int *error,			struct semaphore *mutex){	void *ret;#if 1	duprintf("find_inlist: searching for `%s' in %s.\n",		 name, head == &ip6t_target ? "ip6t_target"		 : head == &ip6t_match ? "ip6t_match"		 : head == &ip6t_tables ? "ip6t_tables" : "UNKNOWN");#endif	*error = down_interruptible(mutex);	if (*error != 0)		return NULL;	ret = list_named_find(head, name);	if (!ret) {		*error = -ENOENT;		up(mutex);	}	return ret;}#ifndef CONFIG_KMOD#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))#elsestatic void *find_inlist_lock(struct list_head *head,		 const char *name,		 const char *prefix,		 int *error,		 struct semaphore *mutex){	void *ret;	ret = find_inlist_lock_noload(head, name, error, mutex);	if (!ret) {		duprintf("find_inlist: loading `%s%s'.\n", prefix, name);		request_module("%s%s", prefix, name);		ret = find_inlist_lock_noload(head, name, error, mutex);	}	return ret;}#endifstatic inline struct ip6t_table *ip6t_find_table_lock(const char *name, int *error, struct semaphore *mutex){	return find_inlist_lock(&ip6t_tables, name, "ip6table_", error, mutex);}static inline struct ip6t_match *find_match_lock(const char *name, int *error, struct semaphore *mutex){	return find_inlist_lock(&ip6t_match, name, "ip6t_", error, mutex);}struct ip6t_target *ip6t_find_target_lock(const char *name, int *error, struct semaphore *mutex){	return find_inlist_lock(&ip6t_target, name, "ip6t_", error, mutex);}/* All zeroes == unconditional rule. */static inline intunconditional(const struct ip6t_ip6 *ipv6){	unsigned int i;	for (i = 0; i < sizeof(*ipv6); i++)		if (((char *)ipv6)[i])			break;	return (i == sizeof(*ipv6));}/* Figures out from what hook each rule can be called: returns 0 if   there are loops.  Puts hook bitmask in comefrom. */static intmark_source_chains(struct ip6t_table_info *newinfo, unsigned int valid_hooks){	unsigned int hook;	/* No recursion; use packet counter to save back ptrs (reset	   to 0 as we leave), and comefrom to save source hook bitmask */	for (hook = 0; hook < NF_IP6_NUMHOOKS; hook++) {		unsigned int pos = newinfo->hook_entry[hook];		struct ip6t_entry *e			= (struct ip6t_entry *)(newinfo->entries + pos);		if (!(valid_hooks & (1 << hook)))			continue;		/* Set initial back pointer. */		e->counters.pcnt = pos;		for (;;) {			struct ip6t_standard_target *t				= (void *)ip6t_get_target(e);			if (e->comefrom & (1 << NF_IP6_NUMHOOKS)) {				printk("iptables: loop hook %u pos %u %08X.\n",				       hook, pos, e->comefrom);				return 0;			}			e->comefrom				|= ((1 << hook) | (1 << NF_IP6_NUMHOOKS));			/* Unconditional return/END. */			if (e->target_offset == sizeof(struct ip6t_entry)			    && (strcmp(t->target.u.user.name,				       IP6T_STANDARD_TARGET) == 0)			    && t->verdict < 0			    && unconditional(&e->ipv6)) {				unsigned int oldpos, size;				/* Return: backtrack through the last				   big jump. */				do {					e->comefrom ^= (1<<NF_IP6_NUMHOOKS);#ifdef DEBUG_IP_FIREWALL_USER					if (e->comefrom					    & (1 << NF_IP6_NUMHOOKS)) {						duprintf("Back unset "							 "on hook %u "							 "rule %u\n",							 hook, pos);					}#endif					oldpos = pos;					pos = e->counters.pcnt;					e->counters.pcnt = 0;					/* We're at the start. */					if (pos == oldpos)						goto next;					e = (struct ip6t_entry *)						(newinfo->entries + pos);				} while (oldpos == pos + e->next_offset);				/* Move along one */				size = e->next_offset;				e = (struct ip6t_entry *)					(newinfo->entries + pos + size);				e->counters.pcnt = pos;				pos += size;			} else {				int newpos = t->verdict;				if (strcmp(t->target.u.user.name,					   IP6T_STANDARD_TARGET) == 0				    && newpos >= 0) {					/* This a jump; chase it. */					duprintf("Jump rule %u -> %u\n",						 pos, newpos);				} else {					/* ... this is a fallthru */					newpos = pos + e->next_offset;				}				e = (struct ip6t_entry *)					(newinfo->entries + newpos);				e->counters.pcnt = pos;				pos = newpos;			}		}		next:		duprintf("Finished chain %u\n", hook);	}	return 1;}static inline intcleanup_match(struct ip6t_entry_match *m, unsigned int *i){	if (i && (*i)-- == 0)		return 1;	if (m->u.kernel.match->destroy)		m->u.kernel.match->destroy(m->data,					   m->u.match_size - sizeof(*m));	module_put(m->u.kernel.match->me);	return 0;}static inline intstandard_check(const struct ip6t_entry_target *t,	       unsigned int max_offset){	struct ip6t_standard_target *targ = (void *)t;	/* Check standard info. */	if (t->u.target_size	    != IP6T_ALIGN(sizeof(struct ip6t_standard_target))) {		duprintf("standard_check: target size %u != %u\n",			 t->u.target_size,			 IP6T_ALIGN(sizeof(struct ip6t_standard_target)));		return 0;	}	if (targ->verdict >= 0	    && targ->verdict > max_offset - sizeof(struct ip6t_entry)) {		duprintf("ip6t_standard_check: bad verdict (%i)\n",			 targ->verdict);		return 0;	}	if (targ->verdict < -NF_MAX_VERDICT - 1) {		duprintf("ip6t_standard_check: bad negative verdict (%i)\n",			 targ->verdict);		return 0;	}	return 1;}static inline intcheck_match(struct ip6t_entry_match *m,	    const char *name,	    const struct ip6t_ip6 *ipv6,	    unsigned int hookmask,	    unsigned int *i){	int ret;	struct ip6t_match *match;	match = find_match_lock(m->u.user.name, &ret, &ip6t_mutex);	if (!match) {	  //		duprintf("check_match: `%s' not found\n", m->u.name);		return ret;	}	if (!try_module_get(match->me)) {		up(&ip6t_mutex);		return -ENOENT;	}	m->u.kernel.match = match;	up(&ip6t_mutex);	if (m->u.kernel.match->checkentry	    && !m->u.kernel.match->checkentry(name, ipv6, m->data,					      m->u.match_size - sizeof(*m),					      hookmask)) {		module_put(m->u.kernel.match->me);		duprintf("ip_tables: check failed for `%s'.\n",			 m->u.kernel.match->name);		return -EINVAL;	}	(*i)++;	return 0;}static struct ip6t_target ip6t_standard_target;static inline intcheck_entry(struct ip6t_entry *e, const char *name, unsigned int size,	    unsigned int *i){	struct ip6t_entry_target *t;	struct ip6t_target *target;	int ret;	unsigned int j;	if (!ip6_checkentry(&e->ipv6)) {		duprintf("ip_tables: ip check failed %p %s.\n", e, name);		return -EINVAL;	}	j = 0;	ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6, e->comefrom, &j);	if (ret != 0)		goto cleanup_matches;	t = ip6t_get_target(e);	target = ip6t_find_target_lock(t->u.user.name, &ret, &ip6t_mutex);	if (!target) {		duprintf("check_entry: `%s' not found\n", t->u.user.name);		goto cleanup_matches;	}	if (!try_module_get(target->me)) {		up(&ip6t_mutex);		ret = -ENOENT;		goto cleanup_matches;	}	t->u.kernel.target = target;	up(&ip6t_mutex);	if (!t->u.kernel.target) {		ret = -EBUSY;		goto cleanup_matches;	}	if (t->u.kernel.target == &ip6t_standard_target) {		if (!standard_check(t, size)) {			ret = -EINVAL;			goto cleanup_matches;		}	} else if (t->u.kernel.target->checkentry		   && !t->u.kernel.target->checkentry(name, e, t->data,						      t->u.target_size						      - sizeof(*t),						      e->comefrom)) {		module_put(t->u.kernel.target->me);		duprintf("ip_tables: check failed for `%s'.\n",			 t->u.kernel.target->name);		ret = -EINVAL;		goto cleanup_matches;	}	(*i)++;	return 0; cleanup_matches:	IP6T_MATCH_ITERATE(e, cleanup_match, &j);	return ret;}static inline intcheck_entry_size_and_hooks(struct ip6t_entry *e,			   struct ip6t_table_info *newinfo,			   unsigned char *base,			   unsigned char *limit,			   const unsigned int *hook_entries,			   const unsigned int *underflows,			   unsigned int *i){	unsigned int h;	if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0	    || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {		duprintf("Bad offset %p\n", e);		return -EINVAL;	}	if (e->next_offset	    < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {		duprintf("checking: element %p size %u\n",			 e, e->next_offset);		return -EINVAL;	}	/* Check hooks & underflows */	for (h = 0; h < NF_IP6_NUMHOOKS; h++) {		if ((unsigned char *)e - base == hook_entries[h])			newinfo->hook_entry[h] = hook_entries[h];		if ((unsigned char *)e - base == underflows[h])			newinfo->underflow[h] = underflows[h];	}	/* FIXME: underflows must be unconditional, standard verdicts           < 0 (not IP6T_RETURN). --RR */	/* Clear counters and comefrom */	e->counters = ((struct ip6t_counters) { 0, 0 });	e->comefrom = 0;	(*i)++;	return 0;}static inline intcleanup_entry(struct ip6t_entry *e, unsigned int *i){	struct ip6t_entry_target *t;	if (i && (*i)-- == 0)		return 1;	/* Cleanup all matches */	IP6T_MATCH_ITERATE(e, cleanup_match, NULL);	t = ip6t_get_target(e);	if (t->u.kernel.target->destroy)		t->u.kernel.target->destroy(t->data,					    t->u.target_size - sizeof(*t));	module_put(t->u.kernel.target->me);	return 0;}/* Checks and translates the user-supplied table segment (held in   newinfo) */static inttranslate_table(const char *name,		unsigned int valid_hooks,		struct ip6t_table_info *newinfo,		unsigned int size,		unsigned int number,		const unsigned int *hook_entries,		const unsigned int *underflows){	unsigned int i;	int ret;	newinfo->size = size;	newinfo->number = number;	/* Init all hooks to impossible value. */	for (i = 0; i < NF_IP6_NUMHOOKS; i++) {		newinfo->hook_entry[i] = 0xFFFFFFFF;		newinfo->underflow[i] = 0xFFFFFFFF;	}	duprintf("translate_table: size %u\n", newinfo->size);	i = 0;	/* Walk through entries, checking offsets. */	ret = IP6T_ENTRY_ITERATE(newinfo->entries, newinfo->size,				check_entry_size_and_hooks,				newinfo,				newinfo->entries,				newinfo->entries + size,				hook_entries, underflows, &i);	if (ret != 0)		return ret;	if (i != number) {		duprintf("translate_table: %u not %u entries\n",			 i, number);		return -EINVAL;	}	/* Check hooks all assigned */	for (i = 0; i < NF_IP6_NUMHOOKS; i++) {		/* Only hooks which are valid */		if (!(valid_hooks & (1 << i)))			continue;		if (newinfo->hook_entry[i] == 0xFFFFFFFF) {			duprintf("Invalid hook entry %u %u\n",				 i, hook_entries[i]);			return -EINVAL;		}		if (newinfo->underflow[i] == 0xFFFFFFFF) {			duprintf("Invalid underflow %u %u\n",				 i, underflows[i]);			return -EINVAL;		}	}	if (!mark_source_chains(newinfo, valid_hooks))		return -ELOOP;	/* Finally, each sanity check must pass */	i = 0;	ret = IP6T_ENTRY_ITERATE(newinfo->entries, newinfo->size,				check_entry, name, size, &i);	if (ret != 0) {		IP6T_ENTRY_ITERATE(newinfo->entries, newinfo->size,				  cleanup_entry, &i);		return ret;	}	/* And one copy for every other CPU */	for (i = 1; i < NR_CPUS; i++) {		memcpy(newinfo->entries + SMP_ALIGN(newinfo->size)*i,		       newinfo->entries,		       SMP_ALIGN(newinfo->size));	}	return ret;}static struct ip6t_table_info *replace_table(struct ip6t_table *table,	      unsigned int num_counters,	      struct ip6t_table_info *newinfo,	      int *error){	struct ip6t_table_info *oldinfo;#ifdef CONFIG_NETFILTER_DEBUG	{		struct ip6t_entry *table_base;		unsigned int i;		for (i = 0; i < NR_CPUS; i++) {			table_base =				(void *)newinfo->entries				+ TABLE_OFFSET(newinfo, i);			table_base->comefrom = 0xdead57ac;		}	}#endif	/* Do the substitution. */	write_lock_bh(&table->lock);	/* Check inside lock: is the old number correct? */	if (num_counters != table->private->number) {		duprintf("num_counters != table->private->number (%u/%u)\n",			 num_counters, table->private->number);		write_unlock_bh(&table->lock);		*error = -EAGAIN;		return NULL;	}	oldinfo = table->private;	table->private = newinfo;	newinfo->initial_entries = oldinfo->initial_entries;	write_unlock_bh(&table->lock);