net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14
  15 #include <linux/kernel.h>
  16 #include <linux/capability.h>
  17 #include <linux/in.h>
  18 #include <linux/skbuff.h>
  19 #include <linux/kmod.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netdevice.h>
  22 #include <linux/module.h>
  23 #include <linux/poison.h>
  24 #include <linux/icmpv6.h>
  25 #include <net/ipv6.h>
  26 #include <net/compat.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/mutex.h>
  29 #include <linux/proc_fs.h>
  30 #include <linux/err.h>
  31 #include <linux/cpumask.h>
  32
  33 #include <linux/netfilter_ipv6/ip6_tables.h>
  34 #include <linux/netfilter/x_tables.h>
  35 #include <net/netfilter/nf_log.h>
  36 #include "../../netfilter/xt_repldata.h"
  37
  38 MODULE_LICENSE("GPL");
  39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  40 MODULE_DESCRIPTION("IPv6 packet filter");
  41
  42 /*#define DEBUG_IP_FIREWALL*/
  43 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  44 /*#define DEBUG_IP_FIREWALL_USER*/
  45
  46 #ifdef DEBUG_IP_FIREWALL
  47 #define dprintf(format, args...) pr_info(format , ## args)
  48 #else
  49 #define dprintf(format, args...)
  50 #endif
  51
  52 #ifdef DEBUG_IP_FIREWALL_USER
  53 #define duprintf(format, args...) pr_info(format , ## args)
  54 #else
  55 #define duprintf(format, args...)
  56 #endif
  57
  58 #ifdef CONFIG_NETFILTER_DEBUG
  59 #define IP_NF_ASSERT(x) WARN_ON(!(x))
  60 #else
  61 #define IP_NF_ASSERT(x)
  62 #endif
  63
  64 #if 0
  65 /* All the better to debug you with... */
  66 #define static
  67 #define inline
  68 #endif
  69
  70 void *ip6t_alloc_initial_table(const struct xt_table *info)
  71 {
  72         return xt_alloc_initial_table(ip6t, IP6T);
  73 }
  74 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
  75
  76 /*
  77    We keep a set of rules for each CPU, so we can avoid write-locking
  78    them in the softirq when updating the counters and therefore
  79    only need to read-lock in the softirq; doing a write_lock_bh() in user
  80    context stops packets coming through and allows user context to read
  81    the counters or update the rules.
  82
  83    Hence the start of any table is given by get_table() below.  */
  84
  85 /* Returns whether matches rule or not. */
  86 /* Performance critical - called for every packet */
  87 static inline bool
  88 ip6_packet_match(const struct sk_buff *skb,
  89                  const char *indev,
  90                  const char *outdev,
  91                  const struct ip6t_ip6 *ip6info,
  92                  unsigned int *protoff,
  93                  int *fragoff, bool *hotdrop)
  94 {
  95         unsigned long ret;
  96         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
  97
  98 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
  99
 100         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 101                                        &ip6info->src), IP6T_INV_SRCIP) ||
 102             FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 103                                        &ip6info->dst), IP6T_INV_DSTIP)) {
 104                 dprintf("Source or dest mismatch.\n");
 105 /*
 106                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 107                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 108                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 109                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 110                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 111                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 112                 return false;
 113         }
 114
 115         ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 116
 117         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 118                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 119                         indev, ip6info->iniface,
 120                         ip6info->invflags & IP6T_INV_VIA_IN ? " (INV)" : "");
 121                 return false;
 122         }
 123
 124         ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 125
 126         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 127                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 128                         outdev, ip6info->outiface,
 129                         ip6info->invflags & IP6T_INV_VIA_OUT ? " (INV)" : "");
 130                 return false;
 131         }
 132
 133 /* ... might want to do something with class and flowlabel here ... */
 134
 135         /* look for the desired protocol header */
 136         if (ip6info->flags & IP6T_F_PROTO) {
 137                 int protohdr;
 138                 unsigned short _frag_off;
 139
 140                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
 141                 if (protohdr < 0) {
 142                         if (_frag_off == 0)
 143                                 *hotdrop = true;
 144                         return false;
 145                 }
 146                 *fragoff = _frag_off;
 147
 148                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 149                                 protohdr,
 150                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 151                                 ip6info->proto);
 152
 153                 if (ip6info->proto == protohdr) {
 154                         if (ip6info->invflags & IP6T_INV_PROTO)
 155                                 return false;
 156
 157                         return true;
 158                 }
 159
 160                 /* We need match for the '-p all', too! */
 161                 if ((ip6info->proto != 0) &&
 162                         !(ip6info->invflags & IP6T_INV_PROTO))
 163                         return false;
 164         }
 165         return true;
 166 }
 167
 168 /* should be ip6 safe */
 169 static bool
 170 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 171 {
 172         if (ipv6->flags & ~IP6T_F_MASK) {
 173                 duprintf("Unknown flag bits set: %08X\n",
 174                          ipv6->flags & ~IP6T_F_MASK);
 175                 return false;
 176         }
 177         if (ipv6->invflags & ~IP6T_INV_MASK) {
 178                 duprintf("Unknown invflag bits set: %08X\n",
 179                          ipv6->invflags & ~IP6T_INV_MASK);
 180                 return false;
 181         }
 182         return true;
 183 }
 184
 185 static unsigned int
 186 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
 187 {
 188         net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
 189
 190         return NF_DROP;
 191 }
 192
 193 static inline struct ip6t_entry *
 194 get_entry(const void *base, unsigned int offset)
 195 {
 196         return (struct ip6t_entry *)(base + offset);
 197 }
 198
 199 /* All zeroes == unconditional rule. */
 200 /* Mildly perf critical (only if packet tracing is on) */
 201 static inline bool unconditional(const struct ip6t_entry *e)
 202 {
 203         static const struct ip6t_ip6 uncond;
 204
 205         return e->target_offset == sizeof(struct ip6t_entry) &&
 206                memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
 207 }
 208
 209 static inline const struct xt_entry_target *
 210 ip6t_get_target_c(const struct ip6t_entry *e)
 211 {
 212         return ip6t_get_target((struct ip6t_entry *)e);
 213 }
 214
 215 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 216 /* This cries for unification! */
 217 static const char *const hooknames[] = {
 218         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 219         [NF_INET_LOCAL_IN]              = "INPUT",
 220         [NF_INET_FORWARD]               = "FORWARD",
 221         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 222         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 223 };
 224
 225 enum nf_ip_trace_comments {
 226         NF_IP6_TRACE_COMMENT_RULE,
 227         NF_IP6_TRACE_COMMENT_RETURN,
 228         NF_IP6_TRACE_COMMENT_POLICY,
 229 };
 230
 231 static const char *const comments[] = {
 232         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
 233         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
 234         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
 235 };
 236
 237 static struct nf_loginfo trace_loginfo = {
 238         .type = NF_LOG_TYPE_LOG,
 239         .u = {
 240                 .log = {
 241                         .level = LOGLEVEL_WARNING,
 242                         .logflags = NF_LOG_MASK,
 243                 },
 244         },
 245 };
 246
 247 /* Mildly perf critical (only if packet tracing is on) */
 248 static inline int
 249 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
 250                       const char *hookname, const char **chainname,
 251                       const char **comment, unsigned int *rulenum)
 252 {
 253         const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
 254
 255         if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
 256                 /* Head of user chain: ERROR target with chainname */
 257                 *chainname = t->target.data;
 258                 (*rulenum) = 0;
 259         } else if (s == e) {
 260                 (*rulenum)++;
 261
 262                 if (unconditional(s) &&
 263                     strcmp(t->target.u.kernel.target->name,
 264                            XT_STANDARD_TARGET) == 0 &&
 265                     t->verdict < 0) {
 266                         /* Tail of chains: STANDARD target (return/policy) */
 267                         *comment = *chainname == hookname
 268                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
 269                                 : comments[NF_IP6_TRACE_COMMENT_RETURN];
 270                 }
 271                 return 1;
 272         } else
 273                 (*rulenum)++;
 274
 275         return 0;
 276 }
 277
 278 static void trace_packet(struct net *net,
 279                          const struct sk_buff *skb,
 280                          unsigned int hook,
 281                          const struct net_device *in,
 282                          const struct net_device *out,
 283                          const char *tablename,
 284                          const struct xt_table_info *private,
 285                          const struct ip6t_entry *e)
 286 {
 287         const struct ip6t_entry *root;
 288         const char *hookname, *chainname, *comment;
 289         const struct ip6t_entry *iter;
 290         unsigned int rulenum = 0;
 291
 292         root = get_entry(private->entries, private->hook_entry[hook]);
 293
 294         hookname = chainname = hooknames[hook];
 295         comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 296
 297         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 298                 if (get_chainname_rulenum(iter, e, hookname,
 299                     &chainname, &comment, &rulenum) != 0)
 300                         break;
 301
 302         nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
 303                      "TRACE: %s:%s:%s:%u ",
 304                      tablename, chainname, comment, rulenum);
 305 }
 306 #endif
 307
 308 static inline struct ip6t_entry *
 309 ip6t_next_entry(const struct ip6t_entry *entry)
 310 {
 311         return (void *)entry + entry->next_offset;
 312 }
 313
 314 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 315 unsigned int
 316 ip6t_do_table(struct sk_buff *skb,
 317               const struct nf_hook_state *state,
 318               struct xt_table *table)
 319 {
 320         unsigned int hook = state->hook;
 321         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 322         /* Initializing verdict to NF_DROP keeps gcc happy. */
 323         unsigned int verdict = NF_DROP;
 324         const char *indev, *outdev;
 325         const void *table_base;
 326         struct ip6t_entry *e, **jumpstack;
 327         unsigned int stackidx, cpu;
 328         const struct xt_table_info *private;
 329         struct xt_action_param acpar;
 330         unsigned int addend;
 331
 332         /* Initialization */
 333         stackidx = 0;
 334         indev = state->in ? state->in->name : nulldevname;
 335         outdev = state->out ? state->out->name : nulldevname;
 336         /* We handle fragments by dealing with the first fragment as
 337          * if it was a normal packet.  All other fragments are treated
 338          * normally, except that they will NEVER match rules that ask
 339          * things we don't know, ie. tcp syn flag or ports).  If the
 340          * rule is also a fragment-specific rule, non-fragments won't
 341          * match it. */
 342         acpar.hotdrop = false;
 343         acpar.net     = state->net;
 344         acpar.in      = state->in;
 345         acpar.out     = state->out;
 346         acpar.family  = NFPROTO_IPV6;
 347         acpar.hooknum = hook;
 348
 349         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 350
 351         local_bh_disable();
 352         addend = xt_write_recseq_begin();
 353         private = table->private;
 354         /*
 355          * Ensure we load private-> members after we've fetched the base
 356          * pointer.
 357          */
 358         smp_read_barrier_depends();
 359         cpu        = smp_processor_id();
 360         table_base = private->entries;
 361         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
 362
 363         /* Switch to alternate jumpstack if we're being invoked via TEE.
 364          * TEE issues XT_CONTINUE verdict on original skb so we must not
 365          * clobber the jumpstack.
 366          *
 367          * For recursion via REJECT or SYNPROXY the stack will be clobbered
 368          * but it is no problem since absolute verdict is issued by these.
 369          */
 370         if (static_key_false(&xt_tee_enabled))
 371                 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
 372
 373         e = get_entry(table_base, private->hook_entry[hook]);
 374
 375         do {
 376                 const struct xt_entry_target *t;
 377                 const struct xt_entry_match *ematch;
 378                 struct xt_counters *counter;
 379
 380                 IP_NF_ASSERT(e);
 381                 acpar.thoff = 0;
 382                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
 383                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
 384  no_match:
 385                         e = ip6t_next_entry(e);
 386                         continue;
 387                 }
 388
 389                 xt_ematch_foreach(ematch, e) {
 390                         acpar.match     = ematch->u.kernel.match;
 391                         acpar.matchinfo = ematch->data;
 392                         if (!acpar.match->match(skb, &acpar))
 393                                 goto no_match;
 394                 }
 395
 396                 counter = xt_get_this_cpu_counter(&e->counters);
 397                 ADD_COUNTER(*counter, skb->len, 1);
 398
 399                 t = ip6t_get_target_c(e);
 400                 IP_NF_ASSERT(t->u.kernel.target);
 401
 402 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
 403                 /* The packet is traced: log it */
 404                 if (unlikely(skb->nf_trace))
 405                         trace_packet(state->net, skb, hook, state->in,
 406                                      state->out, table->name, private, e);
 407 #endif
 408                 /* Standard target? */
 409                 if (!t->u.kernel.target->target) {
 410                         int v;
 411
 412                         v = ((struct xt_standard_target *)t)->verdict;
 413                         if (v < 0) {
 414                                 /* Pop from stack? */
 415                                 if (v != XT_RETURN) {
 416                                         verdict = (unsigned int)(-v) - 1;
 417                                         break;
 418                                 }
 419                                 if (stackidx == 0)
 420                                         e = get_entry(table_base,
 421                                             private->underflow[hook]);
 422                                 else
 423                                         e = ip6t_next_entry(jumpstack[--stackidx]);
 424                                 continue;
 425                         }
 426                         if (table_base + v != ip6t_next_entry(e) &&
 427                             !(e->ipv6.flags & IP6T_F_GOTO)) {
 428                                 jumpstack[stackidx++] = e;
 429                         }
 430
 431                         e = get_entry(table_base, v);
 432                         continue;
 433                 }
 434
 435                 acpar.target   = t->u.kernel.target;
 436                 acpar.targinfo = t->data;
 437
 438                 verdict = t->u.kernel.target->target(skb, &acpar);
 439                 if (verdict == XT_CONTINUE)
 440                         e = ip6t_next_entry(e);
 441                 else
 442                         /* Verdict */
 443                         break;
 444         } while (!acpar.hotdrop);
 445
 446         xt_write_recseq_end(addend);
 447         local_bh_enable();
 448
 449 #ifdef DEBUG_ALLOW_ALL
 450         return NF_ACCEPT;
 451 #else
 452         if (acpar.hotdrop)
 453                 return NF_DROP;
 454         else return verdict;
 455 #endif
 456 }
 457
 458 static bool find_jump_target(const struct xt_table_info *t,
 459                              const struct ip6t_entry *target)
 460 {
 461         struct ip6t_entry *iter;
 462
 463         xt_entry_foreach(iter, t->entries, t->size) {
 464                  if (iter == target)
 465                         return true;
 466         }
 467         return false;
 468 }
 469
 470 /* Figures out from what hook each rule can be called: returns 0 if
 471    there are loops.  Puts hook bitmask in comefrom. */
 472 static int
 473 mark_source_chains(const struct xt_table_info *newinfo,
 474                    unsigned int valid_hooks, void *entry0)
 475 {
 476         unsigned int hook;
 477
 478         /* No recursion; use packet counter to save back ptrs (reset
 479            to 0 as we leave), and comefrom to save source hook bitmask */
 480         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 481                 unsigned int pos = newinfo->hook_entry[hook];
 482                 struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
 483
 484                 if (!(valid_hooks & (1 << hook)))
 485                         continue;
 486
 487                 /* Set initial back pointer. */
 488                 e->counters.pcnt = pos;
 489
 490                 for (;;) {
 491                         const struct xt_standard_target *t
 492                                 = (void *)ip6t_get_target_c(e);
 493                         int visited = e->comefrom & (1 << hook);
 494
 495                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 496                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
 497                                        hook, pos, e->comefrom);
 498                                 return 0;
 499                         }
 500                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 501
 502                         /* Unconditional return/END. */
 503                         if ((unconditional(e) &&
 504                              (strcmp(t->target.u.user.name,
 505                                      XT_STANDARD_TARGET) == 0) &&
 506                              t->verdict < 0) || visited) {
 507                                 unsigned int oldpos, size;
 508
 509                                 if ((strcmp(t->target.u.user.name,
 510                                             XT_STANDARD_TARGET) == 0) &&
 511                                     t->verdict < -NF_MAX_VERDICT - 1) {
 512                                         duprintf("mark_source_chains: bad "
 513                                                 "negative verdict (%i)\n",
 514                                                                 t->verdict);
 515                                         return 0;
 516                                 }
 517
 518                                 /* Return: backtrack through the last
 519                                    big jump. */
 520                                 do {
 521                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 522 #ifdef DEBUG_IP_FIREWALL_USER
 523                                         if (e->comefrom
 524                                             & (1 << NF_INET_NUMHOOKS)) {
 525                                                 duprintf("Back unset "
 526                                                          "on hook %u "
 527                                                          "rule %u\n",
 528                                                          hook, pos);
 529                                         }
 530 #endif
 531                                         oldpos = pos;
 532                                         pos = e->counters.pcnt;
 533                                         e->counters.pcnt = 0;
 534
 535                                         /* We're at the start. */
 536                                         if (pos == oldpos)
 537                                                 goto next;
 538
 539                                         e = (struct ip6t_entry *)
 540                                                 (entry0 + pos);
 541                                 } while (oldpos == pos + e->next_offset);
 542
 543                                 /* Move along one */
 544                                 size = e->next_offset;
 545                                 e = (struct ip6t_entry *)
 546                                         (entry0 + pos + size);
 547                                 if (pos + size >= newinfo->size)
 548                                         return 0;
 549                                 e->counters.pcnt = pos;
 550                                 pos += size;
 551                         } else {
 552                                 int newpos = t->verdict;
 553
 554                                 if (strcmp(t->target.u.user.name,
 555                                            XT_STANDARD_TARGET) == 0 &&
 556                                     newpos >= 0) {
 557                                         if (newpos > newinfo->size -
 558                                                 sizeof(struct ip6t_entry)) {
 559                                                 duprintf("mark_source_chains: "
 560                                                         "bad verdict (%i)\n",
 561                                                                 newpos);
 562                                                 return 0;
 563                                         }
 564                                         /* This a jump; chase it. */
 565                                         duprintf("Jump rule %u -> %u\n",
 566                                                  pos, newpos);
 567                                         e = (struct ip6t_entry *)
 568                                                 (entry0 + newpos);
 569                                         if (!find_jump_target(newinfo, e))
 570                                                 return 0;
 571                                 } else {
 572                                         /* ... this is a fallthru */
 573                                         newpos = pos + e->next_offset;
 574                                         if (newpos >= newinfo->size)
 575                                                 return 0;
 576                                 }
 577                                 e = (struct ip6t_entry *)
 578                                         (entry0 + newpos);
 579                                 e->counters.pcnt = pos;
 580                                 pos = newpos;
 581                         }
 582                 }
 583 next:
 584                 duprintf("Finished chain %u\n", hook);
 585         }
 586         return 1;
 587 }
 588
 589 static void cleanup_match(struct xt_entry_match *m, struct net *net)
 590 {
 591         struct xt_mtdtor_param par;
 592
 593         par.net       = net;
 594         par.match     = m->u.kernel.match;
 595         par.matchinfo = m->data;
 596         par.family    = NFPROTO_IPV6;
 597         if (par.match->destroy != NULL)
 598                 par.match->destroy(&par);
 599         module_put(par.match->me);
 600 }
 601
 602 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 603 {
 604         const struct ip6t_ip6 *ipv6 = par->entryinfo;
 605         int ret;
 606
 607         par->match     = m->u.kernel.match;
 608         par->matchinfo = m->data;
 609
 610         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 611                              ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
 612         if (ret < 0) {
 613                 duprintf("ip_tables: check failed for `%s'.\n",
 614                          par.match->name);
 615                 return ret;
 616         }
 617         return 0;
 618 }
 619
 620 static int
 621 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 622 {
 623         struct xt_match *match;
 624         int ret;
 625
 626         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
 627                                       m->u.user.revision);
 628         if (IS_ERR(match)) {
 629                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 630                 return PTR_ERR(match);
 631         }
 632         m->u.kernel.match = match;
 633
 634         ret = check_match(m, par);
 635         if (ret)
 636                 goto err;
 637
 638         return 0;
 639 err:
 640         module_put(m->u.kernel.match->me);
 641         return ret;
 642 }
 643
 644 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 645 {
 646         struct xt_entry_target *t = ip6t_get_target(e);
 647         struct xt_tgchk_param par = {
 648                 .net       = net,
 649                 .table     = name,
 650                 .entryinfo = e,
 651                 .target    = t->u.kernel.target,
 652                 .targinfo  = t->data,
 653                 .hook_mask = e->comefrom,
 654                 .family    = NFPROTO_IPV6,
 655         };
 656         int ret;
 657
 658         t = ip6t_get_target(e);
 659         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 660               e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
 661         if (ret < 0) {
 662                 duprintf("ip_tables: check failed for `%s'.\n",
 663                          t->u.kernel.target->name);
 664                 return ret;
 665         }
 666         return 0;
 667 }
 668
 669 static int
 670 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 671                  unsigned int size)
 672 {
 673         struct xt_entry_target *t;
 674         struct xt_target *target;
 675         int ret;
 676         unsigned int j;
 677         struct xt_mtchk_param mtpar;
 678         struct xt_entry_match *ematch;
 679
 680         e->counters.pcnt = xt_percpu_counter_alloc();
 681         if (IS_ERR_VALUE(e->counters.pcnt))
 682                 return -ENOMEM;
 683
 684         j = 0;
 685         mtpar.net       = net;
 686         mtpar.table     = name;
 687         mtpar.entryinfo = &e->ipv6;
 688         mtpar.hook_mask = e->comefrom;
 689         mtpar.family    = NFPROTO_IPV6;
 690         xt_ematch_foreach(ematch, e) {
 691                 ret = find_check_match(ematch, &mtpar);
 692                 if (ret != 0)
 693                         goto cleanup_matches;
 694                 ++j;
 695         }
 696
 697         t = ip6t_get_target(e);
 698         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
 699                                         t->u.user.revision);
 700         if (IS_ERR(target)) {
 701                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 702                 ret = PTR_ERR(target);
 703                 goto cleanup_matches;
 704         }
 705         t->u.kernel.target = target;
 706
 707         ret = check_target(e, net, name);
 708         if (ret)
 709                 goto err;
 710         return 0;
 711  err:
 712         module_put(t->u.kernel.target->me);
 713  cleanup_matches:
 714         xt_ematch_foreach(ematch, e) {
 715                 if (j-- == 0)
 716                         break;
 717                 cleanup_match(ematch, net);
 718         }
 719
 720         xt_percpu_counter_free(e->counters.pcnt);
 721
 722         return ret;
 723 }
 724
 725 static bool check_underflow(const struct ip6t_entry *e)
 726 {
 727         const struct xt_entry_target *t;
 728         unsigned int verdict;
 729
 730         if (!unconditional(e))
 731                 return false;
 732         t = ip6t_get_target_c(e);
 733         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 734                 return false;
 735         verdict = ((struct xt_standard_target *)t)->verdict;
 736         verdict = -verdict - 1;
 737         return verdict == NF_DROP || verdict == NF_ACCEPT;
 738 }
 739
 740 static int
 741 check_entry_size_and_hooks(struct ip6t_entry *e,
 742                            struct xt_table_info *newinfo,
 743                            const unsigned char *base,
 744                            const unsigned char *limit,
 745                            const unsigned int *hook_entries,
 746                            const unsigned int *underflows,
 747                            unsigned int valid_hooks)
 748 {
 749         unsigned int h;
 750         int err;
 751
 752         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
 753             (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
 754             (unsigned char *)e + e->next_offset > limit) {
 755                 duprintf("Bad offset %p\n", e);
 756                 return -EINVAL;
 757         }
 758
 759         if (e->next_offset
 760             < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target)) {
 761                 duprintf("checking: element %p size %u\n",
 762                          e, e->next_offset);
 763                 return -EINVAL;
 764         }
 765
 766         if (!ip6_checkentry(&e->ipv6))
 767                 return -EINVAL;
 768
 769         err = xt_check_entry_offsets(e, e->elems, e->target_offset,
 770                                      e->next_offset);
 771         if (err)
 772                 return err;
 773
 774         /* Check hooks & underflows */
 775         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 776                 if (!(valid_hooks & (1 << h)))
 777                         continue;
 778                 if ((unsigned char *)e - base == hook_entries[h])
 779                         newinfo->hook_entry[h] = hook_entries[h];
 780                 if ((unsigned char *)e - base == underflows[h]) {
 781                         if (!check_underflow(e)) {
 782                                 pr_debug("Underflows must be unconditional and "
 783                                          "use the STANDARD target with "
 784                                          "ACCEPT/DROP\n");
 785                                 return -EINVAL;
 786                         }
 787                         newinfo->underflow[h] = underflows[h];
 788                 }
 789         }
 790
 791         /* Clear counters and comefrom */
 792         e->counters = ((struct xt_counters) { 0, 0 });
 793         e->comefrom = 0;
 794         return 0;
 795 }
 796
 797 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
 798 {
 799         struct xt_tgdtor_param par;
 800         struct xt_entry_target *t;
 801         struct xt_entry_match *ematch;
 802
 803         /* Cleanup all matches */
 804         xt_ematch_foreach(ematch, e)
 805                 cleanup_match(ematch, net);
 806         t = ip6t_get_target(e);
 807
 808         par.net      = net;
 809         par.target   = t->u.kernel.target;
 810         par.targinfo = t->data;
 811         par.family   = NFPROTO_IPV6;
 812         if (par.target->destroy != NULL)
 813                 par.target->destroy(&par);
 814         module_put(par.target->me);
 815
 816         xt_percpu_counter_free(e->counters.pcnt);
 817 }
 818
 819 /* Checks and translates the user-supplied table segment (held in
 820    newinfo) */
 821 static int
 822 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
 823                 const struct ip6t_replace *repl)
 824 {
 825         struct ip6t_entry *iter;
 826         unsigned int i;
 827         int ret = 0;
 828
 829         newinfo->size = repl->size;
 830         newinfo->number = repl->num_entries;
 831
 832         /* Init all hooks to impossible value. */
 833         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 834                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 835                 newinfo->underflow[i] = 0xFFFFFFFF;
 836         }
 837
 838         duprintf("translate_table: size %u\n", newinfo->size);
 839         i = 0;
 840         /* Walk through entries, checking offsets. */
 841         xt_entry_foreach(iter, entry0, newinfo->size) {
 842                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 843                                                  entry0 + repl->size,
 844                                                  repl->hook_entry,
 845                                                  repl->underflow,
 846                                                  repl->valid_hooks);
 847                 if (ret != 0)
 848                         return ret;
 849                 ++i;
 850                 if (strcmp(ip6t_get_target(iter)->u.user.name,
 851                     XT_ERROR_TARGET) == 0)
 852                         ++newinfo->stacksize;
 853         }
 854
 855         if (i != repl->num_entries) {
 856                 duprintf("translate_table: %u not %u entries\n",
 857                          i, repl->num_entries);
 858                 return -EINVAL;
 859         }
 860
 861         /* Check hooks all assigned */
 862         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 863                 /* Only hooks which are valid */
 864                 if (!(repl->valid_hooks & (1 << i)))
 865                         continue;
 866                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 867                         duprintf("Invalid hook entry %u %u\n",
 868                                  i, repl->hook_entry[i]);
 869                         return -EINVAL;
 870                 }
 871                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 872                         duprintf("Invalid underflow %u %u\n",
 873                                  i, repl->underflow[i]);
 874                         return -EINVAL;
 875                 }
 876         }
 877
 878         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
 879                 return -ELOOP;
 880
 881         /* Finally, each sanity check must pass */
 882         i = 0;
 883         xt_entry_foreach(iter, entry0, newinfo->size) {
 884                 ret = find_check_entry(iter, net, repl->name, repl->size);
 885                 if (ret != 0)
 886                         break;
 887                 ++i;
 888         }
 889
 890         if (ret != 0) {
 891                 xt_entry_foreach(iter, entry0, newinfo->size) {
 892                         if (i-- == 0)
 893                                 break;
 894                         cleanup_entry(iter, net);
 895                 }
 896                 return ret;
 897         }
 898
 899         return ret;
 900 }
 901
 902 static void
 903 get_counters(const struct xt_table_info *t,
 904              struct xt_counters counters[])
 905 {
 906         struct ip6t_entry *iter;
 907         unsigned int cpu;
 908         unsigned int i;
 909
 910         for_each_possible_cpu(cpu) {
 911                 seqcount_t *s = &per_cpu(xt_recseq, cpu);
 912
 913                 i = 0;
 914                 xt_entry_foreach(iter, t->entries, t->size) {
 915                         struct xt_counters *tmp;
 916                         u64 bcnt, pcnt;
 917                         unsigned int start;
 918
 919                         tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
 920                         do {
 921                                 start = read_seqcount_begin(s);
 922                                 bcnt = tmp->bcnt;
 923                                 pcnt = tmp->pcnt;
 924                         } while (read_seqcount_retry(s, start));
 925
 926                         ADD_COUNTER(counters[i], bcnt, pcnt);
 927                         ++i;
 928                 }
 929         }
 930 }
 931
 932 static struct xt_counters *alloc_counters(const struct xt_table *table)
 933 {
 934         unsigned int countersize;
 935         struct xt_counters *counters;
 936         const struct xt_table_info *private = table->private;
 937
 938         /* We need atomic snapshot of counters: rest doesn't change
 939            (other than comefrom, which userspace doesn't care
 940            about). */
 941         countersize = sizeof(struct xt_counters) * private->number;
 942         counters = vzalloc(countersize);
 943
 944         if (counters == NULL)
 945                 return ERR_PTR(-ENOMEM);
 946
 947         get_counters(private, counters);
 948
 949         return counters;
 950 }
 951
 952 static int
 953 copy_entries_to_user(unsigned int total_size,
 954                      const struct xt_table *table,
 955                      void __user *userptr)
 956 {
 957         unsigned int off, num;
 958         const struct ip6t_entry *e;
 959         struct xt_counters *counters;
 960         const struct xt_table_info *private = table->private;
 961         int ret = 0;
 962         const void *loc_cpu_entry;
 963
 964         counters = alloc_counters(table);
 965         if (IS_ERR(counters))
 966                 return PTR_ERR(counters);
 967
 968         loc_cpu_entry = private->entries;
 969         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 970                 ret = -EFAULT;
 971                 goto free_counters;
 972         }
 973
 974         /* FIXME: use iterator macros --RR */
 975         /* ... then go back and fix counters and names */
 976         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 977                 unsigned int i;
 978                 const struct xt_entry_match *m;
 979                 const struct xt_entry_target *t;
 980
 981                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
 982                 if (copy_to_user(userptr + off
 983                                  + offsetof(struct ip6t_entry, counters),
 984                                  &counters[num],
 985                                  sizeof(counters[num])) != 0) {
 986                         ret = -EFAULT;
 987                         goto free_counters;
 988                 }
 989
 990                 for (i = sizeof(struct ip6t_entry);
 991                      i < e->target_offset;
 992                      i += m->u.match_size) {
 993                         m = (void *)e + i;
 994
 995                         if (copy_to_user(userptr + off + i
 996                                          + offsetof(struct xt_entry_match,
 997                                                     u.user.name),
 998                                          m->u.kernel.match->name,
 999                                          strlen(m->u.kernel.match->name)+1)
1000                             != 0) {
1001                                 ret = -EFAULT;
1002                                 goto free_counters;
1003                         }
1004                 }
1005
1006                 t = ip6t_get_target_c(e);
1007                 if (copy_to_user(userptr + off + e->target_offset
1008                                  + offsetof(struct xt_entry_target,
1009                                             u.user.name),
1010                                  t->u.kernel.target->name,
1011                                  strlen(t->u.kernel.target->name)+1) != 0) {
1012                         ret = -EFAULT;
1013                         goto free_counters;
1014                 }
1015         }
1016
1017  free_counters:
1018         vfree(counters);
1019         return ret;
1020 }
1021
1022 #ifdef CONFIG_COMPAT
1023 static void compat_standard_from_user(void *dst, const void *src)
1024 {
1025         int v = *(compat_int_t *)src;
1026
1027         if (v > 0)
1028                 v += xt_compat_calc_jump(AF_INET6, v);
1029         memcpy(dst, &v, sizeof(v));
1030 }
1031
1032 static int compat_standard_to_user(void __user *dst, const void *src)
1033 {
1034         compat_int_t cv = *(int *)src;
1035
1036         if (cv > 0)
1037                 cv -= xt_compat_calc_jump(AF_INET6, cv);
1038         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1039 }
1040
1041 static int compat_calc_entry(const struct ip6t_entry *e,
1042                              const struct xt_table_info *info,
1043                              const void *base, struct xt_table_info *newinfo)
1044 {
1045         const struct xt_entry_match *ematch;
1046         const struct xt_entry_target *t;
1047         unsigned int entry_offset;
1048         int off, i, ret;
1049
1050         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1051         entry_offset = (void *)e - base;
1052         xt_ematch_foreach(ematch, e)
1053                 off += xt_compat_match_offset(ematch->u.kernel.match);
1054         t = ip6t_get_target_c(e);
1055         off += xt_compat_target_offset(t->u.kernel.target);
1056         newinfo->size -= off;
1057         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1058         if (ret)
1059                 return ret;
1060
1061         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1062                 if (info->hook_entry[i] &&
1063                     (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1064                         newinfo->hook_entry[i] -= off;
1065                 if (info->underflow[i] &&
1066                     (e < (struct ip6t_entry *)(base + info->underflow[i])))
1067                         newinfo->underflow[i] -= off;
1068         }
1069         return 0;
1070 }
1071
1072 static int compat_table_info(const struct xt_table_info *info,
1073                              struct xt_table_info *newinfo)
1074 {
1075         struct ip6t_entry *iter;
1076         const void *loc_cpu_entry;
1077         int ret;
1078
1079         if (!newinfo || !info)
1080                 return -EINVAL;
1081
1082         /* we dont care about newinfo->entries */
1083         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1084         newinfo->initial_entries = 0;
1085         loc_cpu_entry = info->entries;
1086         xt_compat_init_offsets(AF_INET6, info->number);
1087         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1088                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1089                 if (ret != 0)
1090                         return ret;
1091         }
1092         return 0;
1093 }
1094 #endif
1095
1096 static int get_info(struct net *net, void __user *user,
1097                     const int *len, int compat)
1098 {
1099         char name[XT_TABLE_MAXNAMELEN];
1100         struct xt_table *t;
1101         int ret;
1102
1103         if (*len != sizeof(struct ip6t_getinfo)) {
1104                 duprintf("length %u != %zu\n", *len,
1105                          sizeof(struct ip6t_getinfo));
1106                 return -EINVAL;
1107         }
1108
1109         if (copy_from_user(name, user, sizeof(name)) != 0)
1110                 return -EFAULT;
1111
1112         name[XT_TABLE_MAXNAMELEN-1] = '\0';
1113 #ifdef CONFIG_COMPAT
1114         if (compat)
1115                 xt_compat_lock(AF_INET6);
1116 #endif
1117         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1118                                     "ip6table_%s", name);
1119         if (!IS_ERR_OR_NULL(t)) {
1120                 struct ip6t_getinfo info;
1121                 const struct xt_table_info *private = t->private;
1122 #ifdef CONFIG_COMPAT
1123                 struct xt_table_info tmp;
1124
1125                 if (compat) {
1126                         ret = compat_table_info(private, &tmp);
1127                         xt_compat_flush_offsets(AF_INET6);
1128                         private = &tmp;
1129                 }
1130 #endif
1131                 memset(&info, 0, sizeof(info));
1132                 info.valid_hooks = t->valid_hooks;
1133                 memcpy(info.hook_entry, private->hook_entry,
1134                        sizeof(info.hook_entry));
1135                 memcpy(info.underflow, private->underflow,
1136                        sizeof(info.underflow));
1137                 info.num_entries = private->number;
1138                 info.size = private->size;
1139                 strcpy(info.name, name);
1140
1141                 if (copy_to_user(user, &info, *len) != 0)
1142                         ret = -EFAULT;
1143                 else
1144                         ret = 0;
1145
1146                 xt_table_unlock(t);
1147                 module_put(t->me);
1148         } else
1149                 ret = t ? PTR_ERR(t) : -ENOENT;
1150 #ifdef CONFIG_COMPAT
1151         if (compat)
1152                 xt_compat_unlock(AF_INET6);
1153 #endif
1154         return ret;
1155 }
1156
1157 static int
1158 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1159             const int *len)
1160 {
1161         int ret;
1162         struct ip6t_get_entries get;
1163         struct xt_table *t;
1164
1165         if (*len < sizeof(get)) {
1166                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1167                 return -EINVAL;
1168         }
1169         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1170                 return -EFAULT;
1171         if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1172                 duprintf("get_entries: %u != %zu\n",
1173                          *len, sizeof(get) + get.size);
1174                 return -EINVAL;
1175         }
1176         get.name[sizeof(get.name) - 1] = '\0';
1177
1178         t = xt_find_table_lock(net, AF_INET6, get.name);
1179         if (!IS_ERR_OR_NULL(t)) {
1180                 struct xt_table_info *private = t->private;
1181                 duprintf("t->private->number = %u\n", private->number);
1182                 if (get.size == private->size)
1183                         ret = copy_entries_to_user(private->size,
1184                                                    t, uptr->entrytable);
1185                 else {
1186                         duprintf("get_entries: I've got %u not %u!\n",
1187                                  private->size, get.size);
1188                         ret = -EAGAIN;
1189                 }
1190                 module_put(t->me);
1191                 xt_table_unlock(t);
1192         } else
1193                 ret = t ? PTR_ERR(t) : -ENOENT;
1194
1195         return ret;
1196 }
1197
1198 static int
1199 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1200              struct xt_table_info *newinfo, unsigned int num_counters,
1201              void __user *counters_ptr)
1202 {
1203         int ret;
1204         struct xt_table *t;
1205         struct xt_table_info *oldinfo;
1206         struct xt_counters *counters;
1207         struct ip6t_entry *iter;
1208
1209         ret = 0;
1210         counters = vzalloc(num_counters * sizeof(struct xt_counters));
1211         if (!counters) {
1212                 ret = -ENOMEM;
1213                 goto out;
1214         }
1215
1216         t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1217                                     "ip6table_%s", name);
1218         if (IS_ERR_OR_NULL(t)) {
1219                 ret = t ? PTR_ERR(t) : -ENOENT;
1220                 goto free_newinfo_counters_untrans;
1221         }
1222
1223         /* You lied! */
1224         if (valid_hooks != t->valid_hooks) {
1225                 duprintf("Valid hook crap: %08X vs %08X\n",
1226                          valid_hooks, t->valid_hooks);
1227                 ret = -EINVAL;
1228                 goto put_module;
1229         }
1230
1231         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1232         if (!oldinfo)
1233                 goto put_module;
1234
1235         /* Update module usage count based on number of rules */
1236         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1237                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1238         if ((oldinfo->number > oldinfo->initial_entries) ||
1239             (newinfo->number <= oldinfo->initial_entries))
1240                 module_put(t->me);
1241         if ((oldinfo->number > oldinfo->initial_entries) &&
1242             (newinfo->number <= oldinfo->initial_entries))
1243                 module_put(t->me);
1244
1245         /* Get the old counters, and synchronize with replace */
1246         get_counters(oldinfo, counters);
1247
1248         /* Decrease module usage counts and free resource */
1249         xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1250                 cleanup_entry(iter, net);
1251
1252         xt_free_table_info(oldinfo);
1253         if (copy_to_user(counters_ptr, counters,
1254                          sizeof(struct xt_counters) * num_counters) != 0) {
1255                 /* Silent error, can't fail, new table is already in place */
1256                 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1257         }
1258         vfree(counters);
1259         xt_table_unlock(t);
1260         return ret;
1261
1262  put_module:
1263         module_put(t->me);
1264         xt_table_unlock(t);
1265  free_newinfo_counters_untrans:
1266         vfree(counters);
1267  out:
1268         return ret;
1269 }
1270
1271 static int
1272 do_replace(struct net *net, const void __user *user, unsigned int len)
1273 {
1274         int ret;
1275         struct ip6t_replace tmp;
1276         struct xt_table_info *newinfo;
1277         void *loc_cpu_entry;
1278         struct ip6t_entry *iter;
1279
1280         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1281                 return -EFAULT;
1282
1283         /* overflow check */
1284         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1285                 return -ENOMEM;
1286         if (tmp.num_counters == 0)
1287                 return -EINVAL;
1288
1289         tmp.name[sizeof(tmp.name)-1] = 0;
1290
1291         newinfo = xt_alloc_table_info(tmp.size);
1292         if (!newinfo)
1293                 return -ENOMEM;
1294
1295         loc_cpu_entry = newinfo->entries;
1296         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1297                            tmp.size) != 0) {
1298                 ret = -EFAULT;
1299                 goto free_newinfo;
1300         }
1301
1302         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1303         if (ret != 0)
1304                 goto free_newinfo;
1305
1306         duprintf("ip_tables: Translated table\n");
1307
1308         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1309                            tmp.num_counters, tmp.counters);
1310         if (ret)
1311                 goto free_newinfo_untrans;
1312         return 0;
1313
1314  free_newinfo_untrans:
1315         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1316                 cleanup_entry(iter, net);
1317  free_newinfo:
1318         xt_free_table_info(newinfo);
1319         return ret;
1320 }
1321
1322 static int
1323 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1324                 int compat)
1325 {
1326         unsigned int i;
1327         struct xt_counters_info tmp;
1328         struct xt_counters *paddc;
1329         unsigned int num_counters;
1330         char *name;
1331         int size;
1332         void *ptmp;
1333         struct xt_table *t;
1334         const struct xt_table_info *private;
1335         int ret = 0;
1336         struct ip6t_entry *iter;
1337         unsigned int addend;
1338 #ifdef CONFIG_COMPAT
1339         struct compat_xt_counters_info compat_tmp;
1340
1341         if (compat) {
1342                 ptmp = &compat_tmp;
1343                 size = sizeof(struct compat_xt_counters_info);
1344         } else
1345 #endif
1346         {
1347                 ptmp = &tmp;
1348                 size = sizeof(struct xt_counters_info);
1349         }
1350
1351         if (copy_from_user(ptmp, user, size) != 0)
1352                 return -EFAULT;
1353
1354 #ifdef CONFIG_COMPAT
1355         if (compat) {
1356                 num_counters = compat_tmp.num_counters;
1357                 name = compat_tmp.name;
1358         } else
1359 #endif
1360         {
1361                 num_counters = tmp.num_counters;
1362                 name = tmp.name;
1363         }
1364
1365         if (len != size + num_counters * sizeof(struct xt_counters))
1366                 return -EINVAL;
1367
1368         paddc = vmalloc(len - size);
1369         if (!paddc)
1370                 return -ENOMEM;
1371
1372         if (copy_from_user(paddc, user + size, len - size) != 0) {
1373                 ret = -EFAULT;
1374                 goto free;
1375         }
1376
1377         t = xt_find_table_lock(net, AF_INET6, name);
1378         if (IS_ERR_OR_NULL(t)) {
1379                 ret = t ? PTR_ERR(t) : -ENOENT;
1380                 goto free;
1381         }
1382
1383         local_bh_disable();
1384         private = t->private;
1385         if (private->number != num_counters) {
1386                 ret = -EINVAL;
1387                 goto unlock_up_free;
1388         }
1389
1390         i = 0;
1391         addend = xt_write_recseq_begin();
1392         xt_entry_foreach(iter, private->entries, private->size) {
1393                 struct xt_counters *tmp;
1394
1395                 tmp = xt_get_this_cpu_counter(&iter->counters);
1396                 ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1397                 ++i;
1398         }
1399         xt_write_recseq_end(addend);
1400  unlock_up_free:
1401         local_bh_enable();
1402         xt_table_unlock(t);
1403         module_put(t->me);
1404  free:
1405         vfree(paddc);
1406
1407         return ret;
1408 }
1409
1410 #ifdef CONFIG_COMPAT
1411 struct compat_ip6t_replace {
1412         char                    name[XT_TABLE_MAXNAMELEN];
1413         u32                     valid_hooks;
1414         u32                     num_entries;
1415         u32                     size;
1416         u32                     hook_entry[NF_INET_NUMHOOKS];
1417         u32                     underflow[NF_INET_NUMHOOKS];
1418         u32                     num_counters;
1419         compat_uptr_t           counters;       /* struct xt_counters * */
1420         struct compat_ip6t_entry entries[0];
1421 };
1422
1423 static int
1424 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1425                           unsigned int *size, struct xt_counters *counters,
1426                           unsigned int i)
1427 {
1428         struct xt_entry_target *t;
1429         struct compat_ip6t_entry __user *ce;
1430         u_int16_t target_offset, next_offset;
1431         compat_uint_t origsize;
1432         const struct xt_entry_match *ematch;
1433         int ret = 0;
1434
1435         origsize = *size;
1436         ce = (struct compat_ip6t_entry __user *)*dstptr;
1437         if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1438             copy_to_user(&ce->counters, &counters[i],
1439             sizeof(counters[i])) != 0)
1440                 return -EFAULT;
1441
1442         *dstptr += sizeof(struct compat_ip6t_entry);
1443         *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1444
1445         xt_ematch_foreach(ematch, e) {
1446                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1447                 if (ret != 0)
1448                         return ret;
1449         }
1450         target_offset = e->target_offset - (origsize - *size);
1451         t = ip6t_get_target(e);
1452         ret = xt_compat_target_to_user(t, dstptr, size);
1453         if (ret)
1454                 return ret;
1455         next_offset = e->next_offset - (origsize - *size);
1456         if (put_user(target_offset, &ce->target_offset) != 0 ||
1457             put_user(next_offset, &ce->next_offset) != 0)
1458                 return -EFAULT;
1459         return 0;
1460 }
1461
1462 static int
1463 compat_find_calc_match(struct xt_entry_match *m,
1464                        const struct ip6t_ip6 *ipv6,
1465                        int *size)
1466 {
1467         struct xt_match *match;
1468
1469         match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1470                                       m->u.user.revision);
1471         if (IS_ERR(match)) {
1472                 duprintf("compat_check_calc_match: `%s' not found\n",
1473                          m->u.user.name);
1474                 return PTR_ERR(match);
1475         }
1476         m->u.kernel.match = match;
1477         *size += xt_compat_match_offset(match);
1478         return 0;
1479 }
1480
1481 static void compat_release_entry(struct compat_ip6t_entry *e)
1482 {
1483         struct xt_entry_target *t;
1484         struct xt_entry_match *ematch;
1485
1486         /* Cleanup all matches */
1487         xt_ematch_foreach(ematch, e)
1488                 module_put(ematch->u.kernel.match->me);
1489         t = compat_ip6t_get_target(e);
1490         module_put(t->u.kernel.target->me);
1491 }
1492
1493 static int
1494 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1495                                   struct xt_table_info *newinfo,
1496                                   unsigned int *size,
1497                                   const unsigned char *base,
1498                                   const unsigned char *limit,
1499                                   const unsigned int *hook_entries,
1500                                   const unsigned int *underflows)
1501 {
1502         struct xt_entry_match *ematch;
1503         struct xt_entry_target *t;
1504         struct xt_target *target;
1505         unsigned int entry_offset;
1506         unsigned int j;
1507         int ret, off, h;
1508
1509         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1510         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1511             (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
1512             (unsigned char *)e + e->next_offset > limit) {
1513                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1514                 return -EINVAL;
1515         }
1516
1517         if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1518                              sizeof(struct compat_xt_entry_target)) {
1519                 duprintf("checking: element %p size %u\n",
1520                          e, e->next_offset);
1521                 return -EINVAL;
1522         }
1523
1524         if (!ip6_checkentry(&e->ipv6))
1525                 return -EINVAL;
1526
1527         ret = xt_compat_check_entry_offsets(e, e->elems,
1528                                             e->target_offset, e->next_offset);
1529         if (ret)
1530                 return ret;
1531
1532         off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1533         entry_offset = (void *)e - (void *)base;
1534         j = 0;
1535         xt_ematch_foreach(ematch, e) {
1536                 ret = compat_find_calc_match(ematch, &e->ipv6, &off);
1537                 if (ret != 0)
1538                         goto release_matches;
1539                 ++j;
1540         }
1541
1542         t = compat_ip6t_get_target(e);
1543         target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1544                                         t->u.user.revision);
1545         if (IS_ERR(target)) {
1546                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1547                          t->u.user.name);
1548                 ret = PTR_ERR(target);
1549                 goto release_matches;
1550         }
1551         t->u.kernel.target = target;
1552
1553         off += xt_compat_target_offset(target);
1554         *size += off;
1555         ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1556         if (ret)
1557                 goto out;
1558
1559         /* Check hooks & underflows */
1560         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1561                 if ((unsigned char *)e - base == hook_entries[h])
1562                         newinfo->hook_entry[h] = hook_entries[h];
1563                 if ((unsigned char *)e - base == underflows[h])
1564                         newinfo->underflow[h] = underflows[h];
1565         }
1566
1567         /* Clear counters and comefrom */
1568         memset(&e->counters, 0, sizeof(e->counters));
1569         e->comefrom = 0;
1570         return 0;
1571
1572 out:
1573         module_put(t->u.kernel.target->me);
1574 release_matches:
1575         xt_ematch_foreach(ematch, e) {
1576                 if (j-- == 0)
1577                         break;
1578                 module_put(ematch->u.kernel.match->me);
1579         }
1580         return ret;
1581 }
1582
1583 static void
1584 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1585                             unsigned int *size,
1586                             struct xt_table_info *newinfo, unsigned char *base)
1587 {
1588         struct xt_entry_target *t;
1589         struct ip6t_entry *de;
1590         unsigned int origsize;
1591         int h;
1592         struct xt_entry_match *ematch;
1593
1594         origsize = *size;
1595         de = (struct ip6t_entry *)*dstptr;
1596         memcpy(de, e, sizeof(struct ip6t_entry));
1597         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1598
1599         *dstptr += sizeof(struct ip6t_entry);
1600         *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1601
1602         xt_ematch_foreach(ematch, e)
1603                 xt_compat_match_from_user(ematch, dstptr, size);
1604
1605         de->target_offset = e->target_offset - (origsize - *size);
1606         t = compat_ip6t_get_target(e);
1607         xt_compat_target_from_user(t, dstptr, size);
1608
1609         de->next_offset = e->next_offset - (origsize - *size);
1610         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1611                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1612                         newinfo->hook_entry[h] -= origsize - *size;
1613                 if ((unsigned char *)de - base < newinfo->underflow[h])
1614                         newinfo->underflow[h] -= origsize - *size;
1615         }
1616 }
1617
1618 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
1619                               const char *name)
1620 {
1621         unsigned int j;
1622         int ret = 0;
1623         struct xt_mtchk_param mtpar;
1624         struct xt_entry_match *ematch;
1625
1626         e->counters.pcnt = xt_percpu_counter_alloc();
1627         if (IS_ERR_VALUE(e->counters.pcnt))
1628                 return -ENOMEM;
1629         j = 0;
1630         mtpar.net       = net;
1631         mtpar.table     = name;
1632         mtpar.entryinfo = &e->ipv6;
1633         mtpar.hook_mask = e->comefrom;
1634         mtpar.family    = NFPROTO_IPV6;
1635         xt_ematch_foreach(ematch, e) {
1636                 ret = check_match(ematch, &mtpar);
1637                 if (ret != 0)
1638                         goto cleanup_matches;
1639                 ++j;
1640         }
1641
1642         ret = check_target(e, net, name);
1643         if (ret)
1644                 goto cleanup_matches;
1645         return 0;
1646
1647  cleanup_matches:
1648         xt_ematch_foreach(ematch, e) {
1649                 if (j-- == 0)
1650                         break;
1651                 cleanup_match(ematch, net);
1652         }
1653
1654         xt_percpu_counter_free(e->counters.pcnt);
1655
1656         return ret;
1657 }
1658
1659 static int
1660 translate_compat_table(struct net *net,
1661                        struct xt_table_info **pinfo,
1662                        void **pentry0,
1663                        const struct compat_ip6t_replace *compatr)
1664 {
1665         unsigned int i, j;
1666         struct xt_table_info *newinfo, *info;
1667         void *pos, *entry0, *entry1;
1668         struct compat_ip6t_entry *iter0;
1669         struct ip6t_entry *iter1;
1670         unsigned int size;
1671         int ret = 0;
1672
1673         info = *pinfo;
1674         entry0 = *pentry0;
1675         size = compatr->size;
1676         info->number = compatr->num_entries;
1677
1678         /* Init all hooks to impossible value. */
1679         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1680                 info->hook_entry[i] = 0xFFFFFFFF;
1681                 info->underflow[i] = 0xFFFFFFFF;
1682         }
1683
1684         duprintf("translate_compat_table: size %u\n", info->size);
1685         j = 0;
1686         xt_compat_lock(AF_INET6);
1687         xt_compat_init_offsets(AF_INET6, compatr->num_entries);
1688         /* Walk through entries, checking offsets. */
1689         xt_entry_foreach(iter0, entry0, compatr->size) {
1690                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1691                                                         entry0,
1692                                                         entry0 + compatr->size,
1693                                                         compatr->hook_entry,
1694                                                         compatr->underflow);
1695                 if (ret != 0)
1696                         goto out_unlock;
1697                 ++j;
1698         }
1699
1700         ret = -EINVAL;
1701         if (j != compatr->num_entries) {
1702                 duprintf("translate_compat_table: %u not %u entries\n",
1703                          j, compatr->num_entries);
1704                 goto out_unlock;
1705         }
1706
1707         /* Check hooks all assigned */
1708         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1709                 /* Only hooks which are valid */
1710                 if (!(compatr->valid_hooks & (1 << i)))
1711                         continue;
1712                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1713                         duprintf("Invalid hook entry %u %u\n",
1714                                  i, info->hook_entry[i]);
1715                         goto out_unlock;
1716                 }
1717                 if (info->underflow[i] == 0xFFFFFFFF) {
1718                         duprintf("Invalid underflow %u %u\n",
1719                                  i, info->underflow[i]);
1720                         goto out_unlock;
1721                 }
1722         }
1723
1724         ret = -ENOMEM;
1725         newinfo = xt_alloc_table_info(size);
1726         if (!newinfo)
1727                 goto out_unlock;
1728
1729         newinfo->number = compatr->num_entries;
1730         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1731                 newinfo->hook_entry[i] = info->hook_entry[i];
1732                 newinfo->underflow[i] = info->underflow[i];
1733         }
1734         entry1 = newinfo->entries;
1735         pos = entry1;
1736         xt_entry_foreach(iter0, entry0, compatr->size)
1737                 compat_copy_entry_from_user(iter0, &pos, &size,
1738                                             newinfo, entry1);
1739
1740         xt_compat_flush_offsets(AF_INET6);
1741         xt_compat_unlock(AF_INET6);
1742
1743         ret = -ELOOP;
1744         if (!mark_source_chains(newinfo, compatr->valid_hooks, entry1))
1745                 goto free_newinfo;
1746
1747         i = 0;
1748         xt_entry_foreach(iter1, entry1, newinfo->size) {
1749                 ret = compat_check_entry(iter1, net, compatr->name);
1750                 if (ret != 0)
1751                         break;
1752                 ++i;
1753                 if (strcmp(ip6t_get_target(iter1)->u.user.name,
1754                     XT_ERROR_TARGET) == 0)
1755                         ++newinfo->stacksize;
1756         }
1757         if (ret) {
1758                 /*
1759                  * The first i matches need cleanup_entry (calls ->destroy)
1760                  * because they had called ->check already. The other j-i
1761                  * entries need only release.
1762                  */
1763                 int skip = i;
1764                 j -= i;
1765                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1766                         if (skip-- > 0)
1767                                 continue;
1768                         if (j-- == 0)
1769                                 break;
1770                         compat_release_entry(iter0);
1771                 }
1772                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1773                         if (i-- == 0)
1774                                 break;
1775                         cleanup_entry(iter1, net);
1776                 }
1777                 xt_free_table_info(newinfo);
1778                 return ret;
1779         }
1780
1781         *pinfo = newinfo;
1782         *pentry0 = entry1;
1783         xt_free_table_info(info);
1784         return 0;
1785
1786 free_newinfo:
1787         xt_free_table_info(newinfo);
1788 out:
1789         xt_entry_foreach(iter0, entry0, compatr->size) {
1790                 if (j-- == 0)
1791                         break;
1792                 compat_release_entry(iter0);
1793         }
1794         return ret;
1795 out_unlock:
1796         xt_compat_flush_offsets(AF_INET6);
1797         xt_compat_unlock(AF_INET6);
1798         goto out;
1799 }
1800
1801 static int
1802 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1803 {
1804         int ret;
1805         struct compat_ip6t_replace tmp;
1806         struct xt_table_info *newinfo;
1807         void *loc_cpu_entry;
1808         struct ip6t_entry *iter;
1809
1810         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1811                 return -EFAULT;
1812
1813         /* overflow check */
1814         if (tmp.size >= INT_MAX / num_possible_cpus())
1815                 return -ENOMEM;
1816         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1817                 return -ENOMEM;
1818         if (tmp.num_counters == 0)
1819                 return -EINVAL;
1820
1821         tmp.name[sizeof(tmp.name)-1] = 0;
1822
1823         newinfo = xt_alloc_table_info(tmp.size);
1824         if (!newinfo)
1825                 return -ENOMEM;
1826
1827         loc_cpu_entry = newinfo->entries;
1828         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1829                            tmp.size) != 0) {
1830                 ret = -EFAULT;
1831                 goto free_newinfo;
1832         }
1833
1834         ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
1835         if (ret != 0)
1836                 goto free_newinfo;
1837
1838         duprintf("compat_do_replace: Translated table\n");
1839
1840         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1841                            tmp.num_counters, compat_ptr(tmp.counters));
1842         if (ret)
1843                 goto free_newinfo_untrans;
1844         return 0;
1845
1846  free_newinfo_untrans:
1847         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1848                 cleanup_entry(iter, net);
1849  free_newinfo:
1850         xt_free_table_info(newinfo);
1851         return ret;
1852 }
1853
1854 static int
1855 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1856                        unsigned int len)
1857 {
1858         int ret;
1859
1860         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1861                 return -EPERM;
1862
1863         switch (cmd) {
1864         case IP6T_SO_SET_REPLACE:
1865                 ret = compat_do_replace(sock_net(sk), user, len);
1866                 break;
1867
1868         case IP6T_SO_SET_ADD_COUNTERS:
1869                 ret = do_add_counters(sock_net(sk), user, len, 1);
1870                 break;
1871
1872         default:
1873                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1874                 ret = -EINVAL;
1875         }
1876
1877         return ret;
1878 }
1879
1880 struct compat_ip6t_get_entries {
1881         char name[XT_TABLE_MAXNAMELEN];
1882         compat_uint_t size;
1883         struct compat_ip6t_entry entrytable[0];
1884 };
1885
1886 static int
1887 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1888                             void __user *userptr)
1889 {
1890         struct xt_counters *counters;
1891         const struct xt_table_info *private = table->private;
1892         void __user *pos;
1893         unsigned int size;
1894         int ret = 0;
1895         unsigned int i = 0;
1896         struct ip6t_entry *iter;
1897
1898         counters = alloc_counters(table);
1899         if (IS_ERR(counters))
1900                 return PTR_ERR(counters);
1901
1902         pos = userptr;
1903         size = total_size;
1904         xt_entry_foreach(iter, private->entries, total_size) {
1905                 ret = compat_copy_entry_to_user(iter, &pos,
1906                                                 &size, counters, i++);
1907                 if (ret != 0)
1908                         break;
1909         }
1910
1911         vfree(counters);
1912         return ret;
1913 }
1914
1915 static int
1916 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1917                    int *len)
1918 {
1919         int ret;
1920         struct compat_ip6t_get_entries get;
1921         struct xt_table *t;
1922
1923         if (*len < sizeof(get)) {
1924                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1925                 return -EINVAL;
1926         }
1927
1928         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1929                 return -EFAULT;
1930
1931         if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1932                 duprintf("compat_get_entries: %u != %zu\n",
1933                          *len, sizeof(get) + get.size);
1934                 return -EINVAL;
1935         }
1936         get.name[sizeof(get.name) - 1] = '\0';
1937
1938         xt_compat_lock(AF_INET6);
1939         t = xt_find_table_lock(net, AF_INET6, get.name);
1940         if (!IS_ERR_OR_NULL(t)) {
1941                 const struct xt_table_info *private = t->private;
1942                 struct xt_table_info info;
1943                 duprintf("t->private->number = %u\n", private->number);
1944                 ret = compat_table_info(private, &info);
1945                 if (!ret && get.size == info.size) {
1946                         ret = compat_copy_entries_to_user(private->size,
1947                                                           t, uptr->entrytable);
1948                 } else if (!ret) {
1949                         duprintf("compat_get_entries: I've got %u not %u!\n",
1950                                  private->size, get.size);
1951                         ret = -EAGAIN;
1952                 }
1953                 xt_compat_flush_offsets(AF_INET6);
1954                 module_put(t->me);
1955                 xt_table_unlock(t);
1956         } else
1957                 ret = t ? PTR_ERR(t) : -ENOENT;
1958
1959         xt_compat_unlock(AF_INET6);
1960         return ret;
1961 }
1962
1963 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1964
1965 static int
1966 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1967 {
1968         int ret;
1969
1970         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1971                 return -EPERM;
1972
1973         switch (cmd) {
1974         case IP6T_SO_GET_INFO:
1975                 ret = get_info(sock_net(sk), user, len, 1);
1976                 break;
1977         case IP6T_SO_GET_ENTRIES:
1978                 ret = compat_get_entries(sock_net(sk), user, len);
1979                 break;
1980         default:
1981                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
1982         }
1983         return ret;
1984 }
1985 #endif
1986
1987 static int
1988 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1989 {
1990         int ret;
1991
1992         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1993                 return -EPERM;
1994
1995         switch (cmd) {
1996         case IP6T_SO_SET_REPLACE:
1997                 ret = do_replace(sock_net(sk), user, len);
1998                 break;
1999
2000         case IP6T_SO_SET_ADD_COUNTERS:
2001                 ret = do_add_counters(sock_net(sk), user, len, 0);
2002                 break;
2003
2004         default:
2005                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
2006                 ret = -EINVAL;
2007         }
2008
2009         return ret;
2010 }
2011
2012 static int
2013 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2014 {
2015         int ret;
2016
2017         if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
2018                 return -EPERM;
2019
2020         switch (cmd) {
2021         case IP6T_SO_GET_INFO:
2022                 ret = get_info(sock_net(sk), user, len, 0);
2023                 break;
2024
2025         case IP6T_SO_GET_ENTRIES:
2026                 ret = get_entries(sock_net(sk), user, len);
2027                 break;
2028
2029         case IP6T_SO_GET_REVISION_MATCH:
2030         case IP6T_SO_GET_REVISION_TARGET: {
2031                 struct xt_get_revision rev;
2032                 int target;
2033
2034                 if (*len != sizeof(rev)) {
2035                         ret = -EINVAL;
2036                         break;
2037                 }
2038                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2039                         ret = -EFAULT;
2040                         break;
2041                 }
2042                 rev.name[sizeof(rev.name)-1] = 0;
2043
2044                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2045                         target = 1;
2046                 else
2047                         target = 0;
2048
2049                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2050                                                          rev.revision,
2051                                                          target, &ret),
2052                                         "ip6t_%s", rev.name);
2053                 break;
2054         }
2055
2056         default:
2057                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2058                 ret = -EINVAL;
2059         }
2060
2061         return ret;
2062 }
2063
2064 static void __ip6t_unregister_table(struct net *net, struct xt_table *table)
2065 {
2066         struct xt_table_info *private;
2067         void *loc_cpu_entry;
2068         struct module *table_owner = table->me;
2069         struct ip6t_entry *iter;
2070
2071         private = xt_unregister_table(table);
2072
2073         /* Decrease module usage counts and free resources */
2074         loc_cpu_entry = private->entries;
2075         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2076                 cleanup_entry(iter, net);
2077         if (private->number > private->initial_entries)
2078                 module_put(table_owner);
2079         xt_free_table_info(private);
2080 }
2081
2082 int ip6t_register_table(struct net *net, const struct xt_table *table,
2083                         const struct ip6t_replace *repl,
2084                         const struct nf_hook_ops *ops,
2085                         struct xt_table **res)
2086 {
2087         int ret;
2088         struct xt_table_info *newinfo;
2089         struct xt_table_info bootstrap = {0};
2090         void *loc_cpu_entry;
2091         struct xt_table *new_table;
2092
2093         newinfo = xt_alloc_table_info(repl->size);
2094         if (!newinfo)
2095                 return -ENOMEM;
2096
2097         loc_cpu_entry = newinfo->entries;
2098         memcpy(loc_cpu_entry, repl->entries, repl->size);
2099
2100         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2101         if (ret != 0)
2102                 goto out_free;
2103
2104         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2105         if (IS_ERR(new_table)) {
2106                 ret = PTR_ERR(new_table);
2107                 goto out_free;
2108         }
2109
2110         /* set res now, will see skbs right after nf_register_net_hooks */
2111         WRITE_ONCE(*res, new_table);
2112
2113         ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
2114         if (ret != 0) {
2115                 __ip6t_unregister_table(net, new_table);
2116                 *res = NULL;
2117         }
2118
2119         return ret;
2120
2121 out_free:
2122         xt_free_table_info(newinfo);
2123         return ret;
2124 }
2125
2126 void ip6t_unregister_table(struct net *net, struct xt_table *table,
2127                            const struct nf_hook_ops *ops)
2128 {
2129         nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
2130         __ip6t_unregister_table(net, table);
2131 }
2132
2133 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2134 static inline bool
2135 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2136                      u_int8_t type, u_int8_t code,
2137                      bool invert)
2138 {
2139         return (type == test_type && code >= min_code && code <= max_code)
2140                 ^ invert;
2141 }
2142
2143 static bool
2144 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
2145 {
2146         const struct icmp6hdr *ic;
2147         struct icmp6hdr _icmph;
2148         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2149
2150         /* Must not be a fragment. */
2151         if (par->fragoff != 0)
2152                 return false;
2153
2154         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2155         if (ic == NULL) {
2156                 /* We've been asked to examine this packet, and we
2157                  * can't.  Hence, no choice but to drop.
2158                  */
2159                 duprintf("Dropping evil ICMP tinygram.\n");
2160                 par->hotdrop = true;
2161                 return false;
2162         }
2163
2164         return icmp6_type_code_match(icmpinfo->type,
2165                                      icmpinfo->code[0],
2166                                      icmpinfo->code[1],
2167                                      ic->icmp6_type, ic->icmp6_code,
2168                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
2169 }
2170
2171 /* Called when user tries to insert an entry of this type. */
2172 static int icmp6_checkentry(const struct xt_mtchk_param *par)
2173 {
2174         const struct ip6t_icmp *icmpinfo = par->matchinfo;
2175
2176         /* Must specify no unknown invflags */
2177         return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
2178 }
2179
2180 /* The built-in targets: standard (NULL) and error. */
2181 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
2182         {
2183                 .name             = XT_STANDARD_TARGET,
2184                 .targetsize       = sizeof(int),
2185                 .family           = NFPROTO_IPV6,
2186 #ifdef CONFIG_COMPAT
2187                 .compatsize       = sizeof(compat_int_t),
2188                 .compat_from_user = compat_standard_from_user,
2189                 .compat_to_user   = compat_standard_to_user,
2190 #endif
2191         },
2192         {
2193                 .name             = XT_ERROR_TARGET,
2194                 .target           = ip6t_error,
2195                 .targetsize       = XT_FUNCTION_MAXNAMELEN,
2196                 .family           = NFPROTO_IPV6,
2197         },
2198 };
2199
2200 static struct nf_sockopt_ops ip6t_sockopts = {
2201         .pf             = PF_INET6,
2202         .set_optmin     = IP6T_BASE_CTL,
2203         .set_optmax     = IP6T_SO_SET_MAX+1,
2204         .set            = do_ip6t_set_ctl,
2205 #ifdef CONFIG_COMPAT
2206         .compat_set     = compat_do_ip6t_set_ctl,
2207 #endif
2208         .get_optmin     = IP6T_BASE_CTL,
2209         .get_optmax     = IP6T_SO_GET_MAX+1,
2210         .get            = do_ip6t_get_ctl,
2211 #ifdef CONFIG_COMPAT
2212         .compat_get     = compat_do_ip6t_get_ctl,
2213 #endif
2214         .owner          = THIS_MODULE,
2215 };
2216
2217 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
2218         {
2219                 .name       = "icmp6",
2220                 .match      = icmp6_match,
2221                 .matchsize  = sizeof(struct ip6t_icmp),
2222                 .checkentry = icmp6_checkentry,
2223                 .proto      = IPPROTO_ICMPV6,
2224                 .family     = NFPROTO_IPV6,
2225         },
2226 };
2227
2228 static int __net_init ip6_tables_net_init(struct net *net)
2229 {
2230         return xt_proto_init(net, NFPROTO_IPV6);
2231 }
2232
2233 static void __net_exit ip6_tables_net_exit(struct net *net)
2234 {
2235         xt_proto_fini(net, NFPROTO_IPV6);
2236 }
2237
2238 static struct pernet_operations ip6_tables_net_ops = {
2239         .init = ip6_tables_net_init,
2240         .exit = ip6_tables_net_exit,
2241 };
2242
2243 static int __init ip6_tables_init(void)
2244 {
2245         int ret;
2246
2247         ret = register_pernet_subsys(&ip6_tables_net_ops);
2248         if (ret < 0)
2249                 goto err1;
2250
2251         /* No one else will be downing sem now, so we won't sleep */
2252         ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2253         if (ret < 0)
2254                 goto err2;
2255         ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2256         if (ret < 0)
2257                 goto err4;
2258
2259         /* Register setsockopt */
2260         ret = nf_register_sockopt(&ip6t_sockopts);
2261         if (ret < 0)
2262                 goto err5;
2263
2264         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2265         return 0;
2266
2267 err5:
2268         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2269 err4:
2270         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2271 err2:
2272         unregister_pernet_subsys(&ip6_tables_net_ops);
2273 err1:
2274         return ret;
2275 }
2276
2277 static void __exit ip6_tables_fini(void)
2278 {
2279         nf_unregister_sockopt(&ip6t_sockopts);
2280
2281         xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
2282         xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
2283         unregister_pernet_subsys(&ip6_tables_net_ops);
2284 }
2285
2286 EXPORT_SYMBOL(ip6t_register_table);
2287 EXPORT_SYMBOL(ip6t_unregister_table);
2288 EXPORT_SYMBOL(ip6t_do_table);
2289
2290 module_init(ip6_tables_init);
2291 module_exit(ip6_tables_fini);