net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18 #include <linux/kmod.h>
  19 #include <linux/module.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netfilter/x_tables.h>
  22 #include <linux/netfilter_bridge/ebtables.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/mutex.h>
  25 #include <linux/slab.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36
  37 /*
  38  * Each cpu has its own set of counters, so there is no need for write_lock in
  39  * the softirq
  40  * For reading or updating the counters, the user context needs to
  41  * get a write_lock
  42  */
  43
  44 /* The size of each set of counters is altered to get cache alignment */
  45 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  46 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  47 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  48    COUNTER_OFFSET(n) * cpu))
  49
  50
  51
  52 static DEFINE_MUTEX(ebt_mutex);
  53
  54 #ifdef CONFIG_COMPAT
  55 static void ebt_standard_compat_from_user(void *dst, const void *src)
  56 {
  57         int v = *(compat_int_t *)src;
  58
  59         if (v >= 0)
  60                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  61         memcpy(dst, &v, sizeof(v));
  62 }
  63
  64 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  65 {
  66         compat_int_t cv = *(int *)src;
  67
  68         if (cv >= 0)
  69                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  70         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  71 }
  72 #endif
  73
  74
  75 static struct xt_target ebt_standard_target = {
  76         .name       = "standard",
  77         .revision   = 0,
  78         .family     = NFPROTO_BRIDGE,
  79         .targetsize = sizeof(int),
  80 #ifdef CONFIG_COMPAT
  81         .compatsize = sizeof(compat_int_t),
  82         .compat_from_user = ebt_standard_compat_from_user,
  83         .compat_to_user =  ebt_standard_compat_to_user,
  84 #endif
  85 };
  86
  87 static inline int
  88 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  89                struct xt_action_param *par)
  90 {
  91         par->target   = w->u.watcher;
  92         par->targinfo = w->data;
  93         w->u.watcher->target(skb, par);
  94         /* watchers don't give a verdict */
  95         return 0;
  96 }
  97
  98 static inline int
  99 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
 100              struct xt_action_param *par)
 101 {
 102         par->match     = m->u.match;
 103         par->matchinfo = m->data;
 104         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 105 }
 106
 107 static inline int
 108 ebt_dev_check(const char *entry, const struct net_device *device)
 109 {
 110         int i = 0;
 111         const char *devname;
 112
 113         if (*entry == '\0')
 114                 return 0;
 115         if (!device)
 116                 return 1;
 117         devname = device->name;
 118         /* 1 is the wildcard token */
 119         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 120                 i++;
 121         return (devname[i] != entry[i] && entry[i] != 1);
 122 }
 123
 124 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 125 /* process standard matches */
 126 static inline int
 127 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
 128                 const struct net_device *in, const struct net_device *out)
 129 {
 130         const struct ethhdr *h = eth_hdr(skb);
 131         const struct net_bridge_port *p;
 132         __be16 ethproto;
 133         int verdict, i;
 134
 135         if (vlan_tx_tag_present(skb))
 136                 ethproto = htons(ETH_P_8021Q);
 137         else
 138                 ethproto = h->h_proto;
 139
 140         if (e->bitmask & EBT_802_3) {
 141                 if (FWINV2(ntohs(ethproto) >= 1536, EBT_IPROTO))
 142                         return 1;
 143         } else if (!(e->bitmask & EBT_NOPROTO) &&
 144            FWINV2(e->ethproto != ethproto, EBT_IPROTO))
 145                 return 1;
 146
 147         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 148                 return 1;
 149         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 150                 return 1;
 151         /* rcu_read_lock()ed by nf_hook_slow */
 152         if (in && (p = br_port_get_rcu(in)) != NULL &&
 153             FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
 154                 return 1;
 155         if (out && (p = br_port_get_rcu(out)) != NULL &&
 156             FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
 157                 return 1;
 158
 159         if (e->bitmask & EBT_SOURCEMAC) {
 160                 verdict = 0;
 161                 for (i = 0; i < 6; i++)
 162                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 163                            e->sourcemsk[i];
 164                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 165                         return 1;
 166         }
 167         if (e->bitmask & EBT_DESTMAC) {
 168                 verdict = 0;
 169                 for (i = 0; i < 6; i++)
 170                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 171                            e->destmsk[i];
 172                 if (FWINV2(verdict != 0, EBT_IDEST) )
 173                         return 1;
 174         }
 175         return 0;
 176 }
 177
 178 static inline __pure
 179 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 180 {
 181         return (void *)entry + entry->next_offset;
 182 }
 183
 184 /* Do some firewalling */
 185 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 186    const struct net_device *in, const struct net_device *out,
 187    struct ebt_table *table)
 188 {
 189         int i, nentries;
 190         struct ebt_entry *point;
 191         struct ebt_counter *counter_base, *cb_base;
 192         const struct ebt_entry_target *t;
 193         int verdict, sp = 0;
 194         struct ebt_chainstack *cs;
 195         struct ebt_entries *chaininfo;
 196         const char *base;
 197         const struct ebt_table_info *private;
 198         struct xt_action_param acpar;
 199
 200         acpar.family  = NFPROTO_BRIDGE;
 201         acpar.in      = in;
 202         acpar.out     = out;
 203         acpar.hotdrop = false;
 204         acpar.hooknum = hook;
 205
 206         read_lock_bh(&table->lock);
 207         private = table->private;
 208         cb_base = COUNTER_BASE(private->counters, private->nentries,
 209            smp_processor_id());
 210         if (private->chainstack)
 211                 cs = private->chainstack[smp_processor_id()];
 212         else
 213                 cs = NULL;
 214         chaininfo = private->hook_entry[hook];
 215         nentries = private->hook_entry[hook]->nentries;
 216         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 217         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 218         /* base for chain jumps */
 219         base = private->entries;
 220         i = 0;
 221         while (i < nentries) {
 222                 if (ebt_basic_match(point, skb, in, out))
 223                         goto letscontinue;
 224
 225                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
 226                         goto letscontinue;
 227                 if (acpar.hotdrop) {
 228                         read_unlock_bh(&table->lock);
 229                         return NF_DROP;
 230                 }
 231
 232                 /* increase counter */
 233                 (*(counter_base + i)).pcnt++;
 234                 (*(counter_base + i)).bcnt += skb->len;
 235
 236                 /* these should only watch: not modify, nor tell us
 237                    what to do with the packet */
 238                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
 239
 240                 t = (struct ebt_entry_target *)
 241                    (((char *)point) + point->target_offset);
 242                 /* standard target */
 243                 if (!t->u.target->target)
 244                         verdict = ((struct ebt_standard_target *)t)->verdict;
 245                 else {
 246                         acpar.target   = t->u.target;
 247                         acpar.targinfo = t->data;
 248                         verdict = t->u.target->target(skb, &acpar);
 249                 }
 250                 if (verdict == EBT_ACCEPT) {
 251                         read_unlock_bh(&table->lock);
 252                         return NF_ACCEPT;
 253                 }
 254                 if (verdict == EBT_DROP) {
 255                         read_unlock_bh(&table->lock);
 256                         return NF_DROP;
 257                 }
 258                 if (verdict == EBT_RETURN) {
 259 letsreturn:
 260 #ifdef CONFIG_NETFILTER_DEBUG
 261                         if (sp == 0) {
 262                                 BUGPRINT("RETURN on base chain");
 263                                 /* act like this is EBT_CONTINUE */
 264                                 goto letscontinue;
 265                         }
 266 #endif
 267                         sp--;
 268                         /* put all the local variables right */
 269                         i = cs[sp].n;
 270                         chaininfo = cs[sp].chaininfo;
 271                         nentries = chaininfo->nentries;
 272                         point = cs[sp].e;
 273                         counter_base = cb_base +
 274                            chaininfo->counter_offset;
 275                         continue;
 276                 }
 277                 if (verdict == EBT_CONTINUE)
 278                         goto letscontinue;
 279 #ifdef CONFIG_NETFILTER_DEBUG
 280                 if (verdict < 0) {
 281                         BUGPRINT("bogus standard verdict\n");
 282                         read_unlock_bh(&table->lock);
 283                         return NF_DROP;
 284                 }
 285 #endif
 286                 /* jump to a udc */
 287                 cs[sp].n = i + 1;
 288                 cs[sp].chaininfo = chaininfo;
 289                 cs[sp].e = ebt_next_entry(point);
 290                 i = 0;
 291                 chaininfo = (struct ebt_entries *) (base + verdict);
 292 #ifdef CONFIG_NETFILTER_DEBUG
 293                 if (chaininfo->distinguisher) {
 294                         BUGPRINT("jump to non-chain\n");
 295                         read_unlock_bh(&table->lock);
 296                         return NF_DROP;
 297                 }
 298 #endif
 299                 nentries = chaininfo->nentries;
 300                 point = (struct ebt_entry *)chaininfo->data;
 301                 counter_base = cb_base + chaininfo->counter_offset;
 302                 sp++;
 303                 continue;
 304 letscontinue:
 305                 point = ebt_next_entry(point);
 306                 i++;
 307         }
 308
 309         /* I actually like this :) */
 310         if (chaininfo->policy == EBT_RETURN)
 311                 goto letsreturn;
 312         if (chaininfo->policy == EBT_ACCEPT) {
 313                 read_unlock_bh(&table->lock);
 314                 return NF_ACCEPT;
 315         }
 316         read_unlock_bh(&table->lock);
 317         return NF_DROP;
 318 }
 319
 320 /* If it succeeds, returns element and locks mutex */
 321 static inline void *
 322 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 323    struct mutex *mutex)
 324 {
 325         struct {
 326                 struct list_head list;
 327                 char name[EBT_FUNCTION_MAXNAMELEN];
 328         } *e;
 329
 330         *error = mutex_lock_interruptible(mutex);
 331         if (*error != 0)
 332                 return NULL;
 333
 334         list_for_each_entry(e, head, list) {
 335                 if (strcmp(e->name, name) == 0)
 336                         return e;
 337         }
 338         *error = -ENOENT;
 339         mutex_unlock(mutex);
 340         return NULL;
 341 }
 342
 343 static void *
 344 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 345    int *error, struct mutex *mutex)
 346 {
 347         return try_then_request_module(
 348                         find_inlist_lock_noload(head, name, error, mutex),
 349                         "%s%s", prefix, name);
 350 }
 351
 352 static inline struct ebt_table *
 353 find_table_lock(struct net *net, const char *name, int *error,
 354                 struct mutex *mutex)
 355 {
 356         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 357                                 "ebtable_", error, mutex);
 358 }
 359
 360 static inline int
 361 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 362                 unsigned int *cnt)
 363 {
 364         const struct ebt_entry *e = par->entryinfo;
 365         struct xt_match *match;
 366         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 367         int ret;
 368
 369         if (left < sizeof(struct ebt_entry_match) ||
 370             left - sizeof(struct ebt_entry_match) < m->match_size)
 371                 return -EINVAL;
 372
 373         match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
 374         if (IS_ERR(match))
 375                 return PTR_ERR(match);
 376         m->u.match = match;
 377
 378         par->match     = match;
 379         par->matchinfo = m->data;
 380         ret = xt_check_match(par, m->match_size,
 381               e->ethproto, e->invflags & EBT_IPROTO);
 382         if (ret < 0) {
 383                 module_put(match->me);
 384                 return ret;
 385         }
 386
 387         (*cnt)++;
 388         return 0;
 389 }
 390
 391 static inline int
 392 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 393                   unsigned int *cnt)
 394 {
 395         const struct ebt_entry *e = par->entryinfo;
 396         struct xt_target *watcher;
 397         size_t left = ((char *)e + e->target_offset) - (char *)w;
 398         int ret;
 399
 400         if (left < sizeof(struct ebt_entry_watcher) ||
 401            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 402                 return -EINVAL;
 403
 404         watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
 405         if (IS_ERR(watcher))
 406                 return PTR_ERR(watcher);
 407         w->u.watcher = watcher;
 408
 409         par->target   = watcher;
 410         par->targinfo = w->data;
 411         ret = xt_check_target(par, w->watcher_size,
 412               e->ethproto, e->invflags & EBT_IPROTO);
 413         if (ret < 0) {
 414                 module_put(watcher->me);
 415                 return ret;
 416         }
 417
 418         (*cnt)++;
 419         return 0;
 420 }
 421
 422 static int ebt_verify_pointers(const struct ebt_replace *repl,
 423                                struct ebt_table_info *newinfo)
 424 {
 425         unsigned int limit = repl->entries_size;
 426         unsigned int valid_hooks = repl->valid_hooks;
 427         unsigned int offset = 0;
 428         int i;
 429
 430         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 431                 newinfo->hook_entry[i] = NULL;
 432
 433         newinfo->entries_size = repl->entries_size;
 434         newinfo->nentries = repl->nentries;
 435
 436         while (offset < limit) {
 437                 size_t left = limit - offset;
 438                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 439
 440                 if (left < sizeof(unsigned int))
 441                         break;
 442
 443                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 444                         if ((valid_hooks & (1 << i)) == 0)
 445                                 continue;
 446                         if ((char __user *)repl->hook_entry[i] ==
 447                              repl->entries + offset)
 448                                 break;
 449                 }
 450
 451                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 452                         if (e->bitmask != 0) {
 453                                 /* we make userspace set this right,
 454                                    so there is no misunderstanding */
 455                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 456                                          "in distinguisher\n");
 457                                 return -EINVAL;
 458                         }
 459                         if (i != NF_BR_NUMHOOKS)
 460                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 461                         if (left < sizeof(struct ebt_entries))
 462                                 break;
 463                         offset += sizeof(struct ebt_entries);
 464                 } else {
 465                         if (left < sizeof(struct ebt_entry))
 466                                 break;
 467                         if (left < e->next_offset)
 468                                 break;
 469                         if (e->next_offset < sizeof(struct ebt_entry))
 470                                 return -EINVAL;
 471                         offset += e->next_offset;
 472                 }
 473         }
 474         if (offset != limit) {
 475                 BUGPRINT("entries_size too small\n");
 476                 return -EINVAL;
 477         }
 478
 479         /* check if all valid hooks have a chain */
 480         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 481                 if (!newinfo->hook_entry[i] &&
 482                    (valid_hooks & (1 << i))) {
 483                         BUGPRINT("Valid hook without chain\n");
 484                         return -EINVAL;
 485                 }
 486         }
 487         return 0;
 488 }
 489
 490 /*
 491  * this one is very careful, as it is the first function
 492  * to parse the userspace data
 493  */
 494 static inline int
 495 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 496    const struct ebt_table_info *newinfo,
 497    unsigned int *n, unsigned int *cnt,
 498    unsigned int *totalcnt, unsigned int *udc_cnt)
 499 {
 500         int i;
 501
 502         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 503                 if ((void *)e == (void *)newinfo->hook_entry[i])
 504                         break;
 505         }
 506         /* beginning of a new chain
 507            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 508         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 509                 /* this checks if the previous chain has as many entries
 510                    as it said it has */
 511                 if (*n != *cnt) {
 512                         BUGPRINT("nentries does not equal the nr of entries "
 513                                  "in the chain\n");
 514                         return -EINVAL;
 515                 }
 516                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 517                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 518                         /* only RETURN from udc */
 519                         if (i != NF_BR_NUMHOOKS ||
 520                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 521                                 BUGPRINT("bad policy\n");
 522                                 return -EINVAL;
 523                         }
 524                 }
 525                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 526                         (*udc_cnt)++;
 527                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 528                         BUGPRINT("counter_offset != totalcnt");
 529                         return -EINVAL;
 530                 }
 531                 *n = ((struct ebt_entries *)e)->nentries;
 532                 *cnt = 0;
 533                 return 0;
 534         }
 535         /* a plain old entry, heh */
 536         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 537            e->watchers_offset > e->target_offset ||
 538            e->target_offset >= e->next_offset) {
 539                 BUGPRINT("entry offsets not in right order\n");
 540                 return -EINVAL;
 541         }
 542         /* this is not checked anywhere else */
 543         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 544                 BUGPRINT("target size too small\n");
 545                 return -EINVAL;
 546         }
 547         (*cnt)++;
 548         (*totalcnt)++;
 549         return 0;
 550 }
 551
 552 struct ebt_cl_stack
 553 {
 554         struct ebt_chainstack cs;
 555         int from;
 556         unsigned int hookmask;
 557 };
 558
 559 /*
 560  * we need these positions to check that the jumps to a different part of the
 561  * entries is a jump to the beginning of a new chain.
 562  */
 563 static inline int
 564 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 565    unsigned int *n, struct ebt_cl_stack *udc)
 566 {
 567         int i;
 568
 569         /* we're only interested in chain starts */
 570         if (e->bitmask)
 571                 return 0;
 572         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 573                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 574                         break;
 575         }
 576         /* only care about udc */
 577         if (i != NF_BR_NUMHOOKS)
 578                 return 0;
 579
 580         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 581         /* these initialisations are depended on later in check_chainloops() */
 582         udc[*n].cs.n = 0;
 583         udc[*n].hookmask = 0;
 584
 585         (*n)++;
 586         return 0;
 587 }
 588
 589 static inline int
 590 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 591 {
 592         struct xt_mtdtor_param par;
 593
 594         if (i && (*i)-- == 0)
 595                 return 1;
 596
 597         par.net       = net;
 598         par.match     = m->u.match;
 599         par.matchinfo = m->data;
 600         par.family    = NFPROTO_BRIDGE;
 601         if (par.match->destroy != NULL)
 602                 par.match->destroy(&par);
 603         module_put(par.match->me);
 604         return 0;
 605 }
 606
 607 static inline int
 608 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 609 {
 610         struct xt_tgdtor_param par;
 611
 612         if (i && (*i)-- == 0)
 613                 return 1;
 614
 615         par.net      = net;
 616         par.target   = w->u.watcher;
 617         par.targinfo = w->data;
 618         par.family   = NFPROTO_BRIDGE;
 619         if (par.target->destroy != NULL)
 620                 par.target->destroy(&par);
 621         module_put(par.target->me);
 622         return 0;
 623 }
 624
 625 static inline int
 626 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 627 {
 628         struct xt_tgdtor_param par;
 629         struct ebt_entry_target *t;
 630
 631         if (e->bitmask == 0)
 632                 return 0;
 633         /* we're done */
 634         if (cnt && (*cnt)-- == 0)
 635                 return 1;
 636         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 637         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 638         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 639
 640         par.net      = net;
 641         par.target   = t->u.target;
 642         par.targinfo = t->data;
 643         par.family   = NFPROTO_BRIDGE;
 644         if (par.target->destroy != NULL)
 645                 par.target->destroy(&par);
 646         module_put(par.target->me);
 647         return 0;
 648 }
 649
 650 static inline int
 651 ebt_check_entry(struct ebt_entry *e, struct net *net,
 652    const struct ebt_table_info *newinfo,
 653    const char *name, unsigned int *cnt,
 654    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 655 {
 656         struct ebt_entry_target *t;
 657         struct xt_target *target;
 658         unsigned int i, j, hook = 0, hookmask = 0;
 659         size_t gap;
 660         int ret;
 661         struct xt_mtchk_param mtpar;
 662         struct xt_tgchk_param tgpar;
 663
 664         /* don't mess with the struct ebt_entries */
 665         if (e->bitmask == 0)
 666                 return 0;
 667
 668         if (e->bitmask & ~EBT_F_MASK) {
 669                 BUGPRINT("Unknown flag for bitmask\n");
 670                 return -EINVAL;
 671         }
 672         if (e->invflags & ~EBT_INV_MASK) {
 673                 BUGPRINT("Unknown flag for inv bitmask\n");
 674                 return -EINVAL;
 675         }
 676         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 677                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 678                 return -EINVAL;
 679         }
 680         /* what hook do we belong to? */
 681         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 682                 if (!newinfo->hook_entry[i])
 683                         continue;
 684                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 685                         hook = i;
 686                 else
 687                         break;
 688         }
 689         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 690            a base chain */
 691         if (i < NF_BR_NUMHOOKS)
 692                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 693         else {
 694                 for (i = 0; i < udc_cnt; i++)
 695                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 696                                 break;
 697                 if (i == 0)
 698                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 699                 else
 700                         hookmask = cl_s[i - 1].hookmask;
 701         }
 702         i = 0;
 703
 704         mtpar.net       = tgpar.net       = net;
 705         mtpar.table     = tgpar.table     = name;
 706         mtpar.entryinfo = tgpar.entryinfo = e;
 707         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 708         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 709         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 710         if (ret != 0)
 711                 goto cleanup_matches;
 712         j = 0;
 713         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 714         if (ret != 0)
 715                 goto cleanup_watchers;
 716         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 717         gap = e->next_offset - e->target_offset;
 718
 719         target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
 720         if (IS_ERR(target)) {
 721                 ret = PTR_ERR(target);
 722                 goto cleanup_watchers;
 723         }
 724
 725         t->u.target = target;
 726         if (t->u.target == &ebt_standard_target) {
 727                 if (gap < sizeof(struct ebt_standard_target)) {
 728                         BUGPRINT("Standard target size too big\n");
 729                         ret = -EFAULT;
 730                         goto cleanup_watchers;
 731                 }
 732                 if (((struct ebt_standard_target *)t)->verdict <
 733                    -NUM_STANDARD_TARGETS) {
 734                         BUGPRINT("Invalid standard target\n");
 735                         ret = -EFAULT;
 736                         goto cleanup_watchers;
 737                 }
 738         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 739                 module_put(t->u.target->me);
 740                 ret = -EFAULT;
 741                 goto cleanup_watchers;
 742         }
 743
 744         tgpar.target   = target;
 745         tgpar.targinfo = t->data;
 746         ret = xt_check_target(&tgpar, t->target_size,
 747               e->ethproto, e->invflags & EBT_IPROTO);
 748         if (ret < 0) {
 749                 module_put(target->me);
 750                 goto cleanup_watchers;
 751         }
 752         (*cnt)++;
 753         return 0;
 754 cleanup_watchers:
 755         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 756 cleanup_matches:
 757         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 758         return ret;
 759 }
 760
 761 /*
 762  * checks for loops and sets the hook mask for udc
 763  * the hook mask for udc tells us from which base chains the udc can be
 764  * accessed. This mask is a parameter to the check() functions of the extensions
 765  */
 766 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 767    unsigned int udc_cnt, unsigned int hooknr, char *base)
 768 {
 769         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 770         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 771         const struct ebt_entry_target *t;
 772
 773         while (pos < nentries || chain_nr != -1) {
 774                 /* end of udc, go back one 'recursion' step */
 775                 if (pos == nentries) {
 776                         /* put back values of the time when this chain was called */
 777                         e = cl_s[chain_nr].cs.e;
 778                         if (cl_s[chain_nr].from != -1)
 779                                 nentries =
 780                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 781                         else
 782                                 nentries = chain->nentries;
 783                         pos = cl_s[chain_nr].cs.n;
 784                         /* make sure we won't see a loop that isn't one */
 785                         cl_s[chain_nr].cs.n = 0;
 786                         chain_nr = cl_s[chain_nr].from;
 787                         if (pos == nentries)
 788                                 continue;
 789                 }
 790                 t = (struct ebt_entry_target *)
 791                    (((char *)e) + e->target_offset);
 792                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 793                         goto letscontinue;
 794                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 795                    e->next_offset) {
 796                         BUGPRINT("Standard target size too big\n");
 797                         return -1;
 798                 }
 799                 verdict = ((struct ebt_standard_target *)t)->verdict;
 800                 if (verdict >= 0) { /* jump to another chain */
 801                         struct ebt_entries *hlp2 =
 802                            (struct ebt_entries *)(base + verdict);
 803                         for (i = 0; i < udc_cnt; i++)
 804                                 if (hlp2 == cl_s[i].cs.chaininfo)
 805                                         break;
 806                         /* bad destination or loop */
 807                         if (i == udc_cnt) {
 808                                 BUGPRINT("bad destination\n");
 809                                 return -1;
 810                         }
 811                         if (cl_s[i].cs.n) {
 812                                 BUGPRINT("loop\n");
 813                                 return -1;
 814                         }
 815                         if (cl_s[i].hookmask & (1 << hooknr))
 816                                 goto letscontinue;
 817                         /* this can't be 0, so the loop test is correct */
 818                         cl_s[i].cs.n = pos + 1;
 819                         pos = 0;
 820                         cl_s[i].cs.e = ebt_next_entry(e);
 821                         e = (struct ebt_entry *)(hlp2->data);
 822                         nentries = hlp2->nentries;
 823                         cl_s[i].from = chain_nr;
 824                         chain_nr = i;
 825                         /* this udc is accessible from the base chain for hooknr */
 826                         cl_s[i].hookmask |= (1 << hooknr);
 827                         continue;
 828                 }
 829 letscontinue:
 830                 e = ebt_next_entry(e);
 831                 pos++;
 832         }
 833         return 0;
 834 }
 835
 836 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 837 static int translate_table(struct net *net, const char *name,
 838                            struct ebt_table_info *newinfo)
 839 {
 840         unsigned int i, j, k, udc_cnt;
 841         int ret;
 842         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 843
 844         i = 0;
 845         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 846                 i++;
 847         if (i == NF_BR_NUMHOOKS) {
 848                 BUGPRINT("No valid hooks specified\n");
 849                 return -EINVAL;
 850         }
 851         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 852                 BUGPRINT("Chains don't start at beginning\n");
 853                 return -EINVAL;
 854         }
 855         /* make sure chains are ordered after each other in same order
 856            as their corresponding hooks */
 857         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 858                 if (!newinfo->hook_entry[j])
 859                         continue;
 860                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 861                         BUGPRINT("Hook order must be followed\n");
 862                         return -EINVAL;
 863                 }
 864                 i = j;
 865         }
 866
 867         /* do some early checkings and initialize some things */
 868         i = 0; /* holds the expected nr. of entries for the chain */
 869         j = 0; /* holds the up to now counted entries for the chain */
 870         k = 0; /* holds the total nr. of entries, should equal
 871                   newinfo->nentries afterwards */
 872         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 873         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 874            ebt_check_entry_size_and_hooks, newinfo,
 875            &i, &j, &k, &udc_cnt);
 876
 877         if (ret != 0)
 878                 return ret;
 879
 880         if (i != j) {
 881                 BUGPRINT("nentries does not equal the nr of entries in the "
 882                          "(last) chain\n");
 883                 return -EINVAL;
 884         }
 885         if (k != newinfo->nentries) {
 886                 BUGPRINT("Total nentries is wrong\n");
 887                 return -EINVAL;
 888         }
 889
 890         /* get the location of the udc, put them in an array
 891            while we're at it, allocate the chainstack */
 892         if (udc_cnt) {
 893                 /* this will get free'd in do_replace()/ebt_register_table()
 894                    if an error occurs */
 895                 newinfo->chainstack =
 896                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 897                 if (!newinfo->chainstack)
 898                         return -ENOMEM;
 899                 for_each_possible_cpu(i) {
 900                         newinfo->chainstack[i] =
 901                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 902                         if (!newinfo->chainstack[i]) {
 903                                 while (i)
 904                                         vfree(newinfo->chainstack[--i]);
 905                                 vfree(newinfo->chainstack);
 906                                 newinfo->chainstack = NULL;
 907                                 return -ENOMEM;
 908                         }
 909                 }
 910
 911                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 912                 if (!cl_s)
 913                         return -ENOMEM;
 914                 i = 0; /* the i'th udc */
 915                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 916                    ebt_get_udc_positions, newinfo, &i, cl_s);
 917                 /* sanity check */
 918                 if (i != udc_cnt) {
 919                         BUGPRINT("i != udc_cnt\n");
 920                         vfree(cl_s);
 921                         return -EFAULT;
 922                 }
 923         }
 924
 925         /* Check for loops */
 926         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 927                 if (newinfo->hook_entry[i])
 928                         if (check_chainloops(newinfo->hook_entry[i],
 929                            cl_s, udc_cnt, i, newinfo->entries)) {
 930                                 vfree(cl_s);
 931                                 return -EINVAL;
 932                         }
 933
 934         /* we now know the following (along with E=mc²):
 935            - the nr of entries in each chain is right
 936            - the size of the allocated space is right
 937            - all valid hooks have a corresponding chain
 938            - there are no loops
 939            - wrong data can still be on the level of a single entry
 940            - could be there are jumps to places that are not the
 941              beginning of a chain. This can only occur in chains that
 942              are not accessible from any base chains, so we don't care. */
 943
 944         /* used to know what we need to clean up if something goes wrong */
 945         i = 0;
 946         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 947            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 948         if (ret != 0) {
 949                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 950                                   ebt_cleanup_entry, net, &i);
 951         }
 952         vfree(cl_s);
 953         return ret;
 954 }
 955
 956 /* called under write_lock */
 957 static void get_counters(const struct ebt_counter *oldcounters,
 958    struct ebt_counter *counters, unsigned int nentries)
 959 {
 960         int i, cpu;
 961         struct ebt_counter *counter_base;
 962
 963         /* counters of cpu 0 */
 964         memcpy(counters, oldcounters,
 965                sizeof(struct ebt_counter) * nentries);
 966
 967         /* add other counters to those of cpu 0 */
 968         for_each_possible_cpu(cpu) {
 969                 if (cpu == 0)
 970                         continue;
 971                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 972                 for (i = 0; i < nentries; i++) {
 973                         counters[i].pcnt += counter_base[i].pcnt;
 974                         counters[i].bcnt += counter_base[i].bcnt;
 975                 }
 976         }
 977 }
 978
 979 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 980                               struct ebt_table_info *newinfo)
 981 {
 982         int ret, i;
 983         struct ebt_counter *counterstmp = NULL;
 984         /* used to be able to unlock earlier */
 985         struct ebt_table_info *table;
 986         struct ebt_table *t;
 987
 988         /* the user wants counters back
 989            the check on the size is done later, when we have the lock */
 990         if (repl->num_counters) {
 991                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
 992                 counterstmp = vmalloc(size);
 993                 if (!counterstmp)
 994                         return -ENOMEM;
 995         }
 996
 997         newinfo->chainstack = NULL;
 998         ret = ebt_verify_pointers(repl, newinfo);
 999         if (ret != 0)
1000                 goto free_counterstmp;
1001
1002         ret = translate_table(net, repl->name, newinfo);
1003
1004         if (ret != 0)
1005                 goto free_counterstmp;
1006
1007         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1008         if (!t) {
1009                 ret = -ENOENT;
1010                 goto free_iterate;
1011         }
1012
1013         /* the table doesn't like it */
1014         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1015                 goto free_unlock;
1016
1017         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1018                 BUGPRINT("Wrong nr. of counters requested\n");
1019                 ret = -EINVAL;
1020                 goto free_unlock;
1021         }
1022
1023         /* we have the mutex lock, so no danger in reading this pointer */
1024         table = t->private;
1025         /* make sure the table can only be rmmod'ed if it contains no rules */
1026         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1027                 ret = -ENOENT;
1028                 goto free_unlock;
1029         } else if (table->nentries && !newinfo->nentries)
1030                 module_put(t->me);
1031         /* we need an atomic snapshot of the counters */
1032         write_lock_bh(&t->lock);
1033         if (repl->num_counters)
1034                 get_counters(t->private->counters, counterstmp,
1035                    t->private->nentries);
1036
1037         t->private = newinfo;
1038         write_unlock_bh(&t->lock);
1039         mutex_unlock(&ebt_mutex);
1040         /* so, a user can change the chains while having messed up her counter
1041            allocation. Only reason why this is done is because this way the lock
1042            is held only once, while this doesn't bring the kernel into a
1043            dangerous state. */
1044         if (repl->num_counters &&
1045            copy_to_user(repl->counters, counterstmp,
1046            repl->num_counters * sizeof(struct ebt_counter))) {
1047                 ret = -EFAULT;
1048         }
1049         else
1050                 ret = 0;
1051
1052         /* decrease module count and free resources */
1053         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1054                           ebt_cleanup_entry, net, NULL);
1055
1056         vfree(table->entries);
1057         if (table->chainstack) {
1058                 for_each_possible_cpu(i)
1059                         vfree(table->chainstack[i]);
1060                 vfree(table->chainstack);
1061         }
1062         vfree(table);
1063
1064         vfree(counterstmp);
1065         return ret;
1066
1067 free_unlock:
1068         mutex_unlock(&ebt_mutex);
1069 free_iterate:
1070         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1071                           ebt_cleanup_entry, net, NULL);
1072 free_counterstmp:
1073         vfree(counterstmp);
1074         /* can be initialized in translate_table() */
1075         if (newinfo->chainstack) {
1076                 for_each_possible_cpu(i)
1077                         vfree(newinfo->chainstack[i]);
1078                 vfree(newinfo->chainstack);
1079         }
1080         return ret;
1081 }
1082
1083 /* replace the table */
1084 static int do_replace(struct net *net, const void __user *user,
1085                       unsigned int len)
1086 {
1087         int ret, countersize;
1088         struct ebt_table_info *newinfo;
1089         struct ebt_replace tmp;
1090
1091         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1092                 return -EFAULT;
1093
1094         if (len != sizeof(tmp) + tmp.entries_size) {
1095                 BUGPRINT("Wrong len argument\n");
1096                 return -EINVAL;
1097         }
1098
1099         if (tmp.entries_size == 0) {
1100                 BUGPRINT("Entries_size never zero\n");
1101                 return -EINVAL;
1102         }
1103         /* overflow check */
1104         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1105                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1106                 return -ENOMEM;
1107         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1108                 return -ENOMEM;
1109
1110         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1111         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1112         if (!newinfo)
1113                 return -ENOMEM;
1114
1115         if (countersize)
1116                 memset(newinfo->counters, 0, countersize);
1117
1118         newinfo->entries = vmalloc(tmp.entries_size);
1119         if (!newinfo->entries) {
1120                 ret = -ENOMEM;
1121                 goto free_newinfo;
1122         }
1123         if (copy_from_user(
1124            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1125                 BUGPRINT("Couldn't copy entries from userspace\n");
1126                 ret = -EFAULT;
1127                 goto free_entries;
1128         }
1129
1130         ret = do_replace_finish(net, &tmp, newinfo);
1131         if (ret == 0)
1132                 return ret;
1133 free_entries:
1134         vfree(newinfo->entries);
1135 free_newinfo:
1136         vfree(newinfo);
1137         return ret;
1138 }
1139
1140 struct ebt_table *
1141 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1142 {
1143         struct ebt_table_info *newinfo;
1144         struct ebt_table *t, *table;
1145         struct ebt_replace_kernel *repl;
1146         int ret, i, countersize;
1147         void *p;
1148
1149         if (input_table == NULL || (repl = input_table->table) == NULL ||
1150             repl->entries == 0 || repl->entries_size == 0 ||
1151             repl->counters != NULL || input_table->private != NULL) {
1152                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1153                 return ERR_PTR(-EINVAL);
1154         }
1155
1156         /* Don't add one table to multiple lists. */
1157         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1158         if (!table) {
1159                 ret = -ENOMEM;
1160                 goto out;
1161         }
1162
1163         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1164         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1165         ret = -ENOMEM;
1166         if (!newinfo)
1167                 goto free_table;
1168
1169         p = vmalloc(repl->entries_size);
1170         if (!p)
1171                 goto free_newinfo;
1172
1173         memcpy(p, repl->entries, repl->entries_size);
1174         newinfo->entries = p;
1175
1176         newinfo->entries_size = repl->entries_size;
1177         newinfo->nentries = repl->nentries;
1178
1179         if (countersize)
1180                 memset(newinfo->counters, 0, countersize);
1181
1182         /* fill in newinfo and parse the entries */
1183         newinfo->chainstack = NULL;
1184         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1185                 if ((repl->valid_hooks & (1 << i)) == 0)
1186                         newinfo->hook_entry[i] = NULL;
1187                 else
1188                         newinfo->hook_entry[i] = p +
1189                                 ((char *)repl->hook_entry[i] - repl->entries);
1190         }
1191         ret = translate_table(net, repl->name, newinfo);
1192         if (ret != 0) {
1193                 BUGPRINT("Translate_table failed\n");
1194                 goto free_chainstack;
1195         }
1196
1197         if (table->check && table->check(newinfo, table->valid_hooks)) {
1198                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1199                 return ERR_PTR(-EINVAL);
1200         }
1201
1202         table->private = newinfo;
1203         rwlock_init(&table->lock);
1204         ret = mutex_lock_interruptible(&ebt_mutex);
1205         if (ret != 0)
1206                 goto free_chainstack;
1207
1208         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1209                 if (strcmp(t->name, table->name) == 0) {
1210                         ret = -EEXIST;
1211                         BUGPRINT("Table name already exists\n");
1212                         goto free_unlock;
1213                 }
1214         }
1215
1216         /* Hold a reference count if the chains aren't empty */
1217         if (newinfo->nentries && !try_module_get(table->me)) {
1218                 ret = -ENOENT;
1219                 goto free_unlock;
1220         }
1221         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1222         mutex_unlock(&ebt_mutex);
1223         return table;
1224 free_unlock:
1225         mutex_unlock(&ebt_mutex);
1226 free_chainstack:
1227         if (newinfo->chainstack) {
1228                 for_each_possible_cpu(i)
1229                         vfree(newinfo->chainstack[i]);
1230                 vfree(newinfo->chainstack);
1231         }
1232         vfree(newinfo->entries);
1233 free_newinfo:
1234         vfree(newinfo);
1235 free_table:
1236         kfree(table);
1237 out:
1238         return ERR_PTR(ret);
1239 }
1240
1241 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1242 {
1243         int i;
1244
1245         if (!table) {
1246                 BUGPRINT("Request to unregister NULL table!!!\n");
1247                 return;
1248         }
1249         mutex_lock(&ebt_mutex);
1250         list_del(&table->list);
1251         mutex_unlock(&ebt_mutex);
1252         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1253                           ebt_cleanup_entry, net, NULL);
1254         if (table->private->nentries)
1255                 module_put(table->me);
1256         vfree(table->private->entries);
1257         if (table->private->chainstack) {
1258                 for_each_possible_cpu(i)
1259                         vfree(table->private->chainstack[i]);
1260                 vfree(table->private->chainstack);
1261         }
1262         vfree(table->private);
1263         kfree(table);
1264 }
1265
1266 /* userspace just supplied us with counters */
1267 static int do_update_counters(struct net *net, const char *name,
1268                                 struct ebt_counter __user *counters,
1269                                 unsigned int num_counters,
1270                                 const void __user *user, unsigned int len)
1271 {
1272         int i, ret;
1273         struct ebt_counter *tmp;
1274         struct ebt_table *t;
1275
1276         if (num_counters == 0)
1277                 return -EINVAL;
1278
1279         tmp = vmalloc(num_counters * sizeof(*tmp));
1280         if (!tmp)
1281                 return -ENOMEM;
1282
1283         t = find_table_lock(net, name, &ret, &ebt_mutex);
1284         if (!t)
1285                 goto free_tmp;
1286
1287         if (num_counters != t->private->nentries) {
1288                 BUGPRINT("Wrong nr of counters\n");
1289                 ret = -EINVAL;
1290                 goto unlock_mutex;
1291         }
1292
1293         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1294                 ret = -EFAULT;
1295                 goto unlock_mutex;
1296         }
1297
1298         /* we want an atomic add of the counters */
1299         write_lock_bh(&t->lock);
1300
1301         /* we add to the counters of the first cpu */
1302         for (i = 0; i < num_counters; i++) {
1303                 t->private->counters[i].pcnt += tmp[i].pcnt;
1304                 t->private->counters[i].bcnt += tmp[i].bcnt;
1305         }
1306
1307         write_unlock_bh(&t->lock);
1308         ret = 0;
1309 unlock_mutex:
1310         mutex_unlock(&ebt_mutex);
1311 free_tmp:
1312         vfree(tmp);
1313         return ret;
1314 }
1315
1316 static int update_counters(struct net *net, const void __user *user,
1317                             unsigned int len)
1318 {
1319         struct ebt_replace hlp;
1320
1321         if (copy_from_user(&hlp, user, sizeof(hlp)))
1322                 return -EFAULT;
1323
1324         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1325                 return -EINVAL;
1326
1327         return do_update_counters(net, hlp.name, hlp.counters,
1328                                 hlp.num_counters, user, len);
1329 }
1330
1331 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1332     const char *base, char __user *ubase)
1333 {
1334         char __user *hlp = ubase + ((char *)m - base);
1335         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1336                 return -EFAULT;
1337         return 0;
1338 }
1339
1340 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1341     const char *base, char __user *ubase)
1342 {
1343         char __user *hlp = ubase + ((char *)w - base);
1344         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1345                 return -EFAULT;
1346         return 0;
1347 }
1348
1349 static inline int
1350 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1351 {
1352         int ret;
1353         char __user *hlp;
1354         const struct ebt_entry_target *t;
1355
1356         if (e->bitmask == 0)
1357                 return 0;
1358
1359         hlp = ubase + (((char *)e + e->target_offset) - base);
1360         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1361
1362         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1363         if (ret != 0)
1364                 return ret;
1365         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1366         if (ret != 0)
1367                 return ret;
1368         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1369                 return -EFAULT;
1370         return 0;
1371 }
1372
1373 static int copy_counters_to_user(struct ebt_table *t,
1374                                   const struct ebt_counter *oldcounters,
1375                                   void __user *user, unsigned int num_counters,
1376                                   unsigned int nentries)
1377 {
1378         struct ebt_counter *counterstmp;
1379         int ret = 0;
1380
1381         /* userspace might not need the counters */
1382         if (num_counters == 0)
1383                 return 0;
1384
1385         if (num_counters != nentries) {
1386                 BUGPRINT("Num_counters wrong\n");
1387                 return -EINVAL;
1388         }
1389
1390         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1391         if (!counterstmp)
1392                 return -ENOMEM;
1393
1394         write_lock_bh(&t->lock);
1395         get_counters(oldcounters, counterstmp, nentries);
1396         write_unlock_bh(&t->lock);
1397
1398         if (copy_to_user(user, counterstmp,
1399            nentries * sizeof(struct ebt_counter)))
1400                 ret = -EFAULT;
1401         vfree(counterstmp);
1402         return ret;
1403 }
1404
1405 /* called with ebt_mutex locked */
1406 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1407     const int *len, int cmd)
1408 {
1409         struct ebt_replace tmp;
1410         const struct ebt_counter *oldcounters;
1411         unsigned int entries_size, nentries;
1412         int ret;
1413         char *entries;
1414
1415         if (cmd == EBT_SO_GET_ENTRIES) {
1416                 entries_size = t->private->entries_size;
1417                 nentries = t->private->nentries;
1418                 entries = t->private->entries;
1419                 oldcounters = t->private->counters;
1420         } else {
1421                 entries_size = t->table->entries_size;
1422                 nentries = t->table->nentries;
1423                 entries = t->table->entries;
1424                 oldcounters = t->table->counters;
1425         }
1426
1427         if (copy_from_user(&tmp, user, sizeof(tmp)))
1428                 return -EFAULT;
1429
1430         if (*len != sizeof(struct ebt_replace) + entries_size +
1431            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
1432                 return -EINVAL;
1433
1434         if (tmp.nentries != nentries) {
1435                 BUGPRINT("Nentries wrong\n");
1436                 return -EINVAL;
1437         }
1438
1439         if (tmp.entries_size != entries_size) {
1440                 BUGPRINT("Wrong size\n");
1441                 return -EINVAL;
1442         }
1443
1444         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1445                                         tmp.num_counters, nentries);
1446         if (ret)
1447                 return ret;
1448
1449         if (copy_to_user(tmp.entries, entries, entries_size)) {
1450                 BUGPRINT("Couldn't copy entries to userspace\n");
1451                 return -EFAULT;
1452         }
1453         /* set the match/watcher/target names right */
1454         return EBT_ENTRY_ITERATE(entries, entries_size,
1455            ebt_make_names, entries, tmp.entries);
1456 }
1457
1458 static int do_ebt_set_ctl(struct sock *sk,
1459         int cmd, void __user *user, unsigned int len)
1460 {
1461         int ret;
1462
1463         if (!capable(CAP_NET_ADMIN))
1464                 return -EPERM;
1465
1466         switch(cmd) {
1467         case EBT_SO_SET_ENTRIES:
1468                 ret = do_replace(sock_net(sk), user, len);
1469                 break;
1470         case EBT_SO_SET_COUNTERS:
1471                 ret = update_counters(sock_net(sk), user, len);
1472                 break;
1473         default:
1474                 ret = -EINVAL;
1475         }
1476         return ret;
1477 }
1478
1479 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1480 {
1481         int ret;
1482         struct ebt_replace tmp;
1483         struct ebt_table *t;
1484
1485         if (!capable(CAP_NET_ADMIN))
1486                 return -EPERM;
1487
1488         if (copy_from_user(&tmp, user, sizeof(tmp)))
1489                 return -EFAULT;
1490
1491         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1492         if (!t)
1493                 return ret;
1494
1495         switch(cmd) {
1496         case EBT_SO_GET_INFO:
1497         case EBT_SO_GET_INIT_INFO:
1498                 if (*len != sizeof(struct ebt_replace)){
1499                         ret = -EINVAL;
1500                         mutex_unlock(&ebt_mutex);
1501                         break;
1502                 }
1503                 if (cmd == EBT_SO_GET_INFO) {
1504                         tmp.nentries = t->private->nentries;
1505                         tmp.entries_size = t->private->entries_size;
1506                         tmp.valid_hooks = t->valid_hooks;
1507                 } else {
1508                         tmp.nentries = t->table->nentries;
1509                         tmp.entries_size = t->table->entries_size;
1510                         tmp.valid_hooks = t->table->valid_hooks;
1511                 }
1512                 mutex_unlock(&ebt_mutex);
1513                 if (copy_to_user(user, &tmp, *len) != 0){
1514                         BUGPRINT("c2u Didn't work\n");
1515                         ret = -EFAULT;
1516                         break;
1517                 }
1518                 ret = 0;
1519                 break;
1520
1521         case EBT_SO_GET_ENTRIES:
1522         case EBT_SO_GET_INIT_ENTRIES:
1523                 ret = copy_everything_to_user(t, user, len, cmd);
1524                 mutex_unlock(&ebt_mutex);
1525                 break;
1526
1527         default:
1528                 mutex_unlock(&ebt_mutex);
1529                 ret = -EINVAL;
1530         }
1531
1532         return ret;
1533 }
1534
1535 #ifdef CONFIG_COMPAT
1536 /* 32 bit-userspace compatibility definitions. */
1537 struct compat_ebt_replace {
1538         char name[EBT_TABLE_MAXNAMELEN];
1539         compat_uint_t valid_hooks;
1540         compat_uint_t nentries;
1541         compat_uint_t entries_size;
1542         /* start of the chains */
1543         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1544         /* nr of counters userspace expects back */
1545         compat_uint_t num_counters;
1546         /* where the kernel will put the old counters. */
1547         compat_uptr_t counters;
1548         compat_uptr_t entries;
1549 };
1550
1551 /* struct ebt_entry_match, _target and _watcher have same layout */
1552 struct compat_ebt_entry_mwt {
1553         union {
1554                 char name[EBT_FUNCTION_MAXNAMELEN];
1555                 compat_uptr_t ptr;
1556         } u;
1557         compat_uint_t match_size;
1558         compat_uint_t data[0];
1559 };
1560
1561 /* account for possible padding between match_size and ->data */
1562 static int ebt_compat_entry_padsize(void)
1563 {
1564         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1565                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1566         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1567                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1568 }
1569
1570 static int ebt_compat_match_offset(const struct xt_match *match,
1571                                    unsigned int userlen)
1572 {
1573         /*
1574          * ebt_among needs special handling. The kernel .matchsize is
1575          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1576          * value is expected.
1577          * Example: userspace sends 4500, ebt_among.c wants 4504.
1578          */
1579         if (unlikely(match->matchsize == -1))
1580                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1581         return xt_compat_match_offset(match);
1582 }
1583
1584 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1585                                 unsigned int *size)
1586 {
1587         const struct xt_match *match = m->u.match;
1588         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1589         int off = ebt_compat_match_offset(match, m->match_size);
1590         compat_uint_t msize = m->match_size - off;
1591
1592         BUG_ON(off >= m->match_size);
1593
1594         if (copy_to_user(cm->u.name, match->name,
1595             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1596                 return -EFAULT;
1597
1598         if (match->compat_to_user) {
1599                 if (match->compat_to_user(cm->data, m->data))
1600                         return -EFAULT;
1601         } else if (copy_to_user(cm->data, m->data, msize))
1602                         return -EFAULT;
1603
1604         *size -= ebt_compat_entry_padsize() + off;
1605         *dstptr = cm->data;
1606         *dstptr += msize;
1607         return 0;
1608 }
1609
1610 static int compat_target_to_user(struct ebt_entry_target *t,
1611                                  void __user **dstptr,
1612                                  unsigned int *size)
1613 {
1614         const struct xt_target *target = t->u.target;
1615         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1616         int off = xt_compat_target_offset(target);
1617         compat_uint_t tsize = t->target_size - off;
1618
1619         BUG_ON(off >= t->target_size);
1620
1621         if (copy_to_user(cm->u.name, target->name,
1622             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1623                 return -EFAULT;
1624
1625         if (target->compat_to_user) {
1626                 if (target->compat_to_user(cm->data, t->data))
1627                         return -EFAULT;
1628         } else if (copy_to_user(cm->data, t->data, tsize))
1629                 return -EFAULT;
1630
1631         *size -= ebt_compat_entry_padsize() + off;
1632         *dstptr = cm->data;
1633         *dstptr += tsize;
1634         return 0;
1635 }
1636
1637 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1638                                   void __user **dstptr,
1639                                   unsigned int *size)
1640 {
1641         return compat_target_to_user((struct ebt_entry_target *)w,
1642                                                         dstptr, size);
1643 }
1644
1645 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1646                                 unsigned int *size)
1647 {
1648         struct ebt_entry_target *t;
1649         struct ebt_entry __user *ce;
1650         u32 watchers_offset, target_offset, next_offset;
1651         compat_uint_t origsize;
1652         int ret;
1653
1654         if (e->bitmask == 0) {
1655                 if (*size < sizeof(struct ebt_entries))
1656                         return -EINVAL;
1657                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1658                         return -EFAULT;
1659
1660                 *dstptr += sizeof(struct ebt_entries);
1661                 *size -= sizeof(struct ebt_entries);
1662                 return 0;
1663         }
1664
1665         if (*size < sizeof(*ce))
1666                 return -EINVAL;
1667
1668         ce = (struct ebt_entry __user *)*dstptr;
1669         if (copy_to_user(ce, e, sizeof(*ce)))
1670                 return -EFAULT;
1671
1672         origsize = *size;
1673         *dstptr += sizeof(*ce);
1674
1675         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1676         if (ret)
1677                 return ret;
1678         watchers_offset = e->watchers_offset - (origsize - *size);
1679
1680         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1681         if (ret)
1682                 return ret;
1683         target_offset = e->target_offset - (origsize - *size);
1684
1685         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1686
1687         ret = compat_target_to_user(t, dstptr, size);
1688         if (ret)
1689                 return ret;
1690         next_offset = e->next_offset - (origsize - *size);
1691
1692         if (put_user(watchers_offset, &ce->watchers_offset) ||
1693             put_user(target_offset, &ce->target_offset) ||
1694             put_user(next_offset, &ce->next_offset))
1695                 return -EFAULT;
1696
1697         *size -= sizeof(*ce);
1698         return 0;
1699 }
1700
1701 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1702 {
1703         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1704         *off += ebt_compat_entry_padsize();
1705         return 0;
1706 }
1707
1708 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1709 {
1710         *off += xt_compat_target_offset(w->u.watcher);
1711         *off += ebt_compat_entry_padsize();
1712         return 0;
1713 }
1714
1715 static int compat_calc_entry(const struct ebt_entry *e,
1716                              const struct ebt_table_info *info,
1717                              const void *base,
1718                              struct compat_ebt_replace *newinfo)
1719 {
1720         const struct ebt_entry_target *t;
1721         unsigned int entry_offset;
1722         int off, ret, i;
1723
1724         if (e->bitmask == 0)
1725                 return 0;
1726
1727         off = 0;
1728         entry_offset = (void *)e - base;
1729
1730         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1731         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1732
1733         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1734
1735         off += xt_compat_target_offset(t->u.target);
1736         off += ebt_compat_entry_padsize();
1737
1738         newinfo->entries_size -= off;
1739
1740         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1741         if (ret)
1742                 return ret;
1743
1744         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1745                 const void *hookptr = info->hook_entry[i];
1746                 if (info->hook_entry[i] &&
1747                     (e < (struct ebt_entry *)(base - hookptr))) {
1748                         newinfo->hook_entry[i] -= off;
1749                         pr_debug("0x%08X -> 0x%08X\n",
1750                                         newinfo->hook_entry[i] + off,
1751                                         newinfo->hook_entry[i]);
1752                 }
1753         }
1754
1755         return 0;
1756 }
1757
1758
1759 static int compat_table_info(const struct ebt_table_info *info,
1760                              struct compat_ebt_replace *newinfo)
1761 {
1762         unsigned int size = info->entries_size;
1763         const void *entries = info->entries;
1764
1765         newinfo->entries_size = size;
1766
1767         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1768                                                         entries, newinfo);
1769 }
1770
1771 static int compat_copy_everything_to_user(struct ebt_table *t,
1772                                           void __user *user, int *len, int cmd)
1773 {
1774         struct compat_ebt_replace repl, tmp;
1775         struct ebt_counter *oldcounters;
1776         struct ebt_table_info tinfo;
1777         int ret;
1778         void __user *pos;
1779
1780         memset(&tinfo, 0, sizeof(tinfo));
1781
1782         if (cmd == EBT_SO_GET_ENTRIES) {
1783                 tinfo.entries_size = t->private->entries_size;
1784                 tinfo.nentries = t->private->nentries;
1785                 tinfo.entries = t->private->entries;
1786                 oldcounters = t->private->counters;
1787         } else {
1788                 tinfo.entries_size = t->table->entries_size;
1789                 tinfo.nentries = t->table->nentries;
1790                 tinfo.entries = t->table->entries;
1791                 oldcounters = t->table->counters;
1792         }
1793
1794         if (copy_from_user(&tmp, user, sizeof(tmp)))
1795                 return -EFAULT;
1796
1797         if (tmp.nentries != tinfo.nentries ||
1798            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1799                 return -EINVAL;
1800
1801         memcpy(&repl, &tmp, sizeof(repl));
1802         if (cmd == EBT_SO_GET_ENTRIES)
1803                 ret = compat_table_info(t->private, &repl);
1804         else
1805                 ret = compat_table_info(&tinfo, &repl);
1806         if (ret)
1807                 return ret;
1808
1809         if (*len != sizeof(tmp) + repl.entries_size +
1810            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1811                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1812                                 *len, tinfo.entries_size, repl.entries_size);
1813                 return -EINVAL;
1814         }
1815
1816         /* userspace might not need the counters */
1817         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1818                                         tmp.num_counters, tinfo.nentries);
1819         if (ret)
1820                 return ret;
1821
1822         pos = compat_ptr(tmp.entries);
1823         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1824                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1825 }
1826
1827 struct ebt_entries_buf_state {
1828         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1829         u32 buf_kern_len;       /* total size of kernel buffer */
1830         u32 buf_kern_offset;    /* amount of data copied so far */
1831         u32 buf_user_offset;    /* read position in userspace buffer */
1832 };
1833
1834 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1835 {
1836         state->buf_kern_offset += sz;
1837         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1838 }
1839
1840 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1841                        void *data, unsigned int sz)
1842 {
1843         if (state->buf_kern_start == NULL)
1844                 goto count_only;
1845
1846         BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1847
1848         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1849
1850  count_only:
1851         state->buf_user_offset += sz;
1852         return ebt_buf_count(state, sz);
1853 }
1854
1855 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1856 {
1857         char *b = state->buf_kern_start;
1858
1859         BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1860
1861         if (b != NULL && sz > 0)
1862                 memset(b + state->buf_kern_offset, 0, sz);
1863         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1864         return ebt_buf_count(state, sz);
1865 }
1866
1867 enum compat_mwt {
1868         EBT_COMPAT_MATCH,
1869         EBT_COMPAT_WATCHER,
1870         EBT_COMPAT_TARGET,
1871 };
1872
1873 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1874                                 enum compat_mwt compat_mwt,
1875                                 struct ebt_entries_buf_state *state,
1876                                 const unsigned char *base)
1877 {
1878         char name[EBT_FUNCTION_MAXNAMELEN];
1879         struct xt_match *match;
1880         struct xt_target *wt;
1881         void *dst = NULL;
1882         int off, pad = 0, ret = 0;
1883         unsigned int size_kern, entry_offset, match_size = mwt->match_size;
1884
1885         strlcpy(name, mwt->u.name, sizeof(name));
1886
1887         if (state->buf_kern_start)
1888                 dst = state->buf_kern_start + state->buf_kern_offset;
1889
1890         entry_offset = (unsigned char *) mwt - base;
1891         switch (compat_mwt) {
1892         case EBT_COMPAT_MATCH:
1893                 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
1894                                                 name, 0), "ebt_%s", name);
1895                 if (match == NULL)
1896                         return -ENOENT;
1897                 if (IS_ERR(match))
1898                         return PTR_ERR(match);
1899
1900                 off = ebt_compat_match_offset(match, match_size);
1901                 if (dst) {
1902                         if (match->compat_from_user)
1903                                 match->compat_from_user(dst, mwt->data);
1904                         else
1905                                 memcpy(dst, mwt->data, match_size);
1906                 }
1907
1908                 size_kern = match->matchsize;
1909                 if (unlikely(size_kern == -1))
1910                         size_kern = match_size;
1911                 module_put(match->me);
1912                 break;
1913         case EBT_COMPAT_WATCHER: /* fallthrough */
1914         case EBT_COMPAT_TARGET:
1915                 wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
1916                                                 name, 0), "ebt_%s", name);
1917                 if (wt == NULL)
1918                         return -ENOENT;
1919                 if (IS_ERR(wt))
1920                         return PTR_ERR(wt);
1921                 off = xt_compat_target_offset(wt);
1922
1923                 if (dst) {
1924                         if (wt->compat_from_user)
1925                                 wt->compat_from_user(dst, mwt->data);
1926                         else
1927                                 memcpy(dst, mwt->data, match_size);
1928                 }
1929
1930                 size_kern = wt->targetsize;
1931                 module_put(wt->me);
1932                 break;
1933         }
1934
1935         if (!dst) {
1936                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1937                                         off + ebt_compat_entry_padsize());
1938                 if (ret < 0)
1939                         return ret;
1940         }
1941
1942         state->buf_kern_offset += match_size + off;
1943         state->buf_user_offset += match_size;
1944         pad = XT_ALIGN(size_kern) - size_kern;
1945
1946         if (pad > 0 && dst) {
1947                 BUG_ON(state->buf_kern_len <= pad);
1948                 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1949                 memset(dst + size_kern, 0, pad);
1950         }
1951         return off + match_size;
1952 }
1953
1954 /*
1955  * return size of all matches, watchers or target, including necessary
1956  * alignment and padding.
1957  */
1958 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1959                         unsigned int size_left, enum compat_mwt type,
1960                         struct ebt_entries_buf_state *state, const void *base)
1961 {
1962         int growth = 0;
1963         char *buf;
1964
1965         if (size_left == 0)
1966                 return 0;
1967
1968         buf = (char *) match32;
1969
1970         while (size_left >= sizeof(*match32)) {
1971                 struct ebt_entry_match *match_kern;
1972                 int ret;
1973
1974                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1975                 if (match_kern) {
1976                         char *tmp;
1977                         tmp = state->buf_kern_start + state->buf_kern_offset;
1978                         match_kern = (struct ebt_entry_match *) tmp;
1979                 }
1980                 ret = ebt_buf_add(state, buf, sizeof(*match32));
1981                 if (ret < 0)
1982                         return ret;
1983                 size_left -= sizeof(*match32);
1984
1985                 /* add padding before match->data (if any) */
1986                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1987                 if (ret < 0)
1988                         return ret;
1989
1990                 if (match32->match_size > size_left)
1991                         return -EINVAL;
1992
1993                 size_left -= match32->match_size;
1994
1995                 ret = compat_mtw_from_user(match32, type, state, base);
1996                 if (ret < 0)
1997                         return ret;
1998
1999                 BUG_ON(ret < match32->match_size);
2000                 growth += ret - match32->match_size;
2001                 growth += ebt_compat_entry_padsize();
2002
2003                 buf += sizeof(*match32);
2004                 buf += match32->match_size;
2005
2006                 if (match_kern)
2007                         match_kern->match_size = ret;
2008
2009                 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2010                 match32 = (struct compat_ebt_entry_mwt *) buf;
2011         }
2012
2013         return growth;
2014 }
2015
2016 #define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...)          \
2017 ({                                                          \
2018         unsigned int __i;                                   \
2019         int __ret = 0;                                      \
2020         struct compat_ebt_entry_mwt *__watcher;             \
2021                                                             \
2022         for (__i = e->watchers_offset;                      \
2023              __i < (e)->target_offset;                      \
2024              __i += __watcher->watcher_size +               \
2025              sizeof(struct compat_ebt_entry_mwt)) {         \
2026                 __watcher = (void *)(e) + __i;              \
2027                 __ret = fn(__watcher , ## args);            \
2028                 if (__ret != 0)                             \
2029                         break;                              \
2030         }                                                   \
2031         if (__ret == 0) {                                   \
2032                 if (__i != (e)->target_offset)              \
2033                         __ret = -EINVAL;                    \
2034         }                                                   \
2035         __ret;                                              \
2036 })
2037
2038 #define EBT_COMPAT_MATCH_ITERATE(e, fn, args...)            \
2039 ({                                                          \
2040         unsigned int __i;                                   \
2041         int __ret = 0;                                      \
2042         struct compat_ebt_entry_mwt *__match;               \
2043                                                             \
2044         for (__i = sizeof(struct ebt_entry);                \
2045              __i < (e)->watchers_offset;                    \
2046              __i += __match->match_size +                   \
2047              sizeof(struct compat_ebt_entry_mwt)) {         \
2048                 __match = (void *)(e) + __i;                \
2049                 __ret = fn(__match , ## args);              \
2050                 if (__ret != 0)                             \
2051                         break;                              \
2052         }                                                   \
2053         if (__ret == 0) {                                   \
2054                 if (__i != (e)->watchers_offset)            \
2055                         __ret = -EINVAL;                    \
2056         }                                                   \
2057         __ret;                                              \
2058 })
2059
2060 /* called for all ebt_entry structures. */
2061 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2062                           unsigned int *total,
2063                           struct ebt_entries_buf_state *state)
2064 {
2065         unsigned int i, j, startoff, new_offset = 0;
2066         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2067         unsigned int offsets[4];
2068         unsigned int *offsets_update = NULL;
2069         int ret;
2070         char *buf_start;
2071
2072         if (*total < sizeof(struct ebt_entries))
2073                 return -EINVAL;
2074
2075         if (!entry->bitmask) {
2076                 *total -= sizeof(struct ebt_entries);
2077                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2078         }
2079         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2080                 return -EINVAL;
2081
2082         startoff = state->buf_user_offset;
2083         /* pull in most part of ebt_entry, it does not need to be changed. */
2084         ret = ebt_buf_add(state, entry,
2085                         offsetof(struct ebt_entry, watchers_offset));
2086         if (ret < 0)
2087                 return ret;
2088
2089         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2090         memcpy(&offsets[1], &entry->watchers_offset,
2091                         sizeof(offsets) - sizeof(offsets[0]));
2092
2093         if (state->buf_kern_start) {
2094                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2095                 offsets_update = (unsigned int *) buf_start;
2096         }
2097         ret = ebt_buf_add(state, &offsets[1],
2098                         sizeof(offsets) - sizeof(offsets[0]));
2099         if (ret < 0)
2100                 return ret;
2101         buf_start = (char *) entry;
2102         /*
2103          * 0: matches offset, always follows ebt_entry.
2104          * 1: watchers offset, from ebt_entry structure
2105          * 2: target offset, from ebt_entry structure
2106          * 3: next ebt_entry offset, from ebt_entry structure
2107          *
2108          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2109          */
2110         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2111                 struct compat_ebt_entry_mwt *match32;
2112                 unsigned int size;
2113                 char *buf = buf_start;
2114
2115                 buf = buf_start + offsets[i];
2116                 if (offsets[i] > offsets[j])
2117                         return -EINVAL;
2118
2119                 match32 = (struct compat_ebt_entry_mwt *) buf;
2120                 size = offsets[j] - offsets[i];
2121                 ret = ebt_size_mwt(match32, size, i, state, base);
2122                 if (ret < 0)
2123                         return ret;
2124                 new_offset += ret;
2125                 if (offsets_update && new_offset) {
2126                         pr_debug("change offset %d to %d\n",
2127                                 offsets_update[i], offsets[j] + new_offset);
2128                         offsets_update[i] = offsets[j] + new_offset;
2129                 }
2130         }
2131
2132         startoff = state->buf_user_offset - startoff;
2133
2134         BUG_ON(*total < startoff);
2135         *total -= startoff;
2136         return 0;
2137 }
2138
2139 /*
2140  * repl->entries_size is the size of the ebt_entry blob in userspace.
2141  * It might need more memory when copied to a 64 bit kernel in case
2142  * userspace is 32-bit. So, first task: find out how much memory is needed.
2143  *
2144  * Called before validation is performed.
2145  */
2146 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2147                                 struct ebt_entries_buf_state *state)
2148 {
2149         unsigned int size_remaining = size_user;
2150         int ret;
2151
2152         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2153                                         &size_remaining, state);
2154         if (ret < 0)
2155                 return ret;
2156
2157         WARN_ON(size_remaining);
2158         return state->buf_kern_offset;
2159 }
2160
2161
2162 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2163                                             void __user *user, unsigned int len)
2164 {
2165         struct compat_ebt_replace tmp;
2166         int i;
2167
2168         if (len < sizeof(tmp))
2169                 return -EINVAL;
2170
2171         if (copy_from_user(&tmp, user, sizeof(tmp)))
2172                 return -EFAULT;
2173
2174         if (len != sizeof(tmp) + tmp.entries_size)
2175                 return -EINVAL;
2176
2177         if (tmp.entries_size == 0)
2178                 return -EINVAL;
2179
2180         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2181                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2182                 return -ENOMEM;
2183         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2184                 return -ENOMEM;
2185
2186         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2187
2188         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2189         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2190                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2191
2192         repl->num_counters = tmp.num_counters;
2193         repl->counters = compat_ptr(tmp.counters);
2194         repl->entries = compat_ptr(tmp.entries);
2195         return 0;
2196 }
2197
2198 static int compat_do_replace(struct net *net, void __user *user,
2199                              unsigned int len)
2200 {
2201         int ret, i, countersize, size64;
2202         struct ebt_table_info *newinfo;
2203         struct ebt_replace tmp;
2204         struct ebt_entries_buf_state state;
2205         void *entries_tmp;
2206
2207         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2208         if (ret) {
2209                 /* try real handler in case userland supplied needed padding */
2210                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2211                         ret = 0;
2212                 return ret;
2213         }
2214
2215         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2216         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2217         if (!newinfo)
2218                 return -ENOMEM;
2219
2220         if (countersize)
2221                 memset(newinfo->counters, 0, countersize);
2222
2223         memset(&state, 0, sizeof(state));
2224
2225         newinfo->entries = vmalloc(tmp.entries_size);
2226         if (!newinfo->entries) {
2227                 ret = -ENOMEM;
2228                 goto free_newinfo;
2229         }
2230         if (copy_from_user(
2231            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2232                 ret = -EFAULT;
2233                 goto free_entries;
2234         }
2235
2236         entries_tmp = newinfo->entries;
2237
2238         xt_compat_lock(NFPROTO_BRIDGE);
2239
2240         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2241         if (ret < 0)
2242                 goto out_unlock;
2243
2244         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2245                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2246                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2247
2248         size64 = ret;
2249         newinfo->entries = vmalloc(size64);
2250         if (!newinfo->entries) {
2251                 vfree(entries_tmp);
2252                 ret = -ENOMEM;
2253                 goto out_unlock;
2254         }
2255
2256         memset(&state, 0, sizeof(state));
2257         state.buf_kern_start = newinfo->entries;
2258         state.buf_kern_len = size64;
2259
2260         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2261         BUG_ON(ret < 0);        /* parses same data again */
2262
2263         vfree(entries_tmp);
2264         tmp.entries_size = size64;
2265
2266         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2267                 char __user *usrptr;
2268                 if (tmp.hook_entry[i]) {
2269                         unsigned int delta;
2270                         usrptr = (char __user *) tmp.hook_entry[i];
2271                         delta = usrptr - tmp.entries;
2272                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2273                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2274                 }
2275         }
2276
2277         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2278         xt_compat_unlock(NFPROTO_BRIDGE);
2279
2280         ret = do_replace_finish(net, &tmp, newinfo);
2281         if (ret == 0)
2282                 return ret;
2283 free_entries:
2284         vfree(newinfo->entries);
2285 free_newinfo:
2286         vfree(newinfo);
2287         return ret;
2288 out_unlock:
2289         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2290         xt_compat_unlock(NFPROTO_BRIDGE);
2291         goto free_entries;
2292 }
2293
2294 static int compat_update_counters(struct net *net, void __user *user,
2295                                   unsigned int len)
2296 {
2297         struct compat_ebt_replace hlp;
2298
2299         if (copy_from_user(&hlp, user, sizeof(hlp)))
2300                 return -EFAULT;
2301
2302         /* try real handler in case userland supplied needed padding */
2303         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2304                 return update_counters(net, user, len);
2305
2306         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2307                                         hlp.num_counters, user, len);
2308 }
2309
2310 static int compat_do_ebt_set_ctl(struct sock *sk,
2311                 int cmd, void __user *user, unsigned int len)
2312 {
2313         int ret;
2314
2315         if (!capable(CAP_NET_ADMIN))
2316                 return -EPERM;
2317
2318         switch (cmd) {
2319         case EBT_SO_SET_ENTRIES:
2320                 ret = compat_do_replace(sock_net(sk), user, len);
2321                 break;
2322         case EBT_SO_SET_COUNTERS:
2323                 ret = compat_update_counters(sock_net(sk), user, len);
2324                 break;
2325         default:
2326                 ret = -EINVAL;
2327   }
2328         return ret;
2329 }
2330
2331 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2332                 void __user *user, int *len)
2333 {
2334         int ret;
2335         struct compat_ebt_replace tmp;
2336         struct ebt_table *t;
2337
2338         if (!capable(CAP_NET_ADMIN))
2339                 return -EPERM;
2340
2341         /* try real handler in case userland supplied needed padding */
2342         if ((cmd == EBT_SO_GET_INFO ||
2343              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2344                         return do_ebt_get_ctl(sk, cmd, user, len);
2345
2346         if (copy_from_user(&tmp, user, sizeof(tmp)))
2347                 return -EFAULT;
2348
2349         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
2350         if (!t)
2351                 return ret;
2352
2353         xt_compat_lock(NFPROTO_BRIDGE);
2354         switch (cmd) {
2355         case EBT_SO_GET_INFO:
2356                 tmp.nentries = t->private->nentries;
2357                 ret = compat_table_info(t->private, &tmp);
2358                 if (ret)
2359                         goto out;
2360                 tmp.valid_hooks = t->valid_hooks;
2361
2362                 if (copy_to_user(user, &tmp, *len) != 0) {
2363                         ret = -EFAULT;
2364                         break;
2365                 }
2366                 ret = 0;
2367                 break;
2368         case EBT_SO_GET_INIT_INFO:
2369                 tmp.nentries = t->table->nentries;
2370                 tmp.entries_size = t->table->entries_size;
2371                 tmp.valid_hooks = t->table->valid_hooks;
2372
2373                 if (copy_to_user(user, &tmp, *len) != 0) {
2374                         ret = -EFAULT;
2375                         break;
2376                 }
2377                 ret = 0;
2378                 break;
2379         case EBT_SO_GET_ENTRIES:
2380         case EBT_SO_GET_INIT_ENTRIES:
2381                 /*
2382                  * try real handler first in case of userland-side padding.
2383                  * in case we are dealing with an 'ordinary' 32 bit binary
2384                  * without 64bit compatibility padding, this will fail right
2385                  * after copy_from_user when the *len argument is validated.
2386                  *
2387                  * the compat_ variant needs to do one pass over the kernel
2388                  * data set to adjust for size differences before it the check.
2389                  */
2390                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2391                         ret = 0;
2392                 else
2393                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2394                 break;
2395         default:
2396                 ret = -EINVAL;
2397         }
2398  out:
2399         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2400         xt_compat_unlock(NFPROTO_BRIDGE);
2401         mutex_unlock(&ebt_mutex);
2402         return ret;
2403 }
2404 #endif
2405
2406 static struct nf_sockopt_ops ebt_sockopts =
2407 {
2408         .pf             = PF_INET,
2409         .set_optmin     = EBT_BASE_CTL,
2410         .set_optmax     = EBT_SO_SET_MAX + 1,
2411         .set            = do_ebt_set_ctl,
2412 #ifdef CONFIG_COMPAT
2413         .compat_set     = compat_do_ebt_set_ctl,
2414 #endif
2415         .get_optmin     = EBT_BASE_CTL,
2416         .get_optmax     = EBT_SO_GET_MAX + 1,
2417         .get            = do_ebt_get_ctl,
2418 #ifdef CONFIG_COMPAT
2419         .compat_get     = compat_do_ebt_get_ctl,
2420 #endif
2421         .owner          = THIS_MODULE,
2422 };
2423
2424 static int __init ebtables_init(void)
2425 {
2426         int ret;
2427
2428         ret = xt_register_target(&ebt_standard_target);
2429         if (ret < 0)
2430                 return ret;
2431         ret = nf_register_sockopt(&ebt_sockopts);
2432         if (ret < 0) {
2433                 xt_unregister_target(&ebt_standard_target);
2434                 return ret;
2435         }
2436
2437         printk(KERN_INFO "Ebtables v2.0 registered\n");
2438         return 0;
2439 }
2440
2441 static void __exit ebtables_fini(void)
2442 {
2443         nf_unregister_sockopt(&ebt_sockopts);
2444         xt_unregister_target(&ebt_standard_target);
2445         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2446 }
2447
2448 EXPORT_SYMBOL(ebt_register_table);
2449 EXPORT_SYMBOL(ebt_unregister_table);
2450 EXPORT_SYMBOL(ebt_do_table);
2451 module_init(ebtables_init);
2452 module_exit(ebtables_fini);
2453 MODULE_LICENSE("GPL");