?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
cxl: Configure PSL for kernel contexts and merge code
[linux/fpc-iii.git] / net / bridge / netfilter / ebtables.c
blob91180a7fc94376ea3ca7eecf274c03c3bc919590
1 /*
2 * ebtables
3 *
4 * Author:
5 * Bart De Schuymer <bdschuym@pandora.be>
6 *
7 * ebtables.c,v 2.0, July, 2002
8 *
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 */
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18 #include <linux/kmod.h>
19 #include <linux/module.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/spinlock.h>
24 #include <linux/mutex.h>
25 #include <linux/slab.h>
26 #include <asm/uaccess.h>
27 #include <linux/smp.h>
28 #include <linux/cpumask.h>
29 #include <linux/audit.h>
30 #include <net/sock.h>
31 /* needed for logical [in,out]-dev filtering */
32 #include "../br_private.h"
33
34 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
35 "report to author: "format, ## args)
36 /* #define BUGPRINT(format, args...) */
37
38 /*
39 * Each cpu has its own set of counters, so there is no need for write_lock in
40 * the softirq
41 * For reading or updating the counters, the user context needs to
42 * get a write_lock
43 */
44
45 /* The size of each set of counters is altered to get cache alignment */
46 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
47 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
48 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
49 COUNTER_OFFSET(n) * cpu))
50
51
52
53 static DEFINE_MUTEX(ebt_mutex);
54
55 #ifdef CONFIG_COMPAT
56 static void ebt_standard_compat_from_user(void *dst, const void *src)
57 {
58 int v = *(compat_int_t *)src;
59
60 if (v >= 0)
61 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
62 memcpy(dst, &v, sizeof(v));
63 }
64
65 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
66 {
67 compat_int_t cv = *(int *)src;
68
69 if (cv >= 0)
70 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
71 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
72 }
73 #endif
74
75
76 static struct xt_target ebt_standard_target = {
77 .name = "standard",
78 .revision = 0,
79 .family = NFPROTO_BRIDGE,
80 .targetsize = sizeof(int),
81 #ifdef CONFIG_COMPAT
82 .compatsize = sizeof(compat_int_t),
83 .compat_from_user = ebt_standard_compat_from_user,
84 .compat_to_user = ebt_standard_compat_to_user,
85 #endif
86 };
87
88 static inline int
89 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
90 struct xt_action_param *par)
91 {
92 par->target = w->u.watcher;
93 par->targinfo = w->data;
94 w->u.watcher->target(skb, par);
95 /* watchers don't give a verdict */
96 return 0;
97 }
98
99 static inline int
100 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
101 struct xt_action_param *par)
102 {
103 par->match = m->u.match;
104 par->matchinfo = m->data;
105 return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
106 }
107
108 static inline int
109 ebt_dev_check(const char *entry, const struct net_device *device)
110 {
111 int i = 0;
112 const char *devname;
113
114 if (*entry == '\0')
115 return 0;
116 if (!device)
117 return 1;
118 devname = device->name;
119 /* 1 is the wildcard token */
120 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
121 i++;
122 return devname[i] != entry[i] && entry[i] != 1;
123 }
124
125 #define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
126 /* process standard matches */
127 static inline int
128 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
129 const struct net_device *in, const struct net_device *out)
130 {
131 const struct ethhdr *h = eth_hdr(skb);
132 const struct net_bridge_port *p;
133 __be16 ethproto;
134 int verdict, i;
135
136 if (skb_vlan_tag_present(skb))
137 ethproto = htons(ETH_P_8021Q);
138 else
139 ethproto = h->h_proto;
140
141 if (e->bitmask & EBT_802_3) {
142 if (FWINV2(ntohs(ethproto) >= ETH_P_802_3_MIN, EBT_IPROTO))
143 return 1;
144 } else if (!(e->bitmask & EBT_NOPROTO) &&
145 FWINV2(e->ethproto != ethproto, EBT_IPROTO))
146 return 1;
147
148 if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
149 return 1;
150 if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
151 return 1;
152 /* rcu_read_lock()ed by nf_hook_slow */
153 if (in && (p = br_port_get_rcu(in)) != NULL &&
154 FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
155 return 1;
156 if (out && (p = br_port_get_rcu(out)) != NULL &&
157 FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
158 return 1;
159
160 if (e->bitmask & EBT_SOURCEMAC) {
161 verdict = 0;
162 for (i = 0; i < 6; i++)
163 verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
164 e->sourcemsk[i];
165 if (FWINV2(verdict != 0, EBT_ISOURCE) )
166 return 1;
167 }
168 if (e->bitmask & EBT_DESTMAC) {
169 verdict = 0;
170 for (i = 0; i < 6; i++)
171 verdict |= (h->h_dest[i] ^ e->destmac[i]) &
172 e->destmsk[i];
173 if (FWINV2(verdict != 0, EBT_IDEST) )
174 return 1;
175 }
176 return 0;
177 }
178
179 static inline __pure
180 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
181 {
182 return (void *)entry + entry->next_offset;
183 }
184
185 /* Do some firewalling */
186 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
187 const struct net_device *in, const struct net_device *out,
188 struct ebt_table *table)
189 {
190 int i, nentries;
191 struct ebt_entry *point;
192 struct ebt_counter *counter_base, *cb_base;
193 const struct ebt_entry_target *t;
194 int verdict, sp = 0;
195 struct ebt_chainstack *cs;
196 struct ebt_entries *chaininfo;
197 const char *base;
198 const struct ebt_table_info *private;
199 struct xt_action_param acpar;
200
201 acpar.family = NFPROTO_BRIDGE;
202 acpar.in = in;
203 acpar.out = out;
204 acpar.hotdrop = false;
205 acpar.hooknum = hook;
206
207 read_lock_bh(&table->lock);
208 private = table->private;
209 cb_base = COUNTER_BASE(private->counters, private->nentries,
210 smp_processor_id());
211 if (private->chainstack)
212 cs = private->chainstack[smp_processor_id()];
213 else
214 cs = NULL;
215 chaininfo = private->hook_entry[hook];
216 nentries = private->hook_entry[hook]->nentries;
217 point = (struct ebt_entry *)(private->hook_entry[hook]->data);
218 counter_base = cb_base + private->hook_entry[hook]->counter_offset;
219 /* base for chain jumps */
220 base = private->entries;
221 i = 0;
222 while (i < nentries) {
223 if (ebt_basic_match(point, skb, in, out))
224 goto letscontinue;
225
226 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
227 goto letscontinue;
228 if (acpar.hotdrop) {
229 read_unlock_bh(&table->lock);
230 return NF_DROP;
231 }
232
233 /* increase counter */
234 (*(counter_base + i)).pcnt++;
235 (*(counter_base + i)).bcnt += skb->len;
236
237 /* these should only watch: not modify, nor tell us
238 what to do with the packet */
239 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
240
241 t = (struct ebt_entry_target *)
242 (((char *)point) + point->target_offset);
243 /* standard target */
244 if (!t->u.target->target)
245 verdict = ((struct ebt_standard_target *)t)->verdict;
246 else {
247 acpar.target = t->u.target;
248 acpar.targinfo = t->data;
249 verdict = t->u.target->target(skb, &acpar);
250 }
251 if (verdict == EBT_ACCEPT) {
252 read_unlock_bh(&table->lock);
253 return NF_ACCEPT;
254 }
255 if (verdict == EBT_DROP) {
256 read_unlock_bh(&table->lock);
257 return NF_DROP;
258 }
259 if (verdict == EBT_RETURN) {
260 letsreturn:
261 #ifdef CONFIG_NETFILTER_DEBUG
262 if (sp == 0) {
263 BUGPRINT("RETURN on base chain");
264 /* act like this is EBT_CONTINUE */
265 goto letscontinue;
266 }
267 #endif
268 sp--;
269 /* put all the local variables right */
270 i = cs[sp].n;
271 chaininfo = cs[sp].chaininfo;
272 nentries = chaininfo->nentries;
273 point = cs[sp].e;
274 counter_base = cb_base +
275 chaininfo->counter_offset;
276 continue;
277 }
278 if (verdict == EBT_CONTINUE)
279 goto letscontinue;
280 #ifdef CONFIG_NETFILTER_DEBUG
281 if (verdict < 0) {
282 BUGPRINT("bogus standard verdict\n");
283 read_unlock_bh(&table->lock);
284 return NF_DROP;
285 }
286 #endif
287 /* jump to a udc */
288 cs[sp].n = i + 1;
289 cs[sp].chaininfo = chaininfo;
290 cs[sp].e = ebt_next_entry(point);
291 i = 0;
292 chaininfo = (struct ebt_entries *) (base + verdict);
293 #ifdef CONFIG_NETFILTER_DEBUG
294 if (chaininfo->distinguisher) {
295 BUGPRINT("jump to non-chain\n");
296 read_unlock_bh(&table->lock);
297 return NF_DROP;
298 }
299 #endif
300 nentries = chaininfo->nentries;
301 point = (struct ebt_entry *)chaininfo->data;
302 counter_base = cb_base + chaininfo->counter_offset;
303 sp++;
304 continue;
305 letscontinue:
306 point = ebt_next_entry(point);
307 i++;
308 }
309
310 /* I actually like this :) */
311 if (chaininfo->policy == EBT_RETURN)
312 goto letsreturn;
313 if (chaininfo->policy == EBT_ACCEPT) {
314 read_unlock_bh(&table->lock);
315 return NF_ACCEPT;
316 }
317 read_unlock_bh(&table->lock);
318 return NF_DROP;
319 }
320
321 /* If it succeeds, returns element and locks mutex */
322 static inline void *
323 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
324 struct mutex *mutex)
325 {
326 struct {
327 struct list_head list;
328 char name[EBT_FUNCTION_MAXNAMELEN];
329 } *e;
330
331 mutex_lock(mutex);
332 list_for_each_entry(e, head, list) {
333 if (strcmp(e->name, name) == 0)
334 return e;
335 }
336 *error = -ENOENT;
337 mutex_unlock(mutex);
338 return NULL;
339 }
340
341 static void *
342 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
343 int *error, struct mutex *mutex)
344 {
345 return try_then_request_module(
346 find_inlist_lock_noload(head, name, error, mutex),
347 "%s%s", prefix, name);
348 }
349
350 static inline struct ebt_table *
351 find_table_lock(struct net *net, const char *name, int *error,
352 struct mutex *mutex)
353 {
354 return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
355 "ebtable_", error, mutex);
356 }
357
358 static inline int
359 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
360 unsigned int *cnt)
361 {
362 const struct ebt_entry *e = par->entryinfo;
363 struct xt_match *match;
364 size_t left = ((char *)e + e->watchers_offset) - (char *)m;
365 int ret;
366
367 if (left < sizeof(struct ebt_entry_match) ||
368 left - sizeof(struct ebt_entry_match) < m->match_size)
369 return -EINVAL;
370
371 match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
372 if (IS_ERR(match))
373 return PTR_ERR(match);
374 m->u.match = match;
375
376 par->match = match;
377 par->matchinfo = m->data;
378 ret = xt_check_match(par, m->match_size,
379 e->ethproto, e->invflags & EBT_IPROTO);
380 if (ret < 0) {
381 module_put(match->me);
382 return ret;
383 }
384
385 (*cnt)++;
386 return 0;
387 }
388
389 static inline int
390 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
391 unsigned int *cnt)
392 {
393 const struct ebt_entry *e = par->entryinfo;
394 struct xt_target *watcher;
395 size_t left = ((char *)e + e->target_offset) - (char *)w;
396 int ret;
397
398 if (left < sizeof(struct ebt_entry_watcher) ||
399 left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
400 return -EINVAL;
401
402 watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
403 if (IS_ERR(watcher))
404 return PTR_ERR(watcher);
405 w->u.watcher = watcher;
406
407 par->target = watcher;
408 par->targinfo = w->data;
409 ret = xt_check_target(par, w->watcher_size,
410 e->ethproto, e->invflags & EBT_IPROTO);
411 if (ret < 0) {
412 module_put(watcher->me);
413 return ret;
414 }
415
416 (*cnt)++;
417 return 0;
418 }
419
420 static int ebt_verify_pointers(const struct ebt_replace *repl,
421 struct ebt_table_info *newinfo)
422 {
423 unsigned int limit = repl->entries_size;
424 unsigned int valid_hooks = repl->valid_hooks;
425 unsigned int offset = 0;
426 int i;
427
428 for (i = 0; i < NF_BR_NUMHOOKS; i++)
429 newinfo->hook_entry[i] = NULL;
430
431 newinfo->entries_size = repl->entries_size;
432 newinfo->nentries = repl->nentries;
433
434 while (offset < limit) {
435 size_t left = limit - offset;
436 struct ebt_entry *e = (void *)newinfo->entries + offset;
437
438 if (left < sizeof(unsigned int))
439 break;
440
441 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
442 if ((valid_hooks & (1 << i)) == 0)
443 continue;
444 if ((char __user *)repl->hook_entry[i] ==
445 repl->entries + offset)
446 break;
447 }
448
449 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
450 if (e->bitmask != 0) {
451 /* we make userspace set this right,
452 so there is no misunderstanding */
453 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
454 "in distinguisher\n");
455 return -EINVAL;
456 }
457 if (i != NF_BR_NUMHOOKS)
458 newinfo->hook_entry[i] = (struct ebt_entries *)e;
459 if (left < sizeof(struct ebt_entries))
460 break;
461 offset += sizeof(struct ebt_entries);
462 } else {
463 if (left < sizeof(struct ebt_entry))
464 break;
465 if (left < e->next_offset)
466 break;
467 if (e->next_offset < sizeof(struct ebt_entry))
468 return -EINVAL;
469 offset += e->next_offset;
470 }
471 }
472 if (offset != limit) {
473 BUGPRINT("entries_size too small\n");
474 return -EINVAL;
475 }
476
477 /* check if all valid hooks have a chain */
478 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
479 if (!newinfo->hook_entry[i] &&
480 (valid_hooks & (1 << i))) {
481 BUGPRINT("Valid hook without chain\n");
482 return -EINVAL;
483 }
484 }
485 return 0;
486 }
487
488 /*
489 * this one is very careful, as it is the first function
490 * to parse the userspace data
491 */
492 static inline int
493 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
494 const struct ebt_table_info *newinfo,
495 unsigned int *n, unsigned int *cnt,
496 unsigned int *totalcnt, unsigned int *udc_cnt)
497 {
498 int i;
499
500 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
501 if ((void *)e == (void *)newinfo->hook_entry[i])
502 break;
503 }
504 /* beginning of a new chain
505 if i == NF_BR_NUMHOOKS it must be a user defined chain */
506 if (i != NF_BR_NUMHOOKS || !e->bitmask) {
507 /* this checks if the previous chain has as many entries
508 as it said it has */
509 if (*n != *cnt) {
510 BUGPRINT("nentries does not equal the nr of entries "
511 "in the chain\n");
512 return -EINVAL;
513 }
514 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
515 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
516 /* only RETURN from udc */
517 if (i != NF_BR_NUMHOOKS ||
518 ((struct ebt_entries *)e)->policy != EBT_RETURN) {
519 BUGPRINT("bad policy\n");
520 return -EINVAL;
521 }
522 }
523 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
524 (*udc_cnt)++;
525 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
526 BUGPRINT("counter_offset != totalcnt");
527 return -EINVAL;
528 }
529 *n = ((struct ebt_entries *)e)->nentries;
530 *cnt = 0;
531 return 0;
532 }
533 /* a plain old entry, heh */
534 if (sizeof(struct ebt_entry) > e->watchers_offset ||
535 e->watchers_offset > e->target_offset ||
536 e->target_offset >= e->next_offset) {
537 BUGPRINT("entry offsets not in right order\n");
538 return -EINVAL;
539 }
540 /* this is not checked anywhere else */
541 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
542 BUGPRINT("target size too small\n");
543 return -EINVAL;
544 }
545 (*cnt)++;
546 (*totalcnt)++;
547 return 0;
548 }
549
550 struct ebt_cl_stack
551 {
552 struct ebt_chainstack cs;
553 int from;
554 unsigned int hookmask;
555 };
556
557 /*
558 * we need these positions to check that the jumps to a different part of the
559 * entries is a jump to the beginning of a new chain.
560 */
561 static inline int
562 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
563 unsigned int *n, struct ebt_cl_stack *udc)
564 {
565 int i;
566
567 /* we're only interested in chain starts */
568 if (e->bitmask)
569 return 0;
570 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
571 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
572 break;
573 }
574 /* only care about udc */
575 if (i != NF_BR_NUMHOOKS)
576 return 0;
577
578 udc[*n].cs.chaininfo = (struct ebt_entries *)e;
579 /* these initialisations are depended on later in check_chainloops() */
580 udc[*n].cs.n = 0;
581 udc[*n].hookmask = 0;
582
583 (*n)++;
584 return 0;
585 }
586
587 static inline int
588 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
589 {
590 struct xt_mtdtor_param par;
591
592 if (i && (*i)-- == 0)
593 return 1;
594
595 par.net = net;
596 par.match = m->u.match;
597 par.matchinfo = m->data;
598 par.family = NFPROTO_BRIDGE;
599 if (par.match->destroy != NULL)
600 par.match->destroy(&par);
601 module_put(par.match->me);
602 return 0;
603 }
604
605 static inline int
606 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
607 {
608 struct xt_tgdtor_param par;
609
610 if (i && (*i)-- == 0)
611 return 1;
612
613 par.net = net;
614 par.target = w->u.watcher;
615 par.targinfo = w->data;
616 par.family = NFPROTO_BRIDGE;
617 if (par.target->destroy != NULL)
618 par.target->destroy(&par);
619 module_put(par.target->me);
620 return 0;
621 }
622
623 static inline int
624 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
625 {
626 struct xt_tgdtor_param par;
627 struct ebt_entry_target *t;
628
629 if (e->bitmask == 0)
630 return 0;
631 /* we're done */
632 if (cnt && (*cnt)-- == 0)
633 return 1;
634 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
635 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
636 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
637
638 par.net = net;
639 par.target = t->u.target;
640 par.targinfo = t->data;
641 par.family = NFPROTO_BRIDGE;
642 if (par.target->destroy != NULL)
643 par.target->destroy(&par);
644 module_put(par.target->me);
645 return 0;
646 }
647
648 static inline int
649 ebt_check_entry(struct ebt_entry *e, struct net *net,
650 const struct ebt_table_info *newinfo,
651 const char *name, unsigned int *cnt,
652 struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
653 {
654 struct ebt_entry_target *t;
655 struct xt_target *target;
656 unsigned int i, j, hook = 0, hookmask = 0;
657 size_t gap;
658 int ret;
659 struct xt_mtchk_param mtpar;
660 struct xt_tgchk_param tgpar;
661
662 /* don't mess with the struct ebt_entries */
663 if (e->bitmask == 0)
664 return 0;
665
666 if (e->bitmask & ~EBT_F_MASK) {
667 BUGPRINT("Unknown flag for bitmask\n");
668 return -EINVAL;
669 }
670 if (e->invflags & ~EBT_INV_MASK) {
671 BUGPRINT("Unknown flag for inv bitmask\n");
672 return -EINVAL;
673 }
674 if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
675 BUGPRINT("NOPROTO & 802_3 not allowed\n");
676 return -EINVAL;
677 }
678 /* what hook do we belong to? */
679 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
680 if (!newinfo->hook_entry[i])
681 continue;
682 if ((char *)newinfo->hook_entry[i] < (char *)e)
683 hook = i;
684 else
685 break;
686 }
687 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
688 a base chain */
689 if (i < NF_BR_NUMHOOKS)
690 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
691 else {
692 for (i = 0; i < udc_cnt; i++)
693 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
694 break;
695 if (i == 0)
696 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
697 else
698 hookmask = cl_s[i - 1].hookmask;
699 }
700 i = 0;
701
702 mtpar.net = tgpar.net = net;
703 mtpar.table = tgpar.table = name;
704 mtpar.entryinfo = tgpar.entryinfo = e;
705 mtpar.hook_mask = tgpar.hook_mask = hookmask;
706 mtpar.family = tgpar.family = NFPROTO_BRIDGE;
707 ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
708 if (ret != 0)
709 goto cleanup_matches;
710 j = 0;
711 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
712 if (ret != 0)
713 goto cleanup_watchers;
714 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
715 gap = e->next_offset - e->target_offset;
716
717 target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
718 if (IS_ERR(target)) {
719 ret = PTR_ERR(target);
720 goto cleanup_watchers;
721 }
722
723 t->u.target = target;
724 if (t->u.target == &ebt_standard_target) {
725 if (gap < sizeof(struct ebt_standard_target)) {
726 BUGPRINT("Standard target size too big\n");
727 ret = -EFAULT;
728 goto cleanup_watchers;
729 }
730 if (((struct ebt_standard_target *)t)->verdict <
731 -NUM_STANDARD_TARGETS) {
732 BUGPRINT("Invalid standard target\n");
733 ret = -EFAULT;
734 goto cleanup_watchers;
735 }
736 } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
737 module_put(t->u.target->me);
738 ret = -EFAULT;
739 goto cleanup_watchers;
740 }
741
742 tgpar.target = target;
743 tgpar.targinfo = t->data;
744 ret = xt_check_target(&tgpar, t->target_size,
745 e->ethproto, e->invflags & EBT_IPROTO);
746 if (ret < 0) {
747 module_put(target->me);
748 goto cleanup_watchers;
749 }
750 (*cnt)++;
751 return 0;
752 cleanup_watchers:
753 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
754 cleanup_matches:
755 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
756 return ret;
757 }
758
759 /*
760 * checks for loops and sets the hook mask for udc
761 * the hook mask for udc tells us from which base chains the udc can be
762 * accessed. This mask is a parameter to the check() functions of the extensions
763 */
764 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
765 unsigned int udc_cnt, unsigned int hooknr, char *base)
766 {
767 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
768 const struct ebt_entry *e = (struct ebt_entry *)chain->data;
769 const struct ebt_entry_target *t;
770
771 while (pos < nentries || chain_nr != -1) {
772 /* end of udc, go back one 'recursion' step */
773 if (pos == nentries) {
774 /* put back values of the time when this chain was called */
775 e = cl_s[chain_nr].cs.e;
776 if (cl_s[chain_nr].from != -1)
777 nentries =
778 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
779 else
780 nentries = chain->nentries;
781 pos = cl_s[chain_nr].cs.n;
782 /* make sure we won't see a loop that isn't one */
783 cl_s[chain_nr].cs.n = 0;
784 chain_nr = cl_s[chain_nr].from;
785 if (pos == nentries)
786 continue;
787 }
788 t = (struct ebt_entry_target *)
789 (((char *)e) + e->target_offset);
790 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
791 goto letscontinue;
792 if (e->target_offset + sizeof(struct ebt_standard_target) >
793 e->next_offset) {
794 BUGPRINT("Standard target size too big\n");
795 return -1;
796 }
797 verdict = ((struct ebt_standard_target *)t)->verdict;
798 if (verdict >= 0) { /* jump to another chain */
799 struct ebt_entries *hlp2 =
800 (struct ebt_entries *)(base + verdict);
801 for (i = 0; i < udc_cnt; i++)
802 if (hlp2 == cl_s[i].cs.chaininfo)
803 break;
804 /* bad destination or loop */
805 if (i == udc_cnt) {
806 BUGPRINT("bad destination\n");
807 return -1;
808 }
809 if (cl_s[i].cs.n) {
810 BUGPRINT("loop\n");
811 return -1;
812 }
813 if (cl_s[i].hookmask & (1 << hooknr))
814 goto letscontinue;
815 /* this can't be 0, so the loop test is correct */
816 cl_s[i].cs.n = pos + 1;
817 pos = 0;
818 cl_s[i].cs.e = ebt_next_entry(e);
819 e = (struct ebt_entry *)(hlp2->data);
820 nentries = hlp2->nentries;
821 cl_s[i].from = chain_nr;
822 chain_nr = i;
823 /* this udc is accessible from the base chain for hooknr */
824 cl_s[i].hookmask |= (1 << hooknr);
825 continue;
826 }
827 letscontinue:
828 e = ebt_next_entry(e);
829 pos++;
830 }
831 return 0;
832 }
833
834 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
835 static int translate_table(struct net *net, const char *name,
836 struct ebt_table_info *newinfo)
837 {
838 unsigned int i, j, k, udc_cnt;
839 int ret;
840 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
841
842 i = 0;
843 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
844 i++;
845 if (i == NF_BR_NUMHOOKS) {
846 BUGPRINT("No valid hooks specified\n");
847 return -EINVAL;
848 }
849 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
850 BUGPRINT("Chains don't start at beginning\n");
851 return -EINVAL;
852 }
853 /* make sure chains are ordered after each other in same order
854 as their corresponding hooks */
855 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
856 if (!newinfo->hook_entry[j])
857 continue;
858 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
859 BUGPRINT("Hook order must be followed\n");
860 return -EINVAL;
861 }
862 i = j;
863 }
864
865 /* do some early checkings and initialize some things */
866 i = 0; /* holds the expected nr. of entries for the chain */
867 j = 0; /* holds the up to now counted entries for the chain */
868 k = 0; /* holds the total nr. of entries, should equal
869 newinfo->nentries afterwards */
870 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
871 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
872 ebt_check_entry_size_and_hooks, newinfo,
873 &i, &j, &k, &udc_cnt);
874
875 if (ret != 0)
876 return ret;
877
878 if (i != j) {
879 BUGPRINT("nentries does not equal the nr of entries in the "
880 "(last) chain\n");
881 return -EINVAL;
882 }
883 if (k != newinfo->nentries) {
884 BUGPRINT("Total nentries is wrong\n");
885 return -EINVAL;
886 }
887
888 /* get the location of the udc, put them in an array
889 while we're at it, allocate the chainstack */
890 if (udc_cnt) {
891 /* this will get free'd in do_replace()/ebt_register_table()
892 if an error occurs */
893 newinfo->chainstack =
894 vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
895 if (!newinfo->chainstack)
896 return -ENOMEM;
897 for_each_possible_cpu(i) {
898 newinfo->chainstack[i] =
899 vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
900 if (!newinfo->chainstack[i]) {
901 while (i)
902 vfree(newinfo->chainstack[--i]);
903 vfree(newinfo->chainstack);
904 newinfo->chainstack = NULL;
905 return -ENOMEM;
906 }
907 }
908
909 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
910 if (!cl_s)
911 return -ENOMEM;
912 i = 0; /* the i'th udc */
913 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
914 ebt_get_udc_positions, newinfo, &i, cl_s);
915 /* sanity check */
916 if (i != udc_cnt) {
917 BUGPRINT("i != udc_cnt\n");
918 vfree(cl_s);
919 return -EFAULT;
920 }
921 }
922
923 /* Check for loops */
924 for (i = 0; i < NF_BR_NUMHOOKS; i++)
925 if (newinfo->hook_entry[i])
926 if (check_chainloops(newinfo->hook_entry[i],
927 cl_s, udc_cnt, i, newinfo->entries)) {
928 vfree(cl_s);
929 return -EINVAL;
930 }
931
932 /* we now know the following (along with E=mc²):
933 - the nr of entries in each chain is right
934 - the size of the allocated space is right
935 - all valid hooks have a corresponding chain
936 - there are no loops
937 - wrong data can still be on the level of a single entry
938 - could be there are jumps to places that are not the
939 beginning of a chain. This can only occur in chains that
940 are not accessible from any base chains, so we don't care. */
941
942 /* used to know what we need to clean up if something goes wrong */
943 i = 0;
944 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
945 ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
946 if (ret != 0) {
947 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
948 ebt_cleanup_entry, net, &i);
949 }
950 vfree(cl_s);
951 return ret;
952 }
953
954 /* called under write_lock */
955 static void get_counters(const struct ebt_counter *oldcounters,
956 struct ebt_counter *counters, unsigned int nentries)
957 {
958 int i, cpu;
959 struct ebt_counter *counter_base;
960
961 /* counters of cpu 0 */
962 memcpy(counters, oldcounters,
963 sizeof(struct ebt_counter) * nentries);
964
965 /* add other counters to those of cpu 0 */
966 for_each_possible_cpu(cpu) {
967 if (cpu == 0)
968 continue;
969 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
970 for (i = 0; i < nentries; i++) {
971 counters[i].pcnt += counter_base[i].pcnt;
972 counters[i].bcnt += counter_base[i].bcnt;
973 }
974 }
975 }
976
977 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
978 struct ebt_table_info *newinfo)
979 {
980 int ret, i;
981 struct ebt_counter *counterstmp = NULL;
982 /* used to be able to unlock earlier */
983 struct ebt_table_info *table;
984 struct ebt_table *t;
985
986 /* the user wants counters back
987 the check on the size is done later, when we have the lock */
988 if (repl->num_counters) {
989 unsigned long size = repl->num_counters * sizeof(*counterstmp);
990 counterstmp = vmalloc(size);
991 if (!counterstmp)
992 return -ENOMEM;
993 }
994
995 newinfo->chainstack = NULL;
996 ret = ebt_verify_pointers(repl, newinfo);
997 if (ret != 0)
998 goto free_counterstmp;
999
1000 ret = translate_table(net, repl->name, newinfo);
1001
1002 if (ret != 0)
1003 goto free_counterstmp;
1004
1005 t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1006 if (!t) {
1007 ret = -ENOENT;
1008 goto free_iterate;
1009 }
1010
1011 /* the table doesn't like it */
1012 if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1013 goto free_unlock;
1014
1015 if (repl->num_counters && repl->num_counters != t->private->nentries) {
1016 BUGPRINT("Wrong nr. of counters requested\n");
1017 ret = -EINVAL;
1018 goto free_unlock;
1019 }
1020
1021 /* we have the mutex lock, so no danger in reading this pointer */
1022 table = t->private;
1023 /* make sure the table can only be rmmod'ed if it contains no rules */
1024 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1025 ret = -ENOENT;
1026 goto free_unlock;
1027 } else if (table->nentries && !newinfo->nentries)
1028 module_put(t->me);
1029 /* we need an atomic snapshot of the counters */
1030 write_lock_bh(&t->lock);
1031 if (repl->num_counters)
1032 get_counters(t->private->counters, counterstmp,
1033 t->private->nentries);
1034
1035 t->private = newinfo;
1036 write_unlock_bh(&t->lock);
1037 mutex_unlock(&ebt_mutex);
1038 /* so, a user can change the chains while having messed up her counter
1039 allocation. Only reason why this is done is because this way the lock
1040 is held only once, while this doesn't bring the kernel into a
1041 dangerous state. */
1042 if (repl->num_counters &&
1043 copy_to_user(repl->counters, counterstmp,
1044 repl->num_counters * sizeof(struct ebt_counter))) {
1045 /* Silent error, can't fail, new table is already in place */
1046 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
1047 }
1048
1049 /* decrease module count and free resources */
1050 EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1051 ebt_cleanup_entry, net, NULL);
1052
1053 vfree(table->entries);
1054 if (table->chainstack) {
1055 for_each_possible_cpu(i)
1056 vfree(table->chainstack[i]);
1057 vfree(table->chainstack);
1058 }
1059 vfree(table);
1060
1061 vfree(counterstmp);
1062
1063 #ifdef CONFIG_AUDIT
1064 if (audit_enabled) {
1065 struct audit_buffer *ab;
1066
1067 ab = audit_log_start(current->audit_context, GFP_KERNEL,
1068 AUDIT_NETFILTER_CFG);
1069 if (ab) {
1070 audit_log_format(ab, "table=%s family=%u entries=%u",
1071 repl->name, AF_BRIDGE, repl->nentries);
1072 audit_log_end(ab);
1073 }
1074 }
1075 #endif
1076 return ret;
1077
1078 free_unlock:
1079 mutex_unlock(&ebt_mutex);
1080 free_iterate:
1081 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1082 ebt_cleanup_entry, net, NULL);
1083 free_counterstmp:
1084 vfree(counterstmp);
1085 /* can be initialized in translate_table() */
1086 if (newinfo->chainstack) {
1087 for_each_possible_cpu(i)
1088 vfree(newinfo->chainstack[i]);
1089 vfree(newinfo->chainstack);
1090 }
1091 return ret;
1092 }
1093
1094 /* replace the table */
1095 static int do_replace(struct net *net, const void __user *user,
1096 unsigned int len)
1097 {
1098 int ret, countersize;
1099 struct ebt_table_info *newinfo;
1100 struct ebt_replace tmp;
1101
1102 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1103 return -EFAULT;
1104
1105 if (len != sizeof(tmp) + tmp.entries_size) {
1106 BUGPRINT("Wrong len argument\n");
1107 return -EINVAL;
1108 }
1109
1110 if (tmp.entries_size == 0) {
1111 BUGPRINT("Entries_size never zero\n");
1112 return -EINVAL;
1113 }
1114 /* overflow check */
1115 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1116 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1117 return -ENOMEM;
1118 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1119 return -ENOMEM;
1120
1121 tmp.name[sizeof(tmp.name) - 1] = 0;
1122
1123 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1124 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1125 if (!newinfo)
1126 return -ENOMEM;
1127
1128 if (countersize)
1129 memset(newinfo->counters, 0, countersize);
1130
1131 newinfo->entries = vmalloc(tmp.entries_size);
1132 if (!newinfo->entries) {
1133 ret = -ENOMEM;
1134 goto free_newinfo;
1135 }
1136 if (copy_from_user(
1137 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1138 BUGPRINT("Couldn't copy entries from userspace\n");
1139 ret = -EFAULT;
1140 goto free_entries;
1141 }
1142
1143 ret = do_replace_finish(net, &tmp, newinfo);
1144 if (ret == 0)
1145 return ret;
1146 free_entries:
1147 vfree(newinfo->entries);
1148 free_newinfo:
1149 vfree(newinfo);
1150 return ret;
1151 }
1152
1153 struct ebt_table *
1154 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1155 {
1156 struct ebt_table_info *newinfo;
1157 struct ebt_table *t, *table;
1158 struct ebt_replace_kernel *repl;
1159 int ret, i, countersize;
1160 void *p;
1161
1162 if (input_table == NULL || (repl = input_table->table) == NULL ||
1163 repl->entries == NULL || repl->entries_size == 0 ||
1164 repl->counters != NULL || input_table->private != NULL) {
1165 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1166 return ERR_PTR(-EINVAL);
1167 }
1168
1169 /* Don't add one table to multiple lists. */
1170 table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1171 if (!table) {
1172 ret = -ENOMEM;
1173 goto out;
1174 }
1175
1176 countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1177 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1178 ret = -ENOMEM;
1179 if (!newinfo)
1180 goto free_table;
1181
1182 p = vmalloc(repl->entries_size);
1183 if (!p)
1184 goto free_newinfo;
1185
1186 memcpy(p, repl->entries, repl->entries_size);
1187 newinfo->entries = p;
1188
1189 newinfo->entries_size = repl->entries_size;
1190 newinfo->nentries = repl->nentries;
1191
1192 if (countersize)
1193 memset(newinfo->counters, 0, countersize);
1194
1195 /* fill in newinfo and parse the entries */
1196 newinfo->chainstack = NULL;
1197 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1198 if ((repl->valid_hooks & (1 << i)) == 0)
1199 newinfo->hook_entry[i] = NULL;
1200 else
1201 newinfo->hook_entry[i] = p +
1202 ((char *)repl->hook_entry[i] - repl->entries);
1203 }
1204 ret = translate_table(net, repl->name, newinfo);
1205 if (ret != 0) {
1206 BUGPRINT("Translate_table failed\n");
1207 goto free_chainstack;
1208 }
1209
1210 if (table->check && table->check(newinfo, table->valid_hooks)) {
1211 BUGPRINT("The table doesn't like its own initial data, lol\n");
1212 ret = -EINVAL;
1213 goto free_chainstack;
1214 }
1215
1216 table->private = newinfo;
1217 rwlock_init(&table->lock);
1218 mutex_lock(&ebt_mutex);
1219 list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1220 if (strcmp(t->name, table->name) == 0) {
1221 ret = -EEXIST;
1222 BUGPRINT("Table name already exists\n");
1223 goto free_unlock;
1224 }
1225 }
1226
1227 /* Hold a reference count if the chains aren't empty */
1228 if (newinfo->nentries && !try_module_get(table->me)) {
1229 ret = -ENOENT;
1230 goto free_unlock;
1231 }
1232 list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1233 mutex_unlock(&ebt_mutex);
1234 return table;
1235 free_unlock:
1236 mutex_unlock(&ebt_mutex);
1237 free_chainstack:
1238 if (newinfo->chainstack) {
1239 for_each_possible_cpu(i)
1240 vfree(newinfo->chainstack[i]);
1241 vfree(newinfo->chainstack);
1242 }
1243 vfree(newinfo->entries);
1244 free_newinfo:
1245 vfree(newinfo);
1246 free_table:
1247 kfree(table);
1248 out:
1249 return ERR_PTR(ret);
1250 }
1251
1252 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1253 {
1254 int i;
1255
1256 if (!table) {
1257 BUGPRINT("Request to unregister NULL table!!!\n");
1258 return;
1259 }
1260 mutex_lock(&ebt_mutex);
1261 list_del(&table->list);
1262 mutex_unlock(&ebt_mutex);
1263 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1264 ebt_cleanup_entry, net, NULL);
1265 if (table->private->nentries)
1266 module_put(table->me);
1267 vfree(table->private->entries);
1268 if (table->private->chainstack) {
1269 for_each_possible_cpu(i)
1270 vfree(table->private->chainstack[i]);
1271 vfree(table->private->chainstack);
1272 }
1273 vfree(table->private);
1274 kfree(table);
1275 }
1276
1277 /* userspace just supplied us with counters */
1278 static int do_update_counters(struct net *net, const char *name,
1279 struct ebt_counter __user *counters,
1280 unsigned int num_counters,
1281 const void __user *user, unsigned int len)
1282 {
1283 int i, ret;
1284 struct ebt_counter *tmp;
1285 struct ebt_table *t;
1286
1287 if (num_counters == 0)
1288 return -EINVAL;
1289
1290 tmp = vmalloc(num_counters * sizeof(*tmp));
1291 if (!tmp)
1292 return -ENOMEM;
1293
1294 t = find_table_lock(net, name, &ret, &ebt_mutex);
1295 if (!t)
1296 goto free_tmp;
1297
1298 if (num_counters != t->private->nentries) {
1299 BUGPRINT("Wrong nr of counters\n");
1300 ret = -EINVAL;
1301 goto unlock_mutex;
1302 }
1303
1304 if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1305 ret = -EFAULT;
1306 goto unlock_mutex;
1307 }
1308
1309 /* we want an atomic add of the counters */
1310 write_lock_bh(&t->lock);
1311
1312 /* we add to the counters of the first cpu */
1313 for (i = 0; i < num_counters; i++) {
1314 t->private->counters[i].pcnt += tmp[i].pcnt;
1315 t->private->counters[i].bcnt += tmp[i].bcnt;
1316 }
1317
1318 write_unlock_bh(&t->lock);
1319 ret = 0;
1320 unlock_mutex:
1321 mutex_unlock(&ebt_mutex);
1322 free_tmp:
1323 vfree(tmp);
1324 return ret;
1325 }
1326
1327 static int update_counters(struct net *net, const void __user *user,
1328 unsigned int len)
1329 {
1330 struct ebt_replace hlp;
1331
1332 if (copy_from_user(&hlp, user, sizeof(hlp)))
1333 return -EFAULT;
1334
1335 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1336 return -EINVAL;
1337
1338 return do_update_counters(net, hlp.name, hlp.counters,
1339 hlp.num_counters, user, len);
1340 }
1341
1342 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1343 const char *base, char __user *ubase)
1344 {
1345 char __user *hlp = ubase + ((char *)m - base);
1346 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1347
1348 /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
1349 long. Copy 29 bytes and fill remaining bytes with zeroes. */
1350 strlcpy(name, m->u.match->name, sizeof(name));
1351 if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1352 return -EFAULT;
1353 return 0;
1354 }
1355
1356 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1357 const char *base, char __user *ubase)
1358 {
1359 char __user *hlp = ubase + ((char *)w - base);
1360 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1361
1362 strlcpy(name, w->u.watcher->name, sizeof(name));
1363 if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
1364 return -EFAULT;
1365 return 0;
1366 }
1367
1368 static inline int
1369 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1370 {
1371 int ret;
1372 char __user *hlp;
1373 const struct ebt_entry_target *t;
1374 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1375
1376 if (e->bitmask == 0)
1377 return 0;
1378
1379 hlp = ubase + (((char *)e + e->target_offset) - base);
1380 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1381
1382 ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1383 if (ret != 0)
1384 return ret;
1385 ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1386 if (ret != 0)
1387 return ret;
1388 strlcpy(name, t->u.target->name, sizeof(name));
1389 if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1390 return -EFAULT;
1391 return 0;
1392 }
1393
1394 static int copy_counters_to_user(struct ebt_table *t,
1395 const struct ebt_counter *oldcounters,
1396 void __user *user, unsigned int num_counters,
1397 unsigned int nentries)
1398 {
1399 struct ebt_counter *counterstmp;
1400 int ret = 0;
1401
1402 /* userspace might not need the counters */
1403 if (num_counters == 0)
1404 return 0;
1405
1406 if (num_counters != nentries) {
1407 BUGPRINT("Num_counters wrong\n");
1408 return -EINVAL;
1409 }
1410
1411 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1412 if (!counterstmp)
1413 return -ENOMEM;
1414
1415 write_lock_bh(&t->lock);
1416 get_counters(oldcounters, counterstmp, nentries);
1417 write_unlock_bh(&t->lock);
1418
1419 if (copy_to_user(user, counterstmp,
1420 nentries * sizeof(struct ebt_counter)))
1421 ret = -EFAULT;
1422 vfree(counterstmp);
1423 return ret;
1424 }
1425
1426 /* called with ebt_mutex locked */
1427 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1428 const int *len, int cmd)
1429 {
1430 struct ebt_replace tmp;
1431 const struct ebt_counter *oldcounters;
1432 unsigned int entries_size, nentries;
1433 int ret;
1434 char *entries;
1435
1436 if (cmd == EBT_SO_GET_ENTRIES) {
1437 entries_size = t->private->entries_size;
1438 nentries = t->private->nentries;
1439 entries = t->private->entries;
1440 oldcounters = t->private->counters;
1441 } else {
1442 entries_size = t->table->entries_size;
1443 nentries = t->table->nentries;
1444 entries = t->table->entries;
1445 oldcounters = t->table->counters;
1446 }
1447
1448 if (copy_from_user(&tmp, user, sizeof(tmp)))
1449 return -EFAULT;
1450
1451 if (*len != sizeof(struct ebt_replace) + entries_size +
1452 (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
1453 return -EINVAL;
1454
1455 if (tmp.nentries != nentries) {
1456 BUGPRINT("Nentries wrong\n");
1457 return -EINVAL;
1458 }
1459
1460 if (tmp.entries_size != entries_size) {
1461 BUGPRINT("Wrong size\n");
1462 return -EINVAL;
1463 }
1464
1465 ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1466 tmp.num_counters, nentries);
1467 if (ret)
1468 return ret;
1469
1470 if (copy_to_user(tmp.entries, entries, entries_size)) {
1471 BUGPRINT("Couldn't copy entries to userspace\n");
1472 return -EFAULT;
1473 }
1474 /* set the match/watcher/target names right */
1475 return EBT_ENTRY_ITERATE(entries, entries_size,
1476 ebt_make_names, entries, tmp.entries);
1477 }
1478
1479 static int do_ebt_set_ctl(struct sock *sk,
1480 int cmd, void __user *user, unsigned int len)
1481 {
1482 int ret;
1483 struct net *net = sock_net(sk);
1484
1485 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1486 return -EPERM;
1487
1488 switch (cmd) {
1489 case EBT_SO_SET_ENTRIES:
1490 ret = do_replace(net, user, len);
1491 break;
1492 case EBT_SO_SET_COUNTERS:
1493 ret = update_counters(net, user, len);
1494 break;
1495 default:
1496 ret = -EINVAL;
1497 }
1498 return ret;
1499 }
1500
1501 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1502 {
1503 int ret;
1504 struct ebt_replace tmp;
1505 struct ebt_table *t;
1506 struct net *net = sock_net(sk);
1507
1508 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1509 return -EPERM;
1510
1511 if (copy_from_user(&tmp, user, sizeof(tmp)))
1512 return -EFAULT;
1513
1514 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1515 if (!t)
1516 return ret;
1517
1518 switch (cmd) {
1519 case EBT_SO_GET_INFO:
1520 case EBT_SO_GET_INIT_INFO:
1521 if (*len != sizeof(struct ebt_replace)) {
1522 ret = -EINVAL;
1523 mutex_unlock(&ebt_mutex);
1524 break;
1525 }
1526 if (cmd == EBT_SO_GET_INFO) {
1527 tmp.nentries = t->private->nentries;
1528 tmp.entries_size = t->private->entries_size;
1529 tmp.valid_hooks = t->valid_hooks;
1530 } else {
1531 tmp.nentries = t->table->nentries;
1532 tmp.entries_size = t->table->entries_size;
1533 tmp.valid_hooks = t->table->valid_hooks;
1534 }
1535 mutex_unlock(&ebt_mutex);
1536 if (copy_to_user(user, &tmp, *len) != 0) {
1537 BUGPRINT("c2u Didn't work\n");
1538 ret = -EFAULT;
1539 break;
1540 }
1541 ret = 0;
1542 break;
1543
1544 case EBT_SO_GET_ENTRIES:
1545 case EBT_SO_GET_INIT_ENTRIES:
1546 ret = copy_everything_to_user(t, user, len, cmd);
1547 mutex_unlock(&ebt_mutex);
1548 break;
1549
1550 default:
1551 mutex_unlock(&ebt_mutex);
1552 ret = -EINVAL;
1553 }
1554
1555 return ret;
1556 }
1557
1558 #ifdef CONFIG_COMPAT
1559 /* 32 bit-userspace compatibility definitions. */
1560 struct compat_ebt_replace {
1561 char name[EBT_TABLE_MAXNAMELEN];
1562 compat_uint_t valid_hooks;
1563 compat_uint_t nentries;
1564 compat_uint_t entries_size;
1565 /* start of the chains */
1566 compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1567 /* nr of counters userspace expects back */
1568 compat_uint_t num_counters;
1569 /* where the kernel will put the old counters. */
1570 compat_uptr_t counters;
1571 compat_uptr_t entries;
1572 };
1573
1574 /* struct ebt_entry_match, _target and _watcher have same layout */
1575 struct compat_ebt_entry_mwt {
1576 union {
1577 char name[EBT_FUNCTION_MAXNAMELEN];
1578 compat_uptr_t ptr;
1579 } u;
1580 compat_uint_t match_size;
1581 compat_uint_t data[0];
1582 };
1583
1584 /* account for possible padding between match_size and ->data */
1585 static int ebt_compat_entry_padsize(void)
1586 {
1587 BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1588 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1589 return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1590 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1591 }
1592
1593 static int ebt_compat_match_offset(const struct xt_match *match,
1594 unsigned int userlen)
1595 {
1596 /*
1597 * ebt_among needs special handling. The kernel .matchsize is
1598 * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1599 * value is expected.
1600 * Example: userspace sends 4500, ebt_among.c wants 4504.
1601 */
1602 if (unlikely(match->matchsize == -1))
1603 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1604 return xt_compat_match_offset(match);
1605 }
1606
1607 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1608 unsigned int *size)
1609 {
1610 const struct xt_match *match = m->u.match;
1611 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1612 int off = ebt_compat_match_offset(match, m->match_size);
1613 compat_uint_t msize = m->match_size - off;
1614
1615 BUG_ON(off >= m->match_size);
1616
1617 if (copy_to_user(cm->u.name, match->name,
1618 strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1619 return -EFAULT;
1620
1621 if (match->compat_to_user) {
1622 if (match->compat_to_user(cm->data, m->data))
1623 return -EFAULT;
1624 } else if (copy_to_user(cm->data, m->data, msize))
1625 return -EFAULT;
1626
1627 *size -= ebt_compat_entry_padsize() + off;
1628 *dstptr = cm->data;
1629 *dstptr += msize;
1630 return 0;
1631 }
1632
1633 static int compat_target_to_user(struct ebt_entry_target *t,
1634 void __user **dstptr,
1635 unsigned int *size)
1636 {
1637 const struct xt_target *target = t->u.target;
1638 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1639 int off = xt_compat_target_offset(target);
1640 compat_uint_t tsize = t->target_size - off;
1641
1642 BUG_ON(off >= t->target_size);
1643
1644 if (copy_to_user(cm->u.name, target->name,
1645 strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1646 return -EFAULT;
1647
1648 if (target->compat_to_user) {
1649 if (target->compat_to_user(cm->data, t->data))
1650 return -EFAULT;
1651 } else if (copy_to_user(cm->data, t->data, tsize))
1652 return -EFAULT;
1653
1654 *size -= ebt_compat_entry_padsize() + off;
1655 *dstptr = cm->data;
1656 *dstptr += tsize;
1657 return 0;
1658 }
1659
1660 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1661 void __user **dstptr,
1662 unsigned int *size)
1663 {
1664 return compat_target_to_user((struct ebt_entry_target *)w,
1665 dstptr, size);
1666 }
1667
1668 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1669 unsigned int *size)
1670 {
1671 struct ebt_entry_target *t;
1672 struct ebt_entry __user *ce;
1673 u32 watchers_offset, target_offset, next_offset;
1674 compat_uint_t origsize;
1675 int ret;
1676
1677 if (e->bitmask == 0) {
1678 if (*size < sizeof(struct ebt_entries))
1679 return -EINVAL;
1680 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1681 return -EFAULT;
1682
1683 *dstptr += sizeof(struct ebt_entries);
1684 *size -= sizeof(struct ebt_entries);
1685 return 0;
1686 }
1687
1688 if (*size < sizeof(*ce))
1689 return -EINVAL;
1690
1691 ce = (struct ebt_entry __user *)*dstptr;
1692 if (copy_to_user(ce, e, sizeof(*ce)))
1693 return -EFAULT;
1694
1695 origsize = *size;
1696 *dstptr += sizeof(*ce);
1697
1698 ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1699 if (ret)
1700 return ret;
1701 watchers_offset = e->watchers_offset - (origsize - *size);
1702
1703 ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1704 if (ret)
1705 return ret;
1706 target_offset = e->target_offset - (origsize - *size);
1707
1708 t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1709
1710 ret = compat_target_to_user(t, dstptr, size);
1711 if (ret)
1712 return ret;
1713 next_offset = e->next_offset - (origsize - *size);
1714
1715 if (put_user(watchers_offset, &ce->watchers_offset) ||
1716 put_user(target_offset, &ce->target_offset) ||
1717 put_user(next_offset, &ce->next_offset))
1718 return -EFAULT;
1719
1720 *size -= sizeof(*ce);
1721 return 0;
1722 }
1723
1724 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1725 {
1726 *off += ebt_compat_match_offset(m->u.match, m->match_size);
1727 *off += ebt_compat_entry_padsize();
1728 return 0;
1729 }
1730
1731 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1732 {
1733 *off += xt_compat_target_offset(w->u.watcher);
1734 *off += ebt_compat_entry_padsize();
1735 return 0;
1736 }
1737
1738 static int compat_calc_entry(const struct ebt_entry *e,
1739 const struct ebt_table_info *info,
1740 const void *base,
1741 struct compat_ebt_replace *newinfo)
1742 {
1743 const struct ebt_entry_target *t;
1744 unsigned int entry_offset;
1745 int off, ret, i;
1746
1747 if (e->bitmask == 0)
1748 return 0;
1749
1750 off = 0;
1751 entry_offset = (void *)e - base;
1752
1753 EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1754 EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1755
1756 t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1757
1758 off += xt_compat_target_offset(t->u.target);
1759 off += ebt_compat_entry_padsize();
1760
1761 newinfo->entries_size -= off;
1762
1763 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1764 if (ret)
1765 return ret;
1766
1767 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1768 const void *hookptr = info->hook_entry[i];
1769 if (info->hook_entry[i] &&
1770 (e < (struct ebt_entry *)(base - hookptr))) {
1771 newinfo->hook_entry[i] -= off;
1772 pr_debug("0x%08X -> 0x%08X\n",
1773 newinfo->hook_entry[i] + off,
1774 newinfo->hook_entry[i]);
1775 }
1776 }
1777
1778 return 0;
1779 }
1780
1781
1782 static int compat_table_info(const struct ebt_table_info *info,
1783 struct compat_ebt_replace *newinfo)
1784 {
1785 unsigned int size = info->entries_size;
1786 const void *entries = info->entries;
1787
1788 newinfo->entries_size = size;
1789
1790 xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
1791 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1792 entries, newinfo);
1793 }
1794
1795 static int compat_copy_everything_to_user(struct ebt_table *t,
1796 void __user *user, int *len, int cmd)
1797 {
1798 struct compat_ebt_replace repl, tmp;
1799 struct ebt_counter *oldcounters;
1800 struct ebt_table_info tinfo;
1801 int ret;
1802 void __user *pos;
1803
1804 memset(&tinfo, 0, sizeof(tinfo));
1805
1806 if (cmd == EBT_SO_GET_ENTRIES) {
1807 tinfo.entries_size = t->private->entries_size;
1808 tinfo.nentries = t->private->nentries;
1809 tinfo.entries = t->private->entries;
1810 oldcounters = t->private->counters;
1811 } else {
1812 tinfo.entries_size = t->table->entries_size;
1813 tinfo.nentries = t->table->nentries;
1814 tinfo.entries = t->table->entries;
1815 oldcounters = t->table->counters;
1816 }
1817
1818 if (copy_from_user(&tmp, user, sizeof(tmp)))
1819 return -EFAULT;
1820
1821 if (tmp.nentries != tinfo.nentries ||
1822 (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1823 return -EINVAL;
1824
1825 memcpy(&repl, &tmp, sizeof(repl));
1826 if (cmd == EBT_SO_GET_ENTRIES)
1827 ret = compat_table_info(t->private, &repl);
1828 else
1829 ret = compat_table_info(&tinfo, &repl);
1830 if (ret)
1831 return ret;
1832
1833 if (*len != sizeof(tmp) + repl.entries_size +
1834 (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1835 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1836 *len, tinfo.entries_size, repl.entries_size);
1837 return -EINVAL;
1838 }
1839
1840 /* userspace might not need the counters */
1841 ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1842 tmp.num_counters, tinfo.nentries);
1843 if (ret)
1844 return ret;
1845
1846 pos = compat_ptr(tmp.entries);
1847 return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1848 compat_copy_entry_to_user, &pos, &tmp.entries_size);
1849 }
1850
1851 struct ebt_entries_buf_state {
1852 char *buf_kern_start; /* kernel buffer to copy (translated) data to */
1853 u32 buf_kern_len; /* total size of kernel buffer */
1854 u32 buf_kern_offset; /* amount of data copied so far */
1855 u32 buf_user_offset; /* read position in userspace buffer */
1856 };
1857
1858 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1859 {
1860 state->buf_kern_offset += sz;
1861 return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1862 }
1863
1864 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1865 void *data, unsigned int sz)
1866 {
1867 if (state->buf_kern_start == NULL)
1868 goto count_only;
1869
1870 BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1871
1872 memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1873
1874 count_only:
1875 state->buf_user_offset += sz;
1876 return ebt_buf_count(state, sz);
1877 }
1878
1879 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1880 {
1881 char *b = state->buf_kern_start;
1882
1883 BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1884
1885 if (b != NULL && sz > 0)
1886 memset(b + state->buf_kern_offset, 0, sz);
1887 /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1888 return ebt_buf_count(state, sz);
1889 }
1890
1891 enum compat_mwt {
1892 EBT_COMPAT_MATCH,
1893 EBT_COMPAT_WATCHER,
1894 EBT_COMPAT_TARGET,
1895 };
1896
1897 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1898 enum compat_mwt compat_mwt,
1899 struct ebt_entries_buf_state *state,
1900 const unsigned char *base)
1901 {
1902 char name[EBT_FUNCTION_MAXNAMELEN];
1903 struct xt_match *match;
1904 struct xt_target *wt;
1905 void *dst = NULL;
1906 int off, pad = 0;
1907 unsigned int size_kern, match_size = mwt->match_size;
1908
1909 strlcpy(name, mwt->u.name, sizeof(name));
1910
1911 if (state->buf_kern_start)
1912 dst = state->buf_kern_start + state->buf_kern_offset;
1913
1914 switch (compat_mwt) {
1915 case EBT_COMPAT_MATCH:
1916 match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
1917 if (IS_ERR(match))
1918 return PTR_ERR(match);
1919
1920 off = ebt_compat_match_offset(match, match_size);
1921 if (dst) {
1922 if (match->compat_from_user)
1923 match->compat_from_user(dst, mwt->data);
1924 else
1925 memcpy(dst, mwt->data, match_size);
1926 }
1927
1928 size_kern = match->matchsize;
1929 if (unlikely(size_kern == -1))
1930 size_kern = match_size;
1931 module_put(match->me);
1932 break;
1933 case EBT_COMPAT_WATCHER: /* fallthrough */
1934 case EBT_COMPAT_TARGET:
1935 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
1936 if (IS_ERR(wt))
1937 return PTR_ERR(wt);
1938 off = xt_compat_target_offset(wt);
1939
1940 if (dst) {
1941 if (wt->compat_from_user)
1942 wt->compat_from_user(dst, mwt->data);
1943 else
1944 memcpy(dst, mwt->data, match_size);
1945 }
1946
1947 size_kern = wt->targetsize;
1948 module_put(wt->me);
1949 break;
1950
1951 default:
1952 return -EINVAL;
1953 }
1954
1955 state->buf_kern_offset += match_size + off;
1956 state->buf_user_offset += match_size;
1957 pad = XT_ALIGN(size_kern) - size_kern;
1958
1959 if (pad > 0 && dst) {
1960 BUG_ON(state->buf_kern_len <= pad);
1961 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1962 memset(dst + size_kern, 0, pad);
1963 }
1964 return off + match_size;
1965 }
1966
1967 /*
1968 * return size of all matches, watchers or target, including necessary
1969 * alignment and padding.
1970 */
1971 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1972 unsigned int size_left, enum compat_mwt type,
1973 struct ebt_entries_buf_state *state, const void *base)
1974 {
1975 int growth = 0;
1976 char *buf;
1977
1978 if (size_left == 0)
1979 return 0;
1980
1981 buf = (char *) match32;
1982
1983 while (size_left >= sizeof(*match32)) {
1984 struct ebt_entry_match *match_kern;
1985 int ret;
1986
1987 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1988 if (match_kern) {
1989 char *tmp;
1990 tmp = state->buf_kern_start + state->buf_kern_offset;
1991 match_kern = (struct ebt_entry_match *) tmp;
1992 }
1993 ret = ebt_buf_add(state, buf, sizeof(*match32));
1994 if (ret < 0)
1995 return ret;
1996 size_left -= sizeof(*match32);
1997
1998 /* add padding before match->data (if any) */
1999 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
2000 if (ret < 0)
2001 return ret;
2002
2003 if (match32->match_size > size_left)
2004 return -EINVAL;
2005
2006 size_left -= match32->match_size;
2007
2008 ret = compat_mtw_from_user(match32, type, state, base);
2009 if (ret < 0)
2010 return ret;
2011
2012 BUG_ON(ret < match32->match_size);
2013 growth += ret - match32->match_size;
2014 growth += ebt_compat_entry_padsize();
2015
2016 buf += sizeof(*match32);
2017 buf += match32->match_size;
2018
2019 if (match_kern)
2020 match_kern->match_size = ret;
2021
2022 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2023 match32 = (struct compat_ebt_entry_mwt *) buf;
2024 }
2025
2026 return growth;
2027 }
2028
2029 /* called for all ebt_entry structures. */
2030 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2031 unsigned int *total,
2032 struct ebt_entries_buf_state *state)
2033 {
2034 unsigned int i, j, startoff, new_offset = 0;
2035 /* stores match/watchers/targets & offset of next struct ebt_entry: */
2036 unsigned int offsets[4];
2037 unsigned int *offsets_update = NULL;
2038 int ret;
2039 char *buf_start;
2040
2041 if (*total < sizeof(struct ebt_entries))
2042 return -EINVAL;
2043
2044 if (!entry->bitmask) {
2045 *total -= sizeof(struct ebt_entries);
2046 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2047 }
2048 if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2049 return -EINVAL;
2050
2051 startoff = state->buf_user_offset;
2052 /* pull in most part of ebt_entry, it does not need to be changed. */
2053 ret = ebt_buf_add(state, entry,
2054 offsetof(struct ebt_entry, watchers_offset));
2055 if (ret < 0)
2056 return ret;
2057
2058 offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2059 memcpy(&offsets[1], &entry->watchers_offset,
2060 sizeof(offsets) - sizeof(offsets[0]));
2061
2062 if (state->buf_kern_start) {
2063 buf_start = state->buf_kern_start + state->buf_kern_offset;
2064 offsets_update = (unsigned int *) buf_start;
2065 }
2066 ret = ebt_buf_add(state, &offsets[1],
2067 sizeof(offsets) - sizeof(offsets[0]));
2068 if (ret < 0)
2069 return ret;
2070 buf_start = (char *) entry;
2071 /*
2072 * 0: matches offset, always follows ebt_entry.
2073 * 1: watchers offset, from ebt_entry structure
2074 * 2: target offset, from ebt_entry structure
2075 * 3: next ebt_entry offset, from ebt_entry structure
2076 *
2077 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2078 */
2079 for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2080 struct compat_ebt_entry_mwt *match32;
2081 unsigned int size;
2082 char *buf = buf_start;
2083
2084 buf = buf_start + offsets[i];
2085 if (offsets[i] > offsets[j])
2086 return -EINVAL;
2087
2088 match32 = (struct compat_ebt_entry_mwt *) buf;
2089 size = offsets[j] - offsets[i];
2090 ret = ebt_size_mwt(match32, size, i, state, base);
2091 if (ret < 0)
2092 return ret;
2093 new_offset += ret;
2094 if (offsets_update && new_offset) {
2095 pr_debug("change offset %d to %d\n",
2096 offsets_update[i], offsets[j] + new_offset);
2097 offsets_update[i] = offsets[j] + new_offset;
2098 }
2099 }
2100
2101 if (state->buf_kern_start == NULL) {
2102 unsigned int offset = buf_start - (char *) base;
2103
2104 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
2105 if (ret < 0)
2106 return ret;
2107 }
2108
2109 startoff = state->buf_user_offset - startoff;
2110
2111 BUG_ON(*total < startoff);
2112 *total -= startoff;
2113 return 0;
2114 }
2115
2116 /*
2117 * repl->entries_size is the size of the ebt_entry blob in userspace.
2118 * It might need more memory when copied to a 64 bit kernel in case
2119 * userspace is 32-bit. So, first task: find out how much memory is needed.
2120 *
2121 * Called before validation is performed.
2122 */
2123 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2124 struct ebt_entries_buf_state *state)
2125 {
2126 unsigned int size_remaining = size_user;
2127 int ret;
2128
2129 ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2130 &size_remaining, state);
2131 if (ret < 0)
2132 return ret;
2133
2134 WARN_ON(size_remaining);
2135 return state->buf_kern_offset;
2136 }
2137
2138
2139 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2140 void __user *user, unsigned int len)
2141 {
2142 struct compat_ebt_replace tmp;
2143 int i;
2144
2145 if (len < sizeof(tmp))
2146 return -EINVAL;
2147
2148 if (copy_from_user(&tmp, user, sizeof(tmp)))
2149 return -EFAULT;
2150
2151 if (len != sizeof(tmp) + tmp.entries_size)
2152 return -EINVAL;
2153
2154 if (tmp.entries_size == 0)
2155 return -EINVAL;
2156
2157 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2158 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2159 return -ENOMEM;
2160 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2161 return -ENOMEM;
2162
2163 memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2164
2165 /* starting with hook_entry, 32 vs. 64 bit structures are different */
2166 for (i = 0; i < NF_BR_NUMHOOKS; i++)
2167 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2168
2169 repl->num_counters = tmp.num_counters;
2170 repl->counters = compat_ptr(tmp.counters);
2171 repl->entries = compat_ptr(tmp.entries);
2172 return 0;
2173 }
2174
2175 static int compat_do_replace(struct net *net, void __user *user,
2176 unsigned int len)
2177 {
2178 int ret, i, countersize, size64;
2179 struct ebt_table_info *newinfo;
2180 struct ebt_replace tmp;
2181 struct ebt_entries_buf_state state;
2182 void *entries_tmp;
2183
2184 ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2185 if (ret) {
2186 /* try real handler in case userland supplied needed padding */
2187 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2188 ret = 0;
2189 return ret;
2190 }
2191
2192 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2193 newinfo = vmalloc(sizeof(*newinfo) + countersize);
2194 if (!newinfo)
2195 return -ENOMEM;
2196
2197 if (countersize)
2198 memset(newinfo->counters, 0, countersize);
2199
2200 memset(&state, 0, sizeof(state));
2201
2202 newinfo->entries = vmalloc(tmp.entries_size);
2203 if (!newinfo->entries) {
2204 ret = -ENOMEM;
2205 goto free_newinfo;
2206 }
2207 if (copy_from_user(
2208 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2209 ret = -EFAULT;
2210 goto free_entries;
2211 }
2212
2213 entries_tmp = newinfo->entries;
2214
2215 xt_compat_lock(NFPROTO_BRIDGE);
2216
2217 xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
2218 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2219 if (ret < 0)
2220 goto out_unlock;
2221
2222 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2223 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2224 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2225
2226 size64 = ret;
2227 newinfo->entries = vmalloc(size64);
2228 if (!newinfo->entries) {
2229 vfree(entries_tmp);
2230 ret = -ENOMEM;
2231 goto out_unlock;
2232 }
2233
2234 memset(&state, 0, sizeof(state));
2235 state.buf_kern_start = newinfo->entries;
2236 state.buf_kern_len = size64;
2237
2238 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2239 BUG_ON(ret < 0); /* parses same data again */
2240
2241 vfree(entries_tmp);
2242 tmp.entries_size = size64;
2243
2244 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2245 char __user *usrptr;
2246 if (tmp.hook_entry[i]) {
2247 unsigned int delta;
2248 usrptr = (char __user *) tmp.hook_entry[i];
2249 delta = usrptr - tmp.entries;
2250 usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2251 tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2252 }
2253 }
2254
2255 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2256 xt_compat_unlock(NFPROTO_BRIDGE);
2257
2258 ret = do_replace_finish(net, &tmp, newinfo);
2259 if (ret == 0)
2260 return ret;
2261 free_entries:
2262 vfree(newinfo->entries);
2263 free_newinfo:
2264 vfree(newinfo);
2265 return ret;
2266 out_unlock:
2267 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2268 xt_compat_unlock(NFPROTO_BRIDGE);
2269 goto free_entries;
2270 }
2271
2272 static int compat_update_counters(struct net *net, void __user *user,
2273 unsigned int len)
2274 {
2275 struct compat_ebt_replace hlp;
2276
2277 if (copy_from_user(&hlp, user, sizeof(hlp)))
2278 return -EFAULT;
2279
2280 /* try real handler in case userland supplied needed padding */
2281 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2282 return update_counters(net, user, len);
2283
2284 return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2285 hlp.num_counters, user, len);
2286 }
2287
2288 static int compat_do_ebt_set_ctl(struct sock *sk,
2289 int cmd, void __user *user, unsigned int len)
2290 {
2291 int ret;
2292 struct net *net = sock_net(sk);
2293
2294 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2295 return -EPERM;
2296
2297 switch (cmd) {
2298 case EBT_SO_SET_ENTRIES:
2299 ret = compat_do_replace(net, user, len);
2300 break;
2301 case EBT_SO_SET_COUNTERS:
2302 ret = compat_update_counters(net, user, len);
2303 break;
2304 default:
2305 ret = -EINVAL;
2306 }
2307 return ret;
2308 }
2309
2310 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2311 void __user *user, int *len)
2312 {
2313 int ret;
2314 struct compat_ebt_replace tmp;
2315 struct ebt_table *t;
2316 struct net *net = sock_net(sk);
2317
2318 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2319 return -EPERM;
2320
2321 /* try real handler in case userland supplied needed padding */
2322 if ((cmd == EBT_SO_GET_INFO ||
2323 cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2324 return do_ebt_get_ctl(sk, cmd, user, len);
2325
2326 if (copy_from_user(&tmp, user, sizeof(tmp)))
2327 return -EFAULT;
2328
2329 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
2330 if (!t)
2331 return ret;
2332
2333 xt_compat_lock(NFPROTO_BRIDGE);
2334 switch (cmd) {
2335 case EBT_SO_GET_INFO:
2336 tmp.nentries = t->private->nentries;
2337 ret = compat_table_info(t->private, &tmp);
2338 if (ret)
2339 goto out;
2340 tmp.valid_hooks = t->valid_hooks;
2341
2342 if (copy_to_user(user, &tmp, *len) != 0) {
2343 ret = -EFAULT;
2344 break;
2345 }
2346 ret = 0;
2347 break;
2348 case EBT_SO_GET_INIT_INFO:
2349 tmp.nentries = t->table->nentries;
2350 tmp.entries_size = t->table->entries_size;
2351 tmp.valid_hooks = t->table->valid_hooks;
2352
2353 if (copy_to_user(user, &tmp, *len) != 0) {
2354 ret = -EFAULT;
2355 break;
2356 }
2357 ret = 0;
2358 break;
2359 case EBT_SO_GET_ENTRIES:
2360 case EBT_SO_GET_INIT_ENTRIES:
2361 /*
2362 * try real handler first in case of userland-side padding.
2363 * in case we are dealing with an 'ordinary' 32 bit binary
2364 * without 64bit compatibility padding, this will fail right
2365 * after copy_from_user when the *len argument is validated.
2366 *
2367 * the compat_ variant needs to do one pass over the kernel
2368 * data set to adjust for size differences before it the check.
2369 */
2370 if (copy_everything_to_user(t, user, len, cmd) == 0)
2371 ret = 0;
2372 else
2373 ret = compat_copy_everything_to_user(t, user, len, cmd);
2374 break;
2375 default:
2376 ret = -EINVAL;
2377 }
2378 out:
2379 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2380 xt_compat_unlock(NFPROTO_BRIDGE);
2381 mutex_unlock(&ebt_mutex);
2382 return ret;
2383 }
2384 #endif
2385
2386 static struct nf_sockopt_ops ebt_sockopts = {
2387 .pf = PF_INET,
2388 .set_optmin = EBT_BASE_CTL,
2389 .set_optmax = EBT_SO_SET_MAX + 1,
2390 .set = do_ebt_set_ctl,
2391 #ifdef CONFIG_COMPAT
2392 .compat_set = compat_do_ebt_set_ctl,
2393 #endif
2394 .get_optmin = EBT_BASE_CTL,
2395 .get_optmax = EBT_SO_GET_MAX + 1,
2396 .get = do_ebt_get_ctl,
2397 #ifdef CONFIG_COMPAT
2398 .compat_get = compat_do_ebt_get_ctl,
2399 #endif
2400 .owner = THIS_MODULE,
2401 };
2402
2403 static int __init ebtables_init(void)
2404 {
2405 int ret;
2406
2407 ret = xt_register_target(&ebt_standard_target);
2408 if (ret < 0)
2409 return ret;
2410 ret = nf_register_sockopt(&ebt_sockopts);
2411 if (ret < 0) {
2412 xt_unregister_target(&ebt_standard_target);
2413 return ret;
2414 }
2415
2416 printk(KERN_INFO "Ebtables v2.0 registered\n");
2417 return 0;
2418 }
2419
2420 static void __exit ebtables_fini(void)
2421 {
2422 nf_unregister_sockopt(&ebt_sockopts);
2423 xt_unregister_target(&ebt_standard_target);
2424 printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2425 }
2426
2427 EXPORT_SYMBOL(ebt_register_table);
2428 EXPORT_SYMBOL(ebt_unregister_table);
2429 EXPORT_SYMBOL(ebt_do_table);
2430 module_init(ebtables_init);
2431 module_exit(ebtables_fini);
2432 MODULE_LICENSE("GPL");
Linux with added FPC-III support