net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14
  15 #include <linux/kernel.h>
  16 #include <linux/capability.h>
  17 #include <linux/in.h>
  18 #include <linux/skbuff.h>
  19 #include <linux/kmod.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netdevice.h>
  22 #include <linux/module.h>
  23 #include <linux/poison.h>
  24 #include <linux/icmpv6.h>
  25 #include <net/ipv6.h>
  26 #include <net/compat.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/mutex.h>
  29 #include <linux/proc_fs.h>
  30 #include <linux/err.h>
  31 #include <linux/cpumask.h>
  32
  33 #include <linux/netfilter_ipv6/ip6_tables.h>
  34 #include <linux/netfilter/x_tables.h>
  35 #include <net/netfilter/nf_log.h>
  36 #include "../../netfilter/xt_repldata.h"
  37
  38 MODULE_LICENSE("GPL");
  39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  40 MODULE_DESCRIPTION("IPv6 packet filter");
  41
  42 /*#define DEBUG_IP_FIREWALL*/
  43 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  44 /*#define DEBUG_IP_FIREWALL_USER*/
  45
  46 #ifdef DEBUG_IP_FIREWALL
  47 #define dprintf(format, args...) pr_info(format , ## args)
  48 #else
  49 #define dprintf(format, args...)
  50 #endif
  51
  52 #ifdef DEBUG_IP_FIREWALL_USER
  53 #define duprintf(format, args...) pr_info(format , ## args)
  54 #else
  55 #define duprintf(format, args...)
  56 #endif
  57
  58 #ifdef CONFIG_NETFILTER_DEBUG
  59 #define IP_NF_ASSERT(x) WARN_ON(!(x))
  60 #else
  61 #define IP_NF_ASSERT(x)
  62 #endif
  63
  64 #if 0
  65 /* All the better to debug you with... */
  66 #define static
  67 #define inline
  68 #endif
  69
  70 void *ip6t_alloc_initial_table(const struct xt_table *info)
  71 {
  72         return xt_alloc_initial_table(ip6t, IP6T);
  73 }
  74 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
  75
  76 /*
  77    We keep a set of rules for each CPU, so we can avoid write-locking
  78    them in the softirq when updating the counters and therefore
  79    only need to read-lock in the softirq; doing a write_lock_bh() in user
  80    context stops packets coming through and allows user context to read
  81    the counters or update the rules.
  82
  83    Hence the start of any table is given by get_table() below.  */
  84
  85 /* Returns whether matches rule or not. */
  86 /* Performance critical - called for every packet */
  87 static inline bool
  88 ip6_packet_match(const struct sk_buff *skb,
  89                  const char *indev,
  90                  const char *outdev,
  91                  const struct ip6t_ip6 *ip6info,
  92                  unsigned int *protoff,
  93                  int *fragoff, bool *hotdrop)
  94 {
  95         unsigned long ret;
  96         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
  97
  98 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
  99
 100         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 101                                        &ip6info->src), IP6T_INV_SRCIP) ||
 102             FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 103                                        &ip6info->dst), IP6T_INV_DSTIP)) {
 104                 dprintf("Source or dest mismatch.\n");
 105 /*
 106                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 107                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 108                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 109                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 110                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 111                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 112                 return false;
 113         }
 114
 115         ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 116
 117         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 118                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 119                         indev, ip6info->iniface,
 120                         ip6info->invflags & IP6T_INV_VIA_IN ? " (INV)" : "");
 121                 return false;
 122         }
 123
 124         ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 125
 126         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 127                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 128                         outdev, ip6info->outiface,
 129                         ip6info->invflags & IP6T_INV_VIA_OUT ? " (INV)" : "");
 130                 return false;
 131         }
 132
 133 /* ... might want to do something with class and flowlabel here ... */
 134
 135         /* look for the desired protocol header */
 136         if (ip6info->flags & IP6T_F_PROTO) {
 137                 int protohdr;
 138                 unsigned short _frag_off;
 139
 140                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
 141                 if (protohdr < 0) {
 142                         if (_frag_off == 0)
 143                                 *hotdrop = true;
 144                         return false;
 145                 }
 146                 *fragoff = _frag_off;
 147
 148                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 149                                 protohdr,
 150                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 151                                 ip6info->proto);
 152
 153                 if (ip6info->proto == protohdr) {
 154                         if (ip6info->invflags & IP6T_INV_PROTO)
 155                                 return false;
 156
 157                         return true;
 158                 }
 159
 160                 /* We need match for the '-p all', too! */
 161                 if ((ip6info->proto != 0) &&
 162                         !(ip6info->invflags & IP6T_INV_PROTO))
 163                         return false;
 164         }
 165         return true;
 166 }
 167
 168 /* should be ip6 safe */
 169 static bool
 170 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 171 {
 172         if (ipv6->flags & ~IP6T_F_MASK) {
 173                 duprintf("Unknown flag bits set: %08X\n",
 174                          ipv6->flags & ~IP6T_F_MASK);
 175                 return false;
 176         }
 177         if (ipv6->invflags & ~IP6T_INV_MASK) {
 178                 duprintf("Unknown invflag bits set: %08X\n",
 179                          ipv6->invflags & ~IP6T_INV_MASK);
 180                 return false;
 181         }
 182         return true;
 183 }
 184
 185 static unsigned int
 186 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
 187 {
 188         net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
 189
 190         return NF_DROP;
 191 }
 192
 193 static inline struct ip6t_entry *
 194 get_entry(const void *base, unsigned int offset)
 195 {
 196         return (struct ip6t_entry *)(base + offset);
 197 }
 198
 199 /* All zeroes == unconditional rule. */
 200 /* Mildly perf critical (only if packet tracing is on) */
 201 static inline bool unconditional(const struct ip6t_entry *e)
 202 {
 203         static const struct ip6t_ip6 uncond;
 204
 205         return e->target_offset == sizeof(struct ip6t_entry) &&
 206                memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
 207 }
 208
 209 static inline const struct xt_entry_target *
 210 ip6t_get_target_c(const struct ip6t_entry *e)
 211 {
 212         return ip6t_get_target((struct ip6t_entry *)e);
 213 }
 214
 215 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 216 /* This cries for unification! */
 217 static const char *const hooknames[] = {
 218         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 219         [NF_INET_LOCAL_IN]              = "INPUT",
 220         [NF_INET_FORWARD]               = "FORWARD",
 221         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 222         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 223 };
 224
 225 enum nf_ip_trace_comments {
 226         NF_IP6_TRACE_COMMENT_RULE,
 227         NF_IP6_TRACE_COMMENT_RETURN,
 228         NF_IP6_TRACE_COMMENT_POLICY,
 229 };
 230
 231 static const char *const comments[] = {
 232         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
 233         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
 234         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
 235 };
 236
 237 static struct nf_loginfo trace_loginfo = {
 238         .type = NF_LOG_TYPE_LOG,
 239         .u = {
 240                 .log = {
 241                         .level = LOGLEVEL_WARNING,
 242                         .logflags = NF_LOG_MASK,
 243                 },
 244         },
 245 };
 246
 247 /* Mildly perf critical (only if packet tracing is on) */
 248 static inline int
 249 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
 250                       const char *hookname, const char **chainname,
 251                       const char **comment, unsigned int *rulenum)
 252 {
 253         const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
 254
 255         if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
 256                 /* Head of user chain: ERROR target with chainname */
 257                 *chainname = t->target.data;
 258                 (*rulenum) = 0;
 259         } else if (s == e) {
 260                 (*rulenum)++;
 261
 262                 if (unconditional(s) &&
 263                     strcmp(t->target.u.kernel.target->name,
 264                            XT_STANDARD_TARGET) == 0 &&
 265                     t->verdict < 0) {
 266                         /* Tail of chains: STANDARD target (return/policy) */
 267                         *comment = *chainname == hookname
 268                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
 269                                 : comments[NF_IP6_TRACE_COMMENT_RETURN];
 270                 }
 271                 return 1;
 272         } else
 273                 (*rulenum)++;
 274
 275         return 0;
 276 }
 277
 278 static void trace_packet(struct net *net,
 279                          const struct sk_buff *skb,
 280                          unsigned int hook,
 281                          const struct net_device *in,
 282                          const struct net_device *out,
 283                          const char *tablename,
 284                          const struct xt_table_info *private,
 285                          const struct ip6t_entry *e)
 286 {
 287         const struct ip6t_entry *root;
 288         const char *hookname, *chainname, *comment;
 289         const struct ip6t_entry *iter;
 290         unsigned int rulenum = 0;
 291
 292         root = get_entry(private->entries, private->hook_entry[hook]);
 293
 294         hookname = chainname = hooknames[hook];
 295         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 296
 297         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 298                 if (get_chainname_rulenum(iter, e, hookname,
 299                     &chainname, &comment, &rulenum) != 0)
 300                         break;
 301
 302         nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
 303                      "TRACE: %s:%s:%s:%u ",
 304                      tablename, chainname, comment, rulenum);
 305 }
 306 #endif
 307
 308 static inline struct ip6t_entry *
 309 ip6t_next_entry(const struct ip6t_entry *entry)
 310 {
 311         return (void *)entry + entry->next_offset;
 312 }
 313
 314 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 315 unsigned int
 316 ip6t_do_table(struct sk_buff *skb,
 317               const struct nf_hook_state *state,
 318               struct xt_table *table)
 319 {
 320         unsigned int hook = state->hook;
 321         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 322         /* Initializing verdict to NF_DROP keeps gcc happy. */
 323         unsigned int verdict = NF_DROP;
 324         const char *indev, *outdev;
 325         const void *table_base;
 326         struct ip6t_entry *e, **jumpstack;
 327         unsigned int stackidx, cpu;
 328         const struct xt_table_info *private;
 329         struct xt_action_param acpar;
 330         unsigned int addend;
 331
 332         /* Initialization */
 333         stackidx = 0;
 334         indev = state->in ? state->in->name : nulldevname;
 335         outdev = state->out ? state->out->name : nulldevname;
 336         /* We handle fragments by dealing with the first fragment as
 337          * if it was a normal packet.  All other fragments are treated
 338          * normally, except that they will NEVER match rules that ask
 339          * things we don't know, ie. tcp syn flag or ports).  If the
 340          * rule is also a fragment-specific rule, non-fragments won't
 341          * match it. */
 342         acpar.hotdrop = false;
 343         acpar.net     = state->net;
 344         acpar.in      = state->in;
 345         acpar.out     = state->out;
 346         acpar.family  = NFPROTO_IPV6;
 347         acpar.hooknum = hook;
 348
 349         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 350
 351         local_bh_disable();
 352         addend = xt_write_recseq_begin();
 353         private = table->private;
 354         /*
 355          * Ensure we load private-> members after we've fetched the base
 356          * pointer.
 357          */
 358         smp_read_barrier_depends();
 359         cpu        = smp_processor_id();
 360         table_base = private->entries;
 361         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
 362
 363         /* Switch to alternate jumpstack if we're being invoked via TEE.
 364          * TEE issues XT_CONTINUE verdict on original skb so we must not
 365          * clobber the jumpstack.
 366          *
 367          * For recursion via REJECT or SYNPROXY the stack will be clobbered
 368          * but it is no problem since absolute verdict is issued by these.
 369          */
 370         if (static_key_false(&xt_tee_enabled))
 371                 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
 372
 373         e = get_entry(table_base, private->hook_entry[hook]);
 374
 375         do {
 376                 const struct xt_entry_target *t;
 377                 const struct xt_entry_match *ematch;
 378                 struct xt_counters *counter;
 379
 380                 IP_NF_ASSERT(e);
 381                 acpar.thoff = 0;
 382                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
 383                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
 384  no_match:
 385                         e = ip6t_next_entry(e);
 386                         continue;
 387                 }
 388
 389                 xt_ematch_foreach(ematch, e) {
 390                         acpar.match     = ematch->u.kernel.match;
 391                         acpar.matchinfo = ematch->data;
 392                         if (!acpar.match->match(skb, &acpar))
 393                                 goto no_match;
 394                 }
 395
 396                 counter = xt_get_this_cpu_counter(&e->counters);
 397                 ADD_COUNTER(*counter, skb->len, 1);
 398
 399                 t = ip6t_get_target_c(e);
 400                 IP_NF_ASSERT(t->u.kernel.target);
 401
 402 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 403                 /* The packet is traced: log it */
 404                 if (unlikely(skb->nf_trace))
 405                         trace_packet(state->net, skb, hook, state->in,
 406                                      state->out, table->name, private, e);
 407 #endif
 408                 /* Standard target? */
 409                 if (!t->u.kernel.target->target) {
 410                         int v;
 411
 412                         v = ((struct xt_standard_target *)t)->verdict;
 413                         if (v < 0) {
 414                                 /* Pop from stack? */
 415                                 if (v != XT_RETURN) {
 416                                         verdict = (unsigned int)(-v) - 1;
 417                                         break;
 418                                 }
 419                                 if (stackidx == 0)
 420                                         e = get_entry(table_base,
 421                                             private->underflow[hook]);
 422                                 else
 423                                         e = ip6t_next_entry(jumpstack[--stackidx]);
 424                                 continue;
 425                         }
 426                         if (table_base + v != ip6t_next_entry(e) &&
 427                             !(e->ipv6.flags & IP6T_F_GOTO)) {
 428                                 jumpstack[stackidx++] = e;
 429                         }
 430
 431                         e = get_entry(table_base, v);
 432                         continue;
 433                 }
 434
 435                 acpar.target   = t->u.kernel.target;
 436                 acpar.targinfo = t->data;
 437
 438                 verdict = t->u.kernel.target->target(skb, &acpar);
 439                 if (verdict == XT_CONTINUE)
 440                         e = ip6t_next_entry(e);
 441                 else
 442                         /* Verdict */
 443                         break;
 444         } while (!acpar.hotdrop);
 445
 446         xt_write_recseq_end(addend);
 447         local_bh_enable();
 448
 449 #ifdef DEBUG_ALLOW_ALL
 450         return NF_ACCEPT;
 451 #else
 452         if (acpar.hotdrop)
 453                 return NF_DROP;
 454         else return verdict;
 455 #endif
 456 }
 457
 458 /* Figures out from what hook each rule can be called: returns 0 if
 459    there are loops.  Puts hook bitmask in comefrom. */
 460 static int
 461 mark_source_chains(const struct xt_table_info *newinfo,
 462                    unsigned int valid_hooks, void *entry0)
 463 {
 464         unsigned int hook;
 465
 466         /* No recursion; use packet counter to save back ptrs (reset
 467            to 0 as we leave), and comefrom to save source hook bitmask */
 468         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 469                 unsigned int pos = newinfo->hook_entry[hook];
 470                 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
 471
 472                 if (!(valid_hooks & (1 << hook)))
 473                         continue;
 474
 475                 /* Set initial back pointer. */
 476                 e->counters.pcnt = pos;
 477
 478                 for (;;) {
 479                         const struct xt_standard_target *t
 480                                 = (void *)ip6t_get_target_c(e);
 481                         int visited = e->comefrom & (1 << hook);
 482
 483                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 484                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
 485                                        hook, pos, e->comefrom);
 486                                 return 0;
 487                         }
 488                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 489
 490                         /* Unconditional return/END. */
 491                         if ((unconditional(e) &&
 492                              (strcmp(t->target.u.user.name,
 493                                      XT_STANDARD_TARGET) == 0) &&
 494                              t->verdict < 0) || visited) {
 495                                 unsigned int oldpos, size;
 496
 497                                 if ((strcmp(t->target.u.user.name,
 498                                             XT_STANDARD_TARGET) == 0) &&
 499                                     t->verdict < -NF_MAX_VERDICT - 1) {
 500                                         duprintf("mark_source_chains: bad "
 501                                                 "negative verdict (%i)\n",
 502                                                                 t->verdict);
 503                                         return 0;
 504                                 }
 505
 506                                 /* Return: backtrack through the last
 507                                    big jump. */
 508                                 do {
 509                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 510 #ifdef DEBUG_IP_FIREWALL_USER
 511                                         if (e->comefrom
 512                                             & (1 << NF_INET_NUMHOOKS)) {
 513                                                 duprintf("Back unset "
 514                                                          "on hook %u "
 515                                                          "rule %u\n",
 516                                                          hook, pos);
 517                                         }
 518 #endif
 519                                         oldpos = pos;
 520                                         pos = e->counters.pcnt;
 521                                         e->counters.pcnt = 0;
 522
 523                                         /* We're at the start. */
 524                                         if (pos == oldpos)
 525                                                 goto next;
 526
 527                                         e = (struct ip6t_entry *)
 528                                                 (entry0 + pos);
 529                                 } while (oldpos == pos + e->next_offset);
 530
 531                                 /* Move along one */
 532                                 size = e->next_offset;
 533                                 e = (struct ip6t_entry *)
 534                                         (entry0 + pos + size);
 535                                 if (pos + size >= newinfo->size)
 536                                         return 0;
 537                                 e->counters.pcnt = pos;
 538                                 pos += size;
 539                         } else {
 540                                 int newpos = t->verdict;
 541
 542                                 if (strcmp(t->target.u.user.name,
 543                                            XT_STANDARD_TARGET) == 0 &&
 544                                     newpos >= 0) {
 545                                         if (newpos > newinfo->size -
 546                                                 sizeof(struct ip6t_entry)) {
 547                                                 duprintf("mark_source_chains: "
 548                                                         "bad verdict (%i)\n",
 549                                                                 newpos);
 550                                                 return 0;
 551                                         }
 552                                         /* This a jump; chase it. */
 553                                         duprintf("Jump rule %u -> %u\n",
 554                                                  pos, newpos);
 555                                 } else {
 556                                         /* ... this is a fallthru */
 557                                         newpos = pos + e->next_offset;
 558                                         if (newpos >= newinfo->size)
 559                                                 return 0;
 560                                 }
 561                                 e = (struct ip6t_entry *)
 562                                         (entry0 + newpos);
 563                                 e->counters.pcnt = pos;
 564                                 pos = newpos;
 565                         }
 566                 }
 567 next:
 568                 duprintf("Finished chain %u\n", hook);
 569         }
 570         return 1;
 571 }
 572
 573 static void cleanup_match(struct xt_entry_match *m, struct net *net)
 574 {
 575         struct xt_mtdtor_param par;
 576
 577         par.net       = net;
 578         par.match     = m->u.kernel.match;
 579         par.matchinfo = m->data;
 580         par.family    = NFPROTO_IPV6;
 581         if (par.match->destroy != NULL)
 582                 par.match->destroy(&par);
 583         module_put(par.match->me);
 584 }
 585
 586 static int
 587 check_entry(const struct ip6t_entry *e)
 588 {
 589         const struct xt_entry_target *t;
 590
 591         if (!ip6_checkentry(&e->ipv6))
 592                 return -EINVAL;
 593
 594         if (e->target_offset + sizeof(struct xt_entry_target) >
 595             e->next_offset)
 596                 return -EINVAL;
 597
 598         t = ip6t_get_target_c(e);
 599         if (e->target_offset + t->u.target_size > e->next_offset)
 600                 return -EINVAL;
 601
 602         return 0;
 603 }
 604
 605 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 606 {
 607         const struct ip6t_ip6 *ipv6 = par->entryinfo;
 608         int ret;
 609
 610         par->match     = m->u.kernel.match;
 611         par->matchinfo = m->data;
 612
 613         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 614                              ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
 615         if (ret < 0) {
 616                 duprintf("ip_tables: check failed for `%s'.\n",
 617                          par.match->name);
 618                 return ret;
 619         }
 620         return 0;
 621 }
 622
 623 static int
 624 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 625 {
 626         struct xt_match *match;
 627         int ret;
 628
 629         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
 630                                       m->u.user.revision);
 631         if (IS_ERR(match)) {
 632                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 633                 return PTR_ERR(match);
 634         }
 635         m->u.kernel.match = match;
 636
 637         ret = check_match(m, par);
 638         if (ret)
 639                 goto err;
 640
 641         return 0;
 642 err:
 643         module_put(m->u.kernel.match->me);
 644         return ret;
 645 }
 646
 647 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 648 {
 649         struct xt_entry_target *t = ip6t_get_target(e);
 650         struct xt_tgchk_param par = {
 651                 .net       = net,
 652                 .table     = name,
 653                 .entryinfo = e,
 654                 .target    = t->u.kernel.target,
 655                 .targinfo  = t->data,
 656                 .hook_mask = e->comefrom,
 657                 .family    = NFPROTO_IPV6,
 658         };
 659         int ret;
 660
 661         t = ip6t_get_target(e);
 662         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 663               e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
 664         if (ret < 0) {
 665                 duprintf("ip_tables: check failed for `%s'.\n",
 666                          t->u.kernel.target->name);
 667                 return ret;
 668         }
 669         return 0;
 670 }
 671
 672 static int
 673 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 674                  unsigned int size)
 675 {
 676         struct xt_entry_target *t;
 677         struct xt_target *target;
 678         int ret;
 679         unsigned int j;
 680         struct xt_mtchk_param mtpar;
 681         struct xt_entry_match *ematch;
 682
 683         e->counters.pcnt = xt_percpu_counter_alloc();
 684         if (IS_ERR_VALUE(e->counters.pcnt))
 685                 return -ENOMEM;
 686
 687         j = 0;
 688         mtpar.net       = net;
 689         mtpar.table     = name;
 690         mtpar.entryinfo = &e->ipv6;
 691         mtpar.hook_mask = e->comefrom;
 692         mtpar.family    = NFPROTO_IPV6;
 693         xt_ematch_foreach(ematch, e) {
 694                 ret = find_check_match(ematch, &mtpar);
 695                 if (ret != 0)
 696                         goto cleanup_matches;
 697                 ++j;
 698         }
 699
 700         t = ip6t_get_target(e);
 701         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
 702                                         t->u.user.revision);
 703         if (IS_ERR(target)) {
 704                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 705                 ret = PTR_ERR(target);
 706                 goto cleanup_matches;
 707         }
 708         t->u.kernel.target = target;
 709
 710         ret = check_target(e, net, name);
 711         if (ret)
 712                 goto err;
 713         return 0;
 714  err:
 715         module_put(t->u.kernel.target->me);
 716  cleanup_matches:
 717         xt_ematch_foreach(ematch, e) {
 718                 if (j-- == 0)
 719                         break;
 720                 cleanup_match(ematch, net);
 721         }
 722
 723         xt_percpu_counter_free(e->counters.pcnt);
 724
 725         return ret;
 726 }
 727
 728 static bool check_underflow(const struct ip6t_entry *e)
 729 {
 730         const struct xt_entry_target *t;
 731         unsigned int verdict;
 732
 733         if (!unconditional(e))
 734                 return false;
 735         t = ip6t_get_target_c(e);
 736         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 737                 return false;
 738         verdict = ((struct xt_standard_target *)t)->verdict;
 739         verdict = -verdict - 1;
 740         return verdict == NF_DROP || verdict == NF_ACCEPT;
 741 }
 742
 743 static int
 744 check_entry_size_and_hooks(struct ip6t_entry *e,
 745                            struct xt_table_info *newinfo,
 746                            const unsigned char *base,
 747                            const unsigned char *limit,
 748                            const unsigned int *hook_entries,
 749                            const unsigned int *underflows,
 750                            unsigned int valid_hooks)
 751 {
 752         unsigned int h;
 753         int err;
 754
 755         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
 756             (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
 757             (unsigned char *)e + e->next_offset > limit) {
 758                 duprintf("Bad offset %p\n", e);
 759                 return -EINVAL;
 760         }
 761
 762         if (e->next_offset
 763             < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target)) {
 764                 duprintf("checking: element %p size %u\n",
 765                          e, e->next_offset);
 766                 return -EINVAL;
 767         }
 768
 769         err = check_entry(e);
 770         if (err)
 771                 return err;
 772
 773         /* Check hooks & underflows */
 774         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 775                 if (!(valid_hooks & (1 << h)))
 776                         continue;
 777                 if ((unsigned char *)e - base == hook_entries[h])
 778                         newinfo->hook_entry[h] = hook_entries[h];
 779                 if ((unsigned char *)e - base == underflows[h]) {
 780                         if (!check_underflow(e)) {
 781                                 pr_debug("Underflows must be unconditional and "
 782                                          "use the STANDARD target with "
 783                                          "ACCEPT/DROP\n");
 784                                 return -EINVAL;
 785                         }
 786                         newinfo->underflow[h] = underflows[h];
 787                 }
 788         }
 789
 790         /* Clear counters and comefrom */
 791         e->counters = ((struct xt_counters) { 0, 0 });
 792         e->comefrom = 0;
 793         return 0;
 794 }
 795
 796 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
 797 {
 798         struct xt_tgdtor_param par;
 799         struct xt_entry_target *t;
 800         struct xt_entry_match *ematch;
 801
 802         /* Cleanup all matches */
 803         xt_ematch_foreach(ematch, e)
 804                 cleanup_match(ematch, net);
 805         t = ip6t_get_target(e);
 806
 807         par.net      = net;
 808         par.target   = t->u.kernel.target;
 809         par.targinfo = t->data;
 810         par.family   = NFPROTO_IPV6;
 811         if (par.target->destroy != NULL)
 812                 par.target->destroy(&par);
 813         module_put(par.target->me);
 814
 815         xt_percpu_counter_free(e->counters.pcnt);
 816 }
 817
 818 /* Checks and translates the user-supplied table segment (held in
 819    newinfo) */
 820 static int
 821 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
 822                 const struct ip6t_replace *repl)
 823 {
 824         struct ip6t_entry *iter;
 825         unsigned int i;
 826         int ret = 0;
 827
 828         newinfo->size = repl->size;
 829         newinfo->number = repl->num_entries;
 830
 831         /* Init all hooks to impossible value. */
 832         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 833                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 834                 newinfo->underflow[i] = 0xFFFFFFFF;
 835         }
 836
 837         duprintf("translate_table: size %u\n", newinfo->size);
 838         i = 0;
 839         /* Walk through entries, checking offsets. */
 840         xt_entry_foreach(iter, entry0, newinfo->size) {
 841                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 842                                                  entry0 + repl->size,
 843                                                  repl->hook_entry,
 844                                                  repl->underflow,
 845                                                  repl->valid_hooks);
 846                 if (ret != 0)
 847                         return ret;
 848                 ++i;
 849                 if (strcmp(ip6t_get_target(iter)->u.user.name,
 850                     XT_ERROR_TARGET) == 0)
 851                         ++newinfo->stacksize;
 852         }
 853
 854         if (i != repl->num_entries) {
 855                 duprintf("translate_table: %u not %u entries\n",
 856                          i, repl->num_entries);
 857                 return -EINVAL;
 858         }
 859
 860         /* Check hooks all assigned */
 861         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 862                 /* Only hooks which are valid */
 863                 if (!(repl->valid_hooks & (1 << i)))
 864                         continue;
 865                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 866                         duprintf("Invalid hook entry %u %u\n",
 867                                  i, repl->hook_entry[i]);
 868                         return -EINVAL;
 869                 }
 870                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 871                         duprintf("Invalid underflow %u %u\n",
 872                                  i, repl->underflow[i]);
 873                         return -EINVAL;
 874                 }
 875         }
 876
 877         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
 878                 return -ELOOP;
 879
 880         /* Finally, each sanity check must pass */
 881         i = 0;
 882         xt_entry_foreach(iter, entry0, newinfo->size) {
 883                 ret = find_check_entry(iter, net, repl->name, repl->size);
 884                 if (ret != 0)
 885                         break;
 886                 ++i;
 887         }
 888
 889         if (ret != 0) {
 890                 xt_entry_foreach(iter, entry0, newinfo->size) {
 891                         if (i-- == 0)
 892                                 break;
 893                         cleanup_entry(iter, net);
 894                 }
 895                 return ret;
 896         }
 897
 898         return ret;
 899 }
 900
 901 static void
 902 get_counters(const struct xt_table_info *t,
 903              struct xt_counters counters[])
 904 {
 905         struct ip6t_entry *iter;
 906         unsigned int cpu;
 907         unsigned int i;
 908
 909         for_each_possible_cpu(cpu) {
 910                 seqcount_t *s = &per_cpu(xt_recseq, cpu);
 911
 912                 i = 0;
 913                 xt_entry_foreach(iter, t->entries, t->size) {
 914                         struct xt_counters *tmp;
 915                         u64 bcnt, pcnt;
 916                         unsigned int start;
 917
 918                         tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
 919                         do {
 920                                 start = read_seqcount_begin(s);
 921                                 bcnt = tmp->bcnt;
 922                                 pcnt = tmp->pcnt;
 923                         } while (read_seqcount_retry(s, start));
 924
 925                         ADD_COUNTER(counters[i], bcnt, pcnt);
 926                         ++i;
 927                 }
 928         }
 929 }
 930
 931 static struct xt_counters *alloc_counters(const struct xt_table *table)
 932 {
 933         unsigned int countersize;
 934         struct xt_counters *counters;
 935         const struct xt_table_info *private = table->private;
 936
 937         /* We need atomic snapshot of counters: rest doesn't change
 938            (other than comefrom, which userspace doesn't care
 939            about). */
 940         countersize = sizeof(struct xt_counters) * private->number;
 941         counters = vzalloc(countersize);
 942
 943         if (counters == NULL)
 944                 return ERR_PTR(-ENOMEM);
 945
 946         get_counters(private, counters);
 947
 948         return counters;
 949 }
 950
 951 static int
 952 copy_entries_to_user(unsigned int total_size,
 953                      const struct xt_table *table,
 954                      void __user *userptr)
 955 {
 956         unsigned int off, num;
 957         const struct ip6t_entry *e;
 958         struct xt_counters *counters;
 959         const struct xt_table_info *private = table->private;
 960         int ret = 0;
 961         const void *loc_cpu_entry;
 962
 963         counters = alloc_counters(table);
 964         if (IS_ERR(counters))
 965                 return PTR_ERR(counters);
 966
 967         loc_cpu_entry = private->entries;
 968         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 969                 ret = -EFAULT;
 970                 goto free_counters;
 971         }
 972
 973         /* FIXME: use iterator macros --RR */
 974         /* ... then go back and fix counters and names */
 975         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 976                 unsigned int i;
 977                 const struct xt_entry_match *m;
 978                 const struct xt_entry_target *t;
 979
 980                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
 981                 if (copy_to_user(userptr + off
 982                                  + offsetof(struct ip6t_entry, counters),
 983                                  &counters[num],
 984                                  sizeof(counters[num])) != 0) {
 985                         ret = -EFAULT;
 986                         goto free_counters;
 987                 }
 988
 989                 for (i = sizeof(struct ip6t_entry);
 990                      i < e->target_offset;
 991                      i += m->u.match_size) {
 992                         m = (void *)e + i;
 993
 994                         if (copy_to_user(userptr + off + i
 995                                          + offsetof(struct xt_entry_match,
 996                                                     u.user.name),
 997                                          m->u.kernel.match->name,
 998                                          strlen(m->u.kernel.match->name)+1)
 999                             != 0) {
1000                                 ret = -EFAULT;
1001                                 goto free_counters;
1002                         }
1003                 }
1004
1005                 t = ip6t_get_target_c(e);
1006                 if (copy_to_user(userptr + off + e->target_offset
1007                                  + offsetof(struct xt_entry_target,
1008                                             u.user.name),
1009                                  t->u.kernel.target->name,
1010                                  strlen(t->u.kernel.target->name)+1) != 0) {
1011                         ret = -EFAULT;
1012                         goto free_counters;
1013                 }
1014         }
1015
1016  free_counters:
1017         vfree(counters);
1018         return ret;
1019 }
1020
1021 #ifdef CONFIG_COMPAT
1022 static void compat_standard_from_user(void *dst, const void *src)
1023 {
1024         int v = *(compat_int_t *)src;
1025
1026         if (v > 0)
1027                 v += xt_compat_calc_jump(AF_INET6, v);
1028         memcpy(dst, &v, sizeof(v));
1029 }
1030
1031 static int compat_standard_to_user(void __user *dst, const void *src)
1032 {
1033         compat_int_t cv = *(int *)src;
1034
1035         if (cv > 0)
1036                 cv -= xt_compat_calc_jump(AF_INET6, cv);
1037         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1038 }
1039
1040 static int compat_calc_entry(const struct ip6t_entry *e,
1041                              const struct xt_table_info *info,
1042                              const void *base, struct xt_table_info *newinfo)
1043 {
1044         const struct xt_entry_match *ematch;
1045         const struct xt_entry_target *t;
1046         unsigned int entry_offset;
1047         int off, i, ret;
1048
1049         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1050         entry_offset = (void *)e - base;
1051         xt_ematch_foreach(ematch, e)
1052                 off += xt_compat_match_offset(ematch->u.kernel.match);
1053         t = ip6t_get_target_c(e);
1054         off += xt_compat_target_offset(t->u.kernel.target);
1055         newinfo->size -= off;
1056         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1057         if (ret)
1058                 return ret;
1059
1060         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1061                 if (info->hook_entry[i] &&
1062                     (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1063                         newinfo->hook_entry[i] -= off;
1064                 if (info->underflow[i] &&
1065                     (e < (struct ip6t_entry *)(base + info->underflow[i])))
1066                         newinfo->underflow[i] -= off;
1067         }
1068         return 0;
1069 }
1070
1071 static int compat_table_info(const struct xt_table_info *info,
1072                              struct xt_table_info *newinfo)
1073 {
1074         struct ip6t_entry *iter;
1075         const void *loc_cpu_entry;
1076         int ret;
1077
1078         if (!newinfo || !info)
1079                 return -EINVAL;
1080
1081         /* we dont care about newinfo->entries */
1082         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1083         newinfo->initial_entries = 0;
1084         loc_cpu_entry = info->entries;
1085         xt_compat_init_offsets(AF_INET6, info->number);
1086         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1087                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1088                 if (ret != 0)
1089                         return ret;
1090         }
1091         return 0;
1092 }
1093 #endif
1094
1095 static int get_info(struct net *net, void __user *user,
1096                     const int *len, int compat)
1097 {
1098         char name[XT_TABLE_MAXNAMELEN];
1099         struct xt_table *t;
1100         int ret;
1101
1102         if (*len != sizeof(struct ip6t_getinfo)) {
1103                 duprintf("length %u != %zu\n", *len,
1104                          sizeof(struct ip6t_getinfo));
1105                 return -EINVAL;
1106         }
1107
1108         if (copy_from_user(name, user, sizeof(name)) != 0)
1109                 return -EFAULT;
1110
1111         name[XT_TABLE_MAXNAMELEN-1] = '\0';
1112 #ifdef CONFIG_COMPAT
1113         if (compat)
1114                 xt_compat_lock(AF_INET6);
1115 #endif
1116         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1117                                     "ip6table_%s", name);
1118         if (!IS_ERR_OR_NULL(t)) {
1119                 struct ip6t_getinfo info;
1120                 const struct xt_table_info *private = t->private;
1121 #ifdef CONFIG_COMPAT
1122                 struct xt_table_info tmp;
1123
1124                 if (compat) {
1125                         ret = compat_table_info(private, &tmp);
1126                         xt_compat_flush_offsets(AF_INET6);
1127                         private = &tmp;
1128                 }
1129 #endif
1130                 memset(&info, 0, sizeof(info));
1131                 info.valid_hooks = t->valid_hooks;
1132                 memcpy(info.hook_entry, private->hook_entry,
1133                        sizeof(info.hook_entry));
1134                 memcpy(info.underflow, private->underflow,
1135                        sizeof(info.underflow));
1136                 info.num_entries = private->number;
1137                 info.size = private->size;
1138                 strcpy(info.name, name);
1139
1140                 if (copy_to_user(user, &info, *len) != 0)
1141                         ret = -EFAULT;
1142                 else
1143                         ret = 0;
1144
1145                 xt_table_unlock(t);
1146                 module_put(t->me);
1147         } else
1148                 ret = t ? PTR_ERR(t) : -ENOENT;
1149 #ifdef CONFIG_COMPAT
1150         if (compat)
1151                 xt_compat_unlock(AF_INET6);
1152 #endif
1153         return ret;
1154 }
1155
1156 static int
1157 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1158             const int *len)
1159 {
1160         int ret;
1161         struct ip6t_get_entries get;
1162         struct xt_table *t;
1163
1164         if (*len < sizeof(get)) {
1165                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1166                 return -EINVAL;
1167         }
1168         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1169                 return -EFAULT;
1170         if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1171                 duprintf("get_entries: %u != %zu\n",
1172                          *len, sizeof(get) + get.size);
1173                 return -EINVAL;
1174         }
1175
1176         t = xt_find_table_lock(net, AF_INET6, get.name);
1177         if (!IS_ERR_OR_NULL(t)) {
1178                 struct xt_table_info *private = t->private;
1179                 duprintf("t->private->number = %u\n", private->number);
1180                 if (get.size == private->size)
1181                         ret = copy_entries_to_user(private->size,
1182                                                    t, uptr->entrytable);
1183                 else {
1184                         duprintf("get_entries: I've got %u not %u!\n",
1185                                  private->size, get.size);
1186                         ret = -EAGAIN;
1187                 }
1188                 module_put(t->me);
1189                 xt_table_unlock(t);
1190         } else
1191                 ret = t ? PTR_ERR(t) : -ENOENT;
1192
1193         return ret;
1194 }
1195
1196 static int
1197 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1198              struct xt_table_info *newinfo, unsigned int num_counters,
1199              void __user *counters_ptr)
1200 {
1201         int ret;
1202         struct xt_table *t;
1203         struct xt_table_info *oldinfo;
1204         struct xt_counters *counters;
1205         struct ip6t_entry *iter;
1206
1207         ret = 0;
1208         counters = vzalloc(num_counters * sizeof(struct xt_counters));
1209         if (!counters) {
1210                 ret = -ENOMEM;
1211                 goto out;
1212         }
1213
1214         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1215                                     "ip6table_%s", name);
1216         if (IS_ERR_OR_NULL(t)) {
1217                 ret = t ? PTR_ERR(t) : -ENOENT;
1218                 goto free_newinfo_counters_untrans;
1219         }
1220
1221         /* You lied! */
1222         if (valid_hooks != t->valid_hooks) {
1223                 duprintf("Valid hook crap: %08X vs %08X\n",
1224                          valid_hooks, t->valid_hooks);
1225                 ret = -EINVAL;
1226                 goto put_module;
1227         }
1228
1229         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1230         if (!oldinfo)
1231                 goto put_module;
1232
1233         /* Update module usage count based on number of rules */
1234         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1235                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1236         if ((oldinfo->number > oldinfo->initial_entries) ||
1237             (newinfo->number <= oldinfo->initial_entries))
1238                 module_put(t->me);
1239         if ((oldinfo->number > oldinfo->initial_entries) &&
1240             (newinfo->number <= oldinfo->initial_entries))
1241                 module_put(t->me);
1242
1243         /* Get the old counters, and synchronize with replace */
1244         get_counters(oldinfo, counters);
1245
1246         /* Decrease module usage counts and free resource */
1247         xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1248                 cleanup_entry(iter, net);
1249
1250         xt_free_table_info(oldinfo);
1251         if (copy_to_user(counters_ptr, counters,
1252                          sizeof(struct xt_counters) * num_counters) != 0) {
1253                 /* Silent error, can't fail, new table is already in place */
1254                 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1255         }
1256         vfree(counters);
1257         xt_table_unlock(t);
1258         return ret;
1259
1260  put_module:
1261         module_put(t->me);
1262         xt_table_unlock(t);
1263  free_newinfo_counters_untrans:
1264         vfree(counters);
1265  out:
1266         return ret;
1267 }
1268
1269 static int
1270 do_replace(struct net *net, const void __user *user, unsigned int len)
1271 {
1272         int ret;
1273         struct ip6t_replace tmp;
1274         struct xt_table_info *newinfo;
1275         void *loc_cpu_entry;
1276         struct ip6t_entry *iter;
1277
1278         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1279                 return -EFAULT;
1280
1281         /* overflow check */
1282         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1283                 return -ENOMEM;
1284         if (tmp.num_counters == 0)
1285                 return -EINVAL;
1286
1287         tmp.name[sizeof(tmp.name)-1] = 0;
1288
1289         newinfo = xt_alloc_table_info(tmp.size);
1290         if (!newinfo)
1291                 return -ENOMEM;
1292
1293         loc_cpu_entry = newinfo->entries;
1294         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1295                            tmp.size) != 0) {
1296                 ret = -EFAULT;
1297                 goto free_newinfo;
1298         }
1299
1300         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1301         if (ret != 0)
1302                 goto free_newinfo;
1303
1304         duprintf("ip_tables: Translated table\n");
1305
1306         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1307                            tmp.num_counters, tmp.counters);
1308         if (ret)
1309                 goto free_newinfo_untrans;
1310         return 0;
1311
1312  free_newinfo_untrans:
1313         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1314                 cleanup_entry(iter, net);
1315  free_newinfo:
1316         xt_free_table_info(newinfo);
1317         return ret;
1318 }
1319
1320 static int
1321 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1322                 int compat)
1323 {
1324         unsigned int i;
1325         struct xt_counters_info tmp;
1326         struct xt_counters *paddc;
1327         unsigned int num_counters;
1328         char *name;
1329         int size;
1330         void *ptmp;
1331         struct xt_table *t;
1332         const struct xt_table_info *private;
1333         int ret = 0;
1334         struct ip6t_entry *iter;
1335         unsigned int addend;
1336 #ifdef CONFIG_COMPAT
1337         struct compat_xt_counters_info compat_tmp;
1338
1339         if (compat) {
1340                 ptmp = &compat_tmp;
1341                 size = sizeof(struct compat_xt_counters_info);
1342         } else
1343 #endif
1344         {
1345                 ptmp = &tmp;
1346                 size = sizeof(struct xt_counters_info);
1347         }
1348
1349         if (copy_from_user(ptmp, user, size) != 0)
1350                 return -EFAULT;
1351
1352 #ifdef CONFIG_COMPAT
1353         if (compat) {
1354                 num_counters = compat_tmp.num_counters;
1355                 name = compat_tmp.name;
1356         } else
1357 #endif
1358         {
1359                 num_counters = tmp.num_counters;
1360                 name = tmp.name;
1361         }
1362
1363         if (len != size + num_counters * sizeof(struct xt_counters))
1364                 return -EINVAL;
1365
1366         paddc = vmalloc(len - size);
1367         if (!paddc)
1368                 return -ENOMEM;
1369
1370         if (copy_from_user(paddc, user + size, len - size) != 0) {
1371                 ret = -EFAULT;
1372                 goto free;
1373         }
1374
1375         t = xt_find_table_lock(net, AF_INET6, name);
1376         if (IS_ERR_OR_NULL(t)) {
1377                 ret = t ? PTR_ERR(t) : -ENOENT;
1378                 goto free;
1379         }
1380
1381         local_bh_disable();
1382         private = t->private;
1383         if (private->number != num_counters) {
1384                 ret = -EINVAL;
1385                 goto unlock_up_free;
1386         }
1387
1388         i = 0;
1389         addend = xt_write_recseq_begin();
1390         xt_entry_foreach(iter, private->entries, private->size) {
1391                 struct xt_counters *tmp;
1392
1393                 tmp = xt_get_this_cpu_counter(&iter->counters);
1394                 ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1395                 ++i;
1396         }
1397         xt_write_recseq_end(addend);
1398  unlock_up_free:
1399         local_bh_enable();
1400         xt_table_unlock(t);
1401         module_put(t->me);
1402  free:
1403         vfree(paddc);
1404
1405         return ret;
1406 }
1407
1408 #ifdef CONFIG_COMPAT
1409 struct compat_ip6t_replace {
1410         char                    name[XT_TABLE_MAXNAMELEN];
1411         u32                     valid_hooks;
1412         u32                     num_entries;
1413         u32                     size;
1414         u32                     hook_entry[NF_INET_NUMHOOKS];
1415         u32                     underflow[NF_INET_NUMHOOKS];
1416         u32                     num_counters;
1417         compat_uptr_t           counters;       /* struct xt_counters * */
1418         struct compat_ip6t_entry entries[0];
1419 };
1420
1421 static int
1422 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1423                           unsigned int *size, struct xt_counters *counters,
1424                           unsigned int i)
1425 {
1426         struct xt_entry_target *t;
1427         struct compat_ip6t_entry __user *ce;
1428         u_int16_t target_offset, next_offset;
1429         compat_uint_t origsize;
1430         const struct xt_entry_match *ematch;
1431         int ret = 0;
1432
1433         origsize = *size;
1434         ce = (struct compat_ip6t_entry __user *)*dstptr;
1435         if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1436             copy_to_user(&ce->counters, &counters[i],
1437             sizeof(counters[i])) != 0)
1438                 return -EFAULT;
1439
1440         *dstptr += sizeof(struct compat_ip6t_entry);
1441         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1442
1443         xt_ematch_foreach(ematch, e) {
1444                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1445                 if (ret != 0)
1446                         return ret;
1447         }
1448         target_offset = e->target_offset - (origsize - *size);
1449         t = ip6t_get_target(e);
1450         ret = xt_compat_target_to_user(t, dstptr, size);
1451         if (ret)
1452                 return ret;
1453         next_offset = e->next_offset - (origsize - *size);
1454         if (put_user(target_offset, &ce->target_offset) != 0 ||
1455             put_user(next_offset, &ce->next_offset) != 0)
1456                 return -EFAULT;
1457         return 0;
1458 }
1459
1460 static int
1461 compat_find_calc_match(struct xt_entry_match *m,
1462                        const char *name,
1463                        const struct ip6t_ip6 *ipv6,
1464                        int *size)
1465 {
1466         struct xt_match *match;
1467
1468         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1469                                       m->u.user.revision);
1470         if (IS_ERR(match)) {
1471                 duprintf("compat_check_calc_match: `%s' not found\n",
1472                          m->u.user.name);
1473                 return PTR_ERR(match);
1474         }
1475         m->u.kernel.match = match;
1476         *size += xt_compat_match_offset(match);
1477         return 0;
1478 }
1479
1480 static void compat_release_entry(struct compat_ip6t_entry *e)
1481 {
1482         struct xt_entry_target *t;
1483         struct xt_entry_match *ematch;
1484
1485         /* Cleanup all matches */
1486         xt_ematch_foreach(ematch, e)
1487                 module_put(ematch->u.kernel.match->me);
1488         t = compat_ip6t_get_target(e);
1489         module_put(t->u.kernel.target->me);
1490 }
1491
1492 static int
1493 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1494                                   struct xt_table_info *newinfo,
1495                                   unsigned int *size,
1496                                   const unsigned char *base,
1497                                   const unsigned char *limit,
1498                                   const unsigned int *hook_entries,
1499                                   const unsigned int *underflows,
1500                                   const char *name)
1501 {
1502         struct xt_entry_match *ematch;
1503         struct xt_entry_target *t;
1504         struct xt_target *target;
1505         unsigned int entry_offset;
1506         unsigned int j;
1507         int ret, off, h;
1508
1509         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1510         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1511             (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
1512             (unsigned char *)e + e->next_offset > limit) {
1513                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1514                 return -EINVAL;
1515         }
1516
1517         if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1518                              sizeof(struct compat_xt_entry_target)) {
1519                 duprintf("checking: element %p size %u\n",
1520                          e, e->next_offset);
1521                 return -EINVAL;
1522         }
1523
1524         /* For purposes of check_entry casting the compat entry is fine */
1525         ret = check_entry((struct ip6t_entry *)e);
1526         if (ret)
1527                 return ret;
1528
1529         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1530         entry_offset = (void *)e - (void *)base;
1531         j = 0;
1532         xt_ematch_foreach(ematch, e) {
1533                 ret = compat_find_calc_match(ematch, name, &e->ipv6, &off);
1534                 if (ret != 0)
1535                         goto release_matches;
1536                 ++j;
1537         }
1538
1539         t = compat_ip6t_get_target(e);
1540         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1541                                         t->u.user.revision);
1542         if (IS_ERR(target)) {
1543                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1544                          t->u.user.name);
1545                 ret = PTR_ERR(target);
1546                 goto release_matches;
1547         }
1548         t->u.kernel.target = target;
1549
1550         off += xt_compat_target_offset(target);
1551         *size += off;
1552         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1553         if (ret)
1554                 goto out;
1555
1556         /* Check hooks & underflows */
1557         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1558                 if ((unsigned char *)e - base == hook_entries[h])
1559                         newinfo->hook_entry[h] = hook_entries[h];
1560                 if ((unsigned char *)e - base == underflows[h])
1561                         newinfo->underflow[h] = underflows[h];
1562         }
1563
1564         /* Clear counters and comefrom */
1565         memset(&e->counters, 0, sizeof(e->counters));
1566         e->comefrom = 0;
1567         return 0;
1568
1569 out:
1570         module_put(t->u.kernel.target->me);
1571 release_matches:
1572         xt_ematch_foreach(ematch, e) {
1573                 if (j-- == 0)
1574                         break;
1575                 module_put(ematch->u.kernel.match->me);
1576         }
1577         return ret;
1578 }
1579
1580 static int
1581 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1582                             unsigned int *size, const char *name,
1583                             struct xt_table_info *newinfo, unsigned char *base)
1584 {
1585         struct xt_entry_target *t;
1586         struct ip6t_entry *de;
1587         unsigned int origsize;
1588         int ret, h;
1589         struct xt_entry_match *ematch;
1590
1591         ret = 0;
1592         origsize = *size;
1593         de = (struct ip6t_entry *)*dstptr;
1594         memcpy(de, e, sizeof(struct ip6t_entry));
1595         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1596
1597         *dstptr += sizeof(struct ip6t_entry);
1598         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1599
1600         xt_ematch_foreach(ematch, e) {
1601                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1602                 if (ret != 0)
1603                         return ret;
1604         }
1605         de->target_offset = e->target_offset - (origsize - *size);
1606         t = compat_ip6t_get_target(e);
1607         xt_compat_target_from_user(t, dstptr, size);
1608
1609         de->next_offset = e->next_offset - (origsize - *size);
1610         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1611                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1612                         newinfo->hook_entry[h] -= origsize - *size;
1613                 if ((unsigned char *)de - base < newinfo->underflow[h])
1614                         newinfo->underflow[h] -= origsize - *size;
1615         }
1616         return ret;
1617 }
1618
1619 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1620                               const char *name)
1621 {
1622         unsigned int j;
1623         int ret = 0;
1624         struct xt_mtchk_param mtpar;
1625         struct xt_entry_match *ematch;
1626
1627         e->counters.pcnt = xt_percpu_counter_alloc();
1628         if (IS_ERR_VALUE(e->counters.pcnt))
1629                 return -ENOMEM;
1630         j = 0;
1631         mtpar.net       = net;
1632         mtpar.table     = name;
1633         mtpar.entryinfo = &e->ipv6;
1634         mtpar.hook_mask = e->comefrom;
1635         mtpar.family    = NFPROTO_IPV6;
1636         xt_ematch_foreach(ematch, e) {
1637                 ret = check_match(ematch, &mtpar);
1638                 if (ret != 0)
1639                         goto cleanup_matches;
1640                 ++j;
1641         }
1642
1643         ret = check_target(e, net, name);
1644         if (ret)
1645                 goto cleanup_matches;
1646         return 0;
1647
1648  cleanup_matches:
1649         xt_ematch_foreach(ematch, e) {
1650                 if (j-- == 0)
1651                         break;
1652                 cleanup_match(ematch, net);
1653         }
1654
1655         xt_percpu_counter_free(e->counters.pcnt);
1656
1657         return ret;
1658 }
1659
1660 static int
1661 translate_compat_table(struct net *net,
1662                        const char *name,
1663                        unsigned int valid_hooks,
1664                        struct xt_table_info **pinfo,
1665                        void **pentry0,
1666                        unsigned int total_size,
1667                        unsigned int number,
1668                        unsigned int *hook_entries,
1669                        unsigned int *underflows)
1670 {
1671         unsigned int i, j;
1672         struct xt_table_info *newinfo, *info;
1673         void *pos, *entry0, *entry1;
1674         struct compat_ip6t_entry *iter0;
1675         struct ip6t_entry *iter1;
1676         unsigned int size;
1677         int ret = 0;
1678
1679         info = *pinfo;
1680         entry0 = *pentry0;
1681         size = total_size;
1682         info->number = number;
1683
1684         /* Init all hooks to impossible value. */
1685         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1686                 info->hook_entry[i] = 0xFFFFFFFF;
1687                 info->underflow[i] = 0xFFFFFFFF;
1688         }
1689
1690         duprintf("translate_compat_table: size %u\n", info->size);
1691         j = 0;
1692         xt_compat_lock(AF_INET6);
1693         xt_compat_init_offsets(AF_INET6, number);
1694         /* Walk through entries, checking offsets. */
1695         xt_entry_foreach(iter0, entry0, total_size) {
1696                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1697                                                         entry0,
1698                                                         entry0 + total_size,
1699                                                         hook_entries,
1700                                                         underflows,
1701                                                         name);
1702                 if (ret != 0)
1703                         goto out_unlock;
1704                 ++j;
1705         }
1706
1707         ret = -EINVAL;
1708         if (j != number) {
1709                 duprintf("translate_compat_table: %u not %u entries\n",
1710                          j, number);
1711                 goto out_unlock;
1712         }
1713
1714         /* Check hooks all assigned */
1715         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1716                 /* Only hooks which are valid */
1717                 if (!(valid_hooks & (1 << i)))
1718                         continue;
1719                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1720                         duprintf("Invalid hook entry %u %u\n",
1721                                  i, hook_entries[i]);
1722                         goto out_unlock;
1723                 }
1724                 if (info->underflow[i] == 0xFFFFFFFF) {
1725                         duprintf("Invalid underflow %u %u\n",
1726                                  i, underflows[i]);
1727                         goto out_unlock;
1728                 }
1729         }
1730
1731         ret = -ENOMEM;
1732         newinfo = xt_alloc_table_info(size);
1733         if (!newinfo)
1734                 goto out_unlock;
1735
1736         newinfo->number = number;
1737         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1738                 newinfo->hook_entry[i] = info->hook_entry[i];
1739                 newinfo->underflow[i] = info->underflow[i];
1740         }
1741         entry1 = newinfo->entries;
1742         pos = entry1;
1743         size = total_size;
1744         xt_entry_foreach(iter0, entry0, total_size) {
1745                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1746                                                   name, newinfo, entry1);
1747                 if (ret != 0)
1748                         break;
1749         }
1750         xt_compat_flush_offsets(AF_INET6);
1751         xt_compat_unlock(AF_INET6);
1752         if (ret)
1753                 goto free_newinfo;
1754
1755         ret = -ELOOP;
1756         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1757                 goto free_newinfo;
1758
1759         i = 0;
1760         xt_entry_foreach(iter1, entry1, newinfo->size) {
1761                 ret = compat_check_entry(iter1, net, name);
1762                 if (ret != 0)
1763                         break;
1764                 ++i;
1765                 if (strcmp(ip6t_get_target(iter1)->u.user.name,
1766                     XT_ERROR_TARGET) == 0)
1767                         ++newinfo->stacksize;
1768         }
1769         if (ret) {
1770                 /*
1771                  * The first i matches need cleanup_entry (calls ->destroy)
1772                  * because they had called ->check already. The other j-i
1773                  * entries need only release.
1774                  */
1775                 int skip = i;
1776                 j -= i;
1777                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1778                         if (skip-- > 0)
1779                                 continue;
1780                         if (j-- == 0)
1781                                 break;
1782                         compat_release_entry(iter0);
1783                 }
1784                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1785                         if (i-- == 0)
1786                                 break;
1787                         cleanup_entry(iter1, net);
1788                 }
1789                 xt_free_table_info(newinfo);
1790                 return ret;
1791         }
1792
1793         *pinfo = newinfo;
1794         *pentry0 = entry1;
1795         xt_free_table_info(info);
1796         return 0;
1797
1798 free_newinfo:
1799         xt_free_table_info(newinfo);
1800 out:
1801         xt_entry_foreach(iter0, entry0, total_size) {
1802                 if (j-- == 0)
1803                         break;
1804                 compat_release_entry(iter0);
1805         }
1806         return ret;
1807 out_unlock:
1808         xt_compat_flush_offsets(AF_INET6);
1809         xt_compat_unlock(AF_INET6);
1810         goto out;
1811 }
1812
1813 static int
1814 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1815 {
1816         int ret;
1817         struct compat_ip6t_replace tmp;
1818         struct xt_table_info *newinfo;
1819         void *loc_cpu_entry;
1820         struct ip6t_entry *iter;
1821
1822         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1823                 return -EFAULT;
1824
1825         /* overflow check */
1826         if (tmp.size >= INT_MAX / num_possible_cpus())
1827                 return -ENOMEM;
1828         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1829                 return -ENOMEM;
1830         if (tmp.num_counters == 0)
1831                 return -EINVAL;
1832
1833         tmp.name[sizeof(tmp.name)-1] = 0;
1834
1835         newinfo = xt_alloc_table_info(tmp.size);
1836         if (!newinfo)
1837                 return -ENOMEM;
1838
1839         loc_cpu_entry = newinfo->entries;
1840         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1841                            tmp.size) != 0) {
1842                 ret = -EFAULT;
1843                 goto free_newinfo;
1844         }
1845
1846         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1847                                      &newinfo, &loc_cpu_entry, tmp.size,
1848                                      tmp.num_entries, tmp.hook_entry,
1849                                      tmp.underflow);
1850         if (ret != 0)
1851                 goto free_newinfo;
1852
1853         duprintf("compat_do_replace: Translated table\n");
1854
1855         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1856                            tmp.num_counters, compat_ptr(tmp.counters));
1857         if (ret)
1858                 goto free_newinfo_untrans;
1859         return 0;
1860
1861  free_newinfo_untrans:
1862         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1863                 cleanup_entry(iter, net);
1864  free_newinfo:
1865         xt_free_table_info(newinfo);
1866         return ret;
1867 }
1868
1869 static int
1870 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1871                        unsigned int len)
1872 {
1873         int ret;
1874
1875         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1876                 return -EPERM;
1877
1878         switch (cmd) {
1879         case IP6T_SO_SET_REPLACE:
1880                 ret = compat_do_replace(sock_net(sk), user, len);
1881                 break;
1882
1883         case IP6T_SO_SET_ADD_COUNTERS:
1884                 ret = do_add_counters(sock_net(sk), user, len, 1);
1885                 break;
1886
1887         default:
1888                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1889                 ret = -EINVAL;
1890         }
1891
1892         return ret;
1893 }
1894
1895 struct compat_ip6t_get_entries {
1896         char name[XT_TABLE_MAXNAMELEN];
1897         compat_uint_t size;
1898         struct compat_ip6t_entry entrytable[0];
1899 };
1900
1901 static int
1902 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1903                             void __user *userptr)
1904 {
1905         struct xt_counters *counters;
1906         const struct xt_table_info *private = table->private;
1907         void __user *pos;
1908         unsigned int size;
1909         int ret = 0;
1910         unsigned int i = 0;
1911         struct ip6t_entry *iter;
1912
1913         counters = alloc_counters(table);
1914         if (IS_ERR(counters))
1915                 return PTR_ERR(counters);
1916
1917         pos = userptr;
1918         size = total_size;
1919         xt_entry_foreach(iter, private->entries, total_size) {
1920                 ret = compat_copy_entry_to_user(iter, &pos,
1921                                                 &size, counters, i++);
1922                 if (ret != 0)
1923                         break;
1924         }
1925
1926         vfree(counters);
1927         return ret;
1928 }
1929
1930 static int
1931 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1932                    int *len)
1933 {
1934         int ret;
1935         struct compat_ip6t_get_entries get;
1936         struct xt_table *t;
1937
1938         if (*len < sizeof(get)) {
1939                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1940                 return -EINVAL;
1941         }
1942
1943         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1944                 return -EFAULT;
1945
1946         if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1947                 duprintf("compat_get_entries: %u != %zu\n",
1948                          *len, sizeof(get) + get.size);
1949                 return -EINVAL;
1950         }
1951
1952         xt_compat_lock(AF_INET6);
1953         t = xt_find_table_lock(net, AF_INET6, get.name);
1954         if (!IS_ERR_OR_NULL(t)) {
1955                 const struct xt_table_info *private = t->private;
1956                 struct xt_table_info info;
1957                 duprintf("t->private->number = %u\n", private->number);
1958                 ret = compat_table_info(private, &info);
1959                 if (!ret && get.size == info.size) {
1960                         ret = compat_copy_entries_to_user(private->size,
1961                                                           t, uptr->entrytable);
1962                 } else if (!ret) {
1963                         duprintf("compat_get_entries: I've got %u not %u!\n",
1964                                  private->size, get.size);
1965                         ret = -EAGAIN;
1966                 }
1967                 xt_compat_flush_offsets(AF_INET6);
1968                 module_put(t->me);
1969                 xt_table_unlock(t);
1970         } else
1971                 ret = t ? PTR_ERR(t) : -ENOENT;
1972
1973         xt_compat_unlock(AF_INET6);
1974         return ret;
1975 }
1976
1977 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1978
1979 static int
1980 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1981 {
1982         int ret;
1983
1984         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1985                 return -EPERM;
1986
1987         switch (cmd) {
1988         case IP6T_SO_GET_INFO:
1989                 ret = get_info(sock_net(sk), user, len, 1);
1990                 break;
1991         case IP6T_SO_GET_ENTRIES:
1992                 ret = compat_get_entries(sock_net(sk), user, len);
1993                 break;
1994         default:
1995                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
1996         }
1997         return ret;
1998 }
1999 #endif
2000
2001 static int
2002 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2003 {
2004         int ret;
2005
2006         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2007                 return -EPERM;
2008
2009         switch (cmd) {
2010         case IP6T_SO_SET_REPLACE:
2011                 ret = do_replace(sock_net(sk), user, len);
2012                 break;
2013
2014         case IP6T_SO_SET_ADD_COUNTERS:
2015                 ret = do_add_counters(sock_net(sk), user, len, 0);
2016                 break;
2017
2018         default:
2019                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
2020                 ret = -EINVAL;
2021         }
2022
2023         return ret;
2024 }
2025
2026 static int
2027 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2028 {
2029         int ret;
2030
2031         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2032                 return -EPERM;
2033
2034         switch (cmd) {
2035         case IP6T_SO_GET_INFO:
2036                 ret = get_info(sock_net(sk), user, len, 0);
2037                 break;
2038
2039         case IP6T_SO_GET_ENTRIES:
2040                 ret = get_entries(sock_net(sk), user, len);
2041                 break;
2042
2043         case IP6T_SO_GET_REVISION_MATCH:
2044         case IP6T_SO_GET_REVISION_TARGET: {
2045                 struct xt_get_revision rev;
2046                 int target;
2047
2048                 if (*len != sizeof(rev)) {
2049                         ret = -EINVAL;
2050                         break;
2051                 }
2052                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2053                         ret = -EFAULT;
2054                         break;
2055                 }
2056                 rev.name[sizeof(rev.name)-1] = 0;
2057
2058                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2059                         target = 1;
2060                 else
2061                         target = 0;
2062
2063                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2064                                                          rev.revision,
2065                                                          target, &ret),
2066                                         "ip6t_%s", rev.name);
2067                 break;
2068         }
2069
2070         default:
2071                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2072                 ret = -EINVAL;
2073         }
2074
2075         return ret;
2076 }
2077
2078 struct xt_table *ip6t_register_table(struct net *net,
2079                                      const struct xt_table *table,
2080                                      const struct ip6t_replace *repl)
2081 {
2082         int ret;
2083         struct xt_table_info *newinfo;
2084         struct xt_table_info bootstrap = {0};
2085         void *loc_cpu_entry;
2086         struct xt_table *new_table;
2087
2088         newinfo = xt_alloc_table_info(repl->size);
2089         if (!newinfo) {
2090                 ret = -ENOMEM;
2091                 goto out;
2092         }
2093
2094         loc_cpu_entry = newinfo->entries;
2095         memcpy(loc_cpu_entry, repl->entries, repl->size);
2096
2097         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2098         if (ret != 0)
2099                 goto out_free;
2100
2101         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2102         if (IS_ERR(new_table)) {
2103                 ret = PTR_ERR(new_table);
2104                 goto out_free;
2105         }
2106         return new_table;
2107
2108 out_free:
2109         xt_free_table_info(newinfo);
2110 out:
2111         return ERR_PTR(ret);
2112 }
2113
2114 void ip6t_unregister_table(struct net *net, struct xt_table *table)
2115 {
2116         struct xt_table_info *private;
2117         void *loc_cpu_entry;
2118         struct module *table_owner = table->me;
2119         struct ip6t_entry *iter;
2120
2121         private = xt_unregister_table(table);
2122
2123         /* Decrease module usage counts and free resources */
2124         loc_cpu_entry = private->entries;
2125         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2126                 cleanup_entry(iter, net);
2127         if (private->number > private->initial_entries)
2128                 module_put(table_owner);
2129         xt_free_table_info(private);
2130 }
2131
2132 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2133 static inline bool
2134 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2135                      u_int8_t type, u_int8_t code,
2136                      bool invert)
2137 {
2138         return (type == test_type && code >= min_code && code <= max_code)
2139                 ^ invert;
2140 }
2141
2142 static bool
2143 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
2144 {
2145         const struct icmp6hdr *ic;
2146         struct icmp6hdr _icmph;
2147         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2148
2149         /* Must not be a fragment. */
2150         if (par->fragoff != 0)
2151                 return false;
2152
2153         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2154         if (ic == NULL) {
2155                 /* We've been asked to examine this packet, and we
2156                  * can't.  Hence, no choice but to drop.
2157                  */
2158                 duprintf("Dropping evil ICMP tinygram.\n");
2159                 par->hotdrop = true;
2160                 return false;
2161         }
2162
2163         return icmp6_type_code_match(icmpinfo->type,
2164                                      icmpinfo->code[0],
2165                                      icmpinfo->code[1],
2166                                      ic->icmp6_type, ic->icmp6_code,
2167                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
2168 }
2169
2170 /* Called when user tries to insert an entry of this type. */
2171 static int icmp6_checkentry(const struct xt_mtchk_param *par)
2172 {
2173         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2174
2175         /* Must specify no unknown invflags */
2176         return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
2177 }
2178
2179 /* The built-in targets: standard (NULL) and error. */
2180 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
2181         {
2182                 .name             = XT_STANDARD_TARGET,
2183                 .targetsize       = sizeof(int),
2184                 .family           = NFPROTO_IPV6,
2185 #ifdef CONFIG_COMPAT
2186                 .compatsize       = sizeof(compat_int_t),
2187                 .compat_from_user = compat_standard_from_user,
2188                 .compat_to_user   = compat_standard_to_user,
2189 #endif
2190         },
2191         {
2192                 .name             = XT_ERROR_TARGET,
2193                 .target           = ip6t_error,
2194                 .targetsize       = XT_FUNCTION_MAXNAMELEN,
2195                 .family           = NFPROTO_IPV6,
2196         },
2197 };
2198
2199 static struct nf_sockopt_ops ip6t_sockopts = {
2200         .pf             = PF_INET6,
2201         .set_optmin     = IP6T_BASE_CTL,
2202         .set_optmax     = IP6T_SO_SET_MAX+1,
2203         .set            = do_ip6t_set_ctl,
2204 #ifdef CONFIG_COMPAT
2205         .compat_set     = compat_do_ip6t_set_ctl,
2206 #endif
2207         .get_optmin     = IP6T_BASE_CTL,
2208         .get_optmax     = IP6T_SO_GET_MAX+1,
2209         .get            = do_ip6t_get_ctl,
2210 #ifdef CONFIG_COMPAT
2211         .compat_get     = compat_do_ip6t_get_ctl,
2212 #endif
2213         .owner          = THIS_MODULE,
2214 };
2215
2216 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
2217         {
2218                 .name       = "icmp6",
2219                 .match      = icmp6_match,
2220                 .matchsize  = sizeof(struct ip6t_icmp),
2221                 .checkentry = icmp6_checkentry,
2222                 .proto      = IPPROTO_ICMPV6,
2223                 .family     = NFPROTO_IPV6,
2224         },
2225 };
2226
2227 static int __net_init ip6_tables_net_init(struct net *net)
2228 {
2229         return xt_proto_init(net, NFPROTO_IPV6);
2230 }
2231
2232 static void __net_exit ip6_tables_net_exit(struct net *net)
2233 {
2234         xt_proto_fini(net, NFPROTO_IPV6);
2235 }
2236
2237 static struct pernet_operations ip6_tables_net_ops = {
2238         .init = ip6_tables_net_init,
2239         .exit = ip6_tables_net_exit,
2240 };
2241
2242 static int __init ip6_tables_init(void)
2243 {
2244         int ret;
2245
2246         ret = register_pernet_subsys(&ip6_tables_net_ops);
2247         if (ret < 0)
2248                 goto err1;
2249
2250         /* No one else will be downing sem now, so we won't sleep */
2251         ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2252         if (ret < 0)
2253                 goto err2;
2254         ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2255         if (ret < 0)
2256                 goto err4;
2257
2258         /* Register setsockopt */
2259         ret = nf_register_sockopt(&ip6t_sockopts);
2260         if (ret < 0)
2261                 goto err5;
2262
2263         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2264         return 0;
2265
2266 err5:
2267         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2268 err4:
2269         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2270 err2:
2271         unregister_pernet_subsys(&ip6_tables_net_ops);
2272 err1:
2273         return ret;
2274 }
2275
2276 static void __exit ip6_tables_fini(void)
2277 {
2278         nf_unregister_sockopt(&ip6t_sockopts);
2279
2280         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2281         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2282         unregister_pernet_subsys(&ip6_tables_net_ops);
2283 }
2284
2285 EXPORT_SYMBOL(ip6t_register_table);
2286 EXPORT_SYMBOL(ip6t_unregister_table);
2287 EXPORT_SYMBOL(ip6t_do_table);
2288
2289 module_init(ip6_tables_init);
2290 module_exit(ip6_tables_fini);