netfilter: xtables: add struct xt_mtchk_param::net
[safe/jmp/linux-2.6] / net / ipv4 / netfilter / ip_tables.c
index cfcb7af..a069d72 100644 (file)
@@ -8,6 +8,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/cache.h>
 #include <linux/capability.h>
 #include <linux/skbuff.h>
@@ -88,9 +89,9 @@ ip_packet_match(const struct iphdr *ip,
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 
        if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
-                 IPT_INV_SRCIP)
-           || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-                    IPT_INV_DSTIP)) {
+                 IPT_INV_SRCIP) ||
+           FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+                 IPT_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");
 
                dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
@@ -121,8 +122,8 @@ ip_packet_match(const struct iphdr *ip,
        }
 
        /* Check specific protocol */
-       if (ipinfo->proto
-           && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
+       if (ipinfo->proto &&
+           FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
                dprintf("Packet protocol %hi does not match %hi.%s\n",
                        ip->protocol, ipinfo->proto,
                        ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
@@ -190,16 +191,11 @@ get_entry(void *base, unsigned int offset)
 
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
-static inline int
-unconditional(const struct ipt_ip *ip)
+static inline bool unconditional(const struct ipt_ip *ip)
 {
-       unsigned int i;
+       static const struct ipt_ip uncond;
 
-       for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++)
-               if (((__u32 *)ip)[i])
-                       return 0;
-
-       return 1;
+       return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 #undef FWINV
 }
 
@@ -250,11 +246,11 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
        } else if (s == e) {
                (*rulenum)++;
 
-               if (s->target_offset == sizeof(struct ipt_entry)
-                  && strcmp(t->target.u.kernel.target->name,
-                            IPT_STANDARD_TARGET) == 0
-                  && t->verdict < 0
-                  && unconditional(&s->ip)) {
+               if (s->target_offset == sizeof(struct ipt_entry) &&
+                   strcmp(t->target.u.kernel.target->name,
+                          IPT_STANDARD_TARGET) == 0 &&
+                  t->verdict < 0 &&
+                  unconditional(&s->ip)) {
                        /* Tail of chains: STANDARD target (return/policy) */
                        *comment = *chainname == hookname
                                ? comments[NF_IP_TRACE_COMMENT_POLICY]
@@ -311,9 +307,10 @@ ipt_do_table(struct sk_buff *skb,
             const struct net_device *out,
             struct xt_table *table)
 {
+#define tb_comefrom ((struct ipt_entry *)table_base)->comefrom
+
        static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
        const struct iphdr *ip;
-       u_int16_t datalen;
        bool hotdrop = false;
        /* Initializing verdict to NF_DROP keeps gcc happy. */
        unsigned int verdict = NF_DROP;
@@ -326,7 +323,6 @@ ipt_do_table(struct sk_buff *skb,
 
        /* Initialization */
        ip = ip_hdr(skb);
-       datalen = skb->len - ip->ihl * 4;
        indev = in ? in->name : nulldevname;
        outdev = out ? out->name : nulldevname;
        /* We handle fragments by dealing with the first fragment as
@@ -341,7 +337,7 @@ ipt_do_table(struct sk_buff *skb,
        mtpar.in      = tgpar.in  = in;
        mtpar.out     = tgpar.out = out;
        mtpar.family  = tgpar.family = NFPROTO_IPV4;
-       tgpar.hooknum = hook;
+       mtpar.hooknum = tgpar.hooknum = hook;
 
        IP_NF_ASSERT(table->valid_hooks & (1 << hook));
        xt_info_rdlock_bh();
@@ -392,8 +388,8 @@ ipt_do_table(struct sk_buff *skb,
                                back = get_entry(table_base, back->comefrom);
                                continue;
                        }
-                       if (table_base + v != ipt_next_entry(e)
-                           && !(e->ip.flags & IPT_F_GOTO)) {
+                       if (table_base + v != ipt_next_entry(e) &&
+                           !(e->ip.flags & IPT_F_GOTO)) {
                                /* Save old back ptr in next entry */
                                struct ipt_entry *next = ipt_next_entry(e);
                                next->comefrom = (void *)back - table_base;
@@ -402,37 +398,34 @@ ipt_do_table(struct sk_buff *skb,
                        }
 
                        e = get_entry(table_base, v);
-               } else {
-                       /* Targets which reenter must return
-                          abs. verdicts */
-                       tgpar.target   = t->u.kernel.target;
-                       tgpar.targinfo = t->data;
+                       continue;
+               }
+
+               /* Targets which reenter must return
+                  abs. verdicts */
+               tgpar.target   = t->u.kernel.target;
+               tgpar.targinfo = t->data;
+
+
 #ifdef CONFIG_NETFILTER_DEBUG
-                       ((struct ipt_entry *)table_base)->comefrom
-                               = 0xeeeeeeec;
+               tb_comefrom = 0xeeeeeeec;
 #endif
-                       verdict = t->u.kernel.target->target(skb, &tgpar);
+               verdict = t->u.kernel.target->target(skb, &tgpar);
 #ifdef CONFIG_NETFILTER_DEBUG
-                       if (((struct ipt_entry *)table_base)->comefrom
-                           != 0xeeeeeeec
-                           && verdict == IPT_CONTINUE) {
-                               printk("Target %s reentered!\n",
-                                      t->u.kernel.target->name);
-                               verdict = NF_DROP;
-                       }
-                       ((struct ipt_entry *)table_base)->comefrom
-                               = 0x57acc001;
-#endif
-                       /* Target might have changed stuff. */
-                       ip = ip_hdr(skb);
-                       datalen = skb->len - ip->ihl * 4;
-
-                       if (verdict == IPT_CONTINUE)
-                               e = ipt_next_entry(e);
-                       else
-                               /* Verdict */
-                               break;
+               if (tb_comefrom != 0xeeeeeeec && verdict == IPT_CONTINUE) {
+                       printk("Target %s reentered!\n",
+                              t->u.kernel.target->name);
+                       verdict = NF_DROP;
                }
+               tb_comefrom = 0x57acc001;
+#endif
+               /* Target might have changed stuff. */
+               ip = ip_hdr(skb);
+               if (verdict == IPT_CONTINUE)
+                       e = ipt_next_entry(e);
+               else
+                       /* Verdict */
+                       break;
        } while (!hotdrop);
        xt_info_rdunlock_bh();
 
@@ -443,6 +436,8 @@ ipt_do_table(struct sk_buff *skb,
                return NF_DROP;
        else return verdict;
 #endif
+
+#undef tb_comefrom
 }
 
 /* Figures out from what hook each rule can be called: returns 0 if
@@ -478,11 +473,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                        e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                        /* Unconditional return/END. */
-                       if ((e->target_offset == sizeof(struct ipt_entry)
-                           && (strcmp(t->target.u.user.name,
-                                      IPT_STANDARD_TARGET) == 0)
-                           && t->verdict < 0
-                           && unconditional(&e->ip)) || visited) {
+                       if ((e->target_offset == sizeof(struct ipt_entry) &&
+                            (strcmp(t->target.u.user.name,
+                                    IPT_STANDARD_TARGET) == 0) &&
+                            t->verdict < 0 && unconditional(&e->ip)) ||
+                           visited) {
                                unsigned int oldpos, size;
 
                                if ((strcmp(t->target.u.user.name,
@@ -529,8 +524,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                int newpos = t->verdict;
 
                                if (strcmp(t->target.u.user.name,
-                                          IPT_STANDARD_TARGET) == 0
-                                   && newpos >= 0) {
+                                          IPT_STANDARD_TARGET) == 0 &&
+                                   newpos >= 0) {
                                        if (newpos > newinfo->size -
                                                sizeof(struct ipt_entry)) {
                                                duprintf("mark_source_chains: "
@@ -666,8 +661,8 @@ static int check_target(struct ipt_entry *e, const char *name)
 }
 
 static int
-find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
-                unsigned int *i)
+find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
+                unsigned int size, unsigned int *i)
 {
        struct ipt_entry_target *t;
        struct xt_target *target;
@@ -680,6 +675,7 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
                return ret;
 
        j = 0;
+       mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
        mtpar.hook_mask = e->comefrom;
@@ -713,6 +709,21 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
        return ret;
 }
 
+static bool check_underflow(struct ipt_entry *e)
+{
+       const struct ipt_entry_target *t;
+       unsigned int verdict;
+
+       if (!unconditional(&e->ip))
+               return false;
+       t = ipt_get_target(e);
+       if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+               return false;
+       verdict = ((struct ipt_standard_target *)t)->verdict;
+       verdict = -verdict - 1;
+       return verdict == NF_DROP || verdict == NF_ACCEPT;
+}
+
 static int
 check_entry_size_and_hooks(struct ipt_entry *e,
                           struct xt_table_info *newinfo,
@@ -720,12 +731,13 @@ check_entry_size_and_hooks(struct ipt_entry *e,
                           unsigned char *limit,
                           const unsigned int *hook_entries,
                           const unsigned int *underflows,
+                          unsigned int valid_hooks,
                           unsigned int *i)
 {
        unsigned int h;
 
-       if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
-           || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+       if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
+           (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
                duprintf("Bad offset %p\n", e);
                return -EINVAL;
        }
@@ -739,15 +751,21 @@ check_entry_size_and_hooks(struct ipt_entry *e,
 
        /* Check hooks & underflows */
        for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+               if (!(valid_hooks & (1 << h)))
+                       continue;
                if ((unsigned char *)e - base == hook_entries[h])
                        newinfo->hook_entry[h] = hook_entries[h];
-               if ((unsigned char *)e - base == underflows[h])
+               if ((unsigned char *)e - base == underflows[h]) {
+                       if (!check_underflow(e)) {
+                               pr_err("Underflows must be unconditional and "
+                                      "use the STANDARD target with "
+                                      "ACCEPT/DROP\n");
+                               return -EINVAL;
+                       }
                        newinfo->underflow[h] = underflows[h];
+               }
        }
 
-       /* FIXME: underflows must be unconditional, standard verdicts
-          < 0 (not IPT_RETURN). --RR */
-
        /* Clear counters and comefrom */
        e->counters = ((struct xt_counters) { 0, 0 });
        e->comefrom = 0;
@@ -781,7 +799,8 @@ cleanup_entry(struct ipt_entry *e, unsigned int *i)
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
-translate_table(const char *name,
+translate_table(struct net *net,
+               const char *name,
                unsigned int valid_hooks,
                struct xt_table_info *newinfo,
                void *entry0,
@@ -810,7 +829,7 @@ translate_table(const char *name,
                                newinfo,
                                entry0,
                                entry0 + size,
-                               hook_entries, underflows, &i);
+                               hook_entries, underflows, valid_hooks, &i);
        if (ret != 0)
                return ret;
 
@@ -843,7 +862,7 @@ translate_table(const char *name,
        /* Finally, each sanity check must pass */
        i = 0;
        ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                               find_check_entry, name, size, &i);
+                               find_check_entry, net, name, size, &i);
 
        if (ret != 0) {
                IPT_ENTRY_ITERATE(entry0, newinfo->size,
@@ -1286,7 +1305,7 @@ do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
 
-       ret = translate_table(tmp.name, tmp.valid_hooks,
+       ret = translate_table(net, tmp.name, tmp.valid_hooks,
                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
                              tmp.hook_entry, tmp.underflow);
        if (ret != 0)
@@ -1531,8 +1550,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
        int ret, off, h;
 
        duprintf("check_compat_entry_size_and_hooks %p\n", e);
-       if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
-           || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+       if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
+           (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
                duprintf("Bad offset %p, limit = %p\n", e, limit);
                return -EINVAL;
        }
@@ -1638,7 +1657,7 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
 }
 
 static int
-compat_check_entry(struct ipt_entry *e, const char *name,
+compat_check_entry(struct ipt_entry *e, struct net *net, const char *name,
                                     unsigned int *i)
 {
        struct xt_mtchk_param mtpar;
@@ -1646,6 +1665,7 @@ compat_check_entry(struct ipt_entry *e, const char *name,
        int ret;
 
        j = 0;
+       mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
        mtpar.hook_mask = e->comefrom;
@@ -1667,7 +1687,8 @@ compat_check_entry(struct ipt_entry *e, const char *name,
 }
 
 static int
-translate_compat_table(const char *name,
+translate_compat_table(struct net *net,
+                      const char *name,
                       unsigned int valid_hooks,
                       struct xt_table_info **pinfo,
                       void **pentry0,
@@ -1756,7 +1777,7 @@ translate_compat_table(const char *name,
 
        i = 0;
        ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                               name, &i);
+                               net, name, &i);
        if (ret) {
                j -= i;
                COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
@@ -1816,7 +1837,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
 
-       ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+       ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
                                     &newinfo, &loc_cpu_entry, tmp.size,
                                     tmp.num_entries, tmp.hook_entry,
                                     tmp.underflow);
@@ -2048,7 +2069,8 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        return ret;
 }
 
-struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
+struct xt_table *ipt_register_table(struct net *net,
+                                   const struct xt_table *table,
                                    const struct ipt_replace *repl)
 {
        int ret;
@@ -2068,7 +2090,7 @@ struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
        loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
        memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-       ret = translate_table(table->name, table->valid_hooks,
+       ret = translate_table(net, table->name, table->valid_hooks,
                              newinfo, loc_cpu_entry, repl->size,
                              repl->num_entries,
                              repl->hook_entry,