net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11
  12 #include <linux/capability.h>
  13 #include <linux/in.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/kmod.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/poison.h>
  20 #include <linux/icmpv6.h>
  21 #include <net/ipv6.h>
  22 #include <asm/uaccess.h>
  23 #include <linux/mutex.h>
  24 #include <linux/proc_fs.h>
  25 #include <linux/cpumask.h>
  26
  27 #include <linux/netfilter_ipv6/ip6_tables.h>
  28 #include <linux/netfilter/x_tables.h>
  29
  30 MODULE_LICENSE("GPL");
  31 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  32 MODULE_DESCRIPTION("IPv6 packet filter");
  33
  34 #define IPV6_HDR_LEN    (sizeof(struct ipv6hdr))
  35 #define IPV6_OPTHDR_LEN (sizeof(struct ipv6_opt_hdr))
  36
  37 /*#define DEBUG_IP_FIREWALL*/
  38 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  39 /*#define DEBUG_IP_FIREWALL_USER*/
  40
  41 #ifdef DEBUG_IP_FIREWALL
  42 #define dprintf(format, args...)  printk(format , ## args)
  43 #else
  44 #define dprintf(format, args...)
  45 #endif
  46
  47 #ifdef DEBUG_IP_FIREWALL_USER
  48 #define duprintf(format, args...) printk(format , ## args)
  49 #else
  50 #define duprintf(format, args...)
  51 #endif
  52
  53 #ifdef CONFIG_NETFILTER_DEBUG
  54 #define IP_NF_ASSERT(x)                                         \
  55 do {                                                            \
  56         if (!(x))                                               \
  57                 printk("IP_NF_ASSERT: %s:%s:%u\n",              \
  58                        __FUNCTION__, __FILE__, __LINE__);       \
  59 } while(0)
  60 #else
  61 #define IP_NF_ASSERT(x)
  62 #endif
  63
  64 #if 0
  65 /* All the better to debug you with... */
  66 #define static
  67 #define inline
  68 #endif
  69
  70 /*
  71    We keep a set of rules for each CPU, so we can avoid write-locking
  72    them in the softirq when updating the counters and therefore
  73    only need to read-lock in the softirq; doing a write_lock_bh() in user
  74    context stops packets coming through and allows user context to read
  75    the counters or update the rules.
  76
  77    Hence the start of any table is given by get_table() below.  */
  78
  79 #if 0
  80 #define down(x) do { printk("DOWN:%u:" #x "\n", __LINE__); down(x); } while(0)
  81 #define down_interruptible(x) ({ int __r; printk("DOWNi:%u:" #x "\n", __LINE__); __r = down_interruptible(x); if (__r != 0) printk("ABORT-DOWNi:%u\n", __LINE__); __r; })
  82 #define up(x) do { printk("UP:%u:" #x "\n", __LINE__); up(x); } while(0)
  83 #endif
  84
  85 /* Check for an extension */
  86 int
  87 ip6t_ext_hdr(u8 nexthdr)
  88 {
  89         return ( (nexthdr == IPPROTO_HOPOPTS)   ||
  90                  (nexthdr == IPPROTO_ROUTING)   ||
  91                  (nexthdr == IPPROTO_FRAGMENT)  ||
  92                  (nexthdr == IPPROTO_ESP)       ||
  93                  (nexthdr == IPPROTO_AH)        ||
  94                  (nexthdr == IPPROTO_NONE)      ||
  95                  (nexthdr == IPPROTO_DSTOPTS) );
  96 }
  97
  98 /* Returns whether matches rule or not. */
  99 static inline int
 100 ip6_packet_match(const struct sk_buff *skb,
 101                  const char *indev,
 102                  const char *outdev,
 103                  const struct ip6t_ip6 *ip6info,
 104                  unsigned int *protoff,
 105                  int *fragoff, int *hotdrop)
 106 {
 107         size_t i;
 108         unsigned long ret;
 109         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
 110
 111 #define FWINV(bool,invflg) ((bool) ^ !!(ip6info->invflags & invflg))
 112
 113         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 114                                        &ip6info->src), IP6T_INV_SRCIP)
 115             || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 116                                           &ip6info->dst), IP6T_INV_DSTIP)) {
 117                 dprintf("Source or dest mismatch.\n");
 118 /*
 119                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 120                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 121                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 122                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 123                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 124                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 125                 return 0;
 126         }
 127
 128         /* Look for ifname matches; this should unroll nicely. */
 129         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
 130                 ret |= (((const unsigned long *)indev)[i]
 131                         ^ ((const unsigned long *)ip6info->iniface)[i])
 132                         & ((const unsigned long *)ip6info->iniface_mask)[i];
 133         }
 134
 135         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 136                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 137                         indev, ip6info->iniface,
 138                         ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
 139                 return 0;
 140         }
 141
 142         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
 143                 ret |= (((const unsigned long *)outdev)[i]
 144                         ^ ((const unsigned long *)ip6info->outiface)[i])
 145                         & ((const unsigned long *)ip6info->outiface_mask)[i];
 146         }
 147
 148         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 149                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 150                         outdev, ip6info->outiface,
 151                         ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
 152                 return 0;
 153         }
 154
 155 /* ... might want to do something with class and flowlabel here ... */
 156
 157         /* look for the desired protocol header */
 158         if((ip6info->flags & IP6T_F_PROTO)) {
 159                 int protohdr;
 160                 unsigned short _frag_off;
 161
 162                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
 163                 if (protohdr < 0) {
 164                         if (_frag_off == 0)
 165                                 *hotdrop = 1;
 166                         return 0;
 167                 }
 168                 *fragoff = _frag_off;
 169
 170                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 171                                 protohdr,
 172                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 173                                 ip6info->proto);
 174
 175                 if (ip6info->proto == protohdr) {
 176                         if(ip6info->invflags & IP6T_INV_PROTO) {
 177                                 return 0;
 178                         }
 179                         return 1;
 180                 }
 181
 182                 /* We need match for the '-p all', too! */
 183                 if ((ip6info->proto != 0) &&
 184                         !(ip6info->invflags & IP6T_INV_PROTO))
 185                         return 0;
 186         }
 187         return 1;
 188 }
 189
 190 /* should be ip6 safe */
 191 static inline int
 192 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 193 {
 194         if (ipv6->flags & ~IP6T_F_MASK) {
 195                 duprintf("Unknown flag bits set: %08X\n",
 196                          ipv6->flags & ~IP6T_F_MASK);
 197                 return 0;
 198         }
 199         if (ipv6->invflags & ~IP6T_INV_MASK) {
 200                 duprintf("Unknown invflag bits set: %08X\n",
 201                          ipv6->invflags & ~IP6T_INV_MASK);
 202                 return 0;
 203         }
 204         return 1;
 205 }
 206
 207 static unsigned int
 208 ip6t_error(struct sk_buff **pskb,
 209           const struct net_device *in,
 210           const struct net_device *out,
 211           unsigned int hooknum,
 212           const struct xt_target *target,
 213           const void *targinfo)
 214 {
 215         if (net_ratelimit())
 216                 printk("ip6_tables: error: `%s'\n", (char *)targinfo);
 217
 218         return NF_DROP;
 219 }
 220
 221 static inline
 222 int do_match(struct ip6t_entry_match *m,
 223              const struct sk_buff *skb,
 224              const struct net_device *in,
 225              const struct net_device *out,
 226              int offset,
 227              unsigned int protoff,
 228              int *hotdrop)
 229 {
 230         /* Stop iteration if it doesn't match */
 231         if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
 232                                       offset, protoff, hotdrop))
 233                 return 1;
 234         else
 235                 return 0;
 236 }
 237
 238 static inline struct ip6t_entry *
 239 get_entry(void *base, unsigned int offset)
 240 {
 241         return (struct ip6t_entry *)(base + offset);
 242 }
 243
 244 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 245 unsigned int
 246 ip6t_do_table(struct sk_buff **pskb,
 247               unsigned int hook,
 248               const struct net_device *in,
 249               const struct net_device *out,
 250               struct xt_table *table)
 251 {
 252         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 253         int offset = 0;
 254         unsigned int protoff = 0;
 255         int hotdrop = 0;
 256         /* Initializing verdict to NF_DROP keeps gcc happy. */
 257         unsigned int verdict = NF_DROP;
 258         const char *indev, *outdev;
 259         void *table_base;
 260         struct ip6t_entry *e, *back;
 261         struct xt_table_info *private;
 262
 263         /* Initialization */
 264         indev = in ? in->name : nulldevname;
 265         outdev = out ? out->name : nulldevname;
 266         /* We handle fragments by dealing with the first fragment as
 267          * if it was a normal packet.  All other fragments are treated
 268          * normally, except that they will NEVER match rules that ask
 269          * things we don't know, ie. tcp syn flag or ports).  If the
 270          * rule is also a fragment-specific rule, non-fragments won't
 271          * match it. */
 272
 273         read_lock_bh(&table->lock);
 274         private = table->private;
 275         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 276         table_base = (void *)private->entries[smp_processor_id()];
 277         e = get_entry(table_base, private->hook_entry[hook]);
 278
 279         /* For return from builtin chain */
 280         back = get_entry(table_base, private->underflow[hook]);
 281
 282         do {
 283                 IP_NF_ASSERT(e);
 284                 IP_NF_ASSERT(back);
 285                 if (ip6_packet_match(*pskb, indev, outdev, &e->ipv6,
 286                         &protoff, &offset, &hotdrop)) {
 287                         struct ip6t_entry_target *t;
 288
 289                         if (IP6T_MATCH_ITERATE(e, do_match,
 290                                                *pskb, in, out,
 291                                                offset, protoff, &hotdrop) != 0)
 292                                 goto no_match;
 293
 294                         ADD_COUNTER(e->counters,
 295                                     ntohs(ipv6_hdr(*pskb)->payload_len)
 296                                     + IPV6_HDR_LEN,
 297                                     1);
 298
 299                         t = ip6t_get_target(e);
 300                         IP_NF_ASSERT(t->u.kernel.target);
 301                         /* Standard target? */
 302                         if (!t->u.kernel.target->target) {
 303                                 int v;
 304
 305                                 v = ((struct ip6t_standard_target *)t)->verdict;
 306                                 if (v < 0) {
 307                                         /* Pop from stack? */
 308                                         if (v != IP6T_RETURN) {
 309                                                 verdict = (unsigned)(-v) - 1;
 310                                                 break;
 311                                         }
 312                                         e = back;
 313                                         back = get_entry(table_base,
 314                                                          back->comefrom);
 315                                         continue;
 316                                 }
 317                                 if (table_base + v != (void *)e + e->next_offset
 318                                     && !(e->ipv6.flags & IP6T_F_GOTO)) {
 319                                         /* Save old back ptr in next entry */
 320                                         struct ip6t_entry *next
 321                                                 = (void *)e + e->next_offset;
 322                                         next->comefrom
 323                                                 = (void *)back - table_base;
 324                                         /* set back pointer to next entry */
 325                                         back = next;
 326                                 }
 327
 328                                 e = get_entry(table_base, v);
 329                         } else {
 330                                 /* Targets which reenter must return
 331                                    abs. verdicts */
 332 #ifdef CONFIG_NETFILTER_DEBUG
 333                                 ((struct ip6t_entry *)table_base)->comefrom
 334                                         = 0xeeeeeeec;
 335 #endif
 336                                 verdict = t->u.kernel.target->target(pskb,
 337                                                                      in, out,
 338                                                                      hook,
 339                                                                      t->u.kernel.target,
 340                                                                      t->data);
 341
 342 #ifdef CONFIG_NETFILTER_DEBUG
 343                                 if (((struct ip6t_entry *)table_base)->comefrom
 344                                     != 0xeeeeeeec
 345                                     && verdict == IP6T_CONTINUE) {
 346                                         printk("Target %s reentered!\n",
 347                                                t->u.kernel.target->name);
 348                                         verdict = NF_DROP;
 349                                 }
 350                                 ((struct ip6t_entry *)table_base)->comefrom
 351                                         = 0x57acc001;
 352 #endif
 353                                 if (verdict == IP6T_CONTINUE)
 354                                         e = (void *)e + e->next_offset;
 355                                 else
 356                                         /* Verdict */
 357                                         break;
 358                         }
 359                 } else {
 360
 361                 no_match:
 362                         e = (void *)e + e->next_offset;
 363                 }
 364         } while (!hotdrop);
 365
 366 #ifdef CONFIG_NETFILTER_DEBUG
 367         ((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON;
 368 #endif
 369         read_unlock_bh(&table->lock);
 370
 371 #ifdef DEBUG_ALLOW_ALL
 372         return NF_ACCEPT;
 373 #else
 374         if (hotdrop)
 375                 return NF_DROP;
 376         else return verdict;
 377 #endif
 378 }
 379
 380 /* All zeroes == unconditional rule. */
 381 static inline int
 382 unconditional(const struct ip6t_ip6 *ipv6)
 383 {
 384         unsigned int i;
 385
 386         for (i = 0; i < sizeof(*ipv6); i++)
 387                 if (((char *)ipv6)[i])
 388                         break;
 389
 390         return (i == sizeof(*ipv6));
 391 }
 392
 393 /* Figures out from what hook each rule can be called: returns 0 if
 394    there are loops.  Puts hook bitmask in comefrom. */
 395 static int
 396 mark_source_chains(struct xt_table_info *newinfo,
 397                    unsigned int valid_hooks, void *entry0)
 398 {
 399         unsigned int hook;
 400
 401         /* No recursion; use packet counter to save back ptrs (reset
 402            to 0 as we leave), and comefrom to save source hook bitmask */
 403         for (hook = 0; hook < NF_IP6_NUMHOOKS; hook++) {
 404                 unsigned int pos = newinfo->hook_entry[hook];
 405                 struct ip6t_entry *e
 406                         = (struct ip6t_entry *)(entry0 + pos);
 407                 int visited = e->comefrom & (1 << hook);
 408
 409                 if (!(valid_hooks & (1 << hook)))
 410                         continue;
 411
 412                 /* Set initial back pointer. */
 413                 e->counters.pcnt = pos;
 414
 415                 for (;;) {
 416                         struct ip6t_standard_target *t
 417                                 = (void *)ip6t_get_target(e);
 418
 419                         if (e->comefrom & (1 << NF_IP6_NUMHOOKS)) {
 420                                 printk("iptables: loop hook %u pos %u %08X.\n",
 421                                        hook, pos, e->comefrom);
 422                                 return 0;
 423                         }
 424                         e->comefrom
 425                                 |= ((1 << hook) | (1 << NF_IP6_NUMHOOKS));
 426
 427                         /* Unconditional return/END. */
 428                         if ((e->target_offset == sizeof(struct ip6t_entry)
 429                             && (strcmp(t->target.u.user.name,
 430                                        IP6T_STANDARD_TARGET) == 0)
 431                             && t->verdict < 0
 432                             && unconditional(&e->ipv6)) || visited) {
 433                                 unsigned int oldpos, size;
 434
 435                                 if (t->verdict < -NF_MAX_VERDICT - 1) {
 436                                         duprintf("mark_source_chains: bad "
 437                                                 "negative verdict (%i)\n",
 438                                                                 t->verdict);
 439                                         return 0;
 440                                 }
 441
 442                                 /* Return: backtrack through the last
 443                                    big jump. */
 444                                 do {
 445                                         e->comefrom ^= (1<<NF_IP6_NUMHOOKS);
 446 #ifdef DEBUG_IP_FIREWALL_USER
 447                                         if (e->comefrom
 448                                             & (1 << NF_IP6_NUMHOOKS)) {
 449                                                 duprintf("Back unset "
 450                                                          "on hook %u "
 451                                                          "rule %u\n",
 452                                                          hook, pos);
 453                                         }
 454 #endif
 455                                         oldpos = pos;
 456                                         pos = e->counters.pcnt;
 457                                         e->counters.pcnt = 0;
 458
 459                                         /* We're at the start. */
 460                                         if (pos == oldpos)
 461                                                 goto next;
 462
 463                                         e = (struct ip6t_entry *)
 464                                                 (entry0 + pos);
 465                                 } while (oldpos == pos + e->next_offset);
 466
 467                                 /* Move along one */
 468                                 size = e->next_offset;
 469                                 e = (struct ip6t_entry *)
 470                                         (entry0 + pos + size);
 471                                 e->counters.pcnt = pos;
 472                                 pos += size;
 473                         } else {
 474                                 int newpos = t->verdict;
 475
 476                                 if (strcmp(t->target.u.user.name,
 477                                            IP6T_STANDARD_TARGET) == 0
 478                                     && newpos >= 0) {
 479                                         if (newpos > newinfo->size -
 480                                                 sizeof(struct ip6t_entry)) {
 481                                                 duprintf("mark_source_chains: "
 482                                                         "bad verdict (%i)\n",
 483                                                                 newpos);
 484                                                 return 0;
 485                                         }
 486                                         /* This a jump; chase it. */
 487                                         duprintf("Jump rule %u -> %u\n",
 488                                                  pos, newpos);
 489                                 } else {
 490                                         /* ... this is a fallthru */
 491                                         newpos = pos + e->next_offset;
 492                                 }
 493                                 e = (struct ip6t_entry *)
 494                                         (entry0 + newpos);
 495                                 e->counters.pcnt = pos;
 496                                 pos = newpos;
 497                         }
 498                 }
 499                 next:
 500                 duprintf("Finished chain %u\n", hook);
 501         }
 502         return 1;
 503 }
 504
 505 static inline int
 506 cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
 507 {
 508         if (i && (*i)-- == 0)
 509                 return 1;
 510
 511         if (m->u.kernel.match->destroy)
 512                 m->u.kernel.match->destroy(m->u.kernel.match, m->data);
 513         module_put(m->u.kernel.match->me);
 514         return 0;
 515 }
 516
 517 static inline int
 518 check_match(struct ip6t_entry_match *m,
 519             const char *name,
 520             const struct ip6t_ip6 *ipv6,
 521             unsigned int hookmask,
 522             unsigned int *i)
 523 {
 524         struct xt_match *match;
 525         int ret;
 526
 527         match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
 528                                         m->u.user.revision),
 529                                         "ip6t_%s", m->u.user.name);
 530         if (IS_ERR(match) || !match) {
 531                 duprintf("check_match: `%s' not found\n", m->u.user.name);
 532                 return match ? PTR_ERR(match) : -ENOENT;
 533         }
 534         m->u.kernel.match = match;
 535
 536         ret = xt_check_match(match, AF_INET6, m->u.match_size - sizeof(*m),
 537                              name, hookmask, ipv6->proto,
 538                              ipv6->invflags & IP6T_INV_PROTO);
 539         if (ret)
 540                 goto err;
 541
 542         if (m->u.kernel.match->checkentry
 543             && !m->u.kernel.match->checkentry(name, ipv6, match,  m->data,
 544                                               hookmask)) {
 545                 duprintf("ip_tables: check failed for `%s'.\n",
 546                          m->u.kernel.match->name);
 547                 ret = -EINVAL;
 548                 goto err;
 549         }
 550
 551         (*i)++;
 552         return 0;
 553 err:
 554         module_put(m->u.kernel.match->me);
 555         return ret;
 556 }
 557
 558 static struct xt_target ip6t_standard_target;
 559
 560 static inline int
 561 check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
 562             unsigned int *i)
 563 {
 564         struct ip6t_entry_target *t;
 565         struct xt_target *target;
 566         int ret;
 567         unsigned int j;
 568
 569         if (!ip6_checkentry(&e->ipv6)) {
 570                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 571                 return -EINVAL;
 572         }
 573
 574         if (e->target_offset + sizeof(struct ip6t_entry_target) >
 575                                                                 e->next_offset)
 576                 return -EINVAL;
 577
 578         j = 0;
 579         ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6, e->comefrom, &j);
 580         if (ret != 0)
 581                 goto cleanup_matches;
 582
 583         t = ip6t_get_target(e);
 584         ret = -EINVAL;
 585         if (e->target_offset + t->u.target_size > e->next_offset)
 586                         goto cleanup_matches;
 587         target = try_then_request_module(xt_find_target(AF_INET6,
 588                                                         t->u.user.name,
 589                                                         t->u.user.revision),
 590                                          "ip6t_%s", t->u.user.name);
 591         if (IS_ERR(target) || !target) {
 592                 duprintf("check_entry: `%s' not found\n", t->u.user.name);
 593                 ret = target ? PTR_ERR(target) : -ENOENT;
 594                 goto cleanup_matches;
 595         }
 596         t->u.kernel.target = target;
 597
 598         ret = xt_check_target(target, AF_INET6, t->u.target_size - sizeof(*t),
 599                               name, e->comefrom, e->ipv6.proto,
 600                               e->ipv6.invflags & IP6T_INV_PROTO);
 601         if (ret)
 602                 goto err;
 603
 604         if (t->u.kernel.target->checkentry
 605                    && !t->u.kernel.target->checkentry(name, e, target, t->data,
 606                                                       e->comefrom)) {
 607                 duprintf("ip_tables: check failed for `%s'.\n",
 608                          t->u.kernel.target->name);
 609                 ret = -EINVAL;
 610                 goto err;
 611         }
 612
 613         (*i)++;
 614         return 0;
 615  err:
 616         module_put(t->u.kernel.target->me);
 617  cleanup_matches:
 618         IP6T_MATCH_ITERATE(e, cleanup_match, &j);
 619         return ret;
 620 }
 621
 622 static inline int
 623 check_entry_size_and_hooks(struct ip6t_entry *e,
 624                            struct xt_table_info *newinfo,
 625                            unsigned char *base,
 626                            unsigned char *limit,
 627                            const unsigned int *hook_entries,
 628                            const unsigned int *underflows,
 629                            unsigned int *i)
 630 {
 631         unsigned int h;
 632
 633         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
 634             || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
 635                 duprintf("Bad offset %p\n", e);
 636                 return -EINVAL;
 637         }
 638
 639         if (e->next_offset
 640             < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
 641                 duprintf("checking: element %p size %u\n",
 642                          e, e->next_offset);
 643                 return -EINVAL;
 644         }
 645
 646         /* Check hooks & underflows */
 647         for (h = 0; h < NF_IP6_NUMHOOKS; h++) {
 648                 if ((unsigned char *)e - base == hook_entries[h])
 649                         newinfo->hook_entry[h] = hook_entries[h];
 650                 if ((unsigned char *)e - base == underflows[h])
 651                         newinfo->underflow[h] = underflows[h];
 652         }
 653
 654         /* FIXME: underflows must be unconditional, standard verdicts
 655            < 0 (not IP6T_RETURN). --RR */
 656
 657         /* Clear counters and comefrom */
 658         e->counters = ((struct xt_counters) { 0, 0 });
 659         e->comefrom = 0;
 660
 661         (*i)++;
 662         return 0;
 663 }
 664
 665 static inline int
 666 cleanup_entry(struct ip6t_entry *e, unsigned int *i)
 667 {
 668         struct ip6t_entry_target *t;
 669
 670         if (i && (*i)-- == 0)
 671                 return 1;
 672
 673         /* Cleanup all matches */
 674         IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
 675         t = ip6t_get_target(e);
 676         if (t->u.kernel.target->destroy)
 677                 t->u.kernel.target->destroy(t->u.kernel.target, t->data);
 678         module_put(t->u.kernel.target->me);
 679         return 0;
 680 }
 681
 682 /* Checks and translates the user-supplied table segment (held in
 683    newinfo) */
 684 static int
 685 translate_table(const char *name,
 686                 unsigned int valid_hooks,
 687                 struct xt_table_info *newinfo,
 688                 void *entry0,
 689                 unsigned int size,
 690                 unsigned int number,
 691                 const unsigned int *hook_entries,
 692                 const unsigned int *underflows)
 693 {
 694         unsigned int i;
 695         int ret;
 696
 697         newinfo->size = size;
 698         newinfo->number = number;
 699
 700         /* Init all hooks to impossible value. */
 701         for (i = 0; i < NF_IP6_NUMHOOKS; i++) {
 702                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 703                 newinfo->underflow[i] = 0xFFFFFFFF;
 704         }
 705
 706         duprintf("translate_table: size %u\n", newinfo->size);
 707         i = 0;
 708         /* Walk through entries, checking offsets. */
 709         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 710                                 check_entry_size_and_hooks,
 711                                 newinfo,
 712                                 entry0,
 713                                 entry0 + size,
 714                                 hook_entries, underflows, &i);
 715         if (ret != 0)
 716                 return ret;
 717
 718         if (i != number) {
 719                 duprintf("translate_table: %u not %u entries\n",
 720                          i, number);
 721                 return -EINVAL;
 722         }
 723
 724         /* Check hooks all assigned */
 725         for (i = 0; i < NF_IP6_NUMHOOKS; i++) {
 726                 /* Only hooks which are valid */
 727                 if (!(valid_hooks & (1 << i)))
 728                         continue;
 729                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 730                         duprintf("Invalid hook entry %u %u\n",
 731                                  i, hook_entries[i]);
 732                         return -EINVAL;
 733                 }
 734                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 735                         duprintf("Invalid underflow %u %u\n",
 736                                  i, underflows[i]);
 737                         return -EINVAL;
 738                 }
 739         }
 740
 741         if (!mark_source_chains(newinfo, valid_hooks, entry0))
 742                 return -ELOOP;
 743
 744         /* Finally, each sanity check must pass */
 745         i = 0;
 746         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 747                                 check_entry, name, size, &i);
 748
 749         if (ret != 0) {
 750                 IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 751                                    cleanup_entry, &i);
 752                 return ret;
 753         }
 754
 755         /* And one copy for every other CPU */
 756         for_each_possible_cpu(i) {
 757                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 758                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 759         }
 760
 761         return 0;
 762 }
 763
 764 /* Gets counters. */
 765 static inline int
 766 add_entry_to_counter(const struct ip6t_entry *e,
 767                      struct xt_counters total[],
 768                      unsigned int *i)
 769 {
 770         ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 771
 772         (*i)++;
 773         return 0;
 774 }
 775
 776 static inline int
 777 set_entry_to_counter(const struct ip6t_entry *e,
 778                      struct ip6t_counters total[],
 779                      unsigned int *i)
 780 {
 781         SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 782
 783         (*i)++;
 784         return 0;
 785 }
 786
 787 static void
 788 get_counters(const struct xt_table_info *t,
 789              struct xt_counters counters[])
 790 {
 791         unsigned int cpu;
 792         unsigned int i;
 793         unsigned int curcpu;
 794
 795         /* Instead of clearing (by a previous call to memset())
 796          * the counters and using adds, we set the counters
 797          * with data used by 'current' CPU
 798          * We dont care about preemption here.
 799          */
 800         curcpu = raw_smp_processor_id();
 801
 802         i = 0;
 803         IP6T_ENTRY_ITERATE(t->entries[curcpu],
 804                            t->size,
 805                            set_entry_to_counter,
 806                            counters,
 807                            &i);
 808
 809         for_each_possible_cpu(cpu) {
 810                 if (cpu == curcpu)
 811                         continue;
 812                 i = 0;
 813                 IP6T_ENTRY_ITERATE(t->entries[cpu],
 814                                   t->size,
 815                                   add_entry_to_counter,
 816                                   counters,
 817                                   &i);
 818         }
 819 }
 820
 821 static int
 822 copy_entries_to_user(unsigned int total_size,
 823                      struct xt_table *table,
 824                      void __user *userptr)
 825 {
 826         unsigned int off, num, countersize;
 827         struct ip6t_entry *e;
 828         struct xt_counters *counters;
 829         struct xt_table_info *private = table->private;
 830         int ret = 0;
 831         void *loc_cpu_entry;
 832
 833         /* We need atomic snapshot of counters: rest doesn't change
 834            (other than comefrom, which userspace doesn't care
 835            about). */
 836         countersize = sizeof(struct xt_counters) * private->number;
 837         counters = vmalloc(countersize);
 838
 839         if (counters == NULL)
 840                 return -ENOMEM;
 841
 842         /* First, sum counters... */
 843         write_lock_bh(&table->lock);
 844         get_counters(private, counters);
 845         write_unlock_bh(&table->lock);
 846
 847         /* choose the copy that is on ourc node/cpu */
 848         loc_cpu_entry = private->entries[raw_smp_processor_id()];
 849         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 850                 ret = -EFAULT;
 851                 goto free_counters;
 852         }
 853
 854         /* FIXME: use iterator macros --RR */
 855         /* ... then go back and fix counters and names */
 856         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 857                 unsigned int i;
 858                 struct ip6t_entry_match *m;
 859                 struct ip6t_entry_target *t;
 860
 861                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
 862                 if (copy_to_user(userptr + off
 863                                  + offsetof(struct ip6t_entry, counters),
 864                                  &counters[num],
 865                                  sizeof(counters[num])) != 0) {
 866                         ret = -EFAULT;
 867                         goto free_counters;
 868                 }
 869
 870                 for (i = sizeof(struct ip6t_entry);
 871                      i < e->target_offset;
 872                      i += m->u.match_size) {
 873                         m = (void *)e + i;
 874
 875                         if (copy_to_user(userptr + off + i
 876                                          + offsetof(struct ip6t_entry_match,
 877                                                     u.user.name),
 878                                          m->u.kernel.match->name,
 879                                          strlen(m->u.kernel.match->name)+1)
 880                             != 0) {
 881                                 ret = -EFAULT;
 882                                 goto free_counters;
 883                         }
 884                 }
 885
 886                 t = ip6t_get_target(e);
 887                 if (copy_to_user(userptr + off + e->target_offset
 888                                  + offsetof(struct ip6t_entry_target,
 889                                             u.user.name),
 890                                  t->u.kernel.target->name,
 891                                  strlen(t->u.kernel.target->name)+1) != 0) {
 892                         ret = -EFAULT;
 893                         goto free_counters;
 894                 }
 895         }
 896
 897  free_counters:
 898         vfree(counters);
 899         return ret;
 900 }
 901
 902 static int
 903 get_entries(const struct ip6t_get_entries *entries,
 904             struct ip6t_get_entries __user *uptr)
 905 {
 906         int ret;
 907         struct xt_table *t;
 908
 909         t = xt_find_table_lock(AF_INET6, entries->name);
 910         if (t && !IS_ERR(t)) {
 911                 struct xt_table_info *private = t->private;
 912                 duprintf("t->private->number = %u\n", private->number);
 913                 if (entries->size == private->size)
 914                         ret = copy_entries_to_user(private->size,
 915                                                    t, uptr->entrytable);
 916                 else {
 917                         duprintf("get_entries: I've got %u not %u!\n",
 918                                  private->size, entries->size);
 919                         ret = -EINVAL;
 920                 }
 921                 module_put(t->me);
 922                 xt_table_unlock(t);
 923         } else
 924                 ret = t ? PTR_ERR(t) : -ENOENT;
 925
 926         return ret;
 927 }
 928
 929 static int
 930 do_replace(void __user *user, unsigned int len)
 931 {
 932         int ret;
 933         struct ip6t_replace tmp;
 934         struct xt_table *t;
 935         struct xt_table_info *newinfo, *oldinfo;
 936         struct xt_counters *counters;
 937         void *loc_cpu_entry, *loc_cpu_old_entry;
 938
 939         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 940                 return -EFAULT;
 941
 942         /* overflow check */
 943         if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
 944                         SMP_CACHE_BYTES)
 945                 return -ENOMEM;
 946         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
 947                 return -ENOMEM;
 948
 949         newinfo = xt_alloc_table_info(tmp.size);
 950         if (!newinfo)
 951                 return -ENOMEM;
 952
 953         /* choose the copy that is on our node/cpu */
 954         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 955         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 956                            tmp.size) != 0) {
 957                 ret = -EFAULT;
 958                 goto free_newinfo;
 959         }
 960
 961         counters = vmalloc(tmp.num_counters * sizeof(struct xt_counters));
 962         if (!counters) {
 963                 ret = -ENOMEM;
 964                 goto free_newinfo;
 965         }
 966
 967         ret = translate_table(tmp.name, tmp.valid_hooks,
 968                               newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
 969                               tmp.hook_entry, tmp.underflow);
 970         if (ret != 0)
 971                 goto free_newinfo_counters;
 972
 973         duprintf("ip_tables: Translated table\n");
 974
 975         t = try_then_request_module(xt_find_table_lock(AF_INET6, tmp.name),
 976                                     "ip6table_%s", tmp.name);
 977         if (!t || IS_ERR(t)) {
 978                 ret = t ? PTR_ERR(t) : -ENOENT;
 979                 goto free_newinfo_counters_untrans;
 980         }
 981
 982         /* You lied! */
 983         if (tmp.valid_hooks != t->valid_hooks) {
 984                 duprintf("Valid hook crap: %08X vs %08X\n",
 985                          tmp.valid_hooks, t->valid_hooks);
 986                 ret = -EINVAL;
 987                 goto put_module;
 988         }
 989
 990         oldinfo = xt_replace_table(t, tmp.num_counters, newinfo, &ret);
 991         if (!oldinfo)
 992                 goto put_module;
 993
 994         /* Update module usage count based on number of rules */
 995         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
 996                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
 997         if ((oldinfo->number > oldinfo->initial_entries) ||
 998             (newinfo->number <= oldinfo->initial_entries))
 999                 module_put(t->me);
1000         if ((oldinfo->number > oldinfo->initial_entries) &&
1001             (newinfo->number <= oldinfo->initial_entries))
1002                 module_put(t->me);
1003
1004         /* Get the old counters. */
1005         get_counters(oldinfo, counters);
1006         /* Decrease module usage counts and free resource */
1007         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1008         IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
1009         xt_free_table_info(oldinfo);
1010         if (copy_to_user(tmp.counters, counters,
1011                          sizeof(struct xt_counters) * tmp.num_counters) != 0)
1012                 ret = -EFAULT;
1013         vfree(counters);
1014         xt_table_unlock(t);
1015         return ret;
1016
1017  put_module:
1018         module_put(t->me);
1019         xt_table_unlock(t);
1020  free_newinfo_counters_untrans:
1021         IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
1022  free_newinfo_counters:
1023         vfree(counters);
1024  free_newinfo:
1025         xt_free_table_info(newinfo);
1026         return ret;
1027 }
1028
1029 /* We're lazy, and add to the first CPU; overflow works its fey magic
1030  * and everything is OK. */
1031 static inline int
1032 add_counter_to_entry(struct ip6t_entry *e,
1033                      const struct xt_counters addme[],
1034                      unsigned int *i)
1035 {
1036 #if 0
1037         duprintf("add_counter: Entry %u %lu/%lu + %lu/%lu\n",
1038                  *i,
1039                  (long unsigned int)e->counters.pcnt,
1040                  (long unsigned int)e->counters.bcnt,
1041                  (long unsigned int)addme[*i].pcnt,
1042                  (long unsigned int)addme[*i].bcnt);
1043 #endif
1044
1045         ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1046
1047         (*i)++;
1048         return 0;
1049 }
1050
1051 static int
1052 do_add_counters(void __user *user, unsigned int len)
1053 {
1054         unsigned int i;
1055         struct xt_counters_info tmp, *paddc;
1056         struct xt_table_info *private;
1057         struct xt_table *t;
1058         int ret = 0;
1059         void *loc_cpu_entry;
1060
1061         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1062                 return -EFAULT;
1063
1064         if (len != sizeof(tmp) + tmp.num_counters*sizeof(struct xt_counters))
1065                 return -EINVAL;
1066
1067         paddc = vmalloc(len);
1068         if (!paddc)
1069                 return -ENOMEM;
1070
1071         if (copy_from_user(paddc, user, len) != 0) {
1072                 ret = -EFAULT;
1073                 goto free;
1074         }
1075
1076         t = xt_find_table_lock(AF_INET6, tmp.name);
1077         if (!t || IS_ERR(t)) {
1078                 ret = t ? PTR_ERR(t) : -ENOENT;
1079                 goto free;
1080         }
1081
1082         write_lock_bh(&t->lock);
1083         private = t->private;
1084         if (private->number != tmp.num_counters) {
1085                 ret = -EINVAL;
1086                 goto unlock_up_free;
1087         }
1088
1089         i = 0;
1090         /* Choose the copy that is on our node */
1091         loc_cpu_entry = private->entries[smp_processor_id()];
1092         IP6T_ENTRY_ITERATE(loc_cpu_entry,
1093                           private->size,
1094                           add_counter_to_entry,
1095                           paddc->counters,
1096                           &i);
1097  unlock_up_free:
1098         write_unlock_bh(&t->lock);
1099         xt_table_unlock(t);
1100         module_put(t->me);
1101  free:
1102         vfree(paddc);
1103
1104         return ret;
1105 }
1106
1107 static int
1108 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1109 {
1110         int ret;
1111
1112         if (!capable(CAP_NET_ADMIN))
1113                 return -EPERM;
1114
1115         switch (cmd) {
1116         case IP6T_SO_SET_REPLACE:
1117                 ret = do_replace(user, len);
1118                 break;
1119
1120         case IP6T_SO_SET_ADD_COUNTERS:
1121                 ret = do_add_counters(user, len);
1122                 break;
1123
1124         default:
1125                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1126                 ret = -EINVAL;
1127         }
1128
1129         return ret;
1130 }
1131
1132 static int
1133 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1134 {
1135         int ret;
1136
1137         if (!capable(CAP_NET_ADMIN))
1138                 return -EPERM;
1139
1140         switch (cmd) {
1141         case IP6T_SO_GET_INFO: {
1142                 char name[IP6T_TABLE_MAXNAMELEN];
1143                 struct xt_table *t;
1144
1145                 if (*len != sizeof(struct ip6t_getinfo)) {
1146                         duprintf("length %u != %u\n", *len,
1147                                  sizeof(struct ip6t_getinfo));
1148                         ret = -EINVAL;
1149                         break;
1150                 }
1151
1152                 if (copy_from_user(name, user, sizeof(name)) != 0) {
1153                         ret = -EFAULT;
1154                         break;
1155                 }
1156                 name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
1157
1158                 t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
1159                                             "ip6table_%s", name);
1160                 if (t && !IS_ERR(t)) {
1161                         struct ip6t_getinfo info;
1162                         struct xt_table_info *private = t->private;
1163
1164                         info.valid_hooks = t->valid_hooks;
1165                         memcpy(info.hook_entry, private->hook_entry,
1166                                sizeof(info.hook_entry));
1167                         memcpy(info.underflow, private->underflow,
1168                                sizeof(info.underflow));
1169                         info.num_entries = private->number;
1170                         info.size = private->size;
1171                         memcpy(info.name, name, sizeof(info.name));
1172
1173                         if (copy_to_user(user, &info, *len) != 0)
1174                                 ret = -EFAULT;
1175                         else
1176                                 ret = 0;
1177                         xt_table_unlock(t);
1178                         module_put(t->me);
1179                 } else
1180                         ret = t ? PTR_ERR(t) : -ENOENT;
1181         }
1182         break;
1183
1184         case IP6T_SO_GET_ENTRIES: {
1185                 struct ip6t_get_entries get;
1186
1187                 if (*len < sizeof(get)) {
1188                         duprintf("get_entries: %u < %u\n", *len, sizeof(get));
1189                         ret = -EINVAL;
1190                 } else if (copy_from_user(&get, user, sizeof(get)) != 0) {
1191                         ret = -EFAULT;
1192                 } else if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1193                         duprintf("get_entries: %u != %u\n", *len,
1194                                  sizeof(struct ip6t_get_entries) + get.size);
1195                         ret = -EINVAL;
1196                 } else
1197                         ret = get_entries(&get, user);
1198                 break;
1199         }
1200
1201         case IP6T_SO_GET_REVISION_MATCH:
1202         case IP6T_SO_GET_REVISION_TARGET: {
1203                 struct ip6t_get_revision rev;
1204                 int target;
1205
1206                 if (*len != sizeof(rev)) {
1207                         ret = -EINVAL;
1208                         break;
1209                 }
1210                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
1211                         ret = -EFAULT;
1212                         break;
1213                 }
1214
1215                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
1216                         target = 1;
1217                 else
1218                         target = 0;
1219
1220                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
1221                                                          rev.revision,
1222                                                          target, &ret),
1223                                         "ip6t_%s", rev.name);
1224                 break;
1225         }
1226
1227         default:
1228                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
1229                 ret = -EINVAL;
1230         }
1231
1232         return ret;
1233 }
1234
1235 int ip6t_register_table(struct xt_table *table,
1236                         const struct ip6t_replace *repl)
1237 {
1238         int ret;
1239         struct xt_table_info *newinfo;
1240         static struct xt_table_info bootstrap
1241                 = { 0, 0, 0, { 0 }, { 0 }, { } };
1242         void *loc_cpu_entry;
1243
1244         newinfo = xt_alloc_table_info(repl->size);
1245         if (!newinfo)
1246                 return -ENOMEM;
1247
1248         /* choose the copy on our node/cpu */
1249         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1250         memcpy(loc_cpu_entry, repl->entries, repl->size);
1251
1252         ret = translate_table(table->name, table->valid_hooks,
1253                               newinfo, loc_cpu_entry, repl->size,
1254                               repl->num_entries,
1255                               repl->hook_entry,
1256                               repl->underflow);
1257         if (ret != 0) {
1258                 xt_free_table_info(newinfo);
1259                 return ret;
1260         }
1261
1262         ret = xt_register_table(table, &bootstrap, newinfo);
1263         if (ret != 0) {
1264                 xt_free_table_info(newinfo);
1265                 return ret;
1266         }
1267
1268         return 0;
1269 }
1270
1271 void ip6t_unregister_table(struct xt_table *table)
1272 {
1273         struct xt_table_info *private;
1274         void *loc_cpu_entry;
1275
1276         private = xt_unregister_table(table);
1277
1278         /* Decrease module usage counts and free resources */
1279         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1280         IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
1281         xt_free_table_info(private);
1282 }
1283
1284 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
1285 static inline int
1286 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
1287                      u_int8_t type, u_int8_t code,
1288                      int invert)
1289 {
1290         return (type == test_type && code >= min_code && code <= max_code)
1291                 ^ invert;
1292 }
1293
1294 static int
1295 icmp6_match(const struct sk_buff *skb,
1296            const struct net_device *in,
1297            const struct net_device *out,
1298            const struct xt_match *match,
1299            const void *matchinfo,
1300            int offset,
1301            unsigned int protoff,
1302            int *hotdrop)
1303 {
1304         struct icmp6hdr _icmp, *ic;
1305         const struct ip6t_icmp *icmpinfo = matchinfo;
1306
1307         /* Must not be a fragment. */
1308         if (offset)
1309                 return 0;
1310
1311         ic = skb_header_pointer(skb, protoff, sizeof(_icmp), &_icmp);
1312         if (ic == NULL) {
1313                 /* We've been asked to examine this packet, and we
1314                    can't.  Hence, no choice but to drop. */
1315                 duprintf("Dropping evil ICMP tinygram.\n");
1316                 *hotdrop = 1;
1317                 return 0;
1318         }
1319
1320         return icmp6_type_code_match(icmpinfo->type,
1321                                      icmpinfo->code[0],
1322                                      icmpinfo->code[1],
1323                                      ic->icmp6_type, ic->icmp6_code,
1324                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
1325 }
1326
1327 /* Called when user tries to insert an entry of this type. */
1328 static int
1329 icmp6_checkentry(const char *tablename,
1330            const void *entry,
1331            const struct xt_match *match,
1332            void *matchinfo,
1333            unsigned int hook_mask)
1334 {
1335         const struct ip6t_icmp *icmpinfo = matchinfo;
1336
1337         /* Must specify no unknown invflags */
1338         return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
1339 }
1340
1341 /* The built-in targets: standard (NULL) and error. */
1342 static struct xt_target ip6t_standard_target = {
1343         .name           = IP6T_STANDARD_TARGET,
1344         .targetsize     = sizeof(int),
1345         .family         = AF_INET6,
1346 };
1347
1348 static struct xt_target ip6t_error_target = {
1349         .name           = IP6T_ERROR_TARGET,
1350         .target         = ip6t_error,
1351         .targetsize     = IP6T_FUNCTION_MAXNAMELEN,
1352         .family         = AF_INET6,
1353 };
1354
1355 static struct nf_sockopt_ops ip6t_sockopts = {
1356         .pf             = PF_INET6,
1357         .set_optmin     = IP6T_BASE_CTL,
1358         .set_optmax     = IP6T_SO_SET_MAX+1,
1359         .set            = do_ip6t_set_ctl,
1360         .get_optmin     = IP6T_BASE_CTL,
1361         .get_optmax     = IP6T_SO_GET_MAX+1,
1362         .get            = do_ip6t_get_ctl,
1363 };
1364
1365 static struct xt_match icmp6_matchstruct = {
1366         .name           = "icmp6",
1367         .match          = &icmp6_match,
1368         .matchsize      = sizeof(struct ip6t_icmp),
1369         .checkentry     = icmp6_checkentry,
1370         .proto          = IPPROTO_ICMPV6,
1371         .family         = AF_INET6,
1372 };
1373
1374 static int __init ip6_tables_init(void)
1375 {
1376         int ret;
1377
1378         ret = xt_proto_init(AF_INET6);
1379         if (ret < 0)
1380                 goto err1;
1381
1382         /* Noone else will be downing sem now, so we won't sleep */
1383         ret = xt_register_target(&ip6t_standard_target);
1384         if (ret < 0)
1385                 goto err2;
1386         ret = xt_register_target(&ip6t_error_target);
1387         if (ret < 0)
1388                 goto err3;
1389         ret = xt_register_match(&icmp6_matchstruct);
1390         if (ret < 0)
1391                 goto err4;
1392
1393         /* Register setsockopt */
1394         ret = nf_register_sockopt(&ip6t_sockopts);
1395         if (ret < 0)
1396                 goto err5;
1397
1398         printk("ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
1399         return 0;
1400
1401 err5:
1402         xt_unregister_match(&icmp6_matchstruct);
1403 err4:
1404         xt_unregister_target(&ip6t_error_target);
1405 err3:
1406         xt_unregister_target(&ip6t_standard_target);
1407 err2:
1408         xt_proto_fini(AF_INET6);
1409 err1:
1410         return ret;
1411 }
1412
1413 static void __exit ip6_tables_fini(void)
1414 {
1415         nf_unregister_sockopt(&ip6t_sockopts);
1416         xt_unregister_match(&icmp6_matchstruct);
1417         xt_unregister_target(&ip6t_error_target);
1418         xt_unregister_target(&ip6t_standard_target);
1419         xt_proto_fini(AF_INET6);
1420 }
1421
1422 /*
1423  * find the offset to specified header or the protocol number of last header
1424  * if target < 0. "last header" is transport protocol header, ESP, or
1425  * "No next header".
1426  *
1427  * If target header is found, its offset is set in *offset and return protocol
1428  * number. Otherwise, return -1.
1429  *
1430  * If the first fragment doesn't contain the final protocol header or
1431  * NEXTHDR_NONE it is considered invalid.
1432  *
1433  * Note that non-1st fragment is special case that "the protocol number
1434  * of last header" is "next header" field in Fragment header. In this case,
1435  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
1436  * isn't NULL.
1437  *
1438  */
1439 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
1440                   int target, unsigned short *fragoff)
1441 {
1442         unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
1443         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
1444         unsigned int len = skb->len - start;
1445
1446         if (fragoff)
1447                 *fragoff = 0;
1448
1449         while (nexthdr != target) {
1450                 struct ipv6_opt_hdr _hdr, *hp;
1451                 unsigned int hdrlen;
1452
1453                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
1454                         if (target < 0)
1455                                 break;
1456                         return -ENOENT;
1457                 }
1458
1459                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
1460                 if (hp == NULL)
1461                         return -EBADMSG;
1462                 if (nexthdr == NEXTHDR_FRAGMENT) {
1463                         unsigned short _frag_off;
1464                         __be16 *fp;
1465                         fp = skb_header_pointer(skb,
1466                                                 start+offsetof(struct frag_hdr,
1467                                                                frag_off),
1468                                                 sizeof(_frag_off),
1469                                                 &_frag_off);
1470                         if (fp == NULL)
1471                                 return -EBADMSG;
1472
1473                         _frag_off = ntohs(*fp) & ~0x7;
1474                         if (_frag_off) {
1475                                 if (target < 0 &&
1476                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
1477                                      hp->nexthdr == NEXTHDR_NONE)) {
1478                                         if (fragoff)
1479                                                 *fragoff = _frag_off;
1480                                         return hp->nexthdr;
1481                                 }
1482                                 return -ENOENT;
1483                         }
1484                         hdrlen = 8;
1485                 } else if (nexthdr == NEXTHDR_AUTH)
1486                         hdrlen = (hp->hdrlen + 2) << 2;
1487                 else
1488                         hdrlen = ipv6_optlen(hp);
1489
1490                 nexthdr = hp->nexthdr;
1491                 len -= hdrlen;
1492                 start += hdrlen;
1493         }
1494
1495         *offset = start;
1496         return nexthdr;
1497 }
1498
1499 EXPORT_SYMBOL(ip6t_register_table);
1500 EXPORT_SYMBOL(ip6t_unregister_table);
1501 EXPORT_SYMBOL(ip6t_do_table);
1502 EXPORT_SYMBOL(ip6t_ext_hdr);
1503 EXPORT_SYMBOL(ipv6_find_hdr);
1504
1505 module_init(ip6_tables_init);
1506 module_exit(ip6_tables_fini);