net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18
  19 #include <linux/kmod.h>
  20 #include <linux/module.h>
  21 #include <linux/vmalloc.h>
  22 #include <linux/netfilter/x_tables.h>
  23 #include <linux/netfilter_bridge/ebtables.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/mutex.h>
  26 #include <linux/slab.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/smp.h>
  29 #include <linux/cpumask.h>
  30 #include <net/sock.h>
  31 /* needed for logical [in,out]-dev filtering */
  32 #include "../br_private.h"
  33
  34 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  35                                          "report to author: "format, ## args)
  36 /* #define BUGPRINT(format, args...) */
  37
  38 /*
  39  * Each cpu has its own set of counters, so there is no need for write_lock in
  40  * the softirq
  41  * For reading or updating the counters, the user context needs to
  42  * get a write_lock
  43  */
  44
  45 /* The size of each set of counters is altered to get cache alignment */
  46 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  47 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  48 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  49    COUNTER_OFFSET(n) * cpu))
  50
  51
  52
  53 static DEFINE_MUTEX(ebt_mutex);
  54
  55 #ifdef CONFIG_COMPAT
  56 static void ebt_standard_compat_from_user(void *dst, const void *src)
  57 {
  58         int v = *(compat_int_t *)src;
  59
  60         if (v >= 0)
  61                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  62         memcpy(dst, &v, sizeof(v));
  63 }
  64
  65 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  66 {
  67         compat_int_t cv = *(int *)src;
  68
  69         if (cv >= 0)
  70                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  71         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  72 }
  73 #endif
  74
  75
  76 static struct xt_target ebt_standard_target = {
  77         .name       = "standard",
  78         .revision   = 0,
  79         .family     = NFPROTO_BRIDGE,
  80         .targetsize = sizeof(int),
  81 #ifdef CONFIG_COMPAT
  82         .compatsize = sizeof(compat_int_t),
  83         .compat_from_user = ebt_standard_compat_from_user,
  84         .compat_to_user =  ebt_standard_compat_to_user,
  85 #endif
  86 };
  87
  88 static inline int
  89 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  90                struct xt_target_param *par)
  91 {
  92         par->target   = w->u.watcher;
  93         par->targinfo = w->data;
  94         w->u.watcher->target(skb, par);
  95         /* watchers don't give a verdict */
  96         return 0;
  97 }
  98
  99 static inline int ebt_do_match (struct ebt_entry_match *m,
 100    const struct sk_buff *skb, struct xt_match_param *par)
 101 {
 102         par->match     = m->u.match;
 103         par->matchinfo = m->data;
 104         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 105 }
 106
 107 static inline int
 108 ebt_dev_check(const char *entry, const struct net_device *device)
 109 {
 110         int i = 0;
 111         const char *devname;
 112
 113         if (*entry == '\0')
 114                 return 0;
 115         if (!device)
 116                 return 1;
 117         devname = device->name;
 118         /* 1 is the wildcard token */
 119         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 120                 i++;
 121         return (devname[i] != entry[i] && entry[i] != 1);
 122 }
 123
 124 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 125 /* process standard matches */
 126 static inline int
 127 ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
 128                 const struct net_device *in, const struct net_device *out)
 129 {
 130         int verdict, i;
 131
 132         if (e->bitmask & EBT_802_3) {
 133                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 134                         return 1;
 135         } else if (!(e->bitmask & EBT_NOPROTO) &&
 136            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 137                 return 1;
 138
 139         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 140                 return 1;
 141         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 142                 return 1;
 143         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 144            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 145                 return 1;
 146         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 147            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 148                 return 1;
 149
 150         if (e->bitmask & EBT_SOURCEMAC) {
 151                 verdict = 0;
 152                 for (i = 0; i < 6; i++)
 153                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 154                            e->sourcemsk[i];
 155                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 156                         return 1;
 157         }
 158         if (e->bitmask & EBT_DESTMAC) {
 159                 verdict = 0;
 160                 for (i = 0; i < 6; i++)
 161                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 162                            e->destmsk[i];
 163                 if (FWINV2(verdict != 0, EBT_IDEST) )
 164                         return 1;
 165         }
 166         return 0;
 167 }
 168
 169 static inline __pure
 170 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 171 {
 172         return (void *)entry + entry->next_offset;
 173 }
 174
 175 /* Do some firewalling */
 176 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 177    const struct net_device *in, const struct net_device *out,
 178    struct ebt_table *table)
 179 {
 180         int i, nentries;
 181         struct ebt_entry *point;
 182         struct ebt_counter *counter_base, *cb_base;
 183         const struct ebt_entry_target *t;
 184         int verdict, sp = 0;
 185         struct ebt_chainstack *cs;
 186         struct ebt_entries *chaininfo;
 187         const char *base;
 188         const struct ebt_table_info *private;
 189         bool hotdrop = false;
 190         struct xt_match_param mtpar;
 191         struct xt_target_param tgpar;
 192
 193         mtpar.family  = tgpar.family = NFPROTO_BRIDGE;
 194         mtpar.in      = tgpar.in  = in;
 195         mtpar.out     = tgpar.out = out;
 196         mtpar.hotdrop = &hotdrop;
 197         mtpar.hooknum = tgpar.hooknum = hook;
 198
 199         read_lock_bh(&table->lock);
 200         private = table->private;
 201         cb_base = COUNTER_BASE(private->counters, private->nentries,
 202            smp_processor_id());
 203         if (private->chainstack)
 204                 cs = private->chainstack[smp_processor_id()];
 205         else
 206                 cs = NULL;
 207         chaininfo = private->hook_entry[hook];
 208         nentries = private->hook_entry[hook]->nentries;
 209         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 210         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 211         /* base for chain jumps */
 212         base = private->entries;
 213         i = 0;
 214         while (i < nentries) {
 215                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 216                         goto letscontinue;
 217
 218                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
 219                         goto letscontinue;
 220                 if (hotdrop) {
 221                         read_unlock_bh(&table->lock);
 222                         return NF_DROP;
 223                 }
 224
 225                 /* increase counter */
 226                 (*(counter_base + i)).pcnt++;
 227                 (*(counter_base + i)).bcnt += skb->len;
 228
 229                 /* these should only watch: not modify, nor tell us
 230                    what to do with the packet */
 231                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &tgpar);
 232
 233                 t = (struct ebt_entry_target *)
 234                    (((char *)point) + point->target_offset);
 235                 /* standard target */
 236                 if (!t->u.target->target)
 237                         verdict = ((struct ebt_standard_target *)t)->verdict;
 238                 else {
 239                         tgpar.target   = t->u.target;
 240                         tgpar.targinfo = t->data;
 241                         verdict = t->u.target->target(skb, &tgpar);
 242                 }
 243                 if (verdict == EBT_ACCEPT) {
 244                         read_unlock_bh(&table->lock);
 245                         return NF_ACCEPT;
 246                 }
 247                 if (verdict == EBT_DROP) {
 248                         read_unlock_bh(&table->lock);
 249                         return NF_DROP;
 250                 }
 251                 if (verdict == EBT_RETURN) {
 252 letsreturn:
 253 #ifdef CONFIG_NETFILTER_DEBUG
 254                         if (sp == 0) {
 255                                 BUGPRINT("RETURN on base chain");
 256                                 /* act like this is EBT_CONTINUE */
 257                                 goto letscontinue;
 258                         }
 259 #endif
 260                         sp--;
 261                         /* put all the local variables right */
 262                         i = cs[sp].n;
 263                         chaininfo = cs[sp].chaininfo;
 264                         nentries = chaininfo->nentries;
 265                         point = cs[sp].e;
 266                         counter_base = cb_base +
 267                            chaininfo->counter_offset;
 268                         continue;
 269                 }
 270                 if (verdict == EBT_CONTINUE)
 271                         goto letscontinue;
 272 #ifdef CONFIG_NETFILTER_DEBUG
 273                 if (verdict < 0) {
 274                         BUGPRINT("bogus standard verdict\n");
 275                         read_unlock_bh(&table->lock);
 276                         return NF_DROP;
 277                 }
 278 #endif
 279                 /* jump to a udc */
 280                 cs[sp].n = i + 1;
 281                 cs[sp].chaininfo = chaininfo;
 282                 cs[sp].e = ebt_next_entry(point);
 283                 i = 0;
 284                 chaininfo = (struct ebt_entries *) (base + verdict);
 285 #ifdef CONFIG_NETFILTER_DEBUG
 286                 if (chaininfo->distinguisher) {
 287                         BUGPRINT("jump to non-chain\n");
 288                         read_unlock_bh(&table->lock);
 289                         return NF_DROP;
 290                 }
 291 #endif
 292                 nentries = chaininfo->nentries;
 293                 point = (struct ebt_entry *)chaininfo->data;
 294                 counter_base = cb_base + chaininfo->counter_offset;
 295                 sp++;
 296                 continue;
 297 letscontinue:
 298                 point = ebt_next_entry(point);
 299                 i++;
 300         }
 301
 302         /* I actually like this :) */
 303         if (chaininfo->policy == EBT_RETURN)
 304                 goto letsreturn;
 305         if (chaininfo->policy == EBT_ACCEPT) {
 306                 read_unlock_bh(&table->lock);
 307                 return NF_ACCEPT;
 308         }
 309         read_unlock_bh(&table->lock);
 310         return NF_DROP;
 311 }
 312
 313 /* If it succeeds, returns element and locks mutex */
 314 static inline void *
 315 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 316    struct mutex *mutex)
 317 {
 318         struct {
 319                 struct list_head list;
 320                 char name[EBT_FUNCTION_MAXNAMELEN];
 321         } *e;
 322
 323         *error = mutex_lock_interruptible(mutex);
 324         if (*error != 0)
 325                 return NULL;
 326
 327         list_for_each_entry(e, head, list) {
 328                 if (strcmp(e->name, name) == 0)
 329                         return e;
 330         }
 331         *error = -ENOENT;
 332         mutex_unlock(mutex);
 333         return NULL;
 334 }
 335
 336 static void *
 337 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 338    int *error, struct mutex *mutex)
 339 {
 340         return try_then_request_module(
 341                         find_inlist_lock_noload(head, name, error, mutex),
 342                         "%s%s", prefix, name);
 343 }
 344
 345 static inline struct ebt_table *
 346 find_table_lock(struct net *net, const char *name, int *error,
 347                 struct mutex *mutex)
 348 {
 349         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 350                                 "ebtable_", error, mutex);
 351 }
 352
 353 static inline int
 354 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 355                 unsigned int *cnt)
 356 {
 357         const struct ebt_entry *e = par->entryinfo;
 358         struct xt_match *match;
 359         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 360         int ret;
 361
 362         if (left < sizeof(struct ebt_entry_match) ||
 363             left - sizeof(struct ebt_entry_match) < m->match_size)
 364                 return -EINVAL;
 365
 366         match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
 367                 m->u.name, 0), "ebt_%s", m->u.name);
 368         if (IS_ERR(match))
 369                 return PTR_ERR(match);
 370         if (match == NULL)
 371                 return -ENOENT;
 372         m->u.match = match;
 373
 374         par->match     = match;
 375         par->matchinfo = m->data;
 376         ret = xt_check_match(par, m->match_size,
 377               e->ethproto, e->invflags & EBT_IPROTO);
 378         if (ret < 0) {
 379                 module_put(match->me);
 380                 return ret;
 381         }
 382
 383         (*cnt)++;
 384         return 0;
 385 }
 386
 387 static inline int
 388 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 389                   unsigned int *cnt)
 390 {
 391         const struct ebt_entry *e = par->entryinfo;
 392         struct xt_target *watcher;
 393         size_t left = ((char *)e + e->target_offset) - (char *)w;
 394         int ret;
 395
 396         if (left < sizeof(struct ebt_entry_watcher) ||
 397            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 398                 return -EINVAL;
 399
 400         watcher = try_then_request_module(
 401                   xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
 402                   "ebt_%s", w->u.name);
 403         if (IS_ERR(watcher))
 404                 return PTR_ERR(watcher);
 405         if (watcher == NULL)
 406                 return -ENOENT;
 407         w->u.watcher = watcher;
 408
 409         par->target   = watcher;
 410         par->targinfo = w->data;
 411         ret = xt_check_target(par, w->watcher_size,
 412               e->ethproto, e->invflags & EBT_IPROTO);
 413         if (ret < 0) {
 414                 module_put(watcher->me);
 415                 return ret;
 416         }
 417
 418         (*cnt)++;
 419         return 0;
 420 }
 421
 422 static int ebt_verify_pointers(const struct ebt_replace *repl,
 423                                struct ebt_table_info *newinfo)
 424 {
 425         unsigned int limit = repl->entries_size;
 426         unsigned int valid_hooks = repl->valid_hooks;
 427         unsigned int offset = 0;
 428         int i;
 429
 430         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 431                 newinfo->hook_entry[i] = NULL;
 432
 433         newinfo->entries_size = repl->entries_size;
 434         newinfo->nentries = repl->nentries;
 435
 436         while (offset < limit) {
 437                 size_t left = limit - offset;
 438                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 439
 440                 if (left < sizeof(unsigned int))
 441                         break;
 442
 443                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 444                         if ((valid_hooks & (1 << i)) == 0)
 445                                 continue;
 446                         if ((char __user *)repl->hook_entry[i] ==
 447                              repl->entries + offset)
 448                                 break;
 449                 }
 450
 451                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 452                         if (e->bitmask != 0) {
 453                                 /* we make userspace set this right,
 454                                    so there is no misunderstanding */
 455                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 456                                          "in distinguisher\n");
 457                                 return -EINVAL;
 458                         }
 459                         if (i != NF_BR_NUMHOOKS)
 460                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 461                         if (left < sizeof(struct ebt_entries))
 462                                 break;
 463                         offset += sizeof(struct ebt_entries);
 464                 } else {
 465                         if (left < sizeof(struct ebt_entry))
 466                                 break;
 467                         if (left < e->next_offset)
 468                                 break;
 469                         if (e->next_offset < sizeof(struct ebt_entry))
 470                                 return -EINVAL;
 471                         offset += e->next_offset;
 472                 }
 473         }
 474         if (offset != limit) {
 475                 BUGPRINT("entries_size too small\n");
 476                 return -EINVAL;
 477         }
 478
 479         /* check if all valid hooks have a chain */
 480         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 481                 if (!newinfo->hook_entry[i] &&
 482                    (valid_hooks & (1 << i))) {
 483                         BUGPRINT("Valid hook without chain\n");
 484                         return -EINVAL;
 485                 }
 486         }
 487         return 0;
 488 }
 489
 490 /*
 491  * this one is very careful, as it is the first function
 492  * to parse the userspace data
 493  */
 494 static inline int
 495 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 496    const struct ebt_table_info *newinfo,
 497    unsigned int *n, unsigned int *cnt,
 498    unsigned int *totalcnt, unsigned int *udc_cnt)
 499 {
 500         int i;
 501
 502         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 503                 if ((void *)e == (void *)newinfo->hook_entry[i])
 504                         break;
 505         }
 506         /* beginning of a new chain
 507            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 508         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 509                 /* this checks if the previous chain has as many entries
 510                    as it said it has */
 511                 if (*n != *cnt) {
 512                         BUGPRINT("nentries does not equal the nr of entries "
 513                                  "in the chain\n");
 514                         return -EINVAL;
 515                 }
 516                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 517                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 518                         /* only RETURN from udc */
 519                         if (i != NF_BR_NUMHOOKS ||
 520                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 521                                 BUGPRINT("bad policy\n");
 522                                 return -EINVAL;
 523                         }
 524                 }
 525                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 526                         (*udc_cnt)++;
 527                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 528                         BUGPRINT("counter_offset != totalcnt");
 529                         return -EINVAL;
 530                 }
 531                 *n = ((struct ebt_entries *)e)->nentries;
 532                 *cnt = 0;
 533                 return 0;
 534         }
 535         /* a plain old entry, heh */
 536         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 537            e->watchers_offset > e->target_offset ||
 538            e->target_offset >= e->next_offset) {
 539                 BUGPRINT("entry offsets not in right order\n");
 540                 return -EINVAL;
 541         }
 542         /* this is not checked anywhere else */
 543         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 544                 BUGPRINT("target size too small\n");
 545                 return -EINVAL;
 546         }
 547         (*cnt)++;
 548         (*totalcnt)++;
 549         return 0;
 550 }
 551
 552 struct ebt_cl_stack
 553 {
 554         struct ebt_chainstack cs;
 555         int from;
 556         unsigned int hookmask;
 557 };
 558
 559 /*
 560  * we need these positions to check that the jumps to a different part of the
 561  * entries is a jump to the beginning of a new chain.
 562  */
 563 static inline int
 564 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 565    unsigned int *n, struct ebt_cl_stack *udc)
 566 {
 567         int i;
 568
 569         /* we're only interested in chain starts */
 570         if (e->bitmask)
 571                 return 0;
 572         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 573                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 574                         break;
 575         }
 576         /* only care about udc */
 577         if (i != NF_BR_NUMHOOKS)
 578                 return 0;
 579
 580         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 581         /* these initialisations are depended on later in check_chainloops() */
 582         udc[*n].cs.n = 0;
 583         udc[*n].hookmask = 0;
 584
 585         (*n)++;
 586         return 0;
 587 }
 588
 589 static inline int
 590 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 591 {
 592         struct xt_mtdtor_param par;
 593
 594         if (i && (*i)-- == 0)
 595                 return 1;
 596
 597         par.net       = net;
 598         par.match     = m->u.match;
 599         par.matchinfo = m->data;
 600         par.family    = NFPROTO_BRIDGE;
 601         if (par.match->destroy != NULL)
 602                 par.match->destroy(&par);
 603         module_put(par.match->me);
 604         return 0;
 605 }
 606
 607 static inline int
 608 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 609 {
 610         struct xt_tgdtor_param par;
 611
 612         if (i && (*i)-- == 0)
 613                 return 1;
 614
 615         par.net      = net;
 616         par.target   = w->u.watcher;
 617         par.targinfo = w->data;
 618         par.family   = NFPROTO_BRIDGE;
 619         if (par.target->destroy != NULL)
 620                 par.target->destroy(&par);
 621         module_put(par.target->me);
 622         return 0;
 623 }
 624
 625 static inline int
 626 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 627 {
 628         struct xt_tgdtor_param par;
 629         struct ebt_entry_target *t;
 630
 631         if (e->bitmask == 0)
 632                 return 0;
 633         /* we're done */
 634         if (cnt && (*cnt)-- == 0)
 635                 return 1;
 636         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 637         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 638         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 639
 640         par.net      = net;
 641         par.target   = t->u.target;
 642         par.targinfo = t->data;
 643         par.family   = NFPROTO_BRIDGE;
 644         if (par.target->destroy != NULL)
 645                 par.target->destroy(&par);
 646         module_put(par.target->me);
 647         return 0;
 648 }
 649
 650 static inline int
 651 ebt_check_entry(struct ebt_entry *e, struct net *net,
 652    const struct ebt_table_info *newinfo,
 653    const char *name, unsigned int *cnt,
 654    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 655 {
 656         struct ebt_entry_target *t;
 657         struct xt_target *target;
 658         unsigned int i, j, hook = 0, hookmask = 0;
 659         size_t gap;
 660         int ret;
 661         struct xt_mtchk_param mtpar;
 662         struct xt_tgchk_param tgpar;
 663
 664         /* don't mess with the struct ebt_entries */
 665         if (e->bitmask == 0)
 666                 return 0;
 667
 668         if (e->bitmask & ~EBT_F_MASK) {
 669                 BUGPRINT("Unknown flag for bitmask\n");
 670                 return -EINVAL;
 671         }
 672         if (e->invflags & ~EBT_INV_MASK) {
 673                 BUGPRINT("Unknown flag for inv bitmask\n");
 674                 return -EINVAL;
 675         }
 676         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 677                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 678                 return -EINVAL;
 679         }
 680         /* what hook do we belong to? */
 681         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 682                 if (!newinfo->hook_entry[i])
 683                         continue;
 684                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 685                         hook = i;
 686                 else
 687                         break;
 688         }
 689         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 690            a base chain */
 691         if (i < NF_BR_NUMHOOKS)
 692                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 693         else {
 694                 for (i = 0; i < udc_cnt; i++)
 695                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 696                                 break;
 697                 if (i == 0)
 698                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 699                 else
 700                         hookmask = cl_s[i - 1].hookmask;
 701         }
 702         i = 0;
 703
 704         mtpar.net       = tgpar.net       = net;
 705         mtpar.table     = tgpar.table     = name;
 706         mtpar.entryinfo = tgpar.entryinfo = e;
 707         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 708         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 709         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 710         if (ret != 0)
 711                 goto cleanup_matches;
 712         j = 0;
 713         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 714         if (ret != 0)
 715                 goto cleanup_watchers;
 716         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 717         gap = e->next_offset - e->target_offset;
 718
 719         target = try_then_request_module(
 720                  xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
 721                  "ebt_%s", t->u.name);
 722         if (IS_ERR(target)) {
 723                 ret = PTR_ERR(target);
 724                 goto cleanup_watchers;
 725         } else if (target == NULL) {
 726                 ret = -ENOENT;
 727                 goto cleanup_watchers;
 728         }
 729
 730         t->u.target = target;
 731         if (t->u.target == &ebt_standard_target) {
 732                 if (gap < sizeof(struct ebt_standard_target)) {
 733                         BUGPRINT("Standard target size too big\n");
 734                         ret = -EFAULT;
 735                         goto cleanup_watchers;
 736                 }
 737                 if (((struct ebt_standard_target *)t)->verdict <
 738                    -NUM_STANDARD_TARGETS) {
 739                         BUGPRINT("Invalid standard target\n");
 740                         ret = -EFAULT;
 741                         goto cleanup_watchers;
 742                 }
 743         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 744                 module_put(t->u.target->me);
 745                 ret = -EFAULT;
 746                 goto cleanup_watchers;
 747         }
 748
 749         tgpar.target   = target;
 750         tgpar.targinfo = t->data;
 751         ret = xt_check_target(&tgpar, t->target_size,
 752               e->ethproto, e->invflags & EBT_IPROTO);
 753         if (ret < 0) {
 754                 module_put(target->me);
 755                 goto cleanup_watchers;
 756         }
 757         (*cnt)++;
 758         return 0;
 759 cleanup_watchers:
 760         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 761 cleanup_matches:
 762         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 763         return ret;
 764 }
 765
 766 /*
 767  * checks for loops and sets the hook mask for udc
 768  * the hook mask for udc tells us from which base chains the udc can be
 769  * accessed. This mask is a parameter to the check() functions of the extensions
 770  */
 771 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 772    unsigned int udc_cnt, unsigned int hooknr, char *base)
 773 {
 774         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 775         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 776         const struct ebt_entry_target *t;
 777
 778         while (pos < nentries || chain_nr != -1) {
 779                 /* end of udc, go back one 'recursion' step */
 780                 if (pos == nentries) {
 781                         /* put back values of the time when this chain was called */
 782                         e = cl_s[chain_nr].cs.e;
 783                         if (cl_s[chain_nr].from != -1)
 784                                 nentries =
 785                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 786                         else
 787                                 nentries = chain->nentries;
 788                         pos = cl_s[chain_nr].cs.n;
 789                         /* make sure we won't see a loop that isn't one */
 790                         cl_s[chain_nr].cs.n = 0;
 791                         chain_nr = cl_s[chain_nr].from;
 792                         if (pos == nentries)
 793                                 continue;
 794                 }
 795                 t = (struct ebt_entry_target *)
 796                    (((char *)e) + e->target_offset);
 797                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 798                         goto letscontinue;
 799                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 800                    e->next_offset) {
 801                         BUGPRINT("Standard target size too big\n");
 802                         return -1;
 803                 }
 804                 verdict = ((struct ebt_standard_target *)t)->verdict;
 805                 if (verdict >= 0) { /* jump to another chain */
 806                         struct ebt_entries *hlp2 =
 807                            (struct ebt_entries *)(base + verdict);
 808                         for (i = 0; i < udc_cnt; i++)
 809                                 if (hlp2 == cl_s[i].cs.chaininfo)
 810                                         break;
 811                         /* bad destination or loop */
 812                         if (i == udc_cnt) {
 813                                 BUGPRINT("bad destination\n");
 814                                 return -1;
 815                         }
 816                         if (cl_s[i].cs.n) {
 817                                 BUGPRINT("loop\n");
 818                                 return -1;
 819                         }
 820                         if (cl_s[i].hookmask & (1 << hooknr))
 821                                 goto letscontinue;
 822                         /* this can't be 0, so the loop test is correct */
 823                         cl_s[i].cs.n = pos + 1;
 824                         pos = 0;
 825                         cl_s[i].cs.e = ebt_next_entry(e);
 826                         e = (struct ebt_entry *)(hlp2->data);
 827                         nentries = hlp2->nentries;
 828                         cl_s[i].from = chain_nr;
 829                         chain_nr = i;
 830                         /* this udc is accessible from the base chain for hooknr */
 831                         cl_s[i].hookmask |= (1 << hooknr);
 832                         continue;
 833                 }
 834 letscontinue:
 835                 e = ebt_next_entry(e);
 836                 pos++;
 837         }
 838         return 0;
 839 }
 840
 841 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 842 static int translate_table(struct net *net, const char *name,
 843                            struct ebt_table_info *newinfo)
 844 {
 845         unsigned int i, j, k, udc_cnt;
 846         int ret;
 847         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 848
 849         i = 0;
 850         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 851                 i++;
 852         if (i == NF_BR_NUMHOOKS) {
 853                 BUGPRINT("No valid hooks specified\n");
 854                 return -EINVAL;
 855         }
 856         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 857                 BUGPRINT("Chains don't start at beginning\n");
 858                 return -EINVAL;
 859         }
 860         /* make sure chains are ordered after each other in same order
 861            as their corresponding hooks */
 862         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 863                 if (!newinfo->hook_entry[j])
 864                         continue;
 865                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 866                         BUGPRINT("Hook order must be followed\n");
 867                         return -EINVAL;
 868                 }
 869                 i = j;
 870         }
 871
 872         /* do some early checkings and initialize some things */
 873         i = 0; /* holds the expected nr. of entries for the chain */
 874         j = 0; /* holds the up to now counted entries for the chain */
 875         k = 0; /* holds the total nr. of entries, should equal
 876                   newinfo->nentries afterwards */
 877         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 878         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 879            ebt_check_entry_size_and_hooks, newinfo,
 880            &i, &j, &k, &udc_cnt);
 881
 882         if (ret != 0)
 883                 return ret;
 884
 885         if (i != j) {
 886                 BUGPRINT("nentries does not equal the nr of entries in the "
 887                          "(last) chain\n");
 888                 return -EINVAL;
 889         }
 890         if (k != newinfo->nentries) {
 891                 BUGPRINT("Total nentries is wrong\n");
 892                 return -EINVAL;
 893         }
 894
 895         /* get the location of the udc, put them in an array
 896            while we're at it, allocate the chainstack */
 897         if (udc_cnt) {
 898                 /* this will get free'd in do_replace()/ebt_register_table()
 899                    if an error occurs */
 900                 newinfo->chainstack =
 901                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 902                 if (!newinfo->chainstack)
 903                         return -ENOMEM;
 904                 for_each_possible_cpu(i) {
 905                         newinfo->chainstack[i] =
 906                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 907                         if (!newinfo->chainstack[i]) {
 908                                 while (i)
 909                                         vfree(newinfo->chainstack[--i]);
 910                                 vfree(newinfo->chainstack);
 911                                 newinfo->chainstack = NULL;
 912                                 return -ENOMEM;
 913                         }
 914                 }
 915
 916                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 917                 if (!cl_s)
 918                         return -ENOMEM;
 919                 i = 0; /* the i'th udc */
 920                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 921                    ebt_get_udc_positions, newinfo, &i, cl_s);
 922                 /* sanity check */
 923                 if (i != udc_cnt) {
 924                         BUGPRINT("i != udc_cnt\n");
 925                         vfree(cl_s);
 926                         return -EFAULT;
 927                 }
 928         }
 929
 930         /* Check for loops */
 931         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 932                 if (newinfo->hook_entry[i])
 933                         if (check_chainloops(newinfo->hook_entry[i],
 934                            cl_s, udc_cnt, i, newinfo->entries)) {
 935                                 vfree(cl_s);
 936                                 return -EINVAL;
 937                         }
 938
 939         /* we now know the following (along with E=mc²):
 940            - the nr of entries in each chain is right
 941            - the size of the allocated space is right
 942            - all valid hooks have a corresponding chain
 943            - there are no loops
 944            - wrong data can still be on the level of a single entry
 945            - could be there are jumps to places that are not the
 946              beginning of a chain. This can only occur in chains that
 947              are not accessible from any base chains, so we don't care. */
 948
 949         /* used to know what we need to clean up if something goes wrong */
 950         i = 0;
 951         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 952            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 953         if (ret != 0) {
 954                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 955                                   ebt_cleanup_entry, net, &i);
 956         }
 957         vfree(cl_s);
 958         return ret;
 959 }
 960
 961 /* called under write_lock */
 962 static void get_counters(const struct ebt_counter *oldcounters,
 963    struct ebt_counter *counters, unsigned int nentries)
 964 {
 965         int i, cpu;
 966         struct ebt_counter *counter_base;
 967
 968         /* counters of cpu 0 */
 969         memcpy(counters, oldcounters,
 970                sizeof(struct ebt_counter) * nentries);
 971
 972         /* add other counters to those of cpu 0 */
 973         for_each_possible_cpu(cpu) {
 974                 if (cpu == 0)
 975                         continue;
 976                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 977                 for (i = 0; i < nentries; i++) {
 978                         counters[i].pcnt += counter_base[i].pcnt;
 979                         counters[i].bcnt += counter_base[i].bcnt;
 980                 }
 981         }
 982 }
 983
 984 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 985                               struct ebt_table_info *newinfo)
 986 {
 987         int ret, i;
 988         struct ebt_counter *counterstmp = NULL;
 989         /* used to be able to unlock earlier */
 990         struct ebt_table_info *table;
 991         struct ebt_table *t;
 992
 993         /* the user wants counters back
 994            the check on the size is done later, when we have the lock */
 995         if (repl->num_counters) {
 996                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
 997                 counterstmp = vmalloc(size);
 998                 if (!counterstmp)
 999                         return -ENOMEM;
1000         }
1001
1002         newinfo->chainstack = NULL;
1003         ret = ebt_verify_pointers(repl, newinfo);
1004         if (ret != 0)
1005                 goto free_counterstmp;
1006
1007         ret = translate_table(net, repl->name, newinfo);
1008
1009         if (ret != 0)
1010                 goto free_counterstmp;
1011
1012         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1013         if (!t) {
1014                 ret = -ENOENT;
1015                 goto free_iterate;
1016         }
1017
1018         /* the table doesn't like it */
1019         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1020                 goto free_unlock;
1021
1022         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1023                 BUGPRINT("Wrong nr. of counters requested\n");
1024                 ret = -EINVAL;
1025                 goto free_unlock;
1026         }
1027
1028         /* we have the mutex lock, so no danger in reading this pointer */
1029         table = t->private;
1030         /* make sure the table can only be rmmod'ed if it contains no rules */
1031         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1032                 ret = -ENOENT;
1033                 goto free_unlock;
1034         } else if (table->nentries && !newinfo->nentries)
1035                 module_put(t->me);
1036         /* we need an atomic snapshot of the counters */
1037         write_lock_bh(&t->lock);
1038         if (repl->num_counters)
1039                 get_counters(t->private->counters, counterstmp,
1040                    t->private->nentries);
1041
1042         t->private = newinfo;
1043         write_unlock_bh(&t->lock);
1044         mutex_unlock(&ebt_mutex);
1045         /* so, a user can change the chains while having messed up her counter
1046            allocation. Only reason why this is done is because this way the lock
1047            is held only once, while this doesn't bring the kernel into a
1048            dangerous state. */
1049         if (repl->num_counters &&
1050            copy_to_user(repl->counters, counterstmp,
1051            repl->num_counters * sizeof(struct ebt_counter))) {
1052                 ret = -EFAULT;
1053         }
1054         else
1055                 ret = 0;
1056
1057         /* decrease module count and free resources */
1058         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1059                           ebt_cleanup_entry, net, NULL);
1060
1061         vfree(table->entries);
1062         if (table->chainstack) {
1063                 for_each_possible_cpu(i)
1064                         vfree(table->chainstack[i]);
1065                 vfree(table->chainstack);
1066         }
1067         vfree(table);
1068
1069         vfree(counterstmp);
1070         return ret;
1071
1072 free_unlock:
1073         mutex_unlock(&ebt_mutex);
1074 free_iterate:
1075         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1076                           ebt_cleanup_entry, net, NULL);
1077 free_counterstmp:
1078         vfree(counterstmp);
1079         /* can be initialized in translate_table() */
1080         if (newinfo->chainstack) {
1081                 for_each_possible_cpu(i)
1082                         vfree(newinfo->chainstack[i]);
1083                 vfree(newinfo->chainstack);
1084         }
1085         return ret;
1086 }
1087
1088 /* replace the table */
1089 static int do_replace(struct net *net, const void __user *user,
1090                       unsigned int len)
1091 {
1092         int ret, countersize;
1093         struct ebt_table_info *newinfo;
1094         struct ebt_replace tmp;
1095
1096         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1097                 return -EFAULT;
1098
1099         if (len != sizeof(tmp) + tmp.entries_size) {
1100                 BUGPRINT("Wrong len argument\n");
1101                 return -EINVAL;
1102         }
1103
1104         if (tmp.entries_size == 0) {
1105                 BUGPRINT("Entries_size never zero\n");
1106                 return -EINVAL;
1107         }
1108         /* overflow check */
1109         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1110                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1111                 return -ENOMEM;
1112         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1113                 return -ENOMEM;
1114
1115         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1116         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1117         if (!newinfo)
1118                 return -ENOMEM;
1119
1120         if (countersize)
1121                 memset(newinfo->counters, 0, countersize);
1122
1123         newinfo->entries = vmalloc(tmp.entries_size);
1124         if (!newinfo->entries) {
1125                 ret = -ENOMEM;
1126                 goto free_newinfo;
1127         }
1128         if (copy_from_user(
1129            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1130                 BUGPRINT("Couldn't copy entries from userspace\n");
1131                 ret = -EFAULT;
1132                 goto free_entries;
1133         }
1134
1135         ret = do_replace_finish(net, &tmp, newinfo);
1136         if (ret == 0)
1137                 return ret;
1138 free_entries:
1139         vfree(newinfo->entries);
1140 free_newinfo:
1141         vfree(newinfo);
1142         return ret;
1143 }
1144
1145 struct ebt_table *
1146 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1147 {
1148         struct ebt_table_info *newinfo;
1149         struct ebt_table *t, *table;
1150         struct ebt_replace_kernel *repl;
1151         int ret, i, countersize;
1152         void *p;
1153
1154         if (input_table == NULL || (repl = input_table->table) == NULL ||
1155             repl->entries == 0 || repl->entries_size == 0 ||
1156             repl->counters != NULL || input_table->private != NULL) {
1157                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1158                 return ERR_PTR(-EINVAL);
1159         }
1160
1161         /* Don't add one table to multiple lists. */
1162         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1163         if (!table) {
1164                 ret = -ENOMEM;
1165                 goto out;
1166         }
1167
1168         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1169         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1170         ret = -ENOMEM;
1171         if (!newinfo)
1172                 goto free_table;
1173
1174         p = vmalloc(repl->entries_size);
1175         if (!p)
1176                 goto free_newinfo;
1177
1178         memcpy(p, repl->entries, repl->entries_size);
1179         newinfo->entries = p;
1180
1181         newinfo->entries_size = repl->entries_size;
1182         newinfo->nentries = repl->nentries;
1183
1184         if (countersize)
1185                 memset(newinfo->counters, 0, countersize);
1186
1187         /* fill in newinfo and parse the entries */
1188         newinfo->chainstack = NULL;
1189         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1190                 if ((repl->valid_hooks & (1 << i)) == 0)
1191                         newinfo->hook_entry[i] = NULL;
1192                 else
1193                         newinfo->hook_entry[i] = p +
1194                                 ((char *)repl->hook_entry[i] - repl->entries);
1195         }
1196         ret = translate_table(net, repl->name, newinfo);
1197         if (ret != 0) {
1198                 BUGPRINT("Translate_table failed\n");
1199                 goto free_chainstack;
1200         }
1201
1202         if (table->check && table->check(newinfo, table->valid_hooks)) {
1203                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1204                 return ERR_PTR(-EINVAL);
1205         }
1206
1207         table->private = newinfo;
1208         rwlock_init(&table->lock);
1209         ret = mutex_lock_interruptible(&ebt_mutex);
1210         if (ret != 0)
1211                 goto free_chainstack;
1212
1213         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1214                 if (strcmp(t->name, table->name) == 0) {
1215                         ret = -EEXIST;
1216                         BUGPRINT("Table name already exists\n");
1217                         goto free_unlock;
1218                 }
1219         }
1220
1221         /* Hold a reference count if the chains aren't empty */
1222         if (newinfo->nentries && !try_module_get(table->me)) {
1223                 ret = -ENOENT;
1224                 goto free_unlock;
1225         }
1226         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1227         mutex_unlock(&ebt_mutex);
1228         return table;
1229 free_unlock:
1230         mutex_unlock(&ebt_mutex);
1231 free_chainstack:
1232         if (newinfo->chainstack) {
1233                 for_each_possible_cpu(i)
1234                         vfree(newinfo->chainstack[i]);
1235                 vfree(newinfo->chainstack);
1236         }
1237         vfree(newinfo->entries);
1238 free_newinfo:
1239         vfree(newinfo);
1240 free_table:
1241         kfree(table);
1242 out:
1243         return ERR_PTR(ret);
1244 }
1245
1246 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1247 {
1248         int i;
1249
1250         if (!table) {
1251                 BUGPRINT("Request to unregister NULL table!!!\n");
1252                 return;
1253         }
1254         mutex_lock(&ebt_mutex);
1255         list_del(&table->list);
1256         mutex_unlock(&ebt_mutex);
1257         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1258                           ebt_cleanup_entry, net, NULL);
1259         if (table->private->nentries)
1260                 module_put(table->me);
1261         vfree(table->private->entries);
1262         if (table->private->chainstack) {
1263                 for_each_possible_cpu(i)
1264                         vfree(table->private->chainstack[i]);
1265                 vfree(table->private->chainstack);
1266         }
1267         vfree(table->private);
1268         kfree(table);
1269 }
1270
1271 /* userspace just supplied us with counters */
1272 static int do_update_counters(struct net *net, const char *name,
1273                                 struct ebt_counter __user *counters,
1274                                 unsigned int num_counters,
1275                                 const void __user *user, unsigned int len)
1276 {
1277         int i, ret;
1278         struct ebt_counter *tmp;
1279         struct ebt_table *t;
1280
1281         if (num_counters == 0)
1282                 return -EINVAL;
1283
1284         tmp = vmalloc(num_counters * sizeof(*tmp));
1285         if (!tmp)
1286                 return -ENOMEM;
1287
1288         t = find_table_lock(net, name, &ret, &ebt_mutex);
1289         if (!t)
1290                 goto free_tmp;
1291
1292         if (num_counters != t->private->nentries) {
1293                 BUGPRINT("Wrong nr of counters\n");
1294                 ret = -EINVAL;
1295                 goto unlock_mutex;
1296         }
1297
1298         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1299                 ret = -EFAULT;
1300                 goto unlock_mutex;
1301         }
1302
1303         /* we want an atomic add of the counters */
1304         write_lock_bh(&t->lock);
1305
1306         /* we add to the counters of the first cpu */
1307         for (i = 0; i < num_counters; i++) {
1308                 t->private->counters[i].pcnt += tmp[i].pcnt;
1309                 t->private->counters[i].bcnt += tmp[i].bcnt;
1310         }
1311
1312         write_unlock_bh(&t->lock);
1313         ret = 0;
1314 unlock_mutex:
1315         mutex_unlock(&ebt_mutex);
1316 free_tmp:
1317         vfree(tmp);
1318         return ret;
1319 }
1320
1321 static int update_counters(struct net *net, const void __user *user,
1322                             unsigned int len)
1323 {
1324         struct ebt_replace hlp;
1325
1326         if (copy_from_user(&hlp, user, sizeof(hlp)))
1327                 return -EFAULT;
1328
1329         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1330                 return -EINVAL;
1331
1332         return do_update_counters(net, hlp.name, hlp.counters,
1333                                 hlp.num_counters, user, len);
1334 }
1335
1336 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1337     const char *base, char __user *ubase)
1338 {
1339         char __user *hlp = ubase + ((char *)m - base);
1340         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1341                 return -EFAULT;
1342         return 0;
1343 }
1344
1345 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1346     const char *base, char __user *ubase)
1347 {
1348         char __user *hlp = ubase + ((char *)w - base);
1349         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1350                 return -EFAULT;
1351         return 0;
1352 }
1353
1354 static inline int
1355 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1356 {
1357         int ret;
1358         char __user *hlp;
1359         const struct ebt_entry_target *t;
1360
1361         if (e->bitmask == 0)
1362                 return 0;
1363
1364         hlp = ubase + (((char *)e + e->target_offset) - base);
1365         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1366
1367         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1368         if (ret != 0)
1369                 return ret;
1370         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1371         if (ret != 0)
1372                 return ret;
1373         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1374                 return -EFAULT;
1375         return 0;
1376 }
1377
1378 static int copy_counters_to_user(struct ebt_table *t,
1379                                   const struct ebt_counter *oldcounters,
1380                                   void __user *user, unsigned int num_counters,
1381                                   unsigned int nentries)
1382 {
1383         struct ebt_counter *counterstmp;
1384         int ret = 0;
1385
1386         /* userspace might not need the counters */
1387         if (num_counters == 0)
1388                 return 0;
1389
1390         if (num_counters != nentries) {
1391                 BUGPRINT("Num_counters wrong\n");
1392                 return -EINVAL;
1393         }
1394
1395         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1396         if (!counterstmp)
1397                 return -ENOMEM;
1398
1399         write_lock_bh(&t->lock);
1400         get_counters(oldcounters, counterstmp, nentries);
1401         write_unlock_bh(&t->lock);
1402
1403         if (copy_to_user(user, counterstmp,
1404            nentries * sizeof(struct ebt_counter)))
1405                 ret = -EFAULT;
1406         vfree(counterstmp);
1407         return ret;
1408 }
1409
1410 /* called with ebt_mutex locked */
1411 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1412     const int *len, int cmd)
1413 {
1414         struct ebt_replace tmp;
1415         const struct ebt_counter *oldcounters;
1416         unsigned int entries_size, nentries;
1417         int ret;
1418         char *entries;
1419
1420         if (cmd == EBT_SO_GET_ENTRIES) {
1421                 entries_size = t->private->entries_size;
1422                 nentries = t->private->nentries;
1423                 entries = t->private->entries;
1424                 oldcounters = t->private->counters;
1425         } else {
1426                 entries_size = t->table->entries_size;
1427                 nentries = t->table->nentries;
1428                 entries = t->table->entries;
1429                 oldcounters = t->table->counters;
1430         }
1431
1432         if (copy_from_user(&tmp, user, sizeof(tmp)))
1433                 return -EFAULT;
1434
1435         if (*len != sizeof(struct ebt_replace) + entries_size +
1436            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
1437                 return -EINVAL;
1438
1439         if (tmp.nentries != nentries) {
1440                 BUGPRINT("Nentries wrong\n");
1441                 return -EINVAL;
1442         }
1443
1444         if (tmp.entries_size != entries_size) {
1445                 BUGPRINT("Wrong size\n");
1446                 return -EINVAL;
1447         }
1448
1449         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1450                                         tmp.num_counters, nentries);
1451         if (ret)
1452                 return ret;
1453
1454         if (copy_to_user(tmp.entries, entries, entries_size)) {
1455                 BUGPRINT("Couldn't copy entries to userspace\n");
1456                 return -EFAULT;
1457         }
1458         /* set the match/watcher/target names right */
1459         return EBT_ENTRY_ITERATE(entries, entries_size,
1460            ebt_make_names, entries, tmp.entries);
1461 }
1462
1463 static int do_ebt_set_ctl(struct sock *sk,
1464         int cmd, void __user *user, unsigned int len)
1465 {
1466         int ret;
1467
1468         if (!capable(CAP_NET_ADMIN))
1469                 return -EPERM;
1470
1471         switch(cmd) {
1472         case EBT_SO_SET_ENTRIES:
1473                 ret = do_replace(sock_net(sk), user, len);
1474                 break;
1475         case EBT_SO_SET_COUNTERS:
1476                 ret = update_counters(sock_net(sk), user, len);
1477                 break;
1478         default:
1479                 ret = -EINVAL;
1480         }
1481         return ret;
1482 }
1483
1484 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1485 {
1486         int ret;
1487         struct ebt_replace tmp;
1488         struct ebt_table *t;
1489
1490         if (!capable(CAP_NET_ADMIN))
1491                 return -EPERM;
1492
1493         if (copy_from_user(&tmp, user, sizeof(tmp)))
1494                 return -EFAULT;
1495
1496         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1497         if (!t)
1498                 return ret;
1499
1500         switch(cmd) {
1501         case EBT_SO_GET_INFO:
1502         case EBT_SO_GET_INIT_INFO:
1503                 if (*len != sizeof(struct ebt_replace)){
1504                         ret = -EINVAL;
1505                         mutex_unlock(&ebt_mutex);
1506                         break;
1507                 }
1508                 if (cmd == EBT_SO_GET_INFO) {
1509                         tmp.nentries = t->private->nentries;
1510                         tmp.entries_size = t->private->entries_size;
1511                         tmp.valid_hooks = t->valid_hooks;
1512                 } else {
1513                         tmp.nentries = t->table->nentries;
1514                         tmp.entries_size = t->table->entries_size;
1515                         tmp.valid_hooks = t->table->valid_hooks;
1516                 }
1517                 mutex_unlock(&ebt_mutex);
1518                 if (copy_to_user(user, &tmp, *len) != 0){
1519                         BUGPRINT("c2u Didn't work\n");
1520                         ret = -EFAULT;
1521                         break;
1522                 }
1523                 ret = 0;
1524                 break;
1525
1526         case EBT_SO_GET_ENTRIES:
1527         case EBT_SO_GET_INIT_ENTRIES:
1528                 ret = copy_everything_to_user(t, user, len, cmd);
1529                 mutex_unlock(&ebt_mutex);
1530                 break;
1531
1532         default:
1533                 mutex_unlock(&ebt_mutex);
1534                 ret = -EINVAL;
1535         }
1536
1537         return ret;
1538 }
1539
1540 #ifdef CONFIG_COMPAT
1541 /* 32 bit-userspace compatibility definitions. */
1542 struct compat_ebt_replace {
1543         char name[EBT_TABLE_MAXNAMELEN];
1544         compat_uint_t valid_hooks;
1545         compat_uint_t nentries;
1546         compat_uint_t entries_size;
1547         /* start of the chains */
1548         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1549         /* nr of counters userspace expects back */
1550         compat_uint_t num_counters;
1551         /* where the kernel will put the old counters. */
1552         compat_uptr_t counters;
1553         compat_uptr_t entries;
1554 };
1555
1556 /* struct ebt_entry_match, _target and _watcher have same layout */
1557 struct compat_ebt_entry_mwt {
1558         union {
1559                 char name[EBT_FUNCTION_MAXNAMELEN];
1560                 compat_uptr_t ptr;
1561         } u;
1562         compat_uint_t match_size;
1563         compat_uint_t data[0];
1564 };
1565
1566 /* account for possible padding between match_size and ->data */
1567 static int ebt_compat_entry_padsize(void)
1568 {
1569         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1570                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1571         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1572                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1573 }
1574
1575 static int ebt_compat_match_offset(const struct xt_match *match,
1576                                    unsigned int userlen)
1577 {
1578         /*
1579          * ebt_among needs special handling. The kernel .matchsize is
1580          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1581          * value is expected.
1582          * Example: userspace sends 4500, ebt_among.c wants 4504.
1583          */
1584         if (unlikely(match->matchsize == -1))
1585                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1586         return xt_compat_match_offset(match);
1587 }
1588
1589 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1590                                 unsigned int *size)
1591 {
1592         const struct xt_match *match = m->u.match;
1593         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1594         int off = ebt_compat_match_offset(match, m->match_size);
1595         compat_uint_t msize = m->match_size - off;
1596
1597         BUG_ON(off >= m->match_size);
1598
1599         if (copy_to_user(cm->u.name, match->name,
1600             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1601                 return -EFAULT;
1602
1603         if (match->compat_to_user) {
1604                 if (match->compat_to_user(cm->data, m->data))
1605                         return -EFAULT;
1606         } else if (copy_to_user(cm->data, m->data, msize))
1607                         return -EFAULT;
1608
1609         *size -= ebt_compat_entry_padsize() + off;
1610         *dstptr = cm->data;
1611         *dstptr += msize;
1612         return 0;
1613 }
1614
1615 static int compat_target_to_user(struct ebt_entry_target *t,
1616                                  void __user **dstptr,
1617                                  unsigned int *size)
1618 {
1619         const struct xt_target *target = t->u.target;
1620         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1621         int off = xt_compat_target_offset(target);
1622         compat_uint_t tsize = t->target_size - off;
1623
1624         BUG_ON(off >= t->target_size);
1625
1626         if (copy_to_user(cm->u.name, target->name,
1627             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1628                 return -EFAULT;
1629
1630         if (target->compat_to_user) {
1631                 if (target->compat_to_user(cm->data, t->data))
1632                         return -EFAULT;
1633         } else if (copy_to_user(cm->data, t->data, tsize))
1634                 return -EFAULT;
1635
1636         *size -= ebt_compat_entry_padsize() + off;
1637         *dstptr = cm->data;
1638         *dstptr += tsize;
1639         return 0;
1640 }
1641
1642 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1643                                   void __user **dstptr,
1644                                   unsigned int *size)
1645 {
1646         return compat_target_to_user((struct ebt_entry_target *)w,
1647                                                         dstptr, size);
1648 }
1649
1650 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1651                                 unsigned int *size)
1652 {
1653         struct ebt_entry_target *t;
1654         struct ebt_entry __user *ce;
1655         u32 watchers_offset, target_offset, next_offset;
1656         compat_uint_t origsize;
1657         int ret;
1658
1659         if (e->bitmask == 0) {
1660                 if (*size < sizeof(struct ebt_entries))
1661                         return -EINVAL;
1662                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1663                         return -EFAULT;
1664
1665                 *dstptr += sizeof(struct ebt_entries);
1666                 *size -= sizeof(struct ebt_entries);
1667                 return 0;
1668         }
1669
1670         if (*size < sizeof(*ce))
1671                 return -EINVAL;
1672
1673         ce = (struct ebt_entry __user *)*dstptr;
1674         if (copy_to_user(ce, e, sizeof(*ce)))
1675                 return -EFAULT;
1676
1677         origsize = *size;
1678         *dstptr += sizeof(*ce);
1679
1680         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1681         if (ret)
1682                 return ret;
1683         watchers_offset = e->watchers_offset - (origsize - *size);
1684
1685         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1686         if (ret)
1687                 return ret;
1688         target_offset = e->target_offset - (origsize - *size);
1689
1690         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1691
1692         ret = compat_target_to_user(t, dstptr, size);
1693         if (ret)
1694                 return ret;
1695         next_offset = e->next_offset - (origsize - *size);
1696
1697         if (put_user(watchers_offset, &ce->watchers_offset) ||
1698             put_user(target_offset, &ce->target_offset) ||
1699             put_user(next_offset, &ce->next_offset))
1700                 return -EFAULT;
1701
1702         *size -= sizeof(*ce);
1703         return 0;
1704 }
1705
1706 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1707 {
1708         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1709         *off += ebt_compat_entry_padsize();
1710         return 0;
1711 }
1712
1713 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1714 {
1715         *off += xt_compat_target_offset(w->u.watcher);
1716         *off += ebt_compat_entry_padsize();
1717         return 0;
1718 }
1719
1720 static int compat_calc_entry(const struct ebt_entry *e,
1721                              const struct ebt_table_info *info,
1722                              const void *base,
1723                              struct compat_ebt_replace *newinfo)
1724 {
1725         const struct ebt_entry_target *t;
1726         unsigned int entry_offset;
1727         int off, ret, i;
1728
1729         if (e->bitmask == 0)
1730                 return 0;
1731
1732         off = 0;
1733         entry_offset = (void *)e - base;
1734
1735         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1736         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1737
1738         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1739
1740         off += xt_compat_target_offset(t->u.target);
1741         off += ebt_compat_entry_padsize();
1742
1743         newinfo->entries_size -= off;
1744
1745         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1746         if (ret)
1747                 return ret;
1748
1749         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1750                 const void *hookptr = info->hook_entry[i];
1751                 if (info->hook_entry[i] &&
1752                     (e < (struct ebt_entry *)(base - hookptr))) {
1753                         newinfo->hook_entry[i] -= off;
1754                         pr_debug("0x%08X -> 0x%08X\n",
1755                                         newinfo->hook_entry[i] + off,
1756                                         newinfo->hook_entry[i]);
1757                 }
1758         }
1759
1760         return 0;
1761 }
1762
1763
1764 static int compat_table_info(const struct ebt_table_info *info,
1765                              struct compat_ebt_replace *newinfo)
1766 {
1767         unsigned int size = info->entries_size;
1768         const void *entries = info->entries;
1769
1770         newinfo->entries_size = size;
1771
1772         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1773                                                         entries, newinfo);
1774 }
1775
1776 static int compat_copy_everything_to_user(struct ebt_table *t,
1777                                           void __user *user, int *len, int cmd)
1778 {
1779         struct compat_ebt_replace repl, tmp;
1780         struct ebt_counter *oldcounters;
1781         struct ebt_table_info tinfo;
1782         int ret;
1783         void __user *pos;
1784
1785         memset(&tinfo, 0, sizeof(tinfo));
1786
1787         if (cmd == EBT_SO_GET_ENTRIES) {
1788                 tinfo.entries_size = t->private->entries_size;
1789                 tinfo.nentries = t->private->nentries;
1790                 tinfo.entries = t->private->entries;
1791                 oldcounters = t->private->counters;
1792         } else {
1793                 tinfo.entries_size = t->table->entries_size;
1794                 tinfo.nentries = t->table->nentries;
1795                 tinfo.entries = t->table->entries;
1796                 oldcounters = t->table->counters;
1797         }
1798
1799         if (copy_from_user(&tmp, user, sizeof(tmp)))
1800                 return -EFAULT;
1801
1802         if (tmp.nentries != tinfo.nentries ||
1803            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1804                 return -EINVAL;
1805
1806         memcpy(&repl, &tmp, sizeof(repl));
1807         if (cmd == EBT_SO_GET_ENTRIES)
1808                 ret = compat_table_info(t->private, &repl);
1809         else
1810                 ret = compat_table_info(&tinfo, &repl);
1811         if (ret)
1812                 return ret;
1813
1814         if (*len != sizeof(tmp) + repl.entries_size +
1815            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1816                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1817                                 *len, tinfo.entries_size, repl.entries_size);
1818                 return -EINVAL;
1819         }
1820
1821         /* userspace might not need the counters */
1822         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1823                                         tmp.num_counters, tinfo.nentries);
1824         if (ret)
1825                 return ret;
1826
1827         pos = compat_ptr(tmp.entries);
1828         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1829                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1830 }
1831
1832 struct ebt_entries_buf_state {
1833         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1834         u32 buf_kern_len;       /* total size of kernel buffer */
1835         u32 buf_kern_offset;    /* amount of data copied so far */
1836         u32 buf_user_offset;    /* read position in userspace buffer */
1837 };
1838
1839 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1840 {
1841         state->buf_kern_offset += sz;
1842         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1843 }
1844
1845 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1846                        void *data, unsigned int sz)
1847 {
1848         if (state->buf_kern_start == NULL)
1849                 goto count_only;
1850
1851         BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1852
1853         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1854
1855  count_only:
1856         state->buf_user_offset += sz;
1857         return ebt_buf_count(state, sz);
1858 }
1859
1860 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1861 {
1862         char *b = state->buf_kern_start;
1863
1864         BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1865
1866         if (b != NULL && sz > 0)
1867                 memset(b + state->buf_kern_offset, 0, sz);
1868         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1869         return ebt_buf_count(state, sz);
1870 }
1871
1872 enum compat_mwt {
1873         EBT_COMPAT_MATCH,
1874         EBT_COMPAT_WATCHER,
1875         EBT_COMPAT_TARGET,
1876 };
1877
1878 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1879                                 enum compat_mwt compat_mwt,
1880                                 struct ebt_entries_buf_state *state,
1881                                 const unsigned char *base)
1882 {
1883         char name[EBT_FUNCTION_MAXNAMELEN];
1884         struct xt_match *match;
1885         struct xt_target *wt;
1886         void *dst = NULL;
1887         int off, pad = 0, ret = 0;
1888         unsigned int size_kern, entry_offset, match_size = mwt->match_size;
1889
1890         strlcpy(name, mwt->u.name, sizeof(name));
1891
1892         if (state->buf_kern_start)
1893                 dst = state->buf_kern_start + state->buf_kern_offset;
1894
1895         entry_offset = (unsigned char *) mwt - base;
1896         switch (compat_mwt) {
1897         case EBT_COMPAT_MATCH:
1898                 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
1899                                                 name, 0), "ebt_%s", name);
1900                 if (match == NULL)
1901                         return -ENOENT;
1902                 if (IS_ERR(match))
1903                         return PTR_ERR(match);
1904
1905                 off = ebt_compat_match_offset(match, match_size);
1906                 if (dst) {
1907                         if (match->compat_from_user)
1908                                 match->compat_from_user(dst, mwt->data);
1909                         else
1910                                 memcpy(dst, mwt->data, match_size);
1911                 }
1912
1913                 size_kern = match->matchsize;
1914                 if (unlikely(size_kern == -1))
1915                         size_kern = match_size;
1916                 module_put(match->me);
1917                 break;
1918         case EBT_COMPAT_WATCHER: /* fallthrough */
1919         case EBT_COMPAT_TARGET:
1920                 wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
1921                                                 name, 0), "ebt_%s", name);
1922                 if (wt == NULL)
1923                         return -ENOENT;
1924                 if (IS_ERR(wt))
1925                         return PTR_ERR(wt);
1926                 off = xt_compat_target_offset(wt);
1927
1928                 if (dst) {
1929                         if (wt->compat_from_user)
1930                                 wt->compat_from_user(dst, mwt->data);
1931                         else
1932                                 memcpy(dst, mwt->data, match_size);
1933                 }
1934
1935                 size_kern = wt->targetsize;
1936                 module_put(wt->me);
1937                 break;
1938         }
1939
1940         if (!dst) {
1941                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1942                                         off + ebt_compat_entry_padsize());
1943                 if (ret < 0)
1944                         return ret;
1945         }
1946
1947         state->buf_kern_offset += match_size + off;
1948         state->buf_user_offset += match_size;
1949         pad = XT_ALIGN(size_kern) - size_kern;
1950
1951         if (pad > 0 && dst) {
1952                 BUG_ON(state->buf_kern_len <= pad);
1953                 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1954                 memset(dst + size_kern, 0, pad);
1955         }
1956         return off + match_size;
1957 }
1958
1959 /*
1960  * return size of all matches, watchers or target, including necessary
1961  * alignment and padding.
1962  */
1963 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1964                         unsigned int size_left, enum compat_mwt type,
1965                         struct ebt_entries_buf_state *state, const void *base)
1966 {
1967         int growth = 0;
1968         char *buf;
1969
1970         if (size_left == 0)
1971                 return 0;
1972
1973         buf = (char *) match32;
1974
1975         while (size_left >= sizeof(*match32)) {
1976                 struct ebt_entry_match *match_kern;
1977                 int ret;
1978
1979                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1980                 if (match_kern) {
1981                         char *tmp;
1982                         tmp = state->buf_kern_start + state->buf_kern_offset;
1983                         match_kern = (struct ebt_entry_match *) tmp;
1984                 }
1985                 ret = ebt_buf_add(state, buf, sizeof(*match32));
1986                 if (ret < 0)
1987                         return ret;
1988                 size_left -= sizeof(*match32);
1989
1990                 /* add padding before match->data (if any) */
1991                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1992                 if (ret < 0)
1993                         return ret;
1994
1995                 if (match32->match_size > size_left)
1996                         return -EINVAL;
1997
1998                 size_left -= match32->match_size;
1999
2000                 ret = compat_mtw_from_user(match32, type, state, base);
2001                 if (ret < 0)
2002                         return ret;
2003
2004                 BUG_ON(ret < match32->match_size);
2005                 growth += ret - match32->match_size;
2006                 growth += ebt_compat_entry_padsize();
2007
2008                 buf += sizeof(*match32);
2009                 buf += match32->match_size;
2010
2011                 if (match_kern)
2012                         match_kern->match_size = ret;
2013
2014                 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2015                 match32 = (struct compat_ebt_entry_mwt *) buf;
2016         }
2017
2018         return growth;
2019 }
2020
2021 #define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...)          \
2022 ({                                                          \
2023         unsigned int __i;                                   \
2024         int __ret = 0;                                      \
2025         struct compat_ebt_entry_mwt *__watcher;             \
2026                                                             \
2027         for (__i = e->watchers_offset;                      \
2028              __i < (e)->target_offset;                      \
2029              __i += __watcher->watcher_size +               \
2030              sizeof(struct compat_ebt_entry_mwt)) {         \
2031                 __watcher = (void *)(e) + __i;              \
2032                 __ret = fn(__watcher , ## args);            \
2033                 if (__ret != 0)                             \
2034                         break;                              \
2035         }                                                   \
2036         if (__ret == 0) {                                   \
2037                 if (__i != (e)->target_offset)              \
2038                         __ret = -EINVAL;                    \
2039         }                                                   \
2040         __ret;                                              \
2041 })
2042
2043 #define EBT_COMPAT_MATCH_ITERATE(e, fn, args...)            \
2044 ({                                                          \
2045         unsigned int __i;                                   \
2046         int __ret = 0;                                      \
2047         struct compat_ebt_entry_mwt *__match;               \
2048                                                             \
2049         for (__i = sizeof(struct ebt_entry);                \
2050              __i < (e)->watchers_offset;                    \
2051              __i += __match->match_size +                   \
2052              sizeof(struct compat_ebt_entry_mwt)) {         \
2053                 __match = (void *)(e) + __i;                \
2054                 __ret = fn(__match , ## args);              \
2055                 if (__ret != 0)                             \
2056                         break;                              \
2057         }                                                   \
2058         if (__ret == 0) {                                   \
2059                 if (__i != (e)->watchers_offset)            \
2060                         __ret = -EINVAL;                    \
2061         }                                                   \
2062         __ret;                                              \
2063 })
2064
2065 /* called for all ebt_entry structures. */
2066 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2067                           unsigned int *total,
2068                           struct ebt_entries_buf_state *state)
2069 {
2070         unsigned int i, j, startoff, new_offset = 0;
2071         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2072         unsigned int offsets[4];
2073         unsigned int *offsets_update = NULL;
2074         int ret;
2075         char *buf_start;
2076
2077         if (*total < sizeof(struct ebt_entries))
2078                 return -EINVAL;
2079
2080         if (!entry->bitmask) {
2081                 *total -= sizeof(struct ebt_entries);
2082                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2083         }
2084         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2085                 return -EINVAL;
2086
2087         startoff = state->buf_user_offset;
2088         /* pull in most part of ebt_entry, it does not need to be changed. */
2089         ret = ebt_buf_add(state, entry,
2090                         offsetof(struct ebt_entry, watchers_offset));
2091         if (ret < 0)
2092                 return ret;
2093
2094         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2095         memcpy(&offsets[1], &entry->watchers_offset,
2096                         sizeof(offsets) - sizeof(offsets[0]));
2097
2098         if (state->buf_kern_start) {
2099                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2100                 offsets_update = (unsigned int *) buf_start;
2101         }
2102         ret = ebt_buf_add(state, &offsets[1],
2103                         sizeof(offsets) - sizeof(offsets[0]));
2104         if (ret < 0)
2105                 return ret;
2106         buf_start = (char *) entry;
2107         /*
2108          * 0: matches offset, always follows ebt_entry.
2109          * 1: watchers offset, from ebt_entry structure
2110          * 2: target offset, from ebt_entry structure
2111          * 3: next ebt_entry offset, from ebt_entry structure
2112          *
2113          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2114          */
2115         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2116                 struct compat_ebt_entry_mwt *match32;
2117                 unsigned int size;
2118                 char *buf = buf_start;
2119
2120                 buf = buf_start + offsets[i];
2121                 if (offsets[i] > offsets[j])
2122                         return -EINVAL;
2123
2124                 match32 = (struct compat_ebt_entry_mwt *) buf;
2125                 size = offsets[j] - offsets[i];
2126                 ret = ebt_size_mwt(match32, size, i, state, base);
2127                 if (ret < 0)
2128                         return ret;
2129                 new_offset += ret;
2130                 if (offsets_update && new_offset) {
2131                         pr_debug("ebtables: change offset %d to %d\n",
2132                                 offsets_update[i], offsets[j] + new_offset);
2133                         offsets_update[i] = offsets[j] + new_offset;
2134                 }
2135         }
2136
2137         startoff = state->buf_user_offset - startoff;
2138
2139         BUG_ON(*total < startoff);
2140         *total -= startoff;
2141         return 0;
2142 }
2143
2144 /*
2145  * repl->entries_size is the size of the ebt_entry blob in userspace.
2146  * It might need more memory when copied to a 64 bit kernel in case
2147  * userspace is 32-bit. So, first task: find out how much memory is needed.
2148  *
2149  * Called before validation is performed.
2150  */
2151 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2152                                 struct ebt_entries_buf_state *state)
2153 {
2154         unsigned int size_remaining = size_user;
2155         int ret;
2156
2157         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2158                                         &size_remaining, state);
2159         if (ret < 0)
2160                 return ret;
2161
2162         WARN_ON(size_remaining);
2163         return state->buf_kern_offset;
2164 }
2165
2166
2167 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2168                                             void __user *user, unsigned int len)
2169 {
2170         struct compat_ebt_replace tmp;
2171         int i;
2172
2173         if (len < sizeof(tmp))
2174                 return -EINVAL;
2175
2176         if (copy_from_user(&tmp, user, sizeof(tmp)))
2177                 return -EFAULT;
2178
2179         if (len != sizeof(tmp) + tmp.entries_size)
2180                 return -EINVAL;
2181
2182         if (tmp.entries_size == 0)
2183                 return -EINVAL;
2184
2185         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2186                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2187                 return -ENOMEM;
2188         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2189                 return -ENOMEM;
2190
2191         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2192
2193         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2194         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2195                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2196
2197         repl->num_counters = tmp.num_counters;
2198         repl->counters = compat_ptr(tmp.counters);
2199         repl->entries = compat_ptr(tmp.entries);
2200         return 0;
2201 }
2202
2203 static int compat_do_replace(struct net *net, void __user *user,
2204                              unsigned int len)
2205 {
2206         int ret, i, countersize, size64;
2207         struct ebt_table_info *newinfo;
2208         struct ebt_replace tmp;
2209         struct ebt_entries_buf_state state;
2210         void *entries_tmp;
2211
2212         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2213         if (ret) {
2214                 /* try real handler in case userland supplied needed padding */
2215                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2216                         ret = 0;
2217                 return ret;
2218         }
2219
2220         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2221         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2222         if (!newinfo)
2223                 return -ENOMEM;
2224
2225         if (countersize)
2226                 memset(newinfo->counters, 0, countersize);
2227
2228         memset(&state, 0, sizeof(state));
2229
2230         newinfo->entries = vmalloc(tmp.entries_size);
2231         if (!newinfo->entries) {
2232                 ret = -ENOMEM;
2233                 goto free_newinfo;
2234         }
2235         if (copy_from_user(
2236            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2237                 ret = -EFAULT;
2238                 goto free_entries;
2239         }
2240
2241         entries_tmp = newinfo->entries;
2242
2243         xt_compat_lock(NFPROTO_BRIDGE);
2244
2245         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2246         if (ret < 0)
2247                 goto out_unlock;
2248
2249         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2250                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2251                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2252
2253         size64 = ret;
2254         newinfo->entries = vmalloc(size64);
2255         if (!newinfo->entries) {
2256                 vfree(entries_tmp);
2257                 ret = -ENOMEM;
2258                 goto out_unlock;
2259         }
2260
2261         memset(&state, 0, sizeof(state));
2262         state.buf_kern_start = newinfo->entries;
2263         state.buf_kern_len = size64;
2264
2265         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2266         BUG_ON(ret < 0);        /* parses same data again */
2267
2268         vfree(entries_tmp);
2269         tmp.entries_size = size64;
2270
2271         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2272                 char __user *usrptr;
2273                 if (tmp.hook_entry[i]) {
2274                         unsigned int delta;
2275                         usrptr = (char __user *) tmp.hook_entry[i];
2276                         delta = usrptr - tmp.entries;
2277                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2278                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2279                 }
2280         }
2281
2282         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2283         xt_compat_unlock(NFPROTO_BRIDGE);
2284
2285         ret = do_replace_finish(net, &tmp, newinfo);
2286         if (ret == 0)
2287                 return ret;
2288 free_entries:
2289         vfree(newinfo->entries);
2290 free_newinfo:
2291         vfree(newinfo);
2292         return ret;
2293 out_unlock:
2294         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2295         xt_compat_unlock(NFPROTO_BRIDGE);
2296         goto free_entries;
2297 }
2298
2299 static int compat_update_counters(struct net *net, void __user *user,
2300                                   unsigned int len)
2301 {
2302         struct compat_ebt_replace hlp;
2303
2304         if (copy_from_user(&hlp, user, sizeof(hlp)))
2305                 return -EFAULT;
2306
2307         /* try real handler in case userland supplied needed padding */
2308         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2309                 return update_counters(net, user, len);
2310
2311         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2312                                         hlp.num_counters, user, len);
2313 }
2314
2315 static int compat_do_ebt_set_ctl(struct sock *sk,
2316                 int cmd, void __user *user, unsigned int len)
2317 {
2318         int ret;
2319
2320         if (!capable(CAP_NET_ADMIN))
2321                 return -EPERM;
2322
2323         switch (cmd) {
2324         case EBT_SO_SET_ENTRIES:
2325                 ret = compat_do_replace(sock_net(sk), user, len);
2326                 break;
2327         case EBT_SO_SET_COUNTERS:
2328                 ret = compat_update_counters(sock_net(sk), user, len);
2329                 break;
2330         default:
2331                 ret = -EINVAL;
2332   }
2333         return ret;
2334 }
2335
2336 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2337                 void __user *user, int *len)
2338 {
2339         int ret;
2340         struct compat_ebt_replace tmp;
2341         struct ebt_table *t;
2342
2343         if (!capable(CAP_NET_ADMIN))
2344                 return -EPERM;
2345
2346         /* try real handler in case userland supplied needed padding */
2347         if ((cmd == EBT_SO_GET_INFO ||
2348              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2349                         return do_ebt_get_ctl(sk, cmd, user, len);
2350
2351         if (copy_from_user(&tmp, user, sizeof(tmp)))
2352                 return -EFAULT;
2353
2354         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
2355         if (!t)
2356                 return ret;
2357
2358         xt_compat_lock(NFPROTO_BRIDGE);
2359         switch (cmd) {
2360         case EBT_SO_GET_INFO:
2361                 tmp.nentries = t->private->nentries;
2362                 ret = compat_table_info(t->private, &tmp);
2363                 if (ret)
2364                         goto out;
2365                 tmp.valid_hooks = t->valid_hooks;
2366
2367                 if (copy_to_user(user, &tmp, *len) != 0) {
2368                         ret = -EFAULT;
2369                         break;
2370                 }
2371                 ret = 0;
2372                 break;
2373         case EBT_SO_GET_INIT_INFO:
2374                 tmp.nentries = t->table->nentries;
2375                 tmp.entries_size = t->table->entries_size;
2376                 tmp.valid_hooks = t->table->valid_hooks;
2377
2378                 if (copy_to_user(user, &tmp, *len) != 0) {
2379                         ret = -EFAULT;
2380                         break;
2381                 }
2382                 ret = 0;
2383                 break;
2384         case EBT_SO_GET_ENTRIES:
2385         case EBT_SO_GET_INIT_ENTRIES:
2386                 /*
2387                  * try real handler first in case of userland-side padding.
2388                  * in case we are dealing with an 'ordinary' 32 bit binary
2389                  * without 64bit compatibility padding, this will fail right
2390                  * after copy_from_user when the *len argument is validated.
2391                  *
2392                  * the compat_ variant needs to do one pass over the kernel
2393                  * data set to adjust for size differences before it the check.
2394                  */
2395                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2396                         ret = 0;
2397                 else
2398                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2399                 break;
2400         default:
2401                 ret = -EINVAL;
2402         }
2403  out:
2404         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2405         xt_compat_unlock(NFPROTO_BRIDGE);
2406         mutex_unlock(&ebt_mutex);
2407         return ret;
2408 }
2409 #endif
2410
2411 static struct nf_sockopt_ops ebt_sockopts =
2412 {
2413         .pf             = PF_INET,
2414         .set_optmin     = EBT_BASE_CTL,
2415         .set_optmax     = EBT_SO_SET_MAX + 1,
2416         .set            = do_ebt_set_ctl,
2417 #ifdef CONFIG_COMPAT
2418         .compat_set     = compat_do_ebt_set_ctl,
2419 #endif
2420         .get_optmin     = EBT_BASE_CTL,
2421         .get_optmax     = EBT_SO_GET_MAX + 1,
2422         .get            = do_ebt_get_ctl,
2423 #ifdef CONFIG_COMPAT
2424         .compat_get     = compat_do_ebt_get_ctl,
2425 #endif
2426         .owner          = THIS_MODULE,
2427 };
2428
2429 static int __init ebtables_init(void)
2430 {
2431         int ret;
2432
2433         ret = xt_register_target(&ebt_standard_target);
2434         if (ret < 0)
2435                 return ret;
2436         ret = nf_register_sockopt(&ebt_sockopts);
2437         if (ret < 0) {
2438                 xt_unregister_target(&ebt_standard_target);
2439                 return ret;
2440         }
2441
2442         printk(KERN_INFO "Ebtables v2.0 registered\n");
2443         return 0;
2444 }
2445
2446 static void __exit ebtables_fini(void)
2447 {
2448         nf_unregister_sockopt(&ebt_sockopts);
2449         xt_unregister_target(&ebt_standard_target);
2450         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2451 }
2452
2453 EXPORT_SYMBOL(ebt_register_table);
2454 EXPORT_SYMBOL(ebt_unregister_table);
2455 EXPORT_SYMBOL(ebt_do_table);
2456 module_init(ebtables_init);
2457 module_exit(ebtables_fini);
2458 MODULE_LICENSE("GPL");