2 * IPVS An implementation of the IP virtual server support for the
3 * LINUX operating system. IPVS is now implemented as a module
4 * over the NetFilter framework. IPVS can be used to build a
5 * high-performance and highly available server based on a
8 * Version: $Id: ip_vs_ctl.c,v 1.36 2003/06/08 09:31:19 wensong Exp $
10 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org>
11 * Peter Kese <peter.kese@ijs.si>
12 * Julian Anastasov <ja@ssi.bg>
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version
17 * 2 of the License, or (at your option) any later version.
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/types.h>
26 #include <linux/capability.h>
28 #include <linux/sysctl.h>
29 #include <linux/proc_fs.h>
30 #include <linux/workqueue.h>
31 #include <linux/swap.h>
32 #include <linux/seq_file.h>
34 #include <linux/netfilter.h>
35 #include <linux/netfilter_ipv4.h>
36 #include <linux/mutex.h>
39 #include <net/route.h>
42 #include <asm/uaccess.h>
44 #include <net/ip_vs.h>
46 /* semaphore for IPVS sockopts. And, [gs]etsockopt may sleep. */
47 static DEFINE_MUTEX(__ip_vs_mutex);
49 /* lock for service table */
50 static DEFINE_RWLOCK(__ip_vs_svc_lock);
52 /* lock for table with the real services */
53 static DEFINE_RWLOCK(__ip_vs_rs_lock);
55 /* lock for state and timeout tables */
56 static DEFINE_RWLOCK(__ip_vs_securetcp_lock);
58 /* lock for drop entry handling */
59 static DEFINE_SPINLOCK(__ip_vs_dropentry_lock);
61 /* lock for drop packet handling */
62 static DEFINE_SPINLOCK(__ip_vs_droppacket_lock);
64 /* 1/rate drop and drop-entry variables */
65 int ip_vs_drop_rate = 0;
66 int ip_vs_drop_counter = 0;
67 static atomic_t ip_vs_dropentry = ATOMIC_INIT(0);
69 /* number of virtual services */
70 static int ip_vs_num_services = 0;
72 /* sysctl variables */
73 static int sysctl_ip_vs_drop_entry = 0;
74 static int sysctl_ip_vs_drop_packet = 0;
75 static int sysctl_ip_vs_secure_tcp = 0;
76 static int sysctl_ip_vs_amemthresh = 1024;
77 static int sysctl_ip_vs_am_droprate = 10;
78 int sysctl_ip_vs_cache_bypass = 0;
79 int sysctl_ip_vs_expire_nodest_conn = 0;
80 int sysctl_ip_vs_expire_quiescent_template = 0;
81 int sysctl_ip_vs_sync_threshold[2] = { 3, 50 };
82 int sysctl_ip_vs_nat_icmp_send = 0;
85 #ifdef CONFIG_IP_VS_DEBUG
86 static int sysctl_ip_vs_debug_level = 0;
88 int ip_vs_get_debug_level(void)
90 return sysctl_ip_vs_debug_level;
95 * update_defense_level is called from keventd and from sysctl,
96 * so it needs to protect itself from softirqs
98 static void update_defense_level(void)
101 static int old_secure_tcp = 0;
106 /* we only count free and buffered memory (in pages) */
108 availmem = i.freeram + i.bufferram;
109 /* however in linux 2.5 the i.bufferram is total page cache size,
111 /* si_swapinfo(&i); */
112 /* availmem = availmem - (i.totalswap - i.freeswap); */
114 nomem = (availmem < sysctl_ip_vs_amemthresh);
119 spin_lock(&__ip_vs_dropentry_lock);
120 switch (sysctl_ip_vs_drop_entry) {
122 atomic_set(&ip_vs_dropentry, 0);
126 atomic_set(&ip_vs_dropentry, 1);
127 sysctl_ip_vs_drop_entry = 2;
129 atomic_set(&ip_vs_dropentry, 0);
134 atomic_set(&ip_vs_dropentry, 1);
136 atomic_set(&ip_vs_dropentry, 0);
137 sysctl_ip_vs_drop_entry = 1;
141 atomic_set(&ip_vs_dropentry, 1);
144 spin_unlock(&__ip_vs_dropentry_lock);
147 spin_lock(&__ip_vs_droppacket_lock);
148 switch (sysctl_ip_vs_drop_packet) {
154 ip_vs_drop_rate = ip_vs_drop_counter
155 = sysctl_ip_vs_amemthresh /
156 (sysctl_ip_vs_amemthresh-availmem);
157 sysctl_ip_vs_drop_packet = 2;
164 ip_vs_drop_rate = ip_vs_drop_counter
165 = sysctl_ip_vs_amemthresh /
166 (sysctl_ip_vs_amemthresh-availmem);
169 sysctl_ip_vs_drop_packet = 1;
173 ip_vs_drop_rate = sysctl_ip_vs_am_droprate;
176 spin_unlock(&__ip_vs_droppacket_lock);
179 write_lock(&__ip_vs_securetcp_lock);
180 switch (sysctl_ip_vs_secure_tcp) {
182 if (old_secure_tcp >= 2)
187 if (old_secure_tcp < 2)
189 sysctl_ip_vs_secure_tcp = 2;
191 if (old_secure_tcp >= 2)
197 if (old_secure_tcp < 2)
200 if (old_secure_tcp >= 2)
202 sysctl_ip_vs_secure_tcp = 1;
206 if (old_secure_tcp < 2)
210 old_secure_tcp = sysctl_ip_vs_secure_tcp;
212 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
213 write_unlock(&__ip_vs_securetcp_lock);
220 * Timer for checking the defense
222 #define DEFENSE_TIMER_PERIOD 1*HZ
223 static void defense_work_handler(struct work_struct *work);
224 static DECLARE_DELAYED_WORK(defense_work, defense_work_handler);
226 static void defense_work_handler(struct work_struct *work)
228 update_defense_level();
229 if (atomic_read(&ip_vs_dropentry))
230 ip_vs_random_dropentry();
232 schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
236 ip_vs_use_count_inc(void)
238 return try_module_get(THIS_MODULE);
242 ip_vs_use_count_dec(void)
244 module_put(THIS_MODULE);
249 * Hash table: for virtual service lookups
251 #define IP_VS_SVC_TAB_BITS 8
252 #define IP_VS_SVC_TAB_SIZE (1 << IP_VS_SVC_TAB_BITS)
253 #define IP_VS_SVC_TAB_MASK (IP_VS_SVC_TAB_SIZE - 1)
255 /* the service table hashed by <protocol, addr, port> */
256 static struct list_head ip_vs_svc_table[IP_VS_SVC_TAB_SIZE];
257 /* the service table hashed by fwmark */
258 static struct list_head ip_vs_svc_fwm_table[IP_VS_SVC_TAB_SIZE];
261 * Hash table: for real service lookups
263 #define IP_VS_RTAB_BITS 4
264 #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS)
265 #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1)
267 static struct list_head ip_vs_rtable[IP_VS_RTAB_SIZE];
270 * Trash for destinations
272 static LIST_HEAD(ip_vs_dest_trash);
275 * FTP & NULL virtual service counters
277 static atomic_t ip_vs_ftpsvc_counter = ATOMIC_INIT(0);
278 static atomic_t ip_vs_nullsvc_counter = ATOMIC_INIT(0);
282 * Returns hash value for virtual service
284 static __inline__ unsigned
285 ip_vs_svc_hashkey(unsigned proto, __be32 addr, __be16 port)
287 register unsigned porth = ntohs(port);
289 return (proto^ntohl(addr)^(porth>>IP_VS_SVC_TAB_BITS)^porth)
290 & IP_VS_SVC_TAB_MASK;
294 * Returns hash value of fwmark for virtual service lookup
296 static __inline__ unsigned ip_vs_svc_fwm_hashkey(__u32 fwmark)
298 return fwmark & IP_VS_SVC_TAB_MASK;
302 * Hashes a service in the ip_vs_svc_table by <proto,addr,port>
303 * or in the ip_vs_svc_fwm_table by fwmark.
304 * Should be called with locked tables.
306 static int ip_vs_svc_hash(struct ip_vs_service *svc)
310 if (svc->flags & IP_VS_SVC_F_HASHED) {
311 IP_VS_ERR("ip_vs_svc_hash(): request for already hashed, "
312 "called from %p\n", __builtin_return_address(0));
316 if (svc->fwmark == 0) {
318 * Hash it by <protocol,addr,port> in ip_vs_svc_table
320 hash = ip_vs_svc_hashkey(svc->protocol, svc->addr, svc->port);
321 list_add(&svc->s_list, &ip_vs_svc_table[hash]);
324 * Hash it by fwmark in ip_vs_svc_fwm_table
326 hash = ip_vs_svc_fwm_hashkey(svc->fwmark);
327 list_add(&svc->f_list, &ip_vs_svc_fwm_table[hash]);
330 svc->flags |= IP_VS_SVC_F_HASHED;
331 /* increase its refcnt because it is referenced by the svc table */
332 atomic_inc(&svc->refcnt);
338 * Unhashes a service from ip_vs_svc_table/ip_vs_svc_fwm_table.
339 * Should be called with locked tables.
341 static int ip_vs_svc_unhash(struct ip_vs_service *svc)
343 if (!(svc->flags & IP_VS_SVC_F_HASHED)) {
344 IP_VS_ERR("ip_vs_svc_unhash(): request for unhash flagged, "
345 "called from %p\n", __builtin_return_address(0));
349 if (svc->fwmark == 0) {
350 /* Remove it from the ip_vs_svc_table table */
351 list_del(&svc->s_list);
353 /* Remove it from the ip_vs_svc_fwm_table table */
354 list_del(&svc->f_list);
357 svc->flags &= ~IP_VS_SVC_F_HASHED;
358 atomic_dec(&svc->refcnt);
364 * Get service by {proto,addr,port} in the service table.
366 static __inline__ struct ip_vs_service *
367 __ip_vs_service_get(__u16 protocol, __be32 vaddr, __be16 vport)
370 struct ip_vs_service *svc;
372 /* Check for "full" addressed entries */
373 hash = ip_vs_svc_hashkey(protocol, vaddr, vport);
375 list_for_each_entry(svc, &ip_vs_svc_table[hash], s_list){
376 if ((svc->addr == vaddr)
377 && (svc->port == vport)
378 && (svc->protocol == protocol)) {
380 atomic_inc(&svc->usecnt);
390 * Get service by {fwmark} in the service table.
392 static __inline__ struct ip_vs_service *__ip_vs_svc_fwm_get(__u32 fwmark)
395 struct ip_vs_service *svc;
397 /* Check for fwmark addressed entries */
398 hash = ip_vs_svc_fwm_hashkey(fwmark);
400 list_for_each_entry(svc, &ip_vs_svc_fwm_table[hash], f_list) {
401 if (svc->fwmark == fwmark) {
403 atomic_inc(&svc->usecnt);
411 struct ip_vs_service *
412 ip_vs_service_get(__u32 fwmark, __u16 protocol, __be32 vaddr, __be16 vport)
414 struct ip_vs_service *svc;
416 read_lock(&__ip_vs_svc_lock);
419 * Check the table hashed by fwmark first
421 if (fwmark && (svc = __ip_vs_svc_fwm_get(fwmark)))
425 * Check the table hashed by <protocol,addr,port>
426 * for "full" addressed entries
428 svc = __ip_vs_service_get(protocol, vaddr, vport);
431 && protocol == IPPROTO_TCP
432 && atomic_read(&ip_vs_ftpsvc_counter)
433 && (vport == FTPDATA || ntohs(vport) >= PROT_SOCK)) {
435 * Check if ftp service entry exists, the packet
436 * might belong to FTP data connections.
438 svc = __ip_vs_service_get(protocol, vaddr, FTPPORT);
442 && atomic_read(&ip_vs_nullsvc_counter)) {
444 * Check if the catch-all port (port zero) exists
446 svc = __ip_vs_service_get(protocol, vaddr, 0);
450 read_unlock(&__ip_vs_svc_lock);
452 IP_VS_DBG(9, "lookup service: fwm %u %s %u.%u.%u.%u:%u %s\n",
453 fwmark, ip_vs_proto_name(protocol),
454 NIPQUAD(vaddr), ntohs(vport),
455 svc?"hit":"not hit");
462 __ip_vs_bind_svc(struct ip_vs_dest *dest, struct ip_vs_service *svc)
464 atomic_inc(&svc->refcnt);
469 __ip_vs_unbind_svc(struct ip_vs_dest *dest)
471 struct ip_vs_service *svc = dest->svc;
474 if (atomic_dec_and_test(&svc->refcnt))
480 * Returns hash value for real service
482 static __inline__ unsigned ip_vs_rs_hashkey(__be32 addr, __be16 port)
484 register unsigned porth = ntohs(port);
486 return (ntohl(addr)^(porth>>IP_VS_RTAB_BITS)^porth)
491 * Hashes ip_vs_dest in ip_vs_rtable by <proto,addr,port>.
492 * should be called with locked tables.
494 static int ip_vs_rs_hash(struct ip_vs_dest *dest)
498 if (!list_empty(&dest->d_list)) {
503 * Hash by proto,addr,port,
504 * which are the parameters of the real service.
506 hash = ip_vs_rs_hashkey(dest->addr, dest->port);
507 list_add(&dest->d_list, &ip_vs_rtable[hash]);
513 * UNhashes ip_vs_dest from ip_vs_rtable.
514 * should be called with locked tables.
516 static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
519 * Remove it from the ip_vs_rtable table.
521 if (!list_empty(&dest->d_list)) {
522 list_del(&dest->d_list);
523 INIT_LIST_HEAD(&dest->d_list);
530 * Lookup real service by <proto,addr,port> in the real service table.
533 ip_vs_lookup_real_service(__u16 protocol, __be32 daddr, __be16 dport)
536 struct ip_vs_dest *dest;
539 * Check for "full" addressed entries
540 * Return the first found entry
542 hash = ip_vs_rs_hashkey(daddr, dport);
544 read_lock(&__ip_vs_rs_lock);
545 list_for_each_entry(dest, &ip_vs_rtable[hash], d_list) {
546 if ((dest->addr == daddr)
547 && (dest->port == dport)
548 && ((dest->protocol == protocol) ||
551 read_unlock(&__ip_vs_rs_lock);
555 read_unlock(&__ip_vs_rs_lock);
561 * Lookup destination by {addr,port} in the given service
563 static struct ip_vs_dest *
564 ip_vs_lookup_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
566 struct ip_vs_dest *dest;
569 * Find the destination for the given service
571 list_for_each_entry(dest, &svc->destinations, n_list) {
572 if ((dest->addr == daddr) && (dest->port == dport)) {
583 * Lookup dest by {svc,addr,port} in the destination trash.
584 * The destination trash is used to hold the destinations that are removed
585 * from the service table but are still referenced by some conn entries.
586 * The reason to add the destination trash is when the dest is temporary
587 * down (either by administrator or by monitor program), the dest can be
588 * picked back from the trash, the remaining connections to the dest can
589 * continue, and the counting information of the dest is also useful for
592 static struct ip_vs_dest *
593 ip_vs_trash_get_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
595 struct ip_vs_dest *dest, *nxt;
598 * Find the destination in trash
600 list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
601 IP_VS_DBG(3, "Destination %u/%u.%u.%u.%u:%u still in trash, "
604 NIPQUAD(dest->addr), ntohs(dest->port),
605 atomic_read(&dest->refcnt));
606 if (dest->addr == daddr &&
607 dest->port == dport &&
608 dest->vfwmark == svc->fwmark &&
609 dest->protocol == svc->protocol &&
611 (dest->vaddr == svc->addr &&
612 dest->vport == svc->port))) {
618 * Try to purge the destination from trash if not referenced
620 if (atomic_read(&dest->refcnt) == 1) {
621 IP_VS_DBG(3, "Removing destination %u/%u.%u.%u.%u:%u "
624 NIPQUAD(dest->addr), ntohs(dest->port));
625 list_del(&dest->n_list);
626 ip_vs_dst_reset(dest);
627 __ip_vs_unbind_svc(dest);
637 * Clean up all the destinations in the trash
638 * Called by the ip_vs_control_cleanup()
640 * When the ip_vs_control_clearup is activated by ipvs module exit,
641 * the service tables must have been flushed and all the connections
642 * are expired, and the refcnt of each destination in the trash must
643 * be 1, so we simply release them here.
645 static void ip_vs_trash_cleanup(void)
647 struct ip_vs_dest *dest, *nxt;
649 list_for_each_entry_safe(dest, nxt, &ip_vs_dest_trash, n_list) {
650 list_del(&dest->n_list);
651 ip_vs_dst_reset(dest);
652 __ip_vs_unbind_svc(dest);
659 ip_vs_zero_stats(struct ip_vs_stats *stats)
661 spin_lock_bh(&stats->lock);
662 memset(stats, 0, (char *)&stats->lock - (char *)stats);
663 spin_unlock_bh(&stats->lock);
664 ip_vs_zero_estimator(stats);
668 * Update a destination in the given service
671 __ip_vs_update_dest(struct ip_vs_service *svc,
672 struct ip_vs_dest *dest, struct ip_vs_dest_user *udest)
676 /* set the weight and the flags */
677 atomic_set(&dest->weight, udest->weight);
678 conn_flags = udest->conn_flags | IP_VS_CONN_F_INACTIVE;
680 /* check if local node and update the flags */
681 if (inet_addr_type(udest->addr) == RTN_LOCAL) {
682 conn_flags = (conn_flags & ~IP_VS_CONN_F_FWD_MASK)
683 | IP_VS_CONN_F_LOCALNODE;
686 /* set the IP_VS_CONN_F_NOOUTPUT flag if not masquerading/NAT */
687 if ((conn_flags & IP_VS_CONN_F_FWD_MASK) != 0) {
688 conn_flags |= IP_VS_CONN_F_NOOUTPUT;
691 * Put the real service in ip_vs_rtable if not present.
692 * For now only for NAT!
694 write_lock_bh(&__ip_vs_rs_lock);
696 write_unlock_bh(&__ip_vs_rs_lock);
698 atomic_set(&dest->conn_flags, conn_flags);
700 /* bind the service */
702 __ip_vs_bind_svc(dest, svc);
704 if (dest->svc != svc) {
705 __ip_vs_unbind_svc(dest);
706 ip_vs_zero_stats(&dest->stats);
707 __ip_vs_bind_svc(dest, svc);
711 /* set the dest status flags */
712 dest->flags |= IP_VS_DEST_F_AVAILABLE;
714 if (udest->u_threshold == 0 || udest->u_threshold > dest->u_threshold)
715 dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
716 dest->u_threshold = udest->u_threshold;
717 dest->l_threshold = udest->l_threshold;
722 * Create a destination for the given service
725 ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest,
726 struct ip_vs_dest **dest_p)
728 struct ip_vs_dest *dest;
733 atype = inet_addr_type(udest->addr);
734 if (atype != RTN_LOCAL && atype != RTN_UNICAST)
737 dest = kzalloc(sizeof(struct ip_vs_dest), GFP_ATOMIC);
739 IP_VS_ERR("ip_vs_new_dest: kmalloc failed.\n");
743 dest->protocol = svc->protocol;
744 dest->vaddr = svc->addr;
745 dest->vport = svc->port;
746 dest->vfwmark = svc->fwmark;
747 dest->addr = udest->addr;
748 dest->port = udest->port;
750 atomic_set(&dest->activeconns, 0);
751 atomic_set(&dest->inactconns, 0);
752 atomic_set(&dest->persistconns, 0);
753 atomic_set(&dest->refcnt, 0);
755 INIT_LIST_HEAD(&dest->d_list);
756 spin_lock_init(&dest->dst_lock);
757 spin_lock_init(&dest->stats.lock);
758 __ip_vs_update_dest(svc, dest, udest);
759 ip_vs_new_estimator(&dest->stats);
769 * Add a destination into an existing service
772 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
774 struct ip_vs_dest *dest;
775 __be32 daddr = udest->addr;
776 __be16 dport = udest->port;
781 if (udest->weight < 0) {
782 IP_VS_ERR("ip_vs_add_dest(): server weight less than zero\n");
786 if (udest->l_threshold > udest->u_threshold) {
787 IP_VS_ERR("ip_vs_add_dest(): lower threshold is higher than "
788 "upper threshold\n");
793 * Check if the dest already exists in the list
795 dest = ip_vs_lookup_dest(svc, daddr, dport);
797 IP_VS_DBG(1, "ip_vs_add_dest(): dest already exists\n");
802 * Check if the dest already exists in the trash and
803 * is from the same service
805 dest = ip_vs_trash_get_dest(svc, daddr, dport);
807 IP_VS_DBG(3, "Get destination %u.%u.%u.%u:%u from trash, "
808 "dest->refcnt=%d, service %u/%u.%u.%u.%u:%u\n",
809 NIPQUAD(daddr), ntohs(dport),
810 atomic_read(&dest->refcnt),
812 NIPQUAD(dest->vaddr),
814 __ip_vs_update_dest(svc, dest, udest);
817 * Get the destination from the trash
819 list_del(&dest->n_list);
821 ip_vs_new_estimator(&dest->stats);
823 write_lock_bh(&__ip_vs_svc_lock);
826 * Wait until all other svc users go away.
828 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
830 list_add(&dest->n_list, &svc->destinations);
833 /* call the update_service function of its scheduler */
834 svc->scheduler->update_service(svc);
836 write_unlock_bh(&__ip_vs_svc_lock);
841 * Allocate and initialize the dest structure
843 ret = ip_vs_new_dest(svc, udest, &dest);
849 * Add the dest entry into the list
851 atomic_inc(&dest->refcnt);
853 write_lock_bh(&__ip_vs_svc_lock);
856 * Wait until all other svc users go away.
858 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
860 list_add(&dest->n_list, &svc->destinations);
863 /* call the update_service function of its scheduler */
864 svc->scheduler->update_service(svc);
866 write_unlock_bh(&__ip_vs_svc_lock);
875 * Edit a destination in the given service
878 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
880 struct ip_vs_dest *dest;
881 __be32 daddr = udest->addr;
882 __be16 dport = udest->port;
886 if (udest->weight < 0) {
887 IP_VS_ERR("ip_vs_edit_dest(): server weight less than zero\n");
891 if (udest->l_threshold > udest->u_threshold) {
892 IP_VS_ERR("ip_vs_edit_dest(): lower threshold is higher than "
893 "upper threshold\n");
898 * Lookup the destination list
900 dest = ip_vs_lookup_dest(svc, daddr, dport);
902 IP_VS_DBG(1, "ip_vs_edit_dest(): dest doesn't exist\n");
906 __ip_vs_update_dest(svc, dest, udest);
908 write_lock_bh(&__ip_vs_svc_lock);
910 /* Wait until all other svc users go away */
911 while (atomic_read(&svc->usecnt) > 1) {};
913 /* call the update_service, because server weight may be changed */
914 svc->scheduler->update_service(svc);
916 write_unlock_bh(&__ip_vs_svc_lock);
925 * Delete a destination (must be already unlinked from the service)
927 static void __ip_vs_del_dest(struct ip_vs_dest *dest)
929 ip_vs_kill_estimator(&dest->stats);
932 * Remove it from the d-linked list with the real services.
934 write_lock_bh(&__ip_vs_rs_lock);
935 ip_vs_rs_unhash(dest);
936 write_unlock_bh(&__ip_vs_rs_lock);
939 * Decrease the refcnt of the dest, and free the dest
940 * if nobody refers to it (refcnt=0). Otherwise, throw
941 * the destination into the trash.
943 if (atomic_dec_and_test(&dest->refcnt)) {
944 ip_vs_dst_reset(dest);
945 /* simply decrease svc->refcnt here, let the caller check
946 and release the service if nobody refers to it.
947 Only user context can release destination and service,
948 and only one user context can update virtual service at a
949 time, so the operation here is OK */
950 atomic_dec(&dest->svc->refcnt);
953 IP_VS_DBG(3, "Moving dest %u.%u.%u.%u:%u into trash, "
955 NIPQUAD(dest->addr), ntohs(dest->port),
956 atomic_read(&dest->refcnt));
957 list_add(&dest->n_list, &ip_vs_dest_trash);
958 atomic_inc(&dest->refcnt);
964 * Unlink a destination from the given service
966 static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
967 struct ip_vs_dest *dest,
970 dest->flags &= ~IP_VS_DEST_F_AVAILABLE;
973 * Remove it from the d-linked destination list.
975 list_del(&dest->n_list);
979 * Call the update_service function of its scheduler
981 svc->scheduler->update_service(svc);
987 * Delete a destination server in the given service
990 ip_vs_del_dest(struct ip_vs_service *svc,struct ip_vs_dest_user *udest)
992 struct ip_vs_dest *dest;
993 __be32 daddr = udest->addr;
994 __be16 dport = udest->port;
998 dest = ip_vs_lookup_dest(svc, daddr, dport);
1000 IP_VS_DBG(1, "ip_vs_del_dest(): destination not found!\n");
1004 write_lock_bh(&__ip_vs_svc_lock);
1007 * Wait until all other svc users go away.
1009 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1012 * Unlink dest from the service
1014 __ip_vs_unlink_dest(svc, dest, 1);
1016 write_unlock_bh(&__ip_vs_svc_lock);
1019 * Delete the destination
1021 __ip_vs_del_dest(dest);
1030 * Add a service into the service hash table
1033 ip_vs_add_service(struct ip_vs_service_user *u, struct ip_vs_service **svc_p)
1036 struct ip_vs_scheduler *sched = NULL;
1037 struct ip_vs_service *svc = NULL;
1039 /* increase the module use count */
1040 ip_vs_use_count_inc();
1042 /* Lookup the scheduler by 'u->sched_name' */
1043 sched = ip_vs_scheduler_get(u->sched_name);
1044 if (sched == NULL) {
1045 IP_VS_INFO("Scheduler module ip_vs_%s not found\n",
1051 svc = kzalloc(sizeof(struct ip_vs_service), GFP_ATOMIC);
1053 IP_VS_DBG(1, "ip_vs_add_service: kmalloc failed.\n");
1058 /* I'm the first user of the service */
1059 atomic_set(&svc->usecnt, 1);
1060 atomic_set(&svc->refcnt, 0);
1062 svc->protocol = u->protocol;
1063 svc->addr = u->addr;
1064 svc->port = u->port;
1065 svc->fwmark = u->fwmark;
1066 svc->flags = u->flags;
1067 svc->timeout = u->timeout * HZ;
1068 svc->netmask = u->netmask;
1070 INIT_LIST_HEAD(&svc->destinations);
1071 rwlock_init(&svc->sched_lock);
1072 spin_lock_init(&svc->stats.lock);
1074 /* Bind the scheduler */
1075 ret = ip_vs_bind_scheduler(svc, sched);
1080 /* Update the virtual service counters */
1081 if (svc->port == FTPPORT)
1082 atomic_inc(&ip_vs_ftpsvc_counter);
1083 else if (svc->port == 0)
1084 atomic_inc(&ip_vs_nullsvc_counter);
1086 ip_vs_new_estimator(&svc->stats);
1087 ip_vs_num_services++;
1089 /* Hash the service into the service table */
1090 write_lock_bh(&__ip_vs_svc_lock);
1091 ip_vs_svc_hash(svc);
1092 write_unlock_bh(&__ip_vs_svc_lock);
1100 ip_vs_unbind_scheduler(svc);
1103 ip_vs_app_inc_put(svc->inc);
1108 ip_vs_scheduler_put(sched);
1111 /* decrease the module use count */
1112 ip_vs_use_count_dec();
1119 * Edit a service and bind it with a new scheduler
1122 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user *u)
1124 struct ip_vs_scheduler *sched, *old_sched;
1128 * Lookup the scheduler, by 'u->sched_name'
1130 sched = ip_vs_scheduler_get(u->sched_name);
1131 if (sched == NULL) {
1132 IP_VS_INFO("Scheduler module ip_vs_%s not found\n",
1138 write_lock_bh(&__ip_vs_svc_lock);
1141 * Wait until all other svc users go away.
1143 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1146 * Set the flags and timeout value
1148 svc->flags = u->flags | IP_VS_SVC_F_HASHED;
1149 svc->timeout = u->timeout * HZ;
1150 svc->netmask = u->netmask;
1152 old_sched = svc->scheduler;
1153 if (sched != old_sched) {
1155 * Unbind the old scheduler
1157 if ((ret = ip_vs_unbind_scheduler(svc))) {
1163 * Bind the new scheduler
1165 if ((ret = ip_vs_bind_scheduler(svc, sched))) {
1167 * If ip_vs_bind_scheduler fails, restore the old
1169 * The main reason of failure is out of memory.
1171 * The question is if the old scheduler can be
1172 * restored all the time. TODO: if it cannot be
1173 * restored some time, we must delete the service,
1174 * otherwise the system may crash.
1176 ip_vs_bind_scheduler(svc, old_sched);
1183 write_unlock_bh(&__ip_vs_svc_lock);
1186 ip_vs_scheduler_put(old_sched);
1193 * Delete a service from the service list
1194 * - The service must be unlinked, unlocked and not referenced!
1195 * - We are called under _bh lock
1197 static void __ip_vs_del_service(struct ip_vs_service *svc)
1199 struct ip_vs_dest *dest, *nxt;
1200 struct ip_vs_scheduler *old_sched;
1202 ip_vs_num_services--;
1203 ip_vs_kill_estimator(&svc->stats);
1205 /* Unbind scheduler */
1206 old_sched = svc->scheduler;
1207 ip_vs_unbind_scheduler(svc);
1209 ip_vs_scheduler_put(old_sched);
1211 /* Unbind app inc */
1213 ip_vs_app_inc_put(svc->inc);
1218 * Unlink the whole destination list
1220 list_for_each_entry_safe(dest, nxt, &svc->destinations, n_list) {
1221 __ip_vs_unlink_dest(svc, dest, 0);
1222 __ip_vs_del_dest(dest);
1226 * Update the virtual service counters
1228 if (svc->port == FTPPORT)
1229 atomic_dec(&ip_vs_ftpsvc_counter);
1230 else if (svc->port == 0)
1231 atomic_dec(&ip_vs_nullsvc_counter);
1234 * Free the service if nobody refers to it
1236 if (atomic_read(&svc->refcnt) == 0)
1239 /* decrease the module use count */
1240 ip_vs_use_count_dec();
1244 * Delete a service from the service list
1246 static int ip_vs_del_service(struct ip_vs_service *svc)
1252 * Unhash it from the service table
1254 write_lock_bh(&__ip_vs_svc_lock);
1256 ip_vs_svc_unhash(svc);
1259 * Wait until all the svc users go away.
1261 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
1263 __ip_vs_del_service(svc);
1265 write_unlock_bh(&__ip_vs_svc_lock);
1272 * Flush all the virtual services
1274 static int ip_vs_flush(void)
1277 struct ip_vs_service *svc, *nxt;
1280 * Flush the service table hashed by <protocol,addr,port>
1282 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1283 list_for_each_entry_safe(svc, nxt, &ip_vs_svc_table[idx], s_list) {
1284 write_lock_bh(&__ip_vs_svc_lock);
1285 ip_vs_svc_unhash(svc);
1287 * Wait until all the svc users go away.
1289 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1290 __ip_vs_del_service(svc);
1291 write_unlock_bh(&__ip_vs_svc_lock);
1296 * Flush the service table hashed by fwmark
1298 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1299 list_for_each_entry_safe(svc, nxt,
1300 &ip_vs_svc_fwm_table[idx], f_list) {
1301 write_lock_bh(&__ip_vs_svc_lock);
1302 ip_vs_svc_unhash(svc);
1304 * Wait until all the svc users go away.
1306 IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 0);
1307 __ip_vs_del_service(svc);
1308 write_unlock_bh(&__ip_vs_svc_lock);
1317 * Zero counters in a service or all services
1319 static int ip_vs_zero_service(struct ip_vs_service *svc)
1321 struct ip_vs_dest *dest;
1323 write_lock_bh(&__ip_vs_svc_lock);
1324 list_for_each_entry(dest, &svc->destinations, n_list) {
1325 ip_vs_zero_stats(&dest->stats);
1327 ip_vs_zero_stats(&svc->stats);
1328 write_unlock_bh(&__ip_vs_svc_lock);
1332 static int ip_vs_zero_all(void)
1335 struct ip_vs_service *svc;
1337 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1338 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1339 ip_vs_zero_service(svc);
1343 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1344 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1345 ip_vs_zero_service(svc);
1349 ip_vs_zero_stats(&ip_vs_stats);
1355 proc_do_defense_mode(ctl_table *table, int write, struct file * filp,
1356 void __user *buffer, size_t *lenp, loff_t *ppos)
1358 int *valp = table->data;
1362 rc = proc_dointvec(table, write, filp, buffer, lenp, ppos);
1363 if (write && (*valp != val)) {
1364 if ((*valp < 0) || (*valp > 3)) {
1365 /* Restore the correct value */
1368 update_defense_level();
1376 proc_do_sync_threshold(ctl_table *table, int write, struct file *filp,
1377 void __user *buffer, size_t *lenp, loff_t *ppos)
1379 int *valp = table->data;
1383 /* backup the value first */
1384 memcpy(val, valp, sizeof(val));
1386 rc = proc_dointvec(table, write, filp, buffer, lenp, ppos);
1387 if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
1388 /* Restore the correct value */
1389 memcpy(valp, val, sizeof(val));
1396 * IPVS sysctl table (under the /proc/sys/net/ipv4/vs/)
1399 static struct ctl_table vs_vars[] = {
1401 .ctl_name = NET_IPV4_VS_AMEMTHRESH,
1402 .procname = "amemthresh",
1403 .data = &sysctl_ip_vs_amemthresh,
1404 .maxlen = sizeof(int),
1406 .proc_handler = &proc_dointvec,
1408 #ifdef CONFIG_IP_VS_DEBUG
1410 .ctl_name = NET_IPV4_VS_DEBUG_LEVEL,
1411 .procname = "debug_level",
1412 .data = &sysctl_ip_vs_debug_level,
1413 .maxlen = sizeof(int),
1415 .proc_handler = &proc_dointvec,
1419 .ctl_name = NET_IPV4_VS_AMDROPRATE,
1420 .procname = "am_droprate",
1421 .data = &sysctl_ip_vs_am_droprate,
1422 .maxlen = sizeof(int),
1424 .proc_handler = &proc_dointvec,
1427 .ctl_name = NET_IPV4_VS_DROP_ENTRY,
1428 .procname = "drop_entry",
1429 .data = &sysctl_ip_vs_drop_entry,
1430 .maxlen = sizeof(int),
1432 .proc_handler = &proc_do_defense_mode,
1435 .ctl_name = NET_IPV4_VS_DROP_PACKET,
1436 .procname = "drop_packet",
1437 .data = &sysctl_ip_vs_drop_packet,
1438 .maxlen = sizeof(int),
1440 .proc_handler = &proc_do_defense_mode,
1443 .ctl_name = NET_IPV4_VS_SECURE_TCP,
1444 .procname = "secure_tcp",
1445 .data = &sysctl_ip_vs_secure_tcp,
1446 .maxlen = sizeof(int),
1448 .proc_handler = &proc_do_defense_mode,
1452 .ctl_name = NET_IPV4_VS_TO_ES,
1453 .procname = "timeout_established",
1454 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ESTABLISHED],
1455 .maxlen = sizeof(int),
1457 .proc_handler = &proc_dointvec_jiffies,
1460 .ctl_name = NET_IPV4_VS_TO_SS,
1461 .procname = "timeout_synsent",
1462 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_SENT],
1463 .maxlen = sizeof(int),
1465 .proc_handler = &proc_dointvec_jiffies,
1468 .ctl_name = NET_IPV4_VS_TO_SR,
1469 .procname = "timeout_synrecv",
1470 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYN_RECV],
1471 .maxlen = sizeof(int),
1473 .proc_handler = &proc_dointvec_jiffies,
1476 .ctl_name = NET_IPV4_VS_TO_FW,
1477 .procname = "timeout_finwait",
1478 .data = &vs_timeout_table_dos.timeout[IP_VS_S_FIN_WAIT],
1479 .maxlen = sizeof(int),
1481 .proc_handler = &proc_dointvec_jiffies,
1484 .ctl_name = NET_IPV4_VS_TO_TW,
1485 .procname = "timeout_timewait",
1486 .data = &vs_timeout_table_dos.timeout[IP_VS_S_TIME_WAIT],
1487 .maxlen = sizeof(int),
1489 .proc_handler = &proc_dointvec_jiffies,
1492 .ctl_name = NET_IPV4_VS_TO_CL,
1493 .procname = "timeout_close",
1494 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE],
1495 .maxlen = sizeof(int),
1497 .proc_handler = &proc_dointvec_jiffies,
1500 .ctl_name = NET_IPV4_VS_TO_CW,
1501 .procname = "timeout_closewait",
1502 .data = &vs_timeout_table_dos.timeout[IP_VS_S_CLOSE_WAIT],
1503 .maxlen = sizeof(int),
1505 .proc_handler = &proc_dointvec_jiffies,
1508 .ctl_name = NET_IPV4_VS_TO_LA,
1509 .procname = "timeout_lastack",
1510 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LAST_ACK],
1511 .maxlen = sizeof(int),
1513 .proc_handler = &proc_dointvec_jiffies,
1516 .ctl_name = NET_IPV4_VS_TO_LI,
1517 .procname = "timeout_listen",
1518 .data = &vs_timeout_table_dos.timeout[IP_VS_S_LISTEN],
1519 .maxlen = sizeof(int),
1521 .proc_handler = &proc_dointvec_jiffies,
1524 .ctl_name = NET_IPV4_VS_TO_SA,
1525 .procname = "timeout_synack",
1526 .data = &vs_timeout_table_dos.timeout[IP_VS_S_SYNACK],
1527 .maxlen = sizeof(int),
1529 .proc_handler = &proc_dointvec_jiffies,
1532 .ctl_name = NET_IPV4_VS_TO_UDP,
1533 .procname = "timeout_udp",
1534 .data = &vs_timeout_table_dos.timeout[IP_VS_S_UDP],
1535 .maxlen = sizeof(int),
1537 .proc_handler = &proc_dointvec_jiffies,
1540 .ctl_name = NET_IPV4_VS_TO_ICMP,
1541 .procname = "timeout_icmp",
1542 .data = &vs_timeout_table_dos.timeout[IP_VS_S_ICMP],
1543 .maxlen = sizeof(int),
1545 .proc_handler = &proc_dointvec_jiffies,
1549 .ctl_name = NET_IPV4_VS_CACHE_BYPASS,
1550 .procname = "cache_bypass",
1551 .data = &sysctl_ip_vs_cache_bypass,
1552 .maxlen = sizeof(int),
1554 .proc_handler = &proc_dointvec,
1557 .ctl_name = NET_IPV4_VS_EXPIRE_NODEST_CONN,
1558 .procname = "expire_nodest_conn",
1559 .data = &sysctl_ip_vs_expire_nodest_conn,
1560 .maxlen = sizeof(int),
1562 .proc_handler = &proc_dointvec,
1565 .ctl_name = NET_IPV4_VS_EXPIRE_QUIESCENT_TEMPLATE,
1566 .procname = "expire_quiescent_template",
1567 .data = &sysctl_ip_vs_expire_quiescent_template,
1568 .maxlen = sizeof(int),
1570 .proc_handler = &proc_dointvec,
1573 .ctl_name = NET_IPV4_VS_SYNC_THRESHOLD,
1574 .procname = "sync_threshold",
1575 .data = &sysctl_ip_vs_sync_threshold,
1576 .maxlen = sizeof(sysctl_ip_vs_sync_threshold),
1578 .proc_handler = &proc_do_sync_threshold,
1581 .ctl_name = NET_IPV4_VS_NAT_ICMP_SEND,
1582 .procname = "nat_icmp_send",
1583 .data = &sysctl_ip_vs_nat_icmp_send,
1584 .maxlen = sizeof(int),
1586 .proc_handler = &proc_dointvec,
1591 static ctl_table vs_table[] = {
1593 .ctl_name = NET_IPV4_VS,
1601 static ctl_table ipvs_ipv4_table[] = {
1603 .ctl_name = NET_IPV4,
1611 static ctl_table vs_root_table[] = {
1613 .ctl_name = CTL_NET,
1616 .child = ipvs_ipv4_table,
1621 static struct ctl_table_header * sysctl_header;
1623 #ifdef CONFIG_PROC_FS
1626 struct list_head *table;
1631 * Write the contents of the VS rule table to a PROCfs file.
1632 * (It is kept just for backward compatibility)
1634 static inline const char *ip_vs_fwd_name(unsigned flags)
1636 switch (flags & IP_VS_CONN_F_FWD_MASK) {
1637 case IP_VS_CONN_F_LOCALNODE:
1639 case IP_VS_CONN_F_TUNNEL:
1641 case IP_VS_CONN_F_DROUTE:
1649 /* Get the Nth entry in the two lists */
1650 static struct ip_vs_service *ip_vs_info_array(struct seq_file *seq, loff_t pos)
1652 struct ip_vs_iter *iter = seq->private;
1654 struct ip_vs_service *svc;
1656 /* look in hash by protocol */
1657 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1658 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1660 iter->table = ip_vs_svc_table;
1667 /* keep looking in fwmark */
1668 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1669 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1671 iter->table = ip_vs_svc_fwm_table;
1681 static void *ip_vs_info_seq_start(struct seq_file *seq, loff_t *pos)
1684 read_lock_bh(&__ip_vs_svc_lock);
1685 return *pos ? ip_vs_info_array(seq, *pos - 1) : SEQ_START_TOKEN;
1689 static void *ip_vs_info_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1691 struct list_head *e;
1692 struct ip_vs_iter *iter;
1693 struct ip_vs_service *svc;
1696 if (v == SEQ_START_TOKEN)
1697 return ip_vs_info_array(seq,0);
1700 iter = seq->private;
1702 if (iter->table == ip_vs_svc_table) {
1703 /* next service in table hashed by protocol */
1704 if ((e = svc->s_list.next) != &ip_vs_svc_table[iter->bucket])
1705 return list_entry(e, struct ip_vs_service, s_list);
1708 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1709 list_for_each_entry(svc,&ip_vs_svc_table[iter->bucket],
1715 iter->table = ip_vs_svc_fwm_table;
1720 /* next service in hashed by fwmark */
1721 if ((e = svc->f_list.next) != &ip_vs_svc_fwm_table[iter->bucket])
1722 return list_entry(e, struct ip_vs_service, f_list);
1725 while (++iter->bucket < IP_VS_SVC_TAB_SIZE) {
1726 list_for_each_entry(svc, &ip_vs_svc_fwm_table[iter->bucket],
1734 static void ip_vs_info_seq_stop(struct seq_file *seq, void *v)
1736 read_unlock_bh(&__ip_vs_svc_lock);
1740 static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
1742 if (v == SEQ_START_TOKEN) {
1744 "IP Virtual Server version %d.%d.%d (size=%d)\n",
1745 NVERSION(IP_VS_VERSION_CODE), IP_VS_CONN_TAB_SIZE);
1747 "Prot LocalAddress:Port Scheduler Flags\n");
1749 " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n");
1751 const struct ip_vs_service *svc = v;
1752 const struct ip_vs_iter *iter = seq->private;
1753 const struct ip_vs_dest *dest;
1755 if (iter->table == ip_vs_svc_table)
1756 seq_printf(seq, "%s %08X:%04X %s ",
1757 ip_vs_proto_name(svc->protocol),
1760 svc->scheduler->name);
1762 seq_printf(seq, "FWM %08X %s ",
1763 svc->fwmark, svc->scheduler->name);
1765 if (svc->flags & IP_VS_SVC_F_PERSISTENT)
1766 seq_printf(seq, "persistent %d %08X\n",
1768 ntohl(svc->netmask));
1770 seq_putc(seq, '\n');
1772 list_for_each_entry(dest, &svc->destinations, n_list) {
1774 " -> %08X:%04X %-7s %-6d %-10d %-10d\n",
1775 ntohl(dest->addr), ntohs(dest->port),
1776 ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
1777 atomic_read(&dest->weight),
1778 atomic_read(&dest->activeconns),
1779 atomic_read(&dest->inactconns));
1785 static const struct seq_operations ip_vs_info_seq_ops = {
1786 .start = ip_vs_info_seq_start,
1787 .next = ip_vs_info_seq_next,
1788 .stop = ip_vs_info_seq_stop,
1789 .show = ip_vs_info_seq_show,
1792 static int ip_vs_info_open(struct inode *inode, struct file *file)
1794 struct seq_file *seq;
1796 struct ip_vs_iter *s = kzalloc(sizeof(*s), GFP_KERNEL);
1801 rc = seq_open(file, &ip_vs_info_seq_ops);
1805 seq = file->private_data;
1814 static const struct file_operations ip_vs_info_fops = {
1815 .owner = THIS_MODULE,
1816 .open = ip_vs_info_open,
1818 .llseek = seq_lseek,
1819 .release = seq_release_private,
1824 struct ip_vs_stats ip_vs_stats;
1826 #ifdef CONFIG_PROC_FS
1827 static int ip_vs_stats_show(struct seq_file *seq, void *v)
1830 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
1832 " Total Incoming Outgoing Incoming Outgoing\n");
1834 " Conns Packets Packets Bytes Bytes\n");
1836 spin_lock_bh(&ip_vs_stats.lock);
1837 seq_printf(seq, "%8X %8X %8X %16LX %16LX\n\n", ip_vs_stats.conns,
1838 ip_vs_stats.inpkts, ip_vs_stats.outpkts,
1839 (unsigned long long) ip_vs_stats.inbytes,
1840 (unsigned long long) ip_vs_stats.outbytes);
1842 /* 01234567 01234567 01234567 0123456701234567 0123456701234567 */
1844 " Conns/s Pkts/s Pkts/s Bytes/s Bytes/s\n");
1845 seq_printf(seq,"%8X %8X %8X %16X %16X\n",
1850 ip_vs_stats.outbps);
1851 spin_unlock_bh(&ip_vs_stats.lock);
1856 static int ip_vs_stats_seq_open(struct inode *inode, struct file *file)
1858 return single_open(file, ip_vs_stats_show, NULL);
1861 static const struct file_operations ip_vs_stats_fops = {
1862 .owner = THIS_MODULE,
1863 .open = ip_vs_stats_seq_open,
1865 .llseek = seq_lseek,
1866 .release = single_release,
1872 * Set timeout values for tcp tcpfin udp in the timeout_table.
1874 static int ip_vs_set_timeout(struct ip_vs_timeout_user *u)
1876 IP_VS_DBG(2, "Setting timeout tcp:%d tcpfin:%d udp:%d\n",
1881 #ifdef CONFIG_IP_VS_PROTO_TCP
1882 if (u->tcp_timeout) {
1883 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED]
1884 = u->tcp_timeout * HZ;
1887 if (u->tcp_fin_timeout) {
1888 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT]
1889 = u->tcp_fin_timeout * HZ;
1893 #ifdef CONFIG_IP_VS_PROTO_UDP
1894 if (u->udp_timeout) {
1895 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL]
1896 = u->udp_timeout * HZ;
1903 #define SET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
1904 #define SERVICE_ARG_LEN (sizeof(struct ip_vs_service_user))
1905 #define SVCDEST_ARG_LEN (sizeof(struct ip_vs_service_user) + \
1906 sizeof(struct ip_vs_dest_user))
1907 #define TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
1908 #define DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user))
1909 #define MAX_ARG_LEN SVCDEST_ARG_LEN
1911 static const unsigned char set_arglen[SET_CMDID(IP_VS_SO_SET_MAX)+1] = {
1912 [SET_CMDID(IP_VS_SO_SET_ADD)] = SERVICE_ARG_LEN,
1913 [SET_CMDID(IP_VS_SO_SET_EDIT)] = SERVICE_ARG_LEN,
1914 [SET_CMDID(IP_VS_SO_SET_DEL)] = SERVICE_ARG_LEN,
1915 [SET_CMDID(IP_VS_SO_SET_FLUSH)] = 0,
1916 [SET_CMDID(IP_VS_SO_SET_ADDDEST)] = SVCDEST_ARG_LEN,
1917 [SET_CMDID(IP_VS_SO_SET_DELDEST)] = SVCDEST_ARG_LEN,
1918 [SET_CMDID(IP_VS_SO_SET_EDITDEST)] = SVCDEST_ARG_LEN,
1919 [SET_CMDID(IP_VS_SO_SET_TIMEOUT)] = TIMEOUT_ARG_LEN,
1920 [SET_CMDID(IP_VS_SO_SET_STARTDAEMON)] = DAEMON_ARG_LEN,
1921 [SET_CMDID(IP_VS_SO_SET_STOPDAEMON)] = DAEMON_ARG_LEN,
1922 [SET_CMDID(IP_VS_SO_SET_ZERO)] = SERVICE_ARG_LEN,
1926 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1929 unsigned char arg[MAX_ARG_LEN];
1930 struct ip_vs_service_user *usvc;
1931 struct ip_vs_service *svc;
1932 struct ip_vs_dest_user *udest;
1934 if (!capable(CAP_NET_ADMIN))
1937 if (len != set_arglen[SET_CMDID(cmd)]) {
1938 IP_VS_ERR("set_ctl: len %u != %u\n",
1939 len, set_arglen[SET_CMDID(cmd)]);
1943 if (copy_from_user(arg, user, len) != 0)
1946 /* increase the module use count */
1947 ip_vs_use_count_inc();
1949 if (mutex_lock_interruptible(&__ip_vs_mutex)) {
1954 if (cmd == IP_VS_SO_SET_FLUSH) {
1955 /* Flush the virtual service */
1956 ret = ip_vs_flush();
1958 } else if (cmd == IP_VS_SO_SET_TIMEOUT) {
1959 /* Set timeout values for (tcp tcpfin udp) */
1960 ret = ip_vs_set_timeout((struct ip_vs_timeout_user *)arg);
1962 } else if (cmd == IP_VS_SO_SET_STARTDAEMON) {
1963 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
1964 ret = start_sync_thread(dm->state, dm->mcast_ifn, dm->syncid);
1966 } else if (cmd == IP_VS_SO_SET_STOPDAEMON) {
1967 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
1968 ret = stop_sync_thread(dm->state);
1972 usvc = (struct ip_vs_service_user *)arg;
1973 udest = (struct ip_vs_dest_user *)(usvc + 1);
1975 if (cmd == IP_VS_SO_SET_ZERO) {
1976 /* if no service address is set, zero counters in all */
1977 if (!usvc->fwmark && !usvc->addr && !usvc->port) {
1978 ret = ip_vs_zero_all();
1983 /* Check for valid protocol: TCP or UDP, even for fwmark!=0 */
1984 if (usvc->protocol!=IPPROTO_TCP && usvc->protocol!=IPPROTO_UDP) {
1985 IP_VS_ERR("set_ctl: invalid protocol: %d %d.%d.%d.%d:%d %s\n",
1986 usvc->protocol, NIPQUAD(usvc->addr),
1987 ntohs(usvc->port), usvc->sched_name);
1992 /* Lookup the exact service by <protocol, addr, port> or fwmark */
1993 if (usvc->fwmark == 0)
1994 svc = __ip_vs_service_get(usvc->protocol,
1995 usvc->addr, usvc->port);
1997 svc = __ip_vs_svc_fwm_get(usvc->fwmark);
1999 if (cmd != IP_VS_SO_SET_ADD
2000 && (svc == NULL || svc->protocol != usvc->protocol)) {
2006 case IP_VS_SO_SET_ADD:
2010 ret = ip_vs_add_service(usvc, &svc);
2012 case IP_VS_SO_SET_EDIT:
2013 ret = ip_vs_edit_service(svc, usvc);
2015 case IP_VS_SO_SET_DEL:
2016 ret = ip_vs_del_service(svc);
2020 case IP_VS_SO_SET_ZERO:
2021 ret = ip_vs_zero_service(svc);
2023 case IP_VS_SO_SET_ADDDEST:
2024 ret = ip_vs_add_dest(svc, udest);
2026 case IP_VS_SO_SET_EDITDEST:
2027 ret = ip_vs_edit_dest(svc, udest);
2029 case IP_VS_SO_SET_DELDEST:
2030 ret = ip_vs_del_dest(svc, udest);
2037 ip_vs_service_put(svc);
2040 mutex_unlock(&__ip_vs_mutex);
2042 /* decrease the module use count */
2043 ip_vs_use_count_dec();
2050 ip_vs_copy_stats(struct ip_vs_stats_user *dst, struct ip_vs_stats *src)
2052 spin_lock_bh(&src->lock);
2053 memcpy(dst, src, (char*)&src->lock - (char*)src);
2054 spin_unlock_bh(&src->lock);
2058 ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
2060 dst->protocol = src->protocol;
2061 dst->addr = src->addr;
2062 dst->port = src->port;
2063 dst->fwmark = src->fwmark;
2064 strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
2065 dst->flags = src->flags;
2066 dst->timeout = src->timeout / HZ;
2067 dst->netmask = src->netmask;
2068 dst->num_dests = src->num_dests;
2069 ip_vs_copy_stats(&dst->stats, &src->stats);
2073 __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
2074 struct ip_vs_get_services __user *uptr)
2077 struct ip_vs_service *svc;
2078 struct ip_vs_service_entry entry;
2081 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2082 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
2083 if (count >= get->num_services)
2085 memset(&entry, 0, sizeof(entry));
2086 ip_vs_copy_service(&entry, svc);
2087 if (copy_to_user(&uptr->entrytable[count],
2088 &entry, sizeof(entry))) {
2096 for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2097 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
2098 if (count >= get->num_services)
2100 memset(&entry, 0, sizeof(entry));
2101 ip_vs_copy_service(&entry, svc);
2102 if (copy_to_user(&uptr->entrytable[count],
2103 &entry, sizeof(entry))) {
2115 __ip_vs_get_dest_entries(const struct ip_vs_get_dests *get,
2116 struct ip_vs_get_dests __user *uptr)
2118 struct ip_vs_service *svc;
2122 svc = __ip_vs_svc_fwm_get(get->fwmark);
2124 svc = __ip_vs_service_get(get->protocol,
2125 get->addr, get->port);
2128 struct ip_vs_dest *dest;
2129 struct ip_vs_dest_entry entry;
2131 list_for_each_entry(dest, &svc->destinations, n_list) {
2132 if (count >= get->num_dests)
2135 entry.addr = dest->addr;
2136 entry.port = dest->port;
2137 entry.conn_flags = atomic_read(&dest->conn_flags);
2138 entry.weight = atomic_read(&dest->weight);
2139 entry.u_threshold = dest->u_threshold;
2140 entry.l_threshold = dest->l_threshold;
2141 entry.activeconns = atomic_read(&dest->activeconns);
2142 entry.inactconns = atomic_read(&dest->inactconns);
2143 entry.persistconns = atomic_read(&dest->persistconns);
2144 ip_vs_copy_stats(&entry.stats, &dest->stats);
2145 if (copy_to_user(&uptr->entrytable[count],
2146 &entry, sizeof(entry))) {
2152 ip_vs_service_put(svc);
2159 __ip_vs_get_timeouts(struct ip_vs_timeout_user *u)
2161 #ifdef CONFIG_IP_VS_PROTO_TCP
2163 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_ESTABLISHED] / HZ;
2164 u->tcp_fin_timeout =
2165 ip_vs_protocol_tcp.timeout_table[IP_VS_TCP_S_FIN_WAIT] / HZ;
2167 #ifdef CONFIG_IP_VS_PROTO_UDP
2169 ip_vs_protocol_udp.timeout_table[IP_VS_UDP_S_NORMAL] / HZ;
2174 #define GET_CMDID(cmd) (cmd - IP_VS_BASE_CTL)
2175 #define GET_INFO_ARG_LEN (sizeof(struct ip_vs_getinfo))
2176 #define GET_SERVICES_ARG_LEN (sizeof(struct ip_vs_get_services))
2177 #define GET_SERVICE_ARG_LEN (sizeof(struct ip_vs_service_entry))
2178 #define GET_DESTS_ARG_LEN (sizeof(struct ip_vs_get_dests))
2179 #define GET_TIMEOUT_ARG_LEN (sizeof(struct ip_vs_timeout_user))
2180 #define GET_DAEMON_ARG_LEN (sizeof(struct ip_vs_daemon_user) * 2)
2182 static const unsigned char get_arglen[GET_CMDID(IP_VS_SO_GET_MAX)+1] = {
2183 [GET_CMDID(IP_VS_SO_GET_VERSION)] = 64,
2184 [GET_CMDID(IP_VS_SO_GET_INFO)] = GET_INFO_ARG_LEN,
2185 [GET_CMDID(IP_VS_SO_GET_SERVICES)] = GET_SERVICES_ARG_LEN,
2186 [GET_CMDID(IP_VS_SO_GET_SERVICE)] = GET_SERVICE_ARG_LEN,
2187 [GET_CMDID(IP_VS_SO_GET_DESTS)] = GET_DESTS_ARG_LEN,
2188 [GET_CMDID(IP_VS_SO_GET_TIMEOUT)] = GET_TIMEOUT_ARG_LEN,
2189 [GET_CMDID(IP_VS_SO_GET_DAEMON)] = GET_DAEMON_ARG_LEN,
2193 do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2195 unsigned char arg[128];
2198 if (!capable(CAP_NET_ADMIN))
2201 if (*len < get_arglen[GET_CMDID(cmd)]) {
2202 IP_VS_ERR("get_ctl: len %u < %u\n",
2203 *len, get_arglen[GET_CMDID(cmd)]);
2207 if (copy_from_user(arg, user, get_arglen[GET_CMDID(cmd)]) != 0)
2210 if (mutex_lock_interruptible(&__ip_vs_mutex))
2211 return -ERESTARTSYS;
2214 case IP_VS_SO_GET_VERSION:
2218 sprintf(buf, "IP Virtual Server version %d.%d.%d (size=%d)",
2219 NVERSION(IP_VS_VERSION_CODE), IP_VS_CONN_TAB_SIZE);
2220 if (copy_to_user(user, buf, strlen(buf)+1) != 0) {
2224 *len = strlen(buf)+1;
2228 case IP_VS_SO_GET_INFO:
2230 struct ip_vs_getinfo info;
2231 info.version = IP_VS_VERSION_CODE;
2232 info.size = IP_VS_CONN_TAB_SIZE;
2233 info.num_services = ip_vs_num_services;
2234 if (copy_to_user(user, &info, sizeof(info)) != 0)
2239 case IP_VS_SO_GET_SERVICES:
2241 struct ip_vs_get_services *get;
2244 get = (struct ip_vs_get_services *)arg;
2245 size = sizeof(*get) +
2246 sizeof(struct ip_vs_service_entry) * get->num_services;
2248 IP_VS_ERR("length: %u != %u\n", *len, size);
2252 ret = __ip_vs_get_service_entries(get, user);
2256 case IP_VS_SO_GET_SERVICE:
2258 struct ip_vs_service_entry *entry;
2259 struct ip_vs_service *svc;
2261 entry = (struct ip_vs_service_entry *)arg;
2263 svc = __ip_vs_svc_fwm_get(entry->fwmark);
2265 svc = __ip_vs_service_get(entry->protocol,
2266 entry->addr, entry->port);
2268 ip_vs_copy_service(entry, svc);
2269 if (copy_to_user(user, entry, sizeof(*entry)) != 0)
2271 ip_vs_service_put(svc);
2277 case IP_VS_SO_GET_DESTS:
2279 struct ip_vs_get_dests *get;
2282 get = (struct ip_vs_get_dests *)arg;
2283 size = sizeof(*get) +
2284 sizeof(struct ip_vs_dest_entry) * get->num_dests;
2286 IP_VS_ERR("length: %u != %u\n", *len, size);
2290 ret = __ip_vs_get_dest_entries(get, user);
2294 case IP_VS_SO_GET_TIMEOUT:
2296 struct ip_vs_timeout_user t;
2298 __ip_vs_get_timeouts(&t);
2299 if (copy_to_user(user, &t, sizeof(t)) != 0)
2304 case IP_VS_SO_GET_DAEMON:
2306 struct ip_vs_daemon_user d[2];
2308 memset(&d, 0, sizeof(d));
2309 if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
2310 d[0].state = IP_VS_STATE_MASTER;
2311 strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
2312 d[0].syncid = ip_vs_master_syncid;
2314 if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
2315 d[1].state = IP_VS_STATE_BACKUP;
2316 strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
2317 d[1].syncid = ip_vs_backup_syncid;
2319 if (copy_to_user(user, &d, sizeof(d)) != 0)
2329 mutex_unlock(&__ip_vs_mutex);
2334 static struct nf_sockopt_ops ip_vs_sockopts = {
2336 .set_optmin = IP_VS_BASE_CTL,
2337 .set_optmax = IP_VS_SO_SET_MAX+1,
2338 .set = do_ip_vs_set_ctl,
2339 .get_optmin = IP_VS_BASE_CTL,
2340 .get_optmax = IP_VS_SO_GET_MAX+1,
2341 .get = do_ip_vs_get_ctl,
2345 int ip_vs_control_init(void)
2352 ret = nf_register_sockopt(&ip_vs_sockopts);
2354 IP_VS_ERR("cannot register sockopt.\n");
2358 proc_net_fops_create("ip_vs", 0, &ip_vs_info_fops);
2359 proc_net_fops_create("ip_vs_stats",0, &ip_vs_stats_fops);
2361 sysctl_header = register_sysctl_table(vs_root_table);
2363 /* Initialize ip_vs_svc_table, ip_vs_svc_fwm_table, ip_vs_rtable */
2364 for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
2365 INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
2366 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
2368 for(idx = 0; idx < IP_VS_RTAB_SIZE; idx++) {
2369 INIT_LIST_HEAD(&ip_vs_rtable[idx]);
2372 memset(&ip_vs_stats, 0, sizeof(ip_vs_stats));
2373 spin_lock_init(&ip_vs_stats.lock);
2374 ip_vs_new_estimator(&ip_vs_stats);
2376 /* Hook the defense timer */
2377 schedule_delayed_work(&defense_work, DEFENSE_TIMER_PERIOD);
2384 void ip_vs_control_cleanup(void)
2387 ip_vs_trash_cleanup();
2388 cancel_rearming_delayed_work(&defense_work);
2389 cancel_work_sync(&defense_work.work);
2390 ip_vs_kill_estimator(&ip_vs_stats);
2391 unregister_sysctl_table(sysctl_header);
2392 proc_net_remove("ip_vs_stats");
2393 proc_net_remove("ip_vs");
2394 nf_unregister_sockopt(&ip_vs_sockopts);