2005-04-17 00:20:36 +02:00
|
|
|
/*
|
|
|
|
* Packet matching code for ARP packets.
|
|
|
|
*
|
|
|
|
* Based heavily, if not almost entirely, upon ip_tables.c framework.
|
|
|
|
*
|
|
|
|
* Some ARP specific bits are:
|
|
|
|
*
|
|
|
|
* Copyright (C) 2002 David S. Miller (davem@redhat.com)
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
#include <linux/netdevice.h>
|
2006-01-11 21:17:47 +01:00
|
|
|
#include <linux/capability.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/if_arp.h>
|
|
|
|
#include <linux/kmod.h>
|
|
|
|
#include <linux/vmalloc.h>
|
|
|
|
#include <linux/proc_fs.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
|
|
|
|
#include <asm/uaccess.h>
|
2006-03-21 07:35:41 +01:00
|
|
|
#include <linux/mutex.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
#include <linux/netfilter/x_tables.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/netfilter_arp/arp_tables.h>
|
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
|
|
|
|
MODULE_DESCRIPTION("arptables core");
|
|
|
|
|
|
|
|
/*#define DEBUG_ARP_TABLES*/
|
|
|
|
/*#define DEBUG_ARP_TABLES_USER*/
|
|
|
|
|
|
|
|
#ifdef DEBUG_ARP_TABLES
|
|
|
|
#define dprintf(format, args...) printk(format , ## args)
|
|
|
|
#else
|
|
|
|
#define dprintf(format, args...)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef DEBUG_ARP_TABLES_USER
|
|
|
|
#define duprintf(format, args...) printk(format , ## args)
|
|
|
|
#else
|
|
|
|
#define duprintf(format, args...)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef CONFIG_NETFILTER_DEBUG
|
|
|
|
#define ARP_NF_ASSERT(x) \
|
|
|
|
do { \
|
|
|
|
if (!(x)) \
|
|
|
|
printk("ARP_NF_ASSERT: %s:%s:%u\n", \
|
|
|
|
__FUNCTION__, __FILE__, __LINE__); \
|
|
|
|
} while(0)
|
|
|
|
#else
|
|
|
|
#define ARP_NF_ASSERT(x)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
|
|
|
|
char *hdr_addr, int len)
|
|
|
|
{
|
|
|
|
int i, ret;
|
|
|
|
|
|
|
|
if (len > ARPT_DEV_ADDR_LEN_MAX)
|
|
|
|
len = ARPT_DEV_ADDR_LEN_MAX;
|
|
|
|
|
|
|
|
ret = 0;
|
|
|
|
for (i = 0; i < len; i++)
|
|
|
|
ret |= (hdr_addr[i] ^ ap->addr[i]) & ap->mask[i];
|
|
|
|
|
|
|
|
return (ret != 0);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Returns whether packet matches rule or not. */
|
|
|
|
static inline int arp_packet_match(const struct arphdr *arphdr,
|
|
|
|
struct net_device *dev,
|
|
|
|
const char *indev,
|
|
|
|
const char *outdev,
|
|
|
|
const struct arpt_arp *arpinfo)
|
|
|
|
{
|
|
|
|
char *arpptr = (char *)(arphdr + 1);
|
|
|
|
char *src_devaddr, *tgt_devaddr;
|
2006-09-28 23:21:07 +02:00
|
|
|
__be32 src_ipaddr, tgt_ipaddr;
|
2005-04-17 00:20:36 +02:00
|
|
|
int i, ret;
|
|
|
|
|
|
|
|
#define FWINV(bool,invflg) ((bool) ^ !!(arpinfo->invflags & invflg))
|
|
|
|
|
|
|
|
if (FWINV((arphdr->ar_op & arpinfo->arpop_mask) != arpinfo->arpop,
|
|
|
|
ARPT_INV_ARPOP)) {
|
|
|
|
dprintf("ARP operation field mismatch.\n");
|
|
|
|
dprintf("ar_op: %04x info->arpop: %04x info->arpop_mask: %04x\n",
|
|
|
|
arphdr->ar_op, arpinfo->arpop, arpinfo->arpop_mask);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (FWINV((arphdr->ar_hrd & arpinfo->arhrd_mask) != arpinfo->arhrd,
|
|
|
|
ARPT_INV_ARPHRD)) {
|
|
|
|
dprintf("ARP hardware address format mismatch.\n");
|
|
|
|
dprintf("ar_hrd: %04x info->arhrd: %04x info->arhrd_mask: %04x\n",
|
|
|
|
arphdr->ar_hrd, arpinfo->arhrd, arpinfo->arhrd_mask);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (FWINV((arphdr->ar_pro & arpinfo->arpro_mask) != arpinfo->arpro,
|
|
|
|
ARPT_INV_ARPPRO)) {
|
|
|
|
dprintf("ARP protocol address format mismatch.\n");
|
|
|
|
dprintf("ar_pro: %04x info->arpro: %04x info->arpro_mask: %04x\n",
|
|
|
|
arphdr->ar_pro, arpinfo->arpro, arpinfo->arpro_mask);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (FWINV((arphdr->ar_hln & arpinfo->arhln_mask) != arpinfo->arhln,
|
|
|
|
ARPT_INV_ARPHLN)) {
|
|
|
|
dprintf("ARP hardware address length mismatch.\n");
|
|
|
|
dprintf("ar_hln: %02x info->arhln: %02x info->arhln_mask: %02x\n",
|
|
|
|
arphdr->ar_hln, arpinfo->arhln, arpinfo->arhln_mask);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
src_devaddr = arpptr;
|
|
|
|
arpptr += dev->addr_len;
|
|
|
|
memcpy(&src_ipaddr, arpptr, sizeof(u32));
|
|
|
|
arpptr += sizeof(u32);
|
|
|
|
tgt_devaddr = arpptr;
|
|
|
|
arpptr += dev->addr_len;
|
|
|
|
memcpy(&tgt_ipaddr, arpptr, sizeof(u32));
|
|
|
|
|
|
|
|
if (FWINV(arp_devaddr_compare(&arpinfo->src_devaddr, src_devaddr, dev->addr_len),
|
|
|
|
ARPT_INV_SRCDEVADDR) ||
|
|
|
|
FWINV(arp_devaddr_compare(&arpinfo->tgt_devaddr, tgt_devaddr, dev->addr_len),
|
|
|
|
ARPT_INV_TGTDEVADDR)) {
|
|
|
|
dprintf("Source or target device address mismatch.\n");
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (FWINV((src_ipaddr & arpinfo->smsk.s_addr) != arpinfo->src.s_addr,
|
|
|
|
ARPT_INV_SRCIP) ||
|
|
|
|
FWINV(((tgt_ipaddr & arpinfo->tmsk.s_addr) != arpinfo->tgt.s_addr),
|
|
|
|
ARPT_INV_TGTIP)) {
|
|
|
|
dprintf("Source or target IP address mismatch.\n");
|
|
|
|
|
|
|
|
dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
|
|
|
|
NIPQUAD(src_ipaddr),
|
|
|
|
NIPQUAD(arpinfo->smsk.s_addr),
|
|
|
|
NIPQUAD(arpinfo->src.s_addr),
|
|
|
|
arpinfo->invflags & ARPT_INV_SRCIP ? " (INV)" : "");
|
|
|
|
dprintf("TGT: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
|
|
|
|
NIPQUAD(tgt_ipaddr),
|
|
|
|
NIPQUAD(arpinfo->tmsk.s_addr),
|
|
|
|
NIPQUAD(arpinfo->tgt.s_addr),
|
|
|
|
arpinfo->invflags & ARPT_INV_TGTIP ? " (INV)" : "");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Look for ifname matches. */
|
|
|
|
for (i = 0, ret = 0; i < IFNAMSIZ; i++) {
|
|
|
|
ret |= (indev[i] ^ arpinfo->iniface[i])
|
|
|
|
& arpinfo->iniface_mask[i];
|
|
|
|
}
|
|
|
|
|
|
|
|
if (FWINV(ret != 0, ARPT_INV_VIA_IN)) {
|
|
|
|
dprintf("VIA in mismatch (%s vs %s).%s\n",
|
|
|
|
indev, arpinfo->iniface,
|
|
|
|
arpinfo->invflags&ARPT_INV_VIA_IN ?" (INV)":"");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-04-14 01:37:54 +02:00
|
|
|
for (i = 0, ret = 0; i < IFNAMSIZ; i++) {
|
|
|
|
ret |= (outdev[i] ^ arpinfo->outiface[i])
|
|
|
|
& arpinfo->outiface_mask[i];
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if (FWINV(ret != 0, ARPT_INV_VIA_OUT)) {
|
|
|
|
dprintf("VIA out mismatch (%s vs %s).%s\n",
|
|
|
|
outdev, arpinfo->outiface,
|
|
|
|
arpinfo->invflags&ARPT_INV_VIA_OUT ?" (INV)":"");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int arp_checkentry(const struct arpt_arp *arp)
|
|
|
|
{
|
|
|
|
if (arp->flags & ~ARPT_F_MASK) {
|
|
|
|
duprintf("Unknown flag bits set: %08X\n",
|
|
|
|
arp->flags & ~ARPT_F_MASK);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
if (arp->invflags & ~ARPT_INV_MASK) {
|
|
|
|
duprintf("Unknown invflag bits set: %08X\n",
|
|
|
|
arp->invflags & ~ARPT_INV_MASK);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2007-10-15 09:53:15 +02:00
|
|
|
static unsigned int arpt_error(struct sk_buff *skb,
|
2005-04-17 00:20:36 +02:00
|
|
|
const struct net_device *in,
|
|
|
|
const struct net_device *out,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
unsigned int hooknum,
|
2006-03-21 03:02:56 +01:00
|
|
|
const struct xt_target *target,
|
2006-08-22 09:35:47 +02:00
|
|
|
const void *targinfo)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
if (net_ratelimit())
|
|
|
|
printk("arp_tables: error: '%s'\n", (char *)targinfo);
|
|
|
|
|
|
|
|
return NF_DROP;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
|
|
|
|
{
|
|
|
|
return (struct arpt_entry *)(base + offset);
|
|
|
|
}
|
|
|
|
|
2007-10-15 09:53:15 +02:00
|
|
|
unsigned int arpt_do_table(struct sk_buff *skb,
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned int hook,
|
|
|
|
const struct net_device *in,
|
|
|
|
const struct net_device *out,
|
2006-08-22 09:35:47 +02:00
|
|
|
struct arpt_table *table)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
static const char nulldevname[IFNAMSIZ];
|
|
|
|
unsigned int verdict = NF_DROP;
|
|
|
|
struct arphdr *arp;
|
2007-07-08 07:15:12 +02:00
|
|
|
bool hotdrop = false;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct arpt_entry *e, *back;
|
|
|
|
const char *indev, *outdev;
|
|
|
|
void *table_base;
|
2006-08-22 00:31:08 +02:00
|
|
|
struct xt_table_info *private;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* ARP header, plus 2 device addresses, plus 2 IP addresses. */
|
2007-10-15 09:53:15 +02:00
|
|
|
if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
|
|
|
|
(2 * skb->dev->addr_len) +
|
|
|
|
(2 * sizeof(u32)))))
|
2005-04-17 00:20:36 +02:00
|
|
|
return NF_DROP;
|
|
|
|
|
|
|
|
indev = in ? in->name : nulldevname;
|
|
|
|
outdev = out ? out->name : nulldevname;
|
|
|
|
|
|
|
|
read_lock_bh(&table->lock);
|
2006-08-22 00:31:08 +02:00
|
|
|
private = table->private;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
table_base = (void *)private->entries[smp_processor_id()];
|
|
|
|
e = get_entry(table_base, private->hook_entry[hook]);
|
|
|
|
back = get_entry(table_base, private->underflow[hook]);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-10-15 09:53:15 +02:00
|
|
|
arp = arp_hdr(skb);
|
2005-04-17 00:20:36 +02:00
|
|
|
do {
|
2007-10-15 09:53:15 +02:00
|
|
|
if (arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
|
2005-04-17 00:20:36 +02:00
|
|
|
struct arpt_entry_target *t;
|
|
|
|
int hdr_len;
|
|
|
|
|
|
|
|
hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
|
2007-10-15 09:53:15 +02:00
|
|
|
(2 * skb->dev->addr_len);
|
2005-04-17 00:20:36 +02:00
|
|
|
ADD_COUNTER(e->counters, hdr_len, 1);
|
|
|
|
|
|
|
|
t = arpt_get_target(e);
|
|
|
|
|
|
|
|
/* Standard target? */
|
|
|
|
if (!t->u.kernel.target->target) {
|
|
|
|
int v;
|
|
|
|
|
|
|
|
v = ((struct arpt_standard_target *)t)->verdict;
|
|
|
|
if (v < 0) {
|
|
|
|
/* Pop from stack? */
|
|
|
|
if (v != ARPT_RETURN) {
|
|
|
|
verdict = (unsigned)(-v) - 1;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
e = back;
|
|
|
|
back = get_entry(table_base,
|
|
|
|
back->comefrom);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
if (table_base + v
|
|
|
|
!= (void *)e + e->next_offset) {
|
|
|
|
/* Save old back ptr in next entry */
|
|
|
|
struct arpt_entry *next
|
|
|
|
= (void *)e + e->next_offset;
|
|
|
|
next->comefrom =
|
|
|
|
(void *)back - table_base;
|
|
|
|
|
|
|
|
/* set back pointer to next entry */
|
|
|
|
back = next;
|
|
|
|
}
|
|
|
|
|
|
|
|
e = get_entry(table_base, v);
|
|
|
|
} else {
|
|
|
|
/* Targets which reenter must return
|
|
|
|
* abs. verdicts
|
|
|
|
*/
|
2007-10-15 09:53:15 +02:00
|
|
|
verdict = t->u.kernel.target->target(skb,
|
2005-04-17 00:20:36 +02:00
|
|
|
in, out,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
hook,
|
2006-03-21 03:02:15 +01:00
|
|
|
t->u.kernel.target,
|
2006-08-22 09:35:47 +02:00
|
|
|
t->data);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Target might have changed stuff. */
|
2007-10-15 09:53:15 +02:00
|
|
|
arp = arp_hdr(skb);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (verdict == ARPT_CONTINUE)
|
|
|
|
e = (void *)e + e->next_offset;
|
|
|
|
else
|
|
|
|
/* Verdict */
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
e = (void *)e + e->next_offset;
|
|
|
|
}
|
|
|
|
} while (!hotdrop);
|
|
|
|
read_unlock_bh(&table->lock);
|
|
|
|
|
|
|
|
if (hotdrop)
|
|
|
|
return NF_DROP;
|
|
|
|
else
|
|
|
|
return verdict;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* All zeroes == unconditional rule. */
|
|
|
|
static inline int unconditional(const struct arpt_arp *arp)
|
|
|
|
{
|
|
|
|
unsigned int i;
|
|
|
|
|
|
|
|
for (i = 0; i < sizeof(*arp)/sizeof(__u32); i++)
|
|
|
|
if (((__u32 *)arp)[i])
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Figures out from what hook each rule can be called: returns 0 if
|
|
|
|
* there are loops. Puts hook bitmask in comefrom.
|
|
|
|
*/
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
static int mark_source_chains(struct xt_table_info *newinfo,
|
2005-12-14 08:13:48 +01:00
|
|
|
unsigned int valid_hooks, void *entry0)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
unsigned int hook;
|
|
|
|
|
|
|
|
/* No recursion; use packet counter to save back ptrs (reset
|
|
|
|
* to 0 as we leave), and comefrom to save source hook bitmask.
|
|
|
|
*/
|
|
|
|
for (hook = 0; hook < NF_ARP_NUMHOOKS; hook++) {
|
|
|
|
unsigned int pos = newinfo->hook_entry[hook];
|
|
|
|
struct arpt_entry *e
|
2005-12-14 08:13:48 +01:00
|
|
|
= (struct arpt_entry *)(entry0 + pos);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (!(valid_hooks & (1 << hook)))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
/* Set initial back pointer. */
|
|
|
|
e->counters.pcnt = pos;
|
|
|
|
|
|
|
|
for (;;) {
|
|
|
|
struct arpt_standard_target *t
|
|
|
|
= (void *)arpt_get_target(e);
|
2006-12-12 09:29:52 +01:00
|
|
|
int visited = e->comefrom & (1 << hook);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (e->comefrom & (1 << NF_ARP_NUMHOOKS)) {
|
|
|
|
printk("arptables: loop hook %u pos %u %08X.\n",
|
|
|
|
hook, pos, e->comefrom);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
e->comefrom
|
|
|
|
|= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
|
|
|
|
|
|
|
|
/* Unconditional return/END. */
|
2006-12-12 09:29:52 +01:00
|
|
|
if ((e->target_offset == sizeof(struct arpt_entry)
|
2005-04-17 00:20:36 +02:00
|
|
|
&& (strcmp(t->target.u.user.name,
|
|
|
|
ARPT_STANDARD_TARGET) == 0)
|
|
|
|
&& t->verdict < 0
|
2006-12-12 09:29:52 +01:00
|
|
|
&& unconditional(&e->arp)) || visited) {
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned int oldpos, size;
|
|
|
|
|
2006-12-05 22:43:50 +01:00
|
|
|
if (t->verdict < -NF_MAX_VERDICT - 1) {
|
|
|
|
duprintf("mark_source_chains: bad "
|
|
|
|
"negative verdict (%i)\n",
|
|
|
|
t->verdict);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* Return: backtrack through the last
|
|
|
|
* big jump.
|
|
|
|
*/
|
|
|
|
do {
|
|
|
|
e->comefrom ^= (1<<NF_ARP_NUMHOOKS);
|
|
|
|
oldpos = pos;
|
|
|
|
pos = e->counters.pcnt;
|
|
|
|
e->counters.pcnt = 0;
|
|
|
|
|
|
|
|
/* We're at the start. */
|
|
|
|
if (pos == oldpos)
|
|
|
|
goto next;
|
|
|
|
|
|
|
|
e = (struct arpt_entry *)
|
2005-12-14 08:13:48 +01:00
|
|
|
(entry0 + pos);
|
2005-04-17 00:20:36 +02:00
|
|
|
} while (oldpos == pos + e->next_offset);
|
|
|
|
|
|
|
|
/* Move along one */
|
|
|
|
size = e->next_offset;
|
|
|
|
e = (struct arpt_entry *)
|
2005-12-14 08:13:48 +01:00
|
|
|
(entry0 + pos + size);
|
2005-04-17 00:20:36 +02:00
|
|
|
e->counters.pcnt = pos;
|
|
|
|
pos += size;
|
|
|
|
} else {
|
|
|
|
int newpos = t->verdict;
|
|
|
|
|
|
|
|
if (strcmp(t->target.u.user.name,
|
|
|
|
ARPT_STANDARD_TARGET) == 0
|
|
|
|
&& newpos >= 0) {
|
2006-12-05 22:43:50 +01:00
|
|
|
if (newpos > newinfo->size -
|
|
|
|
sizeof(struct arpt_entry)) {
|
|
|
|
duprintf("mark_source_chains: "
|
|
|
|
"bad verdict (%i)\n",
|
|
|
|
newpos);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* This a jump; chase it. */
|
|
|
|
duprintf("Jump rule %u -> %u\n",
|
|
|
|
pos, newpos);
|
|
|
|
} else {
|
|
|
|
/* ... this is a fallthru */
|
|
|
|
newpos = pos + e->next_offset;
|
|
|
|
}
|
|
|
|
e = (struct arpt_entry *)
|
2005-12-14 08:13:48 +01:00
|
|
|
(entry0 + newpos);
|
2005-04-17 00:20:36 +02:00
|
|
|
e->counters.pcnt = pos;
|
|
|
|
pos = newpos;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
next:
|
|
|
|
duprintf("Finished chain %u\n", hook);
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2007-12-18 06:56:33 +01:00
|
|
|
static inline int check_entry(struct arpt_entry *e, const char *name)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct arpt_entry_target *t;
|
|
|
|
|
|
|
|
if (!arp_checkentry(&e->arp)) {
|
|
|
|
duprintf("arp_tables: arp check failed %p %s.\n", e, name);
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
[NETFILTER]: Missed and reordered checks in {arp,ip,ip6}_tables
There is a number of issues in parsing user-provided table in
translate_table(). Malicious user with CAP_NET_ADMIN may crash system by
passing special-crafted table to the *_tables.
The first issue is that mark_source_chains() function is called before entry
content checks. In case of standard target, mark_source_chains() function
uses t->verdict field in order to determine new position. But the check, that
this field leads no further, than the table end, is in check_entry(), which
is called later, than mark_source_chains().
The second issue, that there is no check that target_offset points inside
entry. If so, *_ITERATE_MATCH macro will follow further, than the entry
ends. As a result, we'll have oops or memory disclosure.
And the third issue, that there is no check that the target is completely
inside entry. Results are the same, as in previous issue.
Signed-off-by: Dmitry Mishin <dim@openvz.org>
Acked-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-31 00:12:55 +01:00
|
|
|
if (e->target_offset + sizeof(struct arpt_entry_target) > e->next_offset)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
t = arpt_get_target(e);
|
[NETFILTER]: Missed and reordered checks in {arp,ip,ip6}_tables
There is a number of issues in parsing user-provided table in
translate_table(). Malicious user with CAP_NET_ADMIN may crash system by
passing special-crafted table to the *_tables.
The first issue is that mark_source_chains() function is called before entry
content checks. In case of standard target, mark_source_chains() function
uses t->verdict field in order to determine new position. But the check, that
this field leads no further, than the table end, is in check_entry(), which
is called later, than mark_source_chains().
The second issue, that there is no check that target_offset points inside
entry. If so, *_ITERATE_MATCH macro will follow further, than the entry
ends. As a result, we'll have oops or memory disclosure.
And the third issue, that there is no check that the target is completely
inside entry. Results are the same, as in previous issue.
Signed-off-by: Dmitry Mishin <dim@openvz.org>
Acked-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-10-31 00:12:55 +01:00
|
|
|
if (e->target_offset + t->u.target_size > e->next_offset)
|
|
|
|
return -EINVAL;
|
|
|
|
|
2007-12-18 06:56:33 +01:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int check_target(struct arpt_entry *e, const char *name)
|
|
|
|
{
|
|
|
|
struct arpt_entry_target *t;
|
|
|
|
struct arpt_target *target;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
t = arpt_get_target(e);
|
|
|
|
target = t->u.kernel.target;
|
|
|
|
|
|
|
|
ret = xt_check_target(target, NF_ARP, t->u.target_size - sizeof(*t),
|
|
|
|
name, e->comefrom, 0, 0);
|
|
|
|
if (!ret && t->u.kernel.target->checkentry
|
|
|
|
&& !t->u.kernel.target->checkentry(name, e, target, t->data,
|
|
|
|
e->comefrom)) {
|
|
|
|
duprintf("arp_tables: check failed for `%s'.\n",
|
|
|
|
t->u.kernel.target->name);
|
|
|
|
ret = -EINVAL;
|
|
|
|
}
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int
|
|
|
|
find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
|
|
|
|
unsigned int *i)
|
|
|
|
{
|
|
|
|
struct arpt_entry_target *t;
|
|
|
|
struct arpt_target *target;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
ret = check_entry(e, name);
|
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
|
|
|
|
t = arpt_get_target(e);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
target = try_then_request_module(xt_find_target(NF_ARP, t->u.user.name,
|
|
|
|
t->u.user.revision),
|
2005-10-26 09:34:24 +02:00
|
|
|
"arpt_%s", t->u.user.name);
|
|
|
|
if (IS_ERR(target) || !target) {
|
2007-12-18 06:56:33 +01:00
|
|
|
duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
|
2005-10-26 09:34:24 +02:00
|
|
|
ret = target ? PTR_ERR(target) : -ENOENT;
|
2005-04-17 00:20:36 +02:00
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
t->u.kernel.target = target;
|
|
|
|
|
2007-12-18 06:56:33 +01:00
|
|
|
ret = check_target(e, name);
|
2006-03-21 03:00:36 +01:00
|
|
|
if (ret)
|
|
|
|
goto err;
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
(*i)++;
|
|
|
|
return 0;
|
2006-03-21 03:00:36 +01:00
|
|
|
err:
|
|
|
|
module_put(t->u.kernel.target->me);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int check_entry_size_and_hooks(struct arpt_entry *e,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *newinfo,
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned char *base,
|
|
|
|
unsigned char *limit,
|
|
|
|
const unsigned int *hook_entries,
|
|
|
|
const unsigned int *underflows,
|
|
|
|
unsigned int *i)
|
|
|
|
{
|
|
|
|
unsigned int h;
|
|
|
|
|
|
|
|
if ((unsigned long)e % __alignof__(struct arpt_entry) != 0
|
|
|
|
|| (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
|
|
|
|
duprintf("Bad offset %p\n", e);
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (e->next_offset
|
|
|
|
< sizeof(struct arpt_entry) + sizeof(struct arpt_entry_target)) {
|
|
|
|
duprintf("checking: element %p size %u\n",
|
|
|
|
e, e->next_offset);
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check hooks & underflows */
|
|
|
|
for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
|
|
|
|
if ((unsigned char *)e - base == hook_entries[h])
|
|
|
|
newinfo->hook_entry[h] = hook_entries[h];
|
|
|
|
if ((unsigned char *)e - base == underflows[h])
|
|
|
|
newinfo->underflow[h] = underflows[h];
|
|
|
|
}
|
|
|
|
|
|
|
|
/* FIXME: underflows must be unconditional, standard verdicts
|
2007-02-09 15:24:47 +01:00
|
|
|
< 0 (not ARPT_RETURN). --RR */
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Clear counters and comefrom */
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
e->counters = ((struct xt_counters) { 0, 0 });
|
2005-04-17 00:20:36 +02:00
|
|
|
e->comefrom = 0;
|
|
|
|
|
|
|
|
(*i)++;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
|
|
|
|
{
|
|
|
|
struct arpt_entry_target *t;
|
|
|
|
|
|
|
|
if (i && (*i)-- == 0)
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
t = arpt_get_target(e);
|
|
|
|
if (t->u.kernel.target->destroy)
|
2006-08-22 09:36:37 +02:00
|
|
|
t->u.kernel.target->destroy(t->u.kernel.target, t->data);
|
2005-04-17 00:20:36 +02:00
|
|
|
module_put(t->u.kernel.target->me);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Checks and translates the user-supplied table segment (held in
|
|
|
|
* newinfo).
|
|
|
|
*/
|
|
|
|
static int translate_table(const char *name,
|
|
|
|
unsigned int valid_hooks,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *newinfo,
|
2005-12-14 08:13:48 +01:00
|
|
|
void *entry0,
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned int size,
|
|
|
|
unsigned int number,
|
|
|
|
const unsigned int *hook_entries,
|
|
|
|
const unsigned int *underflows)
|
|
|
|
{
|
|
|
|
unsigned int i;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
newinfo->size = size;
|
|
|
|
newinfo->number = number;
|
|
|
|
|
|
|
|
/* Init all hooks to impossible value. */
|
|
|
|
for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
|
|
|
|
newinfo->hook_entry[i] = 0xFFFFFFFF;
|
|
|
|
newinfo->underflow[i] = 0xFFFFFFFF;
|
|
|
|
}
|
|
|
|
|
|
|
|
duprintf("translate_table: size %u\n", newinfo->size);
|
|
|
|
i = 0;
|
|
|
|
|
|
|
|
/* Walk through entries, checking offsets. */
|
2005-12-14 08:13:48 +01:00
|
|
|
ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
|
2005-04-17 00:20:36 +02:00
|
|
|
check_entry_size_and_hooks,
|
|
|
|
newinfo,
|
2005-12-14 08:13:48 +01:00
|
|
|
entry0,
|
|
|
|
entry0 + size,
|
2005-04-17 00:20:36 +02:00
|
|
|
hook_entries, underflows, &i);
|
|
|
|
duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
|
|
|
|
if (ret != 0)
|
|
|
|
return ret;
|
|
|
|
|
|
|
|
if (i != number) {
|
|
|
|
duprintf("translate_table: %u not %u entries\n",
|
|
|
|
i, number);
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Check hooks all assigned */
|
|
|
|
for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
|
|
|
|
/* Only hooks which are valid */
|
|
|
|
if (!(valid_hooks & (1 << i)))
|
|
|
|
continue;
|
|
|
|
if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
|
|
|
|
duprintf("Invalid hook entry %u %u\n",
|
|
|
|
i, hook_entries[i]);
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
if (newinfo->underflow[i] == 0xFFFFFFFF) {
|
|
|
|
duprintf("Invalid underflow %u %u\n",
|
|
|
|
i, underflows[i]);
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2006-12-05 22:43:50 +01:00
|
|
|
if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
|
|
|
|
duprintf("Looping hook\n");
|
|
|
|
return -ELOOP;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* Finally, each sanity check must pass */
|
|
|
|
i = 0;
|
2005-12-14 08:13:48 +01:00
|
|
|
ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
|
2007-12-18 06:56:33 +01:00
|
|
|
find_check_entry, name, size, &i);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-12-05 22:43:50 +01:00
|
|
|
if (ret != 0) {
|
|
|
|
ARPT_ENTRY_ITERATE(entry0, newinfo->size,
|
|
|
|
cleanup_entry, &i);
|
|
|
|
return ret;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* And one copy for every other CPU */
|
2006-04-11 07:52:50 +02:00
|
|
|
for_each_possible_cpu(i) {
|
2005-12-14 08:13:48 +01:00
|
|
|
if (newinfo->entries[i] && newinfo->entries[i] != entry0)
|
|
|
|
memcpy(newinfo->entries[i], entry0, newinfo->size);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Gets counters. */
|
|
|
|
static inline int add_entry_to_counter(const struct arpt_entry *e,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_counters total[],
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned int *i)
|
|
|
|
{
|
|
|
|
ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
|
|
|
|
|
|
|
|
(*i)++;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-12-14 08:13:48 +01:00
|
|
|
static inline int set_entry_to_counter(const struct arpt_entry *e,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_counters total[],
|
2005-12-14 08:13:48 +01:00
|
|
|
unsigned int *i)
|
|
|
|
{
|
|
|
|
SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
|
|
|
|
|
|
|
|
(*i)++;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
static void get_counters(const struct xt_table_info *t,
|
|
|
|
struct xt_counters counters[])
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
unsigned int cpu;
|
|
|
|
unsigned int i;
|
2005-12-14 08:13:48 +01:00
|
|
|
unsigned int curcpu;
|
|
|
|
|
|
|
|
/* Instead of clearing (by a previous call to memset())
|
|
|
|
* the counters and using adds, we set the counters
|
|
|
|
* with data used by 'current' CPU
|
|
|
|
* We dont care about preemption here.
|
|
|
|
*/
|
|
|
|
curcpu = raw_smp_processor_id();
|
|
|
|
|
|
|
|
i = 0;
|
|
|
|
ARPT_ENTRY_ITERATE(t->entries[curcpu],
|
|
|
|
t->size,
|
|
|
|
set_entry_to_counter,
|
|
|
|
counters,
|
|
|
|
&i);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-04-11 07:52:50 +02:00
|
|
|
for_each_possible_cpu(cpu) {
|
2005-12-14 08:13:48 +01:00
|
|
|
if (cpu == curcpu)
|
|
|
|
continue;
|
2005-04-17 00:20:36 +02:00
|
|
|
i = 0;
|
2005-12-14 08:13:48 +01:00
|
|
|
ARPT_ENTRY_ITERATE(t->entries[cpu],
|
2005-04-17 00:20:36 +02:00
|
|
|
t->size,
|
|
|
|
add_entry_to_counter,
|
|
|
|
counters,
|
|
|
|
&i);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-12-18 06:56:48 +01:00
|
|
|
static inline struct xt_counters *alloc_counters(struct arpt_table *table)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2007-12-18 06:56:48 +01:00
|
|
|
unsigned int countersize;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_counters *counters;
|
|
|
|
struct xt_table_info *private = table->private;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* We need atomic snapshot of counters: rest doesn't change
|
|
|
|
* (other than comefrom, which userspace doesn't care
|
|
|
|
* about).
|
|
|
|
*/
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
countersize = sizeof(struct xt_counters) * private->number;
|
|
|
|
counters = vmalloc_node(countersize, numa_node_id());
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (counters == NULL)
|
2007-12-18 06:56:48 +01:00
|
|
|
return ERR_PTR(-ENOMEM);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* First, sum counters... */
|
|
|
|
write_lock_bh(&table->lock);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
get_counters(private, counters);
|
2005-04-17 00:20:36 +02:00
|
|
|
write_unlock_bh(&table->lock);
|
|
|
|
|
2007-12-18 06:56:48 +01:00
|
|
|
return counters;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int copy_entries_to_user(unsigned int total_size,
|
|
|
|
struct arpt_table *table,
|
|
|
|
void __user *userptr)
|
|
|
|
{
|
|
|
|
unsigned int off, num;
|
|
|
|
struct arpt_entry *e;
|
|
|
|
struct xt_counters *counters;
|
|
|
|
struct xt_table_info *private = table->private;
|
|
|
|
int ret = 0;
|
|
|
|
void *loc_cpu_entry;
|
|
|
|
|
|
|
|
counters = alloc_counters(table);
|
|
|
|
if (IS_ERR(counters))
|
|
|
|
return PTR_ERR(counters);
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
loc_cpu_entry = private->entries[raw_smp_processor_id()];
|
2005-12-14 08:13:48 +01:00
|
|
|
/* ... then copy entire thing ... */
|
|
|
|
if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
|
2005-04-17 00:20:36 +02:00
|
|
|
ret = -EFAULT;
|
|
|
|
goto free_counters;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* FIXME: use iterator macros --RR */
|
|
|
|
/* ... then go back and fix counters and names */
|
|
|
|
for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
|
|
|
|
struct arpt_entry_target *t;
|
|
|
|
|
2005-12-14 08:13:48 +01:00
|
|
|
e = (struct arpt_entry *)(loc_cpu_entry + off);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (copy_to_user(userptr + off
|
|
|
|
+ offsetof(struct arpt_entry, counters),
|
|
|
|
&counters[num],
|
|
|
|
sizeof(counters[num])) != 0) {
|
|
|
|
ret = -EFAULT;
|
|
|
|
goto free_counters;
|
|
|
|
}
|
|
|
|
|
|
|
|
t = arpt_get_target(e);
|
|
|
|
if (copy_to_user(userptr + off + e->target_offset
|
|
|
|
+ offsetof(struct arpt_entry_target,
|
|
|
|
u.user.name),
|
|
|
|
t->u.kernel.target->name,
|
|
|
|
strlen(t->u.kernel.target->name)+1) != 0) {
|
|
|
|
ret = -EFAULT;
|
|
|
|
goto free_counters;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
free_counters:
|
|
|
|
vfree(counters);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int get_entries(const struct arpt_get_entries *entries,
|
|
|
|
struct arpt_get_entries __user *uptr)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
struct arpt_table *t;
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
t = xt_find_table_lock(NF_ARP, entries->name);
|
2006-03-13 05:40:43 +01:00
|
|
|
if (t && !IS_ERR(t)) {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *private = t->private;
|
2005-04-17 00:20:36 +02:00
|
|
|
duprintf("t->private->number = %u\n",
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
private->number);
|
|
|
|
if (entries->size == private->size)
|
|
|
|
ret = copy_entries_to_user(private->size,
|
2005-04-17 00:20:36 +02:00
|
|
|
t, uptr->entrytable);
|
|
|
|
else {
|
|
|
|
duprintf("get_entries: I've got %u not %u!\n",
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
private->size, entries->size);
|
2005-04-17 00:20:36 +02:00
|
|
|
ret = -EINVAL;
|
|
|
|
}
|
2005-10-26 09:34:24 +02:00
|
|
|
module_put(t->me);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_table_unlock(t);
|
2005-04-17 00:20:36 +02:00
|
|
|
} else
|
2005-10-26 09:34:24 +02:00
|
|
|
ret = t ? PTR_ERR(t) : -ENOENT;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int do_replace(void __user *user, unsigned int len)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
struct arpt_replace tmp;
|
|
|
|
struct arpt_table *t;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *newinfo, *oldinfo;
|
|
|
|
struct xt_counters *counters;
|
2005-12-14 08:13:48 +01:00
|
|
|
void *loc_cpu_entry, *loc_cpu_old_entry;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
|
|
|
|
return -EFAULT;
|
|
|
|
|
2006-02-04 11:16:56 +01:00
|
|
|
/* overflow check */
|
|
|
|
if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
|
|
|
|
return -ENOMEM;
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
newinfo = xt_alloc_table_info(tmp.size);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!newinfo)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
2005-12-14 08:13:48 +01:00
|
|
|
/* choose the copy that is on our node/cpu */
|
|
|
|
loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
|
|
|
|
if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
|
2005-04-17 00:20:36 +02:00
|
|
|
tmp.size) != 0) {
|
|
|
|
ret = -EFAULT;
|
|
|
|
goto free_newinfo;
|
|
|
|
}
|
|
|
|
|
2007-12-18 06:55:59 +01:00
|
|
|
counters = vmalloc_node(tmp.num_counters * sizeof(struct xt_counters),
|
|
|
|
numa_node_id());
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!counters) {
|
|
|
|
ret = -ENOMEM;
|
|
|
|
goto free_newinfo;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = translate_table(tmp.name, tmp.valid_hooks,
|
2005-12-14 08:13:48 +01:00
|
|
|
newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
|
2005-04-17 00:20:36 +02:00
|
|
|
tmp.hook_entry, tmp.underflow);
|
|
|
|
if (ret != 0)
|
|
|
|
goto free_newinfo_counters;
|
|
|
|
|
|
|
|
duprintf("arp_tables: Translated table\n");
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
t = try_then_request_module(xt_find_table_lock(NF_ARP, tmp.name),
|
2005-10-26 09:34:24 +02:00
|
|
|
"arptable_%s", tmp.name);
|
|
|
|
if (!t || IS_ERR(t)) {
|
|
|
|
ret = t ? PTR_ERR(t) : -ENOENT;
|
2005-04-17 00:20:36 +02:00
|
|
|
goto free_newinfo_counters_untrans;
|
2005-10-26 09:34:24 +02:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* You lied! */
|
|
|
|
if (tmp.valid_hooks != t->valid_hooks) {
|
|
|
|
duprintf("Valid hook crap: %08X vs %08X\n",
|
|
|
|
tmp.valid_hooks, t->valid_hooks);
|
|
|
|
ret = -EINVAL;
|
2005-10-26 09:34:24 +02:00
|
|
|
goto put_module;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
oldinfo = xt_replace_table(t, tmp.num_counters, newinfo, &ret);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!oldinfo)
|
|
|
|
goto put_module;
|
|
|
|
|
|
|
|
/* Update module usage count based on number of rules */
|
|
|
|
duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
|
|
|
|
oldinfo->number, oldinfo->initial_entries, newinfo->number);
|
2007-02-09 15:24:47 +01:00
|
|
|
if ((oldinfo->number > oldinfo->initial_entries) ||
|
|
|
|
(newinfo->number <= oldinfo->initial_entries))
|
2005-04-17 00:20:36 +02:00
|
|
|
module_put(t->me);
|
|
|
|
if ((oldinfo->number > oldinfo->initial_entries) &&
|
|
|
|
(newinfo->number <= oldinfo->initial_entries))
|
|
|
|
module_put(t->me);
|
|
|
|
|
|
|
|
/* Get the old counters. */
|
|
|
|
get_counters(oldinfo, counters);
|
|
|
|
/* Decrease module usage counts and free resource */
|
2005-12-14 08:13:48 +01:00
|
|
|
loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
|
|
|
|
ARPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_free_table_info(oldinfo);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (copy_to_user(tmp.counters, counters,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
sizeof(struct xt_counters) * tmp.num_counters) != 0)
|
2005-04-17 00:20:36 +02:00
|
|
|
ret = -EFAULT;
|
|
|
|
vfree(counters);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_table_unlock(t);
|
2005-04-17 00:20:36 +02:00
|
|
|
return ret;
|
|
|
|
|
|
|
|
put_module:
|
|
|
|
module_put(t->me);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_table_unlock(t);
|
2005-04-17 00:20:36 +02:00
|
|
|
free_newinfo_counters_untrans:
|
2005-12-14 08:13:48 +01:00
|
|
|
ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
|
2005-04-17 00:20:36 +02:00
|
|
|
free_newinfo_counters:
|
|
|
|
vfree(counters);
|
|
|
|
free_newinfo:
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_free_table_info(newinfo);
|
2005-04-17 00:20:36 +02:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* We're lazy, and add to the first CPU; overflow works its fey magic
|
|
|
|
* and everything is OK.
|
|
|
|
*/
|
|
|
|
static inline int add_counter_to_entry(struct arpt_entry *e,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
const struct xt_counters addme[],
|
2005-04-17 00:20:36 +02:00
|
|
|
unsigned int *i)
|
|
|
|
{
|
|
|
|
|
|
|
|
ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
|
|
|
|
|
|
|
|
(*i)++;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int do_add_counters(void __user *user, unsigned int len)
|
|
|
|
{
|
|
|
|
unsigned int i;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_counters_info tmp, *paddc;
|
2005-04-17 00:20:36 +02:00
|
|
|
struct arpt_table *t;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *private;
|
2005-10-26 09:34:24 +02:00
|
|
|
int ret = 0;
|
2005-12-14 08:13:48 +01:00
|
|
|
void *loc_cpu_entry;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
|
|
|
|
return -EFAULT;
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
if (len != sizeof(tmp) + tmp.num_counters*sizeof(struct xt_counters))
|
2005-04-17 00:20:36 +02:00
|
|
|
return -EINVAL;
|
|
|
|
|
2007-12-18 06:55:59 +01:00
|
|
|
paddc = vmalloc_node(len, numa_node_id());
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!paddc)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
if (copy_from_user(paddc, user, len) != 0) {
|
|
|
|
ret = -EFAULT;
|
|
|
|
goto free;
|
|
|
|
}
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
t = xt_find_table_lock(NF_ARP, tmp.name);
|
2005-10-26 09:34:24 +02:00
|
|
|
if (!t || IS_ERR(t)) {
|
|
|
|
ret = t ? PTR_ERR(t) : -ENOENT;
|
2005-04-17 00:20:36 +02:00
|
|
|
goto free;
|
2005-10-26 09:34:24 +02:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
write_lock_bh(&t->lock);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
private = t->private;
|
2006-05-19 11:16:52 +02:00
|
|
|
if (private->number != tmp.num_counters) {
|
2005-04-17 00:20:36 +02:00
|
|
|
ret = -EINVAL;
|
|
|
|
goto unlock_up_free;
|
|
|
|
}
|
|
|
|
|
|
|
|
i = 0;
|
2005-12-14 08:13:48 +01:00
|
|
|
/* Choose the copy that is on our node */
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
loc_cpu_entry = private->entries[smp_processor_id()];
|
2005-12-14 08:13:48 +01:00
|
|
|
ARPT_ENTRY_ITERATE(loc_cpu_entry,
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
private->size,
|
2005-04-17 00:20:36 +02:00
|
|
|
add_counter_to_entry,
|
|
|
|
paddc->counters,
|
|
|
|
&i);
|
|
|
|
unlock_up_free:
|
|
|
|
write_unlock_bh(&t->lock);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_table_unlock(t);
|
2005-10-26 09:34:24 +02:00
|
|
|
module_put(t->me);
|
2005-04-17 00:20:36 +02:00
|
|
|
free:
|
|
|
|
vfree(paddc);
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if (!capable(CAP_NET_ADMIN))
|
|
|
|
return -EPERM;
|
|
|
|
|
|
|
|
switch (cmd) {
|
|
|
|
case ARPT_SO_SET_REPLACE:
|
|
|
|
ret = do_replace(user, len);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case ARPT_SO_SET_ADD_COUNTERS:
|
|
|
|
ret = do_add_counters(user, len);
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
duprintf("do_arpt_set_ctl: unknown request %i\n", cmd);
|
|
|
|
ret = -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if (!capable(CAP_NET_ADMIN))
|
|
|
|
return -EPERM;
|
|
|
|
|
|
|
|
switch (cmd) {
|
|
|
|
case ARPT_SO_GET_INFO: {
|
|
|
|
char name[ARPT_TABLE_MAXNAMELEN];
|
|
|
|
struct arpt_table *t;
|
|
|
|
|
|
|
|
if (*len != sizeof(struct arpt_getinfo)) {
|
|
|
|
duprintf("length %u != %Zu\n", *len,
|
|
|
|
sizeof(struct arpt_getinfo));
|
|
|
|
ret = -EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (copy_from_user(name, user, sizeof(name)) != 0) {
|
|
|
|
ret = -EFAULT;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
name[ARPT_TABLE_MAXNAMELEN-1] = '\0';
|
2005-10-26 09:34:24 +02:00
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
t = try_then_request_module(xt_find_table_lock(NF_ARP, name),
|
2005-10-26 09:34:24 +02:00
|
|
|
"arptable_%s", name);
|
|
|
|
if (t && !IS_ERR(t)) {
|
2005-04-17 00:20:36 +02:00
|
|
|
struct arpt_getinfo info;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *private = t->private;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
info.valid_hooks = t->valid_hooks;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
memcpy(info.hook_entry, private->hook_entry,
|
2005-04-17 00:20:36 +02:00
|
|
|
sizeof(info.hook_entry));
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
memcpy(info.underflow, private->underflow,
|
2005-04-17 00:20:36 +02:00
|
|
|
sizeof(info.underflow));
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
info.num_entries = private->number;
|
|
|
|
info.size = private->size;
|
2005-04-17 00:20:36 +02:00
|
|
|
strcpy(info.name, name);
|
|
|
|
|
|
|
|
if (copy_to_user(user, &info, *len) != 0)
|
|
|
|
ret = -EFAULT;
|
|
|
|
else
|
|
|
|
ret = 0;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_table_unlock(t);
|
2005-10-26 09:34:24 +02:00
|
|
|
module_put(t->me);
|
|
|
|
} else
|
|
|
|
ret = t ? PTR_ERR(t) : -ENOENT;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case ARPT_SO_GET_ENTRIES: {
|
|
|
|
struct arpt_get_entries get;
|
|
|
|
|
|
|
|
if (*len < sizeof(get)) {
|
|
|
|
duprintf("get_entries: %u < %Zu\n", *len, sizeof(get));
|
|
|
|
ret = -EINVAL;
|
|
|
|
} else if (copy_from_user(&get, user, sizeof(get)) != 0) {
|
|
|
|
ret = -EFAULT;
|
|
|
|
} else if (*len != sizeof(struct arpt_get_entries) + get.size) {
|
|
|
|
duprintf("get_entries: %u != %Zu\n", *len,
|
|
|
|
sizeof(struct arpt_get_entries) + get.size);
|
|
|
|
ret = -EINVAL;
|
|
|
|
} else
|
|
|
|
ret = get_entries(&get, user);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2005-10-26 09:34:24 +02:00
|
|
|
case ARPT_SO_GET_REVISION_TARGET: {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_get_revision rev;
|
2005-10-26 09:34:24 +02:00
|
|
|
|
|
|
|
if (*len != sizeof(rev)) {
|
|
|
|
ret = -EINVAL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
|
|
|
|
ret = -EFAULT;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
try_then_request_module(xt_find_revision(NF_ARP, rev.name,
|
|
|
|
rev.revision, 1, &ret),
|
2005-10-26 09:34:24 +02:00
|
|
|
"arpt_%s", rev.name);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
default:
|
|
|
|
duprintf("do_arpt_get_ctl: unknown request %i\n", cmd);
|
|
|
|
ret = -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
int arpt_register_table(struct arpt_table *table,
|
|
|
|
const struct arpt_replace *repl)
|
|
|
|
{
|
|
|
|
int ret;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *newinfo;
|
2007-12-05 08:24:56 +01:00
|
|
|
struct xt_table_info bootstrap
|
2005-04-17 00:20:36 +02:00
|
|
|
= { 0, 0, 0, { 0 }, { 0 }, { } };
|
2005-12-14 08:13:48 +01:00
|
|
|
void *loc_cpu_entry;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
newinfo = xt_alloc_table_info(repl->size);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!newinfo) {
|
|
|
|
ret = -ENOMEM;
|
|
|
|
return ret;
|
|
|
|
}
|
2005-12-14 08:13:48 +01:00
|
|
|
|
|
|
|
/* choose the copy on our node/cpu */
|
|
|
|
loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
|
|
|
|
memcpy(loc_cpu_entry, repl->entries, repl->size);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
ret = translate_table(table->name, table->valid_hooks,
|
2005-12-14 08:13:48 +01:00
|
|
|
newinfo, loc_cpu_entry, repl->size,
|
2005-04-17 00:20:36 +02:00
|
|
|
repl->num_entries,
|
|
|
|
repl->hook_entry,
|
|
|
|
repl->underflow);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
duprintf("arpt_register_table: translate table gives %d\n", ret);
|
|
|
|
if (ret != 0) {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_free_table_info(newinfo);
|
2005-04-17 00:20:36 +02:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2006-06-27 12:00:09 +02:00
|
|
|
ret = xt_register_table(table, &bootstrap, newinfo);
|
|
|
|
if (ret != 0) {
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_free_table_info(newinfo);
|
2005-04-17 00:20:36 +02:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
return 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
void arpt_unregister_table(struct arpt_table *table)
|
|
|
|
{
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
struct xt_table_info *private;
|
2005-12-14 08:13:48 +01:00
|
|
|
void *loc_cpu_entry;
|
|
|
|
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
private = xt_unregister_table(table);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Decrease module usage counts and free resources */
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
loc_cpu_entry = private->entries[raw_smp_processor_id()];
|
|
|
|
ARPT_ENTRY_ITERATE(loc_cpu_entry, private->size,
|
2005-04-17 00:20:36 +02:00
|
|
|
cleanup_entry, NULL);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_free_table_info(private);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* The built-in targets: standard (NULL) and error. */
|
2007-07-08 07:22:02 +02:00
|
|
|
static struct arpt_target arpt_standard_target __read_mostly = {
|
2005-04-17 00:20:36 +02:00
|
|
|
.name = ARPT_STANDARD_TARGET,
|
2006-03-21 03:01:28 +01:00
|
|
|
.targetsize = sizeof(int),
|
2006-03-22 22:55:40 +01:00
|
|
|
.family = NF_ARP,
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
2007-07-08 07:22:02 +02:00
|
|
|
static struct arpt_target arpt_error_target __read_mostly = {
|
2005-04-17 00:20:36 +02:00
|
|
|
.name = ARPT_ERROR_TARGET,
|
|
|
|
.target = arpt_error,
|
2006-03-21 03:01:28 +01:00
|
|
|
.targetsize = ARPT_FUNCTION_MAXNAMELEN,
|
2006-03-22 22:55:40 +01:00
|
|
|
.family = NF_ARP,
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
static struct nf_sockopt_ops arpt_sockopts = {
|
|
|
|
.pf = PF_INET,
|
|
|
|
.set_optmin = ARPT_BASE_CTL,
|
|
|
|
.set_optmax = ARPT_SO_SET_MAX+1,
|
|
|
|
.set = do_arpt_set_ctl,
|
|
|
|
.get_optmin = ARPT_BASE_CTL,
|
|
|
|
.get_optmax = ARPT_SO_GET_MAX+1,
|
|
|
|
.get = do_arpt_get_ctl,
|
[NETFILTER]: Fix/improve deadlock condition on module removal netfilter
So I've had a deadlock reported to me. I've found that the sequence of
events goes like this:
1) process A (modprobe) runs to remove ip_tables.ko
2) process B (iptables-restore) runs and calls setsockopt on a netfilter socket,
increasing the ip_tables socket_ops use count
3) process A acquires a file lock on the file ip_tables.ko, calls remove_module
in the kernel, which in turn executes the ip_tables module cleanup routine,
which calls nf_unregister_sockopt
4) nf_unregister_sockopt, seeing that the use count is non-zero, puts the
calling process into uninterruptible sleep, expecting the process using the
socket option code to wake it up when it exits the kernel
4) the user of the socket option code (process B) in do_ipt_get_ctl, calls
ipt_find_table_lock, which in this case calls request_module to load
ip_tables_nat.ko
5) request_module forks a copy of modprobe (process C) to load the module and
blocks until modprobe exits.
6) Process C. forked by request_module process the dependencies of
ip_tables_nat.ko, of which ip_tables.ko is one.
7) Process C attempts to lock the request module and all its dependencies, it
blocks when it attempts to lock ip_tables.ko (which was previously locked in
step 3)
Theres not really any great permanent solution to this that I can see, but I've
developed a two part solution that corrects the problem
Part 1) Modifies the nf_sockopt registration code so that, instead of using a
use counter internal to the nf_sockopt_ops structure, we instead use a pointer
to the registering modules owner to do module reference counting when nf_sockopt
calls a modules set/get routine. This prevents the deadlock by preventing set 4
from happening.
Part 2) Enhances the modprobe utilty so that by default it preforms non-blocking
remove operations (the same way rmmod does), and add an option to explicity
request blocking operation. So if you select blocking operation in modprobe you
can still cause the above deadlock, but only if you explicity try (and since
root can do any old stupid thing it would like.... :) ).
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2007-09-11 11:28:26 +02:00
|
|
|
.owner = THIS_MODULE,
|
2005-04-17 00:20:36 +02:00
|
|
|
};
|
|
|
|
|
2006-03-29 02:37:06 +02:00
|
|
|
static int __init arp_tables_init(void)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
2006-08-14 03:57:28 +02:00
|
|
|
ret = xt_proto_init(NF_ARP);
|
|
|
|
if (ret < 0)
|
|
|
|
goto err1;
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/* Noone else will be downing sem now, so we won't sleep */
|
2006-08-14 03:57:28 +02:00
|
|
|
ret = xt_register_target(&arpt_standard_target);
|
|
|
|
if (ret < 0)
|
|
|
|
goto err2;
|
|
|
|
ret = xt_register_target(&arpt_error_target);
|
|
|
|
if (ret < 0)
|
|
|
|
goto err3;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* Register setsockopt */
|
|
|
|
ret = nf_register_sockopt(&arpt_sockopts);
|
2006-08-14 03:57:28 +02:00
|
|
|
if (ret < 0)
|
|
|
|
goto err4;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-07-15 05:46:15 +02:00
|
|
|
printk(KERN_INFO "arp_tables: (C) 2002 David S. Miller\n");
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0;
|
2006-08-14 03:57:28 +02:00
|
|
|
|
|
|
|
err4:
|
|
|
|
xt_unregister_target(&arpt_error_target);
|
|
|
|
err3:
|
|
|
|
xt_unregister_target(&arpt_standard_target);
|
|
|
|
err2:
|
|
|
|
xt_proto_fini(NF_ARP);
|
|
|
|
err1:
|
|
|
|
return ret;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2006-03-29 02:37:06 +02:00
|
|
|
static void __exit arp_tables_fini(void)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
nf_unregister_sockopt(&arpt_sockopts);
|
2006-10-12 23:08:11 +02:00
|
|
|
xt_unregister_target(&arpt_error_target);
|
|
|
|
xt_unregister_target(&arpt_standard_target);
|
[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables
This monster-patch tries to do the best job for unifying the data
structures and backend interfaces for the three evil clones ip_tables,
ip6_tables and arp_tables. In an ideal world we would never have
allowed this kind of copy+paste programming... but well, our world
isn't (yet?) ideal.
o introduce a new x_tables module
o {ip,arp,ip6}_tables depend on this x_tables module
o registration functions for tables, matches and targets are only
wrappers around x_tables provided functions
o all matches/targets that are used from ip_tables and ip6_tables
are now implemented as xt_FOOBAR.c files and provide module aliases
to ipt_FOOBAR and ip6t_FOOBAR
o header files for xt_matches are in include/linux/netfilter/,
include/linux/netfilter_{ipv4,ipv6} contains compatibility wrappers
around the xt_FOOBAR.h headers
Based on this patchset we're going to further unify the code,
gradually getting rid of all the layer 3 specific assumptions.
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-01-12 22:30:04 +01:00
|
|
|
xt_proto_fini(NF_ARP);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(arpt_register_table);
|
|
|
|
EXPORT_SYMBOL(arpt_unregister_table);
|
|
|
|
EXPORT_SYMBOL(arpt_do_table);
|
|
|
|
|
2006-03-29 02:37:06 +02:00
|
|
|
module_init(arp_tables_init);
|
|
|
|
module_exit(arp_tables_fini);
|