2 * x_tables core - Backend for {ip,ip6,arp}_tables
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
6 * Based on existing ip_tables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 #include <linux/kernel.h>
17 #include <linux/socket.h>
18 #include <linux/net.h>
19 #include <linux/proc_fs.h>
20 #include <linux/seq_file.h>
21 #include <linux/string.h>
22 #include <linux/vmalloc.h>
23 #include <linux/mutex.h>
25 #include <linux/netfilter/x_tables.h>
26 #include <linux/netfilter_arp.h>
29 MODULE_LICENSE("GPL");
30 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
31 MODULE_DESCRIPTION("[ip,ip6,arp]_tables backend module");
33 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
37 struct list_head match
;
38 struct list_head target
;
39 struct list_head tables
;
40 struct mutex compat_mutex
;
43 static struct xt_af
*xt
;
45 #ifdef DEBUG_IP_FIREWALL_USER
46 #define duprintf(format, args...) printk(format , ## args)
48 #define duprintf(format, args...)
57 static const char *xt_prefix
[NPROTO
] = {
63 /* Registration hooks for targets. */
65 xt_register_target(struct xt_target
*target
)
67 int ret
, af
= target
->family
;
69 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
72 list_add(&target
->list
, &xt
[af
].target
);
73 mutex_unlock(&xt
[af
].mutex
);
76 EXPORT_SYMBOL(xt_register_target
);
79 xt_unregister_target(struct xt_target
*target
)
81 int af
= target
->family
;
83 mutex_lock(&xt
[af
].mutex
);
84 LIST_DELETE(&xt
[af
].target
, target
);
85 mutex_unlock(&xt
[af
].mutex
);
87 EXPORT_SYMBOL(xt_unregister_target
);
90 xt_register_targets(struct xt_target
*target
, unsigned int n
)
95 for (i
= 0; i
< n
; i
++) {
96 err
= xt_register_target(&target
[i
]);
104 xt_unregister_targets(target
, i
);
107 EXPORT_SYMBOL(xt_register_targets
);
110 xt_unregister_targets(struct xt_target
*target
, unsigned int n
)
114 for (i
= 0; i
< n
; i
++)
115 xt_unregister_target(&target
[i
]);
117 EXPORT_SYMBOL(xt_unregister_targets
);
120 xt_register_match(struct xt_match
*match
)
122 int ret
, af
= match
->family
;
124 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
128 list_add(&match
->list
, &xt
[af
].match
);
129 mutex_unlock(&xt
[af
].mutex
);
133 EXPORT_SYMBOL(xt_register_match
);
136 xt_unregister_match(struct xt_match
*match
)
138 int af
= match
->family
;
140 mutex_lock(&xt
[af
].mutex
);
141 LIST_DELETE(&xt
[af
].match
, match
);
142 mutex_unlock(&xt
[af
].mutex
);
144 EXPORT_SYMBOL(xt_unregister_match
);
147 xt_register_matches(struct xt_match
*match
, unsigned int n
)
152 for (i
= 0; i
< n
; i
++) {
153 err
= xt_register_match(&match
[i
]);
161 xt_unregister_matches(match
, i
);
164 EXPORT_SYMBOL(xt_register_matches
);
167 xt_unregister_matches(struct xt_match
*match
, unsigned int n
)
171 for (i
= 0; i
< n
; i
++)
172 xt_unregister_match(&match
[i
]);
174 EXPORT_SYMBOL(xt_unregister_matches
);
178 * These are weird, but module loading must not be done with mutex
179 * held (since they will register), and we have to have a single
180 * function to use try_then_request_module().
183 /* Find match, grabs ref. Returns ERR_PTR() on error. */
184 struct xt_match
*xt_find_match(int af
, const char *name
, u8 revision
)
189 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
190 return ERR_PTR(-EINTR
);
192 list_for_each_entry(m
, &xt
[af
].match
, list
) {
193 if (strcmp(m
->name
, name
) == 0) {
194 if (m
->revision
== revision
) {
195 if (try_module_get(m
->me
)) {
196 mutex_unlock(&xt
[af
].mutex
);
200 err
= -EPROTOTYPE
; /* Found something. */
203 mutex_unlock(&xt
[af
].mutex
);
206 EXPORT_SYMBOL(xt_find_match
);
208 /* Find target, grabs ref. Returns ERR_PTR() on error. */
209 struct xt_target
*xt_find_target(int af
, const char *name
, u8 revision
)
214 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
215 return ERR_PTR(-EINTR
);
217 list_for_each_entry(t
, &xt
[af
].target
, list
) {
218 if (strcmp(t
->name
, name
) == 0) {
219 if (t
->revision
== revision
) {
220 if (try_module_get(t
->me
)) {
221 mutex_unlock(&xt
[af
].mutex
);
225 err
= -EPROTOTYPE
; /* Found something. */
228 mutex_unlock(&xt
[af
].mutex
);
231 EXPORT_SYMBOL(xt_find_target
);
233 struct xt_target
*xt_request_find_target(int af
, const char *name
, u8 revision
)
235 struct xt_target
*target
;
237 target
= try_then_request_module(xt_find_target(af
, name
, revision
),
238 "%st_%s", xt_prefix
[af
], name
);
239 if (IS_ERR(target
) || !target
)
243 EXPORT_SYMBOL_GPL(xt_request_find_target
);
245 static int match_revfn(int af
, const char *name
, u8 revision
, int *bestp
)
250 list_for_each_entry(m
, &xt
[af
].match
, list
) {
251 if (strcmp(m
->name
, name
) == 0) {
252 if (m
->revision
> *bestp
)
253 *bestp
= m
->revision
;
254 if (m
->revision
== revision
)
261 static int target_revfn(int af
, const char *name
, u8 revision
, int *bestp
)
266 list_for_each_entry(t
, &xt
[af
].target
, list
) {
267 if (strcmp(t
->name
, name
) == 0) {
268 if (t
->revision
> *bestp
)
269 *bestp
= t
->revision
;
270 if (t
->revision
== revision
)
277 /* Returns true or false (if no such extension at all) */
278 int xt_find_revision(int af
, const char *name
, u8 revision
, int target
,
281 int have_rev
, best
= -1;
283 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0) {
288 have_rev
= target_revfn(af
, name
, revision
, &best
);
290 have_rev
= match_revfn(af
, name
, revision
, &best
);
291 mutex_unlock(&xt
[af
].mutex
);
293 /* Nothing at all? Return 0 to try loading module. */
301 *err
= -EPROTONOSUPPORT
;
304 EXPORT_SYMBOL_GPL(xt_find_revision
);
306 int xt_check_match(const struct xt_match
*match
, unsigned short family
,
307 unsigned int size
, const char *table
, unsigned int hook_mask
,
308 unsigned short proto
, int inv_proto
)
310 if (XT_ALIGN(match
->matchsize
) != size
) {
311 printk("%s_tables: %s match: invalid size %Zu != %u\n",
312 xt_prefix
[family
], match
->name
,
313 XT_ALIGN(match
->matchsize
), size
);
316 if (match
->table
&& strcmp(match
->table
, table
)) {
317 printk("%s_tables: %s match: only valid in %s table, not %s\n",
318 xt_prefix
[family
], match
->name
, match
->table
, table
);
321 if (match
->hooks
&& (hook_mask
& ~match
->hooks
) != 0) {
322 printk("%s_tables: %s match: bad hook_mask %u\n",
323 xt_prefix
[family
], match
->name
, hook_mask
);
326 if (match
->proto
&& (match
->proto
!= proto
|| inv_proto
)) {
327 printk("%s_tables: %s match: only valid for protocol %u\n",
328 xt_prefix
[family
], match
->name
, match
->proto
);
333 EXPORT_SYMBOL_GPL(xt_check_match
);
336 int xt_compat_match(void *match
, void **dstptr
, int *size
, int convert
)
339 struct compat_xt_entry_match
*pcompat_m
;
340 struct xt_entry_match
*pm
;
345 m
= ((struct xt_entry_match
*)match
)->u
.kernel
.match
;
346 off
= XT_ALIGN(m
->matchsize
) - COMPAT_XT_ALIGN(m
->matchsize
);
349 pm
= (struct xt_entry_match
*)match
;
350 msize
= pm
->u
.user
.match_size
;
351 if (copy_to_user(*dstptr
, pm
, msize
)) {
356 if (put_user(msize
, (u_int16_t
*)*dstptr
))
361 case COMPAT_FROM_USER
:
362 pcompat_m
= (struct compat_xt_entry_match
*)match
;
363 pm
= (struct xt_entry_match
*)*dstptr
;
364 msize
= pcompat_m
->u
.user
.match_size
;
365 memcpy(pm
, pcompat_m
, msize
);
367 pm
->u
.user
.match_size
= msize
;
371 case COMPAT_CALC_SIZE
:
380 EXPORT_SYMBOL_GPL(xt_compat_match
);
383 int xt_check_target(const struct xt_target
*target
, unsigned short family
,
384 unsigned int size
, const char *table
, unsigned int hook_mask
,
385 unsigned short proto
, int inv_proto
)
387 if (XT_ALIGN(target
->targetsize
) != size
) {
388 printk("%s_tables: %s target: invalid size %Zu != %u\n",
389 xt_prefix
[family
], target
->name
,
390 XT_ALIGN(target
->targetsize
), size
);
393 if (target
->table
&& strcmp(target
->table
, table
)) {
394 printk("%s_tables: %s target: only valid in %s table, not %s\n",
395 xt_prefix
[family
], target
->name
, target
->table
, table
);
398 if (target
->hooks
&& (hook_mask
& ~target
->hooks
) != 0) {
399 printk("%s_tables: %s target: bad hook_mask %u\n",
400 xt_prefix
[family
], target
->name
, hook_mask
);
403 if (target
->proto
&& (target
->proto
!= proto
|| inv_proto
)) {
404 printk("%s_tables: %s target: only valid for protocol %u\n",
405 xt_prefix
[family
], target
->name
, target
->proto
);
410 EXPORT_SYMBOL_GPL(xt_check_target
);
413 int xt_compat_target(void *target
, void **dstptr
, int *size
, int convert
)
416 struct compat_xt_entry_target
*pcompat
;
417 struct xt_entry_target
*pt
;
422 t
= ((struct xt_entry_target
*)target
)->u
.kernel
.target
;
423 off
= XT_ALIGN(t
->targetsize
) - COMPAT_XT_ALIGN(t
->targetsize
);
426 pt
= (struct xt_entry_target
*)target
;
427 tsize
= pt
->u
.user
.target_size
;
428 if (copy_to_user(*dstptr
, pt
, tsize
)) {
433 if (put_user(tsize
, (u_int16_t
*)*dstptr
))
438 case COMPAT_FROM_USER
:
439 pcompat
= (struct compat_xt_entry_target
*)target
;
440 pt
= (struct xt_entry_target
*)*dstptr
;
441 tsize
= pcompat
->u
.user
.target_size
;
442 memcpy(pt
, pcompat
, tsize
);
444 pt
->u
.user
.target_size
= tsize
;
448 case COMPAT_CALC_SIZE
:
457 EXPORT_SYMBOL_GPL(xt_compat_target
);
460 struct xt_table_info
*xt_alloc_table_info(unsigned int size
)
462 struct xt_table_info
*newinfo
;
465 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
466 if ((SMP_ALIGN(size
) >> PAGE_SHIFT
) + 2 > num_physpages
)
469 newinfo
= kzalloc(sizeof(struct xt_table_info
), GFP_KERNEL
);
473 newinfo
->size
= size
;
475 for_each_possible_cpu(cpu
) {
476 if (size
<= PAGE_SIZE
)
477 newinfo
->entries
[cpu
] = kmalloc_node(size
,
481 newinfo
->entries
[cpu
] = vmalloc_node(size
,
484 if (newinfo
->entries
[cpu
] == NULL
) {
485 xt_free_table_info(newinfo
);
492 EXPORT_SYMBOL(xt_alloc_table_info
);
494 void xt_free_table_info(struct xt_table_info
*info
)
498 for_each_possible_cpu(cpu
) {
499 if (info
->size
<= PAGE_SIZE
)
500 kfree(info
->entries
[cpu
]);
502 vfree(info
->entries
[cpu
]);
506 EXPORT_SYMBOL(xt_free_table_info
);
508 /* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
509 struct xt_table
*xt_find_table_lock(int af
, const char *name
)
513 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
514 return ERR_PTR(-EINTR
);
516 list_for_each_entry(t
, &xt
[af
].tables
, list
)
517 if (strcmp(t
->name
, name
) == 0 && try_module_get(t
->me
))
519 mutex_unlock(&xt
[af
].mutex
);
522 EXPORT_SYMBOL_GPL(xt_find_table_lock
);
524 void xt_table_unlock(struct xt_table
*table
)
526 mutex_unlock(&xt
[table
->af
].mutex
);
528 EXPORT_SYMBOL_GPL(xt_table_unlock
);
531 void xt_compat_lock(int af
)
533 mutex_lock(&xt
[af
].compat_mutex
);
535 EXPORT_SYMBOL_GPL(xt_compat_lock
);
537 void xt_compat_unlock(int af
)
539 mutex_unlock(&xt
[af
].compat_mutex
);
541 EXPORT_SYMBOL_GPL(xt_compat_unlock
);
544 struct xt_table_info
*
545 xt_replace_table(struct xt_table
*table
,
546 unsigned int num_counters
,
547 struct xt_table_info
*newinfo
,
550 struct xt_table_info
*oldinfo
, *private;
552 /* Do the substitution. */
553 write_lock_bh(&table
->lock
);
554 private = table
->private;
555 /* Check inside lock: is the old number correct? */
556 if (num_counters
!= private->number
) {
557 duprintf("num_counters != table->private->number (%u/%u)\n",
558 num_counters
, private->number
);
559 write_unlock_bh(&table
->lock
);
564 table
->private = newinfo
;
565 newinfo
->initial_entries
= oldinfo
->initial_entries
;
566 write_unlock_bh(&table
->lock
);
570 EXPORT_SYMBOL_GPL(xt_replace_table
);
572 int xt_register_table(struct xt_table
*table
,
573 struct xt_table_info
*bootstrap
,
574 struct xt_table_info
*newinfo
)
577 struct xt_table_info
*private;
579 ret
= mutex_lock_interruptible(&xt
[table
->af
].mutex
);
583 /* Don't autoload: we'd eat our tail... */
584 if (list_named_find(&xt
[table
->af
].tables
, table
->name
)) {
589 /* Simplifies replace_table code. */
590 table
->private = bootstrap
;
591 rwlock_init(&table
->lock
);
592 if (!xt_replace_table(table
, 0, newinfo
, &ret
))
595 private = table
->private;
596 duprintf("table->private->number = %u\n", private->number
);
598 /* save number of initial entries */
599 private->initial_entries
= private->number
;
601 list_prepend(&xt
[table
->af
].tables
, table
);
605 mutex_unlock(&xt
[table
->af
].mutex
);
608 EXPORT_SYMBOL_GPL(xt_register_table
);
610 void *xt_unregister_table(struct xt_table
*table
)
612 struct xt_table_info
*private;
614 mutex_lock(&xt
[table
->af
].mutex
);
615 private = table
->private;
616 LIST_DELETE(&xt
[table
->af
].tables
, table
);
617 mutex_unlock(&xt
[table
->af
].mutex
);
621 EXPORT_SYMBOL_GPL(xt_unregister_table
);
623 #ifdef CONFIG_PROC_FS
624 static char *xt_proto_prefix
[NPROTO
] = {
630 static struct list_head
*xt_get_idx(struct list_head
*list
, struct seq_file
*seq
, loff_t pos
)
632 struct list_head
*head
= list
->next
;
634 if (!head
|| list_empty(list
))
637 while (pos
&& (head
= head
->next
)) {
642 return pos
? NULL
: head
;
645 static struct list_head
*type2list(u_int16_t af
, u_int16_t type
)
647 struct list_head
*list
;
651 list
= &xt
[af
].target
;
654 list
= &xt
[af
].match
;
657 list
= &xt
[af
].tables
;
667 static void *xt_tgt_seq_start(struct seq_file
*seq
, loff_t
*pos
)
669 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*) seq
->private;
670 u_int16_t af
= (unsigned long)pde
->data
& 0xffff;
671 u_int16_t type
= (unsigned long)pde
->data
>> 16;
672 struct list_head
*list
;
677 list
= type2list(af
, type
);
681 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
684 return xt_get_idx(list
, seq
, *pos
);
687 static void *xt_tgt_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
689 struct proc_dir_entry
*pde
= seq
->private;
690 u_int16_t af
= (unsigned long)pde
->data
& 0xffff;
691 u_int16_t type
= (unsigned long)pde
->data
>> 16;
692 struct list_head
*list
;
697 list
= type2list(af
, type
);
702 return xt_get_idx(list
, seq
, *pos
);
705 static void xt_tgt_seq_stop(struct seq_file
*seq
, void *v
)
707 struct proc_dir_entry
*pde
= seq
->private;
708 u_int16_t af
= (unsigned long)pde
->data
& 0xffff;
710 mutex_unlock(&xt
[af
].mutex
);
713 static int xt_name_seq_show(struct seq_file
*seq
, void *v
)
715 char *name
= (char *)v
+ sizeof(struct list_head
);
718 return seq_printf(seq
, "%s\n", name
);
723 static struct seq_operations xt_tgt_seq_ops
= {
724 .start
= xt_tgt_seq_start
,
725 .next
= xt_tgt_seq_next
,
726 .stop
= xt_tgt_seq_stop
,
727 .show
= xt_name_seq_show
,
730 static int xt_tgt_open(struct inode
*inode
, struct file
*file
)
734 ret
= seq_open(file
, &xt_tgt_seq_ops
);
736 struct seq_file
*seq
= file
->private_data
;
737 struct proc_dir_entry
*pde
= PDE(inode
);
745 static struct file_operations xt_file_ops
= {
746 .owner
= THIS_MODULE
,
750 .release
= seq_release
,
753 #define FORMAT_TABLES "_tables_names"
754 #define FORMAT_MATCHES "_tables_matches"
755 #define FORMAT_TARGETS "_tables_targets"
757 #endif /* CONFIG_PROC_FS */
759 int xt_proto_init(int af
)
761 #ifdef CONFIG_PROC_FS
762 char buf
[XT_FUNCTION_MAXNAMELEN
];
763 struct proc_dir_entry
*proc
;
770 #ifdef CONFIG_PROC_FS
771 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
772 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
773 proc
= proc_net_fops_create(buf
, 0440, &xt_file_ops
);
776 proc
->data
= (void *) ((unsigned long) af
| (TABLE
<< 16));
779 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
780 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
781 proc
= proc_net_fops_create(buf
, 0440, &xt_file_ops
);
783 goto out_remove_tables
;
784 proc
->data
= (void *) ((unsigned long) af
| (MATCH
<< 16));
786 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
787 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
788 proc
= proc_net_fops_create(buf
, 0440, &xt_file_ops
);
790 goto out_remove_matches
;
791 proc
->data
= (void *) ((unsigned long) af
| (TARGET
<< 16));
796 #ifdef CONFIG_PROC_FS
798 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
799 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
800 proc_net_remove(buf
);
803 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
804 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
805 proc_net_remove(buf
);
810 EXPORT_SYMBOL_GPL(xt_proto_init
);
812 void xt_proto_fini(int af
)
814 #ifdef CONFIG_PROC_FS
815 char buf
[XT_FUNCTION_MAXNAMELEN
];
817 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
818 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
819 proc_net_remove(buf
);
821 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
822 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
823 proc_net_remove(buf
);
825 strlcpy(buf
, xt_proto_prefix
[af
], sizeof(buf
));
826 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
827 proc_net_remove(buf
);
828 #endif /*CONFIG_PROC_FS*/
830 EXPORT_SYMBOL_GPL(xt_proto_fini
);
833 static int __init
xt_init(void)
837 xt
= kmalloc(sizeof(struct xt_af
) * NPROTO
, GFP_KERNEL
);
841 for (i
= 0; i
< NPROTO
; i
++) {
842 mutex_init(&xt
[i
].mutex
);
844 mutex_init(&xt
[i
].compat_mutex
);
846 INIT_LIST_HEAD(&xt
[i
].target
);
847 INIT_LIST_HEAD(&xt
[i
].match
);
848 INIT_LIST_HEAD(&xt
[i
].tables
);
853 static void __exit
xt_fini(void)
858 module_init(xt_init
);
859 module_exit(xt_fini
);