2 * Packet matching code for ARP packets.
4 * Based heavily, if not almost entirely, upon ip_tables.c framework.
6 * Some ARP specific bits are:
8 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
12 #include <linux/config.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/if_arp.h>
17 #include <linux/kmod.h>
18 #include <linux/vmalloc.h>
19 #include <linux/proc_fs.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
23 #include <asm/uaccess.h>
24 #include <asm/semaphore.h>
26 #include <linux/netfilter_arp/arp_tables.h>
28 /*#define DEBUG_ARP_TABLES*/
29 /*#define DEBUG_ARP_TABLES_USER*/
31 #ifdef DEBUG_ARP_TABLES
32 #define dprintf(format, args...) printk(format , ## args)
34 #define dprintf(format, args...)
37 #ifdef DEBUG_ARP_TABLES_USER
38 #define duprintf(format, args...) printk(format , ## args)
40 #define duprintf(format, args...)
43 #ifdef CONFIG_NETFILTER_DEBUG
44 #define ARP_NF_ASSERT(x) \
47 printk("ARP_NF_ASSERT: %s:%s:%u\n", \
48 __FUNCTION__, __FILE__, __LINE__); \
51 #define ARP_NF_ASSERT(x)
53 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
55 static DECLARE_MUTEX(arpt_mutex
);
57 #define ASSERT_READ_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
58 #define ASSERT_WRITE_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
59 #include <linux/netfilter_ipv4/lockhelp.h>
60 #include <linux/netfilter_ipv4/listhelp.h>
62 struct arpt_table_info
{
65 unsigned int initial_entries
;
66 unsigned int hook_entry
[NF_ARP_NUMHOOKS
];
67 unsigned int underflow
[NF_ARP_NUMHOOKS
];
68 char entries
[0] __attribute__((aligned(SMP_CACHE_BYTES
)));
71 static LIST_HEAD(arpt_target
);
72 static LIST_HEAD(arpt_tables
);
73 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
76 #define TABLE_OFFSET(t,p) (SMP_ALIGN((t)->size)*(p))
78 #define TABLE_OFFSET(t,p) 0
81 static inline int arp_devaddr_compare(const struct arpt_devaddr_info
*ap
,
82 char *hdr_addr
, int len
)
86 if (len
> ARPT_DEV_ADDR_LEN_MAX
)
87 len
= ARPT_DEV_ADDR_LEN_MAX
;
90 for (i
= 0; i
< len
; i
++)
91 ret
|= (hdr_addr
[i
] ^ ap
->addr
[i
]) & ap
->mask
[i
];
96 /* Returns whether packet matches rule or not. */
97 static inline int arp_packet_match(const struct arphdr
*arphdr
,
98 struct net_device
*dev
,
101 const struct arpt_arp
*arpinfo
)
103 char *arpptr
= (char *)(arphdr
+ 1);
104 char *src_devaddr
, *tgt_devaddr
;
105 u32
*src_ipaddr
, *tgt_ipaddr
;
108 #define FWINV(bool,invflg) ((bool) ^ !!(arpinfo->invflags & invflg))
110 if (FWINV((arphdr
->ar_op
& arpinfo
->arpop_mask
) != arpinfo
->arpop
,
112 dprintf("ARP operation field mismatch.\n");
113 dprintf("ar_op: %04x info->arpop: %04x info->arpop_mask: %04x\n",
114 arphdr
->ar_op
, arpinfo
->arpop
, arpinfo
->arpop_mask
);
118 if (FWINV((arphdr
->ar_hrd
& arpinfo
->arhrd_mask
) != arpinfo
->arhrd
,
120 dprintf("ARP hardware address format mismatch.\n");
121 dprintf("ar_hrd: %04x info->arhrd: %04x info->arhrd_mask: %04x\n",
122 arphdr
->ar_hrd
, arpinfo
->arhrd
, arpinfo
->arhrd_mask
);
126 if (FWINV((arphdr
->ar_pro
& arpinfo
->arpro_mask
) != arpinfo
->arpro
,
128 dprintf("ARP protocol address format mismatch.\n");
129 dprintf("ar_pro: %04x info->arpro: %04x info->arpro_mask: %04x\n",
130 arphdr
->ar_pro
, arpinfo
->arpro
, arpinfo
->arpro_mask
);
134 if (FWINV((arphdr
->ar_hln
& arpinfo
->arhln_mask
) != arpinfo
->arhln
,
136 dprintf("ARP hardware address length mismatch.\n");
137 dprintf("ar_hln: %02x info->arhln: %02x info->arhln_mask: %02x\n",
138 arphdr
->ar_hln
, arpinfo
->arhln
, arpinfo
->arhln_mask
);
141 src_devaddr
= arpptr
;
142 arpptr
+= dev
->addr_len
;
143 src_ipaddr
= (u32
*) arpptr
;
144 arpptr
+= sizeof(u32
);
145 tgt_devaddr
= arpptr
;
146 arpptr
+= dev
->addr_len
;
147 tgt_ipaddr
= (u32
*) arpptr
;
149 if (FWINV(arp_devaddr_compare(&arpinfo
->src_devaddr
, src_devaddr
, dev
->addr_len
),
150 ARPT_INV_SRCDEVADDR
) ||
151 FWINV(arp_devaddr_compare(&arpinfo
->tgt_devaddr
, tgt_devaddr
, dev
->addr_len
),
152 ARPT_INV_TGTDEVADDR
)) {
153 dprintf("Source or target device address mismatch.\n");
158 if (FWINV(((*src_ipaddr
) & arpinfo
->smsk
.s_addr
) != arpinfo
->src
.s_addr
,
160 FWINV((((*tgt_ipaddr
) & arpinfo
->tmsk
.s_addr
) != arpinfo
->tgt
.s_addr
),
162 dprintf("Source or target IP address mismatch.\n");
164 dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
165 NIPQUAD(*src_ipaddr
),
166 NIPQUAD(arpinfo
->smsk
.s_addr
),
167 NIPQUAD(arpinfo
->src
.s_addr
),
168 arpinfo
->invflags
& ARPT_INV_SRCIP
? " (INV)" : "");
169 dprintf("TGT: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
170 NIPQUAD(*tgt_ipaddr
),
171 NIPQUAD(arpinfo
->tmsk
.s_addr
),
172 NIPQUAD(arpinfo
->tgt
.s_addr
),
173 arpinfo
->invflags
& ARPT_INV_TGTIP
? " (INV)" : "");
177 /* Look for ifname matches; this should unroll nicely. */
178 for (i
= 0, ret
= 0; i
< IFNAMSIZ
/sizeof(unsigned long); i
++) {
179 ret
|= (((const unsigned long *)indev
)[i
]
180 ^ ((const unsigned long *)arpinfo
->iniface
)[i
])
181 & ((const unsigned long *)arpinfo
->iniface_mask
)[i
];
184 if (FWINV(ret
!= 0, ARPT_INV_VIA_IN
)) {
185 dprintf("VIA in mismatch (%s vs %s).%s\n",
186 indev
, arpinfo
->iniface
,
187 arpinfo
->invflags
&ARPT_INV_VIA_IN
?" (INV)":"");
191 for (i
= 0, ret
= 0; i
< IFNAMSIZ
/sizeof(unsigned long); i
++) {
192 ret
|= (((const unsigned long *)outdev
)[i
]
193 ^ ((const unsigned long *)arpinfo
->outiface
)[i
])
194 & ((const unsigned long *)arpinfo
->outiface_mask
)[i
];
197 if (FWINV(ret
!= 0, ARPT_INV_VIA_OUT
)) {
198 dprintf("VIA out mismatch (%s vs %s).%s\n",
199 outdev
, arpinfo
->outiface
,
200 arpinfo
->invflags
&ARPT_INV_VIA_OUT
?" (INV)":"");
207 static inline int arp_checkentry(const struct arpt_arp
*arp
)
209 if (arp
->flags
& ~ARPT_F_MASK
) {
210 duprintf("Unknown flag bits set: %08X\n",
211 arp
->flags
& ~ARPT_F_MASK
);
214 if (arp
->invflags
& ~ARPT_INV_MASK
) {
215 duprintf("Unknown invflag bits set: %08X\n",
216 arp
->invflags
& ~ARPT_INV_MASK
);
223 static unsigned int arpt_error(struct sk_buff
**pskb
,
224 unsigned int hooknum
,
225 const struct net_device
*in
,
226 const struct net_device
*out
,
227 const void *targinfo
,
231 printk("arp_tables: error: '%s'\n", (char *)targinfo
);
236 static inline struct arpt_entry
*get_entry(void *base
, unsigned int offset
)
238 return (struct arpt_entry
*)(base
+ offset
);
241 unsigned int arpt_do_table(struct sk_buff
**pskb
,
243 const struct net_device
*in
,
244 const struct net_device
*out
,
245 struct arpt_table
*table
,
248 static const char nulldevname
[IFNAMSIZ
] = { 0 };
249 unsigned int verdict
= NF_DROP
;
250 struct arphdr
*arp
= (*pskb
)->nh
.arph
;
252 struct arpt_entry
*e
, *back
;
253 const char *indev
, *outdev
;
256 indev
= in
? in
->name
: nulldevname
;
257 outdev
= out
? out
->name
: nulldevname
;
259 read_lock_bh(&table
->lock
);
260 table_base
= (void *)table
->private->entries
261 + TABLE_OFFSET(table
->private,
262 cpu_number_map(smp_processor_id()));
263 e
= get_entry(table_base
, table
->private->hook_entry
[hook
]);
264 back
= get_entry(table_base
, table
->private->underflow
[hook
]);
267 if (arp_packet_match(arp
, (*pskb
)->dev
, indev
, outdev
, &e
->arp
)) {
268 struct arpt_entry_target
*t
;
271 hdr_len
= sizeof(*arp
) + (2 * sizeof(struct in_addr
)) +
272 (2 * (*pskb
)->dev
->addr_len
);
273 ADD_COUNTER(e
->counters
, hdr_len
, 1);
275 t
= arpt_get_target(e
);
277 /* Standard target? */
278 if (!t
->u
.kernel
.target
->target
) {
281 v
= ((struct arpt_standard_target
*)t
)->verdict
;
283 /* Pop from stack? */
284 if (v
!= ARPT_RETURN
) {
285 verdict
= (unsigned)(-v
) - 1;
289 back
= get_entry(table_base
,
294 != (void *)e
+ e
->next_offset
) {
295 /* Save old back ptr in next entry */
296 struct arpt_entry
*next
297 = (void *)e
+ e
->next_offset
;
299 (void *)back
- table_base
;
301 /* set back pointer to next entry */
305 e
= get_entry(table_base
, v
);
307 /* Targets which reenter must return
310 verdict
= t
->u
.kernel
.target
->target(pskb
,
316 /* Target might have changed stuff. */
317 arp
= (*pskb
)->nh
.arph
;
319 if (verdict
== ARPT_CONTINUE
)
320 e
= (void *)e
+ e
->next_offset
;
326 e
= (void *)e
+ e
->next_offset
;
329 read_unlock_bh(&table
->lock
);
337 static inline void *find_inlist_lock_noload(struct list_head
*head
,
340 struct semaphore
*mutex
)
344 *error
= down_interruptible(mutex
);
348 ret
= list_named_find(head
, name
);
357 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
360 find_inlist_lock(struct list_head
*head
,
364 struct semaphore
*mutex
)
368 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
370 char modulename
[ARPT_FUNCTION_MAXNAMELEN
+ strlen(prefix
) + 1];
371 strcpy(modulename
, prefix
);
372 strcat(modulename
, name
);
373 duprintf("find_inlist: loading `%s'.\n", modulename
);
374 request_module(modulename
);
375 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
382 static inline struct arpt_table
*find_table_lock(const char *name
, int *error
, struct semaphore
*mutex
)
384 return find_inlist_lock(&arpt_tables
, name
, "arptable_", error
, mutex
);
387 static inline struct arpt_target
*find_target_lock(const char *name
, int *error
, struct semaphore
*mutex
)
389 return find_inlist_lock(&arpt_target
, name
, "arpt_", error
, mutex
);
392 /* All zeroes == unconditional rule. */
393 static inline int unconditional(const struct arpt_arp
*arp
)
397 for (i
= 0; i
< sizeof(*arp
)/sizeof(__u32
); i
++)
398 if (((__u32
*)arp
)[i
])
404 /* Figures out from what hook each rule can be called: returns 0 if
405 * there are loops. Puts hook bitmask in comefrom.
407 static int mark_source_chains(struct arpt_table_info
*newinfo
, unsigned int valid_hooks
)
411 /* No recursion; use packet counter to save back ptrs (reset
412 * to 0 as we leave), and comefrom to save source hook bitmask.
414 for (hook
= 0; hook
< NF_ARP_NUMHOOKS
; hook
++) {
415 unsigned int pos
= newinfo
->hook_entry
[hook
];
417 = (struct arpt_entry
*)(newinfo
->entries
+ pos
);
419 if (!(valid_hooks
& (1 << hook
)))
422 /* Set initial back pointer. */
423 e
->counters
.pcnt
= pos
;
426 struct arpt_standard_target
*t
427 = (void *)arpt_get_target(e
);
429 if (e
->comefrom
& (1 << NF_ARP_NUMHOOKS
)) {
430 printk("arptables: loop hook %u pos %u %08X.\n",
431 hook
, pos
, e
->comefrom
);
435 |= ((1 << hook
) | (1 << NF_ARP_NUMHOOKS
));
437 /* Unconditional return/END. */
438 if (e
->target_offset
== sizeof(struct arpt_entry
)
439 && (strcmp(t
->target
.u
.user
.name
,
440 ARPT_STANDARD_TARGET
) == 0)
442 && unconditional(&e
->arp
)) {
443 unsigned int oldpos
, size
;
445 /* Return: backtrack through the last
449 e
->comefrom
^= (1<<NF_ARP_NUMHOOKS
);
451 pos
= e
->counters
.pcnt
;
452 e
->counters
.pcnt
= 0;
454 /* We're at the start. */
458 e
= (struct arpt_entry
*)
459 (newinfo
->entries
+ pos
);
460 } while (oldpos
== pos
+ e
->next_offset
);
463 size
= e
->next_offset
;
464 e
= (struct arpt_entry
*)
465 (newinfo
->entries
+ pos
+ size
);
466 e
->counters
.pcnt
= pos
;
469 int newpos
= t
->verdict
;
471 if (strcmp(t
->target
.u
.user
.name
,
472 ARPT_STANDARD_TARGET
) == 0
474 /* This a jump; chase it. */
475 duprintf("Jump rule %u -> %u\n",
478 /* ... this is a fallthru */
479 newpos
= pos
+ e
->next_offset
;
481 e
= (struct arpt_entry
*)
482 (newinfo
->entries
+ newpos
);
483 e
->counters
.pcnt
= pos
;
488 duprintf("Finished chain %u\n", hook
);
493 static inline int standard_check(const struct arpt_entry_target
*t
,
494 unsigned int max_offset
)
496 struct arpt_standard_target
*targ
= (void *)t
;
498 /* Check standard info. */
500 != ARPT_ALIGN(sizeof(struct arpt_standard_target
))) {
501 duprintf("arpt_standard_check: target size %u != %Zu\n",
503 ARPT_ALIGN(sizeof(struct arpt_standard_target
)));
507 if (targ
->verdict
>= 0
508 && targ
->verdict
> max_offset
- sizeof(struct arpt_entry
)) {
509 duprintf("arpt_standard_check: bad verdict (%i)\n",
514 if (targ
->verdict
< -NF_MAX_VERDICT
- 1) {
515 duprintf("arpt_standard_check: bad negative verdict (%i)\n",
522 static struct arpt_target arpt_standard_target
;
524 static inline int check_entry(struct arpt_entry
*e
, const char *name
, unsigned int size
,
527 struct arpt_entry_target
*t
;
528 struct arpt_target
*target
;
531 if (!arp_checkentry(&e
->arp
)) {
532 duprintf("arp_tables: arp check failed %p %s.\n", e
, name
);
536 t
= arpt_get_target(e
);
537 target
= find_target_lock(t
->u
.user
.name
, &ret
, &arpt_mutex
);
539 duprintf("check_entry: `%s' not found\n", t
->u
.user
.name
);
543 __MOD_INC_USE_COUNT(target
->me
);
544 t
->u
.kernel
.target
= target
;
547 if (t
->u
.kernel
.target
== &arpt_standard_target
) {
548 if (!standard_check(t
, size
)) {
552 } else if (t
->u
.kernel
.target
->checkentry
553 && !t
->u
.kernel
.target
->checkentry(name
, e
, t
->data
,
557 if (t
->u
.kernel
.target
->me
)
558 __MOD_DEC_USE_COUNT(t
->u
.kernel
.target
->me
);
559 duprintf("arp_tables: check failed for `%s'.\n",
560 t
->u
.kernel
.target
->name
);
572 static inline int check_entry_size_and_hooks(struct arpt_entry
*e
,
573 struct arpt_table_info
*newinfo
,
575 unsigned char *limit
,
576 const unsigned int *hook_entries
,
577 const unsigned int *underflows
,
582 if ((unsigned long)e
% __alignof__(struct arpt_entry
) != 0
583 || (unsigned char *)e
+ sizeof(struct arpt_entry
) >= limit
) {
584 duprintf("Bad offset %p\n", e
);
589 < sizeof(struct arpt_entry
) + sizeof(struct arpt_entry_target
)) {
590 duprintf("checking: element %p size %u\n",
595 /* Check hooks & underflows */
596 for (h
= 0; h
< NF_ARP_NUMHOOKS
; h
++) {
597 if ((unsigned char *)e
- base
== hook_entries
[h
])
598 newinfo
->hook_entry
[h
] = hook_entries
[h
];
599 if ((unsigned char *)e
- base
== underflows
[h
])
600 newinfo
->underflow
[h
] = underflows
[h
];
604 /* Clear counters and comefrom */
605 e
->counters
= ((struct arpt_counters
) { 0, 0 });
612 static inline int cleanup_entry(struct arpt_entry
*e
, unsigned int *i
)
614 struct arpt_entry_target
*t
;
616 if (i
&& (*i
)-- == 0)
619 t
= arpt_get_target(e
);
620 if (t
->u
.kernel
.target
->destroy
)
621 t
->u
.kernel
.target
->destroy(t
->data
,
622 t
->u
.target_size
- sizeof(*t
));
623 if (t
->u
.kernel
.target
->me
)
624 __MOD_DEC_USE_COUNT(t
->u
.kernel
.target
->me
);
629 /* Checks and translates the user-supplied table segment (held in
632 static int translate_table(const char *name
,
633 unsigned int valid_hooks
,
634 struct arpt_table_info
*newinfo
,
637 const unsigned int *hook_entries
,
638 const unsigned int *underflows
)
643 newinfo
->size
= size
;
644 newinfo
->number
= number
;
646 /* Init all hooks to impossible value. */
647 for (i
= 0; i
< NF_ARP_NUMHOOKS
; i
++) {
648 newinfo
->hook_entry
[i
] = 0xFFFFFFFF;
649 newinfo
->underflow
[i
] = 0xFFFFFFFF;
652 duprintf("translate_table: size %u\n", newinfo
->size
);
655 /* Walk through entries, checking offsets. */
656 ret
= ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
,
657 check_entry_size_and_hooks
,
660 newinfo
->entries
+ size
,
661 hook_entries
, underflows
, &i
);
662 duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret
);
667 duprintf("translate_table: %u not %u entries\n",
672 /* Check hooks all assigned */
673 for (i
= 0; i
< NF_ARP_NUMHOOKS
; i
++) {
674 /* Only hooks which are valid */
675 if (!(valid_hooks
& (1 << i
)))
677 if (newinfo
->hook_entry
[i
] == 0xFFFFFFFF) {
678 duprintf("Invalid hook entry %u %u\n",
682 if (newinfo
->underflow
[i
] == 0xFFFFFFFF) {
683 duprintf("Invalid underflow %u %u\n",
689 if (!mark_source_chains(newinfo
, valid_hooks
)) {
690 duprintf("Looping hook\n");
694 /* Finally, each sanity check must pass */
696 ret
= ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
,
697 check_entry
, name
, size
, &i
);
700 ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
,
705 /* And one copy for every other CPU */
706 for (i
= 1; i
< smp_num_cpus
; i
++) {
707 memcpy(newinfo
->entries
+ SMP_ALIGN(newinfo
->size
)*i
,
709 SMP_ALIGN(newinfo
->size
));
715 static struct arpt_table_info
*replace_table(struct arpt_table
*table
,
716 unsigned int num_counters
,
717 struct arpt_table_info
*newinfo
,
720 struct arpt_table_info
*oldinfo
;
722 /* Do the substitution. */
723 write_lock_bh(&table
->lock
);
724 /* Check inside lock: is the old number correct? */
725 if (num_counters
!= table
->private->number
) {
726 duprintf("num_counters != table->private->number (%u/%u)\n",
727 num_counters
, table
->private->number
);
728 write_unlock_bh(&table
->lock
);
732 oldinfo
= table
->private;
733 table
->private = newinfo
;
734 newinfo
->initial_entries
= oldinfo
->initial_entries
;
735 write_unlock_bh(&table
->lock
);
741 static inline int add_entry_to_counter(const struct arpt_entry
*e
,
742 struct arpt_counters total
[],
745 ADD_COUNTER(total
[*i
], e
->counters
.bcnt
, e
->counters
.pcnt
);
751 static void get_counters(const struct arpt_table_info
*t
,
752 struct arpt_counters counters
[])
757 for (cpu
= 0; cpu
< smp_num_cpus
; cpu
++) {
759 ARPT_ENTRY_ITERATE(t
->entries
+ TABLE_OFFSET(t
, cpu
),
761 add_entry_to_counter
,
767 static int copy_entries_to_user(unsigned int total_size
,
768 struct arpt_table
*table
,
771 unsigned int off
, num
, countersize
;
772 struct arpt_entry
*e
;
773 struct arpt_counters
*counters
;
776 /* We need atomic snapshot of counters: rest doesn't change
777 * (other than comefrom, which userspace doesn't care
780 countersize
= sizeof(struct arpt_counters
) * table
->private->number
;
781 counters
= vmalloc(countersize
);
783 if (counters
== NULL
)
786 /* First, sum counters... */
787 memset(counters
, 0, countersize
);
788 write_lock_bh(&table
->lock
);
789 get_counters(table
->private, counters
);
790 write_unlock_bh(&table
->lock
);
792 /* ... then copy entire thing from CPU 0... */
793 if (copy_to_user(userptr
, table
->private->entries
, total_size
) != 0) {
798 /* ... then go back and fix counters and names */
799 for (off
= 0, num
= 0; off
< total_size
; off
+= e
->next_offset
, num
++){
800 struct arpt_entry_target
*t
;
802 e
= (struct arpt_entry
*)(table
->private->entries
+ off
);
803 if (copy_to_user(userptr
+ off
804 + offsetof(struct arpt_entry
, counters
),
806 sizeof(counters
[num
])) != 0) {
811 t
= arpt_get_target(e
);
812 if (copy_to_user(userptr
+ off
+ e
->target_offset
813 + offsetof(struct arpt_entry_target
,
815 t
->u
.kernel
.target
->name
,
816 strlen(t
->u
.kernel
.target
->name
)+1) != 0) {
827 static int get_entries(const struct arpt_get_entries
*entries
,
828 struct arpt_get_entries
*uptr
)
831 struct arpt_table
*t
;
833 t
= find_table_lock(entries
->name
, &ret
, &arpt_mutex
);
835 duprintf("t->private->number = %u\n",
837 if (entries
->size
== t
->private->size
)
838 ret
= copy_entries_to_user(t
->private->size
,
839 t
, uptr
->entrytable
);
841 duprintf("get_entries: I've got %u not %u!\n",
848 duprintf("get_entries: Can't find %s!\n",
854 static int do_replace(void *user
, unsigned int len
)
857 struct arpt_replace tmp
;
858 struct arpt_table
*t
;
859 struct arpt_table_info
*newinfo
, *oldinfo
;
860 struct arpt_counters
*counters
;
862 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
865 /* Hack: Causes ipchains to give correct error msg --RR */
866 if (len
!= sizeof(tmp
) + tmp
.size
)
869 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
870 if ((SMP_ALIGN(tmp
.size
) >> PAGE_SHIFT
) + 2 > num_physpages
)
873 newinfo
= vmalloc(sizeof(struct arpt_table_info
)
874 + SMP_ALIGN(tmp
.size
) * smp_num_cpus
);
878 if (copy_from_user(newinfo
->entries
, user
+ sizeof(tmp
),
884 counters
= vmalloc(tmp
.num_counters
* sizeof(struct arpt_counters
));
889 memset(counters
, 0, tmp
.num_counters
* sizeof(struct arpt_counters
));
891 ret
= translate_table(tmp
.name
, tmp
.valid_hooks
,
892 newinfo
, tmp
.size
, tmp
.num_entries
,
893 tmp
.hook_entry
, tmp
.underflow
);
895 goto free_newinfo_counters
;
897 duprintf("arp_tables: Translated table\n");
899 t
= find_table_lock(tmp
.name
, &ret
, &arpt_mutex
);
901 goto free_newinfo_counters_untrans
;
904 if (tmp
.valid_hooks
!= t
->valid_hooks
) {
905 duprintf("Valid hook crap: %08X vs %08X\n",
906 tmp
.valid_hooks
, t
->valid_hooks
);
908 goto free_newinfo_counters_untrans_unlock
;
911 oldinfo
= replace_table(t
, tmp
.num_counters
, newinfo
, &ret
);
913 goto free_newinfo_counters_untrans_unlock
;
915 /* Update module usage count based on number of rules */
916 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
917 oldinfo
->number
, oldinfo
->initial_entries
, newinfo
->number
);
918 if (t
->me
&& (oldinfo
->number
<= oldinfo
->initial_entries
) &&
919 (newinfo
->number
> oldinfo
->initial_entries
))
920 __MOD_INC_USE_COUNT(t
->me
);
921 else if (t
->me
&& (oldinfo
->number
> oldinfo
->initial_entries
) &&
922 (newinfo
->number
<= oldinfo
->initial_entries
))
923 __MOD_DEC_USE_COUNT(t
->me
);
925 /* Get the old counters. */
926 get_counters(oldinfo
, counters
);
927 /* Decrease module usage counts and free resource */
928 ARPT_ENTRY_ITERATE(oldinfo
->entries
, oldinfo
->size
, cleanup_entry
,NULL
);
930 /* Silent error: too late now. */
931 copy_to_user(tmp
.counters
, counters
,
932 sizeof(struct arpt_counters
) * tmp
.num_counters
);
937 free_newinfo_counters_untrans_unlock
:
939 free_newinfo_counters_untrans
:
940 ARPT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->size
, cleanup_entry
, NULL
);
941 free_newinfo_counters
:
948 /* We're lazy, and add to the first CPU; overflow works its fey magic
949 * and everything is OK.
951 static inline int add_counter_to_entry(struct arpt_entry
*e
,
952 const struct arpt_counters addme
[],
956 ADD_COUNTER(e
->counters
, addme
[*i
].bcnt
, addme
[*i
].pcnt
);
962 static int do_add_counters(void *user
, unsigned int len
)
965 struct arpt_counters_info tmp
, *paddc
;
966 struct arpt_table
*t
;
969 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
972 if (len
!= sizeof(tmp
) + tmp
.num_counters
*sizeof(struct arpt_counters
))
975 paddc
= vmalloc(len
);
979 if (copy_from_user(paddc
, user
, len
) != 0) {
984 t
= find_table_lock(tmp
.name
, &ret
, &arpt_mutex
);
988 write_lock_bh(&t
->lock
);
990 #if 0 // removed 1.11 forward bug test
991 // 43011 (09?): checkme: modify by tanghui @ 2006-10-11 for a RACE CONDITION in the "do_add_counters()" function
992 // if (t->private->number != tmp.num_counters) {
994 if (t
->private->number
!= paddc
->num_counters
) {
1000 ARPT_ENTRY_ITERATE(t
->private->entries
,
1002 add_counter_to_entry
,
1006 write_unlock_bh(&t
->lock
);
1014 static int do_arpt_set_ctl(struct sock
*sk
, int cmd
, void *user
, unsigned int len
)
1018 if (!capable(CAP_NET_ADMIN
))
1022 case ARPT_SO_SET_REPLACE
:
1023 ret
= do_replace(user
, len
);
1026 case ARPT_SO_SET_ADD_COUNTERS
:
1027 ret
= do_add_counters(user
, len
);
1031 duprintf("do_arpt_set_ctl: unknown request %i\n", cmd
);
1038 static int do_arpt_get_ctl(struct sock
*sk
, int cmd
, void *user
, int *len
)
1042 if (!capable(CAP_NET_ADMIN
))
1046 case ARPT_SO_GET_INFO
: {
1047 char name
[ARPT_TABLE_MAXNAMELEN
];
1048 struct arpt_table
*t
;
1050 if (*len
!= sizeof(struct arpt_getinfo
)) {
1051 duprintf("length %u != %Zu\n", *len
,
1052 sizeof(struct arpt_getinfo
));
1057 if (copy_from_user(name
, user
, sizeof(name
)) != 0) {
1061 name
[ARPT_TABLE_MAXNAMELEN
-1] = '\0';
1062 t
= find_table_lock(name
, &ret
, &arpt_mutex
);
1064 struct arpt_getinfo info
;
1066 info
.valid_hooks
= t
->valid_hooks
;
1067 memcpy(info
.hook_entry
, t
->private->hook_entry
,
1068 sizeof(info
.hook_entry
));
1069 memcpy(info
.underflow
, t
->private->underflow
,
1070 sizeof(info
.underflow
));
1071 info
.num_entries
= t
->private->number
;
1072 info
.size
= t
->private->size
;
1073 strcpy(info
.name
, name
);
1075 if (copy_to_user(user
, &info
, *len
) != 0)
1085 case ARPT_SO_GET_ENTRIES
: {
1086 struct arpt_get_entries get
;
1088 if (*len
< sizeof(get
)) {
1089 duprintf("get_entries: %u < %Zu\n", *len
, sizeof(get
));
1091 } else if (copy_from_user(&get
, user
, sizeof(get
)) != 0) {
1093 } else if (*len
!= sizeof(struct arpt_get_entries
) + get
.size
) {
1094 duprintf("get_entries: %u != %Zu\n", *len
,
1095 sizeof(struct arpt_get_entries
) + get
.size
);
1098 ret
= get_entries(&get
, user
);
1103 duprintf("do_arpt_get_ctl: unknown request %i\n", cmd
);
1110 /* Registration hooks for targets. */
1111 int arpt_register_target(struct arpt_target
*target
)
1116 ret
= down_interruptible(&arpt_mutex
);
1121 if (!list_named_insert(&arpt_target
, target
)) {
1122 duprintf("arpt_register_target: `%s' already in list!\n",
1131 void arpt_unregister_target(struct arpt_target
*target
)
1134 LIST_DELETE(&arpt_target
, target
);
1139 int arpt_register_table(struct arpt_table
*table
)
1142 struct arpt_table_info
*newinfo
;
1143 static struct arpt_table_info bootstrap
1144 = { 0, 0, 0, { 0 }, { 0 }, { } };
1147 newinfo
= vmalloc(sizeof(struct arpt_table_info
)
1148 + SMP_ALIGN(table
->table
->size
) * smp_num_cpus
);
1154 memcpy(newinfo
->entries
, table
->table
->entries
, table
->table
->size
);
1156 ret
= translate_table(table
->name
, table
->valid_hooks
,
1157 newinfo
, table
->table
->size
,
1158 table
->table
->num_entries
,
1159 table
->table
->hook_entry
,
1160 table
->table
->underflow
);
1161 duprintf("arpt_register_table: translate table gives %d\n", ret
);
1168 ret
= down_interruptible(&arpt_mutex
);
1175 /* Don't autoload: we'd eat our tail... */
1176 if (list_named_find(&arpt_tables
, table
->name
)) {
1181 /* Simplifies replace_table code. */
1182 table
->private = &bootstrap
;
1183 if (!replace_table(table
, 0, newinfo
, &ret
))
1186 duprintf("table->private->number = %u\n",
1187 table
->private->number
);
1189 /* save number of initial entries */
1190 table
->private->initial_entries
= table
->private->number
;
1192 table
->lock
= RW_LOCK_UNLOCKED
;
1193 list_prepend(&arpt_tables
, table
);
1205 void arpt_unregister_table(struct arpt_table
*table
)
1208 LIST_DELETE(&arpt_tables
, table
);
1211 /* Decrease module usage counts and free resources */
1212 ARPT_ENTRY_ITERATE(table
->private->entries
, table
->private->size
,
1213 cleanup_entry
, NULL
);
1214 vfree(table
->private);
1218 /* The built-in targets: standard (NULL) and error. */
1219 static struct arpt_target arpt_standard_target
1220 = { { NULL
, NULL
}, ARPT_STANDARD_TARGET
, NULL
, NULL
, NULL
};
1221 static struct arpt_target arpt_error_target
1222 = { { NULL
, NULL
}, ARPT_ERROR_TARGET
, arpt_error
, NULL
, NULL
};
1224 static struct nf_sockopt_ops arpt_sockopts
1225 = { { NULL
, NULL
}, PF_INET
, ARPT_BASE_CTL
, ARPT_SO_SET_MAX
+1, do_arpt_set_ctl
,
1226 ARPT_BASE_CTL
, ARPT_SO_GET_MAX
+1, do_arpt_get_ctl
, 0, NULL
};
1228 #ifdef CONFIG_PROC_FS
1229 static inline int print_name(const struct arpt_table
*t
,
1230 off_t start_offset
, char *buffer
, int length
,
1231 off_t
*pos
, unsigned int *count
)
1233 if ((*count
)++ >= start_offset
) {
1234 unsigned int namelen
;
1236 namelen
= sprintf(buffer
+ *pos
, "%s\n", t
->name
);
1237 if (*pos
+ namelen
> length
) {
1238 /* Stop iterating */
1246 static int arpt_get_tables(char *buffer
, char **start
, off_t offset
, int length
)
1249 unsigned int count
= 0;
1251 if (down_interruptible(&arpt_mutex
) != 0)
1254 LIST_FIND(&arpt_tables
, print_name
, struct arpt_table
*,
1255 offset
, buffer
, length
, &pos
, &count
);
1259 /* `start' hack - see fs/proc/generic.c line ~105 */
1260 *start
=(char *)((unsigned long)count
-offset
);
1263 #endif /*CONFIG_PROC_FS*/
1265 static int __init
init(void)
1269 /* Noone else will be downing sem now, so we won't sleep */
1271 list_append(&arpt_target
, &arpt_standard_target
);
1272 list_append(&arpt_target
, &arpt_error_target
);
1275 /* Register setsockopt */
1276 ret
= nf_register_sockopt(&arpt_sockopts
);
1278 duprintf("Unable to register sockopts.\n");
1282 #ifdef CONFIG_PROC_FS
1284 struct proc_dir_entry
*proc
;
1286 proc
= proc_net_create("arp_tables_names", 0, arpt_get_tables
);
1288 nf_unregister_sockopt(&arpt_sockopts
);
1291 proc
->owner
= THIS_MODULE
;
1295 printk("arp_tables: (C) 2002 David S. Miller\n");
1299 static void __exit
fini(void)
1301 nf_unregister_sockopt(&arpt_sockopts
);
1302 #ifdef CONFIG_PROC_FS
1303 proc_net_remove("arp_tables_names");
1307 EXPORT_SYMBOL(arpt_register_table
);
1308 EXPORT_SYMBOL(arpt_unregister_table
);
1309 EXPORT_SYMBOL(arpt_do_table
);
1310 EXPORT_SYMBOL(arpt_register_target
);
1311 EXPORT_SYMBOL(arpt_unregister_target
);
1315 MODULE_LICENSE("GPL");