projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
[NETFILTER]: xt_MARK: add compat support for revision 0
[deliverable/linux.git] / net / ipv6 / netfilter / ip6_tables.c
1 /*
2 * Packet matching code.
3 *
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12 #include <linux/capability.h>
13 #include <linux/in.h>
14 #include <linux/skbuff.h>
15 #include <linux/kmod.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netdevice.h>
18 #include <linux/module.h>
19 #include <linux/poison.h>
20 #include <linux/icmpv6.h>
21 #include <net/ipv6.h>
22 #include <net/compat.h>
23 #include <asm/uaccess.h>
24 #include <linux/mutex.h>
25 #include <linux/proc_fs.h>
26 #include <linux/err.h>
27 #include <linux/cpumask.h>
28
29 #include <linux/netfilter_ipv6/ip6_tables.h>
30 #include <linux/netfilter/x_tables.h>
31
32 MODULE_LICENSE("GPL");
33 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
34 MODULE_DESCRIPTION("IPv6 packet filter");
35
36 /*#define DEBUG_IP_FIREWALL*/
37 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
38 /*#define DEBUG_IP_FIREWALL_USER*/
39
40 #ifdef DEBUG_IP_FIREWALL
41 #define dprintf(format, args...) printk(format , ## args)
42 #else
43 #define dprintf(format, args...)
44 #endif
45
46 #ifdef DEBUG_IP_FIREWALL_USER
47 #define duprintf(format, args...) printk(format , ## args)
48 #else
49 #define duprintf(format, args...)
50 #endif
51
52 #ifdef CONFIG_NETFILTER_DEBUG
53 #define IP_NF_ASSERT(x) \
54 do { \
55 if (!(x)) \
56 printk("IP_NF_ASSERT: %s:%s:%u\n", \
57 __FUNCTION__, __FILE__, __LINE__); \
58 } while(0)
59 #else
60 #define IP_NF_ASSERT(x)
61 #endif
62
63 #if 0
64 /* All the better to debug you with... */
65 #define static
66 #define inline
67 #endif
68
69 /*
70 We keep a set of rules for each CPU, so we can avoid write-locking
71 them in the softirq when updating the counters and therefore
72 only need to read-lock in the softirq; doing a write_lock_bh() in user
73 context stops packets coming through and allows user context to read
74 the counters or update the rules.
75
76 Hence the start of any table is given by get_table() below. */
77
78 /* Check for an extension */
79 int
80 ip6t_ext_hdr(u8 nexthdr)
81 {
82 return ( (nexthdr == IPPROTO_HOPOPTS) ||
83 (nexthdr == IPPROTO_ROUTING) ||
84 (nexthdr == IPPROTO_FRAGMENT) ||
85 (nexthdr == IPPROTO_ESP) ||
86 (nexthdr == IPPROTO_AH) ||
87 (nexthdr == IPPROTO_NONE) ||
88 (nexthdr == IPPROTO_DSTOPTS) );
89 }
90
91 /* Returns whether matches rule or not. */
92 static inline bool
93 ip6_packet_match(const struct sk_buff *skb,
94 const char *indev,
95 const char *outdev,
96 const struct ip6t_ip6 *ip6info,
97 unsigned int *protoff,
98 int *fragoff, bool *hotdrop)
99 {
100 size_t i;
101 unsigned long ret;
102 const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
103
104 #define FWINV(bool,invflg) ((bool) ^ !!(ip6info->invflags & invflg))
105
106 if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
107 &ip6info->src), IP6T_INV_SRCIP)
108 || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
109 &ip6info->dst), IP6T_INV_DSTIP)) {
110 dprintf("Source or dest mismatch.\n");
111 /*
112 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
113 ipinfo->smsk.s_addr, ipinfo->src.s_addr,
114 ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
115 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
116 ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
117 ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
118 return false;
119 }
120
121 /* Look for ifname matches; this should unroll nicely. */
122 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
123 ret |= (((const unsigned long *)indev)[i]
124 ^ ((const unsigned long *)ip6info->iniface)[i])
125 & ((const unsigned long *)ip6info->iniface_mask)[i];
126 }
127
128 if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
129 dprintf("VIA in mismatch (%s vs %s).%s\n",
130 indev, ip6info->iniface,
131 ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
132 return false;
133 }
134
135 for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
136 ret |= (((const unsigned long *)outdev)[i]
137 ^ ((const unsigned long *)ip6info->outiface)[i])
138 & ((const unsigned long *)ip6info->outiface_mask)[i];
139 }
140
141 if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
142 dprintf("VIA out mismatch (%s vs %s).%s\n",
143 outdev, ip6info->outiface,
144 ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
145 return false;
146 }
147
148 /* ... might want to do something with class and flowlabel here ... */
149
150 /* look for the desired protocol header */
151 if((ip6info->flags & IP6T_F_PROTO)) {
152 int protohdr;
153 unsigned short _frag_off;
154
155 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
156 if (protohdr < 0) {
157 if (_frag_off == 0)
158 *hotdrop = true;
159 return false;
160 }
161 *fragoff = _frag_off;
162
163 dprintf("Packet protocol %hi ?= %s%hi.\n",
164 protohdr,
165 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
166 ip6info->proto);
167
168 if (ip6info->proto == protohdr) {
169 if(ip6info->invflags & IP6T_INV_PROTO) {
170 return false;
171 }
172 return true;
173 }
174
175 /* We need match for the '-p all', too! */
176 if ((ip6info->proto != 0) &&
177 !(ip6info->invflags & IP6T_INV_PROTO))
178 return false;
179 }
180 return true;
181 }
182
183 /* should be ip6 safe */
184 static inline bool
185 ip6_checkentry(const struct ip6t_ip6 *ipv6)
186 {
187 if (ipv6->flags & ~IP6T_F_MASK) {
188 duprintf("Unknown flag bits set: %08X\n",
189 ipv6->flags & ~IP6T_F_MASK);
190 return false;
191 }
192 if (ipv6->invflags & ~IP6T_INV_MASK) {
193 duprintf("Unknown invflag bits set: %08X\n",
194 ipv6->invflags & ~IP6T_INV_MASK);
195 return false;
196 }
197 return true;
198 }
199
200 static unsigned int
201 ip6t_error(struct sk_buff *skb,
202 const struct net_device *in,
203 const struct net_device *out,
204 unsigned int hooknum,
205 const struct xt_target *target,
206 const void *targinfo)
207 {
208 if (net_ratelimit())
209 printk("ip6_tables: error: `%s'\n", (char *)targinfo);
210
211 return NF_DROP;
212 }
213
214 static inline
215 bool do_match(struct ip6t_entry_match *m,
216 const struct sk_buff *skb,
217 const struct net_device *in,
218 const struct net_device *out,
219 int offset,
220 unsigned int protoff,
221 bool *hotdrop)
222 {
223 /* Stop iteration if it doesn't match */
224 if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
225 offset, protoff, hotdrop))
226 return true;
227 else
228 return false;
229 }
230
231 static inline struct ip6t_entry *
232 get_entry(void *base, unsigned int offset)
233 {
234 return (struct ip6t_entry *)(base + offset);
235 }
236
237 /* All zeroes == unconditional rule. */
238 static inline int
239 unconditional(const struct ip6t_ip6 *ipv6)
240 {
241 unsigned int i;
242
243 for (i = 0; i < sizeof(*ipv6); i++)
244 if (((char *)ipv6)[i])
245 break;
246
247 return (i == sizeof(*ipv6));
248 }
249
250 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
251 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
252 /* This cries for unification! */
253 static const char *hooknames[] = {
254 [NF_INET_PRE_ROUTING] = "PREROUTING",
255 [NF_INET_LOCAL_IN] = "INPUT",
256 [NF_INET_FORWARD] = "FORWARD",
257 [NF_INET_LOCAL_OUT] = "OUTPUT",
258 [NF_INET_POST_ROUTING] = "POSTROUTING",
259 };
260
261 enum nf_ip_trace_comments {
262 NF_IP6_TRACE_COMMENT_RULE,
263 NF_IP6_TRACE_COMMENT_RETURN,
264 NF_IP6_TRACE_COMMENT_POLICY,
265 };
266
267 static const char *comments[] = {
268 [NF_IP6_TRACE_COMMENT_RULE] = "rule",
269 [NF_IP6_TRACE_COMMENT_RETURN] = "return",
270 [NF_IP6_TRACE_COMMENT_POLICY] = "policy",
271 };
272
273 static struct nf_loginfo trace_loginfo = {
274 .type = NF_LOG_TYPE_LOG,
275 .u = {
276 .log = {
277 .level = 4,
278 .logflags = NF_LOG_MASK,
279 },
280 },
281 };
282
283 static inline int
284 get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
285 char *hookname, char **chainname,
286 char **comment, unsigned int *rulenum)
287 {
288 struct ip6t_standard_target *t = (void *)ip6t_get_target(s);
289
290 if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
291 /* Head of user chain: ERROR target with chainname */
292 *chainname = t->target.data;
293 (*rulenum) = 0;
294 } else if (s == e) {
295 (*rulenum)++;
296
297 if (s->target_offset == sizeof(struct ip6t_entry)
298 && strcmp(t->target.u.kernel.target->name,
299 IP6T_STANDARD_TARGET) == 0
300 && t->verdict < 0
301 && unconditional(&s->ipv6)) {
302 /* Tail of chains: STANDARD target (return/policy) */
303 *comment = *chainname == hookname
304 ? (char *)comments[NF_IP6_TRACE_COMMENT_POLICY]
305 : (char *)comments[NF_IP6_TRACE_COMMENT_RETURN];
306 }
307 return 1;
308 } else
309 (*rulenum)++;
310
311 return 0;
312 }
313
314 static void trace_packet(struct sk_buff *skb,
315 unsigned int hook,
316 const struct net_device *in,
317 const struct net_device *out,
318 char *tablename,
319 struct xt_table_info *private,
320 struct ip6t_entry *e)
321 {
322 void *table_base;
323 struct ip6t_entry *root;
324 char *hookname, *chainname, *comment;
325 unsigned int rulenum = 0;
326
327 table_base = (void *)private->entries[smp_processor_id()];
328 root = get_entry(table_base, private->hook_entry[hook]);
329
330 hookname = chainname = (char *)hooknames[hook];
331 comment = (char *)comments[NF_IP6_TRACE_COMMENT_RULE];
332
333 IP6T_ENTRY_ITERATE(root,
334 private->size - private->hook_entry[hook],
335 get_chainname_rulenum,
336 e, hookname, &chainname, &comment, &rulenum);
337
338 nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
339 "TRACE: %s:%s:%s:%u ",
340 tablename, chainname, comment, rulenum);
341 }
342 #endif
343
344 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
345 unsigned int
346 ip6t_do_table(struct sk_buff *skb,
347 unsigned int hook,
348 const struct net_device *in,
349 const struct net_device *out,
350 struct xt_table *table)
351 {
352 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
353 int offset = 0;
354 unsigned int protoff = 0;
355 bool hotdrop = false;
356 /* Initializing verdict to NF_DROP keeps gcc happy. */
357 unsigned int verdict = NF_DROP;
358 const char *indev, *outdev;
359 void *table_base;
360 struct ip6t_entry *e, *back;
361 struct xt_table_info *private;
362
363 /* Initialization */
364 indev = in ? in->name : nulldevname;
365 outdev = out ? out->name : nulldevname;
366 /* We handle fragments by dealing with the first fragment as
367 * if it was a normal packet. All other fragments are treated
368 * normally, except that they will NEVER match rules that ask
369 * things we don't know, ie. tcp syn flag or ports). If the
370 * rule is also a fragment-specific rule, non-fragments won't
371 * match it. */
372
373 read_lock_bh(&table->lock);
374 private = table->private;
375 IP_NF_ASSERT(table->valid_hooks & (1 << hook));
376 table_base = (void *)private->entries[smp_processor_id()];
377 e = get_entry(table_base, private->hook_entry[hook]);
378
379 /* For return from builtin chain */
380 back = get_entry(table_base, private->underflow[hook]);
381
382 do {
383 IP_NF_ASSERT(e);
384 IP_NF_ASSERT(back);
385 if (ip6_packet_match(skb, indev, outdev, &e->ipv6,
386 &protoff, &offset, &hotdrop)) {
387 struct ip6t_entry_target *t;
388
389 if (IP6T_MATCH_ITERATE(e, do_match,
390 skb, in, out,
391 offset, protoff, &hotdrop) != 0)
392 goto no_match;
393
394 ADD_COUNTER(e->counters,
395 ntohs(ipv6_hdr(skb)->payload_len) +
396 sizeof(struct ipv6hdr), 1);
397
398 t = ip6t_get_target(e);
399 IP_NF_ASSERT(t->u.kernel.target);
400
401 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
402 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
403 /* The packet is traced: log it */
404 if (unlikely(skb->nf_trace))
405 trace_packet(skb, hook, in, out,
406 table->name, private, e);
407 #endif
408 /* Standard target? */
409 if (!t->u.kernel.target->target) {
410 int v;
411
412 v = ((struct ip6t_standard_target *)t)->verdict;
413 if (v < 0) {
414 /* Pop from stack? */
415 if (v != IP6T_RETURN) {
416 verdict = (unsigned)(-v) - 1;
417 break;
418 }
419 e = back;
420 back = get_entry(table_base,
421 back->comefrom);
422 continue;
423 }
424 if (table_base + v != (void *)e + e->next_offset
425 && !(e->ipv6.flags & IP6T_F_GOTO)) {
426 /* Save old back ptr in next entry */
427 struct ip6t_entry *next
428 = (void *)e + e->next_offset;
429 next->comefrom
430 = (void *)back - table_base;
431 /* set back pointer to next entry */
432 back = next;
433 }
434
435 e = get_entry(table_base, v);
436 } else {
437 /* Targets which reenter must return
438 abs. verdicts */
439 #ifdef CONFIG_NETFILTER_DEBUG
440 ((struct ip6t_entry *)table_base)->comefrom
441 = 0xeeeeeeec;
442 #endif
443 verdict = t->u.kernel.target->target(skb,
444 in, out,
445 hook,
446 t->u.kernel.target,
447 t->data);
448
449 #ifdef CONFIG_NETFILTER_DEBUG
450 if (((struct ip6t_entry *)table_base)->comefrom
451 != 0xeeeeeeec
452 && verdict == IP6T_CONTINUE) {
453 printk("Target %s reentered!\n",
454 t->u.kernel.target->name);
455 verdict = NF_DROP;
456 }
457 ((struct ip6t_entry *)table_base)->comefrom
458 = 0x57acc001;
459 #endif
460 if (verdict == IP6T_CONTINUE)
461 e = (void *)e + e->next_offset;
462 else
463 /* Verdict */
464 break;
465 }
466 } else {
467
468 no_match:
469 e = (void *)e + e->next_offset;
470 }
471 } while (!hotdrop);
472
473 #ifdef CONFIG_NETFILTER_DEBUG
474 ((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON;
475 #endif
476 read_unlock_bh(&table->lock);
477
478 #ifdef DEBUG_ALLOW_ALL
479 return NF_ACCEPT;
480 #else
481 if (hotdrop)
482 return NF_DROP;
483 else return verdict;
484 #endif
485 }
486
487 /* Figures out from what hook each rule can be called: returns 0 if
488 there are loops. Puts hook bitmask in comefrom. */
489 static int
490 mark_source_chains(struct xt_table_info *newinfo,
491 unsigned int valid_hooks, void *entry0)
492 {
493 unsigned int hook;
494
495 /* No recursion; use packet counter to save back ptrs (reset
496 to 0 as we leave), and comefrom to save source hook bitmask */
497 for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
498 unsigned int pos = newinfo->hook_entry[hook];
499 struct ip6t_entry *e
500 = (struct ip6t_entry *)(entry0 + pos);
501 int visited = e->comefrom & (1 << hook);
502
503 if (!(valid_hooks & (1 << hook)))
504 continue;
505
506 /* Set initial back pointer. */
507 e->counters.pcnt = pos;
508
509 for (;;) {
510 struct ip6t_standard_target *t
511 = (void *)ip6t_get_target(e);
512
513 if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
514 printk("iptables: loop hook %u pos %u %08X.\n",
515 hook, pos, e->comefrom);
516 return 0;
517 }
518 e->comefrom
519 |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
520
521 /* Unconditional return/END. */
522 if ((e->target_offset == sizeof(struct ip6t_entry)
523 && (strcmp(t->target.u.user.name,
524 IP6T_STANDARD_TARGET) == 0)
525 && t->verdict < 0
526 && unconditional(&e->ipv6)) || visited) {
527 unsigned int oldpos, size;
528
529 if (t->verdict < -NF_MAX_VERDICT - 1) {
530 duprintf("mark_source_chains: bad "
531 "negative verdict (%i)\n",
532 t->verdict);
533 return 0;
534 }
535
536 /* Return: backtrack through the last
537 big jump. */
538 do {
539 e->comefrom ^= (1<<NF_INET_NUMHOOKS);
540 #ifdef DEBUG_IP_FIREWALL_USER
541 if (e->comefrom
542 & (1 << NF_INET_NUMHOOKS)) {
543 duprintf("Back unset "
544 "on hook %u "
545 "rule %u\n",
546 hook, pos);
547 }
548 #endif
549 oldpos = pos;
550 pos = e->counters.pcnt;
551 e->counters.pcnt = 0;
552
553 /* We're at the start. */
554 if (pos == oldpos)
555 goto next;
556
557 e = (struct ip6t_entry *)
558 (entry0 + pos);
559 } while (oldpos == pos + e->next_offset);
560
561 /* Move along one */
562 size = e->next_offset;
563 e = (struct ip6t_entry *)
564 (entry0 + pos + size);
565 e->counters.pcnt = pos;
566 pos += size;
567 } else {
568 int newpos = t->verdict;
569
570 if (strcmp(t->target.u.user.name,
571 IP6T_STANDARD_TARGET) == 0
572 && newpos >= 0) {
573 if (newpos > newinfo->size -
574 sizeof(struct ip6t_entry)) {
575 duprintf("mark_source_chains: "
576 "bad verdict (%i)\n",
577 newpos);
578 return 0;
579 }
580 /* This a jump; chase it. */
581 duprintf("Jump rule %u -> %u\n",
582 pos, newpos);
583 } else {
584 /* ... this is a fallthru */
585 newpos = pos + e->next_offset;
586 }
587 e = (struct ip6t_entry *)
588 (entry0 + newpos);
589 e->counters.pcnt = pos;
590 pos = newpos;
591 }
592 }
593 next:
594 duprintf("Finished chain %u\n", hook);
595 }
596 return 1;
597 }
598
599 static inline int
600 cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
601 {
602 if (i && (*i)-- == 0)
603 return 1;
604
605 if (m->u.kernel.match->destroy)
606 m->u.kernel.match->destroy(m->u.kernel.match, m->data);
607 module_put(m->u.kernel.match->me);
608 return 0;
609 }
610
611 static inline int
612 check_entry(struct ip6t_entry *e, const char *name)
613 {
614 struct ip6t_entry_target *t;
615
616 if (!ip6_checkentry(&e->ipv6)) {
617 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
618 return -EINVAL;
619 }
620
621 if (e->target_offset + sizeof(struct ip6t_entry_target) >
622 e->next_offset)
623 return -EINVAL;
624
625 t = ip6t_get_target(e);
626 if (e->target_offset + t->u.target_size > e->next_offset)
627 return -EINVAL;
628
629 return 0;
630 }
631
632 static inline int check_match(struct ip6t_entry_match *m, const char *name,
633 const struct ip6t_ip6 *ipv6,
634 unsigned int hookmask, unsigned int *i)
635 {
636 struct xt_match *match;
637 int ret;
638
639 match = m->u.kernel.match;
640 ret = xt_check_match(match, AF_INET6, m->u.match_size - sizeof(*m),
641 name, hookmask, ipv6->proto,
642 ipv6->invflags & IP6T_INV_PROTO);
643 if (!ret && m->u.kernel.match->checkentry
644 && !m->u.kernel.match->checkentry(name, ipv6, match, m->data,
645 hookmask)) {
646 duprintf("ip_tables: check failed for `%s'.\n",
647 m->u.kernel.match->name);
648 ret = -EINVAL;
649 }
650 if (!ret)
651 (*i)++;
652 return ret;
653 }
654
655 static inline int
656 find_check_match(struct ip6t_entry_match *m,
657 const char *name,
658 const struct ip6t_ip6 *ipv6,
659 unsigned int hookmask,
660 unsigned int *i)
661 {
662 struct xt_match *match;
663 int ret;
664
665 match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
666 m->u.user.revision),
667 "ip6t_%s", m->u.user.name);
668 if (IS_ERR(match) || !match) {
669 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
670 return match ? PTR_ERR(match) : -ENOENT;
671 }
672 m->u.kernel.match = match;
673
674 ret = check_match(m, name, ipv6, hookmask, i);
675 if (ret)
676 goto err;
677
678 return 0;
679 err:
680 module_put(m->u.kernel.match->me);
681 return ret;
682 }
683
684 static inline int check_target(struct ip6t_entry *e, const char *name)
685 {
686 struct ip6t_entry_target *t;
687 struct xt_target *target;
688 int ret;
689
690 t = ip6t_get_target(e);
691 target = t->u.kernel.target;
692 ret = xt_check_target(target, AF_INET6, t->u.target_size - sizeof(*t),
693 name, e->comefrom, e->ipv6.proto,
694 e->ipv6.invflags & IP6T_INV_PROTO);
695 if (!ret && t->u.kernel.target->checkentry
696 && !t->u.kernel.target->checkentry(name, e, target, t->data,
697 e->comefrom)) {
698 duprintf("ip_tables: check failed for `%s'.\n",
699 t->u.kernel.target->name);
700 ret = -EINVAL;
701 }
702 return ret;
703 }
704
705 static inline int
706 find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
707 unsigned int *i)
708 {
709 struct ip6t_entry_target *t;
710 struct xt_target *target;
711 int ret;
712 unsigned int j;
713
714 ret = check_entry(e, name);
715 if (ret)
716 return ret;
717
718 j = 0;
719 ret = IP6T_MATCH_ITERATE(e, find_check_match, name, &e->ipv6,
720 e->comefrom, &j);
721 if (ret != 0)
722 goto cleanup_matches;
723
724 t = ip6t_get_target(e);
725 target = try_then_request_module(xt_find_target(AF_INET6,
726 t->u.user.name,
727 t->u.user.revision),
728 "ip6t_%s", t->u.user.name);
729 if (IS_ERR(target) || !target) {
730 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
731 ret = target ? PTR_ERR(target) : -ENOENT;
732 goto cleanup_matches;
733 }
734 t->u.kernel.target = target;
735
736 ret = check_target(e, name);
737 if (ret)
738 goto err;
739
740 (*i)++;
741 return 0;
742 err:
743 module_put(t->u.kernel.target->me);
744 cleanup_matches:
745 IP6T_MATCH_ITERATE(e, cleanup_match, &j);
746 return ret;
747 }
748
749 static inline int
750 check_entry_size_and_hooks(struct ip6t_entry *e,
751 struct xt_table_info *newinfo,
752 unsigned char *base,
753 unsigned char *limit,
754 const unsigned int *hook_entries,
755 const unsigned int *underflows,
756 unsigned int *i)
757 {
758 unsigned int h;
759
760 if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
761 || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
762 duprintf("Bad offset %p\n", e);
763 return -EINVAL;
764 }
765
766 if (e->next_offset
767 < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
768 duprintf("checking: element %p size %u\n",
769 e, e->next_offset);
770 return -EINVAL;
771 }
772
773 /* Check hooks & underflows */
774 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
775 if ((unsigned char *)e - base == hook_entries[h])
776 newinfo->hook_entry[h] = hook_entries[h];
777 if ((unsigned char *)e - base == underflows[h])
778 newinfo->underflow[h] = underflows[h];
779 }
780
781 /* FIXME: underflows must be unconditional, standard verdicts
782 < 0 (not IP6T_RETURN). --RR */
783
784 /* Clear counters and comefrom */
785 e->counters = ((struct xt_counters) { 0, 0 });
786 e->comefrom = 0;
787
788 (*i)++;
789 return 0;
790 }
791
792 static inline int
793 cleanup_entry(struct ip6t_entry *e, unsigned int *i)
794 {
795 struct ip6t_entry_target *t;
796
797 if (i && (*i)-- == 0)
798 return 1;
799
800 /* Cleanup all matches */
801 IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
802 t = ip6t_get_target(e);
803 if (t->u.kernel.target->destroy)
804 t->u.kernel.target->destroy(t->u.kernel.target, t->data);
805 module_put(t->u.kernel.target->me);
806 return 0;
807 }
808
809 /* Checks and translates the user-supplied table segment (held in
810 newinfo) */
811 static int
812 translate_table(const char *name,
813 unsigned int valid_hooks,
814 struct xt_table_info *newinfo,
815 void *entry0,
816 unsigned int size,
817 unsigned int number,
818 const unsigned int *hook_entries,
819 const unsigned int *underflows)
820 {
821 unsigned int i;
822 int ret;
823
824 newinfo->size = size;
825 newinfo->number = number;
826
827 /* Init all hooks to impossible value. */
828 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
829 newinfo->hook_entry[i] = 0xFFFFFFFF;
830 newinfo->underflow[i] = 0xFFFFFFFF;
831 }
832
833 duprintf("translate_table: size %u\n", newinfo->size);
834 i = 0;
835 /* Walk through entries, checking offsets. */
836 ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
837 check_entry_size_and_hooks,
838 newinfo,
839 entry0,
840 entry0 + size,
841 hook_entries, underflows, &i);
842 if (ret != 0)
843 return ret;
844
845 if (i != number) {
846 duprintf("translate_table: %u not %u entries\n",
847 i, number);
848 return -EINVAL;
849 }
850
851 /* Check hooks all assigned */
852 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
853 /* Only hooks which are valid */
854 if (!(valid_hooks & (1 << i)))
855 continue;
856 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
857 duprintf("Invalid hook entry %u %u\n",
858 i, hook_entries[i]);
859 return -EINVAL;
860 }
861 if (newinfo->underflow[i] == 0xFFFFFFFF) {
862 duprintf("Invalid underflow %u %u\n",
863 i, underflows[i]);
864 return -EINVAL;
865 }
866 }
867
868 if (!mark_source_chains(newinfo, valid_hooks, entry0))
869 return -ELOOP;
870
871 /* Finally, each sanity check must pass */
872 i = 0;
873 ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
874 find_check_entry, name, size, &i);
875
876 if (ret != 0) {
877 IP6T_ENTRY_ITERATE(entry0, newinfo->size,
878 cleanup_entry, &i);
879 return ret;
880 }
881
882 /* And one copy for every other CPU */
883 for_each_possible_cpu(i) {
884 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
885 memcpy(newinfo->entries[i], entry0, newinfo->size);
886 }
887
888 return 0;
889 }
890
891 /* Gets counters. */
892 static inline int
893 add_entry_to_counter(const struct ip6t_entry *e,
894 struct xt_counters total[],
895 unsigned int *i)
896 {
897 ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
898
899 (*i)++;
900 return 0;
901 }
902
903 static inline int
904 set_entry_to_counter(const struct ip6t_entry *e,
905 struct ip6t_counters total[],
906 unsigned int *i)
907 {
908 SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
909
910 (*i)++;
911 return 0;
912 }
913
914 static void
915 get_counters(const struct xt_table_info *t,
916 struct xt_counters counters[])
917 {
918 unsigned int cpu;
919 unsigned int i;
920 unsigned int curcpu;
921
922 /* Instead of clearing (by a previous call to memset())
923 * the counters and using adds, we set the counters
924 * with data used by 'current' CPU
925 * We dont care about preemption here.
926 */
927 curcpu = raw_smp_processor_id();
928
929 i = 0;
930 IP6T_ENTRY_ITERATE(t->entries[curcpu],
931 t->size,
932 set_entry_to_counter,
933 counters,
934 &i);
935
936 for_each_possible_cpu(cpu) {
937 if (cpu == curcpu)
938 continue;
939 i = 0;
940 IP6T_ENTRY_ITERATE(t->entries[cpu],
941 t->size,
942 add_entry_to_counter,
943 counters,
944 &i);
945 }
946 }
947
948 static inline struct xt_counters *alloc_counters(struct xt_table *table)
949 {
950 unsigned int countersize;
951 struct xt_counters *counters;
952 struct xt_table_info *private = table->private;
953
954 /* We need atomic snapshot of counters: rest doesn't change
955 (other than comefrom, which userspace doesn't care
956 about). */
957 countersize = sizeof(struct xt_counters) * private->number;
958 counters = vmalloc_node(countersize, numa_node_id());
959
960 if (counters == NULL)
961 return ERR_PTR(-ENOMEM);
962
963 /* First, sum counters... */
964 write_lock_bh(&table->lock);
965 get_counters(private, counters);
966 write_unlock_bh(&table->lock);
967
968 return counters;
969 }
970
971 static int
972 copy_entries_to_user(unsigned int total_size,
973 struct xt_table *table,
974 void __user *userptr)
975 {
976 unsigned int off, num;
977 struct ip6t_entry *e;
978 struct xt_counters *counters;
979 struct xt_table_info *private = table->private;
980 int ret = 0;
981 void *loc_cpu_entry;
982
983 counters = alloc_counters(table);
984 if (IS_ERR(counters))
985 return PTR_ERR(counters);
986
987 /* choose the copy that is on ourc node/cpu */
988 loc_cpu_entry = private->entries[raw_smp_processor_id()];
989 if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
990 ret = -EFAULT;
991 goto free_counters;
992 }
993
994 /* FIXME: use iterator macros --RR */
995 /* ... then go back and fix counters and names */
996 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
997 unsigned int i;
998 struct ip6t_entry_match *m;
999 struct ip6t_entry_target *t;
1000
1001 e = (struct ip6t_entry *)(loc_cpu_entry + off);
1002 if (copy_to_user(userptr + off
1003 + offsetof(struct ip6t_entry, counters),
1004 &counters[num],
1005 sizeof(counters[num])) != 0) {
1006 ret = -EFAULT;
1007 goto free_counters;
1008 }
1009
1010 for (i = sizeof(struct ip6t_entry);
1011 i < e->target_offset;
1012 i += m->u.match_size) {
1013 m = (void *)e + i;
1014
1015 if (copy_to_user(userptr + off + i
1016 + offsetof(struct ip6t_entry_match,
1017 u.user.name),
1018 m->u.kernel.match->name,
1019 strlen(m->u.kernel.match->name)+1)
1020 != 0) {
1021 ret = -EFAULT;
1022 goto free_counters;
1023 }
1024 }
1025
1026 t = ip6t_get_target(e);
1027 if (copy_to_user(userptr + off + e->target_offset
1028 + offsetof(struct ip6t_entry_target,
1029 u.user.name),
1030 t->u.kernel.target->name,
1031 strlen(t->u.kernel.target->name)+1) != 0) {
1032 ret = -EFAULT;
1033 goto free_counters;
1034 }
1035 }
1036
1037 free_counters:
1038 vfree(counters);
1039 return ret;
1040 }
1041
1042 #ifdef CONFIG_COMPAT
1043 static void compat_standard_from_user(void *dst, void *src)
1044 {
1045 int v = *(compat_int_t *)src;
1046
1047 if (v > 0)
1048 v += xt_compat_calc_jump(AF_INET6, v);
1049 memcpy(dst, &v, sizeof(v));
1050 }
1051
1052 static int compat_standard_to_user(void __user *dst, void *src)
1053 {
1054 compat_int_t cv = *(int *)src;
1055
1056 if (cv > 0)
1057 cv -= xt_compat_calc_jump(AF_INET6, cv);
1058 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1059 }
1060
1061 static inline int
1062 compat_calc_match(struct ip6t_entry_match *m, int *size)
1063 {
1064 *size += xt_compat_match_offset(m->u.kernel.match);
1065 return 0;
1066 }
1067
1068 static int compat_calc_entry(struct ip6t_entry *e,
1069 const struct xt_table_info *info,
1070 void *base, struct xt_table_info *newinfo)
1071 {
1072 struct ip6t_entry_target *t;
1073 unsigned int entry_offset;
1074 int off, i, ret;
1075
1076 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1077 entry_offset = (void *)e - base;
1078 IP6T_MATCH_ITERATE(e, compat_calc_match, &off);
1079 t = ip6t_get_target(e);
1080 off += xt_compat_target_offset(t->u.kernel.target);
1081 newinfo->size -= off;
1082 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1083 if (ret)
1084 return ret;
1085
1086 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1087 if (info->hook_entry[i] &&
1088 (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
1089 newinfo->hook_entry[i] -= off;
1090 if (info->underflow[i] &&
1091 (e < (struct ip6t_entry *)(base + info->underflow[i])))
1092 newinfo->underflow[i] -= off;
1093 }
1094 return 0;
1095 }
1096
1097 static int compat_table_info(const struct xt_table_info *info,
1098 struct xt_table_info *newinfo)
1099 {
1100 void *loc_cpu_entry;
1101
1102 if (!newinfo || !info)
1103 return -EINVAL;
1104
1105 /* we dont care about newinfo->entries[] */
1106 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1107 newinfo->initial_entries = 0;
1108 loc_cpu_entry = info->entries[raw_smp_processor_id()];
1109 return IP6T_ENTRY_ITERATE(loc_cpu_entry, info->size,
1110 compat_calc_entry, info, loc_cpu_entry,
1111 newinfo);
1112 }
1113 #endif
1114
1115 static int get_info(void __user *user, int *len, int compat)
1116 {
1117 char name[IP6T_TABLE_MAXNAMELEN];
1118 struct xt_table *t;
1119 int ret;
1120
1121 if (*len != sizeof(struct ip6t_getinfo)) {
1122 duprintf("length %u != %u\n", *len,
1123 sizeof(struct ip6t_getinfo));
1124 return -EINVAL;
1125 }
1126
1127 if (copy_from_user(name, user, sizeof(name)) != 0)
1128 return -EFAULT;
1129
1130 name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
1131 #ifdef CONFIG_COMPAT
1132 if (compat)
1133 xt_compat_lock(AF_INET6);
1134 #endif
1135 t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
1136 "ip6table_%s", name);
1137 if (t && !IS_ERR(t)) {
1138 struct ip6t_getinfo info;
1139 struct xt_table_info *private = t->private;
1140
1141 #ifdef CONFIG_COMPAT
1142 if (compat) {
1143 struct xt_table_info tmp;
1144 ret = compat_table_info(private, &tmp);
1145 xt_compat_flush_offsets(AF_INET6);
1146 private = &tmp;
1147 }
1148 #endif
1149 info.valid_hooks = t->valid_hooks;
1150 memcpy(info.hook_entry, private->hook_entry,
1151 sizeof(info.hook_entry));
1152 memcpy(info.underflow, private->underflow,
1153 sizeof(info.underflow));
1154 info.num_entries = private->number;
1155 info.size = private->size;
1156 memcpy(info.name, name, sizeof(info.name));
1157
1158 if (copy_to_user(user, &info, *len) != 0)
1159 ret = -EFAULT;
1160 else
1161 ret = 0;
1162
1163 xt_table_unlock(t);
1164 module_put(t->me);
1165 } else
1166 ret = t ? PTR_ERR(t) : -ENOENT;
1167 #ifdef CONFIG_COMPAT
1168 if (compat)
1169 xt_compat_unlock(AF_INET6);
1170 #endif
1171 return ret;
1172 }
1173
1174 static int
1175 get_entries(struct ip6t_get_entries __user *uptr, int *len)
1176 {
1177 int ret;
1178 struct ip6t_get_entries get;
1179 struct xt_table *t;
1180
1181 if (*len < sizeof(get)) {
1182 duprintf("get_entries: %u < %u\n", *len, sizeof(get));
1183 return -EINVAL;
1184 }
1185 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1186 return -EFAULT;
1187 if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1188 duprintf("get_entries: %u != %u\n", *len,
1189 sizeof(struct ip6t_get_entries) + get.size);
1190 return -EINVAL;
1191 }
1192
1193 t = xt_find_table_lock(AF_INET6, get.name);
1194 if (t && !IS_ERR(t)) {
1195 struct xt_table_info *private = t->private;
1196 duprintf("t->private->number = %u\n", private->number);
1197 if (get.size == private->size)
1198 ret = copy_entries_to_user(private->size,
1199 t, uptr->entrytable);
1200 else {
1201 duprintf("get_entries: I've got %u not %u!\n",
1202 private->size, entries->size);
1203 ret = -EINVAL;
1204 }
1205 module_put(t->me);
1206 xt_table_unlock(t);
1207 } else
1208 ret = t ? PTR_ERR(t) : -ENOENT;
1209
1210 return ret;
1211 }
1212
1213 static int
1214 __do_replace(const char *name, unsigned int valid_hooks,
1215 struct xt_table_info *newinfo, unsigned int num_counters,
1216 void __user *counters_ptr)
1217 {
1218 int ret;
1219 struct xt_table *t;
1220 struct xt_table_info *oldinfo;
1221 struct xt_counters *counters;
1222 void *loc_cpu_old_entry;
1223
1224 ret = 0;
1225 counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
1226 numa_node_id());
1227 if (!counters) {
1228 ret = -ENOMEM;
1229 goto out;
1230 }
1231
1232 t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
1233 "ip6table_%s", name);
1234 if (!t || IS_ERR(t)) {
1235 ret = t ? PTR_ERR(t) : -ENOENT;
1236 goto free_newinfo_counters_untrans;
1237 }
1238
1239 /* You lied! */
1240 if (valid_hooks != t->valid_hooks) {
1241 duprintf("Valid hook crap: %08X vs %08X\n",
1242 valid_hooks, t->valid_hooks);
1243 ret = -EINVAL;
1244 goto put_module;
1245 }
1246
1247 oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1248 if (!oldinfo)
1249 goto put_module;
1250
1251 /* Update module usage count based on number of rules */
1252 duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1253 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1254 if ((oldinfo->number > oldinfo->initial_entries) ||
1255 (newinfo->number <= oldinfo->initial_entries))
1256 module_put(t->me);
1257 if ((oldinfo->number > oldinfo->initial_entries) &&
1258 (newinfo->number <= oldinfo->initial_entries))
1259 module_put(t->me);
1260
1261 /* Get the old counters. */
1262 get_counters(oldinfo, counters);
1263 /* Decrease module usage counts and free resource */
1264 loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1265 IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
1266 NULL);
1267 xt_free_table_info(oldinfo);
1268 if (copy_to_user(counters_ptr, counters,
1269 sizeof(struct xt_counters) * num_counters) != 0)
1270 ret = -EFAULT;
1271 vfree(counters);
1272 xt_table_unlock(t);
1273 return ret;
1274
1275 put_module:
1276 module_put(t->me);
1277 xt_table_unlock(t);
1278 free_newinfo_counters_untrans:
1279 vfree(counters);
1280 out:
1281 return ret;
1282 }
1283
1284 static int
1285 do_replace(void __user *user, unsigned int len)
1286 {
1287 int ret;
1288 struct ip6t_replace tmp;
1289 struct xt_table_info *newinfo;
1290 void *loc_cpu_entry;
1291
1292 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1293 return -EFAULT;
1294
1295 /* overflow check */
1296 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1297 return -ENOMEM;
1298
1299 newinfo = xt_alloc_table_info(tmp.size);
1300 if (!newinfo)
1301 return -ENOMEM;
1302
1303 /* choose the copy that is on our node/cpu */
1304 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1305 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1306 tmp.size) != 0) {
1307 ret = -EFAULT;
1308 goto free_newinfo;
1309 }
1310
1311 ret = translate_table(tmp.name, tmp.valid_hooks,
1312 newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1313 tmp.hook_entry, tmp.underflow);
1314 if (ret != 0)
1315 goto free_newinfo;
1316
1317 duprintf("ip_tables: Translated table\n");
1318
1319 ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
1320 tmp.num_counters, tmp.counters);
1321 if (ret)
1322 goto free_newinfo_untrans;
1323 return 0;
1324
1325 free_newinfo_untrans:
1326 IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
1327 free_newinfo:
1328 xt_free_table_info(newinfo);
1329 return ret;
1330 }
1331
1332 /* We're lazy, and add to the first CPU; overflow works its fey magic
1333 * and everything is OK. */
1334 static inline int
1335 add_counter_to_entry(struct ip6t_entry *e,
1336 const struct xt_counters addme[],
1337 unsigned int *i)
1338 {
1339 #if 0
1340 duprintf("add_counter: Entry %u %lu/%lu + %lu/%lu\n",
1341 *i,
1342 (long unsigned int)e->counters.pcnt,
1343 (long unsigned int)e->counters.bcnt,
1344 (long unsigned int)addme[*i].pcnt,
1345 (long unsigned int)addme[*i].bcnt);
1346 #endif
1347
1348 ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1349
1350 (*i)++;
1351 return 0;
1352 }
1353
1354 static int
1355 do_add_counters(void __user *user, unsigned int len, int compat)
1356 {
1357 unsigned int i;
1358 struct xt_counters_info tmp;
1359 struct xt_counters *paddc;
1360 unsigned int num_counters;
1361 char *name;
1362 int size;
1363 void *ptmp;
1364 struct xt_table_info *private;
1365 struct xt_table *t;
1366 int ret = 0;
1367 void *loc_cpu_entry;
1368 #ifdef CONFIG_COMPAT
1369 struct compat_xt_counters_info compat_tmp;
1370
1371 if (compat) {
1372 ptmp = &compat_tmp;
1373 size = sizeof(struct compat_xt_counters_info);
1374 } else
1375 #endif
1376 {
1377 ptmp = &tmp;
1378 size = sizeof(struct xt_counters_info);
1379 }
1380
1381 if (copy_from_user(ptmp, user, size) != 0)
1382 return -EFAULT;
1383
1384 #ifdef CONFIG_COMPAT
1385 if (compat) {
1386 num_counters = compat_tmp.num_counters;
1387 name = compat_tmp.name;
1388 } else
1389 #endif
1390 {
1391 num_counters = tmp.num_counters;
1392 name = tmp.name;
1393 }
1394
1395 if (len != size + num_counters * sizeof(struct xt_counters))
1396 return -EINVAL;
1397
1398 paddc = vmalloc_node(len - size, numa_node_id());
1399 if (!paddc)
1400 return -ENOMEM;
1401
1402 if (copy_from_user(paddc, user + size, len - size) != 0) {
1403 ret = -EFAULT;
1404 goto free;
1405 }
1406
1407 t = xt_find_table_lock(AF_INET6, name);
1408 if (!t || IS_ERR(t)) {
1409 ret = t ? PTR_ERR(t) : -ENOENT;
1410 goto free;
1411 }
1412
1413 write_lock_bh(&t->lock);
1414 private = t->private;
1415 if (private->number != num_counters) {
1416 ret = -EINVAL;
1417 goto unlock_up_free;
1418 }
1419
1420 i = 0;
1421 /* Choose the copy that is on our node */
1422 loc_cpu_entry = private->entries[smp_processor_id()];
1423 IP6T_ENTRY_ITERATE(loc_cpu_entry,
1424 private->size,
1425 add_counter_to_entry,
1426 paddc,
1427 &i);
1428 unlock_up_free:
1429 write_unlock_bh(&t->lock);
1430 xt_table_unlock(t);
1431 module_put(t->me);
1432 free:
1433 vfree(paddc);
1434
1435 return ret;
1436 }
1437
1438 #ifdef CONFIG_COMPAT
1439 struct compat_ip6t_replace {
1440 char name[IP6T_TABLE_MAXNAMELEN];
1441 u32 valid_hooks;
1442 u32 num_entries;
1443 u32 size;
1444 u32 hook_entry[NF_INET_NUMHOOKS];
1445 u32 underflow[NF_INET_NUMHOOKS];
1446 u32 num_counters;
1447 compat_uptr_t counters; /* struct ip6t_counters * */
1448 struct compat_ip6t_entry entries[0];
1449 };
1450
1451 static int
1452 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1453 compat_uint_t *size, struct xt_counters *counters,
1454 unsigned int *i)
1455 {
1456 struct ip6t_entry_target *t;
1457 struct compat_ip6t_entry __user *ce;
1458 u_int16_t target_offset, next_offset;
1459 compat_uint_t origsize;
1460 int ret;
1461
1462 ret = -EFAULT;
1463 origsize = *size;
1464 ce = (struct compat_ip6t_entry __user *)*dstptr;
1465 if (copy_to_user(ce, e, sizeof(struct ip6t_entry)))
1466 goto out;
1467
1468 if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
1469 goto out;
1470
1471 *dstptr += sizeof(struct compat_ip6t_entry);
1472 *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1473
1474 ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
1475 target_offset = e->target_offset - (origsize - *size);
1476 if (ret)
1477 goto out;
1478 t = ip6t_get_target(e);
1479 ret = xt_compat_target_to_user(t, dstptr, size);
1480 if (ret)
1481 goto out;
1482 ret = -EFAULT;
1483 next_offset = e->next_offset - (origsize - *size);
1484 if (put_user(target_offset, &ce->target_offset))
1485 goto out;
1486 if (put_user(next_offset, &ce->next_offset))
1487 goto out;
1488
1489 (*i)++;
1490 return 0;
1491 out:
1492 return ret;
1493 }
1494
1495 static inline int
1496 compat_find_calc_match(struct ip6t_entry_match *m,
1497 const char *name,
1498 const struct ip6t_ip6 *ipv6,
1499 unsigned int hookmask,
1500 int *size, int *i)
1501 {
1502 struct xt_match *match;
1503
1504 match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
1505 m->u.user.revision),
1506 "ip6t_%s", m->u.user.name);
1507 if (IS_ERR(match) || !match) {
1508 duprintf("compat_check_calc_match: `%s' not found\n",
1509 m->u.user.name);
1510 return match ? PTR_ERR(match) : -ENOENT;
1511 }
1512 m->u.kernel.match = match;
1513 *size += xt_compat_match_offset(match);
1514
1515 (*i)++;
1516 return 0;
1517 }
1518
1519 static inline int
1520 compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
1521 {
1522 if (i && (*i)-- == 0)
1523 return 1;
1524
1525 module_put(m->u.kernel.match->me);
1526 return 0;
1527 }
1528
1529 static inline int
1530 compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
1531 {
1532 struct ip6t_entry_target *t;
1533
1534 if (i && (*i)-- == 0)
1535 return 1;
1536
1537 /* Cleanup all matches */
1538 COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
1539 t = compat_ip6t_get_target(e);
1540 module_put(t->u.kernel.target->me);
1541 return 0;
1542 }
1543
1544 static inline int
1545 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1546 struct xt_table_info *newinfo,
1547 unsigned int *size,
1548 unsigned char *base,
1549 unsigned char *limit,
1550 unsigned int *hook_entries,
1551 unsigned int *underflows,
1552 unsigned int *i,
1553 const char *name)
1554 {
1555 struct ip6t_entry_target *t;
1556 struct xt_target *target;
1557 unsigned int entry_offset;
1558 int ret, off, h, j;
1559
1560 duprintf("check_compat_entry_size_and_hooks %p\n", e);
1561 if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0
1562 || (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
1563 duprintf("Bad offset %p, limit = %p\n", e, limit);
1564 return -EINVAL;
1565 }
1566
1567 if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1568 sizeof(struct compat_xt_entry_target)) {
1569 duprintf("checking: element %p size %u\n",
1570 e, e->next_offset);
1571 return -EINVAL;
1572 }
1573
1574 /* For purposes of check_entry casting the compat entry is fine */
1575 ret = check_entry((struct ip6t_entry *)e, name);
1576 if (ret)
1577 return ret;
1578
1579 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1580 entry_offset = (void *)e - (void *)base;
1581 j = 0;
1582 ret = COMPAT_IP6T_MATCH_ITERATE(e, compat_find_calc_match, name,
1583 &e->ipv6, e->comefrom, &off, &j);
1584 if (ret != 0)
1585 goto release_matches;
1586
1587 t = compat_ip6t_get_target(e);
1588 target = try_then_request_module(xt_find_target(AF_INET6,
1589 t->u.user.name,
1590 t->u.user.revision),
1591 "ip6t_%s", t->u.user.name);
1592 if (IS_ERR(target) || !target) {
1593 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1594 t->u.user.name);
1595 ret = target ? PTR_ERR(target) : -ENOENT;
1596 goto release_matches;
1597 }
1598 t->u.kernel.target = target;
1599
1600 off += xt_compat_target_offset(target);
1601 *size += off;
1602 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1603 if (ret)
1604 goto out;
1605
1606 /* Check hooks & underflows */
1607 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1608 if ((unsigned char *)e - base == hook_entries[h])
1609 newinfo->hook_entry[h] = hook_entries[h];
1610 if ((unsigned char *)e - base == underflows[h])
1611 newinfo->underflow[h] = underflows[h];
1612 }
1613
1614 /* Clear counters and comefrom */
1615 memset(&e->counters, 0, sizeof(e->counters));
1616 e->comefrom = 0;
1617
1618 (*i)++;
1619 return 0;
1620
1621 out:
1622 module_put(t->u.kernel.target->me);
1623 release_matches:
1624 IP6T_MATCH_ITERATE(e, compat_release_match, &j);
1625 return ret;
1626 }
1627
1628 static int
1629 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1630 unsigned int *size, const char *name,
1631 struct xt_table_info *newinfo, unsigned char *base)
1632 {
1633 struct ip6t_entry_target *t;
1634 struct xt_target *target;
1635 struct ip6t_entry *de;
1636 unsigned int origsize;
1637 int ret, h;
1638
1639 ret = 0;
1640 origsize = *size;
1641 de = (struct ip6t_entry *)*dstptr;
1642 memcpy(de, e, sizeof(struct ip6t_entry));
1643 memcpy(&de->counters, &e->counters, sizeof(e->counters));
1644
1645 *dstptr += sizeof(struct ip6t_entry);
1646 *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1647
1648 ret = COMPAT_IP6T_MATCH_ITERATE(e, xt_compat_match_from_user,
1649 dstptr, size);
1650 if (ret)
1651 return ret;
1652 de->target_offset = e->target_offset - (origsize - *size);
1653 t = compat_ip6t_get_target(e);
1654 target = t->u.kernel.target;
1655 xt_compat_target_from_user(t, dstptr, size);
1656
1657 de->next_offset = e->next_offset - (origsize - *size);
1658 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1659 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1660 newinfo->hook_entry[h] -= origsize - *size;
1661 if ((unsigned char *)de - base < newinfo->underflow[h])
1662 newinfo->underflow[h] -= origsize - *size;
1663 }
1664 return ret;
1665 }
1666
1667 static inline int compat_check_entry(struct ip6t_entry *e, const char *name,
1668 unsigned int *i)
1669 {
1670 int j, ret;
1671
1672 j = 0;
1673 ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6,
1674 e->comefrom, &j);
1675 if (ret)
1676 goto cleanup_matches;
1677
1678 ret = check_target(e, name);
1679 if (ret)
1680 goto cleanup_matches;
1681
1682 (*i)++;
1683 return 0;
1684
1685 cleanup_matches:
1686 IP6T_MATCH_ITERATE(e, cleanup_match, &j);
1687 return ret;
1688 }
1689
1690 static int
1691 translate_compat_table(const char *name,
1692 unsigned int valid_hooks,
1693 struct xt_table_info **pinfo,
1694 void **pentry0,
1695 unsigned int total_size,
1696 unsigned int number,
1697 unsigned int *hook_entries,
1698 unsigned int *underflows)
1699 {
1700 unsigned int i, j;
1701 struct xt_table_info *newinfo, *info;
1702 void *pos, *entry0, *entry1;
1703 unsigned int size;
1704 int ret;
1705
1706 info = *pinfo;
1707 entry0 = *pentry0;
1708 size = total_size;
1709 info->number = number;
1710
1711 /* Init all hooks to impossible value. */
1712 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1713 info->hook_entry[i] = 0xFFFFFFFF;
1714 info->underflow[i] = 0xFFFFFFFF;
1715 }
1716
1717 duprintf("translate_compat_table: size %u\n", info->size);
1718 j = 0;
1719 xt_compat_lock(AF_INET6);
1720 /* Walk through entries, checking offsets. */
1721 ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
1722 check_compat_entry_size_and_hooks,
1723 info, &size, entry0,
1724 entry0 + total_size,
1725 hook_entries, underflows, &j, name);
1726 if (ret != 0)
1727 goto out_unlock;
1728
1729 ret = -EINVAL;
1730 if (j != number) {
1731 duprintf("translate_compat_table: %u not %u entries\n",
1732 j, number);
1733 goto out_unlock;
1734 }
1735
1736 /* Check hooks all assigned */
1737 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1738 /* Only hooks which are valid */
1739 if (!(valid_hooks & (1 << i)))
1740 continue;
1741 if (info->hook_entry[i] == 0xFFFFFFFF) {
1742 duprintf("Invalid hook entry %u %u\n",
1743 i, hook_entries[i]);
1744 goto out_unlock;
1745 }
1746 if (info->underflow[i] == 0xFFFFFFFF) {
1747 duprintf("Invalid underflow %u %u\n",
1748 i, underflows[i]);
1749 goto out_unlock;
1750 }
1751 }
1752
1753 ret = -ENOMEM;
1754 newinfo = xt_alloc_table_info(size);
1755 if (!newinfo)
1756 goto out_unlock;
1757
1758 newinfo->number = number;
1759 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1760 newinfo->hook_entry[i] = info->hook_entry[i];
1761 newinfo->underflow[i] = info->underflow[i];
1762 }
1763 entry1 = newinfo->entries[raw_smp_processor_id()];
1764 pos = entry1;
1765 size = total_size;
1766 ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
1767 compat_copy_entry_from_user,
1768 &pos, &size, name, newinfo, entry1);
1769 xt_compat_flush_offsets(AF_INET6);
1770 xt_compat_unlock(AF_INET6);
1771 if (ret)
1772 goto free_newinfo;
1773
1774 ret = -ELOOP;
1775 if (!mark_source_chains(newinfo, valid_hooks, entry1))
1776 goto free_newinfo;
1777
1778 i = 0;
1779 ret = IP6T_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
1780 name, &i);
1781 if (ret) {
1782 j -= i;
1783 COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
1784 compat_release_entry, &j);
1785 IP6T_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
1786 xt_free_table_info(newinfo);
1787 return ret;
1788 }
1789
1790 /* And one copy for every other CPU */
1791 for_each_possible_cpu(i)
1792 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1793 memcpy(newinfo->entries[i], entry1, newinfo->size);
1794
1795 *pinfo = newinfo;
1796 *pentry0 = entry1;
1797 xt_free_table_info(info);
1798 return 0;
1799
1800 free_newinfo:
1801 xt_free_table_info(newinfo);
1802 out:
1803 COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
1804 return ret;
1805 out_unlock:
1806 xt_compat_flush_offsets(AF_INET6);
1807 xt_compat_unlock(AF_INET6);
1808 goto out;
1809 }
1810
1811 static int
1812 compat_do_replace(void __user *user, unsigned int len)
1813 {
1814 int ret;
1815 struct compat_ip6t_replace tmp;
1816 struct xt_table_info *newinfo;
1817 void *loc_cpu_entry;
1818
1819 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1820 return -EFAULT;
1821
1822 /* overflow check */
1823 if (tmp.size >= INT_MAX / num_possible_cpus())
1824 return -ENOMEM;
1825 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1826 return -ENOMEM;
1827
1828 newinfo = xt_alloc_table_info(tmp.size);
1829 if (!newinfo)
1830 return -ENOMEM;
1831
1832 /* choose the copy that is our node/cpu */
1833 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1834 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1835 tmp.size) != 0) {
1836 ret = -EFAULT;
1837 goto free_newinfo;
1838 }
1839
1840 ret = translate_compat_table(tmp.name, tmp.valid_hooks,
1841 &newinfo, &loc_cpu_entry, tmp.size,
1842 tmp.num_entries, tmp.hook_entry,
1843 tmp.underflow);
1844 if (ret != 0)
1845 goto free_newinfo;
1846
1847 duprintf("compat_do_replace: Translated table\n");
1848
1849 ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
1850 tmp.num_counters, compat_ptr(tmp.counters));
1851 if (ret)
1852 goto free_newinfo_untrans;
1853 return 0;
1854
1855 free_newinfo_untrans:
1856 IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
1857 free_newinfo:
1858 xt_free_table_info(newinfo);
1859 return ret;
1860 }
1861
1862 static int
1863 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1864 unsigned int len)
1865 {
1866 int ret;
1867
1868 if (!capable(CAP_NET_ADMIN))
1869 return -EPERM;
1870
1871 switch (cmd) {
1872 case IP6T_SO_SET_REPLACE:
1873 ret = compat_do_replace(user, len);
1874 break;
1875
1876 case IP6T_SO_SET_ADD_COUNTERS:
1877 ret = do_add_counters(user, len, 1);
1878 break;
1879
1880 default:
1881 duprintf("do_ip6t_set_ctl: unknown request %i\n", cmd);
1882 ret = -EINVAL;
1883 }
1884
1885 return ret;
1886 }
1887
1888 struct compat_ip6t_get_entries {
1889 char name[IP6T_TABLE_MAXNAMELEN];
1890 compat_uint_t size;
1891 struct compat_ip6t_entry entrytable[0];
1892 };
1893
1894 static int
1895 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1896 void __user *userptr)
1897 {
1898 struct xt_counters *counters;
1899 struct xt_table_info *private = table->private;
1900 void __user *pos;
1901 unsigned int size;
1902 int ret = 0;
1903 void *loc_cpu_entry;
1904 unsigned int i = 0;
1905
1906 counters = alloc_counters(table);
1907 if (IS_ERR(counters))
1908 return PTR_ERR(counters);
1909
1910 /* choose the copy that is on our node/cpu, ...
1911 * This choice is lazy (because current thread is
1912 * allowed to migrate to another cpu)
1913 */
1914 loc_cpu_entry = private->entries[raw_smp_processor_id()];
1915 pos = userptr;
1916 size = total_size;
1917 ret = IP6T_ENTRY_ITERATE(loc_cpu_entry, total_size,
1918 compat_copy_entry_to_user,
1919 &pos, &size, counters, &i);
1920
1921 vfree(counters);
1922 return ret;
1923 }
1924
1925 static int
1926 compat_get_entries(struct compat_ip6t_get_entries __user *uptr, int *len)
1927 {
1928 int ret;
1929 struct compat_ip6t_get_entries get;
1930 struct xt_table *t;
1931
1932 if (*len < sizeof(get)) {
1933 duprintf("compat_get_entries: %u < %u\n",
1934 *len, (unsigned int)sizeof(get));
1935 return -EINVAL;
1936 }
1937
1938 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1939 return -EFAULT;
1940
1941 if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
1942 duprintf("compat_get_entries: %u != %u\n", *len,
1943 (unsigned int)(sizeof(struct compat_ip6t_get_entries) +
1944 get.size));
1945 return -EINVAL;
1946 }
1947
1948 xt_compat_lock(AF_INET6);
1949 t = xt_find_table_lock(AF_INET6, get.name);
1950 if (t && !IS_ERR(t)) {
1951 struct xt_table_info *private = t->private;
1952 struct xt_table_info info;
1953 duprintf("t->private->number = %u\n",
1954 private->number);
1955 ret = compat_table_info(private, &info);
1956 if (!ret && get.size == info.size) {
1957 ret = compat_copy_entries_to_user(private->size,
1958 t, uptr->entrytable);
1959 } else if (!ret) {
1960 duprintf("compat_get_entries: I've got %u not %u!\n",
1961 private->size,
1962 get.size);
1963 ret = -EINVAL;
1964 }
1965 xt_compat_flush_offsets(AF_INET6);
1966 module_put(t->me);
1967 xt_table_unlock(t);
1968 } else
1969 ret = t ? PTR_ERR(t) : -ENOENT;
1970
1971 xt_compat_unlock(AF_INET6);
1972 return ret;
1973 }
1974
1975 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1976
1977 static int
1978 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1979 {
1980 int ret;
1981
1982 if (!capable(CAP_NET_ADMIN))
1983 return -EPERM;
1984
1985 switch (cmd) {
1986 case IP6T_SO_GET_INFO:
1987 ret = get_info(user, len, 1);
1988 break;
1989 case IP6T_SO_GET_ENTRIES:
1990 ret = compat_get_entries(user, len);
1991 break;
1992 default:
1993 ret = do_ip6t_get_ctl(sk, cmd, user, len);
1994 }
1995 return ret;
1996 }
1997 #endif
1998
1999 static int
2000 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2001 {
2002 int ret;
2003
2004 if (!capable(CAP_NET_ADMIN))
2005 return -EPERM;
2006
2007 switch (cmd) {
2008 case IP6T_SO_SET_REPLACE:
2009 ret = do_replace(user, len);
2010 break;
2011
2012 case IP6T_SO_SET_ADD_COUNTERS:
2013 ret = do_add_counters(user, len, 0);
2014 break;
2015
2016 default:
2017 duprintf("do_ip6t_set_ctl: unknown request %i\n", cmd);
2018 ret = -EINVAL;
2019 }
2020
2021 return ret;
2022 }
2023
2024 static int
2025 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2026 {
2027 int ret;
2028
2029 if (!capable(CAP_NET_ADMIN))
2030 return -EPERM;
2031
2032 switch (cmd) {
2033 case IP6T_SO_GET_INFO:
2034 ret = get_info(user, len, 0);
2035 break;
2036
2037 case IP6T_SO_GET_ENTRIES:
2038 ret = get_entries(user, len);
2039 break;
2040
2041 case IP6T_SO_GET_REVISION_MATCH:
2042 case IP6T_SO_GET_REVISION_TARGET: {
2043 struct ip6t_get_revision rev;
2044 int target;
2045
2046 if (*len != sizeof(rev)) {
2047 ret = -EINVAL;
2048 break;
2049 }
2050 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2051 ret = -EFAULT;
2052 break;
2053 }
2054
2055 if (cmd == IP6T_SO_GET_REVISION_TARGET)
2056 target = 1;
2057 else
2058 target = 0;
2059
2060 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
2061 rev.revision,
2062 target, &ret),
2063 "ip6t_%s", rev.name);
2064 break;
2065 }
2066
2067 default:
2068 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
2069 ret = -EINVAL;
2070 }
2071
2072 return ret;
2073 }
2074
2075 int ip6t_register_table(struct xt_table *table,
2076 const struct ip6t_replace *repl)
2077 {
2078 int ret;
2079 struct xt_table_info *newinfo;
2080 struct xt_table_info bootstrap
2081 = { 0, 0, 0, { 0 }, { 0 }, { } };
2082 void *loc_cpu_entry;
2083
2084 newinfo = xt_alloc_table_info(repl->size);
2085 if (!newinfo)
2086 return -ENOMEM;
2087
2088 /* choose the copy on our node/cpu */
2089 loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2090 memcpy(loc_cpu_entry, repl->entries, repl->size);
2091
2092 ret = translate_table(table->name, table->valid_hooks,
2093 newinfo, loc_cpu_entry, repl->size,
2094 repl->num_entries,
2095 repl->hook_entry,
2096 repl->underflow);
2097 if (ret != 0) {
2098 xt_free_table_info(newinfo);
2099 return ret;
2100 }
2101
2102 ret = xt_register_table(table, &bootstrap, newinfo);
2103 if (ret != 0) {
2104 xt_free_table_info(newinfo);
2105 return ret;
2106 }
2107
2108 return 0;
2109 }
2110
2111 void ip6t_unregister_table(struct xt_table *table)
2112 {
2113 struct xt_table_info *private;
2114 void *loc_cpu_entry;
2115
2116 private = xt_unregister_table(table);
2117
2118 /* Decrease module usage counts and free resources */
2119 loc_cpu_entry = private->entries[raw_smp_processor_id()];
2120 IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
2121 xt_free_table_info(private);
2122 }
2123
2124 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2125 static inline bool
2126 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2127 u_int8_t type, u_int8_t code,
2128 bool invert)
2129 {
2130 return (type == test_type && code >= min_code && code <= max_code)
2131 ^ invert;
2132 }
2133
2134 static bool
2135 icmp6_match(const struct sk_buff *skb,
2136 const struct net_device *in,
2137 const struct net_device *out,
2138 const struct xt_match *match,
2139 const void *matchinfo,
2140 int offset,
2141 unsigned int protoff,
2142 bool *hotdrop)
2143 {
2144 struct icmp6hdr _icmp, *ic;
2145 const struct ip6t_icmp *icmpinfo = matchinfo;
2146
2147 /* Must not be a fragment. */
2148 if (offset)
2149 return false;
2150
2151 ic = skb_header_pointer(skb, protoff, sizeof(_icmp), &_icmp);
2152 if (ic == NULL) {
2153 /* We've been asked to examine this packet, and we
2154 can't. Hence, no choice but to drop. */
2155 duprintf("Dropping evil ICMP tinygram.\n");
2156 *hotdrop = true;
2157 return false;
2158 }
2159
2160 return icmp6_type_code_match(icmpinfo->type,
2161 icmpinfo->code[0],
2162 icmpinfo->code[1],
2163 ic->icmp6_type, ic->icmp6_code,
2164 !!(icmpinfo->invflags&IP6T_ICMP_INV));
2165 }
2166
2167 /* Called when user tries to insert an entry of this type. */
2168 static bool
2169 icmp6_checkentry(const char *tablename,
2170 const void *entry,
2171 const struct xt_match *match,
2172 void *matchinfo,
2173 unsigned int hook_mask)
2174 {
2175 const struct ip6t_icmp *icmpinfo = matchinfo;
2176
2177 /* Must specify no unknown invflags */
2178 return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
2179 }
2180
2181 /* The built-in targets: standard (NULL) and error. */
2182 static struct xt_target ip6t_standard_target __read_mostly = {
2183 .name = IP6T_STANDARD_TARGET,
2184 .targetsize = sizeof(int),
2185 .family = AF_INET6,
2186 #ifdef CONFIG_COMPAT
2187 .compatsize = sizeof(compat_int_t),
2188 .compat_from_user = compat_standard_from_user,
2189 .compat_to_user = compat_standard_to_user,
2190 #endif
2191 };
2192
2193 static struct xt_target ip6t_error_target __read_mostly = {
2194 .name = IP6T_ERROR_TARGET,
2195 .target = ip6t_error,
2196 .targetsize = IP6T_FUNCTION_MAXNAMELEN,
2197 .family = AF_INET6,
2198 };
2199
2200 static struct nf_sockopt_ops ip6t_sockopts = {
2201 .pf = PF_INET6,
2202 .set_optmin = IP6T_BASE_CTL,
2203 .set_optmax = IP6T_SO_SET_MAX+1,
2204 .set = do_ip6t_set_ctl,
2205 #ifdef CONFIG_COMPAT
2206 .compat_set = compat_do_ip6t_set_ctl,
2207 #endif
2208 .get_optmin = IP6T_BASE_CTL,
2209 .get_optmax = IP6T_SO_GET_MAX+1,
2210 .get = do_ip6t_get_ctl,
2211 #ifdef CONFIG_COMPAT
2212 .compat_get = compat_do_ip6t_get_ctl,
2213 #endif
2214 .owner = THIS_MODULE,
2215 };
2216
2217 static struct xt_match icmp6_matchstruct __read_mostly = {
2218 .name = "icmp6",
2219 .match = &icmp6_match,
2220 .matchsize = sizeof(struct ip6t_icmp),
2221 .checkentry = icmp6_checkentry,
2222 .proto = IPPROTO_ICMPV6,
2223 .family = AF_INET6,
2224 };
2225
2226 static int __init ip6_tables_init(void)
2227 {
2228 int ret;
2229
2230 ret = xt_proto_init(AF_INET6);
2231 if (ret < 0)
2232 goto err1;
2233
2234 /* Noone else will be downing sem now, so we won't sleep */
2235 ret = xt_register_target(&ip6t_standard_target);
2236 if (ret < 0)
2237 goto err2;
2238 ret = xt_register_target(&ip6t_error_target);
2239 if (ret < 0)
2240 goto err3;
2241 ret = xt_register_match(&icmp6_matchstruct);
2242 if (ret < 0)
2243 goto err4;
2244
2245 /* Register setsockopt */
2246 ret = nf_register_sockopt(&ip6t_sockopts);
2247 if (ret < 0)
2248 goto err5;
2249
2250 printk(KERN_INFO "ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
2251 return 0;
2252
2253 err5:
2254 xt_unregister_match(&icmp6_matchstruct);
2255 err4:
2256 xt_unregister_target(&ip6t_error_target);
2257 err3:
2258 xt_unregister_target(&ip6t_standard_target);
2259 err2:
2260 xt_proto_fini(AF_INET6);
2261 err1:
2262 return ret;
2263 }
2264
2265 static void __exit ip6_tables_fini(void)
2266 {
2267 nf_unregister_sockopt(&ip6t_sockopts);
2268 xt_unregister_match(&icmp6_matchstruct);
2269 xt_unregister_target(&ip6t_error_target);
2270 xt_unregister_target(&ip6t_standard_target);
2271 xt_proto_fini(AF_INET6);
2272 }
2273
2274 /*
2275 * find the offset to specified header or the protocol number of last header
2276 * if target < 0. "last header" is transport protocol header, ESP, or
2277 * "No next header".
2278 *
2279 * If target header is found, its offset is set in *offset and return protocol
2280 * number. Otherwise, return -1.
2281 *
2282 * If the first fragment doesn't contain the final protocol header or
2283 * NEXTHDR_NONE it is considered invalid.
2284 *
2285 * Note that non-1st fragment is special case that "the protocol number
2286 * of last header" is "next header" field in Fragment header. In this case,
2287 * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
2288 * isn't NULL.
2289 *
2290 */
2291 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
2292 int target, unsigned short *fragoff)
2293 {
2294 unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
2295 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
2296 unsigned int len = skb->len - start;
2297
2298 if (fragoff)
2299 *fragoff = 0;
2300
2301 while (nexthdr != target) {
2302 struct ipv6_opt_hdr _hdr, *hp;
2303 unsigned int hdrlen;
2304
2305 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
2306 if (target < 0)
2307 break;
2308 return -ENOENT;
2309 }
2310
2311 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
2312 if (hp == NULL)
2313 return -EBADMSG;
2314 if (nexthdr == NEXTHDR_FRAGMENT) {
2315 unsigned short _frag_off;
2316 __be16 *fp;
2317 fp = skb_header_pointer(skb,
2318 start+offsetof(struct frag_hdr,
2319 frag_off),
2320 sizeof(_frag_off),
2321 &_frag_off);
2322 if (fp == NULL)
2323 return -EBADMSG;
2324
2325 _frag_off = ntohs(*fp) & ~0x7;
2326 if (_frag_off) {
2327 if (target < 0 &&
2328 ((!ipv6_ext_hdr(hp->nexthdr)) ||
2329 hp->nexthdr == NEXTHDR_NONE)) {
2330 if (fragoff)
2331 *fragoff = _frag_off;
2332 return hp->nexthdr;
2333 }
2334 return -ENOENT;
2335 }
2336 hdrlen = 8;
2337 } else if (nexthdr == NEXTHDR_AUTH)
2338 hdrlen = (hp->hdrlen + 2) << 2;
2339 else
2340 hdrlen = ipv6_optlen(hp);
2341
2342 nexthdr = hp->nexthdr;
2343 len -= hdrlen;
2344 start += hdrlen;
2345 }
2346
2347 *offset = start;
2348 return nexthdr;
2349 }
2350
2351 EXPORT_SYMBOL(ip6t_register_table);
2352 EXPORT_SYMBOL(ip6t_unregister_table);
2353 EXPORT_SYMBOL(ip6t_do_table);
2354 EXPORT_SYMBOL(ip6t_ext_hdr);
2355 EXPORT_SYMBOL(ipv6_find_hdr);
2356
2357 module_init(ip6_tables_init);
2358 module_exit(ip6_tables_fini);
Linux kernel - Deliverables
This page took 0.077324 seconds and 6 git commands to generate.