Merge branch 'master' of /repos/git/net-next-2.6
[linux-2.6.git] / net / ipv6 / netfilter / ip6_tables.c
1 /*
2  * Packet matching code.
3  *
4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 #include <linux/capability.h>
13 #include <linux/in.h>
14 #include <linux/skbuff.h>
15 #include <linux/kmod.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netdevice.h>
18 #include <linux/module.h>
19 #include <linux/poison.h>
20 #include <linux/icmpv6.h>
21 #include <net/ipv6.h>
22 #include <net/compat.h>
23 #include <asm/uaccess.h>
24 #include <linux/mutex.h>
25 #include <linux/proc_fs.h>
26 #include <linux/err.h>
27 #include <linux/cpumask.h>
28
29 #include <linux/netfilter_ipv6/ip6_tables.h>
30 #include <linux/netfilter/x_tables.h>
31 #include <net/netfilter/nf_log.h>
32 #include "../../netfilter/xt_repldata.h"
33
34 MODULE_LICENSE("GPL");
35 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
36 MODULE_DESCRIPTION("IPv6 packet filter");
37
38 /*#define DEBUG_IP_FIREWALL*/
39 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
40 /*#define DEBUG_IP_FIREWALL_USER*/
41
42 #ifdef DEBUG_IP_FIREWALL
43 #define dprintf(format, args...) pr_info(format , ## args)
44 #else
45 #define dprintf(format, args...)
46 #endif
47
48 #ifdef DEBUG_IP_FIREWALL_USER
49 #define duprintf(format, args...) pr_info(format , ## args)
50 #else
51 #define duprintf(format, args...)
52 #endif
53
54 #ifdef CONFIG_NETFILTER_DEBUG
55 #define IP_NF_ASSERT(x) WARN_ON(!(x))
56 #else
57 #define IP_NF_ASSERT(x)
58 #endif
59
60 #if 0
61 /* All the better to debug you with... */
62 #define static
63 #define inline
64 #endif
65
66 void *ip6t_alloc_initial_table(const struct xt_table *info)
67 {
68         return xt_alloc_initial_table(ip6t, IP6T);
69 }
70 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
71
72 /*
73    We keep a set of rules for each CPU, so we can avoid write-locking
74    them in the softirq when updating the counters and therefore
75    only need to read-lock in the softirq; doing a write_lock_bh() in user
76    context stops packets coming through and allows user context to read
77    the counters or update the rules.
78
79    Hence the start of any table is given by get_table() below.  */
80
81 /* Check for an extension */
82 int
83 ip6t_ext_hdr(u8 nexthdr)
84 {
85         return  (nexthdr == IPPROTO_HOPOPTS)   ||
86                 (nexthdr == IPPROTO_ROUTING)   ||
87                 (nexthdr == IPPROTO_FRAGMENT)  ||
88                 (nexthdr == IPPROTO_ESP)       ||
89                 (nexthdr == IPPROTO_AH)        ||
90                 (nexthdr == IPPROTO_NONE)      ||
91                 (nexthdr == IPPROTO_DSTOPTS);
92 }
93
94 /* Returns whether matches rule or not. */
95 /* Performance critical - called for every packet */
96 static inline bool
97 ip6_packet_match(const struct sk_buff *skb,
98                  const char *indev,
99                  const char *outdev,
100                  const struct ip6t_ip6 *ip6info,
101                  unsigned int *protoff,
102                  int *fragoff, bool *hotdrop)
103 {
104         unsigned long ret;
105         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
106
107 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
108
109         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
110                                        &ip6info->src), IP6T_INV_SRCIP) ||
111             FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
112                                        &ip6info->dst), IP6T_INV_DSTIP)) {
113                 dprintf("Source or dest mismatch.\n");
114 /*
115                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
116                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
117                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
118                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
119                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
120                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
121                 return false;
122         }
123
124         ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
125
126         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
127                 dprintf("VIA in mismatch (%s vs %s).%s\n",
128                         indev, ip6info->iniface,
129                         ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
130                 return false;
131         }
132
133         ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
134
135         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
136                 dprintf("VIA out mismatch (%s vs %s).%s\n",
137                         outdev, ip6info->outiface,
138                         ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
139                 return false;
140         }
141
142 /* ... might want to do something with class and flowlabel here ... */
143
144         /* look for the desired protocol header */
145         if((ip6info->flags & IP6T_F_PROTO)) {
146                 int protohdr;
147                 unsigned short _frag_off;
148
149                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
150                 if (protohdr < 0) {
151                         if (_frag_off == 0)
152                                 *hotdrop = true;
153                         return false;
154                 }
155                 *fragoff = _frag_off;
156
157                 dprintf("Packet protocol %hi ?= %s%hi.\n",
158                                 protohdr,
159                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
160                                 ip6info->proto);
161
162                 if (ip6info->proto == protohdr) {
163                         if(ip6info->invflags & IP6T_INV_PROTO) {
164                                 return false;
165                         }
166                         return true;
167                 }
168
169                 /* We need match for the '-p all', too! */
170                 if ((ip6info->proto != 0) &&
171                         !(ip6info->invflags & IP6T_INV_PROTO))
172                         return false;
173         }
174         return true;
175 }
176
177 /* should be ip6 safe */
178 static bool
179 ip6_checkentry(const struct ip6t_ip6 *ipv6)
180 {
181         if (ipv6->flags & ~IP6T_F_MASK) {
182                 duprintf("Unknown flag bits set: %08X\n",
183                          ipv6->flags & ~IP6T_F_MASK);
184                 return false;
185         }
186         if (ipv6->invflags & ~IP6T_INV_MASK) {
187                 duprintf("Unknown invflag bits set: %08X\n",
188                          ipv6->invflags & ~IP6T_INV_MASK);
189                 return false;
190         }
191         return true;
192 }
193
194 static unsigned int
195 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
196 {
197         if (net_ratelimit())
198                 pr_info("error: `%s'\n", (const char *)par->targinfo);
199
200         return NF_DROP;
201 }
202
203 static inline struct ip6t_entry *
204 get_entry(const void *base, unsigned int offset)
205 {
206         return (struct ip6t_entry *)(base + offset);
207 }
208
209 /* All zeroes == unconditional rule. */
210 /* Mildly perf critical (only if packet tracing is on) */
211 static inline bool unconditional(const struct ip6t_ip6 *ipv6)
212 {
213         static const struct ip6t_ip6 uncond;
214
215         return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
216 }
217
218 static inline const struct xt_entry_target *
219 ip6t_get_target_c(const struct ip6t_entry *e)
220 {
221         return ip6t_get_target((struct ip6t_entry *)e);
222 }
223
224 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
225     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
226 /* This cries for unification! */
227 static const char *const hooknames[] = {
228         [NF_INET_PRE_ROUTING]           = "PREROUTING",
229         [NF_INET_LOCAL_IN]              = "INPUT",
230         [NF_INET_FORWARD]               = "FORWARD",
231         [NF_INET_LOCAL_OUT]             = "OUTPUT",
232         [NF_INET_POST_ROUTING]          = "POSTROUTING",
233 };
234
235 enum nf_ip_trace_comments {
236         NF_IP6_TRACE_COMMENT_RULE,
237         NF_IP6_TRACE_COMMENT_RETURN,
238         NF_IP6_TRACE_COMMENT_POLICY,
239 };
240
241 static const char *const comments[] = {
242         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
243         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
244         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
245 };
246
247 static struct nf_loginfo trace_loginfo = {
248         .type = NF_LOG_TYPE_LOG,
249         .u = {
250                 .log = {
251                         .level = 4,
252                         .logflags = NF_LOG_MASK,
253                 },
254         },
255 };
256
257 /* Mildly perf critical (only if packet tracing is on) */
258 static inline int
259 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
260                       const char *hookname, const char **chainname,
261                       const char **comment, unsigned int *rulenum)
262 {
263         const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
264
265         if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
266                 /* Head of user chain: ERROR target with chainname */
267                 *chainname = t->target.data;
268                 (*rulenum) = 0;
269         } else if (s == e) {
270                 (*rulenum)++;
271
272                 if (s->target_offset == sizeof(struct ip6t_entry) &&
273                     strcmp(t->target.u.kernel.target->name,
274                            XT_STANDARD_TARGET) == 0 &&
275                     t->verdict < 0 &&
276                     unconditional(&s->ipv6)) {
277                         /* Tail of chains: STANDARD target (return/policy) */
278                         *comment = *chainname == hookname
279                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
280                                 : comments[NF_IP6_TRACE_COMMENT_RETURN];
281                 }
282                 return 1;
283         } else
284                 (*rulenum)++;
285
286         return 0;
287 }
288
289 static void trace_packet(const struct sk_buff *skb,
290                          unsigned int hook,
291                          const struct net_device *in,
292                          const struct net_device *out,
293                          const char *tablename,
294                          const struct xt_table_info *private,
295                          const struct ip6t_entry *e)
296 {
297         const void *table_base;
298         const struct ip6t_entry *root;
299         const char *hookname, *chainname, *comment;
300         const struct ip6t_entry *iter;
301         unsigned int rulenum = 0;
302
303         table_base = private->entries[smp_processor_id()];
304         root = get_entry(table_base, private->hook_entry[hook]);
305
306         hookname = chainname = hooknames[hook];
307         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
308
309         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
310                 if (get_chainname_rulenum(iter, e, hookname,
311                     &chainname, &comment, &rulenum) != 0)
312                         break;
313
314         nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
315                       "TRACE: %s:%s:%s:%u ",
316                       tablename, chainname, comment, rulenum);
317 }
318 #endif
319
320 static inline __pure struct ip6t_entry *
321 ip6t_next_entry(const struct ip6t_entry *entry)
322 {
323         return (void *)entry + entry->next_offset;
324 }
325
326 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
327 unsigned int
328 ip6t_do_table(struct sk_buff *skb,
329               unsigned int hook,
330               const struct net_device *in,
331               const struct net_device *out,
332               struct xt_table *table)
333 {
334         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
335         /* Initializing verdict to NF_DROP keeps gcc happy. */
336         unsigned int verdict = NF_DROP;
337         const char *indev, *outdev;
338         const void *table_base;
339         struct ip6t_entry *e, **jumpstack;
340         unsigned int *stackptr, origptr, cpu;
341         const struct xt_table_info *private;
342         struct xt_action_param acpar;
343
344         /* Initialization */
345         indev = in ? in->name : nulldevname;
346         outdev = out ? out->name : nulldevname;
347         /* We handle fragments by dealing with the first fragment as
348          * if it was a normal packet.  All other fragments are treated
349          * normally, except that they will NEVER match rules that ask
350          * things we don't know, ie. tcp syn flag or ports).  If the
351          * rule is also a fragment-specific rule, non-fragments won't
352          * match it. */
353         acpar.hotdrop = false;
354         acpar.in      = in;
355         acpar.out     = out;
356         acpar.family  = NFPROTO_IPV6;
357         acpar.hooknum = hook;
358
359         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
360
361         xt_info_rdlock_bh();
362         private = table->private;
363         cpu        = smp_processor_id();
364         table_base = private->entries[cpu];
365         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
366         stackptr   = per_cpu_ptr(private->stackptr, cpu);
367         origptr    = *stackptr;
368
369         e = get_entry(table_base, private->hook_entry[hook]);
370
371         do {
372                 const struct xt_entry_target *t;
373                 const struct xt_entry_match *ematch;
374
375                 IP_NF_ASSERT(e);
376                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
377                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
378  no_match:
379                         e = ip6t_next_entry(e);
380                         continue;
381                 }
382
383                 xt_ematch_foreach(ematch, e) {
384                         acpar.match     = ematch->u.kernel.match;
385                         acpar.matchinfo = ematch->data;
386                         if (!acpar.match->match(skb, &acpar))
387                                 goto no_match;
388                 }
389
390                 ADD_COUNTER(e->counters, skb->len, 1);
391
392                 t = ip6t_get_target_c(e);
393                 IP_NF_ASSERT(t->u.kernel.target);
394
395 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
396     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
397                 /* The packet is traced: log it */
398                 if (unlikely(skb->nf_trace))
399                         trace_packet(skb, hook, in, out,
400                                      table->name, private, e);
401 #endif
402                 /* Standard target? */
403                 if (!t->u.kernel.target->target) {
404                         int v;
405
406                         v = ((struct xt_standard_target *)t)->verdict;
407                         if (v < 0) {
408                                 /* Pop from stack? */
409                                 if (v != XT_RETURN) {
410                                         verdict = (unsigned)(-v) - 1;
411                                         break;
412                                 }
413                                 if (*stackptr == 0)
414                                         e = get_entry(table_base,
415                                             private->underflow[hook]);
416                                 else
417                                         e = ip6t_next_entry(jumpstack[--*stackptr]);
418                                 continue;
419                         }
420                         if (table_base + v != ip6t_next_entry(e) &&
421                             !(e->ipv6.flags & IP6T_F_GOTO)) {
422                                 if (*stackptr >= private->stacksize) {
423                                         verdict = NF_DROP;
424                                         break;
425                                 }
426                                 jumpstack[(*stackptr)++] = e;
427                         }
428
429                         e = get_entry(table_base, v);
430                         continue;
431                 }
432
433                 acpar.target   = t->u.kernel.target;
434                 acpar.targinfo = t->data;
435
436                 verdict = t->u.kernel.target->target(skb, &acpar);
437                 if (verdict == XT_CONTINUE)
438                         e = ip6t_next_entry(e);
439                 else
440                         /* Verdict */
441                         break;
442         } while (!acpar.hotdrop);
443
444         xt_info_rdunlock_bh();
445         *stackptr = origptr;
446
447 #ifdef DEBUG_ALLOW_ALL
448         return NF_ACCEPT;
449 #else
450         if (acpar.hotdrop)
451                 return NF_DROP;
452         else return verdict;
453 #endif
454 }
455
456 /* Figures out from what hook each rule can be called: returns 0 if
457    there are loops.  Puts hook bitmask in comefrom. */
458 static int
459 mark_source_chains(const struct xt_table_info *newinfo,
460                    unsigned int valid_hooks, void *entry0)
461 {
462         unsigned int hook;
463
464         /* No recursion; use packet counter to save back ptrs (reset
465            to 0 as we leave), and comefrom to save source hook bitmask */
466         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
467                 unsigned int pos = newinfo->hook_entry[hook];
468                 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
469
470                 if (!(valid_hooks & (1 << hook)))
471                         continue;
472
473                 /* Set initial back pointer. */
474                 e->counters.pcnt = pos;
475
476                 for (;;) {
477                         const struct xt_standard_target *t
478                                 = (void *)ip6t_get_target_c(e);
479                         int visited = e->comefrom & (1 << hook);
480
481                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
482                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
483                                        hook, pos, e->comefrom);
484                                 return 0;
485                         }
486                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
487
488                         /* Unconditional return/END. */
489                         if ((e->target_offset == sizeof(struct ip6t_entry) &&
490                              (strcmp(t->target.u.user.name,
491                                      XT_STANDARD_TARGET) == 0) &&
492                              t->verdict < 0 &&
493                              unconditional(&e->ipv6)) || visited) {
494                                 unsigned int oldpos, size;
495
496                                 if ((strcmp(t->target.u.user.name,
497                                             XT_STANDARD_TARGET) == 0) &&
498                                     t->verdict < -NF_MAX_VERDICT - 1) {
499                                         duprintf("mark_source_chains: bad "
500                                                 "negative verdict (%i)\n",
501                                                                 t->verdict);
502                                         return 0;
503                                 }
504
505                                 /* Return: backtrack through the last
506                                    big jump. */
507                                 do {
508                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
509 #ifdef DEBUG_IP_FIREWALL_USER
510                                         if (e->comefrom
511                                             & (1 << NF_INET_NUMHOOKS)) {
512                                                 duprintf("Back unset "
513                                                          "on hook %u "
514                                                          "rule %u\n",
515                                                          hook, pos);
516                                         }
517 #endif
518                                         oldpos = pos;
519                                         pos = e->counters.pcnt;
520                                         e->counters.pcnt = 0;
521
522                                         /* We're at the start. */
523                                         if (pos == oldpos)
524                                                 goto next;
525
526                                         e = (struct ip6t_entry *)
527                                                 (entry0 + pos);
528                                 } while (oldpos == pos + e->next_offset);
529
530                                 /* Move along one */
531                                 size = e->next_offset;
532                                 e = (struct ip6t_entry *)
533                                         (entry0 + pos + size);
534                                 e->counters.pcnt = pos;
535                                 pos += size;
536                         } else {
537                                 int newpos = t->verdict;
538
539                                 if (strcmp(t->target.u.user.name,
540                                            XT_STANDARD_TARGET) == 0 &&
541                                     newpos >= 0) {
542                                         if (newpos > newinfo->size -
543                                                 sizeof(struct ip6t_entry)) {
544                                                 duprintf("mark_source_chains: "
545                                                         "bad verdict (%i)\n",
546                                                                 newpos);
547                                                 return 0;
548                                         }
549                                         /* This a jump; chase it. */
550                                         duprintf("Jump rule %u -> %u\n",
551                                                  pos, newpos);
552                                 } else {
553                                         /* ... this is a fallthru */
554                                         newpos = pos + e->next_offset;
555                                 }
556                                 e = (struct ip6t_entry *)
557                                         (entry0 + newpos);
558                                 e->counters.pcnt = pos;
559                                 pos = newpos;
560                         }
561                 }
562                 next:
563                 duprintf("Finished chain %u\n", hook);
564         }
565         return 1;
566 }
567
568 static void cleanup_match(struct xt_entry_match *m, struct net *net)
569 {
570         struct xt_mtdtor_param par;
571
572         par.net       = net;
573         par.match     = m->u.kernel.match;
574         par.matchinfo = m->data;
575         par.family    = NFPROTO_IPV6;
576         if (par.match->destroy != NULL)
577                 par.match->destroy(&par);
578         module_put(par.match->me);
579 }
580
581 static int
582 check_entry(const struct ip6t_entry *e, const char *name)
583 {
584         const struct xt_entry_target *t;
585
586         if (!ip6_checkentry(&e->ipv6)) {
587                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
588                 return -EINVAL;
589         }
590
591         if (e->target_offset + sizeof(struct xt_entry_target) >
592             e->next_offset)
593                 return -EINVAL;
594
595         t = ip6t_get_target_c(e);
596         if (e->target_offset + t->u.target_size > e->next_offset)
597                 return -EINVAL;
598
599         return 0;
600 }
601
602 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
603 {
604         const struct ip6t_ip6 *ipv6 = par->entryinfo;
605         int ret;
606
607         par->match     = m->u.kernel.match;
608         par->matchinfo = m->data;
609
610         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
611                              ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
612         if (ret < 0) {
613                 duprintf("ip_tables: check failed for `%s'.\n",
614                          par.match->name);
615                 return ret;
616         }
617         return 0;
618 }
619
620 static int
621 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
622 {
623         struct xt_match *match;
624         int ret;
625
626         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
627                                       m->u.user.revision);
628         if (IS_ERR(match)) {
629                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
630                 return PTR_ERR(match);
631         }
632         m->u.kernel.match = match;
633
634         ret = check_match(m, par);
635         if (ret)
636                 goto err;
637
638         return 0;
639 err:
640         module_put(m->u.kernel.match->me);
641         return ret;
642 }
643
644 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
645 {
646         struct xt_entry_target *t = ip6t_get_target(e);
647         struct xt_tgchk_param par = {
648                 .net       = net,
649                 .table     = name,
650                 .entryinfo = e,
651                 .target    = t->u.kernel.target,
652                 .targinfo  = t->data,
653                 .hook_mask = e->comefrom,
654                 .family    = NFPROTO_IPV6,
655         };
656         int ret;
657
658         t = ip6t_get_target(e);
659         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
660               e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
661         if (ret < 0) {
662                 duprintf("ip_tables: check failed for `%s'.\n",
663                          t->u.kernel.target->name);
664                 return ret;
665         }
666         return 0;
667 }
668
669 static int
670 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
671                  unsigned int size)
672 {
673         struct xt_entry_target *t;
674         struct xt_target *target;
675         int ret;
676         unsigned int j;
677         struct xt_mtchk_param mtpar;
678         struct xt_entry_match *ematch;
679
680         ret = check_entry(e, name);
681         if (ret)
682                 return ret;
683
684         j = 0;
685         mtpar.net       = net;
686         mtpar.table     = name;
687         mtpar.entryinfo = &e->ipv6;
688         mtpar.hook_mask = e->comefrom;
689         mtpar.family    = NFPROTO_IPV6;
690         xt_ematch_foreach(ematch, e) {
691                 ret = find_check_match(ematch, &mtpar);
692                 if (ret != 0)
693                         goto cleanup_matches;
694                 ++j;
695         }
696
697         t = ip6t_get_target(e);
698         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
699                                         t->u.user.revision);
700         if (IS_ERR(target)) {
701                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
702                 ret = PTR_ERR(target);
703                 goto cleanup_matches;
704         }
705         t->u.kernel.target = target;
706
707         ret = check_target(e, net, name);
708         if (ret)
709                 goto err;
710         return 0;
711  err:
712         module_put(t->u.kernel.target->me);
713  cleanup_matches:
714         xt_ematch_foreach(ematch, e) {
715                 if (j-- == 0)
716                         break;
717                 cleanup_match(ematch, net);
718         }
719         return ret;
720 }
721
722 static bool check_underflow(const struct ip6t_entry *e)
723 {
724         const struct xt_entry_target *t;
725         unsigned int verdict;
726
727         if (!unconditional(&e->ipv6))
728                 return false;
729         t = ip6t_get_target_c(e);
730         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
731                 return false;
732         verdict = ((struct xt_standard_target *)t)->verdict;
733         verdict = -verdict - 1;
734         return verdict == NF_DROP || verdict == NF_ACCEPT;
735 }
736
737 static int
738 check_entry_size_and_hooks(struct ip6t_entry *e,
739                            struct xt_table_info *newinfo,
740                            const unsigned char *base,
741                            const unsigned char *limit,
742                            const unsigned int *hook_entries,
743                            const unsigned int *underflows,
744                            unsigned int valid_hooks)
745 {
746         unsigned int h;
747
748         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
749             (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
750                 duprintf("Bad offset %p\n", e);
751                 return -EINVAL;
752         }
753
754         if (e->next_offset
755             < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target)) {
756                 duprintf("checking: element %p size %u\n",
757                          e, e->next_offset);
758                 return -EINVAL;
759         }
760
761         /* Check hooks & underflows */
762         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
763                 if (!(valid_hooks & (1 << h)))
764                         continue;
765                 if ((unsigned char *)e - base == hook_entries[h])
766                         newinfo->hook_entry[h] = hook_entries[h];
767                 if ((unsigned char *)e - base == underflows[h]) {
768                         if (!check_underflow(e)) {
769                                 pr_err("Underflows must be unconditional and "
770                                        "use the STANDARD target with "
771                                        "ACCEPT/DROP\n");
772                                 return -EINVAL;
773                         }
774                         newinfo->underflow[h] = underflows[h];
775                 }
776         }
777
778         /* Clear counters and comefrom */
779         e->counters = ((struct xt_counters) { 0, 0 });
780         e->comefrom = 0;
781         return 0;
782 }
783
784 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
785 {
786         struct xt_tgdtor_param par;
787         struct xt_entry_target *t;
788         struct xt_entry_match *ematch;
789
790         /* Cleanup all matches */
791         xt_ematch_foreach(ematch, e)
792                 cleanup_match(ematch, net);
793         t = ip6t_get_target(e);
794
795         par.net      = net;
796         par.target   = t->u.kernel.target;
797         par.targinfo = t->data;
798         par.family   = NFPROTO_IPV6;
799         if (par.target->destroy != NULL)
800                 par.target->destroy(&par);
801         module_put(par.target->me);
802 }
803
804 /* Checks and translates the user-supplied table segment (held in
805    newinfo) */
806 static int
807 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
808                 const struct ip6t_replace *repl)
809 {
810         struct ip6t_entry *iter;
811         unsigned int i;
812         int ret = 0;
813
814         newinfo->size = repl->size;
815         newinfo->number = repl->num_entries;
816
817         /* Init all hooks to impossible value. */
818         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
819                 newinfo->hook_entry[i] = 0xFFFFFFFF;
820                 newinfo->underflow[i] = 0xFFFFFFFF;
821         }
822
823         duprintf("translate_table: size %u\n", newinfo->size);
824         i = 0;
825         /* Walk through entries, checking offsets. */
826         xt_entry_foreach(iter, entry0, newinfo->size) {
827                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
828                                                  entry0 + repl->size,
829                                                  repl->hook_entry,
830                                                  repl->underflow,
831                                                  repl->valid_hooks);
832                 if (ret != 0)
833                         return ret;
834                 ++i;
835                 if (strcmp(ip6t_get_target(iter)->u.user.name,
836                     XT_ERROR_TARGET) == 0)
837                         ++newinfo->stacksize;
838         }
839
840         if (i != repl->num_entries) {
841                 duprintf("translate_table: %u not %u entries\n",
842                          i, repl->num_entries);
843                 return -EINVAL;
844         }
845
846         /* Check hooks all assigned */
847         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
848                 /* Only hooks which are valid */
849                 if (!(repl->valid_hooks & (1 << i)))
850                         continue;
851                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
852                         duprintf("Invalid hook entry %u %u\n",
853                                  i, repl->hook_entry[i]);
854                         return -EINVAL;
855                 }
856                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
857                         duprintf("Invalid underflow %u %u\n",
858                                  i, repl->underflow[i]);
859                         return -EINVAL;
860                 }
861         }
862
863         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
864                 return -ELOOP;
865
866         /* Finally, each sanity check must pass */
867         i = 0;
868         xt_entry_foreach(iter, entry0, newinfo->size) {
869                 ret = find_check_entry(iter, net, repl->name, repl->size);
870                 if (ret != 0)
871                         break;
872                 ++i;
873         }
874
875         if (ret != 0) {
876                 xt_entry_foreach(iter, entry0, newinfo->size) {
877                         if (i-- == 0)
878                                 break;
879                         cleanup_entry(iter, net);
880                 }
881                 return ret;
882         }
883
884         /* And one copy for every other CPU */
885         for_each_possible_cpu(i) {
886                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
887                         memcpy(newinfo->entries[i], entry0, newinfo->size);
888         }
889
890         return ret;
891 }
892
893 static void
894 get_counters(const struct xt_table_info *t,
895              struct xt_counters counters[])
896 {
897         struct ip6t_entry *iter;
898         unsigned int cpu;
899         unsigned int i;
900
901         for_each_possible_cpu(cpu) {
902                 seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
903
904                 i = 0;
905                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
906                         u64 bcnt, pcnt;
907                         unsigned int start;
908
909                         do {
910                                 start = read_seqbegin(lock);
911                                 bcnt = iter->counters.bcnt;
912                                 pcnt = iter->counters.pcnt;
913                         } while (read_seqretry(lock, start));
914
915                         ADD_COUNTER(counters[i], bcnt, pcnt);
916                         ++i;
917                 }
918         }
919 }
920
921 static struct xt_counters *alloc_counters(const struct xt_table *table)
922 {
923         unsigned int countersize;
924         struct xt_counters *counters;
925         const struct xt_table_info *private = table->private;
926
927         /* We need atomic snapshot of counters: rest doesn't change
928            (other than comefrom, which userspace doesn't care
929            about). */
930         countersize = sizeof(struct xt_counters) * private->number;
931         counters = vzalloc(countersize);
932
933         if (counters == NULL)
934                 return ERR_PTR(-ENOMEM);
935
936         get_counters(private, counters);
937
938         return counters;
939 }
940
941 static int
942 copy_entries_to_user(unsigned int total_size,
943                      const struct xt_table *table,
944                      void __user *userptr)
945 {
946         unsigned int off, num;
947         const struct ip6t_entry *e;
948         struct xt_counters *counters;
949         const struct xt_table_info *private = table->private;
950         int ret = 0;
951         const void *loc_cpu_entry;
952
953         counters = alloc_counters(table);
954         if (IS_ERR(counters))
955                 return PTR_ERR(counters);
956
957         /* choose the copy that is on our node/cpu, ...
958          * This choice is lazy (because current thread is
959          * allowed to migrate to another cpu)
960          */
961         loc_cpu_entry = private->entries[raw_smp_processor_id()];
962         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
963                 ret = -EFAULT;
964                 goto free_counters;
965         }
966
967         /* FIXME: use iterator macros --RR */
968         /* ... then go back and fix counters and names */
969         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
970                 unsigned int i;
971                 const struct xt_entry_match *m;
972                 const struct xt_entry_target *t;
973
974                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
975                 if (copy_to_user(userptr + off
976                                  + offsetof(struct ip6t_entry, counters),
977                                  &counters[num],
978                                  sizeof(counters[num])) != 0) {
979                         ret = -EFAULT;
980                         goto free_counters;
981                 }
982
983                 for (i = sizeof(struct ip6t_entry);
984                      i < e->target_offset;
985                      i += m->u.match_size) {
986                         m = (void *)e + i;
987
988                         if (copy_to_user(userptr + off + i
989                                          + offsetof(struct xt_entry_match,
990                                                     u.user.name),
991                                          m->u.kernel.match->name,
992                                          strlen(m->u.kernel.match->name)+1)
993                             != 0) {
994                                 ret = -EFAULT;
995                                 goto free_counters;
996                         }
997                 }
998
999                 t = ip6t_get_target_c(e);
1000                 if (copy_to_user(userptr + off + e->target_offset
1001                                  + offsetof(struct xt_entry_target,
1002                                             u.user.name),
1003                                  t->u.kernel.target->name,
1004                                  strlen(t->u.kernel.target->name)+1) != 0) {
1005                         ret = -EFAULT;
1006                         goto free_counters;
1007                 }
1008         }
1009
1010  free_counters:
1011         vfree(counters);
1012         return ret;
1013 }
1014
1015 #ifdef CONFIG_COMPAT
1016 static void compat_standard_from_user(void *dst, const void *src)
1017 {
1018         int v = *(compat_int_t *)src;
1019
1020         if (v > 0)
1021                 v += xt_compat_calc_jump(AF_INET6, v);
1022         memcpy(dst, &v, sizeof(v));
1023 }
1024
1025 static int compat_standard_to_user(void __user *dst, const void *src)
1026 {
1027         compat_int_t cv = *(int *)src;
1028
1029         if (cv > 0)
1030                 cv -= xt_compat_calc_jump(AF_INET6, cv);
1031         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1032 }
1033
1034 static int compat_calc_entry(const struct ip6t_entry *e,
1035                              const struct xt_table_info *info,
1036                              const void *base, struct xt_table_info *newinfo)
1037 {
1038         const struct xt_entry_match *ematch;
1039         const struct xt_entry_target *t;
1040         unsigned int entry_offset;
1041         int off, i, ret;
1042
1043         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1044         entry_offset = (void *)e - base;
1045         xt_ematch_foreach(ematch, e)
1046                 off += xt_compat_match_offset(ematch->u.kernel.match);
1047         t = ip6t_get_target_c(e);
1048         off += xt_compat_target_offset(t->u.kernel.target);
1049         newinfo->size -= off;
1050         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1051         if (ret)
1052                 return ret;
1053
1054         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1055                 if (info->hook_entry[i] &&
1056                     (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1057                         newinfo->hook_entry[i] -= off;
1058                 if (info->underflow[i] &&
1059                     (e < (struct ip6t_entry *)(base + info->underflow[i])))
1060                         newinfo->underflow[i] -= off;
1061         }
1062         return 0;
1063 }
1064
1065 static int compat_table_info(const struct xt_table_info *info,
1066                              struct xt_table_info *newinfo)
1067 {
1068         struct ip6t_entry *iter;
1069         void *loc_cpu_entry;
1070         int ret;
1071
1072         if (!newinfo || !info)
1073                 return -EINVAL;
1074
1075         /* we dont care about newinfo->entries[] */
1076         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1077         newinfo->initial_entries = 0;
1078         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1079         xt_compat_init_offsets(AF_INET6, info->number);
1080         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1081                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1082                 if (ret != 0)
1083                         return ret;
1084         }
1085         return 0;
1086 }
1087 #endif
1088
1089 static int get_info(struct net *net, void __user *user,
1090                     const int *len, int compat)
1091 {
1092         char name[XT_TABLE_MAXNAMELEN];
1093         struct xt_table *t;
1094         int ret;
1095
1096         if (*len != sizeof(struct ip6t_getinfo)) {
1097                 duprintf("length %u != %zu\n", *len,
1098                          sizeof(struct ip6t_getinfo));
1099                 return -EINVAL;
1100         }
1101
1102         if (copy_from_user(name, user, sizeof(name)) != 0)
1103                 return -EFAULT;
1104
1105         name[XT_TABLE_MAXNAMELEN-1] = '\0';
1106 #ifdef CONFIG_COMPAT
1107         if (compat)
1108                 xt_compat_lock(AF_INET6);
1109 #endif
1110         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1111                                     "ip6table_%s", name);
1112         if (t && !IS_ERR(t)) {
1113                 struct ip6t_getinfo info;
1114                 const struct xt_table_info *private = t->private;
1115 #ifdef CONFIG_COMPAT
1116                 struct xt_table_info tmp;
1117
1118                 if (compat) {
1119                         ret = compat_table_info(private, &tmp);
1120                         xt_compat_flush_offsets(AF_INET6);
1121                         private = &tmp;
1122                 }
1123 #endif
1124                 memset(&info, 0, sizeof(info));
1125                 info.valid_hooks = t->valid_hooks;
1126                 memcpy(info.hook_entry, private->hook_entry,
1127                        sizeof(info.hook_entry));
1128                 memcpy(info.underflow, private->underflow,
1129                        sizeof(info.underflow));
1130                 info.num_entries = private->number;
1131                 info.size = private->size;
1132                 strcpy(info.name, name);
1133
1134                 if (copy_to_user(user, &info, *len) != 0)
1135                         ret = -EFAULT;
1136                 else
1137                         ret = 0;
1138
1139                 xt_table_unlock(t);
1140                 module_put(t->me);
1141         } else
1142                 ret = t ? PTR_ERR(t) : -ENOENT;
1143 #ifdef CONFIG_COMPAT
1144         if (compat)
1145                 xt_compat_unlock(AF_INET6);
1146 #endif
1147         return ret;
1148 }
1149
1150 static int
1151 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1152             const int *len)
1153 {
1154         int ret;
1155         struct ip6t_get_entries get;
1156         struct xt_table *t;
1157
1158         if (*len < sizeof(get)) {
1159                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1160                 return -EINVAL;
1161         }
1162         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1163                 return -EFAULT;
1164         if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1165                 duprintf("get_entries: %u != %zu\n",
1166                          *len, sizeof(get) + get.size);
1167                 return -EINVAL;
1168         }
1169
1170         t = xt_find_table_lock(net, AF_INET6, get.name);
1171         if (t && !IS_ERR(t)) {
1172                 struct xt_table_info *private = t->private;
1173                 duprintf("t->private->number = %u\n", private->number);
1174                 if (get.size == private->size)
1175                         ret = copy_entries_to_user(private->size,
1176                                                    t, uptr->entrytable);
1177                 else {
1178                         duprintf("get_entries: I've got %u not %u!\n",
1179                                  private->size, get.size);
1180                         ret = -EAGAIN;
1181                 }
1182                 module_put(t->me);
1183                 xt_table_unlock(t);
1184         } else
1185                 ret = t ? PTR_ERR(t) : -ENOENT;
1186
1187         return ret;
1188 }
1189
1190 static int
1191 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1192              struct xt_table_info *newinfo, unsigned int num_counters,
1193              void __user *counters_ptr)
1194 {
1195         int ret;
1196         struct xt_table *t;
1197         struct xt_table_info *oldinfo;
1198         struct xt_counters *counters;
1199         const void *loc_cpu_old_entry;
1200         struct ip6t_entry *iter;
1201
1202         ret = 0;
1203         counters = vzalloc(num_counters * sizeof(struct xt_counters));
1204         if (!counters) {
1205                 ret = -ENOMEM;
1206                 goto out;
1207         }
1208
1209         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1210                                     "ip6table_%s", name);
1211         if (!t || IS_ERR(t)) {
1212                 ret = t ? PTR_ERR(t) : -ENOENT;
1213                 goto free_newinfo_counters_untrans;
1214         }
1215
1216         /* You lied! */
1217         if (valid_hooks != t->valid_hooks) {
1218                 duprintf("Valid hook crap: %08X vs %08X\n",
1219                          valid_hooks, t->valid_hooks);
1220                 ret = -EINVAL;
1221                 goto put_module;
1222         }
1223
1224         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1225         if (!oldinfo)
1226                 goto put_module;
1227
1228         /* Update module usage count based on number of rules */
1229         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1230                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1231         if ((oldinfo->number > oldinfo->initial_entries) ||
1232             (newinfo->number <= oldinfo->initial_entries))
1233                 module_put(t->me);
1234         if ((oldinfo->number > oldinfo->initial_entries) &&
1235             (newinfo->number <= oldinfo->initial_entries))
1236                 module_put(t->me);
1237
1238         /* Get the old counters, and synchronize with replace */
1239         get_counters(oldinfo, counters);
1240
1241         /* Decrease module usage counts and free resource */
1242         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1243         xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1244                 cleanup_entry(iter, net);
1245
1246         xt_free_table_info(oldinfo);
1247         if (copy_to_user(counters_ptr, counters,
1248                          sizeof(struct xt_counters) * num_counters) != 0)
1249                 ret = -EFAULT;
1250         vfree(counters);
1251         xt_table_unlock(t);
1252         return ret;
1253
1254  put_module:
1255         module_put(t->me);
1256         xt_table_unlock(t);
1257  free_newinfo_counters_untrans:
1258         vfree(counters);
1259  out:
1260         return ret;
1261 }
1262
1263 static int
1264 do_replace(struct net *net, const void __user *user, unsigned int len)
1265 {
1266         int ret;
1267         struct ip6t_replace tmp;
1268         struct xt_table_info *newinfo;
1269         void *loc_cpu_entry;
1270         struct ip6t_entry *iter;
1271
1272         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1273                 return -EFAULT;
1274
1275         /* overflow check */
1276         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1277                 return -ENOMEM;
1278
1279         newinfo = xt_alloc_table_info(tmp.size);
1280         if (!newinfo)
1281                 return -ENOMEM;
1282
1283         /* choose the copy that is on our node/cpu */
1284         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1285         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1286                            tmp.size) != 0) {
1287                 ret = -EFAULT;
1288                 goto free_newinfo;
1289         }
1290
1291         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1292         if (ret != 0)
1293                 goto free_newinfo;
1294
1295         duprintf("ip_tables: Translated table\n");
1296
1297         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1298                            tmp.num_counters, tmp.counters);
1299         if (ret)
1300                 goto free_newinfo_untrans;
1301         return 0;
1302
1303  free_newinfo_untrans:
1304         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1305                 cleanup_entry(iter, net);
1306  free_newinfo:
1307         xt_free_table_info(newinfo);
1308         return ret;
1309 }
1310
1311 static int
1312 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1313                 int compat)
1314 {
1315         unsigned int i, curcpu;
1316         struct xt_counters_info tmp;
1317         struct xt_counters *paddc;
1318         unsigned int num_counters;
1319         char *name;
1320         int size;
1321         void *ptmp;
1322         struct xt_table *t;
1323         const struct xt_table_info *private;
1324         int ret = 0;
1325         const void *loc_cpu_entry;
1326         struct ip6t_entry *iter;
1327 #ifdef CONFIG_COMPAT
1328         struct compat_xt_counters_info compat_tmp;
1329
1330         if (compat) {
1331                 ptmp = &compat_tmp;
1332                 size = sizeof(struct compat_xt_counters_info);
1333         } else
1334 #endif
1335         {
1336                 ptmp = &tmp;
1337                 size = sizeof(struct xt_counters_info);
1338         }
1339
1340         if (copy_from_user(ptmp, user, size) != 0)
1341                 return -EFAULT;
1342
1343 #ifdef CONFIG_COMPAT
1344         if (compat) {
1345                 num_counters = compat_tmp.num_counters;
1346                 name = compat_tmp.name;
1347         } else
1348 #endif
1349         {
1350                 num_counters = tmp.num_counters;
1351                 name = tmp.name;
1352         }
1353
1354         if (len != size + num_counters * sizeof(struct xt_counters))
1355                 return -EINVAL;
1356
1357         paddc = vmalloc(len - size);
1358         if (!paddc)
1359                 return -ENOMEM;
1360
1361         if (copy_from_user(paddc, user + size, len - size) != 0) {
1362                 ret = -EFAULT;
1363                 goto free;
1364         }
1365
1366         t = xt_find_table_lock(net, AF_INET6, name);
1367         if (!t || IS_ERR(t)) {
1368                 ret = t ? PTR_ERR(t) : -ENOENT;
1369                 goto free;
1370         }
1371
1372
1373         local_bh_disable();
1374         private = t->private;
1375         if (private->number != num_counters) {
1376                 ret = -EINVAL;
1377                 goto unlock_up_free;
1378         }
1379
1380         i = 0;
1381         /* Choose the copy that is on our node */
1382         curcpu = smp_processor_id();
1383         xt_info_wrlock(curcpu);
1384         loc_cpu_entry = private->entries[curcpu];
1385         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
1386                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
1387                 ++i;
1388         }
1389         xt_info_wrunlock(curcpu);
1390
1391  unlock_up_free:
1392         local_bh_enable();
1393         xt_table_unlock(t);
1394         module_put(t->me);
1395  free:
1396         vfree(paddc);
1397
1398         return ret;
1399 }
1400
1401 #ifdef CONFIG_COMPAT
1402 struct compat_ip6t_replace {
1403         char                    name[XT_TABLE_MAXNAMELEN];
1404         u32                     valid_hooks;
1405         u32                     num_entries;
1406         u32                     size;
1407         u32                     hook_entry[NF_INET_NUMHOOKS];
1408         u32                     underflow[NF_INET_NUMHOOKS];
1409         u32                     num_counters;
1410         compat_uptr_t           counters;       /* struct xt_counters * */
1411         struct compat_ip6t_entry entries[0];
1412 };
1413
1414 static int
1415 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1416                           unsigned int *size, struct xt_counters *counters,
1417                           unsigned int i)
1418 {
1419         struct xt_entry_target *t;
1420         struct compat_ip6t_entry __user *ce;
1421         u_int16_t target_offset, next_offset;
1422         compat_uint_t origsize;
1423         const struct xt_entry_match *ematch;
1424         int ret = 0;
1425
1426         origsize = *size;
1427         ce = (struct compat_ip6t_entry __user *)*dstptr;
1428         if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1429             copy_to_user(&ce->counters, &counters[i],
1430             sizeof(counters[i])) != 0)
1431                 return -EFAULT;
1432
1433         *dstptr += sizeof(struct compat_ip6t_entry);
1434         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1435
1436         xt_ematch_foreach(ematch, e) {
1437                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1438                 if (ret != 0)
1439                         return ret;
1440         }
1441         target_offset = e->target_offset - (origsize - *size);
1442         t = ip6t_get_target(e);
1443         ret = xt_compat_target_to_user(t, dstptr, size);
1444         if (ret)
1445                 return ret;
1446         next_offset = e->next_offset - (origsize - *size);
1447         if (put_user(target_offset, &ce->target_offset) != 0 ||
1448             put_user(next_offset, &ce->next_offset) != 0)
1449                 return -EFAULT;
1450         return 0;
1451 }
1452
1453 static int
1454 compat_find_calc_match(struct xt_entry_match *m,
1455                        const char *name,
1456                        const struct ip6t_ip6 *ipv6,
1457                        unsigned int hookmask,
1458                        int *size)
1459 {
1460         struct xt_match *match;
1461
1462         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1463                                       m->u.user.revision);
1464         if (IS_ERR(match)) {
1465                 duprintf("compat_check_calc_match: `%s' not found\n",
1466                          m->u.user.name);
1467                 return PTR_ERR(match);
1468         }
1469         m->u.kernel.match = match;
1470         *size += xt_compat_match_offset(match);
1471         return 0;
1472 }
1473
1474 static void compat_release_entry(struct compat_ip6t_entry *e)
1475 {
1476         struct xt_entry_target *t;
1477         struct xt_entry_match *ematch;
1478
1479         /* Cleanup all matches */
1480         xt_ematch_foreach(ematch, e)
1481                 module_put(ematch->u.kernel.match->me);
1482         t = compat_ip6t_get_target(e);
1483         module_put(t->u.kernel.target->me);
1484 }
1485
1486 static int
1487 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1488                                   struct xt_table_info *newinfo,
1489                                   unsigned int *size,
1490                                   const unsigned char *base,
1491                                   const unsigned char *limit,
1492                                   const unsigned int *hook_entries,
1493                                   const unsigned int *underflows,
1494                                   const char *name)
1495 {
1496         struct xt_entry_match *ematch;
1497         struct xt_entry_target *t;
1498         struct xt_target *target;
1499         unsigned int entry_offset;
1500         unsigned int j;
1501         int ret, off, h;
1502
1503         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1504         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1505             (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
1506                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1507                 return -EINVAL;
1508         }
1509
1510         if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1511                              sizeof(struct compat_xt_entry_target)) {
1512                 duprintf("checking: element %p size %u\n",
1513                          e, e->next_offset);
1514                 return -EINVAL;
1515         }
1516
1517         /* For purposes of check_entry casting the compat entry is fine */
1518         ret = check_entry((struct ip6t_entry *)e, name);
1519         if (ret)
1520                 return ret;
1521
1522         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1523         entry_offset = (void *)e - (void *)base;
1524         j = 0;
1525         xt_ematch_foreach(ematch, e) {
1526                 ret = compat_find_calc_match(ematch, name,
1527                                              &e->ipv6, e->comefrom, &off);
1528                 if (ret != 0)
1529                         goto release_matches;
1530                 ++j;
1531         }
1532
1533         t = compat_ip6t_get_target(e);
1534         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1535                                         t->u.user.revision);
1536         if (IS_ERR(target)) {
1537                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1538                          t->u.user.name);
1539                 ret = PTR_ERR(target);
1540                 goto release_matches;
1541         }
1542         t->u.kernel.target = target;
1543
1544         off += xt_compat_target_offset(target);
1545         *size += off;
1546         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1547         if (ret)
1548                 goto out;
1549
1550         /* Check hooks & underflows */
1551         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1552                 if ((unsigned char *)e - base == hook_entries[h])
1553                         newinfo->hook_entry[h] = hook_entries[h];
1554                 if ((unsigned char *)e - base == underflows[h])
1555                         newinfo->underflow[h] = underflows[h];
1556         }
1557
1558         /* Clear counters and comefrom */
1559         memset(&e->counters, 0, sizeof(e->counters));
1560         e->comefrom = 0;
1561         return 0;
1562
1563 out:
1564         module_put(t->u.kernel.target->me);
1565 release_matches:
1566         xt_ematch_foreach(ematch, e) {
1567                 if (j-- == 0)
1568                         break;
1569                 module_put(ematch->u.kernel.match->me);
1570         }
1571         return ret;
1572 }
1573
1574 static int
1575 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1576                             unsigned int *size, const char *name,
1577                             struct xt_table_info *newinfo, unsigned char *base)
1578 {
1579         struct xt_entry_target *t;
1580         struct xt_target *target;
1581         struct ip6t_entry *de;
1582         unsigned int origsize;
1583         int ret, h;
1584         struct xt_entry_match *ematch;
1585
1586         ret = 0;
1587         origsize = *size;
1588         de = (struct ip6t_entry *)*dstptr;
1589         memcpy(de, e, sizeof(struct ip6t_entry));
1590         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1591
1592         *dstptr += sizeof(struct ip6t_entry);
1593         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1594
1595         xt_ematch_foreach(ematch, e) {
1596                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1597                 if (ret != 0)
1598                         return ret;
1599         }
1600         de->target_offset = e->target_offset - (origsize - *size);
1601         t = compat_ip6t_get_target(e);
1602         target = t->u.kernel.target;
1603         xt_compat_target_from_user(t, dstptr, size);
1604
1605         de->next_offset = e->next_offset - (origsize - *size);
1606         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1607                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1608                         newinfo->hook_entry[h] -= origsize - *size;
1609                 if ((unsigned char *)de - base < newinfo->underflow[h])
1610                         newinfo->underflow[h] -= origsize - *size;
1611         }
1612         return ret;
1613 }
1614
1615 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1616                               const char *name)
1617 {
1618         unsigned int j;
1619         int ret = 0;
1620         struct xt_mtchk_param mtpar;
1621         struct xt_entry_match *ematch;
1622
1623         j = 0;
1624         mtpar.net       = net;
1625         mtpar.table     = name;
1626         mtpar.entryinfo = &e->ipv6;
1627         mtpar.hook_mask = e->comefrom;
1628         mtpar.family    = NFPROTO_IPV6;
1629         xt_ematch_foreach(ematch, e) {
1630                 ret = check_match(ematch, &mtpar);
1631                 if (ret != 0)
1632                         goto cleanup_matches;
1633                 ++j;
1634         }
1635
1636         ret = check_target(e, net, name);
1637         if (ret)
1638                 goto cleanup_matches;
1639         return 0;
1640
1641  cleanup_matches:
1642         xt_ematch_foreach(ematch, e) {
1643                 if (j-- == 0)
1644                         break;
1645                 cleanup_match(ematch, net);
1646         }
1647         return ret;
1648 }
1649
1650 static int
1651 translate_compat_table(struct net *net,
1652                        const char *name,
1653                        unsigned int valid_hooks,
1654                        struct xt_table_info **pinfo,
1655                        void **pentry0,
1656                        unsigned int total_size,
1657                        unsigned int number,
1658                        unsigned int *hook_entries,
1659                        unsigned int *underflows)
1660 {
1661         unsigned int i, j;
1662         struct xt_table_info *newinfo, *info;
1663         void *pos, *entry0, *entry1;
1664         struct compat_ip6t_entry *iter0;
1665         struct ip6t_entry *iter1;
1666         unsigned int size;
1667         int ret = 0;
1668
1669         info = *pinfo;
1670         entry0 = *pentry0;
1671         size = total_size;
1672         info->number = number;
1673
1674         /* Init all hooks to impossible value. */
1675         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1676                 info->hook_entry[i] = 0xFFFFFFFF;
1677                 info->underflow[i] = 0xFFFFFFFF;
1678         }
1679
1680         duprintf("translate_compat_table: size %u\n", info->size);
1681         j = 0;
1682         xt_compat_lock(AF_INET6);
1683         xt_compat_init_offsets(AF_INET6, number);
1684         /* Walk through entries, checking offsets. */
1685         xt_entry_foreach(iter0, entry0, total_size) {
1686                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1687                                                         entry0,
1688                                                         entry0 + total_size,
1689                                                         hook_entries,
1690                                                         underflows,
1691                                                         name);
1692                 if (ret != 0)
1693                         goto out_unlock;
1694                 ++j;
1695         }
1696
1697         ret = -EINVAL;
1698         if (j != number) {
1699                 duprintf("translate_compat_table: %u not %u entries\n",
1700                          j, number);
1701                 goto out_unlock;
1702         }
1703
1704         /* Check hooks all assigned */
1705         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1706                 /* Only hooks which are valid */
1707                 if (!(valid_hooks & (1 << i)))
1708                         continue;
1709                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1710                         duprintf("Invalid hook entry %u %u\n",
1711                                  i, hook_entries[i]);
1712                         goto out_unlock;
1713                 }
1714                 if (info->underflow[i] == 0xFFFFFFFF) {
1715                         duprintf("Invalid underflow %u %u\n",
1716                                  i, underflows[i]);
1717                         goto out_unlock;
1718                 }
1719         }
1720
1721         ret = -ENOMEM;
1722         newinfo = xt_alloc_table_info(size);
1723         if (!newinfo)
1724                 goto out_unlock;
1725
1726         newinfo->number = number;
1727         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1728                 newinfo->hook_entry[i] = info->hook_entry[i];
1729                 newinfo->underflow[i] = info->underflow[i];
1730         }
1731         entry1 = newinfo->entries[raw_smp_processor_id()];
1732         pos = entry1;
1733         size = total_size;
1734         xt_entry_foreach(iter0, entry0, total_size) {
1735                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1736                                                   name, newinfo, entry1);
1737                 if (ret != 0)
1738                         break;
1739         }
1740         xt_compat_flush_offsets(AF_INET6);
1741         xt_compat_unlock(AF_INET6);
1742         if (ret)
1743                 goto free_newinfo;
1744
1745         ret = -ELOOP;
1746         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1747                 goto free_newinfo;
1748
1749         i = 0;
1750         xt_entry_foreach(iter1, entry1, newinfo->size) {
1751                 ret = compat_check_entry(iter1, net, name);
1752                 if (ret != 0)
1753                         break;
1754                 ++i;
1755                 if (strcmp(ip6t_get_target(iter1)->u.user.name,
1756                     XT_ERROR_TARGET) == 0)
1757                         ++newinfo->stacksize;
1758         }
1759         if (ret) {
1760                 /*
1761                  * The first i matches need cleanup_entry (calls ->destroy)
1762                  * because they had called ->check already. The other j-i
1763                  * entries need only release.
1764                  */
1765                 int skip = i;
1766                 j -= i;
1767                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1768                         if (skip-- > 0)
1769                                 continue;
1770                         if (j-- == 0)
1771                                 break;
1772                         compat_release_entry(iter0);
1773                 }
1774                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1775                         if (i-- == 0)
1776                                 break;
1777                         cleanup_entry(iter1, net);
1778                 }
1779                 xt_free_table_info(newinfo);
1780                 return ret;
1781         }
1782
1783         /* And one copy for every other CPU */
1784         for_each_possible_cpu(i)
1785                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1786                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1787
1788         *pinfo = newinfo;
1789         *pentry0 = entry1;
1790         xt_free_table_info(info);
1791         return 0;
1792
1793 free_newinfo:
1794         xt_free_table_info(newinfo);
1795 out:
1796         xt_entry_foreach(iter0, entry0, total_size) {
1797                 if (j-- == 0)
1798                         break;
1799                 compat_release_entry(iter0);
1800         }
1801         return ret;
1802 out_unlock:
1803         xt_compat_flush_offsets(AF_INET6);
1804         xt_compat_unlock(AF_INET6);
1805         goto out;
1806 }
1807
1808 static int
1809 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1810 {
1811         int ret;
1812         struct compat_ip6t_replace tmp;
1813         struct xt_table_info *newinfo;
1814         void *loc_cpu_entry;
1815         struct ip6t_entry *iter;
1816
1817         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1818                 return -EFAULT;
1819
1820         /* overflow check */
1821         if (tmp.size >= INT_MAX / num_possible_cpus())
1822                 return -ENOMEM;
1823         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1824                 return -ENOMEM;
1825
1826         newinfo = xt_alloc_table_info(tmp.size);
1827         if (!newinfo)
1828                 return -ENOMEM;
1829
1830         /* choose the copy that is on our node/cpu */
1831         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1832         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1833                            tmp.size) != 0) {
1834                 ret = -EFAULT;
1835                 goto free_newinfo;
1836         }
1837
1838         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1839                                      &newinfo, &loc_cpu_entry, tmp.size,
1840                                      tmp.num_entries, tmp.hook_entry,
1841                                      tmp.underflow);
1842         if (ret != 0)
1843                 goto free_newinfo;
1844
1845         duprintf("compat_do_replace: Translated table\n");
1846
1847         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1848                            tmp.num_counters, compat_ptr(tmp.counters));
1849         if (ret)
1850                 goto free_newinfo_untrans;
1851         return 0;
1852
1853  free_newinfo_untrans:
1854         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1855                 cleanup_entry(iter, net);
1856  free_newinfo:
1857         xt_free_table_info(newinfo);
1858         return ret;
1859 }
1860
1861 static int
1862 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1863                        unsigned int len)
1864 {
1865         int ret;
1866
1867         if (!capable(CAP_NET_ADMIN))
1868                 return -EPERM;
1869
1870         switch (cmd) {
1871         case IP6T_SO_SET_REPLACE:
1872                 ret = compat_do_replace(sock_net(sk), user, len);
1873                 break;
1874
1875         case IP6T_SO_SET_ADD_COUNTERS:
1876                 ret = do_add_counters(sock_net(sk), user, len, 1);
1877                 break;
1878
1879         default:
1880                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1881                 ret = -EINVAL;
1882         }
1883
1884         return ret;
1885 }
1886
1887 struct compat_ip6t_get_entries {
1888         char name[XT_TABLE_MAXNAMELEN];
1889         compat_uint_t size;
1890         struct compat_ip6t_entry entrytable[0];
1891 };
1892
1893 static int
1894 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1895                             void __user *userptr)
1896 {
1897         struct xt_counters *counters;
1898         const struct xt_table_info *private = table->private;
1899         void __user *pos;
1900         unsigned int size;
1901         int ret = 0;
1902         const void *loc_cpu_entry;
1903         unsigned int i = 0;
1904         struct ip6t_entry *iter;
1905
1906         counters = alloc_counters(table);
1907         if (IS_ERR(counters))
1908                 return PTR_ERR(counters);
1909
1910         /* choose the copy that is on our node/cpu, ...
1911          * This choice is lazy (because current thread is
1912          * allowed to migrate to another cpu)
1913          */
1914         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1915         pos = userptr;
1916         size = total_size;
1917         xt_entry_foreach(iter, loc_cpu_entry, total_size) {
1918                 ret = compat_copy_entry_to_user(iter, &pos,
1919                                                 &size, counters, i++);
1920                 if (ret != 0)
1921                         break;
1922         }
1923
1924         vfree(counters);
1925         return ret;
1926 }
1927
1928 static int
1929 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1930                    int *len)
1931 {
1932         int ret;
1933         struct compat_ip6t_get_entries get;
1934         struct xt_table *t;
1935
1936         if (*len < sizeof(get)) {
1937                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1938                 return -EINVAL;
1939         }
1940
1941         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1942                 return -EFAULT;
1943
1944         if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1945                 duprintf("compat_get_entries: %u != %zu\n",
1946                          *len, sizeof(get) + get.size);
1947                 return -EINVAL;
1948         }
1949
1950         xt_compat_lock(AF_INET6);
1951         t = xt_find_table_lock(net, AF_INET6, get.name);
1952         if (t && !IS_ERR(t)) {
1953                 const struct xt_table_info *private = t->private;
1954                 struct xt_table_info info;
1955                 duprintf("t->private->number = %u\n", private->number);
1956                 ret = compat_table_info(private, &info);
1957                 if (!ret && get.size == info.size) {
1958                         ret = compat_copy_entries_to_user(private->size,
1959                                                           t, uptr->entrytable);
1960                 } else if (!ret) {
1961                         duprintf("compat_get_entries: I've got %u not %u!\n",
1962                                  private->size, get.size);
1963                         ret = -EAGAIN;
1964                 }
1965                 xt_compat_flush_offsets(AF_INET6);
1966                 module_put(t->me);
1967                 xt_table_unlock(t);
1968         } else
1969                 ret = t ? PTR_ERR(t) : -ENOENT;
1970
1971         xt_compat_unlock(AF_INET6);
1972         return ret;
1973 }
1974
1975 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1976
1977 static int
1978 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1979 {
1980         int ret;
1981
1982         if (!capable(CAP_NET_ADMIN))
1983                 return -EPERM;
1984
1985         switch (cmd) {
1986         case IP6T_SO_GET_INFO:
1987                 ret = get_info(sock_net(sk), user, len, 1);
1988                 break;
1989         case IP6T_SO_GET_ENTRIES:
1990                 ret = compat_get_entries(sock_net(sk), user, len);
1991                 break;
1992         default:
1993                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
1994         }
1995         return ret;
1996 }
1997 #endif
1998
1999 static int
2000 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2001 {
2002         int ret;
2003
2004         if (!capable(CAP_NET_ADMIN))
2005                 return -EPERM;
2006
2007         switch (cmd) {
2008         case IP6T_SO_SET_REPLACE:
2009                 ret = do_replace(sock_net(sk), user, len);
2010                 break;
2011
2012         case IP6T_SO_SET_ADD_COUNTERS:
2013                 ret = do_add_counters(sock_net(sk), user, len, 0);
2014                 break;
2015
2016         default:
2017                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
2018                 ret = -EINVAL;
2019         }
2020
2021         return ret;
2022 }
2023
2024 static int
2025 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2026 {
2027         int ret;
2028
2029         if (!capable(CAP_NET_ADMIN))
2030                 return -EPERM;
2031
2032         switch (cmd) {
2033         case IP6T_SO_GET_INFO:
2034                 ret = get_info(sock_net(sk), user, len, 0);
2035                 break;
2036
2037         case IP6T_SO_GET_ENTRIES:
2038                 ret = get_entries(sock_net(sk), user, len);
2039                 break;
2040
2041         case IP6T_SO_GET_REVISION_MATCH:
2042         case IP6T_SO_GET_REVISION_TARGET: {
2043                 struct xt_get_revision rev;
2044                 int target;
2045
2046                 if (*len != sizeof(rev)) {
2047                         ret = -EINVAL;
2048                         break;
2049                 }
2050                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2051                         ret = -EFAULT;
2052                         break;
2053                 }
2054
2055                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2056                         target = 1;
2057                 else
2058                         target = 0;
2059
2060                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2061                                                          rev.revision,
2062                                                          target, &ret),
2063                                         "ip6t_%s", rev.name);
2064                 break;
2065         }
2066
2067         default:
2068                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2069                 ret = -EINVAL;
2070         }
2071
2072         return ret;
2073 }
2074
2075 struct xt_table *ip6t_register_table(struct net *net,
2076                                      const struct xt_table *table,
2077                                      const struct ip6t_replace *repl)
2078 {
2079         int ret;
2080         struct xt_table_info *newinfo;
2081         struct xt_table_info bootstrap = {0};
2082         void *loc_cpu_entry;
2083         struct xt_table *new_table;
2084
2085         newinfo = xt_alloc_table_info(repl->size);
2086         if (!newinfo) {
2087                 ret = -ENOMEM;
2088                 goto out;
2089         }
2090
2091         /* choose the copy on our node/cpu, but dont care about preemption */
2092         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2093         memcpy(loc_cpu_entry, repl->entries, repl->size);
2094
2095         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2096         if (ret != 0)
2097                 goto out_free;
2098
2099         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2100         if (IS_ERR(new_table)) {
2101                 ret = PTR_ERR(new_table);
2102                 goto out_free;
2103         }
2104         return new_table;
2105
2106 out_free:
2107         xt_free_table_info(newinfo);
2108 out:
2109         return ERR_PTR(ret);
2110 }
2111
2112 void ip6t_unregister_table(struct net *net, struct xt_table *table)
2113 {
2114         struct xt_table_info *private;
2115         void *loc_cpu_entry;
2116         struct module *table_owner = table->me;
2117         struct ip6t_entry *iter;
2118
2119         private = xt_unregister_table(table);
2120
2121         /* Decrease module usage counts and free resources */
2122         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2123         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2124                 cleanup_entry(iter, net);
2125         if (private->number > private->initial_entries)
2126                 module_put(table_owner);
2127         xt_free_table_info(private);
2128 }
2129
2130 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2131 static inline bool
2132 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2133                      u_int8_t type, u_int8_t code,
2134                      bool invert)
2135 {
2136         return (type == test_type && code >= min_code && code <= max_code)
2137                 ^ invert;
2138 }
2139
2140 static bool
2141 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
2142 {
2143         const struct icmp6hdr *ic;
2144         struct icmp6hdr _icmph;
2145         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2146
2147         /* Must not be a fragment. */
2148         if (par->fragoff != 0)
2149                 return false;
2150
2151         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2152         if (ic == NULL) {
2153                 /* We've been asked to examine this packet, and we
2154                  * can't.  Hence, no choice but to drop.
2155                  */
2156                 duprintf("Dropping evil ICMP tinygram.\n");
2157                 par->hotdrop = true;
2158                 return false;
2159         }
2160
2161         return icmp6_type_code_match(icmpinfo->type,
2162                                      icmpinfo->code[0],
2163                                      icmpinfo->code[1],
2164                                      ic->icmp6_type, ic->icmp6_code,
2165                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
2166 }
2167
2168 /* Called when user tries to insert an entry of this type. */
2169 static int icmp6_checkentry(const struct xt_mtchk_param *par)
2170 {
2171         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2172
2173         /* Must specify no unknown invflags */
2174         return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
2175 }
2176
2177 /* The built-in targets: standard (NULL) and error. */
2178 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
2179         {
2180                 .name             = XT_STANDARD_TARGET,
2181                 .targetsize       = sizeof(int),
2182                 .family           = NFPROTO_IPV6,
2183 #ifdef CONFIG_COMPAT
2184                 .compatsize       = sizeof(compat_int_t),
2185                 .compat_from_user = compat_standard_from_user,
2186                 .compat_to_user   = compat_standard_to_user,
2187 #endif
2188         },
2189         {
2190                 .name             = XT_ERROR_TARGET,
2191                 .target           = ip6t_error,
2192                 .targetsize       = XT_FUNCTION_MAXNAMELEN,
2193                 .family           = NFPROTO_IPV6,
2194         },
2195 };
2196
2197 static struct nf_sockopt_ops ip6t_sockopts = {
2198         .pf             = PF_INET6,
2199         .set_optmin     = IP6T_BASE_CTL,
2200         .set_optmax     = IP6T_SO_SET_MAX+1,
2201         .set            = do_ip6t_set_ctl,
2202 #ifdef CONFIG_COMPAT
2203         .compat_set     = compat_do_ip6t_set_ctl,
2204 #endif
2205         .get_optmin     = IP6T_BASE_CTL,
2206         .get_optmax     = IP6T_SO_GET_MAX+1,
2207         .get            = do_ip6t_get_ctl,
2208 #ifdef CONFIG_COMPAT
2209         .compat_get     = compat_do_ip6t_get_ctl,
2210 #endif
2211         .owner          = THIS_MODULE,
2212 };
2213
2214 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
2215         {
2216                 .name       = "icmp6",
2217                 .match      = icmp6_match,
2218                 .matchsize  = sizeof(struct ip6t_icmp),
2219                 .checkentry = icmp6_checkentry,
2220                 .proto      = IPPROTO_ICMPV6,
2221                 .family     = NFPROTO_IPV6,
2222         },
2223 };
2224
2225 static int __net_init ip6_tables_net_init(struct net *net)
2226 {
2227         return xt_proto_init(net, NFPROTO_IPV6);
2228 }
2229
2230 static void __net_exit ip6_tables_net_exit(struct net *net)
2231 {
2232         xt_proto_fini(net, NFPROTO_IPV6);
2233 }
2234
2235 static struct pernet_operations ip6_tables_net_ops = {
2236         .init = ip6_tables_net_init,
2237         .exit = ip6_tables_net_exit,
2238 };
2239
2240 static int __init ip6_tables_init(void)
2241 {
2242         int ret;
2243
2244         ret = register_pernet_subsys(&ip6_tables_net_ops);
2245         if (ret < 0)
2246                 goto err1;
2247
2248         /* Noone else will be downing sem now, so we won't sleep */
2249         ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2250         if (ret < 0)
2251                 goto err2;
2252         ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2253         if (ret < 0)
2254                 goto err4;
2255
2256         /* Register setsockopt */
2257         ret = nf_register_sockopt(&ip6t_sockopts);
2258         if (ret < 0)
2259                 goto err5;
2260
2261         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2262         return 0;
2263
2264 err5:
2265         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2266 err4:
2267         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2268 err2:
2269         unregister_pernet_subsys(&ip6_tables_net_ops);
2270 err1:
2271         return ret;
2272 }
2273
2274 static void __exit ip6_tables_fini(void)
2275 {
2276         nf_unregister_sockopt(&ip6t_sockopts);
2277
2278         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2279         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2280         unregister_pernet_subsys(&ip6_tables_net_ops);
2281 }
2282
2283 /*
2284  * find the offset to specified header or the protocol number of last header
2285  * if target < 0. "last header" is transport protocol header, ESP, or
2286  * "No next header".
2287  *
2288  * If target header is found, its offset is set in *offset and return protocol
2289  * number. Otherwise, return -1.
2290  *
2291  * If the first fragment doesn't contain the final protocol header or
2292  * NEXTHDR_NONE it is considered invalid.
2293  *
2294  * Note that non-1st fragment is special case that "the protocol number
2295  * of last header" is "next header" field in Fragment header. In this case,
2296  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
2297  * isn't NULL.
2298  *
2299  */
2300 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
2301                   int target, unsigned short *fragoff)
2302 {
2303         unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
2304         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
2305         unsigned int len = skb->len - start;
2306
2307         if (fragoff)
2308                 *fragoff = 0;
2309
2310         while (nexthdr != target) {
2311                 struct ipv6_opt_hdr _hdr, *hp;
2312                 unsigned int hdrlen;
2313
2314                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
2315                         if (target < 0)
2316                                 break;
2317                         return -ENOENT;
2318                 }
2319
2320                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
2321                 if (hp == NULL)
2322                         return -EBADMSG;
2323                 if (nexthdr == NEXTHDR_FRAGMENT) {
2324                         unsigned short _frag_off;
2325                         __be16 *fp;
2326                         fp = skb_header_pointer(skb,
2327                                                 start+offsetof(struct frag_hdr,
2328                                                                frag_off),
2329                                                 sizeof(_frag_off),
2330                                                 &_frag_off);
2331                         if (fp == NULL)
2332                                 return -EBADMSG;
2333
2334                         _frag_off = ntohs(*fp) & ~0x7;
2335                         if (_frag_off) {
2336                                 if (target < 0 &&
2337                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
2338                                      hp->nexthdr == NEXTHDR_NONE)) {
2339                                         if (fragoff)
2340                                                 *fragoff = _frag_off;
2341                                         return hp->nexthdr;
2342                                 }
2343                                 return -ENOENT;
2344                         }
2345                         hdrlen = 8;
2346                 } else if (nexthdr == NEXTHDR_AUTH)
2347                         hdrlen = (hp->hdrlen + 2) << 2;
2348                 else
2349                         hdrlen = ipv6_optlen(hp);
2350
2351                 nexthdr = hp->nexthdr;
2352                 len -= hdrlen;
2353                 start += hdrlen;
2354         }
2355
2356         *offset = start;
2357         return nexthdr;
2358 }
2359
2360 EXPORT_SYMBOL(ip6t_register_table);
2361 EXPORT_SYMBOL(ip6t_unregister_table);
2362 EXPORT_SYMBOL(ip6t_do_table);
2363 EXPORT_SYMBOL(ip6t_ext_hdr);
2364 EXPORT_SYMBOL(ipv6_find_hdr);
2365
2366 module_init(ip6_tables_init);
2367 module_exit(ip6_tables_fini);