1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* Packet matching code.
4	*
5	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
6	* Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
7	* Copyright (C) 2006-2010 Patrick McHardy <kaber@trash.net>
8	*/
9	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10	#include <linux/cache.h>
11	#include <linux/capability.h>
12	#include <linux/skbuff.h>
13	#include <linux/kmod.h>
14	#include <linux/vmalloc.h>
15	#include <linux/netdevice.h>
16	#include <linux/module.h>
17	#include <net/ip.h>
18	#include <net/compat.h>
19	#include <linux/uaccess.h>
20	#include <linux/mutex.h>
21	#include <linux/proc_fs.h>
22	#include <linux/err.h>
23	#include <linux/cpumask.h>
24
25	#include <linux/netfilter/x_tables.h>
26	#include <linux/netfilter_ipv4/ip_tables.h>
27	#include <net/netfilter/nf_log.h>
28	#include "../../netfilter/xt_repldata.h"
29
30	MODULE_LICENSE("GPL");
31	MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
32	MODULE_DESCRIPTION("IPv4 packet filter");
33
34	void *ipt_alloc_initial_table(const struct xt_table *info)
35	{
36	return xt_alloc_initial_table(ipt, IPT);
37	}
38	EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
39
40	/* Returns whether matches rule or not. */
41	/* Performance critical - called for every packet */
42	static inline bool
43	ip_packet_match(const struct iphdr *ip,
44	const char *indev,
45	const char *outdev,
46	const struct ipt_ip *ipinfo,
47	int isfrag)
48	{
49	unsigned long ret;
50
51	if (NF_INVF(ipinfo, IPT_INV_SRCIP,
52	(ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) ||
53	NF_INVF(ipinfo, IPT_INV_DSTIP,
54	(ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr))
55	return false;
56
57	ret = ifname_compare_aligned(a: indev, b: ipinfo->iniface, mask: ipinfo->iniface_mask);
58
59	if (NF_INVF(ipinfo, IPT_INV_VIA_IN, ret != 0))
60	return false;
61
62	ret = ifname_compare_aligned(a: outdev, b: ipinfo->outiface, mask: ipinfo->outiface_mask);
63
64	if (NF_INVF(ipinfo, IPT_INV_VIA_OUT, ret != 0))
65	return false;
66
67	/* Check specific protocol */
68	if (ipinfo->proto &&
69	NF_INVF(ipinfo, IPT_INV_PROTO, ip->protocol != ipinfo->proto))
70	return false;
71
72	/* If we have a fragment rule but the packet is not a fragment
73	* then we return zero */
74	if (NF_INVF(ipinfo, IPT_INV_FRAG,
75	(ipinfo->flags & IPT_F_FRAG) && !isfrag))
76	return false;
77
78	return true;
79	}
80
81	static bool
82	ip_checkentry(const struct ipt_ip *ip)
83	{
84	if (ip->flags & ~IPT_F_MASK)
85	return false;
86	if (ip->invflags & ~IPT_INV_MASK)
87	return false;
88	return true;
89	}
90
91	static unsigned int
92	ipt_error(struct sk_buff *skb, const struct xt_action_param *par)
93	{
94	net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
95
96	return NF_DROP;
97	}
98
99	/* Performance critical */
100	static inline struct ipt_entry *
101	get_entry(const void *base, unsigned int offset)
102	{
103	return (struct ipt_entry *)(base + offset);
104	}
105
106	/* All zeroes == unconditional rule. */
107	/* Mildly perf critical (only if packet tracing is on) */
108	static inline bool unconditional(const struct ipt_entry *e)
109	{
110	static const struct ipt_ip uncond;
111
112	return e->target_offset == sizeof(struct ipt_entry) &&
113	memcmp(p: &e->ip, q: &uncond, size: sizeof(uncond)) == 0;
114	}
115
116	/* for const-correctness */
117	static inline const struct xt_entry_target *
118	ipt_get_target_c(const struct ipt_entry *e)
119	{
120	return ipt_get_target(e: (struct ipt_entry *)e);
121	}
122
123	#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
124	static const char *const hooknames[] = {
125	[NF_INET_PRE_ROUTING] = "PREROUTING",
126	[NF_INET_LOCAL_IN] = "INPUT",
127	[NF_INET_FORWARD] = "FORWARD",
128	[NF_INET_LOCAL_OUT] = "OUTPUT",
129	[NF_INET_POST_ROUTING] = "POSTROUTING",
130	};
131
132	enum nf_ip_trace_comments {
133	NF_IP_TRACE_COMMENT_RULE,
134	NF_IP_TRACE_COMMENT_RETURN,
135	NF_IP_TRACE_COMMENT_POLICY,
136	};
137
138	static const char *const comments[] = {
139	[NF_IP_TRACE_COMMENT_RULE] = "rule",
140	[NF_IP_TRACE_COMMENT_RETURN] = "return",
141	[NF_IP_TRACE_COMMENT_POLICY] = "policy",
142	};
143
144	static const struct nf_loginfo trace_loginfo = {
145	.type = NF_LOG_TYPE_LOG,
146	.u = {
147	.log = {
148	.level = 4,
149	.logflags = NF_LOG_DEFAULT_MASK,
150	},
151	},
152	};
153
154	/* Mildly perf critical (only if packet tracing is on) */
155	static inline int
156	get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
157	const char *hookname, const char **chainname,
158	const char **comment, unsigned int *rulenum)
159	{
160	const struct xt_standard_target *t = (void *)ipt_get_target_c(e: s);
161
162	if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
163	/* Head of user chain: ERROR target with chainname */
164	*chainname = t->target.data;
165	(*rulenum) = 0;
166	} else if (s == e) {
167	(*rulenum)++;
168
169	if (unconditional(e: s) &&
170	strcmp(t->target.u.kernel.target->name,
171	XT_STANDARD_TARGET) == 0 &&
172	t->verdict < 0) {
173	/* Tail of chains: STANDARD target (return/policy) */
174	*comment = *chainname == hookname
175	? comments[NF_IP_TRACE_COMMENT_POLICY]
176	: comments[NF_IP_TRACE_COMMENT_RETURN];
177	}
178	return 1;
179	} else
180	(*rulenum)++;
181
182	return 0;
183	}
184
185	static void trace_packet(struct net *net,
186	const struct sk_buff *skb,
187	unsigned int hook,
188	const struct net_device *in,
189	const struct net_device *out,
190	const char *tablename,
191	const struct xt_table_info *private,
192	const struct ipt_entry *e)
193	{
194	const struct ipt_entry *root;
195	const char *hookname, *chainname, *comment;
196	const struct ipt_entry *iter;
197	unsigned int rulenum = 0;
198
199	root = get_entry(base: private->entries, offset: private->hook_entry[hook]);
200
201	hookname = chainname = hooknames[hook];
202	comment = comments[NF_IP_TRACE_COMMENT_RULE];
203
204	xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
205	if (get_chainname_rulenum(s: iter, e, hookname,
206	chainname: &chainname, comment: &comment, rulenum: &rulenum) != 0)
207	break;
208
209	nf_log_trace(net, AF_INET, hooknum: hook, skb, in, out, li: &trace_loginfo,
210	fmt: "TRACE: %s:%s:%s:%u ",
211	tablename, chainname, comment, rulenum);
212	}
213	#endif
214
215	static inline
216	struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
217	{
218	return (void *)entry + entry->next_offset;
219	}
220
221	/* Returns one of the generic firewall policies, like NF_ACCEPT. */
222	unsigned int
223	ipt_do_table(void *priv,
224	struct sk_buff *skb,
225	const struct nf_hook_state *state)
226	{
227	const struct xt_table *table = priv;
228	unsigned int hook = state->hook;
229	static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
230	const struct iphdr *ip;
231	/* Initializing verdict to NF_DROP keeps gcc happy. */
232	unsigned int verdict = NF_DROP;
233	const char *indev, *outdev;
234	const void *table_base;
235	struct ipt_entry *e, **jumpstack;
236	unsigned int stackidx, cpu;
237	const struct xt_table_info *private;
238	struct xt_action_param acpar;
239	unsigned int addend;
240
241	/* Initialization */
242	stackidx = 0;
243	ip = ip_hdr(skb);
244	indev = state->in ? state->in->name : nulldevname;
245	outdev = state->out ? state->out->name : nulldevname;
246	/* We handle fragments by dealing with the first fragment as
247	* if it was a normal packet. All other fragments are treated
248	* normally, except that they will NEVER match rules that ask
249	* things we don't know, ie. tcp syn flag or ports). If the
250	* rule is also a fragment-specific rule, non-fragments won't
251	* match it. */
252	acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
253	acpar.thoff = ip_hdrlen(skb);
254	acpar.hotdrop = false;
255	acpar.state = state;
256
257	WARN_ON(!(table->valid_hooks & (1 << hook)));
258	local_bh_disable();
259	addend = xt_write_recseq_begin();
260	private = READ_ONCE(table->private); /* Address dependency. */
261	cpu = smp_processor_id();
262	table_base = private->entries;
263	jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
264
265	/* Switch to alternate jumpstack if we're being invoked via TEE.
266	* TEE issues XT_CONTINUE verdict on original skb so we must not
267	* clobber the jumpstack.
268	*
269	* For recursion via REJECT or SYNPROXY the stack will be clobbered
270	* but it is no problem since absolute verdict is issued by these.
271	*/
272	if (static_key_false(key: &xt_tee_enabled))
273	jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
274
275	e = get_entry(base: table_base, offset: private->hook_entry[hook]);
276
277	do {
278	const struct xt_entry_target *t;
279	const struct xt_entry_match *ematch;
280	struct xt_counters *counter;
281
282	WARN_ON(!e);
283	if (!ip_packet_match(ip, indev, outdev,
284	ipinfo: &e->ip, isfrag: acpar.fragoff)) {
285	no_match:
286	e = ipt_next_entry(entry: e);
287	continue;
288	}
289
290	xt_ematch_foreach(ematch, e) {
291	acpar.match = ematch->u.kernel.match;
292	acpar.matchinfo = ematch->data;
293	if (!acpar.match->match(skb, &acpar))
294	goto no_match;
295	}
296
297	counter = xt_get_this_cpu_counter(cnt: &e->counters);
298	ADD_COUNTER(*counter, skb->len, 1);
299
300	t = ipt_get_target_c(e);
301	WARN_ON(!t->u.kernel.target);
302
303	#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
304	/* The packet is traced: log it */
305	if (unlikely(skb->nf_trace))
306	trace_packet(net: state->net, skb, hook, in: state->in,
307	out: state->out, tablename: table->name, private, e);
308	#endif
309	/* Standard target? */
310	if (!t->u.kernel.target->target) {
311	int v;
312
313	v = ((struct xt_standard_target *)t)->verdict;
314	if (v < 0) {
315	/* Pop from stack? */
316	if (v != XT_RETURN) {
317	verdict = (unsigned int)(-v) - 1;
318	break;
319	}
320	if (stackidx == 0) {
321	e = get_entry(base: table_base,
322	offset: private->underflow[hook]);
323	} else {
324	e = jumpstack[--stackidx];
325	e = ipt_next_entry(entry: e);
326	}
327	continue;
328	}
329	if (table_base + v != ipt_next_entry(entry: e) &&
330	!(e->ip.flags & IPT_F_GOTO)) {
331	if (unlikely(stackidx >= private->stacksize)) {
332	verdict = NF_DROP;
333	break;
334	}
335	jumpstack[stackidx++] = e;
336	}
337
338	e = get_entry(base: table_base, offset: v);
339	continue;
340	}
341
342	acpar.target = t->u.kernel.target;
343	acpar.targinfo = t->data;
344
345	verdict = t->u.kernel.target->target(skb, &acpar);
346	if (verdict == XT_CONTINUE) {
347	/* Target might have changed stuff. */
348	ip = ip_hdr(skb);
349	e = ipt_next_entry(entry: e);
350	} else {
351	/* Verdict */
352	break;
353	}
354	} while (!acpar.hotdrop);
355
356	xt_write_recseq_end(addend);
357	local_bh_enable();
358
359	if (acpar.hotdrop)
360	return NF_DROP;
361	else return verdict;
362	}
363
364	/* Figures out from what hook each rule can be called: returns 0 if
365	there are loops. Puts hook bitmask in comefrom. */
366	static int
367	mark_source_chains(const struct xt_table_info *newinfo,
368	unsigned int valid_hooks, void *entry0,
369	unsigned int *offsets)
370	{
371	unsigned int hook;
372
373	/* No recursion; use packet counter to save back ptrs (reset
374	to 0 as we leave), and comefrom to save source hook bitmask */
375	for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
376	unsigned int pos = newinfo->hook_entry[hook];
377	struct ipt_entry *e = entry0 + pos;
378
379	if (!(valid_hooks & (1 << hook)))
380	continue;
381
382	/* Set initial back pointer. */
383	e->counters.pcnt = pos;
384
385	for (;;) {
386	const struct xt_standard_target *t
387	= (void *)ipt_get_target_c(e);
388	int visited = e->comefrom & (1 << hook);
389
390	if (e->comefrom & (1 << NF_INET_NUMHOOKS))
391	return 0;
392
393	e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
394
395	/* Unconditional return/END. */
396	if ((unconditional(e) &&
397	(strcmp(t->target.u.user.name,
398	XT_STANDARD_TARGET) == 0) &&
399	t->verdict < 0) || visited) {
400	unsigned int oldpos, size;
401
402	/* Return: backtrack through the last
403	big jump. */
404	do {
405	e->comefrom ^= (1<<NF_INET_NUMHOOKS);
406	oldpos = pos;
407	pos = e->counters.pcnt;
408	e->counters.pcnt = 0;
409
410	/* We're at the start. */
411	if (pos == oldpos)
412	goto next;
413
414	e = entry0 + pos;
415	} while (oldpos == pos + e->next_offset);
416
417	/* Move along one */
418	size = e->next_offset;
419	e = entry0 + pos + size;
420	if (pos + size >= newinfo->size)
421	return 0;
422	e->counters.pcnt = pos;
423	pos += size;
424	} else {
425	int newpos = t->verdict;
426
427	if (strcmp(t->target.u.user.name,
428	XT_STANDARD_TARGET) == 0 &&
429	newpos >= 0) {
430	/* This a jump; chase it. */
431	if (!xt_find_jump_offset(offsets, target: newpos,
432	size: newinfo->number))
433	return 0;
434	} else {
435	/* ... this is a fallthru */
436	newpos = pos + e->next_offset;
437	if (newpos >= newinfo->size)
438	return 0;
439	}
440	e = entry0 + newpos;
441	e->counters.pcnt = pos;
442	pos = newpos;
443	}
444	}
445	next: ;
446	}
447	return 1;
448	}
449
450	static void cleanup_match(struct xt_entry_match *m, struct net *net)
451	{
452	struct xt_mtdtor_param par;
453
454	par.net = net;
455	par.match = m->u.kernel.match;
456	par.matchinfo = m->data;
457	par.family = NFPROTO_IPV4;
458	if (par.match->destroy != NULL)
459	par.match->destroy(&par);
460	module_put(module: par.match->me);
461	}
462
463	static int
464	check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
465	{
466	const struct ipt_ip *ip = par->entryinfo;
467
468	par->match = m->u.kernel.match;
469	par->matchinfo = m->data;
470
471	return xt_check_match(par, size: m->u.match_size - sizeof(*m),
472	proto: ip->proto, inv_proto: ip->invflags & IPT_INV_PROTO);
473	}
474
475	static int
476	find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
477	{
478	struct xt_match *match;
479	int ret;
480
481	match = xt_request_find_match(af: NFPROTO_IPV4, name: m->u.user.name,
482	revision: m->u.user.revision);
483	if (IS_ERR(ptr: match))
484	return PTR_ERR(ptr: match);
485	m->u.kernel.match = match;
486
487	ret = check_match(m, par);
488	if (ret)
489	goto err;
490
491	return 0;
492	err:
493	module_put(module: m->u.kernel.match->me);
494	return ret;
495	}
496
497	static int check_target(struct ipt_entry *e, struct net *net, const char *name)
498	{
499	struct xt_entry_target *t = ipt_get_target(e);
500	struct xt_tgchk_param par = {
501	.net = net,
502	.table = name,
503	.entryinfo = e,
504	.target = t->u.kernel.target,
505	.targinfo = t->data,
506	.hook_mask = e->comefrom,
507	.family = NFPROTO_IPV4,
508	};
509
510	return xt_check_target(&par, size: t->u.target_size - sizeof(*t),
511	proto: e->ip.proto, inv_proto: e->ip.invflags & IPT_INV_PROTO);
512	}
513
514	static int
515	find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
516	unsigned int size,
517	struct xt_percpu_counter_alloc_state *alloc_state)
518	{
519	struct xt_entry_target *t;
520	struct xt_target *target;
521	int ret;
522	unsigned int j;
523	struct xt_mtchk_param mtpar;
524	struct xt_entry_match *ematch;
525
526	if (!xt_percpu_counter_alloc(state: alloc_state, counter: &e->counters))
527	return -ENOMEM;
528
529	j = 0;
530	memset(&mtpar, 0, sizeof(mtpar));
531	mtpar.net = net;
532	mtpar.table = name;
533	mtpar.entryinfo = &e->ip;
534	mtpar.hook_mask = e->comefrom;
535	mtpar.family = NFPROTO_IPV4;
536	xt_ematch_foreach(ematch, e) {
537	ret = find_check_match(m: ematch, par: &mtpar);
538	if (ret != 0)
539	goto cleanup_matches;
540	++j;
541	}
542
543	t = ipt_get_target(e);
544	target = xt_request_find_target(af: NFPROTO_IPV4, name: t->u.user.name,
545	revision: t->u.user.revision);
546	if (IS_ERR(ptr: target)) {
547	ret = PTR_ERR(ptr: target);
548	goto cleanup_matches;
549	}
550	t->u.kernel.target = target;
551
552	ret = check_target(e, net, name);
553	if (ret)
554	goto err;
555
556	return 0;
557	err:
558	module_put(module: t->u.kernel.target->me);
559	cleanup_matches:
560	xt_ematch_foreach(ematch, e) {
561	if (j-- == 0)
562	break;
563	cleanup_match(m: ematch, net);
564	}
565
566	xt_percpu_counter_free(cnt: &e->counters);
567
568	return ret;
569	}
570
571	static bool check_underflow(const struct ipt_entry *e)
572	{
573	const struct xt_entry_target *t;
574	unsigned int verdict;
575
576	if (!unconditional(e))
577	return false;
578	t = ipt_get_target_c(e);
579	if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
580	return false;
581	verdict = ((struct xt_standard_target *)t)->verdict;
582	verdict = -verdict - 1;
583	return verdict == NF_DROP || verdict == NF_ACCEPT;
584	}
585
586	static int
587	check_entry_size_and_hooks(struct ipt_entry *e,
588	struct xt_table_info *newinfo,
589	const unsigned char *base,
590	const unsigned char *limit,
591	const unsigned int *hook_entries,
592	const unsigned int *underflows,
593	unsigned int valid_hooks)
594	{
595	unsigned int h;
596	int err;
597
598	if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
599	(unsigned char *)e + sizeof(struct ipt_entry) >= limit ||
600	(unsigned char *)e + e->next_offset > limit)
601	return -EINVAL;
602
603	if (e->next_offset
604	< sizeof(struct ipt_entry) + sizeof(struct xt_entry_target))
605	return -EINVAL;
606
607	if (!ip_checkentry(ip: &e->ip))
608	return -EINVAL;
609
610	err = xt_check_entry_offsets(base: e, elems: e->elems, target_offset: e->target_offset,
611	next_offset: e->next_offset);
612	if (err)
613	return err;
614
615	/* Check hooks & underflows */
616	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
617	if (!(valid_hooks & (1 << h)))
618	continue;
619	if ((unsigned char *)e - base == hook_entries[h])
620	newinfo->hook_entry[h] = hook_entries[h];
621	if ((unsigned char *)e - base == underflows[h]) {
622	if (!check_underflow(e))
623	return -EINVAL;
624
625	newinfo->underflow[h] = underflows[h];
626	}
627	}
628
629	/* Clear counters and comefrom */
630	e->counters = ((struct xt_counters) { 0, 0 });
631	e->comefrom = 0;
632	return 0;
633	}
634
635	static void
636	cleanup_entry(struct ipt_entry *e, struct net *net)
637	{
638	struct xt_tgdtor_param par;
639	struct xt_entry_target *t;
640	struct xt_entry_match *ematch;
641
642	/* Cleanup all matches */
643	xt_ematch_foreach(ematch, e)
644	cleanup_match(m: ematch, net);
645	t = ipt_get_target(e);
646
647	par.net = net;
648	par.target = t->u.kernel.target;
649	par.targinfo = t->data;
650	par.family = NFPROTO_IPV4;
651	if (par.target->destroy != NULL)
652	par.target->destroy(&par);
653	module_put(module: par.target->me);
654	xt_percpu_counter_free(cnt: &e->counters);
655	}
656
657	/* Checks and translates the user-supplied table segment (held in
658	newinfo) */
659	static int
660	translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
661	const struct ipt_replace *repl)
662	{
663	struct xt_percpu_counter_alloc_state alloc_state = { 0 };
664	struct ipt_entry *iter;
665	unsigned int *offsets;
666	unsigned int i;
667	int ret = 0;
668
669	newinfo->size = repl->size;
670	newinfo->number = repl->num_entries;
671
672	/* Init all hooks to impossible value. */
673	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
674	newinfo->hook_entry[i] = 0xFFFFFFFF;
675	newinfo->underflow[i] = 0xFFFFFFFF;
676	}
677
678	offsets = xt_alloc_entry_offsets(size: newinfo->number);
679	if (!offsets)
680	return -ENOMEM;
681	i = 0;
682	/* Walk through entries, checking offsets. */
683	xt_entry_foreach(iter, entry0, newinfo->size) {
684	ret = check_entry_size_and_hooks(e: iter, newinfo, base: entry0,
685	limit: entry0 + repl->size,
686	hook_entries: repl->hook_entry,
687	underflows: repl->underflow,
688	valid_hooks: repl->valid_hooks);
689	if (ret != 0)
690	goto out_free;
691	if (i < repl->num_entries)
692	offsets[i] = (void *)iter - entry0;
693	++i;
694	if (strcmp(ipt_get_target(e: iter)->u.user.name,
695	XT_ERROR_TARGET) == 0)
696	++newinfo->stacksize;
697	}
698
699	ret = -EINVAL;
700	if (i != repl->num_entries)
701	goto out_free;
702
703	ret = xt_check_table_hooks(info: newinfo, valid_hooks: repl->valid_hooks);
704	if (ret)
705	goto out_free;
706
707	if (!mark_source_chains(newinfo, valid_hooks: repl->valid_hooks, entry0, offsets)) {
708	ret = -ELOOP;
709	goto out_free;
710	}
711	kvfree(addr: offsets);
712
713	/* Finally, each sanity check must pass */
714	i = 0;
715	xt_entry_foreach(iter, entry0, newinfo->size) {
716	ret = find_check_entry(e: iter, net, name: repl->name, size: repl->size,
717	alloc_state: &alloc_state);
718	if (ret != 0)
719	break;
720	++i;
721	}
722
723	if (ret != 0) {
724	xt_entry_foreach(iter, entry0, newinfo->size) {
725	if (i-- == 0)
726	break;
727	cleanup_entry(e: iter, net);
728	}
729	return ret;
730	}
731
732	return ret;
733	out_free:
734	kvfree(addr: offsets);
735	return ret;
736	}
737
738	static void
739	get_counters(const struct xt_table_info *t,
740	struct xt_counters counters[])
741	{
742	struct ipt_entry *iter;
743	unsigned int cpu;
744	unsigned int i;
745
746	for_each_possible_cpu(cpu) {
747	seqcount_t *s = &per_cpu(xt_recseq, cpu);
748
749	i = 0;
750	xt_entry_foreach(iter, t->entries, t->size) {
751	struct xt_counters *tmp;
752	u64 bcnt, pcnt;
753	unsigned int start;
754
755	tmp = xt_get_per_cpu_counter(cnt: &iter->counters, cpu);
756	do {
757	start = read_seqcount_begin(s);
758	bcnt = tmp->bcnt;
759	pcnt = tmp->pcnt;
760	} while (read_seqcount_retry(s, start));
761
762	ADD_COUNTER(counters[i], bcnt, pcnt);
763	++i; /* macro does multi eval of i */
764	cond_resched();
765	}
766	}
767	}
768
769	static void get_old_counters(const struct xt_table_info *t,
770	struct xt_counters counters[])
771	{
772	struct ipt_entry *iter;
773	unsigned int cpu, i;
774
775	for_each_possible_cpu(cpu) {
776	i = 0;
777	xt_entry_foreach(iter, t->entries, t->size) {
778	const struct xt_counters *tmp;
779
780	tmp = xt_get_per_cpu_counter(cnt: &iter->counters, cpu);
781	ADD_COUNTER(counters[i], tmp->bcnt, tmp->pcnt);
782	++i; /* macro does multi eval of i */
783	}
784
785	cond_resched();
786	}
787	}
788
789	static struct xt_counters *alloc_counters(const struct xt_table *table)
790	{
791	unsigned int countersize;
792	struct xt_counters *counters;
793	const struct xt_table_info *private = table->private;
794
795	/* We need atomic snapshot of counters: rest doesn't change
796	(other than comefrom, which userspace doesn't care
797	about). */
798	countersize = sizeof(struct xt_counters) * private->number;
799	counters = vzalloc(size: countersize);
800
801	if (counters == NULL)
802	return ERR_PTR(error: -ENOMEM);
803
804	get_counters(t: private, counters);
805
806	return counters;
807	}
808
809	static int
810	copy_entries_to_user(unsigned int total_size,
811	const struct xt_table *table,
812	void __user *userptr)
813	{
814	unsigned int off, num;
815	const struct ipt_entry *e;
816	struct xt_counters *counters;
817	const struct xt_table_info *private = table->private;
818	int ret = 0;
819	const void *loc_cpu_entry;
820
821	counters = alloc_counters(table);
822	if (IS_ERR(ptr: counters))
823	return PTR_ERR(ptr: counters);
824
825	loc_cpu_entry = private->entries;
826
827	/* FIXME: use iterator macros --RR */
828	/* ... then go back and fix counters and names */
829	for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
830	unsigned int i;
831	const struct xt_entry_match *m;
832	const struct xt_entry_target *t;
833
834	e = loc_cpu_entry + off;
835	if (copy_to_user(to: userptr + off, from: e, n: sizeof(*e))) {
836	ret = -EFAULT;
837	goto free_counters;
838	}
839	if (copy_to_user(to: userptr + off
840	+ offsetof(struct ipt_entry, counters),
841	from: &counters[num],
842	n: sizeof(counters[num])) != 0) {
843	ret = -EFAULT;
844	goto free_counters;
845	}
846
847	for (i = sizeof(struct ipt_entry);
848	i < e->target_offset;
849	i += m->u.match_size) {
850	m = (void *)e + i;
851
852	if (xt_match_to_user(m, u: userptr + off + i)) {
853	ret = -EFAULT;
854	goto free_counters;
855	}
856	}
857
858	t = ipt_get_target_c(e);
859	if (xt_target_to_user(t, u: userptr + off + e->target_offset)) {
860	ret = -EFAULT;
861	goto free_counters;
862	}
863	}
864
865	free_counters:
866	vfree(addr: counters);
867	return ret;
868	}
869
870	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
871	static void compat_standard_from_user(void *dst, const void *src)
872	{
873	int v = *(compat_int_t *)src;
874
875	if (v > 0)
876	v += xt_compat_calc_jump(AF_INET, offset: v);
877	memcpy(dst, &v, sizeof(v));
878	}
879
880	static int compat_standard_to_user(void __user *dst, const void *src)
881	{
882	compat_int_t cv = *(int *)src;
883
884	if (cv > 0)
885	cv -= xt_compat_calc_jump(AF_INET, offset: cv);
886	return copy_to_user(to: dst, from: &cv, n: sizeof(cv)) ? -EFAULT : 0;
887	}
888
889	static int compat_calc_entry(const struct ipt_entry *e,
890	const struct xt_table_info *info,
891	const void *base, struct xt_table_info *newinfo)
892	{
893	const struct xt_entry_match *ematch;
894	const struct xt_entry_target *t;
895	unsigned int entry_offset;
896	int off, i, ret;
897
898	off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
899	entry_offset = (void *)e - base;
900	xt_ematch_foreach(ematch, e)
901	off += xt_compat_match_offset(match: ematch->u.kernel.match);
902	t = ipt_get_target_c(e);
903	off += xt_compat_target_offset(target: t->u.kernel.target);
904	newinfo->size -= off;
905	ret = xt_compat_add_offset(AF_INET, offset: entry_offset, delta: off);
906	if (ret)
907	return ret;
908
909	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
910	if (info->hook_entry[i] &&
911	(e < (struct ipt_entry *)(base + info->hook_entry[i])))
912	newinfo->hook_entry[i] -= off;
913	if (info->underflow[i] &&
914	(e < (struct ipt_entry *)(base + info->underflow[i])))
915	newinfo->underflow[i] -= off;
916	}
917	return 0;
918	}
919
920	static int compat_table_info(const struct xt_table_info *info,
921	struct xt_table_info *newinfo)
922	{
923	struct ipt_entry *iter;
924	const void *loc_cpu_entry;
925	int ret;
926
927	if (!newinfo || !info)
928	return -EINVAL;
929
930	/* we dont care about newinfo->entries */
931	memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
932	newinfo->initial_entries = 0;
933	loc_cpu_entry = info->entries;
934	ret = xt_compat_init_offsets(AF_INET, number: info->number);
935	if (ret)
936	return ret;
937	xt_entry_foreach(iter, loc_cpu_entry, info->size) {
938	ret = compat_calc_entry(e: iter, info, base: loc_cpu_entry, newinfo);
939	if (ret != 0)
940	return ret;
941	}
942	return 0;
943	}
944	#endif
945
946	static int get_info(struct net *net, void __user *user, const int *len)
947	{
948	char name[XT_TABLE_MAXNAMELEN];
949	struct xt_table *t;
950	int ret;
951
952	if (*len != sizeof(struct ipt_getinfo))
953	return -EINVAL;
954
955	if (copy_from_user(to: name, from: user, n: sizeof(name)) != 0)
956	return -EFAULT;
957
958	name[XT_TABLE_MAXNAMELEN-1] = '\0';
959	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
960	if (in_compat_syscall())
961	xt_compat_lock(AF_INET);
962	#endif
963	t = xt_request_find_table_lock(net, AF_INET, name);
964	if (!IS_ERR(ptr: t)) {
965	struct ipt_getinfo info;
966	const struct xt_table_info *private = t->private;
967	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
968	struct xt_table_info tmp;
969
970	if (in_compat_syscall()) {
971	ret = compat_table_info(info: private, newinfo: &tmp);
972	xt_compat_flush_offsets(AF_INET);
973	private = &tmp;
974	}
975	#endif
976	memset(&info, 0, sizeof(info));
977	info.valid_hooks = t->valid_hooks;
978	memcpy(info.hook_entry, private->hook_entry,
979	sizeof(info.hook_entry));
980	memcpy(info.underflow, private->underflow,
981	sizeof(info.underflow));
982	info.num_entries = private->number;
983	info.size = private->size;
984	strcpy(p: info.name, q: name);
985
986	if (copy_to_user(to: user, from: &info, n: *len) != 0)
987	ret = -EFAULT;
988	else
989	ret = 0;
990
991	xt_table_unlock(t);
992	module_put(module: t->me);
993	} else
994	ret = PTR_ERR(ptr: t);
995	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
996	if (in_compat_syscall())
997	xt_compat_unlock(AF_INET);
998	#endif
999	return ret;
1000	}
1001
1002	static int
1003	get_entries(struct net *net, struct ipt_get_entries __user *uptr,
1004	const int *len)
1005	{
1006	int ret;
1007	struct ipt_get_entries get;
1008	struct xt_table *t;
1009
1010	if (*len < sizeof(get))
1011	return -EINVAL;
1012	if (copy_from_user(to: &get, from: uptr, n: sizeof(get)) != 0)
1013	return -EFAULT;
1014	if (*len != sizeof(struct ipt_get_entries) + get.size)
1015	return -EINVAL;
1016	get.name[sizeof(get.name) - 1] = '\0';
1017
1018	t = xt_find_table_lock(net, AF_INET, name: get.name);
1019	if (!IS_ERR(ptr: t)) {
1020	const struct xt_table_info *private = t->private;
1021	if (get.size == private->size)
1022	ret = copy_entries_to_user(total_size: private->size,
1023	table: t, userptr: uptr->entrytable);
1024	else
1025	ret = -EAGAIN;
1026
1027	module_put(module: t->me);
1028	xt_table_unlock(t);
1029	} else
1030	ret = PTR_ERR(ptr: t);
1031
1032	return ret;
1033	}
1034
1035	static int
1036	__do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1037	struct xt_table_info *newinfo, unsigned int num_counters,
1038	void __user *counters_ptr)
1039	{
1040	int ret;
1041	struct xt_table *t;
1042	struct xt_table_info *oldinfo;
1043	struct xt_counters *counters;
1044	struct ipt_entry *iter;
1045
1046	counters = xt_counters_alloc(counters: num_counters);
1047	if (!counters) {
1048	ret = -ENOMEM;
1049	goto out;
1050	}
1051
1052	t = xt_request_find_table_lock(net, AF_INET, name);
1053	if (IS_ERR(ptr: t)) {
1054	ret = PTR_ERR(ptr: t);
1055	goto free_newinfo_counters_untrans;
1056	}
1057
1058	/* You lied! */
1059	if (valid_hooks != t->valid_hooks) {
1060	ret = -EINVAL;
1061	goto put_module;
1062	}
1063
1064	oldinfo = xt_replace_table(table: t, num_counters, newinfo, error: &ret);
1065	if (!oldinfo)
1066	goto put_module;
1067
1068	/* Update module usage count based on number of rules */
1069	if ((oldinfo->number > oldinfo->initial_entries) ||
1070	(newinfo->number <= oldinfo->initial_entries))
1071	module_put(module: t->me);
1072	if ((oldinfo->number > oldinfo->initial_entries) &&
1073	(newinfo->number <= oldinfo->initial_entries))
1074	module_put(module: t->me);
1075
1076	xt_table_unlock(t);
1077
1078	get_old_counters(t: oldinfo, counters);
1079
1080	/* Decrease module usage counts and free resource */
1081	xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1082	cleanup_entry(e: iter, net);
1083
1084	xt_free_table_info(info: oldinfo);
1085	if (copy_to_user(to: counters_ptr, from: counters,
1086	n: sizeof(struct xt_counters) * num_counters) != 0) {
1087	/* Silent error, can't fail, new table is already in place */
1088	net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
1089	}
1090	vfree(addr: counters);
1091	return 0;
1092
1093	put_module:
1094	module_put(module: t->me);
1095	xt_table_unlock(t);
1096	free_newinfo_counters_untrans:
1097	vfree(addr: counters);
1098	out:
1099	return ret;
1100	}
1101
1102	static int
1103	do_replace(struct net *net, sockptr_t arg, unsigned int len)
1104	{
1105	int ret;
1106	struct ipt_replace tmp;
1107	struct xt_table_info *newinfo;
1108	void *loc_cpu_entry;
1109	struct ipt_entry *iter;
1110
1111	if (copy_from_sockptr(dst: &tmp, src: arg, size: sizeof(tmp)) != 0)
1112	return -EFAULT;
1113
1114	/* overflow check */
1115	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1116	return -ENOMEM;
1117	if (tmp.num_counters == 0)
1118	return -EINVAL;
1119
1120	tmp.name[sizeof(tmp.name)-1] = 0;
1121
1122	newinfo = xt_alloc_table_info(size: tmp.size);
1123	if (!newinfo)
1124	return -ENOMEM;
1125
1126	loc_cpu_entry = newinfo->entries;
1127	if (copy_from_sockptr_offset(dst: loc_cpu_entry, src: arg, offset: sizeof(tmp),
1128	size: tmp.size) != 0) {
1129	ret = -EFAULT;
1130	goto free_newinfo;
1131	}
1132
1133	ret = translate_table(net, newinfo, entry0: loc_cpu_entry, repl: &tmp);
1134	if (ret != 0)
1135	goto free_newinfo;
1136
1137	ret = __do_replace(net, name: tmp.name, valid_hooks: tmp.valid_hooks, newinfo,
1138	num_counters: tmp.num_counters, counters_ptr: tmp.counters);
1139	if (ret)
1140	goto free_newinfo_untrans;
1141	return 0;
1142
1143	free_newinfo_untrans:
1144	xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1145	cleanup_entry(e: iter, net);
1146	free_newinfo:
1147	xt_free_table_info(info: newinfo);
1148	return ret;
1149	}
1150
1151	static int
1152	do_add_counters(struct net *net, sockptr_t arg, unsigned int len)
1153	{
1154	unsigned int i;
1155	struct xt_counters_info tmp;
1156	struct xt_counters *paddc;
1157	struct xt_table *t;
1158	const struct xt_table_info *private;
1159	int ret = 0;
1160	struct ipt_entry *iter;
1161	unsigned int addend;
1162
1163	paddc = xt_copy_counters(arg, len, info: &tmp);
1164	if (IS_ERR(ptr: paddc))
1165	return PTR_ERR(ptr: paddc);
1166
1167	t = xt_find_table_lock(net, AF_INET, name: tmp.name);
1168	if (IS_ERR(ptr: t)) {
1169	ret = PTR_ERR(ptr: t);
1170	goto free;
1171	}
1172
1173	local_bh_disable();
1174	private = t->private;
1175	if (private->number != tmp.num_counters) {
1176	ret = -EINVAL;
1177	goto unlock_up_free;
1178	}
1179
1180	i = 0;
1181	addend = xt_write_recseq_begin();
1182	xt_entry_foreach(iter, private->entries, private->size) {
1183	struct xt_counters *tmp;
1184
1185	tmp = xt_get_this_cpu_counter(cnt: &iter->counters);
1186	ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1187	++i;
1188	}
1189	xt_write_recseq_end(addend);
1190	unlock_up_free:
1191	local_bh_enable();
1192	xt_table_unlock(t);
1193	module_put(module: t->me);
1194	free:
1195	vfree(addr: paddc);
1196
1197	return ret;
1198	}
1199
1200	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
1201	struct compat_ipt_replace {
1202	char name[XT_TABLE_MAXNAMELEN];
1203	u32 valid_hooks;
1204	u32 num_entries;
1205	u32 size;
1206	u32 hook_entry[NF_INET_NUMHOOKS];
1207	u32 underflow[NF_INET_NUMHOOKS];
1208	u32 num_counters;
1209	compat_uptr_t counters; /* struct xt_counters * */
1210	struct compat_ipt_entry entries[];
1211	};
1212
1213	static int
1214	compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
1215	unsigned int *size, struct xt_counters *counters,
1216	unsigned int i)
1217	{
1218	struct xt_entry_target *t;
1219	struct compat_ipt_entry __user *ce;
1220	u_int16_t target_offset, next_offset;
1221	compat_uint_t origsize;
1222	const struct xt_entry_match *ematch;
1223	int ret = 0;
1224
1225	origsize = *size;
1226	ce = *dstptr;
1227	if (copy_to_user(to: ce, from: e, n: sizeof(struct ipt_entry)) != 0 ||
1228	copy_to_user(to: &ce->counters, from: &counters[i],
1229	n: sizeof(counters[i])) != 0)
1230	return -EFAULT;
1231
1232	*dstptr += sizeof(struct compat_ipt_entry);
1233	*size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1234
1235	xt_ematch_foreach(ematch, e) {
1236	ret = xt_compat_match_to_user(m: ematch, dstptr, size);
1237	if (ret != 0)
1238	return ret;
1239	}
1240	target_offset = e->target_offset - (origsize - *size);
1241	t = ipt_get_target(e);
1242	ret = xt_compat_target_to_user(t, dstptr, size);
1243	if (ret)
1244	return ret;
1245	next_offset = e->next_offset - (origsize - *size);
1246	if (put_user(target_offset, &ce->target_offset) != 0 ||
1247	put_user(next_offset, &ce->next_offset) != 0)
1248	return -EFAULT;
1249	return 0;
1250	}
1251
1252	static int
1253	compat_find_calc_match(struct xt_entry_match *m,
1254	const struct ipt_ip *ip,
1255	int *size)
1256	{
1257	struct xt_match *match;
1258
1259	match = xt_request_find_match(af: NFPROTO_IPV4, name: m->u.user.name,
1260	revision: m->u.user.revision);
1261	if (IS_ERR(ptr: match))
1262	return PTR_ERR(ptr: match);
1263
1264	m->u.kernel.match = match;
1265	*size += xt_compat_match_offset(match);
1266	return 0;
1267	}
1268
1269	static void compat_release_entry(struct compat_ipt_entry *e)
1270	{
1271	struct xt_entry_target *t;
1272	struct xt_entry_match *ematch;
1273
1274	/* Cleanup all matches */
1275	xt_ematch_foreach(ematch, e)
1276	module_put(module: ematch->u.kernel.match->me);
1277	t = compat_ipt_get_target(e);
1278	module_put(module: t->u.kernel.target->me);
1279	}
1280
1281	static int
1282	check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
1283	struct xt_table_info *newinfo,
1284	unsigned int *size,
1285	const unsigned char *base,
1286	const unsigned char *limit)
1287	{
1288	struct xt_entry_match *ematch;
1289	struct xt_entry_target *t;
1290	struct xt_target *target;
1291	unsigned int entry_offset;
1292	unsigned int j;
1293	int ret, off;
1294
1295	if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
1296	(unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||
1297	(unsigned char *)e + e->next_offset > limit)
1298	return -EINVAL;
1299
1300	if (e->next_offset < sizeof(struct compat_ipt_entry) +
1301	sizeof(struct compat_xt_entry_target))
1302	return -EINVAL;
1303
1304	if (!ip_checkentry(ip: &e->ip))
1305	return -EINVAL;
1306
1307	ret = xt_compat_check_entry_offsets(base: e, elems: e->elems,
1308	target_offset: e->target_offset, next_offset: e->next_offset);
1309	if (ret)
1310	return ret;
1311
1312	off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1313	entry_offset = (void *)e - (void *)base;
1314	j = 0;
1315	xt_ematch_foreach(ematch, e) {
1316	ret = compat_find_calc_match(m: ematch, ip: &e->ip, size: &off);
1317	if (ret != 0)
1318	goto release_matches;
1319	++j;
1320	}
1321
1322	t = compat_ipt_get_target(e);
1323	target = xt_request_find_target(af: NFPROTO_IPV4, name: t->u.user.name,
1324	revision: t->u.user.revision);
1325	if (IS_ERR(ptr: target)) {
1326	ret = PTR_ERR(ptr: target);
1327	goto release_matches;
1328	}
1329	t->u.kernel.target = target;
1330
1331	off += xt_compat_target_offset(target);
1332	*size += off;
1333	ret = xt_compat_add_offset(AF_INET, offset: entry_offset, delta: off);
1334	if (ret)
1335	goto out;
1336
1337	return 0;
1338
1339	out:
1340	module_put(module: t->u.kernel.target->me);
1341	release_matches:
1342	xt_ematch_foreach(ematch, e) {
1343	if (j-- == 0)
1344	break;
1345	module_put(module: ematch->u.kernel.match->me);
1346	}
1347	return ret;
1348	}
1349
1350	static void
1351	compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
1352	unsigned int *size,
1353	struct xt_table_info *newinfo, unsigned char *base)
1354	{
1355	struct xt_entry_target *t;
1356	struct ipt_entry *de;
1357	unsigned int origsize;
1358	int h;
1359	struct xt_entry_match *ematch;
1360
1361	origsize = *size;
1362	de = *dstptr;
1363	memcpy(de, e, sizeof(struct ipt_entry));
1364	memcpy(&de->counters, &e->counters, sizeof(e->counters));
1365
1366	*dstptr += sizeof(struct ipt_entry);
1367	*size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
1368
1369	xt_ematch_foreach(ematch, e)
1370	xt_compat_match_from_user(m: ematch, dstptr, size);
1371
1372	de->target_offset = e->target_offset - (origsize - *size);
1373	t = compat_ipt_get_target(e);
1374	xt_compat_target_from_user(t, dstptr, size);
1375
1376	de->next_offset = e->next_offset - (origsize - *size);
1377
1378	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1379	if ((unsigned char *)de - base < newinfo->hook_entry[h])
1380	newinfo->hook_entry[h] -= origsize - *size;
1381	if ((unsigned char *)de - base < newinfo->underflow[h])
1382	newinfo->underflow[h] -= origsize - *size;
1383	}
1384	}
1385
1386	static int
1387	translate_compat_table(struct net *net,
1388	struct xt_table_info **pinfo,
1389	void **pentry0,
1390	const struct compat_ipt_replace *compatr)
1391	{
1392	unsigned int i, j;
1393	struct xt_table_info *newinfo, *info;
1394	void *pos, *entry0, *entry1;
1395	struct compat_ipt_entry *iter0;
1396	struct ipt_replace repl;
1397	unsigned int size;
1398	int ret;
1399
1400	info = *pinfo;
1401	entry0 = *pentry0;
1402	size = compatr->size;
1403	info->number = compatr->num_entries;
1404
1405	j = 0;
1406	xt_compat_lock(AF_INET);
1407	ret = xt_compat_init_offsets(AF_INET, number: compatr->num_entries);
1408	if (ret)
1409	goto out_unlock;
1410	/* Walk through entries, checking offsets. */
1411	xt_entry_foreach(iter0, entry0, compatr->size) {
1412	ret = check_compat_entry_size_and_hooks(e: iter0, newinfo: info, size: &size,
1413	base: entry0,
1414	limit: entry0 + compatr->size);
1415	if (ret != 0)
1416	goto out_unlock;
1417	++j;
1418	}
1419
1420	ret = -EINVAL;
1421	if (j != compatr->num_entries)
1422	goto out_unlock;
1423
1424	ret = -ENOMEM;
1425	newinfo = xt_alloc_table_info(size);
1426	if (!newinfo)
1427	goto out_unlock;
1428
1429	memset(newinfo->entries, 0, size);
1430
1431	newinfo->number = compatr->num_entries;
1432	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1433	newinfo->hook_entry[i] = compatr->hook_entry[i];
1434	newinfo->underflow[i] = compatr->underflow[i];
1435	}
1436	entry1 = newinfo->entries;
1437	pos = entry1;
1438	size = compatr->size;
1439	xt_entry_foreach(iter0, entry0, compatr->size)
1440	compat_copy_entry_from_user(e: iter0, dstptr: &pos, size: &size,
1441	newinfo, base: entry1);
1442
1443	/* all module references in entry0 are now gone.
1444	* entry1/newinfo contains a 64bit ruleset that looks exactly as
1445	* generated by 64bit userspace.
1446	*
1447	* Call standard translate_table() to validate all hook_entrys,
1448	* underflows, check for loops, etc.
1449	*/
1450	xt_compat_flush_offsets(AF_INET);
1451	xt_compat_unlock(AF_INET);
1452
1453	memcpy(&repl, compatr, sizeof(*compatr));
1454
1455	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1456	repl.hook_entry[i] = newinfo->hook_entry[i];
1457	repl.underflow[i] = newinfo->underflow[i];
1458	}
1459
1460	repl.num_counters = 0;
1461	repl.counters = NULL;
1462	repl.size = newinfo->size;
1463	ret = translate_table(net, newinfo, entry0: entry1, repl: &repl);
1464	if (ret)
1465	goto free_newinfo;
1466
1467	*pinfo = newinfo;
1468	*pentry0 = entry1;
1469	xt_free_table_info(info);
1470	return 0;
1471
1472	free_newinfo:
1473	xt_free_table_info(info: newinfo);
1474	return ret;
1475	out_unlock:
1476	xt_compat_flush_offsets(AF_INET);
1477	xt_compat_unlock(AF_INET);
1478	xt_entry_foreach(iter0, entry0, compatr->size) {
1479	if (j-- == 0)
1480	break;
1481	compat_release_entry(e: iter0);
1482	}
1483	return ret;
1484	}
1485
1486	static int
1487	compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
1488	{
1489	int ret;
1490	struct compat_ipt_replace tmp;
1491	struct xt_table_info *newinfo;
1492	void *loc_cpu_entry;
1493	struct ipt_entry *iter;
1494
1495	if (copy_from_sockptr(dst: &tmp, src: arg, size: sizeof(tmp)) != 0)
1496	return -EFAULT;
1497
1498	/* overflow check */
1499	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1500	return -ENOMEM;
1501	if (tmp.num_counters == 0)
1502	return -EINVAL;
1503
1504	tmp.name[sizeof(tmp.name)-1] = 0;
1505
1506	newinfo = xt_alloc_table_info(size: tmp.size);
1507	if (!newinfo)
1508	return -ENOMEM;
1509
1510	loc_cpu_entry = newinfo->entries;
1511	if (copy_from_sockptr_offset(dst: loc_cpu_entry, src: arg, offset: sizeof(tmp),
1512	size: tmp.size) != 0) {
1513	ret = -EFAULT;
1514	goto free_newinfo;
1515	}
1516
1517	ret = translate_compat_table(net, pinfo: &newinfo, pentry0: &loc_cpu_entry, compatr: &tmp);
1518	if (ret != 0)
1519	goto free_newinfo;
1520
1521	ret = __do_replace(net, name: tmp.name, valid_hooks: tmp.valid_hooks, newinfo,
1522	num_counters: tmp.num_counters, counters_ptr: compat_ptr(uptr: tmp.counters));
1523	if (ret)
1524	goto free_newinfo_untrans;
1525	return 0;
1526
1527	free_newinfo_untrans:
1528	xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1529	cleanup_entry(e: iter, net);
1530	free_newinfo:
1531	xt_free_table_info(info: newinfo);
1532	return ret;
1533	}
1534
1535	struct compat_ipt_get_entries {
1536	char name[XT_TABLE_MAXNAMELEN];
1537	compat_uint_t size;
1538	struct compat_ipt_entry entrytable[];
1539	};
1540
1541	static int
1542	compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1543	void __user *userptr)
1544	{
1545	struct xt_counters *counters;
1546	const struct xt_table_info *private = table->private;
1547	void __user *pos;
1548	unsigned int size;
1549	int ret = 0;
1550	unsigned int i = 0;
1551	struct ipt_entry *iter;
1552
1553	counters = alloc_counters(table);
1554	if (IS_ERR(ptr: counters))
1555	return PTR_ERR(ptr: counters);
1556
1557	pos = userptr;
1558	size = total_size;
1559	xt_entry_foreach(iter, private->entries, total_size) {
1560	ret = compat_copy_entry_to_user(e: iter, dstptr: &pos,
1561	size: &size, counters, i: i++);
1562	if (ret != 0)
1563	break;
1564	}
1565
1566	vfree(addr: counters);
1567	return ret;
1568	}
1569
1570	static int
1571	compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
1572	int *len)
1573	{
1574	int ret;
1575	struct compat_ipt_get_entries get;
1576	struct xt_table *t;
1577
1578	if (*len < sizeof(get))
1579	return -EINVAL;
1580
1581	if (copy_from_user(to: &get, from: uptr, n: sizeof(get)) != 0)
1582	return -EFAULT;
1583
1584	if (*len != sizeof(struct compat_ipt_get_entries) + get.size)
1585	return -EINVAL;
1586
1587	get.name[sizeof(get.name) - 1] = '\0';
1588
1589	xt_compat_lock(AF_INET);
1590	t = xt_find_table_lock(net, AF_INET, name: get.name);
1591	if (!IS_ERR(ptr: t)) {
1592	const struct xt_table_info *private = t->private;
1593	struct xt_table_info info;
1594	ret = compat_table_info(info: private, newinfo: &info);
1595	if (!ret && get.size == info.size)
1596	ret = compat_copy_entries_to_user(total_size: private->size,
1597	table: t, userptr: uptr->entrytable);
1598	else if (!ret)
1599	ret = -EAGAIN;
1600
1601	xt_compat_flush_offsets(AF_INET);
1602	module_put(module: t->me);
1603	xt_table_unlock(t);
1604	} else
1605	ret = PTR_ERR(ptr: t);
1606
1607	xt_compat_unlock(AF_INET);
1608	return ret;
1609	}
1610	#endif
1611
1612	static int
1613	do_ipt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, unsigned int len)
1614	{
1615	int ret;
1616
1617	if (!ns_capable(ns: sock_net(sk)->user_ns, CAP_NET_ADMIN))
1618	return -EPERM;
1619
1620	switch (cmd) {
1621	case IPT_SO_SET_REPLACE:
1622	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
1623	if (in_compat_syscall())
1624	ret = compat_do_replace(net: sock_net(sk), arg, len);
1625	else
1626	#endif
1627	ret = do_replace(net: sock_net(sk), arg, len);
1628	break;
1629
1630	case IPT_SO_SET_ADD_COUNTERS:
1631	ret = do_add_counters(net: sock_net(sk), arg, len);
1632	break;
1633
1634	default:
1635	ret = -EINVAL;
1636	}
1637
1638	return ret;
1639	}
1640
1641	static int
1642	do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1643	{
1644	int ret;
1645
1646	if (!ns_capable(ns: sock_net(sk)->user_ns, CAP_NET_ADMIN))
1647	return -EPERM;
1648
1649	switch (cmd) {
1650	case IPT_SO_GET_INFO:
1651	ret = get_info(net: sock_net(sk), user, len);
1652	break;
1653
1654	case IPT_SO_GET_ENTRIES:
1655	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
1656	if (in_compat_syscall())
1657	ret = compat_get_entries(net: sock_net(sk), uptr: user, len);
1658	else
1659	#endif
1660	ret = get_entries(net: sock_net(sk), uptr: user, len);
1661	break;
1662
1663	case IPT_SO_GET_REVISION_MATCH:
1664	case IPT_SO_GET_REVISION_TARGET: {
1665	struct xt_get_revision rev;
1666	int target;
1667
1668	if (*len != sizeof(rev)) {
1669	ret = -EINVAL;
1670	break;
1671	}
1672	if (copy_from_user(to: &rev, from: user, n: sizeof(rev)) != 0) {
1673	ret = -EFAULT;
1674	break;
1675	}
1676	rev.name[sizeof(rev.name)-1] = 0;
1677
1678	if (cmd == IPT_SO_GET_REVISION_TARGET)
1679	target = 1;
1680	else
1681	target = 0;
1682
1683	try_then_request_module(xt_find_revision(AF_INET, rev.name,
1684	rev.revision,
1685	target, &ret),
1686	"ipt_%s", rev.name);
1687	break;
1688	}
1689
1690	default:
1691	ret = -EINVAL;
1692	}
1693
1694	return ret;
1695	}
1696
1697	static void __ipt_unregister_table(struct net *net, struct xt_table *table)
1698	{
1699	struct xt_table_info *private;
1700	void *loc_cpu_entry;
1701	struct module *table_owner = table->me;
1702	struct ipt_entry *iter;
1703
1704	private = xt_unregister_table(table);
1705
1706	/* Decrease module usage counts and free resources */
1707	loc_cpu_entry = private->entries;
1708	xt_entry_foreach(iter, loc_cpu_entry, private->size)
1709	cleanup_entry(e: iter, net);
1710	if (private->number > private->initial_entries)
1711	module_put(module: table_owner);
1712	xt_free_table_info(info: private);
1713	}
1714
1715	int ipt_register_table(struct net *net, const struct xt_table *table,
1716	const struct ipt_replace *repl,
1717	const struct nf_hook_ops *template_ops)
1718	{
1719	struct nf_hook_ops *ops;
1720	unsigned int num_ops;
1721	int ret, i;
1722	struct xt_table_info *newinfo;
1723	struct xt_table_info bootstrap = {0};
1724	void *loc_cpu_entry;
1725	struct xt_table *new_table;
1726
1727	newinfo = xt_alloc_table_info(size: repl->size);
1728	if (!newinfo)
1729	return -ENOMEM;
1730
1731	loc_cpu_entry = newinfo->entries;
1732	memcpy(loc_cpu_entry, repl->entries, repl->size);
1733
1734	ret = translate_table(net, newinfo, entry0: loc_cpu_entry, repl);
1735	if (ret != 0) {
1736	xt_free_table_info(info: newinfo);
1737	return ret;
1738	}
1739
1740	new_table = xt_register_table(net, table, bootstrap: &bootstrap, newinfo);
1741	if (IS_ERR(ptr: new_table)) {
1742	struct ipt_entry *iter;
1743
1744	xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1745	cleanup_entry(e: iter, net);
1746	xt_free_table_info(info: newinfo);
1747	return PTR_ERR(ptr: new_table);
1748	}
1749
1750	/* No template? No need to do anything. This is used by 'nat' table, it registers
1751	* with the nat core instead of the netfilter core.
1752	*/
1753	if (!template_ops)
1754	return 0;
1755
1756	num_ops = hweight32(table->valid_hooks);
1757	if (num_ops == 0) {
1758	ret = -EINVAL;
1759	goto out_free;
1760	}
1761
1762	ops = kmemdup(p: template_ops, size: sizeof(*ops) * num_ops, GFP_KERNEL);
1763	if (!ops) {
1764	ret = -ENOMEM;
1765	goto out_free;
1766	}
1767
1768	for (i = 0; i < num_ops; i++)
1769	ops[i].priv = new_table;
1770
1771	new_table->ops = ops;
1772
1773	ret = nf_register_net_hooks(net, reg: ops, n: num_ops);
1774	if (ret != 0)
1775	goto out_free;
1776
1777	return ret;
1778
1779	out_free:
1780	__ipt_unregister_table(net, table: new_table);
1781	return ret;
1782	}
1783
1784	void ipt_unregister_table_pre_exit(struct net *net, const char *name)
1785	{
1786	struct xt_table *table = xt_find_table(net, af: NFPROTO_IPV4, name);
1787
1788	if (table)
1789	nf_unregister_net_hooks(net, reg: table->ops, hweight32(table->valid_hooks));
1790	}
1791
1792	void ipt_unregister_table_exit(struct net *net, const char *name)
1793	{
1794	struct xt_table *table = xt_find_table(net, af: NFPROTO_IPV4, name);
1795
1796	if (table)
1797	__ipt_unregister_table(net, table);
1798	}
1799
1800	static struct xt_target ipt_builtin_tg[] __read_mostly = {
1801	{
1802	.name = XT_STANDARD_TARGET,
1803	.targetsize = sizeof(int),
1804	.family = NFPROTO_IPV4,
1805	#ifdef CONFIG_NETFILTER_XTABLES_COMPAT
1806	.compatsize = sizeof(compat_int_t),
1807	.compat_from_user = compat_standard_from_user,
1808	.compat_to_user = compat_standard_to_user,
1809	#endif
1810	},
1811	{
1812	.name = XT_ERROR_TARGET,
1813	.target = ipt_error,
1814	.targetsize = XT_FUNCTION_MAXNAMELEN,
1815	.family = NFPROTO_IPV4,
1816	},
1817	};
1818
1819	static struct nf_sockopt_ops ipt_sockopts = {
1820	.pf = PF_INET,
1821	.set_optmin = IPT_BASE_CTL,
1822	.set_optmax = IPT_SO_SET_MAX+1,
1823	.set = do_ipt_set_ctl,
1824	.get_optmin = IPT_BASE_CTL,
1825	.get_optmax = IPT_SO_GET_MAX+1,
1826	.get = do_ipt_get_ctl,
1827	.owner = THIS_MODULE,
1828	};
1829
1830	static int __net_init ip_tables_net_init(struct net *net)
1831	{
1832	return xt_proto_init(net, af: NFPROTO_IPV4);
1833	}
1834
1835	static void __net_exit ip_tables_net_exit(struct net *net)
1836	{
1837	xt_proto_fini(net, af: NFPROTO_IPV4);
1838	}
1839
1840	static struct pernet_operations ip_tables_net_ops = {
1841	.init = ip_tables_net_init,
1842	.exit = ip_tables_net_exit,
1843	};
1844
1845	static int __init ip_tables_init(void)
1846	{
1847	int ret;
1848
1849	ret = register_pernet_subsys(&ip_tables_net_ops);
1850	if (ret < 0)
1851	goto err1;
1852
1853	/* No one else will be downing sem now, so we won't sleep */
1854	ret = xt_register_targets(target: ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
1855	if (ret < 0)
1856	goto err2;
1857
1858	/* Register setsockopt */
1859	ret = nf_register_sockopt(reg: &ipt_sockopts);
1860	if (ret < 0)
1861	goto err4;
1862
1863	return 0;
1864
1865	err4:
1866	xt_unregister_targets(target: ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
1867	err2:
1868	unregister_pernet_subsys(&ip_tables_net_ops);
1869	err1:
1870	return ret;
1871	}
1872
1873	static void __exit ip_tables_fini(void)
1874	{
1875	nf_unregister_sockopt(reg: &ipt_sockopts);
1876
1877	xt_unregister_targets(target: ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
1878	unregister_pernet_subsys(&ip_tables_net_ops);
1879	}
1880
1881	EXPORT_SYMBOL(ipt_register_table);
1882	EXPORT_SYMBOL(ipt_unregister_table_pre_exit);
1883	EXPORT_SYMBOL(ipt_unregister_table_exit);
1884	EXPORT_SYMBOL(ipt_do_table);
1885	module_init(ip_tables_init);
1886	module_exit(ip_tables_fini);
1887