1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16#include <linux/kernel.h>
17#include <linux/socket.h>
18#include <linux/net.h>
19#include <linux/proc_fs.h>
20#include <linux/seq_file.h>
21#include <linux/string.h>
22#include <linux/vmalloc.h>
23#include <linux/mutex.h>
24#include <linux/mm.h>
25#include <net/net_namespace.h>
26
27#include <linux/netfilter/x_tables.h>
28#include <linux/netfilter_arp.h>
29
30
31MODULE_LICENSE("GPL");
32MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
33MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
34
35#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
36
37struct compat_delta {
38 struct compat_delta *next;
39 unsigned int offset;
40 short delta;
41};
42
43struct xt_af {
44 struct mutex mutex;
45 struct list_head match;
46 struct list_head target;
47#ifdef CONFIG_COMPAT
48 struct mutex compat_mutex;
49 struct compat_delta *compat_offsets;
50#endif
51};
52
53static struct xt_af *xt;
54
55#ifdef DEBUG_IP_FIREWALL_USER
56#define duprintf(format, args...) printk(format , ## args)
57#else
58#define duprintf(format, args...)
59#endif
60
61static const char *const xt_prefix[NFPROTO_NUMPROTO] = {
62 [NFPROTO_UNSPEC] = "x",
63 [NFPROTO_IPV4] = "ip",
64 [NFPROTO_ARP] = "arp",
65 [NFPROTO_BRIDGE] = "eb",
66 [NFPROTO_IPV6] = "ip6",
67};
68
69
70int
71xt_register_target(struct xt_target *target)
72{
73 u_int8_t af = target->family;
74 int ret;
75
76 ret = mutex_lock_interruptible(&xt[af].mutex);
77 if (ret != 0)
78 return ret;
79 list_add(&target->list, &xt[af].target);
80 mutex_unlock(&xt[af].mutex);
81 return ret;
82}
83EXPORT_SYMBOL(xt_register_target);
84
85void
86xt_unregister_target(struct xt_target *target)
87{
88 u_int8_t af = target->family;
89
90 mutex_lock(&xt[af].mutex);
91 list_del(&target->list);
92 mutex_unlock(&xt[af].mutex);
93}
94EXPORT_SYMBOL(xt_unregister_target);
95
96int
97xt_register_targets(struct xt_target *target, unsigned int n)
98{
99 unsigned int i;
100 int err = 0;
101
102 for (i = 0; i < n; i++) {
103 err = xt_register_target(&target[i]);
104 if (err)
105 goto err;
106 }
107 return err;
108
109err:
110 if (i > 0)
111 xt_unregister_targets(target, i);
112 return err;
113}
114EXPORT_SYMBOL(xt_register_targets);
115
116void
117xt_unregister_targets(struct xt_target *target, unsigned int n)
118{
119 unsigned int i;
120
121 for (i = 0; i < n; i++)
122 xt_unregister_target(&target[i]);
123}
124EXPORT_SYMBOL(xt_unregister_targets);
125
126int
127xt_register_match(struct xt_match *match)
128{
129 u_int8_t af = match->family;
130 int ret;
131
132 ret = mutex_lock_interruptible(&xt[af].mutex);
133 if (ret != 0)
134 return ret;
135
136 list_add(&match->list, &xt[af].match);
137 mutex_unlock(&xt[af].mutex);
138
139 return ret;
140}
141EXPORT_SYMBOL(xt_register_match);
142
143void
144xt_unregister_match(struct xt_match *match)
145{
146 u_int8_t af = match->family;
147
148 mutex_lock(&xt[af].mutex);
149 list_del(&match->list);
150 mutex_unlock(&xt[af].mutex);
151}
152EXPORT_SYMBOL(xt_unregister_match);
153
154int
155xt_register_matches(struct xt_match *match, unsigned int n)
156{
157 unsigned int i;
158 int err = 0;
159
160 for (i = 0; i < n; i++) {
161 err = xt_register_match(&match[i]);
162 if (err)
163 goto err;
164 }
165 return err;
166
167err:
168 if (i > 0)
169 xt_unregister_matches(match, i);
170 return err;
171}
172EXPORT_SYMBOL(xt_register_matches);
173
174void
175xt_unregister_matches(struct xt_match *match, unsigned int n)
176{
177 unsigned int i;
178
179 for (i = 0; i < n; i++)
180 xt_unregister_match(&match[i]);
181}
182EXPORT_SYMBOL(xt_unregister_matches);
183
184
185
186
187
188
189
190
191
192struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
193{
194 struct xt_match *m;
195 int err = 0;
196
197 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
198 return ERR_PTR(-EINTR);
199
200 list_for_each_entry(m, &xt[af].match, list) {
201 if (strcmp(m->name, name) == 0) {
202 if (m->revision == revision) {
203 if (try_module_get(m->me)) {
204 mutex_unlock(&xt[af].mutex);
205 return m;
206 }
207 } else
208 err = -EPROTOTYPE;
209 }
210 }
211 mutex_unlock(&xt[af].mutex);
212
213 if (af != NFPROTO_UNSPEC)
214
215 return xt_find_match(NFPROTO_UNSPEC, name, revision);
216
217 return ERR_PTR(err);
218}
219EXPORT_SYMBOL(xt_find_match);
220
221
222struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
223{
224 struct xt_target *t;
225 int err = 0;
226
227 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
228 return ERR_PTR(-EINTR);
229
230 list_for_each_entry(t, &xt[af].target, list) {
231 if (strcmp(t->name, name) == 0) {
232 if (t->revision == revision) {
233 if (try_module_get(t->me)) {
234 mutex_unlock(&xt[af].mutex);
235 return t;
236 }
237 } else
238 err = -EPROTOTYPE;
239 }
240 }
241 mutex_unlock(&xt[af].mutex);
242
243 if (af != NFPROTO_UNSPEC)
244
245 return xt_find_target(NFPROTO_UNSPEC, name, revision);
246
247 return ERR_PTR(err);
248}
249EXPORT_SYMBOL(xt_find_target);
250
251struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
252{
253 struct xt_target *target;
254
255 target = try_then_request_module(xt_find_target(af, name, revision),
256 "%st_%s", xt_prefix[af], name);
257 if (IS_ERR(target) || !target)
258 return NULL;
259 return target;
260}
261EXPORT_SYMBOL_GPL(xt_request_find_target);
262
263static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
264{
265 const struct xt_match *m;
266 int have_rev = 0;
267
268 list_for_each_entry(m, &xt[af].match, list) {
269 if (strcmp(m->name, name) == 0) {
270 if (m->revision > *bestp)
271 *bestp = m->revision;
272 if (m->revision == revision)
273 have_rev = 1;
274 }
275 }
276
277 if (af != NFPROTO_UNSPEC && !have_rev)
278 return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
279
280 return have_rev;
281}
282
283static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
284{
285 const struct xt_target *t;
286 int have_rev = 0;
287
288 list_for_each_entry(t, &xt[af].target, list) {
289 if (strcmp(t->name, name) == 0) {
290 if (t->revision > *bestp)
291 *bestp = t->revision;
292 if (t->revision == revision)
293 have_rev = 1;
294 }
295 }
296
297 if (af != NFPROTO_UNSPEC && !have_rev)
298 return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
299
300 return have_rev;
301}
302
303
304int xt_find_revision(u8 af, const char *name, u8 revision, int target,
305 int *err)
306{
307 int have_rev, best = -1;
308
309 if (mutex_lock_interruptible(&xt[af].mutex) != 0) {
310 *err = -EINTR;
311 return 1;
312 }
313 if (target == 1)
314 have_rev = target_revfn(af, name, revision, &best);
315 else
316 have_rev = match_revfn(af, name, revision, &best);
317 mutex_unlock(&xt[af].mutex);
318
319
320 if (best == -1) {
321 *err = -ENOENT;
322 return 0;
323 }
324
325 *err = best;
326 if (!have_rev)
327 *err = -EPROTONOSUPPORT;
328 return 1;
329}
330EXPORT_SYMBOL_GPL(xt_find_revision);
331
332static char *textify_hooks(char *buf, size_t size, unsigned int mask)
333{
334 static const char *const names[] = {
335 "PREROUTING", "INPUT", "FORWARD",
336 "OUTPUT", "POSTROUTING", "BROUTING",
337 };
338 unsigned int i;
339 char *p = buf;
340 bool np = false;
341 int res;
342
343 *p = '\0';
344 for (i = 0; i < ARRAY_SIZE(names); ++i) {
345 if (!(mask & (1 << i)))
346 continue;
347 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);
348 if (res > 0) {
349 size -= res;
350 p += res;
351 }
352 np = true;
353 }
354
355 return buf;
356}
357
358int xt_check_match(struct xt_mtchk_param *par,
359 unsigned int size, u_int8_t proto, bool inv_proto)
360{
361 if (XT_ALIGN(par->match->matchsize) != size &&
362 par->match->matchsize != -1) {
363
364
365
366
367 pr_err("%s_tables: %s match: invalid size %Zu != %u\n",
368 xt_prefix[par->family], par->match->name,
369 XT_ALIGN(par->match->matchsize), size);
370 return -EINVAL;
371 }
372 if (par->match->table != NULL &&
373 strcmp(par->match->table, par->table) != 0) {
374 pr_err("%s_tables: %s match: only valid in %s table, not %s\n",
375 xt_prefix[par->family], par->match->name,
376 par->match->table, par->table);
377 return -EINVAL;
378 }
379 if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
380 char used[64], allow[64];
381
382 pr_err("%s_tables: %s match: used from hooks %s, but only "
383 "valid from %s\n",
384 xt_prefix[par->family], par->match->name,
385 textify_hooks(used, sizeof(used), par->hook_mask),
386 textify_hooks(allow, sizeof(allow), par->match->hooks));
387 return -EINVAL;
388 }
389 if (par->match->proto && (par->match->proto != proto || inv_proto)) {
390 pr_err("%s_tables: %s match: only valid for protocol %u\n",
391 xt_prefix[par->family], par->match->name,
392 par->match->proto);
393 return -EINVAL;
394 }
395 if (par->match->checkentry != NULL && !par->match->checkentry(par))
396 return -EINVAL;
397 return 0;
398}
399EXPORT_SYMBOL_GPL(xt_check_match);
400
401#ifdef CONFIG_COMPAT
402int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta)
403{
404 struct compat_delta *tmp;
405
406 tmp = kmalloc(sizeof(struct compat_delta), GFP_KERNEL);
407 if (!tmp)
408 return -ENOMEM;
409
410 tmp->offset = offset;
411 tmp->delta = delta;
412
413 if (xt[af].compat_offsets) {
414 tmp->next = xt[af].compat_offsets->next;
415 xt[af].compat_offsets->next = tmp;
416 } else {
417 xt[af].compat_offsets = tmp;
418 tmp->next = NULL;
419 }
420 return 0;
421}
422EXPORT_SYMBOL_GPL(xt_compat_add_offset);
423
424void xt_compat_flush_offsets(u_int8_t af)
425{
426 struct compat_delta *tmp, *next;
427
428 if (xt[af].compat_offsets) {
429 for (tmp = xt[af].compat_offsets; tmp; tmp = next) {
430 next = tmp->next;
431 kfree(tmp);
432 }
433 xt[af].compat_offsets = NULL;
434 }
435}
436EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
437
438short xt_compat_calc_jump(u_int8_t af, unsigned int offset)
439{
440 struct compat_delta *tmp;
441 short delta;
442
443 for (tmp = xt[af].compat_offsets, delta = 0; tmp; tmp = tmp->next)
444 if (tmp->offset < offset)
445 delta += tmp->delta;
446 return delta;
447}
448EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
449
450int xt_compat_match_offset(const struct xt_match *match)
451{
452 u_int16_t csize = match->compatsize ? : match->matchsize;
453 return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize);
454}
455EXPORT_SYMBOL_GPL(xt_compat_match_offset);
456
457int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
458 unsigned int *size)
459{
460 const struct xt_match *match = m->u.kernel.match;
461 struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
462 int pad, off = xt_compat_match_offset(match);
463 u_int16_t msize = cm->u.user.match_size;
464
465 m = *dstptr;
466 memcpy(m, cm, sizeof(*cm));
467 if (match->compat_from_user)
468 match->compat_from_user(m->data, cm->data);
469 else
470 memcpy(m->data, cm->data, msize - sizeof(*cm));
471 pad = XT_ALIGN(match->matchsize) - match->matchsize;
472 if (pad > 0)
473 memset(m->data + match->matchsize, 0, pad);
474
475 msize += off;
476 m->u.user.match_size = msize;
477
478 *size += off;
479 *dstptr += msize;
480 return 0;
481}
482EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
483
484int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
485 unsigned int *size)
486{
487 const struct xt_match *match = m->u.kernel.match;
488 struct compat_xt_entry_match __user *cm = *dstptr;
489 int off = xt_compat_match_offset(match);
490 u_int16_t msize = m->u.user.match_size - off;
491
492 if (copy_to_user(cm, m, sizeof(*cm)) ||
493 put_user(msize, &cm->u.user.match_size) ||
494 copy_to_user(cm->u.user.name, m->u.kernel.match->name,
495 strlen(m->u.kernel.match->name) + 1))
496 return -EFAULT;
497
498 if (match->compat_to_user) {
499 if (match->compat_to_user((void __user *)cm->data, m->data))
500 return -EFAULT;
501 } else {
502 if (copy_to_user(cm->data, m->data, msize - sizeof(*cm)))
503 return -EFAULT;
504 }
505
506 *size -= off;
507 *dstptr += msize;
508 return 0;
509}
510EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
511#endif
512
513int xt_check_target(struct xt_tgchk_param *par,
514 unsigned int size, u_int8_t proto, bool inv_proto)
515{
516 if (XT_ALIGN(par->target->targetsize) != size) {
517 pr_err("%s_tables: %s target: invalid size %Zu != %u\n",
518 xt_prefix[par->family], par->target->name,
519 XT_ALIGN(par->target->targetsize), size);
520 return -EINVAL;
521 }
522 if (par->target->table != NULL &&
523 strcmp(par->target->table, par->table) != 0) {
524 pr_err("%s_tables: %s target: only valid in %s table, not %s\n",
525 xt_prefix[par->family], par->target->name,
526 par->target->table, par->table);
527 return -EINVAL;
528 }
529 if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
530 char used[64], allow[64];
531
532 pr_err("%s_tables: %s target: used from hooks %s, but only "
533 "usable from %s\n",
534 xt_prefix[par->family], par->target->name,
535 textify_hooks(used, sizeof(used), par->hook_mask),
536 textify_hooks(allow, sizeof(allow), par->target->hooks));
537 return -EINVAL;
538 }
539 if (par->target->proto && (par->target->proto != proto || inv_proto)) {
540 pr_err("%s_tables: %s target: only valid for protocol %u\n",
541 xt_prefix[par->family], par->target->name,
542 par->target->proto);
543 return -EINVAL;
544 }
545 if (par->target->checkentry != NULL && !par->target->checkentry(par))
546 return -EINVAL;
547 return 0;
548}
549EXPORT_SYMBOL_GPL(xt_check_target);
550
551#ifdef CONFIG_COMPAT
552int xt_compat_target_offset(const struct xt_target *target)
553{
554 u_int16_t csize = target->compatsize ? : target->targetsize;
555 return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize);
556}
557EXPORT_SYMBOL_GPL(xt_compat_target_offset);
558
559void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
560 unsigned int *size)
561{
562 const struct xt_target *target = t->u.kernel.target;
563 struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
564 int pad, off = xt_compat_target_offset(target);
565 u_int16_t tsize = ct->u.user.target_size;
566
567 t = *dstptr;
568 memcpy(t, ct, sizeof(*ct));
569 if (target->compat_from_user)
570 target->compat_from_user(t->data, ct->data);
571 else
572 memcpy(t->data, ct->data, tsize - sizeof(*ct));
573 pad = XT_ALIGN(target->targetsize) - target->targetsize;
574 if (pad > 0)
575 memset(t->data + target->targetsize, 0, pad);
576
577 tsize += off;
578 t->u.user.target_size = tsize;
579
580 *size += off;
581 *dstptr += tsize;
582}
583EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
584
585int xt_compat_target_to_user(struct xt_entry_target *t, void __user **dstptr,
586 unsigned int *size)
587{
588 const struct xt_target *target = t->u.kernel.target;
589 struct compat_xt_entry_target __user *ct = *dstptr;
590 int off = xt_compat_target_offset(target);
591 u_int16_t tsize = t->u.user.target_size - off;
592
593 if (copy_to_user(ct, t, sizeof(*ct)) ||
594 put_user(tsize, &ct->u.user.target_size) ||
595 copy_to_user(ct->u.user.name, t->u.kernel.target->name,
596 strlen(t->u.kernel.target->name) + 1))
597 return -EFAULT;
598
599 if (target->compat_to_user) {
600 if (target->compat_to_user((void __user *)ct->data, t->data))
601 return -EFAULT;
602 } else {
603 if (copy_to_user(ct->data, t->data, tsize - sizeof(*ct)))
604 return -EFAULT;
605 }
606
607 *size -= off;
608 *dstptr += tsize;
609 return 0;
610}
611EXPORT_SYMBOL_GPL(xt_compat_target_to_user);
612#endif
613
614struct xt_table_info *xt_alloc_table_info(unsigned int size)
615{
616 struct xt_table_info *newinfo;
617 int cpu;
618
619
620 if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
621 return NULL;
622
623 newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);
624 if (!newinfo)
625 return NULL;
626
627 newinfo->size = size;
628
629 for_each_possible_cpu(cpu) {
630 if (size <= PAGE_SIZE)
631 newinfo->entries[cpu] = kmalloc_node(size,
632 GFP_KERNEL,
633 cpu_to_node(cpu));
634 else
635 newinfo->entries[cpu] = vmalloc_node(size,
636 cpu_to_node(cpu));
637
638 if (newinfo->entries[cpu] == NULL) {
639 xt_free_table_info(newinfo);
640 return NULL;
641 }
642 }
643
644 return newinfo;
645}
646EXPORT_SYMBOL(xt_alloc_table_info);
647
648void xt_free_table_info(struct xt_table_info *info)
649{
650 int cpu;
651
652 for_each_possible_cpu(cpu) {
653 if (info->size <= PAGE_SIZE)
654 kfree(info->entries[cpu]);
655 else
656 vfree(info->entries[cpu]);
657 }
658 kfree(info);
659}
660EXPORT_SYMBOL(xt_free_table_info);
661
662
663struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
664 const char *name)
665{
666 struct xt_table *t;
667
668 if (mutex_lock_interruptible(&xt[af].mutex) != 0)
669 return ERR_PTR(-EINTR);
670
671 list_for_each_entry(t, &net->xt.tables[af], list)
672 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
673 return t;
674 mutex_unlock(&xt[af].mutex);
675 return NULL;
676}
677EXPORT_SYMBOL_GPL(xt_find_table_lock);
678
679void xt_table_unlock(struct xt_table *table)
680{
681 mutex_unlock(&xt[table->af].mutex);
682}
683EXPORT_SYMBOL_GPL(xt_table_unlock);
684
685#ifdef CONFIG_COMPAT
686void xt_compat_lock(u_int8_t af)
687{
688 mutex_lock(&xt[af].compat_mutex);
689}
690EXPORT_SYMBOL_GPL(xt_compat_lock);
691
692void xt_compat_unlock(u_int8_t af)
693{
694 mutex_unlock(&xt[af].compat_mutex);
695}
696EXPORT_SYMBOL_GPL(xt_compat_unlock);
697#endif
698
699DEFINE_PER_CPU(struct xt_info_lock, xt_info_locks);
700EXPORT_PER_CPU_SYMBOL_GPL(xt_info_locks);
701
702
703struct xt_table_info *
704xt_replace_table(struct xt_table *table,
705 unsigned int num_counters,
706 struct xt_table_info *newinfo,
707 int *error)
708{
709 struct xt_table_info *private;
710
711
712 local_bh_disable();
713 private = table->private;
714
715
716 if (num_counters != private->number) {
717 duprintf("num_counters != table->private->number (%u/%u)\n",
718 num_counters, private->number);
719 local_bh_enable();
720 *error = -EAGAIN;
721 return NULL;
722 }
723
724 table->private = newinfo;
725 newinfo->initial_entries = private->initial_entries;
726
727
728
729
730
731
732
733 local_bh_enable();
734
735 return private;
736}
737EXPORT_SYMBOL_GPL(xt_replace_table);
738
739struct xt_table *xt_register_table(struct net *net,
740 const struct xt_table *input_table,
741 struct xt_table_info *bootstrap,
742 struct xt_table_info *newinfo)
743{
744 int ret;
745 struct xt_table_info *private;
746 struct xt_table *t, *table;
747
748
749 table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);
750 if (!table) {
751 ret = -ENOMEM;
752 goto out;
753 }
754
755 ret = mutex_lock_interruptible(&xt[table->af].mutex);
756 if (ret != 0)
757 goto out_free;
758
759
760 list_for_each_entry(t, &net->xt.tables[table->af], list) {
761 if (strcmp(t->name, table->name) == 0) {
762 ret = -EEXIST;
763 goto unlock;
764 }
765 }
766
767
768 table->private = bootstrap;
769
770 if (!xt_replace_table(table, 0, newinfo, &ret))
771 goto unlock;
772
773 private = table->private;
774 duprintf("table->private->number = %u\n", private->number);
775
776
777 private->initial_entries = private->number;
778
779 list_add(&table->list, &net->xt.tables[table->af]);
780 mutex_unlock(&xt[table->af].mutex);
781 return table;
782
783 unlock:
784 mutex_unlock(&xt[table->af].mutex);
785out_free:
786 kfree(table);
787out:
788 return ERR_PTR(ret);
789}
790EXPORT_SYMBOL_GPL(xt_register_table);
791
792void *xt_unregister_table(struct xt_table *table)
793{
794 struct xt_table_info *private;
795
796 mutex_lock(&xt[table->af].mutex);
797 private = table->private;
798 list_del(&table->list);
799 mutex_unlock(&xt[table->af].mutex);
800 kfree(table);
801
802 return private;
803}
804EXPORT_SYMBOL_GPL(xt_unregister_table);
805
806#ifdef CONFIG_PROC_FS
807struct xt_names_priv {
808 struct seq_net_private p;
809 u_int8_t af;
810};
811static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
812{
813 struct xt_names_priv *priv = seq->private;
814 struct net *net = seq_file_net(seq);
815 u_int8_t af = priv->af;
816
817 mutex_lock(&xt[af].mutex);
818 return seq_list_start(&net->xt.tables[af], *pos);
819}
820
821static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
822{
823 struct xt_names_priv *priv = seq->private;
824 struct net *net = seq_file_net(seq);
825 u_int8_t af = priv->af;
826
827 return seq_list_next(v, &net->xt.tables[af], pos);
828}
829
830static void xt_table_seq_stop(struct seq_file *seq, void *v)
831{
832 struct xt_names_priv *priv = seq->private;
833 u_int8_t af = priv->af;
834
835 mutex_unlock(&xt[af].mutex);
836}
837
838static int xt_table_seq_show(struct seq_file *seq, void *v)
839{
840 struct xt_table *table = list_entry(v, struct xt_table, list);
841
842 if (strlen(table->name))
843 return seq_printf(seq, "%s\n", table->name);
844 else
845 return 0;
846}
847
848static const struct seq_operations xt_table_seq_ops = {
849 .start = xt_table_seq_start,
850 .next = xt_table_seq_next,
851 .stop = xt_table_seq_stop,
852 .show = xt_table_seq_show,
853};
854
855static int xt_table_open(struct inode *inode, struct file *file)
856{
857 int ret;
858 struct xt_names_priv *priv;
859
860 ret = seq_open_net(inode, file, &xt_table_seq_ops,
861 sizeof(struct xt_names_priv));
862 if (!ret) {
863 priv = ((struct seq_file *)file->private_data)->private;
864 priv->af = (unsigned long)PDE(inode)->data;
865 }
866 return ret;
867}
868
869static const struct file_operations xt_table_ops = {
870 .owner = THIS_MODULE,
871 .open = xt_table_open,
872 .read = seq_read,
873 .llseek = seq_lseek,
874 .release = seq_release_net,
875};
876
877
878
879
880
881struct nf_mttg_trav {
882 struct list_head *head, *curr;
883 uint8_t class, nfproto;
884};
885
886enum {
887 MTTG_TRAV_INIT,
888 MTTG_TRAV_NFP_UNSPEC,
889 MTTG_TRAV_NFP_SPEC,
890 MTTG_TRAV_DONE,
891};
892
893static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
894 bool is_target)
895{
896 static const uint8_t next_class[] = {
897 [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
898 [MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE,
899 };
900 struct nf_mttg_trav *trav = seq->private;
901
902 switch (trav->class) {
903 case MTTG_TRAV_INIT:
904 trav->class = MTTG_TRAV_NFP_UNSPEC;
905 mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
906 trav->head = trav->curr = is_target ?
907 &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
908 break;
909 case MTTG_TRAV_NFP_UNSPEC:
910 trav->curr = trav->curr->next;
911 if (trav->curr != trav->head)
912 break;
913 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
914 mutex_lock(&xt[trav->nfproto].mutex);
915 trav->head = trav->curr = is_target ?
916 &xt[trav->nfproto].target : &xt[trav->nfproto].match;
917 trav->class = next_class[trav->class];
918 break;
919 case MTTG_TRAV_NFP_SPEC:
920 trav->curr = trav->curr->next;
921 if (trav->curr != trav->head)
922 break;
923
924 default:
925 return NULL;
926 }
927
928 if (ppos != NULL)
929 ++*ppos;
930 return trav;
931}
932
933static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
934 bool is_target)
935{
936 struct nf_mttg_trav *trav = seq->private;
937 unsigned int j;
938
939 trav->class = MTTG_TRAV_INIT;
940 for (j = 0; j < *pos; ++j)
941 if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
942 return NULL;
943 return trav;
944}
945
946static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
947{
948 struct nf_mttg_trav *trav = seq->private;
949
950 switch (trav->class) {
951 case MTTG_TRAV_NFP_UNSPEC:
952 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
953 break;
954 case MTTG_TRAV_NFP_SPEC:
955 mutex_unlock(&xt[trav->nfproto].mutex);
956 break;
957 }
958}
959
960static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
961{
962 return xt_mttg_seq_start(seq, pos, false);
963}
964
965static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
966{
967 return xt_mttg_seq_next(seq, v, ppos, false);
968}
969
970static int xt_match_seq_show(struct seq_file *seq, void *v)
971{
972 const struct nf_mttg_trav *trav = seq->private;
973 const struct xt_match *match;
974
975 switch (trav->class) {
976 case MTTG_TRAV_NFP_UNSPEC:
977 case MTTG_TRAV_NFP_SPEC:
978 if (trav->curr == trav->head)
979 return 0;
980 match = list_entry(trav->curr, struct xt_match, list);
981 return (*match->name == '\0') ? 0 :
982 seq_printf(seq, "%s\n", match->name);
983 }
984 return 0;
985}
986
987static const struct seq_operations xt_match_seq_ops = {
988 .start = xt_match_seq_start,
989 .next = xt_match_seq_next,
990 .stop = xt_mttg_seq_stop,
991 .show = xt_match_seq_show,
992};
993
994static int xt_match_open(struct inode *inode, struct file *file)
995{
996 struct seq_file *seq;
997 struct nf_mttg_trav *trav;
998 int ret;
999
1000 trav = kmalloc(sizeof(*trav), GFP_KERNEL);
1001 if (trav == NULL)
1002 return -ENOMEM;
1003
1004 ret = seq_open(file, &xt_match_seq_ops);
1005 if (ret < 0) {
1006 kfree(trav);
1007 return ret;
1008 }
1009
1010 seq = file->private_data;
1011 seq->private = trav;
1012 trav->nfproto = (unsigned long)PDE(inode)->data;
1013 return 0;
1014}
1015
1016static const struct file_operations xt_match_ops = {
1017 .owner = THIS_MODULE,
1018 .open = xt_match_open,
1019 .read = seq_read,
1020 .llseek = seq_lseek,
1021 .release = seq_release_private,
1022};
1023
1024static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
1025{
1026 return xt_mttg_seq_start(seq, pos, true);
1027}
1028
1029static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
1030{
1031 return xt_mttg_seq_next(seq, v, ppos, true);
1032}
1033
1034static int xt_target_seq_show(struct seq_file *seq, void *v)
1035{
1036 const struct nf_mttg_trav *trav = seq->private;
1037 const struct xt_target *target;
1038
1039 switch (trav->class) {
1040 case MTTG_TRAV_NFP_UNSPEC:
1041 case MTTG_TRAV_NFP_SPEC:
1042 if (trav->curr == trav->head)
1043 return 0;
1044 target = list_entry(trav->curr, struct xt_target, list);
1045 return (*target->name == '\0') ? 0 :
1046 seq_printf(seq, "%s\n", target->name);
1047 }
1048 return 0;
1049}
1050
1051static const struct seq_operations xt_target_seq_ops = {
1052 .start = xt_target_seq_start,
1053 .next = xt_target_seq_next,
1054 .stop = xt_mttg_seq_stop,
1055 .show = xt_target_seq_show,
1056};
1057
1058static int xt_target_open(struct inode *inode, struct file *file)
1059{
1060 struct seq_file *seq;
1061 struct nf_mttg_trav *trav;
1062 int ret;
1063
1064 trav = kmalloc(sizeof(*trav), GFP_KERNEL);
1065 if (trav == NULL)
1066 return -ENOMEM;
1067
1068 ret = seq_open(file, &xt_target_seq_ops);
1069 if (ret < 0) {
1070 kfree(trav);
1071 return ret;
1072 }
1073
1074 seq = file->private_data;
1075 seq->private = trav;
1076 trav->nfproto = (unsigned long)PDE(inode)->data;
1077 return 0;
1078}
1079
1080static const struct file_operations xt_target_ops = {
1081 .owner = THIS_MODULE,
1082 .open = xt_target_open,
1083 .read = seq_read,
1084 .llseek = seq_lseek,
1085 .release = seq_release_private,
1086};
1087
1088#define FORMAT_TABLES "_tables_names"
1089#define FORMAT_MATCHES "_tables_matches"
1090#define FORMAT_TARGETS "_tables_targets"
1091
1092#endif
1093
1094int xt_proto_init(struct net *net, u_int8_t af)
1095{
1096#ifdef CONFIG_PROC_FS
1097 char buf[XT_FUNCTION_MAXNAMELEN];
1098 struct proc_dir_entry *proc;
1099#endif
1100
1101 if (af >= ARRAY_SIZE(xt_prefix))
1102 return -EINVAL;
1103
1104
1105#ifdef CONFIG_PROC_FS
1106 strlcpy(buf, xt_prefix[af], sizeof(buf));
1107 strlcat(buf, FORMAT_TABLES, sizeof(buf));
1108 proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops,
1109 (void *)(unsigned long)af);
1110 if (!proc)
1111 goto out;
1112
1113 strlcpy(buf, xt_prefix[af], sizeof(buf));
1114 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1115 proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops,
1116 (void *)(unsigned long)af);
1117 if (!proc)
1118 goto out_remove_tables;
1119
1120 strlcpy(buf, xt_prefix[af], sizeof(buf));
1121 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
1122 proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops,
1123 (void *)(unsigned long)af);
1124 if (!proc)
1125 goto out_remove_matches;
1126#endif
1127
1128 return 0;
1129
1130#ifdef CONFIG_PROC_FS
1131out_remove_matches:
1132 strlcpy(buf, xt_prefix[af], sizeof(buf));
1133 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1134 proc_net_remove(net, buf);
1135
1136out_remove_tables:
1137 strlcpy(buf, xt_prefix[af], sizeof(buf));
1138 strlcat(buf, FORMAT_TABLES, sizeof(buf));
1139 proc_net_remove(net, buf);
1140out:
1141 return -1;
1142#endif
1143}
1144EXPORT_SYMBOL_GPL(xt_proto_init);
1145
1146void xt_proto_fini(struct net *net, u_int8_t af)
1147{
1148#ifdef CONFIG_PROC_FS
1149 char buf[XT_FUNCTION_MAXNAMELEN];
1150
1151 strlcpy(buf, xt_prefix[af], sizeof(buf));
1152 strlcat(buf, FORMAT_TABLES, sizeof(buf));
1153 proc_net_remove(net, buf);
1154
1155 strlcpy(buf, xt_prefix[af], sizeof(buf));
1156 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
1157 proc_net_remove(net, buf);
1158
1159 strlcpy(buf, xt_prefix[af], sizeof(buf));
1160 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1161 proc_net_remove(net, buf);
1162#endif
1163}
1164EXPORT_SYMBOL_GPL(xt_proto_fini);
1165
1166static int __net_init xt_net_init(struct net *net)
1167{
1168 int i;
1169
1170 for (i = 0; i < NFPROTO_NUMPROTO; i++)
1171 INIT_LIST_HEAD(&net->xt.tables[i]);
1172 return 0;
1173}
1174
1175static struct pernet_operations xt_net_ops = {
1176 .init = xt_net_init,
1177};
1178
1179static int __init xt_init(void)
1180{
1181 unsigned int i;
1182 int rv;
1183
1184 for_each_possible_cpu(i) {
1185 struct xt_info_lock *lock = &per_cpu(xt_info_locks, i);
1186 spin_lock_init(&lock->lock);
1187 lock->readers = 0;
1188 }
1189
1190 xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
1191 if (!xt)
1192 return -ENOMEM;
1193
1194 for (i = 0; i < NFPROTO_NUMPROTO; i++) {
1195 mutex_init(&xt[i].mutex);
1196#ifdef CONFIG_COMPAT
1197 mutex_init(&xt[i].compat_mutex);
1198 xt[i].compat_offsets = NULL;
1199#endif
1200 INIT_LIST_HEAD(&xt[i].target);
1201 INIT_LIST_HEAD(&xt[i].match);
1202 }
1203 rv = register_pernet_subsys(&xt_net_ops);
1204 if (rv < 0)
1205 kfree(xt);
1206 return rv;
1207}
1208
1209static void __exit xt_fini(void)
1210{
1211 unregister_pernet_subsys(&xt_net_ops);
1212 kfree(xt);
1213}
1214
1215module_init(xt_init);
1216module_exit(xt_fini);
1217
1218