ia64/linux-2.6.18-xen.hg

view net/netfilter/xt_policy.c @ 871:9cbcc9008446

xen/x86: don't initialize cpu_data[]'s apicid field on generic code

Afaict, this is not only redundant with the intialization done in
drivers/xen/core/smpboot.c, but actually results - at least for
secondary CPUs - in the Xen-specific value written to be later
overwritten with whatever the generic code determines (with no
guarantee that the two values are identical).

Signed-off-by: Jan Beulich <jbeulich@novell.com>
author Keir Fraser <keir.fraser@citrix.com>
date Thu May 14 10:09:15 2009 +0100 (2009-05-14)
parents 831230e53067
children
line source
1 /* IP tables module for matching IPsec policy
2 *
3 * Copyright (c) 2004,2005 Patrick McHardy, <kaber@trash.net>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 */
10 #include <linux/kernel.h>
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/init.h>
14 #include <net/xfrm.h>
16 #include <linux/netfilter/xt_policy.h>
17 #include <linux/netfilter/x_tables.h>
19 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
20 MODULE_DESCRIPTION("Xtables IPsec policy matching module");
21 MODULE_LICENSE("GPL");
23 static inline int
24 xt_addr_cmp(const union xt_policy_addr *a1, const union xt_policy_addr *m,
25 const union xt_policy_addr *a2, unsigned short family)
26 {
27 switch (family) {
28 case AF_INET:
29 return !((a1->a4.s_addr ^ a2->a4.s_addr) & m->a4.s_addr);
30 case AF_INET6:
31 return !ipv6_masked_addr_cmp(&a1->a6, &m->a6, &a2->a6);
32 }
33 return 0;
34 }
36 static inline int
37 match_xfrm_state(struct xfrm_state *x, const struct xt_policy_elem *e,
38 unsigned short family)
39 {
40 #define MATCH_ADDR(x,y,z) (!e->match.x || \
41 (xt_addr_cmp(&e->x, &e->y, z, family) \
42 ^ e->invert.x))
43 #define MATCH(x,y) (!e->match.x || ((e->x == (y)) ^ e->invert.x))
45 return MATCH_ADDR(saddr, smask, (union xt_policy_addr *)&x->props.saddr) &&
46 MATCH_ADDR(daddr, dmask, (union xt_policy_addr *)&x->id.daddr) &&
47 MATCH(proto, x->id.proto) &&
48 MATCH(mode, x->props.mode) &&
49 MATCH(spi, x->id.spi) &&
50 MATCH(reqid, x->props.reqid);
51 }
53 static int
54 match_policy_in(const struct sk_buff *skb, const struct xt_policy_info *info,
55 unsigned short family)
56 {
57 const struct xt_policy_elem *e;
58 struct sec_path *sp = skb->sp;
59 int strict = info->flags & XT_POLICY_MATCH_STRICT;
60 int i, pos;
62 if (sp == NULL)
63 return -1;
64 if (strict && info->len != sp->len)
65 return 0;
67 for (i = sp->len - 1; i >= 0; i--) {
68 pos = strict ? i - sp->len + 1 : 0;
69 if (pos >= info->len)
70 return 0;
71 e = &info->pol[pos];
73 if (match_xfrm_state(sp->xvec[i], e, family)) {
74 if (!strict)
75 return 1;
76 } else if (strict)
77 return 0;
78 }
80 return strict ? 1 : 0;
81 }
83 static int
84 match_policy_out(const struct sk_buff *skb, const struct xt_policy_info *info,
85 unsigned short family)
86 {
87 const struct xt_policy_elem *e;
88 struct dst_entry *dst = skb->dst;
89 int strict = info->flags & XT_POLICY_MATCH_STRICT;
90 int i, pos;
92 if (dst->xfrm == NULL)
93 return -1;
95 for (i = 0; dst && dst->xfrm; dst = dst->child, i++) {
96 pos = strict ? i : 0;
97 if (pos >= info->len)
98 return 0;
99 e = &info->pol[pos];
101 if (match_xfrm_state(dst->xfrm, e, family)) {
102 if (!strict)
103 return 1;
104 } else if (strict)
105 return 0;
106 }
108 return strict ? i == info->len : 0;
109 }
111 static int match(const struct sk_buff *skb,
112 const struct net_device *in,
113 const struct net_device *out,
114 const struct xt_match *match,
115 const void *matchinfo,
116 int offset,
117 unsigned int protoff,
118 int *hotdrop)
119 {
120 const struct xt_policy_info *info = matchinfo;
121 int ret;
123 if (info->flags & XT_POLICY_MATCH_IN)
124 ret = match_policy_in(skb, info, match->family);
125 else
126 ret = match_policy_out(skb, info, match->family);
128 if (ret < 0)
129 ret = info->flags & XT_POLICY_MATCH_NONE ? 1 : 0;
130 else if (info->flags & XT_POLICY_MATCH_NONE)
131 ret = 0;
133 return ret;
134 }
136 static int checkentry(const char *tablename, const void *ip_void,
137 const struct xt_match *match,
138 void *matchinfo, unsigned int matchsize,
139 unsigned int hook_mask)
140 {
141 struct xt_policy_info *info = matchinfo;
143 if (!(info->flags & (XT_POLICY_MATCH_IN|XT_POLICY_MATCH_OUT))) {
144 printk(KERN_ERR "xt_policy: neither incoming nor "
145 "outgoing policy selected\n");
146 return 0;
147 }
148 /* hook values are equal for IPv4 and IPv6 */
149 if (hook_mask & (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_LOCAL_IN)
150 && info->flags & XT_POLICY_MATCH_OUT) {
151 printk(KERN_ERR "xt_policy: output policy not valid in "
152 "PRE_ROUTING and INPUT\n");
153 return 0;
154 }
155 if (hook_mask & (1 << NF_IP_POST_ROUTING | 1 << NF_IP_LOCAL_OUT)
156 && info->flags & XT_POLICY_MATCH_IN) {
157 printk(KERN_ERR "xt_policy: input policy not valid in "
158 "POST_ROUTING and OUTPUT\n");
159 return 0;
160 }
161 if (info->len > XT_POLICY_MAX_ELEM) {
162 printk(KERN_ERR "xt_policy: too many policy elements\n");
163 return 0;
164 }
165 return 1;
166 }
168 static struct xt_match policy_match = {
169 .name = "policy",
170 .family = AF_INET,
171 .match = match,
172 .matchsize = sizeof(struct xt_policy_info),
173 .checkentry = checkentry,
174 .family = AF_INET,
175 .me = THIS_MODULE,
176 };
178 static struct xt_match policy6_match = {
179 .name = "policy",
180 .family = AF_INET6,
181 .match = match,
182 .matchsize = sizeof(struct xt_policy_info),
183 .checkentry = checkentry,
184 .family = AF_INET6,
185 .me = THIS_MODULE,
186 };
188 static int __init init(void)
189 {
190 int ret;
192 ret = xt_register_match(&policy_match);
193 if (ret)
194 return ret;
195 ret = xt_register_match(&policy6_match);
196 if (ret)
197 xt_unregister_match(&policy_match);
198 return ret;
199 }
201 static void __exit fini(void)
202 {
203 xt_unregister_match(&policy6_match);
204 xt_unregister_match(&policy_match);
205 }
207 module_init(init);
208 module_exit(fini);
209 MODULE_ALIAS("ipt_policy");
210 MODULE_ALIAS("ip6t_policy");