SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/ipv4/netfilter/ip_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #include <linux/cache.h>
  12 #include <linux/capability.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/kmod.h>
  15 #include <linux/vmalloc.h>
  16 #include <linux/netdevice.h>
  17 #include <linux/module.h>
  18 #include <linux/icmp.h>
  19 #include <net/ip.h>
  20 #include <net/compat.h>
  21 #include <asm/uaccess.h>
  22 #include <linux/mutex.h>
  23 #include <linux/proc_fs.h>
  24 #include <linux/err.h>
  25 #include <linux/cpumask.h>
  26
  27 #include <linux/netfilter/x_tables.h>
  28 #include <linux/netfilter_ipv4/ip_tables.h>
  29 #include <net/netfilter/nf_log.h>
  30
  31 MODULE_LICENSE("GPL");
  32 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  33 MODULE_DESCRIPTION("IPv4 packet filter");
  34
  35 /*#define DEBUG_IP_FIREWALL*/
  36 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  37 /*#define DEBUG_IP_FIREWALL_USER*/
  38
  39 #ifdef DEBUG_IP_FIREWALL
  40 #define dprintf(format, args...)  printk(format , ## args)
  41 #else
  42 #define dprintf(format, args...)
  43 #endif
  44
  45 #ifdef DEBUG_IP_FIREWALL_USER
  46 #define duprintf(format, args...) printk(format , ## args)
  47 #else
  48 #define duprintf(format, args...)
  49 #endif
  50
  51 #ifdef CONFIG_NETFILTER_DEBUG
  52 #define IP_NF_ASSERT(x)                                         \
  53 do {                                                            \
  54         if (!(x))                                               \
  55                 printk("IP_NF_ASSERT: %s:%s:%u\n",              \
  56                        __func__, __FILE__, __LINE__);   \
  57 } while(0)
  58 #else
  59 #define IP_NF_ASSERT(x)
  60 #endif
  61
  62 #if 0
  63 /* All the better to debug you with... */
  64 #define static
  65 #define inline
  66 #endif
  67
  68 /*
  69    We keep a set of rules for each CPU, so we can avoid write-locking
  70    them in the softirq when updating the counters and therefore
  71    only need to read-lock in the softirq; doing a write_lock_bh() in user
  72    context stops packets coming through and allows user context to read
  73    the counters or update the rules.
  74
  75    Hence the start of any table is given by get_table() below.  */
  76
  77 /* Returns whether matches rule or not. */
  78 /* Performance critical - called for every packet */
  79 static inline bool
  80 ip_packet_match(const struct iphdr *ip,
  81                 const char *indev,
  82                 const char *outdev,
  83                 const struct ipt_ip *ipinfo,
  84                 int isfrag)
  85 {
  86         unsigned long ret;
  87
  88 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
  89
  90         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
  91                   IPT_INV_SRCIP)
  92             || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
  93                      IPT_INV_DSTIP)) {
  94                 dprintf("Source or dest mismatch.\n");
  95
  96                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
  97                         &ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
  98                         ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
  99                 dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
 100                         &ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
 101                         ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
 102                 return false;
 103         }
 104
 105         ret = ifname_compare_aligned(indev, ipinfo->iniface, ipinfo->iniface_mask);
 106
 107         if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
 108                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 109                         indev, ipinfo->iniface,
 110                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
 111                 return false;
 112         }
 113
 114         ret = ifname_compare_aligned(outdev, ipinfo->outiface, ipinfo->outiface_mask);
 115
 116         if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
 117                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 118                         outdev, ipinfo->outiface,
 119                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
 120                 return false;
 121         }
 122
 123         /* Check specific protocol */
 124         if (ipinfo->proto
 125             && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
 126                 dprintf("Packet protocol %hi does not match %hi.%s\n",
 127                         ip->protocol, ipinfo->proto,
 128                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
 129                 return false;
 130         }
 131
 132         /* If we have a fragment rule but the packet is not a fragment
 133          * then we return zero */
 134         if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
 135                 dprintf("Fragment rule but not fragment.%s\n",
 136                         ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
 137                 return false;
 138         }
 139
 140         return true;
 141 }
 142
 143 static bool
 144 ip_checkentry(const struct ipt_ip *ip)
 145 {
 146         if (ip->flags & ~IPT_F_MASK) {
 147                 duprintf("Unknown flag bits set: %08X\n",
 148                          ip->flags & ~IPT_F_MASK);
 149                 return false;
 150         }
 151         if (ip->invflags & ~IPT_INV_MASK) {
 152                 duprintf("Unknown invflag bits set: %08X\n",
 153                          ip->invflags & ~IPT_INV_MASK);
 154                 return false;
 155         }
 156         return true;
 157 }
 158
 159 static unsigned int
 160 ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
 161 {
 162         if (net_ratelimit())
 163                 printk("ip_tables: error: `%s'\n",
 164                        (const char *)par->targinfo);
 165
 166         return NF_DROP;
 167 }
 168
 169 /* Performance critical - called for every packet */
 170 static inline bool
 171 do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
 172          struct xt_match_param *par)
 173 {
 174         par->match     = m->u.kernel.match;
 175         par->matchinfo = m->data;
 176
 177         /* Stop iteration if it doesn't match */
 178         if (!m->u.kernel.match->match(skb, par))
 179                 return true;
 180         else
 181                 return false;
 182 }
 183
 184 /* Performance critical */
 185 static inline struct ipt_entry *
 186 get_entry(void *base, unsigned int offset)
 187 {
 188         return (struct ipt_entry *)(base + offset);
 189 }
 190
 191 /* All zeroes == unconditional rule. */
 192 /* Mildly perf critical (only if packet tracing is on) */
 193 static inline int
 194 unconditional(const struct ipt_ip *ip)
 195 {
 196         unsigned int i;
 197
 198         for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++)
 199                 if (((__u32 *)ip)[i])
 200                         return 0;
 201
 202         return 1;
 203 #undef FWINV
 204 }
 205
 206 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 207     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 208 static const char *const hooknames[] = {
 209         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 210         [NF_INET_LOCAL_IN]              = "INPUT",
 211         [NF_INET_FORWARD]               = "FORWARD",
 212         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 213         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 214 };
 215
 216 enum nf_ip_trace_comments {
 217         NF_IP_TRACE_COMMENT_RULE,
 218         NF_IP_TRACE_COMMENT_RETURN,
 219         NF_IP_TRACE_COMMENT_POLICY,
 220 };
 221
 222 static const char *const comments[] = {
 223         [NF_IP_TRACE_COMMENT_RULE]      = "rule",
 224         [NF_IP_TRACE_COMMENT_RETURN]    = "return",
 225         [NF_IP_TRACE_COMMENT_POLICY]    = "policy",
 226 };
 227
 228 static struct nf_loginfo trace_loginfo = {
 229         .type = NF_LOG_TYPE_LOG,
 230         .u = {
 231                 .log = {
 232                         .level = 4,
 233                         .logflags = NF_LOG_MASK,
 234                 },
 235         },
 236 };
 237
 238 /* Mildly perf critical (only if packet tracing is on) */
 239 static inline int
 240 get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
 241                       char *hookname, char **chainname,
 242                       char **comment, unsigned int *rulenum)
 243 {
 244         struct ipt_standard_target *t = (void *)ipt_get_target(s);
 245
 246         if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
 247                 /* Head of user chain: ERROR target with chainname */
 248                 *chainname = t->target.data;
 249                 (*rulenum) = 0;
 250         } else if (s == e) {
 251                 (*rulenum)++;
 252
 253                 if (s->target_offset == sizeof(struct ipt_entry)
 254                    && strcmp(t->target.u.kernel.target->name,
 255                              IPT_STANDARD_TARGET) == 0
 256                    && t->verdict < 0
 257                    && unconditional(&s->ip)) {
 258                         /* Tail of chains: STANDARD target (return/policy) */
 259                         *comment = *chainname == hookname
 260                                 ? (char *)comments[NF_IP_TRACE_COMMENT_POLICY]
 261                                 : (char *)comments[NF_IP_TRACE_COMMENT_RETURN];
 262                 }
 263                 return 1;
 264         } else
 265                 (*rulenum)++;
 266
 267         return 0;
 268 }
 269
 270 static void trace_packet(struct sk_buff *skb,
 271                          unsigned int hook,
 272                          const struct net_device *in,
 273                          const struct net_device *out,
 274                          const char *tablename,
 275                          struct xt_table_info *private,
 276                          struct ipt_entry *e)
 277 {
 278         void *table_base;
 279         const struct ipt_entry *root;
 280         char *hookname, *chainname, *comment;
 281         unsigned int rulenum = 0;
 282
 283         table_base = (void *)private->entries[smp_processor_id()];
 284         root = get_entry(table_base, private->hook_entry[hook]);
 285
 286         hookname = chainname = (char *)hooknames[hook];
 287         comment = (char *)comments[NF_IP_TRACE_COMMENT_RULE];
 288
 289         IPT_ENTRY_ITERATE(root,
 290                           private->size - private->hook_entry[hook],
 291                           get_chainname_rulenum,
 292                           e, hookname, &chainname, &comment, &rulenum);
 293
 294         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
 295                       "TRACE: %s:%s:%s:%u ",
 296                       tablename, chainname, comment, rulenum);
 297 }
 298 #endif
 299
 300 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 301 unsigned int
 302 ipt_do_table(struct sk_buff *skb,
 303              unsigned int hook,
 304              const struct net_device *in,
 305              const struct net_device *out,
 306              struct xt_table *table)
 307 {
 308         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 309         const struct iphdr *ip;
 310         u_int16_t datalen;
 311         bool hotdrop = false;
 312         /* Initializing verdict to NF_DROP keeps gcc happy. */
 313         unsigned int verdict = NF_DROP;
 314         const char *indev, *outdev;
 315         void *table_base;
 316         struct ipt_entry *e, *back;
 317         struct xt_table_info *private;
 318         struct xt_match_param mtpar;
 319         struct xt_target_param tgpar;
 320
 321         /* Initialization */
 322         ip = ip_hdr(skb);
 323         datalen = skb->len - ip->ihl * 4;
 324         indev = in ? in->name : nulldevname;
 325         outdev = out ? out->name : nulldevname;
 326         /* We handle fragments by dealing with the first fragment as
 327          * if it was a normal packet.  All other fragments are treated
 328          * normally, except that they will NEVER match rules that ask
 329          * things we don't know, ie. tcp syn flag or ports).  If the
 330          * rule is also a fragment-specific rule, non-fragments won't
 331          * match it. */
 332         mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 333         mtpar.thoff   = ip_hdrlen(skb);
 334         mtpar.hotdrop = &hotdrop;
 335         mtpar.in      = tgpar.in  = in;
 336         mtpar.out     = tgpar.out = out;
 337         mtpar.family  = tgpar.family = NFPROTO_IPV4;
 338         tgpar.hooknum = hook;
 339
 340         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 341         xt_info_rdlock_bh();
 342         private = table->private;
 343         table_base = private->entries[smp_processor_id()];
 344
 345         e = get_entry(table_base, private->hook_entry[hook]);
 346
 347         /* For return from builtin chain */
 348         back = get_entry(table_base, private->underflow[hook]);
 349
 350         do {
 351                 IP_NF_ASSERT(e);
 352                 IP_NF_ASSERT(back);
 353                 if (ip_packet_match(ip, indev, outdev,
 354                     &e->ip, mtpar.fragoff)) {
 355                         struct ipt_entry_target *t;
 356
 357                         if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
 358                                 goto no_match;
 359
 360                         ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
 361
 362                         t = ipt_get_target(e);
 363                         IP_NF_ASSERT(t->u.kernel.target);
 364
 365 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 366     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 367                         /* The packet is traced: log it */
 368                         if (unlikely(skb->nf_trace))
 369                                 trace_packet(skb, hook, in, out,
 370                                              table->name, private, e);
 371 #endif
 372                         /* Standard target? */
 373                         if (!t->u.kernel.target->target) {
 374                                 int v;
 375
 376                                 v = ((struct ipt_standard_target *)t)->verdict;
 377                                 if (v < 0) {
 378                                         /* Pop from stack? */
 379                                         if (v != IPT_RETURN) {
 380                                                 verdict = (unsigned)(-v) - 1;
 381                                                 break;
 382                                         }
 383                                         e = back;
 384                                         back = get_entry(table_base,
 385                                                          back->comefrom);
 386                                         continue;
 387                                 }
 388                                 if (table_base + v != (void *)e + e->next_offset
 389                                     && !(e->ip.flags & IPT_F_GOTO)) {
 390                                         /* Save old back ptr in next entry */
 391                                         struct ipt_entry *next
 392                                                 = (void *)e + e->next_offset;
 393                                         next->comefrom
 394                                                 = (void *)back - table_base;
 395                                         /* set back pointer to next entry */
 396                                         back = next;
 397                                 }
 398
 399                                 e = get_entry(table_base, v);
 400                         } else {
 401                                 /* Targets which reenter must return
 402                                    abs. verdicts */
 403                                 tgpar.target   = t->u.kernel.target;
 404                                 tgpar.targinfo = t->data;
 405 #ifdef CONFIG_NETFILTER_DEBUG
 406                                 ((struct ipt_entry *)table_base)->comefrom
 407                                         = 0xeeeeeeec;
 408 #endif
 409                                 verdict = t->u.kernel.target->target(skb,
 410                                                                      &tgpar);
 411 #ifdef CONFIG_NETFILTER_DEBUG
 412                                 if (((struct ipt_entry *)table_base)->comefrom
 413                                     != 0xeeeeeeec
 414                                     && verdict == IPT_CONTINUE) {
 415                                         printk("Target %s reentered!\n",
 416                                                t->u.kernel.target->name);
 417                                         verdict = NF_DROP;
 418                                 }
 419                                 ((struct ipt_entry *)table_base)->comefrom
 420                                         = 0x57acc001;
 421 #endif
 422                                 /* Target might have changed stuff. */
 423                                 ip = ip_hdr(skb);
 424                                 datalen = skb->len - ip->ihl * 4;
 425
 426                                 if (verdict == IPT_CONTINUE)
 427                                         e = (void *)e + e->next_offset;
 428                                 else
 429                                         /* Verdict */
 430                                         break;
 431                         }
 432                 } else {
 433
 434                 no_match:
 435                         e = (void *)e + e->next_offset;
 436                 }
 437         } while (!hotdrop);
 438         xt_info_rdunlock_bh();
 439
 440 #ifdef DEBUG_ALLOW_ALL
 441         return NF_ACCEPT;
 442 #else
 443         if (hotdrop)
 444                 return NF_DROP;
 445         else return verdict;
 446 #endif
 447 }
 448
 449 /* Figures out from what hook each rule can be called: returns 0 if
 450    there are loops.  Puts hook bitmask in comefrom. */
 451 static int
 452 mark_source_chains(struct xt_table_info *newinfo,
 453                    unsigned int valid_hooks, void *entry0)
 454 {
 455         unsigned int hook;
 456
 457         /* No recursion; use packet counter to save back ptrs (reset
 458            to 0 as we leave), and comefrom to save source hook bitmask */
 459         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 460                 unsigned int pos = newinfo->hook_entry[hook];
 461                 struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
 462
 463                 if (!(valid_hooks & (1 << hook)))
 464                         continue;
 465
 466                 /* Set initial back pointer. */
 467                 e->counters.pcnt = pos;
 468
 469                 for (;;) {
 470                         struct ipt_standard_target *t
 471                                 = (void *)ipt_get_target(e);
 472                         int visited = e->comefrom & (1 << hook);
 473
 474                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 475                                 printk("iptables: loop hook %u pos %u %08X.\n",
 476                                        hook, pos, e->comefrom);
 477                                 return 0;
 478                         }
 479                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 480
 481                         /* Unconditional return/END. */
 482                         if ((e->target_offset == sizeof(struct ipt_entry)
 483                             && (strcmp(t->target.u.user.name,
 484                                        IPT_STANDARD_TARGET) == 0)
 485                             && t->verdict < 0
 486                             && unconditional(&e->ip)) || visited) {
 487                                 unsigned int oldpos, size;
 488
 489                                 if ((strcmp(t->target.u.user.name,
 490                                             IPT_STANDARD_TARGET) == 0) &&
 491                                     t->verdict < -NF_MAX_VERDICT - 1) {
 492                                         duprintf("mark_source_chains: bad "
 493                                                 "negative verdict (%i)\n",
 494                                                                 t->verdict);
 495                                         return 0;
 496                                 }
 497
 498                                 /* Return: backtrack through the last
 499                                    big jump. */
 500                                 do {
 501                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 502 #ifdef DEBUG_IP_FIREWALL_USER
 503                                         if (e->comefrom
 504                                             & (1 << NF_INET_NUMHOOKS)) {
 505                                                 duprintf("Back unset "
 506                                                          "on hook %u "
 507                                                          "rule %u\n",
 508                                                          hook, pos);
 509                                         }
 510 #endif
 511                                         oldpos = pos;
 512                                         pos = e->counters.pcnt;
 513                                         e->counters.pcnt = 0;
 514
 515                                         /* We're at the start. */
 516                                         if (pos == oldpos)
 517                                                 goto next;
 518
 519                                         e = (struct ipt_entry *)
 520                                                 (entry0 + pos);
 521                                 } while (oldpos == pos + e->next_offset);
 522
 523                                 /* Move along one */
 524                                 size = e->next_offset;
 525                                 e = (struct ipt_entry *)
 526                                         (entry0 + pos + size);
 527                                 e->counters.pcnt = pos;
 528                                 pos += size;
 529                         } else {
 530                                 int newpos = t->verdict;
 531
 532                                 if (strcmp(t->target.u.user.name,
 533                                            IPT_STANDARD_TARGET) == 0
 534                                     && newpos >= 0) {
 535                                         if (newpos > newinfo->size -
 536                                                 sizeof(struct ipt_entry)) {
 537                                                 duprintf("mark_source_chains: "
 538                                                         "bad verdict (%i)\n",
 539                                                                 newpos);
 540                                                 return 0;
 541                                         }
 542                                         /* This a jump; chase it. */
 543                                         duprintf("Jump rule %u -> %u\n",
 544                                                  pos, newpos);
 545                                 } else {
 546                                         /* ... this is a fallthru */
 547                                         newpos = pos + e->next_offset;
 548                                 }
 549                                 e = (struct ipt_entry *)
 550                                         (entry0 + newpos);
 551                                 e->counters.pcnt = pos;
 552                                 pos = newpos;
 553                         }
 554                 }
 555                 next:
 556                 duprintf("Finished chain %u\n", hook);
 557         }
 558         return 1;
 559 }
 560
 561 static int
 562 cleanup_match(struct ipt_entry_match *m, unsigned int *i)
 563 {
 564         struct xt_mtdtor_param par;
 565
 566         if (i && (*i)-- == 0)
 567                 return 1;
 568
 569         par.match     = m->u.kernel.match;
 570         par.matchinfo = m->data;
 571         par.family    = NFPROTO_IPV4;
 572         if (par.match->destroy != NULL)
 573                 par.match->destroy(&par);
 574         module_put(par.match->me);
 575         return 0;
 576 }
 577
 578 static int
 579 check_entry(struct ipt_entry *e, const char *name)
 580 {
 581         struct ipt_entry_target *t;
 582
 583         if (!ip_checkentry(&e->ip)) {
 584                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 585                 return -EINVAL;
 586         }
 587
 588         if (e->target_offset + sizeof(struct ipt_entry_target) >
 589             e->next_offset)
 590                 return -EINVAL;
 591
 592         t = ipt_get_target(e);
 593         if (e->target_offset + t->u.target_size > e->next_offset)
 594                 return -EINVAL;
 595
 596         return 0;
 597 }
 598
 599 static int
 600 check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
 601             unsigned int *i)
 602 {
 603         const struct ipt_ip *ip = par->entryinfo;
 604         int ret;
 605
 606         par->match     = m->u.kernel.match;
 607         par->matchinfo = m->data;
 608
 609         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 610               ip->proto, ip->invflags & IPT_INV_PROTO);
 611         if (ret < 0) {
 612                 duprintf("ip_tables: check failed for `%s'.\n",
 613                          par.match->name);
 614                 return ret;
 615         }
 616         ++*i;
 617         return 0;
 618 }
 619
 620 static int
 621 find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
 622                  unsigned int *i)
 623 {
 624         struct xt_match *match;
 625         int ret;
 626
 627         match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
 628                                                       m->u.user.revision),
 629                                         "ipt_%s", m->u.user.name);
 630         if (IS_ERR(match) || !match) {
 631                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 632                 return match ? PTR_ERR(match) : -ENOENT;
 633         }
 634         m->u.kernel.match = match;
 635
 636         ret = check_match(m, par, i);
 637         if (ret)
 638                 goto err;
 639
 640         return 0;
 641 err:
 642         module_put(m->u.kernel.match->me);
 643         return ret;
 644 }
 645
 646 static int check_target(struct ipt_entry *e, const char *name)
 647 {
 648         struct ipt_entry_target *t = ipt_get_target(e);
 649         struct xt_tgchk_param par = {
 650                 .table     = name,
 651                 .entryinfo = e,
 652                 .target    = t->u.kernel.target,
 653                 .targinfo  = t->data,
 654                 .hook_mask = e->comefrom,
 655                 .family    = NFPROTO_IPV4,
 656         };
 657         int ret;
 658
 659         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 660               e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
 661         if (ret < 0) {
 662                 duprintf("ip_tables: check failed for `%s'.\n",
 663                          t->u.kernel.target->name);
 664                 return ret;
 665         }
 666         return 0;
 667 }
 668
 669 static int
 670 find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
 671                  unsigned int *i)
 672 {
 673         struct ipt_entry_target *t;
 674         struct xt_target *target;
 675         int ret;
 676         unsigned int j;
 677         struct xt_mtchk_param mtpar;
 678
 679         ret = check_entry(e, name);
 680         if (ret)
 681                 return ret;
 682
 683         j = 0;
 684         mtpar.table     = name;
 685         mtpar.entryinfo = &e->ip;
 686         mtpar.hook_mask = e->comefrom;
 687         mtpar.family    = NFPROTO_IPV4;
 688         ret = IPT_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
 689         if (ret != 0)
 690                 goto cleanup_matches;
 691
 692         t = ipt_get_target(e);
 693         target = try_then_request_module(xt_find_target(AF_INET,
 694                                                         t->u.user.name,
 695                                                         t->u.user.revision),
 696                                          "ipt_%s", t->u.user.name);
 697         if (IS_ERR(target) || !target) {
 698                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 699                 ret = target ? PTR_ERR(target) : -ENOENT;
 700                 goto cleanup_matches;
 701         }
 702         t->u.kernel.target = target;
 703
 704         ret = check_target(e, name);
 705         if (ret)
 706                 goto err;
 707
 708         (*i)++;
 709         return 0;
 710  err:
 711         module_put(t->u.kernel.target->me);
 712  cleanup_matches:
 713         IPT_MATCH_ITERATE(e, cleanup_match, &j);
 714         return ret;
 715 }
 716
 717 static int
 718 check_entry_size_and_hooks(struct ipt_entry *e,
 719                            struct xt_table_info *newinfo,
 720                            unsigned char *base,
 721                            unsigned char *limit,
 722                            const unsigned int *hook_entries,
 723                            const unsigned int *underflows,
 724                            unsigned int *i)
 725 {
 726         unsigned int h;
 727
 728         if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
 729             || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
 730                 duprintf("Bad offset %p\n", e);
 731                 return -EINVAL;
 732         }
 733
 734         if (e->next_offset
 735             < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
 736                 duprintf("checking: element %p size %u\n",
 737                          e, e->next_offset);
 738                 return -EINVAL;
 739         }
 740
 741         /* Check hooks & underflows */
 742         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 743                 if ((unsigned char *)e - base == hook_entries[h])
 744                         newinfo->hook_entry[h] = hook_entries[h];
 745                 if ((unsigned char *)e - base == underflows[h])
 746                         newinfo->underflow[h] = underflows[h];
 747         }
 748
 749         /* FIXME: underflows must be unconditional, standard verdicts
 750            < 0 (not IPT_RETURN). --RR */
 751
 752         /* Clear counters and comefrom */
 753         e->counters = ((struct xt_counters) { 0, 0 });
 754         e->comefrom = 0;
 755
 756         (*i)++;
 757         return 0;
 758 }
 759
 760 static int
 761 cleanup_entry(struct ipt_entry *e, unsigned int *i)
 762 {
 763         struct xt_tgdtor_param par;
 764         struct ipt_entry_target *t;
 765
 766         if (i && (*i)-- == 0)
 767                 return 1;
 768
 769         /* Cleanup all matches */
 770         IPT_MATCH_ITERATE(e, cleanup_match, NULL);
 771         t = ipt_get_target(e);
 772
 773         par.target   = t->u.kernel.target;
 774         par.targinfo = t->data;
 775         par.family   = NFPROTO_IPV4;
 776         if (par.target->destroy != NULL)
 777                 par.target->destroy(&par);
 778         module_put(par.target->me);
 779         return 0;
 780 }
 781
 782 /* Checks and translates the user-supplied table segment (held in
 783    newinfo) */
 784 static int
 785 translate_table(const char *name,
 786                 unsigned int valid_hooks,
 787                 struct xt_table_info *newinfo,
 788                 void *entry0,
 789                 unsigned int size,
 790                 unsigned int number,
 791                 const unsigned int *hook_entries,
 792                 const unsigned int *underflows)
 793 {
 794         unsigned int i;
 795         int ret;
 796
 797         newinfo->size = size;
 798         newinfo->number = number;
 799
 800         /* Init all hooks to impossible value. */
 801         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 802                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 803                 newinfo->underflow[i] = 0xFFFFFFFF;
 804         }
 805
 806         duprintf("translate_table: size %u\n", newinfo->size);
 807         i = 0;
 808         /* Walk through entries, checking offsets. */
 809         ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 810                                 check_entry_size_and_hooks,
 811                                 newinfo,
 812                                 entry0,
 813                                 entry0 + size,
 814                                 hook_entries, underflows, &i);
 815         if (ret != 0)
 816                 return ret;
 817
 818         if (i != number) {
 819                 duprintf("translate_table: %u not %u entries\n",
 820                          i, number);
 821                 return -EINVAL;
 822         }
 823
 824         /* Check hooks all assigned */
 825         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 826                 /* Only hooks which are valid */
 827                 if (!(valid_hooks & (1 << i)))
 828                         continue;
 829                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 830                         duprintf("Invalid hook entry %u %u\n",
 831                                  i, hook_entries[i]);
 832                         return -EINVAL;
 833                 }
 834                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 835                         duprintf("Invalid underflow %u %u\n",
 836                                  i, underflows[i]);
 837                         return -EINVAL;
 838                 }
 839         }
 840
 841         if (!mark_source_chains(newinfo, valid_hooks, entry0))
 842                 return -ELOOP;
 843
 844         /* Finally, each sanity check must pass */
 845         i = 0;
 846         ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 847                                 find_check_entry, name, size, &i);
 848
 849         if (ret != 0) {
 850                 IPT_ENTRY_ITERATE(entry0, newinfo->size,
 851                                 cleanup_entry, &i);
 852                 return ret;
 853         }
 854
 855         /* And one copy for every other CPU */
 856         for_each_possible_cpu(i) {
 857                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 858                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 859         }
 860
 861         return ret;
 862 }
 863
 864 /* Gets counters. */
 865 static inline int
 866 add_entry_to_counter(const struct ipt_entry *e,
 867                      struct xt_counters total[],
 868                      unsigned int *i)
 869 {
 870         ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 871
 872         (*i)++;
 873         return 0;
 874 }
 875
 876 static inline int
 877 set_entry_to_counter(const struct ipt_entry *e,
 878                      struct ipt_counters total[],
 879                      unsigned int *i)
 880 {
 881         SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 882
 883         (*i)++;
 884         return 0;
 885 }
 886
 887 static void
 888 get_counters(const struct xt_table_info *t,
 889              struct xt_counters counters[])
 890 {
 891         unsigned int cpu;
 892         unsigned int i;
 893         unsigned int curcpu;
 894
 895         /* Instead of clearing (by a previous call to memset())
 896          * the counters and using adds, we set the counters
 897          * with data used by 'current' CPU.
 898          *
 899          * Bottom half has to be disabled to prevent deadlock
 900          * if new softirq were to run and call ipt_do_table
 901          */
 902         local_bh_disable();
 903         curcpu = smp_processor_id();
 904
 905         i = 0;
 906         IPT_ENTRY_ITERATE(t->entries[curcpu],
 907                           t->size,
 908                           set_entry_to_counter,
 909                           counters,
 910                           &i);
 911
 912         for_each_possible_cpu(cpu) {
 913                 if (cpu == curcpu)
 914                         continue;
 915                 i = 0;
 916                 xt_info_wrlock(cpu);
 917                 IPT_ENTRY_ITERATE(t->entries[cpu],
 918                                   t->size,
 919                                   add_entry_to_counter,
 920                                   counters,
 921                                   &i);
 922                 xt_info_wrunlock(cpu);
 923         }
 924         local_bh_enable();
 925 }
 926
 927 static struct xt_counters * alloc_counters(struct xt_table *table)
 928 {
 929         unsigned int countersize;
 930         struct xt_counters *counters;
 931         struct xt_table_info *private = table->private;
 932
 933         /* We need atomic snapshot of counters: rest doesn't change
 934            (other than comefrom, which userspace doesn't care
 935            about). */
 936         countersize = sizeof(struct xt_counters) * private->number;
 937         counters = vmalloc_node(countersize, numa_node_id());
 938
 939         if (counters == NULL)
 940                 return ERR_PTR(-ENOMEM);
 941
 942         get_counters(private, counters);
 943
 944         return counters;
 945 }
 946
 947 static int
 948 copy_entries_to_user(unsigned int total_size,
 949                      struct xt_table *table,
 950                      void __user *userptr)
 951 {
 952         unsigned int off, num;
 953         struct ipt_entry *e;
 954         struct xt_counters *counters;
 955         const struct xt_table_info *private = table->private;
 956         int ret = 0;
 957         const void *loc_cpu_entry;
 958
 959         counters = alloc_counters(table);
 960         if (IS_ERR(counters))
 961                 return PTR_ERR(counters);
 962
 963         /* choose the copy that is on our node/cpu, ...
 964          * This choice is lazy (because current thread is
 965          * allowed to migrate to another cpu)
 966          */
 967         loc_cpu_entry = private->entries[raw_smp_processor_id()];
 968         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 969                 ret = -EFAULT;
 970                 goto free_counters;
 971         }
 972
 973         /* FIXME: use iterator macros --RR */
 974         /* ... then go back and fix counters and names */
 975         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 976                 unsigned int i;
 977                 const struct ipt_entry_match *m;
 978                 const struct ipt_entry_target *t;
 979
 980                 e = (struct ipt_entry *)(loc_cpu_entry + off);
 981                 if (copy_to_user(userptr + off
 982                                  + offsetof(struct ipt_entry, counters),
 983                                  &counters[num],
 984                                  sizeof(counters[num])) != 0) {
 985                         ret = -EFAULT;
 986                         goto free_counters;
 987                 }
 988
 989                 for (i = sizeof(struct ipt_entry);
 990                      i < e->target_offset;
 991                      i += m->u.match_size) {
 992                         m = (void *)e + i;
 993
 994                         if (copy_to_user(userptr + off + i
 995                                          + offsetof(struct ipt_entry_match,
 996                                                     u.user.name),
 997                                          m->u.kernel.match->name,
 998                                          strlen(m->u.kernel.match->name)+1)
 999                             != 0) {
1000                                 ret = -EFAULT;
1001                                 goto free_counters;
1002                         }
1003                 }
1004
1005                 t = ipt_get_target(e);
1006                 if (copy_to_user(userptr + off + e->target_offset
1007                                  + offsetof(struct ipt_entry_target,
1008                                             u.user.name),
1009                                  t->u.kernel.target->name,
1010                                  strlen(t->u.kernel.target->name)+1) != 0) {
1011                         ret = -EFAULT;
1012                         goto free_counters;
1013                 }
1014         }
1015
1016  free_counters:
1017         vfree(counters);
1018         return ret;
1019 }
1020
1021 #ifdef CONFIG_COMPAT
1022 static void compat_standard_from_user(void *dst, void *src)
1023 {
1024         int v = *(compat_int_t *)src;
1025
1026         if (v > 0)
1027                 v += xt_compat_calc_jump(AF_INET, v);
1028         memcpy(dst, &v, sizeof(v));
1029 }
1030
1031 static int compat_standard_to_user(void __user *dst, void *src)
1032 {
1033         compat_int_t cv = *(int *)src;
1034
1035         if (cv > 0)
1036                 cv -= xt_compat_calc_jump(AF_INET, cv);
1037         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1038 }
1039
1040 static inline int
1041 compat_calc_match(struct ipt_entry_match *m, int *size)
1042 {
1043         *size += xt_compat_match_offset(m->u.kernel.match);
1044         return 0;
1045 }
1046
1047 static int compat_calc_entry(struct ipt_entry *e,
1048                              const struct xt_table_info *info,
1049                              void *base, struct xt_table_info *newinfo)
1050 {
1051         struct ipt_entry_target *t;
1052         unsigned int entry_offset;
1053         int off, i, ret;
1054
1055         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1056         entry_offset = (void *)e - base;
1057         IPT_MATCH_ITERATE(e, compat_calc_match, &off);
1058         t = ipt_get_target(e);
1059         off += xt_compat_target_offset(t->u.kernel.target);
1060         newinfo->size -= off;
1061         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1062         if (ret)
1063                 return ret;
1064
1065         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1066                 if (info->hook_entry[i] &&
1067                     (e < (struct ipt_entry *)(base + info->hook_entry[i])))
1068                         newinfo->hook_entry[i] -= off;
1069                 if (info->underflow[i] &&
1070                     (e < (struct ipt_entry *)(base + info->underflow[i])))
1071                         newinfo->underflow[i] -= off;
1072         }
1073         return 0;
1074 }
1075
1076 static int compat_table_info(const struct xt_table_info *info,
1077                              struct xt_table_info *newinfo)
1078 {
1079         void *loc_cpu_entry;
1080
1081         if (!newinfo || !info)
1082                 return -EINVAL;
1083
1084         /* we dont care about newinfo->entries[] */
1085         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1086         newinfo->initial_entries = 0;
1087         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1088         return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
1089                                  compat_calc_entry, info, loc_cpu_entry,
1090                                  newinfo);
1091 }
1092 #endif
1093
1094 static int get_info(struct net *net, void __user *user, int *len, int compat)
1095 {
1096         char name[IPT_TABLE_MAXNAMELEN];
1097         struct xt_table *t;
1098         int ret;
1099
1100         if (*len != sizeof(struct ipt_getinfo)) {
1101                 duprintf("length %u != %zu\n", *len,
1102                          sizeof(struct ipt_getinfo));
1103                 return -EINVAL;
1104         }
1105
1106         if (copy_from_user(name, user, sizeof(name)) != 0)
1107                 return -EFAULT;
1108
1109         name[IPT_TABLE_MAXNAMELEN-1] = '\0';
1110 #ifdef CONFIG_COMPAT
1111         if (compat)
1112                 xt_compat_lock(AF_INET);
1113 #endif
1114         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1115                                     "iptable_%s", name);
1116         if (t && !IS_ERR(t)) {
1117                 struct ipt_getinfo info;
1118                 const struct xt_table_info *private = t->private;
1119
1120 #ifdef CONFIG_COMPAT
1121                 if (compat) {
1122                         struct xt_table_info tmp;
1123                         ret = compat_table_info(private, &tmp);
1124                         xt_compat_flush_offsets(AF_INET);
1125                         private = &tmp;
1126                 }
1127 #endif
1128                 info.valid_hooks = t->valid_hooks;
1129                 memcpy(info.hook_entry, private->hook_entry,
1130                        sizeof(info.hook_entry));
1131                 memcpy(info.underflow, private->underflow,
1132                        sizeof(info.underflow));
1133                 info.num_entries = private->number;
1134                 info.size = private->size;
1135                 strcpy(info.name, name);
1136
1137                 if (copy_to_user(user, &info, *len) != 0)
1138                         ret = -EFAULT;
1139                 else
1140                         ret = 0;
1141
1142                 xt_table_unlock(t);
1143                 module_put(t->me);
1144         } else
1145                 ret = t ? PTR_ERR(t) : -ENOENT;
1146 #ifdef CONFIG_COMPAT
1147         if (compat)
1148                 xt_compat_unlock(AF_INET);
1149 #endif
1150         return ret;
1151 }
1152
1153 static int
1154 get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
1155 {
1156         int ret;
1157         struct ipt_get_entries get;
1158         struct xt_table *t;
1159
1160         if (*len < sizeof(get)) {
1161                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1162                 return -EINVAL;
1163         }
1164         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1165                 return -EFAULT;
1166         if (*len != sizeof(struct ipt_get_entries) + get.size) {
1167                 duprintf("get_entries: %u != %zu\n",
1168                          *len, sizeof(get) + get.size);
1169                 return -EINVAL;
1170         }
1171
1172         t = xt_find_table_lock(net, AF_INET, get.name);
1173         if (t && !IS_ERR(t)) {
1174                 const struct xt_table_info *private = t->private;
1175                 duprintf("t->private->number = %u\n", private->number);
1176                 if (get.size == private->size)
1177                         ret = copy_entries_to_user(private->size,
1178                                                    t, uptr->entrytable);
1179                 else {
1180                         duprintf("get_entries: I've got %u not %u!\n",
1181                                  private->size, get.size);
1182                         ret = -EAGAIN;
1183                 }
1184                 module_put(t->me);
1185                 xt_table_unlock(t);
1186         } else
1187                 ret = t ? PTR_ERR(t) : -ENOENT;
1188
1189         return ret;
1190 }
1191
1192 static int
1193 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1194              struct xt_table_info *newinfo, unsigned int num_counters,
1195              void __user *counters_ptr)
1196 {
1197         int ret;
1198         struct xt_table *t;
1199         struct xt_table_info *oldinfo;
1200         struct xt_counters *counters;
1201         void *loc_cpu_old_entry;
1202
1203         ret = 0;
1204         counters = vmalloc(num_counters * sizeof(struct xt_counters));
1205         if (!counters) {
1206                 ret = -ENOMEM;
1207                 goto out;
1208         }
1209
1210         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1211                                     "iptable_%s", name);
1212         if (!t || IS_ERR(t)) {
1213                 ret = t ? PTR_ERR(t) : -ENOENT;
1214                 goto free_newinfo_counters_untrans;
1215         }
1216
1217         /* You lied! */
1218         if (valid_hooks != t->valid_hooks) {
1219                 duprintf("Valid hook crap: %08X vs %08X\n",
1220                          valid_hooks, t->valid_hooks);
1221                 ret = -EINVAL;
1222                 goto put_module;
1223         }
1224
1225         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1226         if (!oldinfo)
1227                 goto put_module;
1228
1229         /* Update module usage count based on number of rules */
1230         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1231                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1232         if ((oldinfo->number > oldinfo->initial_entries) ||
1233             (newinfo->number <= oldinfo->initial_entries))
1234                 module_put(t->me);
1235         if ((oldinfo->number > oldinfo->initial_entries) &&
1236             (newinfo->number <= oldinfo->initial_entries))
1237                 module_put(t->me);
1238
1239         /* Get the old counters, and synchronize with replace */
1240         get_counters(oldinfo, counters);
1241
1242         /* Decrease module usage counts and free resource */
1243         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1244         IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
1245                           NULL);
1246         xt_free_table_info(oldinfo);
1247         if (copy_to_user(counters_ptr, counters,
1248                          sizeof(struct xt_counters) * num_counters) != 0)
1249                 ret = -EFAULT;
1250         vfree(counters);
1251         xt_table_unlock(t);
1252         return ret;
1253
1254  put_module:
1255         module_put(t->me);
1256         xt_table_unlock(t);
1257  free_newinfo_counters_untrans:
1258         vfree(counters);
1259  out:
1260         return ret;
1261 }
1262
1263 static int
1264 do_replace(struct net *net, void __user *user, unsigned int len)
1265 {
1266         int ret;
1267         struct ipt_replace tmp;
1268         struct xt_table_info *newinfo;
1269         void *loc_cpu_entry;
1270
1271         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1272                 return -EFAULT;
1273
1274         /* overflow check */
1275         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1276                 return -ENOMEM;
1277
1278         newinfo = xt_alloc_table_info(tmp.size);
1279         if (!newinfo)
1280                 return -ENOMEM;
1281
1282         /* choose the copy that is on our node/cpu */
1283         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1284         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1285                            tmp.size) != 0) {
1286                 ret = -EFAULT;
1287                 goto free_newinfo;
1288         }
1289
1290         ret = translate_table(tmp.name, tmp.valid_hooks,
1291                               newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1292                               tmp.hook_entry, tmp.underflow);
1293         if (ret != 0)
1294                 goto free_newinfo;
1295
1296         duprintf("ip_tables: Translated table\n");
1297
1298         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1299                            tmp.num_counters, tmp.counters);
1300         if (ret)
1301                 goto free_newinfo_untrans;
1302         return 0;
1303
1304  free_newinfo_untrans:
1305         IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
1306  free_newinfo:
1307         xt_free_table_info(newinfo);
1308         return ret;
1309 }
1310
1311 /* We're lazy, and add to the first CPU; overflow works its fey magic
1312  * and everything is OK. */
1313 static int
1314 add_counter_to_entry(struct ipt_entry *e,
1315                      const struct xt_counters addme[],
1316                      unsigned int *i)
1317 {
1318         ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1319
1320         (*i)++;
1321         return 0;
1322 }
1323
1324 static int
1325 do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
1326 {
1327         unsigned int i, curcpu;
1328         struct xt_counters_info tmp;
1329         struct xt_counters *paddc;
1330         unsigned int num_counters;
1331         const char *name;
1332         int size;
1333         void *ptmp;
1334         struct xt_table *t;
1335         const struct xt_table_info *private;
1336         int ret = 0;
1337         void *loc_cpu_entry;
1338 #ifdef CONFIG_COMPAT
1339         struct compat_xt_counters_info compat_tmp;
1340
1341         if (compat) {
1342                 ptmp = &compat_tmp;
1343                 size = sizeof(struct compat_xt_counters_info);
1344         } else
1345 #endif
1346         {
1347                 ptmp = &tmp;
1348                 size = sizeof(struct xt_counters_info);
1349         }
1350
1351         if (copy_from_user(ptmp, user, size) != 0)
1352                 return -EFAULT;
1353
1354 #ifdef CONFIG_COMPAT
1355         if (compat) {
1356                 num_counters = compat_tmp.num_counters;
1357                 name = compat_tmp.name;
1358         } else
1359 #endif
1360         {
1361                 num_counters = tmp.num_counters;
1362                 name = tmp.name;
1363         }
1364
1365         if (len != size + num_counters * sizeof(struct xt_counters))
1366                 return -EINVAL;
1367
1368         paddc = vmalloc_node(len - size, numa_node_id());
1369         if (!paddc)
1370                 return -ENOMEM;
1371
1372         if (copy_from_user(paddc, user + size, len - size) != 0) {
1373                 ret = -EFAULT;
1374                 goto free;
1375         }
1376
1377         t = xt_find_table_lock(net, AF_INET, name);
1378         if (!t || IS_ERR(t)) {
1379                 ret = t ? PTR_ERR(t) : -ENOENT;
1380                 goto free;
1381         }
1382
1383         local_bh_disable();
1384         private = t->private;
1385         if (private->number != num_counters) {
1386                 ret = -EINVAL;
1387                 goto unlock_up_free;
1388         }
1389
1390         i = 0;
1391         /* Choose the copy that is on our node */
1392         curcpu = smp_processor_id();
1393         loc_cpu_entry = private->entries[curcpu];
1394         xt_info_wrlock(curcpu);
1395         IPT_ENTRY_ITERATE(loc_cpu_entry,
1396                           private->size,
1397                           add_counter_to_entry,
1398                           paddc,
1399                           &i);
1400         xt_info_wrunlock(curcpu);
1401  unlock_up_free:
1402         local_bh_enable();
1403         xt_table_unlock(t);
1404         module_put(t->me);
1405  free:
1406         vfree(paddc);
1407
1408         return ret;
1409 }
1410
1411 #ifdef CONFIG_COMPAT
1412 struct compat_ipt_replace {
1413         char                    name[IPT_TABLE_MAXNAMELEN];
1414         u32                     valid_hooks;
1415         u32                     num_entries;
1416         u32                     size;
1417         u32                     hook_entry[NF_INET_NUMHOOKS];
1418         u32                     underflow[NF_INET_NUMHOOKS];
1419         u32                     num_counters;
1420         compat_uptr_t           counters;       /* struct ipt_counters * */
1421         struct compat_ipt_entry entries[0];
1422 };
1423
1424 static int
1425 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1426                           unsigned int *size, struct xt_counters *counters,
1427                           unsigned int *i)
1428 {
1429         struct ipt_entry_target *t;
1430         struct compat_ipt_entry __user *ce;
1431         u_int16_t target_offset, next_offset;
1432         compat_uint_t origsize;
1433         int ret;
1434
1435         ret = -EFAULT;
1436         origsize = *size;
1437         ce = (struct compat_ipt_entry __user *)*dstptr;
1438         if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
1439                 goto out;
1440
1441         if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
1442                 goto out;
1443
1444         *dstptr += sizeof(struct compat_ipt_entry);
1445         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1446
1447         ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
1448         target_offset = e->target_offset - (origsize - *size);
1449         if (ret)
1450                 goto out;
1451         t = ipt_get_target(e);
1452         ret = xt_compat_target_to_user(t, dstptr, size);
1453         if (ret)
1454                 goto out;
1455         ret = -EFAULT;
1456         next_offset = e->next_offset - (origsize - *size);
1457         if (put_user(target_offset, &ce->target_offset))
1458                 goto out;
1459         if (put_user(next_offset, &ce->next_offset))
1460                 goto out;
1461
1462         (*i)++;
1463         return 0;
1464 out:
1465         return ret;
1466 }
1467
1468 static int
1469 compat_find_calc_match(struct ipt_entry_match *m,
1470                        const char *name,
1471                        const struct ipt_ip *ip,
1472                        unsigned int hookmask,
1473                        int *size, unsigned int *i)
1474 {
1475         struct xt_match *match;
1476
1477         match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
1478                                                       m->u.user.revision),
1479                                         "ipt_%s", m->u.user.name);
1480         if (IS_ERR(match) || !match) {
1481                 duprintf("compat_check_calc_match: `%s' not found\n",
1482                          m->u.user.name);
1483                 return match ? PTR_ERR(match) : -ENOENT;
1484         }
1485         m->u.kernel.match = match;
1486         *size += xt_compat_match_offset(match);
1487
1488         (*i)++;
1489         return 0;
1490 }
1491
1492 static int
1493 compat_release_match(struct ipt_entry_match *m, unsigned int *i)
1494 {
1495         if (i && (*i)-- == 0)
1496                 return 1;
1497
1498         module_put(m->u.kernel.match->me);
1499         return 0;
1500 }
1501
1502 static int
1503 compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
1504 {
1505         struct ipt_entry_target *t;
1506
1507         if (i && (*i)-- == 0)
1508                 return 1;
1509
1510         /* Cleanup all matches */
1511         COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL);
1512         t = compat_ipt_get_target(e);
1513         module_put(t->u.kernel.target->me);
1514         return 0;
1515 }
1516
1517 static int
1518 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1519                                   struct xt_table_info *newinfo,
1520                                   unsigned int *size,
1521                                   unsigned char *base,
1522                                   unsigned char *limit,
1523                                   unsigned int *hook_entries,
1524                                   unsigned int *underflows,
1525                                   unsigned int *i,
1526                                   const char *name)
1527 {
1528         struct ipt_entry_target *t;
1529         struct xt_target *target;
1530         unsigned int entry_offset;
1531         unsigned int j;
1532         int ret, off, h;
1533
1534         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1535         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
1536             || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1537                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1538                 return -EINVAL;
1539         }
1540
1541         if (e->next_offset < sizeof(struct compat_ipt_entry) +
1542                              sizeof(struct compat_xt_entry_target)) {
1543                 duprintf("checking: element %p size %u\n",
1544                          e, e->next_offset);
1545                 return -EINVAL;
1546         }
1547
1548         /* For purposes of check_entry casting the compat entry is fine */
1549         ret = check_entry((struct ipt_entry *)e, name);
1550         if (ret)
1551                 return ret;
1552
1553         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1554         entry_offset = (void *)e - (void *)base;
1555         j = 0;
1556         ret = COMPAT_IPT_MATCH_ITERATE(e, compat_find_calc_match, name,
1557                                        &e->ip, e->comefrom, &off, &j);
1558         if (ret != 0)
1559                 goto release_matches;
1560
1561         t = compat_ipt_get_target(e);
1562         target = try_then_request_module(xt_find_target(AF_INET,
1563                                                         t->u.user.name,
1564                                                         t->u.user.revision),
1565                                          "ipt_%s", t->u.user.name);
1566         if (IS_ERR(target) || !target) {
1567                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1568                          t->u.user.name);
1569                 ret = target ? PTR_ERR(target) : -ENOENT;
1570                 goto release_matches;
1571         }
1572         t->u.kernel.target = target;
1573
1574         off += xt_compat_target_offset(target);
1575         *size += off;
1576         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1577         if (ret)
1578                 goto out;
1579
1580         /* Check hooks & underflows */
1581         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1582                 if ((unsigned char *)e - base == hook_entries[h])
1583                         newinfo->hook_entry[h] = hook_entries[h];
1584                 if ((unsigned char *)e - base == underflows[h])
1585                         newinfo->underflow[h] = underflows[h];
1586         }
1587
1588         /* Clear counters and comefrom */
1589         memset(&e->counters, 0, sizeof(e->counters));
1590         e->comefrom = 0;
1591
1592         (*i)++;
1593         return 0;
1594
1595 out:
1596         module_put(t->u.kernel.target->me);
1597 release_matches:
1598         IPT_MATCH_ITERATE(e, compat_release_match, &j);
1599         return ret;
1600 }
1601
1602 static int
1603 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1604                             unsigned int *size, const char *name,
1605                             struct xt_table_info *newinfo, unsigned char *base)
1606 {
1607         struct ipt_entry_target *t;
1608         struct xt_target *target;
1609         struct ipt_entry *de;
1610         unsigned int origsize;
1611         int ret, h;
1612
1613         ret = 0;
1614         origsize = *size;
1615         de = (struct ipt_entry *)*dstptr;
1616         memcpy(de, e, sizeof(struct ipt_entry));
1617         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1618
1619         *dstptr += sizeof(struct ipt_entry);
1620         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1621
1622         ret = COMPAT_IPT_MATCH_ITERATE(e, xt_compat_match_from_user,
1623                                        dstptr, size);
1624         if (ret)
1625                 return ret;
1626         de->target_offset = e->target_offset - (origsize - *size);
1627         t = compat_ipt_get_target(e);
1628         target = t->u.kernel.target;
1629         xt_compat_target_from_user(t, dstptr, size);
1630
1631         de->next_offset = e->next_offset - (origsize - *size);
1632         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1633                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1634                         newinfo->hook_entry[h] -= origsize - *size;
1635                 if ((unsigned char *)de - base < newinfo->underflow[h])
1636                         newinfo->underflow[h] -= origsize - *size;
1637         }
1638         return ret;
1639 }
1640
1641 static int
1642 compat_check_entry(struct ipt_entry *e, const char *name,
1643                                      unsigned int *i)
1644 {
1645         struct xt_mtchk_param mtpar;
1646         unsigned int j;
1647         int ret;
1648
1649         j = 0;
1650         mtpar.table     = name;
1651         mtpar.entryinfo = &e->ip;
1652         mtpar.hook_mask = e->comefrom;
1653         mtpar.family    = NFPROTO_IPV4;
1654         ret = IPT_MATCH_ITERATE(e, check_match, &mtpar, &j);
1655         if (ret)
1656                 goto cleanup_matches;
1657
1658         ret = check_target(e, name);
1659         if (ret)
1660                 goto cleanup_matches;
1661
1662         (*i)++;
1663         return 0;
1664
1665  cleanup_matches:
1666         IPT_MATCH_ITERATE(e, cleanup_match, &j);
1667         return ret;
1668 }
1669
1670 static int
1671 translate_compat_table(const char *name,
1672                        unsigned int valid_hooks,
1673                        struct xt_table_info **pinfo,
1674                        void **pentry0,
1675                        unsigned int total_size,
1676                        unsigned int number,
1677                        unsigned int *hook_entries,
1678                        unsigned int *underflows)
1679 {
1680         unsigned int i, j;
1681         struct xt_table_info *newinfo, *info;
1682         void *pos, *entry0, *entry1;
1683         unsigned int size;
1684         int ret;
1685
1686         info = *pinfo;
1687         entry0 = *pentry0;
1688         size = total_size;
1689         info->number = number;
1690
1691         /* Init all hooks to impossible value. */
1692         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1693                 info->hook_entry[i] = 0xFFFFFFFF;
1694                 info->underflow[i] = 0xFFFFFFFF;
1695         }
1696
1697         duprintf("translate_compat_table: size %u\n", info->size);
1698         j = 0;
1699         xt_compat_lock(AF_INET);
1700         /* Walk through entries, checking offsets. */
1701         ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
1702                                        check_compat_entry_size_and_hooks,
1703                                        info, &size, entry0,
1704                                        entry0 + total_size,
1705                                        hook_entries, underflows, &j, name);
1706         if (ret != 0)
1707                 goto out_unlock;
1708
1709         ret = -EINVAL;
1710         if (j != number) {
1711                 duprintf("translate_compat_table: %u not %u entries\n",
1712                          j, number);
1713                 goto out_unlock;
1714         }
1715
1716         /* Check hooks all assigned */
1717         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1718                 /* Only hooks which are valid */
1719                 if (!(valid_hooks & (1 << i)))
1720                         continue;
1721                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1722                         duprintf("Invalid hook entry %u %u\n",
1723                                  i, hook_entries[i]);
1724                         goto out_unlock;
1725                 }
1726                 if (info->underflow[i] == 0xFFFFFFFF) {
1727                         duprintf("Invalid underflow %u %u\n",
1728                                  i, underflows[i]);
1729                         goto out_unlock;
1730                 }
1731         }
1732
1733         ret = -ENOMEM;
1734         newinfo = xt_alloc_table_info(size);
1735         if (!newinfo)
1736                 goto out_unlock;
1737
1738         newinfo->number = number;
1739         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1740                 newinfo->hook_entry[i] = info->hook_entry[i];
1741                 newinfo->underflow[i] = info->underflow[i];
1742         }
1743         entry1 = newinfo->entries[raw_smp_processor_id()];
1744         pos = entry1;
1745         size = total_size;
1746         ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
1747                                        compat_copy_entry_from_user,
1748                                        &pos, &size, name, newinfo, entry1);
1749         xt_compat_flush_offsets(AF_INET);
1750         xt_compat_unlock(AF_INET);
1751         if (ret)
1752                 goto free_newinfo;
1753
1754         ret = -ELOOP;
1755         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1756                 goto free_newinfo;
1757
1758         i = 0;
1759         ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
1760                                 name, &i);
1761         if (ret) {
1762                 j -= i;
1763                 COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
1764                                                   compat_release_entry, &j);
1765                 IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
1766                 xt_free_table_info(newinfo);
1767                 return ret;
1768         }
1769
1770         /* And one copy for every other CPU */
1771         for_each_possible_cpu(i)
1772                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1773                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1774
1775         *pinfo = newinfo;
1776         *pentry0 = entry1;
1777         xt_free_table_info(info);
1778         return 0;
1779
1780 free_newinfo:
1781         xt_free_table_info(newinfo);
1782 out:
1783         COMPAT_IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
1784         return ret;
1785 out_unlock:
1786         xt_compat_flush_offsets(AF_INET);
1787         xt_compat_unlock(AF_INET);
1788         goto out;
1789 }
1790
1791 static int
1792 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1793 {
1794         int ret;
1795         struct compat_ipt_replace tmp;
1796         struct xt_table_info *newinfo;
1797         void *loc_cpu_entry;
1798
1799         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1800                 return -EFAULT;
1801
1802         /* overflow check */
1803         if (tmp.size >= INT_MAX / num_possible_cpus())
1804                 return -ENOMEM;
1805         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1806                 return -ENOMEM;
1807
1808         newinfo = xt_alloc_table_info(tmp.size);
1809         if (!newinfo)
1810                 return -ENOMEM;
1811
1812         /* choose the copy that is on our node/cpu */
1813         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1814         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1815                            tmp.size) != 0) {
1816                 ret = -EFAULT;
1817                 goto free_newinfo;
1818         }
1819
1820         ret = translate_compat_table(tmp.name, tmp.valid_hooks,
1821                                      &newinfo, &loc_cpu_entry, tmp.size,
1822                                      tmp.num_entries, tmp.hook_entry,
1823                                      tmp.underflow);
1824         if (ret != 0)
1825                 goto free_newinfo;
1826
1827         duprintf("compat_do_replace: Translated table\n");
1828
1829         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1830                            tmp.num_counters, compat_ptr(tmp.counters));
1831         if (ret)
1832                 goto free_newinfo_untrans;
1833         return 0;
1834
1835  free_newinfo_untrans:
1836         IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
1837  free_newinfo:
1838         xt_free_table_info(newinfo);
1839         return ret;
1840 }
1841
1842 static int
1843 compat_do_ipt_set_ctl(struct sock *sk,  int cmd, void __user *user,
1844                       unsigned int len)
1845 {
1846         int ret;
1847
1848         if (!capable(CAP_NET_ADMIN))
1849                 return -EPERM;
1850
1851         switch (cmd) {
1852         case IPT_SO_SET_REPLACE:
1853                 ret = compat_do_replace(sock_net(sk), user, len);
1854                 break;
1855
1856         case IPT_SO_SET_ADD_COUNTERS:
1857                 ret = do_add_counters(sock_net(sk), user, len, 1);
1858                 break;
1859
1860         default:
1861                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
1862                 ret = -EINVAL;
1863         }
1864
1865         return ret;
1866 }
1867
1868 struct compat_ipt_get_entries {
1869         char name[IPT_TABLE_MAXNAMELEN];
1870         compat_uint_t size;
1871         struct compat_ipt_entry entrytable[0];
1872 };
1873
1874 static int
1875 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1876                             void __user *userptr)
1877 {
1878         struct xt_counters *counters;
1879         const struct xt_table_info *private = table->private;
1880         void __user *pos;
1881         unsigned int size;
1882         int ret = 0;
1883         const void *loc_cpu_entry;
1884         unsigned int i = 0;
1885
1886         counters = alloc_counters(table);
1887         if (IS_ERR(counters))
1888                 return PTR_ERR(counters);
1889
1890         /* choose the copy that is on our node/cpu, ...
1891          * This choice is lazy (because current thread is
1892          * allowed to migrate to another cpu)
1893          */
1894         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1895         pos = userptr;
1896         size = total_size;
1897         ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
1898                                 compat_copy_entry_to_user,
1899                                 &pos, &size, counters, &i);
1900
1901         vfree(counters);
1902         return ret;
1903 }
1904
1905 static int
1906 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1907                    int *len)
1908 {
1909         int ret;
1910         struct compat_ipt_get_entries get;
1911         struct xt_table *t;
1912
1913         if (*len < sizeof(get)) {
1914                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1915                 return -EINVAL;
1916         }
1917
1918         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1919                 return -EFAULT;
1920
1921         if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1922                 duprintf("compat_get_entries: %u != %zu\n",
1923                          *len, sizeof(get) + get.size);
1924                 return -EINVAL;
1925         }
1926
1927         xt_compat_lock(AF_INET);
1928         t = xt_find_table_lock(net, AF_INET, get.name);
1929         if (t && !IS_ERR(t)) {
1930                 const struct xt_table_info *private = t->private;
1931                 struct xt_table_info info;
1932                 duprintf("t->private->number = %u\n", private->number);
1933                 ret = compat_table_info(private, &info);
1934                 if (!ret && get.size == info.size) {
1935                         ret = compat_copy_entries_to_user(private->size,
1936                                                           t, uptr->entrytable);
1937                 } else if (!ret) {
1938                         duprintf("compat_get_entries: I've got %u not %u!\n",
1939                                  private->size, get.size);
1940                         ret = -EAGAIN;
1941                 }
1942                 xt_compat_flush_offsets(AF_INET);
1943                 module_put(t->me);
1944                 xt_table_unlock(t);
1945         } else
1946                 ret = t ? PTR_ERR(t) : -ENOENT;
1947
1948         xt_compat_unlock(AF_INET);
1949         return ret;
1950 }
1951
1952 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
1953
1954 static int
1955 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1956 {
1957         int ret;
1958
1959         if (!capable(CAP_NET_ADMIN))
1960                 return -EPERM;
1961
1962         switch (cmd) {
1963         case IPT_SO_GET_INFO:
1964                 ret = get_info(sock_net(sk), user, len, 1);
1965                 break;
1966         case IPT_SO_GET_ENTRIES:
1967                 ret = compat_get_entries(sock_net(sk), user, len);
1968                 break;
1969         default:
1970                 ret = do_ipt_get_ctl(sk, cmd, user, len);
1971         }
1972         return ret;
1973 }
1974 #endif
1975
1976 static int
1977 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1978 {
1979         int ret;
1980
1981         if (!capable(CAP_NET_ADMIN))
1982                 return -EPERM;
1983
1984         switch (cmd) {
1985         case IPT_SO_SET_REPLACE:
1986                 ret = do_replace(sock_net(sk), user, len);
1987                 break;
1988
1989         case IPT_SO_SET_ADD_COUNTERS:
1990                 ret = do_add_counters(sock_net(sk), user, len, 0);
1991                 break;
1992
1993         default:
1994                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
1995                 ret = -EINVAL;
1996         }
1997
1998         return ret;
1999 }
2000
2001 static int
2002 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2003 {
2004         int ret;
2005
2006         if (!capable(CAP_NET_ADMIN))
2007                 return -EPERM;
2008
2009         switch (cmd) {
2010         case IPT_SO_GET_INFO:
2011                 ret = get_info(sock_net(sk), user, len, 0);
2012                 break;
2013
2014         case IPT_SO_GET_ENTRIES:
2015                 ret = get_entries(sock_net(sk), user, len);
2016                 break;
2017
2018         case IPT_SO_GET_REVISION_MATCH:
2019         case IPT_SO_GET_REVISION_TARGET: {
2020                 struct ipt_get_revision rev;
2021                 int target;
2022
2023                 if (*len != sizeof(rev)) {
2024                         ret = -EINVAL;
2025                         break;
2026                 }
2027                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2028                         ret = -EFAULT;
2029                         break;
2030                 }
2031
2032                 if (cmd == IPT_SO_GET_REVISION_TARGET)
2033                         target = 1;
2034                 else
2035                         target = 0;
2036
2037                 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2038                                                          rev.revision,
2039                                                          target, &ret),
2040                                         "ipt_%s", rev.name);
2041                 break;
2042         }
2043
2044         default:
2045                 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2046                 ret = -EINVAL;
2047         }
2048
2049         return ret;
2050 }
2051
2052 struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
2053                                     const struct ipt_replace *repl)
2054 {
2055         int ret;
2056         struct xt_table_info *newinfo;
2057         struct xt_table_info bootstrap
2058                 = { 0, 0, 0, { 0 }, { 0 }, { } };
2059         void *loc_cpu_entry;
2060         struct xt_table *new_table;
2061
2062         newinfo = xt_alloc_table_info(repl->size);
2063         if (!newinfo) {
2064                 ret = -ENOMEM;
2065                 goto out;
2066         }
2067
2068         /* choose the copy on our node/cpu, but dont care about preemption */
2069         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2070         memcpy(loc_cpu_entry, repl->entries, repl->size);
2071
2072         ret = translate_table(table->name, table->valid_hooks,
2073                               newinfo, loc_cpu_entry, repl->size,
2074                               repl->num_entries,
2075                               repl->hook_entry,
2076                               repl->underflow);
2077         if (ret != 0)
2078                 goto out_free;
2079
2080         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2081         if (IS_ERR(new_table)) {
2082                 ret = PTR_ERR(new_table);
2083                 goto out_free;
2084         }
2085
2086         return new_table;
2087
2088 out_free:
2089         xt_free_table_info(newinfo);
2090 out:
2091         return ERR_PTR(ret);
2092 }
2093
2094 void ipt_unregister_table(struct xt_table *table)
2095 {
2096         struct xt_table_info *private;
2097         void *loc_cpu_entry;
2098         struct module *table_owner = table->me;
2099
2100         private = xt_unregister_table(table);
2101
2102         /* Decrease module usage counts and free resources */
2103         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2104         IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
2105         if (private->number > private->initial_entries)
2106                 module_put(table_owner);
2107         xt_free_table_info(private);
2108 }
2109
2110 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2111 static inline bool
2112 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2113                      u_int8_t type, u_int8_t code,
2114                      bool invert)
2115 {
2116         return ((test_type == 0xFF) ||
2117                 (type == test_type && code >= min_code && code <= max_code))
2118                 ^ invert;
2119 }
2120
2121 static bool
2122 icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
2123 {
2124         const struct icmphdr *ic;
2125         struct icmphdr _icmph;
2126         const struct ipt_icmp *icmpinfo = par->matchinfo;
2127
2128         /* Must not be a fragment. */
2129         if (par->fragoff != 0)
2130                 return false;
2131
2132         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2133         if (ic == NULL) {
2134                 /* We've been asked to examine this packet, and we
2135                  * can't.  Hence, no choice but to drop.
2136                  */
2137                 duprintf("Dropping evil ICMP tinygram.\n");
2138                 *par->hotdrop = true;
2139                 return false;
2140         }
2141
2142         return icmp_type_code_match(icmpinfo->type,
2143                                     icmpinfo->code[0],
2144                                     icmpinfo->code[1],
2145                                     ic->type, ic->code,
2146                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
2147 }
2148
2149 static bool icmp_checkentry(const struct xt_mtchk_param *par)
2150 {
2151         const struct ipt_icmp *icmpinfo = par->matchinfo;
2152
2153         /* Must specify no unknown invflags */
2154         return !(icmpinfo->invflags & ~IPT_ICMP_INV);
2155 }
2156
2157 /* The built-in targets: standard (NULL) and error. */
2158 static struct xt_target ipt_standard_target __read_mostly = {
2159         .name           = IPT_STANDARD_TARGET,
2160         .targetsize     = sizeof(int),
2161         .family         = NFPROTO_IPV4,
2162 #ifdef CONFIG_COMPAT
2163         .compatsize     = sizeof(compat_int_t),
2164         .compat_from_user = compat_standard_from_user,
2165         .compat_to_user = compat_standard_to_user,
2166 #endif
2167 };
2168
2169 static struct xt_target ipt_error_target __read_mostly = {
2170         .name           = IPT_ERROR_TARGET,
2171         .target         = ipt_error,
2172         .targetsize     = IPT_FUNCTION_MAXNAMELEN,
2173         .family         = NFPROTO_IPV4,
2174 };
2175
2176 static struct nf_sockopt_ops ipt_sockopts = {
2177         .pf             = PF_INET,
2178         .set_optmin     = IPT_BASE_CTL,
2179         .set_optmax     = IPT_SO_SET_MAX+1,
2180         .set            = do_ipt_set_ctl,
2181 #ifdef CONFIG_COMPAT
2182         .compat_set     = compat_do_ipt_set_ctl,
2183 #endif
2184         .get_optmin     = IPT_BASE_CTL,
2185         .get_optmax     = IPT_SO_GET_MAX+1,
2186         .get            = do_ipt_get_ctl,
2187 #ifdef CONFIG_COMPAT
2188         .compat_get     = compat_do_ipt_get_ctl,
2189 #endif
2190         .owner          = THIS_MODULE,
2191 };
2192
2193 static struct xt_match icmp_matchstruct __read_mostly = {
2194         .name           = "icmp",
2195         .match          = icmp_match,
2196         .matchsize      = sizeof(struct ipt_icmp),
2197         .checkentry     = icmp_checkentry,
2198         .proto          = IPPROTO_ICMP,
2199         .family         = NFPROTO_IPV4,
2200 };
2201
2202 static int __net_init ip_tables_net_init(struct net *net)
2203 {
2204         return xt_proto_init(net, NFPROTO_IPV4);
2205 }
2206
2207 static void __net_exit ip_tables_net_exit(struct net *net)
2208 {
2209         xt_proto_fini(net, NFPROTO_IPV4);
2210 }
2211
2212 static struct pernet_operations ip_tables_net_ops = {
2213         .init = ip_tables_net_init,
2214         .exit = ip_tables_net_exit,
2215 };
2216
2217 static int __init ip_tables_init(void)
2218 {
2219         int ret;
2220
2221         ret = register_pernet_subsys(&ip_tables_net_ops);
2222         if (ret < 0)
2223                 goto err1;
2224
2225         /* Noone else will be downing sem now, so we won't sleep */
2226         ret = xt_register_target(&ipt_standard_target);
2227         if (ret < 0)
2228                 goto err2;
2229         ret = xt_register_target(&ipt_error_target);
2230         if (ret < 0)
2231                 goto err3;
2232         ret = xt_register_match(&icmp_matchstruct);
2233         if (ret < 0)
2234                 goto err4;
2235
2236         /* Register setsockopt */
2237         ret = nf_register_sockopt(&ipt_sockopts);
2238         if (ret < 0)
2239                 goto err5;
2240
2241         printk(KERN_INFO "ip_tables: (C) 2000-2006 Netfilter Core Team\n");
2242         return 0;
2243
2244 err5:
2245         xt_unregister_match(&icmp_matchstruct);
2246 err4:
2247         xt_unregister_target(&ipt_error_target);
2248 err3:
2249         xt_unregister_target(&ipt_standard_target);
2250 err2:
2251         unregister_pernet_subsys(&ip_tables_net_ops);
2252 err1:
2253         return ret;
2254 }
2255
2256 static void __exit ip_tables_fini(void)
2257 {
2258         nf_unregister_sockopt(&ipt_sockopts);
2259
2260         xt_unregister_match(&icmp_matchstruct);
2261         xt_unregister_target(&ipt_error_target);
2262         xt_unregister_target(&ipt_standard_target);
2263
2264         unregister_pernet_subsys(&ip_tables_net_ops);
2265 }
2266
2267 EXPORT_SYMBOL(ipt_register_table);
2268 EXPORT_SYMBOL(ipt_unregister_table);
2269 EXPORT_SYMBOL(ipt_do_table);
2270 module_init(ip_tables_init);
2271 module_exit(ip_tables_fini);