/* * Packet matching code for ARP packets. * * Based heavily, if not almost entirely, upon ip_tables.c framework. * * Some ARP specific bits are: * * Copyright (C) 2002 David S. Miller (davem@redhat.com) * */#include <linux/config.h>#include <linux/kernel.h>#include <linux/skbuff.h>#include <linux/netdevice.h>#include <linux/if_arp.h>#include <linux/kmod.h>#include <linux/vmalloc.h>#include <linux/proc_fs.h>#include <linux/module.h>#include <linux/init.h>#include <asm/uaccess.h>#include <asm/semaphore.h>#include <linux/netfilter_arp/arp_tables.h>MODULE_LICENSE("GPL");MODULE_AUTHOR("David S. Miller <davem@redhat.com>");MODULE_DESCRIPTION("arptables core");/*#define DEBUG_ARP_TABLES*//*#define DEBUG_ARP_TABLES_USER*/#ifdef DEBUG_ARP_TABLES#define dprintf(format, args...)  printk(format , ## args)#else#define dprintf(format, args...)#endif#ifdef DEBUG_ARP_TABLES_USER#define duprintf(format, args...) printk(format , ## args)#else#define duprintf(format, args...)#endif#ifdef CONFIG_NETFILTER_DEBUG#define ARP_NF_ASSERT(x)					\do {								\	if (!(x))						\		printk("ARP_NF_ASSERT: %s:%s:%u\n",		\		       __FUNCTION__, __FILE__, __LINE__);	\} while(0)#else#define ARP_NF_ASSERT(x)#endif#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))static DECLARE_MUTEX(arpt_mutex);#define ASSERT_READ_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)#define ASSERT_WRITE_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)#include <linux/netfilter_ipv4/lockhelp.h>#include <linux/netfilter_ipv4/listhelp.h>struct arpt_table_info {	unsigned int size;	unsigned int number;	unsigned int initial_entries;	unsigned int hook_entry[NF_ARP_NUMHOOKS];	unsigned int underflow[NF_ARP_NUMHOOKS];	char entries[0] __attribute__((aligned(SMP_CACHE_BYTES)));};static LIST_HEAD(arpt_target);static LIST_HEAD(arpt_tables);#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)#ifdef CONFIG_SMP#define TABLE_OFFSET(t,p) (SMP_ALIGN((t)->size)*(p))#else#define TABLE_OFFSET(t,p) 0#endifstatic inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,				      char *hdr_addr, int len){	int i, ret;	if (len > ARPT_DEV_ADDR_LEN_MAX)		len = ARPT_DEV_ADDR_LEN_MAX;	ret = 0;	for (i = 0; i < len; i++)		ret |= (hdr_addr[i] ^ ap->addr[i]) & ap->mask[i];	return (ret != 0);}/* Returns whether packet matches rule or not. */static inline int arp_packet_match(const struct arphdr *arphdr,				   struct net_device *dev,				   const char *indev,				   const char *outdev,				   const struct arpt_arp *arpinfo){	char *arpptr = (char *)(arphdr + 1);	char *src_devaddr, *tgt_devaddr;	u32 *src_ipaddr, *tgt_ipaddr;	int i, ret;#define FWINV(bool,invflg) ((bool) ^ !!(arpinfo->invflags & invflg))	if (FWINV((arphdr->ar_op & arpinfo->arpop_mask) != arpinfo->arpop,		  ARPT_INV_ARPOP)) {		dprintf("ARP operation field mismatch.\n");		dprintf("ar_op: %04x info->arpop: %04x info->arpop_mask: %04x\n",			arphdr->ar_op, arpinfo->arpop, arpinfo->arpop_mask);		return 0;	}	if (FWINV((arphdr->ar_hrd & arpinfo->arhrd_mask) != arpinfo->arhrd,		  ARPT_INV_ARPHRD)) {		dprintf("ARP hardware address format mismatch.\n");		dprintf("ar_hrd: %04x info->arhrd: %04x info->arhrd_mask: %04x\n",			arphdr->ar_hrd, arpinfo->arhrd, arpinfo->arhrd_mask);		return 0;	}	if (FWINV((arphdr->ar_pro & arpinfo->arpro_mask) != arpinfo->arpro,		  ARPT_INV_ARPPRO)) {		dprintf("ARP protocol address format mismatch.\n");		dprintf("ar_pro: %04x info->arpro: %04x info->arpro_mask: %04x\n",			arphdr->ar_pro, arpinfo->arpro, arpinfo->arpro_mask);		return 0;	}	if (FWINV((arphdr->ar_hln & arpinfo->arhln_mask) != arpinfo->arhln,		  ARPT_INV_ARPHLN)) {		dprintf("ARP hardware address length mismatch.\n");		dprintf("ar_hln: %02x info->arhln: %02x info->arhln_mask: %02x\n",			arphdr->ar_hln, arpinfo->arhln, arpinfo->arhln_mask);		return 0;	}	src_devaddr = arpptr;	arpptr += dev->addr_len;	src_ipaddr = (u32 *) arpptr;	arpptr += sizeof(u32);	tgt_devaddr = arpptr;	arpptr += dev->addr_len;	tgt_ipaddr = (u32 *) arpptr;	if (FWINV(arp_devaddr_compare(&arpinfo->src_devaddr, src_devaddr, dev->addr_len),		  ARPT_INV_SRCDEVADDR) ||	    FWINV(arp_devaddr_compare(&arpinfo->tgt_devaddr, tgt_devaddr, dev->addr_len),		  ARPT_INV_TGTDEVADDR)) {		dprintf("Source or target device address mismatch.\n");		return 0;	}	if (FWINV(((*src_ipaddr) & arpinfo->smsk.s_addr) != arpinfo->src.s_addr,		  ARPT_INV_SRCIP) ||	    FWINV((((*tgt_ipaddr) & arpinfo->tmsk.s_addr) != arpinfo->tgt.s_addr),		  ARPT_INV_TGTIP)) {		dprintf("Source or target IP address mismatch.\n");		dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",			NIPQUAD(*src_ipaddr),			NIPQUAD(arpinfo->smsk.s_addr),			NIPQUAD(arpinfo->src.s_addr),			arpinfo->invflags & ARPT_INV_SRCIP ? " (INV)" : "");		dprintf("TGT: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",			NIPQUAD(*tgt_ipaddr),			NIPQUAD(arpinfo->tmsk.s_addr),			NIPQUAD(arpinfo->tgt.s_addr),			arpinfo->invflags & ARPT_INV_TGTIP ? " (INV)" : "");		return 0;	}	/* Look for ifname matches.  */	for (i = 0, ret = 0; i < IFNAMSIZ; i++) {		ret |= (indev[i] ^ arpinfo->iniface[i])			& arpinfo->iniface_mask[i];	}	if (FWINV(ret != 0, ARPT_INV_VIA_IN)) {		dprintf("VIA in mismatch (%s vs %s).%s\n",			indev, arpinfo->iniface,			arpinfo->invflags&ARPT_INV_VIA_IN ?" (INV)":"");		return 0;	}	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {		ret |= (((const unsigned long *)outdev)[i]			^ ((const unsigned long *)arpinfo->outiface)[i])			& ((const unsigned long *)arpinfo->outiface_mask)[i];	}	if (FWINV(ret != 0, ARPT_INV_VIA_OUT)) {		dprintf("VIA out mismatch (%s vs %s).%s\n",			outdev, arpinfo->outiface,			arpinfo->invflags&ARPT_INV_VIA_OUT ?" (INV)":"");		return 0;	}	return 1;}static inline int arp_checkentry(const struct arpt_arp *arp){	if (arp->flags & ~ARPT_F_MASK) {		duprintf("Unknown flag bits set: %08X\n",			 arp->flags & ~ARPT_F_MASK);		return 0;	}	if (arp->invflags & ~ARPT_INV_MASK) {		duprintf("Unknown invflag bits set: %08X\n",			 arp->invflags & ~ARPT_INV_MASK);		return 0;	}	return 1;}static unsigned int arpt_error(struct sk_buff **pskb,			       unsigned int hooknum,			       const struct net_device *in,			       const struct net_device *out,			       const void *targinfo,			       void *userinfo){	if (net_ratelimit())		printk("arp_tables: error: '%s'\n", (char *)targinfo);	return NF_DROP;}static inline struct arpt_entry *get_entry(void *base, unsigned int offset){	return (struct arpt_entry *)(base + offset);}unsigned int arpt_do_table(struct sk_buff **pskb,			   unsigned int hook,			   const struct net_device *in,			   const struct net_device *out,			   struct arpt_table *table,			   void *userdata){	static const char nulldevname[IFNAMSIZ];	unsigned int verdict = NF_DROP;	struct arphdr *arp;	int hotdrop = 0;	struct arpt_entry *e, *back;	const char *indev, *outdev;	void *table_base;	/* ARP header, plus 2 device addresses, plus 2 IP addresses.  */	if (!pskb_may_pull((*pskb), (sizeof(struct arphdr) +				     (2 * (*pskb)->dev->addr_len) +				     (2 * sizeof(u32)))))		return NF_DROP;	indev = in ? in->name : nulldevname;	outdev = out ? out->name : nulldevname;	read_lock_bh(&table->lock);	table_base = (void *)table->private->entries		+ TABLE_OFFSET(table->private,			       smp_processor_id());	e = get_entry(table_base, table->private->hook_entry[hook]);	back = get_entry(table_base, table->private->underflow[hook]);	arp = (*pskb)->nh.arph;	do {		if (arp_packet_match(arp, (*pskb)->dev, indev, outdev, &e->arp)) {			struct arpt_entry_target *t;			int hdr_len;			hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +				(2 * (*pskb)->dev->addr_len);			ADD_COUNTER(e->counters, hdr_len, 1);			t = arpt_get_target(e);			/* Standard target? */			if (!t->u.kernel.target->target) {				int v;				v = ((struct arpt_standard_target *)t)->verdict;				if (v < 0) {					/* Pop from stack? */					if (v != ARPT_RETURN) {						verdict = (unsigned)(-v) - 1;						break;					}					e = back;					back = get_entry(table_base,							 back->comefrom);					continue;				}				if (table_base + v				    != (void *)e + e->next_offset) {					/* Save old back ptr in next entry */					struct arpt_entry *next						= (void *)e + e->next_offset;					next->comefrom =						(void *)back - table_base;					/* set back pointer to next entry */					back = next;				}				e = get_entry(table_base, v);			} else {				/* Targets which reenter must return				 * abs. verdicts				 */				verdict = t->u.kernel.target->target(pskb,								     hook,								     in, out,								     t->data,								     userdata);				/* Target might have changed stuff. */				arp = (*pskb)->nh.arph;				if (verdict == ARPT_CONTINUE)					e = (void *)e + e->next_offset;				else					/* Verdict */					break;			}		} else {			e = (void *)e + e->next_offset;		}	} while (!hotdrop);	read_unlock_bh(&table->lock);	if (hotdrop)		return NF_DROP;	else		return verdict;}static inline void *find_inlist_lock_noload(struct list_head *head,					    const char *name,					    int *error,					    struct semaphore *mutex){	void *ret;	*error = down_interruptible(mutex);	if (*error != 0)		return NULL;	ret = list_named_find(head, name);	if (!ret) {		*error = -ENOENT;		up(mutex);	}	return ret;}#ifndef CONFIG_KMOD#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))#elsestatic void *find_inlist_lock(struct list_head *head,		 const char *name,		 const char *prefix,		 int *error,		 struct semaphore *mutex){	void *ret;	ret = find_inlist_lock_noload(head, name, error, mutex);	if (!ret) {		duprintf("find_inlist: loading `%s%s'.\n", prefix, name);		request_module("%s%s", prefix, name);		ret = find_inlist_lock_noload(head, name, error, mutex);	}	return ret;}#endifstatic inline struct arpt_table *arpt_find_table_lock(const char *name, int *error, struct semaphore *mutex){	return find_inlist_lock(&arpt_tables, name, "arptable_", error, mutex);}struct arpt_target *arpt_find_target_lock(const char *name, int *error, struct semaphore *mutex){	return find_inlist_lock(&arpt_target, name, "arpt_", error, mutex);}/* All zeroes == unconditional rule. */static inline int unconditional(const struct arpt_arp *arp){	unsigned int i;	for (i = 0; i < sizeof(*arp)/sizeof(__u32); i++)		if (((__u32 *)arp)[i])			return 0;	return 1;}/* Figures out from what hook each rule can be called: returns 0 if * there are loops.  Puts hook bitmask in comefrom. */static int mark_source_chains(struct arpt_table_info *newinfo, unsigned int valid_hooks){	unsigned int hook;	/* No recursion; use packet counter to save back ptrs (reset	 * to 0 as we leave), and comefrom to save source hook bitmask.	 */	for (hook = 0; hook < NF_ARP_NUMHOOKS; hook++) {		unsigned int pos = newinfo->hook_entry[hook];		struct arpt_entry *e			= (struct arpt_entry *)(newinfo->entries + pos);		if (!(valid_hooks & (1 << hook)))			continue;		/* Set initial back pointer. */		e->counters.pcnt = pos;		for (;;) {			struct arpt_standard_target *t				= (void *)arpt_get_target(e);			if (e->comefrom & (1 << NF_ARP_NUMHOOKS)) {				printk("arptables: loop hook %u pos %u %08X.\n",				       hook, pos, e->comefrom);				return 0;			}			e->comefrom				|= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));