1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * ip_vs_proto_tcp.c: TCP load balancing support for IPVS
4 *
5 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
6 * Julian Anastasov <ja@ssi.bg>
7 *
8 * Changes: Hans Schillstrom <hans.schillstrom@ericsson.com>
9 *
10 * Network name space (netns) aware.
11 * Global data moved to netns i.e struct netns_ipvs
12 * tcp_timeouts table has copy per netns in a hash table per
13 * protocol ip_vs_proto_data and is handled by netns
14 */
15
16 #define pr_fmt(fmt) "IPVS: " fmt
17
18 #include <linux/kernel.h>
19 #include <linux/ip.h>
20 #include <linux/tcp.h> /* for tcphdr */
21 #include <net/ip.h>
22 #include <net/tcp.h> /* for csum_tcpudp_magic */
23 #include <net/ip6_checksum.h>
24 #include <linux/netfilter.h>
25 #include <linux/netfilter_ipv4.h>
26 #include <linux/indirect_call_wrapper.h>
27
28 #include <net/ip_vs.h>
29
30 static int
31 tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
32 struct ip_vs_iphdr *iph);
33
34 static int
tcp_conn_schedule(struct netns_ipvs * ipvs,int af,struct sk_buff * skb,struct ip_vs_proto_data * pd,int * verdict,struct ip_vs_conn ** cpp,struct ip_vs_iphdr * iph)35 tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,
36 struct ip_vs_proto_data *pd,
37 int *verdict, struct ip_vs_conn **cpp,
38 struct ip_vs_iphdr *iph)
39 {
40 struct ip_vs_service *svc;
41 struct tcphdr _tcph, *th;
42 __be16 _ports[2], *ports = NULL;
43
44 /* In the event of icmp, we're only guaranteed to have the first 8
45 * bytes of the transport header, so we only check the rest of the
46 * TCP packet for non-ICMP packets
47 */
48 if (likely(!ip_vs_iph_icmp(iph))) {
49 th = skb_header_pointer(skb, iph->len, sizeof(_tcph), &_tcph);
50 if (th) {
51 if (th->rst || !(sysctl_sloppy_tcp(ipvs) || th->syn))
52 return 1;
53 ports = &th->source;
54 }
55 } else {
56 ports = skb_header_pointer(
57 skb, iph->len, sizeof(_ports), &_ports);
58 }
59
60 if (!ports) {
61 *verdict = NF_DROP;
62 return 0;
63 }
64
65 /* No !th->ack check to allow scheduling on SYN+ACK for Active FTP */
66
67 if (likely(!ip_vs_iph_inverse(iph)))
68 svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
69 &iph->daddr, ports[1]);
70 else
71 svc = ip_vs_service_find(ipvs, af, skb->mark, iph->protocol,
72 &iph->saddr, ports[0]);
73
74 if (svc) {
75 int ignored;
76
77 if (ip_vs_todrop(ipvs)) {
78 /*
79 * It seems that we are very loaded.
80 * We have to drop this packet :(
81 */
82 *verdict = NF_DROP;
83 return 0;
84 }
85
86 /*
87 * Let the virtual server select a real server for the
88 * incoming connection, and create a connection entry.
89 */
90 *cpp = ip_vs_schedule(svc, skb, pd, &ignored, iph);
91 if (!*cpp && ignored <= 0) {
92 if (!ignored)
93 *verdict = ip_vs_leave(svc, skb, pd, iph);
94 else
95 *verdict = NF_DROP;
96 return 0;
97 }
98 }
99 /* NF_ACCEPT */
100 return 1;
101 }
102
103
104 static inline void
tcp_fast_csum_update(int af,struct tcphdr * tcph,const union nf_inet_addr * oldip,const union nf_inet_addr * newip,__be16 oldport,__be16 newport)105 tcp_fast_csum_update(int af, struct tcphdr *tcph,
106 const union nf_inet_addr *oldip,
107 const union nf_inet_addr *newip,
108 __be16 oldport, __be16 newport)
109 {
110 #ifdef CONFIG_IP_VS_IPV6
111 if (af == AF_INET6)
112 tcph->check =
113 csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
114 ip_vs_check_diff2(oldport, newport,
115 ~csum_unfold(tcph->check))));
116 else
117 #endif
118 tcph->check =
119 csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
120 ip_vs_check_diff2(oldport, newport,
121 ~csum_unfold(tcph->check))));
122 }
123
124
125 static inline void
tcp_partial_csum_update(int af,struct tcphdr * tcph,const union nf_inet_addr * oldip,const union nf_inet_addr * newip,__be16 oldlen,__be16 newlen)126 tcp_partial_csum_update(int af, struct tcphdr *tcph,
127 const union nf_inet_addr *oldip,
128 const union nf_inet_addr *newip,
129 __be16 oldlen, __be16 newlen)
130 {
131 #ifdef CONFIG_IP_VS_IPV6
132 if (af == AF_INET6)
133 tcph->check =
134 ~csum_fold(ip_vs_check_diff16(oldip->ip6, newip->ip6,
135 ip_vs_check_diff2(oldlen, newlen,
136 csum_unfold(tcph->check))));
137 else
138 #endif
139 tcph->check =
140 ~csum_fold(ip_vs_check_diff4(oldip->ip, newip->ip,
141 ip_vs_check_diff2(oldlen, newlen,
142 csum_unfold(tcph->check))));
143 }
144
145
146 INDIRECT_CALLABLE_SCOPE int
tcp_snat_handler(struct sk_buff * skb,struct ip_vs_protocol * pp,struct ip_vs_conn * cp,struct ip_vs_iphdr * iph)147 tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
148 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
149 {
150 struct tcphdr *tcph;
151 unsigned int tcphoff = iph->len;
152 bool payload_csum = false;
153 int oldlen;
154
155 #ifdef CONFIG_IP_VS_IPV6
156 if (cp->af == AF_INET6 && iph->fragoffs)
157 return 1;
158 #endif
159 oldlen = skb->len - tcphoff;
160
161 /* csum_check requires unshared skb */
162 if (skb_ensure_writable(skb, tcphoff + sizeof(*tcph)))
163 return 0;
164
165 if (unlikely(cp->app != NULL)) {
166 int ret;
167
168 /* Some checks before mangling */
169 if (!tcp_csum_check(cp->af, skb, pp, iph))
170 return 0;
171
172 /* Call application helper if needed */
173 if (!(ret = ip_vs_app_pkt_out(cp, skb, iph)))
174 return 0;
175 /* ret=2: csum update is needed after payload mangling */
176 if (ret == 1)
177 oldlen = skb->len - tcphoff;
178 else
179 payload_csum = true;
180 }
181
182 tcph = (void *)skb->data + tcphoff;
183 tcph->source = cp->vport;
184
185 /* Adjust TCP checksums */
186 if (skb->ip_summed == CHECKSUM_PARTIAL) {
187 tcp_partial_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
188 htons(oldlen),
189 htons(skb->len - tcphoff));
190 } else if (!payload_csum) {
191 /* Only port and addr are changed, do fast csum update */
192 tcp_fast_csum_update(cp->af, tcph, &cp->daddr, &cp->vaddr,
193 cp->dport, cp->vport);
194 if (skb->ip_summed == CHECKSUM_COMPLETE)
195 skb->ip_summed = cp->app ?
196 CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
197 } else {
198 /* full checksum calculation */
199 tcph->check = 0;
200 skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
201 #ifdef CONFIG_IP_VS_IPV6
202 if (cp->af == AF_INET6)
203 tcph->check = csum_ipv6_magic(&cp->vaddr.in6,
204 &cp->caddr.in6,
205 skb->len - tcphoff,
206 cp->protocol, skb->csum);
207 else
208 #endif
209 tcph->check = csum_tcpudp_magic(cp->vaddr.ip,
210 cp->caddr.ip,
211 skb->len - tcphoff,
212 cp->protocol,
213 skb->csum);
214 skb->ip_summed = CHECKSUM_UNNECESSARY;
215
216 IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
217 pp->name, tcph->check,
218 (char*)&(tcph->check) - (char*)tcph);
219 }
220 return 1;
221 }
222
223
224 static int
tcp_dnat_handler(struct sk_buff * skb,struct ip_vs_protocol * pp,struct ip_vs_conn * cp,struct ip_vs_iphdr * iph)225 tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
226 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
227 {
228 struct tcphdr *tcph;
229 unsigned int tcphoff = iph->len;
230 bool payload_csum = false;
231 int oldlen;
232
233 #ifdef CONFIG_IP_VS_IPV6
234 if (cp->af == AF_INET6 && iph->fragoffs)
235 return 1;
236 #endif
237 oldlen = skb->len - tcphoff;
238
239 /* csum_check requires unshared skb */
240 if (skb_ensure_writable(skb, tcphoff + sizeof(*tcph)))
241 return 0;
242
243 if (unlikely(cp->app != NULL)) {
244 int ret;
245
246 /* Some checks before mangling */
247 if (!tcp_csum_check(cp->af, skb, pp, iph))
248 return 0;
249
250 /*
251 * Attempt ip_vs_app call.
252 * It will fix ip_vs_conn and iph ack_seq stuff
253 */
254 if (!(ret = ip_vs_app_pkt_in(cp, skb, iph)))
255 return 0;
256 /* ret=2: csum update is needed after payload mangling */
257 if (ret == 1)
258 oldlen = skb->len - tcphoff;
259 else
260 payload_csum = true;
261 }
262
263 tcph = (void *)skb->data + tcphoff;
264 tcph->dest = cp->dport;
265
266 /*
267 * Adjust TCP checksums
268 */
269 if (skb->ip_summed == CHECKSUM_PARTIAL) {
270 tcp_partial_csum_update(cp->af, tcph, &cp->vaddr, &cp->daddr,
271 htons(oldlen),
272 htons(skb->len - tcphoff));
273 } else if (!payload_csum) {
274 /* Only port and addr are changed, do fast csum update */
275 tcp_fast_csum_update(cp->af, tcph, &cp->vaddr, &cp->daddr,
276 cp->vport, cp->dport);
277 if (skb->ip_summed == CHECKSUM_COMPLETE)
278 skb->ip_summed = cp->app ?
279 CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
280 } else {
281 /* full checksum calculation */
282 tcph->check = 0;
283 skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);
284 #ifdef CONFIG_IP_VS_IPV6
285 if (cp->af == AF_INET6)
286 tcph->check = csum_ipv6_magic(&cp->caddr.in6,
287 &cp->daddr.in6,
288 skb->len - tcphoff,
289 cp->protocol, skb->csum);
290 else
291 #endif
292 tcph->check = csum_tcpudp_magic(cp->caddr.ip,
293 cp->daddr.ip,
294 skb->len - tcphoff,
295 cp->protocol,
296 skb->csum);
297 skb->ip_summed = CHECKSUM_UNNECESSARY;
298 }
299 return 1;
300 }
301
302
303 static int
tcp_csum_check(int af,struct sk_buff * skb,struct ip_vs_protocol * pp,struct ip_vs_iphdr * iph)304 tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
305 struct ip_vs_iphdr *iph)
306 {
307 if (!ip_vs_checksum_common_check(skb, iph->len, IPPROTO_TCP, af)) {
308 IP_VS_DBG_RL_PKT(0, af, pp, skb, iph->off,
309 "Failed checksum for");
310 return 0;
311 }
312 return 1;
313 }
314
315
316 #define TCP_DIR_INPUT 0
317 #define TCP_DIR_OUTPUT 4
318 #define TCP_DIR_INPUT_ONLY 8
319
320 static const int tcp_state_off[IP_VS_DIR_LAST] = {
321 [IP_VS_DIR_INPUT] = TCP_DIR_INPUT,
322 [IP_VS_DIR_OUTPUT] = TCP_DIR_OUTPUT,
323 [IP_VS_DIR_INPUT_ONLY] = TCP_DIR_INPUT_ONLY,
324 };
325
326 /*
327 * Timeout table[state]
328 */
329 static const int tcp_timeouts[IP_VS_TCP_S_LAST+1] = {
330 [IP_VS_TCP_S_NONE] = 2*HZ,
331 [IP_VS_TCP_S_ESTABLISHED] = 15*60*HZ,
332 [IP_VS_TCP_S_SYN_SENT] = 2*60*HZ,
333 [IP_VS_TCP_S_SYN_RECV] = 1*60*HZ,
334 [IP_VS_TCP_S_FIN_WAIT] = 2*60*HZ,
335 [IP_VS_TCP_S_TIME_WAIT] = 2*60*HZ,
336 [IP_VS_TCP_S_CLOSE] = 10*HZ,
337 [IP_VS_TCP_S_CLOSE_WAIT] = 60*HZ,
338 [IP_VS_TCP_S_LAST_ACK] = 30*HZ,
339 [IP_VS_TCP_S_LISTEN] = 2*60*HZ,
340 [IP_VS_TCP_S_SYNACK] = 120*HZ,
341 [IP_VS_TCP_S_LAST] = 2*HZ,
342 };
343
344 static const char *const tcp_state_name_table[IP_VS_TCP_S_LAST+1] = {
345 [IP_VS_TCP_S_NONE] = "NONE",
346 [IP_VS_TCP_S_ESTABLISHED] = "ESTABLISHED",
347 [IP_VS_TCP_S_SYN_SENT] = "SYN_SENT",
348 [IP_VS_TCP_S_SYN_RECV] = "SYN_RECV",
349 [IP_VS_TCP_S_FIN_WAIT] = "FIN_WAIT",
350 [IP_VS_TCP_S_TIME_WAIT] = "TIME_WAIT",
351 [IP_VS_TCP_S_CLOSE] = "CLOSE",
352 [IP_VS_TCP_S_CLOSE_WAIT] = "CLOSE_WAIT",
353 [IP_VS_TCP_S_LAST_ACK] = "LAST_ACK",
354 [IP_VS_TCP_S_LISTEN] = "LISTEN",
355 [IP_VS_TCP_S_SYNACK] = "SYNACK",
356 [IP_VS_TCP_S_LAST] = "BUG!",
357 };
358
359 static const bool tcp_state_active_table[IP_VS_TCP_S_LAST] = {
360 [IP_VS_TCP_S_NONE] = false,
361 [IP_VS_TCP_S_ESTABLISHED] = true,
362 [IP_VS_TCP_S_SYN_SENT] = true,
363 [IP_VS_TCP_S_SYN_RECV] = true,
364 [IP_VS_TCP_S_FIN_WAIT] = false,
365 [IP_VS_TCP_S_TIME_WAIT] = false,
366 [IP_VS_TCP_S_CLOSE] = false,
367 [IP_VS_TCP_S_CLOSE_WAIT] = false,
368 [IP_VS_TCP_S_LAST_ACK] = false,
369 [IP_VS_TCP_S_LISTEN] = false,
370 [IP_VS_TCP_S_SYNACK] = true,
371 };
372
373 #define sNO IP_VS_TCP_S_NONE
374 #define sES IP_VS_TCP_S_ESTABLISHED
375 #define sSS IP_VS_TCP_S_SYN_SENT
376 #define sSR IP_VS_TCP_S_SYN_RECV
377 #define sFW IP_VS_TCP_S_FIN_WAIT
378 #define sTW IP_VS_TCP_S_TIME_WAIT
379 #define sCL IP_VS_TCP_S_CLOSE
380 #define sCW IP_VS_TCP_S_CLOSE_WAIT
381 #define sLA IP_VS_TCP_S_LAST_ACK
382 #define sLI IP_VS_TCP_S_LISTEN
383 #define sSA IP_VS_TCP_S_SYNACK
384
385 struct tcp_states_t {
386 int next_state[IP_VS_TCP_S_LAST];
387 };
388
tcp_state_name(int state)389 static const char * tcp_state_name(int state)
390 {
391 if (state >= IP_VS_TCP_S_LAST)
392 return "ERR!";
393 return tcp_state_name_table[state] ? tcp_state_name_table[state] : "?";
394 }
395
tcp_state_active(int state)396 static bool tcp_state_active(int state)
397 {
398 if (state >= IP_VS_TCP_S_LAST)
399 return false;
400 return tcp_state_active_table[state];
401 }
402
403 static struct tcp_states_t tcp_states[] = {
404 /* INPUT */
405 /* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
406 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
407 /*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sTW }},
408 /*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
409 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sSR }},
410
411 /* OUTPUT */
412 /* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
413 /*syn*/ {{sSS, sES, sSS, sSR, sSS, sSS, sSS, sSS, sSS, sLI, sSR }},
414 /*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
415 /*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
416 /*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
417
418 /* INPUT-ONLY */
419 /* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
420 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
421 /*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
422 /*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
423 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
424 };
425
426 static struct tcp_states_t tcp_states_dos[] = {
427 /* INPUT */
428 /* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
429 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
430 /*fin*/ {{sCL, sCW, sSS, sTW, sTW, sTW, sCL, sCW, sLA, sLI, sSA }},
431 /*ack*/ {{sES, sES, sSS, sSR, sFW, sTW, sCL, sCW, sCL, sLI, sSA }},
432 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
433
434 /* OUTPUT */
435 /* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
436 /*syn*/ {{sSS, sES, sSS, sSA, sSS, sSS, sSS, sSS, sSS, sLI, sSA }},
437 /*fin*/ {{sTW, sFW, sSS, sTW, sFW, sTW, sCL, sTW, sLA, sLI, sTW }},
438 /*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sLA, sES, sES }},
439 /*rst*/ {{sCL, sCL, sSS, sCL, sCL, sTW, sCL, sCL, sCL, sCL, sCL }},
440
441 /* INPUT-ONLY */
442 /* sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
443 /*syn*/ {{sSA, sES, sES, sSR, sSA, sSA, sSA, sSA, sSA, sSA, sSA }},
444 /*fin*/ {{sCL, sFW, sSS, sTW, sFW, sTW, sCL, sCW, sLA, sLI, sTW }},
445 /*ack*/ {{sES, sES, sSS, sES, sFW, sTW, sCL, sCW, sCL, sLI, sES }},
446 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
447 };
448
tcp_timeout_change(struct ip_vs_proto_data * pd,int flags)449 static void tcp_timeout_change(struct ip_vs_proto_data *pd, int flags)
450 {
451 int on = (flags & 1); /* secure_tcp */
452
453 /*
454 ** FIXME: change secure_tcp to independent sysctl var
455 ** or make it per-service or per-app because it is valid
456 ** for most if not for all of the applications. Something
457 ** like "capabilities" (flags) for each object.
458 */
459 pd->tcp_state_table = (on ? tcp_states_dos : tcp_states);
460 }
461
tcp_state_idx(struct tcphdr * th)462 static inline int tcp_state_idx(struct tcphdr *th)
463 {
464 if (th->rst)
465 return 3;
466 if (th->syn)
467 return 0;
468 if (th->fin)
469 return 1;
470 if (th->ack)
471 return 2;
472 return -1;
473 }
474
475 static inline void
set_tcp_state(struct ip_vs_proto_data * pd,struct ip_vs_conn * cp,int direction,struct tcphdr * th)476 set_tcp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
477 int direction, struct tcphdr *th)
478 {
479 int state_idx;
480 int new_state = IP_VS_TCP_S_CLOSE;
481 int state_off = tcp_state_off[direction];
482
483 /*
484 * Update state offset to INPUT_ONLY if necessary
485 * or delete NO_OUTPUT flag if output packet detected
486 */
487 if (cp->flags & IP_VS_CONN_F_NOOUTPUT) {
488 if (state_off == TCP_DIR_OUTPUT)
489 cp->flags &= ~IP_VS_CONN_F_NOOUTPUT;
490 else
491 state_off = TCP_DIR_INPUT_ONLY;
492 }
493
494 if ((state_idx = tcp_state_idx(th)) < 0) {
495 IP_VS_DBG(8, "tcp_state_idx=%d!!!\n", state_idx);
496 goto tcp_state_out;
497 }
498
499 new_state =
500 pd->tcp_state_table[state_off+state_idx].next_state[cp->state];
501
502 tcp_state_out:
503 if (new_state != cp->state) {
504 struct ip_vs_dest *dest = cp->dest;
505
506 IP_VS_DBG_BUF(8, "%s %s [%c%c%c%c] c:%s:%d v:%s:%d "
507 "d:%s:%d state: %s->%s conn->refcnt:%d\n",
508 pd->pp->name,
509 ((state_off == TCP_DIR_OUTPUT) ?
510 "output " : "input "),
511 th->syn ? 'S' : '.',
512 th->fin ? 'F' : '.',
513 th->ack ? 'A' : '.',
514 th->rst ? 'R' : '.',
515 IP_VS_DBG_ADDR(cp->af, &cp->caddr),
516 ntohs(cp->cport),
517 IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
518 ntohs(cp->vport),
519 IP_VS_DBG_ADDR(cp->daf, &cp->daddr),
520 ntohs(cp->dport),
521 tcp_state_name(cp->state),
522 tcp_state_name(new_state),
523 refcount_read(&cp->refcnt));
524
525 if (dest) {
526 if (!(cp->flags & IP_VS_CONN_F_INACTIVE) &&
527 !tcp_state_active(new_state)) {
528 atomic_dec(&dest->activeconns);
529 cp->flags |= IP_VS_CONN_F_INACTIVE;
530 } else if ((cp->flags & IP_VS_CONN_F_INACTIVE) &&
531 tcp_state_active(new_state)) {
532 atomic_inc(&dest->activeconns);
533 cp->flags &= ~IP_VS_CONN_F_INACTIVE;
534 }
535 }
536 if (new_state == IP_VS_TCP_S_ESTABLISHED)
537 ip_vs_control_assure_ct(cp);
538 }
539
540 if (likely(pd))
541 cp->timeout = pd->timeout_table[cp->state = new_state];
542 else /* What to do ? */
543 cp->timeout = tcp_timeouts[cp->state = new_state];
544 }
545
546 /*
547 * Handle state transitions
548 */
549 static void
tcp_state_transition(struct ip_vs_conn * cp,int direction,const struct sk_buff * skb,struct ip_vs_proto_data * pd,unsigned int iph_len)550 tcp_state_transition(struct ip_vs_conn *cp, int direction,
551 const struct sk_buff *skb,
552 struct ip_vs_proto_data *pd,
553 unsigned int iph_len)
554 {
555 struct tcphdr _tcph, *th;
556
557 th = skb_header_pointer(skb, iph_len, sizeof(_tcph), &_tcph);
558 if (th == NULL)
559 return;
560
561 spin_lock_bh(&cp->lock);
562 set_tcp_state(pd, cp, direction, th);
563 spin_unlock_bh(&cp->lock);
564 }
565
tcp_app_hashkey(__be16 port)566 static inline __u16 tcp_app_hashkey(__be16 port)
567 {
568 return (((__force u16)port >> TCP_APP_TAB_BITS) ^ (__force u16)port)
569 & TCP_APP_TAB_MASK;
570 }
571
572
tcp_register_app(struct netns_ipvs * ipvs,struct ip_vs_app * inc)573 static int tcp_register_app(struct netns_ipvs *ipvs, struct ip_vs_app *inc)
574 {
575 struct ip_vs_app *i;
576 __u16 hash;
577 __be16 port = inc->port;
578 int ret = 0;
579 struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
580
581 hash = tcp_app_hashkey(port);
582
583 list_for_each_entry(i, &ipvs->tcp_apps[hash], p_list) {
584 if (i->port == port) {
585 ret = -EEXIST;
586 goto out;
587 }
588 }
589 list_add_rcu(&inc->p_list, &ipvs->tcp_apps[hash]);
590 atomic_inc(&pd->appcnt);
591
592 out:
593 return ret;
594 }
595
596
597 static void
tcp_unregister_app(struct netns_ipvs * ipvs,struct ip_vs_app * inc)598 tcp_unregister_app(struct netns_ipvs *ipvs, struct ip_vs_app *inc)
599 {
600 struct ip_vs_proto_data *pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
601
602 atomic_dec(&pd->appcnt);
603 list_del_rcu(&inc->p_list);
604 }
605
606
607 static int
tcp_app_conn_bind(struct ip_vs_conn * cp)608 tcp_app_conn_bind(struct ip_vs_conn *cp)
609 {
610 struct netns_ipvs *ipvs = cp->ipvs;
611 int hash;
612 struct ip_vs_app *inc;
613 int result = 0;
614
615 /* Default binding: bind app only for NAT */
616 if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
617 return 0;
618
619 /* Lookup application incarnations and bind the right one */
620 hash = tcp_app_hashkey(cp->vport);
621
622 list_for_each_entry_rcu(inc, &ipvs->tcp_apps[hash], p_list) {
623 if (inc->port == cp->vport) {
624 if (unlikely(!ip_vs_app_inc_get(inc)))
625 break;
626
627 IP_VS_DBG_BUF(9, "%s(): Binding conn %s:%u->"
628 "%s:%u to app %s on port %u\n",
629 __func__,
630 IP_VS_DBG_ADDR(cp->af, &cp->caddr),
631 ntohs(cp->cport),
632 IP_VS_DBG_ADDR(cp->af, &cp->vaddr),
633 ntohs(cp->vport),
634 inc->name, ntohs(inc->port));
635
636 cp->app = inc;
637 if (inc->init_conn)
638 result = inc->init_conn(inc, cp);
639 break;
640 }
641 }
642
643 return result;
644 }
645
646
647 /*
648 * Set LISTEN timeout. (ip_vs_conn_put will setup timer)
649 */
ip_vs_tcp_conn_listen(struct ip_vs_conn * cp)650 void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp)
651 {
652 struct ip_vs_proto_data *pd = ip_vs_proto_data_get(cp->ipvs, IPPROTO_TCP);
653
654 spin_lock_bh(&cp->lock);
655 cp->state = IP_VS_TCP_S_LISTEN;
656 cp->timeout = (pd ? pd->timeout_table[IP_VS_TCP_S_LISTEN]
657 : tcp_timeouts[IP_VS_TCP_S_LISTEN]);
658 spin_unlock_bh(&cp->lock);
659 }
660
661 /* ---------------------------------------------
662 * timeouts is netns related now.
663 * ---------------------------------------------
664 */
__ip_vs_tcp_init(struct netns_ipvs * ipvs,struct ip_vs_proto_data * pd)665 static int __ip_vs_tcp_init(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd)
666 {
667 ip_vs_init_hash_table(ipvs->tcp_apps, TCP_APP_TAB_SIZE);
668 pd->timeout_table = ip_vs_create_timeout_table((int *)tcp_timeouts,
669 sizeof(tcp_timeouts));
670 if (!pd->timeout_table)
671 return -ENOMEM;
672 pd->tcp_state_table = tcp_states;
673 return 0;
674 }
675
__ip_vs_tcp_exit(struct netns_ipvs * ipvs,struct ip_vs_proto_data * pd)676 static void __ip_vs_tcp_exit(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd)
677 {
678 kfree(pd->timeout_table);
679 }
680
681
682 struct ip_vs_protocol ip_vs_protocol_tcp = {
683 .name = "TCP",
684 .protocol = IPPROTO_TCP,
685 .num_states = IP_VS_TCP_S_LAST,
686 .dont_defrag = 0,
687 .init = NULL,
688 .exit = NULL,
689 .init_netns = __ip_vs_tcp_init,
690 .exit_netns = __ip_vs_tcp_exit,
691 .register_app = tcp_register_app,
692 .unregister_app = tcp_unregister_app,
693 .conn_schedule = tcp_conn_schedule,
694 .conn_in_get = ip_vs_conn_in_get_proto,
695 .conn_out_get = ip_vs_conn_out_get_proto,
696 .snat_handler = tcp_snat_handler,
697 .dnat_handler = tcp_dnat_handler,
698 .state_name = tcp_state_name,
699 .state_transition = tcp_state_transition,
700 .app_conn_bind = tcp_app_conn_bind,
701 .debug_packet = ip_vs_tcpudp_debug_packet,
702 .timeout_change = tcp_timeout_change,
703 };
704