Skip to content

Commit

Permalink
[NETFILTER]: Convert x_tables matches/targets to centralized error ch…
Browse files Browse the repository at this point in the history 
…ecking

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Patrick McHardy authored and David S. Miller committed Mar 21, 2006
1 parent 7f93971 commit 5d04bff
Show file tree
Hide file tree
Showing 23 changed files with 167 additions and 511 deletions.
41 changes: 8 additions & 33 deletions net/netfilter/xt_CLASSIFY.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,47 +39,22 @@ target(struct sk_buff **pskb,
return XT_CONTINUE;
}

static int
checkentry(const char *tablename,
const void *e,
void *targinfo,
unsigned int targinfosize,
unsigned int hook_mask)
{
if (targinfosize != XT_ALIGN(sizeof(struct xt_classify_target_info))){
printk(KERN_ERR "CLASSIFY: invalid size (%u != %Zu).\n",
targinfosize,
XT_ALIGN(sizeof(struct xt_classify_target_info)));
return 0;
}

if (hook_mask & ~((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
(1 << NF_IP_POST_ROUTING))) {
printk(KERN_ERR "CLASSIFY: only valid in LOCAL_OUT, FORWARD "
"and POST_ROUTING.\n");
return 0;
}

if (strcmp(tablename, "mangle") != 0) {
printk(KERN_ERR "CLASSIFY: can only be called from "
"\"mangle\" table, not \"%s\".\n",
tablename);
return 0;
}

return 1;
}

static struct xt_target classify_reg = {
.name = "CLASSIFY",
.target = target,
.checkentry = checkentry,
.targetsize = sizeof(struct xt_classify_target_info),
.table = "mangle",
.hooks = (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
(1 << NF_IP_POST_ROUTING),
.me = THIS_MODULE,
};
static struct xt_target classify6_reg = {
.name = "CLASSIFY",
.target = target,
.checkentry = checkentry,
.targetsize = sizeof(struct xt_classify_target_info),
.table = "mangle",
.hooks = (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
(1 << NF_IP_POST_ROUTING),
.me = THIS_MODULE,
};

Expand Down
25 changes: 11 additions & 14 deletions net/netfilter/xt_CONNMARK.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,12 +79,6 @@ checkentry(const char *tablename,
unsigned int hook_mask)
{
struct xt_connmark_target_info *matchinfo = targinfo;
if (targinfosize != XT_ALIGN(sizeof(struct xt_connmark_target_info))) {
printk(KERN_WARNING "CONNMARK: targinfosize %u != %Zu\n",
targinfosize,
XT_ALIGN(sizeof(struct xt_connmark_target_info)));
return 0;
}

if (matchinfo->mode == XT_CONNMARK_RESTORE) {
if (strcmp(tablename, "mangle") != 0) {
Expand All @@ -102,16 +96,19 @@ checkentry(const char *tablename,
}

static struct xt_target connmark_reg = {
.name = "CONNMARK",
.target = &target,
.checkentry = &checkentry,
.me = THIS_MODULE
.name = "CONNMARK",
.target = target,
.targetsize = sizeof(struct xt_connmark_target_info),
.checkentry = checkentry,
.me = THIS_MODULE
};

static struct xt_target connmark6_reg = {
.name = "CONNMARK",
.target = &target,
.checkentry = &checkentry,
.me = THIS_MODULE
.name = "CONNMARK",
.target = target,
.targetsize = sizeof(struct xt_connmark_target_info),
.checkentry = checkentry,
.me = THIS_MODULE
};

static int __init init(void)
Expand Down
33 changes: 6 additions & 27 deletions net/netfilter/xt_MARK.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,23 +78,10 @@ checkentry_v0(const char *tablename,
{
struct xt_mark_target_info *markinfo = targinfo;

if (targinfosize != XT_ALIGN(sizeof(struct xt_mark_target_info))) {
printk(KERN_WARNING "MARK: targinfosize %u != %Zu\n",
targinfosize,
XT_ALIGN(sizeof(struct xt_mark_target_info)));
return 0;
}

if (strcmp(tablename, "mangle") != 0) {
printk(KERN_WARNING "MARK: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
return 0;
}

if (markinfo->mark > 0xffffffff) {
printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
return 0;
}

return 1;
}

Expand All @@ -107,37 +94,25 @@ checkentry_v1(const char *tablename,
{
struct xt_mark_target_info_v1 *markinfo = targinfo;

if (targinfosize != XT_ALIGN(sizeof(struct xt_mark_target_info_v1))){
printk(KERN_WARNING "MARK: targinfosize %u != %Zu\n",
targinfosize,
XT_ALIGN(sizeof(struct xt_mark_target_info_v1)));
return 0;
}

if (strcmp(tablename, "mangle") != 0) {
printk(KERN_WARNING "MARK: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
return 0;
}

if (markinfo->mode != XT_MARK_SET
&& markinfo->mode != XT_MARK_AND
&& markinfo->mode != XT_MARK_OR) {
printk(KERN_WARNING "MARK: unknown mode %u\n",
markinfo->mode);
return 0;
}

if (markinfo->mark > 0xffffffff) {
printk(KERN_WARNING "MARK: Only supports 32bit wide mark\n");
return 0;
}

return 1;
}

static struct xt_target ipt_mark_reg_v0 = {
.name = "MARK",
.target = target_v0,
.targetsize = sizeof(struct xt_mark_target_info),
.table = "mangle",
.checkentry = checkentry_v0,
.me = THIS_MODULE,
.revision = 0,
Expand All @@ -146,6 +121,8 @@ static struct xt_target ipt_mark_reg_v0 = {
static struct xt_target ipt_mark_reg_v1 = {
.name = "MARK",
.target = target_v1,
.targetsize = sizeof(struct xt_mark_target_info_v1),
.table = "mangle",
.checkentry = checkentry_v1,
.me = THIS_MODULE,
.revision = 1,
Expand All @@ -154,6 +131,8 @@ static struct xt_target ipt_mark_reg_v1 = {
static struct xt_target ip6t_mark_reg_v0 = {
.name = "MARK",
.target = target_v0,
.targetsize = sizeof(struct xt_mark_target_info),
.table = "mangle",
.checkentry = checkentry_v0,
.me = THIS_MODULE,
.revision = 0,
Expand Down
23 changes: 3 additions & 20 deletions net/netfilter/xt_NFQUEUE.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,41 +36,24 @@ target(struct sk_buff **pskb,
return NF_QUEUE_NR(tinfo->queuenum);
}

static int
checkentry(const char *tablename,
const void *entry,
void *targinfo,
unsigned int targinfosize,
unsigned int hook_mask)
{
if (targinfosize != XT_ALIGN(sizeof(struct xt_NFQ_info))) {
printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n",
targinfosize,
XT_ALIGN(sizeof(struct xt_NFQ_info)));
return 0;
}

return 1;
}

static struct xt_target ipt_NFQ_reg = {
.name = "NFQUEUE",
.target = target,
.checkentry = checkentry,
.targetsize = sizeof(struct xt_NFQ_info),
.me = THIS_MODULE,
};

static struct xt_target ip6t_NFQ_reg = {
.name = "NFQUEUE",
.target = target,
.checkentry = checkentry,
.targetsize = sizeof(struct xt_NFQ_info),
.me = THIS_MODULE,
};

static struct xt_target arpt_NFQ_reg = {
.name = "NFQUEUE",
.target = target,
.checkentry = checkentry,
.targetsize = sizeof(struct xt_NFQ_info),
.me = THIS_MODULE,
};

Expand Down
44 changes: 13 additions & 31 deletions net/netfilter/xt_NOTRACK.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,38 +33,20 @@ target(struct sk_buff **pskb,
return XT_CONTINUE;
}

static int
checkentry(const char *tablename,
const void *entry,
void *targinfo,
unsigned int targinfosize,
unsigned int hook_mask)
{
if (targinfosize != 0) {
printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
targinfosize);
return 0;
}

if (strcmp(tablename, "raw") != 0) {
printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
return 0;
}

return 1;
}

static struct xt_target notrack_reg = {
.name = "NOTRACK",
.target = target,
.checkentry = checkentry,
.me = THIS_MODULE,
static struct xt_target notrack_reg = {
.name = "NOTRACK",
.target = target,
.targetsize = 0,
.table = "raw",
.me = THIS_MODULE,
};
static struct xt_target notrack6_reg = {
.name = "NOTRACK",
.target = target,
.checkentry = checkentry,
.me = THIS_MODULE,

static struct xt_target notrack6_reg = {
.name = "NOTRACK",
.target = target,
.targetsize = 0,
.table = "raw",
.me = THIS_MODULE,
};

static int __init init(void)
Expand Down
17 changes: 2 additions & 15 deletions net/netfilter/xt_comment.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,30 +28,17 @@ match(const struct sk_buff *skb,
return 1;
}

static int
checkentry(const char *tablename,
const void *ip,
void *matchinfo,
unsigned int matchsize,
unsigned int hook_mask)
{
/* Check the size */
if (matchsize != XT_ALIGN(sizeof(struct xt_comment_info)))
return 0;
return 1;
}

static struct xt_match comment_match = {
.name = "comment",
.match = match,
.checkentry = checkentry,
.matchsize = sizeof(struct xt_comment_info),
.me = THIS_MODULE
};

static struct xt_match comment6_match = {
.name = "comment",
.match = match,
.checkentry = checkentry,
.matchsize = sizeof(struct xt_comment_info),
.me = THIS_MODULE
};

Expand Down
13 changes: 6 additions & 7 deletions net/netfilter/xt_connbytes.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -128,9 +128,6 @@ static int check(const char *tablename,
{
const struct xt_connbytes_info *sinfo = matchinfo;

if (matchsize != XT_ALIGN(sizeof(struct xt_connbytes_info)))
return 0;

if (sinfo->what != XT_CONNBYTES_PKTS &&
sinfo->what != XT_CONNBYTES_BYTES &&
sinfo->what != XT_CONNBYTES_AVGPKT)
Expand All @@ -146,14 +143,16 @@ static int check(const char *tablename,

static struct xt_match connbytes_match = {
.name = "connbytes",
.match = &match,
.checkentry = &check,
.match = match,
.checkentry = check,
.matchsize = sizeof(struct xt_connbytes_info),
.me = THIS_MODULE
};
static struct xt_match connbytes6_match = {
.name = "connbytes",
.match = &match,
.checkentry = &check,
.match = match,
.checkentry = check,
.matchsize = sizeof(struct xt_connbytes_info),
.me = THIS_MODULE
};

Expand Down
26 changes: 12 additions & 14 deletions net/netfilter/xt_connmark.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,33 +56,31 @@ checkentry(const char *tablename,
unsigned int matchsize,
unsigned int hook_mask)
{
struct xt_connmark_info *cm =
(struct xt_connmark_info *)matchinfo;
if (matchsize != XT_ALIGN(sizeof(struct xt_connmark_info)))
return 0;
struct xt_connmark_info *cm = (struct xt_connmark_info *)matchinfo;

if (cm->mark > 0xffffffff || cm->mask > 0xffffffff) {
printk(KERN_WARNING "connmark: only support 32bit mark\n");
return 0;
}

return 1;
}

static struct xt_match connmark_match = {
.name = "connmark",
.match = &match,
.checkentry = &checkentry,
.me = THIS_MODULE
.name = "connmark",
.match = match,
.matchsize = sizeof(struct xt_connmark_info),
.checkentry = checkentry,
.me = THIS_MODULE
};

static struct xt_match connmark6_match = {
.name = "connmark",
.match = &match,
.checkentry = &checkentry,
.me = THIS_MODULE
.name = "connmark",
.match = match,
.matchsize = sizeof(struct xt_connmark_info),
.checkentry = checkentry,
.me = THIS_MODULE
};


static int __init init(void)
{
int ret;
Expand Down
Loading

0 comments on commit 5d04bff

Please sign in to comment.