net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14
  15 #include <linux/kernel.h>
  16 #include <linux/capability.h>
  17 #include <linux/in.h>
  18 #include <linux/skbuff.h>
  19 #include <linux/kmod.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netdevice.h>
  22 #include <linux/module.h>
  23 #include <linux/poison.h>
  24 #include <linux/icmpv6.h>
  25 #include <net/ipv6.h>
  26 #include <net/compat.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/mutex.h>
  29 #include <linux/proc_fs.h>
  30 #include <linux/err.h>
  31 #include <linux/cpumask.h>
  32
  33 #include <linux/netfilter_ipv6/ip6_tables.h>
  34 #include <linux/netfilter/x_tables.h>
  35 #include <net/netfilter/nf_log.h>
  36 #include "../../netfilter/xt_repldata.h"
  37
  38 MODULE_LICENSE("GPL");
  39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  40 MODULE_DESCRIPTION("IPv6 packet filter");
  41
  42 /*#define DEBUG_IP_FIREWALL*/
  43 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  44 /*#define DEBUG_IP_FIREWALL_USER*/
  45
  46 #ifdef DEBUG_IP_FIREWALL
  47 #define dprintf(format, args...) pr_info(format , ## args)
  48 #else
  49 #define dprintf(format, args...)
  50 #endif
  51
  52 #ifdef DEBUG_IP_FIREWALL_USER
  53 #define duprintf(format, args...) pr_info(format , ## args)
  54 #else
  55 #define duprintf(format, args...)
  56 #endif
  57
  58 #ifdef CONFIG_NETFILTER_DEBUG
  59 #define IP_NF_ASSERT(x) WARN_ON(!(x))
  60 #else
  61 #define IP_NF_ASSERT(x)
  62 #endif
  63
  64 #if 0
  65 /* All the better to debug you with... */
  66 #define static
  67 #define inline
  68 #endif
  69
  70 void *ip6t_alloc_initial_table(const struct xt_table *info)
  71 {
  72         return xt_alloc_initial_table(ip6t, IP6T);
  73 }
  74 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
  75
  76 /*
  77    We keep a set of rules for each CPU, so we can avoid write-locking
  78    them in the softirq when updating the counters and therefore
  79    only need to read-lock in the softirq; doing a write_lock_bh() in user
  80    context stops packets coming through and allows user context to read
  81    the counters or update the rules.
  82
  83    Hence the start of any table is given by get_table() below.  */
  84
  85 /* Returns whether matches rule or not. */
  86 /* Performance critical - called for every packet */
  87 static inline bool
  88 ip6_packet_match(const struct sk_buff *skb,
  89                  const char *indev,
  90                  const char *outdev,
  91                  const struct ip6t_ip6 *ip6info,
  92                  unsigned int *protoff,
  93                  int *fragoff, bool *hotdrop)
  94 {
  95         unsigned long ret;
  96         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
  97
  98 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
  99
 100         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 101                                        &ip6info->src), IP6T_INV_SRCIP) ||
 102             FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 103                                        &ip6info->dst), IP6T_INV_DSTIP)) {
 104                 dprintf("Source or dest mismatch.\n");
 105 /*
 106                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 107                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 108                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 109                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 110                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 111                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 112                 return false;
 113         }
 114
 115         ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 116
 117         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 118                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 119                         indev, ip6info->iniface,
 120                         ip6info->invflags & IP6T_INV_VIA_IN ? " (INV)" : "");
 121                 return false;
 122         }
 123
 124         ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 125
 126         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 127                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 128                         outdev, ip6info->outiface,
 129                         ip6info->invflags & IP6T_INV_VIA_OUT ? " (INV)" : "");
 130                 return false;
 131         }
 132
 133 /* ... might want to do something with class and flowlabel here ... */
 134
 135         /* look for the desired protocol header */
 136         if (ip6info->flags & IP6T_F_PROTO) {
 137                 int protohdr;
 138                 unsigned short _frag_off;
 139
 140                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
 141                 if (protohdr < 0) {
 142                         if (_frag_off == 0)
 143                                 *hotdrop = true;
 144                         return false;
 145                 }
 146                 *fragoff = _frag_off;
 147
 148                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 149                                 protohdr,
 150                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 151                                 ip6info->proto);
 152
 153                 if (ip6info->proto == protohdr) {
 154                         if (ip6info->invflags & IP6T_INV_PROTO)
 155                                 return false;
 156
 157                         return true;
 158                 }
 159
 160                 /* We need match for the '-p all', too! */
 161                 if ((ip6info->proto != 0) &&
 162                         !(ip6info->invflags & IP6T_INV_PROTO))
 163                         return false;
 164         }
 165         return true;
 166 }
 167
 168 /* should be ip6 safe */
 169 static bool
 170 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 171 {
 172         if (ipv6->flags & ~IP6T_F_MASK) {
 173                 duprintf("Unknown flag bits set: %08X\n",
 174                          ipv6->flags & ~IP6T_F_MASK);
 175                 return false;
 176         }
 177         if (ipv6->invflags & ~IP6T_INV_MASK) {
 178                 duprintf("Unknown invflag bits set: %08X\n",
 179                          ipv6->invflags & ~IP6T_INV_MASK);
 180                 return false;
 181         }
 182         return true;
 183 }
 184
 185 static unsigned int
 186 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
 187 {
 188         net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
 189
 190         return NF_DROP;
 191 }
 192
 193 static inline struct ip6t_entry *
 194 get_entry(const void *base, unsigned int offset)
 195 {
 196         return (struct ip6t_entry *)(base + offset);
 197 }
 198
 199 /* All zeroes == unconditional rule. */
 200 /* Mildly perf critical (only if packet tracing is on) */
 201 static inline bool unconditional(const struct ip6t_ip6 *ipv6)
 202 {
 203         static const struct ip6t_ip6 uncond;
 204
 205         return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 206 }
 207
 208 static inline const struct xt_entry_target *
 209 ip6t_get_target_c(const struct ip6t_entry *e)
 210 {
 211         return ip6t_get_target((struct ip6t_entry *)e);
 212 }
 213
 214 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 215 /* This cries for unification! */
 216 static const char *const hooknames[] = {
 217         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 218         [NF_INET_LOCAL_IN]              = "INPUT",
 219         [NF_INET_FORWARD]               = "FORWARD",
 220         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 221         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 222 };
 223
 224 enum nf_ip_trace_comments {
 225         NF_IP6_TRACE_COMMENT_RULE,
 226         NF_IP6_TRACE_COMMENT_RETURN,
 227         NF_IP6_TRACE_COMMENT_POLICY,
 228 };
 229
 230 static const char *const comments[] = {
 231         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
 232         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
 233         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
 234 };
 235
 236 static struct nf_loginfo trace_loginfo = {
 237         .type = NF_LOG_TYPE_LOG,
 238         .u = {
 239                 .log = {
 240                         .level = LOGLEVEL_WARNING,
 241                         .logflags = NF_LOG_MASK,
 242                 },
 243         },
 244 };
 245
 246 /* Mildly perf critical (only if packet tracing is on) */
 247 static inline int
 248 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
 249                       const char *hookname, const char **chainname,
 250                       const char **comment, unsigned int *rulenum)
 251 {
 252         const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
 253
 254         if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
 255                 /* Head of user chain: ERROR target with chainname */
 256                 *chainname = t->target.data;
 257                 (*rulenum) = 0;
 258         } else if (s == e) {
 259                 (*rulenum)++;
 260
 261                 if (s->target_offset == sizeof(struct ip6t_entry) &&
 262                     strcmp(t->target.u.kernel.target->name,
 263                            XT_STANDARD_TARGET) == 0 &&
 264                     t->verdict < 0 &&
 265                     unconditional(&s->ipv6)) {
 266                         /* Tail of chains: STANDARD target (return/policy) */
 267                         *comment = *chainname == hookname
 268                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
 269                                 : comments[NF_IP6_TRACE_COMMENT_RETURN];
 270                 }
 271                 return 1;
 272         } else
 273                 (*rulenum)++;
 274
 275         return 0;
 276 }
 277
 278 static void trace_packet(struct net *net,
 279                          const struct sk_buff *skb,
 280                          unsigned int hook,
 281                          const struct net_device *in,
 282                          const struct net_device *out,
 283                          const char *tablename,
 284                          const struct xt_table_info *private,
 285                          const struct ip6t_entry *e)
 286 {
 287         const struct ip6t_entry *root;
 288         const char *hookname, *chainname, *comment;
 289         const struct ip6t_entry *iter;
 290         unsigned int rulenum = 0;
 291
 292         root = get_entry(private->entries, private->hook_entry[hook]);
 293
 294         hookname = chainname = hooknames[hook];
 295         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 296
 297         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 298                 if (get_chainname_rulenum(iter, e, hookname,
 299                     &chainname, &comment, &rulenum) != 0)
 300                         break;
 301
 302         nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
 303                      "TRACE: %s:%s:%s:%u ",
 304                      tablename, chainname, comment, rulenum);
 305 }
 306 #endif
 307
 308 static inline struct ip6t_entry *
 309 ip6t_next_entry(const struct ip6t_entry *entry)
 310 {
 311         return (void *)entry + entry->next_offset;
 312 }
 313
 314 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 315 unsigned int
 316 ip6t_do_table(struct sk_buff *skb,
 317               const struct nf_hook_state *state,
 318               struct xt_table *table)
 319 {
 320         unsigned int hook = state->hook;
 321         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 322         /* Initializing verdict to NF_DROP keeps gcc happy. */
 323         unsigned int verdict = NF_DROP;
 324         const char *indev, *outdev;
 325         const void *table_base;
 326         struct ip6t_entry *e, **jumpstack;
 327         unsigned int stackidx, cpu;
 328         const struct xt_table_info *private;
 329         struct xt_action_param acpar;
 330         unsigned int addend;
 331
 332         /* Initialization */
 333         stackidx = 0;
 334         indev = state->in ? state->in->name : nulldevname;
 335         outdev = state->out ? state->out->name : nulldevname;
 336         /* We handle fragments by dealing with the first fragment as
 337          * if it was a normal packet.  All other fragments are treated
 338          * normally, except that they will NEVER match rules that ask
 339          * things we don't know, ie. tcp syn flag or ports).  If the
 340          * rule is also a fragment-specific rule, non-fragments won't
 341          * match it. */
 342         acpar.hotdrop = false;
 343         acpar.net     = state->net;
 344         acpar.in      = state->in;
 345         acpar.out     = state->out;
 346         acpar.family  = NFPROTO_IPV6;
 347         acpar.hooknum = hook;
 348
 349         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 350
 351         local_bh_disable();
 352         addend = xt_write_recseq_begin();
 353         private = table->private;
 354         /*
 355          * Ensure we load private-> members after we've fetched the base
 356          * pointer.
 357          */
 358         smp_read_barrier_depends();
 359         cpu        = smp_processor_id();
 360         table_base = private->entries;
 361         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
 362
 363         /* Switch to alternate jumpstack if we're being invoked via TEE.
 364          * TEE issues XT_CONTINUE verdict on original skb so we must not
 365          * clobber the jumpstack.
 366          *
 367          * For recursion via REJECT or SYNPROXY the stack will be clobbered
 368          * but it is no problem since absolute verdict is issued by these.
 369          */
 370         if (static_key_false(&xt_tee_enabled))
 371                 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
 372
 373         e = get_entry(table_base, private->hook_entry[hook]);
 374
 375         do {
 376                 const struct xt_entry_target *t;
 377                 const struct xt_entry_match *ematch;
 378                 struct xt_counters *counter;
 379
 380                 IP_NF_ASSERT(e);
 381                 acpar.thoff = 0;
 382                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
 383                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
 384  no_match:
 385                         e = ip6t_next_entry(e);
 386                         continue;
 387                 }
 388
 389                 xt_ematch_foreach(ematch, e) {
 390                         acpar.match     = ematch->u.kernel.match;
 391                         acpar.matchinfo = ematch->data;
 392                         if (!acpar.match->match(skb, &acpar))
 393                                 goto no_match;
 394                 }
 395
 396                 counter = xt_get_this_cpu_counter(&e->counters);
 397                 ADD_COUNTER(*counter, skb->len, 1);
 398
 399                 t = ip6t_get_target_c(e);
 400                 IP_NF_ASSERT(t->u.kernel.target);
 401
 402 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 403                 /* The packet is traced: log it */
 404                 if (unlikely(skb->nf_trace))
 405                         trace_packet(state->net, skb, hook, state->in,
 406                                      state->out, table->name, private, e);
 407 #endif
 408                 /* Standard target? */
 409                 if (!t->u.kernel.target->target) {
 410                         int v;
 411
 412                         v = ((struct xt_standard_target *)t)->verdict;
 413                         if (v < 0) {
 414                                 /* Pop from stack? */
 415                                 if (v != XT_RETURN) {
 416                                         verdict = (unsigned int)(-v) - 1;
 417                                         break;
 418                                 }
 419                                 if (stackidx == 0)
 420                                         e = get_entry(table_base,
 421                                             private->underflow[hook]);
 422                                 else
 423                                         e = ip6t_next_entry(jumpstack[--stackidx]);
 424                                 continue;
 425                         }
 426                         if (table_base + v != ip6t_next_entry(e) &&
 427                             !(e->ipv6.flags & IP6T_F_GOTO)) {
 428                                 jumpstack[stackidx++] = e;
 429                         }
 430
 431                         e = get_entry(table_base, v);
 432                         continue;
 433                 }
 434
 435                 acpar.target   = t->u.kernel.target;
 436                 acpar.targinfo = t->data;
 437
 438                 verdict = t->u.kernel.target->target(skb, &acpar);
 439                 if (verdict == XT_CONTINUE)
 440                         e = ip6t_next_entry(e);
 441                 else
 442                         /* Verdict */
 443                         break;
 444         } while (!acpar.hotdrop);
 445
 446         xt_write_recseq_end(addend);
 447         local_bh_enable();
 448
 449 #ifdef DEBUG_ALLOW_ALL
 450         return NF_ACCEPT;
 451 #else
 452         if (acpar.hotdrop)
 453                 return NF_DROP;
 454         else return verdict;
 455 #endif
 456 }
 457
 458 /* Figures out from what hook each rule can be called: returns 0 if
 459    there are loops.  Puts hook bitmask in comefrom. */
 460 static int
 461 mark_source_chains(const struct xt_table_info *newinfo,
 462                    unsigned int valid_hooks, void *entry0)
 463 {
 464         unsigned int hook;
 465
 466         /* No recursion; use packet counter to save back ptrs (reset
 467            to 0 as we leave), and comefrom to save source hook bitmask */
 468         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 469                 unsigned int pos = newinfo->hook_entry[hook];
 470                 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
 471
 472                 if (!(valid_hooks & (1 << hook)))
 473                         continue;
 474
 475                 /* Set initial back pointer. */
 476                 e->counters.pcnt = pos;
 477
 478                 for (;;) {
 479                         const struct xt_standard_target *t
 480                                 = (void *)ip6t_get_target_c(e);
 481                         int visited = e->comefrom & (1 << hook);
 482
 483                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 484                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
 485                                        hook, pos, e->comefrom);
 486                                 return 0;
 487                         }
 488                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 489
 490                         /* Unconditional return/END. */
 491                         if ((e->target_offset == sizeof(struct ip6t_entry) &&
 492                              (strcmp(t->target.u.user.name,
 493                                      XT_STANDARD_TARGET) == 0) &&
 494                              t->verdict < 0 &&
 495                              unconditional(&e->ipv6)) || visited) {
 496                                 unsigned int oldpos, size;
 497
 498                                 if ((strcmp(t->target.u.user.name,
 499                                             XT_STANDARD_TARGET) == 0) &&
 500                                     t->verdict < -NF_MAX_VERDICT - 1) {
 501                                         duprintf("mark_source_chains: bad "
 502                                                 "negative verdict (%i)\n",
 503                                                                 t->verdict);
 504                                         return 0;
 505                                 }
 506
 507                                 /* Return: backtrack through the last
 508                                    big jump. */
 509                                 do {
 510                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 511 #ifdef DEBUG_IP_FIREWALL_USER
 512                                         if (e->comefrom
 513                                             & (1 << NF_INET_NUMHOOKS)) {
 514                                                 duprintf("Back unset "
 515                                                          "on hook %u "
 516                                                          "rule %u\n",
 517                                                          hook, pos);
 518                                         }
 519 #endif
 520                                         oldpos = pos;
 521                                         pos = e->counters.pcnt;
 522                                         e->counters.pcnt = 0;
 523
 524                                         /* We're at the start. */
 525                                         if (pos == oldpos)
 526                                                 goto next;
 527
 528                                         e = (struct ip6t_entry *)
 529                                                 (entry0 + pos);
 530                                 } while (oldpos == pos + e->next_offset);
 531
 532                                 /* Move along one */
 533                                 size = e->next_offset;
 534                                 e = (struct ip6t_entry *)
 535                                         (entry0 + pos + size);
 536                                 e->counters.pcnt = pos;
 537                                 pos += size;
 538                         } else {
 539                                 int newpos = t->verdict;
 540
 541                                 if (strcmp(t->target.u.user.name,
 542                                            XT_STANDARD_TARGET) == 0 &&
 543                                     newpos >= 0) {
 544                                         if (newpos > newinfo->size -
 545                                                 sizeof(struct ip6t_entry)) {
 546                                                 duprintf("mark_source_chains: "
 547                                                         "bad verdict (%i)\n",
 548                                                                 newpos);
 549                                                 return 0;
 550                                         }
 551                                         /* This a jump; chase it. */
 552                                         duprintf("Jump rule %u -> %u\n",
 553                                                  pos, newpos);
 554                                 } else {
 555                                         /* ... this is a fallthru */
 556                                         newpos = pos + e->next_offset;
 557                                 }
 558                                 e = (struct ip6t_entry *)
 559                                         (entry0 + newpos);
 560                                 e->counters.pcnt = pos;
 561                                 pos = newpos;
 562                         }
 563                 }
 564 next:
 565                 duprintf("Finished chain %u\n", hook);
 566         }
 567         return 1;
 568 }
 569
 570 static void cleanup_match(struct xt_entry_match *m, struct net *net)
 571 {
 572         struct xt_mtdtor_param par;
 573
 574         par.net       = net;
 575         par.match     = m->u.kernel.match;
 576         par.matchinfo = m->data;
 577         par.family    = NFPROTO_IPV6;
 578         if (par.match->destroy != NULL)
 579                 par.match->destroy(&par);
 580         module_put(par.match->me);
 581 }
 582
 583 static int
 584 check_entry(const struct ip6t_entry *e, const char *name)
 585 {
 586         const struct xt_entry_target *t;
 587
 588         if (!ip6_checkentry(&e->ipv6)) {
 589                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 590                 return -EINVAL;
 591         }
 592
 593         if (e->target_offset + sizeof(struct xt_entry_target) >
 594             e->next_offset)
 595                 return -EINVAL;
 596
 597         t = ip6t_get_target_c(e);
 598         if (e->target_offset + t->u.target_size > e->next_offset)
 599                 return -EINVAL;
 600
 601         return 0;
 602 }
 603
 604 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 605 {
 606         const struct ip6t_ip6 *ipv6 = par->entryinfo;
 607         int ret;
 608
 609         par->match     = m->u.kernel.match;
 610         par->matchinfo = m->data;
 611
 612         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 613                              ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
 614         if (ret < 0) {
 615                 duprintf("ip_tables: check failed for `%s'.\n",
 616                          par.match->name);
 617                 return ret;
 618         }
 619         return 0;
 620 }
 621
 622 static int
 623 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 624 {
 625         struct xt_match *match;
 626         int ret;
 627
 628         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
 629                                       m->u.user.revision);
 630         if (IS_ERR(match)) {
 631                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 632                 return PTR_ERR(match);
 633         }
 634         m->u.kernel.match = match;
 635
 636         ret = check_match(m, par);
 637         if (ret)
 638                 goto err;
 639
 640         return 0;
 641 err:
 642         module_put(m->u.kernel.match->me);
 643         return ret;
 644 }
 645
 646 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 647 {
 648         struct xt_entry_target *t = ip6t_get_target(e);
 649         struct xt_tgchk_param par = {
 650                 .net       = net,
 651                 .table     = name,
 652                 .entryinfo = e,
 653                 .target    = t->u.kernel.target,
 654                 .targinfo  = t->data,
 655                 .hook_mask = e->comefrom,
 656                 .family    = NFPROTO_IPV6,
 657         };
 658         int ret;
 659
 660         t = ip6t_get_target(e);
 661         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 662               e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
 663         if (ret < 0) {
 664                 duprintf("ip_tables: check failed for `%s'.\n",
 665                          t->u.kernel.target->name);
 666                 return ret;
 667         }
 668         return 0;
 669 }
 670
 671 static int
 672 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 673                  unsigned int size)
 674 {
 675         struct xt_entry_target *t;
 676         struct xt_target *target;
 677         int ret;
 678         unsigned int j;
 679         struct xt_mtchk_param mtpar;
 680         struct xt_entry_match *ematch;
 681
 682         ret = check_entry(e, name);
 683         if (ret)
 684                 return ret;
 685
 686         e->counters.pcnt = xt_percpu_counter_alloc();
 687         if (IS_ERR_VALUE(e->counters.pcnt))
 688                 return -ENOMEM;
 689
 690         j = 0;
 691         mtpar.net       = net;
 692         mtpar.table     = name;
 693         mtpar.entryinfo = &e->ipv6;
 694         mtpar.hook_mask = e->comefrom;
 695         mtpar.family    = NFPROTO_IPV6;
 696         xt_ematch_foreach(ematch, e) {
 697                 ret = find_check_match(ematch, &mtpar);
 698                 if (ret != 0)
 699                         goto cleanup_matches;
 700                 ++j;
 701         }
 702
 703         t = ip6t_get_target(e);
 704         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
 705                                         t->u.user.revision);
 706         if (IS_ERR(target)) {
 707                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 708                 ret = PTR_ERR(target);
 709                 goto cleanup_matches;
 710         }
 711         t->u.kernel.target = target;
 712
 713         ret = check_target(e, net, name);
 714         if (ret)
 715                 goto err;
 716         return 0;
 717  err:
 718         module_put(t->u.kernel.target->me);
 719  cleanup_matches:
 720         xt_ematch_foreach(ematch, e) {
 721                 if (j-- == 0)
 722                         break;
 723                 cleanup_match(ematch, net);
 724         }
 725
 726         xt_percpu_counter_free(e->counters.pcnt);
 727
 728         return ret;
 729 }
 730
 731 static bool check_underflow(const struct ip6t_entry *e)
 732 {
 733         const struct xt_entry_target *t;
 734         unsigned int verdict;
 735
 736         if (!unconditional(&e->ipv6))
 737                 return false;
 738         t = ip6t_get_target_c(e);
 739         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 740                 return false;
 741         verdict = ((struct xt_standard_target *)t)->verdict;
 742         verdict = -verdict - 1;
 743         return verdict == NF_DROP || verdict == NF_ACCEPT;
 744 }
 745
 746 static int
 747 check_entry_size_and_hooks(struct ip6t_entry *e,
 748                            struct xt_table_info *newinfo,
 749                            const unsigned char *base,
 750                            const unsigned char *limit,
 751                            const unsigned int *hook_entries,
 752                            const unsigned int *underflows,
 753                            unsigned int valid_hooks)
 754 {
 755         unsigned int h;
 756
 757         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
 758             (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
 759                 duprintf("Bad offset %p\n", e);
 760                 return -EINVAL;
 761         }
 762
 763         if (e->next_offset
 764             < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target)) {
 765                 duprintf("checking: element %p size %u\n",
 766                          e, e->next_offset);
 767                 return -EINVAL;
 768         }
 769
 770         /* Check hooks & underflows */
 771         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 772                 if (!(valid_hooks & (1 << h)))
 773                         continue;
 774                 if ((unsigned char *)e - base == hook_entries[h])
 775                         newinfo->hook_entry[h] = hook_entries[h];
 776                 if ((unsigned char *)e - base == underflows[h]) {
 777                         if (!check_underflow(e)) {
 778                                 pr_err("Underflows must be unconditional and "
 779                                        "use the STANDARD target with "
 780                                        "ACCEPT/DROP\n");
 781                                 return -EINVAL;
 782                         }
 783                         newinfo->underflow[h] = underflows[h];
 784                 }
 785         }
 786
 787         /* Clear counters and comefrom */
 788         e->counters = ((struct xt_counters) { 0, 0 });
 789         e->comefrom = 0;
 790         return 0;
 791 }
 792
 793 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
 794 {
 795         struct xt_tgdtor_param par;
 796         struct xt_entry_target *t;
 797         struct xt_entry_match *ematch;
 798
 799         /* Cleanup all matches */
 800         xt_ematch_foreach(ematch, e)
 801                 cleanup_match(ematch, net);
 802         t = ip6t_get_target(e);
 803
 804         par.net      = net;
 805         par.target   = t->u.kernel.target;
 806         par.targinfo = t->data;
 807         par.family   = NFPROTO_IPV6;
 808         if (par.target->destroy != NULL)
 809                 par.target->destroy(&par);
 810         module_put(par.target->me);
 811
 812         xt_percpu_counter_free(e->counters.pcnt);
 813 }
 814
 815 /* Checks and translates the user-supplied table segment (held in
 816    newinfo) */
 817 static int
 818 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
 819                 const struct ip6t_replace *repl)
 820 {
 821         struct ip6t_entry *iter;
 822         unsigned int i;
 823         int ret = 0;
 824
 825         newinfo->size = repl->size;
 826         newinfo->number = repl->num_entries;
 827
 828         /* Init all hooks to impossible value. */
 829         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 830                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 831                 newinfo->underflow[i] = 0xFFFFFFFF;
 832         }
 833
 834         duprintf("translate_table: size %u\n", newinfo->size);
 835         i = 0;
 836         /* Walk through entries, checking offsets. */
 837         xt_entry_foreach(iter, entry0, newinfo->size) {
 838                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 839                                                  entry0 + repl->size,
 840                                                  repl->hook_entry,
 841                                                  repl->underflow,
 842                                                  repl->valid_hooks);
 843                 if (ret != 0)
 844                         return ret;
 845                 ++i;
 846                 if (strcmp(ip6t_get_target(iter)->u.user.name,
 847                     XT_ERROR_TARGET) == 0)
 848                         ++newinfo->stacksize;
 849         }
 850
 851         if (i != repl->num_entries) {
 852                 duprintf("translate_table: %u not %u entries\n",
 853                          i, repl->num_entries);
 854                 return -EINVAL;
 855         }
 856
 857         /* Check hooks all assigned */
 858         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 859                 /* Only hooks which are valid */
 860                 if (!(repl->valid_hooks & (1 << i)))
 861                         continue;
 862                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 863                         duprintf("Invalid hook entry %u %u\n",
 864                                  i, repl->hook_entry[i]);
 865                         return -EINVAL;
 866                 }
 867                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 868                         duprintf("Invalid underflow %u %u\n",
 869                                  i, repl->underflow[i]);
 870                         return -EINVAL;
 871                 }
 872         }
 873
 874         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
 875                 return -ELOOP;
 876
 877         /* Finally, each sanity check must pass */
 878         i = 0;
 879         xt_entry_foreach(iter, entry0, newinfo->size) {
 880                 ret = find_check_entry(iter, net, repl->name, repl->size);
 881                 if (ret != 0)
 882                         break;
 883                 ++i;
 884         }
 885
 886         if (ret != 0) {
 887                 xt_entry_foreach(iter, entry0, newinfo->size) {
 888                         if (i-- == 0)
 889                                 break;
 890                         cleanup_entry(iter, net);
 891                 }
 892                 return ret;
 893         }
 894
 895         return ret;
 896 }
 897
 898 static void
 899 get_counters(const struct xt_table_info *t,
 900              struct xt_counters counters[])
 901 {
 902         struct ip6t_entry *iter;
 903         unsigned int cpu;
 904         unsigned int i;
 905
 906         for_each_possible_cpu(cpu) {
 907                 seqcount_t *s = &per_cpu(xt_recseq, cpu);
 908
 909                 i = 0;
 910                 xt_entry_foreach(iter, t->entries, t->size) {
 911                         struct xt_counters *tmp;
 912                         u64 bcnt, pcnt;
 913                         unsigned int start;
 914
 915                         tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
 916                         do {
 917                                 start = read_seqcount_begin(s);
 918                                 bcnt = tmp->bcnt;
 919                                 pcnt = tmp->pcnt;
 920                         } while (read_seqcount_retry(s, start));
 921
 922                         ADD_COUNTER(counters[i], bcnt, pcnt);
 923                         ++i;
 924                 }
 925         }
 926 }
 927
 928 static struct xt_counters *alloc_counters(const struct xt_table *table)
 929 {
 930         unsigned int countersize;
 931         struct xt_counters *counters;
 932         const struct xt_table_info *private = table->private;
 933
 934         /* We need atomic snapshot of counters: rest doesn't change
 935            (other than comefrom, which userspace doesn't care
 936            about). */
 937         countersize = sizeof(struct xt_counters) * private->number;
 938         counters = vzalloc(countersize);
 939
 940         if (counters == NULL)
 941                 return ERR_PTR(-ENOMEM);
 942
 943         get_counters(private, counters);
 944
 945         return counters;
 946 }
 947
 948 static int
 949 copy_entries_to_user(unsigned int total_size,
 950                      const struct xt_table *table,
 951                      void __user *userptr)
 952 {
 953         unsigned int off, num;
 954         const struct ip6t_entry *e;
 955         struct xt_counters *counters;
 956         const struct xt_table_info *private = table->private;
 957         int ret = 0;
 958         const void *loc_cpu_entry;
 959
 960         counters = alloc_counters(table);
 961         if (IS_ERR(counters))
 962                 return PTR_ERR(counters);
 963
 964         loc_cpu_entry = private->entries;
 965         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 966                 ret = -EFAULT;
 967                 goto free_counters;
 968         }
 969
 970         /* FIXME: use iterator macros --RR */
 971         /* ... then go back and fix counters and names */
 972         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 973                 unsigned int i;
 974                 const struct xt_entry_match *m;
 975                 const struct xt_entry_target *t;
 976
 977                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
 978                 if (copy_to_user(userptr + off
 979                                  + offsetof(struct ip6t_entry, counters),
 980                                  &counters[num],
 981                                  sizeof(counters[num])) != 0) {
 982                         ret = -EFAULT;
 983                         goto free_counters;
 984                 }
 985
 986                 for (i = sizeof(struct ip6t_entry);
 987                      i < e->target_offset;
 988                      i += m->u.match_size) {
 989                         m = (void *)e + i;
 990
 991                         if (copy_to_user(userptr + off + i
 992                                          + offsetof(struct xt_entry_match,
 993                                                     u.user.name),
 994                                          m->u.kernel.match->name,
 995                                          strlen(m->u.kernel.match->name)+1)
 996                             != 0) {
 997                                 ret = -EFAULT;
 998                                 goto free_counters;
 999                         }
1000                 }
1001
1002                 t = ip6t_get_target_c(e);
1003                 if (copy_to_user(userptr + off + e->target_offset
1004                                  + offsetof(struct xt_entry_target,
1005                                             u.user.name),
1006                                  t->u.kernel.target->name,
1007                                  strlen(t->u.kernel.target->name)+1) != 0) {
1008                         ret = -EFAULT;
1009                         goto free_counters;
1010                 }
1011         }
1012
1013  free_counters:
1014         vfree(counters);
1015         return ret;
1016 }
1017
1018 #ifdef CONFIG_COMPAT
1019 static void compat_standard_from_user(void *dst, const void *src)
1020 {
1021         int v = *(compat_int_t *)src;
1022
1023         if (v > 0)
1024                 v += xt_compat_calc_jump(AF_INET6, v);
1025         memcpy(dst, &v, sizeof(v));
1026 }
1027
1028 static int compat_standard_to_user(void __user *dst, const void *src)
1029 {
1030         compat_int_t cv = *(int *)src;
1031
1032         if (cv > 0)
1033                 cv -= xt_compat_calc_jump(AF_INET6, cv);
1034         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1035 }
1036
1037 static int compat_calc_entry(const struct ip6t_entry *e,
1038                              const struct xt_table_info *info,
1039                              const void *base, struct xt_table_info *newinfo)
1040 {
1041         const struct xt_entry_match *ematch;
1042         const struct xt_entry_target *t;
1043         unsigned int entry_offset;
1044         int off, i, ret;
1045
1046         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1047         entry_offset = (void *)e - base;
1048         xt_ematch_foreach(ematch, e)
1049                 off += xt_compat_match_offset(ematch->u.kernel.match);
1050         t = ip6t_get_target_c(e);
1051         off += xt_compat_target_offset(t->u.kernel.target);
1052         newinfo->size -= off;
1053         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1054         if (ret)
1055                 return ret;
1056
1057         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1058                 if (info->hook_entry[i] &&
1059                     (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1060                         newinfo->hook_entry[i] -= off;
1061                 if (info->underflow[i] &&
1062                     (e < (struct ip6t_entry *)(base + info->underflow[i])))
1063                         newinfo->underflow[i] -= off;
1064         }
1065         return 0;
1066 }
1067
1068 static int compat_table_info(const struct xt_table_info *info,
1069                              struct xt_table_info *newinfo)
1070 {
1071         struct ip6t_entry *iter;
1072         const void *loc_cpu_entry;
1073         int ret;
1074
1075         if (!newinfo || !info)
1076                 return -EINVAL;
1077
1078         /* we dont care about newinfo->entries */
1079         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1080         newinfo->initial_entries = 0;
1081         loc_cpu_entry = info->entries;
1082         xt_compat_init_offsets(AF_INET6, info->number);
1083         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1084                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1085                 if (ret != 0)
1086                         return ret;
1087         }
1088         return 0;
1089 }
1090 #endif
1091
1092 static int get_info(struct net *net, void __user *user,
1093                     const int *len, int compat)
1094 {
1095         char name[XT_TABLE_MAXNAMELEN];
1096         struct xt_table *t;
1097         int ret;
1098
1099         if (*len != sizeof(struct ip6t_getinfo)) {
1100                 duprintf("length %u != %zu\n", *len,
1101                          sizeof(struct ip6t_getinfo));
1102                 return -EINVAL;
1103         }
1104
1105         if (copy_from_user(name, user, sizeof(name)) != 0)
1106                 return -EFAULT;
1107
1108         name[XT_TABLE_MAXNAMELEN-1] = '\0';
1109 #ifdef CONFIG_COMPAT
1110         if (compat)
1111                 xt_compat_lock(AF_INET6);
1112 #endif
1113         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1114                                     "ip6table_%s", name);
1115         if (!IS_ERR_OR_NULL(t)) {
1116                 struct ip6t_getinfo info;
1117                 const struct xt_table_info *private = t->private;
1118 #ifdef CONFIG_COMPAT
1119                 struct xt_table_info tmp;
1120
1121                 if (compat) {
1122                         ret = compat_table_info(private, &tmp);
1123                         xt_compat_flush_offsets(AF_INET6);
1124                         private = &tmp;
1125                 }
1126 #endif
1127                 memset(&info, 0, sizeof(info));
1128                 info.valid_hooks = t->valid_hooks;
1129                 memcpy(info.hook_entry, private->hook_entry,
1130                        sizeof(info.hook_entry));
1131                 memcpy(info.underflow, private->underflow,
1132                        sizeof(info.underflow));
1133                 info.num_entries = private->number;
1134                 info.size = private->size;
1135                 strcpy(info.name, name);
1136
1137                 if (copy_to_user(user, &info, *len) != 0)
1138                         ret = -EFAULT;
1139                 else
1140                         ret = 0;
1141
1142                 xt_table_unlock(t);
1143                 module_put(t->me);
1144         } else
1145                 ret = t ? PTR_ERR(t) : -ENOENT;
1146 #ifdef CONFIG_COMPAT
1147         if (compat)
1148                 xt_compat_unlock(AF_INET6);
1149 #endif
1150         return ret;
1151 }
1152
1153 static int
1154 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1155             const int *len)
1156 {
1157         int ret;
1158         struct ip6t_get_entries get;
1159         struct xt_table *t;
1160
1161         if (*len < sizeof(get)) {
1162                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1163                 return -EINVAL;
1164         }
1165         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1166                 return -EFAULT;
1167         if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1168                 duprintf("get_entries: %u != %zu\n",
1169                          *len, sizeof(get) + get.size);
1170                 return -EINVAL;
1171         }
1172
1173         t = xt_find_table_lock(net, AF_INET6, get.name);
1174         if (!IS_ERR_OR_NULL(t)) {
1175                 struct xt_table_info *private = t->private;
1176                 duprintf("t->private->number = %u\n", private->number);
1177                 if (get.size == private->size)
1178                         ret = copy_entries_to_user(private->size,
1179                                                    t, uptr->entrytable);
1180                 else {
1181                         duprintf("get_entries: I've got %u not %u!\n",
1182                                  private->size, get.size);
1183                         ret = -EAGAIN;
1184                 }
1185                 module_put(t->me);
1186                 xt_table_unlock(t);
1187         } else
1188                 ret = t ? PTR_ERR(t) : -ENOENT;
1189
1190         return ret;
1191 }
1192
1193 static int
1194 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1195              struct xt_table_info *newinfo, unsigned int num_counters,
1196              void __user *counters_ptr)
1197 {
1198         int ret;
1199         struct xt_table *t;
1200         struct xt_table_info *oldinfo;
1201         struct xt_counters *counters;
1202         struct ip6t_entry *iter;
1203
1204         ret = 0;
1205         counters = vzalloc(num_counters * sizeof(struct xt_counters));
1206         if (!counters) {
1207                 ret = -ENOMEM;
1208                 goto out;
1209         }
1210
1211         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1212                                     "ip6table_%s", name);
1213         if (IS_ERR_OR_NULL(t)) {
1214                 ret = t ? PTR_ERR(t) : -ENOENT;
1215                 goto free_newinfo_counters_untrans;
1216         }
1217
1218         /* You lied! */
1219         if (valid_hooks != t->valid_hooks) {
1220                 duprintf("Valid hook crap: %08X vs %08X\n",
1221                          valid_hooks, t->valid_hooks);
1222                 ret = -EINVAL;
1223                 goto put_module;
1224         }
1225
1226         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1227         if (!oldinfo)
1228                 goto put_module;
1229
1230         /* Update module usage count based on number of rules */
1231         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1232                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1233         if ((oldinfo->number > oldinfo->initial_entries) ||
1234             (newinfo->number <= oldinfo->initial_entries))
1235                 module_put(t->me);
1236         if ((oldinfo->number > oldinfo->initial_entries) &&
1237             (newinfo->number <= oldinfo->initial_entries))
1238                 module_put(t->me);
1239
1240         /* Get the old counters, and synchronize with replace */
1241         get_counters(oldinfo, counters);
1242
1243         /* Decrease module usage counts and free resource */
1244         xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1245                 cleanup_entry(iter, net);
1246
1247         xt_free_table_info(oldinfo);
1248         if (copy_to_user(counters_ptr, counters,
1249                          sizeof(struct xt_counters) * num_counters) != 0) {
1250                 /* Silent error, can't fail, new table is already in place */
1251                 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1252         }
1253         vfree(counters);
1254         xt_table_unlock(t);
1255         return ret;
1256
1257  put_module:
1258         module_put(t->me);
1259         xt_table_unlock(t);
1260  free_newinfo_counters_untrans:
1261         vfree(counters);
1262  out:
1263         return ret;
1264 }
1265
1266 static int
1267 do_replace(struct net *net, const void __user *user, unsigned int len)
1268 {
1269         int ret;
1270         struct ip6t_replace tmp;
1271         struct xt_table_info *newinfo;
1272         void *loc_cpu_entry;
1273         struct ip6t_entry *iter;
1274
1275         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1276                 return -EFAULT;
1277
1278         /* overflow check */
1279         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1280                 return -ENOMEM;
1281         if (tmp.num_counters == 0)
1282                 return -EINVAL;
1283
1284         tmp.name[sizeof(tmp.name)-1] = 0;
1285
1286         newinfo = xt_alloc_table_info(tmp.size);
1287         if (!newinfo)
1288                 return -ENOMEM;
1289
1290         loc_cpu_entry = newinfo->entries;
1291         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1292                            tmp.size) != 0) {
1293                 ret = -EFAULT;
1294                 goto free_newinfo;
1295         }
1296
1297         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1298         if (ret != 0)
1299                 goto free_newinfo;
1300
1301         duprintf("ip_tables: Translated table\n");
1302
1303         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1304                            tmp.num_counters, tmp.counters);
1305         if (ret)
1306                 goto free_newinfo_untrans;
1307         return 0;
1308
1309  free_newinfo_untrans:
1310         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1311                 cleanup_entry(iter, net);
1312  free_newinfo:
1313         xt_free_table_info(newinfo);
1314         return ret;
1315 }
1316
1317 static int
1318 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1319                 int compat)
1320 {
1321         unsigned int i;
1322         struct xt_counters_info tmp;
1323         struct xt_counters *paddc;
1324         unsigned int num_counters;
1325         char *name;
1326         int size;
1327         void *ptmp;
1328         struct xt_table *t;
1329         const struct xt_table_info *private;
1330         int ret = 0;
1331         struct ip6t_entry *iter;
1332         unsigned int addend;
1333 #ifdef CONFIG_COMPAT
1334         struct compat_xt_counters_info compat_tmp;
1335
1336         if (compat) {
1337                 ptmp = &compat_tmp;
1338                 size = sizeof(struct compat_xt_counters_info);
1339         } else
1340 #endif
1341         {
1342                 ptmp = &tmp;
1343                 size = sizeof(struct xt_counters_info);
1344         }
1345
1346         if (copy_from_user(ptmp, user, size) != 0)
1347                 return -EFAULT;
1348
1349 #ifdef CONFIG_COMPAT
1350         if (compat) {
1351                 num_counters = compat_tmp.num_counters;
1352                 name = compat_tmp.name;
1353         } else
1354 #endif
1355         {
1356                 num_counters = tmp.num_counters;
1357                 name = tmp.name;
1358         }
1359
1360         if (len != size + num_counters * sizeof(struct xt_counters))
1361                 return -EINVAL;
1362
1363         paddc = vmalloc(len - size);
1364         if (!paddc)
1365                 return -ENOMEM;
1366
1367         if (copy_from_user(paddc, user + size, len - size) != 0) {
1368                 ret = -EFAULT;
1369                 goto free;
1370         }
1371
1372         t = xt_find_table_lock(net, AF_INET6, name);
1373         if (IS_ERR_OR_NULL(t)) {
1374                 ret = t ? PTR_ERR(t) : -ENOENT;
1375                 goto free;
1376         }
1377
1378         local_bh_disable();
1379         private = t->private;
1380         if (private->number != num_counters) {
1381                 ret = -EINVAL;
1382                 goto unlock_up_free;
1383         }
1384
1385         i = 0;
1386         addend = xt_write_recseq_begin();
1387         xt_entry_foreach(iter, private->entries, private->size) {
1388                 struct xt_counters *tmp;
1389
1390                 tmp = xt_get_this_cpu_counter(&iter->counters);
1391                 ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1392                 ++i;
1393         }
1394         xt_write_recseq_end(addend);
1395  unlock_up_free:
1396         local_bh_enable();
1397         xt_table_unlock(t);
1398         module_put(t->me);
1399  free:
1400         vfree(paddc);
1401
1402         return ret;
1403 }
1404
1405 #ifdef CONFIG_COMPAT
1406 struct compat_ip6t_replace {
1407         char                    name[XT_TABLE_MAXNAMELEN];
1408         u32                     valid_hooks;
1409         u32                     num_entries;
1410         u32                     size;
1411         u32                     hook_entry[NF_INET_NUMHOOKS];
1412         u32                     underflow[NF_INET_NUMHOOKS];
1413         u32                     num_counters;
1414         compat_uptr_t           counters;       /* struct xt_counters * */
1415         struct compat_ip6t_entry entries[0];
1416 };
1417
1418 static int
1419 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1420                           unsigned int *size, struct xt_counters *counters,
1421                           unsigned int i)
1422 {
1423         struct xt_entry_target *t;
1424         struct compat_ip6t_entry __user *ce;
1425         u_int16_t target_offset, next_offset;
1426         compat_uint_t origsize;
1427         const struct xt_entry_match *ematch;
1428         int ret = 0;
1429
1430         origsize = *size;
1431         ce = (struct compat_ip6t_entry __user *)*dstptr;
1432         if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1433             copy_to_user(&ce->counters, &counters[i],
1434             sizeof(counters[i])) != 0)
1435                 return -EFAULT;
1436
1437         *dstptr += sizeof(struct compat_ip6t_entry);
1438         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1439
1440         xt_ematch_foreach(ematch, e) {
1441                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1442                 if (ret != 0)
1443                         return ret;
1444         }
1445         target_offset = e->target_offset - (origsize - *size);
1446         t = ip6t_get_target(e);
1447         ret = xt_compat_target_to_user(t, dstptr, size);
1448         if (ret)
1449                 return ret;
1450         next_offset = e->next_offset - (origsize - *size);
1451         if (put_user(target_offset, &ce->target_offset) != 0 ||
1452             put_user(next_offset, &ce->next_offset) != 0)
1453                 return -EFAULT;
1454         return 0;
1455 }
1456
1457 static int
1458 compat_find_calc_match(struct xt_entry_match *m,
1459                        const char *name,
1460                        const struct ip6t_ip6 *ipv6,
1461                        int *size)
1462 {
1463         struct xt_match *match;
1464
1465         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1466                                       m->u.user.revision);
1467         if (IS_ERR(match)) {
1468                 duprintf("compat_check_calc_match: `%s' not found\n",
1469                          m->u.user.name);
1470                 return PTR_ERR(match);
1471         }
1472         m->u.kernel.match = match;
1473         *size += xt_compat_match_offset(match);
1474         return 0;
1475 }
1476
1477 static void compat_release_entry(struct compat_ip6t_entry *e)
1478 {
1479         struct xt_entry_target *t;
1480         struct xt_entry_match *ematch;
1481
1482         /* Cleanup all matches */
1483         xt_ematch_foreach(ematch, e)
1484                 module_put(ematch->u.kernel.match->me);
1485         t = compat_ip6t_get_target(e);
1486         module_put(t->u.kernel.target->me);
1487 }
1488
1489 static int
1490 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1491                                   struct xt_table_info *newinfo,
1492                                   unsigned int *size,
1493                                   const unsigned char *base,
1494                                   const unsigned char *limit,
1495                                   const unsigned int *hook_entries,
1496                                   const unsigned int *underflows,
1497                                   const char *name)
1498 {
1499         struct xt_entry_match *ematch;
1500         struct xt_entry_target *t;
1501         struct xt_target *target;
1502         unsigned int entry_offset;
1503         unsigned int j;
1504         int ret, off, h;
1505
1506         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1507         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1508             (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
1509                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1510                 return -EINVAL;
1511         }
1512
1513         if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1514                              sizeof(struct compat_xt_entry_target)) {
1515                 duprintf("checking: element %p size %u\n",
1516                          e, e->next_offset);
1517                 return -EINVAL;
1518         }
1519
1520         /* For purposes of check_entry casting the compat entry is fine */
1521         ret = check_entry((struct ip6t_entry *)e, name);
1522         if (ret)
1523                 return ret;
1524
1525         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1526         entry_offset = (void *)e - (void *)base;
1527         j = 0;
1528         xt_ematch_foreach(ematch, e) {
1529                 ret = compat_find_calc_match(ematch, name, &e->ipv6, &off);
1530                 if (ret != 0)
1531                         goto release_matches;
1532                 ++j;
1533         }
1534
1535         t = compat_ip6t_get_target(e);
1536         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1537                                         t->u.user.revision);
1538         if (IS_ERR(target)) {
1539                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1540                          t->u.user.name);
1541                 ret = PTR_ERR(target);
1542                 goto release_matches;
1543         }
1544         t->u.kernel.target = target;
1545
1546         off += xt_compat_target_offset(target);
1547         *size += off;
1548         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1549         if (ret)
1550                 goto out;
1551
1552         /* Check hooks & underflows */
1553         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1554                 if ((unsigned char *)e - base == hook_entries[h])
1555                         newinfo->hook_entry[h] = hook_entries[h];
1556                 if ((unsigned char *)e - base == underflows[h])
1557                         newinfo->underflow[h] = underflows[h];
1558         }
1559
1560         /* Clear counters and comefrom */
1561         memset(&e->counters, 0, sizeof(e->counters));
1562         e->comefrom = 0;
1563         return 0;
1564
1565 out:
1566         module_put(t->u.kernel.target->me);
1567 release_matches:
1568         xt_ematch_foreach(ematch, e) {
1569                 if (j-- == 0)
1570                         break;
1571                 module_put(ematch->u.kernel.match->me);
1572         }
1573         return ret;
1574 }
1575
1576 static int
1577 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1578                             unsigned int *size, const char *name,
1579                             struct xt_table_info *newinfo, unsigned char *base)
1580 {
1581         struct xt_entry_target *t;
1582         struct ip6t_entry *de;
1583         unsigned int origsize;
1584         int ret, h;
1585         struct xt_entry_match *ematch;
1586
1587         ret = 0;
1588         origsize = *size;
1589         de = (struct ip6t_entry *)*dstptr;
1590         memcpy(de, e, sizeof(struct ip6t_entry));
1591         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1592
1593         *dstptr += sizeof(struct ip6t_entry);
1594         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1595
1596         xt_ematch_foreach(ematch, e) {
1597                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1598                 if (ret != 0)
1599                         return ret;
1600         }
1601         de->target_offset = e->target_offset - (origsize - *size);
1602         t = compat_ip6t_get_target(e);
1603         xt_compat_target_from_user(t, dstptr, size);
1604
1605         de->next_offset = e->next_offset - (origsize - *size);
1606         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1607                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1608                         newinfo->hook_entry[h] -= origsize - *size;
1609                 if ((unsigned char *)de - base < newinfo->underflow[h])
1610                         newinfo->underflow[h] -= origsize - *size;
1611         }
1612         return ret;
1613 }
1614
1615 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1616                               const char *name)
1617 {
1618         unsigned int j;
1619         int ret = 0;
1620         struct xt_mtchk_param mtpar;
1621         struct xt_entry_match *ematch;
1622
1623         e->counters.pcnt = xt_percpu_counter_alloc();
1624         if (IS_ERR_VALUE(e->counters.pcnt))
1625                 return -ENOMEM;
1626         j = 0;
1627         mtpar.net       = net;
1628         mtpar.table     = name;
1629         mtpar.entryinfo = &e->ipv6;
1630         mtpar.hook_mask = e->comefrom;
1631         mtpar.family    = NFPROTO_IPV6;
1632         xt_ematch_foreach(ematch, e) {
1633                 ret = check_match(ematch, &mtpar);
1634                 if (ret != 0)
1635                         goto cleanup_matches;
1636                 ++j;
1637         }
1638
1639         ret = check_target(e, net, name);
1640         if (ret)
1641                 goto cleanup_matches;
1642         return 0;
1643
1644  cleanup_matches:
1645         xt_ematch_foreach(ematch, e) {
1646                 if (j-- == 0)
1647                         break;
1648                 cleanup_match(ematch, net);
1649         }
1650
1651         xt_percpu_counter_free(e->counters.pcnt);
1652
1653         return ret;
1654 }
1655
1656 static int
1657 translate_compat_table(struct net *net,
1658                        const char *name,
1659                        unsigned int valid_hooks,
1660                        struct xt_table_info **pinfo,
1661                        void **pentry0,
1662                        unsigned int total_size,
1663                        unsigned int number,
1664                        unsigned int *hook_entries,
1665                        unsigned int *underflows)
1666 {
1667         unsigned int i, j;
1668         struct xt_table_info *newinfo, *info;
1669         void *pos, *entry0, *entry1;
1670         struct compat_ip6t_entry *iter0;
1671         struct ip6t_entry *iter1;
1672         unsigned int size;
1673         int ret = 0;
1674
1675         info = *pinfo;
1676         entry0 = *pentry0;
1677         size = total_size;
1678         info->number = number;
1679
1680         /* Init all hooks to impossible value. */
1681         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1682                 info->hook_entry[i] = 0xFFFFFFFF;
1683                 info->underflow[i] = 0xFFFFFFFF;
1684         }
1685
1686         duprintf("translate_compat_table: size %u\n", info->size);
1687         j = 0;
1688         xt_compat_lock(AF_INET6);
1689         xt_compat_init_offsets(AF_INET6, number);
1690         /* Walk through entries, checking offsets. */
1691         xt_entry_foreach(iter0, entry0, total_size) {
1692                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1693                                                         entry0,
1694                                                         entry0 + total_size,
1695                                                         hook_entries,
1696                                                         underflows,
1697                                                         name);
1698                 if (ret != 0)
1699                         goto out_unlock;
1700                 ++j;
1701         }
1702
1703         ret = -EINVAL;
1704         if (j != number) {
1705                 duprintf("translate_compat_table: %u not %u entries\n",
1706                          j, number);
1707                 goto out_unlock;
1708         }
1709
1710         /* Check hooks all assigned */
1711         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1712                 /* Only hooks which are valid */
1713                 if (!(valid_hooks & (1 << i)))
1714                         continue;
1715                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1716                         duprintf("Invalid hook entry %u %u\n",
1717                                  i, hook_entries[i]);
1718                         goto out_unlock;
1719                 }
1720                 if (info->underflow[i] == 0xFFFFFFFF) {
1721                         duprintf("Invalid underflow %u %u\n",
1722                                  i, underflows[i]);
1723                         goto out_unlock;
1724                 }
1725         }
1726
1727         ret = -ENOMEM;
1728         newinfo = xt_alloc_table_info(size);
1729         if (!newinfo)
1730                 goto out_unlock;
1731
1732         newinfo->number = number;
1733         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1734                 newinfo->hook_entry[i] = info->hook_entry[i];
1735                 newinfo->underflow[i] = info->underflow[i];
1736         }
1737         entry1 = newinfo->entries;
1738         pos = entry1;
1739         size = total_size;
1740         xt_entry_foreach(iter0, entry0, total_size) {
1741                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1742                                                   name, newinfo, entry1);
1743                 if (ret != 0)
1744                         break;
1745         }
1746         xt_compat_flush_offsets(AF_INET6);
1747         xt_compat_unlock(AF_INET6);
1748         if (ret)
1749                 goto free_newinfo;
1750
1751         ret = -ELOOP;
1752         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1753                 goto free_newinfo;
1754
1755         i = 0;
1756         xt_entry_foreach(iter1, entry1, newinfo->size) {
1757                 ret = compat_check_entry(iter1, net, name);
1758                 if (ret != 0)
1759                         break;
1760                 ++i;
1761                 if (strcmp(ip6t_get_target(iter1)->u.user.name,
1762                     XT_ERROR_TARGET) == 0)
1763                         ++newinfo->stacksize;
1764         }
1765         if (ret) {
1766                 /*
1767                  * The first i matches need cleanup_entry (calls ->destroy)
1768                  * because they had called ->check already. The other j-i
1769                  * entries need only release.
1770                  */
1771                 int skip = i;
1772                 j -= i;
1773                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1774                         if (skip-- > 0)
1775                                 continue;
1776                         if (j-- == 0)
1777                                 break;
1778                         compat_release_entry(iter0);
1779                 }
1780                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1781                         if (i-- == 0)
1782                                 break;
1783                         cleanup_entry(iter1, net);
1784                 }
1785                 xt_free_table_info(newinfo);
1786                 return ret;
1787         }
1788
1789         *pinfo = newinfo;
1790         *pentry0 = entry1;
1791         xt_free_table_info(info);
1792         return 0;
1793
1794 free_newinfo:
1795         xt_free_table_info(newinfo);
1796 out:
1797         xt_entry_foreach(iter0, entry0, total_size) {
1798                 if (j-- == 0)
1799                         break;
1800                 compat_release_entry(iter0);
1801         }
1802         return ret;
1803 out_unlock:
1804         xt_compat_flush_offsets(AF_INET6);
1805         xt_compat_unlock(AF_INET6);
1806         goto out;
1807 }
1808
1809 static int
1810 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1811 {
1812         int ret;
1813         struct compat_ip6t_replace tmp;
1814         struct xt_table_info *newinfo;
1815         void *loc_cpu_entry;
1816         struct ip6t_entry *iter;
1817
1818         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1819                 return -EFAULT;
1820
1821         /* overflow check */
1822         if (tmp.size >= INT_MAX / num_possible_cpus())
1823                 return -ENOMEM;
1824         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1825                 return -ENOMEM;
1826         if (tmp.num_counters == 0)
1827                 return -EINVAL;
1828
1829         tmp.name[sizeof(tmp.name)-1] = 0;
1830
1831         newinfo = xt_alloc_table_info(tmp.size);
1832         if (!newinfo)
1833                 return -ENOMEM;
1834
1835         loc_cpu_entry = newinfo->entries;
1836         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1837                            tmp.size) != 0) {
1838                 ret = -EFAULT;
1839                 goto free_newinfo;
1840         }
1841
1842         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1843                                      &newinfo, &loc_cpu_entry, tmp.size,
1844                                      tmp.num_entries, tmp.hook_entry,
1845                                      tmp.underflow);
1846         if (ret != 0)
1847                 goto free_newinfo;
1848
1849         duprintf("compat_do_replace: Translated table\n");
1850
1851         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1852                            tmp.num_counters, compat_ptr(tmp.counters));
1853         if (ret)
1854                 goto free_newinfo_untrans;
1855         return 0;
1856
1857  free_newinfo_untrans:
1858         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1859                 cleanup_entry(iter, net);
1860  free_newinfo:
1861         xt_free_table_info(newinfo);
1862         return ret;
1863 }
1864
1865 static int
1866 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1867                        unsigned int len)
1868 {
1869         int ret;
1870
1871         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1872                 return -EPERM;
1873
1874         switch (cmd) {
1875         case IP6T_SO_SET_REPLACE:
1876                 ret = compat_do_replace(sock_net(sk), user, len);
1877                 break;
1878
1879         case IP6T_SO_SET_ADD_COUNTERS:
1880                 ret = do_add_counters(sock_net(sk), user, len, 1);
1881                 break;
1882
1883         default:
1884                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1885                 ret = -EINVAL;
1886         }
1887
1888         return ret;
1889 }
1890
1891 struct compat_ip6t_get_entries {
1892         char name[XT_TABLE_MAXNAMELEN];
1893         compat_uint_t size;
1894         struct compat_ip6t_entry entrytable[0];
1895 };
1896
1897 static int
1898 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1899                             void __user *userptr)
1900 {
1901         struct xt_counters *counters;
1902         const struct xt_table_info *private = table->private;
1903         void __user *pos;
1904         unsigned int size;
1905         int ret = 0;
1906         unsigned int i = 0;
1907         struct ip6t_entry *iter;
1908
1909         counters = alloc_counters(table);
1910         if (IS_ERR(counters))
1911                 return PTR_ERR(counters);
1912
1913         pos = userptr;
1914         size = total_size;
1915         xt_entry_foreach(iter, private->entries, total_size) {
1916                 ret = compat_copy_entry_to_user(iter, &pos,
1917                                                 &size, counters, i++);
1918                 if (ret != 0)
1919                         break;
1920         }
1921
1922         vfree(counters);
1923         return ret;
1924 }
1925
1926 static int
1927 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1928                    int *len)
1929 {
1930         int ret;
1931         struct compat_ip6t_get_entries get;
1932         struct xt_table *t;
1933
1934         if (*len < sizeof(get)) {
1935                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1936                 return -EINVAL;
1937         }
1938
1939         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1940                 return -EFAULT;
1941
1942         if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1943                 duprintf("compat_get_entries: %u != %zu\n",
1944                          *len, sizeof(get) + get.size);
1945                 return -EINVAL;
1946         }
1947
1948         xt_compat_lock(AF_INET6);
1949         t = xt_find_table_lock(net, AF_INET6, get.name);
1950         if (!IS_ERR_OR_NULL(t)) {
1951                 const struct xt_table_info *private = t->private;
1952                 struct xt_table_info info;
1953                 duprintf("t->private->number = %u\n", private->number);
1954                 ret = compat_table_info(private, &info);
1955                 if (!ret && get.size == info.size) {
1956                         ret = compat_copy_entries_to_user(private->size,
1957                                                           t, uptr->entrytable);
1958                 } else if (!ret) {
1959                         duprintf("compat_get_entries: I've got %u not %u!\n",
1960                                  private->size, get.size);
1961                         ret = -EAGAIN;
1962                 }
1963                 xt_compat_flush_offsets(AF_INET6);
1964                 module_put(t->me);
1965                 xt_table_unlock(t);
1966         } else
1967                 ret = t ? PTR_ERR(t) : -ENOENT;
1968
1969         xt_compat_unlock(AF_INET6);
1970         return ret;
1971 }
1972
1973 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1974
1975 static int
1976 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1977 {
1978         int ret;
1979
1980         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1981                 return -EPERM;
1982
1983         switch (cmd) {
1984         case IP6T_SO_GET_INFO:
1985                 ret = get_info(sock_net(sk), user, len, 1);
1986                 break;
1987         case IP6T_SO_GET_ENTRIES:
1988                 ret = compat_get_entries(sock_net(sk), user, len);
1989                 break;
1990         default:
1991                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
1992         }
1993         return ret;
1994 }
1995 #endif
1996
1997 static int
1998 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1999 {
2000         int ret;
2001
2002         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2003                 return -EPERM;
2004
2005         switch (cmd) {
2006         case IP6T_SO_SET_REPLACE:
2007                 ret = do_replace(sock_net(sk), user, len);
2008                 break;
2009
2010         case IP6T_SO_SET_ADD_COUNTERS:
2011                 ret = do_add_counters(sock_net(sk), user, len, 0);
2012                 break;
2013
2014         default:
2015                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
2016                 ret = -EINVAL;
2017         }
2018
2019         return ret;
2020 }
2021
2022 static int
2023 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2024 {
2025         int ret;
2026
2027         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2028                 return -EPERM;
2029
2030         switch (cmd) {
2031         case IP6T_SO_GET_INFO:
2032                 ret = get_info(sock_net(sk), user, len, 0);
2033                 break;
2034
2035         case IP6T_SO_GET_ENTRIES:
2036                 ret = get_entries(sock_net(sk), user, len);
2037                 break;
2038
2039         case IP6T_SO_GET_REVISION_MATCH:
2040         case IP6T_SO_GET_REVISION_TARGET: {
2041                 struct xt_get_revision rev;
2042                 int target;
2043
2044                 if (*len != sizeof(rev)) {
2045                         ret = -EINVAL;
2046                         break;
2047                 }
2048                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2049                         ret = -EFAULT;
2050                         break;
2051                 }
2052                 rev.name[sizeof(rev.name)-1] = 0;
2053
2054                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2055                         target = 1;
2056                 else
2057                         target = 0;
2058
2059                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2060                                                          rev.revision,
2061                                                          target, &ret),
2062                                         "ip6t_%s", rev.name);
2063                 break;
2064         }
2065
2066         default:
2067                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2068                 ret = -EINVAL;
2069         }
2070
2071         return ret;
2072 }
2073
2074 struct xt_table *ip6t_register_table(struct net *net,
2075                                      const struct xt_table *table,
2076                                      const struct ip6t_replace *repl)
2077 {
2078         int ret;
2079         struct xt_table_info *newinfo;
2080         struct xt_table_info bootstrap = {0};
2081         void *loc_cpu_entry;
2082         struct xt_table *new_table;
2083
2084         newinfo = xt_alloc_table_info(repl->size);
2085         if (!newinfo) {
2086                 ret = -ENOMEM;
2087                 goto out;
2088         }
2089
2090         loc_cpu_entry = newinfo->entries;
2091         memcpy(loc_cpu_entry, repl->entries, repl->size);
2092
2093         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2094         if (ret != 0)
2095                 goto out_free;
2096
2097         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2098         if (IS_ERR(new_table)) {
2099                 ret = PTR_ERR(new_table);
2100                 goto out_free;
2101         }
2102         return new_table;
2103
2104 out_free:
2105         xt_free_table_info(newinfo);
2106 out:
2107         return ERR_PTR(ret);
2108 }
2109
2110 void ip6t_unregister_table(struct net *net, struct xt_table *table)
2111 {
2112         struct xt_table_info *private;
2113         void *loc_cpu_entry;
2114         struct module *table_owner = table->me;
2115         struct ip6t_entry *iter;
2116
2117         private = xt_unregister_table(table);
2118
2119         /* Decrease module usage counts and free resources */
2120         loc_cpu_entry = private->entries;
2121         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2122                 cleanup_entry(iter, net);
2123         if (private->number > private->initial_entries)
2124                 module_put(table_owner);
2125         xt_free_table_info(private);
2126 }
2127
2128 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2129 static inline bool
2130 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2131                      u_int8_t type, u_int8_t code,
2132                      bool invert)
2133 {
2134         return (type == test_type && code >= min_code && code <= max_code)
2135                 ^ invert;
2136 }
2137
2138 static bool
2139 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
2140 {
2141         const struct icmp6hdr *ic;
2142         struct icmp6hdr _icmph;
2143         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2144
2145         /* Must not be a fragment. */
2146         if (par->fragoff != 0)
2147                 return false;
2148
2149         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2150         if (ic == NULL) {
2151                 /* We've been asked to examine this packet, and we
2152                  * can't.  Hence, no choice but to drop.
2153                  */
2154                 duprintf("Dropping evil ICMP tinygram.\n");
2155                 par->hotdrop = true;
2156                 return false;
2157         }
2158
2159         return icmp6_type_code_match(icmpinfo->type,
2160                                      icmpinfo->code[0],
2161                                      icmpinfo->code[1],
2162                                      ic->icmp6_type, ic->icmp6_code,
2163                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
2164 }
2165
2166 /* Called when user tries to insert an entry of this type. */
2167 static int icmp6_checkentry(const struct xt_mtchk_param *par)
2168 {
2169         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2170
2171         /* Must specify no unknown invflags */
2172         return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
2173 }
2174
2175 /* The built-in targets: standard (NULL) and error. */
2176 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
2177         {
2178                 .name             = XT_STANDARD_TARGET,
2179                 .targetsize       = sizeof(int),
2180                 .family           = NFPROTO_IPV6,
2181 #ifdef CONFIG_COMPAT
2182                 .compatsize       = sizeof(compat_int_t),
2183                 .compat_from_user = compat_standard_from_user,
2184                 .compat_to_user   = compat_standard_to_user,
2185 #endif
2186         },
2187         {
2188                 .name             = XT_ERROR_TARGET,
2189                 .target           = ip6t_error,
2190                 .targetsize       = XT_FUNCTION_MAXNAMELEN,
2191                 .family           = NFPROTO_IPV6,
2192         },
2193 };
2194
2195 static struct nf_sockopt_ops ip6t_sockopts = {
2196         .pf             = PF_INET6,
2197         .set_optmin     = IP6T_BASE_CTL,
2198         .set_optmax     = IP6T_SO_SET_MAX+1,
2199         .set            = do_ip6t_set_ctl,
2200 #ifdef CONFIG_COMPAT
2201         .compat_set     = compat_do_ip6t_set_ctl,
2202 #endif
2203         .get_optmin     = IP6T_BASE_CTL,
2204         .get_optmax     = IP6T_SO_GET_MAX+1,
2205         .get            = do_ip6t_get_ctl,
2206 #ifdef CONFIG_COMPAT
2207         .compat_get     = compat_do_ip6t_get_ctl,
2208 #endif
2209         .owner          = THIS_MODULE,
2210 };
2211
2212 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
2213         {
2214                 .name       = "icmp6",
2215                 .match      = icmp6_match,
2216                 .matchsize  = sizeof(struct ip6t_icmp),
2217                 .checkentry = icmp6_checkentry,
2218                 .proto      = IPPROTO_ICMPV6,
2219                 .family     = NFPROTO_IPV6,
2220         },
2221 };
2222
2223 static int __net_init ip6_tables_net_init(struct net *net)
2224 {
2225         return xt_proto_init(net, NFPROTO_IPV6);
2226 }
2227
2228 static void __net_exit ip6_tables_net_exit(struct net *net)
2229 {
2230         xt_proto_fini(net, NFPROTO_IPV6);
2231 }
2232
2233 static struct pernet_operations ip6_tables_net_ops = {
2234         .init = ip6_tables_net_init,
2235         .exit = ip6_tables_net_exit,
2236 };
2237
2238 static int __init ip6_tables_init(void)
2239 {
2240         int ret;
2241
2242         ret = register_pernet_subsys(&ip6_tables_net_ops);
2243         if (ret < 0)
2244                 goto err1;
2245
2246         /* No one else will be downing sem now, so we won't sleep */
2247         ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2248         if (ret < 0)
2249                 goto err2;
2250         ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2251         if (ret < 0)
2252                 goto err4;
2253
2254         /* Register setsockopt */
2255         ret = nf_register_sockopt(&ip6t_sockopts);
2256         if (ret < 0)
2257                 goto err5;
2258
2259         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2260         return 0;
2261
2262 err5:
2263         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2264 err4:
2265         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2266 err2:
2267         unregister_pernet_subsys(&ip6_tables_net_ops);
2268 err1:
2269         return ret;
2270 }
2271
2272 static void __exit ip6_tables_fini(void)
2273 {
2274         nf_unregister_sockopt(&ip6t_sockopts);
2275
2276         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2277         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2278         unregister_pernet_subsys(&ip6_tables_net_ops);
2279 }
2280
2281 EXPORT_SYMBOL(ip6t_register_table);
2282 EXPORT_SYMBOL(ip6t_unregister_table);
2283 EXPORT_SYMBOL(ip6t_do_table);
2284
2285 module_init(ip6_tables_init);
2286 module_exit(ip6_tables_fini);