2 * Packet matching code for ARP packets.
4 * Based heavily, if not almost entirely, upon ip_tables.c framework.
6 * Some ARP specific bits are:
8 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
12 #include <linux/config.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/if_arp.h>
17 #include <linux/kmod.h>
18 #include <linux/vmalloc.h>
19 #include <linux/proc_fs.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
23 #include <asm/uaccess.h>
24 #include <asm/semaphore.h>
26 #include <linux/netfilter_arp/arp_tables.h>
28 MODULE_LICENSE("GPL");
29 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
30 MODULE_DESCRIPTION("arptables core");
32 /*#define DEBUG_ARP_TABLES*/
33 /*#define DEBUG_ARP_TABLES_USER*/
35 #ifdef DEBUG_ARP_TABLES
36 #define dprintf(format, args...) printk(format , ## args)
38 #define dprintf(format, args...)
41 #ifdef DEBUG_ARP_TABLES_USER
42 #define duprintf(format, args...) printk(format , ## args)
44 #define duprintf(format, args...)
47 #ifdef CONFIG_NETFILTER_DEBUG
48 #define ARP_NF_ASSERT(x) \
51 printk("ARP_NF_ASSERT: %s:%s:%u\n", \
52 __FUNCTION__, __FILE__, __LINE__); \
55 #define ARP_NF_ASSERT(x)
57 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
59 static DECLARE_MUTEX(arpt_mutex
);
61 #define ASSERT_READ_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
62 #define ASSERT_WRITE_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
63 #include <linux/netfilter_ipv4/listhelp.h>
65 struct arpt_table_info
{
68 unsigned int initial_entries
;
69 unsigned int hook_entry
[NF_ARP_NUMHOOKS
];
70 unsigned int underflow
[NF_ARP_NUMHOOKS
];
71 char entries
[0] __attribute__((aligned(SMP_CACHE_BYTES
)));
74 static LIST_HEAD(arpt_target
);
75 static LIST_HEAD(arpt_tables
);
76 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
79 #define TABLE_OFFSET(t,p) (SMP_ALIGN((t)->size)*(p))
81 #define TABLE_OFFSET(t,p) 0
84 static inline int arp_devaddr_compare(const struct arpt_devaddr_info
*ap
,
85 char *hdr_addr
, int len
)
89 if (len
> ARPT_DEV_ADDR_LEN_MAX
)
90 len
= ARPT_DEV_ADDR_LEN_MAX
;
93 for (i
= 0; i
< len
; i
++)
94 ret
|= (hdr_addr
[i
] ^ ap
->addr
[i
]) & ap
->mask
[i
];
99 /* Returns whether packet matches rule or not. */
100 static inline int arp_packet_match(const struct arphdr
*arphdr
,
101 struct net_device
*dev
,
104 const struct arpt_arp
*arpinfo
)
106 char *arpptr
= (char *)(arphdr
+ 1);
107 char *src_devaddr
, *tgt_devaddr
;
108 u32 src_ipaddr
, tgt_ipaddr
;
111 #define FWINV(bool,invflg) ((bool) ^ !!(arpinfo->invflags & invflg))
113 if (FWINV((arphdr
->ar_op
& arpinfo
->arpop_mask
) != arpinfo
->arpop
,
115 dprintf("ARP operation field mismatch.\n");
116 dprintf("ar_op: %04x info->arpop: %04x info->arpop_mask: %04x\n",
117 arphdr
->ar_op
, arpinfo
->arpop
, arpinfo
->arpop_mask
);
121 if (FWINV((arphdr
->ar_hrd
& arpinfo
->arhrd_mask
) != arpinfo
->arhrd
,
123 dprintf("ARP hardware address format mismatch.\n");
124 dprintf("ar_hrd: %04x info->arhrd: %04x info->arhrd_mask: %04x\n",
125 arphdr
->ar_hrd
, arpinfo
->arhrd
, arpinfo
->arhrd_mask
);
129 if (FWINV((arphdr
->ar_pro
& arpinfo
->arpro_mask
) != arpinfo
->arpro
,
131 dprintf("ARP protocol address format mismatch.\n");
132 dprintf("ar_pro: %04x info->arpro: %04x info->arpro_mask: %04x\n",
133 arphdr
->ar_pro
, arpinfo
->arpro
, arpinfo
->arpro_mask
);
137 if (FWINV((arphdr
->ar_hln
& arpinfo
->arhln_mask
) != arpinfo
->arhln
,
139 dprintf("ARP hardware address length mismatch.\n");
140 dprintf("ar_hln: %02x info->arhln: %02x info->arhln_mask: %02x\n",
141 arphdr
->ar_hln
, arpinfo
->arhln
, arpinfo
->arhln_mask
);
145 src_devaddr
= arpptr
;
146 arpptr
+= dev
->addr_len
;
147 memcpy(&src_ipaddr
, arpptr
, sizeof(u32
));
148 arpptr
+= sizeof(u32
);
149 tgt_devaddr
= arpptr
;
150 arpptr
+= dev
->addr_len
;
151 memcpy(&tgt_ipaddr
, arpptr
, sizeof(u32
));
153 if (FWINV(arp_devaddr_compare(&arpinfo
->src_devaddr
, src_devaddr
, dev
->addr_len
),
154 ARPT_INV_SRCDEVADDR
) ||
155 FWINV(arp_devaddr_compare(&arpinfo
->tgt_devaddr
, tgt_devaddr
, dev
->addr_len
),
156 ARPT_INV_TGTDEVADDR
)) {
157 dprintf("Source or target device address mismatch.\n");
162 if (FWINV((src_ipaddr
& arpinfo
->smsk
.s_addr
) != arpinfo
->src
.s_addr
,
164 FWINV(((tgt_ipaddr
& arpinfo
->tmsk
.s_addr
) != arpinfo
->tgt
.s_addr
),
166 dprintf("Source or target IP address mismatch.\n");
168 dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
170 NIPQUAD(arpinfo
->smsk
.s_addr
),
171 NIPQUAD(arpinfo
->src
.s_addr
),
172 arpinfo
->invflags
& ARPT_INV_SRCIP
? " (INV)" : "");
173 dprintf("TGT: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
175 NIPQUAD(arpinfo
->tmsk
.s_addr
),
176 NIPQUAD(arpinfo
->tgt
.s_addr
),
177 arpinfo
->invflags
& ARPT_INV_TGTIP
? " (INV)" : "");
181 /* Look for ifname matches. */
182 for (i
= 0, ret
= 0; i
< IFNAMSIZ
; i
++) {
183 ret
|= (indev
[i
] ^ arpinfo
->iniface
[i
])
184 & arpinfo
->iniface_mask
[i
];
187 if (FWINV(ret
!= 0, ARPT_INV_VIA_IN
)) {
188 dprintf("VIA in mismatch (%s vs %s).%s\n",
189 indev
, arpinfo
->iniface
,
190 arpinfo
->invflags
&ARPT_INV_VIA_IN
?" (INV)":"");
194 for (i
= 0, ret
= 0; i
< IFNAMSIZ
/sizeof(unsigned long); i
++) {
196 memcpy(&odev
, outdev
+ i
*sizeof(unsigned long),
197 sizeof(unsigned long));
199 ^ ((const unsigned long *)arpinfo
->outiface
)[i
])
200 & ((const unsigned long *)arpinfo
->outiface_mask
)[i
];
203 if (FWINV(ret
!= 0, ARPT_INV_VIA_OUT
)) {
204 dprintf("VIA out mismatch (%s vs %s).%s\n",
205 outdev
, arpinfo
->outiface
,
206 arpinfo
->invflags
&ARPT_INV_VIA_OUT
?" (INV)":"");
213 static inline int arp_checkentry(const struct arpt_arp
*arp
)
215 if (arp
->flags
& ~ARPT_F_MASK
) {
216 duprintf("Unknown flag bits set: %08X\n",
217 arp
->flags
& ~ARPT_F_MASK
);
220 if (arp
->invflags
& ~ARPT_INV_MASK
) {
221 duprintf("Unknown invflag bits set: %08X\n",
222 arp
->invflags
& ~ARPT_INV_MASK
);
229 static unsigned int arpt_error(struct sk_buff
**pskb
,
230 unsigned int hooknum
,
231 const struct net_device
*in
,
232 const struct net_device
*out
,
233 const void *targinfo
,
237 printk("arp_tables: error: '%s'\n", (char *)targinfo
);
242 static inline struct arpt_entry
*get_entry(void *base
, unsigned int offset
)
244 return (struct arpt_entry
*)(base
+ offset
);
247 unsigned int arpt_do_table(struct sk_buff
**pskb
,
249 const struct net_device
*in
,
250 const struct net_device
*out
,
251 struct arpt_table
*table
,
254 static const char nulldevname
[IFNAMSIZ
];
255 unsigned int verdict
= NF_DROP
;
258 struct arpt_entry
*e
, *back
;
259 const char *indev
, *outdev
;
262 /* ARP header, plus 2 device addresses, plus 2 IP addresses. */
263 if (!pskb_may_pull((*pskb
), (sizeof(struct arphdr
) +
264 (2 * (*pskb
)->dev
->addr_len
) +
268 indev
= in
? in
->name
: nulldevname
;
269 outdev
= out
? out
->name
: nulldevname
;
271 read_lock_bh(&table
->lock
);
272 table_base
= (void *)table
->private->entries
273 + TABLE_OFFSET(table
->private,
275 e
= get_entry(table_base
, table
->private->hook_entry
[hook
]);
276 back
= get_entry(table_base
, table
->private->underflow
[hook
]);
278 arp
= (*pskb
)->nh
.arph
;
280 if (arp_packet_match(arp
, (*pskb
)->dev
, indev
, outdev
, &e
->arp
)) {
281 struct arpt_entry_target
*t
;
284 hdr_len
= sizeof(*arp
) + (2 * sizeof(struct in_addr
)) +
285 (2 * (*pskb
)->dev
->addr_len
);
286 ADD_COUNTER(e
->counters
, hdr_len
, 1);
288 t
= arpt_get_target(e
);
290 /* Standard target? */
291 if (!t
->u
.kernel
.target
->target
) {
294 v
= ((struct arpt_standard_target
*)t
)->verdict
;
296 /* Pop from stack? */
297 if (v
!= ARPT_RETURN
) {
298 verdict
= (unsigned)(-v
) - 1;
302 back
= get_entry(table_base
,
307 != (void *)e
+ e
->next_offset
) {
308 /* Save old back ptr in next entry */
309 struct arpt_entry
*next
310 = (void *)e
+ e
->next_offset
;
312 (void *)back
- table_base
;
314 /* set back pointer to next entry */
318 e
= get_entry(table_base
, v
);
320 /* Targets which reenter must return
323 verdict
= t
->u
.kernel
.target
->target(pskb
,
329 /* Target might have changed stuff. */
330 arp
= (*pskb
)->nh
.arph
;
332 if (verdict
== ARPT_CONTINUE
)
333 e
= (void *)e
+ e
->next_offset
;
339 e
= (void *)e
+ e
->next_offset
;
342 read_unlock_bh(&table
->lock
);
350 static inline void *find_inlist_lock_noload(struct list_head
*head
,
353 struct semaphore
*mutex
)
357 *error
= down_interruptible(mutex
);
361 ret
= list_named_find(head
, name
);
370 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
373 find_inlist_lock(struct list_head
*head
,
377 struct semaphore
*mutex
)
381 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
383 duprintf("find_inlist: loading `%s%s'.\n", prefix
, name
);
384 request_module("%s%s", prefix
, name
);
385 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
392 static inline struct arpt_table
*arpt_find_table_lock(const char *name
, int *error
, struct semaphore
*mutex
)
394 return find_inlist_lock(&arpt_tables
, name
, "arptable_", error
, mutex
);
397 static struct arpt_target
*arpt_find_target_lock(const char *name
, int *error
, struct semaphore
*mutex
)
399 return find_inlist_lock(&arpt_target
, name
, "arpt_", error
, mutex
);
402 /* All zeroes == unconditional rule. */
403 static inline int unconditional(const struct arpt_arp
*arp
)
407 for (i
= 0; i
< sizeof(*arp
)/sizeof(__u32
); i
++)
408 if (((__u32
*)arp
)[i
])
414 /* Figures out from what hook each rule can be called: returns 0 if
415 * there are loops. Puts hook bitmask in comefrom.
417 static int mark_source_chains(struct arpt_table_info
*newinfo
, unsigned int valid_hooks
)
421 /* No recursion; use packet counter to save back ptrs (reset
422 * to 0 as we leave), and comefrom to save source hook bitmask.
424 for (hook
= 0; hook
< NF_ARP_NUMHOOKS
; hook
++) {
425 unsigned int pos
= newinfo
->hook_entry
[hook
];
427 = (struct arpt_entry
*)(newinfo
->entries
+ pos
);
429 if (!(valid_hooks
& (1 << hook
)))
432 /* Set initial back pointer. */
433 e
->counters
.pcnt
= pos
;
436 struct arpt_standard_target
*t
437 = (void *)arpt_get_target(e
);
439 if (e
->comefrom
& (1 << NF_ARP_NUMHOOKS
)) {
440 printk("arptables: loop hook %u pos %u %08X.\n",
441 hook
, pos
, e
->comefrom
);
445 |= ((1 << hook
) | (1 << NF_ARP_NUMHOOKS
));
447 /* Unconditional return/END. */
448 if (e
->target_offset
== sizeof(struct arpt_entry
)
449 && (strcmp(t
->target
.u
.user
.name
,
450 ARPT_STANDARD_TARGET
) == 0)
452 && unconditional(&e
->arp
)) {
453 unsigned int oldpos
, size
;
455 /* Return: backtrack through the last
459 e
->comefrom
^= (1<<NF_ARP_NUMHOOKS
);
461 pos
= e
->counters
.pcnt
;
462 e
->counters
.pcnt
= 0;
464 /* We're at the start. */
468 e
= (struct arpt_entry
*)
469 (newinfo
->entries
+ pos
);
470 } while (oldpos
== pos
+ e
->next_offset
);
473 size
= e
->next_offset
;
474 e
= (struct arpt_entry
*)
475 (newinfo
->entries
+ pos
+ size
);
476 e
->counters
.pcnt
= pos
;
479 int newpos
= t
->verdict
;
481 if (strcmp(t
->target
.u
.user
.name
,
482 ARPT_STANDARD_TARGET
) == 0
484 /* This a jump; chase it. */
485 duprintf("Jump rule %u -> %u\n",
488 /* ... this is a fallthru */
489 newpos
= pos
+ e
->next_offset
;
491 e
= (struct arpt_entry
*)
492 (newinfo
->entries
+ newpos
);
493 e
->counters
.pcnt
= pos
;
498 duprintf("Finished chain %u\n", hook
);
503 static inline int standard_check(const struct arpt_entry_target
*t
,
504 unsigned int max_offset
)
506 struct arpt_standard_target
*targ
= (void *)t
;
508 /* Check standard info. */
510 != ARPT_ALIGN(sizeof(struct arpt_standard_target
))) {
511 duprintf("arpt_standard_check: target size %u != %Zu\n",
513 ARPT_ALIGN(sizeof(struct arpt_standard_target
)));
517 if (targ
->verdict
>= 0
518 && targ
->verdict
> max_offset
- sizeof(struct arpt_entry
)) {
519 duprintf("arpt_standard_check: bad verdict (%i)\n",
524 if (targ
->verdict
< -NF_MAX_VERDICT
- 1) {
525 duprintf("arpt_standard_check: bad negative verdict (%i)\n",
532 static struct arpt_target arpt_standard_target
;
534 static inline int check_entry(struct arpt_entry
*e
, const char *name
, unsigned int size
,
537 struct arpt_entry_target
*t
;
538 struct arpt_target
*target
;
541 if (!arp_checkentry(&e
->arp
)) {
542 duprintf("arp_tables: arp check failed %p %s.\n", e
, name
);
546 t
= arpt_get_target(e
);
547 target
= arpt_find_target_lock(t
->u
.user
.name
, &ret
, &arpt_mutex
);
549 duprintf("check_entry: `%s' not found\n", t
->u
.user
.name
);
552 if (!try_module_get((target
->me
))) {
556 t
->u
.kernel
.target
= target
;
559 if (t
->u
.kernel
.target
== &arpt_standard_target
) {
560 if (!standard_check(t
, size
)) {
564 } else if (t
->u
.kernel
.target
->checkentry
565 && !t
->u
.kernel
.target
->checkentry(name
, e
, t
->data
,
569 module_put(t
->u
.kernel
.target
->me
);
570 duprintf("arp_tables: check failed for `%s'.\n",
571 t
->u
.kernel
.target
->name
);
585 static inline int check_entry_size_and_hooks(struct arpt_entry
*e
,
586 struct arpt_table_info
*newinfo
,
588 unsigned char *limit
,
589 const unsigned int *hook_entries
,
590 const unsigned int *underflows
,
595 if ((unsigned long)e
% __alignof__(struct arpt_entry
) != 0
596 || (unsigned char *)e
+ sizeof(struct arpt_entry
) >= limit
) {
597 duprintf("Bad offset %p\n", e
);
602 < sizeof(struct arpt_entry
) + sizeof(struct arpt_entry_target
)) {
603 duprintf("checking: element %p size %u\n",
608 /* Check hooks & underflows */
609 for (h
= 0; h
< NF_ARP_NUMHOOKS
; h
++) {
610 if ((unsigned char *)e
- base
== hook_entries
[h
])
611 newinfo
->hook_entry
[h
] = hook_entries
[h
];
612 if ((unsigned char *)e
- base
== underflows
[h
])
613 newinfo
->underflow
[h
] = underflows
[h
];
616 /* FIXME: underflows must be unconditional, standard verdicts
617 < 0 (not ARPT_RETURN). --RR */
619 /* Clear counters and comefrom */
620 e
->counters
= ((struct arpt_counters
) { 0, 0 });
627 static inline int cleanup_entry(struct arpt_entry
*e
, unsigned int *i
)
629 struct arpt_entry_target
*t
;
631 if (i
&& (*i
)-- == 0)
634 t
= arpt_get_target(e
);
635 if (t
->u
.kernel
.target
->destroy
)
636 t
->u
.kernel
.target
->destroy(t
->data
,
637 t
->u
.target_size
- sizeof(*t
));
638 module_put(t
->u
.kernel
.target
->me
);
642 /* Checks and translates the user-supplied table segment (held in
645 static int translate_table(const char *name
,
646 unsigned int valid_hooks
,
647 struct arpt_table_info
*newinfo
,
650 const unsigned int *hook_entries
,
651 const unsigned int *underflows
)
656 newinfo
->size
= size
;
657 newinfo
->number
= number
;
659 /* Init all hooks to impossible value. */
660 for (i
= 0; i
< NF_ARP_NUMHOOKS
; i
++) {
661 newinfo
->hook_entry
[i
] = 0xFFFFFFFF;
662 newinfo
->underflow
[i
] = 0xFFFFFFFF;
665 duprintf("translate_table: size %u\n", newinfo
->size
);
668 /* Walk through entries, checking offsets. */
669 ret
= ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
,
670 check_entry_size_and_hooks
,
673 newinfo
->entries
+ size
,
674 hook_entries
, underflows
, &i
);
675 duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret
);
680 duprintf("translate_table: %u not %u entries\n",
685 /* Check hooks all assigned */
686 for (i
= 0; i
< NF_ARP_NUMHOOKS
; i
++) {
687 /* Only hooks which are valid */
688 if (!(valid_hooks
& (1 << i
)))
690 if (newinfo
->hook_entry
[i
] == 0xFFFFFFFF) {
691 duprintf("Invalid hook entry %u %u\n",
695 if (newinfo
->underflow
[i
] == 0xFFFFFFFF) {
696 duprintf("Invalid underflow %u %u\n",
702 if (!mark_source_chains(newinfo
, valid_hooks
)) {
703 duprintf("Looping hook\n");
707 /* Finally, each sanity check must pass */
709 ret
= ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
,
710 check_entry
, name
, size
, &i
);
713 ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
,
718 /* And one copy for every other CPU */
719 for (i
= 1; i
< num_possible_cpus(); i
++) {
720 memcpy(newinfo
->entries
+ SMP_ALIGN(newinfo
->size
)*i
,
722 SMP_ALIGN(newinfo
->size
));
728 static struct arpt_table_info
*replace_table(struct arpt_table
*table
,
729 unsigned int num_counters
,
730 struct arpt_table_info
*newinfo
,
733 struct arpt_table_info
*oldinfo
;
735 /* Do the substitution. */
736 write_lock_bh(&table
->lock
);
737 /* Check inside lock: is the old number correct? */
738 if (num_counters
!= table
->private->number
) {
739 duprintf("num_counters != table->private->number (%u/%u)\n",
740 num_counters
, table
->private->number
);
741 write_unlock_bh(&table
->lock
);
745 oldinfo
= table
->private;
746 table
->private = newinfo
;
747 newinfo
->initial_entries
= oldinfo
->initial_entries
;
748 write_unlock_bh(&table
->lock
);
754 static inline int add_entry_to_counter(const struct arpt_entry
*e
,
755 struct arpt_counters total
[],
758 ADD_COUNTER(total
[*i
], e
->counters
.bcnt
, e
->counters
.pcnt
);
764 static void get_counters(const struct arpt_table_info
*t
,
765 struct arpt_counters counters
[])
770 for (cpu
= 0; cpu
< num_possible_cpus(); cpu
++) {
772 ARPT_ENTRY_ITERATE(t
->entries
+ TABLE_OFFSET(t
, cpu
),
774 add_entry_to_counter
,
780 static int copy_entries_to_user(unsigned int total_size
,
781 struct arpt_table
*table
,
782 void __user
*userptr
)
784 unsigned int off
, num
, countersize
;
785 struct arpt_entry
*e
;
786 struct arpt_counters
*counters
;
789 /* We need atomic snapshot of counters: rest doesn't change
790 * (other than comefrom, which userspace doesn't care
793 countersize
= sizeof(struct arpt_counters
) * table
->private->number
;
794 counters
= vmalloc(countersize
);
796 if (counters
== NULL
)
799 /* First, sum counters... */
800 memset(counters
, 0, countersize
);
801 write_lock_bh(&table
->lock
);
802 get_counters(table
->private, counters
);
803 write_unlock_bh(&table
->lock
);
805 /* ... then copy entire thing from CPU 0... */
806 if (copy_to_user(userptr
, table
->private->entries
, total_size
) != 0) {
811 /* FIXME: use iterator macros --RR */
812 /* ... then go back and fix counters and names */
813 for (off
= 0, num
= 0; off
< total_size
; off
+= e
->next_offset
, num
++){
814 struct arpt_entry_target
*t
;
816 e
= (struct arpt_entry
*)(table
->private->entries
+ off
);
817 if (copy_to_user(userptr
+ off
818 + offsetof(struct arpt_entry
, counters
),
820 sizeof(counters
[num
])) != 0) {
825 t
= arpt_get_target(e
);
826 if (copy_to_user(userptr
+ off
+ e
->target_offset
827 + offsetof(struct arpt_entry_target
,
829 t
->u
.kernel
.target
->name
,
830 strlen(t
->u
.kernel
.target
->name
)+1) != 0) {
841 static int get_entries(const struct arpt_get_entries
*entries
,
842 struct arpt_get_entries __user
*uptr
)
845 struct arpt_table
*t
;
847 t
= arpt_find_table_lock(entries
->name
, &ret
, &arpt_mutex
);
849 duprintf("t->private->number = %u\n",
851 if (entries
->size
== t
->private->size
)
852 ret
= copy_entries_to_user(t
->private->size
,
853 t
, uptr
->entrytable
);
855 duprintf("get_entries: I've got %u not %u!\n",
862 duprintf("get_entries: Can't find %s!\n",
868 static int do_replace(void __user
*user
, unsigned int len
)
871 struct arpt_replace tmp
;
872 struct arpt_table
*t
;
873 struct arpt_table_info
*newinfo
, *oldinfo
;
874 struct arpt_counters
*counters
;
876 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
879 /* Hack: Causes ipchains to give correct error msg --RR */
880 if (len
!= sizeof(tmp
) + tmp
.size
)
883 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
884 if ((SMP_ALIGN(tmp
.size
) >> PAGE_SHIFT
) + 2 > num_physpages
)
887 newinfo
= vmalloc(sizeof(struct arpt_table_info
)
888 + SMP_ALIGN(tmp
.size
) * num_possible_cpus());
892 if (copy_from_user(newinfo
->entries
, user
+ sizeof(tmp
),
898 counters
= vmalloc(tmp
.num_counters
* sizeof(struct arpt_counters
));
903 memset(counters
, 0, tmp
.num_counters
* sizeof(struct arpt_counters
));
905 ret
= translate_table(tmp
.name
, tmp
.valid_hooks
,
906 newinfo
, tmp
.size
, tmp
.num_entries
,
907 tmp
.hook_entry
, tmp
.underflow
);
909 goto free_newinfo_counters
;
911 duprintf("arp_tables: Translated table\n");
913 t
= arpt_find_table_lock(tmp
.name
, &ret
, &arpt_mutex
);
915 goto free_newinfo_counters_untrans
;
918 if (tmp
.valid_hooks
!= t
->valid_hooks
) {
919 duprintf("Valid hook crap: %08X vs %08X\n",
920 tmp
.valid_hooks
, t
->valid_hooks
);
922 goto free_newinfo_counters_untrans_unlock
;
925 /* Get a reference in advance, we're not allowed fail later */
926 if (!try_module_get(t
->me
)) {
928 goto free_newinfo_counters_untrans_unlock
;
931 oldinfo
= replace_table(t
, tmp
.num_counters
, newinfo
, &ret
);
935 /* Update module usage count based on number of rules */
936 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
937 oldinfo
->number
, oldinfo
->initial_entries
, newinfo
->number
);
938 if ((oldinfo
->number
> oldinfo
->initial_entries
) ||
939 (newinfo
->number
<= oldinfo
->initial_entries
))
941 if ((oldinfo
->number
> oldinfo
->initial_entries
) &&
942 (newinfo
->number
<= oldinfo
->initial_entries
))
945 /* Get the old counters. */
946 get_counters(oldinfo
, counters
);
947 /* Decrease module usage counts and free resource */
948 ARPT_ENTRY_ITERATE(oldinfo
->entries
, oldinfo
->size
, cleanup_entry
,NULL
);
950 if (copy_to_user(tmp
.counters
, counters
,
951 sizeof(struct arpt_counters
) * tmp
.num_counters
) != 0)
959 free_newinfo_counters_untrans_unlock
:
961 free_newinfo_counters_untrans
:
962 ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
, cleanup_entry
, NULL
);
963 free_newinfo_counters
:
970 /* We're lazy, and add to the first CPU; overflow works its fey magic
971 * and everything is OK.
973 static inline int add_counter_to_entry(struct arpt_entry
*e
,
974 const struct arpt_counters addme
[],
978 ADD_COUNTER(e
->counters
, addme
[*i
].bcnt
, addme
[*i
].pcnt
);
984 static int do_add_counters(void __user
*user
, unsigned int len
)
987 struct arpt_counters_info tmp
, *paddc
;
988 struct arpt_table
*t
;
991 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
994 if (len
!= sizeof(tmp
) + tmp
.num_counters
*sizeof(struct arpt_counters
))
997 paddc
= vmalloc(len
);
1001 if (copy_from_user(paddc
, user
, len
) != 0) {
1006 t
= arpt_find_table_lock(tmp
.name
, &ret
, &arpt_mutex
);
1010 write_lock_bh(&t
->lock
);
1011 if (t
->private->number
!= paddc
->num_counters
) {
1013 goto unlock_up_free
;
1017 ARPT_ENTRY_ITERATE(t
->private->entries
,
1019 add_counter_to_entry
,
1023 write_unlock_bh(&t
->lock
);
1031 static int do_arpt_set_ctl(struct sock
*sk
, int cmd
, void __user
*user
, unsigned int len
)
1035 if (!capable(CAP_NET_ADMIN
))
1039 case ARPT_SO_SET_REPLACE
:
1040 ret
= do_replace(user
, len
);
1043 case ARPT_SO_SET_ADD_COUNTERS
:
1044 ret
= do_add_counters(user
, len
);
1048 duprintf("do_arpt_set_ctl: unknown request %i\n", cmd
);
1055 static int do_arpt_get_ctl(struct sock
*sk
, int cmd
, void __user
*user
, int *len
)
1059 if (!capable(CAP_NET_ADMIN
))
1063 case ARPT_SO_GET_INFO
: {
1064 char name
[ARPT_TABLE_MAXNAMELEN
];
1065 struct arpt_table
*t
;
1067 if (*len
!= sizeof(struct arpt_getinfo
)) {
1068 duprintf("length %u != %Zu\n", *len
,
1069 sizeof(struct arpt_getinfo
));
1074 if (copy_from_user(name
, user
, sizeof(name
)) != 0) {
1078 name
[ARPT_TABLE_MAXNAMELEN
-1] = '\0';
1079 t
= arpt_find_table_lock(name
, &ret
, &arpt_mutex
);
1081 struct arpt_getinfo info
;
1083 info
.valid_hooks
= t
->valid_hooks
;
1084 memcpy(info
.hook_entry
, t
->private->hook_entry
,
1085 sizeof(info
.hook_entry
));
1086 memcpy(info
.underflow
, t
->private->underflow
,
1087 sizeof(info
.underflow
));
1088 info
.num_entries
= t
->private->number
;
1089 info
.size
= t
->private->size
;
1090 strcpy(info
.name
, name
);
1092 if (copy_to_user(user
, &info
, *len
) != 0)
1102 case ARPT_SO_GET_ENTRIES
: {
1103 struct arpt_get_entries get
;
1105 if (*len
< sizeof(get
)) {
1106 duprintf("get_entries: %u < %Zu\n", *len
, sizeof(get
));
1108 } else if (copy_from_user(&get
, user
, sizeof(get
)) != 0) {
1110 } else if (*len
!= sizeof(struct arpt_get_entries
) + get
.size
) {
1111 duprintf("get_entries: %u != %Zu\n", *len
,
1112 sizeof(struct arpt_get_entries
) + get
.size
);
1115 ret
= get_entries(&get
, user
);
1120 duprintf("do_arpt_get_ctl: unknown request %i\n", cmd
);
1127 /* Registration hooks for targets. */
1128 int arpt_register_target(struct arpt_target
*target
)
1132 ret
= down_interruptible(&arpt_mutex
);
1136 if (!list_named_insert(&arpt_target
, target
)) {
1137 duprintf("arpt_register_target: `%s' already in list!\n",
1145 void arpt_unregister_target(struct arpt_target
*target
)
1148 LIST_DELETE(&arpt_target
, target
);
1152 int arpt_register_table(struct arpt_table
*table
,
1153 const struct arpt_replace
*repl
)
1156 struct arpt_table_info
*newinfo
;
1157 static struct arpt_table_info bootstrap
1158 = { 0, 0, 0, { 0 }, { 0 }, { } };
1160 newinfo
= vmalloc(sizeof(struct arpt_table_info
)
1161 + SMP_ALIGN(repl
->size
) * num_possible_cpus());
1166 memcpy(newinfo
->entries
, repl
->entries
, repl
->size
);
1168 ret
= translate_table(table
->name
, table
->valid_hooks
,
1169 newinfo
, repl
->size
,
1173 duprintf("arpt_register_table: translate table gives %d\n", ret
);
1179 ret
= down_interruptible(&arpt_mutex
);
1185 /* Don't autoload: we'd eat our tail... */
1186 if (list_named_find(&arpt_tables
, table
->name
)) {
1191 /* Simplifies replace_table code. */
1192 table
->private = &bootstrap
;
1193 if (!replace_table(table
, 0, newinfo
, &ret
))
1196 duprintf("table->private->number = %u\n",
1197 table
->private->number
);
1199 /* save number of initial entries */
1200 table
->private->initial_entries
= table
->private->number
;
1202 rwlock_init(&table
->lock
);
1203 list_prepend(&arpt_tables
, table
);
1214 void arpt_unregister_table(struct arpt_table
*table
)
1217 LIST_DELETE(&arpt_tables
, table
);
1220 /* Decrease module usage counts and free resources */
1221 ARPT_ENTRY_ITERATE(table
->private->entries
, table
->private->size
,
1222 cleanup_entry
, NULL
);
1223 vfree(table
->private);
1226 /* The built-in targets: standard (NULL) and error. */
1227 static struct arpt_target arpt_standard_target
= {
1228 .name
= ARPT_STANDARD_TARGET
,
1231 static struct arpt_target arpt_error_target
= {
1232 .name
= ARPT_ERROR_TARGET
,
1233 .target
= arpt_error
,
1236 static struct nf_sockopt_ops arpt_sockopts
= {
1238 .set_optmin
= ARPT_BASE_CTL
,
1239 .set_optmax
= ARPT_SO_SET_MAX
+1,
1240 .set
= do_arpt_set_ctl
,
1241 .get_optmin
= ARPT_BASE_CTL
,
1242 .get_optmax
= ARPT_SO_GET_MAX
+1,
1243 .get
= do_arpt_get_ctl
,
1246 #ifdef CONFIG_PROC_FS
1247 static inline int print_name(const struct arpt_table
*t
,
1248 off_t start_offset
, char *buffer
, int length
,
1249 off_t
*pos
, unsigned int *count
)
1251 if ((*count
)++ >= start_offset
) {
1252 unsigned int namelen
;
1254 namelen
= sprintf(buffer
+ *pos
, "%s\n", t
->name
);
1255 if (*pos
+ namelen
> length
) {
1256 /* Stop iterating */
1264 static int arpt_get_tables(char *buffer
, char **start
, off_t offset
, int length
)
1267 unsigned int count
= 0;
1269 if (down_interruptible(&arpt_mutex
) != 0)
1272 LIST_FIND(&arpt_tables
, print_name
, struct arpt_table
*,
1273 offset
, buffer
, length
, &pos
, &count
);
1277 /* `start' hack - see fs/proc/generic.c line ~105 */
1278 *start
=(char *)((unsigned long)count
-offset
);
1281 #endif /*CONFIG_PROC_FS*/
1283 static int __init
init(void)
1287 /* Noone else will be downing sem now, so we won't sleep */
1289 list_append(&arpt_target
, &arpt_standard_target
);
1290 list_append(&arpt_target
, &arpt_error_target
);
1293 /* Register setsockopt */
1294 ret
= nf_register_sockopt(&arpt_sockopts
);
1296 duprintf("Unable to register sockopts.\n");
1300 #ifdef CONFIG_PROC_FS
1302 struct proc_dir_entry
*proc
;
1304 proc
= proc_net_create("arp_tables_names", 0, arpt_get_tables
);
1306 nf_unregister_sockopt(&arpt_sockopts
);
1309 proc
->owner
= THIS_MODULE
;
1313 printk("arp_tables: (C) 2002 David S. Miller\n");
1317 static void __exit
fini(void)
1319 nf_unregister_sockopt(&arpt_sockopts
);
1320 #ifdef CONFIG_PROC_FS
1321 proc_net_remove("arp_tables_names");
1325 EXPORT_SYMBOL(arpt_register_table
);
1326 EXPORT_SYMBOL(arpt_unregister_table
);
1327 EXPORT_SYMBOL(arpt_do_table
);
1328 EXPORT_SYMBOL(arpt_register_target
);
1329 EXPORT_SYMBOL(arpt_unregister_target
);