2 * x_tables core - Backend for {ip,ip6,arp}_tables
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
6 * Based on existing ip_tables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 #include <linux/kernel.h>
17 #include <linux/socket.h>
18 #include <linux/net.h>
19 #include <linux/proc_fs.h>
20 #include <linux/seq_file.h>
21 #include <linux/string.h>
22 #include <linux/vmalloc.h>
23 #include <linux/mutex.h>
25 #include <net/net_namespace.h>
27 #include <linux/netfilter/x_tables.h>
28 #include <linux/netfilter_arp.h>
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
33 MODULE_DESCRIPTION("[ip,ip6,arp]_tables backend module");
35 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
38 struct compat_delta
*next
;
45 struct list_head match
;
46 struct list_head target
;
48 struct mutex compat_mutex
;
49 struct compat_delta
*compat_offsets
;
53 static struct xt_af
*xt
;
55 #ifdef DEBUG_IP_FIREWALL_USER
56 #define duprintf(format, args...) printk(format , ## args)
58 #define duprintf(format, args...)
61 static const char *const xt_prefix
[NPROTO
] = {
67 /* Registration hooks for targets. */
69 xt_register_target(struct xt_target
*target
)
71 u_int8_t af
= target
->family
;
74 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
77 list_add(&target
->list
, &xt
[af
].target
);
78 mutex_unlock(&xt
[af
].mutex
);
81 EXPORT_SYMBOL(xt_register_target
);
84 xt_unregister_target(struct xt_target
*target
)
86 u_int8_t af
= target
->family
;
88 mutex_lock(&xt
[af
].mutex
);
89 list_del(&target
->list
);
90 mutex_unlock(&xt
[af
].mutex
);
92 EXPORT_SYMBOL(xt_unregister_target
);
95 xt_register_targets(struct xt_target
*target
, unsigned int n
)
100 for (i
= 0; i
< n
; i
++) {
101 err
= xt_register_target(&target
[i
]);
109 xt_unregister_targets(target
, i
);
112 EXPORT_SYMBOL(xt_register_targets
);
115 xt_unregister_targets(struct xt_target
*target
, unsigned int n
)
119 for (i
= 0; i
< n
; i
++)
120 xt_unregister_target(&target
[i
]);
122 EXPORT_SYMBOL(xt_unregister_targets
);
125 xt_register_match(struct xt_match
*match
)
127 u_int8_t af
= match
->family
;
130 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
134 list_add(&match
->list
, &xt
[af
].match
);
135 mutex_unlock(&xt
[af
].mutex
);
139 EXPORT_SYMBOL(xt_register_match
);
142 xt_unregister_match(struct xt_match
*match
)
144 u_int8_t af
= match
->family
;
146 mutex_lock(&xt
[af
].mutex
);
147 list_del(&match
->list
);
148 mutex_unlock(&xt
[af
].mutex
);
150 EXPORT_SYMBOL(xt_unregister_match
);
153 xt_register_matches(struct xt_match
*match
, unsigned int n
)
158 for (i
= 0; i
< n
; i
++) {
159 err
= xt_register_match(&match
[i
]);
167 xt_unregister_matches(match
, i
);
170 EXPORT_SYMBOL(xt_register_matches
);
173 xt_unregister_matches(struct xt_match
*match
, unsigned int n
)
177 for (i
= 0; i
< n
; i
++)
178 xt_unregister_match(&match
[i
]);
180 EXPORT_SYMBOL(xt_unregister_matches
);
184 * These are weird, but module loading must not be done with mutex
185 * held (since they will register), and we have to have a single
186 * function to use try_then_request_module().
189 /* Find match, grabs ref. Returns ERR_PTR() on error. */
190 struct xt_match
*xt_find_match(u8 af
, const char *name
, u8 revision
)
195 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
196 return ERR_PTR(-EINTR
);
198 list_for_each_entry(m
, &xt
[af
].match
, list
) {
199 if (strcmp(m
->name
, name
) == 0) {
200 if (m
->revision
== revision
) {
201 if (try_module_get(m
->me
)) {
202 mutex_unlock(&xt
[af
].mutex
);
206 err
= -EPROTOTYPE
; /* Found something. */
209 mutex_unlock(&xt
[af
].mutex
);
212 EXPORT_SYMBOL(xt_find_match
);
214 /* Find target, grabs ref. Returns ERR_PTR() on error. */
215 struct xt_target
*xt_find_target(u8 af
, const char *name
, u8 revision
)
220 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
221 return ERR_PTR(-EINTR
);
223 list_for_each_entry(t
, &xt
[af
].target
, list
) {
224 if (strcmp(t
->name
, name
) == 0) {
225 if (t
->revision
== revision
) {
226 if (try_module_get(t
->me
)) {
227 mutex_unlock(&xt
[af
].mutex
);
231 err
= -EPROTOTYPE
; /* Found something. */
234 mutex_unlock(&xt
[af
].mutex
);
237 EXPORT_SYMBOL(xt_find_target
);
239 struct xt_target
*xt_request_find_target(u8 af
, const char *name
, u8 revision
)
241 struct xt_target
*target
;
243 target
= try_then_request_module(xt_find_target(af
, name
, revision
),
244 "%st_%s", xt_prefix
[af
], name
);
245 if (IS_ERR(target
) || !target
)
249 EXPORT_SYMBOL_GPL(xt_request_find_target
);
251 static int match_revfn(u8 af
, const char *name
, u8 revision
, int *bestp
)
253 const struct xt_match
*m
;
256 list_for_each_entry(m
, &xt
[af
].match
, list
) {
257 if (strcmp(m
->name
, name
) == 0) {
258 if (m
->revision
> *bestp
)
259 *bestp
= m
->revision
;
260 if (m
->revision
== revision
)
267 static int target_revfn(u8 af
, const char *name
, u8 revision
, int *bestp
)
269 const struct xt_target
*t
;
272 list_for_each_entry(t
, &xt
[af
].target
, list
) {
273 if (strcmp(t
->name
, name
) == 0) {
274 if (t
->revision
> *bestp
)
275 *bestp
= t
->revision
;
276 if (t
->revision
== revision
)
283 /* Returns true or false (if no such extension at all) */
284 int xt_find_revision(u8 af
, const char *name
, u8 revision
, int target
,
287 int have_rev
, best
= -1;
289 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0) {
294 have_rev
= target_revfn(af
, name
, revision
, &best
);
296 have_rev
= match_revfn(af
, name
, revision
, &best
);
297 mutex_unlock(&xt
[af
].mutex
);
299 /* Nothing at all? Return 0 to try loading module. */
307 *err
= -EPROTONOSUPPORT
;
310 EXPORT_SYMBOL_GPL(xt_find_revision
);
312 int xt_check_match(const struct xt_match
*match
, unsigned short family
,
313 unsigned int size
, const char *table
, unsigned int hook_mask
,
314 unsigned short proto
, int inv_proto
)
316 if (XT_ALIGN(match
->matchsize
) != size
) {
317 printk("%s_tables: %s match: invalid size %Zu != %u\n",
318 xt_prefix
[family
], match
->name
,
319 XT_ALIGN(match
->matchsize
), size
);
322 if (match
->table
&& strcmp(match
->table
, table
)) {
323 printk("%s_tables: %s match: only valid in %s table, not %s\n",
324 xt_prefix
[family
], match
->name
, match
->table
, table
);
327 if (match
->hooks
&& (hook_mask
& ~match
->hooks
) != 0) {
328 printk("%s_tables: %s match: bad hook_mask %u/%u\n",
329 xt_prefix
[family
], match
->name
, hook_mask
, match
->hooks
);
332 if (match
->proto
&& (match
->proto
!= proto
|| inv_proto
)) {
333 printk("%s_tables: %s match: only valid for protocol %u\n",
334 xt_prefix
[family
], match
->name
, match
->proto
);
339 EXPORT_SYMBOL_GPL(xt_check_match
);
342 int xt_compat_add_offset(u_int8_t af
, unsigned int offset
, short delta
)
344 struct compat_delta
*tmp
;
346 tmp
= kmalloc(sizeof(struct compat_delta
), GFP_KERNEL
);
350 tmp
->offset
= offset
;
353 if (xt
[af
].compat_offsets
) {
354 tmp
->next
= xt
[af
].compat_offsets
->next
;
355 xt
[af
].compat_offsets
->next
= tmp
;
357 xt
[af
].compat_offsets
= tmp
;
362 EXPORT_SYMBOL_GPL(xt_compat_add_offset
);
364 void xt_compat_flush_offsets(u_int8_t af
)
366 struct compat_delta
*tmp
, *next
;
368 if (xt
[af
].compat_offsets
) {
369 for (tmp
= xt
[af
].compat_offsets
; tmp
; tmp
= next
) {
373 xt
[af
].compat_offsets
= NULL
;
376 EXPORT_SYMBOL_GPL(xt_compat_flush_offsets
);
378 short xt_compat_calc_jump(u_int8_t af
, unsigned int offset
)
380 struct compat_delta
*tmp
;
383 for (tmp
= xt
[af
].compat_offsets
, delta
= 0; tmp
; tmp
= tmp
->next
)
384 if (tmp
->offset
< offset
)
388 EXPORT_SYMBOL_GPL(xt_compat_calc_jump
);
390 int xt_compat_match_offset(const struct xt_match
*match
)
392 u_int16_t csize
= match
->compatsize
? : match
->matchsize
;
393 return XT_ALIGN(match
->matchsize
) - COMPAT_XT_ALIGN(csize
);
395 EXPORT_SYMBOL_GPL(xt_compat_match_offset
);
397 int xt_compat_match_from_user(struct xt_entry_match
*m
, void **dstptr
,
400 const struct xt_match
*match
= m
->u
.kernel
.match
;
401 struct compat_xt_entry_match
*cm
= (struct compat_xt_entry_match
*)m
;
402 int pad
, off
= xt_compat_match_offset(match
);
403 u_int16_t msize
= cm
->u
.user
.match_size
;
406 memcpy(m
, cm
, sizeof(*cm
));
407 if (match
->compat_from_user
)
408 match
->compat_from_user(m
->data
, cm
->data
);
410 memcpy(m
->data
, cm
->data
, msize
- sizeof(*cm
));
411 pad
= XT_ALIGN(match
->matchsize
) - match
->matchsize
;
413 memset(m
->data
+ match
->matchsize
, 0, pad
);
416 m
->u
.user
.match_size
= msize
;
422 EXPORT_SYMBOL_GPL(xt_compat_match_from_user
);
424 int xt_compat_match_to_user(struct xt_entry_match
*m
, void __user
**dstptr
,
427 const struct xt_match
*match
= m
->u
.kernel
.match
;
428 struct compat_xt_entry_match __user
*cm
= *dstptr
;
429 int off
= xt_compat_match_offset(match
);
430 u_int16_t msize
= m
->u
.user
.match_size
- off
;
432 if (copy_to_user(cm
, m
, sizeof(*cm
)) ||
433 put_user(msize
, &cm
->u
.user
.match_size
) ||
434 copy_to_user(cm
->u
.user
.name
, m
->u
.kernel
.match
->name
,
435 strlen(m
->u
.kernel
.match
->name
) + 1))
438 if (match
->compat_to_user
) {
439 if (match
->compat_to_user((void __user
*)cm
->data
, m
->data
))
442 if (copy_to_user(cm
->data
, m
->data
, msize
- sizeof(*cm
)))
450 EXPORT_SYMBOL_GPL(xt_compat_match_to_user
);
451 #endif /* CONFIG_COMPAT */
453 int xt_check_target(const struct xt_target
*target
, unsigned short family
,
454 unsigned int size
, const char *table
, unsigned int hook_mask
,
455 unsigned short proto
, int inv_proto
)
457 if (XT_ALIGN(target
->targetsize
) != size
) {
458 printk("%s_tables: %s target: invalid size %Zu != %u\n",
459 xt_prefix
[family
], target
->name
,
460 XT_ALIGN(target
->targetsize
), size
);
463 if (target
->table
&& strcmp(target
->table
, table
)) {
464 printk("%s_tables: %s target: only valid in %s table, not %s\n",
465 xt_prefix
[family
], target
->name
, target
->table
, table
);
468 if (target
->hooks
&& (hook_mask
& ~target
->hooks
) != 0) {
469 printk("%s_tables: %s target: bad hook_mask %u/%u\n",
470 xt_prefix
[family
], target
->name
, hook_mask
,
474 if (target
->proto
&& (target
->proto
!= proto
|| inv_proto
)) {
475 printk("%s_tables: %s target: only valid for protocol %u\n",
476 xt_prefix
[family
], target
->name
, target
->proto
);
481 EXPORT_SYMBOL_GPL(xt_check_target
);
484 int xt_compat_target_offset(const struct xt_target
*target
)
486 u_int16_t csize
= target
->compatsize
? : target
->targetsize
;
487 return XT_ALIGN(target
->targetsize
) - COMPAT_XT_ALIGN(csize
);
489 EXPORT_SYMBOL_GPL(xt_compat_target_offset
);
491 void xt_compat_target_from_user(struct xt_entry_target
*t
, void **dstptr
,
494 const struct xt_target
*target
= t
->u
.kernel
.target
;
495 struct compat_xt_entry_target
*ct
= (struct compat_xt_entry_target
*)t
;
496 int pad
, off
= xt_compat_target_offset(target
);
497 u_int16_t tsize
= ct
->u
.user
.target_size
;
500 memcpy(t
, ct
, sizeof(*ct
));
501 if (target
->compat_from_user
)
502 target
->compat_from_user(t
->data
, ct
->data
);
504 memcpy(t
->data
, ct
->data
, tsize
- sizeof(*ct
));
505 pad
= XT_ALIGN(target
->targetsize
) - target
->targetsize
;
507 memset(t
->data
+ target
->targetsize
, 0, pad
);
510 t
->u
.user
.target_size
= tsize
;
515 EXPORT_SYMBOL_GPL(xt_compat_target_from_user
);
517 int xt_compat_target_to_user(struct xt_entry_target
*t
, void __user
**dstptr
,
520 const struct xt_target
*target
= t
->u
.kernel
.target
;
521 struct compat_xt_entry_target __user
*ct
= *dstptr
;
522 int off
= xt_compat_target_offset(target
);
523 u_int16_t tsize
= t
->u
.user
.target_size
- off
;
525 if (copy_to_user(ct
, t
, sizeof(*ct
)) ||
526 put_user(tsize
, &ct
->u
.user
.target_size
) ||
527 copy_to_user(ct
->u
.user
.name
, t
->u
.kernel
.target
->name
,
528 strlen(t
->u
.kernel
.target
->name
) + 1))
531 if (target
->compat_to_user
) {
532 if (target
->compat_to_user((void __user
*)ct
->data
, t
->data
))
535 if (copy_to_user(ct
->data
, t
->data
, tsize
- sizeof(*ct
)))
543 EXPORT_SYMBOL_GPL(xt_compat_target_to_user
);
546 struct xt_table_info
*xt_alloc_table_info(unsigned int size
)
548 struct xt_table_info
*newinfo
;
551 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
552 if ((SMP_ALIGN(size
) >> PAGE_SHIFT
) + 2 > num_physpages
)
555 newinfo
= kzalloc(XT_TABLE_INFO_SZ
, GFP_KERNEL
);
559 newinfo
->size
= size
;
561 for_each_possible_cpu(cpu
) {
562 if (size
<= PAGE_SIZE
)
563 newinfo
->entries
[cpu
] = kmalloc_node(size
,
567 newinfo
->entries
[cpu
] = vmalloc_node(size
,
570 if (newinfo
->entries
[cpu
] == NULL
) {
571 xt_free_table_info(newinfo
);
578 EXPORT_SYMBOL(xt_alloc_table_info
);
580 void xt_free_table_info(struct xt_table_info
*info
)
584 for_each_possible_cpu(cpu
) {
585 if (info
->size
<= PAGE_SIZE
)
586 kfree(info
->entries
[cpu
]);
588 vfree(info
->entries
[cpu
]);
592 EXPORT_SYMBOL(xt_free_table_info
);
594 /* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
595 struct xt_table
*xt_find_table_lock(struct net
*net
, u_int8_t af
,
600 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
601 return ERR_PTR(-EINTR
);
603 list_for_each_entry(t
, &net
->xt
.tables
[af
], list
)
604 if (strcmp(t
->name
, name
) == 0 && try_module_get(t
->me
))
606 mutex_unlock(&xt
[af
].mutex
);
609 EXPORT_SYMBOL_GPL(xt_find_table_lock
);
611 void xt_table_unlock(struct xt_table
*table
)
613 mutex_unlock(&xt
[table
->af
].mutex
);
615 EXPORT_SYMBOL_GPL(xt_table_unlock
);
618 void xt_compat_lock(u_int8_t af
)
620 mutex_lock(&xt
[af
].compat_mutex
);
622 EXPORT_SYMBOL_GPL(xt_compat_lock
);
624 void xt_compat_unlock(u_int8_t af
)
626 mutex_unlock(&xt
[af
].compat_mutex
);
628 EXPORT_SYMBOL_GPL(xt_compat_unlock
);
631 struct xt_table_info
*
632 xt_replace_table(struct xt_table
*table
,
633 unsigned int num_counters
,
634 struct xt_table_info
*newinfo
,
637 struct xt_table_info
*oldinfo
, *private;
639 /* Do the substitution. */
640 write_lock_bh(&table
->lock
);
641 private = table
->private;
642 /* Check inside lock: is the old number correct? */
643 if (num_counters
!= private->number
) {
644 duprintf("num_counters != table->private->number (%u/%u)\n",
645 num_counters
, private->number
);
646 write_unlock_bh(&table
->lock
);
651 table
->private = newinfo
;
652 newinfo
->initial_entries
= oldinfo
->initial_entries
;
653 write_unlock_bh(&table
->lock
);
657 EXPORT_SYMBOL_GPL(xt_replace_table
);
659 struct xt_table
*xt_register_table(struct net
*net
, struct xt_table
*table
,
660 struct xt_table_info
*bootstrap
,
661 struct xt_table_info
*newinfo
)
664 struct xt_table_info
*private;
667 /* Don't add one object to multiple lists. */
668 table
= kmemdup(table
, sizeof(struct xt_table
), GFP_KERNEL
);
674 ret
= mutex_lock_interruptible(&xt
[table
->af
].mutex
);
678 /* Don't autoload: we'd eat our tail... */
679 list_for_each_entry(t
, &net
->xt
.tables
[table
->af
], list
) {
680 if (strcmp(t
->name
, table
->name
) == 0) {
686 /* Simplifies replace_table code. */
687 table
->private = bootstrap
;
688 rwlock_init(&table
->lock
);
689 if (!xt_replace_table(table
, 0, newinfo
, &ret
))
692 private = table
->private;
693 duprintf("table->private->number = %u\n", private->number
);
695 /* save number of initial entries */
696 private->initial_entries
= private->number
;
698 list_add(&table
->list
, &net
->xt
.tables
[table
->af
]);
699 mutex_unlock(&xt
[table
->af
].mutex
);
703 mutex_unlock(&xt
[table
->af
].mutex
);
709 EXPORT_SYMBOL_GPL(xt_register_table
);
711 void *xt_unregister_table(struct xt_table
*table
)
713 struct xt_table_info
*private;
715 mutex_lock(&xt
[table
->af
].mutex
);
716 private = table
->private;
717 list_del(&table
->list
);
718 mutex_unlock(&xt
[table
->af
].mutex
);
723 EXPORT_SYMBOL_GPL(xt_unregister_table
);
725 #ifdef CONFIG_PROC_FS
726 struct xt_names_priv
{
727 struct seq_net_private p
;
730 static void *xt_table_seq_start(struct seq_file
*seq
, loff_t
*pos
)
732 struct xt_names_priv
*priv
= seq
->private;
733 struct net
*net
= seq_file_net(seq
);
734 u_int8_t af
= priv
->af
;
736 mutex_lock(&xt
[af
].mutex
);
737 return seq_list_start(&net
->xt
.tables
[af
], *pos
);
740 static void *xt_table_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
742 struct xt_names_priv
*priv
= seq
->private;
743 struct net
*net
= seq_file_net(seq
);
744 u_int8_t af
= priv
->af
;
746 return seq_list_next(v
, &net
->xt
.tables
[af
], pos
);
749 static void xt_table_seq_stop(struct seq_file
*seq
, void *v
)
751 struct xt_names_priv
*priv
= seq
->private;
752 u_int8_t af
= priv
->af
;
754 mutex_unlock(&xt
[af
].mutex
);
757 static int xt_table_seq_show(struct seq_file
*seq
, void *v
)
759 struct xt_table
*table
= list_entry(v
, struct xt_table
, list
);
761 if (strlen(table
->name
))
762 return seq_printf(seq
, "%s\n", table
->name
);
767 static const struct seq_operations xt_table_seq_ops
= {
768 .start
= xt_table_seq_start
,
769 .next
= xt_table_seq_next
,
770 .stop
= xt_table_seq_stop
,
771 .show
= xt_table_seq_show
,
774 static int xt_table_open(struct inode
*inode
, struct file
*file
)
777 struct xt_names_priv
*priv
;
779 ret
= seq_open_net(inode
, file
, &xt_table_seq_ops
,
780 sizeof(struct xt_names_priv
));
782 priv
= ((struct seq_file
*)file
->private_data
)->private;
783 priv
->af
= (unsigned long)PDE(inode
)->data
;
788 static const struct file_operations xt_table_ops
= {
789 .owner
= THIS_MODULE
,
790 .open
= xt_table_open
,
793 .release
= seq_release_net
,
796 static void *xt_match_seq_start(struct seq_file
*seq
, loff_t
*pos
)
798 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
799 u_int16_t af
= (unsigned long)pde
->data
;
801 mutex_lock(&xt
[af
].mutex
);
802 return seq_list_start(&xt
[af
].match
, *pos
);
805 static void *xt_match_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
807 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
808 u_int16_t af
= (unsigned long)pde
->data
;
810 return seq_list_next(v
, &xt
[af
].match
, pos
);
813 static void xt_match_seq_stop(struct seq_file
*seq
, void *v
)
815 struct proc_dir_entry
*pde
= seq
->private;
816 u_int16_t af
= (unsigned long)pde
->data
;
818 mutex_unlock(&xt
[af
].mutex
);
821 static int xt_match_seq_show(struct seq_file
*seq
, void *v
)
823 struct xt_match
*match
= list_entry(v
, struct xt_match
, list
);
825 if (strlen(match
->name
))
826 return seq_printf(seq
, "%s\n", match
->name
);
831 static const struct seq_operations xt_match_seq_ops
= {
832 .start
= xt_match_seq_start
,
833 .next
= xt_match_seq_next
,
834 .stop
= xt_match_seq_stop
,
835 .show
= xt_match_seq_show
,
838 static int xt_match_open(struct inode
*inode
, struct file
*file
)
842 ret
= seq_open(file
, &xt_match_seq_ops
);
844 struct seq_file
*seq
= file
->private_data
;
846 seq
->private = PDE(inode
);
851 static const struct file_operations xt_match_ops
= {
852 .owner
= THIS_MODULE
,
853 .open
= xt_match_open
,
856 .release
= seq_release
,
859 static void *xt_target_seq_start(struct seq_file
*seq
, loff_t
*pos
)
861 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
862 u_int16_t af
= (unsigned long)pde
->data
;
864 mutex_lock(&xt
[af
].mutex
);
865 return seq_list_start(&xt
[af
].target
, *pos
);
868 static void *xt_target_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
870 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*)seq
->private;
871 u_int16_t af
= (unsigned long)pde
->data
;
873 return seq_list_next(v
, &xt
[af
].target
, pos
);
876 static void xt_target_seq_stop(struct seq_file
*seq
, void *v
)
878 struct proc_dir_entry
*pde
= seq
->private;
879 u_int16_t af
= (unsigned long)pde
->data
;
881 mutex_unlock(&xt
[af
].mutex
);
884 static int xt_target_seq_show(struct seq_file
*seq
, void *v
)
886 struct xt_target
*target
= list_entry(v
, struct xt_target
, list
);
888 if (strlen(target
->name
))
889 return seq_printf(seq
, "%s\n", target
->name
);
894 static const struct seq_operations xt_target_seq_ops
= {
895 .start
= xt_target_seq_start
,
896 .next
= xt_target_seq_next
,
897 .stop
= xt_target_seq_stop
,
898 .show
= xt_target_seq_show
,
901 static int xt_target_open(struct inode
*inode
, struct file
*file
)
905 ret
= seq_open(file
, &xt_target_seq_ops
);
907 struct seq_file
*seq
= file
->private_data
;
909 seq
->private = PDE(inode
);
914 static const struct file_operations xt_target_ops
= {
915 .owner
= THIS_MODULE
,
916 .open
= xt_target_open
,
919 .release
= seq_release
,
922 #define FORMAT_TABLES "_tables_names"
923 #define FORMAT_MATCHES "_tables_matches"
924 #define FORMAT_TARGETS "_tables_targets"
926 #endif /* CONFIG_PROC_FS */
928 int xt_proto_init(struct net
*net
, u_int8_t af
)
930 #ifdef CONFIG_PROC_FS
931 char buf
[XT_FUNCTION_MAXNAMELEN
];
932 struct proc_dir_entry
*proc
;
939 #ifdef CONFIG_PROC_FS
940 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
941 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
942 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_table_ops
,
943 (void *)(unsigned long)af
);
947 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
948 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
949 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_match_ops
,
950 (void *)(unsigned long)af
);
952 goto out_remove_tables
;
954 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
955 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
956 proc
= proc_create_data(buf
, 0440, net
->proc_net
, &xt_target_ops
,
957 (void *)(unsigned long)af
);
959 goto out_remove_matches
;
964 #ifdef CONFIG_PROC_FS
966 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
967 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
968 proc_net_remove(net
, buf
);
971 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
972 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
973 proc_net_remove(net
, buf
);
978 EXPORT_SYMBOL_GPL(xt_proto_init
);
980 void xt_proto_fini(struct net
*net
, u_int8_t af
)
982 #ifdef CONFIG_PROC_FS
983 char buf
[XT_FUNCTION_MAXNAMELEN
];
985 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
986 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
987 proc_net_remove(net
, buf
);
989 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
990 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
991 proc_net_remove(net
, buf
);
993 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
994 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
995 proc_net_remove(net
, buf
);
996 #endif /*CONFIG_PROC_FS*/
998 EXPORT_SYMBOL_GPL(xt_proto_fini
);
1000 static int __net_init
xt_net_init(struct net
*net
)
1004 for (i
= 0; i
< NPROTO
; i
++)
1005 INIT_LIST_HEAD(&net
->xt
.tables
[i
]);
1009 static struct pernet_operations xt_net_ops
= {
1010 .init
= xt_net_init
,
1013 static int __init
xt_init(void)
1017 xt
= kmalloc(sizeof(struct xt_af
) * NPROTO
, GFP_KERNEL
);
1021 for (i
= 0; i
< NPROTO
; i
++) {
1022 mutex_init(&xt
[i
].mutex
);
1023 #ifdef CONFIG_COMPAT
1024 mutex_init(&xt
[i
].compat_mutex
);
1025 xt
[i
].compat_offsets
= NULL
;
1027 INIT_LIST_HEAD(&xt
[i
].target
);
1028 INIT_LIST_HEAD(&xt
[i
].match
);
1030 rv
= register_pernet_subsys(&xt_net_ops
);
1036 static void __exit
xt_fini(void)
1038 unregister_pernet_subsys(&xt_net_ops
);
1042 module_init(xt_init
);
1043 module_exit(xt_fini
);