net/ipv4/netfilter/ip_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12 #include <linux/cache.h>
  13 #include <linux/capability.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/kmod.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/icmp.h>
  20 #include <net/ip.h>
  21 #include <net/compat.h>
  22 #include <asm/uaccess.h>
  23 #include <linux/mutex.h>
  24 #include <linux/proc_fs.h>
  25 #include <linux/err.h>
  26 #include <linux/cpumask.h>
  27
  28 #include <linux/netfilter/x_tables.h>
  29 #include <linux/netfilter_ipv4/ip_tables.h>
  30 #include <net/netfilter/nf_log.h>
  31 #include "../../netfilter/xt_repldata.h"
  32
  33 MODULE_LICENSE("GPL");
  34 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  35 MODULE_DESCRIPTION("IPv4 packet filter");
  36
  37 /*#define DEBUG_IP_FIREWALL*/
  38 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  39 /*#define DEBUG_IP_FIREWALL_USER*/
  40
  41 #ifdef DEBUG_IP_FIREWALL
  42 #define dprintf(format, args...) pr_info(format , ## args)
  43 #else
  44 #define dprintf(format, args...)
  45 #endif
  46
  47 #ifdef DEBUG_IP_FIREWALL_USER
  48 #define duprintf(format, args...) pr_info(format , ## args)
  49 #else
  50 #define duprintf(format, args...)
  51 #endif
  52
  53 #ifdef CONFIG_NETFILTER_DEBUG
  54 #define IP_NF_ASSERT(x)         WARN_ON(!(x))
  55 #else
  56 #define IP_NF_ASSERT(x)
  57 #endif
  58
  59 #if 0
  60 /* All the better to debug you with... */
  61 #define static
  62 #define inline
  63 #endif
  64
  65 void *ipt_alloc_initial_table(const struct xt_table *info)
  66 {
  67         return xt_alloc_initial_table(ipt, IPT);
  68 }
  69 EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
  70
  71 /*
  72    We keep a set of rules for each CPU, so we can avoid write-locking
  73    them in the softirq when updating the counters and therefore
  74    only need to read-lock in the softirq; doing a write_lock_bh() in user
  75    context stops packets coming through and allows user context to read
  76    the counters or update the rules.
  77
  78    Hence the start of any table is given by get_table() below.  */
  79
  80 /* Returns whether matches rule or not. */
  81 /* Performance critical - called for every packet */
  82 static inline bool
  83 ip_packet_match(const struct iphdr *ip,
  84                 const char *indev,
  85                 const char *outdev,
  86                 const struct ipt_ip *ipinfo,
  87                 int isfrag)
  88 {
  89         unsigned long ret;
  90
  91 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
  92
  93         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
  94                   IPT_INV_SRCIP) ||
  95             FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
  96                   IPT_INV_DSTIP)) {
  97                 dprintf("Source or dest mismatch.\n");
  98
  99                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
 100                         &ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
 101                         ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
 102                 dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
 103                         &ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
 104                         ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
 105                 return false;
 106         }
 107
 108         ret = ifname_compare_aligned(indev, ipinfo->iniface, ipinfo->iniface_mask);
 109
 110         if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
 111                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 112                         indev, ipinfo->iniface,
 113                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
 114                 return false;
 115         }
 116
 117         ret = ifname_compare_aligned(outdev, ipinfo->outiface, ipinfo->outiface_mask);
 118
 119         if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
 120                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 121                         outdev, ipinfo->outiface,
 122                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
 123                 return false;
 124         }
 125
 126         /* Check specific protocol */
 127         if (ipinfo->proto &&
 128             FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
 129                 dprintf("Packet protocol %hi does not match %hi.%s\n",
 130                         ip->protocol, ipinfo->proto,
 131                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
 132                 return false;
 133         }
 134
 135         /* If we have a fragment rule but the packet is not a fragment
 136          * then we return zero */
 137         if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
 138                 dprintf("Fragment rule but not fragment.%s\n",
 139                         ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
 140                 return false;
 141         }
 142
 143         return true;
 144 }
 145
 146 static bool
 147 ip_checkentry(const struct ipt_ip *ip)
 148 {
 149         if (ip->flags & ~IPT_F_MASK) {
 150                 duprintf("Unknown flag bits set: %08X\n",
 151                          ip->flags & ~IPT_F_MASK);
 152                 return false;
 153         }
 154         if (ip->invflags & ~IPT_INV_MASK) {
 155                 duprintf("Unknown invflag bits set: %08X\n",
 156                          ip->invflags & ~IPT_INV_MASK);
 157                 return false;
 158         }
 159         return true;
 160 }
 161
 162 static unsigned int
 163 ipt_error(struct sk_buff *skb, const struct xt_action_param *par)
 164 {
 165         if (net_ratelimit())
 166                 pr_info("error: `%s'\n", (const char *)par->targinfo);
 167
 168         return NF_DROP;
 169 }
 170
 171 /* Performance critical */
 172 static inline struct ipt_entry *
 173 get_entry(const void *base, unsigned int offset)
 174 {
 175         return (struct ipt_entry *)(base + offset);
 176 }
 177
 178 /* All zeroes == unconditional rule. */
 179 /* Mildly perf critical (only if packet tracing is on) */
 180 static inline bool unconditional(const struct ipt_ip *ip)
 181 {
 182         static const struct ipt_ip uncond;
 183
 184         return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 185 #undef FWINV
 186 }
 187
 188 /* for const-correctness */
 189 static inline const struct ipt_entry_target *
 190 ipt_get_target_c(const struct ipt_entry *e)
 191 {
 192         return ipt_get_target((struct ipt_entry *)e);
 193 }
 194
 195 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 196     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 197 static const char *const hooknames[] = {
 198         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 199         [NF_INET_LOCAL_IN]              = "INPUT",
 200         [NF_INET_FORWARD]               = "FORWARD",
 201         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 202         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 203 };
 204
 205 enum nf_ip_trace_comments {
 206         NF_IP_TRACE_COMMENT_RULE,
 207         NF_IP_TRACE_COMMENT_RETURN,
 208         NF_IP_TRACE_COMMENT_POLICY,
 209 };
 210
 211 static const char *const comments[] = {
 212         [NF_IP_TRACE_COMMENT_RULE]      = "rule",
 213         [NF_IP_TRACE_COMMENT_RETURN]    = "return",
 214         [NF_IP_TRACE_COMMENT_POLICY]    = "policy",
 215 };
 216
 217 static struct nf_loginfo trace_loginfo = {
 218         .type = NF_LOG_TYPE_LOG,
 219         .u = {
 220                 .log = {
 221                         .level = 4,
 222                         .logflags = NF_LOG_MASK,
 223                 },
 224         },
 225 };
 226
 227 /* Mildly perf critical (only if packet tracing is on) */
 228 static inline int
 229 get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
 230                       const char *hookname, const char **chainname,
 231                       const char **comment, unsigned int *rulenum)
 232 {
 233         const struct ipt_standard_target *t = (void *)ipt_get_target_c(s);
 234
 235         if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
 236                 /* Head of user chain: ERROR target with chainname */
 237                 *chainname = t->target.data;
 238                 (*rulenum) = 0;
 239         } else if (s == e) {
 240                 (*rulenum)++;
 241
 242                 if (s->target_offset == sizeof(struct ipt_entry) &&
 243                     strcmp(t->target.u.kernel.target->name,
 244                            IPT_STANDARD_TARGET) == 0 &&
 245                    t->verdict < 0 &&
 246                    unconditional(&s->ip)) {
 247                         /* Tail of chains: STANDARD target (return/policy) */
 248                         *comment = *chainname == hookname
 249                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
 250                                 : comments[NF_IP_TRACE_COMMENT_RETURN];
 251                 }
 252                 return 1;
 253         } else
 254                 (*rulenum)++;
 255
 256         return 0;
 257 }
 258
 259 static void trace_packet(const struct sk_buff *skb,
 260                          unsigned int hook,
 261                          const struct net_device *in,
 262                          const struct net_device *out,
 263                          const char *tablename,
 264                          const struct xt_table_info *private,
 265                          const struct ipt_entry *e)
 266 {
 267         const void *table_base;
 268         const struct ipt_entry *root;
 269         const char *hookname, *chainname, *comment;
 270         const struct ipt_entry *iter;
 271         unsigned int rulenum = 0;
 272
 273         table_base = private->entries[smp_processor_id()];
 274         root = get_entry(table_base, private->hook_entry[hook]);
 275
 276         hookname = chainname = hooknames[hook];
 277         comment = comments[NF_IP_TRACE_COMMENT_RULE];
 278
 279         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 280                 if (get_chainname_rulenum(iter, e, hookname,
 281                     &chainname, &comment, &rulenum) != 0)
 282                         break;
 283
 284         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
 285                       "TRACE: %s:%s:%s:%u ",
 286                       tablename, chainname, comment, rulenum);
 287 }
 288 #endif
 289
 290 static inline __pure
 291 struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
 292 {
 293         return (void *)entry + entry->next_offset;
 294 }
 295
 296 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 297 unsigned int
 298 ipt_do_table(struct sk_buff *skb,
 299              unsigned int hook,
 300              const struct net_device *in,
 301              const struct net_device *out,
 302              struct xt_table *table)
 303 {
 304         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 305         const struct iphdr *ip;
 306         /* Initializing verdict to NF_DROP keeps gcc happy. */
 307         unsigned int verdict = NF_DROP;
 308         const char *indev, *outdev;
 309         const void *table_base;
 310         struct ipt_entry *e, **jumpstack;
 311         unsigned int *stackptr, origptr, cpu;
 312         const struct xt_table_info *private;
 313         struct xt_action_param acpar;
 314
 315         /* Initialization */
 316         ip = ip_hdr(skb);
 317         indev = in ? in->name : nulldevname;
 318         outdev = out ? out->name : nulldevname;
 319         /* We handle fragments by dealing with the first fragment as
 320          * if it was a normal packet.  All other fragments are treated
 321          * normally, except that they will NEVER match rules that ask
 322          * things we don't know, ie. tcp syn flag or ports).  If the
 323          * rule is also a fragment-specific rule, non-fragments won't
 324          * match it. */
 325         acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 326         acpar.thoff   = ip_hdrlen(skb);
 327         acpar.hotdrop = false;
 328         acpar.in      = in;
 329         acpar.out     = out;
 330         acpar.family  = NFPROTO_IPV4;
 331         acpar.hooknum = hook;
 332
 333         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 334         xt_info_rdlock_bh();
 335         private = table->private;
 336         cpu        = smp_processor_id();
 337         table_base = private->entries[cpu];
 338         jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
 339         stackptr   = per_cpu_ptr(private->stackptr, cpu);
 340         origptr    = *stackptr;
 341
 342         e = get_entry(table_base, private->hook_entry[hook]);
 343
 344         pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
 345                  table->name, hook, origptr,
 346                  get_entry(table_base, private->underflow[hook]));
 347
 348         do {
 349                 const struct ipt_entry_target *t;
 350                 const struct xt_entry_match *ematch;
 351
 352                 IP_NF_ASSERT(e);
 353                 if (!ip_packet_match(ip, indev, outdev,
 354                     &e->ip, acpar.fragoff)) {
 355  no_match:
 356                         e = ipt_next_entry(e);
 357                         continue;
 358                 }
 359
 360                 xt_ematch_foreach(ematch, e) {
 361                         acpar.match     = ematch->u.kernel.match;
 362                         acpar.matchinfo = ematch->data;
 363                         if (!acpar.match->match(skb, &acpar))
 364                                 goto no_match;
 365                 }
 366
 367                 ADD_COUNTER(e->counters, skb->len, 1);
 368
 369                 t = ipt_get_target(e);
 370                 IP_NF_ASSERT(t->u.kernel.target);
 371
 372 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 373     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 374                 /* The packet is traced: log it */
 375                 if (unlikely(skb->nf_trace))
 376                         trace_packet(skb, hook, in, out,
 377                                      table->name, private, e);
 378 #endif
 379                 /* Standard target? */
 380                 if (!t->u.kernel.target->target) {
 381                         int v;
 382
 383                         v = ((struct ipt_standard_target *)t)->verdict;
 384                         if (v < 0) {
 385                                 /* Pop from stack? */
 386                                 if (v != IPT_RETURN) {
 387                                         verdict = (unsigned)(-v) - 1;
 388                                         break;
 389                                 }
 390                                 if (*stackptr == 0) {
 391                                         e = get_entry(table_base,
 392                                             private->underflow[hook]);
 393                                         pr_debug("Underflow (this is normal) "
 394                                                  "to %p\n", e);
 395                                 } else {
 396                                         e = jumpstack[--*stackptr];
 397                                         pr_debug("Pulled %p out from pos %u\n",
 398                                                  e, *stackptr);
 399                                         e = ipt_next_entry(e);
 400                                 }
 401                                 continue;
 402                         }
 403                         if (table_base + v != ipt_next_entry(e) &&
 404                             !(e->ip.flags & IPT_F_GOTO)) {
 405                                 if (*stackptr >= private->stacksize) {
 406                                         verdict = NF_DROP;
 407                                         break;
 408                                 }
 409                                 jumpstack[(*stackptr)++] = e;
 410                                 pr_debug("Pushed %p into pos %u\n",
 411                                          e, *stackptr - 1);
 412                         }
 413
 414                         e = get_entry(table_base, v);
 415                         continue;
 416                 }
 417
 418                 acpar.target   = t->u.kernel.target;
 419                 acpar.targinfo = t->data;
 420
 421                 verdict = t->u.kernel.target->target(skb, &acpar);
 422                 /* Target might have changed stuff. */
 423                 ip = ip_hdr(skb);
 424                 if (verdict == IPT_CONTINUE)
 425                         e = ipt_next_entry(e);
 426                 else
 427                         /* Verdict */
 428                         break;
 429         } while (!acpar.hotdrop);
 430         xt_info_rdunlock_bh();
 431         pr_debug("Exiting %s; resetting sp from %u to %u\n",
 432                  __func__, *stackptr, origptr);
 433         *stackptr = origptr;
 434 #ifdef DEBUG_ALLOW_ALL
 435         return NF_ACCEPT;
 436 #else
 437         if (acpar.hotdrop)
 438                 return NF_DROP;
 439         else return verdict;
 440 #endif
 441 }
 442
 443 /* Figures out from what hook each rule can be called: returns 0 if
 444    there are loops.  Puts hook bitmask in comefrom. */
 445 static int
 446 mark_source_chains(const struct xt_table_info *newinfo,
 447                    unsigned int valid_hooks, void *entry0)
 448 {
 449         unsigned int hook;
 450
 451         /* No recursion; use packet counter to save back ptrs (reset
 452            to 0 as we leave), and comefrom to save source hook bitmask */
 453         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 454                 unsigned int pos = newinfo->hook_entry[hook];
 455                 struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
 456
 457                 if (!(valid_hooks & (1 << hook)))
 458                         continue;
 459
 460                 /* Set initial back pointer. */
 461                 e->counters.pcnt = pos;
 462
 463                 for (;;) {
 464                         const struct ipt_standard_target *t
 465                                 = (void *)ipt_get_target_c(e);
 466                         int visited = e->comefrom & (1 << hook);
 467
 468                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 469                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
 470                                        hook, pos, e->comefrom);
 471                                 return 0;
 472                         }
 473                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 474
 475                         /* Unconditional return/END. */
 476                         if ((e->target_offset == sizeof(struct ipt_entry) &&
 477                              (strcmp(t->target.u.user.name,
 478                                      IPT_STANDARD_TARGET) == 0) &&
 479                              t->verdict < 0 && unconditional(&e->ip)) ||
 480                             visited) {
 481                                 unsigned int oldpos, size;
 482
 483                                 if ((strcmp(t->target.u.user.name,
 484                                             IPT_STANDARD_TARGET) == 0) &&
 485                                     t->verdict < -NF_MAX_VERDICT - 1) {
 486                                         duprintf("mark_source_chains: bad "
 487                                                 "negative verdict (%i)\n",
 488                                                                 t->verdict);
 489                                         return 0;
 490                                 }
 491
 492                                 /* Return: backtrack through the last
 493                                    big jump. */
 494                                 do {
 495                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 496 #ifdef DEBUG_IP_FIREWALL_USER
 497                                         if (e->comefrom
 498                                             & (1 << NF_INET_NUMHOOKS)) {
 499                                                 duprintf("Back unset "
 500                                                          "on hook %u "
 501                                                          "rule %u\n",
 502                                                          hook, pos);
 503                                         }
 504 #endif
 505                                         oldpos = pos;
 506                                         pos = e->counters.pcnt;
 507                                         e->counters.pcnt = 0;
 508
 509                                         /* We're at the start. */
 510                                         if (pos == oldpos)
 511                                                 goto next;
 512
 513                                         e = (struct ipt_entry *)
 514                                                 (entry0 + pos);
 515                                 } while (oldpos == pos + e->next_offset);
 516
 517                                 /* Move along one */
 518                                 size = e->next_offset;
 519                                 e = (struct ipt_entry *)
 520                                         (entry0 + pos + size);
 521                                 e->counters.pcnt = pos;
 522                                 pos += size;
 523                         } else {
 524                                 int newpos = t->verdict;
 525
 526                                 if (strcmp(t->target.u.user.name,
 527                                            IPT_STANDARD_TARGET) == 0 &&
 528                                     newpos >= 0) {
 529                                         if (newpos > newinfo->size -
 530                                                 sizeof(struct ipt_entry)) {
 531                                                 duprintf("mark_source_chains: "
 532                                                         "bad verdict (%i)\n",
 533                                                                 newpos);
 534                                                 return 0;
 535                                         }
 536                                         /* This a jump; chase it. */
 537                                         duprintf("Jump rule %u -> %u\n",
 538                                                  pos, newpos);
 539                                 } else {
 540                                         /* ... this is a fallthru */
 541                                         newpos = pos + e->next_offset;
 542                                 }
 543                                 e = (struct ipt_entry *)
 544                                         (entry0 + newpos);
 545                                 e->counters.pcnt = pos;
 546                                 pos = newpos;
 547                         }
 548                 }
 549                 next:
 550                 duprintf("Finished chain %u\n", hook);
 551         }
 552         return 1;
 553 }
 554
 555 static void cleanup_match(struct ipt_entry_match *m, struct net *net)
 556 {
 557         struct xt_mtdtor_param par;
 558
 559         par.net       = net;
 560         par.match     = m->u.kernel.match;
 561         par.matchinfo = m->data;
 562         par.family    = NFPROTO_IPV4;
 563         if (par.match->destroy != NULL)
 564                 par.match->destroy(&par);
 565         module_put(par.match->me);
 566 }
 567
 568 static int
 569 check_entry(const struct ipt_entry *e, const char *name)
 570 {
 571         const struct ipt_entry_target *t;
 572
 573         if (!ip_checkentry(&e->ip)) {
 574                 duprintf("ip check failed %p %s.\n", e, par->match->name);
 575                 return -EINVAL;
 576         }
 577
 578         if (e->target_offset + sizeof(struct ipt_entry_target) >
 579             e->next_offset)
 580                 return -EINVAL;
 581
 582         t = ipt_get_target_c(e);
 583         if (e->target_offset + t->u.target_size > e->next_offset)
 584                 return -EINVAL;
 585
 586         return 0;
 587 }
 588
 589 static int
 590 check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 591 {
 592         const struct ipt_ip *ip = par->entryinfo;
 593         int ret;
 594
 595         par->match     = m->u.kernel.match;
 596         par->matchinfo = m->data;
 597
 598         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 599               ip->proto, ip->invflags & IPT_INV_PROTO);
 600         if (ret < 0) {
 601                 duprintf("check failed for `%s'.\n", par->match->name);
 602                 return ret;
 603         }
 604         return 0;
 605 }
 606
 607 static int
 608 find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 609 {
 610         struct xt_match *match;
 611         int ret;
 612
 613         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
 614                                       m->u.user.revision);
 615         if (IS_ERR(match)) {
 616                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 617                 return PTR_ERR(match);
 618         }
 619         m->u.kernel.match = match;
 620
 621         ret = check_match(m, par);
 622         if (ret)
 623                 goto err;
 624
 625         return 0;
 626 err:
 627         module_put(m->u.kernel.match->me);
 628         return ret;
 629 }
 630
 631 static int check_target(struct ipt_entry *e, struct net *net, const char *name)
 632 {
 633         struct ipt_entry_target *t = ipt_get_target(e);
 634         struct xt_tgchk_param par = {
 635                 .net       = net,
 636                 .table     = name,
 637                 .entryinfo = e,
 638                 .target    = t->u.kernel.target,
 639                 .targinfo  = t->data,
 640                 .hook_mask = e->comefrom,
 641                 .family    = NFPROTO_IPV4,
 642         };
 643         int ret;
 644
 645         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 646               e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
 647         if (ret < 0) {
 648                 duprintf("check failed for `%s'.\n",
 649                          t->u.kernel.target->name);
 650                 return ret;
 651         }
 652         return 0;
 653 }
 654
 655 static int
 656 find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
 657                  unsigned int size)
 658 {
 659         struct ipt_entry_target *t;
 660         struct xt_target *target;
 661         int ret;
 662         unsigned int j;
 663         struct xt_mtchk_param mtpar;
 664         struct xt_entry_match *ematch;
 665
 666         ret = check_entry(e, name);
 667         if (ret)
 668                 return ret;
 669
 670         j = 0;
 671         mtpar.net       = net;
 672         mtpar.table     = name;
 673         mtpar.entryinfo = &e->ip;
 674         mtpar.hook_mask = e->comefrom;
 675         mtpar.family    = NFPROTO_IPV4;
 676         xt_ematch_foreach(ematch, e) {
 677                 ret = find_check_match(ematch, &mtpar);
 678                 if (ret != 0)
 679                         goto cleanup_matches;
 680                 ++j;
 681         }
 682
 683         t = ipt_get_target(e);
 684         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
 685                                         t->u.user.revision);
 686         if (IS_ERR(target)) {
 687                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 688                 ret = PTR_ERR(target);
 689                 goto cleanup_matches;
 690         }
 691         t->u.kernel.target = target;
 692
 693         ret = check_target(e, net, name);
 694         if (ret)
 695                 goto err;
 696         return 0;
 697  err:
 698         module_put(t->u.kernel.target->me);
 699  cleanup_matches:
 700         xt_ematch_foreach(ematch, e) {
 701                 if (j-- == 0)
 702                         break;
 703                 cleanup_match(ematch, net);
 704         }
 705         return ret;
 706 }
 707
 708 static bool check_underflow(const struct ipt_entry *e)
 709 {
 710         const struct ipt_entry_target *t;
 711         unsigned int verdict;
 712
 713         if (!unconditional(&e->ip))
 714                 return false;
 715         t = ipt_get_target_c(e);
 716         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 717                 return false;
 718         verdict = ((struct ipt_standard_target *)t)->verdict;
 719         verdict = -verdict - 1;
 720         return verdict == NF_DROP || verdict == NF_ACCEPT;
 721 }
 722
 723 static int
 724 check_entry_size_and_hooks(struct ipt_entry *e,
 725                            struct xt_table_info *newinfo,
 726                            const unsigned char *base,
 727                            const unsigned char *limit,
 728                            const unsigned int *hook_entries,
 729                            const unsigned int *underflows,
 730                            unsigned int valid_hooks)
 731 {
 732         unsigned int h;
 733
 734         if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
 735             (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
 736                 duprintf("Bad offset %p\n", e);
 737                 return -EINVAL;
 738         }
 739
 740         if (e->next_offset
 741             < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
 742                 duprintf("checking: element %p size %u\n",
 743                          e, e->next_offset);
 744                 return -EINVAL;
 745         }
 746
 747         /* Check hooks & underflows */
 748         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 749                 if (!(valid_hooks & (1 << h)))
 750                         continue;
 751                 if ((unsigned char *)e - base == hook_entries[h])
 752                         newinfo->hook_entry[h] = hook_entries[h];
 753                 if ((unsigned char *)e - base == underflows[h]) {
 754                         if (!check_underflow(e)) {
 755                                 pr_err("Underflows must be unconditional and "
 756                                        "use the STANDARD target with "
 757                                        "ACCEPT/DROP\n");
 758                                 return -EINVAL;
 759                         }
 760                         newinfo->underflow[h] = underflows[h];
 761                 }
 762         }
 763
 764         /* Clear counters and comefrom */
 765         e->counters = ((struct xt_counters) { 0, 0 });
 766         e->comefrom = 0;
 767         return 0;
 768 }
 769
 770 static void
 771 cleanup_entry(struct ipt_entry *e, struct net *net)
 772 {
 773         struct xt_tgdtor_param par;
 774         struct ipt_entry_target *t;
 775         struct xt_entry_match *ematch;
 776
 777         /* Cleanup all matches */
 778         xt_ematch_foreach(ematch, e)
 779                 cleanup_match(ematch, net);
 780         t = ipt_get_target(e);
 781
 782         par.net      = net;
 783         par.target   = t->u.kernel.target;
 784         par.targinfo = t->data;
 785         par.family   = NFPROTO_IPV4;
 786         if (par.target->destroy != NULL)
 787                 par.target->destroy(&par);
 788         module_put(par.target->me);
 789 }
 790
 791 /* Checks and translates the user-supplied table segment (held in
 792    newinfo) */
 793 static int
 794 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
 795                 const struct ipt_replace *repl)
 796 {
 797         struct ipt_entry *iter;
 798         unsigned int i;
 799         int ret = 0;
 800
 801         newinfo->size = repl->size;
 802         newinfo->number = repl->num_entries;
 803
 804         /* Init all hooks to impossible value. */
 805         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 806                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 807                 newinfo->underflow[i] = 0xFFFFFFFF;
 808         }
 809
 810         duprintf("translate_table: size %u\n", newinfo->size);
 811         i = 0;
 812         /* Walk through entries, checking offsets. */
 813         xt_entry_foreach(iter, entry0, newinfo->size) {
 814                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 815                                                  entry0 + repl->size,
 816                                                  repl->hook_entry,
 817                                                  repl->underflow,
 818                                                  repl->valid_hooks);
 819                 if (ret != 0)
 820                         return ret;
 821                 ++i;
 822                 if (strcmp(ipt_get_target(iter)->u.user.name,
 823                     XT_ERROR_TARGET) == 0)
 824                         ++newinfo->stacksize;
 825         }
 826
 827         if (i != repl->num_entries) {
 828                 duprintf("translate_table: %u not %u entries\n",
 829                          i, repl->num_entries);
 830                 return -EINVAL;
 831         }
 832
 833         /* Check hooks all assigned */
 834         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 835                 /* Only hooks which are valid */
 836                 if (!(repl->valid_hooks & (1 << i)))
 837                         continue;
 838                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 839                         duprintf("Invalid hook entry %u %u\n",
 840                                  i, repl->hook_entry[i]);
 841                         return -EINVAL;
 842                 }
 843                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 844                         duprintf("Invalid underflow %u %u\n",
 845                                  i, repl->underflow[i]);
 846                         return -EINVAL;
 847                 }
 848         }
 849
 850         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
 851                 return -ELOOP;
 852
 853         /* Finally, each sanity check must pass */
 854         i = 0;
 855         xt_entry_foreach(iter, entry0, newinfo->size) {
 856                 ret = find_check_entry(iter, net, repl->name, repl->size);
 857                 if (ret != 0)
 858                         break;
 859                 ++i;
 860         }
 861
 862         if (ret != 0) {
 863                 xt_entry_foreach(iter, entry0, newinfo->size) {
 864                         if (i-- == 0)
 865                                 break;
 866                         cleanup_entry(iter, net);
 867                 }
 868                 return ret;
 869         }
 870
 871         /* And one copy for every other CPU */
 872         for_each_possible_cpu(i) {
 873                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 874                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 875         }
 876
 877         return ret;
 878 }
 879
 880 static void
 881 get_counters(const struct xt_table_info *t,
 882              struct xt_counters counters[])
 883 {
 884         struct ipt_entry *iter;
 885         unsigned int cpu;
 886         unsigned int i;
 887         unsigned int curcpu = get_cpu();
 888
 889         /* Instead of clearing (by a previous call to memset())
 890          * the counters and using adds, we set the counters
 891          * with data used by 'current' CPU.
 892          *
 893          * Bottom half has to be disabled to prevent deadlock
 894          * if new softirq were to run and call ipt_do_table
 895          */
 896         local_bh_disable();
 897         i = 0;
 898         xt_entry_foreach(iter, t->entries[curcpu], t->size) {
 899                 SET_COUNTER(counters[i], iter->counters.bcnt,
 900                             iter->counters.pcnt);
 901                 ++i;
 902         }
 903         local_bh_enable();
 904         /* Processing counters from other cpus, we can let bottom half enabled,
 905          * (preemption is disabled)
 906          */
 907
 908         for_each_possible_cpu(cpu) {
 909                 if (cpu == curcpu)
 910                         continue;
 911                 i = 0;
 912                 local_bh_disable();
 913                 xt_info_wrlock(cpu);
 914                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
 915                         ADD_COUNTER(counters[i], iter->counters.bcnt,
 916                                     iter->counters.pcnt);
 917                         ++i; /* macro does multi eval of i */
 918                 }
 919                 xt_info_wrunlock(cpu);
 920                 local_bh_enable();
 921         }
 922         put_cpu();
 923 }
 924
 925 static struct xt_counters *alloc_counters(const struct xt_table *table)
 926 {
 927         unsigned int countersize;
 928         struct xt_counters *counters;
 929         const struct xt_table_info *private = table->private;
 930
 931         /* We need atomic snapshot of counters: rest doesn't change
 932            (other than comefrom, which userspace doesn't care
 933            about). */
 934         countersize = sizeof(struct xt_counters) * private->number;
 935         counters = vmalloc(countersize);
 936
 937         if (counters == NULL)
 938                 return ERR_PTR(-ENOMEM);
 939
 940         get_counters(private, counters);
 941
 942         return counters;
 943 }
 944
 945 static int
 946 copy_entries_to_user(unsigned int total_size,
 947                      const struct xt_table *table,
 948                      void __user *userptr)
 949 {
 950         unsigned int off, num;
 951         const struct ipt_entry *e;
 952         struct xt_counters *counters;
 953         const struct xt_table_info *private = table->private;
 954         int ret = 0;
 955         const void *loc_cpu_entry;
 956
 957         counters = alloc_counters(table);
 958         if (IS_ERR(counters))
 959                 return PTR_ERR(counters);
 960
 961         /* choose the copy that is on our node/cpu, ...
 962          * This choice is lazy (because current thread is
 963          * allowed to migrate to another cpu)
 964          */
 965         loc_cpu_entry = private->entries[raw_smp_processor_id()];
 966         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 967                 ret = -EFAULT;
 968                 goto free_counters;
 969         }
 970
 971         /* FIXME: use iterator macros --RR */
 972         /* ... then go back and fix counters and names */
 973         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 974                 unsigned int i;
 975                 const struct ipt_entry_match *m;
 976                 const struct ipt_entry_target *t;
 977
 978                 e = (struct ipt_entry *)(loc_cpu_entry + off);
 979                 if (copy_to_user(userptr + off
 980                                  + offsetof(struct ipt_entry, counters),
 981                                  &counters[num],
 982                                  sizeof(counters[num])) != 0) {
 983                         ret = -EFAULT;
 984                         goto free_counters;
 985                 }
 986
 987                 for (i = sizeof(struct ipt_entry);
 988                      i < e->target_offset;
 989                      i += m->u.match_size) {
 990                         m = (void *)e + i;
 991
 992                         if (copy_to_user(userptr + off + i
 993                                          + offsetof(struct ipt_entry_match,
 994                                                     u.user.name),
 995                                          m->u.kernel.match->name,
 996                                          strlen(m->u.kernel.match->name)+1)
 997                             != 0) {
 998                                 ret = -EFAULT;
 999                                 goto free_counters;
1000                         }
1001                 }
1002
1003                 t = ipt_get_target_c(e);
1004                 if (copy_to_user(userptr + off + e->target_offset
1005                                  + offsetof(struct ipt_entry_target,
1006                                             u.user.name),
1007                                  t->u.kernel.target->name,
1008                                  strlen(t->u.kernel.target->name)+1) != 0) {
1009                         ret = -EFAULT;
1010                         goto free_counters;
1011                 }
1012         }
1013
1014  free_counters:
1015         vfree(counters);
1016         return ret;
1017 }
1018
1019 #ifdef CONFIG_COMPAT
1020 static void compat_standard_from_user(void *dst, const void *src)
1021 {
1022         int v = *(compat_int_t *)src;
1023
1024         if (v > 0)
1025                 v += xt_compat_calc_jump(AF_INET, v);
1026         memcpy(dst, &v, sizeof(v));
1027 }
1028
1029 static int compat_standard_to_user(void __user *dst, const void *src)
1030 {
1031         compat_int_t cv = *(int *)src;
1032
1033         if (cv > 0)
1034                 cv -= xt_compat_calc_jump(AF_INET, cv);
1035         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1036 }
1037
1038 static int compat_calc_entry(const struct ipt_entry *e,
1039                              const struct xt_table_info *info,
1040                              const void *base, struct xt_table_info *newinfo)
1041 {
1042         const struct xt_entry_match *ematch;
1043         const struct ipt_entry_target *t;
1044         unsigned int entry_offset;
1045         int off, i, ret;
1046
1047         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1048         entry_offset = (void *)e - base;
1049         xt_ematch_foreach(ematch, e)
1050                 off += xt_compat_match_offset(ematch->u.kernel.match);
1051         t = ipt_get_target_c(e);
1052         off += xt_compat_target_offset(t->u.kernel.target);
1053         newinfo->size -= off;
1054         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1055         if (ret)
1056                 return ret;
1057
1058         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1059                 if (info->hook_entry[i] &&
1060                     (e < (struct ipt_entry *)(base + info->hook_entry[i])))
1061                         newinfo->hook_entry[i] -= off;
1062                 if (info->underflow[i] &&
1063                     (e < (struct ipt_entry *)(base + info->underflow[i])))
1064                         newinfo->underflow[i] -= off;
1065         }
1066         return 0;
1067 }
1068
1069 static int compat_table_info(const struct xt_table_info *info,
1070                              struct xt_table_info *newinfo)
1071 {
1072         struct ipt_entry *iter;
1073         void *loc_cpu_entry;
1074         int ret;
1075
1076         if (!newinfo || !info)
1077                 return -EINVAL;
1078
1079         /* we dont care about newinfo->entries[] */
1080         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1081         newinfo->initial_entries = 0;
1082         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1083         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1084                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1085                 if (ret != 0)
1086                         return ret;
1087         }
1088         return 0;
1089 }
1090 #endif
1091
1092 static int get_info(struct net *net, void __user *user,
1093                     const int *len, int compat)
1094 {
1095         char name[IPT_TABLE_MAXNAMELEN];
1096         struct xt_table *t;
1097         int ret;
1098
1099         if (*len != sizeof(struct ipt_getinfo)) {
1100                 duprintf("length %u != %zu\n", *len,
1101                          sizeof(struct ipt_getinfo));
1102                 return -EINVAL;
1103         }
1104
1105         if (copy_from_user(name, user, sizeof(name)) != 0)
1106                 return -EFAULT;
1107
1108         name[IPT_TABLE_MAXNAMELEN-1] = '\0';
1109 #ifdef CONFIG_COMPAT
1110         if (compat)
1111                 xt_compat_lock(AF_INET);
1112 #endif
1113         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1114                                     "iptable_%s", name);
1115         if (t && !IS_ERR(t)) {
1116                 struct ipt_getinfo info;
1117                 const struct xt_table_info *private = t->private;
1118 #ifdef CONFIG_COMPAT
1119                 struct xt_table_info tmp;
1120
1121                 if (compat) {
1122                         ret = compat_table_info(private, &tmp);
1123                         xt_compat_flush_offsets(AF_INET);
1124                         private = &tmp;
1125                 }
1126 #endif
1127                 info.valid_hooks = t->valid_hooks;
1128                 memcpy(info.hook_entry, private->hook_entry,
1129                        sizeof(info.hook_entry));
1130                 memcpy(info.underflow, private->underflow,
1131                        sizeof(info.underflow));
1132                 info.num_entries = private->number;
1133                 info.size = private->size;
1134                 strcpy(info.name, name);
1135
1136                 if (copy_to_user(user, &info, *len) != 0)
1137                         ret = -EFAULT;
1138                 else
1139                         ret = 0;
1140
1141                 xt_table_unlock(t);
1142                 module_put(t->me);
1143         } else
1144                 ret = t ? PTR_ERR(t) : -ENOENT;
1145 #ifdef CONFIG_COMPAT
1146         if (compat)
1147                 xt_compat_unlock(AF_INET);
1148 #endif
1149         return ret;
1150 }
1151
1152 static int
1153 get_entries(struct net *net, struct ipt_get_entries __user *uptr,
1154             const int *len)
1155 {
1156         int ret;
1157         struct ipt_get_entries get;
1158         struct xt_table *t;
1159
1160         if (*len < sizeof(get)) {
1161                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1162                 return -EINVAL;
1163         }
1164         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1165                 return -EFAULT;
1166         if (*len != sizeof(struct ipt_get_entries) + get.size) {
1167                 duprintf("get_entries: %u != %zu\n",
1168                          *len, sizeof(get) + get.size);
1169                 return -EINVAL;
1170         }
1171
1172         t = xt_find_table_lock(net, AF_INET, get.name);
1173         if (t && !IS_ERR(t)) {
1174                 const struct xt_table_info *private = t->private;
1175                 duprintf("t->private->number = %u\n", private->number);
1176                 if (get.size == private->size)
1177                         ret = copy_entries_to_user(private->size,
1178                                                    t, uptr->entrytable);
1179                 else {
1180                         duprintf("get_entries: I've got %u not %u!\n",
1181                                  private->size, get.size);
1182                         ret = -EAGAIN;
1183                 }
1184                 module_put(t->me);
1185                 xt_table_unlock(t);
1186         } else
1187                 ret = t ? PTR_ERR(t) : -ENOENT;
1188
1189         return ret;
1190 }
1191
1192 static int
1193 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1194              struct xt_table_info *newinfo, unsigned int num_counters,
1195              void __user *counters_ptr)
1196 {
1197         int ret;
1198         struct xt_table *t;
1199         struct xt_table_info *oldinfo;
1200         struct xt_counters *counters;
1201         void *loc_cpu_old_entry;
1202         struct ipt_entry *iter;
1203
1204         ret = 0;
1205         counters = vmalloc(num_counters * sizeof(struct xt_counters));
1206         if (!counters) {
1207                 ret = -ENOMEM;
1208                 goto out;
1209         }
1210
1211         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1212                                     "iptable_%s", name);
1213         if (!t || IS_ERR(t)) {
1214                 ret = t ? PTR_ERR(t) : -ENOENT;
1215                 goto free_newinfo_counters_untrans;
1216         }
1217
1218         /* You lied! */
1219         if (valid_hooks != t->valid_hooks) {
1220                 duprintf("Valid hook crap: %08X vs %08X\n",
1221                          valid_hooks, t->valid_hooks);
1222                 ret = -EINVAL;
1223                 goto put_module;
1224         }
1225
1226         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1227         if (!oldinfo)
1228                 goto put_module;
1229
1230         /* Update module usage count based on number of rules */
1231         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1232                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1233         if ((oldinfo->number > oldinfo->initial_entries) ||
1234             (newinfo->number <= oldinfo->initial_entries))
1235                 module_put(t->me);
1236         if ((oldinfo->number > oldinfo->initial_entries) &&
1237             (newinfo->number <= oldinfo->initial_entries))
1238                 module_put(t->me);
1239
1240         /* Get the old counters, and synchronize with replace */
1241         get_counters(oldinfo, counters);
1242
1243         /* Decrease module usage counts and free resource */
1244         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1245         xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1246                 cleanup_entry(iter, net);
1247
1248         xt_free_table_info(oldinfo);
1249         if (copy_to_user(counters_ptr, counters,
1250                          sizeof(struct xt_counters) * num_counters) != 0)
1251                 ret = -EFAULT;
1252         vfree(counters);
1253         xt_table_unlock(t);
1254         return ret;
1255
1256  put_module:
1257         module_put(t->me);
1258         xt_table_unlock(t);
1259  free_newinfo_counters_untrans:
1260         vfree(counters);
1261  out:
1262         return ret;
1263 }
1264
1265 static int
1266 do_replace(struct net *net, const void __user *user, unsigned int len)
1267 {
1268         int ret;
1269         struct ipt_replace tmp;
1270         struct xt_table_info *newinfo;
1271         void *loc_cpu_entry;
1272         struct ipt_entry *iter;
1273
1274         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1275                 return -EFAULT;
1276
1277         /* overflow check */
1278         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1279                 return -ENOMEM;
1280
1281         newinfo = xt_alloc_table_info(tmp.size);
1282         if (!newinfo)
1283                 return -ENOMEM;
1284
1285         /* choose the copy that is on our node/cpu */
1286         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1287         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1288                            tmp.size) != 0) {
1289                 ret = -EFAULT;
1290                 goto free_newinfo;
1291         }
1292
1293         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1294         if (ret != 0)
1295                 goto free_newinfo;
1296
1297         duprintf("Translated table\n");
1298
1299         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1300                            tmp.num_counters, tmp.counters);
1301         if (ret)
1302                 goto free_newinfo_untrans;
1303         return 0;
1304
1305  free_newinfo_untrans:
1306         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1307                 cleanup_entry(iter, net);
1308  free_newinfo:
1309         xt_free_table_info(newinfo);
1310         return ret;
1311 }
1312
1313 static int
1314 do_add_counters(struct net *net, const void __user *user,
1315                 unsigned int len, int compat)
1316 {
1317         unsigned int i, curcpu;
1318         struct xt_counters_info tmp;
1319         struct xt_counters *paddc;
1320         unsigned int num_counters;
1321         const char *name;
1322         int size;
1323         void *ptmp;
1324         struct xt_table *t;
1325         const struct xt_table_info *private;
1326         int ret = 0;
1327         void *loc_cpu_entry;
1328         struct ipt_entry *iter;
1329 #ifdef CONFIG_COMPAT
1330         struct compat_xt_counters_info compat_tmp;
1331
1332         if (compat) {
1333                 ptmp = &compat_tmp;
1334                 size = sizeof(struct compat_xt_counters_info);
1335         } else
1336 #endif
1337         {
1338                 ptmp = &tmp;
1339                 size = sizeof(struct xt_counters_info);
1340         }
1341
1342         if (copy_from_user(ptmp, user, size) != 0)
1343                 return -EFAULT;
1344
1345 #ifdef CONFIG_COMPAT
1346         if (compat) {
1347                 num_counters = compat_tmp.num_counters;
1348                 name = compat_tmp.name;
1349         } else
1350 #endif
1351         {
1352                 num_counters = tmp.num_counters;
1353                 name = tmp.name;
1354         }
1355
1356         if (len != size + num_counters * sizeof(struct xt_counters))
1357                 return -EINVAL;
1358
1359         paddc = vmalloc(len - size);
1360         if (!paddc)
1361                 return -ENOMEM;
1362
1363         if (copy_from_user(paddc, user + size, len - size) != 0) {
1364                 ret = -EFAULT;
1365                 goto free;
1366         }
1367
1368         t = xt_find_table_lock(net, AF_INET, name);
1369         if (!t || IS_ERR(t)) {
1370                 ret = t ? PTR_ERR(t) : -ENOENT;
1371                 goto free;
1372         }
1373
1374         local_bh_disable();
1375         private = t->private;
1376         if (private->number != num_counters) {
1377                 ret = -EINVAL;
1378                 goto unlock_up_free;
1379         }
1380
1381         i = 0;
1382         /* Choose the copy that is on our node */
1383         curcpu = smp_processor_id();
1384         loc_cpu_entry = private->entries[curcpu];
1385         xt_info_wrlock(curcpu);
1386         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
1387                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
1388                 ++i;
1389         }
1390         xt_info_wrunlock(curcpu);
1391  unlock_up_free:
1392         local_bh_enable();
1393         xt_table_unlock(t);
1394         module_put(t->me);
1395  free:
1396         vfree(paddc);
1397
1398         return ret;
1399 }
1400
1401 #ifdef CONFIG_COMPAT
1402 struct compat_ipt_replace {
1403         char                    name[IPT_TABLE_MAXNAMELEN];
1404         u32                     valid_hooks;
1405         u32                     num_entries;
1406         u32                     size;
1407         u32                     hook_entry[NF_INET_NUMHOOKS];
1408         u32                     underflow[NF_INET_NUMHOOKS];
1409         u32                     num_counters;
1410         compat_uptr_t           counters;       /* struct ipt_counters * */
1411         struct compat_ipt_entry entries[0];
1412 };
1413
1414 static int
1415 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1416                           unsigned int *size, struct xt_counters *counters,
1417                           unsigned int i)
1418 {
1419         struct ipt_entry_target *t;
1420         struct compat_ipt_entry __user *ce;
1421         u_int16_t target_offset, next_offset;
1422         compat_uint_t origsize;
1423         const struct xt_entry_match *ematch;
1424         int ret = 0;
1425
1426         origsize = *size;
1427         ce = (struct compat_ipt_entry __user *)*dstptr;
1428         if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
1429             copy_to_user(&ce->counters, &counters[i],
1430             sizeof(counters[i])) != 0)
1431                 return -EFAULT;
1432
1433         *dstptr += sizeof(struct compat_ipt_entry);
1434         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1435
1436         xt_ematch_foreach(ematch, e) {
1437                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1438                 if (ret != 0)
1439                         return ret;
1440         }
1441         target_offset = e->target_offset - (origsize - *size);
1442         t = ipt_get_target(e);
1443         ret = xt_compat_target_to_user(t, dstptr, size);
1444         if (ret)
1445                 return ret;
1446         next_offset = e->next_offset - (origsize - *size);
1447         if (put_user(target_offset, &ce->target_offset) != 0 ||
1448             put_user(next_offset, &ce->next_offset) != 0)
1449                 return -EFAULT;
1450         return 0;
1451 }
1452
1453 static int
1454 compat_find_calc_match(struct ipt_entry_match *m,
1455                        const char *name,
1456                        const struct ipt_ip *ip,
1457                        unsigned int hookmask,
1458                        int *size)
1459 {
1460         struct xt_match *match;
1461
1462         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
1463                                       m->u.user.revision);
1464         if (IS_ERR(match)) {
1465                 duprintf("compat_check_calc_match: `%s' not found\n",
1466                          m->u.user.name);
1467                 return PTR_ERR(match);
1468         }
1469         m->u.kernel.match = match;
1470         *size += xt_compat_match_offset(match);
1471         return 0;
1472 }
1473
1474 static void compat_release_entry(struct compat_ipt_entry *e)
1475 {
1476         struct ipt_entry_target *t;
1477         struct xt_entry_match *ematch;
1478
1479         /* Cleanup all matches */
1480         xt_ematch_foreach(ematch, e)
1481                 module_put(ematch->u.kernel.match->me);
1482         t = compat_ipt_get_target(e);
1483         module_put(t->u.kernel.target->me);
1484 }
1485
1486 static int
1487 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1488                                   struct xt_table_info *newinfo,
1489                                   unsigned int *size,
1490                                   const unsigned char *base,
1491                                   const unsigned char *limit,
1492                                   const unsigned int *hook_entries,
1493                                   const unsigned int *underflows,
1494                                   const char *name)
1495 {
1496         struct xt_entry_match *ematch;
1497         struct ipt_entry_target *t;
1498         struct xt_target *target;
1499         unsigned int entry_offset;
1500         unsigned int j;
1501         int ret, off, h;
1502
1503         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1504         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
1505             (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1506                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1507                 return -EINVAL;
1508         }
1509
1510         if (e->next_offset < sizeof(struct compat_ipt_entry) +
1511                              sizeof(struct compat_xt_entry_target)) {
1512                 duprintf("checking: element %p size %u\n",
1513                          e, e->next_offset);
1514                 return -EINVAL;
1515         }
1516
1517         /* For purposes of check_entry casting the compat entry is fine */
1518         ret = check_entry((struct ipt_entry *)e, name);
1519         if (ret)
1520                 return ret;
1521
1522         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1523         entry_offset = (void *)e - (void *)base;
1524         j = 0;
1525         xt_ematch_foreach(ematch, e) {
1526                 ret = compat_find_calc_match(ematch, name,
1527                                              &e->ip, e->comefrom, &off);
1528                 if (ret != 0)
1529                         goto release_matches;
1530                 ++j;
1531         }
1532
1533         t = compat_ipt_get_target(e);
1534         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
1535                                         t->u.user.revision);
1536         if (IS_ERR(target)) {
1537                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1538                          t->u.user.name);
1539                 ret = PTR_ERR(target);
1540                 goto release_matches;
1541         }
1542         t->u.kernel.target = target;
1543
1544         off += xt_compat_target_offset(target);
1545         *size += off;
1546         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1547         if (ret)
1548                 goto out;
1549
1550         /* Check hooks & underflows */
1551         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1552                 if ((unsigned char *)e - base == hook_entries[h])
1553                         newinfo->hook_entry[h] = hook_entries[h];
1554                 if ((unsigned char *)e - base == underflows[h])
1555                         newinfo->underflow[h] = underflows[h];
1556         }
1557
1558         /* Clear counters and comefrom */
1559         memset(&e->counters, 0, sizeof(e->counters));
1560         e->comefrom = 0;
1561         return 0;
1562
1563 out:
1564         module_put(t->u.kernel.target->me);
1565 release_matches:
1566         xt_ematch_foreach(ematch, e) {
1567                 if (j-- == 0)
1568                         break;
1569                 module_put(ematch->u.kernel.match->me);
1570         }
1571         return ret;
1572 }
1573
1574 static int
1575 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1576                             unsigned int *size, const char *name,
1577                             struct xt_table_info *newinfo, unsigned char *base)
1578 {
1579         struct ipt_entry_target *t;
1580         struct xt_target *target;
1581         struct ipt_entry *de;
1582         unsigned int origsize;
1583         int ret, h;
1584         struct xt_entry_match *ematch;
1585
1586         ret = 0;
1587         origsize = *size;
1588         de = (struct ipt_entry *)*dstptr;
1589         memcpy(de, e, sizeof(struct ipt_entry));
1590         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1591
1592         *dstptr += sizeof(struct ipt_entry);
1593         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1594
1595         xt_ematch_foreach(ematch, e) {
1596                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1597                 if (ret != 0)
1598                         return ret;
1599         }
1600         de->target_offset = e->target_offset - (origsize - *size);
1601         t = compat_ipt_get_target(e);
1602         target = t->u.kernel.target;
1603         xt_compat_target_from_user(t, dstptr, size);
1604
1605         de->next_offset = e->next_offset - (origsize - *size);
1606         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1607                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1608                         newinfo->hook_entry[h] -= origsize - *size;
1609                 if ((unsigned char *)de - base < newinfo->underflow[h])
1610                         newinfo->underflow[h] -= origsize - *size;
1611         }
1612         return ret;
1613 }
1614
1615 static int
1616 compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
1617 {
1618         struct xt_entry_match *ematch;
1619         struct xt_mtchk_param mtpar;
1620         unsigned int j;
1621         int ret = 0;
1622
1623         j = 0;
1624         mtpar.net       = net;
1625         mtpar.table     = name;
1626         mtpar.entryinfo = &e->ip;
1627         mtpar.hook_mask = e->comefrom;
1628         mtpar.family    = NFPROTO_IPV4;
1629         xt_ematch_foreach(ematch, e) {
1630                 ret = check_match(ematch, &mtpar);
1631                 if (ret != 0)
1632                         goto cleanup_matches;
1633                 ++j;
1634         }
1635
1636         ret = check_target(e, net, name);
1637         if (ret)
1638                 goto cleanup_matches;
1639         return 0;
1640
1641  cleanup_matches:
1642         xt_ematch_foreach(ematch, e) {
1643                 if (j-- == 0)
1644                         break;
1645                 cleanup_match(ematch, net);
1646         }
1647         return ret;
1648 }
1649
1650 static int
1651 translate_compat_table(struct net *net,
1652                        const char *name,
1653                        unsigned int valid_hooks,
1654                        struct xt_table_info **pinfo,
1655                        void **pentry0,
1656                        unsigned int total_size,
1657                        unsigned int number,
1658                        unsigned int *hook_entries,
1659                        unsigned int *underflows)
1660 {
1661         unsigned int i, j;
1662         struct xt_table_info *newinfo, *info;
1663         void *pos, *entry0, *entry1;
1664         struct compat_ipt_entry *iter0;
1665         struct ipt_entry *iter1;
1666         unsigned int size;
1667         int ret;
1668
1669         info = *pinfo;
1670         entry0 = *pentry0;
1671         size = total_size;
1672         info->number = number;
1673
1674         /* Init all hooks to impossible value. */
1675         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1676                 info->hook_entry[i] = 0xFFFFFFFF;
1677                 info->underflow[i] = 0xFFFFFFFF;
1678         }
1679
1680         duprintf("translate_compat_table: size %u\n", info->size);
1681         j = 0;
1682         xt_compat_lock(AF_INET);
1683         /* Walk through entries, checking offsets. */
1684         xt_entry_foreach(iter0, entry0, total_size) {
1685                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1686                                                         entry0,
1687                                                         entry0 + total_size,
1688                                                         hook_entries,
1689                                                         underflows,
1690                                                         name);
1691                 if (ret != 0)
1692                         goto out_unlock;
1693                 ++j;
1694         }
1695
1696         ret = -EINVAL;
1697         if (j != number) {
1698                 duprintf("translate_compat_table: %u not %u entries\n",
1699                          j, number);
1700                 goto out_unlock;
1701         }
1702
1703         /* Check hooks all assigned */
1704         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1705                 /* Only hooks which are valid */
1706                 if (!(valid_hooks & (1 << i)))
1707                         continue;
1708                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1709                         duprintf("Invalid hook entry %u %u\n",
1710                                  i, hook_entries[i]);
1711                         goto out_unlock;
1712                 }
1713                 if (info->underflow[i] == 0xFFFFFFFF) {
1714                         duprintf("Invalid underflow %u %u\n",
1715                                  i, underflows[i]);
1716                         goto out_unlock;
1717                 }
1718         }
1719
1720         ret = -ENOMEM;
1721         newinfo = xt_alloc_table_info(size);
1722         if (!newinfo)
1723                 goto out_unlock;
1724
1725         newinfo->number = number;
1726         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1727                 newinfo->hook_entry[i] = info->hook_entry[i];
1728                 newinfo->underflow[i] = info->underflow[i];
1729         }
1730         entry1 = newinfo->entries[raw_smp_processor_id()];
1731         pos = entry1;
1732         size = total_size;
1733         xt_entry_foreach(iter0, entry0, total_size) {
1734                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1735                                                   name, newinfo, entry1);
1736                 if (ret != 0)
1737                         break;
1738         }
1739         xt_compat_flush_offsets(AF_INET);
1740         xt_compat_unlock(AF_INET);
1741         if (ret)
1742                 goto free_newinfo;
1743
1744         ret = -ELOOP;
1745         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1746                 goto free_newinfo;
1747
1748         i = 0;
1749         xt_entry_foreach(iter1, entry1, newinfo->size) {
1750                 ret = compat_check_entry(iter1, net, name);
1751                 if (ret != 0)
1752                         break;
1753                 ++i;
1754         }
1755         if (ret) {
1756                 /*
1757                  * The first i matches need cleanup_entry (calls ->destroy)
1758                  * because they had called ->check already. The other j-i
1759                  * entries need only release.
1760                  */
1761                 int skip = i;
1762                 j -= i;
1763                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1764                         if (skip-- > 0)
1765                                 continue;
1766                         if (j-- == 0)
1767                                 break;
1768                         compat_release_entry(iter0);
1769                 }
1770                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1771                         if (i-- == 0)
1772                                 break;
1773                         cleanup_entry(iter1, net);
1774                 }
1775                 xt_free_table_info(newinfo);
1776                 return ret;
1777         }
1778
1779         /* And one copy for every other CPU */
1780         for_each_possible_cpu(i)
1781                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1782                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1783
1784         *pinfo = newinfo;
1785         *pentry0 = entry1;
1786         xt_free_table_info(info);
1787         return 0;
1788
1789 free_newinfo:
1790         xt_free_table_info(newinfo);
1791 out:
1792         xt_entry_foreach(iter0, entry0, total_size) {
1793                 if (j-- == 0)
1794                         break;
1795                 compat_release_entry(iter0);
1796         }
1797         return ret;
1798 out_unlock:
1799         xt_compat_flush_offsets(AF_INET);
1800         xt_compat_unlock(AF_INET);
1801         goto out;
1802 }
1803
1804 static int
1805 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1806 {
1807         int ret;
1808         struct compat_ipt_replace tmp;
1809         struct xt_table_info *newinfo;
1810         void *loc_cpu_entry;
1811         struct ipt_entry *iter;
1812
1813         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1814                 return -EFAULT;
1815
1816         /* overflow check */
1817         if (tmp.size >= INT_MAX / num_possible_cpus())
1818                 return -ENOMEM;
1819         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1820                 return -ENOMEM;
1821
1822         newinfo = xt_alloc_table_info(tmp.size);
1823         if (!newinfo)
1824                 return -ENOMEM;
1825
1826         /* choose the copy that is on our node/cpu */
1827         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1828         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1829                            tmp.size) != 0) {
1830                 ret = -EFAULT;
1831                 goto free_newinfo;
1832         }
1833
1834         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1835                                      &newinfo, &loc_cpu_entry, tmp.size,
1836                                      tmp.num_entries, tmp.hook_entry,
1837                                      tmp.underflow);
1838         if (ret != 0)
1839                 goto free_newinfo;
1840
1841         duprintf("compat_do_replace: Translated table\n");
1842
1843         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1844                            tmp.num_counters, compat_ptr(tmp.counters));
1845         if (ret)
1846                 goto free_newinfo_untrans;
1847         return 0;
1848
1849  free_newinfo_untrans:
1850         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1851                 cleanup_entry(iter, net);
1852  free_newinfo:
1853         xt_free_table_info(newinfo);
1854         return ret;
1855 }
1856
1857 static int
1858 compat_do_ipt_set_ctl(struct sock *sk,  int cmd, void __user *user,
1859                       unsigned int len)
1860 {
1861         int ret;
1862
1863         if (!capable(CAP_NET_ADMIN))
1864                 return -EPERM;
1865
1866         switch (cmd) {
1867         case IPT_SO_SET_REPLACE:
1868                 ret = compat_do_replace(sock_net(sk), user, len);
1869                 break;
1870
1871         case IPT_SO_SET_ADD_COUNTERS:
1872                 ret = do_add_counters(sock_net(sk), user, len, 1);
1873                 break;
1874
1875         default:
1876                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
1877                 ret = -EINVAL;
1878         }
1879
1880         return ret;
1881 }
1882
1883 struct compat_ipt_get_entries {
1884         char name[IPT_TABLE_MAXNAMELEN];
1885         compat_uint_t size;
1886         struct compat_ipt_entry entrytable[0];
1887 };
1888
1889 static int
1890 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1891                             void __user *userptr)
1892 {
1893         struct xt_counters *counters;
1894         const struct xt_table_info *private = table->private;
1895         void __user *pos;
1896         unsigned int size;
1897         int ret = 0;
1898         const void *loc_cpu_entry;
1899         unsigned int i = 0;
1900         struct ipt_entry *iter;
1901
1902         counters = alloc_counters(table);
1903         if (IS_ERR(counters))
1904                 return PTR_ERR(counters);
1905
1906         /* choose the copy that is on our node/cpu, ...
1907          * This choice is lazy (because current thread is
1908          * allowed to migrate to another cpu)
1909          */
1910         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1911         pos = userptr;
1912         size = total_size;
1913         xt_entry_foreach(iter, loc_cpu_entry, total_size) {
1914                 ret = compat_copy_entry_to_user(iter, &pos,
1915                                                 &size, counters, i++);
1916                 if (ret != 0)
1917                         break;
1918         }
1919
1920         vfree(counters);
1921         return ret;
1922 }
1923
1924 static int
1925 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1926                    int *len)
1927 {
1928         int ret;
1929         struct compat_ipt_get_entries get;
1930         struct xt_table *t;
1931
1932         if (*len < sizeof(get)) {
1933                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1934                 return -EINVAL;
1935         }
1936
1937         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1938                 return -EFAULT;
1939
1940         if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1941                 duprintf("compat_get_entries: %u != %zu\n",
1942                          *len, sizeof(get) + get.size);
1943                 return -EINVAL;
1944         }
1945
1946         xt_compat_lock(AF_INET);
1947         t = xt_find_table_lock(net, AF_INET, get.name);
1948         if (t && !IS_ERR(t)) {
1949                 const struct xt_table_info *private = t->private;
1950                 struct xt_table_info info;
1951                 duprintf("t->private->number = %u\n", private->number);
1952                 ret = compat_table_info(private, &info);
1953                 if (!ret && get.size == info.size) {
1954                         ret = compat_copy_entries_to_user(private->size,
1955                                                           t, uptr->entrytable);
1956                 } else if (!ret) {
1957                         duprintf("compat_get_entries: I've got %u not %u!\n",
1958                                  private->size, get.size);
1959                         ret = -EAGAIN;
1960                 }
1961                 xt_compat_flush_offsets(AF_INET);
1962                 module_put(t->me);
1963                 xt_table_unlock(t);
1964         } else
1965                 ret = t ? PTR_ERR(t) : -ENOENT;
1966
1967         xt_compat_unlock(AF_INET);
1968         return ret;
1969 }
1970
1971 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
1972
1973 static int
1974 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1975 {
1976         int ret;
1977
1978         if (!capable(CAP_NET_ADMIN))
1979                 return -EPERM;
1980
1981         switch (cmd) {
1982         case IPT_SO_GET_INFO:
1983                 ret = get_info(sock_net(sk), user, len, 1);
1984                 break;
1985         case IPT_SO_GET_ENTRIES:
1986                 ret = compat_get_entries(sock_net(sk), user, len);
1987                 break;
1988         default:
1989                 ret = do_ipt_get_ctl(sk, cmd, user, len);
1990         }
1991         return ret;
1992 }
1993 #endif
1994
1995 static int
1996 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1997 {
1998         int ret;
1999
2000         if (!capable(CAP_NET_ADMIN))
2001                 return -EPERM;
2002
2003         switch (cmd) {
2004         case IPT_SO_SET_REPLACE:
2005                 ret = do_replace(sock_net(sk), user, len);
2006                 break;
2007
2008         case IPT_SO_SET_ADD_COUNTERS:
2009                 ret = do_add_counters(sock_net(sk), user, len, 0);
2010                 break;
2011
2012         default:
2013                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
2014                 ret = -EINVAL;
2015         }
2016
2017         return ret;
2018 }
2019
2020 static int
2021 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2022 {
2023         int ret;
2024
2025         if (!capable(CAP_NET_ADMIN))
2026                 return -EPERM;
2027
2028         switch (cmd) {
2029         case IPT_SO_GET_INFO:
2030                 ret = get_info(sock_net(sk), user, len, 0);
2031                 break;
2032
2033         case IPT_SO_GET_ENTRIES:
2034                 ret = get_entries(sock_net(sk), user, len);
2035                 break;
2036
2037         case IPT_SO_GET_REVISION_MATCH:
2038         case IPT_SO_GET_REVISION_TARGET: {
2039                 struct ipt_get_revision rev;
2040                 int target;
2041
2042                 if (*len != sizeof(rev)) {
2043                         ret = -EINVAL;
2044                         break;
2045                 }
2046                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2047                         ret = -EFAULT;
2048                         break;
2049                 }
2050
2051                 if (cmd == IPT_SO_GET_REVISION_TARGET)
2052                         target = 1;
2053                 else
2054                         target = 0;
2055
2056                 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2057                                                          rev.revision,
2058                                                          target, &ret),
2059                                         "ipt_%s", rev.name);
2060                 break;
2061         }
2062
2063         default:
2064                 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2065                 ret = -EINVAL;
2066         }
2067
2068         return ret;
2069 }
2070
2071 struct xt_table *ipt_register_table(struct net *net,
2072                                     const struct xt_table *table,
2073                                     const struct ipt_replace *repl)
2074 {
2075         int ret;
2076         struct xt_table_info *newinfo;
2077         struct xt_table_info bootstrap = {0};
2078         void *loc_cpu_entry;
2079         struct xt_table *new_table;
2080
2081         newinfo = xt_alloc_table_info(repl->size);
2082         if (!newinfo) {
2083                 ret = -ENOMEM;
2084                 goto out;
2085         }
2086
2087         /* choose the copy on our node/cpu, but dont care about preemption */
2088         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2089         memcpy(loc_cpu_entry, repl->entries, repl->size);
2090
2091         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2092         if (ret != 0)
2093                 goto out_free;
2094
2095         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2096         if (IS_ERR(new_table)) {
2097                 ret = PTR_ERR(new_table);
2098                 goto out_free;
2099         }
2100
2101         return new_table;
2102
2103 out_free:
2104         xt_free_table_info(newinfo);
2105 out:
2106         return ERR_PTR(ret);
2107 }
2108
2109 void ipt_unregister_table(struct net *net, struct xt_table *table)
2110 {
2111         struct xt_table_info *private;
2112         void *loc_cpu_entry;
2113         struct module *table_owner = table->me;
2114         struct ipt_entry *iter;
2115
2116         private = xt_unregister_table(table);
2117
2118         /* Decrease module usage counts and free resources */
2119         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2120         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2121                 cleanup_entry(iter, net);
2122         if (private->number > private->initial_entries)
2123                 module_put(table_owner);
2124         xt_free_table_info(private);
2125 }
2126
2127 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2128 static inline bool
2129 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2130                      u_int8_t type, u_int8_t code,
2131                      bool invert)
2132 {
2133         return ((test_type == 0xFF) ||
2134                 (type == test_type && code >= min_code && code <= max_code))
2135                 ^ invert;
2136 }
2137
2138 static bool
2139 icmp_match(const struct sk_buff *skb, struct xt_action_param *par)
2140 {
2141         const struct icmphdr *ic;
2142         struct icmphdr _icmph;
2143         const struct ipt_icmp *icmpinfo = par->matchinfo;
2144
2145         /* Must not be a fragment. */
2146         if (par->fragoff != 0)
2147                 return false;
2148
2149         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2150         if (ic == NULL) {
2151                 /* We've been asked to examine this packet, and we
2152                  * can't.  Hence, no choice but to drop.
2153                  */
2154                 duprintf("Dropping evil ICMP tinygram.\n");
2155                 par->hotdrop = true;
2156                 return false;
2157         }
2158
2159         return icmp_type_code_match(icmpinfo->type,
2160                                     icmpinfo->code[0],
2161                                     icmpinfo->code[1],
2162                                     ic->type, ic->code,
2163                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
2164 }
2165
2166 static int icmp_checkentry(const struct xt_mtchk_param *par)
2167 {
2168         const struct ipt_icmp *icmpinfo = par->matchinfo;
2169
2170         /* Must specify no unknown invflags */
2171         return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
2172 }
2173
2174 static struct xt_target ipt_builtin_tg[] __read_mostly = {
2175         {
2176                 .name             = IPT_STANDARD_TARGET,
2177                 .targetsize       = sizeof(int),
2178                 .family           = NFPROTO_IPV4,
2179 #ifdef CONFIG_COMPAT
2180                 .compatsize       = sizeof(compat_int_t),
2181                 .compat_from_user = compat_standard_from_user,
2182                 .compat_to_user   = compat_standard_to_user,
2183 #endif
2184         },
2185         {
2186                 .name             = IPT_ERROR_TARGET,
2187                 .target           = ipt_error,
2188                 .targetsize       = IPT_FUNCTION_MAXNAMELEN,
2189                 .family           = NFPROTO_IPV4,
2190         },
2191 };
2192
2193 static struct nf_sockopt_ops ipt_sockopts = {
2194         .pf             = PF_INET,
2195         .set_optmin     = IPT_BASE_CTL,
2196         .set_optmax     = IPT_SO_SET_MAX+1,
2197         .set            = do_ipt_set_ctl,
2198 #ifdef CONFIG_COMPAT
2199         .compat_set     = compat_do_ipt_set_ctl,
2200 #endif
2201         .get_optmin     = IPT_BASE_CTL,
2202         .get_optmax     = IPT_SO_GET_MAX+1,
2203         .get            = do_ipt_get_ctl,
2204 #ifdef CONFIG_COMPAT
2205         .compat_get     = compat_do_ipt_get_ctl,
2206 #endif
2207         .owner          = THIS_MODULE,
2208 };
2209
2210 static struct xt_match ipt_builtin_mt[] __read_mostly = {
2211         {
2212                 .name       = "icmp",
2213                 .match      = icmp_match,
2214                 .matchsize  = sizeof(struct ipt_icmp),
2215                 .checkentry = icmp_checkentry,
2216                 .proto      = IPPROTO_ICMP,
2217                 .family     = NFPROTO_IPV4,
2218         },
2219 };
2220
2221 static int __net_init ip_tables_net_init(struct net *net)
2222 {
2223         return xt_proto_init(net, NFPROTO_IPV4);
2224 }
2225
2226 static void __net_exit ip_tables_net_exit(struct net *net)
2227 {
2228         xt_proto_fini(net, NFPROTO_IPV4);
2229 }
2230
2231 static struct pernet_operations ip_tables_net_ops = {
2232         .init = ip_tables_net_init,
2233         .exit = ip_tables_net_exit,
2234 };
2235
2236 static int __init ip_tables_init(void)
2237 {
2238         int ret;
2239
2240         ret = register_pernet_subsys(&ip_tables_net_ops);
2241         if (ret < 0)
2242                 goto err1;
2243
2244         /* Noone else will be downing sem now, so we won't sleep */
2245         ret = xt_register_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2246         if (ret < 0)
2247                 goto err2;
2248         ret = xt_register_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2249         if (ret < 0)
2250                 goto err4;
2251
2252         /* Register setsockopt */
2253         ret = nf_register_sockopt(&ipt_sockopts);
2254         if (ret < 0)
2255                 goto err5;
2256
2257         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2258         return 0;
2259
2260 err5:
2261         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2262 err4:
2263         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2264 err2:
2265         unregister_pernet_subsys(&ip_tables_net_ops);
2266 err1:
2267         return ret;
2268 }
2269
2270 static void __exit ip_tables_fini(void)
2271 {
2272         nf_unregister_sockopt(&ipt_sockopts);
2273
2274         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2275         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2276         unregister_pernet_subsys(&ip_tables_net_ops);
2277 }
2278
2279 EXPORT_SYMBOL(ipt_register_table);
2280 EXPORT_SYMBOL(ipt_unregister_table);
2281 EXPORT_SYMBOL(ipt_do_table);
2282 module_init(ip_tables_init);
2283 module_exit(ip_tables_fini);