Merge tag 'io_uring-5.11-2021-01-16' of git://git.kernel.dk/linux-block
[linux/fpc-iii.git] / net / netfilter / x_tables.c
blobacce622582e3d769ecaa0bf09b588c07769ba53b
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * x_tables core - Backend for {ip,ip6,arp}_tables
5 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
6 * Copyright (C) 2006-2012 Patrick McHardy <kaber@trash.net>
8 * Based on existing ip_tables code which is
9 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
10 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
13 #include <linux/kernel.h>
14 #include <linux/module.h>
15 #include <linux/socket.h>
16 #include <linux/net.h>
17 #include <linux/proc_fs.h>
18 #include <linux/seq_file.h>
19 #include <linux/string.h>
20 #include <linux/vmalloc.h>
21 #include <linux/mutex.h>
22 #include <linux/mm.h>
23 #include <linux/slab.h>
24 #include <linux/audit.h>
25 #include <linux/user_namespace.h>
26 #include <net/net_namespace.h>
28 #include <linux/netfilter/x_tables.h>
29 #include <linux/netfilter_arp.h>
30 #include <linux/netfilter_ipv4/ip_tables.h>
31 #include <linux/netfilter_ipv6/ip6_tables.h>
32 #include <linux/netfilter_arp/arp_tables.h>
34 MODULE_LICENSE("GPL");
35 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
36 MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
38 #define XT_PCPU_BLOCK_SIZE 4096
39 #define XT_MAX_TABLE_SIZE (512 * 1024 * 1024)
41 struct compat_delta {
42 unsigned int offset; /* offset in kernel */
43 int delta; /* delta in 32bit user land */
46 struct xt_af {
47 struct mutex mutex;
48 struct list_head match;
49 struct list_head target;
50 #ifdef CONFIG_COMPAT
51 struct mutex compat_mutex;
52 struct compat_delta *compat_tab;
53 unsigned int number; /* number of slots in compat_tab[] */
54 unsigned int cur; /* number of used slots in compat_tab[] */
55 #endif
58 static struct xt_af *xt;
60 static const char *const xt_prefix[NFPROTO_NUMPROTO] = {
61 [NFPROTO_UNSPEC] = "x",
62 [NFPROTO_IPV4] = "ip",
63 [NFPROTO_ARP] = "arp",
64 [NFPROTO_BRIDGE] = "eb",
65 [NFPROTO_IPV6] = "ip6",
68 /* Registration hooks for targets. */
69 int xt_register_target(struct xt_target *target)
71 u_int8_t af = target->family;
73 mutex_lock(&xt[af].mutex);
74 list_add(&target->list, &xt[af].target);
75 mutex_unlock(&xt[af].mutex);
76 return 0;
78 EXPORT_SYMBOL(xt_register_target);
80 void
81 xt_unregister_target(struct xt_target *target)
83 u_int8_t af = target->family;
85 mutex_lock(&xt[af].mutex);
86 list_del(&target->list);
87 mutex_unlock(&xt[af].mutex);
89 EXPORT_SYMBOL(xt_unregister_target);
91 int
92 xt_register_targets(struct xt_target *target, unsigned int n)
94 unsigned int i;
95 int err = 0;
97 for (i = 0; i < n; i++) {
98 err = xt_register_target(&target[i]);
99 if (err)
100 goto err;
102 return err;
104 err:
105 if (i > 0)
106 xt_unregister_targets(target, i);
107 return err;
109 EXPORT_SYMBOL(xt_register_targets);
111 void
112 xt_unregister_targets(struct xt_target *target, unsigned int n)
114 while (n-- > 0)
115 xt_unregister_target(&target[n]);
117 EXPORT_SYMBOL(xt_unregister_targets);
119 int xt_register_match(struct xt_match *match)
121 u_int8_t af = match->family;
123 mutex_lock(&xt[af].mutex);
124 list_add(&match->list, &xt[af].match);
125 mutex_unlock(&xt[af].mutex);
126 return 0;
128 EXPORT_SYMBOL(xt_register_match);
130 void
131 xt_unregister_match(struct xt_match *match)
133 u_int8_t af = match->family;
135 mutex_lock(&xt[af].mutex);
136 list_del(&match->list);
137 mutex_unlock(&xt[af].mutex);
139 EXPORT_SYMBOL(xt_unregister_match);
142 xt_register_matches(struct xt_match *match, unsigned int n)
144 unsigned int i;
145 int err = 0;
147 for (i = 0; i < n; i++) {
148 err = xt_register_match(&match[i]);
149 if (err)
150 goto err;
152 return err;
154 err:
155 if (i > 0)
156 xt_unregister_matches(match, i);
157 return err;
159 EXPORT_SYMBOL(xt_register_matches);
161 void
162 xt_unregister_matches(struct xt_match *match, unsigned int n)
164 while (n-- > 0)
165 xt_unregister_match(&match[n]);
167 EXPORT_SYMBOL(xt_unregister_matches);
171 * These are weird, but module loading must not be done with mutex
172 * held (since they will register), and we have to have a single
173 * function to use.
176 /* Find match, grabs ref. Returns ERR_PTR() on error. */
177 struct xt_match *xt_find_match(u8 af, const char *name, u8 revision)
179 struct xt_match *m;
180 int err = -ENOENT;
182 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
183 return ERR_PTR(-EINVAL);
185 mutex_lock(&xt[af].mutex);
186 list_for_each_entry(m, &xt[af].match, list) {
187 if (strcmp(m->name, name) == 0) {
188 if (m->revision == revision) {
189 if (try_module_get(m->me)) {
190 mutex_unlock(&xt[af].mutex);
191 return m;
193 } else
194 err = -EPROTOTYPE; /* Found something. */
197 mutex_unlock(&xt[af].mutex);
199 if (af != NFPROTO_UNSPEC)
200 /* Try searching again in the family-independent list */
201 return xt_find_match(NFPROTO_UNSPEC, name, revision);
203 return ERR_PTR(err);
205 EXPORT_SYMBOL(xt_find_match);
207 struct xt_match *
208 xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision)
210 struct xt_match *match;
212 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
213 return ERR_PTR(-EINVAL);
215 match = xt_find_match(nfproto, name, revision);
216 if (IS_ERR(match)) {
217 request_module("%st_%s", xt_prefix[nfproto], name);
218 match = xt_find_match(nfproto, name, revision);
221 return match;
223 EXPORT_SYMBOL_GPL(xt_request_find_match);
225 /* Find target, grabs ref. Returns ERR_PTR() on error. */
226 static struct xt_target *xt_find_target(u8 af, const char *name, u8 revision)
228 struct xt_target *t;
229 int err = -ENOENT;
231 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
232 return ERR_PTR(-EINVAL);
234 mutex_lock(&xt[af].mutex);
235 list_for_each_entry(t, &xt[af].target, list) {
236 if (strcmp(t->name, name) == 0) {
237 if (t->revision == revision) {
238 if (try_module_get(t->me)) {
239 mutex_unlock(&xt[af].mutex);
240 return t;
242 } else
243 err = -EPROTOTYPE; /* Found something. */
246 mutex_unlock(&xt[af].mutex);
248 if (af != NFPROTO_UNSPEC)
249 /* Try searching again in the family-independent list */
250 return xt_find_target(NFPROTO_UNSPEC, name, revision);
252 return ERR_PTR(err);
255 struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
257 struct xt_target *target;
259 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
260 return ERR_PTR(-EINVAL);
262 target = xt_find_target(af, name, revision);
263 if (IS_ERR(target)) {
264 request_module("%st_%s", xt_prefix[af], name);
265 target = xt_find_target(af, name, revision);
268 return target;
270 EXPORT_SYMBOL_GPL(xt_request_find_target);
273 static int xt_obj_to_user(u16 __user *psize, u16 size,
274 void __user *pname, const char *name,
275 u8 __user *prev, u8 rev)
277 if (put_user(size, psize))
278 return -EFAULT;
279 if (copy_to_user(pname, name, strlen(name) + 1))
280 return -EFAULT;
281 if (put_user(rev, prev))
282 return -EFAULT;
284 return 0;
287 #define XT_OBJ_TO_USER(U, K, TYPE, C_SIZE) \
288 xt_obj_to_user(&U->u.TYPE##_size, C_SIZE ? : K->u.TYPE##_size, \
289 U->u.user.name, K->u.kernel.TYPE->name, \
290 &U->u.user.revision, K->u.kernel.TYPE->revision)
292 int xt_data_to_user(void __user *dst, const void *src,
293 int usersize, int size, int aligned_size)
295 usersize = usersize ? : size;
296 if (copy_to_user(dst, src, usersize))
297 return -EFAULT;
298 if (usersize != aligned_size &&
299 clear_user(dst + usersize, aligned_size - usersize))
300 return -EFAULT;
302 return 0;
304 EXPORT_SYMBOL_GPL(xt_data_to_user);
306 #define XT_DATA_TO_USER(U, K, TYPE) \
307 xt_data_to_user(U->data, K->data, \
308 K->u.kernel.TYPE->usersize, \
309 K->u.kernel.TYPE->TYPE##size, \
310 XT_ALIGN(K->u.kernel.TYPE->TYPE##size))
312 int xt_match_to_user(const struct xt_entry_match *m,
313 struct xt_entry_match __user *u)
315 return XT_OBJ_TO_USER(u, m, match, 0) ||
316 XT_DATA_TO_USER(u, m, match);
318 EXPORT_SYMBOL_GPL(xt_match_to_user);
320 int xt_target_to_user(const struct xt_entry_target *t,
321 struct xt_entry_target __user *u)
323 return XT_OBJ_TO_USER(u, t, target, 0) ||
324 XT_DATA_TO_USER(u, t, target);
326 EXPORT_SYMBOL_GPL(xt_target_to_user);
328 static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
330 const struct xt_match *m;
331 int have_rev = 0;
333 list_for_each_entry(m, &xt[af].match, list) {
334 if (strcmp(m->name, name) == 0) {
335 if (m->revision > *bestp)
336 *bestp = m->revision;
337 if (m->revision == revision)
338 have_rev = 1;
342 if (af != NFPROTO_UNSPEC && !have_rev)
343 return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
345 return have_rev;
348 static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
350 const struct xt_target *t;
351 int have_rev = 0;
353 list_for_each_entry(t, &xt[af].target, list) {
354 if (strcmp(t->name, name) == 0) {
355 if (t->revision > *bestp)
356 *bestp = t->revision;
357 if (t->revision == revision)
358 have_rev = 1;
362 if (af != NFPROTO_UNSPEC && !have_rev)
363 return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
365 return have_rev;
368 /* Returns true or false (if no such extension at all) */
369 int xt_find_revision(u8 af, const char *name, u8 revision, int target,
370 int *err)
372 int have_rev, best = -1;
374 mutex_lock(&xt[af].mutex);
375 if (target == 1)
376 have_rev = target_revfn(af, name, revision, &best);
377 else
378 have_rev = match_revfn(af, name, revision, &best);
379 mutex_unlock(&xt[af].mutex);
381 /* Nothing at all? Return 0 to try loading module. */
382 if (best == -1) {
383 *err = -ENOENT;
384 return 0;
387 *err = best;
388 if (!have_rev)
389 *err = -EPROTONOSUPPORT;
390 return 1;
392 EXPORT_SYMBOL_GPL(xt_find_revision);
394 static char *
395 textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
397 static const char *const inetbr_names[] = {
398 "PREROUTING", "INPUT", "FORWARD",
399 "OUTPUT", "POSTROUTING", "BROUTING",
401 static const char *const arp_names[] = {
402 "INPUT", "FORWARD", "OUTPUT",
404 const char *const *names;
405 unsigned int i, max;
406 char *p = buf;
407 bool np = false;
408 int res;
410 names = (nfproto == NFPROTO_ARP) ? arp_names : inetbr_names;
411 max = (nfproto == NFPROTO_ARP) ? ARRAY_SIZE(arp_names) :
412 ARRAY_SIZE(inetbr_names);
413 *p = '\0';
414 for (i = 0; i < max; ++i) {
415 if (!(mask & (1 << i)))
416 continue;
417 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);
418 if (res > 0) {
419 size -= res;
420 p += res;
422 np = true;
425 return buf;
429 * xt_check_proc_name - check that name is suitable for /proc file creation
431 * @name: file name candidate
432 * @size: length of buffer
434 * some x_tables modules wish to create a file in /proc.
435 * This function makes sure that the name is suitable for this
436 * purpose, it checks that name is NUL terminated and isn't a 'special'
437 * name, like "..".
439 * returns negative number on error or 0 if name is useable.
441 int xt_check_proc_name(const char *name, unsigned int size)
443 if (name[0] == '\0')
444 return -EINVAL;
446 if (strnlen(name, size) == size)
447 return -ENAMETOOLONG;
449 if (strcmp(name, ".") == 0 ||
450 strcmp(name, "..") == 0 ||
451 strchr(name, '/'))
452 return -EINVAL;
454 return 0;
456 EXPORT_SYMBOL(xt_check_proc_name);
458 int xt_check_match(struct xt_mtchk_param *par,
459 unsigned int size, u16 proto, bool inv_proto)
461 int ret;
463 if (XT_ALIGN(par->match->matchsize) != size &&
464 par->match->matchsize != -1) {
466 * ebt_among is exempt from centralized matchsize checking
467 * because it uses a dynamic-size data set.
469 pr_err_ratelimited("%s_tables: %s.%u match: invalid size %u (kernel) != (user) %u\n",
470 xt_prefix[par->family], par->match->name,
471 par->match->revision,
472 XT_ALIGN(par->match->matchsize), size);
473 return -EINVAL;
475 if (par->match->table != NULL &&
476 strcmp(par->match->table, par->table) != 0) {
477 pr_info_ratelimited("%s_tables: %s match: only valid in %s table, not %s\n",
478 xt_prefix[par->family], par->match->name,
479 par->match->table, par->table);
480 return -EINVAL;
482 if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
483 char used[64], allow[64];
485 pr_info_ratelimited("%s_tables: %s match: used from hooks %s, but only valid from %s\n",
486 xt_prefix[par->family], par->match->name,
487 textify_hooks(used, sizeof(used),
488 par->hook_mask, par->family),
489 textify_hooks(allow, sizeof(allow),
490 par->match->hooks,
491 par->family));
492 return -EINVAL;
494 if (par->match->proto && (par->match->proto != proto || inv_proto)) {
495 pr_info_ratelimited("%s_tables: %s match: only valid for protocol %u\n",
496 xt_prefix[par->family], par->match->name,
497 par->match->proto);
498 return -EINVAL;
500 if (par->match->checkentry != NULL) {
501 ret = par->match->checkentry(par);
502 if (ret < 0)
503 return ret;
504 else if (ret > 0)
505 /* Flag up potential errors. */
506 return -EIO;
508 return 0;
510 EXPORT_SYMBOL_GPL(xt_check_match);
512 /** xt_check_entry_match - check that matches end before start of target
514 * @match: beginning of xt_entry_match
515 * @target: beginning of this rules target (alleged end of matches)
516 * @alignment: alignment requirement of match structures
518 * Validates that all matches add up to the beginning of the target,
519 * and that each match covers at least the base structure size.
521 * Return: 0 on success, negative errno on failure.
523 static int xt_check_entry_match(const char *match, const char *target,
524 const size_t alignment)
526 const struct xt_entry_match *pos;
527 int length = target - match;
529 if (length == 0) /* no matches */
530 return 0;
532 pos = (struct xt_entry_match *)match;
533 do {
534 if ((unsigned long)pos % alignment)
535 return -EINVAL;
537 if (length < (int)sizeof(struct xt_entry_match))
538 return -EINVAL;
540 if (pos->u.match_size < sizeof(struct xt_entry_match))
541 return -EINVAL;
543 if (pos->u.match_size > length)
544 return -EINVAL;
546 length -= pos->u.match_size;
547 pos = ((void *)((char *)(pos) + (pos)->u.match_size));
548 } while (length > 0);
550 return 0;
553 /** xt_check_table_hooks - check hook entry points are sane
555 * @info xt_table_info to check
556 * @valid_hooks - hook entry points that we can enter from
558 * Validates that the hook entry and underflows points are set up.
560 * Return: 0 on success, negative errno on failure.
562 int xt_check_table_hooks(const struct xt_table_info *info, unsigned int valid_hooks)
564 const char *err = "unsorted underflow";
565 unsigned int i, max_uflow, max_entry;
566 bool check_hooks = false;
568 BUILD_BUG_ON(ARRAY_SIZE(info->hook_entry) != ARRAY_SIZE(info->underflow));
570 max_entry = 0;
571 max_uflow = 0;
573 for (i = 0; i < ARRAY_SIZE(info->hook_entry); i++) {
574 if (!(valid_hooks & (1 << i)))
575 continue;
577 if (info->hook_entry[i] == 0xFFFFFFFF)
578 return -EINVAL;
579 if (info->underflow[i] == 0xFFFFFFFF)
580 return -EINVAL;
582 if (check_hooks) {
583 if (max_uflow > info->underflow[i])
584 goto error;
586 if (max_uflow == info->underflow[i]) {
587 err = "duplicate underflow";
588 goto error;
590 if (max_entry > info->hook_entry[i]) {
591 err = "unsorted entry";
592 goto error;
594 if (max_entry == info->hook_entry[i]) {
595 err = "duplicate entry";
596 goto error;
599 max_entry = info->hook_entry[i];
600 max_uflow = info->underflow[i];
601 check_hooks = true;
604 return 0;
605 error:
606 pr_err_ratelimited("%s at hook %d\n", err, i);
607 return -EINVAL;
609 EXPORT_SYMBOL(xt_check_table_hooks);
611 static bool verdict_ok(int verdict)
613 if (verdict > 0)
614 return true;
616 if (verdict < 0) {
617 int v = -verdict - 1;
619 if (verdict == XT_RETURN)
620 return true;
622 switch (v) {
623 case NF_ACCEPT: return true;
624 case NF_DROP: return true;
625 case NF_QUEUE: return true;
626 default:
627 break;
630 return false;
633 return false;
636 static bool error_tg_ok(unsigned int usersize, unsigned int kernsize,
637 const char *msg, unsigned int msglen)
639 return usersize == kernsize && strnlen(msg, msglen) < msglen;
642 #ifdef CONFIG_COMPAT
643 int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta)
645 struct xt_af *xp = &xt[af];
647 WARN_ON(!mutex_is_locked(&xt[af].compat_mutex));
649 if (WARN_ON(!xp->compat_tab))
650 return -ENOMEM;
652 if (xp->cur >= xp->number)
653 return -EINVAL;
655 if (xp->cur)
656 delta += xp->compat_tab[xp->cur - 1].delta;
657 xp->compat_tab[xp->cur].offset = offset;
658 xp->compat_tab[xp->cur].delta = delta;
659 xp->cur++;
660 return 0;
662 EXPORT_SYMBOL_GPL(xt_compat_add_offset);
664 void xt_compat_flush_offsets(u_int8_t af)
666 WARN_ON(!mutex_is_locked(&xt[af].compat_mutex));
668 if (xt[af].compat_tab) {
669 vfree(xt[af].compat_tab);
670 xt[af].compat_tab = NULL;
671 xt[af].number = 0;
672 xt[af].cur = 0;
675 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
677 int xt_compat_calc_jump(u_int8_t af, unsigned int offset)
679 struct compat_delta *tmp = xt[af].compat_tab;
680 int mid, left = 0, right = xt[af].cur - 1;
682 while (left <= right) {
683 mid = (left + right) >> 1;
684 if (offset > tmp[mid].offset)
685 left = mid + 1;
686 else if (offset < tmp[mid].offset)
687 right = mid - 1;
688 else
689 return mid ? tmp[mid - 1].delta : 0;
691 return left ? tmp[left - 1].delta : 0;
693 EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
695 int xt_compat_init_offsets(u8 af, unsigned int number)
697 size_t mem;
699 WARN_ON(!mutex_is_locked(&xt[af].compat_mutex));
701 if (!number || number > (INT_MAX / sizeof(struct compat_delta)))
702 return -EINVAL;
704 if (WARN_ON(xt[af].compat_tab))
705 return -EINVAL;
707 mem = sizeof(struct compat_delta) * number;
708 if (mem > XT_MAX_TABLE_SIZE)
709 return -ENOMEM;
711 xt[af].compat_tab = vmalloc(mem);
712 if (!xt[af].compat_tab)
713 return -ENOMEM;
715 xt[af].number = number;
716 xt[af].cur = 0;
718 return 0;
720 EXPORT_SYMBOL(xt_compat_init_offsets);
722 int xt_compat_match_offset(const struct xt_match *match)
724 u_int16_t csize = match->compatsize ? : match->matchsize;
725 return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize);
727 EXPORT_SYMBOL_GPL(xt_compat_match_offset);
729 void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
730 unsigned int *size)
732 const struct xt_match *match = m->u.kernel.match;
733 struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
734 int pad, off = xt_compat_match_offset(match);
735 u_int16_t msize = cm->u.user.match_size;
736 char name[sizeof(m->u.user.name)];
738 m = *dstptr;
739 memcpy(m, cm, sizeof(*cm));
740 if (match->compat_from_user)
741 match->compat_from_user(m->data, cm->data);
742 else
743 memcpy(m->data, cm->data, msize - sizeof(*cm));
744 pad = XT_ALIGN(match->matchsize) - match->matchsize;
745 if (pad > 0)
746 memset(m->data + match->matchsize, 0, pad);
748 msize += off;
749 m->u.user.match_size = msize;
750 strlcpy(name, match->name, sizeof(name));
751 module_put(match->me);
752 strncpy(m->u.user.name, name, sizeof(m->u.user.name));
754 *size += off;
755 *dstptr += msize;
757 EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
759 #define COMPAT_XT_DATA_TO_USER(U, K, TYPE, C_SIZE) \
760 xt_data_to_user(U->data, K->data, \
761 K->u.kernel.TYPE->usersize, \
762 C_SIZE, \
763 COMPAT_XT_ALIGN(C_SIZE))
765 int xt_compat_match_to_user(const struct xt_entry_match *m,
766 void __user **dstptr, unsigned int *size)
768 const struct xt_match *match = m->u.kernel.match;
769 struct compat_xt_entry_match __user *cm = *dstptr;
770 int off = xt_compat_match_offset(match);
771 u_int16_t msize = m->u.user.match_size - off;
773 if (XT_OBJ_TO_USER(cm, m, match, msize))
774 return -EFAULT;
776 if (match->compat_to_user) {
777 if (match->compat_to_user((void __user *)cm->data, m->data))
778 return -EFAULT;
779 } else {
780 if (COMPAT_XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
781 return -EFAULT;
784 *size -= off;
785 *dstptr += msize;
786 return 0;
788 EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
790 /* non-compat version may have padding after verdict */
791 struct compat_xt_standard_target {
792 struct compat_xt_entry_target t;
793 compat_uint_t verdict;
796 struct compat_xt_error_target {
797 struct compat_xt_entry_target t;
798 char errorname[XT_FUNCTION_MAXNAMELEN];
801 int xt_compat_check_entry_offsets(const void *base, const char *elems,
802 unsigned int target_offset,
803 unsigned int next_offset)
805 long size_of_base_struct = elems - (const char *)base;
806 const struct compat_xt_entry_target *t;
807 const char *e = base;
809 if (target_offset < size_of_base_struct)
810 return -EINVAL;
812 if (target_offset + sizeof(*t) > next_offset)
813 return -EINVAL;
815 t = (void *)(e + target_offset);
816 if (t->u.target_size < sizeof(*t))
817 return -EINVAL;
819 if (target_offset + t->u.target_size > next_offset)
820 return -EINVAL;
822 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0) {
823 const struct compat_xt_standard_target *st = (const void *)t;
825 if (COMPAT_XT_ALIGN(target_offset + sizeof(*st)) != next_offset)
826 return -EINVAL;
828 if (!verdict_ok(st->verdict))
829 return -EINVAL;
830 } else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
831 const struct compat_xt_error_target *et = (const void *)t;
833 if (!error_tg_ok(t->u.target_size, sizeof(*et),
834 et->errorname, sizeof(et->errorname)))
835 return -EINVAL;
838 /* compat_xt_entry match has less strict alignment requirements,
839 * otherwise they are identical. In case of padding differences
840 * we need to add compat version of xt_check_entry_match.
842 BUILD_BUG_ON(sizeof(struct compat_xt_entry_match) != sizeof(struct xt_entry_match));
844 return xt_check_entry_match(elems, base + target_offset,
845 __alignof__(struct compat_xt_entry_match));
847 EXPORT_SYMBOL(xt_compat_check_entry_offsets);
848 #endif /* CONFIG_COMPAT */
851 * xt_check_entry_offsets - validate arp/ip/ip6t_entry
853 * @base: pointer to arp/ip/ip6t_entry
854 * @elems: pointer to first xt_entry_match, i.e. ip(6)t_entry->elems
855 * @target_offset: the arp/ip/ip6_t->target_offset
856 * @next_offset: the arp/ip/ip6_t->next_offset
858 * validates that target_offset and next_offset are sane and that all
859 * match sizes (if any) align with the target offset.
861 * This function does not validate the targets or matches themselves, it
862 * only tests that all the offsets and sizes are correct, that all
863 * match structures are aligned, and that the last structure ends where
864 * the target structure begins.
866 * Also see xt_compat_check_entry_offsets for CONFIG_COMPAT version.
868 * The arp/ip/ip6t_entry structure @base must have passed following tests:
869 * - it must point to a valid memory location
870 * - base to base + next_offset must be accessible, i.e. not exceed allocated
871 * length.
873 * A well-formed entry looks like this:
875 * ip(6)t_entry match [mtdata] match [mtdata] target [tgdata] ip(6)t_entry
876 * e->elems[]-----' | |
877 * matchsize | |
878 * matchsize | |
879 * | |
880 * target_offset---------------------------------' |
881 * next_offset---------------------------------------------------'
883 * elems[]: flexible array member at end of ip(6)/arpt_entry struct.
884 * This is where matches (if any) and the target reside.
885 * target_offset: beginning of target.
886 * next_offset: start of the next rule; also: size of this rule.
887 * Since targets have a minimum size, target_offset + minlen <= next_offset.
889 * Every match stores its size, sum of sizes must not exceed target_offset.
891 * Return: 0 on success, negative errno on failure.
893 int xt_check_entry_offsets(const void *base,
894 const char *elems,
895 unsigned int target_offset,
896 unsigned int next_offset)
898 long size_of_base_struct = elems - (const char *)base;
899 const struct xt_entry_target *t;
900 const char *e = base;
902 /* target start is within the ip/ip6/arpt_entry struct */
903 if (target_offset < size_of_base_struct)
904 return -EINVAL;
906 if (target_offset + sizeof(*t) > next_offset)
907 return -EINVAL;
909 t = (void *)(e + target_offset);
910 if (t->u.target_size < sizeof(*t))
911 return -EINVAL;
913 if (target_offset + t->u.target_size > next_offset)
914 return -EINVAL;
916 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0) {
917 const struct xt_standard_target *st = (const void *)t;
919 if (XT_ALIGN(target_offset + sizeof(*st)) != next_offset)
920 return -EINVAL;
922 if (!verdict_ok(st->verdict))
923 return -EINVAL;
924 } else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0) {
925 const struct xt_error_target *et = (const void *)t;
927 if (!error_tg_ok(t->u.target_size, sizeof(*et),
928 et->errorname, sizeof(et->errorname)))
929 return -EINVAL;
932 return xt_check_entry_match(elems, base + target_offset,
933 __alignof__(struct xt_entry_match));
935 EXPORT_SYMBOL(xt_check_entry_offsets);
938 * xt_alloc_entry_offsets - allocate array to store rule head offsets
940 * @size: number of entries
942 * Return: NULL or zeroed kmalloc'd or vmalloc'd array
944 unsigned int *xt_alloc_entry_offsets(unsigned int size)
946 if (size > XT_MAX_TABLE_SIZE / sizeof(unsigned int))
947 return NULL;
949 return kvcalloc(size, sizeof(unsigned int), GFP_KERNEL);
952 EXPORT_SYMBOL(xt_alloc_entry_offsets);
955 * xt_find_jump_offset - check if target is a valid jump offset
957 * @offsets: array containing all valid rule start offsets of a rule blob
958 * @target: the jump target to search for
959 * @size: entries in @offset
961 bool xt_find_jump_offset(const unsigned int *offsets,
962 unsigned int target, unsigned int size)
964 int m, low = 0, hi = size;
966 while (hi > low) {
967 m = (low + hi) / 2u;
969 if (offsets[m] > target)
970 hi = m;
971 else if (offsets[m] < target)
972 low = m + 1;
973 else
974 return true;
977 return false;
979 EXPORT_SYMBOL(xt_find_jump_offset);
981 int xt_check_target(struct xt_tgchk_param *par,
982 unsigned int size, u16 proto, bool inv_proto)
984 int ret;
986 if (XT_ALIGN(par->target->targetsize) != size) {
987 pr_err_ratelimited("%s_tables: %s.%u target: invalid size %u (kernel) != (user) %u\n",
988 xt_prefix[par->family], par->target->name,
989 par->target->revision,
990 XT_ALIGN(par->target->targetsize), size);
991 return -EINVAL;
993 if (par->target->table != NULL &&
994 strcmp(par->target->table, par->table) != 0) {
995 pr_info_ratelimited("%s_tables: %s target: only valid in %s table, not %s\n",
996 xt_prefix[par->family], par->target->name,
997 par->target->table, par->table);
998 return -EINVAL;
1000 if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
1001 char used[64], allow[64];
1003 pr_info_ratelimited("%s_tables: %s target: used from hooks %s, but only usable from %s\n",
1004 xt_prefix[par->family], par->target->name,
1005 textify_hooks(used, sizeof(used),
1006 par->hook_mask, par->family),
1007 textify_hooks(allow, sizeof(allow),
1008 par->target->hooks,
1009 par->family));
1010 return -EINVAL;
1012 if (par->target->proto && (par->target->proto != proto || inv_proto)) {
1013 pr_info_ratelimited("%s_tables: %s target: only valid for protocol %u\n",
1014 xt_prefix[par->family], par->target->name,
1015 par->target->proto);
1016 return -EINVAL;
1018 if (par->target->checkentry != NULL) {
1019 ret = par->target->checkentry(par);
1020 if (ret < 0)
1021 return ret;
1022 else if (ret > 0)
1023 /* Flag up potential errors. */
1024 return -EIO;
1026 return 0;
1028 EXPORT_SYMBOL_GPL(xt_check_target);
1031 * xt_copy_counters - copy counters and metadata from a sockptr_t
1033 * @arg: src sockptr
1034 * @len: alleged size of userspace memory
1035 * @info: where to store the xt_counters_info metadata
1037 * Copies counter meta data from @user and stores it in @info.
1039 * vmallocs memory to hold the counters, then copies the counter data
1040 * from @user to the new memory and returns a pointer to it.
1042 * If called from a compat syscall, @info gets converted automatically to the
1043 * 64bit representation.
1045 * The metadata associated with the counters is stored in @info.
1047 * Return: returns pointer that caller has to test via IS_ERR().
1048 * If IS_ERR is false, caller has to vfree the pointer.
1050 void *xt_copy_counters(sockptr_t arg, unsigned int len,
1051 struct xt_counters_info *info)
1053 size_t offset;
1054 void *mem;
1055 u64 size;
1057 #ifdef CONFIG_COMPAT
1058 if (in_compat_syscall()) {
1059 /* structures only differ in size due to alignment */
1060 struct compat_xt_counters_info compat_tmp;
1062 if (len <= sizeof(compat_tmp))
1063 return ERR_PTR(-EINVAL);
1065 len -= sizeof(compat_tmp);
1066 if (copy_from_sockptr(&compat_tmp, arg, sizeof(compat_tmp)) != 0)
1067 return ERR_PTR(-EFAULT);
1069 memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
1070 info->num_counters = compat_tmp.num_counters;
1071 offset = sizeof(compat_tmp);
1072 } else
1073 #endif
1075 if (len <= sizeof(*info))
1076 return ERR_PTR(-EINVAL);
1078 len -= sizeof(*info);
1079 if (copy_from_sockptr(info, arg, sizeof(*info)) != 0)
1080 return ERR_PTR(-EFAULT);
1082 offset = sizeof(*info);
1084 info->name[sizeof(info->name) - 1] = '\0';
1086 size = sizeof(struct xt_counters);
1087 size *= info->num_counters;
1089 if (size != (u64)len)
1090 return ERR_PTR(-EINVAL);
1092 mem = vmalloc(len);
1093 if (!mem)
1094 return ERR_PTR(-ENOMEM);
1096 if (copy_from_sockptr_offset(mem, arg, offset, len) == 0)
1097 return mem;
1099 vfree(mem);
1100 return ERR_PTR(-EFAULT);
1102 EXPORT_SYMBOL_GPL(xt_copy_counters);
1104 #ifdef CONFIG_COMPAT
1105 int xt_compat_target_offset(const struct xt_target *target)
1107 u_int16_t csize = target->compatsize ? : target->targetsize;
1108 return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize);
1110 EXPORT_SYMBOL_GPL(xt_compat_target_offset);
1112 void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
1113 unsigned int *size)
1115 const struct xt_target *target = t->u.kernel.target;
1116 struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
1117 int pad, off = xt_compat_target_offset(target);
1118 u_int16_t tsize = ct->u.user.target_size;
1119 char name[sizeof(t->u.user.name)];
1121 t = *dstptr;
1122 memcpy(t, ct, sizeof(*ct));
1123 if (target->compat_from_user)
1124 target->compat_from_user(t->data, ct->data);
1125 else
1126 memcpy(t->data, ct->data, tsize - sizeof(*ct));
1127 pad = XT_ALIGN(target->targetsize) - target->targetsize;
1128 if (pad > 0)
1129 memset(t->data + target->targetsize, 0, pad);
1131 tsize += off;
1132 t->u.user.target_size = tsize;
1133 strlcpy(name, target->name, sizeof(name));
1134 module_put(target->me);
1135 strncpy(t->u.user.name, name, sizeof(t->u.user.name));
1137 *size += off;
1138 *dstptr += tsize;
1140 EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
1142 int xt_compat_target_to_user(const struct xt_entry_target *t,
1143 void __user **dstptr, unsigned int *size)
1145 const struct xt_target *target = t->u.kernel.target;
1146 struct compat_xt_entry_target __user *ct = *dstptr;
1147 int off = xt_compat_target_offset(target);
1148 u_int16_t tsize = t->u.user.target_size - off;
1150 if (XT_OBJ_TO_USER(ct, t, target, tsize))
1151 return -EFAULT;
1153 if (target->compat_to_user) {
1154 if (target->compat_to_user((void __user *)ct->data, t->data))
1155 return -EFAULT;
1156 } else {
1157 if (COMPAT_XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
1158 return -EFAULT;
1161 *size -= off;
1162 *dstptr += tsize;
1163 return 0;
1165 EXPORT_SYMBOL_GPL(xt_compat_target_to_user);
1166 #endif
1168 struct xt_table_info *xt_alloc_table_info(unsigned int size)
1170 struct xt_table_info *info = NULL;
1171 size_t sz = sizeof(*info) + size;
1173 if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE)
1174 return NULL;
1176 info = kvmalloc(sz, GFP_KERNEL_ACCOUNT);
1177 if (!info)
1178 return NULL;
1180 memset(info, 0, sizeof(*info));
1181 info->size = size;
1182 return info;
1184 EXPORT_SYMBOL(xt_alloc_table_info);
1186 void xt_free_table_info(struct xt_table_info *info)
1188 int cpu;
1190 if (info->jumpstack != NULL) {
1191 for_each_possible_cpu(cpu)
1192 kvfree(info->jumpstack[cpu]);
1193 kvfree(info->jumpstack);
1196 kvfree(info);
1198 EXPORT_SYMBOL(xt_free_table_info);
1200 /* Find table by name, grabs mutex & ref. Returns ERR_PTR on error. */
1201 struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af,
1202 const char *name)
1204 struct xt_table *t, *found = NULL;
1206 mutex_lock(&xt[af].mutex);
1207 list_for_each_entry(t, &net->xt.tables[af], list)
1208 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
1209 return t;
1211 if (net == &init_net)
1212 goto out;
1214 /* Table doesn't exist in this netns, re-try init */
1215 list_for_each_entry(t, &init_net.xt.tables[af], list) {
1216 int err;
1218 if (strcmp(t->name, name))
1219 continue;
1220 if (!try_module_get(t->me))
1221 goto out;
1222 mutex_unlock(&xt[af].mutex);
1223 err = t->table_init(net);
1224 if (err < 0) {
1225 module_put(t->me);
1226 return ERR_PTR(err);
1229 found = t;
1231 mutex_lock(&xt[af].mutex);
1232 break;
1235 if (!found)
1236 goto out;
1238 /* and once again: */
1239 list_for_each_entry(t, &net->xt.tables[af], list)
1240 if (strcmp(t->name, name) == 0)
1241 return t;
1243 module_put(found->me);
1244 out:
1245 mutex_unlock(&xt[af].mutex);
1246 return ERR_PTR(-ENOENT);
1248 EXPORT_SYMBOL_GPL(xt_find_table_lock);
1250 struct xt_table *xt_request_find_table_lock(struct net *net, u_int8_t af,
1251 const char *name)
1253 struct xt_table *t = xt_find_table_lock(net, af, name);
1255 #ifdef CONFIG_MODULES
1256 if (IS_ERR(t)) {
1257 int err = request_module("%stable_%s", xt_prefix[af], name);
1258 if (err < 0)
1259 return ERR_PTR(err);
1260 t = xt_find_table_lock(net, af, name);
1262 #endif
1264 return t;
1266 EXPORT_SYMBOL_GPL(xt_request_find_table_lock);
1268 void xt_table_unlock(struct xt_table *table)
1270 mutex_unlock(&xt[table->af].mutex);
1272 EXPORT_SYMBOL_GPL(xt_table_unlock);
1274 #ifdef CONFIG_COMPAT
1275 void xt_compat_lock(u_int8_t af)
1277 mutex_lock(&xt[af].compat_mutex);
1279 EXPORT_SYMBOL_GPL(xt_compat_lock);
1281 void xt_compat_unlock(u_int8_t af)
1283 mutex_unlock(&xt[af].compat_mutex);
1285 EXPORT_SYMBOL_GPL(xt_compat_unlock);
1286 #endif
1288 DEFINE_PER_CPU(seqcount_t, xt_recseq);
1289 EXPORT_PER_CPU_SYMBOL_GPL(xt_recseq);
1291 struct static_key xt_tee_enabled __read_mostly;
1292 EXPORT_SYMBOL_GPL(xt_tee_enabled);
1294 static int xt_jumpstack_alloc(struct xt_table_info *i)
1296 unsigned int size;
1297 int cpu;
1299 size = sizeof(void **) * nr_cpu_ids;
1300 if (size > PAGE_SIZE)
1301 i->jumpstack = kvzalloc(size, GFP_KERNEL);
1302 else
1303 i->jumpstack = kzalloc(size, GFP_KERNEL);
1304 if (i->jumpstack == NULL)
1305 return -ENOMEM;
1307 /* ruleset without jumps -- no stack needed */
1308 if (i->stacksize == 0)
1309 return 0;
1311 /* Jumpstack needs to be able to record two full callchains, one
1312 * from the first rule set traversal, plus one table reentrancy
1313 * via -j TEE without clobbering the callchain that brought us to
1314 * TEE target.
1316 * This is done by allocating two jumpstacks per cpu, on reentry
1317 * the upper half of the stack is used.
1319 * see the jumpstack setup in ipt_do_table() for more details.
1321 size = sizeof(void *) * i->stacksize * 2u;
1322 for_each_possible_cpu(cpu) {
1323 i->jumpstack[cpu] = kvmalloc_node(size, GFP_KERNEL,
1324 cpu_to_node(cpu));
1325 if (i->jumpstack[cpu] == NULL)
1327 * Freeing will be done later on by the callers. The
1328 * chain is: xt_replace_table -> __do_replace ->
1329 * do_replace -> xt_free_table_info.
1331 return -ENOMEM;
1334 return 0;
1337 struct xt_counters *xt_counters_alloc(unsigned int counters)
1339 struct xt_counters *mem;
1341 if (counters == 0 || counters > INT_MAX / sizeof(*mem))
1342 return NULL;
1344 counters *= sizeof(*mem);
1345 if (counters > XT_MAX_TABLE_SIZE)
1346 return NULL;
1348 return vzalloc(counters);
1350 EXPORT_SYMBOL(xt_counters_alloc);
1352 struct xt_table_info
1353 *xt_table_get_private_protected(const struct xt_table *table)
1355 return rcu_dereference_protected(table->private,
1356 mutex_is_locked(&xt[table->af].mutex));
1358 EXPORT_SYMBOL(xt_table_get_private_protected);
1360 struct xt_table_info *
1361 xt_replace_table(struct xt_table *table,
1362 unsigned int num_counters,
1363 struct xt_table_info *newinfo,
1364 int *error)
1366 struct xt_table_info *private;
1367 int ret;
1369 ret = xt_jumpstack_alloc(newinfo);
1370 if (ret < 0) {
1371 *error = ret;
1372 return NULL;
1375 /* Do the substitution. */
1376 private = xt_table_get_private_protected(table);
1378 /* Check inside lock: is the old number correct? */
1379 if (num_counters != private->number) {
1380 pr_debug("num_counters != table->private->number (%u/%u)\n",
1381 num_counters, private->number);
1382 *error = -EAGAIN;
1383 return NULL;
1386 newinfo->initial_entries = private->initial_entries;
1388 rcu_assign_pointer(table->private, newinfo);
1389 synchronize_rcu();
1391 audit_log_nfcfg(table->name, table->af, private->number,
1392 !private->number ? AUDIT_XT_OP_REGISTER :
1393 AUDIT_XT_OP_REPLACE,
1394 GFP_KERNEL);
1395 return private;
1397 EXPORT_SYMBOL_GPL(xt_replace_table);
1399 struct xt_table *xt_register_table(struct net *net,
1400 const struct xt_table *input_table,
1401 struct xt_table_info *bootstrap,
1402 struct xt_table_info *newinfo)
1404 int ret;
1405 struct xt_table_info *private;
1406 struct xt_table *t, *table;
1408 /* Don't add one object to multiple lists. */
1409 table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);
1410 if (!table) {
1411 ret = -ENOMEM;
1412 goto out;
1415 mutex_lock(&xt[table->af].mutex);
1416 /* Don't autoload: we'd eat our tail... */
1417 list_for_each_entry(t, &net->xt.tables[table->af], list) {
1418 if (strcmp(t->name, table->name) == 0) {
1419 ret = -EEXIST;
1420 goto unlock;
1424 /* Simplifies replace_table code. */
1425 rcu_assign_pointer(table->private, bootstrap);
1427 if (!xt_replace_table(table, 0, newinfo, &ret))
1428 goto unlock;
1430 private = xt_table_get_private_protected(table);
1431 pr_debug("table->private->number = %u\n", private->number);
1433 /* save number of initial entries */
1434 private->initial_entries = private->number;
1436 list_add(&table->list, &net->xt.tables[table->af]);
1437 mutex_unlock(&xt[table->af].mutex);
1438 return table;
1440 unlock:
1441 mutex_unlock(&xt[table->af].mutex);
1442 kfree(table);
1443 out:
1444 return ERR_PTR(ret);
1446 EXPORT_SYMBOL_GPL(xt_register_table);
1448 void *xt_unregister_table(struct xt_table *table)
1450 struct xt_table_info *private;
1452 mutex_lock(&xt[table->af].mutex);
1453 private = xt_table_get_private_protected(table);
1454 RCU_INIT_POINTER(table->private, NULL);
1455 list_del(&table->list);
1456 mutex_unlock(&xt[table->af].mutex);
1457 audit_log_nfcfg(table->name, table->af, private->number,
1458 AUDIT_XT_OP_UNREGISTER, GFP_KERNEL);
1459 kfree(table);
1461 return private;
1463 EXPORT_SYMBOL_GPL(xt_unregister_table);
1465 #ifdef CONFIG_PROC_FS
1466 static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
1468 struct net *net = seq_file_net(seq);
1469 u_int8_t af = (unsigned long)PDE_DATA(file_inode(seq->file));
1471 mutex_lock(&xt[af].mutex);
1472 return seq_list_start(&net->xt.tables[af], *pos);
1475 static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1477 struct net *net = seq_file_net(seq);
1478 u_int8_t af = (unsigned long)PDE_DATA(file_inode(seq->file));
1480 return seq_list_next(v, &net->xt.tables[af], pos);
1483 static void xt_table_seq_stop(struct seq_file *seq, void *v)
1485 u_int8_t af = (unsigned long)PDE_DATA(file_inode(seq->file));
1487 mutex_unlock(&xt[af].mutex);
1490 static int xt_table_seq_show(struct seq_file *seq, void *v)
1492 struct xt_table *table = list_entry(v, struct xt_table, list);
1494 if (*table->name)
1495 seq_printf(seq, "%s\n", table->name);
1496 return 0;
1499 static const struct seq_operations xt_table_seq_ops = {
1500 .start = xt_table_seq_start,
1501 .next = xt_table_seq_next,
1502 .stop = xt_table_seq_stop,
1503 .show = xt_table_seq_show,
1507 * Traverse state for ip{,6}_{tables,matches} for helping crossing
1508 * the multi-AF mutexes.
1510 struct nf_mttg_trav {
1511 struct list_head *head, *curr;
1512 uint8_t class;
1515 enum {
1516 MTTG_TRAV_INIT,
1517 MTTG_TRAV_NFP_UNSPEC,
1518 MTTG_TRAV_NFP_SPEC,
1519 MTTG_TRAV_DONE,
1522 static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
1523 bool is_target)
1525 static const uint8_t next_class[] = {
1526 [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
1527 [MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE,
1529 uint8_t nfproto = (unsigned long)PDE_DATA(file_inode(seq->file));
1530 struct nf_mttg_trav *trav = seq->private;
1532 if (ppos != NULL)
1533 ++(*ppos);
1535 switch (trav->class) {
1536 case MTTG_TRAV_INIT:
1537 trav->class = MTTG_TRAV_NFP_UNSPEC;
1538 mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
1539 trav->head = trav->curr = is_target ?
1540 &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
1541 break;
1542 case MTTG_TRAV_NFP_UNSPEC:
1543 trav->curr = trav->curr->next;
1544 if (trav->curr != trav->head)
1545 break;
1546 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
1547 mutex_lock(&xt[nfproto].mutex);
1548 trav->head = trav->curr = is_target ?
1549 &xt[nfproto].target : &xt[nfproto].match;
1550 trav->class = next_class[trav->class];
1551 break;
1552 case MTTG_TRAV_NFP_SPEC:
1553 trav->curr = trav->curr->next;
1554 if (trav->curr != trav->head)
1555 break;
1556 fallthrough;
1557 default:
1558 return NULL;
1560 return trav;
1563 static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
1564 bool is_target)
1566 struct nf_mttg_trav *trav = seq->private;
1567 unsigned int j;
1569 trav->class = MTTG_TRAV_INIT;
1570 for (j = 0; j < *pos; ++j)
1571 if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
1572 return NULL;
1573 return trav;
1576 static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
1578 uint8_t nfproto = (unsigned long)PDE_DATA(file_inode(seq->file));
1579 struct nf_mttg_trav *trav = seq->private;
1581 switch (trav->class) {
1582 case MTTG_TRAV_NFP_UNSPEC:
1583 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
1584 break;
1585 case MTTG_TRAV_NFP_SPEC:
1586 mutex_unlock(&xt[nfproto].mutex);
1587 break;
1591 static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
1593 return xt_mttg_seq_start(seq, pos, false);
1596 static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
1598 return xt_mttg_seq_next(seq, v, ppos, false);
1601 static int xt_match_seq_show(struct seq_file *seq, void *v)
1603 const struct nf_mttg_trav *trav = seq->private;
1604 const struct xt_match *match;
1606 switch (trav->class) {
1607 case MTTG_TRAV_NFP_UNSPEC:
1608 case MTTG_TRAV_NFP_SPEC:
1609 if (trav->curr == trav->head)
1610 return 0;
1611 match = list_entry(trav->curr, struct xt_match, list);
1612 if (*match->name)
1613 seq_printf(seq, "%s\n", match->name);
1615 return 0;
1618 static const struct seq_operations xt_match_seq_ops = {
1619 .start = xt_match_seq_start,
1620 .next = xt_match_seq_next,
1621 .stop = xt_mttg_seq_stop,
1622 .show = xt_match_seq_show,
1625 static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
1627 return xt_mttg_seq_start(seq, pos, true);
1630 static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
1632 return xt_mttg_seq_next(seq, v, ppos, true);
1635 static int xt_target_seq_show(struct seq_file *seq, void *v)
1637 const struct nf_mttg_trav *trav = seq->private;
1638 const struct xt_target *target;
1640 switch (trav->class) {
1641 case MTTG_TRAV_NFP_UNSPEC:
1642 case MTTG_TRAV_NFP_SPEC:
1643 if (trav->curr == trav->head)
1644 return 0;
1645 target = list_entry(trav->curr, struct xt_target, list);
1646 if (*target->name)
1647 seq_printf(seq, "%s\n", target->name);
1649 return 0;
1652 static const struct seq_operations xt_target_seq_ops = {
1653 .start = xt_target_seq_start,
1654 .next = xt_target_seq_next,
1655 .stop = xt_mttg_seq_stop,
1656 .show = xt_target_seq_show,
1659 #define FORMAT_TABLES "_tables_names"
1660 #define FORMAT_MATCHES "_tables_matches"
1661 #define FORMAT_TARGETS "_tables_targets"
1663 #endif /* CONFIG_PROC_FS */
1666 * xt_hook_ops_alloc - set up hooks for a new table
1667 * @table: table with metadata needed to set up hooks
1668 * @fn: Hook function
1670 * This function will create the nf_hook_ops that the x_table needs
1671 * to hand to xt_hook_link_net().
1673 struct nf_hook_ops *
1674 xt_hook_ops_alloc(const struct xt_table *table, nf_hookfn *fn)
1676 unsigned int hook_mask = table->valid_hooks;
1677 uint8_t i, num_hooks = hweight32(hook_mask);
1678 uint8_t hooknum;
1679 struct nf_hook_ops *ops;
1681 if (!num_hooks)
1682 return ERR_PTR(-EINVAL);
1684 ops = kcalloc(num_hooks, sizeof(*ops), GFP_KERNEL);
1685 if (ops == NULL)
1686 return ERR_PTR(-ENOMEM);
1688 for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0;
1689 hook_mask >>= 1, ++hooknum) {
1690 if (!(hook_mask & 1))
1691 continue;
1692 ops[i].hook = fn;
1693 ops[i].pf = table->af;
1694 ops[i].hooknum = hooknum;
1695 ops[i].priority = table->priority;
1696 ++i;
1699 return ops;
1701 EXPORT_SYMBOL_GPL(xt_hook_ops_alloc);
1703 int xt_proto_init(struct net *net, u_int8_t af)
1705 #ifdef CONFIG_PROC_FS
1706 char buf[XT_FUNCTION_MAXNAMELEN];
1707 struct proc_dir_entry *proc;
1708 kuid_t root_uid;
1709 kgid_t root_gid;
1710 #endif
1712 if (af >= ARRAY_SIZE(xt_prefix))
1713 return -EINVAL;
1716 #ifdef CONFIG_PROC_FS
1717 root_uid = make_kuid(net->user_ns, 0);
1718 root_gid = make_kgid(net->user_ns, 0);
1720 strlcpy(buf, xt_prefix[af], sizeof(buf));
1721 strlcat(buf, FORMAT_TABLES, sizeof(buf));
1722 proc = proc_create_net_data(buf, 0440, net->proc_net, &xt_table_seq_ops,
1723 sizeof(struct seq_net_private),
1724 (void *)(unsigned long)af);
1725 if (!proc)
1726 goto out;
1727 if (uid_valid(root_uid) && gid_valid(root_gid))
1728 proc_set_user(proc, root_uid, root_gid);
1730 strlcpy(buf, xt_prefix[af], sizeof(buf));
1731 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1732 proc = proc_create_seq_private(buf, 0440, net->proc_net,
1733 &xt_match_seq_ops, sizeof(struct nf_mttg_trav),
1734 (void *)(unsigned long)af);
1735 if (!proc)
1736 goto out_remove_tables;
1737 if (uid_valid(root_uid) && gid_valid(root_gid))
1738 proc_set_user(proc, root_uid, root_gid);
1740 strlcpy(buf, xt_prefix[af], sizeof(buf));
1741 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
1742 proc = proc_create_seq_private(buf, 0440, net->proc_net,
1743 &xt_target_seq_ops, sizeof(struct nf_mttg_trav),
1744 (void *)(unsigned long)af);
1745 if (!proc)
1746 goto out_remove_matches;
1747 if (uid_valid(root_uid) && gid_valid(root_gid))
1748 proc_set_user(proc, root_uid, root_gid);
1749 #endif
1751 return 0;
1753 #ifdef CONFIG_PROC_FS
1754 out_remove_matches:
1755 strlcpy(buf, xt_prefix[af], sizeof(buf));
1756 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1757 remove_proc_entry(buf, net->proc_net);
1759 out_remove_tables:
1760 strlcpy(buf, xt_prefix[af], sizeof(buf));
1761 strlcat(buf, FORMAT_TABLES, sizeof(buf));
1762 remove_proc_entry(buf, net->proc_net);
1763 out:
1764 return -1;
1765 #endif
1767 EXPORT_SYMBOL_GPL(xt_proto_init);
1769 void xt_proto_fini(struct net *net, u_int8_t af)
1771 #ifdef CONFIG_PROC_FS
1772 char buf[XT_FUNCTION_MAXNAMELEN];
1774 strlcpy(buf, xt_prefix[af], sizeof(buf));
1775 strlcat(buf, FORMAT_TABLES, sizeof(buf));
1776 remove_proc_entry(buf, net->proc_net);
1778 strlcpy(buf, xt_prefix[af], sizeof(buf));
1779 strlcat(buf, FORMAT_TARGETS, sizeof(buf));
1780 remove_proc_entry(buf, net->proc_net);
1782 strlcpy(buf, xt_prefix[af], sizeof(buf));
1783 strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1784 remove_proc_entry(buf, net->proc_net);
1785 #endif /*CONFIG_PROC_FS*/
1787 EXPORT_SYMBOL_GPL(xt_proto_fini);
1790 * xt_percpu_counter_alloc - allocate x_tables rule counter
1792 * @state: pointer to xt_percpu allocation state
1793 * @counter: pointer to counter struct inside the ip(6)/arpt_entry struct
1795 * On SMP, the packet counter [ ip(6)t_entry->counters.pcnt ] will then
1796 * contain the address of the real (percpu) counter.
1798 * Rule evaluation needs to use xt_get_this_cpu_counter() helper
1799 * to fetch the real percpu counter.
1801 * To speed up allocation and improve data locality, a 4kb block is
1802 * allocated. Freeing any counter may free an entire block, so all
1803 * counters allocated using the same state must be freed at the same
1804 * time.
1806 * xt_percpu_counter_alloc_state contains the base address of the
1807 * allocated page and the current sub-offset.
1809 * returns false on error.
1811 bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state,
1812 struct xt_counters *counter)
1814 BUILD_BUG_ON(XT_PCPU_BLOCK_SIZE < (sizeof(*counter) * 2));
1816 if (nr_cpu_ids <= 1)
1817 return true;
1819 if (!state->mem) {
1820 state->mem = __alloc_percpu(XT_PCPU_BLOCK_SIZE,
1821 XT_PCPU_BLOCK_SIZE);
1822 if (!state->mem)
1823 return false;
1825 counter->pcnt = (__force unsigned long)(state->mem + state->off);
1826 state->off += sizeof(*counter);
1827 if (state->off > (XT_PCPU_BLOCK_SIZE - sizeof(*counter))) {
1828 state->mem = NULL;
1829 state->off = 0;
1831 return true;
1833 EXPORT_SYMBOL_GPL(xt_percpu_counter_alloc);
1835 void xt_percpu_counter_free(struct xt_counters *counters)
1837 unsigned long pcnt = counters->pcnt;
1839 if (nr_cpu_ids > 1 && (pcnt & (XT_PCPU_BLOCK_SIZE - 1)) == 0)
1840 free_percpu((void __percpu *)pcnt);
1842 EXPORT_SYMBOL_GPL(xt_percpu_counter_free);
1844 static int __net_init xt_net_init(struct net *net)
1846 int i;
1848 for (i = 0; i < NFPROTO_NUMPROTO; i++)
1849 INIT_LIST_HEAD(&net->xt.tables[i]);
1850 return 0;
1853 static void __net_exit xt_net_exit(struct net *net)
1855 int i;
1857 for (i = 0; i < NFPROTO_NUMPROTO; i++)
1858 WARN_ON_ONCE(!list_empty(&net->xt.tables[i]));
1861 static struct pernet_operations xt_net_ops = {
1862 .init = xt_net_init,
1863 .exit = xt_net_exit,
1866 static int __init xt_init(void)
1868 unsigned int i;
1869 int rv;
1871 for_each_possible_cpu(i) {
1872 seqcount_init(&per_cpu(xt_recseq, i));
1875 xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
1876 if (!xt)
1877 return -ENOMEM;
1879 for (i = 0; i < NFPROTO_NUMPROTO; i++) {
1880 mutex_init(&xt[i].mutex);
1881 #ifdef CONFIG_COMPAT
1882 mutex_init(&xt[i].compat_mutex);
1883 xt[i].compat_tab = NULL;
1884 #endif
1885 INIT_LIST_HEAD(&xt[i].target);
1886 INIT_LIST_HEAD(&xt[i].match);
1888 rv = register_pernet_subsys(&xt_net_ops);
1889 if (rv < 0)
1890 kfree(xt);
1891 return rv;
1894 static void __exit xt_fini(void)
1896 unregister_pernet_subsys(&xt_net_ops);
1897 kfree(xt);
1900 module_init(xt_init);
1901 module_exit(xt_fini);