1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * IPVS An implementation of the IP virtual server support for the 4 * LINUX operating system. IPVS is now implemented as a module 5 * over the Netfilter framework. IPVS can be used to build a 6 * high-performance and highly available server based on a 7 * cluster of servers. 8 * 9 * Authors: Wensong Zhang <wensong@linuxvirtualserver.org> 10 * Peter Kese <peter.kese@ijs.si> 11 * Julian Anastasov <ja@ssi.bg> 12 * 13 * The IPVS code for kernel 2.2 was done by Wensong Zhang and Peter Kese, 14 * with changes/fixes from Julian Anastasov, Lars Marowsky-Bree, Horms 15 * and others. Many code here is taken from IP MASQ code of kernel 2.2. 16 * 17 * Changes: 18 */ 19 20 #define KMSG_COMPONENT "IPVS" 21 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt 22 23 #include <linux/interrupt.h> 24 #include <linux/in.h> 25 #include <linux/inet.h> 26 #include <linux/net.h> 27 #include <linux/kernel.h> 28 #include <linux/module.h> 29 #include <linux/vmalloc.h> 30 #include <linux/proc_fs.h> /* for proc_net_* */ 31 #include <linux/slab.h> 32 #include <linux/seq_file.h> 33 #include <linux/jhash.h> 34 #include <linux/random.h> 35 36 #include <net/net_namespace.h> 37 #include <net/ip_vs.h> 38 39 40 #ifndef CONFIG_IP_VS_TAB_BITS 41 #define CONFIG_IP_VS_TAB_BITS 12 42 #endif 43 44 /* 45 * Connection hash size. Default is what was selected at compile time. 46 */ 47 static int ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS; 48 module_param_named(conn_tab_bits, ip_vs_conn_tab_bits, int, 0444); 49 MODULE_PARM_DESC(conn_tab_bits, "Set connections' hash size"); 50 51 /* size and mask values */ 52 int ip_vs_conn_tab_size __read_mostly; 53 static int ip_vs_conn_tab_mask __read_mostly; 54 55 /* 56 * Connection hash table: for input and output packets lookups of IPVS 57 */ 58 static struct hlist_head *ip_vs_conn_tab __read_mostly; 59 60 /* SLAB cache for IPVS connections */ 61 static struct kmem_cache *ip_vs_conn_cachep __read_mostly; 62 63 /* counter for no client port connections */ 64 static atomic_t ip_vs_conn_no_cport_cnt = ATOMIC_INIT(0); 65 66 /* random value for IPVS connection hash */ 67 static unsigned int ip_vs_conn_rnd __read_mostly; 68 69 /* 70 * Fine locking granularity for big connection hash table 71 */ 72 #define CT_LOCKARRAY_BITS 5 73 #define CT_LOCKARRAY_SIZE (1<<CT_LOCKARRAY_BITS) 74 #define CT_LOCKARRAY_MASK (CT_LOCKARRAY_SIZE-1) 75 76 /* We need an addrstrlen that works with or without v6 */ 77 #ifdef CONFIG_IP_VS_IPV6 78 #define IP_VS_ADDRSTRLEN INET6_ADDRSTRLEN 79 #else 80 #define IP_VS_ADDRSTRLEN (8+1) 81 #endif 82 83 struct ip_vs_aligned_lock 84 { 85 spinlock_t l; 86 } __attribute__((__aligned__(SMP_CACHE_BYTES))); 87 88 /* lock array for conn table */ 89 static struct ip_vs_aligned_lock 90 __ip_vs_conntbl_lock_array[CT_LOCKARRAY_SIZE] __cacheline_aligned; 91 92 static inline void ct_write_lock_bh(unsigned int key) 93 { 94 spin_lock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l); 95 } 96 97 static inline void ct_write_unlock_bh(unsigned int key) 98 { 99 spin_unlock_bh(&__ip_vs_conntbl_lock_array[key&CT_LOCKARRAY_MASK].l); 100 } 101 102 static void ip_vs_conn_expire(struct timer_list *t); 103 104 /* 105 * Returns hash value for IPVS connection entry 106 */ 107 static unsigned int ip_vs_conn_hashkey(struct netns_ipvs *ipvs, int af, unsigned int proto, 108 const union nf_inet_addr *addr, 109 __be16 port) 110 { 111 #ifdef CONFIG_IP_VS_IPV6 112 if (af == AF_INET6) 113 return (jhash_3words(jhash(addr, 16, ip_vs_conn_rnd), 114 (__force u32)port, proto, ip_vs_conn_rnd) ^ 115 ((size_t)ipvs>>8)) & ip_vs_conn_tab_mask; 116 #endif 117 return (jhash_3words((__force u32)addr->ip, (__force u32)port, proto, 118 ip_vs_conn_rnd) ^ 119 ((size_t)ipvs>>8)) & ip_vs_conn_tab_mask; 120 } 121 122 static unsigned int ip_vs_conn_hashkey_param(const struct ip_vs_conn_param *p, 123 bool inverse) 124 { 125 const union nf_inet_addr *addr; 126 __be16 port; 127 128 if (p->pe_data && p->pe->hashkey_raw) 129 return p->pe->hashkey_raw(p, ip_vs_conn_rnd, inverse) & 130 ip_vs_conn_tab_mask; 131 132 if (likely(!inverse)) { 133 addr = p->caddr; 134 port = p->cport; 135 } else { 136 addr = p->vaddr; 137 port = p->vport; 138 } 139 140 return ip_vs_conn_hashkey(p->ipvs, p->af, p->protocol, addr, port); 141 } 142 143 static unsigned int ip_vs_conn_hashkey_conn(const struct ip_vs_conn *cp) 144 { 145 struct ip_vs_conn_param p; 146 147 ip_vs_conn_fill_param(cp->ipvs, cp->af, cp->protocol, 148 &cp->caddr, cp->cport, NULL, 0, &p); 149 150 if (cp->pe) { 151 p.pe = cp->pe; 152 p.pe_data = cp->pe_data; 153 p.pe_data_len = cp->pe_data_len; 154 } 155 156 return ip_vs_conn_hashkey_param(&p, false); 157 } 158 159 /* 160 * Hashes ip_vs_conn in ip_vs_conn_tab by netns,proto,addr,port. 161 * returns bool success. 162 */ 163 static inline int ip_vs_conn_hash(struct ip_vs_conn *cp) 164 { 165 unsigned int hash; 166 int ret; 167 168 if (cp->flags & IP_VS_CONN_F_ONE_PACKET) 169 return 0; 170 171 /* Hash by protocol, client address and port */ 172 hash = ip_vs_conn_hashkey_conn(cp); 173 174 ct_write_lock_bh(hash); 175 spin_lock(&cp->lock); 176 177 if (!(cp->flags & IP_VS_CONN_F_HASHED)) { 178 cp->flags |= IP_VS_CONN_F_HASHED; 179 refcount_inc(&cp->refcnt); 180 hlist_add_head_rcu(&cp->c_list, &ip_vs_conn_tab[hash]); 181 ret = 1; 182 } else { 183 pr_err("%s(): request for already hashed, called from %pS\n", 184 __func__, __builtin_return_address(0)); 185 ret = 0; 186 } 187 188 spin_unlock(&cp->lock); 189 ct_write_unlock_bh(hash); 190 191 return ret; 192 } 193 194 195 /* 196 * UNhashes ip_vs_conn from ip_vs_conn_tab. 197 * returns bool success. Caller should hold conn reference. 198 */ 199 static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp) 200 { 201 unsigned int hash; 202 int ret; 203 204 /* unhash it and decrease its reference counter */ 205 hash = ip_vs_conn_hashkey_conn(cp); 206 207 ct_write_lock_bh(hash); 208 spin_lock(&cp->lock); 209 210 if (cp->flags & IP_VS_CONN_F_HASHED) { 211 hlist_del_rcu(&cp->c_list); 212 cp->flags &= ~IP_VS_CONN_F_HASHED; 213 refcount_dec(&cp->refcnt); 214 ret = 1; 215 } else 216 ret = 0; 217 218 spin_unlock(&cp->lock); 219 ct_write_unlock_bh(hash); 220 221 return ret; 222 } 223 224 /* Try to unlink ip_vs_conn from ip_vs_conn_tab. 225 * returns bool success. 226 */ 227 static inline bool ip_vs_conn_unlink(struct ip_vs_conn *cp) 228 { 229 unsigned int hash; 230 bool ret = false; 231 232 if (cp->flags & IP_VS_CONN_F_ONE_PACKET) 233 return refcount_dec_if_one(&cp->refcnt); 234 235 hash = ip_vs_conn_hashkey_conn(cp); 236 237 ct_write_lock_bh(hash); 238 spin_lock(&cp->lock); 239 240 if (cp->flags & IP_VS_CONN_F_HASHED) { 241 /* Decrease refcnt and unlink conn only if we are last user */ 242 if (refcount_dec_if_one(&cp->refcnt)) { 243 hlist_del_rcu(&cp->c_list); 244 cp->flags &= ~IP_VS_CONN_F_HASHED; 245 ret = true; 246 } 247 } 248 249 spin_unlock(&cp->lock); 250 ct_write_unlock_bh(hash); 251 252 return ret; 253 } 254 255 256 /* 257 * Gets ip_vs_conn associated with supplied parameters in the ip_vs_conn_tab. 258 * Called for pkts coming from OUTside-to-INside. 259 * p->caddr, p->cport: pkt source address (foreign host) 260 * p->vaddr, p->vport: pkt dest address (load balancer) 261 */ 262 static inline struct ip_vs_conn * 263 __ip_vs_conn_in_get(const struct ip_vs_conn_param *p) 264 { 265 unsigned int hash; 266 struct ip_vs_conn *cp; 267 268 hash = ip_vs_conn_hashkey_param(p, false); 269 270 rcu_read_lock(); 271 272 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[hash], c_list) { 273 if (p->cport == cp->cport && p->vport == cp->vport && 274 cp->af == p->af && 275 ip_vs_addr_equal(p->af, p->caddr, &cp->caddr) && 276 ip_vs_addr_equal(p->af, p->vaddr, &cp->vaddr) && 277 ((!p->cport) ^ (!(cp->flags & IP_VS_CONN_F_NO_CPORT))) && 278 p->protocol == cp->protocol && 279 cp->ipvs == p->ipvs) { 280 if (!__ip_vs_conn_get(cp)) 281 continue; 282 /* HIT */ 283 rcu_read_unlock(); 284 return cp; 285 } 286 } 287 288 rcu_read_unlock(); 289 290 return NULL; 291 } 292 293 struct ip_vs_conn *ip_vs_conn_in_get(const struct ip_vs_conn_param *p) 294 { 295 struct ip_vs_conn *cp; 296 297 cp = __ip_vs_conn_in_get(p); 298 if (!cp && atomic_read(&ip_vs_conn_no_cport_cnt)) { 299 struct ip_vs_conn_param cport_zero_p = *p; 300 cport_zero_p.cport = 0; 301 cp = __ip_vs_conn_in_get(&cport_zero_p); 302 } 303 304 IP_VS_DBG_BUF(9, "lookup/in %s %s:%d->%s:%d %s\n", 305 ip_vs_proto_name(p->protocol), 306 IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport), 307 IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport), 308 cp ? "hit" : "not hit"); 309 310 return cp; 311 } 312 313 static int 314 ip_vs_conn_fill_param_proto(struct netns_ipvs *ipvs, 315 int af, const struct sk_buff *skb, 316 const struct ip_vs_iphdr *iph, 317 struct ip_vs_conn_param *p) 318 { 319 __be16 _ports[2], *pptr; 320 321 pptr = frag_safe_skb_hp(skb, iph->len, sizeof(_ports), _ports); 322 if (pptr == NULL) 323 return 1; 324 325 if (likely(!ip_vs_iph_inverse(iph))) 326 ip_vs_conn_fill_param(ipvs, af, iph->protocol, &iph->saddr, 327 pptr[0], &iph->daddr, pptr[1], p); 328 else 329 ip_vs_conn_fill_param(ipvs, af, iph->protocol, &iph->daddr, 330 pptr[1], &iph->saddr, pptr[0], p); 331 return 0; 332 } 333 334 struct ip_vs_conn * 335 ip_vs_conn_in_get_proto(struct netns_ipvs *ipvs, int af, 336 const struct sk_buff *skb, 337 const struct ip_vs_iphdr *iph) 338 { 339 struct ip_vs_conn_param p; 340 341 if (ip_vs_conn_fill_param_proto(ipvs, af, skb, iph, &p)) 342 return NULL; 343 344 return ip_vs_conn_in_get(&p); 345 } 346 EXPORT_SYMBOL_GPL(ip_vs_conn_in_get_proto); 347 348 /* Get reference to connection template */ 349 struct ip_vs_conn *ip_vs_ct_in_get(const struct ip_vs_conn_param *p) 350 { 351 unsigned int hash; 352 struct ip_vs_conn *cp; 353 354 hash = ip_vs_conn_hashkey_param(p, false); 355 356 rcu_read_lock(); 357 358 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[hash], c_list) { 359 if (unlikely(p->pe_data && p->pe->ct_match)) { 360 if (cp->ipvs != p->ipvs) 361 continue; 362 if (p->pe == cp->pe && p->pe->ct_match(p, cp)) { 363 if (__ip_vs_conn_get(cp)) 364 goto out; 365 } 366 continue; 367 } 368 369 if (cp->af == p->af && 370 ip_vs_addr_equal(p->af, p->caddr, &cp->caddr) && 371 /* protocol should only be IPPROTO_IP if 372 * p->vaddr is a fwmark */ 373 ip_vs_addr_equal(p->protocol == IPPROTO_IP ? AF_UNSPEC : 374 p->af, p->vaddr, &cp->vaddr) && 375 p->vport == cp->vport && p->cport == cp->cport && 376 cp->flags & IP_VS_CONN_F_TEMPLATE && 377 p->protocol == cp->protocol && 378 cp->ipvs == p->ipvs) { 379 if (__ip_vs_conn_get(cp)) 380 goto out; 381 } 382 } 383 cp = NULL; 384 385 out: 386 rcu_read_unlock(); 387 388 IP_VS_DBG_BUF(9, "template lookup/in %s %s:%d->%s:%d %s\n", 389 ip_vs_proto_name(p->protocol), 390 IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport), 391 IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport), 392 cp ? "hit" : "not hit"); 393 394 return cp; 395 } 396 397 /* Gets ip_vs_conn associated with supplied parameters in the ip_vs_conn_tab. 398 * Called for pkts coming from inside-to-OUTside. 399 * p->caddr, p->cport: pkt source address (inside host) 400 * p->vaddr, p->vport: pkt dest address (foreign host) */ 401 struct ip_vs_conn *ip_vs_conn_out_get(const struct ip_vs_conn_param *p) 402 { 403 unsigned int hash; 404 struct ip_vs_conn *cp, *ret=NULL; 405 406 /* 407 * Check for "full" addressed entries 408 */ 409 hash = ip_vs_conn_hashkey_param(p, true); 410 411 rcu_read_lock(); 412 413 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[hash], c_list) { 414 if (p->vport == cp->cport && p->cport == cp->dport && 415 cp->af == p->af && 416 ip_vs_addr_equal(p->af, p->vaddr, &cp->caddr) && 417 ip_vs_addr_equal(p->af, p->caddr, &cp->daddr) && 418 p->protocol == cp->protocol && 419 cp->ipvs == p->ipvs) { 420 if (!__ip_vs_conn_get(cp)) 421 continue; 422 /* HIT */ 423 ret = cp; 424 break; 425 } 426 } 427 428 rcu_read_unlock(); 429 430 IP_VS_DBG_BUF(9, "lookup/out %s %s:%d->%s:%d %s\n", 431 ip_vs_proto_name(p->protocol), 432 IP_VS_DBG_ADDR(p->af, p->caddr), ntohs(p->cport), 433 IP_VS_DBG_ADDR(p->af, p->vaddr), ntohs(p->vport), 434 ret ? "hit" : "not hit"); 435 436 return ret; 437 } 438 439 struct ip_vs_conn * 440 ip_vs_conn_out_get_proto(struct netns_ipvs *ipvs, int af, 441 const struct sk_buff *skb, 442 const struct ip_vs_iphdr *iph) 443 { 444 struct ip_vs_conn_param p; 445 446 if (ip_vs_conn_fill_param_proto(ipvs, af, skb, iph, &p)) 447 return NULL; 448 449 return ip_vs_conn_out_get(&p); 450 } 451 EXPORT_SYMBOL_GPL(ip_vs_conn_out_get_proto); 452 453 /* 454 * Put back the conn and restart its timer with its timeout 455 */ 456 static void __ip_vs_conn_put_timer(struct ip_vs_conn *cp) 457 { 458 unsigned long t = (cp->flags & IP_VS_CONN_F_ONE_PACKET) ? 459 0 : cp->timeout; 460 mod_timer(&cp->timer, jiffies+t); 461 462 __ip_vs_conn_put(cp); 463 } 464 465 void ip_vs_conn_put(struct ip_vs_conn *cp) 466 { 467 if ((cp->flags & IP_VS_CONN_F_ONE_PACKET) && 468 (refcount_read(&cp->refcnt) == 1) && 469 !timer_pending(&cp->timer)) 470 /* expire connection immediately */ 471 ip_vs_conn_expire(&cp->timer); 472 else 473 __ip_vs_conn_put_timer(cp); 474 } 475 476 /* 477 * Fill a no_client_port connection with a client port number 478 */ 479 void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport) 480 { 481 if (ip_vs_conn_unhash(cp)) { 482 spin_lock_bh(&cp->lock); 483 if (cp->flags & IP_VS_CONN_F_NO_CPORT) { 484 atomic_dec(&ip_vs_conn_no_cport_cnt); 485 cp->flags &= ~IP_VS_CONN_F_NO_CPORT; 486 cp->cport = cport; 487 } 488 spin_unlock_bh(&cp->lock); 489 490 /* hash on new dport */ 491 ip_vs_conn_hash(cp); 492 } 493 } 494 495 496 /* 497 * Bind a connection entry with the corresponding packet_xmit. 498 * Called by ip_vs_conn_new. 499 */ 500 static inline void ip_vs_bind_xmit(struct ip_vs_conn *cp) 501 { 502 switch (IP_VS_FWD_METHOD(cp)) { 503 case IP_VS_CONN_F_MASQ: 504 cp->packet_xmit = ip_vs_nat_xmit; 505 break; 506 507 case IP_VS_CONN_F_TUNNEL: 508 #ifdef CONFIG_IP_VS_IPV6 509 if (cp->daf == AF_INET6) 510 cp->packet_xmit = ip_vs_tunnel_xmit_v6; 511 else 512 #endif 513 cp->packet_xmit = ip_vs_tunnel_xmit; 514 break; 515 516 case IP_VS_CONN_F_DROUTE: 517 cp->packet_xmit = ip_vs_dr_xmit; 518 break; 519 520 case IP_VS_CONN_F_LOCALNODE: 521 cp->packet_xmit = ip_vs_null_xmit; 522 break; 523 524 case IP_VS_CONN_F_BYPASS: 525 cp->packet_xmit = ip_vs_bypass_xmit; 526 break; 527 } 528 } 529 530 #ifdef CONFIG_IP_VS_IPV6 531 static inline void ip_vs_bind_xmit_v6(struct ip_vs_conn *cp) 532 { 533 switch (IP_VS_FWD_METHOD(cp)) { 534 case IP_VS_CONN_F_MASQ: 535 cp->packet_xmit = ip_vs_nat_xmit_v6; 536 break; 537 538 case IP_VS_CONN_F_TUNNEL: 539 if (cp->daf == AF_INET6) 540 cp->packet_xmit = ip_vs_tunnel_xmit_v6; 541 else 542 cp->packet_xmit = ip_vs_tunnel_xmit; 543 break; 544 545 case IP_VS_CONN_F_DROUTE: 546 cp->packet_xmit = ip_vs_dr_xmit_v6; 547 break; 548 549 case IP_VS_CONN_F_LOCALNODE: 550 cp->packet_xmit = ip_vs_null_xmit; 551 break; 552 553 case IP_VS_CONN_F_BYPASS: 554 cp->packet_xmit = ip_vs_bypass_xmit_v6; 555 break; 556 } 557 } 558 #endif 559 560 561 static inline int ip_vs_dest_totalconns(struct ip_vs_dest *dest) 562 { 563 return atomic_read(&dest->activeconns) 564 + atomic_read(&dest->inactconns); 565 } 566 567 /* 568 * Bind a connection entry with a virtual service destination 569 * Called just after a new connection entry is created. 570 */ 571 static inline void 572 ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest) 573 { 574 unsigned int conn_flags; 575 __u32 flags; 576 577 /* if dest is NULL, then return directly */ 578 if (!dest) 579 return; 580 581 /* Increase the refcnt counter of the dest */ 582 ip_vs_dest_hold(dest); 583 584 conn_flags = atomic_read(&dest->conn_flags); 585 if (cp->protocol != IPPROTO_UDP) 586 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET; 587 flags = cp->flags; 588 /* Bind with the destination and its corresponding transmitter */ 589 if (flags & IP_VS_CONN_F_SYNC) { 590 /* if the connection is not template and is created 591 * by sync, preserve the activity flag. 592 */ 593 if (!(flags & IP_VS_CONN_F_TEMPLATE)) 594 conn_flags &= ~IP_VS_CONN_F_INACTIVE; 595 /* connections inherit forwarding method from dest */ 596 flags &= ~(IP_VS_CONN_F_FWD_MASK | IP_VS_CONN_F_NOOUTPUT); 597 } 598 flags |= conn_flags; 599 cp->flags = flags; 600 cp->dest = dest; 601 602 IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d " 603 "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d " 604 "dest->refcnt:%d\n", 605 ip_vs_proto_name(cp->protocol), 606 IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport), 607 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport), 608 IP_VS_DBG_ADDR(cp->daf, &cp->daddr), ntohs(cp->dport), 609 ip_vs_fwd_tag(cp), cp->state, 610 cp->flags, refcount_read(&cp->refcnt), 611 refcount_read(&dest->refcnt)); 612 613 /* Update the connection counters */ 614 if (!(flags & IP_VS_CONN_F_TEMPLATE)) { 615 /* It is a normal connection, so modify the counters 616 * according to the flags, later the protocol can 617 * update them on state change 618 */ 619 if (!(flags & IP_VS_CONN_F_INACTIVE)) 620 atomic_inc(&dest->activeconns); 621 else 622 atomic_inc(&dest->inactconns); 623 } else { 624 /* It is a persistent connection/template, so increase 625 the persistent connection counter */ 626 atomic_inc(&dest->persistconns); 627 } 628 629 if (dest->u_threshold != 0 && 630 ip_vs_dest_totalconns(dest) >= dest->u_threshold) 631 dest->flags |= IP_VS_DEST_F_OVERLOAD; 632 } 633 634 635 /* 636 * Check if there is a destination for the connection, if so 637 * bind the connection to the destination. 638 */ 639 void ip_vs_try_bind_dest(struct ip_vs_conn *cp) 640 { 641 struct ip_vs_dest *dest; 642 643 rcu_read_lock(); 644 645 /* This function is only invoked by the synchronization code. We do 646 * not currently support heterogeneous pools with synchronization, 647 * so we can make the assumption that the svc_af is the same as the 648 * dest_af 649 */ 650 dest = ip_vs_find_dest(cp->ipvs, cp->af, cp->af, &cp->daddr, 651 cp->dport, &cp->vaddr, cp->vport, 652 cp->protocol, cp->fwmark, cp->flags); 653 if (dest) { 654 struct ip_vs_proto_data *pd; 655 656 spin_lock_bh(&cp->lock); 657 if (cp->dest) { 658 spin_unlock_bh(&cp->lock); 659 rcu_read_unlock(); 660 return; 661 } 662 663 /* Applications work depending on the forwarding method 664 * but better to reassign them always when binding dest */ 665 if (cp->app) 666 ip_vs_unbind_app(cp); 667 668 ip_vs_bind_dest(cp, dest); 669 spin_unlock_bh(&cp->lock); 670 671 /* Update its packet transmitter */ 672 cp->packet_xmit = NULL; 673 #ifdef CONFIG_IP_VS_IPV6 674 if (cp->af == AF_INET6) 675 ip_vs_bind_xmit_v6(cp); 676 else 677 #endif 678 ip_vs_bind_xmit(cp); 679 680 pd = ip_vs_proto_data_get(cp->ipvs, cp->protocol); 681 if (pd && atomic_read(&pd->appcnt)) 682 ip_vs_bind_app(cp, pd->pp); 683 } 684 rcu_read_unlock(); 685 } 686 687 688 /* 689 * Unbind a connection entry with its VS destination 690 * Called by the ip_vs_conn_expire function. 691 */ 692 static inline void ip_vs_unbind_dest(struct ip_vs_conn *cp) 693 { 694 struct ip_vs_dest *dest = cp->dest; 695 696 if (!dest) 697 return; 698 699 IP_VS_DBG_BUF(7, "Unbind-dest %s c:%s:%d v:%s:%d " 700 "d:%s:%d fwd:%c s:%u conn->flags:%X conn->refcnt:%d " 701 "dest->refcnt:%d\n", 702 ip_vs_proto_name(cp->protocol), 703 IP_VS_DBG_ADDR(cp->af, &cp->caddr), ntohs(cp->cport), 704 IP_VS_DBG_ADDR(cp->af, &cp->vaddr), ntohs(cp->vport), 705 IP_VS_DBG_ADDR(cp->daf, &cp->daddr), ntohs(cp->dport), 706 ip_vs_fwd_tag(cp), cp->state, 707 cp->flags, refcount_read(&cp->refcnt), 708 refcount_read(&dest->refcnt)); 709 710 /* Update the connection counters */ 711 if (!(cp->flags & IP_VS_CONN_F_TEMPLATE)) { 712 /* It is a normal connection, so decrease the inactconns 713 or activeconns counter */ 714 if (cp->flags & IP_VS_CONN_F_INACTIVE) { 715 atomic_dec(&dest->inactconns); 716 } else { 717 atomic_dec(&dest->activeconns); 718 } 719 } else { 720 /* It is a persistent connection/template, so decrease 721 the persistent connection counter */ 722 atomic_dec(&dest->persistconns); 723 } 724 725 if (dest->l_threshold != 0) { 726 if (ip_vs_dest_totalconns(dest) < dest->l_threshold) 727 dest->flags &= ~IP_VS_DEST_F_OVERLOAD; 728 } else if (dest->u_threshold != 0) { 729 if (ip_vs_dest_totalconns(dest) * 4 < dest->u_threshold * 3) 730 dest->flags &= ~IP_VS_DEST_F_OVERLOAD; 731 } else { 732 if (dest->flags & IP_VS_DEST_F_OVERLOAD) 733 dest->flags &= ~IP_VS_DEST_F_OVERLOAD; 734 } 735 736 ip_vs_dest_put(dest); 737 } 738 739 static int expire_quiescent_template(struct netns_ipvs *ipvs, 740 struct ip_vs_dest *dest) 741 { 742 #ifdef CONFIG_SYSCTL 743 return ipvs->sysctl_expire_quiescent_template && 744 (atomic_read(&dest->weight) == 0); 745 #else 746 return 0; 747 #endif 748 } 749 750 /* 751 * Checking if the destination of a connection template is available. 752 * If available, return 1, otherwise invalidate this connection 753 * template and return 0. 754 */ 755 int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest) 756 { 757 struct ip_vs_dest *dest = ct->dest; 758 struct netns_ipvs *ipvs = ct->ipvs; 759 760 /* 761 * Checking the dest server status. 762 */ 763 if ((dest == NULL) || 764 !(dest->flags & IP_VS_DEST_F_AVAILABLE) || 765 expire_quiescent_template(ipvs, dest) || 766 (cdest && (dest != cdest))) { 767 IP_VS_DBG_BUF(9, "check_template: dest not available for " 768 "protocol %s s:%s:%d v:%s:%d " 769 "-> d:%s:%d\n", 770 ip_vs_proto_name(ct->protocol), 771 IP_VS_DBG_ADDR(ct->af, &ct->caddr), 772 ntohs(ct->cport), 773 IP_VS_DBG_ADDR(ct->af, &ct->vaddr), 774 ntohs(ct->vport), 775 IP_VS_DBG_ADDR(ct->daf, &ct->daddr), 776 ntohs(ct->dport)); 777 778 /* 779 * Invalidate the connection template 780 */ 781 if (ct->vport != htons(0xffff)) { 782 if (ip_vs_conn_unhash(ct)) { 783 ct->dport = htons(0xffff); 784 ct->vport = htons(0xffff); 785 ct->cport = 0; 786 ip_vs_conn_hash(ct); 787 } 788 } 789 790 /* 791 * Simply decrease the refcnt of the template, 792 * don't restart its timer. 793 */ 794 __ip_vs_conn_put(ct); 795 return 0; 796 } 797 return 1; 798 } 799 800 static void ip_vs_conn_rcu_free(struct rcu_head *head) 801 { 802 struct ip_vs_conn *cp = container_of(head, struct ip_vs_conn, 803 rcu_head); 804 805 ip_vs_pe_put(cp->pe); 806 kfree(cp->pe_data); 807 kmem_cache_free(ip_vs_conn_cachep, cp); 808 } 809 810 /* Try to delete connection while not holding reference */ 811 static void ip_vs_conn_del(struct ip_vs_conn *cp) 812 { 813 if (del_timer(&cp->timer)) { 814 /* Drop cp->control chain too */ 815 if (cp->control) 816 cp->timeout = 0; 817 ip_vs_conn_expire(&cp->timer); 818 } 819 } 820 821 /* Try to delete connection while holding reference */ 822 static void ip_vs_conn_del_put(struct ip_vs_conn *cp) 823 { 824 if (del_timer(&cp->timer)) { 825 /* Drop cp->control chain too */ 826 if (cp->control) 827 cp->timeout = 0; 828 __ip_vs_conn_put(cp); 829 ip_vs_conn_expire(&cp->timer); 830 } else { 831 __ip_vs_conn_put(cp); 832 } 833 } 834 835 static void ip_vs_conn_expire(struct timer_list *t) 836 { 837 struct ip_vs_conn *cp = from_timer(cp, t, timer); 838 struct netns_ipvs *ipvs = cp->ipvs; 839 840 /* 841 * do I control anybody? 842 */ 843 if (atomic_read(&cp->n_control)) 844 goto expire_later; 845 846 /* Unlink conn if not referenced anymore */ 847 if (likely(ip_vs_conn_unlink(cp))) { 848 struct ip_vs_conn *ct = cp->control; 849 850 /* delete the timer if it is activated by other users */ 851 del_timer(&cp->timer); 852 853 /* does anybody control me? */ 854 if (ct) { 855 bool has_ref = !cp->timeout && __ip_vs_conn_get(ct); 856 857 ip_vs_control_del(cp); 858 /* Drop CTL or non-assured TPL if not used anymore */ 859 if (has_ref && !atomic_read(&ct->n_control) && 860 (!(ct->flags & IP_VS_CONN_F_TEMPLATE) || 861 !(ct->state & IP_VS_CTPL_S_ASSURED))) { 862 IP_VS_DBG(4, "drop controlling connection\n"); 863 ip_vs_conn_del_put(ct); 864 } else if (has_ref) { 865 __ip_vs_conn_put(ct); 866 } 867 } 868 869 if ((cp->flags & IP_VS_CONN_F_NFCT) && 870 !(cp->flags & IP_VS_CONN_F_ONE_PACKET)) { 871 /* Do not access conntracks during subsys cleanup 872 * because nf_conntrack_find_get can not be used after 873 * conntrack cleanup for the net. 874 */ 875 smp_rmb(); 876 if (ipvs->enable) 877 ip_vs_conn_drop_conntrack(cp); 878 } 879 880 if (unlikely(cp->app != NULL)) 881 ip_vs_unbind_app(cp); 882 ip_vs_unbind_dest(cp); 883 if (cp->flags & IP_VS_CONN_F_NO_CPORT) 884 atomic_dec(&ip_vs_conn_no_cport_cnt); 885 if (cp->flags & IP_VS_CONN_F_ONE_PACKET) 886 ip_vs_conn_rcu_free(&cp->rcu_head); 887 else 888 call_rcu(&cp->rcu_head, ip_vs_conn_rcu_free); 889 atomic_dec(&ipvs->conn_count); 890 return; 891 } 892 893 expire_later: 894 IP_VS_DBG(7, "delayed: conn->refcnt=%d conn->n_control=%d\n", 895 refcount_read(&cp->refcnt), 896 atomic_read(&cp->n_control)); 897 898 refcount_inc(&cp->refcnt); 899 cp->timeout = 60*HZ; 900 901 if (ipvs->sync_state & IP_VS_STATE_MASTER) 902 ip_vs_sync_conn(ipvs, cp, sysctl_sync_threshold(ipvs)); 903 904 __ip_vs_conn_put_timer(cp); 905 } 906 907 /* Modify timer, so that it expires as soon as possible. 908 * Can be called without reference only if under RCU lock. 909 * We can have such chain of conns linked with ->control: DATA->CTL->TPL 910 * - DATA (eg. FTP) and TPL (persistence) can be present depending on setup 911 * - cp->timeout=0 indicates all conns from chain should be dropped but 912 * TPL is not dropped if in assured state 913 */ 914 void ip_vs_conn_expire_now(struct ip_vs_conn *cp) 915 { 916 /* Using mod_timer_pending will ensure the timer is not 917 * modified after the final del_timer in ip_vs_conn_expire. 918 */ 919 if (timer_pending(&cp->timer) && 920 time_after(cp->timer.expires, jiffies)) 921 mod_timer_pending(&cp->timer, jiffies); 922 } 923 924 925 /* 926 * Create a new connection entry and hash it into the ip_vs_conn_tab 927 */ 928 struct ip_vs_conn * 929 ip_vs_conn_new(const struct ip_vs_conn_param *p, int dest_af, 930 const union nf_inet_addr *daddr, __be16 dport, unsigned int flags, 931 struct ip_vs_dest *dest, __u32 fwmark) 932 { 933 struct ip_vs_conn *cp; 934 struct netns_ipvs *ipvs = p->ipvs; 935 struct ip_vs_proto_data *pd = ip_vs_proto_data_get(p->ipvs, 936 p->protocol); 937 938 cp = kmem_cache_alloc(ip_vs_conn_cachep, GFP_ATOMIC); 939 if (cp == NULL) { 940 IP_VS_ERR_RL("%s(): no memory\n", __func__); 941 return NULL; 942 } 943 944 INIT_HLIST_NODE(&cp->c_list); 945 timer_setup(&cp->timer, ip_vs_conn_expire, 0); 946 cp->ipvs = ipvs; 947 cp->af = p->af; 948 cp->daf = dest_af; 949 cp->protocol = p->protocol; 950 ip_vs_addr_set(p->af, &cp->caddr, p->caddr); 951 cp->cport = p->cport; 952 /* proto should only be IPPROTO_IP if p->vaddr is a fwmark */ 953 ip_vs_addr_set(p->protocol == IPPROTO_IP ? AF_UNSPEC : p->af, 954 &cp->vaddr, p->vaddr); 955 cp->vport = p->vport; 956 ip_vs_addr_set(cp->daf, &cp->daddr, daddr); 957 cp->dport = dport; 958 cp->flags = flags; 959 cp->fwmark = fwmark; 960 if (flags & IP_VS_CONN_F_TEMPLATE && p->pe) { 961 ip_vs_pe_get(p->pe); 962 cp->pe = p->pe; 963 cp->pe_data = p->pe_data; 964 cp->pe_data_len = p->pe_data_len; 965 } else { 966 cp->pe = NULL; 967 cp->pe_data = NULL; 968 cp->pe_data_len = 0; 969 } 970 spin_lock_init(&cp->lock); 971 972 /* 973 * Set the entry is referenced by the current thread before hashing 974 * it in the table, so that other thread run ip_vs_random_dropentry 975 * but cannot drop this entry. 976 */ 977 refcount_set(&cp->refcnt, 1); 978 979 cp->control = NULL; 980 atomic_set(&cp->n_control, 0); 981 atomic_set(&cp->in_pkts, 0); 982 983 cp->packet_xmit = NULL; 984 cp->app = NULL; 985 cp->app_data = NULL; 986 /* reset struct ip_vs_seq */ 987 cp->in_seq.delta = 0; 988 cp->out_seq.delta = 0; 989 990 atomic_inc(&ipvs->conn_count); 991 if (flags & IP_VS_CONN_F_NO_CPORT) 992 atomic_inc(&ip_vs_conn_no_cport_cnt); 993 994 /* Bind the connection with a destination server */ 995 cp->dest = NULL; 996 ip_vs_bind_dest(cp, dest); 997 998 /* Set its state and timeout */ 999 cp->state = 0; 1000 cp->old_state = 0; 1001 cp->timeout = 3*HZ; 1002 cp->sync_endtime = jiffies & ~3UL; 1003 1004 /* Bind its packet transmitter */ 1005 #ifdef CONFIG_IP_VS_IPV6 1006 if (p->af == AF_INET6) 1007 ip_vs_bind_xmit_v6(cp); 1008 else 1009 #endif 1010 ip_vs_bind_xmit(cp); 1011 1012 if (unlikely(pd && atomic_read(&pd->appcnt))) 1013 ip_vs_bind_app(cp, pd->pp); 1014 1015 /* 1016 * Allow conntrack to be preserved. By default, conntrack 1017 * is created and destroyed for every packet. 1018 * Sometimes keeping conntrack can be useful for 1019 * IP_VS_CONN_F_ONE_PACKET too. 1020 */ 1021 1022 if (ip_vs_conntrack_enabled(ipvs)) 1023 cp->flags |= IP_VS_CONN_F_NFCT; 1024 1025 /* Hash it in the ip_vs_conn_tab finally */ 1026 ip_vs_conn_hash(cp); 1027 1028 return cp; 1029 } 1030 1031 /* 1032 * /proc/net/ip_vs_conn entries 1033 */ 1034 #ifdef CONFIG_PROC_FS 1035 struct ip_vs_iter_state { 1036 struct seq_net_private p; 1037 struct hlist_head *l; 1038 }; 1039 1040 static void *ip_vs_conn_array(struct seq_file *seq, loff_t pos) 1041 { 1042 int idx; 1043 struct ip_vs_conn *cp; 1044 struct ip_vs_iter_state *iter = seq->private; 1045 1046 for (idx = 0; idx < ip_vs_conn_tab_size; idx++) { 1047 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[idx], c_list) { 1048 /* __ip_vs_conn_get() is not needed by 1049 * ip_vs_conn_seq_show and ip_vs_conn_sync_seq_show 1050 */ 1051 if (pos-- == 0) { 1052 iter->l = &ip_vs_conn_tab[idx]; 1053 return cp; 1054 } 1055 } 1056 cond_resched_rcu(); 1057 } 1058 1059 return NULL; 1060 } 1061 1062 static void *ip_vs_conn_seq_start(struct seq_file *seq, loff_t *pos) 1063 __acquires(RCU) 1064 { 1065 struct ip_vs_iter_state *iter = seq->private; 1066 1067 iter->l = NULL; 1068 rcu_read_lock(); 1069 return *pos ? ip_vs_conn_array(seq, *pos - 1) :SEQ_START_TOKEN; 1070 } 1071 1072 static void *ip_vs_conn_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1073 { 1074 struct ip_vs_conn *cp = v; 1075 struct ip_vs_iter_state *iter = seq->private; 1076 struct hlist_node *e; 1077 struct hlist_head *l = iter->l; 1078 int idx; 1079 1080 ++*pos; 1081 if (v == SEQ_START_TOKEN) 1082 return ip_vs_conn_array(seq, 0); 1083 1084 /* more on same hash chain? */ 1085 e = rcu_dereference(hlist_next_rcu(&cp->c_list)); 1086 if (e) 1087 return hlist_entry(e, struct ip_vs_conn, c_list); 1088 1089 idx = l - ip_vs_conn_tab; 1090 while (++idx < ip_vs_conn_tab_size) { 1091 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[idx], c_list) { 1092 iter->l = &ip_vs_conn_tab[idx]; 1093 return cp; 1094 } 1095 cond_resched_rcu(); 1096 } 1097 iter->l = NULL; 1098 return NULL; 1099 } 1100 1101 static void ip_vs_conn_seq_stop(struct seq_file *seq, void *v) 1102 __releases(RCU) 1103 { 1104 rcu_read_unlock(); 1105 } 1106 1107 static int ip_vs_conn_seq_show(struct seq_file *seq, void *v) 1108 { 1109 1110 if (v == SEQ_START_TOKEN) 1111 seq_puts(seq, 1112 "Pro FromIP FPrt ToIP TPrt DestIP DPrt State Expires PEName PEData\n"); 1113 else { 1114 const struct ip_vs_conn *cp = v; 1115 struct net *net = seq_file_net(seq); 1116 char pe_data[IP_VS_PENAME_MAXLEN + IP_VS_PEDATA_MAXLEN + 3]; 1117 size_t len = 0; 1118 char dbuf[IP_VS_ADDRSTRLEN]; 1119 1120 if (!net_eq(cp->ipvs->net, net)) 1121 return 0; 1122 if (cp->pe_data) { 1123 pe_data[0] = ' '; 1124 len = strlen(cp->pe->name); 1125 memcpy(pe_data + 1, cp->pe->name, len); 1126 pe_data[len + 1] = ' '; 1127 len += 2; 1128 len += cp->pe->show_pe_data(cp, pe_data + len); 1129 } 1130 pe_data[len] = '\0'; 1131 1132 #ifdef CONFIG_IP_VS_IPV6 1133 if (cp->daf == AF_INET6) 1134 snprintf(dbuf, sizeof(dbuf), "%pI6", &cp->daddr.in6); 1135 else 1136 #endif 1137 snprintf(dbuf, sizeof(dbuf), "%08X", 1138 ntohl(cp->daddr.ip)); 1139 1140 #ifdef CONFIG_IP_VS_IPV6 1141 if (cp->af == AF_INET6) 1142 seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X " 1143 "%s %04X %-11s %7u%s\n", 1144 ip_vs_proto_name(cp->protocol), 1145 &cp->caddr.in6, ntohs(cp->cport), 1146 &cp->vaddr.in6, ntohs(cp->vport), 1147 dbuf, ntohs(cp->dport), 1148 ip_vs_state_name(cp), 1149 jiffies_delta_to_msecs(cp->timer.expires - 1150 jiffies) / 1000, 1151 pe_data); 1152 else 1153 #endif 1154 seq_printf(seq, 1155 "%-3s %08X %04X %08X %04X" 1156 " %s %04X %-11s %7u%s\n", 1157 ip_vs_proto_name(cp->protocol), 1158 ntohl(cp->caddr.ip), ntohs(cp->cport), 1159 ntohl(cp->vaddr.ip), ntohs(cp->vport), 1160 dbuf, ntohs(cp->dport), 1161 ip_vs_state_name(cp), 1162 jiffies_delta_to_msecs(cp->timer.expires - 1163 jiffies) / 1000, 1164 pe_data); 1165 } 1166 return 0; 1167 } 1168 1169 static const struct seq_operations ip_vs_conn_seq_ops = { 1170 .start = ip_vs_conn_seq_start, 1171 .next = ip_vs_conn_seq_next, 1172 .stop = ip_vs_conn_seq_stop, 1173 .show = ip_vs_conn_seq_show, 1174 }; 1175 1176 static const char *ip_vs_origin_name(unsigned int flags) 1177 { 1178 if (flags & IP_VS_CONN_F_SYNC) 1179 return "SYNC"; 1180 else 1181 return "LOCAL"; 1182 } 1183 1184 static int ip_vs_conn_sync_seq_show(struct seq_file *seq, void *v) 1185 { 1186 char dbuf[IP_VS_ADDRSTRLEN]; 1187 1188 if (v == SEQ_START_TOKEN) 1189 seq_puts(seq, 1190 "Pro FromIP FPrt ToIP TPrt DestIP DPrt State Origin Expires\n"); 1191 else { 1192 const struct ip_vs_conn *cp = v; 1193 struct net *net = seq_file_net(seq); 1194 1195 if (!net_eq(cp->ipvs->net, net)) 1196 return 0; 1197 1198 #ifdef CONFIG_IP_VS_IPV6 1199 if (cp->daf == AF_INET6) 1200 snprintf(dbuf, sizeof(dbuf), "%pI6", &cp->daddr.in6); 1201 else 1202 #endif 1203 snprintf(dbuf, sizeof(dbuf), "%08X", 1204 ntohl(cp->daddr.ip)); 1205 1206 #ifdef CONFIG_IP_VS_IPV6 1207 if (cp->af == AF_INET6) 1208 seq_printf(seq, "%-3s %pI6 %04X %pI6 %04X " 1209 "%s %04X %-11s %-6s %7u\n", 1210 ip_vs_proto_name(cp->protocol), 1211 &cp->caddr.in6, ntohs(cp->cport), 1212 &cp->vaddr.in6, ntohs(cp->vport), 1213 dbuf, ntohs(cp->dport), 1214 ip_vs_state_name(cp), 1215 ip_vs_origin_name(cp->flags), 1216 jiffies_delta_to_msecs(cp->timer.expires - 1217 jiffies) / 1000); 1218 else 1219 #endif 1220 seq_printf(seq, 1221 "%-3s %08X %04X %08X %04X " 1222 "%s %04X %-11s %-6s %7u\n", 1223 ip_vs_proto_name(cp->protocol), 1224 ntohl(cp->caddr.ip), ntohs(cp->cport), 1225 ntohl(cp->vaddr.ip), ntohs(cp->vport), 1226 dbuf, ntohs(cp->dport), 1227 ip_vs_state_name(cp), 1228 ip_vs_origin_name(cp->flags), 1229 jiffies_delta_to_msecs(cp->timer.expires - 1230 jiffies) / 1000); 1231 } 1232 return 0; 1233 } 1234 1235 static const struct seq_operations ip_vs_conn_sync_seq_ops = { 1236 .start = ip_vs_conn_seq_start, 1237 .next = ip_vs_conn_seq_next, 1238 .stop = ip_vs_conn_seq_stop, 1239 .show = ip_vs_conn_sync_seq_show, 1240 }; 1241 #endif 1242 1243 1244 /* Randomly drop connection entries before running out of memory 1245 * Can be used for DATA and CTL conns. For TPL conns there are exceptions: 1246 * - traffic for services in OPS mode increases ct->in_pkts, so it is supported 1247 * - traffic for services not in OPS mode does not increase ct->in_pkts in 1248 * all cases, so it is not supported 1249 */ 1250 static inline int todrop_entry(struct ip_vs_conn *cp) 1251 { 1252 /* 1253 * The drop rate array needs tuning for real environments. 1254 * Called from timer bh only => no locking 1255 */ 1256 static const char todrop_rate[9] = {0, 1, 2, 3, 4, 5, 6, 7, 8}; 1257 static char todrop_counter[9] = {0}; 1258 int i; 1259 1260 /* if the conn entry hasn't lasted for 60 seconds, don't drop it. 1261 This will leave enough time for normal connection to get 1262 through. */ 1263 if (time_before(cp->timeout + jiffies, cp->timer.expires + 60*HZ)) 1264 return 0; 1265 1266 /* Don't drop the entry if its number of incoming packets is not 1267 located in [0, 8] */ 1268 i = atomic_read(&cp->in_pkts); 1269 if (i > 8 || i < 0) return 0; 1270 1271 if (!todrop_rate[i]) return 0; 1272 if (--todrop_counter[i] > 0) return 0; 1273 1274 todrop_counter[i] = todrop_rate[i]; 1275 return 1; 1276 } 1277 1278 static inline bool ip_vs_conn_ops_mode(struct ip_vs_conn *cp) 1279 { 1280 struct ip_vs_service *svc; 1281 1282 if (!cp->dest) 1283 return false; 1284 svc = rcu_dereference(cp->dest->svc); 1285 return svc && (svc->flags & IP_VS_SVC_F_ONEPACKET); 1286 } 1287 1288 /* Called from keventd and must protect itself from softirqs */ 1289 void ip_vs_random_dropentry(struct netns_ipvs *ipvs) 1290 { 1291 int idx; 1292 struct ip_vs_conn *cp; 1293 1294 rcu_read_lock(); 1295 /* 1296 * Randomly scan 1/32 of the whole table every second 1297 */ 1298 for (idx = 0; idx < (ip_vs_conn_tab_size>>5); idx++) { 1299 unsigned int hash = prandom_u32() & ip_vs_conn_tab_mask; 1300 1301 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[hash], c_list) { 1302 if (cp->ipvs != ipvs) 1303 continue; 1304 if (atomic_read(&cp->n_control)) 1305 continue; 1306 if (cp->flags & IP_VS_CONN_F_TEMPLATE) { 1307 /* connection template of OPS */ 1308 if (ip_vs_conn_ops_mode(cp)) 1309 goto try_drop; 1310 if (!(cp->state & IP_VS_CTPL_S_ASSURED)) 1311 goto drop; 1312 continue; 1313 } 1314 if (cp->protocol == IPPROTO_TCP) { 1315 switch(cp->state) { 1316 case IP_VS_TCP_S_SYN_RECV: 1317 case IP_VS_TCP_S_SYNACK: 1318 break; 1319 1320 case IP_VS_TCP_S_ESTABLISHED: 1321 if (todrop_entry(cp)) 1322 break; 1323 continue; 1324 1325 default: 1326 continue; 1327 } 1328 } else if (cp->protocol == IPPROTO_SCTP) { 1329 switch (cp->state) { 1330 case IP_VS_SCTP_S_INIT1: 1331 case IP_VS_SCTP_S_INIT: 1332 break; 1333 case IP_VS_SCTP_S_ESTABLISHED: 1334 if (todrop_entry(cp)) 1335 break; 1336 continue; 1337 default: 1338 continue; 1339 } 1340 } else { 1341 try_drop: 1342 if (!todrop_entry(cp)) 1343 continue; 1344 } 1345 1346 drop: 1347 IP_VS_DBG(4, "drop connection\n"); 1348 ip_vs_conn_del(cp); 1349 } 1350 cond_resched_rcu(); 1351 } 1352 rcu_read_unlock(); 1353 } 1354 1355 1356 /* 1357 * Flush all the connection entries in the ip_vs_conn_tab 1358 */ 1359 static void ip_vs_conn_flush(struct netns_ipvs *ipvs) 1360 { 1361 int idx; 1362 struct ip_vs_conn *cp, *cp_c; 1363 1364 flush_again: 1365 rcu_read_lock(); 1366 for (idx = 0; idx < ip_vs_conn_tab_size; idx++) { 1367 1368 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[idx], c_list) { 1369 if (cp->ipvs != ipvs) 1370 continue; 1371 if (atomic_read(&cp->n_control)) 1372 continue; 1373 cp_c = cp->control; 1374 IP_VS_DBG(4, "del connection\n"); 1375 ip_vs_conn_del(cp); 1376 if (cp_c && !atomic_read(&cp_c->n_control)) { 1377 IP_VS_DBG(4, "del controlling connection\n"); 1378 ip_vs_conn_del(cp_c); 1379 } 1380 } 1381 cond_resched_rcu(); 1382 } 1383 rcu_read_unlock(); 1384 1385 /* the counter may be not NULL, because maybe some conn entries 1386 are run by slow timer handler or unhashed but still referred */ 1387 if (atomic_read(&ipvs->conn_count) != 0) { 1388 schedule(); 1389 goto flush_again; 1390 } 1391 } 1392 1393 #ifdef CONFIG_SYSCTL 1394 void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs) 1395 { 1396 int idx; 1397 struct ip_vs_conn *cp, *cp_c; 1398 struct ip_vs_dest *dest; 1399 1400 rcu_read_lock(); 1401 for (idx = 0; idx < ip_vs_conn_tab_size; idx++) { 1402 hlist_for_each_entry_rcu(cp, &ip_vs_conn_tab[idx], c_list) { 1403 if (cp->ipvs != ipvs) 1404 continue; 1405 1406 dest = cp->dest; 1407 if (!dest || (dest->flags & IP_VS_DEST_F_AVAILABLE)) 1408 continue; 1409 1410 if (atomic_read(&cp->n_control)) 1411 continue; 1412 1413 cp_c = cp->control; 1414 IP_VS_DBG(4, "del connection\n"); 1415 ip_vs_conn_del(cp); 1416 if (cp_c && !atomic_read(&cp_c->n_control)) { 1417 IP_VS_DBG(4, "del controlling connection\n"); 1418 ip_vs_conn_del(cp_c); 1419 } 1420 } 1421 cond_resched_rcu(); 1422 1423 /* netns clean up started, abort delayed work */ 1424 if (!ipvs->enable) 1425 break; 1426 } 1427 rcu_read_unlock(); 1428 } 1429 #endif 1430 1431 /* 1432 * per netns init and exit 1433 */ 1434 int __net_init ip_vs_conn_net_init(struct netns_ipvs *ipvs) 1435 { 1436 atomic_set(&ipvs->conn_count, 0); 1437 1438 proc_create_net("ip_vs_conn", 0, ipvs->net->proc_net, 1439 &ip_vs_conn_seq_ops, sizeof(struct ip_vs_iter_state)); 1440 proc_create_net("ip_vs_conn_sync", 0, ipvs->net->proc_net, 1441 &ip_vs_conn_sync_seq_ops, 1442 sizeof(struct ip_vs_iter_state)); 1443 return 0; 1444 } 1445 1446 void __net_exit ip_vs_conn_net_cleanup(struct netns_ipvs *ipvs) 1447 { 1448 /* flush all the connection entries first */ 1449 ip_vs_conn_flush(ipvs); 1450 remove_proc_entry("ip_vs_conn", ipvs->net->proc_net); 1451 remove_proc_entry("ip_vs_conn_sync", ipvs->net->proc_net); 1452 } 1453 1454 int __init ip_vs_conn_init(void) 1455 { 1456 int idx; 1457 1458 /* Compute size and mask */ 1459 ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits; 1460 ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1; 1461 1462 /* 1463 * Allocate the connection hash table and initialize its list heads 1464 */ 1465 ip_vs_conn_tab = vmalloc(array_size(ip_vs_conn_tab_size, 1466 sizeof(*ip_vs_conn_tab))); 1467 if (!ip_vs_conn_tab) 1468 return -ENOMEM; 1469 1470 /* Allocate ip_vs_conn slab cache */ 1471 ip_vs_conn_cachep = kmem_cache_create("ip_vs_conn", 1472 sizeof(struct ip_vs_conn), 0, 1473 SLAB_HWCACHE_ALIGN, NULL); 1474 if (!ip_vs_conn_cachep) { 1475 vfree(ip_vs_conn_tab); 1476 return -ENOMEM; 1477 } 1478 1479 pr_info("Connection hash table configured " 1480 "(size=%d, memory=%ldKbytes)\n", 1481 ip_vs_conn_tab_size, 1482 (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024); 1483 IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n", 1484 sizeof(struct ip_vs_conn)); 1485 1486 for (idx = 0; idx < ip_vs_conn_tab_size; idx++) 1487 INIT_HLIST_HEAD(&ip_vs_conn_tab[idx]); 1488 1489 for (idx = 0; idx < CT_LOCKARRAY_SIZE; idx++) { 1490 spin_lock_init(&__ip_vs_conntbl_lock_array[idx].l); 1491 } 1492 1493 /* calculate the random value for connection hash */ 1494 get_random_bytes(&ip_vs_conn_rnd, sizeof(ip_vs_conn_rnd)); 1495 1496 return 0; 1497 } 1498 1499 void ip_vs_conn_cleanup(void) 1500 { 1501 /* Wait all ip_vs_conn_rcu_free() callbacks to complete */ 1502 rcu_barrier(); 1503 /* Release the empty cache */ 1504 kmem_cache_destroy(ip_vs_conn_cachep); 1505 vfree(ip_vs_conn_tab); 1506 } 1507