of the dest */
	ip_vs_dest_hold(dest);

	conn_flags = atomic_read(&dest->conn_flags);
	if (cp->protocol != IPPROTO_UDP)
		conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
	flags = cp->flags;
	/* Bind with the destination and its corresponding transmitter */
	if (flags & IP_VS_CONN_F_SYNC) {
		/* Synced conns are hashed, so they can not get this flag */
		conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;

		/* if the connection is not template and is created
		 * by sync, preserve the activity flag.
		 */
		if (!(flags & IP_VS_CONN_F_TEMPLATE))
			conn_flags &= ~IP_VS_CONN_F_INACTIVE;
		/* connections inherit forwarding method from dest */
		flags &= ~(IP_VS_CONN_F_FWD_MASK | IP_VS_CONN_F_NOOUTPUT);
		flags |= conn_flags;
		/* Changing forwarding method for hashed conn can
		 * happen only under locks
		 */
		if (cp->flags & IP_VS_CONN_F_HASHED)
			ip_vs_conn_change_fwd_mask(cp, flags);
		else
			cp->flags = flags;
	} else {
		flags |= conn_flags;
		cp->flags = flags;
	}
	cp->dest = dest;

	IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
		      "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
		      "dest->refcnt:%d\n",
		      ip_vs_proto_name(cp->protocol),
		      IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport),
		      IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport),
		      IP_VS_DBG_ADDR(cp->daf, &cp->daddr), ntohs(cp->dport),
		      ip_vs_fwd_tag(cp), cp->state,
		      cp->flags, refcount_read(&cp->refcnt),
		      refcount_read(&dest->refcnt));

	/* Update the connection counters */
	if (!(flags & IP_VS_CONN_F_TEMPLATE)) {
		int tc;

		/* It is a normal connection, so modify the counters
		 * according to the flags, later the protocol can
		 * update them on state change
		 */
		if (!(flags & IP_VS_CONN_F_INACTIVE))
			atomic_inc(&dest->activeconns);
		tc = atomic_inc_return(&dest->totalconns);
		if (tc == READ_ONCE(dest->u_threshold))
			ip_vs_dest_update_overload(dest, 1);
	} else {
		/* It is a persistent connection/template, so increase
		   the persistent connection counter */
		atomic_inc(&dest->persistconns);
	}
}


/*
 * Check if there is a destination for the connection, if so
 * bind the connection to the destination.
 */
void ip_vs_try_bind_dest(struct ip_vs_conn *cp)
{
	struct ip_vs_dest *dest;

	rcu_read_lock();

	/* This function is only invoked by the synchronization code. We do
	 * not currently support heterogeneous pools with synchronization,
	 * so we can make the assumption that the svc_af is the same as the
	 * dest_af
	 */
	dest = ip_vs_find_dest(cp->ipvs, cp->af, cp->af, &cp->daddr,
			       cp->dport, &cp->vaddr, cp->vport,
			       cp->protocol, cp->fwmark, cp->flags);
	if (dest) {
		struct ip_vs_proto_data *pd;

		spin_lock_bh(&cp->lock);
		if (cp->dest) {
			spin_unlock_bh(&cp->lock);
			rcu_read_unlock();
			return;
		}

		/* Applications work depending on the forwarding method
		 * but better to reassign them always when binding dest */
		if (cp->app)
			ip_vs_unbind_app(cp);

		ip_vs_bind_dest(cp, dest);
		spin_unlock_bh(&cp->lock);

		/* Update its packet transmitter */
		cp->packet_xmit = NULL;
#ifdef CONFIG_IP_VS_IPV6
		if (cp->af == AF_INET6)
			ip_vs_bind_xmit_v6(cp);
		else
#endif
			ip_vs_bind_xmit(cp);

		pd = ip_vs_proto_data_get(cp->ipvs, cp->protocol);
		if (pd && atomic_read(&pd->appcnt))
			ip_vs_bind_app(cp, pd->pp);
	}
	rcu_read_unlock();
}


/*
 *	Unbind a connection entry with its VS destination
 *	Called by the ip_vs_conn_expire function.
 */
static inline void ip_vs_unbind_dest(struct ip_vs_conn *cp)
{
	struct ip_vs_dest *dest = cp->dest;

	if (!dest)
		return;

	IP_VS_DBG_BUF(7, "Unbind-dest %s c:%s:%d v:%s:%d "
		      "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d "
		      "dest->refcnt:%d\n",
		      ip_vs_proto_name(cp->protocol),
		      IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport),
		      IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport),
		      IP_VS_DBG_ADDR(cp->daf, &cp->daddr), ntohs(cp->dport),
		      ip_vs_fwd_tag(cp), cp->state,
		      cp->flags, refcount_read(&cp->refcnt),
		      refcount_read(&dest->refcnt));

	/* Update the connection counters */
	if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) {
		int tc;

		/* It is a normal connection, so decrease the counters */
		if (!(cp->flags & IP_VS_CONN_F_INACTIVE))
			atomic_dec(&dest->activeconns);
		tc = atomic_fetch_dec(&dest->totalconns);
		if (tc == READ_ONCE(dest->l_threshold_val))
			ip_vs_dest_update_overload(dest, -1);
	} else {
		/* It is a persistent connection/template, so decrease
		   the persistent connection counter */
		atomic_dec(&dest->persistconns);
	}

	ip_vs_dest_put(dest);
}

static int expire_quiescent_template(struct netns_ipvs *ipvs,
				     struct ip_vs_dest *dest)
{
#ifdef CONFIG_SYSCTL
	return ipvs->sysctl_expire_quiescent_template &&
		(atomic_read(&dest->weight) == 0);
#else
	return 0;
#endif
}

/*
 *	Checking if the destination of a connection template is available.
 *	If available, return 1, otherwise invalidate this connection
 *	template and return 0.
 */
int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest)
{
	struct ip_vs_dest *dest = ct->dest;
	struct netns_ipvs *ipvs = ct->ipvs;

	/*
	 * Checking the dest server status.
	 */
	if ((dest == NULL) ||
	    !(dest->cflags & IP_VS_DEST_CF_AVAILABLE) ||
	    expire_quiescent_template(ipvs, dest) ||
	    (cdest && (dest != cdest))) {
		IP_VS_DBG_BUF(9, "check_template: dest not available for "
			      "protocol %s s:%s:%d v:%s:%d "
			      "-> d:%s:%d\n",
			      ip_vs_proto_name(ct->protocol),
			      IP_VS_DBG_ADDR(ct->af, &ct->caddr),
			      ntohs(ct->cport),
			      IP_VS_DBG_ADDR(ct->af, &ct->vaddr),
			      ntohs(ct->vport),
			      IP_VS_DBG_ADDR(ct->daf, &ct->daddr),
			      ntohs(ct->dport));

		/* Invalidate the connection template. Prefer to avoid
		 * rehashing, it will move it as first in chain, so use
		 * only dport as indication, it is not a hash key.
		 */
		ct->dport = htons(0xffff);

		/*
		 * Simply decrease the refcnt of the template,
		 * don't restart its timer.
		 */
		__ip_vs_conn_put(ct);
		return 0;
	}
	return 1;
}

static void ip_vs_conn_rcu_free(struct rcu_head *head)
{
	struct ip_vs_conn *cp = container_of(head, struct ip_vs_conn,
					     rcu_head);

	ip_vs_pe_put(cp->pe);
	kfree(cp->pe_data);
	kmem_cache_free(ip_vs_conn_cachep, cp);
}

/* Try to delete connection while not holding reference */
static void ip_vs_conn_del(struct ip_vs_conn *cp)
{
	if (timer_delete(&cp->timer)) {
		/* Drop cp->control chain too */
		if (cp->control)
			cp->timeout = 0;
		ip_vs_conn_expire(&cp->timer);
	}
}

/* Try to delete connection while holding reference */
static void ip_vs_conn_del_put(struct ip_vs_conn *cp)
{
	if (timer_delete(&cp->timer)) {
		/* Drop cp->control chain too */
		if (cp->control)
			cp->timeout = 0;
		__ip_vs_conn_put(cp);
		ip_vs_conn_expire(&cp->timer);
	} else {
		__ip_vs_conn_put(cp);
	}
}

static void ip_vs_conn_expire(struct timer_list *t)
{
	struct ip_vs_conn *cp = timer_container_of(cp, t, timer);
	struct netns_ipvs *ipvs = cp->ipvs;

	/*
	 *	do I control anybody?
	 */
	if (atomic_read(&cp->n_control))
		goto expire_later;

	/* Unlink conn if not referenced anymore */
	if (likely(ip_vs_conn_unlink(cp))) {
		struct ip_vs_conn *ct = cp->control;

		/* delete the timer if it is activated by other users */
		timer_delete(&cp->timer);

		/* does anybody control me? */
		if (ct) {
			bool has_ref = !cp->timeout && __ip_vs_conn_get(ct);

			ip_vs_control_del(cp);
			/* Drop CTL or non-assured TPL if not used anymore */
			if (has_ref && !atomic_read(&ct->n_control) &&
			    (!(ct->flags & IP_VS_CONN_F_TEMPLATE) ||
			     !(ct->state & IP_VS_CTPL_S_ASSURED))) {
				IP_VS_DBG(4, "drop controlling connection\n");
				ip_vs_conn_del_put(ct);
			} else if (has_ref) {
				__ip_vs_conn_put(ct);
			}
		}

		if ((cp->flags & IP_VS_CONN_F_NFCT) &&
		    !(cp->flags & IP_VS_CONN_F_ONE_PACKET)) {
			/* Do not access conntracks during subsys cleanup
			 * because nf_conntrack_find_get can not be used after
			 * conntrack cleanup for the net.
			 */
			smp_rmb();
			if (READ_ONCE(ipvs->enable))
				ip_vs_conn_drop_conntrack(cp);
		}

		if (unlikely(cp->app != NULL))
			ip_vs_unbind_app(cp);
		ip_vs_unbind_dest(cp);
		if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {
			int af_id = ip_vs_af_index(cp->af);

			atomic_dec(&ipvs->no_cport_conns[af_id]);
		}
		if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
			ip_vs_conn_rcu_free(&cp->rcu_head);
		else
			call_rcu(&cp->rcu_head, ip_vs_conn_rcu_free);
		atomic_dec(&ipvs->conn_count);
		return;
	}

  expire_later:
	IP_VS_DBG(7, "delayed: conn->refcnt=%d conn->n_control=%d\n",
		  refcount_read(&cp->refcnt),
		  atomic_read(&cp->n_control));

	refcount_inc(&cp->refcnt);
	cp->timeout = 60*HZ;

	if (ipvs->sync_state & IP_VS_STATE_MASTER)
		ip_vs_sync_conn(ipvs, cp, sysctl_sync_threshold(ipvs));

	__ip_vs_conn_put_timer(cp);
}

/* Modify timer, so that it expires as soon as possible.
 * Can be called without reference only if under RCU lock.
 * We can have such chain of conns linked with ->control: DATA->CTL->TPL
 * - DATA (eg. FTP) and TPL (persistence) can be present depending on setup
 * - cp->timeout=0 indicates all conns from chain should be dropped but
 * TPL is not dropped if in assured state
 */
void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
{
	/* Using mod_timer_pending will ensure the timer is not
	 * modified after the final timer_delete in ip_vs_conn_expire.
	 */
	if (timer_pending(&cp->timer) &&
	    time_after(cp->timer.expires, jiffies))
		mod_timer_pending(&cp->timer, jiffies);
}


/*
 *	Create a new connection entry and hash it into the conn_tab
 */
struct ip_vs_conn *
ip_vs_conn_new(const struct ip_vs_conn_param *p, int dest_af,
	       const union nf_inet_addr *daddr, __be16 dport, unsigned int flags,
	       struct ip_vs_dest *dest, __u32 fwmark)
{
	struct ip_vs_conn *cp;
	struct netns_ipvs *ipvs = p->ipvs;
	struct ip_vs_proto_data *pd = ip_vs_proto_data_get(p->ipvs,
							   p->protocol);
	/* Increment conn_count up to conn_max */
	int count = atomic_read(&ipvs->conn_count);
	int max = sysctl_conn_max(ipvs);

	do {
		if (count >= max)
			return NULL;
	} while (!atomic_try_cmpxchg(&ipvs->conn_count, &count, count + 1));

	cp = kmem_cache_alloc(ip_vs_conn_cachep, GFP_ATOMIC);
	if (cp == NULL) {
		atomic_dec(&ipvs->conn_count);
		IP_VS_ERR_RL("%s(): no memory\n", __func__);
		return NULL;
	}

	INIT_HLIST_BL_NODE(&cp->hn0.node);
	INIT_HLIST_BL_NODE(&cp->hn1.node);
	timer_setup(&cp->timer, ip_vs_conn_expire, 0);
	cp->ipvs	   = ipvs;
	cp->hn0.dir	   = 0;
	cp->af		   = p->af;
	cp->hn1.dir	   = 1;
	cp->daf		   = dest_af;
	cp->protocol	   = p->protocol;
	ip_vs_addr_set(p->af, &cp->caddr, p->caddr);
	cp->cport	   = p->cport;
	/* proto should only be IPPROTO_IP if p->vaddr is a fwmark */
	ip_vs_addr_set(p->protocol == IPPROTO_IP ? AF_UNSPEC : p->af,
		       &cp->vaddr, p->vaddr);
	cp->vport	   = p->vport;
	ip_vs_addr_set(cp->daf, &cp->daddr, daddr);
	cp->dport          = dport;
	cp->flags	   = flags;
	cp->fwmark         = fwmark;
	if (flags & IP_VS_CONN_F_TEMPLATE && p->pe) {
		ip_vs_pe_get(p->pe);
		cp->pe = p->pe;
		cp->pe_data = p->pe_data;
		cp->pe_data_len = p->pe_data_len;
	} else {
		cp->pe = NULL;
		cp->pe_data = NULL;
		cp->pe_data_len = 0;
	}
	spin_lock_init(&cp->lock);

	/*
	 * Set the entry is referenced by the current thread before hashing
	 * it in the table, so that other thread run ip_vs_random_dropentry
	 * but cannot drop this entry.
	 */
	refcount_set(&cp->refcnt, 1);

	cp->control = NULL;
	atomic_set(&cp->n_control, 0);
	atomic_set(&cp->in_pkts, 0);

	cp->packet_xmit = NULL;
	cp->app = NULL;
	cp->app_data = NULL;
	/* reset struct ip_vs_seq */
	memset(&cp->in_seq, 0, sizeof(cp->in_seq));
	memset(&cp->out_seq, 0, sizeof(cp->out_seq));

	if (unlikely(flags & IP_VS_CONN_F_NO_CPORT)) {
		int af_id = ip_vs_af_index(cp->af);

		atomic_inc(&ipvs->no_cport_conns[af_id]);
	}

	/* Bind the connection with a destination server */
	cp->dest = NULL;
	ip_vs_bind_dest(cp, dest);

	/* Set its state and timeout */
	cp->state = 0;
	cp->old_state = 0;
	cp->timeout = 3*HZ;
	cp->sync_endtime = jiffies & ~3UL;

	/* Bind its packet transmitter */
#ifdef CONFIG_IP_VS_IPV6
	if (p->af == AF_INET6)
		ip_vs_bind_xmit_v6(cp);
	else
#endif
		ip_vs_bind_xmit(cp);

	if (unlikely(pd && atomic_read(&pd->appcnt)))
		ip_vs_bind_app(cp, pd->pp);

	/*
	 * Allow conntrack to be preserved. By default, conntrack
	 * is created and destroyed for every packet.
	 * Sometimes keeping conntrack can be useful for
	 * IP_VS_CONN_F_ONE_PACKET too.
	 */

	if (ip_vs_conntrack_enabled(ipvs))
		cp->flags |= IP_VS_CONN_F_NFCT;

	/* Hash it in the conn_tab finally */
	ip_vs_conn_hash(cp);

	return cp;
}

/*
 *	/proc/net/ip_vs_conn entries
 */
#ifdef CONFIG_PROC_FS
struct ip_vs_iter_state {
	struct seq_net_private	p;
	struct ip_vs_rht	*t;
	int			gen;
	u32			bucket;
	unsigned int		skip_elems;
};

static void *ip_vs_conn_array(struct seq_file *seq)
{
	struct ip_vs_iter_state *iter = seq->private;
	struct net *net = seq_file_net(seq);
	struct netns_ipvs *ipvs = net_ipvs(net);
	struct ip_vs_rht *t = iter->t;
	struct ip_vs_conn_hnode *hn;
	struct hlist_bl_node *e;
	int idx;

	if (!t)
		return NULL;
	for (idx = iter->bucket; idx < t->size; idx++) {
		unsigned int skip = 0;

		hlist_bl_for_each_entry_rcu(hn, e, &t->buckets[idx], node) {
			/* __ip_vs_conn_get() is not needed by
			 * ip_vs_conn_seq_show and ip_vs_conn_sync_seq_show
			 */
			if (!ip_vs_rht_same_table(t, READ_ONCE(hn->hash_key)))
				break;
			if (hn->dir != 0)
				continue;
			if (skip >= iter->skip_elems) {
				iter->bucket = idx;
				return hn;
			}

			++skip;
		}

		if (!(idx & 31)) {
			cond_resched_rcu();
			/* New table installed ? */
			if (iter->gen != atomic_read(&ipvs->conn_tab_changes))
				break;
		}
		iter->skip_elems = 0;
	}

	iter->bucket = idx;
	return NULL;
}

static void *ip_vs_conn_seq_start(struct seq_file *seq, loff_t *pos)
	__acquires(RCU)
{
	struct ip_vs_iter_state *iter = seq->private;
	struct net *net = seq_file_net(seq);
	struct netns_ipvs *ipvs = net_ipvs(net);

	rcu_read_lock();
	iter->gen = atomic_read(&ipvs->conn_tab_changes);
	smp_rmb(); /* ipvs->conn_tab and conn_tab_changes */
	iter->t = rcu_dereference(ipvs->conn_tab);
	if (*pos == 0) {
		iter->skip_elems = 0;
		iter->bucket = 0;
		return SEQ_START_TOKEN;
	}

	return ip_vs_conn_array(seq);
}

static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
	struct ip_vs_iter_state *iter = seq->private;
	struct ip_vs_conn_hnode *hn = v;
	struct hlist_bl_node *e;
	struct ip_vs_rht *t;

	++*pos;
	if (v == SEQ_START_TOKEN)
		return ip_vs_conn_array(seq);

	t = iter->t;
	if (!t)
		return NULL;

	/* more on same hash chain? */
	hlist_bl_for_each_entry_continue_rcu(hn, e, node) {
		/* Our cursor was moved to new table ? */
		if (!ip_vs_rht_same_table(t, READ_ONCE(hn->hash_key)))
			break;
		if (hn->dir != 0)
			continue;
		iter->skip_elems++;
		return hn;
	}

	iter->skip_elems = 0;
	iter->bucket++;

	return ip_vs_conn_array(seq);
}

static void ip_vs_conn_seq_stop(struct seq_file *seq, void *v)
	__releases(RCU)
{
	rcu_read_unlock();
}

static int ip_vs_conn_seq_show(struct seq_file *seq, void *v)
{

	if (v == SEQ_START_TOKEN)
		seq_puts(seq,
   "Pro FromIP   FPrt ToIP     TPrt DestIP   DPrt State       Expires PEName PEData\n");
	else {
		struct ip_vs_conn_hnode *hn = v;
		const struct ip_vs_conn *cp = ip_vs_hn0_to_conn(hn);
		char pe_data[IP_VS_PENAME_MAXLEN + IP_VS_PEDATA_MAXLEN + 3];
		size_t len = 0;
		char dbuf[IP_VS_ADDRSTRLEN];

		if (cp->pe_data) {
			pe_data[0] = ' ';
			len = strlen(cp->pe->name);
			memcpy(pe_data + 1, cp->pe->name, len);
			pe_data[len + 1] = ' ';
			len += 2;
			len += cp->pe->show_pe_data(cp, pe_data + len);
		}
		pe_data[len] = '\0';

#ifdef CONFIG_IP_VS_IPV6
		if (cp->daf == AF_INET6)
			snprintf(dbuf, sizeof(dbuf), "%pI6", &cp->daddr.in6);
		else
#endif
			snprintf(dbuf, sizeof(dbuf), "%08X",
				 ntohl(cp->daddr.ip));

#ifdef CONFIG_IP_VS_IPV6
		if (cp->af == AF_INET6)
			seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X "
				"%s %04X %-11s %7u%s\n",
				ip_vs_proto_name(cp->protocol),
				&cp->caddr.in6, ntohs(cp->cport),
				&cp->vaddr.in6, ntohs(cp->vport),
				dbuf, ntohs(cp->dport),
				ip_vs_state_name(cp),
				jiffies_delta_to_msecs(cp->timer.expires -
						       jiffies) / 1000,
				pe_data);
		else
#endif
			seq_printf(seq,
				"%-3s %08X %04X %08X %04X"
				" %s %04X %-11s %7u%s\n",
				ip_vs_proto_name(cp->protocol),
				ntohl(cp->caddr.ip), ntohs(cp->cport),
				ntohl(cp->vaddr.ip), ntohs(cp->vport),
				dbuf, ntohs(cp->dport),
				ip_vs_state_name(cp),
				jiffies_delta_to_msecs(cp->timer.expires -
						       jiffies) / 1000,
				pe_data);
	}
	return 0;
}

static const struct seq_operations ip_vs_conn_seq_ops = {
	.start = ip_vs_conn_seq_start,
	.next  = ip_vs_conn_seq_next,
	.stop  = ip_vs_conn_seq_stop,
	.show  = ip_vs_conn_seq_show,
};

static const char *ip_vs_origin_name(unsigned int flags)
{
	if (flags & IP_VS_CONN_F_SYNC)
		return "SYNC";
	else
		return "LOCAL";
}

static int ip_vs_conn_sync_seq_show(struct seq_file *seq, void *v)
{
	char dbuf[IP_VS_ADDRSTRLEN];

	if (v == SEQ_START_TOKEN)
		seq_puts(seq,
   "Pro FromIP   FPrt ToIP     TPrt DestIP   DPrt State       Origin Expires\n");
	else {
		const struct ip_vs_conn *cp = v;

#ifdef CONFIG_IP_VS_IPV6
		if (cp->daf == AF_INET6)
			snprintf(dbuf, sizeof(dbuf), "%pI6", &cp->daddr.in6);
		else
#endif
			snprintf(dbuf, sizeof(dbuf), "%08X",
				 ntohl(cp->daddr.ip));

#ifdef CONFIG_IP_VS_IPV6
		if (cp->af == AF_INET6)
			seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X "
				"%s %04X %-11s %-6s %7u\n",
				ip_vs_proto_name(cp->protocol),
				&cp->caddr.in6, ntohs(cp->cport),
				&cp->vaddr.in6, ntohs(cp->vport),
				dbuf, ntohs(cp->dport),
				ip_vs_state_name(cp),
				ip_vs_origin_name(cp->flags),
				jiffies_delta_to_msecs(cp->timer.expires -
						       jiffies) / 1000);
		else
#endif
			seq_printf(seq,
				"%-3s %08X %04X %08X %04X "
				"%s %04X %-11s %-6s %7u\n",
				ip_vs_proto_name(cp->protocol),
				ntohl(cp->caddr.ip), ntohs(cp->cport),
				ntohl(cp->vaddr.ip), ntohs(cp->vport),
				dbuf, ntohs(cp->dport),
				ip_vs_state_name(cp),
				ip_vs_origin_name(cp->flags),
				jiffies_delta_to_msecs(cp->timer.expires -
						       jiffies) / 1000);
	}
	return 0;
}

static const struct seq_operations ip_vs_conn_sync_seq_ops = {
	.start = ip_vs_conn_seq_start,
	.next  = ip_vs_conn_seq_next,
	.stop  = ip_vs_conn_seq_stop,
	.show  = ip_vs_conn_sync_seq_show,
};
#endif

#ifdef CONFIG_SYSCTL

/* Randomly drop connection entries before running out of memory
 * Can be used for DATA and CTL conns. For TPL conns there are exceptions:
 * - traffic for services in OPS mode increases ct->in_pkts, so it is supported
 * - traffic for services not in OPS mode does not increase ct->in_pkts in
 * all cases, so it is not supported
 */
static inline int todrop_entry(struct ip_vs_conn *cp)
{
	struct netns_ipvs *ipvs = cp->ipvs;
	int i;

	/* if the conn entry hasn't lasted for 60 seconds, don't drop it.
	   This will leave enough time for normal connection to get
	   through. */
	if (time_before(cp->timeout + jiffies, cp->timer.expires + 60*HZ))
		return 0;

	/* Drop only conns with number of incoming packets in [1..8] range */
	i = atomic_read(&cp->in_pkts);
	if (i > 8 || i < 1)
		return 0;

	i--;
	if (--ipvs->dropentry_counters[i] > 0)
		return 0;

	/* Prefer to drop conns with less number of incoming packets */
	ipvs->dropentry_counters[i] = i + 1;
	return 1;
}

static inline bool ip_vs_conn_ops_mode(struct ip_vs_conn *cp)
{
	struct ip_vs_service *svc;

	if (!cp->dest)
		return false;
	svc = rcu_dereference(cp->dest->svc);
	return svc && (svc->flags & IP_VS_SVC_F_ONEPACKET);
}

void ip_vs_random_dropentry(struct netns_ipvs *ipvs)
{
	struct ip_vs_conn_hnode *hn;
	struct hlist_bl_node *e;
	struct ip_vs_conn *cp;
	struct ip_vs_rht *t;
	unsigned int r;
	int idx;

	r = get_random_u32();
	rcu_read_lock();
	t = rcu_dereference(ipvs->conn_tab);
	if (!t)
		goto out;
	/*
	 * Randomly scan 1/32 of the whole table every second
	 */
	for (idx = 0; idx < (t->size >> 5); idx++) {
		unsigned int hash = (r + idx) & t->mask;

		/* Don't care if due to moved entry we jump to another bucket
		 * and even to new table
		 */
		hlist_bl_for_each_entry_rcu(hn, e, &t->buckets[hash], node) {
			if (hn->dir != 0)
				continue;
			cp = ip_vs_hn0_to_conn(hn);
			if (atomic_read(&cp->n_control))
				continue;
			if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
				/* connection template of OPS */
				if (ip_vs_conn_ops_mode(cp))
					goto try_drop;
				if (!(cp->state & IP_VS_CTPL_S_ASSURED))
					goto drop;
				continue;
			}
			if (cp->protocol == IPPROTO_TCP) {
				switch(cp->state) {
				case IP_VS_TCP_S_SYN_RECV:
				case IP_VS_TCP_S_SYNACK:
					break;

				case IP_VS_TCP_S_ESTABLISHED:
					if (todrop_entry(cp))
						break;
					continue;

				default:
					continue;
				}
			} else if (cp->protocol == IPPROTO_SCTP) {
				switch (cp->state) {
				case IP_VS_SCTP_S_INIT1:
				case IP_VS_SCTP_S_INIT:
					break;
				case IP_VS_SCTP_S_ESTABLISHED:
					if (todrop_entry(cp))
						break;
					continue;
				default:
					continue;
				}
			} else {
try_drop:
				if (!todrop_entry(cp))
					continue;
			}

drop:
			IP_VS_DBG(4, "drop connection\n");
			ip_vs_conn_del(cp);
		}
		if (!(idx & 31)) {
			cond_resched_rcu();
			t = rcu_dereference(ipvs->conn_tab);
			if (!t)
				goto out;
		}
	}

out:
	rcu_read_unlock();
}
#endif

/* Flush all the connection entries in the conn_tab */
static void ip_vs_conn_flush(struct netns_ipvs *ipvs)
{
	DECLARE_IP_VS_RHT_WALK_BUCKETS_SAFE_RCU();
	struct ip_vs_conn *cp, *cp_c;
	struct ip_vs_conn_hnode *hn;
	struct hlist_bl_head *head;
	struct ip_vs_rht *t, *p;
	struct hlist_bl_node *e;

	if (!rcu_dereference_protected(ipvs->conn_tab, 1))
		return;
	disable_delayed_work_sync(&ipvs->conn_resize_work);
	if (!atomic_read(&ipvs->conn_count))
		goto unreg;

flush_again:
	/* Rely on RCU grace period while accessing cp after ip_vs_conn_del */
	rcu_read_lock();
	ip_vs_rht_walk_buckets_safe_rcu(ipvs->conn_tab, head) {
		hlist_bl_for_each_entry_rcu(hn, e, head, node) {
			if (hn->dir != 0)
				continue;
			cp = ip_vs_hn0_to_conn(hn);
			if (atomic_read(&cp->n_control))
				continue;
			cp_c = cp->control;
			IP_VS_DBG(4, "del connection\n");
			ip_vs_conn_del(cp);
			if (cp_c && !atomic_read(&cp_c->n_control)) {
				IP_VS_DBG(4, "del controlling connection\n");
				ip_vs_conn_del(cp_c);
			}
		}
		cond_resched_rcu();
	}
	rcu_read_unlock();

	/* the counter may be not NULL, because maybe some conn entries
	   are run by slow timer handler or unhashed but still referred */
	if (atomic_read(&ipvs->conn_count) != 0) {
		schedule();
		goto flush_again;
	}

unreg:
	/* Unregister the hash table and release it after RCU grace period.
	 * This is needed because other works may not be stopped yet and
	 * they may walk the tables.
	 */
	t = rcu_dereference_protected(ipvs->conn_tab, 1);
	rcu_assign_pointer(ipvs->conn_tab, NULL);
	/* Inform readers that conn_tab is changed */
	smp_mb__before_atomic();
	atomic_inc(&ipvs->conn_tab_changes);
	while (1) {
		p = rcu_dereference_protected(t->new_tbl, 1);
		call_rcu(&t->rcu_head, ip_vs_rht_rcu_free);
		if (p == t)
			break;
		t = p;
	}
}

#ifdef CONFIG_SYSCTL
void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
{
	DECLARE_IP_VS_RHT_WALK_BUCKETS_RCU();
	unsigned int resched_score = 0;
	struct ip_vs_conn *cp, *cp_c;
	struct ip_vs_conn_hnode *hn;
	struct hlist_bl_head *head;
	struct ip_vs_dest *dest;
	struct hlist_bl_node *e;
	int old_gen, new_gen;

	if (!atomic_read(&ipvs->conn_count))
		return;
	old_gen = atomic_read(&ipvs->conn_tab_changes);
	rcu_read_lock();

repeat:
	smp_rmb(); /* ipvs->conn_tab and conn_tab_changes */
	ip_vs_rht_walk_buckets_rcu(ipvs->conn_tab, head) {
		hlist_bl_for_each_entry_rcu(hn, e, head, node) {
			if (hn->dir != 0)
				continue;
			cp = ip_vs_hn0_to_conn(hn);
			resched_score++;
			dest = cp->dest;
			if (!dest || (dest->cflags & IP_VS_DEST_CF_AVAILABLE))
				continue;

			if (atomic_read(&cp->n_control))
				continue;

			cp_c = cp->control;
			IP_VS_DBG(4, "del connection\n");
			ip_vs_conn_del(cp);
			if (cp_c && !atomic_read(&cp_c->n_control)) {
				IP_VS_DBG(4, "del controlling connection\n");
				ip_vs_conn_del(cp_c);
			}
			resched_score += 10;
		}
		resched_score++;
		if (resched_score >= 100) {
			resched_score = 0;
			cond_resched_rcu();
			/* netns clean up started, abort delayed work */
			if (!READ_ONCE(ipvs->enable))
				goto out;
			new_gen = atomic_read(&ipvs->conn_tab_changes);
			/* New table installed ? */
			if (old_gen != new_gen) {
				old_gen = new_gen;
				goto repeat;
			}
		}
	}

out:
	rcu_read_unlock();
}
#endif

/*
 * per netns init and exit
 */
int __net_init ip_vs_conn_net_init(struct netns_ipvs *ipvs)
{
	int idx;

	atomic_set(&ipvs->conn_count, 0);
	for (idx = 0; idx < IP_VS_AF_MAX; idx++)
		atomic_set(&ipvs->no_cport_conns[idx], 0);
	INIT_DELAYED_WORK(&ipvs->conn_resize_work, conn_resize_work_handler);
	RCU_INIT_POINTER(ipvs->conn_tab, NULL);
	atomic_set(&ipvs->conn_tab_changes, 0);
	ipvs->sysctl_conn_lfactor = ip_vs_conn_default_load_factor(ipvs);

#ifdef CONFIG_PROC_FS
	if (!proc_create_net("ip_vs_conn", 0, ipvs->net->proc_net,
			     &ip_vs_conn_seq_ops,
			     sizeof(struct ip_vs_iter_state)))
		goto err_conn;

	if (!proc_create_net("ip_vs_conn_sync", 0, ipvs->net->proc_net,
			     &ip_vs_conn_sync_seq_ops,
			     sizeof(struct ip_vs_iter_state)))
		goto err_conn_sync;
#endif

	return 0;

#ifdef CONFIG_PROC_FS
err_conn_sync:
	remove_proc_entry("ip_vs_conn", ipvs->net->proc_net);
err_conn:
	return -ENOMEM;
#endif
}

void __net_exit ip_vs_conn_net_cleanup(struct netns_ipvs *ipvs)
{
	/* flush all the connection entries first */
	ip_vs_conn_flush(ipvs);
#ifdef CONFIG_PROC_FS
	remove_proc_entry("ip_vs_conn", ipvs->net->proc_net);
	remove_proc_entry("ip_vs_conn_sync", ipvs->net->proc_net);
#endif
}

int __init ip_vs_conn_init(void)
{
	int min = IP_VS_CONN_TAB_MIN_BITS;
	int max = IP_VS_CONN_TAB_MAX_BITS;
	size_t tab_array_size;
	int max_avail;

	max_avail = order_base_2(totalram_pages()) + PAGE_SHIFT;
	/* 64-bit: 27 bits at 64GB, 32-bit: 20 bits at 512MB */
	max_avail += 1;		/* hash table loaded at 50% */
	max_avail -= 1;		/* IPVS up to 1/2 of mem */
	max_avail -= order_base_2(sizeof(struct ip_vs_conn));
	max = clamp(max_avail, min, max);
	ip_vs_conn_tab_bits = clamp(ip_vs_conn_tab_bits, min, max);
	ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;

	/*
	 * Allocate the connection hash table and initialize its list heads
	 */
	tab_array_size = array_size(ip_vs_conn_tab_size,
				    sizeof(struct hlist_bl_head));

	/* Allocate ip_vs_conn slab cache */
	ip_vs_conn_cachep = KMEM_CACHE(ip_vs_conn, SLAB_HWCACHE_ALIGN);
	if (!ip_vs_conn_cachep)
		return -ENOMEM;

	pr_info("Connection hash table configured (size=%d, memory=%zdKbytes)\n",
		ip_vs_conn_tab_size, tab_array_size / 1024);
	IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n",
		  sizeof(struct ip_vs_conn));

	return 0;
}

void ip_vs_conn_cleanup(void)
{
	/* Wait all ip_vs_conn_rcu_free() callbacks to complete */
	rcu_barrier();
	/* Release the empty cache */
	kmem_cache_destroy(ip_vs_conn_cachep);
}