netfilter: x_tables: use pr ratelimiting in all remaining spots
Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
c08e5e1ee6
commit
b26066447b
|
@ -106,7 +106,7 @@ static int ecn_tg_check(const struct xt_tgchk_param *par)
|
|||
|
||||
if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
|
||||
(e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
|
||||
pr_info("cannot use TCP operations on a non-tcp rule\n");
|
||||
pr_info_ratelimited("cannot use operation on non-tcp rule\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
return 0;
|
||||
|
|
|
@ -74,13 +74,13 @@ static int reject_tg_check(const struct xt_tgchk_param *par)
|
|||
const struct ipt_entry *e = par->entryinfo;
|
||||
|
||||
if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
|
||||
pr_info("ECHOREPLY no longer supported.\n");
|
||||
pr_info_ratelimited("ECHOREPLY no longer supported.\n");
|
||||
return -EINVAL;
|
||||
} else if (rejinfo->with == IPT_TCP_RESET) {
|
||||
/* Must specify that it's a TCP packet */
|
||||
if (e->ip.proto != IPPROTO_TCP ||
|
||||
(e->ip.invflags & XT_INV_PROTO)) {
|
||||
pr_info("TCP_RESET invalid for non-tcp\n");
|
||||
pr_info_ratelimited("TCP_RESET invalid for non-tcp\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -105,7 +105,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
|
|||
const struct xt_rpfilter_info *info = par->matchinfo;
|
||||
unsigned int options = ~XT_RPFILTER_OPTION_MASK;
|
||||
if (info->flags & options) {
|
||||
pr_info("unknown options encountered");
|
||||
pr_info_ratelimited("unknown options\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -85,14 +85,14 @@ static int reject_tg6_check(const struct xt_tgchk_param *par)
|
|||
const struct ip6t_entry *e = par->entryinfo;
|
||||
|
||||
if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
|
||||
pr_info("ECHOREPLY is not supported.\n");
|
||||
pr_info_ratelimited("ECHOREPLY is not supported\n");
|
||||
return -EINVAL;
|
||||
} else if (rejinfo->with == IP6T_TCP_RESET) {
|
||||
/* Must specify that it's a TCP packet */
|
||||
if (!(e->ipv6.flags & IP6T_F_PROTO) ||
|
||||
e->ipv6.proto != IPPROTO_TCP ||
|
||||
(e->ipv6.invflags & XT_INV_PROTO)) {
|
||||
pr_info("TCP_RESET illegal for non-tcp\n");
|
||||
pr_info_ratelimited("TCP_RESET illegal for non-tcp\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -103,7 +103,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
|
|||
unsigned int options = ~XT_RPFILTER_OPTION_MASK;
|
||||
|
||||
if (info->flags & options) {
|
||||
pr_info("unknown options encountered");
|
||||
pr_info_ratelimited("unknown options\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -122,12 +122,14 @@ static int srh_mt6_check(const struct xt_mtchk_param *par)
|
|||
const struct ip6t_srh *srhinfo = par->matchinfo;
|
||||
|
||||
if (srhinfo->mt_flags & ~IP6T_SRH_MASK) {
|
||||
pr_err("unknown srh match flags %X\n", srhinfo->mt_flags);
|
||||
pr_info_ratelimited("unknown srh match flags %X\n",
|
||||
srhinfo->mt_flags);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (srhinfo->mt_invflags & ~IP6T_SRH_INV_MASK) {
|
||||
pr_err("unknown srh invflags %X\n", srhinfo->mt_invflags);
|
||||
pr_info_ratelimited("unknown srh invflags %X\n",
|
||||
srhinfo->mt_invflags);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -120,8 +120,8 @@ static int audit_tg_check(const struct xt_tgchk_param *par)
|
|||
const struct xt_audit_info *info = par->targinfo;
|
||||
|
||||
if (info->type > XT_AUDIT_TYPE_MAX) {
|
||||
pr_info("Audit type out of range (valid range: 0..%hhu)\n",
|
||||
XT_AUDIT_TYPE_MAX);
|
||||
pr_info_ratelimited("Audit type out of range (valid range: 0..%hhu)\n",
|
||||
XT_AUDIT_TYPE_MAX);
|
||||
return -ERANGE;
|
||||
}
|
||||
|
||||
|
|
|
@ -36,7 +36,8 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)
|
|||
const struct xt_CHECKSUM_info *einfo = par->targinfo;
|
||||
|
||||
if (einfo->operation & ~XT_CHECKSUM_OP_FILL) {
|
||||
pr_info("unsupported CHECKSUM operation %x\n", einfo->operation);
|
||||
pr_info_ratelimited("unsupported CHECKSUM operation %x\n",
|
||||
einfo->operation);
|
||||
return -EINVAL;
|
||||
}
|
||||
if (!einfo->operation)
|
||||
|
|
|
@ -102,14 +102,14 @@ static int connsecmark_tg_check(const struct xt_tgchk_param *par)
|
|||
break;
|
||||
|
||||
default:
|
||||
pr_info("invalid mode: %hu\n", info->mode);
|
||||
pr_info_ratelimited("invalid mode: %hu\n", info->mode);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0)
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
|
@ -136,7 +136,7 @@ static int led_tg_check(const struct xt_tgchk_param *par)
|
|||
|
||||
err = led_trigger_register(&ledinternal->netfilter_led_trigger);
|
||||
if (err) {
|
||||
pr_err("Trigger name is already in use.\n");
|
||||
pr_info_ratelimited("Trigger name is already in use.\n");
|
||||
goto exit_alloc;
|
||||
}
|
||||
|
||||
|
|
|
@ -60,18 +60,20 @@ static int checkentry_lsm(struct xt_secmark_target_info *info)
|
|||
&info->secid);
|
||||
if (err) {
|
||||
if (err == -EINVAL)
|
||||
pr_info("invalid security context \'%s\'\n", info->secctx);
|
||||
pr_info_ratelimited("invalid security context \'%s\'\n",
|
||||
info->secctx);
|
||||
return err;
|
||||
}
|
||||
|
||||
if (!info->secid) {
|
||||
pr_info("unable to map security context \'%s\'\n", info->secctx);
|
||||
pr_info_ratelimited("unable to map security context \'%s\'\n",
|
||||
info->secctx);
|
||||
return -ENOENT;
|
||||
}
|
||||
|
||||
err = security_secmark_relabel_packet(info->secid);
|
||||
if (err) {
|
||||
pr_info("unable to obtain relabeling permission\n");
|
||||
pr_info_ratelimited("unable to obtain relabeling permission\n");
|
||||
return err;
|
||||
}
|
||||
|
||||
|
@ -92,8 +94,8 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
|
|||
}
|
||||
|
||||
if (mode && mode != info->mode) {
|
||||
pr_info("mode already set to %hu cannot mix with "
|
||||
"rules for mode %hu\n", mode, info->mode);
|
||||
pr_info_ratelimited("mode already set to %hu cannot mix with rules for mode %hu\n",
|
||||
mode, info->mode);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -101,7 +103,7 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
|
|||
case SECMARK_MODE_SEL:
|
||||
break;
|
||||
default:
|
||||
pr_info("invalid mode: %hu\n", info->mode);
|
||||
pr_info_ratelimited("invalid mode: %hu\n", info->mode);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -273,8 +273,7 @@ static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
|
|||
(par->hook_mask & ~((1 << NF_INET_FORWARD) |
|
||||
(1 << NF_INET_LOCAL_OUT) |
|
||||
(1 << NF_INET_POST_ROUTING))) != 0) {
|
||||
pr_info("path-MTU clamping only supported in "
|
||||
"FORWARD, OUTPUT and POSTROUTING hooks\n");
|
||||
pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
if (par->nft_compat)
|
||||
|
@ -283,7 +282,7 @@ static int tcpmss_tg4_check(const struct xt_tgchk_param *par)
|
|||
xt_ematch_foreach(ematch, e)
|
||||
if (find_syn_match(ematch))
|
||||
return 0;
|
||||
pr_info("Only works on TCP SYN packets\n");
|
||||
pr_info_ratelimited("Only works on TCP SYN packets\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -298,8 +297,7 @@ static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
|
|||
(par->hook_mask & ~((1 << NF_INET_FORWARD) |
|
||||
(1 << NF_INET_LOCAL_OUT) |
|
||||
(1 << NF_INET_POST_ROUTING))) != 0) {
|
||||
pr_info("path-MTU clamping only supported in "
|
||||
"FORWARD, OUTPUT and POSTROUTING hooks\n");
|
||||
pr_info_ratelimited("path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
if (par->nft_compat)
|
||||
|
@ -308,7 +306,7 @@ static int tcpmss_tg6_check(const struct xt_tgchk_param *par)
|
|||
xt_ematch_foreach(ematch, e)
|
||||
if (find_syn_match(ematch))
|
||||
return 0;
|
||||
pr_info("Only works on TCP SYN packets\n");
|
||||
pr_info_ratelimited("Only works on TCP SYN packets\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
#endif
|
||||
|
|
|
@ -540,8 +540,7 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
|
|||
!(i->invflags & IP6T_INV_PROTO))
|
||||
return 0;
|
||||
|
||||
pr_info("Can be used only in combination with "
|
||||
"either -p tcp or -p udp\n");
|
||||
pr_info_ratelimited("Can be used only with -p tcp or -p udp\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
#endif
|
||||
|
@ -559,8 +558,7 @@ static int tproxy_tg4_check(const struct xt_tgchk_param *par)
|
|||
&& !(i->invflags & IPT_INV_PROTO))
|
||||
return 0;
|
||||
|
||||
pr_info("Can be used only in combination with "
|
||||
"either -p tcp or -p udp\n");
|
||||
pr_info_ratelimited("Can be used only with -p tcp or -p udp\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -7,6 +7,8 @@
|
|||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
||||
|
||||
#include <linux/module.h>
|
||||
#include <linux/syscalls.h>
|
||||
#include <linux/skbuff.h>
|
||||
|
@ -34,7 +36,7 @@ static int __bpf_mt_check_bytecode(struct sock_filter *insns, __u16 len,
|
|||
program.filter = insns;
|
||||
|
||||
if (bpf_prog_create(ret, &program)) {
|
||||
pr_info("bpf: check failed: parse error\n");
|
||||
pr_info_ratelimited("check failed: parse error\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -12,6 +12,8 @@
|
|||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
||||
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/module.h>
|
||||
#include <linux/netfilter/x_tables.h>
|
||||
|
@ -48,7 +50,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
|
|||
}
|
||||
|
||||
if (info->has_path && info->has_classid) {
|
||||
pr_info("xt_cgroup: both path and classid specified\n");
|
||||
pr_info_ratelimited("path and classid specified\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -56,8 +58,8 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
|
|||
if (info->has_path) {
|
||||
cgrp = cgroup_get_from_path(info->path);
|
||||
if (IS_ERR(cgrp)) {
|
||||
pr_info("xt_cgroup: invalid path, errno=%ld\n",
|
||||
PTR_ERR(cgrp));
|
||||
pr_info_ratelimited("invalid path, errno=%ld\n",
|
||||
PTR_ERR(cgrp));
|
||||
return -EINVAL;
|
||||
}
|
||||
info->priv = cgrp;
|
||||
|
|
|
@ -135,14 +135,12 @@ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
|
|||
struct xt_cluster_match_info *info = par->matchinfo;
|
||||
|
||||
if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
|
||||
pr_info("you have exceeded the maximum "
|
||||
"number of cluster nodes (%u > %u)\n",
|
||||
info->total_nodes, XT_CLUSTER_NODES_MAX);
|
||||
pr_info_ratelimited("you have exceeded the maximum number of cluster nodes (%u > %u)\n",
|
||||
info->total_nodes, XT_CLUSTER_NODES_MAX);
|
||||
return -EINVAL;
|
||||
}
|
||||
if (info->node_mask >= (1ULL << info->total_nodes)) {
|
||||
pr_info("this node mask cannot be "
|
||||
"higher than the total number of nodes\n");
|
||||
pr_info_ratelimited("node mask cannot exceed total number of nodes\n");
|
||||
return -EDOM;
|
||||
}
|
||||
return 0;
|
||||
|
|
|
@ -112,8 +112,8 @@ static int connbytes_mt_check(const struct xt_mtchk_param *par)
|
|||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0)
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
|
||||
/*
|
||||
* This filter cannot function correctly unless connection tracking
|
||||
|
|
|
@ -57,14 +57,15 @@ static int connlabel_mt_check(const struct xt_mtchk_param *par)
|
|||
int ret;
|
||||
|
||||
if (info->options & ~options) {
|
||||
pr_err("Unknown options in mask %x\n", info->options);
|
||||
pr_info_ratelimited("Unknown options in mask %x\n",
|
||||
info->options);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0) {
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
|
@ -79,8 +79,8 @@ static int connmark_tg_check(const struct xt_tgchk_param *par)
|
|||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0)
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
@ -109,8 +109,8 @@ static int connmark_mt_check(const struct xt_mtchk_param *par)
|
|||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0)
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
|
@ -272,8 +272,8 @@ static int conntrack_mt_check(const struct xt_mtchk_param *par)
|
|||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0)
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
|
@ -97,7 +97,7 @@ static int ecn_mt_check4(const struct xt_mtchk_param *par)
|
|||
|
||||
if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
|
||||
(ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
|
||||
pr_info("cannot match TCP bits in rule for non-tcp packets\n");
|
||||
pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -139,7 +139,7 @@ static int ecn_mt_check6(const struct xt_mtchk_param *par)
|
|||
|
||||
if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
|
||||
(ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) {
|
||||
pr_info("cannot match TCP bits in rule for non-tcp packets\n");
|
||||
pr_info_ratelimited("cannot match TCP bits for non-tcp packets\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -523,7 +523,8 @@ static u64 user2rate(u64 user)
|
|||
if (user != 0) {
|
||||
return div64_u64(XT_HASHLIMIT_SCALE_v2, user);
|
||||
} else {
|
||||
pr_warn("invalid rate from userspace: %llu\n", user);
|
||||
pr_info_ratelimited("invalid rate from userspace: %llu\n",
|
||||
user);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
@ -865,33 +866,34 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par,
|
|||
}
|
||||
|
||||
if (cfg->mode & ~XT_HASHLIMIT_ALL) {
|
||||
pr_info("Unknown mode mask %X, kernel too old?\n",
|
||||
cfg->mode);
|
||||
pr_info_ratelimited("Unknown mode mask %X, kernel too old?\n",
|
||||
cfg->mode);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
/* Check for overflow. */
|
||||
if (revision >= 3 && cfg->mode & XT_HASHLIMIT_RATE_MATCH) {
|
||||
if (cfg->avg == 0 || cfg->avg > U32_MAX) {
|
||||
pr_info("hashlimit invalid rate\n");
|
||||
pr_info_ratelimited("invalid rate\n");
|
||||
return -ERANGE;
|
||||
}
|
||||
|
||||
if (cfg->interval == 0) {
|
||||
pr_info("hashlimit invalid interval\n");
|
||||
pr_info_ratelimited("invalid interval\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
} else if (cfg->mode & XT_HASHLIMIT_BYTES) {
|
||||
if (user2credits_byte(cfg->avg) == 0) {
|
||||
pr_info("overflow, rate too high: %llu\n", cfg->avg);
|
||||
pr_info_ratelimited("overflow, rate too high: %llu\n",
|
||||
cfg->avg);
|
||||
return -EINVAL;
|
||||
}
|
||||
} else if (cfg->burst == 0 ||
|
||||
user2credits(cfg->avg * cfg->burst, revision) <
|
||||
user2credits(cfg->avg, revision)) {
|
||||
pr_info("overflow, try lower: %llu/%llu\n",
|
||||
cfg->avg, cfg->burst);
|
||||
return -ERANGE;
|
||||
user2credits(cfg->avg * cfg->burst, revision) <
|
||||
user2credits(cfg->avg, revision)) {
|
||||
pr_info_ratelimited("overflow, try lower: %llu/%llu\n",
|
||||
cfg->avg, cfg->burst);
|
||||
return -ERANGE;
|
||||
}
|
||||
|
||||
mutex_lock(&hashlimit_mutex);
|
||||
|
|
|
@ -61,8 +61,8 @@ static int helper_mt_check(const struct xt_mtchk_param *par)
|
|||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0) {
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
return ret;
|
||||
}
|
||||
info->name[sizeof(info->name) - 1] = '\0';
|
||||
|
|
|
@ -72,7 +72,7 @@ static int comp_mt_check(const struct xt_mtchk_param *par)
|
|||
|
||||
/* Must specify no unknown invflags */
|
||||
if (compinfo->invflags & ~XT_IPCOMP_INV_MASK) {
|
||||
pr_err("unknown flags %X\n", compinfo->invflags);
|
||||
pr_info_ratelimited("unknown flags %X\n", compinfo->invflags);
|
||||
return -EINVAL;
|
||||
}
|
||||
return 0;
|
||||
|
|
|
@ -158,7 +158,8 @@ static int ipvs_mt_check(const struct xt_mtchk_param *par)
|
|||
&& par->family != NFPROTO_IPV6
|
||||
#endif
|
||||
) {
|
||||
pr_info("protocol family %u not supported\n", par->family);
|
||||
pr_info_ratelimited("protocol family %u not supported\n",
|
||||
par->family);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -216,7 +216,7 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
|
|||
/* Check for invalid flags */
|
||||
if (info->flags & ~(XT_L2TP_TID | XT_L2TP_SID | XT_L2TP_VERSION |
|
||||
XT_L2TP_TYPE)) {
|
||||
pr_info("unknown flags: %x\n", info->flags);
|
||||
pr_info_ratelimited("unknown flags: %x\n", info->flags);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -225,7 +225,8 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
|
|||
(!(info->flags & XT_L2TP_SID)) &&
|
||||
((!(info->flags & XT_L2TP_TYPE)) ||
|
||||
(info->type != XT_L2TP_TYPE_CONTROL))) {
|
||||
pr_info("invalid flags combination: %x\n", info->flags);
|
||||
pr_info_ratelimited("invalid flags combination: %x\n",
|
||||
info->flags);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -234,19 +235,22 @@ static int l2tp_mt_check(const struct xt_mtchk_param *par)
|
|||
*/
|
||||
if (info->flags & XT_L2TP_VERSION) {
|
||||
if ((info->version < 2) || (info->version > 3)) {
|
||||
pr_info("wrong L2TP version: %u\n", info->version);
|
||||
pr_info_ratelimited("wrong L2TP version: %u\n",
|
||||
info->version);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (info->version == 2) {
|
||||
if ((info->flags & XT_L2TP_TID) &&
|
||||
(info->tid > 0xffff)) {
|
||||
pr_info("v2 tid > 0xffff: %u\n", info->tid);
|
||||
pr_info_ratelimited("v2 tid > 0xffff: %u\n",
|
||||
info->tid);
|
||||
return -EINVAL;
|
||||
}
|
||||
if ((info->flags & XT_L2TP_SID) &&
|
||||
(info->sid > 0xffff)) {
|
||||
pr_info("v2 sid > 0xffff: %u\n", info->sid);
|
||||
pr_info_ratelimited("v2 sid > 0xffff: %u\n",
|
||||
info->sid);
|
||||
return -EINVAL;
|
||||
}
|
||||
}
|
||||
|
@ -268,13 +272,13 @@ static int l2tp_mt_check4(const struct xt_mtchk_param *par)
|
|||
|
||||
if ((ip->proto != IPPROTO_UDP) &&
|
||||
(ip->proto != IPPROTO_L2TP)) {
|
||||
pr_info("missing protocol rule (udp|l2tpip)\n");
|
||||
pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if ((ip->proto == IPPROTO_L2TP) &&
|
||||
(info->version == 2)) {
|
||||
pr_info("v2 doesn't support IP mode\n");
|
||||
pr_info_ratelimited("v2 doesn't support IP mode\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -295,13 +299,13 @@ static int l2tp_mt_check6(const struct xt_mtchk_param *par)
|
|||
|
||||
if ((ip->proto != IPPROTO_UDP) &&
|
||||
(ip->proto != IPPROTO_L2TP)) {
|
||||
pr_info("missing protocol rule (udp|l2tpip)\n");
|
||||
pr_info_ratelimited("missing protocol rule (udp|l2tpip)\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if ((ip->proto == IPPROTO_L2TP) &&
|
||||
(info->version == 2)) {
|
||||
pr_info("v2 doesn't support IP mode\n");
|
||||
pr_info_ratelimited("v2 doesn't support IP mode\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
|
@ -106,8 +106,8 @@ static int limit_mt_check(const struct xt_mtchk_param *par)
|
|||
/* Check for overflow. */
|
||||
if (r->burst == 0
|
||||
|| user2credits(r->avg * r->burst) < user2credits(r->avg)) {
|
||||
pr_info("Overflow, try lower: %u/%u\n",
|
||||
r->avg, r->burst);
|
||||
pr_info_ratelimited("Overflow, try lower: %u/%u\n",
|
||||
r->avg, r->burst);
|
||||
return -ERANGE;
|
||||
}
|
||||
|
||||
|
|
|
@ -8,6 +8,8 @@
|
|||
* published by the Free Software Foundation.
|
||||
*/
|
||||
|
||||
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
||||
|
||||
#include <linux/module.h>
|
||||
#include <linux/skbuff.h>
|
||||
#include <linux/netfilter.h>
|
||||
|
@ -19,8 +21,7 @@ static int xt_nat_checkentry_v0(const struct xt_tgchk_param *par)
|
|||
const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
|
||||
|
||||
if (mr->rangesize != 1) {
|
||||
pr_info("%s: multiple ranges no longer supported\n",
|
||||
par->target->name);
|
||||
pr_info_ratelimited("multiple ranges no longer supported\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
return nf_ct_netns_get(par->net, par->family);
|
||||
|
|
|
@ -6,6 +6,8 @@
|
|||
* it under the terms of the GNU General Public License version 2 (or any
|
||||
* later at your option) as published by the Free Software Foundation.
|
||||
*/
|
||||
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
||||
|
||||
#include <linux/module.h>
|
||||
#include <linux/skbuff.h>
|
||||
|
||||
|
@ -39,8 +41,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par)
|
|||
|
||||
nfacct = nfnl_acct_find_get(par->net, info->name);
|
||||
if (nfacct == NULL) {
|
||||
pr_info("xt_nfacct: accounting object with name `%s' "
|
||||
"does not exists\n", info->name);
|
||||
pr_info_ratelimited("accounting object `%s' does not exists\n",
|
||||
info->name);
|
||||
return -ENOENT;
|
||||
}
|
||||
info->nfacct = nfacct;
|
||||
|
|
|
@ -107,9 +107,7 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
|
|||
info->invert & XT_PHYSDEV_OP_BRIDGED) &&
|
||||
par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
|
||||
(1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
|
||||
pr_info("using --physdev-out and --physdev-is-out are only "
|
||||
"supported in the FORWARD and POSTROUTING chains with "
|
||||
"bridged traffic.\n");
|
||||
pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
|
||||
if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
|
||||
return -EINVAL;
|
||||
}
|
||||
|
|
|
@ -342,8 +342,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
|
|||
net_get_random_once(&hash_rnd, sizeof(hash_rnd));
|
||||
|
||||
if (info->check_set & ~XT_RECENT_VALID_FLAGS) {
|
||||
pr_info("Unsupported user space flags (%08x)\n",
|
||||
info->check_set);
|
||||
pr_info_ratelimited("Unsupported userspace flags (%08x)\n",
|
||||
info->check_set);
|
||||
return -EINVAL;
|
||||
}
|
||||
if (hweight8(info->check_set &
|
||||
|
@ -357,8 +357,8 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
|
|||
if ((info->check_set & XT_RECENT_REAP) && !info->seconds)
|
||||
return -EINVAL;
|
||||
if (info->hit_count >= XT_RECENT_MAX_NSTAMPS) {
|
||||
pr_info("hitcount (%u) is larger than allowed maximum (%u)\n",
|
||||
info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
|
||||
pr_info_ratelimited("hitcount (%u) is larger than allowed maximum (%u)\n",
|
||||
info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
|
||||
return -EINVAL;
|
||||
}
|
||||
if (info->name[0] == '\0' ||
|
||||
|
@ -587,7 +587,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
|
|||
add = true;
|
||||
break;
|
||||
default:
|
||||
pr_info("Need \"+ip\", \"-ip\" or \"/\"\n");
|
||||
pr_info_ratelimited("Need \"+ip\", \"-ip\" or \"/\"\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
@ -601,10 +601,8 @@ recent_mt_proc_write(struct file *file, const char __user *input,
|
|||
succ = in4_pton(c, size, (void *)&addr, '\n', NULL);
|
||||
}
|
||||
|
||||
if (!succ) {
|
||||
pr_info("illegal address written to procfs\n");
|
||||
if (!succ)
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
spin_lock_bh(&recent_lock);
|
||||
e = recent_entry_lookup(t, &addr, family, 0);
|
||||
|
|
|
@ -171,7 +171,8 @@ static int socket_mt_v1_check(const struct xt_mtchk_param *par)
|
|||
return err;
|
||||
|
||||
if (info->flags & ~XT_SOCKET_FLAGS_V1) {
|
||||
pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V1);
|
||||
pr_info_ratelimited("unknown flags 0x%x\n",
|
||||
info->flags & ~XT_SOCKET_FLAGS_V1);
|
||||
return -EINVAL;
|
||||
}
|
||||
return 0;
|
||||
|
@ -187,7 +188,8 @@ static int socket_mt_v2_check(const struct xt_mtchk_param *par)
|
|||
return err;
|
||||
|
||||
if (info->flags & ~XT_SOCKET_FLAGS_V2) {
|
||||
pr_info("unknown flags 0x%x\n", info->flags & ~XT_SOCKET_FLAGS_V2);
|
||||
pr_info_ratelimited("unknown flags 0x%x\n",
|
||||
info->flags & ~XT_SOCKET_FLAGS_V2);
|
||||
return -EINVAL;
|
||||
}
|
||||
return 0;
|
||||
|
@ -203,8 +205,8 @@ static int socket_mt_v3_check(const struct xt_mtchk_param *par)
|
|||
if (err)
|
||||
return err;
|
||||
if (info->flags & ~XT_SOCKET_FLAGS_V3) {
|
||||
pr_info("unknown flags 0x%x\n",
|
||||
info->flags & ~XT_SOCKET_FLAGS_V3);
|
||||
pr_info_ratelimited("unknown flags 0x%x\n",
|
||||
info->flags & ~XT_SOCKET_FLAGS_V3);
|
||||
return -EINVAL;
|
||||
}
|
||||
return 0;
|
||||
|
|
|
@ -44,8 +44,8 @@ static int state_mt_check(const struct xt_mtchk_param *par)
|
|||
|
||||
ret = nf_ct_netns_get(par->net, par->family);
|
||||
if (ret < 0)
|
||||
pr_info("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
|
||||
par->family);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
|
@ -235,13 +235,13 @@ static int time_mt_check(const struct xt_mtchk_param *par)
|
|||
|
||||
if (info->daytime_start > XT_TIME_MAX_DAYTIME ||
|
||||
info->daytime_stop > XT_TIME_MAX_DAYTIME) {
|
||||
pr_info("invalid argument - start or "
|
||||
"stop time greater than 23:59:59\n");
|
||||
pr_info_ratelimited("invalid argument - start or stop time greater than 23:59:59\n");
|
||||
return -EDOM;
|
||||
}
|
||||
|
||||
if (info->flags & ~XT_TIME_ALL_FLAGS) {
|
||||
pr_info("unknown flags 0x%x\n", info->flags & ~XT_TIME_ALL_FLAGS);
|
||||
pr_info_ratelimited("unknown flags 0x%x\n",
|
||||
info->flags & ~XT_TIME_ALL_FLAGS);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue