blob: 150e5cf62f8531d98b99fa4b04d2842238f149ba [file] [log] [blame]
Harald Welte2e4e6a12006-01-12 13:30:04 -08001/*
2 * x_tables core - Backend for {ip,ip6,arp}_tables
3 *
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
5 *
6 * Based on existing ip_tables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
13 *
14 */
15
Harald Welte2e4e6a12006-01-12 13:30:04 -080016#include <linux/kernel.h>
17#include <linux/socket.h>
18#include <linux/net.h>
19#include <linux/proc_fs.h>
20#include <linux/seq_file.h>
21#include <linux/string.h>
22#include <linux/vmalloc.h>
Ingo Molnar9e19bb62006-03-25 01:41:10 -080023#include <linux/mutex.h>
Al Virod7fe0f22006-12-03 23:15:30 -050024#include <linux/mm.h>
Eric W. Biederman457c4cb2007-09-12 12:01:34 +020025#include <net/net_namespace.h>
Harald Welte2e4e6a12006-01-12 13:30:04 -080026
27#include <linux/netfilter/x_tables.h>
28#include <linux/netfilter_arp.h>
29
Ingo Molnar9e19bb62006-03-25 01:41:10 -080030
Harald Welte2e4e6a12006-01-12 13:30:04 -080031MODULE_LICENSE("GPL");
32MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
Jan Engelhardt043ef462008-10-08 11:35:15 +020033MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
Harald Welte2e4e6a12006-01-12 13:30:04 -080034
35#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
36
Patrick McHardyb386d9f2007-12-17 21:47:48 -080037struct compat_delta {
38 struct compat_delta *next;
39 unsigned int offset;
40 short delta;
41};
42
Harald Welte2e4e6a12006-01-12 13:30:04 -080043struct xt_af {
Ingo Molnar9e19bb62006-03-25 01:41:10 -080044 struct mutex mutex;
Harald Welte2e4e6a12006-01-12 13:30:04 -080045 struct list_head match;
46 struct list_head target;
Patrick McHardyb386d9f2007-12-17 21:47:48 -080047#ifdef CONFIG_COMPAT
Dmitry Mishin27229712006-04-01 02:25:19 -080048 struct mutex compat_mutex;
Patrick McHardyb386d9f2007-12-17 21:47:48 -080049 struct compat_delta *compat_offsets;
50#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -080051};
52
53static struct xt_af *xt;
54
55#ifdef DEBUG_IP_FIREWALL_USER
56#define duprintf(format, args...) printk(format , ## args)
57#else
58#define duprintf(format, args...)
59#endif
60
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +020061static const char *const xt_prefix[NFPROTO_NUMPROTO] = {
62 [NFPROTO_UNSPEC] = "x",
63 [NFPROTO_IPV4] = "ip",
64 [NFPROTO_ARP] = "arp",
65 [NFPROTO_BRIDGE] = "eb",
66 [NFPROTO_IPV6] = "ip6",
Patrick McHardy37f9f732006-03-20 17:59:06 -080067};
68
Harald Welte2e4e6a12006-01-12 13:30:04 -080069/* Registration hooks for targets. */
70int
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080071xt_register_target(struct xt_target *target)
Harald Welte2e4e6a12006-01-12 13:30:04 -080072{
Jan Engelhardt76108ce2008-10-08 11:35:00 +020073 u_int8_t af = target->family;
74 int ret;
Harald Welte2e4e6a12006-01-12 13:30:04 -080075
Ingo Molnar9e19bb62006-03-25 01:41:10 -080076 ret = mutex_lock_interruptible(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080077 if (ret != 0)
78 return ret;
79 list_add(&target->list, &xt[af].target);
Ingo Molnar9e19bb62006-03-25 01:41:10 -080080 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080081 return ret;
82}
83EXPORT_SYMBOL(xt_register_target);
84
85void
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080086xt_unregister_target(struct xt_target *target)
Harald Welte2e4e6a12006-01-12 13:30:04 -080087{
Jan Engelhardt76108ce2008-10-08 11:35:00 +020088 u_int8_t af = target->family;
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080089
Ingo Molnar9e19bb62006-03-25 01:41:10 -080090 mutex_lock(&xt[af].mutex);
Patrick McHardydf0933d2006-09-20 11:57:53 -070091 list_del(&target->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -080092 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080093}
94EXPORT_SYMBOL(xt_unregister_target);
95
96int
Patrick McHardy52d9c422006-08-22 00:33:45 -070097xt_register_targets(struct xt_target *target, unsigned int n)
98{
99 unsigned int i;
100 int err = 0;
101
102 for (i = 0; i < n; i++) {
103 err = xt_register_target(&target[i]);
104 if (err)
105 goto err;
106 }
107 return err;
108
109err:
110 if (i > 0)
111 xt_unregister_targets(target, i);
112 return err;
113}
114EXPORT_SYMBOL(xt_register_targets);
115
116void
117xt_unregister_targets(struct xt_target *target, unsigned int n)
118{
119 unsigned int i;
120
121 for (i = 0; i < n; i++)
122 xt_unregister_target(&target[i]);
123}
124EXPORT_SYMBOL(xt_unregister_targets);
125
126int
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800127xt_register_match(struct xt_match *match)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800128{
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200129 u_int8_t af = match->family;
130 int ret;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800131
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800132 ret = mutex_lock_interruptible(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800133 if (ret != 0)
134 return ret;
135
136 list_add(&match->list, &xt[af].match);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800137 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800138
139 return ret;
140}
141EXPORT_SYMBOL(xt_register_match);
142
143void
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800144xt_unregister_match(struct xt_match *match)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800145{
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200146 u_int8_t af = match->family;
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800147
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800148 mutex_lock(&xt[af].mutex);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700149 list_del(&match->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800150 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800151}
152EXPORT_SYMBOL(xt_unregister_match);
153
Patrick McHardy52d9c422006-08-22 00:33:45 -0700154int
155xt_register_matches(struct xt_match *match, unsigned int n)
156{
157 unsigned int i;
158 int err = 0;
159
160 for (i = 0; i < n; i++) {
161 err = xt_register_match(&match[i]);
162 if (err)
163 goto err;
164 }
165 return err;
166
167err:
168 if (i > 0)
169 xt_unregister_matches(match, i);
170 return err;
171}
172EXPORT_SYMBOL(xt_register_matches);
173
174void
175xt_unregister_matches(struct xt_match *match, unsigned int n)
176{
177 unsigned int i;
178
179 for (i = 0; i < n; i++)
180 xt_unregister_match(&match[i]);
181}
182EXPORT_SYMBOL(xt_unregister_matches);
183
Harald Welte2e4e6a12006-01-12 13:30:04 -0800184
185/*
186 * These are weird, but module loading must not be done with mutex
187 * held (since they will register), and we have to have a single
188 * function to use try_then_request_module().
189 */
190
191/* Find match, grabs ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200192struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800193{
194 struct xt_match *m;
195 int err = 0;
196
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800197 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800198 return ERR_PTR(-EINTR);
199
200 list_for_each_entry(m, &xt[af].match, list) {
201 if (strcmp(m->name, name) == 0) {
202 if (m->revision == revision) {
203 if (try_module_get(m->me)) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800204 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800205 return m;
206 }
207 } else
208 err = -EPROTOTYPE; /* Found something. */
209 }
210 }
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800211 mutex_unlock(&xt[af].mutex);
Jan Engelhardt55b69e92008-10-08 11:35:01 +0200212
213 if (af != NFPROTO_UNSPEC)
214 /* Try searching again in the family-independent list */
215 return xt_find_match(NFPROTO_UNSPEC, name, revision);
216
Harald Welte2e4e6a12006-01-12 13:30:04 -0800217 return ERR_PTR(err);
218}
219EXPORT_SYMBOL(xt_find_match);
220
221/* Find target, grabs ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200222struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800223{
224 struct xt_target *t;
225 int err = 0;
226
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800227 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800228 return ERR_PTR(-EINTR);
229
230 list_for_each_entry(t, &xt[af].target, list) {
231 if (strcmp(t->name, name) == 0) {
232 if (t->revision == revision) {
233 if (try_module_get(t->me)) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800234 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800235 return t;
236 }
237 } else
238 err = -EPROTOTYPE; /* Found something. */
239 }
240 }
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800241 mutex_unlock(&xt[af].mutex);
Jan Engelhardt55b69e92008-10-08 11:35:01 +0200242
243 if (af != NFPROTO_UNSPEC)
244 /* Try searching again in the family-independent list */
245 return xt_find_target(NFPROTO_UNSPEC, name, revision);
246
Harald Welte2e4e6a12006-01-12 13:30:04 -0800247 return ERR_PTR(err);
248}
249EXPORT_SYMBOL(xt_find_target);
250
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200251struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800252{
253 struct xt_target *target;
254
255 target = try_then_request_module(xt_find_target(af, name, revision),
Patrick McHardy37f9f732006-03-20 17:59:06 -0800256 "%st_%s", xt_prefix[af], name);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800257 if (IS_ERR(target) || !target)
258 return NULL;
259 return target;
260}
261EXPORT_SYMBOL_GPL(xt_request_find_target);
262
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200263static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800264{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200265 const struct xt_match *m;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800266 int have_rev = 0;
267
268 list_for_each_entry(m, &xt[af].match, list) {
269 if (strcmp(m->name, name) == 0) {
270 if (m->revision > *bestp)
271 *bestp = m->revision;
272 if (m->revision == revision)
273 have_rev = 1;
274 }
275 }
Patrick McHardy656caff2009-01-12 00:06:04 +0000276
277 if (af != NFPROTO_UNSPEC && !have_rev)
278 return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
279
Harald Welte2e4e6a12006-01-12 13:30:04 -0800280 return have_rev;
281}
282
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200283static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800284{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200285 const struct xt_target *t;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800286 int have_rev = 0;
287
288 list_for_each_entry(t, &xt[af].target, list) {
289 if (strcmp(t->name, name) == 0) {
290 if (t->revision > *bestp)
291 *bestp = t->revision;
292 if (t->revision == revision)
293 have_rev = 1;
294 }
295 }
Patrick McHardy656caff2009-01-12 00:06:04 +0000296
297 if (af != NFPROTO_UNSPEC && !have_rev)
298 return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
299
Harald Welte2e4e6a12006-01-12 13:30:04 -0800300 return have_rev;
301}
302
303/* Returns true or false (if no such extension at all) */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200304int xt_find_revision(u8 af, const char *name, u8 revision, int target,
Harald Welte2e4e6a12006-01-12 13:30:04 -0800305 int *err)
306{
307 int have_rev, best = -1;
308
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800309 if (mutex_lock_interruptible(&xt[af].mutex) != 0) {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800310 *err = -EINTR;
311 return 1;
312 }
313 if (target == 1)
314 have_rev = target_revfn(af, name, revision, &best);
315 else
316 have_rev = match_revfn(af, name, revision, &best);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800317 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800318
319 /* Nothing at all? Return 0 to try loading module. */
320 if (best == -1) {
321 *err = -ENOENT;
322 return 0;
323 }
324
325 *err = best;
326 if (!have_rev)
327 *err = -EPROTONOSUPPORT;
328 return 1;
329}
330EXPORT_SYMBOL_GPL(xt_find_revision);
331
Jan Engelhardt916a9172008-10-08 11:35:20 +0200332int xt_check_match(struct xt_mtchk_param *par,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200333 unsigned int size, u_int8_t proto, bool inv_proto)
Patrick McHardy37f9f732006-03-20 17:59:06 -0800334{
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200335 if (XT_ALIGN(par->match->matchsize) != size &&
336 par->match->matchsize != -1) {
Jan Engelhardt043ef462008-10-08 11:35:15 +0200337 /*
338 * ebt_among is exempt from centralized matchsize checking
339 * because it uses a dynamic-size data set.
340 */
Patrick McHardy37f9f732006-03-20 17:59:06 -0800341 printk("%s_tables: %s match: invalid size %Zu != %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200342 xt_prefix[par->family], par->match->name,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200343 XT_ALIGN(par->match->matchsize), size);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800344 return -EINVAL;
345 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200346 if (par->match->table != NULL &&
347 strcmp(par->match->table, par->table) != 0) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800348 printk("%s_tables: %s match: only valid in %s table, not %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200349 xt_prefix[par->family], par->match->name,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200350 par->match->table, par->table);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800351 return -EINVAL;
352 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200353 if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
Jan Engelhardt102befa2008-10-08 11:35:15 +0200354 printk("%s_tables: %s match: bad hook_mask %#x/%#x\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200355 xt_prefix[par->family], par->match->name,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200356 par->hook_mask, par->match->hooks);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800357 return -EINVAL;
358 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200359 if (par->match->proto && (par->match->proto != proto || inv_proto)) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800360 printk("%s_tables: %s match: only valid for protocol %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200361 xt_prefix[par->family], par->match->name,
362 par->match->proto);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800363 return -EINVAL;
364 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200365 if (par->match->checkentry != NULL && !par->match->checkentry(par))
Jan Engelhardt367c6792008-10-08 11:35:17 +0200366 return -EINVAL;
Patrick McHardy37f9f732006-03-20 17:59:06 -0800367 return 0;
368}
369EXPORT_SYMBOL_GPL(xt_check_match);
370
Dmitry Mishin27229712006-04-01 02:25:19 -0800371#ifdef CONFIG_COMPAT
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200372int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800373{
374 struct compat_delta *tmp;
375
376 tmp = kmalloc(sizeof(struct compat_delta), GFP_KERNEL);
377 if (!tmp)
378 return -ENOMEM;
379
380 tmp->offset = offset;
381 tmp->delta = delta;
382
383 if (xt[af].compat_offsets) {
384 tmp->next = xt[af].compat_offsets->next;
385 xt[af].compat_offsets->next = tmp;
386 } else {
387 xt[af].compat_offsets = tmp;
388 tmp->next = NULL;
389 }
390 return 0;
391}
392EXPORT_SYMBOL_GPL(xt_compat_add_offset);
393
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200394void xt_compat_flush_offsets(u_int8_t af)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800395{
396 struct compat_delta *tmp, *next;
397
398 if (xt[af].compat_offsets) {
399 for (tmp = xt[af].compat_offsets; tmp; tmp = next) {
400 next = tmp->next;
401 kfree(tmp);
402 }
403 xt[af].compat_offsets = NULL;
404 }
405}
406EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
407
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200408short xt_compat_calc_jump(u_int8_t af, unsigned int offset)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800409{
410 struct compat_delta *tmp;
411 short delta;
412
413 for (tmp = xt[af].compat_offsets, delta = 0; tmp; tmp = tmp->next)
414 if (tmp->offset < offset)
415 delta += tmp->delta;
416 return delta;
417}
418EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
419
Jan Engelhardt5452e422008-04-14 11:15:35 +0200420int xt_compat_match_offset(const struct xt_match *match)
Dmitry Mishin27229712006-04-01 02:25:19 -0800421{
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700422 u_int16_t csize = match->compatsize ? : match->matchsize;
423 return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize);
Dmitry Mishin27229712006-04-01 02:25:19 -0800424}
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700425EXPORT_SYMBOL_GPL(xt_compat_match_offset);
426
Patrick McHardy89566952007-12-17 21:46:40 -0800427int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800428 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700429{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200430 const struct xt_match *match = m->u.kernel.match;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700431 struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
432 int pad, off = xt_compat_match_offset(match);
433 u_int16_t msize = cm->u.user.match_size;
434
435 m = *dstptr;
436 memcpy(m, cm, sizeof(*cm));
437 if (match->compat_from_user)
438 match->compat_from_user(m->data, cm->data);
439 else
440 memcpy(m->data, cm->data, msize - sizeof(*cm));
441 pad = XT_ALIGN(match->matchsize) - match->matchsize;
442 if (pad > 0)
443 memset(m->data + match->matchsize, 0, pad);
444
445 msize += off;
446 m->u.user.match_size = msize;
447
448 *size += off;
449 *dstptr += msize;
Patrick McHardy89566952007-12-17 21:46:40 -0800450 return 0;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700451}
452EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
453
454int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800455 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700456{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200457 const struct xt_match *match = m->u.kernel.match;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700458 struct compat_xt_entry_match __user *cm = *dstptr;
459 int off = xt_compat_match_offset(match);
460 u_int16_t msize = m->u.user.match_size - off;
461
462 if (copy_to_user(cm, m, sizeof(*cm)) ||
Patrick McHardya18aa312007-12-12 10:35:16 -0800463 put_user(msize, &cm->u.user.match_size) ||
464 copy_to_user(cm->u.user.name, m->u.kernel.match->name,
465 strlen(m->u.kernel.match->name) + 1))
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800466 return -EFAULT;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700467
468 if (match->compat_to_user) {
469 if (match->compat_to_user((void __user *)cm->data, m->data))
470 return -EFAULT;
471 } else {
472 if (copy_to_user(cm->data, m->data, msize - sizeof(*cm)))
473 return -EFAULT;
474 }
475
476 *size -= off;
477 *dstptr += msize;
478 return 0;
479}
480EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
481#endif /* CONFIG_COMPAT */
Dmitry Mishin27229712006-04-01 02:25:19 -0800482
Jan Engelhardt916a9172008-10-08 11:35:20 +0200483int xt_check_target(struct xt_tgchk_param *par,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200484 unsigned int size, u_int8_t proto, bool inv_proto)
Patrick McHardy37f9f732006-03-20 17:59:06 -0800485{
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200486 if (XT_ALIGN(par->target->targetsize) != size) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800487 printk("%s_tables: %s target: invalid size %Zu != %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200488 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200489 XT_ALIGN(par->target->targetsize), size);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800490 return -EINVAL;
491 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200492 if (par->target->table != NULL &&
493 strcmp(par->target->table, par->table) != 0) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800494 printk("%s_tables: %s target: only valid in %s table, not %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200495 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200496 par->target->table, par->table);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800497 return -EINVAL;
498 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200499 if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
Jan Engelhardt102befa2008-10-08 11:35:15 +0200500 printk("%s_tables: %s target: bad hook_mask %#x/%#x\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200501 xt_prefix[par->family], par->target->name,
502 par->hook_mask, par->target->hooks);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800503 return -EINVAL;
504 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200505 if (par->target->proto && (par->target->proto != proto || inv_proto)) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800506 printk("%s_tables: %s target: only valid for protocol %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200507 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200508 par->target->proto);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800509 return -EINVAL;
510 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200511 if (par->target->checkentry != NULL && !par->target->checkentry(par))
Jan Engelhardt367c6792008-10-08 11:35:17 +0200512 return -EINVAL;
Patrick McHardy37f9f732006-03-20 17:59:06 -0800513 return 0;
514}
515EXPORT_SYMBOL_GPL(xt_check_target);
516
Dmitry Mishin27229712006-04-01 02:25:19 -0800517#ifdef CONFIG_COMPAT
Jan Engelhardt5452e422008-04-14 11:15:35 +0200518int xt_compat_target_offset(const struct xt_target *target)
Dmitry Mishin27229712006-04-01 02:25:19 -0800519{
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700520 u_int16_t csize = target->compatsize ? : target->targetsize;
521 return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize);
Dmitry Mishin27229712006-04-01 02:25:19 -0800522}
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700523EXPORT_SYMBOL_GPL(xt_compat_target_offset);
524
525void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800526 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700527{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200528 const struct xt_target *target = t->u.kernel.target;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700529 struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
530 int pad, off = xt_compat_target_offset(target);
531 u_int16_t tsize = ct->u.user.target_size;
532
533 t = *dstptr;
534 memcpy(t, ct, sizeof(*ct));
535 if (target->compat_from_user)
536 target->compat_from_user(t->data, ct->data);
537 else
538 memcpy(t->data, ct->data, tsize - sizeof(*ct));
539 pad = XT_ALIGN(target->targetsize) - target->targetsize;
540 if (pad > 0)
541 memset(t->data + target->targetsize, 0, pad);
542
543 tsize += off;
544 t->u.user.target_size = tsize;
545
546 *size += off;
547 *dstptr += tsize;
548}
549EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
550
551int xt_compat_target_to_user(struct xt_entry_target *t, void __user **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800552 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700553{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200554 const struct xt_target *target = t->u.kernel.target;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700555 struct compat_xt_entry_target __user *ct = *dstptr;
556 int off = xt_compat_target_offset(target);
557 u_int16_t tsize = t->u.user.target_size - off;
558
559 if (copy_to_user(ct, t, sizeof(*ct)) ||
Patrick McHardya18aa312007-12-12 10:35:16 -0800560 put_user(tsize, &ct->u.user.target_size) ||
561 copy_to_user(ct->u.user.name, t->u.kernel.target->name,
562 strlen(t->u.kernel.target->name) + 1))
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800563 return -EFAULT;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700564
565 if (target->compat_to_user) {
566 if (target->compat_to_user((void __user *)ct->data, t->data))
567 return -EFAULT;
568 } else {
569 if (copy_to_user(ct->data, t->data, tsize - sizeof(*ct)))
570 return -EFAULT;
571 }
572
573 *size -= off;
574 *dstptr += tsize;
575 return 0;
576}
577EXPORT_SYMBOL_GPL(xt_compat_target_to_user);
Dmitry Mishin27229712006-04-01 02:25:19 -0800578#endif
579
Harald Welte2e4e6a12006-01-12 13:30:04 -0800580struct xt_table_info *xt_alloc_table_info(unsigned int size)
581{
582 struct xt_table_info *newinfo;
583 int cpu;
584
585 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
586 if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > num_physpages)
587 return NULL;
588
Eric Dumazet259d4e42007-12-04 23:24:56 -0800589 newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800590 if (!newinfo)
591 return NULL;
592
593 newinfo->size = size;
594
KAMEZAWA Hiroyuki6f912042006-04-10 22:52:50 -0700595 for_each_possible_cpu(cpu) {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800596 if (size <= PAGE_SIZE)
597 newinfo->entries[cpu] = kmalloc_node(size,
598 GFP_KERNEL,
599 cpu_to_node(cpu));
600 else
601 newinfo->entries[cpu] = vmalloc_node(size,
602 cpu_to_node(cpu));
603
604 if (newinfo->entries[cpu] == NULL) {
605 xt_free_table_info(newinfo);
606 return NULL;
607 }
608 }
609
610 return newinfo;
611}
612EXPORT_SYMBOL(xt_alloc_table_info);
613
614void xt_free_table_info(struct xt_table_info *info)
615{
616 int cpu;
617
KAMEZAWA Hiroyuki6f912042006-04-10 22:52:50 -0700618 for_each_possible_cpu(cpu) {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800619 if (info->size <= PAGE_SIZE)
620 kfree(info->entries[cpu]);
621 else
622 vfree(info->entries[cpu]);
623 }
624 kfree(info);
625}
626EXPORT_SYMBOL(xt_free_table_info);
627
628/* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200629struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
630 const char *name)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800631{
632 struct xt_table *t;
633
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800634 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800635 return ERR_PTR(-EINTR);
636
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800637 list_for_each_entry(t, &net->xt.tables[af], list)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800638 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
639 return t;
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800640 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800641 return NULL;
642}
643EXPORT_SYMBOL_GPL(xt_find_table_lock);
644
645void xt_table_unlock(struct xt_table *table)
646{
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800647 mutex_unlock(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800648}
649EXPORT_SYMBOL_GPL(xt_table_unlock);
650
Dmitry Mishin27229712006-04-01 02:25:19 -0800651#ifdef CONFIG_COMPAT
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200652void xt_compat_lock(u_int8_t af)
Dmitry Mishin27229712006-04-01 02:25:19 -0800653{
654 mutex_lock(&xt[af].compat_mutex);
655}
656EXPORT_SYMBOL_GPL(xt_compat_lock);
657
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200658void xt_compat_unlock(u_int8_t af)
Dmitry Mishin27229712006-04-01 02:25:19 -0800659{
660 mutex_unlock(&xt[af].compat_mutex);
661}
662EXPORT_SYMBOL_GPL(xt_compat_unlock);
663#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -0800664
Stephen Hemminger942e4a22009-04-28 22:36:33 -0700665DEFINE_PER_CPU(struct xt_info_lock, xt_info_locks);
666EXPORT_PER_CPU_SYMBOL_GPL(xt_info_locks);
667
668
Harald Welte2e4e6a12006-01-12 13:30:04 -0800669struct xt_table_info *
670xt_replace_table(struct xt_table *table,
671 unsigned int num_counters,
672 struct xt_table_info *newinfo,
673 int *error)
674{
Stephen Hemminger942e4a22009-04-28 22:36:33 -0700675 struct xt_table_info *private;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800676
677 /* Do the substitution. */
Stephen Hemminger942e4a22009-04-28 22:36:33 -0700678 local_bh_disable();
Harald Welte2e4e6a12006-01-12 13:30:04 -0800679 private = table->private;
Stephen Hemminger942e4a22009-04-28 22:36:33 -0700680
Harald Welte2e4e6a12006-01-12 13:30:04 -0800681 /* Check inside lock: is the old number correct? */
682 if (num_counters != private->number) {
683 duprintf("num_counters != table->private->number (%u/%u)\n",
684 num_counters, private->number);
Stephen Hemminger942e4a22009-04-28 22:36:33 -0700685 local_bh_enable();
Harald Welte2e4e6a12006-01-12 13:30:04 -0800686 *error = -EAGAIN;
687 return NULL;
688 }
Harald Welte2e4e6a12006-01-12 13:30:04 -0800689
Stephen Hemminger942e4a22009-04-28 22:36:33 -0700690 table->private = newinfo;
691 newinfo->initial_entries = private->initial_entries;
692
693 /*
694 * Even though table entries have now been swapped, other CPU's
695 * may still be using the old entries. This is okay, because
696 * resynchronization happens because of the locking done
697 * during the get_counters() routine.
698 */
699 local_bh_enable();
700
701 return private;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800702}
703EXPORT_SYMBOL_GPL(xt_replace_table);
704
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800705struct xt_table *xt_register_table(struct net *net, struct xt_table *table,
Alexey Dobriyana98da112008-01-31 04:01:49 -0800706 struct xt_table_info *bootstrap,
707 struct xt_table_info *newinfo)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800708{
709 int ret;
710 struct xt_table_info *private;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700711 struct xt_table *t;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800712
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800713 /* Don't add one object to multiple lists. */
714 table = kmemdup(table, sizeof(struct xt_table), GFP_KERNEL);
715 if (!table) {
716 ret = -ENOMEM;
717 goto out;
718 }
719
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800720 ret = mutex_lock_interruptible(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800721 if (ret != 0)
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800722 goto out_free;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800723
724 /* Don't autoload: we'd eat our tail... */
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800725 list_for_each_entry(t, &net->xt.tables[table->af], list) {
Patrick McHardydf0933d2006-09-20 11:57:53 -0700726 if (strcmp(t->name, table->name) == 0) {
727 ret = -EEXIST;
728 goto unlock;
729 }
Harald Welte2e4e6a12006-01-12 13:30:04 -0800730 }
731
732 /* Simplifies replace_table code. */
733 table->private = bootstrap;
Stephen Hemminger78454472009-02-20 10:35:32 +0100734
Harald Welte2e4e6a12006-01-12 13:30:04 -0800735 if (!xt_replace_table(table, 0, newinfo, &ret))
736 goto unlock;
737
738 private = table->private;
739 duprintf("table->private->number = %u\n", private->number);
740
741 /* save number of initial entries */
742 private->initial_entries = private->number;
743
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800744 list_add(&table->list, &net->xt.tables[table->af]);
Alexey Dobriyana98da112008-01-31 04:01:49 -0800745 mutex_unlock(&xt[table->af].mutex);
746 return table;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800747
Harald Welte2e4e6a12006-01-12 13:30:04 -0800748 unlock:
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800749 mutex_unlock(&xt[table->af].mutex);
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800750out_free:
751 kfree(table);
Alexey Dobriyana98da112008-01-31 04:01:49 -0800752out:
753 return ERR_PTR(ret);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800754}
755EXPORT_SYMBOL_GPL(xt_register_table);
756
757void *xt_unregister_table(struct xt_table *table)
758{
759 struct xt_table_info *private;
760
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800761 mutex_lock(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800762 private = table->private;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700763 list_del(&table->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800764 mutex_unlock(&xt[table->af].mutex);
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800765 kfree(table);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800766
767 return private;
768}
769EXPORT_SYMBOL_GPL(xt_unregister_table);
770
771#ifdef CONFIG_PROC_FS
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800772struct xt_names_priv {
773 struct seq_net_private p;
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200774 u_int8_t af;
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800775};
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800776static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800777{
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800778 struct xt_names_priv *priv = seq->private;
YOSHIFUJI Hideaki12188542008-03-26 02:36:06 +0900779 struct net *net = seq_file_net(seq);
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200780 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800781
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800782 mutex_lock(&xt[af].mutex);
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800783 return seq_list_start(&net->xt.tables[af], *pos);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800784}
785
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800786static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800787{
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800788 struct xt_names_priv *priv = seq->private;
YOSHIFUJI Hideaki12188542008-03-26 02:36:06 +0900789 struct net *net = seq_file_net(seq);
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200790 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800791
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800792 return seq_list_next(v, &net->xt.tables[af], pos);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800793}
794
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800795static void xt_table_seq_stop(struct seq_file *seq, void *v)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800796{
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800797 struct xt_names_priv *priv = seq->private;
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200798 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800799
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800800 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800801}
802
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800803static int xt_table_seq_show(struct seq_file *seq, void *v)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800804{
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800805 struct xt_table *table = list_entry(v, struct xt_table, list);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800806
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800807 if (strlen(table->name))
808 return seq_printf(seq, "%s\n", table->name);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800809 else
810 return 0;
811}
812
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800813static const struct seq_operations xt_table_seq_ops = {
814 .start = xt_table_seq_start,
815 .next = xt_table_seq_next,
816 .stop = xt_table_seq_stop,
817 .show = xt_table_seq_show,
Harald Welte2e4e6a12006-01-12 13:30:04 -0800818};
819
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800820static int xt_table_open(struct inode *inode, struct file *file)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800821{
822 int ret;
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800823 struct xt_names_priv *priv;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800824
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800825 ret = seq_open_net(inode, file, &xt_table_seq_ops,
826 sizeof(struct xt_names_priv));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800827 if (!ret) {
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800828 priv = ((struct seq_file *)file->private_data)->private;
829 priv->af = (unsigned long)PDE(inode)->data;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800830 }
Harald Welte2e4e6a12006-01-12 13:30:04 -0800831 return ret;
832}
833
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800834static const struct file_operations xt_table_ops = {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800835 .owner = THIS_MODULE,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800836 .open = xt_table_open,
837 .read = seq_read,
838 .llseek = seq_lseek,
Pavel Emelyanov0e93bb942008-04-29 03:15:35 -0700839 .release = seq_release_net,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800840};
841
Jan Engelhardteb132202009-02-18 16:42:19 +0100842/*
843 * Traverse state for ip{,6}_{tables,matches} for helping crossing
844 * the multi-AF mutexes.
845 */
846struct nf_mttg_trav {
847 struct list_head *head, *curr;
848 uint8_t class, nfproto;
849};
850
851enum {
852 MTTG_TRAV_INIT,
853 MTTG_TRAV_NFP_UNSPEC,
854 MTTG_TRAV_NFP_SPEC,
855 MTTG_TRAV_DONE,
856};
857
858static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
859 bool is_target)
860{
861 static const uint8_t next_class[] = {
862 [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
863 [MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE,
864 };
865 struct nf_mttg_trav *trav = seq->private;
866
867 switch (trav->class) {
868 case MTTG_TRAV_INIT:
869 trav->class = MTTG_TRAV_NFP_UNSPEC;
870 mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
871 trav->head = trav->curr = is_target ?
872 &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
873 break;
874 case MTTG_TRAV_NFP_UNSPEC:
875 trav->curr = trav->curr->next;
876 if (trav->curr != trav->head)
877 break;
878 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
879 mutex_lock(&xt[trav->nfproto].mutex);
880 trav->head = trav->curr = is_target ?
881 &xt[trav->nfproto].target : &xt[trav->nfproto].match;
882 trav->class = next_class[trav->class];
883 break;
884 case MTTG_TRAV_NFP_SPEC:
885 trav->curr = trav->curr->next;
886 if (trav->curr != trav->head)
887 break;
888 /* fallthru, _stop will unlock */
889 default:
890 return NULL;
891 }
892
893 if (ppos != NULL)
894 ++*ppos;
895 return trav;
896}
897
898static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
899 bool is_target)
900{
901 struct nf_mttg_trav *trav = seq->private;
902 unsigned int j;
903
904 trav->class = MTTG_TRAV_INIT;
905 for (j = 0; j < *pos; ++j)
906 if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
907 return NULL;
908 return trav;
909}
910
911static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
912{
913 struct nf_mttg_trav *trav = seq->private;
914
915 switch (trav->class) {
916 case MTTG_TRAV_NFP_UNSPEC:
917 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
918 break;
919 case MTTG_TRAV_NFP_SPEC:
920 mutex_unlock(&xt[trav->nfproto].mutex);
921 break;
922 }
923}
924
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800925static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
926{
Jan Engelhardteb132202009-02-18 16:42:19 +0100927 return xt_mttg_seq_start(seq, pos, false);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800928}
929
Jan Engelhardteb132202009-02-18 16:42:19 +0100930static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800931{
Jan Engelhardteb132202009-02-18 16:42:19 +0100932 return xt_mttg_seq_next(seq, v, ppos, false);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800933}
934
935static int xt_match_seq_show(struct seq_file *seq, void *v)
936{
Jan Engelhardteb132202009-02-18 16:42:19 +0100937 const struct nf_mttg_trav *trav = seq->private;
938 const struct xt_match *match;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800939
Jan Engelhardteb132202009-02-18 16:42:19 +0100940 switch (trav->class) {
941 case MTTG_TRAV_NFP_UNSPEC:
942 case MTTG_TRAV_NFP_SPEC:
943 if (trav->curr == trav->head)
944 return 0;
945 match = list_entry(trav->curr, struct xt_match, list);
946 return (*match->name == '\0') ? 0 :
947 seq_printf(seq, "%s\n", match->name);
948 }
949 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800950}
951
952static const struct seq_operations xt_match_seq_ops = {
953 .start = xt_match_seq_start,
954 .next = xt_match_seq_next,
Jan Engelhardteb132202009-02-18 16:42:19 +0100955 .stop = xt_mttg_seq_stop,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800956 .show = xt_match_seq_show,
957};
958
959static int xt_match_open(struct inode *inode, struct file *file)
960{
Jan Engelhardteb132202009-02-18 16:42:19 +0100961 struct seq_file *seq;
962 struct nf_mttg_trav *trav;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800963 int ret;
964
Jan Engelhardteb132202009-02-18 16:42:19 +0100965 trav = kmalloc(sizeof(*trav), GFP_KERNEL);
966 if (trav == NULL)
967 return -ENOMEM;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800968
Jan Engelhardteb132202009-02-18 16:42:19 +0100969 ret = seq_open(file, &xt_match_seq_ops);
970 if (ret < 0) {
971 kfree(trav);
972 return ret;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800973 }
Jan Engelhardteb132202009-02-18 16:42:19 +0100974
975 seq = file->private_data;
976 seq->private = trav;
977 trav->nfproto = (unsigned long)PDE(inode)->data;
978 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800979}
980
981static const struct file_operations xt_match_ops = {
982 .owner = THIS_MODULE,
983 .open = xt_match_open,
984 .read = seq_read,
985 .llseek = seq_lseek,
Jan Engelhardteb132202009-02-18 16:42:19 +0100986 .release = seq_release_private,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800987};
988
989static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
990{
Jan Engelhardteb132202009-02-18 16:42:19 +0100991 return xt_mttg_seq_start(seq, pos, true);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800992}
993
Jan Engelhardteb132202009-02-18 16:42:19 +0100994static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800995{
Jan Engelhardteb132202009-02-18 16:42:19 +0100996 return xt_mttg_seq_next(seq, v, ppos, true);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800997}
998
999static int xt_target_seq_show(struct seq_file *seq, void *v)
1000{
Jan Engelhardteb132202009-02-18 16:42:19 +01001001 const struct nf_mttg_trav *trav = seq->private;
1002 const struct xt_target *target;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001003
Jan Engelhardteb132202009-02-18 16:42:19 +01001004 switch (trav->class) {
1005 case MTTG_TRAV_NFP_UNSPEC:
1006 case MTTG_TRAV_NFP_SPEC:
1007 if (trav->curr == trav->head)
1008 return 0;
1009 target = list_entry(trav->curr, struct xt_target, list);
1010 return (*target->name == '\0') ? 0 :
1011 seq_printf(seq, "%s\n", target->name);
1012 }
1013 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001014}
1015
1016static const struct seq_operations xt_target_seq_ops = {
1017 .start = xt_target_seq_start,
1018 .next = xt_target_seq_next,
Jan Engelhardteb132202009-02-18 16:42:19 +01001019 .stop = xt_mttg_seq_stop,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001020 .show = xt_target_seq_show,
1021};
1022
1023static int xt_target_open(struct inode *inode, struct file *file)
1024{
Jan Engelhardteb132202009-02-18 16:42:19 +01001025 struct seq_file *seq;
1026 struct nf_mttg_trav *trav;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001027 int ret;
1028
Jan Engelhardteb132202009-02-18 16:42:19 +01001029 trav = kmalloc(sizeof(*trav), GFP_KERNEL);
1030 if (trav == NULL)
1031 return -ENOMEM;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001032
Jan Engelhardteb132202009-02-18 16:42:19 +01001033 ret = seq_open(file, &xt_target_seq_ops);
1034 if (ret < 0) {
1035 kfree(trav);
1036 return ret;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001037 }
Jan Engelhardteb132202009-02-18 16:42:19 +01001038
1039 seq = file->private_data;
1040 seq->private = trav;
1041 trav->nfproto = (unsigned long)PDE(inode)->data;
1042 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001043}
1044
1045static const struct file_operations xt_target_ops = {
1046 .owner = THIS_MODULE,
1047 .open = xt_target_open,
Harald Welte2e4e6a12006-01-12 13:30:04 -08001048 .read = seq_read,
1049 .llseek = seq_lseek,
Jan Engelhardteb132202009-02-18 16:42:19 +01001050 .release = seq_release_private,
Harald Welte2e4e6a12006-01-12 13:30:04 -08001051};
1052
1053#define FORMAT_TABLES "_tables_names"
1054#define FORMAT_MATCHES "_tables_matches"
1055#define FORMAT_TARGETS "_tables_targets"
1056
1057#endif /* CONFIG_PROC_FS */
1058
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001059int xt_proto_init(struct net *net, u_int8_t af)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001060{
1061#ifdef CONFIG_PROC_FS
1062 char buf[XT_FUNCTION_MAXNAMELEN];
1063 struct proc_dir_entry *proc;
1064#endif
1065
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001066 if (af >= ARRAY_SIZE(xt_prefix))
Harald Welte2e4e6a12006-01-12 13:30:04 -08001067 return -EINVAL;
1068
1069
1070#ifdef CONFIG_PROC_FS
Tobias Klauserce18afe2007-03-14 16:36:16 -07001071 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001072 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -07001073 proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops,
1074 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001075 if (!proc)
1076 goto out;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001077
Tobias Klauserce18afe2007-03-14 16:36:16 -07001078 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001079 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -07001080 proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops,
1081 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001082 if (!proc)
1083 goto out_remove_tables;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001084
Tobias Klauserce18afe2007-03-14 16:36:16 -07001085 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001086 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -07001087 proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops,
1088 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001089 if (!proc)
1090 goto out_remove_matches;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001091#endif
1092
1093 return 0;
1094
1095#ifdef CONFIG_PROC_FS
1096out_remove_matches:
Tobias Klauserce18afe2007-03-14 16:36:16 -07001097 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001098 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001099 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001100
1101out_remove_tables:
Tobias Klauserce18afe2007-03-14 16:36:16 -07001102 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001103 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001104 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001105out:
1106 return -1;
1107#endif
1108}
1109EXPORT_SYMBOL_GPL(xt_proto_init);
1110
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001111void xt_proto_fini(struct net *net, u_int8_t af)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001112{
1113#ifdef CONFIG_PROC_FS
1114 char buf[XT_FUNCTION_MAXNAMELEN];
1115
Tobias Klauserce18afe2007-03-14 16:36:16 -07001116 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001117 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001118 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001119
Tobias Klauserce18afe2007-03-14 16:36:16 -07001120 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001121 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001122 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001123
Tobias Klauserce18afe2007-03-14 16:36:16 -07001124 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001125 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001126 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001127#endif /*CONFIG_PROC_FS*/
1128}
1129EXPORT_SYMBOL_GPL(xt_proto_fini);
1130
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001131static int __net_init xt_net_init(struct net *net)
1132{
1133 int i;
1134
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001135 for (i = 0; i < NFPROTO_NUMPROTO; i++)
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001136 INIT_LIST_HEAD(&net->xt.tables[i]);
1137 return 0;
1138}
1139
1140static struct pernet_operations xt_net_ops = {
1141 .init = xt_net_init,
1142};
Harald Welte2e4e6a12006-01-12 13:30:04 -08001143
1144static int __init xt_init(void)
1145{
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001146 unsigned int i;
1147 int rv;
1148
1149 for_each_possible_cpu(i) {
1150 struct xt_info_lock *lock = &per_cpu(xt_info_locks, i);
1151 spin_lock_init(&lock->lock);
1152 lock->readers = 0;
1153 }
Harald Welte2e4e6a12006-01-12 13:30:04 -08001154
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001155 xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001156 if (!xt)
1157 return -ENOMEM;
1158
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001159 for (i = 0; i < NFPROTO_NUMPROTO; i++) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001160 mutex_init(&xt[i].mutex);
Dmitry Mishin27229712006-04-01 02:25:19 -08001161#ifdef CONFIG_COMPAT
1162 mutex_init(&xt[i].compat_mutex);
Patrick McHardyb386d9f2007-12-17 21:47:48 -08001163 xt[i].compat_offsets = NULL;
Dmitry Mishin27229712006-04-01 02:25:19 -08001164#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -08001165 INIT_LIST_HEAD(&xt[i].target);
1166 INIT_LIST_HEAD(&xt[i].match);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001167 }
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001168 rv = register_pernet_subsys(&xt_net_ops);
1169 if (rv < 0)
1170 kfree(xt);
1171 return rv;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001172}
1173
1174static void __exit xt_fini(void)
1175{
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001176 unregister_pernet_subsys(&xt_net_ops);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001177 kfree(xt);
1178}
1179
1180module_init(xt_init);
1181module_exit(xt_fini);
1182