1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* IP Virtual Server 3 * data structure and functionality definitions 4 */ 5 6 #ifndef _NET_IP_VS_H 7 #define _NET_IP_VS_H 8 9 #include <linux/ip_vs.h> /* definitions shared with userland */ 10 11 #include <asm/types.h> /* for __uXX types */ 12 13 #include <linux/list.h> /* for struct list_head */ 14 #include <linux/spinlock.h> /* for struct rwlock_t */ 15 #include <linux/atomic.h> /* for struct atomic_t */ 16 #include <linux/refcount.h> /* for struct refcount_t */ 17 18 #include <linux/compiler.h> 19 #include <linux/timer.h> 20 #include <linux/bug.h> 21 22 #include <net/checksum.h> 23 #include <linux/netfilter.h> /* for union nf_inet_addr */ 24 #include <linux/ip.h> 25 #include <linux/ipv6.h> /* for struct ipv6hdr */ 26 #include <net/ipv6.h> 27 #if IS_ENABLED(CONFIG_IP_VS_IPV6) 28 #include <linux/netfilter_ipv6/ip6_tables.h> 29 #endif 30 #if IS_ENABLED(CONFIG_NF_CONNTRACK) 31 #include <net/netfilter/nf_conntrack.h> 32 #endif 33 #include <net/net_namespace.h> /* Netw namespace */ 34 35 #define IP_VS_HDR_INVERSE 1 36 #define IP_VS_HDR_ICMP 2 37 38 /* Generic access of ipvs struct */ 39 static inline struct netns_ipvs *net_ipvs(struct net* net) 40 { 41 return net->ipvs; 42 } 43 44 /* This one needed for single_open_net since net is stored directly in 45 * private not as a struct i.e. seq_file_net can't be used. 46 */ 47 static inline struct net *seq_file_single_net(struct seq_file *seq) 48 { 49 #ifdef CONFIG_NET_NS 50 return (struct net *)seq->private; 51 #else 52 return &init_net; 53 #endif 54 } 55 56 /* Connections' size value needed by ip_vs_ctl.c */ 57 extern int ip_vs_conn_tab_size; 58 59 struct ip_vs_iphdr { 60 int hdr_flags; /* ipvs flags */ 61 __u32 off; /* Where IP or IPv4 header starts */ 62 __u32 len; /* IPv4 simply where L4 starts 63 * IPv6 where L4 Transport Header starts */ 64 __u16 fragoffs; /* IPv6 fragment offset, 0 if first frag (or not frag)*/ 65 __s16 protocol; 66 __s32 flags; 67 union nf_inet_addr saddr; 68 union nf_inet_addr daddr; 69 }; 70 71 static inline void *frag_safe_skb_hp(const struct sk_buff *skb, int offset, 72 int len, void *buffer) 73 { 74 return skb_header_pointer(skb, offset, len, buffer); 75 } 76 77 /* This function handles filling *ip_vs_iphdr, both for IPv4 and IPv6. 78 * IPv6 requires some extra work, as finding proper header position, 79 * depend on the IPv6 extension headers. 80 */ 81 static inline int 82 ip_vs_fill_iph_skb_off(int af, const struct sk_buff *skb, int offset, 83 int hdr_flags, struct ip_vs_iphdr *iphdr) 84 { 85 iphdr->hdr_flags = hdr_flags; 86 iphdr->off = offset; 87 88 #ifdef CONFIG_IP_VS_IPV6 89 if (af == AF_INET6) { 90 struct ipv6hdr _iph; 91 const struct ipv6hdr *iph = skb_header_pointer( 92 skb, offset, sizeof(_iph), &_iph); 93 if (!iph) 94 return 0; 95 96 iphdr->saddr.in6 = iph->saddr; 97 iphdr->daddr.in6 = iph->daddr; 98 /* ipv6_find_hdr() updates len, flags */ 99 iphdr->len = offset; 100 iphdr->flags = 0; 101 iphdr->protocol = ipv6_find_hdr(skb, &iphdr->len, -1, 102 &iphdr->fragoffs, 103 &iphdr->flags); 104 if (iphdr->protocol < 0) 105 return 0; 106 } else 107 #endif 108 { 109 struct iphdr _iph; 110 const struct iphdr *iph = skb_header_pointer( 111 skb, offset, sizeof(_iph), &_iph); 112 if (!iph) 113 return 0; 114 115 iphdr->len = offset + iph->ihl * 4; 116 iphdr->fragoffs = 0; 117 iphdr->protocol = iph->protocol; 118 iphdr->saddr.ip = iph->saddr; 119 iphdr->daddr.ip = iph->daddr; 120 } 121 122 return 1; 123 } 124 125 static inline int 126 ip_vs_fill_iph_skb_icmp(int af, const struct sk_buff *skb, int offset, 127 bool inverse, struct ip_vs_iphdr *iphdr) 128 { 129 int hdr_flags = IP_VS_HDR_ICMP; 130 131 if (inverse) 132 hdr_flags |= IP_VS_HDR_INVERSE; 133 134 return ip_vs_fill_iph_skb_off(af, skb, offset, hdr_flags, iphdr); 135 } 136 137 static inline int 138 ip_vs_fill_iph_skb(int af, const struct sk_buff *skb, bool inverse, 139 struct ip_vs_iphdr *iphdr) 140 { 141 int hdr_flags = 0; 142 143 if (inverse) 144 hdr_flags |= IP_VS_HDR_INVERSE; 145 146 return ip_vs_fill_iph_skb_off(af, skb, skb_network_offset(skb), 147 hdr_flags, iphdr); 148 } 149 150 static inline bool 151 ip_vs_iph_inverse(const struct ip_vs_iphdr *iph) 152 { 153 return !!(iph->hdr_flags & IP_VS_HDR_INVERSE); 154 } 155 156 static inline bool 157 ip_vs_iph_icmp(const struct ip_vs_iphdr *iph) 158 { 159 return !!(iph->hdr_flags & IP_VS_HDR_ICMP); 160 } 161 162 static inline void ip_vs_addr_copy(int af, union nf_inet_addr *dst, 163 const union nf_inet_addr *src) 164 { 165 #ifdef CONFIG_IP_VS_IPV6 166 if (af == AF_INET6) 167 dst->in6 = src->in6; 168 else 169 #endif 170 dst->ip = src->ip; 171 } 172 173 static inline void ip_vs_addr_set(int af, union nf_inet_addr *dst, 174 const union nf_inet_addr *src) 175 { 176 #ifdef CONFIG_IP_VS_IPV6 177 if (af == AF_INET6) { 178 dst->in6 = src->in6; 179 return; 180 } 181 #endif 182 dst->ip = src->ip; 183 dst->all[1] = 0; 184 dst->all[2] = 0; 185 dst->all[3] = 0; 186 } 187 188 static inline int ip_vs_addr_equal(int af, const union nf_inet_addr *a, 189 const union nf_inet_addr *b) 190 { 191 #ifdef CONFIG_IP_VS_IPV6 192 if (af == AF_INET6) 193 return ipv6_addr_equal(&a->in6, &b->in6); 194 #endif 195 return a->ip == b->ip; 196 } 197 198 #ifdef CONFIG_IP_VS_DEBUG 199 #include <linux/net.h> 200 201 int ip_vs_get_debug_level(void); 202 203 static inline const char *ip_vs_dbg_addr(int af, char *buf, size_t buf_len, 204 const union nf_inet_addr *addr, 205 int *idx) 206 { 207 int len; 208 #ifdef CONFIG_IP_VS_IPV6 209 if (af == AF_INET6) 210 len = snprintf(&buf[*idx], buf_len - *idx, "[%pI6c]", 211 &addr->in6) + 1; 212 else 213 #endif 214 len = snprintf(&buf[*idx], buf_len - *idx, "%pI4", 215 &addr->ip) + 1; 216 217 *idx += len; 218 BUG_ON(*idx > buf_len + 1); 219 return &buf[*idx - len]; 220 } 221 222 #define IP_VS_DBG_BUF(level, msg, ...) \ 223 do { \ 224 char ip_vs_dbg_buf[160]; \ 225 int ip_vs_dbg_idx = 0; \ 226 if (level <= ip_vs_get_debug_level()) \ 227 printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__); \ 228 } while (0) 229 #define IP_VS_ERR_BUF(msg...) \ 230 do { \ 231 char ip_vs_dbg_buf[160]; \ 232 int ip_vs_dbg_idx = 0; \ 233 pr_err(msg); \ 234 } while (0) 235 236 /* Only use from within IP_VS_DBG_BUF() or IP_VS_ERR_BUF macros */ 237 #define IP_VS_DBG_ADDR(af, addr) \ 238 ip_vs_dbg_addr(af, ip_vs_dbg_buf, \ 239 sizeof(ip_vs_dbg_buf), addr, \ 240 &ip_vs_dbg_idx) 241 242 #define IP_VS_DBG(level, msg, ...) \ 243 do { \ 244 if (level <= ip_vs_get_debug_level()) \ 245 printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__); \ 246 } while (0) 247 #define IP_VS_DBG_RL(msg, ...) \ 248 do { \ 249 if (net_ratelimit()) \ 250 printk(KERN_DEBUG pr_fmt(msg), ##__VA_ARGS__); \ 251 } while (0) 252 #define IP_VS_DBG_PKT(level, af, pp, skb, ofs, msg) \ 253 do { \ 254 if (level <= ip_vs_get_debug_level()) \ 255 pp->debug_packet(af, pp, skb, ofs, msg); \ 256 } while (0) 257 #define IP_VS_DBG_RL_PKT(level, af, pp, skb, ofs, msg) \ 258 do { \ 259 if (level <= ip_vs_get_debug_level() && \ 260 net_ratelimit()) \ 261 pp->debug_packet(af, pp, skb, ofs, msg); \ 262 } while (0) 263 #else /* NO DEBUGGING at ALL */ 264 #define IP_VS_DBG_BUF(level, msg...) do {} while (0) 265 #define IP_VS_ERR_BUF(msg...) do {} while (0) 266 #define IP_VS_DBG(level, msg...) do {} while (0) 267 #define IP_VS_DBG_RL(msg...) do {} while (0) 268 #define IP_VS_DBG_PKT(level, af, pp, skb, ofs, msg) do {} while (0) 269 #define IP_VS_DBG_RL_PKT(level, af, pp, skb, ofs, msg) do {} while (0) 270 #endif 271 272 #define IP_VS_BUG() BUG() 273 #define IP_VS_ERR_RL(msg, ...) \ 274 do { \ 275 if (net_ratelimit()) \ 276 pr_err(msg, ##__VA_ARGS__); \ 277 } while (0) 278 279 #ifdef CONFIG_IP_VS_DEBUG 280 #define EnterFunction(level) \ 281 do { \ 282 if (level <= ip_vs_get_debug_level()) \ 283 printk(KERN_DEBUG \ 284 pr_fmt("Enter: %s, %s line %i\n"), \ 285 __func__, __FILE__, __LINE__); \ 286 } while (0) 287 #define LeaveFunction(level) \ 288 do { \ 289 if (level <= ip_vs_get_debug_level()) \ 290 printk(KERN_DEBUG \ 291 pr_fmt("Leave: %s, %s line %i\n"), \ 292 __func__, __FILE__, __LINE__); \ 293 } while (0) 294 #else 295 #define EnterFunction(level) do {} while (0) 296 #define LeaveFunction(level) do {} while (0) 297 #endif 298 299 /* The port number of FTP service (in network order). */ 300 #define FTPPORT cpu_to_be16(21) 301 #define FTPDATA cpu_to_be16(20) 302 303 /* TCP State Values */ 304 enum { 305 IP_VS_TCP_S_NONE = 0, 306 IP_VS_TCP_S_ESTABLISHED, 307 IP_VS_TCP_S_SYN_SENT, 308 IP_VS_TCP_S_SYN_RECV, 309 IP_VS_TCP_S_FIN_WAIT, 310 IP_VS_TCP_S_TIME_WAIT, 311 IP_VS_TCP_S_CLOSE, 312 IP_VS_TCP_S_CLOSE_WAIT, 313 IP_VS_TCP_S_LAST_ACK, 314 IP_VS_TCP_S_LISTEN, 315 IP_VS_TCP_S_SYNACK, 316 IP_VS_TCP_S_LAST 317 }; 318 319 /* UDP State Values */ 320 enum { 321 IP_VS_UDP_S_NORMAL, 322 IP_VS_UDP_S_LAST, 323 }; 324 325 /* ICMP State Values */ 326 enum { 327 IP_VS_ICMP_S_NORMAL, 328 IP_VS_ICMP_S_LAST, 329 }; 330 331 /* SCTP State Values */ 332 enum ip_vs_sctp_states { 333 IP_VS_SCTP_S_NONE, 334 IP_VS_SCTP_S_INIT1, 335 IP_VS_SCTP_S_INIT, 336 IP_VS_SCTP_S_COOKIE_SENT, 337 IP_VS_SCTP_S_COOKIE_REPLIED, 338 IP_VS_SCTP_S_COOKIE_WAIT, 339 IP_VS_SCTP_S_COOKIE, 340 IP_VS_SCTP_S_COOKIE_ECHOED, 341 IP_VS_SCTP_S_ESTABLISHED, 342 IP_VS_SCTP_S_SHUTDOWN_SENT, 343 IP_VS_SCTP_S_SHUTDOWN_RECEIVED, 344 IP_VS_SCTP_S_SHUTDOWN_ACK_SENT, 345 IP_VS_SCTP_S_REJECTED, 346 IP_VS_SCTP_S_CLOSED, 347 IP_VS_SCTP_S_LAST 348 }; 349 350 /* Delta sequence info structure 351 * Each ip_vs_conn has 2 (output AND input seq. changes). 352 * Only used in the VS/NAT. 353 */ 354 struct ip_vs_seq { 355 __u32 init_seq; /* Add delta from this seq */ 356 __u32 delta; /* Delta in sequence numbers */ 357 __u32 previous_delta; /* Delta in sequence numbers 358 * before last resized pkt */ 359 }; 360 361 /* counters per cpu */ 362 struct ip_vs_counters { 363 __u64 conns; /* connections scheduled */ 364 __u64 inpkts; /* incoming packets */ 365 __u64 outpkts; /* outgoing packets */ 366 __u64 inbytes; /* incoming bytes */ 367 __u64 outbytes; /* outgoing bytes */ 368 }; 369 /* Stats per cpu */ 370 struct ip_vs_cpu_stats { 371 struct ip_vs_counters cnt; 372 struct u64_stats_sync syncp; 373 }; 374 375 /* IPVS statistics objects */ 376 struct ip_vs_estimator { 377 struct list_head list; 378 379 u64 last_inbytes; 380 u64 last_outbytes; 381 u64 last_conns; 382 u64 last_inpkts; 383 u64 last_outpkts; 384 385 u64 cps; 386 u64 inpps; 387 u64 outpps; 388 u64 inbps; 389 u64 outbps; 390 }; 391 392 /* 393 * IPVS statistics object, 64-bit kernel version of struct ip_vs_stats_user 394 */ 395 struct ip_vs_kstats { 396 u64 conns; /* connections scheduled */ 397 u64 inpkts; /* incoming packets */ 398 u64 outpkts; /* outgoing packets */ 399 u64 inbytes; /* incoming bytes */ 400 u64 outbytes; /* outgoing bytes */ 401 402 u64 cps; /* current connection rate */ 403 u64 inpps; /* current in packet rate */ 404 u64 outpps; /* current out packet rate */ 405 u64 inbps; /* current in byte rate */ 406 u64 outbps; /* current out byte rate */ 407 }; 408 409 struct ip_vs_stats { 410 struct ip_vs_kstats kstats; /* kernel statistics */ 411 struct ip_vs_estimator est; /* estimator */ 412 struct ip_vs_cpu_stats __percpu *cpustats; /* per cpu counters */ 413 spinlock_t lock; /* spin lock */ 414 struct ip_vs_kstats kstats0; /* reset values */ 415 }; 416 417 struct dst_entry; 418 struct iphdr; 419 struct ip_vs_conn; 420 struct ip_vs_app; 421 struct sk_buff; 422 struct ip_vs_proto_data; 423 424 struct ip_vs_protocol { 425 struct ip_vs_protocol *next; 426 char *name; 427 u16 protocol; 428 u16 num_states; 429 int dont_defrag; 430 431 void (*init)(struct ip_vs_protocol *pp); 432 433 void (*exit)(struct ip_vs_protocol *pp); 434 435 int (*init_netns)(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd); 436 437 void (*exit_netns)(struct netns_ipvs *ipvs, struct ip_vs_proto_data *pd); 438 439 int (*conn_schedule)(struct netns_ipvs *ipvs, 440 int af, struct sk_buff *skb, 441 struct ip_vs_proto_data *pd, 442 int *verdict, struct ip_vs_conn **cpp, 443 struct ip_vs_iphdr *iph); 444 445 struct ip_vs_conn * 446 (*conn_in_get)(struct netns_ipvs *ipvs, 447 int af, 448 const struct sk_buff *skb, 449 const struct ip_vs_iphdr *iph); 450 451 struct ip_vs_conn * 452 (*conn_out_get)(struct netns_ipvs *ipvs, 453 int af, 454 const struct sk_buff *skb, 455 const struct ip_vs_iphdr *iph); 456 457 int (*snat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp, 458 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph); 459 460 int (*dnat_handler)(struct sk_buff *skb, struct ip_vs_protocol *pp, 461 struct ip_vs_conn *cp, struct ip_vs_iphdr *iph); 462 463 int (*csum_check)(int af, struct sk_buff *skb, 464 struct ip_vs_protocol *pp); 465 466 const char *(*state_name)(int state); 467 468 void (*state_transition)(struct ip_vs_conn *cp, int direction, 469 const struct sk_buff *skb, 470 struct ip_vs_proto_data *pd); 471 472 int (*register_app)(struct netns_ipvs *ipvs, struct ip_vs_app *inc); 473 474 void (*unregister_app)(struct netns_ipvs *ipvs, struct ip_vs_app *inc); 475 476 int (*app_conn_bind)(struct ip_vs_conn *cp); 477 478 void (*debug_packet)(int af, struct ip_vs_protocol *pp, 479 const struct sk_buff *skb, 480 int offset, 481 const char *msg); 482 483 void (*timeout_change)(struct ip_vs_proto_data *pd, int flags); 484 }; 485 486 /* protocol data per netns */ 487 struct ip_vs_proto_data { 488 struct ip_vs_proto_data *next; 489 struct ip_vs_protocol *pp; 490 int *timeout_table; /* protocol timeout table */ 491 atomic_t appcnt; /* counter of proto app incs. */ 492 struct tcp_states_t *tcp_state_table; 493 }; 494 495 struct ip_vs_protocol *ip_vs_proto_get(unsigned short proto); 496 struct ip_vs_proto_data *ip_vs_proto_data_get(struct netns_ipvs *ipvs, 497 unsigned short proto); 498 499 struct ip_vs_conn_param { 500 struct netns_ipvs *ipvs; 501 const union nf_inet_addr *caddr; 502 const union nf_inet_addr *vaddr; 503 __be16 cport; 504 __be16 vport; 505 __u16 protocol; 506 u16 af; 507 508 const struct ip_vs_pe *pe; 509 char *pe_data; 510 __u8 pe_data_len; 511 }; 512 513 /* IP_VS structure allocated for each dynamically scheduled connection */ 514 struct ip_vs_conn { 515 struct hlist_node c_list; /* hashed list heads */ 516 /* Protocol, addresses and port numbers */ 517 __be16 cport; 518 __be16 dport; 519 __be16 vport; 520 u16 af; /* address family */ 521 union nf_inet_addr caddr; /* client address */ 522 union nf_inet_addr vaddr; /* virtual address */ 523 union nf_inet_addr daddr; /* destination address */ 524 volatile __u32 flags; /* status flags */ 525 __u16 protocol; /* Which protocol (TCP/UDP) */ 526 __u16 daf; /* Address family of the dest */ 527 struct netns_ipvs *ipvs; 528 529 /* counter and timer */ 530 refcount_t refcnt; /* reference count */ 531 struct timer_list timer; /* Expiration timer */ 532 volatile unsigned long timeout; /* timeout */ 533 534 /* Flags and state transition */ 535 spinlock_t lock; /* lock for state transition */ 536 volatile __u16 state; /* state info */ 537 volatile __u16 old_state; /* old state, to be used for 538 * state transition triggerd 539 * synchronization 540 */ 541 __u32 fwmark; /* Fire wall mark from skb */ 542 unsigned long sync_endtime; /* jiffies + sent_retries */ 543 544 /* Control members */ 545 struct ip_vs_conn *control; /* Master control connection */ 546 atomic_t n_control; /* Number of controlled ones */ 547 struct ip_vs_dest *dest; /* real server */ 548 atomic_t in_pkts; /* incoming packet counter */ 549 550 /* Packet transmitter for different forwarding methods. If it 551 * mangles the packet, it must return NF_DROP or better NF_STOLEN, 552 * otherwise this must be changed to a sk_buff **. 553 * NF_ACCEPT can be returned when destination is local. 554 */ 555 int (*packet_xmit)(struct sk_buff *skb, struct ip_vs_conn *cp, 556 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 557 558 /* Note: we can group the following members into a structure, 559 * in order to save more space, and the following members are 560 * only used in VS/NAT anyway 561 */ 562 struct ip_vs_app *app; /* bound ip_vs_app object */ 563 void *app_data; /* Application private data */ 564 struct ip_vs_seq in_seq; /* incoming seq. struct */ 565 struct ip_vs_seq out_seq; /* outgoing seq. struct */ 566 567 const struct ip_vs_pe *pe; 568 char *pe_data; 569 __u8 pe_data_len; 570 571 struct rcu_head rcu_head; 572 }; 573 574 /* Extended internal versions of struct ip_vs_service_user and ip_vs_dest_user 575 * for IPv6 support. 576 * 577 * We need these to conveniently pass around service and destination 578 * options, but unfortunately, we also need to keep the old definitions to 579 * maintain userspace backwards compatibility for the setsockopt interface. 580 */ 581 struct ip_vs_service_user_kern { 582 /* virtual service addresses */ 583 u16 af; 584 u16 protocol; 585 union nf_inet_addr addr; /* virtual ip address */ 586 __be16 port; 587 u32 fwmark; /* firwall mark of service */ 588 589 /* virtual service options */ 590 char *sched_name; 591 char *pe_name; 592 unsigned int flags; /* virtual service flags */ 593 unsigned int timeout; /* persistent timeout in sec */ 594 __be32 netmask; /* persistent netmask or plen */ 595 }; 596 597 598 struct ip_vs_dest_user_kern { 599 /* destination server address */ 600 union nf_inet_addr addr; 601 __be16 port; 602 603 /* real server options */ 604 unsigned int conn_flags; /* connection flags */ 605 int weight; /* destination weight */ 606 607 /* thresholds for active connections */ 608 u32 u_threshold; /* upper threshold */ 609 u32 l_threshold; /* lower threshold */ 610 611 /* Address family of addr */ 612 u16 af; 613 }; 614 615 616 /* 617 * The information about the virtual service offered to the net and the 618 * forwarding entries. 619 */ 620 struct ip_vs_service { 621 struct hlist_node s_list; /* for normal service table */ 622 struct hlist_node f_list; /* for fwmark-based service table */ 623 atomic_t refcnt; /* reference counter */ 624 625 u16 af; /* address family */ 626 __u16 protocol; /* which protocol (TCP/UDP) */ 627 union nf_inet_addr addr; /* IP address for virtual service */ 628 __be16 port; /* port number for the service */ 629 __u32 fwmark; /* firewall mark of the service */ 630 unsigned int flags; /* service status flags */ 631 unsigned int timeout; /* persistent timeout in ticks */ 632 __be32 netmask; /* grouping granularity, mask/plen */ 633 struct netns_ipvs *ipvs; 634 635 struct list_head destinations; /* real server d-linked list */ 636 __u32 num_dests; /* number of servers */ 637 struct ip_vs_stats stats; /* statistics for the service */ 638 639 /* for scheduling */ 640 struct ip_vs_scheduler __rcu *scheduler; /* bound scheduler object */ 641 spinlock_t sched_lock; /* lock sched_data */ 642 void *sched_data; /* scheduler application data */ 643 644 /* alternate persistence engine */ 645 struct ip_vs_pe __rcu *pe; 646 647 struct rcu_head rcu_head; 648 }; 649 650 /* Information for cached dst */ 651 struct ip_vs_dest_dst { 652 struct dst_entry *dst_cache; /* destination cache entry */ 653 u32 dst_cookie; 654 union nf_inet_addr dst_saddr; 655 struct rcu_head rcu_head; 656 }; 657 658 /* The real server destination forwarding entry with ip address, port number, 659 * and so on. 660 */ 661 struct ip_vs_dest { 662 struct list_head n_list; /* for the dests in the service */ 663 struct hlist_node d_list; /* for table with all the dests */ 664 665 u16 af; /* address family */ 666 __be16 port; /* port number of the server */ 667 union nf_inet_addr addr; /* IP address of the server */ 668 volatile unsigned int flags; /* dest status flags */ 669 atomic_t conn_flags; /* flags to copy to conn */ 670 atomic_t weight; /* server weight */ 671 atomic_t last_weight; /* server latest weight */ 672 673 refcount_t refcnt; /* reference counter */ 674 struct ip_vs_stats stats; /* statistics */ 675 unsigned long idle_start; /* start time, jiffies */ 676 677 /* connection counters and thresholds */ 678 atomic_t activeconns; /* active connections */ 679 atomic_t inactconns; /* inactive connections */ 680 atomic_t persistconns; /* persistent connections */ 681 __u32 u_threshold; /* upper threshold */ 682 __u32 l_threshold; /* lower threshold */ 683 684 /* for destination cache */ 685 spinlock_t dst_lock; /* lock of dst_cache */ 686 struct ip_vs_dest_dst __rcu *dest_dst; /* cached dst info */ 687 688 /* for virtual service */ 689 struct ip_vs_service __rcu *svc; /* service it belongs to */ 690 __u16 protocol; /* which protocol (TCP/UDP) */ 691 __be16 vport; /* virtual port number */ 692 union nf_inet_addr vaddr; /* virtual IP address */ 693 __u32 vfwmark; /* firewall mark of service */ 694 695 struct list_head t_list; /* in dest_trash */ 696 unsigned int in_rs_table:1; /* we are in rs_table */ 697 }; 698 699 /* The scheduler object */ 700 struct ip_vs_scheduler { 701 struct list_head n_list; /* d-linked list head */ 702 char *name; /* scheduler name */ 703 atomic_t refcnt; /* reference counter */ 704 struct module *module; /* THIS_MODULE/NULL */ 705 706 /* scheduler initializing service */ 707 int (*init_service)(struct ip_vs_service *svc); 708 /* scheduling service finish */ 709 void (*done_service)(struct ip_vs_service *svc); 710 /* dest is linked */ 711 int (*add_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest); 712 /* dest is unlinked */ 713 int (*del_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest); 714 /* dest is updated */ 715 int (*upd_dest)(struct ip_vs_service *svc, struct ip_vs_dest *dest); 716 717 /* selecting a server from the given service */ 718 struct ip_vs_dest* (*schedule)(struct ip_vs_service *svc, 719 const struct sk_buff *skb, 720 struct ip_vs_iphdr *iph); 721 }; 722 723 /* The persistence engine object */ 724 struct ip_vs_pe { 725 struct list_head n_list; /* d-linked list head */ 726 char *name; /* scheduler name */ 727 atomic_t refcnt; /* reference counter */ 728 struct module *module; /* THIS_MODULE/NULL */ 729 730 /* get the connection template, if any */ 731 int (*fill_param)(struct ip_vs_conn_param *p, struct sk_buff *skb); 732 bool (*ct_match)(const struct ip_vs_conn_param *p, 733 struct ip_vs_conn *ct); 734 u32 (*hashkey_raw)(const struct ip_vs_conn_param *p, u32 initval, 735 bool inverse); 736 int (*show_pe_data)(const struct ip_vs_conn *cp, char *buf); 737 /* create connections for real-server outgoing packets */ 738 struct ip_vs_conn* (*conn_out)(struct ip_vs_service *svc, 739 struct ip_vs_dest *dest, 740 struct sk_buff *skb, 741 const struct ip_vs_iphdr *iph, 742 __be16 dport, __be16 cport); 743 }; 744 745 /* The application module object (a.k.a. app incarnation) */ 746 struct ip_vs_app { 747 struct list_head a_list; /* member in app list */ 748 int type; /* IP_VS_APP_TYPE_xxx */ 749 char *name; /* application module name */ 750 __u16 protocol; 751 struct module *module; /* THIS_MODULE/NULL */ 752 struct list_head incs_list; /* list of incarnations */ 753 754 /* members for application incarnations */ 755 struct list_head p_list; /* member in proto app list */ 756 struct ip_vs_app *app; /* its real application */ 757 __be16 port; /* port number in net order */ 758 atomic_t usecnt; /* usage counter */ 759 struct rcu_head rcu_head; 760 761 /* output hook: Process packet in inout direction, diff set for TCP. 762 * Return: 0=Error, 1=Payload Not Mangled/Mangled but checksum is ok, 763 * 2=Mangled but checksum was not updated 764 */ 765 int (*pkt_out)(struct ip_vs_app *, struct ip_vs_conn *, 766 struct sk_buff *, int *diff); 767 768 /* input hook: Process packet in outin direction, diff set for TCP. 769 * Return: 0=Error, 1=Payload Not Mangled/Mangled but checksum is ok, 770 * 2=Mangled but checksum was not updated 771 */ 772 int (*pkt_in)(struct ip_vs_app *, struct ip_vs_conn *, 773 struct sk_buff *, int *diff); 774 775 /* ip_vs_app initializer */ 776 int (*init_conn)(struct ip_vs_app *, struct ip_vs_conn *); 777 778 /* ip_vs_app finish */ 779 int (*done_conn)(struct ip_vs_app *, struct ip_vs_conn *); 780 781 782 /* not used now */ 783 int (*bind_conn)(struct ip_vs_app *, struct ip_vs_conn *, 784 struct ip_vs_protocol *); 785 786 void (*unbind_conn)(struct ip_vs_app *, struct ip_vs_conn *); 787 788 int * timeout_table; 789 int * timeouts; 790 int timeouts_size; 791 792 int (*conn_schedule)(struct sk_buff *skb, struct ip_vs_app *app, 793 int *verdict, struct ip_vs_conn **cpp); 794 795 struct ip_vs_conn * 796 (*conn_in_get)(const struct sk_buff *skb, struct ip_vs_app *app, 797 const struct iphdr *iph, int inverse); 798 799 struct ip_vs_conn * 800 (*conn_out_get)(const struct sk_buff *skb, struct ip_vs_app *app, 801 const struct iphdr *iph, int inverse); 802 803 int (*state_transition)(struct ip_vs_conn *cp, int direction, 804 const struct sk_buff *skb, 805 struct ip_vs_app *app); 806 807 void (*timeout_change)(struct ip_vs_app *app, int flags); 808 }; 809 810 struct ipvs_master_sync_state { 811 struct list_head sync_queue; 812 struct ip_vs_sync_buff *sync_buff; 813 unsigned long sync_queue_len; 814 unsigned int sync_queue_delay; 815 struct task_struct *master_thread; 816 struct delayed_work master_wakeup_work; 817 struct netns_ipvs *ipvs; 818 }; 819 820 /* How much time to keep dests in trash */ 821 #define IP_VS_DEST_TRASH_PERIOD (120 * HZ) 822 823 struct ipvs_sync_daemon_cfg { 824 union nf_inet_addr mcast_group; 825 int syncid; 826 u16 sync_maxlen; 827 u16 mcast_port; 828 u8 mcast_af; 829 u8 mcast_ttl; 830 /* multicast interface name */ 831 char mcast_ifn[IP_VS_IFNAME_MAXLEN]; 832 }; 833 834 /* IPVS in network namespace */ 835 struct netns_ipvs { 836 int gen; /* Generation */ 837 int enable; /* enable like nf_hooks do */ 838 /* Hash table: for real service lookups */ 839 #define IP_VS_RTAB_BITS 4 840 #define IP_VS_RTAB_SIZE (1 << IP_VS_RTAB_BITS) 841 #define IP_VS_RTAB_MASK (IP_VS_RTAB_SIZE - 1) 842 843 struct hlist_head rs_table[IP_VS_RTAB_SIZE]; 844 /* ip_vs_app */ 845 struct list_head app_list; 846 /* ip_vs_proto */ 847 #define IP_VS_PROTO_TAB_SIZE 32 /* must be power of 2 */ 848 struct ip_vs_proto_data *proto_data_table[IP_VS_PROTO_TAB_SIZE]; 849 /* ip_vs_proto_tcp */ 850 #ifdef CONFIG_IP_VS_PROTO_TCP 851 #define TCP_APP_TAB_BITS 4 852 #define TCP_APP_TAB_SIZE (1 << TCP_APP_TAB_BITS) 853 #define TCP_APP_TAB_MASK (TCP_APP_TAB_SIZE - 1) 854 struct list_head tcp_apps[TCP_APP_TAB_SIZE]; 855 #endif 856 /* ip_vs_proto_udp */ 857 #ifdef CONFIG_IP_VS_PROTO_UDP 858 #define UDP_APP_TAB_BITS 4 859 #define UDP_APP_TAB_SIZE (1 << UDP_APP_TAB_BITS) 860 #define UDP_APP_TAB_MASK (UDP_APP_TAB_SIZE - 1) 861 struct list_head udp_apps[UDP_APP_TAB_SIZE]; 862 #endif 863 /* ip_vs_proto_sctp */ 864 #ifdef CONFIG_IP_VS_PROTO_SCTP 865 #define SCTP_APP_TAB_BITS 4 866 #define SCTP_APP_TAB_SIZE (1 << SCTP_APP_TAB_BITS) 867 #define SCTP_APP_TAB_MASK (SCTP_APP_TAB_SIZE - 1) 868 /* Hash table for SCTP application incarnations */ 869 struct list_head sctp_apps[SCTP_APP_TAB_SIZE]; 870 #endif 871 /* ip_vs_conn */ 872 atomic_t conn_count; /* connection counter */ 873 874 /* ip_vs_ctl */ 875 struct ip_vs_stats tot_stats; /* Statistics & est. */ 876 877 int num_services; /* no of virtual services */ 878 879 /* Trash for destinations */ 880 struct list_head dest_trash; 881 spinlock_t dest_trash_lock; 882 struct timer_list dest_trash_timer; /* expiration timer */ 883 /* Service counters */ 884 atomic_t ftpsvc_counter; 885 atomic_t nullsvc_counter; 886 atomic_t conn_out_counter; 887 888 #ifdef CONFIG_SYSCTL 889 /* 1/rate drop and drop-entry variables */ 890 struct delayed_work defense_work; /* Work handler */ 891 int drop_rate; 892 int drop_counter; 893 atomic_t dropentry; 894 /* locks in ctl.c */ 895 spinlock_t dropentry_lock; /* drop entry handling */ 896 spinlock_t droppacket_lock; /* drop packet handling */ 897 spinlock_t securetcp_lock; /* state and timeout tables */ 898 899 /* sys-ctl struct */ 900 struct ctl_table_header *sysctl_hdr; 901 struct ctl_table *sysctl_tbl; 902 #endif 903 904 /* sysctl variables */ 905 int sysctl_amemthresh; 906 int sysctl_am_droprate; 907 int sysctl_drop_entry; 908 int sysctl_drop_packet; 909 int sysctl_secure_tcp; 910 #ifdef CONFIG_IP_VS_NFCT 911 int sysctl_conntrack; 912 #endif 913 int sysctl_snat_reroute; 914 int sysctl_sync_ver; 915 int sysctl_sync_ports; 916 int sysctl_sync_persist_mode; 917 unsigned long sysctl_sync_qlen_max; 918 int sysctl_sync_sock_size; 919 int sysctl_cache_bypass; 920 int sysctl_expire_nodest_conn; 921 int sysctl_sloppy_tcp; 922 int sysctl_sloppy_sctp; 923 int sysctl_expire_quiescent_template; 924 int sysctl_sync_threshold[2]; 925 unsigned int sysctl_sync_refresh_period; 926 int sysctl_sync_retries; 927 int sysctl_nat_icmp_send; 928 int sysctl_pmtu_disc; 929 int sysctl_backup_only; 930 int sysctl_conn_reuse_mode; 931 int sysctl_schedule_icmp; 932 int sysctl_ignore_tunneled; 933 934 /* ip_vs_lblc */ 935 int sysctl_lblc_expiration; 936 struct ctl_table_header *lblc_ctl_header; 937 struct ctl_table *lblc_ctl_table; 938 /* ip_vs_lblcr */ 939 int sysctl_lblcr_expiration; 940 struct ctl_table_header *lblcr_ctl_header; 941 struct ctl_table *lblcr_ctl_table; 942 /* ip_vs_est */ 943 struct list_head est_list; /* estimator list */ 944 spinlock_t est_lock; 945 struct timer_list est_timer; /* Estimation timer */ 946 /* ip_vs_sync */ 947 spinlock_t sync_lock; 948 struct ipvs_master_sync_state *ms; 949 spinlock_t sync_buff_lock; 950 struct task_struct **backup_threads; 951 int threads_mask; 952 volatile int sync_state; 953 struct mutex sync_mutex; 954 struct ipvs_sync_daemon_cfg mcfg; /* Master Configuration */ 955 struct ipvs_sync_daemon_cfg bcfg; /* Backup Configuration */ 956 /* net name space ptr */ 957 struct net *net; /* Needed by timer routines */ 958 /* Number of heterogeneous destinations, needed becaus heterogeneous 959 * are not supported when synchronization is enabled. 960 */ 961 unsigned int mixed_address_family_dests; 962 }; 963 964 #define DEFAULT_SYNC_THRESHOLD 3 965 #define DEFAULT_SYNC_PERIOD 50 966 #define DEFAULT_SYNC_VER 1 967 #define DEFAULT_SLOPPY_TCP 0 968 #define DEFAULT_SLOPPY_SCTP 0 969 #define DEFAULT_SYNC_REFRESH_PERIOD (0U * HZ) 970 #define DEFAULT_SYNC_RETRIES 0 971 #define IPVS_SYNC_WAKEUP_RATE 8 972 #define IPVS_SYNC_QLEN_MAX (IPVS_SYNC_WAKEUP_RATE * 4) 973 #define IPVS_SYNC_SEND_DELAY (HZ / 50) 974 #define IPVS_SYNC_CHECK_PERIOD HZ 975 #define IPVS_SYNC_FLUSH_TIME (HZ * 2) 976 #define IPVS_SYNC_PORTS_MAX (1 << 6) 977 978 #ifdef CONFIG_SYSCTL 979 980 static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs) 981 { 982 return ipvs->sysctl_sync_threshold[0]; 983 } 984 985 static inline int sysctl_sync_period(struct netns_ipvs *ipvs) 986 { 987 return READ_ONCE(ipvs->sysctl_sync_threshold[1]); 988 } 989 990 static inline unsigned int sysctl_sync_refresh_period(struct netns_ipvs *ipvs) 991 { 992 return READ_ONCE(ipvs->sysctl_sync_refresh_period); 993 } 994 995 static inline int sysctl_sync_retries(struct netns_ipvs *ipvs) 996 { 997 return ipvs->sysctl_sync_retries; 998 } 999 1000 static inline int sysctl_sync_ver(struct netns_ipvs *ipvs) 1001 { 1002 return ipvs->sysctl_sync_ver; 1003 } 1004 1005 static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs) 1006 { 1007 return ipvs->sysctl_sloppy_tcp; 1008 } 1009 1010 static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs) 1011 { 1012 return ipvs->sysctl_sloppy_sctp; 1013 } 1014 1015 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs) 1016 { 1017 return READ_ONCE(ipvs->sysctl_sync_ports); 1018 } 1019 1020 static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs) 1021 { 1022 return ipvs->sysctl_sync_persist_mode; 1023 } 1024 1025 static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs) 1026 { 1027 return ipvs->sysctl_sync_qlen_max; 1028 } 1029 1030 static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs) 1031 { 1032 return ipvs->sysctl_sync_sock_size; 1033 } 1034 1035 static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs) 1036 { 1037 return ipvs->sysctl_pmtu_disc; 1038 } 1039 1040 static inline int sysctl_backup_only(struct netns_ipvs *ipvs) 1041 { 1042 return ipvs->sync_state & IP_VS_STATE_BACKUP && 1043 ipvs->sysctl_backup_only; 1044 } 1045 1046 static inline int sysctl_conn_reuse_mode(struct netns_ipvs *ipvs) 1047 { 1048 return ipvs->sysctl_conn_reuse_mode; 1049 } 1050 1051 static inline int sysctl_schedule_icmp(struct netns_ipvs *ipvs) 1052 { 1053 return ipvs->sysctl_schedule_icmp; 1054 } 1055 1056 static inline int sysctl_ignore_tunneled(struct netns_ipvs *ipvs) 1057 { 1058 return ipvs->sysctl_ignore_tunneled; 1059 } 1060 1061 static inline int sysctl_cache_bypass(struct netns_ipvs *ipvs) 1062 { 1063 return ipvs->sysctl_cache_bypass; 1064 } 1065 1066 #else 1067 1068 static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs) 1069 { 1070 return DEFAULT_SYNC_THRESHOLD; 1071 } 1072 1073 static inline int sysctl_sync_period(struct netns_ipvs *ipvs) 1074 { 1075 return DEFAULT_SYNC_PERIOD; 1076 } 1077 1078 static inline unsigned int sysctl_sync_refresh_period(struct netns_ipvs *ipvs) 1079 { 1080 return DEFAULT_SYNC_REFRESH_PERIOD; 1081 } 1082 1083 static inline int sysctl_sync_retries(struct netns_ipvs *ipvs) 1084 { 1085 return DEFAULT_SYNC_RETRIES & 3; 1086 } 1087 1088 static inline int sysctl_sync_ver(struct netns_ipvs *ipvs) 1089 { 1090 return DEFAULT_SYNC_VER; 1091 } 1092 1093 static inline int sysctl_sloppy_tcp(struct netns_ipvs *ipvs) 1094 { 1095 return DEFAULT_SLOPPY_TCP; 1096 } 1097 1098 static inline int sysctl_sloppy_sctp(struct netns_ipvs *ipvs) 1099 { 1100 return DEFAULT_SLOPPY_SCTP; 1101 } 1102 1103 static inline int sysctl_sync_ports(struct netns_ipvs *ipvs) 1104 { 1105 return 1; 1106 } 1107 1108 static inline int sysctl_sync_persist_mode(struct netns_ipvs *ipvs) 1109 { 1110 return 0; 1111 } 1112 1113 static inline unsigned long sysctl_sync_qlen_max(struct netns_ipvs *ipvs) 1114 { 1115 return IPVS_SYNC_QLEN_MAX; 1116 } 1117 1118 static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs) 1119 { 1120 return 0; 1121 } 1122 1123 static inline int sysctl_pmtu_disc(struct netns_ipvs *ipvs) 1124 { 1125 return 1; 1126 } 1127 1128 static inline int sysctl_backup_only(struct netns_ipvs *ipvs) 1129 { 1130 return 0; 1131 } 1132 1133 static inline int sysctl_conn_reuse_mode(struct netns_ipvs *ipvs) 1134 { 1135 return 1; 1136 } 1137 1138 static inline int sysctl_schedule_icmp(struct netns_ipvs *ipvs) 1139 { 1140 return 0; 1141 } 1142 1143 static inline int sysctl_ignore_tunneled(struct netns_ipvs *ipvs) 1144 { 1145 return 0; 1146 } 1147 1148 static inline int sysctl_cache_bypass(struct netns_ipvs *ipvs) 1149 { 1150 return 0; 1151 } 1152 1153 #endif 1154 1155 /* IPVS core functions 1156 * (from ip_vs_core.c) 1157 */ 1158 const char *ip_vs_proto_name(unsigned int proto); 1159 void ip_vs_init_hash_table(struct list_head *table, int rows); 1160 struct ip_vs_conn *ip_vs_new_conn_out(struct ip_vs_service *svc, 1161 struct ip_vs_dest *dest, 1162 struct sk_buff *skb, 1163 const struct ip_vs_iphdr *iph, 1164 __be16 dport, 1165 __be16 cport); 1166 #define IP_VS_INIT_HASH_TABLE(t) ip_vs_init_hash_table((t), ARRAY_SIZE((t))) 1167 1168 #define IP_VS_APP_TYPE_FTP 1 1169 1170 /* ip_vs_conn handling functions 1171 * (from ip_vs_conn.c) 1172 */ 1173 enum { 1174 IP_VS_DIR_INPUT = 0, 1175 IP_VS_DIR_OUTPUT, 1176 IP_VS_DIR_INPUT_ONLY, 1177 IP_VS_DIR_LAST, 1178 }; 1179 1180 static inline void ip_vs_conn_fill_param(struct netns_ipvs *ipvs, int af, int protocol, 1181 const union nf_inet_addr *caddr, 1182 __be16 cport, 1183 const union nf_inet_addr *vaddr, 1184 __be16 vport, 1185 struct ip_vs_conn_param *p) 1186 { 1187 p->ipvs = ipvs; 1188 p->af = af; 1189 p->protocol = protocol; 1190 p->caddr = caddr; 1191 p->cport = cport; 1192 p->vaddr = vaddr; 1193 p->vport = vport; 1194 p->pe = NULL; 1195 p->pe_data = NULL; 1196 } 1197 1198 struct ip_vs_conn *ip_vs_conn_in_get(const struct ip_vs_conn_param *p); 1199 struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p); 1200 1201 struct ip_vs_conn * ip_vs_conn_in_get_proto(struct netns_ipvs *ipvs, int af, 1202 const struct sk_buff *skb, 1203 const struct ip_vs_iphdr *iph); 1204 1205 struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p); 1206 1207 struct ip_vs_conn * ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af, 1208 const struct sk_buff *skb, 1209 const struct ip_vs_iphdr *iph); 1210 1211 /* Get reference to gain full access to conn. 1212 * By default, RCU read-side critical sections have access only to 1213 * conn fields and its PE data, see ip_vs_conn_rcu_free() for reference. 1214 */ 1215 static inline bool __ip_vs_conn_get(struct ip_vs_conn *cp) 1216 { 1217 return refcount_inc_not_zero(&cp->refcnt); 1218 } 1219 1220 /* put back the conn without restarting its timer */ 1221 static inline void __ip_vs_conn_put(struct ip_vs_conn *cp) 1222 { 1223 smp_mb__before_atomic(); 1224 refcount_dec(&cp->refcnt); 1225 } 1226 void ip_vs_conn_put(struct ip_vs_conn *cp); 1227 void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport); 1228 1229 struct ip_vs_conn *ip_vs_conn_new(const struct ip_vs_conn_param *p, int dest_af, 1230 const union nf_inet_addr *daddr, 1231 __be16 dport, unsigned int flags, 1232 struct ip_vs_dest *dest, __u32 fwmark); 1233 void ip_vs_conn_expire_now(struct ip_vs_conn *cp); 1234 1235 const char *ip_vs_state_name(__u16 proto, int state); 1236 1237 void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp); 1238 int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest); 1239 void ip_vs_random_dropentry(struct netns_ipvs *ipvs); 1240 int ip_vs_conn_init(void); 1241 void ip_vs_conn_cleanup(void); 1242 1243 static inline void ip_vs_control_del(struct ip_vs_conn *cp) 1244 { 1245 struct ip_vs_conn *ctl_cp = cp->control; 1246 if (!ctl_cp) { 1247 IP_VS_ERR_BUF("request control DEL for uncontrolled: " 1248 "%s:%d to %s:%d\n", 1249 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1250 ntohs(cp->cport), 1251 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), 1252 ntohs(cp->vport)); 1253 1254 return; 1255 } 1256 1257 IP_VS_DBG_BUF(7, "DELeting control for: " 1258 "cp.dst=%s:%d ctl_cp.dst=%s:%d\n", 1259 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1260 ntohs(cp->cport), 1261 IP_VS_DBG_ADDR(cp->af, &ctl_cp->caddr), 1262 ntohs(ctl_cp->cport)); 1263 1264 cp->control = NULL; 1265 if (atomic_read(&ctl_cp->n_control) == 0) { 1266 IP_VS_ERR_BUF("BUG control DEL with n=0 : " 1267 "%s:%d to %s:%d\n", 1268 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1269 ntohs(cp->cport), 1270 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), 1271 ntohs(cp->vport)); 1272 1273 return; 1274 } 1275 atomic_dec(&ctl_cp->n_control); 1276 } 1277 1278 static inline void 1279 ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp) 1280 { 1281 if (cp->control) { 1282 IP_VS_ERR_BUF("request control ADD for already controlled: " 1283 "%s:%d to %s:%d\n", 1284 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1285 ntohs(cp->cport), 1286 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), 1287 ntohs(cp->vport)); 1288 1289 ip_vs_control_del(cp); 1290 } 1291 1292 IP_VS_DBG_BUF(7, "ADDing control for: " 1293 "cp.dst=%s:%d ctl_cp.dst=%s:%d\n", 1294 IP_VS_DBG_ADDR(cp->af, &cp->caddr), 1295 ntohs(cp->cport), 1296 IP_VS_DBG_ADDR(cp->af, &ctl_cp->caddr), 1297 ntohs(ctl_cp->cport)); 1298 1299 cp->control = ctl_cp; 1300 atomic_inc(&ctl_cp->n_control); 1301 } 1302 1303 /* IPVS netns init & cleanup functions */ 1304 int ip_vs_estimator_net_init(struct netns_ipvs *ipvs); 1305 int ip_vs_control_net_init(struct netns_ipvs *ipvs); 1306 int ip_vs_protocol_net_init(struct netns_ipvs *ipvs); 1307 int ip_vs_app_net_init(struct netns_ipvs *ipvs); 1308 int ip_vs_conn_net_init(struct netns_ipvs *ipvs); 1309 int ip_vs_sync_net_init(struct netns_ipvs *ipvs); 1310 void ip_vs_conn_net_cleanup(struct netns_ipvs *ipvs); 1311 void ip_vs_app_net_cleanup(struct netns_ipvs *ipvs); 1312 void ip_vs_protocol_net_cleanup(struct netns_ipvs *ipvs); 1313 void ip_vs_control_net_cleanup(struct netns_ipvs *ipvs); 1314 void ip_vs_estimator_net_cleanup(struct netns_ipvs *ipvs); 1315 void ip_vs_sync_net_cleanup(struct netns_ipvs *ipvs); 1316 void ip_vs_service_net_cleanup(struct netns_ipvs *ipvs); 1317 1318 /* IPVS application functions 1319 * (from ip_vs_app.c) 1320 */ 1321 #define IP_VS_APP_MAX_PORTS 8 1322 struct ip_vs_app *register_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *app); 1323 void unregister_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *app); 1324 int ip_vs_bind_app(struct ip_vs_conn *cp, struct ip_vs_protocol *pp); 1325 void ip_vs_unbind_app(struct ip_vs_conn *cp); 1326 int register_ip_vs_app_inc(struct netns_ipvs *ipvs, struct ip_vs_app *app, __u16 proto, 1327 __u16 port); 1328 int ip_vs_app_inc_get(struct ip_vs_app *inc); 1329 void ip_vs_app_inc_put(struct ip_vs_app *inc); 1330 1331 int ip_vs_app_pkt_out(struct ip_vs_conn *, struct sk_buff *skb); 1332 int ip_vs_app_pkt_in(struct ip_vs_conn *, struct sk_buff *skb); 1333 1334 int register_ip_vs_pe(struct ip_vs_pe *pe); 1335 int unregister_ip_vs_pe(struct ip_vs_pe *pe); 1336 struct ip_vs_pe *ip_vs_pe_getbyname(const char *name); 1337 struct ip_vs_pe *__ip_vs_pe_getbyname(const char *pe_name); 1338 1339 /* Use a #define to avoid all of module.h just for these trivial ops */ 1340 #define ip_vs_pe_get(pe) \ 1341 if (pe && pe->module) \ 1342 __module_get(pe->module); 1343 1344 #define ip_vs_pe_put(pe) \ 1345 if (pe && pe->module) \ 1346 module_put(pe->module); 1347 1348 /* IPVS protocol functions (from ip_vs_proto.c) */ 1349 int ip_vs_protocol_init(void); 1350 void ip_vs_protocol_cleanup(void); 1351 void ip_vs_protocol_timeout_change(struct netns_ipvs *ipvs, int flags); 1352 int *ip_vs_create_timeout_table(int *table, int size); 1353 void ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp, 1354 const struct sk_buff *skb, int offset, 1355 const char *msg); 1356 1357 extern struct ip_vs_protocol ip_vs_protocol_tcp; 1358 extern struct ip_vs_protocol ip_vs_protocol_udp; 1359 extern struct ip_vs_protocol ip_vs_protocol_icmp; 1360 extern struct ip_vs_protocol ip_vs_protocol_esp; 1361 extern struct ip_vs_protocol ip_vs_protocol_ah; 1362 extern struct ip_vs_protocol ip_vs_protocol_sctp; 1363 1364 /* Registering/unregistering scheduler functions 1365 * (from ip_vs_sched.c) 1366 */ 1367 int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler); 1368 int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler); 1369 int ip_vs_bind_scheduler(struct ip_vs_service *svc, 1370 struct ip_vs_scheduler *scheduler); 1371 void ip_vs_unbind_scheduler(struct ip_vs_service *svc, 1372 struct ip_vs_scheduler *sched); 1373 struct ip_vs_scheduler *ip_vs_scheduler_get(const char *sched_name); 1374 void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler); 1375 struct ip_vs_conn * 1376 ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, 1377 struct ip_vs_proto_data *pd, int *ignored, 1378 struct ip_vs_iphdr *iph); 1379 int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, 1380 struct ip_vs_proto_data *pd, struct ip_vs_iphdr *iph); 1381 1382 void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg); 1383 1384 /* IPVS control data and functions (from ip_vs_ctl.c) */ 1385 extern struct ip_vs_stats ip_vs_stats; 1386 extern int sysctl_ip_vs_sync_ver; 1387 1388 struct ip_vs_service * 1389 ip_vs_service_find(struct netns_ipvs *ipvs, int af, __u32 fwmark, __u16 protocol, 1390 const union nf_inet_addr *vaddr, __be16 vport); 1391 1392 bool ip_vs_has_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol, 1393 const union nf_inet_addr *daddr, __be16 dport); 1394 1395 struct ip_vs_dest * 1396 ip_vs_find_real_service(struct netns_ipvs *ipvs, int af, __u16 protocol, 1397 const union nf_inet_addr *daddr, __be16 dport); 1398 1399 int ip_vs_use_count_inc(void); 1400 void ip_vs_use_count_dec(void); 1401 int ip_vs_register_nl_ioctl(void); 1402 void ip_vs_unregister_nl_ioctl(void); 1403 int ip_vs_control_init(void); 1404 void ip_vs_control_cleanup(void); 1405 struct ip_vs_dest * 1406 ip_vs_find_dest(struct netns_ipvs *ipvs, int svc_af, int dest_af, 1407 const union nf_inet_addr *daddr, __be16 dport, 1408 const union nf_inet_addr *vaddr, __be16 vport, 1409 __u16 protocol, __u32 fwmark, __u32 flags); 1410 void ip_vs_try_bind_dest(struct ip_vs_conn *cp); 1411 1412 static inline void ip_vs_dest_hold(struct ip_vs_dest *dest) 1413 { 1414 refcount_inc(&dest->refcnt); 1415 } 1416 1417 static inline void ip_vs_dest_put(struct ip_vs_dest *dest) 1418 { 1419 smp_mb__before_atomic(); 1420 refcount_dec(&dest->refcnt); 1421 } 1422 1423 static inline void ip_vs_dest_put_and_free(struct ip_vs_dest *dest) 1424 { 1425 if (refcount_dec_and_test(&dest->refcnt)) 1426 kfree(dest); 1427 } 1428 1429 /* IPVS sync daemon data and function prototypes 1430 * (from ip_vs_sync.c) 1431 */ 1432 int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *cfg, 1433 int state); 1434 int stop_sync_thread(struct netns_ipvs *ipvs, int state); 1435 void ip_vs_sync_conn(struct netns_ipvs *ipvs, struct ip_vs_conn *cp, int pkts); 1436 1437 /* IPVS rate estimator prototypes (from ip_vs_est.c) */ 1438 void ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats); 1439 void ip_vs_stop_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats); 1440 void ip_vs_zero_estimator(struct ip_vs_stats *stats); 1441 void ip_vs_read_estimator(struct ip_vs_kstats *dst, struct ip_vs_stats *stats); 1442 1443 /* Various IPVS packet transmitters (from ip_vs_xmit.c) */ 1444 int ip_vs_null_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1445 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1446 int ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1447 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1448 int ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1449 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1450 int ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1451 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1452 int ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1453 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1454 int ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, 1455 struct ip_vs_protocol *pp, int offset, 1456 unsigned int hooknum, struct ip_vs_iphdr *iph); 1457 void ip_vs_dest_dst_rcu_free(struct rcu_head *head); 1458 1459 #ifdef CONFIG_IP_VS_IPV6 1460 int ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1461 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1462 int ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1463 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1464 int ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1465 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1466 int ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1467 struct ip_vs_protocol *pp, struct ip_vs_iphdr *iph); 1468 int ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, 1469 struct ip_vs_protocol *pp, int offset, 1470 unsigned int hooknum, struct ip_vs_iphdr *iph); 1471 #endif 1472 1473 #ifdef CONFIG_SYSCTL 1474 /* This is a simple mechanism to ignore packets when 1475 * we are loaded. Just set ip_vs_drop_rate to 'n' and 1476 * we start to drop 1/rate of the packets 1477 */ 1478 static inline int ip_vs_todrop(struct netns_ipvs *ipvs) 1479 { 1480 if (!ipvs->drop_rate) 1481 return 0; 1482 if (--ipvs->drop_counter > 0) 1483 return 0; 1484 ipvs->drop_counter = ipvs->drop_rate; 1485 return 1; 1486 } 1487 #else 1488 static inline int ip_vs_todrop(struct netns_ipvs *ipvs) { return 0; } 1489 #endif 1490 1491 /* ip_vs_fwd_tag returns the forwarding tag of the connection */ 1492 #define IP_VS_FWD_METHOD(cp) (cp->flags & IP_VS_CONN_F_FWD_MASK) 1493 1494 static inline char ip_vs_fwd_tag(struct ip_vs_conn *cp) 1495 { 1496 char fwd; 1497 1498 switch (IP_VS_FWD_METHOD(cp)) { 1499 case IP_VS_CONN_F_MASQ: 1500 fwd = 'M'; break; 1501 case IP_VS_CONN_F_LOCALNODE: 1502 fwd = 'L'; break; 1503 case IP_VS_CONN_F_TUNNEL: 1504 fwd = 'T'; break; 1505 case IP_VS_CONN_F_DROUTE: 1506 fwd = 'R'; break; 1507 case IP_VS_CONN_F_BYPASS: 1508 fwd = 'B'; break; 1509 default: 1510 fwd = '?'; break; 1511 } 1512 return fwd; 1513 } 1514 1515 void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp, 1516 struct ip_vs_conn *cp, int dir); 1517 1518 #ifdef CONFIG_IP_VS_IPV6 1519 void ip_vs_nat_icmp_v6(struct sk_buff *skb, struct ip_vs_protocol *pp, 1520 struct ip_vs_conn *cp, int dir); 1521 #endif 1522 1523 __sum16 ip_vs_checksum_complete(struct sk_buff *skb, int offset); 1524 1525 static inline __wsum ip_vs_check_diff4(__be32 old, __be32 new, __wsum oldsum) 1526 { 1527 __be32 diff[2] = { ~old, new }; 1528 1529 return csum_partial(diff, sizeof(diff), oldsum); 1530 } 1531 1532 #ifdef CONFIG_IP_VS_IPV6 1533 static inline __wsum ip_vs_check_diff16(const __be32 *old, const __be32 *new, 1534 __wsum oldsum) 1535 { 1536 __be32 diff[8] = { ~old[3], ~old[2], ~old[1], ~old[0], 1537 new[3], new[2], new[1], new[0] }; 1538 1539 return csum_partial(diff, sizeof(diff), oldsum); 1540 } 1541 #endif 1542 1543 static inline __wsum ip_vs_check_diff2(__be16 old, __be16 new, __wsum oldsum) 1544 { 1545 __be16 diff[2] = { ~old, new }; 1546 1547 return csum_partial(diff, sizeof(diff), oldsum); 1548 } 1549 1550 /* Forget current conntrack (unconfirmed) and attach notrack entry */ 1551 static inline void ip_vs_notrack(struct sk_buff *skb) 1552 { 1553 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) 1554 enum ip_conntrack_info ctinfo; 1555 struct nf_conn *ct = nf_ct_get(skb, &ctinfo); 1556 1557 if (ct) { 1558 nf_conntrack_put(&ct->ct_general); 1559 nf_ct_set(skb, NULL, IP_CT_UNTRACKED); 1560 } 1561 #endif 1562 } 1563 1564 #ifdef CONFIG_IP_VS_NFCT 1565 /* Netfilter connection tracking 1566 * (from ip_vs_nfct.c) 1567 */ 1568 static inline int ip_vs_conntrack_enabled(struct netns_ipvs *ipvs) 1569 { 1570 #ifdef CONFIG_SYSCTL 1571 return ipvs->sysctl_conntrack; 1572 #else 1573 return 0; 1574 #endif 1575 } 1576 1577 void ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, 1578 int outin); 1579 int ip_vs_confirm_conntrack(struct sk_buff *skb); 1580 void ip_vs_nfct_expect_related(struct sk_buff *skb, struct nf_conn *ct, 1581 struct ip_vs_conn *cp, u_int8_t proto, 1582 const __be16 port, int from_rs); 1583 void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp); 1584 1585 #else 1586 1587 static inline int ip_vs_conntrack_enabled(struct netns_ipvs *ipvs) 1588 { 1589 return 0; 1590 } 1591 1592 static inline void ip_vs_update_conntrack(struct sk_buff *skb, 1593 struct ip_vs_conn *cp, int outin) 1594 { 1595 } 1596 1597 static inline int ip_vs_confirm_conntrack(struct sk_buff *skb) 1598 { 1599 return NF_ACCEPT; 1600 } 1601 1602 static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) 1603 { 1604 } 1605 #endif /* CONFIG_IP_VS_NFCT */ 1606 1607 /* Really using conntrack? */ 1608 static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, 1609 struct sk_buff *skb) 1610 { 1611 #ifdef CONFIG_IP_VS_NFCT 1612 enum ip_conntrack_info ctinfo; 1613 struct nf_conn *ct; 1614 1615 if (!(cp->flags & IP_VS_CONN_F_NFCT)) 1616 return false; 1617 ct = nf_ct_get(skb, &ctinfo); 1618 if (ct) 1619 return true; 1620 #endif 1621 return false; 1622 } 1623 1624 static inline int 1625 ip_vs_dest_conn_overhead(struct ip_vs_dest *dest) 1626 { 1627 /* We think the overhead of processing active connections is 256 1628 * times higher than that of inactive connections in average. (This 1629 * 256 times might not be accurate, we will change it later) We 1630 * use the following formula to estimate the overhead now: 1631 * dest->activeconns*256 + dest->inactconns 1632 */ 1633 return (atomic_read(&dest->activeconns) << 8) + 1634 atomic_read(&dest->inactconns); 1635 } 1636 1637 #endif /* _NET_IP_VS_H */ 1638