[NETFILTER]: xt_tables: add centralized error checking

Introduce new functions for common match/target checks (private data
size, valid hooks, valid tables and valid protocols) to get more consistent
error reporting and to avoid each module duplicating them.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 6500d4e59d46c5c6f60bfba239aad63f4639b7bf..b9c37e1e67301cb04ae1ae0216b61fafd4b96150 100644 (file)
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -92,8 +92,6 @@ struct xt_match
 
        const char name[XT_FUNCTION_MAXNAMELEN-1];
 
-       u_int8_t revision;
-
        /* Return true or false: return FALSE and set *hotdrop = 1 to
            force immediate packet drop. */
        /* Arguments changed since 2.6.9, as this must now handle
@@ -120,6 +118,12 @@ struct xt_match
 
        /* Set this to THIS_MODULE if you are a module, otherwise NULL */
        struct module *me;
+
+       char *table;
+       unsigned int matchsize;
+       unsigned int hooks;
+       unsigned short proto;
+       u_int8_t revision;
 };
 
 /* Registration hooks for targets. */
@@ -129,8 +133,6 @@ struct xt_target
 
        const char name[XT_FUNCTION_MAXNAMELEN-1];
 
-       u_int8_t revision;
-
        /* Returns verdict. Argument order changed since 2.6.9, as this
           must now handle non-linear skbs, using skb_copy_bits and
           skb_ip_make_writable. */
@@ -156,6 +158,12 @@ struct xt_target
 
        /* Set this to THIS_MODULE if you are a module, otherwise NULL */
        struct module *me;
+
+       char *table;
+       unsigned int targetsize;
+       unsigned int hooks;
+       unsigned short proto;
+       u_int8_t revision;
 };
 
 /* Furniture shopping... */
@@ -207,6 +215,13 @@ extern void xt_unregister_target(int af, struct xt_target *target);
 extern int xt_register_match(int af, struct xt_match *target);
 extern void xt_unregister_match(int af, struct xt_match *target);
 
+extern int xt_check_match(const struct xt_match *match, unsigned short family,
+                         unsigned int size, const char *table, unsigned int hook,
+                         unsigned short proto, int inv_proto);
+extern int xt_check_target(const struct xt_target *target, unsigned short family,
+                          unsigned int size, const char *table, unsigned int hook,
+                          unsigned short proto, int inv_proto);
+
 extern int xt_register_table(struct xt_table *table,
                             struct xt_table_info *bootstrap,
                             struct xt_table_info *newinfo);

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d7817afc6b9654cd12499135d5e1b9c2617b5440..750b928297660b141db59c5f45ec8d4be0321f77 100644 (file)
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -52,6 +52,12 @@ enum {
        MATCH,
 };
 
+static const char *xt_prefix[NPROTO] = {
+       [AF_INET]       = "ip",
+       [AF_INET6]      = "ip6",
+       [NF_ARP]        = "arp",
+};
+
 /* Registration hooks for targets. */
 int
 xt_register_target(int af, struct xt_target *target)
@@ -158,18 +164,12 @@ struct xt_target *xt_find_target(int af, const char *name, u8 revision)
 }
 EXPORT_SYMBOL(xt_find_target);
 
-static const char *xt_prefix[NPROTO] = {
-       [AF_INET]       = "ipt_%s",
-       [AF_INET6]      = "ip6t_%s",
-       [NF_ARP]        = "arpt_%s",
-};
-
 struct xt_target *xt_request_find_target(int af, const char *name, u8 revision)
 {
        struct xt_target *target;
 
        target = try_then_request_module(xt_find_target(af, name, revision),
-                                        xt_prefix[af], name);
+                                        "%st_%s", xt_prefix[af], name);
        if (IS_ERR(target) || !target)
                return NULL;
        return target;
@@ -237,6 +237,64 @@ int xt_find_revision(int af, const char *name, u8 revision, int target,
 }
 EXPORT_SYMBOL_GPL(xt_find_revision);
 
+int xt_check_match(const struct xt_match *match, unsigned short family,
+                   unsigned int size, const char *table, unsigned int hook_mask,
+                  unsigned short proto, int inv_proto)
+{
+       if (XT_ALIGN(match->matchsize) != size) {
+               printk("%s_tables: %s match: invalid size %Zu != %u\n",
+                      xt_prefix[family], match->name,
+                      XT_ALIGN(match->matchsize), size);
+               return -EINVAL;
+       }
+       if (match->table && strcmp(match->table, table)) {
+               printk("%s_tables: %s match: only valid in %s table, not %s\n",
+                      xt_prefix[family], match->name, match->table, table);
+               return -EINVAL;
+       }
+       if (match->hooks && (hook_mask & ~match->hooks) != 0) {
+               printk("%s_tables: %s match: bad hook_mask %u\n",
+                      xt_prefix[family], match->name, hook_mask);
+               return -EINVAL;
+       }
+       if (match->proto && (match->proto != proto || inv_proto)) {
+               printk("%s_tables: %s match: only valid for protocol %u\n",
+                      xt_prefix[family], match->name, match->proto);
+               return -EINVAL;
+       }
+       return 0;
+}
+EXPORT_SYMBOL_GPL(xt_check_match);
+
+int xt_check_target(const struct xt_target *target, unsigned short family,
+                   unsigned int size, const char *table, unsigned int hook_mask,
+                   unsigned short proto, int inv_proto)
+{
+       if (XT_ALIGN(target->targetsize) != size) {
+               printk("%s_tables: %s target: invalid size %Zu != %u\n",
+                      xt_prefix[family], target->name,
+                      XT_ALIGN(target->targetsize), size);
+               return -EINVAL;
+       }
+       if (target->table && strcmp(target->table, table)) {
+               printk("%s_tables: %s target: only valid in %s table, not %s\n",
+                      xt_prefix[family], target->name, target->table, table);
+               return -EINVAL;
+       }
+       if (target->hooks && (hook_mask & ~target->hooks) != 0) {
+               printk("%s_tables: %s target: bad hook_mask %u\n",
+                      xt_prefix[family], target->name, hook_mask);
+               return -EINVAL;
+       }
+       if (target->proto && (target->proto != proto || inv_proto)) {
+               printk("%s_tables: %s target: only valid for protocol %u\n",
+                      xt_prefix[family], target->name, target->proto);
+               return -EINVAL;
+       }
+       return 0;
+}
+EXPORT_SYMBOL_GPL(xt_check_target);
+
 struct xt_table_info *xt_alloc_table_info(unsigned int size)
 {
        struct xt_table_info *newinfo;