2 * Packet matching code.
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 #include <linux/kernel.h>
16 #include <linux/capability.h>
18 #include <linux/skbuff.h>
19 #include <linux/kmod.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netdevice.h>
22 #include <linux/module.h>
23 #include <linux/poison.h>
24 #include <linux/icmpv6.h>
26 #include <net/compat.h>
27 #include <asm/uaccess.h>
28 #include <linux/mutex.h>
29 #include <linux/proc_fs.h>
30 #include <linux/err.h>
31 #include <linux/cpumask.h>
33 #include <linux/netfilter_ipv6/ip6_tables.h>
34 #include <linux/netfilter/x_tables.h>
35 #include <net/netfilter/nf_log.h>
36 #include "../../netfilter/xt_repldata.h"
38 MODULE_LICENSE("GPL");
39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
40 MODULE_DESCRIPTION("IPv6 packet filter");
42 /*#define DEBUG_IP_FIREWALL*/
43 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
44 /*#define DEBUG_IP_FIREWALL_USER*/
46 #ifdef DEBUG_IP_FIREWALL
47 #define dprintf(format, args...) pr_info(format , ## args)
49 #define dprintf(format, args...)
52 #ifdef DEBUG_IP_FIREWALL_USER
53 #define duprintf(format, args...) pr_info(format , ## args)
55 #define duprintf(format, args...)
58 #ifdef CONFIG_NETFILTER_DEBUG
59 #define IP_NF_ASSERT(x) WARN_ON(!(x))
61 #define IP_NF_ASSERT(x)
65 /* All the better to debug you with... */
70 void *ip6t_alloc_initial_table(const struct xt_table *info)
72 return xt_alloc_initial_table(ip6t, IP6T);
74 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
77 We keep a set of rules for each CPU, so we can avoid write-locking
78 them in the softirq when updating the counters and therefore
79 only need to read-lock in the softirq; doing a write_lock_bh() in user
80 context stops packets coming through and allows user context to read
81 the counters or update the rules.
83 Hence the start of any table is given by get_table() below. */
85 /* Returns whether matches rule or not. */
86 /* Performance critical - called for every packet */
88 ip6_packet_match(const struct sk_buff *skb,
91 const struct ip6t_ip6 *ip6info,
92 unsigned int *protoff,
93 int *fragoff, bool *hotdrop)
96 const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
98 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
100 if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
101 &ip6info->src), IP6T_INV_SRCIP) ||
102 FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
103 &ip6info->dst), IP6T_INV_DSTIP)) {
104 dprintf("Source or dest mismatch.\n");
106 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
107 ipinfo->smsk.s_addr, ipinfo->src.s_addr,
108 ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
109 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
110 ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
111 ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
115 ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
117 if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
118 dprintf("VIA in mismatch (%s vs %s).%s\n",
119 indev, ip6info->iniface,
120 ip6info->invflags & IP6T_INV_VIA_IN ? " (INV)" : "");
124 ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
126 if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
127 dprintf("VIA out mismatch (%s vs %s).%s\n",
128 outdev, ip6info->outiface,
129 ip6info->invflags & IP6T_INV_VIA_OUT ? " (INV)" : "");
133 /* ... might want to do something with class and flowlabel here ... */
135 /* look for the desired protocol header */
136 if (ip6info->flags & IP6T_F_PROTO) {
138 unsigned short _frag_off;
140 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
146 *fragoff = _frag_off;
148 dprintf("Packet protocol %hi ?= %s%hi.\n",
150 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
153 if (ip6info->proto == protohdr) {
154 if (ip6info->invflags & IP6T_INV_PROTO)
160 /* We need match for the '-p all', too! */
161 if ((ip6info->proto != 0) &&
162 !(ip6info->invflags & IP6T_INV_PROTO))
168 /* should be ip6 safe */
170 ip6_checkentry(const struct ip6t_ip6 *ipv6)
172 if (ipv6->flags & ~IP6T_F_MASK) {
173 duprintf("Unknown flag bits set: %08X\n",
174 ipv6->flags & ~IP6T_F_MASK);
177 if (ipv6->invflags & ~IP6T_INV_MASK) {
178 duprintf("Unknown invflag bits set: %08X\n",
179 ipv6->invflags & ~IP6T_INV_MASK);
186 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
188 net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
193 static inline struct ip6t_entry *
194 get_entry(const void *base, unsigned int offset)
196 return (struct ip6t_entry *)(base + offset);
199 /* All zeroes == unconditional rule. */
200 /* Mildly perf critical (only if packet tracing is on) */
201 static inline bool unconditional(const struct ip6t_entry *e)
203 static const struct ip6t_ip6 uncond;
205 return e->target_offset == sizeof(struct ip6t_entry) &&
206 memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
209 static inline const struct xt_entry_target *
210 ip6t_get_target_c(const struct ip6t_entry *e)
212 return ip6t_get_target((struct ip6t_entry *)e);
215 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
216 /* This cries for unification! */
217 static const char *const hooknames[] = {
218 [NF_INET_PRE_ROUTING] = "PREROUTING",
219 [NF_INET_LOCAL_IN] = "INPUT",
220 [NF_INET_FORWARD] = "FORWARD",
221 [NF_INET_LOCAL_OUT] = "OUTPUT",
222 [NF_INET_POST_ROUTING] = "POSTROUTING",
225 enum nf_ip_trace_comments {
226 NF_IP6_TRACE_COMMENT_RULE,
227 NF_IP6_TRACE_COMMENT_RETURN,
228 NF_IP6_TRACE_COMMENT_POLICY,
231 static const char *const comments[] = {
232 [NF_IP6_TRACE_COMMENT_RULE] = "rule",
233 [NF_IP6_TRACE_COMMENT_RETURN] = "return",
234 [NF_IP6_TRACE_COMMENT_POLICY] = "policy",
237 static struct nf_loginfo trace_loginfo = {
238 .type = NF_LOG_TYPE_LOG,
241 .level = LOGLEVEL_WARNING,
242 .logflags = NF_LOG_MASK,
247 /* Mildly perf critical (only if packet tracing is on) */
249 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
250 const char *hookname, const char **chainname,
251 const char **comment, unsigned int *rulenum)
253 const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
255 if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
256 /* Head of user chain: ERROR target with chainname */
257 *chainname = t->target.data;
262 if (unconditional(s) &&
263 strcmp(t->target.u.kernel.target->name,
264 XT_STANDARD_TARGET) == 0 &&
266 /* Tail of chains: STANDARD target (return/policy) */
267 *comment = *chainname == hookname
268 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
269 : comments[NF_IP6_TRACE_COMMENT_RETURN];
278 static void trace_packet(struct net *net,
279 const struct sk_buff *skb,
281 const struct net_device *in,
282 const struct net_device *out,
283 const char *tablename,
284 const struct xt_table_info *private,
285 const struct ip6t_entry *e)
287 const struct ip6t_entry *root;
288 const char *hookname, *chainname, *comment;
289 const struct ip6t_entry *iter;
290 unsigned int rulenum = 0;
292 root = get_entry(private->entries, private->hook_entry[hook]);
294 hookname = chainname = hooknames[hook];
295 comment = comments[NF_IP6_TRACE_COMMENT_RULE];
297 xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
298 if (get_chainname_rulenum(iter, e, hookname,
299 &chainname, &comment, &rulenum) != 0)
302 nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
303 "TRACE: %s:%s:%s:%u ",
304 tablename, chainname, comment, rulenum);
308 static inline struct ip6t_entry *
309 ip6t_next_entry(const struct ip6t_entry *entry)
311 return (void *)entry + entry->next_offset;
314 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
316 ip6t_do_table(struct sk_buff *skb,
317 const struct nf_hook_state *state,
318 struct xt_table *table)
320 unsigned int hook = state->hook;
321 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
322 /* Initializing verdict to NF_DROP keeps gcc happy. */
323 unsigned int verdict = NF_DROP;
324 const char *indev, *outdev;
325 const void *table_base;
326 struct ip6t_entry *e, **jumpstack;
327 unsigned int stackidx, cpu;
328 const struct xt_table_info *private;
329 struct xt_action_param acpar;
334 indev = state->in ? state->in->name : nulldevname;
335 outdev = state->out ? state->out->name : nulldevname;
336 /* We handle fragments by dealing with the first fragment as
337 * if it was a normal packet. All other fragments are treated
338 * normally, except that they will NEVER match rules that ask
339 * things we don't know, ie. tcp syn flag or ports). If the
340 * rule is also a fragment-specific rule, non-fragments won't
342 acpar.hotdrop = false;
343 acpar.net = state->net;
344 acpar.in = state->in;
345 acpar.out = state->out;
346 acpar.family = NFPROTO_IPV6;
347 acpar.hooknum = hook;
349 IP_NF_ASSERT(table->valid_hooks & (1 << hook));
352 addend = xt_write_recseq_begin();
353 private = table->private;
355 * Ensure we load private-> members after we've fetched the base
358 smp_read_barrier_depends();
359 cpu = smp_processor_id();
360 table_base = private->entries;
361 jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
363 /* Switch to alternate jumpstack if we're being invoked via TEE.
364 * TEE issues XT_CONTINUE verdict on original skb so we must not
365 * clobber the jumpstack.
367 * For recursion via REJECT or SYNPROXY the stack will be clobbered
368 * but it is no problem since absolute verdict is issued by these.
370 if (static_key_false(&xt_tee_enabled))
371 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
373 e = get_entry(table_base, private->hook_entry[hook]);
376 const struct xt_entry_target *t;
377 const struct xt_entry_match *ematch;
378 struct xt_counters *counter;
382 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
383 &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
385 e = ip6t_next_entry(e);
389 xt_ematch_foreach(ematch, e) {
390 acpar.match = ematch->u.kernel.match;
391 acpar.matchinfo = ematch->data;
392 if (!acpar.match->match(skb, &acpar))
396 counter = xt_get_this_cpu_counter(&e->counters);
397 ADD_COUNTER(*counter, skb->len, 1);
399 t = ip6t_get_target_c(e);
400 IP_NF_ASSERT(t->u.kernel.target);
402 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
403 /* The packet is traced: log it */
404 if (unlikely(skb->nf_trace))
405 trace_packet(state->net, skb, hook, state->in,
406 state->out, table->name, private, e);
408 /* Standard target? */
409 if (!t->u.kernel.target->target) {
412 v = ((struct xt_standard_target *)t)->verdict;
414 /* Pop from stack? */
415 if (v != XT_RETURN) {
416 verdict = (unsigned int)(-v) - 1;
420 e = get_entry(table_base,
421 private->underflow[hook]);
423 e = ip6t_next_entry(jumpstack[--stackidx]);
426 if (table_base + v != ip6t_next_entry(e) &&
427 !(e->ipv6.flags & IP6T_F_GOTO)) {
428 jumpstack[stackidx++] = e;
431 e = get_entry(table_base, v);
435 acpar.target = t->u.kernel.target;
436 acpar.targinfo = t->data;
438 verdict = t->u.kernel.target->target(skb, &acpar);
439 if (verdict == XT_CONTINUE)
440 e = ip6t_next_entry(e);
444 } while (!acpar.hotdrop);
446 xt_write_recseq_end(addend);
449 #ifdef DEBUG_ALLOW_ALL
458 static bool find_jump_target(const struct xt_table_info *t,
459 const struct ip6t_entry *target)
461 struct ip6t_entry *iter;
463 xt_entry_foreach(iter, t->entries, t->size) {
470 /* Figures out from what hook each rule can be called: returns 0 if
471 there are loops. Puts hook bitmask in comefrom. */
473 mark_source_chains(const struct xt_table_info *newinfo,
474 unsigned int valid_hooks, void *entry0)
478 /* No recursion; use packet counter to save back ptrs (reset
479 to 0 as we leave), and comefrom to save source hook bitmask */
480 for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
481 unsigned int pos = newinfo->hook_entry[hook];
482 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
484 if (!(valid_hooks & (1 << hook)))
487 /* Set initial back pointer. */
488 e->counters.pcnt = pos;
491 const struct xt_standard_target *t
492 = (void *)ip6t_get_target_c(e);
493 int visited = e->comefrom & (1 << hook);
495 if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
496 pr_err("iptables: loop hook %u pos %u %08X.\n",
497 hook, pos, e->comefrom);
500 e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
502 /* Unconditional return/END. */
503 if ((unconditional(e) &&
504 (strcmp(t->target.u.user.name,
505 XT_STANDARD_TARGET) == 0) &&
506 t->verdict < 0) || visited) {
507 unsigned int oldpos, size;
509 if ((strcmp(t->target.u.user.name,
510 XT_STANDARD_TARGET) == 0) &&
511 t->verdict < -NF_MAX_VERDICT - 1) {
512 duprintf("mark_source_chains: bad "
513 "negative verdict (%i)\n",
518 /* Return: backtrack through the last
521 e->comefrom ^= (1<<NF_INET_NUMHOOKS);
522 #ifdef DEBUG_IP_FIREWALL_USER
524 & (1 << NF_INET_NUMHOOKS)) {
525 duprintf("Back unset "
532 pos = e->counters.pcnt;
533 e->counters.pcnt = 0;
535 /* We're at the start. */
539 e = (struct ip6t_entry *)
541 } while (oldpos == pos + e->next_offset);
544 size = e->next_offset;
545 e = (struct ip6t_entry *)
546 (entry0 + pos + size);
547 if (pos + size >= newinfo->size)
549 e->counters.pcnt = pos;
552 int newpos = t->verdict;
554 if (strcmp(t->target.u.user.name,
555 XT_STANDARD_TARGET) == 0 &&
557 if (newpos > newinfo->size -
558 sizeof(struct ip6t_entry)) {
559 duprintf("mark_source_chains: "
560 "bad verdict (%i)\n",
564 /* This a jump; chase it. */
565 duprintf("Jump rule %u -> %u\n",
567 e = (struct ip6t_entry *)
569 if (!find_jump_target(newinfo, e))
572 /* ... this is a fallthru */
573 newpos = pos + e->next_offset;
574 if (newpos >= newinfo->size)
577 e = (struct ip6t_entry *)
579 e->counters.pcnt = pos;
584 duprintf("Finished chain %u\n", hook);
589 static void cleanup_match(struct xt_entry_match *m, struct net *net)
591 struct xt_mtdtor_param par;
594 par.match = m->u.kernel.match;
595 par.matchinfo = m->data;
596 par.family = NFPROTO_IPV6;
597 if (par.match->destroy != NULL)
598 par.match->destroy(&par);
599 module_put(par.match->me);
602 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
604 const struct ip6t_ip6 *ipv6 = par->entryinfo;
607 par->match = m->u.kernel.match;
608 par->matchinfo = m->data;
610 ret = xt_check_match(par, m->u.match_size - sizeof(*m),
611 ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
613 duprintf("ip_tables: check failed for `%s'.\n",
621 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
623 struct xt_match *match;
626 match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
629 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
630 return PTR_ERR(match);
632 m->u.kernel.match = match;
634 ret = check_match(m, par);
640 module_put(m->u.kernel.match->me);
644 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
646 struct xt_entry_target *t = ip6t_get_target(e);
647 struct xt_tgchk_param par = {
651 .target = t->u.kernel.target,
653 .hook_mask = e->comefrom,
654 .family = NFPROTO_IPV6,
658 t = ip6t_get_target(e);
659 ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
660 e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
662 duprintf("ip_tables: check failed for `%s'.\n",
663 t->u.kernel.target->name);
670 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
673 struct xt_entry_target *t;
674 struct xt_target *target;
677 struct xt_mtchk_param mtpar;
678 struct xt_entry_match *ematch;
680 e->counters.pcnt = xt_percpu_counter_alloc();
681 if (IS_ERR_VALUE(e->counters.pcnt))
687 mtpar.entryinfo = &e->ipv6;
688 mtpar.hook_mask = e->comefrom;
689 mtpar.family = NFPROTO_IPV6;
690 xt_ematch_foreach(ematch, e) {
691 ret = find_check_match(ematch, &mtpar);
693 goto cleanup_matches;
697 t = ip6t_get_target(e);
698 target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
700 if (IS_ERR(target)) {
701 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
702 ret = PTR_ERR(target);
703 goto cleanup_matches;
705 t->u.kernel.target = target;
707 ret = check_target(e, net, name);
712 module_put(t->u.kernel.target->me);
714 xt_ematch_foreach(ematch, e) {
717 cleanup_match(ematch, net);
720 xt_percpu_counter_free(e->counters.pcnt);
725 static bool check_underflow(const struct ip6t_entry *e)
727 const struct xt_entry_target *t;
728 unsigned int verdict;
730 if (!unconditional(e))
732 t = ip6t_get_target_c(e);
733 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
735 verdict = ((struct xt_standard_target *)t)->verdict;
736 verdict = -verdict - 1;
737 return verdict == NF_DROP || verdict == NF_ACCEPT;
741 check_entry_size_and_hooks(struct ip6t_entry *e,
742 struct xt_table_info *newinfo,
743 const unsigned char *base,
744 const unsigned char *limit,
745 const unsigned int *hook_entries,
746 const unsigned int *underflows,
747 unsigned int valid_hooks)
752 if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
753 (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
754 (unsigned char *)e + e->next_offset > limit) {
755 duprintf("Bad offset %p\n", e);
760 < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target)) {
761 duprintf("checking: element %p size %u\n",
766 if (!ip6_checkentry(&e->ipv6))
769 err = xt_check_entry_offsets(e, e->target_offset, e->next_offset);
773 /* Check hooks & underflows */
774 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
775 if (!(valid_hooks & (1 << h)))
777 if ((unsigned char *)e - base == hook_entries[h])
778 newinfo->hook_entry[h] = hook_entries[h];
779 if ((unsigned char *)e - base == underflows[h]) {
780 if (!check_underflow(e)) {
781 pr_debug("Underflows must be unconditional and "
782 "use the STANDARD target with "
786 newinfo->underflow[h] = underflows[h];
790 /* Clear counters and comefrom */
791 e->counters = ((struct xt_counters) { 0, 0 });
796 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
798 struct xt_tgdtor_param par;
799 struct xt_entry_target *t;
800 struct xt_entry_match *ematch;
802 /* Cleanup all matches */
803 xt_ematch_foreach(ematch, e)
804 cleanup_match(ematch, net);
805 t = ip6t_get_target(e);
808 par.target = t->u.kernel.target;
809 par.targinfo = t->data;
810 par.family = NFPROTO_IPV6;
811 if (par.target->destroy != NULL)
812 par.target->destroy(&par);
813 module_put(par.target->me);
815 xt_percpu_counter_free(e->counters.pcnt);
818 /* Checks and translates the user-supplied table segment (held in
821 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
822 const struct ip6t_replace *repl)
824 struct ip6t_entry *iter;
828 newinfo->size = repl->size;
829 newinfo->number = repl->num_entries;
831 /* Init all hooks to impossible value. */
832 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
833 newinfo->hook_entry[i] = 0xFFFFFFFF;
834 newinfo->underflow[i] = 0xFFFFFFFF;
837 duprintf("translate_table: size %u\n", newinfo->size);
839 /* Walk through entries, checking offsets. */
840 xt_entry_foreach(iter, entry0, newinfo->size) {
841 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
849 if (strcmp(ip6t_get_target(iter)->u.user.name,
850 XT_ERROR_TARGET) == 0)
851 ++newinfo->stacksize;
854 if (i != repl->num_entries) {
855 duprintf("translate_table: %u not %u entries\n",
856 i, repl->num_entries);
860 /* Check hooks all assigned */
861 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
862 /* Only hooks which are valid */
863 if (!(repl->valid_hooks & (1 << i)))
865 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
866 duprintf("Invalid hook entry %u %u\n",
867 i, repl->hook_entry[i]);
870 if (newinfo->underflow[i] == 0xFFFFFFFF) {
871 duprintf("Invalid underflow %u %u\n",
872 i, repl->underflow[i]);
877 if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
880 /* Finally, each sanity check must pass */
882 xt_entry_foreach(iter, entry0, newinfo->size) {
883 ret = find_check_entry(iter, net, repl->name, repl->size);
890 xt_entry_foreach(iter, entry0, newinfo->size) {
893 cleanup_entry(iter, net);
902 get_counters(const struct xt_table_info *t,
903 struct xt_counters counters[])
905 struct ip6t_entry *iter;
909 for_each_possible_cpu(cpu) {
910 seqcount_t *s = &per_cpu(xt_recseq, cpu);
913 xt_entry_foreach(iter, t->entries, t->size) {
914 struct xt_counters *tmp;
918 tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
920 start = read_seqcount_begin(s);
923 } while (read_seqcount_retry(s, start));
925 ADD_COUNTER(counters[i], bcnt, pcnt);
931 static struct xt_counters *alloc_counters(const struct xt_table *table)
933 unsigned int countersize;
934 struct xt_counters *counters;
935 const struct xt_table_info *private = table->private;
937 /* We need atomic snapshot of counters: rest doesn't change
938 (other than comefrom, which userspace doesn't care
940 countersize = sizeof(struct xt_counters) * private->number;
941 counters = vzalloc(countersize);
943 if (counters == NULL)
944 return ERR_PTR(-ENOMEM);
946 get_counters(private, counters);
952 copy_entries_to_user(unsigned int total_size,
953 const struct xt_table *table,
954 void __user *userptr)
956 unsigned int off, num;
957 const struct ip6t_entry *e;
958 struct xt_counters *counters;
959 const struct xt_table_info *private = table->private;
961 const void *loc_cpu_entry;
963 counters = alloc_counters(table);
964 if (IS_ERR(counters))
965 return PTR_ERR(counters);
967 loc_cpu_entry = private->entries;
968 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
973 /* FIXME: use iterator macros --RR */
974 /* ... then go back and fix counters and names */
975 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
977 const struct xt_entry_match *m;
978 const struct xt_entry_target *t;
980 e = (struct ip6t_entry *)(loc_cpu_entry + off);
981 if (copy_to_user(userptr + off
982 + offsetof(struct ip6t_entry, counters),
984 sizeof(counters[num])) != 0) {
989 for (i = sizeof(struct ip6t_entry);
990 i < e->target_offset;
991 i += m->u.match_size) {
994 if (copy_to_user(userptr + off + i
995 + offsetof(struct xt_entry_match,
997 m->u.kernel.match->name,
998 strlen(m->u.kernel.match->name)+1)
1005 t = ip6t_get_target_c(e);
1006 if (copy_to_user(userptr + off + e->target_offset
1007 + offsetof(struct xt_entry_target,
1009 t->u.kernel.target->name,
1010 strlen(t->u.kernel.target->name)+1) != 0) {
1021 #ifdef CONFIG_COMPAT
1022 static void compat_standard_from_user(void *dst, const void *src)
1024 int v = *(compat_int_t *)src;
1027 v += xt_compat_calc_jump(AF_INET6, v);
1028 memcpy(dst, &v, sizeof(v));
1031 static int compat_standard_to_user(void __user *dst, const void *src)
1033 compat_int_t cv = *(int *)src;
1036 cv -= xt_compat_calc_jump(AF_INET6, cv);
1037 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1040 static int compat_calc_entry(const struct ip6t_entry *e,
1041 const struct xt_table_info *info,
1042 const void *base, struct xt_table_info *newinfo)
1044 const struct xt_entry_match *ematch;
1045 const struct xt_entry_target *t;
1046 unsigned int entry_offset;
1049 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1050 entry_offset = (void *)e - base;
1051 xt_ematch_foreach(ematch, e)
1052 off += xt_compat_match_offset(ematch->u.kernel.match);
1053 t = ip6t_get_target_c(e);
1054 off += xt_compat_target_offset(t->u.kernel.target);
1055 newinfo->size -= off;
1056 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1060 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1061 if (info->hook_entry[i] &&
1062 (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1063 newinfo->hook_entry[i] -= off;
1064 if (info->underflow[i] &&
1065 (e < (struct ip6t_entry *)(base + info->underflow[i])))
1066 newinfo->underflow[i] -= off;
1071 static int compat_table_info(const struct xt_table_info *info,
1072 struct xt_table_info *newinfo)
1074 struct ip6t_entry *iter;
1075 const void *loc_cpu_entry;
1078 if (!newinfo || !info)
1081 /* we dont care about newinfo->entries */
1082 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1083 newinfo->initial_entries = 0;
1084 loc_cpu_entry = info->entries;
1085 xt_compat_init_offsets(AF_INET6, info->number);
1086 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1087 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1095 static int get_info(struct net *net, void __user *user,
1096 const int *len, int compat)
1098 char name[XT_TABLE_MAXNAMELEN];
1102 if (*len != sizeof(struct ip6t_getinfo)) {
1103 duprintf("length %u != %zu\n", *len,
1104 sizeof(struct ip6t_getinfo));
1108 if (copy_from_user(name, user, sizeof(name)) != 0)
1111 name[XT_TABLE_MAXNAMELEN-1] = '\0';
1112 #ifdef CONFIG_COMPAT
1114 xt_compat_lock(AF_INET6);
1116 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1117 "ip6table_%s", name);
1118 if (!IS_ERR_OR_NULL(t)) {
1119 struct ip6t_getinfo info;
1120 const struct xt_table_info *private = t->private;
1121 #ifdef CONFIG_COMPAT
1122 struct xt_table_info tmp;
1125 ret = compat_table_info(private, &tmp);
1126 xt_compat_flush_offsets(AF_INET6);
1130 memset(&info, 0, sizeof(info));
1131 info.valid_hooks = t->valid_hooks;
1132 memcpy(info.hook_entry, private->hook_entry,
1133 sizeof(info.hook_entry));
1134 memcpy(info.underflow, private->underflow,
1135 sizeof(info.underflow));
1136 info.num_entries = private->number;
1137 info.size = private->size;
1138 strcpy(info.name, name);
1140 if (copy_to_user(user, &info, *len) != 0)
1148 ret = t ? PTR_ERR(t) : -ENOENT;
1149 #ifdef CONFIG_COMPAT
1151 xt_compat_unlock(AF_INET6);
1157 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1161 struct ip6t_get_entries get;
1164 if (*len < sizeof(get)) {
1165 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1168 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1170 if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1171 duprintf("get_entries: %u != %zu\n",
1172 *len, sizeof(get) + get.size);
1176 t = xt_find_table_lock(net, AF_INET6, get.name);
1177 if (!IS_ERR_OR_NULL(t)) {
1178 struct xt_table_info *private = t->private;
1179 duprintf("t->private->number = %u\n", private->number);
1180 if (get.size == private->size)
1181 ret = copy_entries_to_user(private->size,
1182 t, uptr->entrytable);
1184 duprintf("get_entries: I've got %u not %u!\n",
1185 private->size, get.size);
1191 ret = t ? PTR_ERR(t) : -ENOENT;
1197 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1198 struct xt_table_info *newinfo, unsigned int num_counters,
1199 void __user *counters_ptr)
1203 struct xt_table_info *oldinfo;
1204 struct xt_counters *counters;
1205 struct ip6t_entry *iter;
1208 counters = vzalloc(num_counters * sizeof(struct xt_counters));
1214 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1215 "ip6table_%s", name);
1216 if (IS_ERR_OR_NULL(t)) {
1217 ret = t ? PTR_ERR(t) : -ENOENT;
1218 goto free_newinfo_counters_untrans;
1222 if (valid_hooks != t->valid_hooks) {
1223 duprintf("Valid hook crap: %08X vs %08X\n",
1224 valid_hooks, t->valid_hooks);
1229 oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1233 /* Update module usage count based on number of rules */
1234 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1235 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1236 if ((oldinfo->number > oldinfo->initial_entries) ||
1237 (newinfo->number <= oldinfo->initial_entries))
1239 if ((oldinfo->number > oldinfo->initial_entries) &&
1240 (newinfo->number <= oldinfo->initial_entries))
1243 /* Get the old counters, and synchronize with replace */
1244 get_counters(oldinfo, counters);
1246 /* Decrease module usage counts and free resource */
1247 xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1248 cleanup_entry(iter, net);
1250 xt_free_table_info(oldinfo);
1251 if (copy_to_user(counters_ptr, counters,
1252 sizeof(struct xt_counters) * num_counters) != 0) {
1253 /* Silent error, can't fail, new table is already in place */
1254 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1263 free_newinfo_counters_untrans:
1270 do_replace(struct net *net, const void __user *user, unsigned int len)
1273 struct ip6t_replace tmp;
1274 struct xt_table_info *newinfo;
1275 void *loc_cpu_entry;
1276 struct ip6t_entry *iter;
1278 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1281 /* overflow check */
1282 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1284 if (tmp.num_counters == 0)
1287 tmp.name[sizeof(tmp.name)-1] = 0;
1289 newinfo = xt_alloc_table_info(tmp.size);
1293 loc_cpu_entry = newinfo->entries;
1294 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1300 ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1304 duprintf("ip_tables: Translated table\n");
1306 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1307 tmp.num_counters, tmp.counters);
1309 goto free_newinfo_untrans;
1312 free_newinfo_untrans:
1313 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1314 cleanup_entry(iter, net);
1316 xt_free_table_info(newinfo);
1321 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1325 struct xt_counters_info tmp;
1326 struct xt_counters *paddc;
1327 unsigned int num_counters;
1332 const struct xt_table_info *private;
1334 struct ip6t_entry *iter;
1335 unsigned int addend;
1336 #ifdef CONFIG_COMPAT
1337 struct compat_xt_counters_info compat_tmp;
1341 size = sizeof(struct compat_xt_counters_info);
1346 size = sizeof(struct xt_counters_info);
1349 if (copy_from_user(ptmp, user, size) != 0)
1352 #ifdef CONFIG_COMPAT
1354 num_counters = compat_tmp.num_counters;
1355 name = compat_tmp.name;
1359 num_counters = tmp.num_counters;
1363 if (len != size + num_counters * sizeof(struct xt_counters))
1366 paddc = vmalloc(len - size);
1370 if (copy_from_user(paddc, user + size, len - size) != 0) {
1375 t = xt_find_table_lock(net, AF_INET6, name);
1376 if (IS_ERR_OR_NULL(t)) {
1377 ret = t ? PTR_ERR(t) : -ENOENT;
1382 private = t->private;
1383 if (private->number != num_counters) {
1385 goto unlock_up_free;
1389 addend = xt_write_recseq_begin();
1390 xt_entry_foreach(iter, private->entries, private->size) {
1391 struct xt_counters *tmp;
1393 tmp = xt_get_this_cpu_counter(&iter->counters);
1394 ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1397 xt_write_recseq_end(addend);
1408 #ifdef CONFIG_COMPAT
1409 struct compat_ip6t_replace {
1410 char name[XT_TABLE_MAXNAMELEN];
1414 u32 hook_entry[NF_INET_NUMHOOKS];
1415 u32 underflow[NF_INET_NUMHOOKS];
1417 compat_uptr_t counters; /* struct xt_counters * */
1418 struct compat_ip6t_entry entries[0];
1422 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1423 unsigned int *size, struct xt_counters *counters,
1426 struct xt_entry_target *t;
1427 struct compat_ip6t_entry __user *ce;
1428 u_int16_t target_offset, next_offset;
1429 compat_uint_t origsize;
1430 const struct xt_entry_match *ematch;
1434 ce = (struct compat_ip6t_entry __user *)*dstptr;
1435 if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1436 copy_to_user(&ce->counters, &counters[i],
1437 sizeof(counters[i])) != 0)
1440 *dstptr += sizeof(struct compat_ip6t_entry);
1441 *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1443 xt_ematch_foreach(ematch, e) {
1444 ret = xt_compat_match_to_user(ematch, dstptr, size);
1448 target_offset = e->target_offset - (origsize - *size);
1449 t = ip6t_get_target(e);
1450 ret = xt_compat_target_to_user(t, dstptr, size);
1453 next_offset = e->next_offset - (origsize - *size);
1454 if (put_user(target_offset, &ce->target_offset) != 0 ||
1455 put_user(next_offset, &ce->next_offset) != 0)
1461 compat_find_calc_match(struct xt_entry_match *m,
1463 const struct ip6t_ip6 *ipv6,
1466 struct xt_match *match;
1468 match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1469 m->u.user.revision);
1470 if (IS_ERR(match)) {
1471 duprintf("compat_check_calc_match: `%s' not found\n",
1473 return PTR_ERR(match);
1475 m->u.kernel.match = match;
1476 *size += xt_compat_match_offset(match);
1480 static void compat_release_entry(struct compat_ip6t_entry *e)
1482 struct xt_entry_target *t;
1483 struct xt_entry_match *ematch;
1485 /* Cleanup all matches */
1486 xt_ematch_foreach(ematch, e)
1487 module_put(ematch->u.kernel.match->me);
1488 t = compat_ip6t_get_target(e);
1489 module_put(t->u.kernel.target->me);
1493 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1494 struct xt_table_info *newinfo,
1496 const unsigned char *base,
1497 const unsigned char *limit,
1498 const unsigned int *hook_entries,
1499 const unsigned int *underflows,
1502 struct xt_entry_match *ematch;
1503 struct xt_entry_target *t;
1504 struct xt_target *target;
1505 unsigned int entry_offset;
1509 duprintf("check_compat_entry_size_and_hooks %p\n", e);
1510 if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1511 (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
1512 (unsigned char *)e + e->next_offset > limit) {
1513 duprintf("Bad offset %p, limit = %p\n", e, limit);
1517 if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1518 sizeof(struct compat_xt_entry_target)) {
1519 duprintf("checking: element %p size %u\n",
1524 if (!ip6_checkentry(&e->ipv6))
1527 ret = xt_check_entry_offsets(e, e->target_offset, e->next_offset);
1531 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1532 entry_offset = (void *)e - (void *)base;
1534 xt_ematch_foreach(ematch, e) {
1535 ret = compat_find_calc_match(ematch, name, &e->ipv6, &off);
1537 goto release_matches;
1541 t = compat_ip6t_get_target(e);
1542 target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1543 t->u.user.revision);
1544 if (IS_ERR(target)) {
1545 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1547 ret = PTR_ERR(target);
1548 goto release_matches;
1550 t->u.kernel.target = target;
1552 off += xt_compat_target_offset(target);
1554 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1558 /* Check hooks & underflows */
1559 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1560 if ((unsigned char *)e - base == hook_entries[h])
1561 newinfo->hook_entry[h] = hook_entries[h];
1562 if ((unsigned char *)e - base == underflows[h])
1563 newinfo->underflow[h] = underflows[h];
1566 /* Clear counters and comefrom */
1567 memset(&e->counters, 0, sizeof(e->counters));
1572 module_put(t->u.kernel.target->me);
1574 xt_ematch_foreach(ematch, e) {
1577 module_put(ematch->u.kernel.match->me);
1583 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1584 unsigned int *size, const char *name,
1585 struct xt_table_info *newinfo, unsigned char *base)
1587 struct xt_entry_target *t;
1588 struct ip6t_entry *de;
1589 unsigned int origsize;
1591 struct xt_entry_match *ematch;
1595 de = (struct ip6t_entry *)*dstptr;
1596 memcpy(de, e, sizeof(struct ip6t_entry));
1597 memcpy(&de->counters, &e->counters, sizeof(e->counters));
1599 *dstptr += sizeof(struct ip6t_entry);
1600 *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1602 xt_ematch_foreach(ematch, e) {
1603 ret = xt_compat_match_from_user(ematch, dstptr, size);
1607 de->target_offset = e->target_offset - (origsize - *size);
1608 t = compat_ip6t_get_target(e);
1609 xt_compat_target_from_user(t, dstptr, size);
1611 de->next_offset = e->next_offset - (origsize - *size);
1612 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1613 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1614 newinfo->hook_entry[h] -= origsize - *size;
1615 if ((unsigned char *)de - base < newinfo->underflow[h])
1616 newinfo->underflow[h] -= origsize - *size;
1621 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1626 struct xt_mtchk_param mtpar;
1627 struct xt_entry_match *ematch;
1629 e->counters.pcnt = xt_percpu_counter_alloc();
1630 if (IS_ERR_VALUE(e->counters.pcnt))
1635 mtpar.entryinfo = &e->ipv6;
1636 mtpar.hook_mask = e->comefrom;
1637 mtpar.family = NFPROTO_IPV6;
1638 xt_ematch_foreach(ematch, e) {
1639 ret = check_match(ematch, &mtpar);
1641 goto cleanup_matches;
1645 ret = check_target(e, net, name);
1647 goto cleanup_matches;
1651 xt_ematch_foreach(ematch, e) {
1654 cleanup_match(ematch, net);
1657 xt_percpu_counter_free(e->counters.pcnt);
1663 translate_compat_table(struct net *net,
1665 unsigned int valid_hooks,
1666 struct xt_table_info **pinfo,
1668 unsigned int total_size,
1669 unsigned int number,
1670 unsigned int *hook_entries,
1671 unsigned int *underflows)
1674 struct xt_table_info *newinfo, *info;
1675 void *pos, *entry0, *entry1;
1676 struct compat_ip6t_entry *iter0;
1677 struct ip6t_entry *iter1;
1684 info->number = number;
1686 /* Init all hooks to impossible value. */
1687 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1688 info->hook_entry[i] = 0xFFFFFFFF;
1689 info->underflow[i] = 0xFFFFFFFF;
1692 duprintf("translate_compat_table: size %u\n", info->size);
1694 xt_compat_lock(AF_INET6);
1695 xt_compat_init_offsets(AF_INET6, number);
1696 /* Walk through entries, checking offsets. */
1697 xt_entry_foreach(iter0, entry0, total_size) {
1698 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1700 entry0 + total_size,
1711 duprintf("translate_compat_table: %u not %u entries\n",
1716 /* Check hooks all assigned */
1717 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1718 /* Only hooks which are valid */
1719 if (!(valid_hooks & (1 << i)))
1721 if (info->hook_entry[i] == 0xFFFFFFFF) {
1722 duprintf("Invalid hook entry %u %u\n",
1723 i, hook_entries[i]);
1726 if (info->underflow[i] == 0xFFFFFFFF) {
1727 duprintf("Invalid underflow %u %u\n",
1734 newinfo = xt_alloc_table_info(size);
1738 newinfo->number = number;
1739 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1740 newinfo->hook_entry[i] = info->hook_entry[i];
1741 newinfo->underflow[i] = info->underflow[i];
1743 entry1 = newinfo->entries;
1746 xt_entry_foreach(iter0, entry0, total_size) {
1747 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1748 name, newinfo, entry1);
1752 xt_compat_flush_offsets(AF_INET6);
1753 xt_compat_unlock(AF_INET6);
1758 if (!mark_source_chains(newinfo, valid_hooks, entry1))
1762 xt_entry_foreach(iter1, entry1, newinfo->size) {
1763 ret = compat_check_entry(iter1, net, name);
1767 if (strcmp(ip6t_get_target(iter1)->u.user.name,
1768 XT_ERROR_TARGET) == 0)
1769 ++newinfo->stacksize;
1773 * The first i matches need cleanup_entry (calls ->destroy)
1774 * because they had called ->check already. The other j-i
1775 * entries need only release.
1779 xt_entry_foreach(iter0, entry0, newinfo->size) {
1784 compat_release_entry(iter0);
1786 xt_entry_foreach(iter1, entry1, newinfo->size) {
1789 cleanup_entry(iter1, net);
1791 xt_free_table_info(newinfo);
1797 xt_free_table_info(info);
1801 xt_free_table_info(newinfo);
1803 xt_entry_foreach(iter0, entry0, total_size) {
1806 compat_release_entry(iter0);
1810 xt_compat_flush_offsets(AF_INET6);
1811 xt_compat_unlock(AF_INET6);
1816 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1819 struct compat_ip6t_replace tmp;
1820 struct xt_table_info *newinfo;
1821 void *loc_cpu_entry;
1822 struct ip6t_entry *iter;
1824 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1827 /* overflow check */
1828 if (tmp.size >= INT_MAX / num_possible_cpus())
1830 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1832 if (tmp.num_counters == 0)
1835 tmp.name[sizeof(tmp.name)-1] = 0;
1837 newinfo = xt_alloc_table_info(tmp.size);
1841 loc_cpu_entry = newinfo->entries;
1842 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1848 ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1849 &newinfo, &loc_cpu_entry, tmp.size,
1850 tmp.num_entries, tmp.hook_entry,
1855 duprintf("compat_do_replace: Translated table\n");
1857 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1858 tmp.num_counters, compat_ptr(tmp.counters));
1860 goto free_newinfo_untrans;
1863 free_newinfo_untrans:
1864 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1865 cleanup_entry(iter, net);
1867 xt_free_table_info(newinfo);
1872 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1877 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1881 case IP6T_SO_SET_REPLACE:
1882 ret = compat_do_replace(sock_net(sk), user, len);
1885 case IP6T_SO_SET_ADD_COUNTERS:
1886 ret = do_add_counters(sock_net(sk), user, len, 1);
1890 duprintf("do_ip6t_set_ctl: unknown request %i\n", cmd);
1897 struct compat_ip6t_get_entries {
1898 char name[XT_TABLE_MAXNAMELEN];
1900 struct compat_ip6t_entry entrytable[0];
1904 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1905 void __user *userptr)
1907 struct xt_counters *counters;
1908 const struct xt_table_info *private = table->private;
1913 struct ip6t_entry *iter;
1915 counters = alloc_counters(table);
1916 if (IS_ERR(counters))
1917 return PTR_ERR(counters);
1921 xt_entry_foreach(iter, private->entries, total_size) {
1922 ret = compat_copy_entry_to_user(iter, &pos,
1923 &size, counters, i++);
1933 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1937 struct compat_ip6t_get_entries get;
1940 if (*len < sizeof(get)) {
1941 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1945 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1948 if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1949 duprintf("compat_get_entries: %u != %zu\n",
1950 *len, sizeof(get) + get.size);
1954 xt_compat_lock(AF_INET6);
1955 t = xt_find_table_lock(net, AF_INET6, get.name);
1956 if (!IS_ERR_OR_NULL(t)) {
1957 const struct xt_table_info *private = t->private;
1958 struct xt_table_info info;
1959 duprintf("t->private->number = %u\n", private->number);
1960 ret = compat_table_info(private, &info);
1961 if (!ret && get.size == info.size) {
1962 ret = compat_copy_entries_to_user(private->size,
1963 t, uptr->entrytable);
1965 duprintf("compat_get_entries: I've got %u not %u!\n",
1966 private->size, get.size);
1969 xt_compat_flush_offsets(AF_INET6);
1973 ret = t ? PTR_ERR(t) : -ENOENT;
1975 xt_compat_unlock(AF_INET6);
1979 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1982 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1986 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1990 case IP6T_SO_GET_INFO:
1991 ret = get_info(sock_net(sk), user, len, 1);
1993 case IP6T_SO_GET_ENTRIES:
1994 ret = compat_get_entries(sock_net(sk), user, len);
1997 ret = do_ip6t_get_ctl(sk, cmd, user, len);
2004 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2008 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2012 case IP6T_SO_SET_REPLACE:
2013 ret = do_replace(sock_net(sk), user, len);
2016 case IP6T_SO_SET_ADD_COUNTERS:
2017 ret = do_add_counters(sock_net(sk), user, len, 0);
2021 duprintf("do_ip6t_set_ctl: unknown request %i\n", cmd);
2029 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2033 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2037 case IP6T_SO_GET_INFO:
2038 ret = get_info(sock_net(sk), user, len, 0);
2041 case IP6T_SO_GET_ENTRIES:
2042 ret = get_entries(sock_net(sk), user, len);
2045 case IP6T_SO_GET_REVISION_MATCH:
2046 case IP6T_SO_GET_REVISION_TARGET: {
2047 struct xt_get_revision rev;
2050 if (*len != sizeof(rev)) {
2054 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2058 rev.name[sizeof(rev.name)-1] = 0;
2060 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2065 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2068 "ip6t_%s", rev.name);
2073 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2080 struct xt_table *ip6t_register_table(struct net *net,
2081 const struct xt_table *table,
2082 const struct ip6t_replace *repl)
2085 struct xt_table_info *newinfo;
2086 struct xt_table_info bootstrap = {0};
2087 void *loc_cpu_entry;
2088 struct xt_table *new_table;
2090 newinfo = xt_alloc_table_info(repl->size);
2096 loc_cpu_entry = newinfo->entries;
2097 memcpy(loc_cpu_entry, repl->entries, repl->size);
2099 ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2103 new_table = xt_register_table(net, table, &bootstrap, newinfo);
2104 if (IS_ERR(new_table)) {
2105 ret = PTR_ERR(new_table);
2111 xt_free_table_info(newinfo);
2113 return ERR_PTR(ret);
2116 void ip6t_unregister_table(struct net *net, struct xt_table *table)
2118 struct xt_table_info *private;
2119 void *loc_cpu_entry;
2120 struct module *table_owner = table->me;
2121 struct ip6t_entry *iter;
2123 private = xt_unregister_table(table);
2125 /* Decrease module usage counts and free resources */
2126 loc_cpu_entry = private->entries;
2127 xt_entry_foreach(iter, loc_cpu_entry, private->size)
2128 cleanup_entry(iter, net);
2129 if (private->number > private->initial_entries)
2130 module_put(table_owner);
2131 xt_free_table_info(private);
2134 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2136 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2137 u_int8_t type, u_int8_t code,
2140 return (type == test_type && code >= min_code && code <= max_code)
2145 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
2147 const struct icmp6hdr *ic;
2148 struct icmp6hdr _icmph;
2149 const struct ip6t_icmp *icmpinfo = par->matchinfo;
2151 /* Must not be a fragment. */
2152 if (par->fragoff != 0)
2155 ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2157 /* We've been asked to examine this packet, and we
2158 * can't. Hence, no choice but to drop.
2160 duprintf("Dropping evil ICMP tinygram.\n");
2161 par->hotdrop = true;
2165 return icmp6_type_code_match(icmpinfo->type,
2168 ic->icmp6_type, ic->icmp6_code,
2169 !!(icmpinfo->invflags&IP6T_ICMP_INV));
2172 /* Called when user tries to insert an entry of this type. */
2173 static int icmp6_checkentry(const struct xt_mtchk_param *par)
2175 const struct ip6t_icmp *icmpinfo = par->matchinfo;
2177 /* Must specify no unknown invflags */
2178 return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
2181 /* The built-in targets: standard (NULL) and error. */
2182 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
2184 .name = XT_STANDARD_TARGET,
2185 .targetsize = sizeof(int),
2186 .family = NFPROTO_IPV6,
2187 #ifdef CONFIG_COMPAT
2188 .compatsize = sizeof(compat_int_t),
2189 .compat_from_user = compat_standard_from_user,
2190 .compat_to_user = compat_standard_to_user,
2194 .name = XT_ERROR_TARGET,
2195 .target = ip6t_error,
2196 .targetsize = XT_FUNCTION_MAXNAMELEN,
2197 .family = NFPROTO_IPV6,
2201 static struct nf_sockopt_ops ip6t_sockopts = {
2203 .set_optmin = IP6T_BASE_CTL,
2204 .set_optmax = IP6T_SO_SET_MAX+1,
2205 .set = do_ip6t_set_ctl,
2206 #ifdef CONFIG_COMPAT
2207 .compat_set = compat_do_ip6t_set_ctl,
2209 .get_optmin = IP6T_BASE_CTL,
2210 .get_optmax = IP6T_SO_GET_MAX+1,
2211 .get = do_ip6t_get_ctl,
2212 #ifdef CONFIG_COMPAT
2213 .compat_get = compat_do_ip6t_get_ctl,
2215 .owner = THIS_MODULE,
2218 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
2221 .match = icmp6_match,
2222 .matchsize = sizeof(struct ip6t_icmp),
2223 .checkentry = icmp6_checkentry,
2224 .proto = IPPROTO_ICMPV6,
2225 .family = NFPROTO_IPV6,
2229 static int __net_init ip6_tables_net_init(struct net *net)
2231 return xt_proto_init(net, NFPROTO_IPV6);
2234 static void __net_exit ip6_tables_net_exit(struct net *net)
2236 xt_proto_fini(net, NFPROTO_IPV6);
2239 static struct pernet_operations ip6_tables_net_ops = {
2240 .init = ip6_tables_net_init,
2241 .exit = ip6_tables_net_exit,
2244 static int __init ip6_tables_init(void)
2248 ret = register_pernet_subsys(&ip6_tables_net_ops);
2252 /* No one else will be downing sem now, so we won't sleep */
2253 ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2256 ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2260 /* Register setsockopt */
2261 ret = nf_register_sockopt(&ip6t_sockopts);
2265 pr_info("(C) 2000-2006 Netfilter Core Team\n");
2269 xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2271 xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2273 unregister_pernet_subsys(&ip6_tables_net_ops);
2278 static void __exit ip6_tables_fini(void)
2280 nf_unregister_sockopt(&ip6t_sockopts);
2282 xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2283 xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2284 unregister_pernet_subsys(&ip6_tables_net_ops);
2287 EXPORT_SYMBOL(ip6t_register_table);
2288 EXPORT_SYMBOL(ip6t_unregister_table);
2289 EXPORT_SYMBOL(ip6t_do_table);
2291 module_init(ip6_tables_init);
2292 module_exit(ip6_tables_fini);