?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[PATCH] for_each_possible_cpu: network codes
[usb.git] / net / ipv6 / netfilter / ip6_tables.c
blob642b4b11464f1594c28cc99550fccd809d96d4df
1 /*
2 * Packet matching code.
3 *
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 * 19 Jan 2002 Harald Welte <laforge@gnumonks.org>
12 * - increase module usage count as soon as we have rules inside
13 * a table
14 * 06 Jun 2002 Andras Kis-Szabo <kisza@sch.bme.hu>
15 * - new extension header parser code
16 * 15 Oct 2005 Harald Welte <laforge@netfilter.org>
17 * - Unification of {ip,ip6}_tables into x_tables
18 * - Removed tcp and udp code, since it's not ipv6 specific
19 */
20
21 #include <linux/capability.h>
22 #include <linux/config.h>
23 #include <linux/in.h>
24 #include <linux/skbuff.h>
25 #include <linux/kmod.h>
26 #include <linux/vmalloc.h>
27 #include <linux/netdevice.h>
28 #include <linux/module.h>
29 #include <linux/icmpv6.h>
30 #include <net/ipv6.h>
31 #include <asm/uaccess.h>
32 #include <linux/mutex.h>
33 #include <linux/proc_fs.h>
34 #include <linux/cpumask.h>
35
36 #include <linux/netfilter_ipv6/ip6_tables.h>
37 #include <linux/netfilter/x_tables.h>
38
39 MODULE_LICENSE("GPL");
40 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
41 MODULE_DESCRIPTION("IPv6 packet filter");
42
43 #define IPV6_HDR_LEN (sizeof(struct ipv6hdr))
44 #define IPV6_OPTHDR_LEN (sizeof(struct ipv6_opt_hdr))
45
46 /*#define DEBUG_IP_FIREWALL*/
47 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
48 /*#define DEBUG_IP_FIREWALL_USER*/
49
50 #ifdef DEBUG_IP_FIREWALL
51 #define dprintf(format, args...) printk(format , ## args)
52 #else
53 #define dprintf(format, args...)
54 #endif
55
56 #ifdef DEBUG_IP_FIREWALL_USER
57 #define duprintf(format, args...) printk(format , ## args)
58 #else
59 #define duprintf(format, args...)
60 #endif
61
62 #ifdef CONFIG_NETFILTER_DEBUG
63 #define IP_NF_ASSERT(x) \
64 do { \
65 if (!(x)) \
66 printk("IP_NF_ASSERT: %s:%s:%u\n", \
67 __FUNCTION__, __FILE__, __LINE__); \
68 } while(0)
69 #else
70 #define IP_NF_ASSERT(x)
71 #endif
72
73
74 #include <linux/netfilter_ipv4/listhelp.h>
75
76 #if 0
77 /* All the better to debug you with... */
78 #define static
79 #define inline
80 #endif
81
82 /*
83 We keep a set of rules for each CPU, so we can avoid write-locking
84 them in the softirq when updating the counters and therefore
85 only need to read-lock in the softirq; doing a write_lock_bh() in user
86 context stops packets coming through and allows user context to read
87 the counters or update the rules.
88
89 Hence the start of any table is given by get_table() below. */
90
91 #if 0
92 #define down(x) do { printk("DOWN:%u:" #x "\n", __LINE__); down(x); } while(0)
93 #define down_interruptible(x) ({ int __r; printk("DOWNi:%u:" #x "\n", __LINE__); __r = down_interruptible(x); if (__r != 0) printk("ABORT-DOWNi:%u\n", __LINE__); __r; })
94 #define up(x) do { printk("UP:%u:" #x "\n", __LINE__); up(x); } while(0)
95 #endif
96
97 /* Check for an extension */
98 int
99 ip6t_ext_hdr(u8 nexthdr)
100 {
101 return ( (nexthdr == IPPROTO_HOPOPTS) ||
102 (nexthdr == IPPROTO_ROUTING) ||
103 (nexthdr == IPPROTO_FRAGMENT) ||
104 (nexthdr == IPPROTO_ESP) ||
105 (nexthdr == IPPROTO_AH) ||
106 (nexthdr == IPPROTO_NONE) ||
107 (nexthdr == IPPROTO_DSTOPTS) );
108 }
109
110 /* Returns whether matches rule or not. */
111 static inline int
112 ip6_packet_match(const struct sk_buff *skb,
113 const char *indev,
114 const char *outdev,
115 const struct ip6t_ip6 *ip6info,
116 unsigned int *protoff,
117 int *fragoff)
118 {
119 size_t i;
120 unsigned long ret;
121 const struct ipv6hdr *ipv6 = skb->nh.ipv6h;
122
123 #define FWINV(bool,invflg) ((bool) ^ !!(ip6info->invflags & invflg))
124
125 if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
126 &ip6info->src), IP6T_INV_SRCIP)
127 || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
128 &ip6info->dst), IP6T_INV_DSTIP)) {
129 dprintf("Source or dest mismatch.\n");
130 /*
131 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
132 ipinfo->smsk.s_addr, ipinfo->src.s_addr,
133 ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
134 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
135 ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
136 ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
137 return 0;
138 }
139
140 /* Look for ifname matches; this should unroll nicely. */
141 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
142 ret |= (((const unsigned long *)indev)[i]
143 ^ ((const unsigned long *)ip6info->iniface)[i])
144 & ((const unsigned long *)ip6info->iniface_mask)[i];
145 }
146
147 if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
148 dprintf("VIA in mismatch (%s vs %s).%s\n",
149 indev, ip6info->iniface,
150 ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
151 return 0;
152 }
153
154 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
155 ret |= (((const unsigned long *)outdev)[i]
156 ^ ((const unsigned long *)ip6info->outiface)[i])
157 & ((const unsigned long *)ip6info->outiface_mask)[i];
158 }
159
160 if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
161 dprintf("VIA out mismatch (%s vs %s).%s\n",
162 outdev, ip6info->outiface,
163 ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
164 return 0;
165 }
166
167 /* ... might want to do something with class and flowlabel here ... */
168
169 /* look for the desired protocol header */
170 if((ip6info->flags & IP6T_F_PROTO)) {
171 int protohdr;
172 unsigned short _frag_off;
173
174 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
175 if (protohdr < 0)
176 return 0;
177
178 *fragoff = _frag_off;
179
180 dprintf("Packet protocol %hi ?= %s%hi.\n",
181 protohdr,
182 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
183 ip6info->proto);
184
185 if (ip6info->proto == protohdr) {
186 if(ip6info->invflags & IP6T_INV_PROTO) {
187 return 0;
188 }
189 return 1;
190 }
191
192 /* We need match for the '-p all', too! */
193 if ((ip6info->proto != 0) &&
194 !(ip6info->invflags & IP6T_INV_PROTO))
195 return 0;
196 }
197 return 1;
198 }
199
200 /* should be ip6 safe */
201 static inline int
202 ip6_checkentry(const struct ip6t_ip6 *ipv6)
203 {
204 if (ipv6->flags & ~IP6T_F_MASK) {
205 duprintf("Unknown flag bits set: %08X\n",
206 ipv6->flags & ~IP6T_F_MASK);
207 return 0;
208 }
209 if (ipv6->invflags & ~IP6T_INV_MASK) {
210 duprintf("Unknown invflag bits set: %08X\n",
211 ipv6->invflags & ~IP6T_INV_MASK);
212 return 0;
213 }
214 return 1;
215 }
216
217 static unsigned int
218 ip6t_error(struct sk_buff **pskb,
219 const struct net_device *in,
220 const struct net_device *out,
221 unsigned int hooknum,
222 const struct xt_target *target,
223 const void *targinfo,
224 void *userinfo)
225 {
226 if (net_ratelimit())
227 printk("ip6_tables: error: `%s'\n", (char *)targinfo);
228
229 return NF_DROP;
230 }
231
232 static inline
233 int do_match(struct ip6t_entry_match *m,
234 const struct sk_buff *skb,
235 const struct net_device *in,
236 const struct net_device *out,
237 int offset,
238 unsigned int protoff,
239 int *hotdrop)
240 {
241 /* Stop iteration if it doesn't match */
242 if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
243 offset, protoff, hotdrop))
244 return 1;
245 else
246 return 0;
247 }
248
249 static inline struct ip6t_entry *
250 get_entry(void *base, unsigned int offset)
251 {
252 return (struct ip6t_entry *)(base + offset);
253 }
254
255 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
256 unsigned int
257 ip6t_do_table(struct sk_buff **pskb,
258 unsigned int hook,
259 const struct net_device *in,
260 const struct net_device *out,
261 struct xt_table *table,
262 void *userdata)
263 {
264 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
265 int offset = 0;
266 unsigned int protoff = 0;
267 int hotdrop = 0;
268 /* Initializing verdict to NF_DROP keeps gcc happy. */
269 unsigned int verdict = NF_DROP;
270 const char *indev, *outdev;
271 void *table_base;
272 struct ip6t_entry *e, *back;
273 struct xt_table_info *private;
274
275 /* Initialization */
276 indev = in ? in->name : nulldevname;
277 outdev = out ? out->name : nulldevname;
278 /* We handle fragments by dealing with the first fragment as
279 * if it was a normal packet. All other fragments are treated
280 * normally, except that they will NEVER match rules that ask
281 * things we don't know, ie. tcp syn flag or ports). If the
282 * rule is also a fragment-specific rule, non-fragments won't
283 * match it. */
284
285 read_lock_bh(&table->lock);
286 private = table->private;
287 IP_NF_ASSERT(table->valid_hooks & (1 << hook));
288 table_base = (void *)private->entries[smp_processor_id()];
289 e = get_entry(table_base, private->hook_entry[hook]);
290
291 #ifdef CONFIG_NETFILTER_DEBUG
292 /* Check noone else using our table */
293 if (((struct ip6t_entry *)table_base)->comefrom != 0xdead57ac
294 && ((struct ip6t_entry *)table_base)->comefrom != 0xeeeeeeec) {
295 printk("ASSERT: CPU #%u, %s comefrom(%p) = %X\n",
296 smp_processor_id(),
297 table->name,
298 &((struct ip6t_entry *)table_base)->comefrom,
299 ((struct ip6t_entry *)table_base)->comefrom);
300 }
301 ((struct ip6t_entry *)table_base)->comefrom = 0x57acc001;
302 #endif
303
304 /* For return from builtin chain */
305 back = get_entry(table_base, private->underflow[hook]);
306
307 do {
308 IP_NF_ASSERT(e);
309 IP_NF_ASSERT(back);
310 if (ip6_packet_match(*pskb, indev, outdev, &e->ipv6,
311 &protoff, &offset)) {
312 struct ip6t_entry_target *t;
313
314 if (IP6T_MATCH_ITERATE(e, do_match,
315 *pskb, in, out,
316 offset, protoff, &hotdrop) != 0)
317 goto no_match;
318
319 ADD_COUNTER(e->counters,
320 ntohs((*pskb)->nh.ipv6h->payload_len)
321 + IPV6_HDR_LEN,
322 1);
323
324 t = ip6t_get_target(e);
325 IP_NF_ASSERT(t->u.kernel.target);
326 /* Standard target? */
327 if (!t->u.kernel.target->target) {
328 int v;
329
330 v = ((struct ip6t_standard_target *)t)->verdict;
331 if (v < 0) {
332 /* Pop from stack? */
333 if (v != IP6T_RETURN) {
334 verdict = (unsigned)(-v) - 1;
335 break;
336 }
337 e = back;
338 back = get_entry(table_base,
339 back->comefrom);
340 continue;
341 }
342 if (table_base + v != (void *)e + e->next_offset
343 && !(e->ipv6.flags & IP6T_F_GOTO)) {
344 /* Save old back ptr in next entry */
345 struct ip6t_entry *next
346 = (void *)e + e->next_offset;
347 next->comefrom
348 = (void *)back - table_base;
349 /* set back pointer to next entry */
350 back = next;
351 }
352
353 e = get_entry(table_base, v);
354 } else {
355 /* Targets which reenter must return
356 abs. verdicts */
357 #ifdef CONFIG_NETFILTER_DEBUG
358 ((struct ip6t_entry *)table_base)->comefrom
359 = 0xeeeeeeec;
360 #endif
361 verdict = t->u.kernel.target->target(pskb,
362 in, out,
363 hook,
364 t->u.kernel.target,
365 t->data,
366 userdata);
367
368 #ifdef CONFIG_NETFILTER_DEBUG
369 if (((struct ip6t_entry *)table_base)->comefrom
370 != 0xeeeeeeec
371 && verdict == IP6T_CONTINUE) {
372 printk("Target %s reentered!\n",
373 t->u.kernel.target->name);
374 verdict = NF_DROP;
375 }
376 ((struct ip6t_entry *)table_base)->comefrom
377 = 0x57acc001;
378 #endif
379 if (verdict == IP6T_CONTINUE)
380 e = (void *)e + e->next_offset;
381 else
382 /* Verdict */
383 break;
384 }
385 } else {
386
387 no_match:
388 e = (void *)e + e->next_offset;
389 }
390 } while (!hotdrop);
391
392 #ifdef CONFIG_NETFILTER_DEBUG
393 ((struct ip6t_entry *)table_base)->comefrom = 0xdead57ac;
394 #endif
395 read_unlock_bh(&table->lock);
396
397 #ifdef DEBUG_ALLOW_ALL
398 return NF_ACCEPT;
399 #else
400 if (hotdrop)
401 return NF_DROP;
402 else return verdict;
403 #endif
404 }
405
406 /* All zeroes == unconditional rule. */
407 static inline int
408 unconditional(const struct ip6t_ip6 *ipv6)
409 {
410 unsigned int i;
411
412 for (i = 0; i < sizeof(*ipv6); i++)
413 if (((char *)ipv6)[i])
414 break;
415
416 return (i == sizeof(*ipv6));
417 }
418
419 /* Figures out from what hook each rule can be called: returns 0 if
420 there are loops. Puts hook bitmask in comefrom. */
421 static int
422 mark_source_chains(struct xt_table_info *newinfo,
423 unsigned int valid_hooks, void *entry0)
424 {
425 unsigned int hook;
426
427 /* No recursion; use packet counter to save back ptrs (reset
428 to 0 as we leave), and comefrom to save source hook bitmask */
429 for (hook = 0; hook < NF_IP6_NUMHOOKS; hook++) {
430 unsigned int pos = newinfo->hook_entry[hook];
431 struct ip6t_entry *e
432 = (struct ip6t_entry *)(entry0 + pos);
433
434 if (!(valid_hooks & (1 << hook)))
435 continue;
436
437 /* Set initial back pointer. */
438 e->counters.pcnt = pos;
439
440 for (;;) {
441 struct ip6t_standard_target *t
442 = (void *)ip6t_get_target(e);
443
444 if (e->comefrom & (1 << NF_IP6_NUMHOOKS)) {
445 printk("iptables: loop hook %u pos %u %08X.\n",
446 hook, pos, e->comefrom);
447 return 0;
448 }
449 e->comefrom
450 |= ((1 << hook) | (1 << NF_IP6_NUMHOOKS));
451
452 /* Unconditional return/END. */
453 if (e->target_offset == sizeof(struct ip6t_entry)
454 && (strcmp(t->target.u.user.name,
455 IP6T_STANDARD_TARGET) == 0)
456 && t->verdict < 0
457 && unconditional(&e->ipv6)) {
458 unsigned int oldpos, size;
459
460 /* Return: backtrack through the last
461 big jump. */
462 do {
463 e->comefrom ^= (1<<NF_IP6_NUMHOOKS);
464 #ifdef DEBUG_IP_FIREWALL_USER
465 if (e->comefrom
466 & (1 << NF_IP6_NUMHOOKS)) {
467 duprintf("Back unset "
468 "on hook %u "
469 "rule %u\n",
470 hook, pos);
471 }
472 #endif
473 oldpos = pos;
474 pos = e->counters.pcnt;
475 e->counters.pcnt = 0;
476
477 /* We're at the start. */
478 if (pos == oldpos)
479 goto next;
480
481 e = (struct ip6t_entry *)
482 (entry0 + pos);
483 } while (oldpos == pos + e->next_offset);
484
485 /* Move along one */
486 size = e->next_offset;
487 e = (struct ip6t_entry *)
488 (entry0 + pos + size);
489 e->counters.pcnt = pos;
490 pos += size;
491 } else {
492 int newpos = t->verdict;
493
494 if (strcmp(t->target.u.user.name,
495 IP6T_STANDARD_TARGET) == 0
496 && newpos >= 0) {
497 /* This a jump; chase it. */
498 duprintf("Jump rule %u -> %u\n",
499 pos, newpos);
500 } else {
501 /* ... this is a fallthru */
502 newpos = pos + e->next_offset;
503 }
504 e = (struct ip6t_entry *)
505 (entry0 + newpos);
506 e->counters.pcnt = pos;
507 pos = newpos;
508 }
509 }
510 next:
511 duprintf("Finished chain %u\n", hook);
512 }
513 return 1;
514 }
515
516 static inline int
517 cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
518 {
519 if (i && (*i)-- == 0)
520 return 1;
521
522 if (m->u.kernel.match->destroy)
523 m->u.kernel.match->destroy(m->u.kernel.match, m->data,
524 m->u.match_size - sizeof(*m));
525 module_put(m->u.kernel.match->me);
526 return 0;
527 }
528
529 static inline int
530 standard_check(const struct ip6t_entry_target *t,
531 unsigned int max_offset)
532 {
533 struct ip6t_standard_target *targ = (void *)t;
534
535 /* Check standard info. */
536 if (targ->verdict >= 0
537 && targ->verdict > max_offset - sizeof(struct ip6t_entry)) {
538 duprintf("ip6t_standard_check: bad verdict (%i)\n",
539 targ->verdict);
540 return 0;
541 }
542 if (targ->verdict < -NF_MAX_VERDICT - 1) {
543 duprintf("ip6t_standard_check: bad negative verdict (%i)\n",
544 targ->verdict);
545 return 0;
546 }
547 return 1;
548 }
549
550 static inline int
551 check_match(struct ip6t_entry_match *m,
552 const char *name,
553 const struct ip6t_ip6 *ipv6,
554 unsigned int hookmask,
555 unsigned int *i)
556 {
557 struct ip6t_match *match;
558 int ret;
559
560 match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
561 m->u.user.revision),
562 "ip6t_%s", m->u.user.name);
563 if (IS_ERR(match) || !match) {
564 duprintf("check_match: `%s' not found\n", m->u.user.name);
565 return match ? PTR_ERR(match) : -ENOENT;
566 }
567 m->u.kernel.match = match;
568
569 ret = xt_check_match(match, AF_INET6, m->u.match_size - sizeof(*m),
570 name, hookmask, ipv6->proto,
571 ipv6->invflags & IP6T_INV_PROTO);
572 if (ret)
573 goto err;
574
575 if (m->u.kernel.match->checkentry
576 && !m->u.kernel.match->checkentry(name, ipv6, match, m->data,
577 m->u.match_size - sizeof(*m),
578 hookmask)) {
579 duprintf("ip_tables: check failed for `%s'.\n",
580 m->u.kernel.match->name);
581 ret = -EINVAL;
582 goto err;
583 }
584
585 (*i)++;
586 return 0;
587 err:
588 module_put(m->u.kernel.match->me);
589 return ret;
590 }
591
592 static struct ip6t_target ip6t_standard_target;
593
594 static inline int
595 check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
596 unsigned int *i)
597 {
598 struct ip6t_entry_target *t;
599 struct ip6t_target *target;
600 int ret;
601 unsigned int j;
602
603 if (!ip6_checkentry(&e->ipv6)) {
604 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
605 return -EINVAL;
606 }
607
608 j = 0;
609 ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6, e->comefrom, &j);
610 if (ret != 0)
611 goto cleanup_matches;
612
613 t = ip6t_get_target(e);
614 target = try_then_request_module(xt_find_target(AF_INET6,
615 t->u.user.name,
616 t->u.user.revision),
617 "ip6t_%s", t->u.user.name);
618 if (IS_ERR(target) || !target) {
619 duprintf("check_entry: `%s' not found\n", t->u.user.name);
620 ret = target ? PTR_ERR(target) : -ENOENT;
621 goto cleanup_matches;
622 }
623 t->u.kernel.target = target;
624
625 ret = xt_check_target(target, AF_INET6, t->u.target_size - sizeof(*t),
626 name, e->comefrom, e->ipv6.proto,
627 e->ipv6.invflags & IP6T_INV_PROTO);
628 if (ret)
629 goto err;
630
631 if (t->u.kernel.target == &ip6t_standard_target) {
632 if (!standard_check(t, size)) {
633 ret = -EINVAL;
634 goto cleanup_matches;
635 }
636 } else if (t->u.kernel.target->checkentry
637 && !t->u.kernel.target->checkentry(name, e, target, t->data,
638 t->u.target_size
639 - sizeof(*t),
640 e->comefrom)) {
641 duprintf("ip_tables: check failed for `%s'.\n",
642 t->u.kernel.target->name);
643 ret = -EINVAL;
644 goto err;
645 }
646
647 (*i)++;
648 return 0;
649 err:
650 module_put(t->u.kernel.target->me);
651 cleanup_matches:
652 IP6T_MATCH_ITERATE(e, cleanup_match, &j);
653 return ret;
654 }
655
656 static inline int
657 check_entry_size_and_hooks(struct ip6t_entry *e,
658 struct xt_table_info *newinfo,
659 unsigned char *base,
660 unsigned char *limit,
661 const unsigned int *hook_entries,
662 const unsigned int *underflows,
663 unsigned int *i)
664 {
665 unsigned int h;
666
667 if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
668 || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
669 duprintf("Bad offset %p\n", e);
670 return -EINVAL;
671 }
672
673 if (e->next_offset
674 < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
675 duprintf("checking: element %p size %u\n",
676 e, e->next_offset);
677 return -EINVAL;
678 }
679
680 /* Check hooks & underflows */
681 for (h = 0; h < NF_IP6_NUMHOOKS; h++) {
682 if ((unsigned char *)e - base == hook_entries[h])
683 newinfo->hook_entry[h] = hook_entries[h];
684 if ((unsigned char *)e - base == underflows[h])
685 newinfo->underflow[h] = underflows[h];
686 }
687
688 /* FIXME: underflows must be unconditional, standard verdicts
689 < 0 (not IP6T_RETURN). --RR */
690
691 /* Clear counters and comefrom */
692 e->counters = ((struct xt_counters) { 0, 0 });
693 e->comefrom = 0;
694
695 (*i)++;
696 return 0;
697 }
698
699 static inline int
700 cleanup_entry(struct ip6t_entry *e, unsigned int *i)
701 {
702 struct ip6t_entry_target *t;
703
704 if (i && (*i)-- == 0)
705 return 1;
706
707 /* Cleanup all matches */
708 IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
709 t = ip6t_get_target(e);
710 if (t->u.kernel.target->destroy)
711 t->u.kernel.target->destroy(t->u.kernel.target, t->data,
712 t->u.target_size - sizeof(*t));
713 module_put(t->u.kernel.target->me);
714 return 0;
715 }
716
717 /* Checks and translates the user-supplied table segment (held in
718 newinfo) */
719 static int
720 translate_table(const char *name,
721 unsigned int valid_hooks,
722 struct xt_table_info *newinfo,
723 void *entry0,
724 unsigned int size,
725 unsigned int number,
726 const unsigned int *hook_entries,
727 const unsigned int *underflows)
728 {
729 unsigned int i;
730 int ret;
731
732 newinfo->size = size;
733 newinfo->number = number;
734
735 /* Init all hooks to impossible value. */
736 for (i = 0; i < NF_IP6_NUMHOOKS; i++) {
737 newinfo->hook_entry[i] = 0xFFFFFFFF;
738 newinfo->underflow[i] = 0xFFFFFFFF;
739 }
740
741 duprintf("translate_table: size %u\n", newinfo->size);
742 i = 0;
743 /* Walk through entries, checking offsets. */
744 ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
745 check_entry_size_and_hooks,
746 newinfo,
747 entry0,
748 entry0 + size,
749 hook_entries, underflows, &i);
750 if (ret != 0)
751 return ret;
752
753 if (i != number) {
754 duprintf("translate_table: %u not %u entries\n",
755 i, number);
756 return -EINVAL;
757 }
758
759 /* Check hooks all assigned */
760 for (i = 0; i < NF_IP6_NUMHOOKS; i++) {
761 /* Only hooks which are valid */
762 if (!(valid_hooks & (1 << i)))
763 continue;
764 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
765 duprintf("Invalid hook entry %u %u\n",
766 i, hook_entries[i]);
767 return -EINVAL;
768 }
769 if (newinfo->underflow[i] == 0xFFFFFFFF) {
770 duprintf("Invalid underflow %u %u\n",
771 i, underflows[i]);
772 return -EINVAL;
773 }
774 }
775
776 if (!mark_source_chains(newinfo, valid_hooks, entry0))
777 return -ELOOP;
778
779 /* Finally, each sanity check must pass */
780 i = 0;
781 ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
782 check_entry, name, size, &i);
783
784 if (ret != 0) {
785 IP6T_ENTRY_ITERATE(entry0, newinfo->size,
786 cleanup_entry, &i);
787 return ret;
788 }
789
790 /* And one copy for every other CPU */
791 for_each_possible_cpu(i) {
792 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
793 memcpy(newinfo->entries[i], entry0, newinfo->size);
794 }
795
796 return ret;
797 }
798
799 /* Gets counters. */
800 static inline int
801 add_entry_to_counter(const struct ip6t_entry *e,
802 struct xt_counters total[],
803 unsigned int *i)
804 {
805 ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
806
807 (*i)++;
808 return 0;
809 }
810
811 static inline int
812 set_entry_to_counter(const struct ip6t_entry *e,
813 struct ip6t_counters total[],
814 unsigned int *i)
815 {
816 SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
817
818 (*i)++;
819 return 0;
820 }
821
822 static void
823 get_counters(const struct xt_table_info *t,
824 struct xt_counters counters[])
825 {
826 unsigned int cpu;
827 unsigned int i;
828 unsigned int curcpu;
829
830 /* Instead of clearing (by a previous call to memset())
831 * the counters and using adds, we set the counters
832 * with data used by 'current' CPU
833 * We dont care about preemption here.
834 */
835 curcpu = raw_smp_processor_id();
836
837 i = 0;
838 IP6T_ENTRY_ITERATE(t->entries[curcpu],
839 t->size,
840 set_entry_to_counter,
841 counters,
842 &i);
843
844 for_each_possible_cpu(cpu) {
845 if (cpu == curcpu)
846 continue;
847 i = 0;
848 IP6T_ENTRY_ITERATE(t->entries[cpu],
849 t->size,
850 add_entry_to_counter,
851 counters,
852 &i);
853 }
854 }
855
856 static int
857 copy_entries_to_user(unsigned int total_size,
858 struct xt_table *table,
859 void __user *userptr)
860 {
861 unsigned int off, num, countersize;
862 struct ip6t_entry *e;
863 struct xt_counters *counters;
864 struct xt_table_info *private = table->private;
865 int ret = 0;
866 void *loc_cpu_entry;
867
868 /* We need atomic snapshot of counters: rest doesn't change
869 (other than comefrom, which userspace doesn't care
870 about). */
871 countersize = sizeof(struct xt_counters) * private->number;
872 counters = vmalloc(countersize);
873
874 if (counters == NULL)
875 return -ENOMEM;
876
877 /* First, sum counters... */
878 write_lock_bh(&table->lock);
879 get_counters(private, counters);
880 write_unlock_bh(&table->lock);
881
882 /* choose the copy that is on ourc node/cpu */
883 loc_cpu_entry = private->entries[raw_smp_processor_id()];
884 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
885 ret = -EFAULT;
886 goto free_counters;
887 }
888
889 /* FIXME: use iterator macros --RR */
890 /* ... then go back and fix counters and names */
891 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
892 unsigned int i;
893 struct ip6t_entry_match *m;
894 struct ip6t_entry_target *t;
895
896 e = (struct ip6t_entry *)(loc_cpu_entry + off);
897 if (copy_to_user(userptr + off
898 + offsetof(struct ip6t_entry, counters),
899 &counters[num],
900 sizeof(counters[num])) != 0) {
901 ret = -EFAULT;
902 goto free_counters;
903 }
904
905 for (i = sizeof(struct ip6t_entry);
906 i < e->target_offset;
907 i += m->u.match_size) {
908 m = (void *)e + i;
909
910 if (copy_to_user(userptr + off + i
911 + offsetof(struct ip6t_entry_match,
912 u.user.name),
913 m->u.kernel.match->name,
914 strlen(m->u.kernel.match->name)+1)
915 != 0) {
916 ret = -EFAULT;
917 goto free_counters;
918 }
919 }
920
921 t = ip6t_get_target(e);
922 if (copy_to_user(userptr + off + e->target_offset
923 + offsetof(struct ip6t_entry_target,
924 u.user.name),
925 t->u.kernel.target->name,
926 strlen(t->u.kernel.target->name)+1) != 0) {
927 ret = -EFAULT;
928 goto free_counters;
929 }
930 }
931
932 free_counters:
933 vfree(counters);
934 return ret;
935 }
936
937 static int
938 get_entries(const struct ip6t_get_entries *entries,
939 struct ip6t_get_entries __user *uptr)
940 {
941 int ret;
942 struct xt_table *t;
943
944 t = xt_find_table_lock(AF_INET6, entries->name);
945 if (t && !IS_ERR(t)) {
946 struct xt_table_info *private = t->private;
947 duprintf("t->private->number = %u\n", private->number);
948 if (entries->size == private->size)
949 ret = copy_entries_to_user(private->size,
950 t, uptr->entrytable);
951 else {
952 duprintf("get_entries: I've got %u not %u!\n",
953 private->size, entries->size);
954 ret = -EINVAL;
955 }
956 module_put(t->me);
957 xt_table_unlock(t);
958 } else
959 ret = t ? PTR_ERR(t) : -ENOENT;
960
961 return ret;
962 }
963
964 static int
965 do_replace(void __user *user, unsigned int len)
966 {
967 int ret;
968 struct ip6t_replace tmp;
969 struct xt_table *t;
970 struct xt_table_info *newinfo, *oldinfo;
971 struct xt_counters *counters;
972 void *loc_cpu_entry, *loc_cpu_old_entry;
973
974 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
975 return -EFAULT;
976
977 /* overflow check */
978 if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
979 SMP_CACHE_BYTES)
980 return -ENOMEM;
981 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
982 return -ENOMEM;
983
984 newinfo = xt_alloc_table_info(tmp.size);
985 if (!newinfo)
986 return -ENOMEM;
987
988 /* choose the copy that is on our node/cpu */
989 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
990 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
991 tmp.size) != 0) {
992 ret = -EFAULT;
993 goto free_newinfo;
994 }
995
996 counters = vmalloc(tmp.num_counters * sizeof(struct xt_counters));
997 if (!counters) {
998 ret = -ENOMEM;
999 goto free_newinfo;
1000 }
1001
1002 ret = translate_table(tmp.name, tmp.valid_hooks,
1003 newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1004 tmp.hook_entry, tmp.underflow);
1005 if (ret != 0)
1006 goto free_newinfo_counters;
1007
1008 duprintf("ip_tables: Translated table\n");
1009
1010 t = try_then_request_module(xt_find_table_lock(AF_INET6, tmp.name),
1011 "ip6table_%s", tmp.name);
1012 if (!t || IS_ERR(t)) {
1013 ret = t ? PTR_ERR(t) : -ENOENT;
1014 goto free_newinfo_counters_untrans;
1015 }
1016
1017 /* You lied! */
1018 if (tmp.valid_hooks != t->valid_hooks) {
1019 duprintf("Valid hook crap: %08X vs %08X\n",
1020 tmp.valid_hooks, t->valid_hooks);
1021 ret = -EINVAL;
1022 goto put_module;
1023 }
1024
1025 oldinfo = xt_replace_table(t, tmp.num_counters, newinfo, &ret);
1026 if (!oldinfo)
1027 goto put_module;
1028
1029 /* Update module usage count based on number of rules */
1030 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1031 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1032 if ((oldinfo->number > oldinfo->initial_entries) ||
1033 (newinfo->number <= oldinfo->initial_entries))
1034 module_put(t->me);
1035 if ((oldinfo->number > oldinfo->initial_entries) &&
1036 (newinfo->number <= oldinfo->initial_entries))
1037 module_put(t->me);
1038
1039 /* Get the old counters. */
1040 get_counters(oldinfo, counters);
1041 /* Decrease module usage counts and free resource */
1042 loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1043 IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
1044 xt_free_table_info(oldinfo);
1045 if (copy_to_user(tmp.counters, counters,
1046 sizeof(struct xt_counters) * tmp.num_counters) != 0)
1047 ret = -EFAULT;
1048 vfree(counters);
1049 xt_table_unlock(t);
1050 return ret;
1051
1052 put_module:
1053 module_put(t->me);
1054 xt_table_unlock(t);
1055 free_newinfo_counters_untrans:
1056 IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
1057 free_newinfo_counters:
1058 vfree(counters);
1059 free_newinfo:
1060 xt_free_table_info(newinfo);
1061 return ret;
1062 }
1063
1064 /* We're lazy, and add to the first CPU; overflow works its fey magic
1065 * and everything is OK. */
1066 static inline int
1067 add_counter_to_entry(struct ip6t_entry *e,
1068 const struct xt_counters addme[],
1069 unsigned int *i)
1070 {
1071 #if 0
1072 duprintf("add_counter: Entry %u %lu/%lu + %lu/%lu\n",
1073 *i,
1074 (long unsigned int)e->counters.pcnt,
1075 (long unsigned int)e->counters.bcnt,
1076 (long unsigned int)addme[*i].pcnt,
1077 (long unsigned int)addme[*i].bcnt);
1078 #endif
1079
1080 ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1081
1082 (*i)++;
1083 return 0;
1084 }
1085
1086 static int
1087 do_add_counters(void __user *user, unsigned int len)
1088 {
1089 unsigned int i;
1090 struct xt_counters_info tmp, *paddc;
1091 struct xt_table_info *private;
1092 struct xt_table *t;
1093 int ret = 0;
1094 void *loc_cpu_entry;
1095
1096 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1097 return -EFAULT;
1098
1099 if (len != sizeof(tmp) + tmp.num_counters*sizeof(struct xt_counters))
1100 return -EINVAL;
1101
1102 paddc = vmalloc(len);
1103 if (!paddc)
1104 return -ENOMEM;
1105
1106 if (copy_from_user(paddc, user, len) != 0) {
1107 ret = -EFAULT;
1108 goto free;
1109 }
1110
1111 t = xt_find_table_lock(AF_INET6, tmp.name);
1112 if (!t || IS_ERR(t)) {
1113 ret = t ? PTR_ERR(t) : -ENOENT;
1114 goto free;
1115 }
1116
1117 write_lock_bh(&t->lock);
1118 private = t->private;
1119 if (private->number != paddc->num_counters) {
1120 ret = -EINVAL;
1121 goto unlock_up_free;
1122 }
1123
1124 i = 0;
1125 /* Choose the copy that is on our node */
1126 loc_cpu_entry = private->entries[smp_processor_id()];
1127 IP6T_ENTRY_ITERATE(loc_cpu_entry,
1128 private->size,
1129 add_counter_to_entry,
1130 paddc->counters,
1131 &i);
1132 unlock_up_free:
1133 write_unlock_bh(&t->lock);
1134 xt_table_unlock(t);
1135 module_put(t->me);
1136 free:
1137 vfree(paddc);
1138
1139 return ret;
1140 }
1141
1142 static int
1143 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1144 {
1145 int ret;
1146
1147 if (!capable(CAP_NET_ADMIN))
1148 return -EPERM;
1149
1150 switch (cmd) {
1151 case IP6T_SO_SET_REPLACE:
1152 ret = do_replace(user, len);
1153 break;
1154
1155 case IP6T_SO_SET_ADD_COUNTERS:
1156 ret = do_add_counters(user, len);
1157 break;
1158
1159 default:
1160 duprintf("do_ip6t_set_ctl: unknown request %i\n", cmd);
1161 ret = -EINVAL;
1162 }
1163
1164 return ret;
1165 }
1166
1167 static int
1168 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1169 {
1170 int ret;
1171
1172 if (!capable(CAP_NET_ADMIN))
1173 return -EPERM;
1174
1175 switch (cmd) {
1176 case IP6T_SO_GET_INFO: {
1177 char name[IP6T_TABLE_MAXNAMELEN];
1178 struct xt_table *t;
1179
1180 if (*len != sizeof(struct ip6t_getinfo)) {
1181 duprintf("length %u != %u\n", *len,
1182 sizeof(struct ip6t_getinfo));
1183 ret = -EINVAL;
1184 break;
1185 }
1186
1187 if (copy_from_user(name, user, sizeof(name)) != 0) {
1188 ret = -EFAULT;
1189 break;
1190 }
1191 name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
1192
1193 t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
1194 "ip6table_%s", name);
1195 if (t && !IS_ERR(t)) {
1196 struct ip6t_getinfo info;
1197 struct xt_table_info *private = t->private;
1198
1199 info.valid_hooks = t->valid_hooks;
1200 memcpy(info.hook_entry, private->hook_entry,
1201 sizeof(info.hook_entry));
1202 memcpy(info.underflow, private->underflow,
1203 sizeof(info.underflow));
1204 info.num_entries = private->number;
1205 info.size = private->size;
1206 memcpy(info.name, name, sizeof(info.name));
1207
1208 if (copy_to_user(user, &info, *len) != 0)
1209 ret = -EFAULT;
1210 else
1211 ret = 0;
1212 xt_table_unlock(t);
1213 module_put(t->me);
1214 } else
1215 ret = t ? PTR_ERR(t) : -ENOENT;
1216 }
1217 break;
1218
1219 case IP6T_SO_GET_ENTRIES: {
1220 struct ip6t_get_entries get;
1221
1222 if (*len < sizeof(get)) {
1223 duprintf("get_entries: %u < %u\n", *len, sizeof(get));
1224 ret = -EINVAL;
1225 } else if (copy_from_user(&get, user, sizeof(get)) != 0) {
1226 ret = -EFAULT;
1227 } else if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1228 duprintf("get_entries: %u != %u\n", *len,
1229 sizeof(struct ip6t_get_entries) + get.size);
1230 ret = -EINVAL;
1231 } else
1232 ret = get_entries(&get, user);
1233 break;
1234 }
1235
1236 case IP6T_SO_GET_REVISION_MATCH:
1237 case IP6T_SO_GET_REVISION_TARGET: {
1238 struct ip6t_get_revision rev;
1239 int target;
1240
1241 if (*len != sizeof(rev)) {
1242 ret = -EINVAL;
1243 break;
1244 }
1245 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
1246 ret = -EFAULT;
1247 break;
1248 }
1249
1250 if (cmd == IP6T_SO_GET_REVISION_TARGET)
1251 target = 1;
1252 else
1253 target = 0;
1254
1255 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
1256 rev.revision,
1257 target, &ret),
1258 "ip6t_%s", rev.name);
1259 break;
1260 }
1261
1262 default:
1263 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
1264 ret = -EINVAL;
1265 }
1266
1267 return ret;
1268 }
1269
1270 int ip6t_register_table(struct xt_table *table,
1271 const struct ip6t_replace *repl)
1272 {
1273 int ret;
1274 struct xt_table_info *newinfo;
1275 static struct xt_table_info bootstrap
1276 = { 0, 0, 0, { 0 }, { 0 }, { } };
1277 void *loc_cpu_entry;
1278
1279 newinfo = xt_alloc_table_info(repl->size);
1280 if (!newinfo)
1281 return -ENOMEM;
1282
1283 /* choose the copy on our node/cpu */
1284 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1285 memcpy(loc_cpu_entry, repl->entries, repl->size);
1286
1287 ret = translate_table(table->name, table->valid_hooks,
1288 newinfo, loc_cpu_entry, repl->size,
1289 repl->num_entries,
1290 repl->hook_entry,
1291 repl->underflow);
1292 if (ret != 0) {
1293 xt_free_table_info(newinfo);
1294 return ret;
1295 }
1296
1297 if (xt_register_table(table, &bootstrap, newinfo) != 0) {
1298 xt_free_table_info(newinfo);
1299 return ret;
1300 }
1301
1302 return 0;
1303 }
1304
1305 void ip6t_unregister_table(struct xt_table *table)
1306 {
1307 struct xt_table_info *private;
1308 void *loc_cpu_entry;
1309
1310 private = xt_unregister_table(table);
1311
1312 /* Decrease module usage counts and free resources */
1313 loc_cpu_entry = private->entries[raw_smp_processor_id()];
1314 IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
1315 xt_free_table_info(private);
1316 }
1317
1318 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
1319 static inline int
1320 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
1321 u_int8_t type, u_int8_t code,
1322 int invert)
1323 {
1324 return (type == test_type && code >= min_code && code <= max_code)
1325 ^ invert;
1326 }
1327
1328 static int
1329 icmp6_match(const struct sk_buff *skb,
1330 const struct net_device *in,
1331 const struct net_device *out,
1332 const struct xt_match *match,
1333 const void *matchinfo,
1334 int offset,
1335 unsigned int protoff,
1336 int *hotdrop)
1337 {
1338 struct icmp6hdr _icmp, *ic;
1339 const struct ip6t_icmp *icmpinfo = matchinfo;
1340
1341 /* Must not be a fragment. */
1342 if (offset)
1343 return 0;
1344
1345 ic = skb_header_pointer(skb, protoff, sizeof(_icmp), &_icmp);
1346 if (ic == NULL) {
1347 /* We've been asked to examine this packet, and we
1348 can't. Hence, no choice but to drop. */
1349 duprintf("Dropping evil ICMP tinygram.\n");
1350 *hotdrop = 1;
1351 return 0;
1352 }
1353
1354 return icmp6_type_code_match(icmpinfo->type,
1355 icmpinfo->code[0],
1356 icmpinfo->code[1],
1357 ic->icmp6_type, ic->icmp6_code,
1358 !!(icmpinfo->invflags&IP6T_ICMP_INV));
1359 }
1360
1361 /* Called when user tries to insert an entry of this type. */
1362 static int
1363 icmp6_checkentry(const char *tablename,
1364 const void *entry,
1365 const struct xt_match *match,
1366 void *matchinfo,
1367 unsigned int matchsize,
1368 unsigned int hook_mask)
1369 {
1370 const struct ip6t_icmp *icmpinfo = matchinfo;
1371
1372 /* Must specify no unknown invflags */
1373 return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
1374 }
1375
1376 /* The built-in targets: standard (NULL) and error. */
1377 static struct ip6t_target ip6t_standard_target = {
1378 .name = IP6T_STANDARD_TARGET,
1379 .targetsize = sizeof(int),
1380 .family = AF_INET6,
1381 };
1382
1383 static struct ip6t_target ip6t_error_target = {
1384 .name = IP6T_ERROR_TARGET,
1385 .target = ip6t_error,
1386 .targetsize = IP6T_FUNCTION_MAXNAMELEN,
1387 .family = AF_INET6,
1388 };
1389
1390 static struct nf_sockopt_ops ip6t_sockopts = {
1391 .pf = PF_INET6,
1392 .set_optmin = IP6T_BASE_CTL,
1393 .set_optmax = IP6T_SO_SET_MAX+1,
1394 .set = do_ip6t_set_ctl,
1395 .get_optmin = IP6T_BASE_CTL,
1396 .get_optmax = IP6T_SO_GET_MAX+1,
1397 .get = do_ip6t_get_ctl,
1398 };
1399
1400 static struct ip6t_match icmp6_matchstruct = {
1401 .name = "icmp6",
1402 .match = &icmp6_match,
1403 .matchsize = sizeof(struct ip6t_icmp),
1404 .checkentry = icmp6_checkentry,
1405 .proto = IPPROTO_ICMPV6,
1406 .family = AF_INET6,
1407 };
1408
1409 static int __init ip6_tables_init(void)
1410 {
1411 int ret;
1412
1413 xt_proto_init(AF_INET6);
1414
1415 /* Noone else will be downing sem now, so we won't sleep */
1416 xt_register_target(&ip6t_standard_target);
1417 xt_register_target(&ip6t_error_target);
1418 xt_register_match(&icmp6_matchstruct);
1419
1420 /* Register setsockopt */
1421 ret = nf_register_sockopt(&ip6t_sockopts);
1422 if (ret < 0) {
1423 duprintf("Unable to register sockopts.\n");
1424 xt_proto_fini(AF_INET6);
1425 return ret;
1426 }
1427
1428 printk("ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
1429 return 0;
1430 }
1431
1432 static void __exit ip6_tables_fini(void)
1433 {
1434 nf_unregister_sockopt(&ip6t_sockopts);
1435 xt_unregister_match(&icmp6_matchstruct);
1436 xt_unregister_target(&ip6t_error_target);
1437 xt_unregister_target(&ip6t_standard_target);
1438 xt_proto_fini(AF_INET6);
1439 }
1440
1441 /*
1442 * find the offset to specified header or the protocol number of last header
1443 * if target < 0. "last header" is transport protocol header, ESP, or
1444 * "No next header".
1445 *
1446 * If target header is found, its offset is set in *offset and return protocol
1447 * number. Otherwise, return -1.
1448 *
1449 * Note that non-1st fragment is special case that "the protocol number
1450 * of last header" is "next header" field in Fragment header. In this case,
1451 * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
1452 * isn't NULL.
1453 *
1454 */
1455 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
1456 int target, unsigned short *fragoff)
1457 {
1458 unsigned int start = (u8*)(skb->nh.ipv6h + 1) - skb->data;
1459 u8 nexthdr = skb->nh.ipv6h->nexthdr;
1460 unsigned int len = skb->len - start;
1461
1462 if (fragoff)
1463 *fragoff = 0;
1464
1465 while (nexthdr != target) {
1466 struct ipv6_opt_hdr _hdr, *hp;
1467 unsigned int hdrlen;
1468
1469 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
1470 if (target < 0)
1471 break;
1472 return -1;
1473 }
1474
1475 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
1476 if (hp == NULL)
1477 return -1;
1478 if (nexthdr == NEXTHDR_FRAGMENT) {
1479 unsigned short _frag_off, *fp;
1480 fp = skb_header_pointer(skb,
1481 start+offsetof(struct frag_hdr,
1482 frag_off),
1483 sizeof(_frag_off),
1484 &_frag_off);
1485 if (fp == NULL)
1486 return -1;
1487
1488 _frag_off = ntohs(*fp) & ~0x7;
1489 if (_frag_off) {
1490 if (target < 0 &&
1491 ((!ipv6_ext_hdr(hp->nexthdr)) ||
1492 nexthdr == NEXTHDR_NONE)) {
1493 if (fragoff)
1494 *fragoff = _frag_off;
1495 return hp->nexthdr;
1496 }
1497 return -1;
1498 }
1499 hdrlen = 8;
1500 } else if (nexthdr == NEXTHDR_AUTH)
1501 hdrlen = (hp->hdrlen + 2) << 2;
1502 else
1503 hdrlen = ipv6_optlen(hp);
1504
1505 nexthdr = hp->nexthdr;
1506 len -= hdrlen;
1507 start += hdrlen;
1508 }
1509
1510 *offset = start;
1511 return nexthdr;
1512 }
1513
1514 EXPORT_SYMBOL(ip6t_register_table);
1515 EXPORT_SYMBOL(ip6t_unregister_table);
1516 EXPORT_SYMBOL(ip6t_do_table);
1517 EXPORT_SYMBOL(ip6t_ext_hdr);
1518 EXPORT_SYMBOL(ipv6_find_hdr);
1519
1520 module_init(ip6_tables_init);
1521 module_exit(ip6_tables_fini);
USB Experimental Work