~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nft_compat.c

Version: ~ [ linux-5.7-rc7 ] ~ [ linux-5.6.14 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.42 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.124 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.181 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.224 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.224 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.84 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
  9  */
 10 
 11 #include <linux/kernel.h>
 12 #include <linux/init.h>
 13 #include <linux/module.h>
 14 #include <linux/netlink.h>
 15 #include <linux/netfilter.h>
 16 #include <linux/netfilter/nfnetlink.h>
 17 #include <linux/netfilter/nf_tables.h>
 18 #include <linux/netfilter/nf_tables_compat.h>
 19 #include <linux/netfilter/x_tables.h>
 20 #include <linux/netfilter_ipv4/ip_tables.h>
 21 #include <linux/netfilter_ipv6/ip6_tables.h>
 22 #include <linux/netfilter_bridge/ebtables.h>
 23 #include <linux/netfilter_arp/arp_tables.h>
 24 #include <net/netfilter/nf_tables.h>
 25 
 26 /* Used for matches where *info is larger than X byte */
 27 #define NFT_MATCH_LARGE_THRESH  192
 28 
 29 struct nft_xt_match_priv {
 30         void *info;
 31 };
 32 
 33 static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
 34                                                 const char *tablename)
 35 {
 36         enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
 37         const struct nft_chain *chain = ctx->chain;
 38         const struct nft_base_chain *basechain;
 39 
 40         if (!tablename ||
 41             !nft_is_base_chain(chain))
 42                 return 0;
 43 
 44         basechain = nft_base_chain(chain);
 45         if (strcmp(tablename, "nat") == 0) {
 46                 if (ctx->family != NFPROTO_BRIDGE)
 47                         type = NFT_CHAIN_T_NAT;
 48                 if (basechain->type->type != type)
 49                         return -EINVAL;
 50         }
 51 
 52         return 0;
 53 }
 54 
 55 union nft_entry {
 56         struct ipt_entry e4;
 57         struct ip6t_entry e6;
 58         struct ebt_entry ebt;
 59         struct arpt_entry arp;
 60 };
 61 
 62 static inline void
 63 nft_compat_set_par(struct xt_action_param *par, void *xt, const void *xt_info)
 64 {
 65         par->target     = xt;
 66         par->targinfo   = xt_info;
 67         par->hotdrop    = false;
 68 }
 69 
 70 static void nft_target_eval_xt(const struct nft_expr *expr,
 71                                struct nft_regs *regs,
 72                                const struct nft_pktinfo *pkt)
 73 {
 74         void *info = nft_expr_priv(expr);
 75         struct xt_target *target = expr->ops->data;
 76         struct sk_buff *skb = pkt->skb;
 77         int ret;
 78 
 79         nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info);
 80 
 81         ret = target->target(skb, &pkt->xt);
 82 
 83         if (pkt->xt.hotdrop)
 84                 ret = NF_DROP;
 85 
 86         switch (ret) {
 87         case XT_CONTINUE:
 88                 regs->verdict.code = NFT_CONTINUE;
 89                 break;
 90         default:
 91                 regs->verdict.code = ret;
 92                 break;
 93         }
 94 }
 95 
 96 static void nft_target_eval_bridge(const struct nft_expr *expr,
 97                                    struct nft_regs *regs,
 98                                    const struct nft_pktinfo *pkt)
 99 {
100         void *info = nft_expr_priv(expr);
101         struct xt_target *target = expr->ops->data;
102         struct sk_buff *skb = pkt->skb;
103         int ret;
104 
105         nft_compat_set_par((struct xt_action_param *)&pkt->xt, target, info);
106 
107         ret = target->target(skb, &pkt->xt);
108 
109         if (pkt->xt.hotdrop)
110                 ret = NF_DROP;
111 
112         switch (ret) {
113         case EBT_ACCEPT:
114                 regs->verdict.code = NF_ACCEPT;
115                 break;
116         case EBT_DROP:
117                 regs->verdict.code = NF_DROP;
118                 break;
119         case EBT_CONTINUE:
120                 regs->verdict.code = NFT_CONTINUE;
121                 break;
122         case EBT_RETURN:
123                 regs->verdict.code = NFT_RETURN;
124                 break;
125         default:
126                 regs->verdict.code = ret;
127                 break;
128         }
129 }
130 
131 static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = {
132         [NFTA_TARGET_NAME]      = { .type = NLA_NUL_STRING },
133         [NFTA_TARGET_REV]       = { .type = NLA_U32 },
134         [NFTA_TARGET_INFO]      = { .type = NLA_BINARY },
135 };
136 
137 static void
138 nft_target_set_tgchk_param(struct xt_tgchk_param *par,
139                            const struct nft_ctx *ctx,
140                            struct xt_target *target, void *info,
141                            union nft_entry *entry, u16 proto, bool inv)
142 {
143         par->net        = ctx->net;
144         par->table      = ctx->table->name;
145         switch (ctx->family) {
146         case AF_INET:
147                 entry->e4.ip.proto = proto;
148                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
149                 break;
150         case AF_INET6:
151                 if (proto)
152                         entry->e6.ipv6.flags |= IP6T_F_PROTO;
153 
154                 entry->e6.ipv6.proto = proto;
155                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
156                 break;
157         case NFPROTO_BRIDGE:
158                 entry->ebt.ethproto = (__force __be16)proto;
159                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
160                 break;
161         case NFPROTO_ARP:
162                 break;
163         }
164         par->entryinfo  = entry;
165         par->target     = target;
166         par->targinfo   = info;
167         if (nft_is_base_chain(ctx->chain)) {
168                 const struct nft_base_chain *basechain =
169                                                 nft_base_chain(ctx->chain);
170                 const struct nf_hook_ops *ops = &basechain->ops;
171 
172                 par->hook_mask = 1 << ops->hooknum;
173         } else {
174                 par->hook_mask = 0;
175         }
176         par->family     = ctx->family;
177         par->nft_compat = true;
178 }
179 
180 static void target_compat_from_user(struct xt_target *t, void *in, void *out)
181 {
182         int pad;
183 
184         memcpy(out, in, t->targetsize);
185         pad = XT_ALIGN(t->targetsize) - t->targetsize;
186         if (pad > 0)
187                 memset(out + t->targetsize, 0, pad);
188 }
189 
190 static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = {
191         [NFTA_RULE_COMPAT_PROTO]        = { .type = NLA_U32 },
192         [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
193 };
194 
195 static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
196 {
197         struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
198         u32 flags;
199         int err;
200 
201         err = nla_parse_nested(tb, NFTA_RULE_COMPAT_MAX, attr,
202                                nft_rule_compat_policy, NULL);
203         if (err < 0)
204                 return err;
205 
206         if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS])
207                 return -EINVAL;
208 
209         flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS]));
210         if (flags & ~NFT_RULE_COMPAT_F_MASK)
211                 return -EINVAL;
212         if (flags & NFT_RULE_COMPAT_F_INV)
213                 *inv = true;
214 
215         *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
216         return 0;
217 }
218 
219 static int
220 nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
221                 const struct nlattr * const tb[])
222 {
223         void *info = nft_expr_priv(expr);
224         struct xt_target *target = expr->ops->data;
225         struct xt_tgchk_param par;
226         size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
227         u16 proto = 0;
228         bool inv = false;
229         union nft_entry e = {};
230         int ret;
231 
232         target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
233 
234         if (ctx->nla[NFTA_RULE_COMPAT]) {
235                 ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
236                 if (ret < 0)
237                         return ret;
238         }
239 
240         nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
241 
242         ret = xt_check_target(&par, size, proto, inv);
243         if (ret < 0)
244                 return ret;
245 
246         /* The standard target cannot be used */
247         if (!target->target)
248                 return -EINVAL;
249 
250         return 0;
251 }
252 
253 static void
254 nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
255 {
256         struct xt_target *target = expr->ops->data;
257         void *info = nft_expr_priv(expr);
258         struct module *me = target->me;
259         struct xt_tgdtor_param par;
260 
261         par.net = ctx->net;
262         par.target = target;
263         par.targinfo = info;
264         par.family = ctx->family;
265         if (par.target->destroy != NULL)
266                 par.target->destroy(&par);
267 
268         module_put(me);
269         kfree(expr->ops);
270 }
271 
272 static int nft_extension_dump_info(struct sk_buff *skb, int attr,
273                                    const void *info,
274                                    unsigned int size, unsigned int user_size)
275 {
276         unsigned int info_size, aligned_size = XT_ALIGN(size);
277         struct nlattr *nla;
278 
279         nla = nla_reserve(skb, attr, aligned_size);
280         if (!nla)
281                 return -1;
282 
283         info_size = user_size ? : size;
284         memcpy(nla_data(nla), info, info_size);
285         memset(nla_data(nla) + info_size, 0, aligned_size - info_size);
286 
287         return 0;
288 }
289 
290 static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)
291 {
292         const struct xt_target *target = expr->ops->data;
293         void *info = nft_expr_priv(expr);
294 
295         if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) ||
296             nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) ||
297             nft_extension_dump_info(skb, NFTA_TARGET_INFO, info,
298                                     target->targetsize, target->usersize))
299                 goto nla_put_failure;
300 
301         return 0;
302 
303 nla_put_failure:
304         return -1;
305 }
306 
307 static int nft_target_validate(const struct nft_ctx *ctx,
308                                const struct nft_expr *expr,
309                                const struct nft_data **data)
310 {
311         struct xt_target *target = expr->ops->data;
312         unsigned int hook_mask = 0;
313         int ret;
314 
315         if (nft_is_base_chain(ctx->chain)) {
316                 const struct nft_base_chain *basechain =
317                                                 nft_base_chain(ctx->chain);
318                 const struct nf_hook_ops *ops = &basechain->ops;
319 
320                 hook_mask = 1 << ops->hooknum;
321                 if (target->hooks && !(hook_mask & target->hooks))
322                         return -EINVAL;
323 
324                 ret = nft_compat_chain_validate_dependency(ctx, target->table);
325                 if (ret < 0)
326                         return ret;
327         }
328         return 0;
329 }
330 
331 static void __nft_match_eval(const struct nft_expr *expr,
332                              struct nft_regs *regs,
333                              const struct nft_pktinfo *pkt,
334                              void *info)
335 {
336         struct xt_match *match = expr->ops->data;
337         struct sk_buff *skb = pkt->skb;
338         bool ret;
339 
340         nft_compat_set_par((struct xt_action_param *)&pkt->xt, match, info);
341 
342         ret = match->match(skb, (struct xt_action_param *)&pkt->xt);
343 
344         if (pkt->xt.hotdrop) {
345                 regs->verdict.code = NF_DROP;
346                 return;
347         }
348 
349         switch (ret ? 1 : 0) {
350         case 1:
351                 regs->verdict.code = NFT_CONTINUE;
352                 break;
353         case 0:
354                 regs->verdict.code = NFT_BREAK;
355                 break;
356         }
357 }
358 
359 static void nft_match_large_eval(const struct nft_expr *expr,
360                                  struct nft_regs *regs,
361                                  const struct nft_pktinfo *pkt)
362 {
363         struct nft_xt_match_priv *priv = nft_expr_priv(expr);
364 
365         __nft_match_eval(expr, regs, pkt, priv->info);
366 }
367 
368 static void nft_match_eval(const struct nft_expr *expr,
369                            struct nft_regs *regs,
370                            const struct nft_pktinfo *pkt)
371 {
372         __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr));
373 }
374 
375 static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
376         [NFTA_MATCH_NAME]       = { .type = NLA_NUL_STRING },
377         [NFTA_MATCH_REV]        = { .type = NLA_U32 },
378         [NFTA_MATCH_INFO]       = { .type = NLA_BINARY },
379 };
380 
381 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
382 static void
383 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
384                           struct xt_match *match, void *info,
385                           union nft_entry *entry, u16 proto, bool inv)
386 {
387         par->net        = ctx->net;
388         par->table      = ctx->table->name;
389         switch (ctx->family) {
390         case AF_INET:
391                 entry->e4.ip.proto = proto;
392                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
393                 break;
394         case AF_INET6:
395                 if (proto)
396                         entry->e6.ipv6.flags |= IP6T_F_PROTO;
397 
398                 entry->e6.ipv6.proto = proto;
399                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
400                 break;
401         case NFPROTO_BRIDGE:
402                 entry->ebt.ethproto = (__force __be16)proto;
403                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
404                 break;
405         case NFPROTO_ARP:
406                 break;
407         }
408         par->entryinfo  = entry;
409         par->match      = match;
410         par->matchinfo  = info;
411         if (nft_is_base_chain(ctx->chain)) {
412                 const struct nft_base_chain *basechain =
413                                                 nft_base_chain(ctx->chain);
414                 const struct nf_hook_ops *ops = &basechain->ops;
415 
416                 par->hook_mask = 1 << ops->hooknum;
417         } else {
418                 par->hook_mask = 0;
419         }
420         par->family     = ctx->family;
421         par->nft_compat = true;
422 }
423 
424 static void match_compat_from_user(struct xt_match *m, void *in, void *out)
425 {
426         int pad;
427 
428         memcpy(out, in, m->matchsize);
429         pad = XT_ALIGN(m->matchsize) - m->matchsize;
430         if (pad > 0)
431                 memset(out + m->matchsize, 0, pad);
432 }
433 
434 static int
435 __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
436                  const struct nlattr * const tb[],
437                  void *info)
438 {
439         struct xt_match *match = expr->ops->data;
440         struct xt_mtchk_param par;
441         size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
442         u16 proto = 0;
443         bool inv = false;
444         union nft_entry e = {};
445         int ret;
446 
447         match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
448 
449         if (ctx->nla[NFTA_RULE_COMPAT]) {
450                 ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
451                 if (ret < 0)
452                         return ret;
453         }
454 
455         nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
456 
457         return xt_check_match(&par, size, proto, inv);
458 }
459 
460 static int
461 nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
462                const struct nlattr * const tb[])
463 {
464         return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr));
465 }
466 
467 static int
468 nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
469                      const struct nlattr * const tb[])
470 {
471         struct nft_xt_match_priv *priv = nft_expr_priv(expr);
472         struct xt_match *m = expr->ops->data;
473         int ret;
474 
475         priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL);
476         if (!priv->info)
477                 return -ENOMEM;
478 
479         ret = __nft_match_init(ctx, expr, tb, priv->info);
480         if (ret)
481                 kfree(priv->info);
482         return ret;
483 }
484 
485 static void
486 __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
487                     void *info)
488 {
489         struct xt_match *match = expr->ops->data;
490         struct module *me = match->me;
491         struct xt_mtdtor_param par;
492 
493         par.net = ctx->net;
494         par.match = match;
495         par.matchinfo = info;
496         par.family = ctx->family;
497         if (par.match->destroy != NULL)
498                 par.match->destroy(&par);
499 
500         module_put(me);
501         kfree(expr->ops);
502 }
503 
504 static void
505 nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
506 {
507         __nft_match_destroy(ctx, expr, nft_expr_priv(expr));
508 }
509 
510 static void
511 nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
512 {
513         struct nft_xt_match_priv *priv = nft_expr_priv(expr);
514 
515         __nft_match_destroy(ctx, expr, priv->info);
516         kfree(priv->info);
517 }
518 
519 static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr,
520                             void *info)
521 {
522         struct xt_match *match = expr->ops->data;
523 
524         if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) ||
525             nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) ||
526             nft_extension_dump_info(skb, NFTA_MATCH_INFO, info,
527                                     match->matchsize, match->usersize))
528                 goto nla_put_failure;
529 
530         return 0;
531 
532 nla_put_failure:
533         return -1;
534 }
535 
536 static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr)
537 {
538         return __nft_match_dump(skb, expr, nft_expr_priv(expr));
539 }
540 
541 static int nft_match_large_dump(struct sk_buff *skb, const struct nft_expr *e)
542 {
543         struct nft_xt_match_priv *priv = nft_expr_priv(e);
544 
545         return __nft_match_dump(skb, e, priv->info);
546 }
547 
548 static int nft_match_validate(const struct nft_ctx *ctx,
549                               const struct nft_expr *expr,
550                               const struct nft_data **data)
551 {
552         struct xt_match *match = expr->ops->data;
553         unsigned int hook_mask = 0;
554         int ret;
555 
556         if (nft_is_base_chain(ctx->chain)) {
557                 const struct nft_base_chain *basechain =
558                                                 nft_base_chain(ctx->chain);
559                 const struct nf_hook_ops *ops = &basechain->ops;
560 
561                 hook_mask = 1 << ops->hooknum;
562                 if (match->hooks && !(hook_mask & match->hooks))
563                         return -EINVAL;
564 
565                 ret = nft_compat_chain_validate_dependency(ctx, match->table);
566                 if (ret < 0)
567                         return ret;
568         }
569         return 0;
570 }
571 
572 static int
573 nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
574                       int event, u16 family, const char *name,
575                       int rev, int target)
576 {
577         struct nlmsghdr *nlh;
578         struct nfgenmsg *nfmsg;
579         unsigned int flags = portid ? NLM_F_MULTI : 0;
580 
581         event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event);
582         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
583         if (nlh == NULL)
584                 goto nlmsg_failure;
585 
586         nfmsg = nlmsg_data(nlh);
587         nfmsg->nfgen_family = family;
588         nfmsg->version = NFNETLINK_V0;
589         nfmsg->res_id = 0;
590 
591         if (nla_put_string(skb, NFTA_COMPAT_NAME, name) ||
592             nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) ||
593             nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target)))
594                 goto nla_put_failure;
595 
596         nlmsg_end(skb, nlh);
597         return skb->len;
598 
599 nlmsg_failure:
600 nla_put_failure:
601         nlmsg_cancel(skb, nlh);
602         return -1;
603 }
604 
605 static int nfnl_compat_get_rcu(struct net *net, struct sock *nfnl,
606                                struct sk_buff *skb, const struct nlmsghdr *nlh,
607                                const struct nlattr * const tb[],
608                                struct netlink_ext_ack *extack)
609 {
610         int ret = 0, target;
611         struct nfgenmsg *nfmsg;
612         const char *fmt;
613         const char *name;
614         u32 rev;
615         struct sk_buff *skb2;
616 
617         if (tb[NFTA_COMPAT_NAME] == NULL ||
618             tb[NFTA_COMPAT_REV] == NULL ||
619             tb[NFTA_COMPAT_TYPE] == NULL)
620                 return -EINVAL;
621 
622         name = nla_data(tb[NFTA_COMPAT_NAME]);
623         rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV]));
624         target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE]));
625 
626         nfmsg = nlmsg_data(nlh);
627 
628         switch(nfmsg->nfgen_family) {
629         case AF_INET:
630                 fmt = "ipt_%s";
631                 break;
632         case AF_INET6:
633                 fmt = "ip6t_%s";
634                 break;
635         case NFPROTO_BRIDGE:
636                 fmt = "ebt_%s";
637                 break;
638         case NFPROTO_ARP:
639                 fmt = "arpt_%s";
640                 break;
641         default:
642                 pr_err("nft_compat: unsupported protocol %d\n",
643                         nfmsg->nfgen_family);
644                 return -EINVAL;
645         }
646 
647         if (!try_module_get(THIS_MODULE))
648                 return -EINVAL;
649 
650         rcu_read_unlock();
651         try_then_request_module(xt_find_revision(nfmsg->nfgen_family, name,
652                                                  rev, target, &ret),
653                                                  fmt, name);
654         if (ret < 0)
655                 goto out_put;
656 
657         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
658         if (skb2 == NULL) {
659                 ret = -ENOMEM;
660                 goto out_put;
661         }
662 
663         /* include the best revision for this extension in the message */
664         if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid,
665                                   nlh->nlmsg_seq,
666                                   NFNL_MSG_TYPE(nlh->nlmsg_type),
667                                   NFNL_MSG_COMPAT_GET,
668                                   nfmsg->nfgen_family,
669                                   name, ret, target) <= 0) {
670                 kfree_skb(skb2);
671                 goto out_put;
672         }
673 
674         ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
675                                 MSG_DONTWAIT);
676         if (ret > 0)
677                 ret = 0;
678 out_put:
679         rcu_read_lock();
680         module_put(THIS_MODULE);
681         return ret == -EAGAIN ? -ENOBUFS : ret;
682 }
683 
684 static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = {
685         [NFTA_COMPAT_NAME]      = { .type = NLA_NUL_STRING,
686                                     .len = NFT_COMPAT_NAME_MAX-1 },
687         [NFTA_COMPAT_REV]       = { .type = NLA_U32 },
688         [NFTA_COMPAT_TYPE]      = { .type = NLA_U32 },
689 };
690 
691 static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = {
692         [NFNL_MSG_COMPAT_GET]           = { .call_rcu = nfnl_compat_get_rcu,
693                                             .attr_count = NFTA_COMPAT_MAX,
694                                             .policy = nfnl_compat_policy_get },
695 };
696 
697 static const struct nfnetlink_subsystem nfnl_compat_subsys = {
698         .name           = "nft-compat",
699         .subsys_id      = NFNL_SUBSYS_NFT_COMPAT,
700         .cb_count       = NFNL_MSG_COMPAT_MAX,
701         .cb             = nfnl_nft_compat_cb,
702 };
703 
704 static struct nft_expr_type nft_match_type;
705 
706 static const struct nft_expr_ops *
707 nft_match_select_ops(const struct nft_ctx *ctx,
708                      const struct nlattr * const tb[])
709 {
710         struct nft_expr_ops *ops;
711         struct xt_match *match;
712         unsigned int matchsize;
713         char *mt_name;
714         u32 rev, family;
715         int err;
716 
717         if (tb[NFTA_MATCH_NAME] == NULL ||
718             tb[NFTA_MATCH_REV] == NULL ||
719             tb[NFTA_MATCH_INFO] == NULL)
720                 return ERR_PTR(-EINVAL);
721 
722         mt_name = nla_data(tb[NFTA_MATCH_NAME]);
723         rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
724         family = ctx->family;
725 
726         match = xt_request_find_match(family, mt_name, rev);
727         if (IS_ERR(match))
728                 return ERR_PTR(-ENOENT);
729 
730         if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) {
731                 err = -EINVAL;
732                 goto err;
733         }
734 
735         ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
736         if (!ops) {
737                 err = -ENOMEM;
738                 goto err;
739         }
740 
741         ops->type = &nft_match_type;
742         ops->eval = nft_match_eval;
743         ops->init = nft_match_init;
744         ops->destroy = nft_match_destroy;
745         ops->dump = nft_match_dump;
746         ops->validate = nft_match_validate;
747         ops->data = match;
748 
749         matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
750         if (matchsize > NFT_MATCH_LARGE_THRESH) {
751                 matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv));
752 
753                 ops->eval = nft_match_large_eval;
754                 ops->init = nft_match_large_init;
755                 ops->destroy = nft_match_large_destroy;
756                 ops->dump = nft_match_large_dump;
757         }
758 
759         ops->size = matchsize;
760 
761         return ops;
762 err:
763         module_put(match->me);
764         return ERR_PTR(err);
765 }
766 
767 static void nft_match_release_ops(const struct nft_expr_ops *ops)
768 {
769         struct xt_match *match = ops->data;
770 
771         module_put(match->me);
772         kfree(ops);
773 }
774 
775 static struct nft_expr_type nft_match_type __read_mostly = {
776         .name           = "match",
777         .select_ops     = nft_match_select_ops,
778         .release_ops    = nft_match_release_ops,
779         .policy         = nft_match_policy,
780         .maxattr        = NFTA_MATCH_MAX,
781         .owner          = THIS_MODULE,
782 };
783 
784 static struct nft_expr_type nft_target_type;
785 
786 static const struct nft_expr_ops *
787 nft_target_select_ops(const struct nft_ctx *ctx,
788                       const struct nlattr * const tb[])
789 {
790         struct nft_expr_ops *ops;
791         struct xt_target *target;
792         char *tg_name;
793         u32 rev, family;
794         int err;
795 
796         if (tb[NFTA_TARGET_NAME] == NULL ||
797             tb[NFTA_TARGET_REV] == NULL ||
798             tb[NFTA_TARGET_INFO] == NULL)
799                 return ERR_PTR(-EINVAL);
800 
801         tg_name = nla_data(tb[NFTA_TARGET_NAME]);
802         rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
803         family = ctx->family;
804 
805         if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
806             strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
807             strcmp(tg_name, "standard") == 0)
808                 return ERR_PTR(-EINVAL);
809 
810         target = xt_request_find_target(family, tg_name, rev);
811         if (IS_ERR(target))
812                 return ERR_PTR(-ENOENT);
813 
814         if (!target->target) {
815                 err = -EINVAL;
816                 goto err;
817         }
818 
819         if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
820                 err = -EINVAL;
821                 goto err;
822         }
823 
824         ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL);
825         if (!ops) {
826                 err = -ENOMEM;
827                 goto err;
828         }
829 
830         ops->type = &nft_target_type;
831         ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
832         ops->init = nft_target_init;
833         ops->destroy = nft_target_destroy;
834         ops->dump = nft_target_dump;
835         ops->validate = nft_target_validate;
836         ops->data = target;
837 
838         if (family == NFPROTO_BRIDGE)
839                 ops->eval = nft_target_eval_bridge;
840         else
841                 ops->eval = nft_target_eval_xt;
842 
843         return ops;
844 err:
845         module_put(target->me);
846         return ERR_PTR(err);
847 }
848 
849 static void nft_target_release_ops(const struct nft_expr_ops *ops)
850 {
851         struct xt_target *target = ops->data;
852 
853         module_put(target->me);
854         kfree(ops);
855 }
856 
857 static struct nft_expr_type nft_target_type __read_mostly = {
858         .name           = "target",
859         .select_ops     = nft_target_select_ops,
860         .release_ops    = nft_target_release_ops,
861         .policy         = nft_target_policy,
862         .maxattr        = NFTA_TARGET_MAX,
863         .owner          = THIS_MODULE,
864 };
865 
866 static int __init nft_compat_module_init(void)
867 {
868         int ret;
869 
870         ret = nft_register_expr(&nft_match_type);
871         if (ret < 0)
872                 return ret;
873 
874         ret = nft_register_expr(&nft_target_type);
875         if (ret < 0)
876                 goto err_match;
877 
878         ret = nfnetlink_subsys_register(&nfnl_compat_subsys);
879         if (ret < 0) {
880                 pr_err("nft_compat: cannot register with nfnetlink.\n");
881                 goto err_target;
882         }
883 
884         return ret;
885 err_target:
886         nft_unregister_expr(&nft_target_type);
887 err_match:
888         nft_unregister_expr(&nft_match_type);
889         return ret;
890 }
891 
892 static void __exit nft_compat_module_exit(void)
893 {
894         nfnetlink_subsys_unregister(&nfnl_compat_subsys);
895         nft_unregister_expr(&nft_target_type);
896         nft_unregister_expr(&nft_match_type);
897 }
898 
899 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
900 
901 module_init(nft_compat_module_init);
902 module_exit(nft_compat_module_exit);
903 
904 MODULE_LICENSE("GPL");
905 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
906 MODULE_ALIAS_NFT_EXPR("match");
907 MODULE_ALIAS_NFT_EXPR("target");
908 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp