blob: 89837a4eef7621e6678049fee3c096bf67de8acf [file] [log] [blame]
Harald Welte2e4e6a12006-01-12 13:30:04 -08001/*
2 * x_tables core - Backend for {ip,ip6,arp}_tables
3 *
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
5 *
6 * Based on existing ip_tables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
13 *
14 */
15
Harald Welte2e4e6a12006-01-12 13:30:04 -080016#include <linux/kernel.h>
17#include <linux/socket.h>
18#include <linux/net.h>
19#include <linux/proc_fs.h>
20#include <linux/seq_file.h>
21#include <linux/string.h>
22#include <linux/vmalloc.h>
Ingo Molnar9e19bb62006-03-25 01:41:10 -080023#include <linux/mutex.h>
Al Virod7fe0f22006-12-03 23:15:30 -050024#include <linux/mm.h>
Eric W. Biederman457c4cb2007-09-12 12:01:34 +020025#include <net/net_namespace.h>
Harald Welte2e4e6a12006-01-12 13:30:04 -080026
27#include <linux/netfilter/x_tables.h>
28#include <linux/netfilter_arp.h>
29
Ingo Molnar9e19bb62006-03-25 01:41:10 -080030
Harald Welte2e4e6a12006-01-12 13:30:04 -080031MODULE_LICENSE("GPL");
32MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
Jan Engelhardt043ef462008-10-08 11:35:15 +020033MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
Harald Welte2e4e6a12006-01-12 13:30:04 -080034
35#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
36
Patrick McHardyb386d9f2007-12-17 21:47:48 -080037struct compat_delta {
38 struct compat_delta *next;
39 unsigned int offset;
40 short delta;
41};
42
Harald Welte2e4e6a12006-01-12 13:30:04 -080043struct xt_af {
Ingo Molnar9e19bb62006-03-25 01:41:10 -080044 struct mutex mutex;
Harald Welte2e4e6a12006-01-12 13:30:04 -080045 struct list_head match;
46 struct list_head target;
Patrick McHardyb386d9f2007-12-17 21:47:48 -080047#ifdef CONFIG_COMPAT
Dmitry Mishin27229712006-04-01 02:25:19 -080048 struct mutex compat_mutex;
Patrick McHardyb386d9f2007-12-17 21:47:48 -080049 struct compat_delta *compat_offsets;
50#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -080051};
52
53static struct xt_af *xt;
54
55#ifdef DEBUG_IP_FIREWALL_USER
56#define duprintf(format, args...) printk(format , ## args)
57#else
58#define duprintf(format, args...)
59#endif
60
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +020061static const char *const xt_prefix[NFPROTO_NUMPROTO] = {
62 [NFPROTO_UNSPEC] = "x",
63 [NFPROTO_IPV4] = "ip",
64 [NFPROTO_ARP] = "arp",
65 [NFPROTO_BRIDGE] = "eb",
66 [NFPROTO_IPV6] = "ip6",
Patrick McHardy37f9f732006-03-20 17:59:06 -080067};
68
Harald Welte2e4e6a12006-01-12 13:30:04 -080069/* Registration hooks for targets. */
70int
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080071xt_register_target(struct xt_target *target)
Harald Welte2e4e6a12006-01-12 13:30:04 -080072{
Jan Engelhardt76108ce2008-10-08 11:35:00 +020073 u_int8_t af = target->family;
74 int ret;
Harald Welte2e4e6a12006-01-12 13:30:04 -080075
Ingo Molnar9e19bb62006-03-25 01:41:10 -080076 ret = mutex_lock_interruptible(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080077 if (ret != 0)
78 return ret;
79 list_add(&target->list, &xt[af].target);
Ingo Molnar9e19bb62006-03-25 01:41:10 -080080 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080081 return ret;
82}
83EXPORT_SYMBOL(xt_register_target);
84
85void
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080086xt_unregister_target(struct xt_target *target)
Harald Welte2e4e6a12006-01-12 13:30:04 -080087{
Jan Engelhardt76108ce2008-10-08 11:35:00 +020088 u_int8_t af = target->family;
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080089
Ingo Molnar9e19bb62006-03-25 01:41:10 -080090 mutex_lock(&xt[af].mutex);
Patrick McHardydf0933d2006-09-20 11:57:53 -070091 list_del(&target->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -080092 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080093}
94EXPORT_SYMBOL(xt_unregister_target);
95
96int
Patrick McHardy52d9c422006-08-22 00:33:45 -070097xt_register_targets(struct xt_target *target, unsigned int n)
98{
99 unsigned int i;
100 int err = 0;
101
102 for (i = 0; i < n; i++) {
103 err = xt_register_target(&target[i]);
104 if (err)
105 goto err;
106 }
107 return err;
108
109err:
110 if (i > 0)
111 xt_unregister_targets(target, i);
112 return err;
113}
114EXPORT_SYMBOL(xt_register_targets);
115
116void
117xt_unregister_targets(struct xt_target *target, unsigned int n)
118{
119 unsigned int i;
120
121 for (i = 0; i < n; i++)
122 xt_unregister_target(&target[i]);
123}
124EXPORT_SYMBOL(xt_unregister_targets);
125
126int
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800127xt_register_match(struct xt_match *match)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800128{
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200129 u_int8_t af = match->family;
130 int ret;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800131
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800132 ret = mutex_lock_interruptible(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800133 if (ret != 0)
134 return ret;
135
136 list_add(&match->list, &xt[af].match);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800137 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800138
139 return ret;
140}
141EXPORT_SYMBOL(xt_register_match);
142
143void
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800144xt_unregister_match(struct xt_match *match)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800145{
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200146 u_int8_t af = match->family;
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800147
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800148 mutex_lock(&xt[af].mutex);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700149 list_del(&match->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800150 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800151}
152EXPORT_SYMBOL(xt_unregister_match);
153
Patrick McHardy52d9c422006-08-22 00:33:45 -0700154int
155xt_register_matches(struct xt_match *match, unsigned int n)
156{
157 unsigned int i;
158 int err = 0;
159
160 for (i = 0; i < n; i++) {
161 err = xt_register_match(&match[i]);
162 if (err)
163 goto err;
164 }
165 return err;
166
167err:
168 if (i > 0)
169 xt_unregister_matches(match, i);
170 return err;
171}
172EXPORT_SYMBOL(xt_register_matches);
173
174void
175xt_unregister_matches(struct xt_match *match, unsigned int n)
176{
177 unsigned int i;
178
179 for (i = 0; i < n; i++)
180 xt_unregister_match(&match[i]);
181}
182EXPORT_SYMBOL(xt_unregister_matches);
183
Harald Welte2e4e6a12006-01-12 13:30:04 -0800184
185/*
186 * These are weird, but module loading must not be done with mutex
187 * held (since they will register), and we have to have a single
188 * function to use try_then_request_module().
189 */
190
191/* Find match, grabs ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200192struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800193{
194 struct xt_match *m;
195 int err = 0;
196
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800197 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800198 return ERR_PTR(-EINTR);
199
200 list_for_each_entry(m, &xt[af].match, list) {
201 if (strcmp(m->name, name) == 0) {
202 if (m->revision == revision) {
203 if (try_module_get(m->me)) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800204 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800205 return m;
206 }
207 } else
208 err = -EPROTOTYPE; /* Found something. */
209 }
210 }
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800211 mutex_unlock(&xt[af].mutex);
Jan Engelhardt55b69e92008-10-08 11:35:01 +0200212
213 if (af != NFPROTO_UNSPEC)
214 /* Try searching again in the family-independent list */
215 return xt_find_match(NFPROTO_UNSPEC, name, revision);
216
Harald Welte2e4e6a12006-01-12 13:30:04 -0800217 return ERR_PTR(err);
218}
219EXPORT_SYMBOL(xt_find_match);
220
221/* Find target, grabs ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200222struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800223{
224 struct xt_target *t;
225 int err = 0;
226
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800227 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800228 return ERR_PTR(-EINTR);
229
230 list_for_each_entry(t, &xt[af].target, list) {
231 if (strcmp(t->name, name) == 0) {
232 if (t->revision == revision) {
233 if (try_module_get(t->me)) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800234 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800235 return t;
236 }
237 } else
238 err = -EPROTOTYPE; /* Found something. */
239 }
240 }
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800241 mutex_unlock(&xt[af].mutex);
Jan Engelhardt55b69e92008-10-08 11:35:01 +0200242
243 if (af != NFPROTO_UNSPEC)
244 /* Try searching again in the family-independent list */
245 return xt_find_target(NFPROTO_UNSPEC, name, revision);
246
Harald Welte2e4e6a12006-01-12 13:30:04 -0800247 return ERR_PTR(err);
248}
249EXPORT_SYMBOL(xt_find_target);
250
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200251struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800252{
253 struct xt_target *target;
254
255 target = try_then_request_module(xt_find_target(af, name, revision),
Patrick McHardy37f9f732006-03-20 17:59:06 -0800256 "%st_%s", xt_prefix[af], name);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800257 if (IS_ERR(target) || !target)
258 return NULL;
259 return target;
260}
261EXPORT_SYMBOL_GPL(xt_request_find_target);
262
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200263static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800264{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200265 const struct xt_match *m;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800266 int have_rev = 0;
267
268 list_for_each_entry(m, &xt[af].match, list) {
269 if (strcmp(m->name, name) == 0) {
270 if (m->revision > *bestp)
271 *bestp = m->revision;
272 if (m->revision == revision)
273 have_rev = 1;
274 }
275 }
276 return have_rev;
277}
278
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200279static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800280{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200281 const struct xt_target *t;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800282 int have_rev = 0;
283
284 list_for_each_entry(t, &xt[af].target, list) {
285 if (strcmp(t->name, name) == 0) {
286 if (t->revision > *bestp)
287 *bestp = t->revision;
288 if (t->revision == revision)
289 have_rev = 1;
290 }
291 }
292 return have_rev;
293}
294
295/* Returns true or false (if no such extension at all) */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200296int xt_find_revision(u8 af, const char *name, u8 revision, int target,
Harald Welte2e4e6a12006-01-12 13:30:04 -0800297 int *err)
298{
299 int have_rev, best = -1;
300
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800301 if (mutex_lock_interruptible(&xt[af].mutex) != 0) {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800302 *err = -EINTR;
303 return 1;
304 }
305 if (target == 1)
306 have_rev = target_revfn(af, name, revision, &best);
307 else
308 have_rev = match_revfn(af, name, revision, &best);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800309 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800310
311 /* Nothing at all? Return 0 to try loading module. */
312 if (best == -1) {
313 *err = -ENOENT;
314 return 0;
315 }
316
317 *err = best;
318 if (!have_rev)
319 *err = -EPROTONOSUPPORT;
320 return 1;
321}
322EXPORT_SYMBOL_GPL(xt_find_revision);
323
Jan Engelhardt916a9172008-10-08 11:35:20 +0200324int xt_check_match(struct xt_mtchk_param *par,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200325 unsigned int size, u_int8_t proto, bool inv_proto)
Patrick McHardy37f9f732006-03-20 17:59:06 -0800326{
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200327 if (XT_ALIGN(par->match->matchsize) != size &&
328 par->match->matchsize != -1) {
Jan Engelhardt043ef462008-10-08 11:35:15 +0200329 /*
330 * ebt_among is exempt from centralized matchsize checking
331 * because it uses a dynamic-size data set.
332 */
Patrick McHardy37f9f732006-03-20 17:59:06 -0800333 printk("%s_tables: %s match: invalid size %Zu != %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200334 xt_prefix[par->family], par->match->name,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200335 XT_ALIGN(par->match->matchsize), size);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800336 return -EINVAL;
337 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200338 if (par->match->table != NULL &&
339 strcmp(par->match->table, par->table) != 0) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800340 printk("%s_tables: %s match: only valid in %s table, not %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200341 xt_prefix[par->family], par->match->name,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200342 par->match->table, par->table);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800343 return -EINVAL;
344 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200345 if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
Jan Engelhardt102befa2008-10-08 11:35:15 +0200346 printk("%s_tables: %s match: bad hook_mask %#x/%#x\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200347 xt_prefix[par->family], par->match->name,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200348 par->hook_mask, par->match->hooks);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800349 return -EINVAL;
350 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200351 if (par->match->proto && (par->match->proto != proto || inv_proto)) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800352 printk("%s_tables: %s match: only valid for protocol %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200353 xt_prefix[par->family], par->match->name,
354 par->match->proto);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800355 return -EINVAL;
356 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200357 if (par->match->checkentry != NULL && !par->match->checkentry(par))
Jan Engelhardt367c6792008-10-08 11:35:17 +0200358 return -EINVAL;
Patrick McHardy37f9f732006-03-20 17:59:06 -0800359 return 0;
360}
361EXPORT_SYMBOL_GPL(xt_check_match);
362
Dmitry Mishin27229712006-04-01 02:25:19 -0800363#ifdef CONFIG_COMPAT
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200364int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800365{
366 struct compat_delta *tmp;
367
368 tmp = kmalloc(sizeof(struct compat_delta), GFP_KERNEL);
369 if (!tmp)
370 return -ENOMEM;
371
372 tmp->offset = offset;
373 tmp->delta = delta;
374
375 if (xt[af].compat_offsets) {
376 tmp->next = xt[af].compat_offsets->next;
377 xt[af].compat_offsets->next = tmp;
378 } else {
379 xt[af].compat_offsets = tmp;
380 tmp->next = NULL;
381 }
382 return 0;
383}
384EXPORT_SYMBOL_GPL(xt_compat_add_offset);
385
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200386void xt_compat_flush_offsets(u_int8_t af)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800387{
388 struct compat_delta *tmp, *next;
389
390 if (xt[af].compat_offsets) {
391 for (tmp = xt[af].compat_offsets; tmp; tmp = next) {
392 next = tmp->next;
393 kfree(tmp);
394 }
395 xt[af].compat_offsets = NULL;
396 }
397}
398EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
399
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200400short xt_compat_calc_jump(u_int8_t af, unsigned int offset)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800401{
402 struct compat_delta *tmp;
403 short delta;
404
405 for (tmp = xt[af].compat_offsets, delta = 0; tmp; tmp = tmp->next)
406 if (tmp->offset < offset)
407 delta += tmp->delta;
408 return delta;
409}
410EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
411
Jan Engelhardt5452e422008-04-14 11:15:35 +0200412int xt_compat_match_offset(const struct xt_match *match)
Dmitry Mishin27229712006-04-01 02:25:19 -0800413{
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700414 u_int16_t csize = match->compatsize ? : match->matchsize;
415 return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize);
Dmitry Mishin27229712006-04-01 02:25:19 -0800416}
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700417EXPORT_SYMBOL_GPL(xt_compat_match_offset);
418
Patrick McHardy89566952007-12-17 21:46:40 -0800419int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800420 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700421{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200422 const struct xt_match *match = m->u.kernel.match;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700423 struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
424 int pad, off = xt_compat_match_offset(match);
425 u_int16_t msize = cm->u.user.match_size;
426
427 m = *dstptr;
428 memcpy(m, cm, sizeof(*cm));
429 if (match->compat_from_user)
430 match->compat_from_user(m->data, cm->data);
431 else
432 memcpy(m->data, cm->data, msize - sizeof(*cm));
433 pad = XT_ALIGN(match->matchsize) - match->matchsize;
434 if (pad > 0)
435 memset(m->data + match->matchsize, 0, pad);
436
437 msize += off;
438 m->u.user.match_size = msize;
439
440 *size += off;
441 *dstptr += msize;
Patrick McHardy89566952007-12-17 21:46:40 -0800442 return 0;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700443}
444EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
445
446int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800447 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700448{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200449 const struct xt_match *match = m->u.kernel.match;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700450 struct compat_xt_entry_match __user *cm = *dstptr;
451 int off = xt_compat_match_offset(match);
452 u_int16_t msize = m->u.user.match_size - off;
453
454 if (copy_to_user(cm, m, sizeof(*cm)) ||
Patrick McHardya18aa312007-12-12 10:35:16 -0800455 put_user(msize, &cm->u.user.match_size) ||
456 copy_to_user(cm->u.user.name, m->u.kernel.match->name,
457 strlen(m->u.kernel.match->name) + 1))
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800458 return -EFAULT;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700459
460 if (match->compat_to_user) {
461 if (match->compat_to_user((void __user *)cm->data, m->data))
462 return -EFAULT;
463 } else {
464 if (copy_to_user(cm->data, m->data, msize - sizeof(*cm)))
465 return -EFAULT;
466 }
467
468 *size -= off;
469 *dstptr += msize;
470 return 0;
471}
472EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
473#endif /* CONFIG_COMPAT */
Dmitry Mishin27229712006-04-01 02:25:19 -0800474
Jan Engelhardt916a9172008-10-08 11:35:20 +0200475int xt_check_target(struct xt_tgchk_param *par,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200476 unsigned int size, u_int8_t proto, bool inv_proto)
Patrick McHardy37f9f732006-03-20 17:59:06 -0800477{
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200478 if (XT_ALIGN(par->target->targetsize) != size) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800479 printk("%s_tables: %s target: invalid size %Zu != %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200480 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200481 XT_ALIGN(par->target->targetsize), size);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800482 return -EINVAL;
483 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200484 if (par->target->table != NULL &&
485 strcmp(par->target->table, par->table) != 0) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800486 printk("%s_tables: %s target: only valid in %s table, not %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200487 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200488 par->target->table, par->table);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800489 return -EINVAL;
490 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200491 if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
Jan Engelhardt102befa2008-10-08 11:35:15 +0200492 printk("%s_tables: %s target: bad hook_mask %#x/%#x\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200493 xt_prefix[par->family], par->target->name,
494 par->hook_mask, par->target->hooks);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800495 return -EINVAL;
496 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200497 if (par->target->proto && (par->target->proto != proto || inv_proto)) {
Patrick McHardy37f9f732006-03-20 17:59:06 -0800498 printk("%s_tables: %s target: only valid for protocol %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200499 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200500 par->target->proto);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800501 return -EINVAL;
502 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200503 if (par->target->checkentry != NULL && !par->target->checkentry(par))
Jan Engelhardt367c6792008-10-08 11:35:17 +0200504 return -EINVAL;
Patrick McHardy37f9f732006-03-20 17:59:06 -0800505 return 0;
506}
507EXPORT_SYMBOL_GPL(xt_check_target);
508
Dmitry Mishin27229712006-04-01 02:25:19 -0800509#ifdef CONFIG_COMPAT
Jan Engelhardt5452e422008-04-14 11:15:35 +0200510int xt_compat_target_offset(const struct xt_target *target)
Dmitry Mishin27229712006-04-01 02:25:19 -0800511{
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700512 u_int16_t csize = target->compatsize ? : target->targetsize;
513 return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize);
Dmitry Mishin27229712006-04-01 02:25:19 -0800514}
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700515EXPORT_SYMBOL_GPL(xt_compat_target_offset);
516
517void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800518 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700519{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200520 const struct xt_target *target = t->u.kernel.target;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700521 struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
522 int pad, off = xt_compat_target_offset(target);
523 u_int16_t tsize = ct->u.user.target_size;
524
525 t = *dstptr;
526 memcpy(t, ct, sizeof(*ct));
527 if (target->compat_from_user)
528 target->compat_from_user(t->data, ct->data);
529 else
530 memcpy(t->data, ct->data, tsize - sizeof(*ct));
531 pad = XT_ALIGN(target->targetsize) - target->targetsize;
532 if (pad > 0)
533 memset(t->data + target->targetsize, 0, pad);
534
535 tsize += off;
536 t->u.user.target_size = tsize;
537
538 *size += off;
539 *dstptr += tsize;
540}
541EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
542
543int xt_compat_target_to_user(struct xt_entry_target *t, void __user **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800544 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700545{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200546 const struct xt_target *target = t->u.kernel.target;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700547 struct compat_xt_entry_target __user *ct = *dstptr;
548 int off = xt_compat_target_offset(target);
549 u_int16_t tsize = t->u.user.target_size - off;
550
551 if (copy_to_user(ct, t, sizeof(*ct)) ||
Patrick McHardya18aa312007-12-12 10:35:16 -0800552 put_user(tsize, &ct->u.user.target_size) ||
553 copy_to_user(ct->u.user.name, t->u.kernel.target->name,
554 strlen(t->u.kernel.target->name) + 1))
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800555 return -EFAULT;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700556
557 if (target->compat_to_user) {
558 if (target->compat_to_user((void __user *)ct->data, t->data))
559 return -EFAULT;
560 } else {
561 if (copy_to_user(ct->data, t->data, tsize - sizeof(*ct)))
562 return -EFAULT;
563 }
564
565 *size -= off;
566 *dstptr += tsize;
567 return 0;
568}
569EXPORT_SYMBOL_GPL(xt_compat_target_to_user);
Dmitry Mishin27229712006-04-01 02:25:19 -0800570#endif
571
Harald Welte2e4e6a12006-01-12 13:30:04 -0800572struct xt_table_info *xt_alloc_table_info(unsigned int size)
573{
574 struct xt_table_info *newinfo;
575 int cpu;
576
577 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
578 if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > num_physpages)
579 return NULL;
580
Eric Dumazet259d4e42007-12-04 23:24:56 -0800581 newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800582 if (!newinfo)
583 return NULL;
584
585 newinfo->size = size;
586
KAMEZAWA Hiroyuki6f912042006-04-10 22:52:50 -0700587 for_each_possible_cpu(cpu) {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800588 if (size <= PAGE_SIZE)
589 newinfo->entries[cpu] = kmalloc_node(size,
590 GFP_KERNEL,
591 cpu_to_node(cpu));
592 else
593 newinfo->entries[cpu] = vmalloc_node(size,
594 cpu_to_node(cpu));
595
596 if (newinfo->entries[cpu] == NULL) {
597 xt_free_table_info(newinfo);
598 return NULL;
599 }
600 }
601
602 return newinfo;
603}
604EXPORT_SYMBOL(xt_alloc_table_info);
605
606void xt_free_table_info(struct xt_table_info *info)
607{
608 int cpu;
609
KAMEZAWA Hiroyuki6f912042006-04-10 22:52:50 -0700610 for_each_possible_cpu(cpu) {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800611 if (info->size <= PAGE_SIZE)
612 kfree(info->entries[cpu]);
613 else
614 vfree(info->entries[cpu]);
615 }
616 kfree(info);
617}
618EXPORT_SYMBOL(xt_free_table_info);
619
620/* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200621struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
622 const char *name)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800623{
624 struct xt_table *t;
625
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800626 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800627 return ERR_PTR(-EINTR);
628
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800629 list_for_each_entry(t, &net->xt.tables[af], list)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800630 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
631 return t;
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800632 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800633 return NULL;
634}
635EXPORT_SYMBOL_GPL(xt_find_table_lock);
636
637void xt_table_unlock(struct xt_table *table)
638{
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800639 mutex_unlock(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800640}
641EXPORT_SYMBOL_GPL(xt_table_unlock);
642
Dmitry Mishin27229712006-04-01 02:25:19 -0800643#ifdef CONFIG_COMPAT
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200644void xt_compat_lock(u_int8_t af)
Dmitry Mishin27229712006-04-01 02:25:19 -0800645{
646 mutex_lock(&xt[af].compat_mutex);
647}
648EXPORT_SYMBOL_GPL(xt_compat_lock);
649
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200650void xt_compat_unlock(u_int8_t af)
Dmitry Mishin27229712006-04-01 02:25:19 -0800651{
652 mutex_unlock(&xt[af].compat_mutex);
653}
654EXPORT_SYMBOL_GPL(xt_compat_unlock);
655#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -0800656
657struct xt_table_info *
658xt_replace_table(struct xt_table *table,
659 unsigned int num_counters,
660 struct xt_table_info *newinfo,
661 int *error)
662{
663 struct xt_table_info *oldinfo, *private;
664
665 /* Do the substitution. */
666 write_lock_bh(&table->lock);
667 private = table->private;
668 /* Check inside lock: is the old number correct? */
669 if (num_counters != private->number) {
670 duprintf("num_counters != table->private->number (%u/%u)\n",
671 num_counters, private->number);
672 write_unlock_bh(&table->lock);
673 *error = -EAGAIN;
674 return NULL;
675 }
676 oldinfo = private;
677 table->private = newinfo;
678 newinfo->initial_entries = oldinfo->initial_entries;
679 write_unlock_bh(&table->lock);
680
681 return oldinfo;
682}
683EXPORT_SYMBOL_GPL(xt_replace_table);
684
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800685struct xt_table *xt_register_table(struct net *net, struct xt_table *table,
Alexey Dobriyana98da112008-01-31 04:01:49 -0800686 struct xt_table_info *bootstrap,
687 struct xt_table_info *newinfo)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800688{
689 int ret;
690 struct xt_table_info *private;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700691 struct xt_table *t;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800692
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800693 /* Don't add one object to multiple lists. */
694 table = kmemdup(table, sizeof(struct xt_table), GFP_KERNEL);
695 if (!table) {
696 ret = -ENOMEM;
697 goto out;
698 }
699
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800700 ret = mutex_lock_interruptible(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800701 if (ret != 0)
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800702 goto out_free;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800703
704 /* Don't autoload: we'd eat our tail... */
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800705 list_for_each_entry(t, &net->xt.tables[table->af], list) {
Patrick McHardydf0933d2006-09-20 11:57:53 -0700706 if (strcmp(t->name, table->name) == 0) {
707 ret = -EEXIST;
708 goto unlock;
709 }
Harald Welte2e4e6a12006-01-12 13:30:04 -0800710 }
711
712 /* Simplifies replace_table code. */
713 table->private = bootstrap;
Dmitry Mishin91536b72006-04-24 17:18:25 -0700714 rwlock_init(&table->lock);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800715 if (!xt_replace_table(table, 0, newinfo, &ret))
716 goto unlock;
717
718 private = table->private;
719 duprintf("table->private->number = %u\n", private->number);
720
721 /* save number of initial entries */
722 private->initial_entries = private->number;
723
Alexey Dobriyan8d870052008-01-31 04:02:13 -0800724 list_add(&table->list, &net->xt.tables[table->af]);
Alexey Dobriyana98da112008-01-31 04:01:49 -0800725 mutex_unlock(&xt[table->af].mutex);
726 return table;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800727
Harald Welte2e4e6a12006-01-12 13:30:04 -0800728 unlock:
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800729 mutex_unlock(&xt[table->af].mutex);
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800730out_free:
731 kfree(table);
Alexey Dobriyana98da112008-01-31 04:01:49 -0800732out:
733 return ERR_PTR(ret);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800734}
735EXPORT_SYMBOL_GPL(xt_register_table);
736
737void *xt_unregister_table(struct xt_table *table)
738{
739 struct xt_table_info *private;
740
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800741 mutex_lock(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800742 private = table->private;
Patrick McHardydf0933d2006-09-20 11:57:53 -0700743 list_del(&table->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800744 mutex_unlock(&xt[table->af].mutex);
Alexey Dobriyan44d34e72008-01-31 04:02:44 -0800745 kfree(table);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800746
747 return private;
748}
749EXPORT_SYMBOL_GPL(xt_unregister_table);
750
751#ifdef CONFIG_PROC_FS
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800752struct xt_names_priv {
753 struct seq_net_private p;
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200754 u_int8_t af;
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800755};
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800756static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800757{
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800758 struct xt_names_priv *priv = seq->private;
YOSHIFUJI Hideaki12188542008-03-26 02:36:06 +0900759 struct net *net = seq_file_net(seq);
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200760 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800761
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800762 mutex_lock(&xt[af].mutex);
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800763 return seq_list_start(&net->xt.tables[af], *pos);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800764}
765
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800766static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800767{
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800768 struct xt_names_priv *priv = seq->private;
YOSHIFUJI Hideaki12188542008-03-26 02:36:06 +0900769 struct net *net = seq_file_net(seq);
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200770 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800771
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800772 return seq_list_next(v, &net->xt.tables[af], pos);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800773}
774
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800775static void xt_table_seq_stop(struct seq_file *seq, void *v)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800776{
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800777 struct xt_names_priv *priv = seq->private;
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200778 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800779
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800780 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800781}
782
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800783static int xt_table_seq_show(struct seq_file *seq, void *v)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800784{
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800785 struct xt_table *table = list_entry(v, struct xt_table, list);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800786
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800787 if (strlen(table->name))
788 return seq_printf(seq, "%s\n", table->name);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800789 else
790 return 0;
791}
792
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800793static const struct seq_operations xt_table_seq_ops = {
794 .start = xt_table_seq_start,
795 .next = xt_table_seq_next,
796 .stop = xt_table_seq_stop,
797 .show = xt_table_seq_show,
Harald Welte2e4e6a12006-01-12 13:30:04 -0800798};
799
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800800static int xt_table_open(struct inode *inode, struct file *file)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800801{
802 int ret;
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800803 struct xt_names_priv *priv;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800804
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800805 ret = seq_open_net(inode, file, &xt_table_seq_ops,
806 sizeof(struct xt_names_priv));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800807 if (!ret) {
Alexey Dobriyan715cf352008-01-31 04:49:16 -0800808 priv = ((struct seq_file *)file->private_data)->private;
809 priv->af = (unsigned long)PDE(inode)->data;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800810 }
Harald Welte2e4e6a12006-01-12 13:30:04 -0800811 return ret;
812}
813
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800814static const struct file_operations xt_table_ops = {
Harald Welte2e4e6a12006-01-12 13:30:04 -0800815 .owner = THIS_MODULE,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800816 .open = xt_table_open,
817 .read = seq_read,
818 .llseek = seq_lseek,
Pavel Emelyanov0e93bb942008-04-29 03:15:35 -0700819 .release = seq_release_net,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -0800820};
821
822static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
823{
824 struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
825 u_int16_t af = (unsigned long)pde->data;
826
827 mutex_lock(&xt[af].mutex);
828 return seq_list_start(&xt[af].match, *pos);
829}
830
831static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *pos)
832{
833 struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
834 u_int16_t af = (unsigned long)pde->data;
835
836 return seq_list_next(v, &xt[af].match, pos);
837}
838
839static void xt_match_seq_stop(struct seq_file *seq, void *v)
840{
841 struct proc_dir_entry *pde = seq->private;
842 u_int16_t af = (unsigned long)pde->data;
843
844 mutex_unlock(&xt[af].mutex);
845}
846
847static int xt_match_seq_show(struct seq_file *seq, void *v)
848{
849 struct xt_match *match = list_entry(v, struct xt_match, list);
850
851 if (strlen(match->name))
852 return seq_printf(seq, "%s\n", match->name);
853 else
854 return 0;
855}
856
857static const struct seq_operations xt_match_seq_ops = {
858 .start = xt_match_seq_start,
859 .next = xt_match_seq_next,
860 .stop = xt_match_seq_stop,
861 .show = xt_match_seq_show,
862};
863
864static int xt_match_open(struct inode *inode, struct file *file)
865{
866 int ret;
867
868 ret = seq_open(file, &xt_match_seq_ops);
869 if (!ret) {
870 struct seq_file *seq = file->private_data;
871
872 seq->private = PDE(inode);
873 }
874 return ret;
875}
876
877static const struct file_operations xt_match_ops = {
878 .owner = THIS_MODULE,
879 .open = xt_match_open,
880 .read = seq_read,
881 .llseek = seq_lseek,
882 .release = seq_release,
883};
884
885static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
886{
887 struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
888 u_int16_t af = (unsigned long)pde->data;
889
890 mutex_lock(&xt[af].mutex);
891 return seq_list_start(&xt[af].target, *pos);
892}
893
894static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *pos)
895{
896 struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
897 u_int16_t af = (unsigned long)pde->data;
898
899 return seq_list_next(v, &xt[af].target, pos);
900}
901
902static void xt_target_seq_stop(struct seq_file *seq, void *v)
903{
904 struct proc_dir_entry *pde = seq->private;
905 u_int16_t af = (unsigned long)pde->data;
906
907 mutex_unlock(&xt[af].mutex);
908}
909
910static int xt_target_seq_show(struct seq_file *seq, void *v)
911{
912 struct xt_target *target = list_entry(v, struct xt_target, list);
913
914 if (strlen(target->name))
915 return seq_printf(seq, "%s\n", target->name);
916 else
917 return 0;
918}
919
920static const struct seq_operations xt_target_seq_ops = {
921 .start = xt_target_seq_start,
922 .next = xt_target_seq_next,
923 .stop = xt_target_seq_stop,
924 .show = xt_target_seq_show,
925};
926
927static int xt_target_open(struct inode *inode, struct file *file)
928{
929 int ret;
930
931 ret = seq_open(file, &xt_target_seq_ops);
932 if (!ret) {
933 struct seq_file *seq = file->private_data;
934
935 seq->private = PDE(inode);
936 }
937 return ret;
938}
939
940static const struct file_operations xt_target_ops = {
941 .owner = THIS_MODULE,
942 .open = xt_target_open,
Harald Welte2e4e6a12006-01-12 13:30:04 -0800943 .read = seq_read,
944 .llseek = seq_lseek,
945 .release = seq_release,
946};
947
948#define FORMAT_TABLES "_tables_names"
949#define FORMAT_MATCHES "_tables_matches"
950#define FORMAT_TARGETS "_tables_targets"
951
952#endif /* CONFIG_PROC_FS */
953
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200954int xt_proto_init(struct net *net, u_int8_t af)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800955{
956#ifdef CONFIG_PROC_FS
957 char buf[XT_FUNCTION_MAXNAMELEN];
958 struct proc_dir_entry *proc;
959#endif
960
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +0200961 if (af >= ARRAY_SIZE(xt_prefix))
Harald Welte2e4e6a12006-01-12 13:30:04 -0800962 return -EINVAL;
963
964
965#ifdef CONFIG_PROC_FS
Tobias Klauserce18afe2007-03-14 16:36:16 -0700966 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800967 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -0700968 proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops,
969 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800970 if (!proc)
971 goto out;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800972
Tobias Klauserce18afe2007-03-14 16:36:16 -0700973 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800974 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -0700975 proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops,
976 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800977 if (!proc)
978 goto out_remove_tables;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800979
Tobias Klauserce18afe2007-03-14 16:36:16 -0700980 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800981 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -0700982 proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops,
983 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800984 if (!proc)
985 goto out_remove_matches;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800986#endif
987
988 return 0;
989
990#ifdef CONFIG_PROC_FS
991out_remove_matches:
Tobias Klauserce18afe2007-03-14 16:36:16 -0700992 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800993 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -0800994 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800995
996out_remove_tables:
Tobias Klauserce18afe2007-03-14 16:36:16 -0700997 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800998 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -0800999 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001000out:
1001 return -1;
1002#endif
1003}
1004EXPORT_SYMBOL_GPL(xt_proto_init);
1005
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001006void xt_proto_fini(struct net *net, u_int8_t af)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001007{
1008#ifdef CONFIG_PROC_FS
1009 char buf[XT_FUNCTION_MAXNAMELEN];
1010
Tobias Klauserce18afe2007-03-14 16:36:16 -07001011 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001012 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001013 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001014
Tobias Klauserce18afe2007-03-14 16:36:16 -07001015 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001016 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001017 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001018
Tobias Klauserce18afe2007-03-14 16:36:16 -07001019 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001020 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Alexey Dobriyan3cb609d2008-01-31 04:49:35 -08001021 proc_net_remove(net, buf);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001022#endif /*CONFIG_PROC_FS*/
1023}
1024EXPORT_SYMBOL_GPL(xt_proto_fini);
1025
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001026static int __net_init xt_net_init(struct net *net)
1027{
1028 int i;
1029
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001030 for (i = 0; i < NFPROTO_NUMPROTO; i++)
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001031 INIT_LIST_HEAD(&net->xt.tables[i]);
1032 return 0;
1033}
1034
1035static struct pernet_operations xt_net_ops = {
1036 .init = xt_net_init,
1037};
Harald Welte2e4e6a12006-01-12 13:30:04 -08001038
1039static int __init xt_init(void)
1040{
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001041 int i, rv;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001042
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001043 xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001044 if (!xt)
1045 return -ENOMEM;
1046
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001047 for (i = 0; i < NFPROTO_NUMPROTO; i++) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001048 mutex_init(&xt[i].mutex);
Dmitry Mishin27229712006-04-01 02:25:19 -08001049#ifdef CONFIG_COMPAT
1050 mutex_init(&xt[i].compat_mutex);
Patrick McHardyb386d9f2007-12-17 21:47:48 -08001051 xt[i].compat_offsets = NULL;
Dmitry Mishin27229712006-04-01 02:25:19 -08001052#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -08001053 INIT_LIST_HEAD(&xt[i].target);
1054 INIT_LIST_HEAD(&xt[i].match);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001055 }
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001056 rv = register_pernet_subsys(&xt_net_ops);
1057 if (rv < 0)
1058 kfree(xt);
1059 return rv;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001060}
1061
1062static void __exit xt_fini(void)
1063{
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001064 unregister_pernet_subsys(&xt_net_ops);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001065 kfree(xt);
1066}
1067
1068module_init(xt_init);
1069module_exit(xt_fini);
1070