net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is strongly inspired by the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18 #include <linux/kmod.h>
  19 #include <linux/module.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netfilter/x_tables.h>
  22 #include <linux/netfilter_bridge/ebtables.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/mutex.h>
  25 #include <linux/slab.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <linux/audit.h>
  30 #include <net/sock.h>
  31 /* needed for logical [in,out]-dev filtering */
  32 #include "../br_private.h"
  33
  34 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  35                                          "report to author: "format, ## args)
  36 /* #define BUGPRINT(format, args...) */
  37
  38 /*
  39  * Each cpu has its own set of counters, so there is no need for write_lock in
  40  * the softirq
  41  * For reading or updating the counters, the user context needs to
  42  * get a write_lock
  43  */
  44
  45 /* The size of each set of counters is altered to get cache alignment */
  46 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  47 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  48 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  49    COUNTER_OFFSET(n) * cpu))
  50
  51
  52
  53 static DEFINE_MUTEX(ebt_mutex);
  54
  55 #ifdef CONFIG_COMPAT
  56 static void ebt_standard_compat_from_user(void *dst, const void *src)
  57 {
  58         int v = *(compat_int_t *)src;
  59
  60         if (v >= 0)
  61                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  62         memcpy(dst, &v, sizeof(v));
  63 }
  64
  65 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  66 {
  67         compat_int_t cv = *(int *)src;
  68
  69         if (cv >= 0)
  70                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  71         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  72 }
  73 #endif
  74
  75
  76 static struct xt_target ebt_standard_target = {
  77         .name       = "standard",
  78         .revision   = 0,
  79         .family     = NFPROTO_BRIDGE,
  80         .targetsize = sizeof(int),
  81 #ifdef CONFIG_COMPAT
  82         .compatsize = sizeof(compat_int_t),
  83         .compat_from_user = ebt_standard_compat_from_user,
  84         .compat_to_user =  ebt_standard_compat_to_user,
  85 #endif
  86 };
  87
  88 static inline int
  89 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  90                struct xt_action_param *par)
  91 {
  92         par->target   = w->u.watcher;
  93         par->targinfo = w->data;
  94         w->u.watcher->target(skb, par);
  95         /* watchers don't give a verdict */
  96         return 0;
  97 }
  98
  99 static inline int
 100 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
 101              struct xt_action_param *par)
 102 {
 103         par->match     = m->u.match;
 104         par->matchinfo = m->data;
 105         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 106 }
 107
 108 static inline int
 109 ebt_dev_check(const char *entry, const struct net_device *device)
 110 {
 111         int i = 0;
 112         const char *devname;
 113
 114         if (*entry == '\0')
 115                 return 0;
 116         if (!device)
 117                 return 1;
 118         devname = device->name;
 119         /* 1 is the wildcard token */
 120         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 121                 i++;
 122         return devname[i] != entry[i] && entry[i] != 1;
 123 }
 124
 125 #define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
 126 /* process standard matches */
 127 static inline int
 128 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
 129                 const struct net_device *in, const struct net_device *out)
 130 {
 131         const struct ethhdr *h = eth_hdr(skb);
 132         const struct net_bridge_port *p;
 133         __be16 ethproto;
 134         int verdict, i;
 135
 136         if (skb_vlan_tag_present(skb))
 137                 ethproto = htons(ETH_P_8021Q);
 138         else
 139                 ethproto = h->h_proto;
 140
 141         if (e->bitmask & EBT_802_3) {
 142                 if (FWINV2(eth_proto_is_802_3(ethproto), EBT_IPROTO))
 143                         return 1;
 144         } else if (!(e->bitmask & EBT_NOPROTO) &&
 145            FWINV2(e->ethproto != ethproto, EBT_IPROTO))
 146                 return 1;
 147
 148         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 149                 return 1;
 150         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 151                 return 1;
 152         /* rcu_read_lock()ed by nf_hook_slow */
 153         if (in && (p = br_port_get_rcu(in)) != NULL &&
 154             FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
 155                 return 1;
 156         if (out && (p = br_port_get_rcu(out)) != NULL &&
 157             FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
 158                 return 1;
 159
 160         if (e->bitmask & EBT_SOURCEMAC) {
 161                 verdict = 0;
 162                 for (i = 0; i < 6; i++)
 163                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 164                            e->sourcemsk[i];
 165                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 166                         return 1;
 167         }
 168         if (e->bitmask & EBT_DESTMAC) {
 169                 verdict = 0;
 170                 for (i = 0; i < 6; i++)
 171                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 172                            e->destmsk[i];
 173                 if (FWINV2(verdict != 0, EBT_IDEST) )
 174                         return 1;
 175         }
 176         return 0;
 177 }
 178
 179 static inline
 180 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 181 {
 182         return (void *)entry + entry->next_offset;
 183 }
 184
 185 /* Do some firewalling */
 186 unsigned int ebt_do_table(struct sk_buff *skb,
 187                           const struct nf_hook_state *state,
 188                           struct ebt_table *table)
 189 {
 190         unsigned int hook = state->hook;
 191         int i, nentries;
 192         struct ebt_entry *point;
 193         struct ebt_counter *counter_base, *cb_base;
 194         const struct ebt_entry_target *t;
 195         int verdict, sp = 0;
 196         struct ebt_chainstack *cs;
 197         struct ebt_entries *chaininfo;
 198         const char *base;
 199         const struct ebt_table_info *private;
 200         struct xt_action_param acpar;
 201
 202         acpar.family  = NFPROTO_BRIDGE;
 203         acpar.net     = state->net;
 204         acpar.in      = state->in;
 205         acpar.out     = state->out;
 206         acpar.hotdrop = false;
 207         acpar.hooknum = hook;
 208
 209         read_lock_bh(&table->lock);
 210         private = table->private;
 211         cb_base = COUNTER_BASE(private->counters, private->nentries,
 212            smp_processor_id());
 213         if (private->chainstack)
 214                 cs = private->chainstack[smp_processor_id()];
 215         else
 216                 cs = NULL;
 217         chaininfo = private->hook_entry[hook];
 218         nentries = private->hook_entry[hook]->nentries;
 219         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 220         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 221         /* base for chain jumps */
 222         base = private->entries;
 223         i = 0;
 224         while (i < nentries) {
 225                 if (ebt_basic_match(point, skb, state->in, state->out))
 226                         goto letscontinue;
 227
 228                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
 229                         goto letscontinue;
 230                 if (acpar.hotdrop) {
 231                         read_unlock_bh(&table->lock);
 232                         return NF_DROP;
 233                 }
 234
 235                 /* increase counter */
 236                 (*(counter_base + i)).pcnt++;
 237                 (*(counter_base + i)).bcnt += skb->len;
 238
 239                 /* these should only watch: not modify, nor tell us
 240                    what to do with the packet */
 241                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
 242
 243                 t = (struct ebt_entry_target *)
 244                    (((char *)point) + point->target_offset);
 245                 /* standard target */
 246                 if (!t->u.target->target)
 247                         verdict = ((struct ebt_standard_target *)t)->verdict;
 248                 else {
 249                         acpar.target   = t->u.target;
 250                         acpar.targinfo = t->data;
 251                         verdict = t->u.target->target(skb, &acpar);
 252                 }
 253                 if (verdict == EBT_ACCEPT) {
 254                         read_unlock_bh(&table->lock);
 255                         return NF_ACCEPT;
 256                 }
 257                 if (verdict == EBT_DROP) {
 258                         read_unlock_bh(&table->lock);
 259                         return NF_DROP;
 260                 }
 261                 if (verdict == EBT_RETURN) {
 262 letsreturn:
 263 #ifdef CONFIG_NETFILTER_DEBUG
 264                         if (sp == 0) {
 265                                 BUGPRINT("RETURN on base chain");
 266                                 /* act like this is EBT_CONTINUE */
 267                                 goto letscontinue;
 268                         }
 269 #endif
 270                         sp--;
 271                         /* put all the local variables right */
 272                         i = cs[sp].n;
 273                         chaininfo = cs[sp].chaininfo;
 274                         nentries = chaininfo->nentries;
 275                         point = cs[sp].e;
 276                         counter_base = cb_base +
 277                            chaininfo->counter_offset;
 278                         continue;
 279                 }
 280                 if (verdict == EBT_CONTINUE)
 281                         goto letscontinue;
 282 #ifdef CONFIG_NETFILTER_DEBUG
 283                 if (verdict < 0) {
 284                         BUGPRINT("bogus standard verdict\n");
 285                         read_unlock_bh(&table->lock);
 286                         return NF_DROP;
 287                 }
 288 #endif
 289                 /* jump to a udc */
 290                 cs[sp].n = i + 1;
 291                 cs[sp].chaininfo = chaininfo;
 292                 cs[sp].e = ebt_next_entry(point);
 293                 i = 0;
 294                 chaininfo = (struct ebt_entries *) (base + verdict);
 295 #ifdef CONFIG_NETFILTER_DEBUG
 296                 if (chaininfo->distinguisher) {
 297                         BUGPRINT("jump to non-chain\n");
 298                         read_unlock_bh(&table->lock);
 299                         return NF_DROP;
 300                 }
 301 #endif
 302                 nentries = chaininfo->nentries;
 303                 point = (struct ebt_entry *)chaininfo->data;
 304                 counter_base = cb_base + chaininfo->counter_offset;
 305                 sp++;
 306                 continue;
 307 letscontinue:
 308                 point = ebt_next_entry(point);
 309                 i++;
 310         }
 311
 312         /* I actually like this :) */
 313         if (chaininfo->policy == EBT_RETURN)
 314                 goto letsreturn;
 315         if (chaininfo->policy == EBT_ACCEPT) {
 316                 read_unlock_bh(&table->lock);
 317                 return NF_ACCEPT;
 318         }
 319         read_unlock_bh(&table->lock);
 320         return NF_DROP;
 321 }
 322
 323 /* If it succeeds, returns element and locks mutex */
 324 static inline void *
 325 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 326    struct mutex *mutex)
 327 {
 328         struct {
 329                 struct list_head list;
 330                 char name[EBT_FUNCTION_MAXNAMELEN];
 331         } *e;
 332
 333         mutex_lock(mutex);
 334         list_for_each_entry(e, head, list) {
 335                 if (strcmp(e->name, name) == 0)
 336                         return e;
 337         }
 338         *error = -ENOENT;
 339         mutex_unlock(mutex);
 340         return NULL;
 341 }
 342
 343 static void *
 344 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 345    int *error, struct mutex *mutex)
 346 {
 347         return try_then_request_module(
 348                         find_inlist_lock_noload(head, name, error, mutex),
 349                         "%s%s", prefix, name);
 350 }
 351
 352 static inline struct ebt_table *
 353 find_table_lock(struct net *net, const char *name, int *error,
 354                 struct mutex *mutex)
 355 {
 356         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 357                                 "ebtable_", error, mutex);
 358 }
 359
 360 static inline int
 361 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 362                 unsigned int *cnt)
 363 {
 364         const struct ebt_entry *e = par->entryinfo;
 365         struct xt_match *match;
 366         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 367         int ret;
 368
 369         if (left < sizeof(struct ebt_entry_match) ||
 370             left - sizeof(struct ebt_entry_match) < m->match_size)
 371                 return -EINVAL;
 372
 373         match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
 374         if (IS_ERR(match))
 375                 return PTR_ERR(match);
 376         m->u.match = match;
 377
 378         par->match     = match;
 379         par->matchinfo = m->data;
 380         ret = xt_check_match(par, m->match_size,
 381               e->ethproto, e->invflags & EBT_IPROTO);
 382         if (ret < 0) {
 383                 module_put(match->me);
 384                 return ret;
 385         }
 386
 387         (*cnt)++;
 388         return 0;
 389 }
 390
 391 static inline int
 392 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 393                   unsigned int *cnt)
 394 {
 395         const struct ebt_entry *e = par->entryinfo;
 396         struct xt_target *watcher;
 397         size_t left = ((char *)e + e->target_offset) - (char *)w;
 398         int ret;
 399
 400         if (left < sizeof(struct ebt_entry_watcher) ||
 401            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 402                 return -EINVAL;
 403
 404         watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
 405         if (IS_ERR(watcher))
 406                 return PTR_ERR(watcher);
 407
 408         if (watcher->family != NFPROTO_BRIDGE) {
 409                 module_put(watcher->me);
 410                 return -ENOENT;
 411         }
 412
 413         w->u.watcher = watcher;
 414
 415         par->target   = watcher;
 416         par->targinfo = w->data;
 417         ret = xt_check_target(par, w->watcher_size,
 418               e->ethproto, e->invflags & EBT_IPROTO);
 419         if (ret < 0) {
 420                 module_put(watcher->me);
 421                 return ret;
 422         }
 423
 424         (*cnt)++;
 425         return 0;
 426 }
 427
 428 static int ebt_verify_pointers(const struct ebt_replace *repl,
 429                                struct ebt_table_info *newinfo)
 430 {
 431         unsigned int limit = repl->entries_size;
 432         unsigned int valid_hooks = repl->valid_hooks;
 433         unsigned int offset = 0;
 434         int i;
 435
 436         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 437                 newinfo->hook_entry[i] = NULL;
 438
 439         newinfo->entries_size = repl->entries_size;
 440         newinfo->nentries = repl->nentries;
 441
 442         while (offset < limit) {
 443                 size_t left = limit - offset;
 444                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 445
 446                 if (left < sizeof(unsigned int))
 447                         break;
 448
 449                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 450                         if ((valid_hooks & (1 << i)) == 0)
 451                                 continue;
 452                         if ((char __user *)repl->hook_entry[i] ==
 453                              repl->entries + offset)
 454                                 break;
 455                 }
 456
 457                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 458                         if (e->bitmask != 0) {
 459                                 /* we make userspace set this right,
 460                                    so there is no misunderstanding */
 461                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 462                                          "in distinguisher\n");
 463                                 return -EINVAL;
 464                         }
 465                         if (i != NF_BR_NUMHOOKS)
 466                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 467                         if (left < sizeof(struct ebt_entries))
 468                                 break;
 469                         offset += sizeof(struct ebt_entries);
 470                 } else {
 471                         if (left < sizeof(struct ebt_entry))
 472                                 break;
 473                         if (left < e->next_offset)
 474                                 break;
 475                         if (e->next_offset < sizeof(struct ebt_entry))
 476                                 return -EINVAL;
 477                         offset += e->next_offset;
 478                 }
 479         }
 480         if (offset != limit) {
 481                 BUGPRINT("entries_size too small\n");
 482                 return -EINVAL;
 483         }
 484
 485         /* check if all valid hooks have a chain */
 486         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 487                 if (!newinfo->hook_entry[i] &&
 488                    (valid_hooks & (1 << i))) {
 489                         BUGPRINT("Valid hook without chain\n");
 490                         return -EINVAL;
 491                 }
 492         }
 493         return 0;
 494 }
 495
 496 /*
 497  * this one is very careful, as it is the first function
 498  * to parse the userspace data
 499  */
 500 static inline int
 501 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 502    const struct ebt_table_info *newinfo,
 503    unsigned int *n, unsigned int *cnt,
 504    unsigned int *totalcnt, unsigned int *udc_cnt)
 505 {
 506         int i;
 507
 508         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 509                 if ((void *)e == (void *)newinfo->hook_entry[i])
 510                         break;
 511         }
 512         /* beginning of a new chain
 513            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 514         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 515                 /* this checks if the previous chain has as many entries
 516                    as it said it has */
 517                 if (*n != *cnt) {
 518                         BUGPRINT("nentries does not equal the nr of entries "
 519                                  "in the chain\n");
 520                         return -EINVAL;
 521                 }
 522                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 523                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 524                         /* only RETURN from udc */
 525                         if (i != NF_BR_NUMHOOKS ||
 526                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 527                                 BUGPRINT("bad policy\n");
 528                                 return -EINVAL;
 529                         }
 530                 }
 531                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 532                         (*udc_cnt)++;
 533                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 534                         BUGPRINT("counter_offset != totalcnt");
 535                         return -EINVAL;
 536                 }
 537                 *n = ((struct ebt_entries *)e)->nentries;
 538                 *cnt = 0;
 539                 return 0;
 540         }
 541         /* a plain old entry, heh */
 542         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 543            e->watchers_offset > e->target_offset ||
 544            e->target_offset >= e->next_offset) {
 545                 BUGPRINT("entry offsets not in right order\n");
 546                 return -EINVAL;
 547         }
 548         /* this is not checked anywhere else */
 549         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 550                 BUGPRINT("target size too small\n");
 551                 return -EINVAL;
 552         }
 553         (*cnt)++;
 554         (*totalcnt)++;
 555         return 0;
 556 }
 557
 558 struct ebt_cl_stack
 559 {
 560         struct ebt_chainstack cs;
 561         int from;
 562         unsigned int hookmask;
 563 };
 564
 565 /*
 566  * we need these positions to check that the jumps to a different part of the
 567  * entries is a jump to the beginning of a new chain.
 568  */
 569 static inline int
 570 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 571    unsigned int *n, struct ebt_cl_stack *udc)
 572 {
 573         int i;
 574
 575         /* we're only interested in chain starts */
 576         if (e->bitmask)
 577                 return 0;
 578         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 579                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 580                         break;
 581         }
 582         /* only care about udc */
 583         if (i != NF_BR_NUMHOOKS)
 584                 return 0;
 585
 586         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 587         /* these initialisations are depended on later in check_chainloops() */
 588         udc[*n].cs.n = 0;
 589         udc[*n].hookmask = 0;
 590
 591         (*n)++;
 592         return 0;
 593 }
 594
 595 static inline int
 596 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 597 {
 598         struct xt_mtdtor_param par;
 599
 600         if (i && (*i)-- == 0)
 601                 return 1;
 602
 603         par.net       = net;
 604         par.match     = m->u.match;
 605         par.matchinfo = m->data;
 606         par.family    = NFPROTO_BRIDGE;
 607         if (par.match->destroy != NULL)
 608                 par.match->destroy(&par);
 609         module_put(par.match->me);
 610         return 0;
 611 }
 612
 613 static inline int
 614 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 615 {
 616         struct xt_tgdtor_param par;
 617
 618         if (i && (*i)-- == 0)
 619                 return 1;
 620
 621         par.net      = net;
 622         par.target   = w->u.watcher;
 623         par.targinfo = w->data;
 624         par.family   = NFPROTO_BRIDGE;
 625         if (par.target->destroy != NULL)
 626                 par.target->destroy(&par);
 627         module_put(par.target->me);
 628         return 0;
 629 }
 630
 631 static inline int
 632 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 633 {
 634         struct xt_tgdtor_param par;
 635         struct ebt_entry_target *t;
 636
 637         if (e->bitmask == 0)
 638                 return 0;
 639         /* we're done */
 640         if (cnt && (*cnt)-- == 0)
 641                 return 1;
 642         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 643         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 644         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 645
 646         par.net      = net;
 647         par.target   = t->u.target;
 648         par.targinfo = t->data;
 649         par.family   = NFPROTO_BRIDGE;
 650         if (par.target->destroy != NULL)
 651                 par.target->destroy(&par);
 652         module_put(par.target->me);
 653         return 0;
 654 }
 655
 656 static inline int
 657 ebt_check_entry(struct ebt_entry *e, struct net *net,
 658    const struct ebt_table_info *newinfo,
 659    const char *name, unsigned int *cnt,
 660    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 661 {
 662         struct ebt_entry_target *t;
 663         struct xt_target *target;
 664         unsigned int i, j, hook = 0, hookmask = 0;
 665         size_t gap;
 666         int ret;
 667         struct xt_mtchk_param mtpar;
 668         struct xt_tgchk_param tgpar;
 669
 670         /* don't mess with the struct ebt_entries */
 671         if (e->bitmask == 0)
 672                 return 0;
 673
 674         if (e->bitmask & ~EBT_F_MASK) {
 675                 BUGPRINT("Unknown flag for bitmask\n");
 676                 return -EINVAL;
 677         }
 678         if (e->invflags & ~EBT_INV_MASK) {
 679                 BUGPRINT("Unknown flag for inv bitmask\n");
 680                 return -EINVAL;
 681         }
 682         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 683                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 684                 return -EINVAL;
 685         }
 686         /* what hook do we belong to? */
 687         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 688                 if (!newinfo->hook_entry[i])
 689                         continue;
 690                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 691                         hook = i;
 692                 else
 693                         break;
 694         }
 695         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 696            a base chain */
 697         if (i < NF_BR_NUMHOOKS)
 698                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 699         else {
 700                 for (i = 0; i < udc_cnt; i++)
 701                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 702                                 break;
 703                 if (i == 0)
 704                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 705                 else
 706                         hookmask = cl_s[i - 1].hookmask;
 707         }
 708         i = 0;
 709
 710         memset(&mtpar, 0, sizeof(mtpar));
 711         memset(&tgpar, 0, sizeof(tgpar));
 712         mtpar.net       = tgpar.net       = net;
 713         mtpar.table     = tgpar.table     = name;
 714         mtpar.entryinfo = tgpar.entryinfo = e;
 715         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 716         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 717         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 718         if (ret != 0)
 719                 goto cleanup_matches;
 720         j = 0;
 721         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 722         if (ret != 0)
 723                 goto cleanup_watchers;
 724         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 725         gap = e->next_offset - e->target_offset;
 726
 727         target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
 728         if (IS_ERR(target)) {
 729                 ret = PTR_ERR(target);
 730                 goto cleanup_watchers;
 731         }
 732
 733         /* Reject UNSPEC, xtables verdicts/return values are incompatible */
 734         if (target->family != NFPROTO_BRIDGE) {
 735                 module_put(target->me);
 736                 ret = -ENOENT;
 737                 goto cleanup_watchers;
 738         }
 739
 740         t->u.target = target;
 741         if (t->u.target == &ebt_standard_target) {
 742                 if (gap < sizeof(struct ebt_standard_target)) {
 743                         BUGPRINT("Standard target size too big\n");
 744                         ret = -EFAULT;
 745                         goto cleanup_watchers;
 746                 }
 747                 if (((struct ebt_standard_target *)t)->verdict <
 748                    -NUM_STANDARD_TARGETS) {
 749                         BUGPRINT("Invalid standard target\n");
 750                         ret = -EFAULT;
 751                         goto cleanup_watchers;
 752                 }
 753         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 754                 module_put(t->u.target->me);
 755                 ret = -EFAULT;
 756                 goto cleanup_watchers;
 757         }
 758
 759         tgpar.target   = target;
 760         tgpar.targinfo = t->data;
 761         ret = xt_check_target(&tgpar, t->target_size,
 762               e->ethproto, e->invflags & EBT_IPROTO);
 763         if (ret < 0) {
 764                 module_put(target->me);
 765                 goto cleanup_watchers;
 766         }
 767         (*cnt)++;
 768         return 0;
 769 cleanup_watchers:
 770         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 771 cleanup_matches:
 772         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 773         return ret;
 774 }
 775
 776 /*
 777  * checks for loops and sets the hook mask for udc
 778  * the hook mask for udc tells us from which base chains the udc can be
 779  * accessed. This mask is a parameter to the check() functions of the extensions
 780  */
 781 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 782    unsigned int udc_cnt, unsigned int hooknr, char *base)
 783 {
 784         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 785         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 786         const struct ebt_entry_target *t;
 787
 788         while (pos < nentries || chain_nr != -1) {
 789                 /* end of udc, go back one 'recursion' step */
 790                 if (pos == nentries) {
 791                         /* put back values of the time when this chain was called */
 792                         e = cl_s[chain_nr].cs.e;
 793                         if (cl_s[chain_nr].from != -1)
 794                                 nentries =
 795                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 796                         else
 797                                 nentries = chain->nentries;
 798                         pos = cl_s[chain_nr].cs.n;
 799                         /* make sure we won't see a loop that isn't one */
 800                         cl_s[chain_nr].cs.n = 0;
 801                         chain_nr = cl_s[chain_nr].from;
 802                         if (pos == nentries)
 803                                 continue;
 804                 }
 805                 t = (struct ebt_entry_target *)
 806                    (((char *)e) + e->target_offset);
 807                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 808                         goto letscontinue;
 809                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 810                    e->next_offset) {
 811                         BUGPRINT("Standard target size too big\n");
 812                         return -1;
 813                 }
 814                 verdict = ((struct ebt_standard_target *)t)->verdict;
 815                 if (verdict >= 0) { /* jump to another chain */
 816                         struct ebt_entries *hlp2 =
 817                            (struct ebt_entries *)(base + verdict);
 818                         for (i = 0; i < udc_cnt; i++)
 819                                 if (hlp2 == cl_s[i].cs.chaininfo)
 820                                         break;
 821                         /* bad destination or loop */
 822                         if (i == udc_cnt) {
 823                                 BUGPRINT("bad destination\n");
 824                                 return -1;
 825                         }
 826                         if (cl_s[i].cs.n) {
 827                                 BUGPRINT("loop\n");
 828                                 return -1;
 829                         }
 830                         if (cl_s[i].hookmask & (1 << hooknr))
 831                                 goto letscontinue;
 832                         /* this can't be 0, so the loop test is correct */
 833                         cl_s[i].cs.n = pos + 1;
 834                         pos = 0;
 835                         cl_s[i].cs.e = ebt_next_entry(e);
 836                         e = (struct ebt_entry *)(hlp2->data);
 837                         nentries = hlp2->nentries;
 838                         cl_s[i].from = chain_nr;
 839                         chain_nr = i;
 840                         /* this udc is accessible from the base chain for hooknr */
 841                         cl_s[i].hookmask |= (1 << hooknr);
 842                         continue;
 843                 }
 844 letscontinue:
 845                 e = ebt_next_entry(e);
 846                 pos++;
 847         }
 848         return 0;
 849 }
 850
 851 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 852 static int translate_table(struct net *net, const char *name,
 853                            struct ebt_table_info *newinfo)
 854 {
 855         unsigned int i, j, k, udc_cnt;
 856         int ret;
 857         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 858
 859         i = 0;
 860         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 861                 i++;
 862         if (i == NF_BR_NUMHOOKS) {
 863                 BUGPRINT("No valid hooks specified\n");
 864                 return -EINVAL;
 865         }
 866         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 867                 BUGPRINT("Chains don't start at beginning\n");
 868                 return -EINVAL;
 869         }
 870         /* make sure chains are ordered after each other in same order
 871            as their corresponding hooks */
 872         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 873                 if (!newinfo->hook_entry[j])
 874                         continue;
 875                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 876                         BUGPRINT("Hook order must be followed\n");
 877                         return -EINVAL;
 878                 }
 879                 i = j;
 880         }
 881
 882         /* do some early checkings and initialize some things */
 883         i = 0; /* holds the expected nr. of entries for the chain */
 884         j = 0; /* holds the up to now counted entries for the chain */
 885         k = 0; /* holds the total nr. of entries, should equal
 886                   newinfo->nentries afterwards */
 887         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 888         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 889            ebt_check_entry_size_and_hooks, newinfo,
 890            &i, &j, &k, &udc_cnt);
 891
 892         if (ret != 0)
 893                 return ret;
 894
 895         if (i != j) {
 896                 BUGPRINT("nentries does not equal the nr of entries in the "
 897                          "(last) chain\n");
 898                 return -EINVAL;
 899         }
 900         if (k != newinfo->nentries) {
 901                 BUGPRINT("Total nentries is wrong\n");
 902                 return -EINVAL;
 903         }
 904
 905         /* get the location of the udc, put them in an array
 906            while we're at it, allocate the chainstack */
 907         if (udc_cnt) {
 908                 /* this will get free'd in do_replace()/ebt_register_table()
 909                    if an error occurs */
 910                 newinfo->chainstack =
 911                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 912                 if (!newinfo->chainstack)
 913                         return -ENOMEM;
 914                 for_each_possible_cpu(i) {
 915                         newinfo->chainstack[i] =
 916                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 917                         if (!newinfo->chainstack[i]) {
 918                                 while (i)
 919                                         vfree(newinfo->chainstack[--i]);
 920                                 vfree(newinfo->chainstack);
 921                                 newinfo->chainstack = NULL;
 922                                 return -ENOMEM;
 923                         }
 924                 }
 925
 926                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 927                 if (!cl_s)
 928                         return -ENOMEM;
 929                 i = 0; /* the i'th udc */
 930                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 931                    ebt_get_udc_positions, newinfo, &i, cl_s);
 932                 /* sanity check */
 933                 if (i != udc_cnt) {
 934                         BUGPRINT("i != udc_cnt\n");
 935                         vfree(cl_s);
 936                         return -EFAULT;
 937                 }
 938         }
 939
 940         /* Check for loops */
 941         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 942                 if (newinfo->hook_entry[i])
 943                         if (check_chainloops(newinfo->hook_entry[i],
 944                            cl_s, udc_cnt, i, newinfo->entries)) {
 945                                 vfree(cl_s);
 946                                 return -EINVAL;
 947                         }
 948
 949         /* we now know the following (along with E=mc²):
 950            - the nr of entries in each chain is right
 951            - the size of the allocated space is right
 952            - all valid hooks have a corresponding chain
 953            - there are no loops
 954            - wrong data can still be on the level of a single entry
 955            - could be there are jumps to places that are not the
 956              beginning of a chain. This can only occur in chains that
 957              are not accessible from any base chains, so we don't care. */
 958
 959         /* used to know what we need to clean up if something goes wrong */
 960         i = 0;
 961         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 962            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 963         if (ret != 0) {
 964                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 965                                   ebt_cleanup_entry, net, &i);
 966         }
 967         vfree(cl_s);
 968         return ret;
 969 }
 970
 971 /* called under write_lock */
 972 static void get_counters(const struct ebt_counter *oldcounters,
 973    struct ebt_counter *counters, unsigned int nentries)
 974 {
 975         int i, cpu;
 976         struct ebt_counter *counter_base;
 977
 978         /* counters of cpu 0 */
 979         memcpy(counters, oldcounters,
 980                sizeof(struct ebt_counter) * nentries);
 981
 982         /* add other counters to those of cpu 0 */
 983         for_each_possible_cpu(cpu) {
 984                 if (cpu == 0)
 985                         continue;
 986                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 987                 for (i = 0; i < nentries; i++) {
 988                         counters[i].pcnt += counter_base[i].pcnt;
 989                         counters[i].bcnt += counter_base[i].bcnt;
 990                 }
 991         }
 992 }
 993
 994 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 995                               struct ebt_table_info *newinfo)
 996 {
 997         int ret, i;
 998         struct ebt_counter *counterstmp = NULL;
 999         /* used to be able to unlock earlier */
1000         struct ebt_table_info *table;
1001         struct ebt_table *t;
1002
1003         /* the user wants counters back
1004            the check on the size is done later, when we have the lock */
1005         if (repl->num_counters) {
1006                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
1007                 counterstmp = vmalloc(size);
1008                 if (!counterstmp)
1009                         return -ENOMEM;
1010         }
1011
1012         newinfo->chainstack = NULL;
1013         ret = ebt_verify_pointers(repl, newinfo);
1014         if (ret != 0)
1015                 goto free_counterstmp;
1016
1017         ret = translate_table(net, repl->name, newinfo);
1018
1019         if (ret != 0)
1020                 goto free_counterstmp;
1021
1022         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1023         if (!t) {
1024                 ret = -ENOENT;
1025                 goto free_iterate;
1026         }
1027
1028         /* the table doesn't like it */
1029         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1030                 goto free_unlock;
1031
1032         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1033                 BUGPRINT("Wrong nr. of counters requested\n");
1034                 ret = -EINVAL;
1035                 goto free_unlock;
1036         }
1037
1038         /* we have the mutex lock, so no danger in reading this pointer */
1039         table = t->private;
1040         /* make sure the table can only be rmmod'ed if it contains no rules */
1041         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1042                 ret = -ENOENT;
1043                 goto free_unlock;
1044         } else if (table->nentries && !newinfo->nentries)
1045                 module_put(t->me);
1046         /* we need an atomic snapshot of the counters */
1047         write_lock_bh(&t->lock);
1048         if (repl->num_counters)
1049                 get_counters(t->private->counters, counterstmp,
1050                    t->private->nentries);
1051
1052         t->private = newinfo;
1053         write_unlock_bh(&t->lock);
1054         mutex_unlock(&ebt_mutex);
1055         /* so, a user can change the chains while having messed up her counter
1056            allocation. Only reason why this is done is because this way the lock
1057            is held only once, while this doesn't bring the kernel into a
1058            dangerous state. */
1059         if (repl->num_counters &&
1060            copy_to_user(repl->counters, counterstmp,
1061            repl->num_counters * sizeof(struct ebt_counter))) {
1062                 /* Silent error, can't fail, new table is already in place */
1063                 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
1064         }
1065
1066         /* decrease module count and free resources */
1067         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1068                           ebt_cleanup_entry, net, NULL);
1069
1070         vfree(table->entries);
1071         if (table->chainstack) {
1072                 for_each_possible_cpu(i)
1073                         vfree(table->chainstack[i]);
1074                 vfree(table->chainstack);
1075         }
1076         vfree(table);
1077
1078         vfree(counterstmp);
1079
1080 #ifdef CONFIG_AUDIT
1081         if (audit_enabled) {
1082                 struct audit_buffer *ab;
1083
1084                 ab = audit_log_start(current->audit_context, GFP_KERNEL,
1085                                      AUDIT_NETFILTER_CFG);
1086                 if (ab) {
1087                         audit_log_format(ab, "table=%s family=%u entries=%u",
1088                                          repl->name, AF_BRIDGE, repl->nentries);
1089                         audit_log_end(ab);
1090                 }
1091         }
1092 #endif
1093         return ret;
1094
1095 free_unlock:
1096         mutex_unlock(&ebt_mutex);
1097 free_iterate:
1098         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1099                           ebt_cleanup_entry, net, NULL);
1100 free_counterstmp:
1101         vfree(counterstmp);
1102         /* can be initialized in translate_table() */
1103         if (newinfo->chainstack) {
1104                 for_each_possible_cpu(i)
1105                         vfree(newinfo->chainstack[i]);
1106                 vfree(newinfo->chainstack);
1107         }
1108         return ret;
1109 }
1110
1111 /* replace the table */
1112 static int do_replace(struct net *net, const void __user *user,
1113                       unsigned int len)
1114 {
1115         int ret, countersize;
1116         struct ebt_table_info *newinfo;
1117         struct ebt_replace tmp;
1118
1119         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1120                 return -EFAULT;
1121
1122         if (len != sizeof(tmp) + tmp.entries_size) {
1123                 BUGPRINT("Wrong len argument\n");
1124                 return -EINVAL;
1125         }
1126
1127         if (tmp.entries_size == 0) {
1128                 BUGPRINT("Entries_size never zero\n");
1129                 return -EINVAL;
1130         }
1131         /* overflow check */
1132         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1133                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1134                 return -ENOMEM;
1135         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1136                 return -ENOMEM;
1137
1138         tmp.name[sizeof(tmp.name) - 1] = 0;
1139
1140         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1141         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1142         if (!newinfo)
1143                 return -ENOMEM;
1144
1145         if (countersize)
1146                 memset(newinfo->counters, 0, countersize);
1147
1148         newinfo->entries = vmalloc(tmp.entries_size);
1149         if (!newinfo->entries) {
1150                 ret = -ENOMEM;
1151                 goto free_newinfo;
1152         }
1153         if (copy_from_user(
1154            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1155                 BUGPRINT("Couldn't copy entries from userspace\n");
1156                 ret = -EFAULT;
1157                 goto free_entries;
1158         }
1159
1160         ret = do_replace_finish(net, &tmp, newinfo);
1161         if (ret == 0)
1162                 return ret;
1163 free_entries:
1164         vfree(newinfo->entries);
1165 free_newinfo:
1166         vfree(newinfo);
1167         return ret;
1168 }
1169
1170 struct ebt_table *
1171 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1172 {
1173         struct ebt_table_info *newinfo;
1174         struct ebt_table *t, *table;
1175         struct ebt_replace_kernel *repl;
1176         int ret, i, countersize;
1177         void *p;
1178
1179         if (input_table == NULL || (repl = input_table->table) == NULL ||
1180             repl->entries == NULL || repl->entries_size == 0 ||
1181             repl->counters != NULL || input_table->private != NULL) {
1182                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1183                 return ERR_PTR(-EINVAL);
1184         }
1185
1186         /* Don't add one table to multiple lists. */
1187         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1188         if (!table) {
1189                 ret = -ENOMEM;
1190                 goto out;
1191         }
1192
1193         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1194         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1195         ret = -ENOMEM;
1196         if (!newinfo)
1197                 goto free_table;
1198
1199         p = vmalloc(repl->entries_size);
1200         if (!p)
1201                 goto free_newinfo;
1202
1203         memcpy(p, repl->entries, repl->entries_size);
1204         newinfo->entries = p;
1205
1206         newinfo->entries_size = repl->entries_size;
1207         newinfo->nentries = repl->nentries;
1208
1209         if (countersize)
1210                 memset(newinfo->counters, 0, countersize);
1211
1212         /* fill in newinfo and parse the entries */
1213         newinfo->chainstack = NULL;
1214         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1215                 if ((repl->valid_hooks & (1 << i)) == 0)
1216                         newinfo->hook_entry[i] = NULL;
1217                 else
1218                         newinfo->hook_entry[i] = p +
1219                                 ((char *)repl->hook_entry[i] - repl->entries);
1220         }
1221         ret = translate_table(net, repl->name, newinfo);
1222         if (ret != 0) {
1223                 BUGPRINT("Translate_table failed\n");
1224                 goto free_chainstack;
1225         }
1226
1227         if (table->check && table->check(newinfo, table->valid_hooks)) {
1228                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1229                 ret = -EINVAL;
1230                 goto free_chainstack;
1231         }
1232
1233         table->private = newinfo;
1234         rwlock_init(&table->lock);
1235         mutex_lock(&ebt_mutex);
1236         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1237                 if (strcmp(t->name, table->name) == 0) {
1238                         ret = -EEXIST;
1239                         BUGPRINT("Table name already exists\n");
1240                         goto free_unlock;
1241                 }
1242         }
1243
1244         /* Hold a reference count if the chains aren't empty */
1245         if (newinfo->nentries && !try_module_get(table->me)) {
1246                 ret = -ENOENT;
1247                 goto free_unlock;
1248         }
1249         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1250         mutex_unlock(&ebt_mutex);
1251         return table;
1252 free_unlock:
1253         mutex_unlock(&ebt_mutex);
1254 free_chainstack:
1255         if (newinfo->chainstack) {
1256                 for_each_possible_cpu(i)
1257                         vfree(newinfo->chainstack[i]);
1258                 vfree(newinfo->chainstack);
1259         }
1260         vfree(newinfo->entries);
1261 free_newinfo:
1262         vfree(newinfo);
1263 free_table:
1264         kfree(table);
1265 out:
1266         return ERR_PTR(ret);
1267 }
1268
1269 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1270 {
1271         int i;
1272
1273         if (!table) {
1274                 BUGPRINT("Request to unregister NULL table!!!\n");
1275                 return;
1276         }
1277         mutex_lock(&ebt_mutex);
1278         list_del(&table->list);
1279         mutex_unlock(&ebt_mutex);
1280         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1281                           ebt_cleanup_entry, net, NULL);
1282         if (table->private->nentries)
1283                 module_put(table->me);
1284         vfree(table->private->entries);
1285         if (table->private->chainstack) {
1286                 for_each_possible_cpu(i)
1287                         vfree(table->private->chainstack[i]);
1288                 vfree(table->private->chainstack);
1289         }
1290         vfree(table->private);
1291         kfree(table);
1292 }
1293
1294 /* userspace just supplied us with counters */
1295 static int do_update_counters(struct net *net, const char *name,
1296                                 struct ebt_counter __user *counters,
1297                                 unsigned int num_counters,
1298                                 const void __user *user, unsigned int len)
1299 {
1300         int i, ret;
1301         struct ebt_counter *tmp;
1302         struct ebt_table *t;
1303
1304         if (num_counters == 0)
1305                 return -EINVAL;
1306
1307         tmp = vmalloc(num_counters * sizeof(*tmp));
1308         if (!tmp)
1309                 return -ENOMEM;
1310
1311         t = find_table_lock(net, name, &ret, &ebt_mutex);
1312         if (!t)
1313                 goto free_tmp;
1314
1315         if (num_counters != t->private->nentries) {
1316                 BUGPRINT("Wrong nr of counters\n");
1317                 ret = -EINVAL;
1318                 goto unlock_mutex;
1319         }
1320
1321         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1322                 ret = -EFAULT;
1323                 goto unlock_mutex;
1324         }
1325
1326         /* we want an atomic add of the counters */
1327         write_lock_bh(&t->lock);
1328
1329         /* we add to the counters of the first cpu */
1330         for (i = 0; i < num_counters; i++) {
1331                 t->private->counters[i].pcnt += tmp[i].pcnt;
1332                 t->private->counters[i].bcnt += tmp[i].bcnt;
1333         }
1334
1335         write_unlock_bh(&t->lock);
1336         ret = 0;
1337 unlock_mutex:
1338         mutex_unlock(&ebt_mutex);
1339 free_tmp:
1340         vfree(tmp);
1341         return ret;
1342 }
1343
1344 static int update_counters(struct net *net, const void __user *user,
1345                             unsigned int len)
1346 {
1347         struct ebt_replace hlp;
1348
1349         if (copy_from_user(&hlp, user, sizeof(hlp)))
1350                 return -EFAULT;
1351
1352         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1353                 return -EINVAL;
1354
1355         return do_update_counters(net, hlp.name, hlp.counters,
1356                                 hlp.num_counters, user, len);
1357 }
1358
1359 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1360     const char *base, char __user *ubase)
1361 {
1362         char __user *hlp = ubase + ((char *)m - base);
1363         char name[EBT_FUNCTION_MAXNAMELEN] = {};
1364
1365         /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
1366            long. Copy 29 bytes and fill remaining bytes with zeroes. */
1367         strlcpy(name, m->u.match->name, sizeof(name));
1368         if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1369                 return -EFAULT;
1370         return 0;
1371 }
1372
1373 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1374     const char *base, char __user *ubase)
1375 {
1376         char __user *hlp = ubase + ((char *)w - base);
1377         char name[EBT_FUNCTION_MAXNAMELEN] = {};
1378
1379         strlcpy(name, w->u.watcher->name, sizeof(name));
1380         if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
1381                 return -EFAULT;
1382         return 0;
1383 }
1384
1385 static inline int
1386 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1387 {
1388         int ret;
1389         char __user *hlp;
1390         const struct ebt_entry_target *t;
1391         char name[EBT_FUNCTION_MAXNAMELEN] = {};
1392
1393         if (e->bitmask == 0)
1394                 return 0;
1395
1396         hlp = ubase + (((char *)e + e->target_offset) - base);
1397         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1398
1399         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1400         if (ret != 0)
1401                 return ret;
1402         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1403         if (ret != 0)
1404                 return ret;
1405         strlcpy(name, t->u.target->name, sizeof(name));
1406         if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1407                 return -EFAULT;
1408         return 0;
1409 }
1410
1411 static int copy_counters_to_user(struct ebt_table *t,
1412                                   const struct ebt_counter *oldcounters,
1413                                   void __user *user, unsigned int num_counters,
1414                                   unsigned int nentries)
1415 {
1416         struct ebt_counter *counterstmp;
1417         int ret = 0;
1418
1419         /* userspace might not need the counters */
1420         if (num_counters == 0)
1421                 return 0;
1422
1423         if (num_counters != nentries) {
1424                 BUGPRINT("Num_counters wrong\n");
1425                 return -EINVAL;
1426         }
1427
1428         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1429         if (!counterstmp)
1430                 return -ENOMEM;
1431
1432         write_lock_bh(&t->lock);
1433         get_counters(oldcounters, counterstmp, nentries);
1434         write_unlock_bh(&t->lock);
1435
1436         if (copy_to_user(user, counterstmp,
1437            nentries * sizeof(struct ebt_counter)))
1438                 ret = -EFAULT;
1439         vfree(counterstmp);
1440         return ret;
1441 }
1442
1443 /* called with ebt_mutex locked */
1444 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1445     const int *len, int cmd)
1446 {
1447         struct ebt_replace tmp;
1448         const struct ebt_counter *oldcounters;
1449         unsigned int entries_size, nentries;
1450         int ret;
1451         char *entries;
1452
1453         if (cmd == EBT_SO_GET_ENTRIES) {
1454                 entries_size = t->private->entries_size;
1455                 nentries = t->private->nentries;
1456                 entries = t->private->entries;
1457                 oldcounters = t->private->counters;
1458         } else {
1459                 entries_size = t->table->entries_size;
1460                 nentries = t->table->nentries;
1461                 entries = t->table->entries;
1462                 oldcounters = t->table->counters;
1463         }
1464
1465         if (copy_from_user(&tmp, user, sizeof(tmp)))
1466                 return -EFAULT;
1467
1468         if (*len != sizeof(struct ebt_replace) + entries_size +
1469            (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
1470                 return -EINVAL;
1471
1472         if (tmp.nentries != nentries) {
1473                 BUGPRINT("Nentries wrong\n");
1474                 return -EINVAL;
1475         }
1476
1477         if (tmp.entries_size != entries_size) {
1478                 BUGPRINT("Wrong size\n");
1479                 return -EINVAL;
1480         }
1481
1482         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1483                                         tmp.num_counters, nentries);
1484         if (ret)
1485                 return ret;
1486
1487         if (copy_to_user(tmp.entries, entries, entries_size)) {
1488                 BUGPRINT("Couldn't copy entries to userspace\n");
1489                 return -EFAULT;
1490         }
1491         /* set the match/watcher/target names right */
1492         return EBT_ENTRY_ITERATE(entries, entries_size,
1493            ebt_make_names, entries, tmp.entries);
1494 }
1495
1496 static int do_ebt_set_ctl(struct sock *sk,
1497         int cmd, void __user *user, unsigned int len)
1498 {
1499         int ret;
1500         struct net *net = sock_net(sk);
1501
1502         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1503                 return -EPERM;
1504
1505         switch (cmd) {
1506         case EBT_SO_SET_ENTRIES:
1507                 ret = do_replace(net, user, len);
1508                 break;
1509         case EBT_SO_SET_COUNTERS:
1510                 ret = update_counters(net, user, len);
1511                 break;
1512         default:
1513                 ret = -EINVAL;
1514         }
1515         return ret;
1516 }
1517
1518 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1519 {
1520         int ret;
1521         struct ebt_replace tmp;
1522         struct ebt_table *t;
1523         struct net *net = sock_net(sk);
1524
1525         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1526                 return -EPERM;
1527
1528         if (copy_from_user(&tmp, user, sizeof(tmp)))
1529                 return -EFAULT;
1530
1531         tmp.name[sizeof(tmp.name) - 1] = '\0';
1532
1533         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1534         if (!t)
1535                 return ret;
1536
1537         switch (cmd) {
1538         case EBT_SO_GET_INFO:
1539         case EBT_SO_GET_INIT_INFO:
1540                 if (*len != sizeof(struct ebt_replace)) {
1541                         ret = -EINVAL;
1542                         mutex_unlock(&ebt_mutex);
1543                         break;
1544                 }
1545                 if (cmd == EBT_SO_GET_INFO) {
1546                         tmp.nentries = t->private->nentries;
1547                         tmp.entries_size = t->private->entries_size;
1548                         tmp.valid_hooks = t->valid_hooks;
1549                 } else {
1550                         tmp.nentries = t->table->nentries;
1551                         tmp.entries_size = t->table->entries_size;
1552                         tmp.valid_hooks = t->table->valid_hooks;
1553                 }
1554                 mutex_unlock(&ebt_mutex);
1555                 if (copy_to_user(user, &tmp, *len) != 0) {
1556                         BUGPRINT("c2u Didn't work\n");
1557                         ret = -EFAULT;
1558                         break;
1559                 }
1560                 ret = 0;
1561                 break;
1562
1563         case EBT_SO_GET_ENTRIES:
1564         case EBT_SO_GET_INIT_ENTRIES:
1565                 ret = copy_everything_to_user(t, user, len, cmd);
1566                 mutex_unlock(&ebt_mutex);
1567                 break;
1568
1569         default:
1570                 mutex_unlock(&ebt_mutex);
1571                 ret = -EINVAL;
1572         }
1573
1574         return ret;
1575 }
1576
1577 #ifdef CONFIG_COMPAT
1578 /* 32 bit-userspace compatibility definitions. */
1579 struct compat_ebt_replace {
1580         char name[EBT_TABLE_MAXNAMELEN];
1581         compat_uint_t valid_hooks;
1582         compat_uint_t nentries;
1583         compat_uint_t entries_size;
1584         /* start of the chains */
1585         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1586         /* nr of counters userspace expects back */
1587         compat_uint_t num_counters;
1588         /* where the kernel will put the old counters. */
1589         compat_uptr_t counters;
1590         compat_uptr_t entries;
1591 };
1592
1593 /* struct ebt_entry_match, _target and _watcher have same layout */
1594 struct compat_ebt_entry_mwt {
1595         union {
1596                 char name[EBT_FUNCTION_MAXNAMELEN];
1597                 compat_uptr_t ptr;
1598         } u;
1599         compat_uint_t match_size;
1600         compat_uint_t data[0];
1601 };
1602
1603 /* account for possible padding between match_size and ->data */
1604 static int ebt_compat_entry_padsize(void)
1605 {
1606         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1607                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1608         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1609                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1610 }
1611
1612 static int ebt_compat_match_offset(const struct xt_match *match,
1613                                    unsigned int userlen)
1614 {
1615         /*
1616          * ebt_among needs special handling. The kernel .matchsize is
1617          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1618          * value is expected.
1619          * Example: userspace sends 4500, ebt_among.c wants 4504.
1620          */
1621         if (unlikely(match->matchsize == -1))
1622                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1623         return xt_compat_match_offset(match);
1624 }
1625
1626 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1627                                 unsigned int *size)
1628 {
1629         const struct xt_match *match = m->u.match;
1630         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1631         int off = ebt_compat_match_offset(match, m->match_size);
1632         compat_uint_t msize = m->match_size - off;
1633
1634         if (WARN_ON(off >= m->match_size))
1635                 return -EINVAL;
1636
1637         if (copy_to_user(cm->u.name, match->name,
1638             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1639                 return -EFAULT;
1640
1641         if (match->compat_to_user) {
1642                 if (match->compat_to_user(cm->data, m->data))
1643                         return -EFAULT;
1644         } else if (copy_to_user(cm->data, m->data, msize))
1645                         return -EFAULT;
1646
1647         *size -= ebt_compat_entry_padsize() + off;
1648         *dstptr = cm->data;
1649         *dstptr += msize;
1650         return 0;
1651 }
1652
1653 static int compat_target_to_user(struct ebt_entry_target *t,
1654                                  void __user **dstptr,
1655                                  unsigned int *size)
1656 {
1657         const struct xt_target *target = t->u.target;
1658         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1659         int off = xt_compat_target_offset(target);
1660         compat_uint_t tsize = t->target_size - off;
1661
1662         if (WARN_ON(off >= t->target_size))
1663                 return -EINVAL;
1664
1665         if (copy_to_user(cm->u.name, target->name,
1666             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1667                 return -EFAULT;
1668
1669         if (target->compat_to_user) {
1670                 if (target->compat_to_user(cm->data, t->data))
1671                         return -EFAULT;
1672         } else if (copy_to_user(cm->data, t->data, tsize))
1673                 return -EFAULT;
1674
1675         *size -= ebt_compat_entry_padsize() + off;
1676         *dstptr = cm->data;
1677         *dstptr += tsize;
1678         return 0;
1679 }
1680
1681 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1682                                   void __user **dstptr,
1683                                   unsigned int *size)
1684 {
1685         return compat_target_to_user((struct ebt_entry_target *)w,
1686                                                         dstptr, size);
1687 }
1688
1689 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1690                                 unsigned int *size)
1691 {
1692         struct ebt_entry_target *t;
1693         struct ebt_entry __user *ce;
1694         u32 watchers_offset, target_offset, next_offset;
1695         compat_uint_t origsize;
1696         int ret;
1697
1698         if (e->bitmask == 0) {
1699                 if (*size < sizeof(struct ebt_entries))
1700                         return -EINVAL;
1701                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1702                         return -EFAULT;
1703
1704                 *dstptr += sizeof(struct ebt_entries);
1705                 *size -= sizeof(struct ebt_entries);
1706                 return 0;
1707         }
1708
1709         if (*size < sizeof(*ce))
1710                 return -EINVAL;
1711
1712         ce = (struct ebt_entry __user *)*dstptr;
1713         if (copy_to_user(ce, e, sizeof(*ce)))
1714                 return -EFAULT;
1715
1716         origsize = *size;
1717         *dstptr += sizeof(*ce);
1718
1719         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1720         if (ret)
1721                 return ret;
1722         watchers_offset = e->watchers_offset - (origsize - *size);
1723
1724         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1725         if (ret)
1726                 return ret;
1727         target_offset = e->target_offset - (origsize - *size);
1728
1729         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1730
1731         ret = compat_target_to_user(t, dstptr, size);
1732         if (ret)
1733                 return ret;
1734         next_offset = e->next_offset - (origsize - *size);
1735
1736         if (put_user(watchers_offset, &ce->watchers_offset) ||
1737             put_user(target_offset, &ce->target_offset) ||
1738             put_user(next_offset, &ce->next_offset))
1739                 return -EFAULT;
1740
1741         *size -= sizeof(*ce);
1742         return 0;
1743 }
1744
1745 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1746 {
1747         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1748         *off += ebt_compat_entry_padsize();
1749         return 0;
1750 }
1751
1752 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1753 {
1754         *off += xt_compat_target_offset(w->u.watcher);
1755         *off += ebt_compat_entry_padsize();
1756         return 0;
1757 }
1758
1759 static int compat_calc_entry(const struct ebt_entry *e,
1760                              const struct ebt_table_info *info,
1761                              const void *base,
1762                              struct compat_ebt_replace *newinfo)
1763 {
1764         const struct ebt_entry_target *t;
1765         unsigned int entry_offset;
1766         int off, ret, i;
1767
1768         if (e->bitmask == 0)
1769                 return 0;
1770
1771         off = 0;
1772         entry_offset = (void *)e - base;
1773
1774         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1775         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1776
1777         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1778
1779         off += xt_compat_target_offset(t->u.target);
1780         off += ebt_compat_entry_padsize();
1781
1782         newinfo->entries_size -= off;
1783
1784         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1785         if (ret)
1786                 return ret;
1787
1788         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1789                 const void *hookptr = info->hook_entry[i];
1790                 if (info->hook_entry[i] &&
1791                     (e < (struct ebt_entry *)(base - hookptr))) {
1792                         newinfo->hook_entry[i] -= off;
1793                         pr_debug("0x%08X -> 0x%08X\n",
1794                                         newinfo->hook_entry[i] + off,
1795                                         newinfo->hook_entry[i]);
1796                 }
1797         }
1798
1799         return 0;
1800 }
1801
1802
1803 static int compat_table_info(const struct ebt_table_info *info,
1804                              struct compat_ebt_replace *newinfo)
1805 {
1806         unsigned int size = info->entries_size;
1807         const void *entries = info->entries;
1808
1809         newinfo->entries_size = size;
1810
1811         xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
1812         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1813                                                         entries, newinfo);
1814 }
1815
1816 static int compat_copy_everything_to_user(struct ebt_table *t,
1817                                           void __user *user, int *len, int cmd)
1818 {
1819         struct compat_ebt_replace repl, tmp;
1820         struct ebt_counter *oldcounters;
1821         struct ebt_table_info tinfo;
1822         int ret;
1823         void __user *pos;
1824
1825         memset(&tinfo, 0, sizeof(tinfo));
1826
1827         if (cmd == EBT_SO_GET_ENTRIES) {
1828                 tinfo.entries_size = t->private->entries_size;
1829                 tinfo.nentries = t->private->nentries;
1830                 tinfo.entries = t->private->entries;
1831                 oldcounters = t->private->counters;
1832         } else {
1833                 tinfo.entries_size = t->table->entries_size;
1834                 tinfo.nentries = t->table->nentries;
1835                 tinfo.entries = t->table->entries;
1836                 oldcounters = t->table->counters;
1837         }
1838
1839         if (copy_from_user(&tmp, user, sizeof(tmp)))
1840                 return -EFAULT;
1841
1842         if (tmp.nentries != tinfo.nentries ||
1843            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1844                 return -EINVAL;
1845
1846         memcpy(&repl, &tmp, sizeof(repl));
1847         if (cmd == EBT_SO_GET_ENTRIES)
1848                 ret = compat_table_info(t->private, &repl);
1849         else
1850                 ret = compat_table_info(&tinfo, &repl);
1851         if (ret)
1852                 return ret;
1853
1854         if (*len != sizeof(tmp) + repl.entries_size +
1855            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1856                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1857                                 *len, tinfo.entries_size, repl.entries_size);
1858                 return -EINVAL;
1859         }
1860
1861         /* userspace might not need the counters */
1862         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1863                                         tmp.num_counters, tinfo.nentries);
1864         if (ret)
1865                 return ret;
1866
1867         pos = compat_ptr(tmp.entries);
1868         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1869                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1870 }
1871
1872 struct ebt_entries_buf_state {
1873         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1874         u32 buf_kern_len;       /* total size of kernel buffer */
1875         u32 buf_kern_offset;    /* amount of data copied so far */
1876         u32 buf_user_offset;    /* read position in userspace buffer */
1877 };
1878
1879 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1880 {
1881         state->buf_kern_offset += sz;
1882         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1883 }
1884
1885 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1886                        const void *data, unsigned int sz)
1887 {
1888         if (state->buf_kern_start == NULL)
1889                 goto count_only;
1890
1891         if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len))
1892                 return -EINVAL;
1893
1894         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1895
1896  count_only:
1897         state->buf_user_offset += sz;
1898         return ebt_buf_count(state, sz);
1899 }
1900
1901 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1902 {
1903         char *b = state->buf_kern_start;
1904
1905         if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len))
1906                 return -EINVAL;
1907
1908         if (b != NULL && sz > 0)
1909                 memset(b + state->buf_kern_offset, 0, sz);
1910         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1911         return ebt_buf_count(state, sz);
1912 }
1913
1914 enum compat_mwt {
1915         EBT_COMPAT_MATCH,
1916         EBT_COMPAT_WATCHER,
1917         EBT_COMPAT_TARGET,
1918 };
1919
1920 static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,
1921                                 enum compat_mwt compat_mwt,
1922                                 struct ebt_entries_buf_state *state,
1923                                 const unsigned char *base)
1924 {
1925         char name[EBT_FUNCTION_MAXNAMELEN];
1926         struct xt_match *match;
1927         struct xt_target *wt;
1928         void *dst = NULL;
1929         int off, pad = 0;
1930         unsigned int size_kern, match_size = mwt->match_size;
1931
1932         if (strscpy(name, mwt->u.name, sizeof(name)) < 0)
1933                 return -EINVAL;
1934
1935         if (state->buf_kern_start)
1936                 dst = state->buf_kern_start + state->buf_kern_offset;
1937
1938         switch (compat_mwt) {
1939         case EBT_COMPAT_MATCH:
1940                 match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
1941                 if (IS_ERR(match))
1942                         return PTR_ERR(match);
1943
1944                 off = ebt_compat_match_offset(match, match_size);
1945                 if (dst) {
1946                         if (match->compat_from_user)
1947                                 match->compat_from_user(dst, mwt->data);
1948                         else
1949                                 memcpy(dst, mwt->data, match_size);
1950                 }
1951
1952                 size_kern = match->matchsize;
1953                 if (unlikely(size_kern == -1))
1954                         size_kern = match_size;
1955                 module_put(match->me);
1956                 break;
1957         case EBT_COMPAT_WATCHER: /* fallthrough */
1958         case EBT_COMPAT_TARGET:
1959                 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
1960                 if (IS_ERR(wt))
1961                         return PTR_ERR(wt);
1962                 off = xt_compat_target_offset(wt);
1963
1964                 if (dst) {
1965                         if (wt->compat_from_user)
1966                                 wt->compat_from_user(dst, mwt->data);
1967                         else
1968                                 memcpy(dst, mwt->data, match_size);
1969                 }
1970
1971                 size_kern = wt->targetsize;
1972                 module_put(wt->me);
1973                 break;
1974
1975         default:
1976                 return -EINVAL;
1977         }
1978
1979         state->buf_kern_offset += match_size + off;
1980         state->buf_user_offset += match_size;
1981         pad = XT_ALIGN(size_kern) - size_kern;
1982
1983         if (pad > 0 && dst) {
1984                 if (WARN_ON(state->buf_kern_len <= pad))
1985                         return -EINVAL;
1986                 if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad))
1987                         return -EINVAL;
1988                 memset(dst + size_kern, 0, pad);
1989         }
1990         return off + match_size;
1991 }
1992
1993 /*
1994  * return size of all matches, watchers or target, including necessary
1995  * alignment and padding.
1996  */
1997 static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32,
1998                         unsigned int size_left, enum compat_mwt type,
1999                         struct ebt_entries_buf_state *state, const void *base)
2000 {
2001         const char *buf = (const char *)match32;
2002         int growth = 0;
2003
2004         if (size_left == 0)
2005                 return 0;
2006
2007         do {
2008                 struct ebt_entry_match *match_kern;
2009                 int ret;
2010
2011                 if (size_left < sizeof(*match32))
2012                         return -EINVAL;
2013
2014                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
2015                 if (match_kern) {
2016                         char *tmp;
2017                         tmp = state->buf_kern_start + state->buf_kern_offset;
2018                         match_kern = (struct ebt_entry_match *) tmp;
2019                 }
2020                 ret = ebt_buf_add(state, buf, sizeof(*match32));
2021                 if (ret < 0)
2022                         return ret;
2023                 size_left -= sizeof(*match32);
2024
2025                 /* add padding before match->data (if any) */
2026                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
2027                 if (ret < 0)
2028                         return ret;
2029
2030                 if (match32->match_size > size_left)
2031                         return -EINVAL;
2032
2033                 size_left -= match32->match_size;
2034
2035                 ret = compat_mtw_from_user(match32, type, state, base);
2036                 if (ret < 0)
2037                         return ret;
2038
2039                 if (WARN_ON(ret < match32->match_size))
2040                         return -EINVAL;
2041                 growth += ret - match32->match_size;
2042                 growth += ebt_compat_entry_padsize();
2043
2044                 buf += sizeof(*match32);
2045                 buf += match32->match_size;
2046
2047                 if (match_kern)
2048                         match_kern->match_size = ret;
2049
2050                 match32 = (struct compat_ebt_entry_mwt *) buf;
2051         } while (size_left);
2052
2053         return growth;
2054 }
2055
2056 /* called for all ebt_entry structures. */
2057 static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base,
2058                           unsigned int *total,
2059                           struct ebt_entries_buf_state *state)
2060 {
2061         unsigned int i, j, startoff, next_expected_off, new_offset = 0;
2062         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2063         unsigned int offsets[4];
2064         unsigned int *offsets_update = NULL;
2065         int ret;
2066         char *buf_start;
2067
2068         if (*total < sizeof(struct ebt_entries))
2069                 return -EINVAL;
2070
2071         if (!entry->bitmask) {
2072                 *total -= sizeof(struct ebt_entries);
2073                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2074         }
2075         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2076                 return -EINVAL;
2077
2078         startoff = state->buf_user_offset;
2079         /* pull in most part of ebt_entry, it does not need to be changed. */
2080         ret = ebt_buf_add(state, entry,
2081                         offsetof(struct ebt_entry, watchers_offset));
2082         if (ret < 0)
2083                 return ret;
2084
2085         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2086         memcpy(&offsets[1], &entry->watchers_offset,
2087                         sizeof(offsets) - sizeof(offsets[0]));
2088
2089         if (state->buf_kern_start) {
2090                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2091                 offsets_update = (unsigned int *) buf_start;
2092         }
2093         ret = ebt_buf_add(state, &offsets[1],
2094                         sizeof(offsets) - sizeof(offsets[0]));
2095         if (ret < 0)
2096                 return ret;
2097         buf_start = (char *) entry;
2098         /*
2099          * 0: matches offset, always follows ebt_entry.
2100          * 1: watchers offset, from ebt_entry structure
2101          * 2: target offset, from ebt_entry structure
2102          * 3: next ebt_entry offset, from ebt_entry structure
2103          *
2104          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2105          */
2106         for (i = 0; i < 4 ; ++i) {
2107                 if (offsets[i] > *total)
2108                         return -EINVAL;
2109
2110                 if (i < 3 && offsets[i] == *total)
2111                         return -EINVAL;
2112
2113                 if (i == 0)
2114                         continue;
2115                 if (offsets[i-1] > offsets[i])
2116                         return -EINVAL;
2117         }
2118
2119         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2120                 struct compat_ebt_entry_mwt *match32;
2121                 unsigned int size;
2122                 char *buf = buf_start;
2123
2124                 buf = buf_start + offsets[i];
2125                 if (offsets[i] > offsets[j])
2126                         return -EINVAL;
2127
2128                 match32 = (struct compat_ebt_entry_mwt *) buf;
2129                 size = offsets[j] - offsets[i];
2130                 ret = ebt_size_mwt(match32, size, i, state, base);
2131                 if (ret < 0)
2132                         return ret;
2133                 new_offset += ret;
2134                 if (offsets_update && new_offset) {
2135                         pr_debug("change offset %d to %d\n",
2136                                 offsets_update[i], offsets[j] + new_offset);
2137                         offsets_update[i] = offsets[j] + new_offset;
2138                 }
2139         }
2140
2141         if (state->buf_kern_start == NULL) {
2142                 unsigned int offset = buf_start - (char *) base;
2143
2144                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
2145                 if (ret < 0)
2146                         return ret;
2147         }
2148
2149         next_expected_off = state->buf_user_offset - startoff;
2150         if (next_expected_off != entry->next_offset)
2151                 return -EINVAL;
2152
2153         if (*total < entry->next_offset)
2154                 return -EINVAL;
2155         *total -= entry->next_offset;
2156         return 0;
2157 }
2158
2159 /*
2160  * repl->entries_size is the size of the ebt_entry blob in userspace.
2161  * It might need more memory when copied to a 64 bit kernel in case
2162  * userspace is 32-bit. So, first task: find out how much memory is needed.
2163  *
2164  * Called before validation is performed.
2165  */
2166 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2167                                 struct ebt_entries_buf_state *state)
2168 {
2169         unsigned int size_remaining = size_user;
2170         int ret;
2171
2172         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2173                                         &size_remaining, state);
2174         if (ret < 0)
2175                 return ret;
2176
2177         if (size_remaining)
2178                 return -EINVAL;
2179
2180         return state->buf_kern_offset;
2181 }
2182
2183
2184 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2185                                             void __user *user, unsigned int len)
2186 {
2187         struct compat_ebt_replace tmp;
2188         int i;
2189
2190         if (len < sizeof(tmp))
2191                 return -EINVAL;
2192
2193         if (copy_from_user(&tmp, user, sizeof(tmp)))
2194                 return -EFAULT;
2195
2196         if (len != sizeof(tmp) + tmp.entries_size)
2197                 return -EINVAL;
2198
2199         if (tmp.entries_size == 0)
2200                 return -EINVAL;
2201
2202         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2203                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2204                 return -ENOMEM;
2205         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2206                 return -ENOMEM;
2207
2208         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2209
2210         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2211         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2212                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2213
2214         repl->num_counters = tmp.num_counters;
2215         repl->counters = compat_ptr(tmp.counters);
2216         repl->entries = compat_ptr(tmp.entries);
2217         return 0;
2218 }
2219
2220 static int compat_do_replace(struct net *net, void __user *user,
2221                              unsigned int len)
2222 {
2223         int ret, i, countersize, size64;
2224         struct ebt_table_info *newinfo;
2225         struct ebt_replace tmp;
2226         struct ebt_entries_buf_state state;
2227         void *entries_tmp;
2228
2229         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2230         if (ret) {
2231                 /* try real handler in case userland supplied needed padding */
2232                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2233                         ret = 0;
2234                 return ret;
2235         }
2236
2237         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2238         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2239         if (!newinfo)
2240                 return -ENOMEM;
2241
2242         if (countersize)
2243                 memset(newinfo->counters, 0, countersize);
2244
2245         memset(&state, 0, sizeof(state));
2246
2247         newinfo->entries = vmalloc(tmp.entries_size);
2248         if (!newinfo->entries) {
2249                 ret = -ENOMEM;
2250                 goto free_newinfo;
2251         }
2252         if (copy_from_user(
2253            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2254                 ret = -EFAULT;
2255                 goto free_entries;
2256         }
2257
2258         entries_tmp = newinfo->entries;
2259
2260         xt_compat_lock(NFPROTO_BRIDGE);
2261
2262         xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
2263         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2264         if (ret < 0)
2265                 goto out_unlock;
2266
2267         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2268                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2269                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2270
2271         size64 = ret;
2272         newinfo->entries = vmalloc(size64);
2273         if (!newinfo->entries) {
2274                 vfree(entries_tmp);
2275                 ret = -ENOMEM;
2276                 goto out_unlock;
2277         }
2278
2279         memset(&state, 0, sizeof(state));
2280         state.buf_kern_start = newinfo->entries;
2281         state.buf_kern_len = size64;
2282
2283         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2284         if (WARN_ON(ret < 0)) {
2285                 vfree(entries_tmp);
2286                 goto out_unlock;
2287         }
2288
2289         vfree(entries_tmp);
2290         tmp.entries_size = size64;
2291
2292         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2293                 char __user *usrptr;
2294                 if (tmp.hook_entry[i]) {
2295                         unsigned int delta;
2296                         usrptr = (char __user *) tmp.hook_entry[i];
2297                         delta = usrptr - tmp.entries;
2298                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2299                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2300                 }
2301         }
2302
2303         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2304         xt_compat_unlock(NFPROTO_BRIDGE);
2305
2306         ret = do_replace_finish(net, &tmp, newinfo);
2307         if (ret == 0)
2308                 return ret;
2309 free_entries:
2310         vfree(newinfo->entries);
2311 free_newinfo:
2312         vfree(newinfo);
2313         return ret;
2314 out_unlock:
2315         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2316         xt_compat_unlock(NFPROTO_BRIDGE);
2317         goto free_entries;
2318 }
2319
2320 static int compat_update_counters(struct net *net, void __user *user,
2321                                   unsigned int len)
2322 {
2323         struct compat_ebt_replace hlp;
2324
2325         if (copy_from_user(&hlp, user, sizeof(hlp)))
2326                 return -EFAULT;
2327
2328         /* try real handler in case userland supplied needed padding */
2329         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2330                 return update_counters(net, user, len);
2331
2332         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2333                                         hlp.num_counters, user, len);
2334 }
2335
2336 static int compat_do_ebt_set_ctl(struct sock *sk,
2337                 int cmd, void __user *user, unsigned int len)
2338 {
2339         int ret;
2340         struct net *net = sock_net(sk);
2341
2342         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2343                 return -EPERM;
2344
2345         switch (cmd) {
2346         case EBT_SO_SET_ENTRIES:
2347                 ret = compat_do_replace(net, user, len);
2348                 break;
2349         case EBT_SO_SET_COUNTERS:
2350                 ret = compat_update_counters(net, user, len);
2351                 break;
2352         default:
2353                 ret = -EINVAL;
2354   }
2355         return ret;
2356 }
2357
2358 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2359                 void __user *user, int *len)
2360 {
2361         int ret;
2362         struct compat_ebt_replace tmp;
2363         struct ebt_table *t;
2364         struct net *net = sock_net(sk);
2365
2366         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2367                 return -EPERM;
2368
2369         /* try real handler in case userland supplied needed padding */
2370         if ((cmd == EBT_SO_GET_INFO ||
2371              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2372                         return do_ebt_get_ctl(sk, cmd, user, len);
2373
2374         if (copy_from_user(&tmp, user, sizeof(tmp)))
2375                 return -EFAULT;
2376
2377         tmp.name[sizeof(tmp.name) - 1] = '\0';
2378
2379         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
2380         if (!t)
2381                 return ret;
2382
2383         xt_compat_lock(NFPROTO_BRIDGE);
2384         switch (cmd) {
2385         case EBT_SO_GET_INFO:
2386                 tmp.nentries = t->private->nentries;
2387                 ret = compat_table_info(t->private, &tmp);
2388                 if (ret)
2389                         goto out;
2390                 tmp.valid_hooks = t->valid_hooks;
2391
2392                 if (copy_to_user(user, &tmp, *len) != 0) {
2393                         ret = -EFAULT;
2394                         break;
2395                 }
2396                 ret = 0;
2397                 break;
2398         case EBT_SO_GET_INIT_INFO:
2399                 tmp.nentries = t->table->nentries;
2400                 tmp.entries_size = t->table->entries_size;
2401                 tmp.valid_hooks = t->table->valid_hooks;
2402
2403                 if (copy_to_user(user, &tmp, *len) != 0) {
2404                         ret = -EFAULT;
2405                         break;
2406                 }
2407                 ret = 0;
2408                 break;
2409         case EBT_SO_GET_ENTRIES:
2410         case EBT_SO_GET_INIT_ENTRIES:
2411                 /*
2412                  * try real handler first in case of userland-side padding.
2413                  * in case we are dealing with an 'ordinary' 32 bit binary
2414                  * without 64bit compatibility padding, this will fail right
2415                  * after copy_from_user when the *len argument is validated.
2416                  *
2417                  * the compat_ variant needs to do one pass over the kernel
2418                  * data set to adjust for size differences before it the check.
2419                  */
2420                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2421                         ret = 0;
2422                 else
2423                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2424                 break;
2425         default:
2426                 ret = -EINVAL;
2427         }
2428  out:
2429         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2430         xt_compat_unlock(NFPROTO_BRIDGE);
2431         mutex_unlock(&ebt_mutex);
2432         return ret;
2433 }
2434 #endif
2435
2436 static struct nf_sockopt_ops ebt_sockopts = {
2437         .pf             = PF_INET,
2438         .set_optmin     = EBT_BASE_CTL,
2439         .set_optmax     = EBT_SO_SET_MAX + 1,
2440         .set            = do_ebt_set_ctl,
2441 #ifdef CONFIG_COMPAT
2442         .compat_set     = compat_do_ebt_set_ctl,
2443 #endif
2444         .get_optmin     = EBT_BASE_CTL,
2445         .get_optmax     = EBT_SO_GET_MAX + 1,
2446         .get            = do_ebt_get_ctl,
2447 #ifdef CONFIG_COMPAT
2448         .compat_get     = compat_do_ebt_get_ctl,
2449 #endif
2450         .owner          = THIS_MODULE,
2451 };
2452
2453 static int __init ebtables_init(void)
2454 {
2455         int ret;
2456
2457         ret = xt_register_target(&ebt_standard_target);
2458         if (ret < 0)
2459                 return ret;
2460         ret = nf_register_sockopt(&ebt_sockopts);
2461         if (ret < 0) {
2462                 xt_unregister_target(&ebt_standard_target);
2463                 return ret;
2464         }
2465
2466         printk(KERN_INFO "Ebtables v2.0 registered\n");
2467         return 0;
2468 }
2469
2470 static void __exit ebtables_fini(void)
2471 {
2472         nf_unregister_sockopt(&ebt_sockopts);
2473         xt_unregister_target(&ebt_standard_target);
2474         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2475 }
2476
2477 EXPORT_SYMBOL(ebt_register_table);
2478 EXPORT_SYMBOL(ebt_unregister_table);
2479 EXPORT_SYMBOL(ebt_do_table);
2480 module_init(ebtables_init);
2481 module_exit(ebtables_fini);
2482 MODULE_LICENSE("GPL");