Eric Lee / linux-smarc-t335x-v3.2

Commit e3eaa9910b380530cfd2c0670fcd3f627674da8a

Authored by Jan Engelhardt 2009-06-18 04:14:54 +0800

Exists in master and in 4 other branches

netfilter: xtables: generate initial table on-demand

The static initial tables are pretty large, and after the net
namespace has been instantiated, they just hang around for nothing.
This commit removes them and creates tables on-demand at runtime when
needed.

Size shrinks by 7735 bytes (x86_64).

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

Showing 18 changed files with 141 additions and 334 deletions Inline Diff

include/linux/netfilter_arp/arp_tables.h
include/linux/netfilter_ipv4/ip_tables.h
include/linux/netfilter_ipv6/ip6_tables.h
net/ipv4/netfilter/arp_tables.c
net/ipv4/netfilter/arptable_filter.c
net/ipv4/netfilter/ip_tables.c
net/ipv4/netfilter/iptable_filter.c
net/ipv4/netfilter/iptable_mangle.c
net/ipv4/netfilter/iptable_raw.c
net/ipv4/netfilter/iptable_security.c
net/ipv4/netfilter/nf_nat_rule.c
net/ipv6/netfilter/ip6_tables.c
net/ipv6/netfilter/ip6table_filter.c
net/ipv6/netfilter/ip6table_mangle.c
net/ipv6/netfilter/ip6table_raw.c
net/ipv6/netfilter/ip6table_security.c
net/netfilter/x_tables.c
net/netfilter/xt_repldata.h

include/linux/netfilter_arp/arp_tables.h

Diff comments View file @ e3eaa99

 /*
  * 	Format of an ARP firewall descriptor
  *
  * 	src, tgt, src_mask, tgt_mask, arpop, arpop_mask are always stored in
  *	network byte order.
  * 	flags are stored in host byte order (of course).
  */
 #ifndef _ARPTABLES_H
 #define _ARPTABLES_H
 #ifdef __KERNEL__
 #include <linux/if.h>
 #include <linux/in.h>
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
 #endif
 #include <linux/types.h>
 #include <linux/compiler.h>
 #include <linux/netfilter_arp.h>
 #include <linux/netfilter/x_tables.h>
 #define ARPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
 #define ARPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
 #define ARPT_DEV_ADDR_LEN_MAX 16
 struct arpt_devaddr_info {
 	char addr[ARPT_DEV_ADDR_LEN_MAX];
 	char mask[ARPT_DEV_ADDR_LEN_MAX];
 };
 /* Yes, Virginia, you have to zero the padding. */
 struct arpt_arp {
 	/* Source and target IP addr */
 	struct in_addr src, tgt;
 	/* Mask for src and target IP addr */
 	struct in_addr smsk, tmsk;
 	/* Device hw address length, src+target device addresses */
 	u_int8_t arhln, arhln_mask;
 	struct arpt_devaddr_info src_devaddr;
 	struct arpt_devaddr_info tgt_devaddr;
 	/* ARP operation code. */
 	__be16 arpop, arpop_mask;
 	/* ARP hardware address and protocol address format. */
 	__be16 arhrd, arhrd_mask;
 	__be16 arpro, arpro_mask;
 	/* The protocol address length is only accepted if it is 4
 	 * so there is no use in offering a way to do filtering on it.
 	 */
 	char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
 	unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
 	/* Flags word */
 	u_int8_t flags;
 	/* Inverse flags */
 	u_int16_t invflags;
 };
 #define arpt_entry_target xt_entry_target
 #define arpt_standard_target xt_standard_target
 /* Values for "flag" field in struct arpt_ip (general arp structure).
  * No flags defined yet.
  */
 #define ARPT_F_MASK		0x00	/* All possible flag bits mask. */
 /* Values for "inv" field in struct arpt_arp. */
 #define ARPT_INV_VIA_IN		0x0001	/* Invert the sense of IN IFACE. */
 #define ARPT_INV_VIA_OUT	0x0002	/* Invert the sense of OUT IFACE */
 #define ARPT_INV_SRCIP		0x0004	/* Invert the sense of SRC IP. */
 #define ARPT_INV_TGTIP		0x0008	/* Invert the sense of TGT IP. */
 #define ARPT_INV_SRCDEVADDR	0x0010	/* Invert the sense of SRC DEV ADDR. */
 #define ARPT_INV_TGTDEVADDR	0x0020	/* Invert the sense of TGT DEV ADDR. */
 #define ARPT_INV_ARPOP		0x0040	/* Invert the sense of ARP OP. */
 #define ARPT_INV_ARPHRD		0x0080	/* Invert the sense of ARP HRD. */
 #define ARPT_INV_ARPPRO		0x0100	/* Invert the sense of ARP PRO. */
 #define ARPT_INV_ARPHLN		0x0200	/* Invert the sense of ARP HLN. */
 #define ARPT_INV_MASK		0x03FF	/* All possible flag bits mask. */
 /* This structure defines each of the firewall rules.  Consists of 3
    parts which are 1) general ARP header stuff 2) match specific
    stuff 3) the target to perform if the rule matches */
 struct arpt_entry
 {
 	struct arpt_arp arp;
 	/* Size of arpt_entry + matches */
 	u_int16_t target_offset;
 	/* Size of arpt_entry + matches + target */
 	u_int16_t next_offset;
 	/* Back pointer */
 	unsigned int comefrom;
 	/* Packet and byte counters. */
 	struct xt_counters counters;
 	/* The matches (if any), then the target. */
 	unsigned char elems[0];
 };
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
  * socket for this. Instead we check rights in the calls.
  *
  * ATTENTION: check linux/in.h before adding new number here.
  */
 #define ARPT_BASE_CTL		96
 #define ARPT_SO_SET_REPLACE		(ARPT_BASE_CTL)
 #define ARPT_SO_SET_ADD_COUNTERS	(ARPT_BASE_CTL + 1)
 #define ARPT_SO_SET_MAX			ARPT_SO_SET_ADD_COUNTERS
 #define ARPT_SO_GET_INFO		(ARPT_BASE_CTL)
 #define ARPT_SO_GET_ENTRIES		(ARPT_BASE_CTL + 1)
 /* #define ARPT_SO_GET_REVISION_MATCH	(APRT_BASE_CTL + 2) */
 #define ARPT_SO_GET_REVISION_TARGET	(ARPT_BASE_CTL + 3)
 #define ARPT_SO_GET_MAX			(ARPT_SO_GET_REVISION_TARGET)
 /* CONTINUE verdict for targets */
 #define ARPT_CONTINUE XT_CONTINUE
 /* For standard target */
 #define ARPT_RETURN XT_RETURN
 /* The argument to ARPT_SO_GET_INFO */
 struct arpt_getinfo {
 	/* Which table: caller fills this in. */
 	char name[ARPT_TABLE_MAXNAMELEN];
 	/* Kernel fills these in. */
 	/* Which hook entry points are valid: bitmask */
 	unsigned int valid_hooks;
 	/* Hook entry points: one per netfilter hook. */
 	unsigned int hook_entry[NF_ARP_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_ARP_NUMHOOKS];
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Size of entries. */
 	unsigned int size;
 };
 /* The argument to ARPT_SO_SET_REPLACE. */
 struct arpt_replace {
 	/* Which table. */
 	char name[ARPT_TABLE_MAXNAMELEN];
 	/* Which hook entry points are valid: bitmask.  You can't
            change this. */
 	unsigned int valid_hooks;
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Total size of new entries */
 	unsigned int size;
 	/* Hook entry points. */
 	unsigned int hook_entry[NF_ARP_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_ARP_NUMHOOKS];
 	/* Information about old entries: */
 	/* Number of counters (must be equal to current number of entries). */
 	unsigned int num_counters;
 	/* The old entries' counters. */
 	struct xt_counters __user *counters;
 	/* The entries (hang off end: not really an array). */
 	struct arpt_entry entries[0];
 };
 /* The argument to ARPT_SO_ADD_COUNTERS. */
 #define arpt_counters_info xt_counters_info
 #define arpt_counters xt_counters
 /* The argument to ARPT_SO_GET_ENTRIES. */
 struct arpt_get_entries {
 	/* Which table: user fills this in. */
 	char name[ARPT_TABLE_MAXNAMELEN];
 	/* User fills this in: total entry size. */
 	unsigned int size;
 	/* The entries. */
 	struct arpt_entry entrytable[0];
 };
 /* Standard return verdict, or do jump. */
 #define ARPT_STANDARD_TARGET XT_STANDARD_TARGET
 /* Error verdict. */
 #define ARPT_ERROR_TARGET XT_ERROR_TARGET
 /* Helper functions */
 static __inline__ struct arpt_entry_target *arpt_get_target(struct arpt_entry *e)
 {
 	return (void *)e + e->target_offset;
 }
 /* fn returns 0 to continue iteration */
 #define ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
 	XT_ENTRY_ITERATE(struct arpt_entry, entries, size, fn, ## args)
 /*
  *	Main firewall chains definitions and global var's definitions.
  */
 #ifdef __KERNEL__
 /* Standard entry. */
 struct arpt_standard {
 	struct arpt_entry entry;
 	struct arpt_standard_target target;
 };
 struct arpt_error_target {
 	struct arpt_entry_target target;
 	char errorname[ARPT_FUNCTION_MAXNAMELEN];
 };
 struct arpt_error {
 	struct arpt_entry entry;
 	struct arpt_error_target target;
 };
 #define ARPT_ENTRY_INIT(__size)						       \
 {									       \
 	.target_offset	= sizeof(struct arpt_entry),			       \
 	.next_offset	= (__size),					       \
 }
 #define ARPT_STANDARD_INIT(__verdict)					       \
 {									       \
 	.entry		= ARPT_ENTRY_INIT(sizeof(struct arpt_standard)),       \
 	.target		= XT_TARGET_INIT(ARPT_STANDARD_TARGET,		       \
 					 sizeof(struct arpt_standard_target)), \
 	.target.verdict	= -(__verdict) - 1,				       \
 }
 #define ARPT_ERROR_INIT							       \
 {									       \
 	.entry		= ARPT_ENTRY_INIT(sizeof(struct arpt_error)),	       \
 	.target		= XT_TARGET_INIT(ARPT_ERROR_TARGET,		       \
 					 sizeof(struct arpt_error_target)),    \
 	.target.errorname = "ERROR",					       \
 }
+extern void *arpt_alloc_initial_table(const struct xt_table *);
 extern struct xt_table *arpt_register_table(struct net *net,
 					    const struct xt_table *table,
 					    const struct arpt_replace *repl);
 extern void arpt_unregister_table(struct xt_table *table);
 extern unsigned int arpt_do_table(struct sk_buff *skb,
 				  unsigned int hook,
 				  const struct net_device *in,
 				  const struct net_device *out,
 				  struct xt_table *table);
 #define ARPT_ALIGN(s) XT_ALIGN(s)
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 struct compat_arpt_entry {
 	struct arpt_arp arp;
 	u_int16_t target_offset;
 	u_int16_t next_offset;
 	compat_uint_t comefrom;
 	struct compat_xt_counters counters;
 	unsigned char elems[0];
 };
 static inline struct arpt_entry_target *
 compat_arpt_get_target(struct compat_arpt_entry *e)
 {
 	return (void *)e + e->target_offset;
 }
 #define COMPAT_ARPT_ALIGN(s)	COMPAT_XT_ALIGN(s)
 /* fn returns 0 to continue iteration */
 #define COMPAT_ARPT_ENTRY_ITERATE(entries, size, fn, args...) \
 	XT_ENTRY_ITERATE(struct compat_arpt_entry, entries, size, fn, ## args)
 #define COMPAT_ARPT_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
 	XT_ENTRY_ITERATE_CONTINUE(struct compat_arpt_entry, entries, size, n, \
 				  fn, ## args)
 #endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _ARPTABLES_H */

include/linux/netfilter_ipv4/ip_tables.h

Diff comments View file @ e3eaa99

 /*
  * 25-Jul-1998 Major changes to allow for ip chain table
  *
  * 3-Jan-2000 Named tables to allow packet selection for different uses.
  */
 /*
  * 	Format of an IP firewall descriptor
  *
  * 	src, dst, src_mask, dst_mask are always stored in network byte order.
  * 	flags are stored in host byte order (of course).
  * 	Port numbers are stored in HOST byte order.
  */
 #ifndef _IPTABLES_H
 #define _IPTABLES_H
 #ifdef __KERNEL__
 #include <linux/if.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/skbuff.h>
 #endif
 #include <linux/types.h>
 #include <linux/compiler.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
 #define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
 #define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
 #define ipt_match xt_match
 #define ipt_target xt_target
 #define ipt_table xt_table
 #define ipt_get_revision xt_get_revision
 /* Yes, Virginia, you have to zero the padding. */
 struct ipt_ip {
 	/* Source and destination IP addr */
 	struct in_addr src, dst;
 	/* Mask for src and dest IP addr */
 	struct in_addr smsk, dmsk;
 	char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
 	unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
 	/* Protocol, 0 = ANY */
 	u_int16_t proto;
 	/* Flags word */
 	u_int8_t flags;
 	/* Inverse flags */
 	u_int8_t invflags;
 };
 #define ipt_entry_match xt_entry_match
 #define ipt_entry_target xt_entry_target
 #define ipt_standard_target xt_standard_target
 #define ipt_counters xt_counters
 /* Values for "flag" field in struct ipt_ip (general ip structure). */
 #define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
 #define IPT_F_GOTO		0x02	/* Set if jump is a goto */
 #define IPT_F_MASK		0x03	/* All possible flag bits mask. */
 /* Values for "inv" field in struct ipt_ip. */
 #define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
 #define IPT_INV_VIA_OUT		0x02	/* Invert the sense of OUT IFACE */
 #define IPT_INV_TOS		0x04	/* Invert the sense of TOS. */
 #define IPT_INV_SRCIP		0x08	/* Invert the sense of SRC IP. */
 #define IPT_INV_DSTIP		0x10	/* Invert the sense of DST OP. */
 #define IPT_INV_FRAG		0x20	/* Invert the sense of FRAG. */
 #define IPT_INV_PROTO		XT_INV_PROTO
 #define IPT_INV_MASK		0x7F	/* All possible flag bits mask. */
 /* This structure defines each of the firewall rules.  Consists of 3
    parts which are 1) general IP header stuff 2) match specific
    stuff 3) the target to perform if the rule matches */
 struct ipt_entry {
 	struct ipt_ip ip;
 	/* Mark with fields that we care about. */
 	unsigned int nfcache;
 	/* Size of ipt_entry + matches */
 	u_int16_t target_offset;
 	/* Size of ipt_entry + matches + target */
 	u_int16_t next_offset;
 	/* Back pointer */
 	unsigned int comefrom;
 	/* Packet and byte counters. */
 	struct xt_counters counters;
 	/* The matches (if any), then the target. */
 	unsigned char elems[0];
 };
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
  * socket for this. Instead we check rights in the calls.
  *
  * ATTENTION: check linux/in.h before adding new number here.
  */
 #define IPT_BASE_CTL		64
 #define IPT_SO_SET_REPLACE	(IPT_BASE_CTL)
 #define IPT_SO_SET_ADD_COUNTERS	(IPT_BASE_CTL + 1)
 #define IPT_SO_SET_MAX		IPT_SO_SET_ADD_COUNTERS
 #define IPT_SO_GET_INFO			(IPT_BASE_CTL)
 #define IPT_SO_GET_ENTRIES		(IPT_BASE_CTL + 1)
 #define IPT_SO_GET_REVISION_MATCH	(IPT_BASE_CTL + 2)
 #define IPT_SO_GET_REVISION_TARGET	(IPT_BASE_CTL + 3)
 #define IPT_SO_GET_MAX			IPT_SO_GET_REVISION_TARGET
 #define IPT_CONTINUE XT_CONTINUE
 #define IPT_RETURN XT_RETURN
 #include <linux/netfilter/xt_tcpudp.h>
 #define ipt_udp xt_udp
 #define ipt_tcp xt_tcp
 #define IPT_TCP_INV_SRCPT	XT_TCP_INV_SRCPT
 #define IPT_TCP_INV_DSTPT	XT_TCP_INV_DSTPT
 #define IPT_TCP_INV_FLAGS	XT_TCP_INV_FLAGS
 #define IPT_TCP_INV_OPTION	XT_TCP_INV_OPTION
 #define IPT_TCP_INV_MASK	XT_TCP_INV_MASK
 #define IPT_UDP_INV_SRCPT	XT_UDP_INV_SRCPT
 #define IPT_UDP_INV_DSTPT	XT_UDP_INV_DSTPT
 #define IPT_UDP_INV_MASK	XT_UDP_INV_MASK
 /* ICMP matching stuff */
 struct ipt_icmp {
 	u_int8_t type;				/* type to match */
 	u_int8_t code[2];			/* range of code */
 	u_int8_t invflags;			/* Inverse flags */
 };
 /* Values for "inv" field for struct ipt_icmp. */
 #define IPT_ICMP_INV	0x01	/* Invert the sense of type/code test */
 /* The argument to IPT_SO_GET_INFO */
 struct ipt_getinfo {
 	/* Which table: caller fills this in. */
 	char name[IPT_TABLE_MAXNAMELEN];
 	/* Kernel fills these in. */
 	/* Which hook entry points are valid: bitmask */
 	unsigned int valid_hooks;
 	/* Hook entry points: one per netfilter hook. */
 	unsigned int hook_entry[NF_INET_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_INET_NUMHOOKS];
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Size of entries. */
 	unsigned int size;
 };
 /* The argument to IPT_SO_SET_REPLACE. */
 struct ipt_replace {
 	/* Which table. */
 	char name[IPT_TABLE_MAXNAMELEN];
 	/* Which hook entry points are valid: bitmask.  You can't
            change this. */
 	unsigned int valid_hooks;
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Total size of new entries */
 	unsigned int size;
 	/* Hook entry points. */
 	unsigned int hook_entry[NF_INET_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_INET_NUMHOOKS];
 	/* Information about old entries: */
 	/* Number of counters (must be equal to current number of entries). */
 	unsigned int num_counters;
 	/* The old entries' counters. */
 	struct xt_counters __user *counters;
 	/* The entries (hang off end: not really an array). */
 	struct ipt_entry entries[0];
 };
 /* The argument to IPT_SO_ADD_COUNTERS. */
 #define ipt_counters_info xt_counters_info
 /* The argument to IPT_SO_GET_ENTRIES. */
 struct ipt_get_entries {
 	/* Which table: user fills this in. */
 	char name[IPT_TABLE_MAXNAMELEN];
 	/* User fills this in: total entry size. */
 	unsigned int size;
 	/* The entries. */
 	struct ipt_entry entrytable[0];
 };
 /* Standard return verdict, or do jump. */
 #define IPT_STANDARD_TARGET XT_STANDARD_TARGET
 /* Error verdict. */
 #define IPT_ERROR_TARGET XT_ERROR_TARGET
 /* Helper functions */
 static __inline__ struct ipt_entry_target *
 ipt_get_target(struct ipt_entry *e)
 {
 	return (void *)e + e->target_offset;
 }
 /* fn returns 0 to continue iteration */
 #define IPT_MATCH_ITERATE(e, fn, args...) \
 	XT_MATCH_ITERATE(struct ipt_entry, e, fn, ## args)
 /* fn returns 0 to continue iteration */
 #define IPT_ENTRY_ITERATE(entries, size, fn, args...) \
 	XT_ENTRY_ITERATE(struct ipt_entry, entries, size, fn, ## args)
 /*
  *	Main firewall chains definitions and global var's definitions.
  */
 #ifdef __KERNEL__
 #include <linux/init.h>
 extern void ipt_init(void) __init;
 extern struct xt_table *ipt_register_table(struct net *net,
 					   const struct xt_table *table,
 					   const struct ipt_replace *repl);
 extern void ipt_unregister_table(struct net *net, struct xt_table *table);
 /* Standard entry. */
 struct ipt_standard {
 	struct ipt_entry entry;
 	struct ipt_standard_target target;
 };
 struct ipt_error_target {
 	struct ipt_entry_target target;
 	char errorname[IPT_FUNCTION_MAXNAMELEN];
 };
 struct ipt_error {
 	struct ipt_entry entry;
 	struct ipt_error_target target;
 };
 #define IPT_ENTRY_INIT(__size)						       \
 {									       \
 	.target_offset	= sizeof(struct ipt_entry),			       \
 	.next_offset	= (__size),					       \
 }
 #define IPT_STANDARD_INIT(__verdict)					       \
 {									       \
 	.entry		= IPT_ENTRY_INIT(sizeof(struct ipt_standard)),	       \
 	.target		= XT_TARGET_INIT(IPT_STANDARD_TARGET,		       \
 					 sizeof(struct xt_standard_target)),   \
 	.target.verdict	= -(__verdict) - 1,				       \
 }
 #define IPT_ERROR_INIT							       \
 {									       \
 	.entry		= IPT_ENTRY_INIT(sizeof(struct ipt_error)),	       \
 	.target		= XT_TARGET_INIT(IPT_ERROR_TARGET,		       \
 					 sizeof(struct ipt_error_target)),     \
 	.target.errorname = "ERROR",					       \
 }
+extern void *ipt_alloc_initial_table(const struct xt_table *);
 extern unsigned int ipt_do_table(struct sk_buff *skb,
 				 unsigned int hook,
 				 const struct net_device *in,
 				 const struct net_device *out,
 				 struct xt_table *table);
 #define IPT_ALIGN(s) XT_ALIGN(s)
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 struct compat_ipt_entry {
 	struct ipt_ip ip;
 	compat_uint_t nfcache;
 	u_int16_t target_offset;
 	u_int16_t next_offset;
 	compat_uint_t comefrom;
 	struct compat_xt_counters counters;
 	unsigned char elems[0];
 };
 /* Helper functions */
 static inline struct ipt_entry_target *
 compat_ipt_get_target(struct compat_ipt_entry *e)
 {
 	return (void *)e + e->target_offset;
 }
 #define COMPAT_IPT_ALIGN(s) 	COMPAT_XT_ALIGN(s)
 /* fn returns 0 to continue iteration */
 #define COMPAT_IPT_MATCH_ITERATE(e, fn, args...) \
 	XT_MATCH_ITERATE(struct compat_ipt_entry, e, fn, ## args)
 /* fn returns 0 to continue iteration */
 #define COMPAT_IPT_ENTRY_ITERATE(entries, size, fn, args...) \
 	XT_ENTRY_ITERATE(struct compat_ipt_entry, entries, size, fn, ## args)
 /* fn returns 0 to continue iteration */
 #define COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
 	XT_ENTRY_ITERATE_CONTINUE(struct compat_ipt_entry, entries, size, n, \
 				  fn, ## args)
 #endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _IPTABLES_H */

include/linux/netfilter_ipv6/ip6_tables.h

Diff comments View file @ e3eaa99

 /*
  * 25-Jul-1998 Major changes to allow for ip chain table
  *
  * 3-Jan-2000 Named tables to allow packet selection for different uses.
  */
 /*
  * 	Format of an IP6 firewall descriptor
  *
  * 	src, dst, src_mask, dst_mask are always stored in network byte order.
  * 	flags are stored in host byte order (of course).
  * 	Port numbers are stored in HOST byte order.
  */
 #ifndef _IP6_TABLES_H
 #define _IP6_TABLES_H
 #ifdef __KERNEL__
 #include <linux/if.h>
 #include <linux/in6.h>
 #include <linux/ipv6.h>
 #include <linux/skbuff.h>
 #endif
 #include <linux/types.h>
 #include <linux/compiler.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter/x_tables.h>
 #define IP6T_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
 #define IP6T_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
 #define ip6t_match xt_match
 #define ip6t_target xt_target
 #define ip6t_table xt_table
 #define ip6t_get_revision xt_get_revision
 /* Yes, Virginia, you have to zero the padding. */
 struct ip6t_ip6 {
 	/* Source and destination IP6 addr */
 	struct in6_addr src, dst;
 	/* Mask for src and dest IP6 addr */
 	struct in6_addr smsk, dmsk;
 	char iniface[IFNAMSIZ], outiface[IFNAMSIZ];
 	unsigned char iniface_mask[IFNAMSIZ], outiface_mask[IFNAMSIZ];
 	/* Upper protocol number
 	 * - The allowed value is 0 (any) or protocol number of last parsable
 	 *   header, which is 50 (ESP), 59 (No Next Header), 135 (MH), or
 	 *   the non IPv6 extension headers.
 	 * - The protocol numbers of IPv6 extension headers except of ESP and
 	 *   MH do not match any packets.
 	 * - You also need to set IP6T_FLAGS_PROTO to "flags" to check protocol.
 	 */
 	u_int16_t proto;
 	/* TOS to match iff flags & IP6T_F_TOS */
 	u_int8_t tos;
 	/* Flags word */
 	u_int8_t flags;
 	/* Inverse flags */
 	u_int8_t invflags;
 };
 #define ip6t_entry_match xt_entry_match
 #define ip6t_entry_target xt_entry_target
 #define ip6t_standard_target xt_standard_target
 #define ip6t_counters	xt_counters
 /* Values for "flag" field in struct ip6t_ip6 (general ip6 structure). */
 #define IP6T_F_PROTO		0x01	/* Set if rule cares about upper
 					   protocols */
 #define IP6T_F_TOS		0x02	/* Match the TOS. */
 #define IP6T_F_GOTO		0x04	/* Set if jump is a goto */
 #define IP6T_F_MASK		0x07	/* All possible flag bits mask. */
 /* Values for "inv" field in struct ip6t_ip6. */
 #define IP6T_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
 #define IP6T_INV_VIA_OUT		0x02	/* Invert the sense of OUT IFACE */
 #define IP6T_INV_TOS		0x04	/* Invert the sense of TOS. */
 #define IP6T_INV_SRCIP		0x08	/* Invert the sense of SRC IP. */
 #define IP6T_INV_DSTIP		0x10	/* Invert the sense of DST OP. */
 #define IP6T_INV_FRAG		0x20	/* Invert the sense of FRAG. */
 #define IP6T_INV_PROTO		XT_INV_PROTO
 #define IP6T_INV_MASK		0x7F	/* All possible flag bits mask. */
 /* This structure defines each of the firewall rules.  Consists of 3
    parts which are 1) general IP header stuff 2) match specific
    stuff 3) the target to perform if the rule matches */
 struct ip6t_entry {
 	struct ip6t_ip6 ipv6;
 	/* Mark with fields that we care about. */
 	unsigned int nfcache;
 	/* Size of ipt_entry + matches */
 	u_int16_t target_offset;
 	/* Size of ipt_entry + matches + target */
 	u_int16_t next_offset;
 	/* Back pointer */
 	unsigned int comefrom;
 	/* Packet and byte counters. */
 	struct xt_counters counters;
 	/* The matches (if any), then the target. */
 	unsigned char elems[0];
 };
 /* Standard entry */
 struct ip6t_standard {
 	struct ip6t_entry entry;
 	struct ip6t_standard_target target;
 };
 struct ip6t_error_target {
 	struct ip6t_entry_target target;
 	char errorname[IP6T_FUNCTION_MAXNAMELEN];
 };
 struct ip6t_error {
 	struct ip6t_entry entry;
 	struct ip6t_error_target target;
 };
 #define IP6T_ENTRY_INIT(__size)						       \
 {									       \
 	.target_offset	= sizeof(struct ip6t_entry),			       \
 	.next_offset	= (__size),					       \
 }
 #define IP6T_STANDARD_INIT(__verdict)					       \
 {									       \
 	.entry		= IP6T_ENTRY_INIT(sizeof(struct ip6t_standard)),       \
 	.target		= XT_TARGET_INIT(IP6T_STANDARD_TARGET,		       \
 					 sizeof(struct ip6t_standard_target)), \
 	.target.verdict	= -(__verdict) - 1,				       \
 }
 #define IP6T_ERROR_INIT							       \
 {									       \
 	.entry		= IP6T_ENTRY_INIT(sizeof(struct ip6t_error)),	       \
 	.target		= XT_TARGET_INIT(IP6T_ERROR_TARGET,		       \
 					 sizeof(struct ip6t_error_target)),    \
 	.target.errorname = "ERROR",					       \
 }
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use
  * a raw socket for this. Instead we check rights in the calls.
  *
  * ATTENTION: check linux/in6.h before adding new number here.
  */
 #define IP6T_BASE_CTL			64
 #define IP6T_SO_SET_REPLACE		(IP6T_BASE_CTL)
 #define IP6T_SO_SET_ADD_COUNTERS	(IP6T_BASE_CTL + 1)
 #define IP6T_SO_SET_MAX			IP6T_SO_SET_ADD_COUNTERS
 #define IP6T_SO_GET_INFO		(IP6T_BASE_CTL)
 #define IP6T_SO_GET_ENTRIES		(IP6T_BASE_CTL + 1)
 #define IP6T_SO_GET_REVISION_MATCH	(IP6T_BASE_CTL + 4)
 #define IP6T_SO_GET_REVISION_TARGET	(IP6T_BASE_CTL + 5)
 #define IP6T_SO_GET_MAX			IP6T_SO_GET_REVISION_TARGET
 /* CONTINUE verdict for targets */
 #define IP6T_CONTINUE XT_CONTINUE
 /* For standard target */
 #define IP6T_RETURN XT_RETURN
 /* TCP/UDP matching stuff */
 #include <linux/netfilter/xt_tcpudp.h>
 #define ip6t_tcp xt_tcp
 #define ip6t_udp xt_udp
 /* Values for "inv" field in struct ipt_tcp. */
 #define IP6T_TCP_INV_SRCPT	XT_TCP_INV_SRCPT
 #define IP6T_TCP_INV_DSTPT	XT_TCP_INV_DSTPT
 #define IP6T_TCP_INV_FLAGS	XT_TCP_INV_FLAGS
 #define IP6T_TCP_INV_OPTION	XT_TCP_INV_OPTION
 #define IP6T_TCP_INV_MASK	XT_TCP_INV_MASK
 /* Values for "invflags" field in struct ipt_udp. */
 #define IP6T_UDP_INV_SRCPT	XT_UDP_INV_SRCPT
 #define IP6T_UDP_INV_DSTPT	XT_UDP_INV_DSTPT
 #define IP6T_UDP_INV_MASK	XT_UDP_INV_MASK
 /* ICMP matching stuff */
 struct ip6t_icmp {
 	u_int8_t type;				/* type to match */
 	u_int8_t code[2];			/* range of code */
 	u_int8_t invflags;			/* Inverse flags */
 };
 /* Values for "inv" field for struct ipt_icmp. */
 #define IP6T_ICMP_INV	0x01	/* Invert the sense of type/code test */
 /* The argument to IP6T_SO_GET_INFO */
 struct ip6t_getinfo {
 	/* Which table: caller fills this in. */
 	char name[IP6T_TABLE_MAXNAMELEN];
 	/* Kernel fills these in. */
 	/* Which hook entry points are valid: bitmask */
 	unsigned int valid_hooks;
 	/* Hook entry points: one per netfilter hook. */
 	unsigned int hook_entry[NF_INET_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_INET_NUMHOOKS];
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Size of entries. */
 	unsigned int size;
 };
 /* The argument to IP6T_SO_SET_REPLACE. */
 struct ip6t_replace {
 	/* Which table. */
 	char name[IP6T_TABLE_MAXNAMELEN];
 	/* Which hook entry points are valid: bitmask.  You can't
            change this. */
 	unsigned int valid_hooks;
 	/* Number of entries */
 	unsigned int num_entries;
 	/* Total size of new entries */
 	unsigned int size;
 	/* Hook entry points. */
 	unsigned int hook_entry[NF_INET_NUMHOOKS];
 	/* Underflow points. */
 	unsigned int underflow[NF_INET_NUMHOOKS];
 	/* Information about old entries: */
 	/* Number of counters (must be equal to current number of entries). */
 	unsigned int num_counters;
 	/* The old entries' counters. */
 	struct xt_counters __user *counters;
 	/* The entries (hang off end: not really an array). */
 	struct ip6t_entry entries[0];
 };
 /* The argument to IP6T_SO_ADD_COUNTERS. */
 #define ip6t_counters_info xt_counters_info
 /* The argument to IP6T_SO_GET_ENTRIES. */
 struct ip6t_get_entries {
 	/* Which table: user fills this in. */
 	char name[IP6T_TABLE_MAXNAMELEN];
 	/* User fills this in: total entry size. */
 	unsigned int size;
 	/* The entries. */
 	struct ip6t_entry entrytable[0];
 };
 /* Standard return verdict, or do jump. */
 #define IP6T_STANDARD_TARGET XT_STANDARD_TARGET
 /* Error verdict. */
 #define IP6T_ERROR_TARGET XT_ERROR_TARGET
 /* Helper functions */
 static __inline__ struct ip6t_entry_target *
 ip6t_get_target(struct ip6t_entry *e)
 {
 	return (void *)e + e->target_offset;
 }
 /* fn returns 0 to continue iteration */
 #define IP6T_MATCH_ITERATE(e, fn, args...) \
 	XT_MATCH_ITERATE(struct ip6t_entry, e, fn, ## args)
 /* fn returns 0 to continue iteration */
 #define IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
 	XT_ENTRY_ITERATE(struct ip6t_entry, entries, size, fn, ## args)
 /*
  *	Main firewall chains definitions and global var's definitions.
  */
 #ifdef __KERNEL__
 #include <linux/init.h>
 extern void ip6t_init(void) __init;
+extern void *ip6t_alloc_initial_table(const struct xt_table *);
 extern struct xt_table *ip6t_register_table(struct net *net,
 					    const struct xt_table *table,
 					    const struct ip6t_replace *repl);
 extern void ip6t_unregister_table(struct net *net, struct xt_table *table);
 extern unsigned int ip6t_do_table(struct sk_buff *skb,
 				  unsigned int hook,
 				  const struct net_device *in,
 				  const struct net_device *out,
 				  struct xt_table *table);
 /* Check for an extension */
 extern int ip6t_ext_hdr(u8 nexthdr);
 /* find specified header and get offset to it */
 extern int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 			 int target, unsigned short *fragoff);
 extern int ip6_masked_addrcmp(const struct in6_addr *addr1,
 			      const struct in6_addr *mask,
 			      const struct in6_addr *addr2);
 #define IP6T_ALIGN(s) XT_ALIGN(s)
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 struct compat_ip6t_entry {
 	struct ip6t_ip6 ipv6;
 	compat_uint_t nfcache;
 	u_int16_t target_offset;
 	u_int16_t next_offset;
 	compat_uint_t comefrom;
 	struct compat_xt_counters counters;
 	unsigned char elems[0];
 };
 static inline struct ip6t_entry_target *
 compat_ip6t_get_target(struct compat_ip6t_entry *e)
 {
 	return (void *)e + e->target_offset;
 }
 #define COMPAT_IP6T_ALIGN(s)	COMPAT_XT_ALIGN(s)
 /* fn returns 0 to continue iteration */
 #define COMPAT_IP6T_MATCH_ITERATE(e, fn, args...) \
 	XT_MATCH_ITERATE(struct compat_ip6t_entry, e, fn, ## args)
 /* fn returns 0 to continue iteration */
 #define COMPAT_IP6T_ENTRY_ITERATE(entries, size, fn, args...) \
 	XT_ENTRY_ITERATE(struct compat_ip6t_entry, entries, size, fn, ## args)
 #define COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
 	XT_ENTRY_ITERATE_CONTINUE(struct compat_ip6t_entry, entries, size, n, \
 				  fn, ## args)
 #endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _IP6_TABLES_H */

net/ipv4/netfilter/arp_tables.c

Diff comments View file @ e3eaa99

 /*
  * Packet matching code for ARP packets.
  *
  * Based heavily, if not almost entirely, upon ip_tables.c framework.
  *
  * Some ARP specific bits are:
  *
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
  *
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/capability.h>
 #include <linux/if_arp.h>
 #include <linux/kmod.h>
 #include <linux/vmalloc.h>
 #include <linux/proc_fs.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
 #include <linux/err.h>
 #include <net/compat.h>
 #include <net/sock.h>
 #include <asm/uaccess.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp/arp_tables.h>
+#include "../../netfilter/xt_repldata.h"
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
 MODULE_DESCRIPTION("arptables core");
 /*#define DEBUG_ARP_TABLES*/
 /*#define DEBUG_ARP_TABLES_USER*/
 #ifdef DEBUG_ARP_TABLES
 #define dprintf(format, args...)  printk(format , ## args)
 #else
 #define dprintf(format, args...)
 #endif
 #ifdef DEBUG_ARP_TABLES_USER
 #define duprintf(format, args...) printk(format , ## args)
 #else
 #define duprintf(format, args...)
 #endif
 #ifdef CONFIG_NETFILTER_DEBUG
 #define ARP_NF_ASSERT(x)					\
 do {								\
 	if (!(x))						\
 		printk("ARP_NF_ASSERT: %s:%s:%u\n",		\
 		       __func__, __FILE__, __LINE__);	\
 } while(0)
 #else
 #define ARP_NF_ASSERT(x)
 #endif
+void *arpt_alloc_initial_table(const struct xt_table *info)
+{
+	return xt_alloc_initial_table(arpt, ARPT);
+}
+EXPORT_SYMBOL_GPL(arpt_alloc_initial_table);
 static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
 				      const char *hdr_addr, int len)
 {
 	int i, ret;
 	if (len > ARPT_DEV_ADDR_LEN_MAX)
 		len = ARPT_DEV_ADDR_LEN_MAX;
 	ret = 0;
 	for (i = 0; i < len; i++)
 		ret |= (hdr_addr[i] ^ ap->addr[i]) & ap->mask[i];
 	return (ret != 0);
 }
 /*
  * Unfortunatly, _b and _mask are not aligned to an int (or long int)
  * Some arches dont care, unrolling the loop is a win on them.
  * For other arches, we only have a 16bit alignement.
  */
 static unsigned long ifname_compare(const char *_a, const char *_b, const char *_mask)
 {
 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
 	unsigned long ret = ifname_compare_aligned(_a, _b, _mask);
 #else
 	unsigned long ret = 0;
 	const u16 *a = (const u16 *)_a;
 	const u16 *b = (const u16 *)_b;
 	const u16 *mask = (const u16 *)_mask;
 	int i;
 	for (i = 0; i < IFNAMSIZ/sizeof(u16); i++)
 		ret |= (a[i] ^ b[i]) & mask[i];
 #endif
 	return ret;
 }
 /* Returns whether packet matches rule or not. */
 static inline int arp_packet_match(const struct arphdr *arphdr,
 				   struct net_device *dev,
 				   const char *indev,
 				   const char *outdev,
 				   const struct arpt_arp *arpinfo)
 {
 	const char *arpptr = (char *)(arphdr + 1);
 	const char *src_devaddr, *tgt_devaddr;
 	__be32 src_ipaddr, tgt_ipaddr;
 	long ret;
 #define FWINV(bool, invflg) ((bool) ^ !!(arpinfo->invflags & (invflg)))
 	if (FWINV((arphdr->ar_op & arpinfo->arpop_mask) != arpinfo->arpop,
 		  ARPT_INV_ARPOP)) {
 		dprintf("ARP operation field mismatch.\n");
 		dprintf("ar_op: %04x info->arpop: %04x info->arpop_mask: %04x\n",
 			arphdr->ar_op, arpinfo->arpop, arpinfo->arpop_mask);
 		return 0;
 	}
 	if (FWINV((arphdr->ar_hrd & arpinfo->arhrd_mask) != arpinfo->arhrd,
 		  ARPT_INV_ARPHRD)) {
 		dprintf("ARP hardware address format mismatch.\n");
 		dprintf("ar_hrd: %04x info->arhrd: %04x info->arhrd_mask: %04x\n",
 			arphdr->ar_hrd, arpinfo->arhrd, arpinfo->arhrd_mask);
 		return 0;
 	}
 	if (FWINV((arphdr->ar_pro & arpinfo->arpro_mask) != arpinfo->arpro,
 		  ARPT_INV_ARPPRO)) {
 		dprintf("ARP protocol address format mismatch.\n");
 		dprintf("ar_pro: %04x info->arpro: %04x info->arpro_mask: %04x\n",
 			arphdr->ar_pro, arpinfo->arpro, arpinfo->arpro_mask);
 		return 0;
 	}
 	if (FWINV((arphdr->ar_hln & arpinfo->arhln_mask) != arpinfo->arhln,
 		  ARPT_INV_ARPHLN)) {
 		dprintf("ARP hardware address length mismatch.\n");
 		dprintf("ar_hln: %02x info->arhln: %02x info->arhln_mask: %02x\n",
 			arphdr->ar_hln, arpinfo->arhln, arpinfo->arhln_mask);
 		return 0;
 	}
 	src_devaddr = arpptr;
 	arpptr += dev->addr_len;
 	memcpy(&src_ipaddr, arpptr, sizeof(u32));
 	arpptr += sizeof(u32);
 	tgt_devaddr = arpptr;
 	arpptr += dev->addr_len;
 	memcpy(&tgt_ipaddr, arpptr, sizeof(u32));
 	if (FWINV(arp_devaddr_compare(&arpinfo->src_devaddr, src_devaddr, dev->addr_len),
 		  ARPT_INV_SRCDEVADDR) ||
 	    FWINV(arp_devaddr_compare(&arpinfo->tgt_devaddr, tgt_devaddr, dev->addr_len),
 		  ARPT_INV_TGTDEVADDR)) {
 		dprintf("Source or target device address mismatch.\n");
 		return 0;
 	}
 	if (FWINV((src_ipaddr & arpinfo->smsk.s_addr) != arpinfo->src.s_addr,
 		  ARPT_INV_SRCIP) ||
 	    FWINV(((tgt_ipaddr & arpinfo->tmsk.s_addr) != arpinfo->tgt.s_addr),
 		  ARPT_INV_TGTIP)) {
 		dprintf("Source or target IP address mismatch.\n");
 		dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
 			&src_ipaddr,
 			&arpinfo->smsk.s_addr,
 			&arpinfo->src.s_addr,
 			arpinfo->invflags & ARPT_INV_SRCIP ? " (INV)" : "");
 		dprintf("TGT: %pI4 Mask: %pI4 Target: %pI4.%s\n",
 			&tgt_ipaddr,
 			&arpinfo->tmsk.s_addr,
 			&arpinfo->tgt.s_addr,
 			arpinfo->invflags & ARPT_INV_TGTIP ? " (INV)" : "");
 		return 0;
 	}
 	/* Look for ifname matches.  */
 	ret = ifname_compare(indev, arpinfo->iniface, arpinfo->iniface_mask);
 	if (FWINV(ret != 0, ARPT_INV_VIA_IN)) {
 		dprintf("VIA in mismatch (%s vs %s).%s\n",
 			indev, arpinfo->iniface,
 			arpinfo->invflags&ARPT_INV_VIA_IN ?" (INV)":"");
 		return 0;
 	}
 	ret = ifname_compare(outdev, arpinfo->outiface, arpinfo->outiface_mask);
 	if (FWINV(ret != 0, ARPT_INV_VIA_OUT)) {
 		dprintf("VIA out mismatch (%s vs %s).%s\n",
 			outdev, arpinfo->outiface,
 			arpinfo->invflags&ARPT_INV_VIA_OUT ?" (INV)":"");
 		return 0;
 	}
 	return 1;
 #undef FWINV
 }
 static inline int arp_checkentry(const struct arpt_arp *arp)
 {
 	if (arp->flags & ~ARPT_F_MASK) {
 		duprintf("Unknown flag bits set: %08X\n",
 			 arp->flags & ~ARPT_F_MASK);
 		return 0;
 	}
 	if (arp->invflags & ~ARPT_INV_MASK) {
 		duprintf("Unknown invflag bits set: %08X\n",
 			 arp->invflags & ~ARPT_INV_MASK);
 		return 0;
 	}
 	return 1;
 }
 static unsigned int
 arpt_error(struct sk_buff *skb, const struct xt_target_param *par)
 {
 	if (net_ratelimit())
 		printk("arp_tables: error: '%s'\n",
 		       (const char *)par->targinfo);
 	return NF_DROP;
 }
 static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
 {
 	return (struct arpt_entry *)(base + offset);
 }
 static inline __pure
 struct arpt_entry *arpt_next_entry(const struct arpt_entry *entry)
 {
 	return (void *)entry + entry->next_offset;
 }
 unsigned int arpt_do_table(struct sk_buff *skb,
 			   unsigned int hook,
 			   const struct net_device *in,
 			   const struct net_device *out,
 			   struct xt_table *table)
 {
 	static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 	unsigned int verdict = NF_DROP;
 	const struct arphdr *arp;
 	bool hotdrop = false;
 	struct arpt_entry *e, *back;
 	const char *indev, *outdev;
 	void *table_base;
 	const struct xt_table_info *private;
 	struct xt_target_param tgpar;
 	if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
 		return NF_DROP;
 	indev = in ? in->name : nulldevname;
 	outdev = out ? out->name : nulldevname;
 	xt_info_rdlock_bh();
 	private = table->private;
 	table_base = private->entries[smp_processor_id()];
 	e = get_entry(table_base, private->hook_entry[hook]);
 	back = get_entry(table_base, private->underflow[hook]);
 	tgpar.in      = in;
 	tgpar.out     = out;
 	tgpar.hooknum = hook;
 	tgpar.family  = NFPROTO_ARP;
 	arp = arp_hdr(skb);
 	do {
 		struct arpt_entry_target *t;
 		int hdr_len;
 		if (!arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
 			e = arpt_next_entry(e);
 			continue;
 		}
 		hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
 			(2 * skb->dev->addr_len);
 		ADD_COUNTER(e->counters, hdr_len, 1);
 		t = arpt_get_target(e);
 		/* Standard target? */
 		if (!t->u.kernel.target->target) {
 			int v;
 			v = ((struct arpt_standard_target *)t)->verdict;
 			if (v < 0) {
 				/* Pop from stack? */
 				if (v != ARPT_RETURN) {
 					verdict = (unsigned)(-v) - 1;
 					break;
 				}
 				e = back;
 				back = get_entry(table_base, back->comefrom);
 				continue;
 			}
 			if (table_base + v
 			    != arpt_next_entry(e)) {
 				/* Save old back ptr in next entry */
 				struct arpt_entry *next = arpt_next_entry(e);
 				next->comefrom = (void *)back - table_base;
 				/* set back pointer to next entry */
 				back = next;
 			}
 			e = get_entry(table_base, v);
 			continue;
 		}
 		/* Targets which reenter must return
 		 * abs. verdicts
 		 */
 		tgpar.target   = t->u.kernel.target;
 		tgpar.targinfo = t->data;
 		verdict = t->u.kernel.target->target(skb, &tgpar);
 		/* Target might have changed stuff. */
 		arp = arp_hdr(skb);
 		if (verdict == ARPT_CONTINUE)
 			e = arpt_next_entry(e);
 		else
 			/* Verdict */
 			break;
 	} while (!hotdrop);
 	xt_info_rdunlock_bh();
 	if (hotdrop)
 		return NF_DROP;
 	else
 		return verdict;
 }
 /* All zeroes == unconditional rule. */
 static inline bool unconditional(const struct arpt_arp *arp)
 {
 	static const struct arpt_arp uncond;
 	return memcmp(arp, &uncond, sizeof(uncond)) == 0;
 }
 /* Figures out from what hook each rule can be called: returns 0 if
  * there are loops.  Puts hook bitmask in comefrom.
  */
 static int mark_source_chains(struct xt_table_info *newinfo,
 			      unsigned int valid_hooks, void *entry0)
 {
 	unsigned int hook;
 	/* No recursion; use packet counter to save back ptrs (reset
 	 * to 0 as we leave), and comefrom to save source hook bitmask.
 	 */
 	for (hook = 0; hook < NF_ARP_NUMHOOKS; hook++) {
 		unsigned int pos = newinfo->hook_entry[hook];
 		struct arpt_entry *e
 			= (struct arpt_entry *)(entry0 + pos);
 		if (!(valid_hooks & (1 << hook)))
 			continue;
 		/* Set initial back pointer. */
 		e->counters.pcnt = pos;
 		for (;;) {
 			const struct arpt_standard_target *t
 				= (void *)arpt_get_target(e);
 			int visited = e->comefrom & (1 << hook);
 			if (e->comefrom & (1 << NF_ARP_NUMHOOKS)) {
 				printk("arptables: loop hook %u pos %u %08X.\n",
 				       hook, pos, e->comefrom);
 				return 0;
 			}
 			e->comefrom
 				|= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
 			/* Unconditional return/END. */
 			if ((e->target_offset == sizeof(struct arpt_entry) &&
 			     (strcmp(t->target.u.user.name,
 				     ARPT_STANDARD_TARGET) == 0) &&
 			     t->verdict < 0 && unconditional(&e->arp)) ||
 			    visited) {
 				unsigned int oldpos, size;
 				if ((strcmp(t->target.u.user.name,
 					    ARPT_STANDARD_TARGET) == 0) &&
 				    t->verdict < -NF_MAX_VERDICT - 1) {
 					duprintf("mark_source_chains: bad "
 						"negative verdict (%i)\n",
 								t->verdict);
 					return 0;
 				}
 				/* Return: backtrack through the last
 				 * big jump.
 				 */
 				do {
 					e->comefrom ^= (1<<NF_ARP_NUMHOOKS);
 					oldpos = pos;
 					pos = e->counters.pcnt;
 					e->counters.pcnt = 0;
 					/* We're at the start. */
 					if (pos == oldpos)
 						goto next;
 					e = (struct arpt_entry *)
 						(entry0 + pos);
 				} while (oldpos == pos + e->next_offset);
 				/* Move along one */
 				size = e->next_offset;
 				e = (struct arpt_entry *)
 					(entry0 + pos + size);
 				e->counters.pcnt = pos;
 				pos += size;
 			} else {
 				int newpos = t->verdict;
 				if (strcmp(t->target.u.user.name,
 					   ARPT_STANDARD_TARGET) == 0 &&
 				    newpos >= 0) {
 					if (newpos > newinfo->size -
 						sizeof(struct arpt_entry)) {
 						duprintf("mark_source_chains: "
 							"bad verdict (%i)\n",
 								newpos);
 						return 0;
 					}
 					/* This a jump; chase it. */
 					duprintf("Jump rule %u -> %u\n",
 						 pos, newpos);
 				} else {
 					/* ... this is a fallthru */
 					newpos = pos + e->next_offset;
 				}
 				e = (struct arpt_entry *)
 					(entry0 + newpos);
 				e->counters.pcnt = pos;
 				pos = newpos;
 			}
 		}
 		next:
 		duprintf("Finished chain %u\n", hook);
 	}
 	return 1;
 }
 static inline int check_entry(struct arpt_entry *e, const char *name)
 {
 	const struct arpt_entry_target *t;
 	if (!arp_checkentry(&e->arp)) {
 		duprintf("arp_tables: arp check failed %p %s.\n", e, name);
 		return -EINVAL;
 	}
 	if (e->target_offset + sizeof(struct arpt_entry_target) > e->next_offset)
 		return -EINVAL;
 	t = arpt_get_target(e);
 	if (e->target_offset + t->u.target_size > e->next_offset)
 		return -EINVAL;
 	return 0;
 }
 static inline int check_target(struct arpt_entry *e, const char *name)
 {
 	struct arpt_entry_target *t = arpt_get_target(e);
 	int ret;
 	struct xt_tgchk_param par = {
 		.table     = name,
 		.entryinfo = e,
 		.target    = t->u.kernel.target,
 		.targinfo  = t->data,
 		.hook_mask = e->comefrom,
 		.family    = NFPROTO_ARP,
 	};
 	ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
 	if (ret < 0) {
 		duprintf("arp_tables: check failed for `%s'.\n",
 			 t->u.kernel.target->name);
 		return ret;
 	}
 	return 0;
 }
 static inline int
 find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
 		 unsigned int *i)
 {
 	struct arpt_entry_target *t;
 	struct xt_target *target;
 	int ret;
 	ret = check_entry(e, name);
 	if (ret)
 		return ret;
 	t = arpt_get_target(e);
 	target = try_then_request_module(xt_find_target(NFPROTO_ARP,
 							t->u.user.name,
 							t->u.user.revision),
 					 "arpt_%s", t->u.user.name);
 	if (IS_ERR(target) || !target) {
 		duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 		ret = target ? PTR_ERR(target) : -ENOENT;
 		goto out;
 	}
 	t->u.kernel.target = target;
 	ret = check_target(e, name);
 	if (ret)
 		goto err;
 	(*i)++;
 	return 0;
 err:
 	module_put(t->u.kernel.target->me);
 out:
 	return ret;
 }
 static bool check_underflow(struct arpt_entry *e)
 {
 	const struct arpt_entry_target *t;
 	unsigned int verdict;
 	if (!unconditional(&e->arp))
 		return false;
 	t = arpt_get_target(e);
 	if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 		return false;
 	verdict = ((struct arpt_standard_target *)t)->verdict;
 	verdict = -verdict - 1;
 	return verdict == NF_DROP || verdict == NF_ACCEPT;
 }
 static inline int check_entry_size_and_hooks(struct arpt_entry *e,
 					     struct xt_table_info *newinfo,
 					     unsigned char *base,
 					     unsigned char *limit,
 					     const unsigned int *hook_entries,
 					     const unsigned int *underflows,
 					     unsigned int valid_hooks,
 					     unsigned int *i)
 {
 	unsigned int h;
 	if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
 	    (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
 		duprintf("Bad offset %p\n", e);
 		return -EINVAL;
 	}
 	if (e->next_offset
 	    < sizeof(struct arpt_entry) + sizeof(struct arpt_entry_target)) {
 		duprintf("checking: element %p size %u\n",
 			 e, e->next_offset);
 		return -EINVAL;
 	}
 	/* Check hooks & underflows */
 	for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
 		if (!(valid_hooks & (1 << h)))
 			continue;
 		if ((unsigned char *)e - base == hook_entries[h])
 			newinfo->hook_entry[h] = hook_entries[h];
 		if ((unsigned char *)e - base == underflows[h]) {
 			if (!check_underflow(e)) {
 				pr_err("Underflows must be unconditional and "
 				       "use the STANDARD target with "
 				       "ACCEPT/DROP\n");
 				return -EINVAL;
 			}
 			newinfo->underflow[h] = underflows[h];
 		}
 	}
 	/* Clear counters and comefrom */
 	e->counters = ((struct xt_counters) { 0, 0 });
 	e->comefrom = 0;
 	(*i)++;
 	return 0;
 }
 static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
 {
 	struct xt_tgdtor_param par;
 	struct arpt_entry_target *t;
 	if (i && (*i)-- == 0)
 		return 1;
 	t = arpt_get_target(e);
 	par.target   = t->u.kernel.target;
 	par.targinfo = t->data;
 	par.family   = NFPROTO_ARP;
 	if (par.target->destroy != NULL)
 		par.target->destroy(&par);
 	module_put(par.target->me);
 	return 0;
 }
 /* Checks and translates the user-supplied table segment (held in
  * newinfo).
  */
 static int translate_table(const char *name,
 			   unsigned int valid_hooks,
 			   struct xt_table_info *newinfo,
 			   void *entry0,
 			   unsigned int size,
 			   unsigned int number,
 			   const unsigned int *hook_entries,
 			   const unsigned int *underflows)
 {
 	unsigned int i;
 	int ret;
 	newinfo->size = size;
 	newinfo->number = number;
 	/* Init all hooks to impossible value. */
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = 0xFFFFFFFF;
 		newinfo->underflow[i] = 0xFFFFFFFF;
 	}
 	duprintf("translate_table: size %u\n", newinfo->size);
 	i = 0;
 	/* Walk through entries, checking offsets. */
 	ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
 				 check_entry_size_and_hooks,
 				 newinfo,
 				 entry0,
 				 entry0 + size,
 				 hook_entries, underflows, valid_hooks, &i);
 	duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
 	if (ret != 0)
 		return ret;
 	if (i != number) {
 		duprintf("translate_table: %u not %u entries\n",
 			 i, number);
 		return -EINVAL;
 	}
 	/* Check hooks all assigned */
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		/* Only hooks which are valid */
 		if (!(valid_hooks & (1 << i)))
 			continue;
 		if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 			duprintf("Invalid hook entry %u %u\n",
 				 i, hook_entries[i]);
 			return -EINVAL;
 		}
 		if (newinfo->underflow[i] == 0xFFFFFFFF) {
 			duprintf("Invalid underflow %u %u\n",
 				 i, underflows[i]);
 			return -EINVAL;
 		}
 	}
 	if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
 		duprintf("Looping hook\n");
 		return -ELOOP;
 	}
 	/* Finally, each sanity check must pass */
 	i = 0;
 	ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
 				 find_check_entry, name, size, &i);
 	if (ret != 0) {
 		ARPT_ENTRY_ITERATE(entry0, newinfo->size,
 				cleanup_entry, &i);
 		return ret;
 	}
 	/* And one copy for every other CPU */
 	for_each_possible_cpu(i) {
 		if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 			memcpy(newinfo->entries[i], entry0, newinfo->size);
 	}
 	return ret;
 }
 /* Gets counters. */
 static inline int add_entry_to_counter(const struct arpt_entry *e,
 				       struct xt_counters total[],
 				       unsigned int *i)
 {
 	ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 	(*i)++;
 	return 0;
 }
 static inline int set_entry_to_counter(const struct arpt_entry *e,
 				       struct xt_counters total[],
 				       unsigned int *i)
 {
 	SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 	(*i)++;
 	return 0;
 }
 static void get_counters(const struct xt_table_info *t,
 			 struct xt_counters counters[])
 {
 	unsigned int cpu;
 	unsigned int i;
 	unsigned int curcpu;
 	/* Instead of clearing (by a previous call to memset())
 	 * the counters and using adds, we set the counters
 	 * with data used by 'current' CPU
 	 *
 	 * Bottom half has to be disabled to prevent deadlock
 	 * if new softirq were to run and call ipt_do_table
 	 */
 	local_bh_disable();
 	curcpu = smp_processor_id();
 	i = 0;
 	ARPT_ENTRY_ITERATE(t->entries[curcpu],
 			   t->size,
 			   set_entry_to_counter,
 			   counters,
 			   &i);
 	for_each_possible_cpu(cpu) {
 		if (cpu == curcpu)
 			continue;
 		i = 0;
 		xt_info_wrlock(cpu);
 		ARPT_ENTRY_ITERATE(t->entries[cpu],
 				   t->size,
 				   add_entry_to_counter,
 				   counters,
 				   &i);
 		xt_info_wrunlock(cpu);
 	}
 	local_bh_enable();
 }
 static struct xt_counters *alloc_counters(struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
 	struct xt_table_info *private = table->private;
 	/* We need atomic snapshot of counters: rest doesn't change
 	 * (other than comefrom, which userspace doesn't care
 	 * about).
 	 */
 	countersize = sizeof(struct xt_counters) * private->number;
 	counters = vmalloc_node(countersize, numa_node_id());
 	if (counters == NULL)
 		return ERR_PTR(-ENOMEM);
 	get_counters(private, counters);
 	return counters;
 }
 static int copy_entries_to_user(unsigned int total_size,
 				struct xt_table *table,
 				void __user *userptr)
 {
 	unsigned int off, num;
 	struct arpt_entry *e;
 	struct xt_counters *counters;
 	struct xt_table_info *private = table->private;
 	int ret = 0;
 	void *loc_cpu_entry;
 	counters = alloc_counters(table);
 	if (IS_ERR(counters))
 		return PTR_ERR(counters);
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	/* ... then copy entire thing ... */
 	if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 		ret = -EFAULT;
 		goto free_counters;
 	}
 	/* FIXME: use iterator macros --RR */
 	/* ... then go back and fix counters and names */
 	for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 		struct arpt_entry_target *t;
 		e = (struct arpt_entry *)(loc_cpu_entry + off);
 		if (copy_to_user(userptr + off
 				 + offsetof(struct arpt_entry, counters),
 				 &counters[num],
 				 sizeof(counters[num])) != 0) {
 			ret = -EFAULT;
 			goto free_counters;
 		}
 		t = arpt_get_target(e);
 		if (copy_to_user(userptr + off + e->target_offset
 				 + offsetof(struct arpt_entry_target,
 					    u.user.name),
 				 t->u.kernel.target->name,
 				 strlen(t->u.kernel.target->name)+1) != 0) {
 			ret = -EFAULT;
 			goto free_counters;
 		}
 	}
  free_counters:
 	vfree(counters);
 	return ret;
 }
 #ifdef CONFIG_COMPAT
 static void compat_standard_from_user(void *dst, void *src)
 {
 	int v = *(compat_int_t *)src;
 	if (v > 0)
 		v += xt_compat_calc_jump(NFPROTO_ARP, v);
 	memcpy(dst, &v, sizeof(v));
 }
 static int compat_standard_to_user(void __user *dst, void *src)
 {
 	compat_int_t cv = *(int *)src;
 	if (cv > 0)
 		cv -= xt_compat_calc_jump(NFPROTO_ARP, cv);
 	return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 static int compat_calc_entry(struct arpt_entry *e,
 			     const struct xt_table_info *info,
 			     void *base, struct xt_table_info *newinfo)
 {
 	struct arpt_entry_target *t;
 	unsigned int entry_offset;
 	int off, i, ret;
 	off = sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
 	entry_offset = (void *)e - base;
 	t = arpt_get_target(e);
 	off += xt_compat_target_offset(t->u.kernel.target);
 	newinfo->size -= off;
 	ret = xt_compat_add_offset(NFPROTO_ARP, entry_offset, off);
 	if (ret)
 		return ret;
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		if (info->hook_entry[i] &&
 		    (e < (struct arpt_entry *)(base + info->hook_entry[i])))
 			newinfo->hook_entry[i] -= off;
 		if (info->underflow[i] &&
 		    (e < (struct arpt_entry *)(base + info->underflow[i])))
 			newinfo->underflow[i] -= off;
 	}
 	return 0;
 }
 static int compat_table_info(const struct xt_table_info *info,
 			     struct xt_table_info *newinfo)
 {
 	void *loc_cpu_entry;
 	if (!newinfo || !info)
 		return -EINVAL;
 	/* we dont care about newinfo->entries[] */
 	memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
 	newinfo->initial_entries = 0;
 	loc_cpu_entry = info->entries[raw_smp_processor_id()];
 	return ARPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
 				  compat_calc_entry, info, loc_cpu_entry,
 				  newinfo);
 }
 #endif
 static int get_info(struct net *net, void __user *user, int *len, int compat)
 {
 	char name[ARPT_TABLE_MAXNAMELEN];
 	struct xt_table *t;
 	int ret;
 	if (*len != sizeof(struct arpt_getinfo)) {
 		duprintf("length %u != %Zu\n", *len,
 			 sizeof(struct arpt_getinfo));
 		return -EINVAL;
 	}
 	if (copy_from_user(name, user, sizeof(name)) != 0)
 		return -EFAULT;
 	name[ARPT_TABLE_MAXNAMELEN-1] = '\0';
 #ifdef CONFIG_COMPAT
 	if (compat)
 		xt_compat_lock(NFPROTO_ARP);
 #endif
 	t = try_then_request_module(xt_find_table_lock(net, NFPROTO_ARP, name),
 				    "arptable_%s", name);
 	if (t && !IS_ERR(t)) {
 		struct arpt_getinfo info;
 		const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 		if (compat) {
 			ret = compat_table_info(private, &tmp);
 			xt_compat_flush_offsets(NFPROTO_ARP);
 			private = &tmp;
 		}
 #endif
 		info.valid_hooks = t->valid_hooks;
 		memcpy(info.hook_entry, private->hook_entry,
 		       sizeof(info.hook_entry));
 		memcpy(info.underflow, private->underflow,
 		       sizeof(info.underflow));
 		info.num_entries = private->number;
 		info.size = private->size;
 		strcpy(info.name, name);
 		if (copy_to_user(user, &info, *len) != 0)
 			ret = -EFAULT;
 		else
 			ret = 0;
 		xt_table_unlock(t);
 		module_put(t->me);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 #ifdef CONFIG_COMPAT
 	if (compat)
 		xt_compat_unlock(NFPROTO_ARP);
 #endif
 	return ret;
 }
 static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
 		       int *len)
 {
 	int ret;
 	struct arpt_get_entries get;
 	struct xt_table *t;
 	if (*len < sizeof(get)) {
 		duprintf("get_entries: %u < %Zu\n", *len, sizeof(get));
 		return -EINVAL;
 	}
 	if (copy_from_user(&get, uptr, sizeof(get)) != 0)
 		return -EFAULT;
 	if (*len != sizeof(struct arpt_get_entries) + get.size) {
 		duprintf("get_entries: %u != %Zu\n", *len,
 			 sizeof(struct arpt_get_entries) + get.size);
 		return -EINVAL;
 	}
 	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
 	if (t && !IS_ERR(t)) {
 		const struct xt_table_info *private = t->private;
 		duprintf("t->private->number = %u\n",
 			 private->number);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
 		else {
 			duprintf("get_entries: I've got %u not %u!\n",
 				 private->size, get.size);
 			ret = -EAGAIN;
 		}
 		module_put(t->me);
 		xt_table_unlock(t);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 	return ret;
 }
 static int __do_replace(struct net *net, const char *name,
 			unsigned int valid_hooks,
 			struct xt_table_info *newinfo,
 			unsigned int num_counters,
 			void __user *counters_ptr)
 {
 	int ret;
 	struct xt_table *t;
 	struct xt_table_info *oldinfo;
 	struct xt_counters *counters;
 	void *loc_cpu_old_entry;
 	ret = 0;
 	counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
 				numa_node_id());
 	if (!counters) {
 		ret = -ENOMEM;
 		goto out;
 	}
 	t = try_then_request_module(xt_find_table_lock(net, NFPROTO_ARP, name),
 				    "arptable_%s", name);
 	if (!t || IS_ERR(t)) {
 		ret = t ? PTR_ERR(t) : -ENOENT;
 		goto free_newinfo_counters_untrans;
 	}
 	/* You lied! */
 	if (valid_hooks != t->valid_hooks) {
 		duprintf("Valid hook crap: %08X vs %08X\n",
 			 valid_hooks, t->valid_hooks);
 		ret = -EINVAL;
 		goto put_module;
 	}
 	oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
 	if (!oldinfo)
 		goto put_module;
 	/* Update module usage count based on number of rules */
 	duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
 		oldinfo->number, oldinfo->initial_entries, newinfo->number);
 	if ((oldinfo->number > oldinfo->initial_entries) ||
 	    (newinfo->number <= oldinfo->initial_entries))
 		module_put(t->me);
 	if ((oldinfo->number > oldinfo->initial_entries) &&
 	    (newinfo->number <= oldinfo->initial_entries))
 		module_put(t->me);
 	/* Get the old counters, and synchronize with replace */
 	get_counters(oldinfo, counters);
 	/* Decrease module usage counts and free resource */
 	loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
 	ARPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
 			   NULL);
 	xt_free_table_info(oldinfo);
 	if (copy_to_user(counters_ptr, counters,
 			 sizeof(struct xt_counters) * num_counters) != 0)
 		ret = -EFAULT;
 	vfree(counters);
 	xt_table_unlock(t);
 	return ret;
  put_module:
 	module_put(t->me);
 	xt_table_unlock(t);
  free_newinfo_counters_untrans:
 	vfree(counters);
  out:
 	return ret;
 }
 static int do_replace(struct net *net, void __user *user, unsigned int len)
 {
 	int ret;
 	struct arpt_replace tmp;
 	struct xt_table_info *newinfo;
 	void *loc_cpu_entry;
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
 	/* overflow check */
 	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
 		return -ENOMEM;
 	newinfo = xt_alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 	/* choose the copy that is on our node/cpu */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
 	}
 	ret = translate_table(tmp.name, tmp.valid_hooks,
 			      newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
 			      tmp.hook_entry, tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo;
 	duprintf("arp_tables: Translated table\n");
 	ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
 			   tmp.num_counters, tmp.counters);
 	if (ret)
 		goto free_newinfo_untrans;
 	return 0;
  free_newinfo_untrans:
 	ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
 }
 /* We're lazy, and add to the first CPU; overflow works its fey magic
  * and everything is OK. */
 static int
 add_counter_to_entry(struct arpt_entry *e,
 		     const struct xt_counters addme[],
 		     unsigned int *i)
 {
 	ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
 	(*i)++;
 	return 0;
 }
 static int do_add_counters(struct net *net, void __user *user, unsigned int len,
 			   int compat)
 {
 	unsigned int i, curcpu;
 	struct xt_counters_info tmp;
 	struct xt_counters *paddc;
 	unsigned int num_counters;
 	const char *name;
 	int size;
 	void *ptmp;
 	struct xt_table *t;
 	const struct xt_table_info *private;
 	int ret = 0;
 	void *loc_cpu_entry;
 #ifdef CONFIG_COMPAT
 	struct compat_xt_counters_info compat_tmp;
 	if (compat) {
 		ptmp = &compat_tmp;
 		size = sizeof(struct compat_xt_counters_info);
 	} else
 #endif
 	{
 		ptmp = &tmp;
 		size = sizeof(struct xt_counters_info);
 	}
 	if (copy_from_user(ptmp, user, size) != 0)
 		return -EFAULT;
 #ifdef CONFIG_COMPAT
 	if (compat) {
 		num_counters = compat_tmp.num_counters;
 		name = compat_tmp.name;
 	} else
 #endif
 	{
 		num_counters = tmp.num_counters;
 		name = tmp.name;
 	}
 	if (len != size + num_counters * sizeof(struct xt_counters))
 		return -EINVAL;
 	paddc = vmalloc_node(len - size, numa_node_id());
 	if (!paddc)
 		return -ENOMEM;
 	if (copy_from_user(paddc, user + size, len - size) != 0) {
 		ret = -EFAULT;
 		goto free;
 	}
 	t = xt_find_table_lock(net, NFPROTO_ARP, name);
 	if (!t || IS_ERR(t)) {
 		ret = t ? PTR_ERR(t) : -ENOENT;
 		goto free;
 	}
 	local_bh_disable();
 	private = t->private;
 	if (private->number != num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
 	}
 	i = 0;
 	/* Choose the copy that is on our node */
 	curcpu = smp_processor_id();
 	loc_cpu_entry = private->entries[curcpu];
 	xt_info_wrlock(curcpu);
 	ARPT_ENTRY_ITERATE(loc_cpu_entry,
 			   private->size,
 			   add_counter_to_entry,
 			   paddc,
 			   &i);
 	xt_info_wrunlock(curcpu);
  unlock_up_free:
 	local_bh_enable();
 	xt_table_unlock(t);
 	module_put(t->me);
  free:
 	vfree(paddc);
 	return ret;
 }
 #ifdef CONFIG_COMPAT
 static inline int
 compat_release_entry(struct compat_arpt_entry *e, unsigned int *i)
 {
 	struct arpt_entry_target *t;
 	if (i && (*i)-- == 0)
 		return 1;
 	t = compat_arpt_get_target(e);
 	module_put(t->u.kernel.target->me);
 	return 0;
 }
 static inline int
 check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
 				  struct xt_table_info *newinfo,
 				  unsigned int *size,
 				  unsigned char *base,
 				  unsigned char *limit,
 				  unsigned int *hook_entries,
 				  unsigned int *underflows,
 				  unsigned int *i,
 				  const char *name)
 {
 	struct arpt_entry_target *t;
 	struct xt_target *target;
 	unsigned int entry_offset;
 	int ret, off, h;
 	duprintf("check_compat_entry_size_and_hooks %p\n", e);
 	if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
 	    (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
 		duprintf("Bad offset %p, limit = %p\n", e, limit);
 		return -EINVAL;
 	}
 	if (e->next_offset < sizeof(struct compat_arpt_entry) +
 			     sizeof(struct compat_xt_entry_target)) {
 		duprintf("checking: element %p size %u\n",
 			 e, e->next_offset);
 		return -EINVAL;
 	}
 	/* For purposes of check_entry casting the compat entry is fine */
 	ret = check_entry((struct arpt_entry *)e, name);
 	if (ret)
 		return ret;
 	off = sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
 	entry_offset = (void *)e - (void *)base;
 	t = compat_arpt_get_target(e);
 	target = try_then_request_module(xt_find_target(NFPROTO_ARP,
 							t->u.user.name,
 							t->u.user.revision),
 					 "arpt_%s", t->u.user.name);
 	if (IS_ERR(target) || !target) {
 		duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
 			 t->u.user.name);
 		ret = target ? PTR_ERR(target) : -ENOENT;
 		goto out;
 	}
 	t->u.kernel.target = target;
 	off += xt_compat_target_offset(target);
 	*size += off;
 	ret = xt_compat_add_offset(NFPROTO_ARP, entry_offset, off);
 	if (ret)
 		goto release_target;
 	/* Check hooks & underflows */
 	for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
 		if ((unsigned char *)e - base == hook_entries[h])
 			newinfo->hook_entry[h] = hook_entries[h];
 		if ((unsigned char *)e - base == underflows[h])
 			newinfo->underflow[h] = underflows[h];
 	}
 	/* Clear counters and comefrom */
 	memset(&e->counters, 0, sizeof(e->counters));
 	e->comefrom = 0;
 	(*i)++;
 	return 0;
 release_target:
 	module_put(t->u.kernel.target->me);
 out:
 	return ret;
 }
 static int
 compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
 			    unsigned int *size, const char *name,
 			    struct xt_table_info *newinfo, unsigned char *base)
 {
 	struct arpt_entry_target *t;
 	struct xt_target *target;
 	struct arpt_entry *de;
 	unsigned int origsize;
 	int ret, h;
 	ret = 0;
 	origsize = *size;
 	de = (struct arpt_entry *)*dstptr;
 	memcpy(de, e, sizeof(struct arpt_entry));
 	memcpy(&de->counters, &e->counters, sizeof(e->counters));
 	*dstptr += sizeof(struct arpt_entry);
 	*size += sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
 	de->target_offset = e->target_offset - (origsize - *size);
 	t = compat_arpt_get_target(e);
 	target = t->u.kernel.target;
 	xt_compat_target_from_user(t, dstptr, size);
 	de->next_offset = e->next_offset - (origsize - *size);
 	for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
 		if ((unsigned char *)de - base < newinfo->hook_entry[h])
 			newinfo->hook_entry[h] -= origsize - *size;
 		if ((unsigned char *)de - base < newinfo->underflow[h])
 			newinfo->underflow[h] -= origsize - *size;
 	}
 	return ret;
 }
 static inline int compat_check_entry(struct arpt_entry *e, const char *name,
 				     unsigned int *i)
 {
 	int ret;
 	ret = check_target(e, name);
 	if (ret)
 		return ret;
 	(*i)++;
 	return 0;
 }
 static int translate_compat_table(const char *name,
 				  unsigned int valid_hooks,
 				  struct xt_table_info **pinfo,
 				  void **pentry0,
 				  unsigned int total_size,
 				  unsigned int number,
 				  unsigned int *hook_entries,
 				  unsigned int *underflows)
 {
 	unsigned int i, j;
 	struct xt_table_info *newinfo, *info;
 	void *pos, *entry0, *entry1;
 	unsigned int size;
 	int ret;
 	info = *pinfo;
 	entry0 = *pentry0;
 	size = total_size;
 	info->number = number;
 	/* Init all hooks to impossible value. */
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		info->hook_entry[i] = 0xFFFFFFFF;
 		info->underflow[i] = 0xFFFFFFFF;
 	}
 	duprintf("translate_compat_table: size %u\n", info->size);
 	j = 0;
 	xt_compat_lock(NFPROTO_ARP);
 	/* Walk through entries, checking offsets. */
 	ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
 					check_compat_entry_size_and_hooks,
 					info, &size, entry0,
 					entry0 + total_size,
 					hook_entries, underflows, &j, name);
 	if (ret != 0)
 		goto out_unlock;
 	ret = -EINVAL;
 	if (j != number) {
 		duprintf("translate_compat_table: %u not %u entries\n",
 			 j, number);
 		goto out_unlock;
 	}
 	/* Check hooks all assigned */
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		/* Only hooks which are valid */
 		if (!(valid_hooks & (1 << i)))
 			continue;
 		if (info->hook_entry[i] == 0xFFFFFFFF) {
 			duprintf("Invalid hook entry %u %u\n",
 				 i, hook_entries[i]);
 			goto out_unlock;
 		}
 		if (info->underflow[i] == 0xFFFFFFFF) {
 			duprintf("Invalid underflow %u %u\n",
 				 i, underflows[i]);
 			goto out_unlock;
 		}
 	}
 	ret = -ENOMEM;
 	newinfo = xt_alloc_table_info(size);
 	if (!newinfo)
 		goto out_unlock;
 	newinfo->number = number;
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = info->hook_entry[i];
 		newinfo->underflow[i] = info->underflow[i];
 	}
 	entry1 = newinfo->entries[raw_smp_processor_id()];
 	pos = entry1;
 	size = total_size;
 	ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
 					compat_copy_entry_from_user,
 					&pos, &size, name, newinfo, entry1);
 	xt_compat_flush_offsets(NFPROTO_ARP);
 	xt_compat_unlock(NFPROTO_ARP);
 	if (ret)
 		goto free_newinfo;
 	ret = -ELOOP;
 	if (!mark_source_chains(newinfo, valid_hooks, entry1))
 		goto free_newinfo;
 	i = 0;
 	ret = ARPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
 				 name, &i);
 	if (ret) {
 		j -= i;
 		COMPAT_ARPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
 						   compat_release_entry, &j);
 		ARPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
 		xt_free_table_info(newinfo);
 		return ret;
 	}
 	/* And one copy for every other CPU */
 	for_each_possible_cpu(i)
 		if (newinfo->entries[i] && newinfo->entries[i] != entry1)
 			memcpy(newinfo->entries[i], entry1, newinfo->size);
 	*pinfo = newinfo;
 	*pentry0 = entry1;
 	xt_free_table_info(info);
 	return 0;
 free_newinfo:
 	xt_free_table_info(newinfo);
 out:
 	COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
 	return ret;
 out_unlock:
 	xt_compat_flush_offsets(NFPROTO_ARP);
 	xt_compat_unlock(NFPROTO_ARP);
 	goto out;
 }
 struct compat_arpt_replace {
 	char				name[ARPT_TABLE_MAXNAMELEN];
 	u32				valid_hooks;
 	u32				num_entries;
 	u32				size;
 	u32				hook_entry[NF_ARP_NUMHOOKS];
 	u32				underflow[NF_ARP_NUMHOOKS];
 	u32				num_counters;
 	compat_uptr_t			counters;
 	struct compat_arpt_entry	entries[0];
 };
 static int compat_do_replace(struct net *net, void __user *user,
 			     unsigned int len)
 {
 	int ret;
 	struct compat_arpt_replace tmp;
 	struct xt_table_info *newinfo;
 	void *loc_cpu_entry;
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
 	/* overflow check */
 	if (tmp.size >= INT_MAX / num_possible_cpus())
 		return -ENOMEM;
 	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
 		return -ENOMEM;
 	newinfo = xt_alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 	/* choose the copy that is on our node/cpu */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp), tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
 	}
 	ret = translate_compat_table(tmp.name, tmp.valid_hooks,
 				     &newinfo, &loc_cpu_entry, tmp.size,
 				     tmp.num_entries, tmp.hook_entry,
 				     tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo;
 	duprintf("compat_do_replace: Translated table\n");
 	ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
 			   tmp.num_counters, compat_ptr(tmp.counters));
 	if (ret)
 		goto free_newinfo_untrans;
 	return 0;
  free_newinfo_untrans:
 	ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
 }
 static int compat_do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user,
 				  unsigned int len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case ARPT_SO_SET_REPLACE:
 		ret = compat_do_replace(sock_net(sk), user, len);
 		break;
 	case ARPT_SO_SET_ADD_COUNTERS:
 		ret = do_add_counters(sock_net(sk), user, len, 1);
 		break;
 	default:
 		duprintf("do_arpt_set_ctl:  unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
 				     compat_uint_t *size,
 				     struct xt_counters *counters,
 				     unsigned int *i)
 {
 	struct arpt_entry_target *t;
 	struct compat_arpt_entry __user *ce;
 	u_int16_t target_offset, next_offset;
 	compat_uint_t origsize;
 	int ret;
 	ret = -EFAULT;
 	origsize = *size;
 	ce = (struct compat_arpt_entry __user *)*dstptr;
 	if (copy_to_user(ce, e, sizeof(struct arpt_entry)))
 		goto out;
 	if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
 		goto out;
 	*dstptr += sizeof(struct compat_arpt_entry);
 	*size -= sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
 	target_offset = e->target_offset - (origsize - *size);
 	t = arpt_get_target(e);
 	ret = xt_compat_target_to_user(t, dstptr, size);
 	if (ret)
 		goto out;
 	ret = -EFAULT;
 	next_offset = e->next_offset - (origsize - *size);
 	if (put_user(target_offset, &ce->target_offset))
 		goto out;
 	if (put_user(next_offset, &ce->next_offset))
 		goto out;
 	(*i)++;
 	return 0;
 out:
 	return ret;
 }
 static int compat_copy_entries_to_user(unsigned int total_size,
 				       struct xt_table *table,
 				       void __user *userptr)
 {
 	struct xt_counters *counters;
 	const struct xt_table_info *private = table->private;
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
 	void *loc_cpu_entry;
 	unsigned int i = 0;
 	counters = alloc_counters(table);
 	if (IS_ERR(counters))
 		return PTR_ERR(counters);
 	/* choose the copy on our node/cpu */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	pos = userptr;
 	size = total_size;
 	ret = ARPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
 				 compat_copy_entry_to_user,
 				 &pos, &size, counters, &i);
 	vfree(counters);
 	return ret;
 }
 struct compat_arpt_get_entries {
 	char name[ARPT_TABLE_MAXNAMELEN];
 	compat_uint_t size;
 	struct compat_arpt_entry entrytable[0];
 };
 static int compat_get_entries(struct net *net,
 			      struct compat_arpt_get_entries __user *uptr,
 			      int *len)
 {
 	int ret;
 	struct compat_arpt_get_entries get;
 	struct xt_table *t;
 	if (*len < sizeof(get)) {
 		duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
 		return -EINVAL;
 	}
 	if (copy_from_user(&get, uptr, sizeof(get)) != 0)
 		return -EFAULT;
 	if (*len != sizeof(struct compat_arpt_get_entries) + get.size) {
 		duprintf("compat_get_entries: %u != %zu\n",
 			 *len, sizeof(get) + get.size);
 		return -EINVAL;
 	}
 	xt_compat_lock(NFPROTO_ARP);
 	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
 	if (t && !IS_ERR(t)) {
 		const struct xt_table_info *private = t->private;
 		struct xt_table_info info;
 		duprintf("t->private->number = %u\n", private->number);
 		ret = compat_table_info(private, &info);
 		if (!ret && get.size == info.size) {
 			ret = compat_copy_entries_to_user(private->size,
 							  t, uptr->entrytable);
 		} else if (!ret) {
 			duprintf("compat_get_entries: I've got %u not %u!\n",
 				 private->size, get.size);
 			ret = -EAGAIN;
 		}
 		xt_compat_flush_offsets(NFPROTO_ARP);
 		module_put(t->me);
 		xt_table_unlock(t);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 	xt_compat_unlock(NFPROTO_ARP);
 	return ret;
 }
 static int do_arpt_get_ctl(struct sock *, int, void __user *, int *);
 static int compat_do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user,
 				  int *len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case ARPT_SO_GET_INFO:
 		ret = get_info(sock_net(sk), user, len, 1);
 		break;
 	case ARPT_SO_GET_ENTRIES:
 		ret = compat_get_entries(sock_net(sk), user, len);
 		break;
 	default:
 		ret = do_arpt_get_ctl(sk, cmd, user, len);
 	}
 	return ret;
 }
 #endif
 static int do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case ARPT_SO_SET_REPLACE:
 		ret = do_replace(sock_net(sk), user, len);
 		break;
 	case ARPT_SO_SET_ADD_COUNTERS:
 		ret = do_add_counters(sock_net(sk), user, len, 0);
 		break;
 	default:
 		duprintf("do_arpt_set_ctl:  unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case ARPT_SO_GET_INFO:
 		ret = get_info(sock_net(sk), user, len, 0);
 		break;
 	case ARPT_SO_GET_ENTRIES:
 		ret = get_entries(sock_net(sk), user, len);
 		break;
 	case ARPT_SO_GET_REVISION_TARGET: {
 		struct xt_get_revision rev;
 		if (*len != sizeof(rev)) {
 			ret = -EINVAL;
 			break;
 		}
 		if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
 			ret = -EFAULT;
 			break;
 		}
 		try_then_request_module(xt_find_revision(NFPROTO_ARP, rev.name,
 							 rev.revision, 1, &ret),
 					"arpt_%s", rev.name);
 		break;
 	}
 	default:
 		duprintf("do_arpt_get_ctl: unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 struct xt_table *arpt_register_table(struct net *net,
 				     const struct xt_table *table,
 				     const struct arpt_replace *repl)
 {
 	int ret;
 	struct xt_table_info *newinfo;
 	struct xt_table_info bootstrap
 		= { 0, 0, 0, { 0 }, { 0 }, { } };
 	void *loc_cpu_entry;
 	struct xt_table *new_table;
 	newinfo = xt_alloc_table_info(repl->size);
 	if (!newinfo) {
 		ret = -ENOMEM;
 		goto out;
 	}
 	/* choose the copy on our node/cpu */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	memcpy(loc_cpu_entry, repl->entries, repl->size);
 	ret = translate_table(table->name, table->valid_hooks,
 			      newinfo, loc_cpu_entry, repl->size,
 			      repl->num_entries,
 			      repl->hook_entry,
 			      repl->underflow);
 	duprintf("arpt_register_table: translate table gives %d\n", ret);
 	if (ret != 0)
 		goto out_free;
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
 		ret = PTR_ERR(new_table);
 		goto out_free;
 	}
 	return new_table;
 out_free:
 	xt_free_table_info(newinfo);
 out:
 	return ERR_PTR(ret);
 }
 void arpt_unregister_table(struct xt_table *table)
 {
 	struct xt_table_info *private;
 	void *loc_cpu_entry;
 	struct module *table_owner = table->me;
 	private = xt_unregister_table(table);
 	/* Decrease module usage counts and free resources */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	ARPT_ENTRY_ITERATE(loc_cpu_entry, private->size,
 			   cleanup_entry, NULL);
 	if (private->number > private->initial_entries)
 		module_put(table_owner);
 	xt_free_table_info(private);
 }
 /* The built-in targets: standard (NULL) and error. */
 static struct xt_target arpt_standard_target __read_mostly = {
 	.name		= ARPT_STANDARD_TARGET,
 	.targetsize	= sizeof(int),
 	.family		= NFPROTO_ARP,
 #ifdef CONFIG_COMPAT
 	.compatsize	= sizeof(compat_int_t),
 	.compat_from_user = compat_standard_from_user,
 	.compat_to_user	= compat_standard_to_user,
 #endif
 };
 static struct xt_target arpt_error_target __read_mostly = {
 	.name		= ARPT_ERROR_TARGET,
 	.target		= arpt_error,
 	.targetsize	= ARPT_FUNCTION_MAXNAMELEN,
 	.family		= NFPROTO_ARP,
 };
 static struct nf_sockopt_ops arpt_sockopts = {
 	.pf		= PF_INET,
 	.set_optmin	= ARPT_BASE_CTL,
 	.set_optmax	= ARPT_SO_SET_MAX+1,
 	.set		= do_arpt_set_ctl,
 #ifdef CONFIG_COMPAT
 	.compat_set	= compat_do_arpt_set_ctl,
 #endif
 	.get_optmin	= ARPT_BASE_CTL,
 	.get_optmax	= ARPT_SO_GET_MAX+1,
 	.get		= do_arpt_get_ctl,
 #ifdef CONFIG_COMPAT
 	.compat_get	= compat_do_arpt_get_ctl,
 #endif
 	.owner		= THIS_MODULE,
 };
 static int __net_init arp_tables_net_init(struct net *net)
 {
 	return xt_proto_init(net, NFPROTO_ARP);
 }
 static void __net_exit arp_tables_net_exit(struct net *net)
 {
 	xt_proto_fini(net, NFPROTO_ARP);
 }
 static struct pernet_operations arp_tables_net_ops = {
 	.init = arp_tables_net_init,
 	.exit = arp_tables_net_exit,
 };
 static int __init arp_tables_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&arp_tables_net_ops);
 	if (ret < 0)
 		goto err1;
 	/* Noone else will be downing sem now, so we won't sleep */
 	ret = xt_register_target(&arpt_standard_target);
 	if (ret < 0)
 		goto err2;
 	ret = xt_register_target(&arpt_error_target);
 	if (ret < 0)
 		goto err3;
 	/* Register setsockopt */
 	ret = nf_register_sockopt(&arpt_sockopts);
 	if (ret < 0)
 		goto err4;
 	printk(KERN_INFO "arp_tables: (C) 2002 David S. Miller\n");
 	return 0;
 err4:
 	xt_unregister_target(&arpt_error_target);
 err3:
 	xt_unregister_target(&arpt_standard_target);
 err2:
 	unregister_pernet_subsys(&arp_tables_net_ops);
 err1:
 	return ret;
 }
 static void __exit arp_tables_fini(void)
 {
 	nf_unregister_sockopt(&arpt_sockopts);
 	xt_unregister_target(&arpt_error_target);
 	xt_unregister_target(&arpt_standard_target);
 	unregister_pernet_subsys(&arp_tables_net_ops);
 }
 EXPORT_SYMBOL(arpt_register_table);
 EXPORT_SYMBOL(arpt_unregister_table);
 EXPORT_SYMBOL(arpt_do_table);
 module_init(arp_tables_init);
 module_exit(arp_tables_fini);

net/ipv4/netfilter/arptable_filter.c

Diff comments View file @ e3eaa99

 /*
  * Filtering ARP tables module.
  *
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
  *
  */
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp/arp_tables.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
 MODULE_DESCRIPTION("arptables filter table");
 #define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \
 			   (1 << NF_ARP_FORWARD))
-static const struct
-{
-	struct arpt_replace repl;
-	struct arpt_standard entries[3];
-	struct arpt_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "filter",
-		.valid_hooks = FILTER_VALID_HOOKS,
-		.num_entries = 4,
-		.size = sizeof(struct arpt_standard) * 3 + sizeof(struct arpt_error),
-		.hook_entry = {
-			[NF_ARP_IN] = 0,
-			[NF_ARP_OUT] = sizeof(struct arpt_standard),
-			[NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-		},
-		.underflow = {
-			[NF_ARP_IN] = 0,
-			[NF_ARP_OUT] = sizeof(struct arpt_standard),
-			[NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-		},
-	},
-	.entries = {
-		ARPT_STANDARD_INIT(NF_ACCEPT),	/* ARP_IN */
-		ARPT_STANDARD_INIT(NF_ACCEPT),	/* ARP_OUT */
-		ARPT_STANDARD_INIT(NF_ACCEPT),	/* ARP_FORWARD */
-	},
-	.term = ARPT_ERROR_INIT,
-};
 static const struct xt_table packet_filter = {
 	.name		= "filter",
 	.valid_hooks	= FILTER_VALID_HOOKS,
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_ARP,
 	.priority	= NF_IP_PRI_FILTER,
 };
 /* The work comes in here from netfilter.c */
 static unsigned int
 arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
 		     const struct net_device *in, const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
 	const struct net *net = dev_net((in != NULL) ? in : out);
 	return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
 }
 static struct nf_hook_ops *arpfilter_ops __read_mostly;
 static int __net_init arptable_filter_net_init(struct net *net)
 {
-	/* Register table */
+	struct arpt_replace *repl;
+	repl = arpt_alloc_initial_table(&packet_filter);
+	if (repl == NULL)
+		return -ENOMEM;
 	net->ipv4.arptable_filter =
-		arpt_register_table(net, &packet_filter, &initial_table.repl);
+		arpt_register_table(net, &packet_filter, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv4.arptable_filter))
 		return PTR_ERR(net->ipv4.arptable_filter);
 	return 0;
 }
 static void __net_exit arptable_filter_net_exit(struct net *net)
 {
 	arpt_unregister_table(net->ipv4.arptable_filter);
 }
 static struct pernet_operations arptable_filter_net_ops = {
 	.init = arptable_filter_net_init,
 	.exit = arptable_filter_net_exit,
 };
 static int __init arptable_filter_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&arptable_filter_net_ops);
 	if (ret < 0)
 		return ret;
 	arpfilter_ops = xt_hook_link(&packet_filter, arptable_filter_hook);
 	if (IS_ERR(arpfilter_ops)) {
 		ret = PTR_ERR(arpfilter_ops);
 		goto cleanup_table;
 	}
 	return ret;
 cleanup_table:
 	unregister_pernet_subsys(&arptable_filter_net_ops);
 	return ret;
 }
 static void __exit arptable_filter_fini(void)
 {
 	xt_hook_unlink(&packet_filter, arpfilter_ops);

net/ipv4/netfilter/ip_tables.c

Diff comments View file @ e3eaa99

 /*
  * Packet matching code.
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/cache.h>
 #include <linux/capability.h>
 #include <linux/skbuff.h>
 #include <linux/kmod.h>
 #include <linux/vmalloc.h>
 #include <linux/netdevice.h>
 #include <linux/module.h>
 #include <linux/icmp.h>
 #include <net/ip.h>
 #include <net/compat.h>
 #include <asm/uaccess.h>
 #include <linux/mutex.h>
 #include <linux/proc_fs.h>
 #include <linux/err.h>
 #include <linux/cpumask.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <net/netfilter/nf_log.h>
+#include "../../netfilter/xt_repldata.h"
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("IPv4 packet filter");
 /*#define DEBUG_IP_FIREWALL*/
 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
 /*#define DEBUG_IP_FIREWALL_USER*/
 #ifdef DEBUG_IP_FIREWALL
 #define dprintf(format, args...)  printk(format , ## args)
 #else
 #define dprintf(format, args...)
 #endif
 #ifdef DEBUG_IP_FIREWALL_USER
 #define duprintf(format, args...) printk(format , ## args)
 #else
 #define duprintf(format, args...)
 #endif
 #ifdef CONFIG_NETFILTER_DEBUG
 #define IP_NF_ASSERT(x)						\
 do {								\
 	if (!(x))						\
 		printk("IP_NF_ASSERT: %s:%s:%u\n",		\
 		       __func__, __FILE__, __LINE__);	\
 } while(0)
 #else
 #define IP_NF_ASSERT(x)
 #endif
 #if 0
 /* All the better to debug you with... */
 #define static
 #define inline
 #endif
+void *ipt_alloc_initial_table(const struct xt_table *info)
+{
+	return xt_alloc_initial_table(ipt, IPT);
+}
+EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
 /*
    We keep a set of rules for each CPU, so we can avoid write-locking
    them in the softirq when updating the counters and therefore
    only need to read-lock in the softirq; doing a write_lock_bh() in user
    context stops packets coming through and allows user context to read
    the counters or update the rules.
    Hence the start of any table is given by get_table() below.  */
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
 ip_packet_match(const struct iphdr *ip,
 		const char *indev,
 		const char *outdev,
 		const struct ipt_ip *ipinfo,
 		int isfrag)
 {
 	unsigned long ret;
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 	if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
 		  IPT_INV_SRCIP) ||
 	    FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
 		  IPT_INV_DSTIP)) {
 		dprintf("Source or dest mismatch.\n");
 		dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
 			&ip->saddr, &ipinfo->smsk.s_addr, &ipinfo->src.s_addr,
 			ipinfo->invflags & IPT_INV_SRCIP ? " (INV)" : "");
 		dprintf("DST: %pI4 Mask: %pI4 Target: %pI4.%s\n",
 			&ip->daddr, &ipinfo->dmsk.s_addr, &ipinfo->dst.s_addr,
 			ipinfo->invflags & IPT_INV_DSTIP ? " (INV)" : "");
 		return false;
 	}
 	ret = ifname_compare_aligned(indev, ipinfo->iniface, ipinfo->iniface_mask);
 	if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
 		dprintf("VIA in mismatch (%s vs %s).%s\n",
 			indev, ipinfo->iniface,
 			ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
 		return false;
 	}
 	ret = ifname_compare_aligned(outdev, ipinfo->outiface, ipinfo->outiface_mask);
 	if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
 		dprintf("VIA out mismatch (%s vs %s).%s\n",
 			outdev, ipinfo->outiface,
 			ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
 		return false;
 	}
 	/* Check specific protocol */
 	if (ipinfo->proto &&
 	    FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
 		dprintf("Packet protocol %hi does not match %hi.%s\n",
 			ip->protocol, ipinfo->proto,
 			ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
 		return false;
 	}
 	/* If we have a fragment rule but the packet is not a fragment
 	 * then we return zero */
 	if (FWINV((ipinfo->flags&IPT_F_FRAG) && !isfrag, IPT_INV_FRAG)) {
 		dprintf("Fragment rule but not fragment.%s\n",
 			ipinfo->invflags & IPT_INV_FRAG ? " (INV)" : "");
 		return false;
 	}
 	return true;
 }
 static bool
 ip_checkentry(const struct ipt_ip *ip)
 {
 	if (ip->flags & ~IPT_F_MASK) {
 		duprintf("Unknown flag bits set: %08X\n",
 			 ip->flags & ~IPT_F_MASK);
 		return false;
 	}
 	if (ip->invflags & ~IPT_INV_MASK) {
 		duprintf("Unknown invflag bits set: %08X\n",
 			 ip->invflags & ~IPT_INV_MASK);
 		return false;
 	}
 	return true;
 }
 static unsigned int
 ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
 {
 	if (net_ratelimit())
 		printk("ip_tables: error: `%s'\n",
 		       (const char *)par->targinfo);
 	return NF_DROP;
 }
 /* Performance critical - called for every packet */
 static inline bool
 do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
 	 struct xt_match_param *par)
 {
 	par->match     = m->u.kernel.match;
 	par->matchinfo = m->data;
 	/* Stop iteration if it doesn't match */
 	if (!m->u.kernel.match->match(skb, par))
 		return true;
 	else
 		return false;
 }
 /* Performance critical */
 static inline struct ipt_entry *
 get_entry(void *base, unsigned int offset)
 {
 	return (struct ipt_entry *)(base + offset);
 }
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
 static inline bool unconditional(const struct ipt_ip *ip)
 {
 	static const struct ipt_ip uncond;
 	return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 #undef FWINV
 }
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 static const char *const hooknames[] = {
 	[NF_INET_PRE_ROUTING]		= "PREROUTING",
 	[NF_INET_LOCAL_IN]		= "INPUT",
 	[NF_INET_FORWARD]		= "FORWARD",
 	[NF_INET_LOCAL_OUT]		= "OUTPUT",
 	[NF_INET_POST_ROUTING]		= "POSTROUTING",
 };
 enum nf_ip_trace_comments {
 	NF_IP_TRACE_COMMENT_RULE,
 	NF_IP_TRACE_COMMENT_RETURN,
 	NF_IP_TRACE_COMMENT_POLICY,
 };
 static const char *const comments[] = {
 	[NF_IP_TRACE_COMMENT_RULE]	= "rule",
 	[NF_IP_TRACE_COMMENT_RETURN]	= "return",
 	[NF_IP_TRACE_COMMENT_POLICY]	= "policy",
 };
 static struct nf_loginfo trace_loginfo = {
 	.type = NF_LOG_TYPE_LOG,
 	.u = {
 		.log = {
 			.level = 4,
 			.logflags = NF_LOG_MASK,
 		},
 	},
 };
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
 get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
 		      const char *hookname, const char **chainname,
 		      const char **comment, unsigned int *rulenum)
 {
 	struct ipt_standard_target *t = (void *)ipt_get_target(s);
 	if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
 		/* Head of user chain: ERROR target with chainname */
 		*chainname = t->target.data;
 		(*rulenum) = 0;
 	} else if (s == e) {
 		(*rulenum)++;
 		if (s->target_offset == sizeof(struct ipt_entry) &&
 		    strcmp(t->target.u.kernel.target->name,
 			   IPT_STANDARD_TARGET) == 0 &&
 		   t->verdict < 0 &&
 		   unconditional(&s->ip)) {
 			/* Tail of chains: STANDARD target (return/policy) */
 			*comment = *chainname == hookname
 				? comments[NF_IP_TRACE_COMMENT_POLICY]
 				: comments[NF_IP_TRACE_COMMENT_RETURN];
 		}
 		return 1;
 	} else
 		(*rulenum)++;
 	return 0;
 }
 static void trace_packet(struct sk_buff *skb,
 			 unsigned int hook,
 			 const struct net_device *in,
 			 const struct net_device *out,
 			 const char *tablename,
 			 struct xt_table_info *private,
 			 struct ipt_entry *e)
 {
 	void *table_base;
 	const struct ipt_entry *root;
 	const char *hookname, *chainname, *comment;
 	unsigned int rulenum = 0;
 	table_base = private->entries[smp_processor_id()];
 	root = get_entry(table_base, private->hook_entry[hook]);
 	hookname = chainname = hooknames[hook];
 	comment = comments[NF_IP_TRACE_COMMENT_RULE];
 	IPT_ENTRY_ITERATE(root,
 			  private->size - private->hook_entry[hook],
 			  get_chainname_rulenum,
 			  e, hookname, &chainname, &comment, &rulenum);
 	nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
 		      "TRACE: %s:%s:%s:%u ",
 		      tablename, chainname, comment, rulenum);
 }
 #endif
 static inline __pure
 struct ipt_entry *ipt_next_entry(const struct ipt_entry *entry)
 {
 	return (void *)entry + entry->next_offset;
 }
 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 unsigned int
 ipt_do_table(struct sk_buff *skb,
 	     unsigned int hook,
 	     const struct net_device *in,
 	     const struct net_device *out,
 	     struct xt_table *table)
 {
 #define tb_comefrom ((struct ipt_entry *)table_base)->comefrom
 	static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 	const struct iphdr *ip;
 	bool hotdrop = false;
 	/* Initializing verdict to NF_DROP keeps gcc happy. */
 	unsigned int verdict = NF_DROP;
 	const char *indev, *outdev;
 	void *table_base;
 	struct ipt_entry *e, *back;
 	struct xt_table_info *private;
 	struct xt_match_param mtpar;
 	struct xt_target_param tgpar;
 	/* Initialization */
 	ip = ip_hdr(skb);
 	indev = in ? in->name : nulldevname;
 	outdev = out ? out->name : nulldevname;
 	/* We handle fragments by dealing with the first fragment as
 	 * if it was a normal packet.  All other fragments are treated
 	 * normally, except that they will NEVER match rules that ask
 	 * things we don't know, ie. tcp syn flag or ports).  If the
 	 * rule is also a fragment-specific rule, non-fragments won't
 	 * match it. */
 	mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
 	mtpar.thoff   = ip_hdrlen(skb);
 	mtpar.hotdrop = &hotdrop;
 	mtpar.in      = tgpar.in  = in;
 	mtpar.out     = tgpar.out = out;
 	mtpar.family  = tgpar.family = NFPROTO_IPV4;
 	mtpar.hooknum = tgpar.hooknum = hook;
 	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 	xt_info_rdlock_bh();
 	private = table->private;
 	table_base = private->entries[smp_processor_id()];
 	e = get_entry(table_base, private->hook_entry[hook]);
 	/* For return from builtin chain */
 	back = get_entry(table_base, private->underflow[hook]);
 	do {
 		struct ipt_entry_target *t;
 		IP_NF_ASSERT(e);
 		IP_NF_ASSERT(back);
 		if (!ip_packet_match(ip, indev, outdev,
 		    &e->ip, mtpar.fragoff) ||
 		    IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
 			e = ipt_next_entry(e);
 			continue;
 		}
 		ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
 		t = ipt_get_target(e);
 		IP_NF_ASSERT(t->u.kernel.target);
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 		/* The packet is traced: log it */
 		if (unlikely(skb->nf_trace))
 			trace_packet(skb, hook, in, out,
 				     table->name, private, e);
 #endif
 		/* Standard target? */
 		if (!t->u.kernel.target->target) {
 			int v;
 			v = ((struct ipt_standard_target *)t)->verdict;
 			if (v < 0) {
 				/* Pop from stack? */
 				if (v != IPT_RETURN) {
 					verdict = (unsigned)(-v) - 1;
 					break;
 				}
 				e = back;
 				back = get_entry(table_base, back->comefrom);
 				continue;
 			}
 			if (table_base + v != ipt_next_entry(e) &&
 			    !(e->ip.flags & IPT_F_GOTO)) {
 				/* Save old back ptr in next entry */
 				struct ipt_entry *next = ipt_next_entry(e);
 				next->comefrom = (void *)back - table_base;
 				/* set back pointer to next entry */
 				back = next;
 			}
 			e = get_entry(table_base, v);
 			continue;
 		}
 		/* Targets which reenter must return
 		   abs. verdicts */
 		tgpar.target   = t->u.kernel.target;
 		tgpar.targinfo = t->data;
 #ifdef CONFIG_NETFILTER_DEBUG
 		tb_comefrom = 0xeeeeeeec;
 #endif
 		verdict = t->u.kernel.target->target(skb, &tgpar);
 #ifdef CONFIG_NETFILTER_DEBUG
 		if (tb_comefrom != 0xeeeeeeec && verdict == IPT_CONTINUE) {
 			printk("Target %s reentered!\n",
 			       t->u.kernel.target->name);
 			verdict = NF_DROP;
 		}
 		tb_comefrom = 0x57acc001;
 #endif
 		/* Target might have changed stuff. */
 		ip = ip_hdr(skb);
 		if (verdict == IPT_CONTINUE)
 			e = ipt_next_entry(e);
 		else
 			/* Verdict */
 			break;
 	} while (!hotdrop);
 	xt_info_rdunlock_bh();
 #ifdef DEBUG_ALLOW_ALL
 	return NF_ACCEPT;
 #else
 	if (hotdrop)
 		return NF_DROP;
 	else return verdict;
 #endif
 #undef tb_comefrom
 }
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
 mark_source_chains(struct xt_table_info *newinfo,
 		   unsigned int valid_hooks, void *entry0)
 {
 	unsigned int hook;
 	/* No recursion; use packet counter to save back ptrs (reset
 	   to 0 as we leave), and comefrom to save source hook bitmask */
 	for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 		unsigned int pos = newinfo->hook_entry[hook];
 		struct ipt_entry *e = (struct ipt_entry *)(entry0 + pos);
 		if (!(valid_hooks & (1 << hook)))
 			continue;
 		/* Set initial back pointer. */
 		e->counters.pcnt = pos;
 		for (;;) {
 			struct ipt_standard_target *t
 				= (void *)ipt_get_target(e);
 			int visited = e->comefrom & (1 << hook);
 			if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 				printk("iptables: loop hook %u pos %u %08X.\n",
 				       hook, pos, e->comefrom);
 				return 0;
 			}
 			e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 			/* Unconditional return/END. */
 			if ((e->target_offset == sizeof(struct ipt_entry) &&
 			     (strcmp(t->target.u.user.name,
 				     IPT_STANDARD_TARGET) == 0) &&
 			     t->verdict < 0 && unconditional(&e->ip)) ||
 			    visited) {
 				unsigned int oldpos, size;
 				if ((strcmp(t->target.u.user.name,
 			    		    IPT_STANDARD_TARGET) == 0) &&
 				    t->verdict < -NF_MAX_VERDICT - 1) {
 					duprintf("mark_source_chains: bad "
 						"negative verdict (%i)\n",
 								t->verdict);
 					return 0;
 				}
 				/* Return: backtrack through the last
 				   big jump. */
 				do {
 					e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 #ifdef DEBUG_IP_FIREWALL_USER
 					if (e->comefrom
 					    & (1 << NF_INET_NUMHOOKS)) {
 						duprintf("Back unset "
 							 "on hook %u "
 							 "rule %u\n",
 							 hook, pos);
 					}
 #endif
 					oldpos = pos;
 					pos = e->counters.pcnt;
 					e->counters.pcnt = 0;
 					/* We're at the start. */
 					if (pos == oldpos)
 						goto next;
 					e = (struct ipt_entry *)
 						(entry0 + pos);
 				} while (oldpos == pos + e->next_offset);
 				/* Move along one */
 				size = e->next_offset;
 				e = (struct ipt_entry *)
 					(entry0 + pos + size);
 				e->counters.pcnt = pos;
 				pos += size;
 			} else {
 				int newpos = t->verdict;
 				if (strcmp(t->target.u.user.name,
 					   IPT_STANDARD_TARGET) == 0 &&
 				    newpos >= 0) {
 					if (newpos > newinfo->size -
 						sizeof(struct ipt_entry)) {
 						duprintf("mark_source_chains: "
 							"bad verdict (%i)\n",
 								newpos);
 						return 0;
 					}
 					/* This a jump; chase it. */
 					duprintf("Jump rule %u -> %u\n",
 						 pos, newpos);
 				} else {
 					/* ... this is a fallthru */
 					newpos = pos + e->next_offset;
 				}
 				e = (struct ipt_entry *)
 					(entry0 + newpos);
 				e->counters.pcnt = pos;
 				pos = newpos;
 			}
 		}
 		next:
 		duprintf("Finished chain %u\n", hook);
 	}
 	return 1;
 }
 static int
 cleanup_match(struct ipt_entry_match *m, struct net *net, unsigned int *i)
 {
 	struct xt_mtdtor_param par;
 	if (i && (*i)-- == 0)
 		return 1;
 	par.net       = net;
 	par.match     = m->u.kernel.match;
 	par.matchinfo = m->data;
 	par.family    = NFPROTO_IPV4;
 	if (par.match->destroy != NULL)
 		par.match->destroy(&par);
 	module_put(par.match->me);
 	return 0;
 }
 static int
 check_entry(struct ipt_entry *e, const char *name)
 {
 	struct ipt_entry_target *t;
 	if (!ip_checkentry(&e->ip)) {
 		duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 		return -EINVAL;
 	}
 	if (e->target_offset + sizeof(struct ipt_entry_target) >
 	    e->next_offset)
 		return -EINVAL;
 	t = ipt_get_target(e);
 	if (e->target_offset + t->u.target_size > e->next_offset)
 		return -EINVAL;
 	return 0;
 }
 static int
 check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
 	    unsigned int *i)
 {
 	const struct ipt_ip *ip = par->entryinfo;
 	int ret;
 	par->match     = m->u.kernel.match;
 	par->matchinfo = m->data;
 	ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 	      ip->proto, ip->invflags & IPT_INV_PROTO);
 	if (ret < 0) {
 		duprintf("ip_tables: check failed for `%s'.\n",
 			 par.match->name);
 		return ret;
 	}
 	++*i;
 	return 0;
 }
 static int
 find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
 		 unsigned int *i)
 {
 	struct xt_match *match;
 	int ret;
 	match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
 						      m->u.user.revision),
 					"ipt_%s", m->u.user.name);
 	if (IS_ERR(match) || !match) {
 		duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 		return match ? PTR_ERR(match) : -ENOENT;
 	}
 	m->u.kernel.match = match;
 	ret = check_match(m, par, i);
 	if (ret)
 		goto err;
 	return 0;
 err:
 	module_put(m->u.kernel.match->me);
 	return ret;
 }
 static int check_target(struct ipt_entry *e, struct net *net, const char *name)
 {
 	struct ipt_entry_target *t = ipt_get_target(e);
 	struct xt_tgchk_param par = {
 		.net       = net,
 		.table     = name,
 		.entryinfo = e,
 		.target    = t->u.kernel.target,
 		.targinfo  = t->data,
 		.hook_mask = e->comefrom,
 		.family    = NFPROTO_IPV4,
 	};
 	int ret;
 	ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 	      e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
 	if (ret < 0) {
 		duprintf("ip_tables: check failed for `%s'.\n",
 			 t->u.kernel.target->name);
 		return ret;
 	}
 	return 0;
 }
 static int
 find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
 		 unsigned int size, unsigned int *i)
 {
 	struct ipt_entry_target *t;
 	struct xt_target *target;
 	int ret;
 	unsigned int j;
 	struct xt_mtchk_param mtpar;
 	ret = check_entry(e, name);
 	if (ret)
 		return ret;
 	j = 0;
 	mtpar.net	= net;
 	mtpar.table     = name;
 	mtpar.entryinfo = &e->ip;
 	mtpar.hook_mask = e->comefrom;
 	mtpar.family    = NFPROTO_IPV4;
 	ret = IPT_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
 	if (ret != 0)
 		goto cleanup_matches;
 	t = ipt_get_target(e);
 	target = try_then_request_module(xt_find_target(AF_INET,
 							t->u.user.name,
 							t->u.user.revision),
 					 "ipt_%s", t->u.user.name);
 	if (IS_ERR(target) || !target) {
 		duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 		ret = target ? PTR_ERR(target) : -ENOENT;
 		goto cleanup_matches;
 	}
 	t->u.kernel.target = target;
 	ret = check_target(e, net, name);
 	if (ret)
 		goto err;
 	(*i)++;
 	return 0;
  err:
 	module_put(t->u.kernel.target->me);
  cleanup_matches:
 	IPT_MATCH_ITERATE(e, cleanup_match, net, &j);
 	return ret;
 }
 static bool check_underflow(struct ipt_entry *e)
 {
 	const struct ipt_entry_target *t;
 	unsigned int verdict;
 	if (!unconditional(&e->ip))
 		return false;
 	t = ipt_get_target(e);
 	if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 		return false;
 	verdict = ((struct ipt_standard_target *)t)->verdict;
 	verdict = -verdict - 1;
 	return verdict == NF_DROP || verdict == NF_ACCEPT;
 }
 static int
 check_entry_size_and_hooks(struct ipt_entry *e,
 			   struct xt_table_info *newinfo,
 			   unsigned char *base,
 			   unsigned char *limit,
 			   const unsigned int *hook_entries,
 			   const unsigned int *underflows,
 			   unsigned int valid_hooks,
 			   unsigned int *i)
 {
 	unsigned int h;
 	if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
 	    (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
 		duprintf("Bad offset %p\n", e);
 		return -EINVAL;
 	}
 	if (e->next_offset
 	    < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
 		duprintf("checking: element %p size %u\n",
 			 e, e->next_offset);
 		return -EINVAL;
 	}
 	/* Check hooks & underflows */
 	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 		if (!(valid_hooks & (1 << h)))
 			continue;
 		if ((unsigned char *)e - base == hook_entries[h])
 			newinfo->hook_entry[h] = hook_entries[h];
 		if ((unsigned char *)e - base == underflows[h]) {
 			if (!check_underflow(e)) {
 				pr_err("Underflows must be unconditional and "
 				       "use the STANDARD target with "
 				       "ACCEPT/DROP\n");
 				return -EINVAL;
 			}
 			newinfo->underflow[h] = underflows[h];
 		}
 	}
 	/* Clear counters and comefrom */
 	e->counters = ((struct xt_counters) { 0, 0 });
 	e->comefrom = 0;
 	(*i)++;
 	return 0;
 }
 static int
 cleanup_entry(struct ipt_entry *e, struct net *net, unsigned int *i)
 {
 	struct xt_tgdtor_param par;
 	struct ipt_entry_target *t;
 	if (i && (*i)-- == 0)
 		return 1;
 	/* Cleanup all matches */
 	IPT_MATCH_ITERATE(e, cleanup_match, net, NULL);
 	t = ipt_get_target(e);
 	par.net      = net;
 	par.target   = t->u.kernel.target;
 	par.targinfo = t->data;
 	par.family   = NFPROTO_IPV4;
 	if (par.target->destroy != NULL)
 		par.target->destroy(&par);
 	module_put(par.target->me);
 	return 0;
 }
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
 translate_table(struct net *net,
 		const char *name,
 		unsigned int valid_hooks,
 		struct xt_table_info *newinfo,
 		void *entry0,
 		unsigned int size,
 		unsigned int number,
 		const unsigned int *hook_entries,
 		const unsigned int *underflows)
 {
 	unsigned int i;
 	int ret;
 	newinfo->size = size;
 	newinfo->number = number;
 	/* Init all hooks to impossible value. */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = 0xFFFFFFFF;
 		newinfo->underflow[i] = 0xFFFFFFFF;
 	}
 	duprintf("translate_table: size %u\n", newinfo->size);
 	i = 0;
 	/* Walk through entries, checking offsets. */
 	ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 				check_entry_size_and_hooks,
 				newinfo,
 				entry0,
 				entry0 + size,
 				hook_entries, underflows, valid_hooks, &i);
 	if (ret != 0)
 		return ret;
 	if (i != number) {
 		duprintf("translate_table: %u not %u entries\n",
 			 i, number);
 		return -EINVAL;
 	}
 	/* Check hooks all assigned */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		/* Only hooks which are valid */
 		if (!(valid_hooks & (1 << i)))
 			continue;
 		if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 			duprintf("Invalid hook entry %u %u\n",
 				 i, hook_entries[i]);
 			return -EINVAL;
 		}
 		if (newinfo->underflow[i] == 0xFFFFFFFF) {
 			duprintf("Invalid underflow %u %u\n",
 				 i, underflows[i]);
 			return -EINVAL;
 		}
 	}
 	if (!mark_source_chains(newinfo, valid_hooks, entry0))
 		return -ELOOP;
 	/* Finally, each sanity check must pass */
 	i = 0;
 	ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
 				find_check_entry, net, name, size, &i);
 	if (ret != 0) {
 		IPT_ENTRY_ITERATE(entry0, newinfo->size,
 				cleanup_entry, net, &i);
 		return ret;
 	}
 	/* And one copy for every other CPU */
 	for_each_possible_cpu(i) {
 		if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 			memcpy(newinfo->entries[i], entry0, newinfo->size);
 	}
 	return ret;
 }
 /* Gets counters. */
 static inline int
 add_entry_to_counter(const struct ipt_entry *e,
 		     struct xt_counters total[],
 		     unsigned int *i)
 {
 	ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 	(*i)++;
 	return 0;
 }
 static inline int
 set_entry_to_counter(const struct ipt_entry *e,
 		     struct ipt_counters total[],
 		     unsigned int *i)
 {
 	SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 	(*i)++;
 	return 0;
 }
 static void
 get_counters(const struct xt_table_info *t,
 	     struct xt_counters counters[])
 {
 	unsigned int cpu;
 	unsigned int i;
 	unsigned int curcpu;
 	/* Instead of clearing (by a previous call to memset())
 	 * the counters and using adds, we set the counters
 	 * with data used by 'current' CPU.
 	 *
 	 * Bottom half has to be disabled to prevent deadlock
 	 * if new softirq were to run and call ipt_do_table
 	 */
 	local_bh_disable();
 	curcpu = smp_processor_id();
 	i = 0;
 	IPT_ENTRY_ITERATE(t->entries[curcpu],
 			  t->size,
 			  set_entry_to_counter,
 			  counters,
 			  &i);
 	for_each_possible_cpu(cpu) {
 		if (cpu == curcpu)
 			continue;
 		i = 0;
 		xt_info_wrlock(cpu);
 		IPT_ENTRY_ITERATE(t->entries[cpu],
 				  t->size,
 				  add_entry_to_counter,
 				  counters,
 				  &i);
 		xt_info_wrunlock(cpu);
 	}
 	local_bh_enable();
 }
 static struct xt_counters * alloc_counters(struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
 	struct xt_table_info *private = table->private;
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
 	   about). */
 	countersize = sizeof(struct xt_counters) * private->number;
 	counters = vmalloc_node(countersize, numa_node_id());
 	if (counters == NULL)
 		return ERR_PTR(-ENOMEM);
 	get_counters(private, counters);
 	return counters;
 }
 static int
 copy_entries_to_user(unsigned int total_size,
 		     struct xt_table *table,
 		     void __user *userptr)
 {
 	unsigned int off, num;
 	struct ipt_entry *e;
 	struct xt_counters *counters;
 	const struct xt_table_info *private = table->private;
 	int ret = 0;
 	const void *loc_cpu_entry;
 	counters = alloc_counters(table);
 	if (IS_ERR(counters))
 		return PTR_ERR(counters);
 	/* choose the copy that is on our node/cpu, ...
 	 * This choice is lazy (because current thread is
 	 * allowed to migrate to another cpu)
 	 */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 		ret = -EFAULT;
 		goto free_counters;
 	}
 	/* FIXME: use iterator macros --RR */
 	/* ... then go back and fix counters and names */
 	for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 		unsigned int i;
 		const struct ipt_entry_match *m;
 		const struct ipt_entry_target *t;
 		e = (struct ipt_entry *)(loc_cpu_entry + off);
 		if (copy_to_user(userptr + off
 				 + offsetof(struct ipt_entry, counters),
 				 &counters[num],
 				 sizeof(counters[num])) != 0) {
 			ret = -EFAULT;
 			goto free_counters;
 		}
 		for (i = sizeof(struct ipt_entry);
 		     i < e->target_offset;
 		     i += m->u.match_size) {
 			m = (void *)e + i;
 			if (copy_to_user(userptr + off + i
 					 + offsetof(struct ipt_entry_match,
 						    u.user.name),
 					 m->u.kernel.match->name,
 					 strlen(m->u.kernel.match->name)+1)
 			    != 0) {
 				ret = -EFAULT;
 				goto free_counters;
 			}
 		}
 		t = ipt_get_target(e);
 		if (copy_to_user(userptr + off + e->target_offset
 				 + offsetof(struct ipt_entry_target,
 					    u.user.name),
 				 t->u.kernel.target->name,
 				 strlen(t->u.kernel.target->name)+1) != 0) {
 			ret = -EFAULT;
 			goto free_counters;
 		}
 	}
  free_counters:
 	vfree(counters);
 	return ret;
 }
 #ifdef CONFIG_COMPAT
 static void compat_standard_from_user(void *dst, void *src)
 {
 	int v = *(compat_int_t *)src;
 	if (v > 0)
 		v += xt_compat_calc_jump(AF_INET, v);
 	memcpy(dst, &v, sizeof(v));
 }
 static int compat_standard_to_user(void __user *dst, void *src)
 {
 	compat_int_t cv = *(int *)src;
 	if (cv > 0)
 		cv -= xt_compat_calc_jump(AF_INET, cv);
 	return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 static inline int
 compat_calc_match(struct ipt_entry_match *m, int *size)
 {
 	*size += xt_compat_match_offset(m->u.kernel.match);
 	return 0;
 }
 static int compat_calc_entry(struct ipt_entry *e,
 			     const struct xt_table_info *info,
 			     void *base, struct xt_table_info *newinfo)
 {
 	struct ipt_entry_target *t;
 	unsigned int entry_offset;
 	int off, i, ret;
 	off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 	entry_offset = (void *)e - base;
 	IPT_MATCH_ITERATE(e, compat_calc_match, &off);
 	t = ipt_get_target(e);
 	off += xt_compat_target_offset(t->u.kernel.target);
 	newinfo->size -= off;
 	ret = xt_compat_add_offset(AF_INET, entry_offset, off);
 	if (ret)
 		return ret;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		if (info->hook_entry[i] &&
 		    (e < (struct ipt_entry *)(base + info->hook_entry[i])))
 			newinfo->hook_entry[i] -= off;
 		if (info->underflow[i] &&
 		    (e < (struct ipt_entry *)(base + info->underflow[i])))
 			newinfo->underflow[i] -= off;
 	}
 	return 0;
 }
 static int compat_table_info(const struct xt_table_info *info,
 			     struct xt_table_info *newinfo)
 {
 	void *loc_cpu_entry;
 	if (!newinfo || !info)
 		return -EINVAL;
 	/* we dont care about newinfo->entries[] */
 	memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
 	newinfo->initial_entries = 0;
 	loc_cpu_entry = info->entries[raw_smp_processor_id()];
 	return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
 				 compat_calc_entry, info, loc_cpu_entry,
 				 newinfo);
 }
 #endif
 static int get_info(struct net *net, void __user *user, int *len, int compat)
 {
 	char name[IPT_TABLE_MAXNAMELEN];
 	struct xt_table *t;
 	int ret;
 	if (*len != sizeof(struct ipt_getinfo)) {
 		duprintf("length %u != %zu\n", *len,
 			 sizeof(struct ipt_getinfo));
 		return -EINVAL;
 	}
 	if (copy_from_user(name, user, sizeof(name)) != 0)
 		return -EFAULT;
 	name[IPT_TABLE_MAXNAMELEN-1] = '\0';
 #ifdef CONFIG_COMPAT
 	if (compat)
 		xt_compat_lock(AF_INET);
 #endif
 	t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
 				    "iptable_%s", name);
 	if (t && !IS_ERR(t)) {
 		struct ipt_getinfo info;
 		const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 		if (compat) {
 			ret = compat_table_info(private, &tmp);
 			xt_compat_flush_offsets(AF_INET);
 			private = &tmp;
 		}
 #endif
 		info.valid_hooks = t->valid_hooks;
 		memcpy(info.hook_entry, private->hook_entry,
 		       sizeof(info.hook_entry));
 		memcpy(info.underflow, private->underflow,
 		       sizeof(info.underflow));
 		info.num_entries = private->number;
 		info.size = private->size;
 		strcpy(info.name, name);
 		if (copy_to_user(user, &info, *len) != 0)
 			ret = -EFAULT;
 		else
 			ret = 0;
 		xt_table_unlock(t);
 		module_put(t->me);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 #ifdef CONFIG_COMPAT
 	if (compat)
 		xt_compat_unlock(AF_INET);
 #endif
 	return ret;
 }
 static int
 get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
 {
 	int ret;
 	struct ipt_get_entries get;
 	struct xt_table *t;
 	if (*len < sizeof(get)) {
 		duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
 		return -EINVAL;
 	}
 	if (copy_from_user(&get, uptr, sizeof(get)) != 0)
 		return -EFAULT;
 	if (*len != sizeof(struct ipt_get_entries) + get.size) {
 		duprintf("get_entries: %u != %zu\n",
 			 *len, sizeof(get) + get.size);
 		return -EINVAL;
 	}
 	t = xt_find_table_lock(net, AF_INET, get.name);
 	if (t && !IS_ERR(t)) {
 		const struct xt_table_info *private = t->private;
 		duprintf("t->private->number = %u\n", private->number);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
 		else {
 			duprintf("get_entries: I've got %u not %u!\n",
 				 private->size, get.size);
 			ret = -EAGAIN;
 		}
 		module_put(t->me);
 		xt_table_unlock(t);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 	return ret;
 }
 static int
 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 	     struct xt_table_info *newinfo, unsigned int num_counters,
 	     void __user *counters_ptr)
 {
 	int ret;
 	struct xt_table *t;
 	struct xt_table_info *oldinfo;
 	struct xt_counters *counters;
 	void *loc_cpu_old_entry;
 	ret = 0;
 	counters = vmalloc(num_counters * sizeof(struct xt_counters));
 	if (!counters) {
 		ret = -ENOMEM;
 		goto out;
 	}
 	t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
 				    "iptable_%s", name);
 	if (!t || IS_ERR(t)) {
 		ret = t ? PTR_ERR(t) : -ENOENT;
 		goto free_newinfo_counters_untrans;
 	}
 	/* You lied! */
 	if (valid_hooks != t->valid_hooks) {
 		duprintf("Valid hook crap: %08X vs %08X\n",
 			 valid_hooks, t->valid_hooks);
 		ret = -EINVAL;
 		goto put_module;
 	}
 	oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
 	if (!oldinfo)
 		goto put_module;
 	/* Update module usage count based on number of rules */
 	duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
 		oldinfo->number, oldinfo->initial_entries, newinfo->number);
 	if ((oldinfo->number > oldinfo->initial_entries) ||
 	    (newinfo->number <= oldinfo->initial_entries))
 		module_put(t->me);
 	if ((oldinfo->number > oldinfo->initial_entries) &&
 	    (newinfo->number <= oldinfo->initial_entries))
 		module_put(t->me);
 	/* Get the old counters, and synchronize with replace */
 	get_counters(oldinfo, counters);
 	/* Decrease module usage counts and free resource */
 	loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
 	IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
 			  net, NULL);
 	xt_free_table_info(oldinfo);
 	if (copy_to_user(counters_ptr, counters,
 			 sizeof(struct xt_counters) * num_counters) != 0)
 		ret = -EFAULT;
 	vfree(counters);
 	xt_table_unlock(t);
 	return ret;
  put_module:
 	module_put(t->me);
 	xt_table_unlock(t);
  free_newinfo_counters_untrans:
 	vfree(counters);
  out:
 	return ret;
 }
 static int
 do_replace(struct net *net, void __user *user, unsigned int len)
 {
 	int ret;
 	struct ipt_replace tmp;
 	struct xt_table_info *newinfo;
 	void *loc_cpu_entry;
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
 	/* overflow check */
 	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
 		return -ENOMEM;
 	newinfo = xt_alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 	/* choose the copy that is on our node/cpu */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
 	}
 	ret = translate_table(net, tmp.name, tmp.valid_hooks,
 			      newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
 			      tmp.hook_entry, tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo;
 	duprintf("ip_tables: Translated table\n");
 	ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
 			   tmp.num_counters, tmp.counters);
 	if (ret)
 		goto free_newinfo_untrans;
 	return 0;
  free_newinfo_untrans:
 	IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, net, NULL);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
 }
 /* We're lazy, and add to the first CPU; overflow works its fey magic
  * and everything is OK. */
 static int
 add_counter_to_entry(struct ipt_entry *e,
 		     const struct xt_counters addme[],
 		     unsigned int *i)
 {
 	ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
 	(*i)++;
 	return 0;
 }
 static int
 do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
 {
 	unsigned int i, curcpu;
 	struct xt_counters_info tmp;
 	struct xt_counters *paddc;
 	unsigned int num_counters;
 	const char *name;
 	int size;
 	void *ptmp;
 	struct xt_table *t;
 	const struct xt_table_info *private;
 	int ret = 0;
 	void *loc_cpu_entry;
 #ifdef CONFIG_COMPAT
 	struct compat_xt_counters_info compat_tmp;
 	if (compat) {
 		ptmp = &compat_tmp;
 		size = sizeof(struct compat_xt_counters_info);
 	} else
 #endif
 	{
 		ptmp = &tmp;
 		size = sizeof(struct xt_counters_info);
 	}
 	if (copy_from_user(ptmp, user, size) != 0)
 		return -EFAULT;
 #ifdef CONFIG_COMPAT
 	if (compat) {
 		num_counters = compat_tmp.num_counters;
 		name = compat_tmp.name;
 	} else
 #endif
 	{
 		num_counters = tmp.num_counters;
 		name = tmp.name;
 	}
 	if (len != size + num_counters * sizeof(struct xt_counters))
 		return -EINVAL;
 	paddc = vmalloc_node(len - size, numa_node_id());
 	if (!paddc)
 		return -ENOMEM;
 	if (copy_from_user(paddc, user + size, len - size) != 0) {
 		ret = -EFAULT;
 		goto free;
 	}
 	t = xt_find_table_lock(net, AF_INET, name);
 	if (!t || IS_ERR(t)) {
 		ret = t ? PTR_ERR(t) : -ENOENT;
 		goto free;
 	}
 	local_bh_disable();
 	private = t->private;
 	if (private->number != num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
 	}
 	i = 0;
 	/* Choose the copy that is on our node */
 	curcpu = smp_processor_id();
 	loc_cpu_entry = private->entries[curcpu];
 	xt_info_wrlock(curcpu);
 	IPT_ENTRY_ITERATE(loc_cpu_entry,
 			  private->size,
 			  add_counter_to_entry,
 			  paddc,
 			  &i);
 	xt_info_wrunlock(curcpu);
  unlock_up_free:
 	local_bh_enable();
 	xt_table_unlock(t);
 	module_put(t->me);
  free:
 	vfree(paddc);
 	return ret;
 }
 #ifdef CONFIG_COMPAT
 struct compat_ipt_replace {
 	char			name[IPT_TABLE_MAXNAMELEN];
 	u32			valid_hooks;
 	u32			num_entries;
 	u32			size;
 	u32			hook_entry[NF_INET_NUMHOOKS];
 	u32			underflow[NF_INET_NUMHOOKS];
 	u32			num_counters;
 	compat_uptr_t		counters;	/* struct ipt_counters * */
 	struct compat_ipt_entry	entries[0];
 };
 static int
 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
 			  unsigned int *size, struct xt_counters *counters,
 			  unsigned int *i)
 {
 	struct ipt_entry_target *t;
 	struct compat_ipt_entry __user *ce;
 	u_int16_t target_offset, next_offset;
 	compat_uint_t origsize;
 	int ret;
 	ret = -EFAULT;
 	origsize = *size;
 	ce = (struct compat_ipt_entry __user *)*dstptr;
 	if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
 		goto out;
 	if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
 		goto out;
 	*dstptr += sizeof(struct compat_ipt_entry);
 	*size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 	ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
 	target_offset = e->target_offset - (origsize - *size);
 	if (ret)
 		goto out;
 	t = ipt_get_target(e);
 	ret = xt_compat_target_to_user(t, dstptr, size);
 	if (ret)
 		goto out;
 	ret = -EFAULT;
 	next_offset = e->next_offset - (origsize - *size);
 	if (put_user(target_offset, &ce->target_offset))
 		goto out;
 	if (put_user(next_offset, &ce->next_offset))
 		goto out;
 	(*i)++;
 	return 0;
 out:
 	return ret;
 }
 static int
 compat_find_calc_match(struct ipt_entry_match *m,
 		       const char *name,
 		       const struct ipt_ip *ip,
 		       unsigned int hookmask,
 		       int *size, unsigned int *i)
 {
 	struct xt_match *match;
 	match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
 						      m->u.user.revision),
 					"ipt_%s", m->u.user.name);
 	if (IS_ERR(match) || !match) {
 		duprintf("compat_check_calc_match: `%s' not found\n",
 			 m->u.user.name);
 		return match ? PTR_ERR(match) : -ENOENT;
 	}
 	m->u.kernel.match = match;
 	*size += xt_compat_match_offset(match);
 	(*i)++;
 	return 0;
 }
 static int
 compat_release_match(struct ipt_entry_match *m, unsigned int *i)
 {
 	if (i && (*i)-- == 0)
 		return 1;
 	module_put(m->u.kernel.match->me);
 	return 0;
 }
 static int
 compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
 {
 	struct ipt_entry_target *t;
 	if (i && (*i)-- == 0)
 		return 1;
 	/* Cleanup all matches */
 	COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL);
 	t = compat_ipt_get_target(e);
 	module_put(t->u.kernel.target->me);
 	return 0;
 }
 static int
 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
 				  struct xt_table_info *newinfo,
 				  unsigned int *size,
 				  unsigned char *base,
 				  unsigned char *limit,
 				  unsigned int *hook_entries,
 				  unsigned int *underflows,
 				  unsigned int *i,
 				  const char *name)
 {
 	struct ipt_entry_target *t;
 	struct xt_target *target;
 	unsigned int entry_offset;
 	unsigned int j;
 	int ret, off, h;
 	duprintf("check_compat_entry_size_and_hooks %p\n", e);
 	if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
 	    (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
 		duprintf("Bad offset %p, limit = %p\n", e, limit);
 		return -EINVAL;
 	}
 	if (e->next_offset < sizeof(struct compat_ipt_entry) +
 			     sizeof(struct compat_xt_entry_target)) {
 		duprintf("checking: element %p size %u\n",
 			 e, e->next_offset);
 		return -EINVAL;
 	}
 	/* For purposes of check_entry casting the compat entry is fine */
 	ret = check_entry((struct ipt_entry *)e, name);
 	if (ret)
 		return ret;
 	off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 	entry_offset = (void *)e - (void *)base;
 	j = 0;
 	ret = COMPAT_IPT_MATCH_ITERATE(e, compat_find_calc_match, name,
 				       &e->ip, e->comefrom, &off, &j);
 	if (ret != 0)
 		goto release_matches;
 	t = compat_ipt_get_target(e);
 	target = try_then_request_module(xt_find_target(AF_INET,
 							t->u.user.name,
 							t->u.user.revision),
 					 "ipt_%s", t->u.user.name);
 	if (IS_ERR(target) || !target) {
 		duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
 			 t->u.user.name);
 		ret = target ? PTR_ERR(target) : -ENOENT;
 		goto release_matches;
 	}
 	t->u.kernel.target = target;
 	off += xt_compat_target_offset(target);
 	*size += off;
 	ret = xt_compat_add_offset(AF_INET, entry_offset, off);
 	if (ret)
 		goto out;
 	/* Check hooks & underflows */
 	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 		if ((unsigned char *)e - base == hook_entries[h])
 			newinfo->hook_entry[h] = hook_entries[h];
 		if ((unsigned char *)e - base == underflows[h])
 			newinfo->underflow[h] = underflows[h];
 	}
 	/* Clear counters and comefrom */
 	memset(&e->counters, 0, sizeof(e->counters));
 	e->comefrom = 0;
 	(*i)++;
 	return 0;
 out:
 	module_put(t->u.kernel.target->me);
 release_matches:
 	IPT_MATCH_ITERATE(e, compat_release_match, &j);
 	return ret;
 }
 static int
 compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
 			    unsigned int *size, const char *name,
 			    struct xt_table_info *newinfo, unsigned char *base)
 {
 	struct ipt_entry_target *t;
 	struct xt_target *target;
 	struct ipt_entry *de;
 	unsigned int origsize;
 	int ret, h;
 	ret = 0;
 	origsize = *size;
 	de = (struct ipt_entry *)*dstptr;
 	memcpy(de, e, sizeof(struct ipt_entry));
 	memcpy(&de->counters, &e->counters, sizeof(e->counters));
 	*dstptr += sizeof(struct ipt_entry);
 	*size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 	ret = COMPAT_IPT_MATCH_ITERATE(e, xt_compat_match_from_user,
 				       dstptr, size);
 	if (ret)
 		return ret;
 	de->target_offset = e->target_offset - (origsize - *size);
 	t = compat_ipt_get_target(e);
 	target = t->u.kernel.target;
 	xt_compat_target_from_user(t, dstptr, size);
 	de->next_offset = e->next_offset - (origsize - *size);
 	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 		if ((unsigned char *)de - base < newinfo->hook_entry[h])
 			newinfo->hook_entry[h] -= origsize - *size;
 		if ((unsigned char *)de - base < newinfo->underflow[h])
 			newinfo->underflow[h] -= origsize - *size;
 	}
 	return ret;
 }
 static int
 compat_check_entry(struct ipt_entry *e, struct net *net, const char *name,
 				     unsigned int *i)
 {
 	struct xt_mtchk_param mtpar;
 	unsigned int j;
 	int ret;
 	j = 0;
 	mtpar.net	= net;
 	mtpar.table     = name;
 	mtpar.entryinfo = &e->ip;
 	mtpar.hook_mask = e->comefrom;
 	mtpar.family    = NFPROTO_IPV4;
 	ret = IPT_MATCH_ITERATE(e, check_match, &mtpar, &j);
 	if (ret)
 		goto cleanup_matches;
 	ret = check_target(e, net, name);
 	if (ret)
 		goto cleanup_matches;
 	(*i)++;
 	return 0;
  cleanup_matches:
 	IPT_MATCH_ITERATE(e, cleanup_match, net, &j);
 	return ret;
 }
 static int
 translate_compat_table(struct net *net,
 		       const char *name,
 		       unsigned int valid_hooks,
 		       struct xt_table_info **pinfo,
 		       void **pentry0,
 		       unsigned int total_size,
 		       unsigned int number,
 		       unsigned int *hook_entries,
 		       unsigned int *underflows)
 {
 	unsigned int i, j;
 	struct xt_table_info *newinfo, *info;
 	void *pos, *entry0, *entry1;
 	unsigned int size;
 	int ret;
 	info = *pinfo;
 	entry0 = *pentry0;
 	size = total_size;
 	info->number = number;
 	/* Init all hooks to impossible value. */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		info->hook_entry[i] = 0xFFFFFFFF;
 		info->underflow[i] = 0xFFFFFFFF;
 	}
 	duprintf("translate_compat_table: size %u\n", info->size);
 	j = 0;
 	xt_compat_lock(AF_INET);
 	/* Walk through entries, checking offsets. */
 	ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
 				       check_compat_entry_size_and_hooks,
 				       info, &size, entry0,
 				       entry0 + total_size,
 				       hook_entries, underflows, &j, name);
 	if (ret != 0)
 		goto out_unlock;
 	ret = -EINVAL;
 	if (j != number) {
 		duprintf("translate_compat_table: %u not %u entries\n",
 			 j, number);
 		goto out_unlock;
 	}
 	/* Check hooks all assigned */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		/* Only hooks which are valid */
 		if (!(valid_hooks & (1 << i)))
 			continue;
 		if (info->hook_entry[i] == 0xFFFFFFFF) {
 			duprintf("Invalid hook entry %u %u\n",
 				 i, hook_entries[i]);
 			goto out_unlock;
 		}
 		if (info->underflow[i] == 0xFFFFFFFF) {
 			duprintf("Invalid underflow %u %u\n",
 				 i, underflows[i]);
 			goto out_unlock;
 		}
 	}
 	ret = -ENOMEM;
 	newinfo = xt_alloc_table_info(size);
 	if (!newinfo)
 		goto out_unlock;
 	newinfo->number = number;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = info->hook_entry[i];
 		newinfo->underflow[i] = info->underflow[i];
 	}
 	entry1 = newinfo->entries[raw_smp_processor_id()];
 	pos = entry1;
 	size = total_size;
 	ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
 				       compat_copy_entry_from_user,
 				       &pos, &size, name, newinfo, entry1);
 	xt_compat_flush_offsets(AF_INET);
 	xt_compat_unlock(AF_INET);
 	if (ret)
 		goto free_newinfo;
 	ret = -ELOOP;
 	if (!mark_source_chains(newinfo, valid_hooks, entry1))
 		goto free_newinfo;
 	i = 0;
 	ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
 				net, name, &i);
 	if (ret) {
 		j -= i;
 		COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
 						  compat_release_entry, &j);
 		IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, net, &i);
 		xt_free_table_info(newinfo);
 		return ret;
 	}
 	/* And one copy for every other CPU */
 	for_each_possible_cpu(i)
 		if (newinfo->entries[i] && newinfo->entries[i] != entry1)
 			memcpy(newinfo->entries[i], entry1, newinfo->size);
 	*pinfo = newinfo;
 	*pentry0 = entry1;
 	xt_free_table_info(info);
 	return 0;
 free_newinfo:
 	xt_free_table_info(newinfo);
 out:
 	COMPAT_IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
 	return ret;
 out_unlock:
 	xt_compat_flush_offsets(AF_INET);
 	xt_compat_unlock(AF_INET);
 	goto out;
 }
 static int
 compat_do_replace(struct net *net, void __user *user, unsigned int len)
 {
 	int ret;
 	struct compat_ipt_replace tmp;
 	struct xt_table_info *newinfo;
 	void *loc_cpu_entry;
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
 	/* overflow check */
 	if (tmp.size >= INT_MAX / num_possible_cpus())
 		return -ENOMEM;
 	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
 		return -ENOMEM;
 	newinfo = xt_alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 	/* choose the copy that is on our node/cpu */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
 	}
 	ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
 				     &newinfo, &loc_cpu_entry, tmp.size,
 				     tmp.num_entries, tmp.hook_entry,
 				     tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo;
 	duprintf("compat_do_replace: Translated table\n");
 	ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
 			   tmp.num_counters, compat_ptr(tmp.counters));
 	if (ret)
 		goto free_newinfo_untrans;
 	return 0;
  free_newinfo_untrans:
 	IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, net, NULL);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
 }
 static int
 compat_do_ipt_set_ctl(struct sock *sk,	int cmd, void __user *user,
 		      unsigned int len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IPT_SO_SET_REPLACE:
 		ret = compat_do_replace(sock_net(sk), user, len);
 		break;
 	case IPT_SO_SET_ADD_COUNTERS:
 		ret = do_add_counters(sock_net(sk), user, len, 1);
 		break;
 	default:
 		duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 struct compat_ipt_get_entries {
 	char name[IPT_TABLE_MAXNAMELEN];
 	compat_uint_t size;
 	struct compat_ipt_entry entrytable[0];
 };
 static int
 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
 	const struct xt_table_info *private = table->private;
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
 	const void *loc_cpu_entry;
 	unsigned int i = 0;
 	counters = alloc_counters(table);
 	if (IS_ERR(counters))
 		return PTR_ERR(counters);
 	/* choose the copy that is on our node/cpu, ...
 	 * This choice is lazy (because current thread is
 	 * allowed to migrate to another cpu)
 	 */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	pos = userptr;
 	size = total_size;
 	ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
 				compat_copy_entry_to_user,
 				&pos, &size, counters, &i);
 	vfree(counters);
 	return ret;
 }
 static int
 compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
 		   int *len)
 {
 	int ret;
 	struct compat_ipt_get_entries get;
 	struct xt_table *t;
 	if (*len < sizeof(get)) {
 		duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
 		return -EINVAL;
 	}
 	if (copy_from_user(&get, uptr, sizeof(get)) != 0)
 		return -EFAULT;
 	if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
 		duprintf("compat_get_entries: %u != %zu\n",
 			 *len, sizeof(get) + get.size);
 		return -EINVAL;
 	}
 	xt_compat_lock(AF_INET);
 	t = xt_find_table_lock(net, AF_INET, get.name);
 	if (t && !IS_ERR(t)) {
 		const struct xt_table_info *private = t->private;
 		struct xt_table_info info;
 		duprintf("t->private->number = %u\n", private->number);
 		ret = compat_table_info(private, &info);
 		if (!ret && get.size == info.size) {
 			ret = compat_copy_entries_to_user(private->size,
 							  t, uptr->entrytable);
 		} else if (!ret) {
 			duprintf("compat_get_entries: I've got %u not %u!\n",
 				 private->size, get.size);
 			ret = -EAGAIN;
 		}
 		xt_compat_flush_offsets(AF_INET);
 		module_put(t->me);
 		xt_table_unlock(t);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 	xt_compat_unlock(AF_INET);
 	return ret;
 }
 static int do_ipt_get_ctl(struct sock *, int, void __user *, int *);
 static int
 compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IPT_SO_GET_INFO:
 		ret = get_info(sock_net(sk), user, len, 1);
 		break;
 	case IPT_SO_GET_ENTRIES:
 		ret = compat_get_entries(sock_net(sk), user, len);
 		break;
 	default:
 		ret = do_ipt_get_ctl(sk, cmd, user, len);
 	}
 	return ret;
 }
 #endif
 static int
 do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IPT_SO_SET_REPLACE:
 		ret = do_replace(sock_net(sk), user, len);
 		break;
 	case IPT_SO_SET_ADD_COUNTERS:
 		ret = do_add_counters(sock_net(sk), user, len, 0);
 		break;
 	default:
 		duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 static int
 do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IPT_SO_GET_INFO:
 		ret = get_info(sock_net(sk), user, len, 0);
 		break;
 	case IPT_SO_GET_ENTRIES:
 		ret = get_entries(sock_net(sk), user, len);
 		break;
 	case IPT_SO_GET_REVISION_MATCH:
 	case IPT_SO_GET_REVISION_TARGET: {
 		struct ipt_get_revision rev;
 		int target;
 		if (*len != sizeof(rev)) {
 			ret = -EINVAL;
 			break;
 		}
 		if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
 			ret = -EFAULT;
 			break;
 		}
 		if (cmd == IPT_SO_GET_REVISION_TARGET)
 			target = 1;
 		else
 			target = 0;
 		try_then_request_module(xt_find_revision(AF_INET, rev.name,
 							 rev.revision,
 							 target, &ret),
 					"ipt_%s", rev.name);
 		break;
 	}
 	default:
 		duprintf("do_ipt_get_ctl: unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 struct xt_table *ipt_register_table(struct net *net,
 				    const struct xt_table *table,
 				    const struct ipt_replace *repl)
 {
 	int ret;
 	struct xt_table_info *newinfo;
 	struct xt_table_info bootstrap
 		= { 0, 0, 0, { 0 }, { 0 }, { } };
 	void *loc_cpu_entry;
 	struct xt_table *new_table;
 	newinfo = xt_alloc_table_info(repl->size);
 	if (!newinfo) {
 		ret = -ENOMEM;
 		goto out;
 	}
 	/* choose the copy on our node/cpu, but dont care about preemption */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	memcpy(loc_cpu_entry, repl->entries, repl->size);
 	ret = translate_table(net, table->name, table->valid_hooks,
 			      newinfo, loc_cpu_entry, repl->size,
 			      repl->num_entries,
 			      repl->hook_entry,
 			      repl->underflow);
 	if (ret != 0)
 		goto out_free;
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
 		ret = PTR_ERR(new_table);
 		goto out_free;
 	}
 	return new_table;
 out_free:
 	xt_free_table_info(newinfo);
 out:
 	return ERR_PTR(ret);
 }
 void ipt_unregister_table(struct net *net, struct xt_table *table)
 {
 	struct xt_table_info *private;
 	void *loc_cpu_entry;
 	struct module *table_owner = table->me;
 	private = xt_unregister_table(table);
 	/* Decrease module usage counts and free resources */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, net, NULL);
 	if (private->number > private->initial_entries)
 		module_put(table_owner);
 	xt_free_table_info(private);
 }
 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
 static inline bool
 icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
 		     u_int8_t type, u_int8_t code,
 		     bool invert)
 {
 	return ((test_type == 0xFF) ||
 		(type == test_type && code >= min_code && code <= max_code))
 		^ invert;
 }
 static bool
 icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
 {
 	const struct icmphdr *ic;
 	struct icmphdr _icmph;
 	const struct ipt_icmp *icmpinfo = par->matchinfo;
 	/* Must not be a fragment. */
 	if (par->fragoff != 0)
 		return false;
 	ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
 	if (ic == NULL) {
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
 		duprintf("Dropping evil ICMP tinygram.\n");
 		*par->hotdrop = true;
 		return false;
 	}
 	return icmp_type_code_match(icmpinfo->type,
 				    icmpinfo->code[0],
 				    icmpinfo->code[1],
 				    ic->type, ic->code,
 				    !!(icmpinfo->invflags&IPT_ICMP_INV));
 }
 static bool icmp_checkentry(const struct xt_mtchk_param *par)
 {
 	const struct ipt_icmp *icmpinfo = par->matchinfo;
 	/* Must specify no unknown invflags */
 	return !(icmpinfo->invflags & ~IPT_ICMP_INV);
 }
 /* The built-in targets: standard (NULL) and error. */
 static struct xt_target ipt_standard_target __read_mostly = {
 	.name		= IPT_STANDARD_TARGET,
 	.targetsize	= sizeof(int),
 	.family		= NFPROTO_IPV4,
 #ifdef CONFIG_COMPAT
 	.compatsize	= sizeof(compat_int_t),
 	.compat_from_user = compat_standard_from_user,
 	.compat_to_user	= compat_standard_to_user,
 #endif
 };
 static struct xt_target ipt_error_target __read_mostly = {
 	.name		= IPT_ERROR_TARGET,
 	.target		= ipt_error,
 	.targetsize	= IPT_FUNCTION_MAXNAMELEN,
 	.family		= NFPROTO_IPV4,
 };
 static struct nf_sockopt_ops ipt_sockopts = {
 	.pf		= PF_INET,
 	.set_optmin	= IPT_BASE_CTL,
 	.set_optmax	= IPT_SO_SET_MAX+1,
 	.set		= do_ipt_set_ctl,
 #ifdef CONFIG_COMPAT
 	.compat_set	= compat_do_ipt_set_ctl,
 #endif
 	.get_optmin	= IPT_BASE_CTL,
 	.get_optmax	= IPT_SO_GET_MAX+1,
 	.get		= do_ipt_get_ctl,
 #ifdef CONFIG_COMPAT
 	.compat_get	= compat_do_ipt_get_ctl,
 #endif
 	.owner		= THIS_MODULE,
 };
 static struct xt_match icmp_matchstruct __read_mostly = {
 	.name		= "icmp",
 	.match		= icmp_match,
 	.matchsize	= sizeof(struct ipt_icmp),
 	.checkentry	= icmp_checkentry,
 	.proto		= IPPROTO_ICMP,
 	.family		= NFPROTO_IPV4,
 };
 static int __net_init ip_tables_net_init(struct net *net)
 {
 	return xt_proto_init(net, NFPROTO_IPV4);
 }
 static void __net_exit ip_tables_net_exit(struct net *net)
 {
 	xt_proto_fini(net, NFPROTO_IPV4);
 }
 static struct pernet_operations ip_tables_net_ops = {
 	.init = ip_tables_net_init,
 	.exit = ip_tables_net_exit,
 };
 static int __init ip_tables_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&ip_tables_net_ops);
 	if (ret < 0)
 		goto err1;
 	/* Noone else will be downing sem now, so we won't sleep */
 	ret = xt_register_target(&ipt_standard_target);
 	if (ret < 0)
 		goto err2;
 	ret = xt_register_target(&ipt_error_target);
 	if (ret < 0)
 		goto err3;
 	ret = xt_register_match(&icmp_matchstruct);
 	if (ret < 0)
 		goto err4;
 	/* Register setsockopt */
 	ret = nf_register_sockopt(&ipt_sockopts);
 	if (ret < 0)
 		goto err5;
 	printk(KERN_INFO "ip_tables: (C) 2000-2006 Netfilter Core Team\n");
 	return 0;
 err5:
 	xt_unregister_match(&icmp_matchstruct);
 err4:
 	xt_unregister_target(&ipt_error_target);
 err3:
 	xt_unregister_target(&ipt_standard_target);
 err2:
 	unregister_pernet_subsys(&ip_tables_net_ops);
 err1:
 	return ret;
 }
 static void __exit ip_tables_fini(void)
 {
 	nf_unregister_sockopt(&ipt_sockopts);
 	xt_unregister_match(&icmp_matchstruct);
 	xt_unregister_target(&ipt_error_target);
 	xt_unregister_target(&ipt_standard_target);
 	unregister_pernet_subsys(&ip_tables_net_ops);
 }
 EXPORT_SYMBOL(ipt_register_table);
 EXPORT_SYMBOL(ipt_unregister_table);
 EXPORT_SYMBOL(ipt_do_table);
 module_init(ip_tables_init);
 module_exit(ip_tables_fini);

net/ipv4/netfilter/iptable_filter.c

Diff comments View file @ e3eaa99

 /*
  * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
  */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <net/ip.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("iptables filter table");
 #define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \
 			    (1 << NF_INET_FORWARD) | \
 			    (1 << NF_INET_LOCAL_OUT))
-static struct
-{
-	struct ipt_replace repl;
-	struct ipt_standard entries[3];
-	struct ipt_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "filter",
-		.valid_hooks = FILTER_VALID_HOOKS,
-		.num_entries = 4,
-		.size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-		.hook_entry = {
-			[NF_INET_LOCAL_IN] = 0,
-			[NF_INET_FORWARD] = sizeof(struct ipt_standard),
-			[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
-		},
-		.underflow = {
-			[NF_INET_LOCAL_IN] = 0,
-			[NF_INET_FORWARD] = sizeof(struct ipt_standard),
-			[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
-		},
-	},
-	.entries = {
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-	},
-	.term = IPT_ERROR_INIT,			/* ERROR */
-};
 static const struct xt_table packet_filter = {
 	.name		= "filter",
 	.valid_hooks	= FILTER_VALID_HOOKS,
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV4,
 	.priority	= NF_IP_PRI_FILTER,
 };
 static unsigned int
 iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
 		    const struct net_device *in, const struct net_device *out,
 		    int (*okfn)(struct sk_buff *))
 {
 	const struct net *net;
 	if (hook == NF_INET_LOCAL_OUT &&
 	    (skb->len < sizeof(struct iphdr) ||
 	     ip_hdrlen(skb) < sizeof(struct iphdr)))
 		/* root is playing with raw sockets. */
 		return NF_ACCEPT;
 	net = dev_net((in != NULL) ? in : out);
 	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
 }
 static struct nf_hook_ops *filter_ops __read_mostly;
 /* Default to forward because I got too much mail already. */
 static int forward = NF_ACCEPT;
 module_param(forward, bool, 0000);
 static int __net_init iptable_filter_net_init(struct net *net)
 {
-	/* Register table */
+	struct ipt_replace *repl;
+	repl = ipt_alloc_initial_table(&packet_filter);
+	if (repl == NULL)
+		return -ENOMEM;
+	/* Entry 1 is the FORWARD hook */
+	((struct ipt_standard *)repl->entries)[1].target.verdict =
+		-forward - 1;
 	net->ipv4.iptable_filter =
-		ipt_register_table(net, &packet_filter, &initial_table.repl);
+		ipt_register_table(net, &packet_filter, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv4.iptable_filter))
 		return PTR_ERR(net->ipv4.iptable_filter);
 	return 0;
 }
 static void __net_exit iptable_filter_net_exit(struct net *net)
 {
 	ipt_unregister_table(net, net->ipv4.iptable_filter);
 }
 static struct pernet_operations iptable_filter_net_ops = {
 	.init = iptable_filter_net_init,
 	.exit = iptable_filter_net_exit,
 };
 static int __init iptable_filter_init(void)
 {
 	int ret;
 	if (forward < 0 || forward > NF_MAX_VERDICT) {
 		printk("iptables forward must be 0 or 1\n");
 		return -EINVAL;
 	}
-	/* Entry 1 is the FORWARD hook */
-	initial_table.entries[1].target.verdict = -forward - 1;
 	ret = register_pernet_subsys(&iptable_filter_net_ops);
 	if (ret < 0)
 		return ret;
 	/* Register hooks */
 	filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);
 	if (IS_ERR(filter_ops)) {
 		ret = PTR_ERR(filter_ops);
 		goto cleanup_table;
 	}
 	return ret;
  cleanup_table:
 	unregister_pernet_subsys(&iptable_filter_net_ops);
 	return ret;
 }

net/ipv4/netfilter/iptable_mangle.c

Diff comments View file @ e3eaa99

 /*
  * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
 #include <net/route.h>
 #include <linux/ip.h>
 #include <net/ip.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("iptables mangle table");
 #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
 			    (1 << NF_INET_LOCAL_IN) | \
 			    (1 << NF_INET_FORWARD) | \
 			    (1 << NF_INET_LOCAL_OUT) | \
 			    (1 << NF_INET_POST_ROUTING))
-/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
-static const struct
-{
-	struct ipt_replace repl;
-	struct ipt_standard entries[5];
-	struct ipt_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "mangle",
-		.valid_hooks = MANGLE_VALID_HOOKS,
-		.num_entries = 6,
-		.size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
-		.hook_entry = {
-			[NF_INET_PRE_ROUTING] 	= 0,
-			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
-			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
-			[NF_INET_POST_ROUTING] 	= sizeof(struct ipt_standard) * 4,
-		},
-		.underflow = {
-			[NF_INET_PRE_ROUTING] 	= 0,
-			[NF_INET_LOCAL_IN] 	= sizeof(struct ipt_standard),
-			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard) * 2,
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 3,
-			[NF_INET_POST_ROUTING]	= sizeof(struct ipt_standard) * 4,
-		},
-	},
-	.entries = {
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
-	},
-	.term = IPT_ERROR_INIT,			/* ERROR */
-};
 static const struct xt_table packet_mangler = {
 	.name		= "mangle",
 	.valid_hooks	= MANGLE_VALID_HOOKS,
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV4,
 	.priority	= NF_IP_PRI_MANGLE,
 };
 static unsigned int
 ipt_local_hook(unsigned int hook,
 		   struct sk_buff *skb,
 		   const struct net_device *in,
 		   const struct net_device *out,
 		   int (*okfn)(struct sk_buff *))
 {
 	unsigned int ret;
 	const struct iphdr *iph;
 	u_int8_t tos;
 	__be32 saddr, daddr;
 	u_int32_t mark;
 	/* root is playing with raw sockets. */
 	if (skb->len < sizeof(struct iphdr) ||
 	    ip_hdrlen(skb) < sizeof(struct iphdr))
 		return NF_ACCEPT;
 	/* Save things which could affect route */
 	mark = skb->mark;
 	iph = ip_hdr(skb);
 	saddr = iph->saddr;
 	daddr = iph->daddr;
 	tos = iph->tos;
 	ret = ipt_do_table(skb, hook, in, out,
 			   dev_net(out)->ipv4.iptable_mangle);
 	/* Reroute for ANY change. */
 	if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
 		iph = ip_hdr(skb);
 		if (iph->saddr != saddr ||
 		    iph->daddr != daddr ||
 		    skb->mark != mark ||
 		    iph->tos != tos)
 			if (ip_route_me_harder(skb, RTN_UNSPEC))
 				ret = NF_DROP;
 	}
 	return ret;
 }
 /* The work comes in here from netfilter.c. */
 static unsigned int
 iptable_mangle_hook(unsigned int hook,
 		     struct sk_buff *skb,
 		     const struct net_device *in,
 		     const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
 	if (hook == NF_INET_LOCAL_OUT)
 		return ipt_local_hook(hook, skb, in, out, okfn);
 	/* PREROUTING/INPUT/FORWARD: */
 	return ipt_do_table(skb, hook, in, out,
 			    dev_net(in)->ipv4.iptable_mangle);
 }
 static struct nf_hook_ops *mangle_ops __read_mostly;
 static int __net_init iptable_mangle_net_init(struct net *net)
 {
-	/* Register table */
+	struct ipt_replace *repl;
+	repl = ipt_alloc_initial_table(&packet_mangler);
+	if (repl == NULL)
+		return -ENOMEM;
 	net->ipv4.iptable_mangle =
-		ipt_register_table(net, &packet_mangler, &initial_table.repl);
+		ipt_register_table(net, &packet_mangler, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv4.iptable_mangle))
 		return PTR_ERR(net->ipv4.iptable_mangle);
 	return 0;
 }
 static void __net_exit iptable_mangle_net_exit(struct net *net)
 {
 	ipt_unregister_table(net, net->ipv4.iptable_mangle);
 }
 static struct pernet_operations iptable_mangle_net_ops = {
 	.init = iptable_mangle_net_init,
 	.exit = iptable_mangle_net_exit,
 };
 static int __init iptable_mangle_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&iptable_mangle_net_ops);
 	if (ret < 0)
 		return ret;
 	/* Register hooks */
 	mangle_ops = xt_hook_link(&packet_mangler, iptable_mangle_hook);
 	if (IS_ERR(mangle_ops)) {
 		ret = PTR_ERR(mangle_ops);
 		goto cleanup_table;
 	}
 	return ret;
  cleanup_table:
 	unregister_pernet_subsys(&iptable_mangle_net_ops);
 	return ret;
 }
 static void __exit iptable_mangle_fini(void)
 {
 	xt_hook_unlink(&packet_mangler, mangle_ops);
 	unregister_pernet_subsys(&iptable_mangle_net_ops);

net/ipv4/netfilter/iptable_raw.c

Diff comments View file @ e3eaa99

 /*
  * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
  *
  * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <net/ip.h>
 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
-static const struct
-{
-	struct ipt_replace repl;
-	struct ipt_standard entries[2];
-	struct ipt_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "raw",
-		.valid_hooks = RAW_VALID_HOOKS,
-		.num_entries = 3,
-		.size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
-		.hook_entry = {
-			[NF_INET_PRE_ROUTING] = 0,
-			[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard)
-		},
-		.underflow = {
-			[NF_INET_PRE_ROUTING] = 0,
-			[NF_INET_LOCAL_OUT]  = sizeof(struct ipt_standard)
-		},
-	},
-	.entries = {
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-	},
-	.term = IPT_ERROR_INIT,			/* ERROR */
-};
 static const struct xt_table packet_raw = {
 	.name = "raw",
 	.valid_hooks =  RAW_VALID_HOOKS,
 	.me = THIS_MODULE,
 	.af = NFPROTO_IPV4,
 	.priority = NF_IP_PRI_RAW,
 };
 /* The work comes in here from netfilter.c. */
 static unsigned int
 iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
 		 const struct net_device *in, const struct net_device *out,
 		 int (*okfn)(struct sk_buff *))
 {
 	const struct net *net;
 	if (hook == NF_INET_LOCAL_OUT &&
 	    (skb->len < sizeof(struct iphdr) ||
 	     ip_hdrlen(skb) < sizeof(struct iphdr)))
 		/* root is playing with raw sockets. */
 		return NF_ACCEPT;
 	net = dev_net((in != NULL) ? in : out);
 	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
 }
 static struct nf_hook_ops *rawtable_ops __read_mostly;
 static int __net_init iptable_raw_net_init(struct net *net)
 {
-	/* Register table */
+	struct ipt_replace *repl;
+	repl = ipt_alloc_initial_table(&packet_raw);
+	if (repl == NULL)
+		return -ENOMEM;
 	net->ipv4.iptable_raw =
-		ipt_register_table(net, &packet_raw, &initial_table.repl);
+		ipt_register_table(net, &packet_raw, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv4.iptable_raw))
 		return PTR_ERR(net->ipv4.iptable_raw);
 	return 0;
 }
 static void __net_exit iptable_raw_net_exit(struct net *net)
 {
 	ipt_unregister_table(net, net->ipv4.iptable_raw);
 }
 static struct pernet_operations iptable_raw_net_ops = {
 	.init = iptable_raw_net_init,
 	.exit = iptable_raw_net_exit,
 };
 static int __init iptable_raw_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&iptable_raw_net_ops);
 	if (ret < 0)
 		return ret;
 	/* Register hooks */
 	rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook);
 	if (IS_ERR(rawtable_ops)) {
 		ret = PTR_ERR(rawtable_ops);
 		goto cleanup_table;
 	}
 	return ret;
  cleanup_table:
 	unregister_pernet_subsys(&iptable_raw_net_ops);
 	return ret;
 }
 static void __exit iptable_raw_fini(void)
 {
 	xt_hook_unlink(&packet_raw, rawtable_ops);
 	unregister_pernet_subsys(&iptable_raw_net_ops);
 }

net/ipv4/netfilter/iptable_security.c

Diff comments View file @ e3eaa99

 /*
  * "security" table
  *
  * This is for use by Mandatory Access Control (MAC) security models,
  * which need to be able to manage security policy in separate context
  * to DAC.
  *
  * Based on iptable_mangle.c
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
  * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <net/ip.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
 MODULE_DESCRIPTION("iptables security table, for MAC rules");
 #define SECURITY_VALID_HOOKS	(1 << NF_INET_LOCAL_IN) | \
 				(1 << NF_INET_FORWARD) | \
 				(1 << NF_INET_LOCAL_OUT)
-static const struct
-{
-	struct ipt_replace repl;
-	struct ipt_standard entries[3];
-	struct ipt_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "security",
-		.valid_hooks = SECURITY_VALID_HOOKS,
-		.num_entries = 4,
-		.size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-		.hook_entry = {
-			[NF_INET_LOCAL_IN] 	= 0,
-			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard),
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 2,
-		},
-		.underflow = {
-			[NF_INET_LOCAL_IN] 	= 0,
-			[NF_INET_FORWARD] 	= sizeof(struct ipt_standard),
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ipt_standard) * 2,
-		},
-	},
-	.entries = {
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
-		IPT_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-	},
-	.term = IPT_ERROR_INIT,			/* ERROR */
-};
 static const struct xt_table security_table = {
 	.name		= "security",
 	.valid_hooks	= SECURITY_VALID_HOOKS,
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV4,
 	.priority	= NF_IP_PRI_SECURITY,
 };
 static unsigned int
 iptable_security_hook(unsigned int hook, struct sk_buff *skb,
 		      const struct net_device *in,
 		      const struct net_device *out,
 		      int (*okfn)(struct sk_buff *))
 {
 	const struct net *net;
 	if (hook == NF_INET_LOCAL_OUT &&
 	    (skb->len < sizeof(struct iphdr) ||
 	     ip_hdrlen(skb) < sizeof(struct iphdr)))
 		/* Somebody is playing with raw sockets. */
 		return NF_ACCEPT;
 	net = dev_net((in != NULL) ? in : out);
 	return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
 }
 static struct nf_hook_ops *sectbl_ops __read_mostly;
 static int __net_init iptable_security_net_init(struct net *net)
 {
-	net->ipv4.iptable_security =
+	struct ipt_replace *repl;
-		ipt_register_table(net, &security_table, &initial_table.repl);
+	repl = ipt_alloc_initial_table(&security_table);
+	if (repl == NULL)
+		return -ENOMEM;
+	net->ipv4.iptable_security =
+		ipt_register_table(net, &security_table, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv4.iptable_security))
 		return PTR_ERR(net->ipv4.iptable_security);
 	return 0;
 }
 static void __net_exit iptable_security_net_exit(struct net *net)
 {
 	ipt_unregister_table(net, net->ipv4.iptable_security);
 }
 static struct pernet_operations iptable_security_net_ops = {
 	.init = iptable_security_net_init,
 	.exit = iptable_security_net_exit,
 };
 static int __init iptable_security_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&iptable_security_net_ops);
         if (ret < 0)
 		return ret;
 	sectbl_ops = xt_hook_link(&security_table, iptable_security_hook);
 	if (IS_ERR(sectbl_ops)) {
 		ret = PTR_ERR(sectbl_ops);
 		goto cleanup_table;
 	}
 	return ret;
 cleanup_table:
 	unregister_pernet_subsys(&iptable_security_net_ops);
 	return ret;
 }
 static void __exit iptable_security_fini(void)
 {
 	xt_hook_unlink(&security_table, sectbl_ops);

net/ipv4/netfilter/nf_nat_rule.c

Diff comments View file @ e3eaa99

1	/* (C) 1999-2001 Paul `Rusty' Russell	1	/* (C) 1999-2001 Paul `Rusty' Russell
2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>	2	* (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
3	*	3	*
4	* This program is free software; you can redistribute it and/or modify	4	* This program is free software; you can redistribute it and/or modify
5	* it under the terms of the GNU General Public License version 2 as	5	* it under the terms of the GNU General Public License version 2 as
6	* published by the Free Software Foundation.	6	* published by the Free Software Foundation.
7	*/	7	*/
8		8
9	/* Everything about the rules for NAT. */	9	/* Everything about the rules for NAT. */
10	#include <linux/types.h>	10	#include <linux/types.h>
11	#include <linux/ip.h>	11	#include <linux/ip.h>
12	#include <linux/netfilter.h>	12	#include <linux/netfilter.h>
13	#include <linux/netfilter_ipv4.h>	13	#include <linux/netfilter_ipv4.h>
14	#include <linux/module.h>	14	#include <linux/module.h>
15	#include <linux/kmod.h>	15	#include <linux/kmod.h>
16	#include <linux/skbuff.h>	16	#include <linux/skbuff.h>
17	#include <linux/proc_fs.h>	17	#include <linux/proc_fs.h>
18	#include <net/checksum.h>	18	#include <net/checksum.h>
19	#include <net/route.h>	19	#include <net/route.h>
20	#include <linux/bitops.h>	20	#include <linux/bitops.h>
21		21
22	#include <linux/netfilter_ipv4/ip_tables.h>	22	#include <linux/netfilter_ipv4/ip_tables.h>
23	#include <net/netfilter/nf_nat.h>	23	#include <net/netfilter/nf_nat.h>
24	#include <net/netfilter/nf_nat_core.h>	24	#include <net/netfilter/nf_nat_core.h>
25	#include <net/netfilter/nf_nat_rule.h>	25	#include <net/netfilter/nf_nat_rule.h>
26		26
27	#define NAT_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) \| \	27	#define NAT_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) \| \
28	(1 << NF_INET_POST_ROUTING) \| \	28	(1 << NF_INET_POST_ROUTING) \| \
29	(1 << NF_INET_LOCAL_OUT))	29	(1 << NF_INET_LOCAL_OUT))
30		30
31	static const struct
32	{
33	struct ipt_replace repl;
34	struct ipt_standard entries[3];
35	struct ipt_error term;
36	} nat_initial_table __net_initdata = {
37	.repl = {
38	.name = "nat",
39	.valid_hooks = NAT_VALID_HOOKS,
40	.num_entries = 4,
41	.size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
42	.hook_entry = {
43	[NF_INET_PRE_ROUTING] = 0,
44	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
45	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
46	},
47	.underflow = {
48	[NF_INET_PRE_ROUTING] = 0,
49	[NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
50	[NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
51	},
52	},
53	.entries = {
54	IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */
55	IPT_STANDARD_INIT(NF_ACCEPT), /* POST_ROUTING */
56	IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */
57	},
58	.term = IPT_ERROR_INIT, /* ERROR */
59	};
60
61	static const struct xt_table nat_table = {	31	static const struct xt_table nat_table = {
62	.name = "nat",	32	.name = "nat",
63	.valid_hooks = NAT_VALID_HOOKS,	33	.valid_hooks = NAT_VALID_HOOKS,
64	.me = THIS_MODULE,	34	.me = THIS_MODULE,
65	.af = NFPROTO_IPV4,	35	.af = NFPROTO_IPV4,
66	};	36	};
67		37
68	/* Source NAT */	38	/* Source NAT */
69	static unsigned int	39	static unsigned int
70	ipt_snat_target(struct sk_buff skb, const struct xt_target_param par)	40	ipt_snat_target(struct sk_buff skb, const struct xt_target_param par)
71	{	41	{
72	struct nf_conn *ct;	42	struct nf_conn *ct;
73	enum ip_conntrack_info ctinfo;	43	enum ip_conntrack_info ctinfo;
74	const struct nf_nat_multi_range_compat *mr = par->targinfo;	44	const struct nf_nat_multi_range_compat *mr = par->targinfo;
75		45
76	NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);	46	NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
77		47
78	ct = nf_ct_get(skb, &ctinfo);	48	ct = nf_ct_get(skb, &ctinfo);
79		49
80	/* Connection must be valid and new. */	50	/* Connection must be valid and new. */
81	NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|	51	NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED \|\|
82	ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));	52	ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
83	NF_CT_ASSERT(par->out != NULL);	53	NF_CT_ASSERT(par->out != NULL);
84		54
85	return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC);	55	return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC);
86	}	56	}
87		57
88	static unsigned int	58	static unsigned int
89	ipt_dnat_target(struct sk_buff skb, const struct xt_target_param par)	59	ipt_dnat_target(struct sk_buff skb, const struct xt_target_param par)
90	{	60	{
91	struct nf_conn *ct;	61	struct nf_conn *ct;
92	enum ip_conntrack_info ctinfo;	62	enum ip_conntrack_info ctinfo;
93	const struct nf_nat_multi_range_compat *mr = par->targinfo;	63	const struct nf_nat_multi_range_compat *mr = par->targinfo;
94		64
95	NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING \|\|	65	NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING \|\|
96	par->hooknum == NF_INET_LOCAL_OUT);	66	par->hooknum == NF_INET_LOCAL_OUT);
97		67
98	ct = nf_ct_get(skb, &ctinfo);	68	ct = nf_ct_get(skb, &ctinfo);
99		69
100	/* Connection must be valid and new. */	70	/* Connection must be valid and new. */
101	NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED));	71	NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW \|\| ctinfo == IP_CT_RELATED));
102		72
103	return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);	73	return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);
104	}	74	}
105		75
106	static bool ipt_snat_checkentry(const struct xt_tgchk_param *par)	76	static bool ipt_snat_checkentry(const struct xt_tgchk_param *par)
107	{	77	{
108	const struct nf_nat_multi_range_compat *mr = par->targinfo;	78	const struct nf_nat_multi_range_compat *mr = par->targinfo;
109		79
110	/* Must be a valid range */	80	/* Must be a valid range */
111	if (mr->rangesize != 1) {	81	if (mr->rangesize != 1) {
112	printk("SNAT: multiple ranges no longer supported\n");	82	printk("SNAT: multiple ranges no longer supported\n");
113	return false;	83	return false;
114	}	84	}
115	return true;	85	return true;
116	}	86	}
117		87
118	static bool ipt_dnat_checkentry(const struct xt_tgchk_param *par)	88	static bool ipt_dnat_checkentry(const struct xt_tgchk_param *par)
119	{	89	{
120	const struct nf_nat_multi_range_compat *mr = par->targinfo;	90	const struct nf_nat_multi_range_compat *mr = par->targinfo;
121		91
122	/* Must be a valid range */	92	/* Must be a valid range */
123	if (mr->rangesize != 1) {	93	if (mr->rangesize != 1) {
124	printk("DNAT: multiple ranges no longer supported\n");	94	printk("DNAT: multiple ranges no longer supported\n");
125	return false;	95	return false;
126	}	96	}
127	return true;	97	return true;
128	}	98	}
129		99
130	unsigned int	100	unsigned int
131	alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)	101	alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
132	{	102	{
133	/* Force range to this IP; let proto decide mapping for	103	/* Force range to this IP; let proto decide mapping for
134	per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).	104	per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
135	Use reply in case it's already been mangled (eg local packet).	105	Use reply in case it's already been mangled (eg local packet).
136	*/	106	*/
137	__be32 ip	107	__be32 ip
138	= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC	108	= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
139	? ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip	109	? ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip
140	: ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);	110	: ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
141	struct nf_nat_range range	111	struct nf_nat_range range
142	= { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } };	112	= { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } };
143		113
144	pr_debug("Allocating NULL binding for %p (%pI4)\n", ct, &ip);	114	pr_debug("Allocating NULL binding for %p (%pI4)\n", ct, &ip);
145	return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));	115	return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
146	}	116	}
147		117
148	int nf_nat_rule_find(struct sk_buff *skb,	118	int nf_nat_rule_find(struct sk_buff *skb,
149	unsigned int hooknum,	119	unsigned int hooknum,
150	const struct net_device *in,	120	const struct net_device *in,
151	const struct net_device *out,	121	const struct net_device *out,
152	struct nf_conn *ct)	122	struct nf_conn *ct)
153	{	123	{
154	struct net *net = nf_ct_net(ct);	124	struct net *net = nf_ct_net(ct);
155	int ret;	125	int ret;
156		126
157	ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);	127	ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
158		128
159	if (ret == NF_ACCEPT) {	129	if (ret == NF_ACCEPT) {
160	if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))	130	if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
161	/* NUL mapping */	131	/* NUL mapping */
162	ret = alloc_null_binding(ct, hooknum);	132	ret = alloc_null_binding(ct, hooknum);
163	}	133	}
164	return ret;	134	return ret;
165	}	135	}
166		136
167	static struct xt_target ipt_snat_reg __read_mostly = {	137	static struct xt_target ipt_snat_reg __read_mostly = {
168	.name = "SNAT",	138	.name = "SNAT",
169	.target = ipt_snat_target,	139	.target = ipt_snat_target,
170	.targetsize = sizeof(struct nf_nat_multi_range_compat),	140	.targetsize = sizeof(struct nf_nat_multi_range_compat),
171	.table = "nat",	141	.table = "nat",
172	.hooks = 1 << NF_INET_POST_ROUTING,	142	.hooks = 1 << NF_INET_POST_ROUTING,
173	.checkentry = ipt_snat_checkentry,	143	.checkentry = ipt_snat_checkentry,
174	.family = AF_INET,	144	.family = AF_INET,
175	};	145	};
176		146
177	static struct xt_target ipt_dnat_reg __read_mostly = {	147	static struct xt_target ipt_dnat_reg __read_mostly = {
178	.name = "DNAT",	148	.name = "DNAT",
179	.target = ipt_dnat_target,	149	.target = ipt_dnat_target,
180	.targetsize = sizeof(struct nf_nat_multi_range_compat),	150	.targetsize = sizeof(struct nf_nat_multi_range_compat),
181	.table = "nat",	151	.table = "nat",
182	.hooks = (1 << NF_INET_PRE_ROUTING) \| (1 << NF_INET_LOCAL_OUT),	152	.hooks = (1 << NF_INET_PRE_ROUTING) \| (1 << NF_INET_LOCAL_OUT),
183	.checkentry = ipt_dnat_checkentry,	153	.checkentry = ipt_dnat_checkentry,
184	.family = AF_INET,	154	.family = AF_INET,
185	};	155	};
186		156
187	static int __net_init nf_nat_rule_net_init(struct net *net)	157	static int __net_init nf_nat_rule_net_init(struct net *net)
188	{	158	{
189	net->ipv4.nat_table = ipt_register_table(net, &nat_table,	159	struct ipt_replace *repl;
190	&nat_initial_table.repl);	160
		161	repl = ipt_alloc_initial_table(&nat_table);
		162	if (repl == NULL)
		163	return -ENOMEM;
		164	net->ipv4.nat_table = ipt_register_table(net, &nat_table, repl);
		165	kfree(repl);
191	if (IS_ERR(net->ipv4.nat_table))	166	if (IS_ERR(net->ipv4.nat_table))
192	return PTR_ERR(net->ipv4.nat_table);	167	return PTR_ERR(net->ipv4.nat_table);
193	return 0;	168	return 0;
194	}	169	}
195		170
196	static void __net_exit nf_nat_rule_net_exit(struct net *net)	171	static void __net_exit nf_nat_rule_net_exit(struct net *net)
197	{	172	{
198	ipt_unregister_table(net, net->ipv4.nat_table);	173	ipt_unregister_table(net, net->ipv4.nat_table);
199	}	174	}
200		175
201	static struct pernet_operations nf_nat_rule_net_ops = {	176	static struct pernet_operations nf_nat_rule_net_ops = {
202	.init = nf_nat_rule_net_init,	177	.init = nf_nat_rule_net_init,
203	.exit = nf_nat_rule_net_exit,	178	.exit = nf_nat_rule_net_exit,
204	};	179	};
205		180
206	int __init nf_nat_rule_init(void)	181	int __init nf_nat_rule_init(void)
207	{	182	{
208	int ret;	183	int ret;
209		184
210	ret = register_pernet_subsys(&nf_nat_rule_net_ops);	185	ret = register_pernet_subsys(&nf_nat_rule_net_ops);
211	if (ret != 0)	186	if (ret != 0)
212	goto out;	187	goto out;
213	ret = xt_register_target(&ipt_snat_reg);	188	ret = xt_register_target(&ipt_snat_reg);
214	if (ret != 0)	189	if (ret != 0)
215	goto unregister_table;	190	goto unregister_table;
216		191
217	ret = xt_register_target(&ipt_dnat_reg);	192	ret = xt_register_target(&ipt_dnat_reg);
218	if (ret != 0)	193	if (ret != 0)
219	goto unregister_snat;	194	goto unregister_snat;
220		195
221	return ret;	196	return ret;
222		197
223	unregister_snat:	198	unregister_snat:
224	xt_unregister_target(&ipt_snat_reg);	199	xt_unregister_target(&ipt_snat_reg);
225	unregister_table:	200	unregister_table:
226	unregister_pernet_subsys(&nf_nat_rule_net_ops);	201	unregister_pernet_subsys(&nf_nat_rule_net_ops);
227	out:	202	out:
228	return ret;	203	return ret;
229	}	204	}
230		205
231	void nf_nat_rule_cleanup(void)	206	void nf_nat_rule_cleanup(void)
232	{	207	{

net/ipv6/netfilter/ip6_tables.c

Diff comments View file @ e3eaa99

 /*
  * Packet matching code.
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/capability.h>
 #include <linux/in.h>
 #include <linux/skbuff.h>
 #include <linux/kmod.h>
 #include <linux/vmalloc.h>
 #include <linux/netdevice.h>
 #include <linux/module.h>
 #include <linux/poison.h>
 #include <linux/icmpv6.h>
 #include <net/ipv6.h>
 #include <net/compat.h>
 #include <asm/uaccess.h>
 #include <linux/mutex.h>
 #include <linux/proc_fs.h>
 #include <linux/err.h>
 #include <linux/cpumask.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter/x_tables.h>
 #include <net/netfilter/nf_log.h>
+#include "../../netfilter/xt_repldata.h"
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("IPv6 packet filter");
 /*#define DEBUG_IP_FIREWALL*/
 /*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
 /*#define DEBUG_IP_FIREWALL_USER*/
 #ifdef DEBUG_IP_FIREWALL
 #define dprintf(format, args...)  printk(format , ## args)
 #else
 #define dprintf(format, args...)
 #endif
 #ifdef DEBUG_IP_FIREWALL_USER
 #define duprintf(format, args...) printk(format , ## args)
 #else
 #define duprintf(format, args...)
 #endif
 #ifdef CONFIG_NETFILTER_DEBUG
 #define IP_NF_ASSERT(x)						\
 do {								\
 	if (!(x))						\
 		printk("IP_NF_ASSERT: %s:%s:%u\n",		\
 		       __func__, __FILE__, __LINE__);	\
 } while(0)
 #else
 #define IP_NF_ASSERT(x)
 #endif
 #if 0
 /* All the better to debug you with... */
 #define static
 #define inline
 #endif
+void *ip6t_alloc_initial_table(const struct xt_table *info)
+{
+	return xt_alloc_initial_table(ip6t, IP6T);
+}
+EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 /*
    We keep a set of rules for each CPU, so we can avoid write-locking
    them in the softirq when updating the counters and therefore
    only need to read-lock in the softirq; doing a write_lock_bh() in user
    context stops packets coming through and allows user context to read
    the counters or update the rules.
    Hence the start of any table is given by get_table() below.  */
 /* Check for an extension */
 int
 ip6t_ext_hdr(u8 nexthdr)
 {
 	return ( (nexthdr == IPPROTO_HOPOPTS)   ||
 		 (nexthdr == IPPROTO_ROUTING)   ||
 		 (nexthdr == IPPROTO_FRAGMENT)  ||
 		 (nexthdr == IPPROTO_ESP)       ||
 		 (nexthdr == IPPROTO_AH)        ||
 		 (nexthdr == IPPROTO_NONE)      ||
 		 (nexthdr == IPPROTO_DSTOPTS) );
 }
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
 ip6_packet_match(const struct sk_buff *skb,
 		 const char *indev,
 		 const char *outdev,
 		 const struct ip6t_ip6 *ip6info,
 		 unsigned int *protoff,
 		 int *fragoff, bool *hotdrop)
 {
 	unsigned long ret;
 	const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
 	if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
 				       &ip6info->src), IP6T_INV_SRCIP) ||
 	    FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
 				       &ip6info->dst), IP6T_INV_DSTIP)) {
 		dprintf("Source or dest mismatch.\n");
 /*
 		dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
 			ipinfo->smsk.s_addr, ipinfo->src.s_addr,
 			ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");
 		dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
 			ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
 			ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
 		return false;
 	}
 	ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
 	if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {
 		dprintf("VIA in mismatch (%s vs %s).%s\n",
 			indev, ip6info->iniface,
 			ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
 		return false;
 	}
 	ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
 	if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {
 		dprintf("VIA out mismatch (%s vs %s).%s\n",
 			outdev, ip6info->outiface,
 			ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
 		return false;
 	}
 /* ... might want to do something with class and flowlabel here ... */
 	/* look for the desired protocol header */
 	if((ip6info->flags & IP6T_F_PROTO)) {
 		int protohdr;
 		unsigned short _frag_off;
 		protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
 		if (protohdr < 0) {
 			if (_frag_off == 0)
 				*hotdrop = true;
 			return false;
 		}
 		*fragoff = _frag_off;
 		dprintf("Packet protocol %hi ?= %s%hi.\n",
 				protohdr,
 				ip6info->invflags & IP6T_INV_PROTO ? "!":"",
 				ip6info->proto);
 		if (ip6info->proto == protohdr) {
 			if(ip6info->invflags & IP6T_INV_PROTO) {
 				return false;
 			}
 			return true;
 		}
 		/* We need match for the '-p all', too! */
 		if ((ip6info->proto != 0) &&
 			!(ip6info->invflags & IP6T_INV_PROTO))
 			return false;
 	}
 	return true;
 }
 /* should be ip6 safe */
 static bool
 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 {
 	if (ipv6->flags & ~IP6T_F_MASK) {
 		duprintf("Unknown flag bits set: %08X\n",
 			 ipv6->flags & ~IP6T_F_MASK);
 		return false;
 	}
 	if (ipv6->invflags & ~IP6T_INV_MASK) {
 		duprintf("Unknown invflag bits set: %08X\n",
 			 ipv6->invflags & ~IP6T_INV_MASK);
 		return false;
 	}
 	return true;
 }
 static unsigned int
 ip6t_error(struct sk_buff *skb, const struct xt_target_param *par)
 {
 	if (net_ratelimit())
 		printk("ip6_tables: error: `%s'\n",
 		       (const char *)par->targinfo);
 	return NF_DROP;
 }
 /* Performance critical - called for every packet */
 static inline bool
 do_match(struct ip6t_entry_match *m, const struct sk_buff *skb,
 	 struct xt_match_param *par)
 {
 	par->match     = m->u.kernel.match;
 	par->matchinfo = m->data;
 	/* Stop iteration if it doesn't match */
 	if (!m->u.kernel.match->match(skb, par))
 		return true;
 	else
 		return false;
 }
 static inline struct ip6t_entry *
 get_entry(void *base, unsigned int offset)
 {
 	return (struct ip6t_entry *)(base + offset);
 }
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
 static inline bool unconditional(const struct ip6t_ip6 *ipv6)
 {
 	static const struct ip6t_ip6 uncond;
 	return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 }
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 /* This cries for unification! */
 static const char *const hooknames[] = {
 	[NF_INET_PRE_ROUTING]		= "PREROUTING",
 	[NF_INET_LOCAL_IN]		= "INPUT",
 	[NF_INET_FORWARD]		= "FORWARD",
 	[NF_INET_LOCAL_OUT]		= "OUTPUT",
 	[NF_INET_POST_ROUTING]		= "POSTROUTING",
 };
 enum nf_ip_trace_comments {
 	NF_IP6_TRACE_COMMENT_RULE,
 	NF_IP6_TRACE_COMMENT_RETURN,
 	NF_IP6_TRACE_COMMENT_POLICY,
 };
 static const char *const comments[] = {
 	[NF_IP6_TRACE_COMMENT_RULE]	= "rule",
 	[NF_IP6_TRACE_COMMENT_RETURN]	= "return",
 	[NF_IP6_TRACE_COMMENT_POLICY]	= "policy",
 };
 static struct nf_loginfo trace_loginfo = {
 	.type = NF_LOG_TYPE_LOG,
 	.u = {
 		.log = {
 			.level = 4,
 			.logflags = NF_LOG_MASK,
 		},
 	},
 };
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
 get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
 		      const char *hookname, const char **chainname,
 		      const char **comment, unsigned int *rulenum)
 {
 	struct ip6t_standard_target *t = (void *)ip6t_get_target(s);
 	if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
 		/* Head of user chain: ERROR target with chainname */
 		*chainname = t->target.data;
 		(*rulenum) = 0;
 	} else if (s == e) {
 		(*rulenum)++;
 		if (s->target_offset == sizeof(struct ip6t_entry) &&
 		    strcmp(t->target.u.kernel.target->name,
 			   IP6T_STANDARD_TARGET) == 0 &&
 		    t->verdict < 0 &&
 		    unconditional(&s->ipv6)) {
 			/* Tail of chains: STANDARD target (return/policy) */
 			*comment = *chainname == hookname
 				? comments[NF_IP6_TRACE_COMMENT_POLICY]
 				: comments[NF_IP6_TRACE_COMMENT_RETURN];
 		}
 		return 1;
 	} else
 		(*rulenum)++;
 	return 0;
 }
 static void trace_packet(struct sk_buff *skb,
 			 unsigned int hook,
 			 const struct net_device *in,
 			 const struct net_device *out,
 			 const char *tablename,
 			 struct xt_table_info *private,
 			 struct ip6t_entry *e)
 {
 	void *table_base;
 	const struct ip6t_entry *root;
 	const char *hookname, *chainname, *comment;
 	unsigned int rulenum = 0;
 	table_base = private->entries[smp_processor_id()];
 	root = get_entry(table_base, private->hook_entry[hook]);
 	hookname = chainname = hooknames[hook];
 	comment = comments[NF_IP6_TRACE_COMMENT_RULE];
 	IP6T_ENTRY_ITERATE(root,
 			   private->size - private->hook_entry[hook],
 			   get_chainname_rulenum,
 			   e, hookname, &chainname, &comment, &rulenum);
 	nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
 		      "TRACE: %s:%s:%s:%u ",
 		      tablename, chainname, comment, rulenum);
 }
 #endif
 static inline __pure struct ip6t_entry *
 ip6t_next_entry(const struct ip6t_entry *entry)
 {
 	return (void *)entry + entry->next_offset;
 }
 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 unsigned int
 ip6t_do_table(struct sk_buff *skb,
 	      unsigned int hook,
 	      const struct net_device *in,
 	      const struct net_device *out,
 	      struct xt_table *table)
 {
 #define tb_comefrom ((struct ip6t_entry *)table_base)->comefrom
 	static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
 	bool hotdrop = false;
 	/* Initializing verdict to NF_DROP keeps gcc happy. */
 	unsigned int verdict = NF_DROP;
 	const char *indev, *outdev;
 	void *table_base;
 	struct ip6t_entry *e, *back;
 	struct xt_table_info *private;
 	struct xt_match_param mtpar;
 	struct xt_target_param tgpar;
 	/* Initialization */
 	indev = in ? in->name : nulldevname;
 	outdev = out ? out->name : nulldevname;
 	/* We handle fragments by dealing with the first fragment as
 	 * if it was a normal packet.  All other fragments are treated
 	 * normally, except that they will NEVER match rules that ask
 	 * things we don't know, ie. tcp syn flag or ports).  If the
 	 * rule is also a fragment-specific rule, non-fragments won't
 	 * match it. */
 	mtpar.hotdrop = &hotdrop;
 	mtpar.in      = tgpar.in  = in;
 	mtpar.out     = tgpar.out = out;
 	mtpar.family  = tgpar.family = NFPROTO_IPV6;
 	mtpar.hooknum = tgpar.hooknum = hook;
 	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 	xt_info_rdlock_bh();
 	private = table->private;
 	table_base = private->entries[smp_processor_id()];
 	e = get_entry(table_base, private->hook_entry[hook]);
 	/* For return from builtin chain */
 	back = get_entry(table_base, private->underflow[hook]);
 	do {
 		struct ip6t_entry_target *t;
 		IP_NF_ASSERT(e);
 		IP_NF_ASSERT(back);
 		if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
 		    &mtpar.thoff, &mtpar.fragoff, &hotdrop) ||
 		    IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
 			e = ip6t_next_entry(e);
 			continue;
 		}
 		ADD_COUNTER(e->counters,
 			    ntohs(ipv6_hdr(skb)->payload_len) +
 			    sizeof(struct ipv6hdr), 1);
 		t = ip6t_get_target(e);
 		IP_NF_ASSERT(t->u.kernel.target);
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 		/* The packet is traced: log it */
 		if (unlikely(skb->nf_trace))
 			trace_packet(skb, hook, in, out,
 				     table->name, private, e);
 #endif
 		/* Standard target? */
 		if (!t->u.kernel.target->target) {
 			int v;
 			v = ((struct ip6t_standard_target *)t)->verdict;
 			if (v < 0) {
 				/* Pop from stack? */
 				if (v != IP6T_RETURN) {
 					verdict = (unsigned)(-v) - 1;
 					break;
 				}
 				e = back;
 				back = get_entry(table_base, back->comefrom);
 				continue;
 			}
 			if (table_base + v != ip6t_next_entry(e) &&
 			    !(e->ipv6.flags & IP6T_F_GOTO)) {
 				/* Save old back ptr in next entry */
 				struct ip6t_entry *next = ip6t_next_entry(e);
 				next->comefrom = (void *)back - table_base;
 				/* set back pointer to next entry */
 				back = next;
 			}
 			e = get_entry(table_base, v);
 			continue;
 		}
 		/* Targets which reenter must return
 		   abs. verdicts */
 		tgpar.target   = t->u.kernel.target;
 		tgpar.targinfo = t->data;
 #ifdef CONFIG_NETFILTER_DEBUG
 		tb_comefrom = 0xeeeeeeec;
 #endif
 		verdict = t->u.kernel.target->target(skb, &tgpar);
 #ifdef CONFIG_NETFILTER_DEBUG
 		if (tb_comefrom != 0xeeeeeeec && verdict == IP6T_CONTINUE) {
 			printk("Target %s reentered!\n",
 			       t->u.kernel.target->name);
 			verdict = NF_DROP;
 		}
 		tb_comefrom = 0x57acc001;
 #endif
 		if (verdict == IP6T_CONTINUE)
 			e = ip6t_next_entry(e);
 		else
 			/* Verdict */
 			break;
 	} while (!hotdrop);
 #ifdef CONFIG_NETFILTER_DEBUG
 	tb_comefrom = NETFILTER_LINK_POISON;
 #endif
 	xt_info_rdunlock_bh();
 #ifdef DEBUG_ALLOW_ALL
 	return NF_ACCEPT;
 #else
 	if (hotdrop)
 		return NF_DROP;
 	else return verdict;
 #endif
 #undef tb_comefrom
 }
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
 mark_source_chains(struct xt_table_info *newinfo,
 		   unsigned int valid_hooks, void *entry0)
 {
 	unsigned int hook;
 	/* No recursion; use packet counter to save back ptrs (reset
 	   to 0 as we leave), and comefrom to save source hook bitmask */
 	for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
 		unsigned int pos = newinfo->hook_entry[hook];
 		struct ip6t_entry *e = (struct ip6t_entry *)(entry0 + pos);
 		if (!(valid_hooks & (1 << hook)))
 			continue;
 		/* Set initial back pointer. */
 		e->counters.pcnt = pos;
 		for (;;) {
 			struct ip6t_standard_target *t
 				= (void *)ip6t_get_target(e);
 			int visited = e->comefrom & (1 << hook);
 			if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
 				printk("iptables: loop hook %u pos %u %08X.\n",
 				       hook, pos, e->comefrom);
 				return 0;
 			}
 			e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 			/* Unconditional return/END. */
 			if ((e->target_offset == sizeof(struct ip6t_entry) &&
 			     (strcmp(t->target.u.user.name,
 				     IP6T_STANDARD_TARGET) == 0) &&
 			     t->verdict < 0 &&
 			     unconditional(&e->ipv6)) || visited) {
 				unsigned int oldpos, size;
 				if ((strcmp(t->target.u.user.name,
 					    IP6T_STANDARD_TARGET) == 0) &&
 				    t->verdict < -NF_MAX_VERDICT - 1) {
 					duprintf("mark_source_chains: bad "
 						"negative verdict (%i)\n",
 								t->verdict);
 					return 0;
 				}
 				/* Return: backtrack through the last
 				   big jump. */
 				do {
 					e->comefrom ^= (1<<NF_INET_NUMHOOKS);
 #ifdef DEBUG_IP_FIREWALL_USER
 					if (e->comefrom
 					    & (1 << NF_INET_NUMHOOKS)) {
 						duprintf("Back unset "
 							 "on hook %u "
 							 "rule %u\n",
 							 hook, pos);
 					}
 #endif
 					oldpos = pos;
 					pos = e->counters.pcnt;
 					e->counters.pcnt = 0;
 					/* We're at the start. */
 					if (pos == oldpos)
 						goto next;
 					e = (struct ip6t_entry *)
 						(entry0 + pos);
 				} while (oldpos == pos + e->next_offset);
 				/* Move along one */
 				size = e->next_offset;
 				e = (struct ip6t_entry *)
 					(entry0 + pos + size);
 				e->counters.pcnt = pos;
 				pos += size;
 			} else {
 				int newpos = t->verdict;
 				if (strcmp(t->target.u.user.name,
 					   IP6T_STANDARD_TARGET) == 0 &&
 				    newpos >= 0) {
 					if (newpos > newinfo->size -
 						sizeof(struct ip6t_entry)) {
 						duprintf("mark_source_chains: "
 							"bad verdict (%i)\n",
 								newpos);
 						return 0;
 					}
 					/* This a jump; chase it. */
 					duprintf("Jump rule %u -> %u\n",
 						 pos, newpos);
 				} else {
 					/* ... this is a fallthru */
 					newpos = pos + e->next_offset;
 				}
 				e = (struct ip6t_entry *)
 					(entry0 + newpos);
 				e->counters.pcnt = pos;
 				pos = newpos;
 			}
 		}
 		next:
 		duprintf("Finished chain %u\n", hook);
 	}
 	return 1;
 }
 static int
 cleanup_match(struct ip6t_entry_match *m, struct net *net, unsigned int *i)
 {
 	struct xt_mtdtor_param par;
 	if (i && (*i)-- == 0)
 		return 1;
 	par.net       = net;
 	par.match     = m->u.kernel.match;
 	par.matchinfo = m->data;
 	par.family    = NFPROTO_IPV6;
 	if (par.match->destroy != NULL)
 		par.match->destroy(&par);
 	module_put(par.match->me);
 	return 0;
 }
 static int
 check_entry(struct ip6t_entry *e, const char *name)
 {
 	struct ip6t_entry_target *t;
 	if (!ip6_checkentry(&e->ipv6)) {
 		duprintf("ip_tables: ip check failed %p %s.\n", e, name);
 		return -EINVAL;
 	}
 	if (e->target_offset + sizeof(struct ip6t_entry_target) >
 	    e->next_offset)
 		return -EINVAL;
 	t = ip6t_get_target(e);
 	if (e->target_offset + t->u.target_size > e->next_offset)
 		return -EINVAL;
 	return 0;
 }
 static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
 		       unsigned int *i)
 {
 	const struct ip6t_ip6 *ipv6 = par->entryinfo;
 	int ret;
 	par->match     = m->u.kernel.match;
 	par->matchinfo = m->data;
 	ret = xt_check_match(par, m->u.match_size - sizeof(*m),
 			     ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
 	if (ret < 0) {
 		duprintf("ip_tables: check failed for `%s'.\n",
 			 par.match->name);
 		return ret;
 	}
 	++*i;
 	return 0;
 }
 static int
 find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
 		 unsigned int *i)
 {
 	struct xt_match *match;
 	int ret;
 	match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
 						      m->u.user.revision),
 					"ip6t_%s", m->u.user.name);
 	if (IS_ERR(match) || !match) {
 		duprintf("find_check_match: `%s' not found\n", m->u.user.name);
 		return match ? PTR_ERR(match) : -ENOENT;
 	}
 	m->u.kernel.match = match;
 	ret = check_match(m, par, i);
 	if (ret)
 		goto err;
 	return 0;
 err:
 	module_put(m->u.kernel.match->me);
 	return ret;
 }
 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 {
 	struct ip6t_entry_target *t = ip6t_get_target(e);
 	struct xt_tgchk_param par = {
 		.net       = net,
 		.table     = name,
 		.entryinfo = e,
 		.target    = t->u.kernel.target,
 		.targinfo  = t->data,
 		.hook_mask = e->comefrom,
 		.family    = NFPROTO_IPV6,
 	};
 	int ret;
 	t = ip6t_get_target(e);
 	ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
 	      e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
 	if (ret < 0) {
 		duprintf("ip_tables: check failed for `%s'.\n",
 			 t->u.kernel.target->name);
 		return ret;
 	}
 	return 0;
 }
 static int
 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 		 unsigned int size, unsigned int *i)
 {
 	struct ip6t_entry_target *t;
 	struct xt_target *target;
 	int ret;
 	unsigned int j;
 	struct xt_mtchk_param mtpar;
 	ret = check_entry(e, name);
 	if (ret)
 		return ret;
 	j = 0;
 	mtpar.net	= net;
 	mtpar.table     = name;
 	mtpar.entryinfo = &e->ipv6;
 	mtpar.hook_mask = e->comefrom;
 	mtpar.family    = NFPROTO_IPV6;
 	ret = IP6T_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
 	if (ret != 0)
 		goto cleanup_matches;
 	t = ip6t_get_target(e);
 	target = try_then_request_module(xt_find_target(AF_INET6,
 							t->u.user.name,
 							t->u.user.revision),
 					 "ip6t_%s", t->u.user.name);
 	if (IS_ERR(target) || !target) {
 		duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
 		ret = target ? PTR_ERR(target) : -ENOENT;
 		goto cleanup_matches;
 	}
 	t->u.kernel.target = target;
 	ret = check_target(e, net, name);
 	if (ret)
 		goto err;
 	(*i)++;
 	return 0;
  err:
 	module_put(t->u.kernel.target->me);
  cleanup_matches:
 	IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
 	return ret;
 }
 static bool check_underflow(struct ip6t_entry *e)
 {
 	const struct ip6t_entry_target *t;
 	unsigned int verdict;
 	if (!unconditional(&e->ipv6))
 		return false;
 	t = ip6t_get_target(e);
 	if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
 		return false;
 	verdict = ((struct ip6t_standard_target *)t)->verdict;
 	verdict = -verdict - 1;
 	return verdict == NF_DROP || verdict == NF_ACCEPT;
 }
 static int
 check_entry_size_and_hooks(struct ip6t_entry *e,
 			   struct xt_table_info *newinfo,
 			   unsigned char *base,
 			   unsigned char *limit,
 			   const unsigned int *hook_entries,
 			   const unsigned int *underflows,
 			   unsigned int valid_hooks,
 			   unsigned int *i)
 {
 	unsigned int h;
 	if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
 	    (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
 		duprintf("Bad offset %p\n", e);
 		return -EINVAL;
 	}
 	if (e->next_offset
 	    < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
 		duprintf("checking: element %p size %u\n",
 			 e, e->next_offset);
 		return -EINVAL;
 	}
 	/* Check hooks & underflows */
 	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 		if (!(valid_hooks & (1 << h)))
 			continue;
 		if ((unsigned char *)e - base == hook_entries[h])
 			newinfo->hook_entry[h] = hook_entries[h];
 		if ((unsigned char *)e - base == underflows[h]) {
 			if (!check_underflow(e)) {
 				pr_err("Underflows must be unconditional and "
 				       "use the STANDARD target with "
 				       "ACCEPT/DROP\n");
 				return -EINVAL;
 			}
 			newinfo->underflow[h] = underflows[h];
 		}
 	}
 	/* Clear counters and comefrom */
 	e->counters = ((struct xt_counters) { 0, 0 });
 	e->comefrom = 0;
 	(*i)++;
 	return 0;
 }
 static int
 cleanup_entry(struct ip6t_entry *e, struct net *net, unsigned int *i)
 {
 	struct xt_tgdtor_param par;
 	struct ip6t_entry_target *t;
 	if (i && (*i)-- == 0)
 		return 1;
 	/* Cleanup all matches */
 	IP6T_MATCH_ITERATE(e, cleanup_match, net, NULL);
 	t = ip6t_get_target(e);
 	par.net      = net;
 	par.target   = t->u.kernel.target;
 	par.targinfo = t->data;
 	par.family   = NFPROTO_IPV6;
 	if (par.target->destroy != NULL)
 		par.target->destroy(&par);
 	module_put(par.target->me);
 	return 0;
 }
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
 translate_table(struct net *net,
 		const char *name,
 		unsigned int valid_hooks,
 		struct xt_table_info *newinfo,
 		void *entry0,
 		unsigned int size,
 		unsigned int number,
 		const unsigned int *hook_entries,
 		const unsigned int *underflows)
 {
 	unsigned int i;
 	int ret;
 	newinfo->size = size;
 	newinfo->number = number;
 	/* Init all hooks to impossible value. */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = 0xFFFFFFFF;
 		newinfo->underflow[i] = 0xFFFFFFFF;
 	}
 	duprintf("translate_table: size %u\n", newinfo->size);
 	i = 0;
 	/* Walk through entries, checking offsets. */
 	ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 				check_entry_size_and_hooks,
 				newinfo,
 				entry0,
 				entry0 + size,
 				hook_entries, underflows, valid_hooks, &i);
 	if (ret != 0)
 		return ret;
 	if (i != number) {
 		duprintf("translate_table: %u not %u entries\n",
 			 i, number);
 		return -EINVAL;
 	}
 	/* Check hooks all assigned */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		/* Only hooks which are valid */
 		if (!(valid_hooks & (1 << i)))
 			continue;
 		if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
 			duprintf("Invalid hook entry %u %u\n",
 				 i, hook_entries[i]);
 			return -EINVAL;
 		}
 		if (newinfo->underflow[i] == 0xFFFFFFFF) {
 			duprintf("Invalid underflow %u %u\n",
 				 i, underflows[i]);
 			return -EINVAL;
 		}
 	}
 	if (!mark_source_chains(newinfo, valid_hooks, entry0))
 		return -ELOOP;
 	/* Finally, each sanity check must pass */
 	i = 0;
 	ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 				find_check_entry, net, name, size, &i);
 	if (ret != 0) {
 		IP6T_ENTRY_ITERATE(entry0, newinfo->size,
 				   cleanup_entry, net, &i);
 		return ret;
 	}
 	/* And one copy for every other CPU */
 	for_each_possible_cpu(i) {
 		if (newinfo->entries[i] && newinfo->entries[i] != entry0)
 			memcpy(newinfo->entries[i], entry0, newinfo->size);
 	}
 	return ret;
 }
 /* Gets counters. */
 static inline int
 add_entry_to_counter(const struct ip6t_entry *e,
 		     struct xt_counters total[],
 		     unsigned int *i)
 {
 	ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 	(*i)++;
 	return 0;
 }
 static inline int
 set_entry_to_counter(const struct ip6t_entry *e,
 		     struct ip6t_counters total[],
 		     unsigned int *i)
 {
 	SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
 	(*i)++;
 	return 0;
 }
 static void
 get_counters(const struct xt_table_info *t,
 	     struct xt_counters counters[])
 {
 	unsigned int cpu;
 	unsigned int i;
 	unsigned int curcpu;
 	/* Instead of clearing (by a previous call to memset())
 	 * the counters and using adds, we set the counters
 	 * with data used by 'current' CPU
 	 *
 	 * Bottom half has to be disabled to prevent deadlock
 	 * if new softirq were to run and call ipt_do_table
 	 */
 	local_bh_disable();
 	curcpu = smp_processor_id();
 	i = 0;
 	IP6T_ENTRY_ITERATE(t->entries[curcpu],
 			   t->size,
 			   set_entry_to_counter,
 			   counters,
 			   &i);
 	for_each_possible_cpu(cpu) {
 		if (cpu == curcpu)
 			continue;
 		i = 0;
 		xt_info_wrlock(cpu);
 		IP6T_ENTRY_ITERATE(t->entries[cpu],
 				  t->size,
 				  add_entry_to_counter,
 				  counters,
 				  &i);
 		xt_info_wrunlock(cpu);
 	}
 	local_bh_enable();
 }
 static struct xt_counters *alloc_counters(struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
 	struct xt_table_info *private = table->private;
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
 	   about). */
 	countersize = sizeof(struct xt_counters) * private->number;
 	counters = vmalloc_node(countersize, numa_node_id());
 	if (counters == NULL)
 		return ERR_PTR(-ENOMEM);
 	get_counters(private, counters);
 	return counters;
 }
 static int
 copy_entries_to_user(unsigned int total_size,
 		     struct xt_table *table,
 		     void __user *userptr)
 {
 	unsigned int off, num;
 	struct ip6t_entry *e;
 	struct xt_counters *counters;
 	const struct xt_table_info *private = table->private;
 	int ret = 0;
 	const void *loc_cpu_entry;
 	counters = alloc_counters(table);
 	if (IS_ERR(counters))
 		return PTR_ERR(counters);
 	/* choose the copy that is on our node/cpu, ...
 	 * This choice is lazy (because current thread is
 	 * allowed to migrate to another cpu)
 	 */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	if (copy_to_user(userptr, loc_cpu_entry, total_size) != 0) {
 		ret = -EFAULT;
 		goto free_counters;
 	}
 	/* FIXME: use iterator macros --RR */
 	/* ... then go back and fix counters and names */
 	for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
 		unsigned int i;
 		const struct ip6t_entry_match *m;
 		const struct ip6t_entry_target *t;
 		e = (struct ip6t_entry *)(loc_cpu_entry + off);
 		if (copy_to_user(userptr + off
 				 + offsetof(struct ip6t_entry, counters),
 				 &counters[num],
 				 sizeof(counters[num])) != 0) {
 			ret = -EFAULT;
 			goto free_counters;
 		}
 		for (i = sizeof(struct ip6t_entry);
 		     i < e->target_offset;
 		     i += m->u.match_size) {
 			m = (void *)e + i;
 			if (copy_to_user(userptr + off + i
 					 + offsetof(struct ip6t_entry_match,
 						    u.user.name),
 					 m->u.kernel.match->name,
 					 strlen(m->u.kernel.match->name)+1)
 			    != 0) {
 				ret = -EFAULT;
 				goto free_counters;
 			}
 		}
 		t = ip6t_get_target(e);
 		if (copy_to_user(userptr + off + e->target_offset
 				 + offsetof(struct ip6t_entry_target,
 					    u.user.name),
 				 t->u.kernel.target->name,
 				 strlen(t->u.kernel.target->name)+1) != 0) {
 			ret = -EFAULT;
 			goto free_counters;
 		}
 	}
  free_counters:
 	vfree(counters);
 	return ret;
 }
 #ifdef CONFIG_COMPAT
 static void compat_standard_from_user(void *dst, void *src)
 {
 	int v = *(compat_int_t *)src;
 	if (v > 0)
 		v += xt_compat_calc_jump(AF_INET6, v);
 	memcpy(dst, &v, sizeof(v));
 }
 static int compat_standard_to_user(void __user *dst, void *src)
 {
 	compat_int_t cv = *(int *)src;
 	if (cv > 0)
 		cv -= xt_compat_calc_jump(AF_INET6, cv);
 	return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 static inline int
 compat_calc_match(struct ip6t_entry_match *m, int *size)
 {
 	*size += xt_compat_match_offset(m->u.kernel.match);
 	return 0;
 }
 static int compat_calc_entry(struct ip6t_entry *e,
 			     const struct xt_table_info *info,
 			     void *base, struct xt_table_info *newinfo)
 {
 	struct ip6t_entry_target *t;
 	unsigned int entry_offset;
 	int off, i, ret;
 	off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
 	entry_offset = (void *)e - base;
 	IP6T_MATCH_ITERATE(e, compat_calc_match, &off);
 	t = ip6t_get_target(e);
 	off += xt_compat_target_offset(t->u.kernel.target);
 	newinfo->size -= off;
 	ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
 	if (ret)
 		return ret;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		if (info->hook_entry[i] &&
 		    (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
 			newinfo->hook_entry[i] -= off;
 		if (info->underflow[i] &&
 		    (e < (struct ip6t_entry *)(base + info->underflow[i])))
 			newinfo->underflow[i] -= off;
 	}
 	return 0;
 }
 static int compat_table_info(const struct xt_table_info *info,
 			     struct xt_table_info *newinfo)
 {
 	void *loc_cpu_entry;
 	if (!newinfo || !info)
 		return -EINVAL;
 	/* we dont care about newinfo->entries[] */
 	memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
 	newinfo->initial_entries = 0;
 	loc_cpu_entry = info->entries[raw_smp_processor_id()];
 	return IP6T_ENTRY_ITERATE(loc_cpu_entry, info->size,
 				  compat_calc_entry, info, loc_cpu_entry,
 				  newinfo);
 }
 #endif
 static int get_info(struct net *net, void __user *user, int *len, int compat)
 {
 	char name[IP6T_TABLE_MAXNAMELEN];
 	struct xt_table *t;
 	int ret;
 	if (*len != sizeof(struct ip6t_getinfo)) {
 		duprintf("length %u != %zu\n", *len,
 			 sizeof(struct ip6t_getinfo));
 		return -EINVAL;
 	}
 	if (copy_from_user(name, user, sizeof(name)) != 0)
 		return -EFAULT;
 	name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
 #ifdef CONFIG_COMPAT
 	if (compat)
 		xt_compat_lock(AF_INET6);
 #endif
 	t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
 				    "ip6table_%s", name);
 	if (t && !IS_ERR(t)) {
 		struct ip6t_getinfo info;
 		const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 		if (compat) {
 			ret = compat_table_info(private, &tmp);
 			xt_compat_flush_offsets(AF_INET6);
 			private = &tmp;
 		}
 #endif
 		info.valid_hooks = t->valid_hooks;
 		memcpy(info.hook_entry, private->hook_entry,
 		       sizeof(info.hook_entry));
 		memcpy(info.underflow, private->underflow,
 		       sizeof(info.underflow));
 		info.num_entries = private->number;
 		info.size = private->size;
 		strcpy(info.name, name);
 		if (copy_to_user(user, &info, *len) != 0)
 			ret = -EFAULT;
 		else
 			ret = 0;
 		xt_table_unlock(t);
 		module_put(t->me);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 #ifdef CONFIG_COMPAT
 	if (compat)
 		xt_compat_unlock(AF_INET6);
 #endif
 	return ret;
 }
 static int
 get_entries(struct net *net, struct ip6t_get_entries __user *uptr, int *len)
 {
 	int ret;
 	struct ip6t_get_entries get;
 	struct xt_table *t;
 	if (*len < sizeof(get)) {
 		duprintf("get_entries: %u < %zu\n", *len, sizeof(get));
 		return -EINVAL;
 	}
 	if (copy_from_user(&get, uptr, sizeof(get)) != 0)
 		return -EFAULT;
 	if (*len != sizeof(struct ip6t_get_entries) + get.size) {
 		duprintf("get_entries: %u != %zu\n",
 			 *len, sizeof(get) + get.size);
 		return -EINVAL;
 	}
 	t = xt_find_table_lock(net, AF_INET6, get.name);
 	if (t && !IS_ERR(t)) {
 		struct xt_table_info *private = t->private;
 		duprintf("t->private->number = %u\n", private->number);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
 		else {
 			duprintf("get_entries: I've got %u not %u!\n",
 				 private->size, get.size);
 			ret = -EAGAIN;
 		}
 		module_put(t->me);
 		xt_table_unlock(t);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 	return ret;
 }
 static int
 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 	     struct xt_table_info *newinfo, unsigned int num_counters,
 	     void __user *counters_ptr)
 {
 	int ret;
 	struct xt_table *t;
 	struct xt_table_info *oldinfo;
 	struct xt_counters *counters;
 	const void *loc_cpu_old_entry;
 	ret = 0;
 	counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
 				numa_node_id());
 	if (!counters) {
 		ret = -ENOMEM;
 		goto out;
 	}
 	t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
 				    "ip6table_%s", name);
 	if (!t || IS_ERR(t)) {
 		ret = t ? PTR_ERR(t) : -ENOENT;
 		goto free_newinfo_counters_untrans;
 	}
 	/* You lied! */
 	if (valid_hooks != t->valid_hooks) {
 		duprintf("Valid hook crap: %08X vs %08X\n",
 			 valid_hooks, t->valid_hooks);
 		ret = -EINVAL;
 		goto put_module;
 	}
 	oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
 	if (!oldinfo)
 		goto put_module;
 	/* Update module usage count based on number of rules */
 	duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
 		oldinfo->number, oldinfo->initial_entries, newinfo->number);
 	if ((oldinfo->number > oldinfo->initial_entries) ||
 	    (newinfo->number <= oldinfo->initial_entries))
 		module_put(t->me);
 	if ((oldinfo->number > oldinfo->initial_entries) &&
 	    (newinfo->number <= oldinfo->initial_entries))
 		module_put(t->me);
 	/* Get the old counters, and synchronize with replace */
 	get_counters(oldinfo, counters);
 	/* Decrease module usage counts and free resource */
 	loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
 	IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
 			   net, NULL);
 	xt_free_table_info(oldinfo);
 	if (copy_to_user(counters_ptr, counters,
 			 sizeof(struct xt_counters) * num_counters) != 0)
 		ret = -EFAULT;
 	vfree(counters);
 	xt_table_unlock(t);
 	return ret;
  put_module:
 	module_put(t->me);
 	xt_table_unlock(t);
  free_newinfo_counters_untrans:
 	vfree(counters);
  out:
 	return ret;
 }
 static int
 do_replace(struct net *net, void __user *user, unsigned int len)
 {
 	int ret;
 	struct ip6t_replace tmp;
 	struct xt_table_info *newinfo;
 	void *loc_cpu_entry;
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
 	/* overflow check */
 	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
 		return -ENOMEM;
 	newinfo = xt_alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 	/* choose the copy that is on our node/cpu */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
 	}
 	ret = translate_table(net, tmp.name, tmp.valid_hooks,
 			      newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
 			      tmp.hook_entry, tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo;
 	duprintf("ip_tables: Translated table\n");
 	ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
 			   tmp.num_counters, tmp.counters);
 	if (ret)
 		goto free_newinfo_untrans;
 	return 0;
  free_newinfo_untrans:
 	IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, net, NULL);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
 }
 /* We're lazy, and add to the first CPU; overflow works its fey magic
  * and everything is OK. */
 static int
 add_counter_to_entry(struct ip6t_entry *e,
 		     const struct xt_counters addme[],
 		     unsigned int *i)
 {
 	ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
 	(*i)++;
 	return 0;
 }
 static int
 do_add_counters(struct net *net, void __user *user, unsigned int len,
 		int compat)
 {
 	unsigned int i, curcpu;
 	struct xt_counters_info tmp;
 	struct xt_counters *paddc;
 	unsigned int num_counters;
 	char *name;
 	int size;
 	void *ptmp;
 	struct xt_table *t;
 	const struct xt_table_info *private;
 	int ret = 0;
 	const void *loc_cpu_entry;
 #ifdef CONFIG_COMPAT
 	struct compat_xt_counters_info compat_tmp;
 	if (compat) {
 		ptmp = &compat_tmp;
 		size = sizeof(struct compat_xt_counters_info);
 	} else
 #endif
 	{
 		ptmp = &tmp;
 		size = sizeof(struct xt_counters_info);
 	}
 	if (copy_from_user(ptmp, user, size) != 0)
 		return -EFAULT;
 #ifdef CONFIG_COMPAT
 	if (compat) {
 		num_counters = compat_tmp.num_counters;
 		name = compat_tmp.name;
 	} else
 #endif
 	{
 		num_counters = tmp.num_counters;
 		name = tmp.name;
 	}
 	if (len != size + num_counters * sizeof(struct xt_counters))
 		return -EINVAL;
 	paddc = vmalloc_node(len - size, numa_node_id());
 	if (!paddc)
 		return -ENOMEM;
 	if (copy_from_user(paddc, user + size, len - size) != 0) {
 		ret = -EFAULT;
 		goto free;
 	}
 	t = xt_find_table_lock(net, AF_INET6, name);
 	if (!t || IS_ERR(t)) {
 		ret = t ? PTR_ERR(t) : -ENOENT;
 		goto free;
 	}
 	local_bh_disable();
 	private = t->private;
 	if (private->number != num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
 	}
 	i = 0;
 	/* Choose the copy that is on our node */
 	curcpu = smp_processor_id();
 	xt_info_wrlock(curcpu);
 	loc_cpu_entry = private->entries[curcpu];
 	IP6T_ENTRY_ITERATE(loc_cpu_entry,
 			  private->size,
 			  add_counter_to_entry,
 			  paddc,
 			  &i);
 	xt_info_wrunlock(curcpu);
  unlock_up_free:
 	local_bh_enable();
 	xt_table_unlock(t);
 	module_put(t->me);
  free:
 	vfree(paddc);
 	return ret;
 }
 #ifdef CONFIG_COMPAT
 struct compat_ip6t_replace {
 	char			name[IP6T_TABLE_MAXNAMELEN];
 	u32			valid_hooks;
 	u32			num_entries;
 	u32			size;
 	u32			hook_entry[NF_INET_NUMHOOKS];
 	u32			underflow[NF_INET_NUMHOOKS];
 	u32			num_counters;
 	compat_uptr_t		counters;	/* struct ip6t_counters * */
 	struct compat_ip6t_entry entries[0];
 };
 static int
 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
 			  unsigned int *size, struct xt_counters *counters,
 			  unsigned int *i)
 {
 	struct ip6t_entry_target *t;
 	struct compat_ip6t_entry __user *ce;
 	u_int16_t target_offset, next_offset;
 	compat_uint_t origsize;
 	int ret;
 	ret = -EFAULT;
 	origsize = *size;
 	ce = (struct compat_ip6t_entry __user *)*dstptr;
 	if (copy_to_user(ce, e, sizeof(struct ip6t_entry)))
 		goto out;
 	if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
 		goto out;
 	*dstptr += sizeof(struct compat_ip6t_entry);
 	*size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
 	ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
 	target_offset = e->target_offset - (origsize - *size);
 	if (ret)
 		goto out;
 	t = ip6t_get_target(e);
 	ret = xt_compat_target_to_user(t, dstptr, size);
 	if (ret)
 		goto out;
 	ret = -EFAULT;
 	next_offset = e->next_offset - (origsize - *size);
 	if (put_user(target_offset, &ce->target_offset))
 		goto out;
 	if (put_user(next_offset, &ce->next_offset))
 		goto out;
 	(*i)++;
 	return 0;
 out:
 	return ret;
 }
 static int
 compat_find_calc_match(struct ip6t_entry_match *m,
 		       const char *name,
 		       const struct ip6t_ip6 *ipv6,
 		       unsigned int hookmask,
 		       int *size, unsigned int *i)
 {
 	struct xt_match *match;
 	match = try_then_request_module(xt_find_match(AF_INET6, m->u.user.name,
 						      m->u.user.revision),
 					"ip6t_%s", m->u.user.name);
 	if (IS_ERR(match) || !match) {
 		duprintf("compat_check_calc_match: `%s' not found\n",
 			 m->u.user.name);
 		return match ? PTR_ERR(match) : -ENOENT;
 	}
 	m->u.kernel.match = match;
 	*size += xt_compat_match_offset(match);
 	(*i)++;
 	return 0;
 }
 static int
 compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
 {
 	if (i && (*i)-- == 0)
 		return 1;
 	module_put(m->u.kernel.match->me);
 	return 0;
 }
 static int
 compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
 {
 	struct ip6t_entry_target *t;
 	if (i && (*i)-- == 0)
 		return 1;
 	/* Cleanup all matches */
 	COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
 	t = compat_ip6t_get_target(e);
 	module_put(t->u.kernel.target->me);
 	return 0;
 }
 static int
 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
 				  struct xt_table_info *newinfo,
 				  unsigned int *size,
 				  unsigned char *base,
 				  unsigned char *limit,
 				  unsigned int *hook_entries,
 				  unsigned int *underflows,
 				  unsigned int *i,
 				  const char *name)
 {
 	struct ip6t_entry_target *t;
 	struct xt_target *target;
 	unsigned int entry_offset;
 	unsigned int j;
 	int ret, off, h;
 	duprintf("check_compat_entry_size_and_hooks %p\n", e);
 	if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
 	    (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
 		duprintf("Bad offset %p, limit = %p\n", e, limit);
 		return -EINVAL;
 	}
 	if (e->next_offset < sizeof(struct compat_ip6t_entry) +
 			     sizeof(struct compat_xt_entry_target)) {
 		duprintf("checking: element %p size %u\n",
 			 e, e->next_offset);
 		return -EINVAL;
 	}
 	/* For purposes of check_entry casting the compat entry is fine */
 	ret = check_entry((struct ip6t_entry *)e, name);
 	if (ret)
 		return ret;
 	off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
 	entry_offset = (void *)e - (void *)base;
 	j = 0;
 	ret = COMPAT_IP6T_MATCH_ITERATE(e, compat_find_calc_match, name,
 					&e->ipv6, e->comefrom, &off, &j);
 	if (ret != 0)
 		goto release_matches;
 	t = compat_ip6t_get_target(e);
 	target = try_then_request_module(xt_find_target(AF_INET6,
 							t->u.user.name,
 							t->u.user.revision),
 					 "ip6t_%s", t->u.user.name);
 	if (IS_ERR(target) || !target) {
 		duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
 			 t->u.user.name);
 		ret = target ? PTR_ERR(target) : -ENOENT;
 		goto release_matches;
 	}
 	t->u.kernel.target = target;
 	off += xt_compat_target_offset(target);
 	*size += off;
 	ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
 	if (ret)
 		goto out;
 	/* Check hooks & underflows */
 	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 		if ((unsigned char *)e - base == hook_entries[h])
 			newinfo->hook_entry[h] = hook_entries[h];
 		if ((unsigned char *)e - base == underflows[h])
 			newinfo->underflow[h] = underflows[h];
 	}
 	/* Clear counters and comefrom */
 	memset(&e->counters, 0, sizeof(e->counters));
 	e->comefrom = 0;
 	(*i)++;
 	return 0;
 out:
 	module_put(t->u.kernel.target->me);
 release_matches:
 	IP6T_MATCH_ITERATE(e, compat_release_match, &j);
 	return ret;
 }
 static int
 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
 			    unsigned int *size, const char *name,
 			    struct xt_table_info *newinfo, unsigned char *base)
 {
 	struct ip6t_entry_target *t;
 	struct xt_target *target;
 	struct ip6t_entry *de;
 	unsigned int origsize;
 	int ret, h;
 	ret = 0;
 	origsize = *size;
 	de = (struct ip6t_entry *)*dstptr;
 	memcpy(de, e, sizeof(struct ip6t_entry));
 	memcpy(&de->counters, &e->counters, sizeof(e->counters));
 	*dstptr += sizeof(struct ip6t_entry);
 	*size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
 	ret = COMPAT_IP6T_MATCH_ITERATE(e, xt_compat_match_from_user,
 					dstptr, size);
 	if (ret)
 		return ret;
 	de->target_offset = e->target_offset - (origsize - *size);
 	t = compat_ip6t_get_target(e);
 	target = t->u.kernel.target;
 	xt_compat_target_from_user(t, dstptr, size);
 	de->next_offset = e->next_offset - (origsize - *size);
 	for (h = 0; h < NF_INET_NUMHOOKS; h++) {
 		if ((unsigned char *)de - base < newinfo->hook_entry[h])
 			newinfo->hook_entry[h] -= origsize - *size;
 		if ((unsigned char *)de - base < newinfo->underflow[h])
 			newinfo->underflow[h] -= origsize - *size;
 	}
 	return ret;
 }
 static int compat_check_entry(struct ip6t_entry *e, struct net *net,
 			      const char *name, unsigned int *i)
 {
 	unsigned int j;
 	int ret;
 	struct xt_mtchk_param mtpar;
 	j = 0;
 	mtpar.net	= net;
 	mtpar.table     = name;
 	mtpar.entryinfo = &e->ipv6;
 	mtpar.hook_mask = e->comefrom;
 	mtpar.family    = NFPROTO_IPV6;
 	ret = IP6T_MATCH_ITERATE(e, check_match, &mtpar, &j);
 	if (ret)
 		goto cleanup_matches;
 	ret = check_target(e, net, name);
 	if (ret)
 		goto cleanup_matches;
 	(*i)++;
 	return 0;
  cleanup_matches:
 	IP6T_MATCH_ITERATE(e, cleanup_match, net, &j);
 	return ret;
 }
 static int
 translate_compat_table(struct net *net,
 		       const char *name,
 		       unsigned int valid_hooks,
 		       struct xt_table_info **pinfo,
 		       void **pentry0,
 		       unsigned int total_size,
 		       unsigned int number,
 		       unsigned int *hook_entries,
 		       unsigned int *underflows)
 {
 	unsigned int i, j;
 	struct xt_table_info *newinfo, *info;
 	void *pos, *entry0, *entry1;
 	unsigned int size;
 	int ret;
 	info = *pinfo;
 	entry0 = *pentry0;
 	size = total_size;
 	info->number = number;
 	/* Init all hooks to impossible value. */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		info->hook_entry[i] = 0xFFFFFFFF;
 		info->underflow[i] = 0xFFFFFFFF;
 	}
 	duprintf("translate_compat_table: size %u\n", info->size);
 	j = 0;
 	xt_compat_lock(AF_INET6);
 	/* Walk through entries, checking offsets. */
 	ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
 					check_compat_entry_size_and_hooks,
 					info, &size, entry0,
 					entry0 + total_size,
 					hook_entries, underflows, &j, name);
 	if (ret != 0)
 		goto out_unlock;
 	ret = -EINVAL;
 	if (j != number) {
 		duprintf("translate_compat_table: %u not %u entries\n",
 			 j, number);
 		goto out_unlock;
 	}
 	/* Check hooks all assigned */
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		/* Only hooks which are valid */
 		if (!(valid_hooks & (1 << i)))
 			continue;
 		if (info->hook_entry[i] == 0xFFFFFFFF) {
 			duprintf("Invalid hook entry %u %u\n",
 				 i, hook_entries[i]);
 			goto out_unlock;
 		}
 		if (info->underflow[i] == 0xFFFFFFFF) {
 			duprintf("Invalid underflow %u %u\n",
 				 i, underflows[i]);
 			goto out_unlock;
 		}
 	}
 	ret = -ENOMEM;
 	newinfo = xt_alloc_table_info(size);
 	if (!newinfo)
 		goto out_unlock;
 	newinfo->number = number;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = info->hook_entry[i];
 		newinfo->underflow[i] = info->underflow[i];
 	}
 	entry1 = newinfo->entries[raw_smp_processor_id()];
 	pos = entry1;
 	size = total_size;
 	ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
 					compat_copy_entry_from_user,
 					&pos, &size, name, newinfo, entry1);
 	xt_compat_flush_offsets(AF_INET6);
 	xt_compat_unlock(AF_INET6);
 	if (ret)
 		goto free_newinfo;
 	ret = -ELOOP;
 	if (!mark_source_chains(newinfo, valid_hooks, entry1))
 		goto free_newinfo;
 	i = 0;
 	ret = IP6T_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
 				 net, name, &i);
 	if (ret) {
 		j -= i;
 		COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
 						   compat_release_entry, &j);
 		IP6T_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, net, &i);
 		xt_free_table_info(newinfo);
 		return ret;
 	}
 	/* And one copy for every other CPU */
 	for_each_possible_cpu(i)
 		if (newinfo->entries[i] && newinfo->entries[i] != entry1)
 			memcpy(newinfo->entries[i], entry1, newinfo->size);
 	*pinfo = newinfo;
 	*pentry0 = entry1;
 	xt_free_table_info(info);
 	return 0;
 free_newinfo:
 	xt_free_table_info(newinfo);
 out:
 	COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
 	return ret;
 out_unlock:
 	xt_compat_flush_offsets(AF_INET6);
 	xt_compat_unlock(AF_INET6);
 	goto out;
 }
 static int
 compat_do_replace(struct net *net, void __user *user, unsigned int len)
 {
 	int ret;
 	struct compat_ip6t_replace tmp;
 	struct xt_table_info *newinfo;
 	void *loc_cpu_entry;
 	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 		return -EFAULT;
 	/* overflow check */
 	if (tmp.size >= INT_MAX / num_possible_cpus())
 		return -ENOMEM;
 	if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
 		return -ENOMEM;
 	newinfo = xt_alloc_table_info(tmp.size);
 	if (!newinfo)
 		return -ENOMEM;
 	/* choose the copy that is on our node/cpu */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
 			   tmp.size) != 0) {
 		ret = -EFAULT;
 		goto free_newinfo;
 	}
 	ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
 				     &newinfo, &loc_cpu_entry, tmp.size,
 				     tmp.num_entries, tmp.hook_entry,
 				     tmp.underflow);
 	if (ret != 0)
 		goto free_newinfo;
 	duprintf("compat_do_replace: Translated table\n");
 	ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
 			   tmp.num_counters, compat_ptr(tmp.counters));
 	if (ret)
 		goto free_newinfo_untrans;
 	return 0;
  free_newinfo_untrans:
 	IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, net, NULL);
  free_newinfo:
 	xt_free_table_info(newinfo);
 	return ret;
 }
 static int
 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
 		       unsigned int len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IP6T_SO_SET_REPLACE:
 		ret = compat_do_replace(sock_net(sk), user, len);
 		break;
 	case IP6T_SO_SET_ADD_COUNTERS:
 		ret = do_add_counters(sock_net(sk), user, len, 1);
 		break;
 	default:
 		duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 struct compat_ip6t_get_entries {
 	char name[IP6T_TABLE_MAXNAMELEN];
 	compat_uint_t size;
 	struct compat_ip6t_entry entrytable[0];
 };
 static int
 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
 	const struct xt_table_info *private = table->private;
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
 	const void *loc_cpu_entry;
 	unsigned int i = 0;
 	counters = alloc_counters(table);
 	if (IS_ERR(counters))
 		return PTR_ERR(counters);
 	/* choose the copy that is on our node/cpu, ...
 	 * This choice is lazy (because current thread is
 	 * allowed to migrate to another cpu)
 	 */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	pos = userptr;
 	size = total_size;
 	ret = IP6T_ENTRY_ITERATE(loc_cpu_entry, total_size,
 				 compat_copy_entry_to_user,
 				 &pos, &size, counters, &i);
 	vfree(counters);
 	return ret;
 }
 static int
 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
 		   int *len)
 {
 	int ret;
 	struct compat_ip6t_get_entries get;
 	struct xt_table *t;
 	if (*len < sizeof(get)) {
 		duprintf("compat_get_entries: %u < %zu\n", *len, sizeof(get));
 		return -EINVAL;
 	}
 	if (copy_from_user(&get, uptr, sizeof(get)) != 0)
 		return -EFAULT;
 	if (*len != sizeof(struct compat_ip6t_get_entries) + get.size) {
 		duprintf("compat_get_entries: %u != %zu\n",
 			 *len, sizeof(get) + get.size);
 		return -EINVAL;
 	}
 	xt_compat_lock(AF_INET6);
 	t = xt_find_table_lock(net, AF_INET6, get.name);
 	if (t && !IS_ERR(t)) {
 		const struct xt_table_info *private = t->private;
 		struct xt_table_info info;
 		duprintf("t->private->number = %u\n", private->number);
 		ret = compat_table_info(private, &info);
 		if (!ret && get.size == info.size) {
 			ret = compat_copy_entries_to_user(private->size,
 							  t, uptr->entrytable);
 		} else if (!ret) {
 			duprintf("compat_get_entries: I've got %u not %u!\n",
 				 private->size, get.size);
 			ret = -EAGAIN;
 		}
 		xt_compat_flush_offsets(AF_INET6);
 		module_put(t->me);
 		xt_table_unlock(t);
 	} else
 		ret = t ? PTR_ERR(t) : -ENOENT;
 	xt_compat_unlock(AF_INET6);
 	return ret;
 }
 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
 static int
 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IP6T_SO_GET_INFO:
 		ret = get_info(sock_net(sk), user, len, 1);
 		break;
 	case IP6T_SO_GET_ENTRIES:
 		ret = compat_get_entries(sock_net(sk), user, len);
 		break;
 	default:
 		ret = do_ip6t_get_ctl(sk, cmd, user, len);
 	}
 	return ret;
 }
 #endif
 static int
 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IP6T_SO_SET_REPLACE:
 		ret = do_replace(sock_net(sk), user, len);
 		break;
 	case IP6T_SO_SET_ADD_COUNTERS:
 		ret = do_add_counters(sock_net(sk), user, len, 0);
 		break;
 	default:
 		duprintf("do_ip6t_set_ctl:  unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 static int
 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
 	int ret;
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 	switch (cmd) {
 	case IP6T_SO_GET_INFO:
 		ret = get_info(sock_net(sk), user, len, 0);
 		break;
 	case IP6T_SO_GET_ENTRIES:
 		ret = get_entries(sock_net(sk), user, len);
 		break;
 	case IP6T_SO_GET_REVISION_MATCH:
 	case IP6T_SO_GET_REVISION_TARGET: {
 		struct ip6t_get_revision rev;
 		int target;
 		if (*len != sizeof(rev)) {
 			ret = -EINVAL;
 			break;
 		}
 		if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
 			ret = -EFAULT;
 			break;
 		}
 		if (cmd == IP6T_SO_GET_REVISION_TARGET)
 			target = 1;
 		else
 			target = 0;
 		try_then_request_module(xt_find_revision(AF_INET6, rev.name,
 							 rev.revision,
 							 target, &ret),
 					"ip6t_%s", rev.name);
 		break;
 	}
 	default:
 		duprintf("do_ip6t_get_ctl: unknown request %i\n", cmd);
 		ret = -EINVAL;
 	}
 	return ret;
 }
 struct xt_table *ip6t_register_table(struct net *net,
 				     const struct xt_table *table,
 				     const struct ip6t_replace *repl)
 {
 	int ret;
 	struct xt_table_info *newinfo;
 	struct xt_table_info bootstrap
 		= { 0, 0, 0, { 0 }, { 0 }, { } };
 	void *loc_cpu_entry;
 	struct xt_table *new_table;
 	newinfo = xt_alloc_table_info(repl->size);
 	if (!newinfo) {
 		ret = -ENOMEM;
 		goto out;
 	}
 	/* choose the copy on our node/cpu, but dont care about preemption */
 	loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
 	memcpy(loc_cpu_entry, repl->entries, repl->size);
 	ret = translate_table(net, table->name, table->valid_hooks,
 			      newinfo, loc_cpu_entry, repl->size,
 			      repl->num_entries,
 			      repl->hook_entry,
 			      repl->underflow);
 	if (ret != 0)
 		goto out_free;
 	new_table = xt_register_table(net, table, &bootstrap, newinfo);
 	if (IS_ERR(new_table)) {
 		ret = PTR_ERR(new_table);
 		goto out_free;
 	}
 	return new_table;
 out_free:
 	xt_free_table_info(newinfo);
 out:
 	return ERR_PTR(ret);
 }
 void ip6t_unregister_table(struct net *net, struct xt_table *table)
 {
 	struct xt_table_info *private;
 	void *loc_cpu_entry;
 	struct module *table_owner = table->me;
 	private = xt_unregister_table(table);
 	/* Decrease module usage counts and free resources */
 	loc_cpu_entry = private->entries[raw_smp_processor_id()];
 	IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, net, NULL);
 	if (private->number > private->initial_entries)
 		module_put(table_owner);
 	xt_free_table_info(private);
 }
 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
 static inline bool
 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
 		     u_int8_t type, u_int8_t code,
 		     bool invert)
 {
 	return (type == test_type && code >= min_code && code <= max_code)
 		^ invert;
 }
 static bool
 icmp6_match(const struct sk_buff *skb, const struct xt_match_param *par)
 {
 	const struct icmp6hdr *ic;
 	struct icmp6hdr _icmph;
 	const struct ip6t_icmp *icmpinfo = par->matchinfo;
 	/* Must not be a fragment. */
 	if (par->fragoff != 0)
 		return false;
 	ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
 	if (ic == NULL) {
 		/* We've been asked to examine this packet, and we
 		 * can't.  Hence, no choice but to drop.
 		 */
 		duprintf("Dropping evil ICMP tinygram.\n");
 		*par->hotdrop = true;
 		return false;
 	}
 	return icmp6_type_code_match(icmpinfo->type,
 				     icmpinfo->code[0],
 				     icmpinfo->code[1],
 				     ic->icmp6_type, ic->icmp6_code,
 				     !!(icmpinfo->invflags&IP6T_ICMP_INV));
 }
 /* Called when user tries to insert an entry of this type. */
 static bool icmp6_checkentry(const struct xt_mtchk_param *par)
 {
 	const struct ip6t_icmp *icmpinfo = par->matchinfo;
 	/* Must specify no unknown invflags */
 	return !(icmpinfo->invflags & ~IP6T_ICMP_INV);
 }
 /* The built-in targets: standard (NULL) and error. */
 static struct xt_target ip6t_standard_target __read_mostly = {
 	.name		= IP6T_STANDARD_TARGET,
 	.targetsize	= sizeof(int),
 	.family		= NFPROTO_IPV6,
 #ifdef CONFIG_COMPAT
 	.compatsize	= sizeof(compat_int_t),
 	.compat_from_user = compat_standard_from_user,
 	.compat_to_user	= compat_standard_to_user,
 #endif
 };
 static struct xt_target ip6t_error_target __read_mostly = {
 	.name		= IP6T_ERROR_TARGET,
 	.target		= ip6t_error,
 	.targetsize	= IP6T_FUNCTION_MAXNAMELEN,
 	.family		= NFPROTO_IPV6,
 };
 static struct nf_sockopt_ops ip6t_sockopts = {
 	.pf		= PF_INET6,
 	.set_optmin	= IP6T_BASE_CTL,
 	.set_optmax	= IP6T_SO_SET_MAX+1,
 	.set		= do_ip6t_set_ctl,
 #ifdef CONFIG_COMPAT
 	.compat_set	= compat_do_ip6t_set_ctl,
 #endif
 	.get_optmin	= IP6T_BASE_CTL,
 	.get_optmax	= IP6T_SO_GET_MAX+1,
 	.get		= do_ip6t_get_ctl,
 #ifdef CONFIG_COMPAT
 	.compat_get	= compat_do_ip6t_get_ctl,
 #endif
 	.owner		= THIS_MODULE,
 };
 static struct xt_match icmp6_matchstruct __read_mostly = {
 	.name		= "icmp6",
 	.match		= icmp6_match,
 	.matchsize	= sizeof(struct ip6t_icmp),
 	.checkentry	= icmp6_checkentry,
 	.proto		= IPPROTO_ICMPV6,
 	.family		= NFPROTO_IPV6,
 };
 static int __net_init ip6_tables_net_init(struct net *net)
 {
 	return xt_proto_init(net, NFPROTO_IPV6);
 }
 static void __net_exit ip6_tables_net_exit(struct net *net)
 {
 	xt_proto_fini(net, NFPROTO_IPV6);
 }
 static struct pernet_operations ip6_tables_net_ops = {
 	.init = ip6_tables_net_init,
 	.exit = ip6_tables_net_exit,
 };
 static int __init ip6_tables_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&ip6_tables_net_ops);
 	if (ret < 0)
 		goto err1;
 	/* Noone else will be downing sem now, so we won't sleep */
 	ret = xt_register_target(&ip6t_standard_target);
 	if (ret < 0)
 		goto err2;
 	ret = xt_register_target(&ip6t_error_target);
 	if (ret < 0)
 		goto err3;
 	ret = xt_register_match(&icmp6_matchstruct);
 	if (ret < 0)
 		goto err4;
 	/* Register setsockopt */
 	ret = nf_register_sockopt(&ip6t_sockopts);
 	if (ret < 0)
 		goto err5;
 	printk(KERN_INFO "ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
 	return 0;
 err5:
 	xt_unregister_match(&icmp6_matchstruct);
 err4:
 	xt_unregister_target(&ip6t_error_target);
 err3:
 	xt_unregister_target(&ip6t_standard_target);
 err2:
 	unregister_pernet_subsys(&ip6_tables_net_ops);
 err1:
 	return ret;
 }
 static void __exit ip6_tables_fini(void)
 {
 	nf_unregister_sockopt(&ip6t_sockopts);
 	xt_unregister_match(&icmp6_matchstruct);
 	xt_unregister_target(&ip6t_error_target);
 	xt_unregister_target(&ip6t_standard_target);
 	unregister_pernet_subsys(&ip6_tables_net_ops);
 }
 /*
  * find the offset to specified header or the protocol number of last header
  * if target < 0. "last header" is transport protocol header, ESP, or
  * "No next header".
  *
  * If target header is found, its offset is set in *offset and return protocol
  * number. Otherwise, return -1.
  *
  * If the first fragment doesn't contain the final protocol header or
  * NEXTHDR_NONE it is considered invalid.
  *
  * Note that non-1st fragment is special case that "the protocol number
  * of last header" is "next header" field in Fragment header. In this case,
  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
  * isn't NULL.
  *
  */
 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
 		  int target, unsigned short *fragoff)
 {
 	unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
 	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 	unsigned int len = skb->len - start;
 	if (fragoff)
 		*fragoff = 0;
 	while (nexthdr != target) {
 		struct ipv6_opt_hdr _hdr, *hp;
 		unsigned int hdrlen;
 		if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
 			if (target < 0)
 				break;
 			return -ENOENT;
 		}
 		hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
 		if (hp == NULL)
 			return -EBADMSG;
 		if (nexthdr == NEXTHDR_FRAGMENT) {
 			unsigned short _frag_off;
 			__be16 *fp;
 			fp = skb_header_pointer(skb,
 						start+offsetof(struct frag_hdr,
 							       frag_off),
 						sizeof(_frag_off),
 						&_frag_off);
 			if (fp == NULL)
 				return -EBADMSG;
 			_frag_off = ntohs(*fp) & ~0x7;
 			if (_frag_off) {
 				if (target < 0 &&
 				    ((!ipv6_ext_hdr(hp->nexthdr)) ||
 				     hp->nexthdr == NEXTHDR_NONE)) {
 					if (fragoff)
 						*fragoff = _frag_off;
 					return hp->nexthdr;
 				}
 				return -ENOENT;
 			}
 			hdrlen = 8;
 		} else if (nexthdr == NEXTHDR_AUTH)
 			hdrlen = (hp->hdrlen + 2) << 2;
 		else
 			hdrlen = ipv6_optlen(hp);
 		nexthdr = hp->nexthdr;
 		len -= hdrlen;
 		start += hdrlen;
 	}
 	*offset = start;
 	return nexthdr;
 }
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
 EXPORT_SYMBOL(ip6t_ext_hdr);
 EXPORT_SYMBOL(ipv6_find_hdr);
 module_init(ip6_tables_init);
 module_exit(ip6_tables_fini);

net/ipv6/netfilter/ip6table_filter.c

Diff comments View file @ e3eaa99

 /*
  * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("ip6tables filter table");
 #define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \
 			    (1 << NF_INET_FORWARD) | \
 			    (1 << NF_INET_LOCAL_OUT))
-static struct
-{
-	struct ip6t_replace repl;
-	struct ip6t_standard entries[3];
-	struct ip6t_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "filter",
-		.valid_hooks = FILTER_VALID_HOOKS,
-		.num_entries = 4,
-		.size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
-		.hook_entry = {
-			[NF_INET_LOCAL_IN] = 0,
-			[NF_INET_FORWARD] = sizeof(struct ip6t_standard),
-			[NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
-		},
-		.underflow = {
-			[NF_INET_LOCAL_IN] = 0,
-			[NF_INET_FORWARD] = sizeof(struct ip6t_standard),
-			[NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
-		},
-	},
-	.entries = {
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-	},
-	.term = IP6T_ERROR_INIT,		/* ERROR */
-};
 static const struct xt_table packet_filter = {
 	.name		= "filter",
 	.valid_hooks	= FILTER_VALID_HOOKS,
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV6,
 	.priority	= NF_IP6_PRI_FILTER,
 };
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
 		     const struct net_device *in, const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
 	const struct net *net = dev_net((in != NULL) ? in : out);
 	return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
 }
 static struct nf_hook_ops *filter_ops __read_mostly;
 /* Default to forward because I got too much mail already. */
 static int forward = NF_ACCEPT;
 module_param(forward, bool, 0000);
 static int __net_init ip6table_filter_net_init(struct net *net)
 {
-	/* Register table */
+	struct ip6t_replace *repl;
+	repl = ip6t_alloc_initial_table(&packet_filter);
+	if (repl == NULL)
+		return -ENOMEM;
+	/* Entry 1 is the FORWARD hook */
+	((struct ip6t_standard *)repl->entries)[1].target.verdict =
+		-forward - 1;
 	net->ipv6.ip6table_filter =
-		ip6t_register_table(net, &packet_filter, &initial_table.repl);
+		ip6t_register_table(net, &packet_filter, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv6.ip6table_filter))
 		return PTR_ERR(net->ipv6.ip6table_filter);
 	return 0;
 }
 static void __net_exit ip6table_filter_net_exit(struct net *net)
 {
 	ip6t_unregister_table(net, net->ipv6.ip6table_filter);
 }
 static struct pernet_operations ip6table_filter_net_ops = {
 	.init = ip6table_filter_net_init,
 	.exit = ip6table_filter_net_exit,
 };
 static int __init ip6table_filter_init(void)
 {
 	int ret;
 	if (forward < 0 || forward > NF_MAX_VERDICT) {
 		printk("iptables forward must be 0 or 1\n");
 		return -EINVAL;
 	}
-	/* Entry 1 is the FORWARD hook */
-	initial_table.entries[1].target.verdict = -forward - 1;
 	ret = register_pernet_subsys(&ip6table_filter_net_ops);
 	if (ret < 0)
 		return ret;
 	/* Register hooks */
 	filter_ops = xt_hook_link(&packet_filter, ip6table_filter_hook);
 	if (IS_ERR(filter_ops)) {
 		ret = PTR_ERR(filter_ops);
 		goto cleanup_table;
 	}
 	return ret;
  cleanup_table:
 	unregister_pernet_subsys(&ip6table_filter_net_ops);
 	return ret;
 }

net/ipv6/netfilter/ip6table_mangle.c

Diff comments View file @ e3eaa99

 /*
  * IPv6 packet mangling table, a port of the IPv4 mangle table to IPv6
  *
  * Copyright (C) 2000-2001 by Harald Welte <laforge@gnumonks.org>
  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("ip6tables mangle table");
 #define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
 			    (1 << NF_INET_LOCAL_IN) | \
 			    (1 << NF_INET_FORWARD) | \
 			    (1 << NF_INET_LOCAL_OUT) | \
 			    (1 << NF_INET_POST_ROUTING))
-static const struct
-{
-	struct ip6t_replace repl;
-	struct ip6t_standard entries[5];
-	struct ip6t_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "mangle",
-		.valid_hooks = MANGLE_VALID_HOOKS,
-		.num_entries = 6,
-		.size = sizeof(struct ip6t_standard) * 5 + sizeof(struct ip6t_error),
-		.hook_entry = {
-			[NF_INET_PRE_ROUTING] 	= 0,
-			[NF_INET_LOCAL_IN]	= sizeof(struct ip6t_standard),
-			[NF_INET_FORWARD]	= sizeof(struct ip6t_standard) * 2,
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ip6t_standard) * 3,
-			[NF_INET_POST_ROUTING]	= sizeof(struct ip6t_standard) * 4,
-		},
-		.underflow = {
-			[NF_INET_PRE_ROUTING] 	= 0,
-			[NF_INET_LOCAL_IN]	= sizeof(struct ip6t_standard),
-			[NF_INET_FORWARD]	= sizeof(struct ip6t_standard) * 2,
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ip6t_standard) * 3,
-			[NF_INET_POST_ROUTING]	= sizeof(struct ip6t_standard) * 4,
-		},
-	},
-	.entries = {
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
-	},
-	.term = IP6T_ERROR_INIT,		/* ERROR */
-};
 static const struct xt_table packet_mangler = {
 	.name		= "mangle",
 	.valid_hooks	= MANGLE_VALID_HOOKS,
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV6,
 	.priority	= NF_IP6_PRI_MANGLE,
 };
 static unsigned int
 ip6t_local_out_hook(unsigned int hook,
 		   struct sk_buff *skb,
 		   const struct net_device *out,
 		   int (*okfn)(struct sk_buff *))
 {
 	unsigned int ret;
 	struct in6_addr saddr, daddr;
 	u_int8_t hop_limit;
 	u_int32_t flowlabel, mark;
 #if 0
 	/* root is playing with raw sockets. */
 	if (skb->len < sizeof(struct iphdr) ||
 	    ip_hdrlen(skb) < sizeof(struct iphdr)) {
 		if (net_ratelimit())
 			printk("ip6t_hook: happy cracking.\n");
 		return NF_ACCEPT;
 	}
 #endif
 	/* save source/dest address, mark, hoplimit, flowlabel, priority,  */
 	memcpy(&saddr, &ipv6_hdr(skb)->saddr, sizeof(saddr));
 	memcpy(&daddr, &ipv6_hdr(skb)->daddr, sizeof(daddr));
 	mark = skb->mark;
 	hop_limit = ipv6_hdr(skb)->hop_limit;
 	/* flowlabel and prio (includes version, which shouldn't change either */
 	flowlabel = *((u_int32_t *)ipv6_hdr(skb));
 	ret = ip6t_do_table(skb, hook, NULL, out,
 			    dev_net(out)->ipv6.ip6table_mangle);
 	if (ret != NF_DROP && ret != NF_STOLEN &&
 	    (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
 	     memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
 	     skb->mark != mark ||
 	     ipv6_hdr(skb)->hop_limit != hop_limit))
 		return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
 	return ret;
 }
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ip6table_mangle_hook(unsigned int hook, struct sk_buff *skb,
 		     const struct net_device *in, const struct net_device *out,
 		     int (*okfn)(struct sk_buff *))
 {
 	if (hook == NF_INET_LOCAL_OUT)
 		return ip6t_local_out_hook(hook, skb, out, okfn);
 	/* INPUT/FORWARD */
 	return ip6t_do_table(skb, hook, in, out,
 			     dev_net(in)->ipv6.ip6table_mangle);
 }
 static struct nf_hook_ops *mangle_ops __read_mostly;
 static int __net_init ip6table_mangle_net_init(struct net *net)
 {
-	/* Register table */
+	struct ip6t_replace *repl;
+	repl = ip6t_alloc_initial_table(&packet_mangler);
+	if (repl == NULL)
+		return -ENOMEM;
 	net->ipv6.ip6table_mangle =
-		ip6t_register_table(net, &packet_mangler, &initial_table.repl);
+		ip6t_register_table(net, &packet_mangler, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv6.ip6table_mangle))
 		return PTR_ERR(net->ipv6.ip6table_mangle);
 	return 0;
 }
 static void __net_exit ip6table_mangle_net_exit(struct net *net)
 {
 	ip6t_unregister_table(net, net->ipv6.ip6table_mangle);
 }
 static struct pernet_operations ip6table_mangle_net_ops = {
 	.init = ip6table_mangle_net_init,
 	.exit = ip6table_mangle_net_exit,
 };
 static int __init ip6table_mangle_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&ip6table_mangle_net_ops);
 	if (ret < 0)
 		return ret;
 	/* Register hooks */
 	mangle_ops = xt_hook_link(&packet_mangler, ip6table_mangle_hook);
 	if (IS_ERR(mangle_ops)) {
 		ret = PTR_ERR(mangle_ops);
 		goto cleanup_table;
 	}
 	return ret;
  cleanup_table:
 	unregister_pernet_subsys(&ip6table_mangle_net_ops);
 	return ret;
 }
 static void __exit ip6table_mangle_fini(void)
 {
 	xt_hook_unlink(&packet_mangler, mangle_ops);
 	unregister_pernet_subsys(&ip6table_mangle_net_ops);

net/ipv6/netfilter/ip6table_raw.c

Diff comments View file @ e3eaa99

 /*
  * IPv6 raw table, a port of the IPv4 raw table to IPv6
  *
  * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
-static const struct
-{
-	struct ip6t_replace repl;
-	struct ip6t_standard entries[2];
-	struct ip6t_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "raw",
-		.valid_hooks = RAW_VALID_HOOKS,
-		.num_entries = 3,
-		.size = sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
-		.hook_entry = {
-			[NF_INET_PRE_ROUTING] = 0,
-			[NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
-		},
-		.underflow = {
-			[NF_INET_PRE_ROUTING] = 0,
-			[NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
-		},
-	},
-	.entries = {
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* PRE_ROUTING */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-	},
-	.term = IP6T_ERROR_INIT,		/* ERROR */
-};
 static const struct xt_table packet_raw = {
 	.name = "raw",
 	.valid_hooks = RAW_VALID_HOOKS,
 	.me = THIS_MODULE,
 	.af = NFPROTO_IPV6,
 	.priority = NF_IP6_PRI_FIRST,
 };
 /* The work comes in here from netfilter.c. */
 static unsigned int
 ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
 		  const struct net_device *in, const struct net_device *out,
 		  int (*okfn)(struct sk_buff *))
 {
 	const struct net *net = dev_net((in != NULL) ? in : out);
 	return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_raw);
 }
 static struct nf_hook_ops *rawtable_ops __read_mostly;
 static int __net_init ip6table_raw_net_init(struct net *net)
 {
-	/* Register table */
+	struct ip6t_replace *repl;
+	repl = ip6t_alloc_initial_table(&packet_raw);
+	if (repl == NULL)
+		return -ENOMEM;
 	net->ipv6.ip6table_raw =
-		ip6t_register_table(net, &packet_raw, &initial_table.repl);
+		ip6t_register_table(net, &packet_raw, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv6.ip6table_raw))
 		return PTR_ERR(net->ipv6.ip6table_raw);
 	return 0;
 }
 static void __net_exit ip6table_raw_net_exit(struct net *net)
 {
 	ip6t_unregister_table(net, net->ipv6.ip6table_raw);
 }
 static struct pernet_operations ip6table_raw_net_ops = {
 	.init = ip6table_raw_net_init,
 	.exit = ip6table_raw_net_exit,
 };
 static int __init ip6table_raw_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&ip6table_raw_net_ops);
 	if (ret < 0)
 		return ret;
 	/* Register hooks */
 	rawtable_ops = xt_hook_link(&packet_raw, ip6table_raw_hook);
 	if (IS_ERR(rawtable_ops)) {
 		ret = PTR_ERR(rawtable_ops);
 		goto cleanup_table;
 	}
 	return ret;
  cleanup_table:
 	unregister_pernet_subsys(&ip6table_raw_net_ops);
 	return ret;
 }
 static void __exit ip6table_raw_fini(void)
 {
 	xt_hook_unlink(&packet_raw, rawtable_ops);
 	unregister_pernet_subsys(&ip6table_raw_net_ops);
 }

net/ipv6/netfilter/ip6table_security.c

Diff comments View file @ e3eaa99

 /*
  * "security" table for IPv6
  *
  * This is for use by Mandatory Access Control (MAC) security models,
  * which need to be able to manage security policy in separate context
  * to DAC.
  *
  * Based on iptable_mangle.c
  *
  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
  * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
 MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
 #define SECURITY_VALID_HOOKS	(1 << NF_INET_LOCAL_IN) | \
 				(1 << NF_INET_FORWARD) | \
 				(1 << NF_INET_LOCAL_OUT)
-static const struct
-{
-	struct ip6t_replace repl;
-	struct ip6t_standard entries[3];
-	struct ip6t_error term;
-} initial_table __net_initdata = {
-	.repl = {
-		.name = "security",
-		.valid_hooks = SECURITY_VALID_HOOKS,
-		.num_entries = 4,
-		.size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
-		.hook_entry = {
-			[NF_INET_LOCAL_IN] 	= 0,
-			[NF_INET_FORWARD] 	= sizeof(struct ip6t_standard),
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ip6t_standard) * 2,
-		},
-		.underflow = {
-			[NF_INET_LOCAL_IN] 	= 0,
-			[NF_INET_FORWARD] 	= sizeof(struct ip6t_standard),
-			[NF_INET_LOCAL_OUT] 	= sizeof(struct ip6t_standard) * 2,
-		},
-	},
-	.entries = {
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_IN */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* FORWARD */
-		IP6T_STANDARD_INIT(NF_ACCEPT),	/* LOCAL_OUT */
-	},
-	.term = IP6T_ERROR_INIT,		/* ERROR */
-};
 static const struct xt_table security_table = {
 	.name		= "security",
 	.valid_hooks	= SECURITY_VALID_HOOKS,
 	.me		= THIS_MODULE,
 	.af		= NFPROTO_IPV6,
 	.priority	= NF_IP6_PRI_SECURITY,
 };
 static unsigned int
 ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
 		       const struct net_device *in,
 		       const struct net_device *out,
 		       int (*okfn)(struct sk_buff *))
 {
 	const struct net *net = dev_net((in != NULL) ? in : out);
 	return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_security);
 }
 static struct nf_hook_ops *sectbl_ops __read_mostly;
 static int __net_init ip6table_security_net_init(struct net *net)
 {
-	net->ipv6.ip6table_security =
+	struct ip6t_replace *repl;
-		ip6t_register_table(net, &security_table, &initial_table.repl);
+	repl = ip6t_alloc_initial_table(&security_table);
+	if (repl == NULL)
+		return -ENOMEM;
+	net->ipv6.ip6table_security =
+		ip6t_register_table(net, &security_table, repl);
+	kfree(repl);
 	if (IS_ERR(net->ipv6.ip6table_security))
 		return PTR_ERR(net->ipv6.ip6table_security);
 	return 0;
 }
 static void __net_exit ip6table_security_net_exit(struct net *net)
 {
 	ip6t_unregister_table(net, net->ipv6.ip6table_security);
 }
 static struct pernet_operations ip6table_security_net_ops = {
 	.init = ip6table_security_net_init,
 	.exit = ip6table_security_net_exit,
 };
 static int __init ip6table_security_init(void)
 {
 	int ret;
 	ret = register_pernet_subsys(&ip6table_security_net_ops);
 	if (ret < 0)
 		return ret;
 	sectbl_ops = xt_hook_link(&security_table, ip6table_security_hook);
 	if (IS_ERR(sectbl_ops)) {
 		ret = PTR_ERR(sectbl_ops);
 		goto cleanup_table;
 	}
 	return ret;
 cleanup_table:
 	unregister_pernet_subsys(&ip6table_security_net_ops);
 	return ret;
 }
 static void __exit ip6table_security_fini(void)
 {
 	xt_hook_unlink(&security_table, sectbl_ops);

net/netfilter/x_tables.c

Diff comments View file @ e3eaa99

1	/*	1	/*
2	* x_tables core - Backend for {ip,ip6,arp}_tables	2	* x_tables core - Backend for {ip,ip6,arp}_tables
3	*	3	*
4	* Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>	4	* Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
5	*	5	*
6	* Based on existing ip_tables code which is	6	* Based on existing ip_tables code which is
7	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling	7	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8	* Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>	8	* Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
9	*	9	*
10	* This program is free software; you can redistribute it and/or modify	10	* This program is free software; you can redistribute it and/or modify
11	* it under the terms of the GNU General Public License version 2 as	11	* it under the terms of the GNU General Public License version 2 as
12	* published by the Free Software Foundation.	12	* published by the Free Software Foundation.
13	*	13	*
14	*/	14	*/
15		15
16	#include <linux/kernel.h>	16	#include <linux/kernel.h>
17	#include <linux/socket.h>	17	#include <linux/socket.h>
18	#include <linux/net.h>	18	#include <linux/net.h>
19	#include <linux/proc_fs.h>	19	#include <linux/proc_fs.h>
20	#include <linux/seq_file.h>	20	#include <linux/seq_file.h>
21	#include <linux/string.h>	21	#include <linux/string.h>
22	#include <linux/vmalloc.h>	22	#include <linux/vmalloc.h>
23	#include <linux/mutex.h>	23	#include <linux/mutex.h>
24	#include <linux/mm.h>	24	#include <linux/mm.h>
25	#include <net/net_namespace.h>	25	#include <net/net_namespace.h>
26		26
27	#include <linux/netfilter/x_tables.h>	27	#include <linux/netfilter/x_tables.h>
28	#include <linux/netfilter_arp.h>	28	#include <linux/netfilter_arp.h>
29		29	#include <linux/netfilter_ipv4/ip_tables.h>
		30	#include <linux/netfilter_ipv6/ip6_tables.h>
		31	#include <linux/netfilter_arp/arp_tables.h>
30		32
31	MODULE_LICENSE("GPL");	33	MODULE_LICENSE("GPL");
32	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");	34	MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
33	MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");	35	MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
34		36
35	#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))	37	#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
36		38
37	struct compat_delta {	39	struct compat_delta {
38	struct compat_delta *next;	40	struct compat_delta *next;
39	unsigned int offset;	41	unsigned int offset;
40	short delta;	42	short delta;
41	};	43	};
42		44
43	struct xt_af {	45	struct xt_af {
44	struct mutex mutex;	46	struct mutex mutex;
45	struct list_head match;	47	struct list_head match;
46	struct list_head target;	48	struct list_head target;
47	#ifdef CONFIG_COMPAT	49	#ifdef CONFIG_COMPAT
48	struct mutex compat_mutex;	50	struct mutex compat_mutex;
49	struct compat_delta *compat_offsets;	51	struct compat_delta *compat_offsets;
50	#endif	52	#endif
51	};	53	};
52		54
53	static struct xt_af *xt;	55	static struct xt_af *xt;
54		56
55	#ifdef DEBUG_IP_FIREWALL_USER	57	#ifdef DEBUG_IP_FIREWALL_USER
56	#define duprintf(format, args...) printk(format , ## args)	58	#define duprintf(format, args...) printk(format , ## args)
57	#else	59	#else
58	#define duprintf(format, args...)	60	#define duprintf(format, args...)
59	#endif	61	#endif
60		62
61	static const char *const xt_prefix[NFPROTO_NUMPROTO] = {	63	static const char *const xt_prefix[NFPROTO_NUMPROTO] = {
62	[NFPROTO_UNSPEC] = "x",	64	[NFPROTO_UNSPEC] = "x",
63	[NFPROTO_IPV4] = "ip",	65	[NFPROTO_IPV4] = "ip",
64	[NFPROTO_ARP] = "arp",	66	[NFPROTO_ARP] = "arp",
65	[NFPROTO_BRIDGE] = "eb",	67	[NFPROTO_BRIDGE] = "eb",
66	[NFPROTO_IPV6] = "ip6",	68	[NFPROTO_IPV6] = "ip6",
67	};	69	};
68		70
69	/* Registration hooks for targets. */	71	/* Registration hooks for targets. */
70	int	72	int
71	xt_register_target(struct xt_target *target)	73	xt_register_target(struct xt_target *target)
72	{	74	{
73	u_int8_t af = target->family;	75	u_int8_t af = target->family;
74	int ret;	76	int ret;
75		77
76	ret = mutex_lock_interruptible(&xt[af].mutex);	78	ret = mutex_lock_interruptible(&xt[af].mutex);
77	if (ret != 0)	79	if (ret != 0)
78	return ret;	80	return ret;
79	list_add(&target->list, &xt[af].target);	81	list_add(&target->list, &xt[af].target);
80	mutex_unlock(&xt[af].mutex);	82	mutex_unlock(&xt[af].mutex);
81	return ret;	83	return ret;
82	}	84	}
83	EXPORT_SYMBOL(xt_register_target);	85	EXPORT_SYMBOL(xt_register_target);
84		86
85	void	87	void
86	xt_unregister_target(struct xt_target *target)	88	xt_unregister_target(struct xt_target *target)
87	{	89	{
88	u_int8_t af = target->family;	90	u_int8_t af = target->family;
89		91
90	mutex_lock(&xt[af].mutex);	92	mutex_lock(&xt[af].mutex);
91	list_del(&target->list);	93	list_del(&target->list);
92	mutex_unlock(&xt[af].mutex);	94	mutex_unlock(&xt[af].mutex);
93	}	95	}
94	EXPORT_SYMBOL(xt_unregister_target);	96	EXPORT_SYMBOL(xt_unregister_target);
95		97
96	int	98	int
97	xt_register_targets(struct xt_target *target, unsigned int n)	99	xt_register_targets(struct xt_target *target, unsigned int n)
98	{	100	{
99	unsigned int i;	101	unsigned int i;
100	int err = 0;	102	int err = 0;
101		103
102	for (i = 0; i < n; i++) {	104	for (i = 0; i < n; i++) {
103	err = xt_register_target(&target[i]);	105	err = xt_register_target(&target[i]);
104	if (err)	106	if (err)
105	goto err;	107	goto err;
106	}	108	}
107	return err;	109	return err;
108		110
109	err:	111	err:
110	if (i > 0)	112	if (i > 0)
111	xt_unregister_targets(target, i);	113	xt_unregister_targets(target, i);
112	return err;	114	return err;
113	}	115	}
114	EXPORT_SYMBOL(xt_register_targets);	116	EXPORT_SYMBOL(xt_register_targets);
115		117
116	void	118	void
117	xt_unregister_targets(struct xt_target *target, unsigned int n)	119	xt_unregister_targets(struct xt_target *target, unsigned int n)
118	{	120	{
119	unsigned int i;	121	unsigned int i;
120		122
121	for (i = 0; i < n; i++)	123	for (i = 0; i < n; i++)
122	xt_unregister_target(&target[i]);	124	xt_unregister_target(&target[i]);
123	}	125	}
124	EXPORT_SYMBOL(xt_unregister_targets);	126	EXPORT_SYMBOL(xt_unregister_targets);
125		127
126	int	128	int
127	xt_register_match(struct xt_match *match)	129	xt_register_match(struct xt_match *match)
128	{	130	{
129	u_int8_t af = match->family;	131	u_int8_t af = match->family;
130	int ret;	132	int ret;
131		133
132	ret = mutex_lock_interruptible(&xt[af].mutex);	134	ret = mutex_lock_interruptible(&xt[af].mutex);
133	if (ret != 0)	135	if (ret != 0)
134	return ret;	136	return ret;
135		137
136	list_add(&match->list, &xt[af].match);	138	list_add(&match->list, &xt[af].match);
137	mutex_unlock(&xt[af].mutex);	139	mutex_unlock(&xt[af].mutex);
138		140
139	return ret;	141	return ret;
140	}	142	}
141	EXPORT_SYMBOL(xt_register_match);	143	EXPORT_SYMBOL(xt_register_match);
142		144
143	void	145	void
144	xt_unregister_match(struct xt_match *match)	146	xt_unregister_match(struct xt_match *match)
145	{	147	{
146	u_int8_t af = match->family;	148	u_int8_t af = match->family;
147		149
148	mutex_lock(&xt[af].mutex);	150	mutex_lock(&xt[af].mutex);
149	list_del(&match->list);	151	list_del(&match->list);
150	mutex_unlock(&xt[af].mutex);	152	mutex_unlock(&xt[af].mutex);
151	}	153	}
152	EXPORT_SYMBOL(xt_unregister_match);	154	EXPORT_SYMBOL(xt_unregister_match);
153		155
154	int	156	int
155	xt_register_matches(struct xt_match *match, unsigned int n)	157	xt_register_matches(struct xt_match *match, unsigned int n)
156	{	158	{
157	unsigned int i;	159	unsigned int i;
158	int err = 0;	160	int err = 0;
159		161
160	for (i = 0; i < n; i++) {	162	for (i = 0; i < n; i++) {
161	err = xt_register_match(&match[i]);	163	err = xt_register_match(&match[i]);
162	if (err)	164	if (err)
163	goto err;	165	goto err;
164	}	166	}
165	return err;	167	return err;
166		168
167	err:	169	err:
168	if (i > 0)	170	if (i > 0)
169	xt_unregister_matches(match, i);	171	xt_unregister_matches(match, i);
170	return err;	172	return err;
171	}	173	}
172	EXPORT_SYMBOL(xt_register_matches);	174	EXPORT_SYMBOL(xt_register_matches);
173		175
174	void	176	void
175	xt_unregister_matches(struct xt_match *match, unsigned int n)	177	xt_unregister_matches(struct xt_match *match, unsigned int n)
176	{	178	{
177	unsigned int i;	179	unsigned int i;
178		180
179	for (i = 0; i < n; i++)	181	for (i = 0; i < n; i++)
180	xt_unregister_match(&match[i]);	182	xt_unregister_match(&match[i]);
181	}	183	}
182	EXPORT_SYMBOL(xt_unregister_matches);	184	EXPORT_SYMBOL(xt_unregister_matches);
183		185
184		186
185	/*	187	/*
186	* These are weird, but module loading must not be done with mutex	188	* These are weird, but module loading must not be done with mutex
187	* held (since they will register), and we have to have a single	189	* held (since they will register), and we have to have a single
188	* function to use try_then_request_module().	190	* function to use try_then_request_module().
189	*/	191	*/
190		192
191	/* Find match, grabs ref. Returns ERR_PTR() on error. */	193	/* Find match, grabs ref. Returns ERR_PTR() on error. */
192	struct xt_match xt_find_match(u8 af, const char name, u8 revision)	194	struct xt_match xt_find_match(u8 af, const char name, u8 revision)
193	{	195	{
194	struct xt_match *m;	196	struct xt_match *m;
195	int err = 0;	197	int err = 0;
196		198
197	if (mutex_lock_interruptible(&xt[af].mutex) != 0)	199	if (mutex_lock_interruptible(&xt[af].mutex) != 0)
198	return ERR_PTR(-EINTR);	200	return ERR_PTR(-EINTR);
199		201
200	list_for_each_entry(m, &xt[af].match, list) {	202	list_for_each_entry(m, &xt[af].match, list) {
201	if (strcmp(m->name, name) == 0) {	203	if (strcmp(m->name, name) == 0) {
202	if (m->revision == revision) {	204	if (m->revision == revision) {
203	if (try_module_get(m->me)) {	205	if (try_module_get(m->me)) {
204	mutex_unlock(&xt[af].mutex);	206	mutex_unlock(&xt[af].mutex);
205	return m;	207	return m;
206	}	208	}
207	} else	209	} else
208	err = -EPROTOTYPE; /* Found something. */	210	err = -EPROTOTYPE; /* Found something. */
209	}	211	}
210	}	212	}
211	mutex_unlock(&xt[af].mutex);	213	mutex_unlock(&xt[af].mutex);
212		214
213	if (af != NFPROTO_UNSPEC)	215	if (af != NFPROTO_UNSPEC)
214	/* Try searching again in the family-independent list */	216	/* Try searching again in the family-independent list */
215	return xt_find_match(NFPROTO_UNSPEC, name, revision);	217	return xt_find_match(NFPROTO_UNSPEC, name, revision);
216		218
217	return ERR_PTR(err);	219	return ERR_PTR(err);
218	}	220	}
219	EXPORT_SYMBOL(xt_find_match);	221	EXPORT_SYMBOL(xt_find_match);
220		222
221	/* Find target, grabs ref. Returns ERR_PTR() on error. */	223	/* Find target, grabs ref. Returns ERR_PTR() on error. */
222	struct xt_target xt_find_target(u8 af, const char name, u8 revision)	224	struct xt_target xt_find_target(u8 af, const char name, u8 revision)
223	{	225	{
224	struct xt_target *t;	226	struct xt_target *t;
225	int err = 0;	227	int err = 0;
226		228
227	if (mutex_lock_interruptible(&xt[af].mutex) != 0)	229	if (mutex_lock_interruptible(&xt[af].mutex) != 0)
228	return ERR_PTR(-EINTR);	230	return ERR_PTR(-EINTR);
229		231
230	list_for_each_entry(t, &xt[af].target, list) {	232	list_for_each_entry(t, &xt[af].target, list) {
231	if (strcmp(t->name, name) == 0) {	233	if (strcmp(t->name, name) == 0) {
232	if (t->revision == revision) {	234	if (t->revision == revision) {
233	if (try_module_get(t->me)) {	235	if (try_module_get(t->me)) {
234	mutex_unlock(&xt[af].mutex);	236	mutex_unlock(&xt[af].mutex);
235	return t;	237	return t;
236	}	238	}
237	} else	239	} else
238	err = -EPROTOTYPE; /* Found something. */	240	err = -EPROTOTYPE; /* Found something. */
239	}	241	}
240	}	242	}
241	mutex_unlock(&xt[af].mutex);	243	mutex_unlock(&xt[af].mutex);
242		244
243	if (af != NFPROTO_UNSPEC)	245	if (af != NFPROTO_UNSPEC)
244	/* Try searching again in the family-independent list */	246	/* Try searching again in the family-independent list */
245	return xt_find_target(NFPROTO_UNSPEC, name, revision);	247	return xt_find_target(NFPROTO_UNSPEC, name, revision);
246		248
247	return ERR_PTR(err);	249	return ERR_PTR(err);
248	}	250	}
249	EXPORT_SYMBOL(xt_find_target);	251	EXPORT_SYMBOL(xt_find_target);
250		252
251	struct xt_target xt_request_find_target(u8 af, const char name, u8 revision)	253	struct xt_target xt_request_find_target(u8 af, const char name, u8 revision)
252	{	254	{
253	struct xt_target *target;	255	struct xt_target *target;
254		256
255	target = try_then_request_module(xt_find_target(af, name, revision),	257	target = try_then_request_module(xt_find_target(af, name, revision),
256	"%st_%s", xt_prefix[af], name);	258	"%st_%s", xt_prefix[af], name);
257	if (IS_ERR(target) \|\| !target)	259	if (IS_ERR(target) \|\| !target)
258	return NULL;	260	return NULL;
259	return target;	261	return target;
260	}	262	}
261	EXPORT_SYMBOL_GPL(xt_request_find_target);	263	EXPORT_SYMBOL_GPL(xt_request_find_target);
262		264
263	static int match_revfn(u8 af, const char name, u8 revision, int bestp)	265	static int match_revfn(u8 af, const char name, u8 revision, int bestp)
264	{	266	{
265	const struct xt_match *m;	267	const struct xt_match *m;
266	int have_rev = 0;	268	int have_rev = 0;
267		269
268	list_for_each_entry(m, &xt[af].match, list) {	270	list_for_each_entry(m, &xt[af].match, list) {
269	if (strcmp(m->name, name) == 0) {	271	if (strcmp(m->name, name) == 0) {
270	if (m->revision > *bestp)	272	if (m->revision > *bestp)
271	*bestp = m->revision;	273	*bestp = m->revision;
272	if (m->revision == revision)	274	if (m->revision == revision)
273	have_rev = 1;	275	have_rev = 1;
274	}	276	}
275	}	277	}
276		278
277	if (af != NFPROTO_UNSPEC && !have_rev)	279	if (af != NFPROTO_UNSPEC && !have_rev)
278	return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);	280	return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
279		281
280	return have_rev;	282	return have_rev;
281	}	283	}
282		284
283	static int target_revfn(u8 af, const char name, u8 revision, int bestp)	285	static int target_revfn(u8 af, const char name, u8 revision, int bestp)
284	{	286	{
285	const struct xt_target *t;	287	const struct xt_target *t;
286	int have_rev = 0;	288	int have_rev = 0;
287		289
288	list_for_each_entry(t, &xt[af].target, list) {	290	list_for_each_entry(t, &xt[af].target, list) {
289	if (strcmp(t->name, name) == 0) {	291	if (strcmp(t->name, name) == 0) {
290	if (t->revision > *bestp)	292	if (t->revision > *bestp)
291	*bestp = t->revision;	293	*bestp = t->revision;
292	if (t->revision == revision)	294	if (t->revision == revision)
293	have_rev = 1;	295	have_rev = 1;
294	}	296	}
295	}	297	}
296		298
297	if (af != NFPROTO_UNSPEC && !have_rev)	299	if (af != NFPROTO_UNSPEC && !have_rev)
298	return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);	300	return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
299		301
300	return have_rev;	302	return have_rev;
301	}	303	}
302		304
303	/* Returns true or false (if no such extension at all) */	305	/* Returns true or false (if no such extension at all) */
304	int xt_find_revision(u8 af, const char *name, u8 revision, int target,	306	int xt_find_revision(u8 af, const char *name, u8 revision, int target,
305	int *err)	307	int *err)
306	{	308	{
307	int have_rev, best = -1;	309	int have_rev, best = -1;
308		310
309	if (mutex_lock_interruptible(&xt[af].mutex) != 0) {	311	if (mutex_lock_interruptible(&xt[af].mutex) != 0) {
310	*err = -EINTR;	312	*err = -EINTR;
311	return 1;	313	return 1;
312	}	314	}
313	if (target == 1)	315	if (target == 1)
314	have_rev = target_revfn(af, name, revision, &best);	316	have_rev = target_revfn(af, name, revision, &best);
315	else	317	else
316	have_rev = match_revfn(af, name, revision, &best);	318	have_rev = match_revfn(af, name, revision, &best);
317	mutex_unlock(&xt[af].mutex);	319	mutex_unlock(&xt[af].mutex);
318		320
319	/* Nothing at all? Return 0 to try loading module. */	321	/* Nothing at all? Return 0 to try loading module. */
320	if (best == -1) {	322	if (best == -1) {
321	*err = -ENOENT;	323	*err = -ENOENT;
322	return 0;	324	return 0;
323	}	325	}
324		326
325	*err = best;	327	*err = best;
326	if (!have_rev)	328	if (!have_rev)
327	*err = -EPROTONOSUPPORT;	329	*err = -EPROTONOSUPPORT;
328	return 1;	330	return 1;
329	}	331	}
330	EXPORT_SYMBOL_GPL(xt_find_revision);	332	EXPORT_SYMBOL_GPL(xt_find_revision);
331		333
332	static char textify_hooks(char buf, size_t size, unsigned int mask)	334	static char textify_hooks(char buf, size_t size, unsigned int mask)
333	{	335	{
334	static const char *const names[] = {	336	static const char *const names[] = {
335	"PREROUTING", "INPUT", "FORWARD",	337	"PREROUTING", "INPUT", "FORWARD",
336	"OUTPUT", "POSTROUTING", "BROUTING",	338	"OUTPUT", "POSTROUTING", "BROUTING",
337	};	339	};
338	unsigned int i;	340	unsigned int i;
339	char *p = buf;	341	char *p = buf;
340	bool np = false;	342	bool np = false;
341	int res;	343	int res;
342		344
343	*p = '\0';	345	*p = '\0';
344	for (i = 0; i < ARRAY_SIZE(names); ++i) {	346	for (i = 0; i < ARRAY_SIZE(names); ++i) {
345	if (!(mask & (1 << i)))	347	if (!(mask & (1 << i)))
346	continue;	348	continue;
347	res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);	349	res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);
348	if (res > 0) {	350	if (res > 0) {
349	size -= res;	351	size -= res;
350	p += res;	352	p += res;
351	}	353	}
352	np = true;	354	np = true;
353	}	355	}
354		356
355	return buf;	357	return buf;
356	}	358	}
357		359
358	int xt_check_match(struct xt_mtchk_param *par,	360	int xt_check_match(struct xt_mtchk_param *par,
359	unsigned int size, u_int8_t proto, bool inv_proto)	361	unsigned int size, u_int8_t proto, bool inv_proto)
360	{	362	{
361	if (XT_ALIGN(par->match->matchsize) != size &&	363	if (XT_ALIGN(par->match->matchsize) != size &&
362	par->match->matchsize != -1) {	364	par->match->matchsize != -1) {
363	/*	365	/*
364	* ebt_among is exempt from centralized matchsize checking	366	* ebt_among is exempt from centralized matchsize checking
365	* because it uses a dynamic-size data set.	367	* because it uses a dynamic-size data set.
366	*/	368	*/
367	pr_err("%s_tables: %s match: invalid size %Zu != %u\n",	369	pr_err("%s_tables: %s match: invalid size %Zu != %u\n",
368	xt_prefix[par->family], par->match->name,	370	xt_prefix[par->family], par->match->name,
369	XT_ALIGN(par->match->matchsize), size);	371	XT_ALIGN(par->match->matchsize), size);
370	return -EINVAL;	372	return -EINVAL;
371	}	373	}
372	if (par->match->table != NULL &&	374	if (par->match->table != NULL &&
373	strcmp(par->match->table, par->table) != 0) {	375	strcmp(par->match->table, par->table) != 0) {
374	pr_err("%s_tables: %s match: only valid in %s table, not %s\n",	376	pr_err("%s_tables: %s match: only valid in %s table, not %s\n",
375	xt_prefix[par->family], par->match->name,	377	xt_prefix[par->family], par->match->name,
376	par->match->table, par->table);	378	par->match->table, par->table);
377	return -EINVAL;	379	return -EINVAL;
378	}	380	}
379	if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {	381	if (par->match->hooks && (par->hook_mask & ~par->match->hooks) != 0) {
380	char used[64], allow[64];	382	char used[64], allow[64];
381		383
382	pr_err("%s_tables: %s match: used from hooks %s, but only "	384	pr_err("%s_tables: %s match: used from hooks %s, but only "
383	"valid from %s\n",	385	"valid from %s\n",
384	xt_prefix[par->family], par->match->name,	386	xt_prefix[par->family], par->match->name,
385	textify_hooks(used, sizeof(used), par->hook_mask),	387	textify_hooks(used, sizeof(used), par->hook_mask),
386	textify_hooks(allow, sizeof(allow), par->match->hooks));	388	textify_hooks(allow, sizeof(allow), par->match->hooks));
387	return -EINVAL;	389	return -EINVAL;
388	}	390	}
389	if (par->match->proto && (par->match->proto != proto \|\| inv_proto)) {	391	if (par->match->proto && (par->match->proto != proto \|\| inv_proto)) {
390	pr_err("%s_tables: %s match: only valid for protocol %u\n",	392	pr_err("%s_tables: %s match: only valid for protocol %u\n",
391	xt_prefix[par->family], par->match->name,	393	xt_prefix[par->family], par->match->name,
392	par->match->proto);	394	par->match->proto);
393	return -EINVAL;	395	return -EINVAL;
394	}	396	}
395	if (par->match->checkentry != NULL && !par->match->checkentry(par))	397	if (par->match->checkentry != NULL && !par->match->checkentry(par))
396	return -EINVAL;	398	return -EINVAL;
397	return 0;	399	return 0;
398	}	400	}
399	EXPORT_SYMBOL_GPL(xt_check_match);	401	EXPORT_SYMBOL_GPL(xt_check_match);
400		402
401	#ifdef CONFIG_COMPAT	403	#ifdef CONFIG_COMPAT
402	int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta)	404	int xt_compat_add_offset(u_int8_t af, unsigned int offset, short delta)
403	{	405	{
404	struct compat_delta *tmp;	406	struct compat_delta *tmp;
405		407
406	tmp = kmalloc(sizeof(struct compat_delta), GFP_KERNEL);	408	tmp = kmalloc(sizeof(struct compat_delta), GFP_KERNEL);
407	if (!tmp)	409	if (!tmp)
408	return -ENOMEM;	410	return -ENOMEM;
409		411
410	tmp->offset = offset;	412	tmp->offset = offset;
411	tmp->delta = delta;	413	tmp->delta = delta;
412		414
413	if (xt[af].compat_offsets) {	415	if (xt[af].compat_offsets) {
414	tmp->next = xt[af].compat_offsets->next;	416	tmp->next = xt[af].compat_offsets->next;
415	xt[af].compat_offsets->next = tmp;	417	xt[af].compat_offsets->next = tmp;
416	} else {	418	} else {
417	xt[af].compat_offsets = tmp;	419	xt[af].compat_offsets = tmp;
418	tmp->next = NULL;	420	tmp->next = NULL;
419	}	421	}
420	return 0;	422	return 0;
421	}	423	}
422	EXPORT_SYMBOL_GPL(xt_compat_add_offset);	424	EXPORT_SYMBOL_GPL(xt_compat_add_offset);
423		425
424	void xt_compat_flush_offsets(u_int8_t af)	426	void xt_compat_flush_offsets(u_int8_t af)
425	{	427	{
426	struct compat_delta tmp, next;	428	struct compat_delta tmp, next;
427		429
428	if (xt[af].compat_offsets) {	430	if (xt[af].compat_offsets) {
429	for (tmp = xt[af].compat_offsets; tmp; tmp = next) {	431	for (tmp = xt[af].compat_offsets; tmp; tmp = next) {
430	next = tmp->next;	432	next = tmp->next;
431	kfree(tmp);	433	kfree(tmp);
432	}	434	}
433	xt[af].compat_offsets = NULL;	435	xt[af].compat_offsets = NULL;
434	}	436	}
435	}	437	}
436	EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);	438	EXPORT_SYMBOL_GPL(xt_compat_flush_offsets);
437		439
438	short xt_compat_calc_jump(u_int8_t af, unsigned int offset)	440	short xt_compat_calc_jump(u_int8_t af, unsigned int offset)
439	{	441	{
440	struct compat_delta *tmp;	442	struct compat_delta *tmp;
441	short delta;	443	short delta;
442		444
443	for (tmp = xt[af].compat_offsets, delta = 0; tmp; tmp = tmp->next)	445	for (tmp = xt[af].compat_offsets, delta = 0; tmp; tmp = tmp->next)
444	if (tmp->offset < offset)	446	if (tmp->offset < offset)
445	delta += tmp->delta;	447	delta += tmp->delta;
446	return delta;	448	return delta;
447	}	449	}
448	EXPORT_SYMBOL_GPL(xt_compat_calc_jump);	450	EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
449		451
450	int xt_compat_match_offset(const struct xt_match *match)	452	int xt_compat_match_offset(const struct xt_match *match)
451	{	453	{
452	u_int16_t csize = match->compatsize ? : match->matchsize;	454	u_int16_t csize = match->compatsize ? : match->matchsize;
453	return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize);	455	return XT_ALIGN(match->matchsize) - COMPAT_XT_ALIGN(csize);
454	}	456	}
455	EXPORT_SYMBOL_GPL(xt_compat_match_offset);	457	EXPORT_SYMBOL_GPL(xt_compat_match_offset);
456		458
457	int xt_compat_match_from_user(struct xt_entry_match m, void *dstptr,	459	int xt_compat_match_from_user(struct xt_entry_match m, void *dstptr,
458	unsigned int *size)	460	unsigned int *size)
459	{	461	{
460	const struct xt_match *match = m->u.kernel.match;	462	const struct xt_match *match = m->u.kernel.match;
461	struct compat_xt_entry_match cm = (struct compat_xt_entry_match )m;	463	struct compat_xt_entry_match cm = (struct compat_xt_entry_match )m;
462	int pad, off = xt_compat_match_offset(match);	464	int pad, off = xt_compat_match_offset(match);
463	u_int16_t msize = cm->u.user.match_size;	465	u_int16_t msize = cm->u.user.match_size;
464		466
465	m = *dstptr;	467	m = *dstptr;
466	memcpy(m, cm, sizeof(*cm));	468	memcpy(m, cm, sizeof(*cm));
467	if (match->compat_from_user)	469	if (match->compat_from_user)
468	match->compat_from_user(m->data, cm->data);	470	match->compat_from_user(m->data, cm->data);
469	else	471	else
470	memcpy(m->data, cm->data, msize - sizeof(*cm));	472	memcpy(m->data, cm->data, msize - sizeof(*cm));
471	pad = XT_ALIGN(match->matchsize) - match->matchsize;	473	pad = XT_ALIGN(match->matchsize) - match->matchsize;
472	if (pad > 0)	474	if (pad > 0)
473	memset(m->data + match->matchsize, 0, pad);	475	memset(m->data + match->matchsize, 0, pad);
474		476
475	msize += off;	477	msize += off;
476	m->u.user.match_size = msize;	478	m->u.user.match_size = msize;
477		479
478	*size += off;	480	*size += off;
479	*dstptr += msize;	481	*dstptr += msize;
480	return 0;	482	return 0;
481	}	483	}
482	EXPORT_SYMBOL_GPL(xt_compat_match_from_user);	484	EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
483		485
484	int xt_compat_match_to_user(struct xt_entry_match m, void __user *dstptr,	486	int xt_compat_match_to_user(struct xt_entry_match m, void __user *dstptr,
485	unsigned int *size)	487	unsigned int *size)
486	{	488	{
487	const struct xt_match *match = m->u.kernel.match;	489	const struct xt_match *match = m->u.kernel.match;
488	struct compat_xt_entry_match __user cm = dstptr;	490	struct compat_xt_entry_match __user cm = dstptr;
489	int off = xt_compat_match_offset(match);	491	int off = xt_compat_match_offset(match);
490	u_int16_t msize = m->u.user.match_size - off;	492	u_int16_t msize = m->u.user.match_size - off;
491		493
492	if (copy_to_user(cm, m, sizeof(*cm)) \|\|	494	if (copy_to_user(cm, m, sizeof(*cm)) \|\|
493	put_user(msize, &cm->u.user.match_size) \|\|	495	put_user(msize, &cm->u.user.match_size) \|\|
494	copy_to_user(cm->u.user.name, m->u.kernel.match->name,	496	copy_to_user(cm->u.user.name, m->u.kernel.match->name,
495	strlen(m->u.kernel.match->name) + 1))	497	strlen(m->u.kernel.match->name) + 1))
496	return -EFAULT;	498	return -EFAULT;
497		499
498	if (match->compat_to_user) {	500	if (match->compat_to_user) {
499	if (match->compat_to_user((void __user *)cm->data, m->data))	501	if (match->compat_to_user((void __user *)cm->data, m->data))
500	return -EFAULT;	502	return -EFAULT;
501	} else {	503	} else {
502	if (copy_to_user(cm->data, m->data, msize - sizeof(*cm)))	504	if (copy_to_user(cm->data, m->data, msize - sizeof(*cm)))
503	return -EFAULT;	505	return -EFAULT;
504	}	506	}
505		507
506	*size -= off;	508	*size -= off;
507	*dstptr += msize;	509	*dstptr += msize;
508	return 0;	510	return 0;
509	}	511	}
510	EXPORT_SYMBOL_GPL(xt_compat_match_to_user);	512	EXPORT_SYMBOL_GPL(xt_compat_match_to_user);
511	#endif /* CONFIG_COMPAT */	513	#endif /* CONFIG_COMPAT */
512		514
513	int xt_check_target(struct xt_tgchk_param *par,	515	int xt_check_target(struct xt_tgchk_param *par,
514	unsigned int size, u_int8_t proto, bool inv_proto)	516	unsigned int size, u_int8_t proto, bool inv_proto)
515	{	517	{
516	if (XT_ALIGN(par->target->targetsize) != size) {	518	if (XT_ALIGN(par->target->targetsize) != size) {
517	pr_err("%s_tables: %s target: invalid size %Zu != %u\n",	519	pr_err("%s_tables: %s target: invalid size %Zu != %u\n",
518	xt_prefix[par->family], par->target->name,	520	xt_prefix[par->family], par->target->name,
519	XT_ALIGN(par->target->targetsize), size);	521	XT_ALIGN(par->target->targetsize), size);
520	return -EINVAL;	522	return -EINVAL;
521	}	523	}
522	if (par->target->table != NULL &&	524	if (par->target->table != NULL &&
523	strcmp(par->target->table, par->table) != 0) {	525	strcmp(par->target->table, par->table) != 0) {
524	pr_err("%s_tables: %s target: only valid in %s table, not %s\n",	526	pr_err("%s_tables: %s target: only valid in %s table, not %s\n",
525	xt_prefix[par->family], par->target->name,	527	xt_prefix[par->family], par->target->name,
526	par->target->table, par->table);	528	par->target->table, par->table);
527	return -EINVAL;	529	return -EINVAL;
528	}	530	}
529	if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {	531	if (par->target->hooks && (par->hook_mask & ~par->target->hooks) != 0) {
530	char used[64], allow[64];	532	char used[64], allow[64];
531		533
532	pr_err("%s_tables: %s target: used from hooks %s, but only "	534	pr_err("%s_tables: %s target: used from hooks %s, but only "
533	"usable from %s\n",	535	"usable from %s\n",
534	xt_prefix[par->family], par->target->name,	536	xt_prefix[par->family], par->target->name,
535	textify_hooks(used, sizeof(used), par->hook_mask),	537	textify_hooks(used, sizeof(used), par->hook_mask),
536	textify_hooks(allow, sizeof(allow), par->target->hooks));	538	textify_hooks(allow, sizeof(allow), par->target->hooks));
537	return -EINVAL;	539	return -EINVAL;
538	}	540	}
539	if (par->target->proto && (par->target->proto != proto \|\| inv_proto)) {	541	if (par->target->proto && (par->target->proto != proto \|\| inv_proto)) {
540	pr_err("%s_tables: %s target: only valid for protocol %u\n",	542	pr_err("%s_tables: %s target: only valid for protocol %u\n",
541	xt_prefix[par->family], par->target->name,	543	xt_prefix[par->family], par->target->name,
542	par->target->proto);	544	par->target->proto);
543	return -EINVAL;	545	return -EINVAL;
544	}	546	}
545	if (par->target->checkentry != NULL && !par->target->checkentry(par))	547	if (par->target->checkentry != NULL && !par->target->checkentry(par))
546	return -EINVAL;	548	return -EINVAL;
547	return 0;	549	return 0;
548	}	550	}
549	EXPORT_SYMBOL_GPL(xt_check_target);	551	EXPORT_SYMBOL_GPL(xt_check_target);
550		552
551	#ifdef CONFIG_COMPAT	553	#ifdef CONFIG_COMPAT
552	int xt_compat_target_offset(const struct xt_target *target)	554	int xt_compat_target_offset(const struct xt_target *target)
553	{	555	{
554	u_int16_t csize = target->compatsize ? : target->targetsize;	556	u_int16_t csize = target->compatsize ? : target->targetsize;
555	return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize);	557	return XT_ALIGN(target->targetsize) - COMPAT_XT_ALIGN(csize);
556	}	558	}
557	EXPORT_SYMBOL_GPL(xt_compat_target_offset);	559	EXPORT_SYMBOL_GPL(xt_compat_target_offset);
558		560
559	void xt_compat_target_from_user(struct xt_entry_target t, void *dstptr,	561	void xt_compat_target_from_user(struct xt_entry_target t, void *dstptr,
560	unsigned int *size)	562	unsigned int *size)
561	{	563	{
562	const struct xt_target *target = t->u.kernel.target;	564	const struct xt_target *target = t->u.kernel.target;
563	struct compat_xt_entry_target ct = (struct compat_xt_entry_target )t;	565	struct compat_xt_entry_target ct = (struct compat_xt_entry_target )t;
564	int pad, off = xt_compat_target_offset(target);	566	int pad, off = xt_compat_target_offset(target);
565	u_int16_t tsize = ct->u.user.target_size;	567	u_int16_t tsize = ct->u.user.target_size;
566		568
567	t = *dstptr;	569	t = *dstptr;
568	memcpy(t, ct, sizeof(*ct));	570	memcpy(t, ct, sizeof(*ct));
569	if (target->compat_from_user)	571	if (target->compat_from_user)
570	target->compat_from_user(t->data, ct->data);	572	target->compat_from_user(t->data, ct->data);
571	else	573	else
572	memcpy(t->data, ct->data, tsize - sizeof(*ct));	574	memcpy(t->data, ct->data, tsize - sizeof(*ct));
573	pad = XT_ALIGN(target->targetsize) - target->targetsize;	575	pad = XT_ALIGN(target->targetsize) - target->targetsize;
574	if (pad > 0)	576	if (pad > 0)
575	memset(t->data + target->targetsize, 0, pad);	577	memset(t->data + target->targetsize, 0, pad);
576		578
577	tsize += off;	579	tsize += off;
578	t->u.user.target_size = tsize;	580	t->u.user.target_size = tsize;
579		581
580	*size += off;	582	*size += off;
581	*dstptr += tsize;	583	*dstptr += tsize;
582	}	584	}
583	EXPORT_SYMBOL_GPL(xt_compat_target_from_user);	585	EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
584		586
585	int xt_compat_target_to_user(struct xt_entry_target t, void __user *dstptr,	587	int xt_compat_target_to_user(struct xt_entry_target t, void __user *dstptr,
586	unsigned int *size)	588	unsigned int *size)
587	{	589	{
588	const struct xt_target *target = t->u.kernel.target;	590	const struct xt_target *target = t->u.kernel.target;
589	struct compat_xt_entry_target __user ct = dstptr;	591	struct compat_xt_entry_target __user ct = dstptr;
590	int off = xt_compat_target_offset(target);	592	int off = xt_compat_target_offset(target);
591	u_int16_t tsize = t->u.user.target_size - off;	593	u_int16_t tsize = t->u.user.target_size - off;
592		594
593	if (copy_to_user(ct, t, sizeof(*ct)) \|\|	595	if (copy_to_user(ct, t, sizeof(*ct)) \|\|
594	put_user(tsize, &ct->u.user.target_size) \|\|	596	put_user(tsize, &ct->u.user.target_size) \|\|
595	copy_to_user(ct->u.user.name, t->u.kernel.target->name,	597	copy_to_user(ct->u.user.name, t->u.kernel.target->name,
596	strlen(t->u.kernel.target->name) + 1))	598	strlen(t->u.kernel.target->name) + 1))
597	return -EFAULT;	599	return -EFAULT;
598		600
599	if (target->compat_to_user) {	601	if (target->compat_to_user) {
600	if (target->compat_to_user((void __user *)ct->data, t->data))	602	if (target->compat_to_user((void __user *)ct->data, t->data))
601	return -EFAULT;	603	return -EFAULT;
602	} else {	604	} else {
603	if (copy_to_user(ct->data, t->data, tsize - sizeof(*ct)))	605	if (copy_to_user(ct->data, t->data, tsize - sizeof(*ct)))
604	return -EFAULT;	606	return -EFAULT;
605	}	607	}
606		608
607	*size -= off;	609	*size -= off;
608	*dstptr += tsize;	610	*dstptr += tsize;
609	return 0;	611	return 0;
610	}	612	}
611	EXPORT_SYMBOL_GPL(xt_compat_target_to_user);	613	EXPORT_SYMBOL_GPL(xt_compat_target_to_user);
612	#endif	614	#endif
613		615
614	struct xt_table_info *xt_alloc_table_info(unsigned int size)	616	struct xt_table_info *xt_alloc_table_info(unsigned int size)
615	{	617	{
616	struct xt_table_info *newinfo;	618	struct xt_table_info *newinfo;
617	int cpu;	619	int cpu;
618		620
619	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */	621	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
620	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)	622	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
621	return NULL;	623	return NULL;
622		624
623	newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);	625	newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);
624	if (!newinfo)	626	if (!newinfo)
625	return NULL;	627	return NULL;
626		628
627	newinfo->size = size;	629	newinfo->size = size;
628		630
629	for_each_possible_cpu(cpu) {	631	for_each_possible_cpu(cpu) {
630	if (size <= PAGE_SIZE)	632	if (size <= PAGE_SIZE)
631	newinfo->entries[cpu] = kmalloc_node(size,	633	newinfo->entries[cpu] = kmalloc_node(size,
632	GFP_KERNEL,	634	GFP_KERNEL,
633	cpu_to_node(cpu));	635	cpu_to_node(cpu));
634	else	636	else
635	newinfo->entries[cpu] = vmalloc_node(size,	637	newinfo->entries[cpu] = vmalloc_node(size,
636	cpu_to_node(cpu));	638	cpu_to_node(cpu));
637		639
638	if (newinfo->entries[cpu] == NULL) {	640	if (newinfo->entries[cpu] == NULL) {
639	xt_free_table_info(newinfo);	641	xt_free_table_info(newinfo);
640	return NULL;	642	return NULL;
641	}	643	}
642	}	644	}
643		645
644	return newinfo;	646	return newinfo;
645	}	647	}
646	EXPORT_SYMBOL(xt_alloc_table_info);	648	EXPORT_SYMBOL(xt_alloc_table_info);
647		649
648	void xt_free_table_info(struct xt_table_info *info)	650	void xt_free_table_info(struct xt_table_info *info)
649	{	651	{
650	int cpu;	652	int cpu;
651		653
652	for_each_possible_cpu(cpu) {	654	for_each_possible_cpu(cpu) {
653	if (info->size <= PAGE_SIZE)	655	if (info->size <= PAGE_SIZE)
654	kfree(info->entries[cpu]);	656	kfree(info->entries[cpu]);
655	else	657	else
656	vfree(info->entries[cpu]);	658	vfree(info->entries[cpu]);
657	}	659	}
658	kfree(info);	660	kfree(info);
659	}	661	}
660	EXPORT_SYMBOL(xt_free_table_info);	662	EXPORT_SYMBOL(xt_free_table_info);
661		663
662	/* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */	664	/* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
663	struct xt_table xt_find_table_lock(struct net net, u_int8_t af,	665	struct xt_table xt_find_table_lock(struct net net, u_int8_t af,
664	const char *name)	666	const char *name)
665	{	667	{
666	struct xt_table *t;	668	struct xt_table *t;
667		669
668	if (mutex_lock_interruptible(&xt[af].mutex) != 0)	670	if (mutex_lock_interruptible(&xt[af].mutex) != 0)
669	return ERR_PTR(-EINTR);	671	return ERR_PTR(-EINTR);
670		672
671	list_for_each_entry(t, &net->xt.tables[af], list)	673	list_for_each_entry(t, &net->xt.tables[af], list)
672	if (strcmp(t->name, name) == 0 && try_module_get(t->me))	674	if (strcmp(t->name, name) == 0 && try_module_get(t->me))
673	return t;	675	return t;
674	mutex_unlock(&xt[af].mutex);	676	mutex_unlock(&xt[af].mutex);
675	return NULL;	677	return NULL;
676	}	678	}
677	EXPORT_SYMBOL_GPL(xt_find_table_lock);	679	EXPORT_SYMBOL_GPL(xt_find_table_lock);
678		680
679	void xt_table_unlock(struct xt_table *table)	681	void xt_table_unlock(struct xt_table *table)
680	{	682	{
681	mutex_unlock(&xt[table->af].mutex);	683	mutex_unlock(&xt[table->af].mutex);
682	}	684	}
683	EXPORT_SYMBOL_GPL(xt_table_unlock);	685	EXPORT_SYMBOL_GPL(xt_table_unlock);
684		686
685	#ifdef CONFIG_COMPAT	687	#ifdef CONFIG_COMPAT
686	void xt_compat_lock(u_int8_t af)	688	void xt_compat_lock(u_int8_t af)
687	{	689	{
688	mutex_lock(&xt[af].compat_mutex);	690	mutex_lock(&xt[af].compat_mutex);
689	}	691	}
690	EXPORT_SYMBOL_GPL(xt_compat_lock);	692	EXPORT_SYMBOL_GPL(xt_compat_lock);
691		693
692	void xt_compat_unlock(u_int8_t af)	694	void xt_compat_unlock(u_int8_t af)
693	{	695	{
694	mutex_unlock(&xt[af].compat_mutex);	696	mutex_unlock(&xt[af].compat_mutex);
695	}	697	}
696	EXPORT_SYMBOL_GPL(xt_compat_unlock);	698	EXPORT_SYMBOL_GPL(xt_compat_unlock);
697	#endif	699	#endif
698		700
699	DEFINE_PER_CPU(struct xt_info_lock, xt_info_locks);	701	DEFINE_PER_CPU(struct xt_info_lock, xt_info_locks);
700	EXPORT_PER_CPU_SYMBOL_GPL(xt_info_locks);	702	EXPORT_PER_CPU_SYMBOL_GPL(xt_info_locks);
701		703
702		704
703	struct xt_table_info *	705	struct xt_table_info *
704	xt_replace_table(struct xt_table *table,	706	xt_replace_table(struct xt_table *table,
705	unsigned int num_counters,	707	unsigned int num_counters,
706	struct xt_table_info *newinfo,	708	struct xt_table_info *newinfo,
707	int *error)	709	int *error)
708	{	710	{
709	struct xt_table_info *private;	711	struct xt_table_info *private;
710		712
711	/* Do the substitution. */	713	/* Do the substitution. */
712	local_bh_disable();	714	local_bh_disable();
713	private = table->private;	715	private = table->private;
714		716
715	/* Check inside lock: is the old number correct? */	717	/* Check inside lock: is the old number correct? */
716	if (num_counters != private->number) {	718	if (num_counters != private->number) {
717	duprintf("num_counters != table->private->number (%u/%u)\n",	719	duprintf("num_counters != table->private->number (%u/%u)\n",
718	num_counters, private->number);	720	num_counters, private->number);
719	local_bh_enable();	721	local_bh_enable();
720	*error = -EAGAIN;	722	*error = -EAGAIN;
721	return NULL;	723	return NULL;
722	}	724	}
723		725
724	table->private = newinfo;	726	table->private = newinfo;
725	newinfo->initial_entries = private->initial_entries;	727	newinfo->initial_entries = private->initial_entries;
726		728
727	/*	729	/*
728	* Even though table entries have now been swapped, other CPU's	730	* Even though table entries have now been swapped, other CPU's
729	* may still be using the old entries. This is okay, because	731	* may still be using the old entries. This is okay, because
730	* resynchronization happens because of the locking done	732	* resynchronization happens because of the locking done
731	* during the get_counters() routine.	733	* during the get_counters() routine.
732	*/	734	*/
733	local_bh_enable();	735	local_bh_enable();
734		736
735	return private;	737	return private;
736	}	738	}
737	EXPORT_SYMBOL_GPL(xt_replace_table);	739	EXPORT_SYMBOL_GPL(xt_replace_table);
738		740
739	struct xt_table xt_register_table(struct net net,	741	struct xt_table xt_register_table(struct net net,
740	const struct xt_table *input_table,	742	const struct xt_table *input_table,
741	struct xt_table_info *bootstrap,	743	struct xt_table_info *bootstrap,
742	struct xt_table_info *newinfo)	744	struct xt_table_info *newinfo)
743	{	745	{
744	int ret;	746	int ret;
745	struct xt_table_info *private;	747	struct xt_table_info *private;
746	struct xt_table t, table;	748	struct xt_table t, table;
747		749
748	/* Don't add one object to multiple lists. */	750	/* Don't add one object to multiple lists. */
749	table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);	751	table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);
750	if (!table) {	752	if (!table) {
751	ret = -ENOMEM;	753	ret = -ENOMEM;
752	goto out;	754	goto out;
753	}	755	}
754		756
755	ret = mutex_lock_interruptible(&xt[table->af].mutex);	757	ret = mutex_lock_interruptible(&xt[table->af].mutex);
756	if (ret != 0)	758	if (ret != 0)
757	goto out_free;	759	goto out_free;
758		760
759	/* Don't autoload: we'd eat our tail... */	761	/* Don't autoload: we'd eat our tail... */
760	list_for_each_entry(t, &net->xt.tables[table->af], list) {	762	list_for_each_entry(t, &net->xt.tables[table->af], list) {
761	if (strcmp(t->name, table->name) == 0) {	763	if (strcmp(t->name, table->name) == 0) {
762	ret = -EEXIST;	764	ret = -EEXIST;
763	goto unlock;	765	goto unlock;
764	}	766	}
765	}	767	}
766		768
767	/* Simplifies replace_table code. */	769	/* Simplifies replace_table code. */
768	table->private = bootstrap;	770	table->private = bootstrap;
769		771
770	if (!xt_replace_table(table, 0, newinfo, &ret))	772	if (!xt_replace_table(table, 0, newinfo, &ret))
771	goto unlock;	773	goto unlock;
772		774
773	private = table->private;	775	private = table->private;
774	duprintf("table->private->number = %u\n", private->number);	776	duprintf("table->private->number = %u\n", private->number);
775		777
776	/* save number of initial entries */	778	/* save number of initial entries */
777	private->initial_entries = private->number;	779	private->initial_entries = private->number;
778		780
779	list_add(&table->list, &net->xt.tables[table->af]);	781	list_add(&table->list, &net->xt.tables[table->af]);
780	mutex_unlock(&xt[table->af].mutex);	782	mutex_unlock(&xt[table->af].mutex);
781	return table;	783	return table;
782		784
783	unlock:	785	unlock:
784	mutex_unlock(&xt[table->af].mutex);	786	mutex_unlock(&xt[table->af].mutex);
785	out_free:	787	out_free:
786	kfree(table);	788	kfree(table);
787	out:	789	out:
788	return ERR_PTR(ret);	790	return ERR_PTR(ret);
789	}	791	}
790	EXPORT_SYMBOL_GPL(xt_register_table);	792	EXPORT_SYMBOL_GPL(xt_register_table);
791		793
792	void xt_unregister_table(struct xt_table table)	794	void xt_unregister_table(struct xt_table table)
793	{	795	{
794	struct xt_table_info *private;	796	struct xt_table_info *private;
795		797
796	mutex_lock(&xt[table->af].mutex);	798	mutex_lock(&xt[table->af].mutex);
797	private = table->private;	799	private = table->private;
798	list_del(&table->list);	800	list_del(&table->list);
799	mutex_unlock(&xt[table->af].mutex);	801	mutex_unlock(&xt[table->af].mutex);
800	kfree(table);	802	kfree(table);
801		803
802	return private;	804	return private;
803	}	805	}
804	EXPORT_SYMBOL_GPL(xt_unregister_table);	806	EXPORT_SYMBOL_GPL(xt_unregister_table);
805		807
806	#ifdef CONFIG_PROC_FS	808	#ifdef CONFIG_PROC_FS
807	struct xt_names_priv {	809	struct xt_names_priv {
808	struct seq_net_private p;	810	struct seq_net_private p;
809	u_int8_t af;	811	u_int8_t af;
810	};	812	};
811	static void xt_table_seq_start(struct seq_file seq, loff_t *pos)	813	static void xt_table_seq_start(struct seq_file seq, loff_t *pos)
812	{	814	{
813	struct xt_names_priv *priv = seq->private;	815	struct xt_names_priv *priv = seq->private;
814	struct net *net = seq_file_net(seq);	816	struct net *net = seq_file_net(seq);
815	u_int8_t af = priv->af;	817	u_int8_t af = priv->af;
816		818
817	mutex_lock(&xt[af].mutex);	819	mutex_lock(&xt[af].mutex);
818	return seq_list_start(&net->xt.tables[af], *pos);	820	return seq_list_start(&net->xt.tables[af], *pos);
819	}	821	}
820		822
821	static void xt_table_seq_next(struct seq_file seq, void v, loff_t pos)	823	static void xt_table_seq_next(struct seq_file seq, void v, loff_t pos)
822	{	824	{
823	struct xt_names_priv *priv = seq->private;	825	struct xt_names_priv *priv = seq->private;
824	struct net *net = seq_file_net(seq);	826	struct net *net = seq_file_net(seq);
825	u_int8_t af = priv->af;	827	u_int8_t af = priv->af;
826		828
827	return seq_list_next(v, &net->xt.tables[af], pos);	829	return seq_list_next(v, &net->xt.tables[af], pos);
828	}	830	}
829		831
830	static void xt_table_seq_stop(struct seq_file seq, void v)	832	static void xt_table_seq_stop(struct seq_file seq, void v)
831	{	833	{
832	struct xt_names_priv *priv = seq->private;	834	struct xt_names_priv *priv = seq->private;
833	u_int8_t af = priv->af;	835	u_int8_t af = priv->af;
834		836
835	mutex_unlock(&xt[af].mutex);	837	mutex_unlock(&xt[af].mutex);
836	}	838	}
837		839
838	static int xt_table_seq_show(struct seq_file seq, void v)	840	static int xt_table_seq_show(struct seq_file seq, void v)
839	{	841	{
840	struct xt_table *table = list_entry(v, struct xt_table, list);	842	struct xt_table *table = list_entry(v, struct xt_table, list);
841		843
842	if (strlen(table->name))	844	if (strlen(table->name))
843	return seq_printf(seq, "%s\n", table->name);	845	return seq_printf(seq, "%s\n", table->name);
844	else	846	else
845	return 0;	847	return 0;
846	}	848	}
847		849
848	static const struct seq_operations xt_table_seq_ops = {	850	static const struct seq_operations xt_table_seq_ops = {
849	.start = xt_table_seq_start,	851	.start = xt_table_seq_start,
850	.next = xt_table_seq_next,	852	.next = xt_table_seq_next,
851	.stop = xt_table_seq_stop,	853	.stop = xt_table_seq_stop,
852	.show = xt_table_seq_show,	854	.show = xt_table_seq_show,
853	};	855	};
854		856
855	static int xt_table_open(struct inode inode, struct file file)	857	static int xt_table_open(struct inode inode, struct file file)
856	{	858	{
857	int ret;	859	int ret;
858	struct xt_names_priv *priv;	860	struct xt_names_priv *priv;
859		861
860	ret = seq_open_net(inode, file, &xt_table_seq_ops,	862	ret = seq_open_net(inode, file, &xt_table_seq_ops,
861	sizeof(struct xt_names_priv));	863	sizeof(struct xt_names_priv));
862	if (!ret) {	864	if (!ret) {
863	priv = ((struct seq_file *)file->private_data)->private;	865	priv = ((struct seq_file *)file->private_data)->private;
864	priv->af = (unsigned long)PDE(inode)->data;	866	priv->af = (unsigned long)PDE(inode)->data;
865	}	867	}
866	return ret;	868	return ret;
867	}	869	}
868		870
869	static const struct file_operations xt_table_ops = {	871	static const struct file_operations xt_table_ops = {
870	.owner = THIS_MODULE,	872	.owner = THIS_MODULE,
871	.open = xt_table_open,	873	.open = xt_table_open,
872	.read = seq_read,	874	.read = seq_read,
873	.llseek = seq_lseek,	875	.llseek = seq_lseek,
874	.release = seq_release_net,	876	.release = seq_release_net,
875	};	877	};
876		878
877	/*	879	/*
878	* Traverse state for ip{,6}_{tables,matches} for helping crossing	880	* Traverse state for ip{,6}_{tables,matches} for helping crossing
879	* the multi-AF mutexes.	881	* the multi-AF mutexes.
880	*/	882	*/
881	struct nf_mttg_trav {	883	struct nf_mttg_trav {
882	struct list_head head, curr;	884	struct list_head head, curr;
883	uint8_t class, nfproto;	885	uint8_t class, nfproto;
884	};	886	};
885		887
886	enum {	888	enum {
887	MTTG_TRAV_INIT,	889	MTTG_TRAV_INIT,
888	MTTG_TRAV_NFP_UNSPEC,	890	MTTG_TRAV_NFP_UNSPEC,
889	MTTG_TRAV_NFP_SPEC,	891	MTTG_TRAV_NFP_SPEC,
890	MTTG_TRAV_DONE,	892	MTTG_TRAV_DONE,
891	};	893	};
892		894
893	static void xt_mttg_seq_next(struct seq_file seq, void v, loff_t ppos,	895	static void xt_mttg_seq_next(struct seq_file seq, void v, loff_t ppos,
894	bool is_target)	896	bool is_target)
895	{	897	{
896	static const uint8_t next_class[] = {	898	static const uint8_t next_class[] = {
897	[MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,	899	[MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
898	[MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE,	900	[MTTG_TRAV_NFP_SPEC] = MTTG_TRAV_DONE,
899	};	901	};
900	struct nf_mttg_trav *trav = seq->private;	902	struct nf_mttg_trav *trav = seq->private;
901		903
902	switch (trav->class) {	904	switch (trav->class) {
903	case MTTG_TRAV_INIT:	905	case MTTG_TRAV_INIT:
904	trav->class = MTTG_TRAV_NFP_UNSPEC;	906	trav->class = MTTG_TRAV_NFP_UNSPEC;
905	mutex_lock(&xt[NFPROTO_UNSPEC].mutex);	907	mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
906	trav->head = trav->curr = is_target ?	908	trav->head = trav->curr = is_target ?
907	&xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;	909	&xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
908	break;	910	break;
909	case MTTG_TRAV_NFP_UNSPEC:	911	case MTTG_TRAV_NFP_UNSPEC:
910	trav->curr = trav->curr->next;	912	trav->curr = trav->curr->next;
911	if (trav->curr != trav->head)	913	if (trav->curr != trav->head)
912	break;	914	break;
913	mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);	915	mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
914	mutex_lock(&xt[trav->nfproto].mutex);	916	mutex_lock(&xt[trav->nfproto].mutex);
915	trav->head = trav->curr = is_target ?	917	trav->head = trav->curr = is_target ?
916	&xt[trav->nfproto].target : &xt[trav->nfproto].match;	918	&xt[trav->nfproto].target : &xt[trav->nfproto].match;
917	trav->class = next_class[trav->class];	919	trav->class = next_class[trav->class];
918	break;	920	break;
919	case MTTG_TRAV_NFP_SPEC:	921	case MTTG_TRAV_NFP_SPEC:
920	trav->curr = trav->curr->next;	922	trav->curr = trav->curr->next;
921	if (trav->curr != trav->head)	923	if (trav->curr != trav->head)
922	break;	924	break;
923	/* fallthru, _stop will unlock */	925	/* fallthru, _stop will unlock */
924	default:	926	default:
925	return NULL;	927	return NULL;
926	}	928	}
927		929
928	if (ppos != NULL)	930	if (ppos != NULL)
929	++*ppos;	931	++*ppos;
930	return trav;	932	return trav;
931	}	933	}
932		934
933	static void xt_mttg_seq_start(struct seq_file seq, loff_t *pos,	935	static void xt_mttg_seq_start(struct seq_file seq, loff_t *pos,
934	bool is_target)	936	bool is_target)
935	{	937	{
936	struct nf_mttg_trav *trav = seq->private;	938	struct nf_mttg_trav *trav = seq->private;
937	unsigned int j;	939	unsigned int j;
938		940
939	trav->class = MTTG_TRAV_INIT;	941	trav->class = MTTG_TRAV_INIT;
940	for (j = 0; j < *pos; ++j)	942	for (j = 0; j < *pos; ++j)
941	if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)	943	if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
942	return NULL;	944	return NULL;
943	return trav;	945	return trav;
944	}	946	}
945		947
946	static void xt_mttg_seq_stop(struct seq_file seq, void v)	948	static void xt_mttg_seq_stop(struct seq_file seq, void v)
947	{	949	{
948	struct nf_mttg_trav *trav = seq->private;	950	struct nf_mttg_trav *trav = seq->private;
949		951
950	switch (trav->class) {	952	switch (trav->class) {
951	case MTTG_TRAV_NFP_UNSPEC:	953	case MTTG_TRAV_NFP_UNSPEC:
952	mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);	954	mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
953	break;	955	break;
954	case MTTG_TRAV_NFP_SPEC:	956	case MTTG_TRAV_NFP_SPEC:
955	mutex_unlock(&xt[trav->nfproto].mutex);	957	mutex_unlock(&xt[trav->nfproto].mutex);
956	break;	958	break;
957	}	959	}
958	}	960	}
959		961
960	static void xt_match_seq_start(struct seq_file seq, loff_t *pos)	962	static void xt_match_seq_start(struct seq_file seq, loff_t *pos)
961	{	963	{
962	return xt_mttg_seq_start(seq, pos, false);	964	return xt_mttg_seq_start(seq, pos, false);
963	}	965	}
964		966
965	static void xt_match_seq_next(struct seq_file seq, void v, loff_t ppos)	967	static void xt_match_seq_next(struct seq_file seq, void v, loff_t ppos)
966	{	968	{
967	return xt_mttg_seq_next(seq, v, ppos, false);	969	return xt_mttg_seq_next(seq, v, ppos, false);
968	}	970	}
969		971
970	static int xt_match_seq_show(struct seq_file seq, void v)	972	static int xt_match_seq_show(struct seq_file seq, void v)
971	{	973	{
972	const struct nf_mttg_trav *trav = seq->private;	974	const struct nf_mttg_trav *trav = seq->private;
973	const struct xt_match *match;	975	const struct xt_match *match;
974		976
975	switch (trav->class) {	977	switch (trav->class) {
976	case MTTG_TRAV_NFP_UNSPEC:	978	case MTTG_TRAV_NFP_UNSPEC:
977	case MTTG_TRAV_NFP_SPEC:	979	case MTTG_TRAV_NFP_SPEC:
978	if (trav->curr == trav->head)	980	if (trav->curr == trav->head)
979	return 0;	981	return 0;
980	match = list_entry(trav->curr, struct xt_match, list);	982	match = list_entry(trav->curr, struct xt_match, list);
981	return (*match->name == '\0') ? 0 :	983	return (*match->name == '\0') ? 0 :
982	seq_printf(seq, "%s\n", match->name);	984	seq_printf(seq, "%s\n", match->name);
983	}	985	}
984	return 0;	986	return 0;
985	}	987	}
986		988
987	static const struct seq_operations xt_match_seq_ops = {	989	static const struct seq_operations xt_match_seq_ops = {
988	.start = xt_match_seq_start,	990	.start = xt_match_seq_start,
989	.next = xt_match_seq_next,	991	.next = xt_match_seq_next,
990	.stop = xt_mttg_seq_stop,	992	.stop = xt_mttg_seq_stop,
991	.show = xt_match_seq_show,	993	.show = xt_match_seq_show,
992	};	994	};
993		995
994	static int xt_match_open(struct inode inode, struct file file)	996	static int xt_match_open(struct inode inode, struct file file)
995	{	997	{
996	struct seq_file *seq;	998	struct seq_file *seq;
997	struct nf_mttg_trav *trav;	999	struct nf_mttg_trav *trav;
998	int ret;	1000	int ret;
999		1001
1000	trav = kmalloc(sizeof(*trav), GFP_KERNEL);	1002	trav = kmalloc(sizeof(*trav), GFP_KERNEL);
1001	if (trav == NULL)	1003	if (trav == NULL)
1002	return -ENOMEM;	1004	return -ENOMEM;
1003		1005
1004	ret = seq_open(file, &xt_match_seq_ops);	1006	ret = seq_open(file, &xt_match_seq_ops);
1005	if (ret < 0) {	1007	if (ret < 0) {
1006	kfree(trav);	1008	kfree(trav);
1007	return ret;	1009	return ret;
1008	}	1010	}
1009		1011
1010	seq = file->private_data;	1012	seq = file->private_data;
1011	seq->private = trav;	1013	seq->private = trav;
1012	trav->nfproto = (unsigned long)PDE(inode)->data;	1014	trav->nfproto = (unsigned long)PDE(inode)->data;
1013	return 0;	1015	return 0;
1014	}	1016	}
1015		1017
1016	static const struct file_operations xt_match_ops = {	1018	static const struct file_operations xt_match_ops = {
1017	.owner = THIS_MODULE,	1019	.owner = THIS_MODULE,
1018	.open = xt_match_open,	1020	.open = xt_match_open,
1019	.read = seq_read,	1021	.read = seq_read,
1020	.llseek = seq_lseek,	1022	.llseek = seq_lseek,
1021	.release = seq_release_private,	1023	.release = seq_release_private,
1022	};	1024	};
1023		1025
1024	static void xt_target_seq_start(struct seq_file seq, loff_t *pos)	1026	static void xt_target_seq_start(struct seq_file seq, loff_t *pos)
1025	{	1027	{
1026	return xt_mttg_seq_start(seq, pos, true);	1028	return xt_mttg_seq_start(seq, pos, true);
1027	}	1029	}
1028		1030
1029	static void xt_target_seq_next(struct seq_file seq, void v, loff_t ppos)	1031	static void xt_target_seq_next(struct seq_file seq, void v, loff_t ppos)
1030	{	1032	{
1031	return xt_mttg_seq_next(seq, v, ppos, true);	1033	return xt_mttg_seq_next(seq, v, ppos, true);
1032	}	1034	}
1033		1035
1034	static int xt_target_seq_show(struct seq_file seq, void v)	1036	static int xt_target_seq_show(struct seq_file seq, void v)
1035	{	1037	{
1036	const struct nf_mttg_trav *trav = seq->private;	1038	const struct nf_mttg_trav *trav = seq->private;
1037	const struct xt_target *target;	1039	const struct xt_target *target;
1038		1040
1039	switch (trav->class) {	1041	switch (trav->class) {
1040	case MTTG_TRAV_NFP_UNSPEC:	1042	case MTTG_TRAV_NFP_UNSPEC:
1041	case MTTG_TRAV_NFP_SPEC:	1043	case MTTG_TRAV_NFP_SPEC:
1042	if (trav->curr == trav->head)	1044	if (trav->curr == trav->head)
1043	return 0;	1045	return 0;
1044	target = list_entry(trav->curr, struct xt_target, list);	1046	target = list_entry(trav->curr, struct xt_target, list);
1045	return (*target->name == '\0') ? 0 :	1047	return (*target->name == '\0') ? 0 :
1046	seq_printf(seq, "%s\n", target->name);	1048	seq_printf(seq, "%s\n", target->name);
1047	}	1049	}
1048	return 0;	1050	return 0;
1049	}	1051	}
1050		1052
1051	static const struct seq_operations xt_target_seq_ops = {	1053	static const struct seq_operations xt_target_seq_ops = {
1052	.start = xt_target_seq_start,	1054	.start = xt_target_seq_start,
1053	.next = xt_target_seq_next,	1055	.next = xt_target_seq_next,
1054	.stop = xt_mttg_seq_stop,	1056	.stop = xt_mttg_seq_stop,
1055	.show = xt_target_seq_show,	1057	.show = xt_target_seq_show,
1056	};	1058	};
1057		1059
1058	static int xt_target_open(struct inode inode, struct file file)	1060	static int xt_target_open(struct inode inode, struct file file)
1059	{	1061	{
1060	struct seq_file *seq;	1062	struct seq_file *seq;
1061	struct nf_mttg_trav *trav;	1063	struct nf_mttg_trav *trav;
1062	int ret;	1064	int ret;
1063		1065
1064	trav = kmalloc(sizeof(*trav), GFP_KERNEL);	1066	trav = kmalloc(sizeof(*trav), GFP_KERNEL);
1065	if (trav == NULL)	1067	if (trav == NULL)
1066	return -ENOMEM;	1068	return -ENOMEM;
1067		1069
1068	ret = seq_open(file, &xt_target_seq_ops);	1070	ret = seq_open(file, &xt_target_seq_ops);
1069	if (ret < 0) {	1071	if (ret < 0) {
1070	kfree(trav);	1072	kfree(trav);
1071	return ret;	1073	return ret;
1072	}	1074	}
1073		1075
1074	seq = file->private_data;	1076	seq = file->private_data;
1075	seq->private = trav;	1077	seq->private = trav;
1076	trav->nfproto = (unsigned long)PDE(inode)->data;	1078	trav->nfproto = (unsigned long)PDE(inode)->data;
1077	return 0;	1079	return 0;
1078	}	1080	}
1079		1081
1080	static const struct file_operations xt_target_ops = {	1082	static const struct file_operations xt_target_ops = {
1081	.owner = THIS_MODULE,	1083	.owner = THIS_MODULE,
1082	.open = xt_target_open,	1084	.open = xt_target_open,
1083	.read = seq_read,	1085	.read = seq_read,
1084	.llseek = seq_lseek,	1086	.llseek = seq_lseek,
1085	.release = seq_release_private,	1087	.release = seq_release_private,
1086	};	1088	};
1087		1089
1088	#define FORMAT_TABLES "_tables_names"	1090	#define FORMAT_TABLES "_tables_names"
1089	#define FORMAT_MATCHES "_tables_matches"	1091	#define FORMAT_MATCHES "_tables_matches"
1090	#define FORMAT_TARGETS "_tables_targets"	1092	#define FORMAT_TARGETS "_tables_targets"
1091		1093
1092	#endif /* CONFIG_PROC_FS */	1094	#endif /* CONFIG_PROC_FS */
1093		1095
1094	/**	1096	/**
1095	* xt_hook_link - set up hooks for a new table	1097	* xt_hook_link - set up hooks for a new table
1096	* @table: table with metadata needed to set up hooks	1098	* @table: table with metadata needed to set up hooks
1097	* @fn: Hook function	1099	* @fn: Hook function
1098	*	1100	*
1099	* This function will take care of creating and registering the necessary	1101	* This function will take care of creating and registering the necessary
1100	* Netfilter hooks for XT tables.	1102	* Netfilter hooks for XT tables.
1101	*/	1103	*/
1102	struct nf_hook_ops xt_hook_link(const struct xt_table table, nf_hookfn *fn)	1104	struct nf_hook_ops xt_hook_link(const struct xt_table table, nf_hookfn *fn)
1103	{	1105	{
1104	unsigned int hook_mask = table->valid_hooks;	1106	unsigned int hook_mask = table->valid_hooks;
1105	uint8_t i, num_hooks = hweight32(hook_mask);	1107	uint8_t i, num_hooks = hweight32(hook_mask);
1106	uint8_t hooknum;	1108	uint8_t hooknum;
1107	struct nf_hook_ops *ops;	1109	struct nf_hook_ops *ops;
1108	int ret;	1110	int ret;
1109		1111
1110	ops = kmalloc(sizeof(ops) num_hooks, GFP_KERNEL);	1112	ops = kmalloc(sizeof(ops) num_hooks, GFP_KERNEL);
1111	if (ops == NULL)	1113	if (ops == NULL)
1112	return ERR_PTR(-ENOMEM);	1114	return ERR_PTR(-ENOMEM);
1113		1115
1114	for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0;	1116	for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0;
1115	hook_mask >>= 1, ++hooknum) {	1117	hook_mask >>= 1, ++hooknum) {
1116	if (!(hook_mask & 1))	1118	if (!(hook_mask & 1))
1117	continue;	1119	continue;
1118	ops[i].hook = fn;	1120	ops[i].hook = fn;
1119	ops[i].owner = table->me;	1121	ops[i].owner = table->me;
1120	ops[i].pf = table->af;	1122	ops[i].pf = table->af;
1121	ops[i].hooknum = hooknum;	1123	ops[i].hooknum = hooknum;
1122	ops[i].priority = table->priority;	1124	ops[i].priority = table->priority;
1123	++i;	1125	++i;
1124	}	1126	}
1125		1127
1126	ret = nf_register_hooks(ops, num_hooks);	1128	ret = nf_register_hooks(ops, num_hooks);
1127	if (ret < 0) {	1129	if (ret < 0) {
1128	kfree(ops);	1130	kfree(ops);
1129	return ERR_PTR(ret);	1131	return ERR_PTR(ret);
1130	}	1132	}
1131		1133
1132	return ops;	1134	return ops;
1133	}	1135	}
1134	EXPORT_SYMBOL_GPL(xt_hook_link);	1136	EXPORT_SYMBOL_GPL(xt_hook_link);
1135		1137
1136	/**	1138	/**
1137	* xt_hook_unlink - remove hooks for a table	1139	* xt_hook_unlink - remove hooks for a table
1138	* @ops: nf_hook_ops array as returned by nf_hook_link	1140	* @ops: nf_hook_ops array as returned by nf_hook_link
1139	* @hook_mask: the very same mask that was passed to nf_hook_link	1141	* @hook_mask: the very same mask that was passed to nf_hook_link
1140	*/	1142	*/
1141	void xt_hook_unlink(const struct xt_table table, struct nf_hook_ops ops)	1143	void xt_hook_unlink(const struct xt_table table, struct nf_hook_ops ops)
1142	{	1144	{
1143	nf_unregister_hooks(ops, hweight32(table->valid_hooks));	1145	nf_unregister_hooks(ops, hweight32(table->valid_hooks));
1144	kfree(ops);	1146	kfree(ops);
1145	}	1147	}
1146	EXPORT_SYMBOL_GPL(xt_hook_unlink);	1148	EXPORT_SYMBOL_GPL(xt_hook_unlink);
1147		1149
1148	int xt_proto_init(struct net *net, u_int8_t af)	1150	int xt_proto_init(struct net *net, u_int8_t af)
1149	{	1151	{
1150	#ifdef CONFIG_PROC_FS	1152	#ifdef CONFIG_PROC_FS
1151	char buf[XT_FUNCTION_MAXNAMELEN];	1153	char buf[XT_FUNCTION_MAXNAMELEN];
1152	struct proc_dir_entry *proc;	1154	struct proc_dir_entry *proc;
1153	#endif	1155	#endif
1154		1156
1155	if (af >= ARRAY_SIZE(xt_prefix))	1157	if (af >= ARRAY_SIZE(xt_prefix))
1156	return -EINVAL;	1158	return -EINVAL;
1157		1159
1158		1160
1159	#ifdef CONFIG_PROC_FS	1161	#ifdef CONFIG_PROC_FS
1160	strlcpy(buf, xt_prefix[af], sizeof(buf));	1162	strlcpy(buf, xt_prefix[af], sizeof(buf));
1161	strlcat(buf, FORMAT_TABLES, sizeof(buf));	1163	strlcat(buf, FORMAT_TABLES, sizeof(buf));
1162	proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops,	1164	proc = proc_create_data(buf, 0440, net->proc_net, &xt_table_ops,
1163	(void *)(unsigned long)af);	1165	(void *)(unsigned long)af);
1164	if (!proc)	1166	if (!proc)
1165	goto out;	1167	goto out;
1166		1168
1167	strlcpy(buf, xt_prefix[af], sizeof(buf));	1169	strlcpy(buf, xt_prefix[af], sizeof(buf));
1168	strlcat(buf, FORMAT_MATCHES, sizeof(buf));	1170	strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1169	proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops,	1171	proc = proc_create_data(buf, 0440, net->proc_net, &xt_match_ops,
1170	(void *)(unsigned long)af);	1172	(void *)(unsigned long)af);
1171	if (!proc)	1173	if (!proc)
1172	goto out_remove_tables;	1174	goto out_remove_tables;
1173		1175
1174	strlcpy(buf, xt_prefix[af], sizeof(buf));	1176	strlcpy(buf, xt_prefix[af], sizeof(buf));
1175	strlcat(buf, FORMAT_TARGETS, sizeof(buf));	1177	strlcat(buf, FORMAT_TARGETS, sizeof(buf));
1176	proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops,	1178	proc = proc_create_data(buf, 0440, net->proc_net, &xt_target_ops,
1177	(void *)(unsigned long)af);	1179	(void *)(unsigned long)af);
1178	if (!proc)	1180	if (!proc)
1179	goto out_remove_matches;	1181	goto out_remove_matches;
1180	#endif	1182	#endif
1181		1183
1182	return 0;	1184	return 0;
1183		1185
1184	#ifdef CONFIG_PROC_FS	1186	#ifdef CONFIG_PROC_FS
1185	out_remove_matches:	1187	out_remove_matches:
1186	strlcpy(buf, xt_prefix[af], sizeof(buf));	1188	strlcpy(buf, xt_prefix[af], sizeof(buf));
1187	strlcat(buf, FORMAT_MATCHES, sizeof(buf));	1189	strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1188	proc_net_remove(net, buf);	1190	proc_net_remove(net, buf);
1189		1191
1190	out_remove_tables:	1192	out_remove_tables:
1191	strlcpy(buf, xt_prefix[af], sizeof(buf));	1193	strlcpy(buf, xt_prefix[af], sizeof(buf));
1192	strlcat(buf, FORMAT_TABLES, sizeof(buf));	1194	strlcat(buf, FORMAT_TABLES, sizeof(buf));
1193	proc_net_remove(net, buf);	1195	proc_net_remove(net, buf);
1194	out:	1196	out:
1195	return -1;	1197	return -1;
1196	#endif	1198	#endif
1197	}	1199	}
1198	EXPORT_SYMBOL_GPL(xt_proto_init);	1200	EXPORT_SYMBOL_GPL(xt_proto_init);
1199		1201
1200	void xt_proto_fini(struct net *net, u_int8_t af)	1202	void xt_proto_fini(struct net *net, u_int8_t af)
1201	{	1203	{
1202	#ifdef CONFIG_PROC_FS	1204	#ifdef CONFIG_PROC_FS
1203	char buf[XT_FUNCTION_MAXNAMELEN];	1205	char buf[XT_FUNCTION_MAXNAMELEN];
1204		1206
1205	strlcpy(buf, xt_prefix[af], sizeof(buf));	1207	strlcpy(buf, xt_prefix[af], sizeof(buf));
1206	strlcat(buf, FORMAT_TABLES, sizeof(buf));	1208	strlcat(buf, FORMAT_TABLES, sizeof(buf));
1207	proc_net_remove(net, buf);	1209	proc_net_remove(net, buf);
1208		1210
1209	strlcpy(buf, xt_prefix[af], sizeof(buf));	1211	strlcpy(buf, xt_prefix[af], sizeof(buf));
1210	strlcat(buf, FORMAT_TARGETS, sizeof(buf));	1212	strlcat(buf, FORMAT_TARGETS, sizeof(buf));
1211	proc_net_remove(net, buf);	1213	proc_net_remove(net, buf);
1212		1214
1213	strlcpy(buf, xt_prefix[af], sizeof(buf));	1215	strlcpy(buf, xt_prefix[af], sizeof(buf));
1214	strlcat(buf, FORMAT_MATCHES, sizeof(buf));	1216	strlcat(buf, FORMAT_MATCHES, sizeof(buf));
1215	proc_net_remove(net, buf);	1217	proc_net_remove(net, buf);
1216	#endif /CONFIG_PROC_FS/	1218	#endif /CONFIG_PROC_FS/
1217	}	1219	}
1218	EXPORT_SYMBOL_GPL(xt_proto_fini);	1220	EXPORT_SYMBOL_GPL(xt_proto_fini);
1219		1221
1220	static int __net_init xt_net_init(struct net *net)	1222	static int __net_init xt_net_init(struct net *net)
1221	{	1223	{
1222	int i;	1224	int i;
1223		1225
1224	for (i = 0; i < NFPROTO_NUMPROTO; i++)	1226	for (i = 0; i < NFPROTO_NUMPROTO; i++)
1225	INIT_LIST_HEAD(&net->xt.tables[i]);	1227	INIT_LIST_HEAD(&net->xt.tables[i]);
1226	return 0;	1228	return 0;
1227	}	1229	}
1228		1230
1229	static struct pernet_operations xt_net_ops = {	1231	static struct pernet_operations xt_net_ops = {
1230	.init = xt_net_init,	1232	.init = xt_net_init,
1231	};	1233	};
1232		1234
1233	static int __init xt_init(void)	1235	static int __init xt_init(void)
1234	{	1236	{
1235	unsigned int i;	1237	unsigned int i;
1236	int rv;	1238	int rv;
1237		1239
1238	for_each_possible_cpu(i) {	1240	for_each_possible_cpu(i) {
1239	struct xt_info_lock *lock = &per_cpu(xt_info_locks, i);	1241	struct xt_info_lock *lock = &per_cpu(xt_info_locks, i);
1240	spin_lock_init(&lock->lock);	1242	spin_lock_init(&lock->lock);
1241	lock->readers = 0;	1243	lock->readers = 0;
1242	}	1244	}
1243		1245
1244	xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);	1246	xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
1245	if (!xt)	1247	if (!xt)
1246	return -ENOMEM;	1248	return -ENOMEM;
1247		1249
1248	for (i = 0; i < NFPROTO_NUMPROTO; i++) {	1250	for (i = 0; i < NFPROTO_NUMPROTO; i++) {
1249	mutex_init(&xt[i].mutex);	1251	mutex_init(&xt[i].mutex);
1250	#ifdef CONFIG_COMPAT	1252	#ifdef CONFIG_COMPAT
1251	mutex_init(&xt[i].compat_mutex);	1253	mutex_init(&xt[i].compat_mutex);
1252	xt[i].compat_offsets = NULL;	1254	xt[i].compat_offsets = NULL;
1253	#endif	1255	#endif
1254	INIT_LIST_HEAD(&xt[i].target);	1256	INIT_LIST_HEAD(&xt[i].target);
1255	INIT_LIST_HEAD(&xt[i].match);	1257	INIT_LIST_HEAD(&xt[i].match);
1256	}	1258	}
1257	rv = register_pernet_subsys(&xt_net_ops);	1259	rv = register_pernet_subsys(&xt_net_ops);
1258	if (rv < 0)	1260	if (rv < 0)
1259	kfree(xt);	1261	kfree(xt);
1260	return rv;	1262	return rv;
1261	}	1263	}
1262		1264
1263	static void __exit xt_fini(void)	1265	static void __exit xt_fini(void)
1264	{	1266	{
1265	unregister_pernet_subsys(&xt_net_ops);	1267	unregister_pernet_subsys(&xt_net_ops);
1266	kfree(xt);	1268	kfree(xt);
1267	}	1269	}
1268		1270
1269	module_init(xt_init);	1271	module_init(xt_init);
1270	module_exit(xt_fini);	1272	module_exit(xt_fini);
1271		1273
1272		1274

net/netfilter/xt_repldata.h

Diff comments View file @ e3eaa99

File was created	1	/*
	2	* Today's hack: quantum tunneling in structs
	3	*
	4	* 'entries' and 'term' are never anywhere referenced by word in code. In fact,
	5	* they serve as the hanging-off data accessed through repl.data[].
	6	*/
	7
	8	#define xt_alloc_initial_table(type, typ2) ({ \
	9	unsigned int hook_mask = info->valid_hooks; \
	10	unsigned int nhooks = hweight32(hook_mask); \
	11	unsigned int bytes = 0, hooknum = 0, i = 0; \
	12	struct { \
	13	struct type##_replace repl; \
	14	struct type##_standard entries[nhooks]; \
	15	struct type##_error term; \
	16	} tbl = kzalloc(sizeof(tbl), GFP_KERNEL); \
	17	if (tbl == NULL) \
	18	return NULL; \
	19	strncpy(tbl->repl.name, info->name, sizeof(tbl->repl.name)); \
	20	tbl->term = (struct type##_error)typ2##_ERROR_INIT; \
	21	tbl->repl.valid_hooks = hook_mask; \
	22	tbl->repl.num_entries = nhooks + 1; \
	23	tbl->repl.size = nhooks * sizeof(struct type##_standard) + \
	24	sizeof(struct type##_error); \
	25	for (; hook_mask != 0; hook_mask >>= 1, ++hooknum) { \
	26	if (!(hook_mask & 1)) \
	27	continue; \
	28	tbl->repl.hook_entry[hooknum] = bytes; \
	29	tbl->repl.underflow[hooknum] = bytes; \
	30	tbl->entries[i++] = (struct type##_standard) \
	31	typ2##_STANDARD_INIT(NF_ACCEPT); \
	32	bytes += sizeof(struct type##_standard); \
	33	} \
	34	tbl; \
	35	})
	36