2 * x_tables core - Backend for {ip,ip6,arp}_tables
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
6 * Based on existing ip_tables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
15 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16 #include <linux/kernel.h>
17 #include <linux/socket.h>
18 #include <linux/net.h>
19 #include <linux/proc_fs.h>
20 #include <linux/seq_file.h>
21 #include <linux/string.h>
22 #include <linux/vmalloc.h>
23 #include <linux/mutex.h>
25 #include <net/net_namespace.h>
27 #include <linux/netfilter/x_tables.h>
28 #include <linux/netfilter_arp.h>
29 #include <linux/netfilter_ipv4/ip_tables.h>
30 #include <linux/netfilter_ipv6/ip6_tables.h>
31 #include <linux/netfilter_arp/arp_tables.h>
33 MODULE_LICENSE("GPL");
34 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
35 MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
37 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
40 struct compat_delta
*next
;
47 struct list_head match
;
48 struct list_head target
;
50 struct mutex compat_mutex
;
51 struct compat_delta
*compat_offsets
;
55 static struct xt_af
*xt
;
57 static const char *const xt_prefix
[NFPROTO_NUMPROTO
] = {
58 [NFPROTO_UNSPEC
] = "x",
59 [NFPROTO_IPV4
] = "ip",
60 [NFPROTO_ARP
] = "arp",
61 [NFPROTO_BRIDGE
] = "eb",
62 [NFPROTO_IPV6
] = "ip6",
65 /* Registration hooks for targets. */
67 xt_register_target(struct xt_target
*target
)
69 u_int8_t af
= target
->family
;
72 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
75 list_add(&target
->list
, &xt
[af
].target
);
76 mutex_unlock(&xt
[af
].mutex
);
79 EXPORT_SYMBOL(xt_register_target
);
82 xt_unregister_target(struct xt_target
*target
)
84 u_int8_t af
= target
->family
;
86 mutex_lock(&xt
[af
].mutex
);
87 list_del(&target
->list
);
88 mutex_unlock(&xt
[af
].mutex
);
90 EXPORT_SYMBOL(xt_unregister_target
);
93 xt_register_targets(struct xt_target
*target
, unsigned int n
)
98 for (i
= 0; i
< n
; i
++) {
99 err
= xt_register_target(&target
[i
]);
107 xt_unregister_targets(target
, i
);
110 EXPORT_SYMBOL(xt_register_targets
);
113 xt_unregister_targets(struct xt_target
*target
, unsigned int n
)
117 for (i
= 0; i
< n
; i
++)
118 xt_unregister_target(&target
[i
]);
120 EXPORT_SYMBOL(xt_unregister_targets
);
123 xt_register_match(struct xt_match
*match
)
125 u_int8_t af
= match
->family
;
128 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
132 list_add(&match
->list
, &xt
[af
].match
);
133 mutex_unlock(&xt
[af
].mutex
);
137 EXPORT_SYMBOL(xt_register_match
);
140 xt_unregister_match(struct xt_match
*match
)
142 u_int8_t af
= match
->family
;
144 mutex_lock(&xt
[af
].mutex
);
145 list_del(&match
->list
);
146 mutex_unlock(&xt
[af
].mutex
);
148 EXPORT_SYMBOL(xt_unregister_match
);
151 xt_register_matches(struct xt_match
*match
, unsigned int n
)
156 for (i
= 0; i
< n
; i
++) {
157 err
= xt_register_match(&match
[i
]);
165 xt_unregister_matches(match
, i
);
168 EXPORT_SYMBOL(xt_register_matches
);
171 xt_unregister_matches(struct xt_match
*match
, unsigned int n
)
175 for (i
= 0; i
< n
; i
++)
176 xt_unregister_match(&match
[i
]);
178 EXPORT_SYMBOL(xt_unregister_matches
);
182 * These are weird, but module loading must not be done with mutex
183 * held (since they will register), and we have to have a single
184 * function to use try_then_request_module().
187 /* Find match, grabs ref. Returns ERR_PTR() on error. */
188 struct xt_match
*xt_find_match(u8 af
, const char *name
, u8 revision
)
193 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
194 return ERR_PTR(-EINTR
);
196 list_for_each_entry(m
, &xt
[af
].match
, list
) {
197 if (strcmp(m
->name
, name
) == 0) {
198 if (m
->revision
== revision
) {
199 if (try_module_get(m
->me
)) {
200 mutex_unlock(&xt
[af
].mutex
);
204 err
= -EPROTOTYPE
; /* Found something. */
207 mutex_unlock(&xt
[af
].mutex
);
209 if (af
!= NFPROTO_UNSPEC
)
210 /* Try searching again in the family-independent list */
211 return xt_find_match(NFPROTO_UNSPEC
, name
, revision
);
215 EXPORT_SYMBOL(xt_find_match
);
218 xt_request_find_match(uint8_t nfproto
, const char *name
, uint8_t revision
)
220 struct xt_match
*match
;
222 match
= try_then_request_module(xt_find_match(nfproto
, name
, revision
),
223 "%st_%s", xt_prefix
[nfproto
], name
);
224 return (match
!= NULL
) ? match
: ERR_PTR(-ENOENT
);
226 EXPORT_SYMBOL_GPL(xt_request_find_match
);
228 /* Find target, grabs ref. Returns ERR_PTR() on error. */
229 struct xt_target
*xt_find_target(u8 af
, const char *name
, u8 revision
)
234 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
235 return ERR_PTR(-EINTR
);
237 list_for_each_entry(t
, &xt
[af
].target
, list
) {
238 if (strcmp(t
->name
, name
) == 0) {
239 if (t
->revision
== revision
) {
240 if (try_module_get(t
->me
)) {
241 mutex_unlock(&xt
[af
].mutex
);
245 err
= -EPROTOTYPE
; /* Found something. */
248 mutex_unlock(&xt
[af
].mutex
);
250 if (af
!= NFPROTO_UNSPEC
)
251 /* Try searching again in the family-independent list */
252 return xt_find_target(NFPROTO_UNSPEC
, name
, revision
);
256 EXPORT_SYMBOL(xt_find_target
);
258 struct xt_target
*xt_request_find_target(u8 af
, const char *name
, u8 revision
)
260 struct xt_target
*target
;
262 target
= try_then_request_module(xt_find_target(af
, name
, revision
),
263 "%st_%s", xt_prefix
[af
], name
);
264 return (target
!= NULL
) ? target
: ERR_PTR(-ENOENT
);
266 EXPORT_SYMBOL_GPL(xt_request_find_target
);
268 static int match_revfn(u8 af
, const char *name
, u8 revision
, int *bestp
)
270 const struct xt_match
*m
;
273 list_for_each_entry(m
, &xt
[af
].match
, list
) {
274 if (strcmp(m
->name
, name
) == 0) {
275 if (m
->revision
> *bestp
)
276 *bestp
= m
->revision
;
277 if (m
->revision
== revision
)
282 if (af
!= NFPROTO_UNSPEC
&& !have_rev
)
283 return match_revfn(NFPROTO_UNSPEC
, name
, revision
, bestp
);
288 static int target_revfn(u8 af
, const char *name
, u8 revision
, int *bestp
)
290 const struct xt_target
*t
;
293 list_for_each_entry(t
, &xt
[af
].target
, list
) {
294 if (strcmp(t
->name
, name
) == 0) {
295 if (t
->revision
> *bestp
)
296 *bestp
= t
->revision
;
297 if (t
->revision
== revision
)
302 if (af
!= NFPROTO_UNSPEC
&& !have_rev
)
303 return target_revfn(NFPROTO_UNSPEC
, name
, revision
, bestp
);
308 /* Returns true or false (if no such extension at all) */
309 int xt_find_revision(u8 af
, const char *name
, u8 revision
, int target
,
312 int have_rev
, best
= -1;
314 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0) {
319 have_rev
= target_revfn(af
, name
, revision
, &best
);
321 have_rev
= match_revfn(af
, name
, revision
, &best
);
322 mutex_unlock(&xt
[af
].mutex
);
324 /* Nothing at all? Return 0 to try loading module. */
332 *err
= -EPROTONOSUPPORT
;
335 EXPORT_SYMBOL_GPL(xt_find_revision
);
337 static char *textify_hooks(char *buf
, size_t size
, unsigned int mask
)
339 static const char *const names
[] = {
340 "PREROUTING", "INPUT", "FORWARD",
341 "OUTPUT", "POSTROUTING", "BROUTING",
349 for (i
= 0; i
< ARRAY_SIZE(names
); ++i
) {
350 if (!(mask
& (1 << i
)))
352 res
= snprintf(p
, size
, "%s%s", np
? "/" : "", names
[i
]);
363 int xt_check_match(struct xt_mtchk_param
*par
,
364 unsigned int size
, u_int8_t proto
, bool inv_proto
)
366 if (XT_ALIGN(par
->match
->matchsize
) != size
&&
367 par
->match
->matchsize
!= -1) {
369 * ebt_among is exempt from centralized matchsize checking
370 * because it uses a dynamic-size data set.
372 pr_err("%s_tables: %s.%u match: invalid size "
373 "%u (kernel) != (user) %u\n",
374 xt_prefix
[par
->family
], par
->match
->name
,
375 par
->match
->revision
,
376 XT_ALIGN(par
->match
->matchsize
), size
);
379 if (par
->match
->table
!= NULL
&&
380 strcmp(par
->match
->table
, par
->table
) != 0) {
381 pr_err("%s_tables: %s match: only valid in %s table, not %s\n",
382 xt_prefix
[par
->family
], par
->match
->name
,
383 par
->match
->table
, par
->table
);
386 if (par
->match
->hooks
&& (par
->hook_mask
& ~par
->match
->hooks
) != 0) {
387 char used
[64], allow
[64];
389 pr_err("%s_tables: %s match: used from hooks %s, but only "
391 xt_prefix
[par
->family
], par
->match
->name
,
392 textify_hooks(used
, sizeof(used
), par
->hook_mask
),
393 textify_hooks(allow
, sizeof(allow
), par
->match
->hooks
));
396 if (par
->match
->proto
&& (par
->match
->proto
!= proto
|| inv_proto
)) {
397 pr_err("%s_tables: %s match: only valid for protocol %u\n",
398 xt_prefix
[par
->family
], par
->match
->name
,
402 if (par
->match
->checkentry
!= NULL
&& !par
->match
->checkentry(par
))
406 EXPORT_SYMBOL_GPL(xt_check_match
);
409 int xt_compat_add_offset(u_int8_t af
, unsigned int offset
, short delta
)
411 struct compat_delta
*tmp
;
413 tmp
= kmalloc(sizeof(struct compat_delta
), GFP_KERNEL
);
417 tmp
->offset
= offset
;
420 if (xt
[af
].compat_offsets
) {
421 tmp
->next
= xt
[af
].compat_offsets
->next
;
422 xt
[af
].compat_offsets
->next
= tmp
;
424 xt
[af
].compat_offsets
= tmp
;
429 EXPORT_SYMBOL_GPL(xt_compat_add_offset
);
431 void xt_compat_flush_offsets(u_int8_t af
)
433 struct compat_delta
*tmp
, *next
;
435 if (xt
[af
].compat_offsets
) {
436 for (tmp
= xt
[af
].compat_offsets
; tmp
; tmp
= next
) {
440 xt
[af
].compat_offsets
= NULL
;
443 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets
);
445 int xt_compat_calc_jump(u_int8_t af
, unsigned int offset
)
447 struct compat_delta
*tmp
;
450 for (tmp
= xt
[af
].compat_offsets
, delta
= 0; tmp
; tmp
= tmp
->next
)
451 if (tmp
->offset
< offset
)
455 EXPORT_SYMBOL_GPL(xt_compat_calc_jump
);
457 int xt_compat_match_offset(const struct xt_match
*match
)
459 u_int16_t csize
= match
->compatsize
? : match
->matchsize
;
460 return XT_ALIGN(match
->matchsize
) - COMPAT_XT_ALIGN(csize
);
462 EXPORT_SYMBOL_GPL(xt_compat_match_offset
);
464 int xt_compat_match_from_user(struct xt_entry_match
*m
, void **dstptr
,
467 const struct xt_match
*match
= m
->u
.kernel
.match
;
468 struct compat_xt_entry_match
*cm
= (struct compat_xt_entry_match
*)m
;
469 int pad
, off
= xt_compat_match_offset(match
);
470 u_int16_t msize
= cm
->u
.user
.match_size
;
473 memcpy(m
, cm
, sizeof(*cm
));
474 if (match
->compat_from_user
)
475 match
->compat_from_user(m
->data
, cm
->data
);
477 memcpy(m
->data
, cm
->data
, msize
- sizeof(*cm
));
478 pad
= XT_ALIGN(match
->matchsize
) - match
->matchsize
;
480 memset(m
->data
+ match
->matchsize
, 0, pad
);
483 m
->u
.user
.match_size
= msize
;
489 EXPORT_SYMBOL_GPL(xt_compat_match_from_user
);
491 int xt_compat_match_to_user(const struct xt_entry_match
*m
,
492 void __user
**dstptr
, unsigned int *size
)
494 const struct xt_match
*match
= m
->u
.kernel
.match
;
495 struct compat_xt_entry_match __user
*cm
= *dstptr
;
496 int off
= xt_compat_match_offset(match
);
497 u_int16_t msize
= m
->u
.user
.match_size
- off
;
499 if (copy_to_user(cm
, m
, sizeof(*cm
)) ||
500 put_user(msize
, &cm
->u
.user
.match_size
) ||
501 copy_to_user(cm
->u
.user
.name
, m
->u
.kernel
.match
->name
,
502 strlen(m
->u
.kernel
.match
->name
) + 1))
505 if (match
->compat_to_user
) {
506 if (match
->compat_to_user((void __user
*)cm
->data
, m
->data
))
509 if (copy_to_user(cm
->data
, m
->data
, msize
- sizeof(*cm
)))
517 EXPORT_SYMBOL_GPL(xt_compat_match_to_user
);
518 #endif /* CONFIG_COMPAT */
520 int xt_check_target(struct xt_tgchk_param
*par
,
521 unsigned int size
, u_int8_t proto
, bool inv_proto
)
523 if (XT_ALIGN(par
->target
->targetsize
) != size
) {
524 pr_err("%s_tables: %s.%u target: invalid size "
525 "%u (kernel) != (user) %u\n",
526 xt_prefix
[par
->family
], par
->target
->name
,
527 par
->target
->revision
,
528 XT_ALIGN(par
->target
->targetsize
), size
);
531 if (par
->target
->table
!= NULL
&&
532 strcmp(par
->target
->table
, par
->table
) != 0) {
533 pr_err("%s_tables: %s target: only valid in %s table, not %s\n",
534 xt_prefix
[par
->family
], par
->target
->name
,
535 par
->target
->table
, par
->table
);
538 if (par
->target
->hooks
&& (par
->hook_mask
& ~par
->target
->hooks
) != 0) {
539 char used
[64], allow
[64];
541 pr_err("%s_tables: %s target: used from hooks %s, but only "
543 xt_prefix
[par
->family
], par
->target
->name
,
544 textify_hooks(used
, sizeof(used
), par
->hook_mask
),
545 textify_hooks(allow
, sizeof(allow
), par
->target
->hooks
));
548 if (par
->target
->proto
&& (par
->target
->proto
!= proto
|| inv_proto
)) {
549 pr_err("%s_tables: %s target: only valid for protocol %u\n",
550 xt_prefix
[par
->family
], par
->target
->name
,
554 if (par
->target
->checkentry
!= NULL
&& !par
->target
->checkentry(par
))
558 EXPORT_SYMBOL_GPL(xt_check_target
);
561 int xt_compat_target_offset(const struct xt_target
*target
)
563 u_int16_t csize
= target
->compatsize
? : target
->targetsize
;
564 return XT_ALIGN(target
->targetsize
) - COMPAT_XT_ALIGN(csize
);
566 EXPORT_SYMBOL_GPL(xt_compat_target_offset
);
568 void xt_compat_target_from_user(struct xt_entry_target
*t
, void **dstptr
,
571 const struct xt_target
*target
= t
->u
.kernel
.target
;
572 struct compat_xt_entry_target
*ct
= (struct compat_xt_entry_target
*)t
;
573 int pad
, off
= xt_compat_target_offset(target
);
574 u_int16_t tsize
= ct
->u
.user
.target_size
;
577 memcpy(t
, ct
, sizeof(*ct
));
578 if (target
->compat_from_user
)
579 target
->compat_from_user(t
->data
, ct
->data
);
581 memcpy(t
->data
, ct
->data
, tsize
- sizeof(*ct
));
582 pad
= XT_ALIGN(target
->targetsize
) - target
->targetsize
;
584 memset(t
->data
+ target
->targetsize
, 0, pad
);
587 t
->u
.user
.target_size
= tsize
;
592 EXPORT_SYMBOL_GPL(xt_compat_target_from_user
);
594 int xt_compat_target_to_user(const struct xt_entry_target
*t
,
595 void __user
**dstptr
, unsigned int *size
)
597 const struct xt_target
*target
= t
->u
.kernel
.target
;
598 struct compat_xt_entry_target __user
*ct
= *dstptr
;
599 int off
= xt_compat_target_offset(target
);
600 u_int16_t tsize
= t
->u
.user
.target_size
- off
;
602 if (copy_to_user(ct
, t
, sizeof(*ct
)) ||
603 put_user(tsize
, &ct
->u
.user
.target_size
) ||
604 copy_to_user(ct
->u
.user
.name
, t
->u
.kernel
.target
->name
,
605 strlen(t
->u
.kernel
.target
->name
) + 1))
608 if (target
->compat_to_user
) {
609 if (target
->compat_to_user((void __user
*)ct
->data
, t
->data
))
612 if (copy_to_user(ct
->data
, t
->data
, tsize
- sizeof(*ct
)))
620 EXPORT_SYMBOL_GPL(xt_compat_target_to_user
);
623 struct xt_table_info
*xt_alloc_table_info(unsigned int size
)
625 struct xt_table_info
*newinfo
;
628 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
629 if ((SMP_ALIGN(size
) >> PAGE_SHIFT
) + 2 > totalram_pages
)
632 newinfo
= kzalloc(XT_TABLE_INFO_SZ
, GFP_KERNEL
);
636 newinfo
->size
= size
;
638 for_each_possible_cpu(cpu
) {
639 if (size
<= PAGE_SIZE
)
640 newinfo
->entries
[cpu
] = kmalloc_node(size
,
644 newinfo
->entries
[cpu
] = vmalloc_node(size
,
647 if (newinfo
->entries
[cpu
] == NULL
) {
648 xt_free_table_info(newinfo
);
655 EXPORT_SYMBOL(xt_alloc_table_info
);
657 void xt_free_table_info(struct xt_table_info
*info
)
661 for_each_possible_cpu(cpu
) {
662 if (info
->size
<= PAGE_SIZE
)
663 kfree(info
->entries
[cpu
]);
665 vfree(info
->entries
[cpu
]);
669 EXPORT_SYMBOL(xt_free_table_info
);
671 /* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
672 struct xt_table
*xt_find_table_lock(struct net
*net
, u_int8_t af
,
677 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
678 return ERR_PTR(-EINTR
);
680 list_for_each_entry(t
, &net
->xt
.tables
[af
], list
)
681 if (strcmp(t
->name
, name
) == 0 && try_module_get(t
->me
))
683 mutex_unlock(&xt
[af
].mutex
);
686 EXPORT_SYMBOL_GPL(xt_find_table_lock
);
688 void xt_table_unlock(struct xt_table
*table
)
690 mutex_unlock(&xt
[table
->af
].mutex
);
692 EXPORT_SYMBOL_GPL(xt_table_unlock
);
695 void xt_compat_lock(u_int8_t af
)
697 mutex_lock(&xt
[af
].compat_mutex
);
699 EXPORT_SYMBOL_GPL(xt_compat_lock
);
701 void xt_compat_unlock(u_int8_t af
)
703 mutex_unlock(&xt
[af
].compat_mutex
);
705 EXPORT_SYMBOL_GPL(xt_compat_unlock
);
708 DEFINE_PER_CPU(struct xt_info_lock
, xt_info_locks
);
709 EXPORT_PER_CPU_SYMBOL_GPL(xt_info_locks
);
712 struct xt_table_info
*
713 xt_replace_table(struct xt_table
*table
,
714 unsigned int num_counters
,
715 struct xt_table_info
*newinfo
,
718 struct xt_table_info
*private;
720 /* Do the substitution. */
722 private = table
->private;
724 /* Check inside lock: is the old number correct? */
725 if (num_counters
!= private->number
) {
726 pr_debug("num_counters != table->private->number (%u/%u)\n",
727 num_counters
, private->number
);
733 table
->private = newinfo
;
734 newinfo
->initial_entries
= private->initial_entries
;
737 * Even though table entries have now been swapped, other CPU's
738 * may still be using the old entries. This is okay, because
739 * resynchronization happens because of the locking done
740 * during the get_counters() routine.
746 EXPORT_SYMBOL_GPL(xt_replace_table
);
748 struct xt_table
*xt_register_table(struct net
*net
,
749 const struct xt_table
*input_table
,
750 struct xt_table_info
*bootstrap
,
751 struct xt_table_info
*newinfo
)
754 struct xt_table_info
*private;
755 struct xt_table
*t
, *table
;
757 /* Don't add one object to multiple lists. */
758 table
= kmemdup(input_table
, sizeof(struct xt_table
), GFP_KERNEL
);
764 ret
= mutex_lock_interruptible(&xt
[table
->af
].mutex
);
768 /* Don't autoload: we'd eat our tail... */
769 list_for_each_entry(t
, &net
->xt
.tables
[table
->af
], list
) {
770 if (strcmp(t
->name
, table
->name
) == 0) {
776 /* Simplifies replace_table code. */
777 table
->private = bootstrap
;
779 if (!xt_replace_table(table
, 0, newinfo
, &ret
))
782 private = table
->private;
783 pr_debug("table->private->number = %u\n", private->number
);
785 /* save number of initial entries */
786 private->initial_entries
= private->number
;
788 list_add(&table
->list
, &net
->xt
.tables
[table
->af
]);
789 mutex_unlock(&xt
[table
->af
].mutex
);
793 mutex_unlock(&xt
[table
->af
].mutex
);
799 EXPORT_SYMBOL_GPL(xt_register_table
);
801 void *xt_unregister_table(struct xt_table
*table
)
803 struct xt_table_info
*private;
805 mutex_lock(&xt
[table
->af
].mutex
);
806 private = table
->private;
807 list_del(&table
->list
);
808 mutex_unlock(&xt
[table
->af
].mutex
);
813 EXPORT_SYMBOL_GPL(xt_unregister_table
);
815 #ifdef CONFIG_PROC_FS
816 struct xt_names_priv
{
817 struct seq_net_private p
;
820 static void *xt_table_seq_start(struct seq_file
*seq
, loff_t
*pos
)
822 struct xt_names_priv
*priv
= seq
->private;
823 struct net
*net
= seq_file_net(seq
);
824 u_int8_t af
= priv
->af
;
826 mutex_lock(&xt
[af
].mutex
);
827 return seq_list_start(&net
->xt
.tables
[af
], *pos
);
830 static void *xt_table_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
832 struct xt_names_priv
*priv
= seq
->private;
833 struct net
*net
= seq_file_net(seq
);
834 u_int8_t af
= priv
->af
;
836 return seq_list_next(v
, &net
->xt
.tables
[af
], pos
);
839 static void xt_table_seq_stop(struct seq_file
*seq
, void *v
)
841 struct xt_names_priv
*priv
= seq
->private;
842 u_int8_t af
= priv
->af
;
844 mutex_unlock(&xt
[af
].mutex
);
847 static int xt_table_seq_show(struct seq_file
*seq
, void *v
)
849 struct xt_table
*table
= list_entry(v
, struct xt_table
, list
);
851 if (strlen(table
->name
))
852 return seq_printf(seq
, "%s\n", table
->name
);
857 static const struct seq_operations xt_table_seq_ops
= {
858 .start
= xt_table_seq_start
,
859 .next
= xt_table_seq_next
,
860 .stop
= xt_table_seq_stop
,
861 .show
= xt_table_seq_show
,
864 static int xt_table_open(struct inode
*inode
, struct file
*file
)
867 struct xt_names_priv
*priv
;
869 ret
= seq_open_net(inode
, file
, &xt_table_seq_ops
,
870 sizeof(struct xt_names_priv
));
872 priv
= ((struct seq_file
*)file
->private_data
)->private;
873 priv
->af
= (unsigned long)PDE(inode
)->data
;
878 static const struct file_operations xt_table_ops
= {
879 .owner
= THIS_MODULE
,
880 .open
= xt_table_open
,
883 .release
= seq_release_net
,
887 * Traverse state for ip{,6}_{tables,matches} for helping crossing
888 * the multi-AF mutexes.
890 struct nf_mttg_trav
{
891 struct list_head
*head
, *curr
;
892 uint8_t class, nfproto
;
897 MTTG_TRAV_NFP_UNSPEC
,
902 static void *xt_mttg_seq_next(struct seq_file
*seq
, void *v
, loff_t
*ppos
,
905 static const uint8_t next_class
[] = {
906 [MTTG_TRAV_NFP_UNSPEC
] = MTTG_TRAV_NFP_SPEC
,
907 [MTTG_TRAV_NFP_SPEC
] = MTTG_TRAV_DONE
,
909 struct nf_mttg_trav
*trav
= seq
->private;
911 switch (trav
->class) {
913 trav
->class = MTTG_TRAV_NFP_UNSPEC
;
914 mutex_lock(&xt
[NFPROTO_UNSPEC
].mutex
);
915 trav
->head
= trav
->curr
= is_target
?
916 &xt
[NFPROTO_UNSPEC
].target
: &xt
[NFPROTO_UNSPEC
].match
;
918 case MTTG_TRAV_NFP_UNSPEC
:
919 trav
->curr
= trav
->curr
->next
;
920 if (trav
->curr
!= trav
->head
)
922 mutex_unlock(&xt
[NFPROTO_UNSPEC
].mutex
);
923 mutex_lock(&xt
[trav
->nfproto
].mutex
);
924 trav
->head
= trav
->curr
= is_target
?
925 &xt
[trav
->nfproto
].target
: &xt
[trav
->nfproto
].match
;
926 trav
->class = next_class
[trav
->class];
928 case MTTG_TRAV_NFP_SPEC
:
929 trav
->curr
= trav
->curr
->next
;
930 if (trav
->curr
!= trav
->head
)
932 /* fallthru, _stop will unlock */
942 static void *xt_mttg_seq_start(struct seq_file
*seq
, loff_t
*pos
,
945 struct nf_mttg_trav
*trav
= seq
->private;
948 trav
->class = MTTG_TRAV_INIT
;
949 for (j
= 0; j
< *pos
; ++j
)
950 if (xt_mttg_seq_next(seq
, NULL
, NULL
, is_target
) == NULL
)
955 static void xt_mttg_seq_stop(struct seq_file
*seq
, void *v
)
957 struct nf_mttg_trav
*trav
= seq
->private;
959 switch (trav
->class) {
960 case MTTG_TRAV_NFP_UNSPEC
:
961 mutex_unlock(&xt
[NFPROTO_UNSPEC
].mutex
);
963 case MTTG_TRAV_NFP_SPEC
:
964 mutex_unlock(&xt
[trav
->nfproto
].mutex
);
969 static void *xt_match_seq_start(struct seq_file
*seq
, loff_t
*pos
)
971 return xt_mttg_seq_start(seq
, pos
, false);
974 static void *xt_match_seq_next(struct seq_file
*seq
, void *v
, loff_t
*ppos
)
976 return xt_mttg_seq_next(seq
, v
, ppos
, false);
979 static int xt_match_seq_show(struct seq_file
*seq
, void *v
)
981 const struct nf_mttg_trav
*trav
= seq
->private;
982 const struct xt_match
*match
;
984 switch (trav
->class) {
985 case MTTG_TRAV_NFP_UNSPEC
:
986 case MTTG_TRAV_NFP_SPEC
:
987 if (trav
->curr
== trav
->head
)
989 match
= list_entry(trav
->curr
, struct xt_match
, list
);
990 return (*match
->name
== '\0') ? 0 :
991 seq_printf(seq
, "%s\n", match
->name
);
996 static const struct seq_operations xt_match_seq_ops
= {
997 .start
= xt_match_seq_start
,
998 .next
= xt_match_seq_next
,
999 .stop
= xt_mttg_seq_stop
,
1000 .show
= xt_match_seq_show
,
1003 static int xt_match_open(struct inode
*inode
, struct file
*file
)
1005 struct seq_file
*seq
;
1006 struct nf_mttg_trav
*trav
;
1009 trav
= kmalloc(sizeof(*trav
), GFP_KERNEL
);
1013 ret
= seq_open(file
, &xt_match_seq_ops
);
1019 seq
= file
->private_data
;
1020 seq
->private = trav
;
1021 trav
->nfproto
= (unsigned long)PDE(inode
)->data
;
1025 static const struct file_operations xt_match_ops
= {
1026 .owner
= THIS_MODULE
,
1027 .open
= xt_match_open
,
1029 .llseek
= seq_lseek
,
1030 .release
= seq_release_private
,
1033 static void *xt_target_seq_start(struct seq_file
*seq
, loff_t
*pos
)
1035 return xt_mttg_seq_start(seq
, pos
, true);
1038 static void *xt_target_seq_next(struct seq_file
*seq
, void *v
, loff_t
*ppos
)
1040 return xt_mttg_seq_next(seq
, v
, ppos
, true);
1043 static int xt_target_seq_show(struct seq_file
*seq
, void *v
)
1045 const struct nf_mttg_trav
*trav
= seq
->private;
1046 const struct xt_target
*target
;
1048 switch (trav
->class) {
1049 case MTTG_TRAV_NFP_UNSPEC
:
1050 case MTTG_TRAV_NFP_SPEC
:
1051 if (trav
->curr
== trav
->head
)
1053 target
= list_entry(trav
->curr
, struct xt_target
, list
);
1054 return (*target
->name
== '\0') ? 0 :
1055 seq_printf(seq
, "%s\n", target
->name
);
1060 static const struct seq_operations xt_target_seq_ops
= {
1061 .start
= xt_target_seq_start
,
1062 .next
= xt_target_seq_next
,
1063 .stop
= xt_mttg_seq_stop
,
1064 .show
= xt_target_seq_show
,
1067 static int xt_target_open(struct inode
*inode
, struct file
*file
)
1069 struct seq_file
*seq
;
1070 struct nf_mttg_trav
*trav
;
1073 trav
= kmalloc(sizeof(*trav
), GFP_KERNEL
);
1077 ret
= seq_open(file
, &xt_target_seq_ops
);
1083 seq
= file
->private_data
;
1084 seq
->private = trav
;
1085 trav
->nfproto
= (unsigned long)PDE(inode
)->data
;
1089 static const struct file_operations xt_target_ops
= {
1090 .owner
= THIS_MODULE
,
1091 .open
= xt_target_open
,
1093 .llseek
= seq_lseek
,
1094 .release
= seq_release_private
,
1097 #define FORMAT_TABLES "_tables_names"
1098 #define FORMAT_MATCHES "_tables_matches"
1099 #define FORMAT_TARGETS "_tables_targets"
1101 #endif /* CONFIG_PROC_FS */
1104 * xt_hook_link - set up hooks for a new table
1105 * @table: table with metadata needed to set up hooks
1106 * @fn: Hook function
1108 * This function will take care of creating and registering the necessary
1109 * Netfilter hooks for XT tables.
1111 struct nf_hook_ops
*xt_hook_link(const struct xt_table
*table
, nf_hookfn
*fn
)
1113 unsigned int hook_mask
= table
->valid_hooks
;
1114 uint8_t i
, num_hooks
= hweight32(hook_mask
);
1116 struct nf_hook_ops
*ops
;
1119 ops
= kmalloc(sizeof(*ops
) * num_hooks
, GFP_KERNEL
);
1121 return ERR_PTR(-ENOMEM
);
1123 for (i
= 0, hooknum
= 0; i
< num_hooks
&& hook_mask
!= 0;
1124 hook_mask
>>= 1, ++hooknum
) {
1125 if (!(hook_mask
& 1))
1128 ops
[i
].owner
= table
->me
;
1129 ops
[i
].pf
= table
->af
;
1130 ops
[i
].hooknum
= hooknum
;
1131 ops
[i
].priority
= table
->priority
;
1135 ret
= nf_register_hooks(ops
, num_hooks
);
1138 return ERR_PTR(ret
);
1143 EXPORT_SYMBOL_GPL(xt_hook_link
);
1146 * xt_hook_unlink - remove hooks for a table
1147 * @ops: nf_hook_ops array as returned by nf_hook_link
1148 * @hook_mask: the very same mask that was passed to nf_hook_link
1150 void xt_hook_unlink(const struct xt_table
*table
, struct nf_hook_ops
*ops
)
1152 nf_unregister_hooks(ops
, hweight32(table
->valid_hooks
));
1155 EXPORT_SYMBOL_GPL(xt_hook_unlink
);
1157 int xt_proto_init(struct net
*net
, u_int8_t af
)
1159 #ifdef CONFIG_PROC_FS
1160 char buf
[XT_FUNCTION_MAXNAMELEN
];
1161 struct proc_dir_entry
*proc
;
1164 if (af
>= ARRAY_SIZE(xt_prefix
))
1168 #ifdef CONFIG_PROC_FS
1169 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1170 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
1171 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_table_ops
,
1172 (void *)(unsigned long)af
);
1176 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1177 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
1178 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_match_ops
,
1179 (void *)(unsigned long)af
);
1181 goto out_remove_tables
;
1183 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1184 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
1185 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_target_ops
,
1186 (void *)(unsigned long)af
);
1188 goto out_remove_matches
;
1193 #ifdef CONFIG_PROC_FS
1195 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1196 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
1197 proc_net_remove(net
, buf
);
1200 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1201 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
1202 proc_net_remove(net
, buf
);
1207 EXPORT_SYMBOL_GPL(xt_proto_init
);
1209 void xt_proto_fini(struct net
*net
, u_int8_t af
)
1211 #ifdef CONFIG_PROC_FS
1212 char buf
[XT_FUNCTION_MAXNAMELEN
];
1214 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1215 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
1216 proc_net_remove(net
, buf
);
1218 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1219 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
1220 proc_net_remove(net
, buf
);
1222 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1223 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
1224 proc_net_remove(net
, buf
);
1225 #endif /*CONFIG_PROC_FS*/
1227 EXPORT_SYMBOL_GPL(xt_proto_fini
);
1229 static int __net_init
xt_net_init(struct net
*net
)
1233 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++)
1234 INIT_LIST_HEAD(&net
->xt
.tables
[i
]);
1238 static struct pernet_operations xt_net_ops
= {
1239 .init
= xt_net_init
,
1242 static int __init
xt_init(void)
1247 for_each_possible_cpu(i
) {
1248 struct xt_info_lock
*lock
= &per_cpu(xt_info_locks
, i
);
1249 spin_lock_init(&lock
->lock
);
1253 xt
= kmalloc(sizeof(struct xt_af
) * NFPROTO_NUMPROTO
, GFP_KERNEL
);
1257 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++) {
1258 mutex_init(&xt
[i
].mutex
);
1259 #ifdef CONFIG_COMPAT
1260 mutex_init(&xt
[i
].compat_mutex
);
1261 xt
[i
].compat_offsets
= NULL
;
1263 INIT_LIST_HEAD(&xt
[i
].target
);
1264 INIT_LIST_HEAD(&xt
[i
].match
);
1266 rv
= register_pernet_subsys(&xt_net_ops
);
1272 static void __exit
xt_fini(void)
1274 unregister_pernet_subsys(&xt_net_ops
);
1278 module_init(xt_init
);
1279 module_exit(xt_fini
);