xt_check_entry_offsets(9)

💅 xt_check_entry_offsets(9) — Kernel API Manual, but make it make sense 💅

Hiii bestie, welcome to xt_check_entry_offsets(9) from the Kernel API Manual. This is the little validity-checker function for arp/ip/ip6t_entry, and yes, it is lowkey doing important gatekeeping work. 🫶

---

🌸 NAME 🌸

xt_check_entry_offsets — validate arp/ip/ip6t_entry

---

✨ SYNOPSIS ✨

int xt_check_entry_offsets (const void *base , const char *elems ,
       unsigned int target_offset , unsigned int next_offset );

---

🎀 ARGUMENTS 🎀

• base — pointer to arp/ip/ip6t_entry. This is the entry bestie in question. 💖
• elems — pointer to the first xt_entry_match, i.e. ip(6)t_entry->elems. It’s where the match structures start showing up. ✨
• target_offset — the arp/ip/ip6_t->target_offset. Yes, exactly that one.
• next_offset — the arp/ip/ip6_t->next_offset. Also exactly that one. No cap. 🎯

---

🦋 DESCRIPTION 🦋

Okay so what this function does is validate that target_offset and next_offset are sane, and that all match sizes (if any) align with the target offset. It’s giving “make sure the offsets aren’t cursed” energy. 💅

This function does not validate the targets or matches themselves, bestie. It only tests that all the offsets and sizes are correct, that all match structures are aligned, and that the last structure ends where the target structure begins. Periodt. 🎀

Also, peep xt_compat_check_entry_offsets for the CONFIG_NETFILTER_XTABLES_COMPAT version. iykyk. 🌈

The arp/ip/ip6t_entry structure base must have passed following tests:

• it must point to a valid memory location
• base to base + next_offset must be accessible, i.e. not exceed allocated length.

⚠️ Bestie, those two checks are non-negotiable. base has to be real and the whole base → base + next_offset range has to be accessible, not past the allocated length. 🫶

A well-formed entry looks like this:

       ip(6)t_entry   match [mtdata]  match [mtdata] target [tgdata]
       ip(6)t_entry e->elems[]-----'                              |
       | matchsize                      |               | matchsize      |
       | |               | target_offset---------------------------------'
       | next_offset---------------------------------------------------'

elems[]: flexible array member at end of ip(6)/arpt_entry struct. This is where matches (if any) and the target reside. target_offset: beginning of target. next_offset: start of the next rule; also: size of this rule. Since targets have a minimum size, target_offset + minlen <= next_offset. 💖

Every match stores its size, sum of sizes must not exceed target_offset. That part is literally the vibe check for match sizes. ✨

---

🌟 RETURN 🌟

0 on success, negative errno on failure. Slay when it’s zero, cry a little when it’s negative. 😭

---

🔥 SEE ALSO 🔥

Kernel file ./net/netfilter/x_tables.c — plus the whole related crew:

• xt_check_proc_name(9)
• xt_alloc_entry_offsets(9)
• xt_find_jump_offset(9)
• xt_copy_counters(9)
• xt_unregister_table_pre_exit(9)
• xt_unregister_table_exit(9)
• xt_hook_ops_alloc(9)
• xt_percpu_counter_alloc(9)

---

And that’s the page, bestie. The footer/source energy is ./net/netfilter, and the date stamp is October 2026. Bye-bye, go validate those offsets responsibly. 💖✨🎀🦋