Merge branch 'master' of /repos/git/net-next-2.6
[pandora-kernel.git] / net / ipv4 / netfilter / ip_tables.c
1 /*
2  * Packet matching code.
3  *
4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 #include <linux/cache.h>
13 #include <linux/capability.h>
14 #include <linux/skbuff.h>
15 #include <linux/kmod.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netdevice.h>
18 #include <linux/module.h>
19 #include <linux/icmp.h>
20 #include <net/ip.h>
21 #include <net/compat.h>
22 #include <asm/uaccess.h>
23 #include <linux/mutex.h>
24 #include <linux/proc_fs.h>
25 #include <linux/err.h>
26 #include <linux/cpumask.h>
27
28 #include <linux/netfilter/x_tables.h>
29 #include <linux/netfilter_ipv4/ip_tables.h>
30 #include <net/netfilter/nf_log.h>
31 #include "../../netfilter/xt_repldata.h"
32
33 MODULE_LICENSE("GPL");
34 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
35 MODULE_DESCRIPTION("IPv4 packet filter");
36
37 /*#define DEBUG_IP_FIREWALL*/
38 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
39 /*#define DEBUG_IP_FIREWALL_USER*/
40
41 #ifdef DEBUG_IP_FIREWALL
42 #define dprintf(format, args...) pr_info(format , ## args)
43 #else
44 #define dprintf(format, args...)
45 #endif
46
47 #ifdef DEBUG_IP_FIREWALL_USER
48 #define duprintf(format, args...) pr_info(format , ## args)
49 #else
50 #define duprintf(format, args...)
51 #endif
52
53 #ifdef CONFIG_NETFILTER_DEBUG
54 #define IP_NF_ASSERT(x)         WARN_ON(!(x))
55 #else
56 #define IP_NF_ASSERT(x)
57 #endif
58
59 #if 0
60 /* All the better to debug you with... */
61 #define static
62 #define inline
63 #endif
64
65 void *ipt_alloc_initial_table(const struct xt_table *info)
66 {
67         return xt_alloc_initial_table(ipt, IPT);
68 }
69 EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
70
71 /*
72    We keep a set of rules for each CPU, so we can avoid write-locking
73    them in the softirq when updating the counters and therefore
74    only need to read-lock in the softirq; doing a write_lock_bh() in user
75    context stops packets coming through and allows user context to read
76    the counters or update the rules.
77
78    Hence the start of any table is given by get_table() below.  */
79
80 /* Returns whether matches rule or not. */
81 /* Performance critical - called for every packet */
82 static inline bool
83 ip_packet_match(const struct iphdr *ip,
84                 const char *indev,
85                 const char *outdev,
86                 const struct ipt_ip *ipinfo,
87                 int isfrag)
88 {
89         unsigned long ret;
90
91 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
92
93         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
94                   IPT_INV_SRCIP) ||
95             FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
96                   IPT_INV_DSTIP)) {
97                 dprintf("Source or dest mismatch.\n");
98
99                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
100                         &ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
101                         ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
102                 dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
103                         &ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
104                         ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
105                 return false;
106         }
107
108         ret = ifname_compare_aligned(indev, ipinfo->iniface, ipinfo->iniface_mask);
109
110         if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
111                 dprintf("VIA in mismatch (%s vs %s).%s\n",
112                         indev, ipinfo->iniface,
113                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
114                 return false;
115         }
116
117         ret = ifname_compare_aligned(outdev, ipinfo->outiface, ipinfo->outiface_mask);
118
119         if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
120                 dprintf("VIA out mismatch (%s vs %s).%s\n",
121                         outdev, ipinfo->outiface,
122                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
123                 return false;
124         }
125
126         /* Check specific protocol */
127         if (ipinfo->proto &&
128             FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
129                 dprintf("Packet protocol %hi does not match %hi.%s\n",
130                         ip->protocol, ipinfo->proto,
131                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
132                 return false;
133         }
134
135         /* If we have a fragment rule but the packet is not a fragment
136          * then we return zero */
137         if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
138                 dprintf("Fragment rule but not fragment.%s\n",
139                         ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
140                 return false;
141         }
142
143         return true;
144 }
145
146 static bool
147 ip_checkentry(const struct ipt_ip *ip)
148 {
149         if (ip->flags & ~IPT_F_MASK) {
150                 duprintf("Unknown flag bits set: %08X\n",
151                          ip->flags & ~IPT_F_MASK);
152                 return false;
153         }
154         if (ip->invflags & ~IPT_INV_MASK) {
155                 duprintf("Unknown invflag bits set: %08X\n",
156                          ip->invflags & ~IPT_INV_MASK);
157                 return false;
158         }
159         return true;
160 }
161
162 static unsigned int
163 ipt_error(struct sk_buff *skb, const struct xt_action_param *par)
164 {
165         if (net_ratelimit())
166                 pr_info("error: `%s'\n", (const char *)par->targinfo);
167
168         return NF_DROP;
169 }
170
171 /* Performance critical */
172 static inline struct ipt_entry *
173 get_entry(const void *base, unsigned int offset)
174 {
175         return (struct ipt_entry *)(base + offset);
176 }
177
178 /* All zeroes == unconditional rule. */
179 /* Mildly perf critical (only if packet tracing is on) */
180 static inline bool unconditional(const struct ipt_ip *ip)
181 {
182         static const struct ipt_ip uncond;
183
184         return memcmp(ip, &uncond, sizeof(uncond)) == 0;
185 #undef FWINV
186 }
187
188 /* for const-correctness */
189 static inline const struct xt_entry_target *
190 ipt_get_target_c(const struct ipt_entry *e)
191 {
192         return ipt_get_target((struct ipt_entry *)e);
193 }
194
195 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
196     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
197 static const char *const hooknames[] = {
198         [NF_INET_PRE_ROUTING]           = "PREROUTING",
199         [NF_INET_LOCAL_IN]              = "INPUT",
200         [NF_INET_FORWARD]               = "FORWARD",
201         [NF_INET_LOCAL_OUT]             = "OUTPUT",
202         [NF_INET_POST_ROUTING]          = "POSTROUTING",
203 };
204
205 enum nf_ip_trace_comments {
206         NF_IP_TRACE_COMMENT_RULE,
207         NF_IP_TRACE_COMMENT_RETURN,
208         NF_IP_TRACE_COMMENT_POLICY,
209 };
210
211 static const char *const comments[] = {
212         [NF_IP_TRACE_COMMENT_RULE]      = "rule",
213         [NF_IP_TRACE_COMMENT_RETURN]    = "return",
214         [NF_IP_TRACE_COMMENT_POLICY]    = "policy",
215 };
216
217 static struct nf_loginfo trace_loginfo = {
218         .type = NF_LOG_TYPE_LOG,
219         .u = {
220                 .log = {
221                         .level = 4,
222                         .logflags = NF_LOG_MASK,
223                 },
224         },
225 };
226
227 /* Mildly perf critical (only if packet tracing is on) */
228 static inline int
229 get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
230                       const char *hookname, const char **chainname,
231                       const char **comment, unsigned int *rulenum)
232 {
233         const struct xt_standard_target *t = (void *)ipt_get_target_c(s);
234
235         if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
236                 /* Head of user chain: ERROR target with chainname */
237                 *chainname = t->target.data;
238                 (*rulenum) = 0;
239         } else if (s == e) {
240                 (*rulenum)++;
241
242                 if (s->target_offset == sizeof(struct ipt_entry) &&
243                     strcmp(t->target.u.kernel.target->name,
244                            XT_STANDARD_TARGET) == 0 &&
245                    t->verdict < 0 &&
246                    unconditional(&s->ip)) {
247                         /* Tail of chains: STANDARD target (return/policy) */
248                         *comment = *chainname == hookname
249                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
250                                 : comments[NF_IP_TRACE_COMMENT_RETURN];
251                 }
252                 return 1;
253         } else
254                 (*rulenum)++;
255
256         return 0;
257 }
258
259 static void trace_packet(const struct sk_buff *skb,
260                          unsigned int hook,
261                          const struct net_device *in,
262                          const struct net_device *out,
263                          const char *tablename,
264                          const struct xt_table_info *private,
265                          const struct ipt_entry *e)
266 {
267         const void *table_base;
268         const struct ipt_entry *root;
269         const char *hookname, *chainname, *comment;
270         const struct ipt_entry *iter;
271         unsigned int rulenum = 0;
272
273         table_base = private->entries[smp_processor_id()];
274         root = get_entry(table_base, private->hook_entry[hook]);
275
276         hookname = chainname = hooknames[hook];
277         comment = comments[NF_IP_TRACE_COMMENT_RULE];
278
279         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
280                 if (get_chainname_rulenum(iter, e, hookname,
281                     &chainname, &comment, &rulenum) != 0)
282                         break;
283
284         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
285                       "TRACE: %s:%s:%s:%u ",
286                       tablename, chainname, comment, rulenum);
287 }
288 #endif
289
290 static inline __pure
291 struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
292 {
293         return (void *)entry + entry->next_offset;
294 }
295
296 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
297 unsigned int
298 ipt_do_table(struct sk_buff *skb,
299              unsigned int hook,
300              const struct net_device *in,
301              const struct net_device *out,
302              struct xt_table *table)
303 {
304         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
305         const struct iphdr *ip;
306         /* Initializing verdict to NF_DROP keeps gcc happy. */
307         unsigned int verdict = NF_DROP;
308         const char *indev, *outdev;
309         const void *table_base;
310         struct ipt_entry *e, **jumpstack;
311         unsigned int *stackptr, origptr, cpu;
312         const struct xt_table_info *private;
313         struct xt_action_param acpar;
314
315         /* Initialization */
316         ip = ip_hdr(skb);
317         indev = in ? in->name : nulldevname;
318         outdev = out ? out->name : nulldevname;
319         /* We handle fragments by dealing with the first fragment as
320          * if it was a normal packet.  All other fragments are treated
321          * normally, except that they will NEVER match rules that ask
322          * things we don't know, ie. tcp syn flag or ports).  If the
323          * rule is also a fragment-specific rule, non-fragments won't
324          * match it. */
325         acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
326         acpar.thoff   = ip_hdrlen(skb);
327         acpar.hotdrop = false;
328         acpar.in      = in;
329         acpar.out     = out;
330         acpar.family  = NFPROTO_IPV4;
331         acpar.hooknum = hook;
332
333         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
334         xt_info_rdlock_bh();
335         private = table->private;
336         cpu        = smp_processor_id();
337         table_base = private->entries[cpu];
338         jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
339         stackptr   = per_cpu_ptr(private->stackptr, cpu);
340         origptr    = *stackptr;
341
342         e = get_entry(table_base, private->hook_entry[hook]);
343
344         pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
345                  table->name, hook, origptr,
346                  get_entry(table_base, private->underflow[hook]));
347
348         do {
349                 const struct xt_entry_target *t;
350                 const struct xt_entry_match *ematch;
351
352                 IP_NF_ASSERT(e);
353                 if (!ip_packet_match(ip, indev, outdev,
354                     &e->ip, acpar.fragoff)) {
355  no_match:
356                         e = ipt_next_entry(e);
357                         continue;
358                 }
359
360                 xt_ematch_foreach(ematch, e) {
361                         acpar.match     = ematch->u.kernel.match;
362                         acpar.matchinfo = ematch->data;
363                         if (!acpar.match->match(skb, &acpar))
364                                 goto no_match;
365                 }
366
367                 ADD_COUNTER(e->counters, skb->len, 1);
368
369                 t = ipt_get_target(e);
370                 IP_NF_ASSERT(t->u.kernel.target);
371
372 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
373     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
374                 /* The packet is traced: log it */
375                 if (unlikely(skb->nf_trace))
376                         trace_packet(skb, hook, in, out,
377                                      table->name, private, e);
378 #endif
379                 /* Standard target? */
380                 if (!t->u.kernel.target->target) {
381                         int v;
382
383                         v = ((struct xt_standard_target *)t)->verdict;
384                         if (v < 0) {
385                                 /* Pop from stack? */
386                                 if (v != XT_RETURN) {
387                                         verdict = (unsigned)(-v) - 1;
388                                         break;
389                                 }
390                                 if (*stackptr == 0) {
391                                         e = get_entry(table_base,
392                                             private->underflow[hook]);
393                                         pr_debug("Underflow (this is normal) "
394                                                  "to %p\n", e);
395                                 } else {
396                                         e = jumpstack[--*stackptr];
397                                         pr_debug("Pulled %p out from pos %u\n",
398                                                  e, *stackptr);
399                                         e = ipt_next_entry(e);
400                                 }
401                                 continue;
402                         }
403                         if (table_base + v != ipt_next_entry(e) &&
404                             !(e->ip.flags & IPT_F_GOTO)) {
405                                 if (*stackptr >= private->stacksize) {
406                                         verdict = NF_DROP;
407                                         break;
408                                 }
409                                 jumpstack[(*stackptr)++] = e;
410                                 pr_debug("Pushed %p into pos %u\n",
411                                          e, *stackptr - 1);
412                         }
413
414                         e = get_entry(table_base, v);
415                         continue;
416                 }
417
418                 acpar.target   = t->u.kernel.target;
419                 acpar.targinfo = t->data;
420
421                 verdict = t->u.kernel.target->target(skb, &acpar);
422                 /* Target might have changed stuff. */
423                 ip = ip_hdr(skb);
424                 if (verdict == XT_CONTINUE)
425                         e = ipt_next_entry(e);
426                 else
427                         /* Verdict */
428                         break;
429         } while (!acpar.hotdrop);
430         xt_info_rdunlock_bh();
431         pr_debug("Exiting %s; resetting sp from %u to %u\n",
432                  __func__, *stackptr, origptr);
433         *stackptr = origptr;
434 #ifdef DEBUG_ALLOW_ALL
435         return NF_ACCEPT;
436 #else
437         if (acpar.hotdrop)
438                 return NF_DROP;
439         else return verdict;
440 #endif
441 }
442
443 /* Figures out from what hook each rule can be called: returns 0 if
444    there are loops.  Puts hook bitmask in comefrom. */
445 static int
446 mark_source_chains(const struct xt_table_info *newinfo,
447                    unsigned int valid_hooks, void *entry0)
448 {
449         unsigned int hook;
450
451         /* No recursion; use packet counter to save back ptrs (reset
452            to 0 as we leave), and comefrom to save source hook bitmask */
453         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
454                 unsigned int pos = newinfo->hook_entry[hook];
455                 struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
456
457                 if (!(valid_hooks & (1 << hook)))
458                         continue;
459
460                 /* Set initial back pointer. */
461                 e->counters.pcnt = pos;
462
463                 for (;;) {
464                         const struct xt_standard_target *t
465                                 = (void *)ipt_get_target_c(e);
466                         int visited = e->comefrom & (1 << hook);
467
468                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
469                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
470                                        hook, pos, e->comefrom);
471                                 return 0;
472                         }
473                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
474
475                         /* Unconditional return/END. */
476                         if ((e->target_offset == sizeof(struct ipt_entry) &&
477                              (strcmp(t->target.u.user.name,
478                                      XT_STANDARD_TARGET) == 0) &&
479                              t->verdict < 0 && unconditional(&e->ip)) ||
480                             visited) {
481                                 unsigned int oldpos, size;
482
483                                 if ((strcmp(t->target.u.user.name,
484                                             XT_STANDARD_TARGET) == 0) &&
485                                     t->verdict < -NF_MAX_VERDICT - 1) {
486                                         duprintf("mark_source_chains: bad "
487                                                 "negative verdict (%i)\n",
488                                                                 t->verdict);
489                                         return 0;
490                                 }
491
492                                 /* Return: backtrack through the last
493                                    big jump. */
494                                 do {
495                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
496 #ifdef DEBUG_IP_FIREWALL_USER
497                                         if (e->comefrom
498                                             & (1 << NF_INET_NUMHOOKS)) {
499                                                 duprintf("Back unset "
500                                                          "on hook %u "
501                                                          "rule %u\n",
502                                                          hook, pos);
503                                         }
504 #endif
505                                         oldpos = pos;
506                                         pos = e->counters.pcnt;
507                                         e->counters.pcnt = 0;
508
509                                         /* We're at the start. */
510                                         if (pos == oldpos)
511                                                 goto next;
512
513                                         e = (struct ipt_entry *)
514                                                 (entry0 + pos);
515                                 } while (oldpos == pos + e->next_offset);
516
517                                 /* Move along one */
518                                 size = e->next_offset;
519                                 e = (struct ipt_entry *)
520                                         (entry0 + pos + size);
521                                 e->counters.pcnt = pos;
522                                 pos += size;
523                         } else {
524                                 int newpos = t->verdict;
525
526                                 if (strcmp(t->target.u.user.name,
527                                            XT_STANDARD_TARGET) == 0 &&
528                                     newpos >= 0) {
529                                         if (newpos > newinfo->size -
530                                                 sizeof(struct ipt_entry)) {
531                                                 duprintf("mark_source_chains: "
532                                                         "bad verdict (%i)\n",
533                                                                 newpos);
534                                                 return 0;
535                                         }
536                                         /* This a jump; chase it. */
537                                         duprintf("Jump rule %u -> %u\n",
538                                                  pos, newpos);
539                                 } else {
540                                         /* ... this is a fallthru */
541                                         newpos = pos + e->next_offset;
542                                 }
543                                 e = (struct ipt_entry *)
544                                         (entry0 + newpos);
545                                 e->counters.pcnt = pos;
546                                 pos = newpos;
547                         }
548                 }
549                 next:
550                 duprintf("Finished chain %u\n", hook);
551         }
552         return 1;
553 }
554
555 static void cleanup_match(struct xt_entry_match *m, struct net *net)
556 {
557         struct xt_mtdtor_param par;
558
559         par.net       = net;
560         par.match     = m->u.kernel.match;
561         par.matchinfo = m->data;
562         par.family    = NFPROTO_IPV4;
563         if (par.match->destroy != NULL)
564                 par.match->destroy(&par);
565         module_put(par.match->me);
566 }
567
568 static int
569 check_entry(const struct ipt_entry *e, const char *name)
570 {
571         const struct xt_entry_target *t;
572
573         if (!ip_checkentry(&e->ip)) {
574                 duprintf("ip check failed %p %s.\n", e, par->match->name);
575                 return -EINVAL;
576         }
577
578         if (e->target_offset + sizeof(struct xt_entry_target) >
579             e->next_offset)
580                 return -EINVAL;
581
582         t = ipt_get_target_c(e);
583         if (e->target_offset + t->u.target_size > e->next_offset)
584                 return -EINVAL;
585
586         return 0;
587 }
588
589 static int
590 check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
591 {
592         const struct ipt_ip *ip = par->entryinfo;
593         int ret;
594
595         par->match     = m->u.kernel.match;
596         par->matchinfo = m->data;
597
598         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
599               ip->proto, ip->invflags & IPT_INV_PROTO);
600         if (ret < 0) {
601                 duprintf("check failed for `%s'.\n", par->match->name);
602                 return ret;
603         }
604         return 0;
605 }
606
607 static int
608 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
609 {
610         struct xt_match *match;
611         int ret;
612
613         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
614                                       m->u.user.revision);
615         if (IS_ERR(match)) {
616                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
617                 return PTR_ERR(match);
618         }
619         m->u.kernel.match = match;
620
621         ret = check_match(m, par);
622         if (ret)
623                 goto err;
624
625         return 0;
626 err:
627         module_put(m->u.kernel.match->me);
628         return ret;
629 }
630
631 static int check_target(struct ipt_entry *e, struct net *net, const char *name)
632 {
633         struct xt_entry_target *t = ipt_get_target(e);
634         struct xt_tgchk_param par = {
635                 .net       = net,
636                 .table     = name,
637                 .entryinfo = e,
638                 .target    = t->u.kernel.target,
639                 .targinfo  = t->data,
640                 .hook_mask = e->comefrom,
641                 .family    = NFPROTO_IPV4,
642         };
643         int ret;
644
645         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
646               e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
647         if (ret < 0) {
648                 duprintf("check failed for `%s'.\n",
649                          t->u.kernel.target->name);
650                 return ret;
651         }
652         return 0;
653 }
654
655 static int
656 find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
657                  unsigned int size)
658 {
659         struct xt_entry_target *t;
660         struct xt_target *target;
661         int ret;
662         unsigned int j;
663         struct xt_mtchk_param mtpar;
664         struct xt_entry_match *ematch;
665
666         ret = check_entry(e, name);
667         if (ret)
668                 return ret;
669
670         j = 0;
671         mtpar.net       = net;
672         mtpar.table     = name;
673         mtpar.entryinfo = &e->ip;
674         mtpar.hook_mask = e->comefrom;
675         mtpar.family    = NFPROTO_IPV4;
676         xt_ematch_foreach(ematch, e) {
677                 ret = find_check_match(ematch, &mtpar);
678                 if (ret != 0)
679                         goto cleanup_matches;
680                 ++j;
681         }
682
683         t = ipt_get_target(e);
684         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
685                                         t->u.user.revision);
686         if (IS_ERR(target)) {
687                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
688                 ret = PTR_ERR(target);
689                 goto cleanup_matches;
690         }
691         t->u.kernel.target = target;
692
693         ret = check_target(e, net, name);
694         if (ret)
695                 goto err;
696         return 0;
697  err:
698         module_put(t->u.kernel.target->me);
699  cleanup_matches:
700         xt_ematch_foreach(ematch, e) {
701                 if (j-- == 0)
702                         break;
703                 cleanup_match(ematch, net);
704         }
705         return ret;
706 }
707
708 static bool check_underflow(const struct ipt_entry *e)
709 {
710         const struct xt_entry_target *t;
711         unsigned int verdict;
712
713         if (!unconditional(&e->ip))
714                 return false;
715         t = ipt_get_target_c(e);
716         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
717                 return false;
718         verdict = ((struct xt_standard_target *)t)->verdict;
719         verdict = -verdict - 1;
720         return verdict == NF_DROP || verdict == NF_ACCEPT;
721 }
722
723 static int
724 check_entry_size_and_hooks(struct ipt_entry *e,
725                            struct xt_table_info *newinfo,
726                            const unsigned char *base,
727                            const unsigned char *limit,
728                            const unsigned int *hook_entries,
729                            const unsigned int *underflows,
730                            unsigned int valid_hooks)
731 {
732         unsigned int h;
733
734         if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
735             (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
736                 duprintf("Bad offset %p\n", e);
737                 return -EINVAL;
738         }
739
740         if (e->next_offset
741             < sizeof(struct ipt_entry) + sizeof(struct xt_entry_target)) {
742                 duprintf("checking: element %p size %u\n",
743                          e, e->next_offset);
744                 return -EINVAL;
745         }
746
747         /* Check hooks & underflows */
748         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
749                 if (!(valid_hooks & (1 << h)))
750                         continue;
751                 if ((unsigned char *)e - base == hook_entries[h])
752                         newinfo->hook_entry[h] = hook_entries[h];
753                 if ((unsigned char *)e - base == underflows[h]) {
754                         if (!check_underflow(e)) {
755                                 pr_err("Underflows must be unconditional and "
756                                        "use the STANDARD target with "
757                                        "ACCEPT/DROP\n");
758                                 return -EINVAL;
759                         }
760                         newinfo->underflow[h] = underflows[h];
761                 }
762         }
763
764         /* Clear counters and comefrom */
765         e->counters = ((struct xt_counters) { 0, 0 });
766         e->comefrom = 0;
767         return 0;
768 }
769
770 static void
771 cleanup_entry(struct ipt_entry *e, struct net *net)
772 {
773         struct xt_tgdtor_param par;
774         struct xt_entry_target *t;
775         struct xt_entry_match *ematch;
776
777         /* Cleanup all matches */
778         xt_ematch_foreach(ematch, e)
779                 cleanup_match(ematch, net);
780         t = ipt_get_target(e);
781
782         par.net      = net;
783         par.target   = t->u.kernel.target;
784         par.targinfo = t->data;
785         par.family   = NFPROTO_IPV4;
786         if (par.target->destroy != NULL)
787                 par.target->destroy(&par);
788         module_put(par.target->me);
789 }
790
791 /* Checks and translates the user-supplied table segment (held in
792    newinfo) */
793 static int
794 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
795                 const struct ipt_replace *repl)
796 {
797         struct ipt_entry *iter;
798         unsigned int i;
799         int ret = 0;
800
801         newinfo->size = repl->size;
802         newinfo->number = repl->num_entries;
803
804         /* Init all hooks to impossible value. */
805         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
806                 newinfo->hook_entry[i] = 0xFFFFFFFF;
807                 newinfo->underflow[i] = 0xFFFFFFFF;
808         }
809
810         duprintf("translate_table: size %u\n", newinfo->size);
811         i = 0;
812         /* Walk through entries, checking offsets. */
813         xt_entry_foreach(iter, entry0, newinfo->size) {
814                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
815                                                  entry0 + repl->size,
816                                                  repl->hook_entry,
817                                                  repl->underflow,
818                                                  repl->valid_hooks);
819                 if (ret != 0)
820                         return ret;
821                 ++i;
822                 if (strcmp(ipt_get_target(iter)->u.user.name,
823                     XT_ERROR_TARGET) == 0)
824                         ++newinfo->stacksize;
825         }
826
827         if (i != repl->num_entries) {
828                 duprintf("translate_table: %u not %u entries\n",
829                          i, repl->num_entries);
830                 return -EINVAL;
831         }
832
833         /* Check hooks all assigned */
834         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
835                 /* Only hooks which are valid */
836                 if (!(repl->valid_hooks & (1 << i)))
837                         continue;
838                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
839                         duprintf("Invalid hook entry %u %u\n",
840                                  i, repl->hook_entry[i]);
841                         return -EINVAL;
842                 }
843                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
844                         duprintf("Invalid underflow %u %u\n",
845                                  i, repl->underflow[i]);
846                         return -EINVAL;
847                 }
848         }
849
850         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
851                 return -ELOOP;
852
853         /* Finally, each sanity check must pass */
854         i = 0;
855         xt_entry_foreach(iter, entry0, newinfo->size) {
856                 ret = find_check_entry(iter, net, repl->name, repl->size);
857                 if (ret != 0)
858                         break;
859                 ++i;
860         }
861
862         if (ret != 0) {
863                 xt_entry_foreach(iter, entry0, newinfo->size) {
864                         if (i-- == 0)
865                                 break;
866                         cleanup_entry(iter, net);
867                 }
868                 return ret;
869         }
870
871         /* And one copy for every other CPU */
872         for_each_possible_cpu(i) {
873                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
874                         memcpy(newinfo->entries[i], entry0, newinfo->size);
875         }
876
877         return ret;
878 }
879
880 static void
881 get_counters(const struct xt_table_info *t,
882              struct xt_counters counters[])
883 {
884         struct ipt_entry *iter;
885         unsigned int cpu;
886         unsigned int i;
887
888         for_each_possible_cpu(cpu) {
889                 seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
890
891                 i = 0;
892                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
893                         u64 bcnt, pcnt;
894                         unsigned int start;
895
896                         do {
897                                 start = read_seqbegin(lock);
898                                 bcnt = iter->counters.bcnt;
899                                 pcnt = iter->counters.pcnt;
900                         } while (read_seqretry(lock, start));
901
902                         ADD_COUNTER(counters[i], bcnt, pcnt);
903                         ++i; /* macro does multi eval of i */
904                 }
905         }
906 }
907
908 static struct xt_counters *alloc_counters(const struct xt_table *table)
909 {
910         unsigned int countersize;
911         struct xt_counters *counters;
912         const struct xt_table_info *private = table->private;
913
914         /* We need atomic snapshot of counters: rest doesn't change
915            (other than comefrom, which userspace doesn't care
916            about). */
917         countersize = sizeof(struct xt_counters) * private->number;
918         counters = vzalloc(countersize);
919
920         if (counters == NULL)
921                 return ERR_PTR(-ENOMEM);
922
923         get_counters(private, counters);
924
925         return counters;
926 }
927
928 static int
929 copy_entries_to_user(unsigned int total_size,
930                      const struct xt_table *table,
931                      void __user *userptr)
932 {
933         unsigned int off, num;
934         const struct ipt_entry *e;
935         struct xt_counters *counters;
936         const struct xt_table_info *private = table->private;
937         int ret = 0;
938         const void *loc_cpu_entry;
939
940         counters = alloc_counters(table);
941         if (IS_ERR(counters))
942                 return PTR_ERR(counters);
943
944         /* choose the copy that is on our node/cpu, ...
945          * This choice is lazy (because current thread is
946          * allowed to migrate to another cpu)
947          */
948         loc_cpu_entry = private->entries[raw_smp_processor_id()];
949         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
950                 ret = -EFAULT;
951                 goto free_counters;
952         }
953
954         /* FIXME: use iterator macros --RR */
955         /* ... then go back and fix counters and names */
956         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
957                 unsigned int i;
958                 const struct xt_entry_match *m;
959                 const struct xt_entry_target *t;
960
961                 e = (struct ipt_entry *)(loc_cpu_entry + off);
962                 if (copy_to_user(userptr + off
963                                  + offsetof(struct ipt_entry, counters),
964                                  &counters[num],
965                                  sizeof(counters[num])) != 0) {
966                         ret = -EFAULT;
967                         goto free_counters;
968                 }
969
970                 for (i = sizeof(struct ipt_entry);
971                      i < e->target_offset;
972                      i += m->u.match_size) {
973                         m = (void *)e + i;
974
975                         if (copy_to_user(userptr + off + i
976                                          + offsetof(struct xt_entry_match,
977                                                     u.user.name),
978                                          m->u.kernel.match->name,
979                                          strlen(m->u.kernel.match->name)+1)
980                             != 0) {
981                                 ret = -EFAULT;
982                                 goto free_counters;
983                         }
984                 }
985
986                 t = ipt_get_target_c(e);
987                 if (copy_to_user(userptr + off + e->target_offset
988                                  + offsetof(struct xt_entry_target,
989                                             u.user.name),
990                                  t->u.kernel.target->name,
991                                  strlen(t->u.kernel.target->name)+1) != 0) {
992                         ret = -EFAULT;
993                         goto free_counters;
994                 }
995         }
996
997  free_counters:
998         vfree(counters);
999         return ret;
1000 }
1001
1002 #ifdef CONFIG_COMPAT
1003 static void compat_standard_from_user(void *dst, const void *src)
1004 {
1005         int v = *(compat_int_t *)src;
1006
1007         if (v > 0)
1008                 v += xt_compat_calc_jump(AF_INET, v);
1009         memcpy(dst, &v, sizeof(v));
1010 }
1011
1012 static int compat_standard_to_user(void __user *dst, const void *src)
1013 {
1014         compat_int_t cv = *(int *)src;
1015
1016         if (cv > 0)
1017                 cv -= xt_compat_calc_jump(AF_INET, cv);
1018         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1019 }
1020
1021 static int compat_calc_entry(const struct ipt_entry *e,
1022                              const struct xt_table_info *info,
1023                              const void *base, struct xt_table_info *newinfo)
1024 {
1025         const struct xt_entry_match *ematch;
1026         const struct xt_entry_target *t;
1027         unsigned int entry_offset;
1028         int off, i, ret;
1029
1030         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1031         entry_offset = (void *)e - base;
1032         xt_ematch_foreach(ematch, e)
1033                 off += xt_compat_match_offset(ematch->u.kernel.match);
1034         t = ipt_get_target_c(e);
1035         off += xt_compat_target_offset(t->u.kernel.target);
1036         newinfo->size -= off;
1037         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1038         if (ret)
1039                 return ret;
1040
1041         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1042                 if (info->hook_entry[i] &&
1043                     (e < (struct ipt_entry *)(base + info->hook_entry[i])))
1044                         newinfo->hook_entry[i] -= off;
1045                 if (info->underflow[i] &&
1046                     (e < (struct ipt_entry *)(base + info->underflow[i])))
1047                         newinfo->underflow[i] -= off;
1048         }
1049         return 0;
1050 }
1051
1052 static int compat_table_info(const struct xt_table_info *info,
1053                              struct xt_table_info *newinfo)
1054 {
1055         struct ipt_entry *iter;
1056         void *loc_cpu_entry;
1057         int ret;
1058
1059         if (!newinfo || !info)
1060                 return -EINVAL;
1061
1062         /* we dont care about newinfo->entries[] */
1063         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1064         newinfo->initial_entries = 0;
1065         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1066         xt_compat_init_offsets(AF_INET, info->number);
1067         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1068                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1069                 if (ret != 0)
1070                         return ret;
1071         }
1072         return 0;
1073 }
1074 #endif
1075
1076 static int get_info(struct net *net, void __user *user,
1077                     const int *len, int compat)
1078 {
1079         char name[XT_TABLE_MAXNAMELEN];
1080         struct xt_table *t;
1081         int ret;
1082
1083         if (*len != sizeof(struct ipt_getinfo)) {
1084                 duprintf("length %u != %zu\n", *len,
1085                          sizeof(struct ipt_getinfo));
1086                 return -EINVAL;
1087         }
1088
1089         if (copy_from_user(name, user, sizeof(name)) != 0)
1090                 return -EFAULT;
1091
1092         name[XT_TABLE_MAXNAMELEN-1] = '\0';
1093 #ifdef CONFIG_COMPAT
1094         if (compat)
1095                 xt_compat_lock(AF_INET);
1096 #endif
1097         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1098                                     "iptable_%s", name);
1099         if (t && !IS_ERR(t)) {
1100                 struct ipt_getinfo info;
1101                 const struct xt_table_info *private = t->private;
1102 #ifdef CONFIG_COMPAT
1103                 struct xt_table_info tmp;
1104
1105                 if (compat) {
1106                         ret = compat_table_info(private, &tmp);
1107                         xt_compat_flush_offsets(AF_INET);
1108                         private = &tmp;
1109                 }
1110 #endif
1111                 memset(&info, 0, sizeof(info));
1112                 info.valid_hooks = t->valid_hooks;
1113                 memcpy(info.hook_entry, private->hook_entry,
1114                        sizeof(info.hook_entry));
1115                 memcpy(info.underflow, private->underflow,
1116                        sizeof(info.underflow));
1117                 info.num_entries = private->number;
1118                 info.size = private->size;
1119                 strcpy(info.name, name);
1120
1121                 if (copy_to_user(user, &info, *len) != 0)
1122                         ret = -EFAULT;
1123                 else
1124                         ret = 0;
1125
1126                 xt_table_unlock(t);
1127                 module_put(t->me);
1128         } else
1129                 ret = t ? PTR_ERR(t) : -ENOENT;
1130 #ifdef CONFIG_COMPAT
1131         if (compat)
1132                 xt_compat_unlock(AF_INET);
1133 #endif
1134         return ret;
1135 }
1136
1137 static int
1138 get_entries(struct net *net, struct ipt_get_entries __user *uptr,
1139             const int *len)
1140 {
1141         int ret;
1142         struct ipt_get_entries get;
1143         struct xt_table *t;
1144
1145         if (*len < sizeof(get)) {
1146                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1147                 return -EINVAL;
1148         }
1149         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1150                 return -EFAULT;
1151         if (*len != sizeof(struct ipt_get_entries) + get.size) {
1152                 duprintf("get_entries: %u != %zu\n",
1153                          *len, sizeof(get) + get.size);
1154                 return -EINVAL;
1155         }
1156
1157         t = xt_find_table_lock(net, AF_INET, get.name);
1158         if (t && !IS_ERR(t)) {
1159                 const struct xt_table_info *private = t->private;
1160                 duprintf("t->private->number = %u\n", private->number);
1161                 if (get.size == private->size)
1162                         ret = copy_entries_to_user(private->size,
1163                                                    t, uptr->entrytable);
1164                 else {
1165                         duprintf("get_entries: I've got %u not %u!\n",
1166                                  private->size, get.size);
1167                         ret = -EAGAIN;
1168                 }
1169                 module_put(t->me);
1170                 xt_table_unlock(t);
1171         } else
1172                 ret = t ? PTR_ERR(t) : -ENOENT;
1173
1174         return ret;
1175 }
1176
1177 static int
1178 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1179              struct xt_table_info *newinfo, unsigned int num_counters,
1180              void __user *counters_ptr)
1181 {
1182         int ret;
1183         struct xt_table *t;
1184         struct xt_table_info *oldinfo;
1185         struct xt_counters *counters;
1186         void *loc_cpu_old_entry;
1187         struct ipt_entry *iter;
1188
1189         ret = 0;
1190         counters = vzalloc(num_counters * sizeof(struct xt_counters));
1191         if (!counters) {
1192                 ret = -ENOMEM;
1193                 goto out;
1194         }
1195
1196         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1197                                     "iptable_%s", name);
1198         if (!t || IS_ERR(t)) {
1199                 ret = t ? PTR_ERR(t) : -ENOENT;
1200                 goto free_newinfo_counters_untrans;
1201         }
1202
1203         /* You lied! */
1204         if (valid_hooks != t->valid_hooks) {
1205                 duprintf("Valid hook crap: %08X vs %08X\n",
1206                          valid_hooks, t->valid_hooks);
1207                 ret = -EINVAL;
1208                 goto put_module;
1209         }
1210
1211         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1212         if (!oldinfo)
1213                 goto put_module;
1214
1215         /* Update module usage count based on number of rules */
1216         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1217                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1218         if ((oldinfo->number > oldinfo->initial_entries) ||
1219             (newinfo->number <= oldinfo->initial_entries))
1220                 module_put(t->me);
1221         if ((oldinfo->number > oldinfo->initial_entries) &&
1222             (newinfo->number <= oldinfo->initial_entries))
1223                 module_put(t->me);
1224
1225         /* Get the old counters, and synchronize with replace */
1226         get_counters(oldinfo, counters);
1227
1228         /* Decrease module usage counts and free resource */
1229         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1230         xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1231                 cleanup_entry(iter, net);
1232
1233         xt_free_table_info(oldinfo);
1234         if (copy_to_user(counters_ptr, counters,
1235                          sizeof(struct xt_counters) * num_counters) != 0)
1236                 ret = -EFAULT;
1237         vfree(counters);
1238         xt_table_unlock(t);
1239         return ret;
1240
1241  put_module:
1242         module_put(t->me);
1243         xt_table_unlock(t);
1244  free_newinfo_counters_untrans:
1245         vfree(counters);
1246  out:
1247         return ret;
1248 }
1249
1250 static int
1251 do_replace(struct net *net, const void __user *user, unsigned int len)
1252 {
1253         int ret;
1254         struct ipt_replace tmp;
1255         struct xt_table_info *newinfo;
1256         void *loc_cpu_entry;
1257         struct ipt_entry *iter;
1258
1259         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1260                 return -EFAULT;
1261
1262         /* overflow check */
1263         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1264                 return -ENOMEM;
1265
1266         newinfo = xt_alloc_table_info(tmp.size);
1267         if (!newinfo)
1268                 return -ENOMEM;
1269
1270         /* choose the copy that is on our node/cpu */
1271         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1272         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1273                            tmp.size) != 0) {
1274                 ret = -EFAULT;
1275                 goto free_newinfo;
1276         }
1277
1278         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1279         if (ret != 0)
1280                 goto free_newinfo;
1281
1282         duprintf("Translated table\n");
1283
1284         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1285                            tmp.num_counters, tmp.counters);
1286         if (ret)
1287                 goto free_newinfo_untrans;
1288         return 0;
1289
1290  free_newinfo_untrans:
1291         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1292                 cleanup_entry(iter, net);
1293  free_newinfo:
1294         xt_free_table_info(newinfo);
1295         return ret;
1296 }
1297
1298 static int
1299 do_add_counters(struct net *net, const void __user *user,
1300                 unsigned int len, int compat)
1301 {
1302         unsigned int i, curcpu;
1303         struct xt_counters_info tmp;
1304         struct xt_counters *paddc;
1305         unsigned int num_counters;
1306         const char *name;
1307         int size;
1308         void *ptmp;
1309         struct xt_table *t;
1310         const struct xt_table_info *private;
1311         int ret = 0;
1312         void *loc_cpu_entry;
1313         struct ipt_entry *iter;
1314 #ifdef CONFIG_COMPAT
1315         struct compat_xt_counters_info compat_tmp;
1316
1317         if (compat) {
1318                 ptmp = &compat_tmp;
1319                 size = sizeof(struct compat_xt_counters_info);
1320         } else
1321 #endif
1322         {
1323                 ptmp = &tmp;
1324                 size = sizeof(struct xt_counters_info);
1325         }
1326
1327         if (copy_from_user(ptmp, user, size) != 0)
1328                 return -EFAULT;
1329
1330 #ifdef CONFIG_COMPAT
1331         if (compat) {
1332                 num_counters = compat_tmp.num_counters;
1333                 name = compat_tmp.name;
1334         } else
1335 #endif
1336         {
1337                 num_counters = tmp.num_counters;
1338                 name = tmp.name;
1339         }
1340
1341         if (len != size + num_counters * sizeof(struct xt_counters))
1342                 return -EINVAL;
1343
1344         paddc = vmalloc(len - size);
1345         if (!paddc)
1346                 return -ENOMEM;
1347
1348         if (copy_from_user(paddc, user + size, len - size) != 0) {
1349                 ret = -EFAULT;
1350                 goto free;
1351         }
1352
1353         t = xt_find_table_lock(net, AF_INET, name);
1354         if (!t || IS_ERR(t)) {
1355                 ret = t ? PTR_ERR(t) : -ENOENT;
1356                 goto free;
1357         }
1358
1359         local_bh_disable();
1360         private = t->private;
1361         if (private->number != num_counters) {
1362                 ret = -EINVAL;
1363                 goto unlock_up_free;
1364         }
1365
1366         i = 0;
1367         /* Choose the copy that is on our node */
1368         curcpu = smp_processor_id();
1369         loc_cpu_entry = private->entries[curcpu];
1370         xt_info_wrlock(curcpu);
1371         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
1372                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
1373                 ++i;
1374         }
1375         xt_info_wrunlock(curcpu);
1376  unlock_up_free:
1377         local_bh_enable();
1378         xt_table_unlock(t);
1379         module_put(t->me);
1380  free:
1381         vfree(paddc);
1382
1383         return ret;
1384 }
1385
1386 #ifdef CONFIG_COMPAT
1387 struct compat_ipt_replace {
1388         char                    name[XT_TABLE_MAXNAMELEN];
1389         u32                     valid_hooks;
1390         u32                     num_entries;
1391         u32                     size;
1392         u32                     hook_entry[NF_INET_NUMHOOKS];
1393         u32                     underflow[NF_INET_NUMHOOKS];
1394         u32                     num_counters;
1395         compat_uptr_t           counters;       /* struct xt_counters * */
1396         struct compat_ipt_entry entries[0];
1397 };
1398
1399 static int
1400 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1401                           unsigned int *size, struct xt_counters *counters,
1402                           unsigned int i)
1403 {
1404         struct xt_entry_target *t;
1405         struct compat_ipt_entry __user *ce;
1406         u_int16_t target_offset, next_offset;
1407         compat_uint_t origsize;
1408         const struct xt_entry_match *ematch;
1409         int ret = 0;
1410
1411         origsize = *size;
1412         ce = (struct compat_ipt_entry __user *)*dstptr;
1413         if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
1414             copy_to_user(&ce->counters, &counters[i],
1415             sizeof(counters[i])) != 0)
1416                 return -EFAULT;
1417
1418         *dstptr += sizeof(struct compat_ipt_entry);
1419         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1420
1421         xt_ematch_foreach(ematch, e) {
1422                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1423                 if (ret != 0)
1424                         return ret;
1425         }
1426         target_offset = e->target_offset - (origsize - *size);
1427         t = ipt_get_target(e);
1428         ret = xt_compat_target_to_user(t, dstptr, size);
1429         if (ret)
1430                 return ret;
1431         next_offset = e->next_offset - (origsize - *size);
1432         if (put_user(target_offset, &ce->target_offset) != 0 ||
1433             put_user(next_offset, &ce->next_offset) != 0)
1434                 return -EFAULT;
1435         return 0;
1436 }
1437
1438 static int
1439 compat_find_calc_match(struct xt_entry_match *m,
1440                        const char *name,
1441                        const struct ipt_ip *ip,
1442                        unsigned int hookmask,
1443                        int *size)
1444 {
1445         struct xt_match *match;
1446
1447         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
1448                                       m->u.user.revision);
1449         if (IS_ERR(match)) {
1450                 duprintf("compat_check_calc_match: `%s' not found\n",
1451                          m->u.user.name);
1452                 return PTR_ERR(match);
1453         }
1454         m->u.kernel.match = match;
1455         *size += xt_compat_match_offset(match);
1456         return 0;
1457 }
1458
1459 static void compat_release_entry(struct compat_ipt_entry *e)
1460 {
1461         struct xt_entry_target *t;
1462         struct xt_entry_match *ematch;
1463
1464         /* Cleanup all matches */
1465         xt_ematch_foreach(ematch, e)
1466                 module_put(ematch->u.kernel.match->me);
1467         t = compat_ipt_get_target(e);
1468         module_put(t->u.kernel.target->me);
1469 }
1470
1471 static int
1472 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1473                                   struct xt_table_info *newinfo,
1474                                   unsigned int *size,
1475                                   const unsigned char *base,
1476                                   const unsigned char *limit,
1477                                   const unsigned int *hook_entries,
1478                                   const unsigned int *underflows,
1479                                   const char *name)
1480 {
1481         struct xt_entry_match *ematch;
1482         struct xt_entry_target *t;
1483         struct xt_target *target;
1484         unsigned int entry_offset;
1485         unsigned int j;
1486         int ret, off, h;
1487
1488         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1489         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
1490             (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1491                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1492                 return -EINVAL;
1493         }
1494
1495         if (e->next_offset < sizeof(struct compat_ipt_entry) +
1496                              sizeof(struct compat_xt_entry_target)) {
1497                 duprintf("checking: element %p size %u\n",
1498                          e, e->next_offset);
1499                 return -EINVAL;
1500         }
1501
1502         /* For purposes of check_entry casting the compat entry is fine */
1503         ret = check_entry((struct ipt_entry *)e, name);
1504         if (ret)
1505                 return ret;
1506
1507         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1508         entry_offset = (void *)e - (void *)base;
1509         j = 0;
1510         xt_ematch_foreach(ematch, e) {
1511                 ret = compat_find_calc_match(ematch, name,
1512                                              &e->ip, e->comefrom, &off);
1513                 if (ret != 0)
1514                         goto release_matches;
1515                 ++j;
1516         }
1517
1518         t = compat_ipt_get_target(e);
1519         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
1520                                         t->u.user.revision);
1521         if (IS_ERR(target)) {
1522                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1523                          t->u.user.name);
1524                 ret = PTR_ERR(target);
1525                 goto release_matches;
1526         }
1527         t->u.kernel.target = target;
1528
1529         off += xt_compat_target_offset(target);
1530         *size += off;
1531         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1532         if (ret)
1533                 goto out;
1534
1535         /* Check hooks & underflows */
1536         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1537                 if ((unsigned char *)e - base == hook_entries[h])
1538                         newinfo->hook_entry[h] = hook_entries[h];
1539                 if ((unsigned char *)e - base == underflows[h])
1540                         newinfo->underflow[h] = underflows[h];
1541         }
1542
1543         /* Clear counters and comefrom */
1544         memset(&e->counters, 0, sizeof(e->counters));
1545         e->comefrom = 0;
1546         return 0;
1547
1548 out:
1549         module_put(t->u.kernel.target->me);
1550 release_matches:
1551         xt_ematch_foreach(ematch, e) {
1552                 if (j-- == 0)
1553                         break;
1554                 module_put(ematch->u.kernel.match->me);
1555         }
1556         return ret;
1557 }
1558
1559 static int
1560 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1561                             unsigned int *size, const char *name,
1562                             struct xt_table_info *newinfo, unsigned char *base)
1563 {
1564         struct xt_entry_target *t;
1565         struct xt_target *target;
1566         struct ipt_entry *de;
1567         unsigned int origsize;
1568         int ret, h;
1569         struct xt_entry_match *ematch;
1570
1571         ret = 0;
1572         origsize = *size;
1573         de = (struct ipt_entry *)*dstptr;
1574         memcpy(de, e, sizeof(struct ipt_entry));
1575         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1576
1577         *dstptr += sizeof(struct ipt_entry);
1578         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1579
1580         xt_ematch_foreach(ematch, e) {
1581                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1582                 if (ret != 0)
1583                         return ret;
1584         }
1585         de->target_offset = e->target_offset - (origsize - *size);
1586         t = compat_ipt_get_target(e);
1587         target = t->u.kernel.target;
1588         xt_compat_target_from_user(t, dstptr, size);
1589
1590         de->next_offset = e->next_offset - (origsize - *size);
1591         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1592                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1593                         newinfo->hook_entry[h] -= origsize - *size;
1594                 if ((unsigned char *)de - base < newinfo->underflow[h])
1595                         newinfo->underflow[h] -= origsize - *size;
1596         }
1597         return ret;
1598 }
1599
1600 static int
1601 compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
1602 {
1603         struct xt_entry_match *ematch;
1604         struct xt_mtchk_param mtpar;
1605         unsigned int j;
1606         int ret = 0;
1607
1608         j = 0;
1609         mtpar.net       = net;
1610         mtpar.table     = name;
1611         mtpar.entryinfo = &e->ip;
1612         mtpar.hook_mask = e->comefrom;
1613         mtpar.family    = NFPROTO_IPV4;
1614         xt_ematch_foreach(ematch, e) {
1615                 ret = check_match(ematch, &mtpar);
1616                 if (ret != 0)
1617                         goto cleanup_matches;
1618                 ++j;
1619         }
1620
1621         ret = check_target(e, net, name);
1622         if (ret)
1623                 goto cleanup_matches;
1624         return 0;
1625
1626  cleanup_matches:
1627         xt_ematch_foreach(ematch, e) {
1628                 if (j-- == 0)
1629                         break;
1630                 cleanup_match(ematch, net);
1631         }
1632         return ret;
1633 }
1634
1635 static int
1636 translate_compat_table(struct net *net,
1637                        const char *name,
1638                        unsigned int valid_hooks,
1639                        struct xt_table_info **pinfo,
1640                        void **pentry0,
1641                        unsigned int total_size,
1642                        unsigned int number,
1643                        unsigned int *hook_entries,
1644                        unsigned int *underflows)
1645 {
1646         unsigned int i, j;
1647         struct xt_table_info *newinfo, *info;
1648         void *pos, *entry0, *entry1;
1649         struct compat_ipt_entry *iter0;
1650         struct ipt_entry *iter1;
1651         unsigned int size;
1652         int ret;
1653
1654         info = *pinfo;
1655         entry0 = *pentry0;
1656         size = total_size;
1657         info->number = number;
1658
1659         /* Init all hooks to impossible value. */
1660         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1661                 info->hook_entry[i] = 0xFFFFFFFF;
1662                 info->underflow[i] = 0xFFFFFFFF;
1663         }
1664
1665         duprintf("translate_compat_table: size %u\n", info->size);
1666         j = 0;
1667         xt_compat_lock(AF_INET);
1668         xt_compat_init_offsets(AF_INET, number);
1669         /* Walk through entries, checking offsets. */
1670         xt_entry_foreach(iter0, entry0, total_size) {
1671                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1672                                                         entry0,
1673                                                         entry0 + total_size,
1674                                                         hook_entries,
1675                                                         underflows,
1676                                                         name);
1677                 if (ret != 0)
1678                         goto out_unlock;
1679                 ++j;
1680         }
1681
1682         ret = -EINVAL;
1683         if (j != number) {
1684                 duprintf("translate_compat_table: %u not %u entries\n",
1685                          j, number);
1686                 goto out_unlock;
1687         }
1688
1689         /* Check hooks all assigned */
1690         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1691                 /* Only hooks which are valid */
1692                 if (!(valid_hooks & (1 << i)))
1693                         continue;
1694                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1695                         duprintf("Invalid hook entry %u %u\n",
1696                                  i, hook_entries[i]);
1697                         goto out_unlock;
1698                 }
1699                 if (info->underflow[i] == 0xFFFFFFFF) {
1700                         duprintf("Invalid underflow %u %u\n",
1701                                  i, underflows[i]);
1702                         goto out_unlock;
1703                 }
1704         }
1705
1706         ret = -ENOMEM;
1707         newinfo = xt_alloc_table_info(size);
1708         if (!newinfo)
1709                 goto out_unlock;
1710
1711         newinfo->number = number;
1712         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1713                 newinfo->hook_entry[i] = info->hook_entry[i];
1714                 newinfo->underflow[i] = info->underflow[i];
1715         }
1716         entry1 = newinfo->entries[raw_smp_processor_id()];
1717         pos = entry1;
1718         size = total_size;
1719         xt_entry_foreach(iter0, entry0, total_size) {
1720                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1721                                                   name, newinfo, entry1);
1722                 if (ret != 0)
1723                         break;
1724         }
1725         xt_compat_flush_offsets(AF_INET);
1726         xt_compat_unlock(AF_INET);
1727         if (ret)
1728                 goto free_newinfo;
1729
1730         ret = -ELOOP;
1731         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1732                 goto free_newinfo;
1733
1734         i = 0;
1735         xt_entry_foreach(iter1, entry1, newinfo->size) {
1736                 ret = compat_check_entry(iter1, net, name);
1737                 if (ret != 0)
1738                         break;
1739                 ++i;
1740                 if (strcmp(ipt_get_target(iter1)->u.user.name,
1741                     XT_ERROR_TARGET) == 0)
1742                         ++newinfo->stacksize;
1743         }
1744         if (ret) {
1745                 /*
1746                  * The first i matches need cleanup_entry (calls ->destroy)
1747                  * because they had called ->check already. The other j-i
1748                  * entries need only release.
1749                  */
1750                 int skip = i;
1751                 j -= i;
1752                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1753                         if (skip-- > 0)
1754                                 continue;
1755                         if (j-- == 0)
1756                                 break;
1757                         compat_release_entry(iter0);
1758                 }
1759                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1760                         if (i-- == 0)
1761                                 break;
1762                         cleanup_entry(iter1, net);
1763                 }
1764                 xt_free_table_info(newinfo);
1765                 return ret;
1766         }
1767
1768         /* And one copy for every other CPU */
1769         for_each_possible_cpu(i)
1770                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1771                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1772
1773         *pinfo = newinfo;
1774         *pentry0 = entry1;
1775         xt_free_table_info(info);
1776         return 0;
1777
1778 free_newinfo:
1779         xt_free_table_info(newinfo);
1780 out:
1781         xt_entry_foreach(iter0, entry0, total_size) {
1782                 if (j-- == 0)
1783                         break;
1784                 compat_release_entry(iter0);
1785         }
1786         return ret;
1787 out_unlock:
1788         xt_compat_flush_offsets(AF_INET);
1789         xt_compat_unlock(AF_INET);
1790         goto out;
1791 }
1792
1793 static int
1794 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1795 {
1796         int ret;
1797         struct compat_ipt_replace tmp;
1798         struct xt_table_info *newinfo;
1799         void *loc_cpu_entry;
1800         struct ipt_entry *iter;
1801
1802         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1803                 return -EFAULT;
1804
1805         /* overflow check */
1806         if (tmp.size >= INT_MAX / num_possible_cpus())
1807                 return -ENOMEM;
1808         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1809                 return -ENOMEM;
1810
1811         newinfo = xt_alloc_table_info(tmp.size);
1812         if (!newinfo)
1813                 return -ENOMEM;
1814
1815         /* choose the copy that is on our node/cpu */
1816         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1817         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1818                            tmp.size) != 0) {
1819                 ret = -EFAULT;
1820                 goto free_newinfo;
1821         }
1822
1823         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1824                                      &newinfo, &loc_cpu_entry, tmp.size,
1825                                      tmp.num_entries, tmp.hook_entry,
1826                                      tmp.underflow);
1827         if (ret != 0)
1828                 goto free_newinfo;
1829
1830         duprintf("compat_do_replace: Translated table\n");
1831
1832         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1833                            tmp.num_counters, compat_ptr(tmp.counters));
1834         if (ret)
1835                 goto free_newinfo_untrans;
1836         return 0;
1837
1838  free_newinfo_untrans:
1839         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1840                 cleanup_entry(iter, net);
1841  free_newinfo:
1842         xt_free_table_info(newinfo);
1843         return ret;
1844 }
1845
1846 static int
1847 compat_do_ipt_set_ctl(struct sock *sk,  int cmd, void __user *user,
1848                       unsigned int len)
1849 {
1850         int ret;
1851
1852         if (!capable(CAP_NET_ADMIN))
1853                 return -EPERM;
1854
1855         switch (cmd) {
1856         case IPT_SO_SET_REPLACE:
1857                 ret = compat_do_replace(sock_net(sk), user, len);
1858                 break;
1859
1860         case IPT_SO_SET_ADD_COUNTERS:
1861                 ret = do_add_counters(sock_net(sk), user, len, 1);
1862                 break;
1863
1864         default:
1865                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
1866                 ret = -EINVAL;
1867         }
1868
1869         return ret;
1870 }
1871
1872 struct compat_ipt_get_entries {
1873         char name[XT_TABLE_MAXNAMELEN];
1874         compat_uint_t size;
1875         struct compat_ipt_entry entrytable[0];
1876 };
1877
1878 static int
1879 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1880                             void __user *userptr)
1881 {
1882         struct xt_counters *counters;
1883         const struct xt_table_info *private = table->private;
1884         void __user *pos;
1885         unsigned int size;
1886         int ret = 0;
1887         const void *loc_cpu_entry;
1888         unsigned int i = 0;
1889         struct ipt_entry *iter;
1890
1891         counters = alloc_counters(table);
1892         if (IS_ERR(counters))
1893                 return PTR_ERR(counters);
1894
1895         /* choose the copy that is on our node/cpu, ...
1896          * This choice is lazy (because current thread is
1897          * allowed to migrate to another cpu)
1898          */
1899         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1900         pos = userptr;
1901         size = total_size;
1902         xt_entry_foreach(iter, loc_cpu_entry, total_size) {
1903                 ret = compat_copy_entry_to_user(iter, &pos,
1904                                                 &size, counters, i++);
1905                 if (ret != 0)
1906                         break;
1907         }
1908
1909         vfree(counters);
1910         return ret;
1911 }
1912
1913 static int
1914 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1915                    int *len)
1916 {
1917         int ret;
1918         struct compat_ipt_get_entries get;
1919         struct xt_table *t;
1920
1921         if (*len < sizeof(get)) {
1922                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1923                 return -EINVAL;
1924         }
1925
1926         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1927                 return -EFAULT;
1928
1929         if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1930                 duprintf("compat_get_entries: %u != %zu\n",
1931                          *len, sizeof(get) + get.size);
1932                 return -EINVAL;
1933         }
1934
1935         xt_compat_lock(AF_INET);
1936         t = xt_find_table_lock(net, AF_INET, get.name);
1937         if (t && !IS_ERR(t)) {
1938                 const struct xt_table_info *private = t->private;
1939                 struct xt_table_info info;
1940                 duprintf("t->private->number = %u\n", private->number);
1941                 ret = compat_table_info(private, &info);
1942                 if (!ret && get.size == info.size) {
1943                         ret = compat_copy_entries_to_user(private->size,
1944                                                           t, uptr->entrytable);
1945                 } else if (!ret) {
1946                         duprintf("compat_get_entries: I've got %u not %u!\n",
1947                                  private->size, get.size);
1948                         ret = -EAGAIN;
1949                 }
1950                 xt_compat_flush_offsets(AF_INET);
1951                 module_put(t->me);
1952                 xt_table_unlock(t);
1953         } else
1954                 ret = t ? PTR_ERR(t) : -ENOENT;
1955
1956         xt_compat_unlock(AF_INET);
1957         return ret;
1958 }
1959
1960 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
1961
1962 static int
1963 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1964 {
1965         int ret;
1966
1967         if (!capable(CAP_NET_ADMIN))
1968                 return -EPERM;
1969
1970         switch (cmd) {
1971         case IPT_SO_GET_INFO:
1972                 ret = get_info(sock_net(sk), user, len, 1);
1973                 break;
1974         case IPT_SO_GET_ENTRIES:
1975                 ret = compat_get_entries(sock_net(sk), user, len);
1976                 break;
1977         default:
1978                 ret = do_ipt_get_ctl(sk, cmd, user, len);
1979         }
1980         return ret;
1981 }
1982 #endif
1983
1984 static int
1985 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1986 {
1987         int ret;
1988
1989         if (!capable(CAP_NET_ADMIN))
1990                 return -EPERM;
1991
1992         switch (cmd) {
1993         case IPT_SO_SET_REPLACE:
1994                 ret = do_replace(sock_net(sk), user, len);
1995                 break;
1996
1997         case IPT_SO_SET_ADD_COUNTERS:
1998                 ret = do_add_counters(sock_net(sk), user, len, 0);
1999                 break;
2000
2001         default:
2002                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
2003                 ret = -EINVAL;
2004         }
2005
2006         return ret;
2007 }
2008
2009 static int
2010 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2011 {
2012         int ret;
2013
2014         if (!capable(CAP_NET_ADMIN))
2015                 return -EPERM;
2016
2017         switch (cmd) {
2018         case IPT_SO_GET_INFO:
2019                 ret = get_info(sock_net(sk), user, len, 0);
2020                 break;
2021
2022         case IPT_SO_GET_ENTRIES:
2023                 ret = get_entries(sock_net(sk), user, len);
2024                 break;
2025
2026         case IPT_SO_GET_REVISION_MATCH:
2027         case IPT_SO_GET_REVISION_TARGET: {
2028                 struct xt_get_revision rev;
2029                 int target;
2030
2031                 if (*len != sizeof(rev)) {
2032                         ret = -EINVAL;
2033                         break;
2034                 }
2035                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2036                         ret = -EFAULT;
2037                         break;
2038                 }
2039
2040                 if (cmd == IPT_SO_GET_REVISION_TARGET)
2041                         target = 1;
2042                 else
2043                         target = 0;
2044
2045                 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2046                                                          rev.revision,
2047                                                          target, &ret),
2048                                         "ipt_%s", rev.name);
2049                 break;
2050         }
2051
2052         default:
2053                 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2054                 ret = -EINVAL;
2055         }
2056
2057         return ret;
2058 }
2059
2060 struct xt_table *ipt_register_table(struct net *net,
2061                                     const struct xt_table *table,
2062                                     const struct ipt_replace *repl)
2063 {
2064         int ret;
2065         struct xt_table_info *newinfo;
2066         struct xt_table_info bootstrap = {0};
2067         void *loc_cpu_entry;
2068         struct xt_table *new_table;
2069
2070         newinfo = xt_alloc_table_info(repl->size);
2071         if (!newinfo) {
2072                 ret = -ENOMEM;
2073                 goto out;
2074         }
2075
2076         /* choose the copy on our node/cpu, but dont care about preemption */
2077         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2078         memcpy(loc_cpu_entry, repl->entries, repl->size);
2079
2080         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2081         if (ret != 0)
2082                 goto out_free;
2083
2084         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2085         if (IS_ERR(new_table)) {
2086                 ret = PTR_ERR(new_table);
2087                 goto out_free;
2088         }
2089
2090         return new_table;
2091
2092 out_free:
2093         xt_free_table_info(newinfo);
2094 out:
2095         return ERR_PTR(ret);
2096 }
2097
2098 void ipt_unregister_table(struct net *net, struct xt_table *table)
2099 {
2100         struct xt_table_info *private;
2101         void *loc_cpu_entry;
2102         struct module *table_owner = table->me;
2103         struct ipt_entry *iter;
2104
2105         private = xt_unregister_table(table);
2106
2107         /* Decrease module usage counts and free resources */
2108         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2109         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2110                 cleanup_entry(iter, net);
2111         if (private->number > private->initial_entries)
2112                 module_put(table_owner);
2113         xt_free_table_info(private);
2114 }
2115
2116 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2117 static inline bool
2118 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2119                      u_int8_t type, u_int8_t code,
2120                      bool invert)
2121 {
2122         return ((test_type == 0xFF) ||
2123                 (type == test_type && code >= min_code && code <= max_code))
2124                 ^ invert;
2125 }
2126
2127 static bool
2128 icmp_match(const struct sk_buff *skb, struct xt_action_param *par)
2129 {
2130         const struct icmphdr *ic;
2131         struct icmphdr _icmph;
2132         const struct ipt_icmp *icmpinfo = par->matchinfo;
2133
2134         /* Must not be a fragment. */
2135         if (par->fragoff != 0)
2136                 return false;
2137
2138         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2139         if (ic == NULL) {
2140                 /* We've been asked to examine this packet, and we
2141                  * can't.  Hence, no choice but to drop.
2142                  */
2143                 duprintf("Dropping evil ICMP tinygram.\n");
2144                 par->hotdrop = true;
2145                 return false;
2146         }
2147
2148         return icmp_type_code_match(icmpinfo->type,
2149                                     icmpinfo->code[0],
2150                                     icmpinfo->code[1],
2151                                     ic->type, ic->code,
2152                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
2153 }
2154
2155 static int icmp_checkentry(const struct xt_mtchk_param *par)
2156 {
2157         const struct ipt_icmp *icmpinfo = par->matchinfo;
2158
2159         /* Must specify no unknown invflags */
2160         return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
2161 }
2162
2163 static struct xt_target ipt_builtin_tg[] __read_mostly = {
2164         {
2165                 .name             = XT_STANDARD_TARGET,
2166                 .targetsize       = sizeof(int),
2167                 .family           = NFPROTO_IPV4,
2168 #ifdef CONFIG_COMPAT
2169                 .compatsize       = sizeof(compat_int_t),
2170                 .compat_from_user = compat_standard_from_user,
2171                 .compat_to_user   = compat_standard_to_user,
2172 #endif
2173         },
2174         {
2175                 .name             = XT_ERROR_TARGET,
2176                 .target           = ipt_error,
2177                 .targetsize       = XT_FUNCTION_MAXNAMELEN,
2178                 .family           = NFPROTO_IPV4,
2179         },
2180 };
2181
2182 static struct nf_sockopt_ops ipt_sockopts = {
2183         .pf             = PF_INET,
2184         .set_optmin     = IPT_BASE_CTL,
2185         .set_optmax     = IPT_SO_SET_MAX+1,
2186         .set            = do_ipt_set_ctl,
2187 #ifdef CONFIG_COMPAT
2188         .compat_set     = compat_do_ipt_set_ctl,
2189 #endif
2190         .get_optmin     = IPT_BASE_CTL,
2191         .get_optmax     = IPT_SO_GET_MAX+1,
2192         .get            = do_ipt_get_ctl,
2193 #ifdef CONFIG_COMPAT
2194         .compat_get     = compat_do_ipt_get_ctl,
2195 #endif
2196         .owner          = THIS_MODULE,
2197 };
2198
2199 static struct xt_match ipt_builtin_mt[] __read_mostly = {
2200         {
2201                 .name       = "icmp",
2202                 .match      = icmp_match,
2203                 .matchsize  = sizeof(struct ipt_icmp),
2204                 .checkentry = icmp_checkentry,
2205                 .proto      = IPPROTO_ICMP,
2206                 .family     = NFPROTO_IPV4,
2207         },
2208 };
2209
2210 static int __net_init ip_tables_net_init(struct net *net)
2211 {
2212         return xt_proto_init(net, NFPROTO_IPV4);
2213 }
2214
2215 static void __net_exit ip_tables_net_exit(struct net *net)
2216 {
2217         xt_proto_fini(net, NFPROTO_IPV4);
2218 }
2219
2220 static struct pernet_operations ip_tables_net_ops = {
2221         .init = ip_tables_net_init,
2222         .exit = ip_tables_net_exit,
2223 };
2224
2225 static int __init ip_tables_init(void)
2226 {
2227         int ret;
2228
2229         ret = register_pernet_subsys(&ip_tables_net_ops);
2230         if (ret < 0)
2231                 goto err1;
2232
2233         /* Noone else will be downing sem now, so we won't sleep */
2234         ret = xt_register_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2235         if (ret < 0)
2236                 goto err2;
2237         ret = xt_register_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2238         if (ret < 0)
2239                 goto err4;
2240
2241         /* Register setsockopt */
2242         ret = nf_register_sockopt(&ipt_sockopts);
2243         if (ret < 0)
2244                 goto err5;
2245
2246         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2247         return 0;
2248
2249 err5:
2250         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2251 err4:
2252         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2253 err2:
2254         unregister_pernet_subsys(&ip_tables_net_ops);
2255 err1:
2256         return ret;
2257 }
2258
2259 static void __exit ip_tables_fini(void)
2260 {
2261         nf_unregister_sockopt(&ipt_sockopts);
2262
2263         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2264         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2265         unregister_pernet_subsys(&ip_tables_net_ops);
2266 }
2267
2268 EXPORT_SYMBOL(ipt_register_table);
2269 EXPORT_SYMBOL(ipt_unregister_table);
2270 EXPORT_SYMBOL(ipt_do_table);
2271 module_init(ip_tables_init);
2272 module_exit(ip_tables_fini);