2 * Packet matching code.
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 #include <linux/kernel.h>
16 #include <linux/capability.h>
18 #include <linux/skbuff.h>
19 #include <linux/kmod.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netdevice.h>
22 #include <linux/module.h>
23 #include <linux/poison.h>
24 #include <linux/icmpv6.h>
26 #include <net/compat.h>
27 #include <linux/uaccess.h>
28 #include <linux/mutex.h>
29 #include <linux/proc_fs.h>
30 #include <linux/err.h>
31 #include <linux/cpumask.h>
33 #include <linux/netfilter_ipv6/ip6_tables.h>
34 #include <linux/netfilter/x_tables.h>
35 #include <net/netfilter/nf_log.h>
36 #include "../../netfilter/xt_repldata.h"
38 MODULE_LICENSE("GPL");
39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
40 MODULE_DESCRIPTION("IPv6 packet filter");
42 #ifdef CONFIG_NETFILTER_DEBUG
43 #define IP_NF_ASSERT(x) WARN_ON(!(x))
45 #define IP_NF_ASSERT(x)
48 void *ip6t_alloc_initial_table(const struct xt_table
*info
)
50 return xt_alloc_initial_table(ip6t
, IP6T
);
52 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table
);
55 We keep a set of rules for each CPU, so we can avoid write-locking
56 them in the softirq when updating the counters and therefore
57 only need to read-lock in the softirq; doing a write_lock_bh() in user
58 context stops packets coming through and allows user context to read
59 the counters or update the rules.
61 Hence the start of any table is given by get_table() below. */
63 /* Returns whether matches rule or not. */
64 /* Performance critical - called for every packet */
66 ip6_packet_match(const struct sk_buff
*skb
,
69 const struct ip6t_ip6
*ip6info
,
70 unsigned int *protoff
,
71 int *fragoff
, bool *hotdrop
)
74 const struct ipv6hdr
*ipv6
= ipv6_hdr(skb
);
76 if (NF_INVF(ip6info
, IP6T_INV_SRCIP
,
77 ipv6_masked_addr_cmp(&ipv6
->saddr
, &ip6info
->smsk
,
79 NF_INVF(ip6info
, IP6T_INV_DSTIP
,
80 ipv6_masked_addr_cmp(&ipv6
->daddr
, &ip6info
->dmsk
,
84 ret
= ifname_compare_aligned(indev
, ip6info
->iniface
, ip6info
->iniface_mask
);
86 if (NF_INVF(ip6info
, IP6T_INV_VIA_IN
, ret
!= 0))
89 ret
= ifname_compare_aligned(outdev
, ip6info
->outiface
, ip6info
->outiface_mask
);
91 if (NF_INVF(ip6info
, IP6T_INV_VIA_OUT
, ret
!= 0))
94 /* ... might want to do something with class and flowlabel here ... */
96 /* look for the desired protocol header */
97 if (ip6info
->flags
& IP6T_F_PROTO
) {
99 unsigned short _frag_off
;
101 protohdr
= ipv6_find_hdr(skb
, protoff
, -1, &_frag_off
, NULL
);
107 *fragoff
= _frag_off
;
109 if (ip6info
->proto
== protohdr
) {
110 if (ip6info
->invflags
& IP6T_INV_PROTO
)
116 /* We need match for the '-p all', too! */
117 if ((ip6info
->proto
!= 0) &&
118 !(ip6info
->invflags
& IP6T_INV_PROTO
))
124 /* should be ip6 safe */
126 ip6_checkentry(const struct ip6t_ip6
*ipv6
)
128 if (ipv6
->flags
& ~IP6T_F_MASK
)
130 if (ipv6
->invflags
& ~IP6T_INV_MASK
)
137 ip6t_error(struct sk_buff
*skb
, const struct xt_action_param
*par
)
139 net_info_ratelimited("error: `%s'\n", (const char *)par
->targinfo
);
144 static inline struct ip6t_entry
*
145 get_entry(const void *base
, unsigned int offset
)
147 return (struct ip6t_entry
*)(base
+ offset
);
150 /* All zeroes == unconditional rule. */
151 /* Mildly perf critical (only if packet tracing is on) */
152 static inline bool unconditional(const struct ip6t_entry
*e
)
154 static const struct ip6t_ip6 uncond
;
156 return e
->target_offset
== sizeof(struct ip6t_entry
) &&
157 memcmp(&e
->ipv6
, &uncond
, sizeof(uncond
)) == 0;
160 static inline const struct xt_entry_target
*
161 ip6t_get_target_c(const struct ip6t_entry
*e
)
163 return ip6t_get_target((struct ip6t_entry
*)e
);
166 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
167 /* This cries for unification! */
168 static const char *const hooknames
[] = {
169 [NF_INET_PRE_ROUTING
] = "PREROUTING",
170 [NF_INET_LOCAL_IN
] = "INPUT",
171 [NF_INET_FORWARD
] = "FORWARD",
172 [NF_INET_LOCAL_OUT
] = "OUTPUT",
173 [NF_INET_POST_ROUTING
] = "POSTROUTING",
176 enum nf_ip_trace_comments
{
177 NF_IP6_TRACE_COMMENT_RULE
,
178 NF_IP6_TRACE_COMMENT_RETURN
,
179 NF_IP6_TRACE_COMMENT_POLICY
,
182 static const char *const comments
[] = {
183 [NF_IP6_TRACE_COMMENT_RULE
] = "rule",
184 [NF_IP6_TRACE_COMMENT_RETURN
] = "return",
185 [NF_IP6_TRACE_COMMENT_POLICY
] = "policy",
188 static struct nf_loginfo trace_loginfo
= {
189 .type
= NF_LOG_TYPE_LOG
,
192 .level
= LOGLEVEL_WARNING
,
193 .logflags
= NF_LOG_DEFAULT_MASK
,
198 /* Mildly perf critical (only if packet tracing is on) */
200 get_chainname_rulenum(const struct ip6t_entry
*s
, const struct ip6t_entry
*e
,
201 const char *hookname
, const char **chainname
,
202 const char **comment
, unsigned int *rulenum
)
204 const struct xt_standard_target
*t
= (void *)ip6t_get_target_c(s
);
206 if (strcmp(t
->target
.u
.kernel
.target
->name
, XT_ERROR_TARGET
) == 0) {
207 /* Head of user chain: ERROR target with chainname */
208 *chainname
= t
->target
.data
;
213 if (unconditional(s
) &&
214 strcmp(t
->target
.u
.kernel
.target
->name
,
215 XT_STANDARD_TARGET
) == 0 &&
217 /* Tail of chains: STANDARD target (return/policy) */
218 *comment
= *chainname
== hookname
219 ? comments
[NF_IP6_TRACE_COMMENT_POLICY
]
220 : comments
[NF_IP6_TRACE_COMMENT_RETURN
];
229 static void trace_packet(struct net
*net
,
230 const struct sk_buff
*skb
,
232 const struct net_device
*in
,
233 const struct net_device
*out
,
234 const char *tablename
,
235 const struct xt_table_info
*private,
236 const struct ip6t_entry
*e
)
238 const struct ip6t_entry
*root
;
239 const char *hookname
, *chainname
, *comment
;
240 const struct ip6t_entry
*iter
;
241 unsigned int rulenum
= 0;
243 root
= get_entry(private->entries
, private->hook_entry
[hook
]);
245 hookname
= chainname
= hooknames
[hook
];
246 comment
= comments
[NF_IP6_TRACE_COMMENT_RULE
];
248 xt_entry_foreach(iter
, root
, private->size
- private->hook_entry
[hook
])
249 if (get_chainname_rulenum(iter
, e
, hookname
,
250 &chainname
, &comment
, &rulenum
) != 0)
253 nf_log_trace(net
, AF_INET6
, hook
, skb
, in
, out
, &trace_loginfo
,
254 "TRACE: %s:%s:%s:%u ",
255 tablename
, chainname
, comment
, rulenum
);
259 static inline struct ip6t_entry
*
260 ip6t_next_entry(const struct ip6t_entry
*entry
)
262 return (void *)entry
+ entry
->next_offset
;
265 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
267 ip6t_do_table(struct sk_buff
*skb
,
268 const struct nf_hook_state
*state
,
269 struct xt_table
*table
)
271 unsigned int hook
= state
->hook
;
272 static const char nulldevname
[IFNAMSIZ
] __attribute__((aligned(sizeof(long))));
273 /* Initializing verdict to NF_DROP keeps gcc happy. */
274 unsigned int verdict
= NF_DROP
;
275 const char *indev
, *outdev
;
276 const void *table_base
;
277 struct ip6t_entry
*e
, **jumpstack
;
278 unsigned int stackidx
, cpu
;
279 const struct xt_table_info
*private;
280 struct xt_action_param acpar
;
285 indev
= state
->in
? state
->in
->name
: nulldevname
;
286 outdev
= state
->out
? state
->out
->name
: nulldevname
;
287 /* We handle fragments by dealing with the first fragment as
288 * if it was a normal packet. All other fragments are treated
289 * normally, except that they will NEVER match rules that ask
290 * things we don't know, ie. tcp syn flag or ports). If the
291 * rule is also a fragment-specific rule, non-fragments won't
293 acpar
.hotdrop
= false;
296 IP_NF_ASSERT(table
->valid_hooks
& (1 << hook
));
299 addend
= xt_write_recseq_begin();
300 private = table
->private;
302 * Ensure we load private-> members after we've fetched the base
305 smp_read_barrier_depends();
306 cpu
= smp_processor_id();
307 table_base
= private->entries
;
308 jumpstack
= (struct ip6t_entry
**)private->jumpstack
[cpu
];
310 /* Switch to alternate jumpstack if we're being invoked via TEE.
311 * TEE issues XT_CONTINUE verdict on original skb so we must not
312 * clobber the jumpstack.
314 * For recursion via REJECT or SYNPROXY the stack will be clobbered
315 * but it is no problem since absolute verdict is issued by these.
317 if (static_key_false(&xt_tee_enabled
))
318 jumpstack
+= private->stacksize
* __this_cpu_read(nf_skb_duplicated
);
320 e
= get_entry(table_base
, private->hook_entry
[hook
]);
323 const struct xt_entry_target
*t
;
324 const struct xt_entry_match
*ematch
;
325 struct xt_counters
*counter
;
329 if (!ip6_packet_match(skb
, indev
, outdev
, &e
->ipv6
,
330 &acpar
.thoff
, &acpar
.fragoff
, &acpar
.hotdrop
)) {
332 e
= ip6t_next_entry(e
);
336 xt_ematch_foreach(ematch
, e
) {
337 acpar
.match
= ematch
->u
.kernel
.match
;
338 acpar
.matchinfo
= ematch
->data
;
339 if (!acpar
.match
->match(skb
, &acpar
))
343 counter
= xt_get_this_cpu_counter(&e
->counters
);
344 ADD_COUNTER(*counter
, skb
->len
, 1);
346 t
= ip6t_get_target_c(e
);
347 IP_NF_ASSERT(t
->u
.kernel
.target
);
349 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
350 /* The packet is traced: log it */
351 if (unlikely(skb
->nf_trace
))
352 trace_packet(state
->net
, skb
, hook
, state
->in
,
353 state
->out
, table
->name
, private, e
);
355 /* Standard target? */
356 if (!t
->u
.kernel
.target
->target
) {
359 v
= ((struct xt_standard_target
*)t
)->verdict
;
361 /* Pop from stack? */
362 if (v
!= XT_RETURN
) {
363 verdict
= (unsigned int)(-v
) - 1;
367 e
= get_entry(table_base
,
368 private->underflow
[hook
]);
370 e
= ip6t_next_entry(jumpstack
[--stackidx
]);
373 if (table_base
+ v
!= ip6t_next_entry(e
) &&
374 !(e
->ipv6
.flags
& IP6T_F_GOTO
)) {
375 jumpstack
[stackidx
++] = e
;
378 e
= get_entry(table_base
, v
);
382 acpar
.target
= t
->u
.kernel
.target
;
383 acpar
.targinfo
= t
->data
;
385 verdict
= t
->u
.kernel
.target
->target(skb
, &acpar
);
386 if (verdict
== XT_CONTINUE
)
387 e
= ip6t_next_entry(e
);
391 } while (!acpar
.hotdrop
);
393 xt_write_recseq_end(addend
);
401 static bool next_offset_ok(const struct xt_table_info
*t
, unsigned int newpos
)
403 if (newpos
> t
->size
- sizeof(struct ip6t_entry
))
406 if (newpos
% __alignof__(struct ip6t_entry
) != 0)
412 /* Figures out from what hook each rule can be called: returns 0 if
413 there are loops. Puts hook bitmask in comefrom. */
415 mark_source_chains(const struct xt_table_info
*newinfo
,
416 unsigned int valid_hooks
, void *entry0
,
417 unsigned int *offsets
)
421 /* No recursion; use packet counter to save back ptrs (reset
422 to 0 as we leave), and comefrom to save source hook bitmask */
423 for (hook
= 0; hook
< NF_INET_NUMHOOKS
; hook
++) {
424 unsigned int pos
= newinfo
->hook_entry
[hook
];
425 struct ip6t_entry
*e
= (struct ip6t_entry
*)(entry0
+ pos
);
427 if (!(valid_hooks
& (1 << hook
)))
430 /* Set initial back pointer. */
431 e
->counters
.pcnt
= pos
;
434 const struct xt_standard_target
*t
435 = (void *)ip6t_get_target_c(e
);
436 int visited
= e
->comefrom
& (1 << hook
);
438 if (e
->comefrom
& (1 << NF_INET_NUMHOOKS
))
441 e
->comefrom
|= ((1 << hook
) | (1 << NF_INET_NUMHOOKS
));
443 /* Unconditional return/END. */
444 if ((unconditional(e
) &&
445 (strcmp(t
->target
.u
.user
.name
,
446 XT_STANDARD_TARGET
) == 0) &&
447 t
->verdict
< 0) || visited
) {
448 unsigned int oldpos
, size
;
450 if ((strcmp(t
->target
.u
.user
.name
,
451 XT_STANDARD_TARGET
) == 0) &&
452 t
->verdict
< -NF_MAX_VERDICT
- 1)
455 /* Return: backtrack through the last
458 e
->comefrom
^= (1<<NF_INET_NUMHOOKS
);
460 pos
= e
->counters
.pcnt
;
461 e
->counters
.pcnt
= 0;
463 /* We're at the start. */
467 e
= (struct ip6t_entry
*)
469 } while (oldpos
== pos
+ e
->next_offset
);
472 size
= e
->next_offset
;
473 if (!next_offset_ok(newinfo
, pos
+ size
))
475 e
= (struct ip6t_entry
*)
476 (entry0
+ pos
+ size
);
477 if (pos
+ size
>= newinfo
->size
)
479 e
->counters
.pcnt
= pos
;
482 int newpos
= t
->verdict
;
484 if (strcmp(t
->target
.u
.user
.name
,
485 XT_STANDARD_TARGET
) == 0 &&
487 /* This a jump; chase it. */
488 if (!xt_find_jump_offset(offsets
, newpos
,
491 e
= (struct ip6t_entry
*)
494 /* ... this is a fallthru */
495 newpos
= pos
+ e
->next_offset
;
496 if (newpos
>= newinfo
->size
)
500 if (!next_offset_ok(newinfo
, newpos
))
503 e
= (struct ip6t_entry
*)
505 e
->counters
.pcnt
= pos
;
514 static void cleanup_match(struct xt_entry_match
*m
, struct net
*net
)
516 struct xt_mtdtor_param par
;
519 par
.match
= m
->u
.kernel
.match
;
520 par
.matchinfo
= m
->data
;
521 par
.family
= NFPROTO_IPV6
;
522 if (par
.match
->destroy
!= NULL
)
523 par
.match
->destroy(&par
);
524 module_put(par
.match
->me
);
527 static int check_match(struct xt_entry_match
*m
, struct xt_mtchk_param
*par
)
529 const struct ip6t_ip6
*ipv6
= par
->entryinfo
;
531 par
->match
= m
->u
.kernel
.match
;
532 par
->matchinfo
= m
->data
;
534 return xt_check_match(par
, m
->u
.match_size
- sizeof(*m
),
535 ipv6
->proto
, ipv6
->invflags
& IP6T_INV_PROTO
);
539 find_check_match(struct xt_entry_match
*m
, struct xt_mtchk_param
*par
)
541 struct xt_match
*match
;
544 match
= xt_request_find_match(NFPROTO_IPV6
, m
->u
.user
.name
,
547 return PTR_ERR(match
);
549 m
->u
.kernel
.match
= match
;
551 ret
= check_match(m
, par
);
557 module_put(m
->u
.kernel
.match
->me
);
561 static int check_target(struct ip6t_entry
*e
, struct net
*net
, const char *name
)
563 struct xt_entry_target
*t
= ip6t_get_target(e
);
564 struct xt_tgchk_param par
= {
568 .target
= t
->u
.kernel
.target
,
570 .hook_mask
= e
->comefrom
,
571 .family
= NFPROTO_IPV6
,
574 t
= ip6t_get_target(e
);
575 return xt_check_target(&par
, t
->u
.target_size
- sizeof(*t
),
577 e
->ipv6
.invflags
& IP6T_INV_PROTO
);
581 find_check_entry(struct ip6t_entry
*e
, struct net
*net
, const char *name
,
583 struct xt_percpu_counter_alloc_state
*alloc_state
)
585 struct xt_entry_target
*t
;
586 struct xt_target
*target
;
589 struct xt_mtchk_param mtpar
;
590 struct xt_entry_match
*ematch
;
592 if (!xt_percpu_counter_alloc(alloc_state
, &e
->counters
))
598 mtpar
.entryinfo
= &e
->ipv6
;
599 mtpar
.hook_mask
= e
->comefrom
;
600 mtpar
.family
= NFPROTO_IPV6
;
601 xt_ematch_foreach(ematch
, e
) {
602 ret
= find_check_match(ematch
, &mtpar
);
604 goto cleanup_matches
;
608 t
= ip6t_get_target(e
);
609 target
= xt_request_find_target(NFPROTO_IPV6
, t
->u
.user
.name
,
611 if (IS_ERR(target
)) {
612 ret
= PTR_ERR(target
);
613 goto cleanup_matches
;
615 t
->u
.kernel
.target
= target
;
617 ret
= check_target(e
, net
, name
);
622 module_put(t
->u
.kernel
.target
->me
);
624 xt_ematch_foreach(ematch
, e
) {
627 cleanup_match(ematch
, net
);
630 xt_percpu_counter_free(&e
->counters
);
635 static bool check_underflow(const struct ip6t_entry
*e
)
637 const struct xt_entry_target
*t
;
638 unsigned int verdict
;
640 if (!unconditional(e
))
642 t
= ip6t_get_target_c(e
);
643 if (strcmp(t
->u
.user
.name
, XT_STANDARD_TARGET
) != 0)
645 verdict
= ((struct xt_standard_target
*)t
)->verdict
;
646 verdict
= -verdict
- 1;
647 return verdict
== NF_DROP
|| verdict
== NF_ACCEPT
;
651 check_entry_size_and_hooks(struct ip6t_entry
*e
,
652 struct xt_table_info
*newinfo
,
653 const unsigned char *base
,
654 const unsigned char *limit
,
655 const unsigned int *hook_entries
,
656 const unsigned int *underflows
,
657 unsigned int valid_hooks
)
662 if ((unsigned long)e
% __alignof__(struct ip6t_entry
) != 0 ||
663 (unsigned char *)e
+ sizeof(struct ip6t_entry
) >= limit
||
664 (unsigned char *)e
+ e
->next_offset
> limit
)
668 < sizeof(struct ip6t_entry
) + sizeof(struct xt_entry_target
))
671 if (!ip6_checkentry(&e
->ipv6
))
674 err
= xt_check_entry_offsets(e
, e
->elems
, e
->target_offset
,
679 /* Check hooks & underflows */
680 for (h
= 0; h
< NF_INET_NUMHOOKS
; h
++) {
681 if (!(valid_hooks
& (1 << h
)))
683 if ((unsigned char *)e
- base
== hook_entries
[h
])
684 newinfo
->hook_entry
[h
] = hook_entries
[h
];
685 if ((unsigned char *)e
- base
== underflows
[h
]) {
686 if (!check_underflow(e
))
689 newinfo
->underflow
[h
] = underflows
[h
];
693 /* Clear counters and comefrom */
694 e
->counters
= ((struct xt_counters
) { 0, 0 });
699 static void cleanup_entry(struct ip6t_entry
*e
, struct net
*net
)
701 struct xt_tgdtor_param par
;
702 struct xt_entry_target
*t
;
703 struct xt_entry_match
*ematch
;
705 /* Cleanup all matches */
706 xt_ematch_foreach(ematch
, e
)
707 cleanup_match(ematch
, net
);
708 t
= ip6t_get_target(e
);
711 par
.target
= t
->u
.kernel
.target
;
712 par
.targinfo
= t
->data
;
713 par
.family
= NFPROTO_IPV6
;
714 if (par
.target
->destroy
!= NULL
)
715 par
.target
->destroy(&par
);
716 module_put(par
.target
->me
);
717 xt_percpu_counter_free(&e
->counters
);
720 /* Checks and translates the user-supplied table segment (held in
723 translate_table(struct net
*net
, struct xt_table_info
*newinfo
, void *entry0
,
724 const struct ip6t_replace
*repl
)
726 struct xt_percpu_counter_alloc_state alloc_state
= { 0 };
727 struct ip6t_entry
*iter
;
728 unsigned int *offsets
;
732 newinfo
->size
= repl
->size
;
733 newinfo
->number
= repl
->num_entries
;
735 /* Init all hooks to impossible value. */
736 for (i
= 0; i
< NF_INET_NUMHOOKS
; i
++) {
737 newinfo
->hook_entry
[i
] = 0xFFFFFFFF;
738 newinfo
->underflow
[i
] = 0xFFFFFFFF;
741 offsets
= xt_alloc_entry_offsets(newinfo
->number
);
745 /* Walk through entries, checking offsets. */
746 xt_entry_foreach(iter
, entry0
, newinfo
->size
) {
747 ret
= check_entry_size_and_hooks(iter
, newinfo
, entry0
,
754 if (i
< repl
->num_entries
)
755 offsets
[i
] = (void *)iter
- entry0
;
757 if (strcmp(ip6t_get_target(iter
)->u
.user
.name
,
758 XT_ERROR_TARGET
) == 0)
759 ++newinfo
->stacksize
;
763 if (i
!= repl
->num_entries
)
766 /* Check hooks all assigned */
767 for (i
= 0; i
< NF_INET_NUMHOOKS
; i
++) {
768 /* Only hooks which are valid */
769 if (!(repl
->valid_hooks
& (1 << i
)))
771 if (newinfo
->hook_entry
[i
] == 0xFFFFFFFF)
773 if (newinfo
->underflow
[i
] == 0xFFFFFFFF)
777 if (!mark_source_chains(newinfo
, repl
->valid_hooks
, entry0
, offsets
)) {
783 /* Finally, each sanity check must pass */
785 xt_entry_foreach(iter
, entry0
, newinfo
->size
) {
786 ret
= find_check_entry(iter
, net
, repl
->name
, repl
->size
,
794 xt_entry_foreach(iter
, entry0
, newinfo
->size
) {
797 cleanup_entry(iter
, net
);
809 get_counters(const struct xt_table_info
*t
,
810 struct xt_counters counters
[])
812 struct ip6t_entry
*iter
;
816 for_each_possible_cpu(cpu
) {
817 seqcount_t
*s
= &per_cpu(xt_recseq
, cpu
);
820 xt_entry_foreach(iter
, t
->entries
, t
->size
) {
821 struct xt_counters
*tmp
;
825 tmp
= xt_get_per_cpu_counter(&iter
->counters
, cpu
);
827 start
= read_seqcount_begin(s
);
830 } while (read_seqcount_retry(s
, start
));
832 ADD_COUNTER(counters
[i
], bcnt
, pcnt
);
838 static struct xt_counters
*alloc_counters(const struct xt_table
*table
)
840 unsigned int countersize
;
841 struct xt_counters
*counters
;
842 const struct xt_table_info
*private = table
->private;
844 /* We need atomic snapshot of counters: rest doesn't change
845 (other than comefrom, which userspace doesn't care
847 countersize
= sizeof(struct xt_counters
) * private->number
;
848 counters
= vzalloc(countersize
);
850 if (counters
== NULL
)
851 return ERR_PTR(-ENOMEM
);
853 get_counters(private, counters
);
859 copy_entries_to_user(unsigned int total_size
,
860 const struct xt_table
*table
,
861 void __user
*userptr
)
863 unsigned int off
, num
;
864 const struct ip6t_entry
*e
;
865 struct xt_counters
*counters
;
866 const struct xt_table_info
*private = table
->private;
868 const void *loc_cpu_entry
;
870 counters
= alloc_counters(table
);
871 if (IS_ERR(counters
))
872 return PTR_ERR(counters
);
874 loc_cpu_entry
= private->entries
;
875 if (copy_to_user(userptr
, loc_cpu_entry
, total_size
) != 0) {
880 /* FIXME: use iterator macros --RR */
881 /* ... then go back and fix counters and names */
882 for (off
= 0, num
= 0; off
< total_size
; off
+= e
->next_offset
, num
++){
884 const struct xt_entry_match
*m
;
885 const struct xt_entry_target
*t
;
887 e
= (struct ip6t_entry
*)(loc_cpu_entry
+ off
);
888 if (copy_to_user(userptr
+ off
889 + offsetof(struct ip6t_entry
, counters
),
891 sizeof(counters
[num
])) != 0) {
896 for (i
= sizeof(struct ip6t_entry
);
897 i
< e
->target_offset
;
898 i
+= m
->u
.match_size
) {
901 if (copy_to_user(userptr
+ off
+ i
902 + offsetof(struct xt_entry_match
,
904 m
->u
.kernel
.match
->name
,
905 strlen(m
->u
.kernel
.match
->name
)+1)
912 t
= ip6t_get_target_c(e
);
913 if (copy_to_user(userptr
+ off
+ e
->target_offset
914 + offsetof(struct xt_entry_target
,
916 t
->u
.kernel
.target
->name
,
917 strlen(t
->u
.kernel
.target
->name
)+1) != 0) {
929 static void compat_standard_from_user(void *dst
, const void *src
)
931 int v
= *(compat_int_t
*)src
;
934 v
+= xt_compat_calc_jump(AF_INET6
, v
);
935 memcpy(dst
, &v
, sizeof(v
));
938 static int compat_standard_to_user(void __user
*dst
, const void *src
)
940 compat_int_t cv
= *(int *)src
;
943 cv
-= xt_compat_calc_jump(AF_INET6
, cv
);
944 return copy_to_user(dst
, &cv
, sizeof(cv
)) ? -EFAULT
: 0;
947 static int compat_calc_entry(const struct ip6t_entry
*e
,
948 const struct xt_table_info
*info
,
949 const void *base
, struct xt_table_info
*newinfo
)
951 const struct xt_entry_match
*ematch
;
952 const struct xt_entry_target
*t
;
953 unsigned int entry_offset
;
956 off
= sizeof(struct ip6t_entry
) - sizeof(struct compat_ip6t_entry
);
957 entry_offset
= (void *)e
- base
;
958 xt_ematch_foreach(ematch
, e
)
959 off
+= xt_compat_match_offset(ematch
->u
.kernel
.match
);
960 t
= ip6t_get_target_c(e
);
961 off
+= xt_compat_target_offset(t
->u
.kernel
.target
);
962 newinfo
->size
-= off
;
963 ret
= xt_compat_add_offset(AF_INET6
, entry_offset
, off
);
967 for (i
= 0; i
< NF_INET_NUMHOOKS
; i
++) {
968 if (info
->hook_entry
[i
] &&
969 (e
< (struct ip6t_entry
*)(base
+ info
->hook_entry
[i
])))
970 newinfo
->hook_entry
[i
] -= off
;
971 if (info
->underflow
[i
] &&
972 (e
< (struct ip6t_entry
*)(base
+ info
->underflow
[i
])))
973 newinfo
->underflow
[i
] -= off
;
978 static int compat_table_info(const struct xt_table_info
*info
,
979 struct xt_table_info
*newinfo
)
981 struct ip6t_entry
*iter
;
982 const void *loc_cpu_entry
;
985 if (!newinfo
|| !info
)
988 /* we dont care about newinfo->entries */
989 memcpy(newinfo
, info
, offsetof(struct xt_table_info
, entries
));
990 newinfo
->initial_entries
= 0;
991 loc_cpu_entry
= info
->entries
;
992 xt_compat_init_offsets(AF_INET6
, info
->number
);
993 xt_entry_foreach(iter
, loc_cpu_entry
, info
->size
) {
994 ret
= compat_calc_entry(iter
, info
, loc_cpu_entry
, newinfo
);
1002 static int get_info(struct net
*net
, void __user
*user
,
1003 const int *len
, int compat
)
1005 char name
[XT_TABLE_MAXNAMELEN
];
1009 if (*len
!= sizeof(struct ip6t_getinfo
))
1012 if (copy_from_user(name
, user
, sizeof(name
)) != 0)
1015 name
[XT_TABLE_MAXNAMELEN
-1] = '\0';
1016 #ifdef CONFIG_COMPAT
1018 xt_compat_lock(AF_INET6
);
1020 t
= try_then_request_module(xt_find_table_lock(net
, AF_INET6
, name
),
1021 "ip6table_%s", name
);
1023 struct ip6t_getinfo info
;
1024 const struct xt_table_info
*private = t
->private;
1025 #ifdef CONFIG_COMPAT
1026 struct xt_table_info tmp
;
1029 ret
= compat_table_info(private, &tmp
);
1030 xt_compat_flush_offsets(AF_INET6
);
1034 memset(&info
, 0, sizeof(info
));
1035 info
.valid_hooks
= t
->valid_hooks
;
1036 memcpy(info
.hook_entry
, private->hook_entry
,
1037 sizeof(info
.hook_entry
));
1038 memcpy(info
.underflow
, private->underflow
,
1039 sizeof(info
.underflow
));
1040 info
.num_entries
= private->number
;
1041 info
.size
= private->size
;
1042 strcpy(info
.name
, name
);
1044 if (copy_to_user(user
, &info
, *len
) != 0)
1053 #ifdef CONFIG_COMPAT
1055 xt_compat_unlock(AF_INET6
);
1061 get_entries(struct net
*net
, struct ip6t_get_entries __user
*uptr
,
1065 struct ip6t_get_entries get
;
1068 if (*len
< sizeof(get
))
1070 if (copy_from_user(&get
, uptr
, sizeof(get
)) != 0)
1072 if (*len
!= sizeof(struct ip6t_get_entries
) + get
.size
)
1075 get
.name
[sizeof(get
.name
) - 1] = '\0';
1077 t
= xt_find_table_lock(net
, AF_INET6
, get
.name
);
1079 struct xt_table_info
*private = t
->private;
1080 if (get
.size
== private->size
)
1081 ret
= copy_entries_to_user(private->size
,
1082 t
, uptr
->entrytable
);
1095 __do_replace(struct net
*net
, const char *name
, unsigned int valid_hooks
,
1096 struct xt_table_info
*newinfo
, unsigned int num_counters
,
1097 void __user
*counters_ptr
)
1101 struct xt_table_info
*oldinfo
;
1102 struct xt_counters
*counters
;
1103 struct ip6t_entry
*iter
;
1106 counters
= vzalloc(num_counters
* sizeof(struct xt_counters
));
1112 t
= try_then_request_module(xt_find_table_lock(net
, AF_INET6
, name
),
1113 "ip6table_%s", name
);
1116 goto free_newinfo_counters_untrans
;
1120 if (valid_hooks
!= t
->valid_hooks
) {
1125 oldinfo
= xt_replace_table(t
, num_counters
, newinfo
, &ret
);
1129 /* Update module usage count based on number of rules */
1130 if ((oldinfo
->number
> oldinfo
->initial_entries
) ||
1131 (newinfo
->number
<= oldinfo
->initial_entries
))
1133 if ((oldinfo
->number
> oldinfo
->initial_entries
) &&
1134 (newinfo
->number
<= oldinfo
->initial_entries
))
1137 /* Get the old counters, and synchronize with replace */
1138 get_counters(oldinfo
, counters
);
1140 /* Decrease module usage counts and free resource */
1141 xt_entry_foreach(iter
, oldinfo
->entries
, oldinfo
->size
)
1142 cleanup_entry(iter
, net
);
1144 xt_free_table_info(oldinfo
);
1145 if (copy_to_user(counters_ptr
, counters
,
1146 sizeof(struct xt_counters
) * num_counters
) != 0) {
1147 /* Silent error, can't fail, new table is already in place */
1148 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1157 free_newinfo_counters_untrans
:
1164 do_replace(struct net
*net
, const void __user
*user
, unsigned int len
)
1167 struct ip6t_replace tmp
;
1168 struct xt_table_info
*newinfo
;
1169 void *loc_cpu_entry
;
1170 struct ip6t_entry
*iter
;
1172 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
1175 /* overflow check */
1176 if (tmp
.num_counters
>= INT_MAX
/ sizeof(struct xt_counters
))
1178 if (tmp
.num_counters
== 0)
1181 tmp
.name
[sizeof(tmp
.name
)-1] = 0;
1183 newinfo
= xt_alloc_table_info(tmp
.size
);
1187 loc_cpu_entry
= newinfo
->entries
;
1188 if (copy_from_user(loc_cpu_entry
, user
+ sizeof(tmp
),
1194 ret
= translate_table(net
, newinfo
, loc_cpu_entry
, &tmp
);
1198 ret
= __do_replace(net
, tmp
.name
, tmp
.valid_hooks
, newinfo
,
1199 tmp
.num_counters
, tmp
.counters
);
1201 goto free_newinfo_untrans
;
1204 free_newinfo_untrans
:
1205 xt_entry_foreach(iter
, loc_cpu_entry
, newinfo
->size
)
1206 cleanup_entry(iter
, net
);
1208 xt_free_table_info(newinfo
);
1213 do_add_counters(struct net
*net
, const void __user
*user
, unsigned int len
,
1217 struct xt_counters_info tmp
;
1218 struct xt_counters
*paddc
;
1220 const struct xt_table_info
*private;
1222 struct ip6t_entry
*iter
;
1223 unsigned int addend
;
1225 paddc
= xt_copy_counters_from_user(user
, len
, &tmp
, compat
);
1227 return PTR_ERR(paddc
);
1228 t
= xt_find_table_lock(net
, AF_INET6
, tmp
.name
);
1235 private = t
->private;
1236 if (private->number
!= tmp
.num_counters
) {
1238 goto unlock_up_free
;
1242 addend
= xt_write_recseq_begin();
1243 xt_entry_foreach(iter
, private->entries
, private->size
) {
1244 struct xt_counters
*tmp
;
1246 tmp
= xt_get_this_cpu_counter(&iter
->counters
);
1247 ADD_COUNTER(*tmp
, paddc
[i
].bcnt
, paddc
[i
].pcnt
);
1250 xt_write_recseq_end(addend
);
1261 #ifdef CONFIG_COMPAT
1262 struct compat_ip6t_replace
{
1263 char name
[XT_TABLE_MAXNAMELEN
];
1267 u32 hook_entry
[NF_INET_NUMHOOKS
];
1268 u32 underflow
[NF_INET_NUMHOOKS
];
1270 compat_uptr_t counters
; /* struct xt_counters * */
1271 struct compat_ip6t_entry entries
[0];
1275 compat_copy_entry_to_user(struct ip6t_entry
*e
, void __user
**dstptr
,
1276 unsigned int *size
, struct xt_counters
*counters
,
1279 struct xt_entry_target
*t
;
1280 struct compat_ip6t_entry __user
*ce
;
1281 u_int16_t target_offset
, next_offset
;
1282 compat_uint_t origsize
;
1283 const struct xt_entry_match
*ematch
;
1287 ce
= (struct compat_ip6t_entry __user
*)*dstptr
;
1288 if (copy_to_user(ce
, e
, sizeof(struct ip6t_entry
)) != 0 ||
1289 copy_to_user(&ce
->counters
, &counters
[i
],
1290 sizeof(counters
[i
])) != 0)
1293 *dstptr
+= sizeof(struct compat_ip6t_entry
);
1294 *size
-= sizeof(struct ip6t_entry
) - sizeof(struct compat_ip6t_entry
);
1296 xt_ematch_foreach(ematch
, e
) {
1297 ret
= xt_compat_match_to_user(ematch
, dstptr
, size
);
1301 target_offset
= e
->target_offset
- (origsize
- *size
);
1302 t
= ip6t_get_target(e
);
1303 ret
= xt_compat_target_to_user(t
, dstptr
, size
);
1306 next_offset
= e
->next_offset
- (origsize
- *size
);
1307 if (put_user(target_offset
, &ce
->target_offset
) != 0 ||
1308 put_user(next_offset
, &ce
->next_offset
) != 0)
1314 compat_find_calc_match(struct xt_entry_match
*m
,
1315 const struct ip6t_ip6
*ipv6
,
1318 struct xt_match
*match
;
1320 match
= xt_request_find_match(NFPROTO_IPV6
, m
->u
.user
.name
,
1321 m
->u
.user
.revision
);
1323 return PTR_ERR(match
);
1325 m
->u
.kernel
.match
= match
;
1326 *size
+= xt_compat_match_offset(match
);
1330 static void compat_release_entry(struct compat_ip6t_entry
*e
)
1332 struct xt_entry_target
*t
;
1333 struct xt_entry_match
*ematch
;
1335 /* Cleanup all matches */
1336 xt_ematch_foreach(ematch
, e
)
1337 module_put(ematch
->u
.kernel
.match
->me
);
1338 t
= compat_ip6t_get_target(e
);
1339 module_put(t
->u
.kernel
.target
->me
);
1343 check_compat_entry_size_and_hooks(struct compat_ip6t_entry
*e
,
1344 struct xt_table_info
*newinfo
,
1346 const unsigned char *base
,
1347 const unsigned char *limit
)
1349 struct xt_entry_match
*ematch
;
1350 struct xt_entry_target
*t
;
1351 struct xt_target
*target
;
1352 unsigned int entry_offset
;
1356 if ((unsigned long)e
% __alignof__(struct compat_ip6t_entry
) != 0 ||
1357 (unsigned char *)e
+ sizeof(struct compat_ip6t_entry
) >= limit
||
1358 (unsigned char *)e
+ e
->next_offset
> limit
)
1361 if (e
->next_offset
< sizeof(struct compat_ip6t_entry
) +
1362 sizeof(struct compat_xt_entry_target
))
1365 if (!ip6_checkentry(&e
->ipv6
))
1368 ret
= xt_compat_check_entry_offsets(e
, e
->elems
,
1369 e
->target_offset
, e
->next_offset
);
1373 off
= sizeof(struct ip6t_entry
) - sizeof(struct compat_ip6t_entry
);
1374 entry_offset
= (void *)e
- (void *)base
;
1376 xt_ematch_foreach(ematch
, e
) {
1377 ret
= compat_find_calc_match(ematch
, &e
->ipv6
, &off
);
1379 goto release_matches
;
1383 t
= compat_ip6t_get_target(e
);
1384 target
= xt_request_find_target(NFPROTO_IPV6
, t
->u
.user
.name
,
1385 t
->u
.user
.revision
);
1386 if (IS_ERR(target
)) {
1387 ret
= PTR_ERR(target
);
1388 goto release_matches
;
1390 t
->u
.kernel
.target
= target
;
1392 off
+= xt_compat_target_offset(target
);
1394 ret
= xt_compat_add_offset(AF_INET6
, entry_offset
, off
);
1401 module_put(t
->u
.kernel
.target
->me
);
1403 xt_ematch_foreach(ematch
, e
) {
1406 module_put(ematch
->u
.kernel
.match
->me
);
1412 compat_copy_entry_from_user(struct compat_ip6t_entry
*e
, void **dstptr
,
1414 struct xt_table_info
*newinfo
, unsigned char *base
)
1416 struct xt_entry_target
*t
;
1417 struct ip6t_entry
*de
;
1418 unsigned int origsize
;
1420 struct xt_entry_match
*ematch
;
1423 de
= (struct ip6t_entry
*)*dstptr
;
1424 memcpy(de
, e
, sizeof(struct ip6t_entry
));
1425 memcpy(&de
->counters
, &e
->counters
, sizeof(e
->counters
));
1427 *dstptr
+= sizeof(struct ip6t_entry
);
1428 *size
+= sizeof(struct ip6t_entry
) - sizeof(struct compat_ip6t_entry
);
1430 xt_ematch_foreach(ematch
, e
)
1431 xt_compat_match_from_user(ematch
, dstptr
, size
);
1433 de
->target_offset
= e
->target_offset
- (origsize
- *size
);
1434 t
= compat_ip6t_get_target(e
);
1435 xt_compat_target_from_user(t
, dstptr
, size
);
1437 de
->next_offset
= e
->next_offset
- (origsize
- *size
);
1438 for (h
= 0; h
< NF_INET_NUMHOOKS
; h
++) {
1439 if ((unsigned char *)de
- base
< newinfo
->hook_entry
[h
])
1440 newinfo
->hook_entry
[h
] -= origsize
- *size
;
1441 if ((unsigned char *)de
- base
< newinfo
->underflow
[h
])
1442 newinfo
->underflow
[h
] -= origsize
- *size
;
1447 translate_compat_table(struct net
*net
,
1448 struct xt_table_info
**pinfo
,
1450 const struct compat_ip6t_replace
*compatr
)
1453 struct xt_table_info
*newinfo
, *info
;
1454 void *pos
, *entry0
, *entry1
;
1455 struct compat_ip6t_entry
*iter0
;
1456 struct ip6t_replace repl
;
1462 size
= compatr
->size
;
1463 info
->number
= compatr
->num_entries
;
1466 xt_compat_lock(AF_INET6
);
1467 xt_compat_init_offsets(AF_INET6
, compatr
->num_entries
);
1468 /* Walk through entries, checking offsets. */
1469 xt_entry_foreach(iter0
, entry0
, compatr
->size
) {
1470 ret
= check_compat_entry_size_and_hooks(iter0
, info
, &size
,
1472 entry0
+ compatr
->size
);
1479 if (j
!= compatr
->num_entries
)
1483 newinfo
= xt_alloc_table_info(size
);
1487 newinfo
->number
= compatr
->num_entries
;
1488 for (i
= 0; i
< NF_INET_NUMHOOKS
; i
++) {
1489 newinfo
->hook_entry
[i
] = compatr
->hook_entry
[i
];
1490 newinfo
->underflow
[i
] = compatr
->underflow
[i
];
1492 entry1
= newinfo
->entries
;
1494 size
= compatr
->size
;
1495 xt_entry_foreach(iter0
, entry0
, compatr
->size
)
1496 compat_copy_entry_from_user(iter0
, &pos
, &size
,
1499 /* all module references in entry0 are now gone. */
1500 xt_compat_flush_offsets(AF_INET6
);
1501 xt_compat_unlock(AF_INET6
);
1503 memcpy(&repl
, compatr
, sizeof(*compatr
));
1505 for (i
= 0; i
< NF_INET_NUMHOOKS
; i
++) {
1506 repl
.hook_entry
[i
] = newinfo
->hook_entry
[i
];
1507 repl
.underflow
[i
] = newinfo
->underflow
[i
];
1510 repl
.num_counters
= 0;
1511 repl
.counters
= NULL
;
1512 repl
.size
= newinfo
->size
;
1513 ret
= translate_table(net
, newinfo
, entry1
, &repl
);
1519 xt_free_table_info(info
);
1523 xt_free_table_info(newinfo
);
1526 xt_compat_flush_offsets(AF_INET6
);
1527 xt_compat_unlock(AF_INET6
);
1528 xt_entry_foreach(iter0
, entry0
, compatr
->size
) {
1531 compat_release_entry(iter0
);
1537 compat_do_replace(struct net
*net
, void __user
*user
, unsigned int len
)
1540 struct compat_ip6t_replace tmp
;
1541 struct xt_table_info
*newinfo
;
1542 void *loc_cpu_entry
;
1543 struct ip6t_entry
*iter
;
1545 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
1548 /* overflow check */
1549 if (tmp
.num_counters
>= INT_MAX
/ sizeof(struct xt_counters
))
1551 if (tmp
.num_counters
== 0)
1554 tmp
.name
[sizeof(tmp
.name
)-1] = 0;
1556 newinfo
= xt_alloc_table_info(tmp
.size
);
1560 loc_cpu_entry
= newinfo
->entries
;
1561 if (copy_from_user(loc_cpu_entry
, user
+ sizeof(tmp
),
1567 ret
= translate_compat_table(net
, &newinfo
, &loc_cpu_entry
, &tmp
);
1571 ret
= __do_replace(net
, tmp
.name
, tmp
.valid_hooks
, newinfo
,
1572 tmp
.num_counters
, compat_ptr(tmp
.counters
));
1574 goto free_newinfo_untrans
;
1577 free_newinfo_untrans
:
1578 xt_entry_foreach(iter
, loc_cpu_entry
, newinfo
->size
)
1579 cleanup_entry(iter
, net
);
1581 xt_free_table_info(newinfo
);
1586 compat_do_ip6t_set_ctl(struct sock
*sk
, int cmd
, void __user
*user
,
1591 if (!ns_capable(sock_net(sk
)->user_ns
, CAP_NET_ADMIN
))
1595 case IP6T_SO_SET_REPLACE
:
1596 ret
= compat_do_replace(sock_net(sk
), user
, len
);
1599 case IP6T_SO_SET_ADD_COUNTERS
:
1600 ret
= do_add_counters(sock_net(sk
), user
, len
, 1);
1610 struct compat_ip6t_get_entries
{
1611 char name
[XT_TABLE_MAXNAMELEN
];
1613 struct compat_ip6t_entry entrytable
[0];
1617 compat_copy_entries_to_user(unsigned int total_size
, struct xt_table
*table
,
1618 void __user
*userptr
)
1620 struct xt_counters
*counters
;
1621 const struct xt_table_info
*private = table
->private;
1626 struct ip6t_entry
*iter
;
1628 counters
= alloc_counters(table
);
1629 if (IS_ERR(counters
))
1630 return PTR_ERR(counters
);
1634 xt_entry_foreach(iter
, private->entries
, total_size
) {
1635 ret
= compat_copy_entry_to_user(iter
, &pos
,
1636 &size
, counters
, i
++);
1646 compat_get_entries(struct net
*net
, struct compat_ip6t_get_entries __user
*uptr
,
1650 struct compat_ip6t_get_entries get
;
1653 if (*len
< sizeof(get
))
1656 if (copy_from_user(&get
, uptr
, sizeof(get
)) != 0)
1659 if (*len
!= sizeof(struct compat_ip6t_get_entries
) + get
.size
)
1662 get
.name
[sizeof(get
.name
) - 1] = '\0';
1664 xt_compat_lock(AF_INET6
);
1665 t
= xt_find_table_lock(net
, AF_INET6
, get
.name
);
1667 const struct xt_table_info
*private = t
->private;
1668 struct xt_table_info info
;
1669 ret
= compat_table_info(private, &info
);
1670 if (!ret
&& get
.size
== info
.size
)
1671 ret
= compat_copy_entries_to_user(private->size
,
1672 t
, uptr
->entrytable
);
1676 xt_compat_flush_offsets(AF_INET6
);
1682 xt_compat_unlock(AF_INET6
);
1686 static int do_ip6t_get_ctl(struct sock
*, int, void __user
*, int *);
1689 compat_do_ip6t_get_ctl(struct sock
*sk
, int cmd
, void __user
*user
, int *len
)
1693 if (!ns_capable(sock_net(sk
)->user_ns
, CAP_NET_ADMIN
))
1697 case IP6T_SO_GET_INFO
:
1698 ret
= get_info(sock_net(sk
), user
, len
, 1);
1700 case IP6T_SO_GET_ENTRIES
:
1701 ret
= compat_get_entries(sock_net(sk
), user
, len
);
1704 ret
= do_ip6t_get_ctl(sk
, cmd
, user
, len
);
1711 do_ip6t_set_ctl(struct sock
*sk
, int cmd
, void __user
*user
, unsigned int len
)
1715 if (!ns_capable(sock_net(sk
)->user_ns
, CAP_NET_ADMIN
))
1719 case IP6T_SO_SET_REPLACE
:
1720 ret
= do_replace(sock_net(sk
), user
, len
);
1723 case IP6T_SO_SET_ADD_COUNTERS
:
1724 ret
= do_add_counters(sock_net(sk
), user
, len
, 0);
1735 do_ip6t_get_ctl(struct sock
*sk
, int cmd
, void __user
*user
, int *len
)
1739 if (!ns_capable(sock_net(sk
)->user_ns
, CAP_NET_ADMIN
))
1743 case IP6T_SO_GET_INFO
:
1744 ret
= get_info(sock_net(sk
), user
, len
, 0);
1747 case IP6T_SO_GET_ENTRIES
:
1748 ret
= get_entries(sock_net(sk
), user
, len
);
1751 case IP6T_SO_GET_REVISION_MATCH
:
1752 case IP6T_SO_GET_REVISION_TARGET
: {
1753 struct xt_get_revision rev
;
1756 if (*len
!= sizeof(rev
)) {
1760 if (copy_from_user(&rev
, user
, sizeof(rev
)) != 0) {
1764 rev
.name
[sizeof(rev
.name
)-1] = 0;
1766 if (cmd
== IP6T_SO_GET_REVISION_TARGET
)
1771 try_then_request_module(xt_find_revision(AF_INET6
, rev
.name
,
1774 "ip6t_%s", rev
.name
);
1785 static void __ip6t_unregister_table(struct net
*net
, struct xt_table
*table
)
1787 struct xt_table_info
*private;
1788 void *loc_cpu_entry
;
1789 struct module
*table_owner
= table
->me
;
1790 struct ip6t_entry
*iter
;
1792 private = xt_unregister_table(table
);
1794 /* Decrease module usage counts and free resources */
1795 loc_cpu_entry
= private->entries
;
1796 xt_entry_foreach(iter
, loc_cpu_entry
, private->size
)
1797 cleanup_entry(iter
, net
);
1798 if (private->number
> private->initial_entries
)
1799 module_put(table_owner
);
1800 xt_free_table_info(private);
1803 int ip6t_register_table(struct net
*net
, const struct xt_table
*table
,
1804 const struct ip6t_replace
*repl
,
1805 const struct nf_hook_ops
*ops
,
1806 struct xt_table
**res
)
1809 struct xt_table_info
*newinfo
;
1810 struct xt_table_info bootstrap
= {0};
1811 void *loc_cpu_entry
;
1812 struct xt_table
*new_table
;
1814 newinfo
= xt_alloc_table_info(repl
->size
);
1818 loc_cpu_entry
= newinfo
->entries
;
1819 memcpy(loc_cpu_entry
, repl
->entries
, repl
->size
);
1821 ret
= translate_table(net
, newinfo
, loc_cpu_entry
, repl
);
1825 new_table
= xt_register_table(net
, table
, &bootstrap
, newinfo
);
1826 if (IS_ERR(new_table
)) {
1827 ret
= PTR_ERR(new_table
);
1831 /* set res now, will see skbs right after nf_register_net_hooks */
1832 WRITE_ONCE(*res
, new_table
);
1834 ret
= nf_register_net_hooks(net
, ops
, hweight32(table
->valid_hooks
));
1836 __ip6t_unregister_table(net
, new_table
);
1843 xt_free_table_info(newinfo
);
1847 void ip6t_unregister_table(struct net
*net
, struct xt_table
*table
,
1848 const struct nf_hook_ops
*ops
)
1850 nf_unregister_net_hooks(net
, ops
, hweight32(table
->valid_hooks
));
1851 __ip6t_unregister_table(net
, table
);
1854 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
1856 icmp6_type_code_match(u_int8_t test_type
, u_int8_t min_code
, u_int8_t max_code
,
1857 u_int8_t type
, u_int8_t code
,
1860 return (type
== test_type
&& code
>= min_code
&& code
<= max_code
)
1865 icmp6_match(const struct sk_buff
*skb
, struct xt_action_param
*par
)
1867 const struct icmp6hdr
*ic
;
1868 struct icmp6hdr _icmph
;
1869 const struct ip6t_icmp
*icmpinfo
= par
->matchinfo
;
1871 /* Must not be a fragment. */
1872 if (par
->fragoff
!= 0)
1875 ic
= skb_header_pointer(skb
, par
->thoff
, sizeof(_icmph
), &_icmph
);
1877 /* We've been asked to examine this packet, and we
1878 * can't. Hence, no choice but to drop.
1880 par
->hotdrop
= true;
1884 return icmp6_type_code_match(icmpinfo
->type
,
1887 ic
->icmp6_type
, ic
->icmp6_code
,
1888 !!(icmpinfo
->invflags
&IP6T_ICMP_INV
));
1891 /* Called when user tries to insert an entry of this type. */
1892 static int icmp6_checkentry(const struct xt_mtchk_param
*par
)
1894 const struct ip6t_icmp
*icmpinfo
= par
->matchinfo
;
1896 /* Must specify no unknown invflags */
1897 return (icmpinfo
->invflags
& ~IP6T_ICMP_INV
) ? -EINVAL
: 0;
1900 /* The built-in targets: standard (NULL) and error. */
1901 static struct xt_target ip6t_builtin_tg
[] __read_mostly
= {
1903 .name
= XT_STANDARD_TARGET
,
1904 .targetsize
= sizeof(int),
1905 .family
= NFPROTO_IPV6
,
1906 #ifdef CONFIG_COMPAT
1907 .compatsize
= sizeof(compat_int_t
),
1908 .compat_from_user
= compat_standard_from_user
,
1909 .compat_to_user
= compat_standard_to_user
,
1913 .name
= XT_ERROR_TARGET
,
1914 .target
= ip6t_error
,
1915 .targetsize
= XT_FUNCTION_MAXNAMELEN
,
1916 .family
= NFPROTO_IPV6
,
1920 static struct nf_sockopt_ops ip6t_sockopts
= {
1922 .set_optmin
= IP6T_BASE_CTL
,
1923 .set_optmax
= IP6T_SO_SET_MAX
+1,
1924 .set
= do_ip6t_set_ctl
,
1925 #ifdef CONFIG_COMPAT
1926 .compat_set
= compat_do_ip6t_set_ctl
,
1928 .get_optmin
= IP6T_BASE_CTL
,
1929 .get_optmax
= IP6T_SO_GET_MAX
+1,
1930 .get
= do_ip6t_get_ctl
,
1931 #ifdef CONFIG_COMPAT
1932 .compat_get
= compat_do_ip6t_get_ctl
,
1934 .owner
= THIS_MODULE
,
1937 static struct xt_match ip6t_builtin_mt
[] __read_mostly
= {
1940 .match
= icmp6_match
,
1941 .matchsize
= sizeof(struct ip6t_icmp
),
1942 .checkentry
= icmp6_checkentry
,
1943 .proto
= IPPROTO_ICMPV6
,
1944 .family
= NFPROTO_IPV6
,
1948 static int __net_init
ip6_tables_net_init(struct net
*net
)
1950 return xt_proto_init(net
, NFPROTO_IPV6
);
1953 static void __net_exit
ip6_tables_net_exit(struct net
*net
)
1955 xt_proto_fini(net
, NFPROTO_IPV6
);
1958 static struct pernet_operations ip6_tables_net_ops
= {
1959 .init
= ip6_tables_net_init
,
1960 .exit
= ip6_tables_net_exit
,
1963 static int __init
ip6_tables_init(void)
1967 ret
= register_pernet_subsys(&ip6_tables_net_ops
);
1971 /* No one else will be downing sem now, so we won't sleep */
1972 ret
= xt_register_targets(ip6t_builtin_tg
, ARRAY_SIZE(ip6t_builtin_tg
));
1975 ret
= xt_register_matches(ip6t_builtin_mt
, ARRAY_SIZE(ip6t_builtin_mt
));
1979 /* Register setsockopt */
1980 ret
= nf_register_sockopt(&ip6t_sockopts
);
1984 pr_info("(C) 2000-2006 Netfilter Core Team\n");
1988 xt_unregister_matches(ip6t_builtin_mt
, ARRAY_SIZE(ip6t_builtin_mt
));
1990 xt_unregister_targets(ip6t_builtin_tg
, ARRAY_SIZE(ip6t_builtin_tg
));
1992 unregister_pernet_subsys(&ip6_tables_net_ops
);
1997 static void __exit
ip6_tables_fini(void)
1999 nf_unregister_sockopt(&ip6t_sockopts
);
2001 xt_unregister_matches(ip6t_builtin_mt
, ARRAY_SIZE(ip6t_builtin_mt
));
2002 xt_unregister_targets(ip6t_builtin_tg
, ARRAY_SIZE(ip6t_builtin_tg
));
2003 unregister_pernet_subsys(&ip6_tables_net_ops
);
2006 EXPORT_SYMBOL(ip6t_register_table
);
2007 EXPORT_SYMBOL(ip6t_unregister_table
);
2008 EXPORT_SYMBOL(ip6t_do_table
);
2010 module_init(ip6_tables_init
);
2011 module_exit(ip6_tables_fini
);