net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14
  15 #include <linux/kernel.h>
  16 #include <linux/capability.h>
  17 #include <linux/in.h>
  18 #include <linux/skbuff.h>
  19 #include <linux/kmod.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netdevice.h>
  22 #include <linux/module.h>
  23 #include <linux/poison.h>
  24 #include <linux/icmpv6.h>
  25 #include <net/ipv6.h>
  26 #include <net/compat.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/mutex.h>
  29 #include <linux/proc_fs.h>
  30 #include <linux/err.h>
  31 #include <linux/cpumask.h>
  32
  33 #include <linux/netfilter_ipv6/ip6_tables.h>
  34 #include <linux/netfilter/x_tables.h>
  35 #include <net/netfilter/nf_log.h>
  36 #include "../../netfilter/xt_repldata.h"
  37
  38 MODULE_LICENSE("GPL");
  39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  40 MODULE_DESCRIPTION("IPv6 packet filter");
  41
  42 /*#define DEBUG_IP_FIREWALL*/
  43 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  44 /*#define DEBUG_IP_FIREWALL_USER*/
  45
  46 #ifdef DEBUG_IP_FIREWALL
  47 #define dprintf(format, args...) pr_info(format , ## args)
  48 #else
  49 #define dprintf(format, args...)
  50 #endif
  51
  52 #ifdef DEBUG_IP_FIREWALL_USER
  53 #define duprintf(format, args...) pr_info(format , ## args)
  54 #else
  55 #define duprintf(format, args...)
  56 #endif
  57
  58 #ifdef CONFIG_NETFILTER_DEBUG
  59 #define IP_NF_ASSERT(x) WARN_ON(!(x))
  60 #else
  61 #define IP_NF_ASSERT(x)
  62 #endif
  63
  64 #if 0
  65 /* All the better to debug you with... */
  66 #define static
  67 #define inline
  68 #endif
  69
  70 void *ip6t_alloc_initial_table(const struct xt_table *info)
  71 {
  72         return xt_alloc_initial_table(ip6t, IP6T);
  73 }
  74 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
  75
  76 /*
  77    We keep a set of rules for each CPU, so we can avoid write-locking
  78    them in the softirq when updating the counters and therefore
  79    only need to read-lock in the softirq; doing a write_lock_bh() in user
  80    context stops packets coming through and allows user context to read
  81    the counters or update the rules.
  82
  83    Hence the start of any table is given by get_table() below.  */
  84
  85 /* Returns whether matches rule or not. */
  86 /* Performance critical - called for every packet */
  87 static inline bool
  88 ip6_packet_match(const struct sk_buff *skb,
  89                  const char *indev,
  90                  const char *outdev,
  91                  const struct ip6t_ip6 *ip6info,
  92                  unsigned int *protoff,
  93                  int *fragoff, bool *hotdrop)
  94 {
  95         unsigned long ret;
  96         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
  97
  98 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
  99
 100         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 101                                        &ip6info->src), IP6T_INV_SRCIP) ||
 102             FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 103                                        &ip6info->dst), IP6T_INV_DSTIP)) {
 104                 dprintf("Source or dest mismatch.\n");
 105 /*
 106                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 107                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 108                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 109                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 110                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 111                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 112                 return false;
 113         }
 114
 115         ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 116
 117         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 118                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 119                         indev, ip6info->iniface,
 120                         ip6info->invflags & IP6T_INV_VIA_IN ? " (INV)" : "");
 121                 return false;
 122         }
 123
 124         ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 125
 126         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 127                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 128                         outdev, ip6info->outiface,
 129                         ip6info->invflags & IP6T_INV_VIA_OUT ? " (INV)" : "");
 130                 return false;
 131         }
 132
 133 /* ... might want to do something with class and flowlabel here ... */
 134
 135         /* look for the desired protocol header */
 136         if (ip6info->flags & IP6T_F_PROTO) {
 137                 int protohdr;
 138                 unsigned short _frag_off;
 139
 140                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
 141                 if (protohdr < 0) {
 142                         if (_frag_off == 0)
 143                                 *hotdrop = true;
 144                         return false;
 145                 }
 146                 *fragoff = _frag_off;
 147
 148                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 149                                 protohdr,
 150                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 151                                 ip6info->proto);
 152
 153                 if (ip6info->proto == protohdr) {
 154                         if (ip6info->invflags & IP6T_INV_PROTO)
 155                                 return false;
 156
 157                         return true;
 158                 }
 159
 160                 /* We need match for the '-p all', too! */
 161                 if ((ip6info->proto != 0) &&
 162                         !(ip6info->invflags & IP6T_INV_PROTO))
 163                         return false;
 164         }
 165         return true;
 166 }
 167
 168 /* should be ip6 safe */
 169 static bool
 170 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 171 {
 172         if (ipv6->flags & ~IP6T_F_MASK) {
 173                 duprintf("Unknown flag bits set: %08X\n",
 174                          ipv6->flags & ~IP6T_F_MASK);
 175                 return false;
 176         }
 177         if (ipv6->invflags & ~IP6T_INV_MASK) {
 178                 duprintf("Unknown invflag bits set: %08X\n",
 179                          ipv6->invflags & ~IP6T_INV_MASK);
 180                 return false;
 181         }
 182         return true;
 183 }
 184
 185 static unsigned int
 186 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
 187 {
 188         net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
 189
 190         return NF_DROP;
 191 }
 192
 193 static inline struct ip6t_entry *
 194 get_entry(const void *base, unsigned int offset)
 195 {
 196         return (struct ip6t_entry *)(base + offset);
 197 }
 198
 199 /* All zeroes == unconditional rule. */
 200 /* Mildly perf critical (only if packet tracing is on) */
 201 static inline bool unconditional(const struct ip6t_entry *e)
 202 {
 203         static const struct ip6t_ip6 uncond;
 204
 205         return e->target_offset == sizeof(struct ip6t_entry) &&
 206                memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
 207 }
 208
 209 static inline const struct xt_entry_target *
 210 ip6t_get_target_c(const struct ip6t_entry *e)
 211 {
 212         return ip6t_get_target((struct ip6t_entry *)e);
 213 }
 214
 215 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 216 /* This cries for unification! */
 217 static const char *const hooknames[] = {
 218         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 219         [NF_INET_LOCAL_IN]              = "INPUT",
 220         [NF_INET_FORWARD]               = "FORWARD",
 221         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 222         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 223 };
 224
 225 enum nf_ip_trace_comments {
 226         NF_IP6_TRACE_COMMENT_RULE,
 227         NF_IP6_TRACE_COMMENT_RETURN,
 228         NF_IP6_TRACE_COMMENT_POLICY,
 229 };
 230
 231 static const char *const comments[] = {
 232         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
 233         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
 234         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
 235 };
 236
 237 static struct nf_loginfo trace_loginfo = {
 238         .type = NF_LOG_TYPE_LOG,
 239         .u = {
 240                 .log = {
 241                         .level = LOGLEVEL_WARNING,
 242                         .logflags = NF_LOG_MASK,
 243                 },
 244         },
 245 };
 246
 247 /* Mildly perf critical (only if packet tracing is on) */
 248 static inline int
 249 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
 250                       const char *hookname, const char **chainname,
 251                       const char **comment, unsigned int *rulenum)
 252 {
 253         const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
 254
 255         if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
 256                 /* Head of user chain: ERROR target with chainname */
 257                 *chainname = t->target.data;
 258                 (*rulenum) = 0;
 259         } else if (s == e) {
 260                 (*rulenum)++;
 261
 262                 if (unconditional(s) &&
 263                     strcmp(t->target.u.kernel.target->name,
 264                            XT_STANDARD_TARGET) == 0 &&
 265                     t->verdict < 0) {
 266                         /* Tail of chains: STANDARD target (return/policy) */
 267                         *comment = *chainname == hookname
 268                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
 269                                 : comments[NF_IP6_TRACE_COMMENT_RETURN];
 270                 }
 271                 return 1;
 272         } else
 273                 (*rulenum)++;
 274
 275         return 0;
 276 }
 277
 278 static void trace_packet(struct net *net,
 279                          const struct sk_buff *skb,
 280                          unsigned int hook,
 281                          const struct net_device *in,
 282                          const struct net_device *out,
 283                          const char *tablename,
 284                          const struct xt_table_info *private,
 285                          const struct ip6t_entry *e)
 286 {
 287         const struct ip6t_entry *root;
 288         const char *hookname, *chainname, *comment;
 289         const struct ip6t_entry *iter;
 290         unsigned int rulenum = 0;
 291
 292         root = get_entry(private->entries, private->hook_entry[hook]);
 293
 294         hookname = chainname = hooknames[hook];
 295         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 296
 297         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 298                 if (get_chainname_rulenum(iter, e, hookname,
 299                     &chainname, &comment, &rulenum) != 0)
 300                         break;
 301
 302         nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
 303                      "TRACE: %s:%s:%s:%u ",
 304                      tablename, chainname, comment, rulenum);
 305 }
 306 #endif
 307
 308 static inline struct ip6t_entry *
 309 ip6t_next_entry(const struct ip6t_entry *entry)
 310 {
 311         return (void *)entry + entry->next_offset;
 312 }
 313
 314 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 315 unsigned int
 316 ip6t_do_table(struct sk_buff *skb,
 317               const struct nf_hook_state *state,
 318               struct xt_table *table)
 319 {
 320         unsigned int hook = state->hook;
 321         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 322         /* Initializing verdict to NF_DROP keeps gcc happy. */
 323         unsigned int verdict = NF_DROP;
 324         const char *indev, *outdev;
 325         const void *table_base;
 326         struct ip6t_entry *e, **jumpstack;
 327         unsigned int stackidx, cpu;
 328         const struct xt_table_info *private;
 329         struct xt_action_param acpar;
 330         unsigned int addend;
 331
 332         /* Initialization */
 333         stackidx = 0;
 334         indev = state->in ? state->in->name : nulldevname;
 335         outdev = state->out ? state->out->name : nulldevname;
 336         /* We handle fragments by dealing with the first fragment as
 337          * if it was a normal packet.  All other fragments are treated
 338          * normally, except that they will NEVER match rules that ask
 339          * things we don't know, ie. tcp syn flag or ports).  If the
 340          * rule is also a fragment-specific rule, non-fragments won't
 341          * match it. */
 342         acpar.hotdrop = false;
 343         acpar.net     = state->net;
 344         acpar.in      = state->in;
 345         acpar.out     = state->out;
 346         acpar.family  = NFPROTO_IPV6;
 347         acpar.hooknum = hook;
 348
 349         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 350
 351         local_bh_disable();
 352         addend = xt_write_recseq_begin();
 353         private = table->private;
 354         /*
 355          * Ensure we load private-> members after we've fetched the base
 356          * pointer.
 357          */
 358         smp_read_barrier_depends();
 359         cpu        = smp_processor_id();
 360         table_base = private->entries;
 361         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
 362
 363         /* Switch to alternate jumpstack if we're being invoked via TEE.
 364          * TEE issues XT_CONTINUE verdict on original skb so we must not
 365          * clobber the jumpstack.
 366          *
 367          * For recursion via REJECT or SYNPROXY the stack will be clobbered
 368          * but it is no problem since absolute verdict is issued by these.
 369          */
 370         if (static_key_false(&xt_tee_enabled))
 371                 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
 372
 373         e = get_entry(table_base, private->hook_entry[hook]);
 374
 375         do {
 376                 const struct xt_entry_target *t;
 377                 const struct xt_entry_match *ematch;
 378                 struct xt_counters *counter;
 379
 380                 IP_NF_ASSERT(e);
 381                 acpar.thoff = 0;
 382                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
 383                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
 384  no_match:
 385                         e = ip6t_next_entry(e);
 386                         continue;
 387                 }
 388
 389                 xt_ematch_foreach(ematch, e) {
 390                         acpar.match     = ematch->u.kernel.match;
 391                         acpar.matchinfo = ematch->data;
 392                         if (!acpar.match->match(skb, &acpar))
 393                                 goto no_match;
 394                 }
 395
 396                 counter = xt_get_this_cpu_counter(&e->counters);
 397                 ADD_COUNTER(*counter, skb->len, 1);
 398
 399                 t = ip6t_get_target_c(e);
 400                 IP_NF_ASSERT(t->u.kernel.target);
 401
 402 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 403                 /* The packet is traced: log it */
 404                 if (unlikely(skb->nf_trace))
 405                         trace_packet(state->net, skb, hook, state->in,
 406                                      state->out, table->name, private, e);
 407 #endif
 408                 /* Standard target? */
 409                 if (!t->u.kernel.target->target) {
 410                         int v;
 411
 412                         v = ((struct xt_standard_target *)t)->verdict;
 413                         if (v < 0) {
 414                                 /* Pop from stack? */
 415                                 if (v != XT_RETURN) {
 416                                         verdict = (unsigned int)(-v) - 1;
 417                                         break;
 418                                 }
 419                                 if (stackidx == 0)
 420                                         e = get_entry(table_base,
 421                                             private->underflow[hook]);
 422                                 else
 423                                         e = ip6t_next_entry(jumpstack[--stackidx]);
 424                                 continue;
 425                         }
 426                         if (table_base + v != ip6t_next_entry(e) &&
 427                             !(e->ipv6.flags & IP6T_F_GOTO)) {
 428                                 jumpstack[stackidx++] = e;
 429                         }
 430
 431                         e = get_entry(table_base, v);
 432                         continue;
 433                 }
 434
 435                 acpar.target   = t->u.kernel.target;
 436                 acpar.targinfo = t->data;
 437
 438                 verdict = t->u.kernel.target->target(skb, &acpar);
 439                 if (verdict == XT_CONTINUE)
 440                         e = ip6t_next_entry(e);
 441                 else
 442                         /* Verdict */
 443                         break;
 444         } while (!acpar.hotdrop);
 445
 446         xt_write_recseq_end(addend);
 447         local_bh_enable();
 448
 449 #ifdef DEBUG_ALLOW_ALL
 450         return NF_ACCEPT;
 451 #else
 452         if (acpar.hotdrop)
 453                 return NF_DROP;
 454         else return verdict;
 455 #endif
 456 }
 457
 458 static bool find_jump_target(const struct xt_table_info *t,
 459                              const struct ip6t_entry *target)
 460 {
 461         struct ip6t_entry *iter;
 462
 463         xt_entry_foreach(iter, t->entries, t->size) {
 464                  if (iter == target)
 465                         return true;
 466         }
 467         return false;
 468 }
 469
 470 /* Figures out from what hook each rule can be called: returns 0 if
 471    there are loops.  Puts hook bitmask in comefrom. */
 472 static int
 473 mark_source_chains(const struct xt_table_info *newinfo,
 474                    unsigned int valid_hooks, void *entry0)
 475 {
 476         unsigned int hook;
 477
 478         /* No recursion; use packet counter to save back ptrs (reset
 479            to 0 as we leave), and comefrom to save source hook bitmask */
 480         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 481                 unsigned int pos = newinfo->hook_entry[hook];
 482                 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
 483
 484                 if (!(valid_hooks & (1 << hook)))
 485                         continue;
 486
 487                 /* Set initial back pointer. */
 488                 e->counters.pcnt = pos;
 489
 490                 for (;;) {
 491                         const struct xt_standard_target *t
 492                                 = (void *)ip6t_get_target_c(e);
 493                         int visited = e->comefrom & (1 << hook);
 494
 495                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 496                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
 497                                        hook, pos, e->comefrom);
 498                                 return 0;
 499                         }
 500                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 501
 502                         /* Unconditional return/END. */
 503                         if ((unconditional(e) &&
 504                              (strcmp(t->target.u.user.name,
 505                                      XT_STANDARD_TARGET) == 0) &&
 506                              t->verdict < 0) || visited) {
 507                                 unsigned int oldpos, size;
 508
 509                                 if ((strcmp(t->target.u.user.name,
 510                                             XT_STANDARD_TARGET) == 0) &&
 511                                     t->verdict < -NF_MAX_VERDICT - 1) {
 512                                         duprintf("mark_source_chains: bad "
 513                                                 "negative verdict (%i)\n",
 514                                                                 t->verdict);
 515                                         return 0;
 516                                 }
 517
 518                                 /* Return: backtrack through the last
 519                                    big jump. */
 520                                 do {
 521                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 522 #ifdef DEBUG_IP_FIREWALL_USER
 523                                         if (e->comefrom
 524                                             & (1 << NF_INET_NUMHOOKS)) {
 525                                                 duprintf("Back unset "
 526                                                          "on hook %u "
 527                                                          "rule %u\n",
 528                                                          hook, pos);
 529                                         }
 530 #endif
 531                                         oldpos = pos;
 532                                         pos = e->counters.pcnt;
 533                                         e->counters.pcnt = 0;
 534
 535                                         /* We're at the start. */
 536                                         if (pos == oldpos)
 537                                                 goto next;
 538
 539                                         e = (struct ip6t_entry *)
 540                                                 (entry0 + pos);
 541                                 } while (oldpos == pos + e->next_offset);
 542
 543                                 /* Move along one */
 544                                 size = e->next_offset;
 545                                 e = (struct ip6t_entry *)
 546                                         (entry0 + pos + size);
 547                                 if (pos + size >= newinfo->size)
 548                                         return 0;
 549                                 e->counters.pcnt = pos;
 550                                 pos += size;
 551                         } else {
 552                                 int newpos = t->verdict;
 553
 554                                 if (strcmp(t->target.u.user.name,
 555                                            XT_STANDARD_TARGET) == 0 &&
 556                                     newpos >= 0) {
 557                                         if (newpos > newinfo->size -
 558                                                 sizeof(struct ip6t_entry)) {
 559                                                 duprintf("mark_source_chains: "
 560                                                         "bad verdict (%i)\n",
 561                                                                 newpos);
 562                                                 return 0;
 563                                         }
 564                                         /* This a jump; chase it. */
 565                                         duprintf("Jump rule %u -> %u\n",
 566                                                  pos, newpos);
 567                                         e = (struct ip6t_entry *)
 568                                                 (entry0 + newpos);
 569                                         if (!find_jump_target(newinfo, e))
 570                                                 return 0;
 571                                 } else {
 572                                         /* ... this is a fallthru */
 573                                         newpos = pos + e->next_offset;
 574                                         if (newpos >= newinfo->size)
 575                                                 return 0;
 576                                 }
 577                                 e = (struct ip6t_entry *)
 578                                         (entry0 + newpos);
 579                                 e->counters.pcnt = pos;
 580                                 pos = newpos;
 581                         }
 582                 }
 583 next:
 584                 duprintf("Finished chain %u\n", hook);
 585         }
 586         return 1;
 587 }
 588
 589 static void cleanup_match(struct xt_entry_match *m, struct net *net)
 590 {
 591         struct xt_mtdtor_param par;
 592
 593         par.net       = net;
 594         par.match     = m->u.kernel.match;
 595         par.matchinfo = m->data;
 596         par.family    = NFPROTO_IPV6;
 597         if (par.match->destroy != NULL)
 598                 par.match->destroy(&par);
 599         module_put(par.match->me);
 600 }
 601
 602 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 603 {
 604         const struct ip6t_ip6 *ipv6 = par->entryinfo;
 605         int ret;
 606
 607         par->match     = m->u.kernel.match;
 608         par->matchinfo = m->data;
 609
 610         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 611                              ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
 612         if (ret < 0) {
 613                 duprintf("ip_tables: check failed for `%s'.\n",
 614                          par.match->name);
 615                 return ret;
 616         }
 617         return 0;
 618 }
 619
 620 static int
 621 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 622 {
 623         struct xt_match *match;
 624         int ret;
 625
 626         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
 627                                       m->u.user.revision);
 628         if (IS_ERR(match)) {
 629                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 630                 return PTR_ERR(match);
 631         }
 632         m->u.kernel.match = match;
 633
 634         ret = check_match(m, par);
 635         if (ret)
 636                 goto err;
 637
 638         return 0;
 639 err:
 640         module_put(m->u.kernel.match->me);
 641         return ret;
 642 }
 643
 644 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 645 {
 646         struct xt_entry_target *t = ip6t_get_target(e);
 647         struct xt_tgchk_param par = {
 648                 .net       = net,
 649                 .table     = name,
 650                 .entryinfo = e,
 651                 .target    = t->u.kernel.target,
 652                 .targinfo  = t->data,
 653                 .hook_mask = e->comefrom,
 654                 .family    = NFPROTO_IPV6,
 655         };
 656         int ret;
 657
 658         t = ip6t_get_target(e);
 659         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 660               e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
 661         if (ret < 0) {
 662                 duprintf("ip_tables: check failed for `%s'.\n",
 663                          t->u.kernel.target->name);
 664                 return ret;
 665         }
 666         return 0;
 667 }
 668
 669 static int
 670 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 671                  unsigned int size)
 672 {
 673         struct xt_entry_target *t;
 674         struct xt_target *target;
 675         int ret;
 676         unsigned int j;
 677         struct xt_mtchk_param mtpar;
 678         struct xt_entry_match *ematch;
 679
 680         e->counters.pcnt = xt_percpu_counter_alloc();
 681         if (IS_ERR_VALUE(e->counters.pcnt))
 682                 return -ENOMEM;
 683
 684         j = 0;
 685         mtpar.net       = net;
 686         mtpar.table     = name;
 687         mtpar.entryinfo = &e->ipv6;
 688         mtpar.hook_mask = e->comefrom;
 689         mtpar.family    = NFPROTO_IPV6;
 690         xt_ematch_foreach(ematch, e) {
 691                 ret = find_check_match(ematch, &mtpar);
 692                 if (ret != 0)
 693                         goto cleanup_matches;
 694                 ++j;
 695         }
 696
 697         t = ip6t_get_target(e);
 698         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
 699                                         t->u.user.revision);
 700         if (IS_ERR(target)) {
 701                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 702                 ret = PTR_ERR(target);
 703                 goto cleanup_matches;
 704         }
 705         t->u.kernel.target = target;
 706
 707         ret = check_target(e, net, name);
 708         if (ret)
 709                 goto err;
 710         return 0;
 711  err:
 712         module_put(t->u.kernel.target->me);
 713  cleanup_matches:
 714         xt_ematch_foreach(ematch, e) {
 715                 if (j-- == 0)
 716                         break;
 717                 cleanup_match(ematch, net);
 718         }
 719
 720         xt_percpu_counter_free(e->counters.pcnt);
 721
 722         return ret;
 723 }
 724
 725 static bool check_underflow(const struct ip6t_entry *e)
 726 {
 727         const struct xt_entry_target *t;
 728         unsigned int verdict;
 729
 730         if (!unconditional(e))
 731                 return false;
 732         t = ip6t_get_target_c(e);
 733         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 734                 return false;
 735         verdict = ((struct xt_standard_target *)t)->verdict;
 736         verdict = -verdict - 1;
 737         return verdict == NF_DROP || verdict == NF_ACCEPT;
 738 }
 739
 740 static int
 741 check_entry_size_and_hooks(struct ip6t_entry *e,
 742                            struct xt_table_info *newinfo,
 743                            const unsigned char *base,
 744                            const unsigned char *limit,
 745                            const unsigned int *hook_entries,
 746                            const unsigned int *underflows,
 747                            unsigned int valid_hooks)
 748 {
 749         unsigned int h;
 750         int err;
 751
 752         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
 753             (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
 754             (unsigned char *)e + e->next_offset > limit) {
 755                 duprintf("Bad offset %p\n", e);
 756                 return -EINVAL;
 757         }
 758
 759         if (e->next_offset
 760             < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target)) {
 761                 duprintf("checking: element %p size %u\n",
 762                          e, e->next_offset);
 763                 return -EINVAL;
 764         }
 765
 766         if (!ip6_checkentry(&e->ipv6))
 767                 return -EINVAL;
 768
 769         err = xt_check_entry_offsets(e, e->target_offset, e->next_offset);
 770         if (err)
 771                 return err;
 772
 773         /* Check hooks & underflows */
 774         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 775                 if (!(valid_hooks & (1 << h)))
 776                         continue;
 777                 if ((unsigned char *)e - base == hook_entries[h])
 778                         newinfo->hook_entry[h] = hook_entries[h];
 779                 if ((unsigned char *)e - base == underflows[h]) {
 780                         if (!check_underflow(e)) {
 781                                 pr_debug("Underflows must be unconditional and "
 782                                          "use the STANDARD target with "
 783                                          "ACCEPT/DROP\n");
 784                                 return -EINVAL;
 785                         }
 786                         newinfo->underflow[h] = underflows[h];
 787                 }
 788         }
 789
 790         /* Clear counters and comefrom */
 791         e->counters = ((struct xt_counters) { 0, 0 });
 792         e->comefrom = 0;
 793         return 0;
 794 }
 795
 796 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
 797 {
 798         struct xt_tgdtor_param par;
 799         struct xt_entry_target *t;
 800         struct xt_entry_match *ematch;
 801
 802         /* Cleanup all matches */
 803         xt_ematch_foreach(ematch, e)
 804                 cleanup_match(ematch, net);
 805         t = ip6t_get_target(e);
 806
 807         par.net      = net;
 808         par.target   = t->u.kernel.target;
 809         par.targinfo = t->data;
 810         par.family   = NFPROTO_IPV6;
 811         if (par.target->destroy != NULL)
 812                 par.target->destroy(&par);
 813         module_put(par.target->me);
 814
 815         xt_percpu_counter_free(e->counters.pcnt);
 816 }
 817
 818 /* Checks and translates the user-supplied table segment (held in
 819    newinfo) */
 820 static int
 821 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
 822                 const struct ip6t_replace *repl)
 823 {
 824         struct ip6t_entry *iter;
 825         unsigned int i;
 826         int ret = 0;
 827
 828         newinfo->size = repl->size;
 829         newinfo->number = repl->num_entries;
 830
 831         /* Init all hooks to impossible value. */
 832         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 833                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 834                 newinfo->underflow[i] = 0xFFFFFFFF;
 835         }
 836
 837         duprintf("translate_table: size %u\n", newinfo->size);
 838         i = 0;
 839         /* Walk through entries, checking offsets. */
 840         xt_entry_foreach(iter, entry0, newinfo->size) {
 841                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 842                                                  entry0 + repl->size,
 843                                                  repl->hook_entry,
 844                                                  repl->underflow,
 845                                                  repl->valid_hooks);
 846                 if (ret != 0)
 847                         return ret;
 848                 ++i;
 849                 if (strcmp(ip6t_get_target(iter)->u.user.name,
 850                     XT_ERROR_TARGET) == 0)
 851                         ++newinfo->stacksize;
 852         }
 853
 854         if (i != repl->num_entries) {
 855                 duprintf("translate_table: %u not %u entries\n",
 856                          i, repl->num_entries);
 857                 return -EINVAL;
 858         }
 859
 860         /* Check hooks all assigned */
 861         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 862                 /* Only hooks which are valid */
 863                 if (!(repl->valid_hooks & (1 << i)))
 864                         continue;
 865                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 866                         duprintf("Invalid hook entry %u %u\n",
 867                                  i, repl->hook_entry[i]);
 868                         return -EINVAL;
 869                 }
 870                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 871                         duprintf("Invalid underflow %u %u\n",
 872                                  i, repl->underflow[i]);
 873                         return -EINVAL;
 874                 }
 875         }
 876
 877         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
 878                 return -ELOOP;
 879
 880         /* Finally, each sanity check must pass */
 881         i = 0;
 882         xt_entry_foreach(iter, entry0, newinfo->size) {
 883                 ret = find_check_entry(iter, net, repl->name, repl->size);
 884                 if (ret != 0)
 885                         break;
 886                 ++i;
 887         }
 888
 889         if (ret != 0) {
 890                 xt_entry_foreach(iter, entry0, newinfo->size) {
 891                         if (i-- == 0)
 892                                 break;
 893                         cleanup_entry(iter, net);
 894                 }
 895                 return ret;
 896         }
 897
 898         return ret;
 899 }
 900
 901 static void
 902 get_counters(const struct xt_table_info *t,
 903              struct xt_counters counters[])
 904 {
 905         struct ip6t_entry *iter;
 906         unsigned int cpu;
 907         unsigned int i;
 908
 909         for_each_possible_cpu(cpu) {
 910                 seqcount_t *s = &per_cpu(xt_recseq, cpu);
 911
 912                 i = 0;
 913                 xt_entry_foreach(iter, t->entries, t->size) {
 914                         struct xt_counters *tmp;
 915                         u64 bcnt, pcnt;
 916                         unsigned int start;
 917
 918                         tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
 919                         do {
 920                                 start = read_seqcount_begin(s);
 921                                 bcnt = tmp->bcnt;
 922                                 pcnt = tmp->pcnt;
 923                         } while (read_seqcount_retry(s, start));
 924
 925                         ADD_COUNTER(counters[i], bcnt, pcnt);
 926                         ++i;
 927                 }
 928         }
 929 }
 930
 931 static struct xt_counters *alloc_counters(const struct xt_table *table)
 932 {
 933         unsigned int countersize;
 934         struct xt_counters *counters;
 935         const struct xt_table_info *private = table->private;
 936
 937         /* We need atomic snapshot of counters: rest doesn't change
 938            (other than comefrom, which userspace doesn't care
 939            about). */
 940         countersize = sizeof(struct xt_counters) * private->number;
 941         counters = vzalloc(countersize);
 942
 943         if (counters == NULL)
 944                 return ERR_PTR(-ENOMEM);
 945
 946         get_counters(private, counters);
 947
 948         return counters;
 949 }
 950
 951 static int
 952 copy_entries_to_user(unsigned int total_size,
 953                      const struct xt_table *table,
 954                      void __user *userptr)
 955 {
 956         unsigned int off, num;
 957         const struct ip6t_entry *e;
 958         struct xt_counters *counters;
 959         const struct xt_table_info *private = table->private;
 960         int ret = 0;
 961         const void *loc_cpu_entry;
 962
 963         counters = alloc_counters(table);
 964         if (IS_ERR(counters))
 965                 return PTR_ERR(counters);
 966
 967         loc_cpu_entry = private->entries;
 968         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 969                 ret = -EFAULT;
 970                 goto free_counters;
 971         }
 972
 973         /* FIXME: use iterator macros --RR */
 974         /* ... then go back and fix counters and names */
 975         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 976                 unsigned int i;
 977                 const struct xt_entry_match *m;
 978                 const struct xt_entry_target *t;
 979
 980                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
 981                 if (copy_to_user(userptr + off
 982                                  + offsetof(struct ip6t_entry, counters),
 983                                  &counters[num],
 984                                  sizeof(counters[num])) != 0) {
 985                         ret = -EFAULT;
 986                         goto free_counters;
 987                 }
 988
 989                 for (i = sizeof(struct ip6t_entry);
 990                      i < e->target_offset;
 991                      i += m->u.match_size) {
 992                         m = (void *)e + i;
 993
 994                         if (copy_to_user(userptr + off + i
 995                                          + offsetof(struct xt_entry_match,
 996                                                     u.user.name),
 997                                          m->u.kernel.match->name,
 998                                          strlen(m->u.kernel.match->name)+1)
 999                             != 0) {
1000                                 ret = -EFAULT;
1001                                 goto free_counters;
1002                         }
1003                 }
1004
1005                 t = ip6t_get_target_c(e);
1006                 if (copy_to_user(userptr + off + e->target_offset
1007                                  + offsetof(struct xt_entry_target,
1008                                             u.user.name),
1009                                  t->u.kernel.target->name,
1010                                  strlen(t->u.kernel.target->name)+1) != 0) {
1011                         ret = -EFAULT;
1012                         goto free_counters;
1013                 }
1014         }
1015
1016  free_counters:
1017         vfree(counters);
1018         return ret;
1019 }
1020
1021 #ifdef CONFIG_COMPAT
1022 static void compat_standard_from_user(void *dst, const void *src)
1023 {
1024         int v = *(compat_int_t *)src;
1025
1026         if (v > 0)
1027                 v += xt_compat_calc_jump(AF_INET6, v);
1028         memcpy(dst, &v, sizeof(v));
1029 }
1030
1031 static int compat_standard_to_user(void __user *dst, const void *src)
1032 {
1033         compat_int_t cv = *(int *)src;
1034
1035         if (cv > 0)
1036                 cv -= xt_compat_calc_jump(AF_INET6, cv);
1037         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1038 }
1039
1040 static int compat_calc_entry(const struct ip6t_entry *e,
1041                              const struct xt_table_info *info,
1042                              const void *base, struct xt_table_info *newinfo)
1043 {
1044         const struct xt_entry_match *ematch;
1045         const struct xt_entry_target *t;
1046         unsigned int entry_offset;
1047         int off, i, ret;
1048
1049         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1050         entry_offset = (void *)e - base;
1051         xt_ematch_foreach(ematch, e)
1052                 off += xt_compat_match_offset(ematch->u.kernel.match);
1053         t = ip6t_get_target_c(e);
1054         off += xt_compat_target_offset(t->u.kernel.target);
1055         newinfo->size -= off;
1056         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1057         if (ret)
1058                 return ret;
1059
1060         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1061                 if (info->hook_entry[i] &&
1062                     (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1063                         newinfo->hook_entry[i] -= off;
1064                 if (info->underflow[i] &&
1065                     (e < (struct ip6t_entry *)(base + info->underflow[i])))
1066                         newinfo->underflow[i] -= off;
1067         }
1068         return 0;
1069 }
1070
1071 static int compat_table_info(const struct xt_table_info *info,
1072                              struct xt_table_info *newinfo)
1073 {
1074         struct ip6t_entry *iter;
1075         const void *loc_cpu_entry;
1076         int ret;
1077
1078         if (!newinfo || !info)
1079                 return -EINVAL;
1080
1081         /* we dont care about newinfo->entries */
1082         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1083         newinfo->initial_entries = 0;
1084         loc_cpu_entry = info->entries;
1085         xt_compat_init_offsets(AF_INET6, info->number);
1086         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1087                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1088                 if (ret != 0)
1089                         return ret;
1090         }
1091         return 0;
1092 }
1093 #endif
1094
1095 static int get_info(struct net *net, void __user *user,
1096                     const int *len, int compat)
1097 {
1098         char name[XT_TABLE_MAXNAMELEN];
1099         struct xt_table *t;
1100         int ret;
1101
1102         if (*len != sizeof(struct ip6t_getinfo)) {
1103                 duprintf("length %u != %zu\n", *len,
1104                          sizeof(struct ip6t_getinfo));
1105                 return -EINVAL;
1106         }
1107
1108         if (copy_from_user(name, user, sizeof(name)) != 0)
1109                 return -EFAULT;
1110
1111         name[XT_TABLE_MAXNAMELEN-1] = '\0';
1112 #ifdef CONFIG_COMPAT
1113         if (compat)
1114                 xt_compat_lock(AF_INET6);
1115 #endif
1116         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1117                                     "ip6table_%s", name);
1118         if (!IS_ERR_OR_NULL(t)) {
1119                 struct ip6t_getinfo info;
1120                 const struct xt_table_info *private = t->private;
1121 #ifdef CONFIG_COMPAT
1122                 struct xt_table_info tmp;
1123
1124                 if (compat) {
1125                         ret = compat_table_info(private, &tmp);
1126                         xt_compat_flush_offsets(AF_INET6);
1127                         private = &tmp;
1128                 }
1129 #endif
1130                 memset(&info, 0, sizeof(info));
1131                 info.valid_hooks = t->valid_hooks;
1132                 memcpy(info.hook_entry, private->hook_entry,
1133                        sizeof(info.hook_entry));
1134                 memcpy(info.underflow, private->underflow,
1135                        sizeof(info.underflow));
1136                 info.num_entries = private->number;
1137                 info.size = private->size;
1138                 strcpy(info.name, name);
1139
1140                 if (copy_to_user(user, &info, *len) != 0)
1141                         ret = -EFAULT;
1142                 else
1143                         ret = 0;
1144
1145                 xt_table_unlock(t);
1146                 module_put(t->me);
1147         } else
1148                 ret = t ? PTR_ERR(t) : -ENOENT;
1149 #ifdef CONFIG_COMPAT
1150         if (compat)
1151                 xt_compat_unlock(AF_INET6);
1152 #endif
1153         return ret;
1154 }
1155
1156 static int
1157 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1158             const int *len)
1159 {
1160         int ret;
1161         struct ip6t_get_entries get;
1162         struct xt_table *t;
1163
1164         if (*len < sizeof(get)) {
1165                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1166                 return -EINVAL;
1167         }
1168         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1169                 return -EFAULT;
1170         if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1171                 duprintf("get_entries: %u != %zu\n",
1172                          *len, sizeof(get) + get.size);
1173                 return -EINVAL;
1174         }
1175         get.name[sizeof(get.name) - 1] = '\0';
1176
1177         t = xt_find_table_lock(net, AF_INET6, get.name);
1178         if (!IS_ERR_OR_NULL(t)) {
1179                 struct xt_table_info *private = t->private;
1180                 duprintf("t->private->number = %u\n", private->number);
1181                 if (get.size == private->size)
1182                         ret = copy_entries_to_user(private->size,
1183                                                    t, uptr->entrytable);
1184                 else {
1185                         duprintf("get_entries: I've got %u not %u!\n",
1186                                  private->size, get.size);
1187                         ret = -EAGAIN;
1188                 }
1189                 module_put(t->me);
1190                 xt_table_unlock(t);
1191         } else
1192                 ret = t ? PTR_ERR(t) : -ENOENT;
1193
1194         return ret;
1195 }
1196
1197 static int
1198 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1199              struct xt_table_info *newinfo, unsigned int num_counters,
1200              void __user *counters_ptr)
1201 {
1202         int ret;
1203         struct xt_table *t;
1204         struct xt_table_info *oldinfo;
1205         struct xt_counters *counters;
1206         struct ip6t_entry *iter;
1207
1208         ret = 0;
1209         counters = vzalloc(num_counters * sizeof(struct xt_counters));
1210         if (!counters) {
1211                 ret = -ENOMEM;
1212                 goto out;
1213         }
1214
1215         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1216                                     "ip6table_%s", name);
1217         if (IS_ERR_OR_NULL(t)) {
1218                 ret = t ? PTR_ERR(t) : -ENOENT;
1219                 goto free_newinfo_counters_untrans;
1220         }
1221
1222         /* You lied! */
1223         if (valid_hooks != t->valid_hooks) {
1224                 duprintf("Valid hook crap: %08X vs %08X\n",
1225                          valid_hooks, t->valid_hooks);
1226                 ret = -EINVAL;
1227                 goto put_module;
1228         }
1229
1230         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1231         if (!oldinfo)
1232                 goto put_module;
1233
1234         /* Update module usage count based on number of rules */
1235         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1236                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1237         if ((oldinfo->number > oldinfo->initial_entries) ||
1238             (newinfo->number <= oldinfo->initial_entries))
1239                 module_put(t->me);
1240         if ((oldinfo->number > oldinfo->initial_entries) &&
1241             (newinfo->number <= oldinfo->initial_entries))
1242                 module_put(t->me);
1243
1244         /* Get the old counters, and synchronize with replace */
1245         get_counters(oldinfo, counters);
1246
1247         /* Decrease module usage counts and free resource */
1248         xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1249                 cleanup_entry(iter, net);
1250
1251         xt_free_table_info(oldinfo);
1252         if (copy_to_user(counters_ptr, counters,
1253                          sizeof(struct xt_counters) * num_counters) != 0) {
1254                 /* Silent error, can't fail, new table is already in place */
1255                 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1256         }
1257         vfree(counters);
1258         xt_table_unlock(t);
1259         return ret;
1260
1261  put_module:
1262         module_put(t->me);
1263         xt_table_unlock(t);
1264  free_newinfo_counters_untrans:
1265         vfree(counters);
1266  out:
1267         return ret;
1268 }
1269
1270 static int
1271 do_replace(struct net *net, const void __user *user, unsigned int len)
1272 {
1273         int ret;
1274         struct ip6t_replace tmp;
1275         struct xt_table_info *newinfo;
1276         void *loc_cpu_entry;
1277         struct ip6t_entry *iter;
1278
1279         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1280                 return -EFAULT;
1281
1282         /* overflow check */
1283         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1284                 return -ENOMEM;
1285         if (tmp.num_counters == 0)
1286                 return -EINVAL;
1287
1288         tmp.name[sizeof(tmp.name)-1] = 0;
1289
1290         newinfo = xt_alloc_table_info(tmp.size);
1291         if (!newinfo)
1292                 return -ENOMEM;
1293
1294         loc_cpu_entry = newinfo->entries;
1295         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1296                            tmp.size) != 0) {
1297                 ret = -EFAULT;
1298                 goto free_newinfo;
1299         }
1300
1301         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1302         if (ret != 0)
1303                 goto free_newinfo;
1304
1305         duprintf("ip_tables: Translated table\n");
1306
1307         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1308                            tmp.num_counters, tmp.counters);
1309         if (ret)
1310                 goto free_newinfo_untrans;
1311         return 0;
1312
1313  free_newinfo_untrans:
1314         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1315                 cleanup_entry(iter, net);
1316  free_newinfo:
1317         xt_free_table_info(newinfo);
1318         return ret;
1319 }
1320
1321 static int
1322 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1323                 int compat)
1324 {
1325         unsigned int i;
1326         struct xt_counters_info tmp;
1327         struct xt_counters *paddc;
1328         unsigned int num_counters;
1329         char *name;
1330         int size;
1331         void *ptmp;
1332         struct xt_table *t;
1333         const struct xt_table_info *private;
1334         int ret = 0;
1335         struct ip6t_entry *iter;
1336         unsigned int addend;
1337 #ifdef CONFIG_COMPAT
1338         struct compat_xt_counters_info compat_tmp;
1339
1340         if (compat) {
1341                 ptmp = &compat_tmp;
1342                 size = sizeof(struct compat_xt_counters_info);
1343         } else
1344 #endif
1345         {
1346                 ptmp = &tmp;
1347                 size = sizeof(struct xt_counters_info);
1348         }
1349
1350         if (copy_from_user(ptmp, user, size) != 0)
1351                 return -EFAULT;
1352
1353 #ifdef CONFIG_COMPAT
1354         if (compat) {
1355                 num_counters = compat_tmp.num_counters;
1356                 name = compat_tmp.name;
1357         } else
1358 #endif
1359         {
1360                 num_counters = tmp.num_counters;
1361                 name = tmp.name;
1362         }
1363
1364         if (len != size + num_counters * sizeof(struct xt_counters))
1365                 return -EINVAL;
1366
1367         paddc = vmalloc(len - size);
1368         if (!paddc)
1369                 return -ENOMEM;
1370
1371         if (copy_from_user(paddc, user + size, len - size) != 0) {
1372                 ret = -EFAULT;
1373                 goto free;
1374         }
1375
1376         t = xt_find_table_lock(net, AF_INET6, name);
1377         if (IS_ERR_OR_NULL(t)) {
1378                 ret = t ? PTR_ERR(t) : -ENOENT;
1379                 goto free;
1380         }
1381
1382         local_bh_disable();
1383         private = t->private;
1384         if (private->number != num_counters) {
1385                 ret = -EINVAL;
1386                 goto unlock_up_free;
1387         }
1388
1389         i = 0;
1390         addend = xt_write_recseq_begin();
1391         xt_entry_foreach(iter, private->entries, private->size) {
1392                 struct xt_counters *tmp;
1393
1394                 tmp = xt_get_this_cpu_counter(&iter->counters);
1395                 ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1396                 ++i;
1397         }
1398         xt_write_recseq_end(addend);
1399  unlock_up_free:
1400         local_bh_enable();
1401         xt_table_unlock(t);
1402         module_put(t->me);
1403  free:
1404         vfree(paddc);
1405
1406         return ret;
1407 }
1408
1409 #ifdef CONFIG_COMPAT
1410 struct compat_ip6t_replace {
1411         char                    name[XT_TABLE_MAXNAMELEN];
1412         u32                     valid_hooks;
1413         u32                     num_entries;
1414         u32                     size;
1415         u32                     hook_entry[NF_INET_NUMHOOKS];
1416         u32                     underflow[NF_INET_NUMHOOKS];
1417         u32                     num_counters;
1418         compat_uptr_t           counters;       /* struct xt_counters * */
1419         struct compat_ip6t_entry entries[0];
1420 };
1421
1422 static int
1423 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1424                           unsigned int *size, struct xt_counters *counters,
1425                           unsigned int i)
1426 {
1427         struct xt_entry_target *t;
1428         struct compat_ip6t_entry __user *ce;
1429         u_int16_t target_offset, next_offset;
1430         compat_uint_t origsize;
1431         const struct xt_entry_match *ematch;
1432         int ret = 0;
1433
1434         origsize = *size;
1435         ce = (struct compat_ip6t_entry __user *)*dstptr;
1436         if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1437             copy_to_user(&ce->counters, &counters[i],
1438             sizeof(counters[i])) != 0)
1439                 return -EFAULT;
1440
1441         *dstptr += sizeof(struct compat_ip6t_entry);
1442         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1443
1444         xt_ematch_foreach(ematch, e) {
1445                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1446                 if (ret != 0)
1447                         return ret;
1448         }
1449         target_offset = e->target_offset - (origsize - *size);
1450         t = ip6t_get_target(e);
1451         ret = xt_compat_target_to_user(t, dstptr, size);
1452         if (ret)
1453                 return ret;
1454         next_offset = e->next_offset - (origsize - *size);
1455         if (put_user(target_offset, &ce->target_offset) != 0 ||
1456             put_user(next_offset, &ce->next_offset) != 0)
1457                 return -EFAULT;
1458         return 0;
1459 }
1460
1461 static int
1462 compat_find_calc_match(struct xt_entry_match *m,
1463                        const char *name,
1464                        const struct ip6t_ip6 *ipv6,
1465                        int *size)
1466 {
1467         struct xt_match *match;
1468
1469         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1470                                       m->u.user.revision);
1471         if (IS_ERR(match)) {
1472                 duprintf("compat_check_calc_match: `%s' not found\n",
1473                          m->u.user.name);
1474                 return PTR_ERR(match);
1475         }
1476         m->u.kernel.match = match;
1477         *size += xt_compat_match_offset(match);
1478         return 0;
1479 }
1480
1481 static void compat_release_entry(struct compat_ip6t_entry *e)
1482 {
1483         struct xt_entry_target *t;
1484         struct xt_entry_match *ematch;
1485
1486         /* Cleanup all matches */
1487         xt_ematch_foreach(ematch, e)
1488                 module_put(ematch->u.kernel.match->me);
1489         t = compat_ip6t_get_target(e);
1490         module_put(t->u.kernel.target->me);
1491 }
1492
1493 static int
1494 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1495                                   struct xt_table_info *newinfo,
1496                                   unsigned int *size,
1497                                   const unsigned char *base,
1498                                   const unsigned char *limit,
1499                                   const unsigned int *hook_entries,
1500                                   const unsigned int *underflows,
1501                                   const char *name)
1502 {
1503         struct xt_entry_match *ematch;
1504         struct xt_entry_target *t;
1505         struct xt_target *target;
1506         unsigned int entry_offset;
1507         unsigned int j;
1508         int ret, off, h;
1509
1510         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1511         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1512             (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
1513             (unsigned char *)e + e->next_offset > limit) {
1514                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1515                 return -EINVAL;
1516         }
1517
1518         if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1519                              sizeof(struct compat_xt_entry_target)) {
1520                 duprintf("checking: element %p size %u\n",
1521                          e, e->next_offset);
1522                 return -EINVAL;
1523         }
1524
1525         if (!ip6_checkentry(&e->ipv6))
1526                 return -EINVAL;
1527
1528         ret = xt_check_entry_offsets(e, e->target_offset, e->next_offset);
1529         if (ret)
1530                 return ret;
1531
1532         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1533         entry_offset = (void *)e - (void *)base;
1534         j = 0;
1535         xt_ematch_foreach(ematch, e) {
1536                 ret = compat_find_calc_match(ematch, name, &e->ipv6, &off);
1537                 if (ret != 0)
1538                         goto release_matches;
1539                 ++j;
1540         }
1541
1542         t = compat_ip6t_get_target(e);
1543         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1544                                         t->u.user.revision);
1545         if (IS_ERR(target)) {
1546                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1547                          t->u.user.name);
1548                 ret = PTR_ERR(target);
1549                 goto release_matches;
1550         }
1551         t->u.kernel.target = target;
1552
1553         off += xt_compat_target_offset(target);
1554         *size += off;
1555         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1556         if (ret)
1557                 goto out;
1558
1559         /* Check hooks & underflows */
1560         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1561                 if ((unsigned char *)e - base == hook_entries[h])
1562                         newinfo->hook_entry[h] = hook_entries[h];
1563                 if ((unsigned char *)e - base == underflows[h])
1564                         newinfo->underflow[h] = underflows[h];
1565         }
1566
1567         /* Clear counters and comefrom */
1568         memset(&e->counters, 0, sizeof(e->counters));
1569         e->comefrom = 0;
1570         return 0;
1571
1572 out:
1573         module_put(t->u.kernel.target->me);
1574 release_matches:
1575         xt_ematch_foreach(ematch, e) {
1576                 if (j-- == 0)
1577                         break;
1578                 module_put(ematch->u.kernel.match->me);
1579         }
1580         return ret;
1581 }
1582
1583 static int
1584 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1585                             unsigned int *size, const char *name,
1586                             struct xt_table_info *newinfo, unsigned char *base)
1587 {
1588         struct xt_entry_target *t;
1589         struct ip6t_entry *de;
1590         unsigned int origsize;
1591         int ret, h;
1592         struct xt_entry_match *ematch;
1593
1594         ret = 0;
1595         origsize = *size;
1596         de = (struct ip6t_entry *)*dstptr;
1597         memcpy(de, e, sizeof(struct ip6t_entry));
1598         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1599
1600         *dstptr += sizeof(struct ip6t_entry);
1601         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1602
1603         xt_ematch_foreach(ematch, e) {
1604                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1605                 if (ret != 0)
1606                         return ret;
1607         }
1608         de->target_offset = e->target_offset - (origsize - *size);
1609         t = compat_ip6t_get_target(e);
1610         xt_compat_target_from_user(t, dstptr, size);
1611
1612         de->next_offset = e->next_offset - (origsize - *size);
1613         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1614                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1615                         newinfo->hook_entry[h] -= origsize - *size;
1616                 if ((unsigned char *)de - base < newinfo->underflow[h])
1617                         newinfo->underflow[h] -= origsize - *size;
1618         }
1619         return ret;
1620 }
1621
1622 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1623                               const char *name)
1624 {
1625         unsigned int j;
1626         int ret = 0;
1627         struct xt_mtchk_param mtpar;
1628         struct xt_entry_match *ematch;
1629
1630         e->counters.pcnt = xt_percpu_counter_alloc();
1631         if (IS_ERR_VALUE(e->counters.pcnt))
1632                 return -ENOMEM;
1633         j = 0;
1634         mtpar.net       = net;
1635         mtpar.table     = name;
1636         mtpar.entryinfo = &e->ipv6;
1637         mtpar.hook_mask = e->comefrom;
1638         mtpar.family    = NFPROTO_IPV6;
1639         xt_ematch_foreach(ematch, e) {
1640                 ret = check_match(ematch, &mtpar);
1641                 if (ret != 0)
1642                         goto cleanup_matches;
1643                 ++j;
1644         }
1645
1646         ret = check_target(e, net, name);
1647         if (ret)
1648                 goto cleanup_matches;
1649         return 0;
1650
1651  cleanup_matches:
1652         xt_ematch_foreach(ematch, e) {
1653                 if (j-- == 0)
1654                         break;
1655                 cleanup_match(ematch, net);
1656         }
1657
1658         xt_percpu_counter_free(e->counters.pcnt);
1659
1660         return ret;
1661 }
1662
1663 static int
1664 translate_compat_table(struct net *net,
1665                        const char *name,
1666                        unsigned int valid_hooks,
1667                        struct xt_table_info **pinfo,
1668                        void **pentry0,
1669                        unsigned int total_size,
1670                        unsigned int number,
1671                        unsigned int *hook_entries,
1672                        unsigned int *underflows)
1673 {
1674         unsigned int i, j;
1675         struct xt_table_info *newinfo, *info;
1676         void *pos, *entry0, *entry1;
1677         struct compat_ip6t_entry *iter0;
1678         struct ip6t_entry *iter1;
1679         unsigned int size;
1680         int ret = 0;
1681
1682         info = *pinfo;
1683         entry0 = *pentry0;
1684         size = total_size;
1685         info->number = number;
1686
1687         /* Init all hooks to impossible value. */
1688         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1689                 info->hook_entry[i] = 0xFFFFFFFF;
1690                 info->underflow[i] = 0xFFFFFFFF;
1691         }
1692
1693         duprintf("translate_compat_table: size %u\n", info->size);
1694         j = 0;
1695         xt_compat_lock(AF_INET6);
1696         xt_compat_init_offsets(AF_INET6, number);
1697         /* Walk through entries, checking offsets. */
1698         xt_entry_foreach(iter0, entry0, total_size) {
1699                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1700                                                         entry0,
1701                                                         entry0 + total_size,
1702                                                         hook_entries,
1703                                                         underflows,
1704                                                         name);
1705                 if (ret != 0)
1706                         goto out_unlock;
1707                 ++j;
1708         }
1709
1710         ret = -EINVAL;
1711         if (j != number) {
1712                 duprintf("translate_compat_table: %u not %u entries\n",
1713                          j, number);
1714                 goto out_unlock;
1715         }
1716
1717         /* Check hooks all assigned */
1718         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1719                 /* Only hooks which are valid */
1720                 if (!(valid_hooks & (1 << i)))
1721                         continue;
1722                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1723                         duprintf("Invalid hook entry %u %u\n",
1724                                  i, hook_entries[i]);
1725                         goto out_unlock;
1726                 }
1727                 if (info->underflow[i] == 0xFFFFFFFF) {
1728                         duprintf("Invalid underflow %u %u\n",
1729                                  i, underflows[i]);
1730                         goto out_unlock;
1731                 }
1732         }
1733
1734         ret = -ENOMEM;
1735         newinfo = xt_alloc_table_info(size);
1736         if (!newinfo)
1737                 goto out_unlock;
1738
1739         newinfo->number = number;
1740         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1741                 newinfo->hook_entry[i] = info->hook_entry[i];
1742                 newinfo->underflow[i] = info->underflow[i];
1743         }
1744         entry1 = newinfo->entries;
1745         pos = entry1;
1746         size = total_size;
1747         xt_entry_foreach(iter0, entry0, total_size) {
1748                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1749                                                   name, newinfo, entry1);
1750                 if (ret != 0)
1751                         break;
1752         }
1753         xt_compat_flush_offsets(AF_INET6);
1754         xt_compat_unlock(AF_INET6);
1755         if (ret)
1756                 goto free_newinfo;
1757
1758         ret = -ELOOP;
1759         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1760                 goto free_newinfo;
1761
1762         i = 0;
1763         xt_entry_foreach(iter1, entry1, newinfo->size) {
1764                 ret = compat_check_entry(iter1, net, name);
1765                 if (ret != 0)
1766                         break;
1767                 ++i;
1768                 if (strcmp(ip6t_get_target(iter1)->u.user.name,
1769                     XT_ERROR_TARGET) == 0)
1770                         ++newinfo->stacksize;
1771         }
1772         if (ret) {
1773                 /*
1774                  * The first i matches need cleanup_entry (calls ->destroy)
1775                  * because they had called ->check already. The other j-i
1776                  * entries need only release.
1777                  */
1778                 int skip = i;
1779                 j -= i;
1780                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1781                         if (skip-- > 0)
1782                                 continue;
1783                         if (j-- == 0)
1784                                 break;
1785                         compat_release_entry(iter0);
1786                 }
1787                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1788                         if (i-- == 0)
1789                                 break;
1790                         cleanup_entry(iter1, net);
1791                 }
1792                 xt_free_table_info(newinfo);
1793                 return ret;
1794         }
1795
1796         *pinfo = newinfo;
1797         *pentry0 = entry1;
1798         xt_free_table_info(info);
1799         return 0;
1800
1801 free_newinfo:
1802         xt_free_table_info(newinfo);
1803 out:
1804         xt_entry_foreach(iter0, entry0, total_size) {
1805                 if (j-- == 0)
1806                         break;
1807                 compat_release_entry(iter0);
1808         }
1809         return ret;
1810 out_unlock:
1811         xt_compat_flush_offsets(AF_INET6);
1812         xt_compat_unlock(AF_INET6);
1813         goto out;
1814 }
1815
1816 static int
1817 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1818 {
1819         int ret;
1820         struct compat_ip6t_replace tmp;
1821         struct xt_table_info *newinfo;
1822         void *loc_cpu_entry;
1823         struct ip6t_entry *iter;
1824
1825         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1826                 return -EFAULT;
1827
1828         /* overflow check */
1829         if (tmp.size >= INT_MAX / num_possible_cpus())
1830                 return -ENOMEM;
1831         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1832                 return -ENOMEM;
1833         if (tmp.num_counters == 0)
1834                 return -EINVAL;
1835
1836         tmp.name[sizeof(tmp.name)-1] = 0;
1837
1838         newinfo = xt_alloc_table_info(tmp.size);
1839         if (!newinfo)
1840                 return -ENOMEM;
1841
1842         loc_cpu_entry = newinfo->entries;
1843         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1844                            tmp.size) != 0) {
1845                 ret = -EFAULT;
1846                 goto free_newinfo;
1847         }
1848
1849         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1850                                      &newinfo, &loc_cpu_entry, tmp.size,
1851                                      tmp.num_entries, tmp.hook_entry,
1852                                      tmp.underflow);
1853         if (ret != 0)
1854                 goto free_newinfo;
1855
1856         duprintf("compat_do_replace: Translated table\n");
1857
1858         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1859                            tmp.num_counters, compat_ptr(tmp.counters));
1860         if (ret)
1861                 goto free_newinfo_untrans;
1862         return 0;
1863
1864  free_newinfo_untrans:
1865         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1866                 cleanup_entry(iter, net);
1867  free_newinfo:
1868         xt_free_table_info(newinfo);
1869         return ret;
1870 }
1871
1872 static int
1873 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1874                        unsigned int len)
1875 {
1876         int ret;
1877
1878         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1879                 return -EPERM;
1880
1881         switch (cmd) {
1882         case IP6T_SO_SET_REPLACE:
1883                 ret = compat_do_replace(sock_net(sk), user, len);
1884                 break;
1885
1886         case IP6T_SO_SET_ADD_COUNTERS:
1887                 ret = do_add_counters(sock_net(sk), user, len, 1);
1888                 break;
1889
1890         default:
1891                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1892                 ret = -EINVAL;
1893         }
1894
1895         return ret;
1896 }
1897
1898 struct compat_ip6t_get_entries {
1899         char name[XT_TABLE_MAXNAMELEN];
1900         compat_uint_t size;
1901         struct compat_ip6t_entry entrytable[0];
1902 };
1903
1904 static int
1905 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1906                             void __user *userptr)
1907 {
1908         struct xt_counters *counters;
1909         const struct xt_table_info *private = table->private;
1910         void __user *pos;
1911         unsigned int size;
1912         int ret = 0;
1913         unsigned int i = 0;
1914         struct ip6t_entry *iter;
1915
1916         counters = alloc_counters(table);
1917         if (IS_ERR(counters))
1918                 return PTR_ERR(counters);
1919
1920         pos = userptr;
1921         size = total_size;
1922         xt_entry_foreach(iter, private->entries, total_size) {
1923                 ret = compat_copy_entry_to_user(iter, &pos,
1924                                                 &size, counters, i++);
1925                 if (ret != 0)
1926                         break;
1927         }
1928
1929         vfree(counters);
1930         return ret;
1931 }
1932
1933 static int
1934 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1935                    int *len)
1936 {
1937         int ret;
1938         struct compat_ip6t_get_entries get;
1939         struct xt_table *t;
1940
1941         if (*len < sizeof(get)) {
1942                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1943                 return -EINVAL;
1944         }
1945
1946         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1947                 return -EFAULT;
1948
1949         if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1950                 duprintf("compat_get_entries: %u != %zu\n",
1951                          *len, sizeof(get) + get.size);
1952                 return -EINVAL;
1953         }
1954         get.name[sizeof(get.name) - 1] = '\0';
1955
1956         xt_compat_lock(AF_INET6);
1957         t = xt_find_table_lock(net, AF_INET6, get.name);
1958         if (!IS_ERR_OR_NULL(t)) {
1959                 const struct xt_table_info *private = t->private;
1960                 struct xt_table_info info;
1961                 duprintf("t->private->number = %u\n", private->number);
1962                 ret = compat_table_info(private, &info);
1963                 if (!ret && get.size == info.size) {
1964                         ret = compat_copy_entries_to_user(private->size,
1965                                                           t, uptr->entrytable);
1966                 } else if (!ret) {
1967                         duprintf("compat_get_entries: I've got %u not %u!\n",
1968                                  private->size, get.size);
1969                         ret = -EAGAIN;
1970                 }
1971                 xt_compat_flush_offsets(AF_INET6);
1972                 module_put(t->me);
1973                 xt_table_unlock(t);
1974         } else
1975                 ret = t ? PTR_ERR(t) : -ENOENT;
1976
1977         xt_compat_unlock(AF_INET6);
1978         return ret;
1979 }
1980
1981 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1982
1983 static int
1984 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1985 {
1986         int ret;
1987
1988         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1989                 return -EPERM;
1990
1991         switch (cmd) {
1992         case IP6T_SO_GET_INFO:
1993                 ret = get_info(sock_net(sk), user, len, 1);
1994                 break;
1995         case IP6T_SO_GET_ENTRIES:
1996                 ret = compat_get_entries(sock_net(sk), user, len);
1997                 break;
1998         default:
1999                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
2000         }
2001         return ret;
2002 }
2003 #endif
2004
2005 static int
2006 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2007 {
2008         int ret;
2009
2010         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2011                 return -EPERM;
2012
2013         switch (cmd) {
2014         case IP6T_SO_SET_REPLACE:
2015                 ret = do_replace(sock_net(sk), user, len);
2016                 break;
2017
2018         case IP6T_SO_SET_ADD_COUNTERS:
2019                 ret = do_add_counters(sock_net(sk), user, len, 0);
2020                 break;
2021
2022         default:
2023                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
2024                 ret = -EINVAL;
2025         }
2026
2027         return ret;
2028 }
2029
2030 static int
2031 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2032 {
2033         int ret;
2034
2035         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2036                 return -EPERM;
2037
2038         switch (cmd) {
2039         case IP6T_SO_GET_INFO:
2040                 ret = get_info(sock_net(sk), user, len, 0);
2041                 break;
2042
2043         case IP6T_SO_GET_ENTRIES:
2044                 ret = get_entries(sock_net(sk), user, len);
2045                 break;
2046
2047         case IP6T_SO_GET_REVISION_MATCH:
2048         case IP6T_SO_GET_REVISION_TARGET: {
2049                 struct xt_get_revision rev;
2050                 int target;
2051
2052                 if (*len != sizeof(rev)) {
2053                         ret = -EINVAL;
2054                         break;
2055                 }
2056                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2057                         ret = -EFAULT;
2058                         break;
2059                 }
2060                 rev.name[sizeof(rev.name)-1] = 0;
2061
2062                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2063                         target = 1;
2064                 else
2065                         target = 0;
2066
2067                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2068                                                          rev.revision,
2069                                                          target, &ret),
2070                                         "ip6t_%s", rev.name);
2071                 break;
2072         }
2073
2074         default:
2075                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2076                 ret = -EINVAL;
2077         }
2078
2079         return ret;
2080 }
2081
2082 static void __ip6t_unregister_table(struct net *net, struct xt_table *table)
2083 {
2084         struct xt_table_info *private;
2085         void *loc_cpu_entry;
2086         struct module *table_owner = table->me;
2087         struct ip6t_entry *iter;
2088
2089         private = xt_unregister_table(table);
2090
2091         /* Decrease module usage counts and free resources */
2092         loc_cpu_entry = private->entries;
2093         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2094                 cleanup_entry(iter, net);
2095         if (private->number > private->initial_entries)
2096                 module_put(table_owner);
2097         xt_free_table_info(private);
2098 }
2099
2100 int ip6t_register_table(struct net *net, const struct xt_table *table,
2101                         const struct ip6t_replace *repl,
2102                         const struct nf_hook_ops *ops,
2103                         struct xt_table **res)
2104 {
2105         int ret;
2106         struct xt_table_info *newinfo;
2107         struct xt_table_info bootstrap = {0};
2108         void *loc_cpu_entry;
2109         struct xt_table *new_table;
2110
2111         newinfo = xt_alloc_table_info(repl->size);
2112         if (!newinfo)
2113                 return -ENOMEM;
2114
2115         loc_cpu_entry = newinfo->entries;
2116         memcpy(loc_cpu_entry, repl->entries, repl->size);
2117
2118         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2119         if (ret != 0)
2120                 goto out_free;
2121
2122         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2123         if (IS_ERR(new_table)) {
2124                 ret = PTR_ERR(new_table);
2125                 goto out_free;
2126         }
2127
2128         /* set res now, will see skbs right after nf_register_net_hooks */
2129         WRITE_ONCE(*res, new_table);
2130
2131         ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
2132         if (ret != 0) {
2133                 __ip6t_unregister_table(net, new_table);
2134                 *res = NULL;
2135         }
2136
2137         return ret;
2138
2139 out_free:
2140         xt_free_table_info(newinfo);
2141         return ret;
2142 }
2143
2144 void ip6t_unregister_table(struct net *net, struct xt_table *table,
2145                            const struct nf_hook_ops *ops)
2146 {
2147         nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
2148         __ip6t_unregister_table(net, table);
2149 }
2150
2151 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2152 static inline bool
2153 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2154                      u_int8_t type, u_int8_t code,
2155                      bool invert)
2156 {
2157         return (type == test_type && code >= min_code && code <= max_code)
2158                 ^ invert;
2159 }
2160
2161 static bool
2162 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
2163 {
2164         const struct icmp6hdr *ic;
2165         struct icmp6hdr _icmph;
2166         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2167
2168         /* Must not be a fragment. */
2169         if (par->fragoff != 0)
2170                 return false;
2171
2172         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2173         if (ic == NULL) {
2174                 /* We've been asked to examine this packet, and we
2175                  * can't.  Hence, no choice but to drop.
2176                  */
2177                 duprintf("Dropping evil ICMP tinygram.\n");
2178                 par->hotdrop = true;
2179                 return false;
2180         }
2181
2182         return icmp6_type_code_match(icmpinfo->type,
2183                                      icmpinfo->code[0],
2184                                      icmpinfo->code[1],
2185                                      ic->icmp6_type, ic->icmp6_code,
2186                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
2187 }
2188
2189 /* Called when user tries to insert an entry of this type. */
2190 static int icmp6_checkentry(const struct xt_mtchk_param *par)
2191 {
2192         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2193
2194         /* Must specify no unknown invflags */
2195         return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
2196 }
2197
2198 /* The built-in targets: standard (NULL) and error. */
2199 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
2200         {
2201                 .name             = XT_STANDARD_TARGET,
2202                 .targetsize       = sizeof(int),
2203                 .family           = NFPROTO_IPV6,
2204 #ifdef CONFIG_COMPAT
2205                 .compatsize       = sizeof(compat_int_t),
2206                 .compat_from_user = compat_standard_from_user,
2207                 .compat_to_user   = compat_standard_to_user,
2208 #endif
2209         },
2210         {
2211                 .name             = XT_ERROR_TARGET,
2212                 .target           = ip6t_error,
2213                 .targetsize       = XT_FUNCTION_MAXNAMELEN,
2214                 .family           = NFPROTO_IPV6,
2215         },
2216 };
2217
2218 static struct nf_sockopt_ops ip6t_sockopts = {
2219         .pf             = PF_INET6,
2220         .set_optmin     = IP6T_BASE_CTL,
2221         .set_optmax     = IP6T_SO_SET_MAX+1,
2222         .set            = do_ip6t_set_ctl,
2223 #ifdef CONFIG_COMPAT
2224         .compat_set     = compat_do_ip6t_set_ctl,
2225 #endif
2226         .get_optmin     = IP6T_BASE_CTL,
2227         .get_optmax     = IP6T_SO_GET_MAX+1,
2228         .get            = do_ip6t_get_ctl,
2229 #ifdef CONFIG_COMPAT
2230         .compat_get     = compat_do_ip6t_get_ctl,
2231 #endif
2232         .owner          = THIS_MODULE,
2233 };
2234
2235 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
2236         {
2237                 .name       = "icmp6",
2238                 .match      = icmp6_match,
2239                 .matchsize  = sizeof(struct ip6t_icmp),
2240                 .checkentry = icmp6_checkentry,
2241                 .proto      = IPPROTO_ICMPV6,
2242                 .family     = NFPROTO_IPV6,
2243         },
2244 };
2245
2246 static int __net_init ip6_tables_net_init(struct net *net)
2247 {
2248         return xt_proto_init(net, NFPROTO_IPV6);
2249 }
2250
2251 static void __net_exit ip6_tables_net_exit(struct net *net)
2252 {
2253         xt_proto_fini(net, NFPROTO_IPV6);
2254 }
2255
2256 static struct pernet_operations ip6_tables_net_ops = {
2257         .init = ip6_tables_net_init,
2258         .exit = ip6_tables_net_exit,
2259 };
2260
2261 static int __init ip6_tables_init(void)
2262 {
2263         int ret;
2264
2265         ret = register_pernet_subsys(&ip6_tables_net_ops);
2266         if (ret < 0)
2267                 goto err1;
2268
2269         /* No one else will be downing sem now, so we won't sleep */
2270         ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2271         if (ret < 0)
2272                 goto err2;
2273         ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2274         if (ret < 0)
2275                 goto err4;
2276
2277         /* Register setsockopt */
2278         ret = nf_register_sockopt(&ip6t_sockopts);
2279         if (ret < 0)
2280                 goto err5;
2281
2282         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2283         return 0;
2284
2285 err5:
2286         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2287 err4:
2288         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2289 err2:
2290         unregister_pernet_subsys(&ip6_tables_net_ops);
2291 err1:
2292         return ret;
2293 }
2294
2295 static void __exit ip6_tables_fini(void)
2296 {
2297         nf_unregister_sockopt(&ip6t_sockopts);
2298
2299         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2300         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2301         unregister_pernet_subsys(&ip6_tables_net_ops);
2302 }
2303
2304 EXPORT_SYMBOL(ip6t_register_table);
2305 EXPORT_SYMBOL(ip6t_unregister_table);
2306 EXPORT_SYMBOL(ip6t_do_table);
2307
2308 module_init(ip6_tables_init);
2309 module_exit(ip6_tables_fini);