net/netfilter/x_tables.c

   1 /*
   2  * x_tables core - Backend for {ip,ip6,arp}_tables
   3  *
   4  * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
   5  *
   6  * Based on existing ip_tables code which is
   7  *   Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   8  *   Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation.
  13  *
  14  */
  15
  16 #include <linux/config.h>
  17 #include <linux/kernel.h>
  18 #include <linux/socket.h>
  19 #include <linux/net.h>
  20 #include <linux/proc_fs.h>
  21 #include <linux/seq_file.h>
  22 #include <linux/string.h>
  23 #include <linux/vmalloc.h>
  24 #include <linux/mutex.h>
  25
  26 #include <linux/netfilter/x_tables.h>
  27 #include <linux/netfilter_arp.h>
  28
  29
  30 MODULE_LICENSE("GPL");
  31 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
  32 MODULE_DESCRIPTION("[ip,ip6,arp]_tables backend module");
  33
  34 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  35
  36 struct xt_af {
  37         struct mutex mutex;
  38         struct list_head match;
  39         struct list_head target;
  40         struct list_head tables;
  41         struct mutex compat_mutex;
  42 };
  43
  44 static struct xt_af *xt;
  45
  46 #ifdef DEBUG_IP_FIREWALL_USER
  47 #define duprintf(format, args...) printk(format , ## args)
  48 #else
  49 #define duprintf(format, args...)
  50 #endif
  51
  52 enum {
  53         TABLE,
  54         TARGET,
  55         MATCH,
  56 };
  57
  58 static const char *xt_prefix[NPROTO] = {
  59         [AF_INET]       = "ip",
  60         [AF_INET6]      = "ip6",
  61         [NF_ARP]        = "arp",
  62 };
  63
  64 /* Registration hooks for targets. */
  65 int
  66 xt_register_target(struct xt_target *target)
  67 {
  68         int ret, af = target->family;
  69
  70         ret = mutex_lock_interruptible(&xt[af].mutex);
  71         if (ret != 0)
  72                 return ret;
  73         list_add(&target->list, &xt[af].target);
  74         mutex_unlock(&xt[af].mutex);
  75         return ret;
  76 }
  77 EXPORT_SYMBOL(xt_register_target);
  78
  79 void
  80 xt_unregister_target(struct xt_target *target)
  81 {
  82         int af = target->family;
  83
  84         mutex_lock(&xt[af].mutex);
  85         LIST_DELETE(&xt[af].target, target);
  86         mutex_unlock(&xt[af].mutex);
  87 }
  88 EXPORT_SYMBOL(xt_unregister_target);
  89
  90 int
  91 xt_register_match(struct xt_match *match)
  92 {
  93         int ret, af = match->family;
  94
  95         ret = mutex_lock_interruptible(&xt[af].mutex);
  96         if (ret != 0)
  97                 return ret;
  98
  99         list_add(&match->list, &xt[af].match);
 100         mutex_unlock(&xt[af].mutex);
 101
 102         return ret;
 103 }
 104 EXPORT_SYMBOL(xt_register_match);
 105
 106 void
 107 xt_unregister_match(struct xt_match *match)
 108 {
 109         int af =  match->family;
 110
 111         mutex_lock(&xt[af].mutex);
 112         LIST_DELETE(&xt[af].match, match);
 113         mutex_unlock(&xt[af].mutex);
 114 }
 115 EXPORT_SYMBOL(xt_unregister_match);
 116
 117
 118 /*
 119  * These are weird, but module loading must not be done with mutex
 120  * held (since they will register), and we have to have a single
 121  * function to use try_then_request_module().
 122  */
 123
 124 /* Find match, grabs ref.  Returns ERR_PTR() on error. */
 125 struct xt_match *xt_find_match(int af, const char *name, u8 revision)
 126 {
 127         struct xt_match *m;
 128         int err = 0;
 129
 130         if (mutex_lock_interruptible(&xt[af].mutex) != 0)
 131                 return ERR_PTR(-EINTR);
 132
 133         list_for_each_entry(m, &xt[af].match, list) {
 134                 if (strcmp(m->name, name) == 0) {
 135                         if (m->revision == revision) {
 136                                 if (try_module_get(m->me)) {
 137                                         mutex_unlock(&xt[af].mutex);
 138                                         return m;
 139                                 }
 140                         } else
 141                                 err = -EPROTOTYPE; /* Found something. */
 142                 }
 143         }
 144         mutex_unlock(&xt[af].mutex);
 145         return ERR_PTR(err);
 146 }
 147 EXPORT_SYMBOL(xt_find_match);
 148
 149 /* Find target, grabs ref.  Returns ERR_PTR() on error. */
 150 struct xt_target *xt_find_target(int af, const char *name, u8 revision)
 151 {
 152         struct xt_target *t;
 153         int err = 0;
 154
 155         if (mutex_lock_interruptible(&xt[af].mutex) != 0)
 156                 return ERR_PTR(-EINTR);
 157
 158         list_for_each_entry(t, &xt[af].target, list) {
 159                 if (strcmp(t->name, name) == 0) {
 160                         if (t->revision == revision) {
 161                                 if (try_module_get(t->me)) {
 162                                         mutex_unlock(&xt[af].mutex);
 163                                         return t;
 164                                 }
 165                         } else
 166                                 err = -EPROTOTYPE; /* Found something. */
 167                 }
 168         }
 169         mutex_unlock(&xt[af].mutex);
 170         return ERR_PTR(err);
 171 }
 172 EXPORT_SYMBOL(xt_find_target);
 173
 174 struct xt_target *xt_request_find_target(int af, const char *name, u8 revision)
 175 {
 176         struct xt_target *target;
 177
 178         target = try_then_request_module(xt_find_target(af, name, revision),
 179                                          "%st_%s", xt_prefix[af], name);
 180         if (IS_ERR(target) || !target)
 181                 return NULL;
 182         return target;
 183 }
 184 EXPORT_SYMBOL_GPL(xt_request_find_target);
 185
 186 static int match_revfn(int af, const char *name, u8 revision, int *bestp)
 187 {
 188         struct xt_match *m;
 189         int have_rev = 0;
 190
 191         list_for_each_entry(m, &xt[af].match, list) {
 192                 if (strcmp(m->name, name) == 0) {
 193                         if (m->revision > *bestp)
 194                                 *bestp = m->revision;
 195                         if (m->revision == revision)
 196                                 have_rev = 1;
 197                 }
 198         }
 199         return have_rev;
 200 }
 201
 202 static int target_revfn(int af, const char *name, u8 revision, int *bestp)
 203 {
 204         struct xt_target *t;
 205         int have_rev = 0;
 206
 207         list_for_each_entry(t, &xt[af].target, list) {
 208                 if (strcmp(t->name, name) == 0) {
 209                         if (t->revision > *bestp)
 210                                 *bestp = t->revision;
 211                         if (t->revision == revision)
 212                                 have_rev = 1;
 213                 }
 214         }
 215         return have_rev;
 216 }
 217
 218 /* Returns true or false (if no such extension at all) */
 219 int xt_find_revision(int af, const char *name, u8 revision, int target,
 220                      int *err)
 221 {
 222         int have_rev, best = -1;
 223
 224         if (mutex_lock_interruptible(&xt[af].mutex) != 0) {
 225                 *err = -EINTR;
 226                 return 1;
 227         }
 228         if (target == 1)
 229                 have_rev = target_revfn(af, name, revision, &best);
 230         else
 231                 have_rev = match_revfn(af, name, revision, &best);
 232         mutex_unlock(&xt[af].mutex);
 233
 234         /* Nothing at all?  Return 0 to try loading module. */
 235         if (best == -1) {
 236                 *err = -ENOENT;
 237                 return 0;
 238         }
 239
 240         *err = best;
 241         if (!have_rev)
 242                 *err = -EPROTONOSUPPORT;
 243         return 1;
 244 }
 245 EXPORT_SYMBOL_GPL(xt_find_revision);
 246
 247 int xt_check_match(const struct xt_match *match, unsigned short family,
 248                    unsigned int size, const char *table, unsigned int hook_mask,
 249                    unsigned short proto, int inv_proto)
 250 {
 251         if (XT_ALIGN(match->matchsize) != size) {
 252                 printk("%s_tables: %s match: invalid size %Zu != %u\n",
 253                        xt_prefix[family], match->name,
 254                        XT_ALIGN(match->matchsize), size);
 255                 return -EINVAL;
 256         }
 257         if (match->table && strcmp(match->table, table)) {
 258                 printk("%s_tables: %s match: only valid in %s table, not %s\n",
 259                        xt_prefix[family], match->name, match->table, table);
 260                 return -EINVAL;
 261         }
 262         if (match->hooks && (hook_mask & ~match->hooks) != 0) {
 263                 printk("%s_tables: %s match: bad hook_mask %u\n",
 264                        xt_prefix[family], match->name, hook_mask);
 265                 return -EINVAL;
 266         }
 267         if (match->proto && (match->proto != proto || inv_proto)) {
 268                 printk("%s_tables: %s match: only valid for protocol %u\n",
 269                        xt_prefix[family], match->name, match->proto);
 270                 return -EINVAL;
 271         }
 272         return 0;
 273 }
 274 EXPORT_SYMBOL_GPL(xt_check_match);
 275
 276 #ifdef CONFIG_COMPAT
 277 int xt_compat_match(void *match, void **dstptr, int *size, int convert)
 278 {
 279         struct xt_match *m;
 280         struct compat_xt_entry_match *pcompat_m;
 281         struct xt_entry_match *pm;
 282         u_int16_t msize;
 283         int off, ret;
 284
 285         ret = 0;
 286         m = ((struct xt_entry_match *)match)->u.kernel.match;
 287         off = XT_ALIGN(m->matchsize) - COMPAT_XT_ALIGN(m->matchsize);
 288         switch (convert) {
 289                 case COMPAT_TO_USER:
 290                         pm = (struct xt_entry_match *)match;
 291                         msize = pm->u.user.match_size;
 292                         if (copy_to_user(*dstptr, pm, msize)) {
 293                                 ret = -EFAULT;
 294                                 break;
 295                         }
 296                         msize -= off;
 297                         if (put_user(msize, (u_int16_t *)*dstptr))
 298                                 ret = -EFAULT;
 299                         *size -= off;
 300                         *dstptr += msize;
 301                         break;
 302                 case COMPAT_FROM_USER:
 303                         pcompat_m = (struct compat_xt_entry_match *)match;
 304                         pm = (struct xt_entry_match *)*dstptr;
 305                         msize = pcompat_m->u.user.match_size;
 306                         memcpy(pm, pcompat_m, msize);
 307                         msize += off;
 308                         pm->u.user.match_size = msize;
 309                         *size += off;
 310                         *dstptr += msize;
 311                         break;
 312                 case COMPAT_CALC_SIZE:
 313                         *size += off;
 314                         break;
 315                 default:
 316                         ret = -ENOPROTOOPT;
 317                         break;
 318         }
 319         return ret;
 320 }
 321 EXPORT_SYMBOL_GPL(xt_compat_match);
 322 #endif
 323
 324 int xt_check_target(const struct xt_target *target, unsigned short family,
 325                     unsigned int size, const char *table, unsigned int hook_mask,
 326                     unsigned short proto, int inv_proto)
 327 {
 328         if (XT_ALIGN(target->targetsize) != size) {
 329                 printk("%s_tables: %s target: invalid size %Zu != %u\n",
 330                        xt_prefix[family], target->name,
 331                        XT_ALIGN(target->targetsize), size);
 332                 return -EINVAL;
 333         }
 334         if (target->table && strcmp(target->table, table)) {
 335                 printk("%s_tables: %s target: only valid in %s table, not %s\n",
 336                        xt_prefix[family], target->name, target->table, table);
 337                 return -EINVAL;
 338         }
 339         if (target->hooks && (hook_mask & ~target->hooks) != 0) {
 340                 printk("%s_tables: %s target: bad hook_mask %u\n",
 341                        xt_prefix[family], target->name, hook_mask);
 342                 return -EINVAL;
 343         }
 344         if (target->proto && (target->proto != proto || inv_proto)) {
 345                 printk("%s_tables: %s target: only valid for protocol %u\n",
 346                        xt_prefix[family], target->name, target->proto);
 347                 return -EINVAL;
 348         }
 349         return 0;
 350 }
 351 EXPORT_SYMBOL_GPL(xt_check_target);
 352
 353 #ifdef CONFIG_COMPAT
 354 int xt_compat_target(void *target, void **dstptr, int *size, int convert)
 355 {
 356         struct xt_target *t;
 357         struct compat_xt_entry_target *pcompat;
 358         struct xt_entry_target *pt;
 359         u_int16_t tsize;
 360         int off, ret;
 361
 362         ret = 0;
 363         t = ((struct xt_entry_target *)target)->u.kernel.target;
 364         off = XT_ALIGN(t->targetsize) - COMPAT_XT_ALIGN(t->targetsize);
 365         switch (convert) {
 366                 case COMPAT_TO_USER:
 367                         pt = (struct xt_entry_target *)target;
 368                         tsize = pt->u.user.target_size;
 369                         if (copy_to_user(*dstptr, pt, tsize)) {
 370                                 ret = -EFAULT;
 371                                 break;
 372                         }
 373                         tsize -= off;
 374                         if (put_user(tsize, (u_int16_t *)*dstptr))
 375                                 ret = -EFAULT;
 376                         *size -= off;
 377                         *dstptr += tsize;
 378                         break;
 379                 case COMPAT_FROM_USER:
 380                         pcompat = (struct compat_xt_entry_target *)target;
 381                         pt = (struct xt_entry_target *)*dstptr;
 382                         tsize = pcompat->u.user.target_size;
 383                         memcpy(pt, pcompat, tsize);
 384                         tsize += off;
 385                         pt->u.user.target_size = tsize;
 386                         *size += off;
 387                         *dstptr += tsize;
 388                         break;
 389                 case COMPAT_CALC_SIZE:
 390                         *size += off;
 391                         break;
 392                 default:
 393                         ret = -ENOPROTOOPT;
 394                         break;
 395         }
 396         return ret;
 397 }
 398 EXPORT_SYMBOL_GPL(xt_compat_target);
 399 #endif
 400
 401 struct xt_table_info *xt_alloc_table_info(unsigned int size)
 402 {
 403         struct xt_table_info *newinfo;
 404         int cpu;
 405
 406         /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
 407         if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > num_physpages)
 408                 return NULL;
 409
 410         newinfo = kzalloc(sizeof(struct xt_table_info), GFP_KERNEL);
 411         if (!newinfo)
 412                 return NULL;
 413
 414         newinfo->size = size;
 415
 416         for_each_possible_cpu(cpu) {
 417                 if (size <= PAGE_SIZE)
 418                         newinfo->entries[cpu] = kmalloc_node(size,
 419                                                         GFP_KERNEL,
 420                                                         cpu_to_node(cpu));
 421                 else
 422                         newinfo->entries[cpu] = vmalloc_node(size,
 423                                                         cpu_to_node(cpu));
 424
 425                 if (newinfo->entries[cpu] == NULL) {
 426                         xt_free_table_info(newinfo);
 427                         return NULL;
 428                 }
 429         }
 430
 431         return newinfo;
 432 }
 433 EXPORT_SYMBOL(xt_alloc_table_info);
 434
 435 void xt_free_table_info(struct xt_table_info *info)
 436 {
 437         int cpu;
 438
 439         for_each_possible_cpu(cpu) {
 440                 if (info->size <= PAGE_SIZE)
 441                         kfree(info->entries[cpu]);
 442                 else
 443                         vfree(info->entries[cpu]);
 444         }
 445         kfree(info);
 446 }
 447 EXPORT_SYMBOL(xt_free_table_info);
 448
 449 /* Find table by name, grabs mutex & ref.  Returns ERR_PTR() on error. */
 450 struct xt_table *xt_find_table_lock(int af, const char *name)
 451 {
 452         struct xt_table *t;
 453
 454         if (mutex_lock_interruptible(&xt[af].mutex) != 0)
 455                 return ERR_PTR(-EINTR);
 456
 457         list_for_each_entry(t, &xt[af].tables, list)
 458                 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
 459                         return t;
 460         mutex_unlock(&xt[af].mutex);
 461         return NULL;
 462 }
 463 EXPORT_SYMBOL_GPL(xt_find_table_lock);
 464
 465 void xt_table_unlock(struct xt_table *table)
 466 {
 467         mutex_unlock(&xt[table->af].mutex);
 468 }
 469 EXPORT_SYMBOL_GPL(xt_table_unlock);
 470
 471 #ifdef CONFIG_COMPAT
 472 void xt_compat_lock(int af)
 473 {
 474         mutex_lock(&xt[af].compat_mutex);
 475 }
 476 EXPORT_SYMBOL_GPL(xt_compat_lock);
 477
 478 void xt_compat_unlock(int af)
 479 {
 480         mutex_unlock(&xt[af].compat_mutex);
 481 }
 482 EXPORT_SYMBOL_GPL(xt_compat_unlock);
 483 #endif
 484
 485 struct xt_table_info *
 486 xt_replace_table(struct xt_table *table,
 487               unsigned int num_counters,
 488               struct xt_table_info *newinfo,
 489               int *error)
 490 {
 491         struct xt_table_info *oldinfo, *private;
 492
 493         /* Do the substitution. */
 494         write_lock_bh(&table->lock);
 495         private = table->private;
 496         /* Check inside lock: is the old number correct? */
 497         if (num_counters != private->number) {
 498                 duprintf("num_counters != table->private->number (%u/%u)\n",
 499                          num_counters, private->number);
 500                 write_unlock_bh(&table->lock);
 501                 *error = -EAGAIN;
 502                 return NULL;
 503         }
 504         oldinfo = private;
 505         table->private = newinfo;
 506         newinfo->initial_entries = oldinfo->initial_entries;
 507         write_unlock_bh(&table->lock);
 508
 509         return oldinfo;
 510 }
 511 EXPORT_SYMBOL_GPL(xt_replace_table);
 512
 513 int xt_register_table(struct xt_table *table,
 514                       struct xt_table_info *bootstrap,
 515                       struct xt_table_info *newinfo)
 516 {
 517         int ret;
 518         struct xt_table_info *private;
 519
 520         ret = mutex_lock_interruptible(&xt[table->af].mutex);
 521         if (ret != 0)
 522                 return ret;
 523
 524         /* Don't autoload: we'd eat our tail... */
 525         if (list_named_find(&xt[table->af].tables, table->name)) {
 526                 ret = -EEXIST;
 527                 goto unlock;
 528         }
 529
 530         /* Simplifies replace_table code. */
 531         table->private = bootstrap;
 532         rwlock_init(&table->lock);
 533         if (!xt_replace_table(table, 0, newinfo, &ret))
 534                 goto unlock;
 535
 536         private = table->private;
 537         duprintf("table->private->number = %u\n", private->number);
 538
 539         /* save number of initial entries */
 540         private->initial_entries = private->number;
 541
 542         list_prepend(&xt[table->af].tables, table);
 543
 544         ret = 0;
 545  unlock:
 546         mutex_unlock(&xt[table->af].mutex);
 547         return ret;
 548 }
 549 EXPORT_SYMBOL_GPL(xt_register_table);
 550
 551 void *xt_unregister_table(struct xt_table *table)
 552 {
 553         struct xt_table_info *private;
 554
 555         mutex_lock(&xt[table->af].mutex);
 556         private = table->private;
 557         LIST_DELETE(&xt[table->af].tables, table);
 558         mutex_unlock(&xt[table->af].mutex);
 559
 560         return private;
 561 }
 562 EXPORT_SYMBOL_GPL(xt_unregister_table);
 563
 564 #ifdef CONFIG_PROC_FS
 565 static char *xt_proto_prefix[NPROTO] = {
 566         [AF_INET]       = "ip",
 567         [AF_INET6]      = "ip6",
 568         [NF_ARP]        = "arp",
 569 };
 570
 571 static struct list_head *xt_get_idx(struct list_head *list, struct seq_file *seq, loff_t pos)
 572 {
 573         struct list_head *head = list->next;
 574
 575         if (!head || list_empty(list))
 576                 return NULL;
 577
 578         while (pos && (head = head->next)) {
 579                 if (head == list)
 580                         return NULL;
 581                 pos--;
 582         }
 583         return pos ? NULL : head;
 584 }
 585
 586 static struct list_head *type2list(u_int16_t af, u_int16_t type)
 587 {
 588         struct list_head *list;
 589
 590         switch (type) {
 591         case TARGET:
 592                 list = &xt[af].target;
 593                 break;
 594         case MATCH:
 595                 list = &xt[af].match;
 596                 break;
 597         case TABLE:
 598                 list = &xt[af].tables;
 599                 break;
 600         default:
 601                 list = NULL;
 602                 break;
 603         }
 604
 605         return list;
 606 }
 607
 608 static void *xt_tgt_seq_start(struct seq_file *seq, loff_t *pos)
 609 {
 610         struct proc_dir_entry *pde = (struct proc_dir_entry *) seq->private;
 611         u_int16_t af = (unsigned long)pde->data & 0xffff;
 612         u_int16_t type = (unsigned long)pde->data >> 16;
 613         struct list_head *list;
 614
 615         if (af >= NPROTO)
 616                 return NULL;
 617
 618         list = type2list(af, type);
 619         if (!list)
 620                 return NULL;
 621
 622         if (mutex_lock_interruptible(&xt[af].mutex) != 0)
 623                 return NULL;
 624
 625         return xt_get_idx(list, seq, *pos);
 626 }
 627
 628 static void *xt_tgt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 629 {
 630         struct proc_dir_entry *pde = seq->private;
 631         u_int16_t af = (unsigned long)pde->data & 0xffff;
 632         u_int16_t type = (unsigned long)pde->data >> 16;
 633         struct list_head *list;
 634
 635         if (af >= NPROTO)
 636                 return NULL;
 637
 638         list = type2list(af, type);
 639         if (!list)
 640                 return NULL;
 641
 642         (*pos)++;
 643         return xt_get_idx(list, seq, *pos);
 644 }
 645
 646 static void xt_tgt_seq_stop(struct seq_file *seq, void *v)
 647 {
 648         struct proc_dir_entry *pde = seq->private;
 649         u_int16_t af = (unsigned long)pde->data & 0xffff;
 650
 651         mutex_unlock(&xt[af].mutex);
 652 }
 653
 654 static int xt_name_seq_show(struct seq_file *seq, void *v)
 655 {
 656         char *name = (char *)v + sizeof(struct list_head);
 657
 658         if (strlen(name))
 659                 return seq_printf(seq, "%s\n", name);
 660         else
 661                 return 0;
 662 }
 663
 664 static struct seq_operations xt_tgt_seq_ops = {
 665         .start  = xt_tgt_seq_start,
 666         .next   = xt_tgt_seq_next,
 667         .stop   = xt_tgt_seq_stop,
 668         .show   = xt_name_seq_show,
 669 };
 670
 671 static int xt_tgt_open(struct inode *inode, struct file *file)
 672 {
 673         int ret;
 674
 675         ret = seq_open(file, &xt_tgt_seq_ops);
 676         if (!ret) {
 677                 struct seq_file *seq = file->private_data;
 678                 struct proc_dir_entry *pde = PDE(inode);
 679
 680                 seq->private = pde;
 681         }
 682
 683         return ret;
 684 }
 685
 686 static struct file_operations xt_file_ops = {
 687         .owner   = THIS_MODULE,
 688         .open    = xt_tgt_open,
 689         .read    = seq_read,
 690         .llseek  = seq_lseek,
 691         .release = seq_release,
 692 };
 693
 694 #define FORMAT_TABLES   "_tables_names"
 695 #define FORMAT_MATCHES  "_tables_matches"
 696 #define FORMAT_TARGETS  "_tables_targets"
 697
 698 #endif /* CONFIG_PROC_FS */
 699
 700 int xt_proto_init(int af)
 701 {
 702 #ifdef CONFIG_PROC_FS
 703         char buf[XT_FUNCTION_MAXNAMELEN];
 704         struct proc_dir_entry *proc;
 705 #endif
 706
 707         if (af >= NPROTO)
 708                 return -EINVAL;
 709
 710
 711 #ifdef CONFIG_PROC_FS
 712         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 713         strlcat(buf, FORMAT_TABLES, sizeof(buf));
 714         proc = proc_net_fops_create(buf, 0440, &xt_file_ops);
 715         if (!proc)
 716                 goto out;
 717         proc->data = (void *) ((unsigned long) af | (TABLE << 16));
 718
 719
 720         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 721         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
 722         proc = proc_net_fops_create(buf, 0440, &xt_file_ops);
 723         if (!proc)
 724                 goto out_remove_tables;
 725         proc->data = (void *) ((unsigned long) af | (MATCH << 16));
 726
 727         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 728         strlcat(buf, FORMAT_TARGETS, sizeof(buf));
 729         proc = proc_net_fops_create(buf, 0440, &xt_file_ops);
 730         if (!proc)
 731                 goto out_remove_matches;
 732         proc->data = (void *) ((unsigned long) af | (TARGET << 16));
 733 #endif
 734
 735         return 0;
 736
 737 #ifdef CONFIG_PROC_FS
 738 out_remove_matches:
 739         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 740         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
 741         proc_net_remove(buf);
 742
 743 out_remove_tables:
 744         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 745         strlcat(buf, FORMAT_TABLES, sizeof(buf));
 746         proc_net_remove(buf);
 747 out:
 748         return -1;
 749 #endif
 750 }
 751 EXPORT_SYMBOL_GPL(xt_proto_init);
 752
 753 void xt_proto_fini(int af)
 754 {
 755 #ifdef CONFIG_PROC_FS
 756         char buf[XT_FUNCTION_MAXNAMELEN];
 757
 758         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 759         strlcat(buf, FORMAT_TABLES, sizeof(buf));
 760         proc_net_remove(buf);
 761
 762         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 763         strlcat(buf, FORMAT_TARGETS, sizeof(buf));
 764         proc_net_remove(buf);
 765
 766         strlcpy(buf, xt_proto_prefix[af], sizeof(buf));
 767         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
 768         proc_net_remove(buf);
 769 #endif /*CONFIG_PROC_FS*/
 770 }
 771 EXPORT_SYMBOL_GPL(xt_proto_fini);
 772
 773
 774 static int __init xt_init(void)
 775 {
 776         int i;
 777
 778         xt = kmalloc(sizeof(struct xt_af) * NPROTO, GFP_KERNEL);
 779         if (!xt)
 780                 return -ENOMEM;
 781
 782         for (i = 0; i < NPROTO; i++) {
 783                 mutex_init(&xt[i].mutex);
 784 #ifdef CONFIG_COMPAT
 785                 mutex_init(&xt[i].compat_mutex);
 786 #endif
 787                 INIT_LIST_HEAD(&xt[i].target);
 788                 INIT_LIST_HEAD(&xt[i].match);
 789                 INIT_LIST_HEAD(&xt[i].tables);
 790         }
 791         return 0;
 792 }
 793
 794 static void __exit xt_fini(void)
 795 {
 796         kfree(xt);
 797 }
 798
 799 module_init(xt_init);
 800 module_exit(xt_fini);
 801