net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12 #include <linux/capability.h>
  13 #include <linux/in.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/kmod.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/poison.h>
  20 #include <linux/icmpv6.h>
  21 #include <net/ipv6.h>
  22 #include <net/compat.h>
  23 #include <asm/uaccess.h>
  24 #include <linux/mutex.h>
  25 #include <linux/proc_fs.h>
  26 #include <linux/err.h>
  27 #include <linux/cpumask.h>
  28
  29 #include <linux/netfilter_ipv6/ip6_tables.h>
  30 #include <linux/netfilter/x_tables.h>
  31 #include <net/netfilter/nf_log.h>
  32 #include "../../netfilter/xt_repldata.h"
  33
  34 MODULE_LICENSE("GPL");
  35 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  36 MODULE_DESCRIPTION("IPv6 packet filter");
  37
  38 /*#define DEBUG_IP_FIREWALL*/
  39 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  40 /*#define DEBUG_IP_FIREWALL_USER*/
  41
  42 #ifdef DEBUG_IP_FIREWALL
  43 #define dprintf(format, args...)  printk(format , ## args)
  44 #else
  45 #define dprintf(format, args...)
  46 #endif
  47
  48 #ifdef DEBUG_IP_FIREWALL_USER
  49 #define duprintf(format, args...) printk(format , ## args)
  50 #else
  51 #define duprintf(format, args...)
  52 #endif
  53
  54 #ifdef CONFIG_NETFILTER_DEBUG
  55 #define IP_NF_ASSERT(x)                                         \
  56 do {                                                            \
  57         if (!(x))                                               \
  58                 printk("IP_NF_ASSERT: %s:%s:%u\n",              \
  59                        __func__, __FILE__, __LINE__);   \
  60 } while(0)
  61 #else
  62 #define IP_NF_ASSERT(x)
  63 #endif
  64
  65 #if 0
  66 /* All the better to debug you with... */
  67 #define static
  68 #define inline
  69 #endif
  70
  71 void *ip6t_alloc_initial_table(const struct xt_table *info)
  72 {
  73         return xt_alloc_initial_table(ip6t, IP6T);
  74 }
  75 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
  76
  77 /*
  78    We keep a set of rules for each CPU, so we can avoid write-locking
  79    them in the softirq when updating the counters and therefore
  80    only need to read-lock in the softirq; doing a write_lock_bh() in user
  81    context stops packets coming through and allows user context to read
  82    the counters or update the rules.
  83
  84    Hence the start of any table is given by get_table() below.  */
  85
  86 /* Check for an extension */
  87 int
  88 ip6t_ext_hdr(u8 nexthdr)
  89 {
  90         return ( (nexthdr == IPPROTO_HOPOPTS)   ||
  91                  (nexthdr == IPPROTO_ROUTING)   ||
  92                  (nexthdr == IPPROTO_FRAGMENT)  ||
  93                  (nexthdr == IPPROTO_ESP)       ||
  94                  (nexthdr == IPPROTO_AH)        ||
  95                  (nexthdr == IPPROTO_NONE)      ||
  96                  (nexthdr == IPPROTO_DSTOPTS) );
  97 }
  98
  99 /* Returns whether matches rule or not. */
 100 /* Performance critical - called for every packet */
 101 static inline bool
 102 ip6_packet_match(const struct sk_buff *skb,
 103                  const char *indev,
 104                  const char *outdev,
 105                  const struct ip6t_ip6 *ip6info,
 106                  unsigned int *protoff,
 107                  int *fragoff, bool *hotdrop)
 108 {
 109         unsigned long ret;
 110         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
 111
 112 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
 113
 114         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 115                                        &ip6info->src), IP6T_INV_SRCIP) ||
 116             FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 117                                        &ip6info->dst), IP6T_INV_DSTIP)) {
 118                 dprintf("Source or dest mismatch.\n");
 119 /*
 120                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 121                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 122                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 123                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 124                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 125                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 126                 return false;
 127         }
 128
 129         ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 130
 131         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 132                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 133                         indev, ip6info->iniface,
 134                         ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
 135                 return false;
 136         }
 137
 138         ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 139
 140         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 141                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 142                         outdev, ip6info->outiface,
 143                         ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
 144                 return false;
 145         }
 146
 147 /* ... might want to do something with class and flowlabel here ... */
 148
 149         /* look for the desired protocol header */
 150         if((ip6info->flags & IP6T_F_PROTO)) {
 151                 int protohdr;
 152                 unsigned short _frag_off;
 153
 154                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
 155                 if (protohdr < 0) {
 156                         if (_frag_off == 0)
 157                                 *hotdrop = true;
 158                         return false;
 159                 }
 160                 *fragoff = _frag_off;
 161
 162                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 163                                 protohdr,
 164                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 165                                 ip6info->proto);
 166
 167                 if (ip6info->proto == protohdr) {
 168                         if(ip6info->invflags & IP6T_INV_PROTO) {
 169                                 return false;
 170                         }
 171                         return true;
 172                 }
 173
 174                 /* We need match for the '-p all', too! */
 175                 if ((ip6info->proto != 0) &&
 176                         !(ip6info->invflags & IP6T_INV_PROTO))
 177                         return false;
 178         }
 179         return true;
 180 }
 181
 182 /* should be ip6 safe */
 183 static bool
 184 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 185 {
 186         if (ipv6->flags & ~IP6T_F_MASK) {
 187                 duprintf("Unknown flag bits set: %08X\n",
 188                          ipv6->flags & ~IP6T_F_MASK);
 189                 return false;
 190         }
 191         if (ipv6->invflags & ~IP6T_INV_MASK) {
 192                 duprintf("Unknown invflag bits set: %08X\n",
 193                          ipv6->invflags & ~IP6T_INV_MASK);
 194                 return false;
 195         }
 196         return true;
 197 }
 198
 199 static unsigned int
 200 ip6t_error(struct sk_buff *skb, const struct xt_target_param *par)
 201 {
 202         if (net_ratelimit())
 203                 printk("ip6_tables: error: `%s'\n",
 204                        (const char *)par->targinfo);
 205
 206         return NF_DROP;
 207 }
 208
 209 /* Performance critical - called for every packet */
 210 static inline bool
 211 do_match(const struct ip6t_entry_match *m, const struct sk_buff *skb,
 212          struct xt_match_param *par)
 213 {
 214         par->match     = m->u.kernel.match;
 215         par->matchinfo = m->data;
 216
 217         /* Stop iteration if it doesn't match */
 218         if (!m->u.kernel.match->match(skb, par))
 219                 return true;
 220         else
 221                 return false;
 222 }
 223
 224 static inline struct ip6t_entry *
 225 get_entry(const void *base, unsigned int offset)
 226 {
 227         return (struct ip6t_entry *)(base + offset);
 228 }
 229
 230 /* All zeroes == unconditional rule. */
 231 /* Mildly perf critical (only if packet tracing is on) */
 232 static inline bool unconditional(const struct ip6t_ip6 *ipv6)
 233 {
 234         static const struct ip6t_ip6 uncond;
 235
 236         return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 237 }
 238
 239 static inline const struct ip6t_entry_target *
 240 ip6t_get_target_c(const struct ip6t_entry *e)
 241 {
 242         return ip6t_get_target((struct ip6t_entry *)e);
 243 }
 244
 245 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 246     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 247 /* This cries for unification! */
 248 static const char *const hooknames[] = {
 249         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 250         [NF_INET_LOCAL_IN]              = "INPUT",
 251         [NF_INET_FORWARD]               = "FORWARD",
 252         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 253         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 254 };
 255
 256 enum nf_ip_trace_comments {
 257         NF_IP6_TRACE_COMMENT_RULE,
 258         NF_IP6_TRACE_COMMENT_RETURN,
 259         NF_IP6_TRACE_COMMENT_POLICY,
 260 };
 261
 262 static const char *const comments[] = {
 263         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
 264         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
 265         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
 266 };
 267
 268 static struct nf_loginfo trace_loginfo = {
 269         .type = NF_LOG_TYPE_LOG,
 270         .u = {
 271                 .log = {
 272                         .level = 4,
 273                         .logflags = NF_LOG_MASK,
 274                 },
 275         },
 276 };
 277
 278 /* Mildly perf critical (only if packet tracing is on) */
 279 static inline int
 280 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
 281                       const char *hookname, const char **chainname,
 282                       const char **comment, unsigned int *rulenum)
 283 {
 284         const struct ip6t_standard_target *t = (void *)ip6t_get_target_c(s);
 285
 286         if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
 287                 /* Head of user chain: ERROR target with chainname */
 288                 *chainname = t->target.data;
 289                 (*rulenum) = 0;
 290         } else if (s == e) {
 291                 (*rulenum)++;
 292
 293                 if (s->target_offset == sizeof(struct ip6t_entry) &&
 294                     strcmp(t->target.u.kernel.target->name,
 295                            IP6T_STANDARD_TARGET) == 0 &&
 296                     t->verdict < 0 &&
 297                     unconditional(&s->ipv6)) {
 298                         /* Tail of chains: STANDARD target (return/policy) */
 299                         *comment = *chainname == hookname
 300                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
 301                                 : comments[NF_IP6_TRACE_COMMENT_RETURN];
 302                 }
 303                 return 1;
 304         } else
 305                 (*rulenum)++;
 306
 307         return 0;
 308 }
 309
 310 static void trace_packet(const struct sk_buff *skb,
 311                          unsigned int hook,
 312                          const struct net_device *in,
 313                          const struct net_device *out,
 314                          const char *tablename,
 315                          const struct xt_table_info *private,
 316                          const struct ip6t_entry *e)
 317 {
 318         const void *table_base;
 319         const struct ip6t_entry *root;
 320         const char *hookname, *chainname, *comment;
 321         unsigned int rulenum = 0;
 322
 323         table_base = private->entries[smp_processor_id()];
 324         root = get_entry(table_base, private->hook_entry[hook]);
 325
 326         hookname = chainname = hooknames[hook];
 327         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 328
 329         IP6T_ENTRY_ITERATE(root,
 330                            private->size - private->hook_entry[hook],
 331                            get_chainname_rulenum,
 332                            e, hookname, &chainname, &comment, &rulenum);
 333
 334         nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
 335                       "TRACE: %s:%s:%s:%u ",
 336                       tablename, chainname, comment, rulenum);
 337 }
 338 #endif
 339
 340 static inline __pure struct ip6t_entry *
 341 ip6t_next_entry(const struct ip6t_entry *entry)
 342 {
 343         return (void *)entry + entry->next_offset;
 344 }
 345
 346 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 347 unsigned int
 348 ip6t_do_table(struct sk_buff *skb,
 349               unsigned int hook,
 350               const struct net_device *in,
 351               const struct net_device *out,
 352               struct xt_table *table)
 353 {
 354 #define tb_comefrom ((struct ip6t_entry *)table_base)->comefrom
 355
 356         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 357         bool hotdrop = false;
 358         /* Initializing verdict to NF_DROP keeps gcc happy. */
 359         unsigned int verdict = NF_DROP;
 360         const char *indev, *outdev;
 361         const void *table_base;
 362         struct ip6t_entry *e, *back;
 363         const struct xt_table_info *private;
 364         struct xt_match_param mtpar;
 365         struct xt_target_param tgpar;
 366
 367         /* Initialization */
 368         indev = in ? in->name : nulldevname;
 369         outdev = out ? out->name : nulldevname;
 370         /* We handle fragments by dealing with the first fragment as
 371          * if it was a normal packet.  All other fragments are treated
 372          * normally, except that they will NEVER match rules that ask
 373          * things we don't know, ie. tcp syn flag or ports).  If the
 374          * rule is also a fragment-specific rule, non-fragments won't
 375          * match it. */
 376         mtpar.hotdrop = &hotdrop;
 377         mtpar.in      = tgpar.in  = in;
 378         mtpar.out     = tgpar.out = out;
 379         mtpar.family  = tgpar.family = NFPROTO_IPV6;
 380         mtpar.hooknum = tgpar.hooknum = hook;
 381
 382         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 383
 384         xt_info_rdlock_bh();
 385         private = table->private;
 386         table_base = private->entries[smp_processor_id()];
 387
 388         e = get_entry(table_base, private->hook_entry[hook]);
 389
 390         /* For return from builtin chain */
 391         back = get_entry(table_base, private->underflow[hook]);
 392
 393         do {
 394                 const struct ip6t_entry_target *t;
 395
 396                 IP_NF_ASSERT(e);
 397                 IP_NF_ASSERT(back);
 398                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
 399                     &mtpar.thoff, &mtpar.fragoff, &hotdrop) ||
 400                     IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
 401                         e = ip6t_next_entry(e);
 402                         continue;
 403                 }
 404
 405                 ADD_COUNTER(e->counters,
 406                             ntohs(ipv6_hdr(skb)->payload_len) +
 407                             sizeof(struct ipv6hdr), 1);
 408
 409                 t = ip6t_get_target_c(e);
 410                 IP_NF_ASSERT(t->u.kernel.target);
 411
 412 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 413     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 414                 /* The packet is traced: log it */
 415                 if (unlikely(skb->nf_trace))
 416                         trace_packet(skb, hook, in, out,
 417                                      table->name, private, e);
 418 #endif
 419                 /* Standard target? */
 420                 if (!t->u.kernel.target->target) {
 421                         int v;
 422
 423                         v = ((struct ip6t_standard_target *)t)->verdict;
 424                         if (v < 0) {
 425                                 /* Pop from stack? */
 426                                 if (v != IP6T_RETURN) {
 427                                         verdict = (unsigned)(-v) - 1;
 428                                         break;
 429                                 }
 430                                 e = back;
 431                                 back = get_entry(table_base, back->comefrom);
 432                                 continue;
 433                         }
 434                         if (table_base + v != ip6t_next_entry(e) &&
 435                             !(e->ipv6.flags & IP6T_F_GOTO)) {
 436                                 /* Save old back ptr in next entry */
 437                                 struct ip6t_entry *next = ip6t_next_entry(e);
 438                                 next->comefrom = (void *)back - table_base;
 439                                 /* set back pointer to next entry */
 440                                 back = next;
 441                         }
 442
 443                         e = get_entry(table_base, v);
 444                         continue;
 445                 }
 446
 447                 /* Targets which reenter must return
 448                    abs. verdicts */
 449                 tgpar.target   = t->u.kernel.target;
 450                 tgpar.targinfo = t->data;
 451
 452 #ifdef CONFIG_NETFILTER_DEBUG
 453                 tb_comefrom = 0xeeeeeeec;
 454 #endif
 455                 verdict = t->u.kernel.target->target(skb, &tgpar);
 456
 457 #ifdef CONFIG_NETFILTER_DEBUG
 458                 if (tb_comefrom != 0xeeeeeeec && verdict == IP6T_CONTINUE) {
 459                         printk("Target %s reentered!\n",
 460                                t->u.kernel.target->name);
 461                         verdict = NF_DROP;
 462                 }
 463                 tb_comefrom = 0x57acc001;
 464 #endif
 465                 if (verdict == IP6T_CONTINUE)
 466                         e = ip6t_next_entry(e);
 467                 else
 468                         /* Verdict */
 469                         break;
 470         } while (!hotdrop);
 471
 472 #ifdef CONFIG_NETFILTER_DEBUG
 473         tb_comefrom = NETFILTER_LINK_POISON;
 474 #endif
 475         xt_info_rdunlock_bh();
 476
 477 #ifdef DEBUG_ALLOW_ALL
 478         return NF_ACCEPT;
 479 #else
 480         if (hotdrop)
 481                 return NF_DROP;
 482         else return verdict;
 483 #endif
 484
 485 #undef tb_comefrom
 486 }
 487
 488 /* Figures out from what hook each rule can be called: returns 0 if
 489    there are loops.  Puts hook bitmask in comefrom. */
 490 static int
 491 mark_source_chains(const struct xt_table_info *newinfo,
 492                    unsigned int valid_hooks, void *entry0)
 493 {
 494         unsigned int hook;
 495
 496         /* No recursion; use packet counter to save back ptrs (reset
 497            to 0 as we leave), and comefrom to save source hook bitmask */
 498         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 499                 unsigned int pos = newinfo->hook_entry[hook];
 500                 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
 501
 502                 if (!(valid_hooks & (1 << hook)))
 503                         continue;
 504
 505                 /* Set initial back pointer. */
 506                 e->counters.pcnt = pos;
 507
 508                 for (;;) {
 509                         const struct ip6t_standard_target *t
 510                                 = (void *)ip6t_get_target_c(e);
 511                         int visited = e->comefrom & (1 << hook);
 512
 513                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 514                                 printk("iptables: loop hook %u pos %u %08X.\n",
 515                                        hook, pos, e->comefrom);
 516                                 return 0;
 517                         }
 518                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 519
 520                         /* Unconditional return/END. */
 521                         if ((e->target_offset == sizeof(struct ip6t_entry) &&
 522                              (strcmp(t->target.u.user.name,
 523                                      IP6T_STANDARD_TARGET) == 0) &&
 524                              t->verdict < 0 &&
 525                              unconditional(&e->ipv6)) || visited) {
 526                                 unsigned int oldpos, size;
 527
 528                                 if ((strcmp(t->target.u.user.name,
 529                                             IP6T_STANDARD_TARGET) == 0) &&
 530                                     t->verdict < -NF_MAX_VERDICT - 1) {
 531                                         duprintf("mark_source_chains: bad "
 532                                                 "negative verdict (%i)\n",
 533                                                                 t->verdict);
 534                                         return 0;
 535                                 }
 536
 537                                 /* Return: backtrack through the last
 538                                    big jump. */
 539                                 do {
 540                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 541 #ifdef DEBUG_IP_FIREWALL_USER
 542                                         if (e->comefrom
 543                                             & (1 << NF_INET_NUMHOOKS)) {
 544                                                 duprintf("Back unset "
 545                                                          "on hook %u "
 546                                                          "rule %u\n",
 547                                                          hook, pos);
 548                                         }
 549 #endif
 550                                         oldpos = pos;
 551                                         pos = e->counters.pcnt;
 552                                         e->counters.pcnt = 0;
 553
 554                                         /* We're at the start. */
 555                                         if (pos == oldpos)
 556                                                 goto next;
 557
 558                                         e = (struct ip6t_entry *)
 559                                                 (entry0 + pos);
 560                                 } while (oldpos == pos + e->next_offset);
 561
 562                                 /* Move along one */
 563                                 size = e->next_offset;
 564                                 e = (struct ip6t_entry *)
 565                                         (entry0 + pos + size);
 566                                 e->counters.pcnt = pos;
 567                                 pos += size;
 568                         } else {
 569                                 int newpos = t->verdict;
 570
 571                                 if (strcmp(t->target.u.user.name,
 572                                            IP6T_STANDARD_TARGET) == 0 &&
 573                                     newpos >= 0) {
 574                                         if (newpos > newinfo->size -
 575                                                 sizeof(struct ip6t_entry)) {
 576                                                 duprintf("mark_source_chains: "
 577                                                         "bad verdict (%i)\n",
 578                                                                 newpos);
 579                                                 return 0;
 580                                         }
 581                                         /* This a jump; chase it. */
 582                                         duprintf("Jump rule %u -> %u\n",
 583                                                  pos, newpos);
 584                                 } else {
 585                                         /* ... this is a fallthru */
 586                                         newpos = pos + e->next_offset;
 587                                 }
 588                                 e = (struct ip6t_entry *)
 589                                         (entry0 + newpos);
 590                                 e->counters.pcnt = pos;
 591                                 pos = newpos;
 592                         }
 593                 }
 594                 next:
 595                 duprintf("Finished chain %u\n", hook);
 596         }
 597         return 1;
 598 }
 599
 600 static int
 601 cleanup_match(struct ip6t_entry_match *m, struct net *net, unsigned int *i)
 602 {
 603         struct xt_mtdtor_param par;
 604
 605         if (i && (*i)-- == 0)
 606                 return 1;
 607
 608         par.net       = net;
 609         par.match     = m->u.kernel.match;
 610         par.matchinfo = m->data;
 611         par.family    = NFPROTO_IPV6;
 612         if (par.match->destroy != NULL)
 613                 par.match->destroy(&par);
 614         module_put(par.match->me);
 615         return 0;
 616 }
 617
 618 static int
 619 check_entry(const struct ip6t_entry *e, const char *name)
 620 {
 621         const struct ip6t_entry_target *t;
 622
 623         if (!ip6_checkentry(&e->ipv6)) {
 624                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 625                 return -EINVAL;
 626         }
 627
 628         if (e->target_offset + sizeof(struct ip6t_entry_target) >
 629             e->next_offset)
 630                 return -EINVAL;
 631
 632         t = ip6t_get_target_c(e);
 633         if (e->target_offset + t->u.target_size > e->next_offset)
 634                 return -EINVAL;
 635
 636         return 0;
 637 }
 638
 639 static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
 640                        unsigned int *i)
 641 {
 642         const struct ip6t_ip6 *ipv6 = par->entryinfo;
 643         int ret;
 644
 645         par->match     = m->u.kernel.match;
 646         par->matchinfo = m->data;
 647
 648         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 649                              ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
 650         if (ret < 0) {
 651                 duprintf("ip_tables: check failed for `%s'.\n",
 652                          par.match->name);
 653                 return ret;
 654         }
 655         ++*i;
 656         return 0;
 657 }
 658
 659 static int
 660 find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
 661                  unsigned int *i)
 662 {
 663         struct xt_match *match;
 664         int ret;
 665
 666         match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
 667                                                       m->u.user.revision),
 668                                         "ip6t_%s", m->u.user.name);
 669         if (IS_ERR(match) || !match) {
 670                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 671                 return match ? PTR_ERR(match) : -ENOENT;
 672         }
 673         m->u.kernel.match = match;
 674
 675         ret = check_match(m, par, i);
 676         if (ret)
 677                 goto err;
 678
 679         return 0;
 680 err:
 681         module_put(m->u.kernel.match->me);
 682         return ret;
 683 }
 684
 685 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 686 {
 687         struct ip6t_entry_target *t = ip6t_get_target(e);
 688         struct xt_tgchk_param par = {
 689                 .net       = net,
 690                 .table     = name,
 691                 .entryinfo = e,
 692                 .target    = t->u.kernel.target,
 693                 .targinfo  = t->data,
 694                 .hook_mask = e->comefrom,
 695                 .family    = NFPROTO_IPV6,
 696         };
 697         int ret;
 698
 699         t = ip6t_get_target(e);
 700         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 701               e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
 702         if (ret < 0) {
 703                 duprintf("ip_tables: check failed for `%s'.\n",
 704                          t->u.kernel.target->name);
 705                 return ret;
 706         }
 707         return 0;
 708 }
 709
 710 static int
 711 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 712                  unsigned int size, unsigned int *i)
 713 {
 714         struct ip6t_entry_target *t;
 715         struct xt_target *target;
 716         int ret;
 717         unsigned int j;
 718         struct xt_mtchk_param mtpar;
 719
 720         ret = check_entry(e, name);
 721         if (ret)
 722                 return ret;
 723
 724         j = 0;
 725         mtpar.net       = net;
 726         mtpar.table     = name;
 727         mtpar.entryinfo = &e->ipv6;
 728         mtpar.hook_mask = e->comefrom;
 729         mtpar.family    = NFPROTO_IPV6;
 730         ret = IP6T_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
 731         if (ret != 0)
 732                 goto cleanup_matches;
 733
 734         t = ip6t_get_target(e);
 735         target = try_then_request_module(xt_find_target(AF_INET6,
 736                                                         t->u.user.name,
 737                                                         t->u.user.revision),
 738                                          "ip6t_%s", t->u.user.name);
 739         if (IS_ERR(target) || !target) {
 740                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 741                 ret = target ? PTR_ERR(target) : -ENOENT;
 742                 goto cleanup_matches;
 743         }
 744         t->u.kernel.target = target;
 745
 746         ret = check_target(e, net, name);
 747         if (ret)
 748                 goto err;
 749
 750         (*i)++;
 751         return 0;
 752  err:
 753         module_put(t->u.kernel.target->me);
 754  cleanup_matches:
 755         IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
 756         return ret;
 757 }
 758
 759 static bool check_underflow(const struct ip6t_entry *e)
 760 {
 761         const struct ip6t_entry_target *t;
 762         unsigned int verdict;
 763
 764         if (!unconditional(&e->ipv6))
 765                 return false;
 766         t = ip6t_get_target_c(e);
 767         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 768                 return false;
 769         verdict = ((struct ip6t_standard_target *)t)->verdict;
 770         verdict = -verdict - 1;
 771         return verdict == NF_DROP || verdict == NF_ACCEPT;
 772 }
 773
 774 static int
 775 check_entry_size_and_hooks(struct ip6t_entry *e,
 776                            struct xt_table_info *newinfo,
 777                            const unsigned char *base,
 778                            const unsigned char *limit,
 779                            const unsigned int *hook_entries,
 780                            const unsigned int *underflows,
 781                            unsigned int valid_hooks,
 782                            unsigned int *i)
 783 {
 784         unsigned int h;
 785
 786         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
 787             (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
 788                 duprintf("Bad offset %p\n", e);
 789                 return -EINVAL;
 790         }
 791
 792         if (e->next_offset
 793             < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
 794                 duprintf("checking: element %p size %u\n",
 795                          e, e->next_offset);
 796                 return -EINVAL;
 797         }
 798
 799         /* Check hooks & underflows */
 800         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 801                 if (!(valid_hooks & (1 << h)))
 802                         continue;
 803                 if ((unsigned char *)e - base == hook_entries[h])
 804                         newinfo->hook_entry[h] = hook_entries[h];
 805                 if ((unsigned char *)e - base == underflows[h]) {
 806                         if (!check_underflow(e)) {
 807                                 pr_err("Underflows must be unconditional and "
 808                                        "use the STANDARD target with "
 809                                        "ACCEPT/DROP\n");
 810                                 return -EINVAL;
 811                         }
 812                         newinfo->underflow[h] = underflows[h];
 813                 }
 814         }
 815
 816         /* Clear counters and comefrom */
 817         e->counters = ((struct xt_counters) { 0, 0 });
 818         e->comefrom = 0;
 819
 820         (*i)++;
 821         return 0;
 822 }
 823
 824 static int
 825 cleanup_entry(struct ip6t_entry *e, struct net *net, unsigned int *i)
 826 {
 827         struct xt_tgdtor_param par;
 828         struct ip6t_entry_target *t;
 829
 830         if (i && (*i)-- == 0)
 831                 return 1;
 832
 833         /* Cleanup all matches */
 834         IP6T_MATCH_ITERATE(e, cleanup_match, net, NULL);
 835         t = ip6t_get_target(e);
 836
 837         par.net      = net;
 838         par.target   = t->u.kernel.target;
 839         par.targinfo = t->data;
 840         par.family   = NFPROTO_IPV6;
 841         if (par.target->destroy != NULL)
 842                 par.target->destroy(&par);
 843         module_put(par.target->me);
 844         return 0;
 845 }
 846
 847 /* Checks and translates the user-supplied table segment (held in
 848    newinfo) */
 849 static int
 850 translate_table(struct net *net,
 851                 const char *name,
 852                 unsigned int valid_hooks,
 853                 struct xt_table_info *newinfo,
 854                 void *entry0,
 855                 unsigned int size,
 856                 unsigned int number,
 857                 const unsigned int *hook_entries,
 858                 const unsigned int *underflows)
 859 {
 860         unsigned int i;
 861         int ret;
 862
 863         newinfo->size = size;
 864         newinfo->number = number;
 865
 866         /* Init all hooks to impossible value. */
 867         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 868                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 869                 newinfo->underflow[i] = 0xFFFFFFFF;
 870         }
 871
 872         duprintf("translate_table: size %u\n", newinfo->size);
 873         i = 0;
 874         /* Walk through entries, checking offsets. */
 875         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 876                                 check_entry_size_and_hooks,
 877                                 newinfo,
 878                                 entry0,
 879                                 entry0 + size,
 880                                 hook_entries, underflows, valid_hooks, &i);
 881         if (ret != 0)
 882                 return ret;
 883
 884         if (i != number) {
 885                 duprintf("translate_table: %u not %u entries\n",
 886                          i, number);
 887                 return -EINVAL;
 888         }
 889
 890         /* Check hooks all assigned */
 891         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 892                 /* Only hooks which are valid */
 893                 if (!(valid_hooks & (1 << i)))
 894                         continue;
 895                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 896                         duprintf("Invalid hook entry %u %u\n",
 897                                  i, hook_entries[i]);
 898                         return -EINVAL;
 899                 }
 900                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 901                         duprintf("Invalid underflow %u %u\n",
 902                                  i, underflows[i]);
 903                         return -EINVAL;
 904                 }
 905         }
 906
 907         if (!mark_source_chains(newinfo, valid_hooks, entry0))
 908                 return -ELOOP;
 909
 910         /* Finally, each sanity check must pass */
 911         i = 0;
 912         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 913                                 find_check_entry, net, name, size, &i);
 914
 915         if (ret != 0) {
 916                 IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 917                                    cleanup_entry, net, &i);
 918                 return ret;
 919         }
 920
 921         /* And one copy for every other CPU */
 922         for_each_possible_cpu(i) {
 923                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 924                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 925         }
 926
 927         return ret;
 928 }
 929
 930 /* Gets counters. */
 931 static inline int
 932 add_entry_to_counter(const struct ip6t_entry *e,
 933                      struct xt_counters total[],
 934                      unsigned int *i)
 935 {
 936         ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 937
 938         (*i)++;
 939         return 0;
 940 }
 941
 942 static inline int
 943 set_entry_to_counter(const struct ip6t_entry *e,
 944                      struct ip6t_counters total[],
 945                      unsigned int *i)
 946 {
 947         SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 948
 949         (*i)++;
 950         return 0;
 951 }
 952
 953 static void
 954 get_counters(const struct xt_table_info *t,
 955              struct xt_counters counters[])
 956 {
 957         unsigned int cpu;
 958         unsigned int i;
 959         unsigned int curcpu;
 960
 961         /* Instead of clearing (by a previous call to memset())
 962          * the counters and using adds, we set the counters
 963          * with data used by 'current' CPU
 964          *
 965          * Bottom half has to be disabled to prevent deadlock
 966          * if new softirq were to run and call ipt_do_table
 967          */
 968         local_bh_disable();
 969         curcpu = smp_processor_id();
 970
 971         i = 0;
 972         IP6T_ENTRY_ITERATE(t->entries[curcpu],
 973                            t->size,
 974                            set_entry_to_counter,
 975                            counters,
 976                            &i);
 977
 978         for_each_possible_cpu(cpu) {
 979                 if (cpu == curcpu)
 980                         continue;
 981                 i = 0;
 982                 xt_info_wrlock(cpu);
 983                 IP6T_ENTRY_ITERATE(t->entries[cpu],
 984                                   t->size,
 985                                   add_entry_to_counter,
 986                                   counters,
 987                                   &i);
 988                 xt_info_wrunlock(cpu);
 989         }
 990         local_bh_enable();
 991 }
 992
 993 static struct xt_counters *alloc_counters(const struct xt_table *table)
 994 {
 995         unsigned int countersize;
 996         struct xt_counters *counters;
 997         const struct xt_table_info *private = table->private;
 998
 999         /* We need atomic snapshot of counters: rest doesn't change
1000            (other than comefrom, which userspace doesn't care
1001            about). */
1002         countersize = sizeof(struct xt_counters) * private->number;
1003         counters = vmalloc_node(countersize, numa_node_id());
1004
1005         if (counters == NULL)
1006                 return ERR_PTR(-ENOMEM);
1007
1008         get_counters(private, counters);
1009
1010         return counters;
1011 }
1012
1013 static int
1014 copy_entries_to_user(unsigned int total_size,
1015                      const struct xt_table *table,
1016                      void __user *userptr)
1017 {
1018         unsigned int off, num;
1019         const struct ip6t_entry *e;
1020         struct xt_counters *counters;
1021         const struct xt_table_info *private = table->private;
1022         int ret = 0;
1023         const void *loc_cpu_entry;
1024
1025         counters = alloc_counters(table);
1026         if (IS_ERR(counters))
1027                 return PTR_ERR(counters);
1028
1029         /* choose the copy that is on our node/cpu, ...
1030          * This choice is lazy (because current thread is
1031          * allowed to migrate to another cpu)
1032          */
1033         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1034         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
1035                 ret = -EFAULT;
1036                 goto free_counters;
1037         }
1038
1039         /* FIXME: use iterator macros --RR */
1040         /* ... then go back and fix counters and names */
1041         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
1042                 unsigned int i;
1043                 const struct ip6t_entry_match *m;
1044                 const struct ip6t_entry_target *t;
1045
1046                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
1047                 if (copy_to_user(userptr + off
1048                                  + offsetof(struct ip6t_entry, counters),
1049                                  &counters[num],
1050                                  sizeof(counters[num])) != 0) {
1051                         ret = -EFAULT;
1052                         goto free_counters;
1053                 }
1054
1055                 for (i = sizeof(struct ip6t_entry);
1056                      i < e->target_offset;
1057                      i += m->u.match_size) {
1058                         m = (void *)e + i;
1059
1060                         if (copy_to_user(userptr + off + i
1061                                          + offsetof(struct ip6t_entry_match,
1062                                                     u.user.name),
1063                                          m->u.kernel.match->name,
1064                                          strlen(m->u.kernel.match->name)+1)
1065                             != 0) {
1066                                 ret = -EFAULT;
1067                                 goto free_counters;
1068                         }
1069                 }
1070
1071                 t = ip6t_get_target_c(e);
1072                 if (copy_to_user(userptr + off + e->target_offset
1073                                  + offsetof(struct ip6t_entry_target,
1074                                             u.user.name),
1075                                  t->u.kernel.target->name,
1076                                  strlen(t->u.kernel.target->name)+1) != 0) {
1077                         ret = -EFAULT;
1078                         goto free_counters;
1079                 }
1080         }
1081
1082  free_counters:
1083         vfree(counters);
1084         return ret;
1085 }
1086
1087 #ifdef CONFIG_COMPAT
1088 static void compat_standard_from_user(void *dst, const void *src)
1089 {
1090         int v = *(compat_int_t *)src;
1091
1092         if (v > 0)
1093                 v += xt_compat_calc_jump(AF_INET6, v);
1094         memcpy(dst, &v, sizeof(v));
1095 }
1096
1097 static int compat_standard_to_user(void __user *dst, const void *src)
1098 {
1099         compat_int_t cv = *(int *)src;
1100
1101         if (cv > 0)
1102                 cv -= xt_compat_calc_jump(AF_INET6, cv);
1103         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1104 }
1105
1106 static inline int
1107 compat_calc_match(const struct ip6t_entry_match *m, int *size)
1108 {
1109         *size += xt_compat_match_offset(m->u.kernel.match);
1110         return 0;
1111 }
1112
1113 static int compat_calc_entry(const struct ip6t_entry *e,
1114                              const struct xt_table_info *info,
1115                              const void *base, struct xt_table_info *newinfo)
1116 {
1117         const struct ip6t_entry_target *t;
1118         unsigned int entry_offset;
1119         int off, i, ret;
1120
1121         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1122         entry_offset = (void *)e - base;
1123         IP6T_MATCH_ITERATE(e, compat_calc_match, &off);
1124         t = ip6t_get_target_c(e);
1125         off += xt_compat_target_offset(t->u.kernel.target);
1126         newinfo->size -= off;
1127         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1128         if (ret)
1129                 return ret;
1130
1131         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1132                 if (info->hook_entry[i] &&
1133                     (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1134                         newinfo->hook_entry[i] -= off;
1135                 if (info->underflow[i] &&
1136                     (e < (struct ip6t_entry *)(base + info->underflow[i])))
1137                         newinfo->underflow[i] -= off;
1138         }
1139         return 0;
1140 }
1141
1142 static int compat_table_info(const struct xt_table_info *info,
1143                              struct xt_table_info *newinfo)
1144 {
1145         void *loc_cpu_entry;
1146
1147         if (!newinfo || !info)
1148                 return -EINVAL;
1149
1150         /* we dont care about newinfo->entries[] */
1151         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1152         newinfo->initial_entries = 0;
1153         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1154         return IP6T_ENTRY_ITERATE(loc_cpu_entry, info->size,
1155                                   compat_calc_entry, info, loc_cpu_entry,
1156                                   newinfo);
1157 }
1158 #endif
1159
1160 static int get_info(struct net *net, void __user *user,
1161                     const int *len, int compat)
1162 {
1163         char name[IP6T_TABLE_MAXNAMELEN];
1164         struct xt_table *t;
1165         int ret;
1166
1167         if (*len != sizeof(struct ip6t_getinfo)) {
1168                 duprintf("length %u != %zu\n", *len,
1169                          sizeof(struct ip6t_getinfo));
1170                 return -EINVAL;
1171         }
1172
1173         if (copy_from_user(name, user, sizeof(name)) != 0)
1174                 return -EFAULT;
1175
1176         name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
1177 #ifdef CONFIG_COMPAT
1178         if (compat)
1179                 xt_compat_lock(AF_INET6);
1180 #endif
1181         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1182                                     "ip6table_%s", name);
1183         if (t && !IS_ERR(t)) {
1184                 struct ip6t_getinfo info;
1185                 const struct xt_table_info *private = t->private;
1186 #ifdef CONFIG_COMPAT
1187                 struct xt_table_info tmp;
1188
1189                 if (compat) {
1190                         ret = compat_table_info(private, &tmp);
1191                         xt_compat_flush_offsets(AF_INET6);
1192                         private = &tmp;
1193                 }
1194 #endif
1195                 info.valid_hooks = t->valid_hooks;
1196                 memcpy(info.hook_entry, private->hook_entry,
1197                        sizeof(info.hook_entry));
1198                 memcpy(info.underflow, private->underflow,
1199                        sizeof(info.underflow));
1200                 info.num_entries = private->number;
1201                 info.size = private->size;
1202                 strcpy(info.name, name);
1203
1204                 if (copy_to_user(user, &info, *len) != 0)
1205                         ret = -EFAULT;
1206                 else
1207                         ret = 0;
1208
1209                 xt_table_unlock(t);
1210                 module_put(t->me);
1211         } else
1212                 ret = t ? PTR_ERR(t) : -ENOENT;
1213 #ifdef CONFIG_COMPAT
1214         if (compat)
1215                 xt_compat_unlock(AF_INET6);
1216 #endif
1217         return ret;
1218 }
1219
1220 static int
1221 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1222             const int *len)
1223 {
1224         int ret;
1225         struct ip6t_get_entries get;
1226         struct xt_table *t;
1227
1228         if (*len < sizeof(get)) {
1229                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1230                 return -EINVAL;
1231         }
1232         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1233                 return -EFAULT;
1234         if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1235                 duprintf("get_entries: %u != %zu\n",
1236                          *len, sizeof(get) + get.size);
1237                 return -EINVAL;
1238         }
1239
1240         t = xt_find_table_lock(net, AF_INET6, get.name);
1241         if (t && !IS_ERR(t)) {
1242                 struct xt_table_info *private = t->private;
1243                 duprintf("t->private->number = %u\n", private->number);
1244                 if (get.size == private->size)
1245                         ret = copy_entries_to_user(private->size,
1246                                                    t, uptr->entrytable);
1247                 else {
1248                         duprintf("get_entries: I've got %u not %u!\n",
1249                                  private->size, get.size);
1250                         ret = -EAGAIN;
1251                 }
1252                 module_put(t->me);
1253                 xt_table_unlock(t);
1254         } else
1255                 ret = t ? PTR_ERR(t) : -ENOENT;
1256
1257         return ret;
1258 }
1259
1260 static int
1261 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1262              struct xt_table_info *newinfo, unsigned int num_counters,
1263              void __user *counters_ptr)
1264 {
1265         int ret;
1266         struct xt_table *t;
1267         struct xt_table_info *oldinfo;
1268         struct xt_counters *counters;
1269         const void *loc_cpu_old_entry;
1270
1271         ret = 0;
1272         counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
1273                                 numa_node_id());
1274         if (!counters) {
1275                 ret = -ENOMEM;
1276                 goto out;
1277         }
1278
1279         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1280                                     "ip6table_%s", name);
1281         if (!t || IS_ERR(t)) {
1282                 ret = t ? PTR_ERR(t) : -ENOENT;
1283                 goto free_newinfo_counters_untrans;
1284         }
1285
1286         /* You lied! */
1287         if (valid_hooks != t->valid_hooks) {
1288                 duprintf("Valid hook crap: %08X vs %08X\n",
1289                          valid_hooks, t->valid_hooks);
1290                 ret = -EINVAL;
1291                 goto put_module;
1292         }
1293
1294         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1295         if (!oldinfo)
1296                 goto put_module;
1297
1298         /* Update module usage count based on number of rules */
1299         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1300                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1301         if ((oldinfo->number > oldinfo->initial_entries) ||
1302             (newinfo->number <= oldinfo->initial_entries))
1303                 module_put(t->me);
1304         if ((oldinfo->number > oldinfo->initial_entries) &&
1305             (newinfo->number <= oldinfo->initial_entries))
1306                 module_put(t->me);
1307
1308         /* Get the old counters, and synchronize with replace */
1309         get_counters(oldinfo, counters);
1310
1311         /* Decrease module usage counts and free resource */
1312         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1313         IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
1314                            net, NULL);
1315         xt_free_table_info(oldinfo);
1316         if (copy_to_user(counters_ptr, counters,
1317                          sizeof(struct xt_counters) * num_counters) != 0)
1318                 ret = -EFAULT;
1319         vfree(counters);
1320         xt_table_unlock(t);
1321         return ret;
1322
1323  put_module:
1324         module_put(t->me);
1325         xt_table_unlock(t);
1326  free_newinfo_counters_untrans:
1327         vfree(counters);
1328  out:
1329         return ret;
1330 }
1331
1332 static int
1333 do_replace(struct net *net, const void __user *user, unsigned int len)
1334 {
1335         int ret;
1336         struct ip6t_replace tmp;
1337         struct xt_table_info *newinfo;
1338         void *loc_cpu_entry;
1339
1340         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1341                 return -EFAULT;
1342
1343         /* overflow check */
1344         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1345                 return -ENOMEM;
1346
1347         newinfo = xt_alloc_table_info(tmp.size);
1348         if (!newinfo)
1349                 return -ENOMEM;
1350
1351         /* choose the copy that is on our node/cpu */
1352         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1353         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1354                            tmp.size) != 0) {
1355                 ret = -EFAULT;
1356                 goto free_newinfo;
1357         }
1358
1359         ret = translate_table(net, tmp.name, tmp.valid_hooks,
1360                               newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1361                               tmp.hook_entry, tmp.underflow);
1362         if (ret != 0)
1363                 goto free_newinfo;
1364
1365         duprintf("ip_tables: Translated table\n");
1366
1367         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1368                            tmp.num_counters, tmp.counters);
1369         if (ret)
1370                 goto free_newinfo_untrans;
1371         return 0;
1372
1373  free_newinfo_untrans:
1374         IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, net, NULL);
1375  free_newinfo:
1376         xt_free_table_info(newinfo);
1377         return ret;
1378 }
1379
1380 /* We're lazy, and add to the first CPU; overflow works its fey magic
1381  * and everything is OK. */
1382 static int
1383 add_counter_to_entry(struct ip6t_entry *e,
1384                      const struct xt_counters addme[],
1385                      unsigned int *i)
1386 {
1387         ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1388
1389         (*i)++;
1390         return 0;
1391 }
1392
1393 static int
1394 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1395                 int compat)
1396 {
1397         unsigned int i, curcpu;
1398         struct xt_counters_info tmp;
1399         struct xt_counters *paddc;
1400         unsigned int num_counters;
1401         char *name;
1402         int size;
1403         void *ptmp;
1404         struct xt_table *t;
1405         const struct xt_table_info *private;
1406         int ret = 0;
1407         const void *loc_cpu_entry;
1408 #ifdef CONFIG_COMPAT
1409         struct compat_xt_counters_info compat_tmp;
1410
1411         if (compat) {
1412                 ptmp = &compat_tmp;
1413                 size = sizeof(struct compat_xt_counters_info);
1414         } else
1415 #endif
1416         {
1417                 ptmp = &tmp;
1418                 size = sizeof(struct xt_counters_info);
1419         }
1420
1421         if (copy_from_user(ptmp, user, size) != 0)
1422                 return -EFAULT;
1423
1424 #ifdef CONFIG_COMPAT
1425         if (compat) {
1426                 num_counters = compat_tmp.num_counters;
1427                 name = compat_tmp.name;
1428         } else
1429 #endif
1430         {
1431                 num_counters = tmp.num_counters;
1432                 name = tmp.name;
1433         }
1434
1435         if (len != size + num_counters * sizeof(struct xt_counters))
1436                 return -EINVAL;
1437
1438         paddc = vmalloc_node(len - size, numa_node_id());
1439         if (!paddc)
1440                 return -ENOMEM;
1441
1442         if (copy_from_user(paddc, user + size, len - size) != 0) {
1443                 ret = -EFAULT;
1444                 goto free;
1445         }
1446
1447         t = xt_find_table_lock(net, AF_INET6, name);
1448         if (!t || IS_ERR(t)) {
1449                 ret = t ? PTR_ERR(t) : -ENOENT;
1450                 goto free;
1451         }
1452
1453
1454         local_bh_disable();
1455         private = t->private;
1456         if (private->number != num_counters) {
1457                 ret = -EINVAL;
1458                 goto unlock_up_free;
1459         }
1460
1461         i = 0;
1462         /* Choose the copy that is on our node */
1463         curcpu = smp_processor_id();
1464         xt_info_wrlock(curcpu);
1465         loc_cpu_entry = private->entries[curcpu];
1466         IP6T_ENTRY_ITERATE(loc_cpu_entry,
1467                           private->size,
1468                           add_counter_to_entry,
1469                           paddc,
1470                           &i);
1471         xt_info_wrunlock(curcpu);
1472
1473  unlock_up_free:
1474         local_bh_enable();
1475         xt_table_unlock(t);
1476         module_put(t->me);
1477  free:
1478         vfree(paddc);
1479
1480         return ret;
1481 }
1482
1483 #ifdef CONFIG_COMPAT
1484 struct compat_ip6t_replace {
1485         char                    name[IP6T_TABLE_MAXNAMELEN];
1486         u32                     valid_hooks;
1487         u32                     num_entries;
1488         u32                     size;
1489         u32                     hook_entry[NF_INET_NUMHOOKS];
1490         u32                     underflow[NF_INET_NUMHOOKS];
1491         u32                     num_counters;
1492         compat_uptr_t           counters;       /* struct ip6t_counters * */
1493         struct compat_ip6t_entry entries[0];
1494 };
1495
1496 static int
1497 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1498                           unsigned int *size, struct xt_counters *counters,
1499                           unsigned int *i)
1500 {
1501         struct ip6t_entry_target *t;
1502         struct compat_ip6t_entry __user *ce;
1503         u_int16_t target_offset, next_offset;
1504         compat_uint_t origsize;
1505         int ret;
1506
1507         ret = -EFAULT;
1508         origsize = *size;
1509         ce = (struct compat_ip6t_entry __user *)*dstptr;
1510         if (copy_to_user(ce, e, sizeof(struct ip6t_entry)))
1511                 goto out;
1512
1513         if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
1514                 goto out;
1515
1516         *dstptr += sizeof(struct compat_ip6t_entry);
1517         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1518
1519         ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
1520         target_offset = e->target_offset - (origsize - *size);
1521         if (ret)
1522                 goto out;
1523         t = ip6t_get_target(e);
1524         ret = xt_compat_target_to_user(t, dstptr, size);
1525         if (ret)
1526                 goto out;
1527         ret = -EFAULT;
1528         next_offset = e->next_offset - (origsize - *size);
1529         if (put_user(target_offset, &ce->target_offset))
1530                 goto out;
1531         if (put_user(next_offset, &ce->next_offset))
1532                 goto out;
1533
1534         (*i)++;
1535         return 0;
1536 out:
1537         return ret;
1538 }
1539
1540 static int
1541 compat_find_calc_match(struct ip6t_entry_match *m,
1542                        const char *name,
1543                        const struct ip6t_ip6 *ipv6,
1544                        unsigned int hookmask,
1545                        int *size, unsigned int *i)
1546 {
1547         struct xt_match *match;
1548
1549         match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
1550                                                       m->u.user.revision),
1551                                         "ip6t_%s", m->u.user.name);
1552         if (IS_ERR(match) || !match) {
1553                 duprintf("compat_check_calc_match: `%s' not found\n",
1554                          m->u.user.name);
1555                 return match ? PTR_ERR(match) : -ENOENT;
1556         }
1557         m->u.kernel.match = match;
1558         *size += xt_compat_match_offset(match);
1559
1560         (*i)++;
1561         return 0;
1562 }
1563
1564 static int
1565 compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
1566 {
1567         if (i && (*i)-- == 0)
1568                 return 1;
1569
1570         module_put(m->u.kernel.match->me);
1571         return 0;
1572 }
1573
1574 static int
1575 compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
1576 {
1577         struct ip6t_entry_target *t;
1578
1579         if (i && (*i)-- == 0)
1580                 return 1;
1581
1582         /* Cleanup all matches */
1583         COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
1584         t = compat_ip6t_get_target(e);
1585         module_put(t->u.kernel.target->me);
1586         return 0;
1587 }
1588
1589 static int
1590 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1591                                   struct xt_table_info *newinfo,
1592                                   unsigned int *size,
1593                                   const unsigned char *base,
1594                                   const unsigned char *limit,
1595                                   const unsigned int *hook_entries,
1596                                   const unsigned int *underflows,
1597                                   unsigned int *i,
1598                                   const char *name)
1599 {
1600         struct ip6t_entry_target *t;
1601         struct xt_target *target;
1602         unsigned int entry_offset;
1603         unsigned int j;
1604         int ret, off, h;
1605
1606         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1607         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1608             (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
1609                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1610                 return -EINVAL;
1611         }
1612
1613         if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1614                              sizeof(struct compat_xt_entry_target)) {
1615                 duprintf("checking: element %p size %u\n",
1616                          e, e->next_offset);
1617                 return -EINVAL;
1618         }
1619
1620         /* For purposes of check_entry casting the compat entry is fine */
1621         ret = check_entry((struct ip6t_entry *)e, name);
1622         if (ret)
1623                 return ret;
1624
1625         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1626         entry_offset = (void *)e - (void *)base;
1627         j = 0;
1628         ret = COMPAT_IP6T_MATCH_ITERATE(e, compat_find_calc_match, name,
1629                                         &e->ipv6, e->comefrom, &off, &j);
1630         if (ret != 0)
1631                 goto release_matches;
1632
1633         t = compat_ip6t_get_target(e);
1634         target = try_then_request_module(xt_find_target(AF_INET6,
1635                                                         t->u.user.name,
1636                                                         t->u.user.revision),
1637                                          "ip6t_%s", t->u.user.name);
1638         if (IS_ERR(target) || !target) {
1639                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1640                          t->u.user.name);
1641                 ret = target ? PTR_ERR(target) : -ENOENT;
1642                 goto release_matches;
1643         }
1644         t->u.kernel.target = target;
1645
1646         off += xt_compat_target_offset(target);
1647         *size += off;
1648         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1649         if (ret)
1650                 goto out;
1651
1652         /* Check hooks & underflows */
1653         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1654                 if ((unsigned char *)e - base == hook_entries[h])
1655                         newinfo->hook_entry[h] = hook_entries[h];
1656                 if ((unsigned char *)e - base == underflows[h])
1657                         newinfo->underflow[h] = underflows[h];
1658         }
1659
1660         /* Clear counters and comefrom */
1661         memset(&e->counters, 0, sizeof(e->counters));
1662         e->comefrom = 0;
1663
1664         (*i)++;
1665         return 0;
1666
1667 out:
1668         module_put(t->u.kernel.target->me);
1669 release_matches:
1670         IP6T_MATCH_ITERATE(e, compat_release_match, &j);
1671         return ret;
1672 }
1673
1674 static int
1675 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1676                             unsigned int *size, const char *name,
1677                             struct xt_table_info *newinfo, unsigned char *base)
1678 {
1679         struct ip6t_entry_target *t;
1680         struct xt_target *target;
1681         struct ip6t_entry *de;
1682         unsigned int origsize;
1683         int ret, h;
1684
1685         ret = 0;
1686         origsize = *size;
1687         de = (struct ip6t_entry *)*dstptr;
1688         memcpy(de, e, sizeof(struct ip6t_entry));
1689         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1690
1691         *dstptr += sizeof(struct ip6t_entry);
1692         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1693
1694         ret = COMPAT_IP6T_MATCH_ITERATE(e, xt_compat_match_from_user,
1695                                         dstptr, size);
1696         if (ret)
1697                 return ret;
1698         de->target_offset = e->target_offset - (origsize - *size);
1699         t = compat_ip6t_get_target(e);
1700         target = t->u.kernel.target;
1701         xt_compat_target_from_user(t, dstptr, size);
1702
1703         de->next_offset = e->next_offset - (origsize - *size);
1704         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1705                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1706                         newinfo->hook_entry[h] -= origsize - *size;
1707                 if ((unsigned char *)de - base < newinfo->underflow[h])
1708                         newinfo->underflow[h] -= origsize - *size;
1709         }
1710         return ret;
1711 }
1712
1713 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1714                               const char *name, unsigned int *i)
1715 {
1716         unsigned int j;
1717         int ret;
1718         struct xt_mtchk_param mtpar;
1719
1720         j = 0;
1721         mtpar.net       = net;
1722         mtpar.table     = name;
1723         mtpar.entryinfo = &e->ipv6;
1724         mtpar.hook_mask = e->comefrom;
1725         mtpar.family    = NFPROTO_IPV6;
1726         ret = IP6T_MATCH_ITERATE(e, check_match, &mtpar, &j);
1727         if (ret)
1728                 goto cleanup_matches;
1729
1730         ret = check_target(e, net, name);
1731         if (ret)
1732                 goto cleanup_matches;
1733
1734         (*i)++;
1735         return 0;
1736
1737  cleanup_matches:
1738         IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
1739         return ret;
1740 }
1741
1742 static int
1743 translate_compat_table(struct net *net,
1744                        const char *name,
1745                        unsigned int valid_hooks,
1746                        struct xt_table_info **pinfo,
1747                        void **pentry0,
1748                        unsigned int total_size,
1749                        unsigned int number,
1750                        unsigned int *hook_entries,
1751                        unsigned int *underflows)
1752 {
1753         unsigned int i, j;
1754         struct xt_table_info *newinfo, *info;
1755         void *pos, *entry0, *entry1;
1756         unsigned int size;
1757         int ret;
1758
1759         info = *pinfo;
1760         entry0 = *pentry0;
1761         size = total_size;
1762         info->number = number;
1763
1764         /* Init all hooks to impossible value. */
1765         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1766                 info->hook_entry[i] = 0xFFFFFFFF;
1767                 info->underflow[i] = 0xFFFFFFFF;
1768         }
1769
1770         duprintf("translate_compat_table: size %u\n", info->size);
1771         j = 0;
1772         xt_compat_lock(AF_INET6);
1773         /* Walk through entries, checking offsets. */
1774         ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
1775                                         check_compat_entry_size_and_hooks,
1776                                         info, &size, entry0,
1777                                         entry0 + total_size,
1778                                         hook_entries, underflows, &j, name);
1779         if (ret != 0)
1780                 goto out_unlock;
1781
1782         ret = -EINVAL;
1783         if (j != number) {
1784                 duprintf("translate_compat_table: %u not %u entries\n",
1785                          j, number);
1786                 goto out_unlock;
1787         }
1788
1789         /* Check hooks all assigned */
1790         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1791                 /* Only hooks which are valid */
1792                 if (!(valid_hooks & (1 << i)))
1793                         continue;
1794                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1795                         duprintf("Invalid hook entry %u %u\n",
1796                                  i, hook_entries[i]);
1797                         goto out_unlock;
1798                 }
1799                 if (info->underflow[i] == 0xFFFFFFFF) {
1800                         duprintf("Invalid underflow %u %u\n",
1801                                  i, underflows[i]);
1802                         goto out_unlock;
1803                 }
1804         }
1805
1806         ret = -ENOMEM;
1807         newinfo = xt_alloc_table_info(size);
1808         if (!newinfo)
1809                 goto out_unlock;
1810
1811         newinfo->number = number;
1812         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1813                 newinfo->hook_entry[i] = info->hook_entry[i];
1814                 newinfo->underflow[i] = info->underflow[i];
1815         }
1816         entry1 = newinfo->entries[raw_smp_processor_id()];
1817         pos = entry1;
1818         size = total_size;
1819         ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
1820                                         compat_copy_entry_from_user,
1821                                         &pos, &size, name, newinfo, entry1);
1822         xt_compat_flush_offsets(AF_INET6);
1823         xt_compat_unlock(AF_INET6);
1824         if (ret)
1825                 goto free_newinfo;
1826
1827         ret = -ELOOP;
1828         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1829                 goto free_newinfo;
1830
1831         i = 0;
1832         ret = IP6T_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
1833                                  net, name, &i);
1834         if (ret) {
1835                 j -= i;
1836                 COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
1837                                                    compat_release_entry, &j);
1838                 IP6T_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, net, &i);
1839                 xt_free_table_info(newinfo);
1840                 return ret;
1841         }
1842
1843         /* And one copy for every other CPU */
1844         for_each_possible_cpu(i)
1845                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1846                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1847
1848         *pinfo = newinfo;
1849         *pentry0 = entry1;
1850         xt_free_table_info(info);
1851         return 0;
1852
1853 free_newinfo:
1854         xt_free_table_info(newinfo);
1855 out:
1856         COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
1857         return ret;
1858 out_unlock:
1859         xt_compat_flush_offsets(AF_INET6);
1860         xt_compat_unlock(AF_INET6);
1861         goto out;
1862 }
1863
1864 static int
1865 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1866 {
1867         int ret;
1868         struct compat_ip6t_replace tmp;
1869         struct xt_table_info *newinfo;
1870         void *loc_cpu_entry;
1871
1872         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1873                 return -EFAULT;
1874
1875         /* overflow check */
1876         if (tmp.size >= INT_MAX / num_possible_cpus())
1877                 return -ENOMEM;
1878         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1879                 return -ENOMEM;
1880
1881         newinfo = xt_alloc_table_info(tmp.size);
1882         if (!newinfo)
1883                 return -ENOMEM;
1884
1885         /* choose the copy that is on our node/cpu */
1886         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1887         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1888                            tmp.size) != 0) {
1889                 ret = -EFAULT;
1890                 goto free_newinfo;
1891         }
1892
1893         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1894                                      &newinfo, &loc_cpu_entry, tmp.size,
1895                                      tmp.num_entries, tmp.hook_entry,
1896                                      tmp.underflow);
1897         if (ret != 0)
1898                 goto free_newinfo;
1899
1900         duprintf("compat_do_replace: Translated table\n");
1901
1902         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1903                            tmp.num_counters, compat_ptr(tmp.counters));
1904         if (ret)
1905                 goto free_newinfo_untrans;
1906         return 0;
1907
1908  free_newinfo_untrans:
1909         IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, net, NULL);
1910  free_newinfo:
1911         xt_free_table_info(newinfo);
1912         return ret;
1913 }
1914
1915 static int
1916 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1917                        unsigned int len)
1918 {
1919         int ret;
1920
1921         if (!capable(CAP_NET_ADMIN))
1922                 return -EPERM;
1923
1924         switch (cmd) {
1925         case IP6T_SO_SET_REPLACE:
1926                 ret = compat_do_replace(sock_net(sk), user, len);
1927                 break;
1928
1929         case IP6T_SO_SET_ADD_COUNTERS:
1930                 ret = do_add_counters(sock_net(sk), user, len, 1);
1931                 break;
1932
1933         default:
1934                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1935                 ret = -EINVAL;
1936         }
1937
1938         return ret;
1939 }
1940
1941 struct compat_ip6t_get_entries {
1942         char name[IP6T_TABLE_MAXNAMELEN];
1943         compat_uint_t size;
1944         struct compat_ip6t_entry entrytable[0];
1945 };
1946
1947 static int
1948 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1949                             void __user *userptr)
1950 {
1951         struct xt_counters *counters;
1952         const struct xt_table_info *private = table->private;
1953         void __user *pos;
1954         unsigned int size;
1955         int ret = 0;
1956         const void *loc_cpu_entry;
1957         unsigned int i = 0;
1958
1959         counters = alloc_counters(table);
1960         if (IS_ERR(counters))
1961                 return PTR_ERR(counters);
1962
1963         /* choose the copy that is on our node/cpu, ...
1964          * This choice is lazy (because current thread is
1965          * allowed to migrate to another cpu)
1966          */
1967         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1968         pos = userptr;
1969         size = total_size;
1970         ret = IP6T_ENTRY_ITERATE(loc_cpu_entry, total_size,
1971                                  compat_copy_entry_to_user,
1972                                  &pos, &size, counters, &i);
1973
1974         vfree(counters);
1975         return ret;
1976 }
1977
1978 static int
1979 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1980                    int *len)
1981 {
1982         int ret;
1983         struct compat_ip6t_get_entries get;
1984         struct xt_table *t;
1985
1986         if (*len < sizeof(get)) {
1987                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1988                 return -EINVAL;
1989         }
1990
1991         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1992                 return -EFAULT;
1993
1994         if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1995                 duprintf("compat_get_entries: %u != %zu\n",
1996                          *len, sizeof(get) + get.size);
1997                 return -EINVAL;
1998         }
1999
2000         xt_compat_lock(AF_INET6);
2001         t = xt_find_table_lock(net, AF_INET6, get.name);
2002         if (t && !IS_ERR(t)) {
2003                 const struct xt_table_info *private = t->private;
2004                 struct xt_table_info info;
2005                 duprintf("t->private->number = %u\n", private->number);
2006                 ret = compat_table_info(private, &info);
2007                 if (!ret && get.size == info.size) {
2008                         ret = compat_copy_entries_to_user(private->size,
2009                                                           t, uptr->entrytable);
2010                 } else if (!ret) {
2011                         duprintf("compat_get_entries: I've got %u not %u!\n",
2012                                  private->size, get.size);
2013                         ret = -EAGAIN;
2014                 }
2015                 xt_compat_flush_offsets(AF_INET6);
2016                 module_put(t->me);
2017                 xt_table_unlock(t);
2018         } else
2019                 ret = t ? PTR_ERR(t) : -ENOENT;
2020
2021         xt_compat_unlock(AF_INET6);
2022         return ret;
2023 }
2024
2025 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
2026
2027 static int
2028 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2029 {
2030         int ret;
2031
2032         if (!capable(CAP_NET_ADMIN))
2033                 return -EPERM;
2034
2035         switch (cmd) {
2036         case IP6T_SO_GET_INFO:
2037                 ret = get_info(sock_net(sk), user, len, 1);
2038                 break;
2039         case IP6T_SO_GET_ENTRIES:
2040                 ret = compat_get_entries(sock_net(sk), user, len);
2041                 break;
2042         default:
2043                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
2044         }
2045         return ret;
2046 }
2047 #endif
2048
2049 static int
2050 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2051 {
2052         int ret;
2053
2054         if (!capable(CAP_NET_ADMIN))
2055                 return -EPERM;
2056
2057         switch (cmd) {
2058         case IP6T_SO_SET_REPLACE:
2059                 ret = do_replace(sock_net(sk), user, len);
2060                 break;
2061
2062         case IP6T_SO_SET_ADD_COUNTERS:
2063                 ret = do_add_counters(sock_net(sk), user, len, 0);
2064                 break;
2065
2066         default:
2067                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
2068                 ret = -EINVAL;
2069         }
2070
2071         return ret;
2072 }
2073
2074 static int
2075 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2076 {
2077         int ret;
2078
2079         if (!capable(CAP_NET_ADMIN))
2080                 return -EPERM;
2081
2082         switch (cmd) {
2083         case IP6T_SO_GET_INFO:
2084                 ret = get_info(sock_net(sk), user, len, 0);
2085                 break;
2086
2087         case IP6T_SO_GET_ENTRIES:
2088                 ret = get_entries(sock_net(sk), user, len);
2089                 break;
2090
2091         case IP6T_SO_GET_REVISION_MATCH:
2092         case IP6T_SO_GET_REVISION_TARGET: {
2093                 struct ip6t_get_revision rev;
2094                 int target;
2095
2096                 if (*len != sizeof(rev)) {
2097                         ret = -EINVAL;
2098                         break;
2099                 }
2100                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2101                         ret = -EFAULT;
2102                         break;
2103                 }
2104
2105                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2106                         target = 1;
2107                 else
2108                         target = 0;
2109
2110                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2111                                                          rev.revision,
2112                                                          target, &ret),
2113                                         "ip6t_%s", rev.name);
2114                 break;
2115         }
2116
2117         default:
2118                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2119                 ret = -EINVAL;
2120         }
2121
2122         return ret;
2123 }
2124
2125 struct xt_table *ip6t_register_table(struct net *net,
2126                                      const struct xt_table *table,
2127                                      const struct ip6t_replace *repl)
2128 {
2129         int ret;
2130         struct xt_table_info *newinfo;
2131         struct xt_table_info bootstrap
2132                 = { 0, 0, 0, { 0 }, { 0 }, { } };
2133         void *loc_cpu_entry;
2134         struct xt_table *new_table;
2135
2136         newinfo = xt_alloc_table_info(repl->size);
2137         if (!newinfo) {
2138                 ret = -ENOMEM;
2139                 goto out;
2140         }
2141
2142         /* choose the copy on our node/cpu, but dont care about preemption */
2143         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2144         memcpy(loc_cpu_entry, repl->entries, repl->size);
2145
2146         ret = translate_table(net, table->name, table->valid_hooks,
2147                               newinfo, loc_cpu_entry, repl->size,
2148                               repl->num_entries,
2149                               repl->hook_entry,
2150                               repl->underflow);
2151         if (ret != 0)
2152                 goto out_free;
2153
2154         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2155         if (IS_ERR(new_table)) {
2156                 ret = PTR_ERR(new_table);
2157                 goto out_free;
2158         }
2159         return new_table;
2160
2161 out_free:
2162         xt_free_table_info(newinfo);
2163 out:
2164         return ERR_PTR(ret);
2165 }
2166
2167 void ip6t_unregister_table(struct net *net, struct xt_table *table)
2168 {
2169         struct xt_table_info *private;
2170         void *loc_cpu_entry;
2171         struct module *table_owner = table->me;
2172
2173         private = xt_unregister_table(table);
2174
2175         /* Decrease module usage counts and free resources */
2176         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2177         IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, net, NULL);
2178         if (private->number > private->initial_entries)
2179                 module_put(table_owner);
2180         xt_free_table_info(private);
2181 }
2182
2183 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2184 static inline bool
2185 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2186                      u_int8_t type, u_int8_t code,
2187                      bool invert)
2188 {
2189         return (type == test_type && code >= min_code && code <= max_code)
2190                 ^ invert;
2191 }
2192
2193 static bool
2194 icmp6_match(const struct sk_buff *skb, const struct xt_match_param *par)
2195 {
2196         const struct icmp6hdr *ic;
2197         struct icmp6hdr _icmph;
2198         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2199
2200         /* Must not be a fragment. */
2201         if (par->fragoff != 0)
2202                 return false;
2203
2204         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2205         if (ic == NULL) {
2206                 /* We've been asked to examine this packet, and we
2207                  * can't.  Hence, no choice but to drop.
2208                  */
2209                 duprintf("Dropping evil ICMP tinygram.\n");
2210                 *par->hotdrop = true;
2211                 return false;
2212         }
2213
2214         return icmp6_type_code_match(icmpinfo->type,
2215                                      icmpinfo->code[0],
2216                                      icmpinfo->code[1],
2217                                      ic->icmp6_type, ic->icmp6_code,
2218                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
2219 }
2220
2221 /* Called when user tries to insert an entry of this type. */
2222 static bool icmp6_checkentry(const struct xt_mtchk_param *par)
2223 {
2224         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2225
2226         /* Must specify no unknown invflags */
2227         return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
2228 }
2229
2230 /* The built-in targets: standard (NULL) and error. */
2231 static struct xt_target ip6t_standard_target __read_mostly = {
2232         .name           = IP6T_STANDARD_TARGET,
2233         .targetsize     = sizeof(int),
2234         .family         = NFPROTO_IPV6,
2235 #ifdef CONFIG_COMPAT
2236         .compatsize     = sizeof(compat_int_t),
2237         .compat_from_user = compat_standard_from_user,
2238         .compat_to_user = compat_standard_to_user,
2239 #endif
2240 };
2241
2242 static struct xt_target ip6t_error_target __read_mostly = {
2243         .name           = IP6T_ERROR_TARGET,
2244         .target         = ip6t_error,
2245         .targetsize     = IP6T_FUNCTION_MAXNAMELEN,
2246         .family         = NFPROTO_IPV6,
2247 };
2248
2249 static struct nf_sockopt_ops ip6t_sockopts = {
2250         .pf             = PF_INET6,
2251         .set_optmin     = IP6T_BASE_CTL,
2252         .set_optmax     = IP6T_SO_SET_MAX+1,
2253         .set            = do_ip6t_set_ctl,
2254 #ifdef CONFIG_COMPAT
2255         .compat_set     = compat_do_ip6t_set_ctl,
2256 #endif
2257         .get_optmin     = IP6T_BASE_CTL,
2258         .get_optmax     = IP6T_SO_GET_MAX+1,
2259         .get            = do_ip6t_get_ctl,
2260 #ifdef CONFIG_COMPAT
2261         .compat_get     = compat_do_ip6t_get_ctl,
2262 #endif
2263         .owner          = THIS_MODULE,
2264 };
2265
2266 static struct xt_match icmp6_matchstruct __read_mostly = {
2267         .name           = "icmp6",
2268         .match          = icmp6_match,
2269         .matchsize      = sizeof(struct ip6t_icmp),
2270         .checkentry     = icmp6_checkentry,
2271         .proto          = IPPROTO_ICMPV6,
2272         .family         = NFPROTO_IPV6,
2273 };
2274
2275 static int __net_init ip6_tables_net_init(struct net *net)
2276 {
2277         return xt_proto_init(net, NFPROTO_IPV6);
2278 }
2279
2280 static void __net_exit ip6_tables_net_exit(struct net *net)
2281 {
2282         xt_proto_fini(net, NFPROTO_IPV6);
2283 }
2284
2285 static struct pernet_operations ip6_tables_net_ops = {
2286         .init = ip6_tables_net_init,
2287         .exit = ip6_tables_net_exit,
2288 };
2289
2290 static int __init ip6_tables_init(void)
2291 {
2292         int ret;
2293
2294         ret = register_pernet_subsys(&ip6_tables_net_ops);
2295         if (ret < 0)
2296                 goto err1;
2297
2298         /* Noone else will be downing sem now, so we won't sleep */
2299         ret = xt_register_target(&ip6t_standard_target);
2300         if (ret < 0)
2301                 goto err2;
2302         ret = xt_register_target(&ip6t_error_target);
2303         if (ret < 0)
2304                 goto err3;
2305         ret = xt_register_match(&icmp6_matchstruct);
2306         if (ret < 0)
2307                 goto err4;
2308
2309         /* Register setsockopt */
2310         ret = nf_register_sockopt(&ip6t_sockopts);
2311         if (ret < 0)
2312                 goto err5;
2313
2314         printk(KERN_INFO "ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
2315         return 0;
2316
2317 err5:
2318         xt_unregister_match(&icmp6_matchstruct);
2319 err4:
2320         xt_unregister_target(&ip6t_error_target);
2321 err3:
2322         xt_unregister_target(&ip6t_standard_target);
2323 err2:
2324         unregister_pernet_subsys(&ip6_tables_net_ops);
2325 err1:
2326         return ret;
2327 }
2328
2329 static void __exit ip6_tables_fini(void)
2330 {
2331         nf_unregister_sockopt(&ip6t_sockopts);
2332
2333         xt_unregister_match(&icmp6_matchstruct);
2334         xt_unregister_target(&ip6t_error_target);
2335         xt_unregister_target(&ip6t_standard_target);
2336
2337         unregister_pernet_subsys(&ip6_tables_net_ops);
2338 }
2339
2340 /*
2341  * find the offset to specified header or the protocol number of last header
2342  * if target < 0. "last header" is transport protocol header, ESP, or
2343  * "No next header".
2344  *
2345  * If target header is found, its offset is set in *offset and return protocol
2346  * number. Otherwise, return -1.
2347  *
2348  * If the first fragment doesn't contain the final protocol header or
2349  * NEXTHDR_NONE it is considered invalid.
2350  *
2351  * Note that non-1st fragment is special case that "the protocol number
2352  * of last header" is "next header" field in Fragment header. In this case,
2353  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
2354  * isn't NULL.
2355  *
2356  */
2357 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
2358                   int target, unsigned short *fragoff)
2359 {
2360         unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
2361         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
2362         unsigned int len = skb->len - start;
2363
2364         if (fragoff)
2365                 *fragoff = 0;
2366
2367         while (nexthdr != target) {
2368                 struct ipv6_opt_hdr _hdr, *hp;
2369                 unsigned int hdrlen;
2370
2371                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
2372                         if (target < 0)
2373                                 break;
2374                         return -ENOENT;
2375                 }
2376
2377                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
2378                 if (hp == NULL)
2379                         return -EBADMSG;
2380                 if (nexthdr == NEXTHDR_FRAGMENT) {
2381                         unsigned short _frag_off;
2382                         __be16 *fp;
2383                         fp = skb_header_pointer(skb,
2384                                                 start+offsetof(struct frag_hdr,
2385                                                                frag_off),
2386                                                 sizeof(_frag_off),
2387                                                 &_frag_off);
2388                         if (fp == NULL)
2389                                 return -EBADMSG;
2390
2391                         _frag_off = ntohs(*fp) & ~0x7;
2392                         if (_frag_off) {
2393                                 if (target < 0 &&
2394                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
2395                                      hp->nexthdr == NEXTHDR_NONE)) {
2396                                         if (fragoff)
2397                                                 *fragoff = _frag_off;
2398                                         return hp->nexthdr;
2399                                 }
2400                                 return -ENOENT;
2401                         }
2402                         hdrlen = 8;
2403                 } else if (nexthdr == NEXTHDR_AUTH)
2404                         hdrlen = (hp->hdrlen + 2) << 2;
2405                 else
2406                         hdrlen = ipv6_optlen(hp);
2407
2408                 nexthdr = hp->nexthdr;
2409                 len -= hdrlen;
2410                 start += hdrlen;
2411         }
2412
2413         *offset = start;
2414         return nexthdr;
2415 }
2416
2417 EXPORT_SYMBOL(ip6t_register_table);
2418 EXPORT_SYMBOL(ip6t_unregister_table);
2419 EXPORT_SYMBOL(ip6t_do_table);
2420 EXPORT_SYMBOL(ip6t_ext_hdr);
2421 EXPORT_SYMBOL(ipv6_find_hdr);
2422
2423 module_init(ip6_tables_init);
2424 module_exit(ip6_tables_fini);