2 * x_tables core - Backend for {ip,ip6,arp}_tables
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
6 * Based on existing ip_tables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 #include <linux/kernel.h>
17 #include <linux/socket.h>
18 #include <linux/net.h>
19 #include <linux/proc_fs.h>
20 #include <linux/seq_file.h>
21 #include <linux/string.h>
22 #include <linux/vmalloc.h>
23 #include <linux/mutex.h>
25 #include <net/net_namespace.h>
27 #include <linux/netfilter/x_tables.h>
28 #include <linux/netfilter_arp.h>
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
33 MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
35 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
38 struct compat_delta
*next
;
45 struct list_head match
;
46 struct list_head target
;
48 struct mutex compat_mutex
;
49 struct compat_delta
*compat_offsets
;
53 static struct xt_af
*xt
;
55 #ifdef DEBUG_IP_FIREWALL_USER
56 #define duprintf(format, args...) printk(format , ## args)
58 #define duprintf(format, args...)
61 static const char *const xt_prefix
[NFPROTO_NUMPROTO
] = {
62 [NFPROTO_UNSPEC
] = "x",
63 [NFPROTO_IPV4
] = "ip",
64 [NFPROTO_ARP
] = "arp",
65 [NFPROTO_BRIDGE
] = "eb",
66 [NFPROTO_IPV6
] = "ip6",
69 /* Registration hooks for targets. */
71 xt_register_target(struct xt_target
*target
)
73 u_int8_t af
= target
->family
;
76 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
79 list_add(&target
->list
, &xt
[af
].target
);
80 mutex_unlock(&xt
[af
].mutex
);
83 EXPORT_SYMBOL(xt_register_target
);
86 xt_unregister_target(struct xt_target
*target
)
88 u_int8_t af
= target
->family
;
90 mutex_lock(&xt
[af
].mutex
);
91 list_del(&target
->list
);
92 mutex_unlock(&xt
[af
].mutex
);
94 EXPORT_SYMBOL(xt_unregister_target
);
97 xt_register_targets(struct xt_target
*target
, unsigned int n
)
102 for (i
= 0; i
< n
; i
++) {
103 err
= xt_register_target(&target
[i
]);
111 xt_unregister_targets(target
, i
);
114 EXPORT_SYMBOL(xt_register_targets
);
117 xt_unregister_targets(struct xt_target
*target
, unsigned int n
)
121 for (i
= 0; i
< n
; i
++)
122 xt_unregister_target(&target
[i
]);
124 EXPORT_SYMBOL(xt_unregister_targets
);
127 xt_register_match(struct xt_match
*match
)
129 u_int8_t af
= match
->family
;
132 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
136 list_add(&match
->list
, &xt
[af
].match
);
137 mutex_unlock(&xt
[af
].mutex
);
141 EXPORT_SYMBOL(xt_register_match
);
144 xt_unregister_match(struct xt_match
*match
)
146 u_int8_t af
= match
->family
;
148 mutex_lock(&xt
[af
].mutex
);
149 list_del(&match
->list
);
150 mutex_unlock(&xt
[af
].mutex
);
152 EXPORT_SYMBOL(xt_unregister_match
);
155 xt_register_matches(struct xt_match
*match
, unsigned int n
)
160 for (i
= 0; i
< n
; i
++) {
161 err
= xt_register_match(&match
[i
]);
169 xt_unregister_matches(match
, i
);
172 EXPORT_SYMBOL(xt_register_matches
);
175 xt_unregister_matches(struct xt_match
*match
, unsigned int n
)
179 for (i
= 0; i
< n
; i
++)
180 xt_unregister_match(&match
[i
]);
182 EXPORT_SYMBOL(xt_unregister_matches
);
186 * These are weird, but module loading must not be done with mutex
187 * held (since they will register), and we have to have a single
188 * function to use try_then_request_module().
191 /* Find match, grabs ref. Returns ERR_PTR() on error. */
192 struct xt_match
*xt_find_match(u8 af
, const char *name
, u8 revision
)
197 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
198 return ERR_PTR(-EINTR
);
200 list_for_each_entry(m
, &xt
[af
].match
, list
) {
201 if (strcmp(m
->name
, name
) == 0) {
202 if (m
->revision
== revision
) {
203 if (try_module_get(m
->me
)) {
204 mutex_unlock(&xt
[af
].mutex
);
208 err
= -EPROTOTYPE
; /* Found something. */
211 mutex_unlock(&xt
[af
].mutex
);
213 if (af
!= NFPROTO_UNSPEC
)
214 /* Try searching again in the family-independent list */
215 return xt_find_match(NFPROTO_UNSPEC
, name
, revision
);
219 EXPORT_SYMBOL(xt_find_match
);
221 /* Find target, grabs ref. Returns ERR_PTR() on error. */
222 struct xt_target
*xt_find_target(u8 af
, const char *name
, u8 revision
)
227 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
228 return ERR_PTR(-EINTR
);
230 list_for_each_entry(t
, &xt
[af
].target
, list
) {
231 if (strcmp(t
->name
, name
) == 0) {
232 if (t
->revision
== revision
) {
233 if (try_module_get(t
->me
)) {
234 mutex_unlock(&xt
[af
].mutex
);
238 err
= -EPROTOTYPE
; /* Found something. */
241 mutex_unlock(&xt
[af
].mutex
);
243 if (af
!= NFPROTO_UNSPEC
)
244 /* Try searching again in the family-independent list */
245 return xt_find_target(NFPROTO_UNSPEC
, name
, revision
);
249 EXPORT_SYMBOL(xt_find_target
);
251 struct xt_target
*xt_request_find_target(u8 af
, const char *name
, u8 revision
)
253 struct xt_target
*target
;
255 target
= try_then_request_module(xt_find_target(af
, name
, revision
),
256 "%st_%s", xt_prefix
[af
], name
);
257 if (IS_ERR(target
) || !target
)
261 EXPORT_SYMBOL_GPL(xt_request_find_target
);
263 static int match_revfn(u8 af
, const char *name
, u8 revision
, int *bestp
)
265 const struct xt_match
*m
;
268 list_for_each_entry(m
, &xt
[af
].match
, list
) {
269 if (strcmp(m
->name
, name
) == 0) {
270 if (m
->revision
> *bestp
)
271 *bestp
= m
->revision
;
272 if (m
->revision
== revision
)
279 static int target_revfn(u8 af
, const char *name
, u8 revision
, int *bestp
)
281 const struct xt_target
*t
;
284 list_for_each_entry(t
, &xt
[af
].target
, list
) {
285 if (strcmp(t
->name
, name
) == 0) {
286 if (t
->revision
> *bestp
)
287 *bestp
= t
->revision
;
288 if (t
->revision
== revision
)
295 /* Returns true or false (if no such extension at all) */
296 int xt_find_revision(u8 af
, const char *name
, u8 revision
, int target
,
299 int have_rev
, best
= -1;
301 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0) {
306 have_rev
= target_revfn(af
, name
, revision
, &best
);
308 have_rev
= match_revfn(af
, name
, revision
, &best
);
309 mutex_unlock(&xt
[af
].mutex
);
311 /* Nothing at all? Return 0 to try loading module. */
319 *err
= -EPROTONOSUPPORT
;
322 EXPORT_SYMBOL_GPL(xt_find_revision
);
324 int xt_check_match(struct xt_mtchk_param
*par
, u_int8_t family
,
325 unsigned int size
, u_int8_t proto
, bool inv_proto
)
327 if (XT_ALIGN(par
->match
->matchsize
) != size
&&
328 par
->match
->matchsize
!= -1) {
330 * ebt_among is exempt from centralized matchsize checking
331 * because it uses a dynamic-size data set.
333 printk("%s_tables: %s match: invalid size %Zu != %u\n",
334 xt_prefix
[family
], par
->match
->name
,
335 XT_ALIGN(par
->match
->matchsize
), size
);
338 if (par
->match
->table
!= NULL
&&
339 strcmp(par
->match
->table
, par
->table
) != 0) {
340 printk("%s_tables: %s match: only valid in %s table, not %s\n",
341 xt_prefix
[family
], par
->match
->name
,
342 par
->match
->table
, par
->table
);
345 if (par
->match
->hooks
&& (par
->hook_mask
& ~par
->match
->hooks
) != 0) {
346 printk("%s_tables: %s match: bad hook_mask %#x/%#x\n",
347 xt_prefix
[family
], par
->match
->name
,
348 par
->hook_mask
, par
->match
->hooks
);
351 if (par
->match
->proto
&& (par
->match
->proto
!= proto
|| inv_proto
)) {
352 printk("%s_tables: %s match: only valid for protocol %u\n",
353 xt_prefix
[family
], par
->match
->name
, par
->match
->proto
);
356 if (par
->match
->checkentry
!= NULL
&& !par
->match
->checkentry(par
))
360 EXPORT_SYMBOL_GPL(xt_check_match
);
363 int xt_compat_add_offset(u_int8_t af
, unsigned int offset
, short delta
)
365 struct compat_delta
*tmp
;
367 tmp
= kmalloc(sizeof(struct compat_delta
), GFP_KERNEL
);
371 tmp
->offset
= offset
;
374 if (xt
[af
].compat_offsets
) {
375 tmp
->next
= xt
[af
].compat_offsets
->next
;
376 xt
[af
].compat_offsets
->next
= tmp
;
378 xt
[af
].compat_offsets
= tmp
;
383 EXPORT_SYMBOL_GPL(xt_compat_add_offset
);
385 void xt_compat_flush_offsets(u_int8_t af
)
387 struct compat_delta
*tmp
, *next
;
389 if (xt
[af
].compat_offsets
) {
390 for (tmp
= xt
[af
].compat_offsets
; tmp
; tmp
= next
) {
394 xt
[af
].compat_offsets
= NULL
;
397 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets
);
399 short xt_compat_calc_jump(u_int8_t af
, unsigned int offset
)
401 struct compat_delta
*tmp
;
404 for (tmp
= xt
[af
].compat_offsets
, delta
= 0; tmp
; tmp
= tmp
->next
)
405 if (tmp
->offset
< offset
)
409 EXPORT_SYMBOL_GPL(xt_compat_calc_jump
);
411 int xt_compat_match_offset(const struct xt_match
*match
)
413 u_int16_t csize
= match
->compatsize
? : match
->matchsize
;
414 return XT_ALIGN(match
->matchsize
) - COMPAT_XT_ALIGN(csize
);
416 EXPORT_SYMBOL_GPL(xt_compat_match_offset
);
418 int xt_compat_match_from_user(struct xt_entry_match
*m
, void **dstptr
,
421 const struct xt_match
*match
= m
->u
.kernel
.match
;
422 struct compat_xt_entry_match
*cm
= (struct compat_xt_entry_match
*)m
;
423 int pad
, off
= xt_compat_match_offset(match
);
424 u_int16_t msize
= cm
->u
.user
.match_size
;
427 memcpy(m
, cm
, sizeof(*cm
));
428 if (match
->compat_from_user
)
429 match
->compat_from_user(m
->data
, cm
->data
);
431 memcpy(m
->data
, cm
->data
, msize
- sizeof(*cm
));
432 pad
= XT_ALIGN(match
->matchsize
) - match
->matchsize
;
434 memset(m
->data
+ match
->matchsize
, 0, pad
);
437 m
->u
.user
.match_size
= msize
;
443 EXPORT_SYMBOL_GPL(xt_compat_match_from_user
);
445 int xt_compat_match_to_user(struct xt_entry_match
*m
, void __user
**dstptr
,
448 const struct xt_match
*match
= m
->u
.kernel
.match
;
449 struct compat_xt_entry_match __user
*cm
= *dstptr
;
450 int off
= xt_compat_match_offset(match
);
451 u_int16_t msize
= m
->u
.user
.match_size
- off
;
453 if (copy_to_user(cm
, m
, sizeof(*cm
)) ||
454 put_user(msize
, &cm
->u
.user
.match_size
) ||
455 copy_to_user(cm
->u
.user
.name
, m
->u
.kernel
.match
->name
,
456 strlen(m
->u
.kernel
.match
->name
) + 1))
459 if (match
->compat_to_user
) {
460 if (match
->compat_to_user((void __user
*)cm
->data
, m
->data
))
463 if (copy_to_user(cm
->data
, m
->data
, msize
- sizeof(*cm
)))
471 EXPORT_SYMBOL_GPL(xt_compat_match_to_user
);
472 #endif /* CONFIG_COMPAT */
474 int xt_check_target(const struct xt_target
*target
, unsigned short family
,
475 unsigned int size
, const char *table
, unsigned int hook_mask
,
476 unsigned short proto
, int inv_proto
, const void *entry
,
479 if (XT_ALIGN(target
->targetsize
) != size
) {
480 printk("%s_tables: %s target: invalid size %Zu != %u\n",
481 xt_prefix
[family
], target
->name
,
482 XT_ALIGN(target
->targetsize
), size
);
485 if (target
->table
&& strcmp(target
->table
, table
)) {
486 printk("%s_tables: %s target: only valid in %s table, not %s\n",
487 xt_prefix
[family
], target
->name
, target
->table
, table
);
490 if (target
->hooks
&& (hook_mask
& ~target
->hooks
) != 0) {
491 printk("%s_tables: %s target: bad hook_mask %#x/%#x\n",
492 xt_prefix
[family
], target
->name
, hook_mask
,
496 if (target
->proto
&& (target
->proto
!= proto
|| inv_proto
)) {
497 printk("%s_tables: %s target: only valid for protocol %u\n",
498 xt_prefix
[family
], target
->name
, target
->proto
);
501 if (target
->checkentry
!= NULL
&&
502 !target
->checkentry(table
, entry
, target
, targinfo
, hook_mask
))
506 EXPORT_SYMBOL_GPL(xt_check_target
);
509 int xt_compat_target_offset(const struct xt_target
*target
)
511 u_int16_t csize
= target
->compatsize
? : target
->targetsize
;
512 return XT_ALIGN(target
->targetsize
) - COMPAT_XT_ALIGN(csize
);
514 EXPORT_SYMBOL_GPL(xt_compat_target_offset
);
516 void xt_compat_target_from_user(struct xt_entry_target
*t
, void **dstptr
,
519 const struct xt_target
*target
= t
->u
.kernel
.target
;
520 struct compat_xt_entry_target
*ct
= (struct compat_xt_entry_target
*)t
;
521 int pad
, off
= xt_compat_target_offset(target
);
522 u_int16_t tsize
= ct
->u
.user
.target_size
;
525 memcpy(t
, ct
, sizeof(*ct
));
526 if (target
->compat_from_user
)
527 target
->compat_from_user(t
->data
, ct
->data
);
529 memcpy(t
->data
, ct
->data
, tsize
- sizeof(*ct
));
530 pad
= XT_ALIGN(target
->targetsize
) - target
->targetsize
;
532 memset(t
->data
+ target
->targetsize
, 0, pad
);
535 t
->u
.user
.target_size
= tsize
;
540 EXPORT_SYMBOL_GPL(xt_compat_target_from_user
);
542 int xt_compat_target_to_user(struct xt_entry_target
*t
, void __user
**dstptr
,
545 const struct xt_target
*target
= t
->u
.kernel
.target
;
546 struct compat_xt_entry_target __user
*ct
= *dstptr
;
547 int off
= xt_compat_target_offset(target
);
548 u_int16_t tsize
= t
->u
.user
.target_size
- off
;
550 if (copy_to_user(ct
, t
, sizeof(*ct
)) ||
551 put_user(tsize
, &ct
->u
.user
.target_size
) ||
552 copy_to_user(ct
->u
.user
.name
, t
->u
.kernel
.target
->name
,
553 strlen(t
->u
.kernel
.target
->name
) + 1))
556 if (target
->compat_to_user
) {
557 if (target
->compat_to_user((void __user
*)ct
->data
, t
->data
))
560 if (copy_to_user(ct
->data
, t
->data
, tsize
- sizeof(*ct
)))
568 EXPORT_SYMBOL_GPL(xt_compat_target_to_user
);
571 struct xt_table_info
*xt_alloc_table_info(unsigned int size
)
573 struct xt_table_info
*newinfo
;
576 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
577 if ((SMP_ALIGN(size
) >> PAGE_SHIFT
) + 2 > num_physpages
)
580 newinfo
= kzalloc(XT_TABLE_INFO_SZ
, GFP_KERNEL
);
584 newinfo
->size
= size
;
586 for_each_possible_cpu(cpu
) {
587 if (size
<= PAGE_SIZE
)
588 newinfo
->entries
[cpu
] = kmalloc_node(size
,
592 newinfo
->entries
[cpu
] = vmalloc_node(size
,
595 if (newinfo
->entries
[cpu
] == NULL
) {
596 xt_free_table_info(newinfo
);
603 EXPORT_SYMBOL(xt_alloc_table_info
);
605 void xt_free_table_info(struct xt_table_info
*info
)
609 for_each_possible_cpu(cpu
) {
610 if (info
->size
<= PAGE_SIZE
)
611 kfree(info
->entries
[cpu
]);
613 vfree(info
->entries
[cpu
]);
617 EXPORT_SYMBOL(xt_free_table_info
);
619 /* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
620 struct xt_table
*xt_find_table_lock(struct net
*net
, u_int8_t af
,
625 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
626 return ERR_PTR(-EINTR
);
628 list_for_each_entry(t
, &net
->xt
.tables
[af
], list
)
629 if (strcmp(t
->name
, name
) == 0 && try_module_get(t
->me
))
631 mutex_unlock(&xt
[af
].mutex
);
634 EXPORT_SYMBOL_GPL(xt_find_table_lock
);
636 void xt_table_unlock(struct xt_table
*table
)
638 mutex_unlock(&xt
[table
->af
].mutex
);
640 EXPORT_SYMBOL_GPL(xt_table_unlock
);
643 void xt_compat_lock(u_int8_t af
)
645 mutex_lock(&xt
[af
].compat_mutex
);
647 EXPORT_SYMBOL_GPL(xt_compat_lock
);
649 void xt_compat_unlock(u_int8_t af
)
651 mutex_unlock(&xt
[af
].compat_mutex
);
653 EXPORT_SYMBOL_GPL(xt_compat_unlock
);
656 struct xt_table_info
*
657 xt_replace_table(struct xt_table
*table
,
658 unsigned int num_counters
,
659 struct xt_table_info
*newinfo
,
662 struct xt_table_info
*oldinfo
, *private;
664 /* Do the substitution. */
665 write_lock_bh(&table
->lock
);
666 private = table
->private;
667 /* Check inside lock: is the old number correct? */
668 if (num_counters
!= private->number
) {
669 duprintf("num_counters != table->private->number (%u/%u)\n",
670 num_counters
, private->number
);
671 write_unlock_bh(&table
->lock
);
676 table
->private = newinfo
;
677 newinfo
->initial_entries
= oldinfo
->initial_entries
;
678 write_unlock_bh(&table
->lock
);
682 EXPORT_SYMBOL_GPL(xt_replace_table
);
684 struct xt_table
*xt_register_table(struct net
*net
, struct xt_table
*table
,
685 struct xt_table_info
*bootstrap
,
686 struct xt_table_info
*newinfo
)
689 struct xt_table_info
*private;
692 /* Don't add one object to multiple lists. */
693 table
= kmemdup(table
, sizeof(struct xt_table
), GFP_KERNEL
);
699 ret
= mutex_lock_interruptible(&xt
[table
->af
].mutex
);
703 /* Don't autoload: we'd eat our tail... */
704 list_for_each_entry(t
, &net
->xt
.tables
[table
->af
], list
) {
705 if (strcmp(t
->name
, table
->name
) == 0) {
711 /* Simplifies replace_table code. */
712 table
->private = bootstrap
;
713 rwlock_init(&table
->lock
);
714 if (!xt_replace_table(table
, 0, newinfo
, &ret
))
717 private = table
->private;
718 duprintf("table->private->number = %u\n", private->number
);
720 /* save number of initial entries */
721 private->initial_entries
= private->number
;
723 list_add(&table
->list
, &net
->xt
.tables
[table
->af
]);
724 mutex_unlock(&xt
[table
->af
].mutex
);
728 mutex_unlock(&xt
[table
->af
].mutex
);
734 EXPORT_SYMBOL_GPL(xt_register_table
);
736 void *xt_unregister_table(struct xt_table
*table
)
738 struct xt_table_info
*private;
740 mutex_lock(&xt
[table
->af
].mutex
);
741 private = table
->private;
742 list_del(&table
->list
);
743 mutex_unlock(&xt
[table
->af
].mutex
);
748 EXPORT_SYMBOL_GPL(xt_unregister_table
);
750 #ifdef CONFIG_PROC_FS
751 struct xt_names_priv
{
752 struct seq_net_private p
;
755 static void *xt_table_seq_start(struct seq_file
*seq
, loff_t
*pos
)
757 struct xt_names_priv
*priv
= seq
->private;
758 struct net
*net
= seq_file_net(seq
);
759 u_int8_t af
= priv
->af
;
761 mutex_lock(&xt
[af
].mutex
);
762 return seq_list_start(&net
->xt
.tables
[af
], *pos
);
765 static void *xt_table_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
767 struct xt_names_priv
*priv
= seq
->private;
768 struct net
*net
= seq_file_net(seq
);
769 u_int8_t af
= priv
->af
;
771 return seq_list_next(v
, &net
->xt
.tables
[af
], pos
);
774 static void xt_table_seq_stop(struct seq_file
*seq
, void *v
)
776 struct xt_names_priv
*priv
= seq
->private;
777 u_int8_t af
= priv
->af
;
779 mutex_unlock(&xt
[af
].mutex
);
782 static int xt_table_seq_show(struct seq_file
*seq
, void *v
)
784 struct xt_table
*table
= list_entry(v
, struct xt_table
, list
);
786 if (strlen(table
->name
))
787 return seq_printf(seq
, "%s\n", table
->name
);
792 static const struct seq_operations xt_table_seq_ops
= {
793 .start
= xt_table_seq_start
,
794 .next
= xt_table_seq_next
,
795 .stop
= xt_table_seq_stop
,
796 .show
= xt_table_seq_show
,
799 static int xt_table_open(struct inode
*inode
, struct file
*file
)
802 struct xt_names_priv
*priv
;
804 ret
= seq_open_net(inode
, file
, &xt_table_seq_ops
,
805 sizeof(struct xt_names_priv
));
807 priv
= ((struct seq_file
*)file
->private_data
)->private;
808 priv
->af
= (unsigned long)PDE(inode
)->data
;
813 static const struct file_operations xt_table_ops
= {
814 .owner
= THIS_MODULE
,
815 .open
= xt_table_open
,
818 .release
= seq_release_net
,
821 static void *xt_match_seq_start(struct seq_file
*seq
, loff_t
*pos
)
823 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
824 u_int16_t af
= (unsigned long)pde
->data
;
826 mutex_lock(&xt
[af
].mutex
);
827 return seq_list_start(&xt
[af
].match
, *pos
);
830 static void *xt_match_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
832 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
833 u_int16_t af
= (unsigned long)pde
->data
;
835 return seq_list_next(v
, &xt
[af
].match
, pos
);
838 static void xt_match_seq_stop(struct seq_file
*seq
, void *v
)
840 struct proc_dir_entry
*pde
= seq
->private;
841 u_int16_t af
= (unsigned long)pde
->data
;
843 mutex_unlock(&xt
[af
].mutex
);
846 static int xt_match_seq_show(struct seq_file
*seq
, void *v
)
848 struct xt_match
*match
= list_entry(v
, struct xt_match
, list
);
850 if (strlen(match
->name
))
851 return seq_printf(seq
, "%s\n", match
->name
);
856 static const struct seq_operations xt_match_seq_ops
= {
857 .start
= xt_match_seq_start
,
858 .next
= xt_match_seq_next
,
859 .stop
= xt_match_seq_stop
,
860 .show
= xt_match_seq_show
,
863 static int xt_match_open(struct inode
*inode
, struct file
*file
)
867 ret
= seq_open(file
, &xt_match_seq_ops
);
869 struct seq_file
*seq
= file
->private_data
;
871 seq
->private = PDE(inode
);
876 static const struct file_operations xt_match_ops
= {
877 .owner
= THIS_MODULE
,
878 .open
= xt_match_open
,
881 .release
= seq_release
,
884 static void *xt_target_seq_start(struct seq_file
*seq
, loff_t
*pos
)
886 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
887 u_int16_t af
= (unsigned long)pde
->data
;
889 mutex_lock(&xt
[af
].mutex
);
890 return seq_list_start(&xt
[af
].target
, *pos
);
893 static void *xt_target_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
895 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
896 u_int16_t af
= (unsigned long)pde
->data
;
898 return seq_list_next(v
, &xt
[af
].target
, pos
);
901 static void xt_target_seq_stop(struct seq_file
*seq
, void *v
)
903 struct proc_dir_entry
*pde
= seq
->private;
904 u_int16_t af
= (unsigned long)pde
->data
;
906 mutex_unlock(&xt
[af
].mutex
);
909 static int xt_target_seq_show(struct seq_file
*seq
, void *v
)
911 struct xt_target
*target
= list_entry(v
, struct xt_target
, list
);
913 if (strlen(target
->name
))
914 return seq_printf(seq
, "%s\n", target
->name
);
919 static const struct seq_operations xt_target_seq_ops
= {
920 .start
= xt_target_seq_start
,
921 .next
= xt_target_seq_next
,
922 .stop
= xt_target_seq_stop
,
923 .show
= xt_target_seq_show
,
926 static int xt_target_open(struct inode
*inode
, struct file
*file
)
930 ret
= seq_open(file
, &xt_target_seq_ops
);
932 struct seq_file
*seq
= file
->private_data
;
934 seq
->private = PDE(inode
);
939 static const struct file_operations xt_target_ops
= {
940 .owner
= THIS_MODULE
,
941 .open
= xt_target_open
,
944 .release
= seq_release
,
947 #define FORMAT_TABLES "_tables_names"
948 #define FORMAT_MATCHES "_tables_matches"
949 #define FORMAT_TARGETS "_tables_targets"
951 #endif /* CONFIG_PROC_FS */
953 int xt_proto_init(struct net
*net
, u_int8_t af
)
955 #ifdef CONFIG_PROC_FS
956 char buf
[XT_FUNCTION_MAXNAMELEN
];
957 struct proc_dir_entry
*proc
;
960 if (af
>= ARRAY_SIZE(xt_prefix
))
964 #ifdef CONFIG_PROC_FS
965 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
966 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
967 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_table_ops
,
968 (void *)(unsigned long)af
);
972 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
973 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
974 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_match_ops
,
975 (void *)(unsigned long)af
);
977 goto out_remove_tables
;
979 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
980 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
981 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_target_ops
,
982 (void *)(unsigned long)af
);
984 goto out_remove_matches
;
989 #ifdef CONFIG_PROC_FS
991 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
992 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
993 proc_net_remove(net
, buf
);
996 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
997 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
998 proc_net_remove(net
, buf
);
1003 EXPORT_SYMBOL_GPL(xt_proto_init
);
1005 void xt_proto_fini(struct net
*net
, u_int8_t af
)
1007 #ifdef CONFIG_PROC_FS
1008 char buf
[XT_FUNCTION_MAXNAMELEN
];
1010 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1011 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
1012 proc_net_remove(net
, buf
);
1014 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1015 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
1016 proc_net_remove(net
, buf
);
1018 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
1019 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
1020 proc_net_remove(net
, buf
);
1021 #endif /*CONFIG_PROC_FS*/
1023 EXPORT_SYMBOL_GPL(xt_proto_fini
);
1025 static int __net_init
xt_net_init(struct net
*net
)
1029 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++)
1030 INIT_LIST_HEAD(&net
->xt
.tables
[i
]);
1034 static struct pernet_operations xt_net_ops
= {
1035 .init
= xt_net_init
,
1038 static int __init
xt_init(void)
1042 xt
= kmalloc(sizeof(struct xt_af
) * NFPROTO_NUMPROTO
, GFP_KERNEL
);
1046 for (i
= 0; i
< NFPROTO_NUMPROTO
; i
++) {
1047 mutex_init(&xt
[i
].mutex
);
1048 #ifdef CONFIG_COMPAT
1049 mutex_init(&xt
[i
].compat_mutex
);
1050 xt
[i
].compat_offsets
= NULL
;
1052 INIT_LIST_HEAD(&xt
[i
].target
);
1053 INIT_LIST_HEAD(&xt
[i
].match
);
1055 rv
= register_pernet_subsys(&xt_net_ops
);
1061 static void __exit
xt_fini(void)
1063 unregister_pernet_subsys(&xt_net_ops
);
1067 module_init(xt_init
);
1068 module_exit(xt_fini
);