?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netfilter: xtables: replace XT_ENTRY_ITERATE macro
[linux-2.6/libata-dev.git] / net / ipv6 / netfilter / ip6_tables.c
blob23926e38d36bf6991a7f8ea6f4b0a7988cf98e88
1 /*
2 * Packet matching code.
3 *
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 #include <linux/capability.h>
13 #include <linux/in.h>
14 #include <linux/skbuff.h>
15 #include <linux/kmod.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netdevice.h>
18 #include <linux/module.h>
19 #include <linux/poison.h>
20 #include <linux/icmpv6.h>
21 #include <net/ipv6.h>
22 #include <net/compat.h>
23 #include <asm/uaccess.h>
24 #include <linux/mutex.h>
25 #include <linux/proc_fs.h>
26 #include <linux/err.h>
27 #include <linux/cpumask.h>
28
29 #include <linux/netfilter_ipv6/ip6_tables.h>
30 #include <linux/netfilter/x_tables.h>
31 #include <net/netfilter/nf_log.h>
32 #include "../../netfilter/xt_repldata.h"
33
34 MODULE_LICENSE("GPL");
35 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
36 MODULE_DESCRIPTION("IPv6 packet filter");
37
38 /*#define DEBUG_IP_FIREWALL*/
39 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
40 /*#define DEBUG_IP_FIREWALL_USER*/
41
42 #ifdef DEBUG_IP_FIREWALL
43 #define dprintf(format, args...) printk(format , ## args)
44 #else
45 #define dprintf(format, args...)
46 #endif
47
48 #ifdef DEBUG_IP_FIREWALL_USER
49 #define duprintf(format, args...) printk(format , ## args)
50 #else
51 #define duprintf(format, args...)
52 #endif
53
54 #ifdef CONFIG_NETFILTER_DEBUG
55 #define IP_NF_ASSERT(x) \
56 do { \
57 if (!(x)) \
58 printk("IP_NF_ASSERT: %s:%s:%u\n", \
59 __func__, __FILE__, __LINE__); \
60 } while(0)
61 #else
62 #define IP_NF_ASSERT(x)
63 #endif
64
65 #if 0
66 /* All the better to debug you with... */
67 #define static
68 #define inline
69 #endif
70
71 void *ip6t_alloc_initial_table(const struct xt_table *info)
72 {
73 return xt_alloc_initial_table(ip6t, IP6T);
74 }
75 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
76
77 /*
78 We keep a set of rules for each CPU, so we can avoid write-locking
79 them in the softirq when updating the counters and therefore
80 only need to read-lock in the softirq; doing a write_lock_bh() in user
81 context stops packets coming through and allows user context to read
82 the counters or update the rules.
83
84 Hence the start of any table is given by get_table() below. */
85
86 /* Check for an extension */
87 int
88 ip6t_ext_hdr(u8 nexthdr)
89 {
90 return ( (nexthdr == IPPROTO_HOPOPTS) ||
91 (nexthdr == IPPROTO_ROUTING) ||
92 (nexthdr == IPPROTO_FRAGMENT) ||
93 (nexthdr == IPPROTO_ESP) ||
94 (nexthdr == IPPROTO_AH) ||
95 (nexthdr == IPPROTO_NONE) ||
96 (nexthdr == IPPROTO_DSTOPTS) );
97 }
98
99 /* Returns whether matches rule or not. */
100 /* Performance critical - called for every packet */
101 static inline bool
102 ip6_packet_match(const struct sk_buff *skb,
103 const char *indev,
104 const char *outdev,
105 const struct ip6t_ip6 *ip6info,
106 unsigned int *protoff,
107 int *fragoff, bool *hotdrop)
108 {
109 unsigned long ret;
110 const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
111
112 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
113
114 if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
115 &ip6info->src), IP6T_INV_SRCIP) ||
116 FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
117 &ip6info->dst), IP6T_INV_DSTIP)) {
118 dprintf("Source or dest mismatch.\n");
119 /*
120 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
121 ipinfo->smsk.s_addr, ipinfo->src.s_addr,
122 ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
123 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
124 ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
125 ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
126 return false;
127 }
128
129 ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
130
131 if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
132 dprintf("VIA in mismatch (%s vs %s).%s\n",
133 indev, ip6info->iniface,
134 ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
135 return false;
136 }
137
138 ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
139
140 if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
141 dprintf("VIA out mismatch (%s vs %s).%s\n",
142 outdev, ip6info->outiface,
143 ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
144 return false;
145 }
146
147 /* ... might want to do something with class and flowlabel here ... */
148
149 /* look for the desired protocol header */
150 if((ip6info->flags & IP6T_F_PROTO)) {
151 int protohdr;
152 unsigned short _frag_off;
153
154 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
155 if (protohdr < 0) {
156 if (_frag_off == 0)
157 *hotdrop = true;
158 return false;
159 }
160 *fragoff = _frag_off;
161
162 dprintf("Packet protocol %hi ?= %s%hi.\n",
163 protohdr,
164 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
165 ip6info->proto);
166
167 if (ip6info->proto == protohdr) {
168 if(ip6info->invflags & IP6T_INV_PROTO) {
169 return false;
170 }
171 return true;
172 }
173
174 /* We need match for the '-p all', too! */
175 if ((ip6info->proto != 0) &&
176 !(ip6info->invflags & IP6T_INV_PROTO))
177 return false;
178 }
179 return true;
180 }
181
182 /* should be ip6 safe */
183 static bool
184 ip6_checkentry(const struct ip6t_ip6 *ipv6)
185 {
186 if (ipv6->flags & ~IP6T_F_MASK) {
187 duprintf("Unknown flag bits set: %08X\n",
188 ipv6->flags & ~IP6T_F_MASK);
189 return false;
190 }
191 if (ipv6->invflags & ~IP6T_INV_MASK) {
192 duprintf("Unknown invflag bits set: %08X\n",
193 ipv6->invflags & ~IP6T_INV_MASK);
194 return false;
195 }
196 return true;
197 }
198
199 static unsigned int
200 ip6t_error(struct sk_buff *skb, const struct xt_target_param *par)
201 {
202 if (net_ratelimit())
203 printk("ip6_tables: error: `%s'\n",
204 (const char *)par->targinfo);
205
206 return NF_DROP;
207 }
208
209 /* Performance critical - called for every packet */
210 static inline bool
211 do_match(const struct ip6t_entry_match *m, const struct sk_buff *skb,
212 struct xt_match_param *par)
213 {
214 par->match = m->u.kernel.match;
215 par->matchinfo = m->data;
216
217 /* Stop iteration if it doesn't match */
218 if (!m->u.kernel.match->match(skb, par))
219 return true;
220 else
221 return false;
222 }
223
224 static inline struct ip6t_entry *
225 get_entry(const void *base, unsigned int offset)
226 {
227 return (struct ip6t_entry *)(base + offset);
228 }
229
230 /* All zeroes == unconditional rule. */
231 /* Mildly perf critical (only if packet tracing is on) */
232 static inline bool unconditional(const struct ip6t_ip6 *ipv6)
233 {
234 static const struct ip6t_ip6 uncond;
235
236 return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
237 }
238
239 static inline const struct ip6t_entry_target *
240 ip6t_get_target_c(const struct ip6t_entry *e)
241 {
242 return ip6t_get_target((struct ip6t_entry *)e);
243 }
244
245 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
246 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
247 /* This cries for unification! */
248 static const char *const hooknames[] = {
249 [NF_INET_PRE_ROUTING] = "PREROUTING",
250 [NF_INET_LOCAL_IN] = "INPUT",
251 [NF_INET_FORWARD] = "FORWARD",
252 [NF_INET_LOCAL_OUT] = "OUTPUT",
253 [NF_INET_POST_ROUTING] = "POSTROUTING",
254 };
255
256 enum nf_ip_trace_comments {
257 NF_IP6_TRACE_COMMENT_RULE,
258 NF_IP6_TRACE_COMMENT_RETURN,
259 NF_IP6_TRACE_COMMENT_POLICY,
260 };
261
262 static const char *const comments[] = {
263 [NF_IP6_TRACE_COMMENT_RULE] = "rule",
264 [NF_IP6_TRACE_COMMENT_RETURN] = "return",
265 [NF_IP6_TRACE_COMMENT_POLICY] = "policy",
266 };
267
268 static struct nf_loginfo trace_loginfo = {
269 .type = NF_LOG_TYPE_LOG,
270 .u = {
271 .log = {
272 .level = 4,
273 .logflags = NF_LOG_MASK,
274 },
275 },
276 };
277
278 /* Mildly perf critical (only if packet tracing is on) */
279 static inline int
280 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
281 const char *hookname, const char **chainname,
282 const char **comment, unsigned int *rulenum)
283 {
284 const struct ip6t_standard_target *t = (void *)ip6t_get_target_c(s);
285
286 if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
287 /* Head of user chain: ERROR target with chainname */
288 *chainname = t->target.data;
289 (*rulenum) = 0;
290 } else if (s == e) {
291 (*rulenum)++;
292
293 if (s->target_offset == sizeof(struct ip6t_entry) &&
294 strcmp(t->target.u.kernel.target->name,
295 IP6T_STANDARD_TARGET) == 0 &&
296 t->verdict < 0 &&
297 unconditional(&s->ipv6)) {
298 /* Tail of chains: STANDARD target (return/policy) */
299 *comment = *chainname == hookname
300 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
301 : comments[NF_IP6_TRACE_COMMENT_RETURN];
302 }
303 return 1;
304 } else
305 (*rulenum)++;
306
307 return 0;
308 }
309
310 static void trace_packet(const struct sk_buff *skb,
311 unsigned int hook,
312 const struct net_device *in,
313 const struct net_device *out,
314 const char *tablename,
315 const struct xt_table_info *private,
316 const struct ip6t_entry *e)
317 {
318 const void *table_base;
319 const struct ip6t_entry *root;
320 const char *hookname, *chainname, *comment;
321 const struct ip6t_entry *iter;
322 unsigned int rulenum = 0;
323
324 table_base = private->entries[smp_processor_id()];
325 root = get_entry(table_base, private->hook_entry[hook]);
326
327 hookname = chainname = hooknames[hook];
328 comment = comments[NF_IP6_TRACE_COMMENT_RULE];
329
330 xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
331 if (get_chainname_rulenum(iter, e, hookname,
332 &chainname, &comment, &rulenum) != 0)
333 break;
334
335 nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
336 "TRACE: %s:%s:%s:%u ",
337 tablename, chainname, comment, rulenum);
338 }
339 #endif
340
341 static inline __pure struct ip6t_entry *
342 ip6t_next_entry(const struct ip6t_entry *entry)
343 {
344 return (void *)entry + entry->next_offset;
345 }
346
347 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
348 unsigned int
349 ip6t_do_table(struct sk_buff *skb,
350 unsigned int hook,
351 const struct net_device *in,
352 const struct net_device *out,
353 struct xt_table *table)
354 {
355 #define tb_comefrom ((struct ip6t_entry *)table_base)->comefrom
356
357 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
358 bool hotdrop = false;
359 /* Initializing verdict to NF_DROP keeps gcc happy. */
360 unsigned int verdict = NF_DROP;
361 const char *indev, *outdev;
362 const void *table_base;
363 struct ip6t_entry *e, *back;
364 const struct xt_table_info *private;
365 struct xt_match_param mtpar;
366 struct xt_target_param tgpar;
367
368 /* Initialization */
369 indev = in ? in->name : nulldevname;
370 outdev = out ? out->name : nulldevname;
371 /* We handle fragments by dealing with the first fragment as
372 * if it was a normal packet. All other fragments are treated
373 * normally, except that they will NEVER match rules that ask
374 * things we don't know, ie. tcp syn flag or ports). If the
375 * rule is also a fragment-specific rule, non-fragments won't
376 * match it. */
377 mtpar.hotdrop = &hotdrop;
378 mtpar.in = tgpar.in = in;
379 mtpar.out = tgpar.out = out;
380 mtpar.family = tgpar.family = NFPROTO_IPV6;
381 mtpar.hooknum = tgpar.hooknum = hook;
382
383 IP_NF_ASSERT(table->valid_hooks & (1 << hook));
384
385 xt_info_rdlock_bh();
386 private = table->private;
387 table_base = private->entries[smp_processor_id()];
388
389 e = get_entry(table_base, private->hook_entry[hook]);
390
391 /* For return from builtin chain */
392 back = get_entry(table_base, private->underflow[hook]);
393
394 do {
395 const struct ip6t_entry_target *t;
396
397 IP_NF_ASSERT(e);
398 IP_NF_ASSERT(back);
399 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
400 &mtpar.thoff, &mtpar.fragoff, &hotdrop) ||
401 IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
402 e = ip6t_next_entry(e);
403 continue;
404 }
405
406 ADD_COUNTER(e->counters,
407 ntohs(ipv6_hdr(skb)->payload_len) +
408 sizeof(struct ipv6hdr), 1);
409
410 t = ip6t_get_target_c(e);
411 IP_NF_ASSERT(t->u.kernel.target);
412
413 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
414 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
415 /* The packet is traced: log it */
416 if (unlikely(skb->nf_trace))
417 trace_packet(skb, hook, in, out,
418 table->name, private, e);
419 #endif
420 /* Standard target? */
421 if (!t->u.kernel.target->target) {
422 int v;
423
424 v = ((struct ip6t_standard_target *)t)->verdict;
425 if (v < 0) {
426 /* Pop from stack? */
427 if (v != IP6T_RETURN) {
428 verdict = (unsigned)(-v) - 1;
429 break;
430 }
431 e = back;
432 back = get_entry(table_base, back->comefrom);
433 continue;
434 }
435 if (table_base + v != ip6t_next_entry(e) &&
436 !(e->ipv6.flags & IP6T_F_GOTO)) {
437 /* Save old back ptr in next entry */
438 struct ip6t_entry *next = ip6t_next_entry(e);
439 next->comefrom = (void *)back - table_base;
440 /* set back pointer to next entry */
441 back = next;
442 }
443
444 e = get_entry(table_base, v);
445 continue;
446 }
447
448 /* Targets which reenter must return
449 abs. verdicts */
450 tgpar.target = t->u.kernel.target;
451 tgpar.targinfo = t->data;
452
453 #ifdef CONFIG_NETFILTER_DEBUG
454 tb_comefrom = 0xeeeeeeec;
455 #endif
456 verdict = t->u.kernel.target->target(skb, &tgpar);
457
458 #ifdef CONFIG_NETFILTER_DEBUG
459 if (tb_comefrom != 0xeeeeeeec && verdict == IP6T_CONTINUE) {
460 printk("Target %s reentered!\n",
461 t->u.kernel.target->name);
462 verdict = NF_DROP;
463 }
464 tb_comefrom = 0x57acc001;
465 #endif
466 if (verdict == IP6T_CONTINUE)
467 e = ip6t_next_entry(e);
468 else
469 /* Verdict */
470 break;
471 } while (!hotdrop);
472
473 #ifdef CONFIG_NETFILTER_DEBUG
474 tb_comefrom = NETFILTER_LINK_POISON;
475 #endif
476 xt_info_rdunlock_bh();
477
478 #ifdef DEBUG_ALLOW_ALL
479 return NF_ACCEPT;
480 #else
481 if (hotdrop)
482 return NF_DROP;
483 else return verdict;
484 #endif
485
486 #undef tb_comefrom
487 }
488
489 /* Figures out from what hook each rule can be called: returns 0 if
490 there are loops. Puts hook bitmask in comefrom. */
491 static int
492 mark_source_chains(const struct xt_table_info *newinfo,
493 unsigned int valid_hooks, void *entry0)
494 {
495 unsigned int hook;
496
497 /* No recursion; use packet counter to save back ptrs (reset
498 to 0 as we leave), and comefrom to save source hook bitmask */
499 for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
500 unsigned int pos = newinfo->hook_entry[hook];
501 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
502
503 if (!(valid_hooks & (1 << hook)))
504 continue;
505
506 /* Set initial back pointer. */
507 e->counters.pcnt = pos;
508
509 for (;;) {
510 const struct ip6t_standard_target *t
511 = (void *)ip6t_get_target_c(e);
512 int visited = e->comefrom & (1 << hook);
513
514 if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
515 printk("iptables: loop hook %u pos %u %08X.\n",
516 hook, pos, e->comefrom);
517 return 0;
518 }
519 e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
520
521 /* Unconditional return/END. */
522 if ((e->target_offset == sizeof(struct ip6t_entry) &&
523 (strcmp(t->target.u.user.name,
524 IP6T_STANDARD_TARGET) == 0) &&
525 t->verdict < 0 &&
526 unconditional(&e->ipv6)) || visited) {
527 unsigned int oldpos, size;
528
529 if ((strcmp(t->target.u.user.name,
530 IP6T_STANDARD_TARGET) == 0) &&
531 t->verdict < -NF_MAX_VERDICT - 1) {
532 duprintf("mark_source_chains: bad "
533 "negative verdict (%i)\n",
534 t->verdict);
535 return 0;
536 }
537
538 /* Return: backtrack through the last
539 big jump. */
540 do {
541 e->comefrom ^= (1<<NF_INET_NUMHOOKS);
542 #ifdef DEBUG_IP_FIREWALL_USER
543 if (e->comefrom
544 & (1 << NF_INET_NUMHOOKS)) {
545 duprintf("Back unset "
546 "on hook %u "
547 "rule %u\n",
548 hook, pos);
549 }
550 #endif
551 oldpos = pos;
552 pos = e->counters.pcnt;
553 e->counters.pcnt = 0;
554
555 /* We're at the start. */
556 if (pos == oldpos)
557 goto next;
558
559 e = (struct ip6t_entry *)
560 (entry0 + pos);
561 } while (oldpos == pos + e->next_offset);
562
563 /* Move along one */
564 size = e->next_offset;
565 e = (struct ip6t_entry *)
566 (entry0 + pos + size);
567 e->counters.pcnt = pos;
568 pos += size;
569 } else {
570 int newpos = t->verdict;
571
572 if (strcmp(t->target.u.user.name,
573 IP6T_STANDARD_TARGET) == 0 &&
574 newpos >= 0) {
575 if (newpos > newinfo->size -
576 sizeof(struct ip6t_entry)) {
577 duprintf("mark_source_chains: "
578 "bad verdict (%i)\n",
579 newpos);
580 return 0;
581 }
582 /* This a jump; chase it. */
583 duprintf("Jump rule %u -> %u\n",
584 pos, newpos);
585 } else {
586 /* ... this is a fallthru */
587 newpos = pos + e->next_offset;
588 }
589 e = (struct ip6t_entry *)
590 (entry0 + newpos);
591 e->counters.pcnt = pos;
592 pos = newpos;
593 }
594 }
595 next:
596 duprintf("Finished chain %u\n", hook);
597 }
598 return 1;
599 }
600
601 static int
602 cleanup_match(struct ip6t_entry_match *m, struct net *net, unsigned int *i)
603 {
604 struct xt_mtdtor_param par;
605
606 if (i && (*i)-- == 0)
607 return 1;
608
609 par.net = net;
610 par.match = m->u.kernel.match;
611 par.matchinfo = m->data;
612 par.family = NFPROTO_IPV6;
613 if (par.match->destroy != NULL)
614 par.match->destroy(&par);
615 module_put(par.match->me);
616 return 0;
617 }
618
619 static int
620 check_entry(const struct ip6t_entry *e, const char *name)
621 {
622 const struct ip6t_entry_target *t;
623
624 if (!ip6_checkentry(&e->ipv6)) {
625 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
626 return -EINVAL;
627 }
628
629 if (e->target_offset + sizeof(struct ip6t_entry_target) >
630 e->next_offset)
631 return -EINVAL;
632
633 t = ip6t_get_target_c(e);
634 if (e->target_offset + t->u.target_size > e->next_offset)
635 return -EINVAL;
636
637 return 0;
638 }
639
640 static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
641 unsigned int *i)
642 {
643 const struct ip6t_ip6 *ipv6 = par->entryinfo;
644 int ret;
645
646 par->match = m->u.kernel.match;
647 par->matchinfo = m->data;
648
649 ret = xt_check_match(par, m->u.match_size - sizeof(*m),
650 ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
651 if (ret < 0) {
652 duprintf("ip_tables: check failed for `%s'.\n",
653 par.match->name);
654 return ret;
655 }
656 ++*i;
657 return 0;
658 }
659
660 static int
661 find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
662 unsigned int *i)
663 {
664 struct xt_match *match;
665 int ret;
666
667 match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
668 m->u.user.revision),
669 "ip6t_%s", m->u.user.name);
670 if (IS_ERR(match) || !match) {
671 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
672 return match ? PTR_ERR(match) : -ENOENT;
673 }
674 m->u.kernel.match = match;
675
676 ret = check_match(m, par, i);
677 if (ret)
678 goto err;
679
680 return 0;
681 err:
682 module_put(m->u.kernel.match->me);
683 return ret;
684 }
685
686 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
687 {
688 struct ip6t_entry_target *t = ip6t_get_target(e);
689 struct xt_tgchk_param par = {
690 .net = net,
691 .table = name,
692 .entryinfo = e,
693 .target = t->u.kernel.target,
694 .targinfo = t->data,
695 .hook_mask = e->comefrom,
696 .family = NFPROTO_IPV6,
697 };
698 int ret;
699
700 t = ip6t_get_target(e);
701 ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
702 e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
703 if (ret < 0) {
704 duprintf("ip_tables: check failed for `%s'.\n",
705 t->u.kernel.target->name);
706 return ret;
707 }
708 return 0;
709 }
710
711 static int
712 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
713 unsigned int size, unsigned int *i)
714 {
715 struct ip6t_entry_target *t;
716 struct xt_target *target;
717 int ret;
718 unsigned int j;
719 struct xt_mtchk_param mtpar;
720
721 ret = check_entry(e, name);
722 if (ret)
723 return ret;
724
725 j = 0;
726 mtpar.net = net;
727 mtpar.table = name;
728 mtpar.entryinfo = &e->ipv6;
729 mtpar.hook_mask = e->comefrom;
730 mtpar.family = NFPROTO_IPV6;
731 ret = IP6T_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
732 if (ret != 0)
733 goto cleanup_matches;
734
735 t = ip6t_get_target(e);
736 target = try_then_request_module(xt_find_target(AF_INET6,
737 t->u.user.name,
738 t->u.user.revision),
739 "ip6t_%s", t->u.user.name);
740 if (IS_ERR(target) || !target) {
741 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
742 ret = target ? PTR_ERR(target) : -ENOENT;
743 goto cleanup_matches;
744 }
745 t->u.kernel.target = target;
746
747 ret = check_target(e, net, name);
748 if (ret)
749 goto err;
750
751 (*i)++;
752 return 0;
753 err:
754 module_put(t->u.kernel.target->me);
755 cleanup_matches:
756 IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
757 return ret;
758 }
759
760 static bool check_underflow(const struct ip6t_entry *e)
761 {
762 const struct ip6t_entry_target *t;
763 unsigned int verdict;
764
765 if (!unconditional(&e->ipv6))
766 return false;
767 t = ip6t_get_target_c(e);
768 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
769 return false;
770 verdict = ((struct ip6t_standard_target *)t)->verdict;
771 verdict = -verdict - 1;
772 return verdict == NF_DROP || verdict == NF_ACCEPT;
773 }
774
775 static int
776 check_entry_size_and_hooks(struct ip6t_entry *e,
777 struct xt_table_info *newinfo,
778 const unsigned char *base,
779 const unsigned char *limit,
780 const unsigned int *hook_entries,
781 const unsigned int *underflows,
782 unsigned int valid_hooks,
783 unsigned int *i)
784 {
785 unsigned int h;
786
787 if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
788 (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
789 duprintf("Bad offset %p\n", e);
790 return -EINVAL;
791 }
792
793 if (e->next_offset
794 < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
795 duprintf("checking: element %p size %u\n",
796 e, e->next_offset);
797 return -EINVAL;
798 }
799
800 /* Check hooks & underflows */
801 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
802 if (!(valid_hooks & (1 << h)))
803 continue;
804 if ((unsigned char *)e - base == hook_entries[h])
805 newinfo->hook_entry[h] = hook_entries[h];
806 if ((unsigned char *)e - base == underflows[h]) {
807 if (!check_underflow(e)) {
808 pr_err("Underflows must be unconditional and "
809 "use the STANDARD target with "
810 "ACCEPT/DROP\n");
811 return -EINVAL;
812 }
813 newinfo->underflow[h] = underflows[h];
814 }
815 }
816
817 /* Clear counters and comefrom */
818 e->counters = ((struct xt_counters) { 0, 0 });
819 e->comefrom = 0;
820
821 (*i)++;
822 return 0;
823 }
824
825 static int
826 cleanup_entry(struct ip6t_entry *e, struct net *net, unsigned int *i)
827 {
828 struct xt_tgdtor_param par;
829 struct ip6t_entry_target *t;
830
831 if (i && (*i)-- == 0)
832 return 1;
833
834 /* Cleanup all matches */
835 IP6T_MATCH_ITERATE(e, cleanup_match, net, NULL);
836 t = ip6t_get_target(e);
837
838 par.net = net;
839 par.target = t->u.kernel.target;
840 par.targinfo = t->data;
841 par.family = NFPROTO_IPV6;
842 if (par.target->destroy != NULL)
843 par.target->destroy(&par);
844 module_put(par.target->me);
845 return 0;
846 }
847
848 /* Checks and translates the user-supplied table segment (held in
849 newinfo) */
850 static int
851 translate_table(struct net *net,
852 const char *name,
853 unsigned int valid_hooks,
854 struct xt_table_info *newinfo,
855 void *entry0,
856 unsigned int size,
857 unsigned int number,
858 const unsigned int *hook_entries,
859 const unsigned int *underflows)
860 {
861 struct ip6t_entry *iter;
862 unsigned int i;
863 int ret = 0;
864
865 newinfo->size = size;
866 newinfo->number = number;
867
868 /* Init all hooks to impossible value. */
869 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
870 newinfo->hook_entry[i] = 0xFFFFFFFF;
871 newinfo->underflow[i] = 0xFFFFFFFF;
872 }
873
874 duprintf("translate_table: size %u\n", newinfo->size);
875 i = 0;
876 /* Walk through entries, checking offsets. */
877 xt_entry_foreach(iter, entry0, newinfo->size) {
878 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
879 entry0 + size, hook_entries, underflows,
880 valid_hooks, &i);
881 if (ret != 0)
882 break;
883 }
884 if (ret != 0)
885 return ret;
886
887 if (i != number) {
888 duprintf("translate_table: %u not %u entries\n",
889 i, number);
890 return -EINVAL;
891 }
892
893 /* Check hooks all assigned */
894 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
895 /* Only hooks which are valid */
896 if (!(valid_hooks & (1 << i)))
897 continue;
898 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
899 duprintf("Invalid hook entry %u %u\n",
900 i, hook_entries[i]);
901 return -EINVAL;
902 }
903 if (newinfo->underflow[i] == 0xFFFFFFFF) {
904 duprintf("Invalid underflow %u %u\n",
905 i, underflows[i]);
906 return -EINVAL;
907 }
908 }
909
910 if (!mark_source_chains(newinfo, valid_hooks, entry0))
911 return -ELOOP;
912
913 /* Finally, each sanity check must pass */
914 i = 0;
915 xt_entry_foreach(iter, entry0, newinfo->size) {
916 ret = find_check_entry(iter, net, name, size, &i);
917 if (ret != 0)
918 break;
919 }
920
921 if (ret != 0) {
922 xt_entry_foreach(iter, entry0, newinfo->size)
923 if (cleanup_entry(iter, net, &i) != 0)
924 break;
925 return ret;
926 }
927
928 /* And one copy for every other CPU */
929 for_each_possible_cpu(i) {
930 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
931 memcpy(newinfo->entries[i], entry0, newinfo->size);
932 }
933
934 return ret;
935 }
936
937 /* Gets counters. */
938 static inline int
939 add_entry_to_counter(const struct ip6t_entry *e,
940 struct xt_counters total[],
941 unsigned int *i)
942 {
943 ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
944
945 (*i)++;
946 return 0;
947 }
948
949 static inline int
950 set_entry_to_counter(const struct ip6t_entry *e,
951 struct ip6t_counters total[],
952 unsigned int *i)
953 {
954 SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
955
956 (*i)++;
957 return 0;
958 }
959
960 static void
961 get_counters(const struct xt_table_info *t,
962 struct xt_counters counters[])
963 {
964 struct ip6t_entry *iter;
965 unsigned int cpu;
966 unsigned int i;
967 unsigned int curcpu;
968
969 /* Instead of clearing (by a previous call to memset())
970 * the counters and using adds, we set the counters
971 * with data used by 'current' CPU
972 *
973 * Bottom half has to be disabled to prevent deadlock
974 * if new softirq were to run and call ipt_do_table
975 */
976 local_bh_disable();
977 curcpu = smp_processor_id();
978
979 i = 0;
980 xt_entry_foreach(iter, t->entries[curcpu], t->size)
981 if (set_entry_to_counter(iter, counters, &i) != 0)
982 break;
983
984 for_each_possible_cpu(cpu) {
985 if (cpu == curcpu)
986 continue;
987 i = 0;
988 xt_info_wrlock(cpu);
989 xt_entry_foreach(iter, t->entries[cpu], t->size)
990 if (add_entry_to_counter(iter, counters, &i) != 0)
991 break;
992 xt_info_wrunlock(cpu);
993 }
994 local_bh_enable();
995 }
996
997 static struct xt_counters *alloc_counters(const struct xt_table *table)
998 {
999 unsigned int countersize;
1000 struct xt_counters *counters;
1001 const struct xt_table_info *private = table->private;
1002
1003 /* We need atomic snapshot of counters: rest doesn't change
1004 (other than comefrom, which userspace doesn't care
1005 about). */
1006 countersize = sizeof(struct xt_counters) * private->number;
1007 counters = vmalloc_node(countersize, numa_node_id());
1008
1009 if (counters == NULL)
1010 return ERR_PTR(-ENOMEM);
1011
1012 get_counters(private, counters);
1013
1014 return counters;
1015 }
1016
1017 static int
1018 copy_entries_to_user(unsigned int total_size,
1019 const struct xt_table *table,
1020 void __user *userptr)
1021 {
1022 unsigned int off, num;
1023 const struct ip6t_entry *e;
1024 struct xt_counters *counters;
1025 const struct xt_table_info *private = table->private;
1026 int ret = 0;
1027 const void *loc_cpu_entry;
1028
1029 counters = alloc_counters(table);
1030 if (IS_ERR(counters))
1031 return PTR_ERR(counters);
1032
1033 /* choose the copy that is on our node/cpu, ...
1034 * This choice is lazy (because current thread is
1035 * allowed to migrate to another cpu)
1036 */
1037 loc_cpu_entry = private->entries[raw_smp_processor_id()];
1038 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
1039 ret = -EFAULT;
1040 goto free_counters;
1041 }
1042
1043 /* FIXME: use iterator macros --RR */
1044 /* ... then go back and fix counters and names */
1045 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
1046 unsigned int i;
1047 const struct ip6t_entry_match *m;
1048 const struct ip6t_entry_target *t;
1049
1050 e = (struct ip6t_entry *)(loc_cpu_entry + off);
1051 if (copy_to_user(userptr + off
1052 + offsetof(struct ip6t_entry, counters),
1053 &counters[num],
1054 sizeof(counters[num])) != 0) {
1055 ret = -EFAULT;
1056 goto free_counters;
1057 }
1058
1059 for (i = sizeof(struct ip6t_entry);
1060 i < e->target_offset;
1061 i += m->u.match_size) {
1062 m = (void *)e + i;
1063
1064 if (copy_to_user(userptr + off + i
1065 + offsetof(struct ip6t_entry_match,
1066 u.user.name),
1067 m->u.kernel.match->name,
1068 strlen(m->u.kernel.match->name)+1)
1069 != 0) {
1070 ret = -EFAULT;
1071 goto free_counters;
1072 }
1073 }
1074
1075 t = ip6t_get_target_c(e);
1076 if (copy_to_user(userptr + off + e->target_offset
1077 + offsetof(struct ip6t_entry_target,
1078 u.user.name),
1079 t->u.kernel.target->name,
1080 strlen(t->u.kernel.target->name)+1) != 0) {
1081 ret = -EFAULT;
1082 goto free_counters;
1083 }
1084 }
1085
1086 free_counters:
1087 vfree(counters);
1088 return ret;
1089 }
1090
1091 #ifdef CONFIG_COMPAT
1092 static void compat_standard_from_user(void *dst, const void *src)
1093 {
1094 int v = *(compat_int_t *)src;
1095
1096 if (v > 0)
1097 v += xt_compat_calc_jump(AF_INET6, v);
1098 memcpy(dst, &v, sizeof(v));
1099 }
1100
1101 static int compat_standard_to_user(void __user *dst, const void *src)
1102 {
1103 compat_int_t cv = *(int *)src;
1104
1105 if (cv > 0)
1106 cv -= xt_compat_calc_jump(AF_INET6, cv);
1107 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1108 }
1109
1110 static inline int
1111 compat_calc_match(const struct ip6t_entry_match *m, int *size)
1112 {
1113 *size += xt_compat_match_offset(m->u.kernel.match);
1114 return 0;
1115 }
1116
1117 static int compat_calc_entry(const struct ip6t_entry *e,
1118 const struct xt_table_info *info,
1119 const void *base, struct xt_table_info *newinfo)
1120 {
1121 const struct ip6t_entry_target *t;
1122 unsigned int entry_offset;
1123 int off, i, ret;
1124
1125 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1126 entry_offset = (void *)e - base;
1127 IP6T_MATCH_ITERATE(e, compat_calc_match, &off);
1128 t = ip6t_get_target_c(e);
1129 off += xt_compat_target_offset(t->u.kernel.target);
1130 newinfo->size -= off;
1131 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1132 if (ret)
1133 return ret;
1134
1135 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1136 if (info->hook_entry[i] &&
1137 (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1138 newinfo->hook_entry[i] -= off;
1139 if (info->underflow[i] &&
1140 (e < (struct ip6t_entry *)(base + info->underflow[i])))
1141 newinfo->underflow[i] -= off;
1142 }
1143 return 0;
1144 }
1145
1146 static int compat_table_info(const struct xt_table_info *info,
1147 struct xt_table_info *newinfo)
1148 {
1149 struct ip6t_entry *iter;
1150 void *loc_cpu_entry;
1151 int ret = 0;
1152
1153 if (!newinfo || !info)
1154 return -EINVAL;
1155
1156 /* we dont care about newinfo->entries[] */
1157 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1158 newinfo->initial_entries = 0;
1159 loc_cpu_entry = info->entries[raw_smp_processor_id()];
1160 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1161 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1162 if (ret != 0)
1163 break;
1164 }
1165 return ret;
1166 }
1167 #endif
1168
1169 static int get_info(struct net *net, void __user *user,
1170 const int *len, int compat)
1171 {
1172 char name[IP6T_TABLE_MAXNAMELEN];
1173 struct xt_table *t;
1174 int ret;
1175
1176 if (*len != sizeof(struct ip6t_getinfo)) {
1177 duprintf("length %u != %zu\n", *len,
1178 sizeof(struct ip6t_getinfo));
1179 return -EINVAL;
1180 }
1181
1182 if (copy_from_user(name, user, sizeof(name)) != 0)
1183 return -EFAULT;
1184
1185 name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
1186 #ifdef CONFIG_COMPAT
1187 if (compat)
1188 xt_compat_lock(AF_INET6);
1189 #endif
1190 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1191 "ip6table_%s", name);
1192 if (t && !IS_ERR(t)) {
1193 struct ip6t_getinfo info;
1194 const struct xt_table_info *private = t->private;
1195 #ifdef CONFIG_COMPAT
1196 struct xt_table_info tmp;
1197
1198 if (compat) {
1199 ret = compat_table_info(private, &tmp);
1200 xt_compat_flush_offsets(AF_INET6);
1201 private = &tmp;
1202 }
1203 #endif
1204 info.valid_hooks = t->valid_hooks;
1205 memcpy(info.hook_entry, private->hook_entry,
1206 sizeof(info.hook_entry));
1207 memcpy(info.underflow, private->underflow,
1208 sizeof(info.underflow));
1209 info.num_entries = private->number;
1210 info.size = private->size;
1211 strcpy(info.name, name);
1212
1213 if (copy_to_user(user, &info, *len) != 0)
1214 ret = -EFAULT;
1215 else
1216 ret = 0;
1217
1218 xt_table_unlock(t);
1219 module_put(t->me);
1220 } else
1221 ret = t ? PTR_ERR(t) : -ENOENT;
1222 #ifdef CONFIG_COMPAT
1223 if (compat)
1224 xt_compat_unlock(AF_INET6);
1225 #endif
1226 return ret;
1227 }
1228
1229 static int
1230 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1231 const int *len)
1232 {
1233 int ret;
1234 struct ip6t_get_entries get;
1235 struct xt_table *t;
1236
1237 if (*len < sizeof(get)) {
1238 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1239 return -EINVAL;
1240 }
1241 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1242 return -EFAULT;
1243 if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1244 duprintf("get_entries: %u != %zu\n",
1245 *len, sizeof(get) + get.size);
1246 return -EINVAL;
1247 }
1248
1249 t = xt_find_table_lock(net, AF_INET6, get.name);
1250 if (t && !IS_ERR(t)) {
1251 struct xt_table_info *private = t->private;
1252 duprintf("t->private->number = %u\n", private->number);
1253 if (get.size == private->size)
1254 ret = copy_entries_to_user(private->size,
1255 t, uptr->entrytable);
1256 else {
1257 duprintf("get_entries: I've got %u not %u!\n",
1258 private->size, get.size);
1259 ret = -EAGAIN;
1260 }
1261 module_put(t->me);
1262 xt_table_unlock(t);
1263 } else
1264 ret = t ? PTR_ERR(t) : -ENOENT;
1265
1266 return ret;
1267 }
1268
1269 static int
1270 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1271 struct xt_table_info *newinfo, unsigned int num_counters,
1272 void __user *counters_ptr)
1273 {
1274 int ret;
1275 struct xt_table *t;
1276 struct xt_table_info *oldinfo;
1277 struct xt_counters *counters;
1278 const void *loc_cpu_old_entry;
1279 struct ip6t_entry *iter;
1280
1281 ret = 0;
1282 counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
1283 numa_node_id());
1284 if (!counters) {
1285 ret = -ENOMEM;
1286 goto out;
1287 }
1288
1289 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1290 "ip6table_%s", name);
1291 if (!t || IS_ERR(t)) {
1292 ret = t ? PTR_ERR(t) : -ENOENT;
1293 goto free_newinfo_counters_untrans;
1294 }
1295
1296 /* You lied! */
1297 if (valid_hooks != t->valid_hooks) {
1298 duprintf("Valid hook crap: %08X vs %08X\n",
1299 valid_hooks, t->valid_hooks);
1300 ret = -EINVAL;
1301 goto put_module;
1302 }
1303
1304 oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1305 if (!oldinfo)
1306 goto put_module;
1307
1308 /* Update module usage count based on number of rules */
1309 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1310 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1311 if ((oldinfo->number > oldinfo->initial_entries) ||
1312 (newinfo->number <= oldinfo->initial_entries))
1313 module_put(t->me);
1314 if ((oldinfo->number > oldinfo->initial_entries) &&
1315 (newinfo->number <= oldinfo->initial_entries))
1316 module_put(t->me);
1317
1318 /* Get the old counters, and synchronize with replace */
1319 get_counters(oldinfo, counters);
1320
1321 /* Decrease module usage counts and free resource */
1322 loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1323 xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1324 if (cleanup_entry(iter, net, NULL) != 0)
1325 break;
1326
1327 xt_free_table_info(oldinfo);
1328 if (copy_to_user(counters_ptr, counters,
1329 sizeof(struct xt_counters) * num_counters) != 0)
1330 ret = -EFAULT;
1331 vfree(counters);
1332 xt_table_unlock(t);
1333 return ret;
1334
1335 put_module:
1336 module_put(t->me);
1337 xt_table_unlock(t);
1338 free_newinfo_counters_untrans:
1339 vfree(counters);
1340 out:
1341 return ret;
1342 }
1343
1344 static int
1345 do_replace(struct net *net, const void __user *user, unsigned int len)
1346 {
1347 int ret;
1348 struct ip6t_replace tmp;
1349 struct xt_table_info *newinfo;
1350 void *loc_cpu_entry;
1351 struct ip6t_entry *iter;
1352
1353 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1354 return -EFAULT;
1355
1356 /* overflow check */
1357 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1358 return -ENOMEM;
1359
1360 newinfo = xt_alloc_table_info(tmp.size);
1361 if (!newinfo)
1362 return -ENOMEM;
1363
1364 /* choose the copy that is on our node/cpu */
1365 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1366 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1367 tmp.size) != 0) {
1368 ret = -EFAULT;
1369 goto free_newinfo;
1370 }
1371
1372 ret = translate_table(net, tmp.name, tmp.valid_hooks,
1373 newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1374 tmp.hook_entry, tmp.underflow);
1375 if (ret != 0)
1376 goto free_newinfo;
1377
1378 duprintf("ip_tables: Translated table\n");
1379
1380 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1381 tmp.num_counters, tmp.counters);
1382 if (ret)
1383 goto free_newinfo_untrans;
1384 return 0;
1385
1386 free_newinfo_untrans:
1387 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1388 if (cleanup_entry(iter, net, NULL) != 0)
1389 break;
1390 free_newinfo:
1391 xt_free_table_info(newinfo);
1392 return ret;
1393 }
1394
1395 /* We're lazy, and add to the first CPU; overflow works its fey magic
1396 * and everything is OK. */
1397 static int
1398 add_counter_to_entry(struct ip6t_entry *e,
1399 const struct xt_counters addme[],
1400 unsigned int *i)
1401 {
1402 ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1403
1404 (*i)++;
1405 return 0;
1406 }
1407
1408 static int
1409 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1410 int compat)
1411 {
1412 unsigned int i, curcpu;
1413 struct xt_counters_info tmp;
1414 struct xt_counters *paddc;
1415 unsigned int num_counters;
1416 char *name;
1417 int size;
1418 void *ptmp;
1419 struct xt_table *t;
1420 const struct xt_table_info *private;
1421 int ret = 0;
1422 const void *loc_cpu_entry;
1423 struct ip6t_entry *iter;
1424 #ifdef CONFIG_COMPAT
1425 struct compat_xt_counters_info compat_tmp;
1426
1427 if (compat) {
1428 ptmp = &compat_tmp;
1429 size = sizeof(struct compat_xt_counters_info);
1430 } else
1431 #endif
1432 {
1433 ptmp = &tmp;
1434 size = sizeof(struct xt_counters_info);
1435 }
1436
1437 if (copy_from_user(ptmp, user, size) != 0)
1438 return -EFAULT;
1439
1440 #ifdef CONFIG_COMPAT
1441 if (compat) {
1442 num_counters = compat_tmp.num_counters;
1443 name = compat_tmp.name;
1444 } else
1445 #endif
1446 {
1447 num_counters = tmp.num_counters;
1448 name = tmp.name;
1449 }
1450
1451 if (len != size + num_counters * sizeof(struct xt_counters))
1452 return -EINVAL;
1453
1454 paddc = vmalloc_node(len - size, numa_node_id());
1455 if (!paddc)
1456 return -ENOMEM;
1457
1458 if (copy_from_user(paddc, user + size, len - size) != 0) {
1459 ret = -EFAULT;
1460 goto free;
1461 }
1462
1463 t = xt_find_table_lock(net, AF_INET6, name);
1464 if (!t || IS_ERR(t)) {
1465 ret = t ? PTR_ERR(t) : -ENOENT;
1466 goto free;
1467 }
1468
1469
1470 local_bh_disable();
1471 private = t->private;
1472 if (private->number != num_counters) {
1473 ret = -EINVAL;
1474 goto unlock_up_free;
1475 }
1476
1477 i = 0;
1478 /* Choose the copy that is on our node */
1479 curcpu = smp_processor_id();
1480 xt_info_wrlock(curcpu);
1481 loc_cpu_entry = private->entries[curcpu];
1482 xt_entry_foreach(iter, loc_cpu_entry, private->size)
1483 if (add_counter_to_entry(iter, paddc, &i) != 0)
1484 break;
1485 xt_info_wrunlock(curcpu);
1486
1487 unlock_up_free:
1488 local_bh_enable();
1489 xt_table_unlock(t);
1490 module_put(t->me);
1491 free:
1492 vfree(paddc);
1493
1494 return ret;
1495 }
1496
1497 #ifdef CONFIG_COMPAT
1498 struct compat_ip6t_replace {
1499 char name[IP6T_TABLE_MAXNAMELEN];
1500 u32 valid_hooks;
1501 u32 num_entries;
1502 u32 size;
1503 u32 hook_entry[NF_INET_NUMHOOKS];
1504 u32 underflow[NF_INET_NUMHOOKS];
1505 u32 num_counters;
1506 compat_uptr_t counters; /* struct ip6t_counters * */
1507 struct compat_ip6t_entry entries[0];
1508 };
1509
1510 static int
1511 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1512 unsigned int *size, struct xt_counters *counters,
1513 unsigned int *i)
1514 {
1515 struct ip6t_entry_target *t;
1516 struct compat_ip6t_entry __user *ce;
1517 u_int16_t target_offset, next_offset;
1518 compat_uint_t origsize;
1519 int ret;
1520
1521 ret = -EFAULT;
1522 origsize = *size;
1523 ce = (struct compat_ip6t_entry __user *)*dstptr;
1524 if (copy_to_user(ce, e, sizeof(struct ip6t_entry)))
1525 goto out;
1526
1527 if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
1528 goto out;
1529
1530 *dstptr += sizeof(struct compat_ip6t_entry);
1531 *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1532
1533 ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
1534 target_offset = e->target_offset - (origsize - *size);
1535 if (ret)
1536 goto out;
1537 t = ip6t_get_target(e);
1538 ret = xt_compat_target_to_user(t, dstptr, size);
1539 if (ret)
1540 goto out;
1541 ret = -EFAULT;
1542 next_offset = e->next_offset - (origsize - *size);
1543 if (put_user(target_offset, &ce->target_offset))
1544 goto out;
1545 if (put_user(next_offset, &ce->next_offset))
1546 goto out;
1547
1548 (*i)++;
1549 return 0;
1550 out:
1551 return ret;
1552 }
1553
1554 static int
1555 compat_find_calc_match(struct ip6t_entry_match *m,
1556 const char *name,
1557 const struct ip6t_ip6 *ipv6,
1558 unsigned int hookmask,
1559 int *size, unsigned int *i)
1560 {
1561 struct xt_match *match;
1562
1563 match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
1564 m->u.user.revision),
1565 "ip6t_%s", m->u.user.name);
1566 if (IS_ERR(match) || !match) {
1567 duprintf("compat_check_calc_match: `%s' not found\n",
1568 m->u.user.name);
1569 return match ? PTR_ERR(match) : -ENOENT;
1570 }
1571 m->u.kernel.match = match;
1572 *size += xt_compat_match_offset(match);
1573
1574 (*i)++;
1575 return 0;
1576 }
1577
1578 static int
1579 compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
1580 {
1581 if (i && (*i)-- == 0)
1582 return 1;
1583
1584 module_put(m->u.kernel.match->me);
1585 return 0;
1586 }
1587
1588 static int
1589 compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
1590 {
1591 struct ip6t_entry_target *t;
1592
1593 if (i && (*i)-- == 0)
1594 return 1;
1595
1596 /* Cleanup all matches */
1597 COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
1598 t = compat_ip6t_get_target(e);
1599 module_put(t->u.kernel.target->me);
1600 return 0;
1601 }
1602
1603 static int
1604 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1605 struct xt_table_info *newinfo,
1606 unsigned int *size,
1607 const unsigned char *base,
1608 const unsigned char *limit,
1609 const unsigned int *hook_entries,
1610 const unsigned int *underflows,
1611 unsigned int *i,
1612 const char *name)
1613 {
1614 struct ip6t_entry_target *t;
1615 struct xt_target *target;
1616 unsigned int entry_offset;
1617 unsigned int j;
1618 int ret, off, h;
1619
1620 duprintf("check_compat_entry_size_and_hooks %p\n", e);
1621 if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1622 (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
1623 duprintf("Bad offset %p, limit = %p\n", e, limit);
1624 return -EINVAL;
1625 }
1626
1627 if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1628 sizeof(struct compat_xt_entry_target)) {
1629 duprintf("checking: element %p size %u\n",
1630 e, e->next_offset);
1631 return -EINVAL;
1632 }
1633
1634 /* For purposes of check_entry casting the compat entry is fine */
1635 ret = check_entry((struct ip6t_entry *)e, name);
1636 if (ret)
1637 return ret;
1638
1639 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1640 entry_offset = (void *)e - (void *)base;
1641 j = 0;
1642 ret = COMPAT_IP6T_MATCH_ITERATE(e, compat_find_calc_match, name,
1643 &e->ipv6, e->comefrom, &off, &j);
1644 if (ret != 0)
1645 goto release_matches;
1646
1647 t = compat_ip6t_get_target(e);
1648 target = try_then_request_module(xt_find_target(AF_INET6,
1649 t->u.user.name,
1650 t->u.user.revision),
1651 "ip6t_%s", t->u.user.name);
1652 if (IS_ERR(target) || !target) {
1653 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1654 t->u.user.name);
1655 ret = target ? PTR_ERR(target) : -ENOENT;
1656 goto release_matches;
1657 }
1658 t->u.kernel.target = target;
1659
1660 off += xt_compat_target_offset(target);
1661 *size += off;
1662 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1663 if (ret)
1664 goto out;
1665
1666 /* Check hooks & underflows */
1667 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1668 if ((unsigned char *)e - base == hook_entries[h])
1669 newinfo->hook_entry[h] = hook_entries[h];
1670 if ((unsigned char *)e - base == underflows[h])
1671 newinfo->underflow[h] = underflows[h];
1672 }
1673
1674 /* Clear counters and comefrom */
1675 memset(&e->counters, 0, sizeof(e->counters));
1676 e->comefrom = 0;
1677
1678 (*i)++;
1679 return 0;
1680
1681 out:
1682 module_put(t->u.kernel.target->me);
1683 release_matches:
1684 IP6T_MATCH_ITERATE(e, compat_release_match, &j);
1685 return ret;
1686 }
1687
1688 static int
1689 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1690 unsigned int *size, const char *name,
1691 struct xt_table_info *newinfo, unsigned char *base)
1692 {
1693 struct ip6t_entry_target *t;
1694 struct xt_target *target;
1695 struct ip6t_entry *de;
1696 unsigned int origsize;
1697 int ret, h;
1698
1699 ret = 0;
1700 origsize = *size;
1701 de = (struct ip6t_entry *)*dstptr;
1702 memcpy(de, e, sizeof(struct ip6t_entry));
1703 memcpy(&de->counters, &e->counters, sizeof(e->counters));
1704
1705 *dstptr += sizeof(struct ip6t_entry);
1706 *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1707
1708 ret = COMPAT_IP6T_MATCH_ITERATE(e, xt_compat_match_from_user,
1709 dstptr, size);
1710 if (ret)
1711 return ret;
1712 de->target_offset = e->target_offset - (origsize - *size);
1713 t = compat_ip6t_get_target(e);
1714 target = t->u.kernel.target;
1715 xt_compat_target_from_user(t, dstptr, size);
1716
1717 de->next_offset = e->next_offset - (origsize - *size);
1718 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1719 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1720 newinfo->hook_entry[h] -= origsize - *size;
1721 if ((unsigned char *)de - base < newinfo->underflow[h])
1722 newinfo->underflow[h] -= origsize - *size;
1723 }
1724 return ret;
1725 }
1726
1727 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1728 const char *name, unsigned int *i)
1729 {
1730 unsigned int j;
1731 int ret;
1732 struct xt_mtchk_param mtpar;
1733
1734 j = 0;
1735 mtpar.net = net;
1736 mtpar.table = name;
1737 mtpar.entryinfo = &e->ipv6;
1738 mtpar.hook_mask = e->comefrom;
1739 mtpar.family = NFPROTO_IPV6;
1740 ret = IP6T_MATCH_ITERATE(e, check_match, &mtpar, &j);
1741 if (ret)
1742 goto cleanup_matches;
1743
1744 ret = check_target(e, net, name);
1745 if (ret)
1746 goto cleanup_matches;
1747
1748 (*i)++;
1749 return 0;
1750
1751 cleanup_matches:
1752 IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
1753 return ret;
1754 }
1755
1756 static int
1757 translate_compat_table(struct net *net,
1758 const char *name,
1759 unsigned int valid_hooks,
1760 struct xt_table_info **pinfo,
1761 void **pentry0,
1762 unsigned int total_size,
1763 unsigned int number,
1764 unsigned int *hook_entries,
1765 unsigned int *underflows)
1766 {
1767 unsigned int i, j;
1768 struct xt_table_info *newinfo, *info;
1769 void *pos, *entry0, *entry1;
1770 struct compat_ip6t_entry *iter0;
1771 struct ip6t_entry *iter1;
1772 unsigned int size;
1773 int ret = 0;
1774
1775 info = *pinfo;
1776 entry0 = *pentry0;
1777 size = total_size;
1778 info->number = number;
1779
1780 /* Init all hooks to impossible value. */
1781 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1782 info->hook_entry[i] = 0xFFFFFFFF;
1783 info->underflow[i] = 0xFFFFFFFF;
1784 }
1785
1786 duprintf("translate_compat_table: size %u\n", info->size);
1787 j = 0;
1788 xt_compat_lock(AF_INET6);
1789 /* Walk through entries, checking offsets. */
1790 xt_entry_foreach(iter0, entry0, total_size) {
1791 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1792 entry0, entry0 + total_size, hook_entries, underflows,
1793 &j, name);
1794 if (ret != 0)
1795 break;
1796 }
1797 if (ret != 0)
1798 goto out_unlock;
1799
1800 ret = -EINVAL;
1801 if (j != number) {
1802 duprintf("translate_compat_table: %u not %u entries\n",
1803 j, number);
1804 goto out_unlock;
1805 }
1806
1807 /* Check hooks all assigned */
1808 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1809 /* Only hooks which are valid */
1810 if (!(valid_hooks & (1 << i)))
1811 continue;
1812 if (info->hook_entry[i] == 0xFFFFFFFF) {
1813 duprintf("Invalid hook entry %u %u\n",
1814 i, hook_entries[i]);
1815 goto out_unlock;
1816 }
1817 if (info->underflow[i] == 0xFFFFFFFF) {
1818 duprintf("Invalid underflow %u %u\n",
1819 i, underflows[i]);
1820 goto out_unlock;
1821 }
1822 }
1823
1824 ret = -ENOMEM;
1825 newinfo = xt_alloc_table_info(size);
1826 if (!newinfo)
1827 goto out_unlock;
1828
1829 newinfo->number = number;
1830 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1831 newinfo->hook_entry[i] = info->hook_entry[i];
1832 newinfo->underflow[i] = info->underflow[i];
1833 }
1834 entry1 = newinfo->entries[raw_smp_processor_id()];
1835 pos = entry1;
1836 size = total_size;
1837 xt_entry_foreach(iter0, entry0, total_size) {
1838 ret = compat_copy_entry_from_user(iter0, &pos,
1839 &size, name, newinfo, entry1);
1840 if (ret != 0)
1841 break;
1842 }
1843 xt_compat_flush_offsets(AF_INET6);
1844 xt_compat_unlock(AF_INET6);
1845 if (ret)
1846 goto free_newinfo;
1847
1848 ret = -ELOOP;
1849 if (!mark_source_chains(newinfo, valid_hooks, entry1))
1850 goto free_newinfo;
1851
1852 i = 0;
1853 xt_entry_foreach(iter1, entry1, newinfo->size) {
1854 ret = compat_check_entry(iter1, net, name, &i);
1855 if (ret != 0)
1856 break;
1857 }
1858 if (ret) {
1859 /*
1860 * The first i matches need cleanup_entry (calls ->destroy)
1861 * because they had called ->check already. The other j-i
1862 * entries need only release.
1863 */
1864 int skip = i;
1865 j -= i;
1866 xt_entry_foreach(iter0, entry0, newinfo->size) {
1867 if (skip-- > 0)
1868 continue;
1869 if (compat_release_entry(iter0, &j) != 0)
1870 break;
1871 }
1872 xt_entry_foreach(iter1, entry1, newinfo->size)
1873 if (cleanup_entry(iter1, net, &i) != 0)
1874 break;
1875 xt_free_table_info(newinfo);
1876 return ret;
1877 }
1878
1879 /* And one copy for every other CPU */
1880 for_each_possible_cpu(i)
1881 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1882 memcpy(newinfo->entries[i], entry1, newinfo->size);
1883
1884 *pinfo = newinfo;
1885 *pentry0 = entry1;
1886 xt_free_table_info(info);
1887 return 0;
1888
1889 free_newinfo:
1890 xt_free_table_info(newinfo);
1891 out:
1892 xt_entry_foreach(iter0, entry0, total_size)
1893 if (compat_release_entry(iter0, &j) != 0)
1894 break;
1895 return ret;
1896 out_unlock:
1897 xt_compat_flush_offsets(AF_INET6);
1898 xt_compat_unlock(AF_INET6);
1899 goto out;
1900 }
1901
1902 static int
1903 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1904 {
1905 int ret;
1906 struct compat_ip6t_replace tmp;
1907 struct xt_table_info *newinfo;
1908 void *loc_cpu_entry;
1909 struct ip6t_entry *iter;
1910
1911 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1912 return -EFAULT;
1913
1914 /* overflow check */
1915 if (tmp.size >= INT_MAX / num_possible_cpus())
1916 return -ENOMEM;
1917 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1918 return -ENOMEM;
1919
1920 newinfo = xt_alloc_table_info(tmp.size);
1921 if (!newinfo)
1922 return -ENOMEM;
1923
1924 /* choose the copy that is on our node/cpu */
1925 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1926 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1927 tmp.size) != 0) {
1928 ret = -EFAULT;
1929 goto free_newinfo;
1930 }
1931
1932 ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1933 &newinfo, &loc_cpu_entry, tmp.size,
1934 tmp.num_entries, tmp.hook_entry,
1935 tmp.underflow);
1936 if (ret != 0)
1937 goto free_newinfo;
1938
1939 duprintf("compat_do_replace: Translated table\n");
1940
1941 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1942 tmp.num_counters, compat_ptr(tmp.counters));
1943 if (ret)
1944 goto free_newinfo_untrans;
1945 return 0;
1946
1947 free_newinfo_untrans:
1948 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1949 if (cleanup_entry(iter, net, NULL) != 0)
1950 break;
1951 free_newinfo:
1952 xt_free_table_info(newinfo);
1953 return ret;
1954 }
1955
1956 static int
1957 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1958 unsigned int len)
1959 {
1960 int ret;
1961
1962 if (!capable(CAP_NET_ADMIN))
1963 return -EPERM;
1964
1965 switch (cmd) {
1966 case IP6T_SO_SET_REPLACE:
1967 ret = compat_do_replace(sock_net(sk), user, len);
1968 break;
1969
1970 case IP6T_SO_SET_ADD_COUNTERS:
1971 ret = do_add_counters(sock_net(sk), user, len, 1);
1972 break;
1973
1974 default:
1975 duprintf("do_ip6t_set_ctl: unknown request %i\n", cmd);
1976 ret = -EINVAL;
1977 }
1978
1979 return ret;
1980 }
1981
1982 struct compat_ip6t_get_entries {
1983 char name[IP6T_TABLE_MAXNAMELEN];
1984 compat_uint_t size;
1985 struct compat_ip6t_entry entrytable[0];
1986 };
1987
1988 static int
1989 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1990 void __user *userptr)
1991 {
1992 struct xt_counters *counters;
1993 const struct xt_table_info *private = table->private;
1994 void __user *pos;
1995 unsigned int size;
1996 int ret = 0;
1997 const void *loc_cpu_entry;
1998 unsigned int i = 0;
1999 struct ip6t_entry *iter;
2000
2001 counters = alloc_counters(table);
2002 if (IS_ERR(counters))
2003 return PTR_ERR(counters);
2004
2005 /* choose the copy that is on our node/cpu, ...
2006 * This choice is lazy (because current thread is
2007 * allowed to migrate to another cpu)
2008 */
2009 loc_cpu_entry = private->entries[raw_smp_processor_id()];
2010 pos = userptr;
2011 size = total_size;
2012 xt_entry_foreach(iter, loc_cpu_entry, total_size) {
2013 ret = compat_copy_entry_to_user(iter, &pos,
2014 &size, counters, &i);
2015 if (ret != 0)
2016 break;
2017 }
2018
2019 vfree(counters);
2020 return ret;
2021 }
2022
2023 static int
2024 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
2025 int *len)
2026 {
2027 int ret;
2028 struct compat_ip6t_get_entries get;
2029 struct xt_table *t;
2030
2031 if (*len < sizeof(get)) {
2032 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
2033 return -EINVAL;
2034 }
2035
2036 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
2037 return -EFAULT;
2038
2039 if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
2040 duprintf("compat_get_entries: %u != %zu\n",
2041 *len, sizeof(get) + get.size);
2042 return -EINVAL;
2043 }
2044
2045 xt_compat_lock(AF_INET6);
2046 t = xt_find_table_lock(net, AF_INET6, get.name);
2047 if (t && !IS_ERR(t)) {
2048 const struct xt_table_info *private = t->private;
2049 struct xt_table_info info;
2050 duprintf("t->private->number = %u\n", private->number);
2051 ret = compat_table_info(private, &info);
2052 if (!ret && get.size == info.size) {
2053 ret = compat_copy_entries_to_user(private->size,
2054 t, uptr->entrytable);
2055 } else if (!ret) {
2056 duprintf("compat_get_entries: I've got %u not %u!\n",
2057 private->size, get.size);
2058 ret = -EAGAIN;
2059 }
2060 xt_compat_flush_offsets(AF_INET6);
2061 module_put(t->me);
2062 xt_table_unlock(t);
2063 } else
2064 ret = t ? PTR_ERR(t) : -ENOENT;
2065
2066 xt_compat_unlock(AF_INET6);
2067 return ret;
2068 }
2069
2070 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
2071
2072 static int
2073 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2074 {
2075 int ret;
2076
2077 if (!capable(CAP_NET_ADMIN))
2078 return -EPERM;
2079
2080 switch (cmd) {
2081 case IP6T_SO_GET_INFO:
2082 ret = get_info(sock_net(sk), user, len, 1);
2083 break;
2084 case IP6T_SO_GET_ENTRIES:
2085 ret = compat_get_entries(sock_net(sk), user, len);
2086 break;
2087 default:
2088 ret = do_ip6t_get_ctl(sk, cmd, user, len);
2089 }
2090 return ret;
2091 }
2092 #endif
2093
2094 static int
2095 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2096 {
2097 int ret;
2098
2099 if (!capable(CAP_NET_ADMIN))
2100 return -EPERM;
2101
2102 switch (cmd) {
2103 case IP6T_SO_SET_REPLACE:
2104 ret = do_replace(sock_net(sk), user, len);
2105 break;
2106
2107 case IP6T_SO_SET_ADD_COUNTERS:
2108 ret = do_add_counters(sock_net(sk), user, len, 0);
2109 break;
2110
2111 default:
2112 duprintf("do_ip6t_set_ctl: unknown request %i\n", cmd);
2113 ret = -EINVAL;
2114 }
2115
2116 return ret;
2117 }
2118
2119 static int
2120 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2121 {
2122 int ret;
2123
2124 if (!capable(CAP_NET_ADMIN))
2125 return -EPERM;
2126
2127 switch (cmd) {
2128 case IP6T_SO_GET_INFO:
2129 ret = get_info(sock_net(sk), user, len, 0);
2130 break;
2131
2132 case IP6T_SO_GET_ENTRIES:
2133 ret = get_entries(sock_net(sk), user, len);
2134 break;
2135
2136 case IP6T_SO_GET_REVISION_MATCH:
2137 case IP6T_SO_GET_REVISION_TARGET: {
2138 struct ip6t_get_revision rev;
2139 int target;
2140
2141 if (*len != sizeof(rev)) {
2142 ret = -EINVAL;
2143 break;
2144 }
2145 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2146 ret = -EFAULT;
2147 break;
2148 }
2149
2150 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2151 target = 1;
2152 else
2153 target = 0;
2154
2155 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2156 rev.revision,
2157 target, &ret),
2158 "ip6t_%s", rev.name);
2159 break;
2160 }
2161
2162 default:
2163 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2164 ret = -EINVAL;
2165 }
2166
2167 return ret;
2168 }
2169
2170 struct xt_table *ip6t_register_table(struct net *net,
2171 const struct xt_table *table,
2172 const struct ip6t_replace *repl)
2173 {
2174 int ret;
2175 struct xt_table_info *newinfo;
2176 struct xt_table_info bootstrap
2177 = { 0, 0, 0, { 0 }, { 0 }, { } };
2178 void *loc_cpu_entry;
2179 struct xt_table *new_table;
2180
2181 newinfo = xt_alloc_table_info(repl->size);
2182 if (!newinfo) {
2183 ret = -ENOMEM;
2184 goto out;
2185 }
2186
2187 /* choose the copy on our node/cpu, but dont care about preemption */
2188 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2189 memcpy(loc_cpu_entry, repl->entries, repl->size);
2190
2191 ret = translate_table(net, table->name, table->valid_hooks,
2192 newinfo, loc_cpu_entry, repl->size,
2193 repl->num_entries,
2194 repl->hook_entry,
2195 repl->underflow);
2196 if (ret != 0)
2197 goto out_free;
2198
2199 new_table = xt_register_table(net, table, &bootstrap, newinfo);
2200 if (IS_ERR(new_table)) {
2201 ret = PTR_ERR(new_table);
2202 goto out_free;
2203 }
2204 return new_table;
2205
2206 out_free:
2207 xt_free_table_info(newinfo);
2208 out:
2209 return ERR_PTR(ret);
2210 }
2211
2212 void ip6t_unregister_table(struct net *net, struct xt_table *table)
2213 {
2214 struct xt_table_info *private;
2215 void *loc_cpu_entry;
2216 struct module *table_owner = table->me;
2217 struct ip6t_entry *iter;
2218
2219 private = xt_unregister_table(table);
2220
2221 /* Decrease module usage counts and free resources */
2222 loc_cpu_entry = private->entries[raw_smp_processor_id()];
2223 xt_entry_foreach(iter, loc_cpu_entry, private->size)
2224 if (cleanup_entry(iter, net, NULL) != 0)
2225 break;
2226 if (private->number > private->initial_entries)
2227 module_put(table_owner);
2228 xt_free_table_info(private);
2229 }
2230
2231 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2232 static inline bool
2233 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2234 u_int8_t type, u_int8_t code,
2235 bool invert)
2236 {
2237 return (type == test_type && code >= min_code && code <= max_code)
2238 ^ invert;
2239 }
2240
2241 static bool
2242 icmp6_match(const struct sk_buff *skb, const struct xt_match_param *par)
2243 {
2244 const struct icmp6hdr *ic;
2245 struct icmp6hdr _icmph;
2246 const struct ip6t_icmp *icmpinfo = par->matchinfo;
2247
2248 /* Must not be a fragment. */
2249 if (par->fragoff != 0)
2250 return false;
2251
2252 ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2253 if (ic == NULL) {
2254 /* We've been asked to examine this packet, and we
2255 * can't. Hence, no choice but to drop.
2256 */
2257 duprintf("Dropping evil ICMP tinygram.\n");
2258 *par->hotdrop = true;
2259 return false;
2260 }
2261
2262 return icmp6_type_code_match(icmpinfo->type,
2263 icmpinfo->code[0],
2264 icmpinfo->code[1],
2265 ic->icmp6_type, ic->icmp6_code,
2266 !!(icmpinfo->invflags&IP6T_ICMP_INV));
2267 }
2268
2269 /* Called when user tries to insert an entry of this type. */
2270 static bool icmp6_checkentry(const struct xt_mtchk_param *par)
2271 {
2272 const struct ip6t_icmp *icmpinfo = par->matchinfo;
2273
2274 /* Must specify no unknown invflags */
2275 return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
2276 }
2277
2278 /* The built-in targets: standard (NULL) and error. */
2279 static struct xt_target ip6t_standard_target __read_mostly = {
2280 .name = IP6T_STANDARD_TARGET,
2281 .targetsize = sizeof(int),
2282 .family = NFPROTO_IPV6,
2283 #ifdef CONFIG_COMPAT
2284 .compatsize = sizeof(compat_int_t),
2285 .compat_from_user = compat_standard_from_user,
2286 .compat_to_user = compat_standard_to_user,
2287 #endif
2288 };
2289
2290 static struct xt_target ip6t_error_target __read_mostly = {
2291 .name = IP6T_ERROR_TARGET,
2292 .target = ip6t_error,
2293 .targetsize = IP6T_FUNCTION_MAXNAMELEN,
2294 .family = NFPROTO_IPV6,
2295 };
2296
2297 static struct nf_sockopt_ops ip6t_sockopts = {
2298 .pf = PF_INET6,
2299 .set_optmin = IP6T_BASE_CTL,
2300 .set_optmax = IP6T_SO_SET_MAX+1,
2301 .set = do_ip6t_set_ctl,
2302 #ifdef CONFIG_COMPAT
2303 .compat_set = compat_do_ip6t_set_ctl,
2304 #endif
2305 .get_optmin = IP6T_BASE_CTL,
2306 .get_optmax = IP6T_SO_GET_MAX+1,
2307 .get = do_ip6t_get_ctl,
2308 #ifdef CONFIG_COMPAT
2309 .compat_get = compat_do_ip6t_get_ctl,
2310 #endif
2311 .owner = THIS_MODULE,
2312 };
2313
2314 static struct xt_match icmp6_matchstruct __read_mostly = {
2315 .name = "icmp6",
2316 .match = icmp6_match,
2317 .matchsize = sizeof(struct ip6t_icmp),
2318 .checkentry = icmp6_checkentry,
2319 .proto = IPPROTO_ICMPV6,
2320 .family = NFPROTO_IPV6,
2321 };
2322
2323 static int __net_init ip6_tables_net_init(struct net *net)
2324 {
2325 return xt_proto_init(net, NFPROTO_IPV6);
2326 }
2327
2328 static void __net_exit ip6_tables_net_exit(struct net *net)
2329 {
2330 xt_proto_fini(net, NFPROTO_IPV6);
2331 }
2332
2333 static struct pernet_operations ip6_tables_net_ops = {
2334 .init = ip6_tables_net_init,
2335 .exit = ip6_tables_net_exit,
2336 };
2337
2338 static int __init ip6_tables_init(void)
2339 {
2340 int ret;
2341
2342 ret = register_pernet_subsys(&ip6_tables_net_ops);
2343 if (ret < 0)
2344 goto err1;
2345
2346 /* Noone else will be downing sem now, so we won't sleep */
2347 ret = xt_register_target(&ip6t_standard_target);
2348 if (ret < 0)
2349 goto err2;
2350 ret = xt_register_target(&ip6t_error_target);
2351 if (ret < 0)
2352 goto err3;
2353 ret = xt_register_match(&icmp6_matchstruct);
2354 if (ret < 0)
2355 goto err4;
2356
2357 /* Register setsockopt */
2358 ret = nf_register_sockopt(&ip6t_sockopts);
2359 if (ret < 0)
2360 goto err5;
2361
2362 printk(KERN_INFO "ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
2363 return 0;
2364
2365 err5:
2366 xt_unregister_match(&icmp6_matchstruct);
2367 err4:
2368 xt_unregister_target(&ip6t_error_target);
2369 err3:
2370 xt_unregister_target(&ip6t_standard_target);
2371 err2:
2372 unregister_pernet_subsys(&ip6_tables_net_ops);
2373 err1:
2374 return ret;
2375 }
2376
2377 static void __exit ip6_tables_fini(void)
2378 {
2379 nf_unregister_sockopt(&ip6t_sockopts);
2380
2381 xt_unregister_match(&icmp6_matchstruct);
2382 xt_unregister_target(&ip6t_error_target);
2383 xt_unregister_target(&ip6t_standard_target);
2384
2385 unregister_pernet_subsys(&ip6_tables_net_ops);
2386 }
2387
2388 /*
2389 * find the offset to specified header or the protocol number of last header
2390 * if target < 0. "last header" is transport protocol header, ESP, or
2391 * "No next header".
2392 *
2393 * If target header is found, its offset is set in *offset and return protocol
2394 * number. Otherwise, return -1.
2395 *
2396 * If the first fragment doesn't contain the final protocol header or
2397 * NEXTHDR_NONE it is considered invalid.
2398 *
2399 * Note that non-1st fragment is special case that "the protocol number
2400 * of last header" is "next header" field in Fragment header. In this case,
2401 * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
2402 * isn't NULL.
2403 *
2404 */
2405 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
2406 int target, unsigned short *fragoff)
2407 {
2408 unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
2409 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
2410 unsigned int len = skb->len - start;
2411
2412 if (fragoff)
2413 *fragoff = 0;
2414
2415 while (nexthdr != target) {
2416 struct ipv6_opt_hdr _hdr, *hp;
2417 unsigned int hdrlen;
2418
2419 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
2420 if (target < 0)
2421 break;
2422 return -ENOENT;
2423 }
2424
2425 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
2426 if (hp == NULL)
2427 return -EBADMSG;
2428 if (nexthdr == NEXTHDR_FRAGMENT) {
2429 unsigned short _frag_off;
2430 __be16 *fp;
2431 fp = skb_header_pointer(skb,
2432 start+offsetof(struct frag_hdr,
2433 frag_off),
2434 sizeof(_frag_off),
2435 &_frag_off);
2436 if (fp == NULL)
2437 return -EBADMSG;
2438
2439 _frag_off = ntohs(*fp) & ~0x7;
2440 if (_frag_off) {
2441 if (target < 0 &&
2442 ((!ipv6_ext_hdr(hp->nexthdr)) ||
2443 hp->nexthdr == NEXTHDR_NONE)) {
2444 if (fragoff)
2445 *fragoff = _frag_off;
2446 return hp->nexthdr;
2447 }
2448 return -ENOENT;
2449 }
2450 hdrlen = 8;
2451 } else if (nexthdr == NEXTHDR_AUTH)
2452 hdrlen = (hp->hdrlen + 2) << 2;
2453 else
2454 hdrlen = ipv6_optlen(hp);
2455
2456 nexthdr = hp->nexthdr;
2457 len -= hdrlen;
2458 start += hdrlen;
2459 }
2460
2461 *offset = start;
2462 return nexthdr;
2463 }
2464
2465 EXPORT_SYMBOL(ip6t_register_table);
2466 EXPORT_SYMBOL(ip6t_unregister_table);
2467 EXPORT_SYMBOL(ip6t_do_table);
2468 EXPORT_SYMBOL(ip6t_ext_hdr);
2469 EXPORT_SYMBOL(ipv6_find_hdr);
2470
2471 module_init(ip6_tables_init);
2472 module_exit(ip6_tables_fini);
Linux 2.6 libata-dev (mirror)