1 /* 2 * x_tables core - Backend for {ip,ip6,arp}_tables 3 * 4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org> 5 * Copyright (C) 2006-2012 Patrick McHardy <kaber@trash.net> 6 * 7 * Based on existing ip_tables code which is 8 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 9 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org> 10 * 11 * This program is free software; you can redistribute it and/or modify 12 * it under the terms of the GNU General Public License version 2 as 13 * published by the Free Software Foundation. 14 * 15 */ 16 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 17 #include <linux/kernel.h> 18 #include <linux/module.h> 19 #include <linux/socket.h> 20 #include <linux/net.h> 21 #include <linux/proc_fs.h> 22 #include <linux/seq_file.h> 23 #include <linux/string.h> 24 #include <linux/vmalloc.h> 25 #include <linux/mutex.h> 26 #include <linux/mm.h> 27 #include <linux/slab.h> 28 #include <linux/audit.h> 29 #include <net/net_namespace.h> 30 31 #include <linux/netfilter/x_tables.h> 32 #include <linux/netfilter_arp.h> 33 #include <linux/netfilter_ipv4/ip_tables.h> 34 #include <linux/netfilter_ipv6/ip6_tables.h> 35 #include <linux/netfilter_arp/arp_tables.h> 36 37 MODULE_LICENSE("GPL"); 38 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 39 MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); 40 41 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) 42 43 struct compat_delta { 44 unsigned int offset; /* offset in kernel */ 45 int delta; /* delta in 32bit user land */ 46 }; 47 48 struct xt_af { 49 struct mutex mutex; 50 struct list_head match; 51 struct list_head target; 52 #ifdef CONFIG_COMPAT 53 struct mutex compat_mutex; 54 struct compat_delta *compat_tab; 55 unsigned int number; /* number of slots in compat_tab[] */ 56 unsigned int cur; /* number of used slots in compat_tab[] */ 57 #endif 58 }; 59 60 static struct xt_af *xt; 61 62 static const char *const xt_prefix[NFPROTO_NUMPROTO] = { 63 [NFPROTO_UNSPEC] = "x", 64 [NFPROTO_IPV4] = "ip", 65 [NFPROTO_ARP] = "arp", 66 [NFPROTO_BRIDGE] = "eb", 67 [NFPROTO_IPV6] = "ip6", 68 }; 69 70 /* Registration hooks for targets. */ 71 int xt_register_target(struct xt_target *target) 72 { 73 u_int8_t af = target->family; 74 75 mutex_lock(&xt[af].mutex); 76 list_add(&target->list, &xt[af].target); 77 mutex_unlock(&xt[af].mutex); 78 return 0; 79 } 80 EXPORT_SYMBOL(xt_register_target); 81 82 void 83 xt_unregister_target(struct xt_target *target) 84 { 85 u_int8_t af = target->family; 86 87 mutex_lock(&xt[af].mutex); 88 list_del(&target->list); 89 mutex_unlock(&xt[af].mutex); 90 } 91 EXPORT_SYMBOL(xt_unregister_target); 92 93 int 94 xt_register_targets(struct xt_target *target, unsigned int n) 95 { 96 unsigned int i; 97 int err = 0; 98 99 for (i = 0; i < n; i++) { 100 err = xt_register_target(&target[i]); 101 if (err) 102 goto err; 103 } 104 return err; 105 106 err: 107 if (i > 0) 108 xt_unregister_targets(target, i); 109 return err; 110 } 111 EXPORT_SYMBOL(xt_register_targets); 112 113 void 114 xt_unregister_targets(struct xt_target *target, unsigned int n) 115 { 116 while (n-- > 0) 117 xt_unregister_target(&target[n]); 118 } 119 EXPORT_SYMBOL(xt_unregister_targets); 120 121 int xt_register_match(struct xt_match *match) 122 { 123 u_int8_t af = match->family; 124 125 mutex_lock(&xt[af].mutex); 126 list_add(&match->list, &xt[af].match); 127 mutex_unlock(&xt[af].mutex); 128 return 0; 129 } 130 EXPORT_SYMBOL(xt_register_match); 131 132 void 133 xt_unregister_match(struct xt_match *match) 134 { 135 u_int8_t af = match->family; 136 137 mutex_lock(&xt[af].mutex); 138 list_del(&match->list); 139 mutex_unlock(&xt[af].mutex); 140 } 141 EXPORT_SYMBOL(xt_unregister_match); 142 143 int 144 xt_register_matches(struct xt_match *match, unsigned int n) 145 { 146 unsigned int i; 147 int err = 0; 148 149 for (i = 0; i < n; i++) { 150 err = xt_register_match(&match[i]); 151 if (err) 152 goto err; 153 } 154 return err; 155 156 err: 157 if (i > 0) 158 xt_unregister_matches(match, i); 159 return err; 160 } 161 EXPORT_SYMBOL(xt_register_matches); 162 163 void 164 xt_unregister_matches(struct xt_match *match, unsigned int n) 165 { 166 while (n-- > 0) 167 xt_unregister_match(&match[n]); 168 } 169 EXPORT_SYMBOL(xt_unregister_matches); 170 171 172 /* 173 * These are weird, but module loading must not be done with mutex 174 * held (since they will register), and we have to have a single 175 * function to use. 176 */ 177 178 /* Find match, grabs ref. Returns ERR_PTR() on error. */ 179 struct xt_match *xt_find_match(u8 af, const char *name, u8 revision) 180 { 181 struct xt_match *m; 182 int err = -ENOENT; 183 184 mutex_lock(&xt[af].mutex); 185 list_for_each_entry(m, &xt[af].match, list) { 186 if (strcmp(m->name, name) == 0) { 187 if (m->revision == revision) { 188 if (try_module_get(m->me)) { 189 mutex_unlock(&xt[af].mutex); 190 return m; 191 } 192 } else 193 err = -EPROTOTYPE; /* Found something. */ 194 } 195 } 196 mutex_unlock(&xt[af].mutex); 197 198 if (af != NFPROTO_UNSPEC) 199 /* Try searching again in the family-independent list */ 200 return xt_find_match(NFPROTO_UNSPEC, name, revision); 201 202 return ERR_PTR(err); 203 } 204 EXPORT_SYMBOL(xt_find_match); 205 206 struct xt_match * 207 xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision) 208 { 209 struct xt_match *match; 210 211 match = xt_find_match(nfproto, name, revision); 212 if (IS_ERR(match)) { 213 request_module("%st_%s", xt_prefix[nfproto], name); 214 match = xt_find_match(nfproto, name, revision); 215 } 216 217 return match; 218 } 219 EXPORT_SYMBOL_GPL(xt_request_find_match); 220 221 /* Find target, grabs ref. Returns ERR_PTR() on error. */ 222 struct xt_target *xt_find_target(u8 af, const char *name, u8 revision) 223 { 224 struct xt_target *t; 225 int err = -ENOENT; 226 227 mutex_lock(&xt[af].mutex); 228 list_for_each_entry(t, &xt[af].target, list) { 229 if (strcmp(t->name, name) == 0) { 230 if (t->revision == revision) { 231 if (try_module_get(t->me)) { 232 mutex_unlock(&xt[af].mutex); 233 return t; 234 } 235 } else 236 err = -EPROTOTYPE; /* Found something. */ 237 } 238 } 239 mutex_unlock(&xt[af].mutex); 240 241 if (af != NFPROTO_UNSPEC) 242 /* Try searching again in the family-independent list */ 243 return xt_find_target(NFPROTO_UNSPEC, name, revision); 244 245 return ERR_PTR(err); 246 } 247 EXPORT_SYMBOL(xt_find_target); 248 249 struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision) 250 { 251 struct xt_target *target; 252 253 target = xt_find_target(af, name, revision); 254 if (IS_ERR(target)) { 255 request_module("%st_%s", xt_prefix[af], name); 256 target = xt_find_target(af, name, revision); 257 } 258 259 return target; 260 } 261 EXPORT_SYMBOL_GPL(xt_request_find_target); 262 263 static int match_revfn(u8 af, const char *name, u8 revision, int *bestp) 264 { 265 const struct xt_match *m; 266 int have_rev = 0; 267 268 list_for_each_entry(m, &xt[af].match, list) { 269 if (strcmp(m->name, name) == 0) { 270 if (m->revision > *bestp) 271 *bestp = m->revision; 272 if (m->revision == revision) 273 have_rev = 1; 274 } 275 } 276 277 if (af != NFPROTO_UNSPEC && !have_rev) 278 return match_revfn(NFPROTO_UNSPEC, name, revision, bestp); 279 280 return have_rev; 281 } 282 283 static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) 284 { 285 const struct xt_target *t; 286 int have_rev = 0; 287 288 list_for_each_entry(t, &xt[af].target, list) { 289 if (strcmp(t->name, name) == 0) { 290 if (t->revision > *bestp) 291 *bestp = t->revision; 292 if (t->revision == revision) 293 have_rev = 1; 294 } 295 } 296 297 if (af != NFPROTO_UNSPEC && !have_rev) 298 return target_revfn(NFPROTO_UNSPEC, name, revision, bestp); 299 300 return have_rev; 301 } 302 303 /* Returns true or false (if no such extension at all) */ 304 int xt_find_revision(u8 af, const char *name, u8 revision, int target, 305 int *err) 306 { 307 int have_rev, best = -1; 308 309 mutex_lock(&xt[af].mutex); 310 if (target == 1) 311 have_rev = target_revfn(af, name, revision, &best); 312 else 313 have_rev = match_revfn(af, name, revision, &best); 314 mutex_unlock(&xt[af].mutex); 315 316 /* Nothing at all? Return 0 to try loading module. */ 317 if (best == -1) { 318 *err = -ENOENT; 319 return 0; 320 } 321 322 *err = best; 323 if (!have_rev) 324 *err = -EPROTONOSUPPORT; 325 return 1; 326 } 327 EXPORT_SYMBOL_GPL(xt_find_revision); 328 329 static char * 330 textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto) 331 { 332 static const char *const inetbr_names[] = { 333 "PREROUTING", "INPUT", "FORWARD", 334 "OUTPUT", "POSTROUTING", "BROUTING", 335 }; 336 static const char *const arp_names[] = { 337 "INPUT", "FORWARD", "OUTPUT", 338 }; 339 const char *const *names; 340 unsigned int i, max; 341 char *p = buf; 342 bool np = false; 343 int res; 344 345 names = (nfproto == NFPROTO_ARP) ? arp_names : inetbr_names; 346 max = (nfproto == NFPROTO_ARP) ? ARRAY_SIZE(arp_names) : 347 ARRAY_SIZE(inetbr_names); 348 *p = '\0'; 349 for (i = 0; i < max; ++i) { 350 if (!(mask & (1 << i))) 351 continue; 352 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]); 353 if (res > 0) { 354 size -= res; 355 p += res; 356 } 357 np = true; 358 } 359 360 return buf; 361 } 362 363 int xt_check_match(struct xt_mtchk_param *par, 364 unsigned int size, u_int8_t proto, bool inv_proto) 365 { 366 int ret; 367 368 if (XT_ALIGN(par->match->matchsize) != size && 369 par->match->matchsize != -1) { 370 /* 371 * ebt_among is exempt from centralized matchsize checking 372 * because it uses a dynamic-size data set. 373 */ 374 pr_err("%s_tables: %s.%u match: invalid size " 375 "%u (kernel) != (user) %u\n", 376 xt_prefix[par->family], par->match->name, 377 par->match->revision, 378 XT_ALIGN(par->match->matchsize), size); 379 return -EINVAL; 380 } 381 if (par->match->table != NULL && 382 strcmp(par->match->table, par->table) != 0) { 383 pr_err("%s_tables: %s match: only valid in %s table, not %s\n", 384 xt_prefix[par->family], par->match->name, 385 par->match->table, par->table); 386 return -EINVAL; 387 } 388 if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) { 389 char used[64], allow[64]; 390 391 pr_err("%s_tables: %s match: used from hooks %s, but only " 392 "valid from %s\n", 393 xt_prefix[par->family], par->match->name, 394 textify_hooks(used, sizeof(used), par->hook_mask, 395 par->family), 396 textify_hooks(allow, sizeof(allow), par->match->hooks, 397 par->family)); 398 return -EINVAL; 399 } 400 if (par->match->proto && (par->match->proto != proto || inv_proto)) { 401 pr_err("%s_tables: %s match: only valid for protocol %u\n", 402 xt_prefix[par->family], par->match->name, 403 par->match->proto); 404 return -EINVAL; 405 } 406 if (par->match->checkentry != NULL) { 407 ret = par->match->checkentry(par); 408 if (ret < 0) 409 return ret; 410 else if (ret > 0) 411 /* Flag up potential errors. */ 412 return -EIO; 413 } 414 return 0; 415 } 416 EXPORT_SYMBOL_GPL(xt_check_match); 417 418 #ifdef CONFIG_COMPAT 419 int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta) 420 { 421 struct xt_af *xp = &xt[af]; 422 423 if (!xp->compat_tab) { 424 if (!xp->number) 425 return -EINVAL; 426 xp->compat_tab = vmalloc(sizeof(struct compat_delta) * xp->number); 427 if (!xp->compat_tab) 428 return -ENOMEM; 429 xp->cur = 0; 430 } 431 432 if (xp->cur >= xp->number) 433 return -EINVAL; 434 435 if (xp->cur) 436 delta += xp->compat_tab[xp->cur - 1].delta; 437 xp->compat_tab[xp->cur].offset = offset; 438 xp->compat_tab[xp->cur].delta = delta; 439 xp->cur++; 440 return 0; 441 } 442 EXPORT_SYMBOL_GPL(xt_compat_add_offset); 443 444 void xt_compat_flush_offsets(u_int8_t af) 445 { 446 if (xt[af].compat_tab) { 447 vfree(xt[af].compat_tab); 448 xt[af].compat_tab = NULL; 449 xt[af].number = 0; 450 xt[af].cur = 0; 451 } 452 } 453 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets); 454 455 int xt_compat_calc_jump(u_int8_t af, unsigned int offset) 456 { 457 struct compat_delta *tmp = xt[af].compat_tab; 458 int mid, left = 0, right = xt[af].cur - 1; 459 460 while (left <= right) { 461 mid = (left + right) >> 1; 462 if (offset > tmp[mid].offset) 463 left = mid + 1; 464 else if (offset < tmp[mid].offset) 465 right = mid - 1; 466 else 467 return mid ? tmp[mid - 1].delta : 0; 468 } 469 return left ? tmp[left - 1].delta : 0; 470 } 471 EXPORT_SYMBOL_GPL(xt_compat_calc_jump); 472 473 void xt_compat_init_offsets(u_int8_t af, unsigned int number) 474 { 475 xt[af].number = number; 476 xt[af].cur = 0; 477 } 478 EXPORT_SYMBOL(xt_compat_init_offsets); 479 480 int xt_compat_match_offset(const struct xt_match *match) 481 { 482 u_int16_t csize = match->compatsize ? : match->matchsize; 483 return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize); 484 } 485 EXPORT_SYMBOL_GPL(xt_compat_match_offset); 486 487 int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, 488 unsigned int *size) 489 { 490 const struct xt_match *match = m->u.kernel.match; 491 struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m; 492 int pad, off = xt_compat_match_offset(match); 493 u_int16_t msize = cm->u.user.match_size; 494 495 m = *dstptr; 496 memcpy(m, cm, sizeof(*cm)); 497 if (match->compat_from_user) 498 match->compat_from_user(m->data, cm->data); 499 else 500 memcpy(m->data, cm->data, msize - sizeof(*cm)); 501 pad = XT_ALIGN(match->matchsize) - match->matchsize; 502 if (pad > 0) 503 memset(m->data + match->matchsize, 0, pad); 504 505 msize += off; 506 m->u.user.match_size = msize; 507 508 *size += off; 509 *dstptr += msize; 510 return 0; 511 } 512 EXPORT_SYMBOL_GPL(xt_compat_match_from_user); 513 514 int xt_compat_match_to_user(const struct xt_entry_match *m, 515 void __user **dstptr, unsigned int *size) 516 { 517 const struct xt_match *match = m->u.kernel.match; 518 struct compat_xt_entry_match __user *cm = *dstptr; 519 int off = xt_compat_match_offset(match); 520 u_int16_t msize = m->u.user.match_size - off; 521 522 if (copy_to_user(cm, m, sizeof(*cm)) || 523 put_user(msize, &cm->u.user.match_size) || 524 copy_to_user(cm->u.user.name, m->u.kernel.match->name, 525 strlen(m->u.kernel.match->name) + 1)) 526 return -EFAULT; 527 528 if (match->compat_to_user) { 529 if (match->compat_to_user((void __user *)cm->data, m->data)) 530 return -EFAULT; 531 } else { 532 if (copy_to_user(cm->data, m->data, msize - sizeof(*cm))) 533 return -EFAULT; 534 } 535 536 *size -= off; 537 *dstptr += msize; 538 return 0; 539 } 540 EXPORT_SYMBOL_GPL(xt_compat_match_to_user); 541 #endif /* CONFIG_COMPAT */ 542 543 int xt_check_target(struct xt_tgchk_param *par, 544 unsigned int size, u_int8_t proto, bool inv_proto) 545 { 546 int ret; 547 548 if (XT_ALIGN(par->target->targetsize) != size) { 549 pr_err("%s_tables: %s.%u target: invalid size " 550 "%u (kernel) != (user) %u\n", 551 xt_prefix[par->family], par->target->name, 552 par->target->revision, 553 XT_ALIGN(par->target->targetsize), size); 554 return -EINVAL; 555 } 556 if (par->target->table != NULL && 557 strcmp(par->target->table, par->table) != 0) { 558 pr_err("%s_tables: %s target: only valid in %s table, not %s\n", 559 xt_prefix[par->family], par->target->name, 560 par->target->table, par->table); 561 return -EINVAL; 562 } 563 if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) { 564 char used[64], allow[64]; 565 566 pr_err("%s_tables: %s target: used from hooks %s, but only " 567 "usable from %s\n", 568 xt_prefix[par->family], par->target->name, 569 textify_hooks(used, sizeof(used), par->hook_mask, 570 par->family), 571 textify_hooks(allow, sizeof(allow), par->target->hooks, 572 par->family)); 573 return -EINVAL; 574 } 575 if (par->target->proto && (par->target->proto != proto || inv_proto)) { 576 pr_err("%s_tables: %s target: only valid for protocol %u\n", 577 xt_prefix[par->family], par->target->name, 578 par->target->proto); 579 return -EINVAL; 580 } 581 if (par->target->checkentry != NULL) { 582 ret = par->target->checkentry(par); 583 if (ret < 0) 584 return ret; 585 else if (ret > 0) 586 /* Flag up potential errors. */ 587 return -EIO; 588 } 589 return 0; 590 } 591 EXPORT_SYMBOL_GPL(xt_check_target); 592 593 #ifdef CONFIG_COMPAT 594 int xt_compat_target_offset(const struct xt_target *target) 595 { 596 u_int16_t csize = target->compatsize ? : target->targetsize; 597 return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize); 598 } 599 EXPORT_SYMBOL_GPL(xt_compat_target_offset); 600 601 void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, 602 unsigned int *size) 603 { 604 const struct xt_target *target = t->u.kernel.target; 605 struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t; 606 int pad, off = xt_compat_target_offset(target); 607 u_int16_t tsize = ct->u.user.target_size; 608 609 t = *dstptr; 610 memcpy(t, ct, sizeof(*ct)); 611 if (target->compat_from_user) 612 target->compat_from_user(t->data, ct->data); 613 else 614 memcpy(t->data, ct->data, tsize - sizeof(*ct)); 615 pad = XT_ALIGN(target->targetsize) - target->targetsize; 616 if (pad > 0) 617 memset(t->data + target->targetsize, 0, pad); 618 619 tsize += off; 620 t->u.user.target_size = tsize; 621 622 *size += off; 623 *dstptr += tsize; 624 } 625 EXPORT_SYMBOL_GPL(xt_compat_target_from_user); 626 627 int xt_compat_target_to_user(const struct xt_entry_target *t, 628 void __user **dstptr, unsigned int *size) 629 { 630 const struct xt_target *target = t->u.kernel.target; 631 struct compat_xt_entry_target __user *ct = *dstptr; 632 int off = xt_compat_target_offset(target); 633 u_int16_t tsize = t->u.user.target_size - off; 634 635 if (copy_to_user(ct, t, sizeof(*ct)) || 636 put_user(tsize, &ct->u.user.target_size) || 637 copy_to_user(ct->u.user.name, t->u.kernel.target->name, 638 strlen(t->u.kernel.target->name) + 1)) 639 return -EFAULT; 640 641 if (target->compat_to_user) { 642 if (target->compat_to_user((void __user *)ct->data, t->data)) 643 return -EFAULT; 644 } else { 645 if (copy_to_user(ct->data, t->data, tsize - sizeof(*ct))) 646 return -EFAULT; 647 } 648 649 *size -= off; 650 *dstptr += tsize; 651 return 0; 652 } 653 EXPORT_SYMBOL_GPL(xt_compat_target_to_user); 654 #endif 655 656 struct xt_table_info *xt_alloc_table_info(unsigned int size) 657 { 658 struct xt_table_info *info = NULL; 659 size_t sz = sizeof(*info) + size; 660 661 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ 662 if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) 663 return NULL; 664 665 if (sz <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) 666 info = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); 667 if (!info) { 668 info = vmalloc(sz); 669 if (!info) 670 return NULL; 671 } 672 memset(info, 0, sizeof(*info)); 673 info->size = size; 674 return info; 675 } 676 EXPORT_SYMBOL(xt_alloc_table_info); 677 678 void xt_free_table_info(struct xt_table_info *info) 679 { 680 int cpu; 681 682 if (info->jumpstack != NULL) { 683 for_each_possible_cpu(cpu) 684 kvfree(info->jumpstack[cpu]); 685 kvfree(info->jumpstack); 686 } 687 688 kvfree(info); 689 } 690 EXPORT_SYMBOL(xt_free_table_info); 691 692 /* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */ 693 struct xt_table *xt_find_table_lock(struct net *net, u_int8_t af, 694 const char *name) 695 { 696 struct xt_table *t; 697 698 mutex_lock(&xt[af].mutex); 699 list_for_each_entry(t, &net->xt.tables[af], list) 700 if (strcmp(t->name, name) == 0 && try_module_get(t->me)) 701 return t; 702 mutex_unlock(&xt[af].mutex); 703 return NULL; 704 } 705 EXPORT_SYMBOL_GPL(xt_find_table_lock); 706 707 void xt_table_unlock(struct xt_table *table) 708 { 709 mutex_unlock(&xt[table->af].mutex); 710 } 711 EXPORT_SYMBOL_GPL(xt_table_unlock); 712 713 #ifdef CONFIG_COMPAT 714 void xt_compat_lock(u_int8_t af) 715 { 716 mutex_lock(&xt[af].compat_mutex); 717 } 718 EXPORT_SYMBOL_GPL(xt_compat_lock); 719 720 void xt_compat_unlock(u_int8_t af) 721 { 722 mutex_unlock(&xt[af].compat_mutex); 723 } 724 EXPORT_SYMBOL_GPL(xt_compat_unlock); 725 #endif 726 727 DEFINE_PER_CPU(seqcount_t, xt_recseq); 728 EXPORT_PER_CPU_SYMBOL_GPL(xt_recseq); 729 730 struct static_key xt_tee_enabled __read_mostly; 731 EXPORT_SYMBOL_GPL(xt_tee_enabled); 732 733 static int xt_jumpstack_alloc(struct xt_table_info *i) 734 { 735 unsigned int size; 736 int cpu; 737 738 size = sizeof(void **) * nr_cpu_ids; 739 if (size > PAGE_SIZE) 740 i->jumpstack = vzalloc(size); 741 else 742 i->jumpstack = kzalloc(size, GFP_KERNEL); 743 if (i->jumpstack == NULL) 744 return -ENOMEM; 745 746 /* ruleset without jumps -- no stack needed */ 747 if (i->stacksize == 0) 748 return 0; 749 750 /* Jumpstack needs to be able to record two full callchains, one 751 * from the first rule set traversal, plus one table reentrancy 752 * via -j TEE without clobbering the callchain that brought us to 753 * TEE target. 754 * 755 * This is done by allocating two jumpstacks per cpu, on reentry 756 * the upper half of the stack is used. 757 * 758 * see the jumpstack setup in ipt_do_table() for more details. 759 */ 760 size = sizeof(void *) * i->stacksize * 2u; 761 for_each_possible_cpu(cpu) { 762 if (size > PAGE_SIZE) 763 i->jumpstack[cpu] = vmalloc_node(size, 764 cpu_to_node(cpu)); 765 else 766 i->jumpstack[cpu] = kmalloc_node(size, 767 GFP_KERNEL, cpu_to_node(cpu)); 768 if (i->jumpstack[cpu] == NULL) 769 /* 770 * Freeing will be done later on by the callers. The 771 * chain is: xt_replace_table -> __do_replace -> 772 * do_replace -> xt_free_table_info. 773 */ 774 return -ENOMEM; 775 } 776 777 return 0; 778 } 779 780 struct xt_table_info * 781 xt_replace_table(struct xt_table *table, 782 unsigned int num_counters, 783 struct xt_table_info *newinfo, 784 int *error) 785 { 786 struct xt_table_info *private; 787 int ret; 788 789 ret = xt_jumpstack_alloc(newinfo); 790 if (ret < 0) { 791 *error = ret; 792 return NULL; 793 } 794 795 /* Do the substitution. */ 796 local_bh_disable(); 797 private = table->private; 798 799 /* Check inside lock: is the old number correct? */ 800 if (num_counters != private->number) { 801 pr_debug("num_counters != table->private->number (%u/%u)\n", 802 num_counters, private->number); 803 local_bh_enable(); 804 *error = -EAGAIN; 805 return NULL; 806 } 807 808 newinfo->initial_entries = private->initial_entries; 809 /* 810 * Ensure contents of newinfo are visible before assigning to 811 * private. 812 */ 813 smp_wmb(); 814 table->private = newinfo; 815 816 /* 817 * Even though table entries have now been swapped, other CPU's 818 * may still be using the old entries. This is okay, because 819 * resynchronization happens because of the locking done 820 * during the get_counters() routine. 821 */ 822 local_bh_enable(); 823 824 #ifdef CONFIG_AUDIT 825 if (audit_enabled) { 826 struct audit_buffer *ab; 827 828 ab = audit_log_start(current->audit_context, GFP_KERNEL, 829 AUDIT_NETFILTER_CFG); 830 if (ab) { 831 audit_log_format(ab, "table=%s family=%u entries=%u", 832 table->name, table->af, 833 private->number); 834 audit_log_end(ab); 835 } 836 } 837 #endif 838 839 return private; 840 } 841 EXPORT_SYMBOL_GPL(xt_replace_table); 842 843 struct xt_table *xt_register_table(struct net *net, 844 const struct xt_table *input_table, 845 struct xt_table_info *bootstrap, 846 struct xt_table_info *newinfo) 847 { 848 int ret; 849 struct xt_table_info *private; 850 struct xt_table *t, *table; 851 852 /* Don't add one object to multiple lists. */ 853 table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL); 854 if (!table) { 855 ret = -ENOMEM; 856 goto out; 857 } 858 859 mutex_lock(&xt[table->af].mutex); 860 /* Don't autoload: we'd eat our tail... */ 861 list_for_each_entry(t, &net->xt.tables[table->af], list) { 862 if (strcmp(t->name, table->name) == 0) { 863 ret = -EEXIST; 864 goto unlock; 865 } 866 } 867 868 /* Simplifies replace_table code. */ 869 table->private = bootstrap; 870 871 if (!xt_replace_table(table, 0, newinfo, &ret)) 872 goto unlock; 873 874 private = table->private; 875 pr_debug("table->private->number = %u\n", private->number); 876 877 /* save number of initial entries */ 878 private->initial_entries = private->number; 879 880 list_add(&table->list, &net->xt.tables[table->af]); 881 mutex_unlock(&xt[table->af].mutex); 882 return table; 883 884 unlock: 885 mutex_unlock(&xt[table->af].mutex); 886 kfree(table); 887 out: 888 return ERR_PTR(ret); 889 } 890 EXPORT_SYMBOL_GPL(xt_register_table); 891 892 void *xt_unregister_table(struct xt_table *table) 893 { 894 struct xt_table_info *private; 895 896 mutex_lock(&xt[table->af].mutex); 897 private = table->private; 898 list_del(&table->list); 899 mutex_unlock(&xt[table->af].mutex); 900 kfree(table); 901 902 return private; 903 } 904 EXPORT_SYMBOL_GPL(xt_unregister_table); 905 906 #ifdef CONFIG_PROC_FS 907 struct xt_names_priv { 908 struct seq_net_private p; 909 u_int8_t af; 910 }; 911 static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos) 912 { 913 struct xt_names_priv *priv = seq->private; 914 struct net *net = seq_file_net(seq); 915 u_int8_t af = priv->af; 916 917 mutex_lock(&xt[af].mutex); 918 return seq_list_start(&net->xt.tables[af], *pos); 919 } 920 921 static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos) 922 { 923 struct xt_names_priv *priv = seq->private; 924 struct net *net = seq_file_net(seq); 925 u_int8_t af = priv->af; 926 927 return seq_list_next(v, &net->xt.tables[af], pos); 928 } 929 930 static void xt_table_seq_stop(struct seq_file *seq, void *v) 931 { 932 struct xt_names_priv *priv = seq->private; 933 u_int8_t af = priv->af; 934 935 mutex_unlock(&xt[af].mutex); 936 } 937 938 static int xt_table_seq_show(struct seq_file *seq, void *v) 939 { 940 struct xt_table *table = list_entry(v, struct xt_table, list); 941 942 if (*table->name) 943 seq_printf(seq, "%s\n", table->name); 944 return 0; 945 } 946 947 static const struct seq_operations xt_table_seq_ops = { 948 .start = xt_table_seq_start, 949 .next = xt_table_seq_next, 950 .stop = xt_table_seq_stop, 951 .show = xt_table_seq_show, 952 }; 953 954 static int xt_table_open(struct inode *inode, struct file *file) 955 { 956 int ret; 957 struct xt_names_priv *priv; 958 959 ret = seq_open_net(inode, file, &xt_table_seq_ops, 960 sizeof(struct xt_names_priv)); 961 if (!ret) { 962 priv = ((struct seq_file *)file->private_data)->private; 963 priv->af = (unsigned long)PDE_DATA(inode); 964 } 965 return ret; 966 } 967 968 static const struct file_operations xt_table_ops = { 969 .owner = THIS_MODULE, 970 .open = xt_table_open, 971 .read = seq_read, 972 .llseek = seq_lseek, 973 .release = seq_release_net, 974 }; 975 976 /* 977 * Traverse state for ip{,6}_{tables,matches} for helping crossing 978 * the multi-AF mutexes. 979 */ 980 struct nf_mttg_trav { 981 struct list_head *head, *curr; 982 uint8_t class, nfproto; 983 }; 984 985 enum { 986 MTTG_TRAV_INIT, 987 MTTG_TRAV_NFP_UNSPEC, 988 MTTG_TRAV_NFP_SPEC, 989 MTTG_TRAV_DONE, 990 }; 991 992 static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos, 993 bool is_target) 994 { 995 static const uint8_t next_class[] = { 996 [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC, 997 [MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE, 998 }; 999 struct nf_mttg_trav *trav = seq->private; 1000 1001 switch (trav->class) { 1002 case MTTG_TRAV_INIT: 1003 trav->class = MTTG_TRAV_NFP_UNSPEC; 1004 mutex_lock(&xt[NFPROTO_UNSPEC].mutex); 1005 trav->head = trav->curr = is_target ? 1006 &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match; 1007 break; 1008 case MTTG_TRAV_NFP_UNSPEC: 1009 trav->curr = trav->curr->next; 1010 if (trav->curr != trav->head) 1011 break; 1012 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex); 1013 mutex_lock(&xt[trav->nfproto].mutex); 1014 trav->head = trav->curr = is_target ? 1015 &xt[trav->nfproto].target : &xt[trav->nfproto].match; 1016 trav->class = next_class[trav->class]; 1017 break; 1018 case MTTG_TRAV_NFP_SPEC: 1019 trav->curr = trav->curr->next; 1020 if (trav->curr != trav->head) 1021 break; 1022 /* fallthru, _stop will unlock */ 1023 default: 1024 return NULL; 1025 } 1026 1027 if (ppos != NULL) 1028 ++*ppos; 1029 return trav; 1030 } 1031 1032 static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos, 1033 bool is_target) 1034 { 1035 struct nf_mttg_trav *trav = seq->private; 1036 unsigned int j; 1037 1038 trav->class = MTTG_TRAV_INIT; 1039 for (j = 0; j < *pos; ++j) 1040 if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL) 1041 return NULL; 1042 return trav; 1043 } 1044 1045 static void xt_mttg_seq_stop(struct seq_file *seq, void *v) 1046 { 1047 struct nf_mttg_trav *trav = seq->private; 1048 1049 switch (trav->class) { 1050 case MTTG_TRAV_NFP_UNSPEC: 1051 mutex_unlock(&xt[NFPROTO_UNSPEC].mutex); 1052 break; 1053 case MTTG_TRAV_NFP_SPEC: 1054 mutex_unlock(&xt[trav->nfproto].mutex); 1055 break; 1056 } 1057 } 1058 1059 static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos) 1060 { 1061 return xt_mttg_seq_start(seq, pos, false); 1062 } 1063 1064 static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos) 1065 { 1066 return xt_mttg_seq_next(seq, v, ppos, false); 1067 } 1068 1069 static int xt_match_seq_show(struct seq_file *seq, void *v) 1070 { 1071 const struct nf_mttg_trav *trav = seq->private; 1072 const struct xt_match *match; 1073 1074 switch (trav->class) { 1075 case MTTG_TRAV_NFP_UNSPEC: 1076 case MTTG_TRAV_NFP_SPEC: 1077 if (trav->curr == trav->head) 1078 return 0; 1079 match = list_entry(trav->curr, struct xt_match, list); 1080 if (*match->name) 1081 seq_printf(seq, "%s\n", match->name); 1082 } 1083 return 0; 1084 } 1085 1086 static const struct seq_operations xt_match_seq_ops = { 1087 .start = xt_match_seq_start, 1088 .next = xt_match_seq_next, 1089 .stop = xt_mttg_seq_stop, 1090 .show = xt_match_seq_show, 1091 }; 1092 1093 static int xt_match_open(struct inode *inode, struct file *file) 1094 { 1095 struct nf_mttg_trav *trav; 1096 trav = __seq_open_private(file, &xt_match_seq_ops, sizeof(*trav)); 1097 if (!trav) 1098 return -ENOMEM; 1099 1100 trav->nfproto = (unsigned long)PDE_DATA(inode); 1101 return 0; 1102 } 1103 1104 static const struct file_operations xt_match_ops = { 1105 .owner = THIS_MODULE, 1106 .open = xt_match_open, 1107 .read = seq_read, 1108 .llseek = seq_lseek, 1109 .release = seq_release_private, 1110 }; 1111 1112 static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos) 1113 { 1114 return xt_mttg_seq_start(seq, pos, true); 1115 } 1116 1117 static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos) 1118 { 1119 return xt_mttg_seq_next(seq, v, ppos, true); 1120 } 1121 1122 static int xt_target_seq_show(struct seq_file *seq, void *v) 1123 { 1124 const struct nf_mttg_trav *trav = seq->private; 1125 const struct xt_target *target; 1126 1127 switch (trav->class) { 1128 case MTTG_TRAV_NFP_UNSPEC: 1129 case MTTG_TRAV_NFP_SPEC: 1130 if (trav->curr == trav->head) 1131 return 0; 1132 target = list_entry(trav->curr, struct xt_target, list); 1133 if (*target->name) 1134 seq_printf(seq, "%s\n", target->name); 1135 } 1136 return 0; 1137 } 1138 1139 static const struct seq_operations xt_target_seq_ops = { 1140 .start = xt_target_seq_start, 1141 .next = xt_target_seq_next, 1142 .stop = xt_mttg_seq_stop, 1143 .show = xt_target_seq_show, 1144 }; 1145 1146 static int xt_target_open(struct inode *inode, struct file *file) 1147 { 1148 struct nf_mttg_trav *trav; 1149 trav = __seq_open_private(file, &xt_target_seq_ops, sizeof(*trav)); 1150 if (!trav) 1151 return -ENOMEM; 1152 1153 trav->nfproto = (unsigned long)PDE_DATA(inode); 1154 return 0; 1155 } 1156 1157 static const struct file_operations xt_target_ops = { 1158 .owner = THIS_MODULE, 1159 .open = xt_target_open, 1160 .read = seq_read, 1161 .llseek = seq_lseek, 1162 .release = seq_release_private, 1163 }; 1164 1165 #define FORMAT_TABLES "_tables_names" 1166 #define FORMAT_MATCHES "_tables_matches" 1167 #define FORMAT_TARGETS "_tables_targets" 1168 1169 #endif /* CONFIG_PROC_FS */ 1170 1171 /** 1172 * xt_hook_link - set up hooks for a new table 1173 * @table: table with metadata needed to set up hooks 1174 * @fn: Hook function 1175 * 1176 * This function will take care of creating and registering the necessary 1177 * Netfilter hooks for XT tables. 1178 */ 1179 struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn) 1180 { 1181 unsigned int hook_mask = table->valid_hooks; 1182 uint8_t i, num_hooks = hweight32(hook_mask); 1183 uint8_t hooknum; 1184 struct nf_hook_ops *ops; 1185 int ret; 1186 1187 ops = kmalloc(sizeof(*ops) * num_hooks, GFP_KERNEL); 1188 if (ops == NULL) 1189 return ERR_PTR(-ENOMEM); 1190 1191 for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0; 1192 hook_mask >>= 1, ++hooknum) { 1193 if (!(hook_mask & 1)) 1194 continue; 1195 ops[i].hook = fn; 1196 ops[i].pf = table->af; 1197 ops[i].hooknum = hooknum; 1198 ops[i].priority = table->priority; 1199 ++i; 1200 } 1201 1202 ret = nf_register_hooks(ops, num_hooks); 1203 if (ret < 0) { 1204 kfree(ops); 1205 return ERR_PTR(ret); 1206 } 1207 1208 return ops; 1209 } 1210 EXPORT_SYMBOL_GPL(xt_hook_link); 1211 1212 /** 1213 * xt_hook_unlink - remove hooks for a table 1214 * @ops: nf_hook_ops array as returned by nf_hook_link 1215 * @hook_mask: the very same mask that was passed to nf_hook_link 1216 */ 1217 void xt_hook_unlink(const struct xt_table *table, struct nf_hook_ops *ops) 1218 { 1219 nf_unregister_hooks(ops, hweight32(table->valid_hooks)); 1220 kfree(ops); 1221 } 1222 EXPORT_SYMBOL_GPL(xt_hook_unlink); 1223 1224 int xt_proto_init(struct net *net, u_int8_t af) 1225 { 1226 #ifdef CONFIG_PROC_FS 1227 char buf[XT_FUNCTION_MAXNAMELEN]; 1228 struct proc_dir_entry *proc; 1229 #endif 1230 1231 if (af >= ARRAY_SIZE(xt_prefix)) 1232 return -EINVAL; 1233 1234 1235 #ifdef CONFIG_PROC_FS 1236 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1237 strlcat(buf, FORMAT_TABLES, sizeof(buf)); 1238 proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops, 1239 (void *)(unsigned long)af); 1240 if (!proc) 1241 goto out; 1242 1243 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1244 strlcat(buf, FORMAT_MATCHES, sizeof(buf)); 1245 proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops, 1246 (void *)(unsigned long)af); 1247 if (!proc) 1248 goto out_remove_tables; 1249 1250 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1251 strlcat(buf, FORMAT_TARGETS, sizeof(buf)); 1252 proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops, 1253 (void *)(unsigned long)af); 1254 if (!proc) 1255 goto out_remove_matches; 1256 #endif 1257 1258 return 0; 1259 1260 #ifdef CONFIG_PROC_FS 1261 out_remove_matches: 1262 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1263 strlcat(buf, FORMAT_MATCHES, sizeof(buf)); 1264 remove_proc_entry(buf, net->proc_net); 1265 1266 out_remove_tables: 1267 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1268 strlcat(buf, FORMAT_TABLES, sizeof(buf)); 1269 remove_proc_entry(buf, net->proc_net); 1270 out: 1271 return -1; 1272 #endif 1273 } 1274 EXPORT_SYMBOL_GPL(xt_proto_init); 1275 1276 void xt_proto_fini(struct net *net, u_int8_t af) 1277 { 1278 #ifdef CONFIG_PROC_FS 1279 char buf[XT_FUNCTION_MAXNAMELEN]; 1280 1281 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1282 strlcat(buf, FORMAT_TABLES, sizeof(buf)); 1283 remove_proc_entry(buf, net->proc_net); 1284 1285 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1286 strlcat(buf, FORMAT_TARGETS, sizeof(buf)); 1287 remove_proc_entry(buf, net->proc_net); 1288 1289 strlcpy(buf, xt_prefix[af], sizeof(buf)); 1290 strlcat(buf, FORMAT_MATCHES, sizeof(buf)); 1291 remove_proc_entry(buf, net->proc_net); 1292 #endif /*CONFIG_PROC_FS*/ 1293 } 1294 EXPORT_SYMBOL_GPL(xt_proto_fini); 1295 1296 static int __net_init xt_net_init(struct net *net) 1297 { 1298 int i; 1299 1300 for (i = 0; i < NFPROTO_NUMPROTO; i++) 1301 INIT_LIST_HEAD(&net->xt.tables[i]); 1302 return 0; 1303 } 1304 1305 static struct pernet_operations xt_net_ops = { 1306 .init = xt_net_init, 1307 }; 1308 1309 static int __init xt_init(void) 1310 { 1311 unsigned int i; 1312 int rv; 1313 1314 for_each_possible_cpu(i) { 1315 seqcount_init(&per_cpu(xt_recseq, i)); 1316 } 1317 1318 xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL); 1319 if (!xt) 1320 return -ENOMEM; 1321 1322 for (i = 0; i < NFPROTO_NUMPROTO; i++) { 1323 mutex_init(&xt[i].mutex); 1324 #ifdef CONFIG_COMPAT 1325 mutex_init(&xt[i].compat_mutex); 1326 xt[i].compat_tab = NULL; 1327 #endif 1328 INIT_LIST_HEAD(&xt[i].target); 1329 INIT_LIST_HEAD(&xt[i].match); 1330 } 1331 rv = register_pernet_subsys(&xt_net_ops); 1332 if (rv < 0) 1333 kfree(xt); 1334 return rv; 1335 } 1336 1337 static void __exit xt_fini(void) 1338 { 1339 unregister_pernet_subsys(&xt_net_ops); 1340 kfree(xt); 1341 } 1342 1343 module_init(xt_init); 1344 module_exit(xt_fini); 1345 1346