URL https://opencores.org/ocsvn/or1k/or1k/trunk

Subversion Repositories or1k

[/] [or1k/] [trunk/] [linux/] [linux-2.4/] [net/] [core/] [filter.c] - Blame information for rev 1765

Details | Compare with Previous | View Log


/*
 * Linux Socket Filter - Kernel level socket filtering
 *
 * Author:
 *     Jay Schulist <jschlst@samba.org>
 *
 * Based on the design of:
 *     - The Berkeley Packet Filter
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 *
 * Andi Kleen - Fix a few bad bugs and races.
 */
 
#include <linux/config.h>
#if defined(CONFIG_FILTER)
 
#include <linux/module.h>
#include <linux/types.h>
#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/fcntl.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/netdevice.h>
#include <linux/if_packet.h>
#include <net/ip.h>
#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <linux/errno.h>
#include <linux/timer.h>
#include <asm/system.h>
#include <asm/uaccess.h>
#include <linux/filter.h>
 
/* No hurry in this branch */
 
static u8 *load_pointer(struct sk_buff *skb, int k)
{
        u8 *ptr = NULL;
 
        if (k>=SKF_NET_OFF)
                ptr = skb->nh.raw + k - SKF_NET_OFF;
        else if (k>=SKF_LL_OFF)
                ptr = skb->mac.raw + k - SKF_LL_OFF;
 
        if (ptr >= skb->head && ptr < skb->tail)
                return ptr;
        return NULL;
}
 
/**
 *      sk_run_filter   -       run a filter on a socket
 *      @skb: buffer to run the filter on
 *      @filter: filter to apply
 *      @flen: length of filter
 *
 * Decode and apply filter instructions to the skb->data.
 * Return length to keep, 0 for none. skb is the data we are
 * filtering, filter is the array of filter instructions, and
 * len is the number of filter blocks in the array.
 */
 
int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
{
        unsigned char *data = skb->data;
        /* len is UNSIGNED. Byte wide insns relies only on implicit
           type casts to prevent reading arbitrary memory locations.
         */
        unsigned int len = skb->len-skb->data_len;
        struct sock_filter *fentry;     /* We walk down these */
        u32 A = 0;                       /* Accumulator */
        u32 X = 0;                       /* Index Register */
        u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
        int k;
        int pc;
 
        /*
         * Process array of filter instructions.
         */
 
        for(pc = 0; pc < flen; pc++)
        {
                fentry = &filter[pc];
 
                switch(fentry->code)
                {
                        case BPF_ALU|BPF_ADD|BPF_X:
                                A += X;
                                continue;
 
                        case BPF_ALU|BPF_ADD|BPF_K:
                                A += fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_SUB|BPF_X:
                                A -= X;
                                continue;
 
                        case BPF_ALU|BPF_SUB|BPF_K:
                                A -= fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_MUL|BPF_X:
                                A *= X;
                                continue;
 
                        case BPF_ALU|BPF_MUL|BPF_K:
                                A *= fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_DIV|BPF_X:
                                if(X == 0)
                                        return (0);
                                A /= X;
                                continue;
 
                        case BPF_ALU|BPF_DIV|BPF_K:
                                if(fentry->k == 0)
                                        return (0);
                                A /= fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_AND|BPF_X:
                                A &= X;
                                continue;
 
                        case BPF_ALU|BPF_AND|BPF_K:
                                A &= fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_OR|BPF_X:
                                A |= X;
                                continue;
 
                        case BPF_ALU|BPF_OR|BPF_K:
                                A |= fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_LSH|BPF_X:
                                A <<= X;
                                continue;
 
                        case BPF_ALU|BPF_LSH|BPF_K:
                                A <<= fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_RSH|BPF_X:
                                A >>= X;
                                continue;
 
                        case BPF_ALU|BPF_RSH|BPF_K:
                                A >>= fentry->k;
                                continue;
 
                        case BPF_ALU|BPF_NEG:
                                A = -A;
                                continue;
 
                        case BPF_JMP|BPF_JA:
                                pc += fentry->k;
                                continue;
 
                        case BPF_JMP|BPF_JGT|BPF_K:
                                pc += (A > fentry->k) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_JMP|BPF_JGE|BPF_K:
                                pc += (A >= fentry->k) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_JMP|BPF_JEQ|BPF_K:
                                pc += (A == fentry->k) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_JMP|BPF_JSET|BPF_K:
                                pc += (A & fentry->k) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_JMP|BPF_JGT|BPF_X:
                                pc += (A > X) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_JMP|BPF_JGE|BPF_X:
                                pc += (A >= X) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_JMP|BPF_JEQ|BPF_X:
                                pc += (A == X) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_JMP|BPF_JSET|BPF_X:
                                pc += (A & X) ? fentry->jt : fentry->jf;
                                continue;
 
                        case BPF_LD|BPF_W|BPF_ABS:
                                k = fentry->k;
load_w:
                                if(k >= 0 && (unsigned int)(k+sizeof(u32)) <= len) {
                                        A = ntohl(*(u32*)&data[k]);
                                        continue;
                                }
                                if (k<0) {
                                        u8 *ptr;
 
                                        if (k>=SKF_AD_OFF)
                                                break;
                                        if ((ptr = load_pointer(skb, k)) != NULL) {
                                                A = ntohl(*(u32*)ptr);
                                                continue;
                                        }
                                } else {
                                        u32 tmp;
                                        if (!skb_copy_bits(skb, k, &tmp, 4)) {
                                                A = ntohl(tmp);
                                                continue;
                                        }
                                }
                                return 0;
 
                        case BPF_LD|BPF_H|BPF_ABS:
                                k = fentry->k;
load_h:
                                if(k >= 0 && (unsigned int) (k + sizeof(u16)) <= len) {
                                        A = ntohs(*(u16*)&data[k]);
                                        continue;
                                }
                                if (k<0) {
                                        u8 *ptr;
 
                                        if (k>=SKF_AD_OFF)
                                                break;
                                        if ((ptr = load_pointer(skb, k)) != NULL) {
                                                A = ntohs(*(u16*)ptr);
                                                continue;
                                        }
                                } else {
                                        u16 tmp;
                                        if (!skb_copy_bits(skb, k, &tmp, 2)) {
                                                A = ntohs(tmp);
                                                continue;
                                        }
                                }
                                return 0;
 
                        case BPF_LD|BPF_B|BPF_ABS:
                                k = fentry->k;
load_b:
                                if(k >= 0 && (unsigned int)k < len) {
                                        A = data[k];
                                        continue;
                                }
                                if (k<0) {
                                        u8 *ptr;
 
                                        if (k>=SKF_AD_OFF)
                                                break;
                                        if ((ptr = load_pointer(skb, k)) != NULL) {
                                                A = *ptr;
                                                continue;
                                        }
                                } else {
                                        u8 tmp;
                                        if (!skb_copy_bits(skb, k, &tmp, 1)) {
                                                A = tmp;
                                                continue;
                                        }
                                }
                                return 0;
 
                        case BPF_LD|BPF_W|BPF_LEN:
                                A = len;
                                continue;
 
                        case BPF_LDX|BPF_W|BPF_LEN:
                                X = len;
                                continue;
 
                        case BPF_LD|BPF_W|BPF_IND:
                                k = X + fentry->k;
                                goto load_w;
 
                       case BPF_LD|BPF_H|BPF_IND:
                                k = X + fentry->k;
                                goto load_h;
 
                       case BPF_LD|BPF_B|BPF_IND:
                                k = X + fentry->k;
                                goto load_b;
 
                        case BPF_LDX|BPF_B|BPF_MSH:
                                if(fentry->k >= len)
                                        return (0);
                                X = (data[fentry->k] & 0xf) << 2;
                                continue;
 
                        case BPF_LD|BPF_IMM:
                                A = fentry->k;
                                continue;
 
                        case BPF_LDX|BPF_IMM:
                                X = fentry->k;
                                continue;
 
                        case BPF_LD|BPF_MEM:
                                A = mem[fentry->k];
                                continue;
 
                        case BPF_LDX|BPF_MEM:
                                X = mem[fentry->k];
                                continue;
 
                        case BPF_MISC|BPF_TAX:
                                X = A;
                                continue;
 
                        case BPF_MISC|BPF_TXA:
                                A = X;
                                continue;
 
                        case BPF_RET|BPF_K:
                                return ((unsigned int)fentry->k);
 
                        case BPF_RET|BPF_A:
                                return ((unsigned int)A);
 
                        case BPF_ST:
                                mem[fentry->k] = A;
                                continue;
 
                        case BPF_STX:
                                mem[fentry->k] = X;
                                continue;
 
                        default:
                                /* Invalid instruction counts as RET */
                                return (0);
                }
 
                /* Handle ancillary data, which are impossible
                   (or very difficult) to get parsing packet contents.
                 */
                switch (k-SKF_AD_OFF) {
                case SKF_AD_PROTOCOL:
                        A = htons(skb->protocol);
                        continue;
                case SKF_AD_PKTTYPE:
                        A = skb->pkt_type;
                        continue;
                case SKF_AD_IFINDEX:
                        A = skb->dev->ifindex;
                        continue;
                default:
                        return 0;
                }
        }
 
        return (0);
}
 
/**
 *      sk_chk_filter - verify socket filter code
 *      @filter: filter to verify
 *      @flen: length of filter
 *
 * Check the user's filter code. If we let some ugly
 * filter code slip through kaboom! The filter must contain
 * no references or jumps that are out of range, no illegal instructions
 * and no backward jumps. It must end with a RET instruction
 *
 * Returns 0 if the rule set is legal or a negative errno code if not.
 */
 
int sk_chk_filter(struct sock_filter *filter, int flen)
{
        struct sock_filter *ftest;
        int pc;
 
        if ((unsigned int) flen >= (~0U / sizeof(struct sock_filter)))
                return -EINVAL;
 
       /*
        * Check the filter code now.
        */
        for(pc = 0; pc < flen; pc++)
        {
                /*
                 *      All jumps are forward as they are not signed
                 */
 
                ftest = &filter[pc];
                if(BPF_CLASS(ftest->code) == BPF_JMP)
                {
                        /*
                         *      But they mustn't jump off the end.
                         */
                        if(BPF_OP(ftest->code) == BPF_JA)
                        {
                                /* Note, the large ftest->k might cause
                                   loops. Compare this with conditional
                                   jumps below, where offsets are limited. --ANK (981016)
                                 */
                                if (ftest->k >= (unsigned)(flen-pc-1))
                                        return -EINVAL;
                        }
                        else
                        {
                                /*
                                 *      For conditionals both must be safe
                                 */
                                if(pc + ftest->jt +1 >= flen || pc + ftest->jf +1 >= flen)
                                        return -EINVAL;
                        }
                }
 
                /*
                 *      Check that memory operations use valid addresses.
                 */
 
                if (ftest->k >= BPF_MEMWORDS)
                {
                        /*
                         *      But it might not be a memory operation...
                         */
                        switch (ftest->code) {
                        case BPF_ST:
                        case BPF_STX:
                        case BPF_LD|BPF_MEM:
                        case BPF_LDX|BPF_MEM:
                                return -EINVAL;
                        }
                }
        }
 
        /*
         *      The program must end with a return. We don't care where they
         *      jumped within the script (its always forwards) but in the
         *      end they _will_ hit this.
         */
 
        return (BPF_CLASS(filter[flen - 1].code) == BPF_RET)?0:-EINVAL;
}
 
/**
 *      sk_attach_filter - attach a socket filter
 *      @fprog: the filter program
 *      @sk: the socket to use
 *
 * Attach the user's filter code. We first run some sanity checks on
 * it to make sure it does not explode on us later. If an error
 * occurs or there is insufficient memory for the filter a negative
 * errno code is returned. On success the return is zero.
 */
 
int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
{
        struct sk_filter *fp;
        unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
        int err;
 
        /* Make sure new filter is there and in the right amounts. */
        if (fprog->filter == NULL || fprog->len > BPF_MAXINSNS)
                return (-EINVAL);
 
        fp = (struct sk_filter *)sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
        if(fp == NULL)
                return (-ENOMEM);
 
        if (copy_from_user(fp->insns, fprog->filter, fsize)) {
                sock_kfree_s(sk, fp, fsize+sizeof(*fp));
                return -EFAULT;
        }
 
        atomic_set(&fp->refcnt, 1);
        fp->len = fprog->len;
 
        if ((err = sk_chk_filter(fp->insns, fp->len))==0) {
                struct sk_filter *old_fp;
 
                spin_lock_bh(&sk->lock.slock);
                old_fp = sk->filter;
                sk->filter = fp;
                spin_unlock_bh(&sk->lock.slock);
                fp = old_fp;
        }
 
        if (fp)
                sk_filter_release(sk, fp);
 
        return (err);
}
#endif /* CONFIG_FILTER */

Browse

Tools

Subversion Repositories or1k

[/] [or1k/] [trunk/] [linux/] [linux-2.4/] [net/] [core/] [filter.c] - Blame information for rev 1765

Line No.	Rev	Author	Line
1	1278	phoenix	`/*`
2			`* Linux Socket Filter - Kernel level socket filtering`
3			`*`
4			`* Author:`
5			`* Jay Schulist <jschlst@samba.org>`
6			`*`
7			`* Based on the design of:`
8			`* - The Berkeley Packet Filter`
9			`*`
10			`* This program is free software; you can redistribute it and/or`
11			`* modify it under the terms of the GNU General Public License`
12			`* as published by the Free Software Foundation; either version`
13			`* 2 of the License, or (at your option) any later version.`
14			`*`
15			`* Andi Kleen - Fix a few bad bugs and races.`
16			`*/`
17
18			`#include <linux/config.h>`
19			`#if defined(CONFIG_FILTER)`
20
21			`#include <linux/module.h>`
22			`#include <linux/types.h>`
23			`#include <linux/sched.h>`
24			`#include <linux/mm.h>`
25			`#include <linux/fcntl.h>`
26			`#include <linux/socket.h>`
27			`#include <linux/in.h>`
28			`#include <linux/inet.h>`
29			`#include <linux/netdevice.h>`
30			`#include <linux/if_packet.h>`
31			`#include <net/ip.h>`
32			`#include <net/protocol.h>`
33			`#include <linux/skbuff.h>`
34			`#include <net/sock.h>`
35			`#include <linux/errno.h>`
36			`#include <linux/timer.h>`
37			`#include <asm/system.h>`
38			`#include <asm/uaccess.h>`
39			`#include <linux/filter.h>`
40
41			`/* No hurry in this branch */`
42
43			`static u8 load_pointer(struct sk_buff skb, int k)`
44			`{`
45			`u8 *ptr = NULL;`
46
47			`if (k>=SKF_NET_OFF)`
48			`ptr = skb->nh.raw + k - SKF_NET_OFF;`
49			`else if (k>=SKF_LL_OFF)`
50			`ptr = skb->mac.raw + k - SKF_LL_OFF;`
51
52			`if (ptr >= skb->head && ptr < skb->tail)`
53			`return ptr;`
54			`return NULL;`
55			`}`
56
57			`/**`
58			`* sk_run_filter - run a filter on a socket`
59			`* @skb: buffer to run the filter on`
60			`* @filter: filter to apply`
61			`* @flen: length of filter`
62			`*`
63			`* Decode and apply filter instructions to the skb->data.`
64			`* Return length to keep, 0 for none. skb is the data we are`
65			`* filtering, filter is the array of filter instructions, and`
66			`* len is the number of filter blocks in the array.`
67			`*/`
68
69			`int sk_run_filter(struct sk_buff skb, struct sock_filter filter, int flen)`
70			`{`
71			`unsigned char *data = skb->data;`
72			`/* len is UNSIGNED. Byte wide insns relies only on implicit`
73			`type casts to prevent reading arbitrary memory locations.`
74			`*/`
75			`unsigned int len = skb->len-skb->data_len;`
76			`struct sock_filter fentry; / We walk down these */`
77			`u32 A = 0; /* Accumulator */`
78			`u32 X = 0; /* Index Register */`
79			`u32 mem[BPF_MEMWORDS]; /* Scratch Memory Store */`
80			`int k;`
81			`int pc;`
82
83			`/*`
84			`* Process array of filter instructions.`
85			`*/`
86
87			`for(pc = 0; pc < flen; pc++)`
88			`{`
89			`fentry = &filter[pc];`
90
91			`switch(fentry->code)`
92			`{`
93			`case BPF_ALU\|BPF_ADD\|BPF_X:`
94			`A += X;`
95			`continue;`
96
97			`case BPF_ALU\|BPF_ADD\|BPF_K:`
98			`A += fentry->k;`
99			`continue;`
100
101			`case BPF_ALU\|BPF_SUB\|BPF_X:`
102			`A -= X;`
103			`continue;`
104
105			`case BPF_ALU\|BPF_SUB\|BPF_K:`
106			`A -= fentry->k;`
107			`continue;`
108
109			`case BPF_ALU\|BPF_MUL\|BPF_X:`
110			`A *= X;`
111			`continue;`
112
113			`case BPF_ALU\|BPF_MUL\|BPF_K:`
114			`A *= fentry->k;`
115			`continue;`
116
117			`case BPF_ALU\|BPF_DIV\|BPF_X:`
118			`if(X == 0)`
119			`return (0);`
120			`A /= X;`
121			`continue;`
122
123			`case BPF_ALU\|BPF_DIV\|BPF_K:`
124			`if(fentry->k == 0)`
125			`return (0);`
126			`A /= fentry->k;`
127			`continue;`
128
129			`case BPF_ALU\|BPF_AND\|BPF_X:`
130			`A &= X;`
131			`continue;`
132
133			`case BPF_ALU\|BPF_AND\|BPF_K:`
134			`A &= fentry->k;`
135			`continue;`
136
137			`case BPF_ALU\|BPF_OR\|BPF_X:`
138			`A \|= X;`
139			`continue;`
140
141			`case BPF_ALU\|BPF_OR\|BPF_K:`
142			`A \|= fentry->k;`
143			`continue;`
144
145			`case BPF_ALU\|BPF_LSH\|BPF_X:`
146			`A <<= X;`
147			`continue;`
148
149			`case BPF_ALU\|BPF_LSH\|BPF_K:`
150			`A <<= fentry->k;`
151			`continue;`
152
153			`case BPF_ALU\|BPF_RSH\|BPF_X:`
154			`A >>= X;`
155			`continue;`
156
157			`case BPF_ALU\|BPF_RSH\|BPF_K:`
158			`A >>= fentry->k;`
159			`continue;`
160
161			`case BPF_ALU\|BPF_NEG:`
162			`A = -A;`
163			`continue;`
164
165			`case BPF_JMP\|BPF_JA:`
166			`pc += fentry->k;`
167			`continue;`
168
169			`case BPF_JMP\|BPF_JGT\|BPF_K:`
170			`pc += (A > fentry->k) ? fentry->jt : fentry->jf;`
171			`continue;`
172
173			`case BPF_JMP\|BPF_JGE\|BPF_K:`
174			`pc += (A >= fentry->k) ? fentry->jt : fentry->jf;`
175			`continue;`
176
177			`case BPF_JMP\|BPF_JEQ\|BPF_K:`
178			`pc += (A == fentry->k) ? fentry->jt : fentry->jf;`
179			`continue;`
180
181			`case BPF_JMP\|BPF_JSET\|BPF_K:`
182			`pc += (A & fentry->k) ? fentry->jt : fentry->jf;`
183			`continue;`
184
185			`case BPF_JMP\|BPF_JGT\|BPF_X:`
186			`pc += (A > X) ? fentry->jt : fentry->jf;`
187			`continue;`
188
189			`case BPF_JMP\|BPF_JGE\|BPF_X:`
190			`pc += (A >= X) ? fentry->jt : fentry->jf;`
191			`continue;`
192
193			`case BPF_JMP\|BPF_JEQ\|BPF_X:`
194			`pc += (A == X) ? fentry->jt : fentry->jf;`
195			`continue;`
196
197			`case BPF_JMP\|BPF_JSET\|BPF_X:`
198			`pc += (A & X) ? fentry->jt : fentry->jf;`
199			`continue;`
200
201			`case BPF_LD\|BPF_W\|BPF_ABS:`
202			`k = fentry->k;`
203			`load_w:`
204			`if(k >= 0 && (unsigned int)(k+sizeof(u32)) <= len) {`
205			`A = ntohl((u32)&data[k]);`
206			`continue;`
207			`}`
208			`if (k<0) {`
209			`u8 *ptr;`
210
211			`if (k>=SKF_AD_OFF)`
212			`break;`
213			`if ((ptr = load_pointer(skb, k)) != NULL) {`
214			`A = ntohl((u32)ptr);`
215			`continue;`
216			`}`
217			`} else {`
218			`u32 tmp;`
219			`if (!skb_copy_bits(skb, k, &tmp, 4)) {`
220			`A = ntohl(tmp);`
221			`continue;`
222			`}`
223			`}`
224			`return 0;`
225
226			`case BPF_LD\|BPF_H\|BPF_ABS:`
227			`k = fentry->k;`
228			`load_h:`
229			`if(k >= 0 && (unsigned int) (k + sizeof(u16)) <= len) {`
230			`A = ntohs((u16)&data[k]);`
231			`continue;`
232			`}`
233			`if (k<0) {`
234			`u8 *ptr;`
235
236			`if (k>=SKF_AD_OFF)`
237			`break;`
238			`if ((ptr = load_pointer(skb, k)) != NULL) {`
239			`A = ntohs((u16)ptr);`
240			`continue;`
241			`}`
242			`} else {`
243			`u16 tmp;`
244			`if (!skb_copy_bits(skb, k, &tmp, 2)) {`
245			`A = ntohs(tmp);`
246			`continue;`
247			`}`
248			`}`
249			`return 0;`
250
251			`case BPF_LD\|BPF_B\|BPF_ABS:`
252			`k = fentry->k;`
253			`load_b:`
254			`if(k >= 0 && (unsigned int)k < len) {`
255			`A = data[k];`
256			`continue;`
257			`}`
258			`if (k<0) {`
259			`u8 *ptr;`
260
261			`if (k>=SKF_AD_OFF)`
262			`break;`
263			`if ((ptr = load_pointer(skb, k)) != NULL) {`
264			`A = *ptr;`
265			`continue;`
266			`}`
267			`} else {`
268			`u8 tmp;`
269			`if (!skb_copy_bits(skb, k, &tmp, 1)) {`
270			`A = tmp;`
271			`continue;`
272			`}`
273			`}`
274			`return 0;`
275
276			`case BPF_LD\|BPF_W\|BPF_LEN:`
277			`A = len;`
278			`continue;`
279
280			`case BPF_LDX\|BPF_W\|BPF_LEN:`
281			`X = len;`
282			`continue;`
283
284			`case BPF_LD\|BPF_W\|BPF_IND:`
285			`k = X + fentry->k;`
286			`goto load_w;`
287
288			`case BPF_LD\|BPF_H\|BPF_IND:`
289			`k = X + fentry->k;`
290			`goto load_h;`
291
292			`case BPF_LD\|BPF_B\|BPF_IND:`
293			`k = X + fentry->k;`
294			`goto load_b;`
295
296			`case BPF_LDX\|BPF_B\|BPF_MSH:`
297			`if(fentry->k >= len)`
298			`return (0);`
299			`X = (data[fentry->k] & 0xf) << 2;`
300			`continue;`
301
302			`case BPF_LD\|BPF_IMM:`
303			`A = fentry->k;`
304			`continue;`
305
306			`case BPF_LDX\|BPF_IMM:`
307			`X = fentry->k;`
308			`continue;`
309
310			`case BPF_LD\|BPF_MEM:`
311			`A = mem[fentry->k];`
312			`continue;`
313
314			`case BPF_LDX\|BPF_MEM:`
315			`X = mem[fentry->k];`
316			`continue;`
317
318			`case BPF_MISC\|BPF_TAX:`
319			`X = A;`
320			`continue;`
321
322			`case BPF_MISC\|BPF_TXA:`
323			`A = X;`
324			`continue;`
325
326			`case BPF_RET\|BPF_K:`
327			`return ((unsigned int)fentry->k);`
328
329			`case BPF_RET\|BPF_A:`
330			`return ((unsigned int)A);`
331
332			`case BPF_ST:`
333			`mem[fentry->k] = A;`
334			`continue;`
335
336			`case BPF_STX:`
337			`mem[fentry->k] = X;`
338			`continue;`
339
340			`default:`
341			`/* Invalid instruction counts as RET */`
342			`return (0);`
343			`}`
344
345			`/* Handle ancillary data, which are impossible`
346			`(or very difficult) to get parsing packet contents.`
347			`*/`
348			`switch (k-SKF_AD_OFF) {`
349			`case SKF_AD_PROTOCOL:`
350			`A = htons(skb->protocol);`
351			`continue;`
352			`case SKF_AD_PKTTYPE:`
353			`A = skb->pkt_type;`
354			`continue;`
355			`case SKF_AD_IFINDEX:`
356			`A = skb->dev->ifindex;`
357			`continue;`
358			`default:`
359			`return 0;`
360			`}`
361			`}`
362
363			`return (0);`
364			`}`
365
366			`/**`
367			`* sk_chk_filter - verify socket filter code`
368			`* @filter: filter to verify`
369			`* @flen: length of filter`
370			`*`
371			`* Check the user's filter code. If we let some ugly`
372			`* filter code slip through kaboom! The filter must contain`
373			`* no references or jumps that are out of range, no illegal instructions`
374			`* and no backward jumps. It must end with a RET instruction`
375			`*`
376			`* Returns 0 if the rule set is legal or a negative errno code if not.`
377			`*/`
378
379			`int sk_chk_filter(struct sock_filter *filter, int flen)`
380			`{`
381			`struct sock_filter *ftest;`
382			`int pc;`
383
384			`if ((unsigned int) flen >= (~0U / sizeof(struct sock_filter)))`
385			`return -EINVAL;`
386
387			`/*`
388			`* Check the filter code now.`
389			`*/`
390			`for(pc = 0; pc < flen; pc++)`
391			`{`
392			`/*`
393			`* All jumps are forward as they are not signed`
394			`*/`
395
396			`ftest = &filter[pc];`
397			`if(BPF_CLASS(ftest->code) == BPF_JMP)`
398			`{`
399			`/*`
400			`* But they mustn't jump off the end.`
401			`*/`
402			`if(BPF_OP(ftest->code) == BPF_JA)`
403			`{`
404			`/* Note, the large ftest->k might cause`
405			`loops. Compare this with conditional`
406			`jumps below, where offsets are limited. --ANK (981016)`
407			`*/`
408			`if (ftest->k >= (unsigned)(flen-pc-1))`
409			`return -EINVAL;`
410			`}`
411			`else`
412			`{`
413			`/*`
414			`* For conditionals both must be safe`
415			`*/`
416			`if(pc + ftest->jt +1 >= flen \|\| pc + ftest->jf +1 >= flen)`
417			`return -EINVAL;`
418			`}`
419			`}`
420
421			`/*`
422			`* Check that memory operations use valid addresses.`
423			`*/`
424
425			`if (ftest->k >= BPF_MEMWORDS)`
426			`{`
427			`/*`
428			`* But it might not be a memory operation...`
429			`*/`
430			`switch (ftest->code) {`
431			`case BPF_ST:`
432			`case BPF_STX:`
433			`case BPF_LD\|BPF_MEM:`
434			`case BPF_LDX\|BPF_MEM:`
435			`return -EINVAL;`
436			`}`
437			`}`
438			`}`
439
440			`/*`
441			`* The program must end with a return. We don't care where they`
442			`* jumped within the script (its always forwards) but in the`
443			`* end they _will_ hit this.`
444			`*/`
445
446			`return (BPF_CLASS(filter[flen - 1].code) == BPF_RET)?0:-EINVAL;`
447			`}`
448
449			`/**`
450			`* sk_attach_filter - attach a socket filter`
451			`* @fprog: the filter program`
452			`* @sk: the socket to use`
453			`*`
454			`* Attach the user's filter code. We first run some sanity checks on`
455			`* it to make sure it does not explode on us later. If an error`
456			`* occurs or there is insufficient memory for the filter a negative`
457			`* errno code is returned. On success the return is zero.`
458			`*/`
459
460			`int sk_attach_filter(struct sock_fprog fprog, struct sock sk)`
461			`{`
462			`struct sk_filter *fp;`
463			`unsigned int fsize = sizeof(struct sock_filter) * fprog->len;`
464			`int err;`
465
466			`/* Make sure new filter is there and in the right amounts. */`
467			`if (fprog->filter == NULL \|\| fprog->len > BPF_MAXINSNS)`
468			`return (-EINVAL);`
469
470			`fp = (struct sk_filter )sock_kmalloc(sk, fsize+sizeof(fp), GFP_KERNEL);`
471			`if(fp == NULL)`
472			`return (-ENOMEM);`
473
474			`if (copy_from_user(fp->insns, fprog->filter, fsize)) {`
475			`sock_kfree_s(sk, fp, fsize+sizeof(*fp));`
476			`return -EFAULT;`
477			`}`
478
479			`atomic_set(&fp->refcnt, 1);`
480			`fp->len = fprog->len;`
481
482			`if ((err = sk_chk_filter(fp->insns, fp->len))==0) {`
483			`struct sk_filter *old_fp;`
484
485			`spin_lock_bh(&sk->lock.slock);`
486			`old_fp = sk->filter;`
487			`sk->filter = fp;`
488			`spin_unlock_bh(&sk->lock.slock);`
489			`fp = old_fp;`
490			`}`
491
492			`if (fp)`
493			`sk_filter_release(sk, fp);`
494
495			`return (err);`
496			`}`
497			`#endif /* CONFIG_FILTER */`