1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* IP Virtual Server 3 * data structure and functionality definitions 4 */ 5 6 #ifndef _NET_IP_VS_H 7 #define _NET_IP_VS_H 8 9 #include <linux/ip_vs.h> /* definitions shared with userland */ 10 11 #include <asm/types.h> /* for __uXX types */ 12 13 #include <linux/list.h> /* for struct list_head */ 14 #include <linux/spinlock.h> /* for struct rwlock_t */ 15 #include <linux/atomic.h> /* for struct atomic_t */ 16 #include <linux/refcount.h> /* for struct refcount_t */ 17 18 #include <linux/compiler.h> 19 #include <linux/timer.h> 20 #include <linux/bug.h> 21 22 #include <net/checksum.h> 23 #include <linux/netfilter.h> /* for union nf_inet_addr */ 24 #include <linux/ip.h> 25 #include <linux/ipv6.h> /* for struct ipv6hdr */ 26 #include <net/ipv6.h> 27 #if IS_ENABLED(CONFIG_IP_VS_IPV6) 28 #include <linux/netfilter_ipv6/ip6_tables.h> 29 #endif 30 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 31 #include <net/netfilter/nf_conntrack.h> 32 #endif 33 #include <net/net_namespace.h> /* Netw namespace */ 34 35 #define IP_VS_HDR_INVERSE 1 36 #define IP_VS_HDR_ICMP 2 37 38 /* Generic access of ipvs struct */ 39 static inline struct netns_ipvs *net_ipvs(struct net* net) 40 { 41 return net->ipvs; 42 } 43 44 /* This one needed for single_open_net since net is stored directly in 45 * private not as a struct i.e. seq_file_net can't be used. 46 */ 47 static inline struct net *seq_file_single_net(struct seq_file *seq) 48 { 49 #ifdef CONFIG_NET_NS 50 return (struct net *)seq->private; 51 #else 52 return &init_net; 53 #endif 54 } 55 56 /* Connections' size value needed by ip_vs_ctl.c */ 57 extern int ip_vs_conn_tab_size; 58 59 struct ip_vs_iphdr { 60 int hdr_flags; /* ipvs flags */ 61 __u32 off; /* Where IP or IPv4 header starts */ 62 __u32 len; /* IPv4 simply where L4 starts 63 * IPv6 where L4 Transport Header starts */ 64 __u16 fragoffs; /* IPv6 fragment offset, 0 if first frag (or not frag)*/ 65 __s16 protocol; 66 __s32 flags; 67 union nf_inet_addr saddr; 68 union nf_inet_addr daddr; 69 }; 70 71 static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset, 72 int len, void *buffer, 73 const struct ip_vs_iphdr *ipvsh) 74 { 75 return skb_header_pointer(skb, offset, len, buffer); 76 } 77 78 /* This function handles filling *ip_vs_iphdr, both for IPv4 and IPv6. 79 * IPv6 requires some extra work, as finding proper header position, 80 * depend on the IPv6 extension headers. 81 */ 82 static inline int 83 ip_vs_fill_iph_skb_off(int af, const struct sk_buff *skb, int offset, 84 int hdr_flags, struct ip_vs_iphdr *iphdr) 85 { 86 iphdr->hdr_flags = hdr_flags; 87 iphdr->off = offset; 88 89 #ifdef CONFIG_IP_VS_IPV6 90 if (af == AF_INET6) { 91 struct ipv6hdr _iph; 92 const struct ipv6hdr *iph = skb_header_pointer( 93 skb, offset, sizeof(_iph), &_iph); 94 if (!iph) 95 return 0; 96 97 iphdr->saddr.in6 = iph->saddr; 98 iphdr->daddr.in6 = iph->daddr; 99 /* ipv6_find_hdr() updates len, flags */ 100 iphdr->len = offset; 101 iphdr->flags = 0; 102 iphdr->protocol = ipv6_find_hdr(skb, &iphdr->len, -1, 103 &iphdr->fragoffs, 104 &iphdr->flags); 105 if (iphdr->protocol < 0) 106 return 0; 107 } else 108 #endif 109 { 110 struct iphdr _iph; 111 const struct iphdr *iph = skb_header_pointer( 112 skb, offset, sizeof(_iph), &_iph); 113 if (!iph) 114 return 0; 115 116 iphdr->len = offset + iph->ihl * 4; 117 iphdr->fragoffs = 0; 118 iphdr->protocol = iph->protocol; 119 iphdr->saddr.ip = iph->saddr; 120 iphdr->daddr.ip = iph->daddr; 121 } 122 123 return 1; 124 } 125 126 static inline int 127 ip_vs_fill_iph_skb_icmp(int af, const struct sk_buff *skb, int offset, 128 bool inverse, struct ip_vs_iphdr *iphdr) 129 { 130 int hdr_flags = IP_VS_HDR_ICMP; 131 132 if (inverse) 133 hdr_flags |= IP_VS_HDR_INVERSE; 134 135 return ip_vs_fill_iph_skb_off(af, skb, offset, hdr_flags, iphdr); 136 } 137 138 static inline int 139 ip_vs_fill_iph_skb(int af, const struct sk_buff *skb, bool inverse, 140 struct ip_vs_iphdr *iphdr) 141 { 142 int hdr_flags = 0; 143 144 if (inverse) 145 hdr_flags |= IP_VS_HDR_INVERSE; 146 147 return ip_vs_fill_iph_skb_off(af, skb, skb_network_offset(skb), 148 hdr_flags, iphdr); 149 } 150 151 static inline bool 152 ip_vs_iph_inverse(const struct ip_vs_iphdr *iph) 153 { 154 return !!(iph->hdr_flags & IP_VS_HDR_INVERSE); 155 } 156 157 static inline bool 158 ip_vs_iph_icmp(const struct ip_vs_iphdr *iph) 159 { 160 return !!(iph->hdr_flags & IP_VS_HDR_ICMP); 161 } 162 163 static inline void ip_vs_addr_copy(int af, union nf_inet_addr *dst, 164 const union nf_inet_addr *src) 165 { 166 #ifdef CONFIG_IP_VS_IPV6 167 if (af == AF_INET6) 168 dst->in6 = src->in6; 169 else 170 #endif 171 dst->ip = src->ip; 172 } 173 174 static inline void ip_vs_addr_set(int af, union nf_inet_addr *dst, 175 const union nf_inet_addr *src) 176 { 177 #ifdef CONFIG_IP_VS_IPV6 178 if (af == AF_INET6) { 179 dst->in6 = src->in6; 180 return; 181 } 182 #endif 183 dst->ip = src->ip; 184 dst->all[1] = 0; 185 dst->all[2] = 0; 186 dst->all[3] = 0; 187 } 188 189 static inline int ip_vs_addr_equal(int af, const union nf_inet_addr *a, 190 const union nf_inet_addr *b) 191 { 192 #ifdef CONFIG_IP_VS_IPV6 193 if (af == AF_INET6) 194 return ipv6_addr_equal(&a->in6, &b->in6); 195 #endif 196 return a->ip == b->ip; 197 } 198 199 #ifdef CONFIG_IP_VS_DEBUG 200 #include <linux/net.h> 201 202 int ip_vs_get_debug_level(void); 203 204 static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len, 205 const union nf_inet_addr *addr, 206 int *idx) 207 { 208 int len; 209 #ifdef CONFIG_IP_VS_IPV6 210 if (af == AF_INET6) 211 len = snprintf(&buf[*idx], buf_len - *idx, "[%pI6c]", 212 &addr->in6) + 1; 213 else 214 #endif 215 len = snprintf(&buf[*idx], buf_len - *idx, "%pI4", 216 &addr->ip) + 1; 217 218 *idx += len; 219 BUG_ON(*idx > buf_len + 1); 220 return &buf[*idx - len]; 221 } 222 223 #define IP_VS_DBG_BUF(level, msg, ...) \ 224 do { \ 225 char ip_vs_dbg_buf[160]; \ 226 int ip_vs_dbg_idx = 0; \ 227 if (level <= ip_vs_get_debug_level()) \ 228 printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__); \ 229 } while (0) 230 #define IP_VS_ERR_BUF(msg...) \ 231 do { \ 232 char ip_vs_dbg_buf[160]; \ 233 int ip_vs_dbg_idx = 0; \ 234 pr_err(msg); \ 235 } while (0) 236 237 /* Only use from within IP_VS_DBG_BUF() or IP_VS_ERR_BUF macros */ 238 #define IP_VS_DBG_ADDR(af, addr) \ 239 ip_vs_dbg_addr(af, ip_vs_dbg_buf, \ 240 sizeof(ip_vs_dbg_buf), addr, \ 241 &ip_vs_dbg_idx) 242 243 #define IP_VS_DBG(level, msg, ...) \ 244 do { \ 245 if (level <= ip_vs_get_debug_level()) \ 246 printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__); \ 247 } while (0) 248 #define IP_VS_DBG_RL(msg, ...) \ 249 do { \ 250 if (net_ratelimit()) \ 251 printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__); \ 252 } while (0) 253 #define IP_VS_DBG_PKT(level, af, pp, skb, ofs, msg) \ 254 do { \ 255 if (level <= ip_vs_get_debug_level()) \ 256 pp->debug_packet(af, pp, skb, ofs, msg); \ 257 } while (0) 258 #define IP_VS_DBG_RL_PKT(level, af, pp, skb, ofs, msg) \ 259 do { \ 260 if (level <= ip_vs_get_debug_level() && \ 261 net_ratelimit()) \ 262 pp->debug_packet(af, pp, skb, ofs, msg); \ 263 } while (0) 264 #else /* NO DEBUGGING at ALL */ 265 #define IP_VS_DBG_BUF(level, msg...) do {} while (0) 266 #define IP_VS_ERR_BUF(msg...) do {} while (0) 267 #define IP_VS_DBG(level, msg...) do {} while (0) 268 #define IP_VS_DBG_RL(msg...) do {} while (0) 269 #define IP_VS_DBG_PKT(level, af, pp, skb, ofs, msg) do {} while (0) 270 #define IP_VS_DBG_RL_PKT(level, af, pp, skb, ofs, msg) do {} while (0) 271 #endif 272 273 #define IP_VS_BUG() BUG() 274 #define IP_VS_ERR_RL(msg, ...) \ 275 do { \ 276 if (net_ratelimit()) \ 277 pr_err(msg, ##__VA_ARGS__); \ 278 } while (0) 279 280 #ifdef CONFIG_IP_VS_DEBUG 281 #define EnterFunction(level) \ 282 do { \ 283 if (level <= ip_vs_get_debug_level()) \ 284 printk(KERN_DEBUG \ 285 pr_fmt("Enter: %s, %s line %i\n"), \ 286 __func__, __FILE__, __LINE__); \ 287 } while (0) 288 #define LeaveFunction(level) \ 289 do { \ 290 if (level <= ip_vs_get_debug_level()) \ 291 printk(KERN_DEBUG \ 292 pr_fmt("Leave: %s, %s line %i\n"), \ 293 __func__, __FILE__, __LINE__); \ 294 } while (0) 295 #else 296 #define EnterFunction(level) do {} while (0) 297 #define LeaveFunction(level) do {} while (0) 298 #endif 299 300 /* The port number of FTP service (in network order). */ 301 #define FTPPORT cpu_to_be16(21) 302 #define FTPDATA cpu_to_be16(20) 303 304 /* TCP State Values */ 305 enum { 306 IP_VS_TCP_S_NONE = 0, 307 IP_VS_TCP_S_ESTABLISHED, 308 IP_VS_TCP_S_SYN_SENT, 309 IP_VS_TCP_S_SYN_RECV, 310 IP_VS_TCP_S_FIN_WAIT, 311 IP_VS_TCP_S_TIME_WAIT, 312 IP_VS_TCP_S_CLOSE, 313 IP_VS_TCP_S_CLOSE_WAIT, 314 IP_VS_TCP_S_LAST_ACK, 315 IP_VS_TCP_S_LISTEN, 316 IP_VS_TCP_S_SYNACK, 317 IP_VS_TCP_S_LAST 318 }; 319 320 /* UDP State Values */ 321 enum { 322 IP_VS_UDP_S_NORMAL, 323 IP_VS_UDP_S_LAST, 324 }; 325 326 /* ICMP State Values */ 327 enum { 328 IP_VS_ICMP_S_NORMAL, 329 IP_VS_ICMP_S_LAST, 330 }; 331 332 /* SCTP State Values */ 333 enum ip_vs_sctp_states { 334 IP_VS_SCTP_S_NONE, 335 IP_VS_SCTP_S_INIT1, 336 IP_VS_SCTP_S_INIT, 337 IP_VS_SCTP_S_COOKIE_SENT, 338 IP_VS_SCTP_S_COOKIE_REPLIED, 339 IP_VS_SCTP_S_COOKIE_WAIT, 340 IP_VS_SCTP_S_COOKIE, 341 IP_VS_SCTP_S_COOKIE_ECHOED, 342 IP_VS_SCTP_S_ESTABLISHED, 343 IP_VS_SCTP_S_SHUTDOWN_SENT, 344 IP_VS_SCTP_S_SHUTDOWN_RECEIVED, 345 IP_VS_SCTP_S_SHUTDOWN_ACK_SENT, 346 IP_VS_SCTP_S_REJECTED, 347 IP_VS_SCTP_S_CLOSED, 348 IP_VS_SCTP_S_LAST 349 }; 350 351 /* Delta sequence info structure 352 * Each ip_vs_conn has 2 (output AND input seq. changes). 353 * Only used in the VS/NAT. 354 */ 355 struct ip_vs_seq { 356 __u32 init_seq; /* Add delta from this seq */ 357 __u32 delta; /* Delta in sequence numbers */ 358 __u32 previous_delta; /* Delta in sequence numbers 359 * before last resized pkt */ 360 }; 361 362 /* counters per cpu */ 363 struct ip_vs_counters { 364 __u64 conns; /* connections scheduled */ 365 __u64 inpkts; /* incoming packets */ 366 __u64 outpkts; /* outgoing packets */ 367 __u64 inbytes; /* incoming bytes */ 368 __u64 outbytes; /* outgoing bytes */ 369 }; 370 /* Stats per cpu */ 371 struct ip_vs_cpu_stats { 372 struct ip_vs_counters cnt; 373 struct u64_stats_sync syncp; 374 }; 375 376 /* IPVS statistics objects */ 377 struct ip_vs_estimator { 378 struct list_head list; 379 380 u64 last_inbytes; 381 u64 last_outbytes; 382 u64 last_conns; 383 u64 last_inpkts; 384 u64 last_outpkts; 385 386 u64 cps; 387 u64 inpps; 388 u64 outpps; 389 u64 inbps; 390 u64 outbps; 391 }; 392 393 /* 394 * IPVS statistics object, 64-bit kernel version of struct ip_vs_stats_user 395 */ 396 struct ip_vs_kstats { 397 u64 conns; /* connections scheduled */ 398 u64 inpkts; /* incoming packets */ 399 u64 outpkts; /* outgoing packets */ 400 u64 inbytes; /* incoming bytes */ 401 u64 outbytes; /* outgoing bytes */ 402 403 u64 cps; /* current connection rate */ 404 u64 inpps; /* current in packet rate */ 405 u64 outpps; /* current out packet rate */ 406 u64 inbps; /* current in byte rate */ 407 u64 outbps; /* current out byte rate */ 408 }; 409 410 struct ip_vs_stats { 411 struct ip_vs_kstats kstats; /* kernel statistics */ 412 struct ip_vs_estimator est; /* estimator */ 413 struct ip_vs_cpu_stats __percpu *cpustats; /* per cpu counters */ 414 spinlock_t lock; /* spin lock */ 415 struct ip_vs_kstats kstats0; /* reset values */ 416 }; 417 418 struct dst_entry; 419 struct iphdr; 420 struct ip_vs_conn; 421 struct ip_vs_app; 422 struct sk_buff; 423 struct ip_vs_proto_data; 424 425 struct ip_vs_protocol { 426 struct ip_vs_protocol *next; 427 char *name; 428 u16 protocol; 429 u16 num_states; 430 int dont_defrag; 431 432 void (*init)(struct ip_vs_protocol *pp); 433 434 void (*exit)(struct ip_vs_protocol *pp); 435 436 int (*init_netns)(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd); 437 438 void (*exit_netns)(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd); 439 440 int (*conn_schedule)(struct netns_ipvs *ipvs, 441 int af, struct sk_buff *skb, 442 struct ip_vs_proto_data *pd, 443 int *verdict, struct ip_vs_conn **cpp, 444 struct ip_vs_iphdr *iph); 445 446 struct ip_vs_conn * 447 (*conn_in_get)(struct netns_ipvs *ipvs, 448 int af, 449 const struct sk_buff *skb, 450 const struct ip_vs_iphdr *iph); 451 452 struct ip_vs_conn * 453 (*conn_out_get)(struct netns_ipvs *ipvs, 454 int af, 455 const struct sk_buff *skb, 456 const struct ip_vs_iphdr *iph); 457 458 int (*snat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp, 459 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph); 460 461 int (*dnat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp, 462 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph); 463 464 int (*csum_check)(int af, struct sk_buff *skb, 465 struct ip_vs_protocol *pp); 466 467 const char *(*state_name)(int state); 468 469 void (*state_transition)(struct ip_vs_conn *cp, int direction, 470 const struct sk_buff *skb, 471 struct ip_vs_proto_data *pd); 472 473 int (*register_app)(struct netns_ipvs *ipvs, struct ip_vs_app *inc); 474 475 void (*unregister_app)(struct netns_ipvs *ipvs, struct ip_vs_app *inc); 476 477 int (*app_conn_bind)(struct ip_vs_conn *cp); 478 479 void (*debug_packet)(int af, struct ip_vs_protocol *pp, 480 const struct sk_buff *skb, 481 int offset, 482 const char *msg); 483 484 void (*timeout_change)(struct ip_vs_proto_data *pd, int flags); 485 }; 486 487 /* protocol data per netns */ 488 struct ip_vs_proto_data { 489 struct ip_vs_proto_data *next; 490 struct ip_vs_protocol *pp; 491 int *timeout_table; /* protocol timeout table */ 492 atomic_t appcnt; /* counter of proto app incs. */ 493 struct tcp_states_t *tcp_state_table; 494 }; 495 496 struct ip_vs_protocol *ip_vs_proto_get(unsigned short proto); 497 struct ip_vs_proto_data *ip_vs_proto_data_get(struct netns_ipvs *ipvs, 498 unsigned short proto); 499 500 struct ip_vs_conn_param { 501 struct netns_ipvs *ipvs; 502 const union nf_inet_addr *caddr; 503 const union nf_inet_addr *vaddr; 504 __be16 cport; 505 __be16 vport; 506 __u16 protocol; 507 u16 af; 508 509 const struct ip_vs_pe *pe; 510 char *pe_data; 511 __u8 pe_data_len; 512 }; 513 514 /* IP_VS structure allocated for each dynamically scheduled connection */ 515 struct ip_vs_conn { 516 struct hlist_node c_list; /* hashed list heads */ 517 /* Protocol, addresses and port numbers */ 518 __be16 cport; 519 __be16 dport; 520 __be16 vport; 521 u16 af; /* address family */ 522 union nf_inet_addr caddr; /* client address */ 523 union nf_inet_addr vaddr; /* virtual address */ 524 union nf_inet_addr daddr; /* destination address */ 525 volatile __u32 flags; /* status flags */ 526 __u16 protocol; /* Which protocol (TCP/UDP) */ 527 __u16 daf; /* Address family of the dest */ 528 struct netns_ipvs *ipvs; 529 530 /* counter and timer */ 531 refcount_t refcnt; /* reference count */ 532 struct timer_list timer; /* Expiration timer */ 533 volatile unsigned long timeout; /* timeout */ 534 535 /* Flags and state transition */ 536 spinlock_t lock; /* lock for state transition */ 537 volatile __u16 state; /* state info */ 538 volatile __u16 old_state; /* old state, to be used for 539 * state transition triggerd 540 * synchronization 541 */ 542 __u32 fwmark; /* Fire wall mark from skb */ 543 unsigned long sync_endtime; /* jiffies + sent_retries */ 544 545 /* Control members */ 546 struct ip_vs_conn *control; /* Master control connection */ 547 atomic_t n_control; /* Number of controlled ones */ 548 struct ip_vs_dest *dest; /* real server */ 549 atomic_t in_pkts; /* incoming packet counter */ 550 551 /* Packet transmitter for different forwarding methods. If it 552 * mangles the packet, it must return NF_DROP or better NF_STOLEN, 553 * otherwise this must be changed to a sk_buff **. 554 * NF_ACCEPT can be returned when destination is local. 555 */ 556 int (*packet_xmit)(struct sk_buff *skb, struct ip_vs_conn *cp, 557 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 558 559 /* Note: we can group the following members into a structure, 560 * in order to save more space, and the following members are 561 * only used in VS/NAT anyway 562 */ 563 struct ip_vs_app *app; /* bound ip_vs_app object */ 564 void *app_data; /* Application private data */ 565 struct ip_vs_seq in_seq; /* incoming seq. struct */ 566 struct ip_vs_seq out_seq; /* outgoing seq. struct */ 567 568 const struct ip_vs_pe *pe; 569 char *pe_data; 570 __u8 pe_data_len; 571 572 struct rcu_head rcu_head; 573 }; 574 575 /* Extended internal versions of struct ip_vs_service_user and ip_vs_dest_user 576 * for IPv6 support. 577 * 578 * We need these to conveniently pass around service and destination 579 * options, but unfortunately, we also need to keep the old definitions to 580 * maintain userspace backwards compatibility for the setsockopt interface. 581 */ 582 struct ip_vs_service_user_kern { 583 /* virtual service addresses */ 584 u16 af; 585 u16 protocol; 586 union nf_inet_addr addr; /* virtual ip address */ 587 __be16 port; 588 u32 fwmark; /* firwall mark of service */ 589 590 /* virtual service options */ 591 char *sched_name; 592 char *pe_name; 593 unsigned int flags; /* virtual service flags */ 594 unsigned int timeout; /* persistent timeout in sec */ 595 __be32 netmask; /* persistent netmask or plen */ 596 }; 597 598 599 struct ip_vs_dest_user_kern { 600 /* destination server address */ 601 union nf_inet_addr addr; 602 __be16 port; 603 604 /* real server options */ 605 unsigned int conn_flags; /* connection flags */ 606 int weight; /* destination weight */ 607 608 /* thresholds for active connections */ 609 u32 u_threshold; /* upper threshold */ 610 u32 l_threshold; /* lower threshold */ 611 612 /* Address family of addr */ 613 u16 af; 614 }; 615 616 617 /* 618 * The information about the virtual service offered to the net and the 619 * forwarding entries. 620 */ 621 struct ip_vs_service { 622 struct hlist_node s_list; /* for normal service table */ 623 struct hlist_node f_list; /* for fwmark-based service table */ 624 atomic_t refcnt; /* reference counter */ 625 626 u16 af; /* address family */ 627 __u16 protocol; /* which protocol (TCP/UDP) */ 628 union nf_inet_addr addr; /* IP address for virtual service */ 629 __be16 port; /* port number for the service */ 630 __u32 fwmark; /* firewall mark of the service */ 631 unsigned int flags; /* service status flags */ 632 unsigned int timeout; /* persistent timeout in ticks */ 633 __be32 netmask; /* grouping granularity, mask/plen */ 634 struct netns_ipvs *ipvs; 635 636 struct list_head destinations; /* real server d-linked list */ 637 __u32 num_dests; /* number of servers */ 638 struct ip_vs_stats stats; /* statistics for the service */ 639 640 /* for scheduling */ 641 struct ip_vs_scheduler __rcu *scheduler; /* bound scheduler object */ 642 spinlock_t sched_lock; /* lock sched_data */ 643 void *sched_data; /* scheduler application data */ 644 645 /* alternate persistence engine */ 646 struct ip_vs_pe __rcu *pe; 647 648 struct rcu_head rcu_head; 649 }; 650 651 /* Information for cached dst */ 652 struct ip_vs_dest_dst { 653 struct dst_entry *dst_cache; /* destination cache entry */ 654 u32 dst_cookie; 655 union nf_inet_addr dst_saddr; 656 struct rcu_head rcu_head; 657 }; 658 659 /* The real server destination forwarding entry with ip address, port number, 660 * and so on. 661 */ 662 struct ip_vs_dest { 663 struct list_head n_list; /* for the dests in the service */ 664 struct hlist_node d_list; /* for table with all the dests */ 665 666 u16 af; /* address family */ 667 __be16 port; /* port number of the server */ 668 union nf_inet_addr addr; /* IP address of the server */ 669 volatile unsigned int flags; /* dest status flags */ 670 atomic_t conn_flags; /* flags to copy to conn */ 671 atomic_t weight; /* server weight */ 672 673 refcount_t refcnt; /* reference counter */ 674 struct ip_vs_stats stats; /* statistics */ 675 unsigned long idle_start; /* start time, jiffies */ 676 677 /* connection counters and thresholds */ 678 atomic_t activeconns; /* active connections */ 679 atomic_t inactconns; /* inactive connections */ 680 atomic_t persistconns; /* persistent connections */ 681 __u32 u_threshold; /* upper threshold */ 682 __u32 l_threshold; /* lower threshold */ 683 684 /* for destination cache */ 685 spinlock_t dst_lock; /* lock of dst_cache */ 686 struct ip_vs_dest_dst __rcu *dest_dst; /* cached dst info */ 687 688 /* for virtual service */ 689 struct ip_vs_service __rcu *svc; /* service it belongs to */ 690 __u16 protocol; /* which protocol (TCP/UDP) */ 691 __be16 vport; /* virtual port number */ 692 union nf_inet_addr vaddr; /* virtual IP address */ 693 __u32 vfwmark; /* firewall mark of service */ 694 695 struct list_head t_list; /* in dest_trash */ 696 unsigned int in_rs_table:1; /* we are in rs_table */ 697 }; 698 699 /* The scheduler object */ 700 struct ip_vs_scheduler { 701 struct list_head n_list; /* d-linked list head */ 702 char *name; /* scheduler name */ 703 atomic_t refcnt; /* reference counter */ 704 struct module *module; /* THIS_MODULE/NULL */ 705 706 /* scheduler initializing service */ 707 int (*init_service)(struct ip_vs_service *svc); 708 /* scheduling service finish */ 709 void (*done_service)(struct ip_vs_service *svc); 710 /* dest is linked */ 711 int (*add_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest); 712 /* dest is unlinked */ 713 int (*del_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest); 714 /* dest is updated */ 715 int (*upd_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest); 716 717 /* selecting a server from the given service */ 718 struct ip_vs_dest* (*schedule)(struct ip_vs_service *svc, 719 const struct sk_buff *skb, 720 struct ip_vs_iphdr *iph); 721 }; 722 723 /* The persistence engine object */ 724 struct ip_vs_pe { 725 struct list_head n_list; /* d-linked list head */ 726 char *name; /* scheduler name */ 727 atomic_t refcnt; /* reference counter */ 728 struct module *module; /* THIS_MODULE/NULL */ 729 730 /* get the connection template, if any */ 731 int (*fill_param)(struct ip_vs_conn_param *p, struct sk_buff *skb); 732 bool (*ct_match)(const struct ip_vs_conn_param *p, 733 struct ip_vs_conn *ct); 734 u32 (*hashkey_raw)(const struct ip_vs_conn_param *p, u32 initval, 735 bool inverse); 736 int (*show_pe_data)(const struct ip_vs_conn *cp, char *buf); 737 /* create connections for real-server outgoing packets */ 738 struct ip_vs_conn* (*conn_out)(struct ip_vs_service *svc, 739 struct ip_vs_dest *dest, 740 struct sk_buff *skb, 741 const struct ip_vs_iphdr *iph, 742 __be16 dport, __be16 cport); 743 }; 744 745 /* The application module object (a.k.a. app incarnation) */ 746 struct ip_vs_app { 747 struct list_head a_list; /* member in app list */ 748 int type; /* IP_VS_APP_TYPE_xxx */ 749 char *name; /* application module name */ 750 __u16 protocol; 751 struct module *module; /* THIS_MODULE/NULL */ 752 struct list_head incs_list; /* list of incarnations */ 753 754 /* members for application incarnations */ 755 struct list_head p_list; /* member in proto app list */ 756 struct ip_vs_app *app; /* its real application */ 757 __be16 port; /* port number in net order */ 758 atomic_t usecnt; /* usage counter */ 759 struct rcu_head rcu_head; 760 761 /* output hook: Process packet in inout direction, diff set for TCP. 762 * Return: 0=Error, 1=Payload Not Mangled/Mangled but checksum is ok, 763 * 2=Mangled but checksum was not updated 764 */ 765 int (*pkt_out)(struct ip_vs_app *, struct ip_vs_conn *, 766 struct sk_buff *, int *diff); 767 768 /* input hook: Process packet in outin direction, diff set for TCP. 769 * Return: 0=Error, 1=Payload Not Mangled/Mangled but checksum is ok, 770 * 2=Mangled but checksum was not updated 771 */ 772 int (*pkt_in)(struct ip_vs_app *, struct ip_vs_conn *, 773 struct sk_buff *, int *diff); 774 775 /* ip_vs_app initializer */ 776 int (*init_conn)(struct ip_vs_app *, struct ip_vs_conn *); 777 778 /* ip_vs_app finish */ 779 int (*done_conn)(struct ip_vs_app *, struct ip_vs_conn *); 780 781 782 /* not used now */ 783 int (*bind_conn)(struct ip_vs_app *, struct ip_vs_conn *, 784 struct ip_vs_protocol *); 785 786 void (*unbind_conn)(struct ip_vs_app *, struct ip_vs_conn *); 787 788 int * timeout_table; 789 int * timeouts; 790 int timeouts_size; 791 792 int (*conn_schedule)(struct sk_buff *skb, struct ip_vs_app *app, 793 int *verdict, struct ip_vs_conn **cpp); 794 795 struct ip_vs_conn * 796 (*conn_in_get)(const struct sk_buff *skb, struct ip_vs_app *app, 797 const struct iphdr *iph, int inverse); 798 799 struct ip_vs_conn * 800 (*conn_out_get)(const struct sk_buff *skb, struct ip_vs_app *app, 801 const struct iphdr *iph, int inverse); 802 803 int (*state_transition)(struct ip_vs_conn *cp, int direction, 804 const struct sk_buff *skb, 805 struct ip_vs_app *app); 806 807 void (*timeout_change)(struct ip_vs_app *app, int flags); 808 }; 809 810 struct ipvs_master_sync_state { 811 struct list_head sync_queue; 812 struct ip_vs_sync_buff *sync_buff; 813 unsigned long sync_queue_len; 814 unsigned int sync_queue_delay; 815 struct task_struct *master_thread; 816 struct delayed_work master_wakeup_work; 817 struct netns_ipvs *ipvs; 818 }; 819 820 /* How much time to keep dests in trash */ 821 #define IP_VS_DEST_TRASH_PERIOD (120 * HZ) 822 823 struct ipvs_sync_daemon_cfg { 824 union nf_inet_addr mcast_group; 825 int syncid; 826 u16 sync_maxlen; 827 u16 mcast_port; 828 u8 mcast_af; 829 u8 mcast_ttl; 830 /* multicast interface name */ 831 char mcast_ifn[IP_VS_IFNAME_MAXLEN]; 832 }; 833 834 /* IPVS in network namespace */ 835 struct netns_ipvs { 836 int gen; /* Generation */ 837 int enable; /* enable like nf_hooks do */ 838 /* Hash table: for real service lookups */ 839 #define IP_VS_RTAB_BITS 4 840 #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS) 841 #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1) 842 843 struct hlist_head rs_table[IP_VS_RTAB_SIZE]; 844 /* ip_vs_app */ 845 struct list_head app_list; 846 /* ip_vs_proto */ 847 #define IP_VS_PROTO_TAB_SIZE 32 /* must be power of 2 */ 848 struct ip_vs_proto_data *proto_data_table[IP_VS_PROTO_TAB_SIZE]; 849 /* ip_vs_proto_tcp */ 850 #ifdef CONFIG_IP_VS_PROTO_TCP 851 #define TCP_APP_TAB_BITS 4 852 #define TCP_APP_TAB_SIZE (1 << TCP_APP_TAB_BITS) 853 #define TCP_APP_TAB_MASK (TCP_APP_TAB_SIZE - 1) 854 struct list_head tcp_apps[TCP_APP_TAB_SIZE]; 855 #endif 856 /* ip_vs_proto_udp */ 857 #ifdef CONFIG_IP_VS_PROTO_UDP 858 #define UDP_APP_TAB_BITS 4 859 #define UDP_APP_TAB_SIZE (1 << UDP_APP_TAB_BITS) 860 #define UDP_APP_TAB_MASK (UDP_APP_TAB_SIZE - 1) 861 struct list_head udp_apps[UDP_APP_TAB_SIZE]; 862 #endif 863 /* ip_vs_proto_sctp */ 864 #ifdef CONFIG_IP_VS_PROTO_SCTP 865 #define SCTP_APP_TAB_BITS 4 866 #define SCTP_APP_TAB_SIZE (1 << SCTP_APP_TAB_BITS) 867 #define SCTP_APP_TAB_MASK (SCTP_APP_TAB_SIZE - 1) 868 /* Hash table for SCTP application incarnations */ 869 struct list_head sctp_apps[SCTP_APP_TAB_SIZE]; 870 #endif 871 /* ip_vs_conn */ 872 atomic_t conn_count; /* connection counter */ 873 874 /* ip_vs_ctl */ 875 struct ip_vs_stats tot_stats; /* Statistics & est. */ 876 877 int num_services; /* no of virtual services */ 878 879 /* Trash for destinations */ 880 struct list_head dest_trash; 881 spinlock_t dest_trash_lock; 882 struct timer_list dest_trash_timer; /* expiration timer */ 883 /* Service counters */ 884 atomic_t ftpsvc_counter; 885 atomic_t nullsvc_counter; 886 atomic_t conn_out_counter; 887 888 #ifdef CONFIG_SYSCTL 889 /* 1/rate drop and drop-entry variables */ 890 struct delayed_work defense_work; /* Work handler */ 891 int drop_rate; 892 int drop_counter; 893 atomic_t dropentry; 894 /* locks in ctl.c */ 895 spinlock_t dropentry_lock; /* drop entry handling */ 896 spinlock_t droppacket_lock; /* drop packet handling */ 897 spinlock_t securetcp_lock; /* state and timeout tables */ 898 899 /* sys-ctl struct */ 900 struct ctl_table_header *sysctl_hdr; 901 struct ctl_table *sysctl_tbl; 902 #endif 903 904 /* sysctl variables */ 905 int sysctl_amemthresh; 906 int sysctl_am_droprate; 907 int sysctl_drop_entry; 908 int sysctl_drop_packet; 909 int sysctl_secure_tcp; 910 #ifdef CONFIG_IP_VS_NFCT 911 int sysctl_conntrack; 912 #endif 913 int sysctl_snat_reroute; 914 int sysctl_sync_ver; 915 int sysctl_sync_ports; 916 int sysctl_sync_persist_mode; 917 unsigned long sysctl_sync_qlen_max; 918 int sysctl_sync_sock_size; 919 int sysctl_cache_bypass; 920 int sysctl_expire_nodest_conn; 921 int sysctl_sloppy_tcp; 922 int sysctl_sloppy_sctp; 923 int sysctl_expire_quiescent_template; 924 int sysctl_sync_threshold[2]; 925 unsigned int sysctl_sync_refresh_period; 926 int sysctl_sync_retries; 927 int sysctl_nat_icmp_send; 928 int sysctl_pmtu_disc; 929 int sysctl_backup_only; 930 int sysctl_conn_reuse_mode; 931 int sysctl_schedule_icmp; 932 int sysctl_ignore_tunneled; 933 934 /* ip_vs_lblc */ 935 int sysctl_lblc_expiration; 936 struct ctl_table_header *lblc_ctl_header; 937 struct ctl_table *lblc_ctl_table; 938 /* ip_vs_lblcr */ 939 int sysctl_lblcr_expiration; 940 struct ctl_table_header *lblcr_ctl_header; 941 struct ctl_table *lblcr_ctl_table; 942 /* ip_vs_est */ 943 struct list_head est_list; /* estimator list */ 944 spinlock_t est_lock; 945 struct timer_list est_timer; /* Estimation timer */ 946 /* ip_vs_sync */ 947 spinlock_t sync_lock; 948 struct ipvs_master_sync_state *ms; 949 spinlock_t sync_buff_lock; 950 struct task_struct **backup_threads; 951 int threads_mask; 952 volatile int sync_state; 953 struct mutex sync_mutex; 954 struct ipvs_sync_daemon_cfg mcfg; /* Master Configuration */ 955 struct ipvs_sync_daemon_cfg bcfg; /* Backup Configuration */ 956 /* net name space ptr */ 957 struct net *net; /* Needed by timer routines */ 958 /* Number of heterogeneous destinations, needed becaus heterogeneous 959 * are not supported when synchronization is enabled. 960 */ 961 unsigned int mixed_address_family_dests; 962 }; 963 964 #define DEFAULT_SYNC_THRESHOLD 3 965 #define DEFAULT_SYNC_PERIOD 50 966 #define DEFAULT_SYNC_VER 1 967 #define DEFAULT_SLOPPY_TCP 0 968 #define DEFAULT_SLOPPY_SCTP 0 969 #define DEFAULT_SYNC_REFRESH_PERIOD (0U * HZ) 970 #define DEFAULT_SYNC_RETRIES 0 971 #define IPVS_SYNC_WAKEUP_RATE 8 972 #define IPVS_SYNC_QLEN_MAX (IPVS_SYNC_WAKEUP_RATE * 4) 973 #define IPVS_SYNC_SEND_DELAY (HZ / 50) 974 #define IPVS_SYNC_CHECK_PERIOD HZ 975 #define IPVS_SYNC_FLUSH_TIME (HZ * 2) 976 #define IPVS_SYNC_PORTS_MAX (1 << 6) 977 978 #ifdef CONFIG_SYSCTL 979 980 static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs) 981 { 982 return ipvs->sysctl_sync_threshold[0]; 983 } 984 985 static inline int sysctl_sync_period(struct netns_ipvs *ipvs) 986 { 987 return READ_ONCE(ipvs->sysctl_sync_threshold[1]); 988 } 989 990 static inline unsigned int sysctl_sync_refresh_period(struct netns_ipvs *ipvs) 991 { 992 return READ_ONCE(ipvs->sysctl_sync_refresh_period); 993 } 994 995 static inline int sysctl_sync_retries(struct netns_ipvs *ipvs) 996 { 997 return ipvs->sysctl_sync_retries; 998 } 999 1000 static inline int sysctl_sync_ver(struct netns_ipvs *ipvs) 1001 { 1002 return ipvs->sysctl_sync_ver; 1003 } 1004 1005 static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs) 1006 { 1007 return ipvs->sysctl_sloppy_tcp; 1008 } 1009 1010 static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs) 1011 { 1012 return ipvs->sysctl_sloppy_sctp; 1013 } 1014 1015 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs) 1016 { 1017 return READ_ONCE(ipvs->sysctl_sync_ports); 1018 } 1019 1020 static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs) 1021 { 1022 return ipvs->sysctl_sync_persist_mode; 1023 } 1024 1025 static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs) 1026 { 1027 return ipvs->sysctl_sync_qlen_max; 1028 } 1029 1030 static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs) 1031 { 1032 return ipvs->sysctl_sync_sock_size; 1033 } 1034 1035 static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs) 1036 { 1037 return ipvs->sysctl_pmtu_disc; 1038 } 1039 1040 static inline int sysctl_backup_only(struct netns_ipvs *ipvs) 1041 { 1042 return ipvs->sync_state & IP_VS_STATE_BACKUP && 1043 ipvs->sysctl_backup_only; 1044 } 1045 1046 static inline int sysctl_conn_reuse_mode(struct netns_ipvs *ipvs) 1047 { 1048 return ipvs->sysctl_conn_reuse_mode; 1049 } 1050 1051 static inline int sysctl_schedule_icmp(struct netns_ipvs *ipvs) 1052 { 1053 return ipvs->sysctl_schedule_icmp; 1054 } 1055 1056 static inline int sysctl_ignore_tunneled(struct netns_ipvs *ipvs) 1057 { 1058 return ipvs->sysctl_ignore_tunneled; 1059 } 1060 1061 static inline int sysctl_cache_bypass(struct netns_ipvs *ipvs) 1062 { 1063 return ipvs->sysctl_cache_bypass; 1064 } 1065 1066 #else 1067 1068 static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs) 1069 { 1070 return DEFAULT_SYNC_THRESHOLD; 1071 } 1072 1073 static inline int sysctl_sync_period(struct netns_ipvs *ipvs) 1074 { 1075 return DEFAULT_SYNC_PERIOD; 1076 } 1077 1078 static inline unsigned int sysctl_sync_refresh_period(struct netns_ipvs *ipvs) 1079 { 1080 return DEFAULT_SYNC_REFRESH_PERIOD; 1081 } 1082 1083 static inline int sysctl_sync_retries(struct netns_ipvs *ipvs) 1084 { 1085 return DEFAULT_SYNC_RETRIES & 3; 1086 } 1087 1088 static inline int sysctl_sync_ver(struct netns_ipvs *ipvs) 1089 { 1090 return DEFAULT_SYNC_VER; 1091 } 1092 1093 static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs) 1094 { 1095 return DEFAULT_SLOPPY_TCP; 1096 } 1097 1098 static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs) 1099 { 1100 return DEFAULT_SLOPPY_SCTP; 1101 } 1102 1103 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs) 1104 { 1105 return 1; 1106 } 1107 1108 static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs) 1109 { 1110 return 0; 1111 } 1112 1113 static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs) 1114 { 1115 return IPVS_SYNC_QLEN_MAX; 1116 } 1117 1118 static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs) 1119 { 1120 return 0; 1121 } 1122 1123 static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs) 1124 { 1125 return 1; 1126 } 1127 1128 static inline int sysctl_backup_only(struct netns_ipvs *ipvs) 1129 { 1130 return 0; 1131 } 1132 1133 static inline int sysctl_conn_reuse_mode(struct netns_ipvs *ipvs) 1134 { 1135 return 1; 1136 } 1137 1138 static inline int sysctl_schedule_icmp(struct netns_ipvs *ipvs) 1139 { 1140 return 0; 1141 } 1142 1143 static inline int sysctl_ignore_tunneled(struct netns_ipvs *ipvs) 1144 { 1145 return 0; 1146 } 1147 1148 static inline int sysctl_cache_bypass(struct netns_ipvs *ipvs) 1149 { 1150 return 0; 1151 } 1152 1153 #endif 1154 1155 /* IPVS core functions 1156 * (from ip_vs_core.c) 1157 */ 1158 const char *ip_vs_proto_name(unsigned int proto); 1159 void ip_vs_init_hash_table(struct list_head *table, int rows); 1160 struct ip_vs_conn *ip_vs_new_conn_out(struct ip_vs_service *svc, 1161 struct ip_vs_dest *dest, 1162 struct sk_buff *skb, 1163 const struct ip_vs_iphdr *iph, 1164 __be16 dport, 1165 __be16 cport); 1166 #define IP_VS_INIT_HASH_TABLE(t) ip_vs_init_hash_table((t), ARRAY_SIZE((t))) 1167 1168 #define IP_VS_APP_TYPE_FTP 1 1169 1170 /* ip_vs_conn handling functions 1171 * (from ip_vs_conn.c) 1172 */ 1173 enum { 1174 IP_VS_DIR_INPUT = 0, 1175 IP_VS_DIR_OUTPUT, 1176 IP_VS_DIR_INPUT_ONLY, 1177 IP_VS_DIR_LAST, 1178 }; 1179 1180 static inline void ip_vs_conn_fill_param(struct netns_ipvs *ipvs, int af, int protocol, 1181 const union nf_inet_addr *caddr, 1182 __be16 cport, 1183 const union nf_inet_addr *vaddr, 1184 __be16 vport, 1185 struct ip_vs_conn_param *p) 1186 { 1187 p->ipvs = ipvs; 1188 p->af = af; 1189 p->protocol = protocol; 1190 p->caddr = caddr; 1191 p->cport = cport; 1192 p->vaddr = vaddr; 1193 p->vport = vport; 1194 p->pe = NULL; 1195 p->pe_data = NULL; 1196 } 1197 1198 struct ip_vs_conn *ip_vs_conn_in_get(const struct ip_vs_conn_param *p); 1199 struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p); 1200 1201 struct ip_vs_conn * ip_vs_conn_in_get_proto(struct netns_ipvs *ipvs, int af, 1202 const struct sk_buff *skb, 1203 const struct ip_vs_iphdr *iph); 1204 1205 struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p); 1206 1207 struct ip_vs_conn * ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af, 1208 const struct sk_buff *skb, 1209 const struct ip_vs_iphdr *iph); 1210 1211 /* Get reference to gain full access to conn. 1212 * By default, RCU read-side critical sections have access only to 1213 * conn fields and its PE data, see ip_vs_conn_rcu_free() for reference. 1214 */ 1215 static inline bool __ip_vs_conn_get(struct ip_vs_conn *cp) 1216 { 1217 return refcount_inc_not_zero(&cp->refcnt); 1218 } 1219 1220 /* put back the conn without restarting its timer */ 1221 static inline void __ip_vs_conn_put(struct ip_vs_conn *cp) 1222 { 1223 smp_mb__before_atomic(); 1224 refcount_dec(&cp->refcnt); 1225 } 1226 void ip_vs_conn_put(struct ip_vs_conn *cp); 1227 void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport); 1228 1229 struct ip_vs_conn *ip_vs_conn_new(const struct ip_vs_conn_param *p, int dest_af, 1230 const union nf_inet_addr *daddr, 1231 __be16 dport, unsigned int flags, 1232 struct ip_vs_dest *dest, __u32 fwmark); 1233 void ip_vs_conn_expire_now(struct ip_vs_conn *cp); 1234 1235 const char *ip_vs_state_name(__u16 proto, int state); 1236 1237 void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp); 1238 int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest); 1239 void ip_vs_random_dropentry(struct netns_ipvs *ipvs); 1240 int ip_vs_conn_init(void); 1241 void ip_vs_conn_cleanup(void); 1242 1243 static inline void ip_vs_control_del(struct ip_vs_conn *cp) 1244 { 1245 struct ip_vs_conn *ctl_cp = cp->control; 1246 if (!ctl_cp) { 1247 IP_VS_ERR_BUF("request control DEL for uncontrolled: " 1248 "%s:%d to %s:%d\n", 1249 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1250 ntohs(cp->cport), 1251 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), 1252 ntohs(cp->vport)); 1253 1254 return; 1255 } 1256 1257 IP_VS_DBG_BUF(7, "DELeting control for: " 1258 "cp.dst=%s:%d ctl_cp.dst=%s:%d\n", 1259 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1260 ntohs(cp->cport), 1261 IP_VS_DBG_ADDR(cp->af, &ctl_cp->caddr), 1262 ntohs(ctl_cp->cport)); 1263 1264 cp->control = NULL; 1265 if (atomic_read(&ctl_cp->n_control) == 0) { 1266 IP_VS_ERR_BUF("BUG control DEL with n=0 : " 1267 "%s:%d to %s:%d\n", 1268 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1269 ntohs(cp->cport), 1270 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), 1271 ntohs(cp->vport)); 1272 1273 return; 1274 } 1275 atomic_dec(&ctl_cp->n_control); 1276 } 1277 1278 static inline void 1279 ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp) 1280 { 1281 if (cp->control) { 1282 IP_VS_ERR_BUF("request control ADD for already controlled: " 1283 "%s:%d to %s:%d\n", 1284 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1285 ntohs(cp->cport), 1286 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), 1287 ntohs(cp->vport)); 1288 1289 ip_vs_control_del(cp); 1290 } 1291 1292 IP_VS_DBG_BUF(7, "ADDing control for: " 1293 "cp.dst=%s:%d ctl_cp.dst=%s:%d\n", 1294 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1295 ntohs(cp->cport), 1296 IP_VS_DBG_ADDR(cp->af, &ctl_cp->caddr), 1297 ntohs(ctl_cp->cport)); 1298 1299 cp->control = ctl_cp; 1300 atomic_inc(&ctl_cp->n_control); 1301 } 1302 1303 /* IPVS netns init & cleanup functions */ 1304 int ip_vs_estimator_net_init(struct netns_ipvs *ipvs); 1305 int ip_vs_control_net_init(struct netns_ipvs *ipvs); 1306 int ip_vs_protocol_net_init(struct netns_ipvs *ipvs); 1307 int ip_vs_app_net_init(struct netns_ipvs *ipvs); 1308 int ip_vs_conn_net_init(struct netns_ipvs *ipvs); 1309 int ip_vs_sync_net_init(struct netns_ipvs *ipvs); 1310 void ip_vs_conn_net_cleanup(struct netns_ipvs *ipvs); 1311 void ip_vs_app_net_cleanup(struct netns_ipvs *ipvs); 1312 void ip_vs_protocol_net_cleanup(struct netns_ipvs *ipvs); 1313 void ip_vs_control_net_cleanup(struct netns_ipvs *ipvs); 1314 void ip_vs_estimator_net_cleanup(struct netns_ipvs *ipvs); 1315 void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs); 1316 void ip_vs_service_net_cleanup(struct netns_ipvs *ipvs); 1317 1318 /* IPVS application functions 1319 * (from ip_vs_app.c) 1320 */ 1321 #define IP_VS_APP_MAX_PORTS 8 1322 struct ip_vs_app *register_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *app); 1323 void unregister_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *app); 1324 int ip_vs_bind_app(struct ip_vs_conn *cp, struct ip_vs_protocol *pp); 1325 void ip_vs_unbind_app(struct ip_vs_conn *cp); 1326 int register_ip_vs_app_inc(struct netns_ipvs *ipvs, struct ip_vs_app *app, __u16 proto, 1327 __u16 port); 1328 int ip_vs_app_inc_get(struct ip_vs_app *inc); 1329 void ip_vs_app_inc_put(struct ip_vs_app *inc); 1330 1331 int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb); 1332 int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb); 1333 1334 int register_ip_vs_pe(struct ip_vs_pe *pe); 1335 int unregister_ip_vs_pe(struct ip_vs_pe *pe); 1336 struct ip_vs_pe *ip_vs_pe_getbyname(const char *name); 1337 struct ip_vs_pe *__ip_vs_pe_getbyname(const char *pe_name); 1338 1339 /* Use a #define to avoid all of module.h just for these trivial ops */ 1340 #define ip_vs_pe_get(pe) \ 1341 if (pe && pe->module) \ 1342 __module_get(pe->module); 1343 1344 #define ip_vs_pe_put(pe) \ 1345 if (pe && pe->module) \ 1346 module_put(pe->module); 1347 1348 /* IPVS protocol functions (from ip_vs_proto.c) */ 1349 int ip_vs_protocol_init(void); 1350 void ip_vs_protocol_cleanup(void); 1351 void ip_vs_protocol_timeout_change(struct netns_ipvs *ipvs, int flags); 1352 int *ip_vs_create_timeout_table(int *table, int size); 1353 void ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp, 1354 const struct sk_buff *skb, int offset, 1355 const char *msg); 1356 1357 extern struct ip_vs_protocol ip_vs_protocol_tcp; 1358 extern struct ip_vs_protocol ip_vs_protocol_udp; 1359 extern struct ip_vs_protocol ip_vs_protocol_icmp; 1360 extern struct ip_vs_protocol ip_vs_protocol_esp; 1361 extern struct ip_vs_protocol ip_vs_protocol_ah; 1362 extern struct ip_vs_protocol ip_vs_protocol_sctp; 1363 1364 /* Registering/unregistering scheduler functions 1365 * (from ip_vs_sched.c) 1366 */ 1367 int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler); 1368 int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler); 1369 int ip_vs_bind_scheduler(struct ip_vs_service *svc, 1370 struct ip_vs_scheduler *scheduler); 1371 void ip_vs_unbind_scheduler(struct ip_vs_service *svc, 1372 struct ip_vs_scheduler *sched); 1373 struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name); 1374 void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler); 1375 struct ip_vs_conn * 1376 ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 1377 struct ip_vs_proto_data *pd, int *ignored, 1378 struct ip_vs_iphdr *iph); 1379 int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, 1380 struct ip_vs_proto_data *pd, struct ip_vs_iphdr *iph); 1381 1382 void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg); 1383 1384 /* IPVS control data and functions (from ip_vs_ctl.c) */ 1385 extern struct ip_vs_stats ip_vs_stats; 1386 extern int sysctl_ip_vs_sync_ver; 1387 1388 struct ip_vs_service * 1389 ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u32 fwmark, __u16 protocol, 1390 const union nf_inet_addr *vaddr, __be16 vport); 1391 1392 bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol, 1393 const union nf_inet_addr *daddr, __be16 dport); 1394 1395 struct ip_vs_dest * 1396 ip_vs_find_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol, 1397 const union nf_inet_addr *daddr, __be16 dport); 1398 1399 int ip_vs_use_count_inc(void); 1400 void ip_vs_use_count_dec(void); 1401 int ip_vs_register_nl_ioctl(void); 1402 void ip_vs_unregister_nl_ioctl(void); 1403 int ip_vs_control_init(void); 1404 void ip_vs_control_cleanup(void); 1405 struct ip_vs_dest * 1406 ip_vs_find_dest(struct netns_ipvs *ipvs, int svc_af, int dest_af, 1407 const union nf_inet_addr *daddr, __be16 dport, 1408 const union nf_inet_addr *vaddr, __be16 vport, 1409 __u16 protocol, __u32 fwmark, __u32 flags); 1410 void ip_vs_try_bind_dest(struct ip_vs_conn *cp); 1411 1412 static inline void ip_vs_dest_hold(struct ip_vs_dest *dest) 1413 { 1414 refcount_inc(&dest->refcnt); 1415 } 1416 1417 static inline void ip_vs_dest_put(struct ip_vs_dest *dest) 1418 { 1419 smp_mb__before_atomic(); 1420 refcount_dec(&dest->refcnt); 1421 } 1422 1423 static inline void ip_vs_dest_put_and_free(struct ip_vs_dest *dest) 1424 { 1425 if (refcount_dec_and_test(&dest->refcnt)) 1426 kfree(dest); 1427 } 1428 1429 /* IPVS sync daemon data and function prototypes 1430 * (from ip_vs_sync.c) 1431 */ 1432 int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *cfg, 1433 int state); 1434 int stop_sync_thread(struct netns_ipvs *ipvs, int state); 1435 void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts); 1436 1437 /* IPVS rate estimator prototypes (from ip_vs_est.c) */ 1438 void ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats); 1439 void ip_vs_stop_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats); 1440 void ip_vs_zero_estimator(struct ip_vs_stats *stats); 1441 void ip_vs_read_estimator(struct ip_vs_kstats *dst, struct ip_vs_stats *stats); 1442 1443 /* Various IPVS packet transmitters (from ip_vs_xmit.c) */ 1444 int ip_vs_null_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1445 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1446 int ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1447 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1448 int ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1449 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1450 int ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1451 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1452 int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1453 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1454 int ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1455 struct ip_vs_protocol *pp, int offset, 1456 unsigned int hooknum, struct ip_vs_iphdr *iph); 1457 void ip_vs_dest_dst_rcu_free(struct rcu_head *head); 1458 1459 #ifdef CONFIG_IP_VS_IPV6 1460 int ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1461 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1462 int ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1463 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1464 int ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1465 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1466 int ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1467 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1468 int ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1469 struct ip_vs_protocol *pp, int offset, 1470 unsigned int hooknum, struct ip_vs_iphdr *iph); 1471 #endif 1472 1473 #ifdef CONFIG_SYSCTL 1474 /* This is a simple mechanism to ignore packets when 1475 * we are loaded. Just set ip_vs_drop_rate to 'n' and 1476 * we start to drop 1/rate of the packets 1477 */ 1478 static inline int ip_vs_todrop(struct netns_ipvs *ipvs) 1479 { 1480 if (!ipvs->drop_rate) 1481 return 0; 1482 if (--ipvs->drop_counter > 0) 1483 return 0; 1484 ipvs->drop_counter = ipvs->drop_rate; 1485 return 1; 1486 } 1487 #else 1488 static inline int ip_vs_todrop(struct netns_ipvs *ipvs) { return 0; } 1489 #endif 1490 1491 /* ip_vs_fwd_tag returns the forwarding tag of the connection */ 1492 #define IP_VS_FWD_METHOD(cp) (cp->flags & IP_VS_CONN_F_FWD_MASK) 1493 1494 static inline char ip_vs_fwd_tag(struct ip_vs_conn *cp) 1495 { 1496 char fwd; 1497 1498 switch (IP_VS_FWD_METHOD(cp)) { 1499 case IP_VS_CONN_F_MASQ: 1500 fwd = 'M'; break; 1501 case IP_VS_CONN_F_LOCALNODE: 1502 fwd = 'L'; break; 1503 case IP_VS_CONN_F_TUNNEL: 1504 fwd = 'T'; break; 1505 case IP_VS_CONN_F_DROUTE: 1506 fwd = 'R'; break; 1507 case IP_VS_CONN_F_BYPASS: 1508 fwd = 'B'; break; 1509 default: 1510 fwd = '?'; break; 1511 } 1512 return fwd; 1513 } 1514 1515 void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp, 1516 struct ip_vs_conn *cp, int dir); 1517 1518 #ifdef CONFIG_IP_VS_IPV6 1519 void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp, 1520 struct ip_vs_conn *cp, int dir); 1521 #endif 1522 1523 __sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset); 1524 1525 static inline __wsum ip_vs_check_diff4(__be32 old, __be32 new, __wsum oldsum) 1526 { 1527 __be32 diff[2] = { ~old, new }; 1528 1529 return csum_partial(diff, sizeof(diff), oldsum); 1530 } 1531 1532 #ifdef CONFIG_IP_VS_IPV6 1533 static inline __wsum ip_vs_check_diff16(const __be32 *old, const __be32 *new, 1534 __wsum oldsum) 1535 { 1536 __be32 diff[8] = { ~old[3], ~old[2], ~old[1], ~old[0], 1537 new[3], new[2], new[1], new[0] }; 1538 1539 return csum_partial(diff, sizeof(diff), oldsum); 1540 } 1541 #endif 1542 1543 static inline __wsum ip_vs_check_diff2(__be16 old, __be16 new, __wsum oldsum) 1544 { 1545 __be16 diff[2] = { ~old, new }; 1546 1547 return csum_partial(diff, sizeof(diff), oldsum); 1548 } 1549 1550 /* Forget current conntrack (unconfirmed) and attach notrack entry */ 1551 static inline void ip_vs_notrack(struct sk_buff *skb) 1552 { 1553 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 1554 enum ip_conntrack_info ctinfo; 1555 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1556 1557 if (ct) { 1558 nf_conntrack_put(&ct->ct_general); 1559 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1560 } 1561 #endif 1562 } 1563 1564 #ifdef CONFIG_IP_VS_NFCT 1565 /* Netfilter connection tracking 1566 * (from ip_vs_nfct.c) 1567 */ 1568 static inline int ip_vs_conntrack_enabled(struct netns_ipvs *ipvs) 1569 { 1570 #ifdef CONFIG_SYSCTL 1571 return ipvs->sysctl_conntrack; 1572 #else 1573 return 0; 1574 #endif 1575 } 1576 1577 void ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, 1578 int outin); 1579 int ip_vs_confirm_conntrack(struct sk_buff *skb); 1580 void ip_vs_nfct_expect_related(struct sk_buff *skb, struct nf_conn *ct, 1581 struct ip_vs_conn *cp, u_int8_t proto, 1582 const __be16 port, int from_rs); 1583 void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp); 1584 1585 #else 1586 1587 static inline int ip_vs_conntrack_enabled(struct netns_ipvs *ipvs) 1588 { 1589 return 0; 1590 } 1591 1592 static inline void ip_vs_update_conntrack(struct sk_buff *skb, 1593 struct ip_vs_conn *cp, int outin) 1594 { 1595 } 1596 1597 static inline int ip_vs_confirm_conntrack(struct sk_buff *skb) 1598 { 1599 return NF_ACCEPT; 1600 } 1601 1602 static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) 1603 { 1604 } 1605 #endif /* CONFIG_IP_VS_NFCT */ 1606 1607 /* Really using conntrack? */ 1608 static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, 1609 struct sk_buff *skb) 1610 { 1611 #ifdef CONFIG_IP_VS_NFCT 1612 enum ip_conntrack_info ctinfo; 1613 struct nf_conn *ct; 1614 1615 if (!(cp->flags & IP_VS_CONN_F_NFCT)) 1616 return false; 1617 ct = nf_ct_get(skb, &ctinfo); 1618 if (ct) 1619 return true; 1620 #endif 1621 return false; 1622 } 1623 1624 static inline int 1625 ip_vs_dest_conn_overhead(struct ip_vs_dest *dest) 1626 { 1627 /* We think the overhead of processing active connections is 256 1628 * times higher than that of inactive connections in average. (This 1629 * 256 times might not be accurate, we will change it later) We 1630 * use the following formula to estimate the overhead now: 1631 * dest->activeconns*256 + dest->inactconns 1632 */ 1633 return (atomic_read(&dest->activeconns) << 8) + 1634 atomic_read(&dest->inactconns); 1635 } 1636 1637 #endif /* _NET_IP_VS_H */ 1638