net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18 #include <linux/kmod.h>
  19 #include <linux/module.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netfilter/x_tables.h>
  22 #include <linux/netfilter_bridge/ebtables.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/mutex.h>
  25 #include <linux/slab.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36
  37 /*
  38  * Each cpu has its own set of counters, so there is no need for write_lock in
  39  * the softirq
  40  * For reading or updating the counters, the user context needs to
  41  * get a write_lock
  42  */
  43
  44 /* The size of each set of counters is altered to get cache alignment */
  45 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  46 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  47 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  48    COUNTER_OFFSET(n) * cpu))
  49
  50
  51
  52 static DEFINE_MUTEX(ebt_mutex);
  53
  54 #ifdef CONFIG_COMPAT
  55 static void ebt_standard_compat_from_user(void *dst, const void *src)
  56 {
  57         int v = *(compat_int_t *)src;
  58
  59         if (v >= 0)
  60                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  61         memcpy(dst, &v, sizeof(v));
  62 }
  63
  64 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  65 {
  66         compat_int_t cv = *(int *)src;
  67
  68         if (cv >= 0)
  69                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  70         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  71 }
  72 #endif
  73
  74
  75 static struct xt_target ebt_standard_target = {
  76         .name       = "standard",
  77         .revision   = 0,
  78         .family     = NFPROTO_BRIDGE,
  79         .targetsize = sizeof(int),
  80 #ifdef CONFIG_COMPAT
  81         .compatsize = sizeof(compat_int_t),
  82         .compat_from_user = ebt_standard_compat_from_user,
  83         .compat_to_user =  ebt_standard_compat_to_user,
  84 #endif
  85 };
  86
  87 static inline int
  88 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  89                struct xt_action_param *par)
  90 {
  91         par->target   = w->u.watcher;
  92         par->targinfo = w->data;
  93         w->u.watcher->target(skb, par);
  94         /* watchers don't give a verdict */
  95         return 0;
  96 }
  97
  98 static inline int
  99 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
 100              struct xt_action_param *par)
 101 {
 102         par->match     = m->u.match;
 103         par->matchinfo = m->data;
 104         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 105 }
 106
 107 static inline int
 108 ebt_dev_check(const char *entry, const struct net_device *device)
 109 {
 110         int i = 0;
 111         const char *devname;
 112
 113         if (*entry == '\0')
 114                 return 0;
 115         if (!device)
 116                 return 1;
 117         devname = device->name;
 118         /* 1 is the wildcard token */
 119         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 120                 i++;
 121         return (devname[i] != entry[i] && entry[i] != 1);
 122 }
 123
 124 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 125 /* process standard matches */
 126 static inline int
 127 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
 128                 const struct net_device *in, const struct net_device *out)
 129 {
 130         const struct ethhdr *h = eth_hdr(skb);
 131         __be16 ethproto;
 132         int verdict, i;
 133
 134         if (vlan_tx_tag_present(skb))
 135                 ethproto = htons(ETH_P_8021Q);
 136         else
 137                 ethproto = h->h_proto;
 138
 139         if (e->bitmask & EBT_802_3) {
 140                 if (FWINV2(ntohs(ethproto) >= 1536, EBT_IPROTO))
 141                         return 1;
 142         } else if (!(e->bitmask & EBT_NOPROTO) &&
 143            FWINV2(e->ethproto != ethproto, EBT_IPROTO))
 144                 return 1;
 145
 146         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 147                 return 1;
 148         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 149                 return 1;
 150         /* rcu_read_lock()ed by nf_hook_slow */
 151         if (in && br_port_exists(in) &&
 152             FWINV2(ebt_dev_check(e->logical_in, br_port_get_rcu(in)->br->dev),
 153                    EBT_ILOGICALIN))
 154                 return 1;
 155         if (out && br_port_exists(out) &&
 156             FWINV2(ebt_dev_check(e->logical_out, br_port_get_rcu(out)->br->dev),
 157                    EBT_ILOGICALOUT))
 158                 return 1;
 159
 160         if (e->bitmask & EBT_SOURCEMAC) {
 161                 verdict = 0;
 162                 for (i = 0; i < 6; i++)
 163                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 164                            e->sourcemsk[i];
 165                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 166                         return 1;
 167         }
 168         if (e->bitmask & EBT_DESTMAC) {
 169                 verdict = 0;
 170                 for (i = 0; i < 6; i++)
 171                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 172                            e->destmsk[i];
 173                 if (FWINV2(verdict != 0, EBT_IDEST) )
 174                         return 1;
 175         }
 176         return 0;
 177 }
 178
 179 static inline __pure
 180 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 181 {
 182         return (void *)entry + entry->next_offset;
 183 }
 184
 185 /* Do some firewalling */
 186 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 187    const struct net_device *in, const struct net_device *out,
 188    struct ebt_table *table)
 189 {
 190         int i, nentries;
 191         struct ebt_entry *point;
 192         struct ebt_counter *counter_base, *cb_base;
 193         const struct ebt_entry_target *t;
 194         int verdict, sp = 0;
 195         struct ebt_chainstack *cs;
 196         struct ebt_entries *chaininfo;
 197         const char *base;
 198         const struct ebt_table_info *private;
 199         struct xt_action_param acpar;
 200
 201         acpar.family  = NFPROTO_BRIDGE;
 202         acpar.in      = in;
 203         acpar.out     = out;
 204         acpar.hotdrop = false;
 205         acpar.hooknum = hook;
 206
 207         read_lock_bh(&table->lock);
 208         private = table->private;
 209         cb_base = COUNTER_BASE(private->counters, private->nentries,
 210            smp_processor_id());
 211         if (private->chainstack)
 212                 cs = private->chainstack[smp_processor_id()];
 213         else
 214                 cs = NULL;
 215         chaininfo = private->hook_entry[hook];
 216         nentries = private->hook_entry[hook]->nentries;
 217         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 218         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 219         /* base for chain jumps */
 220         base = private->entries;
 221         i = 0;
 222         while (i < nentries) {
 223                 if (ebt_basic_match(point, skb, in, out))
 224                         goto letscontinue;
 225
 226                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
 227                         goto letscontinue;
 228                 if (acpar.hotdrop) {
 229                         read_unlock_bh(&table->lock);
 230                         return NF_DROP;
 231                 }
 232
 233                 /* increase counter */
 234                 (*(counter_base + i)).pcnt++;
 235                 (*(counter_base + i)).bcnt += skb->len;
 236
 237                 /* these should only watch: not modify, nor tell us
 238                    what to do with the packet */
 239                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
 240
 241                 t = (struct ebt_entry_target *)
 242                    (((char *)point) + point->target_offset);
 243                 /* standard target */
 244                 if (!t->u.target->target)
 245                         verdict = ((struct ebt_standard_target *)t)->verdict;
 246                 else {
 247                         acpar.target   = t->u.target;
 248                         acpar.targinfo = t->data;
 249                         verdict = t->u.target->target(skb, &acpar);
 250                 }
 251                 if (verdict == EBT_ACCEPT) {
 252                         read_unlock_bh(&table->lock);
 253                         return NF_ACCEPT;
 254                 }
 255                 if (verdict == EBT_DROP) {
 256                         read_unlock_bh(&table->lock);
 257                         return NF_DROP;
 258                 }
 259                 if (verdict == EBT_RETURN) {
 260 letsreturn:
 261 #ifdef CONFIG_NETFILTER_DEBUG
 262                         if (sp == 0) {
 263                                 BUGPRINT("RETURN on base chain");
 264                                 /* act like this is EBT_CONTINUE */
 265                                 goto letscontinue;
 266                         }
 267 #endif
 268                         sp--;
 269                         /* put all the local variables right */
 270                         i = cs[sp].n;
 271                         chaininfo = cs[sp].chaininfo;
 272                         nentries = chaininfo->nentries;
 273                         point = cs[sp].e;
 274                         counter_base = cb_base +
 275                            chaininfo->counter_offset;
 276                         continue;
 277                 }
 278                 if (verdict == EBT_CONTINUE)
 279                         goto letscontinue;
 280 #ifdef CONFIG_NETFILTER_DEBUG
 281                 if (verdict < 0) {
 282                         BUGPRINT("bogus standard verdict\n");
 283                         read_unlock_bh(&table->lock);
 284                         return NF_DROP;
 285                 }
 286 #endif
 287                 /* jump to a udc */
 288                 cs[sp].n = i + 1;
 289                 cs[sp].chaininfo = chaininfo;
 290                 cs[sp].e = ebt_next_entry(point);
 291                 i = 0;
 292                 chaininfo = (struct ebt_entries *) (base + verdict);
 293 #ifdef CONFIG_NETFILTER_DEBUG
 294                 if (chaininfo->distinguisher) {
 295                         BUGPRINT("jump to non-chain\n");
 296                         read_unlock_bh(&table->lock);
 297                         return NF_DROP;
 298                 }
 299 #endif
 300                 nentries = chaininfo->nentries;
 301                 point = (struct ebt_entry *)chaininfo->data;
 302                 counter_base = cb_base + chaininfo->counter_offset;
 303                 sp++;
 304                 continue;
 305 letscontinue:
 306                 point = ebt_next_entry(point);
 307                 i++;
 308         }
 309
 310         /* I actually like this :) */
 311         if (chaininfo->policy == EBT_RETURN)
 312                 goto letsreturn;
 313         if (chaininfo->policy == EBT_ACCEPT) {
 314                 read_unlock_bh(&table->lock);
 315                 return NF_ACCEPT;
 316         }
 317         read_unlock_bh(&table->lock);
 318         return NF_DROP;
 319 }
 320
 321 /* If it succeeds, returns element and locks mutex */
 322 static inline void *
 323 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 324    struct mutex *mutex)
 325 {
 326         struct {
 327                 struct list_head list;
 328                 char name[EBT_FUNCTION_MAXNAMELEN];
 329         } *e;
 330
 331         *error = mutex_lock_interruptible(mutex);
 332         if (*error != 0)
 333                 return NULL;
 334
 335         list_for_each_entry(e, head, list) {
 336                 if (strcmp(e->name, name) == 0)
 337                         return e;
 338         }
 339         *error = -ENOENT;
 340         mutex_unlock(mutex);
 341         return NULL;
 342 }
 343
 344 static void *
 345 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 346    int *error, struct mutex *mutex)
 347 {
 348         return try_then_request_module(
 349                         find_inlist_lock_noload(head, name, error, mutex),
 350                         "%s%s", prefix, name);
 351 }
 352
 353 static inline struct ebt_table *
 354 find_table_lock(struct net *net, const char *name, int *error,
 355                 struct mutex *mutex)
 356 {
 357         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 358                                 "ebtable_", error, mutex);
 359 }
 360
 361 static inline int
 362 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 363                 unsigned int *cnt)
 364 {
 365         const struct ebt_entry *e = par->entryinfo;
 366         struct xt_match *match;
 367         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 368         int ret;
 369
 370         if (left < sizeof(struct ebt_entry_match) ||
 371             left - sizeof(struct ebt_entry_match) < m->match_size)
 372                 return -EINVAL;
 373
 374         match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
 375         if (IS_ERR(match))
 376                 return PTR_ERR(match);
 377         m->u.match = match;
 378
 379         par->match     = match;
 380         par->matchinfo = m->data;
 381         ret = xt_check_match(par, m->match_size,
 382               e->ethproto, e->invflags & EBT_IPROTO);
 383         if (ret < 0) {
 384                 module_put(match->me);
 385                 return ret;
 386         }
 387
 388         (*cnt)++;
 389         return 0;
 390 }
 391
 392 static inline int
 393 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 394                   unsigned int *cnt)
 395 {
 396         const struct ebt_entry *e = par->entryinfo;
 397         struct xt_target *watcher;
 398         size_t left = ((char *)e + e->target_offset) - (char *)w;
 399         int ret;
 400
 401         if (left < sizeof(struct ebt_entry_watcher) ||
 402            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 403                 return -EINVAL;
 404
 405         watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
 406         if (IS_ERR(watcher))
 407                 return PTR_ERR(watcher);
 408         w->u.watcher = watcher;
 409
 410         par->target   = watcher;
 411         par->targinfo = w->data;
 412         ret = xt_check_target(par, w->watcher_size,
 413               e->ethproto, e->invflags & EBT_IPROTO);
 414         if (ret < 0) {
 415                 module_put(watcher->me);
 416                 return ret;
 417         }
 418
 419         (*cnt)++;
 420         return 0;
 421 }
 422
 423 static int ebt_verify_pointers(const struct ebt_replace *repl,
 424                                struct ebt_table_info *newinfo)
 425 {
 426         unsigned int limit = repl->entries_size;
 427         unsigned int valid_hooks = repl->valid_hooks;
 428         unsigned int offset = 0;
 429         int i;
 430
 431         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 432                 newinfo->hook_entry[i] = NULL;
 433
 434         newinfo->entries_size = repl->entries_size;
 435         newinfo->nentries = repl->nentries;
 436
 437         while (offset < limit) {
 438                 size_t left = limit - offset;
 439                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 440
 441                 if (left < sizeof(unsigned int))
 442                         break;
 443
 444                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 445                         if ((valid_hooks & (1 << i)) == 0)
 446                                 continue;
 447                         if ((char __user *)repl->hook_entry[i] ==
 448                              repl->entries + offset)
 449                                 break;
 450                 }
 451
 452                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 453                         if (e->bitmask != 0) {
 454                                 /* we make userspace set this right,
 455                                    so there is no misunderstanding */
 456                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 457                                          "in distinguisher\n");
 458                                 return -EINVAL;
 459                         }
 460                         if (i != NF_BR_NUMHOOKS)
 461                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 462                         if (left < sizeof(struct ebt_entries))
 463                                 break;
 464                         offset += sizeof(struct ebt_entries);
 465                 } else {
 466                         if (left < sizeof(struct ebt_entry))
 467                                 break;
 468                         if (left < e->next_offset)
 469                                 break;
 470                         if (e->next_offset < sizeof(struct ebt_entry))
 471                                 return -EINVAL;
 472                         offset += e->next_offset;
 473                 }
 474         }
 475         if (offset != limit) {
 476                 BUGPRINT("entries_size too small\n");
 477                 return -EINVAL;
 478         }
 479
 480         /* check if all valid hooks have a chain */
 481         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 482                 if (!newinfo->hook_entry[i] &&
 483                    (valid_hooks & (1 << i))) {
 484                         BUGPRINT("Valid hook without chain\n");
 485                         return -EINVAL;
 486                 }
 487         }
 488         return 0;
 489 }
 490
 491 /*
 492  * this one is very careful, as it is the first function
 493  * to parse the userspace data
 494  */
 495 static inline int
 496 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 497    const struct ebt_table_info *newinfo,
 498    unsigned int *n, unsigned int *cnt,
 499    unsigned int *totalcnt, unsigned int *udc_cnt)
 500 {
 501         int i;
 502
 503         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 504                 if ((void *)e == (void *)newinfo->hook_entry[i])
 505                         break;
 506         }
 507         /* beginning of a new chain
 508            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 509         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 510                 /* this checks if the previous chain has as many entries
 511                    as it said it has */
 512                 if (*n != *cnt) {
 513                         BUGPRINT("nentries does not equal the nr of entries "
 514                                  "in the chain\n");
 515                         return -EINVAL;
 516                 }
 517                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 518                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 519                         /* only RETURN from udc */
 520                         if (i != NF_BR_NUMHOOKS ||
 521                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 522                                 BUGPRINT("bad policy\n");
 523                                 return -EINVAL;
 524                         }
 525                 }
 526                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 527                         (*udc_cnt)++;
 528                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 529                         BUGPRINT("counter_offset != totalcnt");
 530                         return -EINVAL;
 531                 }
 532                 *n = ((struct ebt_entries *)e)->nentries;
 533                 *cnt = 0;
 534                 return 0;
 535         }
 536         /* a plain old entry, heh */
 537         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 538            e->watchers_offset > e->target_offset ||
 539            e->target_offset >= e->next_offset) {
 540                 BUGPRINT("entry offsets not in right order\n");
 541                 return -EINVAL;
 542         }
 543         /* this is not checked anywhere else */
 544         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 545                 BUGPRINT("target size too small\n");
 546                 return -EINVAL;
 547         }
 548         (*cnt)++;
 549         (*totalcnt)++;
 550         return 0;
 551 }
 552
 553 struct ebt_cl_stack
 554 {
 555         struct ebt_chainstack cs;
 556         int from;
 557         unsigned int hookmask;
 558 };
 559
 560 /*
 561  * we need these positions to check that the jumps to a different part of the
 562  * entries is a jump to the beginning of a new chain.
 563  */
 564 static inline int
 565 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 566    unsigned int *n, struct ebt_cl_stack *udc)
 567 {
 568         int i;
 569
 570         /* we're only interested in chain starts */
 571         if (e->bitmask)
 572                 return 0;
 573         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 574                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 575                         break;
 576         }
 577         /* only care about udc */
 578         if (i != NF_BR_NUMHOOKS)
 579                 return 0;
 580
 581         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 582         /* these initialisations are depended on later in check_chainloops() */
 583         udc[*n].cs.n = 0;
 584         udc[*n].hookmask = 0;
 585
 586         (*n)++;
 587         return 0;
 588 }
 589
 590 static inline int
 591 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 592 {
 593         struct xt_mtdtor_param par;
 594
 595         if (i && (*i)-- == 0)
 596                 return 1;
 597
 598         par.net       = net;
 599         par.match     = m->u.match;
 600         par.matchinfo = m->data;
 601         par.family    = NFPROTO_BRIDGE;
 602         if (par.match->destroy != NULL)
 603                 par.match->destroy(&par);
 604         module_put(par.match->me);
 605         return 0;
 606 }
 607
 608 static inline int
 609 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 610 {
 611         struct xt_tgdtor_param par;
 612
 613         if (i && (*i)-- == 0)
 614                 return 1;
 615
 616         par.net      = net;
 617         par.target   = w->u.watcher;
 618         par.targinfo = w->data;
 619         par.family   = NFPROTO_BRIDGE;
 620         if (par.target->destroy != NULL)
 621                 par.target->destroy(&par);
 622         module_put(par.target->me);
 623         return 0;
 624 }
 625
 626 static inline int
 627 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 628 {
 629         struct xt_tgdtor_param par;
 630         struct ebt_entry_target *t;
 631
 632         if (e->bitmask == 0)
 633                 return 0;
 634         /* we're done */
 635         if (cnt && (*cnt)-- == 0)
 636                 return 1;
 637         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 638         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 639         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 640
 641         par.net      = net;
 642         par.target   = t->u.target;
 643         par.targinfo = t->data;
 644         par.family   = NFPROTO_BRIDGE;
 645         if (par.target->destroy != NULL)
 646                 par.target->destroy(&par);
 647         module_put(par.target->me);
 648         return 0;
 649 }
 650
 651 static inline int
 652 ebt_check_entry(struct ebt_entry *e, struct net *net,
 653    const struct ebt_table_info *newinfo,
 654    const char *name, unsigned int *cnt,
 655    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 656 {
 657         struct ebt_entry_target *t;
 658         struct xt_target *target;
 659         unsigned int i, j, hook = 0, hookmask = 0;
 660         size_t gap;
 661         int ret;
 662         struct xt_mtchk_param mtpar;
 663         struct xt_tgchk_param tgpar;
 664
 665         /* don't mess with the struct ebt_entries */
 666         if (e->bitmask == 0)
 667                 return 0;
 668
 669         if (e->bitmask & ~EBT_F_MASK) {
 670                 BUGPRINT("Unknown flag for bitmask\n");
 671                 return -EINVAL;
 672         }
 673         if (e->invflags & ~EBT_INV_MASK) {
 674                 BUGPRINT("Unknown flag for inv bitmask\n");
 675                 return -EINVAL;
 676         }
 677         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 678                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 679                 return -EINVAL;
 680         }
 681         /* what hook do we belong to? */
 682         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 683                 if (!newinfo->hook_entry[i])
 684                         continue;
 685                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 686                         hook = i;
 687                 else
 688                         break;
 689         }
 690         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 691            a base chain */
 692         if (i < NF_BR_NUMHOOKS)
 693                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 694         else {
 695                 for (i = 0; i < udc_cnt; i++)
 696                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 697                                 break;
 698                 if (i == 0)
 699                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 700                 else
 701                         hookmask = cl_s[i - 1].hookmask;
 702         }
 703         i = 0;
 704
 705         mtpar.net       = tgpar.net       = net;
 706         mtpar.table     = tgpar.table     = name;
 707         mtpar.entryinfo = tgpar.entryinfo = e;
 708         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 709         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 710         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 711         if (ret != 0)
 712                 goto cleanup_matches;
 713         j = 0;
 714         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 715         if (ret != 0)
 716                 goto cleanup_watchers;
 717         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 718         gap = e->next_offset - e->target_offset;
 719
 720         target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
 721         if (IS_ERR(target)) {
 722                 ret = PTR_ERR(target);
 723                 goto cleanup_watchers;
 724         }
 725
 726         t->u.target = target;
 727         if (t->u.target == &ebt_standard_target) {
 728                 if (gap < sizeof(struct ebt_standard_target)) {
 729                         BUGPRINT("Standard target size too big\n");
 730                         ret = -EFAULT;
 731                         goto cleanup_watchers;
 732                 }
 733                 if (((struct ebt_standard_target *)t)->verdict <
 734                    -NUM_STANDARD_TARGETS) {
 735                         BUGPRINT("Invalid standard target\n");
 736                         ret = -EFAULT;
 737                         goto cleanup_watchers;
 738                 }
 739         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 740                 module_put(t->u.target->me);
 741                 ret = -EFAULT;
 742                 goto cleanup_watchers;
 743         }
 744
 745         tgpar.target   = target;
 746         tgpar.targinfo = t->data;
 747         ret = xt_check_target(&tgpar, t->target_size,
 748               e->ethproto, e->invflags & EBT_IPROTO);
 749         if (ret < 0) {
 750                 module_put(target->me);
 751                 goto cleanup_watchers;
 752         }
 753         (*cnt)++;
 754         return 0;
 755 cleanup_watchers:
 756         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 757 cleanup_matches:
 758         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 759         return ret;
 760 }
 761
 762 /*
 763  * checks for loops and sets the hook mask for udc
 764  * the hook mask for udc tells us from which base chains the udc can be
 765  * accessed. This mask is a parameter to the check() functions of the extensions
 766  */
 767 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 768    unsigned int udc_cnt, unsigned int hooknr, char *base)
 769 {
 770         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 771         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 772         const struct ebt_entry_target *t;
 773
 774         while (pos < nentries || chain_nr != -1) {
 775                 /* end of udc, go back one 'recursion' step */
 776                 if (pos == nentries) {
 777                         /* put back values of the time when this chain was called */
 778                         e = cl_s[chain_nr].cs.e;
 779                         if (cl_s[chain_nr].from != -1)
 780                                 nentries =
 781                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 782                         else
 783                                 nentries = chain->nentries;
 784                         pos = cl_s[chain_nr].cs.n;
 785                         /* make sure we won't see a loop that isn't one */
 786                         cl_s[chain_nr].cs.n = 0;
 787                         chain_nr = cl_s[chain_nr].from;
 788                         if (pos == nentries)
 789                                 continue;
 790                 }
 791                 t = (struct ebt_entry_target *)
 792                    (((char *)e) + e->target_offset);
 793                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 794                         goto letscontinue;
 795                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 796                    e->next_offset) {
 797                         BUGPRINT("Standard target size too big\n");
 798                         return -1;
 799                 }
 800                 verdict = ((struct ebt_standard_target *)t)->verdict;
 801                 if (verdict >= 0) { /* jump to another chain */
 802                         struct ebt_entries *hlp2 =
 803                            (struct ebt_entries *)(base + verdict);
 804                         for (i = 0; i < udc_cnt; i++)
 805                                 if (hlp2 == cl_s[i].cs.chaininfo)
 806                                         break;
 807                         /* bad destination or loop */
 808                         if (i == udc_cnt) {
 809                                 BUGPRINT("bad destination\n");
 810                                 return -1;
 811                         }
 812                         if (cl_s[i].cs.n) {
 813                                 BUGPRINT("loop\n");
 814                                 return -1;
 815                         }
 816                         if (cl_s[i].hookmask & (1 << hooknr))
 817                                 goto letscontinue;
 818                         /* this can't be 0, so the loop test is correct */
 819                         cl_s[i].cs.n = pos + 1;
 820                         pos = 0;
 821                         cl_s[i].cs.e = ebt_next_entry(e);
 822                         e = (struct ebt_entry *)(hlp2->data);
 823                         nentries = hlp2->nentries;
 824                         cl_s[i].from = chain_nr;
 825                         chain_nr = i;
 826                         /* this udc is accessible from the base chain for hooknr */
 827                         cl_s[i].hookmask |= (1 << hooknr);
 828                         continue;
 829                 }
 830 letscontinue:
 831                 e = ebt_next_entry(e);
 832                 pos++;
 833         }
 834         return 0;
 835 }
 836
 837 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 838 static int translate_table(struct net *net, const char *name,
 839                            struct ebt_table_info *newinfo)
 840 {
 841         unsigned int i, j, k, udc_cnt;
 842         int ret;
 843         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 844
 845         i = 0;
 846         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 847                 i++;
 848         if (i == NF_BR_NUMHOOKS) {
 849                 BUGPRINT("No valid hooks specified\n");
 850                 return -EINVAL;
 851         }
 852         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 853                 BUGPRINT("Chains don't start at beginning\n");
 854                 return -EINVAL;
 855         }
 856         /* make sure chains are ordered after each other in same order
 857            as their corresponding hooks */
 858         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 859                 if (!newinfo->hook_entry[j])
 860                         continue;
 861                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 862                         BUGPRINT("Hook order must be followed\n");
 863                         return -EINVAL;
 864                 }
 865                 i = j;
 866         }
 867
 868         /* do some early checkings and initialize some things */
 869         i = 0; /* holds the expected nr. of entries for the chain */
 870         j = 0; /* holds the up to now counted entries for the chain */
 871         k = 0; /* holds the total nr. of entries, should equal
 872                   newinfo->nentries afterwards */
 873         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 874         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 875            ebt_check_entry_size_and_hooks, newinfo,
 876            &i, &j, &k, &udc_cnt);
 877
 878         if (ret != 0)
 879                 return ret;
 880
 881         if (i != j) {
 882                 BUGPRINT("nentries does not equal the nr of entries in the "
 883                          "(last) chain\n");
 884                 return -EINVAL;
 885         }
 886         if (k != newinfo->nentries) {
 887                 BUGPRINT("Total nentries is wrong\n");
 888                 return -EINVAL;
 889         }
 890
 891         /* get the location of the udc, put them in an array
 892            while we're at it, allocate the chainstack */
 893         if (udc_cnt) {
 894                 /* this will get free'd in do_replace()/ebt_register_table()
 895                    if an error occurs */
 896                 newinfo->chainstack =
 897                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 898                 if (!newinfo->chainstack)
 899                         return -ENOMEM;
 900                 for_each_possible_cpu(i) {
 901                         newinfo->chainstack[i] =
 902                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 903                         if (!newinfo->chainstack[i]) {
 904                                 while (i)
 905                                         vfree(newinfo->chainstack[--i]);
 906                                 vfree(newinfo->chainstack);
 907                                 newinfo->chainstack = NULL;
 908                                 return -ENOMEM;
 909                         }
 910                 }
 911
 912                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 913                 if (!cl_s)
 914                         return -ENOMEM;
 915                 i = 0; /* the i'th udc */
 916                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 917                    ebt_get_udc_positions, newinfo, &i, cl_s);
 918                 /* sanity check */
 919                 if (i != udc_cnt) {
 920                         BUGPRINT("i != udc_cnt\n");
 921                         vfree(cl_s);
 922                         return -EFAULT;
 923                 }
 924         }
 925
 926         /* Check for loops */
 927         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 928                 if (newinfo->hook_entry[i])
 929                         if (check_chainloops(newinfo->hook_entry[i],
 930                            cl_s, udc_cnt, i, newinfo->entries)) {
 931                                 vfree(cl_s);
 932                                 return -EINVAL;
 933                         }
 934
 935         /* we now know the following (along with E=mc²):
 936            - the nr of entries in each chain is right
 937            - the size of the allocated space is right
 938            - all valid hooks have a corresponding chain
 939            - there are no loops
 940            - wrong data can still be on the level of a single entry
 941            - could be there are jumps to places that are not the
 942              beginning of a chain. This can only occur in chains that
 943              are not accessible from any base chains, so we don't care. */
 944
 945         /* used to know what we need to clean up if something goes wrong */
 946         i = 0;
 947         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 948            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 949         if (ret != 0) {
 950                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 951                                   ebt_cleanup_entry, net, &i);
 952         }
 953         vfree(cl_s);
 954         return ret;
 955 }
 956
 957 /* called under write_lock */
 958 static void get_counters(const struct ebt_counter *oldcounters,
 959    struct ebt_counter *counters, unsigned int nentries)
 960 {
 961         int i, cpu;
 962         struct ebt_counter *counter_base;
 963
 964         /* counters of cpu 0 */
 965         memcpy(counters, oldcounters,
 966                sizeof(struct ebt_counter) * nentries);
 967
 968         /* add other counters to those of cpu 0 */
 969         for_each_possible_cpu(cpu) {
 970                 if (cpu == 0)
 971                         continue;
 972                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 973                 for (i = 0; i < nentries; i++) {
 974                         counters[i].pcnt += counter_base[i].pcnt;
 975                         counters[i].bcnt += counter_base[i].bcnt;
 976                 }
 977         }
 978 }
 979
 980 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 981                               struct ebt_table_info *newinfo)
 982 {
 983         int ret, i;
 984         struct ebt_counter *counterstmp = NULL;
 985         /* used to be able to unlock earlier */
 986         struct ebt_table_info *table;
 987         struct ebt_table *t;
 988
 989         /* the user wants counters back
 990            the check on the size is done later, when we have the lock */
 991         if (repl->num_counters) {
 992                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
 993                 counterstmp = vmalloc(size);
 994                 if (!counterstmp)
 995                         return -ENOMEM;
 996         }
 997
 998         newinfo->chainstack = NULL;
 999         ret = ebt_verify_pointers(repl, newinfo);
1000         if (ret != 0)
1001                 goto free_counterstmp;
1002
1003         ret = translate_table(net, repl->name, newinfo);
1004
1005         if (ret != 0)
1006                 goto free_counterstmp;
1007
1008         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1009         if (!t) {
1010                 ret = -ENOENT;
1011                 goto free_iterate;
1012         }
1013
1014         /* the table doesn't like it */
1015         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1016                 goto free_unlock;
1017
1018         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1019                 BUGPRINT("Wrong nr. of counters requested\n");
1020                 ret = -EINVAL;
1021                 goto free_unlock;
1022         }
1023
1024         /* we have the mutex lock, so no danger in reading this pointer */
1025         table = t->private;
1026         /* make sure the table can only be rmmod'ed if it contains no rules */
1027         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1028                 ret = -ENOENT;
1029                 goto free_unlock;
1030         } else if (table->nentries && !newinfo->nentries)
1031                 module_put(t->me);
1032         /* we need an atomic snapshot of the counters */
1033         write_lock_bh(&t->lock);
1034         if (repl->num_counters)
1035                 get_counters(t->private->counters, counterstmp,
1036                    t->private->nentries);
1037
1038         t->private = newinfo;
1039         write_unlock_bh(&t->lock);
1040         mutex_unlock(&ebt_mutex);
1041         /* so, a user can change the chains while having messed up her counter
1042            allocation. Only reason why this is done is because this way the lock
1043            is held only once, while this doesn't bring the kernel into a
1044            dangerous state. */
1045         if (repl->num_counters &&
1046            copy_to_user(repl->counters, counterstmp,
1047            repl->num_counters * sizeof(struct ebt_counter))) {
1048                 ret = -EFAULT;
1049         }
1050         else
1051                 ret = 0;
1052
1053         /* decrease module count and free resources */
1054         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1055                           ebt_cleanup_entry, net, NULL);
1056
1057         vfree(table->entries);
1058         if (table->chainstack) {
1059                 for_each_possible_cpu(i)
1060                         vfree(table->chainstack[i]);
1061                 vfree(table->chainstack);
1062         }
1063         vfree(table);
1064
1065         vfree(counterstmp);
1066         return ret;
1067
1068 free_unlock:
1069         mutex_unlock(&ebt_mutex);
1070 free_iterate:
1071         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1072                           ebt_cleanup_entry, net, NULL);
1073 free_counterstmp:
1074         vfree(counterstmp);
1075         /* can be initialized in translate_table() */
1076         if (newinfo->chainstack) {
1077                 for_each_possible_cpu(i)
1078                         vfree(newinfo->chainstack[i]);
1079                 vfree(newinfo->chainstack);
1080         }
1081         return ret;
1082 }
1083
1084 /* replace the table */
1085 static int do_replace(struct net *net, const void __user *user,
1086                       unsigned int len)
1087 {
1088         int ret, countersize;
1089         struct ebt_table_info *newinfo;
1090         struct ebt_replace tmp;
1091
1092         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1093                 return -EFAULT;
1094
1095         if (len != sizeof(tmp) + tmp.entries_size) {
1096                 BUGPRINT("Wrong len argument\n");
1097                 return -EINVAL;
1098         }
1099
1100         if (tmp.entries_size == 0) {
1101                 BUGPRINT("Entries_size never zero\n");
1102                 return -EINVAL;
1103         }
1104         /* overflow check */
1105         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1106                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1107                 return -ENOMEM;
1108         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1109                 return -ENOMEM;
1110
1111         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1112         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1113         if (!newinfo)
1114                 return -ENOMEM;
1115
1116         if (countersize)
1117                 memset(newinfo->counters, 0, countersize);
1118
1119         newinfo->entries = vmalloc(tmp.entries_size);
1120         if (!newinfo->entries) {
1121                 ret = -ENOMEM;
1122                 goto free_newinfo;
1123         }
1124         if (copy_from_user(
1125            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1126                 BUGPRINT("Couldn't copy entries from userspace\n");
1127                 ret = -EFAULT;
1128                 goto free_entries;
1129         }
1130
1131         ret = do_replace_finish(net, &tmp, newinfo);
1132         if (ret == 0)
1133                 return ret;
1134 free_entries:
1135         vfree(newinfo->entries);
1136 free_newinfo:
1137         vfree(newinfo);
1138         return ret;
1139 }
1140
1141 struct ebt_table *
1142 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1143 {
1144         struct ebt_table_info *newinfo;
1145         struct ebt_table *t, *table;
1146         struct ebt_replace_kernel *repl;
1147         int ret, i, countersize;
1148         void *p;
1149
1150         if (input_table == NULL || (repl = input_table->table) == NULL ||
1151             repl->entries == 0 || repl->entries_size == 0 ||
1152             repl->counters != NULL || input_table->private != NULL) {
1153                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1154                 return ERR_PTR(-EINVAL);
1155         }
1156
1157         /* Don't add one table to multiple lists. */
1158         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1159         if (!table) {
1160                 ret = -ENOMEM;
1161                 goto out;
1162         }
1163
1164         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1165         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1166         ret = -ENOMEM;
1167         if (!newinfo)
1168                 goto free_table;
1169
1170         p = vmalloc(repl->entries_size);
1171         if (!p)
1172                 goto free_newinfo;
1173
1174         memcpy(p, repl->entries, repl->entries_size);
1175         newinfo->entries = p;
1176
1177         newinfo->entries_size = repl->entries_size;
1178         newinfo->nentries = repl->nentries;
1179
1180         if (countersize)
1181                 memset(newinfo->counters, 0, countersize);
1182
1183         /* fill in newinfo and parse the entries */
1184         newinfo->chainstack = NULL;
1185         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1186                 if ((repl->valid_hooks & (1 << i)) == 0)
1187                         newinfo->hook_entry[i] = NULL;
1188                 else
1189                         newinfo->hook_entry[i] = p +
1190                                 ((char *)repl->hook_entry[i] - repl->entries);
1191         }
1192         ret = translate_table(net, repl->name, newinfo);
1193         if (ret != 0) {
1194                 BUGPRINT("Translate_table failed\n");
1195                 goto free_chainstack;
1196         }
1197
1198         if (table->check && table->check(newinfo, table->valid_hooks)) {
1199                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1200                 return ERR_PTR(-EINVAL);
1201         }
1202
1203         table->private = newinfo;
1204         rwlock_init(&table->lock);
1205         ret = mutex_lock_interruptible(&ebt_mutex);
1206         if (ret != 0)
1207                 goto free_chainstack;
1208
1209         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1210                 if (strcmp(t->name, table->name) == 0) {
1211                         ret = -EEXIST;
1212                         BUGPRINT("Table name already exists\n");
1213                         goto free_unlock;
1214                 }
1215         }
1216
1217         /* Hold a reference count if the chains aren't empty */
1218         if (newinfo->nentries && !try_module_get(table->me)) {
1219                 ret = -ENOENT;
1220                 goto free_unlock;
1221         }
1222         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1223         mutex_unlock(&ebt_mutex);
1224         return table;
1225 free_unlock:
1226         mutex_unlock(&ebt_mutex);
1227 free_chainstack:
1228         if (newinfo->chainstack) {
1229                 for_each_possible_cpu(i)
1230                         vfree(newinfo->chainstack[i]);
1231                 vfree(newinfo->chainstack);
1232         }
1233         vfree(newinfo->entries);
1234 free_newinfo:
1235         vfree(newinfo);
1236 free_table:
1237         kfree(table);
1238 out:
1239         return ERR_PTR(ret);
1240 }
1241
1242 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1243 {
1244         int i;
1245
1246         if (!table) {
1247                 BUGPRINT("Request to unregister NULL table!!!\n");
1248                 return;
1249         }
1250         mutex_lock(&ebt_mutex);
1251         list_del(&table->list);
1252         mutex_unlock(&ebt_mutex);
1253         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1254                           ebt_cleanup_entry, net, NULL);
1255         if (table->private->nentries)
1256                 module_put(table->me);
1257         vfree(table->private->entries);
1258         if (table->private->chainstack) {
1259                 for_each_possible_cpu(i)
1260                         vfree(table->private->chainstack[i]);
1261                 vfree(table->private->chainstack);
1262         }
1263         vfree(table->private);
1264         kfree(table);
1265 }
1266
1267 /* userspace just supplied us with counters */
1268 static int do_update_counters(struct net *net, const char *name,
1269                                 struct ebt_counter __user *counters,
1270                                 unsigned int num_counters,
1271                                 const void __user *user, unsigned int len)
1272 {
1273         int i, ret;
1274         struct ebt_counter *tmp;
1275         struct ebt_table *t;
1276
1277         if (num_counters == 0)
1278                 return -EINVAL;
1279
1280         tmp = vmalloc(num_counters * sizeof(*tmp));
1281         if (!tmp)
1282                 return -ENOMEM;
1283
1284         t = find_table_lock(net, name, &ret, &ebt_mutex);
1285         if (!t)
1286                 goto free_tmp;
1287
1288         if (num_counters != t->private->nentries) {
1289                 BUGPRINT("Wrong nr of counters\n");
1290                 ret = -EINVAL;
1291                 goto unlock_mutex;
1292         }
1293
1294         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1295                 ret = -EFAULT;
1296                 goto unlock_mutex;
1297         }
1298
1299         /* we want an atomic add of the counters */
1300         write_lock_bh(&t->lock);
1301
1302         /* we add to the counters of the first cpu */
1303         for (i = 0; i < num_counters; i++) {
1304                 t->private->counters[i].pcnt += tmp[i].pcnt;
1305                 t->private->counters[i].bcnt += tmp[i].bcnt;
1306         }
1307
1308         write_unlock_bh(&t->lock);
1309         ret = 0;
1310 unlock_mutex:
1311         mutex_unlock(&ebt_mutex);
1312 free_tmp:
1313         vfree(tmp);
1314         return ret;
1315 }
1316
1317 static int update_counters(struct net *net, const void __user *user,
1318                             unsigned int len)
1319 {
1320         struct ebt_replace hlp;
1321
1322         if (copy_from_user(&hlp, user, sizeof(hlp)))
1323                 return -EFAULT;
1324
1325         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1326                 return -EINVAL;
1327
1328         return do_update_counters(net, hlp.name, hlp.counters,
1329                                 hlp.num_counters, user, len);
1330 }
1331
1332 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1333     const char *base, char __user *ubase)
1334 {
1335         char __user *hlp = ubase + ((char *)m - base);
1336         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1337                 return -EFAULT;
1338         return 0;
1339 }
1340
1341 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1342     const char *base, char __user *ubase)
1343 {
1344         char __user *hlp = ubase + ((char *)w - base);
1345         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1346                 return -EFAULT;
1347         return 0;
1348 }
1349
1350 static inline int
1351 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1352 {
1353         int ret;
1354         char __user *hlp;
1355         const struct ebt_entry_target *t;
1356
1357         if (e->bitmask == 0)
1358                 return 0;
1359
1360         hlp = ubase + (((char *)e + e->target_offset) - base);
1361         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1362
1363         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1364         if (ret != 0)
1365                 return ret;
1366         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1367         if (ret != 0)
1368                 return ret;
1369         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1370                 return -EFAULT;
1371         return 0;
1372 }
1373
1374 static int copy_counters_to_user(struct ebt_table *t,
1375                                   const struct ebt_counter *oldcounters,
1376                                   void __user *user, unsigned int num_counters,
1377                                   unsigned int nentries)
1378 {
1379         struct ebt_counter *counterstmp;
1380         int ret = 0;
1381
1382         /* userspace might not need the counters */
1383         if (num_counters == 0)
1384                 return 0;
1385
1386         if (num_counters != nentries) {
1387                 BUGPRINT("Num_counters wrong\n");
1388                 return -EINVAL;
1389         }
1390
1391         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1392         if (!counterstmp)
1393                 return -ENOMEM;
1394
1395         write_lock_bh(&t->lock);
1396         get_counters(oldcounters, counterstmp, nentries);
1397         write_unlock_bh(&t->lock);
1398
1399         if (copy_to_user(user, counterstmp,
1400            nentries * sizeof(struct ebt_counter)))
1401                 ret = -EFAULT;
1402         vfree(counterstmp);
1403         return ret;
1404 }
1405
1406 /* called with ebt_mutex locked */
1407 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1408     const int *len, int cmd)
1409 {
1410         struct ebt_replace tmp;
1411         const struct ebt_counter *oldcounters;
1412         unsigned int entries_size, nentries;
1413         int ret;
1414         char *entries;
1415
1416         if (cmd == EBT_SO_GET_ENTRIES) {
1417                 entries_size = t->private->entries_size;
1418                 nentries = t->private->nentries;
1419                 entries = t->private->entries;
1420                 oldcounters = t->private->counters;
1421         } else {
1422                 entries_size = t->table->entries_size;
1423                 nentries = t->table->nentries;
1424                 entries = t->table->entries;
1425                 oldcounters = t->table->counters;
1426         }
1427
1428         if (copy_from_user(&tmp, user, sizeof(tmp)))
1429                 return -EFAULT;
1430
1431         if (*len != sizeof(struct ebt_replace) + entries_size +
1432            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
1433                 return -EINVAL;
1434
1435         if (tmp.nentries != nentries) {
1436                 BUGPRINT("Nentries wrong\n");
1437                 return -EINVAL;
1438         }
1439
1440         if (tmp.entries_size != entries_size) {
1441                 BUGPRINT("Wrong size\n");
1442                 return -EINVAL;
1443         }
1444
1445         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1446                                         tmp.num_counters, nentries);
1447         if (ret)
1448                 return ret;
1449
1450         if (copy_to_user(tmp.entries, entries, entries_size)) {
1451                 BUGPRINT("Couldn't copy entries to userspace\n");
1452                 return -EFAULT;
1453         }
1454         /* set the match/watcher/target names right */
1455         return EBT_ENTRY_ITERATE(entries, entries_size,
1456            ebt_make_names, entries, tmp.entries);
1457 }
1458
1459 static int do_ebt_set_ctl(struct sock *sk,
1460         int cmd, void __user *user, unsigned int len)
1461 {
1462         int ret;
1463
1464         if (!capable(CAP_NET_ADMIN))
1465                 return -EPERM;
1466
1467         switch(cmd) {
1468         case EBT_SO_SET_ENTRIES:
1469                 ret = do_replace(sock_net(sk), user, len);
1470                 break;
1471         case EBT_SO_SET_COUNTERS:
1472                 ret = update_counters(sock_net(sk), user, len);
1473                 break;
1474         default:
1475                 ret = -EINVAL;
1476         }
1477         return ret;
1478 }
1479
1480 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1481 {
1482         int ret;
1483         struct ebt_replace tmp;
1484         struct ebt_table *t;
1485
1486         if (!capable(CAP_NET_ADMIN))
1487                 return -EPERM;
1488
1489         if (copy_from_user(&tmp, user, sizeof(tmp)))
1490                 return -EFAULT;
1491
1492         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1493         if (!t)
1494                 return ret;
1495
1496         switch(cmd) {
1497         case EBT_SO_GET_INFO:
1498         case EBT_SO_GET_INIT_INFO:
1499                 if (*len != sizeof(struct ebt_replace)){
1500                         ret = -EINVAL;
1501                         mutex_unlock(&ebt_mutex);
1502                         break;
1503                 }
1504                 if (cmd == EBT_SO_GET_INFO) {
1505                         tmp.nentries = t->private->nentries;
1506                         tmp.entries_size = t->private->entries_size;
1507                         tmp.valid_hooks = t->valid_hooks;
1508                 } else {
1509                         tmp.nentries = t->table->nentries;
1510                         tmp.entries_size = t->table->entries_size;
1511                         tmp.valid_hooks = t->table->valid_hooks;
1512                 }
1513                 mutex_unlock(&ebt_mutex);
1514                 if (copy_to_user(user, &tmp, *len) != 0){
1515                         BUGPRINT("c2u Didn't work\n");
1516                         ret = -EFAULT;
1517                         break;
1518                 }
1519                 ret = 0;
1520                 break;
1521
1522         case EBT_SO_GET_ENTRIES:
1523         case EBT_SO_GET_INIT_ENTRIES:
1524                 ret = copy_everything_to_user(t, user, len, cmd);
1525                 mutex_unlock(&ebt_mutex);
1526                 break;
1527
1528         default:
1529                 mutex_unlock(&ebt_mutex);
1530                 ret = -EINVAL;
1531         }
1532
1533         return ret;
1534 }
1535
1536 #ifdef CONFIG_COMPAT
1537 /* 32 bit-userspace compatibility definitions. */
1538 struct compat_ebt_replace {
1539         char name[EBT_TABLE_MAXNAMELEN];
1540         compat_uint_t valid_hooks;
1541         compat_uint_t nentries;
1542         compat_uint_t entries_size;
1543         /* start of the chains */
1544         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1545         /* nr of counters userspace expects back */
1546         compat_uint_t num_counters;
1547         /* where the kernel will put the old counters. */
1548         compat_uptr_t counters;
1549         compat_uptr_t entries;
1550 };
1551
1552 /* struct ebt_entry_match, _target and _watcher have same layout */
1553 struct compat_ebt_entry_mwt {
1554         union {
1555                 char name[EBT_FUNCTION_MAXNAMELEN];
1556                 compat_uptr_t ptr;
1557         } u;
1558         compat_uint_t match_size;
1559         compat_uint_t data[0];
1560 };
1561
1562 /* account for possible padding between match_size and ->data */
1563 static int ebt_compat_entry_padsize(void)
1564 {
1565         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1566                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1567         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1568                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1569 }
1570
1571 static int ebt_compat_match_offset(const struct xt_match *match,
1572                                    unsigned int userlen)
1573 {
1574         /*
1575          * ebt_among needs special handling. The kernel .matchsize is
1576          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1577          * value is expected.
1578          * Example: userspace sends 4500, ebt_among.c wants 4504.
1579          */
1580         if (unlikely(match->matchsize == -1))
1581                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1582         return xt_compat_match_offset(match);
1583 }
1584
1585 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1586                                 unsigned int *size)
1587 {
1588         const struct xt_match *match = m->u.match;
1589         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1590         int off = ebt_compat_match_offset(match, m->match_size);
1591         compat_uint_t msize = m->match_size - off;
1592
1593         BUG_ON(off >= m->match_size);
1594
1595         if (copy_to_user(cm->u.name, match->name,
1596             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1597                 return -EFAULT;
1598
1599         if (match->compat_to_user) {
1600                 if (match->compat_to_user(cm->data, m->data))
1601                         return -EFAULT;
1602         } else if (copy_to_user(cm->data, m->data, msize))
1603                         return -EFAULT;
1604
1605         *size -= ebt_compat_entry_padsize() + off;
1606         *dstptr = cm->data;
1607         *dstptr += msize;
1608         return 0;
1609 }
1610
1611 static int compat_target_to_user(struct ebt_entry_target *t,
1612                                  void __user **dstptr,
1613                                  unsigned int *size)
1614 {
1615         const struct xt_target *target = t->u.target;
1616         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1617         int off = xt_compat_target_offset(target);
1618         compat_uint_t tsize = t->target_size - off;
1619
1620         BUG_ON(off >= t->target_size);
1621
1622         if (copy_to_user(cm->u.name, target->name,
1623             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1624                 return -EFAULT;
1625
1626         if (target->compat_to_user) {
1627                 if (target->compat_to_user(cm->data, t->data))
1628                         return -EFAULT;
1629         } else if (copy_to_user(cm->data, t->data, tsize))
1630                 return -EFAULT;
1631
1632         *size -= ebt_compat_entry_padsize() + off;
1633         *dstptr = cm->data;
1634         *dstptr += tsize;
1635         return 0;
1636 }
1637
1638 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1639                                   void __user **dstptr,
1640                                   unsigned int *size)
1641 {
1642         return compat_target_to_user((struct ebt_entry_target *)w,
1643                                                         dstptr, size);
1644 }
1645
1646 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1647                                 unsigned int *size)
1648 {
1649         struct ebt_entry_target *t;
1650         struct ebt_entry __user *ce;
1651         u32 watchers_offset, target_offset, next_offset;
1652         compat_uint_t origsize;
1653         int ret;
1654
1655         if (e->bitmask == 0) {
1656                 if (*size < sizeof(struct ebt_entries))
1657                         return -EINVAL;
1658                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1659                         return -EFAULT;
1660
1661                 *dstptr += sizeof(struct ebt_entries);
1662                 *size -= sizeof(struct ebt_entries);
1663                 return 0;
1664         }
1665
1666         if (*size < sizeof(*ce))
1667                 return -EINVAL;
1668
1669         ce = (struct ebt_entry __user *)*dstptr;
1670         if (copy_to_user(ce, e, sizeof(*ce)))
1671                 return -EFAULT;
1672
1673         origsize = *size;
1674         *dstptr += sizeof(*ce);
1675
1676         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1677         if (ret)
1678                 return ret;
1679         watchers_offset = e->watchers_offset - (origsize - *size);
1680
1681         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1682         if (ret)
1683                 return ret;
1684         target_offset = e->target_offset - (origsize - *size);
1685
1686         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1687
1688         ret = compat_target_to_user(t, dstptr, size);
1689         if (ret)
1690                 return ret;
1691         next_offset = e->next_offset - (origsize - *size);
1692
1693         if (put_user(watchers_offset, &ce->watchers_offset) ||
1694             put_user(target_offset, &ce->target_offset) ||
1695             put_user(next_offset, &ce->next_offset))
1696                 return -EFAULT;
1697
1698         *size -= sizeof(*ce);
1699         return 0;
1700 }
1701
1702 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1703 {
1704         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1705         *off += ebt_compat_entry_padsize();
1706         return 0;
1707 }
1708
1709 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1710 {
1711         *off += xt_compat_target_offset(w->u.watcher);
1712         *off += ebt_compat_entry_padsize();
1713         return 0;
1714 }
1715
1716 static int compat_calc_entry(const struct ebt_entry *e,
1717                              const struct ebt_table_info *info,
1718                              const void *base,
1719                              struct compat_ebt_replace *newinfo)
1720 {
1721         const struct ebt_entry_target *t;
1722         unsigned int entry_offset;
1723         int off, ret, i;
1724
1725         if (e->bitmask == 0)
1726                 return 0;
1727
1728         off = 0;
1729         entry_offset = (void *)e - base;
1730
1731         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1732         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1733
1734         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1735
1736         off += xt_compat_target_offset(t->u.target);
1737         off += ebt_compat_entry_padsize();
1738
1739         newinfo->entries_size -= off;
1740
1741         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1742         if (ret)
1743                 return ret;
1744
1745         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1746                 const void *hookptr = info->hook_entry[i];
1747                 if (info->hook_entry[i] &&
1748                     (e < (struct ebt_entry *)(base - hookptr))) {
1749                         newinfo->hook_entry[i] -= off;
1750                         pr_debug("0x%08X -> 0x%08X\n",
1751                                         newinfo->hook_entry[i] + off,
1752                                         newinfo->hook_entry[i]);
1753                 }
1754         }
1755
1756         return 0;
1757 }
1758
1759
1760 static int compat_table_info(const struct ebt_table_info *info,
1761                              struct compat_ebt_replace *newinfo)
1762 {
1763         unsigned int size = info->entries_size;
1764         const void *entries = info->entries;
1765
1766         newinfo->entries_size = size;
1767
1768         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1769                                                         entries, newinfo);
1770 }
1771
1772 static int compat_copy_everything_to_user(struct ebt_table *t,
1773                                           void __user *user, int *len, int cmd)
1774 {
1775         struct compat_ebt_replace repl, tmp;
1776         struct ebt_counter *oldcounters;
1777         struct ebt_table_info tinfo;
1778         int ret;
1779         void __user *pos;
1780
1781         memset(&tinfo, 0, sizeof(tinfo));
1782
1783         if (cmd == EBT_SO_GET_ENTRIES) {
1784                 tinfo.entries_size = t->private->entries_size;
1785                 tinfo.nentries = t->private->nentries;
1786                 tinfo.entries = t->private->entries;
1787                 oldcounters = t->private->counters;
1788         } else {
1789                 tinfo.entries_size = t->table->entries_size;
1790                 tinfo.nentries = t->table->nentries;
1791                 tinfo.entries = t->table->entries;
1792                 oldcounters = t->table->counters;
1793         }
1794
1795         if (copy_from_user(&tmp, user, sizeof(tmp)))
1796                 return -EFAULT;
1797
1798         if (tmp.nentries != tinfo.nentries ||
1799            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1800                 return -EINVAL;
1801
1802         memcpy(&repl, &tmp, sizeof(repl));
1803         if (cmd == EBT_SO_GET_ENTRIES)
1804                 ret = compat_table_info(t->private, &repl);
1805         else
1806                 ret = compat_table_info(&tinfo, &repl);
1807         if (ret)
1808                 return ret;
1809
1810         if (*len != sizeof(tmp) + repl.entries_size +
1811            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1812                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1813                                 *len, tinfo.entries_size, repl.entries_size);
1814                 return -EINVAL;
1815         }
1816
1817         /* userspace might not need the counters */
1818         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1819                                         tmp.num_counters, tinfo.nentries);
1820         if (ret)
1821                 return ret;
1822
1823         pos = compat_ptr(tmp.entries);
1824         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1825                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1826 }
1827
1828 struct ebt_entries_buf_state {
1829         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1830         u32 buf_kern_len;       /* total size of kernel buffer */
1831         u32 buf_kern_offset;    /* amount of data copied so far */
1832         u32 buf_user_offset;    /* read position in userspace buffer */
1833 };
1834
1835 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1836 {
1837         state->buf_kern_offset += sz;
1838         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1839 }
1840
1841 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1842                        void *data, unsigned int sz)
1843 {
1844         if (state->buf_kern_start == NULL)
1845                 goto count_only;
1846
1847         BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1848
1849         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1850
1851  count_only:
1852         state->buf_user_offset += sz;
1853         return ebt_buf_count(state, sz);
1854 }
1855
1856 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1857 {
1858         char *b = state->buf_kern_start;
1859
1860         BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1861
1862         if (b != NULL && sz > 0)
1863                 memset(b + state->buf_kern_offset, 0, sz);
1864         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1865         return ebt_buf_count(state, sz);
1866 }
1867
1868 enum compat_mwt {
1869         EBT_COMPAT_MATCH,
1870         EBT_COMPAT_WATCHER,
1871         EBT_COMPAT_TARGET,
1872 };
1873
1874 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1875                                 enum compat_mwt compat_mwt,
1876                                 struct ebt_entries_buf_state *state,
1877                                 const unsigned char *base)
1878 {
1879         char name[EBT_FUNCTION_MAXNAMELEN];
1880         struct xt_match *match;
1881         struct xt_target *wt;
1882         void *dst = NULL;
1883         int off, pad = 0, ret = 0;
1884         unsigned int size_kern, entry_offset, match_size = mwt->match_size;
1885
1886         strlcpy(name, mwt->u.name, sizeof(name));
1887
1888         if (state->buf_kern_start)
1889                 dst = state->buf_kern_start + state->buf_kern_offset;
1890
1891         entry_offset = (unsigned char *) mwt - base;
1892         switch (compat_mwt) {
1893         case EBT_COMPAT_MATCH:
1894                 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
1895                                                 name, 0), "ebt_%s", name);
1896                 if (match == NULL)
1897                         return -ENOENT;
1898                 if (IS_ERR(match))
1899                         return PTR_ERR(match);
1900
1901                 off = ebt_compat_match_offset(match, match_size);
1902                 if (dst) {
1903                         if (match->compat_from_user)
1904                                 match->compat_from_user(dst, mwt->data);
1905                         else
1906                                 memcpy(dst, mwt->data, match_size);
1907                 }
1908
1909                 size_kern = match->matchsize;
1910                 if (unlikely(size_kern == -1))
1911                         size_kern = match_size;
1912                 module_put(match->me);
1913                 break;
1914         case EBT_COMPAT_WATCHER: /* fallthrough */
1915         case EBT_COMPAT_TARGET:
1916                 wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
1917                                                 name, 0), "ebt_%s", name);
1918                 if (wt == NULL)
1919                         return -ENOENT;
1920                 if (IS_ERR(wt))
1921                         return PTR_ERR(wt);
1922                 off = xt_compat_target_offset(wt);
1923
1924                 if (dst) {
1925                         if (wt->compat_from_user)
1926                                 wt->compat_from_user(dst, mwt->data);
1927                         else
1928                                 memcpy(dst, mwt->data, match_size);
1929                 }
1930
1931                 size_kern = wt->targetsize;
1932                 module_put(wt->me);
1933                 break;
1934         }
1935
1936         if (!dst) {
1937                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1938                                         off + ebt_compat_entry_padsize());
1939                 if (ret < 0)
1940                         return ret;
1941         }
1942
1943         state->buf_kern_offset += match_size + off;
1944         state->buf_user_offset += match_size;
1945         pad = XT_ALIGN(size_kern) - size_kern;
1946
1947         if (pad > 0 && dst) {
1948                 BUG_ON(state->buf_kern_len <= pad);
1949                 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1950                 memset(dst + size_kern, 0, pad);
1951         }
1952         return off + match_size;
1953 }
1954
1955 /*
1956  * return size of all matches, watchers or target, including necessary
1957  * alignment and padding.
1958  */
1959 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1960                         unsigned int size_left, enum compat_mwt type,
1961                         struct ebt_entries_buf_state *state, const void *base)
1962 {
1963         int growth = 0;
1964         char *buf;
1965
1966         if (size_left == 0)
1967                 return 0;
1968
1969         buf = (char *) match32;
1970
1971         while (size_left >= sizeof(*match32)) {
1972                 struct ebt_entry_match *match_kern;
1973                 int ret;
1974
1975                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1976                 if (match_kern) {
1977                         char *tmp;
1978                         tmp = state->buf_kern_start + state->buf_kern_offset;
1979                         match_kern = (struct ebt_entry_match *) tmp;
1980                 }
1981                 ret = ebt_buf_add(state, buf, sizeof(*match32));
1982                 if (ret < 0)
1983                         return ret;
1984                 size_left -= sizeof(*match32);
1985
1986                 /* add padding before match->data (if any) */
1987                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1988                 if (ret < 0)
1989                         return ret;
1990
1991                 if (match32->match_size > size_left)
1992                         return -EINVAL;
1993
1994                 size_left -= match32->match_size;
1995
1996                 ret = compat_mtw_from_user(match32, type, state, base);
1997                 if (ret < 0)
1998                         return ret;
1999
2000                 BUG_ON(ret < match32->match_size);
2001                 growth += ret - match32->match_size;
2002                 growth += ebt_compat_entry_padsize();
2003
2004                 buf += sizeof(*match32);
2005                 buf += match32->match_size;
2006
2007                 if (match_kern)
2008                         match_kern->match_size = ret;
2009
2010                 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2011                 match32 = (struct compat_ebt_entry_mwt *) buf;
2012         }
2013
2014         return growth;
2015 }
2016
2017 #define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...)          \
2018 ({                                                          \
2019         unsigned int __i;                                   \
2020         int __ret = 0;                                      \
2021         struct compat_ebt_entry_mwt *__watcher;             \
2022                                                             \
2023         for (__i = e->watchers_offset;                      \
2024              __i < (e)->target_offset;                      \
2025              __i += __watcher->watcher_size +               \
2026              sizeof(struct compat_ebt_entry_mwt)) {         \
2027                 __watcher = (void *)(e) + __i;              \
2028                 __ret = fn(__watcher , ## args);            \
2029                 if (__ret != 0)                             \
2030                         break;                              \
2031         }                                                   \
2032         if (__ret == 0) {                                   \
2033                 if (__i != (e)->target_offset)              \
2034                         __ret = -EINVAL;                    \
2035         }                                                   \
2036         __ret;                                              \
2037 })
2038
2039 #define EBT_COMPAT_MATCH_ITERATE(e, fn, args...)            \
2040 ({                                                          \
2041         unsigned int __i;                                   \
2042         int __ret = 0;                                      \
2043         struct compat_ebt_entry_mwt *__match;               \
2044                                                             \
2045         for (__i = sizeof(struct ebt_entry);                \
2046              __i < (e)->watchers_offset;                    \
2047              __i += __match->match_size +                   \
2048              sizeof(struct compat_ebt_entry_mwt)) {         \
2049                 __match = (void *)(e) + __i;                \
2050                 __ret = fn(__match , ## args);              \
2051                 if (__ret != 0)                             \
2052                         break;                              \
2053         }                                                   \
2054         if (__ret == 0) {                                   \
2055                 if (__i != (e)->watchers_offset)            \
2056                         __ret = -EINVAL;                    \
2057         }                                                   \
2058         __ret;                                              \
2059 })
2060
2061 /* called for all ebt_entry structures. */
2062 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2063                           unsigned int *total,
2064                           struct ebt_entries_buf_state *state)
2065 {
2066         unsigned int i, j, startoff, new_offset = 0;
2067         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2068         unsigned int offsets[4];
2069         unsigned int *offsets_update = NULL;
2070         int ret;
2071         char *buf_start;
2072
2073         if (*total < sizeof(struct ebt_entries))
2074                 return -EINVAL;
2075
2076         if (!entry->bitmask) {
2077                 *total -= sizeof(struct ebt_entries);
2078                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2079         }
2080         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2081                 return -EINVAL;
2082
2083         startoff = state->buf_user_offset;
2084         /* pull in most part of ebt_entry, it does not need to be changed. */
2085         ret = ebt_buf_add(state, entry,
2086                         offsetof(struct ebt_entry, watchers_offset));
2087         if (ret < 0)
2088                 return ret;
2089
2090         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2091         memcpy(&offsets[1], &entry->watchers_offset,
2092                         sizeof(offsets) - sizeof(offsets[0]));
2093
2094         if (state->buf_kern_start) {
2095                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2096                 offsets_update = (unsigned int *) buf_start;
2097         }
2098         ret = ebt_buf_add(state, &offsets[1],
2099                         sizeof(offsets) - sizeof(offsets[0]));
2100         if (ret < 0)
2101                 return ret;
2102         buf_start = (char *) entry;
2103         /*
2104          * 0: matches offset, always follows ebt_entry.
2105          * 1: watchers offset, from ebt_entry structure
2106          * 2: target offset, from ebt_entry structure
2107          * 3: next ebt_entry offset, from ebt_entry structure
2108          *
2109          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2110          */
2111         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2112                 struct compat_ebt_entry_mwt *match32;
2113                 unsigned int size;
2114                 char *buf = buf_start;
2115
2116                 buf = buf_start + offsets[i];
2117                 if (offsets[i] > offsets[j])
2118                         return -EINVAL;
2119
2120                 match32 = (struct compat_ebt_entry_mwt *) buf;
2121                 size = offsets[j] - offsets[i];
2122                 ret = ebt_size_mwt(match32, size, i, state, base);
2123                 if (ret < 0)
2124                         return ret;
2125                 new_offset += ret;
2126                 if (offsets_update && new_offset) {
2127                         pr_debug("change offset %d to %d\n",
2128                                 offsets_update[i], offsets[j] + new_offset);
2129                         offsets_update[i] = offsets[j] + new_offset;
2130                 }
2131         }
2132
2133         startoff = state->buf_user_offset - startoff;
2134
2135         BUG_ON(*total < startoff);
2136         *total -= startoff;
2137         return 0;
2138 }
2139
2140 /*
2141  * repl->entries_size is the size of the ebt_entry blob in userspace.
2142  * It might need more memory when copied to a 64 bit kernel in case
2143  * userspace is 32-bit. So, first task: find out how much memory is needed.
2144  *
2145  * Called before validation is performed.
2146  */
2147 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2148                                 struct ebt_entries_buf_state *state)
2149 {
2150         unsigned int size_remaining = size_user;
2151         int ret;
2152
2153         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2154                                         &size_remaining, state);
2155         if (ret < 0)
2156                 return ret;
2157
2158         WARN_ON(size_remaining);
2159         return state->buf_kern_offset;
2160 }
2161
2162
2163 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2164                                             void __user *user, unsigned int len)
2165 {
2166         struct compat_ebt_replace tmp;
2167         int i;
2168
2169         if (len < sizeof(tmp))
2170                 return -EINVAL;
2171
2172         if (copy_from_user(&tmp, user, sizeof(tmp)))
2173                 return -EFAULT;
2174
2175         if (len != sizeof(tmp) + tmp.entries_size)
2176                 return -EINVAL;
2177
2178         if (tmp.entries_size == 0)
2179                 return -EINVAL;
2180
2181         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2182                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2183                 return -ENOMEM;
2184         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2185                 return -ENOMEM;
2186
2187         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2188
2189         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2190         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2191                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2192
2193         repl->num_counters = tmp.num_counters;
2194         repl->counters = compat_ptr(tmp.counters);
2195         repl->entries = compat_ptr(tmp.entries);
2196         return 0;
2197 }
2198
2199 static int compat_do_replace(struct net *net, void __user *user,
2200                              unsigned int len)
2201 {
2202         int ret, i, countersize, size64;
2203         struct ebt_table_info *newinfo;
2204         struct ebt_replace tmp;
2205         struct ebt_entries_buf_state state;
2206         void *entries_tmp;
2207
2208         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2209         if (ret) {
2210                 /* try real handler in case userland supplied needed padding */
2211                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2212                         ret = 0;
2213                 return ret;
2214         }
2215
2216         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2217         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2218         if (!newinfo)
2219                 return -ENOMEM;
2220
2221         if (countersize)
2222                 memset(newinfo->counters, 0, countersize);
2223
2224         memset(&state, 0, sizeof(state));
2225
2226         newinfo->entries = vmalloc(tmp.entries_size);
2227         if (!newinfo->entries) {
2228                 ret = -ENOMEM;
2229                 goto free_newinfo;
2230         }
2231         if (copy_from_user(
2232            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2233                 ret = -EFAULT;
2234                 goto free_entries;
2235         }
2236
2237         entries_tmp = newinfo->entries;
2238
2239         xt_compat_lock(NFPROTO_BRIDGE);
2240
2241         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2242         if (ret < 0)
2243                 goto out_unlock;
2244
2245         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2246                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2247                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2248
2249         size64 = ret;
2250         newinfo->entries = vmalloc(size64);
2251         if (!newinfo->entries) {
2252                 vfree(entries_tmp);
2253                 ret = -ENOMEM;
2254                 goto out_unlock;
2255         }
2256
2257         memset(&state, 0, sizeof(state));
2258         state.buf_kern_start = newinfo->entries;
2259         state.buf_kern_len = size64;
2260
2261         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2262         BUG_ON(ret < 0);        /* parses same data again */
2263
2264         vfree(entries_tmp);
2265         tmp.entries_size = size64;
2266
2267         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2268                 char __user *usrptr;
2269                 if (tmp.hook_entry[i]) {
2270                         unsigned int delta;
2271                         usrptr = (char __user *) tmp.hook_entry[i];
2272                         delta = usrptr - tmp.entries;
2273                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2274                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2275                 }
2276         }
2277
2278         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2279         xt_compat_unlock(NFPROTO_BRIDGE);
2280
2281         ret = do_replace_finish(net, &tmp, newinfo);
2282         if (ret == 0)
2283                 return ret;
2284 free_entries:
2285         vfree(newinfo->entries);
2286 free_newinfo:
2287         vfree(newinfo);
2288         return ret;
2289 out_unlock:
2290         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2291         xt_compat_unlock(NFPROTO_BRIDGE);
2292         goto free_entries;
2293 }
2294
2295 static int compat_update_counters(struct net *net, void __user *user,
2296                                   unsigned int len)
2297 {
2298         struct compat_ebt_replace hlp;
2299
2300         if (copy_from_user(&hlp, user, sizeof(hlp)))
2301                 return -EFAULT;
2302
2303         /* try real handler in case userland supplied needed padding */
2304         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2305                 return update_counters(net, user, len);
2306
2307         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2308                                         hlp.num_counters, user, len);
2309 }
2310
2311 static int compat_do_ebt_set_ctl(struct sock *sk,
2312                 int cmd, void __user *user, unsigned int len)
2313 {
2314         int ret;
2315
2316         if (!capable(CAP_NET_ADMIN))
2317                 return -EPERM;
2318
2319         switch (cmd) {
2320         case EBT_SO_SET_ENTRIES:
2321                 ret = compat_do_replace(sock_net(sk), user, len);
2322                 break;
2323         case EBT_SO_SET_COUNTERS:
2324                 ret = compat_update_counters(sock_net(sk), user, len);
2325                 break;
2326         default:
2327                 ret = -EINVAL;
2328   }
2329         return ret;
2330 }
2331
2332 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2333                 void __user *user, int *len)
2334 {
2335         int ret;
2336         struct compat_ebt_replace tmp;
2337         struct ebt_table *t;
2338
2339         if (!capable(CAP_NET_ADMIN))
2340                 return -EPERM;
2341
2342         /* try real handler in case userland supplied needed padding */
2343         if ((cmd == EBT_SO_GET_INFO ||
2344              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2345                         return do_ebt_get_ctl(sk, cmd, user, len);
2346
2347         if (copy_from_user(&tmp, user, sizeof(tmp)))
2348                 return -EFAULT;
2349
2350         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
2351         if (!t)
2352                 return ret;
2353
2354         xt_compat_lock(NFPROTO_BRIDGE);
2355         switch (cmd) {
2356         case EBT_SO_GET_INFO:
2357                 tmp.nentries = t->private->nentries;
2358                 ret = compat_table_info(t->private, &tmp);
2359                 if (ret)
2360                         goto out;
2361                 tmp.valid_hooks = t->valid_hooks;
2362
2363                 if (copy_to_user(user, &tmp, *len) != 0) {
2364                         ret = -EFAULT;
2365                         break;
2366                 }
2367                 ret = 0;
2368                 break;
2369         case EBT_SO_GET_INIT_INFO:
2370                 tmp.nentries = t->table->nentries;
2371                 tmp.entries_size = t->table->entries_size;
2372                 tmp.valid_hooks = t->table->valid_hooks;
2373
2374                 if (copy_to_user(user, &tmp, *len) != 0) {
2375                         ret = -EFAULT;
2376                         break;
2377                 }
2378                 ret = 0;
2379                 break;
2380         case EBT_SO_GET_ENTRIES:
2381         case EBT_SO_GET_INIT_ENTRIES:
2382                 /*
2383                  * try real handler first in case of userland-side padding.
2384                  * in case we are dealing with an 'ordinary' 32 bit binary
2385                  * without 64bit compatibility padding, this will fail right
2386                  * after copy_from_user when the *len argument is validated.
2387                  *
2388                  * the compat_ variant needs to do one pass over the kernel
2389                  * data set to adjust for size differences before it the check.
2390                  */
2391                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2392                         ret = 0;
2393                 else
2394                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2395                 break;
2396         default:
2397                 ret = -EINVAL;
2398         }
2399  out:
2400         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2401         xt_compat_unlock(NFPROTO_BRIDGE);
2402         mutex_unlock(&ebt_mutex);
2403         return ret;
2404 }
2405 #endif
2406
2407 static struct nf_sockopt_ops ebt_sockopts =
2408 {
2409         .pf             = PF_INET,
2410         .set_optmin     = EBT_BASE_CTL,
2411         .set_optmax     = EBT_SO_SET_MAX + 1,
2412         .set            = do_ebt_set_ctl,
2413 #ifdef CONFIG_COMPAT
2414         .compat_set     = compat_do_ebt_set_ctl,
2415 #endif
2416         .get_optmin     = EBT_BASE_CTL,
2417         .get_optmax     = EBT_SO_GET_MAX + 1,
2418         .get            = do_ebt_get_ctl,
2419 #ifdef CONFIG_COMPAT
2420         .compat_get     = compat_do_ebt_get_ctl,
2421 #endif
2422         .owner          = THIS_MODULE,
2423 };
2424
2425 static int __init ebtables_init(void)
2426 {
2427         int ret;
2428
2429         ret = xt_register_target(&ebt_standard_target);
2430         if (ret < 0)
2431                 return ret;
2432         ret = nf_register_sockopt(&ebt_sockopts);
2433         if (ret < 0) {
2434                 xt_unregister_target(&ebt_standard_target);
2435                 return ret;
2436         }
2437
2438         printk(KERN_INFO "Ebtables v2.0 registered\n");
2439         return 0;
2440 }
2441
2442 static void __exit ebtables_fini(void)
2443 {
2444         nf_unregister_sockopt(&ebt_sockopts);
2445         xt_unregister_target(&ebt_standard_target);
2446         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2447 }
2448
2449 EXPORT_SYMBOL(ebt_register_table);
2450 EXPORT_SYMBOL(ebt_unregister_table);
2451 EXPORT_SYMBOL(ebt_do_table);
2452 module_init(ebtables_init);
2453 module_exit(ebtables_fini);
2454 MODULE_LICENSE("GPL");