2 * Packet matching code.
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
6 * Copyright (c) 2006-2010 Patrick McHardy <kaber@trash.net>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 #include <linux/kernel.h>
16 #include <linux/capability.h>
18 #include <linux/skbuff.h>
19 #include <linux/kmod.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netdevice.h>
22 #include <linux/module.h>
23 #include <linux/poison.h>
24 #include <linux/icmpv6.h>
26 #include <net/compat.h>
27 #include <linux/uaccess.h>
28 #include <linux/mutex.h>
29 #include <linux/proc_fs.h>
30 #include <linux/err.h>
31 #include <linux/cpumask.h>
33 #include <linux/netfilter_ipv6/ip6_tables.h>
34 #include <linux/netfilter/x_tables.h>
35 #include <net/netfilter/nf_log.h>
36 #include "../../netfilter/xt_repldata.h"
38 MODULE_LICENSE("GPL");
39 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
40 MODULE_DESCRIPTION("IPv6 packet filter");
42 void *ip6t_alloc_initial_table(const struct xt_table *info)
44 return xt_alloc_initial_table(ip6t, IP6T);
46 EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
48 /* Returns whether matches rule or not. */
49 /* Performance critical - called for every packet */
51 ip6_packet_match(const struct sk_buff *skb,
54 const struct ip6t_ip6 *ip6info,
55 unsigned int *protoff,
56 int *fragoff, bool *hotdrop)
59 const struct ipv6hdr *ipv6 = ipv6_hdr(skb);
61 if (NF_INVF(ip6info, IP6T_INV_SRCIP,
62 ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
64 NF_INVF(ip6info, IP6T_INV_DSTIP,
65 ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
69 ret = ifname_compare_aligned(indev, ip6info->iniface, ip6info->iniface_mask);
71 if (NF_INVF(ip6info, IP6T_INV_VIA_IN, ret != 0))
74 ret = ifname_compare_aligned(outdev, ip6info->outiface, ip6info->outiface_mask);
76 if (NF_INVF(ip6info, IP6T_INV_VIA_OUT, ret != 0))
79 /* ... might want to do something with class and flowlabel here ... */
81 /* look for the desired protocol header */
82 if (ip6info->flags & IP6T_F_PROTO) {
84 unsigned short _frag_off;
86 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
94 if (ip6info->proto == protohdr) {
95 if (ip6info->invflags & IP6T_INV_PROTO)
101 /* We need match for the '-p all', too! */
102 if ((ip6info->proto != 0) &&
103 !(ip6info->invflags & IP6T_INV_PROTO))
109 /* should be ip6 safe */
111 ip6_checkentry(const struct ip6t_ip6 *ipv6)
113 if (ipv6->flags & ~IP6T_F_MASK)
115 if (ipv6->invflags & ~IP6T_INV_MASK)
122 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
124 net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
129 static inline struct ip6t_entry *
130 get_entry(const void *base, unsigned int offset)
132 return (struct ip6t_entry *)(base + offset);
135 /* All zeroes == unconditional rule. */
136 /* Mildly perf critical (only if packet tracing is on) */
137 static inline bool unconditional(const struct ip6t_entry *e)
139 static const struct ip6t_ip6 uncond;
141 return e->target_offset == sizeof(struct ip6t_entry) &&
142 memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
145 static inline const struct xt_entry_target *
146 ip6t_get_target_c(const struct ip6t_entry *e)
148 return ip6t_get_target((struct ip6t_entry *)e);
151 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
152 /* This cries for unification! */
153 static const char *const hooknames[] = {
154 [NF_INET_PRE_ROUTING] = "PREROUTING",
155 [NF_INET_LOCAL_IN] = "INPUT",
156 [NF_INET_FORWARD] = "FORWARD",
157 [NF_INET_LOCAL_OUT] = "OUTPUT",
158 [NF_INET_POST_ROUTING] = "POSTROUTING",
161 enum nf_ip_trace_comments {
162 NF_IP6_TRACE_COMMENT_RULE,
163 NF_IP6_TRACE_COMMENT_RETURN,
164 NF_IP6_TRACE_COMMENT_POLICY,
167 static const char *const comments[] = {
168 [NF_IP6_TRACE_COMMENT_RULE] = "rule",
169 [NF_IP6_TRACE_COMMENT_RETURN] = "return",
170 [NF_IP6_TRACE_COMMENT_POLICY] = "policy",
173 static const struct nf_loginfo trace_loginfo = {
174 .type = NF_LOG_TYPE_LOG,
177 .level = LOGLEVEL_WARNING,
178 .logflags = NF_LOG_DEFAULT_MASK,
183 /* Mildly perf critical (only if packet tracing is on) */
185 get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
186 const char *hookname, const char **chainname,
187 const char **comment, unsigned int *rulenum)
189 const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
191 if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
192 /* Head of user chain: ERROR target with chainname */
193 *chainname = t->target.data;
198 if (unconditional(s) &&
199 strcmp(t->target.u.kernel.target->name,
200 XT_STANDARD_TARGET) == 0 &&
202 /* Tail of chains: STANDARD target (return/policy) */
203 *comment = *chainname == hookname
204 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
205 : comments[NF_IP6_TRACE_COMMENT_RETURN];
214 static void trace_packet(struct net *net,
215 const struct sk_buff *skb,
217 const struct net_device *in,
218 const struct net_device *out,
219 const char *tablename,
220 const struct xt_table_info *private,
221 const struct ip6t_entry *e)
223 const struct ip6t_entry *root;
224 const char *hookname, *chainname, *comment;
225 const struct ip6t_entry *iter;
226 unsigned int rulenum = 0;
228 root = get_entry(private->entries, private->hook_entry[hook]);
230 hookname = chainname = hooknames[hook];
231 comment = comments[NF_IP6_TRACE_COMMENT_RULE];
233 xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
234 if (get_chainname_rulenum(iter, e, hookname,
235 &chainname, &comment, &rulenum) != 0)
238 nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
239 "TRACE: %s:%s:%s:%u ",
240 tablename, chainname, comment, rulenum);
244 static inline struct ip6t_entry *
245 ip6t_next_entry(const struct ip6t_entry *entry)
247 return (void *)entry + entry->next_offset;
250 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
252 ip6t_do_table(struct sk_buff *skb,
253 const struct nf_hook_state *state,
254 struct xt_table *table)
256 unsigned int hook = state->hook;
257 static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
258 /* Initializing verdict to NF_DROP keeps gcc happy. */
259 unsigned int verdict = NF_DROP;
260 const char *indev, *outdev;
261 const void *table_base;
262 struct ip6t_entry *e, **jumpstack;
263 unsigned int stackidx, cpu;
264 const struct xt_table_info *private;
265 struct xt_action_param acpar;
270 indev = state->in ? state->in->name : nulldevname;
271 outdev = state->out ? state->out->name : nulldevname;
272 /* We handle fragments by dealing with the first fragment as
273 * if it was a normal packet. All other fragments are treated
274 * normally, except that they will NEVER match rules that ask
275 * things we don't know, ie. tcp syn flag or ports). If the
276 * rule is also a fragment-specific rule, non-fragments won't
278 acpar.hotdrop = false;
281 WARN_ON(!(table->valid_hooks & (1 << hook)));
284 addend = xt_write_recseq_begin();
285 private = table->private;
287 * Ensure we load private-> members after we've fetched the base
290 smp_read_barrier_depends();
291 cpu = smp_processor_id();
292 table_base = private->entries;
293 jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
295 /* Switch to alternate jumpstack if we're being invoked via TEE.
296 * TEE issues XT_CONTINUE verdict on original skb so we must not
297 * clobber the jumpstack.
299 * For recursion via REJECT or SYNPROXY the stack will be clobbered
300 * but it is no problem since absolute verdict is issued by these.
302 if (static_key_false(&xt_tee_enabled))
303 jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);
305 e = get_entry(table_base, private->hook_entry[hook]);
308 const struct xt_entry_target *t;
309 const struct xt_entry_match *ematch;
310 struct xt_counters *counter;
314 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
315 &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
317 e = ip6t_next_entry(e);
321 xt_ematch_foreach(ematch, e) {
322 acpar.match = ematch->u.kernel.match;
323 acpar.matchinfo = ematch->data;
324 if (!acpar.match->match(skb, &acpar))
328 counter = xt_get_this_cpu_counter(&e->counters);
329 ADD_COUNTER(*counter, skb->len, 1);
331 t = ip6t_get_target_c(e);
332 WARN_ON(!t->u.kernel.target);
334 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
335 /* The packet is traced: log it */
336 if (unlikely(skb->nf_trace))
337 trace_packet(state->net, skb, hook, state->in,
338 state->out, table->name, private, e);
340 /* Standard target? */
341 if (!t->u.kernel.target->target) {
344 v = ((struct xt_standard_target *)t)->verdict;
346 /* Pop from stack? */
347 if (v != XT_RETURN) {
348 verdict = (unsigned int)(-v) - 1;
352 e = get_entry(table_base,
353 private->underflow[hook]);
355 e = ip6t_next_entry(jumpstack[--stackidx]);
358 if (table_base + v != ip6t_next_entry(e) &&
359 !(e->ipv6.flags & IP6T_F_GOTO)) {
360 jumpstack[stackidx++] = e;
363 e = get_entry(table_base, v);
367 acpar.target = t->u.kernel.target;
368 acpar.targinfo = t->data;
370 verdict = t->u.kernel.target->target(skb, &acpar);
371 if (verdict == XT_CONTINUE)
372 e = ip6t_next_entry(e);
376 } while (!acpar.hotdrop);
378 xt_write_recseq_end(addend);
386 /* Figures out from what hook each rule can be called: returns 0 if
387 there are loops. Puts hook bitmask in comefrom. */
389 mark_source_chains(const struct xt_table_info *newinfo,
390 unsigned int valid_hooks, void *entry0,
391 unsigned int *offsets)
395 /* No recursion; use packet counter to save back ptrs (reset
396 to 0 as we leave), and comefrom to save source hook bitmask */
397 for (hook = 0; hook < NF_INET_NUMHOOKS; hook++) {
398 unsigned int pos = newinfo->hook_entry[hook];
399 struct ip6t_entry *e = entry0 + pos;
401 if (!(valid_hooks & (1 << hook)))
404 /* Set initial back pointer. */
405 e->counters.pcnt = pos;
408 const struct xt_standard_target *t
409 = (void *)ip6t_get_target_c(e);
410 int visited = e->comefrom & (1 << hook);
412 if (e->comefrom & (1 << NF_INET_NUMHOOKS))
415 e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
417 /* Unconditional return/END. */
418 if ((unconditional(e) &&
419 (strcmp(t->target.u.user.name,
420 XT_STANDARD_TARGET) == 0) &&
421 t->verdict < 0) || visited) {
422 unsigned int oldpos, size;
424 if ((strcmp(t->target.u.user.name,
425 XT_STANDARD_TARGET) == 0) &&
426 t->verdict < -NF_MAX_VERDICT - 1)
429 /* Return: backtrack through the last
432 e->comefrom ^= (1<<NF_INET_NUMHOOKS);
434 pos = e->counters.pcnt;
435 e->counters.pcnt = 0;
437 /* We're at the start. */
442 } while (oldpos == pos + e->next_offset);
445 size = e->next_offset;
446 e = entry0 + pos + size;
447 if (pos + size >= newinfo->size)
449 e->counters.pcnt = pos;
452 int newpos = t->verdict;
454 if (strcmp(t->target.u.user.name,
455 XT_STANDARD_TARGET) == 0 &&
457 /* This a jump; chase it. */
458 if (!xt_find_jump_offset(offsets, newpos,
462 /* ... this is a fallthru */
463 newpos = pos + e->next_offset;
464 if (newpos >= newinfo->size)
468 e->counters.pcnt = pos;
477 static void cleanup_match(struct xt_entry_match *m, struct net *net)
479 struct xt_mtdtor_param par;
482 par.match = m->u.kernel.match;
483 par.matchinfo = m->data;
484 par.family = NFPROTO_IPV6;
485 if (par.match->destroy != NULL)
486 par.match->destroy(&par);
487 module_put(par.match->me);
490 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
492 const struct ip6t_ip6 *ipv6 = par->entryinfo;
494 par->match = m->u.kernel.match;
495 par->matchinfo = m->data;
497 return xt_check_match(par, m->u.match_size - sizeof(*m),
498 ipv6->proto, ipv6->invflags & IP6T_INV_PROTO);
502 find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
504 struct xt_match *match;
507 match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
510 return PTR_ERR(match);
512 m->u.kernel.match = match;
514 ret = check_match(m, par);
520 module_put(m->u.kernel.match->me);
524 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
526 struct xt_entry_target *t = ip6t_get_target(e);
527 struct xt_tgchk_param par = {
531 .target = t->u.kernel.target,
533 .hook_mask = e->comefrom,
534 .family = NFPROTO_IPV6,
537 t = ip6t_get_target(e);
538 return xt_check_target(&par, t->u.target_size - sizeof(*t),
540 e->ipv6.invflags & IP6T_INV_PROTO);
544 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
546 struct xt_percpu_counter_alloc_state *alloc_state)
548 struct xt_entry_target *t;
549 struct xt_target *target;
552 struct xt_mtchk_param mtpar;
553 struct xt_entry_match *ematch;
555 if (!xt_percpu_counter_alloc(alloc_state, &e->counters))
561 mtpar.entryinfo = &e->ipv6;
562 mtpar.hook_mask = e->comefrom;
563 mtpar.family = NFPROTO_IPV6;
564 xt_ematch_foreach(ematch, e) {
565 ret = find_check_match(ematch, &mtpar);
567 goto cleanup_matches;
571 t = ip6t_get_target(e);
572 target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
574 if (IS_ERR(target)) {
575 ret = PTR_ERR(target);
576 goto cleanup_matches;
578 t->u.kernel.target = target;
580 ret = check_target(e, net, name);
585 module_put(t->u.kernel.target->me);
587 xt_ematch_foreach(ematch, e) {
590 cleanup_match(ematch, net);
593 xt_percpu_counter_free(&e->counters);
598 static bool check_underflow(const struct ip6t_entry *e)
600 const struct xt_entry_target *t;
601 unsigned int verdict;
603 if (!unconditional(e))
605 t = ip6t_get_target_c(e);
606 if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
608 verdict = ((struct xt_standard_target *)t)->verdict;
609 verdict = -verdict - 1;
610 return verdict == NF_DROP || verdict == NF_ACCEPT;
614 check_entry_size_and_hooks(struct ip6t_entry *e,
615 struct xt_table_info *newinfo,
616 const unsigned char *base,
617 const unsigned char *limit,
618 const unsigned int *hook_entries,
619 const unsigned int *underflows,
620 unsigned int valid_hooks)
625 if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
626 (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
627 (unsigned char *)e + e->next_offset > limit)
631 < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target))
634 if (!ip6_checkentry(&e->ipv6))
637 err = xt_check_entry_offsets(e, e->elems, e->target_offset,
642 /* Check hooks & underflows */
643 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
644 if (!(valid_hooks & (1 << h)))
646 if ((unsigned char *)e - base == hook_entries[h])
647 newinfo->hook_entry[h] = hook_entries[h];
648 if ((unsigned char *)e - base == underflows[h]) {
649 if (!check_underflow(e))
652 newinfo->underflow[h] = underflows[h];
656 /* Clear counters and comefrom */
657 e->counters = ((struct xt_counters) { 0, 0 });
662 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
664 struct xt_tgdtor_param par;
665 struct xt_entry_target *t;
666 struct xt_entry_match *ematch;
668 /* Cleanup all matches */
669 xt_ematch_foreach(ematch, e)
670 cleanup_match(ematch, net);
671 t = ip6t_get_target(e);
674 par.target = t->u.kernel.target;
675 par.targinfo = t->data;
676 par.family = NFPROTO_IPV6;
677 if (par.target->destroy != NULL)
678 par.target->destroy(&par);
679 module_put(par.target->me);
680 xt_percpu_counter_free(&e->counters);
683 /* Checks and translates the user-supplied table segment (held in
686 translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
687 const struct ip6t_replace *repl)
689 struct xt_percpu_counter_alloc_state alloc_state = { 0 };
690 struct ip6t_entry *iter;
691 unsigned int *offsets;
695 newinfo->size = repl->size;
696 newinfo->number = repl->num_entries;
698 /* Init all hooks to impossible value. */
699 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
700 newinfo->hook_entry[i] = 0xFFFFFFFF;
701 newinfo->underflow[i] = 0xFFFFFFFF;
704 offsets = xt_alloc_entry_offsets(newinfo->number);
708 /* Walk through entries, checking offsets. */
709 xt_entry_foreach(iter, entry0, newinfo->size) {
710 ret = check_entry_size_and_hooks(iter, newinfo, entry0,
717 if (i < repl->num_entries)
718 offsets[i] = (void *)iter - entry0;
720 if (strcmp(ip6t_get_target(iter)->u.user.name,
721 XT_ERROR_TARGET) == 0)
722 ++newinfo->stacksize;
726 if (i != repl->num_entries)
729 /* Check hooks all assigned */
730 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
731 /* Only hooks which are valid */
732 if (!(repl->valid_hooks & (1 << i)))
734 if (newinfo->hook_entry[i] == 0xFFFFFFFF)
736 if (newinfo->underflow[i] == 0xFFFFFFFF)
740 if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) {
746 /* Finally, each sanity check must pass */
748 xt_entry_foreach(iter, entry0, newinfo->size) {
749 ret = find_check_entry(iter, net, repl->name, repl->size,
757 xt_entry_foreach(iter, entry0, newinfo->size) {
760 cleanup_entry(iter, net);
772 get_counters(const struct xt_table_info *t,
773 struct xt_counters counters[])
775 struct ip6t_entry *iter;
779 for_each_possible_cpu(cpu) {
780 seqcount_t *s = &per_cpu(xt_recseq, cpu);
783 xt_entry_foreach(iter, t->entries, t->size) {
784 struct xt_counters *tmp;
788 tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
790 start = read_seqcount_begin(s);
793 } while (read_seqcount_retry(s, start));
795 ADD_COUNTER(counters[i], bcnt, pcnt);
802 static void get_old_counters(const struct xt_table_info *t,
803 struct xt_counters counters[])
805 struct ip6t_entry *iter;
808 for_each_possible_cpu(cpu) {
810 xt_entry_foreach(iter, t->entries, t->size) {
811 const struct xt_counters *tmp;
813 tmp = xt_get_per_cpu_counter(&iter->counters, cpu);
814 ADD_COUNTER(counters[i], tmp->bcnt, tmp->pcnt);
821 static struct xt_counters *alloc_counters(const struct xt_table *table)
823 unsigned int countersize;
824 struct xt_counters *counters;
825 const struct xt_table_info *private = table->private;
827 /* We need atomic snapshot of counters: rest doesn't change
828 (other than comefrom, which userspace doesn't care
830 countersize = sizeof(struct xt_counters) * private->number;
831 counters = vzalloc(countersize);
833 if (counters == NULL)
834 return ERR_PTR(-ENOMEM);
836 get_counters(private, counters);
842 copy_entries_to_user(unsigned int total_size,
843 const struct xt_table *table,
844 void __user *userptr)
846 unsigned int off, num;
847 const struct ip6t_entry *e;
848 struct xt_counters *counters;
849 const struct xt_table_info *private = table->private;
851 const void *loc_cpu_entry;
853 counters = alloc_counters(table);
854 if (IS_ERR(counters))
855 return PTR_ERR(counters);
857 loc_cpu_entry = private->entries;
859 /* FIXME: use iterator macros --RR */
860 /* ... then go back and fix counters and names */
861 for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
863 const struct xt_entry_match *m;
864 const struct xt_entry_target *t;
866 e = loc_cpu_entry + off;
867 if (copy_to_user(userptr + off, e, sizeof(*e))) {
871 if (copy_to_user(userptr + off
872 + offsetof(struct ip6t_entry, counters),
874 sizeof(counters[num])) != 0) {
879 for (i = sizeof(struct ip6t_entry);
880 i < e->target_offset;
881 i += m->u.match_size) {
884 if (xt_match_to_user(m, userptr + off + i)) {
890 t = ip6t_get_target_c(e);
891 if (xt_target_to_user(t, userptr + off + e->target_offset)) {
903 static void compat_standard_from_user(void *dst, const void *src)
905 int v = *(compat_int_t *)src;
908 v += xt_compat_calc_jump(AF_INET6, v);
909 memcpy(dst, &v, sizeof(v));
912 static int compat_standard_to_user(void __user *dst, const void *src)
914 compat_int_t cv = *(int *)src;
917 cv -= xt_compat_calc_jump(AF_INET6, cv);
918 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
921 static int compat_calc_entry(const struct ip6t_entry *e,
922 const struct xt_table_info *info,
923 const void *base, struct xt_table_info *newinfo)
925 const struct xt_entry_match *ematch;
926 const struct xt_entry_target *t;
927 unsigned int entry_offset;
930 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
931 entry_offset = (void *)e - base;
932 xt_ematch_foreach(ematch, e)
933 off += xt_compat_match_offset(ematch->u.kernel.match);
934 t = ip6t_get_target_c(e);
935 off += xt_compat_target_offset(t->u.kernel.target);
936 newinfo->size -= off;
937 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
941 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
942 if (info->hook_entry[i] &&
943 (e < (struct ip6t_entry *)(base + info->hook_entry[i])))
944 newinfo->hook_entry[i] -= off;
945 if (info->underflow[i] &&
946 (e < (struct ip6t_entry *)(base + info->underflow[i])))
947 newinfo->underflow[i] -= off;
952 static int compat_table_info(const struct xt_table_info *info,
953 struct xt_table_info *newinfo)
955 struct ip6t_entry *iter;
956 const void *loc_cpu_entry;
959 if (!newinfo || !info)
962 /* we dont care about newinfo->entries */
963 memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
964 newinfo->initial_entries = 0;
965 loc_cpu_entry = info->entries;
966 xt_compat_init_offsets(AF_INET6, info->number);
967 xt_entry_foreach(iter, loc_cpu_entry, info->size) {
968 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
976 static int get_info(struct net *net, void __user *user,
977 const int *len, int compat)
979 char name[XT_TABLE_MAXNAMELEN];
983 if (*len != sizeof(struct ip6t_getinfo))
986 if (copy_from_user(name, user, sizeof(name)) != 0)
989 name[XT_TABLE_MAXNAMELEN-1] = '\0';
992 xt_compat_lock(AF_INET6);
994 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
995 "ip6table_%s", name);
997 struct ip6t_getinfo info;
998 const struct xt_table_info *private = t->private;
1000 struct xt_table_info tmp;
1003 ret = compat_table_info(private, &tmp);
1004 xt_compat_flush_offsets(AF_INET6);
1008 memset(&info, 0, sizeof(info));
1009 info.valid_hooks = t->valid_hooks;
1010 memcpy(info.hook_entry, private->hook_entry,
1011 sizeof(info.hook_entry));
1012 memcpy(info.underflow, private->underflow,
1013 sizeof(info.underflow));
1014 info.num_entries = private->number;
1015 info.size = private->size;
1016 strcpy(info.name, name);
1018 if (copy_to_user(user, &info, *len) != 0)
1027 #ifdef CONFIG_COMPAT
1029 xt_compat_unlock(AF_INET6);
1035 get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
1039 struct ip6t_get_entries get;
1042 if (*len < sizeof(get))
1044 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1046 if (*len != sizeof(struct ip6t_get_entries) + get.size)
1049 get.name[sizeof(get.name) - 1] = '\0';
1051 t = xt_find_table_lock(net, AF_INET6, get.name);
1053 struct xt_table_info *private = t->private;
1054 if (get.size == private->size)
1055 ret = copy_entries_to_user(private->size,
1056 t, uptr->entrytable);
1069 __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
1070 struct xt_table_info *newinfo, unsigned int num_counters,
1071 void __user *counters_ptr)
1075 struct xt_table_info *oldinfo;
1076 struct xt_counters *counters;
1077 struct ip6t_entry *iter;
1080 counters = vzalloc(num_counters * sizeof(struct xt_counters));
1086 t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
1087 "ip6table_%s", name);
1090 goto free_newinfo_counters_untrans;
1094 if (valid_hooks != t->valid_hooks) {
1099 oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
1103 /* Update module usage count based on number of rules */
1104 if ((oldinfo->number > oldinfo->initial_entries) ||
1105 (newinfo->number <= oldinfo->initial_entries))
1107 if ((oldinfo->number > oldinfo->initial_entries) &&
1108 (newinfo->number <= oldinfo->initial_entries))
1111 get_old_counters(oldinfo, counters);
1113 /* Decrease module usage counts and free resource */
1114 xt_entry_foreach(iter, oldinfo->entries, oldinfo->size)
1115 cleanup_entry(iter, net);
1117 xt_free_table_info(oldinfo);
1118 if (copy_to_user(counters_ptr, counters,
1119 sizeof(struct xt_counters) * num_counters) != 0) {
1120 /* Silent error, can't fail, new table is already in place */
1121 net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
1130 free_newinfo_counters_untrans:
1137 do_replace(struct net *net, const void __user *user, unsigned int len)
1140 struct ip6t_replace tmp;
1141 struct xt_table_info *newinfo;
1142 void *loc_cpu_entry;
1143 struct ip6t_entry *iter;
1145 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1148 /* overflow check */
1149 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1151 if (tmp.num_counters == 0)
1154 tmp.name[sizeof(tmp.name)-1] = 0;
1156 newinfo = xt_alloc_table_info(tmp.size);
1160 loc_cpu_entry = newinfo->entries;
1161 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1167 ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
1171 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1172 tmp.num_counters, tmp.counters);
1174 goto free_newinfo_untrans;
1177 free_newinfo_untrans:
1178 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1179 cleanup_entry(iter, net);
1181 xt_free_table_info(newinfo);
1186 do_add_counters(struct net *net, const void __user *user, unsigned int len,
1190 struct xt_counters_info tmp;
1191 struct xt_counters *paddc;
1193 const struct xt_table_info *private;
1195 struct ip6t_entry *iter;
1196 unsigned int addend;
1198 paddc = xt_copy_counters_from_user(user, len, &tmp, compat);
1200 return PTR_ERR(paddc);
1201 t = xt_find_table_lock(net, AF_INET6, tmp.name);
1208 private = t->private;
1209 if (private->number != tmp.num_counters) {
1211 goto unlock_up_free;
1215 addend = xt_write_recseq_begin();
1216 xt_entry_foreach(iter, private->entries, private->size) {
1217 struct xt_counters *tmp;
1219 tmp = xt_get_this_cpu_counter(&iter->counters);
1220 ADD_COUNTER(*tmp, paddc[i].bcnt, paddc[i].pcnt);
1223 xt_write_recseq_end(addend);
1234 #ifdef CONFIG_COMPAT
1235 struct compat_ip6t_replace {
1236 char name[XT_TABLE_MAXNAMELEN];
1240 u32 hook_entry[NF_INET_NUMHOOKS];
1241 u32 underflow[NF_INET_NUMHOOKS];
1243 compat_uptr_t counters; /* struct xt_counters * */
1244 struct compat_ip6t_entry entries[0];
1248 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
1249 unsigned int *size, struct xt_counters *counters,
1252 struct xt_entry_target *t;
1253 struct compat_ip6t_entry __user *ce;
1254 u_int16_t target_offset, next_offset;
1255 compat_uint_t origsize;
1256 const struct xt_entry_match *ematch;
1261 if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
1262 copy_to_user(&ce->counters, &counters[i],
1263 sizeof(counters[i])) != 0)
1266 *dstptr += sizeof(struct compat_ip6t_entry);
1267 *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1269 xt_ematch_foreach(ematch, e) {
1270 ret = xt_compat_match_to_user(ematch, dstptr, size);
1274 target_offset = e->target_offset - (origsize - *size);
1275 t = ip6t_get_target(e);
1276 ret = xt_compat_target_to_user(t, dstptr, size);
1279 next_offset = e->next_offset - (origsize - *size);
1280 if (put_user(target_offset, &ce->target_offset) != 0 ||
1281 put_user(next_offset, &ce->next_offset) != 0)
1287 compat_find_calc_match(struct xt_entry_match *m,
1288 const struct ip6t_ip6 *ipv6,
1291 struct xt_match *match;
1293 match = xt_request_find_match(NFPROTO_IPV6, m->u.user.name,
1294 m->u.user.revision);
1296 return PTR_ERR(match);
1298 m->u.kernel.match = match;
1299 *size += xt_compat_match_offset(match);
1303 static void compat_release_entry(struct compat_ip6t_entry *e)
1305 struct xt_entry_target *t;
1306 struct xt_entry_match *ematch;
1308 /* Cleanup all matches */
1309 xt_ematch_foreach(ematch, e)
1310 module_put(ematch->u.kernel.match->me);
1311 t = compat_ip6t_get_target(e);
1312 module_put(t->u.kernel.target->me);
1316 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
1317 struct xt_table_info *newinfo,
1319 const unsigned char *base,
1320 const unsigned char *limit)
1322 struct xt_entry_match *ematch;
1323 struct xt_entry_target *t;
1324 struct xt_target *target;
1325 unsigned int entry_offset;
1329 if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
1330 (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
1331 (unsigned char *)e + e->next_offset > limit)
1334 if (e->next_offset < sizeof(struct compat_ip6t_entry) +
1335 sizeof(struct compat_xt_entry_target))
1338 if (!ip6_checkentry(&e->ipv6))
1341 ret = xt_compat_check_entry_offsets(e, e->elems,
1342 e->target_offset, e->next_offset);
1346 off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1347 entry_offset = (void *)e - (void *)base;
1349 xt_ematch_foreach(ematch, e) {
1350 ret = compat_find_calc_match(ematch, &e->ipv6, &off);
1352 goto release_matches;
1356 t = compat_ip6t_get_target(e);
1357 target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name,
1358 t->u.user.revision);
1359 if (IS_ERR(target)) {
1360 ret = PTR_ERR(target);
1361 goto release_matches;
1363 t->u.kernel.target = target;
1365 off += xt_compat_target_offset(target);
1367 ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
1374 module_put(t->u.kernel.target->me);
1376 xt_ematch_foreach(ematch, e) {
1379 module_put(ematch->u.kernel.match->me);
1385 compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
1387 struct xt_table_info *newinfo, unsigned char *base)
1389 struct xt_entry_target *t;
1390 struct ip6t_entry *de;
1391 unsigned int origsize;
1393 struct xt_entry_match *ematch;
1397 memcpy(de, e, sizeof(struct ip6t_entry));
1398 memcpy(&de->counters, &e->counters, sizeof(e->counters));
1400 *dstptr += sizeof(struct ip6t_entry);
1401 *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
1403 xt_ematch_foreach(ematch, e)
1404 xt_compat_match_from_user(ematch, dstptr, size);
1406 de->target_offset = e->target_offset - (origsize - *size);
1407 t = compat_ip6t_get_target(e);
1408 xt_compat_target_from_user(t, dstptr, size);
1410 de->next_offset = e->next_offset - (origsize - *size);
1411 for (h = 0; h < NF_INET_NUMHOOKS; h++) {
1412 if ((unsigned char *)de - base < newinfo->hook_entry[h])
1413 newinfo->hook_entry[h] -= origsize - *size;
1414 if ((unsigned char *)de - base < newinfo->underflow[h])
1415 newinfo->underflow[h] -= origsize - *size;
1420 translate_compat_table(struct net *net,
1421 struct xt_table_info **pinfo,
1423 const struct compat_ip6t_replace *compatr)
1426 struct xt_table_info *newinfo, *info;
1427 void *pos, *entry0, *entry1;
1428 struct compat_ip6t_entry *iter0;
1429 struct ip6t_replace repl;
1435 size = compatr->size;
1436 info->number = compatr->num_entries;
1439 xt_compat_lock(AF_INET6);
1440 xt_compat_init_offsets(AF_INET6, compatr->num_entries);
1441 /* Walk through entries, checking offsets. */
1442 xt_entry_foreach(iter0, entry0, compatr->size) {
1443 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
1445 entry0 + compatr->size);
1452 if (j != compatr->num_entries)
1456 newinfo = xt_alloc_table_info(size);
1460 newinfo->number = compatr->num_entries;
1461 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1462 newinfo->hook_entry[i] = compatr->hook_entry[i];
1463 newinfo->underflow[i] = compatr->underflow[i];
1465 entry1 = newinfo->entries;
1467 size = compatr->size;
1468 xt_entry_foreach(iter0, entry0, compatr->size)
1469 compat_copy_entry_from_user(iter0, &pos, &size,
1472 /* all module references in entry0 are now gone. */
1473 xt_compat_flush_offsets(AF_INET6);
1474 xt_compat_unlock(AF_INET6);
1476 memcpy(&repl, compatr, sizeof(*compatr));
1478 for (i = 0; i < NF_INET_NUMHOOKS; i++) {
1479 repl.hook_entry[i] = newinfo->hook_entry[i];
1480 repl.underflow[i] = newinfo->underflow[i];
1483 repl.num_counters = 0;
1484 repl.counters = NULL;
1485 repl.size = newinfo->size;
1486 ret = translate_table(net, newinfo, entry1, &repl);
1492 xt_free_table_info(info);
1496 xt_free_table_info(newinfo);
1499 xt_compat_flush_offsets(AF_INET6);
1500 xt_compat_unlock(AF_INET6);
1501 xt_entry_foreach(iter0, entry0, compatr->size) {
1504 compat_release_entry(iter0);
1510 compat_do_replace(struct net *net, void __user *user, unsigned int len)
1513 struct compat_ip6t_replace tmp;
1514 struct xt_table_info *newinfo;
1515 void *loc_cpu_entry;
1516 struct ip6t_entry *iter;
1518 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1521 /* overflow check */
1522 if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
1524 if (tmp.num_counters == 0)
1527 tmp.name[sizeof(tmp.name)-1] = 0;
1529 newinfo = xt_alloc_table_info(tmp.size);
1533 loc_cpu_entry = newinfo->entries;
1534 if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
1540 ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
1544 ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
1545 tmp.num_counters, compat_ptr(tmp.counters));
1547 goto free_newinfo_untrans;
1550 free_newinfo_untrans:
1551 xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
1552 cleanup_entry(iter, net);
1554 xt_free_table_info(newinfo);
1559 compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
1564 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1568 case IP6T_SO_SET_REPLACE:
1569 ret = compat_do_replace(sock_net(sk), user, len);
1572 case IP6T_SO_SET_ADD_COUNTERS:
1573 ret = do_add_counters(sock_net(sk), user, len, 1);
1583 struct compat_ip6t_get_entries {
1584 char name[XT_TABLE_MAXNAMELEN];
1586 struct compat_ip6t_entry entrytable[0];
1590 compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
1591 void __user *userptr)
1593 struct xt_counters *counters;
1594 const struct xt_table_info *private = table->private;
1599 struct ip6t_entry *iter;
1601 counters = alloc_counters(table);
1602 if (IS_ERR(counters))
1603 return PTR_ERR(counters);
1607 xt_entry_foreach(iter, private->entries, total_size) {
1608 ret = compat_copy_entry_to_user(iter, &pos,
1609 &size, counters, i++);
1619 compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
1623 struct compat_ip6t_get_entries get;
1626 if (*len < sizeof(get))
1629 if (copy_from_user(&get, uptr, sizeof(get)) != 0)
1632 if (*len != sizeof(struct compat_ip6t_get_entries) + get.size)
1635 get.name[sizeof(get.name) - 1] = '\0';
1637 xt_compat_lock(AF_INET6);
1638 t = xt_find_table_lock(net, AF_INET6, get.name);
1640 const struct xt_table_info *private = t->private;
1641 struct xt_table_info info;
1642 ret = compat_table_info(private, &info);
1643 if (!ret && get.size == info.size)
1644 ret = compat_copy_entries_to_user(private->size,
1645 t, uptr->entrytable);
1649 xt_compat_flush_offsets(AF_INET6);
1655 xt_compat_unlock(AF_INET6);
1659 static int do_ip6t_get_ctl(struct sock *, int, void __user *, int *);
1662 compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1666 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1670 case IP6T_SO_GET_INFO:
1671 ret = get_info(sock_net(sk), user, len, 1);
1673 case IP6T_SO_GET_ENTRIES:
1674 ret = compat_get_entries(sock_net(sk), user, len);
1677 ret = do_ip6t_get_ctl(sk, cmd, user, len);
1684 do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
1688 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1692 case IP6T_SO_SET_REPLACE:
1693 ret = do_replace(sock_net(sk), user, len);
1696 case IP6T_SO_SET_ADD_COUNTERS:
1697 ret = do_add_counters(sock_net(sk), user, len, 0);
1708 do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1712 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
1716 case IP6T_SO_GET_INFO:
1717 ret = get_info(sock_net(sk), user, len, 0);
1720 case IP6T_SO_GET_ENTRIES:
1721 ret = get_entries(sock_net(sk), user, len);
1724 case IP6T_SO_GET_REVISION_MATCH:
1725 case IP6T_SO_GET_REVISION_TARGET: {
1726 struct xt_get_revision rev;
1729 if (*len != sizeof(rev)) {
1733 if (copy_from_user(&rev, user, sizeof(rev)) != 0) {
1737 rev.name[sizeof(rev.name)-1] = 0;
1739 if (cmd == IP6T_SO_GET_REVISION_TARGET)
1744 try_then_request_module(xt_find_revision(AF_INET6, rev.name,
1747 "ip6t_%s", rev.name);
1758 static void __ip6t_unregister_table(struct net *net, struct xt_table *table)
1760 struct xt_table_info *private;
1761 void *loc_cpu_entry;
1762 struct module *table_owner = table->me;
1763 struct ip6t_entry *iter;
1765 private = xt_unregister_table(table);
1767 /* Decrease module usage counts and free resources */
1768 loc_cpu_entry = private->entries;
1769 xt_entry_foreach(iter, loc_cpu_entry, private->size)
1770 cleanup_entry(iter, net);
1771 if (private->number > private->initial_entries)
1772 module_put(table_owner);
1773 xt_free_table_info(private);
1776 int ip6t_register_table(struct net *net, const struct xt_table *table,
1777 const struct ip6t_replace *repl,
1778 const struct nf_hook_ops *ops,
1779 struct xt_table **res)
1782 struct xt_table_info *newinfo;
1783 struct xt_table_info bootstrap = {0};
1784 void *loc_cpu_entry;
1785 struct xt_table *new_table;
1787 newinfo = xt_alloc_table_info(repl->size);
1791 loc_cpu_entry = newinfo->entries;
1792 memcpy(loc_cpu_entry, repl->entries, repl->size);
1794 ret = translate_table(net, newinfo, loc_cpu_entry, repl);
1798 new_table = xt_register_table(net, table, &bootstrap, newinfo);
1799 if (IS_ERR(new_table)) {
1800 ret = PTR_ERR(new_table);
1804 /* set res now, will see skbs right after nf_register_net_hooks */
1805 WRITE_ONCE(*res, new_table);
1807 ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
1809 __ip6t_unregister_table(net, new_table);
1816 xt_free_table_info(newinfo);
1820 void ip6t_unregister_table(struct net *net, struct xt_table *table,
1821 const struct nf_hook_ops *ops)
1823 nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
1824 __ip6t_unregister_table(net, table);
1827 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
1829 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
1830 u_int8_t type, u_int8_t code,
1833 return (type == test_type && code >= min_code && code <= max_code)
1838 icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
1840 const struct icmp6hdr *ic;
1841 struct icmp6hdr _icmph;
1842 const struct ip6t_icmp *icmpinfo = par->matchinfo;
1844 /* Must not be a fragment. */
1845 if (par->fragoff != 0)
1848 ic = skb_header_pointer(skb, par->thoff, sizeof(_icmph), &_icmph);
1850 /* We've been asked to examine this packet, and we
1851 * can't. Hence, no choice but to drop.
1853 par->hotdrop = true;
1857 return icmp6_type_code_match(icmpinfo->type,
1860 ic->icmp6_type, ic->icmp6_code,
1861 !!(icmpinfo->invflags&IP6T_ICMP_INV));
1864 /* Called when user tries to insert an entry of this type. */
1865 static int icmp6_checkentry(const struct xt_mtchk_param *par)
1867 const struct ip6t_icmp *icmpinfo = par->matchinfo;
1869 /* Must specify no unknown invflags */
1870 return (icmpinfo->invflags & ~IP6T_ICMP_INV) ? -EINVAL : 0;
1873 /* The built-in targets: standard (NULL) and error. */
1874 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
1876 .name = XT_STANDARD_TARGET,
1877 .targetsize = sizeof(int),
1878 .family = NFPROTO_IPV6,
1879 #ifdef CONFIG_COMPAT
1880 .compatsize = sizeof(compat_int_t),
1881 .compat_from_user = compat_standard_from_user,
1882 .compat_to_user = compat_standard_to_user,
1886 .name = XT_ERROR_TARGET,
1887 .target = ip6t_error,
1888 .targetsize = XT_FUNCTION_MAXNAMELEN,
1889 .family = NFPROTO_IPV6,
1893 static struct nf_sockopt_ops ip6t_sockopts = {
1895 .set_optmin = IP6T_BASE_CTL,
1896 .set_optmax = IP6T_SO_SET_MAX+1,
1897 .set = do_ip6t_set_ctl,
1898 #ifdef CONFIG_COMPAT
1899 .compat_set = compat_do_ip6t_set_ctl,
1901 .get_optmin = IP6T_BASE_CTL,
1902 .get_optmax = IP6T_SO_GET_MAX+1,
1903 .get = do_ip6t_get_ctl,
1904 #ifdef CONFIG_COMPAT
1905 .compat_get = compat_do_ip6t_get_ctl,
1907 .owner = THIS_MODULE,
1910 static struct xt_match ip6t_builtin_mt[] __read_mostly = {
1913 .match = icmp6_match,
1914 .matchsize = sizeof(struct ip6t_icmp),
1915 .checkentry = icmp6_checkentry,
1916 .proto = IPPROTO_ICMPV6,
1917 .family = NFPROTO_IPV6,
1921 static int __net_init ip6_tables_net_init(struct net *net)
1923 return xt_proto_init(net, NFPROTO_IPV6);
1926 static void __net_exit ip6_tables_net_exit(struct net *net)
1928 xt_proto_fini(net, NFPROTO_IPV6);
1931 static struct pernet_operations ip6_tables_net_ops = {
1932 .init = ip6_tables_net_init,
1933 .exit = ip6_tables_net_exit,
1936 static int __init ip6_tables_init(void)
1940 ret = register_pernet_subsys(&ip6_tables_net_ops);
1944 /* No one else will be downing sem now, so we won't sleep */
1945 ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
1948 ret = xt_register_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
1952 /* Register setsockopt */
1953 ret = nf_register_sockopt(&ip6t_sockopts);
1957 pr_info("(C) 2000-2006 Netfilter Core Team\n");
1961 xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
1963 xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
1965 unregister_pernet_subsys(&ip6_tables_net_ops);
1970 static void __exit ip6_tables_fini(void)
1972 nf_unregister_sockopt(&ip6t_sockopts);
1974 xt_unregister_matches(ip6t_builtin_mt, ARRAY_SIZE(ip6t_builtin_mt));
1975 xt_unregister_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
1976 unregister_pernet_subsys(&ip6_tables_net_ops);
1979 EXPORT_SYMBOL(ip6t_register_table);
1980 EXPORT_SYMBOL(ip6t_unregister_table);
1981 EXPORT_SYMBOL(ip6t_do_table);
1983 module_init(ip6_tables_init);
1984 module_exit(ip6_tables_fini);