net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12 #include <linux/capability.h>
  13 #include <linux/in.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/kmod.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/poison.h>
  20 #include <linux/icmpv6.h>
  21 #include <net/ipv6.h>
  22 #include <net/compat.h>
  23 #include <asm/uaccess.h>
  24 #include <linux/mutex.h>
  25 #include <linux/proc_fs.h>
  26 #include <linux/err.h>
  27 #include <linux/cpumask.h>
  28
  29 #include <linux/netfilter_ipv6/ip6_tables.h>
  30 #include <linux/netfilter/x_tables.h>
  31 #include <net/netfilter/nf_log.h>
  32 #include "../../netfilter/xt_repldata.h"
  33
  34 MODULE_LICENSE("GPL");
  35 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  36 MODULE_DESCRIPTION("IPv6 packet filter");
  37
  38 /*#define DEBUG_IP_FIREWALL*/
  39 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  40 /*#define DEBUG_IP_FIREWALL_USER*/
  41
  42 #ifdef DEBUG_IP_FIREWALL
  43 #define dprintf(format, args...)  printk(format , ## args)
  44 #else
  45 #define dprintf(format, args...)
  46 #endif
  47
  48 #ifdef DEBUG_IP_FIREWALL_USER
  49 #define duprintf(format, args...) printk(format , ## args)
  50 #else
  51 #define duprintf(format, args...)
  52 #endif
  53
  54 #ifdef CONFIG_NETFILTER_DEBUG
  55 #define IP_NF_ASSERT(x)                                         \
  56 do {                                                            \
  57         if (!(x))                                               \
  58                 printk("IP_NF_ASSERT: %s:%s:%u\n",              \
  59                        __func__, __FILE__, __LINE__);   \
  60 } while(0)
  61 #else
  62 #define IP_NF_ASSERT(x)
  63 #endif
  64
  65 #if 0
  66 /* All the better to debug you with... */
  67 #define static
  68 #define inline
  69 #endif
  70
  71 void *ip6t_alloc_initial_table(const struct xt_table *info)
  72 {
  73         return xt_alloc_initial_table(ip6t, IP6T);
  74 }
  75 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
  76
  77 /*
  78    We keep a set of rules for each CPU, so we can avoid write-locking
  79    them in the softirq when updating the counters and therefore
  80    only need to read-lock in the softirq; doing a write_lock_bh() in user
  81    context stops packets coming through and allows user context to read
  82    the counters or update the rules.
  83
  84    Hence the start of any table is given by get_table() below.  */
  85
  86 /* Check for an extension */
  87 int
  88 ip6t_ext_hdr(u8 nexthdr)
  89 {
  90         return ( (nexthdr == IPPROTO_HOPOPTS)   ||
  91                  (nexthdr == IPPROTO_ROUTING)   ||
  92                  (nexthdr == IPPROTO_FRAGMENT)  ||
  93                  (nexthdr == IPPROTO_ESP)       ||
  94                  (nexthdr == IPPROTO_AH)        ||
  95                  (nexthdr == IPPROTO_NONE)      ||
  96                  (nexthdr == IPPROTO_DSTOPTS) );
  97 }
  98
  99 /* Returns whether matches rule or not. */
 100 /* Performance critical - called for every packet */
 101 static inline bool
 102 ip6_packet_match(const struct sk_buff *skb,
 103                  const char *indev,
 104                  const char *outdev,
 105                  const struct ip6t_ip6 *ip6info,
 106                  unsigned int *protoff,
 107                  int *fragoff, bool *hotdrop)
 108 {
 109         unsigned long ret;
 110         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
 111
 112 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
 113
 114         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 115                                        &ip6info->src), IP6T_INV_SRCIP) ||
 116             FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 117                                        &ip6info->dst), IP6T_INV_DSTIP)) {
 118                 dprintf("Source or dest mismatch.\n");
 119 /*
 120                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 121                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 122                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 123                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 124                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 125                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 126                 return false;
 127         }
 128
 129         ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 130
 131         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 132                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 133                         indev, ip6info->iniface,
 134                         ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
 135                 return false;
 136         }
 137
 138         ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 139
 140         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 141                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 142                         outdev, ip6info->outiface,
 143                         ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
 144                 return false;
 145         }
 146
 147 /* ... might want to do something with class and flowlabel here ... */
 148
 149         /* look for the desired protocol header */
 150         if((ip6info->flags & IP6T_F_PROTO)) {
 151                 int protohdr;
 152                 unsigned short _frag_off;
 153
 154                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
 155                 if (protohdr < 0) {
 156                         if (_frag_off == 0)
 157                                 *hotdrop = true;
 158                         return false;
 159                 }
 160                 *fragoff = _frag_off;
 161
 162                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 163                                 protohdr,
 164                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 165                                 ip6info->proto);
 166
 167                 if (ip6info->proto == protohdr) {
 168                         if(ip6info->invflags & IP6T_INV_PROTO) {
 169                                 return false;
 170                         }
 171                         return true;
 172                 }
 173
 174                 /* We need match for the '-p all', too! */
 175                 if ((ip6info->proto != 0) &&
 176                         !(ip6info->invflags & IP6T_INV_PROTO))
 177                         return false;
 178         }
 179         return true;
 180 }
 181
 182 /* should be ip6 safe */
 183 static bool
 184 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 185 {
 186         if (ipv6->flags & ~IP6T_F_MASK) {
 187                 duprintf("Unknown flag bits set: %08X\n",
 188                          ipv6->flags & ~IP6T_F_MASK);
 189                 return false;
 190         }
 191         if (ipv6->invflags & ~IP6T_INV_MASK) {
 192                 duprintf("Unknown invflag bits set: %08X\n",
 193                          ipv6->invflags & ~IP6T_INV_MASK);
 194                 return false;
 195         }
 196         return true;
 197 }
 198
 199 static unsigned int
 200 ip6t_error(struct sk_buff *skb, const struct xt_target_param *par)
 201 {
 202         if (net_ratelimit())
 203                 printk("ip6_tables: error: `%s'\n",
 204                        (const char *)par->targinfo);
 205
 206         return NF_DROP;
 207 }
 208
 209 /* Performance critical - called for every packet */
 210 static inline bool
 211 do_match(const struct ip6t_entry_match *m, const struct sk_buff *skb,
 212          struct xt_match_param *par)
 213 {
 214         par->match     = m->u.kernel.match;
 215         par->matchinfo = m->data;
 216
 217         /* Stop iteration if it doesn't match */
 218         if (!m->u.kernel.match->match(skb, par))
 219                 return true;
 220         else
 221                 return false;
 222 }
 223
 224 static inline struct ip6t_entry *
 225 get_entry(const void *base, unsigned int offset)
 226 {
 227         return (struct ip6t_entry *)(base + offset);
 228 }
 229
 230 /* All zeroes == unconditional rule. */
 231 /* Mildly perf critical (only if packet tracing is on) */
 232 static inline bool unconditional(const struct ip6t_ip6 *ipv6)
 233 {
 234         static const struct ip6t_ip6 uncond;
 235
 236         return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 237 }
 238
 239 static inline const struct ip6t_entry_target *
 240 ip6t_get_target_c(const struct ip6t_entry *e)
 241 {
 242         return ip6t_get_target((struct ip6t_entry *)e);
 243 }
 244
 245 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 246     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 247 /* This cries for unification! */
 248 static const char *const hooknames[] = {
 249         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 250         [NF_INET_LOCAL_IN]              = "INPUT",
 251         [NF_INET_FORWARD]               = "FORWARD",
 252         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 253         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 254 };
 255
 256 enum nf_ip_trace_comments {
 257         NF_IP6_TRACE_COMMENT_RULE,
 258         NF_IP6_TRACE_COMMENT_RETURN,
 259         NF_IP6_TRACE_COMMENT_POLICY,
 260 };
 261
 262 static const char *const comments[] = {
 263         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
 264         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
 265         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
 266 };
 267
 268 static struct nf_loginfo trace_loginfo = {
 269         .type = NF_LOG_TYPE_LOG,
 270         .u = {
 271                 .log = {
 272                         .level = 4,
 273                         .logflags = NF_LOG_MASK,
 274                 },
 275         },
 276 };
 277
 278 /* Mildly perf critical (only if packet tracing is on) */
 279 static inline int
 280 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
 281                       const char *hookname, const char **chainname,
 282                       const char **comment, unsigned int *rulenum)
 283 {
 284         const struct ip6t_standard_target *t = (void *)ip6t_get_target_c(s);
 285
 286         if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
 287                 /* Head of user chain: ERROR target with chainname */
 288                 *chainname = t->target.data;
 289                 (*rulenum) = 0;
 290         } else if (s == e) {
 291                 (*rulenum)++;
 292
 293                 if (s->target_offset == sizeof(struct ip6t_entry) &&
 294                     strcmp(t->target.u.kernel.target->name,
 295                            IP6T_STANDARD_TARGET) == 0 &&
 296                     t->verdict < 0 &&
 297                     unconditional(&s->ipv6)) {
 298                         /* Tail of chains: STANDARD target (return/policy) */
 299                         *comment = *chainname == hookname
 300                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
 301                                 : comments[NF_IP6_TRACE_COMMENT_RETURN];
 302                 }
 303                 return 1;
 304         } else
 305                 (*rulenum)++;
 306
 307         return 0;
 308 }
 309
 310 static void trace_packet(const struct sk_buff *skb,
 311                          unsigned int hook,
 312                          const struct net_device *in,
 313                          const struct net_device *out,
 314                          const char *tablename,
 315                          const struct xt_table_info *private,
 316                          const struct ip6t_entry *e)
 317 {
 318         const void *table_base;
 319         const struct ip6t_entry *root;
 320         const char *hookname, *chainname, *comment;
 321         const struct ip6t_entry *iter;
 322         unsigned int rulenum = 0;
 323
 324         table_base = private->entries[smp_processor_id()];
 325         root = get_entry(table_base, private->hook_entry[hook]);
 326
 327         hookname = chainname = hooknames[hook];
 328         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 329
 330         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 331                 if (get_chainname_rulenum(iter, e, hookname,
 332                     &chainname, &comment, &rulenum) != 0)
 333                         break;
 334
 335         nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
 336                       "TRACE: %s:%s:%s:%u ",
 337                       tablename, chainname, comment, rulenum);
 338 }
 339 #endif
 340
 341 static inline __pure struct ip6t_entry *
 342 ip6t_next_entry(const struct ip6t_entry *entry)
 343 {
 344         return (void *)entry + entry->next_offset;
 345 }
 346
 347 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 348 unsigned int
 349 ip6t_do_table(struct sk_buff *skb,
 350               unsigned int hook,
 351               const struct net_device *in,
 352               const struct net_device *out,
 353               struct xt_table *table)
 354 {
 355 #define tb_comefrom ((struct ip6t_entry *)table_base)->comefrom
 356
 357         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 358         bool hotdrop = false;
 359         /* Initializing verdict to NF_DROP keeps gcc happy. */
 360         unsigned int verdict = NF_DROP;
 361         const char *indev, *outdev;
 362         const void *table_base;
 363         struct ip6t_entry *e, *back;
 364         const struct xt_table_info *private;
 365         struct xt_match_param mtpar;
 366         struct xt_target_param tgpar;
 367
 368         /* Initialization */
 369         indev = in ? in->name : nulldevname;
 370         outdev = out ? out->name : nulldevname;
 371         /* We handle fragments by dealing with the first fragment as
 372          * if it was a normal packet.  All other fragments are treated
 373          * normally, except that they will NEVER match rules that ask
 374          * things we don't know, ie. tcp syn flag or ports).  If the
 375          * rule is also a fragment-specific rule, non-fragments won't
 376          * match it. */
 377         mtpar.hotdrop = &hotdrop;
 378         mtpar.in      = tgpar.in  = in;
 379         mtpar.out     = tgpar.out = out;
 380         mtpar.family  = tgpar.family = NFPROTO_IPV6;
 381         mtpar.hooknum = tgpar.hooknum = hook;
 382
 383         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 384
 385         xt_info_rdlock_bh();
 386         private = table->private;
 387         table_base = private->entries[smp_processor_id()];
 388
 389         e = get_entry(table_base, private->hook_entry[hook]);
 390
 391         /* For return from builtin chain */
 392         back = get_entry(table_base, private->underflow[hook]);
 393
 394         do {
 395                 const struct ip6t_entry_target *t;
 396
 397                 IP_NF_ASSERT(e);
 398                 IP_NF_ASSERT(back);
 399                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
 400                     &mtpar.thoff, &mtpar.fragoff, &hotdrop) ||
 401                     IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
 402                         e = ip6t_next_entry(e);
 403                         continue;
 404                 }
 405
 406                 ADD_COUNTER(e->counters,
 407                             ntohs(ipv6_hdr(skb)->payload_len) +
 408                             sizeof(struct ipv6hdr), 1);
 409
 410                 t = ip6t_get_target_c(e);
 411                 IP_NF_ASSERT(t->u.kernel.target);
 412
 413 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 414     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 415                 /* The packet is traced: log it */
 416                 if (unlikely(skb->nf_trace))
 417                         trace_packet(skb, hook, in, out,
 418                                      table->name, private, e);
 419 #endif
 420                 /* Standard target? */
 421                 if (!t->u.kernel.target->target) {
 422                         int v;
 423
 424                         v = ((struct ip6t_standard_target *)t)->verdict;
 425                         if (v < 0) {
 426                                 /* Pop from stack? */
 427                                 if (v != IP6T_RETURN) {
 428                                         verdict = (unsigned)(-v) - 1;
 429                                         break;
 430                                 }
 431                                 e = back;
 432                                 back = get_entry(table_base, back->comefrom);
 433                                 continue;
 434                         }
 435                         if (table_base + v != ip6t_next_entry(e) &&
 436                             !(e->ipv6.flags & IP6T_F_GOTO)) {
 437                                 /* Save old back ptr in next entry */
 438                                 struct ip6t_entry *next = ip6t_next_entry(e);
 439                                 next->comefrom = (void *)back - table_base;
 440                                 /* set back pointer to next entry */
 441                                 back = next;
 442                         }
 443
 444                         e = get_entry(table_base, v);
 445                         continue;
 446                 }
 447
 448                 /* Targets which reenter must return
 449                    abs. verdicts */
 450                 tgpar.target   = t->u.kernel.target;
 451                 tgpar.targinfo = t->data;
 452
 453 #ifdef CONFIG_NETFILTER_DEBUG
 454                 tb_comefrom = 0xeeeeeeec;
 455 #endif
 456                 verdict = t->u.kernel.target->target(skb, &tgpar);
 457
 458 #ifdef CONFIG_NETFILTER_DEBUG
 459                 if (tb_comefrom != 0xeeeeeeec && verdict == IP6T_CONTINUE) {
 460                         printk("Target %s reentered!\n",
 461                                t->u.kernel.target->name);
 462                         verdict = NF_DROP;
 463                 }
 464                 tb_comefrom = 0x57acc001;
 465 #endif
 466                 if (verdict == IP6T_CONTINUE)
 467                         e = ip6t_next_entry(e);
 468                 else
 469                         /* Verdict */
 470                         break;
 471         } while (!hotdrop);
 472
 473 #ifdef CONFIG_NETFILTER_DEBUG
 474         tb_comefrom = NETFILTER_LINK_POISON;
 475 #endif
 476         xt_info_rdunlock_bh();
 477
 478 #ifdef DEBUG_ALLOW_ALL
 479         return NF_ACCEPT;
 480 #else
 481         if (hotdrop)
 482                 return NF_DROP;
 483         else return verdict;
 484 #endif
 485
 486 #undef tb_comefrom
 487 }
 488
 489 /* Figures out from what hook each rule can be called: returns 0 if
 490    there are loops.  Puts hook bitmask in comefrom. */
 491 static int
 492 mark_source_chains(const struct xt_table_info *newinfo,
 493                    unsigned int valid_hooks, void *entry0)
 494 {
 495         unsigned int hook;
 496
 497         /* No recursion; use packet counter to save back ptrs (reset
 498            to 0 as we leave), and comefrom to save source hook bitmask */
 499         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 500                 unsigned int pos = newinfo->hook_entry[hook];
 501                 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
 502
 503                 if (!(valid_hooks & (1 << hook)))
 504                         continue;
 505
 506                 /* Set initial back pointer. */
 507                 e->counters.pcnt = pos;
 508
 509                 for (;;) {
 510                         const struct ip6t_standard_target *t
 511                                 = (void *)ip6t_get_target_c(e);
 512                         int visited = e->comefrom & (1 << hook);
 513
 514                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 515                                 printk("iptables: loop hook %u pos %u %08X.\n",
 516                                        hook, pos, e->comefrom);
 517                                 return 0;
 518                         }
 519                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 520
 521                         /* Unconditional return/END. */
 522                         if ((e->target_offset == sizeof(struct ip6t_entry) &&
 523                              (strcmp(t->target.u.user.name,
 524                                      IP6T_STANDARD_TARGET) == 0) &&
 525                              t->verdict < 0 &&
 526                              unconditional(&e->ipv6)) || visited) {
 527                                 unsigned int oldpos, size;
 528
 529                                 if ((strcmp(t->target.u.user.name,
 530                                             IP6T_STANDARD_TARGET) == 0) &&
 531                                     t->verdict < -NF_MAX_VERDICT - 1) {
 532                                         duprintf("mark_source_chains: bad "
 533                                                 "negative verdict (%i)\n",
 534                                                                 t->verdict);
 535                                         return 0;
 536                                 }
 537
 538                                 /* Return: backtrack through the last
 539                                    big jump. */
 540                                 do {
 541                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 542 #ifdef DEBUG_IP_FIREWALL_USER
 543                                         if (e->comefrom
 544                                             & (1 << NF_INET_NUMHOOKS)) {
 545                                                 duprintf("Back unset "
 546                                                          "on hook %u "
 547                                                          "rule %u\n",
 548                                                          hook, pos);
 549                                         }
 550 #endif
 551                                         oldpos = pos;
 552                                         pos = e->counters.pcnt;
 553                                         e->counters.pcnt = 0;
 554
 555                                         /* We're at the start. */
 556                                         if (pos == oldpos)
 557                                                 goto next;
 558
 559                                         e = (struct ip6t_entry *)
 560                                                 (entry0 + pos);
 561                                 } while (oldpos == pos + e->next_offset);
 562
 563                                 /* Move along one */
 564                                 size = e->next_offset;
 565                                 e = (struct ip6t_entry *)
 566                                         (entry0 + pos + size);
 567                                 e->counters.pcnt = pos;
 568                                 pos += size;
 569                         } else {
 570                                 int newpos = t->verdict;
 571
 572                                 if (strcmp(t->target.u.user.name,
 573                                            IP6T_STANDARD_TARGET) == 0 &&
 574                                     newpos >= 0) {
 575                                         if (newpos > newinfo->size -
 576                                                 sizeof(struct ip6t_entry)) {
 577                                                 duprintf("mark_source_chains: "
 578                                                         "bad verdict (%i)\n",
 579                                                                 newpos);
 580                                                 return 0;
 581                                         }
 582                                         /* This a jump; chase it. */
 583                                         duprintf("Jump rule %u -> %u\n",
 584                                                  pos, newpos);
 585                                 } else {
 586                                         /* ... this is a fallthru */
 587                                         newpos = pos + e->next_offset;
 588                                 }
 589                                 e = (struct ip6t_entry *)
 590                                         (entry0 + newpos);
 591                                 e->counters.pcnt = pos;
 592                                 pos = newpos;
 593                         }
 594                 }
 595                 next:
 596                 duprintf("Finished chain %u\n", hook);
 597         }
 598         return 1;
 599 }
 600
 601 static int
 602 cleanup_match(struct ip6t_entry_match *m, struct net *net, unsigned int *i)
 603 {
 604         struct xt_mtdtor_param par;
 605
 606         if (i && (*i)-- == 0)
 607                 return 1;
 608
 609         par.net       = net;
 610         par.match     = m->u.kernel.match;
 611         par.matchinfo = m->data;
 612         par.family    = NFPROTO_IPV6;
 613         if (par.match->destroy != NULL)
 614                 par.match->destroy(&par);
 615         module_put(par.match->me);
 616         return 0;
 617 }
 618
 619 static int
 620 check_entry(const struct ip6t_entry *e, const char *name)
 621 {
 622         const struct ip6t_entry_target *t;
 623
 624         if (!ip6_checkentry(&e->ipv6)) {
 625                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 626                 return -EINVAL;
 627         }
 628
 629         if (e->target_offset + sizeof(struct ip6t_entry_target) >
 630             e->next_offset)
 631                 return -EINVAL;
 632
 633         t = ip6t_get_target_c(e);
 634         if (e->target_offset + t->u.target_size > e->next_offset)
 635                 return -EINVAL;
 636
 637         return 0;
 638 }
 639
 640 static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
 641                        unsigned int *i)
 642 {
 643         const struct ip6t_ip6 *ipv6 = par->entryinfo;
 644         int ret;
 645
 646         par->match     = m->u.kernel.match;
 647         par->matchinfo = m->data;
 648
 649         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 650                              ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
 651         if (ret < 0) {
 652                 duprintf("ip_tables: check failed for `%s'.\n",
 653                          par.match->name);
 654                 return ret;
 655         }
 656         ++*i;
 657         return 0;
 658 }
 659
 660 static int
 661 find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
 662                  unsigned int *i)
 663 {
 664         struct xt_match *match;
 665         int ret;
 666
 667         match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
 668                                                       m->u.user.revision),
 669                                         "ip6t_%s", m->u.user.name);
 670         if (IS_ERR(match) || !match) {
 671                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 672                 return match ? PTR_ERR(match) : -ENOENT;
 673         }
 674         m->u.kernel.match = match;
 675
 676         ret = check_match(m, par, i);
 677         if (ret)
 678                 goto err;
 679
 680         return 0;
 681 err:
 682         module_put(m->u.kernel.match->me);
 683         return ret;
 684 }
 685
 686 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 687 {
 688         struct ip6t_entry_target *t = ip6t_get_target(e);
 689         struct xt_tgchk_param par = {
 690                 .net       = net,
 691                 .table     = name,
 692                 .entryinfo = e,
 693                 .target    = t->u.kernel.target,
 694                 .targinfo  = t->data,
 695                 .hook_mask = e->comefrom,
 696                 .family    = NFPROTO_IPV6,
 697         };
 698         int ret;
 699
 700         t = ip6t_get_target(e);
 701         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 702               e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
 703         if (ret < 0) {
 704                 duprintf("ip_tables: check failed for `%s'.\n",
 705                          t->u.kernel.target->name);
 706                 return ret;
 707         }
 708         return 0;
 709 }
 710
 711 static int
 712 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 713                  unsigned int size)
 714 {
 715         struct ip6t_entry_target *t;
 716         struct xt_target *target;
 717         int ret;
 718         unsigned int j;
 719         struct xt_mtchk_param mtpar;
 720
 721         ret = check_entry(e, name);
 722         if (ret)
 723                 return ret;
 724
 725         j = 0;
 726         mtpar.net       = net;
 727         mtpar.table     = name;
 728         mtpar.entryinfo = &e->ipv6;
 729         mtpar.hook_mask = e->comefrom;
 730         mtpar.family    = NFPROTO_IPV6;
 731         ret = IP6T_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
 732         if (ret != 0)
 733                 goto cleanup_matches;
 734
 735         t = ip6t_get_target(e);
 736         target = try_then_request_module(xt_find_target(AF_INET6,
 737                                                         t->u.user.name,
 738                                                         t->u.user.revision),
 739                                          "ip6t_%s", t->u.user.name);
 740         if (IS_ERR(target) || !target) {
 741                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 742                 ret = target ? PTR_ERR(target) : -ENOENT;
 743                 goto cleanup_matches;
 744         }
 745         t->u.kernel.target = target;
 746
 747         ret = check_target(e, net, name);
 748         if (ret)
 749                 goto err;
 750         return 0;
 751  err:
 752         module_put(t->u.kernel.target->me);
 753  cleanup_matches:
 754         IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
 755         return ret;
 756 }
 757
 758 static bool check_underflow(const struct ip6t_entry *e)
 759 {
 760         const struct ip6t_entry_target *t;
 761         unsigned int verdict;
 762
 763         if (!unconditional(&e->ipv6))
 764                 return false;
 765         t = ip6t_get_target_c(e);
 766         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 767                 return false;
 768         verdict = ((struct ip6t_standard_target *)t)->verdict;
 769         verdict = -verdict - 1;
 770         return verdict == NF_DROP || verdict == NF_ACCEPT;
 771 }
 772
 773 static int
 774 check_entry_size_and_hooks(struct ip6t_entry *e,
 775                            struct xt_table_info *newinfo,
 776                            const unsigned char *base,
 777                            const unsigned char *limit,
 778                            const unsigned int *hook_entries,
 779                            const unsigned int *underflows,
 780                            unsigned int valid_hooks)
 781 {
 782         unsigned int h;
 783
 784         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
 785             (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
 786                 duprintf("Bad offset %p\n", e);
 787                 return -EINVAL;
 788         }
 789
 790         if (e->next_offset
 791             < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
 792                 duprintf("checking: element %p size %u\n",
 793                          e, e->next_offset);
 794                 return -EINVAL;
 795         }
 796
 797         /* Check hooks & underflows */
 798         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 799                 if (!(valid_hooks & (1 << h)))
 800                         continue;
 801                 if ((unsigned char *)e - base == hook_entries[h])
 802                         newinfo->hook_entry[h] = hook_entries[h];
 803                 if ((unsigned char *)e - base == underflows[h]) {
 804                         if (!check_underflow(e)) {
 805                                 pr_err("Underflows must be unconditional and "
 806                                        "use the STANDARD target with "
 807                                        "ACCEPT/DROP\n");
 808                                 return -EINVAL;
 809                         }
 810                         newinfo->underflow[h] = underflows[h];
 811                 }
 812         }
 813
 814         /* Clear counters and comefrom */
 815         e->counters = ((struct xt_counters) { 0, 0 });
 816         e->comefrom = 0;
 817         return 0;
 818 }
 819
 820 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
 821 {
 822         struct xt_tgdtor_param par;
 823         struct ip6t_entry_target *t;
 824
 825         /* Cleanup all matches */
 826         IP6T_MATCH_ITERATE(e, cleanup_match, net, NULL);
 827         t = ip6t_get_target(e);
 828
 829         par.net      = net;
 830         par.target   = t->u.kernel.target;
 831         par.targinfo = t->data;
 832         par.family   = NFPROTO_IPV6;
 833         if (par.target->destroy != NULL)
 834                 par.target->destroy(&par);
 835         module_put(par.target->me);
 836 }
 837
 838 /* Checks and translates the user-supplied table segment (held in
 839    newinfo) */
 840 static int
 841 translate_table(struct net *net,
 842                 const char *name,
 843                 unsigned int valid_hooks,
 844                 struct xt_table_info *newinfo,
 845                 void *entry0,
 846                 unsigned int size,
 847                 unsigned int number,
 848                 const unsigned int *hook_entries,
 849                 const unsigned int *underflows)
 850 {
 851         struct ip6t_entry *iter;
 852         unsigned int i;
 853         int ret = 0;
 854
 855         newinfo->size = size;
 856         newinfo->number = number;
 857
 858         /* Init all hooks to impossible value. */
 859         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 860                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 861                 newinfo->underflow[i] = 0xFFFFFFFF;
 862         }
 863
 864         duprintf("translate_table: size %u\n", newinfo->size);
 865         i = 0;
 866         /* Walk through entries, checking offsets. */
 867         xt_entry_foreach(iter, entry0, newinfo->size) {
 868                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 869                       entry0 + size, hook_entries, underflows, valid_hooks);
 870                 if (ret != 0)
 871                         return ret;
 872                 ++i;
 873         }
 874
 875         if (i != number) {
 876                 duprintf("translate_table: %u not %u entries\n",
 877                          i, number);
 878                 return -EINVAL;
 879         }
 880
 881         /* Check hooks all assigned */
 882         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 883                 /* Only hooks which are valid */
 884                 if (!(valid_hooks & (1 << i)))
 885                         continue;
 886                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 887                         duprintf("Invalid hook entry %u %u\n",
 888                                  i, hook_entries[i]);
 889                         return -EINVAL;
 890                 }
 891                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 892                         duprintf("Invalid underflow %u %u\n",
 893                                  i, underflows[i]);
 894                         return -EINVAL;
 895                 }
 896         }
 897
 898         if (!mark_source_chains(newinfo, valid_hooks, entry0))
 899                 return -ELOOP;
 900
 901         /* Finally, each sanity check must pass */
 902         i = 0;
 903         xt_entry_foreach(iter, entry0, newinfo->size) {
 904                 ret = find_check_entry(iter, net, name, size);
 905                 if (ret != 0)
 906                         break;
 907                 ++i;
 908         }
 909
 910         if (ret != 0) {
 911                 xt_entry_foreach(iter, entry0, newinfo->size) {
 912                         if (i-- == 0)
 913                                 break;
 914                         cleanup_entry(iter, net);
 915                 }
 916                 return ret;
 917         }
 918
 919         /* And one copy for every other CPU */
 920         for_each_possible_cpu(i) {
 921                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 922                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 923         }
 924
 925         return ret;
 926 }
 927
 928 static void
 929 get_counters(const struct xt_table_info *t,
 930              struct xt_counters counters[])
 931 {
 932         struct ip6t_entry *iter;
 933         unsigned int cpu;
 934         unsigned int i;
 935         unsigned int curcpu;
 936
 937         /* Instead of clearing (by a previous call to memset())
 938          * the counters and using adds, we set the counters
 939          * with data used by 'current' CPU
 940          *
 941          * Bottom half has to be disabled to prevent deadlock
 942          * if new softirq were to run and call ipt_do_table
 943          */
 944         local_bh_disable();
 945         curcpu = smp_processor_id();
 946
 947         i = 0;
 948         xt_entry_foreach(iter, t->entries[curcpu], t->size) {
 949                 SET_COUNTER(counters[i], iter->counters.bcnt,
 950                         iter->counters.pcnt);
 951                 ++i;
 952         }
 953
 954         for_each_possible_cpu(cpu) {
 955                 if (cpu == curcpu)
 956                         continue;
 957                 i = 0;
 958                 xt_info_wrlock(cpu);
 959                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
 960                         ADD_COUNTER(counters[i], iter->counters.bcnt,
 961                                 iter->counters.pcnt);
 962                         ++i;
 963                 }
 964                 xt_info_wrunlock(cpu);
 965         }
 966         local_bh_enable();
 967 }
 968
 969 static struct xt_counters *alloc_counters(const struct xt_table *table)
 970 {
 971         unsigned int countersize;
 972         struct xt_counters *counters;
 973         const struct xt_table_info *private = table->private;
 974
 975         /* We need atomic snapshot of counters: rest doesn't change
 976            (other than comefrom, which userspace doesn't care
 977            about). */
 978         countersize = sizeof(struct xt_counters) * private->number;
 979         counters = vmalloc_node(countersize, numa_node_id());
 980
 981         if (counters == NULL)
 982                 return ERR_PTR(-ENOMEM);
 983
 984         get_counters(private, counters);
 985
 986         return counters;
 987 }
 988
 989 static int
 990 copy_entries_to_user(unsigned int total_size,
 991                      const struct xt_table *table,
 992                      void __user *userptr)
 993 {
 994         unsigned int off, num;
 995         const struct ip6t_entry *e;
 996         struct xt_counters *counters;
 997         const struct xt_table_info *private = table->private;
 998         int ret = 0;
 999         const void *loc_cpu_entry;
1000
1001         counters = alloc_counters(table);
1002         if (IS_ERR(counters))
1003                 return PTR_ERR(counters);
1004
1005         /* choose the copy that is on our node/cpu, ...
1006          * This choice is lazy (because current thread is
1007          * allowed to migrate to another cpu)
1008          */
1009         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1010         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
1011                 ret = -EFAULT;
1012                 goto free_counters;
1013         }
1014
1015         /* FIXME: use iterator macros --RR */
1016         /* ... then go back and fix counters and names */
1017         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
1018                 unsigned int i;
1019                 const struct ip6t_entry_match *m;
1020                 const struct ip6t_entry_target *t;
1021
1022                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
1023                 if (copy_to_user(userptr + off
1024                                  + offsetof(struct ip6t_entry, counters),
1025                                  &counters[num],
1026                                  sizeof(counters[num])) != 0) {
1027                         ret = -EFAULT;
1028                         goto free_counters;
1029                 }
1030
1031                 for (i = sizeof(struct ip6t_entry);
1032                      i < e->target_offset;
1033                      i += m->u.match_size) {
1034                         m = (void *)e + i;
1035
1036                         if (copy_to_user(userptr + off + i
1037                                          + offsetof(struct ip6t_entry_match,
1038                                                     u.user.name),
1039                                          m->u.kernel.match->name,
1040                                          strlen(m->u.kernel.match->name)+1)
1041                             != 0) {
1042                                 ret = -EFAULT;
1043                                 goto free_counters;
1044                         }
1045                 }
1046
1047                 t = ip6t_get_target_c(e);
1048                 if (copy_to_user(userptr + off + e->target_offset
1049                                  + offsetof(struct ip6t_entry_target,
1050                                             u.user.name),
1051                                  t->u.kernel.target->name,
1052                                  strlen(t->u.kernel.target->name)+1) != 0) {
1053                         ret = -EFAULT;
1054                         goto free_counters;
1055                 }
1056         }
1057
1058  free_counters:
1059         vfree(counters);
1060         return ret;
1061 }
1062
1063 #ifdef CONFIG_COMPAT
1064 static void compat_standard_from_user(void *dst, const void *src)
1065 {
1066         int v = *(compat_int_t *)src;
1067
1068         if (v > 0)
1069                 v += xt_compat_calc_jump(AF_INET6, v);
1070         memcpy(dst, &v, sizeof(v));
1071 }
1072
1073 static int compat_standard_to_user(void __user *dst, const void *src)
1074 {
1075         compat_int_t cv = *(int *)src;
1076
1077         if (cv > 0)
1078                 cv -= xt_compat_calc_jump(AF_INET6, cv);
1079         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1080 }
1081
1082 static inline int
1083 compat_calc_match(const struct ip6t_entry_match *m, int *size)
1084 {
1085         *size += xt_compat_match_offset(m->u.kernel.match);
1086         return 0;
1087 }
1088
1089 static int compat_calc_entry(const struct ip6t_entry *e,
1090                              const struct xt_table_info *info,
1091                              const void *base, struct xt_table_info *newinfo)
1092 {
1093         const struct ip6t_entry_target *t;
1094         unsigned int entry_offset;
1095         int off, i, ret;
1096
1097         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1098         entry_offset = (void *)e - base;
1099         IP6T_MATCH_ITERATE(e, compat_calc_match, &off);
1100         t = ip6t_get_target_c(e);
1101         off += xt_compat_target_offset(t->u.kernel.target);
1102         newinfo->size -= off;
1103         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1104         if (ret)
1105                 return ret;
1106
1107         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1108                 if (info->hook_entry[i] &&
1109                     (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1110                         newinfo->hook_entry[i] -= off;
1111                 if (info->underflow[i] &&
1112                     (e < (struct ip6t_entry *)(base + info->underflow[i])))
1113                         newinfo->underflow[i] -= off;
1114         }
1115         return 0;
1116 }
1117
1118 static int compat_table_info(const struct xt_table_info *info,
1119                              struct xt_table_info *newinfo)
1120 {
1121         struct ip6t_entry *iter;
1122         void *loc_cpu_entry;
1123         int ret;
1124
1125         if (!newinfo || !info)
1126                 return -EINVAL;
1127
1128         /* we dont care about newinfo->entries[] */
1129         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1130         newinfo->initial_entries = 0;
1131         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1132         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1133                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1134                 if (ret != 0)
1135                         return ret;
1136         }
1137         return 0;
1138 }
1139 #endif
1140
1141 static int get_info(struct net *net, void __user *user,
1142                     const int *len, int compat)
1143 {
1144         char name[IP6T_TABLE_MAXNAMELEN];
1145         struct xt_table *t;
1146         int ret;
1147
1148         if (*len != sizeof(struct ip6t_getinfo)) {
1149                 duprintf("length %u != %zu\n", *len,
1150                          sizeof(struct ip6t_getinfo));
1151                 return -EINVAL;
1152         }
1153
1154         if (copy_from_user(name, user, sizeof(name)) != 0)
1155                 return -EFAULT;
1156
1157         name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
1158 #ifdef CONFIG_COMPAT
1159         if (compat)
1160                 xt_compat_lock(AF_INET6);
1161 #endif
1162         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1163                                     "ip6table_%s", name);
1164         if (t && !IS_ERR(t)) {
1165                 struct ip6t_getinfo info;
1166                 const struct xt_table_info *private = t->private;
1167 #ifdef CONFIG_COMPAT
1168                 struct xt_table_info tmp;
1169
1170                 if (compat) {
1171                         ret = compat_table_info(private, &tmp);
1172                         xt_compat_flush_offsets(AF_INET6);
1173                         private = &tmp;
1174                 }
1175 #endif
1176                 info.valid_hooks = t->valid_hooks;
1177                 memcpy(info.hook_entry, private->hook_entry,
1178                        sizeof(info.hook_entry));
1179                 memcpy(info.underflow, private->underflow,
1180                        sizeof(info.underflow));
1181                 info.num_entries = private->number;
1182                 info.size = private->size;
1183                 strcpy(info.name, name);
1184
1185                 if (copy_to_user(user, &info, *len) != 0)
1186                         ret = -EFAULT;
1187                 else
1188                         ret = 0;
1189
1190                 xt_table_unlock(t);
1191                 module_put(t->me);
1192         } else
1193                 ret = t ? PTR_ERR(t) : -ENOENT;
1194 #ifdef CONFIG_COMPAT
1195         if (compat)
1196                 xt_compat_unlock(AF_INET6);
1197 #endif
1198         return ret;
1199 }
1200
1201 static int
1202 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1203             const int *len)
1204 {
1205         int ret;
1206         struct ip6t_get_entries get;
1207         struct xt_table *t;
1208
1209         if (*len < sizeof(get)) {
1210                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1211                 return -EINVAL;
1212         }
1213         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1214                 return -EFAULT;
1215         if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1216                 duprintf("get_entries: %u != %zu\n",
1217                          *len, sizeof(get) + get.size);
1218                 return -EINVAL;
1219         }
1220
1221         t = xt_find_table_lock(net, AF_INET6, get.name);
1222         if (t && !IS_ERR(t)) {
1223                 struct xt_table_info *private = t->private;
1224                 duprintf("t->private->number = %u\n", private->number);
1225                 if (get.size == private->size)
1226                         ret = copy_entries_to_user(private->size,
1227                                                    t, uptr->entrytable);
1228                 else {
1229                         duprintf("get_entries: I've got %u not %u!\n",
1230                                  private->size, get.size);
1231                         ret = -EAGAIN;
1232                 }
1233                 module_put(t->me);
1234                 xt_table_unlock(t);
1235         } else
1236                 ret = t ? PTR_ERR(t) : -ENOENT;
1237
1238         return ret;
1239 }
1240
1241 static int
1242 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1243              struct xt_table_info *newinfo, unsigned int num_counters,
1244              void __user *counters_ptr)
1245 {
1246         int ret;
1247         struct xt_table *t;
1248         struct xt_table_info *oldinfo;
1249         struct xt_counters *counters;
1250         const void *loc_cpu_old_entry;
1251         struct ip6t_entry *iter;
1252
1253         ret = 0;
1254         counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
1255                                 numa_node_id());
1256         if (!counters) {
1257                 ret = -ENOMEM;
1258                 goto out;
1259         }
1260
1261         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1262                                     "ip6table_%s", name);
1263         if (!t || IS_ERR(t)) {
1264                 ret = t ? PTR_ERR(t) : -ENOENT;
1265                 goto free_newinfo_counters_untrans;
1266         }
1267
1268         /* You lied! */
1269         if (valid_hooks != t->valid_hooks) {
1270                 duprintf("Valid hook crap: %08X vs %08X\n",
1271                          valid_hooks, t->valid_hooks);
1272                 ret = -EINVAL;
1273                 goto put_module;
1274         }
1275
1276         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1277         if (!oldinfo)
1278                 goto put_module;
1279
1280         /* Update module usage count based on number of rules */
1281         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1282                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1283         if ((oldinfo->number > oldinfo->initial_entries) ||
1284             (newinfo->number <= oldinfo->initial_entries))
1285                 module_put(t->me);
1286         if ((oldinfo->number > oldinfo->initial_entries) &&
1287             (newinfo->number <= oldinfo->initial_entries))
1288                 module_put(t->me);
1289
1290         /* Get the old counters, and synchronize with replace */
1291         get_counters(oldinfo, counters);
1292
1293         /* Decrease module usage counts and free resource */
1294         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1295         xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1296                 cleanup_entry(iter, net);
1297
1298         xt_free_table_info(oldinfo);
1299         if (copy_to_user(counters_ptr, counters,
1300                          sizeof(struct xt_counters) * num_counters) != 0)
1301                 ret = -EFAULT;
1302         vfree(counters);
1303         xt_table_unlock(t);
1304         return ret;
1305
1306  put_module:
1307         module_put(t->me);
1308         xt_table_unlock(t);
1309  free_newinfo_counters_untrans:
1310         vfree(counters);
1311  out:
1312         return ret;
1313 }
1314
1315 static int
1316 do_replace(struct net *net, const void __user *user, unsigned int len)
1317 {
1318         int ret;
1319         struct ip6t_replace tmp;
1320         struct xt_table_info *newinfo;
1321         void *loc_cpu_entry;
1322         struct ip6t_entry *iter;
1323
1324         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1325                 return -EFAULT;
1326
1327         /* overflow check */
1328         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1329                 return -ENOMEM;
1330
1331         newinfo = xt_alloc_table_info(tmp.size);
1332         if (!newinfo)
1333                 return -ENOMEM;
1334
1335         /* choose the copy that is on our node/cpu */
1336         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1337         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1338                            tmp.size) != 0) {
1339                 ret = -EFAULT;
1340                 goto free_newinfo;
1341         }
1342
1343         ret = translate_table(net, tmp.name, tmp.valid_hooks,
1344                               newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1345                               tmp.hook_entry, tmp.underflow);
1346         if (ret != 0)
1347                 goto free_newinfo;
1348
1349         duprintf("ip_tables: Translated table\n");
1350
1351         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1352                            tmp.num_counters, tmp.counters);
1353         if (ret)
1354                 goto free_newinfo_untrans;
1355         return 0;
1356
1357  free_newinfo_untrans:
1358         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1359                 cleanup_entry(iter, net);
1360  free_newinfo:
1361         xt_free_table_info(newinfo);
1362         return ret;
1363 }
1364
1365 static int
1366 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1367                 int compat)
1368 {
1369         unsigned int i, curcpu;
1370         struct xt_counters_info tmp;
1371         struct xt_counters *paddc;
1372         unsigned int num_counters;
1373         char *name;
1374         int size;
1375         void *ptmp;
1376         struct xt_table *t;
1377         const struct xt_table_info *private;
1378         int ret = 0;
1379         const void *loc_cpu_entry;
1380         struct ip6t_entry *iter;
1381 #ifdef CONFIG_COMPAT
1382         struct compat_xt_counters_info compat_tmp;
1383
1384         if (compat) {
1385                 ptmp = &compat_tmp;
1386                 size = sizeof(struct compat_xt_counters_info);
1387         } else
1388 #endif
1389         {
1390                 ptmp = &tmp;
1391                 size = sizeof(struct xt_counters_info);
1392         }
1393
1394         if (copy_from_user(ptmp, user, size) != 0)
1395                 return -EFAULT;
1396
1397 #ifdef CONFIG_COMPAT
1398         if (compat) {
1399                 num_counters = compat_tmp.num_counters;
1400                 name = compat_tmp.name;
1401         } else
1402 #endif
1403         {
1404                 num_counters = tmp.num_counters;
1405                 name = tmp.name;
1406         }
1407
1408         if (len != size + num_counters * sizeof(struct xt_counters))
1409                 return -EINVAL;
1410
1411         paddc = vmalloc_node(len - size, numa_node_id());
1412         if (!paddc)
1413                 return -ENOMEM;
1414
1415         if (copy_from_user(paddc, user + size, len - size) != 0) {
1416                 ret = -EFAULT;
1417                 goto free;
1418         }
1419
1420         t = xt_find_table_lock(net, AF_INET6, name);
1421         if (!t || IS_ERR(t)) {
1422                 ret = t ? PTR_ERR(t) : -ENOENT;
1423                 goto free;
1424         }
1425
1426
1427         local_bh_disable();
1428         private = t->private;
1429         if (private->number != num_counters) {
1430                 ret = -EINVAL;
1431                 goto unlock_up_free;
1432         }
1433
1434         i = 0;
1435         /* Choose the copy that is on our node */
1436         curcpu = smp_processor_id();
1437         xt_info_wrlock(curcpu);
1438         loc_cpu_entry = private->entries[curcpu];
1439         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
1440                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
1441                 ++i;
1442         }
1443         xt_info_wrunlock(curcpu);
1444
1445  unlock_up_free:
1446         local_bh_enable();
1447         xt_table_unlock(t);
1448         module_put(t->me);
1449  free:
1450         vfree(paddc);
1451
1452         return ret;
1453 }
1454
1455 #ifdef CONFIG_COMPAT
1456 struct compat_ip6t_replace {
1457         char                    name[IP6T_TABLE_MAXNAMELEN];
1458         u32                     valid_hooks;
1459         u32                     num_entries;
1460         u32                     size;
1461         u32                     hook_entry[NF_INET_NUMHOOKS];
1462         u32                     underflow[NF_INET_NUMHOOKS];
1463         u32                     num_counters;
1464         compat_uptr_t           counters;       /* struct ip6t_counters * */
1465         struct compat_ip6t_entry entries[0];
1466 };
1467
1468 static int
1469 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1470                           unsigned int *size, struct xt_counters *counters,
1471                           unsigned int i)
1472 {
1473         struct ip6t_entry_target *t;
1474         struct compat_ip6t_entry __user *ce;
1475         u_int16_t target_offset, next_offset;
1476         compat_uint_t origsize;
1477         int ret;
1478
1479         origsize = *size;
1480         ce = (struct compat_ip6t_entry __user *)*dstptr;
1481         if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1482             copy_to_user(&ce->counters, &counters[i],
1483             sizeof(counters[i])) != 0)
1484                 return -EFAULT;
1485
1486         *dstptr += sizeof(struct compat_ip6t_entry);
1487         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1488
1489         ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
1490         target_offset = e->target_offset - (origsize - *size);
1491         if (ret)
1492                 return ret;
1493         t = ip6t_get_target(e);
1494         ret = xt_compat_target_to_user(t, dstptr, size);
1495         if (ret)
1496                 return ret;
1497         next_offset = e->next_offset - (origsize - *size);
1498         if (put_user(target_offset, &ce->target_offset) != 0 ||
1499             put_user(next_offset, &ce->next_offset) != 0)
1500                 return -EFAULT;
1501         return 0;
1502 }
1503
1504 static int
1505 compat_find_calc_match(struct ip6t_entry_match *m,
1506                        const char *name,
1507                        const struct ip6t_ip6 *ipv6,
1508                        unsigned int hookmask,
1509                        int *size, unsigned int *i)
1510 {
1511         struct xt_match *match;
1512
1513         match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
1514                                                       m->u.user.revision),
1515                                         "ip6t_%s", m->u.user.name);
1516         if (IS_ERR(match) || !match) {
1517                 duprintf("compat_check_calc_match: `%s' not found\n",
1518                          m->u.user.name);
1519                 return match ? PTR_ERR(match) : -ENOENT;
1520         }
1521         m->u.kernel.match = match;
1522         *size += xt_compat_match_offset(match);
1523
1524         (*i)++;
1525         return 0;
1526 }
1527
1528 static int
1529 compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
1530 {
1531         if (i && (*i)-- == 0)
1532                 return 1;
1533
1534         module_put(m->u.kernel.match->me);
1535         return 0;
1536 }
1537
1538 static void compat_release_entry(struct compat_ip6t_entry *e)
1539 {
1540         struct ip6t_entry_target *t;
1541
1542         /* Cleanup all matches */
1543         COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
1544         t = compat_ip6t_get_target(e);
1545         module_put(t->u.kernel.target->me);
1546 }
1547
1548 static int
1549 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1550                                   struct xt_table_info *newinfo,
1551                                   unsigned int *size,
1552                                   const unsigned char *base,
1553                                   const unsigned char *limit,
1554                                   const unsigned int *hook_entries,
1555                                   const unsigned int *underflows,
1556                                   const char *name)
1557 {
1558         struct ip6t_entry_target *t;
1559         struct xt_target *target;
1560         unsigned int entry_offset;
1561         unsigned int j;
1562         int ret, off, h;
1563
1564         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1565         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1566             (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
1567                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1568                 return -EINVAL;
1569         }
1570
1571         if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1572                              sizeof(struct compat_xt_entry_target)) {
1573                 duprintf("checking: element %p size %u\n",
1574                          e, e->next_offset);
1575                 return -EINVAL;
1576         }
1577
1578         /* For purposes of check_entry casting the compat entry is fine */
1579         ret = check_entry((struct ip6t_entry *)e, name);
1580         if (ret)
1581                 return ret;
1582
1583         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1584         entry_offset = (void *)e - (void *)base;
1585         j = 0;
1586         ret = COMPAT_IP6T_MATCH_ITERATE(e, compat_find_calc_match, name,
1587                                         &e->ipv6, e->comefrom, &off, &j);
1588         if (ret != 0)
1589                 goto release_matches;
1590
1591         t = compat_ip6t_get_target(e);
1592         target = try_then_request_module(xt_find_target(AF_INET6,
1593                                                         t->u.user.name,
1594                                                         t->u.user.revision),
1595                                          "ip6t_%s", t->u.user.name);
1596         if (IS_ERR(target) || !target) {
1597                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1598                          t->u.user.name);
1599                 ret = target ? PTR_ERR(target) : -ENOENT;
1600                 goto release_matches;
1601         }
1602         t->u.kernel.target = target;
1603
1604         off += xt_compat_target_offset(target);
1605         *size += off;
1606         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1607         if (ret)
1608                 goto out;
1609
1610         /* Check hooks & underflows */
1611         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1612                 if ((unsigned char *)e - base == hook_entries[h])
1613                         newinfo->hook_entry[h] = hook_entries[h];
1614                 if ((unsigned char *)e - base == underflows[h])
1615                         newinfo->underflow[h] = underflows[h];
1616         }
1617
1618         /* Clear counters and comefrom */
1619         memset(&e->counters, 0, sizeof(e->counters));
1620         e->comefrom = 0;
1621         return 0;
1622
1623 out:
1624         module_put(t->u.kernel.target->me);
1625 release_matches:
1626         IP6T_MATCH_ITERATE(e, compat_release_match, &j);
1627         return ret;
1628 }
1629
1630 static int
1631 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1632                             unsigned int *size, const char *name,
1633                             struct xt_table_info *newinfo, unsigned char *base)
1634 {
1635         struct ip6t_entry_target *t;
1636         struct xt_target *target;
1637         struct ip6t_entry *de;
1638         unsigned int origsize;
1639         int ret, h;
1640
1641         ret = 0;
1642         origsize = *size;
1643         de = (struct ip6t_entry *)*dstptr;
1644         memcpy(de, e, sizeof(struct ip6t_entry));
1645         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1646
1647         *dstptr += sizeof(struct ip6t_entry);
1648         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1649
1650         ret = COMPAT_IP6T_MATCH_ITERATE(e, xt_compat_match_from_user,
1651                                         dstptr, size);
1652         if (ret)
1653                 return ret;
1654         de->target_offset = e->target_offset - (origsize - *size);
1655         t = compat_ip6t_get_target(e);
1656         target = t->u.kernel.target;
1657         xt_compat_target_from_user(t, dstptr, size);
1658
1659         de->next_offset = e->next_offset - (origsize - *size);
1660         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1661                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1662                         newinfo->hook_entry[h] -= origsize - *size;
1663                 if ((unsigned char *)de - base < newinfo->underflow[h])
1664                         newinfo->underflow[h] -= origsize - *size;
1665         }
1666         return ret;
1667 }
1668
1669 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1670                               const char *name)
1671 {
1672         unsigned int j;
1673         int ret;
1674         struct xt_mtchk_param mtpar;
1675
1676         j = 0;
1677         mtpar.net       = net;
1678         mtpar.table     = name;
1679         mtpar.entryinfo = &e->ipv6;
1680         mtpar.hook_mask = e->comefrom;
1681         mtpar.family    = NFPROTO_IPV6;
1682         ret = IP6T_MATCH_ITERATE(e, check_match, &mtpar, &j);
1683         if (ret)
1684                 goto cleanup_matches;
1685
1686         ret = check_target(e, net, name);
1687         if (ret)
1688                 goto cleanup_matches;
1689         return 0;
1690
1691  cleanup_matches:
1692         IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
1693         return ret;
1694 }
1695
1696 static int
1697 translate_compat_table(struct net *net,
1698                        const char *name,
1699                        unsigned int valid_hooks,
1700                        struct xt_table_info **pinfo,
1701                        void **pentry0,
1702                        unsigned int total_size,
1703                        unsigned int number,
1704                        unsigned int *hook_entries,
1705                        unsigned int *underflows)
1706 {
1707         unsigned int i, j;
1708         struct xt_table_info *newinfo, *info;
1709         void *pos, *entry0, *entry1;
1710         struct compat_ip6t_entry *iter0;
1711         struct ip6t_entry *iter1;
1712         unsigned int size;
1713         int ret = 0;
1714
1715         info = *pinfo;
1716         entry0 = *pentry0;
1717         size = total_size;
1718         info->number = number;
1719
1720         /* Init all hooks to impossible value. */
1721         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1722                 info->hook_entry[i] = 0xFFFFFFFF;
1723                 info->underflow[i] = 0xFFFFFFFF;
1724         }
1725
1726         duprintf("translate_compat_table: size %u\n", info->size);
1727         j = 0;
1728         xt_compat_lock(AF_INET6);
1729         /* Walk through entries, checking offsets. */
1730         xt_entry_foreach(iter0, entry0, total_size) {
1731                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1732                       entry0, entry0 + total_size, hook_entries, underflows,
1733                       name);
1734                 if (ret != 0)
1735                         goto out_unlock;
1736                 ++j;
1737         }
1738
1739         ret = -EINVAL;
1740         if (j != number) {
1741                 duprintf("translate_compat_table: %u not %u entries\n",
1742                          j, number);
1743                 goto out_unlock;
1744         }
1745
1746         /* Check hooks all assigned */
1747         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1748                 /* Only hooks which are valid */
1749                 if (!(valid_hooks & (1 << i)))
1750                         continue;
1751                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1752                         duprintf("Invalid hook entry %u %u\n",
1753                                  i, hook_entries[i]);
1754                         goto out_unlock;
1755                 }
1756                 if (info->underflow[i] == 0xFFFFFFFF) {
1757                         duprintf("Invalid underflow %u %u\n",
1758                                  i, underflows[i]);
1759                         goto out_unlock;
1760                 }
1761         }
1762
1763         ret = -ENOMEM;
1764         newinfo = xt_alloc_table_info(size);
1765         if (!newinfo)
1766                 goto out_unlock;
1767
1768         newinfo->number = number;
1769         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1770                 newinfo->hook_entry[i] = info->hook_entry[i];
1771                 newinfo->underflow[i] = info->underflow[i];
1772         }
1773         entry1 = newinfo->entries[raw_smp_processor_id()];
1774         pos = entry1;
1775         size = total_size;
1776         xt_entry_foreach(iter0, entry0, total_size) {
1777                 ret = compat_copy_entry_from_user(iter0, &pos,
1778                       &size, name, newinfo, entry1);
1779                 if (ret != 0)
1780                         break;
1781         }
1782         xt_compat_flush_offsets(AF_INET6);
1783         xt_compat_unlock(AF_INET6);
1784         if (ret)
1785                 goto free_newinfo;
1786
1787         ret = -ELOOP;
1788         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1789                 goto free_newinfo;
1790
1791         i = 0;
1792         xt_entry_foreach(iter1, entry1, newinfo->size) {
1793                 ret = compat_check_entry(iter1, net, name);
1794                 if (ret != 0)
1795                         break;
1796                 ++i;
1797         }
1798         if (ret) {
1799                 /*
1800                  * The first i matches need cleanup_entry (calls ->destroy)
1801                  * because they had called ->check already. The other j-i
1802                  * entries need only release.
1803                  */
1804                 int skip = i;
1805                 j -= i;
1806                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1807                         if (skip-- > 0)
1808                                 continue;
1809                         if (j-- == 0)
1810                                 break;
1811                         compat_release_entry(iter0);
1812                 }
1813                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1814                         if (i-- == 0)
1815                                 break;
1816                         cleanup_entry(iter1, net);
1817                 }
1818                 xt_free_table_info(newinfo);
1819                 return ret;
1820         }
1821
1822         /* And one copy for every other CPU */
1823         for_each_possible_cpu(i)
1824                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1825                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1826
1827         *pinfo = newinfo;
1828         *pentry0 = entry1;
1829         xt_free_table_info(info);
1830         return 0;
1831
1832 free_newinfo:
1833         xt_free_table_info(newinfo);
1834 out:
1835         xt_entry_foreach(iter0, entry0, total_size) {
1836                 if (j-- == 0)
1837                         break;
1838                 compat_release_entry(iter0);
1839         }
1840         return ret;
1841 out_unlock:
1842         xt_compat_flush_offsets(AF_INET6);
1843         xt_compat_unlock(AF_INET6);
1844         goto out;
1845 }
1846
1847 static int
1848 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1849 {
1850         int ret;
1851         struct compat_ip6t_replace tmp;
1852         struct xt_table_info *newinfo;
1853         void *loc_cpu_entry;
1854         struct ip6t_entry *iter;
1855
1856         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1857                 return -EFAULT;
1858
1859         /* overflow check */
1860         if (tmp.size >= INT_MAX / num_possible_cpus())
1861                 return -ENOMEM;
1862         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1863                 return -ENOMEM;
1864
1865         newinfo = xt_alloc_table_info(tmp.size);
1866         if (!newinfo)
1867                 return -ENOMEM;
1868
1869         /* choose the copy that is on our node/cpu */
1870         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1871         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1872                            tmp.size) != 0) {
1873                 ret = -EFAULT;
1874                 goto free_newinfo;
1875         }
1876
1877         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1878                                      &newinfo, &loc_cpu_entry, tmp.size,
1879                                      tmp.num_entries, tmp.hook_entry,
1880                                      tmp.underflow);
1881         if (ret != 0)
1882                 goto free_newinfo;
1883
1884         duprintf("compat_do_replace: Translated table\n");
1885
1886         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1887                            tmp.num_counters, compat_ptr(tmp.counters));
1888         if (ret)
1889                 goto free_newinfo_untrans;
1890         return 0;
1891
1892  free_newinfo_untrans:
1893         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1894                 cleanup_entry(iter, net);
1895  free_newinfo:
1896         xt_free_table_info(newinfo);
1897         return ret;
1898 }
1899
1900 static int
1901 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1902                        unsigned int len)
1903 {
1904         int ret;
1905
1906         if (!capable(CAP_NET_ADMIN))
1907                 return -EPERM;
1908
1909         switch (cmd) {
1910         case IP6T_SO_SET_REPLACE:
1911                 ret = compat_do_replace(sock_net(sk), user, len);
1912                 break;
1913
1914         case IP6T_SO_SET_ADD_COUNTERS:
1915                 ret = do_add_counters(sock_net(sk), user, len, 1);
1916                 break;
1917
1918         default:
1919                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1920                 ret = -EINVAL;
1921         }
1922
1923         return ret;
1924 }
1925
1926 struct compat_ip6t_get_entries {
1927         char name[IP6T_TABLE_MAXNAMELEN];
1928         compat_uint_t size;
1929         struct compat_ip6t_entry entrytable[0];
1930 };
1931
1932 static int
1933 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1934                             void __user *userptr)
1935 {
1936         struct xt_counters *counters;
1937         const struct xt_table_info *private = table->private;
1938         void __user *pos;
1939         unsigned int size;
1940         int ret = 0;
1941         const void *loc_cpu_entry;
1942         unsigned int i = 0;
1943         struct ip6t_entry *iter;
1944
1945         counters = alloc_counters(table);
1946         if (IS_ERR(counters))
1947                 return PTR_ERR(counters);
1948
1949         /* choose the copy that is on our node/cpu, ...
1950          * This choice is lazy (because current thread is
1951          * allowed to migrate to another cpu)
1952          */
1953         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1954         pos = userptr;
1955         size = total_size;
1956         xt_entry_foreach(iter, loc_cpu_entry, total_size) {
1957                 ret = compat_copy_entry_to_user(iter, &pos,
1958                       &size, counters, i++);
1959                 if (ret != 0)
1960                         break;
1961         }
1962
1963         vfree(counters);
1964         return ret;
1965 }
1966
1967 static int
1968 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1969                    int *len)
1970 {
1971         int ret;
1972         struct compat_ip6t_get_entries get;
1973         struct xt_table *t;
1974
1975         if (*len < sizeof(get)) {
1976                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1977                 return -EINVAL;
1978         }
1979
1980         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1981                 return -EFAULT;
1982
1983         if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1984                 duprintf("compat_get_entries: %u != %zu\n",
1985                          *len, sizeof(get) + get.size);
1986                 return -EINVAL;
1987         }
1988
1989         xt_compat_lock(AF_INET6);
1990         t = xt_find_table_lock(net, AF_INET6, get.name);
1991         if (t && !IS_ERR(t)) {
1992                 const struct xt_table_info *private = t->private;
1993                 struct xt_table_info info;
1994                 duprintf("t->private->number = %u\n", private->number);
1995                 ret = compat_table_info(private, &info);
1996                 if (!ret && get.size == info.size) {
1997                         ret = compat_copy_entries_to_user(private->size,
1998                                                           t, uptr->entrytable);
1999                 } else if (!ret) {
2000                         duprintf("compat_get_entries: I've got %u not %u!\n",
2001                                  private->size, get.size);
2002                         ret = -EAGAIN;
2003                 }
2004                 xt_compat_flush_offsets(AF_INET6);
2005                 module_put(t->me);
2006                 xt_table_unlock(t);
2007         } else
2008                 ret = t ? PTR_ERR(t) : -ENOENT;
2009
2010         xt_compat_unlock(AF_INET6);
2011         return ret;
2012 }
2013
2014 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
2015
2016 static int
2017 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2018 {
2019         int ret;
2020
2021         if (!capable(CAP_NET_ADMIN))
2022                 return -EPERM;
2023
2024         switch (cmd) {
2025         case IP6T_SO_GET_INFO:
2026                 ret = get_info(sock_net(sk), user, len, 1);
2027                 break;
2028         case IP6T_SO_GET_ENTRIES:
2029                 ret = compat_get_entries(sock_net(sk), user, len);
2030                 break;
2031         default:
2032                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
2033         }
2034         return ret;
2035 }
2036 #endif
2037
2038 static int
2039 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2040 {
2041         int ret;
2042
2043         if (!capable(CAP_NET_ADMIN))
2044                 return -EPERM;
2045
2046         switch (cmd) {
2047         case IP6T_SO_SET_REPLACE:
2048                 ret = do_replace(sock_net(sk), user, len);
2049                 break;
2050
2051         case IP6T_SO_SET_ADD_COUNTERS:
2052                 ret = do_add_counters(sock_net(sk), user, len, 0);
2053                 break;
2054
2055         default:
2056                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
2057                 ret = -EINVAL;
2058         }
2059
2060         return ret;
2061 }
2062
2063 static int
2064 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2065 {
2066         int ret;
2067
2068         if (!capable(CAP_NET_ADMIN))
2069                 return -EPERM;
2070
2071         switch (cmd) {
2072         case IP6T_SO_GET_INFO:
2073                 ret = get_info(sock_net(sk), user, len, 0);
2074                 break;
2075
2076         case IP6T_SO_GET_ENTRIES:
2077                 ret = get_entries(sock_net(sk), user, len);
2078                 break;
2079
2080         case IP6T_SO_GET_REVISION_MATCH:
2081         case IP6T_SO_GET_REVISION_TARGET: {
2082                 struct ip6t_get_revision rev;
2083                 int target;
2084
2085                 if (*len != sizeof(rev)) {
2086                         ret = -EINVAL;
2087                         break;
2088                 }
2089                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2090                         ret = -EFAULT;
2091                         break;
2092                 }
2093
2094                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2095                         target = 1;
2096                 else
2097                         target = 0;
2098
2099                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2100                                                          rev.revision,
2101                                                          target, &ret),
2102                                         "ip6t_%s", rev.name);
2103                 break;
2104         }
2105
2106         default:
2107                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2108                 ret = -EINVAL;
2109         }
2110
2111         return ret;
2112 }
2113
2114 struct xt_table *ip6t_register_table(struct net *net,
2115                                      const struct xt_table *table,
2116                                      const struct ip6t_replace *repl)
2117 {
2118         int ret;
2119         struct xt_table_info *newinfo;
2120         struct xt_table_info bootstrap
2121                 = { 0, 0, 0, { 0 }, { 0 }, { } };
2122         void *loc_cpu_entry;
2123         struct xt_table *new_table;
2124
2125         newinfo = xt_alloc_table_info(repl->size);
2126         if (!newinfo) {
2127                 ret = -ENOMEM;
2128                 goto out;
2129         }
2130
2131         /* choose the copy on our node/cpu, but dont care about preemption */
2132         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2133         memcpy(loc_cpu_entry, repl->entries, repl->size);
2134
2135         ret = translate_table(net, table->name, table->valid_hooks,
2136                               newinfo, loc_cpu_entry, repl->size,
2137                               repl->num_entries,
2138                               repl->hook_entry,
2139                               repl->underflow);
2140         if (ret != 0)
2141                 goto out_free;
2142
2143         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2144         if (IS_ERR(new_table)) {
2145                 ret = PTR_ERR(new_table);
2146                 goto out_free;
2147         }
2148         return new_table;
2149
2150 out_free:
2151         xt_free_table_info(newinfo);
2152 out:
2153         return ERR_PTR(ret);
2154 }
2155
2156 void ip6t_unregister_table(struct net *net, struct xt_table *table)
2157 {
2158         struct xt_table_info *private;
2159         void *loc_cpu_entry;
2160         struct module *table_owner = table->me;
2161         struct ip6t_entry *iter;
2162
2163         private = xt_unregister_table(table);
2164
2165         /* Decrease module usage counts and free resources */
2166         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2167         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2168                 cleanup_entry(iter, net);
2169         if (private->number > private->initial_entries)
2170                 module_put(table_owner);
2171         xt_free_table_info(private);
2172 }
2173
2174 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2175 static inline bool
2176 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2177                      u_int8_t type, u_int8_t code,
2178                      bool invert)
2179 {
2180         return (type == test_type && code >= min_code && code <= max_code)
2181                 ^ invert;
2182 }
2183
2184 static bool
2185 icmp6_match(const struct sk_buff *skb, const struct xt_match_param *par)
2186 {
2187         const struct icmp6hdr *ic;
2188         struct icmp6hdr _icmph;
2189         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2190
2191         /* Must not be a fragment. */
2192         if (par->fragoff != 0)
2193                 return false;
2194
2195         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2196         if (ic == NULL) {
2197                 /* We've been asked to examine this packet, and we
2198                  * can't.  Hence, no choice but to drop.
2199                  */
2200                 duprintf("Dropping evil ICMP tinygram.\n");
2201                 *par->hotdrop = true;
2202                 return false;
2203         }
2204
2205         return icmp6_type_code_match(icmpinfo->type,
2206                                      icmpinfo->code[0],
2207                                      icmpinfo->code[1],
2208                                      ic->icmp6_type, ic->icmp6_code,
2209                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
2210 }
2211
2212 /* Called when user tries to insert an entry of this type. */
2213 static bool icmp6_checkentry(const struct xt_mtchk_param *par)
2214 {
2215         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2216
2217         /* Must specify no unknown invflags */
2218         return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
2219 }
2220
2221 /* The built-in targets: standard (NULL) and error. */
2222 static struct xt_target ip6t_standard_target __read_mostly = {
2223         .name           = IP6T_STANDARD_TARGET,
2224         .targetsize     = sizeof(int),
2225         .family         = NFPROTO_IPV6,
2226 #ifdef CONFIG_COMPAT
2227         .compatsize     = sizeof(compat_int_t),
2228         .compat_from_user = compat_standard_from_user,
2229         .compat_to_user = compat_standard_to_user,
2230 #endif
2231 };
2232
2233 static struct xt_target ip6t_error_target __read_mostly = {
2234         .name           = IP6T_ERROR_TARGET,
2235         .target         = ip6t_error,
2236         .targetsize     = IP6T_FUNCTION_MAXNAMELEN,
2237         .family         = NFPROTO_IPV6,
2238 };
2239
2240 static struct nf_sockopt_ops ip6t_sockopts = {
2241         .pf             = PF_INET6,
2242         .set_optmin     = IP6T_BASE_CTL,
2243         .set_optmax     = IP6T_SO_SET_MAX+1,
2244         .set            = do_ip6t_set_ctl,
2245 #ifdef CONFIG_COMPAT
2246         .compat_set     = compat_do_ip6t_set_ctl,
2247 #endif
2248         .get_optmin     = IP6T_BASE_CTL,
2249         .get_optmax     = IP6T_SO_GET_MAX+1,
2250         .get            = do_ip6t_get_ctl,
2251 #ifdef CONFIG_COMPAT
2252         .compat_get     = compat_do_ip6t_get_ctl,
2253 #endif
2254         .owner          = THIS_MODULE,
2255 };
2256
2257 static struct xt_match icmp6_matchstruct __read_mostly = {
2258         .name           = "icmp6",
2259         .match          = icmp6_match,
2260         .matchsize      = sizeof(struct ip6t_icmp),
2261         .checkentry     = icmp6_checkentry,
2262         .proto          = IPPROTO_ICMPV6,
2263         .family         = NFPROTO_IPV6,
2264 };
2265
2266 static int __net_init ip6_tables_net_init(struct net *net)
2267 {
2268         return xt_proto_init(net, NFPROTO_IPV6);
2269 }
2270
2271 static void __net_exit ip6_tables_net_exit(struct net *net)
2272 {
2273         xt_proto_fini(net, NFPROTO_IPV6);
2274 }
2275
2276 static struct pernet_operations ip6_tables_net_ops = {
2277         .init = ip6_tables_net_init,
2278         .exit = ip6_tables_net_exit,
2279 };
2280
2281 static int __init ip6_tables_init(void)
2282 {
2283         int ret;
2284
2285         ret = register_pernet_subsys(&ip6_tables_net_ops);
2286         if (ret < 0)
2287                 goto err1;
2288
2289         /* Noone else will be downing sem now, so we won't sleep */
2290         ret = xt_register_target(&ip6t_standard_target);
2291         if (ret < 0)
2292                 goto err2;
2293         ret = xt_register_target(&ip6t_error_target);
2294         if (ret < 0)
2295                 goto err3;
2296         ret = xt_register_match(&icmp6_matchstruct);
2297         if (ret < 0)
2298                 goto err4;
2299
2300         /* Register setsockopt */
2301         ret = nf_register_sockopt(&ip6t_sockopts);
2302         if (ret < 0)
2303                 goto err5;
2304
2305         printk(KERN_INFO "ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
2306         return 0;
2307
2308 err5:
2309         xt_unregister_match(&icmp6_matchstruct);
2310 err4:
2311         xt_unregister_target(&ip6t_error_target);
2312 err3:
2313         xt_unregister_target(&ip6t_standard_target);
2314 err2:
2315         unregister_pernet_subsys(&ip6_tables_net_ops);
2316 err1:
2317         return ret;
2318 }
2319
2320 static void __exit ip6_tables_fini(void)
2321 {
2322         nf_unregister_sockopt(&ip6t_sockopts);
2323
2324         xt_unregister_match(&icmp6_matchstruct);
2325         xt_unregister_target(&ip6t_error_target);
2326         xt_unregister_target(&ip6t_standard_target);
2327
2328         unregister_pernet_subsys(&ip6_tables_net_ops);
2329 }
2330
2331 /*
2332  * find the offset to specified header or the protocol number of last header
2333  * if target < 0. "last header" is transport protocol header, ESP, or
2334  * "No next header".
2335  *
2336  * If target header is found, its offset is set in *offset and return protocol
2337  * number. Otherwise, return -1.
2338  *
2339  * If the first fragment doesn't contain the final protocol header or
2340  * NEXTHDR_NONE it is considered invalid.
2341  *
2342  * Note that non-1st fragment is special case that "the protocol number
2343  * of last header" is "next header" field in Fragment header. In this case,
2344  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
2345  * isn't NULL.
2346  *
2347  */
2348 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
2349                   int target, unsigned short *fragoff)
2350 {
2351         unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
2352         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
2353         unsigned int len = skb->len - start;
2354
2355         if (fragoff)
2356                 *fragoff = 0;
2357
2358         while (nexthdr != target) {
2359                 struct ipv6_opt_hdr _hdr, *hp;
2360                 unsigned int hdrlen;
2361
2362                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
2363                         if (target < 0)
2364                                 break;
2365                         return -ENOENT;
2366                 }
2367
2368                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
2369                 if (hp == NULL)
2370                         return -EBADMSG;
2371                 if (nexthdr == NEXTHDR_FRAGMENT) {
2372                         unsigned short _frag_off;
2373                         __be16 *fp;
2374                         fp = skb_header_pointer(skb,
2375                                                 start+offsetof(struct frag_hdr,
2376                                                                frag_off),
2377                                                 sizeof(_frag_off),
2378                                                 &_frag_off);
2379                         if (fp == NULL)
2380                                 return -EBADMSG;
2381
2382                         _frag_off = ntohs(*fp) & ~0x7;
2383                         if (_frag_off) {
2384                                 if (target < 0 &&
2385                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
2386                                      hp->nexthdr == NEXTHDR_NONE)) {
2387                                         if (fragoff)
2388                                                 *fragoff = _frag_off;
2389                                         return hp->nexthdr;
2390                                 }
2391                                 return -ENOENT;
2392                         }
2393                         hdrlen = 8;
2394                 } else if (nexthdr == NEXTHDR_AUTH)
2395                         hdrlen = (hp->hdrlen + 2) << 2;
2396                 else
2397                         hdrlen = ipv6_optlen(hp);
2398
2399                 nexthdr = hp->nexthdr;
2400                 len -= hdrlen;
2401                 start += hdrlen;
2402         }
2403
2404         *offset = start;
2405         return nexthdr;
2406 }
2407
2408 EXPORT_SYMBOL(ip6t_register_table);
2409 EXPORT_SYMBOL(ip6t_unregister_table);
2410 EXPORT_SYMBOL(ip6t_do_table);
2411 EXPORT_SYMBOL(ip6t_ext_hdr);
2412 EXPORT_SYMBOL(ipv6_find_hdr);
2413
2414 module_init(ip6_tables_init);
2415 module_exit(ip6_tables_fini);