1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * IPVS An implementation of the IP virtual server support for the 4 * LINUX operating system. IPVS is now implemented as a module 5 * over the NetFilter framework. IPVS can be used to build a 6 * high-performance and highly available server based on a 7 * cluster of servers. 8 * 9 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org> 10 * Peter Kese <peter.kese@ijs.si> 11 * Julian Anastasov <ja@ssi.bg> 12 * 13 * Changes: 14 */ 15 16 #define KMSG_COMPONENT "IPVS" 17 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 18 19 #include <linux/module.h> 20 #include <linux/init.h> 21 #include <linux/types.h> 22 #include <linux/capability.h> 23 #include <linux/fs.h> 24 #include <linux/sysctl.h> 25 #include <linux/proc_fs.h> 26 #include <linux/workqueue.h> 27 #include <linux/seq_file.h> 28 #include <linux/slab.h> 29 30 #include <linux/netfilter.h> 31 #include <linux/netfilter_ipv4.h> 32 #include <linux/mutex.h> 33 34 #include <net/net_namespace.h> 35 #include <linux/nsproxy.h> 36 #include <net/ip.h> 37 #ifdef CONFIG_IP_VS_IPV6 38 #include <net/ipv6.h> 39 #include <net/ip6_route.h> 40 #include <net/netfilter/ipv6/nf_defrag_ipv6.h> 41 #endif 42 #include <net/route.h> 43 #include <net/sock.h> 44 #include <net/genetlink.h> 45 46 #include <linux/uaccess.h> 47 48 #include <net/ip_vs.h> 49 50 MODULE_ALIAS_GENL_FAMILY(IPVS_GENL_NAME); 51 52 DEFINE_MUTEX(__ip_vs_mutex); /* Serialize configuration with sockopt/netlink */ 53 54 /* sysctl variables */ 55 56 #ifdef CONFIG_IP_VS_DEBUG 57 static int sysctl_ip_vs_debug_level = 0; 58 59 int ip_vs_get_debug_level(void) 60 { 61 return sysctl_ip_vs_debug_level; 62 } 63 #endif 64 65 66 /* Protos */ 67 static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup); 68 69 70 #ifdef CONFIG_IP_VS_IPV6 71 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */ 72 static bool __ip_vs_addr_is_local_v6(struct net *net, 73 const struct in6_addr *addr) 74 { 75 struct flowi6 fl6 = { 76 .daddr = *addr, 77 }; 78 struct dst_entry *dst = ip6_route_output(net, NULL, &fl6); 79 bool is_local; 80 81 is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK); 82 83 dst_release(dst); 84 return is_local; 85 } 86 #endif 87 88 #ifdef CONFIG_SYSCTL 89 /* 90 * update_defense_level is called from keventd and from sysctl, 91 * so it needs to protect itself from softirqs 92 */ 93 static void update_defense_level(struct netns_ipvs *ipvs) 94 { 95 struct sysinfo i; 96 int availmem; 97 int amemthresh; 98 int nomem; 99 int to_change = -1; 100 101 /* we only count free and buffered memory (in pages) */ 102 si_meminfo(&i); 103 availmem = i.freeram + i.bufferram; 104 /* however in linux 2.5 the i.bufferram is total page cache size, 105 we need adjust it */ 106 /* si_swapinfo(&i); */ 107 /* availmem = availmem - (i.totalswap - i.freeswap); */ 108 109 amemthresh = max(READ_ONCE(ipvs->sysctl_amemthresh), 0); 110 nomem = (availmem < amemthresh); 111 112 local_bh_disable(); 113 114 /* drop_entry */ 115 spin_lock(&ipvs->dropentry_lock); 116 switch (ipvs->sysctl_drop_entry) { 117 case 0: 118 atomic_set(&ipvs->dropentry, 0); 119 break; 120 case 1: 121 if (nomem) { 122 atomic_set(&ipvs->dropentry, 1); 123 ipvs->sysctl_drop_entry = 2; 124 } else { 125 atomic_set(&ipvs->dropentry, 0); 126 } 127 break; 128 case 2: 129 if (nomem) { 130 atomic_set(&ipvs->dropentry, 1); 131 } else { 132 atomic_set(&ipvs->dropentry, 0); 133 ipvs->sysctl_drop_entry = 1; 134 } 135 break; 136 case 3: 137 atomic_set(&ipvs->dropentry, 1); 138 break; 139 } 140 spin_unlock(&ipvs->dropentry_lock); 141 142 /* drop_packet */ 143 spin_lock(&ipvs->droppacket_lock); 144 switch (ipvs->sysctl_drop_packet) { 145 case 0: 146 ipvs->drop_rate = 0; 147 break; 148 case 1: 149 if (nomem) { 150 ipvs->drop_counter = amemthresh / (amemthresh - availmem); 151 ipvs->drop_rate = ipvs->drop_counter; 152 ipvs->sysctl_drop_packet = 2; 153 } else { 154 ipvs->drop_rate = 0; 155 } 156 break; 157 case 2: 158 if (nomem) { 159 ipvs->drop_counter = amemthresh / (amemthresh - availmem); 160 ipvs->drop_rate = ipvs->drop_counter; 161 } else { 162 ipvs->drop_rate = 0; 163 ipvs->sysctl_drop_packet = 1; 164 } 165 break; 166 case 3: 167 ipvs->drop_rate = ipvs->sysctl_am_droprate; 168 break; 169 } 170 spin_unlock(&ipvs->droppacket_lock); 171 172 /* secure_tcp */ 173 spin_lock(&ipvs->securetcp_lock); 174 switch (ipvs->sysctl_secure_tcp) { 175 case 0: 176 if (ipvs->old_secure_tcp >= 2) 177 to_change = 0; 178 break; 179 case 1: 180 if (nomem) { 181 if (ipvs->old_secure_tcp < 2) 182 to_change = 1; 183 ipvs->sysctl_secure_tcp = 2; 184 } else { 185 if (ipvs->old_secure_tcp >= 2) 186 to_change = 0; 187 } 188 break; 189 case 2: 190 if (nomem) { 191 if (ipvs->old_secure_tcp < 2) 192 to_change = 1; 193 } else { 194 if (ipvs->old_secure_tcp >= 2) 195 to_change = 0; 196 ipvs->sysctl_secure_tcp = 1; 197 } 198 break; 199 case 3: 200 if (ipvs->old_secure_tcp < 2) 201 to_change = 1; 202 break; 203 } 204 ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp; 205 if (to_change >= 0) 206 ip_vs_protocol_timeout_change(ipvs, 207 ipvs->sysctl_secure_tcp > 1); 208 spin_unlock(&ipvs->securetcp_lock); 209 210 local_bh_enable(); 211 } 212 213 /* Handler for delayed work for expiring no 214 * destination connections 215 */ 216 static void expire_nodest_conn_handler(struct work_struct *work) 217 { 218 struct netns_ipvs *ipvs; 219 220 ipvs = container_of(work, struct netns_ipvs, 221 expire_nodest_conn_work.work); 222 ip_vs_expire_nodest_conn_flush(ipvs); 223 } 224 225 /* 226 * Timer for checking the defense 227 */ 228 #define DEFENSE_TIMER_PERIOD 1*HZ 229 230 static void defense_work_handler(struct work_struct *work) 231 { 232 struct netns_ipvs *ipvs = 233 container_of(work, struct netns_ipvs, defense_work.work); 234 235 update_defense_level(ipvs); 236 if (atomic_read(&ipvs->dropentry)) 237 ip_vs_random_dropentry(ipvs); 238 queue_delayed_work(system_long_wq, &ipvs->defense_work, 239 DEFENSE_TIMER_PERIOD); 240 } 241 #endif 242 243 static void est_reload_work_handler(struct work_struct *work) 244 { 245 struct netns_ipvs *ipvs = 246 container_of(work, struct netns_ipvs, est_reload_work.work); 247 int genid_done = atomic_read(&ipvs->est_genid_done); 248 unsigned long delay = HZ / 10; /* repeat startups after failure */ 249 bool repeat = false; 250 int genid; 251 int id; 252 253 mutex_lock(&ipvs->est_mutex); 254 genid = atomic_read(&ipvs->est_genid); 255 for (id = 0; id < ipvs->est_kt_count; id++) { 256 struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id]; 257 258 /* netns clean up started, abort delayed work */ 259 if (!READ_ONCE(ipvs->enable)) 260 goto unlock; 261 if (!kd) 262 continue; 263 /* New config ? Stop kthread tasks */ 264 if (genid != genid_done) 265 ip_vs_est_kthread_stop(kd); 266 if (!kd->task && !ip_vs_est_stopped(ipvs)) { 267 /* Do not start kthreads above 0 in calc phase */ 268 if ((!id || !ipvs->est_calc_phase) && 269 ip_vs_est_kthread_start(ipvs, kd) < 0) 270 repeat = true; 271 } 272 } 273 274 atomic_set(&ipvs->est_genid_done, genid); 275 276 if (repeat) 277 queue_delayed_work(system_long_wq, &ipvs->est_reload_work, 278 delay); 279 280 unlock: 281 mutex_unlock(&ipvs->est_mutex); 282 } 283 284 int 285 ip_vs_use_count_inc(void) 286 { 287 return try_module_get(THIS_MODULE); 288 } 289 290 void 291 ip_vs_use_count_dec(void) 292 { 293 module_put(THIS_MODULE); 294 } 295 296 297 /* 298 * Hash table: for virtual service lookups 299 */ 300 #define IP_VS_SVC_TAB_BITS 8 301 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS) 302 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1) 303 304 /* the service table hashed by <protocol, addr, port> */ 305 static struct hlist_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE]; 306 /* the service table hashed by fwmark */ 307 static struct hlist_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE]; 308 309 310 /* 311 * Returns hash value for virtual service 312 */ 313 static inline unsigned int 314 ip_vs_svc_hashkey(struct netns_ipvs *ipvs, int af, unsigned int proto, 315 const union nf_inet_addr *addr, __be16 port) 316 { 317 unsigned int porth = ntohs(port); 318 __be32 addr_fold = addr->ip; 319 __u32 ahash; 320 321 #ifdef CONFIG_IP_VS_IPV6 322 if (af == AF_INET6) 323 addr_fold = addr->ip6[0]^addr->ip6[1]^ 324 addr->ip6[2]^addr->ip6[3]; 325 #endif 326 ahash = ntohl(addr_fold); 327 ahash ^= ((size_t) ipvs >> 8); 328 329 return (proto ^ ahash ^ (porth >> IP_VS_SVC_TAB_BITS) ^ porth) & 330 IP_VS_SVC_TAB_MASK; 331 } 332 333 /* 334 * Returns hash value of fwmark for virtual service lookup 335 */ 336 static inline unsigned int ip_vs_svc_fwm_hashkey(struct netns_ipvs *ipvs, __u32 fwmark) 337 { 338 return (((size_t)ipvs>>8) ^ fwmark) & IP_VS_SVC_TAB_MASK; 339 } 340 341 /* 342 * Hashes a service in the ip_vs_svc_table by <netns,proto,addr,port> 343 * or in the ip_vs_svc_fwm_table by fwmark. 344 * Should be called with locked tables. 345 */ 346 static int ip_vs_svc_hash(struct ip_vs_service *svc) 347 { 348 unsigned int hash; 349 350 if (svc->flags & IP_VS_SVC_F_HASHED) { 351 pr_err("%s(): request for already hashed, called from %pS\n", 352 __func__, __builtin_return_address(0)); 353 return 0; 354 } 355 356 if (svc->fwmark == 0) { 357 /* 358 * Hash it by <netns,protocol,addr,port> in ip_vs_svc_table 359 */ 360 hash = ip_vs_svc_hashkey(svc->ipvs, svc->af, svc->protocol, 361 &svc->addr, svc->port); 362 hlist_add_head_rcu(&svc->s_list, &ip_vs_svc_table[hash]); 363 } else { 364 /* 365 * Hash it by fwmark in svc_fwm_table 366 */ 367 hash = ip_vs_svc_fwm_hashkey(svc->ipvs, svc->fwmark); 368 hlist_add_head_rcu(&svc->f_list, &ip_vs_svc_fwm_table[hash]); 369 } 370 371 svc->flags |= IP_VS_SVC_F_HASHED; 372 /* increase its refcnt because it is referenced by the svc table */ 373 atomic_inc(&svc->refcnt); 374 return 1; 375 } 376 377 378 /* 379 * Unhashes a service from svc_table / svc_fwm_table. 380 * Should be called with locked tables. 381 */ 382 static int ip_vs_svc_unhash(struct ip_vs_service *svc) 383 { 384 if (!(svc->flags & IP_VS_SVC_F_HASHED)) { 385 pr_err("%s(): request for unhash flagged, called from %pS\n", 386 __func__, __builtin_return_address(0)); 387 return 0; 388 } 389 390 if (svc->fwmark == 0) { 391 /* Remove it from the svc_table table */ 392 hlist_del_rcu(&svc->s_list); 393 } else { 394 /* Remove it from the svc_fwm_table table */ 395 hlist_del_rcu(&svc->f_list); 396 } 397 398 svc->flags &= ~IP_VS_SVC_F_HASHED; 399 atomic_dec(&svc->refcnt); 400 return 1; 401 } 402 403 404 /* 405 * Get service by {netns, proto,addr,port} in the service table. 406 */ 407 static inline struct ip_vs_service * 408 __ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u16 protocol, 409 const union nf_inet_addr *vaddr, __be16 vport) 410 { 411 unsigned int hash; 412 struct ip_vs_service *svc; 413 414 /* Check for "full" addressed entries */ 415 hash = ip_vs_svc_hashkey(ipvs, af, protocol, vaddr, vport); 416 417 hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[hash], s_list) { 418 if ((svc->af == af) 419 && ip_vs_addr_equal(af, &svc->addr, vaddr) 420 && (svc->port == vport) 421 && (svc->protocol == protocol) 422 && (svc->ipvs == ipvs)) { 423 /* HIT */ 424 return svc; 425 } 426 } 427 428 return NULL; 429 } 430 431 432 /* 433 * Get service by {fwmark} in the service table. 434 */ 435 static inline struct ip_vs_service * 436 __ip_vs_svc_fwm_find(struct netns_ipvs *ipvs, int af, __u32 fwmark) 437 { 438 unsigned int hash; 439 struct ip_vs_service *svc; 440 441 /* Check for fwmark addressed entries */ 442 hash = ip_vs_svc_fwm_hashkey(ipvs, fwmark); 443 444 hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[hash], f_list) { 445 if (svc->fwmark == fwmark && svc->af == af 446 && (svc->ipvs == ipvs)) { 447 /* HIT */ 448 return svc; 449 } 450 } 451 452 return NULL; 453 } 454 455 /* Find service, called under RCU lock */ 456 struct ip_vs_service * 457 ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u32 fwmark, __u16 protocol, 458 const union nf_inet_addr *vaddr, __be16 vport) 459 { 460 struct ip_vs_service *svc; 461 462 /* 463 * Check the table hashed by fwmark first 464 */ 465 if (fwmark) { 466 svc = __ip_vs_svc_fwm_find(ipvs, af, fwmark); 467 if (svc) 468 goto out; 469 } 470 471 /* 472 * Check the table hashed by <protocol,addr,port> 473 * for "full" addressed entries 474 */ 475 svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, vport); 476 477 if (!svc && protocol == IPPROTO_TCP && 478 atomic_read(&ipvs->ftpsvc_counter) && 479 (vport == FTPDATA || !inet_port_requires_bind_service(ipvs->net, ntohs(vport)))) { 480 /* 481 * Check if ftp service entry exists, the packet 482 * might belong to FTP data connections. 483 */ 484 svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, FTPPORT); 485 } 486 487 if (svc == NULL 488 && atomic_read(&ipvs->nullsvc_counter)) { 489 /* 490 * Check if the catch-all port (port zero) exists 491 */ 492 svc = __ip_vs_service_find(ipvs, af, protocol, vaddr, 0); 493 } 494 495 out: 496 IP_VS_DBG_BUF(9, "lookup service: fwm %u %s %s:%u %s\n", 497 fwmark, ip_vs_proto_name(protocol), 498 IP_VS_DBG_ADDR(af, vaddr), ntohs(vport), 499 svc ? "hit" : "not hit"); 500 501 return svc; 502 } 503 504 505 static inline void 506 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc) 507 { 508 atomic_inc(&svc->refcnt); 509 rcu_assign_pointer(dest->svc, svc); 510 } 511 512 static void ip_vs_service_free(struct ip_vs_service *svc) 513 { 514 ip_vs_stats_release(&svc->stats); 515 kfree(svc); 516 } 517 518 static void ip_vs_service_rcu_free(struct rcu_head *head) 519 { 520 struct ip_vs_service *svc; 521 522 svc = container_of(head, struct ip_vs_service, rcu_head); 523 ip_vs_service_free(svc); 524 } 525 526 static void __ip_vs_svc_put(struct ip_vs_service *svc) 527 { 528 if (atomic_dec_and_test(&svc->refcnt)) { 529 IP_VS_DBG_BUF(3, "Removing service %u/%s:%u\n", 530 svc->fwmark, 531 IP_VS_DBG_ADDR(svc->af, &svc->addr), 532 ntohs(svc->port)); 533 call_rcu(&svc->rcu_head, ip_vs_service_rcu_free); 534 } 535 } 536 537 538 /* 539 * Returns hash value for real service 540 */ 541 static inline unsigned int ip_vs_rs_hashkey(int af, 542 const union nf_inet_addr *addr, 543 __be16 port) 544 { 545 unsigned int porth = ntohs(port); 546 __be32 addr_fold = addr->ip; 547 548 #ifdef CONFIG_IP_VS_IPV6 549 if (af == AF_INET6) 550 addr_fold = addr->ip6[0]^addr->ip6[1]^ 551 addr->ip6[2]^addr->ip6[3]; 552 #endif 553 554 return (ntohl(addr_fold)^(porth>>IP_VS_RTAB_BITS)^porth) 555 & IP_VS_RTAB_MASK; 556 } 557 558 /* Hash ip_vs_dest in rs_table by <proto,addr,port>. */ 559 static void ip_vs_rs_hash(struct netns_ipvs *ipvs, struct ip_vs_dest *dest) 560 { 561 unsigned int hash; 562 __be16 port; 563 564 if (dest->in_rs_table) 565 return; 566 567 switch (IP_VS_DFWD_METHOD(dest)) { 568 case IP_VS_CONN_F_MASQ: 569 port = dest->port; 570 break; 571 case IP_VS_CONN_F_TUNNEL: 572 switch (dest->tun_type) { 573 case IP_VS_CONN_F_TUNNEL_TYPE_GUE: 574 port = dest->tun_port; 575 break; 576 case IP_VS_CONN_F_TUNNEL_TYPE_IPIP: 577 case IP_VS_CONN_F_TUNNEL_TYPE_GRE: 578 port = 0; 579 break; 580 default: 581 return; 582 } 583 break; 584 default: 585 return; 586 } 587 588 /* 589 * Hash by proto,addr,port, 590 * which are the parameters of the real service. 591 */ 592 hash = ip_vs_rs_hashkey(dest->af, &dest->addr, port); 593 594 hlist_add_head_rcu(&dest->d_list, &ipvs->rs_table[hash]); 595 dest->in_rs_table = 1; 596 } 597 598 /* Unhash ip_vs_dest from rs_table. */ 599 static void ip_vs_rs_unhash(struct ip_vs_dest *dest) 600 { 601 /* 602 * Remove it from the rs_table table. 603 */ 604 if (dest->in_rs_table) { 605 hlist_del_rcu(&dest->d_list); 606 dest->in_rs_table = 0; 607 } 608 } 609 610 /* Check if real service by <proto,addr,port> is present */ 611 bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol, 612 const union nf_inet_addr *daddr, __be16 dport) 613 { 614 unsigned int hash; 615 struct ip_vs_dest *dest; 616 617 /* Check for "full" addressed entries */ 618 hash = ip_vs_rs_hashkey(af, daddr, dport); 619 620 hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) { 621 if (dest->port == dport && 622 dest->af == af && 623 ip_vs_addr_equal(af, &dest->addr, daddr) && 624 (dest->protocol == protocol || dest->vfwmark) && 625 IP_VS_DFWD_METHOD(dest) == IP_VS_CONN_F_MASQ) { 626 /* HIT */ 627 return true; 628 } 629 } 630 631 return false; 632 } 633 634 /* Find real service record by <proto,addr,port>. 635 * In case of multiple records with the same <proto,addr,port>, only 636 * the first found record is returned. 637 * 638 * To be called under RCU lock. 639 */ 640 struct ip_vs_dest *ip_vs_find_real_service(struct netns_ipvs *ipvs, int af, 641 __u16 protocol, 642 const union nf_inet_addr *daddr, 643 __be16 dport) 644 { 645 unsigned int hash; 646 struct ip_vs_dest *dest; 647 648 /* Check for "full" addressed entries */ 649 hash = ip_vs_rs_hashkey(af, daddr, dport); 650 651 hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) { 652 if (dest->port == dport && 653 dest->af == af && 654 ip_vs_addr_equal(af, &dest->addr, daddr) && 655 (dest->protocol == protocol || dest->vfwmark) && 656 IP_VS_DFWD_METHOD(dest) == IP_VS_CONN_F_MASQ) { 657 /* HIT */ 658 return dest; 659 } 660 } 661 662 return NULL; 663 } 664 665 /* Find real service record by <af,addr,tun_port>. 666 * In case of multiple records with the same <af,addr,tun_port>, only 667 * the first found record is returned. 668 * 669 * To be called under RCU lock. 670 */ 671 struct ip_vs_dest *ip_vs_find_tunnel(struct netns_ipvs *ipvs, int af, 672 const union nf_inet_addr *daddr, 673 __be16 tun_port) 674 { 675 struct ip_vs_dest *dest; 676 unsigned int hash; 677 678 /* Check for "full" addressed entries */ 679 hash = ip_vs_rs_hashkey(af, daddr, tun_port); 680 681 hlist_for_each_entry_rcu(dest, &ipvs->rs_table[hash], d_list) { 682 if (dest->tun_port == tun_port && 683 dest->af == af && 684 ip_vs_addr_equal(af, &dest->addr, daddr) && 685 IP_VS_DFWD_METHOD(dest) == IP_VS_CONN_F_TUNNEL) { 686 /* HIT */ 687 return dest; 688 } 689 } 690 691 return NULL; 692 } 693 694 /* Lookup destination by {addr,port} in the given service 695 * Called under RCU lock. 696 */ 697 static struct ip_vs_dest * 698 ip_vs_lookup_dest(struct ip_vs_service *svc, int dest_af, 699 const union nf_inet_addr *daddr, __be16 dport) 700 { 701 struct ip_vs_dest *dest; 702 703 /* 704 * Find the destination for the given service 705 */ 706 list_for_each_entry_rcu(dest, &svc->destinations, n_list) { 707 if ((dest->af == dest_af) && 708 ip_vs_addr_equal(dest_af, &dest->addr, daddr) && 709 (dest->port == dport)) { 710 /* HIT */ 711 return dest; 712 } 713 } 714 715 return NULL; 716 } 717 718 /* 719 * Find destination by {daddr,dport,vaddr,protocol} 720 * Created to be used in ip_vs_process_message() in 721 * the backup synchronization daemon. It finds the 722 * destination to be bound to the received connection 723 * on the backup. 724 * Called under RCU lock, no refcnt is returned. 725 */ 726 struct ip_vs_dest *ip_vs_find_dest(struct netns_ipvs *ipvs, int svc_af, int dest_af, 727 const union nf_inet_addr *daddr, 728 __be16 dport, 729 const union nf_inet_addr *vaddr, 730 __be16 vport, __u16 protocol, __u32 fwmark, 731 __u32 flags) 732 { 733 struct ip_vs_dest *dest; 734 struct ip_vs_service *svc; 735 __be16 port = dport; 736 737 svc = ip_vs_service_find(ipvs, svc_af, fwmark, protocol, vaddr, vport); 738 if (!svc) 739 return NULL; 740 if (fwmark && (flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) 741 port = 0; 742 dest = ip_vs_lookup_dest(svc, dest_af, daddr, port); 743 if (!dest) 744 dest = ip_vs_lookup_dest(svc, dest_af, daddr, port ^ dport); 745 return dest; 746 } 747 748 void ip_vs_dest_dst_rcu_free(struct rcu_head *head) 749 { 750 struct ip_vs_dest_dst *dest_dst = container_of(head, 751 struct ip_vs_dest_dst, 752 rcu_head); 753 754 dst_release(dest_dst->dst_cache); 755 kfree(dest_dst); 756 } 757 758 /* Release dest_dst and dst_cache for dest in user context */ 759 static void __ip_vs_dst_cache_reset(struct ip_vs_dest *dest) 760 { 761 struct ip_vs_dest_dst *old; 762 763 old = rcu_dereference_protected(dest->dest_dst, 1); 764 if (old) { 765 RCU_INIT_POINTER(dest->dest_dst, NULL); 766 call_rcu(&old->rcu_head, ip_vs_dest_dst_rcu_free); 767 } 768 } 769 770 /* 771 * Lookup dest by {svc,addr,port} in the destination trash. 772 * The destination trash is used to hold the destinations that are removed 773 * from the service table but are still referenced by some conn entries. 774 * The reason to add the destination trash is when the dest is temporary 775 * down (either by administrator or by monitor program), the dest can be 776 * picked back from the trash, the remaining connections to the dest can 777 * continue, and the counting information of the dest is also useful for 778 * scheduling. 779 */ 780 static struct ip_vs_dest * 781 ip_vs_trash_get_dest(struct ip_vs_service *svc, int dest_af, 782 const union nf_inet_addr *daddr, __be16 dport) 783 { 784 struct ip_vs_dest *dest; 785 struct netns_ipvs *ipvs = svc->ipvs; 786 787 /* 788 * Find the destination in trash 789 */ 790 spin_lock_bh(&ipvs->dest_trash_lock); 791 list_for_each_entry(dest, &ipvs->dest_trash, t_list) { 792 IP_VS_DBG_BUF(3, "Destination %u/%s:%u still in trash, " 793 "dest->refcnt=%d\n", 794 dest->vfwmark, 795 IP_VS_DBG_ADDR(dest->af, &dest->addr), 796 ntohs(dest->port), 797 refcount_read(&dest->refcnt)); 798 if (dest->af == dest_af && 799 ip_vs_addr_equal(dest_af, &dest->addr, daddr) && 800 dest->port == dport && 801 dest->vfwmark == svc->fwmark && 802 dest->protocol == svc->protocol && 803 (svc->fwmark || 804 (ip_vs_addr_equal(svc->af, &dest->vaddr, &svc->addr) && 805 dest->vport == svc->port))) { 806 /* HIT */ 807 list_del(&dest->t_list); 808 goto out; 809 } 810 } 811 812 dest = NULL; 813 814 out: 815 spin_unlock_bh(&ipvs->dest_trash_lock); 816 817 return dest; 818 } 819 820 static void ip_vs_dest_rcu_free(struct rcu_head *head) 821 { 822 struct ip_vs_dest *dest; 823 824 dest = container_of(head, struct ip_vs_dest, rcu_head); 825 ip_vs_stats_release(&dest->stats); 826 ip_vs_dest_put_and_free(dest); 827 } 828 829 static void ip_vs_dest_free(struct ip_vs_dest *dest) 830 { 831 struct ip_vs_service *svc = rcu_dereference_protected(dest->svc, 1); 832 833 __ip_vs_dst_cache_reset(dest); 834 __ip_vs_svc_put(svc); 835 call_rcu(&dest->rcu_head, ip_vs_dest_rcu_free); 836 } 837 838 /* 839 * Clean up all the destinations in the trash 840 * Called by the ip_vs_control_cleanup() 841 * 842 * When the ip_vs_control_clearup is activated by ipvs module exit, 843 * the service tables must have been flushed and all the connections 844 * are expired, and the refcnt of each destination in the trash must 845 * be 1, so we simply release them here. 846 */ 847 static void ip_vs_trash_cleanup(struct netns_ipvs *ipvs) 848 { 849 struct ip_vs_dest *dest, *nxt; 850 851 timer_delete_sync(&ipvs->dest_trash_timer); 852 /* No need to use dest_trash_lock */ 853 list_for_each_entry_safe(dest, nxt, &ipvs->dest_trash, t_list) { 854 list_del(&dest->t_list); 855 ip_vs_dest_free(dest); 856 } 857 } 858 859 static void ip_vs_stats_rcu_free(struct rcu_head *head) 860 { 861 struct ip_vs_stats_rcu *rs = container_of(head, 862 struct ip_vs_stats_rcu, 863 rcu_head); 864 865 ip_vs_stats_release(&rs->s); 866 kfree(rs); 867 } 868 869 static void 870 ip_vs_copy_stats(struct ip_vs_kstats *dst, struct ip_vs_stats *src) 871 { 872 #define IP_VS_SHOW_STATS_COUNTER(c) dst->c = src->kstats.c - src->kstats0.c 873 874 spin_lock(&src->lock); 875 876 IP_VS_SHOW_STATS_COUNTER(conns); 877 IP_VS_SHOW_STATS_COUNTER(inpkts); 878 IP_VS_SHOW_STATS_COUNTER(outpkts); 879 IP_VS_SHOW_STATS_COUNTER(inbytes); 880 IP_VS_SHOW_STATS_COUNTER(outbytes); 881 882 ip_vs_read_estimator(dst, src); 883 884 spin_unlock(&src->lock); 885 } 886 887 static void 888 ip_vs_export_stats_user(struct ip_vs_stats_user *dst, struct ip_vs_kstats *src) 889 { 890 dst->conns = (u32)src->conns; 891 dst->inpkts = (u32)src->inpkts; 892 dst->outpkts = (u32)src->outpkts; 893 dst->inbytes = src->inbytes; 894 dst->outbytes = src->outbytes; 895 dst->cps = (u32)src->cps; 896 dst->inpps = (u32)src->inpps; 897 dst->outpps = (u32)src->outpps; 898 dst->inbps = (u32)src->inbps; 899 dst->outbps = (u32)src->outbps; 900 } 901 902 static void 903 ip_vs_zero_stats(struct ip_vs_stats *stats) 904 { 905 spin_lock(&stats->lock); 906 907 /* get current counters as zero point, rates are zeroed */ 908 909 #define IP_VS_ZERO_STATS_COUNTER(c) stats->kstats0.c = stats->kstats.c 910 911 IP_VS_ZERO_STATS_COUNTER(conns); 912 IP_VS_ZERO_STATS_COUNTER(inpkts); 913 IP_VS_ZERO_STATS_COUNTER(outpkts); 914 IP_VS_ZERO_STATS_COUNTER(inbytes); 915 IP_VS_ZERO_STATS_COUNTER(outbytes); 916 917 ip_vs_zero_estimator(stats); 918 919 spin_unlock(&stats->lock); 920 } 921 922 /* Allocate fields after kzalloc */ 923 int ip_vs_stats_init_alloc(struct ip_vs_stats *s) 924 { 925 int i; 926 927 spin_lock_init(&s->lock); 928 s->cpustats = alloc_percpu(struct ip_vs_cpu_stats); 929 if (!s->cpustats) 930 return -ENOMEM; 931 932 for_each_possible_cpu(i) { 933 struct ip_vs_cpu_stats *cs = per_cpu_ptr(s->cpustats, i); 934 935 u64_stats_init(&cs->syncp); 936 } 937 return 0; 938 } 939 940 struct ip_vs_stats *ip_vs_stats_alloc(void) 941 { 942 struct ip_vs_stats *s = kzalloc(sizeof(*s), GFP_KERNEL); 943 944 if (s && ip_vs_stats_init_alloc(s) >= 0) 945 return s; 946 kfree(s); 947 return NULL; 948 } 949 950 void ip_vs_stats_release(struct ip_vs_stats *stats) 951 { 952 free_percpu(stats->cpustats); 953 } 954 955 void ip_vs_stats_free(struct ip_vs_stats *stats) 956 { 957 if (stats) { 958 ip_vs_stats_release(stats); 959 kfree(stats); 960 } 961 } 962 963 /* 964 * Update a destination in the given service 965 */ 966 static void 967 __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, 968 struct ip_vs_dest_user_kern *udest, int add) 969 { 970 struct netns_ipvs *ipvs = svc->ipvs; 971 struct ip_vs_service *old_svc; 972 struct ip_vs_scheduler *sched; 973 int conn_flags; 974 975 /* We cannot modify an address and change the address family */ 976 BUG_ON(!add && udest->af != dest->af); 977 978 if (add && udest->af != svc->af) 979 ipvs->mixed_address_family_dests++; 980 981 /* keep the last_weight with latest non-0 weight */ 982 if (add || udest->weight != 0) 983 atomic_set(&dest->last_weight, udest->weight); 984 985 /* set the weight and the flags */ 986 atomic_set(&dest->weight, udest->weight); 987 conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK; 988 conn_flags |= IP_VS_CONN_F_INACTIVE; 989 990 /* Need to rehash? */ 991 if ((udest->conn_flags & IP_VS_CONN_F_FWD_MASK) != 992 IP_VS_DFWD_METHOD(dest) || 993 udest->tun_type != dest->tun_type || 994 udest->tun_port != dest->tun_port) 995 ip_vs_rs_unhash(dest); 996 997 /* set the tunnel info */ 998 dest->tun_type = udest->tun_type; 999 dest->tun_port = udest->tun_port; 1000 dest->tun_flags = udest->tun_flags; 1001 1002 /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */ 1003 if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != IP_VS_CONN_F_MASQ) { 1004 conn_flags |= IP_VS_CONN_F_NOOUTPUT; 1005 } else { 1006 /* FTP-NAT requires conntrack for mangling */ 1007 if (svc->port == FTPPORT) 1008 ip_vs_register_conntrack(svc); 1009 } 1010 atomic_set(&dest->conn_flags, conn_flags); 1011 /* Put the real service in rs_table if not present. */ 1012 ip_vs_rs_hash(ipvs, dest); 1013 1014 /* bind the service */ 1015 old_svc = rcu_dereference_protected(dest->svc, 1); 1016 if (!old_svc) { 1017 __ip_vs_bind_svc(dest, svc); 1018 } else { 1019 if (old_svc != svc) { 1020 ip_vs_zero_stats(&dest->stats); 1021 __ip_vs_bind_svc(dest, svc); 1022 __ip_vs_svc_put(old_svc); 1023 } 1024 } 1025 1026 /* set the dest status flags */ 1027 dest->flags |= IP_VS_DEST_F_AVAILABLE; 1028 1029 if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold) 1030 dest->flags &= ~IP_VS_DEST_F_OVERLOAD; 1031 dest->u_threshold = udest->u_threshold; 1032 dest->l_threshold = udest->l_threshold; 1033 1034 dest->af = udest->af; 1035 1036 spin_lock_bh(&dest->dst_lock); 1037 __ip_vs_dst_cache_reset(dest); 1038 spin_unlock_bh(&dest->dst_lock); 1039 1040 if (add) { 1041 list_add_rcu(&dest->n_list, &svc->destinations); 1042 svc->num_dests++; 1043 sched = rcu_dereference_protected(svc->scheduler, 1); 1044 if (sched && sched->add_dest) 1045 sched->add_dest(svc, dest); 1046 } else { 1047 sched = rcu_dereference_protected(svc->scheduler, 1); 1048 if (sched && sched->upd_dest) 1049 sched->upd_dest(svc, dest); 1050 } 1051 } 1052 1053 1054 /* 1055 * Create a destination for the given service 1056 */ 1057 static int 1058 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest) 1059 { 1060 struct ip_vs_dest *dest; 1061 unsigned int atype; 1062 int ret; 1063 1064 #ifdef CONFIG_IP_VS_IPV6 1065 if (udest->af == AF_INET6) { 1066 atype = ipv6_addr_type(&udest->addr.in6); 1067 if ((!(atype & IPV6_ADDR_UNICAST) || 1068 atype & IPV6_ADDR_LINKLOCAL) && 1069 !__ip_vs_addr_is_local_v6(svc->ipvs->net, &udest->addr.in6)) 1070 return -EINVAL; 1071 1072 ret = nf_defrag_ipv6_enable(svc->ipvs->net); 1073 if (ret) 1074 return ret; 1075 } else 1076 #endif 1077 { 1078 atype = inet_addr_type(svc->ipvs->net, udest->addr.ip); 1079 if (atype != RTN_LOCAL && atype != RTN_UNICAST) 1080 return -EINVAL; 1081 } 1082 1083 dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL); 1084 if (dest == NULL) 1085 return -ENOMEM; 1086 1087 ret = ip_vs_stats_init_alloc(&dest->stats); 1088 if (ret < 0) 1089 goto err_alloc; 1090 1091 ret = ip_vs_start_estimator(svc->ipvs, &dest->stats); 1092 if (ret < 0) 1093 goto err_stats; 1094 1095 dest->af = udest->af; 1096 dest->protocol = svc->protocol; 1097 dest->vaddr = svc->addr; 1098 dest->vport = svc->port; 1099 dest->vfwmark = svc->fwmark; 1100 ip_vs_addr_copy(udest->af, &dest->addr, &udest->addr); 1101 dest->port = udest->port; 1102 1103 atomic_set(&dest->activeconns, 0); 1104 atomic_set(&dest->inactconns, 0); 1105 atomic_set(&dest->persistconns, 0); 1106 refcount_set(&dest->refcnt, 1); 1107 1108 INIT_HLIST_NODE(&dest->d_list); 1109 spin_lock_init(&dest->dst_lock); 1110 __ip_vs_update_dest(svc, dest, udest, 1); 1111 1112 return 0; 1113 1114 err_stats: 1115 ip_vs_stats_release(&dest->stats); 1116 1117 err_alloc: 1118 kfree(dest); 1119 return ret; 1120 } 1121 1122 1123 /* 1124 * Add a destination into an existing service 1125 */ 1126 static int 1127 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest) 1128 { 1129 struct ip_vs_dest *dest; 1130 union nf_inet_addr daddr; 1131 __be16 dport = udest->port; 1132 int ret; 1133 1134 if (udest->weight < 0) { 1135 pr_err("%s(): server weight less than zero\n", __func__); 1136 return -ERANGE; 1137 } 1138 1139 if (udest->l_threshold > udest->u_threshold) { 1140 pr_err("%s(): lower threshold is higher than upper threshold\n", 1141 __func__); 1142 return -ERANGE; 1143 } 1144 1145 if (udest->tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) { 1146 if (udest->tun_port == 0) { 1147 pr_err("%s(): tunnel port is zero\n", __func__); 1148 return -EINVAL; 1149 } 1150 } 1151 1152 ip_vs_addr_copy(udest->af, &daddr, &udest->addr); 1153 1154 /* We use function that requires RCU lock */ 1155 rcu_read_lock(); 1156 dest = ip_vs_lookup_dest(svc, udest->af, &daddr, dport); 1157 rcu_read_unlock(); 1158 1159 if (dest != NULL) { 1160 IP_VS_DBG(1, "%s(): dest already exists\n", __func__); 1161 return -EEXIST; 1162 } 1163 1164 /* 1165 * Check if the dest already exists in the trash and 1166 * is from the same service 1167 */ 1168 dest = ip_vs_trash_get_dest(svc, udest->af, &daddr, dport); 1169 1170 if (dest != NULL) { 1171 IP_VS_DBG_BUF(3, "Get destination %s:%u from trash, " 1172 "dest->refcnt=%d, service %u/%s:%u\n", 1173 IP_VS_DBG_ADDR(udest->af, &daddr), ntohs(dport), 1174 refcount_read(&dest->refcnt), 1175 dest->vfwmark, 1176 IP_VS_DBG_ADDR(svc->af, &dest->vaddr), 1177 ntohs(dest->vport)); 1178 1179 ret = ip_vs_start_estimator(svc->ipvs, &dest->stats); 1180 if (ret < 0) 1181 return ret; 1182 __ip_vs_update_dest(svc, dest, udest, 1); 1183 } else { 1184 /* 1185 * Allocate and initialize the dest structure 1186 */ 1187 ret = ip_vs_new_dest(svc, udest); 1188 } 1189 1190 return ret; 1191 } 1192 1193 1194 /* 1195 * Edit a destination in the given service 1196 */ 1197 static int 1198 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest) 1199 { 1200 struct ip_vs_dest *dest; 1201 union nf_inet_addr daddr; 1202 __be16 dport = udest->port; 1203 1204 if (udest->weight < 0) { 1205 pr_err("%s(): server weight less than zero\n", __func__); 1206 return -ERANGE; 1207 } 1208 1209 if (udest->l_threshold > udest->u_threshold) { 1210 pr_err("%s(): lower threshold is higher than upper threshold\n", 1211 __func__); 1212 return -ERANGE; 1213 } 1214 1215 if (udest->tun_type == IP_VS_CONN_F_TUNNEL_TYPE_GUE) { 1216 if (udest->tun_port == 0) { 1217 pr_err("%s(): tunnel port is zero\n", __func__); 1218 return -EINVAL; 1219 } 1220 } 1221 1222 ip_vs_addr_copy(udest->af, &daddr, &udest->addr); 1223 1224 /* We use function that requires RCU lock */ 1225 rcu_read_lock(); 1226 dest = ip_vs_lookup_dest(svc, udest->af, &daddr, dport); 1227 rcu_read_unlock(); 1228 1229 if (dest == NULL) { 1230 IP_VS_DBG(1, "%s(): dest doesn't exist\n", __func__); 1231 return -ENOENT; 1232 } 1233 1234 __ip_vs_update_dest(svc, dest, udest, 0); 1235 1236 return 0; 1237 } 1238 1239 /* 1240 * Delete a destination (must be already unlinked from the service) 1241 */ 1242 static void __ip_vs_del_dest(struct netns_ipvs *ipvs, struct ip_vs_dest *dest, 1243 bool cleanup) 1244 { 1245 ip_vs_stop_estimator(ipvs, &dest->stats); 1246 1247 /* 1248 * Remove it from the d-linked list with the real services. 1249 */ 1250 ip_vs_rs_unhash(dest); 1251 1252 spin_lock_bh(&ipvs->dest_trash_lock); 1253 IP_VS_DBG_BUF(3, "Moving dest %s:%u into trash, dest->refcnt=%d\n", 1254 IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port), 1255 refcount_read(&dest->refcnt)); 1256 if (list_empty(&ipvs->dest_trash) && !cleanup) 1257 mod_timer(&ipvs->dest_trash_timer, 1258 jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1)); 1259 /* dest lives in trash with reference */ 1260 list_add(&dest->t_list, &ipvs->dest_trash); 1261 dest->idle_start = 0; 1262 spin_unlock_bh(&ipvs->dest_trash_lock); 1263 1264 /* Queue up delayed work to expire all no destination connections. 1265 * No-op when CONFIG_SYSCTL is disabled. 1266 */ 1267 if (!cleanup) 1268 ip_vs_enqueue_expire_nodest_conns(ipvs); 1269 } 1270 1271 1272 /* 1273 * Unlink a destination from the given service 1274 */ 1275 static void __ip_vs_unlink_dest(struct ip_vs_service *svc, 1276 struct ip_vs_dest *dest, 1277 int svcupd) 1278 { 1279 dest->flags &= ~IP_VS_DEST_F_AVAILABLE; 1280 1281 /* 1282 * Remove it from the d-linked destination list. 1283 */ 1284 list_del_rcu(&dest->n_list); 1285 svc->num_dests--; 1286 1287 if (dest->af != svc->af) 1288 svc->ipvs->mixed_address_family_dests--; 1289 1290 if (svcupd) { 1291 struct ip_vs_scheduler *sched; 1292 1293 sched = rcu_dereference_protected(svc->scheduler, 1); 1294 if (sched && sched->del_dest) 1295 sched->del_dest(svc, dest); 1296 } 1297 } 1298 1299 1300 /* 1301 * Delete a destination server in the given service 1302 */ 1303 static int 1304 ip_vs_del_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest) 1305 { 1306 struct ip_vs_dest *dest; 1307 __be16 dport = udest->port; 1308 1309 /* We use function that requires RCU lock */ 1310 rcu_read_lock(); 1311 dest = ip_vs_lookup_dest(svc, udest->af, &udest->addr, dport); 1312 rcu_read_unlock(); 1313 1314 if (dest == NULL) { 1315 IP_VS_DBG(1, "%s(): destination not found!\n", __func__); 1316 return -ENOENT; 1317 } 1318 1319 /* 1320 * Unlink dest from the service 1321 */ 1322 __ip_vs_unlink_dest(svc, dest, 1); 1323 1324 /* 1325 * Delete the destination 1326 */ 1327 __ip_vs_del_dest(svc->ipvs, dest, false); 1328 1329 return 0; 1330 } 1331 1332 static void ip_vs_dest_trash_expire(struct timer_list *t) 1333 { 1334 struct netns_ipvs *ipvs = timer_container_of(ipvs, t, 1335 dest_trash_timer); 1336 struct ip_vs_dest *dest, *next; 1337 unsigned long now = jiffies; 1338 1339 spin_lock(&ipvs->dest_trash_lock); 1340 list_for_each_entry_safe(dest, next, &ipvs->dest_trash, t_list) { 1341 if (refcount_read(&dest->refcnt) > 1) 1342 continue; 1343 if (dest->idle_start) { 1344 if (time_before(now, dest->idle_start + 1345 IP_VS_DEST_TRASH_PERIOD)) 1346 continue; 1347 } else { 1348 dest->idle_start = max(1UL, now); 1349 continue; 1350 } 1351 IP_VS_DBG_BUF(3, "Removing destination %u/%s:%u from trash\n", 1352 dest->vfwmark, 1353 IP_VS_DBG_ADDR(dest->af, &dest->addr), 1354 ntohs(dest->port)); 1355 list_del(&dest->t_list); 1356 ip_vs_dest_free(dest); 1357 } 1358 if (!list_empty(&ipvs->dest_trash)) 1359 mod_timer(&ipvs->dest_trash_timer, 1360 jiffies + (IP_VS_DEST_TRASH_PERIOD >> 1)); 1361 spin_unlock(&ipvs->dest_trash_lock); 1362 } 1363 1364 /* 1365 * Add a service into the service hash table 1366 */ 1367 static int 1368 ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, 1369 struct ip_vs_service **svc_p) 1370 { 1371 int ret = 0; 1372 struct ip_vs_scheduler *sched = NULL; 1373 struct ip_vs_pe *pe = NULL; 1374 struct ip_vs_service *svc = NULL; 1375 int ret_hooks = -1; 1376 1377 /* increase the module use count */ 1378 if (!ip_vs_use_count_inc()) 1379 return -ENOPROTOOPT; 1380 1381 /* Lookup the scheduler by 'u->sched_name' */ 1382 if (strcmp(u->sched_name, "none")) { 1383 sched = ip_vs_scheduler_get(u->sched_name); 1384 if (!sched) { 1385 pr_info("Scheduler module ip_vs_%s not found\n", 1386 u->sched_name); 1387 ret = -ENOENT; 1388 goto out_err; 1389 } 1390 } 1391 1392 if (u->pe_name && *u->pe_name) { 1393 pe = ip_vs_pe_getbyname(u->pe_name); 1394 if (pe == NULL) { 1395 pr_info("persistence engine module ip_vs_pe_%s " 1396 "not found\n", u->pe_name); 1397 ret = -ENOENT; 1398 goto out_err; 1399 } 1400 } 1401 1402 #ifdef CONFIG_IP_VS_IPV6 1403 if (u->af == AF_INET6) { 1404 __u32 plen = (__force __u32) u->netmask; 1405 1406 if (plen < 1 || plen > 128) { 1407 ret = -EINVAL; 1408 goto out_err; 1409 } 1410 1411 ret = nf_defrag_ipv6_enable(ipvs->net); 1412 if (ret) 1413 goto out_err; 1414 } 1415 #endif 1416 1417 if ((u->af == AF_INET && !ipvs->num_services) || 1418 (u->af == AF_INET6 && !ipvs->num_services6)) { 1419 ret = ip_vs_register_hooks(ipvs, u->af); 1420 if (ret < 0) 1421 goto out_err; 1422 ret_hooks = ret; 1423 } 1424 1425 svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL); 1426 if (svc == NULL) { 1427 IP_VS_DBG(1, "%s(): no memory\n", __func__); 1428 ret = -ENOMEM; 1429 goto out_err; 1430 } 1431 ret = ip_vs_stats_init_alloc(&svc->stats); 1432 if (ret < 0) 1433 goto out_err; 1434 1435 /* I'm the first user of the service */ 1436 atomic_set(&svc->refcnt, 0); 1437 1438 svc->af = u->af; 1439 svc->protocol = u->protocol; 1440 ip_vs_addr_copy(svc->af, &svc->addr, &u->addr); 1441 svc->port = u->port; 1442 svc->fwmark = u->fwmark; 1443 svc->flags = u->flags & ~IP_VS_SVC_F_HASHED; 1444 svc->timeout = u->timeout * HZ; 1445 svc->netmask = u->netmask; 1446 svc->ipvs = ipvs; 1447 1448 INIT_LIST_HEAD(&svc->destinations); 1449 spin_lock_init(&svc->sched_lock); 1450 1451 /* Bind the scheduler */ 1452 if (sched) { 1453 ret = ip_vs_bind_scheduler(svc, sched); 1454 if (ret) 1455 goto out_err; 1456 sched = NULL; 1457 } 1458 1459 ret = ip_vs_start_estimator(ipvs, &svc->stats); 1460 if (ret < 0) 1461 goto out_err; 1462 1463 /* Update the virtual service counters */ 1464 if (svc->port == FTPPORT) 1465 atomic_inc(&ipvs->ftpsvc_counter); 1466 else if (svc->port == 0) 1467 atomic_inc(&ipvs->nullsvc_counter); 1468 if (pe && pe->conn_out) 1469 atomic_inc(&ipvs->conn_out_counter); 1470 1471 /* Bind the ct retriever */ 1472 RCU_INIT_POINTER(svc->pe, pe); 1473 pe = NULL; 1474 1475 /* Count only IPv4 services for old get/setsockopt interface */ 1476 if (svc->af == AF_INET) 1477 ipvs->num_services++; 1478 else if (svc->af == AF_INET6) 1479 ipvs->num_services6++; 1480 1481 /* Hash the service into the service table */ 1482 ip_vs_svc_hash(svc); 1483 1484 *svc_p = svc; 1485 1486 if (!READ_ONCE(ipvs->enable)) { 1487 /* Now there is a service - full throttle */ 1488 WRITE_ONCE(ipvs->enable, 1); 1489 1490 /* Start estimation for first time */ 1491 ip_vs_est_reload_start(ipvs); 1492 } 1493 1494 return 0; 1495 1496 1497 out_err: 1498 if (ret_hooks >= 0) 1499 ip_vs_unregister_hooks(ipvs, u->af); 1500 if (svc != NULL) { 1501 ip_vs_unbind_scheduler(svc, sched); 1502 ip_vs_service_free(svc); 1503 } 1504 ip_vs_scheduler_put(sched); 1505 ip_vs_pe_put(pe); 1506 1507 /* decrease the module use count */ 1508 ip_vs_use_count_dec(); 1509 1510 return ret; 1511 } 1512 1513 1514 /* 1515 * Edit a service and bind it with a new scheduler 1516 */ 1517 static int 1518 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u) 1519 { 1520 struct ip_vs_scheduler *sched = NULL, *old_sched; 1521 struct ip_vs_pe *pe = NULL, *old_pe = NULL; 1522 int ret = 0; 1523 bool new_pe_conn_out, old_pe_conn_out; 1524 1525 /* 1526 * Lookup the scheduler, by 'u->sched_name' 1527 */ 1528 if (strcmp(u->sched_name, "none")) { 1529 sched = ip_vs_scheduler_get(u->sched_name); 1530 if (!sched) { 1531 pr_info("Scheduler module ip_vs_%s not found\n", 1532 u->sched_name); 1533 return -ENOENT; 1534 } 1535 } 1536 old_sched = sched; 1537 1538 if (u->pe_name && *u->pe_name) { 1539 pe = ip_vs_pe_getbyname(u->pe_name); 1540 if (pe == NULL) { 1541 pr_info("persistence engine module ip_vs_pe_%s " 1542 "not found\n", u->pe_name); 1543 ret = -ENOENT; 1544 goto out; 1545 } 1546 old_pe = pe; 1547 } 1548 1549 #ifdef CONFIG_IP_VS_IPV6 1550 if (u->af == AF_INET6) { 1551 __u32 plen = (__force __u32) u->netmask; 1552 1553 if (plen < 1 || plen > 128) { 1554 ret = -EINVAL; 1555 goto out; 1556 } 1557 } 1558 #endif 1559 1560 old_sched = rcu_dereference_protected(svc->scheduler, 1); 1561 if (sched != old_sched) { 1562 if (old_sched) { 1563 ip_vs_unbind_scheduler(svc, old_sched); 1564 RCU_INIT_POINTER(svc->scheduler, NULL); 1565 /* Wait all svc->sched_data users */ 1566 synchronize_rcu(); 1567 } 1568 /* Bind the new scheduler */ 1569 if (sched) { 1570 ret = ip_vs_bind_scheduler(svc, sched); 1571 if (ret) { 1572 ip_vs_scheduler_put(sched); 1573 goto out; 1574 } 1575 } 1576 } 1577 1578 /* 1579 * Set the flags and timeout value 1580 */ 1581 svc->flags = u->flags | IP_VS_SVC_F_HASHED; 1582 svc->timeout = u->timeout * HZ; 1583 svc->netmask = u->netmask; 1584 1585 old_pe = rcu_dereference_protected(svc->pe, 1); 1586 if (pe != old_pe) { 1587 rcu_assign_pointer(svc->pe, pe); 1588 /* check for optional methods in new pe */ 1589 new_pe_conn_out = (pe && pe->conn_out) ? true : false; 1590 old_pe_conn_out = (old_pe && old_pe->conn_out) ? true : false; 1591 if (new_pe_conn_out && !old_pe_conn_out) 1592 atomic_inc(&svc->ipvs->conn_out_counter); 1593 if (old_pe_conn_out && !new_pe_conn_out) 1594 atomic_dec(&svc->ipvs->conn_out_counter); 1595 } 1596 1597 out: 1598 ip_vs_scheduler_put(old_sched); 1599 ip_vs_pe_put(old_pe); 1600 return ret; 1601 } 1602 1603 /* 1604 * Delete a service from the service list 1605 * - The service must be unlinked, unlocked and not referenced! 1606 * - We are called under _bh lock 1607 */ 1608 static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup) 1609 { 1610 struct ip_vs_dest *dest, *nxt; 1611 struct ip_vs_scheduler *old_sched; 1612 struct ip_vs_pe *old_pe; 1613 struct netns_ipvs *ipvs = svc->ipvs; 1614 1615 if (svc->af == AF_INET) { 1616 ipvs->num_services--; 1617 if (!ipvs->num_services) 1618 ip_vs_unregister_hooks(ipvs, svc->af); 1619 } else if (svc->af == AF_INET6) { 1620 ipvs->num_services6--; 1621 if (!ipvs->num_services6) 1622 ip_vs_unregister_hooks(ipvs, svc->af); 1623 } 1624 1625 ip_vs_stop_estimator(svc->ipvs, &svc->stats); 1626 1627 /* Unbind scheduler */ 1628 old_sched = rcu_dereference_protected(svc->scheduler, 1); 1629 ip_vs_unbind_scheduler(svc, old_sched); 1630 ip_vs_scheduler_put(old_sched); 1631 1632 /* Unbind persistence engine, keep svc->pe */ 1633 old_pe = rcu_dereference_protected(svc->pe, 1); 1634 if (old_pe && old_pe->conn_out) 1635 atomic_dec(&ipvs->conn_out_counter); 1636 ip_vs_pe_put(old_pe); 1637 1638 /* 1639 * Unlink the whole destination list 1640 */ 1641 list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) { 1642 __ip_vs_unlink_dest(svc, dest, 0); 1643 __ip_vs_del_dest(svc->ipvs, dest, cleanup); 1644 } 1645 1646 /* 1647 * Update the virtual service counters 1648 */ 1649 if (svc->port == FTPPORT) 1650 atomic_dec(&ipvs->ftpsvc_counter); 1651 else if (svc->port == 0) 1652 atomic_dec(&ipvs->nullsvc_counter); 1653 1654 /* 1655 * Free the service if nobody refers to it 1656 */ 1657 __ip_vs_svc_put(svc); 1658 1659 /* decrease the module use count */ 1660 ip_vs_use_count_dec(); 1661 } 1662 1663 /* 1664 * Unlink a service from list and try to delete it if its refcnt reached 0 1665 */ 1666 static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup) 1667 { 1668 ip_vs_unregister_conntrack(svc); 1669 /* Hold svc to avoid double release from dest_trash */ 1670 atomic_inc(&svc->refcnt); 1671 /* 1672 * Unhash it from the service table 1673 */ 1674 ip_vs_svc_unhash(svc); 1675 1676 __ip_vs_del_service(svc, cleanup); 1677 } 1678 1679 /* 1680 * Delete a service from the service list 1681 */ 1682 static int ip_vs_del_service(struct ip_vs_service *svc) 1683 { 1684 if (svc == NULL) 1685 return -EEXIST; 1686 ip_vs_unlink_service(svc, false); 1687 1688 return 0; 1689 } 1690 1691 1692 /* 1693 * Flush all the virtual services 1694 */ 1695 static int ip_vs_flush(struct netns_ipvs *ipvs, bool cleanup) 1696 { 1697 int idx; 1698 struct ip_vs_service *svc; 1699 struct hlist_node *n; 1700 1701 /* 1702 * Flush the service table hashed by <netns,protocol,addr,port> 1703 */ 1704 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 1705 hlist_for_each_entry_safe(svc, n, &ip_vs_svc_table[idx], 1706 s_list) { 1707 if (svc->ipvs == ipvs) 1708 ip_vs_unlink_service(svc, cleanup); 1709 } 1710 } 1711 1712 /* 1713 * Flush the service table hashed by fwmark 1714 */ 1715 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 1716 hlist_for_each_entry_safe(svc, n, &ip_vs_svc_fwm_table[idx], 1717 f_list) { 1718 if (svc->ipvs == ipvs) 1719 ip_vs_unlink_service(svc, cleanup); 1720 } 1721 } 1722 1723 return 0; 1724 } 1725 1726 /* 1727 * Delete service by {netns} in the service table. 1728 * Called by __ip_vs_batch_cleanup() 1729 */ 1730 void ip_vs_service_nets_cleanup(struct list_head *net_list) 1731 { 1732 struct netns_ipvs *ipvs; 1733 struct net *net; 1734 1735 /* Check for "full" addressed entries */ 1736 mutex_lock(&__ip_vs_mutex); 1737 list_for_each_entry(net, net_list, exit_list) { 1738 ipvs = net_ipvs(net); 1739 ip_vs_flush(ipvs, true); 1740 } 1741 mutex_unlock(&__ip_vs_mutex); 1742 } 1743 1744 /* Put all references for device (dst_cache) */ 1745 static inline void 1746 ip_vs_forget_dev(struct ip_vs_dest *dest, struct net_device *dev) 1747 { 1748 struct ip_vs_dest_dst *dest_dst; 1749 1750 spin_lock_bh(&dest->dst_lock); 1751 dest_dst = rcu_dereference_protected(dest->dest_dst, 1); 1752 if (dest_dst && dest_dst->dst_cache->dev == dev) { 1753 IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n", 1754 dev->name, 1755 IP_VS_DBG_ADDR(dest->af, &dest->addr), 1756 ntohs(dest->port), 1757 refcount_read(&dest->refcnt)); 1758 __ip_vs_dst_cache_reset(dest); 1759 } 1760 spin_unlock_bh(&dest->dst_lock); 1761 1762 } 1763 /* Netdev event receiver 1764 * Currently only NETDEV_DOWN is handled to release refs to cached dsts 1765 */ 1766 static int ip_vs_dst_event(struct notifier_block *this, unsigned long event, 1767 void *ptr) 1768 { 1769 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1770 struct net *net = dev_net(dev); 1771 struct netns_ipvs *ipvs = net_ipvs(net); 1772 struct ip_vs_service *svc; 1773 struct ip_vs_dest *dest; 1774 unsigned int idx; 1775 1776 if (event != NETDEV_DOWN || !ipvs) 1777 return NOTIFY_DONE; 1778 IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name); 1779 mutex_lock(&__ip_vs_mutex); 1780 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 1781 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) { 1782 if (svc->ipvs == ipvs) { 1783 list_for_each_entry(dest, &svc->destinations, 1784 n_list) { 1785 ip_vs_forget_dev(dest, dev); 1786 } 1787 } 1788 } 1789 1790 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) { 1791 if (svc->ipvs == ipvs) { 1792 list_for_each_entry(dest, &svc->destinations, 1793 n_list) { 1794 ip_vs_forget_dev(dest, dev); 1795 } 1796 } 1797 1798 } 1799 } 1800 1801 spin_lock_bh(&ipvs->dest_trash_lock); 1802 list_for_each_entry(dest, &ipvs->dest_trash, t_list) { 1803 ip_vs_forget_dev(dest, dev); 1804 } 1805 spin_unlock_bh(&ipvs->dest_trash_lock); 1806 mutex_unlock(&__ip_vs_mutex); 1807 return NOTIFY_DONE; 1808 } 1809 1810 /* 1811 * Zero counters in a service or all services 1812 */ 1813 static int ip_vs_zero_service(struct ip_vs_service *svc) 1814 { 1815 struct ip_vs_dest *dest; 1816 1817 list_for_each_entry(dest, &svc->destinations, n_list) { 1818 ip_vs_zero_stats(&dest->stats); 1819 } 1820 ip_vs_zero_stats(&svc->stats); 1821 return 0; 1822 } 1823 1824 static int ip_vs_zero_all(struct netns_ipvs *ipvs) 1825 { 1826 int idx; 1827 struct ip_vs_service *svc; 1828 1829 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 1830 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) { 1831 if (svc->ipvs == ipvs) 1832 ip_vs_zero_service(svc); 1833 } 1834 } 1835 1836 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 1837 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) { 1838 if (svc->ipvs == ipvs) 1839 ip_vs_zero_service(svc); 1840 } 1841 } 1842 1843 ip_vs_zero_stats(&ipvs->tot_stats->s); 1844 return 0; 1845 } 1846 1847 #ifdef CONFIG_SYSCTL 1848 1849 static int 1850 proc_do_defense_mode(const struct ctl_table *table, int write, 1851 void *buffer, size_t *lenp, loff_t *ppos) 1852 { 1853 struct netns_ipvs *ipvs = table->extra2; 1854 int *valp = table->data; 1855 int val = *valp; 1856 int rc; 1857 1858 struct ctl_table tmp = { 1859 .data = &val, 1860 .maxlen = sizeof(int), 1861 .mode = table->mode, 1862 }; 1863 1864 rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); 1865 if (write && (*valp != val)) { 1866 if (val < 0 || val > 3) { 1867 rc = -EINVAL; 1868 } else { 1869 *valp = val; 1870 update_defense_level(ipvs); 1871 } 1872 } 1873 return rc; 1874 } 1875 1876 static int 1877 proc_do_sync_threshold(const struct ctl_table *table, int write, 1878 void *buffer, size_t *lenp, loff_t *ppos) 1879 { 1880 struct netns_ipvs *ipvs = table->extra2; 1881 int *valp = table->data; 1882 int val[2]; 1883 int rc; 1884 struct ctl_table tmp = { 1885 .data = &val, 1886 .maxlen = table->maxlen, 1887 .mode = table->mode, 1888 }; 1889 1890 mutex_lock(&ipvs->sync_mutex); 1891 memcpy(val, valp, sizeof(val)); 1892 rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); 1893 if (write) { 1894 if (val[0] < 0 || val[1] < 0 || 1895 (val[0] >= val[1] && val[1])) 1896 rc = -EINVAL; 1897 else 1898 memcpy(valp, val, sizeof(val)); 1899 } 1900 mutex_unlock(&ipvs->sync_mutex); 1901 return rc; 1902 } 1903 1904 static int 1905 proc_do_sync_ports(const struct ctl_table *table, int write, 1906 void *buffer, size_t *lenp, loff_t *ppos) 1907 { 1908 int *valp = table->data; 1909 int val = *valp; 1910 int rc; 1911 1912 struct ctl_table tmp = { 1913 .data = &val, 1914 .maxlen = sizeof(int), 1915 .mode = table->mode, 1916 }; 1917 1918 rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); 1919 if (write && (*valp != val)) { 1920 if (val < 1 || !is_power_of_2(val)) 1921 rc = -EINVAL; 1922 else 1923 *valp = val; 1924 } 1925 return rc; 1926 } 1927 1928 static int ipvs_proc_est_cpumask_set(const struct ctl_table *table, 1929 void *buffer) 1930 { 1931 struct netns_ipvs *ipvs = table->extra2; 1932 cpumask_var_t *valp = table->data; 1933 cpumask_var_t newmask; 1934 int ret; 1935 1936 if (!zalloc_cpumask_var(&newmask, GFP_KERNEL)) 1937 return -ENOMEM; 1938 1939 ret = cpulist_parse(buffer, newmask); 1940 if (ret) 1941 goto out; 1942 1943 mutex_lock(&ipvs->est_mutex); 1944 1945 if (!ipvs->est_cpulist_valid) { 1946 if (!zalloc_cpumask_var(valp, GFP_KERNEL)) { 1947 ret = -ENOMEM; 1948 goto unlock; 1949 } 1950 ipvs->est_cpulist_valid = 1; 1951 } 1952 cpumask_and(newmask, newmask, ¤t->cpus_mask); 1953 cpumask_copy(*valp, newmask); 1954 /* est_max_threads may depend on cpulist size */ 1955 ipvs->est_max_threads = ip_vs_est_max_threads(ipvs); 1956 ipvs->est_calc_phase = 1; 1957 ip_vs_est_reload_start(ipvs); 1958 1959 unlock: 1960 mutex_unlock(&ipvs->est_mutex); 1961 1962 out: 1963 free_cpumask_var(newmask); 1964 return ret; 1965 } 1966 1967 static int ipvs_proc_est_cpumask_get(const struct ctl_table *table, 1968 void *buffer, size_t size) 1969 { 1970 struct netns_ipvs *ipvs = table->extra2; 1971 cpumask_var_t *valp = table->data; 1972 struct cpumask *mask; 1973 int ret; 1974 1975 mutex_lock(&ipvs->est_mutex); 1976 1977 if (ipvs->est_cpulist_valid) 1978 mask = *valp; 1979 else 1980 mask = (struct cpumask *)housekeeping_cpumask(HK_TYPE_KTHREAD); 1981 ret = scnprintf(buffer, size, "%*pbl\n", cpumask_pr_args(mask)); 1982 1983 mutex_unlock(&ipvs->est_mutex); 1984 1985 return ret; 1986 } 1987 1988 static int ipvs_proc_est_cpulist(const struct ctl_table *table, int write, 1989 void *buffer, size_t *lenp, loff_t *ppos) 1990 { 1991 int ret; 1992 1993 /* Ignore both read and write(append) if *ppos not 0 */ 1994 if (*ppos || !*lenp) { 1995 *lenp = 0; 1996 return 0; 1997 } 1998 if (write) { 1999 /* proc_sys_call_handler() appends terminator */ 2000 ret = ipvs_proc_est_cpumask_set(table, buffer); 2001 if (ret >= 0) 2002 *ppos += *lenp; 2003 } else { 2004 /* proc_sys_call_handler() allocates 1 byte for terminator */ 2005 ret = ipvs_proc_est_cpumask_get(table, buffer, *lenp + 1); 2006 if (ret >= 0) { 2007 *lenp = ret; 2008 *ppos += *lenp; 2009 ret = 0; 2010 } 2011 } 2012 return ret; 2013 } 2014 2015 static int ipvs_proc_est_nice(const struct ctl_table *table, int write, 2016 void *buffer, size_t *lenp, loff_t *ppos) 2017 { 2018 struct netns_ipvs *ipvs = table->extra2; 2019 int *valp = table->data; 2020 int val = *valp; 2021 int ret; 2022 2023 struct ctl_table tmp_table = { 2024 .data = &val, 2025 .maxlen = sizeof(int), 2026 .mode = table->mode, 2027 }; 2028 2029 ret = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); 2030 if (write && ret >= 0) { 2031 if (val < MIN_NICE || val > MAX_NICE) { 2032 ret = -EINVAL; 2033 } else { 2034 mutex_lock(&ipvs->est_mutex); 2035 if (*valp != val) { 2036 *valp = val; 2037 ip_vs_est_reload_start(ipvs); 2038 } 2039 mutex_unlock(&ipvs->est_mutex); 2040 } 2041 } 2042 return ret; 2043 } 2044 2045 static int ipvs_proc_run_estimation(const struct ctl_table *table, int write, 2046 void *buffer, size_t *lenp, loff_t *ppos) 2047 { 2048 struct netns_ipvs *ipvs = table->extra2; 2049 int *valp = table->data; 2050 int val = *valp; 2051 int ret; 2052 2053 struct ctl_table tmp_table = { 2054 .data = &val, 2055 .maxlen = sizeof(int), 2056 .mode = table->mode, 2057 }; 2058 2059 ret = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); 2060 if (write && ret >= 0) { 2061 mutex_lock(&ipvs->est_mutex); 2062 if (*valp != val) { 2063 *valp = val; 2064 ip_vs_est_reload_start(ipvs); 2065 } 2066 mutex_unlock(&ipvs->est_mutex); 2067 } 2068 return ret; 2069 } 2070 2071 /* 2072 * IPVS sysctl table (under the /proc/sys/net/ipv4/vs/) 2073 * Do not change order or insert new entries without 2074 * align with netns init in ip_vs_control_net_init() 2075 */ 2076 2077 static struct ctl_table vs_vars[] = { 2078 { 2079 .procname = "amemthresh", 2080 .maxlen = sizeof(int), 2081 .mode = 0644, 2082 .proc_handler = proc_dointvec, 2083 }, 2084 { 2085 .procname = "am_droprate", 2086 .maxlen = sizeof(int), 2087 .mode = 0644, 2088 .proc_handler = proc_dointvec, 2089 }, 2090 { 2091 .procname = "drop_entry", 2092 .maxlen = sizeof(int), 2093 .mode = 0644, 2094 .proc_handler = proc_do_defense_mode, 2095 }, 2096 { 2097 .procname = "drop_packet", 2098 .maxlen = sizeof(int), 2099 .mode = 0644, 2100 .proc_handler = proc_do_defense_mode, 2101 }, 2102 #ifdef CONFIG_IP_VS_NFCT 2103 { 2104 .procname = "conntrack", 2105 .maxlen = sizeof(int), 2106 .mode = 0644, 2107 .proc_handler = &proc_dointvec, 2108 }, 2109 #endif 2110 { 2111 .procname = "secure_tcp", 2112 .maxlen = sizeof(int), 2113 .mode = 0644, 2114 .proc_handler = proc_do_defense_mode, 2115 }, 2116 { 2117 .procname = "snat_reroute", 2118 .maxlen = sizeof(int), 2119 .mode = 0644, 2120 .proc_handler = &proc_dointvec, 2121 }, 2122 { 2123 .procname = "sync_version", 2124 .maxlen = sizeof(int), 2125 .mode = 0644, 2126 .proc_handler = proc_dointvec_minmax, 2127 .extra1 = SYSCTL_ZERO, 2128 .extra2 = SYSCTL_ONE, 2129 }, 2130 { 2131 .procname = "sync_ports", 2132 .maxlen = sizeof(int), 2133 .mode = 0644, 2134 .proc_handler = proc_do_sync_ports, 2135 }, 2136 { 2137 .procname = "sync_persist_mode", 2138 .maxlen = sizeof(int), 2139 .mode = 0644, 2140 .proc_handler = proc_dointvec, 2141 }, 2142 { 2143 .procname = "sync_qlen_max", 2144 .maxlen = sizeof(unsigned long), 2145 .mode = 0644, 2146 .proc_handler = proc_doulongvec_minmax, 2147 }, 2148 { 2149 .procname = "sync_sock_size", 2150 .maxlen = sizeof(int), 2151 .mode = 0644, 2152 .proc_handler = proc_dointvec, 2153 }, 2154 { 2155 .procname = "cache_bypass", 2156 .maxlen = sizeof(int), 2157 .mode = 0644, 2158 .proc_handler = proc_dointvec, 2159 }, 2160 { 2161 .procname = "expire_nodest_conn", 2162 .maxlen = sizeof(int), 2163 .mode = 0644, 2164 .proc_handler = proc_dointvec, 2165 }, 2166 { 2167 .procname = "sloppy_tcp", 2168 .maxlen = sizeof(int), 2169 .mode = 0644, 2170 .proc_handler = proc_dointvec, 2171 }, 2172 { 2173 .procname = "sloppy_sctp", 2174 .maxlen = sizeof(int), 2175 .mode = 0644, 2176 .proc_handler = proc_dointvec, 2177 }, 2178 { 2179 .procname = "expire_quiescent_template", 2180 .maxlen = sizeof(int), 2181 .mode = 0644, 2182 .proc_handler = proc_dointvec, 2183 }, 2184 { 2185 .procname = "sync_threshold", 2186 .maxlen = 2187 sizeof(((struct netns_ipvs *)0)->sysctl_sync_threshold), 2188 .mode = 0644, 2189 .proc_handler = proc_do_sync_threshold, 2190 }, 2191 { 2192 .procname = "sync_refresh_period", 2193 .maxlen = sizeof(int), 2194 .mode = 0644, 2195 .proc_handler = proc_dointvec_jiffies, 2196 }, 2197 { 2198 .procname = "sync_retries", 2199 .maxlen = sizeof(int), 2200 .mode = 0644, 2201 .proc_handler = proc_dointvec_minmax, 2202 .extra1 = SYSCTL_ZERO, 2203 .extra2 = SYSCTL_THREE, 2204 }, 2205 { 2206 .procname = "nat_icmp_send", 2207 .maxlen = sizeof(int), 2208 .mode = 0644, 2209 .proc_handler = proc_dointvec, 2210 }, 2211 { 2212 .procname = "pmtu_disc", 2213 .maxlen = sizeof(int), 2214 .mode = 0644, 2215 .proc_handler = proc_dointvec, 2216 }, 2217 { 2218 .procname = "backup_only", 2219 .maxlen = sizeof(int), 2220 .mode = 0644, 2221 .proc_handler = proc_dointvec, 2222 }, 2223 { 2224 .procname = "conn_reuse_mode", 2225 .maxlen = sizeof(int), 2226 .mode = 0644, 2227 .proc_handler = proc_dointvec, 2228 }, 2229 { 2230 .procname = "schedule_icmp", 2231 .maxlen = sizeof(int), 2232 .mode = 0644, 2233 .proc_handler = proc_dointvec, 2234 }, 2235 { 2236 .procname = "ignore_tunneled", 2237 .maxlen = sizeof(int), 2238 .mode = 0644, 2239 .proc_handler = proc_dointvec, 2240 }, 2241 { 2242 .procname = "run_estimation", 2243 .maxlen = sizeof(int), 2244 .mode = 0644, 2245 .proc_handler = ipvs_proc_run_estimation, 2246 }, 2247 { 2248 .procname = "est_cpulist", 2249 .maxlen = NR_CPUS, /* unused */ 2250 .mode = 0644, 2251 .proc_handler = ipvs_proc_est_cpulist, 2252 }, 2253 { 2254 .procname = "est_nice", 2255 .maxlen = sizeof(int), 2256 .mode = 0644, 2257 .proc_handler = ipvs_proc_est_nice, 2258 }, 2259 #ifdef CONFIG_IP_VS_DEBUG 2260 { 2261 .procname = "debug_level", 2262 .data = &sysctl_ip_vs_debug_level, 2263 .maxlen = sizeof(int), 2264 .mode = 0644, 2265 .proc_handler = proc_dointvec, 2266 }, 2267 #endif 2268 }; 2269 2270 #endif 2271 2272 #ifdef CONFIG_PROC_FS 2273 2274 struct ip_vs_iter { 2275 struct seq_net_private p; /* Do not move this, netns depends upon it*/ 2276 struct hlist_head *table; 2277 int bucket; 2278 }; 2279 2280 /* 2281 * Write the contents of the VS rule table to a PROCfs file. 2282 * (It is kept just for backward compatibility) 2283 */ 2284 static inline const char *ip_vs_fwd_name(unsigned int flags) 2285 { 2286 switch (flags & IP_VS_CONN_F_FWD_MASK) { 2287 case IP_VS_CONN_F_LOCALNODE: 2288 return "Local"; 2289 case IP_VS_CONN_F_TUNNEL: 2290 return "Tunnel"; 2291 case IP_VS_CONN_F_DROUTE: 2292 return "Route"; 2293 default: 2294 return "Masq"; 2295 } 2296 } 2297 2298 2299 /* Get the Nth entry in the two lists */ 2300 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos) 2301 { 2302 struct net *net = seq_file_net(seq); 2303 struct netns_ipvs *ipvs = net_ipvs(net); 2304 struct ip_vs_iter *iter = seq->private; 2305 int idx; 2306 struct ip_vs_service *svc; 2307 2308 /* look in hash by protocol */ 2309 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 2310 hlist_for_each_entry_rcu(svc, &ip_vs_svc_table[idx], s_list) { 2311 if ((svc->ipvs == ipvs) && pos-- == 0) { 2312 iter->table = ip_vs_svc_table; 2313 iter->bucket = idx; 2314 return svc; 2315 } 2316 } 2317 } 2318 2319 /* keep looking in fwmark */ 2320 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 2321 hlist_for_each_entry_rcu(svc, &ip_vs_svc_fwm_table[idx], 2322 f_list) { 2323 if ((svc->ipvs == ipvs) && pos-- == 0) { 2324 iter->table = ip_vs_svc_fwm_table; 2325 iter->bucket = idx; 2326 return svc; 2327 } 2328 } 2329 } 2330 2331 return NULL; 2332 } 2333 2334 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos) 2335 __acquires(RCU) 2336 { 2337 rcu_read_lock(); 2338 return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN; 2339 } 2340 2341 2342 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos) 2343 { 2344 struct hlist_node *e; 2345 struct ip_vs_iter *iter; 2346 struct ip_vs_service *svc; 2347 2348 ++*pos; 2349 if (v == SEQ_START_TOKEN) 2350 return ip_vs_info_array(seq,0); 2351 2352 svc = v; 2353 iter = seq->private; 2354 2355 if (iter->table == ip_vs_svc_table) { 2356 /* next service in table hashed by protocol */ 2357 e = rcu_dereference(hlist_next_rcu(&svc->s_list)); 2358 if (e) 2359 return hlist_entry(e, struct ip_vs_service, s_list); 2360 2361 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) { 2362 hlist_for_each_entry_rcu(svc, 2363 &ip_vs_svc_table[iter->bucket], 2364 s_list) { 2365 return svc; 2366 } 2367 } 2368 2369 iter->table = ip_vs_svc_fwm_table; 2370 iter->bucket = -1; 2371 goto scan_fwmark; 2372 } 2373 2374 /* next service in hashed by fwmark */ 2375 e = rcu_dereference(hlist_next_rcu(&svc->f_list)); 2376 if (e) 2377 return hlist_entry(e, struct ip_vs_service, f_list); 2378 2379 scan_fwmark: 2380 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) { 2381 hlist_for_each_entry_rcu(svc, 2382 &ip_vs_svc_fwm_table[iter->bucket], 2383 f_list) 2384 return svc; 2385 } 2386 2387 return NULL; 2388 } 2389 2390 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v) 2391 __releases(RCU) 2392 { 2393 rcu_read_unlock(); 2394 } 2395 2396 2397 static int ip_vs_info_seq_show(struct seq_file *seq, void *v) 2398 { 2399 if (v == SEQ_START_TOKEN) { 2400 seq_printf(seq, 2401 "IP Virtual Server version %d.%d.%d (size=%d)\n", 2402 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size); 2403 seq_puts(seq, 2404 "Prot LocalAddress:Port Scheduler Flags\n"); 2405 seq_puts(seq, 2406 " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n"); 2407 } else { 2408 struct net *net = seq_file_net(seq); 2409 struct netns_ipvs *ipvs = net_ipvs(net); 2410 const struct ip_vs_service *svc = v; 2411 const struct ip_vs_iter *iter = seq->private; 2412 const struct ip_vs_dest *dest; 2413 struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler); 2414 char *sched_name = sched ? sched->name : "none"; 2415 2416 if (svc->ipvs != ipvs) 2417 return 0; 2418 if (iter->table == ip_vs_svc_table) { 2419 #ifdef CONFIG_IP_VS_IPV6 2420 if (svc->af == AF_INET6) 2421 seq_printf(seq, "%s [%pI6]:%04X %s ", 2422 ip_vs_proto_name(svc->protocol), 2423 &svc->addr.in6, 2424 ntohs(svc->port), 2425 sched_name); 2426 else 2427 #endif 2428 seq_printf(seq, "%s %08X:%04X %s %s ", 2429 ip_vs_proto_name(svc->protocol), 2430 ntohl(svc->addr.ip), 2431 ntohs(svc->port), 2432 sched_name, 2433 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":""); 2434 } else { 2435 seq_printf(seq, "FWM %08X %s %s", 2436 svc->fwmark, sched_name, 2437 (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":""); 2438 } 2439 2440 if (svc->flags & IP_VS_SVC_F_PERSISTENT) 2441 seq_printf(seq, "persistent %d %08X\n", 2442 svc->timeout, 2443 ntohl(svc->netmask)); 2444 else 2445 seq_putc(seq, '\n'); 2446 2447 list_for_each_entry_rcu(dest, &svc->destinations, n_list) { 2448 #ifdef CONFIG_IP_VS_IPV6 2449 if (dest->af == AF_INET6) 2450 seq_printf(seq, 2451 " -> [%pI6]:%04X" 2452 " %-7s %-6d %-10d %-10d\n", 2453 &dest->addr.in6, 2454 ntohs(dest->port), 2455 ip_vs_fwd_name(atomic_read(&dest->conn_flags)), 2456 atomic_read(&dest->weight), 2457 atomic_read(&dest->activeconns), 2458 atomic_read(&dest->inactconns)); 2459 else 2460 #endif 2461 seq_printf(seq, 2462 " -> %08X:%04X " 2463 "%-7s %-6d %-10d %-10d\n", 2464 ntohl(dest->addr.ip), 2465 ntohs(dest->port), 2466 ip_vs_fwd_name(atomic_read(&dest->conn_flags)), 2467 atomic_read(&dest->weight), 2468 atomic_read(&dest->activeconns), 2469 atomic_read(&dest->inactconns)); 2470 2471 } 2472 } 2473 return 0; 2474 } 2475 2476 static const struct seq_operations ip_vs_info_seq_ops = { 2477 .start = ip_vs_info_seq_start, 2478 .next = ip_vs_info_seq_next, 2479 .stop = ip_vs_info_seq_stop, 2480 .show = ip_vs_info_seq_show, 2481 }; 2482 2483 static int ip_vs_stats_show(struct seq_file *seq, void *v) 2484 { 2485 struct net *net = seq_file_single_net(seq); 2486 struct ip_vs_kstats show; 2487 2488 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */ 2489 seq_puts(seq, 2490 " Total Incoming Outgoing Incoming Outgoing\n"); 2491 seq_puts(seq, 2492 " Conns Packets Packets Bytes Bytes\n"); 2493 2494 ip_vs_copy_stats(&show, &net_ipvs(net)->tot_stats->s); 2495 seq_printf(seq, "%8LX %8LX %8LX %16LX %16LX\n\n", 2496 (unsigned long long)show.conns, 2497 (unsigned long long)show.inpkts, 2498 (unsigned long long)show.outpkts, 2499 (unsigned long long)show.inbytes, 2500 (unsigned long long)show.outbytes); 2501 2502 /* 01234567 01234567 01234567 0123456701234567 0123456701234567*/ 2503 seq_puts(seq, 2504 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n"); 2505 seq_printf(seq, "%8LX %8LX %8LX %16LX %16LX\n", 2506 (unsigned long long)show.cps, 2507 (unsigned long long)show.inpps, 2508 (unsigned long long)show.outpps, 2509 (unsigned long long)show.inbps, 2510 (unsigned long long)show.outbps); 2511 2512 return 0; 2513 } 2514 2515 static int ip_vs_stats_percpu_show(struct seq_file *seq, void *v) 2516 { 2517 struct net *net = seq_file_single_net(seq); 2518 struct ip_vs_stats *tot_stats = &net_ipvs(net)->tot_stats->s; 2519 struct ip_vs_cpu_stats __percpu *cpustats = tot_stats->cpustats; 2520 struct ip_vs_kstats kstats; 2521 int i; 2522 2523 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */ 2524 seq_puts(seq, 2525 " Total Incoming Outgoing Incoming Outgoing\n"); 2526 seq_puts(seq, 2527 "CPU Conns Packets Packets Bytes Bytes\n"); 2528 2529 for_each_possible_cpu(i) { 2530 struct ip_vs_cpu_stats *u = per_cpu_ptr(cpustats, i); 2531 unsigned int start; 2532 u64 conns, inpkts, outpkts, inbytes, outbytes; 2533 2534 do { 2535 start = u64_stats_fetch_begin(&u->syncp); 2536 conns = u64_stats_read(&u->cnt.conns); 2537 inpkts = u64_stats_read(&u->cnt.inpkts); 2538 outpkts = u64_stats_read(&u->cnt.outpkts); 2539 inbytes = u64_stats_read(&u->cnt.inbytes); 2540 outbytes = u64_stats_read(&u->cnt.outbytes); 2541 } while (u64_stats_fetch_retry(&u->syncp, start)); 2542 2543 seq_printf(seq, "%3X %8LX %8LX %8LX %16LX %16LX\n", 2544 i, (u64)conns, (u64)inpkts, 2545 (u64)outpkts, (u64)inbytes, 2546 (u64)outbytes); 2547 } 2548 2549 ip_vs_copy_stats(&kstats, tot_stats); 2550 2551 seq_printf(seq, " ~ %8LX %8LX %8LX %16LX %16LX\n\n", 2552 (unsigned long long)kstats.conns, 2553 (unsigned long long)kstats.inpkts, 2554 (unsigned long long)kstats.outpkts, 2555 (unsigned long long)kstats.inbytes, 2556 (unsigned long long)kstats.outbytes); 2557 2558 /* ... 01234567 01234567 01234567 0123456701234567 0123456701234567 */ 2559 seq_puts(seq, 2560 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n"); 2561 seq_printf(seq, " %8LX %8LX %8LX %16LX %16LX\n", 2562 kstats.cps, 2563 kstats.inpps, 2564 kstats.outpps, 2565 kstats.inbps, 2566 kstats.outbps); 2567 2568 return 0; 2569 } 2570 #endif 2571 2572 /* 2573 * Set timeout values for tcp tcpfin udp in the timeout_table. 2574 */ 2575 static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user *u) 2576 { 2577 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP) 2578 struct ip_vs_proto_data *pd; 2579 #endif 2580 2581 IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n", 2582 u->tcp_timeout, 2583 u->tcp_fin_timeout, 2584 u->udp_timeout); 2585 2586 #ifdef CONFIG_IP_VS_PROTO_TCP 2587 if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) || 2588 u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) { 2589 return -EINVAL; 2590 } 2591 #endif 2592 2593 #ifdef CONFIG_IP_VS_PROTO_UDP 2594 if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ)) 2595 return -EINVAL; 2596 #endif 2597 2598 #ifdef CONFIG_IP_VS_PROTO_TCP 2599 if (u->tcp_timeout) { 2600 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP); 2601 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] 2602 = u->tcp_timeout * HZ; 2603 } 2604 2605 if (u->tcp_fin_timeout) { 2606 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP); 2607 pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] 2608 = u->tcp_fin_timeout * HZ; 2609 } 2610 #endif 2611 2612 #ifdef CONFIG_IP_VS_PROTO_UDP 2613 if (u->udp_timeout) { 2614 pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP); 2615 pd->timeout_table[IP_VS_UDP_S_NORMAL] 2616 = u->udp_timeout * HZ; 2617 } 2618 #endif 2619 return 0; 2620 } 2621 2622 #define CMDID(cmd) (cmd - IP_VS_BASE_CTL) 2623 2624 struct ip_vs_svcdest_user { 2625 struct ip_vs_service_user s; 2626 struct ip_vs_dest_user d; 2627 }; 2628 2629 static const unsigned char set_arglen[CMDID(IP_VS_SO_SET_MAX) + 1] = { 2630 [CMDID(IP_VS_SO_SET_ADD)] = sizeof(struct ip_vs_service_user), 2631 [CMDID(IP_VS_SO_SET_EDIT)] = sizeof(struct ip_vs_service_user), 2632 [CMDID(IP_VS_SO_SET_DEL)] = sizeof(struct ip_vs_service_user), 2633 [CMDID(IP_VS_SO_SET_ADDDEST)] = sizeof(struct ip_vs_svcdest_user), 2634 [CMDID(IP_VS_SO_SET_DELDEST)] = sizeof(struct ip_vs_svcdest_user), 2635 [CMDID(IP_VS_SO_SET_EDITDEST)] = sizeof(struct ip_vs_svcdest_user), 2636 [CMDID(IP_VS_SO_SET_TIMEOUT)] = sizeof(struct ip_vs_timeout_user), 2637 [CMDID(IP_VS_SO_SET_STARTDAEMON)] = sizeof(struct ip_vs_daemon_user), 2638 [CMDID(IP_VS_SO_SET_STOPDAEMON)] = sizeof(struct ip_vs_daemon_user), 2639 [CMDID(IP_VS_SO_SET_ZERO)] = sizeof(struct ip_vs_service_user), 2640 }; 2641 2642 union ip_vs_set_arglen { 2643 struct ip_vs_service_user field_IP_VS_SO_SET_ADD; 2644 struct ip_vs_service_user field_IP_VS_SO_SET_EDIT; 2645 struct ip_vs_service_user field_IP_VS_SO_SET_DEL; 2646 struct ip_vs_svcdest_user field_IP_VS_SO_SET_ADDDEST; 2647 struct ip_vs_svcdest_user field_IP_VS_SO_SET_DELDEST; 2648 struct ip_vs_svcdest_user field_IP_VS_SO_SET_EDITDEST; 2649 struct ip_vs_timeout_user field_IP_VS_SO_SET_TIMEOUT; 2650 struct ip_vs_daemon_user field_IP_VS_SO_SET_STARTDAEMON; 2651 struct ip_vs_daemon_user field_IP_VS_SO_SET_STOPDAEMON; 2652 struct ip_vs_service_user field_IP_VS_SO_SET_ZERO; 2653 }; 2654 2655 #define MAX_SET_ARGLEN sizeof(union ip_vs_set_arglen) 2656 2657 static void ip_vs_copy_usvc_compat(struct ip_vs_service_user_kern *usvc, 2658 struct ip_vs_service_user *usvc_compat) 2659 { 2660 memset(usvc, 0, sizeof(*usvc)); 2661 2662 usvc->af = AF_INET; 2663 usvc->protocol = usvc_compat->protocol; 2664 usvc->addr.ip = usvc_compat->addr; 2665 usvc->port = usvc_compat->port; 2666 usvc->fwmark = usvc_compat->fwmark; 2667 2668 /* Deep copy of sched_name is not needed here */ 2669 usvc->sched_name = usvc_compat->sched_name; 2670 2671 usvc->flags = usvc_compat->flags; 2672 usvc->timeout = usvc_compat->timeout; 2673 usvc->netmask = usvc_compat->netmask; 2674 } 2675 2676 static void ip_vs_copy_udest_compat(struct ip_vs_dest_user_kern *udest, 2677 struct ip_vs_dest_user *udest_compat) 2678 { 2679 memset(udest, 0, sizeof(*udest)); 2680 2681 udest->addr.ip = udest_compat->addr; 2682 udest->port = udest_compat->port; 2683 udest->conn_flags = udest_compat->conn_flags; 2684 udest->weight = udest_compat->weight; 2685 udest->u_threshold = udest_compat->u_threshold; 2686 udest->l_threshold = udest_compat->l_threshold; 2687 udest->af = AF_INET; 2688 udest->tun_type = IP_VS_CONN_F_TUNNEL_TYPE_IPIP; 2689 } 2690 2691 static int 2692 do_ip_vs_set_ctl(struct sock *sk, int cmd, sockptr_t ptr, unsigned int len) 2693 { 2694 struct net *net = sock_net(sk); 2695 int ret; 2696 unsigned char arg[MAX_SET_ARGLEN]; 2697 struct ip_vs_service_user *usvc_compat; 2698 struct ip_vs_service_user_kern usvc; 2699 struct ip_vs_service *svc; 2700 struct ip_vs_dest_user *udest_compat; 2701 struct ip_vs_dest_user_kern udest; 2702 struct netns_ipvs *ipvs = net_ipvs(net); 2703 2704 BUILD_BUG_ON(sizeof(arg) > 255); 2705 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) 2706 return -EPERM; 2707 2708 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX) 2709 return -EINVAL; 2710 if (len != set_arglen[CMDID(cmd)]) { 2711 IP_VS_DBG(1, "set_ctl: len %u != %u\n", 2712 len, set_arglen[CMDID(cmd)]); 2713 return -EINVAL; 2714 } 2715 2716 if (copy_from_sockptr(arg, ptr, len) != 0) 2717 return -EFAULT; 2718 2719 /* Handle daemons since they have another lock */ 2720 if (cmd == IP_VS_SO_SET_STARTDAEMON || 2721 cmd == IP_VS_SO_SET_STOPDAEMON) { 2722 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg; 2723 2724 if (cmd == IP_VS_SO_SET_STARTDAEMON) { 2725 struct ipvs_sync_daemon_cfg cfg; 2726 2727 memset(&cfg, 0, sizeof(cfg)); 2728 ret = -EINVAL; 2729 if (strscpy(cfg.mcast_ifn, dm->mcast_ifn, 2730 sizeof(cfg.mcast_ifn)) <= 0) 2731 return ret; 2732 cfg.syncid = dm->syncid; 2733 ret = start_sync_thread(ipvs, &cfg, dm->state); 2734 } else { 2735 ret = stop_sync_thread(ipvs, dm->state); 2736 } 2737 return ret; 2738 } 2739 2740 mutex_lock(&__ip_vs_mutex); 2741 if (cmd == IP_VS_SO_SET_FLUSH) { 2742 /* Flush the virtual service */ 2743 ret = ip_vs_flush(ipvs, false); 2744 goto out_unlock; 2745 } else if (cmd == IP_VS_SO_SET_TIMEOUT) { 2746 /* Set timeout values for (tcp tcpfin udp) */ 2747 ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg); 2748 goto out_unlock; 2749 } else if (!len) { 2750 /* No more commands with len == 0 below */ 2751 ret = -EINVAL; 2752 goto out_unlock; 2753 } 2754 2755 usvc_compat = (struct ip_vs_service_user *)arg; 2756 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1); 2757 2758 /* We only use the new structs internally, so copy userspace compat 2759 * structs to extended internal versions */ 2760 ip_vs_copy_usvc_compat(&usvc, usvc_compat); 2761 ip_vs_copy_udest_compat(&udest, udest_compat); 2762 2763 if (cmd == IP_VS_SO_SET_ZERO) { 2764 /* if no service address is set, zero counters in all */ 2765 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) { 2766 ret = ip_vs_zero_all(ipvs); 2767 goto out_unlock; 2768 } 2769 } 2770 2771 if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) && 2772 strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) == 2773 IP_VS_SCHEDNAME_MAXLEN) { 2774 ret = -EINVAL; 2775 goto out_unlock; 2776 } 2777 2778 /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */ 2779 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP && 2780 usvc.protocol != IPPROTO_SCTP) { 2781 pr_err("set_ctl: invalid protocol: %d %pI4:%d\n", 2782 usvc.protocol, &usvc.addr.ip, 2783 ntohs(usvc.port)); 2784 ret = -EFAULT; 2785 goto out_unlock; 2786 } 2787 2788 /* Lookup the exact service by <protocol, addr, port> or fwmark */ 2789 rcu_read_lock(); 2790 if (usvc.fwmark == 0) 2791 svc = __ip_vs_service_find(ipvs, usvc.af, usvc.protocol, 2792 &usvc.addr, usvc.port); 2793 else 2794 svc = __ip_vs_svc_fwm_find(ipvs, usvc.af, usvc.fwmark); 2795 rcu_read_unlock(); 2796 2797 if (cmd != IP_VS_SO_SET_ADD 2798 && (svc == NULL || svc->protocol != usvc.protocol)) { 2799 ret = -ESRCH; 2800 goto out_unlock; 2801 } 2802 2803 switch (cmd) { 2804 case IP_VS_SO_SET_ADD: 2805 if (svc != NULL) 2806 ret = -EEXIST; 2807 else 2808 ret = ip_vs_add_service(ipvs, &usvc, &svc); 2809 break; 2810 case IP_VS_SO_SET_EDIT: 2811 ret = ip_vs_edit_service(svc, &usvc); 2812 break; 2813 case IP_VS_SO_SET_DEL: 2814 ret = ip_vs_del_service(svc); 2815 if (!ret) 2816 goto out_unlock; 2817 break; 2818 case IP_VS_SO_SET_ZERO: 2819 ret = ip_vs_zero_service(svc); 2820 break; 2821 case IP_VS_SO_SET_ADDDEST: 2822 ret = ip_vs_add_dest(svc, &udest); 2823 break; 2824 case IP_VS_SO_SET_EDITDEST: 2825 ret = ip_vs_edit_dest(svc, &udest); 2826 break; 2827 case IP_VS_SO_SET_DELDEST: 2828 ret = ip_vs_del_dest(svc, &udest); 2829 break; 2830 default: 2831 WARN_ON_ONCE(1); 2832 ret = -EINVAL; 2833 break; 2834 } 2835 2836 out_unlock: 2837 mutex_unlock(&__ip_vs_mutex); 2838 return ret; 2839 } 2840 2841 2842 static void 2843 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src) 2844 { 2845 struct ip_vs_scheduler *sched; 2846 struct ip_vs_kstats kstats; 2847 char *sched_name; 2848 2849 sched = rcu_dereference_protected(src->scheduler, 1); 2850 sched_name = sched ? sched->name : "none"; 2851 dst->protocol = src->protocol; 2852 dst->addr = src->addr.ip; 2853 dst->port = src->port; 2854 dst->fwmark = src->fwmark; 2855 strscpy(dst->sched_name, sched_name, sizeof(dst->sched_name)); 2856 dst->flags = src->flags; 2857 dst->timeout = src->timeout / HZ; 2858 dst->netmask = src->netmask; 2859 dst->num_dests = src->num_dests; 2860 ip_vs_copy_stats(&kstats, &src->stats); 2861 ip_vs_export_stats_user(&dst->stats, &kstats); 2862 } 2863 2864 static inline int 2865 __ip_vs_get_service_entries(struct netns_ipvs *ipvs, 2866 const struct ip_vs_get_services *get, 2867 struct ip_vs_get_services __user *uptr) 2868 { 2869 int idx, count=0; 2870 struct ip_vs_service *svc; 2871 struct ip_vs_service_entry entry; 2872 int ret = 0; 2873 2874 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 2875 hlist_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) { 2876 /* Only expose IPv4 entries to old interface */ 2877 if (svc->af != AF_INET || (svc->ipvs != ipvs)) 2878 continue; 2879 2880 if (count >= get->num_services) 2881 goto out; 2882 memset(&entry, 0, sizeof(entry)); 2883 ip_vs_copy_service(&entry, svc); 2884 if (copy_to_user(&uptr->entrytable[count], 2885 &entry, sizeof(entry))) { 2886 ret = -EFAULT; 2887 goto out; 2888 } 2889 count++; 2890 } 2891 } 2892 2893 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 2894 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) { 2895 /* Only expose IPv4 entries to old interface */ 2896 if (svc->af != AF_INET || (svc->ipvs != ipvs)) 2897 continue; 2898 2899 if (count >= get->num_services) 2900 goto out; 2901 memset(&entry, 0, sizeof(entry)); 2902 ip_vs_copy_service(&entry, svc); 2903 if (copy_to_user(&uptr->entrytable[count], 2904 &entry, sizeof(entry))) { 2905 ret = -EFAULT; 2906 goto out; 2907 } 2908 count++; 2909 } 2910 } 2911 out: 2912 return ret; 2913 } 2914 2915 static inline int 2916 __ip_vs_get_dest_entries(struct netns_ipvs *ipvs, const struct ip_vs_get_dests *get, 2917 struct ip_vs_get_dests __user *uptr) 2918 { 2919 struct ip_vs_service *svc; 2920 union nf_inet_addr addr = { .ip = get->addr }; 2921 int ret = 0; 2922 2923 rcu_read_lock(); 2924 if (get->fwmark) 2925 svc = __ip_vs_svc_fwm_find(ipvs, AF_INET, get->fwmark); 2926 else 2927 svc = __ip_vs_service_find(ipvs, AF_INET, get->protocol, &addr, 2928 get->port); 2929 rcu_read_unlock(); 2930 2931 if (svc) { 2932 int count = 0; 2933 struct ip_vs_dest *dest; 2934 struct ip_vs_dest_entry entry; 2935 struct ip_vs_kstats kstats; 2936 2937 memset(&entry, 0, sizeof(entry)); 2938 list_for_each_entry(dest, &svc->destinations, n_list) { 2939 if (count >= get->num_dests) 2940 break; 2941 2942 /* Cannot expose heterogeneous members via sockopt 2943 * interface 2944 */ 2945 if (dest->af != svc->af) 2946 continue; 2947 2948 entry.addr = dest->addr.ip; 2949 entry.port = dest->port; 2950 entry.conn_flags = atomic_read(&dest->conn_flags); 2951 entry.weight = atomic_read(&dest->weight); 2952 entry.u_threshold = dest->u_threshold; 2953 entry.l_threshold = dest->l_threshold; 2954 entry.activeconns = atomic_read(&dest->activeconns); 2955 entry.inactconns = atomic_read(&dest->inactconns); 2956 entry.persistconns = atomic_read(&dest->persistconns); 2957 ip_vs_copy_stats(&kstats, &dest->stats); 2958 ip_vs_export_stats_user(&entry.stats, &kstats); 2959 if (copy_to_user(&uptr->entrytable[count], 2960 &entry, sizeof(entry))) { 2961 ret = -EFAULT; 2962 break; 2963 } 2964 count++; 2965 } 2966 } else 2967 ret = -ESRCH; 2968 return ret; 2969 } 2970 2971 static inline void 2972 __ip_vs_get_timeouts(struct netns_ipvs *ipvs, struct ip_vs_timeout_user *u) 2973 { 2974 #if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP) 2975 struct ip_vs_proto_data *pd; 2976 #endif 2977 2978 memset(u, 0, sizeof (*u)); 2979 2980 #ifdef CONFIG_IP_VS_PROTO_TCP 2981 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP); 2982 u->tcp_timeout = pd->timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ; 2983 u->tcp_fin_timeout = pd->timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ; 2984 #endif 2985 #ifdef CONFIG_IP_VS_PROTO_UDP 2986 pd = ip_vs_proto_data_get(ipvs, IPPROTO_UDP); 2987 u->udp_timeout = 2988 pd->timeout_table[IP_VS_UDP_S_NORMAL] / HZ; 2989 #endif 2990 } 2991 2992 static const unsigned char get_arglen[CMDID(IP_VS_SO_GET_MAX) + 1] = { 2993 [CMDID(IP_VS_SO_GET_VERSION)] = 64, 2994 [CMDID(IP_VS_SO_GET_INFO)] = sizeof(struct ip_vs_getinfo), 2995 [CMDID(IP_VS_SO_GET_SERVICES)] = sizeof(struct ip_vs_get_services), 2996 [CMDID(IP_VS_SO_GET_SERVICE)] = sizeof(struct ip_vs_service_entry), 2997 [CMDID(IP_VS_SO_GET_DESTS)] = sizeof(struct ip_vs_get_dests), 2998 [CMDID(IP_VS_SO_GET_TIMEOUT)] = sizeof(struct ip_vs_timeout_user), 2999 [CMDID(IP_VS_SO_GET_DAEMON)] = 2 * sizeof(struct ip_vs_daemon_user), 3000 }; 3001 3002 union ip_vs_get_arglen { 3003 char field_IP_VS_SO_GET_VERSION[64]; 3004 struct ip_vs_getinfo field_IP_VS_SO_GET_INFO; 3005 struct ip_vs_get_services field_IP_VS_SO_GET_SERVICES; 3006 struct ip_vs_service_entry field_IP_VS_SO_GET_SERVICE; 3007 struct ip_vs_get_dests field_IP_VS_SO_GET_DESTS; 3008 struct ip_vs_timeout_user field_IP_VS_SO_GET_TIMEOUT; 3009 struct ip_vs_daemon_user field_IP_VS_SO_GET_DAEMON[2]; 3010 }; 3011 3012 #define MAX_GET_ARGLEN sizeof(union ip_vs_get_arglen) 3013 3014 static int 3015 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 3016 { 3017 unsigned char arg[MAX_GET_ARGLEN]; 3018 int ret = 0; 3019 unsigned int copylen; 3020 struct net *net = sock_net(sk); 3021 struct netns_ipvs *ipvs = net_ipvs(net); 3022 3023 BUG_ON(!net); 3024 BUILD_BUG_ON(sizeof(arg) > 255); 3025 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) 3026 return -EPERM; 3027 3028 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX) 3029 return -EINVAL; 3030 3031 copylen = get_arglen[CMDID(cmd)]; 3032 if (*len < (int) copylen) { 3033 IP_VS_DBG(1, "get_ctl: len %d < %u\n", *len, copylen); 3034 return -EINVAL; 3035 } 3036 3037 if (copy_from_user(arg, user, copylen) != 0) 3038 return -EFAULT; 3039 /* 3040 * Handle daemons first since it has its own locking 3041 */ 3042 if (cmd == IP_VS_SO_GET_DAEMON) { 3043 struct ip_vs_daemon_user d[2]; 3044 3045 memset(&d, 0, sizeof(d)); 3046 mutex_lock(&ipvs->sync_mutex); 3047 if (ipvs->sync_state & IP_VS_STATE_MASTER) { 3048 d[0].state = IP_VS_STATE_MASTER; 3049 strscpy(d[0].mcast_ifn, ipvs->mcfg.mcast_ifn, 3050 sizeof(d[0].mcast_ifn)); 3051 d[0].syncid = ipvs->mcfg.syncid; 3052 } 3053 if (ipvs->sync_state & IP_VS_STATE_BACKUP) { 3054 d[1].state = IP_VS_STATE_BACKUP; 3055 strscpy(d[1].mcast_ifn, ipvs->bcfg.mcast_ifn, 3056 sizeof(d[1].mcast_ifn)); 3057 d[1].syncid = ipvs->bcfg.syncid; 3058 } 3059 if (copy_to_user(user, &d, sizeof(d)) != 0) 3060 ret = -EFAULT; 3061 mutex_unlock(&ipvs->sync_mutex); 3062 return ret; 3063 } 3064 3065 mutex_lock(&__ip_vs_mutex); 3066 switch (cmd) { 3067 case IP_VS_SO_GET_VERSION: 3068 { 3069 char buf[64]; 3070 3071 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)", 3072 NVERSION(IP_VS_VERSION_CODE), ip_vs_conn_tab_size); 3073 if (copy_to_user(user, buf, strlen(buf)+1) != 0) { 3074 ret = -EFAULT; 3075 goto out; 3076 } 3077 *len = strlen(buf)+1; 3078 } 3079 break; 3080 3081 case IP_VS_SO_GET_INFO: 3082 { 3083 struct ip_vs_getinfo info; 3084 info.version = IP_VS_VERSION_CODE; 3085 info.size = ip_vs_conn_tab_size; 3086 info.num_services = ipvs->num_services; 3087 if (copy_to_user(user, &info, sizeof(info)) != 0) 3088 ret = -EFAULT; 3089 } 3090 break; 3091 3092 case IP_VS_SO_GET_SERVICES: 3093 { 3094 struct ip_vs_get_services *get; 3095 size_t size; 3096 3097 get = (struct ip_vs_get_services *)arg; 3098 size = struct_size(get, entrytable, get->num_services); 3099 if (*len != size) { 3100 pr_err("length: %u != %zu\n", *len, size); 3101 ret = -EINVAL; 3102 goto out; 3103 } 3104 ret = __ip_vs_get_service_entries(ipvs, get, user); 3105 } 3106 break; 3107 3108 case IP_VS_SO_GET_SERVICE: 3109 { 3110 struct ip_vs_service_entry *entry; 3111 struct ip_vs_service *svc; 3112 union nf_inet_addr addr; 3113 3114 entry = (struct ip_vs_service_entry *)arg; 3115 addr.ip = entry->addr; 3116 rcu_read_lock(); 3117 if (entry->fwmark) 3118 svc = __ip_vs_svc_fwm_find(ipvs, AF_INET, entry->fwmark); 3119 else 3120 svc = __ip_vs_service_find(ipvs, AF_INET, 3121 entry->protocol, &addr, 3122 entry->port); 3123 rcu_read_unlock(); 3124 if (svc) { 3125 ip_vs_copy_service(entry, svc); 3126 if (copy_to_user(user, entry, sizeof(*entry)) != 0) 3127 ret = -EFAULT; 3128 } else 3129 ret = -ESRCH; 3130 } 3131 break; 3132 3133 case IP_VS_SO_GET_DESTS: 3134 { 3135 struct ip_vs_get_dests *get; 3136 size_t size; 3137 3138 get = (struct ip_vs_get_dests *)arg; 3139 size = struct_size(get, entrytable, get->num_dests); 3140 if (*len != size) { 3141 pr_err("length: %u != %zu\n", *len, size); 3142 ret = -EINVAL; 3143 goto out; 3144 } 3145 ret = __ip_vs_get_dest_entries(ipvs, get, user); 3146 } 3147 break; 3148 3149 case IP_VS_SO_GET_TIMEOUT: 3150 { 3151 struct ip_vs_timeout_user t; 3152 3153 __ip_vs_get_timeouts(ipvs, &t); 3154 if (copy_to_user(user, &t, sizeof(t)) != 0) 3155 ret = -EFAULT; 3156 } 3157 break; 3158 3159 default: 3160 ret = -EINVAL; 3161 } 3162 3163 out: 3164 mutex_unlock(&__ip_vs_mutex); 3165 return ret; 3166 } 3167 3168 3169 static struct nf_sockopt_ops ip_vs_sockopts = { 3170 .pf = PF_INET, 3171 .set_optmin = IP_VS_BASE_CTL, 3172 .set_optmax = IP_VS_SO_SET_MAX+1, 3173 .set = do_ip_vs_set_ctl, 3174 .get_optmin = IP_VS_BASE_CTL, 3175 .get_optmax = IP_VS_SO_GET_MAX+1, 3176 .get = do_ip_vs_get_ctl, 3177 .owner = THIS_MODULE, 3178 }; 3179 3180 /* 3181 * Generic Netlink interface 3182 */ 3183 3184 /* IPVS genetlink family */ 3185 static struct genl_family ip_vs_genl_family; 3186 3187 /* Policy used for first-level command attributes */ 3188 static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = { 3189 [IPVS_CMD_ATTR_SERVICE] = { .type = NLA_NESTED }, 3190 [IPVS_CMD_ATTR_DEST] = { .type = NLA_NESTED }, 3191 [IPVS_CMD_ATTR_DAEMON] = { .type = NLA_NESTED }, 3192 [IPVS_CMD_ATTR_TIMEOUT_TCP] = { .type = NLA_U32 }, 3193 [IPVS_CMD_ATTR_TIMEOUT_TCP_FIN] = { .type = NLA_U32 }, 3194 [IPVS_CMD_ATTR_TIMEOUT_UDP] = { .type = NLA_U32 }, 3195 }; 3196 3197 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DAEMON */ 3198 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = { 3199 [IPVS_DAEMON_ATTR_STATE] = { .type = NLA_U32 }, 3200 [IPVS_DAEMON_ATTR_MCAST_IFN] = { .type = NLA_NUL_STRING, 3201 .len = IP_VS_IFNAME_MAXLEN - 1 }, 3202 [IPVS_DAEMON_ATTR_SYNC_ID] = { .type = NLA_U32 }, 3203 [IPVS_DAEMON_ATTR_SYNC_MAXLEN] = { .type = NLA_U16 }, 3204 [IPVS_DAEMON_ATTR_MCAST_GROUP] = { .type = NLA_U32 }, 3205 [IPVS_DAEMON_ATTR_MCAST_GROUP6] = { .len = sizeof(struct in6_addr) }, 3206 [IPVS_DAEMON_ATTR_MCAST_PORT] = { .type = NLA_U16 }, 3207 [IPVS_DAEMON_ATTR_MCAST_TTL] = { .type = NLA_U8 }, 3208 }; 3209 3210 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_SERVICE */ 3211 static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = { 3212 [IPVS_SVC_ATTR_AF] = { .type = NLA_U16 }, 3213 [IPVS_SVC_ATTR_PROTOCOL] = { .type = NLA_U16 }, 3214 [IPVS_SVC_ATTR_ADDR] = { .type = NLA_BINARY, 3215 .len = sizeof(union nf_inet_addr) }, 3216 [IPVS_SVC_ATTR_PORT] = { .type = NLA_U16 }, 3217 [IPVS_SVC_ATTR_FWMARK] = { .type = NLA_U32 }, 3218 [IPVS_SVC_ATTR_SCHED_NAME] = { .type = NLA_NUL_STRING, 3219 .len = IP_VS_SCHEDNAME_MAXLEN - 1 }, 3220 [IPVS_SVC_ATTR_PE_NAME] = { .type = NLA_NUL_STRING, 3221 .len = IP_VS_PENAME_MAXLEN }, 3222 [IPVS_SVC_ATTR_FLAGS] = { .type = NLA_BINARY, 3223 .len = sizeof(struct ip_vs_flags) }, 3224 [IPVS_SVC_ATTR_TIMEOUT] = { .type = NLA_U32 }, 3225 [IPVS_SVC_ATTR_NETMASK] = { .type = NLA_U32 }, 3226 [IPVS_SVC_ATTR_STATS] = { .type = NLA_NESTED }, 3227 }; 3228 3229 /* Policy used for attributes in nested attribute IPVS_CMD_ATTR_DEST */ 3230 static const struct nla_policy ip_vs_dest_policy[IPVS_DEST_ATTR_MAX + 1] = { 3231 [IPVS_DEST_ATTR_ADDR] = { .type = NLA_BINARY, 3232 .len = sizeof(union nf_inet_addr) }, 3233 [IPVS_DEST_ATTR_PORT] = { .type = NLA_U16 }, 3234 [IPVS_DEST_ATTR_FWD_METHOD] = { .type = NLA_U32 }, 3235 [IPVS_DEST_ATTR_WEIGHT] = { .type = NLA_U32 }, 3236 [IPVS_DEST_ATTR_U_THRESH] = { .type = NLA_U32 }, 3237 [IPVS_DEST_ATTR_L_THRESH] = { .type = NLA_U32 }, 3238 [IPVS_DEST_ATTR_ACTIVE_CONNS] = { .type = NLA_U32 }, 3239 [IPVS_DEST_ATTR_INACT_CONNS] = { .type = NLA_U32 }, 3240 [IPVS_DEST_ATTR_PERSIST_CONNS] = { .type = NLA_U32 }, 3241 [IPVS_DEST_ATTR_STATS] = { .type = NLA_NESTED }, 3242 [IPVS_DEST_ATTR_ADDR_FAMILY] = { .type = NLA_U16 }, 3243 [IPVS_DEST_ATTR_TUN_TYPE] = { .type = NLA_U8 }, 3244 [IPVS_DEST_ATTR_TUN_PORT] = { .type = NLA_U16 }, 3245 [IPVS_DEST_ATTR_TUN_FLAGS] = { .type = NLA_U16 }, 3246 }; 3247 3248 static int ip_vs_genl_fill_stats(struct sk_buff *skb, int container_type, 3249 struct ip_vs_kstats *kstats) 3250 { 3251 struct nlattr *nl_stats = nla_nest_start_noflag(skb, container_type); 3252 3253 if (!nl_stats) 3254 return -EMSGSIZE; 3255 3256 if (nla_put_u32(skb, IPVS_STATS_ATTR_CONNS, (u32)kstats->conns) || 3257 nla_put_u32(skb, IPVS_STATS_ATTR_INPKTS, (u32)kstats->inpkts) || 3258 nla_put_u32(skb, IPVS_STATS_ATTR_OUTPKTS, (u32)kstats->outpkts) || 3259 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBYTES, kstats->inbytes, 3260 IPVS_STATS_ATTR_PAD) || 3261 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBYTES, kstats->outbytes, 3262 IPVS_STATS_ATTR_PAD) || 3263 nla_put_u32(skb, IPVS_STATS_ATTR_CPS, (u32)kstats->cps) || 3264 nla_put_u32(skb, IPVS_STATS_ATTR_INPPS, (u32)kstats->inpps) || 3265 nla_put_u32(skb, IPVS_STATS_ATTR_OUTPPS, (u32)kstats->outpps) || 3266 nla_put_u32(skb, IPVS_STATS_ATTR_INBPS, (u32)kstats->inbps) || 3267 nla_put_u32(skb, IPVS_STATS_ATTR_OUTBPS, (u32)kstats->outbps)) 3268 goto nla_put_failure; 3269 nla_nest_end(skb, nl_stats); 3270 3271 return 0; 3272 3273 nla_put_failure: 3274 nla_nest_cancel(skb, nl_stats); 3275 return -EMSGSIZE; 3276 } 3277 3278 static int ip_vs_genl_fill_stats64(struct sk_buff *skb, int container_type, 3279 struct ip_vs_kstats *kstats) 3280 { 3281 struct nlattr *nl_stats = nla_nest_start_noflag(skb, container_type); 3282 3283 if (!nl_stats) 3284 return -EMSGSIZE; 3285 3286 if (nla_put_u64_64bit(skb, IPVS_STATS_ATTR_CONNS, kstats->conns, 3287 IPVS_STATS_ATTR_PAD) || 3288 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INPKTS, kstats->inpkts, 3289 IPVS_STATS_ATTR_PAD) || 3290 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTPKTS, kstats->outpkts, 3291 IPVS_STATS_ATTR_PAD) || 3292 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBYTES, kstats->inbytes, 3293 IPVS_STATS_ATTR_PAD) || 3294 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBYTES, kstats->outbytes, 3295 IPVS_STATS_ATTR_PAD) || 3296 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_CPS, kstats->cps, 3297 IPVS_STATS_ATTR_PAD) || 3298 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INPPS, kstats->inpps, 3299 IPVS_STATS_ATTR_PAD) || 3300 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTPPS, kstats->outpps, 3301 IPVS_STATS_ATTR_PAD) || 3302 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_INBPS, kstats->inbps, 3303 IPVS_STATS_ATTR_PAD) || 3304 nla_put_u64_64bit(skb, IPVS_STATS_ATTR_OUTBPS, kstats->outbps, 3305 IPVS_STATS_ATTR_PAD)) 3306 goto nla_put_failure; 3307 nla_nest_end(skb, nl_stats); 3308 3309 return 0; 3310 3311 nla_put_failure: 3312 nla_nest_cancel(skb, nl_stats); 3313 return -EMSGSIZE; 3314 } 3315 3316 static int ip_vs_genl_fill_service(struct sk_buff *skb, 3317 struct ip_vs_service *svc) 3318 { 3319 struct ip_vs_scheduler *sched; 3320 struct ip_vs_pe *pe; 3321 struct nlattr *nl_service; 3322 struct ip_vs_flags flags = { .flags = svc->flags, 3323 .mask = ~0 }; 3324 struct ip_vs_kstats kstats; 3325 char *sched_name; 3326 3327 nl_service = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_SERVICE); 3328 if (!nl_service) 3329 return -EMSGSIZE; 3330 3331 if (nla_put_u16(skb, IPVS_SVC_ATTR_AF, svc->af)) 3332 goto nla_put_failure; 3333 if (svc->fwmark) { 3334 if (nla_put_u32(skb, IPVS_SVC_ATTR_FWMARK, svc->fwmark)) 3335 goto nla_put_failure; 3336 } else { 3337 if (nla_put_u16(skb, IPVS_SVC_ATTR_PROTOCOL, svc->protocol) || 3338 nla_put(skb, IPVS_SVC_ATTR_ADDR, sizeof(svc->addr), &svc->addr) || 3339 nla_put_be16(skb, IPVS_SVC_ATTR_PORT, svc->port)) 3340 goto nla_put_failure; 3341 } 3342 3343 sched = rcu_dereference_protected(svc->scheduler, 1); 3344 sched_name = sched ? sched->name : "none"; 3345 pe = rcu_dereference_protected(svc->pe, 1); 3346 if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) || 3347 (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) || 3348 nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) || 3349 nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) || 3350 nla_put_be32(skb, IPVS_SVC_ATTR_NETMASK, svc->netmask)) 3351 goto nla_put_failure; 3352 ip_vs_copy_stats(&kstats, &svc->stats); 3353 if (ip_vs_genl_fill_stats(skb, IPVS_SVC_ATTR_STATS, &kstats)) 3354 goto nla_put_failure; 3355 if (ip_vs_genl_fill_stats64(skb, IPVS_SVC_ATTR_STATS64, &kstats)) 3356 goto nla_put_failure; 3357 3358 nla_nest_end(skb, nl_service); 3359 3360 return 0; 3361 3362 nla_put_failure: 3363 nla_nest_cancel(skb, nl_service); 3364 return -EMSGSIZE; 3365 } 3366 3367 static int ip_vs_genl_dump_service(struct sk_buff *skb, 3368 struct ip_vs_service *svc, 3369 struct netlink_callback *cb) 3370 { 3371 void *hdr; 3372 3373 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, 3374 &ip_vs_genl_family, NLM_F_MULTI, 3375 IPVS_CMD_NEW_SERVICE); 3376 if (!hdr) 3377 return -EMSGSIZE; 3378 3379 if (ip_vs_genl_fill_service(skb, svc) < 0) 3380 goto nla_put_failure; 3381 3382 genlmsg_end(skb, hdr); 3383 return 0; 3384 3385 nla_put_failure: 3386 genlmsg_cancel(skb, hdr); 3387 return -EMSGSIZE; 3388 } 3389 3390 static int ip_vs_genl_dump_services(struct sk_buff *skb, 3391 struct netlink_callback *cb) 3392 { 3393 int idx = 0, i; 3394 int start = cb->args[0]; 3395 struct ip_vs_service *svc; 3396 struct net *net = sock_net(skb->sk); 3397 struct netns_ipvs *ipvs = net_ipvs(net); 3398 3399 mutex_lock(&__ip_vs_mutex); 3400 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) { 3401 hlist_for_each_entry(svc, &ip_vs_svc_table[i], s_list) { 3402 if (++idx <= start || (svc->ipvs != ipvs)) 3403 continue; 3404 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) { 3405 idx--; 3406 goto nla_put_failure; 3407 } 3408 } 3409 } 3410 3411 for (i = 0; i < IP_VS_SVC_TAB_SIZE; i++) { 3412 hlist_for_each_entry(svc, &ip_vs_svc_fwm_table[i], f_list) { 3413 if (++idx <= start || (svc->ipvs != ipvs)) 3414 continue; 3415 if (ip_vs_genl_dump_service(skb, svc, cb) < 0) { 3416 idx--; 3417 goto nla_put_failure; 3418 } 3419 } 3420 } 3421 3422 nla_put_failure: 3423 mutex_unlock(&__ip_vs_mutex); 3424 cb->args[0] = idx; 3425 3426 return skb->len; 3427 } 3428 3429 static bool ip_vs_is_af_valid(int af) 3430 { 3431 if (af == AF_INET) 3432 return true; 3433 #ifdef CONFIG_IP_VS_IPV6 3434 if (af == AF_INET6 && ipv6_mod_enabled()) 3435 return true; 3436 #endif 3437 return false; 3438 } 3439 3440 static int ip_vs_genl_parse_service(struct netns_ipvs *ipvs, 3441 struct ip_vs_service_user_kern *usvc, 3442 struct nlattr *nla, bool full_entry, 3443 struct ip_vs_service **ret_svc) 3444 { 3445 struct nlattr *attrs[IPVS_SVC_ATTR_MAX + 1]; 3446 struct nlattr *nla_af, *nla_port, *nla_fwmark, *nla_protocol, *nla_addr; 3447 struct ip_vs_service *svc; 3448 3449 /* Parse mandatory identifying service fields first */ 3450 if (nla == NULL || 3451 nla_parse_nested_deprecated(attrs, IPVS_SVC_ATTR_MAX, nla, ip_vs_svc_policy, NULL)) 3452 return -EINVAL; 3453 3454 nla_af = attrs[IPVS_SVC_ATTR_AF]; 3455 nla_protocol = attrs[IPVS_SVC_ATTR_PROTOCOL]; 3456 nla_addr = attrs[IPVS_SVC_ATTR_ADDR]; 3457 nla_port = attrs[IPVS_SVC_ATTR_PORT]; 3458 nla_fwmark = attrs[IPVS_SVC_ATTR_FWMARK]; 3459 3460 if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr)))) 3461 return -EINVAL; 3462 3463 memset(usvc, 0, sizeof(*usvc)); 3464 3465 usvc->af = nla_get_u16(nla_af); 3466 if (!ip_vs_is_af_valid(usvc->af)) 3467 return -EAFNOSUPPORT; 3468 3469 if (nla_fwmark) { 3470 usvc->protocol = IPPROTO_TCP; 3471 usvc->fwmark = nla_get_u32(nla_fwmark); 3472 } else { 3473 usvc->protocol = nla_get_u16(nla_protocol); 3474 nla_memcpy(&usvc->addr, nla_addr, sizeof(usvc->addr)); 3475 usvc->port = nla_get_be16(nla_port); 3476 usvc->fwmark = 0; 3477 } 3478 3479 rcu_read_lock(); 3480 if (usvc->fwmark) 3481 svc = __ip_vs_svc_fwm_find(ipvs, usvc->af, usvc->fwmark); 3482 else 3483 svc = __ip_vs_service_find(ipvs, usvc->af, usvc->protocol, 3484 &usvc->addr, usvc->port); 3485 rcu_read_unlock(); 3486 *ret_svc = svc; 3487 3488 /* If a full entry was requested, check for the additional fields */ 3489 if (full_entry) { 3490 struct nlattr *nla_sched, *nla_flags, *nla_pe, *nla_timeout, 3491 *nla_netmask; 3492 struct ip_vs_flags flags; 3493 3494 nla_sched = attrs[IPVS_SVC_ATTR_SCHED_NAME]; 3495 nla_pe = attrs[IPVS_SVC_ATTR_PE_NAME]; 3496 nla_flags = attrs[IPVS_SVC_ATTR_FLAGS]; 3497 nla_timeout = attrs[IPVS_SVC_ATTR_TIMEOUT]; 3498 nla_netmask = attrs[IPVS_SVC_ATTR_NETMASK]; 3499 3500 if (!(nla_sched && nla_flags && nla_timeout && nla_netmask)) 3501 return -EINVAL; 3502 3503 nla_memcpy(&flags, nla_flags, sizeof(flags)); 3504 3505 /* prefill flags from service if it already exists */ 3506 if (svc) 3507 usvc->flags = svc->flags; 3508 3509 /* set new flags from userland */ 3510 usvc->flags = (usvc->flags & ~flags.mask) | 3511 (flags.flags & flags.mask); 3512 usvc->sched_name = nla_data(nla_sched); 3513 usvc->pe_name = nla_pe ? nla_data(nla_pe) : NULL; 3514 usvc->timeout = nla_get_u32(nla_timeout); 3515 usvc->netmask = nla_get_be32(nla_netmask); 3516 } 3517 3518 return 0; 3519 } 3520 3521 static struct ip_vs_service *ip_vs_genl_find_service(struct netns_ipvs *ipvs, 3522 struct nlattr *nla) 3523 { 3524 struct ip_vs_service_user_kern usvc; 3525 struct ip_vs_service *svc; 3526 int ret; 3527 3528 ret = ip_vs_genl_parse_service(ipvs, &usvc, nla, false, &svc); 3529 return ret ? ERR_PTR(ret) : svc; 3530 } 3531 3532 static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest) 3533 { 3534 struct nlattr *nl_dest; 3535 struct ip_vs_kstats kstats; 3536 3537 nl_dest = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_DEST); 3538 if (!nl_dest) 3539 return -EMSGSIZE; 3540 3541 if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) || 3542 nla_put_be16(skb, IPVS_DEST_ATTR_PORT, dest->port) || 3543 nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD, 3544 (atomic_read(&dest->conn_flags) & 3545 IP_VS_CONN_F_FWD_MASK)) || 3546 nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT, 3547 atomic_read(&dest->weight)) || 3548 nla_put_u8(skb, IPVS_DEST_ATTR_TUN_TYPE, 3549 dest->tun_type) || 3550 nla_put_be16(skb, IPVS_DEST_ATTR_TUN_PORT, 3551 dest->tun_port) || 3552 nla_put_u16(skb, IPVS_DEST_ATTR_TUN_FLAGS, 3553 dest->tun_flags) || 3554 nla_put_u32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold) || 3555 nla_put_u32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold) || 3556 nla_put_u32(skb, IPVS_DEST_ATTR_ACTIVE_CONNS, 3557 atomic_read(&dest->activeconns)) || 3558 nla_put_u32(skb, IPVS_DEST_ATTR_INACT_CONNS, 3559 atomic_read(&dest->inactconns)) || 3560 nla_put_u32(skb, IPVS_DEST_ATTR_PERSIST_CONNS, 3561 atomic_read(&dest->persistconns)) || 3562 nla_put_u16(skb, IPVS_DEST_ATTR_ADDR_FAMILY, dest->af)) 3563 goto nla_put_failure; 3564 ip_vs_copy_stats(&kstats, &dest->stats); 3565 if (ip_vs_genl_fill_stats(skb, IPVS_DEST_ATTR_STATS, &kstats)) 3566 goto nla_put_failure; 3567 if (ip_vs_genl_fill_stats64(skb, IPVS_DEST_ATTR_STATS64, &kstats)) 3568 goto nla_put_failure; 3569 3570 nla_nest_end(skb, nl_dest); 3571 3572 return 0; 3573 3574 nla_put_failure: 3575 nla_nest_cancel(skb, nl_dest); 3576 return -EMSGSIZE; 3577 } 3578 3579 static int ip_vs_genl_dump_dest(struct sk_buff *skb, struct ip_vs_dest *dest, 3580 struct netlink_callback *cb) 3581 { 3582 void *hdr; 3583 3584 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, 3585 &ip_vs_genl_family, NLM_F_MULTI, 3586 IPVS_CMD_NEW_DEST); 3587 if (!hdr) 3588 return -EMSGSIZE; 3589 3590 if (ip_vs_genl_fill_dest(skb, dest) < 0) 3591 goto nla_put_failure; 3592 3593 genlmsg_end(skb, hdr); 3594 return 0; 3595 3596 nla_put_failure: 3597 genlmsg_cancel(skb, hdr); 3598 return -EMSGSIZE; 3599 } 3600 3601 static int ip_vs_genl_dump_dests(struct sk_buff *skb, 3602 struct netlink_callback *cb) 3603 { 3604 int idx = 0; 3605 int start = cb->args[0]; 3606 struct ip_vs_service *svc; 3607 struct ip_vs_dest *dest; 3608 struct nlattr *attrs[IPVS_CMD_ATTR_MAX + 1]; 3609 struct net *net = sock_net(skb->sk); 3610 struct netns_ipvs *ipvs = net_ipvs(net); 3611 3612 mutex_lock(&__ip_vs_mutex); 3613 3614 /* Try to find the service for which to dump destinations */ 3615 if (nlmsg_parse_deprecated(cb->nlh, GENL_HDRLEN, attrs, IPVS_CMD_ATTR_MAX, ip_vs_cmd_policy, cb->extack)) 3616 goto out_err; 3617 3618 3619 svc = ip_vs_genl_find_service(ipvs, attrs[IPVS_CMD_ATTR_SERVICE]); 3620 if (IS_ERR_OR_NULL(svc)) 3621 goto out_err; 3622 3623 /* Dump the destinations */ 3624 list_for_each_entry(dest, &svc->destinations, n_list) { 3625 if (++idx <= start) 3626 continue; 3627 if (ip_vs_genl_dump_dest(skb, dest, cb) < 0) { 3628 idx--; 3629 goto nla_put_failure; 3630 } 3631 } 3632 3633 nla_put_failure: 3634 cb->args[0] = idx; 3635 3636 out_err: 3637 mutex_unlock(&__ip_vs_mutex); 3638 3639 return skb->len; 3640 } 3641 3642 static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest, 3643 struct nlattr *nla, bool full_entry) 3644 { 3645 struct nlattr *attrs[IPVS_DEST_ATTR_MAX + 1]; 3646 struct nlattr *nla_addr, *nla_port; 3647 struct nlattr *nla_addr_family; 3648 3649 /* Parse mandatory identifying destination fields first */ 3650 if (nla == NULL || 3651 nla_parse_nested_deprecated(attrs, IPVS_DEST_ATTR_MAX, nla, ip_vs_dest_policy, NULL)) 3652 return -EINVAL; 3653 3654 nla_addr = attrs[IPVS_DEST_ATTR_ADDR]; 3655 nla_port = attrs[IPVS_DEST_ATTR_PORT]; 3656 nla_addr_family = attrs[IPVS_DEST_ATTR_ADDR_FAMILY]; 3657 3658 if (!(nla_addr && nla_port)) 3659 return -EINVAL; 3660 3661 memset(udest, 0, sizeof(*udest)); 3662 3663 nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr)); 3664 udest->port = nla_get_be16(nla_port); 3665 3666 udest->af = nla_get_u16_default(nla_addr_family, 0); 3667 3668 /* If a full entry was requested, check for the additional fields */ 3669 if (full_entry) { 3670 struct nlattr *nla_fwd, *nla_weight, *nla_u_thresh, 3671 *nla_l_thresh, *nla_tun_type, *nla_tun_port, 3672 *nla_tun_flags; 3673 3674 nla_fwd = attrs[IPVS_DEST_ATTR_FWD_METHOD]; 3675 nla_weight = attrs[IPVS_DEST_ATTR_WEIGHT]; 3676 nla_u_thresh = attrs[IPVS_DEST_ATTR_U_THRESH]; 3677 nla_l_thresh = attrs[IPVS_DEST_ATTR_L_THRESH]; 3678 nla_tun_type = attrs[IPVS_DEST_ATTR_TUN_TYPE]; 3679 nla_tun_port = attrs[IPVS_DEST_ATTR_TUN_PORT]; 3680 nla_tun_flags = attrs[IPVS_DEST_ATTR_TUN_FLAGS]; 3681 3682 if (!(nla_fwd && nla_weight && nla_u_thresh && nla_l_thresh)) 3683 return -EINVAL; 3684 3685 udest->conn_flags = nla_get_u32(nla_fwd) 3686 & IP_VS_CONN_F_FWD_MASK; 3687 udest->weight = nla_get_u32(nla_weight); 3688 udest->u_threshold = nla_get_u32(nla_u_thresh); 3689 udest->l_threshold = nla_get_u32(nla_l_thresh); 3690 3691 if (nla_tun_type) 3692 udest->tun_type = nla_get_u8(nla_tun_type); 3693 3694 if (nla_tun_port) 3695 udest->tun_port = nla_get_be16(nla_tun_port); 3696 3697 if (nla_tun_flags) 3698 udest->tun_flags = nla_get_u16(nla_tun_flags); 3699 } 3700 3701 return 0; 3702 } 3703 3704 static int ip_vs_genl_fill_daemon(struct sk_buff *skb, __u32 state, 3705 struct ipvs_sync_daemon_cfg *c) 3706 { 3707 struct nlattr *nl_daemon; 3708 3709 nl_daemon = nla_nest_start_noflag(skb, IPVS_CMD_ATTR_DAEMON); 3710 if (!nl_daemon) 3711 return -EMSGSIZE; 3712 3713 if (nla_put_u32(skb, IPVS_DAEMON_ATTR_STATE, state) || 3714 nla_put_string(skb, IPVS_DAEMON_ATTR_MCAST_IFN, c->mcast_ifn) || 3715 nla_put_u32(skb, IPVS_DAEMON_ATTR_SYNC_ID, c->syncid) || 3716 nla_put_u16(skb, IPVS_DAEMON_ATTR_SYNC_MAXLEN, c->sync_maxlen) || 3717 nla_put_u16(skb, IPVS_DAEMON_ATTR_MCAST_PORT, c->mcast_port) || 3718 nla_put_u8(skb, IPVS_DAEMON_ATTR_MCAST_TTL, c->mcast_ttl)) 3719 goto nla_put_failure; 3720 #ifdef CONFIG_IP_VS_IPV6 3721 if (c->mcast_af == AF_INET6) { 3722 if (nla_put_in6_addr(skb, IPVS_DAEMON_ATTR_MCAST_GROUP6, 3723 &c->mcast_group.in6)) 3724 goto nla_put_failure; 3725 } else 3726 #endif 3727 if (c->mcast_af == AF_INET && 3728 nla_put_in_addr(skb, IPVS_DAEMON_ATTR_MCAST_GROUP, 3729 c->mcast_group.ip)) 3730 goto nla_put_failure; 3731 nla_nest_end(skb, nl_daemon); 3732 3733 return 0; 3734 3735 nla_put_failure: 3736 nla_nest_cancel(skb, nl_daemon); 3737 return -EMSGSIZE; 3738 } 3739 3740 static int ip_vs_genl_dump_daemon(struct sk_buff *skb, __u32 state, 3741 struct ipvs_sync_daemon_cfg *c, 3742 struct netlink_callback *cb) 3743 { 3744 void *hdr; 3745 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, 3746 &ip_vs_genl_family, NLM_F_MULTI, 3747 IPVS_CMD_NEW_DAEMON); 3748 if (!hdr) 3749 return -EMSGSIZE; 3750 3751 if (ip_vs_genl_fill_daemon(skb, state, c)) 3752 goto nla_put_failure; 3753 3754 genlmsg_end(skb, hdr); 3755 return 0; 3756 3757 nla_put_failure: 3758 genlmsg_cancel(skb, hdr); 3759 return -EMSGSIZE; 3760 } 3761 3762 static int ip_vs_genl_dump_daemons(struct sk_buff *skb, 3763 struct netlink_callback *cb) 3764 { 3765 struct net *net = sock_net(skb->sk); 3766 struct netns_ipvs *ipvs = net_ipvs(net); 3767 3768 mutex_lock(&ipvs->sync_mutex); 3769 if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) { 3770 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER, 3771 &ipvs->mcfg, cb) < 0) 3772 goto nla_put_failure; 3773 3774 cb->args[0] = 1; 3775 } 3776 3777 if ((ipvs->sync_state & IP_VS_STATE_BACKUP) && !cb->args[1]) { 3778 if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_BACKUP, 3779 &ipvs->bcfg, cb) < 0) 3780 goto nla_put_failure; 3781 3782 cb->args[1] = 1; 3783 } 3784 3785 nla_put_failure: 3786 mutex_unlock(&ipvs->sync_mutex); 3787 3788 return skb->len; 3789 } 3790 3791 static int ip_vs_genl_new_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs) 3792 { 3793 struct ipvs_sync_daemon_cfg c; 3794 struct nlattr *a; 3795 int ret; 3796 3797 memset(&c, 0, sizeof(c)); 3798 if (!(attrs[IPVS_DAEMON_ATTR_STATE] && 3799 attrs[IPVS_DAEMON_ATTR_MCAST_IFN] && 3800 attrs[IPVS_DAEMON_ATTR_SYNC_ID])) 3801 return -EINVAL; 3802 strscpy(c.mcast_ifn, nla_data(attrs[IPVS_DAEMON_ATTR_MCAST_IFN]), 3803 sizeof(c.mcast_ifn)); 3804 c.syncid = nla_get_u32(attrs[IPVS_DAEMON_ATTR_SYNC_ID]); 3805 3806 a = attrs[IPVS_DAEMON_ATTR_SYNC_MAXLEN]; 3807 if (a) 3808 c.sync_maxlen = nla_get_u16(a); 3809 3810 a = attrs[IPVS_DAEMON_ATTR_MCAST_GROUP]; 3811 if (a) { 3812 c.mcast_af = AF_INET; 3813 c.mcast_group.ip = nla_get_in_addr(a); 3814 if (!ipv4_is_multicast(c.mcast_group.ip)) 3815 return -EINVAL; 3816 } else { 3817 a = attrs[IPVS_DAEMON_ATTR_MCAST_GROUP6]; 3818 if (a) { 3819 #ifdef CONFIG_IP_VS_IPV6 3820 int addr_type; 3821 3822 c.mcast_af = AF_INET6; 3823 c.mcast_group.in6 = nla_get_in6_addr(a); 3824 addr_type = ipv6_addr_type(&c.mcast_group.in6); 3825 if (!(addr_type & IPV6_ADDR_MULTICAST)) 3826 return -EINVAL; 3827 #else 3828 return -EAFNOSUPPORT; 3829 #endif 3830 } 3831 } 3832 3833 a = attrs[IPVS_DAEMON_ATTR_MCAST_PORT]; 3834 if (a) 3835 c.mcast_port = nla_get_u16(a); 3836 3837 a = attrs[IPVS_DAEMON_ATTR_MCAST_TTL]; 3838 if (a) 3839 c.mcast_ttl = nla_get_u8(a); 3840 3841 /* The synchronization protocol is incompatible with mixed family 3842 * services 3843 */ 3844 if (ipvs->mixed_address_family_dests > 0) 3845 return -EINVAL; 3846 3847 ret = start_sync_thread(ipvs, &c, 3848 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE])); 3849 return ret; 3850 } 3851 3852 static int ip_vs_genl_del_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs) 3853 { 3854 int ret; 3855 3856 if (!attrs[IPVS_DAEMON_ATTR_STATE]) 3857 return -EINVAL; 3858 3859 ret = stop_sync_thread(ipvs, 3860 nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE])); 3861 return ret; 3862 } 3863 3864 static int ip_vs_genl_set_config(struct netns_ipvs *ipvs, struct nlattr **attrs) 3865 { 3866 struct ip_vs_timeout_user t; 3867 3868 __ip_vs_get_timeouts(ipvs, &t); 3869 3870 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]) 3871 t.tcp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP]); 3872 3873 if (attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]) 3874 t.tcp_fin_timeout = 3875 nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_TCP_FIN]); 3876 3877 if (attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]) 3878 t.udp_timeout = nla_get_u32(attrs[IPVS_CMD_ATTR_TIMEOUT_UDP]); 3879 3880 return ip_vs_set_timeout(ipvs, &t); 3881 } 3882 3883 static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info) 3884 { 3885 int ret = -EINVAL, cmd; 3886 struct net *net = sock_net(skb->sk); 3887 struct netns_ipvs *ipvs = net_ipvs(net); 3888 3889 cmd = info->genlhdr->cmd; 3890 3891 if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) { 3892 struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1]; 3893 3894 if (!info->attrs[IPVS_CMD_ATTR_DAEMON] || 3895 nla_parse_nested_deprecated(daemon_attrs, IPVS_DAEMON_ATTR_MAX, info->attrs[IPVS_CMD_ATTR_DAEMON], ip_vs_daemon_policy, info->extack)) 3896 goto out; 3897 3898 if (cmd == IPVS_CMD_NEW_DAEMON) 3899 ret = ip_vs_genl_new_daemon(ipvs, daemon_attrs); 3900 else 3901 ret = ip_vs_genl_del_daemon(ipvs, daemon_attrs); 3902 } 3903 3904 out: 3905 return ret; 3906 } 3907 3908 static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info) 3909 { 3910 bool need_full_svc = false, need_full_dest = false; 3911 struct ip_vs_service *svc = NULL; 3912 struct ip_vs_service_user_kern usvc; 3913 struct ip_vs_dest_user_kern udest; 3914 int ret = 0, cmd; 3915 struct net *net = sock_net(skb->sk); 3916 struct netns_ipvs *ipvs = net_ipvs(net); 3917 3918 cmd = info->genlhdr->cmd; 3919 3920 mutex_lock(&__ip_vs_mutex); 3921 3922 if (cmd == IPVS_CMD_FLUSH) { 3923 ret = ip_vs_flush(ipvs, false); 3924 goto out; 3925 } else if (cmd == IPVS_CMD_SET_CONFIG) { 3926 ret = ip_vs_genl_set_config(ipvs, info->attrs); 3927 goto out; 3928 } else if (cmd == IPVS_CMD_ZERO && 3929 !info->attrs[IPVS_CMD_ATTR_SERVICE]) { 3930 ret = ip_vs_zero_all(ipvs); 3931 goto out; 3932 } 3933 3934 /* All following commands require a service argument, so check if we 3935 * received a valid one. We need a full service specification when 3936 * adding / editing a service. Only identifying members otherwise. */ 3937 if (cmd == IPVS_CMD_NEW_SERVICE || cmd == IPVS_CMD_SET_SERVICE) 3938 need_full_svc = true; 3939 3940 ret = ip_vs_genl_parse_service(ipvs, &usvc, 3941 info->attrs[IPVS_CMD_ATTR_SERVICE], 3942 need_full_svc, &svc); 3943 if (ret) 3944 goto out; 3945 3946 /* Unless we're adding a new service, the service must already exist */ 3947 if ((cmd != IPVS_CMD_NEW_SERVICE) && (svc == NULL)) { 3948 ret = -ESRCH; 3949 goto out; 3950 } 3951 3952 /* Destination commands require a valid destination argument. For 3953 * adding / editing a destination, we need a full destination 3954 * specification. */ 3955 if (cmd == IPVS_CMD_NEW_DEST || cmd == IPVS_CMD_SET_DEST || 3956 cmd == IPVS_CMD_DEL_DEST) { 3957 if (cmd != IPVS_CMD_DEL_DEST) 3958 need_full_dest = true; 3959 3960 ret = ip_vs_genl_parse_dest(&udest, 3961 info->attrs[IPVS_CMD_ATTR_DEST], 3962 need_full_dest); 3963 if (ret) 3964 goto out; 3965 3966 /* Old protocols did not allow the user to specify address 3967 * family, so we set it to zero instead. We also didn't 3968 * allow heterogeneous pools in the old code, so it's safe 3969 * to assume that this will have the same address family as 3970 * the service. 3971 */ 3972 if (udest.af == 0) 3973 udest.af = svc->af; 3974 3975 if (!ip_vs_is_af_valid(udest.af)) { 3976 ret = -EAFNOSUPPORT; 3977 goto out; 3978 } 3979 3980 if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) { 3981 /* The synchronization protocol is incompatible 3982 * with mixed family services 3983 */ 3984 if (ipvs->sync_state) { 3985 ret = -EINVAL; 3986 goto out; 3987 } 3988 3989 /* Which connection types do we support? */ 3990 switch (udest.conn_flags) { 3991 case IP_VS_CONN_F_TUNNEL: 3992 /* We are able to forward this */ 3993 break; 3994 default: 3995 ret = -EINVAL; 3996 goto out; 3997 } 3998 } 3999 } 4000 4001 switch (cmd) { 4002 case IPVS_CMD_NEW_SERVICE: 4003 if (svc == NULL) 4004 ret = ip_vs_add_service(ipvs, &usvc, &svc); 4005 else 4006 ret = -EEXIST; 4007 break; 4008 case IPVS_CMD_SET_SERVICE: 4009 ret = ip_vs_edit_service(svc, &usvc); 4010 break; 4011 case IPVS_CMD_DEL_SERVICE: 4012 ret = ip_vs_del_service(svc); 4013 /* do not use svc, it can be freed */ 4014 break; 4015 case IPVS_CMD_NEW_DEST: 4016 ret = ip_vs_add_dest(svc, &udest); 4017 break; 4018 case IPVS_CMD_SET_DEST: 4019 ret = ip_vs_edit_dest(svc, &udest); 4020 break; 4021 case IPVS_CMD_DEL_DEST: 4022 ret = ip_vs_del_dest(svc, &udest); 4023 break; 4024 case IPVS_CMD_ZERO: 4025 ret = ip_vs_zero_service(svc); 4026 break; 4027 default: 4028 ret = -EINVAL; 4029 } 4030 4031 out: 4032 mutex_unlock(&__ip_vs_mutex); 4033 4034 return ret; 4035 } 4036 4037 static int ip_vs_genl_get_cmd(struct sk_buff *skb, struct genl_info *info) 4038 { 4039 struct sk_buff *msg; 4040 void *reply; 4041 int ret, cmd, reply_cmd; 4042 struct net *net = sock_net(skb->sk); 4043 struct netns_ipvs *ipvs = net_ipvs(net); 4044 4045 cmd = info->genlhdr->cmd; 4046 4047 if (cmd == IPVS_CMD_GET_SERVICE) 4048 reply_cmd = IPVS_CMD_NEW_SERVICE; 4049 else if (cmd == IPVS_CMD_GET_INFO) 4050 reply_cmd = IPVS_CMD_SET_INFO; 4051 else if (cmd == IPVS_CMD_GET_CONFIG) 4052 reply_cmd = IPVS_CMD_SET_CONFIG; 4053 else { 4054 pr_err("unknown Generic Netlink command\n"); 4055 return -EINVAL; 4056 } 4057 4058 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4059 if (!msg) 4060 return -ENOMEM; 4061 4062 mutex_lock(&__ip_vs_mutex); 4063 4064 reply = genlmsg_put_reply(msg, info, &ip_vs_genl_family, 0, reply_cmd); 4065 if (reply == NULL) 4066 goto nla_put_failure; 4067 4068 switch (cmd) { 4069 case IPVS_CMD_GET_SERVICE: 4070 { 4071 struct ip_vs_service *svc; 4072 4073 svc = ip_vs_genl_find_service(ipvs, 4074 info->attrs[IPVS_CMD_ATTR_SERVICE]); 4075 if (IS_ERR(svc)) { 4076 ret = PTR_ERR(svc); 4077 goto out_err; 4078 } else if (svc) { 4079 ret = ip_vs_genl_fill_service(msg, svc); 4080 if (ret) 4081 goto nla_put_failure; 4082 } else { 4083 ret = -ESRCH; 4084 goto out_err; 4085 } 4086 4087 break; 4088 } 4089 4090 case IPVS_CMD_GET_CONFIG: 4091 { 4092 struct ip_vs_timeout_user t; 4093 4094 __ip_vs_get_timeouts(ipvs, &t); 4095 #ifdef CONFIG_IP_VS_PROTO_TCP 4096 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP, 4097 t.tcp_timeout) || 4098 nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_TCP_FIN, 4099 t.tcp_fin_timeout)) 4100 goto nla_put_failure; 4101 #endif 4102 #ifdef CONFIG_IP_VS_PROTO_UDP 4103 if (nla_put_u32(msg, IPVS_CMD_ATTR_TIMEOUT_UDP, t.udp_timeout)) 4104 goto nla_put_failure; 4105 #endif 4106 4107 break; 4108 } 4109 4110 case IPVS_CMD_GET_INFO: 4111 if (nla_put_u32(msg, IPVS_INFO_ATTR_VERSION, 4112 IP_VS_VERSION_CODE) || 4113 nla_put_u32(msg, IPVS_INFO_ATTR_CONN_TAB_SIZE, 4114 ip_vs_conn_tab_size)) 4115 goto nla_put_failure; 4116 break; 4117 } 4118 4119 genlmsg_end(msg, reply); 4120 ret = genlmsg_reply(msg, info); 4121 goto out; 4122 4123 nla_put_failure: 4124 pr_err("not enough space in Netlink message\n"); 4125 ret = -EMSGSIZE; 4126 4127 out_err: 4128 nlmsg_free(msg); 4129 out: 4130 mutex_unlock(&__ip_vs_mutex); 4131 4132 return ret; 4133 } 4134 4135 4136 static const struct genl_small_ops ip_vs_genl_ops[] = { 4137 { 4138 .cmd = IPVS_CMD_NEW_SERVICE, 4139 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4140 .flags = GENL_ADMIN_PERM, 4141 .doit = ip_vs_genl_set_cmd, 4142 }, 4143 { 4144 .cmd = IPVS_CMD_SET_SERVICE, 4145 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4146 .flags = GENL_ADMIN_PERM, 4147 .doit = ip_vs_genl_set_cmd, 4148 }, 4149 { 4150 .cmd = IPVS_CMD_DEL_SERVICE, 4151 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4152 .flags = GENL_ADMIN_PERM, 4153 .doit = ip_vs_genl_set_cmd, 4154 }, 4155 { 4156 .cmd = IPVS_CMD_GET_SERVICE, 4157 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4158 .flags = GENL_ADMIN_PERM, 4159 .doit = ip_vs_genl_get_cmd, 4160 .dumpit = ip_vs_genl_dump_services, 4161 }, 4162 { 4163 .cmd = IPVS_CMD_NEW_DEST, 4164 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4165 .flags = GENL_ADMIN_PERM, 4166 .doit = ip_vs_genl_set_cmd, 4167 }, 4168 { 4169 .cmd = IPVS_CMD_SET_DEST, 4170 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4171 .flags = GENL_ADMIN_PERM, 4172 .doit = ip_vs_genl_set_cmd, 4173 }, 4174 { 4175 .cmd = IPVS_CMD_DEL_DEST, 4176 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4177 .flags = GENL_ADMIN_PERM, 4178 .doit = ip_vs_genl_set_cmd, 4179 }, 4180 { 4181 .cmd = IPVS_CMD_GET_DEST, 4182 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4183 .flags = GENL_ADMIN_PERM, 4184 .dumpit = ip_vs_genl_dump_dests, 4185 }, 4186 { 4187 .cmd = IPVS_CMD_NEW_DAEMON, 4188 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4189 .flags = GENL_ADMIN_PERM, 4190 .doit = ip_vs_genl_set_daemon, 4191 }, 4192 { 4193 .cmd = IPVS_CMD_DEL_DAEMON, 4194 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4195 .flags = GENL_ADMIN_PERM, 4196 .doit = ip_vs_genl_set_daemon, 4197 }, 4198 { 4199 .cmd = IPVS_CMD_GET_DAEMON, 4200 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4201 .flags = GENL_ADMIN_PERM, 4202 .dumpit = ip_vs_genl_dump_daemons, 4203 }, 4204 { 4205 .cmd = IPVS_CMD_SET_CONFIG, 4206 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4207 .flags = GENL_ADMIN_PERM, 4208 .doit = ip_vs_genl_set_cmd, 4209 }, 4210 { 4211 .cmd = IPVS_CMD_GET_CONFIG, 4212 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4213 .flags = GENL_ADMIN_PERM, 4214 .doit = ip_vs_genl_get_cmd, 4215 }, 4216 { 4217 .cmd = IPVS_CMD_GET_INFO, 4218 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4219 .flags = GENL_ADMIN_PERM, 4220 .doit = ip_vs_genl_get_cmd, 4221 }, 4222 { 4223 .cmd = IPVS_CMD_ZERO, 4224 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4225 .flags = GENL_ADMIN_PERM, 4226 .doit = ip_vs_genl_set_cmd, 4227 }, 4228 { 4229 .cmd = IPVS_CMD_FLUSH, 4230 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 4231 .flags = GENL_ADMIN_PERM, 4232 .doit = ip_vs_genl_set_cmd, 4233 }, 4234 }; 4235 4236 static struct genl_family ip_vs_genl_family __ro_after_init = { 4237 .hdrsize = 0, 4238 .name = IPVS_GENL_NAME, 4239 .version = IPVS_GENL_VERSION, 4240 .maxattr = IPVS_CMD_ATTR_MAX, 4241 .policy = ip_vs_cmd_policy, 4242 .netnsok = true, /* Make ipvsadm to work on netns */ 4243 .module = THIS_MODULE, 4244 .small_ops = ip_vs_genl_ops, 4245 .n_small_ops = ARRAY_SIZE(ip_vs_genl_ops), 4246 .resv_start_op = IPVS_CMD_FLUSH + 1, 4247 }; 4248 4249 static int __init ip_vs_genl_register(void) 4250 { 4251 return genl_register_family(&ip_vs_genl_family); 4252 } 4253 4254 static void ip_vs_genl_unregister(void) 4255 { 4256 genl_unregister_family(&ip_vs_genl_family); 4257 } 4258 4259 /* End of Generic Netlink interface definitions */ 4260 4261 /* 4262 * per netns intit/exit func. 4263 */ 4264 #ifdef CONFIG_SYSCTL 4265 static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) 4266 { 4267 struct net *net = ipvs->net; 4268 struct ctl_table *tbl; 4269 int idx, ret; 4270 size_t ctl_table_size = ARRAY_SIZE(vs_vars); 4271 bool unpriv = net->user_ns != &init_user_ns; 4272 4273 atomic_set(&ipvs->dropentry, 0); 4274 spin_lock_init(&ipvs->dropentry_lock); 4275 spin_lock_init(&ipvs->droppacket_lock); 4276 spin_lock_init(&ipvs->securetcp_lock); 4277 INIT_DELAYED_WORK(&ipvs->defense_work, defense_work_handler); 4278 INIT_DELAYED_WORK(&ipvs->expire_nodest_conn_work, 4279 expire_nodest_conn_handler); 4280 ipvs->est_stopped = 0; 4281 4282 if (!net_eq(net, &init_net)) { 4283 tbl = kmemdup(vs_vars, sizeof(vs_vars), GFP_KERNEL); 4284 if (tbl == NULL) 4285 return -ENOMEM; 4286 } else 4287 tbl = vs_vars; 4288 /* Initialize sysctl defaults */ 4289 for (idx = 0; idx < ARRAY_SIZE(vs_vars); idx++) { 4290 if (tbl[idx].proc_handler == proc_do_defense_mode) 4291 tbl[idx].extra2 = ipvs; 4292 } 4293 idx = 0; 4294 ipvs->sysctl_amemthresh = 1024; 4295 tbl[idx++].data = &ipvs->sysctl_amemthresh; 4296 ipvs->sysctl_am_droprate = 10; 4297 tbl[idx++].data = &ipvs->sysctl_am_droprate; 4298 tbl[idx++].data = &ipvs->sysctl_drop_entry; 4299 tbl[idx++].data = &ipvs->sysctl_drop_packet; 4300 #ifdef CONFIG_IP_VS_NFCT 4301 tbl[idx++].data = &ipvs->sysctl_conntrack; 4302 #endif 4303 tbl[idx++].data = &ipvs->sysctl_secure_tcp; 4304 ipvs->sysctl_snat_reroute = 1; 4305 tbl[idx++].data = &ipvs->sysctl_snat_reroute; 4306 ipvs->sysctl_sync_ver = 1; 4307 tbl[idx++].data = &ipvs->sysctl_sync_ver; 4308 ipvs->sysctl_sync_ports = 1; 4309 tbl[idx++].data = &ipvs->sysctl_sync_ports; 4310 tbl[idx++].data = &ipvs->sysctl_sync_persist_mode; 4311 4312 ipvs->sysctl_sync_qlen_max = nr_free_buffer_pages() / 32; 4313 if (unpriv) 4314 tbl[idx].mode = 0444; 4315 tbl[idx++].data = &ipvs->sysctl_sync_qlen_max; 4316 4317 ipvs->sysctl_sync_sock_size = 0; 4318 if (unpriv) 4319 tbl[idx].mode = 0444; 4320 tbl[idx++].data = &ipvs->sysctl_sync_sock_size; 4321 4322 tbl[idx++].data = &ipvs->sysctl_cache_bypass; 4323 tbl[idx++].data = &ipvs->sysctl_expire_nodest_conn; 4324 tbl[idx++].data = &ipvs->sysctl_sloppy_tcp; 4325 tbl[idx++].data = &ipvs->sysctl_sloppy_sctp; 4326 tbl[idx++].data = &ipvs->sysctl_expire_quiescent_template; 4327 ipvs->sysctl_sync_threshold[0] = DEFAULT_SYNC_THRESHOLD; 4328 ipvs->sysctl_sync_threshold[1] = DEFAULT_SYNC_PERIOD; 4329 tbl[idx].data = &ipvs->sysctl_sync_threshold; 4330 tbl[idx].extra2 = ipvs; 4331 tbl[idx++].maxlen = sizeof(ipvs->sysctl_sync_threshold); 4332 ipvs->sysctl_sync_refresh_period = DEFAULT_SYNC_REFRESH_PERIOD; 4333 tbl[idx++].data = &ipvs->sysctl_sync_refresh_period; 4334 ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3); 4335 tbl[idx++].data = &ipvs->sysctl_sync_retries; 4336 tbl[idx++].data = &ipvs->sysctl_nat_icmp_send; 4337 ipvs->sysctl_pmtu_disc = 1; 4338 tbl[idx++].data = &ipvs->sysctl_pmtu_disc; 4339 tbl[idx++].data = &ipvs->sysctl_backup_only; 4340 ipvs->sysctl_conn_reuse_mode = 1; 4341 tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode; 4342 tbl[idx++].data = &ipvs->sysctl_schedule_icmp; 4343 tbl[idx++].data = &ipvs->sysctl_ignore_tunneled; 4344 4345 ipvs->sysctl_run_estimation = 1; 4346 if (unpriv) 4347 tbl[idx].mode = 0444; 4348 tbl[idx].extra2 = ipvs; 4349 tbl[idx++].data = &ipvs->sysctl_run_estimation; 4350 4351 ipvs->est_cpulist_valid = 0; 4352 if (unpriv) 4353 tbl[idx].mode = 0444; 4354 tbl[idx].extra2 = ipvs; 4355 tbl[idx++].data = &ipvs->sysctl_est_cpulist; 4356 4357 ipvs->sysctl_est_nice = IPVS_EST_NICE; 4358 if (unpriv) 4359 tbl[idx].mode = 0444; 4360 tbl[idx].extra2 = ipvs; 4361 tbl[idx++].data = &ipvs->sysctl_est_nice; 4362 4363 #ifdef CONFIG_IP_VS_DEBUG 4364 /* Global sysctls must be ro in non-init netns */ 4365 if (!net_eq(net, &init_net)) 4366 tbl[idx++].mode = 0444; 4367 #endif 4368 4369 ret = -ENOMEM; 4370 ipvs->sysctl_hdr = register_net_sysctl_sz(net, "net/ipv4/vs", tbl, 4371 ctl_table_size); 4372 if (!ipvs->sysctl_hdr) 4373 goto err; 4374 ipvs->sysctl_tbl = tbl; 4375 4376 ret = ip_vs_start_estimator(ipvs, &ipvs->tot_stats->s); 4377 if (ret < 0) 4378 goto err; 4379 4380 /* Schedule defense work */ 4381 queue_delayed_work(system_long_wq, &ipvs->defense_work, 4382 DEFENSE_TIMER_PERIOD); 4383 4384 return 0; 4385 4386 err: 4387 unregister_net_sysctl_table(ipvs->sysctl_hdr); 4388 if (!net_eq(net, &init_net)) 4389 kfree(tbl); 4390 return ret; 4391 } 4392 4393 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs) 4394 { 4395 struct net *net = ipvs->net; 4396 4397 cancel_delayed_work_sync(&ipvs->expire_nodest_conn_work); 4398 cancel_delayed_work_sync(&ipvs->defense_work); 4399 cancel_work_sync(&ipvs->defense_work.work); 4400 unregister_net_sysctl_table(ipvs->sysctl_hdr); 4401 ip_vs_stop_estimator(ipvs, &ipvs->tot_stats->s); 4402 4403 if (ipvs->est_cpulist_valid) 4404 free_cpumask_var(ipvs->sysctl_est_cpulist); 4405 4406 if (!net_eq(net, &init_net)) 4407 kfree(ipvs->sysctl_tbl); 4408 } 4409 4410 #else 4411 4412 static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) { return 0; } 4413 static void __net_exit ip_vs_control_net_cleanup_sysctl(struct netns_ipvs *ipvs) { } 4414 4415 #endif 4416 4417 static struct notifier_block ip_vs_dst_notifier = { 4418 .notifier_call = ip_vs_dst_event, 4419 #ifdef CONFIG_IP_VS_IPV6 4420 .priority = ADDRCONF_NOTIFY_PRIORITY + 5, 4421 #endif 4422 }; 4423 4424 int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs) 4425 { 4426 int ret = -ENOMEM; 4427 int idx; 4428 4429 /* Initialize rs_table */ 4430 for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++) 4431 INIT_HLIST_HEAD(&ipvs->rs_table[idx]); 4432 4433 INIT_LIST_HEAD(&ipvs->dest_trash); 4434 spin_lock_init(&ipvs->dest_trash_lock); 4435 timer_setup(&ipvs->dest_trash_timer, ip_vs_dest_trash_expire, 0); 4436 atomic_set(&ipvs->ftpsvc_counter, 0); 4437 atomic_set(&ipvs->nullsvc_counter, 0); 4438 atomic_set(&ipvs->conn_out_counter, 0); 4439 4440 INIT_DELAYED_WORK(&ipvs->est_reload_work, est_reload_work_handler); 4441 4442 /* procfs stats */ 4443 ipvs->tot_stats = kzalloc(sizeof(*ipvs->tot_stats), GFP_KERNEL); 4444 if (!ipvs->tot_stats) 4445 goto out; 4446 if (ip_vs_stats_init_alloc(&ipvs->tot_stats->s) < 0) 4447 goto err_tot_stats; 4448 4449 #ifdef CONFIG_PROC_FS 4450 if (!proc_create_net("ip_vs", 0, ipvs->net->proc_net, 4451 &ip_vs_info_seq_ops, sizeof(struct ip_vs_iter))) 4452 goto err_vs; 4453 if (!proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net, 4454 ip_vs_stats_show, NULL)) 4455 goto err_stats; 4456 if (!proc_create_net_single("ip_vs_stats_percpu", 0, 4457 ipvs->net->proc_net, 4458 ip_vs_stats_percpu_show, NULL)) 4459 goto err_percpu; 4460 #endif 4461 4462 ret = ip_vs_control_net_init_sysctl(ipvs); 4463 if (ret < 0) 4464 goto err; 4465 4466 return 0; 4467 4468 err: 4469 #ifdef CONFIG_PROC_FS 4470 remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net); 4471 4472 err_percpu: 4473 remove_proc_entry("ip_vs_stats", ipvs->net->proc_net); 4474 4475 err_stats: 4476 remove_proc_entry("ip_vs", ipvs->net->proc_net); 4477 4478 err_vs: 4479 #endif 4480 ip_vs_stats_release(&ipvs->tot_stats->s); 4481 4482 err_tot_stats: 4483 kfree(ipvs->tot_stats); 4484 4485 out: 4486 return ret; 4487 } 4488 4489 void __net_exit ip_vs_control_net_cleanup(struct netns_ipvs *ipvs) 4490 { 4491 ip_vs_trash_cleanup(ipvs); 4492 ip_vs_control_net_cleanup_sysctl(ipvs); 4493 cancel_delayed_work_sync(&ipvs->est_reload_work); 4494 #ifdef CONFIG_PROC_FS 4495 remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net); 4496 remove_proc_entry("ip_vs_stats", ipvs->net->proc_net); 4497 remove_proc_entry("ip_vs", ipvs->net->proc_net); 4498 #endif 4499 call_rcu(&ipvs->tot_stats->rcu_head, ip_vs_stats_rcu_free); 4500 } 4501 4502 int __init ip_vs_register_nl_ioctl(void) 4503 { 4504 int ret; 4505 4506 ret = nf_register_sockopt(&ip_vs_sockopts); 4507 if (ret) { 4508 pr_err("cannot register sockopt.\n"); 4509 goto err_sock; 4510 } 4511 4512 ret = ip_vs_genl_register(); 4513 if (ret) { 4514 pr_err("cannot register Generic Netlink interface.\n"); 4515 goto err_genl; 4516 } 4517 return 0; 4518 4519 err_genl: 4520 nf_unregister_sockopt(&ip_vs_sockopts); 4521 err_sock: 4522 return ret; 4523 } 4524 4525 void ip_vs_unregister_nl_ioctl(void) 4526 { 4527 ip_vs_genl_unregister(); 4528 nf_unregister_sockopt(&ip_vs_sockopts); 4529 } 4530 4531 int __init ip_vs_control_init(void) 4532 { 4533 int idx; 4534 int ret; 4535 4536 /* Initialize svc_table, ip_vs_svc_fwm_table */ 4537 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) { 4538 INIT_HLIST_HEAD(&ip_vs_svc_table[idx]); 4539 INIT_HLIST_HEAD(&ip_vs_svc_fwm_table[idx]); 4540 } 4541 4542 smp_wmb(); /* Do we really need it now ? */ 4543 4544 ret = register_netdevice_notifier(&ip_vs_dst_notifier); 4545 if (ret < 0) 4546 return ret; 4547 4548 return 0; 4549 } 4550 4551 4552 void ip_vs_control_cleanup(void) 4553 { 4554 unregister_netdevice_notifier(&ip_vs_dst_notifier); 4555 /* relying on common rcu_barrier() in ip_vs_cleanup() */ 4556 } 4557