net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18 #include <linux/kmod.h>
  19 #include <linux/module.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netfilter/x_tables.h>
  22 #include <linux/netfilter_bridge/ebtables.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/mutex.h>
  25 #include <linux/slab.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36
  37 /*
  38  * Each cpu has its own set of counters, so there is no need for write_lock in
  39  * the softirq
  40  * For reading or updating the counters, the user context needs to
  41  * get a write_lock
  42  */
  43
  44 /* The size of each set of counters is altered to get cache alignment */
  45 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  46 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  47 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  48    COUNTER_OFFSET(n) * cpu))
  49
  50
  51
  52 static DEFINE_MUTEX(ebt_mutex);
  53
  54 #ifdef CONFIG_COMPAT
  55 static void ebt_standard_compat_from_user(void *dst, const void *src)
  56 {
  57         int v = *(compat_int_t *)src;
  58
  59         if (v >= 0)
  60                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  61         memcpy(dst, &v, sizeof(v));
  62 }
  63
  64 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  65 {
  66         compat_int_t cv = *(int *)src;
  67
  68         if (cv >= 0)
  69                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  70         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  71 }
  72 #endif
  73
  74
  75 static struct xt_target ebt_standard_target = {
  76         .name       = "standard",
  77         .revision   = 0,
  78         .family     = NFPROTO_BRIDGE,
  79         .targetsize = sizeof(int),
  80 #ifdef CONFIG_COMPAT
  81         .compatsize = sizeof(compat_int_t),
  82         .compat_from_user = ebt_standard_compat_from_user,
  83         .compat_to_user =  ebt_standard_compat_to_user,
  84 #endif
  85 };
  86
  87 static inline int
  88 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  89                struct xt_action_param *par)
  90 {
  91         par->target   = w->u.watcher;
  92         par->targinfo = w->data;
  93         w->u.watcher->target(skb, par);
  94         /* watchers don't give a verdict */
  95         return 0;
  96 }
  97
  98 static inline int
  99 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
 100              struct xt_action_param *par)
 101 {
 102         par->match     = m->u.match;
 103         par->matchinfo = m->data;
 104         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 105 }
 106
 107 static inline int
 108 ebt_dev_check(const char *entry, const struct net_device *device)
 109 {
 110         int i = 0;
 111         const char *devname;
 112
 113         if (*entry == '\0')
 114                 return 0;
 115         if (!device)
 116                 return 1;
 117         devname = device->name;
 118         /* 1 is the wildcard token */
 119         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 120                 i++;
 121         return (devname[i] != entry[i] && entry[i] != 1);
 122 }
 123
 124 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 125 /* process standard matches */
 126 static inline int
 127 ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
 128                 const struct net_device *in, const struct net_device *out)
 129 {
 130         int verdict, i;
 131
 132         if (e->bitmask & EBT_802_3) {
 133                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 134                         return 1;
 135         } else if (!(e->bitmask & EBT_NOPROTO) &&
 136            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 137                 return 1;
 138
 139         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 140                 return 1;
 141         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 142                 return 1;
 143         /* rcu_read_lock()ed by nf_hook_slow */
 144         if (in && br_port_exists(in) &&
 145             FWINV2(ebt_dev_check(e->logical_in, br_port_get_rcu(in)->br->dev),
 146                    EBT_ILOGICALIN))
 147                 return 1;
 148         if (out && br_port_exists(out) &&
 149             FWINV2(ebt_dev_check(e->logical_out, br_port_get_rcu(out)->br->dev),
 150                    EBT_ILOGICALOUT))
 151                 return 1;
 152
 153         if (e->bitmask & EBT_SOURCEMAC) {
 154                 verdict = 0;
 155                 for (i = 0; i < 6; i++)
 156                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 157                            e->sourcemsk[i];
 158                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 159                         return 1;
 160         }
 161         if (e->bitmask & EBT_DESTMAC) {
 162                 verdict = 0;
 163                 for (i = 0; i < 6; i++)
 164                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 165                            e->destmsk[i];
 166                 if (FWINV2(verdict != 0, EBT_IDEST) )
 167                         return 1;
 168         }
 169         return 0;
 170 }
 171
 172 static inline __pure
 173 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 174 {
 175         return (void *)entry + entry->next_offset;
 176 }
 177
 178 /* Do some firewalling */
 179 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 180    const struct net_device *in, const struct net_device *out,
 181    struct ebt_table *table)
 182 {
 183         int i, nentries;
 184         struct ebt_entry *point;
 185         struct ebt_counter *counter_base, *cb_base;
 186         const struct ebt_entry_target *t;
 187         int verdict, sp = 0;
 188         struct ebt_chainstack *cs;
 189         struct ebt_entries *chaininfo;
 190         const char *base;
 191         const struct ebt_table_info *private;
 192         struct xt_action_param acpar;
 193
 194         acpar.family  = NFPROTO_BRIDGE;
 195         acpar.in      = in;
 196         acpar.out     = out;
 197         acpar.hotdrop = false;
 198         acpar.hooknum = hook;
 199
 200         read_lock_bh(&table->lock);
 201         private = table->private;
 202         cb_base = COUNTER_BASE(private->counters, private->nentries,
 203            smp_processor_id());
 204         if (private->chainstack)
 205                 cs = private->chainstack[smp_processor_id()];
 206         else
 207                 cs = NULL;
 208         chaininfo = private->hook_entry[hook];
 209         nentries = private->hook_entry[hook]->nentries;
 210         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 211         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 212         /* base for chain jumps */
 213         base = private->entries;
 214         i = 0;
 215         while (i < nentries) {
 216                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 217                         goto letscontinue;
 218
 219                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
 220                         goto letscontinue;
 221                 if (acpar.hotdrop) {
 222                         read_unlock_bh(&table->lock);
 223                         return NF_DROP;
 224                 }
 225
 226                 /* increase counter */
 227                 (*(counter_base + i)).pcnt++;
 228                 (*(counter_base + i)).bcnt += skb->len;
 229
 230                 /* these should only watch: not modify, nor tell us
 231                    what to do with the packet */
 232                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
 233
 234                 t = (struct ebt_entry_target *)
 235                    (((char *)point) + point->target_offset);
 236                 /* standard target */
 237                 if (!t->u.target->target)
 238                         verdict = ((struct ebt_standard_target *)t)->verdict;
 239                 else {
 240                         acpar.target   = t->u.target;
 241                         acpar.targinfo = t->data;
 242                         verdict = t->u.target->target(skb, &acpar);
 243                 }
 244                 if (verdict == EBT_ACCEPT) {
 245                         read_unlock_bh(&table->lock);
 246                         return NF_ACCEPT;
 247                 }
 248                 if (verdict == EBT_DROP) {
 249                         read_unlock_bh(&table->lock);
 250                         return NF_DROP;
 251                 }
 252                 if (verdict == EBT_RETURN) {
 253 letsreturn:
 254 #ifdef CONFIG_NETFILTER_DEBUG
 255                         if (sp == 0) {
 256                                 BUGPRINT("RETURN on base chain");
 257                                 /* act like this is EBT_CONTINUE */
 258                                 goto letscontinue;
 259                         }
 260 #endif
 261                         sp--;
 262                         /* put all the local variables right */
 263                         i = cs[sp].n;
 264                         chaininfo = cs[sp].chaininfo;
 265                         nentries = chaininfo->nentries;
 266                         point = cs[sp].e;
 267                         counter_base = cb_base +
 268                            chaininfo->counter_offset;
 269                         continue;
 270                 }
 271                 if (verdict == EBT_CONTINUE)
 272                         goto letscontinue;
 273 #ifdef CONFIG_NETFILTER_DEBUG
 274                 if (verdict < 0) {
 275                         BUGPRINT("bogus standard verdict\n");
 276                         read_unlock_bh(&table->lock);
 277                         return NF_DROP;
 278                 }
 279 #endif
 280                 /* jump to a udc */
 281                 cs[sp].n = i + 1;
 282                 cs[sp].chaininfo = chaininfo;
 283                 cs[sp].e = ebt_next_entry(point);
 284                 i = 0;
 285                 chaininfo = (struct ebt_entries *) (base + verdict);
 286 #ifdef CONFIG_NETFILTER_DEBUG
 287                 if (chaininfo->distinguisher) {
 288                         BUGPRINT("jump to non-chain\n");
 289                         read_unlock_bh(&table->lock);
 290                         return NF_DROP;
 291                 }
 292 #endif
 293                 nentries = chaininfo->nentries;
 294                 point = (struct ebt_entry *)chaininfo->data;
 295                 counter_base = cb_base + chaininfo->counter_offset;
 296                 sp++;
 297                 continue;
 298 letscontinue:
 299                 point = ebt_next_entry(point);
 300                 i++;
 301         }
 302
 303         /* I actually like this :) */
 304         if (chaininfo->policy == EBT_RETURN)
 305                 goto letsreturn;
 306         if (chaininfo->policy == EBT_ACCEPT) {
 307                 read_unlock_bh(&table->lock);
 308                 return NF_ACCEPT;
 309         }
 310         read_unlock_bh(&table->lock);
 311         return NF_DROP;
 312 }
 313
 314 /* If it succeeds, returns element and locks mutex */
 315 static inline void *
 316 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 317    struct mutex *mutex)
 318 {
 319         struct {
 320                 struct list_head list;
 321                 char name[EBT_FUNCTION_MAXNAMELEN];
 322         } *e;
 323
 324         *error = mutex_lock_interruptible(mutex);
 325         if (*error != 0)
 326                 return NULL;
 327
 328         list_for_each_entry(e, head, list) {
 329                 if (strcmp(e->name, name) == 0)
 330                         return e;
 331         }
 332         *error = -ENOENT;
 333         mutex_unlock(mutex);
 334         return NULL;
 335 }
 336
 337 static void *
 338 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 339    int *error, struct mutex *mutex)
 340 {
 341         return try_then_request_module(
 342                         find_inlist_lock_noload(head, name, error, mutex),
 343                         "%s%s", prefix, name);
 344 }
 345
 346 static inline struct ebt_table *
 347 find_table_lock(struct net *net, const char *name, int *error,
 348                 struct mutex *mutex)
 349 {
 350         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 351                                 "ebtable_", error, mutex);
 352 }
 353
 354 static inline int
 355 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 356                 unsigned int *cnt)
 357 {
 358         const struct ebt_entry *e = par->entryinfo;
 359         struct xt_match *match;
 360         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 361         int ret;
 362
 363         if (left < sizeof(struct ebt_entry_match) ||
 364             left - sizeof(struct ebt_entry_match) < m->match_size)
 365                 return -EINVAL;
 366
 367         match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
 368         if (IS_ERR(match))
 369                 return PTR_ERR(match);
 370         m->u.match = match;
 371
 372         par->match     = match;
 373         par->matchinfo = m->data;
 374         ret = xt_check_match(par, m->match_size,
 375               e->ethproto, e->invflags & EBT_IPROTO);
 376         if (ret < 0) {
 377                 module_put(match->me);
 378                 return ret;
 379         }
 380
 381         (*cnt)++;
 382         return 0;
 383 }
 384
 385 static inline int
 386 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 387                   unsigned int *cnt)
 388 {
 389         const struct ebt_entry *e = par->entryinfo;
 390         struct xt_target *watcher;
 391         size_t left = ((char *)e + e->target_offset) - (char *)w;
 392         int ret;
 393
 394         if (left < sizeof(struct ebt_entry_watcher) ||
 395            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 396                 return -EINVAL;
 397
 398         watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
 399         if (IS_ERR(watcher))
 400                 return PTR_ERR(watcher);
 401         w->u.watcher = watcher;
 402
 403         par->target   = watcher;
 404         par->targinfo = w->data;
 405         ret = xt_check_target(par, w->watcher_size,
 406               e->ethproto, e->invflags & EBT_IPROTO);
 407         if (ret < 0) {
 408                 module_put(watcher->me);
 409                 return ret;
 410         }
 411
 412         (*cnt)++;
 413         return 0;
 414 }
 415
 416 static int ebt_verify_pointers(const struct ebt_replace *repl,
 417                                struct ebt_table_info *newinfo)
 418 {
 419         unsigned int limit = repl->entries_size;
 420         unsigned int valid_hooks = repl->valid_hooks;
 421         unsigned int offset = 0;
 422         int i;
 423
 424         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 425                 newinfo->hook_entry[i] = NULL;
 426
 427         newinfo->entries_size = repl->entries_size;
 428         newinfo->nentries = repl->nentries;
 429
 430         while (offset < limit) {
 431                 size_t left = limit - offset;
 432                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 433
 434                 if (left < sizeof(unsigned int))
 435                         break;
 436
 437                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 438                         if ((valid_hooks & (1 << i)) == 0)
 439                                 continue;
 440                         if ((char __user *)repl->hook_entry[i] ==
 441                              repl->entries + offset)
 442                                 break;
 443                 }
 444
 445                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 446                         if (e->bitmask != 0) {
 447                                 /* we make userspace set this right,
 448                                    so there is no misunderstanding */
 449                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 450                                          "in distinguisher\n");
 451                                 return -EINVAL;
 452                         }
 453                         if (i != NF_BR_NUMHOOKS)
 454                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 455                         if (left < sizeof(struct ebt_entries))
 456                                 break;
 457                         offset += sizeof(struct ebt_entries);
 458                 } else {
 459                         if (left < sizeof(struct ebt_entry))
 460                                 break;
 461                         if (left < e->next_offset)
 462                                 break;
 463                         if (e->next_offset < sizeof(struct ebt_entry))
 464                                 return -EINVAL;
 465                         offset += e->next_offset;
 466                 }
 467         }
 468         if (offset != limit) {
 469                 BUGPRINT("entries_size too small\n");
 470                 return -EINVAL;
 471         }
 472
 473         /* check if all valid hooks have a chain */
 474         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 475                 if (!newinfo->hook_entry[i] &&
 476                    (valid_hooks & (1 << i))) {
 477                         BUGPRINT("Valid hook without chain\n");
 478                         return -EINVAL;
 479                 }
 480         }
 481         return 0;
 482 }
 483
 484 /*
 485  * this one is very careful, as it is the first function
 486  * to parse the userspace data
 487  */
 488 static inline int
 489 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 490    const struct ebt_table_info *newinfo,
 491    unsigned int *n, unsigned int *cnt,
 492    unsigned int *totalcnt, unsigned int *udc_cnt)
 493 {
 494         int i;
 495
 496         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 497                 if ((void *)e == (void *)newinfo->hook_entry[i])
 498                         break;
 499         }
 500         /* beginning of a new chain
 501            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 502         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 503                 /* this checks if the previous chain has as many entries
 504                    as it said it has */
 505                 if (*n != *cnt) {
 506                         BUGPRINT("nentries does not equal the nr of entries "
 507                                  "in the chain\n");
 508                         return -EINVAL;
 509                 }
 510                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 511                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 512                         /* only RETURN from udc */
 513                         if (i != NF_BR_NUMHOOKS ||
 514                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 515                                 BUGPRINT("bad policy\n");
 516                                 return -EINVAL;
 517                         }
 518                 }
 519                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 520                         (*udc_cnt)++;
 521                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 522                         BUGPRINT("counter_offset != totalcnt");
 523                         return -EINVAL;
 524                 }
 525                 *n = ((struct ebt_entries *)e)->nentries;
 526                 *cnt = 0;
 527                 return 0;
 528         }
 529         /* a plain old entry, heh */
 530         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 531            e->watchers_offset > e->target_offset ||
 532            e->target_offset >= e->next_offset) {
 533                 BUGPRINT("entry offsets not in right order\n");
 534                 return -EINVAL;
 535         }
 536         /* this is not checked anywhere else */
 537         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 538                 BUGPRINT("target size too small\n");
 539                 return -EINVAL;
 540         }
 541         (*cnt)++;
 542         (*totalcnt)++;
 543         return 0;
 544 }
 545
 546 struct ebt_cl_stack
 547 {
 548         struct ebt_chainstack cs;
 549         int from;
 550         unsigned int hookmask;
 551 };
 552
 553 /*
 554  * we need these positions to check that the jumps to a different part of the
 555  * entries is a jump to the beginning of a new chain.
 556  */
 557 static inline int
 558 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 559    unsigned int *n, struct ebt_cl_stack *udc)
 560 {
 561         int i;
 562
 563         /* we're only interested in chain starts */
 564         if (e->bitmask)
 565                 return 0;
 566         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 567                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 568                         break;
 569         }
 570         /* only care about udc */
 571         if (i != NF_BR_NUMHOOKS)
 572                 return 0;
 573
 574         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 575         /* these initialisations are depended on later in check_chainloops() */
 576         udc[*n].cs.n = 0;
 577         udc[*n].hookmask = 0;
 578
 579         (*n)++;
 580         return 0;
 581 }
 582
 583 static inline int
 584 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 585 {
 586         struct xt_mtdtor_param par;
 587
 588         if (i && (*i)-- == 0)
 589                 return 1;
 590
 591         par.net       = net;
 592         par.match     = m->u.match;
 593         par.matchinfo = m->data;
 594         par.family    = NFPROTO_BRIDGE;
 595         if (par.match->destroy != NULL)
 596                 par.match->destroy(&par);
 597         module_put(par.match->me);
 598         return 0;
 599 }
 600
 601 static inline int
 602 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 603 {
 604         struct xt_tgdtor_param par;
 605
 606         if (i && (*i)-- == 0)
 607                 return 1;
 608
 609         par.net      = net;
 610         par.target   = w->u.watcher;
 611         par.targinfo = w->data;
 612         par.family   = NFPROTO_BRIDGE;
 613         if (par.target->destroy != NULL)
 614                 par.target->destroy(&par);
 615         module_put(par.target->me);
 616         return 0;
 617 }
 618
 619 static inline int
 620 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 621 {
 622         struct xt_tgdtor_param par;
 623         struct ebt_entry_target *t;
 624
 625         if (e->bitmask == 0)
 626                 return 0;
 627         /* we're done */
 628         if (cnt && (*cnt)-- == 0)
 629                 return 1;
 630         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 631         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 632         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 633
 634         par.net      = net;
 635         par.target   = t->u.target;
 636         par.targinfo = t->data;
 637         par.family   = NFPROTO_BRIDGE;
 638         if (par.target->destroy != NULL)
 639                 par.target->destroy(&par);
 640         module_put(par.target->me);
 641         return 0;
 642 }
 643
 644 static inline int
 645 ebt_check_entry(struct ebt_entry *e, struct net *net,
 646    const struct ebt_table_info *newinfo,
 647    const char *name, unsigned int *cnt,
 648    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 649 {
 650         struct ebt_entry_target *t;
 651         struct xt_target *target;
 652         unsigned int i, j, hook = 0, hookmask = 0;
 653         size_t gap;
 654         int ret;
 655         struct xt_mtchk_param mtpar;
 656         struct xt_tgchk_param tgpar;
 657
 658         /* don't mess with the struct ebt_entries */
 659         if (e->bitmask == 0)
 660                 return 0;
 661
 662         if (e->bitmask & ~EBT_F_MASK) {
 663                 BUGPRINT("Unknown flag for bitmask\n");
 664                 return -EINVAL;
 665         }
 666         if (e->invflags & ~EBT_INV_MASK) {
 667                 BUGPRINT("Unknown flag for inv bitmask\n");
 668                 return -EINVAL;
 669         }
 670         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 671                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 672                 return -EINVAL;
 673         }
 674         /* what hook do we belong to? */
 675         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 676                 if (!newinfo->hook_entry[i])
 677                         continue;
 678                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 679                         hook = i;
 680                 else
 681                         break;
 682         }
 683         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 684            a base chain */
 685         if (i < NF_BR_NUMHOOKS)
 686                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 687         else {
 688                 for (i = 0; i < udc_cnt; i++)
 689                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 690                                 break;
 691                 if (i == 0)
 692                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 693                 else
 694                         hookmask = cl_s[i - 1].hookmask;
 695         }
 696         i = 0;
 697
 698         mtpar.net       = tgpar.net       = net;
 699         mtpar.table     = tgpar.table     = name;
 700         mtpar.entryinfo = tgpar.entryinfo = e;
 701         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 702         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 703         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 704         if (ret != 0)
 705                 goto cleanup_matches;
 706         j = 0;
 707         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 708         if (ret != 0)
 709                 goto cleanup_watchers;
 710         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 711         gap = e->next_offset - e->target_offset;
 712
 713         target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
 714         if (IS_ERR(target)) {
 715                 ret = PTR_ERR(target);
 716                 goto cleanup_watchers;
 717         }
 718
 719         t->u.target = target;
 720         if (t->u.target == &ebt_standard_target) {
 721                 if (gap < sizeof(struct ebt_standard_target)) {
 722                         BUGPRINT("Standard target size too big\n");
 723                         ret = -EFAULT;
 724                         goto cleanup_watchers;
 725                 }
 726                 if (((struct ebt_standard_target *)t)->verdict <
 727                    -NUM_STANDARD_TARGETS) {
 728                         BUGPRINT("Invalid standard target\n");
 729                         ret = -EFAULT;
 730                         goto cleanup_watchers;
 731                 }
 732         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 733                 module_put(t->u.target->me);
 734                 ret = -EFAULT;
 735                 goto cleanup_watchers;
 736         }
 737
 738         tgpar.target   = target;
 739         tgpar.targinfo = t->data;
 740         ret = xt_check_target(&tgpar, t->target_size,
 741               e->ethproto, e->invflags & EBT_IPROTO);
 742         if (ret < 0) {
 743                 module_put(target->me);
 744                 goto cleanup_watchers;
 745         }
 746         (*cnt)++;
 747         return 0;
 748 cleanup_watchers:
 749         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 750 cleanup_matches:
 751         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 752         return ret;
 753 }
 754
 755 /*
 756  * checks for loops and sets the hook mask for udc
 757  * the hook mask for udc tells us from which base chains the udc can be
 758  * accessed. This mask is a parameter to the check() functions of the extensions
 759  */
 760 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 761    unsigned int udc_cnt, unsigned int hooknr, char *base)
 762 {
 763         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 764         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 765         const struct ebt_entry_target *t;
 766
 767         while (pos < nentries || chain_nr != -1) {
 768                 /* end of udc, go back one 'recursion' step */
 769                 if (pos == nentries) {
 770                         /* put back values of the time when this chain was called */
 771                         e = cl_s[chain_nr].cs.e;
 772                         if (cl_s[chain_nr].from != -1)
 773                                 nentries =
 774                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 775                         else
 776                                 nentries = chain->nentries;
 777                         pos = cl_s[chain_nr].cs.n;
 778                         /* make sure we won't see a loop that isn't one */
 779                         cl_s[chain_nr].cs.n = 0;
 780                         chain_nr = cl_s[chain_nr].from;
 781                         if (pos == nentries)
 782                                 continue;
 783                 }
 784                 t = (struct ebt_entry_target *)
 785                    (((char *)e) + e->target_offset);
 786                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 787                         goto letscontinue;
 788                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 789                    e->next_offset) {
 790                         BUGPRINT("Standard target size too big\n");
 791                         return -1;
 792                 }
 793                 verdict = ((struct ebt_standard_target *)t)->verdict;
 794                 if (verdict >= 0) { /* jump to another chain */
 795                         struct ebt_entries *hlp2 =
 796                            (struct ebt_entries *)(base + verdict);
 797                         for (i = 0; i < udc_cnt; i++)
 798                                 if (hlp2 == cl_s[i].cs.chaininfo)
 799                                         break;
 800                         /* bad destination or loop */
 801                         if (i == udc_cnt) {
 802                                 BUGPRINT("bad destination\n");
 803                                 return -1;
 804                         }
 805                         if (cl_s[i].cs.n) {
 806                                 BUGPRINT("loop\n");
 807                                 return -1;
 808                         }
 809                         if (cl_s[i].hookmask & (1 << hooknr))
 810                                 goto letscontinue;
 811                         /* this can't be 0, so the loop test is correct */
 812                         cl_s[i].cs.n = pos + 1;
 813                         pos = 0;
 814                         cl_s[i].cs.e = ebt_next_entry(e);
 815                         e = (struct ebt_entry *)(hlp2->data);
 816                         nentries = hlp2->nentries;
 817                         cl_s[i].from = chain_nr;
 818                         chain_nr = i;
 819                         /* this udc is accessible from the base chain for hooknr */
 820                         cl_s[i].hookmask |= (1 << hooknr);
 821                         continue;
 822                 }
 823 letscontinue:
 824                 e = ebt_next_entry(e);
 825                 pos++;
 826         }
 827         return 0;
 828 }
 829
 830 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 831 static int translate_table(struct net *net, const char *name,
 832                            struct ebt_table_info *newinfo)
 833 {
 834         unsigned int i, j, k, udc_cnt;
 835         int ret;
 836         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 837
 838         i = 0;
 839         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 840                 i++;
 841         if (i == NF_BR_NUMHOOKS) {
 842                 BUGPRINT("No valid hooks specified\n");
 843                 return -EINVAL;
 844         }
 845         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 846                 BUGPRINT("Chains don't start at beginning\n");
 847                 return -EINVAL;
 848         }
 849         /* make sure chains are ordered after each other in same order
 850            as their corresponding hooks */
 851         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 852                 if (!newinfo->hook_entry[j])
 853                         continue;
 854                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 855                         BUGPRINT("Hook order must be followed\n");
 856                         return -EINVAL;
 857                 }
 858                 i = j;
 859         }
 860
 861         /* do some early checkings and initialize some things */
 862         i = 0; /* holds the expected nr. of entries for the chain */
 863         j = 0; /* holds the up to now counted entries for the chain */
 864         k = 0; /* holds the total nr. of entries, should equal
 865                   newinfo->nentries afterwards */
 866         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 867         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 868            ebt_check_entry_size_and_hooks, newinfo,
 869            &i, &j, &k, &udc_cnt);
 870
 871         if (ret != 0)
 872                 return ret;
 873
 874         if (i != j) {
 875                 BUGPRINT("nentries does not equal the nr of entries in the "
 876                          "(last) chain\n");
 877                 return -EINVAL;
 878         }
 879         if (k != newinfo->nentries) {
 880                 BUGPRINT("Total nentries is wrong\n");
 881                 return -EINVAL;
 882         }
 883
 884         /* get the location of the udc, put them in an array
 885            while we're at it, allocate the chainstack */
 886         if (udc_cnt) {
 887                 /* this will get free'd in do_replace()/ebt_register_table()
 888                    if an error occurs */
 889                 newinfo->chainstack =
 890                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 891                 if (!newinfo->chainstack)
 892                         return -ENOMEM;
 893                 for_each_possible_cpu(i) {
 894                         newinfo->chainstack[i] =
 895                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 896                         if (!newinfo->chainstack[i]) {
 897                                 while (i)
 898                                         vfree(newinfo->chainstack[--i]);
 899                                 vfree(newinfo->chainstack);
 900                                 newinfo->chainstack = NULL;
 901                                 return -ENOMEM;
 902                         }
 903                 }
 904
 905                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 906                 if (!cl_s)
 907                         return -ENOMEM;
 908                 i = 0; /* the i'th udc */
 909                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 910                    ebt_get_udc_positions, newinfo, &i, cl_s);
 911                 /* sanity check */
 912                 if (i != udc_cnt) {
 913                         BUGPRINT("i != udc_cnt\n");
 914                         vfree(cl_s);
 915                         return -EFAULT;
 916                 }
 917         }
 918
 919         /* Check for loops */
 920         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 921                 if (newinfo->hook_entry[i])
 922                         if (check_chainloops(newinfo->hook_entry[i],
 923                            cl_s, udc_cnt, i, newinfo->entries)) {
 924                                 vfree(cl_s);
 925                                 return -EINVAL;
 926                         }
 927
 928         /* we now know the following (along with E=mc²):
 929            - the nr of entries in each chain is right
 930            - the size of the allocated space is right
 931            - all valid hooks have a corresponding chain
 932            - there are no loops
 933            - wrong data can still be on the level of a single entry
 934            - could be there are jumps to places that are not the
 935              beginning of a chain. This can only occur in chains that
 936              are not accessible from any base chains, so we don't care. */
 937
 938         /* used to know what we need to clean up if something goes wrong */
 939         i = 0;
 940         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 941            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 942         if (ret != 0) {
 943                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 944                                   ebt_cleanup_entry, net, &i);
 945         }
 946         vfree(cl_s);
 947         return ret;
 948 }
 949
 950 /* called under write_lock */
 951 static void get_counters(const struct ebt_counter *oldcounters,
 952    struct ebt_counter *counters, unsigned int nentries)
 953 {
 954         int i, cpu;
 955         struct ebt_counter *counter_base;
 956
 957         /* counters of cpu 0 */
 958         memcpy(counters, oldcounters,
 959                sizeof(struct ebt_counter) * nentries);
 960
 961         /* add other counters to those of cpu 0 */
 962         for_each_possible_cpu(cpu) {
 963                 if (cpu == 0)
 964                         continue;
 965                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 966                 for (i = 0; i < nentries; i++) {
 967                         counters[i].pcnt += counter_base[i].pcnt;
 968                         counters[i].bcnt += counter_base[i].bcnt;
 969                 }
 970         }
 971 }
 972
 973 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 974                               struct ebt_table_info *newinfo)
 975 {
 976         int ret, i;
 977         struct ebt_counter *counterstmp = NULL;
 978         /* used to be able to unlock earlier */
 979         struct ebt_table_info *table;
 980         struct ebt_table *t;
 981
 982         /* the user wants counters back
 983            the check on the size is done later, when we have the lock */
 984         if (repl->num_counters) {
 985                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
 986                 counterstmp = vmalloc(size);
 987                 if (!counterstmp)
 988                         return -ENOMEM;
 989         }
 990
 991         newinfo->chainstack = NULL;
 992         ret = ebt_verify_pointers(repl, newinfo);
 993         if (ret != 0)
 994                 goto free_counterstmp;
 995
 996         ret = translate_table(net, repl->name, newinfo);
 997
 998         if (ret != 0)
 999                 goto free_counterstmp;
1000
1001         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1002         if (!t) {
1003                 ret = -ENOENT;
1004                 goto free_iterate;
1005         }
1006
1007         /* the table doesn't like it */
1008         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1009                 goto free_unlock;
1010
1011         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1012                 BUGPRINT("Wrong nr. of counters requested\n");
1013                 ret = -EINVAL;
1014                 goto free_unlock;
1015         }
1016
1017         /* we have the mutex lock, so no danger in reading this pointer */
1018         table = t->private;
1019         /* make sure the table can only be rmmod'ed if it contains no rules */
1020         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1021                 ret = -ENOENT;
1022                 goto free_unlock;
1023         } else if (table->nentries && !newinfo->nentries)
1024                 module_put(t->me);
1025         /* we need an atomic snapshot of the counters */
1026         write_lock_bh(&t->lock);
1027         if (repl->num_counters)
1028                 get_counters(t->private->counters, counterstmp,
1029                    t->private->nentries);
1030
1031         t->private = newinfo;
1032         write_unlock_bh(&t->lock);
1033         mutex_unlock(&ebt_mutex);
1034         /* so, a user can change the chains while having messed up her counter
1035            allocation. Only reason why this is done is because this way the lock
1036            is held only once, while this doesn't bring the kernel into a
1037            dangerous state. */
1038         if (repl->num_counters &&
1039            copy_to_user(repl->counters, counterstmp,
1040            repl->num_counters * sizeof(struct ebt_counter))) {
1041                 ret = -EFAULT;
1042         }
1043         else
1044                 ret = 0;
1045
1046         /* decrease module count and free resources */
1047         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1048                           ebt_cleanup_entry, net, NULL);
1049
1050         vfree(table->entries);
1051         if (table->chainstack) {
1052                 for_each_possible_cpu(i)
1053                         vfree(table->chainstack[i]);
1054                 vfree(table->chainstack);
1055         }
1056         vfree(table);
1057
1058         vfree(counterstmp);
1059         return ret;
1060
1061 free_unlock:
1062         mutex_unlock(&ebt_mutex);
1063 free_iterate:
1064         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1065                           ebt_cleanup_entry, net, NULL);
1066 free_counterstmp:
1067         vfree(counterstmp);
1068         /* can be initialized in translate_table() */
1069         if (newinfo->chainstack) {
1070                 for_each_possible_cpu(i)
1071                         vfree(newinfo->chainstack[i]);
1072                 vfree(newinfo->chainstack);
1073         }
1074         return ret;
1075 }
1076
1077 /* replace the table */
1078 static int do_replace(struct net *net, const void __user *user,
1079                       unsigned int len)
1080 {
1081         int ret, countersize;
1082         struct ebt_table_info *newinfo;
1083         struct ebt_replace tmp;
1084
1085         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1086                 return -EFAULT;
1087
1088         if (len != sizeof(tmp) + tmp.entries_size) {
1089                 BUGPRINT("Wrong len argument\n");
1090                 return -EINVAL;
1091         }
1092
1093         if (tmp.entries_size == 0) {
1094                 BUGPRINT("Entries_size never zero\n");
1095                 return -EINVAL;
1096         }
1097         /* overflow check */
1098         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1099                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1100                 return -ENOMEM;
1101         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1102                 return -ENOMEM;
1103
1104         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1105         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1106         if (!newinfo)
1107                 return -ENOMEM;
1108
1109         if (countersize)
1110                 memset(newinfo->counters, 0, countersize);
1111
1112         newinfo->entries = vmalloc(tmp.entries_size);
1113         if (!newinfo->entries) {
1114                 ret = -ENOMEM;
1115                 goto free_newinfo;
1116         }
1117         if (copy_from_user(
1118            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1119                 BUGPRINT("Couldn't copy entries from userspace\n");
1120                 ret = -EFAULT;
1121                 goto free_entries;
1122         }
1123
1124         ret = do_replace_finish(net, &tmp, newinfo);
1125         if (ret == 0)
1126                 return ret;
1127 free_entries:
1128         vfree(newinfo->entries);
1129 free_newinfo:
1130         vfree(newinfo);
1131         return ret;
1132 }
1133
1134 struct ebt_table *
1135 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1136 {
1137         struct ebt_table_info *newinfo;
1138         struct ebt_table *t, *table;
1139         struct ebt_replace_kernel *repl;
1140         int ret, i, countersize;
1141         void *p;
1142
1143         if (input_table == NULL || (repl = input_table->table) == NULL ||
1144             repl->entries == 0 || repl->entries_size == 0 ||
1145             repl->counters != NULL || input_table->private != NULL) {
1146                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1147                 return ERR_PTR(-EINVAL);
1148         }
1149
1150         /* Don't add one table to multiple lists. */
1151         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1152         if (!table) {
1153                 ret = -ENOMEM;
1154                 goto out;
1155         }
1156
1157         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1158         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1159         ret = -ENOMEM;
1160         if (!newinfo)
1161                 goto free_table;
1162
1163         p = vmalloc(repl->entries_size);
1164         if (!p)
1165                 goto free_newinfo;
1166
1167         memcpy(p, repl->entries, repl->entries_size);
1168         newinfo->entries = p;
1169
1170         newinfo->entries_size = repl->entries_size;
1171         newinfo->nentries = repl->nentries;
1172
1173         if (countersize)
1174                 memset(newinfo->counters, 0, countersize);
1175
1176         /* fill in newinfo and parse the entries */
1177         newinfo->chainstack = NULL;
1178         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1179                 if ((repl->valid_hooks & (1 << i)) == 0)
1180                         newinfo->hook_entry[i] = NULL;
1181                 else
1182                         newinfo->hook_entry[i] = p +
1183                                 ((char *)repl->hook_entry[i] - repl->entries);
1184         }
1185         ret = translate_table(net, repl->name, newinfo);
1186         if (ret != 0) {
1187                 BUGPRINT("Translate_table failed\n");
1188                 goto free_chainstack;
1189         }
1190
1191         if (table->check && table->check(newinfo, table->valid_hooks)) {
1192                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1193                 return ERR_PTR(-EINVAL);
1194         }
1195
1196         table->private = newinfo;
1197         rwlock_init(&table->lock);
1198         ret = mutex_lock_interruptible(&ebt_mutex);
1199         if (ret != 0)
1200                 goto free_chainstack;
1201
1202         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1203                 if (strcmp(t->name, table->name) == 0) {
1204                         ret = -EEXIST;
1205                         BUGPRINT("Table name already exists\n");
1206                         goto free_unlock;
1207                 }
1208         }
1209
1210         /* Hold a reference count if the chains aren't empty */
1211         if (newinfo->nentries && !try_module_get(table->me)) {
1212                 ret = -ENOENT;
1213                 goto free_unlock;
1214         }
1215         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1216         mutex_unlock(&ebt_mutex);
1217         return table;
1218 free_unlock:
1219         mutex_unlock(&ebt_mutex);
1220 free_chainstack:
1221         if (newinfo->chainstack) {
1222                 for_each_possible_cpu(i)
1223                         vfree(newinfo->chainstack[i]);
1224                 vfree(newinfo->chainstack);
1225         }
1226         vfree(newinfo->entries);
1227 free_newinfo:
1228         vfree(newinfo);
1229 free_table:
1230         kfree(table);
1231 out:
1232         return ERR_PTR(ret);
1233 }
1234
1235 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1236 {
1237         int i;
1238
1239         if (!table) {
1240                 BUGPRINT("Request to unregister NULL table!!!\n");
1241                 return;
1242         }
1243         mutex_lock(&ebt_mutex);
1244         list_del(&table->list);
1245         mutex_unlock(&ebt_mutex);
1246         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1247                           ebt_cleanup_entry, net, NULL);
1248         if (table->private->nentries)
1249                 module_put(table->me);
1250         vfree(table->private->entries);
1251         if (table->private->chainstack) {
1252                 for_each_possible_cpu(i)
1253                         vfree(table->private->chainstack[i]);
1254                 vfree(table->private->chainstack);
1255         }
1256         vfree(table->private);
1257         kfree(table);
1258 }
1259
1260 /* userspace just supplied us with counters */
1261 static int do_update_counters(struct net *net, const char *name,
1262                                 struct ebt_counter __user *counters,
1263                                 unsigned int num_counters,
1264                                 const void __user *user, unsigned int len)
1265 {
1266         int i, ret;
1267         struct ebt_counter *tmp;
1268         struct ebt_table *t;
1269
1270         if (num_counters == 0)
1271                 return -EINVAL;
1272
1273         tmp = vmalloc(num_counters * sizeof(*tmp));
1274         if (!tmp)
1275                 return -ENOMEM;
1276
1277         t = find_table_lock(net, name, &ret, &ebt_mutex);
1278         if (!t)
1279                 goto free_tmp;
1280
1281         if (num_counters != t->private->nentries) {
1282                 BUGPRINT("Wrong nr of counters\n");
1283                 ret = -EINVAL;
1284                 goto unlock_mutex;
1285         }
1286
1287         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1288                 ret = -EFAULT;
1289                 goto unlock_mutex;
1290         }
1291
1292         /* we want an atomic add of the counters */
1293         write_lock_bh(&t->lock);
1294
1295         /* we add to the counters of the first cpu */
1296         for (i = 0; i < num_counters; i++) {
1297                 t->private->counters[i].pcnt += tmp[i].pcnt;
1298                 t->private->counters[i].bcnt += tmp[i].bcnt;
1299         }
1300
1301         write_unlock_bh(&t->lock);
1302         ret = 0;
1303 unlock_mutex:
1304         mutex_unlock(&ebt_mutex);
1305 free_tmp:
1306         vfree(tmp);
1307         return ret;
1308 }
1309
1310 static int update_counters(struct net *net, const void __user *user,
1311                             unsigned int len)
1312 {
1313         struct ebt_replace hlp;
1314
1315         if (copy_from_user(&hlp, user, sizeof(hlp)))
1316                 return -EFAULT;
1317
1318         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1319                 return -EINVAL;
1320
1321         return do_update_counters(net, hlp.name, hlp.counters,
1322                                 hlp.num_counters, user, len);
1323 }
1324
1325 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1326     const char *base, char __user *ubase)
1327 {
1328         char __user *hlp = ubase + ((char *)m - base);
1329         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1330                 return -EFAULT;
1331         return 0;
1332 }
1333
1334 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1335     const char *base, char __user *ubase)
1336 {
1337         char __user *hlp = ubase + ((char *)w - base);
1338         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1339                 return -EFAULT;
1340         return 0;
1341 }
1342
1343 static inline int
1344 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1345 {
1346         int ret;
1347         char __user *hlp;
1348         const struct ebt_entry_target *t;
1349
1350         if (e->bitmask == 0)
1351                 return 0;
1352
1353         hlp = ubase + (((char *)e + e->target_offset) - base);
1354         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1355
1356         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1357         if (ret != 0)
1358                 return ret;
1359         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1360         if (ret != 0)
1361                 return ret;
1362         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1363                 return -EFAULT;
1364         return 0;
1365 }
1366
1367 static int copy_counters_to_user(struct ebt_table *t,
1368                                   const struct ebt_counter *oldcounters,
1369                                   void __user *user, unsigned int num_counters,
1370                                   unsigned int nentries)
1371 {
1372         struct ebt_counter *counterstmp;
1373         int ret = 0;
1374
1375         /* userspace might not need the counters */
1376         if (num_counters == 0)
1377                 return 0;
1378
1379         if (num_counters != nentries) {
1380                 BUGPRINT("Num_counters wrong\n");
1381                 return -EINVAL;
1382         }
1383
1384         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1385         if (!counterstmp)
1386                 return -ENOMEM;
1387
1388         write_lock_bh(&t->lock);
1389         get_counters(oldcounters, counterstmp, nentries);
1390         write_unlock_bh(&t->lock);
1391
1392         if (copy_to_user(user, counterstmp,
1393            nentries * sizeof(struct ebt_counter)))
1394                 ret = -EFAULT;
1395         vfree(counterstmp);
1396         return ret;
1397 }
1398
1399 /* called with ebt_mutex locked */
1400 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1401     const int *len, int cmd)
1402 {
1403         struct ebt_replace tmp;
1404         const struct ebt_counter *oldcounters;
1405         unsigned int entries_size, nentries;
1406         int ret;
1407         char *entries;
1408
1409         if (cmd == EBT_SO_GET_ENTRIES) {
1410                 entries_size = t->private->entries_size;
1411                 nentries = t->private->nentries;
1412                 entries = t->private->entries;
1413                 oldcounters = t->private->counters;
1414         } else {
1415                 entries_size = t->table->entries_size;
1416                 nentries = t->table->nentries;
1417                 entries = t->table->entries;
1418                 oldcounters = t->table->counters;
1419         }
1420
1421         if (copy_from_user(&tmp, user, sizeof(tmp)))
1422                 return -EFAULT;
1423
1424         if (*len != sizeof(struct ebt_replace) + entries_size +
1425            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
1426                 return -EINVAL;
1427
1428         if (tmp.nentries != nentries) {
1429                 BUGPRINT("Nentries wrong\n");
1430                 return -EINVAL;
1431         }
1432
1433         if (tmp.entries_size != entries_size) {
1434                 BUGPRINT("Wrong size\n");
1435                 return -EINVAL;
1436         }
1437
1438         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1439                                         tmp.num_counters, nentries);
1440         if (ret)
1441                 return ret;
1442
1443         if (copy_to_user(tmp.entries, entries, entries_size)) {
1444                 BUGPRINT("Couldn't copy entries to userspace\n");
1445                 return -EFAULT;
1446         }
1447         /* set the match/watcher/target names right */
1448         return EBT_ENTRY_ITERATE(entries, entries_size,
1449            ebt_make_names, entries, tmp.entries);
1450 }
1451
1452 static int do_ebt_set_ctl(struct sock *sk,
1453         int cmd, void __user *user, unsigned int len)
1454 {
1455         int ret;
1456
1457         if (!capable(CAP_NET_ADMIN))
1458                 return -EPERM;
1459
1460         switch(cmd) {
1461         case EBT_SO_SET_ENTRIES:
1462                 ret = do_replace(sock_net(sk), user, len);
1463                 break;
1464         case EBT_SO_SET_COUNTERS:
1465                 ret = update_counters(sock_net(sk), user, len);
1466                 break;
1467         default:
1468                 ret = -EINVAL;
1469         }
1470         return ret;
1471 }
1472
1473 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1474 {
1475         int ret;
1476         struct ebt_replace tmp;
1477         struct ebt_table *t;
1478
1479         if (!capable(CAP_NET_ADMIN))
1480                 return -EPERM;
1481
1482         if (copy_from_user(&tmp, user, sizeof(tmp)))
1483                 return -EFAULT;
1484
1485         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1486         if (!t)
1487                 return ret;
1488
1489         switch(cmd) {
1490         case EBT_SO_GET_INFO:
1491         case EBT_SO_GET_INIT_INFO:
1492                 if (*len != sizeof(struct ebt_replace)){
1493                         ret = -EINVAL;
1494                         mutex_unlock(&ebt_mutex);
1495                         break;
1496                 }
1497                 if (cmd == EBT_SO_GET_INFO) {
1498                         tmp.nentries = t->private->nentries;
1499                         tmp.entries_size = t->private->entries_size;
1500                         tmp.valid_hooks = t->valid_hooks;
1501                 } else {
1502                         tmp.nentries = t->table->nentries;
1503                         tmp.entries_size = t->table->entries_size;
1504                         tmp.valid_hooks = t->table->valid_hooks;
1505                 }
1506                 mutex_unlock(&ebt_mutex);
1507                 if (copy_to_user(user, &tmp, *len) != 0){
1508                         BUGPRINT("c2u Didn't work\n");
1509                         ret = -EFAULT;
1510                         break;
1511                 }
1512                 ret = 0;
1513                 break;
1514
1515         case EBT_SO_GET_ENTRIES:
1516         case EBT_SO_GET_INIT_ENTRIES:
1517                 ret = copy_everything_to_user(t, user, len, cmd);
1518                 mutex_unlock(&ebt_mutex);
1519                 break;
1520
1521         default:
1522                 mutex_unlock(&ebt_mutex);
1523                 ret = -EINVAL;
1524         }
1525
1526         return ret;
1527 }
1528
1529 #ifdef CONFIG_COMPAT
1530 /* 32 bit-userspace compatibility definitions. */
1531 struct compat_ebt_replace {
1532         char name[EBT_TABLE_MAXNAMELEN];
1533         compat_uint_t valid_hooks;
1534         compat_uint_t nentries;
1535         compat_uint_t entries_size;
1536         /* start of the chains */
1537         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1538         /* nr of counters userspace expects back */
1539         compat_uint_t num_counters;
1540         /* where the kernel will put the old counters. */
1541         compat_uptr_t counters;
1542         compat_uptr_t entries;
1543 };
1544
1545 /* struct ebt_entry_match, _target and _watcher have same layout */
1546 struct compat_ebt_entry_mwt {
1547         union {
1548                 char name[EBT_FUNCTION_MAXNAMELEN];
1549                 compat_uptr_t ptr;
1550         } u;
1551         compat_uint_t match_size;
1552         compat_uint_t data[0];
1553 };
1554
1555 /* account for possible padding between match_size and ->data */
1556 static int ebt_compat_entry_padsize(void)
1557 {
1558         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1559                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1560         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1561                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1562 }
1563
1564 static int ebt_compat_match_offset(const struct xt_match *match,
1565                                    unsigned int userlen)
1566 {
1567         /*
1568          * ebt_among needs special handling. The kernel .matchsize is
1569          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1570          * value is expected.
1571          * Example: userspace sends 4500, ebt_among.c wants 4504.
1572          */
1573         if (unlikely(match->matchsize == -1))
1574                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1575         return xt_compat_match_offset(match);
1576 }
1577
1578 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1579                                 unsigned int *size)
1580 {
1581         const struct xt_match *match = m->u.match;
1582         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1583         int off = ebt_compat_match_offset(match, m->match_size);
1584         compat_uint_t msize = m->match_size - off;
1585
1586         BUG_ON(off >= m->match_size);
1587
1588         if (copy_to_user(cm->u.name, match->name,
1589             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1590                 return -EFAULT;
1591
1592         if (match->compat_to_user) {
1593                 if (match->compat_to_user(cm->data, m->data))
1594                         return -EFAULT;
1595         } else if (copy_to_user(cm->data, m->data, msize))
1596                         return -EFAULT;
1597
1598         *size -= ebt_compat_entry_padsize() + off;
1599         *dstptr = cm->data;
1600         *dstptr += msize;
1601         return 0;
1602 }
1603
1604 static int compat_target_to_user(struct ebt_entry_target *t,
1605                                  void __user **dstptr,
1606                                  unsigned int *size)
1607 {
1608         const struct xt_target *target = t->u.target;
1609         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1610         int off = xt_compat_target_offset(target);
1611         compat_uint_t tsize = t->target_size - off;
1612
1613         BUG_ON(off >= t->target_size);
1614
1615         if (copy_to_user(cm->u.name, target->name,
1616             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1617                 return -EFAULT;
1618
1619         if (target->compat_to_user) {
1620                 if (target->compat_to_user(cm->data, t->data))
1621                         return -EFAULT;
1622         } else if (copy_to_user(cm->data, t->data, tsize))
1623                 return -EFAULT;
1624
1625         *size -= ebt_compat_entry_padsize() + off;
1626         *dstptr = cm->data;
1627         *dstptr += tsize;
1628         return 0;
1629 }
1630
1631 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1632                                   void __user **dstptr,
1633                                   unsigned int *size)
1634 {
1635         return compat_target_to_user((struct ebt_entry_target *)w,
1636                                                         dstptr, size);
1637 }
1638
1639 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1640                                 unsigned int *size)
1641 {
1642         struct ebt_entry_target *t;
1643         struct ebt_entry __user *ce;
1644         u32 watchers_offset, target_offset, next_offset;
1645         compat_uint_t origsize;
1646         int ret;
1647
1648         if (e->bitmask == 0) {
1649                 if (*size < sizeof(struct ebt_entries))
1650                         return -EINVAL;
1651                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1652                         return -EFAULT;
1653
1654                 *dstptr += sizeof(struct ebt_entries);
1655                 *size -= sizeof(struct ebt_entries);
1656                 return 0;
1657         }
1658
1659         if (*size < sizeof(*ce))
1660                 return -EINVAL;
1661
1662         ce = (struct ebt_entry __user *)*dstptr;
1663         if (copy_to_user(ce, e, sizeof(*ce)))
1664                 return -EFAULT;
1665
1666         origsize = *size;
1667         *dstptr += sizeof(*ce);
1668
1669         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1670         if (ret)
1671                 return ret;
1672         watchers_offset = e->watchers_offset - (origsize - *size);
1673
1674         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1675         if (ret)
1676                 return ret;
1677         target_offset = e->target_offset - (origsize - *size);
1678
1679         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1680
1681         ret = compat_target_to_user(t, dstptr, size);
1682         if (ret)
1683                 return ret;
1684         next_offset = e->next_offset - (origsize - *size);
1685
1686         if (put_user(watchers_offset, &ce->watchers_offset) ||
1687             put_user(target_offset, &ce->target_offset) ||
1688             put_user(next_offset, &ce->next_offset))
1689                 return -EFAULT;
1690
1691         *size -= sizeof(*ce);
1692         return 0;
1693 }
1694
1695 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1696 {
1697         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1698         *off += ebt_compat_entry_padsize();
1699         return 0;
1700 }
1701
1702 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1703 {
1704         *off += xt_compat_target_offset(w->u.watcher);
1705         *off += ebt_compat_entry_padsize();
1706         return 0;
1707 }
1708
1709 static int compat_calc_entry(const struct ebt_entry *e,
1710                              const struct ebt_table_info *info,
1711                              const void *base,
1712                              struct compat_ebt_replace *newinfo)
1713 {
1714         const struct ebt_entry_target *t;
1715         unsigned int entry_offset;
1716         int off, ret, i;
1717
1718         if (e->bitmask == 0)
1719                 return 0;
1720
1721         off = 0;
1722         entry_offset = (void *)e - base;
1723
1724         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1725         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1726
1727         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1728
1729         off += xt_compat_target_offset(t->u.target);
1730         off += ebt_compat_entry_padsize();
1731
1732         newinfo->entries_size -= off;
1733
1734         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1735         if (ret)
1736                 return ret;
1737
1738         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1739                 const void *hookptr = info->hook_entry[i];
1740                 if (info->hook_entry[i] &&
1741                     (e < (struct ebt_entry *)(base - hookptr))) {
1742                         newinfo->hook_entry[i] -= off;
1743                         pr_debug("0x%08X -> 0x%08X\n",
1744                                         newinfo->hook_entry[i] + off,
1745                                         newinfo->hook_entry[i]);
1746                 }
1747         }
1748
1749         return 0;
1750 }
1751
1752
1753 static int compat_table_info(const struct ebt_table_info *info,
1754                              struct compat_ebt_replace *newinfo)
1755 {
1756         unsigned int size = info->entries_size;
1757         const void *entries = info->entries;
1758
1759         newinfo->entries_size = size;
1760
1761         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1762                                                         entries, newinfo);
1763 }
1764
1765 static int compat_copy_everything_to_user(struct ebt_table *t,
1766                                           void __user *user, int *len, int cmd)
1767 {
1768         struct compat_ebt_replace repl, tmp;
1769         struct ebt_counter *oldcounters;
1770         struct ebt_table_info tinfo;
1771         int ret;
1772         void __user *pos;
1773
1774         memset(&tinfo, 0, sizeof(tinfo));
1775
1776         if (cmd == EBT_SO_GET_ENTRIES) {
1777                 tinfo.entries_size = t->private->entries_size;
1778                 tinfo.nentries = t->private->nentries;
1779                 tinfo.entries = t->private->entries;
1780                 oldcounters = t->private->counters;
1781         } else {
1782                 tinfo.entries_size = t->table->entries_size;
1783                 tinfo.nentries = t->table->nentries;
1784                 tinfo.entries = t->table->entries;
1785                 oldcounters = t->table->counters;
1786         }
1787
1788         if (copy_from_user(&tmp, user, sizeof(tmp)))
1789                 return -EFAULT;
1790
1791         if (tmp.nentries != tinfo.nentries ||
1792            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1793                 return -EINVAL;
1794
1795         memcpy(&repl, &tmp, sizeof(repl));
1796         if (cmd == EBT_SO_GET_ENTRIES)
1797                 ret = compat_table_info(t->private, &repl);
1798         else
1799                 ret = compat_table_info(&tinfo, &repl);
1800         if (ret)
1801                 return ret;
1802
1803         if (*len != sizeof(tmp) + repl.entries_size +
1804            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1805                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1806                                 *len, tinfo.entries_size, repl.entries_size);
1807                 return -EINVAL;
1808         }
1809
1810         /* userspace might not need the counters */
1811         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1812                                         tmp.num_counters, tinfo.nentries);
1813         if (ret)
1814                 return ret;
1815
1816         pos = compat_ptr(tmp.entries);
1817         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1818                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1819 }
1820
1821 struct ebt_entries_buf_state {
1822         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1823         u32 buf_kern_len;       /* total size of kernel buffer */
1824         u32 buf_kern_offset;    /* amount of data copied so far */
1825         u32 buf_user_offset;    /* read position in userspace buffer */
1826 };
1827
1828 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1829 {
1830         state->buf_kern_offset += sz;
1831         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1832 }
1833
1834 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1835                        void *data, unsigned int sz)
1836 {
1837         if (state->buf_kern_start == NULL)
1838                 goto count_only;
1839
1840         BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1841
1842         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1843
1844  count_only:
1845         state->buf_user_offset += sz;
1846         return ebt_buf_count(state, sz);
1847 }
1848
1849 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1850 {
1851         char *b = state->buf_kern_start;
1852
1853         BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1854
1855         if (b != NULL && sz > 0)
1856                 memset(b + state->buf_kern_offset, 0, sz);
1857         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1858         return ebt_buf_count(state, sz);
1859 }
1860
1861 enum compat_mwt {
1862         EBT_COMPAT_MATCH,
1863         EBT_COMPAT_WATCHER,
1864         EBT_COMPAT_TARGET,
1865 };
1866
1867 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1868                                 enum compat_mwt compat_mwt,
1869                                 struct ebt_entries_buf_state *state,
1870                                 const unsigned char *base)
1871 {
1872         char name[EBT_FUNCTION_MAXNAMELEN];
1873         struct xt_match *match;
1874         struct xt_target *wt;
1875         void *dst = NULL;
1876         int off, pad = 0, ret = 0;
1877         unsigned int size_kern, entry_offset, match_size = mwt->match_size;
1878
1879         strlcpy(name, mwt->u.name, sizeof(name));
1880
1881         if (state->buf_kern_start)
1882                 dst = state->buf_kern_start + state->buf_kern_offset;
1883
1884         entry_offset = (unsigned char *) mwt - base;
1885         switch (compat_mwt) {
1886         case EBT_COMPAT_MATCH:
1887                 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
1888                                                 name, 0), "ebt_%s", name);
1889                 if (match == NULL)
1890                         return -ENOENT;
1891                 if (IS_ERR(match))
1892                         return PTR_ERR(match);
1893
1894                 off = ebt_compat_match_offset(match, match_size);
1895                 if (dst) {
1896                         if (match->compat_from_user)
1897                                 match->compat_from_user(dst, mwt->data);
1898                         else
1899                                 memcpy(dst, mwt->data, match_size);
1900                 }
1901
1902                 size_kern = match->matchsize;
1903                 if (unlikely(size_kern == -1))
1904                         size_kern = match_size;
1905                 module_put(match->me);
1906                 break;
1907         case EBT_COMPAT_WATCHER: /* fallthrough */
1908         case EBT_COMPAT_TARGET:
1909                 wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
1910                                                 name, 0), "ebt_%s", name);
1911                 if (wt == NULL)
1912                         return -ENOENT;
1913                 if (IS_ERR(wt))
1914                         return PTR_ERR(wt);
1915                 off = xt_compat_target_offset(wt);
1916
1917                 if (dst) {
1918                         if (wt->compat_from_user)
1919                                 wt->compat_from_user(dst, mwt->data);
1920                         else
1921                                 memcpy(dst, mwt->data, match_size);
1922                 }
1923
1924                 size_kern = wt->targetsize;
1925                 module_put(wt->me);
1926                 break;
1927         }
1928
1929         if (!dst) {
1930                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1931                                         off + ebt_compat_entry_padsize());
1932                 if (ret < 0)
1933                         return ret;
1934         }
1935
1936         state->buf_kern_offset += match_size + off;
1937         state->buf_user_offset += match_size;
1938         pad = XT_ALIGN(size_kern) - size_kern;
1939
1940         if (pad > 0 && dst) {
1941                 BUG_ON(state->buf_kern_len <= pad);
1942                 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1943                 memset(dst + size_kern, 0, pad);
1944         }
1945         return off + match_size;
1946 }
1947
1948 /*
1949  * return size of all matches, watchers or target, including necessary
1950  * alignment and padding.
1951  */
1952 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1953                         unsigned int size_left, enum compat_mwt type,
1954                         struct ebt_entries_buf_state *state, const void *base)
1955 {
1956         int growth = 0;
1957         char *buf;
1958
1959         if (size_left == 0)
1960                 return 0;
1961
1962         buf = (char *) match32;
1963
1964         while (size_left >= sizeof(*match32)) {
1965                 struct ebt_entry_match *match_kern;
1966                 int ret;
1967
1968                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1969                 if (match_kern) {
1970                         char *tmp;
1971                         tmp = state->buf_kern_start + state->buf_kern_offset;
1972                         match_kern = (struct ebt_entry_match *) tmp;
1973                 }
1974                 ret = ebt_buf_add(state, buf, sizeof(*match32));
1975                 if (ret < 0)
1976                         return ret;
1977                 size_left -= sizeof(*match32);
1978
1979                 /* add padding before match->data (if any) */
1980                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1981                 if (ret < 0)
1982                         return ret;
1983
1984                 if (match32->match_size > size_left)
1985                         return -EINVAL;
1986
1987                 size_left -= match32->match_size;
1988
1989                 ret = compat_mtw_from_user(match32, type, state, base);
1990                 if (ret < 0)
1991                         return ret;
1992
1993                 BUG_ON(ret < match32->match_size);
1994                 growth += ret - match32->match_size;
1995                 growth += ebt_compat_entry_padsize();
1996
1997                 buf += sizeof(*match32);
1998                 buf += match32->match_size;
1999
2000                 if (match_kern)
2001                         match_kern->match_size = ret;
2002
2003                 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2004                 match32 = (struct compat_ebt_entry_mwt *) buf;
2005         }
2006
2007         return growth;
2008 }
2009
2010 #define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...)          \
2011 ({                                                          \
2012         unsigned int __i;                                   \
2013         int __ret = 0;                                      \
2014         struct compat_ebt_entry_mwt *__watcher;             \
2015                                                             \
2016         for (__i = e->watchers_offset;                      \
2017              __i < (e)->target_offset;                      \
2018              __i += __watcher->watcher_size +               \
2019              sizeof(struct compat_ebt_entry_mwt)) {         \
2020                 __watcher = (void *)(e) + __i;              \
2021                 __ret = fn(__watcher , ## args);            \
2022                 if (__ret != 0)                             \
2023                         break;                              \
2024         }                                                   \
2025         if (__ret == 0) {                                   \
2026                 if (__i != (e)->target_offset)              \
2027                         __ret = -EINVAL;                    \
2028         }                                                   \
2029         __ret;                                              \
2030 })
2031
2032 #define EBT_COMPAT_MATCH_ITERATE(e, fn, args...)            \
2033 ({                                                          \
2034         unsigned int __i;                                   \
2035         int __ret = 0;                                      \
2036         struct compat_ebt_entry_mwt *__match;               \
2037                                                             \
2038         for (__i = sizeof(struct ebt_entry);                \
2039              __i < (e)->watchers_offset;                    \
2040              __i += __match->match_size +                   \
2041              sizeof(struct compat_ebt_entry_mwt)) {         \
2042                 __match = (void *)(e) + __i;                \
2043                 __ret = fn(__match , ## args);              \
2044                 if (__ret != 0)                             \
2045                         break;                              \
2046         }                                                   \
2047         if (__ret == 0) {                                   \
2048                 if (__i != (e)->watchers_offset)            \
2049                         __ret = -EINVAL;                    \
2050         }                                                   \
2051         __ret;                                              \
2052 })
2053
2054 /* called for all ebt_entry structures. */
2055 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2056                           unsigned int *total,
2057                           struct ebt_entries_buf_state *state)
2058 {
2059         unsigned int i, j, startoff, new_offset = 0;
2060         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2061         unsigned int offsets[4];
2062         unsigned int *offsets_update = NULL;
2063         int ret;
2064         char *buf_start;
2065
2066         if (*total < sizeof(struct ebt_entries))
2067                 return -EINVAL;
2068
2069         if (!entry->bitmask) {
2070                 *total -= sizeof(struct ebt_entries);
2071                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2072         }
2073         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2074                 return -EINVAL;
2075
2076         startoff = state->buf_user_offset;
2077         /* pull in most part of ebt_entry, it does not need to be changed. */
2078         ret = ebt_buf_add(state, entry,
2079                         offsetof(struct ebt_entry, watchers_offset));
2080         if (ret < 0)
2081                 return ret;
2082
2083         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2084         memcpy(&offsets[1], &entry->watchers_offset,
2085                         sizeof(offsets) - sizeof(offsets[0]));
2086
2087         if (state->buf_kern_start) {
2088                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2089                 offsets_update = (unsigned int *) buf_start;
2090         }
2091         ret = ebt_buf_add(state, &offsets[1],
2092                         sizeof(offsets) - sizeof(offsets[0]));
2093         if (ret < 0)
2094                 return ret;
2095         buf_start = (char *) entry;
2096         /*
2097          * 0: matches offset, always follows ebt_entry.
2098          * 1: watchers offset, from ebt_entry structure
2099          * 2: target offset, from ebt_entry structure
2100          * 3: next ebt_entry offset, from ebt_entry structure
2101          *
2102          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2103          */
2104         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2105                 struct compat_ebt_entry_mwt *match32;
2106                 unsigned int size;
2107                 char *buf = buf_start;
2108
2109                 buf = buf_start + offsets[i];
2110                 if (offsets[i] > offsets[j])
2111                         return -EINVAL;
2112
2113                 match32 = (struct compat_ebt_entry_mwt *) buf;
2114                 size = offsets[j] - offsets[i];
2115                 ret = ebt_size_mwt(match32, size, i, state, base);
2116                 if (ret < 0)
2117                         return ret;
2118                 new_offset += ret;
2119                 if (offsets_update && new_offset) {
2120                         pr_debug("change offset %d to %d\n",
2121                                 offsets_update[i], offsets[j] + new_offset);
2122                         offsets_update[i] = offsets[j] + new_offset;
2123                 }
2124         }
2125
2126         startoff = state->buf_user_offset - startoff;
2127
2128         BUG_ON(*total < startoff);
2129         *total -= startoff;
2130         return 0;
2131 }
2132
2133 /*
2134  * repl->entries_size is the size of the ebt_entry blob in userspace.
2135  * It might need more memory when copied to a 64 bit kernel in case
2136  * userspace is 32-bit. So, first task: find out how much memory is needed.
2137  *
2138  * Called before validation is performed.
2139  */
2140 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2141                                 struct ebt_entries_buf_state *state)
2142 {
2143         unsigned int size_remaining = size_user;
2144         int ret;
2145
2146         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2147                                         &size_remaining, state);
2148         if (ret < 0)
2149                 return ret;
2150
2151         WARN_ON(size_remaining);
2152         return state->buf_kern_offset;
2153 }
2154
2155
2156 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2157                                             void __user *user, unsigned int len)
2158 {
2159         struct compat_ebt_replace tmp;
2160         int i;
2161
2162         if (len < sizeof(tmp))
2163                 return -EINVAL;
2164
2165         if (copy_from_user(&tmp, user, sizeof(tmp)))
2166                 return -EFAULT;
2167
2168         if (len != sizeof(tmp) + tmp.entries_size)
2169                 return -EINVAL;
2170
2171         if (tmp.entries_size == 0)
2172                 return -EINVAL;
2173
2174         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2175                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2176                 return -ENOMEM;
2177         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2178                 return -ENOMEM;
2179
2180         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2181
2182         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2183         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2184                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2185
2186         repl->num_counters = tmp.num_counters;
2187         repl->counters = compat_ptr(tmp.counters);
2188         repl->entries = compat_ptr(tmp.entries);
2189         return 0;
2190 }
2191
2192 static int compat_do_replace(struct net *net, void __user *user,
2193                              unsigned int len)
2194 {
2195         int ret, i, countersize, size64;
2196         struct ebt_table_info *newinfo;
2197         struct ebt_replace tmp;
2198         struct ebt_entries_buf_state state;
2199         void *entries_tmp;
2200
2201         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2202         if (ret) {
2203                 /* try real handler in case userland supplied needed padding */
2204                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2205                         ret = 0;
2206                 return ret;
2207         }
2208
2209         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2210         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2211         if (!newinfo)
2212                 return -ENOMEM;
2213
2214         if (countersize)
2215                 memset(newinfo->counters, 0, countersize);
2216
2217         memset(&state, 0, sizeof(state));
2218
2219         newinfo->entries = vmalloc(tmp.entries_size);
2220         if (!newinfo->entries) {
2221                 ret = -ENOMEM;
2222                 goto free_newinfo;
2223         }
2224         if (copy_from_user(
2225            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2226                 ret = -EFAULT;
2227                 goto free_entries;
2228         }
2229
2230         entries_tmp = newinfo->entries;
2231
2232         xt_compat_lock(NFPROTO_BRIDGE);
2233
2234         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2235         if (ret < 0)
2236                 goto out_unlock;
2237
2238         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2239                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2240                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2241
2242         size64 = ret;
2243         newinfo->entries = vmalloc(size64);
2244         if (!newinfo->entries) {
2245                 vfree(entries_tmp);
2246                 ret = -ENOMEM;
2247                 goto out_unlock;
2248         }
2249
2250         memset(&state, 0, sizeof(state));
2251         state.buf_kern_start = newinfo->entries;
2252         state.buf_kern_len = size64;
2253
2254         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2255         BUG_ON(ret < 0);        /* parses same data again */
2256
2257         vfree(entries_tmp);
2258         tmp.entries_size = size64;
2259
2260         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2261                 char __user *usrptr;
2262                 if (tmp.hook_entry[i]) {
2263                         unsigned int delta;
2264                         usrptr = (char __user *) tmp.hook_entry[i];
2265                         delta = usrptr - tmp.entries;
2266                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2267                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2268                 }
2269         }
2270
2271         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2272         xt_compat_unlock(NFPROTO_BRIDGE);
2273
2274         ret = do_replace_finish(net, &tmp, newinfo);
2275         if (ret == 0)
2276                 return ret;
2277 free_entries:
2278         vfree(newinfo->entries);
2279 free_newinfo:
2280         vfree(newinfo);
2281         return ret;
2282 out_unlock:
2283         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2284         xt_compat_unlock(NFPROTO_BRIDGE);
2285         goto free_entries;
2286 }
2287
2288 static int compat_update_counters(struct net *net, void __user *user,
2289                                   unsigned int len)
2290 {
2291         struct compat_ebt_replace hlp;
2292
2293         if (copy_from_user(&hlp, user, sizeof(hlp)))
2294                 return -EFAULT;
2295
2296         /* try real handler in case userland supplied needed padding */
2297         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2298                 return update_counters(net, user, len);
2299
2300         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2301                                         hlp.num_counters, user, len);
2302 }
2303
2304 static int compat_do_ebt_set_ctl(struct sock *sk,
2305                 int cmd, void __user *user, unsigned int len)
2306 {
2307         int ret;
2308
2309         if (!capable(CAP_NET_ADMIN))
2310                 return -EPERM;
2311
2312         switch (cmd) {
2313         case EBT_SO_SET_ENTRIES:
2314                 ret = compat_do_replace(sock_net(sk), user, len);
2315                 break;
2316         case EBT_SO_SET_COUNTERS:
2317                 ret = compat_update_counters(sock_net(sk), user, len);
2318                 break;
2319         default:
2320                 ret = -EINVAL;
2321   }
2322         return ret;
2323 }
2324
2325 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2326                 void __user *user, int *len)
2327 {
2328         int ret;
2329         struct compat_ebt_replace tmp;
2330         struct ebt_table *t;
2331
2332         if (!capable(CAP_NET_ADMIN))
2333                 return -EPERM;
2334
2335         /* try real handler in case userland supplied needed padding */
2336         if ((cmd == EBT_SO_GET_INFO ||
2337              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2338                         return do_ebt_get_ctl(sk, cmd, user, len);
2339
2340         if (copy_from_user(&tmp, user, sizeof(tmp)))
2341                 return -EFAULT;
2342
2343         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
2344         if (!t)
2345                 return ret;
2346
2347         xt_compat_lock(NFPROTO_BRIDGE);
2348         switch (cmd) {
2349         case EBT_SO_GET_INFO:
2350                 tmp.nentries = t->private->nentries;
2351                 ret = compat_table_info(t->private, &tmp);
2352                 if (ret)
2353                         goto out;
2354                 tmp.valid_hooks = t->valid_hooks;
2355
2356                 if (copy_to_user(user, &tmp, *len) != 0) {
2357                         ret = -EFAULT;
2358                         break;
2359                 }
2360                 ret = 0;
2361                 break;
2362         case EBT_SO_GET_INIT_INFO:
2363                 tmp.nentries = t->table->nentries;
2364                 tmp.entries_size = t->table->entries_size;
2365                 tmp.valid_hooks = t->table->valid_hooks;
2366
2367                 if (copy_to_user(user, &tmp, *len) != 0) {
2368                         ret = -EFAULT;
2369                         break;
2370                 }
2371                 ret = 0;
2372                 break;
2373         case EBT_SO_GET_ENTRIES:
2374         case EBT_SO_GET_INIT_ENTRIES:
2375                 /*
2376                  * try real handler first in case of userland-side padding.
2377                  * in case we are dealing with an 'ordinary' 32 bit binary
2378                  * without 64bit compatibility padding, this will fail right
2379                  * after copy_from_user when the *len argument is validated.
2380                  *
2381                  * the compat_ variant needs to do one pass over the kernel
2382                  * data set to adjust for size differences before it the check.
2383                  */
2384                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2385                         ret = 0;
2386                 else
2387                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2388                 break;
2389         default:
2390                 ret = -EINVAL;
2391         }
2392  out:
2393         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2394         xt_compat_unlock(NFPROTO_BRIDGE);
2395         mutex_unlock(&ebt_mutex);
2396         return ret;
2397 }
2398 #endif
2399
2400 static struct nf_sockopt_ops ebt_sockopts =
2401 {
2402         .pf             = PF_INET,
2403         .set_optmin     = EBT_BASE_CTL,
2404         .set_optmax     = EBT_SO_SET_MAX + 1,
2405         .set            = do_ebt_set_ctl,
2406 #ifdef CONFIG_COMPAT
2407         .compat_set     = compat_do_ebt_set_ctl,
2408 #endif
2409         .get_optmin     = EBT_BASE_CTL,
2410         .get_optmax     = EBT_SO_GET_MAX + 1,
2411         .get            = do_ebt_get_ctl,
2412 #ifdef CONFIG_COMPAT
2413         .compat_get     = compat_do_ebt_get_ctl,
2414 #endif
2415         .owner          = THIS_MODULE,
2416 };
2417
2418 static int __init ebtables_init(void)
2419 {
2420         int ret;
2421
2422         ret = xt_register_target(&ebt_standard_target);
2423         if (ret < 0)
2424                 return ret;
2425         ret = nf_register_sockopt(&ebt_sockopts);
2426         if (ret < 0) {
2427                 xt_unregister_target(&ebt_standard_target);
2428                 return ret;
2429         }
2430
2431         printk(KERN_INFO "Ebtables v2.0 registered\n");
2432         return 0;
2433 }
2434
2435 static void __exit ebtables_fini(void)
2436 {
2437         nf_unregister_sockopt(&ebt_sockopts);
2438         xt_unregister_target(&ebt_standard_target);
2439         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2440 }
2441
2442 EXPORT_SYMBOL(ebt_register_table);
2443 EXPORT_SYMBOL(ebt_unregister_table);
2444 EXPORT_SYMBOL(ebt_do_table);
2445 module_init(ebtables_init);
2446 module_exit(ebtables_fini);
2447 MODULE_LICENSE("GPL");