Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37f9f733 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETFILTER]: xt_tables: add centralized error checking 



Introduce new functions for common match/target checks (private data
size, valid hooks, valid tables and valid protocols) to get more consistent
error reporting and to avoid each module duplicating them.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6ea46c9c

include/linux/netfilter/x_tables.h

+19 −4
Original line number Diff line number Diff line
@@ -92,8 +92,6 @@ struct xt_match 


	const char name[XT_FUNCTION_MAXNAMELEN-1];



	u_int8_t revision;



	/* Return true or false: return FALSE and set *hotdrop = 1 to

           force immediate packet drop. */

	/* Arguments changed since 2.6.9, as this must now handle
@@ -120,6 +118,12 @@ struct xt_match 


	/* Set this to THIS_MODULE if you are a module, otherwise NULL */

	struct module *me;



	char *table;

	unsigned int matchsize;

	unsigned int hooks;

	unsigned short proto;

	u_int8_t revision;

};



/* Registration hooks for targets. */
@@ -129,8 +133,6 @@ struct xt_target 


	const char name[XT_FUNCTION_MAXNAMELEN-1];



	u_int8_t revision;



	/* Returns verdict. Argument order changed since 2.6.9, as this

	   must now handle non-linear skbs, using skb_copy_bits and

	   skb_ip_make_writable. */
@@ -156,6 +158,12 @@ struct xt_target 


	/* Set this to THIS_MODULE if you are a module, otherwise NULL */

	struct module *me;



	char *table;

	unsigned int targetsize;

	unsigned int hooks;

	unsigned short proto;

	u_int8_t revision;

};



/* Furniture shopping... */
@@ -207,6 +215,13 @@ extern void xt_unregister_target(int af, struct xt_target *target); 
extern int xt_register_match(int af, struct xt_match *target);

extern void xt_unregister_match(int af, struct xt_match *target);



extern int xt_check_match(const struct xt_match *match, unsigned short family,

			  unsigned int size, const char *table, unsigned int hook,

			  unsigned short proto, int inv_proto);

extern int xt_check_target(const struct xt_target *target, unsigned short family,

			   unsigned int size, const char *table, unsigned int hook,

			   unsigned short proto, int inv_proto);



extern int xt_register_table(struct xt_table *table,

			     struct xt_table_info *bootstrap,

			     struct xt_table_info *newinfo);

net/netfilter/x_tables.c

+65 −7
Original line number Diff line number Diff line
@@ -52,6 +52,12 @@ enum { 
	MATCH,

};



static const char *xt_prefix[NPROTO] = {

	[AF_INET] 	= "ip",

	[AF_INET6] 	= "ip6",

	[NF_ARP]	= "arp",

};



/* Registration hooks for targets. */

int

xt_register_target(int af, struct xt_target *target)
@@ -158,18 +164,12 @@ struct xt_target *xt_find_target(int af, const char *name, u8 revision) 
}

EXPORT_SYMBOL(xt_find_target);



static const char *xt_prefix[NPROTO] = {

	[AF_INET] 	= "ipt_%s",

	[AF_INET6] 	= "ip6t_%s",

	[NF_ARP]	= "arpt_%s",

};



struct xt_target *xt_request_find_target(int af, const char *name, u8 revision)

{

	struct xt_target *target;



	target = try_then_request_module(xt_find_target(af, name, revision),

					 xt_prefix[af], name);

					 "%st_%s", xt_prefix[af], name);

	if (IS_ERR(target) || !target)

		return NULL;

	return target;
@@ -237,6 +237,64 @@ int xt_find_revision(int af, const char *name, u8 revision, int target, 
}

EXPORT_SYMBOL_GPL(xt_find_revision);



int xt_check_match(const struct xt_match *match, unsigned short family,

                   unsigned int size, const char *table, unsigned int hook_mask,

		   unsigned short proto, int inv_proto)

{

	if (XT_ALIGN(match->matchsize) != size) {

		printk("%s_tables: %s match: invalid size %Zu != %u\n",

		       xt_prefix[family], match->name,

		       XT_ALIGN(match->matchsize), size);

		return -EINVAL;

	}

	if (match->table && strcmp(match->table, table)) {

		printk("%s_tables: %s match: only valid in %s table, not %s\n",

		       xt_prefix[family], match->name, match->table, table);

		return -EINVAL;

	}

	if (match->hooks && (hook_mask & ~match->hooks) != 0) {

		printk("%s_tables: %s match: bad hook_mask %u\n",

		       xt_prefix[family], match->name, hook_mask);

		return -EINVAL;

	}

	if (match->proto && (match->proto != proto || inv_proto)) {

		printk("%s_tables: %s match: only valid for protocol %u\n",

		       xt_prefix[family], match->name, match->proto);

		return -EINVAL;

	}

	return 0;

}

EXPORT_SYMBOL_GPL(xt_check_match);



int xt_check_target(const struct xt_target *target, unsigned short family,

		    unsigned int size, const char *table, unsigned int hook_mask,

		    unsigned short proto, int inv_proto)

{

	if (XT_ALIGN(target->targetsize) != size) {

		printk("%s_tables: %s target: invalid size %Zu != %u\n",

		       xt_prefix[family], target->name,

		       XT_ALIGN(target->targetsize), size);

		return -EINVAL;

	}

	if (target->table && strcmp(target->table, table)) {

		printk("%s_tables: %s target: only valid in %s table, not %s\n",

		       xt_prefix[family], target->name, target->table, table);

		return -EINVAL;

	}

	if (target->hooks && (hook_mask & ~target->hooks) != 0) {

		printk("%s_tables: %s target: bad hook_mask %u\n",

		       xt_prefix[family], target->name, hook_mask);

		return -EINVAL;

	}

	if (target->proto && (target->proto != proto || inv_proto)) {

		printk("%s_tables: %s target: only valid for protocol %u\n",

		       xt_prefix[family], target->name, target->proto);

		return -EINVAL;

	}

	return 0;

}

EXPORT_SYMBOL_GPL(xt_check_target);



struct xt_table_info *xt_alloc_table_info(unsigned int size)

{

	struct xt_table_info *newinfo;