/* * Packet matching code. * * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling * Copyright (C) 2000-2002 Netfilter core team <coreteam@netfilter.org> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. * * 19 Jan 2002 Harald Welte <laforge@gnumonks.org> * 	- increase module usage count as soon as we have rules inside * 	  a table * 06 Jun 2002 Andras Kis-Szabo <kisza@sch.bme.hu> *      - new extension header parser code */#include <linux/config.h>#include <linux/skbuff.h>#include <linux/kmod.h>#include <linux/vmalloc.h>#include <linux/netdevice.h>#include <linux/module.h>#include <linux/tcp.h>#include <linux/udp.h>#include <linux/icmpv6.h>#include <net/ip.h>#include <net/ipv6.h>#include <asm/uaccess.h>#include <asm/semaphore.h>#include <linux/proc_fs.h>#include <linux/netfilter_ipv6/ip6_tables.h>MODULE_LICENSE("GPL");MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");MODULE_DESCRIPTION("IPv6 packet filter");#define IPV6_HDR_LEN	(sizeof(struct ipv6hdr))#define IPV6_OPTHDR_LEN	(sizeof(struct ipv6_opt_hdr))/*#define DEBUG_IP_FIREWALL*//*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging *//*#define DEBUG_IP_FIREWALL_USER*/#ifdef DEBUG_IP_FIREWALL#define dprintf(format, args...)  printk(format , ## args)#else#define dprintf(format, args...)#endif#ifdef DEBUG_IP_FIREWALL_USER#define duprintf(format, args...) printk(format , ## args)#else#define duprintf(format, args...)#endif#ifdef CONFIG_NETFILTER_DEBUG#define IP_NF_ASSERT(x)						\do {								\	if (!(x))						\		printk("IP_NF_ASSERT: %s:%s:%u\n",		\		       __FUNCTION__, __FILE__, __LINE__);	\} while(0)#else#define IP_NF_ASSERT(x)#endif#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))/* Must have mutex */#define ASSERT_READ_LOCK(x) IP_NF_ASSERT(down_trylock(&ip6t_mutex) != 0)#define ASSERT_WRITE_LOCK(x) IP_NF_ASSERT(down_trylock(&ip6t_mutex) != 0)#include <linux/netfilter_ipv4/lockhelp.h>#include <linux/netfilter_ipv4/listhelp.h>#if 0/* All the better to debug you with... */#define static#define inline#endif/* Locking is simple: we assume at worst case there will be one packet   in user context and one from bottom halves (or soft irq if Alexey's   softnet patch was applied).   We keep a set of rules for each CPU, so we can avoid write-locking   them; doing a readlock_bh() stops packets coming through if we're   in user context.   To be cache friendly on SMP, we arrange them like so:   [ n-entries ]   ... cache-align padding ...   [ n-entries ]   Hence the start of any table is given by get_table() below.  *//* The table itself */struct ip6t_table_info{	/* Size per table */	unsigned int size;	/* Number of entries: FIXME. --RR */	unsigned int number;	/* Initial number of entries. Needed for module usage count */	unsigned int initial_entries;	/* Entry points and underflows */	unsigned int hook_entry[NF_IP6_NUMHOOKS];	unsigned int underflow[NF_IP6_NUMHOOKS];	/* ip6t_entry tables: one per CPU */	char entries[0] ____cacheline_aligned;};static LIST_HEAD(ip6t_target);static LIST_HEAD(ip6t_match);static LIST_HEAD(ip6t_tables);#define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)#ifdef CONFIG_SMP#define TABLE_OFFSET(t,p) (SMP_ALIGN((t)->size)*(p))#else#define TABLE_OFFSET(t,p) 0#endif#if 0#define down(x) do { printk("DOWN:%u:" #x "\n", __LINE__); down(x); } while(0)#define down_interruptible(x) ({ int __r; printk("DOWNi:%u:" #x "\n", __LINE__); __r = down_interruptible(x); if (__r != 0) printk("ABORT-DOWNi:%u\n", __LINE__); __r; })#define up(x) do { printk("UP:%u:" #x "\n", __LINE__); up(x); } while(0)#endifstatic int ip6_masked_addrcmp(struct in6_addr addr1, struct in6_addr mask,			      struct in6_addr addr2){	int i;	for( i = 0; i < 16; i++){		if((addr1.s6_addr[i] & mask.s6_addr[i]) != 		   (addr2.s6_addr[i] & mask.s6_addr[i]))			return 1;	}	return 0;}/* Check for an extension */int ip6t_ext_hdr(u8 nexthdr){        return ( (nexthdr == IPPROTO_HOPOPTS)   ||                 (nexthdr == IPPROTO_ROUTING)   ||                 (nexthdr == IPPROTO_FRAGMENT)  ||                 (nexthdr == IPPROTO_ESP)       ||                 (nexthdr == IPPROTO_AH)        ||                 (nexthdr == IPPROTO_NONE)      ||                 (nexthdr == IPPROTO_DSTOPTS) );}/* Returns whether matches rule or not. */static inline intip6_packet_match(const struct sk_buff *skb,		 const struct ipv6hdr *ipv6,		 const char *indev,		 const char *outdev,		 const struct ip6t_ip6 *ip6info,		 int isfrag){	size_t i;	unsigned long ret;#define FWINV(bool,invflg) ((bool) ^ !!(ip6info->invflags & invflg))	if (FWINV(ip6_masked_addrcmp(ipv6->saddr,ip6info->smsk,ip6info->src),		  IP6T_INV_SRCIP)	    || FWINV(ip6_masked_addrcmp(ipv6->daddr,ip6info->dmsk,ip6info->dst),		     IP6T_INV_DSTIP)) {		dprintf("Source or dest mismatch.\n");/*		dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,			ipinfo->smsk.s_addr, ipinfo->src.s_addr,			ipinfo->invflags & IP6T_INV_SRCIP ? " (INV)" : "");		dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,			ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,			ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/		return 0;	}	/* Look for ifname matches; this should unroll nicely. */	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {		ret |= (((const unsigned long *)indev)[i]			^ ((const unsigned long *)ip6info->iniface)[i])			& ((const unsigned long *)ip6info->iniface_mask)[i];	}	if (FWINV(ret != 0, IP6T_INV_VIA_IN)) {		dprintf("VIA in mismatch (%s vs %s).%s\n",			indev, ip6info->iniface,			ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");		return 0;	}	for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {		ret |= (((const unsigned long *)outdev)[i]			^ ((const unsigned long *)ip6info->outiface)[i])			& ((const unsigned long *)ip6info->outiface_mask)[i];	}	if (FWINV(ret != 0, IP6T_INV_VIA_OUT)) {		dprintf("VIA out mismatch (%s vs %s).%s\n",			outdev, ip6info->outiface,			ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");		return 0;	}/* ... might want to do something with class and flowlabel here ... */	/* look for the desired protocol header */	if((ip6info->flags & IP6T_F_PROTO)) {		u_int8_t currenthdr = ipv6->nexthdr;		struct ipv6_opt_hdr *hdrptr;		u_int16_t ptr;		/* Header offset in skb */		u_int16_t hdrlen;	/* Header */		ptr = IPV6_HDR_LEN;		while (ip6t_ext_hdr(currenthdr)) {	                /* Is there enough space for the next ext header? */	                if (skb->len - ptr < IPV6_OPTHDR_LEN)	                        return 0;			/* NONE or ESP: there isn't protocol part */			/* If we want to count these packets in '-p all',			 * we will change the return 0 to 1*/			if ((currenthdr == IPPROTO_NONE) || 				(currenthdr == IPPROTO_ESP))				return 0;	                hdrptr = (struct ipv6_opt_hdr *)(skb->data + ptr);			/* Size calculation */	                if (currenthdr == IPPROTO_FRAGMENT) {	                        hdrlen = 8;	                } else if (currenthdr == IPPROTO_AH)	                        hdrlen = (hdrptr->hdrlen+2)<<2;	                else	                        hdrlen = ipv6_optlen(hdrptr);			currenthdr = hdrptr->nexthdr;	                ptr += hdrlen;			/* ptr is too large */	                if ( ptr > skb->len ) 				return 0;		}		/* currenthdr contains the protocol header */		dprintf("Packet protocol %hi ?= %s%hi.\n",				currenthdr, 				ip6info->invflags & IP6T_INV_PROTO ? "!":"",				ip6info->proto);		if (ip6info->proto == currenthdr) {			if(ip6info->invflags & IP6T_INV_PROTO) {				return 0;			}			return 1;		}		/* We need match for the '-p all', too! */		if ((ip6info->proto != 0) &&			!(ip6info->invflags & IP6T_INV_PROTO))			return 0;	}	return 1;}/* should be ip6 safe */static inline int ip6_checkentry(const struct ip6t_ip6 *ipv6){	if (ipv6->flags & ~IP6T_F_MASK) {		duprintf("Unknown flag bits set: %08X\n",			 ipv6->flags & ~IP6T_F_MASK);		return 0;	}	if (ipv6->invflags & ~IP6T_INV_MASK) {		duprintf("Unknown invflag bits set: %08X\n",			 ipv6->invflags & ~IP6T_INV_MASK);		return 0;	}	return 1;}static unsigned intip6t_error(struct sk_buff **pskb,	  unsigned int hooknum,	  const struct net_device *in,	  const struct net_device *out,	  const void *targinfo,	  void *userinfo){	if (net_ratelimit())		printk("ip6_tables: error: `%s'\n", (char *)targinfo);	return NF_DROP;}static inlineint do_match(struct ip6t_entry_match *m,	     const struct sk_buff *skb,	     const struct net_device *in,	     const struct net_device *out,	     int offset,	     const void *hdr,	     u_int16_t datalen,	     int *hotdrop){	/* Stop iteration if it doesn't match */	if (!m->u.kernel.match->match(skb, in, out, m->data,				      offset, hdr, datalen, hotdrop))		return 1;	else		return 0;}static inline struct ip6t_entry *get_entry(void *base, unsigned int offset){	return (struct ip6t_entry *)(base + offset);}/* Returns one of the generic firewall policies, like NF_ACCEPT. */unsigned intip6t_do_table(struct sk_buff **pskb,	      unsigned int hook,	      const struct net_device *in,	      const struct net_device *out,	      struct ip6t_table *table,	      void *userdata){	static const char nulldevname[IFNAMSIZ];	u_int16_t offset = 0;	struct ipv6hdr *ipv6;	void *protohdr;	u_int16_t datalen;	int hotdrop = 0;	/* Initializing verdict to NF_DROP keeps gcc happy. */	unsigned int verdict = NF_DROP;	const char *indev, *outdev;	void *table_base;	struct ip6t_entry *e, *back;	/* FIXME: Push down to extensions --RR */	if (skb_is_nonlinear(*pskb) && skb_linearize(*pskb, GFP_ATOMIC) != 0)		return NF_DROP;	/* Initialization */	ipv6 = (*pskb)->nh.ipv6h;	protohdr = (u_int32_t *)((char *)ipv6 + IPV6_HDR_LEN);	datalen = (*pskb)->len - IPV6_HDR_LEN;	indev = in ? in->name : nulldevname;	outdev = out ? out->name : nulldevname;	/* We handle fragments by dealing with the first fragment as	 * if it was a normal packet.  All other fragments are treated	 * normally, except that they will NEVER match rules that ask	 * things we don't know, ie. tcp syn flag or ports).  If the	 * rule is also a fragment-specific rule, non-fragments won't	 * match it. */	read_lock_bh(&table->lock);	IP_NF_ASSERT(table->valid_hooks & (1 << hook));	table_base = (void *)table->private->entries		+ TABLE_OFFSET(table->private, smp_processor_id());	e = get_entry(table_base, table->private->hook_entry[hook]);#ifdef CONFIG_NETFILTER_DEBUG	/* Check noone else using our table */	if (((struct ip6t_entry *)table_base)->comefrom != 0xdead57ac	    && ((struct ip6t_entry *)table_base)->comefrom != 0xeeeeeeec) {		printk("ASSERT: CPU #%u, %s comefrom(%p) = %X\n",		       smp_processor_id(),		       table->name,		       &((struct ip6t_entry *)table_base)->comefrom,		       ((struct ip6t_entry *)table_base)->comefrom);	}	((struct ip6t_entry *)table_base)->comefrom = 0x57acc001;#endif	/* For return from builtin chain */	back = get_entry(table_base, table->private->underflow[hook]);	do {		IP_NF_ASSERT(e);		IP_NF_ASSERT(back);		(*pskb)->nfcache |= e->nfcache;		if (ip6_packet_match(*pskb, ipv6, indev, outdev, 			&e->ipv6, offset)) {			struct ip6t_entry_target *t;			if (IP6T_MATCH_ITERATE(e, do_match,					       *pskb, in, out,					       offset, protohdr,					       datalen, &hotdrop) != 0)				goto no_match;			ADD_COUNTER(e->counters, ntohs(ipv6->payload_len) + IPV6_HDR_LEN, 1);			t = ip6t_get_target(e);			IP_NF_ASSERT(t->u.kernel.target);			/* Standard target? */			if (!t->u.kernel.target->target) {				int v;				v = ((struct ip6t_standard_target *)t)->verdict;				if (v < 0) {					/* Pop from stack? */					if (v != IP6T_RETURN) {						verdict = (unsigned)(-v) - 1;						break;					}					e = back;					back = get_entry(table_base,							 back->comefrom);					continue;				}				if (table_base + v				    != (void *)e + e->next_offset) {					/* Save old back ptr in next entry */					struct ip6t_entry *next						= (void *)e + e->next_offset;					next->comefrom						= (void *)back - table_base;					/* set back pointer to next entry */					back = next;				}				e = get_entry(table_base, v);			} else {				/* Targets which reenter must return                                   abs. verdicts */#ifdef CONFIG_NETFILTER_DEBUG				((struct ip6t_entry *)table_base)->comefrom					= 0xeeeeeeec;#endif				verdict = t->u.kernel.target->target(pskb,								     hook,								     in, out,								     t->data,								     userdata);#ifdef CONFIG_NETFILTER_DEBUG				if (((struct ip6t_entry *)table_base)->comefrom				    != 0xeeeeeeec				    && verdict == IP6T_CONTINUE) {					printk("Target %s reentered!\n",					       t->u.kernel.target->name);					verdict = NF_DROP;				}				((struct ip6t_entry *)table_base)->comefrom					= 0x57acc001;#endif				/* Target might have changed stuff. */				ipv6 = (*pskb)->nh.ipv6h;				protohdr = (u_int32_t *)((void *)ipv6 + IPV6_HDR_LEN);				datalen = (*pskb)->len - IPV6_HDR_LEN;				if (verdict == IP6T_CONTINUE)					e = (void *)e + e->next_offset;				else					/* Verdict */					break;			}		} else {		no_match:			e = (void *)e + e->next_offset;		}	} while (!hotdrop);#ifdef CONFIG_NETFILTER_DEBUG	((struct ip6t_entry *)table_base)->comefrom = 0xdead57ac;#endif	read_unlock_bh(&table->lock);#ifdef DEBUG_ALLOW_ALL	return NF_ACCEPT;#else	if (hotdrop)		return NF_DROP;	else return verdict;#endif}/* If it succeeds, returns element and locks mutex */static inline void *find_inlist_lock_noload(struct list_head *head,			const char *name,