net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18 #include <linux/kmod.h>
  19 #include <linux/module.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netfilter/x_tables.h>
  22 #include <linux/netfilter_bridge/ebtables.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/mutex.h>
  25 #include <asm/uaccess.h>
  26 #include <linux/smp.h>
  27 #include <linux/cpumask.h>
  28 #include <net/sock.h>
  29 /* needed for logical [in,out]-dev filtering */
  30 #include "../br_private.h"
  31
  32 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  33                                          "report to author: "format, ## args)
  34 /* #define BUGPRINT(format, args...) */
  35
  36 /*
  37  * Each cpu has its own set of counters, so there is no need for write_lock in
  38  * the softirq
  39  * For reading or updating the counters, the user context needs to
  40  * get a write_lock
  41  */
  42
  43 /* The size of each set of counters is altered to get cache alignment */
  44 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  45 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  46 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  47    COUNTER_OFFSET(n) * cpu))
  48
  49
  50
  51 static DEFINE_MUTEX(ebt_mutex);
  52
  53 #ifdef CONFIG_COMPAT
  54 static void ebt_standard_compat_from_user(void *dst, const void *src)
  55 {
  56         int v = *(compat_int_t *)src;
  57
  58         if (v >= 0)
  59                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  60         memcpy(dst, &v, sizeof(v));
  61 }
  62
  63 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  64 {
  65         compat_int_t cv = *(int *)src;
  66
  67         if (cv >= 0)
  68                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  69         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  70 }
  71 #endif
  72
  73
  74 static struct xt_target ebt_standard_target = {
  75         .name       = "standard",
  76         .revision   = 0,
  77         .family     = NFPROTO_BRIDGE,
  78         .targetsize = sizeof(int),
  79 #ifdef CONFIG_COMPAT
  80         .compatsize = sizeof(compat_int_t),
  81         .compat_from_user = ebt_standard_compat_from_user,
  82         .compat_to_user =  ebt_standard_compat_to_user,
  83 #endif
  84 };
  85
  86 static inline int
  87 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  88                struct xt_target_param *par)
  89 {
  90         par->target   = w->u.watcher;
  91         par->targinfo = w->data;
  92         w->u.watcher->target(skb, par);
  93         /* watchers don't give a verdict */
  94         return 0;
  95 }
  96
  97 static inline int ebt_do_match (struct ebt_entry_match *m,
  98    const struct sk_buff *skb, struct xt_match_param *par)
  99 {
 100         par->match     = m->u.match;
 101         par->matchinfo = m->data;
 102         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 103 }
 104
 105 static inline int
 106 ebt_dev_check(const char *entry, const struct net_device *device)
 107 {
 108         int i = 0;
 109         const char *devname;
 110
 111         if (*entry == '\0')
 112                 return 0;
 113         if (!device)
 114                 return 1;
 115         devname = device->name;
 116         /* 1 is the wildcard token */
 117         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 118                 i++;
 119         return (devname[i] != entry[i] && entry[i] != 1);
 120 }
 121
 122 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 123 /* process standard matches */
 124 static inline int
 125 ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
 126                 const struct net_device *in, const struct net_device *out)
 127 {
 128         int verdict, i;
 129
 130         if (e->bitmask & EBT_802_3) {
 131                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 132                         return 1;
 133         } else if (!(e->bitmask & EBT_NOPROTO) &&
 134            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 135                 return 1;
 136
 137         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 138                 return 1;
 139         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 140                 return 1;
 141         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 142            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 143                 return 1;
 144         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 145            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 146                 return 1;
 147
 148         if (e->bitmask & EBT_SOURCEMAC) {
 149                 verdict = 0;
 150                 for (i = 0; i < 6; i++)
 151                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 152                            e->sourcemsk[i];
 153                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 154                         return 1;
 155         }
 156         if (e->bitmask & EBT_DESTMAC) {
 157                 verdict = 0;
 158                 for (i = 0; i < 6; i++)
 159                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 160                            e->destmsk[i];
 161                 if (FWINV2(verdict != 0, EBT_IDEST) )
 162                         return 1;
 163         }
 164         return 0;
 165 }
 166
 167 static inline __pure
 168 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 169 {
 170         return (void *)entry + entry->next_offset;
 171 }
 172
 173 /* Do some firewalling */
 174 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 175    const struct net_device *in, const struct net_device *out,
 176    struct ebt_table *table)
 177 {
 178         int i, nentries;
 179         struct ebt_entry *point;
 180         struct ebt_counter *counter_base, *cb_base;
 181         const struct ebt_entry_target *t;
 182         int verdict, sp = 0;
 183         struct ebt_chainstack *cs;
 184         struct ebt_entries *chaininfo;
 185         const char *base;
 186         const struct ebt_table_info *private;
 187         bool hotdrop = false;
 188         struct xt_match_param mtpar;
 189         struct xt_target_param tgpar;
 190
 191         mtpar.family  = tgpar.family = NFPROTO_BRIDGE;
 192         mtpar.in      = tgpar.in  = in;
 193         mtpar.out     = tgpar.out = out;
 194         mtpar.hotdrop = &hotdrop;
 195         mtpar.hooknum = tgpar.hooknum = hook;
 196
 197         read_lock_bh(&table->lock);
 198         private = table->private;
 199         cb_base = COUNTER_BASE(private->counters, private->nentries,
 200            smp_processor_id());
 201         if (private->chainstack)
 202                 cs = private->chainstack[smp_processor_id()];
 203         else
 204                 cs = NULL;
 205         chaininfo = private->hook_entry[hook];
 206         nentries = private->hook_entry[hook]->nentries;
 207         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 208         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 209         /* base for chain jumps */
 210         base = private->entries;
 211         i = 0;
 212         while (i < nentries) {
 213                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 214                         goto letscontinue;
 215
 216                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
 217                         goto letscontinue;
 218                 if (hotdrop) {
 219                         read_unlock_bh(&table->lock);
 220                         return NF_DROP;
 221                 }
 222
 223                 /* increase counter */
 224                 (*(counter_base + i)).pcnt++;
 225                 (*(counter_base + i)).bcnt += skb->len;
 226
 227                 /* these should only watch: not modify, nor tell us
 228                    what to do with the packet */
 229                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &tgpar);
 230
 231                 t = (struct ebt_entry_target *)
 232                    (((char *)point) + point->target_offset);
 233                 /* standard target */
 234                 if (!t->u.target->target)
 235                         verdict = ((struct ebt_standard_target *)t)->verdict;
 236                 else {
 237                         tgpar.target   = t->u.target;
 238                         tgpar.targinfo = t->data;
 239                         verdict = t->u.target->target(skb, &tgpar);
 240                 }
 241                 if (verdict == EBT_ACCEPT) {
 242                         read_unlock_bh(&table->lock);
 243                         return NF_ACCEPT;
 244                 }
 245                 if (verdict == EBT_DROP) {
 246                         read_unlock_bh(&table->lock);
 247                         return NF_DROP;
 248                 }
 249                 if (verdict == EBT_RETURN) {
 250 letsreturn:
 251 #ifdef CONFIG_NETFILTER_DEBUG
 252                         if (sp == 0) {
 253                                 BUGPRINT("RETURN on base chain");
 254                                 /* act like this is EBT_CONTINUE */
 255                                 goto letscontinue;
 256                         }
 257 #endif
 258                         sp--;
 259                         /* put all the local variables right */
 260                         i = cs[sp].n;
 261                         chaininfo = cs[sp].chaininfo;
 262                         nentries = chaininfo->nentries;
 263                         point = cs[sp].e;
 264                         counter_base = cb_base +
 265                            chaininfo->counter_offset;
 266                         continue;
 267                 }
 268                 if (verdict == EBT_CONTINUE)
 269                         goto letscontinue;
 270 #ifdef CONFIG_NETFILTER_DEBUG
 271                 if (verdict < 0) {
 272                         BUGPRINT("bogus standard verdict\n");
 273                         read_unlock_bh(&table->lock);
 274                         return NF_DROP;
 275                 }
 276 #endif
 277                 /* jump to a udc */
 278                 cs[sp].n = i + 1;
 279                 cs[sp].chaininfo = chaininfo;
 280                 cs[sp].e = ebt_next_entry(point);
 281                 i = 0;
 282                 chaininfo = (struct ebt_entries *) (base + verdict);
 283 #ifdef CONFIG_NETFILTER_DEBUG
 284                 if (chaininfo->distinguisher) {
 285                         BUGPRINT("jump to non-chain\n");
 286                         read_unlock_bh(&table->lock);
 287                         return NF_DROP;
 288                 }
 289 #endif
 290                 nentries = chaininfo->nentries;
 291                 point = (struct ebt_entry *)chaininfo->data;
 292                 counter_base = cb_base + chaininfo->counter_offset;
 293                 sp++;
 294                 continue;
 295 letscontinue:
 296                 point = ebt_next_entry(point);
 297                 i++;
 298         }
 299
 300         /* I actually like this :) */
 301         if (chaininfo->policy == EBT_RETURN)
 302                 goto letsreturn;
 303         if (chaininfo->policy == EBT_ACCEPT) {
 304                 read_unlock_bh(&table->lock);
 305                 return NF_ACCEPT;
 306         }
 307         read_unlock_bh(&table->lock);
 308         return NF_DROP;
 309 }
 310
 311 /* If it succeeds, returns element and locks mutex */
 312 static inline void *
 313 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 314    struct mutex *mutex)
 315 {
 316         struct {
 317                 struct list_head list;
 318                 char name[EBT_FUNCTION_MAXNAMELEN];
 319         } *e;
 320
 321         *error = mutex_lock_interruptible(mutex);
 322         if (*error != 0)
 323                 return NULL;
 324
 325         list_for_each_entry(e, head, list) {
 326                 if (strcmp(e->name, name) == 0)
 327                         return e;
 328         }
 329         *error = -ENOENT;
 330         mutex_unlock(mutex);
 331         return NULL;
 332 }
 333
 334 static void *
 335 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 336    int *error, struct mutex *mutex)
 337 {
 338         return try_then_request_module(
 339                         find_inlist_lock_noload(head, name, error, mutex),
 340                         "%s%s", prefix, name);
 341 }
 342
 343 static inline struct ebt_table *
 344 find_table_lock(struct net *net, const char *name, int *error,
 345                 struct mutex *mutex)
 346 {
 347         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 348                                 "ebtable_", error, mutex);
 349 }
 350
 351 static inline int
 352 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 353                 unsigned int *cnt)
 354 {
 355         const struct ebt_entry *e = par->entryinfo;
 356         struct xt_match *match;
 357         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 358         int ret;
 359
 360         if (left < sizeof(struct ebt_entry_match) ||
 361             left - sizeof(struct ebt_entry_match) < m->match_size)
 362                 return -EINVAL;
 363
 364         match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
 365                 m->u.name, 0), "ebt_%s", m->u.name);
 366         if (IS_ERR(match))
 367                 return PTR_ERR(match);
 368         if (match == NULL)
 369                 return -ENOENT;
 370         m->u.match = match;
 371
 372         par->match     = match;
 373         par->matchinfo = m->data;
 374         ret = xt_check_match(par, m->match_size,
 375               e->ethproto, e->invflags & EBT_IPROTO);
 376         if (ret < 0) {
 377                 module_put(match->me);
 378                 return ret;
 379         }
 380
 381         (*cnt)++;
 382         return 0;
 383 }
 384
 385 static inline int
 386 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 387                   unsigned int *cnt)
 388 {
 389         const struct ebt_entry *e = par->entryinfo;
 390         struct xt_target *watcher;
 391         size_t left = ((char *)e + e->target_offset) - (char *)w;
 392         int ret;
 393
 394         if (left < sizeof(struct ebt_entry_watcher) ||
 395            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 396                 return -EINVAL;
 397
 398         watcher = try_then_request_module(
 399                   xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
 400                   "ebt_%s", w->u.name);
 401         if (IS_ERR(watcher))
 402                 return PTR_ERR(watcher);
 403         if (watcher == NULL)
 404                 return -ENOENT;
 405         w->u.watcher = watcher;
 406
 407         par->target   = watcher;
 408         par->targinfo = w->data;
 409         ret = xt_check_target(par, w->watcher_size,
 410               e->ethproto, e->invflags & EBT_IPROTO);
 411         if (ret < 0) {
 412                 module_put(watcher->me);
 413                 return ret;
 414         }
 415
 416         (*cnt)++;
 417         return 0;
 418 }
 419
 420 static int ebt_verify_pointers(const struct ebt_replace *repl,
 421                                struct ebt_table_info *newinfo)
 422 {
 423         unsigned int limit = repl->entries_size;
 424         unsigned int valid_hooks = repl->valid_hooks;
 425         unsigned int offset = 0;
 426         int i;
 427
 428         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 429                 newinfo->hook_entry[i] = NULL;
 430
 431         newinfo->entries_size = repl->entries_size;
 432         newinfo->nentries = repl->nentries;
 433
 434         while (offset < limit) {
 435                 size_t left = limit - offset;
 436                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 437
 438                 if (left < sizeof(unsigned int))
 439                         break;
 440
 441                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 442                         if ((valid_hooks & (1 << i)) == 0)
 443                                 continue;
 444                         if ((char __user *)repl->hook_entry[i] ==
 445                              repl->entries + offset)
 446                                 break;
 447                 }
 448
 449                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 450                         if (e->bitmask != 0) {
 451                                 /* we make userspace set this right,
 452                                    so there is no misunderstanding */
 453                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 454                                          "in distinguisher\n");
 455                                 return -EINVAL;
 456                         }
 457                         if (i != NF_BR_NUMHOOKS)
 458                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 459                         if (left < sizeof(struct ebt_entries))
 460                                 break;
 461                         offset += sizeof(struct ebt_entries);
 462                 } else {
 463                         if (left < sizeof(struct ebt_entry))
 464                                 break;
 465                         if (left < e->next_offset)
 466                                 break;
 467                         if (e->next_offset < sizeof(struct ebt_entry))
 468                                 return -EINVAL;
 469                         offset += e->next_offset;
 470                 }
 471         }
 472         if (offset != limit) {
 473                 BUGPRINT("entries_size too small\n");
 474                 return -EINVAL;
 475         }
 476
 477         /* check if all valid hooks have a chain */
 478         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 479                 if (!newinfo->hook_entry[i] &&
 480                    (valid_hooks & (1 << i))) {
 481                         BUGPRINT("Valid hook without chain\n");
 482                         return -EINVAL;
 483                 }
 484         }
 485         return 0;
 486 }
 487
 488 /*
 489  * this one is very careful, as it is the first function
 490  * to parse the userspace data
 491  */
 492 static inline int
 493 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 494    const struct ebt_table_info *newinfo,
 495    unsigned int *n, unsigned int *cnt,
 496    unsigned int *totalcnt, unsigned int *udc_cnt)
 497 {
 498         int i;
 499
 500         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 501                 if ((void *)e == (void *)newinfo->hook_entry[i])
 502                         break;
 503         }
 504         /* beginning of a new chain
 505            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 506         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 507                 /* this checks if the previous chain has as many entries
 508                    as it said it has */
 509                 if (*n != *cnt) {
 510                         BUGPRINT("nentries does not equal the nr of entries "
 511                                  "in the chain\n");
 512                         return -EINVAL;
 513                 }
 514                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 515                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 516                         /* only RETURN from udc */
 517                         if (i != NF_BR_NUMHOOKS ||
 518                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 519                                 BUGPRINT("bad policy\n");
 520                                 return -EINVAL;
 521                         }
 522                 }
 523                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 524                         (*udc_cnt)++;
 525                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 526                         BUGPRINT("counter_offset != totalcnt");
 527                         return -EINVAL;
 528                 }
 529                 *n = ((struct ebt_entries *)e)->nentries;
 530                 *cnt = 0;
 531                 return 0;
 532         }
 533         /* a plain old entry, heh */
 534         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 535            e->watchers_offset > e->target_offset ||
 536            e->target_offset >= e->next_offset) {
 537                 BUGPRINT("entry offsets not in right order\n");
 538                 return -EINVAL;
 539         }
 540         /* this is not checked anywhere else */
 541         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 542                 BUGPRINT("target size too small\n");
 543                 return -EINVAL;
 544         }
 545         (*cnt)++;
 546         (*totalcnt)++;
 547         return 0;
 548 }
 549
 550 struct ebt_cl_stack
 551 {
 552         struct ebt_chainstack cs;
 553         int from;
 554         unsigned int hookmask;
 555 };
 556
 557 /*
 558  * we need these positions to check that the jumps to a different part of the
 559  * entries is a jump to the beginning of a new chain.
 560  */
 561 static inline int
 562 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 563    unsigned int *n, struct ebt_cl_stack *udc)
 564 {
 565         int i;
 566
 567         /* we're only interested in chain starts */
 568         if (e->bitmask)
 569                 return 0;
 570         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 571                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 572                         break;
 573         }
 574         /* only care about udc */
 575         if (i != NF_BR_NUMHOOKS)
 576                 return 0;
 577
 578         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 579         /* these initialisations are depended on later in check_chainloops() */
 580         udc[*n].cs.n = 0;
 581         udc[*n].hookmask = 0;
 582
 583         (*n)++;
 584         return 0;
 585 }
 586
 587 static inline int
 588 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 589 {
 590         struct xt_mtdtor_param par;
 591
 592         if (i && (*i)-- == 0)
 593                 return 1;
 594
 595         par.net       = net;
 596         par.match     = m->u.match;
 597         par.matchinfo = m->data;
 598         par.family    = NFPROTO_BRIDGE;
 599         if (par.match->destroy != NULL)
 600                 par.match->destroy(&par);
 601         module_put(par.match->me);
 602         return 0;
 603 }
 604
 605 static inline int
 606 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 607 {
 608         struct xt_tgdtor_param par;
 609
 610         if (i && (*i)-- == 0)
 611                 return 1;
 612
 613         par.net      = net;
 614         par.target   = w->u.watcher;
 615         par.targinfo = w->data;
 616         par.family   = NFPROTO_BRIDGE;
 617         if (par.target->destroy != NULL)
 618                 par.target->destroy(&par);
 619         module_put(par.target->me);
 620         return 0;
 621 }
 622
 623 static inline int
 624 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 625 {
 626         struct xt_tgdtor_param par;
 627         struct ebt_entry_target *t;
 628
 629         if (e->bitmask == 0)
 630                 return 0;
 631         /* we're done */
 632         if (cnt && (*cnt)-- == 0)
 633                 return 1;
 634         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 635         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 636         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 637
 638         par.net      = net;
 639         par.target   = t->u.target;
 640         par.targinfo = t->data;
 641         par.family   = NFPROTO_BRIDGE;
 642         if (par.target->destroy != NULL)
 643                 par.target->destroy(&par);
 644         module_put(par.target->me);
 645         return 0;
 646 }
 647
 648 static inline int
 649 ebt_check_entry(struct ebt_entry *e, struct net *net,
 650    const struct ebt_table_info *newinfo,
 651    const char *name, unsigned int *cnt,
 652    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 653 {
 654         struct ebt_entry_target *t;
 655         struct xt_target *target;
 656         unsigned int i, j, hook = 0, hookmask = 0;
 657         size_t gap;
 658         int ret;
 659         struct xt_mtchk_param mtpar;
 660         struct xt_tgchk_param tgpar;
 661
 662         /* don't mess with the struct ebt_entries */
 663         if (e->bitmask == 0)
 664                 return 0;
 665
 666         if (e->bitmask & ~EBT_F_MASK) {
 667                 BUGPRINT("Unknown flag for bitmask\n");
 668                 return -EINVAL;
 669         }
 670         if (e->invflags & ~EBT_INV_MASK) {
 671                 BUGPRINT("Unknown flag for inv bitmask\n");
 672                 return -EINVAL;
 673         }
 674         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 675                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 676                 return -EINVAL;
 677         }
 678         /* what hook do we belong to? */
 679         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 680                 if (!newinfo->hook_entry[i])
 681                         continue;
 682                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 683                         hook = i;
 684                 else
 685                         break;
 686         }
 687         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 688            a base chain */
 689         if (i < NF_BR_NUMHOOKS)
 690                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 691         else {
 692                 for (i = 0; i < udc_cnt; i++)
 693                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 694                                 break;
 695                 if (i == 0)
 696                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 697                 else
 698                         hookmask = cl_s[i - 1].hookmask;
 699         }
 700         i = 0;
 701
 702         mtpar.net       = tgpar.net       = net;
 703         mtpar.table     = tgpar.table     = name;
 704         mtpar.entryinfo = tgpar.entryinfo = e;
 705         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 706         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 707         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 708         if (ret != 0)
 709                 goto cleanup_matches;
 710         j = 0;
 711         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 712         if (ret != 0)
 713                 goto cleanup_watchers;
 714         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 715         gap = e->next_offset - e->target_offset;
 716
 717         target = try_then_request_module(
 718                  xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
 719                  "ebt_%s", t->u.name);
 720         if (IS_ERR(target)) {
 721                 ret = PTR_ERR(target);
 722                 goto cleanup_watchers;
 723         } else if (target == NULL) {
 724                 ret = -ENOENT;
 725                 goto cleanup_watchers;
 726         }
 727
 728         t->u.target = target;
 729         if (t->u.target == &ebt_standard_target) {
 730                 if (gap < sizeof(struct ebt_standard_target)) {
 731                         BUGPRINT("Standard target size too big\n");
 732                         ret = -EFAULT;
 733                         goto cleanup_watchers;
 734                 }
 735                 if (((struct ebt_standard_target *)t)->verdict <
 736                    -NUM_STANDARD_TARGETS) {
 737                         BUGPRINT("Invalid standard target\n");
 738                         ret = -EFAULT;
 739                         goto cleanup_watchers;
 740                 }
 741         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 742                 module_put(t->u.target->me);
 743                 ret = -EFAULT;
 744                 goto cleanup_watchers;
 745         }
 746
 747         tgpar.target   = target;
 748         tgpar.targinfo = t->data;
 749         ret = xt_check_target(&tgpar, t->target_size,
 750               e->ethproto, e->invflags & EBT_IPROTO);
 751         if (ret < 0) {
 752                 module_put(target->me);
 753                 goto cleanup_watchers;
 754         }
 755         (*cnt)++;
 756         return 0;
 757 cleanup_watchers:
 758         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 759 cleanup_matches:
 760         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 761         return ret;
 762 }
 763
 764 /*
 765  * checks for loops and sets the hook mask for udc
 766  * the hook mask for udc tells us from which base chains the udc can be
 767  * accessed. This mask is a parameter to the check() functions of the extensions
 768  */
 769 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 770    unsigned int udc_cnt, unsigned int hooknr, char *base)
 771 {
 772         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 773         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 774         const struct ebt_entry_target *t;
 775
 776         while (pos < nentries || chain_nr != -1) {
 777                 /* end of udc, go back one 'recursion' step */
 778                 if (pos == nentries) {
 779                         /* put back values of the time when this chain was called */
 780                         e = cl_s[chain_nr].cs.e;
 781                         if (cl_s[chain_nr].from != -1)
 782                                 nentries =
 783                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 784                         else
 785                                 nentries = chain->nentries;
 786                         pos = cl_s[chain_nr].cs.n;
 787                         /* make sure we won't see a loop that isn't one */
 788                         cl_s[chain_nr].cs.n = 0;
 789                         chain_nr = cl_s[chain_nr].from;
 790                         if (pos == nentries)
 791                                 continue;
 792                 }
 793                 t = (struct ebt_entry_target *)
 794                    (((char *)e) + e->target_offset);
 795                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 796                         goto letscontinue;
 797                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 798                    e->next_offset) {
 799                         BUGPRINT("Standard target size too big\n");
 800                         return -1;
 801                 }
 802                 verdict = ((struct ebt_standard_target *)t)->verdict;
 803                 if (verdict >= 0) { /* jump to another chain */
 804                         struct ebt_entries *hlp2 =
 805                            (struct ebt_entries *)(base + verdict);
 806                         for (i = 0; i < udc_cnt; i++)
 807                                 if (hlp2 == cl_s[i].cs.chaininfo)
 808                                         break;
 809                         /* bad destination or loop */
 810                         if (i == udc_cnt) {
 811                                 BUGPRINT("bad destination\n");
 812                                 return -1;
 813                         }
 814                         if (cl_s[i].cs.n) {
 815                                 BUGPRINT("loop\n");
 816                                 return -1;
 817                         }
 818                         if (cl_s[i].hookmask & (1 << hooknr))
 819                                 goto letscontinue;
 820                         /* this can't be 0, so the loop test is correct */
 821                         cl_s[i].cs.n = pos + 1;
 822                         pos = 0;
 823                         cl_s[i].cs.e = ebt_next_entry(e);
 824                         e = (struct ebt_entry *)(hlp2->data);
 825                         nentries = hlp2->nentries;
 826                         cl_s[i].from = chain_nr;
 827                         chain_nr = i;
 828                         /* this udc is accessible from the base chain for hooknr */
 829                         cl_s[i].hookmask |= (1 << hooknr);
 830                         continue;
 831                 }
 832 letscontinue:
 833                 e = ebt_next_entry(e);
 834                 pos++;
 835         }
 836         return 0;
 837 }
 838
 839 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 840 static int translate_table(struct net *net, const char *name,
 841                            struct ebt_table_info *newinfo)
 842 {
 843         unsigned int i, j, k, udc_cnt;
 844         int ret;
 845         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 846
 847         i = 0;
 848         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 849                 i++;
 850         if (i == NF_BR_NUMHOOKS) {
 851                 BUGPRINT("No valid hooks specified\n");
 852                 return -EINVAL;
 853         }
 854         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 855                 BUGPRINT("Chains don't start at beginning\n");
 856                 return -EINVAL;
 857         }
 858         /* make sure chains are ordered after each other in same order
 859            as their corresponding hooks */
 860         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 861                 if (!newinfo->hook_entry[j])
 862                         continue;
 863                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 864                         BUGPRINT("Hook order must be followed\n");
 865                         return -EINVAL;
 866                 }
 867                 i = j;
 868         }
 869
 870         /* do some early checkings and initialize some things */
 871         i = 0; /* holds the expected nr. of entries for the chain */
 872         j = 0; /* holds the up to now counted entries for the chain */
 873         k = 0; /* holds the total nr. of entries, should equal
 874                   newinfo->nentries afterwards */
 875         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 876         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 877            ebt_check_entry_size_and_hooks, newinfo,
 878            &i, &j, &k, &udc_cnt);
 879
 880         if (ret != 0)
 881                 return ret;
 882
 883         if (i != j) {
 884                 BUGPRINT("nentries does not equal the nr of entries in the "
 885                          "(last) chain\n");
 886                 return -EINVAL;
 887         }
 888         if (k != newinfo->nentries) {
 889                 BUGPRINT("Total nentries is wrong\n");
 890                 return -EINVAL;
 891         }
 892
 893         /* get the location of the udc, put them in an array
 894            while we're at it, allocate the chainstack */
 895         if (udc_cnt) {
 896                 /* this will get free'd in do_replace()/ebt_register_table()
 897                    if an error occurs */
 898                 newinfo->chainstack =
 899                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 900                 if (!newinfo->chainstack)
 901                         return -ENOMEM;
 902                 for_each_possible_cpu(i) {
 903                         newinfo->chainstack[i] =
 904                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 905                         if (!newinfo->chainstack[i]) {
 906                                 while (i)
 907                                         vfree(newinfo->chainstack[--i]);
 908                                 vfree(newinfo->chainstack);
 909                                 newinfo->chainstack = NULL;
 910                                 return -ENOMEM;
 911                         }
 912                 }
 913
 914                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 915                 if (!cl_s)
 916                         return -ENOMEM;
 917                 i = 0; /* the i'th udc */
 918                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 919                    ebt_get_udc_positions, newinfo, &i, cl_s);
 920                 /* sanity check */
 921                 if (i != udc_cnt) {
 922                         BUGPRINT("i != udc_cnt\n");
 923                         vfree(cl_s);
 924                         return -EFAULT;
 925                 }
 926         }
 927
 928         /* Check for loops */
 929         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 930                 if (newinfo->hook_entry[i])
 931                         if (check_chainloops(newinfo->hook_entry[i],
 932                            cl_s, udc_cnt, i, newinfo->entries)) {
 933                                 vfree(cl_s);
 934                                 return -EINVAL;
 935                         }
 936
 937         /* we now know the following (along with E=mc²):
 938            - the nr of entries in each chain is right
 939            - the size of the allocated space is right
 940            - all valid hooks have a corresponding chain
 941            - there are no loops
 942            - wrong data can still be on the level of a single entry
 943            - could be there are jumps to places that are not the
 944              beginning of a chain. This can only occur in chains that
 945              are not accessible from any base chains, so we don't care. */
 946
 947         /* used to know what we need to clean up if something goes wrong */
 948         i = 0;
 949         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 950            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 951         if (ret != 0) {
 952                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 953                                   ebt_cleanup_entry, net, &i);
 954         }
 955         vfree(cl_s);
 956         return ret;
 957 }
 958
 959 /* called under write_lock */
 960 static void get_counters(const struct ebt_counter *oldcounters,
 961    struct ebt_counter *counters, unsigned int nentries)
 962 {
 963         int i, cpu;
 964         struct ebt_counter *counter_base;
 965
 966         /* counters of cpu 0 */
 967         memcpy(counters, oldcounters,
 968                sizeof(struct ebt_counter) * nentries);
 969
 970         /* add other counters to those of cpu 0 */
 971         for_each_possible_cpu(cpu) {
 972                 if (cpu == 0)
 973                         continue;
 974                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 975                 for (i = 0; i < nentries; i++) {
 976                         counters[i].pcnt += counter_base[i].pcnt;
 977                         counters[i].bcnt += counter_base[i].bcnt;
 978                 }
 979         }
 980 }
 981
 982 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 983                               struct ebt_table_info *newinfo)
 984 {
 985         int ret, i;
 986         struct ebt_counter *counterstmp = NULL;
 987         /* used to be able to unlock earlier */
 988         struct ebt_table_info *table;
 989         struct ebt_table *t;
 990
 991         /* the user wants counters back
 992            the check on the size is done later, when we have the lock */
 993         if (repl->num_counters) {
 994                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
 995                 counterstmp = vmalloc(size);
 996                 if (!counterstmp)
 997                         return -ENOMEM;
 998         }
 999
1000         newinfo->chainstack = NULL;
1001         ret = ebt_verify_pointers(repl, newinfo);
1002         if (ret != 0)
1003                 goto free_counterstmp;
1004
1005         ret = translate_table(net, repl->name, newinfo);
1006
1007         if (ret != 0)
1008                 goto free_counterstmp;
1009
1010         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1011         if (!t) {
1012                 ret = -ENOENT;
1013                 goto free_iterate;
1014         }
1015
1016         /* the table doesn't like it */
1017         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1018                 goto free_unlock;
1019
1020         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1021                 BUGPRINT("Wrong nr. of counters requested\n");
1022                 ret = -EINVAL;
1023                 goto free_unlock;
1024         }
1025
1026         /* we have the mutex lock, so no danger in reading this pointer */
1027         table = t->private;
1028         /* make sure the table can only be rmmod'ed if it contains no rules */
1029         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1030                 ret = -ENOENT;
1031                 goto free_unlock;
1032         } else if (table->nentries && !newinfo->nentries)
1033                 module_put(t->me);
1034         /* we need an atomic snapshot of the counters */
1035         write_lock_bh(&t->lock);
1036         if (repl->num_counters)
1037                 get_counters(t->private->counters, counterstmp,
1038                    t->private->nentries);
1039
1040         t->private = newinfo;
1041         write_unlock_bh(&t->lock);
1042         mutex_unlock(&ebt_mutex);
1043         /* so, a user can change the chains while having messed up her counter
1044            allocation. Only reason why this is done is because this way the lock
1045            is held only once, while this doesn't bring the kernel into a
1046            dangerous state. */
1047         if (repl->num_counters &&
1048            copy_to_user(repl->counters, counterstmp,
1049            repl->num_counters * sizeof(struct ebt_counter))) {
1050                 ret = -EFAULT;
1051         }
1052         else
1053                 ret = 0;
1054
1055         /* decrease module count and free resources */
1056         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1057                           ebt_cleanup_entry, net, NULL);
1058
1059         vfree(table->entries);
1060         if (table->chainstack) {
1061                 for_each_possible_cpu(i)
1062                         vfree(table->chainstack[i]);
1063                 vfree(table->chainstack);
1064         }
1065         vfree(table);
1066
1067         vfree(counterstmp);
1068         return ret;
1069
1070 free_unlock:
1071         mutex_unlock(&ebt_mutex);
1072 free_iterate:
1073         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1074                           ebt_cleanup_entry, net, NULL);
1075 free_counterstmp:
1076         vfree(counterstmp);
1077         /* can be initialized in translate_table() */
1078         if (newinfo->chainstack) {
1079                 for_each_possible_cpu(i)
1080                         vfree(newinfo->chainstack[i]);
1081                 vfree(newinfo->chainstack);
1082         }
1083         return ret;
1084 }
1085
1086 /* replace the table */
1087 static int do_replace(struct net *net, const void __user *user,
1088                       unsigned int len)
1089 {
1090         int ret, countersize;
1091         struct ebt_table_info *newinfo;
1092         struct ebt_replace tmp;
1093
1094         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1095                 return -EFAULT;
1096
1097         if (len != sizeof(tmp) + tmp.entries_size) {
1098                 BUGPRINT("Wrong len argument\n");
1099                 return -EINVAL;
1100         }
1101
1102         if (tmp.entries_size == 0) {
1103                 BUGPRINT("Entries_size never zero\n");
1104                 return -EINVAL;
1105         }
1106         /* overflow check */
1107         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1108                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1109                 return -ENOMEM;
1110         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1111                 return -ENOMEM;
1112
1113         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1114         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1115         if (!newinfo)
1116                 return -ENOMEM;
1117
1118         if (countersize)
1119                 memset(newinfo->counters, 0, countersize);
1120
1121         newinfo->entries = vmalloc(tmp.entries_size);
1122         if (!newinfo->entries) {
1123                 ret = -ENOMEM;
1124                 goto free_newinfo;
1125         }
1126         if (copy_from_user(
1127            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1128                 BUGPRINT("Couldn't copy entries from userspace\n");
1129                 ret = -EFAULT;
1130                 goto free_entries;
1131         }
1132
1133         ret = do_replace_finish(net, &tmp, newinfo);
1134         if (ret == 0)
1135                 return ret;
1136 free_entries:
1137         vfree(newinfo->entries);
1138 free_newinfo:
1139         vfree(newinfo);
1140         return ret;
1141 }
1142
1143 struct ebt_table *
1144 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1145 {
1146         struct ebt_table_info *newinfo;
1147         struct ebt_table *t, *table;
1148         struct ebt_replace_kernel *repl;
1149         int ret, i, countersize;
1150         void *p;
1151
1152         if (input_table == NULL || (repl = input_table->table) == NULL ||
1153             repl->entries == 0 || repl->entries_size == 0 ||
1154             repl->counters != NULL || input_table->private != NULL) {
1155                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1156                 return ERR_PTR(-EINVAL);
1157         }
1158
1159         /* Don't add one table to multiple lists. */
1160         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1161         if (!table) {
1162                 ret = -ENOMEM;
1163                 goto out;
1164         }
1165
1166         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1167         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1168         ret = -ENOMEM;
1169         if (!newinfo)
1170                 goto free_table;
1171
1172         p = vmalloc(repl->entries_size);
1173         if (!p)
1174                 goto free_newinfo;
1175
1176         memcpy(p, repl->entries, repl->entries_size);
1177         newinfo->entries = p;
1178
1179         newinfo->entries_size = repl->entries_size;
1180         newinfo->nentries = repl->nentries;
1181
1182         if (countersize)
1183                 memset(newinfo->counters, 0, countersize);
1184
1185         /* fill in newinfo and parse the entries */
1186         newinfo->chainstack = NULL;
1187         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1188                 if ((repl->valid_hooks & (1 << i)) == 0)
1189                         newinfo->hook_entry[i] = NULL;
1190                 else
1191                         newinfo->hook_entry[i] = p +
1192                                 ((char *)repl->hook_entry[i] - repl->entries);
1193         }
1194         ret = translate_table(net, repl->name, newinfo);
1195         if (ret != 0) {
1196                 BUGPRINT("Translate_table failed\n");
1197                 goto free_chainstack;
1198         }
1199
1200         if (table->check && table->check(newinfo, table->valid_hooks)) {
1201                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1202                 return ERR_PTR(-EINVAL);
1203         }
1204
1205         table->private = newinfo;
1206         rwlock_init(&table->lock);
1207         ret = mutex_lock_interruptible(&ebt_mutex);
1208         if (ret != 0)
1209                 goto free_chainstack;
1210
1211         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1212                 if (strcmp(t->name, table->name) == 0) {
1213                         ret = -EEXIST;
1214                         BUGPRINT("Table name already exists\n");
1215                         goto free_unlock;
1216                 }
1217         }
1218
1219         /* Hold a reference count if the chains aren't empty */
1220         if (newinfo->nentries && !try_module_get(table->me)) {
1221                 ret = -ENOENT;
1222                 goto free_unlock;
1223         }
1224         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1225         mutex_unlock(&ebt_mutex);
1226         return table;
1227 free_unlock:
1228         mutex_unlock(&ebt_mutex);
1229 free_chainstack:
1230         if (newinfo->chainstack) {
1231                 for_each_possible_cpu(i)
1232                         vfree(newinfo->chainstack[i]);
1233                 vfree(newinfo->chainstack);
1234         }
1235         vfree(newinfo->entries);
1236 free_newinfo:
1237         vfree(newinfo);
1238 free_table:
1239         kfree(table);
1240 out:
1241         return ERR_PTR(ret);
1242 }
1243
1244 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1245 {
1246         int i;
1247
1248         if (!table) {
1249                 BUGPRINT("Request to unregister NULL table!!!\n");
1250                 return;
1251         }
1252         mutex_lock(&ebt_mutex);
1253         list_del(&table->list);
1254         mutex_unlock(&ebt_mutex);
1255         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1256                           ebt_cleanup_entry, net, NULL);
1257         if (table->private->nentries)
1258                 module_put(table->me);
1259         vfree(table->private->entries);
1260         if (table->private->chainstack) {
1261                 for_each_possible_cpu(i)
1262                         vfree(table->private->chainstack[i]);
1263                 vfree(table->private->chainstack);
1264         }
1265         vfree(table->private);
1266         kfree(table);
1267 }
1268
1269 /* userspace just supplied us with counters */
1270 static int do_update_counters(struct net *net, const char *name,
1271                                 struct ebt_counter __user *counters,
1272                                 unsigned int num_counters,
1273                                 const void __user *user, unsigned int len)
1274 {
1275         int i, ret;
1276         struct ebt_counter *tmp;
1277         struct ebt_table *t;
1278
1279         if (num_counters == 0)
1280                 return -EINVAL;
1281
1282         tmp = vmalloc(num_counters * sizeof(*tmp));
1283         if (!tmp)
1284                 return -ENOMEM;
1285
1286         t = find_table_lock(net, name, &ret, &ebt_mutex);
1287         if (!t)
1288                 goto free_tmp;
1289
1290         if (num_counters != t->private->nentries) {
1291                 BUGPRINT("Wrong nr of counters\n");
1292                 ret = -EINVAL;
1293                 goto unlock_mutex;
1294         }
1295
1296         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1297                 ret = -EFAULT;
1298                 goto unlock_mutex;
1299         }
1300
1301         /* we want an atomic add of the counters */
1302         write_lock_bh(&t->lock);
1303
1304         /* we add to the counters of the first cpu */
1305         for (i = 0; i < num_counters; i++) {
1306                 t->private->counters[i].pcnt += tmp[i].pcnt;
1307                 t->private->counters[i].bcnt += tmp[i].bcnt;
1308         }
1309
1310         write_unlock_bh(&t->lock);
1311         ret = 0;
1312 unlock_mutex:
1313         mutex_unlock(&ebt_mutex);
1314 free_tmp:
1315         vfree(tmp);
1316         return ret;
1317 }
1318
1319 static int update_counters(struct net *net, const void __user *user,
1320                             unsigned int len)
1321 {
1322         struct ebt_replace hlp;
1323
1324         if (copy_from_user(&hlp, user, sizeof(hlp)))
1325                 return -EFAULT;
1326
1327         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1328                 return -EINVAL;
1329
1330         return do_update_counters(net, hlp.name, hlp.counters,
1331                                 hlp.num_counters, user, len);
1332 }
1333
1334 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1335     const char *base, char __user *ubase)
1336 {
1337         char __user *hlp = ubase + ((char *)m - base);
1338         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1339                 return -EFAULT;
1340         return 0;
1341 }
1342
1343 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1344     const char *base, char __user *ubase)
1345 {
1346         char __user *hlp = ubase + ((char *)w - base);
1347         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1348                 return -EFAULT;
1349         return 0;
1350 }
1351
1352 static inline int
1353 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1354 {
1355         int ret;
1356         char __user *hlp;
1357         const struct ebt_entry_target *t;
1358
1359         if (e->bitmask == 0)
1360                 return 0;
1361
1362         hlp = ubase + (((char *)e + e->target_offset) - base);
1363         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1364
1365         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1366         if (ret != 0)
1367                 return ret;
1368         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1369         if (ret != 0)
1370                 return ret;
1371         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1372                 return -EFAULT;
1373         return 0;
1374 }
1375
1376 static int copy_counters_to_user(struct ebt_table *t,
1377                                   const struct ebt_counter *oldcounters,
1378                                   void __user *user, unsigned int num_counters,
1379                                   unsigned int nentries)
1380 {
1381         struct ebt_counter *counterstmp;
1382         int ret = 0;
1383
1384         /* userspace might not need the counters */
1385         if (num_counters == 0)
1386                 return 0;
1387
1388         if (num_counters != nentries) {
1389                 BUGPRINT("Num_counters wrong\n");
1390                 return -EINVAL;
1391         }
1392
1393         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1394         if (!counterstmp)
1395                 return -ENOMEM;
1396
1397         write_lock_bh(&t->lock);
1398         get_counters(oldcounters, counterstmp, nentries);
1399         write_unlock_bh(&t->lock);
1400
1401         if (copy_to_user(user, counterstmp,
1402            nentries * sizeof(struct ebt_counter)))
1403                 ret = -EFAULT;
1404         vfree(counterstmp);
1405         return ret;
1406 }
1407
1408 /* called with ebt_mutex locked */
1409 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1410     const int *len, int cmd)
1411 {
1412         struct ebt_replace tmp;
1413         const struct ebt_counter *oldcounters;
1414         unsigned int entries_size, nentries;
1415         int ret;
1416         char *entries;
1417
1418         if (cmd == EBT_SO_GET_ENTRIES) {
1419                 entries_size = t->private->entries_size;
1420                 nentries = t->private->nentries;
1421                 entries = t->private->entries;
1422                 oldcounters = t->private->counters;
1423         } else {
1424                 entries_size = t->table->entries_size;
1425                 nentries = t->table->nentries;
1426                 entries = t->table->entries;
1427                 oldcounters = t->table->counters;
1428         }
1429
1430         if (copy_from_user(&tmp, user, sizeof(tmp)))
1431                 return -EFAULT;
1432
1433         if (*len != sizeof(struct ebt_replace) + entries_size +
1434            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
1435                 return -EINVAL;
1436
1437         if (tmp.nentries != nentries) {
1438                 BUGPRINT("Nentries wrong\n");
1439                 return -EINVAL;
1440         }
1441
1442         if (tmp.entries_size != entries_size) {
1443                 BUGPRINT("Wrong size\n");
1444                 return -EINVAL;
1445         }
1446
1447         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1448                                         tmp.num_counters, nentries);
1449         if (ret)
1450                 return ret;
1451
1452         if (copy_to_user(tmp.entries, entries, entries_size)) {
1453                 BUGPRINT("Couldn't copy entries to userspace\n");
1454                 return -EFAULT;
1455         }
1456         /* set the match/watcher/target names right */
1457         return EBT_ENTRY_ITERATE(entries, entries_size,
1458            ebt_make_names, entries, tmp.entries);
1459 }
1460
1461 static int do_ebt_set_ctl(struct sock *sk,
1462         int cmd, void __user *user, unsigned int len)
1463 {
1464         int ret;
1465
1466         if (!capable(CAP_NET_ADMIN))
1467                 return -EPERM;
1468
1469         switch(cmd) {
1470         case EBT_SO_SET_ENTRIES:
1471                 ret = do_replace(sock_net(sk), user, len);
1472                 break;
1473         case EBT_SO_SET_COUNTERS:
1474                 ret = update_counters(sock_net(sk), user, len);
1475                 break;
1476         default:
1477                 ret = -EINVAL;
1478         }
1479         return ret;
1480 }
1481
1482 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1483 {
1484         int ret;
1485         struct ebt_replace tmp;
1486         struct ebt_table *t;
1487
1488         if (!capable(CAP_NET_ADMIN))
1489                 return -EPERM;
1490
1491         if (copy_from_user(&tmp, user, sizeof(tmp)))
1492                 return -EFAULT;
1493
1494         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1495         if (!t)
1496                 return ret;
1497
1498         switch(cmd) {
1499         case EBT_SO_GET_INFO:
1500         case EBT_SO_GET_INIT_INFO:
1501                 if (*len != sizeof(struct ebt_replace)){
1502                         ret = -EINVAL;
1503                         mutex_unlock(&ebt_mutex);
1504                         break;
1505                 }
1506                 if (cmd == EBT_SO_GET_INFO) {
1507                         tmp.nentries = t->private->nentries;
1508                         tmp.entries_size = t->private->entries_size;
1509                         tmp.valid_hooks = t->valid_hooks;
1510                 } else {
1511                         tmp.nentries = t->table->nentries;
1512                         tmp.entries_size = t->table->entries_size;
1513                         tmp.valid_hooks = t->table->valid_hooks;
1514                 }
1515                 mutex_unlock(&ebt_mutex);
1516                 if (copy_to_user(user, &tmp, *len) != 0){
1517                         BUGPRINT("c2u Didn't work\n");
1518                         ret = -EFAULT;
1519                         break;
1520                 }
1521                 ret = 0;
1522                 break;
1523
1524         case EBT_SO_GET_ENTRIES:
1525         case EBT_SO_GET_INIT_ENTRIES:
1526                 ret = copy_everything_to_user(t, user, len, cmd);
1527                 mutex_unlock(&ebt_mutex);
1528                 break;
1529
1530         default:
1531                 mutex_unlock(&ebt_mutex);
1532                 ret = -EINVAL;
1533         }
1534
1535         return ret;
1536 }
1537
1538 #ifdef CONFIG_COMPAT
1539 /* 32 bit-userspace compatibility definitions. */
1540 struct compat_ebt_replace {
1541         char name[EBT_TABLE_MAXNAMELEN];
1542         compat_uint_t valid_hooks;
1543         compat_uint_t nentries;
1544         compat_uint_t entries_size;
1545         /* start of the chains */
1546         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1547         /* nr of counters userspace expects back */
1548         compat_uint_t num_counters;
1549         /* where the kernel will put the old counters. */
1550         compat_uptr_t counters;
1551         compat_uptr_t entries;
1552 };
1553
1554 /* struct ebt_entry_match, _target and _watcher have same layout */
1555 struct compat_ebt_entry_mwt {
1556         union {
1557                 char name[EBT_FUNCTION_MAXNAMELEN];
1558                 compat_uptr_t ptr;
1559         } u;
1560         compat_uint_t match_size;
1561         compat_uint_t data[0];
1562 };
1563
1564 /* account for possible padding between match_size and ->data */
1565 static int ebt_compat_entry_padsize(void)
1566 {
1567         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1568                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1569         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1570                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1571 }
1572
1573 static int ebt_compat_match_offset(const struct xt_match *match,
1574                                    unsigned int userlen)
1575 {
1576         /*
1577          * ebt_among needs special handling. The kernel .matchsize is
1578          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1579          * value is expected.
1580          * Example: userspace sends 4500, ebt_among.c wants 4504.
1581          */
1582         if (unlikely(match->matchsize == -1))
1583                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1584         return xt_compat_match_offset(match);
1585 }
1586
1587 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1588                                 unsigned int *size)
1589 {
1590         const struct xt_match *match = m->u.match;
1591         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1592         int off = ebt_compat_match_offset(match, m->match_size);
1593         compat_uint_t msize = m->match_size - off;
1594
1595         BUG_ON(off >= m->match_size);
1596
1597         if (copy_to_user(cm->u.name, match->name,
1598             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1599                 return -EFAULT;
1600
1601         if (match->compat_to_user) {
1602                 if (match->compat_to_user(cm->data, m->data))
1603                         return -EFAULT;
1604         } else if (copy_to_user(cm->data, m->data, msize))
1605                         return -EFAULT;
1606
1607         *size -= ebt_compat_entry_padsize() + off;
1608         *dstptr = cm->data;
1609         *dstptr += msize;
1610         return 0;
1611 }
1612
1613 static int compat_target_to_user(struct ebt_entry_target *t,
1614                                  void __user **dstptr,
1615                                  unsigned int *size)
1616 {
1617         const struct xt_target *target = t->u.target;
1618         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1619         int off = xt_compat_target_offset(target);
1620         compat_uint_t tsize = t->target_size - off;
1621
1622         BUG_ON(off >= t->target_size);
1623
1624         if (copy_to_user(cm->u.name, target->name,
1625             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1626                 return -EFAULT;
1627
1628         if (target->compat_to_user) {
1629                 if (target->compat_to_user(cm->data, t->data))
1630                         return -EFAULT;
1631         } else if (copy_to_user(cm->data, t->data, tsize))
1632                 return -EFAULT;
1633
1634         *size -= ebt_compat_entry_padsize() + off;
1635         *dstptr = cm->data;
1636         *dstptr += tsize;
1637         return 0;
1638 }
1639
1640 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1641                                   void __user **dstptr,
1642                                   unsigned int *size)
1643 {
1644         return compat_target_to_user((struct ebt_entry_target *)w,
1645                                                         dstptr, size);
1646 }
1647
1648 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1649                                 unsigned int *size)
1650 {
1651         struct ebt_entry_target *t;
1652         struct ebt_entry __user *ce;
1653         u32 watchers_offset, target_offset, next_offset;
1654         compat_uint_t origsize;
1655         int ret;
1656
1657         if (e->bitmask == 0) {
1658                 if (*size < sizeof(struct ebt_entries))
1659                         return -EINVAL;
1660                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1661                         return -EFAULT;
1662
1663                 *dstptr += sizeof(struct ebt_entries);
1664                 *size -= sizeof(struct ebt_entries);
1665                 return 0;
1666         }
1667
1668         if (*size < sizeof(*ce))
1669                 return -EINVAL;
1670
1671         ce = (struct ebt_entry __user *)*dstptr;
1672         if (copy_to_user(ce, e, sizeof(*ce)))
1673                 return -EFAULT;
1674
1675         origsize = *size;
1676         *dstptr += sizeof(*ce);
1677
1678         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1679         if (ret)
1680                 return ret;
1681         watchers_offset = e->watchers_offset - (origsize - *size);
1682
1683         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1684         if (ret)
1685                 return ret;
1686         target_offset = e->target_offset - (origsize - *size);
1687
1688         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1689
1690         ret = compat_target_to_user(t, dstptr, size);
1691         if (ret)
1692                 return ret;
1693         next_offset = e->next_offset - (origsize - *size);
1694
1695         if (put_user(watchers_offset, &ce->watchers_offset) ||
1696             put_user(target_offset, &ce->target_offset) ||
1697             put_user(next_offset, &ce->next_offset))
1698                 return -EFAULT;
1699
1700         *size -= sizeof(*ce);
1701         return 0;
1702 }
1703
1704 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1705 {
1706         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1707         *off += ebt_compat_entry_padsize();
1708         return 0;
1709 }
1710
1711 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1712 {
1713         *off += xt_compat_target_offset(w->u.watcher);
1714         *off += ebt_compat_entry_padsize();
1715         return 0;
1716 }
1717
1718 static int compat_calc_entry(const struct ebt_entry *e,
1719                              const struct ebt_table_info *info,
1720                              const void *base,
1721                              struct compat_ebt_replace *newinfo)
1722 {
1723         const struct ebt_entry_target *t;
1724         unsigned int entry_offset;
1725         int off, ret, i;
1726
1727         if (e->bitmask == 0)
1728                 return 0;
1729
1730         off = 0;
1731         entry_offset = (void *)e - base;
1732
1733         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1734         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1735
1736         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1737
1738         off += xt_compat_target_offset(t->u.target);
1739         off += ebt_compat_entry_padsize();
1740
1741         newinfo->entries_size -= off;
1742
1743         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1744         if (ret)
1745                 return ret;
1746
1747         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1748                 const void *hookptr = info->hook_entry[i];
1749                 if (info->hook_entry[i] &&
1750                     (e < (struct ebt_entry *)(base - hookptr))) {
1751                         newinfo->hook_entry[i] -= off;
1752                         pr_debug("0x%08X -> 0x%08X\n",
1753                                         newinfo->hook_entry[i] + off,
1754                                         newinfo->hook_entry[i]);
1755                 }
1756         }
1757
1758         return 0;
1759 }
1760
1761
1762 static int compat_table_info(const struct ebt_table_info *info,
1763                              struct compat_ebt_replace *newinfo)
1764 {
1765         unsigned int size = info->entries_size;
1766         const void *entries = info->entries;
1767
1768         newinfo->entries_size = size;
1769
1770         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1771                                                         entries, newinfo);
1772 }
1773
1774 static int compat_copy_everything_to_user(struct ebt_table *t,
1775                                           void __user *user, int *len, int cmd)
1776 {
1777         struct compat_ebt_replace repl, tmp;
1778         struct ebt_counter *oldcounters;
1779         struct ebt_table_info tinfo;
1780         int ret;
1781         void __user *pos;
1782
1783         memset(&tinfo, 0, sizeof(tinfo));
1784
1785         if (cmd == EBT_SO_GET_ENTRIES) {
1786                 tinfo.entries_size = t->private->entries_size;
1787                 tinfo.nentries = t->private->nentries;
1788                 tinfo.entries = t->private->entries;
1789                 oldcounters = t->private->counters;
1790         } else {
1791                 tinfo.entries_size = t->table->entries_size;
1792                 tinfo.nentries = t->table->nentries;
1793                 tinfo.entries = t->table->entries;
1794                 oldcounters = t->table->counters;
1795         }
1796
1797         if (copy_from_user(&tmp, user, sizeof(tmp)))
1798                 return -EFAULT;
1799
1800         if (tmp.nentries != tinfo.nentries ||
1801            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1802                 return -EINVAL;
1803
1804         memcpy(&repl, &tmp, sizeof(repl));
1805         if (cmd == EBT_SO_GET_ENTRIES)
1806                 ret = compat_table_info(t->private, &repl);
1807         else
1808                 ret = compat_table_info(&tinfo, &repl);
1809         if (ret)
1810                 return ret;
1811
1812         if (*len != sizeof(tmp) + repl.entries_size +
1813            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1814                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1815                                 *len, tinfo.entries_size, repl.entries_size);
1816                 return -EINVAL;
1817         }
1818
1819         /* userspace might not need the counters */
1820         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1821                                         tmp.num_counters, tinfo.nentries);
1822         if (ret)
1823                 return ret;
1824
1825         pos = compat_ptr(tmp.entries);
1826         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1827                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1828 }
1829
1830 struct ebt_entries_buf_state {
1831         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1832         u32 buf_kern_len;       /* total size of kernel buffer */
1833         u32 buf_kern_offset;    /* amount of data copied so far */
1834         u32 buf_user_offset;    /* read position in userspace buffer */
1835 };
1836
1837 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1838 {
1839         state->buf_kern_offset += sz;
1840         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1841 }
1842
1843 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1844                        void *data, unsigned int sz)
1845 {
1846         if (state->buf_kern_start == NULL)
1847                 goto count_only;
1848
1849         BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1850
1851         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1852
1853  count_only:
1854         state->buf_user_offset += sz;
1855         return ebt_buf_count(state, sz);
1856 }
1857
1858 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1859 {
1860         char *b = state->buf_kern_start;
1861
1862         BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1863
1864         if (b != NULL && sz > 0)
1865                 memset(b + state->buf_kern_offset, 0, sz);
1866         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1867         return ebt_buf_count(state, sz);
1868 }
1869
1870 enum compat_mwt {
1871         EBT_COMPAT_MATCH,
1872         EBT_COMPAT_WATCHER,
1873         EBT_COMPAT_TARGET,
1874 };
1875
1876 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1877                                 enum compat_mwt compat_mwt,
1878                                 struct ebt_entries_buf_state *state,
1879                                 const unsigned char *base)
1880 {
1881         char name[EBT_FUNCTION_MAXNAMELEN];
1882         struct xt_match *match;
1883         struct xt_target *wt;
1884         void *dst = NULL;
1885         int off, pad = 0, ret = 0;
1886         unsigned int size_kern, entry_offset, match_size = mwt->match_size;
1887
1888         strlcpy(name, mwt->u.name, sizeof(name));
1889
1890         if (state->buf_kern_start)
1891                 dst = state->buf_kern_start + state->buf_kern_offset;
1892
1893         entry_offset = (unsigned char *) mwt - base;
1894         switch (compat_mwt) {
1895         case EBT_COMPAT_MATCH:
1896                 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
1897                                                 name, 0), "ebt_%s", name);
1898                 if (match == NULL)
1899                         return -ENOENT;
1900                 if (IS_ERR(match))
1901                         return PTR_ERR(match);
1902
1903                 off = ebt_compat_match_offset(match, match_size);
1904                 if (dst) {
1905                         if (match->compat_from_user)
1906                                 match->compat_from_user(dst, mwt->data);
1907                         else
1908                                 memcpy(dst, mwt->data, match_size);
1909                 }
1910
1911                 size_kern = match->matchsize;
1912                 if (unlikely(size_kern == -1))
1913                         size_kern = match_size;
1914                 module_put(match->me);
1915                 break;
1916         case EBT_COMPAT_WATCHER: /* fallthrough */
1917         case EBT_COMPAT_TARGET:
1918                 wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
1919                                                 name, 0), "ebt_%s", name);
1920                 if (wt == NULL)
1921                         return -ENOENT;
1922                 if (IS_ERR(wt))
1923                         return PTR_ERR(wt);
1924                 off = xt_compat_target_offset(wt);
1925
1926                 if (dst) {
1927                         if (wt->compat_from_user)
1928                                 wt->compat_from_user(dst, mwt->data);
1929                         else
1930                                 memcpy(dst, mwt->data, match_size);
1931                 }
1932
1933                 size_kern = wt->targetsize;
1934                 module_put(wt->me);
1935                 break;
1936         }
1937
1938         if (!dst) {
1939                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1940                                         off + ebt_compat_entry_padsize());
1941                 if (ret < 0)
1942                         return ret;
1943         }
1944
1945         state->buf_kern_offset += match_size + off;
1946         state->buf_user_offset += match_size;
1947         pad = XT_ALIGN(size_kern) - size_kern;
1948
1949         if (pad > 0 && dst) {
1950                 BUG_ON(state->buf_kern_len <= pad);
1951                 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1952                 memset(dst + size_kern, 0, pad);
1953         }
1954         return off + match_size;
1955 }
1956
1957 /*
1958  * return size of all matches, watchers or target, including necessary
1959  * alignment and padding.
1960  */
1961 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1962                         unsigned int size_left, enum compat_mwt type,
1963                         struct ebt_entries_buf_state *state, const void *base)
1964 {
1965         int growth = 0;
1966         char *buf;
1967
1968         if (size_left == 0)
1969                 return 0;
1970
1971         buf = (char *) match32;
1972
1973         while (size_left >= sizeof(*match32)) {
1974                 struct ebt_entry_match *match_kern;
1975                 int ret;
1976
1977                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1978                 if (match_kern) {
1979                         char *tmp;
1980                         tmp = state->buf_kern_start + state->buf_kern_offset;
1981                         match_kern = (struct ebt_entry_match *) tmp;
1982                 }
1983                 ret = ebt_buf_add(state, buf, sizeof(*match32));
1984                 if (ret < 0)
1985                         return ret;
1986                 size_left -= sizeof(*match32);
1987
1988                 /* add padding before match->data (if any) */
1989                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1990                 if (ret < 0)
1991                         return ret;
1992
1993                 if (match32->match_size > size_left)
1994                         return -EINVAL;
1995
1996                 size_left -= match32->match_size;
1997
1998                 ret = compat_mtw_from_user(match32, type, state, base);
1999                 if (ret < 0)
2000                         return ret;
2001
2002                 BUG_ON(ret < match32->match_size);
2003                 growth += ret - match32->match_size;
2004                 growth += ebt_compat_entry_padsize();
2005
2006                 buf += sizeof(*match32);
2007                 buf += match32->match_size;
2008
2009                 if (match_kern)
2010                         match_kern->match_size = ret;
2011
2012                 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2013                 match32 = (struct compat_ebt_entry_mwt *) buf;
2014         }
2015
2016         return growth;
2017 }
2018
2019 #define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...)          \
2020 ({                                                          \
2021         unsigned int __i;                                   \
2022         int __ret = 0;                                      \
2023         struct compat_ebt_entry_mwt *__watcher;             \
2024                                                             \
2025         for (__i = e->watchers_offset;                      \
2026              __i < (e)->target_offset;                      \
2027              __i += __watcher->watcher_size +               \
2028              sizeof(struct compat_ebt_entry_mwt)) {         \
2029                 __watcher = (void *)(e) + __i;              \
2030                 __ret = fn(__watcher , ## args);            \
2031                 if (__ret != 0)                             \
2032                         break;                              \
2033         }                                                   \
2034         if (__ret == 0) {                                   \
2035                 if (__i != (e)->target_offset)              \
2036                         __ret = -EINVAL;                    \
2037         }                                                   \
2038         __ret;                                              \
2039 })
2040
2041 #define EBT_COMPAT_MATCH_ITERATE(e, fn, args...)            \
2042 ({                                                          \
2043         unsigned int __i;                                   \
2044         int __ret = 0;                                      \
2045         struct compat_ebt_entry_mwt *__match;               \
2046                                                             \
2047         for (__i = sizeof(struct ebt_entry);                \
2048              __i < (e)->watchers_offset;                    \
2049              __i += __match->match_size +                   \
2050              sizeof(struct compat_ebt_entry_mwt)) {         \
2051                 __match = (void *)(e) + __i;                \
2052                 __ret = fn(__match , ## args);              \
2053                 if (__ret != 0)                             \
2054                         break;                              \
2055         }                                                   \
2056         if (__ret == 0) {                                   \
2057                 if (__i != (e)->watchers_offset)            \
2058                         __ret = -EINVAL;                    \
2059         }                                                   \
2060         __ret;                                              \
2061 })
2062
2063 /* called for all ebt_entry structures. */
2064 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2065                           unsigned int *total,
2066                           struct ebt_entries_buf_state *state)
2067 {
2068         unsigned int i, j, startoff, new_offset = 0;
2069         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2070         unsigned int offsets[4];
2071         unsigned int *offsets_update = NULL;
2072         int ret;
2073         char *buf_start;
2074
2075         if (*total < sizeof(struct ebt_entries))
2076                 return -EINVAL;
2077
2078         if (!entry->bitmask) {
2079                 *total -= sizeof(struct ebt_entries);
2080                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2081         }
2082         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2083                 return -EINVAL;
2084
2085         startoff = state->buf_user_offset;
2086         /* pull in most part of ebt_entry, it does not need to be changed. */
2087         ret = ebt_buf_add(state, entry,
2088                         offsetof(struct ebt_entry, watchers_offset));
2089         if (ret < 0)
2090                 return ret;
2091
2092         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2093         memcpy(&offsets[1], &entry->watchers_offset,
2094                         sizeof(offsets) - sizeof(offsets[0]));
2095
2096         if (state->buf_kern_start) {
2097                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2098                 offsets_update = (unsigned int *) buf_start;
2099         }
2100         ret = ebt_buf_add(state, &offsets[1],
2101                         sizeof(offsets) - sizeof(offsets[0]));
2102         if (ret < 0)
2103                 return ret;
2104         buf_start = (char *) entry;
2105         /*
2106          * 0: matches offset, always follows ebt_entry.
2107          * 1: watchers offset, from ebt_entry structure
2108          * 2: target offset, from ebt_entry structure
2109          * 3: next ebt_entry offset, from ebt_entry structure
2110          *
2111          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2112          */
2113         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2114                 struct compat_ebt_entry_mwt *match32;
2115                 unsigned int size;
2116                 char *buf = buf_start;
2117
2118                 buf = buf_start + offsets[i];
2119                 if (offsets[i] > offsets[j])
2120                         return -EINVAL;
2121
2122                 match32 = (struct compat_ebt_entry_mwt *) buf;
2123                 size = offsets[j] - offsets[i];
2124                 ret = ebt_size_mwt(match32, size, i, state, base);
2125                 if (ret < 0)
2126                         return ret;
2127                 new_offset += ret;
2128                 if (offsets_update && new_offset) {
2129                         pr_debug("change offset %d to %d\n",
2130                                 offsets_update[i], offsets[j] + new_offset);
2131                         offsets_update[i] = offsets[j] + new_offset;
2132                 }
2133         }
2134
2135         startoff = state->buf_user_offset - startoff;
2136
2137         BUG_ON(*total < startoff);
2138         *total -= startoff;
2139         return 0;
2140 }
2141
2142 /*
2143  * repl->entries_size is the size of the ebt_entry blob in userspace.
2144  * It might need more memory when copied to a 64 bit kernel in case
2145  * userspace is 32-bit. So, first task: find out how much memory is needed.
2146  *
2147  * Called before validation is performed.
2148  */
2149 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2150                                 struct ebt_entries_buf_state *state)
2151 {
2152         unsigned int size_remaining = size_user;
2153         int ret;
2154
2155         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2156                                         &size_remaining, state);
2157         if (ret < 0)
2158                 return ret;
2159
2160         WARN_ON(size_remaining);
2161         return state->buf_kern_offset;
2162 }
2163
2164
2165 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2166                                             void __user *user, unsigned int len)
2167 {
2168         struct compat_ebt_replace tmp;
2169         int i;
2170
2171         if (len < sizeof(tmp))
2172                 return -EINVAL;
2173
2174         if (copy_from_user(&tmp, user, sizeof(tmp)))
2175                 return -EFAULT;
2176
2177         if (len != sizeof(tmp) + tmp.entries_size)
2178                 return -EINVAL;
2179
2180         if (tmp.entries_size == 0)
2181                 return -EINVAL;
2182
2183         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2184                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2185                 return -ENOMEM;
2186         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2187                 return -ENOMEM;
2188
2189         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2190
2191         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2192         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2193                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2194
2195         repl->num_counters = tmp.num_counters;
2196         repl->counters = compat_ptr(tmp.counters);
2197         repl->entries = compat_ptr(tmp.entries);
2198         return 0;
2199 }
2200
2201 static int compat_do_replace(struct net *net, void __user *user,
2202                              unsigned int len)
2203 {
2204         int ret, i, countersize, size64;
2205         struct ebt_table_info *newinfo;
2206         struct ebt_replace tmp;
2207         struct ebt_entries_buf_state state;
2208         void *entries_tmp;
2209
2210         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2211         if (ret) {
2212                 /* try real handler in case userland supplied needed padding */
2213                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2214                         ret = 0;
2215                 return ret;
2216         }
2217
2218         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2219         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2220         if (!newinfo)
2221                 return -ENOMEM;
2222
2223         if (countersize)
2224                 memset(newinfo->counters, 0, countersize);
2225
2226         memset(&state, 0, sizeof(state));
2227
2228         newinfo->entries = vmalloc(tmp.entries_size);
2229         if (!newinfo->entries) {
2230                 ret = -ENOMEM;
2231                 goto free_newinfo;
2232         }
2233         if (copy_from_user(
2234            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2235                 ret = -EFAULT;
2236                 goto free_entries;
2237         }
2238
2239         entries_tmp = newinfo->entries;
2240
2241         xt_compat_lock(NFPROTO_BRIDGE);
2242
2243         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2244         if (ret < 0)
2245                 goto out_unlock;
2246
2247         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2248                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2249                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2250
2251         size64 = ret;
2252         newinfo->entries = vmalloc(size64);
2253         if (!newinfo->entries) {
2254                 vfree(entries_tmp);
2255                 ret = -ENOMEM;
2256                 goto out_unlock;
2257         }
2258
2259         memset(&state, 0, sizeof(state));
2260         state.buf_kern_start = newinfo->entries;
2261         state.buf_kern_len = size64;
2262
2263         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2264         BUG_ON(ret < 0);        /* parses same data again */
2265
2266         vfree(entries_tmp);
2267         tmp.entries_size = size64;
2268
2269         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2270                 char __user *usrptr;
2271                 if (tmp.hook_entry[i]) {
2272                         unsigned int delta;
2273                         usrptr = (char __user *) tmp.hook_entry[i];
2274                         delta = usrptr - tmp.entries;
2275                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2276                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2277                 }
2278         }
2279
2280         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2281         xt_compat_unlock(NFPROTO_BRIDGE);
2282
2283         ret = do_replace_finish(net, &tmp, newinfo);
2284         if (ret == 0)
2285                 return ret;
2286 free_entries:
2287         vfree(newinfo->entries);
2288 free_newinfo:
2289         vfree(newinfo);
2290         return ret;
2291 out_unlock:
2292         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2293         xt_compat_unlock(NFPROTO_BRIDGE);
2294         goto free_entries;
2295 }
2296
2297 static int compat_update_counters(struct net *net, void __user *user,
2298                                   unsigned int len)
2299 {
2300         struct compat_ebt_replace hlp;
2301
2302         if (copy_from_user(&hlp, user, sizeof(hlp)))
2303                 return -EFAULT;
2304
2305         /* try real handler in case userland supplied needed padding */
2306         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2307                 return update_counters(net, user, len);
2308
2309         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2310                                         hlp.num_counters, user, len);
2311 }
2312
2313 static int compat_do_ebt_set_ctl(struct sock *sk,
2314                 int cmd, void __user *user, unsigned int len)
2315 {
2316         int ret;
2317
2318         if (!capable(CAP_NET_ADMIN))
2319                 return -EPERM;
2320
2321         switch (cmd) {
2322         case EBT_SO_SET_ENTRIES:
2323                 ret = compat_do_replace(sock_net(sk), user, len);
2324                 break;
2325         case EBT_SO_SET_COUNTERS:
2326                 ret = compat_update_counters(sock_net(sk), user, len);
2327                 break;
2328         default:
2329                 ret = -EINVAL;
2330   }
2331         return ret;
2332 }
2333
2334 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2335                 void __user *user, int *len)
2336 {
2337         int ret;
2338         struct compat_ebt_replace tmp;
2339         struct ebt_table *t;
2340
2341         if (!capable(CAP_NET_ADMIN))
2342                 return -EPERM;
2343
2344         /* try real handler in case userland supplied needed padding */
2345         if ((cmd == EBT_SO_GET_INFO ||
2346              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2347                         return do_ebt_get_ctl(sk, cmd, user, len);
2348
2349         if (copy_from_user(&tmp, user, sizeof(tmp)))
2350                 return -EFAULT;
2351
2352         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
2353         if (!t)
2354                 return ret;
2355
2356         xt_compat_lock(NFPROTO_BRIDGE);
2357         switch (cmd) {
2358         case EBT_SO_GET_INFO:
2359                 tmp.nentries = t->private->nentries;
2360                 ret = compat_table_info(t->private, &tmp);
2361                 if (ret)
2362                         goto out;
2363                 tmp.valid_hooks = t->valid_hooks;
2364
2365                 if (copy_to_user(user, &tmp, *len) != 0) {
2366                         ret = -EFAULT;
2367                         break;
2368                 }
2369                 ret = 0;
2370                 break;
2371         case EBT_SO_GET_INIT_INFO:
2372                 tmp.nentries = t->table->nentries;
2373                 tmp.entries_size = t->table->entries_size;
2374                 tmp.valid_hooks = t->table->valid_hooks;
2375
2376                 if (copy_to_user(user, &tmp, *len) != 0) {
2377                         ret = -EFAULT;
2378                         break;
2379                 }
2380                 ret = 0;
2381                 break;
2382         case EBT_SO_GET_ENTRIES:
2383         case EBT_SO_GET_INIT_ENTRIES:
2384                 /*
2385                  * try real handler first in case of userland-side padding.
2386                  * in case we are dealing with an 'ordinary' 32 bit binary
2387                  * without 64bit compatibility padding, this will fail right
2388                  * after copy_from_user when the *len argument is validated.
2389                  *
2390                  * the compat_ variant needs to do one pass over the kernel
2391                  * data set to adjust for size differences before it the check.
2392                  */
2393                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2394                         ret = 0;
2395                 else
2396                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2397                 break;
2398         default:
2399                 ret = -EINVAL;
2400         }
2401  out:
2402         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2403         xt_compat_unlock(NFPROTO_BRIDGE);
2404         mutex_unlock(&ebt_mutex);
2405         return ret;
2406 }
2407 #endif
2408
2409 static struct nf_sockopt_ops ebt_sockopts =
2410 {
2411         .pf             = PF_INET,
2412         .set_optmin     = EBT_BASE_CTL,
2413         .set_optmax     = EBT_SO_SET_MAX + 1,
2414         .set            = do_ebt_set_ctl,
2415 #ifdef CONFIG_COMPAT
2416         .compat_set     = compat_do_ebt_set_ctl,
2417 #endif
2418         .get_optmin     = EBT_BASE_CTL,
2419         .get_optmax     = EBT_SO_GET_MAX + 1,
2420         .get            = do_ebt_get_ctl,
2421 #ifdef CONFIG_COMPAT
2422         .compat_get     = compat_do_ebt_get_ctl,
2423 #endif
2424         .owner          = THIS_MODULE,
2425 };
2426
2427 static int __init ebtables_init(void)
2428 {
2429         int ret;
2430
2431         ret = xt_register_target(&ebt_standard_target);
2432         if (ret < 0)
2433                 return ret;
2434         ret = nf_register_sockopt(&ebt_sockopts);
2435         if (ret < 0) {
2436                 xt_unregister_target(&ebt_standard_target);
2437                 return ret;
2438         }
2439
2440         printk(KERN_INFO "Ebtables v2.0 registered\n");
2441         return 0;
2442 }
2443
2444 static void __exit ebtables_fini(void)
2445 {
2446         nf_unregister_sockopt(&ebt_sockopts);
2447         xt_unregister_target(&ebt_standard_target);
2448         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2449 }
2450
2451 EXPORT_SYMBOL(ebt_register_table);
2452 EXPORT_SYMBOL(ebt_unregister_table);
2453 EXPORT_SYMBOL(ebt_do_table);
2454 module_init(ebtables_init);
2455 module_exit(ebtables_fini);
2456 MODULE_LICENSE("GPL");