Merge branch 'master' of git://1984.lsi.us.es/net-next

9 files changed, 96 insertions, 92 deletions

diff --git a/include/linux/ip_vs.h b/include/linux/ip_vs.h
index be0ef3df4acb..8a2d438dc499 100644
--- a/include/linux/ip_vs.h
+++ b/include/linux/ip_vs.h
@@ -89,6 +89,7 @@
 #define IP_VS_CONN_F_TEMPLATE   0x1000          /* template, not connection */
 #define IP_VS_CONN_F_ONE_PACKET 0x2000          /* forward only one packet */
 
+/* Initial bits allowed in backup server */
 #define IP_VS_CONN_F_BACKUP_MASK (IP_VS_CONN_F_FWD_MASK | \
                                   IP_VS_CONN_F_NOOUTPUT | \
                                   IP_VS_CONN_F_INACTIVE | \
@@ -97,6 +98,10 @@
                                   IP_VS_CONN_F_TEMPLATE \
                                  )
 
+/* Bits allowed to update in backup server */
+#define IP_VS_CONN_F_BACKUP_UPD_MASK (IP_VS_CONN_F_INACTIVE | \
+                                      IP_VS_CONN_F_SEQ_MASK)
+
 /* Flags that are not sent to backup server start from bit 16 */
 #define IP_VS_CONN_F_NFCT       (1 << 16)       /* use netfilter conntrack */
 
diff --git a/include/linux/netfilter/nf_conntrack_common.h b/include/linux/netfilter/nf_conntrack_common.h
index 0d3dd66322ec..d146872a0b91 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -83,6 +83,10 @@ enum ip_conntrack_status {
         /* Conntrack is a fake untracked entry */
         IPS_UNTRACKED_BIT = 12,
         IPS_UNTRACKED = (1 << IPS_UNTRACKED_BIT),
+
+        /* Conntrack got a helper explicitly attached via CT target. */
+        IPS_HELPER_BIT = 13,
+        IPS_HELPER = (1 << IPS_HELPER_BIT),
 };
 
 /* Connection tracking event types */
diff --git a/include/linux/netfilter_ipv4/Kbuild b/include/linux/netfilter_ipv4/Kbuild
index 31f8bec95650..c61b8fb1a9ef 100644
--- a/include/linux/netfilter_ipv4/Kbuild
+++ b/include/linux/netfilter_ipv4/Kbuild
@@ -1,4 +1,3 @@
-header-y += ip_queue.h
 header-y += ip_tables.h
 header-y += ipt_CLUSTERIP.h
 header-y += ipt_ECN.h
diff --git a/include/linux/netfilter_ipv4/ip_queue.h b/include/linux/netfilter_ipv4/ip_queue.h
deleted file mode 100644
index a03507f465f8..000000000000
--- a/include/linux/netfilter_ipv4/ip_queue.h
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * This is a module which is used for queueing IPv4 packets and
- * communicating with userspace via netlink.
- *
- * (C) 2000 James Morris, this code is GPL.
- */
-#ifndef _IP_QUEUE_H
-#define _IP_QUEUE_H
-
-#ifdef __KERNEL__
-#ifdef DEBUG_IPQ
-#define QDEBUG(x...) printk(KERN_DEBUG ## x)
-#else
-#define QDEBUG(x...)
-#endif  /* DEBUG_IPQ */
-#else
-#include <net/if.h>
-#endif  /* ! __KERNEL__ */
-
-/* Messages sent from kernel */
-typedef struct ipq_packet_msg {
-        unsigned long packet_id;        /* ID of queued packet */
-        unsigned long mark;             /* Netfilter mark value */
-        long timestamp_sec;             /* Packet arrival time (seconds) */
-        long timestamp_usec;            /* Packet arrvial time (+useconds) */
-        unsigned int hook;              /* Netfilter hook we rode in on */
-        char indev_name[IFNAMSIZ];      /* Name of incoming interface */
-        char outdev_name[IFNAMSIZ];     /* Name of outgoing interface */
-        __be16 hw_protocol;             /* Hardware protocol (network order) */
-        unsigned short hw_type;         /* Hardware type */
-        unsigned char hw_addrlen;       /* Hardware address length */
-        unsigned char hw_addr[8];       /* Hardware address */
-        size_t data_len;                /* Length of packet data */
-        unsigned char payload[0];       /* Optional packet data */
-} ipq_packet_msg_t;
-
-/* Messages sent from userspace */
-typedef struct ipq_mode_msg {
-        unsigned char value;            /* Requested mode */
-        size_t range;                   /* Optional range of packet requested */
-} ipq_mode_msg_t;
-
-typedef struct ipq_verdict_msg {
-        unsigned int value;             /* Verdict to hand to netfilter */
-        unsigned long id;               /* Packet ID for this verdict */
-        size_t data_len;                /* Length of replacement data */
-        unsigned char payload[0];       /* Optional replacement packet */
-} ipq_verdict_msg_t;
-
-typedef struct ipq_peer_msg {
-        union {
-                ipq_verdict_msg_t verdict;
-                ipq_mode_msg_t mode;
-        } msg;
-} ipq_peer_msg_t;
-
-/* Packet delivery modes */
-enum {
-        IPQ_COPY_NONE,          /* Initial mode, packets are dropped */
-        IPQ_COPY_META,          /* Copy metadata */
-        IPQ_COPY_PACKET         /* Copy metadata + packet (range) */
-};
-#define IPQ_COPY_MAX IPQ_COPY_PACKET
-
-/* Types of messages */
-#define IPQM_BASE       0x10    /* standard netlink messages below this */
-#define IPQM_MODE       (IPQM_BASE + 1)         /* Mode request from peer */
-#define IPQM_VERDICT    (IPQM_BASE + 2)         /* Verdict from peer */ 
-#define IPQM_PACKET     (IPQM_BASE + 3)         /* Packet from kernel */
-#define IPQM_MAX        (IPQM_BASE + 4)
-
-#endif /*_IP_QUEUE_H*/
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index a2092f582a78..0f628ffa420c 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -7,7 +7,7 @@
 #define NETLINK_ROUTE           0       /* Routing/device hook                          */
 #define NETLINK_UNUSED          1       /* Unused number                                */
 #define NETLINK_USERSOCK        2       /* Reserved for user mode socket protocols      */
-#define NETLINK_FIREWALL        3       /* Firewalling hook                             */
+#define NETLINK_FIREWALL        3       /* Unused number, formerly ip_queue             */
 #define NETLINK_SOCK_DIAG       4       /* socket monitoring                            */
 #define NETLINK_NFLOG           5       /* netfilter/iptables ULOG */
 #define NETLINK_XFRM            6       /* ipsec */
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 93b81aa73429..d6146b4811c2 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -504,6 +504,7 @@ struct ip_vs_conn {
                                                  * state transition triggerd
                                                  * synchronization
                                                  */
+        unsigned long           sync_endtime;   /* jiffies + sent_retries */
 
         /* Control members */
         struct ip_vs_conn       *control;       /* Master control connection */
@@ -783,6 +784,16 @@ struct ip_vs_app {
         void (*timeout_change)(struct ip_vs_app *app, int flags);
 };
 
+struct ipvs_master_sync_state {
+        struct list_head        sync_queue;
+        struct ip_vs_sync_buff  *sync_buff;
+        int                     sync_queue_len;
+        unsigned int            sync_queue_delay;
+        struct task_struct      *master_thread;
+        struct delayed_work     master_wakeup_work;
+        struct netns_ipvs       *ipvs;
+};
+
 /* IPVS in network namespace */
 struct netns_ipvs {
         int                     gen;            /* Generation */
@@ -869,10 +880,15 @@ struct netns_ipvs {
 #endif
         int                     sysctl_snat_reroute;
         int                     sysctl_sync_ver;
+        int                     sysctl_sync_ports;
+        int                     sysctl_sync_qlen_max;
+        int                     sysctl_sync_sock_size;
         int                     sysctl_cache_bypass;
         int                     sysctl_expire_nodest_conn;
         int                     sysctl_expire_quiescent_template;
         int                     sysctl_sync_threshold[2];
+        unsigned int            sysctl_sync_refresh_period;
+        int                     sysctl_sync_retries;
         int                     sysctl_nat_icmp_send;
 
         /* ip_vs_lblc */
@@ -888,13 +904,11 @@ struct netns_ipvs {
         spinlock_t              est_lock;
         struct timer_list       est_timer;      /* Estimation timer */
         /* ip_vs_sync */
-        struct list_head        sync_queue;
         spinlock_t              sync_lock;
-        struct ip_vs_sync_buff  *sync_buff;
+        struct ipvs_master_sync_state *ms;
         spinlock_t              sync_buff_lock;
-        struct sockaddr_in      sync_mcast_addr;
-        struct task_struct      *master_thread;
-        struct task_struct      *backup_thread;
+        struct task_struct      **backup_threads;
+        int                     threads_mask;
         int                     send_mesg_maxlen;
         int                     recv_mesg_maxlen;
         volatile int            sync_state;
@@ -911,6 +925,14 @@ struct netns_ipvs {
 #define DEFAULT_SYNC_THRESHOLD  3
 #define DEFAULT_SYNC_PERIOD     50
 #define DEFAULT_SYNC_VER        1
+#define DEFAULT_SYNC_REFRESH_PERIOD     (0U * HZ)
+#define DEFAULT_SYNC_RETRIES            0
+#define IPVS_SYNC_WAKEUP_RATE   8
+#define IPVS_SYNC_QLEN_MAX      (IPVS_SYNC_WAKEUP_RATE * 4)
+#define IPVS_SYNC_SEND_DELAY    (HZ / 50)
+#define IPVS_SYNC_CHECK_PERIOD  HZ
+#define IPVS_SYNC_FLUSH_TIME    (HZ * 2)
+#define IPVS_SYNC_PORTS_MAX     (1 << 6)
 
 #ifdef CONFIG_SYSCTL
 
@@ -921,7 +943,17 @@ static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
 
 static inline int sysctl_sync_period(struct netns_ipvs *ipvs)
 {
-        return ipvs->sysctl_sync_threshold[1];
+        return ACCESS_ONCE(ipvs->sysctl_sync_threshold[1]);
+}
+
+static inline unsigned int sysctl_sync_refresh_period(struct netns_ipvs *ipvs)
+{
+        return ACCESS_ONCE(ipvs->sysctl_sync_refresh_period);
+}
+
+static inline int sysctl_sync_retries(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_retries;
 }
 
 static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
@@ -929,6 +961,21 @@ static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
         return ipvs->sysctl_sync_ver;
 }
 
+static inline int sysctl_sync_ports(struct netns_ipvs *ipvs)
+{
+        return ACCESS_ONCE(ipvs->sysctl_sync_ports);
+}
+
+static inline int sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_qlen_max;
+}
+
+static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs)
+{
+        return ipvs->sysctl_sync_sock_size;
+}
+
 #else
 
 static inline int sysctl_sync_threshold(struct netns_ipvs *ipvs)
@@ -941,11 +988,36 @@ static inline int sysctl_sync_period(struct netns_ipvs *ipvs)
         return DEFAULT_SYNC_PERIOD;
 }
 
+static inline unsigned int sysctl_sync_refresh_period(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SYNC_REFRESH_PERIOD;
+}
+
+static inline int sysctl_sync_retries(struct netns_ipvs *ipvs)
+{
+        return DEFAULT_SYNC_RETRIES & 3;
+}
+
 static inline int sysctl_sync_ver(struct netns_ipvs *ipvs)
 {
         return DEFAULT_SYNC_VER;
 }
 
+static inline int sysctl_sync_ports(struct netns_ipvs *ipvs)
+{
+        return 1;
+}
+
+static inline int sysctl_sync_qlen_max(struct netns_ipvs *ipvs)
+{
+        return IPVS_SYNC_QLEN_MAX;
+}
+
+static inline int sysctl_sync_sock_size(struct netns_ipvs *ipvs)
+{
+        return 0;
+}
+
 #endif
 
 /*
@@ -1185,7 +1257,6 @@ extern void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg);
 extern struct ip_vs_stats ip_vs_stats;
 extern int sysctl_ip_vs_sync_ver;
 
-extern void ip_vs_sync_switch_mode(struct net *net, int mode);
 extern struct ip_vs_service *
 ip_vs_service_get(struct net *net, int af, __u32 fwmark, __u16 protocol,
                   const union nf_inet_addr *vaddr, __be16 vport);
@@ -1219,7 +1290,7 @@ extern struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp);
 extern int start_sync_thread(struct net *net, int state, char *mcast_ifn,
                              __u8 syncid);
 extern int stop_sync_thread(struct net *net, int state);
-extern void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp);
+extern void ip_vs_sync_conn(struct net *net, struct ip_vs_conn *cp, int pkts);
 
 
 /*
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index ab86036bbf0c..cce7f6a798bf 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -321,14 +321,8 @@ extern unsigned int nf_conntrack_max;
 extern unsigned int nf_conntrack_hash_rnd;
 void init_nf_conntrack_hash_rnd(void);
 
-#define NF_CT_STAT_INC(net, count)      \
-        __this_cpu_inc((net)->ct.stat->count)
-#define NF_CT_STAT_INC_ATOMIC(net, count)               \
-do {                                                    \
-        local_bh_disable();                             \
-        __this_cpu_inc((net)->ct.stat->count);          \
-        local_bh_enable();                              \
-} while (0)
+#define NF_CT_STAT_INC(net, count)        __this_cpu_inc((net)->ct.stat->count)
+#define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)
 
 #define MODULE_ALIAS_NFCT_HELPER(helper) \
         MODULE_ALIAS("nfct-helper-" helper)
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index 5767dc242dee..1d1889409b9e 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -60,8 +60,8 @@ static inline struct nf_conn_help *nfct_help(const struct nf_conn *ct)
         return nf_ct_ext_find(ct, NF_CT_EXT_HELPER);
 }
 
-extern int nf_conntrack_helper_init(void);
-extern void nf_conntrack_helper_fini(void);
+extern int nf_conntrack_helper_init(struct net *net);
+extern void nf_conntrack_helper_fini(struct net *net);
 
 extern int nf_conntrack_broadcast_help(struct sk_buff *skb,
                                        unsigned int protoff,
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 7a911eca0f18..a053a19870cf 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -26,11 +26,14 @@ struct netns_ct {
         int                     sysctl_tstamp;
         int                     sysctl_checksum;
         unsigned int            sysctl_log_invalid; /* Log invalid packets */
+        int                     sysctl_auto_assign_helper;
+        bool                    auto_assign_helper_warned;
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *sysctl_header;
         struct ctl_table_header *acct_sysctl_header;
         struct ctl_table_header *tstamp_sysctl_header;
         struct ctl_table_header *event_sysctl_header;
+        struct ctl_table_header *helper_sysctl_header;
 #endif
         char                    *slabname;
 };