projects / GitHub / moto-9609 / android_kernel_motorola_exynos9610.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[PATCH] capable/capability.h (fs/)
[GitHub/moto-9609/android_kernel_motorola_exynos9610.git] / net / ipv4 / netfilter / arp_tables.c
CommitLineData
1da177e4
LT		 1/*
2 * Packet matching code for ARP packets.
3 *
4 * Based heavily, if not almost entirely, upon ip_tables.c framework.
5 *
6 * Some ARP specific bits are:
7 *
8 * Copyright (C) 2002 David S. Miller (davem@redhat.com)
9 *
10 */
11
12#include <linux/config.h>
13#include <linux/kernel.h>
14#include <linux/skbuff.h>
15#include <linux/netdevice.h>
16#include <linux/if_arp.h>
17#include <linux/kmod.h>
18#include <linux/vmalloc.h>
19#include <linux/proc_fs.h>
20#include <linux/module.h>
21#include <linux/init.h>
22
23#include <asm/uaccess.h>
24#include <asm/semaphore.h>
25
26#include <linux/netfilter_arp/arp_tables.h>
27
28MODULE_LICENSE("GPL");
29MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
30MODULE_DESCRIPTION("arptables core");
31
32/*#define DEBUG_ARP_TABLES*/
33/*#define DEBUG_ARP_TABLES_USER*/
34
35#ifdef DEBUG_ARP_TABLES
36#define dprintf(format, args...) printk(format , ## args)
37#else
38#define dprintf(format, args...)
39#endif
40
41#ifdef DEBUG_ARP_TABLES_USER
42#define duprintf(format, args...) printk(format , ## args)
43#else
44#define duprintf(format, args...)
45#endif
46
47#ifdef CONFIG_NETFILTER_DEBUG
48#define ARP_NF_ASSERT(x) \
49do { \
50 if (!(x)) \
51 printk("ARP_NF_ASSERT: %s:%s:%u\n", \
52 __FUNCTION__, __FILE__, __LINE__); \
53} while(0)
54#else
55#define ARP_NF_ASSERT(x)
56#endif
57#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
58
59static DECLARE_MUTEX(arpt_mutex);
60
61#define ASSERT_READ_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
62#define ASSERT_WRITE_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
1da177e4
LT		 63#include <linux/netfilter_ipv4/listhelp.h>
64
65struct arpt_table_info {
66 unsigned int size;
67 unsigned int number;
68 unsigned int initial_entries;
69 unsigned int hook_entry[NF_ARP_NUMHOOKS];
70 unsigned int underflow[NF_ARP_NUMHOOKS];
31836064 71 void *entries[NR_CPUS];
1da177e4
LT		 72};
73
74static LIST_HEAD(arpt_target);
75static LIST_HEAD(arpt_tables);
31836064 76#define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
1da177e4
LT		 77#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
78
1da177e4
LT		 79static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
80 char *hdr_addr, int len)
81{
82 int i, ret;
83
84 if (len > ARPT_DEV_ADDR_LEN_MAX)
85 len = ARPT_DEV_ADDR_LEN_MAX;
86
87 ret = 0;
88 for (i = 0; i < len; i++)
89 ret |= (hdr_addr[i] ^ ap->addr[i]) & ap->mask[i];
90
91 return (ret != 0);
92}
93
94/* Returns whether packet matches rule or not. */
95static inline int arp_packet_match(const struct arphdr *arphdr,
96 struct net_device *dev,
97 const char *indev,
98 const char *outdev,
99 const struct arpt_arp *arpinfo)
100{
101 char *arpptr = (char *)(arphdr + 1);
102 char *src_devaddr, *tgt_devaddr;
103 u32 src_ipaddr, tgt_ipaddr;
104 int i, ret;
105
106#define FWINV(bool,invflg) ((bool) ^ !!(arpinfo->invflags & invflg))
107
108 if (FWINV((arphdr->ar_op & arpinfo->arpop_mask) != arpinfo->arpop,
109 ARPT_INV_ARPOP)) {
110 dprintf("ARP operation field mismatch.\n");
111 dprintf("ar_op: %04x info->arpop: %04x info->arpop_mask: %04x\n",
112 arphdr->ar_op, arpinfo->arpop, arpinfo->arpop_mask);
113 return 0;
114 }
115
116 if (FWINV((arphdr->ar_hrd & arpinfo->arhrd_mask) != arpinfo->arhrd,
117 ARPT_INV_ARPHRD)) {
118 dprintf("ARP hardware address format mismatch.\n");
119 dprintf("ar_hrd: %04x info->arhrd: %04x info->arhrd_mask: %04x\n",
120 arphdr->ar_hrd, arpinfo->arhrd, arpinfo->arhrd_mask);
121 return 0;
122 }
123
124 if (FWINV((arphdr->ar_pro & arpinfo->arpro_mask) != arpinfo->arpro,
125 ARPT_INV_ARPPRO)) {
126 dprintf("ARP protocol address format mismatch.\n");
127 dprintf("ar_pro: %04x info->arpro: %04x info->arpro_mask: %04x\n",
128 arphdr->ar_pro, arpinfo->arpro, arpinfo->arpro_mask);
129 return 0;
130 }
131
132 if (FWINV((arphdr->ar_hln & arpinfo->arhln_mask) != arpinfo->arhln,
133 ARPT_INV_ARPHLN)) {
134 dprintf("ARP hardware address length mismatch.\n");
135 dprintf("ar_hln: %02x info->arhln: %02x info->arhln_mask: %02x\n",
136 arphdr->ar_hln, arpinfo->arhln, arpinfo->arhln_mask);
137 return 0;
138 }
139
140 src_devaddr = arpptr;
141 arpptr += dev->addr_len;
142 memcpy(&src_ipaddr, arpptr, sizeof(u32));
143 arpptr += sizeof(u32);
144 tgt_devaddr = arpptr;
145 arpptr += dev->addr_len;
146 memcpy(&tgt_ipaddr, arpptr, sizeof(u32));
147
148 if (FWINV(arp_devaddr_compare(&arpinfo->src_devaddr, src_devaddr, dev->addr_len),
149 ARPT_INV_SRCDEVADDR) ||
150 FWINV(arp_devaddr_compare(&arpinfo->tgt_devaddr, tgt_devaddr, dev->addr_len),
151 ARPT_INV_TGTDEVADDR)) {
152 dprintf("Source or target device address mismatch.\n");
153
154 return 0;
155 }
156
157 if (FWINV((src_ipaddr & arpinfo->smsk.s_addr) != arpinfo->src.s_addr,
158 ARPT_INV_SRCIP) ||
159 FWINV(((tgt_ipaddr & arpinfo->tmsk.s_addr) != arpinfo->tgt.s_addr),
160 ARPT_INV_TGTIP)) {
161 dprintf("Source or target IP address mismatch.\n");
162
163 dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
164 NIPQUAD(src_ipaddr),
165 NIPQUAD(arpinfo->smsk.s_addr),
166 NIPQUAD(arpinfo->src.s_addr),
167 arpinfo->invflags & ARPT_INV_SRCIP ? " (INV)" : "");
168 dprintf("TGT: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
169 NIPQUAD(tgt_ipaddr),
170 NIPQUAD(arpinfo->tmsk.s_addr),
171 NIPQUAD(arpinfo->tgt.s_addr),
172 arpinfo->invflags & ARPT_INV_TGTIP ? " (INV)" : "");
173 return 0;
174 }
175
176 /* Look for ifname matches. */
177 for (i = 0, ret = 0; i < IFNAMSIZ; i++) {
178 ret |= (indev[i] ^ arpinfo->iniface[i])
179 & arpinfo->iniface_mask[i];
180 }
181
182 if (FWINV(ret != 0, ARPT_INV_VIA_IN)) {
183 dprintf("VIA in mismatch (%s vs %s).%s\n",
184 indev, arpinfo->iniface,
185 arpinfo->invflags&ARPT_INV_VIA_IN ?" (INV)":"");
186 return 0;
187 }
188
189 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
190 unsigned long odev;
191 memcpy(&odev, outdev + i*sizeof(unsigned long),
192 sizeof(unsigned long));
193 ret |= (odev
194 ^ ((const unsigned long *)arpinfo->outiface)[i])
195 & ((const unsigned long *)arpinfo->outiface_mask)[i];
196 }
197
198 if (FWINV(ret != 0, ARPT_INV_VIA_OUT)) {
199 dprintf("VIA out mismatch (%s vs %s).%s\n",
200 outdev, arpinfo->outiface,
201 arpinfo->invflags&ARPT_INV_VIA_OUT ?" (INV)":"");
202 return 0;
203 }
204
205 return 1;
206}
207
208static inline int arp_checkentry(const struct arpt_arp *arp)
209{
210 if (arp->flags & ~ARPT_F_MASK) {
211 duprintf("Unknown flag bits set: %08X\n",
212 arp->flags & ~ARPT_F_MASK);
213 return 0;
214 }
215 if (arp->invflags & ~ARPT_INV_MASK) {
216 duprintf("Unknown invflag bits set: %08X\n",
217 arp->invflags & ~ARPT_INV_MASK);
218 return 0;
219 }
220
221 return 1;
222}
223
224static unsigned int arpt_error(struct sk_buff **pskb,
225 unsigned int hooknum,
226 const struct net_device *in,
227 const struct net_device *out,
228 const void *targinfo,
229 void *userinfo)
230{
231 if (net_ratelimit())
232 printk("arp_tables: error: '%s'\n", (char *)targinfo);
233
234 return NF_DROP;
235}
236
237static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
238{
239 return (struct arpt_entry *)(base + offset);
240}
241
242unsigned int arpt_do_table(struct sk_buff **pskb,
243 unsigned int hook,
244 const struct net_device *in,
245 const struct net_device *out,
246 struct arpt_table *table,
247 void *userdata)
248{
249 static const char nulldevname[IFNAMSIZ];
250 unsigned int verdict = NF_DROP;
251 struct arphdr *arp;
252 int hotdrop = 0;
253 struct arpt_entry *e, *back;
254 const char *indev, *outdev;
255 void *table_base;
256
257 /* ARP header, plus 2 device addresses, plus 2 IP addresses. */
258 if (!pskb_may_pull((*pskb), (sizeof(struct arphdr) +
259 (2 * (*pskb)->dev->addr_len) +
260 (2 * sizeof(u32)))))
261 return NF_DROP;
262
263 indev = in ? in->name : nulldevname;
264 outdev = out ? out->name : nulldevname;
265
266 read_lock_bh(&table->lock);
31836064 267 table_base = (void *)table->private->entries[smp_processor_id()];
1da177e4
LT		 268 e = get_entry(table_base, table->private->hook_entry[hook]);
269 back = get_entry(table_base, table->private->underflow[hook]);
270
271 arp = (*pskb)->nh.arph;
272 do {
273 if (arp_packet_match(arp, (*pskb)->dev, indev, outdev, &e->arp)) {
274 struct arpt_entry_target *t;
275 int hdr_len;
276
277 hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
278 (2 * (*pskb)->dev->addr_len);
279 ADD_COUNTER(e->counters, hdr_len, 1);
280
281 t = arpt_get_target(e);
282
283 /* Standard target? */
284 if (!t->u.kernel.target->target) {
285 int v;
286
287 v = ((struct arpt_standard_target *)t)->verdict;
288 if (v < 0) {
289 /* Pop from stack? */
290 if (v != ARPT_RETURN) {
291 verdict = (unsigned)(-v) - 1;
292 break;
293 }
294 e = back;
295 back = get_entry(table_base,
296 back->comefrom);
297 continue;
298 }
299 if (table_base + v
300 != (void *)e + e->next_offset) {
301 /* Save old back ptr in next entry */
302 struct arpt_entry *next
303 = (void *)e + e->next_offset;
304 next->comefrom =
305 (void *)back - table_base;
306
307 /* set back pointer to next entry */
308 back = next;
309 }
310
311 e = get_entry(table_base, v);
312 } else {
313 /* Targets which reenter must return
314 * abs. verdicts
315 */
316 verdict = t->u.kernel.target->target(pskb,
317 hook,
318 in, out,
319 t->data,
320 userdata);
321
322 /* Target might have changed stuff. */
323 arp = (*pskb)->nh.arph;
324
325 if (verdict == ARPT_CONTINUE)
326 e = (void *)e + e->next_offset;
327 else
328 /* Verdict */
329 break;
330 }
331 } else {
332 e = (void *)e + e->next_offset;
333 }
334 } while (!hotdrop);
335 read_unlock_bh(&table->lock);
336
337 if (hotdrop)
338 return NF_DROP;
339 else
340 return verdict;
341}
342
6b7d31fc
HW		 343/*
344 * These are weird, but module loading must not be done with mutex
345 * held (since they will register), and we have to have a single
346 * function to use try_then_request_module().
347 */
348
349/* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
350static inline struct arpt_table *find_table_lock(const char *name)
1da177e4 351{
6b7d31fc 352 struct arpt_table *t;
1da177e4 353
6b7d31fc
HW		 354 if (down_interruptible(&arpt_mutex) != 0)
355 return ERR_PTR(-EINTR);
1da177e4 356
6b7d31fc
HW		 357 list_for_each_entry(t, &arpt_tables, list)
358 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
359 return t;
360 up(&arpt_mutex);
361 return NULL;
1da177e4
LT		 362}
363
1da177e4 364
6b7d31fc
HW		 365/* Find target, grabs ref. Returns ERR_PTR() on error. */
366static inline struct arpt_target *find_target(const char *name, u8 revision)
367{
368 struct arpt_target *t;
369 int err = 0;
370
371 if (down_interruptible(&arpt_mutex) != 0)
372 return ERR_PTR(-EINTR);
373
374 list_for_each_entry(t, &arpt_target, list) {
375 if (strcmp(t->name, name) == 0) {
376 if (t->revision == revision) {
377 if (try_module_get(t->me)) {
378 up(&arpt_mutex);
379 return t;
380 }
381 } else
382 err = -EPROTOTYPE; /* Found something. */
383 }
1da177e4 384 }
6b7d31fc
HW		 385 up(&arpt_mutex);
386 return ERR_PTR(err);
387}
1da177e4 388
6b7d31fc
HW		 389struct arpt_target *arpt_find_target(const char *name, u8 revision)
390{
391 struct arpt_target *target;
392
393 target = try_then_request_module(find_target(name, revision),
394 "arpt_%s", name);
395 if (IS_ERR(target) || !target)
396 return NULL;
397 return target;
1da177e4 398}
1da177e4 399
6b7d31fc 400static int target_revfn(const char *name, u8 revision, int *bestp)
1da177e4 401{
6b7d31fc
HW		 402 struct arpt_target *t;
403 int have_rev = 0;
404
405 list_for_each_entry(t, &arpt_target, list) {
406 if (strcmp(t->name, name) == 0) {
407 if (t->revision > *bestp)
408 *bestp = t->revision;
409 if (t->revision == revision)
410 have_rev =1;
411 }
412 }
413 return have_rev;
1da177e4
LT		 414}
415
6b7d31fc
HW		 416/* Returns true or false (if no such extension at all) */
417static inline int find_revision(const char *name, u8 revision,
418 int (*revfn)(const char *, u8, int *),
419 int *err)
1da177e4 420{
6b7d31fc
HW		 421 int have_rev, best = -1;
422
423 if (down_interruptible(&arpt_mutex) != 0) {
424 *err = -EINTR;
425 return 1;
426 }
427 have_rev = revfn(name, revision, &best);
428 up(&arpt_mutex);
429
430 /* Nothing at all? Return 0 to try loading module. */
431 if (best == -1) {
432 *err = -ENOENT;
433 return 0;
434 }
435
436 *err = best;
437 if (!have_rev)
438 *err = -EPROTONOSUPPORT;
439 return 1;
1da177e4
LT		 440}
441
6b7d31fc 442
1da177e4
LT		 443/* All zeroes == unconditional rule. */
444static inline int unconditional(const struct arpt_arp *arp)
445{
446 unsigned int i;
447
448 for (i = 0; i < sizeof(*arp)/sizeof(__u32); i++)
449 if (((__u32 *)arp)[i])
450 return 0;
451
452 return 1;
453}
454
455/* Figures out from what hook each rule can be called: returns 0 if
456 * there are loops. Puts hook bitmask in comefrom.
457 */
31836064
ED		 458static int mark_source_chains(struct arpt_table_info *newinfo,
459 unsigned int valid_hooks, void *entry0)
1da177e4
LT		 460{
461 unsigned int hook;
462
463 /* No recursion; use packet counter to save back ptrs (reset
464 * to 0 as we leave), and comefrom to save source hook bitmask.
465 */
466 for (hook = 0; hook < NF_ARP_NUMHOOKS; hook++) {
467 unsigned int pos = newinfo->hook_entry[hook];
468 struct arpt_entry *e
31836064 469 = (struct arpt_entry *)(entry0 + pos);
1da177e4
LT		 470
471 if (!(valid_hooks & (1 << hook)))
472 continue;
473
474 /* Set initial back pointer. */
475 e->counters.pcnt = pos;
476
477 for (;;) {
478 struct arpt_standard_target *t
479 = (void *)arpt_get_target(e);
480
481 if (e->comefrom & (1 << NF_ARP_NUMHOOKS)) {
482 printk("arptables: loop hook %u pos %u %08X.\n",
483 hook, pos, e->comefrom);
484 return 0;
485 }
486 e->comefrom
487 |= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
488
489 /* Unconditional return/END. */
490 if (e->target_offset == sizeof(struct arpt_entry)
491 && (strcmp(t->target.u.user.name,
492 ARPT_STANDARD_TARGET) == 0)
493 && t->verdict < 0
494 && unconditional(&e->arp)) {
495 unsigned int oldpos, size;
496
497 /* Return: backtrack through the last
498 * big jump.
499 */
500 do {
501 e->comefrom ^= (1<<NF_ARP_NUMHOOKS);
502 oldpos = pos;
503 pos = e->counters.pcnt;
504 e->counters.pcnt = 0;
505
506 /* We're at the start. */
507 if (pos == oldpos)
508 goto next;
509
510 e = (struct arpt_entry *)
31836064 511 (entry0 + pos);
1da177e4
LT		 512 } while (oldpos == pos + e->next_offset);
513
514 /* Move along one */
515 size = e->next_offset;
516 e = (struct arpt_entry *)
31836064 517 (entry0 + pos + size);
1da177e4
LT		 518 e->counters.pcnt = pos;
519 pos += size;
520 } else {
521 int newpos = t->verdict;
522
523 if (strcmp(t->target.u.user.name,
524 ARPT_STANDARD_TARGET) == 0
525 && newpos >= 0) {
526 /* This a jump; chase it. */
527 duprintf("Jump rule %u -> %u\n",
528 pos, newpos);
529 } else {
530 /* ... this is a fallthru */
531 newpos = pos + e->next_offset;
532 }
533 e = (struct arpt_entry *)
31836064 534 (entry0 + newpos);
1da177e4
LT		 535 e->counters.pcnt = pos;
536 pos = newpos;
537 }
538 }
539 next:
540 duprintf("Finished chain %u\n", hook);
541 }
542 return 1;
543}
544
545static inline int standard_check(const struct arpt_entry_target *t,
546 unsigned int max_offset)
547{
548 struct arpt_standard_target *targ = (void *)t;
549
550 /* Check standard info. */
551 if (t->u.target_size
552 != ARPT_ALIGN(sizeof(struct arpt_standard_target))) {
553 duprintf("arpt_standard_check: target size %u != %Zu\n",
554 t->u.target_size,
555 ARPT_ALIGN(sizeof(struct arpt_standard_target)));
556 return 0;
557 }
558
559 if (targ->verdict >= 0
560 && targ->verdict > max_offset - sizeof(struct arpt_entry)) {
561 duprintf("arpt_standard_check: bad verdict (%i)\n",
562 targ->verdict);
563 return 0;
564 }
565
566 if (targ->verdict < -NF_MAX_VERDICT - 1) {
567 duprintf("arpt_standard_check: bad negative verdict (%i)\n",
568 targ->verdict);
569 return 0;
570 }
571 return 1;
572}
573
574static struct arpt_target arpt_standard_target;
575
576static inline int check_entry(struct arpt_entry *e, const char *name, unsigned int size,
577 unsigned int *i)
578{
579 struct arpt_entry_target *t;
580 struct arpt_target *target;
581 int ret;
582
583 if (!arp_checkentry(&e->arp)) {
584 duprintf("arp_tables: arp check failed %p %s.\n", e, name);
585 return -EINVAL;
586 }
587
588 t = arpt_get_target(e);
6b7d31fc
HW		 589 target = try_then_request_module(find_target(t->u.user.name,
590 t->u.user.revision),
591 "arpt_%s", t->u.user.name);
592 if (IS_ERR(target) || !target) {
1da177e4 593 duprintf("check_entry: `%s' not found\n", t->u.user.name);
6b7d31fc 594 ret = target ? PTR_ERR(target) : -ENOENT;
1da177e4
LT		 595 goto out;
596 }
1da177e4 597 t->u.kernel.target = target;
1da177e4
LT		 598
599 if (t->u.kernel.target == &arpt_standard_target) {
600 if (!standard_check(t, size)) {
601 ret = -EINVAL;
602 goto out;
603 }
604 } else if (t->u.kernel.target->checkentry
605 && !t->u.kernel.target->checkentry(name, e, t->data,
606 t->u.target_size
607 - sizeof(*t),
608 e->comefrom)) {
609 module_put(t->u.kernel.target->me);
610 duprintf("arp_tables: check failed for `%s'.\n",
611 t->u.kernel.target->name);
612 ret = -EINVAL;
613 goto out;
614 }
615
616 (*i)++;
617 return 0;
618
1da177e4
LT		 619out:
620 return ret;
621}
622
623static inline int check_entry_size_and_hooks(struct arpt_entry *e,
624 struct arpt_table_info *newinfo,
625 unsigned char *base,
626 unsigned char *limit,
627 const unsigned int *hook_entries,
628 const unsigned int *underflows,
629 unsigned int *i)
630{
631 unsigned int h;
632
633 if ((unsigned long)e % __alignof__(struct arpt_entry) != 0
634 || (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
635 duprintf("Bad offset %p\n", e);
636 return -EINVAL;
637 }
638
639 if (e->next_offset
640 < sizeof(struct arpt_entry) + sizeof(struct arpt_entry_target)) {
641 duprintf("checking: element %p size %u\n",
642 e, e->next_offset);
643 return -EINVAL;
644 }
645
646 /* Check hooks & underflows */
647 for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
648 if ((unsigned char *)e - base == hook_entries[h])
649 newinfo->hook_entry[h] = hook_entries[h];
650 if ((unsigned char *)e - base == underflows[h])
651 newinfo->underflow[h] = underflows[h];
652 }
653
654 /* FIXME: underflows must be unconditional, standard verdicts
655 < 0 (not ARPT_RETURN). --RR */
656
657 /* Clear counters and comefrom */
658 e->counters = ((struct arpt_counters) { 0, 0 });
659 e->comefrom = 0;
660
661 (*i)++;
662 return 0;
663}
664
665static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
666{
667 struct arpt_entry_target *t;
668
669 if (i && (*i)-- == 0)
670 return 1;
671
672 t = arpt_get_target(e);
673 if (t->u.kernel.target->destroy)
674 t->u.kernel.target->destroy(t->data,
675 t->u.target_size - sizeof(*t));
676 module_put(t->u.kernel.target->me);
677 return 0;
678}
679
680/* Checks and translates the user-supplied table segment (held in
681 * newinfo).
682 */
683static int translate_table(const char *name,
684 unsigned int valid_hooks,
685 struct arpt_table_info *newinfo,
31836064 686 void *entry0,
1da177e4
LT		 687 unsigned int size,
688 unsigned int number,
689 const unsigned int *hook_entries,
690 const unsigned int *underflows)
691{
692 unsigned int i;
693 int ret;
694
695 newinfo->size = size;
696 newinfo->number = number;
697
698 /* Init all hooks to impossible value. */
699 for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
700 newinfo->hook_entry[i] = 0xFFFFFFFF;
701 newinfo->underflow[i] = 0xFFFFFFFF;
702 }
703
704 duprintf("translate_table: size %u\n", newinfo->size);
705 i = 0;
706
707 /* Walk through entries, checking offsets. */
31836064 708 ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
1da177e4
LT		 709 check_entry_size_and_hooks,
710 newinfo,
31836064
ED		 711 entry0,
712 entry0 + size,
1da177e4
LT		 713 hook_entries, underflows, &i);
714 duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
715 if (ret != 0)
716 return ret;
717
718 if (i != number) {
719 duprintf("translate_table: %u not %u entries\n",
720 i, number);
721 return -EINVAL;
722 }
723
724 /* Check hooks all assigned */
725 for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
726 /* Only hooks which are valid */
727 if (!(valid_hooks & (1 << i)))
728 continue;
729 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
730 duprintf("Invalid hook entry %u %u\n",
731 i, hook_entries[i]);
732 return -EINVAL;
733 }
734 if (newinfo->underflow[i] == 0xFFFFFFFF) {
735 duprintf("Invalid underflow %u %u\n",
736 i, underflows[i]);
737 return -EINVAL;
738 }
739 }
740
31836064 741 if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
1da177e4
LT		 742 duprintf("Looping hook\n");
743 return -ELOOP;
744 }
745
746 /* Finally, each sanity check must pass */
747 i = 0;
31836064 748 ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
1da177e4
LT		 749 check_entry, name, size, &i);
750
751 if (ret != 0) {
31836064 752 ARPT_ENTRY_ITERATE(entry0, newinfo->size,
1da177e4
LT		 753 cleanup_entry, &i);
754 return ret;
755 }
756
757 /* And one copy for every other CPU */
c8923c6b 758 for_each_cpu(i) {
31836064
ED		 759 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
760 memcpy(newinfo->entries[i], entry0, newinfo->size);
1da177e4
LT		 761 }
762
763 return ret;
764}
765
766static struct arpt_table_info *replace_table(struct arpt_table *table,
767 unsigned int num_counters,
768 struct arpt_table_info *newinfo,
769 int *error)
770{
771 struct arpt_table_info *oldinfo;
772
773 /* Do the substitution. */
774 write_lock_bh(&table->lock);
775 /* Check inside lock: is the old number correct? */
776 if (num_counters != table->private->number) {
777 duprintf("num_counters != table->private->number (%u/%u)\n",
778 num_counters, table->private->number);
779 write_unlock_bh(&table->lock);
780 *error = -EAGAIN;
781 return NULL;
782 }
783 oldinfo = table->private;
784 table->private = newinfo;
785 newinfo->initial_entries = oldinfo->initial_entries;
786 write_unlock_bh(&table->lock);
787
788 return oldinfo;
789}
790
791/* Gets counters. */
792static inline int add_entry_to_counter(const struct arpt_entry *e,
793 struct arpt_counters total[],
794 unsigned int *i)
795{
796 ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
797
798 (*i)++;
799 return 0;
800}
801
31836064
ED		 802static inline int set_entry_to_counter(const struct arpt_entry *e,
803 struct arpt_counters total[],
804 unsigned int *i)
805{
806 SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
807
808 (*i)++;
809 return 0;
810}
811
1da177e4
LT		 812static void get_counters(const struct arpt_table_info *t,
813 struct arpt_counters counters[])
814{
815 unsigned int cpu;
816 unsigned int i;
31836064
ED		 817 unsigned int curcpu;
818
819 /* Instead of clearing (by a previous call to memset())
820 * the counters and using adds, we set the counters
821 * with data used by 'current' CPU
822 * We dont care about preemption here.
823 */
824 curcpu = raw_smp_processor_id();
825
826 i = 0;
827 ARPT_ENTRY_ITERATE(t->entries[curcpu],
828 t->size,
829 set_entry_to_counter,
830 counters,
831 &i);
1da177e4 832
c8923c6b 833 for_each_cpu(cpu) {
31836064
ED		 834 if (cpu == curcpu)
835 continue;
1da177e4 836 i = 0;
31836064 837 ARPT_ENTRY_ITERATE(t->entries[cpu],
1da177e4
LT		 838 t->size,
839 add_entry_to_counter,
840 counters,
841 &i);
842 }
843}
844
845static int copy_entries_to_user(unsigned int total_size,
846 struct arpt_table *table,
847 void __user *userptr)
848{
849 unsigned int off, num, countersize;
850 struct arpt_entry *e;
851 struct arpt_counters *counters;
852 int ret = 0;
31836064 853 void *loc_cpu_entry;
1da177e4
LT		 854
855 /* We need atomic snapshot of counters: rest doesn't change
856 * (other than comefrom, which userspace doesn't care
857 * about).
858 */
859 countersize = sizeof(struct arpt_counters) * table->private->number;
860 counters = vmalloc(countersize);
861
862 if (counters == NULL)
863 return -ENOMEM;
864
865 /* First, sum counters... */
1da177e4
LT		 866 write_lock_bh(&table->lock);
867 get_counters(table->private, counters);
868 write_unlock_bh(&table->lock);
869
31836064
ED		 870 loc_cpu_entry = table->private->entries[raw_smp_processor_id()];
871 /* ... then copy entire thing ... */
872 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
1da177e4
LT		 873 ret = -EFAULT;
874 goto free_counters;
875 }
876
877 /* FIXME: use iterator macros --RR */
878 /* ... then go back and fix counters and names */
879 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
880 struct arpt_entry_target *t;
881
31836064 882 e = (struct arpt_entry *)(loc_cpu_entry + off);
1da177e4
LT		 883 if (copy_to_user(userptr + off
884 + offsetof(struct arpt_entry, counters),
885 &counters[num],
886 sizeof(counters[num])) != 0) {
887 ret = -EFAULT;
888 goto free_counters;
889 }
890
891 t = arpt_get_target(e);
892 if (copy_to_user(userptr + off + e->target_offset
893 + offsetof(struct arpt_entry_target,
894 u.user.name),
895 t->u.kernel.target->name,
896 strlen(t->u.kernel.target->name)+1) != 0) {
897 ret = -EFAULT;
898 goto free_counters;
899 }
900 }
901
902 free_counters:
903 vfree(counters);
904 return ret;
905}
906
907static int get_entries(const struct arpt_get_entries *entries,
908 struct arpt_get_entries __user *uptr)
909{
910 int ret;
911 struct arpt_table *t;
912
6b7d31fc
HW		 913 t = find_table_lock(entries->name);
914 if (t || !IS_ERR(t)) {
1da177e4
LT		 915 duprintf("t->private->number = %u\n",
916 t->private->number);
917 if (entries->size == t->private->size)
918 ret = copy_entries_to_user(t->private->size,
919 t, uptr->entrytable);
920 else {
921 duprintf("get_entries: I've got %u not %u!\n",
922 t->private->size,
923 entries->size);
924 ret = -EINVAL;
925 }
6b7d31fc 926 module_put(t->me);
1da177e4
LT		 927 up(&arpt_mutex);
928 } else
6b7d31fc 929 ret = t ? PTR_ERR(t) : -ENOENT;
1da177e4
LT		 930
931 return ret;
932}
933
31836064
ED		 934static void free_table_info(struct arpt_table_info *info)
935{
936 int cpu;
937 for_each_cpu(cpu) {
938 if (info->size <= PAGE_SIZE)
939 kfree(info->entries[cpu]);
940 else
941 vfree(info->entries[cpu]);
942 }
943 kfree(info);
944}
945
946static struct arpt_table_info *alloc_table_info(unsigned int size)
947{
948 struct arpt_table_info *newinfo;
949 int cpu;
950
951 newinfo = kzalloc(sizeof(struct arpt_table_info), GFP_KERNEL);
952 if (!newinfo)
953 return NULL;
954
955 newinfo->size = size;
956
957 for_each_cpu(cpu) {
958 if (size <= PAGE_SIZE)
959 newinfo->entries[cpu] = kmalloc_node(size,
960 GFP_KERNEL,
961 cpu_to_node(cpu));
962 else
963 newinfo->entries[cpu] = vmalloc_node(size,
964 cpu_to_node(cpu));
965
966 if (newinfo->entries[cpu] == NULL) {
967 free_table_info(newinfo);
968 return NULL;
969 }
970 }
971
972 return newinfo;
973}
974
1da177e4
LT		 975static int do_replace(void __user *user, unsigned int len)
976{
977 int ret;
978 struct arpt_replace tmp;
979 struct arpt_table *t;
980 struct arpt_table_info *newinfo, *oldinfo;
981 struct arpt_counters *counters;
31836064 982 void *loc_cpu_entry, *loc_cpu_old_entry;
1da177e4
LT		 983
984 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
985 return -EFAULT;
986
987 /* Hack: Causes ipchains to give correct error msg --RR */
988 if (len != sizeof(tmp) + tmp.size)
989 return -ENOPROTOOPT;
990
991 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
992 if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
993 return -ENOMEM;
994
31836064 995 newinfo = alloc_table_info(tmp.size);
1da177e4
LT		 996 if (!newinfo)
997 return -ENOMEM;
998
31836064
ED		 999 /* choose the copy that is on our node/cpu */
1000 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1001 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1da177e4
LT		 1002 tmp.size) != 0) {
1003 ret = -EFAULT;
1004 goto free_newinfo;
1005 }
1006
1007 counters = vmalloc(tmp.num_counters * sizeof(struct arpt_counters));
1008 if (!counters) {
1009 ret = -ENOMEM;
1010 goto free_newinfo;
1011 }
1da177e4
LT		 1012
1013 ret = translate_table(tmp.name, tmp.valid_hooks,
31836064 1014 newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1da177e4
LT		 1015 tmp.hook_entry, tmp.underflow);
1016 if (ret != 0)
1017 goto free_newinfo_counters;
1018
1019 duprintf("arp_tables: Translated table\n");
1020
6b7d31fc
HW		 1021 t = try_then_request_module(find_table_lock(tmp.name),
1022 "arptable_%s", tmp.name);
1023 if (!t || IS_ERR(t)) {
1024 ret = t ? PTR_ERR(t) : -ENOENT;
1da177e4 1025 goto free_newinfo_counters_untrans;
6b7d31fc 1026 }
1da177e4
LT		 1027
1028 /* You lied! */
1029 if (tmp.valid_hooks != t->valid_hooks) {
1030 duprintf("Valid hook crap: %08X vs %08X\n",
1031 tmp.valid_hooks, t->valid_hooks);
1032 ret = -EINVAL;
6b7d31fc 1033 goto put_module;
1da177e4
LT		 1034 }
1035
1036 oldinfo = replace_table(t, tmp.num_counters, newinfo, &ret);
1037 if (!oldinfo)
1038 goto put_module;
1039
1040 /* Update module usage count based on number of rules */
1041 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1042 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1043 if ((oldinfo->number > oldinfo->initial_entries) ||
1044 (newinfo->number <= oldinfo->initial_entries))
1045 module_put(t->me);
1046 if ((oldinfo->number > oldinfo->initial_entries) &&
1047 (newinfo->number <= oldinfo->initial_entries))
1048 module_put(t->me);
1049
1050 /* Get the old counters. */
1051 get_counters(oldinfo, counters);
1052 /* Decrease module usage counts and free resource */
31836064
ED		 1053 loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1054 ARPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
1055
1056 free_table_info(oldinfo);
1da177e4
LT		 1057 if (copy_to_user(tmp.counters, counters,
1058 sizeof(struct arpt_counters) * tmp.num_counters) != 0)
1059 ret = -EFAULT;
1060 vfree(counters);
1061 up(&arpt_mutex);
1062 return ret;
1063
1064 put_module:
1065 module_put(t->me);
1da177e4
LT		 1066 up(&arpt_mutex);
1067 free_newinfo_counters_untrans:
31836064 1068 ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
1da177e4
LT		 1069 free_newinfo_counters:
1070 vfree(counters);
1071 free_newinfo:
31836064 1072 free_table_info(newinfo);
1da177e4
LT		 1073 return ret;
1074}
1075
1076/* We're lazy, and add to the first CPU; overflow works its fey magic
1077 * and everything is OK.
1078 */
1079static inline int add_counter_to_entry(struct arpt_entry *e,
1080 const struct arpt_counters addme[],
1081 unsigned int *i)
1082{
1083
1084 ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1085
1086 (*i)++;
1087 return 0;
1088}
1089
1090static int do_add_counters(void __user *user, unsigned int len)
1091{
1092 unsigned int i;
1093 struct arpt_counters_info tmp, *paddc;
1094 struct arpt_table *t;
6b7d31fc 1095 int ret = 0;
31836064 1096 void *loc_cpu_entry;
1da177e4
LT		 1097
1098 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1099 return -EFAULT;
1100
1101 if (len != sizeof(tmp) + tmp.num_counters*sizeof(struct arpt_counters))
1102 return -EINVAL;
1103
1104 paddc = vmalloc(len);
1105 if (!paddc)
1106 return -ENOMEM;
1107
1108 if (copy_from_user(paddc, user, len) != 0) {
1109 ret = -EFAULT;
1110 goto free;
1111 }
1112
6b7d31fc
HW		 1113 t = find_table_lock(tmp.name);
1114 if (!t || IS_ERR(t)) {
1115 ret = t ? PTR_ERR(t) : -ENOENT;
1da177e4 1116 goto free;
6b7d31fc 1117 }
1da177e4
LT		 1118
1119 write_lock_bh(&t->lock);
1120 if (t->private->number != paddc->num_counters) {
1121 ret = -EINVAL;
1122 goto unlock_up_free;
1123 }
1124
1125 i = 0;
31836064
ED		 1126 /* Choose the copy that is on our node */
1127 loc_cpu_entry = t->private->entries[smp_processor_id()];
1128 ARPT_ENTRY_ITERATE(loc_cpu_entry,
1da177e4
LT		 1129 t->private->size,
1130 add_counter_to_entry,
1131 paddc->counters,
1132 &i);
1133 unlock_up_free:
1134 write_unlock_bh(&t->lock);
1135 up(&arpt_mutex);
6b7d31fc 1136 module_put(t->me);
1da177e4
LT		 1137 free:
1138 vfree(paddc);
1139
1140 return ret;
1141}
1142
1143static int do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1144{
1145 int ret;
1146
1147 if (!capable(CAP_NET_ADMIN))
1148 return -EPERM;
1149
1150 switch (cmd) {
1151 case ARPT_SO_SET_REPLACE:
1152 ret = do_replace(user, len);
1153 break;
1154
1155 case ARPT_SO_SET_ADD_COUNTERS:
1156 ret = do_add_counters(user, len);
1157 break;
1158
1159 default:
1160 duprintf("do_arpt_set_ctl: unknown request %i\n", cmd);
1161 ret = -EINVAL;
1162 }
1163
1164 return ret;
1165}
1166
1167static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1168{
1169 int ret;
1170
1171 if (!capable(CAP_NET_ADMIN))
1172 return -EPERM;
1173
1174 switch (cmd) {
1175 case ARPT_SO_GET_INFO: {
1176 char name[ARPT_TABLE_MAXNAMELEN];
1177 struct arpt_table *t;
1178
1179 if (*len != sizeof(struct arpt_getinfo)) {
1180 duprintf("length %u != %Zu\n", *len,
1181 sizeof(struct arpt_getinfo));
1182 ret = -EINVAL;
1183 break;
1184 }
1185
1186 if (copy_from_user(name, user, sizeof(name)) != 0) {
1187 ret = -EFAULT;
1188 break;
1189 }
1190 name[ARPT_TABLE_MAXNAMELEN-1] = '\0';
6b7d31fc
HW		 1191
1192 t = try_then_request_module(find_table_lock(name),
1193 "arptable_%s", name);
1194 if (t && !IS_ERR(t)) {
1da177e4
LT		 1195 struct arpt_getinfo info;
1196
1197 info.valid_hooks = t->valid_hooks;
1198 memcpy(info.hook_entry, t->private->hook_entry,
1199 sizeof(info.hook_entry));
1200 memcpy(info.underflow, t->private->underflow,
1201 sizeof(info.underflow));
1202 info.num_entries = t->private->number;
1203 info.size = t->private->size;
1204 strcpy(info.name, name);
1205
1206 if (copy_to_user(user, &info, *len) != 0)
1207 ret = -EFAULT;
1208 else
1209 ret = 0;
1da177e4 1210 up(&arpt_mutex);
6b7d31fc
HW		 1211 module_put(t->me);
1212 } else
1213 ret = t ? PTR_ERR(t) : -ENOENT;
1da177e4
LT		 1214 }
1215 break;
1216
1217 case ARPT_SO_GET_ENTRIES: {
1218 struct arpt_get_entries get;
1219
1220 if (*len < sizeof(get)) {
1221 duprintf("get_entries: %u < %Zu\n", *len, sizeof(get));
1222 ret = -EINVAL;
1223 } else if (copy_from_user(&get, user, sizeof(get)) != 0) {
1224 ret = -EFAULT;
1225 } else if (*len != sizeof(struct arpt_get_entries) + get.size) {
1226 duprintf("get_entries: %u != %Zu\n", *len,
1227 sizeof(struct arpt_get_entries) + get.size);
1228 ret = -EINVAL;
1229 } else
1230 ret = get_entries(&get, user);
1231 break;
1232 }
1233
6b7d31fc
HW		 1234 case ARPT_SO_GET_REVISION_TARGET: {
1235 struct arpt_get_revision rev;
1236
1237 if (*len != sizeof(rev)) {
1238 ret = -EINVAL;
1239 break;
1240 }
1241 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
1242 ret = -EFAULT;
1243 break;
1244 }
1245
1246 try_then_request_module(find_revision(rev.name, rev.revision,
1247 target_revfn, &ret),
1248 "arpt_%s", rev.name);
1249 break;
1250 }
1251
1da177e4
LT		 1252 default:
1253 duprintf("do_arpt_get_ctl: unknown request %i\n", cmd);
1254 ret = -EINVAL;
1255 }
1256
1257 return ret;
1258}
1259
1260/* Registration hooks for targets. */
1261int arpt_register_target(struct arpt_target *target)
1262{
1263 int ret;
1264
1265 ret = down_interruptible(&arpt_mutex);
1266 if (ret != 0)
1267 return ret;
1268
6b7d31fc 1269 list_add(&target->list, &arpt_target);
1da177e4 1270 up(&arpt_mutex);
6b7d31fc 1271
1da177e4
LT		 1272 return ret;
1273}
1274
1275void arpt_unregister_target(struct arpt_target *target)
1276{
1277 down(&arpt_mutex);
1278 LIST_DELETE(&arpt_target, target);
1279 up(&arpt_mutex);
1280}
1281
1282int arpt_register_table(struct arpt_table *table,
1283 const struct arpt_replace *repl)
1284{
1285 int ret;
1286 struct arpt_table_info *newinfo;
1287 static struct arpt_table_info bootstrap
1288 = { 0, 0, 0, { 0 }, { 0 }, { } };
31836064 1289 void *loc_cpu_entry;
1da177e4 1290
31836064 1291 newinfo = alloc_table_info(repl->size);
1da177e4
LT		 1292 if (!newinfo) {
1293 ret = -ENOMEM;
1294 return ret;
1295 }
31836064
ED		 1296
1297 /* choose the copy on our node/cpu */
1298 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1299 memcpy(loc_cpu_entry, repl->entries, repl->size);
1da177e4
LT		 1300
1301 ret = translate_table(table->name, table->valid_hooks,
31836064 1302 newinfo, loc_cpu_entry, repl->size,
1da177e4
LT		 1303 repl->num_entries,
1304 repl->hook_entry,
1305 repl->underflow);
1306 duprintf("arpt_register_table: translate table gives %d\n", ret);
1307 if (ret != 0) {
31836064 1308 free_table_info(newinfo);
1da177e4
LT		 1309 return ret;
1310 }
1311
1312 ret = down_interruptible(&arpt_mutex);
1313 if (ret != 0) {
31836064 1314 free_table_info(newinfo);
1da177e4
LT		 1315 return ret;
1316 }
1317
1318 /* Don't autoload: we'd eat our tail... */
1319 if (list_named_find(&arpt_tables, table->name)) {
1320 ret = -EEXIST;
1321 goto free_unlock;
1322 }
1323
1324 /* Simplifies replace_table code. */
1325 table->private = &bootstrap;
1326 if (!replace_table(table, 0, newinfo, &ret))
1327 goto free_unlock;
1328
1329 duprintf("table->private->number = %u\n",
1330 table->private->number);
1331
1332 /* save number of initial entries */
1333 table->private->initial_entries = table->private->number;
1334
1335 rwlock_init(&table->lock);
1336 list_prepend(&arpt_tables, table);
1337
1338 unlock:
1339 up(&arpt_mutex);
1340 return ret;
1341
1342 free_unlock:
31836064 1343 free_table_info(newinfo);
1da177e4
LT		 1344 goto unlock;
1345}
1346
1347void arpt_unregister_table(struct arpt_table *table)
1348{
31836064
ED		 1349 void *loc_cpu_entry;
1350
1da177e4
LT		 1351 down(&arpt_mutex);
1352 LIST_DELETE(&arpt_tables, table);
1353 up(&arpt_mutex);
1354
1355 /* Decrease module usage counts and free resources */
31836064
ED		 1356 loc_cpu_entry = table->private->entries[raw_smp_processor_id()];
1357 ARPT_ENTRY_ITERATE(loc_cpu_entry, table->private->size,
1da177e4 1358 cleanup_entry, NULL);
31836064 1359 free_table_info(table->private);
1da177e4
LT		 1360}
1361
1362/* The built-in targets: standard (NULL) and error. */
1363static struct arpt_target arpt_standard_target = {
1364 .name = ARPT_STANDARD_TARGET,
1365};
1366
1367static struct arpt_target arpt_error_target = {
1368 .name = ARPT_ERROR_TARGET,
1369 .target = arpt_error,
1370};
1371
1372static struct nf_sockopt_ops arpt_sockopts = {
1373 .pf = PF_INET,
1374 .set_optmin = ARPT_BASE_CTL,
1375 .set_optmax = ARPT_SO_SET_MAX+1,
1376 .set = do_arpt_set_ctl,
1377 .get_optmin = ARPT_BASE_CTL,
1378 .get_optmax = ARPT_SO_GET_MAX+1,
1379 .get = do_arpt_get_ctl,
1380};
1381
1382#ifdef CONFIG_PROC_FS
1383static inline int print_name(const struct arpt_table *t,
1384 off_t start_offset, char *buffer, int length,
1385 off_t *pos, unsigned int *count)
1386{
1387 if ((*count)++ >= start_offset) {
1388 unsigned int namelen;
1389
1390 namelen = sprintf(buffer + *pos, "%s\n", t->name);
1391 if (*pos + namelen > length) {
1392 /* Stop iterating */
1393 return 1;
1394 }
1395 *pos += namelen;
1396 }
1397 return 0;
1398}
1399
1400static int arpt_get_tables(char *buffer, char **start, off_t offset, int length)
1401{
1402 off_t pos = 0;
1403 unsigned int count = 0;
1404
1405 if (down_interruptible(&arpt_mutex) != 0)
1406 return 0;
1407
1408 LIST_FIND(&arpt_tables, print_name, struct arpt_table *,
1409 offset, buffer, length, &pos, &count);
1410
1411 up(&arpt_mutex);
1412
1413 /* `start' hack - see fs/proc/generic.c line ~105 */
1414 *start=(char *)((unsigned long)count-offset);
1415 return pos;
1416}
1417#endif /*CONFIG_PROC_FS*/
1418
1419static int __init init(void)
1420{
1421 int ret;
1422
1423 /* Noone else will be downing sem now, so we won't sleep */
1424 down(&arpt_mutex);
1425 list_append(&arpt_target, &arpt_standard_target);
1426 list_append(&arpt_target, &arpt_error_target);
1427 up(&arpt_mutex);
1428
1429 /* Register setsockopt */
1430 ret = nf_register_sockopt(&arpt_sockopts);
1431 if (ret < 0) {
1432 duprintf("Unable to register sockopts.\n");
1433 return ret;
1434 }
1435
1436#ifdef CONFIG_PROC_FS
1437 {
1438 struct proc_dir_entry *proc;
1439
1440 proc = proc_net_create("arp_tables_names", 0, arpt_get_tables);
1441 if (!proc) {
1442 nf_unregister_sockopt(&arpt_sockopts);
1443 return -ENOMEM;
1444 }
1445 proc->owner = THIS_MODULE;
1446 }
1447#endif
1448
1449 printk("arp_tables: (C) 2002 David S. Miller\n");
1450 return 0;
1451}
1452
1453static void __exit fini(void)
1454{
1455 nf_unregister_sockopt(&arpt_sockopts);
1456#ifdef CONFIG_PROC_FS
1457 proc_net_remove("arp_tables_names");
1458#endif
1459}
1460
1461EXPORT_SYMBOL(arpt_register_table);
1462EXPORT_SYMBOL(arpt_unregister_table);
1463EXPORT_SYMBOL(arpt_do_table);
1464EXPORT_SYMBOL(arpt_register_target);
1465EXPORT_SYMBOL(arpt_unregister_target);
1466
1467module_init(init);
1468module_exit(fini);