blob: 2f685ee1f9c87dc6cee3b1c333e7d62ad36de806 [file] [log] [blame]
Harald Welte2e4e6a12006-01-12 13:30:04 -08001/*
2 * x_tables core - Backend for {ip,ip6,arp}_tables
3 *
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
Patrick McHardyf229f6c2013-04-06 15:24:29 +02005 * Copyright (C) 2006-2012 Patrick McHardy <kaber@trash.net>
Harald Welte2e4e6a12006-01-12 13:30:04 -08006 *
7 * Based on existing ip_tables code which is
8 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
9 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License version 2 as
13 * published by the Free Software Foundation.
14 *
15 */
Jan Engelhardtbe91fd52010-03-18 02:22:32 +010016#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
Harald Welte2e4e6a12006-01-12 13:30:04 -080017#include <linux/kernel.h>
Paul Gortmaker3a9a2312011-05-27 09:12:25 -040018#include <linux/module.h>
Harald Welte2e4e6a12006-01-12 13:30:04 -080019#include <linux/socket.h>
20#include <linux/net.h>
21#include <linux/proc_fs.h>
22#include <linux/seq_file.h>
23#include <linux/string.h>
24#include <linux/vmalloc.h>
Ingo Molnar9e19bb62006-03-25 01:41:10 -080025#include <linux/mutex.h>
Al Virod7fe0f22006-12-03 23:15:30 -050026#include <linux/mm.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090027#include <linux/slab.h>
Thomas Graffbabf312011-01-16 18:12:59 +010028#include <linux/audit.h>
Philip Whinerayf13f2ae2015-11-22 11:35:07 +000029#include <linux/user_namespace.h>
Eric W. Biederman457c4cb2007-09-12 12:01:34 +020030#include <net/net_namespace.h>
Harald Welte2e4e6a12006-01-12 13:30:04 -080031
32#include <linux/netfilter/x_tables.h>
33#include <linux/netfilter_arp.h>
Jan Engelhardte3eaa992009-06-17 22:14:54 +020034#include <linux/netfilter_ipv4/ip_tables.h>
35#include <linux/netfilter_ipv6/ip6_tables.h>
36#include <linux/netfilter_arp/arp_tables.h>
Ingo Molnar9e19bb62006-03-25 01:41:10 -080037
Harald Welte2e4e6a12006-01-12 13:30:04 -080038MODULE_LICENSE("GPL");
39MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
Jan Engelhardt043ef462008-10-08 11:35:15 +020040MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
Harald Welte2e4e6a12006-01-12 13:30:04 -080041
Florian Westphalae0ac0e2016-11-22 14:44:19 +010042#define XT_PCPU_BLOCK_SIZE 4096
Harald Welte2e4e6a12006-01-12 13:30:04 -080043
Patrick McHardyb386d9f2007-12-17 21:47:48 -080044struct compat_delta {
Eric Dumazet255d0dc2010-12-18 18:35:15 +010045 unsigned int offset; /* offset in kernel */
46 int delta; /* delta in 32bit user land */
Patrick McHardyb386d9f2007-12-17 21:47:48 -080047};
48
Harald Welte2e4e6a12006-01-12 13:30:04 -080049struct xt_af {
Ingo Molnar9e19bb62006-03-25 01:41:10 -080050 struct mutex mutex;
Harald Welte2e4e6a12006-01-12 13:30:04 -080051 struct list_head match;
52 struct list_head target;
Patrick McHardyb386d9f2007-12-17 21:47:48 -080053#ifdef CONFIG_COMPAT
Dmitry Mishin27229712006-04-01 02:25:19 -080054 struct mutex compat_mutex;
Eric Dumazet255d0dc2010-12-18 18:35:15 +010055 struct compat_delta *compat_tab;
56 unsigned int number; /* number of slots in compat_tab[] */
57 unsigned int cur; /* number of used slots in compat_tab[] */
Patrick McHardyb386d9f2007-12-17 21:47:48 -080058#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -080059};
60
61static struct xt_af *xt;
62
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +020063static const char *const xt_prefix[NFPROTO_NUMPROTO] = {
64 [NFPROTO_UNSPEC] = "x",
65 [NFPROTO_IPV4] = "ip",
66 [NFPROTO_ARP] = "arp",
67 [NFPROTO_BRIDGE] = "eb",
68 [NFPROTO_IPV6] = "ip6",
Patrick McHardy37f9f732006-03-20 17:59:06 -080069};
70
Harald Welte2e4e6a12006-01-12 13:30:04 -080071/* Registration hooks for targets. */
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +020072int xt_register_target(struct xt_target *target)
Harald Welte2e4e6a12006-01-12 13:30:04 -080073{
Jan Engelhardt76108ce2008-10-08 11:35:00 +020074 u_int8_t af = target->family;
Harald Welte2e4e6a12006-01-12 13:30:04 -080075
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +020076 mutex_lock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080077 list_add(&target->list, &xt[af].target);
Ingo Molnar9e19bb62006-03-25 01:41:10 -080078 mutex_unlock(&xt[af].mutex);
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +020079 return 0;
Harald Welte2e4e6a12006-01-12 13:30:04 -080080}
81EXPORT_SYMBOL(xt_register_target);
82
83void
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080084xt_unregister_target(struct xt_target *target)
Harald Welte2e4e6a12006-01-12 13:30:04 -080085{
Jan Engelhardt76108ce2008-10-08 11:35:00 +020086 u_int8_t af = target->family;
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -080087
Ingo Molnar9e19bb62006-03-25 01:41:10 -080088 mutex_lock(&xt[af].mutex);
Patrick McHardydf0933d2006-09-20 11:57:53 -070089 list_del(&target->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -080090 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -080091}
92EXPORT_SYMBOL(xt_unregister_target);
93
94int
Patrick McHardy52d9c422006-08-22 00:33:45 -070095xt_register_targets(struct xt_target *target, unsigned int n)
96{
97 unsigned int i;
98 int err = 0;
99
100 for (i = 0; i < n; i++) {
101 err = xt_register_target(&target[i]);
102 if (err)
103 goto err;
104 }
105 return err;
106
107err:
108 if (i > 0)
109 xt_unregister_targets(target, i);
110 return err;
111}
112EXPORT_SYMBOL(xt_register_targets);
113
114void
115xt_unregister_targets(struct xt_target *target, unsigned int n)
116{
Changli Gaof68c5302010-10-04 22:24:12 +0200117 while (n-- > 0)
118 xt_unregister_target(&target[n]);
Patrick McHardy52d9c422006-08-22 00:33:45 -0700119}
120EXPORT_SYMBOL(xt_unregister_targets);
121
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +0200122int xt_register_match(struct xt_match *match)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800123{
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200124 u_int8_t af = match->family;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800125
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +0200126 mutex_lock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800127 list_add(&match->list, &xt[af].match);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800128 mutex_unlock(&xt[af].mutex);
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +0200129 return 0;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800130}
131EXPORT_SYMBOL(xt_register_match);
132
133void
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800134xt_unregister_match(struct xt_match *match)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800135{
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200136 u_int8_t af = match->family;
Pablo Neira Ayusoa45049c2006-03-22 13:55:40 -0800137
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800138 mutex_lock(&xt[af].mutex);
Patrick McHardydf0933d2006-09-20 11:57:53 -0700139 list_del(&match->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800140 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800141}
142EXPORT_SYMBOL(xt_unregister_match);
143
Patrick McHardy52d9c422006-08-22 00:33:45 -0700144int
145xt_register_matches(struct xt_match *match, unsigned int n)
146{
147 unsigned int i;
148 int err = 0;
149
150 for (i = 0; i < n; i++) {
151 err = xt_register_match(&match[i]);
152 if (err)
153 goto err;
154 }
155 return err;
156
157err:
158 if (i > 0)
159 xt_unregister_matches(match, i);
160 return err;
161}
162EXPORT_SYMBOL(xt_register_matches);
163
164void
165xt_unregister_matches(struct xt_match *match, unsigned int n)
166{
Changli Gaof68c5302010-10-04 22:24:12 +0200167 while (n-- > 0)
168 xt_unregister_match(&match[n]);
Patrick McHardy52d9c422006-08-22 00:33:45 -0700169}
170EXPORT_SYMBOL(xt_unregister_matches);
171
Harald Welte2e4e6a12006-01-12 13:30:04 -0800172
173/*
174 * These are weird, but module loading must not be done with mutex
175 * held (since they will register), and we have to have a single
Stephen Hemmingeradb00ae2011-03-09 14:14:26 +0100176 * function to use.
Harald Welte2e4e6a12006-01-12 13:30:04 -0800177 */
178
179/* Find match, grabs ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200180struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800181{
182 struct xt_match *m;
Patrick McHardy42046e22011-03-14 19:11:44 +0100183 int err = -ENOENT;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800184
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +0200185 mutex_lock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800186 list_for_each_entry(m, &xt[af].match, list) {
187 if (strcmp(m->name, name) == 0) {
188 if (m->revision == revision) {
189 if (try_module_get(m->me)) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800190 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800191 return m;
192 }
193 } else
194 err = -EPROTOTYPE; /* Found something. */
195 }
196 }
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800197 mutex_unlock(&xt[af].mutex);
Jan Engelhardt55b69e92008-10-08 11:35:01 +0200198
199 if (af != NFPROTO_UNSPEC)
200 /* Try searching again in the family-independent list */
201 return xt_find_match(NFPROTO_UNSPEC, name, revision);
202
Harald Welte2e4e6a12006-01-12 13:30:04 -0800203 return ERR_PTR(err);
204}
205EXPORT_SYMBOL(xt_find_match);
206
Jan Engelhardtfd0ec0e2009-07-10 19:27:47 +0200207struct xt_match *
208xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision)
209{
210 struct xt_match *match;
211
Eric Dumazetda17c732018-01-24 17:16:09 -0800212 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
213 return ERR_PTR(-EINVAL);
214
Stephen Hemmingeradb00ae2011-03-09 14:14:26 +0100215 match = xt_find_match(nfproto, name, revision);
216 if (IS_ERR(match)) {
217 request_module("%st_%s", xt_prefix[nfproto], name);
218 match = xt_find_match(nfproto, name, revision);
219 }
220
221 return match;
Jan Engelhardtfd0ec0e2009-07-10 19:27:47 +0200222}
223EXPORT_SYMBOL_GPL(xt_request_find_match);
224
Harald Welte2e4e6a12006-01-12 13:30:04 -0800225/* Find target, grabs ref. Returns ERR_PTR() on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200226struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800227{
228 struct xt_target *t;
Patrick McHardy42046e22011-03-14 19:11:44 +0100229 int err = -ENOENT;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800230
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +0200231 mutex_lock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800232 list_for_each_entry(t, &xt[af].target, list) {
233 if (strcmp(t->name, name) == 0) {
234 if (t->revision == revision) {
235 if (try_module_get(t->me)) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800236 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800237 return t;
238 }
239 } else
240 err = -EPROTOTYPE; /* Found something. */
241 }
242 }
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800243 mutex_unlock(&xt[af].mutex);
Jan Engelhardt55b69e92008-10-08 11:35:01 +0200244
245 if (af != NFPROTO_UNSPEC)
246 /* Try searching again in the family-independent list */
247 return xt_find_target(NFPROTO_UNSPEC, name, revision);
248
Harald Welte2e4e6a12006-01-12 13:30:04 -0800249 return ERR_PTR(err);
250}
251EXPORT_SYMBOL(xt_find_target);
252
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200253struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800254{
255 struct xt_target *target;
256
Eric Dumazetda17c732018-01-24 17:16:09 -0800257 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
258 return ERR_PTR(-EINVAL);
259
Stephen Hemmingeradb00ae2011-03-09 14:14:26 +0100260 target = xt_find_target(af, name, revision);
261 if (IS_ERR(target)) {
262 request_module("%st_%s", xt_prefix[af], name);
263 target = xt_find_target(af, name, revision);
264 }
265
266 return target;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800267}
268EXPORT_SYMBOL_GPL(xt_request_find_target);
269
Willem de Bruijnf32815d2017-01-02 17:19:40 -0500270
271static int xt_obj_to_user(u16 __user *psize, u16 size,
272 void __user *pname, const char *name,
273 u8 __user *prev, u8 rev)
274{
275 if (put_user(size, psize))
276 return -EFAULT;
277 if (copy_to_user(pname, name, strlen(name) + 1))
278 return -EFAULT;
279 if (put_user(rev, prev))
280 return -EFAULT;
281
282 return 0;
283}
284
285#define XT_OBJ_TO_USER(U, K, TYPE, C_SIZE) \
286 xt_obj_to_user(&U->u.TYPE##_size, C_SIZE ? : K->u.TYPE##_size, \
287 U->u.user.name, K->u.kernel.TYPE->name, \
288 &U->u.user.revision, K->u.kernel.TYPE->revision)
289
290int xt_data_to_user(void __user *dst, const void *src,
Willem de Bruijn324318f2017-05-09 16:17:37 -0400291 int usersize, int size, int aligned_size)
Willem de Bruijnf32815d2017-01-02 17:19:40 -0500292{
293 usersize = usersize ? : size;
294 if (copy_to_user(dst, src, usersize))
295 return -EFAULT;
Willem de Bruijn324318f2017-05-09 16:17:37 -0400296 if (usersize != aligned_size &&
297 clear_user(dst + usersize, aligned_size - usersize))
Willem de Bruijnf32815d2017-01-02 17:19:40 -0500298 return -EFAULT;
299
300 return 0;
301}
302EXPORT_SYMBOL_GPL(xt_data_to_user);
303
Willem de Bruijn751a9c72017-05-17 11:24:47 -0400304#define XT_DATA_TO_USER(U, K, TYPE) \
Willem de Bruijnf32815d2017-01-02 17:19:40 -0500305 xt_data_to_user(U->data, K->data, \
306 K->u.kernel.TYPE->usersize, \
Willem de Bruijn751a9c72017-05-17 11:24:47 -0400307 K->u.kernel.TYPE->TYPE##size, \
308 XT_ALIGN(K->u.kernel.TYPE->TYPE##size))
Willem de Bruijnf32815d2017-01-02 17:19:40 -0500309
310int xt_match_to_user(const struct xt_entry_match *m,
311 struct xt_entry_match __user *u)
312{
313 return XT_OBJ_TO_USER(u, m, match, 0) ||
Willem de Bruijn751a9c72017-05-17 11:24:47 -0400314 XT_DATA_TO_USER(u, m, match);
Willem de Bruijnf32815d2017-01-02 17:19:40 -0500315}
316EXPORT_SYMBOL_GPL(xt_match_to_user);
317
318int xt_target_to_user(const struct xt_entry_target *t,
319 struct xt_entry_target __user *u)
320{
321 return XT_OBJ_TO_USER(u, t, target, 0) ||
Willem de Bruijn751a9c72017-05-17 11:24:47 -0400322 XT_DATA_TO_USER(u, t, target);
Willem de Bruijnf32815d2017-01-02 17:19:40 -0500323}
324EXPORT_SYMBOL_GPL(xt_target_to_user);
325
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200326static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800327{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200328 const struct xt_match *m;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800329 int have_rev = 0;
330
331 list_for_each_entry(m, &xt[af].match, list) {
332 if (strcmp(m->name, name) == 0) {
333 if (m->revision > *bestp)
334 *bestp = m->revision;
335 if (m->revision == revision)
336 have_rev = 1;
337 }
338 }
Patrick McHardy656caff2009-01-12 00:06:04 +0000339
340 if (af != NFPROTO_UNSPEC && !have_rev)
341 return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
342
Harald Welte2e4e6a12006-01-12 13:30:04 -0800343 return have_rev;
344}
345
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200346static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800347{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200348 const struct xt_target *t;
Harald Welte2e4e6a12006-01-12 13:30:04 -0800349 int have_rev = 0;
350
351 list_for_each_entry(t, &xt[af].target, list) {
352 if (strcmp(t->name, name) == 0) {
353 if (t->revision > *bestp)
354 *bestp = t->revision;
355 if (t->revision == revision)
356 have_rev = 1;
357 }
358 }
Patrick McHardy656caff2009-01-12 00:06:04 +0000359
360 if (af != NFPROTO_UNSPEC && !have_rev)
361 return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
362
Harald Welte2e4e6a12006-01-12 13:30:04 -0800363 return have_rev;
364}
365
366/* Returns true or false (if no such extension at all) */
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200367int xt_find_revision(u8 af, const char *name, u8 revision, int target,
Harald Welte2e4e6a12006-01-12 13:30:04 -0800368 int *err)
369{
370 int have_rev, best = -1;
371
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +0200372 mutex_lock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800373 if (target == 1)
374 have_rev = target_revfn(af, name, revision, &best);
375 else
376 have_rev = match_revfn(af, name, revision, &best);
Ingo Molnar9e19bb62006-03-25 01:41:10 -0800377 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -0800378
379 /* Nothing at all? Return 0 to try loading module. */
380 if (best == -1) {
381 *err = -ENOENT;
382 return 0;
383 }
384
385 *err = best;
386 if (!have_rev)
387 *err = -EPROTONOSUPPORT;
388 return 1;
389}
390EXPORT_SYMBOL_GPL(xt_find_revision);
391
Jan Engelhardt5b76c492013-01-10 12:30:05 +0000392static char *
393textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
Jan Engelhardt45185362009-04-05 10:43:09 +0200394{
Jan Engelhardt5b76c492013-01-10 12:30:05 +0000395 static const char *const inetbr_names[] = {
Jan Engelhardt45185362009-04-05 10:43:09 +0200396 "PREROUTING", "INPUT", "FORWARD",
397 "OUTPUT", "POSTROUTING", "BROUTING",
398 };
Jan Engelhardt5b76c492013-01-10 12:30:05 +0000399 static const char *const arp_names[] = {
400 "INPUT", "FORWARD", "OUTPUT",
401 };
402 const char *const *names;
403 unsigned int i, max;
Jan Engelhardt45185362009-04-05 10:43:09 +0200404 char *p = buf;
405 bool np = false;
406 int res;
407
Jan Engelhardt5b76c492013-01-10 12:30:05 +0000408 names = (nfproto == NFPROTO_ARP) ? arp_names : inetbr_names;
409 max = (nfproto == NFPROTO_ARP) ? ARRAY_SIZE(arp_names) :
410 ARRAY_SIZE(inetbr_names);
Jan Engelhardt45185362009-04-05 10:43:09 +0200411 *p = '\0';
Jan Engelhardt5b76c492013-01-10 12:30:05 +0000412 for (i = 0; i < max; ++i) {
Jan Engelhardt45185362009-04-05 10:43:09 +0200413 if (!(mask & (1 << i)))
414 continue;
415 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);
416 if (res > 0) {
417 size -= res;
418 p += res;
419 }
420 np = true;
421 }
422
423 return buf;
424}
425
Jan Engelhardt916a9172008-10-08 11:35:20 +0200426int xt_check_match(struct xt_mtchk_param *par,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200427 unsigned int size, u_int8_t proto, bool inv_proto)
Patrick McHardy37f9f732006-03-20 17:59:06 -0800428{
Jan Engelhardtbd414ee2010-03-23 16:35:56 +0100429 int ret;
430
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200431 if (XT_ALIGN(par->match->matchsize) != size &&
432 par->match->matchsize != -1) {
Jan Engelhardt043ef462008-10-08 11:35:15 +0200433 /*
434 * ebt_among is exempt from centralized matchsize checking
435 * because it uses a dynamic-size data set.
436 */
Jan Engelhardtb4024052009-06-25 18:32:12 +0200437 pr_err("%s_tables: %s.%u match: invalid size "
438 "%u (kernel) != (user) %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200439 xt_prefix[par->family], par->match->name,
Jan Engelhardtb4024052009-06-25 18:32:12 +0200440 par->match->revision,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200441 XT_ALIGN(par->match->matchsize), size);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800442 return -EINVAL;
443 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200444 if (par->match->table != NULL &&
445 strcmp(par->match->table, par->table) != 0) {
Joe Perches3dd5d7e2009-06-13 12:32:39 +0200446 pr_err("%s_tables: %s match: only valid in %s table, not %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200447 xt_prefix[par->family], par->match->name,
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200448 par->match->table, par->table);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800449 return -EINVAL;
450 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200451 if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
Jan Engelhardt45185362009-04-05 10:43:09 +0200452 char used[64], allow[64];
453
Joe Perches3dd5d7e2009-06-13 12:32:39 +0200454 pr_err("%s_tables: %s match: used from hooks %s, but only "
Jan Engelhardt45185362009-04-05 10:43:09 +0200455 "valid from %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200456 xt_prefix[par->family], par->match->name,
Jan Engelhardt5b76c492013-01-10 12:30:05 +0000457 textify_hooks(used, sizeof(used), par->hook_mask,
458 par->family),
459 textify_hooks(allow, sizeof(allow), par->match->hooks,
460 par->family));
Patrick McHardy37f9f732006-03-20 17:59:06 -0800461 return -EINVAL;
462 }
Jan Engelhardt9b4fce72008-10-08 11:35:18 +0200463 if (par->match->proto && (par->match->proto != proto || inv_proto)) {
Joe Perches3dd5d7e2009-06-13 12:32:39 +0200464 pr_err("%s_tables: %s match: only valid for protocol %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200465 xt_prefix[par->family], par->match->name,
466 par->match->proto);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800467 return -EINVAL;
468 }
Jan Engelhardtbd414ee2010-03-23 16:35:56 +0100469 if (par->match->checkentry != NULL) {
470 ret = par->match->checkentry(par);
471 if (ret < 0)
472 return ret;
473 else if (ret > 0)
474 /* Flag up potential errors. */
475 return -EIO;
476 }
Patrick McHardy37f9f732006-03-20 17:59:06 -0800477 return 0;
478}
479EXPORT_SYMBOL_GPL(xt_check_match);
480
Florian Westphal13631bf2016-04-01 14:17:29 +0200481/** xt_check_entry_match - check that matches end before start of target
482 *
483 * @match: beginning of xt_entry_match
484 * @target: beginning of this rules target (alleged end of matches)
485 * @alignment: alignment requirement of match structures
486 *
487 * Validates that all matches add up to the beginning of the target,
488 * and that each match covers at least the base structure size.
489 *
490 * Return: 0 on success, negative errno on failure.
491 */
492static int xt_check_entry_match(const char *match, const char *target,
493 const size_t alignment)
494{
495 const struct xt_entry_match *pos;
496 int length = target - match;
497
498 if (length == 0) /* no matches */
499 return 0;
500
501 pos = (struct xt_entry_match *)match;
502 do {
503 if ((unsigned long)pos % alignment)
504 return -EINVAL;
505
506 if (length < (int)sizeof(struct xt_entry_match))
507 return -EINVAL;
508
509 if (pos->u.match_size < sizeof(struct xt_entry_match))
510 return -EINVAL;
511
512 if (pos->u.match_size > length)
513 return -EINVAL;
514
515 length -= pos->u.match_size;
516 pos = ((void *)((char *)(pos) + (pos)->u.match_size));
517 } while (length > 0);
518
519 return 0;
520}
521
Dmitry Mishin27229712006-04-01 02:25:19 -0800522#ifdef CONFIG_COMPAT
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100523int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800524{
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100525 struct xt_af *xp = &xt[af];
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800526
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100527 if (!xp->compat_tab) {
528 if (!xp->number)
529 return -EINVAL;
530 xp->compat_tab = vmalloc(sizeof(struct compat_delta) * xp->number);
531 if (!xp->compat_tab)
532 return -ENOMEM;
533 xp->cur = 0;
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800534 }
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100535
536 if (xp->cur >= xp->number)
537 return -EINVAL;
538
539 if (xp->cur)
540 delta += xp->compat_tab[xp->cur - 1].delta;
541 xp->compat_tab[xp->cur].offset = offset;
542 xp->compat_tab[xp->cur].delta = delta;
543 xp->cur++;
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800544 return 0;
545}
546EXPORT_SYMBOL_GPL(xt_compat_add_offset);
547
Jan Engelhardt76108ce2008-10-08 11:35:00 +0200548void xt_compat_flush_offsets(u_int8_t af)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800549{
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100550 if (xt[af].compat_tab) {
551 vfree(xt[af].compat_tab);
552 xt[af].compat_tab = NULL;
553 xt[af].number = 0;
Eric Dumazet5a6351e2011-04-21 10:57:21 +0200554 xt[af].cur = 0;
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800555 }
556}
557EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
558
Florian Westphal3e5e5242010-02-15 18:17:10 +0100559int xt_compat_calc_jump(u_int8_t af, unsigned int offset)
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800560{
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100561 struct compat_delta *tmp = xt[af].compat_tab;
562 int mid, left = 0, right = xt[af].cur - 1;
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800563
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100564 while (left <= right) {
565 mid = (left + right) >> 1;
566 if (offset > tmp[mid].offset)
567 left = mid + 1;
568 else if (offset < tmp[mid].offset)
569 right = mid - 1;
570 else
571 return mid ? tmp[mid - 1].delta : 0;
572 }
Eric Dumazet5a6351e2011-04-21 10:57:21 +0200573 return left ? tmp[left - 1].delta : 0;
Patrick McHardyb386d9f2007-12-17 21:47:48 -0800574}
575EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
576
Eric Dumazet255d0dc2010-12-18 18:35:15 +0100577void xt_compat_init_offsets(u_int8_t af, unsigned int number)
578{
579 xt[af].number = number;
580 xt[af].cur = 0;
581}
582EXPORT_SYMBOL(xt_compat_init_offsets);
583
Jan Engelhardt5452e422008-04-14 11:15:35 +0200584int xt_compat_match_offset(const struct xt_match *match)
Dmitry Mishin27229712006-04-01 02:25:19 -0800585{
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700586 u_int16_t csize = match->compatsize ? : match->matchsize;
587 return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize);
Dmitry Mishin27229712006-04-01 02:25:19 -0800588}
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700589EXPORT_SYMBOL_GPL(xt_compat_match_offset);
590
Florian Westphal01883462016-04-01 14:17:33 +0200591void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
592 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700593{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200594 const struct xt_match *match = m->u.kernel.match;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700595 struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
596 int pad, off = xt_compat_match_offset(match);
597 u_int16_t msize = cm->u.user.match_size;
Florian Westphal09d96862016-04-01 14:17:34 +0200598 char name[sizeof(m->u.user.name)];
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700599
600 m = *dstptr;
601 memcpy(m, cm, sizeof(*cm));
602 if (match->compat_from_user)
603 match->compat_from_user(m->data, cm->data);
604 else
605 memcpy(m->data, cm->data, msize - sizeof(*cm));
606 pad = XT_ALIGN(match->matchsize) - match->matchsize;
607 if (pad > 0)
608 memset(m->data + match->matchsize, 0, pad);
609
610 msize += off;
611 m->u.user.match_size = msize;
Florian Westphal09d96862016-04-01 14:17:34 +0200612 strlcpy(name, match->name, sizeof(name));
613 module_put(match->me);
614 strncpy(m->u.user.name, name, sizeof(m->u.user.name));
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700615
616 *size += off;
617 *dstptr += msize;
618}
619EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
620
Willem de Bruijn751a9c72017-05-17 11:24:47 -0400621#define COMPAT_XT_DATA_TO_USER(U, K, TYPE, C_SIZE) \
622 xt_data_to_user(U->data, K->data, \
623 K->u.kernel.TYPE->usersize, \
624 C_SIZE, \
625 COMPAT_XT_ALIGN(C_SIZE))
626
Jan Engelhardt739674f2009-06-26 08:23:19 +0200627int xt_compat_match_to_user(const struct xt_entry_match *m,
628 void __user **dstptr, unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700629{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200630 const struct xt_match *match = m->u.kernel.match;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700631 struct compat_xt_entry_match __user *cm = *dstptr;
632 int off = xt_compat_match_offset(match);
633 u_int16_t msize = m->u.user.match_size - off;
634
Willem de Bruijn4915f7b2017-01-02 17:19:45 -0500635 if (XT_OBJ_TO_USER(cm, m, match, msize))
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800636 return -EFAULT;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700637
638 if (match->compat_to_user) {
639 if (match->compat_to_user((void __user *)cm->data, m->data))
640 return -EFAULT;
641 } else {
Willem de Bruijn751a9c72017-05-17 11:24:47 -0400642 if (COMPAT_XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700643 return -EFAULT;
644 }
645
646 *size -= off;
647 *dstptr += msize;
648 return 0;
649}
650EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
Florian Westphalfc1221b2016-04-01 14:17:26 +0200651
Florian Westphal7ed2abd2016-04-01 14:17:27 +0200652/* non-compat version may have padding after verdict */
653struct compat_xt_standard_target {
654 struct compat_xt_entry_target t;
655 compat_uint_t verdict;
656};
657
Florian Westphalce683e52016-04-01 14:17:28 +0200658int xt_compat_check_entry_offsets(const void *base, const char *elems,
Florian Westphalfc1221b2016-04-01 14:17:26 +0200659 unsigned int target_offset,
660 unsigned int next_offset)
661{
Florian Westphalce683e52016-04-01 14:17:28 +0200662 long size_of_base_struct = elems - (const char *)base;
Florian Westphalfc1221b2016-04-01 14:17:26 +0200663 const struct compat_xt_entry_target *t;
664 const char *e = base;
665
Florian Westphalce683e52016-04-01 14:17:28 +0200666 if (target_offset < size_of_base_struct)
667 return -EINVAL;
668
Florian Westphalfc1221b2016-04-01 14:17:26 +0200669 if (target_offset + sizeof(*t) > next_offset)
670 return -EINVAL;
671
672 t = (void *)(e + target_offset);
673 if (t->u.target_size < sizeof(*t))
674 return -EINVAL;
675
676 if (target_offset + t->u.target_size > next_offset)
677 return -EINVAL;
678
Florian Westphal7ed2abd2016-04-01 14:17:27 +0200679 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
Florian Westphal7b7eba02016-06-01 02:04:44 +0200680 COMPAT_XT_ALIGN(target_offset + sizeof(struct compat_xt_standard_target)) != next_offset)
Florian Westphal7ed2abd2016-04-01 14:17:27 +0200681 return -EINVAL;
682
Masahiro Yamada550116d2017-02-27 14:28:58 -0800683 /* compat_xt_entry match has less strict alignment requirements,
Florian Westphal13631bf2016-04-01 14:17:29 +0200684 * otherwise they are identical. In case of padding differences
685 * we need to add compat version of xt_check_entry_match.
686 */
687 BUILD_BUG_ON(sizeof(struct compat_xt_entry_match) != sizeof(struct xt_entry_match));
688
689 return xt_check_entry_match(elems, base + target_offset,
690 __alignof__(struct compat_xt_entry_match));
Florian Westphalfc1221b2016-04-01 14:17:26 +0200691}
692EXPORT_SYMBOL(xt_compat_check_entry_offsets);
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700693#endif /* CONFIG_COMPAT */
Dmitry Mishin27229712006-04-01 02:25:19 -0800694
Florian Westphal7d358122016-04-01 14:17:23 +0200695/**
696 * xt_check_entry_offsets - validate arp/ip/ip6t_entry
697 *
698 * @base: pointer to arp/ip/ip6t_entry
Florian Westphalce683e52016-04-01 14:17:28 +0200699 * @elems: pointer to first xt_entry_match, i.e. ip(6)t_entry->elems
Florian Westphal7d358122016-04-01 14:17:23 +0200700 * @target_offset: the arp/ip/ip6_t->target_offset
701 * @next_offset: the arp/ip/ip6_t->next_offset
702 *
Florian Westphal13631bf2016-04-01 14:17:29 +0200703 * validates that target_offset and next_offset are sane and that all
704 * match sizes (if any) align with the target offset.
Florian Westphal7d358122016-04-01 14:17:23 +0200705 *
Florian Westphalce683e52016-04-01 14:17:28 +0200706 * This function does not validate the targets or matches themselves, it
Florian Westphal13631bf2016-04-01 14:17:29 +0200707 * only tests that all the offsets and sizes are correct, that all
708 * match structures are aligned, and that the last structure ends where
709 * the target structure begins.
710 *
711 * Also see xt_compat_check_entry_offsets for CONFIG_COMPAT version.
Florian Westphalce683e52016-04-01 14:17:28 +0200712 *
Florian Westphal7d358122016-04-01 14:17:23 +0200713 * The arp/ip/ip6t_entry structure @base must have passed following tests:
714 * - it must point to a valid memory location
715 * - base to base + next_offset must be accessible, i.e. not exceed allocated
716 * length.
717 *
Florian Westphal13631bf2016-04-01 14:17:29 +0200718 * A well-formed entry looks like this:
719 *
720 * ip(6)t_entry match [mtdata] match [mtdata] target [tgdata] ip(6)t_entry
721 * e->elems[]-----' | |
722 * matchsize | |
723 * matchsize | |
724 * | |
725 * target_offset---------------------------------' |
726 * next_offset---------------------------------------------------'
727 *
728 * elems[]: flexible array member at end of ip(6)/arpt_entry struct.
729 * This is where matches (if any) and the target reside.
730 * target_offset: beginning of target.
731 * next_offset: start of the next rule; also: size of this rule.
732 * Since targets have a minimum size, target_offset + minlen <= next_offset.
733 *
734 * Every match stores its size, sum of sizes must not exceed target_offset.
735 *
Florian Westphal7d358122016-04-01 14:17:23 +0200736 * Return: 0 on success, negative errno on failure.
737 */
738int xt_check_entry_offsets(const void *base,
Florian Westphalce683e52016-04-01 14:17:28 +0200739 const char *elems,
Florian Westphal7d358122016-04-01 14:17:23 +0200740 unsigned int target_offset,
741 unsigned int next_offset)
742{
Florian Westphalce683e52016-04-01 14:17:28 +0200743 long size_of_base_struct = elems - (const char *)base;
Florian Westphal7d358122016-04-01 14:17:23 +0200744 const struct xt_entry_target *t;
745 const char *e = base;
746
Florian Westphalce683e52016-04-01 14:17:28 +0200747 /* target start is within the ip/ip6/arpt_entry struct */
748 if (target_offset < size_of_base_struct)
749 return -EINVAL;
750
Florian Westphal7d358122016-04-01 14:17:23 +0200751 if (target_offset + sizeof(*t) > next_offset)
752 return -EINVAL;
753
754 t = (void *)(e + target_offset);
Florian Westphala08e4e192016-04-01 14:17:25 +0200755 if (t->u.target_size < sizeof(*t))
756 return -EINVAL;
757
Florian Westphal7d358122016-04-01 14:17:23 +0200758 if (target_offset + t->u.target_size > next_offset)
759 return -EINVAL;
760
Florian Westphal7ed2abd2016-04-01 14:17:27 +0200761 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
Florian Westphal7b7eba02016-06-01 02:04:44 +0200762 XT_ALIGN(target_offset + sizeof(struct xt_standard_target)) != next_offset)
Florian Westphal7ed2abd2016-04-01 14:17:27 +0200763 return -EINVAL;
764
Florian Westphal13631bf2016-04-01 14:17:29 +0200765 return xt_check_entry_match(elems, base + target_offset,
766 __alignof__(struct xt_entry_match));
Florian Westphal7d358122016-04-01 14:17:23 +0200767}
768EXPORT_SYMBOL(xt_check_entry_offsets);
769
Florian Westphalf4dc7772016-07-14 17:51:26 +0200770/**
771 * xt_alloc_entry_offsets - allocate array to store rule head offsets
772 *
773 * @size: number of entries
774 *
775 * Return: NULL or kmalloc'd or vmalloc'd array
776 */
777unsigned int *xt_alloc_entry_offsets(unsigned int size)
778{
Michal Hocko752ade62017-05-08 15:57:27 -0700779 return kvmalloc_array(size, sizeof(unsigned int), GFP_KERNEL | __GFP_ZERO);
Florian Westphalf4dc7772016-07-14 17:51:26 +0200780
Florian Westphalf4dc7772016-07-14 17:51:26 +0200781}
782EXPORT_SYMBOL(xt_alloc_entry_offsets);
783
784/**
785 * xt_find_jump_offset - check if target is a valid jump offset
786 *
787 * @offsets: array containing all valid rule start offsets of a rule blob
788 * @target: the jump target to search for
789 * @size: entries in @offset
790 */
791bool xt_find_jump_offset(const unsigned int *offsets,
792 unsigned int target, unsigned int size)
793{
794 int m, low = 0, hi = size;
795
796 while (hi > low) {
797 m = (low + hi) / 2u;
798
799 if (offsets[m] > target)
800 hi = m;
801 else if (offsets[m] < target)
802 low = m + 1;
803 else
804 return true;
805 }
806
807 return false;
808}
809EXPORT_SYMBOL(xt_find_jump_offset);
810
Jan Engelhardt916a9172008-10-08 11:35:20 +0200811int xt_check_target(struct xt_tgchk_param *par,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200812 unsigned int size, u_int8_t proto, bool inv_proto)
Patrick McHardy37f9f732006-03-20 17:59:06 -0800813{
Jan Engelhardtd6b00a52010-03-25 16:34:45 +0100814 int ret;
815
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200816 if (XT_ALIGN(par->target->targetsize) != size) {
Jan Engelhardtb4024052009-06-25 18:32:12 +0200817 pr_err("%s_tables: %s.%u target: invalid size "
818 "%u (kernel) != (user) %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200819 xt_prefix[par->family], par->target->name,
Jan Engelhardtb4024052009-06-25 18:32:12 +0200820 par->target->revision,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200821 XT_ALIGN(par->target->targetsize), size);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800822 return -EINVAL;
823 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200824 if (par->target->table != NULL &&
825 strcmp(par->target->table, par->table) != 0) {
Joe Perches3dd5d7e2009-06-13 12:32:39 +0200826 pr_err("%s_tables: %s target: only valid in %s table, not %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200827 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200828 par->target->table, par->table);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800829 return -EINVAL;
830 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200831 if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
Jan Engelhardt45185362009-04-05 10:43:09 +0200832 char used[64], allow[64];
833
Joe Perches3dd5d7e2009-06-13 12:32:39 +0200834 pr_err("%s_tables: %s target: used from hooks %s, but only "
Jan Engelhardt45185362009-04-05 10:43:09 +0200835 "usable from %s\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200836 xt_prefix[par->family], par->target->name,
Jan Engelhardt5b76c492013-01-10 12:30:05 +0000837 textify_hooks(used, sizeof(used), par->hook_mask,
838 par->family),
839 textify_hooks(allow, sizeof(allow), par->target->hooks,
840 par->family));
Patrick McHardy37f9f732006-03-20 17:59:06 -0800841 return -EINVAL;
842 }
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200843 if (par->target->proto && (par->target->proto != proto || inv_proto)) {
Joe Perches3dd5d7e2009-06-13 12:32:39 +0200844 pr_err("%s_tables: %s target: only valid for protocol %u\n",
Jan Engelhardt916a9172008-10-08 11:35:20 +0200845 xt_prefix[par->family], par->target->name,
Jan Engelhardtaf5d6dc2008-10-08 11:35:19 +0200846 par->target->proto);
Patrick McHardy37f9f732006-03-20 17:59:06 -0800847 return -EINVAL;
848 }
Jan Engelhardtd6b00a52010-03-25 16:34:45 +0100849 if (par->target->checkentry != NULL) {
850 ret = par->target->checkentry(par);
851 if (ret < 0)
852 return ret;
853 else if (ret > 0)
854 /* Flag up potential errors. */
855 return -EIO;
856 }
Patrick McHardy37f9f732006-03-20 17:59:06 -0800857 return 0;
858}
859EXPORT_SYMBOL_GPL(xt_check_target);
860
Florian Westphald7591f02016-04-01 15:37:59 +0200861/**
862 * xt_copy_counters_from_user - copy counters and metadata from userspace
863 *
864 * @user: src pointer to userspace memory
865 * @len: alleged size of userspace memory
866 * @info: where to store the xt_counters_info metadata
867 * @compat: true if we setsockopt call is done by 32bit task on 64bit kernel
868 *
869 * Copies counter meta data from @user and stores it in @info.
870 *
871 * vmallocs memory to hold the counters, then copies the counter data
872 * from @user to the new memory and returns a pointer to it.
873 *
874 * If @compat is true, @info gets converted automatically to the 64bit
875 * representation.
876 *
877 * The metadata associated with the counters is stored in @info.
878 *
879 * Return: returns pointer that caller has to test via IS_ERR().
880 * If IS_ERR is false, caller has to vfree the pointer.
881 */
882void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
883 struct xt_counters_info *info, bool compat)
884{
885 void *mem;
886 u64 size;
887
888#ifdef CONFIG_COMPAT
889 if (compat) {
890 /* structures only differ in size due to alignment */
891 struct compat_xt_counters_info compat_tmp;
892
893 if (len <= sizeof(compat_tmp))
894 return ERR_PTR(-EINVAL);
895
896 len -= sizeof(compat_tmp);
897 if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0)
898 return ERR_PTR(-EFAULT);
899
Eric Dumazete466af72017-10-05 02:50:07 -0700900 memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
Florian Westphald7591f02016-04-01 15:37:59 +0200901 info->num_counters = compat_tmp.num_counters;
902 user += sizeof(compat_tmp);
903 } else
904#endif
905 {
906 if (len <= sizeof(*info))
907 return ERR_PTR(-EINVAL);
908
909 len -= sizeof(*info);
910 if (copy_from_user(info, user, sizeof(*info)) != 0)
911 return ERR_PTR(-EFAULT);
912
Florian Westphald7591f02016-04-01 15:37:59 +0200913 user += sizeof(*info);
914 }
Eric Dumazete466af72017-10-05 02:50:07 -0700915 info->name[sizeof(info->name) - 1] = '\0';
Florian Westphald7591f02016-04-01 15:37:59 +0200916
917 size = sizeof(struct xt_counters);
918 size *= info->num_counters;
919
920 if (size != (u64)len)
921 return ERR_PTR(-EINVAL);
922
923 mem = vmalloc(len);
924 if (!mem)
925 return ERR_PTR(-ENOMEM);
926
927 if (copy_from_user(mem, user, len) == 0)
928 return mem;
929
930 vfree(mem);
931 return ERR_PTR(-EFAULT);
932}
933EXPORT_SYMBOL_GPL(xt_copy_counters_from_user);
934
Dmitry Mishin27229712006-04-01 02:25:19 -0800935#ifdef CONFIG_COMPAT
Jan Engelhardt5452e422008-04-14 11:15:35 +0200936int xt_compat_target_offset(const struct xt_target *target)
Dmitry Mishin27229712006-04-01 02:25:19 -0800937{
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700938 u_int16_t csize = target->compatsize ? : target->targetsize;
939 return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize);
Dmitry Mishin27229712006-04-01 02:25:19 -0800940}
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700941EXPORT_SYMBOL_GPL(xt_compat_target_offset);
942
943void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
Patrick McHardyb0a63632008-01-31 04:10:18 -0800944 unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700945{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200946 const struct xt_target *target = t->u.kernel.target;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700947 struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
948 int pad, off = xt_compat_target_offset(target);
949 u_int16_t tsize = ct->u.user.target_size;
Florian Westphal09d96862016-04-01 14:17:34 +0200950 char name[sizeof(t->u.user.name)];
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700951
952 t = *dstptr;
953 memcpy(t, ct, sizeof(*ct));
954 if (target->compat_from_user)
955 target->compat_from_user(t->data, ct->data);
956 else
957 memcpy(t->data, ct->data, tsize - sizeof(*ct));
958 pad = XT_ALIGN(target->targetsize) - target->targetsize;
959 if (pad > 0)
960 memset(t->data + target->targetsize, 0, pad);
961
962 tsize += off;
963 t->u.user.target_size = tsize;
Florian Westphal09d96862016-04-01 14:17:34 +0200964 strlcpy(name, target->name, sizeof(name));
965 module_put(target->me);
966 strncpy(t->u.user.name, name, sizeof(t->u.user.name));
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700967
968 *size += off;
969 *dstptr += tsize;
970}
971EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
972
Jan Engelhardt739674f2009-06-26 08:23:19 +0200973int xt_compat_target_to_user(const struct xt_entry_target *t,
974 void __user **dstptr, unsigned int *size)
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700975{
Jan Engelhardt5452e422008-04-14 11:15:35 +0200976 const struct xt_target *target = t->u.kernel.target;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700977 struct compat_xt_entry_target __user *ct = *dstptr;
978 int off = xt_compat_target_offset(target);
979 u_int16_t tsize = t->u.user.target_size - off;
980
Willem de Bruijn4915f7b2017-01-02 17:19:45 -0500981 if (XT_OBJ_TO_USER(ct, t, target, tsize))
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800982 return -EFAULT;
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700983
984 if (target->compat_to_user) {
985 if (target->compat_to_user((void __user *)ct->data, t->data))
986 return -EFAULT;
987 } else {
Willem de Bruijn751a9c72017-05-17 11:24:47 -0400988 if (COMPAT_XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
Patrick McHardy9fa492c2006-09-20 12:05:37 -0700989 return -EFAULT;
990 }
991
992 *size -= off;
993 *dstptr += tsize;
994 return 0;
995}
996EXPORT_SYMBOL_GPL(xt_compat_target_to_user);
Dmitry Mishin27229712006-04-01 02:25:19 -0800997#endif
998
Harald Welte2e4e6a12006-01-12 13:30:04 -0800999struct xt_table_info *xt_alloc_table_info(unsigned int size)
1000{
Eric Dumazet711bdde62015-06-15 09:57:30 -07001001 struct xt_table_info *info = NULL;
1002 size_t sz = sizeof(*info) + size;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001003
Florian Westphald157bd72016-03-10 01:56:23 +01001004 if (sz < sizeof(*info))
1005 return NULL;
1006
Harald Welte2e4e6a12006-01-12 13:30:04 -08001007 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
Dmitry Vyukov889c6042017-12-28 09:48:54 +01001008 if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001009 return NULL;
1010
Michal Hocko05372502018-01-30 11:30:11 -08001011 /* __GFP_NORETRY is not fully supported by kvmalloc but it should
1012 * work reasonably well if sz is too large and bail out rather
1013 * than shoot all processes down before realizing there is nothing
1014 * more to reclaim.
1015 */
1016 info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY);
Michal Hockoeacd86c2017-07-12 14:35:37 -07001017 if (!info)
1018 return NULL;
1019
Eric Dumazet711bdde62015-06-15 09:57:30 -07001020 memset(info, 0, sizeof(*info));
1021 info->size = size;
1022 return info;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001023}
1024EXPORT_SYMBOL(xt_alloc_table_info);
1025
1026void xt_free_table_info(struct xt_table_info *info)
1027{
1028 int cpu;
1029
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001030 if (info->jumpstack != NULL) {
Eric Dumazetf6b50822014-06-24 02:15:35 -07001031 for_each_possible_cpu(cpu)
1032 kvfree(info->jumpstack[cpu]);
1033 kvfree(info->jumpstack);
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001034 }
1035
Eric Dumazet711bdde62015-06-15 09:57:30 -07001036 kvfree(info);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001037}
1038EXPORT_SYMBOL(xt_free_table_info);
1039
Florian Westphal03d13b62017-12-08 17:01:53 +01001040/* Find table by name, grabs mutex & ref. Returns ERR_PTR on error. */
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001041struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
1042 const char *name)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001043{
Florian Westphalb9e69e12016-02-25 10:08:36 +01001044 struct xt_table *t, *found = NULL;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001045
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +02001046 mutex_lock(&xt[af].mutex);
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001047 list_for_each_entry(t, &net->xt.tables[af], list)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001048 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
1049 return t;
Florian Westphalb9e69e12016-02-25 10:08:36 +01001050
1051 if (net == &init_net)
1052 goto out;
1053
1054 /* Table doesn't exist in this netns, re-try init */
1055 list_for_each_entry(t, &init_net.xt.tables[af], list) {
Florian Westphal03d13b62017-12-08 17:01:53 +01001056 int err;
1057
Florian Westphalb9e69e12016-02-25 10:08:36 +01001058 if (strcmp(t->name, name))
1059 continue;
Florian Westphal03d13b62017-12-08 17:01:53 +01001060 if (!try_module_get(t->me))
1061 goto out;
Florian Westphalb9e69e12016-02-25 10:08:36 +01001062 mutex_unlock(&xt[af].mutex);
Florian Westphal03d13b62017-12-08 17:01:53 +01001063 err = t->table_init(net);
1064 if (err < 0) {
Florian Westphalb9e69e12016-02-25 10:08:36 +01001065 module_put(t->me);
Florian Westphal03d13b62017-12-08 17:01:53 +01001066 return ERR_PTR(err);
Florian Westphalb9e69e12016-02-25 10:08:36 +01001067 }
1068
1069 found = t;
1070
1071 mutex_lock(&xt[af].mutex);
1072 break;
1073 }
1074
1075 if (!found)
1076 goto out;
1077
1078 /* and once again: */
1079 list_for_each_entry(t, &net->xt.tables[af], list)
1080 if (strcmp(t->name, name) == 0)
1081 return t;
1082
1083 module_put(found->me);
1084 out:
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001085 mutex_unlock(&xt[af].mutex);
Florian Westphal03d13b62017-12-08 17:01:53 +01001086 return ERR_PTR(-ENOENT);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001087}
1088EXPORT_SYMBOL_GPL(xt_find_table_lock);
1089
Florian Westphal03d13b62017-12-08 17:01:53 +01001090struct xt_table *xt_request_find_table_lock(struct net *net, u_int8_t af,
1091 const char *name)
1092{
1093 struct xt_table *t = xt_find_table_lock(net, af, name);
1094
Florian Westphal20651ce2018-01-09 14:30:48 +01001095#ifdef CONFIG_MODULES
Florian Westphal03d13b62017-12-08 17:01:53 +01001096 if (IS_ERR(t)) {
1097 int err = request_module("%stable_%s", xt_prefix[af], name);
Florian Westphale3eeacb2018-01-13 14:06:08 +01001098 if (err < 0)
Florian Westphal03d13b62017-12-08 17:01:53 +01001099 return ERR_PTR(err);
1100 t = xt_find_table_lock(net, af, name);
1101 }
1102#endif
1103
1104 return t;
1105}
1106EXPORT_SYMBOL_GPL(xt_request_find_table_lock);
1107
Harald Welte2e4e6a12006-01-12 13:30:04 -08001108void xt_table_unlock(struct xt_table *table)
1109{
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001110 mutex_unlock(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001111}
1112EXPORT_SYMBOL_GPL(xt_table_unlock);
1113
Dmitry Mishin27229712006-04-01 02:25:19 -08001114#ifdef CONFIG_COMPAT
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001115void xt_compat_lock(u_int8_t af)
Dmitry Mishin27229712006-04-01 02:25:19 -08001116{
1117 mutex_lock(&xt[af].compat_mutex);
1118}
1119EXPORT_SYMBOL_GPL(xt_compat_lock);
1120
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001121void xt_compat_unlock(u_int8_t af)
Dmitry Mishin27229712006-04-01 02:25:19 -08001122{
1123 mutex_unlock(&xt[af].compat_mutex);
1124}
1125EXPORT_SYMBOL_GPL(xt_compat_unlock);
1126#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -08001127
Eric Dumazet7f5c6d42011-04-04 17:04:03 +02001128DEFINE_PER_CPU(seqcount_t, xt_recseq);
1129EXPORT_PER_CPU_SYMBOL_GPL(xt_recseq);
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001130
Florian Westphaldcebd312015-07-14 17:51:09 +02001131struct static_key xt_tee_enabled __read_mostly;
1132EXPORT_SYMBOL_GPL(xt_tee_enabled);
1133
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001134static int xt_jumpstack_alloc(struct xt_table_info *i)
1135{
1136 unsigned int size;
1137 int cpu;
1138
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001139 size = sizeof(void **) * nr_cpu_ids;
1140 if (size > PAGE_SIZE)
Michal Hocko752ade62017-05-08 15:57:27 -07001141 i->jumpstack = kvzalloc(size, GFP_KERNEL);
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001142 else
Joe Perches3dbd4432011-05-28 10:36:35 -07001143 i->jumpstack = kzalloc(size, GFP_KERNEL);
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001144 if (i->jumpstack == NULL)
1145 return -ENOMEM;
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001146
Florian Westphal98d1bd82015-07-14 17:51:06 +02001147 /* ruleset without jumps -- no stack needed */
1148 if (i->stacksize == 0)
1149 return 0;
1150
Florian Westphal7814b6e2015-07-14 17:51:08 +02001151 /* Jumpstack needs to be able to record two full callchains, one
1152 * from the first rule set traversal, plus one table reentrancy
1153 * via -j TEE without clobbering the callchain that brought us to
1154 * TEE target.
1155 *
1156 * This is done by allocating two jumpstacks per cpu, on reentry
1157 * the upper half of the stack is used.
1158 *
1159 * see the jumpstack setup in ipt_do_table() for more details.
1160 */
1161 size = sizeof(void *) * i->stacksize * 2u;
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001162 for_each_possible_cpu(cpu) {
Michal Hocko752ade62017-05-08 15:57:27 -07001163 i->jumpstack[cpu] = kvmalloc_node(size, GFP_KERNEL,
1164 cpu_to_node(cpu));
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001165 if (i->jumpstack[cpu] == NULL)
1166 /*
1167 * Freeing will be done later on by the callers. The
1168 * chain is: xt_replace_table -> __do_replace ->
1169 * do_replace -> xt_free_table_info.
1170 */
1171 return -ENOMEM;
1172 }
1173
1174 return 0;
1175}
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001176
Harald Welte2e4e6a12006-01-12 13:30:04 -08001177struct xt_table_info *
1178xt_replace_table(struct xt_table *table,
1179 unsigned int num_counters,
1180 struct xt_table_info *newinfo,
1181 int *error)
1182{
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001183 struct xt_table_info *private;
Florian Westphal80055da2017-10-12 01:13:50 +02001184 unsigned int cpu;
Jan Engelhardtf3c5c1b2010-04-19 16:05:10 +02001185 int ret;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001186
Jan Engelhardtd97a9e42010-04-21 14:45:51 +02001187 ret = xt_jumpstack_alloc(newinfo);
1188 if (ret < 0) {
1189 *error = ret;
1190 return NULL;
1191 }
1192
Harald Welte2e4e6a12006-01-12 13:30:04 -08001193 /* Do the substitution. */
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001194 local_bh_disable();
Harald Welte2e4e6a12006-01-12 13:30:04 -08001195 private = table->private;
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001196
Harald Welte2e4e6a12006-01-12 13:30:04 -08001197 /* Check inside lock: is the old number correct? */
1198 if (num_counters != private->number) {
Jan Engelhardtbe91fd52010-03-18 02:22:32 +01001199 pr_debug("num_counters != table->private->number (%u/%u)\n",
Harald Welte2e4e6a12006-01-12 13:30:04 -08001200 num_counters, private->number);
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001201 local_bh_enable();
Harald Welte2e4e6a12006-01-12 13:30:04 -08001202 *error = -EAGAIN;
1203 return NULL;
1204 }
Harald Welte2e4e6a12006-01-12 13:30:04 -08001205
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001206 newinfo->initial_entries = private->initial_entries;
Will Deaconb416c142013-10-21 13:14:53 +01001207 /*
1208 * Ensure contents of newinfo are visible before assigning to
1209 * private.
1210 */
1211 smp_wmb();
1212 table->private = newinfo;
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001213
Florian Westphal80055da2017-10-12 01:13:50 +02001214 /* make sure all cpus see new ->private value */
1215 smp_wmb();
1216
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001217 /*
1218 * Even though table entries have now been swapped, other CPU's
Florian Westphal80055da2017-10-12 01:13:50 +02001219 * may still be using the old entries...
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001220 */
1221 local_bh_enable();
1222
Florian Westphal80055da2017-10-12 01:13:50 +02001223 /* ... so wait for even xt_recseq on all cpus */
1224 for_each_possible_cpu(cpu) {
1225 seqcount_t *s = &per_cpu(xt_recseq, cpu);
1226 u32 seq = raw_read_seqcount(s);
1227
1228 if (seq & 1) {
1229 do {
1230 cond_resched();
1231 cpu_relax();
1232 } while (seq == raw_read_seqcount(s));
1233 }
1234 }
1235
Thomas Graffbabf312011-01-16 18:12:59 +01001236#ifdef CONFIG_AUDIT
1237 if (audit_enabled) {
Geliang Tang46b20c32017-08-07 21:44:25 +08001238 audit_log(current->audit_context, GFP_KERNEL,
1239 AUDIT_NETFILTER_CFG,
1240 "table=%s family=%u entries=%u",
1241 table->name, table->af, private->number);
Thomas Graffbabf312011-01-16 18:12:59 +01001242 }
1243#endif
1244
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001245 return private;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001246}
1247EXPORT_SYMBOL_GPL(xt_replace_table);
1248
Jan Engelhardt35aad0f2009-08-24 14:56:30 +02001249struct xt_table *xt_register_table(struct net *net,
1250 const struct xt_table *input_table,
Alexey Dobriyana98da112008-01-31 04:01:49 -08001251 struct xt_table_info *bootstrap,
1252 struct xt_table_info *newinfo)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001253{
1254 int ret;
1255 struct xt_table_info *private;
Jan Engelhardt35aad0f2009-08-24 14:56:30 +02001256 struct xt_table *t, *table;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001257
Alexey Dobriyan44d34e72008-01-31 04:02:44 -08001258 /* Don't add one object to multiple lists. */
Jan Engelhardt35aad0f2009-08-24 14:56:30 +02001259 table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);
Alexey Dobriyan44d34e72008-01-31 04:02:44 -08001260 if (!table) {
1261 ret = -ENOMEM;
1262 goto out;
1263 }
1264
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +02001265 mutex_lock(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001266 /* Don't autoload: we'd eat our tail... */
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001267 list_for_each_entry(t, &net->xt.tables[table->af], list) {
Patrick McHardydf0933d2006-09-20 11:57:53 -07001268 if (strcmp(t->name, table->name) == 0) {
1269 ret = -EEXIST;
1270 goto unlock;
1271 }
Harald Welte2e4e6a12006-01-12 13:30:04 -08001272 }
1273
1274 /* Simplifies replace_table code. */
1275 table->private = bootstrap;
Stephen Hemminger78454472009-02-20 10:35:32 +01001276
Harald Welte2e4e6a12006-01-12 13:30:04 -08001277 if (!xt_replace_table(table, 0, newinfo, &ret))
1278 goto unlock;
1279
1280 private = table->private;
Jan Engelhardtbe91fd52010-03-18 02:22:32 +01001281 pr_debug("table->private->number = %u\n", private->number);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001282
1283 /* save number of initial entries */
1284 private->initial_entries = private->number;
1285
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001286 list_add(&table->list, &net->xt.tables[table->af]);
Alexey Dobriyana98da112008-01-31 04:01:49 -08001287 mutex_unlock(&xt[table->af].mutex);
1288 return table;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001289
Pablo Neira Ayuso7926dbf2014-07-31 20:38:46 +02001290unlock:
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001291 mutex_unlock(&xt[table->af].mutex);
Alexey Dobriyan44d34e72008-01-31 04:02:44 -08001292 kfree(table);
Alexey Dobriyana98da112008-01-31 04:01:49 -08001293out:
1294 return ERR_PTR(ret);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001295}
1296EXPORT_SYMBOL_GPL(xt_register_table);
1297
1298void *xt_unregister_table(struct xt_table *table)
1299{
1300 struct xt_table_info *private;
1301
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001302 mutex_lock(&xt[table->af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001303 private = table->private;
Patrick McHardydf0933d2006-09-20 11:57:53 -07001304 list_del(&table->list);
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001305 mutex_unlock(&xt[table->af].mutex);
Alexey Dobriyan44d34e72008-01-31 04:02:44 -08001306 kfree(table);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001307
1308 return private;
1309}
1310EXPORT_SYMBOL_GPL(xt_unregister_table);
1311
1312#ifdef CONFIG_PROC_FS
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001313struct xt_names_priv {
1314 struct seq_net_private p;
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001315 u_int8_t af;
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001316};
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001317static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001318{
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001319 struct xt_names_priv *priv = seq->private;
YOSHIFUJI Hideaki12188542008-03-26 02:36:06 +09001320 struct net *net = seq_file_net(seq);
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001321 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001322
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001323 mutex_lock(&xt[af].mutex);
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001324 return seq_list_start(&net->xt.tables[af], *pos);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001325}
1326
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001327static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001328{
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001329 struct xt_names_priv *priv = seq->private;
YOSHIFUJI Hideaki12188542008-03-26 02:36:06 +09001330 struct net *net = seq_file_net(seq);
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001331 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001332
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001333 return seq_list_next(v, &net->xt.tables[af], pos);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001334}
1335
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001336static void xt_table_seq_stop(struct seq_file *seq, void *v)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001337{
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001338 struct xt_names_priv *priv = seq->private;
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001339 u_int8_t af = priv->af;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001340
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001341 mutex_unlock(&xt[af].mutex);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001342}
1343
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001344static int xt_table_seq_show(struct seq_file *seq, void *v)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001345{
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001346 struct xt_table *table = list_entry(v, struct xt_table, list);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001347
Joe Perches861fb102015-05-12 18:28:23 -07001348 if (*table->name)
Steven Rostedt (Red Hat)e71456ae2014-10-27 17:43:45 -04001349 seq_printf(seq, "%s\n", table->name);
Joe Perches861fb102015-05-12 18:28:23 -07001350 return 0;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001351}
1352
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001353static const struct seq_operations xt_table_seq_ops = {
1354 .start = xt_table_seq_start,
1355 .next = xt_table_seq_next,
1356 .stop = xt_table_seq_stop,
1357 .show = xt_table_seq_show,
Harald Welte2e4e6a12006-01-12 13:30:04 -08001358};
1359
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001360static int xt_table_open(struct inode *inode, struct file *file)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001361{
1362 int ret;
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001363 struct xt_names_priv *priv;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001364
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001365 ret = seq_open_net(inode, file, &xt_table_seq_ops,
1366 sizeof(struct xt_names_priv));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001367 if (!ret) {
Alexey Dobriyan715cf352008-01-31 04:49:16 -08001368 priv = ((struct seq_file *)file->private_data)->private;
Al Virod9dda782013-03-31 18:16:14 -04001369 priv->af = (unsigned long)PDE_DATA(inode);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001370 }
Harald Welte2e4e6a12006-01-12 13:30:04 -08001371 return ret;
1372}
1373
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001374static const struct file_operations xt_table_ops = {
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001375 .open = xt_table_open,
1376 .read = seq_read,
1377 .llseek = seq_lseek,
Pavel Emelyanov0e93bb942008-04-29 03:15:35 -07001378 .release = seq_release_net,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001379};
1380
Jan Engelhardteb132202009-02-18 16:42:19 +01001381/*
1382 * Traverse state for ip{,6}_{tables,matches} for helping crossing
1383 * the multi-AF mutexes.
1384 */
1385struct nf_mttg_trav {
1386 struct list_head *head, *curr;
1387 uint8_t class, nfproto;
1388};
1389
1390enum {
1391 MTTG_TRAV_INIT,
1392 MTTG_TRAV_NFP_UNSPEC,
1393 MTTG_TRAV_NFP_SPEC,
1394 MTTG_TRAV_DONE,
1395};
1396
1397static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
1398 bool is_target)
1399{
1400 static const uint8_t next_class[] = {
1401 [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
1402 [MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE,
1403 };
1404 struct nf_mttg_trav *trav = seq->private;
1405
1406 switch (trav->class) {
1407 case MTTG_TRAV_INIT:
1408 trav->class = MTTG_TRAV_NFP_UNSPEC;
1409 mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
1410 trav->head = trav->curr = is_target ?
1411 &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
1412 break;
1413 case MTTG_TRAV_NFP_UNSPEC:
1414 trav->curr = trav->curr->next;
1415 if (trav->curr != trav->head)
1416 break;
1417 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
1418 mutex_lock(&xt[trav->nfproto].mutex);
1419 trav->head = trav->curr = is_target ?
1420 &xt[trav->nfproto].target : &xt[trav->nfproto].match;
1421 trav->class = next_class[trav->class];
1422 break;
1423 case MTTG_TRAV_NFP_SPEC:
1424 trav->curr = trav->curr->next;
1425 if (trav->curr != trav->head)
1426 break;
Gustavo A. R. Silvae8542dc2017-11-07 08:19:29 -06001427 /* fall through */
Jan Engelhardteb132202009-02-18 16:42:19 +01001428 default:
1429 return NULL;
1430 }
1431
1432 if (ppos != NULL)
1433 ++*ppos;
1434 return trav;
1435}
1436
1437static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
1438 bool is_target)
1439{
1440 struct nf_mttg_trav *trav = seq->private;
1441 unsigned int j;
1442
1443 trav->class = MTTG_TRAV_INIT;
1444 for (j = 0; j < *pos; ++j)
1445 if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
1446 return NULL;
1447 return trav;
1448}
1449
1450static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
1451{
1452 struct nf_mttg_trav *trav = seq->private;
1453
1454 switch (trav->class) {
1455 case MTTG_TRAV_NFP_UNSPEC:
1456 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
1457 break;
1458 case MTTG_TRAV_NFP_SPEC:
1459 mutex_unlock(&xt[trav->nfproto].mutex);
1460 break;
1461 }
1462}
1463
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001464static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
1465{
Jan Engelhardteb132202009-02-18 16:42:19 +01001466 return xt_mttg_seq_start(seq, pos, false);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001467}
1468
Jan Engelhardteb132202009-02-18 16:42:19 +01001469static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001470{
Jan Engelhardteb132202009-02-18 16:42:19 +01001471 return xt_mttg_seq_next(seq, v, ppos, false);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001472}
1473
1474static int xt_match_seq_show(struct seq_file *seq, void *v)
1475{
Jan Engelhardteb132202009-02-18 16:42:19 +01001476 const struct nf_mttg_trav *trav = seq->private;
1477 const struct xt_match *match;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001478
Jan Engelhardteb132202009-02-18 16:42:19 +01001479 switch (trav->class) {
1480 case MTTG_TRAV_NFP_UNSPEC:
1481 case MTTG_TRAV_NFP_SPEC:
1482 if (trav->curr == trav->head)
1483 return 0;
1484 match = list_entry(trav->curr, struct xt_match, list);
Joe Perches861fb102015-05-12 18:28:23 -07001485 if (*match->name)
1486 seq_printf(seq, "%s\n", match->name);
Jan Engelhardteb132202009-02-18 16:42:19 +01001487 }
1488 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001489}
1490
1491static const struct seq_operations xt_match_seq_ops = {
1492 .start = xt_match_seq_start,
1493 .next = xt_match_seq_next,
Jan Engelhardteb132202009-02-18 16:42:19 +01001494 .stop = xt_mttg_seq_stop,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001495 .show = xt_match_seq_show,
1496};
1497
1498static int xt_match_open(struct inode *inode, struct file *file)
1499{
Jan Engelhardteb132202009-02-18 16:42:19 +01001500 struct nf_mttg_trav *trav;
Rob Jones772476d2014-09-19 11:27:51 +01001501 trav = __seq_open_private(file, &xt_match_seq_ops, sizeof(*trav));
1502 if (!trav)
Jan Engelhardteb132202009-02-18 16:42:19 +01001503 return -ENOMEM;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001504
Al Virod9dda782013-03-31 18:16:14 -04001505 trav->nfproto = (unsigned long)PDE_DATA(inode);
Jan Engelhardteb132202009-02-18 16:42:19 +01001506 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001507}
1508
1509static const struct file_operations xt_match_ops = {
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001510 .open = xt_match_open,
1511 .read = seq_read,
1512 .llseek = seq_lseek,
Jan Engelhardteb132202009-02-18 16:42:19 +01001513 .release = seq_release_private,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001514};
1515
1516static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
1517{
Jan Engelhardteb132202009-02-18 16:42:19 +01001518 return xt_mttg_seq_start(seq, pos, true);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001519}
1520
Jan Engelhardteb132202009-02-18 16:42:19 +01001521static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001522{
Jan Engelhardteb132202009-02-18 16:42:19 +01001523 return xt_mttg_seq_next(seq, v, ppos, true);
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001524}
1525
1526static int xt_target_seq_show(struct seq_file *seq, void *v)
1527{
Jan Engelhardteb132202009-02-18 16:42:19 +01001528 const struct nf_mttg_trav *trav = seq->private;
1529 const struct xt_target *target;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001530
Jan Engelhardteb132202009-02-18 16:42:19 +01001531 switch (trav->class) {
1532 case MTTG_TRAV_NFP_UNSPEC:
1533 case MTTG_TRAV_NFP_SPEC:
1534 if (trav->curr == trav->head)
1535 return 0;
1536 target = list_entry(trav->curr, struct xt_target, list);
Joe Perches861fb102015-05-12 18:28:23 -07001537 if (*target->name)
1538 seq_printf(seq, "%s\n", target->name);
Jan Engelhardteb132202009-02-18 16:42:19 +01001539 }
1540 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001541}
1542
1543static const struct seq_operations xt_target_seq_ops = {
1544 .start = xt_target_seq_start,
1545 .next = xt_target_seq_next,
Jan Engelhardteb132202009-02-18 16:42:19 +01001546 .stop = xt_mttg_seq_stop,
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001547 .show = xt_target_seq_show,
1548};
1549
1550static int xt_target_open(struct inode *inode, struct file *file)
1551{
Jan Engelhardteb132202009-02-18 16:42:19 +01001552 struct nf_mttg_trav *trav;
Rob Jones772476d2014-09-19 11:27:51 +01001553 trav = __seq_open_private(file, &xt_target_seq_ops, sizeof(*trav));
1554 if (!trav)
Jan Engelhardteb132202009-02-18 16:42:19 +01001555 return -ENOMEM;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001556
Al Virod9dda782013-03-31 18:16:14 -04001557 trav->nfproto = (unsigned long)PDE_DATA(inode);
Jan Engelhardteb132202009-02-18 16:42:19 +01001558 return 0;
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001559}
1560
1561static const struct file_operations xt_target_ops = {
Alexey Dobriyan025d93d2008-01-31 04:48:54 -08001562 .open = xt_target_open,
Harald Welte2e4e6a12006-01-12 13:30:04 -08001563 .read = seq_read,
1564 .llseek = seq_lseek,
Jan Engelhardteb132202009-02-18 16:42:19 +01001565 .release = seq_release_private,
Harald Welte2e4e6a12006-01-12 13:30:04 -08001566};
1567
1568#define FORMAT_TABLES "_tables_names"
1569#define FORMAT_MATCHES "_tables_matches"
1570#define FORMAT_TARGETS "_tables_targets"
1571
1572#endif /* CONFIG_PROC_FS */
1573
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001574/**
Florian Westphalb9e69e12016-02-25 10:08:36 +01001575 * xt_hook_ops_alloc - set up hooks for a new table
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001576 * @table: table with metadata needed to set up hooks
1577 * @fn: Hook function
1578 *
Florian Westphalb9e69e12016-02-25 10:08:36 +01001579 * This function will create the nf_hook_ops that the x_table needs
1580 * to hand to xt_hook_link_net().
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001581 */
Florian Westphalb9e69e12016-02-25 10:08:36 +01001582struct nf_hook_ops *
1583xt_hook_ops_alloc(const struct xt_table *table, nf_hookfn *fn)
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001584{
1585 unsigned int hook_mask = table->valid_hooks;
1586 uint8_t i, num_hooks = hweight32(hook_mask);
1587 uint8_t hooknum;
1588 struct nf_hook_ops *ops;
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001589
Xiubo Lia6d0bae2016-06-02 10:59:56 +08001590 if (!num_hooks)
1591 return ERR_PTR(-EINVAL);
1592
Florian Westphal1ecc2812016-10-17 21:50:23 +02001593 ops = kcalloc(num_hooks, sizeof(*ops), GFP_KERNEL);
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001594 if (ops == NULL)
1595 return ERR_PTR(-ENOMEM);
1596
1597 for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0;
1598 hook_mask >>= 1, ++hooknum) {
1599 if (!(hook_mask & 1))
1600 continue;
1601 ops[i].hook = fn;
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001602 ops[i].pf = table->af;
1603 ops[i].hooknum = hooknum;
1604 ops[i].priority = table->priority;
1605 ++i;
1606 }
1607
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001608 return ops;
1609}
Florian Westphalb9e69e12016-02-25 10:08:36 +01001610EXPORT_SYMBOL_GPL(xt_hook_ops_alloc);
Jan Engelhardt2b95efe2009-06-17 13:57:48 +02001611
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001612int xt_proto_init(struct net *net, u_int8_t af)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001613{
1614#ifdef CONFIG_PROC_FS
1615 char buf[XT_FUNCTION_MAXNAMELEN];
1616 struct proc_dir_entry *proc;
Philip Whinerayf13f2ae2015-11-22 11:35:07 +00001617 kuid_t root_uid;
1618 kgid_t root_gid;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001619#endif
1620
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001621 if (af >= ARRAY_SIZE(xt_prefix))
Harald Welte2e4e6a12006-01-12 13:30:04 -08001622 return -EINVAL;
1623
1624
1625#ifdef CONFIG_PROC_FS
Philip Whinerayf13f2ae2015-11-22 11:35:07 +00001626 root_uid = make_kuid(net->user_ns, 0);
1627 root_gid = make_kgid(net->user_ns, 0);
1628
Tobias Klauserce18afe2007-03-14 16:36:16 -07001629 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001630 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -07001631 proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops,
1632 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001633 if (!proc)
1634 goto out;
Philip Whinerayf13f2ae2015-11-22 11:35:07 +00001635 if (uid_valid(root_uid) && gid_valid(root_gid))
1636 proc_set_user(proc, root_uid, root_gid);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001637
Tobias Klauserce18afe2007-03-14 16:36:16 -07001638 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001639 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -07001640 proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops,
1641 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001642 if (!proc)
1643 goto out_remove_tables;
Philip Whinerayf13f2ae2015-11-22 11:35:07 +00001644 if (uid_valid(root_uid) && gid_valid(root_gid))
1645 proc_set_user(proc, root_uid, root_gid);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001646
Tobias Klauserce18afe2007-03-14 16:36:16 -07001647 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001648 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
Denis V. Lunev8b169242008-05-02 04:11:52 -07001649 proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops,
1650 (void *)(unsigned long)af);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001651 if (!proc)
1652 goto out_remove_matches;
Philip Whinerayf13f2ae2015-11-22 11:35:07 +00001653 if (uid_valid(root_uid) && gid_valid(root_gid))
1654 proc_set_user(proc, root_uid, root_gid);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001655#endif
1656
1657 return 0;
1658
1659#ifdef CONFIG_PROC_FS
1660out_remove_matches:
Tobias Klauserce18afe2007-03-14 16:36:16 -07001661 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001662 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Gao fengece31ff2013-02-18 01:34:56 +00001663 remove_proc_entry(buf, net->proc_net);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001664
1665out_remove_tables:
Tobias Klauserce18afe2007-03-14 16:36:16 -07001666 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001667 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Gao fengece31ff2013-02-18 01:34:56 +00001668 remove_proc_entry(buf, net->proc_net);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001669out:
1670 return -1;
1671#endif
1672}
1673EXPORT_SYMBOL_GPL(xt_proto_init);
1674
Jan Engelhardt76108ce2008-10-08 11:35:00 +02001675void xt_proto_fini(struct net *net, u_int8_t af)
Harald Welte2e4e6a12006-01-12 13:30:04 -08001676{
1677#ifdef CONFIG_PROC_FS
1678 char buf[XT_FUNCTION_MAXNAMELEN];
1679
Tobias Klauserce18afe2007-03-14 16:36:16 -07001680 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001681 strlcat(buf, FORMAT_TABLES, sizeof(buf));
Gao fengece31ff2013-02-18 01:34:56 +00001682 remove_proc_entry(buf, net->proc_net);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001683
Tobias Klauserce18afe2007-03-14 16:36:16 -07001684 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001685 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
Gao fengece31ff2013-02-18 01:34:56 +00001686 remove_proc_entry(buf, net->proc_net);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001687
Tobias Klauserce18afe2007-03-14 16:36:16 -07001688 strlcpy(buf, xt_prefix[af], sizeof(buf));
Harald Welte2e4e6a12006-01-12 13:30:04 -08001689 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
Gao fengece31ff2013-02-18 01:34:56 +00001690 remove_proc_entry(buf, net->proc_net);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001691#endif /*CONFIG_PROC_FS*/
1692}
1693EXPORT_SYMBOL_GPL(xt_proto_fini);
1694
Florian Westphalf28e15b2016-11-22 14:44:18 +01001695/**
1696 * xt_percpu_counter_alloc - allocate x_tables rule counter
1697 *
Florian Westphalae0ac0e2016-11-22 14:44:19 +01001698 * @state: pointer to xt_percpu allocation state
Florian Westphalf28e15b2016-11-22 14:44:18 +01001699 * @counter: pointer to counter struct inside the ip(6)/arpt_entry struct
1700 *
1701 * On SMP, the packet counter [ ip(6)t_entry->counters.pcnt ] will then
1702 * contain the address of the real (percpu) counter.
1703 *
1704 * Rule evaluation needs to use xt_get_this_cpu_counter() helper
1705 * to fetch the real percpu counter.
1706 *
Florian Westphalae0ac0e2016-11-22 14:44:19 +01001707 * To speed up allocation and improve data locality, a 4kb block is
1708 * allocated.
1709 *
1710 * xt_percpu_counter_alloc_state contains the base address of the
1711 * allocated page and the current sub-offset.
1712 *
Florian Westphalf28e15b2016-11-22 14:44:18 +01001713 * returns false on error.
1714 */
Florian Westphalae0ac0e2016-11-22 14:44:19 +01001715bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state,
1716 struct xt_counters *counter)
Florian Westphalf28e15b2016-11-22 14:44:18 +01001717{
Florian Westphalae0ac0e2016-11-22 14:44:19 +01001718 BUILD_BUG_ON(XT_PCPU_BLOCK_SIZE < (sizeof(*counter) * 2));
Florian Westphalf28e15b2016-11-22 14:44:18 +01001719
1720 if (nr_cpu_ids <= 1)
1721 return true;
1722
Florian Westphalae0ac0e2016-11-22 14:44:19 +01001723 if (!state->mem) {
1724 state->mem = __alloc_percpu(XT_PCPU_BLOCK_SIZE,
1725 XT_PCPU_BLOCK_SIZE);
1726 if (!state->mem)
1727 return false;
1728 }
1729 counter->pcnt = (__force unsigned long)(state->mem + state->off);
1730 state->off += sizeof(*counter);
1731 if (state->off > (XT_PCPU_BLOCK_SIZE - sizeof(*counter))) {
1732 state->mem = NULL;
1733 state->off = 0;
1734 }
Florian Westphalf28e15b2016-11-22 14:44:18 +01001735 return true;
1736}
1737EXPORT_SYMBOL_GPL(xt_percpu_counter_alloc);
1738
Florian Westphal4d31eef2016-11-22 14:44:17 +01001739void xt_percpu_counter_free(struct xt_counters *counters)
1740{
1741 unsigned long pcnt = counters->pcnt;
1742
Florian Westphalae0ac0e2016-11-22 14:44:19 +01001743 if (nr_cpu_ids > 1 && (pcnt & (XT_PCPU_BLOCK_SIZE - 1)) == 0)
Florian Westphal4d31eef2016-11-22 14:44:17 +01001744 free_percpu((void __percpu *)pcnt);
1745}
1746EXPORT_SYMBOL_GPL(xt_percpu_counter_free);
1747
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001748static int __net_init xt_net_init(struct net *net)
1749{
1750 int i;
1751
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001752 for (i = 0; i < NFPROTO_NUMPROTO; i++)
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001753 INIT_LIST_HEAD(&net->xt.tables[i]);
1754 return 0;
1755}
1756
Vasily Averin613d0772017-11-12 14:32:37 +03001757static void __net_exit xt_net_exit(struct net *net)
1758{
1759 int i;
1760
1761 for (i = 0; i < NFPROTO_NUMPROTO; i++)
1762 WARN_ON_ONCE(!list_empty(&net->xt.tables[i]));
1763}
1764
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001765static struct pernet_operations xt_net_ops = {
1766 .init = xt_net_init,
Vasily Averin613d0772017-11-12 14:32:37 +03001767 .exit = xt_net_exit,
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001768};
Harald Welte2e4e6a12006-01-12 13:30:04 -08001769
1770static int __init xt_init(void)
1771{
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001772 unsigned int i;
1773 int rv;
1774
1775 for_each_possible_cpu(i) {
Eric Dumazet7f5c6d42011-04-04 17:04:03 +02001776 seqcount_init(&per_cpu(xt_recseq, i));
Stephen Hemminger942e4a22009-04-28 22:36:33 -07001777 }
Harald Welte2e4e6a12006-01-12 13:30:04 -08001778
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001779 xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001780 if (!xt)
1781 return -ENOMEM;
1782
Jan Engelhardt7e9c6ee2008-10-08 11:35:00 +02001783 for (i = 0; i < NFPROTO_NUMPROTO; i++) {
Ingo Molnar9e19bb62006-03-25 01:41:10 -08001784 mutex_init(&xt[i].mutex);
Dmitry Mishin27229712006-04-01 02:25:19 -08001785#ifdef CONFIG_COMPAT
1786 mutex_init(&xt[i].compat_mutex);
Eric Dumazet255d0dc2010-12-18 18:35:15 +01001787 xt[i].compat_tab = NULL;
Dmitry Mishin27229712006-04-01 02:25:19 -08001788#endif
Harald Welte2e4e6a12006-01-12 13:30:04 -08001789 INIT_LIST_HEAD(&xt[i].target);
1790 INIT_LIST_HEAD(&xt[i].match);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001791 }
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001792 rv = register_pernet_subsys(&xt_net_ops);
1793 if (rv < 0)
1794 kfree(xt);
1795 return rv;
Harald Welte2e4e6a12006-01-12 13:30:04 -08001796}
1797
1798static void __exit xt_fini(void)
1799{
Alexey Dobriyan8d870052008-01-31 04:02:13 -08001800 unregister_pernet_subsys(&xt_net_ops);
Harald Welte2e4e6a12006-01-12 13:30:04 -08001801 kfree(xt);
1802}
1803
1804module_init(xt_init);
1805module_exit(xt_fini);
1806