git.oblomov.eu Git - linux-2.6/blob - net/ipv4/netfilter/ip_tables.c

   1 /*
   2  * Packet matching code.
   3  *
   4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
   5  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11 #include <linux/cache.h>
  12 #include <linux/capability.h>
  13 #include <linux/skbuff.h>
  14 #include <linux/kmod.h>
  15 #include <linux/vmalloc.h>
  16 #include <linux/netdevice.h>
  17 #include <linux/module.h>
  18 #include <linux/icmp.h>
  19 #include <net/ip.h>
  20 #include <net/compat.h>
  21 #include <asm/uaccess.h>
  22 #include <linux/mutex.h>
  23 #include <linux/proc_fs.h>
  24 #include <linux/err.h>
  25 #include <linux/cpumask.h>
  26
  27 #include <linux/netfilter/x_tables.h>
  28 #include <linux/netfilter_ipv4/ip_tables.h>
  29 #include <net/netfilter/nf_log.h>
  30
  31 MODULE_LICENSE("GPL");
  32 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  33 MODULE_DESCRIPTION("IPv4 packet filter");
  34
  35 /*#define DEBUG_IP_FIREWALL*/
  36 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
  37 /*#define DEBUG_IP_FIREWALL_USER*/
  38
  39 #ifdef DEBUG_IP_FIREWALL
  40 #define dprintf(format, args...)  printk(format , ## args)
  41 #else
  42 #define dprintf(format, args...)
  43 #endif
  44
  45 #ifdef DEBUG_IP_FIREWALL_USER
  46 #define duprintf(format, args...) printk(format , ## args)
  47 #else
  48 #define duprintf(format, args...)
  49 #endif
  50
  51 #ifdef CONFIG_NETFILTER_DEBUG
  52 #define IP_NF_ASSERT(x)                                         \
  53 do {                                                            \
  54         if (!(x))                                               \
  55                 printk("IP_NF_ASSERT: %s:%s:%u\n",              \
  56                        __func__, __FILE__, __LINE__);   \
  57 } while(0)
  58 #else
  59 #define IP_NF_ASSERT(x)
  60 #endif
  61
  62 #if 0
  63 /* All the better to debug you with... */
  64 #define static
  65 #define inline
  66 #endif
  67
  68 /*
  69    We keep a set of rules for each CPU, so we can avoid write-locking
  70    them in the softirq when updating the counters and therefore
  71    only need to read-lock in the softirq; doing a write_lock_bh() in user
  72    context stops packets coming through and allows user context to read
  73    the counters or update the rules.
  74
  75    Hence the start of any table is given by get_table() below.  */
  76
  77 /* Returns whether matches rule or not. */
  78 /* Performance critical - called for every packet */
  79 static inline bool
  80 ip_packet_match(const struct iphdr *ip,
  81                 const char *indev,
  82                 const char *outdev,
  83                 const struct ipt_ip *ipinfo,
  84                 int isfrag)
  85 {
  86         size_t i;
  87         unsigned long ret;
  88
  89 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
  90
  91         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
  92                   IPT_INV_SRCIP)
  93             || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
  94                      IPT_INV_DSTIP)) {
  95                 dprintf("Source or dest mismatch.\n");
  96
  97                 dprintf("SRC: %u.%u.%u.%u. Mask: %u.%u.%u.%u. Target: %u.%u.%u.%u.%s\n",
  98                         NIPQUAD(ip->saddr),
  99                         NIPQUAD(ipinfo->smsk.s_addr),
 100                         NIPQUAD(ipinfo->src.s_addr),
 101                         ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
 102                 dprintf("DST: %u.%u.%u.%u Mask: %u.%u.%u.%u Target: %u.%u.%u.%u.%s\n",
 103                         NIPQUAD(ip->daddr),
 104                         NIPQUAD(ipinfo->dmsk.s_addr),
 105                         NIPQUAD(ipinfo->dst.s_addr),
 106                         ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
 107                 return false;
 108         }
 109
 110         /* Look for ifname matches; this should unroll nicely. */
 111         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
 112                 ret |= (((const unsigned long *)indev)[i]
 113                         ^ ((const unsigned long *)ipinfo->iniface)[i])
 114                         & ((const unsigned long *)ipinfo->iniface_mask)[i];
 115         }
 116
 117         if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
 118                 dprintf("VIA in mismatch (%s vs %s).%s\n",
 119                         indev, ipinfo->iniface,
 120                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
 121                 return false;
 122         }
 123
 124         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
 125                 ret |= (((const unsigned long *)outdev)[i]
 126                         ^ ((const unsigned long *)ipinfo->outiface)[i])
 127                         & ((const unsigned long *)ipinfo->outiface_mask)[i];
 128         }
 129
 130         if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
 131                 dprintf("VIA out mismatch (%s vs %s).%s\n",
 132                         outdev, ipinfo->outiface,
 133                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
 134                 return false;
 135         }
 136
 137         /* Check specific protocol */
 138         if (ipinfo->proto
 139             && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
 140                 dprintf("Packet protocol %hi does not match %hi.%s\n",
 141                         ip->protocol, ipinfo->proto,
 142                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
 143                 return false;
 144         }
 145
 146         /* If we have a fragment rule but the packet is not a fragment
 147          * then we return zero */
 148         if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
 149                 dprintf("Fragment rule but not fragment.%s\n",
 150                         ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
 151                 return false;
 152         }
 153
 154         return true;
 155 }
 156
 157 static bool
 158 ip_checkentry(const struct ipt_ip *ip)
 159 {
 160         if (ip->flags & ~IPT_F_MASK) {
 161                 duprintf("Unknown flag bits set: %08X\n",
 162                          ip->flags & ~IPT_F_MASK);
 163                 return false;
 164         }
 165         if (ip->invflags & ~IPT_INV_MASK) {
 166                 duprintf("Unknown invflag bits set: %08X\n",
 167                          ip->invflags & ~IPT_INV_MASK);
 168                 return false;
 169         }
 170         return true;
 171 }
 172
 173 static unsigned int
 174 ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
 175 {
 176         if (net_ratelimit())
 177                 printk("ip_tables: error: `%s'\n",
 178                        (const char *)par->targinfo);
 179
 180         return NF_DROP;
 181 }
 182
 183 /* Performance critical - called for every packet */
 184 static inline bool
 185 do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
 186          struct xt_match_param *par)
 187 {
 188         par->match     = m->u.kernel.match;
 189         par->matchinfo = m->data;
 190
 191         /* Stop iteration if it doesn't match */
 192         if (!m->u.kernel.match->match(skb, par))
 193                 return true;
 194         else
 195                 return false;
 196 }
 197
 198 /* Performance critical */
 199 static inline struct ipt_entry *
 200 get_entry(void *base, unsigned int offset)
 201 {
 202         return (struct ipt_entry *)(base + offset);
 203 }
 204
 205 /* All zeroes == unconditional rule. */
 206 /* Mildly perf critical (only if packet tracing is on) */
 207 static inline int
 208 unconditional(const struct ipt_ip *ip)
 209 {
 210         unsigned int i;
 211
 212         for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++)
 213                 if (((__u32 *)ip)[i])
 214                         return 0;
 215
 216         return 1;
 217 #undef FWINV
 218 }
 219
 220 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 221     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 222 static const char *const hooknames[] = {
 223         [NF_INET_PRE_ROUTING]           = "PREROUTING",
 224         [NF_INET_LOCAL_IN]              = "INPUT",
 225         [NF_INET_FORWARD]               = "FORWARD",
 226         [NF_INET_LOCAL_OUT]             = "OUTPUT",
 227         [NF_INET_POST_ROUTING]          = "POSTROUTING",
 228 };
 229
 230 enum nf_ip_trace_comments {
 231         NF_IP_TRACE_COMMENT_RULE,
 232         NF_IP_TRACE_COMMENT_RETURN,
 233         NF_IP_TRACE_COMMENT_POLICY,
 234 };
 235
 236 static const char *const comments[] = {
 237         [NF_IP_TRACE_COMMENT_RULE]      = "rule",
 238         [NF_IP_TRACE_COMMENT_RETURN]    = "return",
 239         [NF_IP_TRACE_COMMENT_POLICY]    = "policy",
 240 };
 241
 242 static struct nf_loginfo trace_loginfo = {
 243         .type = NF_LOG_TYPE_LOG,
 244         .u = {
 245                 .log = {
 246                         .level = 4,
 247                         .logflags = NF_LOG_MASK,
 248                 },
 249         },
 250 };
 251
 252 /* Mildly perf critical (only if packet tracing is on) */
 253 static inline int
 254 get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
 255                       char *hookname, char **chainname,
 256                       char **comment, unsigned int *rulenum)
 257 {
 258         struct ipt_standard_target *t = (void *)ipt_get_target(s);
 259
 260         if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
 261                 /* Head of user chain: ERROR target with chainname */
 262                 *chainname = t->target.data;
 263                 (*rulenum) = 0;
 264         } else if (s == e) {
 265                 (*rulenum)++;
 266
 267                 if (s->target_offset == sizeof(struct ipt_entry)
 268                    && strcmp(t->target.u.kernel.target->name,
 269                              IPT_STANDARD_TARGET) == 0
 270                    && t->verdict < 0
 271                    && unconditional(&s->ip)) {
 272                         /* Tail of chains: STANDARD target (return/policy) */
 273                         *comment = *chainname == hookname
 274                                 ? (char *)comments[NF_IP_TRACE_COMMENT_POLICY]
 275                                 : (char *)comments[NF_IP_TRACE_COMMENT_RETURN];
 276                 }
 277                 return 1;
 278         } else
 279                 (*rulenum)++;
 280
 281         return 0;
 282 }
 283
 284 static void trace_packet(struct sk_buff *skb,
 285                          unsigned int hook,
 286                          const struct net_device *in,
 287                          const struct net_device *out,
 288                          const char *tablename,
 289                          struct xt_table_info *private,
 290                          struct ipt_entry *e)
 291 {
 292         void *table_base;
 293         const struct ipt_entry *root;
 294         char *hookname, *chainname, *comment;
 295         unsigned int rulenum = 0;
 296
 297         table_base = (void *)private->entries[smp_processor_id()];
 298         root = get_entry(table_base, private->hook_entry[hook]);
 299
 300         hookname = chainname = (char *)hooknames[hook];
 301         comment = (char *)comments[NF_IP_TRACE_COMMENT_RULE];
 302
 303         IPT_ENTRY_ITERATE(root,
 304                           private->size - private->hook_entry[hook],
 305                           get_chainname_rulenum,
 306                           e, hookname, &chainname, &comment, &rulenum);
 307
 308         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
 309                       "TRACE: %s:%s:%s:%u ",
 310                       tablename, chainname, comment, rulenum);
 311 }
 312 #endif
 313
 314 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 315 unsigned int
 316 ipt_do_table(struct sk_buff *skb,
 317              unsigned int hook,
 318              const struct net_device *in,
 319              const struct net_device *out,
 320              struct xt_table *table)
 321 {
 322         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 323         const struct iphdr *ip;
 324         u_int16_t datalen;
 325         bool hotdrop = false;
 326         /* Initializing verdict to NF_DROP keeps gcc happy. */
 327         unsigned int verdict = NF_DROP;
 328         const char *indev, *outdev;
 329         void *table_base;
 330         struct ipt_entry *e, *back;
 331         struct xt_table_info *private;
 332         struct xt_match_param mtpar;
 333         struct xt_target_param tgpar;
 334
 335         /* Initialization */
 336         ip = ip_hdr(skb);
 337         datalen = skb->len - ip->ihl * 4;
 338         indev = in ? in->name : nulldevname;
 339         outdev = out ? out->name : nulldevname;
 340         /* We handle fragments by dealing with the first fragment as
 341          * if it was a normal packet.  All other fragments are treated
 342          * normally, except that they will NEVER match rules that ask
 343          * things we don't know, ie. tcp syn flag or ports).  If the
 344          * rule is also a fragment-specific rule, non-fragments won't
 345          * match it. */
 346         mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 347         mtpar.thoff   = ip_hdrlen(skb);
 348         mtpar.hotdrop = &hotdrop;
 349         mtpar.in      = tgpar.in  = in;
 350         mtpar.out     = tgpar.out = out;
 351         mtpar.family  = tgpar.family = NFPROTO_IPV4;
 352         tgpar.hooknum = hook;
 353
 354         read_lock_bh(&table->lock);
 355         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 356         private = table->private;
 357         table_base = (void *)private->entries[smp_processor_id()];
 358         e = get_entry(table_base, private->hook_entry[hook]);
 359
 360         /* For return from builtin chain */
 361         back = get_entry(table_base, private->underflow[hook]);
 362
 363         do {
 364                 IP_NF_ASSERT(e);
 365                 IP_NF_ASSERT(back);
 366                 if (ip_packet_match(ip, indev, outdev,
 367                     &e->ip, mtpar.fragoff)) {
 368                         struct ipt_entry_target *t;
 369
 370                         if (IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0)
 371                                 goto no_match;
 372
 373                         ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
 374
 375                         t = ipt_get_target(e);
 376                         IP_NF_ASSERT(t->u.kernel.target);
 377
 378 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 379     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 380                         /* The packet is traced: log it */
 381                         if (unlikely(skb->nf_trace))
 382                                 trace_packet(skb, hook, in, out,
 383                                              table->name, private, e);
 384 #endif
 385                         /* Standard target? */
 386                         if (!t->u.kernel.target->target) {
 387                                 int v;
 388
 389                                 v = ((struct ipt_standard_target *)t)->verdict;
 390                                 if (v < 0) {
 391                                         /* Pop from stack? */
 392                                         if (v != IPT_RETURN) {
 393                                                 verdict = (unsigned)(-v) - 1;
 394                                                 break;
 395                                         }
 396                                         e = back;
 397                                         back = get_entry(table_base,
 398                                                          back->comefrom);
 399                                         continue;
 400                                 }
 401                                 if (table_base + v != (void *)e + e->next_offset
 402                                     && !(e->ip.flags & IPT_F_GOTO)) {
 403                                         /* Save old back ptr in next entry */
 404                                         struct ipt_entry *next
 405                                                 = (void *)e + e->next_offset;
 406                                         next->comefrom
 407                                                 = (void *)back - table_base;
 408                                         /* set back pointer to next entry */
 409                                         back = next;
 410                                 }
 411
 412                                 e = get_entry(table_base, v);
 413                         } else {
 414                                 /* Targets which reenter must return
 415                                    abs. verdicts */
 416                                 tgpar.target   = t->u.kernel.target;
 417                                 tgpar.targinfo = t->data;
 418 #ifdef CONFIG_NETFILTER_DEBUG
 419                                 ((struct ipt_entry *)table_base)->comefrom
 420                                         = 0xeeeeeeec;
 421 #endif
 422                                 verdict = t->u.kernel.target->target(skb,
 423                                                                      &tgpar);
 424 #ifdef CONFIG_NETFILTER_DEBUG
 425                                 if (((struct ipt_entry *)table_base)->comefrom
 426                                     != 0xeeeeeeec
 427                                     && verdict == IPT_CONTINUE) {
 428                                         printk("Target %s reentered!\n",
 429                                                t->u.kernel.target->name);
 430                                         verdict = NF_DROP;
 431                                 }
 432                                 ((struct ipt_entry *)table_base)->comefrom
 433                                         = 0x57acc001;
 434 #endif
 435                                 /* Target might have changed stuff. */
 436                                 ip = ip_hdr(skb);
 437                                 datalen = skb->len - ip->ihl * 4;
 438
 439                                 if (verdict == IPT_CONTINUE)
 440                                         e = (void *)e + e->next_offset;
 441                                 else
 442                                         /* Verdict */
 443                                         break;
 444                         }
 445                 } else {
 446
 447                 no_match:
 448                         e = (void *)e + e->next_offset;
 449                 }
 450         } while (!hotdrop);
 451
 452         read_unlock_bh(&table->lock);
 453
 454 #ifdef DEBUG_ALLOW_ALL
 455         return NF_ACCEPT;
 456 #else
 457         if (hotdrop)
 458                 return NF_DROP;
 459         else return verdict;
 460 #endif
 461 }
 462
 463 /* Figures out from what hook each rule can be called: returns 0 if
 464    there are loops.  Puts hook bitmask in comefrom. */
 465 static int
 466 mark_source_chains(struct xt_table_info *newinfo,
 467                    unsigned int valid_hooks, void *entry0)
 468 {
 469         unsigned int hook;
 470
 471         /* No recursion; use packet counter to save back ptrs (reset
 472            to 0 as we leave), and comefrom to save source hook bitmask */
 473         for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 474                 unsigned int pos = newinfo->hook_entry[hook];
 475                 struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
 476
 477                 if (!(valid_hooks & (1 << hook)))
 478                         continue;
 479
 480                 /* Set initial back pointer. */
 481                 e->counters.pcnt = pos;
 482
 483                 for (;;) {
 484                         struct ipt_standard_target *t
 485                                 = (void *)ipt_get_target(e);
 486                         int visited = e->comefrom & (1 << hook);
 487
 488                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 489                                 printk("iptables: loop hook %u pos %u %08X.\n",
 490                                        hook, pos, e->comefrom);
 491                                 return 0;
 492                         }
 493                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 494
 495                         /* Unconditional return/END. */
 496                         if ((e->target_offset == sizeof(struct ipt_entry)
 497                             && (strcmp(t->target.u.user.name,
 498                                        IPT_STANDARD_TARGET) == 0)
 499                             && t->verdict < 0
 500                             && unconditional(&e->ip)) || visited) {
 501                                 unsigned int oldpos, size;
 502
 503                                 if (t->verdict < -NF_MAX_VERDICT - 1) {
 504                                         duprintf("mark_source_chains: bad "
 505                                                 "negative verdict (%i)\n",
 506                                                                 t->verdict);
 507                                         return 0;
 508                                 }
 509
 510                                 /* Return: backtrack through the last
 511                                    big jump. */
 512                                 do {
 513                                         e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 514 #ifdef DEBUG_IP_FIREWALL_USER
 515                                         if (e->comefrom
 516                                             & (1 << NF_INET_NUMHOOKS)) {
 517                                                 duprintf("Back unset "
 518                                                          "on hook %u "
 519                                                          "rule %u\n",
 520                                                          hook, pos);
 521                                         }
 522 #endif
 523                                         oldpos = pos;
 524                                         pos = e->counters.pcnt;
 525                                         e->counters.pcnt = 0;
 526
 527                                         /* We're at the start. */
 528                                         if (pos == oldpos)
 529                                                 goto next;
 530
 531                                         e = (struct ipt_entry *)
 532                                                 (entry0 + pos);
 533                                 } while (oldpos == pos + e->next_offset);
 534
 535                                 /* Move along one */
 536                                 size = e->next_offset;
 537                                 e = (struct ipt_entry *)
 538                                         (entry0 + pos + size);
 539                                 e->counters.pcnt = pos;
 540                                 pos += size;
 541                         } else {
 542                                 int newpos = t->verdict;
 543
 544                                 if (strcmp(t->target.u.user.name,
 545                                            IPT_STANDARD_TARGET) == 0
 546                                     && newpos >= 0) {
 547                                         if (newpos > newinfo->size -
 548                                                 sizeof(struct ipt_entry)) {
 549                                                 duprintf("mark_source_chains: "
 550                                                         "bad verdict (%i)\n",
 551                                                                 newpos);
 552                                                 return 0;
 553                                         }
 554                                         /* This a jump; chase it. */
 555                                         duprintf("Jump rule %u -> %u\n",
 556                                                  pos, newpos);
 557                                 } else {
 558                                         /* ... this is a fallthru */
 559                                         newpos = pos + e->next_offset;
 560                                 }
 561                                 e = (struct ipt_entry *)
 562                                         (entry0 + newpos);
 563                                 e->counters.pcnt = pos;
 564                                 pos = newpos;
 565                         }
 566                 }
 567                 next:
 568                 duprintf("Finished chain %u\n", hook);
 569         }
 570         return 1;
 571 }
 572
 573 static int
 574 cleanup_match(struct ipt_entry_match *m, unsigned int *i)
 575 {
 576         struct xt_mtdtor_param par;
 577
 578         if (i && (*i)-- == 0)
 579                 return 1;
 580
 581         par.match     = m->u.kernel.match;
 582         par.matchinfo = m->data;
 583         par.family    = NFPROTO_IPV4;
 584         if (par.match->destroy != NULL)
 585                 par.match->destroy(&par);
 586         module_put(par.match->me);
 587         return 0;
 588 }
 589
 590 static int
 591 check_entry(struct ipt_entry *e, const char *name)
 592 {
 593         struct ipt_entry_target *t;
 594
 595         if (!ip_checkentry(&e->ip)) {
 596                 duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 597                 return -EINVAL;
 598         }
 599
 600         if (e->target_offset + sizeof(struct ipt_entry_target) >
 601             e->next_offset)
 602                 return -EINVAL;
 603
 604         t = ipt_get_target(e);
 605         if (e->target_offset + t->u.target_size > e->next_offset)
 606                 return -EINVAL;
 607
 608         return 0;
 609 }
 610
 611 static int
 612 check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
 613             unsigned int *i)
 614 {
 615         const struct ipt_ip *ip = par->entryinfo;
 616         int ret;
 617
 618         par->match     = m->u.kernel.match;
 619         par->matchinfo = m->data;
 620
 621         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 622               ip->proto, ip->invflags & IPT_INV_PROTO);
 623         if (ret < 0) {
 624                 duprintf("ip_tables: check failed for `%s'.\n",
 625                          par.match->name);
 626                 return ret;
 627         }
 628         ++*i;
 629         return 0;
 630 }
 631
 632 static int
 633 find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
 634                  unsigned int *i)
 635 {
 636         struct xt_match *match;
 637         int ret;
 638
 639         match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
 640                                                       m->u.user.revision),
 641                                         "ipt_%s", m->u.user.name);
 642         if (IS_ERR(match) || !match) {
 643                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 644                 return match ? PTR_ERR(match) : -ENOENT;
 645         }
 646         m->u.kernel.match = match;
 647
 648         ret = check_match(m, par, i);
 649         if (ret)
 650                 goto err;
 651
 652         return 0;
 653 err:
 654         module_put(m->u.kernel.match->me);
 655         return ret;
 656 }
 657
 658 static int check_target(struct ipt_entry *e, const char *name)
 659 {
 660         struct ipt_entry_target *t = ipt_get_target(e);
 661         struct xt_tgchk_param par = {
 662                 .table     = name,
 663                 .entryinfo = e,
 664                 .target    = t->u.kernel.target,
 665                 .targinfo  = t->data,
 666                 .hook_mask = e->comefrom,
 667                 .family    = NFPROTO_IPV4,
 668         };
 669         int ret;
 670
 671         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 672               e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
 673         if (ret < 0) {
 674                 duprintf("ip_tables: check failed for `%s'.\n",
 675                          t->u.kernel.target->name);
 676                 return ret;
 677         }
 678         return 0;
 679 }
 680
 681 static int
 682 find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
 683                  unsigned int *i)
 684 {
 685         struct ipt_entry_target *t;
 686         struct xt_target *target;
 687         int ret;
 688         unsigned int j;
 689         struct xt_mtchk_param mtpar;
 690
 691         ret = check_entry(e, name);
 692         if (ret)
 693                 return ret;
 694
 695         j = 0;
 696         mtpar.table     = name;
 697         mtpar.entryinfo = &e->ip;
 698         mtpar.hook_mask = e->comefrom;
 699         mtpar.family    = NFPROTO_IPV4;
 700         ret = IPT_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
 701         if (ret != 0)
 702                 goto cleanup_matches;
 703
 704         t = ipt_get_target(e);
 705         target = try_then_request_module(xt_find_target(AF_INET,
 706                                                         t->u.user.name,
 707                                                         t->u.user.revision),
 708                                          "ipt_%s", t->u.user.name);
 709         if (IS_ERR(target) || !target) {
 710                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 711                 ret = target ? PTR_ERR(target) : -ENOENT;
 712                 goto cleanup_matches;
 713         }
 714         t->u.kernel.target = target;
 715
 716         ret = check_target(e, name);
 717         if (ret)
 718                 goto err;
 719
 720         (*i)++;
 721         return 0;
 722  err:
 723         module_put(t->u.kernel.target->me);
 724  cleanup_matches:
 725         IPT_MATCH_ITERATE(e, cleanup_match, &j);
 726         return ret;
 727 }
 728
 729 static int
 730 check_entry_size_and_hooks(struct ipt_entry *e,
 731                            struct xt_table_info *newinfo,
 732                            unsigned char *base,
 733                            unsigned char *limit,
 734                            const unsigned int *hook_entries,
 735                            const unsigned int *underflows,
 736                            unsigned int *i)
 737 {
 738         unsigned int h;
 739
 740         if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
 741             || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
 742                 duprintf("Bad offset %p\n", e);
 743                 return -EINVAL;
 744         }
 745
 746         if (e->next_offset
 747             < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
 748                 duprintf("checking: element %p size %u\n",
 749                          e, e->next_offset);
 750                 return -EINVAL;
 751         }
 752
 753         /* Check hooks & underflows */
 754         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 755                 if ((unsigned char *)e - base == hook_entries[h])
 756                         newinfo->hook_entry[h] = hook_entries[h];
 757                 if ((unsigned char *)e - base == underflows[h])
 758                         newinfo->underflow[h] = underflows[h];
 759         }
 760
 761         /* FIXME: underflows must be unconditional, standard verdicts
 762            < 0 (not IPT_RETURN). --RR */
 763
 764         /* Clear counters and comefrom */
 765         e->counters = ((struct xt_counters) { 0, 0 });
 766         e->comefrom = 0;
 767
 768         (*i)++;
 769         return 0;
 770 }
 771
 772 static int
 773 cleanup_entry(struct ipt_entry *e, unsigned int *i)
 774 {
 775         struct xt_tgdtor_param par;
 776         struct ipt_entry_target *t;
 777
 778         if (i && (*i)-- == 0)
 779                 return 1;
 780
 781         /* Cleanup all matches */
 782         IPT_MATCH_ITERATE(e, cleanup_match, NULL);
 783         t = ipt_get_target(e);
 784
 785         par.target   = t->u.kernel.target;
 786         par.targinfo = t->data;
 787         par.family   = NFPROTO_IPV4;
 788         if (par.target->destroy != NULL)
 789                 par.target->destroy(&par);
 790         module_put(par.target->me);
 791         return 0;
 792 }
 793
 794 /* Checks and translates the user-supplied table segment (held in
 795    newinfo) */
 796 static int
 797 translate_table(const char *name,
 798                 unsigned int valid_hooks,
 799                 struct xt_table_info *newinfo,
 800                 void *entry0,
 801                 unsigned int size,
 802                 unsigned int number,
 803                 const unsigned int *hook_entries,
 804                 const unsigned int *underflows)
 805 {
 806         unsigned int i;
 807         int ret;
 808
 809         newinfo->size = size;
 810         newinfo->number = number;
 811
 812         /* Init all hooks to impossible value. */
 813         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 814                 newinfo->hook_entry[i] = 0xFFFFFFFF;
 815                 newinfo->underflow[i] = 0xFFFFFFFF;
 816         }
 817
 818         duprintf("translate_table: size %u\n", newinfo->size);
 819         i = 0;
 820         /* Walk through entries, checking offsets. */
 821         ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 822                                 check_entry_size_and_hooks,
 823                                 newinfo,
 824                                 entry0,
 825                                 entry0 + size,
 826                                 hook_entries, underflows, &i);
 827         if (ret != 0)
 828                 return ret;
 829
 830         if (i != number) {
 831                 duprintf("translate_table: %u not %u entries\n",
 832                          i, number);
 833                 return -EINVAL;
 834         }
 835
 836         /* Check hooks all assigned */
 837         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 838                 /* Only hooks which are valid */
 839                 if (!(valid_hooks & (1 << i)))
 840                         continue;
 841                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 842                         duprintf("Invalid hook entry %u %u\n",
 843                                  i, hook_entries[i]);
 844                         return -EINVAL;
 845                 }
 846                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
 847                         duprintf("Invalid underflow %u %u\n",
 848                                  i, underflows[i]);
 849                         return -EINVAL;
 850                 }
 851         }
 852
 853         if (!mark_source_chains(newinfo, valid_hooks, entry0))
 854                 return -ELOOP;
 855
 856         /* Finally, each sanity check must pass */
 857         i = 0;
 858         ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 859                                 find_check_entry, name, size, &i);
 860
 861         if (ret != 0) {
 862                 IPT_ENTRY_ITERATE(entry0, newinfo->size,
 863                                 cleanup_entry, &i);
 864                 return ret;
 865         }
 866
 867         /* And one copy for every other CPU */
 868         for_each_possible_cpu(i) {
 869                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 870                         memcpy(newinfo->entries[i], entry0, newinfo->size);
 871         }
 872
 873         return ret;
 874 }
 875
 876 /* Gets counters. */
 877 static inline int
 878 add_entry_to_counter(const struct ipt_entry *e,
 879                      struct xt_counters total[],
 880                      unsigned int *i)
 881 {
 882         ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 883
 884         (*i)++;
 885         return 0;
 886 }
 887
 888 static inline int
 889 set_entry_to_counter(const struct ipt_entry *e,
 890                      struct ipt_counters total[],
 891                      unsigned int *i)
 892 {
 893         SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 894
 895         (*i)++;
 896         return 0;
 897 }
 898
 899 static void
 900 get_counters(const struct xt_table_info *t,
 901              struct xt_counters counters[])
 902 {
 903         unsigned int cpu;
 904         unsigned int i;
 905         unsigned int curcpu;
 906
 907         /* Instead of clearing (by a previous call to memset())
 908          * the counters and using adds, we set the counters
 909          * with data used by 'current' CPU
 910          * We dont care about preemption here.
 911          */
 912         curcpu = raw_smp_processor_id();
 913
 914         i = 0;
 915         IPT_ENTRY_ITERATE(t->entries[curcpu],
 916                           t->size,
 917                           set_entry_to_counter,
 918                           counters,
 919                           &i);
 920
 921         for_each_possible_cpu(cpu) {
 922                 if (cpu == curcpu)
 923                         continue;
 924                 i = 0;
 925                 IPT_ENTRY_ITERATE(t->entries[cpu],
 926                                   t->size,
 927                                   add_entry_to_counter,
 928                                   counters,
 929                                   &i);
 930         }
 931 }
 932
 933 static struct xt_counters * alloc_counters(struct xt_table *table)
 934 {
 935         unsigned int countersize;
 936         struct xt_counters *counters;
 937         const struct xt_table_info *private = table->private;
 938
 939         /* We need atomic snapshot of counters: rest doesn't change
 940            (other than comefrom, which userspace doesn't care
 941            about). */
 942         countersize = sizeof(struct xt_counters) * private->number;
 943         counters = vmalloc_node(countersize, numa_node_id());
 944
 945         if (counters == NULL)
 946                 return ERR_PTR(-ENOMEM);
 947
 948         /* First, sum counters... */
 949         write_lock_bh(&table->lock);
 950         get_counters(private, counters);
 951         write_unlock_bh(&table->lock);
 952
 953         return counters;
 954 }
 955
 956 static int
 957 copy_entries_to_user(unsigned int total_size,
 958                      struct xt_table *table,
 959                      void __user *userptr)
 960 {
 961         unsigned int off, num;
 962         struct ipt_entry *e;
 963         struct xt_counters *counters;
 964         const struct xt_table_info *private = table->private;
 965         int ret = 0;
 966         const void *loc_cpu_entry;
 967
 968         counters = alloc_counters(table);
 969         if (IS_ERR(counters))
 970                 return PTR_ERR(counters);
 971
 972         /* choose the copy that is on our node/cpu, ...
 973          * This choice is lazy (because current thread is
 974          * allowed to migrate to another cpu)
 975          */
 976         loc_cpu_entry = private->entries[raw_smp_processor_id()];
 977         if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 978                 ret = -EFAULT;
 979                 goto free_counters;
 980         }
 981
 982         /* FIXME: use iterator macros --RR */
 983         /* ... then go back and fix counters and names */
 984         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 985                 unsigned int i;
 986                 const struct ipt_entry_match *m;
 987                 const struct ipt_entry_target *t;
 988
 989                 e = (struct ipt_entry *)(loc_cpu_entry + off);
 990                 if (copy_to_user(userptr + off
 991                                  + offsetof(struct ipt_entry, counters),
 992                                  &counters[num],
 993                                  sizeof(counters[num])) != 0) {
 994                         ret = -EFAULT;
 995                         goto free_counters;
 996                 }
 997
 998                 for (i = sizeof(struct ipt_entry);
 999                      i < e->target_offset;
1000                      i += m->u.match_size) {
1001                         m = (void *)e + i;
1002
1003                         if (copy_to_user(userptr + off + i
1004                                          + offsetof(struct ipt_entry_match,
1005                                                     u.user.name),
1006                                          m->u.kernel.match->name,
1007                                          strlen(m->u.kernel.match->name)+1)
1008                             != 0) {
1009                                 ret = -EFAULT;
1010                                 goto free_counters;
1011                         }
1012                 }
1013
1014                 t = ipt_get_target(e);
1015                 if (copy_to_user(userptr + off + e->target_offset
1016                                  + offsetof(struct ipt_entry_target,
1017                                             u.user.name),
1018                                  t->u.kernel.target->name,
1019                                  strlen(t->u.kernel.target->name)+1) != 0) {
1020                         ret = -EFAULT;
1021                         goto free_counters;
1022                 }
1023         }
1024
1025  free_counters:
1026         vfree(counters);
1027         return ret;
1028 }
1029
1030 #ifdef CONFIG_COMPAT
1031 static void compat_standard_from_user(void *dst, void *src)
1032 {
1033         int v = *(compat_int_t *)src;
1034
1035         if (v > 0)
1036                 v += xt_compat_calc_jump(AF_INET, v);
1037         memcpy(dst, &v, sizeof(v));
1038 }
1039
1040 static int compat_standard_to_user(void __user *dst, void *src)
1041 {
1042         compat_int_t cv = *(int *)src;
1043
1044         if (cv > 0)
1045                 cv -= xt_compat_calc_jump(AF_INET, cv);
1046         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
1047 }
1048
1049 static inline int
1050 compat_calc_match(struct ipt_entry_match *m, int *size)
1051 {
1052         *size += xt_compat_match_offset(m->u.kernel.match);
1053         return 0;
1054 }
1055
1056 static int compat_calc_entry(struct ipt_entry *e,
1057                              const struct xt_table_info *info,
1058                              void *base, struct xt_table_info *newinfo)
1059 {
1060         struct ipt_entry_target *t;
1061         unsigned int entry_offset;
1062         int off, i, ret;
1063
1064         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1065         entry_offset = (void *)e - base;
1066         IPT_MATCH_ITERATE(e, compat_calc_match, &off);
1067         t = ipt_get_target(e);
1068         off += xt_compat_target_offset(t->u.kernel.target);
1069         newinfo->size -= off;
1070         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1071         if (ret)
1072                 return ret;
1073
1074         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1075                 if (info->hook_entry[i] &&
1076                     (e < (struct ipt_entry *)(base + info->hook_entry[i])))
1077                         newinfo->hook_entry[i] -= off;
1078                 if (info->underflow[i] &&
1079                     (e < (struct ipt_entry *)(base + info->underflow[i])))
1080                         newinfo->underflow[i] -= off;
1081         }
1082         return 0;
1083 }
1084
1085 static int compat_table_info(const struct xt_table_info *info,
1086                              struct xt_table_info *newinfo)
1087 {
1088         void *loc_cpu_entry;
1089
1090         if (!newinfo || !info)
1091                 return -EINVAL;
1092
1093         /* we dont care about newinfo->entries[] */
1094         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
1095         newinfo->initial_entries = 0;
1096         loc_cpu_entry = info->entries[raw_smp_processor_id()];
1097         return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
1098                                  compat_calc_entry, info, loc_cpu_entry,
1099                                  newinfo);
1100 }
1101 #endif
1102
1103 static int get_info(struct net *net, void __user *user, int *len, int compat)
1104 {
1105         char name[IPT_TABLE_MAXNAMELEN];
1106         struct xt_table *t;
1107         int ret;
1108
1109         if (*len != sizeof(struct ipt_getinfo)) {
1110                 duprintf("length %u != %zu\n", *len,
1111                          sizeof(struct ipt_getinfo));
1112                 return -EINVAL;
1113         }
1114
1115         if (copy_from_user(name, user, sizeof(name)) != 0)
1116                 return -EFAULT;
1117
1118         name[IPT_TABLE_MAXNAMELEN-1] = '\0';
1119 #ifdef CONFIG_COMPAT
1120         if (compat)
1121                 xt_compat_lock(AF_INET);
1122 #endif
1123         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1124                                     "iptable_%s", name);
1125         if (t && !IS_ERR(t)) {
1126                 struct ipt_getinfo info;
1127                 const struct xt_table_info *private = t->private;
1128
1129 #ifdef CONFIG_COMPAT
1130                 if (compat) {
1131                         struct xt_table_info tmp;
1132                         ret = compat_table_info(private, &tmp);
1133                         xt_compat_flush_offsets(AF_INET);
1134                         private = &tmp;
1135                 }
1136 #endif
1137                 info.valid_hooks = t->valid_hooks;
1138                 memcpy(info.hook_entry, private->hook_entry,
1139                        sizeof(info.hook_entry));
1140                 memcpy(info.underflow, private->underflow,
1141                        sizeof(info.underflow));
1142                 info.num_entries = private->number;
1143                 info.size = private->size;
1144                 strcpy(info.name, name);
1145
1146                 if (copy_to_user(user, &info, *len) != 0)
1147                         ret = -EFAULT;
1148                 else
1149                         ret = 0;
1150
1151                 xt_table_unlock(t);
1152                 module_put(t->me);
1153         } else
1154                 ret = t ? PTR_ERR(t) : -ENOENT;
1155 #ifdef CONFIG_COMPAT
1156         if (compat)
1157                 xt_compat_unlock(AF_INET);
1158 #endif
1159         return ret;
1160 }
1161
1162 static int
1163 get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
1164 {
1165         int ret;
1166         struct ipt_get_entries get;
1167         struct xt_table *t;
1168
1169         if (*len < sizeof(get)) {
1170                 duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
1171                 return -EINVAL;
1172         }
1173         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1174                 return -EFAULT;
1175         if (*len != sizeof(struct ipt_get_entries) + get.size) {
1176                 duprintf("get_entries: %u != %zu\n",
1177                          *len, sizeof(get) + get.size);
1178                 return -EINVAL;
1179         }
1180
1181         t = xt_find_table_lock(net, AF_INET, get.name);
1182         if (t && !IS_ERR(t)) {
1183                 const struct xt_table_info *private = t->private;
1184                 duprintf("t->private->number = %u\n", private->number);
1185                 if (get.size == private->size)
1186                         ret = copy_entries_to_user(private->size,
1187                                                    t, uptr->entrytable);
1188                 else {
1189                         duprintf("get_entries: I've got %u not %u!\n",
1190                                  private->size, get.size);
1191                         ret = -EAGAIN;
1192                 }
1193                 module_put(t->me);
1194                 xt_table_unlock(t);
1195         } else
1196                 ret = t ? PTR_ERR(t) : -ENOENT;
1197
1198         return ret;
1199 }
1200
1201 static int
1202 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1203              struct xt_table_info *newinfo, unsigned int num_counters,
1204              void __user *counters_ptr)
1205 {
1206         int ret;
1207         struct xt_table *t;
1208         struct xt_table_info *oldinfo;
1209         struct xt_counters *counters;
1210         void *loc_cpu_old_entry;
1211
1212         ret = 0;
1213         counters = vmalloc(num_counters * sizeof(struct xt_counters));
1214         if (!counters) {
1215                 ret = -ENOMEM;
1216                 goto out;
1217         }
1218
1219         t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
1220                                     "iptable_%s", name);
1221         if (!t || IS_ERR(t)) {
1222                 ret = t ? PTR_ERR(t) : -ENOENT;
1223                 goto free_newinfo_counters_untrans;
1224         }
1225
1226         /* You lied! */
1227         if (valid_hooks != t->valid_hooks) {
1228                 duprintf("Valid hook crap: %08X vs %08X\n",
1229                          valid_hooks, t->valid_hooks);
1230                 ret = -EINVAL;
1231                 goto put_module;
1232         }
1233
1234         oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1235         if (!oldinfo)
1236                 goto put_module;
1237
1238         /* Update module usage count based on number of rules */
1239         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
1240                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
1241         if ((oldinfo->number > oldinfo->initial_entries) ||
1242             (newinfo->number <= oldinfo->initial_entries))
1243                 module_put(t->me);
1244         if ((oldinfo->number > oldinfo->initial_entries) &&
1245             (newinfo->number <= oldinfo->initial_entries))
1246                 module_put(t->me);
1247
1248         /* Get the old counters. */
1249         get_counters(oldinfo, counters);
1250         /* Decrease module usage counts and free resource */
1251         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
1252         IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
1253                           NULL);
1254         xt_free_table_info(oldinfo);
1255         if (copy_to_user(counters_ptr, counters,
1256                          sizeof(struct xt_counters) * num_counters) != 0)
1257                 ret = -EFAULT;
1258         vfree(counters);
1259         xt_table_unlock(t);
1260         return ret;
1261
1262  put_module:
1263         module_put(t->me);
1264         xt_table_unlock(t);
1265  free_newinfo_counters_untrans:
1266         vfree(counters);
1267  out:
1268         return ret;
1269 }
1270
1271 static int
1272 do_replace(struct net *net, void __user *user, unsigned int len)
1273 {
1274         int ret;
1275         struct ipt_replace tmp;
1276         struct xt_table_info *newinfo;
1277         void *loc_cpu_entry;
1278
1279         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1280                 return -EFAULT;
1281
1282         /* overflow check */
1283         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1284                 return -ENOMEM;
1285
1286         newinfo = xt_alloc_table_info(tmp.size);
1287         if (!newinfo)
1288                 return -ENOMEM;
1289
1290         /* choose the copy that is on our node/cpu */
1291         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1292         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1293                            tmp.size) != 0) {
1294                 ret = -EFAULT;
1295                 goto free_newinfo;
1296         }
1297
1298         ret = translate_table(tmp.name, tmp.valid_hooks,
1299                               newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
1300                               tmp.hook_entry, tmp.underflow);
1301         if (ret != 0)
1302                 goto free_newinfo;
1303
1304         duprintf("ip_tables: Translated table\n");
1305
1306         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1307                            tmp.num_counters, tmp.counters);
1308         if (ret)
1309                 goto free_newinfo_untrans;
1310         return 0;
1311
1312  free_newinfo_untrans:
1313         IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
1314  free_newinfo:
1315         xt_free_table_info(newinfo);
1316         return ret;
1317 }
1318
1319 /* We're lazy, and add to the first CPU; overflow works its fey magic
1320  * and everything is OK. */
1321 static int
1322 add_counter_to_entry(struct ipt_entry *e,
1323                      const struct xt_counters addme[],
1324                      unsigned int *i)
1325 {
1326 #if 0
1327         duprintf("add_counter: Entry %u %lu/%lu + %lu/%lu\n",
1328                  *i,
1329                  (long unsigned int)e->counters.pcnt,
1330                  (long unsigned int)e->counters.bcnt,
1331                  (long unsigned int)addme[*i].pcnt,
1332                  (long unsigned int)addme[*i].bcnt);
1333 #endif
1334
1335         ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
1336
1337         (*i)++;
1338         return 0;
1339 }
1340
1341 static int
1342 do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
1343 {
1344         unsigned int i;
1345         struct xt_counters_info tmp;
1346         struct xt_counters *paddc;
1347         unsigned int num_counters;
1348         const char *name;
1349         int size;
1350         void *ptmp;
1351         struct xt_table *t;
1352         const struct xt_table_info *private;
1353         int ret = 0;
1354         void *loc_cpu_entry;
1355 #ifdef CONFIG_COMPAT
1356         struct compat_xt_counters_info compat_tmp;
1357
1358         if (compat) {
1359                 ptmp = &compat_tmp;
1360                 size = sizeof(struct compat_xt_counters_info);
1361         } else
1362 #endif
1363         {
1364                 ptmp = &tmp;
1365                 size = sizeof(struct xt_counters_info);
1366         }
1367
1368         if (copy_from_user(ptmp, user, size) != 0)
1369                 return -EFAULT;
1370
1371 #ifdef CONFIG_COMPAT
1372         if (compat) {
1373                 num_counters = compat_tmp.num_counters;
1374                 name = compat_tmp.name;
1375         } else
1376 #endif
1377         {
1378                 num_counters = tmp.num_counters;
1379                 name = tmp.name;
1380         }
1381
1382         if (len != size + num_counters * sizeof(struct xt_counters))
1383                 return -EINVAL;
1384
1385         paddc = vmalloc_node(len - size, numa_node_id());
1386         if (!paddc)
1387                 return -ENOMEM;
1388
1389         if (copy_from_user(paddc, user + size, len - size) != 0) {
1390                 ret = -EFAULT;
1391                 goto free;
1392         }
1393
1394         t = xt_find_table_lock(net, AF_INET, name);
1395         if (!t || IS_ERR(t)) {
1396                 ret = t ? PTR_ERR(t) : -ENOENT;
1397                 goto free;
1398         }
1399
1400         write_lock_bh(&t->lock);
1401         private = t->private;
1402         if (private->number != num_counters) {
1403                 ret = -EINVAL;
1404                 goto unlock_up_free;
1405         }
1406
1407         i = 0;
1408         /* Choose the copy that is on our node */
1409         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1410         IPT_ENTRY_ITERATE(loc_cpu_entry,
1411                           private->size,
1412                           add_counter_to_entry,
1413                           paddc,
1414                           &i);
1415  unlock_up_free:
1416         write_unlock_bh(&t->lock);
1417         xt_table_unlock(t);
1418         module_put(t->me);
1419  free:
1420         vfree(paddc);
1421
1422         return ret;
1423 }
1424
1425 #ifdef CONFIG_COMPAT
1426 struct compat_ipt_replace {
1427         char                    name[IPT_TABLE_MAXNAMELEN];
1428         u32                     valid_hooks;
1429         u32                     num_entries;
1430         u32                     size;
1431         u32                     hook_entry[NF_INET_NUMHOOKS];
1432         u32                     underflow[NF_INET_NUMHOOKS];
1433         u32                     num_counters;
1434         compat_uptr_t           counters;       /* struct ipt_counters * */
1435         struct compat_ipt_entry entries[0];
1436 };
1437
1438 static int
1439 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1440                           unsigned int *size, struct xt_counters *counters,
1441                           unsigned int *i)
1442 {
1443         struct ipt_entry_target *t;
1444         struct compat_ipt_entry __user *ce;
1445         u_int16_t target_offset, next_offset;
1446         compat_uint_t origsize;
1447         int ret;
1448
1449         ret = -EFAULT;
1450         origsize = *size;
1451         ce = (struct compat_ipt_entry __user *)*dstptr;
1452         if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
1453                 goto out;
1454
1455         if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
1456                 goto out;
1457
1458         *dstptr += sizeof(struct compat_ipt_entry);
1459         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1460
1461         ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
1462         target_offset = e->target_offset - (origsize - *size);
1463         if (ret)
1464                 goto out;
1465         t = ipt_get_target(e);
1466         ret = xt_compat_target_to_user(t, dstptr, size);
1467         if (ret)
1468                 goto out;
1469         ret = -EFAULT;
1470         next_offset = e->next_offset - (origsize - *size);
1471         if (put_user(target_offset, &ce->target_offset))
1472                 goto out;
1473         if (put_user(next_offset, &ce->next_offset))
1474                 goto out;
1475
1476         (*i)++;
1477         return 0;
1478 out:
1479         return ret;
1480 }
1481
1482 static int
1483 compat_find_calc_match(struct ipt_entry_match *m,
1484                        const char *name,
1485                        const struct ipt_ip *ip,
1486                        unsigned int hookmask,
1487                        int *size, unsigned int *i)
1488 {
1489         struct xt_match *match;
1490
1491         match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
1492                                                       m->u.user.revision),
1493                                         "ipt_%s", m->u.user.name);
1494         if (IS_ERR(match) || !match) {
1495                 duprintf("compat_check_calc_match: `%s' not found\n",
1496                          m->u.user.name);
1497                 return match ? PTR_ERR(match) : -ENOENT;
1498         }
1499         m->u.kernel.match = match;
1500         *size += xt_compat_match_offset(match);
1501
1502         (*i)++;
1503         return 0;
1504 }
1505
1506 static int
1507 compat_release_match(struct ipt_entry_match *m, unsigned int *i)
1508 {
1509         if (i && (*i)-- == 0)
1510                 return 1;
1511
1512         module_put(m->u.kernel.match->me);
1513         return 0;
1514 }
1515
1516 static int
1517 compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
1518 {
1519         struct ipt_entry_target *t;
1520
1521         if (i && (*i)-- == 0)
1522                 return 1;
1523
1524         /* Cleanup all matches */
1525         COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL);
1526         t = compat_ipt_get_target(e);
1527         module_put(t->u.kernel.target->me);
1528         return 0;
1529 }
1530
1531 static int
1532 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1533                                   struct xt_table_info *newinfo,
1534                                   unsigned int *size,
1535                                   unsigned char *base,
1536                                   unsigned char *limit,
1537                                   unsigned int *hook_entries,
1538                                   unsigned int *underflows,
1539                                   unsigned int *i,
1540                                   const char *name)
1541 {
1542         struct ipt_entry_target *t;
1543         struct xt_target *target;
1544         unsigned int entry_offset;
1545         unsigned int j;
1546         int ret, off, h;
1547
1548         duprintf("check_compat_entry_size_and_hooks %p\n", e);
1549         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
1550             || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
1551                 duprintf("Bad offset %p, limit = %p\n", e, limit);
1552                 return -EINVAL;
1553         }
1554
1555         if (e->next_offset < sizeof(struct compat_ipt_entry) +
1556                              sizeof(struct compat_xt_entry_target)) {
1557                 duprintf("checking: element %p size %u\n",
1558                          e, e->next_offset);
1559                 return -EINVAL;
1560         }
1561
1562         /* For purposes of check_entry casting the compat entry is fine */
1563         ret = check_entry((struct ipt_entry *)e, name);
1564         if (ret)
1565                 return ret;
1566
1567         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1568         entry_offset = (void *)e - (void *)base;
1569         j = 0;
1570         ret = COMPAT_IPT_MATCH_ITERATE(e, compat_find_calc_match, name,
1571                                        &e->ip, e->comefrom, &off, &j);
1572         if (ret != 0)
1573                 goto release_matches;
1574
1575         t = compat_ipt_get_target(e);
1576         target = try_then_request_module(xt_find_target(AF_INET,
1577                                                         t->u.user.name,
1578                                                         t->u.user.revision),
1579                                          "ipt_%s", t->u.user.name);
1580         if (IS_ERR(target) || !target) {
1581                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
1582                          t->u.user.name);
1583                 ret = target ? PTR_ERR(target) : -ENOENT;
1584                 goto release_matches;
1585         }
1586         t->u.kernel.target = target;
1587
1588         off += xt_compat_target_offset(target);
1589         *size += off;
1590         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
1591         if (ret)
1592                 goto out;
1593
1594         /* Check hooks & underflows */
1595         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1596                 if ((unsigned char *)e - base == hook_entries[h])
1597                         newinfo->hook_entry[h] = hook_entries[h];
1598                 if ((unsigned char *)e - base == underflows[h])
1599                         newinfo->underflow[h] = underflows[h];
1600         }
1601
1602         /* Clear counters and comefrom */
1603         memset(&e->counters, 0, sizeof(e->counters));
1604         e->comefrom = 0;
1605
1606         (*i)++;
1607         return 0;
1608
1609 out:
1610         module_put(t->u.kernel.target->me);
1611 release_matches:
1612         IPT_MATCH_ITERATE(e, compat_release_match, &j);
1613         return ret;
1614 }
1615
1616 static int
1617 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1618                             unsigned int *size, const char *name,
1619                             struct xt_table_info *newinfo, unsigned char *base)
1620 {
1621         struct ipt_entry_target *t;
1622         struct xt_target *target;
1623         struct ipt_entry *de;
1624         unsigned int origsize;
1625         int ret, h;
1626
1627         ret = 0;
1628         origsize = *size;
1629         de = (struct ipt_entry *)*dstptr;
1630         memcpy(de, e, sizeof(struct ipt_entry));
1631         memcpy(&de->counters, &e->counters, sizeof(e->counters));
1632
1633         *dstptr += sizeof(struct ipt_entry);
1634         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1635
1636         ret = COMPAT_IPT_MATCH_ITERATE(e, xt_compat_match_from_user,
1637                                        dstptr, size);
1638         if (ret)
1639                 return ret;
1640         de->target_offset = e->target_offset - (origsize - *size);
1641         t = compat_ipt_get_target(e);
1642         target = t->u.kernel.target;
1643         xt_compat_target_from_user(t, dstptr, size);
1644
1645         de->next_offset = e->next_offset - (origsize - *size);
1646         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1647                 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1648                         newinfo->hook_entry[h] -= origsize - *size;
1649                 if ((unsigned char *)de - base < newinfo->underflow[h])
1650                         newinfo->underflow[h] -= origsize - *size;
1651         }
1652         return ret;
1653 }
1654
1655 static int
1656 compat_check_entry(struct ipt_entry *e, const char *name,
1657                                      unsigned int *i)
1658 {
1659         struct xt_mtchk_param mtpar;
1660         unsigned int j;
1661         int ret;
1662
1663         j = 0;
1664         mtpar.table     = name;
1665         mtpar.entryinfo = &e->ip;
1666         mtpar.hook_mask = e->comefrom;
1667         mtpar.family    = NFPROTO_IPV4;
1668         ret = IPT_MATCH_ITERATE(e, check_match, &mtpar, &j);
1669         if (ret)
1670                 goto cleanup_matches;
1671
1672         ret = check_target(e, name);
1673         if (ret)
1674                 goto cleanup_matches;
1675
1676         (*i)++;
1677         return 0;
1678
1679  cleanup_matches:
1680         IPT_MATCH_ITERATE(e, cleanup_match, &j);
1681         return ret;
1682 }
1683
1684 static int
1685 translate_compat_table(const char *name,
1686                        unsigned int valid_hooks,
1687                        struct xt_table_info **pinfo,
1688                        void **pentry0,
1689                        unsigned int total_size,
1690                        unsigned int number,
1691                        unsigned int *hook_entries,
1692                        unsigned int *underflows)
1693 {
1694         unsigned int i, j;
1695         struct xt_table_info *newinfo, *info;
1696         void *pos, *entry0, *entry1;
1697         unsigned int size;
1698         int ret;
1699
1700         info = *pinfo;
1701         entry0 = *pentry0;
1702         size = total_size;
1703         info->number = number;
1704
1705         /* Init all hooks to impossible value. */
1706         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1707                 info->hook_entry[i] = 0xFFFFFFFF;
1708                 info->underflow[i] = 0xFFFFFFFF;
1709         }
1710
1711         duprintf("translate_compat_table: size %u\n", info->size);
1712         j = 0;
1713         xt_compat_lock(AF_INET);
1714         /* Walk through entries, checking offsets. */
1715         ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
1716                                        check_compat_entry_size_and_hooks,
1717                                        info, &size, entry0,
1718                                        entry0 + total_size,
1719                                        hook_entries, underflows, &j, name);
1720         if (ret != 0)
1721                 goto out_unlock;
1722
1723         ret = -EINVAL;
1724         if (j != number) {
1725                 duprintf("translate_compat_table: %u not %u entries\n",
1726                          j, number);
1727                 goto out_unlock;
1728         }
1729
1730         /* Check hooks all assigned */
1731         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1732                 /* Only hooks which are valid */
1733                 if (!(valid_hooks & (1 << i)))
1734                         continue;
1735                 if (info->hook_entry[i] == 0xFFFFFFFF) {
1736                         duprintf("Invalid hook entry %u %u\n",
1737                                  i, hook_entries[i]);
1738                         goto out_unlock;
1739                 }
1740                 if (info->underflow[i] == 0xFFFFFFFF) {
1741                         duprintf("Invalid underflow %u %u\n",
1742                                  i, underflows[i]);
1743                         goto out_unlock;
1744                 }
1745         }
1746
1747         ret = -ENOMEM;
1748         newinfo = xt_alloc_table_info(size);
1749         if (!newinfo)
1750                 goto out_unlock;
1751
1752         newinfo->number = number;
1753         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1754                 newinfo->hook_entry[i] = info->hook_entry[i];
1755                 newinfo->underflow[i] = info->underflow[i];
1756         }
1757         entry1 = newinfo->entries[raw_smp_processor_id()];
1758         pos = entry1;
1759         size = total_size;
1760         ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
1761                                        compat_copy_entry_from_user,
1762                                        &pos, &size, name, newinfo, entry1);
1763         xt_compat_flush_offsets(AF_INET);
1764         xt_compat_unlock(AF_INET);
1765         if (ret)
1766                 goto free_newinfo;
1767
1768         ret = -ELOOP;
1769         if (!mark_source_chains(newinfo, valid_hooks, entry1))
1770                 goto free_newinfo;
1771
1772         i = 0;
1773         ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
1774                                 name, &i);
1775         if (ret) {
1776                 j -= i;
1777                 COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
1778                                                   compat_release_entry, &j);
1779                 IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
1780                 xt_free_table_info(newinfo);
1781                 return ret;
1782         }
1783
1784         /* And one copy for every other CPU */
1785         for_each_possible_cpu(i)
1786                 if (newinfo->entries[i] && newinfo->entries[i] != entry1)
1787                         memcpy(newinfo->entries[i], entry1, newinfo->size);
1788
1789         *pinfo = newinfo;
1790         *pentry0 = entry1;
1791         xt_free_table_info(info);
1792         return 0;
1793
1794 free_newinfo:
1795         xt_free_table_info(newinfo);
1796 out:
1797         COMPAT_IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
1798         return ret;
1799 out_unlock:
1800         xt_compat_flush_offsets(AF_INET);
1801         xt_compat_unlock(AF_INET);
1802         goto out;
1803 }
1804
1805 static int
1806 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1807 {
1808         int ret;
1809         struct compat_ipt_replace tmp;
1810         struct xt_table_info *newinfo;
1811         void *loc_cpu_entry;
1812
1813         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1814                 return -EFAULT;
1815
1816         /* overflow check */
1817         if (tmp.size >= INT_MAX / num_possible_cpus())
1818                 return -ENOMEM;
1819         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1820                 return -ENOMEM;
1821
1822         newinfo = xt_alloc_table_info(tmp.size);
1823         if (!newinfo)
1824                 return -ENOMEM;
1825
1826         /* choose the copy that is on our node/cpu */
1827         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
1828         if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1829                            tmp.size) != 0) {
1830                 ret = -EFAULT;
1831                 goto free_newinfo;
1832         }
1833
1834         ret = translate_compat_table(tmp.name, tmp.valid_hooks,
1835                                      &newinfo, &loc_cpu_entry, tmp.size,
1836                                      tmp.num_entries, tmp.hook_entry,
1837                                      tmp.underflow);
1838         if (ret != 0)
1839                 goto free_newinfo;
1840
1841         duprintf("compat_do_replace: Translated table\n");
1842
1843         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1844                            tmp.num_counters, compat_ptr(tmp.counters));
1845         if (ret)
1846                 goto free_newinfo_untrans;
1847         return 0;
1848
1849  free_newinfo_untrans:
1850         IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
1851  free_newinfo:
1852         xt_free_table_info(newinfo);
1853         return ret;
1854 }
1855
1856 static int
1857 compat_do_ipt_set_ctl(struct sock *sk,  int cmd, void __user *user,
1858                       unsigned int len)
1859 {
1860         int ret;
1861
1862         if (!capable(CAP_NET_ADMIN))
1863                 return -EPERM;
1864
1865         switch (cmd) {
1866         case IPT_SO_SET_REPLACE:
1867                 ret = compat_do_replace(sock_net(sk), user, len);
1868                 break;
1869
1870         case IPT_SO_SET_ADD_COUNTERS:
1871                 ret = do_add_counters(sock_net(sk), user, len, 1);
1872                 break;
1873
1874         default:
1875                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
1876                 ret = -EINVAL;
1877         }
1878
1879         return ret;
1880 }
1881
1882 struct compat_ipt_get_entries {
1883         char name[IPT_TABLE_MAXNAMELEN];
1884         compat_uint_t size;
1885         struct compat_ipt_entry entrytable[0];
1886 };
1887
1888 static int
1889 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1890                             void __user *userptr)
1891 {
1892         struct xt_counters *counters;
1893         const struct xt_table_info *private = table->private;
1894         void __user *pos;
1895         unsigned int size;
1896         int ret = 0;
1897         const void *loc_cpu_entry;
1898         unsigned int i = 0;
1899
1900         counters = alloc_counters(table);
1901         if (IS_ERR(counters))
1902                 return PTR_ERR(counters);
1903
1904         /* choose the copy that is on our node/cpu, ...
1905          * This choice is lazy (because current thread is
1906          * allowed to migrate to another cpu)
1907          */
1908         loc_cpu_entry = private->entries[raw_smp_processor_id()];
1909         pos = userptr;
1910         size = total_size;
1911         ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
1912                                 compat_copy_entry_to_user,
1913                                 &pos, &size, counters, &i);
1914
1915         vfree(counters);
1916         return ret;
1917 }
1918
1919 static int
1920 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1921                    int *len)
1922 {
1923         int ret;
1924         struct compat_ipt_get_entries get;
1925         struct xt_table *t;
1926
1927         if (*len < sizeof(get)) {
1928                 duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
1929                 return -EINVAL;
1930         }
1931
1932         if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1933                 return -EFAULT;
1934
1935         if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
1936                 duprintf("compat_get_entries: %u != %zu\n",
1937                          *len, sizeof(get) + get.size);
1938                 return -EINVAL;
1939         }
1940
1941         xt_compat_lock(AF_INET);
1942         t = xt_find_table_lock(net, AF_INET, get.name);
1943         if (t && !IS_ERR(t)) {
1944                 const struct xt_table_info *private = t->private;
1945                 struct xt_table_info info;
1946                 duprintf("t->private->number = %u\n", private->number);
1947                 ret = compat_table_info(private, &info);
1948                 if (!ret && get.size == info.size) {
1949                         ret = compat_copy_entries_to_user(private->size,
1950                                                           t, uptr->entrytable);
1951                 } else if (!ret) {
1952                         duprintf("compat_get_entries: I've got %u not %u!\n",
1953                                  private->size, get.size);
1954                         ret = -EAGAIN;
1955                 }
1956                 xt_compat_flush_offsets(AF_INET);
1957                 module_put(t->me);
1958                 xt_table_unlock(t);
1959         } else
1960                 ret = t ? PTR_ERR(t) : -ENOENT;
1961
1962         xt_compat_unlock(AF_INET);
1963         return ret;
1964 }
1965
1966 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
1967
1968 static int
1969 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1970 {
1971         int ret;
1972
1973         if (!capable(CAP_NET_ADMIN))
1974                 return -EPERM;
1975
1976         switch (cmd) {
1977         case IPT_SO_GET_INFO:
1978                 ret = get_info(sock_net(sk), user, len, 1);
1979                 break;
1980         case IPT_SO_GET_ENTRIES:
1981                 ret = compat_get_entries(sock_net(sk), user, len);
1982                 break;
1983         default:
1984                 ret = do_ipt_get_ctl(sk, cmd, user, len);
1985         }
1986         return ret;
1987 }
1988 #endif
1989
1990 static int
1991 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1992 {
1993         int ret;
1994
1995         if (!capable(CAP_NET_ADMIN))
1996                 return -EPERM;
1997
1998         switch (cmd) {
1999         case IPT_SO_SET_REPLACE:
2000                 ret = do_replace(sock_net(sk), user, len);
2001                 break;
2002
2003         case IPT_SO_SET_ADD_COUNTERS:
2004                 ret = do_add_counters(sock_net(sk), user, len, 0);
2005                 break;
2006
2007         default:
2008                 duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
2009                 ret = -EINVAL;
2010         }
2011
2012         return ret;
2013 }
2014
2015 static int
2016 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
2017 {
2018         int ret;
2019
2020         if (!capable(CAP_NET_ADMIN))
2021                 return -EPERM;
2022
2023         switch (cmd) {
2024         case IPT_SO_GET_INFO:
2025                 ret = get_info(sock_net(sk), user, len, 0);
2026                 break;
2027
2028         case IPT_SO_GET_ENTRIES:
2029                 ret = get_entries(sock_net(sk), user, len);
2030                 break;
2031
2032         case IPT_SO_GET_REVISION_MATCH:
2033         case IPT_SO_GET_REVISION_TARGET: {
2034                 struct ipt_get_revision rev;
2035                 int target;
2036
2037                 if (*len != sizeof(rev)) {
2038                         ret = -EINVAL;
2039                         break;
2040                 }
2041                 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
2042                         ret = -EFAULT;
2043                         break;
2044                 }
2045
2046                 if (cmd == IPT_SO_GET_REVISION_TARGET)
2047                         target = 1;
2048                 else
2049                         target = 0;
2050
2051                 try_then_request_module(xt_find_revision(AF_INET, rev.name,
2052                                                          rev.revision,
2053                                                          target, &ret),
2054                                         "ipt_%s", rev.name);
2055                 break;
2056         }
2057
2058         default:
2059                 duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
2060                 ret = -EINVAL;
2061         }
2062
2063         return ret;
2064 }
2065
2066 struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
2067                                     const struct ipt_replace *repl)
2068 {
2069         int ret;
2070         struct xt_table_info *newinfo;
2071         struct xt_table_info bootstrap
2072                 = { 0, 0, 0, { 0 }, { 0 }, { } };
2073         void *loc_cpu_entry;
2074         struct xt_table *new_table;
2075
2076         newinfo = xt_alloc_table_info(repl->size);
2077         if (!newinfo) {
2078                 ret = -ENOMEM;
2079                 goto out;
2080         }
2081
2082         /* choose the copy on our node/cpu, but dont care about preemption */
2083         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
2084         memcpy(loc_cpu_entry, repl->entries, repl->size);
2085
2086         ret = translate_table(table->name, table->valid_hooks,
2087                               newinfo, loc_cpu_entry, repl->size,
2088                               repl->num_entries,
2089                               repl->hook_entry,
2090                               repl->underflow);
2091         if (ret != 0)
2092                 goto out_free;
2093
2094         new_table = xt_register_table(net, table, &bootstrap, newinfo);
2095         if (IS_ERR(new_table)) {
2096                 ret = PTR_ERR(new_table);
2097                 goto out_free;
2098         }
2099
2100         return new_table;
2101
2102 out_free:
2103         xt_free_table_info(newinfo);
2104 out:
2105         return ERR_PTR(ret);
2106 }
2107
2108 void ipt_unregister_table(struct xt_table *table)
2109 {
2110         struct xt_table_info *private;
2111         void *loc_cpu_entry;
2112         struct module *table_owner = table->me;
2113
2114         private = xt_unregister_table(table);
2115
2116         /* Decrease module usage counts and free resources */
2117         loc_cpu_entry = private->entries[raw_smp_processor_id()];
2118         IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
2119         if (private->number > private->initial_entries)
2120                 module_put(table_owner);
2121         xt_free_table_info(private);
2122 }
2123
2124 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
2125 static inline bool
2126 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
2127                      u_int8_t type, u_int8_t code,
2128                      bool invert)
2129 {
2130         return ((test_type == 0xFF) ||
2131                 (type == test_type && code >= min_code && code <= max_code))
2132                 ^ invert;
2133 }
2134
2135 static bool
2136 icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
2137 {
2138         const struct icmphdr *ic;
2139         struct icmphdr _icmph;
2140         const struct ipt_icmp *icmpinfo = par->matchinfo;
2141
2142         /* Must not be a fragment. */
2143         if (par->fragoff != 0)
2144                 return false;
2145
2146         ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
2147         if (ic == NULL) {
2148                 /* We've been asked to examine this packet, and we
2149                  * can't.  Hence, no choice but to drop.
2150                  */
2151                 duprintf("Dropping evil ICMP tinygram.\n");
2152                 *par->hotdrop = true;
2153                 return false;
2154         }
2155
2156         return icmp_type_code_match(icmpinfo->type,
2157                                     icmpinfo->code[0],
2158                                     icmpinfo->code[1],
2159                                     ic->type, ic->code,
2160                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
2161 }
2162
2163 static bool icmp_checkentry(const struct xt_mtchk_param *par)
2164 {
2165         const struct ipt_icmp *icmpinfo = par->matchinfo;
2166
2167         /* Must specify no unknown invflags */
2168         return !(icmpinfo->invflags & ~IPT_ICMP_INV);
2169 }
2170
2171 /* The built-in targets: standard (NULL) and error. */
2172 static struct xt_target ipt_standard_target __read_mostly = {
2173         .name           = IPT_STANDARD_TARGET,
2174         .targetsize     = sizeof(int),
2175         .family         = AF_INET,
2176 #ifdef CONFIG_COMPAT
2177         .compatsize     = sizeof(compat_int_t),
2178         .compat_from_user = compat_standard_from_user,
2179         .compat_to_user = compat_standard_to_user,
2180 #endif
2181 };
2182
2183 static struct xt_target ipt_error_target __read_mostly = {
2184         .name           = IPT_ERROR_TARGET,
2185         .target         = ipt_error,
2186         .targetsize     = IPT_FUNCTION_MAXNAMELEN,
2187         .family         = AF_INET,
2188 };
2189
2190 static struct nf_sockopt_ops ipt_sockopts = {
2191         .pf             = PF_INET,
2192         .set_optmin     = IPT_BASE_CTL,
2193         .set_optmax     = IPT_SO_SET_MAX+1,
2194         .set            = do_ipt_set_ctl,
2195 #ifdef CONFIG_COMPAT
2196         .compat_set     = compat_do_ipt_set_ctl,
2197 #endif
2198         .get_optmin     = IPT_BASE_CTL,
2199         .get_optmax     = IPT_SO_GET_MAX+1,
2200         .get            = do_ipt_get_ctl,
2201 #ifdef CONFIG_COMPAT
2202         .compat_get     = compat_do_ipt_get_ctl,
2203 #endif
2204         .owner          = THIS_MODULE,
2205 };
2206
2207 static struct xt_match icmp_matchstruct __read_mostly = {
2208         .name           = "icmp",
2209         .match          = icmp_match,
2210         .matchsize      = sizeof(struct ipt_icmp),
2211         .checkentry     = icmp_checkentry,
2212         .proto          = IPPROTO_ICMP,
2213         .family         = AF_INET,
2214 };
2215
2216 static int __net_init ip_tables_net_init(struct net *net)
2217 {
2218         return xt_proto_init(net, AF_INET);
2219 }
2220
2221 static void __net_exit ip_tables_net_exit(struct net *net)
2222 {
2223         xt_proto_fini(net, AF_INET);
2224 }
2225
2226 static struct pernet_operations ip_tables_net_ops = {
2227         .init = ip_tables_net_init,
2228         .exit = ip_tables_net_exit,
2229 };
2230
2231 static int __init ip_tables_init(void)
2232 {
2233         int ret;
2234
2235         ret = register_pernet_subsys(&ip_tables_net_ops);
2236         if (ret < 0)
2237                 goto err1;
2238
2239         /* Noone else will be downing sem now, so we won't sleep */
2240         ret = xt_register_target(&ipt_standard_target);
2241         if (ret < 0)
2242                 goto err2;
2243         ret = xt_register_target(&ipt_error_target);
2244         if (ret < 0)
2245                 goto err3;
2246         ret = xt_register_match(&icmp_matchstruct);
2247         if (ret < 0)
2248                 goto err4;
2249
2250         /* Register setsockopt */
2251         ret = nf_register_sockopt(&ipt_sockopts);
2252         if (ret < 0)
2253                 goto err5;
2254
2255         printk(KERN_INFO "ip_tables: (C) 2000-2006 Netfilter Core Team\n");
2256         return 0;
2257
2258 err5:
2259         xt_unregister_match(&icmp_matchstruct);
2260 err4:
2261         xt_unregister_target(&ipt_error_target);
2262 err3:
2263         xt_unregister_target(&ipt_standard_target);
2264 err2:
2265         unregister_pernet_subsys(&ip_tables_net_ops);
2266 err1:
2267         return ret;
2268 }
2269
2270 static void __exit ip_tables_fini(void)
2271 {
2272         nf_unregister_sockopt(&ipt_sockopts);
2273
2274         xt_unregister_match(&icmp_matchstruct);
2275         xt_unregister_target(&ipt_error_target);
2276         xt_unregister_target(&ipt_standard_target);
2277
2278         unregister_pernet_subsys(&ip_tables_net_ops);
2279 }
2280
2281 EXPORT_SYMBOL(ipt_register_table);
2282 EXPORT_SYMBOL(ipt_unregister_table);
2283 EXPORT_SYMBOL(ipt_do_table);
2284 module_init(ip_tables_init);
2285 module_exit(ip_tables_fini);