Skip to content

Commit

Permalink
[NETFILTER]: Convert ip_tables matches/targets to centralized error c…
Browse files Browse the repository at this point in the history 
…hecking

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Patrick McHardy authored and David S. Miller committed Mar 21, 2006
1 parent 3cdc7c9 commit 1d5cd90
Show file tree
Hide file tree
Showing 28 changed files with 103 additions and 390 deletions.
41 changes: 6 additions & 35 deletions net/ipv4/netfilter/ip_nat_rule.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -181,23 +181,6 @@ static int ipt_snat_checkentry(const char *tablename,
printk("SNAT: multiple ranges no longer supported\n");
return 0;
}

if (targinfosize != IPT_ALIGN(sizeof(struct ip_nat_multi_range_compat))) {
DEBUGP("SNAT: Target size %u wrong for %u ranges\n",
targinfosize, mr->rangesize);
return 0;
}

/* Only allow these for NAT. */
if (strcmp(tablename, "nat") != 0) {
DEBUGP("SNAT: wrong table %s\n", tablename);
return 0;
}

if (hook_mask & ~(1 << NF_IP_POST_ROUTING)) {
DEBUGP("SNAT: hook mask 0x%x bad\n", hook_mask);
return 0;
}
return 1;
}

Expand All @@ -214,24 +197,6 @@ static int ipt_dnat_checkentry(const char *tablename,
printk("DNAT: multiple ranges no longer supported\n");
return 0;
}

if (targinfosize != IPT_ALIGN(sizeof(struct ip_nat_multi_range_compat))) {
DEBUGP("DNAT: Target size %u wrong for %u ranges\n",
targinfosize, mr->rangesize);
return 0;
}

/* Only allow these for NAT. */
if (strcmp(tablename, "nat") != 0) {
DEBUGP("DNAT: wrong table %s\n", tablename);
return 0;
}

if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))) {
DEBUGP("DNAT: hook mask 0x%x bad\n", hook_mask);
return 0;
}

return 1;
}

Expand Down Expand Up @@ -299,12 +264,18 @@ int ip_nat_rule_find(struct sk_buff **pskb,
static struct ipt_target ipt_snat_reg = {
.name = "SNAT",
.target = ipt_snat_target,
.targetsize = sizeof(struct ip_nat_multi_range_compat),
.table = "nat",
.hooks = 1 << NF_IP_POST_ROUTING,
.checkentry = ipt_snat_checkentry,
};

static struct ipt_target ipt_dnat_reg = {
.name = "DNAT",
.target = ipt_dnat_target,
.targetsize = sizeof(struct ip_nat_multi_range_compat),
.table = "nat",
.hooks = 1 << NF_IP_PRE_ROUTING,
.checkentry = ipt_dnat_checkentry,
};

Expand Down
25 changes: 8 additions & 17 deletions net/ipv4/netfilter/ip_tables.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -477,21 +477,12 @@ standard_check(const struct ipt_entry_target *t,
struct ipt_standard_target *targ = (void *)t;

/* Check standard info. */
if (t->u.target_size
!= IPT_ALIGN(sizeof(struct ipt_standard_target))) {
duprintf("standard_check: target size %u != %u\n",
t->u.target_size,
IPT_ALIGN(sizeof(struct ipt_standard_target)));
return 0;
}

if (targ->verdict >= 0
&& targ->verdict > max_offset - sizeof(struct ipt_entry)) {
duprintf("ipt_standard_check: bad verdict (%i)\n",
targ->verdict);
return 0;
}

if (targ->verdict < -NF_MAX_VERDICT - 1) {
duprintf("ipt_standard_check: bad negative verdict (%i)\n",
targ->verdict);
Expand Down Expand Up @@ -1330,24 +1321,22 @@ icmp_checkentry(const char *tablename,
unsigned int matchsize,
unsigned int hook_mask)
{
const struct ipt_ip *ip = info;
const struct ipt_icmp *icmpinfo = matchinfo;

/* Must specify proto == ICMP, and no unknown invflags */
return ip->proto == IPPROTO_ICMP
&& !(ip->invflags & IPT_INV_PROTO)
&& matchsize == IPT_ALIGN(sizeof(struct ipt_icmp))
&& !(icmpinfo->invflags & ~IPT_ICMP_INV);
/* Must specify no unknown invflags */
return !(icmpinfo->invflags & ~IPT_ICMP_INV);
}

/* The built-in targets: standard (NULL) and error. */
static struct ipt_target ipt_standard_target = {
.name = IPT_STANDARD_TARGET,
.targetsize = sizeof(int),
};

static struct ipt_target ipt_error_target = {
.name = IPT_ERROR_TARGET,
.target = ipt_error,
.targetsize = IPT_FUNCTION_MAXNAMELEN,
};

static struct nf_sockopt_ops ipt_sockopts = {
Expand All @@ -1362,8 +1351,10 @@ static struct nf_sockopt_ops ipt_sockopts = {

static struct ipt_match icmp_matchstruct = {
.name = "icmp",
.match = &icmp_match,
.checkentry = &icmp_checkentry,
.match = icmp_match,
.matchsize = sizeof(struct ipt_icmp),
.proto = IPPROTO_ICMP,
.checkentry = icmp_checkentry,
};

static int __init init(void)
Expand Down
20 changes: 7 additions & 13 deletions net/ipv4/netfilter/ipt_CLUSTERIP.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -389,13 +389,6 @@ checkentry(const char *tablename,

struct clusterip_config *config;

if (targinfosize != IPT_ALIGN(sizeof(struct ipt_clusterip_tgt_info))) {
printk(KERN_WARNING "CLUSTERIP: targinfosize %u != %Zu\n",
targinfosize,
IPT_ALIGN(sizeof(struct ipt_clusterip_tgt_info)));
return 0;
}

if (cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP &&
cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT &&
cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT_DPT) {
Expand Down Expand Up @@ -476,12 +469,13 @@ static void destroy(void *matchinfo, unsigned int matchinfosize)
clusterip_config_put(cipinfo->config);
}

static struct ipt_target clusterip_tgt = {
.name = "CLUSTERIP",
.target = &target,
.checkentry = &checkentry,
.destroy = &destroy,
.me = THIS_MODULE
static struct ipt_target clusterip_tgt = {
.name = "CLUSTERIP",
.target = target,
.targetsize = sizeof(struct ipt_clusterip_tgt_info),
.checkentry = checkentry,
.destroy = destroy,
.me = THIS_MODULE
};


Expand Down
15 changes: 2 additions & 13 deletions net/ipv4/netfilter/ipt_DSCP.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,29 +64,18 @@ checkentry(const char *tablename,
{
const u_int8_t dscp = ((struct ipt_DSCP_info *)targinfo)->dscp;

if (targinfosize != IPT_ALIGN(sizeof(struct ipt_DSCP_info))) {
printk(KERN_WARNING "DSCP: targinfosize %u != %Zu\n",
targinfosize,
IPT_ALIGN(sizeof(struct ipt_DSCP_info)));
return 0;
}

if (strcmp(tablename, "mangle") != 0) {
printk(KERN_WARNING "DSCP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
return 0;
}

if ((dscp > IPT_DSCP_MAX)) {
printk(KERN_WARNING "DSCP: dscp %x out of range\n", dscp);
return 0;
}

return 1;
}

static struct ipt_target ipt_dscp_reg = {
.name = "DSCP",
.target = target,
.targetsize = sizeof(struct ipt_DSCP_info),
.table = "mangle",
.checkentry = checkentry,
.me = THIS_MODULE,
};
Expand Down
16 changes: 2 additions & 14 deletions net/ipv4/netfilter/ipt_ECN.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -121,18 +121,6 @@ checkentry(const char *tablename,
const struct ipt_ECN_info *einfo = (struct ipt_ECN_info *)targinfo;
const struct ipt_entry *e = e_void;

if (targinfosize != IPT_ALIGN(sizeof(struct ipt_ECN_info))) {
printk(KERN_WARNING "ECN: targinfosize %u != %Zu\n",
targinfosize,
IPT_ALIGN(sizeof(struct ipt_ECN_info)));
return 0;
}

if (strcmp(tablename, "mangle") != 0) {
printk(KERN_WARNING "ECN: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
return 0;
}

if (einfo->operation & IPT_ECN_OP_MASK) {
printk(KERN_WARNING "ECN: unsupported ECN operation %x\n",
einfo->operation);
Expand All @@ -143,20 +131,20 @@ checkentry(const char *tablename,
einfo->ip_ect);
return 0;
}

if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR))
&& (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & IPT_INV_PROTO))) {
printk(KERN_WARNING "ECN: cannot use TCP operations on a "
"non-tcp rule\n");
return 0;
}

return 1;
}

static struct ipt_target ipt_ecn_reg = {
.name = "ECN",
.target = target,
.targetsize = sizeof(struct ipt_ECN_info),
.table = "mangle",
.checkentry = checkentry,
.me = THIS_MODULE,
};
Expand Down
9 changes: 1 addition & 8 deletions net/ipv4/netfilter/ipt_LOG.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -443,29 +443,22 @@ static int ipt_log_checkentry(const char *tablename,
{
const struct ipt_log_info *loginfo = targinfo;

if (targinfosize != IPT_ALIGN(sizeof(struct ipt_log_info))) {
DEBUGP("LOG: targinfosize %u != %u\n",
targinfosize, IPT_ALIGN(sizeof(struct ipt_log_info)));
return 0;
}

if (loginfo->level >= 8) {
DEBUGP("LOG: level %u >= 8\n", loginfo->level);
return 0;
}

if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
DEBUGP("LOG: prefix term %i\n",
loginfo->prefix[sizeof(loginfo->prefix)-1]);
return 0;
}

return 1;
}

static struct ipt_target ipt_log_reg = {
.name = "LOG",
.target = ipt_log_target,
.targetsize = sizeof(struct ipt_log_info),
.checkentry = ipt_log_checkentry,
.me = THIS_MODULE,
};
Expand Down
16 changes: 3 additions & 13 deletions net/ipv4/netfilter/ipt_MASQUERADE.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,19 +47,6 @@ masquerade_check(const char *tablename,
{
const struct ip_nat_multi_range_compat *mr = targinfo;

if (strcmp(tablename, "nat") != 0) {
DEBUGP("masquerade_check: bad table `%s'.\n", tablename);
return 0;
}
if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
DEBUGP("masquerade_check: size %u != %u.\n",
targinfosize, sizeof(*mr));
return 0;
}
if (hook_mask & ~(1 << NF_IP_POST_ROUTING)) {
DEBUGP("masquerade_check: bad hooks %x.\n", hook_mask);
return 0;
}
if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
DEBUGP("masquerade_check: bad MAP_IPS.\n");
return 0;
Expand Down Expand Up @@ -179,6 +166,9 @@ static struct notifier_block masq_inet_notifier = {
static struct ipt_target masquerade = {
.name = "MASQUERADE",
.target = masquerade_target,
.targetsize = sizeof(struct ip_nat_multi_range_compat),
.table = "nat",
.hooks = 1 << NF_IP_POST_ROUTING,
.checkentry = masquerade_check,
.me = THIS_MODULE,
};
Expand Down
17 changes: 4 additions & 13 deletions net/ipv4/netfilter/ipt_NETMAP.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,6 @@ check(const char *tablename,
{
const struct ip_nat_multi_range_compat *mr = targinfo;

if (strcmp(tablename, "nat") != 0) {
DEBUGP(MODULENAME":check: bad table `%s'.\n", tablename);
return 0;
}
if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
DEBUGP(MODULENAME":check: size %u.\n", targinfosize);
return 0;
}
if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING) |
(1 << NF_IP_LOCAL_OUT))) {
DEBUGP(MODULENAME":check: bad hooks %x.\n", hook_mask);
return 0;
}
if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
DEBUGP(MODULENAME":check: bad MAP_IPS.\n");
return 0;
Expand Down Expand Up @@ -101,6 +88,10 @@ target(struct sk_buff **pskb,
static struct ipt_target target_module = {
.name = MODULENAME,
.target = target,
.targetsize = sizeof(struct ip_nat_multi_range_compat),
.table = "nat",
.hooks = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING) |
(1 << NF_IP_LOCAL_OUT),
.checkentry = check,
.me = THIS_MODULE
};
Expand Down
15 changes: 3 additions & 12 deletions net/ipv4/netfilter/ipt_REDIRECT.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,18 +40,6 @@ redirect_check(const char *tablename,
{
const struct ip_nat_multi_range_compat *mr = targinfo;

if (strcmp(tablename, "nat") != 0) {
DEBUGP("redirect_check: bad table `%s'.\n", table);
return 0;
}
if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
DEBUGP("redirect_check: size %u.\n", targinfosize);
return 0;
}
if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))) {
DEBUGP("redirect_check: bad hooks %x.\n", hook_mask);
return 0;
}
if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
DEBUGP("redirect_check: bad MAP_IPS.\n");
return 0;
Expand Down Expand Up @@ -115,6 +103,9 @@ redirect_target(struct sk_buff **pskb,
static struct ipt_target redirect_reg = {
.name = "REDIRECT",
.target = redirect_target,
.targetsize = sizeof(struct ip_nat_multi_range_compat),
.table = "nat",
.hooks = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT),
.checkentry = redirect_check,
.me = THIS_MODULE,
};
Expand Down
Loading

0 comments on commit 1d5cd90

Please sign in to comment.