?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
drm: powerpc can use a simpler drm_io_prot()
[linux/fpc-iii.git] / net / bridge / netfilter / ebtables.c
blob6d69631b9f4d2bf5c667d1f76e4f5bc384cdf61c
1 /*
2 * ebtables
3 *
4 * Author:
5 * Bart De Schuymer <bdschuym@pandora.be>
6 *
7 * ebtables.c,v 2.0, July, 2002
8 *
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 */
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18 #include <linux/kmod.h>
19 #include <linux/module.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/spinlock.h>
24 #include <linux/mutex.h>
25 #include <linux/slab.h>
26 #include <asm/uaccess.h>
27 #include <linux/smp.h>
28 #include <linux/cpumask.h>
29 #include <net/sock.h>
30 /* needed for logical [in,out]-dev filtering */
31 #include "../br_private.h"
32
33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
34 "report to author: "format, ## args)
35 /* #define BUGPRINT(format, args...) */
36
37 /*
38 * Each cpu has its own set of counters, so there is no need for write_lock in
39 * the softirq
40 * For reading or updating the counters, the user context needs to
41 * get a write_lock
42 */
43
44 /* The size of each set of counters is altered to get cache alignment */
45 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
46 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
47 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
48 COUNTER_OFFSET(n) * cpu))
49
50
51
52 static DEFINE_MUTEX(ebt_mutex);
53
54 #ifdef CONFIG_COMPAT
55 static void ebt_standard_compat_from_user(void *dst, const void *src)
56 {
57 int v = *(compat_int_t *)src;
58
59 if (v >= 0)
60 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
61 memcpy(dst, &v, sizeof(v));
62 }
63
64 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
65 {
66 compat_int_t cv = *(int *)src;
67
68 if (cv >= 0)
69 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
70 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
71 }
72 #endif
73
74
75 static struct xt_target ebt_standard_target = {
76 .name = "standard",
77 .revision = 0,
78 .family = NFPROTO_BRIDGE,
79 .targetsize = sizeof(int),
80 #ifdef CONFIG_COMPAT
81 .compatsize = sizeof(compat_int_t),
82 .compat_from_user = ebt_standard_compat_from_user,
83 .compat_to_user = ebt_standard_compat_to_user,
84 #endif
85 };
86
87 static inline int
88 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
89 struct xt_action_param *par)
90 {
91 par->target = w->u.watcher;
92 par->targinfo = w->data;
93 w->u.watcher->target(skb, par);
94 /* watchers don't give a verdict */
95 return 0;
96 }
97
98 static inline int
99 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
100 struct xt_action_param *par)
101 {
102 par->match = m->u.match;
103 par->matchinfo = m->data;
104 return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
105 }
106
107 static inline int
108 ebt_dev_check(const char *entry, const struct net_device *device)
109 {
110 int i = 0;
111 const char *devname;
112
113 if (*entry == '\0')
114 return 0;
115 if (!device)
116 return 1;
117 devname = device->name;
118 /* 1 is the wildcard token */
119 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
120 i++;
121 return devname[i] != entry[i] && entry[i] != 1;
122 }
123
124 #define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
125 /* process standard matches */
126 static inline int
127 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
128 const struct net_device *in, const struct net_device *out)
129 {
130 const struct ethhdr *h = eth_hdr(skb);
131 const struct net_bridge_port *p;
132 __be16 ethproto;
133 int verdict, i;
134
135 if (vlan_tx_tag_present(skb))
136 ethproto = htons(ETH_P_8021Q);
137 else
138 ethproto = h->h_proto;
139
140 if (e->bitmask & EBT_802_3) {
141 if (FWINV2(ntohs(ethproto) >= ETH_P_802_3_MIN, EBT_IPROTO))
142 return 1;
143 } else if (!(e->bitmask & EBT_NOPROTO) &&
144 FWINV2(e->ethproto != ethproto, EBT_IPROTO))
145 return 1;
146
147 if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
148 return 1;
149 if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
150 return 1;
151 /* rcu_read_lock()ed by nf_hook_slow */
152 if (in && (p = br_port_get_rcu(in)) != NULL &&
153 FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
154 return 1;
155 if (out && (p = br_port_get_rcu(out)) != NULL &&
156 FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
157 return 1;
158
159 if (e->bitmask & EBT_SOURCEMAC) {
160 verdict = 0;
161 for (i = 0; i < 6; i++)
162 verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
163 e->sourcemsk[i];
164 if (FWINV2(verdict != 0, EBT_ISOURCE) )
165 return 1;
166 }
167 if (e->bitmask & EBT_DESTMAC) {
168 verdict = 0;
169 for (i = 0; i < 6; i++)
170 verdict |= (h->h_dest[i] ^ e->destmac[i]) &
171 e->destmsk[i];
172 if (FWINV2(verdict != 0, EBT_IDEST) )
173 return 1;
174 }
175 return 0;
176 }
177
178 static inline __pure
179 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
180 {
181 return (void *)entry + entry->next_offset;
182 }
183
184 /* Do some firewalling */
185 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
186 const struct net_device *in, const struct net_device *out,
187 struct ebt_table *table)
188 {
189 int i, nentries;
190 struct ebt_entry *point;
191 struct ebt_counter *counter_base, *cb_base;
192 const struct ebt_entry_target *t;
193 int verdict, sp = 0;
194 struct ebt_chainstack *cs;
195 struct ebt_entries *chaininfo;
196 const char *base;
197 const struct ebt_table_info *private;
198 struct xt_action_param acpar;
199
200 acpar.family = NFPROTO_BRIDGE;
201 acpar.in = in;
202 acpar.out = out;
203 acpar.hotdrop = false;
204 acpar.hooknum = hook;
205
206 read_lock_bh(&table->lock);
207 private = table->private;
208 cb_base = COUNTER_BASE(private->counters, private->nentries,
209 smp_processor_id());
210 if (private->chainstack)
211 cs = private->chainstack[smp_processor_id()];
212 else
213 cs = NULL;
214 chaininfo = private->hook_entry[hook];
215 nentries = private->hook_entry[hook]->nentries;
216 point = (struct ebt_entry *)(private->hook_entry[hook]->data);
217 counter_base = cb_base + private->hook_entry[hook]->counter_offset;
218 /* base for chain jumps */
219 base = private->entries;
220 i = 0;
221 while (i < nentries) {
222 if (ebt_basic_match(point, skb, in, out))
223 goto letscontinue;
224
225 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
226 goto letscontinue;
227 if (acpar.hotdrop) {
228 read_unlock_bh(&table->lock);
229 return NF_DROP;
230 }
231
232 /* increase counter */
233 (*(counter_base + i)).pcnt++;
234 (*(counter_base + i)).bcnt += skb->len;
235
236 /* these should only watch: not modify, nor tell us
237 what to do with the packet */
238 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
239
240 t = (struct ebt_entry_target *)
241 (((char *)point) + point->target_offset);
242 /* standard target */
243 if (!t->u.target->target)
244 verdict = ((struct ebt_standard_target *)t)->verdict;
245 else {
246 acpar.target = t->u.target;
247 acpar.targinfo = t->data;
248 verdict = t->u.target->target(skb, &acpar);
249 }
250 if (verdict == EBT_ACCEPT) {
251 read_unlock_bh(&table->lock);
252 return NF_ACCEPT;
253 }
254 if (verdict == EBT_DROP) {
255 read_unlock_bh(&table->lock);
256 return NF_DROP;
257 }
258 if (verdict == EBT_RETURN) {
259 letsreturn:
260 #ifdef CONFIG_NETFILTER_DEBUG
261 if (sp == 0) {
262 BUGPRINT("RETURN on base chain");
263 /* act like this is EBT_CONTINUE */
264 goto letscontinue;
265 }
266 #endif
267 sp--;
268 /* put all the local variables right */
269 i = cs[sp].n;
270 chaininfo = cs[sp].chaininfo;
271 nentries = chaininfo->nentries;
272 point = cs[sp].e;
273 counter_base = cb_base +
274 chaininfo->counter_offset;
275 continue;
276 }
277 if (verdict == EBT_CONTINUE)
278 goto letscontinue;
279 #ifdef CONFIG_NETFILTER_DEBUG
280 if (verdict < 0) {
281 BUGPRINT("bogus standard verdict\n");
282 read_unlock_bh(&table->lock);
283 return NF_DROP;
284 }
285 #endif
286 /* jump to a udc */
287 cs[sp].n = i + 1;
288 cs[sp].chaininfo = chaininfo;
289 cs[sp].e = ebt_next_entry(point);
290 i = 0;
291 chaininfo = (struct ebt_entries *) (base + verdict);
292 #ifdef CONFIG_NETFILTER_DEBUG
293 if (chaininfo->distinguisher) {
294 BUGPRINT("jump to non-chain\n");
295 read_unlock_bh(&table->lock);
296 return NF_DROP;
297 }
298 #endif
299 nentries = chaininfo->nentries;
300 point = (struct ebt_entry *)chaininfo->data;
301 counter_base = cb_base + chaininfo->counter_offset;
302 sp++;
303 continue;
304 letscontinue:
305 point = ebt_next_entry(point);
306 i++;
307 }
308
309 /* I actually like this :) */
310 if (chaininfo->policy == EBT_RETURN)
311 goto letsreturn;
312 if (chaininfo->policy == EBT_ACCEPT) {
313 read_unlock_bh(&table->lock);
314 return NF_ACCEPT;
315 }
316 read_unlock_bh(&table->lock);
317 return NF_DROP;
318 }
319
320 /* If it succeeds, returns element and locks mutex */
321 static inline void *
322 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
323 struct mutex *mutex)
324 {
325 struct {
326 struct list_head list;
327 char name[EBT_FUNCTION_MAXNAMELEN];
328 } *e;
329
330 mutex_lock(mutex);
331 list_for_each_entry(e, head, list) {
332 if (strcmp(e->name, name) == 0)
333 return e;
334 }
335 *error = -ENOENT;
336 mutex_unlock(mutex);
337 return NULL;
338 }
339
340 static void *
341 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
342 int *error, struct mutex *mutex)
343 {
344 return try_then_request_module(
345 find_inlist_lock_noload(head, name, error, mutex),
346 "%s%s", prefix, name);
347 }
348
349 static inline struct ebt_table *
350 find_table_lock(struct net *net, const char *name, int *error,
351 struct mutex *mutex)
352 {
353 return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
354 "ebtable_", error, mutex);
355 }
356
357 static inline int
358 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
359 unsigned int *cnt)
360 {
361 const struct ebt_entry *e = par->entryinfo;
362 struct xt_match *match;
363 size_t left = ((char *)e + e->watchers_offset) - (char *)m;
364 int ret;
365
366 if (left < sizeof(struct ebt_entry_match) ||
367 left - sizeof(struct ebt_entry_match) < m->match_size)
368 return -EINVAL;
369
370 match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
371 if (IS_ERR(match))
372 return PTR_ERR(match);
373 m->u.match = match;
374
375 par->match = match;
376 par->matchinfo = m->data;
377 ret = xt_check_match(par, m->match_size,
378 e->ethproto, e->invflags & EBT_IPROTO);
379 if (ret < 0) {
380 module_put(match->me);
381 return ret;
382 }
383
384 (*cnt)++;
385 return 0;
386 }
387
388 static inline int
389 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
390 unsigned int *cnt)
391 {
392 const struct ebt_entry *e = par->entryinfo;
393 struct xt_target *watcher;
394 size_t left = ((char *)e + e->target_offset) - (char *)w;
395 int ret;
396
397 if (left < sizeof(struct ebt_entry_watcher) ||
398 left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
399 return -EINVAL;
400
401 watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
402 if (IS_ERR(watcher))
403 return PTR_ERR(watcher);
404 w->u.watcher = watcher;
405
406 par->target = watcher;
407 par->targinfo = w->data;
408 ret = xt_check_target(par, w->watcher_size,
409 e->ethproto, e->invflags & EBT_IPROTO);
410 if (ret < 0) {
411 module_put(watcher->me);
412 return ret;
413 }
414
415 (*cnt)++;
416 return 0;
417 }
418
419 static int ebt_verify_pointers(const struct ebt_replace *repl,
420 struct ebt_table_info *newinfo)
421 {
422 unsigned int limit = repl->entries_size;
423 unsigned int valid_hooks = repl->valid_hooks;
424 unsigned int offset = 0;
425 int i;
426
427 for (i = 0; i < NF_BR_NUMHOOKS; i++)
428 newinfo->hook_entry[i] = NULL;
429
430 newinfo->entries_size = repl->entries_size;
431 newinfo->nentries = repl->nentries;
432
433 while (offset < limit) {
434 size_t left = limit - offset;
435 struct ebt_entry *e = (void *)newinfo->entries + offset;
436
437 if (left < sizeof(unsigned int))
438 break;
439
440 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
441 if ((valid_hooks & (1 << i)) == 0)
442 continue;
443 if ((char __user *)repl->hook_entry[i] ==
444 repl->entries + offset)
445 break;
446 }
447
448 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
449 if (e->bitmask != 0) {
450 /* we make userspace set this right,
451 so there is no misunderstanding */
452 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
453 "in distinguisher\n");
454 return -EINVAL;
455 }
456 if (i != NF_BR_NUMHOOKS)
457 newinfo->hook_entry[i] = (struct ebt_entries *)e;
458 if (left < sizeof(struct ebt_entries))
459 break;
460 offset += sizeof(struct ebt_entries);
461 } else {
462 if (left < sizeof(struct ebt_entry))
463 break;
464 if (left < e->next_offset)
465 break;
466 if (e->next_offset < sizeof(struct ebt_entry))
467 return -EINVAL;
468 offset += e->next_offset;
469 }
470 }
471 if (offset != limit) {
472 BUGPRINT("entries_size too small\n");
473 return -EINVAL;
474 }
475
476 /* check if all valid hooks have a chain */
477 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
478 if (!newinfo->hook_entry[i] &&
479 (valid_hooks & (1 << i))) {
480 BUGPRINT("Valid hook without chain\n");
481 return -EINVAL;
482 }
483 }
484 return 0;
485 }
486
487 /*
488 * this one is very careful, as it is the first function
489 * to parse the userspace data
490 */
491 static inline int
492 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
493 const struct ebt_table_info *newinfo,
494 unsigned int *n, unsigned int *cnt,
495 unsigned int *totalcnt, unsigned int *udc_cnt)
496 {
497 int i;
498
499 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
500 if ((void *)e == (void *)newinfo->hook_entry[i])
501 break;
502 }
503 /* beginning of a new chain
504 if i == NF_BR_NUMHOOKS it must be a user defined chain */
505 if (i != NF_BR_NUMHOOKS || !e->bitmask) {
506 /* this checks if the previous chain has as many entries
507 as it said it has */
508 if (*n != *cnt) {
509 BUGPRINT("nentries does not equal the nr of entries "
510 "in the chain\n");
511 return -EINVAL;
512 }
513 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
514 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
515 /* only RETURN from udc */
516 if (i != NF_BR_NUMHOOKS ||
517 ((struct ebt_entries *)e)->policy != EBT_RETURN) {
518 BUGPRINT("bad policy\n");
519 return -EINVAL;
520 }
521 }
522 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
523 (*udc_cnt)++;
524 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
525 BUGPRINT("counter_offset != totalcnt");
526 return -EINVAL;
527 }
528 *n = ((struct ebt_entries *)e)->nentries;
529 *cnt = 0;
530 return 0;
531 }
532 /* a plain old entry, heh */
533 if (sizeof(struct ebt_entry) > e->watchers_offset ||
534 e->watchers_offset > e->target_offset ||
535 e->target_offset >= e->next_offset) {
536 BUGPRINT("entry offsets not in right order\n");
537 return -EINVAL;
538 }
539 /* this is not checked anywhere else */
540 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
541 BUGPRINT("target size too small\n");
542 return -EINVAL;
543 }
544 (*cnt)++;
545 (*totalcnt)++;
546 return 0;
547 }
548
549 struct ebt_cl_stack
550 {
551 struct ebt_chainstack cs;
552 int from;
553 unsigned int hookmask;
554 };
555
556 /*
557 * we need these positions to check that the jumps to a different part of the
558 * entries is a jump to the beginning of a new chain.
559 */
560 static inline int
561 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
562 unsigned int *n, struct ebt_cl_stack *udc)
563 {
564 int i;
565
566 /* we're only interested in chain starts */
567 if (e->bitmask)
568 return 0;
569 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
570 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
571 break;
572 }
573 /* only care about udc */
574 if (i != NF_BR_NUMHOOKS)
575 return 0;
576
577 udc[*n].cs.chaininfo = (struct ebt_entries *)e;
578 /* these initialisations are depended on later in check_chainloops() */
579 udc[*n].cs.n = 0;
580 udc[*n].hookmask = 0;
581
582 (*n)++;
583 return 0;
584 }
585
586 static inline int
587 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
588 {
589 struct xt_mtdtor_param par;
590
591 if (i && (*i)-- == 0)
592 return 1;
593
594 par.net = net;
595 par.match = m->u.match;
596 par.matchinfo = m->data;
597 par.family = NFPROTO_BRIDGE;
598 if (par.match->destroy != NULL)
599 par.match->destroy(&par);
600 module_put(par.match->me);
601 return 0;
602 }
603
604 static inline int
605 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
606 {
607 struct xt_tgdtor_param par;
608
609 if (i && (*i)-- == 0)
610 return 1;
611
612 par.net = net;
613 par.target = w->u.watcher;
614 par.targinfo = w->data;
615 par.family = NFPROTO_BRIDGE;
616 if (par.target->destroy != NULL)
617 par.target->destroy(&par);
618 module_put(par.target->me);
619 return 0;
620 }
621
622 static inline int
623 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
624 {
625 struct xt_tgdtor_param par;
626 struct ebt_entry_target *t;
627
628 if (e->bitmask == 0)
629 return 0;
630 /* we're done */
631 if (cnt && (*cnt)-- == 0)
632 return 1;
633 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
634 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
635 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
636
637 par.net = net;
638 par.target = t->u.target;
639 par.targinfo = t->data;
640 par.family = NFPROTO_BRIDGE;
641 if (par.target->destroy != NULL)
642 par.target->destroy(&par);
643 module_put(par.target->me);
644 return 0;
645 }
646
647 static inline int
648 ebt_check_entry(struct ebt_entry *e, struct net *net,
649 const struct ebt_table_info *newinfo,
650 const char *name, unsigned int *cnt,
651 struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
652 {
653 struct ebt_entry_target *t;
654 struct xt_target *target;
655 unsigned int i, j, hook = 0, hookmask = 0;
656 size_t gap;
657 int ret;
658 struct xt_mtchk_param mtpar;
659 struct xt_tgchk_param tgpar;
660
661 /* don't mess with the struct ebt_entries */
662 if (e->bitmask == 0)
663 return 0;
664
665 if (e->bitmask & ~EBT_F_MASK) {
666 BUGPRINT("Unknown flag for bitmask\n");
667 return -EINVAL;
668 }
669 if (e->invflags & ~EBT_INV_MASK) {
670 BUGPRINT("Unknown flag for inv bitmask\n");
671 return -EINVAL;
672 }
673 if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
674 BUGPRINT("NOPROTO & 802_3 not allowed\n");
675 return -EINVAL;
676 }
677 /* what hook do we belong to? */
678 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
679 if (!newinfo->hook_entry[i])
680 continue;
681 if ((char *)newinfo->hook_entry[i] < (char *)e)
682 hook = i;
683 else
684 break;
685 }
686 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
687 a base chain */
688 if (i < NF_BR_NUMHOOKS)
689 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
690 else {
691 for (i = 0; i < udc_cnt; i++)
692 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
693 break;
694 if (i == 0)
695 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
696 else
697 hookmask = cl_s[i - 1].hookmask;
698 }
699 i = 0;
700
701 mtpar.net = tgpar.net = net;
702 mtpar.table = tgpar.table = name;
703 mtpar.entryinfo = tgpar.entryinfo = e;
704 mtpar.hook_mask = tgpar.hook_mask = hookmask;
705 mtpar.family = tgpar.family = NFPROTO_BRIDGE;
706 ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
707 if (ret != 0)
708 goto cleanup_matches;
709 j = 0;
710 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
711 if (ret != 0)
712 goto cleanup_watchers;
713 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
714 gap = e->next_offset - e->target_offset;
715
716 target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
717 if (IS_ERR(target)) {
718 ret = PTR_ERR(target);
719 goto cleanup_watchers;
720 }
721
722 t->u.target = target;
723 if (t->u.target == &ebt_standard_target) {
724 if (gap < sizeof(struct ebt_standard_target)) {
725 BUGPRINT("Standard target size too big\n");
726 ret = -EFAULT;
727 goto cleanup_watchers;
728 }
729 if (((struct ebt_standard_target *)t)->verdict <
730 -NUM_STANDARD_TARGETS) {
731 BUGPRINT("Invalid standard target\n");
732 ret = -EFAULT;
733 goto cleanup_watchers;
734 }
735 } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
736 module_put(t->u.target->me);
737 ret = -EFAULT;
738 goto cleanup_watchers;
739 }
740
741 tgpar.target = target;
742 tgpar.targinfo = t->data;
743 ret = xt_check_target(&tgpar, t->target_size,
744 e->ethproto, e->invflags & EBT_IPROTO);
745 if (ret < 0) {
746 module_put(target->me);
747 goto cleanup_watchers;
748 }
749 (*cnt)++;
750 return 0;
751 cleanup_watchers:
752 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
753 cleanup_matches:
754 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
755 return ret;
756 }
757
758 /*
759 * checks for loops and sets the hook mask for udc
760 * the hook mask for udc tells us from which base chains the udc can be
761 * accessed. This mask is a parameter to the check() functions of the extensions
762 */
763 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
764 unsigned int udc_cnt, unsigned int hooknr, char *base)
765 {
766 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
767 const struct ebt_entry *e = (struct ebt_entry *)chain->data;
768 const struct ebt_entry_target *t;
769
770 while (pos < nentries || chain_nr != -1) {
771 /* end of udc, go back one 'recursion' step */
772 if (pos == nentries) {
773 /* put back values of the time when this chain was called */
774 e = cl_s[chain_nr].cs.e;
775 if (cl_s[chain_nr].from != -1)
776 nentries =
777 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
778 else
779 nentries = chain->nentries;
780 pos = cl_s[chain_nr].cs.n;
781 /* make sure we won't see a loop that isn't one */
782 cl_s[chain_nr].cs.n = 0;
783 chain_nr = cl_s[chain_nr].from;
784 if (pos == nentries)
785 continue;
786 }
787 t = (struct ebt_entry_target *)
788 (((char *)e) + e->target_offset);
789 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
790 goto letscontinue;
791 if (e->target_offset + sizeof(struct ebt_standard_target) >
792 e->next_offset) {
793 BUGPRINT("Standard target size too big\n");
794 return -1;
795 }
796 verdict = ((struct ebt_standard_target *)t)->verdict;
797 if (verdict >= 0) { /* jump to another chain */
798 struct ebt_entries *hlp2 =
799 (struct ebt_entries *)(base + verdict);
800 for (i = 0; i < udc_cnt; i++)
801 if (hlp2 == cl_s[i].cs.chaininfo)
802 break;
803 /* bad destination or loop */
804 if (i == udc_cnt) {
805 BUGPRINT("bad destination\n");
806 return -1;
807 }
808 if (cl_s[i].cs.n) {
809 BUGPRINT("loop\n");
810 return -1;
811 }
812 if (cl_s[i].hookmask & (1 << hooknr))
813 goto letscontinue;
814 /* this can't be 0, so the loop test is correct */
815 cl_s[i].cs.n = pos + 1;
816 pos = 0;
817 cl_s[i].cs.e = ebt_next_entry(e);
818 e = (struct ebt_entry *)(hlp2->data);
819 nentries = hlp2->nentries;
820 cl_s[i].from = chain_nr;
821 chain_nr = i;
822 /* this udc is accessible from the base chain for hooknr */
823 cl_s[i].hookmask |= (1 << hooknr);
824 continue;
825 }
826 letscontinue:
827 e = ebt_next_entry(e);
828 pos++;
829 }
830 return 0;
831 }
832
833 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
834 static int translate_table(struct net *net, const char *name,
835 struct ebt_table_info *newinfo)
836 {
837 unsigned int i, j, k, udc_cnt;
838 int ret;
839 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
840
841 i = 0;
842 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
843 i++;
844 if (i == NF_BR_NUMHOOKS) {
845 BUGPRINT("No valid hooks specified\n");
846 return -EINVAL;
847 }
848 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
849 BUGPRINT("Chains don't start at beginning\n");
850 return -EINVAL;
851 }
852 /* make sure chains are ordered after each other in same order
853 as their corresponding hooks */
854 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
855 if (!newinfo->hook_entry[j])
856 continue;
857 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
858 BUGPRINT("Hook order must be followed\n");
859 return -EINVAL;
860 }
861 i = j;
862 }
863
864 /* do some early checkings and initialize some things */
865 i = 0; /* holds the expected nr. of entries for the chain */
866 j = 0; /* holds the up to now counted entries for the chain */
867 k = 0; /* holds the total nr. of entries, should equal
868 newinfo->nentries afterwards */
869 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
870 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
871 ebt_check_entry_size_and_hooks, newinfo,
872 &i, &j, &k, &udc_cnt);
873
874 if (ret != 0)
875 return ret;
876
877 if (i != j) {
878 BUGPRINT("nentries does not equal the nr of entries in the "
879 "(last) chain\n");
880 return -EINVAL;
881 }
882 if (k != newinfo->nentries) {
883 BUGPRINT("Total nentries is wrong\n");
884 return -EINVAL;
885 }
886
887 /* get the location of the udc, put them in an array
888 while we're at it, allocate the chainstack */
889 if (udc_cnt) {
890 /* this will get free'd in do_replace()/ebt_register_table()
891 if an error occurs */
892 newinfo->chainstack =
893 vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
894 if (!newinfo->chainstack)
895 return -ENOMEM;
896 for_each_possible_cpu(i) {
897 newinfo->chainstack[i] =
898 vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
899 if (!newinfo->chainstack[i]) {
900 while (i)
901 vfree(newinfo->chainstack[--i]);
902 vfree(newinfo->chainstack);
903 newinfo->chainstack = NULL;
904 return -ENOMEM;
905 }
906 }
907
908 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
909 if (!cl_s)
910 return -ENOMEM;
911 i = 0; /* the i'th udc */
912 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
913 ebt_get_udc_positions, newinfo, &i, cl_s);
914 /* sanity check */
915 if (i != udc_cnt) {
916 BUGPRINT("i != udc_cnt\n");
917 vfree(cl_s);
918 return -EFAULT;
919 }
920 }
921
922 /* Check for loops */
923 for (i = 0; i < NF_BR_NUMHOOKS; i++)
924 if (newinfo->hook_entry[i])
925 if (check_chainloops(newinfo->hook_entry[i],
926 cl_s, udc_cnt, i, newinfo->entries)) {
927 vfree(cl_s);
928 return -EINVAL;
929 }
930
931 /* we now know the following (along with E=mc²):
932 - the nr of entries in each chain is right
933 - the size of the allocated space is right
934 - all valid hooks have a corresponding chain
935 - there are no loops
936 - wrong data can still be on the level of a single entry
937 - could be there are jumps to places that are not the
938 beginning of a chain. This can only occur in chains that
939 are not accessible from any base chains, so we don't care. */
940
941 /* used to know what we need to clean up if something goes wrong */
942 i = 0;
943 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
944 ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
945 if (ret != 0) {
946 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
947 ebt_cleanup_entry, net, &i);
948 }
949 vfree(cl_s);
950 return ret;
951 }
952
953 /* called under write_lock */
954 static void get_counters(const struct ebt_counter *oldcounters,
955 struct ebt_counter *counters, unsigned int nentries)
956 {
957 int i, cpu;
958 struct ebt_counter *counter_base;
959
960 /* counters of cpu 0 */
961 memcpy(counters, oldcounters,
962 sizeof(struct ebt_counter) * nentries);
963
964 /* add other counters to those of cpu 0 */
965 for_each_possible_cpu(cpu) {
966 if (cpu == 0)
967 continue;
968 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
969 for (i = 0; i < nentries; i++) {
970 counters[i].pcnt += counter_base[i].pcnt;
971 counters[i].bcnt += counter_base[i].bcnt;
972 }
973 }
974 }
975
976 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
977 struct ebt_table_info *newinfo)
978 {
979 int ret, i;
980 struct ebt_counter *counterstmp = NULL;
981 /* used to be able to unlock earlier */
982 struct ebt_table_info *table;
983 struct ebt_table *t;
984
985 /* the user wants counters back
986 the check on the size is done later, when we have the lock */
987 if (repl->num_counters) {
988 unsigned long size = repl->num_counters * sizeof(*counterstmp);
989 counterstmp = vmalloc(size);
990 if (!counterstmp)
991 return -ENOMEM;
992 }
993
994 newinfo->chainstack = NULL;
995 ret = ebt_verify_pointers(repl, newinfo);
996 if (ret != 0)
997 goto free_counterstmp;
998
999 ret = translate_table(net, repl->name, newinfo);
1000
1001 if (ret != 0)
1002 goto free_counterstmp;
1003
1004 t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1005 if (!t) {
1006 ret = -ENOENT;
1007 goto free_iterate;
1008 }
1009
1010 /* the table doesn't like it */
1011 if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1012 goto free_unlock;
1013
1014 if (repl->num_counters && repl->num_counters != t->private->nentries) {
1015 BUGPRINT("Wrong nr. of counters requested\n");
1016 ret = -EINVAL;
1017 goto free_unlock;
1018 }
1019
1020 /* we have the mutex lock, so no danger in reading this pointer */
1021 table = t->private;
1022 /* make sure the table can only be rmmod'ed if it contains no rules */
1023 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1024 ret = -ENOENT;
1025 goto free_unlock;
1026 } else if (table->nentries && !newinfo->nentries)
1027 module_put(t->me);
1028 /* we need an atomic snapshot of the counters */
1029 write_lock_bh(&t->lock);
1030 if (repl->num_counters)
1031 get_counters(t->private->counters, counterstmp,
1032 t->private->nentries);
1033
1034 t->private = newinfo;
1035 write_unlock_bh(&t->lock);
1036 mutex_unlock(&ebt_mutex);
1037 /* so, a user can change the chains while having messed up her counter
1038 allocation. Only reason why this is done is because this way the lock
1039 is held only once, while this doesn't bring the kernel into a
1040 dangerous state. */
1041 if (repl->num_counters &&
1042 copy_to_user(repl->counters, counterstmp,
1043 repl->num_counters * sizeof(struct ebt_counter))) {
1044 /* Silent error, can't fail, new table is already in place */
1045 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
1046 }
1047
1048 /* decrease module count and free resources */
1049 EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1050 ebt_cleanup_entry, net, NULL);
1051
1052 vfree(table->entries);
1053 if (table->chainstack) {
1054 for_each_possible_cpu(i)
1055 vfree(table->chainstack[i]);
1056 vfree(table->chainstack);
1057 }
1058 vfree(table);
1059
1060 vfree(counterstmp);
1061 return ret;
1062
1063 free_unlock:
1064 mutex_unlock(&ebt_mutex);
1065 free_iterate:
1066 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1067 ebt_cleanup_entry, net, NULL);
1068 free_counterstmp:
1069 vfree(counterstmp);
1070 /* can be initialized in translate_table() */
1071 if (newinfo->chainstack) {
1072 for_each_possible_cpu(i)
1073 vfree(newinfo->chainstack[i]);
1074 vfree(newinfo->chainstack);
1075 }
1076 return ret;
1077 }
1078
1079 /* replace the table */
1080 static int do_replace(struct net *net, const void __user *user,
1081 unsigned int len)
1082 {
1083 int ret, countersize;
1084 struct ebt_table_info *newinfo;
1085 struct ebt_replace tmp;
1086
1087 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1088 return -EFAULT;
1089
1090 if (len != sizeof(tmp) + tmp.entries_size) {
1091 BUGPRINT("Wrong len argument\n");
1092 return -EINVAL;
1093 }
1094
1095 if (tmp.entries_size == 0) {
1096 BUGPRINT("Entries_size never zero\n");
1097 return -EINVAL;
1098 }
1099 /* overflow check */
1100 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1101 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1102 return -ENOMEM;
1103 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1104 return -ENOMEM;
1105
1106 tmp.name[sizeof(tmp.name) - 1] = 0;
1107
1108 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1109 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1110 if (!newinfo)
1111 return -ENOMEM;
1112
1113 if (countersize)
1114 memset(newinfo->counters, 0, countersize);
1115
1116 newinfo->entries = vmalloc(tmp.entries_size);
1117 if (!newinfo->entries) {
1118 ret = -ENOMEM;
1119 goto free_newinfo;
1120 }
1121 if (copy_from_user(
1122 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1123 BUGPRINT("Couldn't copy entries from userspace\n");
1124 ret = -EFAULT;
1125 goto free_entries;
1126 }
1127
1128 ret = do_replace_finish(net, &tmp, newinfo);
1129 if (ret == 0)
1130 return ret;
1131 free_entries:
1132 vfree(newinfo->entries);
1133 free_newinfo:
1134 vfree(newinfo);
1135 return ret;
1136 }
1137
1138 struct ebt_table *
1139 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1140 {
1141 struct ebt_table_info *newinfo;
1142 struct ebt_table *t, *table;
1143 struct ebt_replace_kernel *repl;
1144 int ret, i, countersize;
1145 void *p;
1146
1147 if (input_table == NULL || (repl = input_table->table) == NULL ||
1148 repl->entries == NULL || repl->entries_size == 0 ||
1149 repl->counters != NULL || input_table->private != NULL) {
1150 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1151 return ERR_PTR(-EINVAL);
1152 }
1153
1154 /* Don't add one table to multiple lists. */
1155 table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1156 if (!table) {
1157 ret = -ENOMEM;
1158 goto out;
1159 }
1160
1161 countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1162 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1163 ret = -ENOMEM;
1164 if (!newinfo)
1165 goto free_table;
1166
1167 p = vmalloc(repl->entries_size);
1168 if (!p)
1169 goto free_newinfo;
1170
1171 memcpy(p, repl->entries, repl->entries_size);
1172 newinfo->entries = p;
1173
1174 newinfo->entries_size = repl->entries_size;
1175 newinfo->nentries = repl->nentries;
1176
1177 if (countersize)
1178 memset(newinfo->counters, 0, countersize);
1179
1180 /* fill in newinfo and parse the entries */
1181 newinfo->chainstack = NULL;
1182 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1183 if ((repl->valid_hooks & (1 << i)) == 0)
1184 newinfo->hook_entry[i] = NULL;
1185 else
1186 newinfo->hook_entry[i] = p +
1187 ((char *)repl->hook_entry[i] - repl->entries);
1188 }
1189 ret = translate_table(net, repl->name, newinfo);
1190 if (ret != 0) {
1191 BUGPRINT("Translate_table failed\n");
1192 goto free_chainstack;
1193 }
1194
1195 if (table->check && table->check(newinfo, table->valid_hooks)) {
1196 BUGPRINT("The table doesn't like its own initial data, lol\n");
1197 ret = -EINVAL;
1198 goto free_chainstack;
1199 }
1200
1201 table->private = newinfo;
1202 rwlock_init(&table->lock);
1203 mutex_lock(&ebt_mutex);
1204 list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1205 if (strcmp(t->name, table->name) == 0) {
1206 ret = -EEXIST;
1207 BUGPRINT("Table name already exists\n");
1208 goto free_unlock;
1209 }
1210 }
1211
1212 /* Hold a reference count if the chains aren't empty */
1213 if (newinfo->nentries && !try_module_get(table->me)) {
1214 ret = -ENOENT;
1215 goto free_unlock;
1216 }
1217 list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1218 mutex_unlock(&ebt_mutex);
1219 return table;
1220 free_unlock:
1221 mutex_unlock(&ebt_mutex);
1222 free_chainstack:
1223 if (newinfo->chainstack) {
1224 for_each_possible_cpu(i)
1225 vfree(newinfo->chainstack[i]);
1226 vfree(newinfo->chainstack);
1227 }
1228 vfree(newinfo->entries);
1229 free_newinfo:
1230 vfree(newinfo);
1231 free_table:
1232 kfree(table);
1233 out:
1234 return ERR_PTR(ret);
1235 }
1236
1237 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1238 {
1239 int i;
1240
1241 if (!table) {
1242 BUGPRINT("Request to unregister NULL table!!!\n");
1243 return;
1244 }
1245 mutex_lock(&ebt_mutex);
1246 list_del(&table->list);
1247 mutex_unlock(&ebt_mutex);
1248 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1249 ebt_cleanup_entry, net, NULL);
1250 if (table->private->nentries)
1251 module_put(table->me);
1252 vfree(table->private->entries);
1253 if (table->private->chainstack) {
1254 for_each_possible_cpu(i)
1255 vfree(table->private->chainstack[i]);
1256 vfree(table->private->chainstack);
1257 }
1258 vfree(table->private);
1259 kfree(table);
1260 }
1261
1262 /* userspace just supplied us with counters */
1263 static int do_update_counters(struct net *net, const char *name,
1264 struct ebt_counter __user *counters,
1265 unsigned int num_counters,
1266 const void __user *user, unsigned int len)
1267 {
1268 int i, ret;
1269 struct ebt_counter *tmp;
1270 struct ebt_table *t;
1271
1272 if (num_counters == 0)
1273 return -EINVAL;
1274
1275 tmp = vmalloc(num_counters * sizeof(*tmp));
1276 if (!tmp)
1277 return -ENOMEM;
1278
1279 t = find_table_lock(net, name, &ret, &ebt_mutex);
1280 if (!t)
1281 goto free_tmp;
1282
1283 if (num_counters != t->private->nentries) {
1284 BUGPRINT("Wrong nr of counters\n");
1285 ret = -EINVAL;
1286 goto unlock_mutex;
1287 }
1288
1289 if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1290 ret = -EFAULT;
1291 goto unlock_mutex;
1292 }
1293
1294 /* we want an atomic add of the counters */
1295 write_lock_bh(&t->lock);
1296
1297 /* we add to the counters of the first cpu */
1298 for (i = 0; i < num_counters; i++) {
1299 t->private->counters[i].pcnt += tmp[i].pcnt;
1300 t->private->counters[i].bcnt += tmp[i].bcnt;
1301 }
1302
1303 write_unlock_bh(&t->lock);
1304 ret = 0;
1305 unlock_mutex:
1306 mutex_unlock(&ebt_mutex);
1307 free_tmp:
1308 vfree(tmp);
1309 return ret;
1310 }
1311
1312 static int update_counters(struct net *net, const void __user *user,
1313 unsigned int len)
1314 {
1315 struct ebt_replace hlp;
1316
1317 if (copy_from_user(&hlp, user, sizeof(hlp)))
1318 return -EFAULT;
1319
1320 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1321 return -EINVAL;
1322
1323 return do_update_counters(net, hlp.name, hlp.counters,
1324 hlp.num_counters, user, len);
1325 }
1326
1327 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1328 const char *base, char __user *ubase)
1329 {
1330 char __user *hlp = ubase + ((char *)m - base);
1331 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1332
1333 /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
1334 long. Copy 29 bytes and fill remaining bytes with zeroes. */
1335 strlcpy(name, m->u.match->name, sizeof(name));
1336 if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1337 return -EFAULT;
1338 return 0;
1339 }
1340
1341 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1342 const char *base, char __user *ubase)
1343 {
1344 char __user *hlp = ubase + ((char *)w - base);
1345 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1346
1347 strlcpy(name, w->u.watcher->name, sizeof(name));
1348 if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
1349 return -EFAULT;
1350 return 0;
1351 }
1352
1353 static inline int
1354 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1355 {
1356 int ret;
1357 char __user *hlp;
1358 const struct ebt_entry_target *t;
1359 char name[EBT_FUNCTION_MAXNAMELEN] = {};
1360
1361 if (e->bitmask == 0)
1362 return 0;
1363
1364 hlp = ubase + (((char *)e + e->target_offset) - base);
1365 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1366
1367 ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1368 if (ret != 0)
1369 return ret;
1370 ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1371 if (ret != 0)
1372 return ret;
1373 strlcpy(name, t->u.target->name, sizeof(name));
1374 if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1375 return -EFAULT;
1376 return 0;
1377 }
1378
1379 static int copy_counters_to_user(struct ebt_table *t,
1380 const struct ebt_counter *oldcounters,
1381 void __user *user, unsigned int num_counters,
1382 unsigned int nentries)
1383 {
1384 struct ebt_counter *counterstmp;
1385 int ret = 0;
1386
1387 /* userspace might not need the counters */
1388 if (num_counters == 0)
1389 return 0;
1390
1391 if (num_counters != nentries) {
1392 BUGPRINT("Num_counters wrong\n");
1393 return -EINVAL;
1394 }
1395
1396 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1397 if (!counterstmp)
1398 return -ENOMEM;
1399
1400 write_lock_bh(&t->lock);
1401 get_counters(oldcounters, counterstmp, nentries);
1402 write_unlock_bh(&t->lock);
1403
1404 if (copy_to_user(user, counterstmp,
1405 nentries * sizeof(struct ebt_counter)))
1406 ret = -EFAULT;
1407 vfree(counterstmp);
1408 return ret;
1409 }
1410
1411 /* called with ebt_mutex locked */
1412 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1413 const int *len, int cmd)
1414 {
1415 struct ebt_replace tmp;
1416 const struct ebt_counter *oldcounters;
1417 unsigned int entries_size, nentries;
1418 int ret;
1419 char *entries;
1420
1421 if (cmd == EBT_SO_GET_ENTRIES) {
1422 entries_size = t->private->entries_size;
1423 nentries = t->private->nentries;
1424 entries = t->private->entries;
1425 oldcounters = t->private->counters;
1426 } else {
1427 entries_size = t->table->entries_size;
1428 nentries = t->table->nentries;
1429 entries = t->table->entries;
1430 oldcounters = t->table->counters;
1431 }
1432
1433 if (copy_from_user(&tmp, user, sizeof(tmp)))
1434 return -EFAULT;
1435
1436 if (*len != sizeof(struct ebt_replace) + entries_size +
1437 (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
1438 return -EINVAL;
1439
1440 if (tmp.nentries != nentries) {
1441 BUGPRINT("Nentries wrong\n");
1442 return -EINVAL;
1443 }
1444
1445 if (tmp.entries_size != entries_size) {
1446 BUGPRINT("Wrong size\n");
1447 return -EINVAL;
1448 }
1449
1450 ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1451 tmp.num_counters, nentries);
1452 if (ret)
1453 return ret;
1454
1455 if (copy_to_user(tmp.entries, entries, entries_size)) {
1456 BUGPRINT("Couldn't copy entries to userspace\n");
1457 return -EFAULT;
1458 }
1459 /* set the match/watcher/target names right */
1460 return EBT_ENTRY_ITERATE(entries, entries_size,
1461 ebt_make_names, entries, tmp.entries);
1462 }
1463
1464 static int do_ebt_set_ctl(struct sock *sk,
1465 int cmd, void __user *user, unsigned int len)
1466 {
1467 int ret;
1468 struct net *net = sock_net(sk);
1469
1470 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1471 return -EPERM;
1472
1473 switch (cmd) {
1474 case EBT_SO_SET_ENTRIES:
1475 ret = do_replace(net, user, len);
1476 break;
1477 case EBT_SO_SET_COUNTERS:
1478 ret = update_counters(net, user, len);
1479 break;
1480 default:
1481 ret = -EINVAL;
1482 }
1483 return ret;
1484 }
1485
1486 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1487 {
1488 int ret;
1489 struct ebt_replace tmp;
1490 struct ebt_table *t;
1491 struct net *net = sock_net(sk);
1492
1493 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1494 return -EPERM;
1495
1496 if (copy_from_user(&tmp, user, sizeof(tmp)))
1497 return -EFAULT;
1498
1499 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1500 if (!t)
1501 return ret;
1502
1503 switch (cmd) {
1504 case EBT_SO_GET_INFO:
1505 case EBT_SO_GET_INIT_INFO:
1506 if (*len != sizeof(struct ebt_replace)) {
1507 ret = -EINVAL;
1508 mutex_unlock(&ebt_mutex);
1509 break;
1510 }
1511 if (cmd == EBT_SO_GET_INFO) {
1512 tmp.nentries = t->private->nentries;
1513 tmp.entries_size = t->private->entries_size;
1514 tmp.valid_hooks = t->valid_hooks;
1515 } else {
1516 tmp.nentries = t->table->nentries;
1517 tmp.entries_size = t->table->entries_size;
1518 tmp.valid_hooks = t->table->valid_hooks;
1519 }
1520 mutex_unlock(&ebt_mutex);
1521 if (copy_to_user(user, &tmp, *len) != 0) {
1522 BUGPRINT("c2u Didn't work\n");
1523 ret = -EFAULT;
1524 break;
1525 }
1526 ret = 0;
1527 break;
1528
1529 case EBT_SO_GET_ENTRIES:
1530 case EBT_SO_GET_INIT_ENTRIES:
1531 ret = copy_everything_to_user(t, user, len, cmd);
1532 mutex_unlock(&ebt_mutex);
1533 break;
1534
1535 default:
1536 mutex_unlock(&ebt_mutex);
1537 ret = -EINVAL;
1538 }
1539
1540 return ret;
1541 }
1542
1543 #ifdef CONFIG_COMPAT
1544 /* 32 bit-userspace compatibility definitions. */
1545 struct compat_ebt_replace {
1546 char name[EBT_TABLE_MAXNAMELEN];
1547 compat_uint_t valid_hooks;
1548 compat_uint_t nentries;
1549 compat_uint_t entries_size;
1550 /* start of the chains */
1551 compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1552 /* nr of counters userspace expects back */
1553 compat_uint_t num_counters;
1554 /* where the kernel will put the old counters. */
1555 compat_uptr_t counters;
1556 compat_uptr_t entries;
1557 };
1558
1559 /* struct ebt_entry_match, _target and _watcher have same layout */
1560 struct compat_ebt_entry_mwt {
1561 union {
1562 char name[EBT_FUNCTION_MAXNAMELEN];
1563 compat_uptr_t ptr;
1564 } u;
1565 compat_uint_t match_size;
1566 compat_uint_t data[0];
1567 };
1568
1569 /* account for possible padding between match_size and ->data */
1570 static int ebt_compat_entry_padsize(void)
1571 {
1572 BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1573 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1574 return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1575 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1576 }
1577
1578 static int ebt_compat_match_offset(const struct xt_match *match,
1579 unsigned int userlen)
1580 {
1581 /*
1582 * ebt_among needs special handling. The kernel .matchsize is
1583 * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1584 * value is expected.
1585 * Example: userspace sends 4500, ebt_among.c wants 4504.
1586 */
1587 if (unlikely(match->matchsize == -1))
1588 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1589 return xt_compat_match_offset(match);
1590 }
1591
1592 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1593 unsigned int *size)
1594 {
1595 const struct xt_match *match = m->u.match;
1596 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1597 int off = ebt_compat_match_offset(match, m->match_size);
1598 compat_uint_t msize = m->match_size - off;
1599
1600 BUG_ON(off >= m->match_size);
1601
1602 if (copy_to_user(cm->u.name, match->name,
1603 strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1604 return -EFAULT;
1605
1606 if (match->compat_to_user) {
1607 if (match->compat_to_user(cm->data, m->data))
1608 return -EFAULT;
1609 } else if (copy_to_user(cm->data, m->data, msize))
1610 return -EFAULT;
1611
1612 *size -= ebt_compat_entry_padsize() + off;
1613 *dstptr = cm->data;
1614 *dstptr += msize;
1615 return 0;
1616 }
1617
1618 static int compat_target_to_user(struct ebt_entry_target *t,
1619 void __user **dstptr,
1620 unsigned int *size)
1621 {
1622 const struct xt_target *target = t->u.target;
1623 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1624 int off = xt_compat_target_offset(target);
1625 compat_uint_t tsize = t->target_size - off;
1626
1627 BUG_ON(off >= t->target_size);
1628
1629 if (copy_to_user(cm->u.name, target->name,
1630 strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1631 return -EFAULT;
1632
1633 if (target->compat_to_user) {
1634 if (target->compat_to_user(cm->data, t->data))
1635 return -EFAULT;
1636 } else if (copy_to_user(cm->data, t->data, tsize))
1637 return -EFAULT;
1638
1639 *size -= ebt_compat_entry_padsize() + off;
1640 *dstptr = cm->data;
1641 *dstptr += tsize;
1642 return 0;
1643 }
1644
1645 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1646 void __user **dstptr,
1647 unsigned int *size)
1648 {
1649 return compat_target_to_user((struct ebt_entry_target *)w,
1650 dstptr, size);
1651 }
1652
1653 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1654 unsigned int *size)
1655 {
1656 struct ebt_entry_target *t;
1657 struct ebt_entry __user *ce;
1658 u32 watchers_offset, target_offset, next_offset;
1659 compat_uint_t origsize;
1660 int ret;
1661
1662 if (e->bitmask == 0) {
1663 if (*size < sizeof(struct ebt_entries))
1664 return -EINVAL;
1665 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1666 return -EFAULT;
1667
1668 *dstptr += sizeof(struct ebt_entries);
1669 *size -= sizeof(struct ebt_entries);
1670 return 0;
1671 }
1672
1673 if (*size < sizeof(*ce))
1674 return -EINVAL;
1675
1676 ce = (struct ebt_entry __user *)*dstptr;
1677 if (copy_to_user(ce, e, sizeof(*ce)))
1678 return -EFAULT;
1679
1680 origsize = *size;
1681 *dstptr += sizeof(*ce);
1682
1683 ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1684 if (ret)
1685 return ret;
1686 watchers_offset = e->watchers_offset - (origsize - *size);
1687
1688 ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1689 if (ret)
1690 return ret;
1691 target_offset = e->target_offset - (origsize - *size);
1692
1693 t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1694
1695 ret = compat_target_to_user(t, dstptr, size);
1696 if (ret)
1697 return ret;
1698 next_offset = e->next_offset - (origsize - *size);
1699
1700 if (put_user(watchers_offset, &ce->watchers_offset) ||
1701 put_user(target_offset, &ce->target_offset) ||
1702 put_user(next_offset, &ce->next_offset))
1703 return -EFAULT;
1704
1705 *size -= sizeof(*ce);
1706 return 0;
1707 }
1708
1709 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1710 {
1711 *off += ebt_compat_match_offset(m->u.match, m->match_size);
1712 *off += ebt_compat_entry_padsize();
1713 return 0;
1714 }
1715
1716 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1717 {
1718 *off += xt_compat_target_offset(w->u.watcher);
1719 *off += ebt_compat_entry_padsize();
1720 return 0;
1721 }
1722
1723 static int compat_calc_entry(const struct ebt_entry *e,
1724 const struct ebt_table_info *info,
1725 const void *base,
1726 struct compat_ebt_replace *newinfo)
1727 {
1728 const struct ebt_entry_target *t;
1729 unsigned int entry_offset;
1730 int off, ret, i;
1731
1732 if (e->bitmask == 0)
1733 return 0;
1734
1735 off = 0;
1736 entry_offset = (void *)e - base;
1737
1738 EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1739 EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1740
1741 t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1742
1743 off += xt_compat_target_offset(t->u.target);
1744 off += ebt_compat_entry_padsize();
1745
1746 newinfo->entries_size -= off;
1747
1748 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1749 if (ret)
1750 return ret;
1751
1752 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1753 const void *hookptr = info->hook_entry[i];
1754 if (info->hook_entry[i] &&
1755 (e < (struct ebt_entry *)(base - hookptr))) {
1756 newinfo->hook_entry[i] -= off;
1757 pr_debug("0x%08X -> 0x%08X\n",
1758 newinfo->hook_entry[i] + off,
1759 newinfo->hook_entry[i]);
1760 }
1761 }
1762
1763 return 0;
1764 }
1765
1766
1767 static int compat_table_info(const struct ebt_table_info *info,
1768 struct compat_ebt_replace *newinfo)
1769 {
1770 unsigned int size = info->entries_size;
1771 const void *entries = info->entries;
1772
1773 newinfo->entries_size = size;
1774
1775 xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
1776 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1777 entries, newinfo);
1778 }
1779
1780 static int compat_copy_everything_to_user(struct ebt_table *t,
1781 void __user *user, int *len, int cmd)
1782 {
1783 struct compat_ebt_replace repl, tmp;
1784 struct ebt_counter *oldcounters;
1785 struct ebt_table_info tinfo;
1786 int ret;
1787 void __user *pos;
1788
1789 memset(&tinfo, 0, sizeof(tinfo));
1790
1791 if (cmd == EBT_SO_GET_ENTRIES) {
1792 tinfo.entries_size = t->private->entries_size;
1793 tinfo.nentries = t->private->nentries;
1794 tinfo.entries = t->private->entries;
1795 oldcounters = t->private->counters;
1796 } else {
1797 tinfo.entries_size = t->table->entries_size;
1798 tinfo.nentries = t->table->nentries;
1799 tinfo.entries = t->table->entries;
1800 oldcounters = t->table->counters;
1801 }
1802
1803 if (copy_from_user(&tmp, user, sizeof(tmp)))
1804 return -EFAULT;
1805
1806 if (tmp.nentries != tinfo.nentries ||
1807 (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1808 return -EINVAL;
1809
1810 memcpy(&repl, &tmp, sizeof(repl));
1811 if (cmd == EBT_SO_GET_ENTRIES)
1812 ret = compat_table_info(t->private, &repl);
1813 else
1814 ret = compat_table_info(&tinfo, &repl);
1815 if (ret)
1816 return ret;
1817
1818 if (*len != sizeof(tmp) + repl.entries_size +
1819 (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1820 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1821 *len, tinfo.entries_size, repl.entries_size);
1822 return -EINVAL;
1823 }
1824
1825 /* userspace might not need the counters */
1826 ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1827 tmp.num_counters, tinfo.nentries);
1828 if (ret)
1829 return ret;
1830
1831 pos = compat_ptr(tmp.entries);
1832 return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1833 compat_copy_entry_to_user, &pos, &tmp.entries_size);
1834 }
1835
1836 struct ebt_entries_buf_state {
1837 char *buf_kern_start; /* kernel buffer to copy (translated) data to */
1838 u32 buf_kern_len; /* total size of kernel buffer */
1839 u32 buf_kern_offset; /* amount of data copied so far */
1840 u32 buf_user_offset; /* read position in userspace buffer */
1841 };
1842
1843 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1844 {
1845 state->buf_kern_offset += sz;
1846 return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1847 }
1848
1849 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1850 void *data, unsigned int sz)
1851 {
1852 if (state->buf_kern_start == NULL)
1853 goto count_only;
1854
1855 BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1856
1857 memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1858
1859 count_only:
1860 state->buf_user_offset += sz;
1861 return ebt_buf_count(state, sz);
1862 }
1863
1864 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1865 {
1866 char *b = state->buf_kern_start;
1867
1868 BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1869
1870 if (b != NULL && sz > 0)
1871 memset(b + state->buf_kern_offset, 0, sz);
1872 /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1873 return ebt_buf_count(state, sz);
1874 }
1875
1876 enum compat_mwt {
1877 EBT_COMPAT_MATCH,
1878 EBT_COMPAT_WATCHER,
1879 EBT_COMPAT_TARGET,
1880 };
1881
1882 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1883 enum compat_mwt compat_mwt,
1884 struct ebt_entries_buf_state *state,
1885 const unsigned char *base)
1886 {
1887 char name[EBT_FUNCTION_MAXNAMELEN];
1888 struct xt_match *match;
1889 struct xt_target *wt;
1890 void *dst = NULL;
1891 int off, pad = 0;
1892 unsigned int size_kern, match_size = mwt->match_size;
1893
1894 strlcpy(name, mwt->u.name, sizeof(name));
1895
1896 if (state->buf_kern_start)
1897 dst = state->buf_kern_start + state->buf_kern_offset;
1898
1899 switch (compat_mwt) {
1900 case EBT_COMPAT_MATCH:
1901 match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
1902 if (IS_ERR(match))
1903 return PTR_ERR(match);
1904
1905 off = ebt_compat_match_offset(match, match_size);
1906 if (dst) {
1907 if (match->compat_from_user)
1908 match->compat_from_user(dst, mwt->data);
1909 else
1910 memcpy(dst, mwt->data, match_size);
1911 }
1912
1913 size_kern = match->matchsize;
1914 if (unlikely(size_kern == -1))
1915 size_kern = match_size;
1916 module_put(match->me);
1917 break;
1918 case EBT_COMPAT_WATCHER: /* fallthrough */
1919 case EBT_COMPAT_TARGET:
1920 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
1921 if (IS_ERR(wt))
1922 return PTR_ERR(wt);
1923 off = xt_compat_target_offset(wt);
1924
1925 if (dst) {
1926 if (wt->compat_from_user)
1927 wt->compat_from_user(dst, mwt->data);
1928 else
1929 memcpy(dst, mwt->data, match_size);
1930 }
1931
1932 size_kern = wt->targetsize;
1933 module_put(wt->me);
1934 break;
1935
1936 default:
1937 return -EINVAL;
1938 }
1939
1940 state->buf_kern_offset += match_size + off;
1941 state->buf_user_offset += match_size;
1942 pad = XT_ALIGN(size_kern) - size_kern;
1943
1944 if (pad > 0 && dst) {
1945 BUG_ON(state->buf_kern_len <= pad);
1946 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1947 memset(dst + size_kern, 0, pad);
1948 }
1949 return off + match_size;
1950 }
1951
1952 /*
1953 * return size of all matches, watchers or target, including necessary
1954 * alignment and padding.
1955 */
1956 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1957 unsigned int size_left, enum compat_mwt type,
1958 struct ebt_entries_buf_state *state, const void *base)
1959 {
1960 int growth = 0;
1961 char *buf;
1962
1963 if (size_left == 0)
1964 return 0;
1965
1966 buf = (char *) match32;
1967
1968 while (size_left >= sizeof(*match32)) {
1969 struct ebt_entry_match *match_kern;
1970 int ret;
1971
1972 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1973 if (match_kern) {
1974 char *tmp;
1975 tmp = state->buf_kern_start + state->buf_kern_offset;
1976 match_kern = (struct ebt_entry_match *) tmp;
1977 }
1978 ret = ebt_buf_add(state, buf, sizeof(*match32));
1979 if (ret < 0)
1980 return ret;
1981 size_left -= sizeof(*match32);
1982
1983 /* add padding before match->data (if any) */
1984 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1985 if (ret < 0)
1986 return ret;
1987
1988 if (match32->match_size > size_left)
1989 return -EINVAL;
1990
1991 size_left -= match32->match_size;
1992
1993 ret = compat_mtw_from_user(match32, type, state, base);
1994 if (ret < 0)
1995 return ret;
1996
1997 BUG_ON(ret < match32->match_size);
1998 growth += ret - match32->match_size;
1999 growth += ebt_compat_entry_padsize();
2000
2001 buf += sizeof(*match32);
2002 buf += match32->match_size;
2003
2004 if (match_kern)
2005 match_kern->match_size = ret;
2006
2007 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2008 match32 = (struct compat_ebt_entry_mwt *) buf;
2009 }
2010
2011 return growth;
2012 }
2013
2014 /* called for all ebt_entry structures. */
2015 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2016 unsigned int *total,
2017 struct ebt_entries_buf_state *state)
2018 {
2019 unsigned int i, j, startoff, new_offset = 0;
2020 /* stores match/watchers/targets & offset of next struct ebt_entry: */
2021 unsigned int offsets[4];
2022 unsigned int *offsets_update = NULL;
2023 int ret;
2024 char *buf_start;
2025
2026 if (*total < sizeof(struct ebt_entries))
2027 return -EINVAL;
2028
2029 if (!entry->bitmask) {
2030 *total -= sizeof(struct ebt_entries);
2031 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2032 }
2033 if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2034 return -EINVAL;
2035
2036 startoff = state->buf_user_offset;
2037 /* pull in most part of ebt_entry, it does not need to be changed. */
2038 ret = ebt_buf_add(state, entry,
2039 offsetof(struct ebt_entry, watchers_offset));
2040 if (ret < 0)
2041 return ret;
2042
2043 offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2044 memcpy(&offsets[1], &entry->watchers_offset,
2045 sizeof(offsets) - sizeof(offsets[0]));
2046
2047 if (state->buf_kern_start) {
2048 buf_start = state->buf_kern_start + state->buf_kern_offset;
2049 offsets_update = (unsigned int *) buf_start;
2050 }
2051 ret = ebt_buf_add(state, &offsets[1],
2052 sizeof(offsets) - sizeof(offsets[0]));
2053 if (ret < 0)
2054 return ret;
2055 buf_start = (char *) entry;
2056 /*
2057 * 0: matches offset, always follows ebt_entry.
2058 * 1: watchers offset, from ebt_entry structure
2059 * 2: target offset, from ebt_entry structure
2060 * 3: next ebt_entry offset, from ebt_entry structure
2061 *
2062 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2063 */
2064 for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2065 struct compat_ebt_entry_mwt *match32;
2066 unsigned int size;
2067 char *buf = buf_start;
2068
2069 buf = buf_start + offsets[i];
2070 if (offsets[i] > offsets[j])
2071 return -EINVAL;
2072
2073 match32 = (struct compat_ebt_entry_mwt *) buf;
2074 size = offsets[j] - offsets[i];
2075 ret = ebt_size_mwt(match32, size, i, state, base);
2076 if (ret < 0)
2077 return ret;
2078 new_offset += ret;
2079 if (offsets_update && new_offset) {
2080 pr_debug("change offset %d to %d\n",
2081 offsets_update[i], offsets[j] + new_offset);
2082 offsets_update[i] = offsets[j] + new_offset;
2083 }
2084 }
2085
2086 if (state->buf_kern_start == NULL) {
2087 unsigned int offset = buf_start - (char *) base;
2088
2089 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
2090 if (ret < 0)
2091 return ret;
2092 }
2093
2094 startoff = state->buf_user_offset - startoff;
2095
2096 BUG_ON(*total < startoff);
2097 *total -= startoff;
2098 return 0;
2099 }
2100
2101 /*
2102 * repl->entries_size is the size of the ebt_entry blob in userspace.
2103 * It might need more memory when copied to a 64 bit kernel in case
2104 * userspace is 32-bit. So, first task: find out how much memory is needed.
2105 *
2106 * Called before validation is performed.
2107 */
2108 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2109 struct ebt_entries_buf_state *state)
2110 {
2111 unsigned int size_remaining = size_user;
2112 int ret;
2113
2114 ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2115 &size_remaining, state);
2116 if (ret < 0)
2117 return ret;
2118
2119 WARN_ON(size_remaining);
2120 return state->buf_kern_offset;
2121 }
2122
2123
2124 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2125 void __user *user, unsigned int len)
2126 {
2127 struct compat_ebt_replace tmp;
2128 int i;
2129
2130 if (len < sizeof(tmp))
2131 return -EINVAL;
2132
2133 if (copy_from_user(&tmp, user, sizeof(tmp)))
2134 return -EFAULT;
2135
2136 if (len != sizeof(tmp) + tmp.entries_size)
2137 return -EINVAL;
2138
2139 if (tmp.entries_size == 0)
2140 return -EINVAL;
2141
2142 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2143 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2144 return -ENOMEM;
2145 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2146 return -ENOMEM;
2147
2148 memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2149
2150 /* starting with hook_entry, 32 vs. 64 bit structures are different */
2151 for (i = 0; i < NF_BR_NUMHOOKS; i++)
2152 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2153
2154 repl->num_counters = tmp.num_counters;
2155 repl->counters = compat_ptr(tmp.counters);
2156 repl->entries = compat_ptr(tmp.entries);
2157 return 0;
2158 }
2159
2160 static int compat_do_replace(struct net *net, void __user *user,
2161 unsigned int len)
2162 {
2163 int ret, i, countersize, size64;
2164 struct ebt_table_info *newinfo;
2165 struct ebt_replace tmp;
2166 struct ebt_entries_buf_state state;
2167 void *entries_tmp;
2168
2169 ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2170 if (ret) {
2171 /* try real handler in case userland supplied needed padding */
2172 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2173 ret = 0;
2174 return ret;
2175 }
2176
2177 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2178 newinfo = vmalloc(sizeof(*newinfo) + countersize);
2179 if (!newinfo)
2180 return -ENOMEM;
2181
2182 if (countersize)
2183 memset(newinfo->counters, 0, countersize);
2184
2185 memset(&state, 0, sizeof(state));
2186
2187 newinfo->entries = vmalloc(tmp.entries_size);
2188 if (!newinfo->entries) {
2189 ret = -ENOMEM;
2190 goto free_newinfo;
2191 }
2192 if (copy_from_user(
2193 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2194 ret = -EFAULT;
2195 goto free_entries;
2196 }
2197
2198 entries_tmp = newinfo->entries;
2199
2200 xt_compat_lock(NFPROTO_BRIDGE);
2201
2202 xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
2203 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2204 if (ret < 0)
2205 goto out_unlock;
2206
2207 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2208 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2209 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2210
2211 size64 = ret;
2212 newinfo->entries = vmalloc(size64);
2213 if (!newinfo->entries) {
2214 vfree(entries_tmp);
2215 ret = -ENOMEM;
2216 goto out_unlock;
2217 }
2218
2219 memset(&state, 0, sizeof(state));
2220 state.buf_kern_start = newinfo->entries;
2221 state.buf_kern_len = size64;
2222
2223 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2224 BUG_ON(ret < 0); /* parses same data again */
2225
2226 vfree(entries_tmp);
2227 tmp.entries_size = size64;
2228
2229 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2230 char __user *usrptr;
2231 if (tmp.hook_entry[i]) {
2232 unsigned int delta;
2233 usrptr = (char __user *) tmp.hook_entry[i];
2234 delta = usrptr - tmp.entries;
2235 usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2236 tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2237 }
2238 }
2239
2240 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2241 xt_compat_unlock(NFPROTO_BRIDGE);
2242
2243 ret = do_replace_finish(net, &tmp, newinfo);
2244 if (ret == 0)
2245 return ret;
2246 free_entries:
2247 vfree(newinfo->entries);
2248 free_newinfo:
2249 vfree(newinfo);
2250 return ret;
2251 out_unlock:
2252 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2253 xt_compat_unlock(NFPROTO_BRIDGE);
2254 goto free_entries;
2255 }
2256
2257 static int compat_update_counters(struct net *net, void __user *user,
2258 unsigned int len)
2259 {
2260 struct compat_ebt_replace hlp;
2261
2262 if (copy_from_user(&hlp, user, sizeof(hlp)))
2263 return -EFAULT;
2264
2265 /* try real handler in case userland supplied needed padding */
2266 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2267 return update_counters(net, user, len);
2268
2269 return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2270 hlp.num_counters, user, len);
2271 }
2272
2273 static int compat_do_ebt_set_ctl(struct sock *sk,
2274 int cmd, void __user *user, unsigned int len)
2275 {
2276 int ret;
2277 struct net *net = sock_net(sk);
2278
2279 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2280 return -EPERM;
2281
2282 switch (cmd) {
2283 case EBT_SO_SET_ENTRIES:
2284 ret = compat_do_replace(net, user, len);
2285 break;
2286 case EBT_SO_SET_COUNTERS:
2287 ret = compat_update_counters(net, user, len);
2288 break;
2289 default:
2290 ret = -EINVAL;
2291 }
2292 return ret;
2293 }
2294
2295 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2296 void __user *user, int *len)
2297 {
2298 int ret;
2299 struct compat_ebt_replace tmp;
2300 struct ebt_table *t;
2301 struct net *net = sock_net(sk);
2302
2303 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2304 return -EPERM;
2305
2306 /* try real handler in case userland supplied needed padding */
2307 if ((cmd == EBT_SO_GET_INFO ||
2308 cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2309 return do_ebt_get_ctl(sk, cmd, user, len);
2310
2311 if (copy_from_user(&tmp, user, sizeof(tmp)))
2312 return -EFAULT;
2313
2314 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
2315 if (!t)
2316 return ret;
2317
2318 xt_compat_lock(NFPROTO_BRIDGE);
2319 switch (cmd) {
2320 case EBT_SO_GET_INFO:
2321 tmp.nentries = t->private->nentries;
2322 ret = compat_table_info(t->private, &tmp);
2323 if (ret)
2324 goto out;
2325 tmp.valid_hooks = t->valid_hooks;
2326
2327 if (copy_to_user(user, &tmp, *len) != 0) {
2328 ret = -EFAULT;
2329 break;
2330 }
2331 ret = 0;
2332 break;
2333 case EBT_SO_GET_INIT_INFO:
2334 tmp.nentries = t->table->nentries;
2335 tmp.entries_size = t->table->entries_size;
2336 tmp.valid_hooks = t->table->valid_hooks;
2337
2338 if (copy_to_user(user, &tmp, *len) != 0) {
2339 ret = -EFAULT;
2340 break;
2341 }
2342 ret = 0;
2343 break;
2344 case EBT_SO_GET_ENTRIES:
2345 case EBT_SO_GET_INIT_ENTRIES:
2346 /*
2347 * try real handler first in case of userland-side padding.
2348 * in case we are dealing with an 'ordinary' 32 bit binary
2349 * without 64bit compatibility padding, this will fail right
2350 * after copy_from_user when the *len argument is validated.
2351 *
2352 * the compat_ variant needs to do one pass over the kernel
2353 * data set to adjust for size differences before it the check.
2354 */
2355 if (copy_everything_to_user(t, user, len, cmd) == 0)
2356 ret = 0;
2357 else
2358 ret = compat_copy_everything_to_user(t, user, len, cmd);
2359 break;
2360 default:
2361 ret = -EINVAL;
2362 }
2363 out:
2364 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2365 xt_compat_unlock(NFPROTO_BRIDGE);
2366 mutex_unlock(&ebt_mutex);
2367 return ret;
2368 }
2369 #endif
2370
2371 static struct nf_sockopt_ops ebt_sockopts = {
2372 .pf = PF_INET,
2373 .set_optmin = EBT_BASE_CTL,
2374 .set_optmax = EBT_SO_SET_MAX + 1,
2375 .set = do_ebt_set_ctl,
2376 #ifdef CONFIG_COMPAT
2377 .compat_set = compat_do_ebt_set_ctl,
2378 #endif
2379 .get_optmin = EBT_BASE_CTL,
2380 .get_optmax = EBT_SO_GET_MAX + 1,
2381 .get = do_ebt_get_ctl,
2382 #ifdef CONFIG_COMPAT
2383 .compat_get = compat_do_ebt_get_ctl,
2384 #endif
2385 .owner = THIS_MODULE,
2386 };
2387
2388 static int __init ebtables_init(void)
2389 {
2390 int ret;
2391
2392 ret = xt_register_target(&ebt_standard_target);
2393 if (ret < 0)
2394 return ret;
2395 ret = nf_register_sockopt(&ebt_sockopts);
2396 if (ret < 0) {
2397 xt_unregister_target(&ebt_standard_target);
2398 return ret;
2399 }
2400
2401 printk(KERN_INFO "Ebtables v2.0 registered\n");
2402 return 0;
2403 }
2404
2405 static void __exit ebtables_fini(void)
2406 {
2407 nf_unregister_sockopt(&ebt_sockopts);
2408 xt_unregister_target(&ebt_standard_target);
2409 printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2410 }
2411
2412 EXPORT_SYMBOL(ebt_register_table);
2413 EXPORT_SYMBOL(ebt_unregister_table);
2414 EXPORT_SYMBOL(ebt_do_table);
2415 module_init(ebtables_init);
2416 module_exit(ebtables_fini);
2417 MODULE_LICENSE("GPL");
Linux with added FPC-III support