?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netfilter: ip_tables: convert pr_devel() to pr_debug()
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / ipv4 / netfilter / ip_tables.c
blob3e6af1036fbcc6c5778f2c8136ad75e8d653cd0a
1 /*
2 * Packet matching code.
3 *
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 #include <linux/cache.h>
13 #include <linux/capability.h>
14 #include <linux/skbuff.h>
15 #include <linux/kmod.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netdevice.h>
18 #include <linux/module.h>
19 #include <linux/icmp.h>
20 #include <net/ip.h>
21 #include <net/compat.h>
22 #include <asm/uaccess.h>
23 #include <linux/mutex.h>
24 #include <linux/proc_fs.h>
25 #include <linux/err.h>
26 #include <linux/cpumask.h>
27
28 #include <linux/netfilter/x_tables.h>
29 #include <linux/netfilter_ipv4/ip_tables.h>
30 #include <net/netfilter/nf_log.h>
31 #include "../../netfilter/xt_repldata.h"
32
33 MODULE_LICENSE("GPL");
34 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
35 MODULE_DESCRIPTION("IPv4 packet filter");
36
37 /*#define DEBUG_IP_FIREWALL*/
38 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
39 /*#define DEBUG_IP_FIREWALL_USER*/
40
41 #ifdef DEBUG_IP_FIREWALL
42 #define dprintf(format, args...) pr_info(format , ## args)
43 #else
44 #define dprintf(format, args...)
45 #endif
46
47 #ifdef DEBUG_IP_FIREWALL_USER
48 #define duprintf(format, args...) pr_info(format , ## args)
49 #else
50 #define duprintf(format, args...)
51 #endif
52
53 #ifdef CONFIG_NETFILTER_DEBUG
54 #define IP_NF_ASSERT(x) \
55 do { \
56 if (!(x)) \
57 printk("IP_NF_ASSERT: %s:%s:%u\n", \
58 __func__, __FILE__, __LINE__); \
59 } while(0)
60 #else
61 #define IP_NF_ASSERT(x)
62 #endif
63
64 #if 0
65 /* All the better to debug you with... */
66 #define static
67 #define inline
68 #endif
69
70 void *ipt_alloc_initial_table(const struct xt_table *info)
71 {
72 return xt_alloc_initial_table(ipt, IPT);
73 }
74 EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
75
76 /*
77 We keep a set of rules for each CPU, so we can avoid write-locking
78 them in the softirq when updating the counters and therefore
79 only need to read-lock in the softirq; doing a write_lock_bh() in user
80 context stops packets coming through and allows user context to read
81 the counters or update the rules.
82
83 Hence the start of any table is given by get_table() below. */
84
85 /* Returns whether matches rule or not. */
86 /* Performance critical - called for every packet */
87 static inline bool
88 ip_packet_match(const struct iphdr *ip,
89 const char *indev,
90 const char *outdev,
91 const struct ipt_ip *ipinfo,
92 int isfrag)
93 {
94 unsigned long ret;
95
96 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
97
98 if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
99 IPT_INV_SRCIP) ||
100 FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
101 IPT_INV_DSTIP)) {
102 dprintf("Source or dest mismatch.\n");
103
104 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
105 &ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
106 ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
107 dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
108 &ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
109 ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
110 return false;
111 }
112
113 ret = ifname_compare_aligned(indev, ipinfo->iniface, ipinfo->iniface_mask);
114
115 if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
116 dprintf("VIA in mismatch (%s vs %s).%s\n",
117 indev, ipinfo->iniface,
118 ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
119 return false;
120 }
121
122 ret = ifname_compare_aligned(outdev, ipinfo->outiface, ipinfo->outiface_mask);
123
124 if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
125 dprintf("VIA out mismatch (%s vs %s).%s\n",
126 outdev, ipinfo->outiface,
127 ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
128 return false;
129 }
130
131 /* Check specific protocol */
132 if (ipinfo->proto &&
133 FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
134 dprintf("Packet protocol %hi does not match %hi.%s\n",
135 ip->protocol, ipinfo->proto,
136 ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
137 return false;
138 }
139
140 /* If we have a fragment rule but the packet is not a fragment
141 * then we return zero */
142 if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
143 dprintf("Fragment rule but not fragment.%s\n",
144 ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
145 return false;
146 }
147
148 return true;
149 }
150
151 static bool
152 ip_checkentry(const struct ipt_ip *ip)
153 {
154 if (ip->flags & ~IPT_F_MASK) {
155 duprintf("Unknown flag bits set: %08X\n",
156 ip->flags & ~IPT_F_MASK);
157 return false;
158 }
159 if (ip->invflags & ~IPT_INV_MASK) {
160 duprintf("Unknown invflag bits set: %08X\n",
161 ip->invflags & ~IPT_INV_MASK);
162 return false;
163 }
164 return true;
165 }
166
167 static unsigned int
168 ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
169 {
170 if (net_ratelimit())
171 pr_info("error: `%s'\n", (const char *)par->targinfo);
172
173 return NF_DROP;
174 }
175
176 /* Performance critical - called for every packet */
177 static inline bool
178 do_match(const struct ipt_entry_match *m, const struct sk_buff *skb,
179 struct xt_match_param *par)
180 {
181 par->match = m->u.kernel.match;
182 par->matchinfo = m->data;
183
184 /* Stop iteration if it doesn't match */
185 if (!m->u.kernel.match->match(skb, par))
186 return true;
187 else
188 return false;
189 }
190
191 /* Performance critical */
192 static inline struct ipt_entry *
193 get_entry(const void *base, unsigned int offset)
194 {
195 return (struct ipt_entry *)(base + offset);
196 }
197
198 /* All zeroes == unconditional rule. */
199 /* Mildly perf critical (only if packet tracing is on) */
200 static inline bool unconditional(const struct ipt_ip *ip)
201 {
202 static const struct ipt_ip uncond;
203
204 return memcmp(ip, &uncond, sizeof(uncond)) == 0;
205 #undef FWINV
206 }
207
208 /* for const-correctness */
209 static inline const struct ipt_entry_target *
210 ipt_get_target_c(const struct ipt_entry *e)
211 {
212 return ipt_get_target((struct ipt_entry *)e);
213 }
214
215 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
216 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
217 static const char *const hooknames[] = {
218 [NF_INET_PRE_ROUTING] = "PREROUTING",
219 [NF_INET_LOCAL_IN] = "INPUT",
220 [NF_INET_FORWARD] = "FORWARD",
221 [NF_INET_LOCAL_OUT] = "OUTPUT",
222 [NF_INET_POST_ROUTING] = "POSTROUTING",
223 };
224
225 enum nf_ip_trace_comments {
226 NF_IP_TRACE_COMMENT_RULE,
227 NF_IP_TRACE_COMMENT_RETURN,
228 NF_IP_TRACE_COMMENT_POLICY,
229 };
230
231 static const char *const comments[] = {
232 [NF_IP_TRACE_COMMENT_RULE] = "rule",
233 [NF_IP_TRACE_COMMENT_RETURN] = "return",
234 [NF_IP_TRACE_COMMENT_POLICY] = "policy",
235 };
236
237 static struct nf_loginfo trace_loginfo = {
238 .type = NF_LOG_TYPE_LOG,
239 .u = {
240 .log = {
241 .level = 4,
242 .logflags = NF_LOG_MASK,
243 },
244 },
245 };
246
247 /* Mildly perf critical (only if packet tracing is on) */
248 static inline int
249 get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
250 const char *hookname, const char **chainname,
251 const char **comment, unsigned int *rulenum)
252 {
253 const struct ipt_standard_target *t = (void *)ipt_get_target_c(s);
254
255 if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
256 /* Head of user chain: ERROR target with chainname */
257 *chainname = t->target.data;
258 (*rulenum) = 0;
259 } else if (s == e) {
260 (*rulenum)++;
261
262 if (s->target_offset == sizeof(struct ipt_entry) &&
263 strcmp(t->target.u.kernel.target->name,
264 IPT_STANDARD_TARGET) == 0 &&
265 t->verdict < 0 &&
266 unconditional(&s->ip)) {
267 /* Tail of chains: STANDARD target (return/policy) */
268 *comment = *chainname == hookname
269 ? comments[NF_IP_TRACE_COMMENT_POLICY]
270 : comments[NF_IP_TRACE_COMMENT_RETURN];
271 }
272 return 1;
273 } else
274 (*rulenum)++;
275
276 return 0;
277 }
278
279 static void trace_packet(const struct sk_buff *skb,
280 unsigned int hook,
281 const struct net_device *in,
282 const struct net_device *out,
283 const char *tablename,
284 const struct xt_table_info *private,
285 const struct ipt_entry *e)
286 {
287 const void *table_base;
288 const struct ipt_entry *root;
289 const char *hookname, *chainname, *comment;
290 const struct ipt_entry *iter;
291 unsigned int rulenum = 0;
292
293 table_base = private->entries[smp_processor_id()];
294 root = get_entry(table_base, private->hook_entry[hook]);
295
296 hookname = chainname = hooknames[hook];
297 comment = comments[NF_IP_TRACE_COMMENT_RULE];
298
299 xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
300 if (get_chainname_rulenum(iter, e, hookname,
301 &chainname, &comment, &rulenum) != 0)
302 break;
303
304 nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
305 "TRACE: %s:%s:%s:%u ",
306 tablename, chainname, comment, rulenum);
307 }
308 #endif
309
310 static inline __pure
311 struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
312 {
313 return (void *)entry + entry->next_offset;
314 }
315
316 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
317 unsigned int
318 ipt_do_table(struct sk_buff *skb,
319 unsigned int hook,
320 const struct net_device *in,
321 const struct net_device *out,
322 struct xt_table *table)
323 {
324 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
325 const struct iphdr *ip;
326 bool hotdrop = false;
327 /* Initializing verdict to NF_DROP keeps gcc happy. */
328 unsigned int verdict = NF_DROP;
329 const char *indev, *outdev;
330 const void *table_base;
331 struct ipt_entry *e, **jumpstack;
332 unsigned int *stackptr, origptr, cpu;
333 const struct xt_table_info *private;
334 struct xt_match_param mtpar;
335 struct xt_target_param tgpar;
336
337 /* Initialization */
338 ip = ip_hdr(skb);
339 indev = in ? in->name : nulldevname;
340 outdev = out ? out->name : nulldevname;
341 /* We handle fragments by dealing with the first fragment as
342 * if it was a normal packet. All other fragments are treated
343 * normally, except that they will NEVER match rules that ask
344 * things we don't know, ie. tcp syn flag or ports). If the
345 * rule is also a fragment-specific rule, non-fragments won't
346 * match it. */
347 mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
348 mtpar.thoff = ip_hdrlen(skb);
349 mtpar.hotdrop = &hotdrop;
350 mtpar.in = tgpar.in = in;
351 mtpar.out = tgpar.out = out;
352 mtpar.family = tgpar.family = NFPROTO_IPV4;
353 mtpar.hooknum = tgpar.hooknum = hook;
354
355 IP_NF_ASSERT(table->valid_hooks & (1 << hook));
356 xt_info_rdlock_bh();
357 private = table->private;
358 cpu = smp_processor_id();
359 table_base = private->entries[cpu];
360 jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
361 stackptr = &private->stackptr[cpu];
362 origptr = *stackptr;
363
364 e = get_entry(table_base, private->hook_entry[hook]);
365
366 pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
367 table->name, hook, origptr,
368 get_entry(table_base, private->underflow[hook]));
369
370 do {
371 const struct ipt_entry_target *t;
372 const struct xt_entry_match *ematch;
373
374 IP_NF_ASSERT(e);
375 if (!ip_packet_match(ip, indev, outdev,
376 &e->ip, mtpar.fragoff)) {
377 no_match:
378 e = ipt_next_entry(e);
379 continue;
380 }
381
382 xt_ematch_foreach(ematch, e)
383 if (do_match(ematch, skb, &mtpar) != 0)
384 goto no_match;
385
386 ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
387
388 t = ipt_get_target(e);
389 IP_NF_ASSERT(t->u.kernel.target);
390
391 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
392 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
393 /* The packet is traced: log it */
394 if (unlikely(skb->nf_trace))
395 trace_packet(skb, hook, in, out,
396 table->name, private, e);
397 #endif
398 /* Standard target? */
399 if (!t->u.kernel.target->target) {
400 int v;
401
402 v = ((struct ipt_standard_target *)t)->verdict;
403 if (v < 0) {
404 /* Pop from stack? */
405 if (v != IPT_RETURN) {
406 verdict = (unsigned)(-v) - 1;
407 break;
408 }
409 if (*stackptr == 0) {
410 e = get_entry(table_base,
411 private->underflow[hook]);
412 pr_debug("Underflow (this is normal) "
413 "to %p\n", e);
414 } else {
415 e = jumpstack[--*stackptr];
416 pr_debug("Pulled %p out from pos %u\n",
417 e, *stackptr);
418 e = ipt_next_entry(e);
419 }
420 continue;
421 }
422 if (table_base + v != ipt_next_entry(e) &&
423 !(e->ip.flags & IPT_F_GOTO)) {
424 if (*stackptr >= private->stacksize) {
425 verdict = NF_DROP;
426 break;
427 }
428 jumpstack[(*stackptr)++] = e;
429 pr_debug("Pushed %p into pos %u\n",
430 e, *stackptr - 1);
431 }
432
433 e = get_entry(table_base, v);
434 continue;
435 }
436
437 tgpar.target = t->u.kernel.target;
438 tgpar.targinfo = t->data;
439
440
441 verdict = t->u.kernel.target->target(skb, &tgpar);
442 /* Target might have changed stuff. */
443 ip = ip_hdr(skb);
444 if (verdict == IPT_CONTINUE)
445 e = ipt_next_entry(e);
446 else
447 /* Verdict */
448 break;
449 } while (!hotdrop);
450 xt_info_rdunlock_bh();
451 pr_debug("Exiting %s; resetting sp from %u to %u\n",
452 __func__, *stackptr, origptr);
453 *stackptr = origptr;
454 #ifdef DEBUG_ALLOW_ALL
455 return NF_ACCEPT;
456 #else
457 if (hotdrop)
458 return NF_DROP;
459 else return verdict;
460 #endif
461 }
462
463 /* Figures out from what hook each rule can be called: returns 0 if
464 there are loops. Puts hook bitmask in comefrom. */
465 static int
466 mark_source_chains(const struct xt_table_info *newinfo,
467 unsigned int valid_hooks, void *entry0)
468 {
469 unsigned int hook;
470
471 /* No recursion; use packet counter to save back ptrs (reset
472 to 0 as we leave), and comefrom to save source hook bitmask */
473 for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
474 unsigned int pos = newinfo->hook_entry[hook];
475 struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
476
477 if (!(valid_hooks & (1 << hook)))
478 continue;
479
480 /* Set initial back pointer. */
481 e->counters.pcnt = pos;
482
483 for (;;) {
484 const struct ipt_standard_target *t
485 = (void *)ipt_get_target_c(e);
486 int visited = e->comefrom & (1 << hook);
487
488 if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
489 printk("iptables: loop hook %u pos %u %08X.\n",
490 hook, pos, e->comefrom);
491 return 0;
492 }
493 e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
494
495 /* Unconditional return/END. */
496 if ((e->target_offset == sizeof(struct ipt_entry) &&
497 (strcmp(t->target.u.user.name,
498 IPT_STANDARD_TARGET) == 0) &&
499 t->verdict < 0 && unconditional(&e->ip)) ||
500 visited) {
501 unsigned int oldpos, size;
502
503 if ((strcmp(t->target.u.user.name,
504 IPT_STANDARD_TARGET) == 0) &&
505 t->verdict < -NF_MAX_VERDICT - 1) {
506 duprintf("mark_source_chains: bad "
507 "negative verdict (%i)\n",
508 t->verdict);
509 return 0;
510 }
511
512 /* Return: backtrack through the last
513 big jump. */
514 do {
515 e->comefrom ^= (1<<NF_INET_NUMHOOKS);
516 #ifdef DEBUG_IP_FIREWALL_USER
517 if (e->comefrom
518 & (1 << NF_INET_NUMHOOKS)) {
519 duprintf("Back unset "
520 "on hook %u "
521 "rule %u\n",
522 hook, pos);
523 }
524 #endif
525 oldpos = pos;
526 pos = e->counters.pcnt;
527 e->counters.pcnt = 0;
528
529 /* We're at the start. */
530 if (pos == oldpos)
531 goto next;
532
533 e = (struct ipt_entry *)
534 (entry0 + pos);
535 } while (oldpos == pos + e->next_offset);
536
537 /* Move along one */
538 size = e->next_offset;
539 e = (struct ipt_entry *)
540 (entry0 + pos + size);
541 e->counters.pcnt = pos;
542 pos += size;
543 } else {
544 int newpos = t->verdict;
545
546 if (strcmp(t->target.u.user.name,
547 IPT_STANDARD_TARGET) == 0 &&
548 newpos >= 0) {
549 if (newpos > newinfo->size -
550 sizeof(struct ipt_entry)) {
551 duprintf("mark_source_chains: "
552 "bad verdict (%i)\n",
553 newpos);
554 return 0;
555 }
556 /* This a jump; chase it. */
557 duprintf("Jump rule %u -> %u\n",
558 pos, newpos);
559 } else {
560 /* ... this is a fallthru */
561 newpos = pos + e->next_offset;
562 }
563 e = (struct ipt_entry *)
564 (entry0 + newpos);
565 e->counters.pcnt = pos;
566 pos = newpos;
567 }
568 }
569 next:
570 duprintf("Finished chain %u\n", hook);
571 }
572 return 1;
573 }
574
575 static void cleanup_match(struct ipt_entry_match *m, struct net *net)
576 {
577 struct xt_mtdtor_param par;
578
579 par.net = net;
580 par.match = m->u.kernel.match;
581 par.matchinfo = m->data;
582 par.family = NFPROTO_IPV4;
583 if (par.match->destroy != NULL)
584 par.match->destroy(&par);
585 module_put(par.match->me);
586 }
587
588 static int
589 check_entry(const struct ipt_entry *e, const char *name)
590 {
591 const struct ipt_entry_target *t;
592
593 if (!ip_checkentry(&e->ip)) {
594 duprintf("ip check failed %p %s.\n", e, name);
595 return -EINVAL;
596 }
597
598 if (e->target_offset + sizeof(struct ipt_entry_target) >
599 e->next_offset)
600 return -EINVAL;
601
602 t = ipt_get_target_c(e);
603 if (e->target_offset + t->u.target_size > e->next_offset)
604 return -EINVAL;
605
606 return 0;
607 }
608
609 static int
610 check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
611 {
612 const struct ipt_ip *ip = par->entryinfo;
613 int ret;
614
615 par->match = m->u.kernel.match;
616 par->matchinfo = m->data;
617
618 ret = xt_check_match(par, m->u.match_size - sizeof(*m),
619 ip->proto, ip->invflags & IPT_INV_PROTO);
620 if (ret < 0) {
621 duprintf("check failed for `%s'.\n", par.match->name);
622 return ret;
623 }
624 return 0;
625 }
626
627 static int
628 find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
629 {
630 struct xt_match *match;
631 int ret;
632
633 match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
634 m->u.user.revision);
635 if (IS_ERR(match)) {
636 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
637 return PTR_ERR(match);
638 }
639 m->u.kernel.match = match;
640
641 ret = check_match(m, par);
642 if (ret)
643 goto err;
644
645 return 0;
646 err:
647 module_put(m->u.kernel.match->me);
648 return ret;
649 }
650
651 static int check_target(struct ipt_entry *e, struct net *net, const char *name)
652 {
653 struct ipt_entry_target *t = ipt_get_target(e);
654 struct xt_tgchk_param par = {
655 .net = net,
656 .table = name,
657 .entryinfo = e,
658 .target = t->u.kernel.target,
659 .targinfo = t->data,
660 .hook_mask = e->comefrom,
661 .family = NFPROTO_IPV4,
662 };
663 int ret;
664
665 ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
666 e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
667 if (ret < 0) {
668 duprintf("check failed for `%s'.\n",
669 t->u.kernel.target->name);
670 return ret;
671 }
672 return 0;
673 }
674
675 static int
676 find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
677 unsigned int size)
678 {
679 struct ipt_entry_target *t;
680 struct xt_target *target;
681 int ret;
682 unsigned int j;
683 struct xt_mtchk_param mtpar;
684 struct xt_entry_match *ematch;
685
686 ret = check_entry(e, name);
687 if (ret)
688 return ret;
689
690 j = 0;
691 mtpar.net = net;
692 mtpar.table = name;
693 mtpar.entryinfo = &e->ip;
694 mtpar.hook_mask = e->comefrom;
695 mtpar.family = NFPROTO_IPV4;
696 xt_ematch_foreach(ematch, e) {
697 ret = find_check_match(ematch, &mtpar);
698 if (ret != 0)
699 goto cleanup_matches;
700 ++j;
701 }
702
703 t = ipt_get_target(e);
704 target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
705 t->u.user.revision);
706 if (IS_ERR(target)) {
707 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
708 ret = PTR_ERR(target);
709 goto cleanup_matches;
710 }
711 t->u.kernel.target = target;
712
713 ret = check_target(e, net, name);
714 if (ret)
715 goto err;
716 return 0;
717 err:
718 module_put(t->u.kernel.target->me);
719 cleanup_matches:
720 xt_ematch_foreach(ematch, e) {
721 if (j-- == 0)
722 break;
723 cleanup_match(ematch, net);
724 }
725 return ret;
726 }
727
728 static bool check_underflow(const struct ipt_entry *e)
729 {
730 const struct ipt_entry_target *t;
731 unsigned int verdict;
732
733 if (!unconditional(&e->ip))
734 return false;
735 t = ipt_get_target_c(e);
736 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
737 return false;
738 verdict = ((struct ipt_standard_target *)t)->verdict;
739 verdict = -verdict - 1;
740 return verdict == NF_DROP || verdict == NF_ACCEPT;
741 }
742
743 static int
744 check_entry_size_and_hooks(struct ipt_entry *e,
745 struct xt_table_info *newinfo,
746 const unsigned char *base,
747 const unsigned char *limit,
748 const unsigned int *hook_entries,
749 const unsigned int *underflows,
750 unsigned int valid_hooks)
751 {
752 unsigned int h;
753
754 if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
755 (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
756 duprintf("Bad offset %p\n", e);
757 return -EINVAL;
758 }
759
760 if (e->next_offset
761 < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
762 duprintf("checking: element %p size %u\n",
763 e, e->next_offset);
764 return -EINVAL;
765 }
766
767 /* Check hooks & underflows */
768 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
769 if (!(valid_hooks & (1 << h)))
770 continue;
771 if ((unsigned char *)e - base == hook_entries[h])
772 newinfo->hook_entry[h] = hook_entries[h];
773 if ((unsigned char *)e - base == underflows[h]) {
774 if (!check_underflow(e)) {
775 pr_err("Underflows must be unconditional and "
776 "use the STANDARD target with "
777 "ACCEPT/DROP\n");
778 return -EINVAL;
779 }
780 newinfo->underflow[h] = underflows[h];
781 }
782 }
783
784 /* Clear counters and comefrom */
785 e->counters = ((struct xt_counters) { 0, 0 });
786 e->comefrom = 0;
787 return 0;
788 }
789
790 static void
791 cleanup_entry(struct ipt_entry *e, struct net *net)
792 {
793 struct xt_tgdtor_param par;
794 struct ipt_entry_target *t;
795 struct xt_entry_match *ematch;
796
797 /* Cleanup all matches */
798 xt_ematch_foreach(ematch, e)
799 cleanup_match(ematch, net);
800 t = ipt_get_target(e);
801
802 par.net = net;
803 par.target = t->u.kernel.target;
804 par.targinfo = t->data;
805 par.family = NFPROTO_IPV4;
806 if (par.target->destroy != NULL)
807 par.target->destroy(&par);
808 module_put(par.target->me);
809 }
810
811 /* Checks and translates the user-supplied table segment (held in
812 newinfo) */
813 static int
814 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
815 const struct ipt_replace *repl)
816 {
817 struct ipt_entry *iter;
818 unsigned int i;
819 int ret = 0;
820
821 newinfo->size = repl->size;
822 newinfo->number = repl->num_entries;
823
824 /* Init all hooks to impossible value. */
825 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
826 newinfo->hook_entry[i] = 0xFFFFFFFF;
827 newinfo->underflow[i] = 0xFFFFFFFF;
828 }
829
830 duprintf("translate_table: size %u\n", newinfo->size);
831 i = 0;
832 /* Walk through entries, checking offsets. */
833 xt_entry_foreach(iter, entry0, newinfo->size) {
834 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
835 entry0 + repl->size,
836 repl->hook_entry,
837 repl->underflow,
838 repl->valid_hooks);
839 if (ret != 0)
840 return ret;
841 ++i;
842 if (strcmp(ipt_get_target(iter)->u.user.name,
843 XT_ERROR_TARGET) == 0)
844 ++newinfo->stacksize;
845 }
846
847 if (i != repl->num_entries) {
848 duprintf("translate_table: %u not %u entries\n",
849 i, repl->num_entries);
850 return -EINVAL;
851 }
852
853 /* Check hooks all assigned */
854 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
855 /* Only hooks which are valid */
856 if (!(repl->valid_hooks & (1 << i)))
857 continue;
858 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
859 duprintf("Invalid hook entry %u %u\n",
860 i, repl->hook_entry[i]);
861 return -EINVAL;
862 }
863 if (newinfo->underflow[i] == 0xFFFFFFFF) {
864 duprintf("Invalid underflow %u %u\n",
865 i, repl->underflow[i]);
866 return -EINVAL;
867 }
868 }
869
870 if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
871 return -ELOOP;
872
873 /* Finally, each sanity check must pass */
874 i = 0;
875 xt_entry_foreach(iter, entry0, newinfo->size) {
876 ret = find_check_entry(iter, net, repl->name, repl->size);
877 if (ret != 0)
878 break;
879 ++i;
880 }
881
882 if (ret != 0) {
883 xt_entry_foreach(iter, entry0, newinfo->size) {
884 if (i-- == 0)
885 break;
886 cleanup_entry(iter, net);
887 }
888 return ret;
889 }
890
891 /* And one copy for every other CPU */
892 for_each_possible_cpu(i) {
893 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
894 memcpy(newinfo->entries[i], entry0, newinfo->size);
895 }
896
897 return ret;
898 }
899
900 static void
901 get_counters(const struct xt_table_info *t,
902 struct xt_counters counters[])
903 {
904 struct ipt_entry *iter;
905 unsigned int cpu;
906 unsigned int i;
907 unsigned int curcpu;
908
909 /* Instead of clearing (by a previous call to memset())
910 * the counters and using adds, we set the counters
911 * with data used by 'current' CPU.
912 *
913 * Bottom half has to be disabled to prevent deadlock
914 * if new softirq were to run and call ipt_do_table
915 */
916 local_bh_disable();
917 curcpu = smp_processor_id();
918
919 i = 0;
920 xt_entry_foreach(iter, t->entries[curcpu], t->size) {
921 SET_COUNTER(counters[i], iter->counters.bcnt,
922 iter->counters.pcnt);
923 ++i;
924 }
925
926 for_each_possible_cpu(cpu) {
927 if (cpu == curcpu)
928 continue;
929 i = 0;
930 xt_info_wrlock(cpu);
931 xt_entry_foreach(iter, t->entries[cpu], t->size) {
932 ADD_COUNTER(counters[i], iter->counters.bcnt,
933 iter->counters.pcnt);
934 ++i; /* macro does multi eval of i */
935 }
936 xt_info_wrunlock(cpu);
937 }
938 local_bh_enable();
939 }
940
941 static struct xt_counters *alloc_counters(const struct xt_table *table)
942 {
943 unsigned int countersize;
944 struct xt_counters *counters;
945 const struct xt_table_info *private = table->private;
946
947 /* We need atomic snapshot of counters: rest doesn't change
948 (other than comefrom, which userspace doesn't care
949 about). */
950 countersize = sizeof(struct xt_counters) * private->number;
951 counters = vmalloc_node(countersize, numa_node_id());
952
953 if (counters == NULL)
954 return ERR_PTR(-ENOMEM);
955
956 get_counters(private, counters);
957
958 return counters;
959 }
960
961 static int
962 copy_entries_to_user(unsigned int total_size,
963 const struct xt_table *table,
964 void __user *userptr)
965 {
966 unsigned int off, num;
967 const struct ipt_entry *e;
968 struct xt_counters *counters;
969 const struct xt_table_info *private = table->private;
970 int ret = 0;
971 const void *loc_cpu_entry;
972
973 counters = alloc_counters(table);
974 if (IS_ERR(counters))
975 return PTR_ERR(counters);
976
977 /* choose the copy that is on our node/cpu, ...
978 * This choice is lazy (because current thread is
979 * allowed to migrate to another cpu)
980 */
981 loc_cpu_entry = private->entries[raw_smp_processor_id()];
982 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
983 ret = -EFAULT;
984 goto free_counters;
985 }
986
987 /* FIXME: use iterator macros --RR */
988 /* ... then go back and fix counters and names */
989 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
990 unsigned int i;
991 const struct ipt_entry_match *m;
992 const struct ipt_entry_target *t;
993
994 e = (struct ipt_entry *)(loc_cpu_entry + off);
995 if (copy_to_user(userptr + off
996 + offsetof(struct ipt_entry, counters),
997 &counters[num],
998 sizeof(counters[num])) != 0) {
999 ret = -EFAULT;
1000 goto free_counters;
1001 }
1002
1003 for (i = sizeof(struct ipt_entry);
1004 i < e->target_offset;
1005 i += m->u.match_size) {
1006 m = (void *)e + i;
1007
1008 if (copy_to_user(userptr + off + i
1009 + offsetof(struct ipt_entry_match,
1010 u.user.name),
1011 m->u.kernel.match->name,
1012 strlen(m->u.kernel.match->name)+1)
1013 != 0) {
1014 ret = -EFAULT;
1015 goto free_counters;
1016 }
1017 }
1018
1019 t = ipt_get_target_c(e);
1020 if (copy_to_user(userptr + off + e->target_offset
1021 + offsetof(struct ipt_entry_target,
1022 u.user.name),
1023 t->u.kernel.target->name,
1024 strlen(t->u.kernel.target->name)+1) != 0) {
1025 ret = -EFAULT;
1026 goto free_counters;
1027 }
1028 }
1029
1030 free_counters:
1031 vfree(counters);
1032 return ret;
1033 }
1034
1035 #ifdef CONFIG_COMPAT
1036 static void compat_standard_from_user(void *dst, const void *src)
1037 {
1038 int v = *(compat_int_t *)src;
1039
1040 if (v > 0)
1041 v += xt_compat_calc_jump(AF_INET, v);
1042 memcpy(dst, &v, sizeof(v));
1043 }
1044
1045 static int compat_standard_to_user(void __user *dst, const void *src)
1046 {
1047 compat_int_t cv = *(int *)src;
1048
1049 if (cv > 0)
1050 cv -= xt_compat_calc_jump(AF_INET, cv);
1051 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1052 }
1053
1054 static int compat_calc_entry(const struct ipt_entry *e,
1055 const struct xt_table_info *info,
1056 const void *base, struct xt_table_info *newinfo)
1057 {
1058 const struct xt_entry_match *ematch;
1059 const struct ipt_entry_target *t;
1060 unsigned int entry_offset;
1061 int off, i, ret;
1062
1063 off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1064 entry_offset = (void *)e - base;
1065 xt_ematch_foreach(ematch, e)
1066 off += xt_compat_match_offset(ematch->u.kernel.match);
1067 t = ipt_get_target_c(e);
1068 off += xt_compat_target_offset(t->u.kernel.target);
1069 newinfo->size -= off;
1070 ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1071 if (ret)
1072 return ret;
1073
1074 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1075 if (info->hook_entry[i] &&
1076 (e < (struct ipt_entry *)(base + info->hook_entry[i])))
1077 newinfo->hook_entry[i] -= off;
1078 if (info->underflow[i] &&
1079 (e < (struct ipt_entry *)(base + info->underflow[i])))
1080 newinfo->underflow[i] -= off;
1081 }
1082 return 0;
1083 }
1084
1085 static int compat_table_info(const struct xt_table_info *info,
1086 struct xt_table_info *newinfo)
1087 {
1088 struct ipt_entry *iter;
1089 void *loc_cpu_entry;
1090 int ret;
1091
1092 if (!newinfo || !info)
1093 return -EINVAL;
1094
1095 /* we dont care about newinfo->entries[] */
1096 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1097 newinfo->initial_entries = 0;
1098 loc_cpu_entry = info->entries[raw_smp_processor_id()];
1099 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1100 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1101 if (ret != 0)
1102 return ret;
1103 }
1104 return 0;
1105 }
1106 #endif
1107
1108 static int get_info(struct net *net, void __user *user,
1109 const int *len, int compat)
1110 {
1111 char name[IPT_TABLE_MAXNAMELEN];
1112 struct xt_table *t;
1113 int ret;
1114
1115 if (*len != sizeof(struct ipt_getinfo)) {
1116 duprintf("length %u != %zu\n", *len,
1117 sizeof(struct ipt_getinfo));
1118 return -EINVAL;
1119 }
1120
1121 if (copy_from_user(name, user, sizeof(name)) != 0)
1122 return -EFAULT;
1123
1124 name[IPT_TABLE_MAXNAMELEN-1] = '\0';
1125 #ifdef CONFIG_COMPAT
1126 if (compat)
1127 xt_compat_lock(AF_INET);
1128 #endif
1129 t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1130 "iptable_%s", name);
1131 if (t && !IS_ERR(t)) {
1132 struct ipt_getinfo info;
1133 const struct xt_table_info *private = t->private;
1134 #ifdef CONFIG_COMPAT
1135 struct xt_table_info tmp;
1136
1137 if (compat) {
1138 ret = compat_table_info(private, &tmp);
1139 xt_compat_flush_offsets(AF_INET);
1140 private = &tmp;
1141 }
1142 #endif
1143 info.valid_hooks = t->valid_hooks;
1144 memcpy(info.hook_entry, private->hook_entry,
1145 sizeof(info.hook_entry));
1146 memcpy(info.underflow, private->underflow,
1147 sizeof(info.underflow));
1148 info.num_entries = private->number;
1149 info.size = private->size;
1150 strcpy(info.name, name);
1151
1152 if (copy_to_user(user, &info, *len) != 0)
1153 ret = -EFAULT;
1154 else
1155 ret = 0;
1156
1157 xt_table_unlock(t);
1158 module_put(t->me);
1159 } else
1160 ret = t ? PTR_ERR(t) : -ENOENT;
1161 #ifdef CONFIG_COMPAT
1162 if (compat)
1163 xt_compat_unlock(AF_INET);
1164 #endif
1165 return ret;
1166 }
1167
1168 static int
1169 get_entries(struct net *net, struct ipt_get_entries __user *uptr,
1170 const int *len)
1171 {
1172 int ret;
1173 struct ipt_get_entries get;
1174 struct xt_table *t;
1175
1176 if (*len < sizeof(get)) {
1177 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1178 return -EINVAL;
1179 }
1180 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1181 return -EFAULT;
1182 if (*len != sizeof(struct ipt_get_entries) + get.size) {
1183 duprintf("get_entries: %u != %zu\n",
1184 *len, sizeof(get) + get.size);
1185 return -EINVAL;
1186 }
1187
1188 t = xt_find_table_lock(net, AF_INET, get.name);
1189 if (t && !IS_ERR(t)) {
1190 const struct xt_table_info *private = t->private;
1191 duprintf("t->private->number = %u\n", private->number);
1192 if (get.size == private->size)
1193 ret = copy_entries_to_user(private->size,
1194 t, uptr->entrytable);
1195 else {
1196 duprintf("get_entries: I've got %u not %u!\n",
1197 private->size, get.size);
1198 ret = -EAGAIN;
1199 }
1200 module_put(t->me);
1201 xt_table_unlock(t);
1202 } else
1203 ret = t ? PTR_ERR(t) : -ENOENT;
1204
1205 return ret;
1206 }
1207
1208 static int
1209 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1210 struct xt_table_info *newinfo, unsigned int num_counters,
1211 void __user *counters_ptr)
1212 {
1213 int ret;
1214 struct xt_table *t;
1215 struct xt_table_info *oldinfo;
1216 struct xt_counters *counters;
1217 void *loc_cpu_old_entry;
1218 struct ipt_entry *iter;
1219
1220 ret = 0;
1221 counters = vmalloc(num_counters * sizeof(struct xt_counters));
1222 if (!counters) {
1223 ret = -ENOMEM;
1224 goto out;
1225 }
1226
1227 t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1228 "iptable_%s", name);
1229 if (!t || IS_ERR(t)) {
1230 ret = t ? PTR_ERR(t) : -ENOENT;
1231 goto free_newinfo_counters_untrans;
1232 }
1233
1234 /* You lied! */
1235 if (valid_hooks != t->valid_hooks) {
1236 duprintf("Valid hook crap: %08X vs %08X\n",
1237 valid_hooks, t->valid_hooks);
1238 ret = -EINVAL;
1239 goto put_module;
1240 }
1241
1242 oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1243 if (!oldinfo)
1244 goto put_module;
1245
1246 /* Update module usage count based on number of rules */
1247 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1248 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1249 if ((oldinfo->number > oldinfo->initial_entries) ||
1250 (newinfo->number <= oldinfo->initial_entries))
1251 module_put(t->me);
1252 if ((oldinfo->number > oldinfo->initial_entries) &&
1253 (newinfo->number <= oldinfo->initial_entries))
1254 module_put(t->me);
1255
1256 /* Get the old counters, and synchronize with replace */
1257 get_counters(oldinfo, counters);
1258
1259 /* Decrease module usage counts and free resource */
1260 loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1261 xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1262 cleanup_entry(iter, net);
1263
1264 xt_free_table_info(oldinfo);
1265 if (copy_to_user(counters_ptr, counters,
1266 sizeof(struct xt_counters) * num_counters) != 0)
1267 ret = -EFAULT;
1268 vfree(counters);
1269 xt_table_unlock(t);
1270 return ret;
1271
1272 put_module:
1273 module_put(t->me);
1274 xt_table_unlock(t);
1275 free_newinfo_counters_untrans:
1276 vfree(counters);
1277 out:
1278 return ret;
1279 }
1280
1281 static int
1282 do_replace(struct net *net, const void __user *user, unsigned int len)
1283 {
1284 int ret;
1285 struct ipt_replace tmp;
1286 struct xt_table_info *newinfo;
1287 void *loc_cpu_entry;
1288 struct ipt_entry *iter;
1289
1290 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1291 return -EFAULT;
1292
1293 /* overflow check */
1294 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1295 return -ENOMEM;
1296
1297 newinfo = xt_alloc_table_info(tmp.size);
1298 if (!newinfo)
1299 return -ENOMEM;
1300
1301 /* choose the copy that is on our node/cpu */
1302 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1303 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1304 tmp.size) != 0) {
1305 ret = -EFAULT;
1306 goto free_newinfo;
1307 }
1308
1309 ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1310 if (ret != 0)
1311 goto free_newinfo;
1312
1313 duprintf("Translated table\n");
1314
1315 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1316 tmp.num_counters, tmp.counters);
1317 if (ret)
1318 goto free_newinfo_untrans;
1319 return 0;
1320
1321 free_newinfo_untrans:
1322 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1323 cleanup_entry(iter, net);
1324 free_newinfo:
1325 xt_free_table_info(newinfo);
1326 return ret;
1327 }
1328
1329 static int
1330 do_add_counters(struct net *net, const void __user *user,
1331 unsigned int len, int compat)
1332 {
1333 unsigned int i, curcpu;
1334 struct xt_counters_info tmp;
1335 struct xt_counters *paddc;
1336 unsigned int num_counters;
1337 const char *name;
1338 int size;
1339 void *ptmp;
1340 struct xt_table *t;
1341 const struct xt_table_info *private;
1342 int ret = 0;
1343 void *loc_cpu_entry;
1344 struct ipt_entry *iter;
1345 #ifdef CONFIG_COMPAT
1346 struct compat_xt_counters_info compat_tmp;
1347
1348 if (compat) {
1349 ptmp = &compat_tmp;
1350 size = sizeof(struct compat_xt_counters_info);
1351 } else
1352 #endif
1353 {
1354 ptmp = &tmp;
1355 size = sizeof(struct xt_counters_info);
1356 }
1357
1358 if (copy_from_user(ptmp, user, size) != 0)
1359 return -EFAULT;
1360
1361 #ifdef CONFIG_COMPAT
1362 if (compat) {
1363 num_counters = compat_tmp.num_counters;
1364 name = compat_tmp.name;
1365 } else
1366 #endif
1367 {
1368 num_counters = tmp.num_counters;
1369 name = tmp.name;
1370 }
1371
1372 if (len != size + num_counters * sizeof(struct xt_counters))
1373 return -EINVAL;
1374
1375 paddc = vmalloc_node(len - size, numa_node_id());
1376 if (!paddc)
1377 return -ENOMEM;
1378
1379 if (copy_from_user(paddc, user + size, len - size) != 0) {
1380 ret = -EFAULT;
1381 goto free;
1382 }
1383
1384 t = xt_find_table_lock(net, AF_INET, name);
1385 if (!t || IS_ERR(t)) {
1386 ret = t ? PTR_ERR(t) : -ENOENT;
1387 goto free;
1388 }
1389
1390 local_bh_disable();
1391 private = t->private;
1392 if (private->number != num_counters) {
1393 ret = -EINVAL;
1394 goto unlock_up_free;
1395 }
1396
1397 i = 0;
1398 /* Choose the copy that is on our node */
1399 curcpu = smp_processor_id();
1400 loc_cpu_entry = private->entries[curcpu];
1401 xt_info_wrlock(curcpu);
1402 xt_entry_foreach(iter, loc_cpu_entry, private->size) {
1403 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
1404 ++i;
1405 }
1406 xt_info_wrunlock(curcpu);
1407 unlock_up_free:
1408 local_bh_enable();
1409 xt_table_unlock(t);
1410 module_put(t->me);
1411 free:
1412 vfree(paddc);
1413
1414 return ret;
1415 }
1416
1417 #ifdef CONFIG_COMPAT
1418 struct compat_ipt_replace {
1419 char name[IPT_TABLE_MAXNAMELEN];
1420 u32 valid_hooks;
1421 u32 num_entries;
1422 u32 size;
1423 u32 hook_entry[NF_INET_NUMHOOKS];
1424 u32 underflow[NF_INET_NUMHOOKS];
1425 u32 num_counters;
1426 compat_uptr_t counters; /* struct ipt_counters * */
1427 struct compat_ipt_entry entries[0];
1428 };
1429
1430 static int
1431 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1432 unsigned int *size, struct xt_counters *counters,
1433 unsigned int i)
1434 {
1435 struct ipt_entry_target *t;
1436 struct compat_ipt_entry __user *ce;
1437 u_int16_t target_offset, next_offset;
1438 compat_uint_t origsize;
1439 const struct xt_entry_match *ematch;
1440 int ret = 0;
1441
1442 origsize = *size;
1443 ce = (struct compat_ipt_entry __user *)*dstptr;
1444 if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
1445 copy_to_user(&ce->counters, &counters[i],
1446 sizeof(counters[i])) != 0)
1447 return -EFAULT;
1448
1449 *dstptr += sizeof(struct compat_ipt_entry);
1450 *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1451
1452 xt_ematch_foreach(ematch, e) {
1453 ret = xt_compat_match_to_user(ematch, dstptr, size);
1454 if (ret != 0)
1455 return ret;
1456 }
1457 target_offset = e->target_offset - (origsize - *size);
1458 t = ipt_get_target(e);
1459 ret = xt_compat_target_to_user(t, dstptr, size);
1460 if (ret)
1461 return ret;
1462 next_offset = e->next_offset - (origsize - *size);
1463 if (put_user(target_offset, &ce->target_offset) != 0 ||
1464 put_user(next_offset, &ce->next_offset) != 0)
1465 return -EFAULT;
1466 return 0;
1467 }
1468
1469 static int
1470 compat_find_calc_match(struct ipt_entry_match *m,
1471 const char *name,
1472 const struct ipt_ip *ip,
1473 unsigned int hookmask,
1474 int *size)
1475 {
1476 struct xt_match *match;
1477
1478 match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
1479 m->u.user.revision);
1480 if (IS_ERR(match)) {
1481 duprintf("compat_check_calc_match: `%s' not found\n",
1482 m->u.user.name);
1483 return PTR_ERR(match);
1484 }
1485 m->u.kernel.match = match;
1486 *size += xt_compat_match_offset(match);
1487 return 0;
1488 }
1489
1490 static void compat_release_entry(struct compat_ipt_entry *e)
1491 {
1492 struct ipt_entry_target *t;
1493 struct xt_entry_match *ematch;
1494
1495 /* Cleanup all matches */
1496 xt_ematch_foreach(ematch, e)
1497 module_put(ematch->u.kernel.match->me);
1498 t = compat_ipt_get_target(e);
1499 module_put(t->u.kernel.target->me);
1500 }
1501
1502 static int
1503 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1504 struct xt_table_info *newinfo,
1505 unsigned int *size,
1506 const unsigned char *base,
1507 const unsigned char *limit,
1508 const unsigned int *hook_entries,
1509 const unsigned int *underflows,
1510 const char *name)
1511 {
1512 struct xt_entry_match *ematch;
1513 struct ipt_entry_target *t;
1514 struct xt_target *target;
1515 unsigned int entry_offset;
1516 unsigned int j;
1517 int ret, off, h;
1518
1519 duprintf("check_compat_entry_size_and_hooks %p\n", e);
1520 if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
1521 (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1522 duprintf("Bad offset %p, limit = %p\n", e, limit);
1523 return -EINVAL;
1524 }
1525
1526 if (e->next_offset < sizeof(struct compat_ipt_entry) +
1527 sizeof(struct compat_xt_entry_target)) {
1528 duprintf("checking: element %p size %u\n",
1529 e, e->next_offset);
1530 return -EINVAL;
1531 }
1532
1533 /* For purposes of check_entry casting the compat entry is fine */
1534 ret = check_entry((struct ipt_entry *)e, name);
1535 if (ret)
1536 return ret;
1537
1538 off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1539 entry_offset = (void *)e - (void *)base;
1540 j = 0;
1541 xt_ematch_foreach(ematch, e) {
1542 ret = compat_find_calc_match(ematch, name,
1543 &e->ip, e->comefrom, &off);
1544 if (ret != 0)
1545 goto release_matches;
1546 ++j;
1547 }
1548
1549 t = compat_ipt_get_target(e);
1550 target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
1551 t->u.user.revision);
1552 if (IS_ERR(target)) {
1553 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1554 t->u.user.name);
1555 ret = PTR_ERR(target);
1556 goto release_matches;
1557 }
1558 t->u.kernel.target = target;
1559
1560 off += xt_compat_target_offset(target);
1561 *size += off;
1562 ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1563 if (ret)
1564 goto out;
1565
1566 /* Check hooks & underflows */
1567 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1568 if ((unsigned char *)e - base == hook_entries[h])
1569 newinfo->hook_entry[h] = hook_entries[h];
1570 if ((unsigned char *)e - base == underflows[h])
1571 newinfo->underflow[h] = underflows[h];
1572 }
1573
1574 /* Clear counters and comefrom */
1575 memset(&e->counters, 0, sizeof(e->counters));
1576 e->comefrom = 0;
1577 return 0;
1578
1579 out:
1580 module_put(t->u.kernel.target->me);
1581 release_matches:
1582 xt_ematch_foreach(ematch, e) {
1583 if (j-- == 0)
1584 break;
1585 module_put(ematch->u.kernel.match->me);
1586 }
1587 return ret;
1588 }
1589
1590 static int
1591 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1592 unsigned int *size, const char *name,
1593 struct xt_table_info *newinfo, unsigned char *base)
1594 {
1595 struct ipt_entry_target *t;
1596 struct xt_target *target;
1597 struct ipt_entry *de;
1598 unsigned int origsize;
1599 int ret, h;
1600 struct xt_entry_match *ematch;
1601
1602 ret = 0;
1603 origsize = *size;
1604 de = (struct ipt_entry *)*dstptr;
1605 memcpy(de, e, sizeof(struct ipt_entry));
1606 memcpy(&de->counters, &e->counters, sizeof(e->counters));
1607
1608 *dstptr += sizeof(struct ipt_entry);
1609 *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1610
1611 xt_ematch_foreach(ematch, e) {
1612 ret = xt_compat_match_from_user(ematch, dstptr, size);
1613 if (ret != 0)
1614 return ret;
1615 }
1616 de->target_offset = e->target_offset - (origsize - *size);
1617 t = compat_ipt_get_target(e);
1618 target = t->u.kernel.target;
1619 xt_compat_target_from_user(t, dstptr, size);
1620
1621 de->next_offset = e->next_offset - (origsize - *size);
1622 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1623 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1624 newinfo->hook_entry[h] -= origsize - *size;
1625 if ((unsigned char *)de - base < newinfo->underflow[h])
1626 newinfo->underflow[h] -= origsize - *size;
1627 }
1628 return ret;
1629 }
1630
1631 static int
1632 compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
1633 {
1634 struct xt_entry_match *ematch;
1635 struct xt_mtchk_param mtpar;
1636 unsigned int j;
1637 int ret = 0;
1638
1639 j = 0;
1640 mtpar.net = net;
1641 mtpar.table = name;
1642 mtpar.entryinfo = &e->ip;
1643 mtpar.hook_mask = e->comefrom;
1644 mtpar.family = NFPROTO_IPV4;
1645 xt_ematch_foreach(ematch, e) {
1646 ret = check_match(ematch, &mtpar);
1647 if (ret != 0)
1648 goto cleanup_matches;
1649 ++j;
1650 }
1651
1652 ret = check_target(e, net, name);
1653 if (ret)
1654 goto cleanup_matches;
1655 return 0;
1656
1657 cleanup_matches:
1658 xt_ematch_foreach(ematch, e) {
1659 if (j-- == 0)
1660 break;
1661 cleanup_match(ematch, net);
1662 }
1663 return ret;
1664 }
1665
1666 static int
1667 translate_compat_table(struct net *net,
1668 const char *name,
1669 unsigned int valid_hooks,
1670 struct xt_table_info **pinfo,
1671 void **pentry0,
1672 unsigned int total_size,
1673 unsigned int number,
1674 unsigned int *hook_entries,
1675 unsigned int *underflows)
1676 {
1677 unsigned int i, j;
1678 struct xt_table_info *newinfo, *info;
1679 void *pos, *entry0, *entry1;
1680 struct compat_ipt_entry *iter0;
1681 struct ipt_entry *iter1;
1682 unsigned int size;
1683 int ret;
1684
1685 info = *pinfo;
1686 entry0 = *pentry0;
1687 size = total_size;
1688 info->number = number;
1689
1690 /* Init all hooks to impossible value. */
1691 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1692 info->hook_entry[i] = 0xFFFFFFFF;
1693 info->underflow[i] = 0xFFFFFFFF;
1694 }
1695
1696 duprintf("translate_compat_table: size %u\n", info->size);
1697 j = 0;
1698 xt_compat_lock(AF_INET);
1699 /* Walk through entries, checking offsets. */
1700 xt_entry_foreach(iter0, entry0, total_size) {
1701 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1702 entry0,
1703 entry0 + total_size,
1704 hook_entries,
1705 underflows,
1706 name);
1707 if (ret != 0)
1708 goto out_unlock;
1709 ++j;
1710 }
1711
1712 ret = -EINVAL;
1713 if (j != number) {
1714 duprintf("translate_compat_table: %u not %u entries\n",
1715 j, number);
1716 goto out_unlock;
1717 }
1718
1719 /* Check hooks all assigned */
1720 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1721 /* Only hooks which are valid */
1722 if (!(valid_hooks & (1 << i)))
1723 continue;
1724 if (info->hook_entry[i] == 0xFFFFFFFF) {
1725 duprintf("Invalid hook entry %u %u\n",
1726 i, hook_entries[i]);
1727 goto out_unlock;
1728 }
1729 if (info->underflow[i] == 0xFFFFFFFF) {
1730 duprintf("Invalid underflow %u %u\n",
1731 i, underflows[i]);
1732 goto out_unlock;
1733 }
1734 }
1735
1736 ret = -ENOMEM;
1737 newinfo = xt_alloc_table_info(size);
1738 if (!newinfo)
1739 goto out_unlock;
1740
1741 newinfo->number = number;
1742 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1743 newinfo->hook_entry[i] = info->hook_entry[i];
1744 newinfo->underflow[i] = info->underflow[i];
1745 }
1746 entry1 = newinfo->entries[raw_smp_processor_id()];
1747 pos = entry1;
1748 size = total_size;
1749 xt_entry_foreach(iter0, entry0, total_size) {
1750 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1751 name, newinfo, entry1);
1752 if (ret != 0)
1753 break;
1754 }
1755 xt_compat_flush_offsets(AF_INET);
1756 xt_compat_unlock(AF_INET);
1757 if (ret)
1758 goto free_newinfo;
1759
1760 ret = -ELOOP;
1761 if (!mark_source_chains(newinfo, valid_hooks, entry1))
1762 goto free_newinfo;
1763
1764 i = 0;
1765 xt_entry_foreach(iter1, entry1, newinfo->size) {
1766 ret = compat_check_entry(iter1, net, name);
1767 if (ret != 0)
1768 break;
1769 ++i;
1770 }
1771 if (ret) {
1772 /*
1773 * The first i matches need cleanup_entry (calls ->destroy)
1774 * because they had called ->check already. The other j-i
1775 * entries need only release.
1776 */
1777 int skip = i;
1778 j -= i;
1779 xt_entry_foreach(iter0, entry0, newinfo->size) {
1780 if (skip-- > 0)
1781 continue;
1782 if (j-- == 0)
1783 break;
1784 compat_release_entry(iter0);
1785 }
1786 xt_entry_foreach(iter1, entry1, newinfo->size) {
1787 if (i-- == 0)
1788 break;
1789 cleanup_entry(iter1, net);
1790 }
1791 xt_free_table_info(newinfo);
1792 return ret;
1793 }
1794
1795 /* And one copy for every other CPU */
1796 for_each_possible_cpu(i)
1797 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1798 memcpy(newinfo->entries[i], entry1, newinfo->size);
1799
1800 *pinfo = newinfo;
1801 *pentry0 = entry1;
1802 xt_free_table_info(info);
1803 return 0;
1804
1805 free_newinfo:
1806 xt_free_table_info(newinfo);
1807 out:
1808 xt_entry_foreach(iter0, entry0, total_size) {
1809 if (j-- == 0)
1810 break;
1811 compat_release_entry(iter0);
1812 }
1813 return ret;
1814 out_unlock:
1815 xt_compat_flush_offsets(AF_INET);
1816 xt_compat_unlock(AF_INET);
1817 goto out;
1818 }
1819
1820 static int
1821 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1822 {
1823 int ret;
1824 struct compat_ipt_replace tmp;
1825 struct xt_table_info *newinfo;
1826 void *loc_cpu_entry;
1827 struct ipt_entry *iter;
1828
1829 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1830 return -EFAULT;
1831
1832 /* overflow check */
1833 if (tmp.size >= INT_MAX / num_possible_cpus())
1834 return -ENOMEM;
1835 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1836 return -ENOMEM;
1837
1838 newinfo = xt_alloc_table_info(tmp.size);
1839 if (!newinfo)
1840 return -ENOMEM;
1841
1842 /* choose the copy that is on our node/cpu */
1843 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1844 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1845 tmp.size) != 0) {
1846 ret = -EFAULT;
1847 goto free_newinfo;
1848 }
1849
1850 ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1851 &newinfo, &loc_cpu_entry, tmp.size,
1852 tmp.num_entries, tmp.hook_entry,
1853 tmp.underflow);
1854 if (ret != 0)
1855 goto free_newinfo;
1856
1857 duprintf("compat_do_replace: Translated table\n");
1858
1859 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1860 tmp.num_counters, compat_ptr(tmp.counters));
1861 if (ret)
1862 goto free_newinfo_untrans;
1863 return 0;
1864
1865 free_newinfo_untrans:
1866 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1867 cleanup_entry(iter, net);
1868 free_newinfo:
1869 xt_free_table_info(newinfo);
1870 return ret;
1871 }
1872
1873 static int
1874 compat_do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user,
1875 unsigned int len)
1876 {
1877 int ret;
1878
1879 if (!capable(CAP_NET_ADMIN))
1880 return -EPERM;
1881
1882 switch (cmd) {
1883 case IPT_SO_SET_REPLACE:
1884 ret = compat_do_replace(sock_net(sk), user, len);
1885 break;
1886
1887 case IPT_SO_SET_ADD_COUNTERS:
1888 ret = do_add_counters(sock_net(sk), user, len, 1);
1889 break;
1890
1891 default:
1892 duprintf("do_ipt_set_ctl: unknown request %i\n", cmd);
1893 ret = -EINVAL;
1894 }
1895
1896 return ret;
1897 }
1898
1899 struct compat_ipt_get_entries {
1900 char name[IPT_TABLE_MAXNAMELEN];
1901 compat_uint_t size;
1902 struct compat_ipt_entry entrytable[0];
1903 };
1904
1905 static int
1906 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1907 void __user *userptr)
1908 {
1909 struct xt_counters *counters;
1910 const struct xt_table_info *private = table->private;
1911 void __user *pos;
1912 unsigned int size;
1913 int ret = 0;
1914 const void *loc_cpu_entry;
1915 unsigned int i = 0;
1916 struct ipt_entry *iter;
1917
1918 counters = alloc_counters(table);
1919 if (IS_ERR(counters))
1920 return PTR_ERR(counters);
1921
1922 /* choose the copy that is on our node/cpu, ...
1923 * This choice is lazy (because current thread is
1924 * allowed to migrate to another cpu)
1925 */
1926 loc_cpu_entry = private->entries[raw_smp_processor_id()];
1927 pos = userptr;
1928 size = total_size;
1929 xt_entry_foreach(iter, loc_cpu_entry, total_size) {
1930 ret = compat_copy_entry_to_user(iter, &pos,
1931 &size, counters, i++);
1932 if (ret != 0)
1933 break;
1934 }
1935
1936 vfree(counters);
1937 return ret;
1938 }
1939
1940 static int
1941 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1942 int *len)
1943 {
1944 int ret;
1945 struct compat_ipt_get_entries get;
1946 struct xt_table *t;
1947
1948 if (*len < sizeof(get)) {
1949 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1950 return -EINVAL;
1951 }
1952
1953 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1954 return -EFAULT;
1955
1956 if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1957 duprintf("compat_get_entries: %u != %zu\n",
1958 *len, sizeof(get) + get.size);
1959 return -EINVAL;
1960 }
1961
1962 xt_compat_lock(AF_INET);
1963 t = xt_find_table_lock(net, AF_INET, get.name);
1964 if (t && !IS_ERR(t)) {
1965 const struct xt_table_info *private = t->private;
1966 struct xt_table_info info;
1967 duprintf("t->private->number = %u\n", private->number);
1968 ret = compat_table_info(private, &info);
1969 if (!ret && get.size == info.size) {
1970 ret = compat_copy_entries_to_user(private->size,
1971 t, uptr->entrytable);
1972 } else if (!ret) {
1973 duprintf("compat_get_entries: I've got %u not %u!\n",
1974 private->size, get.size);
1975 ret = -EAGAIN;
1976 }
1977 xt_compat_flush_offsets(AF_INET);
1978 module_put(t->me);
1979 xt_table_unlock(t);
1980 } else
1981 ret = t ? PTR_ERR(t) : -ENOENT;
1982
1983 xt_compat_unlock(AF_INET);
1984 return ret;
1985 }
1986
1987 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
1988
1989 static int
1990 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1991 {
1992 int ret;
1993
1994 if (!capable(CAP_NET_ADMIN))
1995 return -EPERM;
1996
1997 switch (cmd) {
1998 case IPT_SO_GET_INFO:
1999 ret = get_info(sock_net(sk), user, len, 1);
2000 break;
2001 case IPT_SO_GET_ENTRIES:
2002 ret = compat_get_entries(sock_net(sk), user, len);
2003 break;
2004 default:
2005 ret = do_ipt_get_ctl(sk, cmd, user, len);
2006 }
2007 return ret;
2008 }
2009 #endif
2010
2011 static int
2012 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2013 {
2014 int ret;
2015
2016 if (!capable(CAP_NET_ADMIN))
2017 return -EPERM;
2018
2019 switch (cmd) {
2020 case IPT_SO_SET_REPLACE:
2021 ret = do_replace(sock_net(sk), user, len);
2022 break;
2023
2024 case IPT_SO_SET_ADD_COUNTERS:
2025 ret = do_add_counters(sock_net(sk), user, len, 0);
2026 break;
2027
2028 default:
2029 duprintf("do_ipt_set_ctl: unknown request %i\n", cmd);
2030 ret = -EINVAL;
2031 }
2032
2033 return ret;
2034 }
2035
2036 static int
2037 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2038 {
2039 int ret;
2040
2041 if (!capable(CAP_NET_ADMIN))
2042 return -EPERM;
2043
2044 switch (cmd) {
2045 case IPT_SO_GET_INFO:
2046 ret = get_info(sock_net(sk), user, len, 0);
2047 break;
2048
2049 case IPT_SO_GET_ENTRIES:
2050 ret = get_entries(sock_net(sk), user, len);
2051 break;
2052
2053 case IPT_SO_GET_REVISION_MATCH:
2054 case IPT_SO_GET_REVISION_TARGET: {
2055 struct ipt_get_revision rev;
2056 int target;
2057
2058 if (*len != sizeof(rev)) {
2059 ret = -EINVAL;
2060 break;
2061 }
2062 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2063 ret = -EFAULT;
2064 break;
2065 }
2066
2067 if (cmd == IPT_SO_GET_REVISION_TARGET)
2068 target = 1;
2069 else
2070 target = 0;
2071
2072 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2073 rev.revision,
2074 target, &ret),
2075 "ipt_%s", rev.name);
2076 break;
2077 }
2078
2079 default:
2080 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2081 ret = -EINVAL;
2082 }
2083
2084 return ret;
2085 }
2086
2087 struct xt_table *ipt_register_table(struct net *net,
2088 const struct xt_table *table,
2089 const struct ipt_replace *repl)
2090 {
2091 int ret;
2092 struct xt_table_info *newinfo;
2093 struct xt_table_info bootstrap = {0};
2094 void *loc_cpu_entry;
2095 struct xt_table *new_table;
2096
2097 newinfo = xt_alloc_table_info(repl->size);
2098 if (!newinfo) {
2099 ret = -ENOMEM;
2100 goto out;
2101 }
2102
2103 /* choose the copy on our node/cpu, but dont care about preemption */
2104 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2105 memcpy(loc_cpu_entry, repl->entries, repl->size);
2106
2107 ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2108 if (ret != 0)
2109 goto out_free;
2110
2111 new_table = xt_register_table(net, table, &bootstrap, newinfo);
2112 if (IS_ERR(new_table)) {
2113 ret = PTR_ERR(new_table);
2114 goto out_free;
2115 }
2116
2117 return new_table;
2118
2119 out_free:
2120 xt_free_table_info(newinfo);
2121 out:
2122 return ERR_PTR(ret);
2123 }
2124
2125 void ipt_unregister_table(struct net *net, struct xt_table *table)
2126 {
2127 struct xt_table_info *private;
2128 void *loc_cpu_entry;
2129 struct module *table_owner = table->me;
2130 struct ipt_entry *iter;
2131
2132 private = xt_unregister_table(table);
2133
2134 /* Decrease module usage counts and free resources */
2135 loc_cpu_entry = private->entries[raw_smp_processor_id()];
2136 xt_entry_foreach(iter, loc_cpu_entry, private->size)
2137 cleanup_entry(iter, net);
2138 if (private->number > private->initial_entries)
2139 module_put(table_owner);
2140 xt_free_table_info(private);
2141 }
2142
2143 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2144 static inline bool
2145 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2146 u_int8_t type, u_int8_t code,
2147 bool invert)
2148 {
2149 return ((test_type == 0xFF) ||
2150 (type == test_type && code >= min_code && code <= max_code))
2151 ^ invert;
2152 }
2153
2154 static bool
2155 icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
2156 {
2157 const struct icmphdr *ic;
2158 struct icmphdr _icmph;
2159 const struct ipt_icmp *icmpinfo = par->matchinfo;
2160
2161 /* Must not be a fragment. */
2162 if (par->fragoff != 0)
2163 return false;
2164
2165 ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2166 if (ic == NULL) {
2167 /* We've been asked to examine this packet, and we
2168 * can't. Hence, no choice but to drop.
2169 */
2170 duprintf("Dropping evil ICMP tinygram.\n");
2171 *par->hotdrop = true;
2172 return false;
2173 }
2174
2175 return icmp_type_code_match(icmpinfo->type,
2176 icmpinfo->code[0],
2177 icmpinfo->code[1],
2178 ic->type, ic->code,
2179 !!(icmpinfo->invflags&IPT_ICMP_INV));
2180 }
2181
2182 static int icmp_checkentry(const struct xt_mtchk_param *par)
2183 {
2184 const struct ipt_icmp *icmpinfo = par->matchinfo;
2185
2186 /* Must specify no unknown invflags */
2187 return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
2188 }
2189
2190 /* The built-in targets: standard (NULL) and error. */
2191 static struct xt_target ipt_standard_target __read_mostly = {
2192 .name = IPT_STANDARD_TARGET,
2193 .targetsize = sizeof(int),
2194 .family = NFPROTO_IPV4,
2195 #ifdef CONFIG_COMPAT
2196 .compatsize = sizeof(compat_int_t),
2197 .compat_from_user = compat_standard_from_user,
2198 .compat_to_user = compat_standard_to_user,
2199 #endif
2200 };
2201
2202 static struct xt_target ipt_error_target __read_mostly = {
2203 .name = IPT_ERROR_TARGET,
2204 .target = ipt_error,
2205 .targetsize = IPT_FUNCTION_MAXNAMELEN,
2206 .family = NFPROTO_IPV4,
2207 };
2208
2209 static struct nf_sockopt_ops ipt_sockopts = {
2210 .pf = PF_INET,
2211 .set_optmin = IPT_BASE_CTL,
2212 .set_optmax = IPT_SO_SET_MAX+1,
2213 .set = do_ipt_set_ctl,
2214 #ifdef CONFIG_COMPAT
2215 .compat_set = compat_do_ipt_set_ctl,
2216 #endif
2217 .get_optmin = IPT_BASE_CTL,
2218 .get_optmax = IPT_SO_GET_MAX+1,
2219 .get = do_ipt_get_ctl,
2220 #ifdef CONFIG_COMPAT
2221 .compat_get = compat_do_ipt_get_ctl,
2222 #endif
2223 .owner = THIS_MODULE,
2224 };
2225
2226 static struct xt_match icmp_matchstruct __read_mostly = {
2227 .name = "icmp",
2228 .match = icmp_match,
2229 .matchsize = sizeof(struct ipt_icmp),
2230 .checkentry = icmp_checkentry,
2231 .proto = IPPROTO_ICMP,
2232 .family = NFPROTO_IPV4,
2233 };
2234
2235 static int __net_init ip_tables_net_init(struct net *net)
2236 {
2237 return xt_proto_init(net, NFPROTO_IPV4);
2238 }
2239
2240 static void __net_exit ip_tables_net_exit(struct net *net)
2241 {
2242 xt_proto_fini(net, NFPROTO_IPV4);
2243 }
2244
2245 static struct pernet_operations ip_tables_net_ops = {
2246 .init = ip_tables_net_init,
2247 .exit = ip_tables_net_exit,
2248 };
2249
2250 static int __init ip_tables_init(void)
2251 {
2252 int ret;
2253
2254 ret = register_pernet_subsys(&ip_tables_net_ops);
2255 if (ret < 0)
2256 goto err1;
2257
2258 /* Noone else will be downing sem now, so we won't sleep */
2259 ret = xt_register_target(&ipt_standard_target);
2260 if (ret < 0)
2261 goto err2;
2262 ret = xt_register_target(&ipt_error_target);
2263 if (ret < 0)
2264 goto err3;
2265 ret = xt_register_match(&icmp_matchstruct);
2266 if (ret < 0)
2267 goto err4;
2268
2269 /* Register setsockopt */
2270 ret = nf_register_sockopt(&ipt_sockopts);
2271 if (ret < 0)
2272 goto err5;
2273
2274 pr_info("(C) 2000-2006 Netfilter Core Team\n");
2275 return 0;
2276
2277 err5:
2278 xt_unregister_match(&icmp_matchstruct);
2279 err4:
2280 xt_unregister_target(&ipt_error_target);
2281 err3:
2282 xt_unregister_target(&ipt_standard_target);
2283 err2:
2284 unregister_pernet_subsys(&ip_tables_net_ops);
2285 err1:
2286 return ret;
2287 }
2288
2289 static void __exit ip_tables_fini(void)
2290 {
2291 nf_unregister_sockopt(&ipt_sockopts);
2292
2293 xt_unregister_match(&icmp_matchstruct);
2294 xt_unregister_target(&ipt_error_target);
2295 xt_unregister_target(&ipt_standard_target);
2296
2297 unregister_pernet_subsys(&ip_tables_net_ops);
2298 }
2299
2300 EXPORT_SYMBOL(ipt_register_table);
2301 EXPORT_SYMBOL(ipt_unregister_table);
2302 EXPORT_SYMBOL(ipt_do_table);
2303 module_init(ip_tables_init);
2304 module_exit(ip_tables_fini);
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree