1 /* 2 * x_tables core - Backend for {ip,ip6,arp}_tables 3 * 4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org> 5 * Copyright (C) 2006-2012 Patrick McHardy <kaber@trash.net> 6 * 7 * Based on existing ip_tables code which is 8 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 9 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org> 10 * 11 * This program is free software; you can redistribute it and/or modify 12 * it under the terms of the GNU General Public License version 2 as 13 * published by the Free Software Foundation. 14 * 15 */ 16 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 17 #include <linux/kernel.h> 18 #include <linux/module.h> 19 #include <linux/socket.h> 20 #include <linux/net.h> 21 #include <linux/proc_fs.h> 22 #include <linux/seq_file.h> 23 #include <linux/string.h> 24 #include <linux/vmalloc.h> 25 #include <linux/mutex.h> 26 #include <linux/mm.h> 27 #include <linux/slab.h> 28 #include <linux/audit.h> 29 #include <linux/user_namespace.h> 30 #include <net/net_namespace.h> 31 32 #include <linux/netfilter/x_tables.h> 33 #include <linux/netfilter_arp.h> 34 #include <linux/netfilter_ipv4/ip_tables.h> 35 #include <linux/netfilter_ipv6/ip6_tables.h> 36 #include <linux/netfilter_arp/arp_tables.h> 37 38 MODULE_LICENSE("GPL"); 39 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 40 MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); 41 42 #define XT_PCPU_BLOCK_SIZE 4096 43 44 struct compat_delta { 45 unsigned int offset; /* offset in kernel */ 46 int delta; /* delta in 32bit user land */ 47 }; 48 49 struct xt_af { 50 struct mutex mutex; 51 struct list_head match; 52 struct list_head target; 53 #ifdef CONFIG_COMPAT 54 struct mutex compat_mutex; 55 struct compat_delta *compat_tab; 56 unsigned int number; /* number of slots in compat_tab[] */ 57 unsigned int cur; /* number of used slots in compat_tab[] */ 58 #endif 59 }; 60 61 static struct xt_af *xt; 62 63 static const char *const xt_prefix[NFPROTO_NUMPROTO] = { 64 [NFPROTO_UNSPEC] = "x", 65 [NFPROTO_IPV4] = "ip", 66 [NFPROTO_ARP] = "arp", 67 [NFPROTO_BRIDGE] = "eb", 68 [NFPROTO_IPV6] = "ip6", 69 }; 70 71 /* Registration hooks for targets. */ 72 int xt_register_target(struct xt_target *target) 73 { 74 u_int8_t af = target->family; 75 76 mutex_lock(&xt[af].mutex); 77 list_add(&target->list, &xt[af].target); 78 mutex_unlock(&xt[af].mutex); 79 return 0; 80 } 81 EXPORT_SYMBOL(xt_register_target); 82 83 void 84 xt_unregister_target(struct xt_target *target) 85 { 86 u_int8_t af = target->family; 87 88 mutex_lock(&xt[af].mutex); 89 list_del(&target->list); 90 mutex_unlock(&xt[af].mutex); 91 } 92 EXPORT_SYMBOL(xt_unregister_target); 93 94 int 95 xt_register_targets(struct xt_target *target, unsigned int n) 96 { 97 unsigned int i; 98 int err = 0; 99 100 for (i = 0; i < n; i++) { 101 err = xt_register_target(&target[i]); 102 if (err) 103 goto err; 104 } 105 return err; 106 107 err: 108 if (i > 0) 109 xt_unregister_targets(target, i); 110 return err; 111 } 112 EXPORT_SYMBOL(xt_register_targets); 113 114 void 115 xt_unregister_targets(struct xt_target *target, unsigned int n) 116 { 117 while (n-- > 0) 118 xt_unregister_target(&target[n]); 119 } 120 EXPORT_SYMBOL(xt_unregister_targets); 121 122 int xt_register_match(struct xt_match *match) 123 { 124 u_int8_t af = match->family; 125 126 mutex_lock(&xt[af].mutex); 127 list_add(&match->list, &xt[af].match); 128 mutex_unlock(&xt[af].mutex); 129 return 0; 130 } 131 EXPORT_SYMBOL(xt_register_match); 132 133 void 134 xt_unregister_match(struct xt_match *match) 135 { 136 u_int8_t af = match->family; 137 138 mutex_lock(&xt[af].mutex); 139 list_del(&match->list); 140 mutex_unlock(&xt[af].mutex); 141 } 142 EXPORT_SYMBOL(xt_unregister_match); 143 144 int 145 xt_register_matches(struct xt_match *match, unsigned int n) 146 { 147 unsigned int i; 148 int err = 0; 149 150 for (i = 0; i < n; i++) { 151 err = xt_register_match(&match[i]); 152 if (err) 153 goto err; 154 } 155 return err; 156 157 err: 158 if (i > 0) 159 xt_unregister_matches(match, i); 160 return err; 161 } 162 EXPORT_SYMBOL(xt_register_matches); 163 164 void 165 xt_unregister_matches(struct xt_match *match, unsigned int n) 166 { 167 while (n-- > 0) 168 xt_unregister_match(&match[n]); 169 } 170 EXPORT_SYMBOL(xt_unregister_matches); 171 172 173 /* 174 * These are weird, but module loading must not be done with mutex 175 * held (since they will register), and we have to have a single 176 * function to use. 177 */ 178 179 /* Find match, grabs ref. Returns ERR_PTR() on error. */ 180 struct xt_match *xt_find_match(u8 af, const char *name, u8 revision) 181 { 182 struct xt_match *m; 183 int err = -ENOENT; 184 185 mutex_lock(&xt[af].mutex); 186 list_for_each_entry(m, &xt[af].match, list) { 187 if (strcmp(m->name, name) == 0) { 188 if (m->revision == revision) { 189 if (try_module_get(m->me)) { 190 mutex_unlock(&xt[af].mutex); 191 return m; 192 } 193 } else 194 err = -EPROTOTYPE; /* Found something. */ 195 } 196 } 197 mutex_unlock(&xt[af].mutex); 198 199 if (af != NFPROTO_UNSPEC) 200 /* Try searching again in the family-independent list */ 201 return xt_find_match(NFPROTO_UNSPEC, name, revision); 202 203 return ERR_PTR(err); 204 } 205 EXPORT_SYMBOL(xt_find_match); 206 207 struct xt_match * 208 xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision) 209 { 210 struct xt_match *match; 211 212 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN) 213 return ERR_PTR(-EINVAL); 214 215 match = xt_find_match(nfproto, name, revision); 216 if (IS_ERR(match)) { 217 request_module("%st_%s", xt_prefix[nfproto], name); 218 match = xt_find_match(nfproto, name, revision); 219 } 220 221 return match; 222 } 223 EXPORT_SYMBOL_GPL(xt_request_find_match); 224 225 /* Find target, grabs ref. Returns ERR_PTR() on error. */ 226 struct xt_target *xt_find_target(u8 af, const char *name, u8 revision) 227 { 228 struct xt_target *t; 229 int err = -ENOENT; 230 231 mutex_lock(&xt[af].mutex); 232 list_for_each_entry(t, &xt[af].target, list) { 233 if (strcmp(t->name, name) == 0) { 234 if (t->revision == revision) { 235 if (try_module_get(t->me)) { 236 mutex_unlock(&xt[af].mutex); 237 return t; 238 } 239 } else 240 err = -EPROTOTYPE; /* Found something. */ 241 } 242 } 243 mutex_unlock(&xt[af].mutex); 244 245 if (af != NFPROTO_UNSPEC) 246 /* Try searching again in the family-independent list */ 247 return xt_find_target(NFPROTO_UNSPEC, name, revision); 248 249 return ERR_PTR(err); 250 } 251 EXPORT_SYMBOL(xt_find_target); 252 253 struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision) 254 { 255 struct xt_target *target; 256 257 if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN) 258 return ERR_PTR(-EINVAL); 259 260 target = xt_find_target(af, name, revision); 261 if (IS_ERR(target)) { 262 request_module("%st_%s", xt_prefix[af], name); 263 target = xt_find_target(af, name, revision); 264 } 265 266 return target; 267 } 268 EXPORT_SYMBOL_GPL(xt_request_find_target); 269 270 271 static int xt_obj_to_user(u16 __user *psize, u16 size, 272 void __user *pname, const char *name, 273 u8 __user *prev, u8 rev) 274 { 275 if (put_user(size, psize)) 276 return -EFAULT; 277 if (copy_to_user(pname, name, strlen(name) + 1)) 278 return -EFAULT; 279 if (put_user(rev, prev)) 280 return -EFAULT; 281 282 return 0; 283 } 284 285 #define XT_OBJ_TO_USER(U, K, TYPE, C_SIZE) \ 286 xt_obj_to_user(&U->u.TYPE##_size, C_SIZE ? : K->u.TYPE##_size, \ 287 U->u.user.name, K->u.kernel.TYPE->name, \ 288 &U->u.user.revision, K->u.kernel.TYPE->revision) 289 290 int xt_data_to_user(void __user *dst, const void *src, 291 int usersize, int size, int aligned_size) 292 { 293 usersize = usersize ? : size; 294 if (copy_to_user(dst, src, usersize)) 295 return -EFAULT; 296 if (usersize != aligned_size && 297 clear_user(dst + usersize, aligned_size - usersize)) 298 return -EFAULT; 299 300 return 0; 301 } 302 EXPORT_SYMBOL_GPL(xt_data_to_user); 303 304 #define XT_DATA_TO_USER(U, K, TYPE) \ 305 xt_data_to_user(U->data, K->data, \ 306 K->u.kernel.TYPE->usersize, \ 307 K->u.kernel.TYPE->TYPE##size, \ 308 XT_ALIGN(K->u.kernel.TYPE->TYPE##size)) 309 310 int xt_match_to_user(const struct xt_entry_match *m, 311 struct xt_entry_match __user *u) 312 { 313 return XT_OBJ_TO_USER(u, m, match, 0) || 314 XT_DATA_TO_USER(u, m, match); 315 } 316 EXPORT_SYMBOL_GPL(xt_match_to_user); 317 318 int xt_target_to_user(const struct xt_entry_target *t, 319 struct xt_entry_target __user *u) 320 { 321 return XT_OBJ_TO_USER(u, t, target, 0) || 322 XT_DATA_TO_USER(u, t, target); 323 } 324 EXPORT_SYMBOL_GPL(xt_target_to_user); 325 326 static int match_revfn(u8 af, const char *name, u8 revision, int *bestp) 327 { 328 const struct xt_match *m; 329 int have_rev = 0; 330 331 list_for_each_entry(m, &xt[af].match, list) { 332 if (strcmp(m->name, name) == 0) { 333 if (m->revision > *bestp) 334 *bestp = m->revision; 335 if (m->revision == revision) 336 have_rev = 1; 337 } 338 } 339 340 if (af != NFPROTO_UNSPEC && !have_rev) 341 return match_revfn(NFPROTO_UNSPEC, name, revision, bestp); 342 343 return have_rev; 344 } 345 346 static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) 347 { 348 const struct xt_target *t; 349 int have_rev = 0; 350 351 list_for_each_entry(t, &xt[af].target, list) { 352 if (strcmp(t->name, name) == 0) { 353 if (t->revision > *bestp) 354 *bestp = t->revision; 355 if (t->revision == revision) 356 have_rev = 1; 357 } 358 } 359 360 if (af != NFPROTO_UNSPEC && !have_rev) 361 return target_revfn(NFPROTO_UNSPEC, name, revision, bestp); 362 363 return have_rev; 364 } 365 366 /* Returns true or false (if no such extension at all) */ 367 int xt_find_revision(u8 af, const char *name, u8 revision, int target, 368 int *err) 369 { 370 int have_rev, best = -1; 371 372 mutex_lock(&xt[af].mutex); 373 if (target == 1) 374 have_rev = target_revfn(af, name, revision, &best); 375 else 376 have_rev = match_revfn(af, name, revision, &best); 377 mutex_unlock(&xt[af].mutex); 378 379 /* Nothing at all? Return 0 to try loading module. */ 380 if (best == -1) { 381 *err = -ENOENT; 382 return 0; 383 } 384 385 *err = best; 386 if (!have_rev) 387 *err = -EPROTONOSUPPORT; 388 return 1; 389 } 390 EXPORT_SYMBOL_GPL(xt_find_revision); 391 392 static char * 393 textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto) 394 { 395 static const char *const inetbr_names[] = { 396 "PREROUTING", "INPUT", "FORWARD", 397 "OUTPUT", "POSTROUTING", "BROUTING", 398 }; 399 static const char *const arp_names[] = { 400 "INPUT", "FORWARD", "OUTPUT", 401 }; 402 const char *const *names; 403 unsigned int i, max; 404 char *p = buf; 405 bool np = false; 406 int res; 407 408 names = (nfproto == NFPROTO_ARP) ? arp_names : inetbr_names; 409 max = (nfproto == NFPROTO_ARP) ? ARRAY_SIZE(arp_names) : 410 ARRAY_SIZE(inetbr_names); 411 *p = '\0'; 412 for (i = 0; i < max; ++i) { 413 if (!(mask & (1 << i))) 414 continue; 415 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]); 416 if (res > 0) { 417 size -= res; 418 p += res; 419 } 420 np = true; 421 } 422 423 return buf; 424 } 425 426 int xt_check_match(struct xt_mtchk_param *par, 427 unsigned int size, u_int8_t proto, bool inv_proto) 428 { 429 int ret; 430 431 if (XT_ALIGN(par->match->matchsize) != size && 432 par->match->matchsize != -1) { 433 /* 434 * ebt_among is exempt from centralized matchsize checking 435 * because it uses a dynamic-size data set. 436 */ 437 pr_err("%s_tables: %s.%u match: invalid size " 438 "%u (kernel) != (user) %u\n", 439 xt_prefix[par->family], par->match->name, 440 par->match->revision, 441 XT_ALIGN(par->match->matchsize), size); 442 return -EINVAL; 443 } 444 if (par->match->table != NULL && 445 strcmp(par->match->table, par->table) != 0) { 446 pr_err("%s_tables: %s match: only valid in %s table, not %s\n", 447 xt_prefix[par->family], par->match->name, 448 par->match->table, par->table); 449 return -EINVAL; 450 } 451 if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) { 452 char used[64], allow[64]; 453 454 pr_err("%s_tables: %s match: used from hooks %s, but only " 455 "valid from %s\n", 456 xt_prefix[par->family], par->match->name, 457 textify_hooks(used, sizeof(used), par->hook_mask, 458 par->family), 459 textify_hooks(allow, sizeof(allow), par->match->hooks, 460 par->family)); 461 return -EINVAL; 462 } 463 if (par->match->proto && (par->match->proto != proto || inv_proto)) { 464 pr_err("%s_tables: %s match: only valid for protocol %u\n", 465 xt_prefix[par->family], par->match->name, 466 par->match->proto); 467 return -EINVAL; 468 } 469 if (par->match->checkentry != NULL) { 470 ret = par->match->checkentry(par); 471 if (ret < 0) 472 return ret; 473 else if (ret > 0) 474 /* Flag up potential errors. */ 475 return -EIO; 476 } 477 return 0; 478 } 479 EXPORT_SYMBOL_GPL(xt_check_match); 480 481 /** xt_check_entry_match - check that matches end before start of target 482 * 483 * @match: beginning of xt_entry_match 484 * @target: beginning of this rules target (alleged end of matches) 485 * @alignment: alignment requirement of match structures 486 * 487 * Validates that all matches add up to the beginning of the target, 488 * and that each match covers at least the base structure size. 489 * 490 * Return: 0 on success, negative errno on failure. 491 */ 492 static int xt_check_entry_match(const char *match, const char *target, 493 const size_t alignment) 494 { 495 const struct xt_entry_match *pos; 496 int length = target - match; 497 498 if (length == 0) /* no matches */ 499 return 0; 500 501 pos = (struct xt_entry_match *)match; 502 do { 503 if ((unsigned long)pos % alignment) 504 return -EINVAL; 505 506 if (length < (int)sizeof(struct xt_entry_match)) 507 return -EINVAL; 508 509 if (pos->u.match_size < sizeof(struct xt_entry_match)) 510 return -EINVAL; 511 512 if (pos->u.match_size > length) 513 return -EINVAL; 514 515 length -= pos->u.match_size; 516 pos = ((void *)((char *)(pos) + (pos)->u.match_size)); 517 } while (length > 0); 518 519 return 0; 520 } 521 522 #ifdef CONFIG_COMPAT 523 int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta) 524 { 525 struct xt_af *xp = &xt[af]; 526 527 if (!xp->compat_tab) { 528 if (!xp->number) 529 return -EINVAL; 530 xp->compat_tab = vmalloc(sizeof(struct compat_delta) * xp->number); 531 if (!xp->compat_tab) 532 return -ENOMEM; 533 xp->cur = 0; 534 } 535 536 if (xp->cur >= xp->number) 537 return -EINVAL; 538 539 if (xp->cur) 540 delta += xp->compat_tab[xp->cur - 1].delta; 541 xp->compat_tab[xp->cur].offset = offset; 542 xp->compat_tab[xp->cur].delta = delta; 543 xp->cur++; 544 return 0; 545 } 546 EXPORT_SYMBOL_GPL(xt_compat_add_offset); 547 548 void xt_compat_flush_offsets(u_int8_t af) 549 { 550 if (xt[af].compat_tab) { 551 vfree(xt[af].compat_tab); 552 xt[af].compat_tab = NULL; 553 xt[af].number = 0; 554 xt[af].cur = 0; 555 } 556 } 557 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets); 558 559 int xt_compat_calc_jump(u_int8_t af, unsigned int offset) 560 { 561 struct compat_delta *tmp = xt[af].compat_tab; 562 int mid, left = 0, right = xt[af].cur - 1; 563 564 while (left <= right) { 565 mid = (left + right) >> 1; 566 if (offset > tmp[mid].offset) 567 left = mid + 1; 568 else if (offset < tmp[mid].offset) 569 right = mid - 1; 570 else 571 return mid ? tmp[mid - 1].delta : 0; 572 } 573 return left ? tmp[left - 1].delta : 0; 574 } 575 EXPORT_SYMBOL_GPL(xt_compat_calc_jump); 576 577 void xt_compat_init_offsets(u_int8_t af, unsigned int number) 578 { 579 xt[af].number = number; 580 xt[af].cur = 0; 581 } 582 EXPORT_SYMBOL(xt_compat_init_offsets); 583 584 int xt_compat_match_offset(const struct xt_match *match) 585 { 586 u_int16_t csize = match->compatsize ? : match->matchsize; 587 return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize); 588 } 589 EXPORT_SYMBOL_GPL(xt_compat_match_offset); 590 591 void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, 592 unsigned int *size) 593 { 594 const struct xt_match *match = m->u.kernel.match; 595 struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m; 596 int pad, off = xt_compat_match_offset(match); 597 u_int16_t msize = cm->u.user.match_size; 598 char name[sizeof(m->u.user.name)]; 599 600 m = *dstptr; 601 memcpy(m, cm, sizeof(*cm)); 602 if (match->compat_from_user) 603 match->compat_from_user(m->data, cm->data); 604 else 605 memcpy(m->data, cm->data, msize - sizeof(*cm)); 606 pad = XT_ALIGN(match->matchsize) - match->matchsize; 607 if (pad > 0) 608 memset(m->data + match->matchsize, 0, pad); 609 610 msize += off; 611 m->u.user.match_size = msize; 612 strlcpy(name, match->name, sizeof(name)); 613 module_put(match->me); 614 strncpy(m->u.user.name, name, sizeof(m->u.user.name)); 615 616 *size += off; 617 *dstptr += msize; 618 } 619 EXPORT_SYMBOL_GPL(xt_compat_match_from_user); 620 621 #define COMPAT_XT_DATA_TO_USER(U, K, TYPE, C_SIZE) \ 622 xt_data_to_user(U->data, K->data, \ 623 K->u.kernel.TYPE->usersize, \ 624 C_SIZE, \ 625 COMPAT_XT_ALIGN(C_SIZE)) 626 627 int xt_compat_match_to_user(const struct xt_entry_match *m, 628 void __user **dstptr, unsigned int *size) 629 { 630 const struct xt_match *match = m->u.kernel.match; 631 struct compat_xt_entry_match __user *cm = *dstptr; 632 int off = xt_compat_match_offset(match); 633 u_int16_t msize = m->u.user.match_size - off; 634 635 if (XT_OBJ_TO_USER(cm, m, match, msize)) 636 return -EFAULT; 637 638 if (match->compat_to_user) { 639 if (match->compat_to_user((void __user *)cm->data, m->data)) 640 return -EFAULT; 641 } else { 642 if (COMPAT_XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm))) 643 return -EFAULT; 644 } 645 646 *size -= off; 647 *dstptr += msize; 648 return 0; 649 } 650 EXPORT_SYMBOL_GPL(xt_compat_match_to_user); 651 652 /* non-compat version may have padding after verdict */ 653 struct compat_xt_standard_target { 654 struct compat_xt_entry_target t; 655 compat_uint_t verdict; 656 }; 657 658 int xt_compat_check_entry_offsets(const void *base, const char *elems, 659 unsigned int target_offset, 660 unsigned int next_offset) 661 { 662 long size_of_base_struct = elems - (const char *)base; 663 const struct compat_xt_entry_target *t; 664 const char *e = base; 665 666 if (target_offset < size_of_base_struct) 667 return -EINVAL; 668 669 if (target_offset + sizeof(*t) > next_offset) 670 return -EINVAL; 671 672 t = (void *)(e + target_offset); 673 if (t->u.target_size < sizeof(*t)) 674 return -EINVAL; 675 676 if (target_offset + t->u.target_size > next_offset) 677 return -EINVAL; 678 679 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 && 680 COMPAT_XT_ALIGN(target_offset + sizeof(struct compat_xt_standard_target)) != next_offset) 681 return -EINVAL; 682 683 /* compat_xt_entry match has less strict alignment requirements, 684 * otherwise they are identical. In case of padding differences 685 * we need to add compat version of xt_check_entry_match. 686 */ 687 BUILD_BUG_ON(sizeof(struct compat_xt_entry_match) != sizeof(struct xt_entry_match)); 688 689 return xt_check_entry_match(elems, base + target_offset, 690 __alignof__(struct compat_xt_entry_match)); 691 } 692 EXPORT_SYMBOL(xt_compat_check_entry_offsets); 693 #endif /* CONFIG_COMPAT */ 694 695 /** 696 * xt_check_entry_offsets - validate arp/ip/ip6t_entry 697 * 698 * @base: pointer to arp/ip/ip6t_entry 699 * @elems: pointer to first xt_entry_match, i.e. ip(6)t_entry->elems 700 * @target_offset: the arp/ip/ip6_t->target_offset 701 * @next_offset: the arp/ip/ip6_t->next_offset 702 * 703 * validates that target_offset and next_offset are sane and that all 704 * match sizes (if any) align with the target offset. 705 * 706 * This function does not validate the targets or matches themselves, it 707 * only tests that all the offsets and sizes are correct, that all 708 * match structures are aligned, and that the last structure ends where 709 * the target structure begins. 710 * 711 * Also see xt_compat_check_entry_offsets for CONFIG_COMPAT version. 712 * 713 * The arp/ip/ip6t_entry structure @base must have passed following tests: 714 * - it must point to a valid memory location 715 * - base to base + next_offset must be accessible, i.e. not exceed allocated 716 * length. 717 * 718 * A well-formed entry looks like this: 719 * 720 * ip(6)t_entry match [mtdata] match [mtdata] target [tgdata] ip(6)t_entry 721 * e->elems[]-----' | | 722 * matchsize | | 723 * matchsize | | 724 * | | 725 * target_offset---------------------------------' | 726 * next_offset---------------------------------------------------' 727 * 728 * elems[]: flexible array member at end of ip(6)/arpt_entry struct. 729 * This is where matches (if any) and the target reside. 730 * target_offset: beginning of target. 731 * next_offset: start of the next rule; also: size of this rule. 732 * Since targets have a minimum size, target_offset + minlen <= next_offset. 733 * 734 * Every match stores its size, sum of sizes must not exceed target_offset. 735 * 736 * Return: 0 on success, negative errno on failure. 737 */ 738 int xt_check_entry_offsets(const void *base, 739 const char *elems, 740 unsigned int target_offset, 741 unsigned int next_offset) 742 { 743 long size_of_base_struct = elems - (const char *)base; 744 const struct xt_entry_target *t; 745 const char *e = base; 746 747 /* target start is within the ip/ip6/arpt_entry struct */ 748 if (target_offset < size_of_base_struct) 749 return -EINVAL; 750 751 if (target_offset + sizeof(*t) > next_offset) 752 return -EINVAL; 753 754 t = (void *)(e + target_offset); 755 if (t->u.target_size < sizeof(*t)) 756 return -EINVAL; 757 758 if (target_offset + t->u.target_size > next_offset) 759 return -EINVAL; 760 761 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 && 762 XT_ALIGN(target_offset + sizeof(struct xt_standard_target)) != next_offset) 763 return -EINVAL; 764 765 return xt_check_entry_match(elems, base + target_offset, 766 __alignof__(struct xt_entry_match)); 767 } 768 EXPORT_SYMBOL(xt_check_entry_offsets); 769 770 /** 771 * xt_alloc_entry_offsets - allocate array to store rule head offsets 772 * 773 * @size: number of entries 774 * 775 * Return: NULL or kmalloc'd or vmalloc'd array 776 */ 777 unsigned int *xt_alloc_entry_offsets(unsigned int size) 778 { 779 return kvmalloc_array(size, sizeof(unsigned int), GFP_KERNEL | __GFP_ZERO); 780 781 } 782 EXPORT_SYMBOL(xt_alloc_entry_offsets); 783 784 /** 785 * xt_find_jump_offset - check if target is a valid jump offset 786 * 787 * @offsets: array containing all valid rule start offsets of a rule blob 788 * @target: the jump target to search for 789 * @size: entries in @offset 790 */ 791 bool xt_find_jump_offset(const unsigned int *offsets, 792 unsigned int target, unsigned int size) 793 { 794 int m, low = 0, hi = size; 795 796 while (hi > low) { 797 m = (low + hi) / 2u; 798 799 if (offsets[m] > target) 800 hi = m; 801 else if (offsets[m] < target) 802 low = m + 1; 803 else 804 return true; 805 } 806 807 return false; 808 } 809 EXPORT_SYMBOL(xt_find_jump_offset); 810 811 int xt_check_target(struct xt_tgchk_param *par, 812 unsigned int size, u_int8_t proto, bool inv_proto) 813 { 814 int ret; 815 816 if (XT_ALIGN(par->target->targetsize) != size) { 817 pr_err("%s_tables: %s.%u target: invalid size " 818 "%u (kernel) != (user) %u\n", 819 xt_prefix[par->family], par->target->name, 820 par->target->revision, 821 XT_ALIGN(par->target->targetsize), size); 822 return -EINVAL; 823 } 824 if (par->target->table != NULL && 825 strcmp(par->target->table, par->table) != 0) { 826 pr_err("%s_tables: %s target: only valid in %s table, not %s\n", 827 xt_prefix[par->family], par->target->name, 828 par->target->table, par->table); 829 return -EINVAL; 830 } 831 if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) { 832 char used[64], allow[64]; 833 834 pr_err("%s_tables: %s target: used from hooks %s, but only " 835 "usable from %s\n", 836 xt_prefix[par->family], par->target->name, 837 textify_hooks(used, sizeof(used), par->hook_mask, 838 par->family), 839 textify_hooks(allow, sizeof(allow), par->target->hooks, 840 par->family)); 841 return -EINVAL; 842 } 843 if (par->target->proto && (par->target->proto != proto || inv_proto)) { 844 pr_err("%s_tables: %s target: only valid for protocol %u\n", 845 xt_prefix[par->family], par->target->name, 846 par->target->proto); 847 return -EINVAL; 848 } 849 if (par->target->checkentry != NULL) { 850 ret = par->target->checkentry(par); 851 if (ret < 0) 852 return ret; 853 else if (ret > 0) 854 /* Flag up potential errors. */ 855 return -EIO; 856 } 857 return 0; 858 } 859 EXPORT_SYMBOL_GPL(xt_check_target); 860 861 /** 862 * xt_copy_counters_from_user - copy counters and metadata from userspace 863 * 864 * @user: src pointer to userspace memory 865 * @len: alleged size of userspace memory 866 * @info: where to store the xt_counters_info metadata 867 * @compat: true if we setsockopt call is done by 32bit task on 64bit kernel 868 * 869 * Copies counter meta data from @user and stores it in @info. 870 * 871 * vmallocs memory to hold the counters, then copies the counter data 872 * from @user to the new memory and returns a pointer to it. 873 * 874 * If @compat is true, @info gets converted automatically to the 64bit 875 * representation. 876 * 877 * The metadata associated with the counters is stored in @info. 878 * 879 * Return: returns pointer that caller has to test via IS_ERR(). 880 * If IS_ERR is false, caller has to vfree the pointer. 881 */ 882 void *xt_copy_counters_from_user(const void __user *user, unsigned int len, 883 struct xt_counters_info *info, bool compat) 884 { 885 void *mem; 886 u64 size; 887 888 #ifdef CONFIG_COMPAT 889 if (compat) { 890 /* structures only differ in size due to alignment */ 891 struct compat_xt_counters_info compat_tmp; 892 893 if (len <= sizeof(compat_tmp)) 894 return ERR_PTR(-EINVAL); 895 896 len -= sizeof(compat_tmp); 897 if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0) 898 return ERR_PTR(-EFAULT); 899 900 memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1); 901 info->num_counters = compat_tmp.num_counters; 902 user += sizeof(compat_tmp); 903 } else 904 #endif 905 { 906 if (len <= sizeof(*info)) 907 return ERR_PTR(-EINVAL); 908 909 len -= sizeof(*info); 910 if (copy_from_user(info, user, sizeof(*info)) != 0) 911 return ERR_PTR(-EFAULT); 912 913 user += sizeof(*info); 914 } 915 info->name[sizeof(info->name) - 1] = '\0'; 916 917 size = sizeof(struct xt_counters); 918 size *= info->num_counters; 919 920 if (size != (u64)len) 921 return ERR_PTR(-EINVAL); 922 923 mem = vmalloc(len); 924 if (!mem) 925 return ERR_PTR(-ENOMEM); 926 927 if (copy_from_user(mem, user, len) == 0) 928 return mem; 929 930 vfree(mem); 931 return ERR_PTR(-EFAULT); 932 } 933 EXPORT_SYMBOL_GPL(xt_copy_counters_from_user); 934 935 #ifdef CONFIG_COMPAT 936 int xt_compat_target_offset(const struct xt_target *target) 937 { 938 u_int16_t csize = target->compatsize ? : target->targetsize; 939 return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize); 940 } 941 EXPORT_SYMBOL_GPL(xt_compat_target_offset); 942 943 void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, 944 unsigned int *size) 945 { 946 const struct xt_target *target = t->u.kernel.target; 947 struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t; 948 int pad, off = xt_compat_target_offset(target); 949 u_int16_t tsize = ct->u.user.target_size; 950 char name[sizeof(t->u.user.name)]; 951 952 t = *dstptr; 953 memcpy(t, ct, sizeof(*ct)); 954 if (target->compat_from_user) 955 target->compat_from_user(t->data, ct->data); 956 else 957 memcpy(t->data, ct->data, tsize - sizeof(*ct)); 958 pad = XT_ALIGN(target->targetsize) - target->targetsize; 959 if (pad > 0) 960 memset(t->data + target->targetsize, 0, pad); 961 962 tsize += off; 963 t->u.user.target_size = tsize; 964 strlcpy(name, target->name, sizeof(name)); 965 module_put(target->me); 966 strncpy(t->u.user.name, name, sizeof(t->u.user.name)); 967 968 *size += off; 969 *dstptr += tsize; 970 } 971 EXPORT_SYMBOL_GPL(xt_compat_target_from_user); 972 973 int xt_compat_target_to_user(const struct xt_entry_target *t, 974 void __user **dstptr, unsigned int *size) 975 { 976 const struct xt_target *target = t->u.kernel.target; 977 struct compat_xt_entry_target __user *ct = *dstptr; 978 int off = xt_compat_target_offset(target); 979 u_int16_t tsize = t->u.user.target_size - off; 980 981 if (XT_OBJ_TO_USER(ct, t, target, tsize)) 982 return -EFAULT; 983 984 if (target->compat_to_user) { 985 if (target->compat_to_user((void __user *)ct->data, t->data)) 986 return -EFAULT; 987 } else { 988 if (COMPAT_XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct))) 989 return -EFAULT; 990 } 991 992 *size -= off; 993 *dstptr += tsize; 994 return 0; 995 } 996 EXPORT_SYMBOL_GPL(xt_compat_target_to_user); 997 #endif 998 999 struct xt_table_info *xt_alloc_table_info(unsigned int size) 1000 { 1001 struct xt_table_info *info = NULL; 1002 size_t sz = sizeof(*info) + size; 1003 1004 if (sz < sizeof(*info)) 1005 return NULL; 1006 1007 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ 1008 if ((size >> PAGE_SHIFT) + 2 > totalram_pages) 1009 return NULL; 1010 1011 /* __GFP_NORETRY is not fully supported by kvmalloc but it should 1012 * work reasonably well if sz is too large and bail out rather 1013 * than shoot all processes down before realizing there is nothing 1014 * more to reclaim. 1015 */ 1016 info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY); 1017 if (!info) 1018 return NULL; 1019 1020 memset(info, 0, sizeof(*info)); 1021 info->size = size; 1022 return info; 1023 } 1024 EXPORT_SYMBOL(xt_alloc_table_info); 1025 1026 void xt_free_table_info(struct xt_table_info *info) 1027 { 1028 int cpu; 1029 1030 if (info->jumpstack != NULL) { 1031 for_each_possible_cpu(cpu) 1032 kvfree(info->jumpstack[cpu]); 1033 kvfree(info->jumpstack); 1034 } 1035 1036 kvfree(info); 1037 } 1038 EXPORT_SYMBOL(xt_free_table_info); 1039 1040 /* Find table by name, grabs mutex & ref. Returns ERR_PTR on error. */ 1041 struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af, 1042 const char *name) 1043 { 1044 struct xt_table *t, *found = NULL; 1045 1046 mutex_lock(&xt[af].mutex); 1047 list_for_each_entry(t, &net->xt.tables[af], list) 1048 if (strcmp(t->name, name) == 0 && try_module_get(t->me)) 1049 return t; 1050 1051 if (net == &init_net) 1052 goto out; 1053 1054 /* Table doesn't exist in this netns, re-try init */ 1055 list_for_each_entry(t, &init_net.xt.tables[af], list) { 1056 int err; 1057 1058 if (strcmp(t->name, name)) 1059 continue; 1060 if (!try_module_get(t->me)) 1061 goto out; 1062 mutex_unlock(&xt[af].mutex); 1063 err = t->table_init(net); 1064 if (err < 0) { 1065 module_put(t->me); 1066 return ERR_PTR(err); 1067 } 1068 1069 found = t; 1070 1071 mutex_lock(&xt[af].mutex); 1072 break; 1073 } 1074 1075 if (!found) 1076 goto out; 1077 1078 /* and once again: */ 1079 list_for_each_entry(t, &net->xt.tables[af], list) 1080 if (strcmp(t->name, name) == 0) 1081 return t; 1082 1083 module_put(found->me); 1084 out: 1085 mutex_unlock(&xt[af].mutex); 1086 return ERR_PTR(-ENOENT); 1087 } 1088 EXPORT_SYMBOL_GPL(xt_find_table_lock); 1089 1090 struct xt_table *xt_request_find_table_lock(struct net *net, u_int8_t af, 1091 const char *name) 1092 { 1093 struct xt_table *t = xt_find_table_lock(net, af, name); 1094 1095 #ifdef CONFIG_MODULES 1096 if (IS_ERR(t)) { 1097 int err = request_module("%stable_%s", xt_prefix[af], name); 1098 if (err < 0) 1099 return ERR_PTR(err); 1100 t = xt_find_table_lock(net, af, name); 1101 } 1102 #endif 1103 1104 return t; 1105 } 1106 EXPORT_SYMBOL_GPL(xt_request_find_table_lock); 1107 1108 void xt_table_unlock(struct xt_table *table) 1109 { 1110 mutex_unlock(&xt[table->af].mutex); 1111 } 1112 EXPORT_SYMBOL_GPL(xt_table_unlock); 1113 1114 #ifdef CONFIG_COMPAT 1115 void xt_compat_lock(u_int8_t af) 1116 { 1117 mutex_lock(&xt[af].compat_mutex); 1118 } 1119 EXPORT_SYMBOL_GPL(xt_compat_lock); 1120 1121 void xt_compat_unlock(u_int8_t af) 1122 { 1123 mutex_unlock(&xt[af].compat_mutex); 1124 } 1125 EXPORT_SYMBOL_GPL(xt_compat_unlock); 1126 #endif 1127 1128 DEFINE_PER_CPU(seqcount_t, xt_recseq); 1129 EXPORT_PER_CPU_SYMBOL_GPL(xt_recseq); 1130 1131 struct static_key xt_tee_enabled __read_mostly; 1132 EXPORT_SYMBOL_GPL(xt_tee_enabled); 1133 1134 static int xt_jumpstack_alloc(struct xt_table_info *i) 1135 { 1136 unsigned int size; 1137 int cpu; 1138 1139 size = sizeof(void **) * nr_cpu_ids; 1140 if (size > PAGE_SIZE) 1141 i->jumpstack = kvzalloc(size, GFP_KERNEL); 1142 else 1143 i->jumpstack = kzalloc(size, GFP_KERNEL); 1144 if (i->jumpstack == NULL) 1145 return -ENOMEM; 1146 1147 /* ruleset without jumps -- no stack needed */ 1148 if (i->stacksize == 0) 1149 return 0; 1150 1151 /* Jumpstack needs to be able to record two full callchains, one 1152 * from the first rule set traversal, plus one table reentrancy 1153 * via -j TEE without clobbering the callchain that brought us to 1154 * TEE target. 1155 * 1156 * This is done by allocating two jumpstacks per cpu, on reentry 1157 * the upper half of the stack is used. 1158 * 1159 * see the jumpstack setup in ipt_do_table() for more details. 1160 */ 1161 size = sizeof(void *) * i->stacksize * 2u; 1162 for_each_possible_cpu(cpu) { 1163 i->jumpstack[cpu] = kvmalloc_node(size, GFP_KERNEL, 1164 cpu_to_node(cpu)); 1165 if (i->jumpstack[cpu] == NULL) 1166 /* 1167 * Freeing will be done later on by the callers. The 1168 * chain is: xt_replace_table -> __do_replace -> 1169 * do_replace -> xt_free_table_info. 1170 */ 1171 return -ENOMEM; 1172 } 1173 1174 return 0; 1175 } 1176 1177 struct xt_table_info * 1178 xt_replace_table(struct xt_table *table, 1179 unsigned int num_counters, 1180 struct xt_table_info *newinfo, 1181 int *error) 1182 { 1183 struct xt_table_info *private; 1184 unsigned int cpu; 1185 int ret; 1186 1187 ret = xt_jumpstack_alloc(newinfo); 1188 if (ret < 0) { 1189 *error = ret; 1190 return NULL; 1191 } 1192 1193 /* Do the substitution. */ 1194 local_bh_disable(); 1195 private = table->private; 1196 1197 /* Check inside lock: is the old number correct? */ 1198 if (num_counters != private->number) { 1199 pr_debug("num_counters != table->private->number (%u/%u)\n", 1200 num_counters, private->number); 1201 local_bh_enable(); 1202 *error = -EAGAIN; 1203 return NULL; 1204 } 1205 1206 newinfo->initial_entries = private->initial_entries; 1207 /* 1208 * Ensure contents of newinfo are visible before assigning to 1209 * private. 1210 */ 1211 smp_wmb(); 1212 table->private = newinfo; 1213 1214 /* make sure all cpus see new ->private value */ 1215 smp_wmb(); 1216 1217 /* 1218 * Even though table entries have now been swapped, other CPU's 1219 * may still be using the old entries... 1220 */ 1221 local_bh_enable(); 1222 1223 /* ... so wait for even xt_recseq on all cpus */ 1224 for_each_possible_cpu(cpu) { 1225 seqcount_t *s = &per_cpu(xt_recseq, cpu); 1226 u32 seq = raw_read_seqcount(s); 1227 1228 if (seq & 1) { 1229 do { 1230 cond_resched(); 1231 cpu_relax(); 1232 } while (seq == raw_read_seqcount(s)); 1233 } 1234 } 1235 1236 #ifdef CONFIG_AUDIT 1237 if (audit_enabled) { 1238 audit_log(current->audit_context, GFP_KERNEL, 1239 AUDIT_NETFILTER_CFG, 1240 "table=%s family=%u entries=%u", 1241 table->name, table->af, private->number); 1242 } 1243 #endif 1244 1245 return private; 1246 } 1247 EXPORT_SYMBOL_GPL(xt_replace_table); 1248 1249 struct xt_table *xt_register_table(struct net *net, 1250 const struct xt_table *input_table, 1251 struct xt_table_info *bootstrap, 1252 struct xt_table_info *newinfo) 1253 { 1254 int ret; 1255 struct xt_table_info *private; 1256 struct xt_table *t, *table; 1257 1258 /* Don't add one object to multiple lists. */ 1259 table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL); 1260 if (!table) { 1261 ret = -ENOMEM; 1262 goto out; 1263 } 1264 1265 mutex_lock(&xt[table->af].mutex); 1266 /* Don't autoload: we'd eat our tail... */ 1267 list_for_each_entry(t, &net->xt.tables[table->af], list) { 1268 if (strcmp(t->name, table->name) == 0) { 1269 ret = -EEXIST; 1270 goto unlock; 1271 } 1272 } 1273 1274 /* Simplifies replace_table code. */ 1275 table->private = bootstrap; 1276 1277 if (!xt_replace_table(table, 0, newinfo, &ret)) 1278 goto unlock; 1279 1280 private = table->private; 1281 pr_debug("table->private->number = %u\n", private->number); 1282 1283 /* save number of initial entries */ 1284 private->initial_entries = private->number; 1285 1286 list_add(&table->list, &net->xt.tables[table->af]); 1287 mutex_unlock(&xt[table->af].mutex); 1288 return table; 1289 1290 unlock: 1291 mutex_unlock(&xt[table->af].mutex); 1292 kfree(table); 1293 out: 1294 return ERR_PTR(ret); 1295 } 1296 EXPORT_SYMBOL_GPL(xt_register_table); 1297 1298 void *xt_unregister_table(struct xt_table *table) 1299 { 1300 struct xt_table_info *private; 1301 1302 mutex_lock(&xt[table->af].mutex); 1303 private = table->private; 1304 list_del(&table->list); 1305 mutex_unlock(&xt[table->af].mutex); 1306 kfree(table); 1307 1308 return private; 1309 } 1310 EXPORT_SYMBOL_GPL(xt_unregister_table); 1311 1312 #ifdef CONFIG_PROC_FS 1313 struct xt_names_priv { 1314 struct seq_net_private p; 1315 u_int8_t af; 1316 }; 1317 static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos) 1318 { 1319 struct xt_names_priv *priv = seq->private; 1320 struct net *net = seq_file_net(seq); 1321 u_int8_t af = priv->af; 1322 1323 mutex_lock(&xt[af].mutex); 1324 return seq_list_start(&net->xt.tables[af], *pos); 1325 } 1326 1327 static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1328 { 1329 struct xt_names_priv *priv = seq->private; 1330 struct net *net = seq_file_net(seq); 1331 u_int8_t af = priv->af; 1332 1333 return seq_list_next(v, &net->xt.tables[af], pos); 1334 } 1335 1336 static void xt_table_seq_stop(struct seq_file *seq, void *v) 1337 { 1338 struct xt_names_priv *priv = seq->private; 1339 u_int8_t af = priv->af; 1340 1341 mutex_unlock(&xt[af].mutex); 1342 } 1343 1344 static int xt_table_seq_show(struct seq_file *seq, void *v) 1345 { 1346 struct xt_table *table = list_entry(v, struct xt_table, list); 1347 1348 if (*table->name) 1349 seq_printf(seq, "%s\n", table->name); 1350 return 0; 1351 } 1352 1353 static const struct seq_operations xt_table_seq_ops = { 1354 .start = xt_table_seq_start, 1355 .next = xt_table_seq_next, 1356 .stop = xt_table_seq_stop, 1357 .show = xt_table_seq_show, 1358 }; 1359 1360 static int xt_table_open(struct inode *inode, struct file *file) 1361 { 1362 int ret; 1363 struct xt_names_priv *priv; 1364 1365 ret = seq_open_net(inode, file, &xt_table_seq_ops, 1366 sizeof(struct xt_names_priv)); 1367 if (!ret) { 1368 priv = ((struct seq_file *)file->private_data)->private; 1369 priv->af = (unsigned long)PDE_DATA(inode); 1370 } 1371 return ret; 1372 } 1373 1374 static const struct file_operations xt_table_ops = { 1375 .open = xt_table_open, 1376 .read = seq_read, 1377 .llseek = seq_lseek, 1378 .release = seq_release_net, 1379 }; 1380 1381 /* 1382 * Traverse state for ip{,6}_{tables,matches} for helping crossing 1383 * the multi-AF mutexes. 1384 */ 1385 struct nf_mttg_trav { 1386 struct list_head *head, *curr; 1387 uint8_t class, nfproto; 1388 }; 1389 1390 enum { 1391 MTTG_TRAV_INIT, 1392 MTTG_TRAV_NFP_UNSPEC, 1393 MTTG_TRAV_NFP_SPEC, 1394 MTTG_TRAV_DONE, 1395 }; 1396 1397 static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos, 1398 bool is_target) 1399 { 1400 static const uint8_t next_class[] = { 1401 [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC, 1402 [MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE, 1403 }; 1404 struct nf_mttg_trav *trav = seq->private; 1405 1406 switch (trav->class) { 1407 case MTTG_TRAV_INIT: 1408 trav->class = MTTG_TRAV_NFP_UNSPEC; 1409 mutex_lock(&xt[NFPROTO_UNSPEC].mutex); 1410 trav->head = trav->curr = is_target ? 1411 &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match; 1412 break; 1413 case MTTG_TRAV_NFP_UNSPEC: 1414 trav->curr = trav->curr->next; 1415 if (trav->curr != trav->head) 1416 break; 1417 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex); 1418 mutex_lock(&xt[trav->nfproto].mutex); 1419 trav->head = trav->curr = is_target ? 1420 &xt[trav->nfproto].target : &xt[trav->nfproto].match; 1421 trav->class = next_class[trav->class]; 1422 break; 1423 case MTTG_TRAV_NFP_SPEC: 1424 trav->curr = trav->curr->next; 1425 if (trav->curr != trav->head) 1426 break; 1427 /* fall through */ 1428 default: 1429 return NULL; 1430 } 1431 1432 if (ppos != NULL) 1433 ++*ppos; 1434 return trav; 1435 } 1436 1437 static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos, 1438 bool is_target) 1439 { 1440 struct nf_mttg_trav *trav = seq->private; 1441 unsigned int j; 1442 1443 trav->class = MTTG_TRAV_INIT; 1444 for (j = 0; j < *pos; ++j) 1445 if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL) 1446 return NULL; 1447 return trav; 1448 } 1449 1450 static void xt_mttg_seq_stop(struct seq_file *seq, void *v) 1451 { 1452 struct nf_mttg_trav *trav = seq->private; 1453 1454 switch (trav->class) { 1455 case MTTG_TRAV_NFP_UNSPEC: 1456 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex); 1457 break; 1458 case MTTG_TRAV_NFP_SPEC: 1459 mutex_unlock(&xt[trav->nfproto].mutex); 1460 break; 1461 } 1462 } 1463 1464 static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos) 1465 { 1466 return xt_mttg_seq_start(seq, pos, false); 1467 } 1468 1469 static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos) 1470 { 1471 return xt_mttg_seq_next(seq, v, ppos, false); 1472 } 1473 1474 static int xt_match_seq_show(struct seq_file *seq, void *v) 1475 { 1476 const struct nf_mttg_trav *trav = seq->private; 1477 const struct xt_match *match; 1478 1479 switch (trav->class) { 1480 case MTTG_TRAV_NFP_UNSPEC: 1481 case MTTG_TRAV_NFP_SPEC: 1482 if (trav->curr == trav->head) 1483 return 0; 1484 match = list_entry(trav->curr, struct xt_match, list); 1485 if (*match->name) 1486 seq_printf(seq, "%s\n", match->name); 1487 } 1488 return 0; 1489 } 1490 1491 static const struct seq_operations xt_match_seq_ops = { 1492 .start = xt_match_seq_start, 1493 .next = xt_match_seq_next, 1494 .stop = xt_mttg_seq_stop, 1495 .show = xt_match_seq_show, 1496 }; 1497 1498 static int xt_match_open(struct inode *inode, struct file *file) 1499 { 1500 struct nf_mttg_trav *trav; 1501 trav = __seq_open_private(file, &xt_match_seq_ops, sizeof(*trav)); 1502 if (!trav) 1503 return -ENOMEM; 1504 1505 trav->nfproto = (unsigned long)PDE_DATA(inode); 1506 return 0; 1507 } 1508 1509 static const struct file_operations xt_match_ops = { 1510 .open = xt_match_open, 1511 .read = seq_read, 1512 .llseek = seq_lseek, 1513 .release = seq_release_private, 1514 }; 1515 1516 static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos) 1517 { 1518 return xt_mttg_seq_start(seq, pos, true); 1519 } 1520 1521 static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos) 1522 { 1523 return xt_mttg_seq_next(seq, v, ppos, true); 1524 } 1525 1526 static int xt_target_seq_show(struct seq_file *seq, void *v) 1527 { 1528 const struct nf_mttg_trav *trav = seq->private; 1529 const struct xt_target *target; 1530 1531 switch (trav->class) { 1532 case MTTG_TRAV_NFP_UNSPEC: 1533 case MTTG_TRAV_NFP_SPEC: 1534 if (trav->curr == trav->head) 1535 return 0; 1536 target = list_entry(trav->curr, struct xt_target, list); 1537 if (*target->name) 1538 seq_printf(seq, "%s\n", target->name); 1539 } 1540 return 0; 1541 } 1542 1543 static const struct seq_operations xt_target_seq_ops = { 1544 .start = xt_target_seq_start, 1545 .next = xt_target_seq_next, 1546 .stop = xt_mttg_seq_stop, 1547 .show = xt_target_seq_show, 1548 }; 1549 1550 static int xt_target_open(struct inode *inode, struct file *file) 1551 { 1552 struct nf_mttg_trav *trav; 1553 trav = __seq_open_private(file, &xt_target_seq_ops, sizeof(*trav)); 1554 if (!trav) 1555 return -ENOMEM; 1556 1557 trav->nfproto = (unsigned long)PDE_DATA(inode); 1558 return 0; 1559 } 1560 1561 static const struct file_operations xt_target_ops = { 1562 .open = xt_target_open, 1563 .read = seq_read, 1564 .llseek = seq_lseek, 1565 .release = seq_release_private, 1566 }; 1567 1568 #define FORMAT_TABLES "_tables_names" 1569 #define FORMAT_MATCHES "_tables_matches" 1570 #define FORMAT_TARGETS "_tables_targets" 1571 1572 #endif /* CONFIG_PROC_FS */ 1573 1574 /** 1575 * xt_hook_ops_alloc - set up hooks for a new table 1576 * @table: table with metadata needed to set up hooks 1577 * @fn: Hook function 1578 * 1579 * This function will create the nf_hook_ops that the x_table needs 1580 * to hand to xt_hook_link_net(). 1581 */ 1582 struct nf_hook_ops * 1583 xt_hook_ops_alloc(const struct xt_table *table, nf_hookfn *fn) 1584 { 1585 unsigned int hook_mask = table->valid_hooks; 1586 uint8_t i, num_hooks = hweight32(hook_mask); 1587 uint8_t hooknum; 1588 struct nf_hook_ops *ops; 1589 1590 if (!num_hooks) 1591 return ERR_PTR(-EINVAL); 1592 1593 ops = kcalloc(num_hooks, sizeof(*ops), GFP_KERNEL); 1594 if (ops == NULL) 1595 return ERR_PTR(-ENOMEM); 1596 1597 for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0; 1598 hook_mask >>= 1, ++hooknum) { 1599 if (!(hook_mask & 1)) 1600 continue; 1601 ops[i].hook = fn; 1602 ops[i].pf = table->af; 1603 ops[i].hooknum = hooknum; 1604 ops[i].priority = table->priority; 1605 ++i; 1606 } 1607 1608 return ops; 1609 } 1610 EXPORT_SYMBOL_GPL(xt_hook_ops_alloc); 1611 1612 int xt_proto_init(struct net *net, u_int8_t af) 1613 { 1614 #ifdef CONFIG_PROC_FS 1615 char buf[XT_FUNCTION_MAXNAMELEN]; 1616 struct proc_dir_entry *proc; 1617 kuid_t root_uid; 1618 kgid_t root_gid; 1619 #endif 1620 1621 if (af >= ARRAY_SIZE(xt_prefix)) 1622 return -EINVAL; 1623 1624 1625 #ifdef CONFIG_PROC_FS 1626 root_uid = make_kuid(net->user_ns, 0); 1627 root_gid = make_kgid(net->user_ns, 0); 1628 1629 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1630 strlcat(buf, FORMAT_TABLES, sizeof(buf)); 1631 proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops, 1632 (void *)(unsigned long)af); 1633 if (!proc) 1634 goto out; 1635 if (uid_valid(root_uid) && gid_valid(root_gid)) 1636 proc_set_user(proc, root_uid, root_gid); 1637 1638 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1639 strlcat(buf, FORMAT_MATCHES, sizeof(buf)); 1640 proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops, 1641 (void *)(unsigned long)af); 1642 if (!proc) 1643 goto out_remove_tables; 1644 if (uid_valid(root_uid) && gid_valid(root_gid)) 1645 proc_set_user(proc, root_uid, root_gid); 1646 1647 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1648 strlcat(buf, FORMAT_TARGETS, sizeof(buf)); 1649 proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops, 1650 (void *)(unsigned long)af); 1651 if (!proc) 1652 goto out_remove_matches; 1653 if (uid_valid(root_uid) && gid_valid(root_gid)) 1654 proc_set_user(proc, root_uid, root_gid); 1655 #endif 1656 1657 return 0; 1658 1659 #ifdef CONFIG_PROC_FS 1660 out_remove_matches: 1661 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1662 strlcat(buf, FORMAT_MATCHES, sizeof(buf)); 1663 remove_proc_entry(buf, net->proc_net); 1664 1665 out_remove_tables: 1666 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1667 strlcat(buf, FORMAT_TABLES, sizeof(buf)); 1668 remove_proc_entry(buf, net->proc_net); 1669 out: 1670 return -1; 1671 #endif 1672 } 1673 EXPORT_SYMBOL_GPL(xt_proto_init); 1674 1675 void xt_proto_fini(struct net *net, u_int8_t af) 1676 { 1677 #ifdef CONFIG_PROC_FS 1678 char buf[XT_FUNCTION_MAXNAMELEN]; 1679 1680 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1681 strlcat(buf, FORMAT_TABLES, sizeof(buf)); 1682 remove_proc_entry(buf, net->proc_net); 1683 1684 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1685 strlcat(buf, FORMAT_TARGETS, sizeof(buf)); 1686 remove_proc_entry(buf, net->proc_net); 1687 1688 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1689 strlcat(buf, FORMAT_MATCHES, sizeof(buf)); 1690 remove_proc_entry(buf, net->proc_net); 1691 #endif /*CONFIG_PROC_FS*/ 1692 } 1693 EXPORT_SYMBOL_GPL(xt_proto_fini); 1694 1695 /** 1696 * xt_percpu_counter_alloc - allocate x_tables rule counter 1697 * 1698 * @state: pointer to xt_percpu allocation state 1699 * @counter: pointer to counter struct inside the ip(6)/arpt_entry struct 1700 * 1701 * On SMP, the packet counter [ ip(6)t_entry->counters.pcnt ] will then 1702 * contain the address of the real (percpu) counter. 1703 * 1704 * Rule evaluation needs to use xt_get_this_cpu_counter() helper 1705 * to fetch the real percpu counter. 1706 * 1707 * To speed up allocation and improve data locality, a 4kb block is 1708 * allocated. 1709 * 1710 * xt_percpu_counter_alloc_state contains the base address of the 1711 * allocated page and the current sub-offset. 1712 * 1713 * returns false on error. 1714 */ 1715 bool xt_percpu_counter_alloc(struct xt_percpu_counter_alloc_state *state, 1716 struct xt_counters *counter) 1717 { 1718 BUILD_BUG_ON(XT_PCPU_BLOCK_SIZE < (sizeof(*counter) * 2)); 1719 1720 if (nr_cpu_ids <= 1) 1721 return true; 1722 1723 if (!state->mem) { 1724 state->mem = __alloc_percpu(XT_PCPU_BLOCK_SIZE, 1725 XT_PCPU_BLOCK_SIZE); 1726 if (!state->mem) 1727 return false; 1728 } 1729 counter->pcnt = (__force unsigned long)(state->mem + state->off); 1730 state->off += sizeof(*counter); 1731 if (state->off > (XT_PCPU_BLOCK_SIZE - sizeof(*counter))) { 1732 state->mem = NULL; 1733 state->off = 0; 1734 } 1735 return true; 1736 } 1737 EXPORT_SYMBOL_GPL(xt_percpu_counter_alloc); 1738 1739 void xt_percpu_counter_free(struct xt_counters *counters) 1740 { 1741 unsigned long pcnt = counters->pcnt; 1742 1743 if (nr_cpu_ids > 1 && (pcnt & (XT_PCPU_BLOCK_SIZE - 1)) == 0) 1744 free_percpu((void __percpu *)pcnt); 1745 } 1746 EXPORT_SYMBOL_GPL(xt_percpu_counter_free); 1747 1748 static int __net_init xt_net_init(struct net *net) 1749 { 1750 int i; 1751 1752 for (i = 0; i < NFPROTO_NUMPROTO; i++) 1753 INIT_LIST_HEAD(&net->xt.tables[i]); 1754 return 0; 1755 } 1756 1757 static void __net_exit xt_net_exit(struct net *net) 1758 { 1759 int i; 1760 1761 for (i = 0; i < NFPROTO_NUMPROTO; i++) 1762 WARN_ON_ONCE(!list_empty(&net->xt.tables[i])); 1763 } 1764 1765 static struct pernet_operations xt_net_ops = { 1766 .init = xt_net_init, 1767 .exit = xt_net_exit, 1768 }; 1769 1770 static int __init xt_init(void) 1771 { 1772 unsigned int i; 1773 int rv; 1774 1775 for_each_possible_cpu(i) { 1776 seqcount_init(&per_cpu(xt_recseq, i)); 1777 } 1778 1779 xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL); 1780 if (!xt) 1781 return -ENOMEM; 1782 1783 for (i = 0; i < NFPROTO_NUMPROTO; i++) { 1784 mutex_init(&xt[i].mutex); 1785 #ifdef CONFIG_COMPAT 1786 mutex_init(&xt[i].compat_mutex); 1787 xt[i].compat_tab = NULL; 1788 #endif 1789 INIT_LIST_HEAD(&xt[i].target); 1790 INIT_LIST_HEAD(&xt[i].match); 1791 } 1792 rv = register_pernet_subsys(&xt_net_ops); 1793 if (rv < 0) 1794 kfree(xt); 1795 return rv; 1796 } 1797 1798 static void __exit xt_fini(void) 1799 { 1800 unregister_pernet_subsys(&xt_net_ops); 1801 kfree(xt); 1802 } 1803 1804 module_init(xt_init); 1805 module_exit(xt_fini); 1806 1807