?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
of: MSI: Simplify irqdomain lookup
[linux/fpc-iii.git] / net / bridge / netfilter / ebtables.c
blobf46ca417bf2d147118f8d37c67d9bffbee59724f
1 /*
2 * ebtables
3 *
4 * Author:
5 * Bart De Schuymer <bdschuym@pandora.be>
6 *
7 * ebtables.c,v 2.0, July, 2002
8 *
9 * This code is strongly inspired by the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 */
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18 #include <linux/kmod.h>
19 #include <linux/module.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/spinlock.h>
24 #include <linux/mutex.h>
25 #include <linux/slab.h>
26 #include <asm/uaccess.h>
27 #include <linux/smp.h>
28 #include <linux/cpumask.h>
29 #include <linux/audit.h>
30 #include <net/sock.h>
31 /* needed for logical [in,out]-dev filtering */
32 #include "../br_private.h"
33
34 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
35 "report to author: "format, ## args)
36 /* #define BUGPRINT(format, args...) */
37
38 /*
39 * Each cpu has its own set of counters, so there is no need for write_lock in
40 * the softirq
41 * For reading or updating the counters, the user context needs to
42 * get a write_lock
43 */
44
45 /* The size of each set of counters is altered to get cache alignment */
46 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
47 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
48 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
49 COUNTER_OFFSET(n) * cpu))
50
51
52
53 static DEFINE_MUTEX(ebt_mutex);
54
55 #ifdef CONFIG_COMPAT
56 static void ebt_standard_compat_from_user(void *dst, const void *src)
57 {
58 int v = *(compat_int_t *)src;
59
60 if (v >= 0)
61 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
62 memcpy(dst, &v, sizeof(v));
63 }
64
65 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
66 {
67 compat_int_t cv = *(int *)src;
68
69 if (cv >= 0)
70 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
71 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
72 }
73 #endif
74
75
76 static struct xt_target ebt_standard_target = {
77 .name = "standard",
78 .revision = 0,
79 .family = NFPROTO_BRIDGE,
80 .targetsize = sizeof(int),
81 #ifdef CONFIG_COMPAT
82 .compatsize = sizeof(compat_int_t),
83 .compat_from_user = ebt_standard_compat_from_user,
84 .compat_to_user = ebt_standard_compat_to_user,
85 #endif
86 };
87
88 static inline int
89 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
90 struct xt_action_param *par)
91 {
92 par->target = w->u.watcher;
93 par->targinfo = w->data;
94 w->u.watcher->target(skb, par);
95 /* watchers don't give a verdict */
96 return 0;
97 }
98
99 static inline int
100 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
101 struct xt_action_param *par)
102 {
103 par->match = m->u.match;
104 par->matchinfo = m->data;
105 return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
106 }
107
108 static inline int
109 ebt_dev_check(const char *entry, const struct net_device *device)
110 {
111 int i = 0;
112 const char *devname;
113
114 if (*entry == '\0')
115 return 0;
116 if (!device)
117 return 1;
118 devname = device->name;
119 /* 1 is the wildcard token */
120 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
121 i++;
122 return devname[i] != entry[i] && entry[i] != 1;
123 }
124
125 #define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
126 /* process standard matches */
127 static inline int
128 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
129 const struct net_device *in, const struct net_device *out)
130 {
131 const struct ethhdr *h = eth_hdr(skb);
132 const struct net_bridge_port *p;
133 __be16 ethproto;
134 int verdict, i;
135
136 if (skb_vlan_tag_present(skb))
137 ethproto = htons(ETH_P_8021Q);
138 else
139 ethproto = h->h_proto;
140
141 if (e->bitmask & EBT_802_3) {
142 if (FWINV2(eth_proto_is_802_3(ethproto), EBT_IPROTO))
143 return 1;
144 } else if (!(e->bitmask & EBT_NOPROTO) &&
145 FWINV2(e->ethproto != ethproto, EBT_IPROTO))
146 return 1;
147
148 if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
149 return 1;
150 if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
151 return 1;
152 /* rcu_read_lock()ed by nf_hook_slow */
153 if (in && (p = br_port_get_rcu(in)) != NULL &&
154 FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
155 return 1;
156 if (out && (p = br_port_get_rcu(out)) != NULL &&
157 FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
158 return 1;
159
160 if (e->bitmask & EBT_SOURCEMAC) {
161 verdict = 0;
162 for (i = 0; i < 6; i++)
163 verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
164 e->sourcemsk[i];
165 if (FWINV2(verdict != 0, EBT_ISOURCE) )
166 return 1;
167 }
168 if (e->bitmask & EBT_DESTMAC) {
169 verdict = 0;
170 for (i = 0; i < 6; i++)
171 verdict |= (h->h_dest[i] ^ e->destmac[i]) &
172 e->destmsk[i];
173 if (FWINV2(verdict != 0, EBT_IDEST) )
174 return 1;
175 }
176 return 0;
177 }
178
179 static inline
180 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
181 {
182 return (void *)entry + entry->next_offset;
183 }
184
185 /* Do some firewalling */
186 unsigned int ebt_do_table(struct sk_buff *skb,
187 const struct nf_hook_state *state,
188 struct ebt_table *table)
189 {
190 unsigned int hook = state->hook;
191 int i, nentries;
192 struct ebt_entry *point;
193 struct ebt_counter *counter_base, *cb_base;
194 const struct ebt_entry_target *t;
195 int verdict, sp = 0;
196 struct ebt_chainstack *cs;
197 struct ebt_entries *chaininfo;
198 const char *base;
199 const struct ebt_table_info *private;
200 struct xt_action_param acpar;
201
202 acpar.family = NFPROTO_BRIDGE;
203 acpar.net = state->net;
204 acpar.in = state->in;
205 acpar.out = state->out;
206 acpar.hotdrop = false;
207 acpar.hooknum = hook;
208
209 read_lock_bh(&table->lock);
210 private = table->private;
211 cb_base = COUNTER_BASE(private->counters, private->nentries,
212 smp_processor_id());
213 if (private->chainstack)
214 cs = private->chainstack[smp_processor_id()];
215 else
216 cs = NULL;
217 chaininfo = private->hook_entry[hook];
218 nentries = private->hook_entry[hook]->nentries;
219 point = (struct ebt_entry *)(private->hook_entry[hook]->data);
220 counter_base = cb_base + private->hook_entry[hook]->counter_offset;
221 /* base for chain jumps */
222 base = private->entries;
223 i = 0;
224 while (i < nentries) {
225 if (ebt_basic_match(point, skb, state->in, state->out))
226 goto letscontinue;
227
228 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
229 goto letscontinue;
230 if (acpar.hotdrop) {
231 read_unlock_bh(&table->lock);
232 return NF_DROP;
233 }
234
235 /* increase counter */
236 (*(counter_base + i)).pcnt++;
237 (*(counter_base + i)).bcnt += skb->len;
238
239 /* these should only watch: not modify, nor tell us
240 what to do with the packet */
241 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
242
243 t = (struct ebt_entry_target *)
244 (((char *)point) + point->target_offset);
245 /* standard target */
246 if (!t->u.target->target)
247 verdict = ((struct ebt_standard_target *)t)->verdict;
248 else {
249 acpar.target = t->u.target;
250 acpar.targinfo = t->data;
251 verdict = t->u.target->target(skb, &acpar);
252 }
253 if (verdict == EBT_ACCEPT) {
254 read_unlock_bh(&table->lock);
255 return NF_ACCEPT;
256 }
257 if (verdict == EBT_DROP) {
258 read_unlock_bh(&table->lock);
259 return NF_DROP;
260 }
261 if (verdict == EBT_RETURN) {
262 letsreturn:
263 #ifdef CONFIG_NETFILTER_DEBUG
264 if (sp == 0) {
265 BUGPRINT("RETURN on base chain");
266 /* act like this is EBT_CONTINUE */
267 goto letscontinue;
268 }
269 #endif
270 sp--;
271 /* put all the local variables right */
272 i = cs[sp].n;
273 chaininfo = cs[sp].chaininfo;
274 nentries = chaininfo->nentries;
275 point = cs[sp].e;
276 counter_base = cb_base +
277 chaininfo->counter_offset;
278 continue;
279 }
280 if (verdict == EBT_CONTINUE)
281 goto letscontinue;
282 #ifdef CONFIG_NETFILTER_DEBUG
283 if (verdict < 0) {
284 BUGPRINT("bogus standard verdict\n");
285 read_unlock_bh(&table->lock);
286 return NF_DROP;
287 }
288 #endif
289 /* jump to a udc */
290 cs[sp].n = i + 1;
291 cs[sp].chaininfo = chaininfo;
292 cs[sp].e = ebt_next_entry(point);
293 i = 0;
294 chaininfo = (struct ebt_entries *) (base + verdict);
295 #ifdef CONFIG_NETFILTER_DEBUG
296 if (chaininfo->distinguisher) {
297 BUGPRINT("jump to non-chain\n");
298 read_unlock_bh(&table->lock);
299 return NF_DROP;
300 }
301 #endif
302 nentries = chaininfo->nentries;
303 point = (struct ebt_entry *)chaininfo->data;
304 counter_base = cb_base + chaininfo->counter_offset;
305 sp++;
306 continue;
307 letscontinue:
308 point = ebt_next_entry(point);
309 i++;
310 }
311
312 /* I actually like this :) */
313 if (chaininfo->policy == EBT_RETURN)
314 goto letsreturn;
315 if (chaininfo->policy == EBT_ACCEPT) {
316 read_unlock_bh(&table->lock);
317 return NF_ACCEPT;
318 }
319 read_unlock_bh(&table->lock);
320 return NF_DROP;
321 }
322
323 /* If it succeeds, returns element and locks mutex */
324 static inline void *
325 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
326 struct mutex *mutex)
327 {
328 struct {
329 struct list_head list;
330 char name[EBT_FUNCTION_MAXNAMELEN];
331 } *e;
332
333 mutex_lock(mutex);
334 list_for_each_entry(e, head, list) {
335 if (strcmp(e->name, name) == 0)
336 return e;
337 }
338 *error = -ENOENT;
339 mutex_unlock(mutex);
340 return NULL;
341 }
342
343 static void *
344 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
345 int *error, struct mutex *mutex)
346 {
347 return try_then_request_module(
348 find_inlist_lock_noload(head, name, error, mutex),
349 "%s%s", prefix, name);
350 }
351
352 static inline struct ebt_table *
353 find_table_lock(struct net *net, const char *name, int *error,
354 struct mutex *mutex)
355 {
356 return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
357 "ebtable_", error, mutex);
358 }
359
360 static inline int
361 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
362 unsigned int *cnt)
363 {
364 const struct ebt_entry *e = par->entryinfo;
365 struct xt_match *match;
366 size_t left = ((char *)e + e->watchers_offset) - (char *)m;
367 int ret;
368
369 if (left < sizeof(struct ebt_entry_match) ||
370 left - sizeof(struct ebt_entry_match) < m->match_size)
371 return -EINVAL;
372
373 match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
374 if (IS_ERR(match))
375 return PTR_ERR(match);
376 m->u.match = match;
377
378 par->match = match;
379 par->matchinfo = m->data;
380 ret = xt_check_match(par, m->match_size,
381 e->ethproto, e->invflags & EBT_IPROTO);
382 if (ret < 0) {
383 module_put(match->me);
384 return ret;
385 }
386
387 (*cnt)++;
388 return 0;
389 }
390
391 static inline int
392 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
393 unsigned int *cnt)
394 {
395 const struct ebt_entry *e = par->entryinfo;
396 struct xt_target *watcher;
397 size_t left = ((char *)e + e->target_offset) - (char *)w;
398 int ret;
399
400 if (left < sizeof(struct ebt_entry_watcher) ||
401 left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
402 return -EINVAL;
403
404 watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
405 if (IS_ERR(watcher))
406 return PTR_ERR(watcher);
407 w->u.watcher = watcher;
408
409 par->target = watcher;
410 par->targinfo = w->data;
411 ret = xt_check_target(par, w->watcher_size,
412 e->ethproto, e->invflags & EBT_IPROTO);
413 if (ret < 0) {
414 module_put(watcher->me);
415 return ret;
416 }
417
418 (*cnt)++;
419 return 0;
420 }
421
422 static int ebt_verify_pointers(const struct ebt_replace *repl,
423 struct ebt_table_info *newinfo)
424 {
425 unsigned int limit = repl->entries_size;
426 unsigned int valid_hooks = repl->valid_hooks;
427 unsigned int offset = 0;
428 int i;
429
430 for (i = 0; i < NF_BR_NUMHOOKS; i++)
431 newinfo->hook_entry[i] = NULL;
432
433 newinfo->entries_size = repl->entries_size;
434 newinfo->nentries = repl->nentries;
435
436 while (offset < limit) {
437 size_t left = limit - offset;
438 struct ebt_entry *e = (void *)newinfo->entries + offset;
439
440 if (left < sizeof(unsigned int))
441 break;
442
443 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
444 if ((valid_hooks & (1 << i)) == 0)
445 continue;
446 if ((char __user *)repl->hook_entry[i] ==
447 repl->entries + offset)
448 break;
449 }
450
451 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
452 if (e->bitmask != 0) {
453 /* we make userspace set this right,
454 so there is no misunderstanding */
455 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
456 "in distinguisher\n");
457 return -EINVAL;
458 }
459 if (i != NF_BR_NUMHOOKS)
460 newinfo->hook_entry[i] = (struct ebt_entries *)e;
461 if (left < sizeof(struct ebt_entries))
462 break;
463 offset += sizeof(struct ebt_entries);
464 } else {
465 if (left < sizeof(struct ebt_entry))
466 break;
467 if (left < e->next_offset)
468 break;
469 if (e->next_offset < sizeof(struct ebt_entry))
470 return -EINVAL;
471 offset += e->next_offset;
472 }
473 }
474 if (offset != limit) {
475 BUGPRINT("entries_size too small\n");
476 return -EINVAL;
477 }
478
479 /* check if all valid hooks have a chain */
480 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
481 if (!newinfo->hook_entry[i] &&
482 (valid_hooks & (1 << i))) {
483 BUGPRINT("Valid hook without chain\n");
484 return -EINVAL;
485 }
486 }
487 return 0;
488 }
489
490 /*
491 * this one is very careful, as it is the first function
492 * to parse the userspace data
493 */
494 static inline int
495 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
496 const struct ebt_table_info *newinfo,
497 unsigned int *n, unsigned int *cnt,
498 unsigned int *totalcnt, unsigned int *udc_cnt)
499 {
500 int i;
501
502 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
503 if ((void *)e == (void *)newinfo->hook_entry[i])
504 break;
505 }
506 /* beginning of a new chain
507 if i == NF_BR_NUMHOOKS it must be a user defined chain */
508 if (i != NF_BR_NUMHOOKS || !e->bitmask) {
509 /* this checks if the previous chain has as many entries
510 as it said it has */
511 if (*n != *cnt) {
512 BUGPRINT("nentries does not equal the nr of entries "
513 "in the chain\n");
514 return -EINVAL;
515 }
516 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
517 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
518 /* only RETURN from udc */
519 if (i != NF_BR_NUMHOOKS ||
520 ((struct ebt_entries *)e)->policy != EBT_RETURN) {
521 BUGPRINT("bad policy\n");
522 return -EINVAL;
523 }
524 }
525 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
526 (*udc_cnt)++;
527 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
528 BUGPRINT("counter_offset != totalcnt");
529 return -EINVAL;
530 }
531 *n = ((struct ebt_entries *)e)->nentries;
532 *cnt = 0;
533 return 0;
534 }
535 /* a plain old entry, heh */
536 if (sizeof(struct ebt_entry) > e->watchers_offset ||
537 e->watchers_offset > e->target_offset ||
538 e->target_offset >= e->next_offset) {
539 BUGPRINT("entry offsets not in right order\n");
540 return -EINVAL;
541 }
542 /* this is not checked anywhere else */
543 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
544 BUGPRINT("target size too small\n");
545 return -EINVAL;
546 }
547 (*cnt)++;
548 (*totalcnt)++;
549 return 0;
550 }
551
552 struct ebt_cl_stack
553 {
554 struct ebt_chainstack cs;
555 int from;
556 unsigned int hookmask;
557 };
558
559 /*
560 * we need these positions to check that the jumps to a different part of the
561 * entries is a jump to the beginning of a new chain.
562 */
563 static inline int
564 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
565 unsigned int *n, struct ebt_cl_stack *udc)
566 {
567 int i;
568
569 /* we're only interested in chain starts */
570 if (e->bitmask)
571 return 0;
572 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
573 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
574 break;
575 }
576 /* only care about udc */
577 if (i != NF_BR_NUMHOOKS)
578 return 0;
579
580 udc[*n].cs.chaininfo = (struct ebt_entries *)e;
581 /* these initialisations are depended on later in check_chainloops() */
582 udc[*n].cs.n = 0;
583 udc[*n].hookmask = 0;
584
585 (*n)++;
586 return 0;
587 }
588
589 static inline int
590 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
591 {
592 struct xt_mtdtor_param par;
593
594 if (i && (*i)-- == 0)
595 return 1;
596
597 par.net = net;
598 par.match = m->u.match;
599 par.matchinfo = m->data;
600 par.family = NFPROTO_BRIDGE;
601 if (par.match->destroy != NULL)
602 par.match->destroy(&par);
603 module_put(par.match->me);
604 return 0;
605 }
606
607 static inline int
608 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
609 {
610 struct xt_tgdtor_param par;
611
612 if (i && (*i)-- == 0)
613 return 1;
614
615 par.net = net;
616 par.target = w->u.watcher;
617 par.targinfo = w->data;
618 par.family = NFPROTO_BRIDGE;
619 if (par.target->destroy != NULL)
620 par.target->destroy(&par);
621 module_put(par.target->me);
622 return 0;
623 }
624
625 static inline int
626 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
627 {
628 struct xt_tgdtor_param par;
629 struct ebt_entry_target *t;
630
631 if (e->bitmask == 0)
632 return 0;
633 /* we're done */
634 if (cnt && (*cnt)-- == 0)
635 return 1;
636 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
637 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
638 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
639
640 par.net = net;
641 par.target = t->u.target;
642 par.targinfo = t->data;
643 par.family = NFPROTO_BRIDGE;
644 if (par.target->destroy != NULL)
645 par.target->destroy(&par);
646 module_put(par.target->me);
647 return 0;
648 }
649
650 static inline int
651 ebt_check_entry(struct ebt_entry *e, struct net *net,
652 const struct ebt_table_info *newinfo,
653 const char *name, unsigned int *cnt,
654 struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
655 {
656 struct ebt_entry_target *t;
657 struct xt_target *target;
658 unsigned int i, j, hook = 0, hookmask = 0;
659 size_t gap;
660 int ret;
661 struct xt_mtchk_param mtpar;
662 struct xt_tgchk_param tgpar;
663
664 /* don't mess with the struct ebt_entries */
665 if (e->bitmask == 0)
666 return 0;
667
668 if (e->bitmask & ~EBT_F_MASK) {
669 BUGPRINT("Unknown flag for bitmask\n");
670 return -EINVAL;
671 }
672 if (e->invflags & ~EBT_INV_MASK) {
673 BUGPRINT("Unknown flag for inv bitmask\n");
674 return -EINVAL;
675 }
676 if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
677 BUGPRINT("NOPROTO & 802_3 not allowed\n");
678 return -EINVAL;
679 }
680 /* what hook do we belong to? */
681 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
682 if (!newinfo->hook_entry[i])
683 continue;
684 if ((char *)newinfo->hook_entry[i] < (char *)e)
685 hook = i;
686 else
687 break;
688 }
689 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
690 a base chain */
691 if (i < NF_BR_NUMHOOKS)
692 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
693 else {
694 for (i = 0; i < udc_cnt; i++)
695 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
696 break;
697 if (i == 0)
698 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
699 else
700 hookmask = cl_s[i - 1].hookmask;
701 }
702 i = 0;
703
704 mtpar.net = tgpar.net = net;
705 mtpar.table = tgpar.table = name;
706 mtpar.entryinfo = tgpar.entryinfo = e;
707 mtpar.hook_mask = tgpar.hook_mask = hookmask;
708 mtpar.family = tgpar.family = NFPROTO_BRIDGE;
709 ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
710 if (ret != 0)
711 goto cleanup_matches;
712 j = 0;
713 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
714 if (ret != 0)
715 goto cleanup_watchers;
716 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
717 gap = e->next_offset - e->target_offset;
718
719 target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
720 if (IS_ERR(target)) {
721 ret = PTR_ERR(target);
722 goto cleanup_watchers;
723 }
724
725 t->u.target = target;
726 if (t->u.target == &ebt_standard_target) {
727 if (gap < sizeof(struct ebt_standard_target)) {
728 BUGPRINT("Standard target size too big\n");
729 ret = -EFAULT;
730 goto cleanup_watchers;
731 }
732 if (((struct ebt_standard_target *)t)->verdict <
733 -NUM_STANDARD_TARGETS) {
734 BUGPRINT("Invalid standard target\n");
735 ret = -EFAULT;
736 goto cleanup_watchers;
737 }
738 } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
739 module_put(t->u.target->me);
740 ret = -EFAULT;
741 goto cleanup_watchers;
742 }
743
744 tgpar.target = target;
745 tgpar.targinfo = t->data;
746 ret = xt_check_target(&tgpar, t->target_size,
747 e->ethproto, e->invflags & EBT_IPROTO);
748 if (ret < 0) {
749 module_put(target->me);
750 goto cleanup_watchers;
751 }
752 (*cnt)++;
753 return 0;
754 cleanup_watchers:
755 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
756 cleanup_matches:
757 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
758 return ret;
759 }
760
761 /*
762 * checks for loops and sets the hook mask for udc
763 * the hook mask for udc tells us from which base chains the udc can be
764 * accessed. This mask is a parameter to the check() functions of the extensions
765 */
766 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
767 unsigned int udc_cnt, unsigned int hooknr, char *base)
768 {
769 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
770 const struct ebt_entry *e = (struct ebt_entry *)chain->data;
771 const struct ebt_entry_target *t;
772
773 while (pos < nentries || chain_nr != -1) {
774 /* end of udc, go back one 'recursion' step */
775 if (pos == nentries) {
776 /* put back values of the time when this chain was called */
777 e = cl_s[chain_nr].cs.e;
778 if (cl_s[chain_nr].from != -1)
779 nentries =
780 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
781 else
782 nentries = chain->nentries;
783 pos = cl_s[chain_nr].cs.n;
784 /* make sure we won't see a loop that isn't one */
785 cl_s[chain_nr].cs.n = 0;
786 chain_nr = cl_s[chain_nr].from;
787 if (pos == nentries)
788 continue;
789 }
790 t = (struct ebt_entry_target *)
791 (((char *)e) + e->target_offset);
792 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
793 goto letscontinue;
794 if (e->target_offset + sizeof(struct ebt_standard_target) >
795 e->next_offset) {
796 BUGPRINT("Standard target size too big\n");
797 return -1;
798 }
799 verdict = ((struct ebt_standard_target *)t)->verdict;
800 if (verdict >= 0) { /* jump to another chain */
801 struct ebt_entries *hlp2 =
802 (struct ebt_entries *)(base + verdict);
803 for (i = 0; i < udc_cnt; i++)
804 if (hlp2 == cl_s[i].cs.chaininfo)
805 break;
806 /* bad destination or loop */
807 if (i == udc_cnt) {
808 BUGPRINT("bad destination\n");
809 return -1;
810 }
811 if (cl_s[i].cs.n) {
812 BUGPRINT("loop\n");
813 return -1;
814 }
815 if (cl_s[i].hookmask & (1 << hooknr))
816 goto letscontinue;
817 /* this can't be 0, so the loop test is correct */
818 cl_s[i].cs.n = pos + 1;
819 pos = 0;
820 cl_s[i].cs.e = ebt_next_entry(e);
821 e = (struct ebt_entry *)(hlp2->data);
822 nentries = hlp2->nentries;
823 cl_s[i].from = chain_nr;
824 chain_nr = i;
825 /* this udc is accessible from the base chain for hooknr */
826 cl_s[i].hookmask |= (1 << hooknr);
827 continue;
828 }
829 letscontinue:
830 e = ebt_next_entry(e);
831 pos++;
832 }
833 return 0;
834 }
835
836 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
837 static int translate_table(struct net *net, const char *name,
838 struct ebt_table_info *newinfo)
839 {
840 unsigned int i, j, k, udc_cnt;
841 int ret;
842 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
843
844 i = 0;
845 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
846 i++;
847 if (i == NF_BR_NUMHOOKS) {
848 BUGPRINT("No valid hooks specified\n");
849 return -EINVAL;
850 }
851 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
852 BUGPRINT("Chains don't start at beginning\n");
853 return -EINVAL;
854 }
855 /* make sure chains are ordered after each other in same order
856 as their corresponding hooks */
857 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
858 if (!newinfo->hook_entry[j])
859 continue;
860 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
861 BUGPRINT("Hook order must be followed\n");
862 return -EINVAL;
863 }
864 i = j;
865 }
866
867 /* do some early checkings and initialize some things */
868 i = 0; /* holds the expected nr. of entries for the chain */
869 j = 0; /* holds the up to now counted entries for the chain */
870 k = 0; /* holds the total nr. of entries, should equal
871 newinfo->nentries afterwards */
872 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
873 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
874 ebt_check_entry_size_and_hooks, newinfo,
875 &i, &j, &k, &udc_cnt);
876
877 if (ret != 0)
878 return ret;
879
880 if (i != j) {
881 BUGPRINT("nentries does not equal the nr of entries in the "
882 "(last) chain\n");
883 return -EINVAL;
884 }
885 if (k != newinfo->nentries) {
886 BUGPRINT("Total nentries is wrong\n");
887 return -EINVAL;
888 }
889
890 /* get the location of the udc, put them in an array
891 while we're at it, allocate the chainstack */
892 if (udc_cnt) {
893 /* this will get free'd in do_replace()/ebt_register_table()
894 if an error occurs */
895 newinfo->chainstack =
896 vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
897 if (!newinfo->chainstack)
898 return -ENOMEM;
899 for_each_possible_cpu(i) {
900 newinfo->chainstack[i] =
901 vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
902 if (!newinfo->chainstack[i]) {
903 while (i)
904 vfree(newinfo->chainstack[--i]);
905 vfree(newinfo->chainstack);
906 newinfo->chainstack = NULL;
907 return -ENOMEM;
908 }
909 }
910
911 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
912 if (!cl_s)
913 return -ENOMEM;
914 i = 0; /* the i'th udc */
915 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
916 ebt_get_udc_positions, newinfo, &i, cl_s);
917 /* sanity check */
918 if (i != udc_cnt) {
919 BUGPRINT("i != udc_cnt\n");
920 vfree(cl_s);
921 return -EFAULT;
922 }
923 }
924
925 /* Check for loops */
926 for (i = 0; i < NF_BR_NUMHOOKS; i++)
927 if (newinfo->hook_entry[i])
928 if (check_chainloops(newinfo->hook_entry[i],
929 cl_s, udc_cnt, i, newinfo->entries)) {
930 vfree(cl_s);
931 return -EINVAL;
932 }
933
934 /* we now know the following (along with E=mc²):
935 - the nr of entries in each chain is right
936 - the size of the allocated space is right
937 - all valid hooks have a corresponding chain
938 - there are no loops
939 - wrong data can still be on the level of a single entry
940 - could be there are jumps to places that are not the
941 beginning of a chain. This can only occur in chains that
942 are not accessible from any base chains, so we don't care. */
943
944 /* used to know what we need to clean up if something goes wrong */
945 i = 0;
946 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
947 ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
948 if (ret != 0) {
949 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
950 ebt_cleanup_entry, net, &i);
951 }
952 vfree(cl_s);
953 return ret;
954 }
955
956 /* called under write_lock */
957 static void get_counters(const struct ebt_counter *oldcounters,
958 struct ebt_counter *counters, unsigned int nentries)
959 {
960 int i, cpu;
961 struct ebt_counter *counter_base;
962
963 /* counters of cpu 0 */
964 memcpy(counters, oldcounters,
965 sizeof(struct ebt_counter) * nentries);
966
967 /* add other counters to those of cpu 0 */
968 for_each_possible_cpu(cpu) {
969 if (cpu == 0)
970 continue;
971 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
972 for (i = 0; i < nentries; i++) {
973 counters[i].pcnt += counter_base[i].pcnt;
974 counters[i].bcnt += counter_base[i].bcnt;
975 }
976 }
977 }
978
979 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
980 struct ebt_table_info *newinfo)
981 {
982 int ret, i;
983 struct ebt_counter *counterstmp = NULL;
984 /* used to be able to unlock earlier */
985 struct ebt_table_info *table;
986 struct ebt_table *t;
987
988 /* the user wants counters back
989 the check on the size is done later, when we have the lock */
990 if (repl->num_counters) {
991 unsigned long size = repl->num_counters * sizeof(*counterstmp);
992 counterstmp = vmalloc(size);
993 if (!counterstmp)
994 return -ENOMEM;
995 }
996
997 newinfo->chainstack = NULL;
998 ret = ebt_verify_pointers(repl, newinfo);
999 if (ret != 0)
1000 goto free_counterstmp;
1001
1002 ret = translate_table(net, repl->name, newinfo);
1003
1004 if (ret != 0)
1005 goto free_counterstmp;
1006
1007 t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1008 if (!t) {
1009 ret = -ENOENT;
1010 goto free_iterate;
1011 }
1012
1013 /* the table doesn't like it */
1014 if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1015 goto free_unlock;
1016
1017 if (repl->num_counters && repl->num_counters != t->private->nentries) {
1018 BUGPRINT("Wrong nr. of counters requested\n");
1019 ret = -EINVAL;
1020 goto free_unlock;
1021 }
1022
1023 /* we have the mutex lock, so no danger in reading this pointer */
1024 table = t->private;
1025 /* make sure the table can only be rmmod'ed if it contains no rules */
1026 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1027 ret = -ENOENT;
1028 goto free_unlock;
1029 } else if (table->nentries && !newinfo->nentries)
1030 module_put(t->me);
1031 /* we need an atomic snapshot of the counters */
1032 write_lock_bh(&t->lock);
1033 if (repl->num_counters)
1034 get_counters(t->private->counters, counterstmp,
1035 t->private->nentries);
1036
1037 t->private = newinfo;
1038 write_unlock_bh(&t->lock);
1039 mutex_unlock(&ebt_mutex);
1040 /* so, a user can change the chains while having messed up her counter
1041 allocation. Only reason why this is done is because this way the lock
1042 is held only once, while this doesn't bring the kernel into a
1043 dangerous state. */
1044 if (repl->num_counters &&
1045 copy_to_user(repl->counters, counterstmp,
1046 repl->num_counters * sizeof(struct ebt_counter))) {
1047 /* Silent error, can't fail, new table is already in place */
1048 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
1049 }
1050
1051 /* decrease module count and free resources */
1052 EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1053 ebt_cleanup_entry, net, NULL);
1054
1055 vfree(table->entries);
1056 if (table->chainstack) {
1057 for_each_possible_cpu(i)
1058 vfree(table->chainstack[i]);
1059 vfree(table->chainstack);
1060 }
1061 vfree(table);
1062
1063 vfree(counterstmp);
1064
1065 #ifdef CONFIG_AUDIT
1066 if (audit_enabled) {
1067 struct audit_buffer *ab;
1068
1069 ab = audit_log_start(current->audit_context, GFP_KERNEL,
1070 AUDIT_NETFILTER_CFG);
1071 if (ab) {
1072 audit_log_format(ab, "table=%s family=%u entries=%u",
1073 repl->name, AF_BRIDGE, repl->nentries);
1074 audit_log_end(ab);
1075 }
1076 }
1077 #endif
1078 return ret;
1079
1080 free_unlock:
1081 mutex_unlock(&ebt_mutex);
1082 free_iterate:
1083 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1084 ebt_cleanup_entry, net, NULL);
1085 free_counterstmp:
1086 vfree(counterstmp);
1087 /* can be initialized in translate_table() */
1088 if (newinfo->chainstack) {
1089 for_each_possible_cpu(i)
1090 vfree(newinfo->chainstack[i]);
1091 vfree(newinfo->chainstack);
1092 }
1093 return ret;
1094 }
1095
1096 /* replace the table */
1097 static int do_replace(struct net *net, const void __user *user,
1098 unsigned int len)
1099 {
1100 int ret, countersize;
1101 struct ebt_table_info *newinfo;
1102 struct ebt_replace tmp;
1103
1104 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1105 return -EFAULT;
1106
1107 if (len != sizeof(tmp) + tmp.entries_size) {
1108 BUGPRINT("Wrong len argument\n");
1109 return -EINVAL;
1110 }
1111
1112 if (tmp.entries_size == 0) {
1113 BUGPRINT("Entries_size never zero\n");
1114 return -EINVAL;
1115 }
1116 /* overflow check */
1117 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1118 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1119 return -ENOMEM;
1120 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1121 return -ENOMEM;
1122
1123 tmp.name[sizeof(tmp.name) - 1] = 0;
1124
1125 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1126 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1127 if (!newinfo)
1128 return -ENOMEM;
1129
1130 if (countersize)
1131 memset(newinfo->counters, 0, countersize);
1132
1133 newinfo->entries = vmalloc(tmp.entries_size);
1134 if (!newinfo->entries) {
1135 ret = -ENOMEM;
1136 goto free_newinfo;
1137 }
1138 if (copy_from_user(
1139 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1140 BUGPRINT("Couldn't copy entries from userspace\n");
1141 ret = -EFAULT;
1142 goto free_entries;
1143 }
1144
1145 ret = do_replace_finish(net, &tmp, newinfo);
1146 if (ret == 0)
1147 return ret;
1148 free_entries:
1149 vfree(newinfo->entries);
1150 free_newinfo:
1151 vfree(newinfo);
1152 return ret;
1153 }
1154
1155 struct ebt_table *
1156 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1157 {
1158 struct ebt_table_info *newinfo;
1159 struct ebt_table *t, *table;
1160 struct ebt_replace_kernel *repl;
1161 int ret, i, countersize;
1162 void *p;
1163
1164 if (input_table == NULL || (repl = input_table->table) == NULL ||
1165 repl->entries == NULL || repl->entries_size == 0 ||
1166 repl->counters != NULL || input_table->private != NULL) {
1167 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1168 return ERR_PTR(-EINVAL);
1169 }
1170
1171 /* Don't add one table to multiple lists. */
1172 table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1173 if (!table) {
1174 ret = -ENOMEM;
1175 goto out;
1176 }
1177
1178 countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1179 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1180 ret = -ENOMEM;
1181 if (!newinfo)
1182 goto free_table;
1183
1184 p = vmalloc(repl->entries_size);
1185 if (!p)
1186 goto free_newinfo;
1187
1188 memcpy(p, repl->entries, repl->entries_size);
1189 newinfo->entries = p;
1190
1191 newinfo->entries_size = repl->entries_size;
1192 newinfo->nentries = repl->nentries;
1193
1194 if (countersize)
1195 memset(newinfo->counters, 0, countersize);
1196
1197 /* fill in newinfo and parse the entries */
1198 newinfo->chainstack = NULL;
1199 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1200 if ((repl->valid_hooks & (1 << i)) == 0)
1201 newinfo->hook_entry[i] = NULL;
1202 else
1203 newinfo->hook_entry[i] = p +
1204 ((char *)repl->hook_entry[i] - repl->entries);
1205 }
1206 ret = translate_table(net, repl->name, newinfo);
1207 if (ret != 0) {
1208 BUGPRINT("Translate_table failed\n");
1209 goto free_chainstack;
1210 }
1211
1212 if (table->check && table->check(newinfo, table->valid_hooks)) {
1213 BUGPRINT("The table doesn't like its own initial data, lol\n");
1214 ret = -EINVAL;
1215 goto free_chainstack;
1216 }
1217
1218 table->private = newinfo;
1219 rwlock_init(&table->lock);
1220 mutex_lock(&ebt_mutex);
1221 list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1222 if (strcmp(t->name, table->name) == 0) {
1223 ret = -EEXIST;
1224 BUGPRINT("Table name already exists\n");
1225 goto free_unlock;
1226 }
1227 }
1228
1229 /* Hold a reference count if the chains aren't empty */
1230 if (newinfo->nentries && !try_module_get(table->me)) {
1231 ret = -ENOENT;
1232 goto free_unlock;
1233 }
1234 list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1235 mutex_unlock(&ebt_mutex);
1236 return table;
1237 free_unlock:
1238 mutex_unlock(&ebt_mutex);
1239 free_chainstack:
1240 if (newinfo->chainstack) {
1241 for_each_possible_cpu(i)
1242 vfree(newinfo->chainstack[i]);
1243 vfree(newinfo->chainstack);
1244 }
1245 vfree(newinfo->entries);
1246 free_newinfo:
1247 vfree(newinfo);
1248 free_table:
1249 kfree(table);
1250 out:
1251 return ERR_PTR(ret);
1252 }
1253
1254 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1255 {
1256 int i;
1257
1258 if (!table) {
1259 BUGPRINT("Request to unregister NULL table!!!\n");
1260 return;
1261 }
1262 mutex_lock(&ebt_mutex);
1263 list_del(&table->list);
1264 mutex_unlock(&ebt_mutex);
1265 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1266 ebt_cleanup_entry, net, NULL);
1267 if (table->private->nentries)
1268 module_put(table->me);
1269 vfree(table->private->entries);
1270 if (table->private->chainstack) {
1271 for_each_possible_cpu(i)
1272 vfree(table->private->chainstack[i]);
1273 vfree(table->private->chainstack);
1274 }
1275 vfree(table->private);
1276 kfree(table);
1277 }
1278
1279 /* userspace just supplied us with counters */
1280 static int do_update_counters(struct net *net, const char *name,
1281 struct ebt_counter __user *counters,
1282 unsigned int num_counters,
1283 const void __user *user, unsigned int len)
1284 {
1285 int i, ret;
1286 struct ebt_counter *tmp;
1287 struct ebt_table *t;
1288
1289 if (num_counters == 0)
1290 return -EINVAL;
1291
1292 tmp = vmalloc(num_counters * sizeof(*tmp));
1293 if (!tmp)
1294 return -ENOMEM;
1295
1296 t = find_table_lock(net, name, &ret, &ebt_mutex);
1297 if (!t)
1298 goto free_tmp;
1299
1300 if (num_counters != t->private->nentries) {
1301 BUGPRINT("Wrong nr of counters\n");
1302 ret = -EINVAL;
1303 goto unlock_mutex;
1304 }
1305
1306 if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1307 ret = -EFAULT;
1308 goto unlock_mutex;
1309 }
1310
1311 /* we want an atomic add of the counters */
1312 write_lock_bh(&t->lock);
1313
1314 /* we add to the counters of the first cpu */
1315 for (i = 0; i < num_counters; i++) {
1316 t->private->counters[i].pcnt += tmp[i].pcnt;
1317 t->private->counters[i].bcnt += tmp[i].bcnt;
1318 }
1319
1320 write_unlock_bh(&t->lock);
1321 ret = 0;
1322 unlock_mutex:
1323 mutex_unlock(&ebt_mutex);
1324 free_tmp:
1325 vfree(tmp);
1326 return ret;
1327 }
1328
1329 static int update_counters(struct net *net, const void __user *user,
1330 unsigned int len)
1331 {
1332 struct ebt_replace hlp;
1333
1334 if (copy_from_user(&hlp, user, sizeof(hlp)))
1335 return -EFAULT;
1336
1337 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1338 return -EINVAL;
1339
1340 return do_update_counters(net, hlp.name, hlp.counters,
1341 hlp.num_counters, user, len);
1342 }
1343
1344 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1345 const char *base, char __user *ubase)
1346 {
1347 char __user *hlp = ubase + ((char *)m - base);
1348 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1349
1350 /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
1351 long. Copy 29 bytes and fill remaining bytes with zeroes. */
1352 strlcpy(name, m->u.match->name, sizeof(name));
1353 if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1354 return -EFAULT;
1355 return 0;
1356 }
1357
1358 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1359 const char *base, char __user *ubase)
1360 {
1361 char __user *hlp = ubase + ((char *)w - base);
1362 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1363
1364 strlcpy(name, w->u.watcher->name, sizeof(name));
1365 if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
1366 return -EFAULT;
1367 return 0;
1368 }
1369
1370 static inline int
1371 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1372 {
1373 int ret;
1374 char __user *hlp;
1375 const struct ebt_entry_target *t;
1376 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1377
1378 if (e->bitmask == 0)
1379 return 0;
1380
1381 hlp = ubase + (((char *)e + e->target_offset) - base);
1382 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1383
1384 ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1385 if (ret != 0)
1386 return ret;
1387 ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1388 if (ret != 0)
1389 return ret;
1390 strlcpy(name, t->u.target->name, sizeof(name));
1391 if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1392 return -EFAULT;
1393 return 0;
1394 }
1395
1396 static int copy_counters_to_user(struct ebt_table *t,
1397 const struct ebt_counter *oldcounters,
1398 void __user *user, unsigned int num_counters,
1399 unsigned int nentries)
1400 {
1401 struct ebt_counter *counterstmp;
1402 int ret = 0;
1403
1404 /* userspace might not need the counters */
1405 if (num_counters == 0)
1406 return 0;
1407
1408 if (num_counters != nentries) {
1409 BUGPRINT("Num_counters wrong\n");
1410 return -EINVAL;
1411 }
1412
1413 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1414 if (!counterstmp)
1415 return -ENOMEM;
1416
1417 write_lock_bh(&t->lock);
1418 get_counters(oldcounters, counterstmp, nentries);
1419 write_unlock_bh(&t->lock);
1420
1421 if (copy_to_user(user, counterstmp,
1422 nentries * sizeof(struct ebt_counter)))
1423 ret = -EFAULT;
1424 vfree(counterstmp);
1425 return ret;
1426 }
1427
1428 /* called with ebt_mutex locked */
1429 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1430 const int *len, int cmd)
1431 {
1432 struct ebt_replace tmp;
1433 const struct ebt_counter *oldcounters;
1434 unsigned int entries_size, nentries;
1435 int ret;
1436 char *entries;
1437
1438 if (cmd == EBT_SO_GET_ENTRIES) {
1439 entries_size = t->private->entries_size;
1440 nentries = t->private->nentries;
1441 entries = t->private->entries;
1442 oldcounters = t->private->counters;
1443 } else {
1444 entries_size = t->table->entries_size;
1445 nentries = t->table->nentries;
1446 entries = t->table->entries;
1447 oldcounters = t->table->counters;
1448 }
1449
1450 if (copy_from_user(&tmp, user, sizeof(tmp)))
1451 return -EFAULT;
1452
1453 if (*len != sizeof(struct ebt_replace) + entries_size +
1454 (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
1455 return -EINVAL;
1456
1457 if (tmp.nentries != nentries) {
1458 BUGPRINT("Nentries wrong\n");
1459 return -EINVAL;
1460 }
1461
1462 if (tmp.entries_size != entries_size) {
1463 BUGPRINT("Wrong size\n");
1464 return -EINVAL;
1465 }
1466
1467 ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1468 tmp.num_counters, nentries);
1469 if (ret)
1470 return ret;
1471
1472 if (copy_to_user(tmp.entries, entries, entries_size)) {
1473 BUGPRINT("Couldn't copy entries to userspace\n");
1474 return -EFAULT;
1475 }
1476 /* set the match/watcher/target names right */
1477 return EBT_ENTRY_ITERATE(entries, entries_size,
1478 ebt_make_names, entries, tmp.entries);
1479 }
1480
1481 static int do_ebt_set_ctl(struct sock *sk,
1482 int cmd, void __user *user, unsigned int len)
1483 {
1484 int ret;
1485 struct net *net = sock_net(sk);
1486
1487 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1488 return -EPERM;
1489
1490 switch (cmd) {
1491 case EBT_SO_SET_ENTRIES:
1492 ret = do_replace(net, user, len);
1493 break;
1494 case EBT_SO_SET_COUNTERS:
1495 ret = update_counters(net, user, len);
1496 break;
1497 default:
1498 ret = -EINVAL;
1499 }
1500 return ret;
1501 }
1502
1503 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1504 {
1505 int ret;
1506 struct ebt_replace tmp;
1507 struct ebt_table *t;
1508 struct net *net = sock_net(sk);
1509
1510 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1511 return -EPERM;
1512
1513 if (copy_from_user(&tmp, user, sizeof(tmp)))
1514 return -EFAULT;
1515
1516 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1517 if (!t)
1518 return ret;
1519
1520 switch (cmd) {
1521 case EBT_SO_GET_INFO:
1522 case EBT_SO_GET_INIT_INFO:
1523 if (*len != sizeof(struct ebt_replace)) {
1524 ret = -EINVAL;
1525 mutex_unlock(&ebt_mutex);
1526 break;
1527 }
1528 if (cmd == EBT_SO_GET_INFO) {
1529 tmp.nentries = t->private->nentries;
1530 tmp.entries_size = t->private->entries_size;
1531 tmp.valid_hooks = t->valid_hooks;
1532 } else {
1533 tmp.nentries = t->table->nentries;
1534 tmp.entries_size = t->table->entries_size;
1535 tmp.valid_hooks = t->table->valid_hooks;
1536 }
1537 mutex_unlock(&ebt_mutex);
1538 if (copy_to_user(user, &tmp, *len) != 0) {
1539 BUGPRINT("c2u Didn't work\n");
1540 ret = -EFAULT;
1541 break;
1542 }
1543 ret = 0;
1544 break;
1545
1546 case EBT_SO_GET_ENTRIES:
1547 case EBT_SO_GET_INIT_ENTRIES:
1548 ret = copy_everything_to_user(t, user, len, cmd);
1549 mutex_unlock(&ebt_mutex);
1550 break;
1551
1552 default:
1553 mutex_unlock(&ebt_mutex);
1554 ret = -EINVAL;
1555 }
1556
1557 return ret;
1558 }
1559
1560 #ifdef CONFIG_COMPAT
1561 /* 32 bit-userspace compatibility definitions. */
1562 struct compat_ebt_replace {
1563 char name[EBT_TABLE_MAXNAMELEN];
1564 compat_uint_t valid_hooks;
1565 compat_uint_t nentries;
1566 compat_uint_t entries_size;
1567 /* start of the chains */
1568 compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1569 /* nr of counters userspace expects back */
1570 compat_uint_t num_counters;
1571 /* where the kernel will put the old counters. */
1572 compat_uptr_t counters;
1573 compat_uptr_t entries;
1574 };
1575
1576 /* struct ebt_entry_match, _target and _watcher have same layout */
1577 struct compat_ebt_entry_mwt {
1578 union {
1579 char name[EBT_FUNCTION_MAXNAMELEN];
1580 compat_uptr_t ptr;
1581 } u;
1582 compat_uint_t match_size;
1583 compat_uint_t data[0];
1584 };
1585
1586 /* account for possible padding between match_size and ->data */
1587 static int ebt_compat_entry_padsize(void)
1588 {
1589 BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1590 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1591 return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1592 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1593 }
1594
1595 static int ebt_compat_match_offset(const struct xt_match *match,
1596 unsigned int userlen)
1597 {
1598 /*
1599 * ebt_among needs special handling. The kernel .matchsize is
1600 * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1601 * value is expected.
1602 * Example: userspace sends 4500, ebt_among.c wants 4504.
1603 */
1604 if (unlikely(match->matchsize == -1))
1605 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1606 return xt_compat_match_offset(match);
1607 }
1608
1609 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1610 unsigned int *size)
1611 {
1612 const struct xt_match *match = m->u.match;
1613 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1614 int off = ebt_compat_match_offset(match, m->match_size);
1615 compat_uint_t msize = m->match_size - off;
1616
1617 BUG_ON(off >= m->match_size);
1618
1619 if (copy_to_user(cm->u.name, match->name,
1620 strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1621 return -EFAULT;
1622
1623 if (match->compat_to_user) {
1624 if (match->compat_to_user(cm->data, m->data))
1625 return -EFAULT;
1626 } else if (copy_to_user(cm->data, m->data, msize))
1627 return -EFAULT;
1628
1629 *size -= ebt_compat_entry_padsize() + off;
1630 *dstptr = cm->data;
1631 *dstptr += msize;
1632 return 0;
1633 }
1634
1635 static int compat_target_to_user(struct ebt_entry_target *t,
1636 void __user **dstptr,
1637 unsigned int *size)
1638 {
1639 const struct xt_target *target = t->u.target;
1640 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1641 int off = xt_compat_target_offset(target);
1642 compat_uint_t tsize = t->target_size - off;
1643
1644 BUG_ON(off >= t->target_size);
1645
1646 if (copy_to_user(cm->u.name, target->name,
1647 strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1648 return -EFAULT;
1649
1650 if (target->compat_to_user) {
1651 if (target->compat_to_user(cm->data, t->data))
1652 return -EFAULT;
1653 } else if (copy_to_user(cm->data, t->data, tsize))
1654 return -EFAULT;
1655
1656 *size -= ebt_compat_entry_padsize() + off;
1657 *dstptr = cm->data;
1658 *dstptr += tsize;
1659 return 0;
1660 }
1661
1662 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1663 void __user **dstptr,
1664 unsigned int *size)
1665 {
1666 return compat_target_to_user((struct ebt_entry_target *)w,
1667 dstptr, size);
1668 }
1669
1670 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1671 unsigned int *size)
1672 {
1673 struct ebt_entry_target *t;
1674 struct ebt_entry __user *ce;
1675 u32 watchers_offset, target_offset, next_offset;
1676 compat_uint_t origsize;
1677 int ret;
1678
1679 if (e->bitmask == 0) {
1680 if (*size < sizeof(struct ebt_entries))
1681 return -EINVAL;
1682 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1683 return -EFAULT;
1684
1685 *dstptr += sizeof(struct ebt_entries);
1686 *size -= sizeof(struct ebt_entries);
1687 return 0;
1688 }
1689
1690 if (*size < sizeof(*ce))
1691 return -EINVAL;
1692
1693 ce = (struct ebt_entry __user *)*dstptr;
1694 if (copy_to_user(ce, e, sizeof(*ce)))
1695 return -EFAULT;
1696
1697 origsize = *size;
1698 *dstptr += sizeof(*ce);
1699
1700 ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1701 if (ret)
1702 return ret;
1703 watchers_offset = e->watchers_offset - (origsize - *size);
1704
1705 ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1706 if (ret)
1707 return ret;
1708 target_offset = e->target_offset - (origsize - *size);
1709
1710 t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1711
1712 ret = compat_target_to_user(t, dstptr, size);
1713 if (ret)
1714 return ret;
1715 next_offset = e->next_offset - (origsize - *size);
1716
1717 if (put_user(watchers_offset, &ce->watchers_offset) ||
1718 put_user(target_offset, &ce->target_offset) ||
1719 put_user(next_offset, &ce->next_offset))
1720 return -EFAULT;
1721
1722 *size -= sizeof(*ce);
1723 return 0;
1724 }
1725
1726 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1727 {
1728 *off += ebt_compat_match_offset(m->u.match, m->match_size);
1729 *off += ebt_compat_entry_padsize();
1730 return 0;
1731 }
1732
1733 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1734 {
1735 *off += xt_compat_target_offset(w->u.watcher);
1736 *off += ebt_compat_entry_padsize();
1737 return 0;
1738 }
1739
1740 static int compat_calc_entry(const struct ebt_entry *e,
1741 const struct ebt_table_info *info,
1742 const void *base,
1743 struct compat_ebt_replace *newinfo)
1744 {
1745 const struct ebt_entry_target *t;
1746 unsigned int entry_offset;
1747 int off, ret, i;
1748
1749 if (e->bitmask == 0)
1750 return 0;
1751
1752 off = 0;
1753 entry_offset = (void *)e - base;
1754
1755 EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1756 EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1757
1758 t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1759
1760 off += xt_compat_target_offset(t->u.target);
1761 off += ebt_compat_entry_padsize();
1762
1763 newinfo->entries_size -= off;
1764
1765 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1766 if (ret)
1767 return ret;
1768
1769 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1770 const void *hookptr = info->hook_entry[i];
1771 if (info->hook_entry[i] &&
1772 (e < (struct ebt_entry *)(base - hookptr))) {
1773 newinfo->hook_entry[i] -= off;
1774 pr_debug("0x%08X -> 0x%08X\n",
1775 newinfo->hook_entry[i] + off,
1776 newinfo->hook_entry[i]);
1777 }
1778 }
1779
1780 return 0;
1781 }
1782
1783
1784 static int compat_table_info(const struct ebt_table_info *info,
1785 struct compat_ebt_replace *newinfo)
1786 {
1787 unsigned int size = info->entries_size;
1788 const void *entries = info->entries;
1789
1790 newinfo->entries_size = size;
1791
1792 xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
1793 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1794 entries, newinfo);
1795 }
1796
1797 static int compat_copy_everything_to_user(struct ebt_table *t,
1798 void __user *user, int *len, int cmd)
1799 {
1800 struct compat_ebt_replace repl, tmp;
1801 struct ebt_counter *oldcounters;
1802 struct ebt_table_info tinfo;
1803 int ret;
1804 void __user *pos;
1805
1806 memset(&tinfo, 0, sizeof(tinfo));
1807
1808 if (cmd == EBT_SO_GET_ENTRIES) {
1809 tinfo.entries_size = t->private->entries_size;
1810 tinfo.nentries = t->private->nentries;
1811 tinfo.entries = t->private->entries;
1812 oldcounters = t->private->counters;
1813 } else {
1814 tinfo.entries_size = t->table->entries_size;
1815 tinfo.nentries = t->table->nentries;
1816 tinfo.entries = t->table->entries;
1817 oldcounters = t->table->counters;
1818 }
1819
1820 if (copy_from_user(&tmp, user, sizeof(tmp)))
1821 return -EFAULT;
1822
1823 if (tmp.nentries != tinfo.nentries ||
1824 (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1825 return -EINVAL;
1826
1827 memcpy(&repl, &tmp, sizeof(repl));
1828 if (cmd == EBT_SO_GET_ENTRIES)
1829 ret = compat_table_info(t->private, &repl);
1830 else
1831 ret = compat_table_info(&tinfo, &repl);
1832 if (ret)
1833 return ret;
1834
1835 if (*len != sizeof(tmp) + repl.entries_size +
1836 (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1837 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1838 *len, tinfo.entries_size, repl.entries_size);
1839 return -EINVAL;
1840 }
1841
1842 /* userspace might not need the counters */
1843 ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1844 tmp.num_counters, tinfo.nentries);
1845 if (ret)
1846 return ret;
1847
1848 pos = compat_ptr(tmp.entries);
1849 return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1850 compat_copy_entry_to_user, &pos, &tmp.entries_size);
1851 }
1852
1853 struct ebt_entries_buf_state {
1854 char *buf_kern_start; /* kernel buffer to copy (translated) data to */
1855 u32 buf_kern_len; /* total size of kernel buffer */
1856 u32 buf_kern_offset; /* amount of data copied so far */
1857 u32 buf_user_offset; /* read position in userspace buffer */
1858 };
1859
1860 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1861 {
1862 state->buf_kern_offset += sz;
1863 return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1864 }
1865
1866 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1867 void *data, unsigned int sz)
1868 {
1869 if (state->buf_kern_start == NULL)
1870 goto count_only;
1871
1872 BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1873
1874 memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1875
1876 count_only:
1877 state->buf_user_offset += sz;
1878 return ebt_buf_count(state, sz);
1879 }
1880
1881 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1882 {
1883 char *b = state->buf_kern_start;
1884
1885 BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1886
1887 if (b != NULL && sz > 0)
1888 memset(b + state->buf_kern_offset, 0, sz);
1889 /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1890 return ebt_buf_count(state, sz);
1891 }
1892
1893 enum compat_mwt {
1894 EBT_COMPAT_MATCH,
1895 EBT_COMPAT_WATCHER,
1896 EBT_COMPAT_TARGET,
1897 };
1898
1899 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1900 enum compat_mwt compat_mwt,
1901 struct ebt_entries_buf_state *state,
1902 const unsigned char *base)
1903 {
1904 char name[EBT_FUNCTION_MAXNAMELEN];
1905 struct xt_match *match;
1906 struct xt_target *wt;
1907 void *dst = NULL;
1908 int off, pad = 0;
1909 unsigned int size_kern, match_size = mwt->match_size;
1910
1911 strlcpy(name, mwt->u.name, sizeof(name));
1912
1913 if (state->buf_kern_start)
1914 dst = state->buf_kern_start + state->buf_kern_offset;
1915
1916 switch (compat_mwt) {
1917 case EBT_COMPAT_MATCH:
1918 match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
1919 if (IS_ERR(match))
1920 return PTR_ERR(match);
1921
1922 off = ebt_compat_match_offset(match, match_size);
1923 if (dst) {
1924 if (match->compat_from_user)
1925 match->compat_from_user(dst, mwt->data);
1926 else
1927 memcpy(dst, mwt->data, match_size);
1928 }
1929
1930 size_kern = match->matchsize;
1931 if (unlikely(size_kern == -1))
1932 size_kern = match_size;
1933 module_put(match->me);
1934 break;
1935 case EBT_COMPAT_WATCHER: /* fallthrough */
1936 case EBT_COMPAT_TARGET:
1937 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
1938 if (IS_ERR(wt))
1939 return PTR_ERR(wt);
1940 off = xt_compat_target_offset(wt);
1941
1942 if (dst) {
1943 if (wt->compat_from_user)
1944 wt->compat_from_user(dst, mwt->data);
1945 else
1946 memcpy(dst, mwt->data, match_size);
1947 }
1948
1949 size_kern = wt->targetsize;
1950 module_put(wt->me);
1951 break;
1952
1953 default:
1954 return -EINVAL;
1955 }
1956
1957 state->buf_kern_offset += match_size + off;
1958 state->buf_user_offset += match_size;
1959 pad = XT_ALIGN(size_kern) - size_kern;
1960
1961 if (pad > 0 && dst) {
1962 BUG_ON(state->buf_kern_len <= pad);
1963 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1964 memset(dst + size_kern, 0, pad);
1965 }
1966 return off + match_size;
1967 }
1968
1969 /*
1970 * return size of all matches, watchers or target, including necessary
1971 * alignment and padding.
1972 */
1973 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1974 unsigned int size_left, enum compat_mwt type,
1975 struct ebt_entries_buf_state *state, const void *base)
1976 {
1977 int growth = 0;
1978 char *buf;
1979
1980 if (size_left == 0)
1981 return 0;
1982
1983 buf = (char *) match32;
1984
1985 while (size_left >= sizeof(*match32)) {
1986 struct ebt_entry_match *match_kern;
1987 int ret;
1988
1989 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1990 if (match_kern) {
1991 char *tmp;
1992 tmp = state->buf_kern_start + state->buf_kern_offset;
1993 match_kern = (struct ebt_entry_match *) tmp;
1994 }
1995 ret = ebt_buf_add(state, buf, sizeof(*match32));
1996 if (ret < 0)
1997 return ret;
1998 size_left -= sizeof(*match32);
1999
2000 /* add padding before match->data (if any) */
2001 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
2002 if (ret < 0)
2003 return ret;
2004
2005 if (match32->match_size > size_left)
2006 return -EINVAL;
2007
2008 size_left -= match32->match_size;
2009
2010 ret = compat_mtw_from_user(match32, type, state, base);
2011 if (ret < 0)
2012 return ret;
2013
2014 BUG_ON(ret < match32->match_size);
2015 growth += ret - match32->match_size;
2016 growth += ebt_compat_entry_padsize();
2017
2018 buf += sizeof(*match32);
2019 buf += match32->match_size;
2020
2021 if (match_kern)
2022 match_kern->match_size = ret;
2023
2024 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2025 match32 = (struct compat_ebt_entry_mwt *) buf;
2026 }
2027
2028 return growth;
2029 }
2030
2031 /* called for all ebt_entry structures. */
2032 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2033 unsigned int *total,
2034 struct ebt_entries_buf_state *state)
2035 {
2036 unsigned int i, j, startoff, new_offset = 0;
2037 /* stores match/watchers/targets & offset of next struct ebt_entry: */
2038 unsigned int offsets[4];
2039 unsigned int *offsets_update = NULL;
2040 int ret;
2041 char *buf_start;
2042
2043 if (*total < sizeof(struct ebt_entries))
2044 return -EINVAL;
2045
2046 if (!entry->bitmask) {
2047 *total -= sizeof(struct ebt_entries);
2048 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2049 }
2050 if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2051 return -EINVAL;
2052
2053 startoff = state->buf_user_offset;
2054 /* pull in most part of ebt_entry, it does not need to be changed. */
2055 ret = ebt_buf_add(state, entry,
2056 offsetof(struct ebt_entry, watchers_offset));
2057 if (ret < 0)
2058 return ret;
2059
2060 offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2061 memcpy(&offsets[1], &entry->watchers_offset,
2062 sizeof(offsets) - sizeof(offsets[0]));
2063
2064 if (state->buf_kern_start) {
2065 buf_start = state->buf_kern_start + state->buf_kern_offset;
2066 offsets_update = (unsigned int *) buf_start;
2067 }
2068 ret = ebt_buf_add(state, &offsets[1],
2069 sizeof(offsets) - sizeof(offsets[0]));
2070 if (ret < 0)
2071 return ret;
2072 buf_start = (char *) entry;
2073 /*
2074 * 0: matches offset, always follows ebt_entry.
2075 * 1: watchers offset, from ebt_entry structure
2076 * 2: target offset, from ebt_entry structure
2077 * 3: next ebt_entry offset, from ebt_entry structure
2078 *
2079 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2080 */
2081 for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2082 struct compat_ebt_entry_mwt *match32;
2083 unsigned int size;
2084 char *buf = buf_start;
2085
2086 buf = buf_start + offsets[i];
2087 if (offsets[i] > offsets[j])
2088 return -EINVAL;
2089
2090 match32 = (struct compat_ebt_entry_mwt *) buf;
2091 size = offsets[j] - offsets[i];
2092 ret = ebt_size_mwt(match32, size, i, state, base);
2093 if (ret < 0)
2094 return ret;
2095 new_offset += ret;
2096 if (offsets_update && new_offset) {
2097 pr_debug("change offset %d to %d\n",
2098 offsets_update[i], offsets[j] + new_offset);
2099 offsets_update[i] = offsets[j] + new_offset;
2100 }
2101 }
2102
2103 if (state->buf_kern_start == NULL) {
2104 unsigned int offset = buf_start - (char *) base;
2105
2106 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
2107 if (ret < 0)
2108 return ret;
2109 }
2110
2111 startoff = state->buf_user_offset - startoff;
2112
2113 BUG_ON(*total < startoff);
2114 *total -= startoff;
2115 return 0;
2116 }
2117
2118 /*
2119 * repl->entries_size is the size of the ebt_entry blob in userspace.
2120 * It might need more memory when copied to a 64 bit kernel in case
2121 * userspace is 32-bit. So, first task: find out how much memory is needed.
2122 *
2123 * Called before validation is performed.
2124 */
2125 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2126 struct ebt_entries_buf_state *state)
2127 {
2128 unsigned int size_remaining = size_user;
2129 int ret;
2130
2131 ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2132 &size_remaining, state);
2133 if (ret < 0)
2134 return ret;
2135
2136 WARN_ON(size_remaining);
2137 return state->buf_kern_offset;
2138 }
2139
2140
2141 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2142 void __user *user, unsigned int len)
2143 {
2144 struct compat_ebt_replace tmp;
2145 int i;
2146
2147 if (len < sizeof(tmp))
2148 return -EINVAL;
2149
2150 if (copy_from_user(&tmp, user, sizeof(tmp)))
2151 return -EFAULT;
2152
2153 if (len != sizeof(tmp) + tmp.entries_size)
2154 return -EINVAL;
2155
2156 if (tmp.entries_size == 0)
2157 return -EINVAL;
2158
2159 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2160 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2161 return -ENOMEM;
2162 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2163 return -ENOMEM;
2164
2165 memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2166
2167 /* starting with hook_entry, 32 vs. 64 bit structures are different */
2168 for (i = 0; i < NF_BR_NUMHOOKS; i++)
2169 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2170
2171 repl->num_counters = tmp.num_counters;
2172 repl->counters = compat_ptr(tmp.counters);
2173 repl->entries = compat_ptr(tmp.entries);
2174 return 0;
2175 }
2176
2177 static int compat_do_replace(struct net *net, void __user *user,
2178 unsigned int len)
2179 {
2180 int ret, i, countersize, size64;
2181 struct ebt_table_info *newinfo;
2182 struct ebt_replace tmp;
2183 struct ebt_entries_buf_state state;
2184 void *entries_tmp;
2185
2186 ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2187 if (ret) {
2188 /* try real handler in case userland supplied needed padding */
2189 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2190 ret = 0;
2191 return ret;
2192 }
2193
2194 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2195 newinfo = vmalloc(sizeof(*newinfo) + countersize);
2196 if (!newinfo)
2197 return -ENOMEM;
2198
2199 if (countersize)
2200 memset(newinfo->counters, 0, countersize);
2201
2202 memset(&state, 0, sizeof(state));
2203
2204 newinfo->entries = vmalloc(tmp.entries_size);
2205 if (!newinfo->entries) {
2206 ret = -ENOMEM;
2207 goto free_newinfo;
2208 }
2209 if (copy_from_user(
2210 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2211 ret = -EFAULT;
2212 goto free_entries;
2213 }
2214
2215 entries_tmp = newinfo->entries;
2216
2217 xt_compat_lock(NFPROTO_BRIDGE);
2218
2219 xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
2220 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2221 if (ret < 0)
2222 goto out_unlock;
2223
2224 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2225 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2226 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2227
2228 size64 = ret;
2229 newinfo->entries = vmalloc(size64);
2230 if (!newinfo->entries) {
2231 vfree(entries_tmp);
2232 ret = -ENOMEM;
2233 goto out_unlock;
2234 }
2235
2236 memset(&state, 0, sizeof(state));
2237 state.buf_kern_start = newinfo->entries;
2238 state.buf_kern_len = size64;
2239
2240 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2241 BUG_ON(ret < 0); /* parses same data again */
2242
2243 vfree(entries_tmp);
2244 tmp.entries_size = size64;
2245
2246 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2247 char __user *usrptr;
2248 if (tmp.hook_entry[i]) {
2249 unsigned int delta;
2250 usrptr = (char __user *) tmp.hook_entry[i];
2251 delta = usrptr - tmp.entries;
2252 usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2253 tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2254 }
2255 }
2256
2257 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2258 xt_compat_unlock(NFPROTO_BRIDGE);
2259
2260 ret = do_replace_finish(net, &tmp, newinfo);
2261 if (ret == 0)
2262 return ret;
2263 free_entries:
2264 vfree(newinfo->entries);
2265 free_newinfo:
2266 vfree(newinfo);
2267 return ret;
2268 out_unlock:
2269 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2270 xt_compat_unlock(NFPROTO_BRIDGE);
2271 goto free_entries;
2272 }
2273
2274 static int compat_update_counters(struct net *net, void __user *user,
2275 unsigned int len)
2276 {
2277 struct compat_ebt_replace hlp;
2278
2279 if (copy_from_user(&hlp, user, sizeof(hlp)))
2280 return -EFAULT;
2281
2282 /* try real handler in case userland supplied needed padding */
2283 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2284 return update_counters(net, user, len);
2285
2286 return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2287 hlp.num_counters, user, len);
2288 }
2289
2290 static int compat_do_ebt_set_ctl(struct sock *sk,
2291 int cmd, void __user *user, unsigned int len)
2292 {
2293 int ret;
2294 struct net *net = sock_net(sk);
2295
2296 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2297 return -EPERM;
2298
2299 switch (cmd) {
2300 case EBT_SO_SET_ENTRIES:
2301 ret = compat_do_replace(net, user, len);
2302 break;
2303 case EBT_SO_SET_COUNTERS:
2304 ret = compat_update_counters(net, user, len);
2305 break;
2306 default:
2307 ret = -EINVAL;
2308 }
2309 return ret;
2310 }
2311
2312 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2313 void __user *user, int *len)
2314 {
2315 int ret;
2316 struct compat_ebt_replace tmp;
2317 struct ebt_table *t;
2318 struct net *net = sock_net(sk);
2319
2320 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2321 return -EPERM;
2322
2323 /* try real handler in case userland supplied needed padding */
2324 if ((cmd == EBT_SO_GET_INFO ||
2325 cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2326 return do_ebt_get_ctl(sk, cmd, user, len);
2327
2328 if (copy_from_user(&tmp, user, sizeof(tmp)))
2329 return -EFAULT;
2330
2331 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
2332 if (!t)
2333 return ret;
2334
2335 xt_compat_lock(NFPROTO_BRIDGE);
2336 switch (cmd) {
2337 case EBT_SO_GET_INFO:
2338 tmp.nentries = t->private->nentries;
2339 ret = compat_table_info(t->private, &tmp);
2340 if (ret)
2341 goto out;
2342 tmp.valid_hooks = t->valid_hooks;
2343
2344 if (copy_to_user(user, &tmp, *len) != 0) {
2345 ret = -EFAULT;
2346 break;
2347 }
2348 ret = 0;
2349 break;
2350 case EBT_SO_GET_INIT_INFO:
2351 tmp.nentries = t->table->nentries;
2352 tmp.entries_size = t->table->entries_size;
2353 tmp.valid_hooks = t->table->valid_hooks;
2354
2355 if (copy_to_user(user, &tmp, *len) != 0) {
2356 ret = -EFAULT;
2357 break;
2358 }
2359 ret = 0;
2360 break;
2361 case EBT_SO_GET_ENTRIES:
2362 case EBT_SO_GET_INIT_ENTRIES:
2363 /*
2364 * try real handler first in case of userland-side padding.
2365 * in case we are dealing with an 'ordinary' 32 bit binary
2366 * without 64bit compatibility padding, this will fail right
2367 * after copy_from_user when the *len argument is validated.
2368 *
2369 * the compat_ variant needs to do one pass over the kernel
2370 * data set to adjust for size differences before it the check.
2371 */
2372 if (copy_everything_to_user(t, user, len, cmd) == 0)
2373 ret = 0;
2374 else
2375 ret = compat_copy_everything_to_user(t, user, len, cmd);
2376 break;
2377 default:
2378 ret = -EINVAL;
2379 }
2380 out:
2381 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2382 xt_compat_unlock(NFPROTO_BRIDGE);
2383 mutex_unlock(&ebt_mutex);
2384 return ret;
2385 }
2386 #endif
2387
2388 static struct nf_sockopt_ops ebt_sockopts = {
2389 .pf = PF_INET,
2390 .set_optmin = EBT_BASE_CTL,
2391 .set_optmax = EBT_SO_SET_MAX + 1,
2392 .set = do_ebt_set_ctl,
2393 #ifdef CONFIG_COMPAT
2394 .compat_set = compat_do_ebt_set_ctl,
2395 #endif
2396 .get_optmin = EBT_BASE_CTL,
2397 .get_optmax = EBT_SO_GET_MAX + 1,
2398 .get = do_ebt_get_ctl,
2399 #ifdef CONFIG_COMPAT
2400 .compat_get = compat_do_ebt_get_ctl,
2401 #endif
2402 .owner = THIS_MODULE,
2403 };
2404
2405 static int __init ebtables_init(void)
2406 {
2407 int ret;
2408
2409 ret = xt_register_target(&ebt_standard_target);
2410 if (ret < 0)
2411 return ret;
2412 ret = nf_register_sockopt(&ebt_sockopts);
2413 if (ret < 0) {
2414 xt_unregister_target(&ebt_standard_target);
2415 return ret;
2416 }
2417
2418 printk(KERN_INFO "Ebtables v2.0 registered\n");
2419 return 0;
2420 }
2421
2422 static void __exit ebtables_fini(void)
2423 {
2424 nf_unregister_sockopt(&ebt_sockopts);
2425 xt_unregister_target(&ebt_standard_target);
2426 printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2427 }
2428
2429 EXPORT_SYMBOL(ebt_register_table);
2430 EXPORT_SYMBOL(ebt_unregister_table);
2431 EXPORT_SYMBOL(ebt_do_table);
2432 module_init(ebtables_init);
2433 module_exit(ebtables_fini);
2434 MODULE_LICENSE("GPL");
Linux with added FPC-III support