History

Merge branch 'pablo/nf-2.6-updates' of git://1984.lsi.us.es/net-2.6

David S. Miller committed 15 years ago

Commit 9bbc0522 parents 0d4420a 93bbce114 files · +279 −161Browse files

Unified · Split

14 files
  1. include/net/ip_vs.h +17 −0
  2. net/bridge/netfilter/ebtables.c +11 −53
  3. net/ipv6/netfilter/ip6t_REJECT.c +3 −1
  4. net/netfilter/ipvs/ip_vs_app.c +3 −12
  5. net/netfilter/ipvs/ip_vs_conn.c +2 −10
  6. net/netfilter/ipvs/ip_vs_core.c +93 −10
  7. net/netfilter/ipvs/ip_vs_ctl.c +101 −19
  8. net/netfilter/ipvs/ip_vs_est.c +3 −11
  9. net/netfilter/ipvs/ip_vs_proto.c +2 −9
  10. net/netfilter/ipvs/ip_vs_sync.c +37 −28
  11. net/netfilter/nf_conntrack_netlink.c +4 −0
  12. net/netfilter/x_tables.c +2 −2
  13. net/netfilter/xt_DSCP.c +1 −1
  14. net/netfilter/xt_conntrack.c +0 −5
include/net/ip_vs.h+17−0
@@ -791,6 +791,7 @@ struct ip_vs_app { · 790 unmodified lines
791791 /* IPVS in network namespace */
792792 struct netns_ipvs {
793793 int gen; /* Generation */
794+ int enable; /* enable like nf_hooks do */
794795 /*
795796 * Hash table: for real service lookups
796797 */
@@ -1089,6 +1090,22 @@ ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp) · 292 unmodified lines
10891090 atomic_inc(&ctl_cp->n_control);
10901091 }
10911092
1093+/*
1094+ * IPVS netns init & cleanup functions
1095+ */
1096+extern int __ip_vs_estimator_init(struct net *net);
1097+extern int __ip_vs_control_init(struct net *net);
1098+extern int __ip_vs_protocol_init(struct net *net);
1099+extern int __ip_vs_app_init(struct net *net);
1100+extern int __ip_vs_conn_init(struct net *net);
1101+extern int __ip_vs_sync_init(struct net *net);
1102+extern void __ip_vs_conn_cleanup(struct net *net);
1103+extern void __ip_vs_app_cleanup(struct net *net);
1104+extern void __ip_vs_protocol_cleanup(struct net *net);
1105+extern void __ip_vs_control_cleanup(struct net *net);
1106+extern void __ip_vs_estimator_cleanup(struct net *net);
1107+extern void __ip_vs_sync_cleanup(struct net *net);
1108+extern void __ip_vs_service_cleanup(struct net *net);
10921109
10931110 /*
10941111 * IPVS application functions
net/bridge/netfilter/ebtables.c+11−53
@@ -1766,7 +1766,7 @@ static int compat_table_info(const struct ebt_table_info *info, · 1765 unmodified lines
17661766
17671767 newinfo->entries_size = size;
17681768
1769− xt_compat_init_offsets(AF_INET, info->nentries);
1769+ xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
17701770 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
17711771 entries, newinfo);
17721772 }
@@ -1882,7 +1882,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, · 109 unmodified lines
18821882 struct xt_match *match;
18831883 struct xt_target *wt;
18841884 void *dst = NULL;
1885− int off, pad = 0, ret = 0;
1885+ int off, pad = 0;
18861886 unsigned int size_kern, entry_offset, match_size = mwt->match_size;
18871887
18881888 strlcpy(name, mwt->u.name, sizeof(name));
@@ -1935,13 +1935,6 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, · 46 unmodified lines
19351935 break;
19361936 }
19371937
1938− if (!dst) {
1939− ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1940− off + ebt_compat_entry_padsize());
1941− if (ret < 0)
1942− return ret;
1943− }
1944−
19451938 state->buf_kern_offset += match_size + off;
19461939 state->buf_user_offset += match_size;
19471940 pad = XT_ALIGN(size_kern) - size_kern;
@@ -2016,50 +2009,6 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, · 68 unmodified lines
20162009 return growth;
20172010 }
20182011
2019−#define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...) \
2020−({ \
2021− unsigned int __i; \
2022− int __ret = 0; \
2023− struct compat_ebt_entry_mwt *__watcher; \
2024− \
2025− for (__i = e->watchers_offset; \
2026− __i < (e)->target_offset; \
2027− __i += __watcher->watcher_size + \
2028− sizeof(struct compat_ebt_entry_mwt)) { \
2029− __watcher = (void *)(e) + __i; \
2030− __ret = fn(__watcher , ## args); \
2031− if (__ret != 0) \
2032− break; \
2033− } \
2034− if (__ret == 0) { \
2035− if (__i != (e)->target_offset) \
2036− __ret = -EINVAL; \
2037− } \
2038− __ret; \
2039−})
2040−
2041−#define EBT_COMPAT_MATCH_ITERATE(e, fn, args...) \
2042−({ \
2043− unsigned int __i; \
2044− int __ret = 0; \
2045− struct compat_ebt_entry_mwt *__match; \
2046− \
2047− for (__i = sizeof(struct ebt_entry); \
2048− __i < (e)->watchers_offset; \
2049− __i += __match->match_size + \
2050− sizeof(struct compat_ebt_entry_mwt)) { \
2051− __match = (void *)(e) + __i; \
2052− __ret = fn(__match , ## args); \
2053− if (__ret != 0) \
2054− break; \
2055− } \
2056− if (__ret == 0) { \
2057− if (__i != (e)->watchers_offset) \
2058− __ret = -EINVAL; \
2059− } \
2060− __ret; \
2061−})
2062−
20632012 /* called for all ebt_entry structures. */
20642013 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
20652014 unsigned int *total,
@@ -2132,6 +2081,14 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, · 66 unmodified lines
21322081 }
21332082 }
21342083
2084+ if (state->buf_kern_start == NULL) {
2085+ unsigned int offset = buf_start - (char *) base;
2086+
2087+ ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
2088+ if (ret < 0)
2089+ return ret;
2090+ }
2091+
21352092 startoff = state->buf_user_offset - startoff;
21362093
21372094 BUG_ON(*total < startoff);
@@ -2240,6 +2197,7 @@ static int compat_do_replace(struct net *net, void __user *user, · 102 unmodified lines
22402197
22412198 xt_compat_lock(NFPROTO_BRIDGE);
22422199
2200+ xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
22432201 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
22442202 if (ret < 0)
22452203 goto out_unlock;
net/ipv6/netfilter/ip6t_REJECT.c+3−1
@@ -45,6 +45,8 @@ static void send_reset(struct net *net, struct sk_buff *oldskb) · 44 unmodified lines
4545 int tcphoff, needs_ack;
4646 const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
4747 struct ipv6hdr *ip6h;
48+#define DEFAULT_TOS_VALUE 0x0U
49+ const __u8 tclass = DEFAULT_TOS_VALUE;
4850 struct dst_entry *dst = NULL;
4951 u8 proto;
5052 struct flowi6 fl6;
@@ -124,7 +126,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb) · 73 unmodified lines
124126 skb_put(nskb, sizeof(struct ipv6hdr));
125127 skb_reset_network_header(nskb);
126128 ip6h = ipv6_hdr(nskb);
127− ip6h->version = 6;
129+ *(__be32 *)ip6h = htonl(0x60000000 | (tclass << 20));
128130 ip6h->hop_limit = ip6_dst_hoplimit(dst);
129131 ip6h->nexthdr = IPPROTO_TCP;
130132 ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
net/netfilter/ipvs/ip_vs_app.c+3−12
@@ -576,7 +576,7 @@ static const struct file_operations ip_vs_app_fops = { · 575 unmodified lines
576576 };
577577 #endif
578578
579−static int __net_init __ip_vs_app_init(struct net *net)
579+int __net_init __ip_vs_app_init(struct net *net)
580580 {
581581 struct netns_ipvs *ipvs = net_ipvs(net);
582582
@@ -585,26 +585,17 @@ static int __net_init __ip_vs_app_init(struct net *net) · 2 unmodified lines
585585 return 0;
586586 }
587587
588−static void __net_exit __ip_vs_app_cleanup(struct net *net)
588+void __net_exit __ip_vs_app_cleanup(struct net *net)
589589 {
590590 proc_net_remove(net, "ip_vs_app");
591591 }
592592
593−static struct pernet_operations ip_vs_app_ops = {
594− .init = __ip_vs_app_init,
595− .exit = __ip_vs_app_cleanup,
596−};
597−
598593 int __init ip_vs_app_init(void)
599594 {
600− int rv;
601−
602− rv = register_pernet_subsys(&ip_vs_app_ops);
603− return rv;
595+ return 0;
604596 }
605597
606598
607599 void ip_vs_app_cleanup(void)
608600 {
609− unregister_pernet_subsys(&ip_vs_app_ops);
610601 }
net/netfilter/ipvs/ip_vs_conn.c+2−10
@@ -1258,22 +1258,17 @@ int __net_init __ip_vs_conn_init(struct net *net) · 1257 unmodified lines
12581258 return 0;
12591259 }
12601260
1261−static void __net_exit __ip_vs_conn_cleanup(struct net *net)
1261+void __net_exit __ip_vs_conn_cleanup(struct net *net)
12621262 {
12631263 /* flush all the connection entries first */
12641264 ip_vs_conn_flush(net);
12651265 proc_net_remove(net, "ip_vs_conn");
12661266 proc_net_remove(net, "ip_vs_conn_sync");
12671267 }
1268−static struct pernet_operations ipvs_conn_ops = {
1269− .init = __ip_vs_conn_init,
1270− .exit = __ip_vs_conn_cleanup,
1271−};
12721268
12731269 int __init ip_vs_conn_init(void)
12741270 {
12751271 int idx;
1276− int retc;
12771272
12781273 /* Compute size and mask */
12791274 ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
@@ -1309,17 +1304,14 @@ int __init ip_vs_conn_init(void) · 29 unmodified lines
13091304 rwlock_init(&__ip_vs_conntbl_lock_array[idx].l);
13101305 }
13111306
1312− retc = register_pernet_subsys(&ipvs_conn_ops);
1313−
13141307 /* calculate the random value for connection hash */
13151308 get_random_bytes(&ip_vs_conn_rnd, sizeof(ip_vs_conn_rnd));
13161309
1317− return retc;
1310+ return 0;
13181311 }
13191312
13201313 void ip_vs_conn_cleanup(void)
13211314 {
1322− unregister_pernet_subsys(&ipvs_conn_ops);
13231315 /* Release the empty cache */
13241316 kmem_cache_destroy(ip_vs_conn_cachep);
13251317 vfree(ip_vs_conn_tab);
net/netfilter/ipvs/ip_vs_core.c+93−10
@@ -1113,6 +1113,9 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af) · 1112 unmodified lines
11131113 return NF_ACCEPT;
11141114
11151115 net = skb_net(skb);
1116+ if (!net_ipvs(net)->enable)
1117+ return NF_ACCEPT;
1118+
11161119 ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
11171120 #ifdef CONFIG_IP_VS_IPV6
11181121 if (af == AF_INET6) {
@@ -1343,6 +1346,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) · 224 unmodified lines
13431346 return NF_ACCEPT; /* The packet looks wrong, ignore */
13441347
13451348 net = skb_net(skb);
1349+
13461350 pd = ip_vs_proto_data_get(net, cih->protocol);
13471351 if (!pd)
13481352 return NF_ACCEPT;
@@ -1529,6 +1533,11 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) · 180 unmodified lines
15291533 IP_VS_DBG_ADDR(af, &iph.daddr), hooknum);
15301534 return NF_ACCEPT;
15311535 }
1536+ /* ipvs enabled in this netns ? */
1537+ net = skb_net(skb);
1538+ if (!net_ipvs(net)->enable)
1539+ return NF_ACCEPT;
1540+
15321541 ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
15331542
15341543 /* Bad... Do not break raw sockets */
@@ -1562,7 +1571,6 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) · 27 unmodified lines
15621571 ip_vs_fill_iphdr(af, skb_network_header(skb), &iph);
15631572 }
15641573
1565− net = skb_net(skb);
15661574 /* Protocol supported? */
15671575 pd = ip_vs_proto_data_get(net, iph.protocol);
15681576 if (unlikely(!pd))
@@ -1588,7 +1596,6 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af) · 19 unmodified lines
15881596 }
15891597
15901598 IP_VS_DBG_PKT(11, af, pp, skb, 0, "Incoming packet");
1591− net = skb_net(skb);
15921599 ipvs = net_ipvs(net);
15931600 /* Check the server status */
15941601 if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
@@ -1743,10 +1750,16 @@ ip_vs_forward_icmp(unsigned int hooknum, struct sk_buff *skb, · 148 unmodified lines
17431750 int (*okfn)(struct sk_buff *))
17441751 {
17451752 int r;
1753+ struct net *net;
17461754
17471755 if (ip_hdr(skb)->protocol != IPPROTO_ICMP)
17481756 return NF_ACCEPT;
17491757
1758+ /* ipvs enabled in this netns ? */
1759+ net = skb_net(skb);
1760+ if (!net_ipvs(net)->enable)
1761+ return NF_ACCEPT;
1762+
17501763 return ip_vs_in_icmp(skb, &r, hooknum);
17511764 }
17521765
@@ -1757,10 +1770,16 @@ ip_vs_forward_icmp_v6(unsigned int hooknum, struct sk_buff *skb, · 4 unmodified lines
17571770 int (*okfn)(struct sk_buff *))
17581771 {
17591772 int r;
1773+ struct net *net;
17601774
17611775 if (ipv6_hdr(skb)->nexthdr != IPPROTO_ICMPV6)
17621776 return NF_ACCEPT;
17631777
1778+ /* ipvs enabled in this netns ? */
1779+ net = skb_net(skb);
1780+ if (!net_ipvs(net)->enable)
1781+ return NF_ACCEPT;
1782+
17641783 return ip_vs_in_icmp_v6(skb, &r, hooknum);
17651784 }
17661785 #endif
@@ -1884,19 +1903,70 @@ static int __net_init __ip_vs_init(struct net *net) · 117 unmodified lines
18841903 pr_err("%s(): no memory.\n", __func__);
18851904 return -ENOMEM;
18861905 }
1906+ /* Hold the beast until a service is registerd */
1907+ ipvs->enable = 0;
18871908 ipvs->net = net;
18881909 /* Counters used for creating unique names */
18891910 ipvs->gen = atomic_read(&ipvs_netns_cnt);
18901911 atomic_inc(&ipvs_netns_cnt);
18911912 net->ipvs = ipvs;
1913+
1914+ if (__ip_vs_estimator_init(net) < 0)
1915+ goto estimator_fail;
1916+
1917+ if (__ip_vs_control_init(net) < 0)
1918+ goto control_fail;
1919+
1920+ if (__ip_vs_protocol_init(net) < 0)
1921+ goto protocol_fail;
1922+
1923+ if (__ip_vs_app_init(net) < 0)
1924+ goto app_fail;
1925+
1926+ if (__ip_vs_conn_init(net) < 0)
1927+ goto conn_fail;
1928+
1929+ if (__ip_vs_sync_init(net) < 0)
1930+ goto sync_fail;
1931+
18921932 printk(KERN_INFO "IPVS: Creating netns size=%zu id=%d\n",
18931933 sizeof(struct netns_ipvs), ipvs->gen);
18941934 return 0;
1935+/*
1936+ * Error handling
1937+ */
1938+
1939+sync_fail:
1940+ __ip_vs_conn_cleanup(net);
1941+conn_fail:
1942+ __ip_vs_app_cleanup(net);
1943+app_fail:
1944+ __ip_vs_protocol_cleanup(net);
1945+protocol_fail:
1946+ __ip_vs_control_cleanup(net);
1947+control_fail:
1948+ __ip_vs_estimator_cleanup(net);
1949+estimator_fail:
1950+ return -ENOMEM;
18951951 }
18961952
18971953 static void __net_exit __ip_vs_cleanup(struct net *net)
18981954 {
1899− IP_VS_DBG(10, "ipvs netns %d released\n", net_ipvs(net)->gen);
1955+ __ip_vs_service_cleanup(net); /* ip_vs_flush() with locks */
1956+ __ip_vs_conn_cleanup(net);
1957+ __ip_vs_app_cleanup(net);
1958+ __ip_vs_protocol_cleanup(net);
1959+ __ip_vs_control_cleanup(net);
1960+ __ip_vs_estimator_cleanup(net);
1961+ IP_VS_DBG(2, "ipvs netns %d released\n", net_ipvs(net)->gen);
1962+}
1963+
1964+static void __net_exit __ip_vs_dev_cleanup(struct net *net)
1965+{
1966+ EnterFunction(2);
1967+ net_ipvs(net)->enable = 0; /* Disable packet reception */
1968+ __ip_vs_sync_cleanup(net);
1969+ LeaveFunction(2);
19001970 }
19011971
19021972 static struct pernet_operations ipvs_core_ops = {
@@ -1906,6 +1976,10 @@ static struct pernet_operations ipvs_core_ops = { · 3 unmodified lines
19061976 .size = sizeof(struct netns_ipvs),
19071977 };
19081978
1979+static struct pernet_operations ipvs_core_dev_ops = {
1980+ .exit = __ip_vs_dev_cleanup,
1981+};
1982+
19091983 /*
19101984 * Initialize IP Virtual Server
19111985 */
@@ -1913,10 +1987,6 @@ static int __init ip_vs_init(void) · 1 unmodified line
19131987 {
19141988 int ret;
19151989
1916− ret = register_pernet_subsys(&ipvs_core_ops); /* Alloc ip_vs struct */
1917− if (ret < 0)
1918− return ret;
1919−
19201990 ip_vs_estimator_init();
19211991 ret = ip_vs_control_init();
19221992 if (ret < 0) {
@@ -1944,15 +2014,28 @@ static int __init ip_vs_init(void) · 21 unmodified lines
19442014 goto cleanup_conn;
19452015 }
19462016
2017+ ret = register_pernet_subsys(&ipvs_core_ops); /* Alloc ip_vs struct */
2018+ if (ret < 0)
2019+ goto cleanup_sync;
2020+
2021+ ret = register_pernet_device(&ipvs_core_dev_ops);
2022+ if (ret < 0)
2023+ goto cleanup_sub;
2024+
19472025 ret = nf_register_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
19482026 if (ret < 0) {
19492027 pr_err("can't register hooks.\n");
1950− goto cleanup_sync;
2028+ goto cleanup_dev;
19512029 }
19522030
19532031 pr_info("ipvs loaded.\n");
2032+
19542033 return ret;
19552034
2035+cleanup_dev:
2036+ unregister_pernet_device(&ipvs_core_dev_ops);
2037+cleanup_sub:
2038+ unregister_pernet_subsys(&ipvs_core_ops);
19562039 cleanup_sync:
19572040 ip_vs_sync_cleanup();
19582041 cleanup_conn:
@@ -1964,20 +2047,20 @@ cleanup_sync: · 5 unmodified lines
19642047 ip_vs_control_cleanup();
19652048 cleanup_estimator:
19662049 ip_vs_estimator_cleanup();
1967− unregister_pernet_subsys(&ipvs_core_ops); /* free ip_vs struct */
19682050 return ret;
19692051 }
19702052
19712053 static void __exit ip_vs_cleanup(void)
19722054 {
19732055 nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
2056+ unregister_pernet_device(&ipvs_core_dev_ops);
2057+ unregister_pernet_subsys(&ipvs_core_ops); /* free ip_vs struct */
19742058 ip_vs_sync_cleanup();
19752059 ip_vs_conn_cleanup();
19762060 ip_vs_app_cleanup();
19772061 ip_vs_protocol_cleanup();
19782062 ip_vs_control_cleanup();
19792063 ip_vs_estimator_cleanup();
1980− unregister_pernet_subsys(&ipvs_core_ops); /* free ip_vs struct */
19812064 pr_info("ipvs unloaded.\n");
19822065 }
19832066
net/netfilter/ipvs/ip_vs_ctl.c+101−19
@@ -69,6 +69,11 @@ int ip_vs_get_debug_level(void) · 68 unmodified lines
6969 }
7070 #endif
7171
72+
73+/* Protos */
74+static void __ip_vs_del_service(struct ip_vs_service *svc);
75+
76+
7277 #ifdef CONFIG_IP_VS_IPV6
7378 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
7479 static int __ip_vs_addr_is_local_v6(struct net *net,
@@ -1214,6 +1219,8 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u, · 1139 unmodified lines
12141219 write_unlock_bh(&__ip_vs_svc_lock);
12151220
12161221 *svc_p = svc;
1222+ /* Now there is a service - full throttle */
1223+ ipvs->enable = 1;
12171224 return 0;
12181225
12191226
@@ -1472,6 +1479,84 @@ static int ip_vs_flush(struct net *net) · 252 unmodified lines
14721479 return 0;
14731480 }
14741481
1482+/*
1483+ * Delete service by {netns} in the service table.
1484+ * Called by __ip_vs_cleanup()
1485+ */
1486+void __ip_vs_service_cleanup(struct net *net)
1487+{
1488+ EnterFunction(2);
1489+ /* Check for "full" addressed entries */
1490+ mutex_lock(&__ip_vs_mutex);
1491+ ip_vs_flush(net);
1492+ mutex_unlock(&__ip_vs_mutex);
1493+ LeaveFunction(2);
1494+}
1495+/*
1496+ * Release dst hold by dst_cache
1497+ */
1498+static inline void
1499+__ip_vs_dev_reset(struct ip_vs_dest *dest, struct net_device *dev)
1500+{
1501+ spin_lock_bh(&dest->dst_lock);
1502+ if (dest->dst_cache && dest->dst_cache->dev == dev) {
1503+ IP_VS_DBG_BUF(3, "Reset dev:%s dest %s:%u ,dest->refcnt=%d\n",
1504+ dev->name,
1505+ IP_VS_DBG_ADDR(dest->af, &dest->addr),
1506+ ntohs(dest->port),
1507+ atomic_read(&dest->refcnt));
1508+ ip_vs_dst_reset(dest);
1509+ }
1510+ spin_unlock_bh(&dest->dst_lock);
1511+
1512+}
1513+/*
1514+ * Netdev event receiver
1515+ * Currently only NETDEV_UNREGISTER is handled, i.e. if we hold a reference to
1516+ * a device that is "unregister" it must be released.
1517+ */
1518+static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
1519+ void *ptr)
1520+{
1521+ struct net_device *dev = ptr;
1522+ struct net *net = dev_net(dev);
1523+ struct ip_vs_service *svc;
1524+ struct ip_vs_dest *dest;
1525+ unsigned int idx;
1526+
1527+ if (event != NETDEV_UNREGISTER)
1528+ return NOTIFY_DONE;
1529+ IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
1530+ EnterFunction(2);
1531+ mutex_lock(&__ip_vs_mutex);
1532+ for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
1533+ list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
1534+ if (net_eq(svc->net, net)) {
1535+ list_for_each_entry(dest, &svc->destinations,
1536+ n_list) {
1537+ __ip_vs_dev_reset(dest, dev);
1538+ }
1539+ }
1540+ }
1541+
1542+ list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
1543+ if (net_eq(svc->net, net)) {
1544+ list_for_each_entry(dest, &svc->destinations,
1545+ n_list) {
1546+ __ip_vs_dev_reset(dest, dev);
1547+ }
1548+ }
1549+
1550+ }
1551+ }
1552+
1553+ list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
1554+ __ip_vs_dev_reset(dest, dev);
1555+ }
1556+ mutex_unlock(&__ip_vs_mutex);
1557+ LeaveFunction(2);
1558+ return NOTIFY_DONE;
1559+}
14751560
14761561 /*
14771562 * Zero counters in a service or all services
@@ -3588,6 +3673,10 @@ void __net_init __ip_vs_control_cleanup_sysctl(struct net *net) { } · 2110 unmodified lines
35883673
35893674 #endif
35903675
3676+static struct notifier_block ip_vs_dst_notifier = {
3677+ .notifier_call = ip_vs_dst_event,
3678+};
3679+
35913680 int __net_init __ip_vs_control_init(struct net *net)
35923681 {
35933682 int idx;
@@ -3626,7 +3715,7 @@ err: · 32 unmodified lines
36263715 return -ENOMEM;
36273716 }
36283717
3629−static void __net_exit __ip_vs_control_cleanup(struct net *net)
3718+void __net_exit __ip_vs_control_cleanup(struct net *net)
36303719 {
36313720 struct netns_ipvs *ipvs = net_ipvs(net);
36323721
@@ -3639,11 +3728,6 @@ static void __net_exit __ip_vs_control_cleanup(struct net *net) · 6 unmodified lines
36393728 free_percpu(ipvs->tot_stats.cpustats);
36403729 }
36413730
3642−static struct pernet_operations ipvs_control_ops = {
3643− .init = __ip_vs_control_init,
3644− .exit = __ip_vs_control_cleanup,
3645−};
3646−
36473731 int __init ip_vs_control_init(void)
36483732 {
36493733 int idx;
@@ -3657,33 +3741,32 @@ int __init ip_vs_control_init(void) · 7 unmodified lines
36573741 INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
36583742 }
36593743
3660− ret = register_pernet_subsys(&ipvs_control_ops);
3661− if (ret) {
3662− pr_err("cannot register namespace.\n");
3663− goto err;
3664− }
3665−
36663744 smp_wmb(); /* Do we really need it now ? */
36673745
36683746 ret = nf_register_sockopt(&ip_vs_sockopts);
36693747 if (ret) {
36703748 pr_err("cannot register sockopt.\n");
3671− goto err_net;
3749+ goto err_sock;
36723750 }
36733751
36743752 ret = ip_vs_genl_register();
36753753 if (ret) {
36763754 pr_err("cannot register Generic Netlink interface.\n");
3677− nf_unregister_sockopt(&ip_vs_sockopts);
3678− goto err_net;
3755+ goto err_genl;
36793756 }
36803757
3758+ ret = register_netdevice_notifier(&ip_vs_dst_notifier);
3759+ if (ret < 0)
3760+ goto err_notf;
3761+
36813762 LeaveFunction(2);
36823763 return 0;
36833764
3684−err_net:
3685− unregister_pernet_subsys(&ipvs_control_ops);
3686−err:
3765+err_notf:
3766+ ip_vs_genl_unregister();
3767+err_genl:
3768+ nf_unregister_sockopt(&ip_vs_sockopts);
3769+err_sock:
36873770 return ret;
36883771 }
36893772
@@ -3691,7 +3774,6 @@ err: · 1 unmodified line
36913774 void ip_vs_control_cleanup(void)
36923775 {
36933776 EnterFunction(2);
3694− unregister_pernet_subsys(&ipvs_control_ops);
36953777 ip_vs_genl_unregister();
36963778 nf_unregister_sockopt(&ip_vs_sockopts);
36973779 LeaveFunction(2);
net/netfilter/ipvs/ip_vs_est.c+3−11
@@ -192,7 +192,7 @@ void ip_vs_read_estimator(struct ip_vs_stats_user *dst, · 191 unmodified lines
192192 dst->outbps = (e->outbps + 0xF) >> 5;
193193 }
194194
195−static int __net_init __ip_vs_estimator_init(struct net *net)
195+int __net_init __ip_vs_estimator_init(struct net *net)
196196 {
197197 struct netns_ipvs *ipvs = net_ipvs(net);
198198
@@ -203,24 +203,16 @@ static int __net_init __ip_vs_estimator_init(struct net *net) · 4 unmodified lines
203203 return 0;
204204 }
205205
206−static void __net_exit __ip_vs_estimator_exit(struct net *net)
206+void __net_exit __ip_vs_estimator_cleanup(struct net *net)
207207 {
208208 del_timer_sync(&net_ipvs(net)->est_timer);
209209 }
210−static struct pernet_operations ip_vs_app_ops = {
211− .init = __ip_vs_estimator_init,
212− .exit = __ip_vs_estimator_exit,
213−};
214210
215211 int __init ip_vs_estimator_init(void)
216212 {
217− int rv;
218−
219− rv = register_pernet_subsys(&ip_vs_app_ops);
220− return rv;
213+ return 0;
221214 }
222215
223216 void ip_vs_estimator_cleanup(void)
224217 {
225− unregister_pernet_subsys(&ip_vs_app_ops);
226218 }
net/netfilter/ipvs/ip_vs_proto.c+2−9
@@ -316,7 +316,7 @@ ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp, · 315 unmodified lines
316316 /*
317317 * per network name-space init
318318 */
319−static int __net_init __ip_vs_protocol_init(struct net *net)
319+int __net_init __ip_vs_protocol_init(struct net *net)
320320 {
321321 #ifdef CONFIG_IP_VS_PROTO_TCP
322322 register_ip_vs_proto_netns(net, &ip_vs_protocol_tcp);
@@ -336,7 +336,7 @@ static int __net_init __ip_vs_protocol_init(struct net *net) · 13 unmodified lines
336336 return 0;
337337 }
338338
339−static void __net_exit __ip_vs_protocol_cleanup(struct net *net)
339+void __net_exit __ip_vs_protocol_cleanup(struct net *net)
340340 {
341341 struct netns_ipvs *ipvs = net_ipvs(net);
342342 struct ip_vs_proto_data *pd;
@@ -349,11 +349,6 @@ static void __net_exit __ip_vs_protocol_cleanup(struct net *net) · 6 unmodified lines
349349 }
350350 }
351351
352−static struct pernet_operations ipvs_proto_ops = {
353− .init = __ip_vs_protocol_init,
354− .exit = __ip_vs_protocol_cleanup,
355−};
356−
357352 int __init ip_vs_protocol_init(void)
358353 {
359354 char protocols[64];
@@ -382,7 +377,6 @@ int __init ip_vs_protocol_init(void) · 22 unmodified lines
382377 REGISTER_PROTOCOL(&ip_vs_protocol_esp);
383378 #endif
384379 pr_info("Registered protocols (%s)\n", &protocols[2]);
385− return register_pernet_subsys(&ipvs_proto_ops);
386380
387381 return 0;
388382 }
@@ -393,7 +387,6 @@ void ip_vs_protocol_cleanup(void) · 4 unmodified lines
393387 struct ip_vs_protocol *pp;
394388 int i;
395389
396− unregister_pernet_subsys(&ipvs_proto_ops);
397390 /* unregister all the ipvs protocols */
398391 for (i = 0; i < IP_VS_PROTO_TAB_SIZE; i++) {
399392 while ((pp = ip_vs_proto_table[i]) != NULL)
net/netfilter/ipvs/ip_vs_sync.c+37−28
@@ -1303,13 +1303,18 @@ static struct socket *make_send_sock(struct net *net) · 1302 unmodified lines
13031303 struct socket *sock;
13041304 int result;
13051305
1306− /* First create a socket */
1307− result = __sock_create(net, PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock, 1);
1306+ /* First create a socket move it to right name space later */
1307+ result = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock);
13081308 if (result < 0) {
13091309 pr_err("Error during creation of socket; terminating\n");
13101310 return ERR_PTR(result);
13111311 }
1312−
1312+ /*
1313+ * Kernel sockets that are a part of a namespace, should not
1314+ * hold a reference to a namespace in order to allow to stop it.
1315+ * After sk_change_net should be released using sk_release_kernel.
1316+ */
1317+ sk_change_net(sock->sk, net);
13131318 result = set_mcast_if(sock->sk, ipvs->master_mcast_ifn);
13141319 if (result < 0) {
13151320 pr_err("Error setting outbound mcast interface\n");
@@ -1334,8 +1339,8 @@ static struct socket *make_send_sock(struct net *net) · 18 unmodified lines
13341339
13351340 return sock;
13361341
1337− error:
1338− sock_release(sock);
1342+error:
1343+ sk_release_kernel(sock->sk);
13391344 return ERR_PTR(result);
13401345 }
13411346
@@ -1350,12 +1355,17 @@ static struct socket *make_receive_sock(struct net *net) · 8 unmodified lines
13501355 int result;
13511356
13521357 /* First create a socket */
1353− result = __sock_create(net, PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock, 1);
1358+ result = sock_create_kern(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &sock);
13541359 if (result < 0) {
13551360 pr_err("Error during creation of socket; terminating\n");
13561361 return ERR_PTR(result);
13571362 }
1358−
1363+ /*
1364+ * Kernel sockets that are a part of a namespace, should not
1365+ * hold a reference to a namespace in order to allow to stop it.
1366+ * After sk_change_net should be released using sk_release_kernel.
1367+ */
1368+ sk_change_net(sock->sk, net);
13591369 /* it is equivalent to the REUSEADDR option in user-space */
13601370 sock->sk->sk_reuse = 1;
13611371
@@ -1377,8 +1387,8 @@ static struct socket *make_receive_sock(struct net *net) · 15 unmodified lines
13771387
13781388 return sock;
13791389
1380− error:
1381− sock_release(sock);
1390+error:
1391+ sk_release_kernel(sock->sk);
13821392 return ERR_PTR(result);
13831393 }
13841394
@@ -1473,7 +1483,7 @@ static int sync_thread_master(void *data) · 88 unmodified lines
14731483 ip_vs_sync_buff_release(sb);
14741484
14751485 /* release the sending multicast socket */
1476− sock_release(tinfo->sock);
1486+ sk_release_kernel(tinfo->sock->sk);
14771487 kfree(tinfo);
14781488
14791489 return 0;
@@ -1513,7 +1523,7 @@ static int sync_thread_backup(void *data) · 33 unmodified lines
15131523 }
15141524
15151525 /* release the sending multicast socket */
1516− sock_release(tinfo->sock);
1526+ sk_release_kernel(tinfo->sock->sk);
15171527 kfree(tinfo->buf);
15181528 kfree(tinfo);
15191529
@@ -1601,7 +1611,7 @@ outtinfo: · 81 unmodified lines
16011611 outbuf:
16021612 kfree(buf);
16031613 outsocket:
1604− sock_release(sock);
1614+ sk_release_kernel(sock->sk);
16051615 out:
16061616 return result;
16071617 }
@@ -1610,6 +1620,7 @@ out: · 2 unmodified lines
16101620 int stop_sync_thread(struct net *net, int state)
16111621 {
16121622 struct netns_ipvs *ipvs = net_ipvs(net);
1623+ int retc = -EINVAL;
16131624
16141625 IP_VS_DBG(7, "%s(): pid %d\n", __func__, task_pid_nr(current));
16151626
@@ -1629,7 +1640,7 @@ int stop_sync_thread(struct net *net, int state) · 13 unmodified lines
16291640 spin_lock_bh(&ipvs->sync_lock);
16301641 ipvs->sync_state &= ~IP_VS_STATE_MASTER;
16311642 spin_unlock_bh(&ipvs->sync_lock);
1632− kthread_stop(ipvs->master_thread);
1643+ retc = kthread_stop(ipvs->master_thread);
16331644 ipvs->master_thread = NULL;
16341645 } else if (state == IP_VS_STATE_BACKUP) {
16351646 if (!ipvs->backup_thread)
@@ -1639,22 +1650,20 @@ int stop_sync_thread(struct net *net, int state) · 3 unmodified lines
16391650 task_pid_nr(ipvs->backup_thread));
16401651
16411652 ipvs->sync_state &= ~IP_VS_STATE_BACKUP;
1642− kthread_stop(ipvs->backup_thread);
1653+ retc = kthread_stop(ipvs->backup_thread);
16431654 ipvs->backup_thread = NULL;
1644− } else {
1645− return -EINVAL;
16461655 }
16471656
16481657 /* decrease the module use count */
16491658 ip_vs_use_count_dec();
16501659
1651− return 0;
1660+ return retc;
16521661 }
16531662
16541663 /*
16551664 * Initialize data struct for each netns
16561665 */
1657−static int __net_init __ip_vs_sync_init(struct net *net)
1666+int __net_init __ip_vs_sync_init(struct net *net)
16581667 {
16591668 struct netns_ipvs *ipvs = net_ipvs(net);
16601669
@@ -1668,24 +1677,24 @@ static int __net_init __ip_vs_sync_init(struct net *net) · 7 unmodified lines
16681677 return 0;
16691678 }
16701679
1671−static void __ip_vs_sync_cleanup(struct net *net)
1680+void __ip_vs_sync_cleanup(struct net *net)
16721681 {
1673− stop_sync_thread(net, IP_VS_STATE_MASTER);
1674− stop_sync_thread(net, IP_VS_STATE_BACKUP);
1675−}
1682+ int retc;
16761683
1677−static struct pernet_operations ipvs_sync_ops = {
1678− .init = __ip_vs_sync_init,
1679− .exit = __ip_vs_sync_cleanup,
1680−};
1684+ retc = stop_sync_thread(net, IP_VS_STATE_MASTER);
1685+ if (retc && retc != -ESRCH)
1686+ pr_err("Failed to stop Master Daemon\n");
16811687
1688+ retc = stop_sync_thread(net, IP_VS_STATE_BACKUP);
1689+ if (retc && retc != -ESRCH)
1690+ pr_err("Failed to stop Backup Daemon\n");
1691+}
16821692
16831693 int __init ip_vs_sync_init(void)
16841694 {
1685− return register_pernet_subsys(&ipvs_sync_ops);
1695+ return 0;
16861696 }
16871697
16881698 void ip_vs_sync_cleanup(void)
16891699 {
1690− unregister_pernet_subsys(&ipvs_sync_ops);
16911700 }
net/netfilter/nf_conntrack_netlink.c+4−0
@@ -1334,6 +1334,7 @@ ctnetlink_create_conntrack(struct net *net, u16 zone, · 1333 unmodified lines
13341334 struct nf_conn *ct;
13351335 int err = -EINVAL;
13361336 struct nf_conntrack_helper *helper;
1337+ struct nf_conn_tstamp *tstamp;
13371338
13381339 ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
13391340 if (IS_ERR(ct))
@@ -1451,6 +1452,9 @@ ctnetlink_create_conntrack(struct net *net, u16 zone, · 111 unmodified lines
14511452 __set_bit(IPS_EXPECTED_BIT, &ct->status);
14521453 ct->master = master_ct;
14531454 }
1455+ tstamp = nf_conn_tstamp_find(ct);
1456+ if (tstamp)
1457+ tstamp->start = ktime_to_ns(ktime_get_real());
14541458
14551459 add_timer(&ct->timeout);
14561460 nf_conntrack_hash_insert(ct);
net/netfilter/x_tables.c+2−2
@@ -455,6 +455,7 @@ void xt_compat_flush_offsets(u_int8_t af) · 454 unmodified lines
455455 vfree(xt[af].compat_tab);
456456 xt[af].compat_tab = NULL;
457457 xt[af].number = 0;
458+ xt[af].cur = 0;
458459 }
459460 }
460461 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
@@ -473,8 +474,7 @@ int xt_compat_calc_jump(u_int8_t af, unsigned int offset) · 12 unmodified lines
473474 else
474475 return mid ? tmp[mid - 1].delta : 0;
475476 }
476− WARN_ON_ONCE(1);
477− return 0;
477+ return left ? tmp[left - 1].delta : 0;
478478 }
479479 EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
480480
net/netfilter/xt_DSCP.c+1−1
@@ -99,7 +99,7 @@ tos_tg6(struct sk_buff *skb, const struct xt_action_param *par) · 98 unmodified lines
9999 u_int8_t orig, nv;
100100
101101 orig = ipv6_get_dsfield(iph);
102− nv = (orig & info->tos_mask) ^ info->tos_value;
102+ nv = (orig & ~info->tos_mask) ^ info->tos_value;
103103
104104 if (orig != nv) {
105105 if (!skb_make_writable(skb, sizeof(struct iphdr)))
net/netfilter/xt_conntrack.c+0−5
@@ -272,11 +272,6 @@ static int conntrack_mt_check(const struct xt_mtchk_param *par) · 271 unmodified lines
272272 {
273273 int ret;
274274
275− if (strcmp(par->table, "raw") == 0) {
276− pr_info("state is undetermined at the time of raw table\n");
277− return -EINVAL;
278− }
279−
280275 ret = nf_ct_l3proto_try_module_get(par->family);
281276 if (ret < 0)
282277 pr_info("cannot load conntrack support for proto=%u\n",