net/ipv6/netfilter/ip6_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11
  12 #include <linux/capability.h>
  13 #include <linux/in.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/kmod.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/poison.h>
  20 #include <linux/icmpv6.h>
  21 #include <net/ipv6.h>
  22 #include <asm/uaccess.h>
  23 #include <linux/mutex.h>
  24 #include <linux/proc_fs.h>
  25 #include <linux/cpumask.h>
  26
  27 #include <linux/netfilter_ipv6/ip6_tables.h>
  28 #include <linux/netfilter/x_tables.h>
  29
  30 MODULE_LICENSE("GPL");
  31 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  32 MODULE_DESCRIPTION("IPv6 packet filter");
  33
  34 /*#define DEBUG_IP_FIREWALL*/
  35 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  36 /*#define DEBUG_IP_FIREWALL_USER*/
  37
  38 #ifdef DEBUG_IP_FIREWALL
  39 #define dprintf(format, args...)  printk(format , ## args)
  40 #else
  41 #define dprintf(format, args...)
  42 #endif
  43
  44 #ifdef DEBUG_IP_FIREWALL_USER
  45 #define duprintf(format, args...) printk(format , ## args)
  46 #else
  47 #define duprintf(format, args...)
  48 #endif
  49
  50 #ifdef CONFIG_NETFILTER_DEBUG
  51 #define IP_NF_ASSERT(x)                                         \
  52 do {                                                            \
  53         if (!(x))                                               \
  54                 printk("IP_NF_ASSERT: %s:%s:%u\n",              \
  55                        __FUNCTION__, __FILE__, __LINE__);       \
  56 } while(0)
  57 #else
  58 #define IP_NF_ASSERT(x)
  59 #endif
  60
  61 #if 0
  62 /* All the better to debug you with... */
  63 #define static
  64 #define inline
  65 #endif
  66
  67 /*
  68    We keep a set of rules for each CPU, so we can avoid write-locking
  69    them in the softirq when updating the counters and therefore
  70    only need to read-lock in the softirq; doing a write_lock_bh() in user
  71    context stops packets coming through and allows user context to read
  72    the counters or update the rules.
  73
  74    Hence the start of any table is given by get_table() below.  */
  75
  76 /* Check for an extension */
  77 int
  78 ip6t_ext_hdr(u8 nexthdr)
  79 {
  80         return ( (nexthdr == IPPROTO_HOPOPTS)   ||
  81                  (nexthdr == IPPROTO_ROUTING)   ||
  82                  (nexthdr == IPPROTO_FRAGMENT)  ||
  83                  (nexthdr == IPPROTO_ESP)       ||
  84                  (nexthdr == IPPROTO_AH)        ||
  85                  (nexthdr == IPPROTO_NONE)      ||
  86                  (nexthdr == IPPROTO_DSTOPTS) );
  87 }
  88
  89 /* Returns whether matches rule or not. */
  90 static inline bool
  91 ip6_packet_match(const struct sk_buff *skb,
  92                  const char *indev,
  93                  const char *outdev,
  94                  const struct ip6t_ip6 *ip6info,
  95                  unsigned int *protoff,
  96                  int *fragoff, bool *hotdrop)
  97 {
  98         size_t i;
  99         unsigned long ret;
 100         const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
 101
 102 #define FWINV(bool,invflg) ((bool) ^ !!(ip6info->invflags & invflg))
 103
 104         if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 105                                        &ip6info->src), IP6T_INV_SRCIP)
 106             || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 107                                           &ip6info->dst), IP6T_INV_DSTIP)) {
 108                 dprintf("Source or dest mismatch.\n");
 109 /*
 110                 dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 111                         ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 112                         ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 113                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 114                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 115                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 116                 return false;
 117         }
 118
 119         /* Look for ifname matches; this should unroll nicely. */
 120         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
 121                 ret |= (((const unsigned long *)indev)[i]
 122                         ^ ((const unsigned long *)ip6info->iniface)[i])
 123                         & ((const unsigned long *)ip6info->iniface_mask)[i];
 124         }
 125
 126         if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 127                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 128                         indev, ip6info->iniface,
 129                         ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
 130                 return false;
 131         }
 132
 133         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
 134                 ret |= (((const unsigned long *)outdev)[i]
 135                         ^ ((const unsigned long *)ip6info->outiface)[i])
 136                         & ((const unsigned long *)ip6info->outiface_mask)[i];
 137         }
 138
 139         if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 140                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 141                         outdev, ip6info->outiface,
 142                         ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
 143                 return false;
 144         }
 145
 146 /* ... might want to do something with class and flowlabel here ... */
 147
 148         /* look for the desired protocol header */
 149         if((ip6info->flags & IP6T_F_PROTO)) {
 150                 int protohdr;
 151                 unsigned short _frag_off;
 152
 153                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
 154                 if (protohdr < 0) {
 155                         if (_frag_off == 0)
 156                                 *hotdrop = true;
 157                         return false;
 158                 }
 159                 *fragoff = _frag_off;
 160
 161                 dprintf("Packet protocol %hi ?= %s%hi.\n",
 162                                 protohdr,
 163                                 ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 164                                 ip6info->proto);
 165
 166                 if (ip6info->proto == protohdr) {
 167                         if(ip6info->invflags & IP6T_INV_PROTO) {
 168                                 return false;
 169                         }
 170                         return true;
 171                 }
 172
 173                 /* We need match for the '-p all', too! */
 174                 if ((ip6info->proto != 0) &&
 175                         !(ip6info->invflags & IP6T_INV_PROTO))
 176                         return false;
 177         }
 178         return true;
 179 }
 180
 181 /* should be ip6 safe */
 182 static inline bool
 183 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 184 {
 185         if (ipv6->flags & ~IP6T_F_MASK) {
 186                 duprintf("Unknown flag bits set: %08X\n",
 187                          ipv6->flags & ~IP6T_F_MASK);
 188                 return false;
 189         }
 190         if (ipv6->invflags & ~IP6T_INV_MASK) {
 191                 duprintf("Unknown invflag bits set: %08X\n",
 192                          ipv6->invflags & ~IP6T_INV_MASK);
 193                 return false;
 194         }
 195         return true;
 196 }
 197
 198 static unsigned int
 199 ip6t_error(struct sk_buff *skb,
 200           const struct net_device *in,
 201           const struct net_device *out,
 202           unsigned int hooknum,
 203           const struct xt_target *target,
 204           const void *targinfo)
 205 {
 206         if (net_ratelimit())
 207                 printk("ip6_tables: error: `%s'\n", (char *)targinfo);
 208
 209         return NF_DROP;
 210 }
 211
 212 static inline
 213 bool do_match(struct ip6t_entry_match *m,
 214               const struct sk_buff *skb,
 215               const struct net_device *in,
 216               const struct net_device *out,
 217               int offset,
 218               unsigned int protoff,
 219               bool *hotdrop)
 220 {
 221         /* Stop iteration if it doesn't match */
 222         if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
 223                                       offset, protoff, hotdrop))
 224                 return true;
 225         else
 226                 return false;
 227 }
 228
 229 static inline struct ip6t_entry *
 230 get_entry(void *base, unsigned int offset)
 231 {
 232         return (struct ip6t_entry *)(base + offset);
 233 }
 234
 235 /* All zeroes == unconditional rule. */
 236 static inline int
 237 unconditional(const struct ip6t_ip6 *ipv6)
 238 {
 239         unsigned int i;
 240
 241         for (i = 0; i < sizeof(*ipv6); i++)
 242                 if (((char *)ipv6)[i])
 243                         break;
 244
 245         return (i == sizeof(*ipv6));
 246 }
 247
 248 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 249     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 250 /* This cries for unification! */
 251 static const char *hooknames[] = {
 252         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 253         [NF_INET_LOCAL_IN]              = "INPUT",
 254         [NF_INET_FORWARD]               = "FORWARD",
 255         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 256         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 257 };
 258
 259 enum nf_ip_trace_comments {
 260         NF_IP6_TRACE_COMMENT_RULE,
 261         NF_IP6_TRACE_COMMENT_RETURN,
 262         NF_IP6_TRACE_COMMENT_POLICY,
 263 };
 264
 265 static const char *comments[] = {
 266         [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
 267         [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
 268         [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
 269 };
 270
 271 static struct nf_loginfo trace_loginfo = {
 272         .type = NF_LOG_TYPE_LOG,
 273         .u = {
 274                 .log = {
 275                         .level = 4,
 276                         .logflags = NF_LOG_MASK,
 277                 },
 278         },
 279 };
 280
 281 static inline int
 282 get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
 283                       char *hookname, char **chainname,
 284                       char **comment, unsigned int *rulenum)
 285 {
 286         struct ip6t_standard_target *t = (void *)ip6t_get_target(s);
 287
 288         if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
 289                 /* Head of user chain: ERROR target with chainname */
 290                 *chainname = t->target.data;
 291                 (*rulenum) = 0;
 292         } else if (s == e) {
 293                 (*rulenum)++;
 294
 295                 if (s->target_offset == sizeof(struct ip6t_entry)
 296                    && strcmp(t->target.u.kernel.target->name,
 297                              IP6T_STANDARD_TARGET) == 0
 298                    && t->verdict < 0
 299                    && unconditional(&s->ipv6)) {
 300                         /* Tail of chains: STANDARD target (return/policy) */
 301                         *comment = *chainname == hookname
 302                                 ? (char *)comments[NF_IP6_TRACE_COMMENT_POLICY]
 303                                 : (char *)comments[NF_IP6_TRACE_COMMENT_RETURN];
 304                 }
 305                 return 1;
 306         } else
 307                 (*rulenum)++;
 308
 309         return 0;
 310 }
 311
 312 static void trace_packet(struct sk_buff *skb,
 313                          unsigned int hook,
 314                          const struct net_device *in,
 315                          const struct net_device *out,
 316                          char *tablename,
 317                          struct xt_table_info *private,
 318                          struct ip6t_entry *e)
 319 {
 320         void *table_base;
 321         struct ip6t_entry *root;
 322         char *hookname, *chainname, *comment;
 323         unsigned int rulenum = 0;
 324
 325         table_base = (void *)private->entries[smp_processor_id()];
 326         root = get_entry(table_base, private->hook_entry[hook]);
 327
 328         hookname = chainname = (char *)hooknames[hook];
 329         comment = (char *)comments[NF_IP6_TRACE_COMMENT_RULE];
 330
 331         IP6T_ENTRY_ITERATE(root,
 332                            private->size - private->hook_entry[hook],
 333                            get_chainname_rulenum,
 334                            e, hookname, &chainname, &comment, &rulenum);
 335
 336         nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
 337                       "TRACE: %s:%s:%s:%u ",
 338                       tablename, chainname, comment, rulenum);
 339 }
 340 #endif
 341
 342 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 343 unsigned int
 344 ip6t_do_table(struct sk_buff *skb,
 345               unsigned int hook,
 346               const struct net_device *in,
 347               const struct net_device *out,
 348               struct xt_table *table)
 349 {
 350         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 351         int offset = 0;
 352         unsigned int protoff = 0;
 353         bool hotdrop = false;
 354         /* Initializing verdict to NF_DROP keeps gcc happy. */
 355         unsigned int verdict = NF_DROP;
 356         const char *indev, *outdev;
 357         void *table_base;
 358         struct ip6t_entry *e, *back;
 359         struct xt_table_info *private;
 360
 361         /* Initialization */
 362         indev = in ? in->name : nulldevname;
 363         outdev = out ? out->name : nulldevname;
 364         /* We handle fragments by dealing with the first fragment as
 365          * if it was a normal packet.  All other fragments are treated
 366          * normally, except that they will NEVER match rules that ask
 367          * things we don't know, ie. tcp syn flag or ports).  If the
 368          * rule is also a fragment-specific rule, non-fragments won't
 369          * match it. */
 370
 371         read_lock_bh(&table->lock);
 372         private = table->private;
 373         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 374         table_base = (void *)private->entries[smp_processor_id()];
 375         e = get_entry(table_base, private->hook_entry[hook]);
 376
 377         /* For return from builtin chain */
 378         back = get_entry(table_base, private->underflow[hook]);
 379
 380         do {
 381                 IP_NF_ASSERT(e);
 382                 IP_NF_ASSERT(back);
 383                 if (ip6_packet_match(skb, indev, outdev, &e->ipv6,
 384                         &protoff, &offset, &hotdrop)) {
 385                         struct ip6t_entry_target *t;
 386
 387                         if (IP6T_MATCH_ITERATE(e, do_match,
 388                                                skb, in, out,
 389                                                offset, protoff, &hotdrop) != 0)
 390                                 goto no_match;
 391
 392                         ADD_COUNTER(e->counters,
 393                                     ntohs(ipv6_hdr(skb)->payload_len) +
 394                                     sizeof(struct ipv6hdr), 1);
 395
 396                         t = ip6t_get_target(e);
 397                         IP_NF_ASSERT(t->u.kernel.target);
 398
 399 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 400     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 401                         /* The packet is traced: log it */
 402                         if (unlikely(skb->nf_trace))
 403                                 trace_packet(skb, hook, in, out,
 404                                              table->name, private, e);
 405 #endif
 406                         /* Standard target? */
 407                         if (!t->u.kernel.target->target) {
 408                                 int v;
 409
 410                                 v = ((struct ip6t_standard_target *)t)->verdict;
 411                                 if (v < 0) {
 412                                         /* Pop from stack? */
 413                                         if (v != IP6T_RETURN) {
 414                                                 verdict = (unsigned)(-v) - 1;
 415                                                 break;
 416                                         }
 417                                         e = back;
 418                                         back = get_entry(table_base,
 419                                                          back->comefrom);
 420                                         continue;
 421                                 }
 422                                 if (table_base + v != (void *)e + e->next_offset
 423                                     && !(e->ipv6.flags & IP6T_F_GOTO)) {
 424                                         /* Save old back ptr in next entry */
 425                                         struct ip6t_entry *next
 426                                                 = (void *)e + e->next_offset;
 427                                         next->comefrom
 428                                                 = (void *)back - table_base;
 429                                         /* set back pointer to next entry */
 430                                         back = next;
 431                                 }
 432
 433                                 e = get_entry(table_base, v);
 434                         } else {
 435                                 /* Targets which reenter must return
 436                                    abs. verdicts */
 437 #ifdef CONFIG_NETFILTER_DEBUG
 438                                 ((struct ip6t_entry *)table_base)->comefrom
 439                                         = 0xeeeeeeec;
 440 #endif
 441                                 verdict = t->u.kernel.target->target(skb,
 442                                                                      in, out,
 443                                                                      hook,
 444                                                                      t->u.kernel.target,
 445                                                                      t->data);
 446
 447 #ifdef CONFIG_NETFILTER_DEBUG
 448                                 if (((struct ip6t_entry *)table_base)->comefrom
 449                                     != 0xeeeeeeec
 450                                     && verdict == IP6T_CONTINUE) {
 451                                         printk("Target %s reentered!\n",
 452                                                t->u.kernel.target->name);
 453                                         verdict = NF_DROP;
 454                                 }
 455                                 ((struct ip6t_entry *)table_base)->comefrom
 456                                         = 0x57acc001;
 457 #endif
 458                                 if (verdict == IP6T_CONTINUE)
 459                                         e = (void *)e + e->next_offset;
 460                                 else
 461                                         /* Verdict */
 462                                         break;
 463                         }
 464                 } else {
 465
 466                 no_match:
 467                         e = (void *)e + e->next_offset;
 468                 }
 469         } while (!hotdrop);
 470
 471 #ifdef CONFIG_NETFILTER_DEBUG
 472         ((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON;
 473 #endif
 474         read_unlock_bh(&table->lock);
 475
 476 #ifdef DEBUG_ALLOW_ALL
 477         return NF_ACCEPT;
 478 #else
 479         if (hotdrop)
 480                 return NF_DROP;
 481         else return verdict;
 482 #endif
 483 }
 484
 485 /* Figures out from what hook each rule can be called: returns 0 if
 486    there are loops.  Puts hook bitmask in comefrom. */
 487 static int
 488 mark_source_chains(struct xt_table_info *newinfo,
 489                    unsigned int valid_hooks, void *entry0)
 490 {
 491         unsigned int hook;
 492
 493         /* No recursion; use packet counter to save back ptrs (reset
 494            to 0 as we leave), and comefrom to save source hook bitmask */
 495         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 496                 unsigned int pos = newinfo->hook_entry[hook];
 497                 struct ip6t_entry *e
 498                         = (struct ip6t_entry *)(entry0 + pos);
 499                 int visited = e->comefrom & (1 << hook);
 500
 501                 if (!(valid_hooks & (1 << hook)))
 502                         continue;
 503
 504                 /* Set initial back pointer. */
 505                 e->counters.pcnt = pos;
 506
 507                 for (;;) {
 508                         struct ip6t_standard_target *t
 509                                 = (void *)ip6t_get_target(e);
 510
 511                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 512                                 printk("iptables: loop hook %u pos %u %08X.\n",
 513                                        hook, pos, e->comefrom);
 514                                 return 0;
 515                         }
 516                         e->comefrom
 517                                 |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 518
 519                         /* Unconditional return/END. */
 520                         if ((e->target_offset == sizeof(struct ip6t_entry)
 521                             && (strcmp(t->target.u.user.name,
 522                                        IP6T_STANDARD_TARGET) == 0)
 523                             && t->verdict < 0
 524                             && unconditional(&e->ipv6)) || visited) {
 525                                 unsigned int oldpos, size;
 526
 527                                 if (t->verdict < -NF_MAX_VERDICT - 1) {
 528                                         duprintf("mark_source_chains: bad "
 529                                                 "negative verdict (%i)\n",
 530                                                                 t->verdict);
 531                                         return 0;
 532                                 }
 533
 534                                 /* Return: backtrack through the last
 535                                    big jump. */
 536                                 do {
 537                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 538 #ifdef DEBUG_IP_FIREWALL_USER
 539                                         if (e->comefrom
 540                                             & (1 << NF_INET_NUMHOOKS)) {
 541                                                 duprintf("Back unset "
 542                                                          "on hook %u "
 543                                                          "rule %u\n",
 544                                                          hook, pos);
 545                                         }
 546 #endif
 547                                         oldpos = pos;
 548                                         pos = e->counters.pcnt;
 549                                         e->counters.pcnt = 0;
 550
 551                                         /* We're at the start. */
 552                                         if (pos == oldpos)
 553                                                 goto next;
 554
 555                                         e = (struct ip6t_entry *)
 556                                                 (entry0 + pos);
 557                                 } while (oldpos == pos + e->next_offset);
 558
 559                                 /* Move along one */
 560                                 size = e->next_offset;
 561                                 e = (struct ip6t_entry *)
 562                                         (entry0 + pos + size);
 563                                 e->counters.pcnt = pos;
 564                                 pos += size;
 565                         } else {
 566                                 int newpos = t->verdict;
 567
 568                                 if (strcmp(t->target.u.user.name,
 569                                            IP6T_STANDARD_TARGET) == 0
 570                                     && newpos >= 0) {
 571                                         if (newpos > newinfo->size -
 572                                                 sizeof(struct ip6t_entry)) {
 573                                                 duprintf("mark_source_chains: "
 574                                                         "bad verdict (%i)\n",
 575                                                                 newpos);
 576                                                 return 0;
 577                                         }
 578                                         /* This a jump; chase it. */
 579                                         duprintf("Jump rule %u -> %u\n",
 580                                                  pos, newpos);
 581                                 } else {
 582                                         /* ... this is a fallthru */
 583                                         newpos = pos + e->next_offset;
 584                                 }
 585                                 e = (struct ip6t_entry *)
 586                                         (entry0 + newpos);
 587                                 e->counters.pcnt = pos;
 588                                 pos = newpos;
 589                         }
 590                 }
 591                 next:
 592                 duprintf("Finished chain %u\n", hook);
 593         }
 594         return 1;
 595 }
 596
 597 static inline int
 598 cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
 599 {
 600         if (i && (*i)-- == 0)
 601                 return 1;
 602
 603         if (m->u.kernel.match->destroy)
 604                 m->u.kernel.match->destroy(m->u.kernel.match, m->data);
 605         module_put(m->u.kernel.match->me);
 606         return 0;
 607 }
 608
 609 static inline int
 610 check_match(struct ip6t_entry_match *m,
 611             const char *name,
 612             const struct ip6t_ip6 *ipv6,
 613             unsigned int hookmask,
 614             unsigned int *i)
 615 {
 616         struct xt_match *match;
 617         int ret;
 618
 619         match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
 620                                         m->u.user.revision),
 621                                         "ip6t_%s", m->u.user.name);
 622         if (IS_ERR(match) || !match) {
 623                 duprintf("check_match: `%s' not found\n", m->u.user.name);
 624                 return match ? PTR_ERR(match) : -ENOENT;
 625         }
 626         m->u.kernel.match = match;
 627
 628         ret = xt_check_match(match, AF_INET6, m->u.match_size - sizeof(*m),
 629                              name, hookmask, ipv6->proto,
 630                              ipv6->invflags & IP6T_INV_PROTO);
 631         if (ret)
 632                 goto err;
 633
 634         if (m->u.kernel.match->checkentry
 635             && !m->u.kernel.match->checkentry(name, ipv6, match,  m->data,
 636                                               hookmask)) {
 637                 duprintf("ip_tables: check failed for `%s'.\n",
 638                          m->u.kernel.match->name);
 639                 ret = -EINVAL;
 640                 goto err;
 641         }
 642
 643         (*i)++;
 644         return 0;
 645 err:
 646         module_put(m->u.kernel.match->me);
 647         return ret;
 648 }
 649
 650 static inline int
 651 check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
 652             unsigned int *i)
 653 {
 654         struct ip6t_entry_target *t;
 655         struct xt_target *target;
 656         int ret;
 657         unsigned int j;
 658
 659         if (!ip6_checkentry(&e->ipv6)) {
 660                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 661                 return -EINVAL;
 662         }
 663
 664         if (e->target_offset + sizeof(struct ip6t_entry_target) >
 665                                                                 e->next_offset)
 666                 return -EINVAL;
 667
 668         j = 0;
 669         ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6, e->comefrom, &j);
 670         if (ret != 0)
 671                 goto cleanup_matches;
 672
 673         t = ip6t_get_target(e);
 674         ret = -EINVAL;
 675         if (e->target_offset + t->u.target_size > e->next_offset)
 676                         goto cleanup_matches;
 677         target = try_then_request_module(xt_find_target(AF_INET6,
 678                                                         t->u.user.name,
 679                                                         t->u.user.revision),
 680                                          "ip6t_%s", t->u.user.name);
 681         if (IS_ERR(target) || !target) {
 682                 duprintf("check_entry: `%s' not found\n", t->u.user.name);
 683                 ret = target ? PTR_ERR(target) : -ENOENT;
 684                 goto cleanup_matches;
 685         }
 686         t->u.kernel.target = target;
 687
 688         ret = xt_check_target(target, AF_INET6, t->u.target_size - sizeof(*t),
 689                               name, e->comefrom, e->ipv6.proto,
 690                               e->ipv6.invflags & IP6T_INV_PROTO);
 691         if (ret)
 692                 goto err;
 693
 694         if (t->u.kernel.target->checkentry
 695                    && !t->u.kernel.target->checkentry(name, e, target, t->data,
 696                                                       e->comefrom)) {
 697                 duprintf("ip_tables: check failed for `%s'.\n",
 698                          t->u.kernel.target->name);
 699                 ret = -EINVAL;
 700                 goto err;
 701         }
 702
 703         (*i)++;
 704         return 0;
 705  err:
 706         module_put(t->u.kernel.target->me);
 707  cleanup_matches:
 708         IP6T_MATCH_ITERATE(e, cleanup_match, &j);
 709         return ret;
 710 }
 711
 712 static inline int
 713 check_entry_size_and_hooks(struct ip6t_entry *e,
 714                            struct xt_table_info *newinfo,
 715                            unsigned char *base,
 716                            unsigned char *limit,
 717                            const unsigned int *hook_entries,
 718                            const unsigned int *underflows,
 719                            unsigned int *i)
 720 {
 721         unsigned int h;
 722
 723         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
 724             || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
 725                 duprintf("Bad offset %p\n", e);
 726                 return -EINVAL;
 727         }
 728
 729         if (e->next_offset
 730             < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
 731                 duprintf("checking: element %p size %u\n",
 732                          e, e->next_offset);
 733                 return -EINVAL;
 734         }
 735
 736         /* Check hooks & underflows */
 737         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 738                 if ((unsigned char *)e - base == hook_entries[h])
 739                         newinfo->hook_entry[h] = hook_entries[h];
 740                 if ((unsigned char *)e - base == underflows[h])
 741                         newinfo->underflow[h] = underflows[h];
 742         }
 743
 744         /* FIXME: underflows must be unconditional, standard verdicts
 745            < 0 (not IP6T_RETURN). --RR */
 746
 747         /* Clear counters and comefrom */
 748         e->counters = ((struct xt_counters) { 0, 0 });
 749         e->comefrom = 0;
 750
 751         (*i)++;
 752         return 0;
 753 }
 754
 755 static inline int
 756 cleanup_entry(struct ip6t_entry *e, unsigned int *i)
 757 {
 758         struct ip6t_entry_target *t;
 759
 760         if (i && (*i)-- == 0)
 761                 return 1;
 762
 763         /* Cleanup all matches */
 764         IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
 765         t = ip6t_get_target(e);
 766         if (t->u.kernel.target->destroy)
 767                 t->u.kernel.target->destroy(t->u.kernel.target, t->data);
 768         module_put(t->u.kernel.target->me);
 769         return 0;
 770 }
 771
 772 /* Checks and translates the user-supplied table segment (held in
 773    newinfo) */
 774 static int
 775 translate_table(const char *name,
 776                 unsigned int valid_hooks,
 777                 struct xt_table_info *newinfo,
 778                 void *entry0,
 779                 unsigned int size,
 780                 unsigned int number,
 781                 const unsigned int *hook_entries,
 782                 const unsigned int *underflows)
 783 {
 784         unsigned int i;
 785         int ret;
 786
 787         newinfo->size = size;
 788         newinfo->number = number;
 789
 790         /* Init all hooks to impossible value. */
 791         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 792                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 793                 newinfo->underflow[i] = 0xFFFFFFFF;
 794         }
 795
 796         duprintf("translate_table: size %u\n", newinfo->size);
 797         i = 0;
 798         /* Walk through entries, checking offsets. */
 799         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 800                                 check_entry_size_and_hooks,
 801                                 newinfo,
 802                                 entry0,
 803                                 entry0 + size,
 804                                 hook_entries, underflows, &i);
 805         if (ret != 0)
 806                 return ret;
 807
 808         if (i != number) {
 809                 duprintf("translate_table: %u not %u entries\n",
 810                          i, number);
 811                 return -EINVAL;
 812         }
 813
 814         /* Check hooks all assigned */
 815         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 816                 /* Only hooks which are valid */
 817                 if (!(valid_hooks & (1 << i)))
 818                         continue;
 819                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 820                         duprintf("Invalid hook entry %u %u\n",
 821                                  i, hook_entries[i]);
 822                         return -EINVAL;
 823                 }
 824                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 825                         duprintf("Invalid underflow %u %u\n",
 826                                  i, underflows[i]);
 827                         return -EINVAL;
 828                 }
 829         }
 830
 831         if (!mark_source_chains(newinfo, valid_hooks, entry0))
 832                 return -ELOOP;
 833
 834         /* Finally, each sanity check must pass */
 835         i = 0;
 836         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 837                                 check_entry, name, size, &i);
 838
 839         if (ret != 0) {
 840                 IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 841                                    cleanup_entry, &i);
 842                 return ret;
 843         }
 844
 845         /* And one copy for every other CPU */
 846         for_each_possible_cpu(i) {
 847                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 848                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 849         }
 850
 851         return 0;
 852 }
 853
 854 /* Gets counters. */
 855 static inline int
 856 add_entry_to_counter(const struct ip6t_entry *e,
 857                      struct xt_counters total[],
 858                      unsigned int *i)
 859 {
 860         ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 861
 862         (*i)++;
 863         return 0;
 864 }
 865
 866 static inline int
 867 set_entry_to_counter(const struct ip6t_entry *e,
 868                      struct ip6t_counters total[],
 869                      unsigned int *i)
 870 {
 871         SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 872
 873         (*i)++;
 874         return 0;
 875 }
 876
 877 static void
 878 get_counters(const struct xt_table_info *t,
 879              struct xt_counters counters[])
 880 {
 881         unsigned int cpu;
 882         unsigned int i;
 883         unsigned int curcpu;
 884
 885         /* Instead of clearing (by a previous call to memset())
 886          * the counters and using adds, we set the counters
 887          * with data used by 'current' CPU
 888          * We dont care about preemption here.
 889          */
 890         curcpu = raw_smp_processor_id();
 891
 892         i = 0;
 893         IP6T_ENTRY_ITERATE(t->entries[curcpu],
 894                            t->size,
 895                            set_entry_to_counter,
 896                            counters,
 897                            &i);
 898
 899         for_each_possible_cpu(cpu) {
 900                 if (cpu == curcpu)
 901                         continue;
 902                 i = 0;
 903                 IP6T_ENTRY_ITERATE(t->entries[cpu],
 904                                   t->size,
 905                                   add_entry_to_counter,
 906                                   counters,
 907                                   &i);
 908         }
 909 }
 910
 911 static int
 912 copy_entries_to_user(unsigned int total_size,
 913                      struct xt_table *table,
 914                      void __user *userptr)
 915 {
 916         unsigned int off, num, countersize;
 917         struct ip6t_entry *e;
 918         struct xt_counters *counters;
 919         struct xt_table_info *private = table->private;
 920         int ret = 0;
 921         void *loc_cpu_entry;
 922
 923         /* We need atomic snapshot of counters: rest doesn't change
 924            (other than comefrom, which userspace doesn't care
 925            about). */
 926         countersize = sizeof(struct xt_counters) * private->number;
 927         counters = vmalloc(countersize);
 928
 929         if (counters == NULL)
 930                 return -ENOMEM;
 931
 932         /* First, sum counters... */
 933         write_lock_bh(&table->lock);
 934         get_counters(private, counters);
 935         write_unlock_bh(&table->lock);
 936
 937         /* choose the copy that is on ourc node/cpu */
 938         loc_cpu_entry = private->entries[raw_smp_processor_id()];
 939         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 940                 ret = -EFAULT;
 941                 goto free_counters;
 942         }
 943
 944         /* FIXME: use iterator macros --RR */
 945         /* ... then go back and fix counters and names */
 946         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 947                 unsigned int i;
 948                 struct ip6t_entry_match *m;
 949                 struct ip6t_entry_target *t;
 950
 951                 e = (struct ip6t_entry *)(loc_cpu_entry + off);
 952                 if (copy_to_user(userptr + off
 953                                  + offsetof(struct ip6t_entry, counters),
 954                                  &counters[num],
 955                                  sizeof(counters[num])) != 0) {
 956                         ret = -EFAULT;
 957                         goto free_counters;
 958                 }
 959
 960                 for (i = sizeof(struct ip6t_entry);
 961                      i < e->target_offset;
 962                      i += m->u.match_size) {
 963                         m = (void *)e + i;
 964
 965                         if (copy_to_user(userptr + off + i
 966                                          + offsetof(struct ip6t_entry_match,
 967                                                     u.user.name),
 968                                          m->u.kernel.match->name,
 969                                          strlen(m->u.kernel.match->name)+1)
 970                             != 0) {
 971                                 ret = -EFAULT;
 972                                 goto free_counters;
 973                         }
 974                 }
 975
 976                 t = ip6t_get_target(e);
 977                 if (copy_to_user(userptr + off + e->target_offset
 978                                  + offsetof(struct ip6t_entry_target,
 979                                             u.user.name),
 980                                  t->u.kernel.target->name,
 981                                  strlen(t->u.kernel.target->name)+1) != 0) {
 982                         ret = -EFAULT;
 983                         goto free_counters;
 984                 }
 985         }
 986
 987  free_counters:
 988         vfree(counters);
 989         return ret;
 990 }
 991
 992 static int
 993 get_entries(const struct ip6t_get_entries *entries,
 994             struct ip6t_get_entries __user *uptr)
 995 {
 996         int ret;
 997         struct xt_table *t;
 998
 999         t = xt_find_table_lock(AF_INET6, entries->name);
1000         if (t && !IS_ERR(t)) {
1001                 struct xt_table_info *private = t->private;
1002                 duprintf("t->private->number = %u\n", private->number);
1003                 if (entries->size == private->size)
1004                         ret = copy_entries_to_user(private->size,
1005                                                    t, uptr->entrytable);
1006                 else {
1007                         duprintf("get_entries: I've got %u not %u!\n",
1008                                  private->size, entries->size);
1009                         ret = -EINVAL;
1010                 }
1011                 module_put(t->me);
1012                 xt_table_unlock(t);
1013         } else
1014                 ret = t ? PTR_ERR(t) : -ENOENT;
1015
1016         return ret;
1017 }
1018
1019 static int
1020 do_replace(void __user *user, unsigned int len)
1021 {
1022         int ret;
1023         struct ip6t_replace tmp;
1024         struct xt_table *t;
1025         struct xt_table_info *newinfo, *oldinfo;
1026         struct xt_counters *counters;
1027         void *loc_cpu_entry, *loc_cpu_old_entry;
1028
1029         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1030                 return -EFAULT;
1031
1032         /* overflow check */
1033         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1034                 return -ENOMEM;
1035
1036         newinfo = xt_alloc_table_info(tmp.size);
1037         if (!newinfo)
1038                 return -ENOMEM;
1039
1040         /* choose the copy that is on our node/cpu */
1041         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1042         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1043                            tmp.size) != 0) {
1044                 ret = -EFAULT;
1045                 goto free_newinfo;
1046         }
1047
1048         counters = vmalloc(tmp.num_counters * sizeof(struct xt_counters));
1049         if (!counters) {
1050                 ret = -ENOMEM;
1051                 goto free_newinfo;
1052         }
1053
1054         ret = translate_table(tmp.name, tmp.valid_hooks,
1055                               newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1056                               tmp.hook_entry, tmp.underflow);
1057         if (ret != 0)
1058                 goto free_newinfo_counters;
1059
1060         duprintf("ip_tables: Translated table\n");
1061
1062         t = try_then_request_module(xt_find_table_lock(AF_INET6, tmp.name),
1063                                     "ip6table_%s", tmp.name);
1064         if (!t || IS_ERR(t)) {
1065                 ret = t ? PTR_ERR(t) : -ENOENT;
1066                 goto free_newinfo_counters_untrans;
1067         }
1068
1069         /* You lied! */
1070         if (tmp.valid_hooks != t->valid_hooks) {
1071                 duprintf("Valid hook crap: %08X vs %08X\n",
1072                          tmp.valid_hooks, t->valid_hooks);
1073                 ret = -EINVAL;
1074                 goto put_module;
1075         }
1076
1077         oldinfo = xt_replace_table(t, tmp.num_counters, newinfo, &ret);
1078         if (!oldinfo)
1079                 goto put_module;
1080
1081         /* Update module usage count based on number of rules */
1082         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1083                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1084         if ((oldinfo->number > oldinfo->initial_entries) ||
1085             (newinfo->number <= oldinfo->initial_entries))
1086                 module_put(t->me);
1087         if ((oldinfo->number > oldinfo->initial_entries) &&
1088             (newinfo->number <= oldinfo->initial_entries))
1089                 module_put(t->me);
1090
1091         /* Get the old counters. */
1092         get_counters(oldinfo, counters);
1093         /* Decrease module usage counts and free resource */
1094         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1095         IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
1096         xt_free_table_info(oldinfo);
1097         if (copy_to_user(tmp.counters, counters,
1098                          sizeof(struct xt_counters) * tmp.num_counters) != 0)
1099                 ret = -EFAULT;
1100         vfree(counters);
1101         xt_table_unlock(t);
1102         return ret;
1103
1104  put_module:
1105         module_put(t->me);
1106         xt_table_unlock(t);
1107  free_newinfo_counters_untrans:
1108         IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
1109  free_newinfo_counters:
1110         vfree(counters);
1111  free_newinfo:
1112         xt_free_table_info(newinfo);
1113         return ret;
1114 }
1115
1116 /* We're lazy, and add to the first CPU; overflow works its fey magic
1117  * and everything is OK. */
1118 static inline int
1119 add_counter_to_entry(struct ip6t_entry *e,
1120                      const struct xt_counters addme[],
1121                      unsigned int *i)
1122 {
1123 #if 0
1124         duprintf("add_counter: Entry %u %lu/%lu + %lu/%lu\n",
1125                  *i,
1126                  (long unsigned int)e->counters.pcnt,
1127                  (long unsigned int)e->counters.bcnt,
1128                  (long unsigned int)addme[*i].pcnt,
1129                  (long unsigned int)addme[*i].bcnt);
1130 #endif
1131
1132         ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1133
1134         (*i)++;
1135         return 0;
1136 }
1137
1138 static int
1139 do_add_counters(void __user *user, unsigned int len)
1140 {
1141         unsigned int i;
1142         struct xt_counters_info tmp, *paddc;
1143         struct xt_table_info *private;
1144         struct xt_table *t;
1145         int ret = 0;
1146         void *loc_cpu_entry;
1147
1148         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1149                 return -EFAULT;
1150
1151         if (len != sizeof(tmp) + tmp.num_counters*sizeof(struct xt_counters))
1152                 return -EINVAL;
1153
1154         paddc = vmalloc(len);
1155         if (!paddc)
1156                 return -ENOMEM;
1157
1158         if (copy_from_user(paddc, user, len) != 0) {
1159                 ret = -EFAULT;
1160                 goto free;
1161         }
1162
1163         t = xt_find_table_lock(AF_INET6, tmp.name);
1164         if (!t || IS_ERR(t)) {
1165                 ret = t ? PTR_ERR(t) : -ENOENT;
1166                 goto free;
1167         }
1168
1169         write_lock_bh(&t->lock);
1170         private = t->private;
1171         if (private->number != tmp.num_counters) {
1172                 ret = -EINVAL;
1173                 goto unlock_up_free;
1174         }
1175
1176         i = 0;
1177         /* Choose the copy that is on our node */
1178         loc_cpu_entry = private->entries[smp_processor_id()];
1179         IP6T_ENTRY_ITERATE(loc_cpu_entry,
1180                           private->size,
1181                           add_counter_to_entry,
1182                           paddc->counters,
1183                           &i);
1184  unlock_up_free:
1185         write_unlock_bh(&t->lock);
1186         xt_table_unlock(t);
1187         module_put(t->me);
1188  free:
1189         vfree(paddc);
1190
1191         return ret;
1192 }
1193
1194 static int
1195 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1196 {
1197         int ret;
1198
1199         if (!capable(CAP_NET_ADMIN))
1200                 return -EPERM;
1201
1202         switch (cmd) {
1203         case IP6T_SO_SET_REPLACE:
1204                 ret = do_replace(user, len);
1205                 break;
1206
1207         case IP6T_SO_SET_ADD_COUNTERS:
1208                 ret = do_add_counters(user, len);
1209                 break;
1210
1211         default:
1212                 duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
1213                 ret = -EINVAL;
1214         }
1215
1216         return ret;
1217 }
1218
1219 static int
1220 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1221 {
1222         int ret;
1223
1224         if (!capable(CAP_NET_ADMIN))
1225                 return -EPERM;
1226
1227         switch (cmd) {
1228         case IP6T_SO_GET_INFO: {
1229                 char name[IP6T_TABLE_MAXNAMELEN];
1230                 struct xt_table *t;
1231
1232                 if (*len != sizeof(struct ip6t_getinfo)) {
1233                         duprintf("length %u != %u\n", *len,
1234                                  sizeof(struct ip6t_getinfo));
1235                         ret = -EINVAL;
1236                         break;
1237                 }
1238
1239                 if (copy_from_user(name, user, sizeof(name)) != 0) {
1240                         ret = -EFAULT;
1241                         break;
1242                 }
1243                 name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
1244
1245                 t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
1246                                             "ip6table_%s", name);
1247                 if (t && !IS_ERR(t)) {
1248                         struct ip6t_getinfo info;
1249                         struct xt_table_info *private = t->private;
1250
1251                         info.valid_hooks = t->valid_hooks;
1252                         memcpy(info.hook_entry, private->hook_entry,
1253                                sizeof(info.hook_entry));
1254                         memcpy(info.underflow, private->underflow,
1255                                sizeof(info.underflow));
1256                         info.num_entries = private->number;
1257                         info.size = private->size;
1258                         memcpy(info.name, name, sizeof(info.name));
1259
1260                         if (copy_to_user(user, &info, *len) != 0)
1261                                 ret = -EFAULT;
1262                         else
1263                                 ret = 0;
1264                         xt_table_unlock(t);
1265                         module_put(t->me);
1266                 } else
1267                         ret = t ? PTR_ERR(t) : -ENOENT;
1268         }
1269         break;
1270
1271         case IP6T_SO_GET_ENTRIES: {
1272                 struct ip6t_get_entries get;
1273
1274                 if (*len < sizeof(get)) {
1275                         duprintf("get_entries: %u < %u\n", *len, sizeof(get));
1276                         ret = -EINVAL;
1277                 } else if (copy_from_user(&get, user, sizeof(get)) != 0) {
1278                         ret = -EFAULT;
1279                 } else if (*len != sizeof(struct ip6t_get_entries) + get.size) {
1280                         duprintf("get_entries: %u != %u\n", *len,
1281                                  sizeof(struct ip6t_get_entries) + get.size);
1282                         ret = -EINVAL;
1283                 } else
1284                         ret = get_entries(&get, user);
1285                 break;
1286         }
1287
1288         case IP6T_SO_GET_REVISION_MATCH:
1289         case IP6T_SO_GET_REVISION_TARGET: {
1290                 struct ip6t_get_revision rev;
1291                 int target;
1292
1293                 if (*len != sizeof(rev)) {
1294                         ret = -EINVAL;
1295                         break;
1296                 }
1297                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
1298                         ret = -EFAULT;
1299                         break;
1300                 }
1301
1302                 if (cmd == IP6T_SO_GET_REVISION_TARGET)
1303                         target = 1;
1304                 else
1305                         target = 0;
1306
1307                 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
1308                                                          rev.revision,
1309                                                          target, &ret),
1310                                         "ip6t_%s", rev.name);
1311                 break;
1312         }
1313
1314         default:
1315                 duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
1316                 ret = -EINVAL;
1317         }
1318
1319         return ret;
1320 }
1321
1322 int ip6t_register_table(struct xt_table *table,
1323                         const struct ip6t_replace *repl)
1324 {
1325         int ret;
1326         struct xt_table_info *newinfo;
1327         struct xt_table_info bootstrap
1328                 = { 0, 0, 0, { 0 }, { 0 }, { } };
1329         void *loc_cpu_entry;
1330
1331         newinfo = xt_alloc_table_info(repl->size);
1332         if (!newinfo)
1333                 return -ENOMEM;
1334
1335         /* choose the copy on our node/cpu */
1336         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1337         memcpy(loc_cpu_entry, repl->entries, repl->size);
1338
1339         ret = translate_table(table->name, table->valid_hooks,
1340                               newinfo, loc_cpu_entry, repl->size,
1341                               repl->num_entries,
1342                               repl->hook_entry,
1343                               repl->underflow);
1344         if (ret != 0) {
1345                 xt_free_table_info(newinfo);
1346                 return ret;
1347         }
1348
1349         ret = xt_register_table(table, &bootstrap, newinfo);
1350         if (ret != 0) {
1351                 xt_free_table_info(newinfo);
1352                 return ret;
1353         }
1354
1355         return 0;
1356 }
1357
1358 void ip6t_unregister_table(struct xt_table *table)
1359 {
1360         struct xt_table_info *private;
1361         void *loc_cpu_entry;
1362
1363         private = xt_unregister_table(table);
1364
1365         /* Decrease module usage counts and free resources */
1366         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1367         IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
1368         xt_free_table_info(private);
1369 }
1370
1371 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
1372 static inline bool
1373 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
1374                      u_int8_t type, u_int8_t code,
1375                      bool invert)
1376 {
1377         return (type == test_type && code >= min_code && code <= max_code)
1378                 ^ invert;
1379 }
1380
1381 static bool
1382 icmp6_match(const struct sk_buff *skb,
1383            const struct net_device *in,
1384            const struct net_device *out,
1385            const struct xt_match *match,
1386            const void *matchinfo,
1387            int offset,
1388            unsigned int protoff,
1389            bool *hotdrop)
1390 {
1391         struct icmp6hdr _icmp, *ic;
1392         const struct ip6t_icmp *icmpinfo = matchinfo;
1393
1394         /* Must not be a fragment. */
1395         if (offset)
1396                 return false;
1397
1398         ic = skb_header_pointer(skb, protoff, sizeof(_icmp), &_icmp);
1399         if (ic == NULL) {
1400                 /* We've been asked to examine this packet, and we
1401                    can't.  Hence, no choice but to drop. */
1402                 duprintf("Dropping evil ICMP tinygram.\n");
1403                 *hotdrop = true;
1404                 return false;
1405         }
1406
1407         return icmp6_type_code_match(icmpinfo->type,
1408                                      icmpinfo->code[0],
1409                                      icmpinfo->code[1],
1410                                      ic->icmp6_type, ic->icmp6_code,
1411                                      !!(icmpinfo->invflags&IP6T_ICMP_INV));
1412 }
1413
1414 /* Called when user tries to insert an entry of this type. */
1415 static bool
1416 icmp6_checkentry(const char *tablename,
1417            const void *entry,
1418            const struct xt_match *match,
1419            void *matchinfo,
1420            unsigned int hook_mask)
1421 {
1422         const struct ip6t_icmp *icmpinfo = matchinfo;
1423
1424         /* Must specify no unknown invflags */
1425         return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
1426 }
1427
1428 /* The built-in targets: standard (NULL) and error. */
1429 static struct xt_target ip6t_standard_target __read_mostly = {
1430         .name           = IP6T_STANDARD_TARGET,
1431         .targetsize     = sizeof(int),
1432         .family         = AF_INET6,
1433 };
1434
1435 static struct xt_target ip6t_error_target __read_mostly = {
1436         .name           = IP6T_ERROR_TARGET,
1437         .target         = ip6t_error,
1438         .targetsize     = IP6T_FUNCTION_MAXNAMELEN,
1439         .family         = AF_INET6,
1440 };
1441
1442 static struct nf_sockopt_ops ip6t_sockopts = {
1443         .pf             = PF_INET6,
1444         .set_optmin     = IP6T_BASE_CTL,
1445         .set_optmax     = IP6T_SO_SET_MAX+1,
1446         .set            = do_ip6t_set_ctl,
1447         .get_optmin     = IP6T_BASE_CTL,
1448         .get_optmax     = IP6T_SO_GET_MAX+1,
1449         .get            = do_ip6t_get_ctl,
1450         .owner          = THIS_MODULE,
1451 };
1452
1453 static struct xt_match icmp6_matchstruct __read_mostly = {
1454         .name           = "icmp6",
1455         .match          = &icmp6_match,
1456         .matchsize      = sizeof(struct ip6t_icmp),
1457         .checkentry     = icmp6_checkentry,
1458         .proto          = IPPROTO_ICMPV6,
1459         .family         = AF_INET6,
1460 };
1461
1462 static int __init ip6_tables_init(void)
1463 {
1464         int ret;
1465
1466         ret = xt_proto_init(AF_INET6);
1467         if (ret < 0)
1468                 goto err1;
1469
1470         /* Noone else will be downing sem now, so we won't sleep */
1471         ret = xt_register_target(&ip6t_standard_target);
1472         if (ret < 0)
1473                 goto err2;
1474         ret = xt_register_target(&ip6t_error_target);
1475         if (ret < 0)
1476                 goto err3;
1477         ret = xt_register_match(&icmp6_matchstruct);
1478         if (ret < 0)
1479                 goto err4;
1480
1481         /* Register setsockopt */
1482         ret = nf_register_sockopt(&ip6t_sockopts);
1483         if (ret < 0)
1484                 goto err5;
1485
1486         printk(KERN_INFO "ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
1487         return 0;
1488
1489 err5:
1490         xt_unregister_match(&icmp6_matchstruct);
1491 err4:
1492         xt_unregister_target(&ip6t_error_target);
1493 err3:
1494         xt_unregister_target(&ip6t_standard_target);
1495 err2:
1496         xt_proto_fini(AF_INET6);
1497 err1:
1498         return ret;
1499 }
1500
1501 static void __exit ip6_tables_fini(void)
1502 {
1503         nf_unregister_sockopt(&ip6t_sockopts);
1504         xt_unregister_match(&icmp6_matchstruct);
1505         xt_unregister_target(&ip6t_error_target);
1506         xt_unregister_target(&ip6t_standard_target);
1507         xt_proto_fini(AF_INET6);
1508 }
1509
1510 /*
1511  * find the offset to specified header or the protocol number of last header
1512  * if target < 0. "last header" is transport protocol header, ESP, or
1513  * "No next header".
1514  *
1515  * If target header is found, its offset is set in *offset and return protocol
1516  * number. Otherwise, return -1.
1517  *
1518  * If the first fragment doesn't contain the final protocol header or
1519  * NEXTHDR_NONE it is considered invalid.
1520  *
1521  * Note that non-1st fragment is special case that "the protocol number
1522  * of last header" is "next header" field in Fragment header. In this case,
1523  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
1524  * isn't NULL.
1525  *
1526  */
1527 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
1528                   int target, unsigned short *fragoff)
1529 {
1530         unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
1531         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
1532         unsigned int len = skb->len - start;
1533
1534         if (fragoff)
1535                 *fragoff = 0;
1536
1537         while (nexthdr != target) {
1538                 struct ipv6_opt_hdr _hdr, *hp;
1539                 unsigned int hdrlen;
1540
1541                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
1542                         if (target < 0)
1543                                 break;
1544                         return -ENOENT;
1545                 }
1546
1547                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
1548                 if (hp == NULL)
1549                         return -EBADMSG;
1550                 if (nexthdr == NEXTHDR_FRAGMENT) {
1551                         unsigned short _frag_off;
1552                         __be16 *fp;
1553                         fp = skb_header_pointer(skb,
1554                                                 start+offsetof(struct frag_hdr,
1555                                                                frag_off),
1556                                                 sizeof(_frag_off),
1557                                                 &_frag_off);
1558                         if (fp == NULL)
1559                                 return -EBADMSG;
1560
1561                         _frag_off = ntohs(*fp) & ~0x7;
1562                         if (_frag_off) {
1563                                 if (target < 0 &&
1564                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
1565                                      hp->nexthdr == NEXTHDR_NONE)) {
1566                                         if (fragoff)
1567                                                 *fragoff = _frag_off;
1568                                         return hp->nexthdr;
1569                                 }
1570                                 return -ENOENT;
1571                         }
1572                         hdrlen = 8;
1573                 } else if (nexthdr == NEXTHDR_AUTH)
1574                         hdrlen = (hp->hdrlen + 2) << 2;
1575                 else
1576                         hdrlen = ipv6_optlen(hp);
1577
1578                 nexthdr = hp->nexthdr;
1579                 len -= hdrlen;
1580                 start += hdrlen;
1581         }
1582
1583         *offset = start;
1584         return nexthdr;
1585 }
1586
1587 EXPORT_SYMBOL(ip6t_register_table);
1588 EXPORT_SYMBOL(ip6t_unregister_table);
1589 EXPORT_SYMBOL(ip6t_do_table);
1590 EXPORT_SYMBOL(ip6t_ext_hdr);
1591 EXPORT_SYMBOL(ipv6_find_hdr);
1592
1593 module_init(ip6_tables_init);
1594 module_exit(ip6_tables_fini);