projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
[NETFILTER]: x_tables: remove obsolete overflow check
[deliverable/linux.git] / net / ipv4 / netfilter / ip_tables.c
1 /*
2 * Packet matching code.
3 *
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11 #include <linux/cache.h>
12 #include <linux/capability.h>
13 #include <linux/skbuff.h>
14 #include <linux/kmod.h>
15 #include <linux/vmalloc.h>
16 #include <linux/netdevice.h>
17 #include <linux/module.h>
18 #include <linux/icmp.h>
19 #include <net/ip.h>
20 #include <net/compat.h>
21 #include <asm/uaccess.h>
22 #include <linux/mutex.h>
23 #include <linux/proc_fs.h>
24 #include <linux/err.h>
25 #include <linux/cpumask.h>
26
27 #include <linux/netfilter/x_tables.h>
28 #include <linux/netfilter_ipv4/ip_tables.h>
29
30 MODULE_LICENSE("GPL");
31 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
32 MODULE_DESCRIPTION("IPv4 packet filter");
33
34 /*#define DEBUG_IP_FIREWALL*/
35 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
36 /*#define DEBUG_IP_FIREWALL_USER*/
37
38 #ifdef DEBUG_IP_FIREWALL
39 #define dprintf(format, args...) printk(format , ## args)
40 #else
41 #define dprintf(format, args...)
42 #endif
43
44 #ifdef DEBUG_IP_FIREWALL_USER
45 #define duprintf(format, args...) printk(format , ## args)
46 #else
47 #define duprintf(format, args...)
48 #endif
49
50 #ifdef CONFIG_NETFILTER_DEBUG
51 #define IP_NF_ASSERT(x) \
52 do { \
53 if (!(x)) \
54 printk("IP_NF_ASSERT: %s:%s:%u\n", \
55 __FUNCTION__, __FILE__, __LINE__); \
56 } while(0)
57 #else
58 #define IP_NF_ASSERT(x)
59 #endif
60
61 #if 0
62 /* All the better to debug you with... */
63 #define static
64 #define inline
65 #endif
66
67 /*
68 We keep a set of rules for each CPU, so we can avoid write-locking
69 them in the softirq when updating the counters and therefore
70 only need to read-lock in the softirq; doing a write_lock_bh() in user
71 context stops packets coming through and allows user context to read
72 the counters or update the rules.
73
74 Hence the start of any table is given by get_table() below. */
75
76 /* Returns whether matches rule or not. */
77 static inline int
78 ip_packet_match(const struct iphdr *ip,
79 const char *indev,
80 const char *outdev,
81 const struct ipt_ip *ipinfo,
82 int isfrag)
83 {
84 size_t i;
85 unsigned long ret;
86
87 #define FWINV(bool,invflg) ((bool) ^ !!(ipinfo->invflags & invflg))
88
89 if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
90 IPT_INV_SRCIP)
91 || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
92 IPT_INV_DSTIP)) {
93 dprintf("Source or dest mismatch.\n");
94
95 dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
96 NIPQUAD(ip->saddr),
97 NIPQUAD(ipinfo->smsk.s_addr),
98 NIPQUAD(ipinfo->src.s_addr),
99 ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
100 dprintf("DST: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
101 NIPQUAD(ip->daddr),
102 NIPQUAD(ipinfo->dmsk.s_addr),
103 NIPQUAD(ipinfo->dst.s_addr),
104 ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
105 return 0;
106 }
107
108 /* Look for ifname matches; this should unroll nicely. */
109 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
110 ret |= (((const unsigned long *)indev)[i]
111 ^ ((const unsigned long *)ipinfo->iniface)[i])
112 & ((const unsigned long *)ipinfo->iniface_mask)[i];
113 }
114
115 if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
116 dprintf("VIA in mismatch (%s vs %s).%s\n",
117 indev, ipinfo->iniface,
118 ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
119 return 0;
120 }
121
122 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
123 ret |= (((const unsigned long *)outdev)[i]
124 ^ ((const unsigned long *)ipinfo->outiface)[i])
125 & ((const unsigned long *)ipinfo->outiface_mask)[i];
126 }
127
128 if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
129 dprintf("VIA out mismatch (%s vs %s).%s\n",
130 outdev, ipinfo->outiface,
131 ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
132 return 0;
133 }
134
135 /* Check specific protocol */
136 if (ipinfo->proto
137 && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
138 dprintf("Packet protocol %hi does not match %hi.%s\n",
139 ip->protocol, ipinfo->proto,
140 ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
141 return 0;
142 }
143
144 /* If we have a fragment rule but the packet is not a fragment
145 * then we return zero */
146 if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
147 dprintf("Fragment rule but not fragment.%s\n",
148 ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
149 return 0;
150 }
151
152 return 1;
153 }
154
155 static inline bool
156 ip_checkentry(const struct ipt_ip *ip)
157 {
158 if (ip->flags & ~IPT_F_MASK) {
159 duprintf("Unknown flag bits set: %08X\n",
160 ip->flags & ~IPT_F_MASK);
161 return false;
162 }
163 if (ip->invflags & ~IPT_INV_MASK) {
164 duprintf("Unknown invflag bits set: %08X\n",
165 ip->invflags & ~IPT_INV_MASK);
166 return false;
167 }
168 return true;
169 }
170
171 static unsigned int
172 ipt_error(struct sk_buff *skb,
173 const struct net_device *in,
174 const struct net_device *out,
175 unsigned int hooknum,
176 const struct xt_target *target,
177 const void *targinfo)
178 {
179 if (net_ratelimit())
180 printk("ip_tables: error: `%s'\n", (char *)targinfo);
181
182 return NF_DROP;
183 }
184
185 static inline
186 bool do_match(struct ipt_entry_match *m,
187 const struct sk_buff *skb,
188 const struct net_device *in,
189 const struct net_device *out,
190 int offset,
191 bool *hotdrop)
192 {
193 /* Stop iteration if it doesn't match */
194 if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
195 offset, ip_hdrlen(skb), hotdrop))
196 return true;
197 else
198 return false;
199 }
200
201 static inline struct ipt_entry *
202 get_entry(void *base, unsigned int offset)
203 {
204 return (struct ipt_entry *)(base + offset);
205 }
206
207 /* All zeroes == unconditional rule. */
208 static inline int
209 unconditional(const struct ipt_ip *ip)
210 {
211 unsigned int i;
212
213 for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++)
214 if (((__u32 *)ip)[i])
215 return 0;
216
217 return 1;
218 }
219
220 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
221 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
222 static const char *hooknames[] = {
223 [NF_INET_PRE_ROUTING] = "PREROUTING",
224 [NF_INET_LOCAL_IN] = "INPUT",
225 [NF_INET_FORWARD] = "FORWARD",
226 [NF_INET_LOCAL_OUT] = "OUTPUT",
227 [NF_INET_POST_ROUTING] = "POSTROUTING",
228 };
229
230 enum nf_ip_trace_comments {
231 NF_IP_TRACE_COMMENT_RULE,
232 NF_IP_TRACE_COMMENT_RETURN,
233 NF_IP_TRACE_COMMENT_POLICY,
234 };
235
236 static const char *comments[] = {
237 [NF_IP_TRACE_COMMENT_RULE] = "rule",
238 [NF_IP_TRACE_COMMENT_RETURN] = "return",
239 [NF_IP_TRACE_COMMENT_POLICY] = "policy",
240 };
241
242 static struct nf_loginfo trace_loginfo = {
243 .type = NF_LOG_TYPE_LOG,
244 .u = {
245 .log = {
246 .level = 4,
247 .logflags = NF_LOG_MASK,
248 },
249 },
250 };
251
252 static inline int
253 get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
254 char *hookname, char **chainname,
255 char **comment, unsigned int *rulenum)
256 {
257 struct ipt_standard_target *t = (void *)ipt_get_target(s);
258
259 if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
260 /* Head of user chain: ERROR target with chainname */
261 *chainname = t->target.data;
262 (*rulenum) = 0;
263 } else if (s == e) {
264 (*rulenum)++;
265
266 if (s->target_offset == sizeof(struct ipt_entry)
267 && strcmp(t->target.u.kernel.target->name,
268 IPT_STANDARD_TARGET) == 0
269 && t->verdict < 0
270 && unconditional(&s->ip)) {
271 /* Tail of chains: STANDARD target (return/policy) */
272 *comment = *chainname == hookname
273 ? (char *)comments[NF_IP_TRACE_COMMENT_POLICY]
274 : (char *)comments[NF_IP_TRACE_COMMENT_RETURN];
275 }
276 return 1;
277 } else
278 (*rulenum)++;
279
280 return 0;
281 }
282
283 static void trace_packet(struct sk_buff *skb,
284 unsigned int hook,
285 const struct net_device *in,
286 const struct net_device *out,
287 char *tablename,
288 struct xt_table_info *private,
289 struct ipt_entry *e)
290 {
291 void *table_base;
292 struct ipt_entry *root;
293 char *hookname, *chainname, *comment;
294 unsigned int rulenum = 0;
295
296 table_base = (void *)private->entries[smp_processor_id()];
297 root = get_entry(table_base, private->hook_entry[hook]);
298
299 hookname = chainname = (char *)hooknames[hook];
300 comment = (char *)comments[NF_IP_TRACE_COMMENT_RULE];
301
302 IPT_ENTRY_ITERATE(root,
303 private->size - private->hook_entry[hook],
304 get_chainname_rulenum,
305 e, hookname, &chainname, &comment, &rulenum);
306
307 nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
308 "TRACE: %s:%s:%s:%u ",
309 tablename, chainname, comment, rulenum);
310 }
311 #endif
312
313 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
314 unsigned int
315 ipt_do_table(struct sk_buff *skb,
316 unsigned int hook,
317 const struct net_device *in,
318 const struct net_device *out,
319 struct xt_table *table)
320 {
321 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
322 u_int16_t offset;
323 struct iphdr *ip;
324 u_int16_t datalen;
325 bool hotdrop = false;
326 /* Initializing verdict to NF_DROP keeps gcc happy. */
327 unsigned int verdict = NF_DROP;
328 const char *indev, *outdev;
329 void *table_base;
330 struct ipt_entry *e, *back;
331 struct xt_table_info *private;
332
333 /* Initialization */
334 ip = ip_hdr(skb);
335 datalen = skb->len - ip->ihl * 4;
336 indev = in ? in->name : nulldevname;
337 outdev = out ? out->name : nulldevname;
338 /* We handle fragments by dealing with the first fragment as
339 * if it was a normal packet. All other fragments are treated
340 * normally, except that they will NEVER match rules that ask
341 * things we don't know, ie. tcp syn flag or ports). If the
342 * rule is also a fragment-specific rule, non-fragments won't
343 * match it. */
344 offset = ntohs(ip->frag_off) & IP_OFFSET;
345
346 read_lock_bh(&table->lock);
347 IP_NF_ASSERT(table->valid_hooks & (1 << hook));
348 private = table->private;
349 table_base = (void *)private->entries[smp_processor_id()];
350 e = get_entry(table_base, private->hook_entry[hook]);
351
352 /* For return from builtin chain */
353 back = get_entry(table_base, private->underflow[hook]);
354
355 do {
356 IP_NF_ASSERT(e);
357 IP_NF_ASSERT(back);
358 if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
359 struct ipt_entry_target *t;
360
361 if (IPT_MATCH_ITERATE(e, do_match,
362 skb, in, out,
363 offset, &hotdrop) != 0)
364 goto no_match;
365
366 ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
367
368 t = ipt_get_target(e);
369 IP_NF_ASSERT(t->u.kernel.target);
370
371 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
372 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
373 /* The packet is traced: log it */
374 if (unlikely(skb->nf_trace))
375 trace_packet(skb, hook, in, out,
376 table->name, private, e);
377 #endif
378 /* Standard target? */
379 if (!t->u.kernel.target->target) {
380 int v;
381
382 v = ((struct ipt_standard_target *)t)->verdict;
383 if (v < 0) {
384 /* Pop from stack? */
385 if (v != IPT_RETURN) {
386 verdict = (unsigned)(-v) - 1;
387 break;
388 }
389 e = back;
390 back = get_entry(table_base,
391 back->comefrom);
392 continue;
393 }
394 if (table_base + v != (void *)e + e->next_offset
395 && !(e->ip.flags & IPT_F_GOTO)) {
396 /* Save old back ptr in next entry */
397 struct ipt_entry *next
398 = (void *)e + e->next_offset;
399 next->comefrom
400 = (void *)back - table_base;
401 /* set back pointer to next entry */
402 back = next;
403 }
404
405 e = get_entry(table_base, v);
406 } else {
407 /* Targets which reenter must return
408 abs. verdicts */
409 #ifdef CONFIG_NETFILTER_DEBUG
410 ((struct ipt_entry *)table_base)->comefrom
411 = 0xeeeeeeec;
412 #endif
413 verdict = t->u.kernel.target->target(skb,
414 in, out,
415 hook,
416 t->u.kernel.target,
417 t->data);
418
419 #ifdef CONFIG_NETFILTER_DEBUG
420 if (((struct ipt_entry *)table_base)->comefrom
421 != 0xeeeeeeec
422 && verdict == IPT_CONTINUE) {
423 printk("Target %s reentered!\n",
424 t->u.kernel.target->name);
425 verdict = NF_DROP;
426 }
427 ((struct ipt_entry *)table_base)->comefrom
428 = 0x57acc001;
429 #endif
430 /* Target might have changed stuff. */
431 ip = ip_hdr(skb);
432 datalen = skb->len - ip->ihl * 4;
433
434 if (verdict == IPT_CONTINUE)
435 e = (void *)e + e->next_offset;
436 else
437 /* Verdict */
438 break;
439 }
440 } else {
441
442 no_match:
443 e = (void *)e + e->next_offset;
444 }
445 } while (!hotdrop);
446
447 read_unlock_bh(&table->lock);
448
449 #ifdef DEBUG_ALLOW_ALL
450 return NF_ACCEPT;
451 #else
452 if (hotdrop)
453 return NF_DROP;
454 else return verdict;
455 #endif
456 }
457
458 /* Figures out from what hook each rule can be called: returns 0 if
459 there are loops. Puts hook bitmask in comefrom. */
460 static int
461 mark_source_chains(struct xt_table_info *newinfo,
462 unsigned int valid_hooks, void *entry0)
463 {
464 unsigned int hook;
465
466 /* No recursion; use packet counter to save back ptrs (reset
467 to 0 as we leave), and comefrom to save source hook bitmask */
468 for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
469 unsigned int pos = newinfo->hook_entry[hook];
470 struct ipt_entry *e
471 = (struct ipt_entry *)(entry0 + pos);
472
473 if (!(valid_hooks & (1 << hook)))
474 continue;
475
476 /* Set initial back pointer. */
477 e->counters.pcnt = pos;
478
479 for (;;) {
480 struct ipt_standard_target *t
481 = (void *)ipt_get_target(e);
482 int visited = e->comefrom & (1 << hook);
483
484 if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
485 printk("iptables: loop hook %u pos %u %08X.\n",
486 hook, pos, e->comefrom);
487 return 0;
488 }
489 e->comefrom
490 |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
491
492 /* Unconditional return/END. */
493 if ((e->target_offset == sizeof(struct ipt_entry)
494 && (strcmp(t->target.u.user.name,
495 IPT_STANDARD_TARGET) == 0)
496 && t->verdict < 0
497 && unconditional(&e->ip)) || visited) {
498 unsigned int oldpos, size;
499
500 if (t->verdict < -NF_MAX_VERDICT - 1) {
501 duprintf("mark_source_chains: bad "
502 "negative verdict (%i)\n",
503 t->verdict);
504 return 0;
505 }
506
507 /* Return: backtrack through the last
508 big jump. */
509 do {
510 e->comefrom ^= (1<<NF_INET_NUMHOOKS);
511 #ifdef DEBUG_IP_FIREWALL_USER
512 if (e->comefrom
513 & (1 << NF_INET_NUMHOOKS)) {
514 duprintf("Back unset "
515 "on hook %u "
516 "rule %u\n",
517 hook, pos);
518 }
519 #endif
520 oldpos = pos;
521 pos = e->counters.pcnt;
522 e->counters.pcnt = 0;
523
524 /* We're at the start. */
525 if (pos == oldpos)
526 goto next;
527
528 e = (struct ipt_entry *)
529 (entry0 + pos);
530 } while (oldpos == pos + e->next_offset);
531
532 /* Move along one */
533 size = e->next_offset;
534 e = (struct ipt_entry *)
535 (entry0 + pos + size);
536 e->counters.pcnt = pos;
537 pos += size;
538 } else {
539 int newpos = t->verdict;
540
541 if (strcmp(t->target.u.user.name,
542 IPT_STANDARD_TARGET) == 0
543 && newpos >= 0) {
544 if (newpos > newinfo->size -
545 sizeof(struct ipt_entry)) {
546 duprintf("mark_source_chains: "
547 "bad verdict (%i)\n",
548 newpos);
549 return 0;
550 }
551 /* This a jump; chase it. */
552 duprintf("Jump rule %u -> %u\n",
553 pos, newpos);
554 } else {
555 /* ... this is a fallthru */
556 newpos = pos + e->next_offset;
557 }
558 e = (struct ipt_entry *)
559 (entry0 + newpos);
560 e->counters.pcnt = pos;
561 pos = newpos;
562 }
563 }
564 next:
565 duprintf("Finished chain %u\n", hook);
566 }
567 return 1;
568 }
569
570 static inline int
571 cleanup_match(struct ipt_entry_match *m, unsigned int *i)
572 {
573 if (i && (*i)-- == 0)
574 return 1;
575
576 if (m->u.kernel.match->destroy)
577 m->u.kernel.match->destroy(m->u.kernel.match, m->data);
578 module_put(m->u.kernel.match->me);
579 return 0;
580 }
581
582 static inline int
583 check_entry(struct ipt_entry *e, const char *name)
584 {
585 struct ipt_entry_target *t;
586
587 if (!ip_checkentry(&e->ip)) {
588 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
589 return -EINVAL;
590 }
591
592 if (e->target_offset + sizeof(struct ipt_entry_target) > e->next_offset)
593 return -EINVAL;
594
595 t = ipt_get_target(e);
596 if (e->target_offset + t->u.target_size > e->next_offset)
597 return -EINVAL;
598
599 return 0;
600 }
601
602 static inline int check_match(struct ipt_entry_match *m, const char *name,
603 const struct ipt_ip *ip, unsigned int hookmask,
604 unsigned int *i)
605 {
606 struct xt_match *match;
607 int ret;
608
609 match = m->u.kernel.match;
610 ret = xt_check_match(match, AF_INET, m->u.match_size - sizeof(*m),
611 name, hookmask, ip->proto,
612 ip->invflags & IPT_INV_PROTO);
613 if (!ret && m->u.kernel.match->checkentry
614 && !m->u.kernel.match->checkentry(name, ip, match, m->data,
615 hookmask)) {
616 duprintf("ip_tables: check failed for `%s'.\n",
617 m->u.kernel.match->name);
618 ret = -EINVAL;
619 }
620 if (!ret)
621 (*i)++;
622 return ret;
623 }
624
625 static inline int
626 find_check_match(struct ipt_entry_match *m,
627 const char *name,
628 const struct ipt_ip *ip,
629 unsigned int hookmask,
630 unsigned int *i)
631 {
632 struct xt_match *match;
633 int ret;
634
635 match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
636 m->u.user.revision),
637 "ipt_%s", m->u.user.name);
638 if (IS_ERR(match) || !match) {
639 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
640 return match ? PTR_ERR(match) : -ENOENT;
641 }
642 m->u.kernel.match = match;
643
644 ret = check_match(m, name, ip, hookmask, i);
645 if (ret)
646 goto err;
647
648 return 0;
649 err:
650 module_put(m->u.kernel.match->me);
651 return ret;
652 }
653
654 static inline int check_target(struct ipt_entry *e, const char *name)
655 {
656 struct ipt_entry_target *t;
657 struct xt_target *target;
658 int ret;
659
660 t = ipt_get_target(e);
661 target = t->u.kernel.target;
662 ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
663 name, e->comefrom, e->ip.proto,
664 e->ip.invflags & IPT_INV_PROTO);
665 if (!ret && t->u.kernel.target->checkentry
666 && !t->u.kernel.target->checkentry(name, e, target,
667 t->data, e->comefrom)) {
668 duprintf("ip_tables: check failed for `%s'.\n",
669 t->u.kernel.target->name);
670 ret = -EINVAL;
671 }
672 return ret;
673 }
674
675 static inline int
676 find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
677 unsigned int *i)
678 {
679 struct ipt_entry_target *t;
680 struct xt_target *target;
681 int ret;
682 unsigned int j;
683
684 ret = check_entry(e, name);
685 if (ret)
686 return ret;
687
688 j = 0;
689 ret = IPT_MATCH_ITERATE(e, find_check_match, name, &e->ip,
690 e->comefrom, &j);
691 if (ret != 0)
692 goto cleanup_matches;
693
694 t = ipt_get_target(e);
695 target = try_then_request_module(xt_find_target(AF_INET,
696 t->u.user.name,
697 t->u.user.revision),
698 "ipt_%s", t->u.user.name);
699 if (IS_ERR(target) || !target) {
700 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
701 ret = target ? PTR_ERR(target) : -ENOENT;
702 goto cleanup_matches;
703 }
704 t->u.kernel.target = target;
705
706 ret = check_target(e, name);
707 if (ret)
708 goto err;
709
710 (*i)++;
711 return 0;
712 err:
713 module_put(t->u.kernel.target->me);
714 cleanup_matches:
715 IPT_MATCH_ITERATE(e, cleanup_match, &j);
716 return ret;
717 }
718
719 static inline int
720 check_entry_size_and_hooks(struct ipt_entry *e,
721 struct xt_table_info *newinfo,
722 unsigned char *base,
723 unsigned char *limit,
724 const unsigned int *hook_entries,
725 const unsigned int *underflows,
726 unsigned int *i)
727 {
728 unsigned int h;
729
730 if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
731 || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
732 duprintf("Bad offset %p\n", e);
733 return -EINVAL;
734 }
735
736 if (e->next_offset
737 < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
738 duprintf("checking: element %p size %u\n",
739 e, e->next_offset);
740 return -EINVAL;
741 }
742
743 /* Check hooks & underflows */
744 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
745 if ((unsigned char *)e - base == hook_entries[h])
746 newinfo->hook_entry[h] = hook_entries[h];
747 if ((unsigned char *)e - base == underflows[h])
748 newinfo->underflow[h] = underflows[h];
749 }
750
751 /* FIXME: underflows must be unconditional, standard verdicts
752 < 0 (not IPT_RETURN). --RR */
753
754 /* Clear counters and comefrom */
755 e->counters = ((struct xt_counters) { 0, 0 });
756 e->comefrom = 0;
757
758 (*i)++;
759 return 0;
760 }
761
762 static inline int
763 cleanup_entry(struct ipt_entry *e, unsigned int *i)
764 {
765 struct ipt_entry_target *t;
766
767 if (i && (*i)-- == 0)
768 return 1;
769
770 /* Cleanup all matches */
771 IPT_MATCH_ITERATE(e, cleanup_match, NULL);
772 t = ipt_get_target(e);
773 if (t->u.kernel.target->destroy)
774 t->u.kernel.target->destroy(t->u.kernel.target, t->data);
775 module_put(t->u.kernel.target->me);
776 return 0;
777 }
778
779 /* Checks and translates the user-supplied table segment (held in
780 newinfo) */
781 static int
782 translate_table(const char *name,
783 unsigned int valid_hooks,
784 struct xt_table_info *newinfo,
785 void *entry0,
786 unsigned int size,
787 unsigned int number,
788 const unsigned int *hook_entries,
789 const unsigned int *underflows)
790 {
791 unsigned int i;
792 int ret;
793
794 newinfo->size = size;
795 newinfo->number = number;
796
797 /* Init all hooks to impossible value. */
798 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
799 newinfo->hook_entry[i] = 0xFFFFFFFF;
800 newinfo->underflow[i] = 0xFFFFFFFF;
801 }
802
803 duprintf("translate_table: size %u\n", newinfo->size);
804 i = 0;
805 /* Walk through entries, checking offsets. */
806 ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
807 check_entry_size_and_hooks,
808 newinfo,
809 entry0,
810 entry0 + size,
811 hook_entries, underflows, &i);
812 if (ret != 0)
813 return ret;
814
815 if (i != number) {
816 duprintf("translate_table: %u not %u entries\n",
817 i, number);
818 return -EINVAL;
819 }
820
821 /* Check hooks all assigned */
822 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
823 /* Only hooks which are valid */
824 if (!(valid_hooks & (1 << i)))
825 continue;
826 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
827 duprintf("Invalid hook entry %u %u\n",
828 i, hook_entries[i]);
829 return -EINVAL;
830 }
831 if (newinfo->underflow[i] == 0xFFFFFFFF) {
832 duprintf("Invalid underflow %u %u\n",
833 i, underflows[i]);
834 return -EINVAL;
835 }
836 }
837
838 if (!mark_source_chains(newinfo, valid_hooks, entry0))
839 return -ELOOP;
840
841 /* Finally, each sanity check must pass */
842 i = 0;
843 ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
844 find_check_entry, name, size, &i);
845
846 if (ret != 0) {
847 IPT_ENTRY_ITERATE(entry0, newinfo->size,
848 cleanup_entry, &i);
849 return ret;
850 }
851
852 /* And one copy for every other CPU */
853 for_each_possible_cpu(i) {
854 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
855 memcpy(newinfo->entries[i], entry0, newinfo->size);
856 }
857
858 return ret;
859 }
860
861 /* Gets counters. */
862 static inline int
863 add_entry_to_counter(const struct ipt_entry *e,
864 struct xt_counters total[],
865 unsigned int *i)
866 {
867 ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
868
869 (*i)++;
870 return 0;
871 }
872
873 static inline int
874 set_entry_to_counter(const struct ipt_entry *e,
875 struct ipt_counters total[],
876 unsigned int *i)
877 {
878 SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
879
880 (*i)++;
881 return 0;
882 }
883
884 static void
885 get_counters(const struct xt_table_info *t,
886 struct xt_counters counters[])
887 {
888 unsigned int cpu;
889 unsigned int i;
890 unsigned int curcpu;
891
892 /* Instead of clearing (by a previous call to memset())
893 * the counters and using adds, we set the counters
894 * with data used by 'current' CPU
895 * We dont care about preemption here.
896 */
897 curcpu = raw_smp_processor_id();
898
899 i = 0;
900 IPT_ENTRY_ITERATE(t->entries[curcpu],
901 t->size,
902 set_entry_to_counter,
903 counters,
904 &i);
905
906 for_each_possible_cpu(cpu) {
907 if (cpu == curcpu)
908 continue;
909 i = 0;
910 IPT_ENTRY_ITERATE(t->entries[cpu],
911 t->size,
912 add_entry_to_counter,
913 counters,
914 &i);
915 }
916 }
917
918 static inline struct xt_counters * alloc_counters(struct xt_table *table)
919 {
920 unsigned int countersize;
921 struct xt_counters *counters;
922 struct xt_table_info *private = table->private;
923
924 /* We need atomic snapshot of counters: rest doesn't change
925 (other than comefrom, which userspace doesn't care
926 about). */
927 countersize = sizeof(struct xt_counters) * private->number;
928 counters = vmalloc_node(countersize, numa_node_id());
929
930 if (counters == NULL)
931 return ERR_PTR(-ENOMEM);
932
933 /* First, sum counters... */
934 write_lock_bh(&table->lock);
935 get_counters(private, counters);
936 write_unlock_bh(&table->lock);
937
938 return counters;
939 }
940
941 static int
942 copy_entries_to_user(unsigned int total_size,
943 struct xt_table *table,
944 void __user *userptr)
945 {
946 unsigned int off, num;
947 struct ipt_entry *e;
948 struct xt_counters *counters;
949 struct xt_table_info *private = table->private;
950 int ret = 0;
951 void *loc_cpu_entry;
952
953 counters = alloc_counters(table);
954 if (IS_ERR(counters))
955 return PTR_ERR(counters);
956
957 /* choose the copy that is on our node/cpu, ...
958 * This choice is lazy (because current thread is
959 * allowed to migrate to another cpu)
960 */
961 loc_cpu_entry = private->entries[raw_smp_processor_id()];
962 /* ... then copy entire thing ... */
963 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
964 ret = -EFAULT;
965 goto free_counters;
966 }
967
968 /* FIXME: use iterator macros --RR */
969 /* ... then go back and fix counters and names */
970 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
971 unsigned int i;
972 struct ipt_entry_match *m;
973 struct ipt_entry_target *t;
974
975 e = (struct ipt_entry *)(loc_cpu_entry + off);
976 if (copy_to_user(userptr + off
977 + offsetof(struct ipt_entry, counters),
978 &counters[num],
979 sizeof(counters[num])) != 0) {
980 ret = -EFAULT;
981 goto free_counters;
982 }
983
984 for (i = sizeof(struct ipt_entry);
985 i < e->target_offset;
986 i += m->u.match_size) {
987 m = (void *)e + i;
988
989 if (copy_to_user(userptr + off + i
990 + offsetof(struct ipt_entry_match,
991 u.user.name),
992 m->u.kernel.match->name,
993 strlen(m->u.kernel.match->name)+1)
994 != 0) {
995 ret = -EFAULT;
996 goto free_counters;
997 }
998 }
999
1000 t = ipt_get_target(e);
1001 if (copy_to_user(userptr + off + e->target_offset
1002 + offsetof(struct ipt_entry_target,
1003 u.user.name),
1004 t->u.kernel.target->name,
1005 strlen(t->u.kernel.target->name)+1) != 0) {
1006 ret = -EFAULT;
1007 goto free_counters;
1008 }
1009 }
1010
1011 free_counters:
1012 vfree(counters);
1013 return ret;
1014 }
1015
1016 #ifdef CONFIG_COMPAT
1017 struct compat_delta {
1018 struct compat_delta *next;
1019 unsigned int offset;
1020 short delta;
1021 };
1022
1023 static struct compat_delta *compat_offsets = NULL;
1024
1025 static int compat_add_offset(unsigned int offset, short delta)
1026 {
1027 struct compat_delta *tmp;
1028
1029 tmp = kmalloc(sizeof(struct compat_delta), GFP_KERNEL);
1030 if (!tmp)
1031 return -ENOMEM;
1032 tmp->offset = offset;
1033 tmp->delta = delta;
1034 if (compat_offsets) {
1035 tmp->next = compat_offsets->next;
1036 compat_offsets->next = tmp;
1037 } else {
1038 compat_offsets = tmp;
1039 tmp->next = NULL;
1040 }
1041 return 0;
1042 }
1043
1044 static void compat_flush_offsets(void)
1045 {
1046 struct compat_delta *tmp, *next;
1047
1048 if (compat_offsets) {
1049 for(tmp = compat_offsets; tmp; tmp = next) {
1050 next = tmp->next;
1051 kfree(tmp);
1052 }
1053 compat_offsets = NULL;
1054 }
1055 }
1056
1057 static short compat_calc_jump(unsigned int offset)
1058 {
1059 struct compat_delta *tmp;
1060 short delta;
1061
1062 for(tmp = compat_offsets, delta = 0; tmp; tmp = tmp->next)
1063 if (tmp->offset < offset)
1064 delta += tmp->delta;
1065 return delta;
1066 }
1067
1068 static void compat_standard_from_user(void *dst, void *src)
1069 {
1070 int v = *(compat_int_t *)src;
1071
1072 if (v > 0)
1073 v += compat_calc_jump(v);
1074 memcpy(dst, &v, sizeof(v));
1075 }
1076
1077 static int compat_standard_to_user(void __user *dst, void *src)
1078 {
1079 compat_int_t cv = *(int *)src;
1080
1081 if (cv > 0)
1082 cv -= compat_calc_jump(cv);
1083 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1084 }
1085
1086 static inline int
1087 compat_calc_match(struct ipt_entry_match *m, int * size)
1088 {
1089 *size += xt_compat_match_offset(m->u.kernel.match);
1090 return 0;
1091 }
1092
1093 static int compat_calc_entry(struct ipt_entry *e,
1094 const struct xt_table_info *info,
1095 void *base, struct xt_table_info *newinfo)
1096 {
1097 struct ipt_entry_target *t;
1098 unsigned int entry_offset;
1099 int off, i, ret;
1100
1101 off = 0;
1102 entry_offset = (void *)e - base;
1103 IPT_MATCH_ITERATE(e, compat_calc_match, &off);
1104 t = ipt_get_target(e);
1105 off += xt_compat_target_offset(t->u.kernel.target);
1106 newinfo->size -= off;
1107 ret = compat_add_offset(entry_offset, off);
1108 if (ret)
1109 return ret;
1110
1111 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1112 if (info->hook_entry[i] && (e < (struct ipt_entry *)
1113 (base + info->hook_entry[i])))
1114 newinfo->hook_entry[i] -= off;
1115 if (info->underflow[i] && (e < (struct ipt_entry *)
1116 (base + info->underflow[i])))
1117 newinfo->underflow[i] -= off;
1118 }
1119 return 0;
1120 }
1121
1122 static int compat_table_info(const struct xt_table_info *info,
1123 struct xt_table_info *newinfo)
1124 {
1125 void *loc_cpu_entry;
1126
1127 if (!newinfo || !info)
1128 return -EINVAL;
1129
1130 /* we dont care about newinfo->entries[] */
1131 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1132 newinfo->initial_entries = 0;
1133 loc_cpu_entry = info->entries[raw_smp_processor_id()];
1134 return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
1135 compat_calc_entry, info, loc_cpu_entry, newinfo);
1136 }
1137 #endif
1138
1139 static int get_info(void __user *user, int *len, int compat)
1140 {
1141 char name[IPT_TABLE_MAXNAMELEN];
1142 struct xt_table *t;
1143 int ret;
1144
1145 if (*len != sizeof(struct ipt_getinfo)) {
1146 duprintf("length %u != %u\n", *len,
1147 (unsigned int)sizeof(struct ipt_getinfo));
1148 return -EINVAL;
1149 }
1150
1151 if (copy_from_user(name, user, sizeof(name)) != 0)
1152 return -EFAULT;
1153
1154 name[IPT_TABLE_MAXNAMELEN-1] = '\0';
1155 #ifdef CONFIG_COMPAT
1156 if (compat)
1157 xt_compat_lock(AF_INET);
1158 #endif
1159 t = try_then_request_module(xt_find_table_lock(AF_INET, name),
1160 "iptable_%s", name);
1161 if (t && !IS_ERR(t)) {
1162 struct ipt_getinfo info;
1163 struct xt_table_info *private = t->private;
1164
1165 #ifdef CONFIG_COMPAT
1166 if (compat) {
1167 struct xt_table_info tmp;
1168 ret = compat_table_info(private, &tmp);
1169 compat_flush_offsets();
1170 private = &tmp;
1171 }
1172 #endif
1173 info.valid_hooks = t->valid_hooks;
1174 memcpy(info.hook_entry, private->hook_entry,
1175 sizeof(info.hook_entry));
1176 memcpy(info.underflow, private->underflow,
1177 sizeof(info.underflow));
1178 info.num_entries = private->number;
1179 info.size = private->size;
1180 strcpy(info.name, name);
1181
1182 if (copy_to_user(user, &info, *len) != 0)
1183 ret = -EFAULT;
1184 else
1185 ret = 0;
1186
1187 xt_table_unlock(t);
1188 module_put(t->me);
1189 } else
1190 ret = t ? PTR_ERR(t) : -ENOENT;
1191 #ifdef CONFIG_COMPAT
1192 if (compat)
1193 xt_compat_unlock(AF_INET);
1194 #endif
1195 return ret;
1196 }
1197
1198 static int
1199 get_entries(struct ipt_get_entries __user *uptr, int *len)
1200 {
1201 int ret;
1202 struct ipt_get_entries get;
1203 struct xt_table *t;
1204
1205 if (*len < sizeof(get)) {
1206 duprintf("get_entries: %u < %d\n", *len,
1207 (unsigned int)sizeof(get));
1208 return -EINVAL;
1209 }
1210 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1211 return -EFAULT;
1212 if (*len != sizeof(struct ipt_get_entries) + get.size) {
1213 duprintf("get_entries: %u != %u\n", *len,
1214 (unsigned int)(sizeof(struct ipt_get_entries) +
1215 get.size));
1216 return -EINVAL;
1217 }
1218
1219 t = xt_find_table_lock(AF_INET, get.name);
1220 if (t && !IS_ERR(t)) {
1221 struct xt_table_info *private = t->private;
1222 duprintf("t->private->number = %u\n",
1223 private->number);
1224 if (get.size == private->size)
1225 ret = copy_entries_to_user(private->size,
1226 t, uptr->entrytable);
1227 else {
1228 duprintf("get_entries: I've got %u not %u!\n",
1229 private->size,
1230 get.size);
1231 ret = -EINVAL;
1232 }
1233 module_put(t->me);
1234 xt_table_unlock(t);
1235 } else
1236 ret = t ? PTR_ERR(t) : -ENOENT;
1237
1238 return ret;
1239 }
1240
1241 static int
1242 __do_replace(const char *name, unsigned int valid_hooks,
1243 struct xt_table_info *newinfo, unsigned int num_counters,
1244 void __user *counters_ptr)
1245 {
1246 int ret;
1247 struct xt_table *t;
1248 struct xt_table_info *oldinfo;
1249 struct xt_counters *counters;
1250 void *loc_cpu_old_entry;
1251
1252 ret = 0;
1253 counters = vmalloc(num_counters * sizeof(struct xt_counters));
1254 if (!counters) {
1255 ret = -ENOMEM;
1256 goto out;
1257 }
1258
1259 t = try_then_request_module(xt_find_table_lock(AF_INET, name),
1260 "iptable_%s", name);
1261 if (!t || IS_ERR(t)) {
1262 ret = t ? PTR_ERR(t) : -ENOENT;
1263 goto free_newinfo_counters_untrans;
1264 }
1265
1266 /* You lied! */
1267 if (valid_hooks != t->valid_hooks) {
1268 duprintf("Valid hook crap: %08X vs %08X\n",
1269 valid_hooks, t->valid_hooks);
1270 ret = -EINVAL;
1271 goto put_module;
1272 }
1273
1274 oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1275 if (!oldinfo)
1276 goto put_module;
1277
1278 /* Update module usage count based on number of rules */
1279 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1280 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1281 if ((oldinfo->number > oldinfo->initial_entries) ||
1282 (newinfo->number <= oldinfo->initial_entries))
1283 module_put(t->me);
1284 if ((oldinfo->number > oldinfo->initial_entries) &&
1285 (newinfo->number <= oldinfo->initial_entries))
1286 module_put(t->me);
1287
1288 /* Get the old counters. */
1289 get_counters(oldinfo, counters);
1290 /* Decrease module usage counts and free resource */
1291 loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1292 IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
1293 xt_free_table_info(oldinfo);
1294 if (copy_to_user(counters_ptr, counters,
1295 sizeof(struct xt_counters) * num_counters) != 0)
1296 ret = -EFAULT;
1297 vfree(counters);
1298 xt_table_unlock(t);
1299 return ret;
1300
1301 put_module:
1302 module_put(t->me);
1303 xt_table_unlock(t);
1304 free_newinfo_counters_untrans:
1305 vfree(counters);
1306 out:
1307 return ret;
1308 }
1309
1310 static int
1311 do_replace(void __user *user, unsigned int len)
1312 {
1313 int ret;
1314 struct ipt_replace tmp;
1315 struct xt_table_info *newinfo;
1316 void *loc_cpu_entry;
1317
1318 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1319 return -EFAULT;
1320
1321 /* Hack: Causes ipchains to give correct error msg --RR */
1322 if (len != sizeof(tmp) + tmp.size)
1323 return -ENOPROTOOPT;
1324
1325 /* overflow check */
1326 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1327 return -ENOMEM;
1328
1329 newinfo = xt_alloc_table_info(tmp.size);
1330 if (!newinfo)
1331 return -ENOMEM;
1332
1333 /* choose the copy that is our node/cpu */
1334 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1335 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1336 tmp.size) != 0) {
1337 ret = -EFAULT;
1338 goto free_newinfo;
1339 }
1340
1341 ret = translate_table(tmp.name, tmp.valid_hooks,
1342 newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1343 tmp.hook_entry, tmp.underflow);
1344 if (ret != 0)
1345 goto free_newinfo;
1346
1347 duprintf("ip_tables: Translated table\n");
1348
1349 ret = __do_replace(tmp.name, tmp.valid_hooks,
1350 newinfo, tmp.num_counters,
1351 tmp.counters);
1352 if (ret)
1353 goto free_newinfo_untrans;
1354 return 0;
1355
1356 free_newinfo_untrans:
1357 IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
1358 free_newinfo:
1359 xt_free_table_info(newinfo);
1360 return ret;
1361 }
1362
1363 /* We're lazy, and add to the first CPU; overflow works its fey magic
1364 * and everything is OK. */
1365 static inline int
1366 add_counter_to_entry(struct ipt_entry *e,
1367 const struct xt_counters addme[],
1368 unsigned int *i)
1369 {
1370 #if 0
1371 duprintf("add_counter: Entry %u %lu/%lu + %lu/%lu\n",
1372 *i,
1373 (long unsigned int)e->counters.pcnt,
1374 (long unsigned int)e->counters.bcnt,
1375 (long unsigned int)addme[*i].pcnt,
1376 (long unsigned int)addme[*i].bcnt);
1377 #endif
1378
1379 ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1380
1381 (*i)++;
1382 return 0;
1383 }
1384
1385 static int
1386 do_add_counters(void __user *user, unsigned int len, int compat)
1387 {
1388 unsigned int i;
1389 struct xt_counters_info tmp;
1390 struct xt_counters *paddc;
1391 unsigned int num_counters;
1392 char *name;
1393 int size;
1394 void *ptmp;
1395 struct xt_table *t;
1396 struct xt_table_info *private;
1397 int ret = 0;
1398 void *loc_cpu_entry;
1399 #ifdef CONFIG_COMPAT
1400 struct compat_xt_counters_info compat_tmp;
1401
1402 if (compat) {
1403 ptmp = &compat_tmp;
1404 size = sizeof(struct compat_xt_counters_info);
1405 } else
1406 #endif
1407 {
1408 ptmp = &tmp;
1409 size = sizeof(struct xt_counters_info);
1410 }
1411
1412 if (copy_from_user(ptmp, user, size) != 0)
1413 return -EFAULT;
1414
1415 #ifdef CONFIG_COMPAT
1416 if (compat) {
1417 num_counters = compat_tmp.num_counters;
1418 name = compat_tmp.name;
1419 } else
1420 #endif
1421 {
1422 num_counters = tmp.num_counters;
1423 name = tmp.name;
1424 }
1425
1426 if (len != size + num_counters * sizeof(struct xt_counters))
1427 return -EINVAL;
1428
1429 paddc = vmalloc_node(len - size, numa_node_id());
1430 if (!paddc)
1431 return -ENOMEM;
1432
1433 if (copy_from_user(paddc, user + size, len - size) != 0) {
1434 ret = -EFAULT;
1435 goto free;
1436 }
1437
1438 t = xt_find_table_lock(AF_INET, name);
1439 if (!t || IS_ERR(t)) {
1440 ret = t ? PTR_ERR(t) : -ENOENT;
1441 goto free;
1442 }
1443
1444 write_lock_bh(&t->lock);
1445 private = t->private;
1446 if (private->number != num_counters) {
1447 ret = -EINVAL;
1448 goto unlock_up_free;
1449 }
1450
1451 i = 0;
1452 /* Choose the copy that is on our node */
1453 loc_cpu_entry = private->entries[raw_smp_processor_id()];
1454 IPT_ENTRY_ITERATE(loc_cpu_entry,
1455 private->size,
1456 add_counter_to_entry,
1457 paddc,
1458 &i);
1459 unlock_up_free:
1460 write_unlock_bh(&t->lock);
1461 xt_table_unlock(t);
1462 module_put(t->me);
1463 free:
1464 vfree(paddc);
1465
1466 return ret;
1467 }
1468
1469 #ifdef CONFIG_COMPAT
1470 struct compat_ipt_replace {
1471 char name[IPT_TABLE_MAXNAMELEN];
1472 u32 valid_hooks;
1473 u32 num_entries;
1474 u32 size;
1475 u32 hook_entry[NF_INET_NUMHOOKS];
1476 u32 underflow[NF_INET_NUMHOOKS];
1477 u32 num_counters;
1478 compat_uptr_t counters; /* struct ipt_counters * */
1479 struct compat_ipt_entry entries[0];
1480 };
1481
1482 static inline int compat_copy_match_to_user(struct ipt_entry_match *m,
1483 void __user **dstptr, compat_uint_t *size)
1484 {
1485 return xt_compat_match_to_user(m, dstptr, size);
1486 }
1487
1488 static int
1489 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1490 compat_uint_t *size, struct xt_counters *counters,
1491 unsigned int *i)
1492 {
1493 struct ipt_entry_target *t;
1494 struct compat_ipt_entry __user *ce;
1495 u_int16_t target_offset, next_offset;
1496 compat_uint_t origsize;
1497 int ret;
1498
1499 ret = -EFAULT;
1500 origsize = *size;
1501 ce = (struct compat_ipt_entry __user *)*dstptr;
1502 if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
1503 goto out;
1504
1505 if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
1506 goto out;
1507
1508 *dstptr += sizeof(struct compat_ipt_entry);
1509 ret = IPT_MATCH_ITERATE(e, compat_copy_match_to_user, dstptr, size);
1510 target_offset = e->target_offset - (origsize - *size);
1511 if (ret)
1512 goto out;
1513 t = ipt_get_target(e);
1514 ret = xt_compat_target_to_user(t, dstptr, size);
1515 if (ret)
1516 goto out;
1517 ret = -EFAULT;
1518 next_offset = e->next_offset - (origsize - *size);
1519 if (put_user(target_offset, &ce->target_offset))
1520 goto out;
1521 if (put_user(next_offset, &ce->next_offset))
1522 goto out;
1523
1524 (*i)++;
1525 return 0;
1526 out:
1527 return ret;
1528 }
1529
1530 static inline int
1531 compat_find_calc_match(struct ipt_entry_match *m,
1532 const char *name,
1533 const struct ipt_ip *ip,
1534 unsigned int hookmask,
1535 int *size, int *i)
1536 {
1537 struct xt_match *match;
1538
1539 match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
1540 m->u.user.revision),
1541 "ipt_%s", m->u.user.name);
1542 if (IS_ERR(match) || !match) {
1543 duprintf("compat_check_calc_match: `%s' not found\n",
1544 m->u.user.name);
1545 return match ? PTR_ERR(match) : -ENOENT;
1546 }
1547 m->u.kernel.match = match;
1548 *size += xt_compat_match_offset(match);
1549
1550 (*i)++;
1551 return 0;
1552 }
1553
1554 static inline int
1555 compat_release_match(struct ipt_entry_match *m, unsigned int *i)
1556 {
1557 if (i && (*i)-- == 0)
1558 return 1;
1559
1560 module_put(m->u.kernel.match->me);
1561 return 0;
1562 }
1563
1564 static inline int
1565 compat_release_entry(struct ipt_entry *e, unsigned int *i)
1566 {
1567 struct ipt_entry_target *t;
1568
1569 if (i && (*i)-- == 0)
1570 return 1;
1571
1572 /* Cleanup all matches */
1573 IPT_MATCH_ITERATE(e, compat_release_match, NULL);
1574 t = ipt_get_target(e);
1575 module_put(t->u.kernel.target->me);
1576 return 0;
1577 }
1578
1579 static inline int
1580 check_compat_entry_size_and_hooks(struct ipt_entry *e,
1581 struct xt_table_info *newinfo,
1582 unsigned int *size,
1583 unsigned char *base,
1584 unsigned char *limit,
1585 unsigned int *hook_entries,
1586 unsigned int *underflows,
1587 unsigned int *i,
1588 const char *name)
1589 {
1590 struct ipt_entry_target *t;
1591 struct xt_target *target;
1592 unsigned int entry_offset;
1593 int ret, off, h, j;
1594
1595 duprintf("check_compat_entry_size_and_hooks %p\n", e);
1596 if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
1597 || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1598 duprintf("Bad offset %p, limit = %p\n", e, limit);
1599 return -EINVAL;
1600 }
1601
1602 if (e->next_offset < sizeof(struct compat_ipt_entry) +
1603 sizeof(struct compat_xt_entry_target)) {
1604 duprintf("checking: element %p size %u\n",
1605 e, e->next_offset);
1606 return -EINVAL;
1607 }
1608
1609 ret = check_entry(e, name);
1610 if (ret)
1611 return ret;
1612
1613 off = 0;
1614 entry_offset = (void *)e - (void *)base;
1615 j = 0;
1616 ret = IPT_MATCH_ITERATE(e, compat_find_calc_match, name, &e->ip,
1617 e->comefrom, &off, &j);
1618 if (ret != 0)
1619 goto release_matches;
1620
1621 t = ipt_get_target(e);
1622 target = try_then_request_module(xt_find_target(AF_INET,
1623 t->u.user.name,
1624 t->u.user.revision),
1625 "ipt_%s", t->u.user.name);
1626 if (IS_ERR(target) || !target) {
1627 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1628 t->u.user.name);
1629 ret = target ? PTR_ERR(target) : -ENOENT;
1630 goto release_matches;
1631 }
1632 t->u.kernel.target = target;
1633
1634 off += xt_compat_target_offset(target);
1635 *size += off;
1636 ret = compat_add_offset(entry_offset, off);
1637 if (ret)
1638 goto out;
1639
1640 /* Check hooks & underflows */
1641 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1642 if ((unsigned char *)e - base == hook_entries[h])
1643 newinfo->hook_entry[h] = hook_entries[h];
1644 if ((unsigned char *)e - base == underflows[h])
1645 newinfo->underflow[h] = underflows[h];
1646 }
1647
1648 /* Clear counters and comefrom */
1649 e->counters = ((struct ipt_counters) { 0, 0 });
1650 e->comefrom = 0;
1651
1652 (*i)++;
1653 return 0;
1654
1655 out:
1656 module_put(t->u.kernel.target->me);
1657 release_matches:
1658 IPT_MATCH_ITERATE(e, compat_release_match, &j);
1659 return ret;
1660 }
1661
1662 static inline int compat_copy_match_from_user(struct ipt_entry_match *m,
1663 void **dstptr, compat_uint_t *size, const char *name,
1664 const struct ipt_ip *ip, unsigned int hookmask)
1665 {
1666 xt_compat_match_from_user(m, dstptr, size);
1667 return 0;
1668 }
1669
1670 static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
1671 unsigned int *size, const char *name,
1672 struct xt_table_info *newinfo, unsigned char *base)
1673 {
1674 struct ipt_entry_target *t;
1675 struct xt_target *target;
1676 struct ipt_entry *de;
1677 unsigned int origsize;
1678 int ret, h;
1679
1680 ret = 0;
1681 origsize = *size;
1682 de = (struct ipt_entry *)*dstptr;
1683 memcpy(de, e, sizeof(struct ipt_entry));
1684
1685 *dstptr += sizeof(struct compat_ipt_entry);
1686 ret = IPT_MATCH_ITERATE(e, compat_copy_match_from_user, dstptr, size,
1687 name, &de->ip, de->comefrom);
1688 if (ret)
1689 return ret;
1690 de->target_offset = e->target_offset - (origsize - *size);
1691 t = ipt_get_target(e);
1692 target = t->u.kernel.target;
1693 xt_compat_target_from_user(t, dstptr, size);
1694
1695 de->next_offset = e->next_offset - (origsize - *size);
1696 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1697 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1698 newinfo->hook_entry[h] -= origsize - *size;
1699 if ((unsigned char *)de - base < newinfo->underflow[h])
1700 newinfo->underflow[h] -= origsize - *size;
1701 }
1702 return ret;
1703 }
1704
1705 static inline int compat_check_entry(struct ipt_entry *e, const char *name,
1706 unsigned int *i)
1707 {
1708 int j, ret;
1709
1710 j = 0;
1711 ret = IPT_MATCH_ITERATE(e, check_match, name, &e->ip, e->comefrom, &j);
1712 if (ret)
1713 goto cleanup_matches;
1714
1715 ret = check_target(e, name);
1716 if (ret)
1717 goto cleanup_matches;
1718
1719 (*i)++;
1720 return 0;
1721
1722 cleanup_matches:
1723 IPT_MATCH_ITERATE(e, cleanup_match, &j);
1724 return ret;
1725 }
1726
1727 static int
1728 translate_compat_table(const char *name,
1729 unsigned int valid_hooks,
1730 struct xt_table_info **pinfo,
1731 void **pentry0,
1732 unsigned int total_size,
1733 unsigned int number,
1734 unsigned int *hook_entries,
1735 unsigned int *underflows)
1736 {
1737 unsigned int i, j;
1738 struct xt_table_info *newinfo, *info;
1739 void *pos, *entry0, *entry1;
1740 unsigned int size;
1741 int ret;
1742
1743 info = *pinfo;
1744 entry0 = *pentry0;
1745 size = total_size;
1746 info->number = number;
1747
1748 /* Init all hooks to impossible value. */
1749 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1750 info->hook_entry[i] = 0xFFFFFFFF;
1751 info->underflow[i] = 0xFFFFFFFF;
1752 }
1753
1754 duprintf("translate_compat_table: size %u\n", info->size);
1755 j = 0;
1756 xt_compat_lock(AF_INET);
1757 /* Walk through entries, checking offsets. */
1758 ret = IPT_ENTRY_ITERATE(entry0, total_size,
1759 check_compat_entry_size_and_hooks,
1760 info, &size, entry0,
1761 entry0 + total_size,
1762 hook_entries, underflows, &j, name);
1763 if (ret != 0)
1764 goto out_unlock;
1765
1766 ret = -EINVAL;
1767 if (j != number) {
1768 duprintf("translate_compat_table: %u not %u entries\n",
1769 j, number);
1770 goto out_unlock;
1771 }
1772
1773 /* Check hooks all assigned */
1774 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1775 /* Only hooks which are valid */
1776 if (!(valid_hooks & (1 << i)))
1777 continue;
1778 if (info->hook_entry[i] == 0xFFFFFFFF) {
1779 duprintf("Invalid hook entry %u %u\n",
1780 i, hook_entries[i]);
1781 goto out_unlock;
1782 }
1783 if (info->underflow[i] == 0xFFFFFFFF) {
1784 duprintf("Invalid underflow %u %u\n",
1785 i, underflows[i]);
1786 goto out_unlock;
1787 }
1788 }
1789
1790 ret = -ENOMEM;
1791 newinfo = xt_alloc_table_info(size);
1792 if (!newinfo)
1793 goto out_unlock;
1794
1795 newinfo->number = number;
1796 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1797 newinfo->hook_entry[i] = info->hook_entry[i];
1798 newinfo->underflow[i] = info->underflow[i];
1799 }
1800 entry1 = newinfo->entries[raw_smp_processor_id()];
1801 pos = entry1;
1802 size = total_size;
1803 ret = IPT_ENTRY_ITERATE(entry0, total_size,
1804 compat_copy_entry_from_user, &pos, &size,
1805 name, newinfo, entry1);
1806 compat_flush_offsets();
1807 xt_compat_unlock(AF_INET);
1808 if (ret)
1809 goto free_newinfo;
1810
1811 ret = -ELOOP;
1812 if (!mark_source_chains(newinfo, valid_hooks, entry1))
1813 goto free_newinfo;
1814
1815 i = 0;
1816 ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
1817 name, &i);
1818 if (ret) {
1819 j -= i;
1820 IPT_ENTRY_ITERATE_CONTINUE(entry1, newinfo->size, i,
1821 compat_release_entry, &j);
1822 IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
1823 xt_free_table_info(newinfo);
1824 return ret;
1825 }
1826
1827 /* And one copy for every other CPU */
1828 for_each_possible_cpu(i)
1829 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1830 memcpy(newinfo->entries[i], entry1, newinfo->size);
1831
1832 *pinfo = newinfo;
1833 *pentry0 = entry1;
1834 xt_free_table_info(info);
1835 return 0;
1836
1837 free_newinfo:
1838 xt_free_table_info(newinfo);
1839 out:
1840 IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
1841 return ret;
1842 out_unlock:
1843 compat_flush_offsets();
1844 xt_compat_unlock(AF_INET);
1845 goto out;
1846 }
1847
1848 static int
1849 compat_do_replace(void __user *user, unsigned int len)
1850 {
1851 int ret;
1852 struct compat_ipt_replace tmp;
1853 struct xt_table_info *newinfo;
1854 void *loc_cpu_entry;
1855
1856 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1857 return -EFAULT;
1858
1859 /* Hack: Causes ipchains to give correct error msg --RR */
1860 if (len != sizeof(tmp) + tmp.size)
1861 return -ENOPROTOOPT;
1862
1863 /* overflow check */
1864 if (tmp.size >= INT_MAX / num_possible_cpus())
1865 return -ENOMEM;
1866 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1867 return -ENOMEM;
1868
1869 newinfo = xt_alloc_table_info(tmp.size);
1870 if (!newinfo)
1871 return -ENOMEM;
1872
1873 /* choose the copy that is our node/cpu */
1874 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1875 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1876 tmp.size) != 0) {
1877 ret = -EFAULT;
1878 goto free_newinfo;
1879 }
1880
1881 ret = translate_compat_table(tmp.name, tmp.valid_hooks,
1882 &newinfo, &loc_cpu_entry, tmp.size,
1883 tmp.num_entries, tmp.hook_entry, tmp.underflow);
1884 if (ret != 0)
1885 goto free_newinfo;
1886
1887 duprintf("compat_do_replace: Translated table\n");
1888
1889 ret = __do_replace(tmp.name, tmp.valid_hooks,
1890 newinfo, tmp.num_counters,
1891 compat_ptr(tmp.counters));
1892 if (ret)
1893 goto free_newinfo_untrans;
1894 return 0;
1895
1896 free_newinfo_untrans:
1897 IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
1898 free_newinfo:
1899 xt_free_table_info(newinfo);
1900 return ret;
1901 }
1902
1903 static int
1904 compat_do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user,
1905 unsigned int len)
1906 {
1907 int ret;
1908
1909 if (!capable(CAP_NET_ADMIN))
1910 return -EPERM;
1911
1912 switch (cmd) {
1913 case IPT_SO_SET_REPLACE:
1914 ret = compat_do_replace(user, len);
1915 break;
1916
1917 case IPT_SO_SET_ADD_COUNTERS:
1918 ret = do_add_counters(user, len, 1);
1919 break;
1920
1921 default:
1922 duprintf("do_ipt_set_ctl: unknown request %i\n", cmd);
1923 ret = -EINVAL;
1924 }
1925
1926 return ret;
1927 }
1928
1929 struct compat_ipt_get_entries
1930 {
1931 char name[IPT_TABLE_MAXNAMELEN];
1932 compat_uint_t size;
1933 struct compat_ipt_entry entrytable[0];
1934 };
1935
1936 static int compat_copy_entries_to_user(unsigned int total_size,
1937 struct xt_table *table, void __user *userptr)
1938 {
1939 struct xt_counters *counters;
1940 struct xt_table_info *private = table->private;
1941 void __user *pos;
1942 unsigned int size;
1943 int ret = 0;
1944 void *loc_cpu_entry;
1945 unsigned int i = 0;
1946
1947 counters = alloc_counters(table);
1948 if (IS_ERR(counters))
1949 return PTR_ERR(counters);
1950
1951 /* choose the copy that is on our node/cpu, ...
1952 * This choice is lazy (because current thread is
1953 * allowed to migrate to another cpu)
1954 */
1955 loc_cpu_entry = private->entries[raw_smp_processor_id()];
1956 pos = userptr;
1957 size = total_size;
1958 ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
1959 compat_copy_entry_to_user,
1960 &pos, &size, counters, &i);
1961
1962 vfree(counters);
1963 return ret;
1964 }
1965
1966 static int
1967 compat_get_entries(struct compat_ipt_get_entries __user *uptr, int *len)
1968 {
1969 int ret;
1970 struct compat_ipt_get_entries get;
1971 struct xt_table *t;
1972
1973
1974 if (*len < sizeof(get)) {
1975 duprintf("compat_get_entries: %u < %u\n",
1976 *len, (unsigned int)sizeof(get));
1977 return -EINVAL;
1978 }
1979
1980 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1981 return -EFAULT;
1982
1983 if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1984 duprintf("compat_get_entries: %u != %u\n", *len,
1985 (unsigned int)(sizeof(struct compat_ipt_get_entries) +
1986 get.size));
1987 return -EINVAL;
1988 }
1989
1990 xt_compat_lock(AF_INET);
1991 t = xt_find_table_lock(AF_INET, get.name);
1992 if (t && !IS_ERR(t)) {
1993 struct xt_table_info *private = t->private;
1994 struct xt_table_info info;
1995 duprintf("t->private->number = %u\n",
1996 private->number);
1997 ret = compat_table_info(private, &info);
1998 if (!ret && get.size == info.size) {
1999 ret = compat_copy_entries_to_user(private->size,
2000 t, uptr->entrytable);
2001 } else if (!ret) {
2002 duprintf("compat_get_entries: I've got %u not %u!\n",
2003 private->size,
2004 get.size);
2005 ret = -EINVAL;
2006 }
2007 compat_flush_offsets();
2008 module_put(t->me);
2009 xt_table_unlock(t);
2010 } else
2011 ret = t ? PTR_ERR(t) : -ENOENT;
2012
2013 xt_compat_unlock(AF_INET);
2014 return ret;
2015 }
2016
2017 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
2018
2019 static int
2020 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2021 {
2022 int ret;
2023
2024 if (!capable(CAP_NET_ADMIN))
2025 return -EPERM;
2026
2027 switch (cmd) {
2028 case IPT_SO_GET_INFO:
2029 ret = get_info(user, len, 1);
2030 break;
2031 case IPT_SO_GET_ENTRIES:
2032 ret = compat_get_entries(user, len);
2033 break;
2034 default:
2035 ret = do_ipt_get_ctl(sk, cmd, user, len);
2036 }
2037 return ret;
2038 }
2039 #endif
2040
2041 static int
2042 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2043 {
2044 int ret;
2045
2046 if (!capable(CAP_NET_ADMIN))
2047 return -EPERM;
2048
2049 switch (cmd) {
2050 case IPT_SO_SET_REPLACE:
2051 ret = do_replace(user, len);
2052 break;
2053
2054 case IPT_SO_SET_ADD_COUNTERS:
2055 ret = do_add_counters(user, len, 0);
2056 break;
2057
2058 default:
2059 duprintf("do_ipt_set_ctl: unknown request %i\n", cmd);
2060 ret = -EINVAL;
2061 }
2062
2063 return ret;
2064 }
2065
2066 static int
2067 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2068 {
2069 int ret;
2070
2071 if (!capable(CAP_NET_ADMIN))
2072 return -EPERM;
2073
2074 switch (cmd) {
2075 case IPT_SO_GET_INFO:
2076 ret = get_info(user, len, 0);
2077 break;
2078
2079 case IPT_SO_GET_ENTRIES:
2080 ret = get_entries(user, len);
2081 break;
2082
2083 case IPT_SO_GET_REVISION_MATCH:
2084 case IPT_SO_GET_REVISION_TARGET: {
2085 struct ipt_get_revision rev;
2086 int target;
2087
2088 if (*len != sizeof(rev)) {
2089 ret = -EINVAL;
2090 break;
2091 }
2092 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2093 ret = -EFAULT;
2094 break;
2095 }
2096
2097 if (cmd == IPT_SO_GET_REVISION_TARGET)
2098 target = 1;
2099 else
2100 target = 0;
2101
2102 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2103 rev.revision,
2104 target, &ret),
2105 "ipt_%s", rev.name);
2106 break;
2107 }
2108
2109 default:
2110 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2111 ret = -EINVAL;
2112 }
2113
2114 return ret;
2115 }
2116
2117 int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
2118 {
2119 int ret;
2120 struct xt_table_info *newinfo;
2121 struct xt_table_info bootstrap
2122 = { 0, 0, 0, { 0 }, { 0 }, { } };
2123 void *loc_cpu_entry;
2124
2125 newinfo = xt_alloc_table_info(repl->size);
2126 if (!newinfo)
2127 return -ENOMEM;
2128
2129 /* choose the copy on our node/cpu
2130 * but dont care of preemption
2131 */
2132 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2133 memcpy(loc_cpu_entry, repl->entries, repl->size);
2134
2135 ret = translate_table(table->name, table->valid_hooks,
2136 newinfo, loc_cpu_entry, repl->size,
2137 repl->num_entries,
2138 repl->hook_entry,
2139 repl->underflow);
2140 if (ret != 0) {
2141 xt_free_table_info(newinfo);
2142 return ret;
2143 }
2144
2145 ret = xt_register_table(table, &bootstrap, newinfo);
2146 if (ret != 0) {
2147 xt_free_table_info(newinfo);
2148 return ret;
2149 }
2150
2151 return 0;
2152 }
2153
2154 void ipt_unregister_table(struct xt_table *table)
2155 {
2156 struct xt_table_info *private;
2157 void *loc_cpu_entry;
2158
2159 private = xt_unregister_table(table);
2160
2161 /* Decrease module usage counts and free resources */
2162 loc_cpu_entry = private->entries[raw_smp_processor_id()];
2163 IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
2164 xt_free_table_info(private);
2165 }
2166
2167 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2168 static inline bool
2169 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2170 u_int8_t type, u_int8_t code,
2171 bool invert)
2172 {
2173 return ((test_type == 0xFF) || (type == test_type && code >= min_code && code <= max_code))
2174 ^ invert;
2175 }
2176
2177 static bool
2178 icmp_match(const struct sk_buff *skb,
2179 const struct net_device *in,
2180 const struct net_device *out,
2181 const struct xt_match *match,
2182 const void *matchinfo,
2183 int offset,
2184 unsigned int protoff,
2185 bool *hotdrop)
2186 {
2187 struct icmphdr _icmph, *ic;
2188 const struct ipt_icmp *icmpinfo = matchinfo;
2189
2190 /* Must not be a fragment. */
2191 if (offset)
2192 return false;
2193
2194 ic = skb_header_pointer(skb, protoff, sizeof(_icmph), &_icmph);
2195 if (ic == NULL) {
2196 /* We've been asked to examine this packet, and we
2197 * can't. Hence, no choice but to drop.
2198 */
2199 duprintf("Dropping evil ICMP tinygram.\n");
2200 *hotdrop = true;
2201 return false;
2202 }
2203
2204 return icmp_type_code_match(icmpinfo->type,
2205 icmpinfo->code[0],
2206 icmpinfo->code[1],
2207 ic->type, ic->code,
2208 !!(icmpinfo->invflags&IPT_ICMP_INV));
2209 }
2210
2211 /* Called when user tries to insert an entry of this type. */
2212 static bool
2213 icmp_checkentry(const char *tablename,
2214 const void *info,
2215 const struct xt_match *match,
2216 void *matchinfo,
2217 unsigned int hook_mask)
2218 {
2219 const struct ipt_icmp *icmpinfo = matchinfo;
2220
2221 /* Must specify no unknown invflags */
2222 return !(icmpinfo->invflags & ~IPT_ICMP_INV);
2223 }
2224
2225 /* The built-in targets: standard (NULL) and error. */
2226 static struct xt_target ipt_standard_target __read_mostly = {
2227 .name = IPT_STANDARD_TARGET,
2228 .targetsize = sizeof(int),
2229 .family = AF_INET,
2230 #ifdef CONFIG_COMPAT
2231 .compatsize = sizeof(compat_int_t),
2232 .compat_from_user = compat_standard_from_user,
2233 .compat_to_user = compat_standard_to_user,
2234 #endif
2235 };
2236
2237 static struct xt_target ipt_error_target __read_mostly = {
2238 .name = IPT_ERROR_TARGET,
2239 .target = ipt_error,
2240 .targetsize = IPT_FUNCTION_MAXNAMELEN,
2241 .family = AF_INET,
2242 };
2243
2244 static struct nf_sockopt_ops ipt_sockopts = {
2245 .pf = PF_INET,
2246 .set_optmin = IPT_BASE_CTL,
2247 .set_optmax = IPT_SO_SET_MAX+1,
2248 .set = do_ipt_set_ctl,
2249 #ifdef CONFIG_COMPAT
2250 .compat_set = compat_do_ipt_set_ctl,
2251 #endif
2252 .get_optmin = IPT_BASE_CTL,
2253 .get_optmax = IPT_SO_GET_MAX+1,
2254 .get = do_ipt_get_ctl,
2255 #ifdef CONFIG_COMPAT
2256 .compat_get = compat_do_ipt_get_ctl,
2257 #endif
2258 .owner = THIS_MODULE,
2259 };
2260
2261 static struct xt_match icmp_matchstruct __read_mostly = {
2262 .name = "icmp",
2263 .match = icmp_match,
2264 .matchsize = sizeof(struct ipt_icmp),
2265 .proto = IPPROTO_ICMP,
2266 .family = AF_INET,
2267 .checkentry = icmp_checkentry,
2268 };
2269
2270 static int __init ip_tables_init(void)
2271 {
2272 int ret;
2273
2274 ret = xt_proto_init(AF_INET);
2275 if (ret < 0)
2276 goto err1;
2277
2278 /* Noone else will be downing sem now, so we won't sleep */
2279 ret = xt_register_target(&ipt_standard_target);
2280 if (ret < 0)
2281 goto err2;
2282 ret = xt_register_target(&ipt_error_target);
2283 if (ret < 0)
2284 goto err3;
2285 ret = xt_register_match(&icmp_matchstruct);
2286 if (ret < 0)
2287 goto err4;
2288
2289 /* Register setsockopt */
2290 ret = nf_register_sockopt(&ipt_sockopts);
2291 if (ret < 0)
2292 goto err5;
2293
2294 printk(KERN_INFO "ip_tables: (C) 2000-2006 Netfilter Core Team\n");
2295 return 0;
2296
2297 err5:
2298 xt_unregister_match(&icmp_matchstruct);
2299 err4:
2300 xt_unregister_target(&ipt_error_target);
2301 err3:
2302 xt_unregister_target(&ipt_standard_target);
2303 err2:
2304 xt_proto_fini(AF_INET);
2305 err1:
2306 return ret;
2307 }
2308
2309 static void __exit ip_tables_fini(void)
2310 {
2311 nf_unregister_sockopt(&ipt_sockopts);
2312
2313 xt_unregister_match(&icmp_matchstruct);
2314 xt_unregister_target(&ipt_error_target);
2315 xt_unregister_target(&ipt_standard_target);
2316
2317 xt_proto_fini(AF_INET);
2318 }
2319
2320 EXPORT_SYMBOL(ipt_register_table);
2321 EXPORT_SYMBOL(ipt_unregister_table);
2322 EXPORT_SYMBOL(ipt_do_table);
2323 module_init(ip_tables_init);
2324 module_exit(ip_tables_fini);
Linux kernel - Deliverables
This page took 0.078511 seconds and 5 git commands to generate.