2 * Packet matching code.
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 #include <linux/kernel.h>
16 #include <linux/capability.h>
18 #include <linux/skbuff.h>
19 #include <linux/kmod.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netdevice.h>
22 #include <linux/module.h>
23 #include <linux/poison.h>
24 #include <linux/icmpv6.h>
26 #include <net/compat.h>
27 #include <asm/uaccess.h>
28 #include <linux/mutex.h>
29 #include <linux/proc_fs.h>
30 #include <linux/err.h>
31 #include <linux/cpumask.h>
33 #include <linux/netfilter_ipv6/ip6_tables.h>
34 #include <linux/netfilter/x_tables.h>
35 #include <net/netfilter/nf_log.h>
36 #include "../../netfilter/xt_repldata.h"
38 MODULE_LICENSE("GPL");
39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
40 MODULE_DESCRIPTION("IPv6 packet filter");
42 #ifdef CONFIG_NETFILTER_DEBUG
43 #define IP_NF_ASSERT(x) WARN_ON(!(x))
45 #define IP_NF_ASSERT(x)
48 void *ip6t_alloc_initial_table(const struct xt_table *info)
50 return xt_alloc_initial_table(ip6t, IP6T);
52 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
55 We keep a set of rules for each CPU, so we can avoid write-locking
56 them in the softirq when updating the counters and therefore
57 only need to read-lock in the softirq; doing a write_lock_bh() in user
58 context stops packets coming through and allows user context to read
59 the counters or update the rules.
61 Hence the start of any table is given by get_table() below. */
63 /* Returns whether matches rule or not. */
64 /* Performance critical - called for every packet */
66 ip6_packet_match(const struct sk_buff *skb,
69 const struct ip6t_ip6 *ip6info,
70 unsigned int *protoff,
71 int *fragoff, bool *hotdrop)
74 const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
76 if (NF_INVF(ip6info, IP6T_INV_SRCIP,
77 ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
79 NF_INVF(ip6info, IP6T_INV_DSTIP,
80 ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
84 ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
86 if (NF_INVF(ip6info, IP6T_INV_VIA_IN, ret != 0))
89 ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
91 if (NF_INVF(ip6info, IP6T_INV_VIA_OUT, ret != 0))
94 /* ... might want to do something with class and flowlabel here ... */
96 /* look for the desired protocol header */
97 if (ip6info->flags & IP6T_F_PROTO) {
99 unsigned short _frag_off;
101 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
107 *fragoff = _frag_off;
109 if (ip6info->proto == protohdr) {
110 if (ip6info->invflags & IP6T_INV_PROTO)
116 /* We need match for the '-p all', too! */
117 if ((ip6info->proto != 0) &&
118 !(ip6info->invflags & IP6T_INV_PROTO))
124 /* should be ip6 safe */
126 ip6_checkentry(const struct ip6t_ip6 *ipv6)
128 if (ipv6->flags & ~IP6T_F_MASK)
130 if (ipv6->invflags & ~IP6T_INV_MASK)
137 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
139 net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
144 static inline struct ip6t_entry *
145 get_entry(const void *base, unsigned int offset)
147 return (struct ip6t_entry *)(base + offset);
150 /* All zeroes == unconditional rule. */
151 /* Mildly perf critical (only if packet tracing is on) */
152 static inline bool unconditional(const struct ip6t_entry *e)
154 static const struct ip6t_ip6 uncond;
156 return e->target_offset == sizeof(struct ip6t_entry) &&
157 memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
160 static inline const struct xt_entry_target *
161 ip6t_get_target_c(const struct ip6t_entry *e)
163 return ip6t_get_target((struct ip6t_entry *)e);
166 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
167 /* This cries for unification! */
168 static const char *const hooknames[] = {
169 [NF_INET_PRE_ROUTING] = "PREROUTING",
170 [NF_INET_LOCAL_IN] = "INPUT",
171 [NF_INET_FORWARD] = "FORWARD",
172 [NF_INET_LOCAL_OUT] = "OUTPUT",
173 [NF_INET_POST_ROUTING] = "POSTROUTING",
176 enum nf_ip_trace_comments {
177 NF_IP6_TRACE_COMMENT_RULE,
178 NF_IP6_TRACE_COMMENT_RETURN,
179 NF_IP6_TRACE_COMMENT_POLICY,
182 static const char *const comments[] = {
183 [NF_IP6_TRACE_COMMENT_RULE] = "rule",
184 [NF_IP6_TRACE_COMMENT_RETURN] = "return",
185 [NF_IP6_TRACE_COMMENT_POLICY] = "policy",
188 static struct nf_loginfo trace_loginfo = {
189 .type = NF_LOG_TYPE_LOG,
192 .level = LOGLEVEL_WARNING,
193 .logflags = NF_LOG_MASK,
198 /* Mildly perf critical (only if packet tracing is on) */
200 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
201 const char *hookname, const char **chainname,
202 const char **comment, unsigned int *rulenum)
204 const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
206 if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
207 /* Head of user chain: ERROR target with chainname */
208 *chainname = t->target.data;
213 if (unconditional(s) &&
214 strcmp(t->target.u.kernel.target->name,
215 XT_STANDARD_TARGET) == 0 &&
217 /* Tail of chains: STANDARD target (return/policy) */
218 *comment = *chainname == hookname
219 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
220 : comments[NF_IP6_TRACE_COMMENT_RETURN];
229 static void trace_packet(struct net *net,
230 const struct sk_buff *skb,
232 const struct net_device *in,
233 const struct net_device *out,
234 const char *tablename,
235 const struct xt_table_info *private,
236 const struct ip6t_entry *e)
238 const struct ip6t_entry *root;
239 const char *hookname, *chainname, *comment;
240 const struct ip6t_entry *iter;
241 unsigned int rulenum = 0;
243 root = get_entry(private->entries, private->hook_entry[hook]);
245 hookname = chainname = hooknames[hook];
246 comment = comments[NF_IP6_TRACE_COMMENT_RULE];
248 xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
249 if (get_chainname_rulenum(iter, e, hookname,
250 &chainname, &comment, &rulenum) != 0)
253 nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
254 "TRACE: %s:%s:%s:%u ",
255 tablename, chainname, comment, rulenum);
259 static inline struct ip6t_entry *
260 ip6t_next_entry(const struct ip6t_entry *entry)
262 return (void *)entry + entry->next_offset;
265 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
267 ip6t_do_table(struct sk_buff *skb,
268 const struct nf_hook_state *state,
269 struct xt_table *table)
271 unsigned int hook = state->hook;
272 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
273 /* Initializing verdict to NF_DROP keeps gcc happy. */
274 unsigned int verdict = NF_DROP;
275 const char *indev, *outdev;
276 const void *table_base;
277 struct ip6t_entry *e, **jumpstack;
278 unsigned int stackidx, cpu;
279 const struct xt_table_info *private;
280 struct xt_action_param acpar;
285 indev = state->in ? state->in->name : nulldevname;
286 outdev = state->out ? state->out->name : nulldevname;
287 /* We handle fragments by dealing with the first fragment as
288 * if it was a normal packet. All other fragments are treated
289 * normally, except that they will NEVER match rules that ask
290 * things we don't know, ie. tcp syn flag or ports). If the
291 * rule is also a fragment-specific rule, non-fragments won't
293 acpar.hotdrop = false;
294 acpar.net = state->net;
295 acpar.in = state->in;
296 acpar.out = state->out;
297 acpar.family = NFPROTO_IPV6;
298 acpar.hooknum = hook;
300 IP_NF_ASSERT(table->valid_hooks & (1 << hook));
303 addend = xt_write_recseq_begin();
304 private = table->private;
306 * Ensure we load private-> members after we've fetched the base
309 smp_read_barrier_depends();
310 cpu = smp_processor_id();
311 table_base = private->entries;
312 jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
314 /* Switch to alternate jumpstack if we're being invoked via TEE.
315 * TEE issues XT_CONTINUE verdict on original skb so we must not
316 * clobber the jumpstack.
318 * For recursion via REJECT or SYNPROXY the stack will be clobbered
319 * but it is no problem since absolute verdict is issued by these.
321 if (static_key_false(&xt_tee_enabled))
322 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
324 e = get_entry(table_base, private->hook_entry[hook]);
327 const struct xt_entry_target *t;
328 const struct xt_entry_match *ematch;
329 struct xt_counters *counter;
333 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
334 &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
336 e = ip6t_next_entry(e);
340 xt_ematch_foreach(ematch, e) {
341 acpar.match = ematch->u.kernel.match;
342 acpar.matchinfo = ematch->data;
343 if (!acpar.match->match(skb, &acpar))
347 counter = xt_get_this_cpu_counter(&e->counters);
348 ADD_COUNTER(*counter, skb->len, 1);
350 t = ip6t_get_target_c(e);
351 IP_NF_ASSERT(t->u.kernel.target);
353 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
354 /* The packet is traced: log it */
355 if (unlikely(skb->nf_trace))
356 trace_packet(state->net, skb, hook, state->in,
357 state->out, table->name, private, e);
359 /* Standard target? */
360 if (!t->u.kernel.target->target) {
363 v = ((struct xt_standard_target *)t)->verdict;
365 /* Pop from stack? */
366 if (v != XT_RETURN) {
367 verdict = (unsigned int)(-v) - 1;
371 e = get_entry(table_base,
372 private->underflow[hook]);
374 e = ip6t_next_entry(jumpstack[--stackidx]);
377 if (table_base + v != ip6t_next_entry(e) &&
378 !(e->ipv6.flags & IP6T_F_GOTO)) {
379 jumpstack[stackidx++] = e;
382 e = get_entry(table_base, v);
386 acpar.target = t->u.kernel.target;
387 acpar.targinfo = t->data;
389 verdict = t->u.kernel.target->target(skb, &acpar);
390 if (verdict == XT_CONTINUE)
391 e = ip6t_next_entry(e);
395 } while (!acpar.hotdrop);
397 xt_write_recseq_end(addend);
405 /* Figures out from what hook each rule can be called: returns 0 if
406 there are loops. Puts hook bitmask in comefrom. */
408 mark_source_chains(const struct xt_table_info *newinfo,
409 unsigned int valid_hooks, void *entry0,
410 unsigned int *offsets)
414 /* No recursion; use packet counter to save back ptrs (reset
415 to 0 as we leave), and comefrom to save source hook bitmask */
416 for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
417 unsigned int pos = newinfo->hook_entry[hook];
418 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
420 if (!(valid_hooks & (1 << hook)))
423 /* Set initial back pointer. */
424 e->counters.pcnt = pos;
427 const struct xt_standard_target *t
428 = (void *)ip6t_get_target_c(e);
429 int visited = e->comefrom & (1 << hook);
431 if (e->comefrom & (1 << NF_INET_NUMHOOKS))
434 e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
436 /* Unconditional return/END. */
437 if ((unconditional(e) &&
438 (strcmp(t->target.u.user.name,
439 XT_STANDARD_TARGET) == 0) &&
440 t->verdict < 0) || visited) {
441 unsigned int oldpos, size;
443 if ((strcmp(t->target.u.user.name,
444 XT_STANDARD_TARGET) == 0) &&
445 t->verdict < -NF_MAX_VERDICT - 1)
448 /* Return: backtrack through the last
451 e->comefrom ^= (1<<NF_INET_NUMHOOKS);
453 pos = e->counters.pcnt;
454 e->counters.pcnt = 0;
456 /* We're at the start. */
460 e = (struct ip6t_entry *)
462 } while (oldpos == pos + e->next_offset);
465 size = e->next_offset;
466 e = (struct ip6t_entry *)
467 (entry0 + pos + size);
468 if (pos + size >= newinfo->size)
470 e->counters.pcnt = pos;
473 int newpos = t->verdict;
475 if (strcmp(t->target.u.user.name,
476 XT_STANDARD_TARGET) == 0 &&
478 /* This a jump; chase it. */
479 if (!xt_find_jump_offset(offsets, newpos,
482 e = (struct ip6t_entry *)
485 /* ... this is a fallthru */
486 newpos = pos + e->next_offset;
487 if (newpos >= newinfo->size)
490 e = (struct ip6t_entry *)
492 e->counters.pcnt = pos;
501 static void cleanup_match(struct xt_entry_match *m, struct net *net)
503 struct xt_mtdtor_param par;
506 par.match = m->u.kernel.match;
507 par.matchinfo = m->data;
508 par.family = NFPROTO_IPV6;
509 if (par.match->destroy != NULL)
510 par.match->destroy(&par);
511 module_put(par.match->me);
514 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
516 const struct ip6t_ip6 *ipv6 = par->entryinfo;
518 par->match = m->u.kernel.match;
519 par->matchinfo = m->data;
521 return xt_check_match(par, m->u.match_size - sizeof(*m),
522 ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
526 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
528 struct xt_match *match;
531 match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
534 return PTR_ERR(match);
536 m->u.kernel.match = match;
538 ret = check_match(m, par);
544 module_put(m->u.kernel.match->me);
548 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
550 struct xt_entry_target *t = ip6t_get_target(e);
551 struct xt_tgchk_param par = {
555 .target = t->u.kernel.target,
557 .hook_mask = e->comefrom,
558 .family = NFPROTO_IPV6,
561 t = ip6t_get_target(e);
562 return xt_check_target(&par, t->u.target_size - sizeof(*t),
564 e->ipv6.invflags & IP6T_INV_PROTO);
568 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
571 struct xt_entry_target *t;
572 struct xt_target *target;
575 struct xt_mtchk_param mtpar;
576 struct xt_entry_match *ematch;
579 pcnt = xt_percpu_counter_alloc();
580 if (IS_ERR_VALUE(pcnt))
582 e->counters.pcnt = pcnt;
587 mtpar.entryinfo = &e->ipv6;
588 mtpar.hook_mask = e->comefrom;
589 mtpar.family = NFPROTO_IPV6;
590 xt_ematch_foreach(ematch, e) {
591 ret = find_check_match(ematch, &mtpar);
593 goto cleanup_matches;
597 t = ip6t_get_target(e);
598 target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
600 if (IS_ERR(target)) {
601 ret = PTR_ERR(target);
602 goto cleanup_matches;
604 t->u.kernel.target = target;
606 ret = check_target(e, net, name);
611 module_put(t->u.kernel.target->me);
613 xt_ematch_foreach(ematch, e) {
616 cleanup_match(ematch, net);
619 xt_percpu_counter_free(e->counters.pcnt);
624 static bool check_underflow(const struct ip6t_entry *e)
626 const struct xt_entry_target *t;
627 unsigned int verdict;
629 if (!unconditional(e))
631 t = ip6t_get_target_c(e);
632 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
634 verdict = ((struct xt_standard_target *)t)->verdict;
635 verdict = -verdict - 1;
636 return verdict == NF_DROP || verdict == NF_ACCEPT;
640 check_entry_size_and_hooks(struct ip6t_entry *e,
641 struct xt_table_info *newinfo,
642 const unsigned char *base,
643 const unsigned char *limit,
644 const unsigned int *hook_entries,
645 const unsigned int *underflows,
646 unsigned int valid_hooks)
651 if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
652 (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
653 (unsigned char *)e + e->next_offset > limit)
657 < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target))
660 if (!ip6_checkentry(&e->ipv6))
663 err = xt_check_entry_offsets(e, e->elems, e->target_offset,
668 /* Check hooks & underflows */
669 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
670 if (!(valid_hooks & (1 << h)))
672 if ((unsigned char *)e - base == hook_entries[h])
673 newinfo->hook_entry[h] = hook_entries[h];
674 if ((unsigned char *)e - base == underflows[h]) {
675 if (!check_underflow(e))
678 newinfo->underflow[h] = underflows[h];
682 /* Clear counters and comefrom */
683 e->counters = ((struct xt_counters) { 0, 0 });
688 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
690 struct xt_tgdtor_param par;
691 struct xt_entry_target *t;
692 struct xt_entry_match *ematch;
694 /* Cleanup all matches */
695 xt_ematch_foreach(ematch, e)
696 cleanup_match(ematch, net);
697 t = ip6t_get_target(e);
700 par.target = t->u.kernel.target;
701 par.targinfo = t->data;
702 par.family = NFPROTO_IPV6;
703 if (par.target->destroy != NULL)
704 par.target->destroy(&par);
705 module_put(par.target->me);
707 xt_percpu_counter_free(e->counters.pcnt);
710 /* Checks and translates the user-supplied table segment (held in
713 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
714 const struct ip6t_replace *repl)
716 struct ip6t_entry *iter;
717 unsigned int *offsets;
721 newinfo->size = repl->size;
722 newinfo->number = repl->num_entries;
724 /* Init all hooks to impossible value. */
725 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
726 newinfo->hook_entry[i] = 0xFFFFFFFF;
727 newinfo->underflow[i] = 0xFFFFFFFF;
730 offsets = xt_alloc_entry_offsets(newinfo->number);
734 /* Walk through entries, checking offsets. */
735 xt_entry_foreach(iter, entry0, newinfo->size) {
736 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
743 if (i < repl->num_entries)
744 offsets[i] = (void *)iter - entry0;
746 if (strcmp(ip6t_get_target(iter)->u.user.name,
747 XT_ERROR_TARGET) == 0)
748 ++newinfo->stacksize;
752 if (i != repl->num_entries)
755 /* Check hooks all assigned */
756 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
757 /* Only hooks which are valid */
758 if (!(repl->valid_hooks & (1 << i)))
760 if (newinfo->hook_entry[i] == 0xFFFFFFFF)
762 if (newinfo->underflow[i] == 0xFFFFFFFF)
766 if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) {
772 /* Finally, each sanity check must pass */
774 xt_entry_foreach(iter, entry0, newinfo->size) {
775 ret = find_check_entry(iter, net, repl->name, repl->size);
782 xt_entry_foreach(iter, entry0, newinfo->size) {
785 cleanup_entry(iter, net);
797 get_counters(const struct xt_table_info *t,
798 struct xt_counters counters[])
800 struct ip6t_entry *iter;
804 for_each_possible_cpu(cpu) {
805 seqcount_t *s = &per_cpu(xt_recseq, cpu);
808 xt_entry_foreach(iter, t->entries, t->size) {
809 struct xt_counters *tmp;
813 tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
815 start = read_seqcount_begin(s);
818 } while (read_seqcount_retry(s, start));
820 ADD_COUNTER(counters[i], bcnt, pcnt);
826 static struct xt_counters *alloc_counters(const struct xt_table *table)
828 unsigned int countersize;
829 struct xt_counters *counters;
830 const struct xt_table_info *private = table->private;
832 /* We need atomic snapshot of counters: rest doesn't change
833 (other than comefrom, which userspace doesn't care
835 countersize = sizeof(struct xt_counters) * private->number;
836 counters = vzalloc(countersize);
838 if (counters == NULL)
839 return ERR_PTR(-ENOMEM);
841 get_counters(private, counters);
847 copy_entries_to_user(unsigned int total_size,
848 const struct xt_table *table,
849 void __user *userptr)
851 unsigned int off, num;
852 const struct ip6t_entry *e;
853 struct xt_counters *counters;
854 const struct xt_table_info *private = table->private;
856 const void *loc_cpu_entry;
858 counters = alloc_counters(table);
859 if (IS_ERR(counters))
860 return PTR_ERR(counters);
862 loc_cpu_entry = private->entries;
863 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
868 /* FIXME: use iterator macros --RR */
869 /* ... then go back and fix counters and names */
870 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
872 const struct xt_entry_match *m;
873 const struct xt_entry_target *t;
875 e = (struct ip6t_entry *)(loc_cpu_entry + off);
876 if (copy_to_user(userptr + off
877 + offsetof(struct ip6t_entry, counters),
879 sizeof(counters[num])) != 0) {
884 for (i = sizeof(struct ip6t_entry);
885 i < e->target_offset;
886 i += m->u.match_size) {
889 if (copy_to_user(userptr + off + i
890 + offsetof(struct xt_entry_match,
892 m->u.kernel.match->name,
893 strlen(m->u.kernel.match->name)+1)
900 t = ip6t_get_target_c(e);
901 if (copy_to_user(userptr + off + e->target_offset
902 + offsetof(struct xt_entry_target,
904 t->u.kernel.target->name,
905 strlen(t->u.kernel.target->name)+1) != 0) {
917 static void compat_standard_from_user(void *dst, const void *src)
919 int v = *(compat_int_t *)src;
922 v += xt_compat_calc_jump(AF_INET6, v);
923 memcpy(dst, &v, sizeof(v));
926 static int compat_standard_to_user(void __user *dst, const void *src)
928 compat_int_t cv = *(int *)src;
931 cv -= xt_compat_calc_jump(AF_INET6, cv);
932 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
935 static int compat_calc_entry(const struct ip6t_entry *e,
936 const struct xt_table_info *info,
937 const void *base, struct xt_table_info *newinfo)
939 const struct xt_entry_match *ematch;
940 const struct xt_entry_target *t;
941 unsigned int entry_offset;
944 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
945 entry_offset = (void *)e - base;
946 xt_ematch_foreach(ematch, e)
947 off += xt_compat_match_offset(ematch->u.kernel.match);
948 t = ip6t_get_target_c(e);
949 off += xt_compat_target_offset(t->u.kernel.target);
950 newinfo->size -= off;
951 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
955 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
956 if (info->hook_entry[i] &&
957 (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
958 newinfo->hook_entry[i] -= off;
959 if (info->underflow[i] &&
960 (e < (struct ip6t_entry *)(base + info->underflow[i])))
961 newinfo->underflow[i] -= off;
966 static int compat_table_info(const struct xt_table_info *info,
967 struct xt_table_info *newinfo)
969 struct ip6t_entry *iter;
970 const void *loc_cpu_entry;
973 if (!newinfo || !info)
976 /* we dont care about newinfo->entries */
977 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
978 newinfo->initial_entries = 0;
979 loc_cpu_entry = info->entries;
980 xt_compat_init_offsets(AF_INET6, info->number);
981 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
982 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
990 static int get_info(struct net *net, void __user *user,
991 const int *len, int compat)
993 char name[XT_TABLE_MAXNAMELEN];
997 if (*len != sizeof(struct ip6t_getinfo))
1000 if (copy_from_user(name, user, sizeof(name)) != 0)
1003 name[XT_TABLE_MAXNAMELEN-1] = '\0';
1004 #ifdef CONFIG_COMPAT
1006 xt_compat_lock(AF_INET6);
1008 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1009 "ip6table_%s", name);
1010 if (!IS_ERR_OR_NULL(t)) {
1011 struct ip6t_getinfo info;
1012 const struct xt_table_info *private = t->private;
1013 #ifdef CONFIG_COMPAT
1014 struct xt_table_info tmp;
1017 ret = compat_table_info(private, &tmp);
1018 xt_compat_flush_offsets(AF_INET6);
1022 memset(&info, 0, sizeof(info));
1023 info.valid_hooks = t->valid_hooks;
1024 memcpy(info.hook_entry, private->hook_entry,
1025 sizeof(info.hook_entry));
1026 memcpy(info.underflow, private->underflow,
1027 sizeof(info.underflow));
1028 info.num_entries = private->number;
1029 info.size = private->size;
1030 strcpy(info.name, name);
1032 if (copy_to_user(user, &info, *len) != 0)
1040 ret = t ? PTR_ERR(t) : -ENOENT;
1041 #ifdef CONFIG_COMPAT
1043 xt_compat_unlock(AF_INET6);
1049 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1053 struct ip6t_get_entries get;
1056 if (*len < sizeof(get))
1058 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1060 if (*len != sizeof(struct ip6t_get_entries) + get.size)
1063 get.name[sizeof(get.name) - 1] = '\0';
1065 t = xt_find_table_lock(net, AF_INET6, get.name);
1066 if (!IS_ERR_OR_NULL(t)) {
1067 struct xt_table_info *private = t->private;
1068 if (get.size == private->size)
1069 ret = copy_entries_to_user(private->size,
1070 t, uptr->entrytable);
1077 ret = t ? PTR_ERR(t) : -ENOENT;
1083 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1084 struct xt_table_info *newinfo, unsigned int num_counters,
1085 void __user *counters_ptr)
1089 struct xt_table_info *oldinfo;
1090 struct xt_counters *counters;
1091 struct ip6t_entry *iter;
1094 counters = vzalloc(num_counters * sizeof(struct xt_counters));
1100 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1101 "ip6table_%s", name);
1102 if (IS_ERR_OR_NULL(t)) {
1103 ret = t ? PTR_ERR(t) : -ENOENT;
1104 goto free_newinfo_counters_untrans;
1108 if (valid_hooks != t->valid_hooks) {
1113 oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1117 /* Update module usage count based on number of rules */
1118 if ((oldinfo->number > oldinfo->initial_entries) ||
1119 (newinfo->number <= oldinfo->initial_entries))
1121 if ((oldinfo->number > oldinfo->initial_entries) &&
1122 (newinfo->number <= oldinfo->initial_entries))
1125 /* Get the old counters, and synchronize with replace */
1126 get_counters(oldinfo, counters);
1128 /* Decrease module usage counts and free resource */
1129 xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1130 cleanup_entry(iter, net);
1132 xt_free_table_info(oldinfo);
1133 if (copy_to_user(counters_ptr, counters,
1134 sizeof(struct xt_counters) * num_counters) != 0) {
1135 /* Silent error, can't fail, new table is already in place */
1136 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1145 free_newinfo_counters_untrans:
1152 do_replace(struct net *net, const void __user *user, unsigned int len)
1155 struct ip6t_replace tmp;
1156 struct xt_table_info *newinfo;
1157 void *loc_cpu_entry;
1158 struct ip6t_entry *iter;
1160 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1163 /* overflow check */
1164 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1166 if (tmp.num_counters == 0)
1169 tmp.name[sizeof(tmp.name)-1] = 0;
1171 newinfo = xt_alloc_table_info(tmp.size);
1175 loc_cpu_entry = newinfo->entries;
1176 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1182 ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1186 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1187 tmp.num_counters, tmp.counters);
1189 goto free_newinfo_untrans;
1192 free_newinfo_untrans:
1193 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1194 cleanup_entry(iter, net);
1196 xt_free_table_info(newinfo);
1201 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1205 struct xt_counters_info tmp;
1206 struct xt_counters *paddc;
1208 const struct xt_table_info *private;
1210 struct ip6t_entry *iter;
1211 unsigned int addend;
1213 paddc = xt_copy_counters_from_user(user, len, &tmp, compat);
1215 return PTR_ERR(paddc);
1216 t = xt_find_table_lock(net, AF_INET6, tmp.name);
1217 if (IS_ERR_OR_NULL(t)) {
1218 ret = t ? PTR_ERR(t) : -ENOENT;
1223 private = t->private;
1224 if (private->number != tmp.num_counters) {
1226 goto unlock_up_free;
1230 addend = xt_write_recseq_begin();
1231 xt_entry_foreach(iter, private->entries, private->size) {
1232 struct xt_counters *tmp;
1234 tmp = xt_get_this_cpu_counter(&iter->counters);
1235 ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1238 xt_write_recseq_end(addend);
1249 #ifdef CONFIG_COMPAT
1250 struct compat_ip6t_replace {
1251 char name[XT_TABLE_MAXNAMELEN];
1255 u32 hook_entry[NF_INET_NUMHOOKS];
1256 u32 underflow[NF_INET_NUMHOOKS];
1258 compat_uptr_t counters; /* struct xt_counters * */
1259 struct compat_ip6t_entry entries[0];
1263 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1264 unsigned int *size, struct xt_counters *counters,
1267 struct xt_entry_target *t;
1268 struct compat_ip6t_entry __user *ce;
1269 u_int16_t target_offset, next_offset;
1270 compat_uint_t origsize;
1271 const struct xt_entry_match *ematch;
1275 ce = (struct compat_ip6t_entry __user *)*dstptr;
1276 if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1277 copy_to_user(&ce->counters, &counters[i],
1278 sizeof(counters[i])) != 0)
1281 *dstptr += sizeof(struct compat_ip6t_entry);
1282 *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1284 xt_ematch_foreach(ematch, e) {
1285 ret = xt_compat_match_to_user(ematch, dstptr, size);
1289 target_offset = e->target_offset - (origsize - *size);
1290 t = ip6t_get_target(e);
1291 ret = xt_compat_target_to_user(t, dstptr, size);
1294 next_offset = e->next_offset - (origsize - *size);
1295 if (put_user(target_offset, &ce->target_offset) != 0 ||
1296 put_user(next_offset, &ce->next_offset) != 0)
1302 compat_find_calc_match(struct xt_entry_match *m,
1303 const struct ip6t_ip6 *ipv6,
1306 struct xt_match *match;
1308 match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1309 m->u.user.revision);
1311 return PTR_ERR(match);
1313 m->u.kernel.match = match;
1314 *size += xt_compat_match_offset(match);
1318 static void compat_release_entry(struct compat_ip6t_entry *e)
1320 struct xt_entry_target *t;
1321 struct xt_entry_match *ematch;
1323 /* Cleanup all matches */
1324 xt_ematch_foreach(ematch, e)
1325 module_put(ematch->u.kernel.match->me);
1326 t = compat_ip6t_get_target(e);
1327 module_put(t->u.kernel.target->me);
1331 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1332 struct xt_table_info *newinfo,
1334 const unsigned char *base,
1335 const unsigned char *limit)
1337 struct xt_entry_match *ematch;
1338 struct xt_entry_target *t;
1339 struct xt_target *target;
1340 unsigned int entry_offset;
1344 if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1345 (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
1346 (unsigned char *)e + e->next_offset > limit)
1349 if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1350 sizeof(struct compat_xt_entry_target))
1353 if (!ip6_checkentry(&e->ipv6))
1356 ret = xt_compat_check_entry_offsets(e, e->elems,
1357 e->target_offset, e->next_offset);
1361 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1362 entry_offset = (void *)e - (void *)base;
1364 xt_ematch_foreach(ematch, e) {
1365 ret = compat_find_calc_match(ematch, &e->ipv6, &off);
1367 goto release_matches;
1371 t = compat_ip6t_get_target(e);
1372 target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1373 t->u.user.revision);
1374 if (IS_ERR(target)) {
1375 ret = PTR_ERR(target);
1376 goto release_matches;
1378 t->u.kernel.target = target;
1380 off += xt_compat_target_offset(target);
1382 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1389 module_put(t->u.kernel.target->me);
1391 xt_ematch_foreach(ematch, e) {
1394 module_put(ematch->u.kernel.match->me);
1400 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1402 struct xt_table_info *newinfo, unsigned char *base)
1404 struct xt_entry_target *t;
1405 struct ip6t_entry *de;
1406 unsigned int origsize;
1408 struct xt_entry_match *ematch;
1411 de = (struct ip6t_entry *)*dstptr;
1412 memcpy(de, e, sizeof(struct ip6t_entry));
1413 memcpy(&de->counters, &e->counters, sizeof(e->counters));
1415 *dstptr += sizeof(struct ip6t_entry);
1416 *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1418 xt_ematch_foreach(ematch, e)
1419 xt_compat_match_from_user(ematch, dstptr, size);
1421 de->target_offset = e->target_offset - (origsize - *size);
1422 t = compat_ip6t_get_target(e);
1423 xt_compat_target_from_user(t, dstptr, size);
1425 de->next_offset = e->next_offset - (origsize - *size);
1426 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1427 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1428 newinfo->hook_entry[h] -= origsize - *size;
1429 if ((unsigned char *)de - base < newinfo->underflow[h])
1430 newinfo->underflow[h] -= origsize - *size;
1435 translate_compat_table(struct net *net,
1436 struct xt_table_info **pinfo,
1438 const struct compat_ip6t_replace *compatr)
1441 struct xt_table_info *newinfo, *info;
1442 void *pos, *entry0, *entry1;
1443 struct compat_ip6t_entry *iter0;
1444 struct ip6t_replace repl;
1450 size = compatr->size;
1451 info->number = compatr->num_entries;
1454 xt_compat_lock(AF_INET6);
1455 xt_compat_init_offsets(AF_INET6, compatr->num_entries);
1456 /* Walk through entries, checking offsets. */
1457 xt_entry_foreach(iter0, entry0, compatr->size) {
1458 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1460 entry0 + compatr->size);
1467 if (j != compatr->num_entries)
1471 newinfo = xt_alloc_table_info(size);
1475 newinfo->number = compatr->num_entries;
1476 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1477 newinfo->hook_entry[i] = compatr->hook_entry[i];
1478 newinfo->underflow[i] = compatr->underflow[i];
1480 entry1 = newinfo->entries;
1482 size = compatr->size;
1483 xt_entry_foreach(iter0, entry0, compatr->size)
1484 compat_copy_entry_from_user(iter0, &pos, &size,
1487 /* all module references in entry0 are now gone. */
1488 xt_compat_flush_offsets(AF_INET6);
1489 xt_compat_unlock(AF_INET6);
1491 memcpy(&repl, compatr, sizeof(*compatr));
1493 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1494 repl.hook_entry[i] = newinfo->hook_entry[i];
1495 repl.underflow[i] = newinfo->underflow[i];
1498 repl.num_counters = 0;
1499 repl.counters = NULL;
1500 repl.size = newinfo->size;
1501 ret = translate_table(net, newinfo, entry1, &repl);
1507 xt_free_table_info(info);
1511 xt_free_table_info(newinfo);
1514 xt_compat_flush_offsets(AF_INET6);
1515 xt_compat_unlock(AF_INET6);
1516 xt_entry_foreach(iter0, entry0, compatr->size) {
1519 compat_release_entry(iter0);
1525 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1528 struct compat_ip6t_replace tmp;
1529 struct xt_table_info *newinfo;
1530 void *loc_cpu_entry;
1531 struct ip6t_entry *iter;
1533 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1536 /* overflow check */
1537 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1539 if (tmp.num_counters == 0)
1542 tmp.name[sizeof(tmp.name)-1] = 0;
1544 newinfo = xt_alloc_table_info(tmp.size);
1548 loc_cpu_entry = newinfo->entries;
1549 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1555 ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
1559 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1560 tmp.num_counters, compat_ptr(tmp.counters));
1562 goto free_newinfo_untrans;
1565 free_newinfo_untrans:
1566 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1567 cleanup_entry(iter, net);
1569 xt_free_table_info(newinfo);
1574 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1579 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1583 case IP6T_SO_SET_REPLACE:
1584 ret = compat_do_replace(sock_net(sk), user, len);
1587 case IP6T_SO_SET_ADD_COUNTERS:
1588 ret = do_add_counters(sock_net(sk), user, len, 1);
1598 struct compat_ip6t_get_entries {
1599 char name[XT_TABLE_MAXNAMELEN];
1601 struct compat_ip6t_entry entrytable[0];
1605 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1606 void __user *userptr)
1608 struct xt_counters *counters;
1609 const struct xt_table_info *private = table->private;
1614 struct ip6t_entry *iter;
1616 counters = alloc_counters(table);
1617 if (IS_ERR(counters))
1618 return PTR_ERR(counters);
1622 xt_entry_foreach(iter, private->entries, total_size) {
1623 ret = compat_copy_entry_to_user(iter, &pos,
1624 &size, counters, i++);
1634 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1638 struct compat_ip6t_get_entries get;
1641 if (*len < sizeof(get))
1644 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1647 if (*len != sizeof(struct compat_ip6t_get_entries) + get.size)
1650 get.name[sizeof(get.name) - 1] = '\0';
1652 xt_compat_lock(AF_INET6);
1653 t = xt_find_table_lock(net, AF_INET6, get.name);
1654 if (!IS_ERR_OR_NULL(t)) {
1655 const struct xt_table_info *private = t->private;
1656 struct xt_table_info info;
1657 ret = compat_table_info(private, &info);
1658 if (!ret && get.size == info.size)
1659 ret = compat_copy_entries_to_user(private->size,
1660 t, uptr->entrytable);
1664 xt_compat_flush_offsets(AF_INET6);
1668 ret = t ? PTR_ERR(t) : -ENOENT;
1670 xt_compat_unlock(AF_INET6);
1674 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1677 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1681 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1685 case IP6T_SO_GET_INFO:
1686 ret = get_info(sock_net(sk), user, len, 1);
1688 case IP6T_SO_GET_ENTRIES:
1689 ret = compat_get_entries(sock_net(sk), user, len);
1692 ret = do_ip6t_get_ctl(sk, cmd, user, len);
1699 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1703 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1707 case IP6T_SO_SET_REPLACE:
1708 ret = do_replace(sock_net(sk), user, len);
1711 case IP6T_SO_SET_ADD_COUNTERS:
1712 ret = do_add_counters(sock_net(sk), user, len, 0);
1723 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1727 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1731 case IP6T_SO_GET_INFO:
1732 ret = get_info(sock_net(sk), user, len, 0);
1735 case IP6T_SO_GET_ENTRIES:
1736 ret = get_entries(sock_net(sk), user, len);
1739 case IP6T_SO_GET_REVISION_MATCH:
1740 case IP6T_SO_GET_REVISION_TARGET: {
1741 struct xt_get_revision rev;
1744 if (*len != sizeof(rev)) {
1748 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
1752 rev.name[sizeof(rev.name)-1] = 0;
1754 if (cmd == IP6T_SO_GET_REVISION_TARGET)
1759 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
1762 "ip6t_%s", rev.name);
1773 static void __ip6t_unregister_table(struct net *net, struct xt_table *table)
1775 struct xt_table_info *private;
1776 void *loc_cpu_entry;
1777 struct module *table_owner = table->me;
1778 struct ip6t_entry *iter;
1780 private = xt_unregister_table(table);
1782 /* Decrease module usage counts and free resources */
1783 loc_cpu_entry = private->entries;
1784 xt_entry_foreach(iter, loc_cpu_entry, private->size)
1785 cleanup_entry(iter, net);
1786 if (private->number > private->initial_entries)
1787 module_put(table_owner);
1788 xt_free_table_info(private);
1791 int ip6t_register_table(struct net *net, const struct xt_table *table,
1792 const struct ip6t_replace *repl,
1793 const struct nf_hook_ops *ops,
1794 struct xt_table **res)
1797 struct xt_table_info *newinfo;
1798 struct xt_table_info bootstrap = {0};
1799 void *loc_cpu_entry;
1800 struct xt_table *new_table;
1802 newinfo = xt_alloc_table_info(repl->size);
1806 loc_cpu_entry = newinfo->entries;
1807 memcpy(loc_cpu_entry, repl->entries, repl->size);
1809 ret = translate_table(net, newinfo, loc_cpu_entry, repl);
1813 new_table = xt_register_table(net, table, &bootstrap, newinfo);
1814 if (IS_ERR(new_table)) {
1815 ret = PTR_ERR(new_table);
1819 /* set res now, will see skbs right after nf_register_net_hooks */
1820 WRITE_ONCE(*res, new_table);
1822 ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
1824 __ip6t_unregister_table(net, new_table);
1831 xt_free_table_info(newinfo);
1835 void ip6t_unregister_table(struct net *net, struct xt_table *table,
1836 const struct nf_hook_ops *ops)
1838 nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
1839 __ip6t_unregister_table(net, table);
1842 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
1844 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
1845 u_int8_t type, u_int8_t code,
1848 return (type == test_type && code >= min_code && code <= max_code)
1853 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
1855 const struct icmp6hdr *ic;
1856 struct icmp6hdr _icmph;
1857 const struct ip6t_icmp *icmpinfo = par->matchinfo;
1859 /* Must not be a fragment. */
1860 if (par->fragoff != 0)
1863 ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
1865 /* We've been asked to examine this packet, and we
1866 * can't. Hence, no choice but to drop.
1868 par->hotdrop = true;
1872 return icmp6_type_code_match(icmpinfo->type,
1875 ic->icmp6_type, ic->icmp6_code,
1876 !!(icmpinfo->invflags&IP6T_ICMP_INV));
1879 /* Called when user tries to insert an entry of this type. */
1880 static int icmp6_checkentry(const struct xt_mtchk_param *par)
1882 const struct ip6t_icmp *icmpinfo = par->matchinfo;
1884 /* Must specify no unknown invflags */
1885 return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
1888 /* The built-in targets: standard (NULL) and error. */
1889 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
1891 .name = XT_STANDARD_TARGET,
1892 .targetsize = sizeof(int),
1893 .family = NFPROTO_IPV6,
1894 #ifdef CONFIG_COMPAT
1895 .compatsize = sizeof(compat_int_t),
1896 .compat_from_user = compat_standard_from_user,
1897 .compat_to_user = compat_standard_to_user,
1901 .name = XT_ERROR_TARGET,
1902 .target = ip6t_error,
1903 .targetsize = XT_FUNCTION_MAXNAMELEN,
1904 .family = NFPROTO_IPV6,
1908 static struct nf_sockopt_ops ip6t_sockopts = {
1910 .set_optmin = IP6T_BASE_CTL,
1911 .set_optmax = IP6T_SO_SET_MAX+1,
1912 .set = do_ip6t_set_ctl,
1913 #ifdef CONFIG_COMPAT
1914 .compat_set = compat_do_ip6t_set_ctl,
1916 .get_optmin = IP6T_BASE_CTL,
1917 .get_optmax = IP6T_SO_GET_MAX+1,
1918 .get = do_ip6t_get_ctl,
1919 #ifdef CONFIG_COMPAT
1920 .compat_get = compat_do_ip6t_get_ctl,
1922 .owner = THIS_MODULE,
1925 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
1928 .match = icmp6_match,
1929 .matchsize = sizeof(struct ip6t_icmp),
1930 .checkentry = icmp6_checkentry,
1931 .proto = IPPROTO_ICMPV6,
1932 .family = NFPROTO_IPV6,
1936 static int __net_init ip6_tables_net_init(struct net *net)
1938 return xt_proto_init(net, NFPROTO_IPV6);
1941 static void __net_exit ip6_tables_net_exit(struct net *net)
1943 xt_proto_fini(net, NFPROTO_IPV6);
1946 static struct pernet_operations ip6_tables_net_ops = {
1947 .init = ip6_tables_net_init,
1948 .exit = ip6_tables_net_exit,
1951 static int __init ip6_tables_init(void)
1955 ret = register_pernet_subsys(&ip6_tables_net_ops);
1959 /* No one else will be downing sem now, so we won't sleep */
1960 ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
1963 ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
1967 /* Register setsockopt */
1968 ret = nf_register_sockopt(&ip6t_sockopts);
1972 pr_info("(C) 2000-2006 Netfilter Core Team\n");
1976 xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
1978 xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
1980 unregister_pernet_subsys(&ip6_tables_net_ops);
1985 static void __exit ip6_tables_fini(void)
1987 nf_unregister_sockopt(&ip6t_sockopts);
1989 xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
1990 xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
1991 unregister_pernet_subsys(&ip6_tables_net_ops);
1994 EXPORT_SYMBOL(ip6t_register_table);
1995 EXPORT_SYMBOL(ip6t_unregister_table);
1996 EXPORT_SYMBOL(ip6t_do_table);
1998 module_init(ip6_tables_init);
1999 module_exit(ip6_tables_fini);