net/ipv4/netfilter/ip_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12 #include <linux/cache.h>
  13 #include <linux/capability.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/kmod.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/icmp.h>
  20 #include <net/ip.h>
  21 #include <net/compat.h>
  22 #include <asm/uaccess.h>
  23 #include <linux/mutex.h>
  24 #include <linux/proc_fs.h>
  25 #include <linux/err.h>
  26 #include <linux/cpumask.h>
  27
  28 #include <linux/netfilter/x_tables.h>
  29 #include <linux/netfilter_ipv4/ip_tables.h>
  30 #include <net/netfilter/nf_log.h>
  31 #include "../../netfilter/xt_repldata.h"
  32
  33 MODULE_LICENSE("GPL");
  34 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  35 MODULE_DESCRIPTION("IPv4 packet filter");
  36
  37 /*#define DEBUG_IP_FIREWALL*/
  38 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  39 /*#define DEBUG_IP_FIREWALL_USER*/
  40
  41 #ifdef DEBUG_IP_FIREWALL
  42 #define dprintf(format, args...) pr_info(format , ## args)
  43 #else
  44 #define dprintf(format, args...)
  45 #endif
  46
  47 #ifdef DEBUG_IP_FIREWALL_USER
  48 #define duprintf(format, args...) pr_info(format , ## args)
  49 #else
  50 #define duprintf(format, args...)
  51 #endif
  52
  53 #ifdef CONFIG_NETFILTER_DEBUG
  54 #define IP_NF_ASSERT(x)         WARN_ON(!(x))
  55 #else
  56 #define IP_NF_ASSERT(x)
  57 #endif
  58
  59 #if 0
  60 /* All the better to debug you with... */
  61 #define static
  62 #define inline
  63 #endif
  64
  65 void *ipt_alloc_initial_table(const struct xt_table *info)
  66 {
  67         return xt_alloc_initial_table(ipt, IPT);
  68 }
  69 EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
  70
  71 /*
  72    We keep a set of rules for each CPU, so we can avoid write-locking
  73    them in the softirq when updating the counters and therefore
  74    only need to read-lock in the softirq; doing a write_lock_bh() in user
  75    context stops packets coming through and allows user context to read
  76    the counters or update the rules.
  77
  78    Hence the start of any table is given by get_table() below.  */
  79
  80 /* Returns whether matches rule or not. */
  81 /* Performance critical - called for every packet */
  82 static inline bool
  83 ip_packet_match(const struct iphdr *ip,
  84                 const char *indev,
  85                 const char *outdev,
  86                 const struct ipt_ip *ipinfo,
  87                 int isfrag)
  88 {
  89         unsigned long ret;
  90
  91 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
  92
  93         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
  94                   IPT_INV_SRCIP) ||
  95             FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
  96                   IPT_INV_DSTIP)) {
  97                 dprintf("Source or dest mismatch.\n");
  98
  99                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
 100                         &ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
 101                         ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
 102                 dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
 103                         &ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
 104                         ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
 105                 return false;
 106         }
 107
 108         ret = ifname_compare_aligned(indev, ipinfo->iniface, ipinfo->iniface_mask);
 109
 110         if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
 111                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 112                         indev, ipinfo->iniface,
 113                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
 114                 return false;
 115         }
 116
 117         ret = ifname_compare_aligned(outdev, ipinfo->outiface, ipinfo->outiface_mask);
 118
 119         if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
 120                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 121                         outdev, ipinfo->outiface,
 122                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
 123                 return false;
 124         }
 125
 126         /* Check specific protocol */
 127         if (ipinfo->proto &&
 128             FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
 129                 dprintf("Packet protocol %hi does not match %hi.%s\n",
 130                         ip->protocol, ipinfo->proto,
 131                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
 132                 return false;
 133         }
 134
 135         /* If we have a fragment rule but the packet is not a fragment
 136          * then we return zero */
 137         if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
 138                 dprintf("Fragment rule but not fragment.%s\n",
 139                         ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
 140                 return false;
 141         }
 142
 143         return true;
 144 }
 145
 146 static bool
 147 ip_checkentry(const struct ipt_ip *ip)
 148 {
 149         if (ip->flags & ~IPT_F_MASK) {
 150                 duprintf("Unknown flag bits set: %08X\n",
 151                          ip->flags & ~IPT_F_MASK);
 152                 return false;
 153         }
 154         if (ip->invflags & ~IPT_INV_MASK) {
 155                 duprintf("Unknown invflag bits set: %08X\n",
 156                          ip->invflags & ~IPT_INV_MASK);
 157                 return false;
 158         }
 159         return true;
 160 }
 161
 162 static unsigned int
 163 ipt_error(struct sk_buff *skb, const struct xt_action_param *par)
 164 {
 165         if (net_ratelimit())
 166                 pr_info("error: `%s'\n", (const char *)par->targinfo);
 167
 168         return NF_DROP;
 169 }
 170
 171 /* Performance critical */
 172 static inline struct ipt_entry *
 173 get_entry(const void *base, unsigned int offset)
 174 {
 175         return (struct ipt_entry *)(base + offset);
 176 }
 177
 178 /* All zeroes == unconditional rule. */
 179 /* Mildly perf critical (only if packet tracing is on) */
 180 static inline bool unconditional(const struct ipt_ip *ip)
 181 {
 182         static const struct ipt_ip uncond;
 183
 184         return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 185 #undef FWINV
 186 }
 187
 188 /* for const-correctness */
 189 static inline const struct ipt_entry_target *
 190 ipt_get_target_c(const struct ipt_entry *e)
 191 {
 192         return ipt_get_target((struct ipt_entry *)e);
 193 }
 194
 195 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 196     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 197 static const char *const hooknames[] = {
 198         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 199         [NF_INET_LOCAL_IN]              = "INPUT",
 200         [NF_INET_FORWARD]               = "FORWARD",
 201         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 202         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 203 };
 204
 205 enum nf_ip_trace_comments {
 206         NF_IP_TRACE_COMMENT_RULE,
 207         NF_IP_TRACE_COMMENT_RETURN,
 208         NF_IP_TRACE_COMMENT_POLICY,
 209 };
 210
 211 static const char *const comments[] = {
 212         [NF_IP_TRACE_COMMENT_RULE]      = "rule",
 213         [NF_IP_TRACE_COMMENT_RETURN]    = "return",
 214         [NF_IP_TRACE_COMMENT_POLICY]    = "policy",
 215 };
 216
 217 static struct nf_loginfo trace_loginfo = {
 218         .type = NF_LOG_TYPE_LOG,
 219         .u = {
 220                 .log = {
 221                         .level = 4,
 222                         .logflags = NF_LOG_MASK,
 223                 },
 224         },
 225 };
 226
 227 /* Mildly perf critical (only if packet tracing is on) */
 228 static inline int
 229 get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
 230                       const char *hookname, const char **chainname,
 231                       const char **comment, unsigned int *rulenum)
 232 {
 233         const struct ipt_standard_target *t = (void *)ipt_get_target_c(s);
 234
 235         if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
 236                 /* Head of user chain: ERROR target with chainname */
 237                 *chainname = t->target.data;
 238                 (*rulenum) = 0;
 239         } else if (s == e) {
 240                 (*rulenum)++;
 241
 242                 if (s->target_offset == sizeof(struct ipt_entry) &&
 243                     strcmp(t->target.u.kernel.target->name,
 244                            IPT_STANDARD_TARGET) == 0 &&
 245                    t->verdict < 0 &&
 246                    unconditional(&s->ip)) {
 247                         /* Tail of chains: STANDARD target (return/policy) */
 248                         *comment = *chainname == hookname
 249                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
 250                                 : comments[NF_IP_TRACE_COMMENT_RETURN];
 251                 }
 252                 return 1;
 253         } else
 254                 (*rulenum)++;
 255
 256         return 0;
 257 }
 258
 259 static void trace_packet(const struct sk_buff *skb,
 260                          unsigned int hook,
 261                          const struct net_device *in,
 262                          const struct net_device *out,
 263                          const char *tablename,
 264                          const struct xt_table_info *private,
 265                          const struct ipt_entry *e)
 266 {
 267         const void *table_base;
 268         const struct ipt_entry *root;
 269         const char *hookname, *chainname, *comment;
 270         const struct ipt_entry *iter;
 271         unsigned int rulenum = 0;
 272
 273         table_base = private->entries[smp_processor_id()];
 274         root = get_entry(table_base, private->hook_entry[hook]);
 275
 276         hookname = chainname = hooknames[hook];
 277         comment = comments[NF_IP_TRACE_COMMENT_RULE];
 278
 279         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 280                 if (get_chainname_rulenum(iter, e, hookname,
 281                     &chainname, &comment, &rulenum) != 0)
 282                         break;
 283
 284         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
 285                       "TRACE: %s:%s:%s:%u ",
 286                       tablename, chainname, comment, rulenum);
 287 }
 288 #endif
 289
 290 static inline __pure
 291 struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
 292 {
 293         return (void *)entry + entry->next_offset;
 294 }
 295
 296 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 297 unsigned int
 298 ipt_do_table(struct sk_buff *skb,
 299              unsigned int hook,
 300              const struct net_device *in,
 301              const struct net_device *out,
 302              struct xt_table *table)
 303 {
 304         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 305         const struct iphdr *ip;
 306         /* Initializing verdict to NF_DROP keeps gcc happy. */
 307         unsigned int verdict = NF_DROP;
 308         const char *indev, *outdev;
 309         const void *table_base;
 310         struct ipt_entry *e, **jumpstack;
 311         unsigned int *stackptr, origptr, cpu;
 312         const struct xt_table_info *private;
 313         struct xt_action_param acpar;
 314
 315         /* Initialization */
 316         ip = ip_hdr(skb);
 317         indev = in ? in->name : nulldevname;
 318         outdev = out ? out->name : nulldevname;
 319         /* We handle fragments by dealing with the first fragment as
 320          * if it was a normal packet.  All other fragments are treated
 321          * normally, except that they will NEVER match rules that ask
 322          * things we don't know, ie. tcp syn flag or ports).  If the
 323          * rule is also a fragment-specific rule, non-fragments won't
 324          * match it. */
 325         acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 326         acpar.thoff   = ip_hdrlen(skb);
 327         acpar.hotdrop = false;
 328         acpar.in      = in;
 329         acpar.out     = out;
 330         acpar.family  = NFPROTO_IPV4;
 331         acpar.hooknum = hook;
 332
 333         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 334         xt_info_rdlock_bh();
 335         private = table->private;
 336         cpu        = smp_processor_id();
 337         table_base = private->entries[cpu];
 338         jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
 339         stackptr   = per_cpu_ptr(private->stackptr, cpu);
 340         origptr    = *stackptr;
 341
 342         e = get_entry(table_base, private->hook_entry[hook]);
 343
 344         pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
 345                  table->name, hook, origptr,
 346                  get_entry(table_base, private->underflow[hook]));
 347
 348         do {
 349                 const struct ipt_entry_target *t;
 350                 const struct xt_entry_match *ematch;
 351
 352                 IP_NF_ASSERT(e);
 353                 if (!ip_packet_match(ip, indev, outdev,
 354                     &e->ip, acpar.fragoff)) {
 355  no_match:
 356                         e = ipt_next_entry(e);
 357                         continue;
 358                 }
 359
 360                 xt_ematch_foreach(ematch, e) {
 361                         acpar.match     = ematch->u.kernel.match;
 362                         acpar.matchinfo = ematch->data;
 363                         if (!acpar.match->match(skb, &acpar))
 364                                 goto no_match;
 365                 }
 366
 367                 ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
 368
 369                 t = ipt_get_target(e);
 370                 IP_NF_ASSERT(t->u.kernel.target);
 371
 372 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 373     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 374                 /* The packet is traced: log it */
 375                 if (unlikely(skb->nf_trace))
 376                         trace_packet(skb, hook, in, out,
 377                                      table->name, private, e);
 378 #endif
 379                 /* Standard target? */
 380                 if (!t->u.kernel.target->target) {
 381                         int v;
 382
 383                         v = ((struct ipt_standard_target *)t)->verdict;
 384                         if (v < 0) {
 385                                 /* Pop from stack? */
 386                                 if (v != IPT_RETURN) {
 387                                         verdict = (unsigned)(-v) - 1;
 388                                         break;
 389                                 }
 390                                 if (*stackptr == 0) {
 391                                         e = get_entry(table_base,
 392                                             private->underflow[hook]);
 393                                         pr_debug("Underflow (this is normal) "
 394                                                  "to %p\n", e);
 395                                 } else {
 396                                         e = jumpstack[--*stackptr];
 397                                         pr_debug("Pulled %p out from pos %u\n",
 398                                                  e, *stackptr);
 399                                         e = ipt_next_entry(e);
 400                                 }
 401                                 continue;
 402                         }
 403                         if (table_base + v != ipt_next_entry(e) &&
 404                             !(e->ip.flags & IPT_F_GOTO)) {
 405                                 if (*stackptr >= private->stacksize) {
 406                                         verdict = NF_DROP;
 407                                         break;
 408                                 }
 409                                 jumpstack[(*stackptr)++] = e;
 410                                 pr_debug("Pushed %p into pos %u\n",
 411                                          e, *stackptr - 1);
 412                         }
 413
 414                         e = get_entry(table_base, v);
 415                         continue;
 416                 }
 417
 418                 acpar.target   = t->u.kernel.target;
 419                 acpar.targinfo = t->data;
 420
 421                 verdict = t->u.kernel.target->target(skb, &acpar);
 422                 /* Target might have changed stuff. */
 423                 ip = ip_hdr(skb);
 424                 if (verdict == IPT_CONTINUE)
 425                         e = ipt_next_entry(e);
 426                 else
 427                         /* Verdict */
 428                         break;
 429         } while (!acpar.hotdrop);
 430         xt_info_rdunlock_bh();
 431         pr_debug("Exiting %s; resetting sp from %u to %u\n",
 432                  __func__, *stackptr, origptr);
 433         *stackptr = origptr;
 434 #ifdef DEBUG_ALLOW_ALL
 435         return NF_ACCEPT;
 436 #else
 437         if (acpar.hotdrop)
 438                 return NF_DROP;
 439         else return verdict;
 440 #endif
 441 }
 442
 443 /* Figures out from what hook each rule can be called: returns 0 if
 444    there are loops.  Puts hook bitmask in comefrom. */
 445 static int
 446 mark_source_chains(const struct xt_table_info *newinfo,
 447                    unsigned int valid_hooks, void *entry0)
 448 {
 449         unsigned int hook;
 450
 451         /* No recursion; use packet counter to save back ptrs (reset
 452            to 0 as we leave), and comefrom to save source hook bitmask */
 453         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 454                 unsigned int pos = newinfo->hook_entry[hook];
 455                 struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
 456
 457                 if (!(valid_hooks & (1 << hook)))
 458                         continue;
 459
 460                 /* Set initial back pointer. */
 461                 e->counters.pcnt = pos;
 462
 463                 for (;;) {
 464                         const struct ipt_standard_target *t
 465                                 = (void *)ipt_get_target_c(e);
 466                         int visited = e->comefrom & (1 << hook);
 467
 468                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 469                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
 470                                        hook, pos, e->comefrom);
 471                                 return 0;
 472                         }
 473                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 474
 475                         /* Unconditional return/END. */
 476                         if ((e->target_offset == sizeof(struct ipt_entry) &&
 477                              (strcmp(t->target.u.user.name,
 478                                      IPT_STANDARD_TARGET) == 0) &&
 479                              t->verdict < 0 && unconditional(&e->ip)) ||
 480                             visited) {
 481                                 unsigned int oldpos, size;
 482
 483                                 if ((strcmp(t->target.u.user.name,
 484                                             IPT_STANDARD_TARGET) == 0) &&
 485                                     t->verdict < -NF_MAX_VERDICT - 1) {
 486                                         duprintf("mark_source_chains: bad "
 487                                                 "negative verdict (%i)\n",
 488                                                                 t->verdict);
 489                                         return 0;
 490                                 }
 491
 492                                 /* Return: backtrack through the last
 493                                    big jump. */
 494                                 do {
 495                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 496 #ifdef DEBUG_IP_FIREWALL_USER
 497                                         if (e->comefrom
 498                                             & (1 << NF_INET_NUMHOOKS)) {
 499                                                 duprintf("Back unset "
 500                                                          "on hook %u "
 501                                                          "rule %u\n",
 502                                                          hook, pos);
 503                                         }
 504 #endif
 505                                         oldpos = pos;
 506                                         pos = e->counters.pcnt;
 507                                         e->counters.pcnt = 0;
 508
 509                                         /* We're at the start. */
 510                                         if (pos == oldpos)
 511                                                 goto next;
 512
 513                                         e = (struct ipt_entry *)
 514                                                 (entry0 + pos);
 515                                 } while (oldpos == pos + e->next_offset);
 516
 517                                 /* Move along one */
 518                                 size = e->next_offset;
 519                                 e = (struct ipt_entry *)
 520                                         (entry0 + pos + size);
 521                                 e->counters.pcnt = pos;
 522                                 pos += size;
 523                         } else {
 524                                 int newpos = t->verdict;
 525
 526                                 if (strcmp(t->target.u.user.name,
 527                                            IPT_STANDARD_TARGET) == 0 &&
 528                                     newpos >= 0) {
 529                                         if (newpos > newinfo->size -
 530                                                 sizeof(struct ipt_entry)) {
 531                                                 duprintf("mark_source_chains: "
 532                                                         "bad verdict (%i)\n",
 533                                                                 newpos);
 534                                                 return 0;
 535                                         }
 536                                         /* This a jump; chase it. */
 537                                         duprintf("Jump rule %u -> %u\n",
 538                                                  pos, newpos);
 539                                 } else {
 540                                         /* ... this is a fallthru */
 541                                         newpos = pos + e->next_offset;
 542                                 }
 543                                 e = (struct ipt_entry *)
 544                                         (entry0 + newpos);
 545                                 e->counters.pcnt = pos;
 546                                 pos = newpos;
 547                         }
 548                 }
 549                 next:
 550                 duprintf("Finished chain %u\n", hook);
 551         }
 552         return 1;
 553 }
 554
 555 static void cleanup_match(struct ipt_entry_match *m, struct net *net)
 556 {
 557         struct xt_mtdtor_param par;
 558
 559         par.net       = net;
 560         par.match     = m->u.kernel.match;
 561         par.matchinfo = m->data;
 562         par.family    = NFPROTO_IPV4;
 563         if (par.match->destroy != NULL)
 564                 par.match->destroy(&par);
 565         module_put(par.match->me);
 566 }
 567
 568 static int
 569 check_entry(const struct ipt_entry *e, const char *name)
 570 {
 571         const struct ipt_entry_target *t;
 572
 573         if (!ip_checkentry(&e->ip)) {
 574                 duprintf("ip check failed %p %s.\n", e, par->match->name);
 575                 return -EINVAL;
 576         }
 577
 578         if (e->target_offset + sizeof(struct ipt_entry_target) >
 579             e->next_offset)
 580                 return -EINVAL;
 581
 582         t = ipt_get_target_c(e);
 583         if (e->target_offset + t->u.target_size > e->next_offset)
 584                 return -EINVAL;
 585
 586         return 0;
 587 }
 588
 589 static int
 590 check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 591 {
 592         const struct ipt_ip *ip = par->entryinfo;
 593         int ret;
 594
 595         par->match     = m->u.kernel.match;
 596         par->matchinfo = m->data;
 597
 598         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 599               ip->proto, ip->invflags & IPT_INV_PROTO);
 600         if (ret < 0) {
 601                 duprintf("check failed for `%s'.\n", par->match->name);
 602                 return ret;
 603         }
 604         return 0;
 605 }
 606
 607 static int
 608 find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 609 {
 610         struct xt_match *match;
 611         int ret;
 612
 613         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
 614                                       m->u.user.revision);
 615         if (IS_ERR(match)) {
 616                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 617                 return PTR_ERR(match);
 618         }
 619         m->u.kernel.match = match;
 620
 621         ret = check_match(m, par);
 622         if (ret)
 623                 goto err;
 624
 625         return 0;
 626 err:
 627         module_put(m->u.kernel.match->me);
 628         return ret;
 629 }
 630
 631 static int check_target(struct ipt_entry *e, struct net *net, const char *name)
 632 {
 633         struct ipt_entry_target *t = ipt_get_target(e);
 634         struct xt_tgchk_param par = {
 635                 .net       = net,
 636                 .table     = name,
 637                 .entryinfo = e,
 638                 .target    = t->u.kernel.target,
 639                 .targinfo  = t->data,
 640                 .hook_mask = e->comefrom,
 641                 .family    = NFPROTO_IPV4,
 642         };
 643         int ret;
 644
 645         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 646               e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
 647         if (ret < 0) {
 648                 duprintf("check failed for `%s'.\n",
 649                          t->u.kernel.target->name);
 650                 return ret;
 651         }
 652         return 0;
 653 }
 654
 655 static int
 656 find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
 657                  unsigned int size)
 658 {
 659         struct ipt_entry_target *t;
 660         struct xt_target *target;
 661         int ret;
 662         unsigned int j;
 663         struct xt_mtchk_param mtpar;
 664         struct xt_entry_match *ematch;
 665
 666         ret = check_entry(e, name);
 667         if (ret)
 668                 return ret;
 669
 670         j = 0;
 671         mtpar.net       = net;
 672         mtpar.table     = name;
 673         mtpar.entryinfo = &e->ip;
 674         mtpar.hook_mask = e->comefrom;
 675         mtpar.family    = NFPROTO_IPV4;
 676         xt_ematch_foreach(ematch, e) {
 677                 ret = find_check_match(ematch, &mtpar);
 678                 if (ret != 0)
 679                         goto cleanup_matches;
 680                 ++j;
 681         }
 682
 683         t = ipt_get_target(e);
 684         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
 685                                         t->u.user.revision);
 686         if (IS_ERR(target)) {
 687                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 688                 ret = PTR_ERR(target);
 689                 goto cleanup_matches;
 690         }
 691         t->u.kernel.target = target;
 692
 693         ret = check_target(e, net, name);
 694         if (ret)
 695                 goto err;
 696         return 0;
 697  err:
 698         module_put(t->u.kernel.target->me);
 699  cleanup_matches:
 700         xt_ematch_foreach(ematch, e) {
 701                 if (j-- == 0)
 702                         break;
 703                 cleanup_match(ematch, net);
 704         }
 705         return ret;
 706 }
 707
 708 static bool check_underflow(const struct ipt_entry *e)
 709 {
 710         const struct ipt_entry_target *t;
 711         unsigned int verdict;
 712
 713         if (!unconditional(&e->ip))
 714                 return false;
 715         t = ipt_get_target_c(e);
 716         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 717                 return false;
 718         verdict = ((struct ipt_standard_target *)t)->verdict;
 719         verdict = -verdict - 1;
 720         return verdict == NF_DROP || verdict == NF_ACCEPT;
 721 }
 722
 723 static int
 724 check_entry_size_and_hooks(struct ipt_entry *e,
 725                            struct xt_table_info *newinfo,
 726                            const unsigned char *base,
 727                            const unsigned char *limit,
 728                            const unsigned int *hook_entries,
 729                            const unsigned int *underflows,
 730                            unsigned int valid_hooks)
 731 {
 732         unsigned int h;
 733
 734         if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
 735             (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
 736                 duprintf("Bad offset %p\n", e);
 737                 return -EINVAL;
 738         }
 739
 740         if (e->next_offset
 741             < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
 742                 duprintf("checking: element %p size %u\n",
 743                          e, e->next_offset);
 744                 return -EINVAL;
 745         }
 746
 747         /* Check hooks & underflows */
 748         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 749                 if (!(valid_hooks & (1 << h)))
 750                         continue;
 751                 if ((unsigned char *)e - base == hook_entries[h])
 752                         newinfo->hook_entry[h] = hook_entries[h];
 753                 if ((unsigned char *)e - base == underflows[h]) {
 754                         if (!check_underflow(e)) {
 755                                 pr_err("Underflows must be unconditional and "
 756                                        "use the STANDARD target with "
 757                                        "ACCEPT/DROP\n");
 758                                 return -EINVAL;
 759                         }
 760                         newinfo->underflow[h] = underflows[h];
 761                 }
 762         }
 763
 764         /* Clear counters and comefrom */
 765         e->counters = ((struct xt_counters) { 0, 0 });
 766         e->comefrom = 0;
 767         return 0;
 768 }
 769
 770 static void
 771 cleanup_entry(struct ipt_entry *e, struct net *net)
 772 {
 773         struct xt_tgdtor_param par;
 774         struct ipt_entry_target *t;
 775         struct xt_entry_match *ematch;
 776
 777         /* Cleanup all matches */
 778         xt_ematch_foreach(ematch, e)
 779                 cleanup_match(ematch, net);
 780         t = ipt_get_target(e);
 781
 782         par.net      = net;
 783         par.target   = t->u.kernel.target;
 784         par.targinfo = t->data;
 785         par.family   = NFPROTO_IPV4;
 786         if (par.target->destroy != NULL)
 787                 par.target->destroy(&par);
 788         module_put(par.target->me);
 789 }
 790
 791 /* Checks and translates the user-supplied table segment (held in
 792    newinfo) */
 793 static int
 794 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
 795                 const struct ipt_replace *repl)
 796 {
 797         struct ipt_entry *iter;
 798         unsigned int i;
 799         int ret = 0;
 800
 801         newinfo->size = repl->size;
 802         newinfo->number = repl->num_entries;
 803
 804         /* Init all hooks to impossible value. */
 805         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 806                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 807                 newinfo->underflow[i] = 0xFFFFFFFF;
 808         }
 809
 810         duprintf("translate_table: size %u\n", newinfo->size);
 811         i = 0;
 812         /* Walk through entries, checking offsets. */
 813         xt_entry_foreach(iter, entry0, newinfo->size) {
 814                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 815                                                  entry0 + repl->size,
 816                                                  repl->hook_entry,
 817                                                  repl->underflow,
 818                                                  repl->valid_hooks);
 819                 if (ret != 0)
 820                         return ret;
 821                 ++i;
 822                 if (strcmp(ipt_get_target(iter)->u.user.name,
 823                     XT_ERROR_TARGET) == 0)
 824                         ++newinfo->stacksize;
 825         }
 826
 827         if (i != repl->num_entries) {
 828                 duprintf("translate_table: %u not %u entries\n",
 829                          i, repl->num_entries);
 830                 return -EINVAL;
 831         }
 832
 833         /* Check hooks all assigned */
 834         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 835                 /* Only hooks which are valid */
 836                 if (!(repl->valid_hooks & (1 << i)))
 837                         continue;
 838                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 839                         duprintf("Invalid hook entry %u %u\n",
 840                                  i, repl->hook_entry[i]);
 841                         return -EINVAL;
 842                 }
 843                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 844                         duprintf("Invalid underflow %u %u\n",
 845                                  i, repl->underflow[i]);
 846                         return -EINVAL;
 847                 }
 848         }
 849
 850         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
 851                 return -ELOOP;
 852
 853         /* Finally, each sanity check must pass */
 854         i = 0;
 855         xt_entry_foreach(iter, entry0, newinfo->size) {
 856                 ret = find_check_entry(iter, net, repl->name, repl->size);
 857                 if (ret != 0)
 858                         break;
 859                 ++i;
 860         }
 861
 862         if (ret != 0) {
 863                 xt_entry_foreach(iter, entry0, newinfo->size) {
 864                         if (i-- == 0)
 865                                 break;
 866                         cleanup_entry(iter, net);
 867                 }
 868                 return ret;
 869         }
 870
 871         /* And one copy for every other CPU */
 872         for_each_possible_cpu(i) {
 873                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 874                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 875         }
 876
 877         return ret;
 878 }
 879
 880 static void
 881 get_counters(const struct xt_table_info *t,
 882              struct xt_counters counters[])
 883 {
 884         struct ipt_entry *iter;
 885         unsigned int cpu;
 886         unsigned int i;
 887         unsigned int curcpu;
 888
 889         /* Instead of clearing (by a previous call to memset())
 890          * the counters and using adds, we set the counters
 891          * with data used by 'current' CPU.
 892          *
 893          * Bottom half has to be disabled to prevent deadlock
 894          * if new softirq were to run and call ipt_do_table
 895          */
 896         local_bh_disable();
 897         curcpu = smp_processor_id();
 898
 899         i = 0;
 900         xt_entry_foreach(iter, t->entries[curcpu], t->size) {
 901                 SET_COUNTER(counters[i], iter->counters.bcnt,
 902                             iter->counters.pcnt);
 903                 ++i;
 904         }
 905
 906         for_each_possible_cpu(cpu) {
 907                 if (cpu == curcpu)
 908                         continue;
 909                 i = 0;
 910                 xt_info_wrlock(cpu);
 911                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
 912                         ADD_COUNTER(counters[i], iter->counters.bcnt,
 913                                     iter->counters.pcnt);
 914                         ++i; /* macro does multi eval of i */
 915                 }
 916                 xt_info_wrunlock(cpu);
 917         }
 918         local_bh_enable();
 919 }
 920
 921 static struct xt_counters *alloc_counters(const struct xt_table *table)
 922 {
 923         unsigned int countersize;
 924         struct xt_counters *counters;
 925         const struct xt_table_info *private = table->private;
 926
 927         /* We need atomic snapshot of counters: rest doesn't change
 928            (other than comefrom, which userspace doesn't care
 929            about). */
 930         countersize = sizeof(struct xt_counters) * private->number;
 931         counters = vmalloc_node(countersize, numa_node_id());
 932
 933         if (counters == NULL)
 934                 return ERR_PTR(-ENOMEM);
 935
 936         get_counters(private, counters);
 937
 938         return counters;
 939 }
 940
 941 static int
 942 copy_entries_to_user(unsigned int total_size,
 943                      const struct xt_table *table,
 944                      void __user *userptr)
 945 {
 946         unsigned int off, num;
 947         const struct ipt_entry *e;
 948         struct xt_counters *counters;
 949         const struct xt_table_info *private = table->private;
 950         int ret = 0;
 951         const void *loc_cpu_entry;
 952
 953         counters = alloc_counters(table);
 954         if (IS_ERR(counters))
 955                 return PTR_ERR(counters);
 956
 957         /* choose the copy that is on our node/cpu, ...
 958          * This choice is lazy (because current thread is
 959          * allowed to migrate to another cpu)
 960          */
 961         loc_cpu_entry = private->entries[raw_smp_processor_id()];
 962         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 963                 ret = -EFAULT;
 964                 goto free_counters;
 965         }
 966
 967         /* FIXME: use iterator macros --RR */
 968         /* ... then go back and fix counters and names */
 969         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 970                 unsigned int i;
 971                 const struct ipt_entry_match *m;
 972                 const struct ipt_entry_target *t;
 973
 974                 e = (struct ipt_entry *)(loc_cpu_entry + off);
 975                 if (copy_to_user(userptr + off
 976                                  + offsetof(struct ipt_entry, counters),
 977                                  &counters[num],
 978                                  sizeof(counters[num])) != 0) {
 979                         ret = -EFAULT;
 980                         goto free_counters;
 981                 }
 982
 983                 for (i = sizeof(struct ipt_entry);
 984                      i < e->target_offset;
 985                      i += m->u.match_size) {
 986                         m = (void *)e + i;
 987
 988                         if (copy_to_user(userptr + off + i
 989                                          + offsetof(struct ipt_entry_match,
 990                                                     u.user.name),
 991                                          m->u.kernel.match->name,
 992                                          strlen(m->u.kernel.match->name)+1)
 993                             != 0) {
 994                                 ret = -EFAULT;
 995                                 goto free_counters;
 996                         }
 997                 }
 998
 999                 t = ipt_get_target_c(e);
1000                 if (copy_to_user(userptr + off + e->target_offset
1001                                  + offsetof(struct ipt_entry_target,
1002                                             u.user.name),
1003                                  t->u.kernel.target->name,
1004                                  strlen(t->u.kernel.target->name)+1) != 0) {
1005                         ret = -EFAULT;
1006                         goto free_counters;
1007                 }
1008         }
1009
1010  free_counters:
1011         vfree(counters);
1012         return ret;
1013 }
1014
1015 #ifdef CONFIG_COMPAT
1016 static void compat_standard_from_user(void *dst, const void *src)
1017 {
1018         int v = *(compat_int_t *)src;
1019
1020         if (v > 0)
1021                 v += xt_compat_calc_jump(AF_INET, v);
1022         memcpy(dst, &v, sizeof(v));
1023 }
1024
1025 static int compat_standard_to_user(void __user *dst, const void *src)
1026 {
1027         compat_int_t cv = *(int *)src;
1028
1029         if (cv > 0)
1030                 cv -= xt_compat_calc_jump(AF_INET, cv);
1031         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1032 }
1033
1034 static int compat_calc_entry(const struct ipt_entry *e,
1035                              const struct xt_table_info *info,
1036                              const void *base, struct xt_table_info *newinfo)
1037 {
1038         const struct xt_entry_match *ematch;
1039         const struct ipt_entry_target *t;
1040         unsigned int entry_offset;
1041         int off, i, ret;
1042
1043         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1044         entry_offset = (void *)e - base;
1045         xt_ematch_foreach(ematch, e)
1046                 off += xt_compat_match_offset(ematch->u.kernel.match);
1047         t = ipt_get_target_c(e);
1048         off += xt_compat_target_offset(t->u.kernel.target);
1049         newinfo->size -= off;
1050         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1051         if (ret)
1052                 return ret;
1053
1054         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1055                 if (info->hook_entry[i] &&
1056                     (e < (struct ipt_entry *)(base + info->hook_entry[i])))
1057                         newinfo->hook_entry[i] -= off;
1058                 if (info->underflow[i] &&
1059                     (e < (struct ipt_entry *)(base + info->underflow[i])))
1060                         newinfo->underflow[i] -= off;
1061         }
1062         return 0;
1063 }
1064
1065 static int compat_table_info(const struct xt_table_info *info,
1066                              struct xt_table_info *newinfo)
1067 {
1068         struct ipt_entry *iter;
1069         void *loc_cpu_entry;
1070         int ret;
1071
1072         if (!newinfo || !info)
1073                 return -EINVAL;
1074
1075         /* we dont care about newinfo->entries[] */
1076         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1077         newinfo->initial_entries = 0;
1078         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1079         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1080                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1081                 if (ret != 0)
1082                         return ret;
1083         }
1084         return 0;
1085 }
1086 #endif
1087
1088 static int get_info(struct net *net, void __user *user,
1089                     const int *len, int compat)
1090 {
1091         char name[IPT_TABLE_MAXNAMELEN];
1092         struct xt_table *t;
1093         int ret;
1094
1095         if (*len != sizeof(struct ipt_getinfo)) {
1096                 duprintf("length %u != %zu\n", *len,
1097                          sizeof(struct ipt_getinfo));
1098                 return -EINVAL;
1099         }
1100
1101         if (copy_from_user(name, user, sizeof(name)) != 0)
1102                 return -EFAULT;
1103
1104         name[IPT_TABLE_MAXNAMELEN-1] = '\0';
1105 #ifdef CONFIG_COMPAT
1106         if (compat)
1107                 xt_compat_lock(AF_INET);
1108 #endif
1109         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1110                                     "iptable_%s", name);
1111         if (t && !IS_ERR(t)) {
1112                 struct ipt_getinfo info;
1113                 const struct xt_table_info *private = t->private;
1114 #ifdef CONFIG_COMPAT
1115                 struct xt_table_info tmp;
1116
1117                 if (compat) {
1118                         ret = compat_table_info(private, &tmp);
1119                         xt_compat_flush_offsets(AF_INET);
1120                         private = &tmp;
1121                 }
1122 #endif
1123                 info.valid_hooks = t->valid_hooks;
1124                 memcpy(info.hook_entry, private->hook_entry,
1125                        sizeof(info.hook_entry));
1126                 memcpy(info.underflow, private->underflow,
1127                        sizeof(info.underflow));
1128                 info.num_entries = private->number;
1129                 info.size = private->size;
1130                 strcpy(info.name, name);
1131
1132                 if (copy_to_user(user, &info, *len) != 0)
1133                         ret = -EFAULT;
1134                 else
1135                         ret = 0;
1136
1137                 xt_table_unlock(t);
1138                 module_put(t->me);
1139         } else
1140                 ret = t ? PTR_ERR(t) : -ENOENT;
1141 #ifdef CONFIG_COMPAT
1142         if (compat)
1143                 xt_compat_unlock(AF_INET);
1144 #endif
1145         return ret;
1146 }
1147
1148 static int
1149 get_entries(struct net *net, struct ipt_get_entries __user *uptr,
1150             const int *len)
1151 {
1152         int ret;
1153         struct ipt_get_entries get;
1154         struct xt_table *t;
1155
1156         if (*len < sizeof(get)) {
1157                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1158                 return -EINVAL;
1159         }
1160         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1161                 return -EFAULT;
1162         if (*len != sizeof(struct ipt_get_entries) + get.size) {
1163                 duprintf("get_entries: %u != %zu\n",
1164                          *len, sizeof(get) + get.size);
1165                 return -EINVAL;
1166         }
1167
1168         t = xt_find_table_lock(net, AF_INET, get.name);
1169         if (t && !IS_ERR(t)) {
1170                 const struct xt_table_info *private = t->private;
1171                 duprintf("t->private->number = %u\n", private->number);
1172                 if (get.size == private->size)
1173                         ret = copy_entries_to_user(private->size,
1174                                                    t, uptr->entrytable);
1175                 else {
1176                         duprintf("get_entries: I've got %u not %u!\n",
1177                                  private->size, get.size);
1178                         ret = -EAGAIN;
1179                 }
1180                 module_put(t->me);
1181                 xt_table_unlock(t);
1182         } else
1183                 ret = t ? PTR_ERR(t) : -ENOENT;
1184
1185         return ret;
1186 }
1187
1188 static int
1189 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1190              struct xt_table_info *newinfo, unsigned int num_counters,
1191              void __user *counters_ptr)
1192 {
1193         int ret;
1194         struct xt_table *t;
1195         struct xt_table_info *oldinfo;
1196         struct xt_counters *counters;
1197         void *loc_cpu_old_entry;
1198         struct ipt_entry *iter;
1199
1200         ret = 0;
1201         counters = vmalloc(num_counters * sizeof(struct xt_counters));
1202         if (!counters) {
1203                 ret = -ENOMEM;
1204                 goto out;
1205         }
1206
1207         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1208                                     "iptable_%s", name);
1209         if (!t || IS_ERR(t)) {
1210                 ret = t ? PTR_ERR(t) : -ENOENT;
1211                 goto free_newinfo_counters_untrans;
1212         }
1213
1214         /* You lied! */
1215         if (valid_hooks != t->valid_hooks) {
1216                 duprintf("Valid hook crap: %08X vs %08X\n",
1217                          valid_hooks, t->valid_hooks);
1218                 ret = -EINVAL;
1219                 goto put_module;
1220         }
1221
1222         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1223         if (!oldinfo)
1224                 goto put_module;
1225
1226         /* Update module usage count based on number of rules */
1227         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1228                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1229         if ((oldinfo->number > oldinfo->initial_entries) ||
1230             (newinfo->number <= oldinfo->initial_entries))
1231                 module_put(t->me);
1232         if ((oldinfo->number > oldinfo->initial_entries) &&
1233             (newinfo->number <= oldinfo->initial_entries))
1234                 module_put(t->me);
1235
1236         /* Get the old counters, and synchronize with replace */
1237         get_counters(oldinfo, counters);
1238
1239         /* Decrease module usage counts and free resource */
1240         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1241         xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1242                 cleanup_entry(iter, net);
1243
1244         xt_free_table_info(oldinfo);
1245         if (copy_to_user(counters_ptr, counters,
1246                          sizeof(struct xt_counters) * num_counters) != 0)
1247                 ret = -EFAULT;
1248         vfree(counters);
1249         xt_table_unlock(t);
1250         return ret;
1251
1252  put_module:
1253         module_put(t->me);
1254         xt_table_unlock(t);
1255  free_newinfo_counters_untrans:
1256         vfree(counters);
1257  out:
1258         return ret;
1259 }
1260
1261 static int
1262 do_replace(struct net *net, const void __user *user, unsigned int len)
1263 {
1264         int ret;
1265         struct ipt_replace tmp;
1266         struct xt_table_info *newinfo;
1267         void *loc_cpu_entry;
1268         struct ipt_entry *iter;
1269
1270         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1271                 return -EFAULT;
1272
1273         /* overflow check */
1274         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1275                 return -ENOMEM;
1276
1277         newinfo = xt_alloc_table_info(tmp.size);
1278         if (!newinfo)
1279                 return -ENOMEM;
1280
1281         /* choose the copy that is on our node/cpu */
1282         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1283         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1284                            tmp.size) != 0) {
1285                 ret = -EFAULT;
1286                 goto free_newinfo;
1287         }
1288
1289         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1290         if (ret != 0)
1291                 goto free_newinfo;
1292
1293         duprintf("Translated table\n");
1294
1295         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1296                            tmp.num_counters, tmp.counters);
1297         if (ret)
1298                 goto free_newinfo_untrans;
1299         return 0;
1300
1301  free_newinfo_untrans:
1302         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1303                 cleanup_entry(iter, net);
1304  free_newinfo:
1305         xt_free_table_info(newinfo);
1306         return ret;
1307 }
1308
1309 static int
1310 do_add_counters(struct net *net, const void __user *user,
1311                 unsigned int len, int compat)
1312 {
1313         unsigned int i, curcpu;
1314         struct xt_counters_info tmp;
1315         struct xt_counters *paddc;
1316         unsigned int num_counters;
1317         const char *name;
1318         int size;
1319         void *ptmp;
1320         struct xt_table *t;
1321         const struct xt_table_info *private;
1322         int ret = 0;
1323         void *loc_cpu_entry;
1324         struct ipt_entry *iter;
1325 #ifdef CONFIG_COMPAT
1326         struct compat_xt_counters_info compat_tmp;
1327
1328         if (compat) {
1329                 ptmp = &compat_tmp;
1330                 size = sizeof(struct compat_xt_counters_info);
1331         } else
1332 #endif
1333         {
1334                 ptmp = &tmp;
1335                 size = sizeof(struct xt_counters_info);
1336         }
1337
1338         if (copy_from_user(ptmp, user, size) != 0)
1339                 return -EFAULT;
1340
1341 #ifdef CONFIG_COMPAT
1342         if (compat) {
1343                 num_counters = compat_tmp.num_counters;
1344                 name = compat_tmp.name;
1345         } else
1346 #endif
1347         {
1348                 num_counters = tmp.num_counters;
1349                 name = tmp.name;
1350         }
1351
1352         if (len != size + num_counters * sizeof(struct xt_counters))
1353                 return -EINVAL;
1354
1355         paddc = vmalloc_node(len - size, numa_node_id());
1356         if (!paddc)
1357                 return -ENOMEM;
1358
1359         if (copy_from_user(paddc, user + size, len - size) != 0) {
1360                 ret = -EFAULT;
1361                 goto free;
1362         }
1363
1364         t = xt_find_table_lock(net, AF_INET, name);
1365         if (!t || IS_ERR(t)) {
1366                 ret = t ? PTR_ERR(t) : -ENOENT;
1367                 goto free;
1368         }
1369
1370         local_bh_disable();
1371         private = t->private;
1372         if (private->number != num_counters) {
1373                 ret = -EINVAL;
1374                 goto unlock_up_free;
1375         }
1376
1377         i = 0;
1378         /* Choose the copy that is on our node */
1379         curcpu = smp_processor_id();
1380         loc_cpu_entry = private->entries[curcpu];
1381         xt_info_wrlock(curcpu);
1382         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
1383                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
1384                 ++i;
1385         }
1386         xt_info_wrunlock(curcpu);
1387  unlock_up_free:
1388         local_bh_enable();
1389         xt_table_unlock(t);
1390         module_put(t->me);
1391  free:
1392         vfree(paddc);
1393
1394         return ret;
1395 }
1396
1397 #ifdef CONFIG_COMPAT
1398 struct compat_ipt_replace {
1399         char                    name[IPT_TABLE_MAXNAMELEN];
1400         u32                     valid_hooks;
1401         u32                     num_entries;
1402         u32                     size;
1403         u32                     hook_entry[NF_INET_NUMHOOKS];
1404         u32                     underflow[NF_INET_NUMHOOKS];
1405         u32                     num_counters;
1406         compat_uptr_t           counters;       /* struct ipt_counters * */
1407         struct compat_ipt_entry entries[0];
1408 };
1409
1410 static int
1411 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1412                           unsigned int *size, struct xt_counters *counters,
1413                           unsigned int i)
1414 {
1415         struct ipt_entry_target *t;
1416         struct compat_ipt_entry __user *ce;
1417         u_int16_t target_offset, next_offset;
1418         compat_uint_t origsize;
1419         const struct xt_entry_match *ematch;
1420         int ret = 0;
1421
1422         origsize = *size;
1423         ce = (struct compat_ipt_entry __user *)*dstptr;
1424         if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
1425             copy_to_user(&ce->counters, &counters[i],
1426             sizeof(counters[i])) != 0)
1427                 return -EFAULT;
1428
1429         *dstptr += sizeof(struct compat_ipt_entry);
1430         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1431
1432         xt_ematch_foreach(ematch, e) {
1433                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1434                 if (ret != 0)
1435                         return ret;
1436         }
1437         target_offset = e->target_offset - (origsize - *size);
1438         t = ipt_get_target(e);
1439         ret = xt_compat_target_to_user(t, dstptr, size);
1440         if (ret)
1441                 return ret;
1442         next_offset = e->next_offset - (origsize - *size);
1443         if (put_user(target_offset, &ce->target_offset) != 0 ||
1444             put_user(next_offset, &ce->next_offset) != 0)
1445                 return -EFAULT;
1446         return 0;
1447 }
1448
1449 static int
1450 compat_find_calc_match(struct ipt_entry_match *m,
1451                        const char *name,
1452                        const struct ipt_ip *ip,
1453                        unsigned int hookmask,
1454                        int *size)
1455 {
1456         struct xt_match *match;
1457
1458         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
1459                                       m->u.user.revision);
1460         if (IS_ERR(match)) {
1461                 duprintf("compat_check_calc_match: `%s' not found\n",
1462                          m->u.user.name);
1463                 return PTR_ERR(match);
1464         }
1465         m->u.kernel.match = match;
1466         *size += xt_compat_match_offset(match);
1467         return 0;
1468 }
1469
1470 static void compat_release_entry(struct compat_ipt_entry *e)
1471 {
1472         struct ipt_entry_target *t;
1473         struct xt_entry_match *ematch;
1474
1475         /* Cleanup all matches */
1476         xt_ematch_foreach(ematch, e)
1477                 module_put(ematch->u.kernel.match->me);
1478         t = compat_ipt_get_target(e);
1479         module_put(t->u.kernel.target->me);
1480 }
1481
1482 static int
1483 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1484                                   struct xt_table_info *newinfo,
1485                                   unsigned int *size,
1486                                   const unsigned char *base,
1487                                   const unsigned char *limit,
1488                                   const unsigned int *hook_entries,
1489                                   const unsigned int *underflows,
1490                                   const char *name)
1491 {
1492         struct xt_entry_match *ematch;
1493         struct ipt_entry_target *t;
1494         struct xt_target *target;
1495         unsigned int entry_offset;
1496         unsigned int j;
1497         int ret, off, h;
1498
1499         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1500         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
1501             (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1502                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1503                 return -EINVAL;
1504         }
1505
1506         if (e->next_offset < sizeof(struct compat_ipt_entry) +
1507                              sizeof(struct compat_xt_entry_target)) {
1508                 duprintf("checking: element %p size %u\n",
1509                          e, e->next_offset);
1510                 return -EINVAL;
1511         }
1512
1513         /* For purposes of check_entry casting the compat entry is fine */
1514         ret = check_entry((struct ipt_entry *)e, name);
1515         if (ret)
1516                 return ret;
1517
1518         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1519         entry_offset = (void *)e - (void *)base;
1520         j = 0;
1521         xt_ematch_foreach(ematch, e) {
1522                 ret = compat_find_calc_match(ematch, name,
1523                                              &e->ip, e->comefrom, &off);
1524                 if (ret != 0)
1525                         goto release_matches;
1526                 ++j;
1527         }
1528
1529         t = compat_ipt_get_target(e);
1530         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
1531                                         t->u.user.revision);
1532         if (IS_ERR(target)) {
1533                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1534                          t->u.user.name);
1535                 ret = PTR_ERR(target);
1536                 goto release_matches;
1537         }
1538         t->u.kernel.target = target;
1539
1540         off += xt_compat_target_offset(target);
1541         *size += off;
1542         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1543         if (ret)
1544                 goto out;
1545
1546         /* Check hooks & underflows */
1547         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1548                 if ((unsigned char *)e - base == hook_entries[h])
1549                         newinfo->hook_entry[h] = hook_entries[h];
1550                 if ((unsigned char *)e - base == underflows[h])
1551                         newinfo->underflow[h] = underflows[h];
1552         }
1553
1554         /* Clear counters and comefrom */
1555         memset(&e->counters, 0, sizeof(e->counters));
1556         e->comefrom = 0;
1557         return 0;
1558
1559 out:
1560         module_put(t->u.kernel.target->me);
1561 release_matches:
1562         xt_ematch_foreach(ematch, e) {
1563                 if (j-- == 0)
1564                         break;
1565                 module_put(ematch->u.kernel.match->me);
1566         }
1567         return ret;
1568 }
1569
1570 static int
1571 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1572                             unsigned int *size, const char *name,
1573                             struct xt_table_info *newinfo, unsigned char *base)
1574 {
1575         struct ipt_entry_target *t;
1576         struct xt_target *target;
1577         struct ipt_entry *de;
1578         unsigned int origsize;
1579         int ret, h;
1580         struct xt_entry_match *ematch;
1581
1582         ret = 0;
1583         origsize = *size;
1584         de = (struct ipt_entry *)*dstptr;
1585         memcpy(de, e, sizeof(struct ipt_entry));
1586         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1587
1588         *dstptr += sizeof(struct ipt_entry);
1589         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1590
1591         xt_ematch_foreach(ematch, e) {
1592                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1593                 if (ret != 0)
1594                         return ret;
1595         }
1596         de->target_offset = e->target_offset - (origsize - *size);
1597         t = compat_ipt_get_target(e);
1598         target = t->u.kernel.target;
1599         xt_compat_target_from_user(t, dstptr, size);
1600
1601         de->next_offset = e->next_offset - (origsize - *size);
1602         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1603                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1604                         newinfo->hook_entry[h] -= origsize - *size;
1605                 if ((unsigned char *)de - base < newinfo->underflow[h])
1606                         newinfo->underflow[h] -= origsize - *size;
1607         }
1608         return ret;
1609 }
1610
1611 static int
1612 compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
1613 {
1614         struct xt_entry_match *ematch;
1615         struct xt_mtchk_param mtpar;
1616         unsigned int j;
1617         int ret = 0;
1618
1619         j = 0;
1620         mtpar.net       = net;
1621         mtpar.table     = name;
1622         mtpar.entryinfo = &e->ip;
1623         mtpar.hook_mask = e->comefrom;
1624         mtpar.family    = NFPROTO_IPV4;
1625         xt_ematch_foreach(ematch, e) {
1626                 ret = check_match(ematch, &mtpar);
1627                 if (ret != 0)
1628                         goto cleanup_matches;
1629                 ++j;
1630         }
1631
1632         ret = check_target(e, net, name);
1633         if (ret)
1634                 goto cleanup_matches;
1635         return 0;
1636
1637  cleanup_matches:
1638         xt_ematch_foreach(ematch, e) {
1639                 if (j-- == 0)
1640                         break;
1641                 cleanup_match(ematch, net);
1642         }
1643         return ret;
1644 }
1645
1646 static int
1647 translate_compat_table(struct net *net,
1648                        const char *name,
1649                        unsigned int valid_hooks,
1650                        struct xt_table_info **pinfo,
1651                        void **pentry0,
1652                        unsigned int total_size,
1653                        unsigned int number,
1654                        unsigned int *hook_entries,
1655                        unsigned int *underflows)
1656 {
1657         unsigned int i, j;
1658         struct xt_table_info *newinfo, *info;
1659         void *pos, *entry0, *entry1;
1660         struct compat_ipt_entry *iter0;
1661         struct ipt_entry *iter1;
1662         unsigned int size;
1663         int ret;
1664
1665         info = *pinfo;
1666         entry0 = *pentry0;
1667         size = total_size;
1668         info->number = number;
1669
1670         /* Init all hooks to impossible value. */
1671         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1672                 info->hook_entry[i] = 0xFFFFFFFF;
1673                 info->underflow[i] = 0xFFFFFFFF;
1674         }
1675
1676         duprintf("translate_compat_table: size %u\n", info->size);
1677         j = 0;
1678         xt_compat_lock(AF_INET);
1679         /* Walk through entries, checking offsets. */
1680         xt_entry_foreach(iter0, entry0, total_size) {
1681                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1682                                                         entry0,
1683                                                         entry0 + total_size,
1684                                                         hook_entries,
1685                                                         underflows,
1686                                                         name);
1687                 if (ret != 0)
1688                         goto out_unlock;
1689                 ++j;
1690         }
1691
1692         ret = -EINVAL;
1693         if (j != number) {
1694                 duprintf("translate_compat_table: %u not %u entries\n",
1695                          j, number);
1696                 goto out_unlock;
1697         }
1698
1699         /* Check hooks all assigned */
1700         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1701                 /* Only hooks which are valid */
1702                 if (!(valid_hooks & (1 << i)))
1703                         continue;
1704                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1705                         duprintf("Invalid hook entry %u %u\n",
1706                                  i, hook_entries[i]);
1707                         goto out_unlock;
1708                 }
1709                 if (info->underflow[i] == 0xFFFFFFFF) {
1710                         duprintf("Invalid underflow %u %u\n",
1711                                  i, underflows[i]);
1712                         goto out_unlock;
1713                 }
1714         }
1715
1716         ret = -ENOMEM;
1717         newinfo = xt_alloc_table_info(size);
1718         if (!newinfo)
1719                 goto out_unlock;
1720
1721         newinfo->number = number;
1722         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1723                 newinfo->hook_entry[i] = info->hook_entry[i];
1724                 newinfo->underflow[i] = info->underflow[i];
1725         }
1726         entry1 = newinfo->entries[raw_smp_processor_id()];
1727         pos = entry1;
1728         size = total_size;
1729         xt_entry_foreach(iter0, entry0, total_size) {
1730                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1731                                                   name, newinfo, entry1);
1732                 if (ret != 0)
1733                         break;
1734         }
1735         xt_compat_flush_offsets(AF_INET);
1736         xt_compat_unlock(AF_INET);
1737         if (ret)
1738                 goto free_newinfo;
1739
1740         ret = -ELOOP;
1741         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1742                 goto free_newinfo;
1743
1744         i = 0;
1745         xt_entry_foreach(iter1, entry1, newinfo->size) {
1746                 ret = compat_check_entry(iter1, net, name);
1747                 if (ret != 0)
1748                         break;
1749                 ++i;
1750         }
1751         if (ret) {
1752                 /*
1753                  * The first i matches need cleanup_entry (calls ->destroy)
1754                  * because they had called ->check already. The other j-i
1755                  * entries need only release.
1756                  */
1757                 int skip = i;
1758                 j -= i;
1759                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1760                         if (skip-- > 0)
1761                                 continue;
1762                         if (j-- == 0)
1763                                 break;
1764                         compat_release_entry(iter0);
1765                 }
1766                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1767                         if (i-- == 0)
1768                                 break;
1769                         cleanup_entry(iter1, net);
1770                 }
1771                 xt_free_table_info(newinfo);
1772                 return ret;
1773         }
1774
1775         /* And one copy for every other CPU */
1776         for_each_possible_cpu(i)
1777                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1778                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1779
1780         *pinfo = newinfo;
1781         *pentry0 = entry1;
1782         xt_free_table_info(info);
1783         return 0;
1784
1785 free_newinfo:
1786         xt_free_table_info(newinfo);
1787 out:
1788         xt_entry_foreach(iter0, entry0, total_size) {
1789                 if (j-- == 0)
1790                         break;
1791                 compat_release_entry(iter0);
1792         }
1793         return ret;
1794 out_unlock:
1795         xt_compat_flush_offsets(AF_INET);
1796         xt_compat_unlock(AF_INET);
1797         goto out;
1798 }
1799
1800 static int
1801 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1802 {
1803         int ret;
1804         struct compat_ipt_replace tmp;
1805         struct xt_table_info *newinfo;
1806         void *loc_cpu_entry;
1807         struct ipt_entry *iter;
1808
1809         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1810                 return -EFAULT;
1811
1812         /* overflow check */
1813         if (tmp.size >= INT_MAX / num_possible_cpus())
1814                 return -ENOMEM;
1815         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1816                 return -ENOMEM;
1817
1818         newinfo = xt_alloc_table_info(tmp.size);
1819         if (!newinfo)
1820                 return -ENOMEM;
1821
1822         /* choose the copy that is on our node/cpu */
1823         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1824         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1825                            tmp.size) != 0) {
1826                 ret = -EFAULT;
1827                 goto free_newinfo;
1828         }
1829
1830         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1831                                      &newinfo, &loc_cpu_entry, tmp.size,
1832                                      tmp.num_entries, tmp.hook_entry,
1833                                      tmp.underflow);
1834         if (ret != 0)
1835                 goto free_newinfo;
1836
1837         duprintf("compat_do_replace: Translated table\n");
1838
1839         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1840                            tmp.num_counters, compat_ptr(tmp.counters));
1841         if (ret)
1842                 goto free_newinfo_untrans;
1843         return 0;
1844
1845  free_newinfo_untrans:
1846         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1847                 cleanup_entry(iter, net);
1848  free_newinfo:
1849         xt_free_table_info(newinfo);
1850         return ret;
1851 }
1852
1853 static int
1854 compat_do_ipt_set_ctl(struct sock *sk,  int cmd, void __user *user,
1855                       unsigned int len)
1856 {
1857         int ret;
1858
1859         if (!capable(CAP_NET_ADMIN))
1860                 return -EPERM;
1861
1862         switch (cmd) {
1863         case IPT_SO_SET_REPLACE:
1864                 ret = compat_do_replace(sock_net(sk), user, len);
1865                 break;
1866
1867         case IPT_SO_SET_ADD_COUNTERS:
1868                 ret = do_add_counters(sock_net(sk), user, len, 1);
1869                 break;
1870
1871         default:
1872                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
1873                 ret = -EINVAL;
1874         }
1875
1876         return ret;
1877 }
1878
1879 struct compat_ipt_get_entries {
1880         char name[IPT_TABLE_MAXNAMELEN];
1881         compat_uint_t size;
1882         struct compat_ipt_entry entrytable[0];
1883 };
1884
1885 static int
1886 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1887                             void __user *userptr)
1888 {
1889         struct xt_counters *counters;
1890         const struct xt_table_info *private = table->private;
1891         void __user *pos;
1892         unsigned int size;
1893         int ret = 0;
1894         const void *loc_cpu_entry;
1895         unsigned int i = 0;
1896         struct ipt_entry *iter;
1897
1898         counters = alloc_counters(table);
1899         if (IS_ERR(counters))
1900                 return PTR_ERR(counters);
1901
1902         /* choose the copy that is on our node/cpu, ...
1903          * This choice is lazy (because current thread is
1904          * allowed to migrate to another cpu)
1905          */
1906         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1907         pos = userptr;
1908         size = total_size;
1909         xt_entry_foreach(iter, loc_cpu_entry, total_size) {
1910                 ret = compat_copy_entry_to_user(iter, &pos,
1911                                                 &size, counters, i++);
1912                 if (ret != 0)
1913                         break;
1914         }
1915
1916         vfree(counters);
1917         return ret;
1918 }
1919
1920 static int
1921 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1922                    int *len)
1923 {
1924         int ret;
1925         struct compat_ipt_get_entries get;
1926         struct xt_table *t;
1927
1928         if (*len < sizeof(get)) {
1929                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1930                 return -EINVAL;
1931         }
1932
1933         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1934                 return -EFAULT;
1935
1936         if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1937                 duprintf("compat_get_entries: %u != %zu\n",
1938                          *len, sizeof(get) + get.size);
1939                 return -EINVAL;
1940         }
1941
1942         xt_compat_lock(AF_INET);
1943         t = xt_find_table_lock(net, AF_INET, get.name);
1944         if (t && !IS_ERR(t)) {
1945                 const struct xt_table_info *private = t->private;
1946                 struct xt_table_info info;
1947                 duprintf("t->private->number = %u\n", private->number);
1948                 ret = compat_table_info(private, &info);
1949                 if (!ret && get.size == info.size) {
1950                         ret = compat_copy_entries_to_user(private->size,
1951                                                           t, uptr->entrytable);
1952                 } else if (!ret) {
1953                         duprintf("compat_get_entries: I've got %u not %u!\n",
1954                                  private->size, get.size);
1955                         ret = -EAGAIN;
1956                 }
1957                 xt_compat_flush_offsets(AF_INET);
1958                 module_put(t->me);
1959                 xt_table_unlock(t);
1960         } else
1961                 ret = t ? PTR_ERR(t) : -ENOENT;
1962
1963         xt_compat_unlock(AF_INET);
1964         return ret;
1965 }
1966
1967 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
1968
1969 static int
1970 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1971 {
1972         int ret;
1973
1974         if (!capable(CAP_NET_ADMIN))
1975                 return -EPERM;
1976
1977         switch (cmd) {
1978         case IPT_SO_GET_INFO:
1979                 ret = get_info(sock_net(sk), user, len, 1);
1980                 break;
1981         case IPT_SO_GET_ENTRIES:
1982                 ret = compat_get_entries(sock_net(sk), user, len);
1983                 break;
1984         default:
1985                 ret = do_ipt_get_ctl(sk, cmd, user, len);
1986         }
1987         return ret;
1988 }
1989 #endif
1990
1991 static int
1992 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1993 {
1994         int ret;
1995
1996         if (!capable(CAP_NET_ADMIN))
1997                 return -EPERM;
1998
1999         switch (cmd) {
2000         case IPT_SO_SET_REPLACE:
2001                 ret = do_replace(sock_net(sk), user, len);
2002                 break;
2003
2004         case IPT_SO_SET_ADD_COUNTERS:
2005                 ret = do_add_counters(sock_net(sk), user, len, 0);
2006                 break;
2007
2008         default:
2009                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
2010                 ret = -EINVAL;
2011         }
2012
2013         return ret;
2014 }
2015
2016 static int
2017 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2018 {
2019         int ret;
2020
2021         if (!capable(CAP_NET_ADMIN))
2022                 return -EPERM;
2023
2024         switch (cmd) {
2025         case IPT_SO_GET_INFO:
2026                 ret = get_info(sock_net(sk), user, len, 0);
2027                 break;
2028
2029         case IPT_SO_GET_ENTRIES:
2030                 ret = get_entries(sock_net(sk), user, len);
2031                 break;
2032
2033         case IPT_SO_GET_REVISION_MATCH:
2034         case IPT_SO_GET_REVISION_TARGET: {
2035                 struct ipt_get_revision rev;
2036                 int target;
2037
2038                 if (*len != sizeof(rev)) {
2039                         ret = -EINVAL;
2040                         break;
2041                 }
2042                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2043                         ret = -EFAULT;
2044                         break;
2045                 }
2046
2047                 if (cmd == IPT_SO_GET_REVISION_TARGET)
2048                         target = 1;
2049                 else
2050                         target = 0;
2051
2052                 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2053                                                          rev.revision,
2054                                                          target, &ret),
2055                                         "ipt_%s", rev.name);
2056                 break;
2057         }
2058
2059         default:
2060                 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2061                 ret = -EINVAL;
2062         }
2063
2064         return ret;
2065 }
2066
2067 struct xt_table *ipt_register_table(struct net *net,
2068                                     const struct xt_table *table,
2069                                     const struct ipt_replace *repl)
2070 {
2071         int ret;
2072         struct xt_table_info *newinfo;
2073         struct xt_table_info bootstrap = {0};
2074         void *loc_cpu_entry;
2075         struct xt_table *new_table;
2076
2077         newinfo = xt_alloc_table_info(repl->size);
2078         if (!newinfo) {
2079                 ret = -ENOMEM;
2080                 goto out;
2081         }
2082
2083         /* choose the copy on our node/cpu, but dont care about preemption */
2084         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2085         memcpy(loc_cpu_entry, repl->entries, repl->size);
2086
2087         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2088         if (ret != 0)
2089                 goto out_free;
2090
2091         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2092         if (IS_ERR(new_table)) {
2093                 ret = PTR_ERR(new_table);
2094                 goto out_free;
2095         }
2096
2097         return new_table;
2098
2099 out_free:
2100         xt_free_table_info(newinfo);
2101 out:
2102         return ERR_PTR(ret);
2103 }
2104
2105 void ipt_unregister_table(struct net *net, struct xt_table *table)
2106 {
2107         struct xt_table_info *private;
2108         void *loc_cpu_entry;
2109         struct module *table_owner = table->me;
2110         struct ipt_entry *iter;
2111
2112         private = xt_unregister_table(table);
2113
2114         /* Decrease module usage counts and free resources */
2115         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2116         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2117                 cleanup_entry(iter, net);
2118         if (private->number > private->initial_entries)
2119                 module_put(table_owner);
2120         xt_free_table_info(private);
2121 }
2122
2123 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2124 static inline bool
2125 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2126                      u_int8_t type, u_int8_t code,
2127                      bool invert)
2128 {
2129         return ((test_type == 0xFF) ||
2130                 (type == test_type && code >= min_code && code <= max_code))
2131                 ^ invert;
2132 }
2133
2134 static bool
2135 icmp_match(const struct sk_buff *skb, struct xt_action_param *par)
2136 {
2137         const struct icmphdr *ic;
2138         struct icmphdr _icmph;
2139         const struct ipt_icmp *icmpinfo = par->matchinfo;
2140
2141         /* Must not be a fragment. */
2142         if (par->fragoff != 0)
2143                 return false;
2144
2145         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2146         if (ic == NULL) {
2147                 /* We've been asked to examine this packet, and we
2148                  * can't.  Hence, no choice but to drop.
2149                  */
2150                 duprintf("Dropping evil ICMP tinygram.\n");
2151                 par->hotdrop = true;
2152                 return false;
2153         }
2154
2155         return icmp_type_code_match(icmpinfo->type,
2156                                     icmpinfo->code[0],
2157                                     icmpinfo->code[1],
2158                                     ic->type, ic->code,
2159                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
2160 }
2161
2162 static int icmp_checkentry(const struct xt_mtchk_param *par)
2163 {
2164         const struct ipt_icmp *icmpinfo = par->matchinfo;
2165
2166         /* Must specify no unknown invflags */
2167         return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
2168 }
2169
2170 static struct xt_target ipt_builtin_tg[] __read_mostly = {
2171         {
2172                 .name             = IPT_STANDARD_TARGET,
2173                 .targetsize       = sizeof(int),
2174                 .family           = NFPROTO_IPV4,
2175 #ifdef CONFIG_COMPAT
2176                 .compatsize       = sizeof(compat_int_t),
2177                 .compat_from_user = compat_standard_from_user,
2178                 .compat_to_user   = compat_standard_to_user,
2179 #endif
2180         },
2181         {
2182                 .name             = IPT_ERROR_TARGET,
2183                 .target           = ipt_error,
2184                 .targetsize       = IPT_FUNCTION_MAXNAMELEN,
2185                 .family           = NFPROTO_IPV4,
2186         },
2187 };
2188
2189 static struct nf_sockopt_ops ipt_sockopts = {
2190         .pf             = PF_INET,
2191         .set_optmin     = IPT_BASE_CTL,
2192         .set_optmax     = IPT_SO_SET_MAX+1,
2193         .set            = do_ipt_set_ctl,
2194 #ifdef CONFIG_COMPAT
2195         .compat_set     = compat_do_ipt_set_ctl,
2196 #endif
2197         .get_optmin     = IPT_BASE_CTL,
2198         .get_optmax     = IPT_SO_GET_MAX+1,
2199         .get            = do_ipt_get_ctl,
2200 #ifdef CONFIG_COMPAT
2201         .compat_get     = compat_do_ipt_get_ctl,
2202 #endif
2203         .owner          = THIS_MODULE,
2204 };
2205
2206 static struct xt_match ipt_builtin_mt[] __read_mostly = {
2207         {
2208                 .name       = "icmp",
2209                 .match      = icmp_match,
2210                 .matchsize  = sizeof(struct ipt_icmp),
2211                 .checkentry = icmp_checkentry,
2212                 .proto      = IPPROTO_ICMP,
2213                 .family     = NFPROTO_IPV4,
2214         },
2215 };
2216
2217 static int __net_init ip_tables_net_init(struct net *net)
2218 {
2219         return xt_proto_init(net, NFPROTO_IPV4);
2220 }
2221
2222 static void __net_exit ip_tables_net_exit(struct net *net)
2223 {
2224         xt_proto_fini(net, NFPROTO_IPV4);
2225 }
2226
2227 static struct pernet_operations ip_tables_net_ops = {
2228         .init = ip_tables_net_init,
2229         .exit = ip_tables_net_exit,
2230 };
2231
2232 static int __init ip_tables_init(void)
2233 {
2234         int ret;
2235
2236         ret = register_pernet_subsys(&ip_tables_net_ops);
2237         if (ret < 0)
2238                 goto err1;
2239
2240         /* Noone else will be downing sem now, so we won't sleep */
2241         ret = xt_register_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2242         if (ret < 0)
2243                 goto err2;
2244         ret = xt_register_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2245         if (ret < 0)
2246                 goto err4;
2247
2248         /* Register setsockopt */
2249         ret = nf_register_sockopt(&ipt_sockopts);
2250         if (ret < 0)
2251                 goto err5;
2252
2253         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2254         return 0;
2255
2256 err5:
2257         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2258 err4:
2259         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2260 err2:
2261         unregister_pernet_subsys(&ip_tables_net_ops);
2262 err1:
2263         return ret;
2264 }
2265
2266 static void __exit ip_tables_fini(void)
2267 {
2268         nf_unregister_sockopt(&ipt_sockopts);
2269
2270         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2271         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2272         unregister_pernet_subsys(&ip_tables_net_ops);
2273 }
2274
2275 EXPORT_SYMBOL(ipt_register_table);
2276 EXPORT_SYMBOL(ipt_unregister_table);
2277 EXPORT_SYMBOL(ipt_do_table);
2278 module_init(ip_tables_init);
2279 module_exit(ip_tables_fini);