net/core/filter.c

   1 /*
   2  * Linux Socket Filter - Kernel level socket filtering
   3  *
   4  * Author:
   5  *     Jay Schulist <jschlst@samba.org>
   6  *
   7  * Based on the design of:
   8  *     - The Berkeley Packet Filter
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License
  12  * as published by the Free Software Foundation; either version
  13  * 2 of the License, or (at your option) any later version.
  14  *
  15  * Andi Kleen - Fix a few bad bugs and races.
  16  */
  17
  18 #include <linux/module.h>
  19 #include <linux/types.h>
  20 #include <linux/sched.h>
  21 #include <linux/mm.h>
  22 #include <linux/fcntl.h>
  23 #include <linux/socket.h>
  24 #include <linux/in.h>
  25 #include <linux/inet.h>
  26 #include <linux/netdevice.h>
  27 #include <linux/if_packet.h>
  28 #include <net/ip.h>
  29 #include <net/protocol.h>
  30 #include <linux/skbuff.h>
  31 #include <net/sock.h>
  32 #include <linux/errno.h>
  33 #include <linux/timer.h>
  34 #include <asm/system.h>
  35 #include <asm/uaccess.h>
  36 #include <linux/filter.h>
  37
  38 /* No hurry in this branch */
  39 static void *__load_pointer(struct sk_buff *skb, int k)
  40 {
  41         u8 *ptr = NULL;
  42
  43         if (k >= SKF_NET_OFF)
  44                 ptr = skb->nh.raw + k - SKF_NET_OFF;
  45         else if (k >= SKF_LL_OFF)
  46                 ptr = skb->mac.raw + k - SKF_LL_OFF;
  47
  48         if (ptr >= skb->head && ptr < skb->tail)
  49                 return ptr;
  50         return NULL;
  51 }
  52
  53 static inline void *load_pointer(struct sk_buff *skb, int k,
  54                                  unsigned int size, void *buffer)
  55 {
  56         if (k >= 0)
  57                 return skb_header_pointer(skb, k, size, buffer);
  58         else {
  59                 if (k >= SKF_AD_OFF)
  60                         return NULL;
  61                 return __load_pointer(skb, k);
  62         }
  63 }
  64
  65 /**
  66  *      sk_run_filter   -       run a filter on a socket
  67  *      @skb: buffer to run the filter on
  68  *      @filter: filter to apply
  69  *      @flen: length of filter
  70  *
  71  * Decode and apply filter instructions to the skb->data.
  72  * Return length to keep, 0 for none. skb is the data we are
  73  * filtering, filter is the array of filter instructions, and
  74  * len is the number of filter blocks in the array.
  75  */
  76
  77 int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
  78 {
  79         /* len is UNSIGNED. Byte wide insns relies only on implicit
  80            type casts to prevent reading arbitrary memory locations.
  81          */
  82         unsigned int len = skb->len-skb->data_len;
  83         struct sock_filter *fentry;     /* We walk down these */
  84         void *ptr;
  85         u32 A = 0;                      /* Accumulator */
  86         u32 X = 0;                      /* Index Register */
  87         u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
  88         u32 tmp;
  89         int k;
  90         int pc;
  91
  92         /*
  93          * Process array of filter instructions.
  94          */
  95         for (pc = 0; pc < flen; pc++) {
  96                 fentry = &filter[pc];
  97
  98                 switch (fentry->code) {
  99                 case BPF_ALU|BPF_ADD|BPF_X:
 100                         A += X;
 101                         continue;
 102                 case BPF_ALU|BPF_ADD|BPF_K:
 103                         A += fentry->k;
 104                         continue;
 105                 case BPF_ALU|BPF_SUB|BPF_X:
 106                         A -= X;
 107                         continue;
 108                 case BPF_ALU|BPF_SUB|BPF_K:
 109                         A -= fentry->k;
 110                         continue;
 111                 case BPF_ALU|BPF_MUL|BPF_X:
 112                         A *= X;
 113                         continue;
 114                 case BPF_ALU|BPF_MUL|BPF_K:
 115                         A *= fentry->k;
 116                         continue;
 117                 case BPF_ALU|BPF_DIV|BPF_X:
 118                         if (X == 0)
 119                                 return 0;
 120                         A /= X;
 121                         continue;
 122                 case BPF_ALU|BPF_DIV|BPF_K:
 123                         if (fentry->k == 0)
 124                                 return 0;
 125                         A /= fentry->k;
 126                         continue;
 127                 case BPF_ALU|BPF_AND|BPF_X:
 128                         A &= X;
 129                         continue;
 130                 case BPF_ALU|BPF_AND|BPF_K:
 131                         A &= fentry->k;
 132                         continue;
 133                 case BPF_ALU|BPF_OR|BPF_X:
 134                         A |= X;
 135                         continue;
 136                 case BPF_ALU|BPF_OR|BPF_K:
 137                         A |= fentry->k;
 138                         continue;
 139                 case BPF_ALU|BPF_LSH|BPF_X:
 140                         A <<= X;
 141                         continue;
 142                 case BPF_ALU|BPF_LSH|BPF_K:
 143                         A <<= fentry->k;
 144                         continue;
 145                 case BPF_ALU|BPF_RSH|BPF_X:
 146                         A >>= X;
 147                         continue;
 148                 case BPF_ALU|BPF_RSH|BPF_K:
 149                         A >>= fentry->k;
 150                         continue;
 151                 case BPF_ALU|BPF_NEG:
 152                         A = -A;
 153                         continue;
 154                 case BPF_JMP|BPF_JA:
 155                         pc += fentry->k;
 156                         continue;
 157                 case BPF_JMP|BPF_JGT|BPF_K:
 158                         pc += (A > fentry->k) ? fentry->jt : fentry->jf;
 159                         continue;
 160                 case BPF_JMP|BPF_JGE|BPF_K:
 161                         pc += (A >= fentry->k) ? fentry->jt : fentry->jf;
 162                         continue;
 163                 case BPF_JMP|BPF_JEQ|BPF_K:
 164                         pc += (A == fentry->k) ? fentry->jt : fentry->jf;
 165                         continue;
 166                 case BPF_JMP|BPF_JSET|BPF_K:
 167                         pc += (A & fentry->k) ? fentry->jt : fentry->jf;
 168                         continue;
 169                 case BPF_JMP|BPF_JGT|BPF_X:
 170                         pc += (A > X) ? fentry->jt : fentry->jf;
 171                         continue;
 172                 case BPF_JMP|BPF_JGE|BPF_X:
 173                         pc += (A >= X) ? fentry->jt : fentry->jf;
 174                         continue;
 175                 case BPF_JMP|BPF_JEQ|BPF_X:
 176                         pc += (A == X) ? fentry->jt : fentry->jf;
 177                         continue;
 178                 case BPF_JMP|BPF_JSET|BPF_X:
 179                         pc += (A & X) ? fentry->jt : fentry->jf;
 180                         continue;
 181                 case BPF_LD|BPF_W|BPF_ABS:
 182                         k = fentry->k;
 183  load_w:
 184                         ptr = load_pointer(skb, k, 4, &tmp);
 185                         if (ptr != NULL) {
 186                                 A = ntohl(*(u32 *)ptr);
 187                                 continue;
 188                         }
 189                         return 0;
 190                 case BPF_LD|BPF_H|BPF_ABS:
 191                         k = fentry->k;
 192  load_h:
 193                         ptr = load_pointer(skb, k, 2, &tmp);
 194                         if (ptr != NULL) {
 195                                 A = ntohs(*(u16 *)ptr);
 196                                 continue;
 197                         }
 198                         return 0;
 199                 case BPF_LD|BPF_B|BPF_ABS:
 200                         k = fentry->k;
 201 load_b:
 202                         ptr = load_pointer(skb, k, 1, &tmp);
 203                         if (ptr != NULL) {
 204                                 A = *(u8 *)ptr;
 205                                 continue;
 206                         }
 207                         return 0;
 208                 case BPF_LD|BPF_W|BPF_LEN:
 209                         A = len;
 210                         continue;
 211                 case BPF_LDX|BPF_W|BPF_LEN:
 212                         X = len;
 213                         continue;
 214                 case BPF_LD|BPF_W|BPF_IND:
 215                         k = X + fentry->k;
 216                         goto load_w;
 217                 case BPF_LD|BPF_H|BPF_IND:
 218                         k = X + fentry->k;
 219                         goto load_h;
 220                 case BPF_LD|BPF_B|BPF_IND:
 221                         k = X + fentry->k;
 222                         goto load_b;
 223                 case BPF_LDX|BPF_B|BPF_MSH:
 224                         ptr = load_pointer(skb, fentry->k, 1, &tmp);
 225                         if (ptr != NULL) {
 226                                 X = (*(u8 *)ptr & 0xf) << 2;
 227                                 continue;
 228                         }
 229                         return 0;
 230                 case BPF_LD|BPF_IMM:
 231                         A = fentry->k;
 232                         continue;
 233                 case BPF_LDX|BPF_IMM:
 234                         X = fentry->k;
 235                         continue;
 236                 case BPF_LD|BPF_MEM:
 237                         A = mem[fentry->k];
 238                         continue;
 239                 case BPF_LDX|BPF_MEM:
 240                         X = mem[fentry->k];
 241                         continue;
 242                 case BPF_MISC|BPF_TAX:
 243                         X = A;
 244                         continue;
 245                 case BPF_MISC|BPF_TXA:
 246                         A = X;
 247                         continue;
 248                 case BPF_RET|BPF_K:
 249                         return ((unsigned int)fentry->k);
 250                 case BPF_RET|BPF_A:
 251                         return ((unsigned int)A);
 252                 case BPF_ST:
 253                         mem[fentry->k] = A;
 254                         continue;
 255                 case BPF_STX:
 256                         mem[fentry->k] = X;
 257                         continue;
 258                 default:
 259                         /* Invalid instruction counts as RET */
 260                         return 0;
 261                 }
 262
 263                 /*
 264                  * Handle ancillary data, which are impossible
 265                  * (or very difficult) to get parsing packet contents.
 266                  */
 267                 switch (k-SKF_AD_OFF) {
 268                 case SKF_AD_PROTOCOL:
 269                         A = htons(skb->protocol);
 270                         continue;
 271                 case SKF_AD_PKTTYPE:
 272                         A = skb->pkt_type;
 273                         continue;
 274                 case SKF_AD_IFINDEX:
 275                         A = skb->dev->ifindex;
 276                         continue;
 277                 default:
 278                         return 0;
 279                 }
 280         }
 281
 282         return 0;
 283 }
 284
 285 /**
 286  *      sk_chk_filter - verify socket filter code
 287  *      @filter: filter to verify
 288  *      @flen: length of filter
 289  *
 290  * Check the user's filter code. If we let some ugly
 291  * filter code slip through kaboom! The filter must contain
 292  * no references or jumps that are out of range, no illegal instructions
 293  * and no backward jumps. It must end with a RET instruction
 294  *
 295  * Returns 0 if the rule set is legal or a negative errno code if not.
 296  */
 297 int sk_chk_filter(struct sock_filter *filter, int flen)
 298 {
 299         struct sock_filter *ftest;
 300         int pc;
 301
 302         if (((unsigned int)flen >= (~0U / sizeof(struct sock_filter))) || flen == 0)
 303                 return -EINVAL;
 304
 305         /* check the filter code now */
 306         for (pc = 0; pc < flen; pc++) {
 307                 /* all jumps are forward as they are not signed */
 308                 ftest = &filter[pc];
 309                 if (BPF_CLASS(ftest->code) == BPF_JMP) {
 310                         /* but they mustn't jump off the end */
 311                         if (BPF_OP(ftest->code) == BPF_JA) {
 312                                 /*
 313                                  * Note, the large ftest->k might cause loops.
 314                                  * Compare this with conditional jumps below,
 315                                  * where offsets are limited. --ANK (981016)
 316                                  */
 317                                 if (ftest->k >= (unsigned)(flen-pc-1))
 318                                         return -EINVAL;
 319                         } else {
 320                                 /* for conditionals both must be safe */
 321                                 if (pc + ftest->jt +1 >= flen ||
 322                                     pc + ftest->jf +1 >= flen)
 323                                         return -EINVAL;
 324                         }
 325                 }
 326
 327                 /* check that memory operations use valid addresses. */
 328                 if (ftest->k >= BPF_MEMWORDS) {
 329                         /* but it might not be a memory operation... */
 330                         switch (ftest->code) {
 331                         case BPF_ST:
 332                         case BPF_STX:
 333                         case BPF_LD|BPF_MEM:
 334                         case BPF_LDX|BPF_MEM:
 335                                 return -EINVAL;
 336                         }
 337                 }
 338         }
 339
 340         /*
 341          * The program must end with a return. We don't care where they
 342          * jumped within the script (its always forwards) but in the end
 343          * they _will_ hit this.
 344          */
 345         return (BPF_CLASS(filter[flen - 1].code) == BPF_RET) ? 0 : -EINVAL;
 346 }
 347
 348 /**
 349  *      sk_attach_filter - attach a socket filter
 350  *      @fprog: the filter program
 351  *      @sk: the socket to use
 352  *
 353  * Attach the user's filter code. We first run some sanity checks on
 354  * it to make sure it does not explode on us later. If an error
 355  * occurs or there is insufficient memory for the filter a negative
 356  * errno code is returned. On success the return is zero.
 357  */
 358 int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 359 {
 360         struct sk_filter *fp;
 361         unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
 362         int err;
 363
 364         /* Make sure new filter is there and in the right amounts. */
 365         if (fprog->filter == NULL || fprog->len > BPF_MAXINSNS)
 366                 return -EINVAL;
 367
 368         fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
 369         if (!fp)
 370                 return -ENOMEM;
 371         if (copy_from_user(fp->insns, fprog->filter, fsize)) {
 372                 sock_kfree_s(sk, fp, fsize+sizeof(*fp));
 373                 return -EFAULT;
 374         }
 375
 376         atomic_set(&fp->refcnt, 1);
 377         fp->len = fprog->len;
 378
 379         err = sk_chk_filter(fp->insns, fp->len);
 380         if (!err) {
 381                 struct sk_filter *old_fp;
 382
 383                 spin_lock_bh(&sk->sk_lock.slock);
 384                 old_fp = sk->sk_filter;
 385                 sk->sk_filter = fp;
 386                 spin_unlock_bh(&sk->sk_lock.slock);
 387                 fp = old_fp;
 388         }
 389
 390         if (fp)
 391                 sk_filter_release(sk, fp);
 392         return err;
 393 }
 394
 395 EXPORT_SYMBOL(sk_chk_filter);
 396 EXPORT_SYMBOL(sk_run_filter);