1 files changed, 106 insertions, 10 deletions

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 125a90d6a79..14cb310064f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -78,6 +78,19 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 
    Hence the start of any table is given by get_table() below.  */
 
+/* Check for an extension */
+int
+ip6t_ext_hdr(u8 nexthdr)
+{
+        return  (nexthdr == IPPROTO_HOPOPTS)   ||
+                (nexthdr == IPPROTO_ROUTING)   ||
+                (nexthdr == IPPROTO_FRAGMENT)  ||
+                (nexthdr == IPPROTO_ESP)       ||
+                (nexthdr == IPPROTO_AH)        ||
+                (nexthdr == IPPROTO_NONE)      ||
+                (nexthdr == IPPROTO_DSTOPTS);
+}
+
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
@@ -133,7 +146,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 int protohdr;
                 unsigned short _frag_off;
 
-                protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
+                protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
                 if (protohdr < 0) {
                         if (_frag_off == 0)
                                 *hotdrop = true;
@@ -181,7 +194,8 @@ ip6_checkentry(const struct ip6t_ip6 *ipv6)
 static unsigned int
 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
+        if (net_ratelimit())
+                pr_info("error: `%s'\n", (const char *)par->targinfo);
 
         return NF_DROP;
 }
@@ -207,7 +221,8 @@ ip6t_get_target_c(const struct ip6t_entry *e)
         return ip6t_get_target((struct ip6t_entry *)e);
 }
 
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 /* This cries for unification! */
 static const char *const hooknames[] = {
         [NF_INET_PRE_ROUTING]           = "PREROUTING",
@@ -360,7 +375,6 @@ ip6t_do_table(struct sk_buff *skb,
                 const struct xt_entry_match *ematch;
 
                 IP_NF_ASSERT(e);
-                acpar.thoff = 0;
                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
  no_match:
@@ -380,7 +394,8 @@ ip6t_do_table(struct sk_buff *skb,
                 t = ip6t_get_target_c(e);
                 IP_NF_ASSERT(t->u.kernel.target);
 
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
                 /* The packet is traced: log it */
                 if (unlikely(skb->nf_trace))
                         trace_packet(skb, hook, in, out,
@@ -394,7 +409,7 @@ ip6t_do_table(struct sk_buff *skb,
                         if (v < 0) {
                                 /* Pop from stack? */
                                 if (v != XT_RETURN) {
-                                        verdict = (unsigned int)(-v) - 1;
+                                        verdict = (unsigned)(-v) - 1;
                                         break;
                                 }
                                 if (*stackptr <= origptr)
@@ -1854,7 +1869,7 @@ compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -1969,7 +1984,7 @@ compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -1991,7 +2006,7 @@ do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -2016,7 +2031,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -2271,9 +2286,90 @@ static void __exit ip6_tables_fini(void)
         unregister_pernet_subsys(&ip6_tables_net_ops);
 }
 
+/*
+ * find the offset to specified header or the protocol number of last header
+ * if target < 0. "last header" is transport protocol header, ESP, or
+ * "No next header".
+ *
+ * If target header is found, its offset is set in *offset and return protocol
+ * number. Otherwise, return -ENOENT or -EBADMSG.
+ *
+ * If the first fragment doesn't contain the final protocol header or
+ * NEXTHDR_NONE it is considered invalid.
+ *
+ * Note that non-1st fragment is special case that "the protocol number
+ * of last header" is "next header" field in Fragment header. In this case,
+ * *offset is meaningless. If fragoff is not NULL, the fragment offset is
+ * stored in *fragoff; if it is NULL, return -EINVAL.
+ */
+int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+                  int target, unsigned short *fragoff)
+{
+        unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+        u8 nexthdr = ipv6_hdr(skb)->nexthdr;
+        unsigned int len = skb->len - start;
+
+        if (fragoff)
+                *fragoff = 0;
+
+        while (nexthdr != target) {
+                struct ipv6_opt_hdr _hdr, *hp;
+                unsigned int hdrlen;
+
+                if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
+                        if (target < 0)
+                                break;
+                        return -ENOENT;
+                }
+
+                hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+                if (hp == NULL)
+                        return -EBADMSG;
+                if (nexthdr == NEXTHDR_FRAGMENT) {
+                        unsigned short _frag_off;
+                        __be16 *fp;
+                        fp = skb_header_pointer(skb,
+                                                start+offsetof(struct frag_hdr,
+                                                               frag_off),
+                                                sizeof(_frag_off),
+                                                &_frag_off);
+                        if (fp == NULL)
+                                return -EBADMSG;
+
+                        _frag_off = ntohs(*fp) & ~0x7;
+                        if (_frag_off) {
+                                if (target < 0 &&
+                                    ((!ipv6_ext_hdr(hp->nexthdr)) ||
+                                     hp->nexthdr == NEXTHDR_NONE)) {
+                                        if (fragoff) {
+                                                *fragoff = _frag_off;
+                                                return hp->nexthdr;
+                                        } else {
+                                                return -EINVAL;
+                                        }
+                                }
+                                return -ENOENT;
+                        }
+                        hdrlen = 8;
+                } else if (nexthdr == NEXTHDR_AUTH)
+                        hdrlen = (hp->hdrlen + 2) << 2;
+                else
+                        hdrlen = ipv6_optlen(hp);
+
+                nexthdr = hp->nexthdr;
+                len -= hdrlen;
+                start += hdrlen;
+        }
+
+        *offset = start;
+        return nexthdr;
+}
+
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
+EXPORT_SYMBOL(ip6t_ext_hdr);
+EXPORT_SYMBOL(ipv6_find_hdr);
 
 module_init(ip6_tables_init);
 module_exit(ip6_tables_fini);