net/ipv4/netfilter/ip_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12 #include <linux/cache.h>
  13 #include <linux/capability.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/kmod.h>
  16 #include <linux/vmalloc.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/module.h>
  19 #include <linux/icmp.h>
  20 #include <net/ip.h>
  21 #include <net/compat.h>
  22 #include <asm/uaccess.h>
  23 #include <linux/mutex.h>
  24 #include <linux/proc_fs.h>
  25 #include <linux/err.h>
  26 #include <linux/cpumask.h>
  27
  28 #include <linux/netfilter/x_tables.h>
  29 #include <linux/netfilter_ipv4/ip_tables.h>
  30 #include <net/netfilter/nf_log.h>
  31 #include "../../netfilter/xt_repldata.h"
  32
  33 MODULE_LICENSE("GPL");
  34 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  35 MODULE_DESCRIPTION("IPv4 packet filter");
  36
  37 /*#define DEBUG_IP_FIREWALL*/
  38 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  39 /*#define DEBUG_IP_FIREWALL_USER*/
  40
  41 #ifdef DEBUG_IP_FIREWALL
  42 #define dprintf(format, args...) pr_info(format , ## args)
  43 #else
  44 #define dprintf(format, args...)
  45 #endif
  46
  47 #ifdef DEBUG_IP_FIREWALL_USER
  48 #define duprintf(format, args...) pr_info(format , ## args)
  49 #else
  50 #define duprintf(format, args...)
  51 #endif
  52
  53 #ifdef CONFIG_NETFILTER_DEBUG
  54 #define IP_NF_ASSERT(x)         WARN_ON(!(x))
  55 #else
  56 #define IP_NF_ASSERT(x)
  57 #endif
  58
  59 #if 0
  60 /* All the better to debug you with... */
  61 #define static
  62 #define inline
  63 #endif
  64
  65 void *ipt_alloc_initial_table(const struct xt_table *info)
  66 {
  67         return xt_alloc_initial_table(ipt, IPT);
  68 }
  69 EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
  70
  71 /*
  72    We keep a set of rules for each CPU, so we can avoid write-locking
  73    them in the softirq when updating the counters and therefore
  74    only need to read-lock in the softirq; doing a write_lock_bh() in user
  75    context stops packets coming through and allows user context to read
  76    the counters or update the rules.
  77
  78    Hence the start of any table is given by get_table() below.  */
  79
  80 /* Returns whether matches rule or not. */
  81 /* Performance critical - called for every packet */
  82 static inline bool
  83 ip_packet_match(const struct iphdr *ip,
  84                 const char *indev,
  85                 const char *outdev,
  86                 const struct ipt_ip *ipinfo,
  87                 int isfrag)
  88 {
  89         unsigned long ret;
  90
  91 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
  92
  93         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
  94                   IPT_INV_SRCIP) ||
  95             FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
  96                   IPT_INV_DSTIP)) {
  97                 dprintf("Source or dest mismatch.\n");
  98
  99                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
 100                         &ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
 101                         ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
 102                 dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
 103                         &ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
 104                         ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
 105                 return false;
 106         }
 107
 108         ret = ifname_compare_aligned(indev, ipinfo->iniface, ipinfo->iniface_mask);
 109
 110         if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
 111                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 112                         indev, ipinfo->iniface,
 113                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
 114                 return false;
 115         }
 116
 117         ret = ifname_compare_aligned(outdev, ipinfo->outiface, ipinfo->outiface_mask);
 118
 119         if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
 120                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 121                         outdev, ipinfo->outiface,
 122                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
 123                 return false;
 124         }
 125
 126         /* Check specific protocol */
 127         if (ipinfo->proto &&
 128             FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
 129                 dprintf("Packet protocol %hi does not match %hi.%s\n",
 130                         ip->protocol, ipinfo->proto,
 131                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
 132                 return false;
 133         }
 134
 135         /* If we have a fragment rule but the packet is not a fragment
 136          * then we return zero */
 137         if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
 138                 dprintf("Fragment rule but not fragment.%s\n",
 139                         ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
 140                 return false;
 141         }
 142
 143         return true;
 144 }
 145
 146 static bool
 147 ip_checkentry(const struct ipt_ip *ip)
 148 {
 149         if (ip->flags & ~IPT_F_MASK) {
 150                 duprintf("Unknown flag bits set: %08X\n",
 151                          ip->flags & ~IPT_F_MASK);
 152                 return false;
 153         }
 154         if (ip->invflags & ~IPT_INV_MASK) {
 155                 duprintf("Unknown invflag bits set: %08X\n",
 156                          ip->invflags & ~IPT_INV_MASK);
 157                 return false;
 158         }
 159         return true;
 160 }
 161
 162 static unsigned int
 163 ipt_error(struct sk_buff *skb, const struct xt_action_param *par)
 164 {
 165         if (net_ratelimit())
 166                 pr_info("error: `%s'\n", (const char *)par->targinfo);
 167
 168         return NF_DROP;
 169 }
 170
 171 /* Performance critical */
 172 static inline struct ipt_entry *
 173 get_entry(const void *base, unsigned int offset)
 174 {
 175         return (struct ipt_entry *)(base + offset);
 176 }
 177
 178 /* All zeroes == unconditional rule. */
 179 /* Mildly perf critical (only if packet tracing is on) */
 180 static inline bool unconditional(const struct ipt_ip *ip)
 181 {
 182         static const struct ipt_ip uncond;
 183
 184         return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 185 #undef FWINV
 186 }
 187
 188 /* for const-correctness */
 189 static inline const struct ipt_entry_target *
 190 ipt_get_target_c(const struct ipt_entry *e)
 191 {
 192         return ipt_get_target((struct ipt_entry *)e);
 193 }
 194
 195 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 196     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 197 static const char *const hooknames[] = {
 198         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 199         [NF_INET_LOCAL_IN]              = "INPUT",
 200         [NF_INET_FORWARD]               = "FORWARD",
 201         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 202         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 203 };
 204
 205 enum nf_ip_trace_comments {
 206         NF_IP_TRACE_COMMENT_RULE,
 207         NF_IP_TRACE_COMMENT_RETURN,
 208         NF_IP_TRACE_COMMENT_POLICY,
 209 };
 210
 211 static const char *const comments[] = {
 212         [NF_IP_TRACE_COMMENT_RULE]      = "rule",
 213         [NF_IP_TRACE_COMMENT_RETURN]    = "return",
 214         [NF_IP_TRACE_COMMENT_POLICY]    = "policy",
 215 };
 216
 217 static struct nf_loginfo trace_loginfo = {
 218         .type = NF_LOG_TYPE_LOG,
 219         .u = {
 220                 .log = {
 221                         .level = 4,
 222                         .logflags = NF_LOG_MASK,
 223                 },
 224         },
 225 };
 226
 227 /* Mildly perf critical (only if packet tracing is on) */
 228 static inline int
 229 get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
 230                       const char *hookname, const char **chainname,
 231                       const char **comment, unsigned int *rulenum)
 232 {
 233         const struct ipt_standard_target *t = (void *)ipt_get_target_c(s);
 234
 235         if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
 236                 /* Head of user chain: ERROR target with chainname */
 237                 *chainname = t->target.data;
 238                 (*rulenum) = 0;
 239         } else if (s == e) {
 240                 (*rulenum)++;
 241
 242                 if (s->target_offset == sizeof(struct ipt_entry) &&
 243                     strcmp(t->target.u.kernel.target->name,
 244                            IPT_STANDARD_TARGET) == 0 &&
 245                    t->verdict < 0 &&
 246                    unconditional(&s->ip)) {
 247                         /* Tail of chains: STANDARD target (return/policy) */
 248                         *comment = *chainname == hookname
 249                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
 250                                 : comments[NF_IP_TRACE_COMMENT_RETURN];
 251                 }
 252                 return 1;
 253         } else
 254                 (*rulenum)++;
 255
 256         return 0;
 257 }
 258
 259 static void trace_packet(const struct sk_buff *skb,
 260                          unsigned int hook,
 261                          const struct net_device *in,
 262                          const struct net_device *out,
 263                          const char *tablename,
 264                          const struct xt_table_info *private,
 265                          const struct ipt_entry *e)
 266 {
 267         const void *table_base;
 268         const struct ipt_entry *root;
 269         const char *hookname, *chainname, *comment;
 270         const struct ipt_entry *iter;
 271         unsigned int rulenum = 0;
 272
 273         table_base = private->entries[smp_processor_id()];
 274         root = get_entry(table_base, private->hook_entry[hook]);
 275
 276         hookname = chainname = hooknames[hook];
 277         comment = comments[NF_IP_TRACE_COMMENT_RULE];
 278
 279         xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
 280                 if (get_chainname_rulenum(iter, e, hookname,
 281                     &chainname, &comment, &rulenum) != 0)
 282                         break;
 283
 284         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
 285                       "TRACE: %s:%s:%s:%u ",
 286                       tablename, chainname, comment, rulenum);
 287 }
 288 #endif
 289
 290 static inline __pure
 291 struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
 292 {
 293         return (void *)entry + entry->next_offset;
 294 }
 295
 296 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 297 unsigned int
 298 ipt_do_table(struct sk_buff *skb,
 299              unsigned int hook,
 300              const struct net_device *in,
 301              const struct net_device *out,
 302              struct xt_table *table)
 303 {
 304         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 305         const struct iphdr *ip;
 306         /* Initializing verdict to NF_DROP keeps gcc happy. */
 307         unsigned int verdict = NF_DROP;
 308         const char *indev, *outdev;
 309         const void *table_base;
 310         struct ipt_entry *e, **jumpstack;
 311         unsigned int *stackptr, origptr, cpu;
 312         const struct xt_table_info *private;
 313         struct xt_action_param acpar;
 314
 315         /* Initialization */
 316         ip = ip_hdr(skb);
 317         indev = in ? in->name : nulldevname;
 318         outdev = out ? out->name : nulldevname;
 319         /* We handle fragments by dealing with the first fragment as
 320          * if it was a normal packet.  All other fragments are treated
 321          * normally, except that they will NEVER match rules that ask
 322          * things we don't know, ie. tcp syn flag or ports).  If the
 323          * rule is also a fragment-specific rule, non-fragments won't
 324          * match it. */
 325         acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 326         acpar.thoff   = ip_hdrlen(skb);
 327         acpar.hotdrop = false;
 328         acpar.in      = in;
 329         acpar.out     = out;
 330         acpar.family  = NFPROTO_IPV4;
 331         acpar.hooknum = hook;
 332
 333         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 334         xt_info_rdlock_bh();
 335         private = table->private;
 336         cpu        = smp_processor_id();
 337         table_base = private->entries[cpu];
 338         jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
 339         stackptr   = per_cpu_ptr(private->stackptr, cpu);
 340         origptr    = *stackptr;
 341
 342         e = get_entry(table_base, private->hook_entry[hook]);
 343
 344         pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
 345                  table->name, hook, origptr,
 346                  get_entry(table_base, private->underflow[hook]));
 347
 348         do {
 349                 const struct ipt_entry_target *t;
 350                 const struct xt_entry_match *ematch;
 351
 352                 IP_NF_ASSERT(e);
 353                 if (!ip_packet_match(ip, indev, outdev,
 354                     &e->ip, acpar.fragoff)) {
 355  no_match:
 356                         e = ipt_next_entry(e);
 357                         continue;
 358                 }
 359
 360                 xt_ematch_foreach(ematch, e) {
 361                         acpar.match     = ematch->u.kernel.match;
 362                         acpar.matchinfo = ematch->data;
 363                         if (!acpar.match->match(skb, &acpar))
 364                                 goto no_match;
 365                 }
 366
 367                 ADD_COUNTER(e->counters, skb->len, 1);
 368
 369                 t = ipt_get_target(e);
 370                 IP_NF_ASSERT(t->u.kernel.target);
 371
 372 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 373     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 374                 /* The packet is traced: log it */
 375                 if (unlikely(skb->nf_trace))
 376                         trace_packet(skb, hook, in, out,
 377                                      table->name, private, e);
 378 #endif
 379                 /* Standard target? */
 380                 if (!t->u.kernel.target->target) {
 381                         int v;
 382
 383                         v = ((struct ipt_standard_target *)t)->verdict;
 384                         if (v < 0) {
 385                                 /* Pop from stack? */
 386                                 if (v != IPT_RETURN) {
 387                                         verdict = (unsigned)(-v) - 1;
 388                                         break;
 389                                 }
 390                                 if (*stackptr == 0) {
 391                                         e = get_entry(table_base,
 392                                             private->underflow[hook]);
 393                                         pr_debug("Underflow (this is normal) "
 394                                                  "to %p\n", e);
 395                                 } else {
 396                                         e = jumpstack[--*stackptr];
 397                                         pr_debug("Pulled %p out from pos %u\n",
 398                                                  e, *stackptr);
 399                                         e = ipt_next_entry(e);
 400                                 }
 401                                 continue;
 402                         }
 403                         if (table_base + v != ipt_next_entry(e) &&
 404                             !(e->ip.flags & IPT_F_GOTO)) {
 405                                 if (*stackptr >= private->stacksize) {
 406                                         verdict = NF_DROP;
 407                                         break;
 408                                 }
 409                                 jumpstack[(*stackptr)++] = e;
 410                                 pr_debug("Pushed %p into pos %u\n",
 411                                          e, *stackptr - 1);
 412                         }
 413
 414                         e = get_entry(table_base, v);
 415                         continue;
 416                 }
 417
 418                 acpar.target   = t->u.kernel.target;
 419                 acpar.targinfo = t->data;
 420
 421                 verdict = t->u.kernel.target->target(skb, &acpar);
 422                 /* Target might have changed stuff. */
 423                 ip = ip_hdr(skb);
 424                 if (verdict == IPT_CONTINUE)
 425                         e = ipt_next_entry(e);
 426                 else
 427                         /* Verdict */
 428                         break;
 429         } while (!acpar.hotdrop);
 430         xt_info_rdunlock_bh();
 431         pr_debug("Exiting %s; resetting sp from %u to %u\n",
 432                  __func__, *stackptr, origptr);
 433         *stackptr = origptr;
 434 #ifdef DEBUG_ALLOW_ALL
 435         return NF_ACCEPT;
 436 #else
 437         if (acpar.hotdrop)
 438                 return NF_DROP;
 439         else return verdict;
 440 #endif
 441 }
 442
 443 /* Figures out from what hook each rule can be called: returns 0 if
 444    there are loops.  Puts hook bitmask in comefrom. */
 445 static int
 446 mark_source_chains(const struct xt_table_info *newinfo,
 447                    unsigned int valid_hooks, void *entry0)
 448 {
 449         unsigned int hook;
 450
 451         /* No recursion; use packet counter to save back ptrs (reset
 452            to 0 as we leave), and comefrom to save source hook bitmask */
 453         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 454                 unsigned int pos = newinfo->hook_entry[hook];
 455                 struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
 456
 457                 if (!(valid_hooks & (1 << hook)))
 458                         continue;
 459
 460                 /* Set initial back pointer. */
 461                 e->counters.pcnt = pos;
 462
 463                 for (;;) {
 464                         const struct ipt_standard_target *t
 465                                 = (void *)ipt_get_target_c(e);
 466                         int visited = e->comefrom & (1 << hook);
 467
 468                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 469                                 pr_err("iptables: loop hook %u pos %u %08X.\n",
 470                                        hook, pos, e->comefrom);
 471                                 return 0;
 472                         }
 473                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 474
 475                         /* Unconditional return/END. */
 476                         if ((e->target_offset == sizeof(struct ipt_entry) &&
 477                              (strcmp(t->target.u.user.name,
 478                                      IPT_STANDARD_TARGET) == 0) &&
 479                              t->verdict < 0 && unconditional(&e->ip)) ||
 480                             visited) {
 481                                 unsigned int oldpos, size;
 482
 483                                 if ((strcmp(t->target.u.user.name,
 484                                             IPT_STANDARD_TARGET) == 0) &&
 485                                     t->verdict < -NF_MAX_VERDICT - 1) {
 486                                         duprintf("mark_source_chains: bad "
 487                                                 "negative verdict (%i)\n",
 488                                                                 t->verdict);
 489                                         return 0;
 490                                 }
 491
 492                                 /* Return: backtrack through the last
 493                                    big jump. */
 494                                 do {
 495                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 496 #ifdef DEBUG_IP_FIREWALL_USER
 497                                         if (e->comefrom
 498                                             & (1 << NF_INET_NUMHOOKS)) {
 499                                                 duprintf("Back unset "
 500                                                          "on hook %u "
 501                                                          "rule %u\n",
 502                                                          hook, pos);
 503                                         }
 504 #endif
 505                                         oldpos = pos;
 506                                         pos = e->counters.pcnt;
 507                                         e->counters.pcnt = 0;
 508
 509                                         /* We're at the start. */
 510                                         if (pos == oldpos)
 511                                                 goto next;
 512
 513                                         e = (struct ipt_entry *)
 514                                                 (entry0 + pos);
 515                                 } while (oldpos == pos + e->next_offset);
 516
 517                                 /* Move along one */
 518                                 size = e->next_offset;
 519                                 e = (struct ipt_entry *)
 520                                         (entry0 + pos + size);
 521                                 e->counters.pcnt = pos;
 522                                 pos += size;
 523                         } else {
 524                                 int newpos = t->verdict;
 525
 526                                 if (strcmp(t->target.u.user.name,
 527                                            IPT_STANDARD_TARGET) == 0 &&
 528                                     newpos >= 0) {
 529                                         if (newpos > newinfo->size -
 530                                                 sizeof(struct ipt_entry)) {
 531                                                 duprintf("mark_source_chains: "
 532                                                         "bad verdict (%i)\n",
 533                                                                 newpos);
 534                                                 return 0;
 535                                         }
 536                                         /* This a jump; chase it. */
 537                                         duprintf("Jump rule %u -> %u\n",
 538                                                  pos, newpos);
 539                                 } else {
 540                                         /* ... this is a fallthru */
 541                                         newpos = pos + e->next_offset;
 542                                 }
 543                                 e = (struct ipt_entry *)
 544                                         (entry0 + newpos);
 545                                 e->counters.pcnt = pos;
 546                                 pos = newpos;
 547                         }
 548                 }
 549                 next:
 550                 duprintf("Finished chain %u\n", hook);
 551         }
 552         return 1;
 553 }
 554
 555 static void cleanup_match(struct ipt_entry_match *m, struct net *net)
 556 {
 557         struct xt_mtdtor_param par;
 558
 559         par.net       = net;
 560         par.match     = m->u.kernel.match;
 561         par.matchinfo = m->data;
 562         par.family    = NFPROTO_IPV4;
 563         if (par.match->destroy != NULL)
 564                 par.match->destroy(&par);
 565         module_put(par.match->me);
 566 }
 567
 568 static int
 569 check_entry(const struct ipt_entry *e, const char *name)
 570 {
 571         const struct ipt_entry_target *t;
 572
 573         if (!ip_checkentry(&e->ip)) {
 574                 duprintf("ip check failed %p %s.\n", e, par->match->name);
 575                 return -EINVAL;
 576         }
 577
 578         if (e->target_offset + sizeof(struct ipt_entry_target) >
 579             e->next_offset)
 580                 return -EINVAL;
 581
 582         t = ipt_get_target_c(e);
 583         if (e->target_offset + t->u.target_size > e->next_offset)
 584                 return -EINVAL;
 585
 586         return 0;
 587 }
 588
 589 static int
 590 check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 591 {
 592         const struct ipt_ip *ip = par->entryinfo;
 593         int ret;
 594
 595         par->match     = m->u.kernel.match;
 596         par->matchinfo = m->data;
 597
 598         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 599               ip->proto, ip->invflags & IPT_INV_PROTO);
 600         if (ret < 0) {
 601                 duprintf("check failed for `%s'.\n", par->match->name);
 602                 return ret;
 603         }
 604         return 0;
 605 }
 606
 607 static int
 608 find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 609 {
 610         struct xt_match *match;
 611         int ret;
 612
 613         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
 614                                       m->u.user.revision);
 615         if (IS_ERR(match)) {
 616                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 617                 return PTR_ERR(match);
 618         }
 619         m->u.kernel.match = match;
 620
 621         ret = check_match(m, par);
 622         if (ret)
 623                 goto err;
 624
 625         return 0;
 626 err:
 627         module_put(m->u.kernel.match->me);
 628         return ret;
 629 }
 630
 631 static int check_target(struct ipt_entry *e, struct net *net, const char *name)
 632 {
 633         struct ipt_entry_target *t = ipt_get_target(e);
 634         struct xt_tgchk_param par = {
 635                 .net       = net,
 636                 .table     = name,
 637                 .entryinfo = e,
 638                 .target    = t->u.kernel.target,
 639                 .targinfo  = t->data,
 640                 .hook_mask = e->comefrom,
 641                 .family    = NFPROTO_IPV4,
 642         };
 643         int ret;
 644
 645         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 646               e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
 647         if (ret < 0) {
 648                 duprintf("check failed for `%s'.\n",
 649                          t->u.kernel.target->name);
 650                 return ret;
 651         }
 652         return 0;
 653 }
 654
 655 static int
 656 find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
 657                  unsigned int size)
 658 {
 659         struct ipt_entry_target *t;
 660         struct xt_target *target;
 661         int ret;
 662         unsigned int j;
 663         struct xt_mtchk_param mtpar;
 664         struct xt_entry_match *ematch;
 665
 666         ret = check_entry(e, name);
 667         if (ret)
 668                 return ret;
 669
 670         j = 0;
 671         mtpar.net       = net;
 672         mtpar.table     = name;
 673         mtpar.entryinfo = &e->ip;
 674         mtpar.hook_mask = e->comefrom;
 675         mtpar.family    = NFPROTO_IPV4;
 676         xt_ematch_foreach(ematch, e) {
 677                 ret = find_check_match(ematch, &mtpar);
 678                 if (ret != 0)
 679                         goto cleanup_matches;
 680                 ++j;
 681         }
 682
 683         t = ipt_get_target(e);
 684         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
 685                                         t->u.user.revision);
 686         if (IS_ERR(target)) {
 687                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 688                 ret = PTR_ERR(target);
 689                 goto cleanup_matches;
 690         }
 691         t->u.kernel.target = target;
 692
 693         ret = check_target(e, net, name);
 694         if (ret)
 695                 goto err;
 696         return 0;
 697  err:
 698         module_put(t->u.kernel.target->me);
 699  cleanup_matches:
 700         xt_ematch_foreach(ematch, e) {
 701                 if (j-- == 0)
 702                         break;
 703                 cleanup_match(ematch, net);
 704         }
 705         return ret;
 706 }
 707
 708 static bool check_underflow(const struct ipt_entry *e)
 709 {
 710         const struct ipt_entry_target *t;
 711         unsigned int verdict;
 712
 713         if (!unconditional(&e->ip))
 714                 return false;
 715         t = ipt_get_target_c(e);
 716         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 717                 return false;
 718         verdict = ((struct ipt_standard_target *)t)->verdict;
 719         verdict = -verdict - 1;
 720         return verdict == NF_DROP || verdict == NF_ACCEPT;
 721 }
 722
 723 static int
 724 check_entry_size_and_hooks(struct ipt_entry *e,
 725                            struct xt_table_info *newinfo,
 726                            const unsigned char *base,
 727                            const unsigned char *limit,
 728                            const unsigned int *hook_entries,
 729                            const unsigned int *underflows,
 730                            unsigned int valid_hooks)
 731 {
 732         unsigned int h;
 733
 734         if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
 735             (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
 736                 duprintf("Bad offset %p\n", e);
 737                 return -EINVAL;
 738         }
 739
 740         if (e->next_offset
 741             < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
 742                 duprintf("checking: element %p size %u\n",
 743                          e, e->next_offset);
 744                 return -EINVAL;
 745         }
 746
 747         /* Check hooks & underflows */
 748         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 749                 if (!(valid_hooks & (1 << h)))
 750                         continue;
 751                 if ((unsigned char *)e - base == hook_entries[h])
 752                         newinfo->hook_entry[h] = hook_entries[h];
 753                 if ((unsigned char *)e - base == underflows[h]) {
 754                         if (!check_underflow(e)) {
 755                                 pr_err("Underflows must be unconditional and "
 756                                        "use the STANDARD target with "
 757                                        "ACCEPT/DROP\n");
 758                                 return -EINVAL;
 759                         }
 760                         newinfo->underflow[h] = underflows[h];
 761                 }
 762         }
 763
 764         /* Clear counters and comefrom */
 765         e->counters = ((struct xt_counters) { 0, 0 });
 766         e->comefrom = 0;
 767         return 0;
 768 }
 769
 770 static void
 771 cleanup_entry(struct ipt_entry *e, struct net *net)
 772 {
 773         struct xt_tgdtor_param par;
 774         struct ipt_entry_target *t;
 775         struct xt_entry_match *ematch;
 776
 777         /* Cleanup all matches */
 778         xt_ematch_foreach(ematch, e)
 779                 cleanup_match(ematch, net);
 780         t = ipt_get_target(e);
 781
 782         par.net      = net;
 783         par.target   = t->u.kernel.target;
 784         par.targinfo = t->data;
 785         par.family   = NFPROTO_IPV4;
 786         if (par.target->destroy != NULL)
 787                 par.target->destroy(&par);
 788         module_put(par.target->me);
 789 }
 790
 791 /* Checks and translates the user-supplied table segment (held in
 792    newinfo) */
 793 static int
 794 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
 795                 const struct ipt_replace *repl)
 796 {
 797         struct ipt_entry *iter;
 798         unsigned int i;
 799         int ret = 0;
 800
 801         newinfo->size = repl->size;
 802         newinfo->number = repl->num_entries;
 803
 804         /* Init all hooks to impossible value. */
 805         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 806                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 807                 newinfo->underflow[i] = 0xFFFFFFFF;
 808         }
 809
 810         duprintf("translate_table: size %u\n", newinfo->size);
 811         i = 0;
 812         /* Walk through entries, checking offsets. */
 813         xt_entry_foreach(iter, entry0, newinfo->size) {
 814                 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
 815                                                  entry0 + repl->size,
 816                                                  repl->hook_entry,
 817                                                  repl->underflow,
 818                                                  repl->valid_hooks);
 819                 if (ret != 0)
 820                         return ret;
 821                 ++i;
 822                 if (strcmp(ipt_get_target(iter)->u.user.name,
 823                     XT_ERROR_TARGET) == 0)
 824                         ++newinfo->stacksize;
 825         }
 826
 827         if (i != repl->num_entries) {
 828                 duprintf("translate_table: %u not %u entries\n",
 829                          i, repl->num_entries);
 830                 return -EINVAL;
 831         }
 832
 833         /* Check hooks all assigned */
 834         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 835                 /* Only hooks which are valid */
 836                 if (!(repl->valid_hooks & (1 << i)))
 837                         continue;
 838                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 839                         duprintf("Invalid hook entry %u %u\n",
 840                                  i, repl->hook_entry[i]);
 841                         return -EINVAL;
 842                 }
 843                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 844                         duprintf("Invalid underflow %u %u\n",
 845                                  i, repl->underflow[i]);
 846                         return -EINVAL;
 847                 }
 848         }
 849
 850         if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
 851                 return -ELOOP;
 852
 853         /* Finally, each sanity check must pass */
 854         i = 0;
 855         xt_entry_foreach(iter, entry0, newinfo->size) {
 856                 ret = find_check_entry(iter, net, repl->name, repl->size);
 857                 if (ret != 0)
 858                         break;
 859                 ++i;
 860         }
 861
 862         if (ret != 0) {
 863                 xt_entry_foreach(iter, entry0, newinfo->size) {
 864                         if (i-- == 0)
 865                                 break;
 866                         cleanup_entry(iter, net);
 867                 }
 868                 return ret;
 869         }
 870
 871         /* And one copy for every other CPU */
 872         for_each_possible_cpu(i) {
 873                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 874                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 875         }
 876
 877         return ret;
 878 }
 879
 880 static void
 881 get_counters(const struct xt_table_info *t,
 882              struct xt_counters counters[])
 883 {
 884         struct ipt_entry *iter;
 885         unsigned int cpu;
 886         unsigned int i;
 887         unsigned int curcpu = get_cpu();
 888
 889         /* Instead of clearing (by a previous call to memset())
 890          * the counters and using adds, we set the counters
 891          * with data used by 'current' CPU.
 892          *
 893          * Bottom half has to be disabled to prevent deadlock
 894          * if new softirq were to run and call ipt_do_table
 895          */
 896         local_bh_disable();
 897         i = 0;
 898         xt_entry_foreach(iter, t->entries[curcpu], t->size) {
 899                 SET_COUNTER(counters[i], iter->counters.bcnt,
 900                             iter->counters.pcnt);
 901                 ++i;
 902         }
 903         local_bh_enable();
 904         /* Processing counters from other cpus, we can let bottom half enabled,
 905          * (preemption is disabled)
 906          */
 907
 908         for_each_possible_cpu(cpu) {
 909                 if (cpu == curcpu)
 910                         continue;
 911                 i = 0;
 912                 local_bh_disable();
 913                 xt_info_wrlock(cpu);
 914                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
 915                         ADD_COUNTER(counters[i], iter->counters.bcnt,
 916                                     iter->counters.pcnt);
 917                         ++i; /* macro does multi eval of i */
 918                 }
 919                 xt_info_wrunlock(cpu);
 920                 local_bh_enable();
 921         }
 922         put_cpu();
 923 }
 924
 925 static struct xt_counters *alloc_counters(const struct xt_table *table)
 926 {
 927         unsigned int countersize;
 928         struct xt_counters *counters;
 929         const struct xt_table_info *private = table->private;
 930
 931         /* We need atomic snapshot of counters: rest doesn't change
 932            (other than comefrom, which userspace doesn't care
 933            about). */
 934         countersize = sizeof(struct xt_counters) * private->number;
 935         counters = vmalloc(countersize);
 936
 937         if (counters == NULL)
 938                 return ERR_PTR(-ENOMEM);
 939
 940         get_counters(private, counters);
 941
 942         return counters;
 943 }
 944
 945 static int
 946 copy_entries_to_user(unsigned int total_size,
 947                      const struct xt_table *table,
 948                      void __user *userptr)
 949 {
 950         unsigned int off, num;
 951         const struct ipt_entry *e;
 952         struct xt_counters *counters;
 953         const struct xt_table_info *private = table->private;
 954         int ret = 0;
 955         const void *loc_cpu_entry;
 956
 957         counters = alloc_counters(table);
 958         if (IS_ERR(counters))
 959                 return PTR_ERR(counters);
 960
 961         /* choose the copy that is on our node/cpu, ...
 962          * This choice is lazy (because current thread is
 963          * allowed to migrate to another cpu)
 964          */
 965         loc_cpu_entry = private->entries[raw_smp_processor_id()];
 966         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 967                 ret = -EFAULT;
 968                 goto free_counters;
 969         }
 970
 971         /* FIXME: use iterator macros --RR */
 972         /* ... then go back and fix counters and names */
 973         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 974                 unsigned int i;
 975                 const struct ipt_entry_match *m;
 976                 const struct ipt_entry_target *t;
 977
 978                 e = (struct ipt_entry *)(loc_cpu_entry + off);
 979                 if (copy_to_user(userptr + off
 980                                  + offsetof(struct ipt_entry, counters),
 981                                  &counters[num],
 982                                  sizeof(counters[num])) != 0) {
 983                         ret = -EFAULT;
 984                         goto free_counters;
 985                 }
 986
 987                 for (i = sizeof(struct ipt_entry);
 988                      i < e->target_offset;
 989                      i += m->u.match_size) {
 990                         m = (void *)e + i;
 991
 992                         if (copy_to_user(userptr + off + i
 993                                          + offsetof(struct ipt_entry_match,
 994                                                     u.user.name),
 995                                          m->u.kernel.match->name,
 996                                          strlen(m->u.kernel.match->name)+1)
 997                             != 0) {
 998                                 ret = -EFAULT;
 999                                 goto free_counters;
1000                         }
1001                 }
1002
1003                 t = ipt_get_target_c(e);
1004                 if (copy_to_user(userptr + off + e->target_offset
1005                                  + offsetof(struct ipt_entry_target,
1006                                             u.user.name),
1007                                  t->u.kernel.target->name,
1008                                  strlen(t->u.kernel.target->name)+1) != 0) {
1009                         ret = -EFAULT;
1010                         goto free_counters;
1011                 }
1012         }
1013
1014  free_counters:
1015         vfree(counters);
1016         return ret;
1017 }
1018
1019 #ifdef CONFIG_COMPAT
1020 static void compat_standard_from_user(void *dst, const void *src)
1021 {
1022         int v = *(compat_int_t *)src;
1023
1024         if (v > 0)
1025                 v += xt_compat_calc_jump(AF_INET, v);
1026         memcpy(dst, &v, sizeof(v));
1027 }
1028
1029 static int compat_standard_to_user(void __user *dst, const void *src)
1030 {
1031         compat_int_t cv = *(int *)src;
1032
1033         if (cv > 0)
1034                 cv -= xt_compat_calc_jump(AF_INET, cv);
1035         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1036 }
1037
1038 static int compat_calc_entry(const struct ipt_entry *e,
1039                              const struct xt_table_info *info,
1040                              const void *base, struct xt_table_info *newinfo)
1041 {
1042         const struct xt_entry_match *ematch;
1043         const struct ipt_entry_target *t;
1044         unsigned int entry_offset;
1045         int off, i, ret;
1046
1047         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1048         entry_offset = (void *)e - base;
1049         xt_ematch_foreach(ematch, e)
1050                 off += xt_compat_match_offset(ematch->u.kernel.match);
1051         t = ipt_get_target_c(e);
1052         off += xt_compat_target_offset(t->u.kernel.target);
1053         newinfo->size -= off;
1054         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1055         if (ret)
1056                 return ret;
1057
1058         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1059                 if (info->hook_entry[i] &&
1060                     (e < (struct ipt_entry *)(base + info->hook_entry[i])))
1061                         newinfo->hook_entry[i] -= off;
1062                 if (info->underflow[i] &&
1063                     (e < (struct ipt_entry *)(base + info->underflow[i])))
1064                         newinfo->underflow[i] -= off;
1065         }
1066         return 0;
1067 }
1068
1069 static int compat_table_info(const struct xt_table_info *info,
1070                              struct xt_table_info *newinfo)
1071 {
1072         struct ipt_entry *iter;
1073         void *loc_cpu_entry;
1074         int ret;
1075
1076         if (!newinfo || !info)
1077                 return -EINVAL;
1078
1079         /* we dont care about newinfo->entries[] */
1080         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1081         newinfo->initial_entries = 0;
1082         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1083         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
1084                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
1085                 if (ret != 0)
1086                         return ret;
1087         }
1088         return 0;
1089 }
1090 #endif
1091
1092 static int get_info(struct net *net, void __user *user,
1093                     const int *len, int compat)
1094 {
1095         char name[IPT_TABLE_MAXNAMELEN];
1096         struct xt_table *t;
1097         int ret;
1098
1099         if (*len != sizeof(struct ipt_getinfo)) {
1100                 duprintf("length %u != %zu\n", *len,
1101                          sizeof(struct ipt_getinfo));
1102                 return -EINVAL;
1103         }
1104
1105         if (copy_from_user(name, user, sizeof(name)) != 0)
1106                 return -EFAULT;
1107
1108         name[IPT_TABLE_MAXNAMELEN-1] = '\0';
1109 #ifdef CONFIG_COMPAT
1110         if (compat)
1111                 xt_compat_lock(AF_INET);
1112 #endif
1113         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1114                                     "iptable_%s", name);
1115         if (t && !IS_ERR(t)) {
1116                 struct ipt_getinfo info;
1117                 const struct xt_table_info *private = t->private;
1118 #ifdef CONFIG_COMPAT
1119                 struct xt_table_info tmp;
1120
1121                 if (compat) {
1122                         ret = compat_table_info(private, &tmp);
1123                         xt_compat_flush_offsets(AF_INET);
1124                         private = &tmp;
1125                 }
1126 #endif
1127                 info.valid_hooks = t->valid_hooks;
1128                 memcpy(info.hook_entry, private->hook_entry,
1129                        sizeof(info.hook_entry));
1130                 memcpy(info.underflow, private->underflow,
1131                        sizeof(info.underflow));
1132                 info.num_entries = private->number;
1133                 info.size = private->size;
1134                 strcpy(info.name, name);
1135
1136                 if (copy_to_user(user, &info, *len) != 0)
1137                         ret = -EFAULT;
1138                 else
1139                         ret = 0;
1140
1141                 xt_table_unlock(t);
1142                 module_put(t->me);
1143         } else
1144                 ret = t ? PTR_ERR(t) : -ENOENT;
1145 #ifdef CONFIG_COMPAT
1146         if (compat)
1147                 xt_compat_unlock(AF_INET);
1148 #endif
1149         return ret;
1150 }
1151
1152 static int
1153 get_entries(struct net *net, struct ipt_get_entries __user *uptr,
1154             const int *len)
1155 {
1156         int ret;
1157         struct ipt_get_entries get;
1158         struct xt_table *t;
1159
1160         if (*len < sizeof(get)) {
1161                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1162                 return -EINVAL;
1163         }
1164         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1165                 return -EFAULT;
1166         if (*len != sizeof(struct ipt_get_entries) + get.size) {
1167                 duprintf("get_entries: %u != %zu\n",
1168                          *len, sizeof(get) + get.size);
1169                 return -EINVAL;
1170         }
1171
1172         t = xt_find_table_lock(net, AF_INET, get.name);
1173         if (t && !IS_ERR(t)) {
1174                 const struct xt_table_info *private = t->private;
1175                 duprintf("t->private->number = %u\n", private->number);
1176                 if (get.size == private->size)
1177                         ret = copy_entries_to_user(private->size,
1178                                                    t, uptr->entrytable);
1179                 else {
1180                         duprintf("get_entries: I've got %u not %u!\n",
1181                                  private->size, get.size);
1182                         ret = -EAGAIN;
1183                 }
1184                 module_put(t->me);
1185                 xt_table_unlock(t);
1186         } else
1187                 ret = t ? PTR_ERR(t) : -ENOENT;
1188
1189         return ret;
1190 }
1191
1192 static int
1193 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1194              struct xt_table_info *newinfo, unsigned int num_counters,
1195              void __user *counters_ptr)
1196 {
1197         int ret;
1198         struct xt_table *t;
1199         struct xt_table_info *oldinfo;
1200         struct xt_counters *counters;
1201         void *loc_cpu_old_entry;
1202         struct ipt_entry *iter;
1203
1204         ret = 0;
1205         counters = vmalloc(num_counters * sizeof(struct xt_counters));
1206         if (!counters) {
1207                 ret = -ENOMEM;
1208                 goto out;
1209         }
1210
1211         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1212                                     "iptable_%s", name);
1213         if (!t || IS_ERR(t)) {
1214                 ret = t ? PTR_ERR(t) : -ENOENT;
1215                 goto free_newinfo_counters_untrans;
1216         }
1217
1218         /* You lied! */
1219         if (valid_hooks != t->valid_hooks) {
1220                 duprintf("Valid hook crap: %08X vs %08X\n",
1221                          valid_hooks, t->valid_hooks);
1222                 ret = -EINVAL;
1223                 goto put_module;
1224         }
1225
1226         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1227         if (!oldinfo)
1228                 goto put_module;
1229
1230         /* Update module usage count based on number of rules */
1231         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1232                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1233         if ((oldinfo->number > oldinfo->initial_entries) ||
1234             (newinfo->number <= oldinfo->initial_entries))
1235                 module_put(t->me);
1236         if ((oldinfo->number > oldinfo->initial_entries) &&
1237             (newinfo->number <= oldinfo->initial_entries))
1238                 module_put(t->me);
1239
1240         /* Get the old counters, and synchronize with replace */
1241         get_counters(oldinfo, counters);
1242
1243         /* Decrease module usage counts and free resource */
1244         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1245         xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
1246                 cleanup_entry(iter, net);
1247
1248         xt_free_table_info(oldinfo);
1249         if (copy_to_user(counters_ptr, counters,
1250                          sizeof(struct xt_counters) * num_counters) != 0)
1251                 ret = -EFAULT;
1252         vfree(counters);
1253         xt_table_unlock(t);
1254         return ret;
1255
1256  put_module:
1257         module_put(t->me);
1258         xt_table_unlock(t);
1259  free_newinfo_counters_untrans:
1260         vfree(counters);
1261  out:
1262         return ret;
1263 }
1264
1265 static int
1266 do_replace(struct net *net, const void __user *user, unsigned int len)
1267 {
1268         int ret;
1269         struct ipt_replace tmp;
1270         struct xt_table_info *newinfo;
1271         void *loc_cpu_entry;
1272         struct ipt_entry *iter;
1273
1274         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1275                 return -EFAULT;
1276
1277         /* overflow check */
1278         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1279                 return -ENOMEM;
1280
1281         newinfo = xt_alloc_table_info(tmp.size);
1282         if (!newinfo)
1283                 return -ENOMEM;
1284
1285         /* choose the copy that is on our node/cpu */
1286         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1287         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1288                            tmp.size) != 0) {
1289                 ret = -EFAULT;
1290                 goto free_newinfo;
1291         }
1292
1293         ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1294         if (ret != 0)
1295                 goto free_newinfo;
1296
1297         duprintf("Translated table\n");
1298
1299         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1300                            tmp.num_counters, tmp.counters);
1301         if (ret)
1302                 goto free_newinfo_untrans;
1303         return 0;
1304
1305  free_newinfo_untrans:
1306         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1307                 cleanup_entry(iter, net);
1308  free_newinfo:
1309         xt_free_table_info(newinfo);
1310         return ret;
1311 }
1312
1313 static int
1314 do_add_counters(struct net *net, const void __user *user,
1315                 unsigned int len, int compat)
1316 {
1317         unsigned int i, curcpu;
1318         struct xt_counters_info tmp;
1319         struct xt_counters *paddc;
1320         unsigned int num_counters;
1321         const char *name;
1322         int size;
1323         void *ptmp;
1324         struct xt_table *t;
1325         const struct xt_table_info *private;
1326         int ret = 0;
1327         void *loc_cpu_entry;
1328         struct ipt_entry *iter;
1329 #ifdef CONFIG_COMPAT
1330         struct compat_xt_counters_info compat_tmp;
1331
1332         if (compat) {
1333                 ptmp = &compat_tmp;
1334                 size = sizeof(struct compat_xt_counters_info);
1335         } else
1336 #endif
1337         {
1338                 ptmp = &tmp;
1339                 size = sizeof(struct xt_counters_info);
1340         }
1341
1342         if (copy_from_user(ptmp, user, size) != 0)
1343                 return -EFAULT;
1344
1345 #ifdef CONFIG_COMPAT
1346         if (compat) {
1347                 num_counters = compat_tmp.num_counters;
1348                 name = compat_tmp.name;
1349         } else
1350 #endif
1351         {
1352                 num_counters = tmp.num_counters;
1353                 name = tmp.name;
1354         }
1355
1356         if (len != size + num_counters * sizeof(struct xt_counters))
1357                 return -EINVAL;
1358
1359         paddc = vmalloc(len - size);
1360         if (!paddc)
1361                 return -ENOMEM;
1362
1363         if (copy_from_user(paddc, user + size, len - size) != 0) {
1364                 ret = -EFAULT;
1365                 goto free;
1366         }
1367
1368         t = xt_find_table_lock(net, AF_INET, name);
1369         if (!t || IS_ERR(t)) {
1370                 ret = t ? PTR_ERR(t) : -ENOENT;
1371                 goto free;
1372         }
1373
1374         local_bh_disable();
1375         private = t->private;
1376         if (private->number != num_counters) {
1377                 ret = -EINVAL;
1378                 goto unlock_up_free;
1379         }
1380
1381         i = 0;
1382         /* Choose the copy that is on our node */
1383         curcpu = smp_processor_id();
1384         loc_cpu_entry = private->entries[curcpu];
1385         xt_info_wrlock(curcpu);
1386         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
1387                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
1388                 ++i;
1389         }
1390         xt_info_wrunlock(curcpu);
1391  unlock_up_free:
1392         local_bh_enable();
1393         xt_table_unlock(t);
1394         module_put(t->me);
1395  free:
1396         vfree(paddc);
1397
1398         return ret;
1399 }
1400
1401 #ifdef CONFIG_COMPAT
1402 struct compat_ipt_replace {
1403         char                    name[IPT_TABLE_MAXNAMELEN];
1404         u32                     valid_hooks;
1405         u32                     num_entries;
1406         u32                     size;
1407         u32                     hook_entry[NF_INET_NUMHOOKS];
1408         u32                     underflow[NF_INET_NUMHOOKS];
1409         u32                     num_counters;
1410         compat_uptr_t           counters;       /* struct ipt_counters * */
1411         struct compat_ipt_entry entries[0];
1412 };
1413
1414 static int
1415 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1416                           unsigned int *size, struct xt_counters *counters,
1417                           unsigned int i)
1418 {
1419         struct ipt_entry_target *t;
1420         struct compat_ipt_entry __user *ce;
1421         u_int16_t target_offset, next_offset;
1422         compat_uint_t origsize;
1423         const struct xt_entry_match *ematch;
1424         int ret = 0;
1425
1426         origsize = *size;
1427         ce = (struct compat_ipt_entry __user *)*dstptr;
1428         if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
1429             copy_to_user(&ce->counters, &counters[i],
1430             sizeof(counters[i])) != 0)
1431                 return -EFAULT;
1432
1433         *dstptr += sizeof(struct compat_ipt_entry);
1434         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1435
1436         xt_ematch_foreach(ematch, e) {
1437                 ret = xt_compat_match_to_user(ematch, dstptr, size);
1438                 if (ret != 0)
1439                         return ret;
1440         }
1441         target_offset = e->target_offset - (origsize - *size);
1442         t = ipt_get_target(e);
1443         ret = xt_compat_target_to_user(t, dstptr, size);
1444         if (ret)
1445                 return ret;
1446         next_offset = e->next_offset - (origsize - *size);
1447         if (put_user(target_offset, &ce->target_offset) != 0 ||
1448             put_user(next_offset, &ce->next_offset) != 0)
1449                 return -EFAULT;
1450         return 0;
1451 }
1452
1453 static int
1454 compat_find_calc_match(struct ipt_entry_match *m,
1455                        const char *name,
1456                        const struct ipt_ip *ip,
1457                        unsigned int hookmask,
1458                        int *size)
1459 {
1460         struct xt_match *match;
1461
1462         match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
1463                                       m->u.user.revision);
1464         if (IS_ERR(match)) {
1465                 duprintf("compat_check_calc_match: `%s' not found\n",
1466                          m->u.user.name);
1467                 return PTR_ERR(match);
1468         }
1469         m->u.kernel.match = match;
1470         *size += xt_compat_match_offset(match);
1471         return 0;
1472 }
1473
1474 static void compat_release_entry(struct compat_ipt_entry *e)
1475 {
1476         struct ipt_entry_target *t;
1477         struct xt_entry_match *ematch;
1478
1479         /* Cleanup all matches */
1480         xt_ematch_foreach(ematch, e)
1481                 module_put(ematch->u.kernel.match->me);
1482         t = compat_ipt_get_target(e);
1483         module_put(t->u.kernel.target->me);
1484 }
1485
1486 static int
1487 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1488                                   struct xt_table_info *newinfo,
1489                                   unsigned int *size,
1490                                   const unsigned char *base,
1491                                   const unsigned char *limit,
1492                                   const unsigned int *hook_entries,
1493                                   const unsigned int *underflows,
1494                                   const char *name)
1495 {
1496         struct xt_entry_match *ematch;
1497         struct ipt_entry_target *t;
1498         struct xt_target *target;
1499         unsigned int entry_offset;
1500         unsigned int j;
1501         int ret, off, h;
1502
1503         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1504         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
1505             (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1506                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1507                 return -EINVAL;
1508         }
1509
1510         if (e->next_offset < sizeof(struct compat_ipt_entry) +
1511                              sizeof(struct compat_xt_entry_target)) {
1512                 duprintf("checking: element %p size %u\n",
1513                          e, e->next_offset);
1514                 return -EINVAL;
1515         }
1516
1517         /* For purposes of check_entry casting the compat entry is fine */
1518         ret = check_entry((struct ipt_entry *)e, name);
1519         if (ret)
1520                 return ret;
1521
1522         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1523         entry_offset = (void *)e - (void *)base;
1524         j = 0;
1525         xt_ematch_foreach(ematch, e) {
1526                 ret = compat_find_calc_match(ematch, name,
1527                                              &e->ip, e->comefrom, &off);
1528                 if (ret != 0)
1529                         goto release_matches;
1530                 ++j;
1531         }
1532
1533         t = compat_ipt_get_target(e);
1534         target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
1535                                         t->u.user.revision);
1536         if (IS_ERR(target)) {
1537                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1538                          t->u.user.name);
1539                 ret = PTR_ERR(target);
1540                 goto release_matches;
1541         }
1542         t->u.kernel.target = target;
1543
1544         off += xt_compat_target_offset(target);
1545         *size += off;
1546         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1547         if (ret)
1548                 goto out;
1549
1550         /* Check hooks & underflows */
1551         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1552                 if ((unsigned char *)e - base == hook_entries[h])
1553                         newinfo->hook_entry[h] = hook_entries[h];
1554                 if ((unsigned char *)e - base == underflows[h])
1555                         newinfo->underflow[h] = underflows[h];
1556         }
1557
1558         /* Clear counters and comefrom */
1559         memset(&e->counters, 0, sizeof(e->counters));
1560         e->comefrom = 0;
1561         return 0;
1562
1563 out:
1564         module_put(t->u.kernel.target->me);
1565 release_matches:
1566         xt_ematch_foreach(ematch, e) {
1567                 if (j-- == 0)
1568                         break;
1569                 module_put(ematch->u.kernel.match->me);
1570         }
1571         return ret;
1572 }
1573
1574 static int
1575 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1576                             unsigned int *size, const char *name,
1577                             struct xt_table_info *newinfo, unsigned char *base)
1578 {
1579         struct ipt_entry_target *t;
1580         struct xt_target *target;
1581         struct ipt_entry *de;
1582         unsigned int origsize;
1583         int ret, h;
1584         struct xt_entry_match *ematch;
1585
1586         ret = 0;
1587         origsize = *size;
1588         de = (struct ipt_entry *)*dstptr;
1589         memcpy(de, e, sizeof(struct ipt_entry));
1590         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1591
1592         *dstptr += sizeof(struct ipt_entry);
1593         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1594
1595         xt_ematch_foreach(ematch, e) {
1596                 ret = xt_compat_match_from_user(ematch, dstptr, size);
1597                 if (ret != 0)
1598                         return ret;
1599         }
1600         de->target_offset = e->target_offset - (origsize - *size);
1601         t = compat_ipt_get_target(e);
1602         target = t->u.kernel.target;
1603         xt_compat_target_from_user(t, dstptr, size);
1604
1605         de->next_offset = e->next_offset - (origsize - *size);
1606         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1607                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1608                         newinfo->hook_entry[h] -= origsize - *size;
1609                 if ((unsigned char *)de - base < newinfo->underflow[h])
1610                         newinfo->underflow[h] -= origsize - *size;
1611         }
1612         return ret;
1613 }
1614
1615 static int
1616 compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
1617 {
1618         struct xt_entry_match *ematch;
1619         struct xt_mtchk_param mtpar;
1620         unsigned int j;
1621         int ret = 0;
1622
1623         j = 0;
1624         mtpar.net       = net;
1625         mtpar.table     = name;
1626         mtpar.entryinfo = &e->ip;
1627         mtpar.hook_mask = e->comefrom;
1628         mtpar.family    = NFPROTO_IPV4;
1629         xt_ematch_foreach(ematch, e) {
1630                 ret = check_match(ematch, &mtpar);
1631                 if (ret != 0)
1632                         goto cleanup_matches;
1633                 ++j;
1634         }
1635
1636         ret = check_target(e, net, name);
1637         if (ret)
1638                 goto cleanup_matches;
1639         return 0;
1640
1641  cleanup_matches:
1642         xt_ematch_foreach(ematch, e) {
1643                 if (j-- == 0)
1644                         break;
1645                 cleanup_match(ematch, net);
1646         }
1647         return ret;
1648 }
1649
1650 static int
1651 translate_compat_table(struct net *net,
1652                        const char *name,
1653                        unsigned int valid_hooks,
1654                        struct xt_table_info **pinfo,
1655                        void **pentry0,
1656                        unsigned int total_size,
1657                        unsigned int number,
1658                        unsigned int *hook_entries,
1659                        unsigned int *underflows)
1660 {
1661         unsigned int i, j;
1662         struct xt_table_info *newinfo, *info;
1663         void *pos, *entry0, *entry1;
1664         struct compat_ipt_entry *iter0;
1665         struct ipt_entry *iter1;
1666         unsigned int size;
1667         int ret;
1668
1669         info = *pinfo;
1670         entry0 = *pentry0;
1671         size = total_size;
1672         info->number = number;
1673
1674         /* Init all hooks to impossible value. */
1675         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1676                 info->hook_entry[i] = 0xFFFFFFFF;
1677                 info->underflow[i] = 0xFFFFFFFF;
1678         }
1679
1680         duprintf("translate_compat_table: size %u\n", info->size);
1681         j = 0;
1682         xt_compat_lock(AF_INET);
1683         /* Walk through entries, checking offsets. */
1684         xt_entry_foreach(iter0, entry0, total_size) {
1685                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1686                                                         entry0,
1687                                                         entry0 + total_size,
1688                                                         hook_entries,
1689                                                         underflows,
1690                                                         name);
1691                 if (ret != 0)
1692                         goto out_unlock;
1693                 ++j;
1694         }
1695
1696         ret = -EINVAL;
1697         if (j != number) {
1698                 duprintf("translate_compat_table: %u not %u entries\n",
1699                          j, number);
1700                 goto out_unlock;
1701         }
1702
1703         /* Check hooks all assigned */
1704         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1705                 /* Only hooks which are valid */
1706                 if (!(valid_hooks & (1 << i)))
1707                         continue;
1708                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1709                         duprintf("Invalid hook entry %u %u\n",
1710                                  i, hook_entries[i]);
1711                         goto out_unlock;
1712                 }
1713                 if (info->underflow[i] == 0xFFFFFFFF) {
1714                         duprintf("Invalid underflow %u %u\n",
1715                                  i, underflows[i]);
1716                         goto out_unlock;
1717                 }
1718         }
1719
1720         ret = -ENOMEM;
1721         newinfo = xt_alloc_table_info(size);
1722         if (!newinfo)
1723                 goto out_unlock;
1724
1725         newinfo->number = number;
1726         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1727                 newinfo->hook_entry[i] = info->hook_entry[i];
1728                 newinfo->underflow[i] = info->underflow[i];
1729         }
1730         entry1 = newinfo->entries[raw_smp_processor_id()];
1731         pos = entry1;
1732         size = total_size;
1733         xt_entry_foreach(iter0, entry0, total_size) {
1734                 ret = compat_copy_entry_from_user(iter0, &pos, &size,
1735                                                   name, newinfo, entry1);
1736                 if (ret != 0)
1737                         break;
1738         }
1739         xt_compat_flush_offsets(AF_INET);
1740         xt_compat_unlock(AF_INET);
1741         if (ret)
1742                 goto free_newinfo;
1743
1744         ret = -ELOOP;
1745         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1746                 goto free_newinfo;
1747
1748         i = 0;
1749         xt_entry_foreach(iter1, entry1, newinfo->size) {
1750                 ret = compat_check_entry(iter1, net, name);
1751                 if (ret != 0)
1752                         break;
1753                 ++i;
1754                 if (strcmp(ipt_get_target(iter1)->u.user.name,
1755                     XT_ERROR_TARGET) == 0)
1756                         ++newinfo->stacksize;
1757         }
1758         if (ret) {
1759                 /*
1760                  * The first i matches need cleanup_entry (calls ->destroy)
1761                  * because they had called ->check already. The other j-i
1762                  * entries need only release.
1763                  */
1764                 int skip = i;
1765                 j -= i;
1766                 xt_entry_foreach(iter0, entry0, newinfo->size) {
1767                         if (skip-- > 0)
1768                                 continue;
1769                         if (j-- == 0)
1770                                 break;
1771                         compat_release_entry(iter0);
1772                 }
1773                 xt_entry_foreach(iter1, entry1, newinfo->size) {
1774                         if (i-- == 0)
1775                                 break;
1776                         cleanup_entry(iter1, net);
1777                 }
1778                 xt_free_table_info(newinfo);
1779                 return ret;
1780         }
1781
1782         /* And one copy for every other CPU */
1783         for_each_possible_cpu(i)
1784                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1785                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1786
1787         *pinfo = newinfo;
1788         *pentry0 = entry1;
1789         xt_free_table_info(info);
1790         return 0;
1791
1792 free_newinfo:
1793         xt_free_table_info(newinfo);
1794 out:
1795         xt_entry_foreach(iter0, entry0, total_size) {
1796                 if (j-- == 0)
1797                         break;
1798                 compat_release_entry(iter0);
1799         }
1800         return ret;
1801 out_unlock:
1802         xt_compat_flush_offsets(AF_INET);
1803         xt_compat_unlock(AF_INET);
1804         goto out;
1805 }
1806
1807 static int
1808 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1809 {
1810         int ret;
1811         struct compat_ipt_replace tmp;
1812         struct xt_table_info *newinfo;
1813         void *loc_cpu_entry;
1814         struct ipt_entry *iter;
1815
1816         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1817                 return -EFAULT;
1818
1819         /* overflow check */
1820         if (tmp.size >= INT_MAX / num_possible_cpus())
1821                 return -ENOMEM;
1822         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1823                 return -ENOMEM;
1824
1825         newinfo = xt_alloc_table_info(tmp.size);
1826         if (!newinfo)
1827                 return -ENOMEM;
1828
1829         /* choose the copy that is on our node/cpu */
1830         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1831         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1832                            tmp.size) != 0) {
1833                 ret = -EFAULT;
1834                 goto free_newinfo;
1835         }
1836
1837         ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
1838                                      &newinfo, &loc_cpu_entry, tmp.size,
1839                                      tmp.num_entries, tmp.hook_entry,
1840                                      tmp.underflow);
1841         if (ret != 0)
1842                 goto free_newinfo;
1843
1844         duprintf("compat_do_replace: Translated table\n");
1845
1846         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1847                            tmp.num_counters, compat_ptr(tmp.counters));
1848         if (ret)
1849                 goto free_newinfo_untrans;
1850         return 0;
1851
1852  free_newinfo_untrans:
1853         xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1854                 cleanup_entry(iter, net);
1855  free_newinfo:
1856         xt_free_table_info(newinfo);
1857         return ret;
1858 }
1859
1860 static int
1861 compat_do_ipt_set_ctl(struct sock *sk,  int cmd, void __user *user,
1862                       unsigned int len)
1863 {
1864         int ret;
1865
1866         if (!capable(CAP_NET_ADMIN))
1867                 return -EPERM;
1868
1869         switch (cmd) {
1870         case IPT_SO_SET_REPLACE:
1871                 ret = compat_do_replace(sock_net(sk), user, len);
1872                 break;
1873
1874         case IPT_SO_SET_ADD_COUNTERS:
1875                 ret = do_add_counters(sock_net(sk), user, len, 1);
1876                 break;
1877
1878         default:
1879                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
1880                 ret = -EINVAL;
1881         }
1882
1883         return ret;
1884 }
1885
1886 struct compat_ipt_get_entries {
1887         char name[IPT_TABLE_MAXNAMELEN];
1888         compat_uint_t size;
1889         struct compat_ipt_entry entrytable[0];
1890 };
1891
1892 static int
1893 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1894                             void __user *userptr)
1895 {
1896         struct xt_counters *counters;
1897         const struct xt_table_info *private = table->private;
1898         void __user *pos;
1899         unsigned int size;
1900         int ret = 0;
1901         const void *loc_cpu_entry;
1902         unsigned int i = 0;
1903         struct ipt_entry *iter;
1904
1905         counters = alloc_counters(table);
1906         if (IS_ERR(counters))
1907                 return PTR_ERR(counters);
1908
1909         /* choose the copy that is on our node/cpu, ...
1910          * This choice is lazy (because current thread is
1911          * allowed to migrate to another cpu)
1912          */
1913         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1914         pos = userptr;
1915         size = total_size;
1916         xt_entry_foreach(iter, loc_cpu_entry, total_size) {
1917                 ret = compat_copy_entry_to_user(iter, &pos,
1918                                                 &size, counters, i++);
1919                 if (ret != 0)
1920                         break;
1921         }
1922
1923         vfree(counters);
1924         return ret;
1925 }
1926
1927 static int
1928 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1929                    int *len)
1930 {
1931         int ret;
1932         struct compat_ipt_get_entries get;
1933         struct xt_table *t;
1934
1935         if (*len < sizeof(get)) {
1936                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1937                 return -EINVAL;
1938         }
1939
1940         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1941                 return -EFAULT;
1942
1943         if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1944                 duprintf("compat_get_entries: %u != %zu\n",
1945                          *len, sizeof(get) + get.size);
1946                 return -EINVAL;
1947         }
1948
1949         xt_compat_lock(AF_INET);
1950         t = xt_find_table_lock(net, AF_INET, get.name);
1951         if (t && !IS_ERR(t)) {
1952                 const struct xt_table_info *private = t->private;
1953                 struct xt_table_info info;
1954                 duprintf("t->private->number = %u\n", private->number);
1955                 ret = compat_table_info(private, &info);
1956                 if (!ret && get.size == info.size) {
1957                         ret = compat_copy_entries_to_user(private->size,
1958                                                           t, uptr->entrytable);
1959                 } else if (!ret) {
1960                         duprintf("compat_get_entries: I've got %u not %u!\n",
1961                                  private->size, get.size);
1962                         ret = -EAGAIN;
1963                 }
1964                 xt_compat_flush_offsets(AF_INET);
1965                 module_put(t->me);
1966                 xt_table_unlock(t);
1967         } else
1968                 ret = t ? PTR_ERR(t) : -ENOENT;
1969
1970         xt_compat_unlock(AF_INET);
1971         return ret;
1972 }
1973
1974 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
1975
1976 static int
1977 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1978 {
1979         int ret;
1980
1981         if (!capable(CAP_NET_ADMIN))
1982                 return -EPERM;
1983
1984         switch (cmd) {
1985         case IPT_SO_GET_INFO:
1986                 ret = get_info(sock_net(sk), user, len, 1);
1987                 break;
1988         case IPT_SO_GET_ENTRIES:
1989                 ret = compat_get_entries(sock_net(sk), user, len);
1990                 break;
1991         default:
1992                 ret = do_ipt_get_ctl(sk, cmd, user, len);
1993         }
1994         return ret;
1995 }
1996 #endif
1997
1998 static int
1999 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
2000 {
2001         int ret;
2002
2003         if (!capable(CAP_NET_ADMIN))
2004                 return -EPERM;
2005
2006         switch (cmd) {
2007         case IPT_SO_SET_REPLACE:
2008                 ret = do_replace(sock_net(sk), user, len);
2009                 break;
2010
2011         case IPT_SO_SET_ADD_COUNTERS:
2012                 ret = do_add_counters(sock_net(sk), user, len, 0);
2013                 break;
2014
2015         default:
2016                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
2017                 ret = -EINVAL;
2018         }
2019
2020         return ret;
2021 }
2022
2023 static int
2024 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2025 {
2026         int ret;
2027
2028         if (!capable(CAP_NET_ADMIN))
2029                 return -EPERM;
2030
2031         switch (cmd) {
2032         case IPT_SO_GET_INFO:
2033                 ret = get_info(sock_net(sk), user, len, 0);
2034                 break;
2035
2036         case IPT_SO_GET_ENTRIES:
2037                 ret = get_entries(sock_net(sk), user, len);
2038                 break;
2039
2040         case IPT_SO_GET_REVISION_MATCH:
2041         case IPT_SO_GET_REVISION_TARGET: {
2042                 struct ipt_get_revision rev;
2043                 int target;
2044
2045                 if (*len != sizeof(rev)) {
2046                         ret = -EINVAL;
2047                         break;
2048                 }
2049                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2050                         ret = -EFAULT;
2051                         break;
2052                 }
2053
2054                 if (cmd == IPT_SO_GET_REVISION_TARGET)
2055                         target = 1;
2056                 else
2057                         target = 0;
2058
2059                 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2060                                                          rev.revision,
2061                                                          target, &ret),
2062                                         "ipt_%s", rev.name);
2063                 break;
2064         }
2065
2066         default:
2067                 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2068                 ret = -EINVAL;
2069         }
2070
2071         return ret;
2072 }
2073
2074 struct xt_table *ipt_register_table(struct net *net,
2075                                     const struct xt_table *table,
2076                                     const struct ipt_replace *repl)
2077 {
2078         int ret;
2079         struct xt_table_info *newinfo;
2080         struct xt_table_info bootstrap = {0};
2081         void *loc_cpu_entry;
2082         struct xt_table *new_table;
2083
2084         newinfo = xt_alloc_table_info(repl->size);
2085         if (!newinfo) {
2086                 ret = -ENOMEM;
2087                 goto out;
2088         }
2089
2090         /* choose the copy on our node/cpu, but dont care about preemption */
2091         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2092         memcpy(loc_cpu_entry, repl->entries, repl->size);
2093
2094         ret = translate_table(net, newinfo, loc_cpu_entry, repl);
2095         if (ret != 0)
2096                 goto out_free;
2097
2098         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2099         if (IS_ERR(new_table)) {
2100                 ret = PTR_ERR(new_table);
2101                 goto out_free;
2102         }
2103
2104         return new_table;
2105
2106 out_free:
2107         xt_free_table_info(newinfo);
2108 out:
2109         return ERR_PTR(ret);
2110 }
2111
2112 void ipt_unregister_table(struct net *net, struct xt_table *table)
2113 {
2114         struct xt_table_info *private;
2115         void *loc_cpu_entry;
2116         struct module *table_owner = table->me;
2117         struct ipt_entry *iter;
2118
2119         private = xt_unregister_table(table);
2120
2121         /* Decrease module usage counts and free resources */
2122         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2123         xt_entry_foreach(iter, loc_cpu_entry, private->size)
2124                 cleanup_entry(iter, net);
2125         if (private->number > private->initial_entries)
2126                 module_put(table_owner);
2127         xt_free_table_info(private);
2128 }
2129
2130 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2131 static inline bool
2132 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2133                      u_int8_t type, u_int8_t code,
2134                      bool invert)
2135 {
2136         return ((test_type == 0xFF) ||
2137                 (type == test_type && code >= min_code && code <= max_code))
2138                 ^ invert;
2139 }
2140
2141 static bool
2142 icmp_match(const struct sk_buff *skb, struct xt_action_param *par)
2143 {
2144         const struct icmphdr *ic;
2145         struct icmphdr _icmph;
2146         const struct ipt_icmp *icmpinfo = par->matchinfo;
2147
2148         /* Must not be a fragment. */
2149         if (par->fragoff != 0)
2150                 return false;
2151
2152         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2153         if (ic == NULL) {
2154                 /* We've been asked to examine this packet, and we
2155                  * can't.  Hence, no choice but to drop.
2156                  */
2157                 duprintf("Dropping evil ICMP tinygram.\n");
2158                 par->hotdrop = true;
2159                 return false;
2160         }
2161
2162         return icmp_type_code_match(icmpinfo->type,
2163                                     icmpinfo->code[0],
2164                                     icmpinfo->code[1],
2165                                     ic->type, ic->code,
2166                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
2167 }
2168
2169 static int icmp_checkentry(const struct xt_mtchk_param *par)
2170 {
2171         const struct ipt_icmp *icmpinfo = par->matchinfo;
2172
2173         /* Must specify no unknown invflags */
2174         return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
2175 }
2176
2177 static struct xt_target ipt_builtin_tg[] __read_mostly = {
2178         {
2179                 .name             = IPT_STANDARD_TARGET,
2180                 .targetsize       = sizeof(int),
2181                 .family           = NFPROTO_IPV4,
2182 #ifdef CONFIG_COMPAT
2183                 .compatsize       = sizeof(compat_int_t),
2184                 .compat_from_user = compat_standard_from_user,
2185                 .compat_to_user   = compat_standard_to_user,
2186 #endif
2187         },
2188         {
2189                 .name             = IPT_ERROR_TARGET,
2190                 .target           = ipt_error,
2191                 .targetsize       = IPT_FUNCTION_MAXNAMELEN,
2192                 .family           = NFPROTO_IPV4,
2193         },
2194 };
2195
2196 static struct nf_sockopt_ops ipt_sockopts = {
2197         .pf             = PF_INET,
2198         .set_optmin     = IPT_BASE_CTL,
2199         .set_optmax     = IPT_SO_SET_MAX+1,
2200         .set            = do_ipt_set_ctl,
2201 #ifdef CONFIG_COMPAT
2202         .compat_set     = compat_do_ipt_set_ctl,
2203 #endif
2204         .get_optmin     = IPT_BASE_CTL,
2205         .get_optmax     = IPT_SO_GET_MAX+1,
2206         .get            = do_ipt_get_ctl,
2207 #ifdef CONFIG_COMPAT
2208         .compat_get     = compat_do_ipt_get_ctl,
2209 #endif
2210         .owner          = THIS_MODULE,
2211 };
2212
2213 static struct xt_match ipt_builtin_mt[] __read_mostly = {
2214         {
2215                 .name       = "icmp",
2216                 .match      = icmp_match,
2217                 .matchsize  = sizeof(struct ipt_icmp),
2218                 .checkentry = icmp_checkentry,
2219                 .proto      = IPPROTO_ICMP,
2220                 .family     = NFPROTO_IPV4,
2221         },
2222 };
2223
2224 static int __net_init ip_tables_net_init(struct net *net)
2225 {
2226         return xt_proto_init(net, NFPROTO_IPV4);
2227 }
2228
2229 static void __net_exit ip_tables_net_exit(struct net *net)
2230 {
2231         xt_proto_fini(net, NFPROTO_IPV4);
2232 }
2233
2234 static struct pernet_operations ip_tables_net_ops = {
2235         .init = ip_tables_net_init,
2236         .exit = ip_tables_net_exit,
2237 };
2238
2239 static int __init ip_tables_init(void)
2240 {
2241         int ret;
2242
2243         ret = register_pernet_subsys(&ip_tables_net_ops);
2244         if (ret < 0)
2245                 goto err1;
2246
2247         /* Noone else will be downing sem now, so we won't sleep */
2248         ret = xt_register_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2249         if (ret < 0)
2250                 goto err2;
2251         ret = xt_register_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2252         if (ret < 0)
2253                 goto err4;
2254
2255         /* Register setsockopt */
2256         ret = nf_register_sockopt(&ipt_sockopts);
2257         if (ret < 0)
2258                 goto err5;
2259
2260         pr_info("(C) 2000-2006 Netfilter Core Team\n");
2261         return 0;
2262
2263 err5:
2264         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2265 err4:
2266         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2267 err2:
2268         unregister_pernet_subsys(&ip_tables_net_ops);
2269 err1:
2270         return ret;
2271 }
2272
2273 static void __exit ip_tables_fini(void)
2274 {
2275         nf_unregister_sockopt(&ipt_sockopts);
2276
2277         xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
2278         xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
2279         unregister_pernet_subsys(&ip_tables_net_ops);
2280 }
2281
2282 EXPORT_SYMBOL(ipt_register_table);
2283 EXPORT_SYMBOL(ipt_unregister_table);
2284 EXPORT_SYMBOL(ipt_do_table);
2285 module_init(ip_tables_init);
2286 module_exit(ip_tables_fini);