SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18 #include <linux/kmod.h>
  19 #include <linux/module.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netfilter/x_tables.h>
  22 #include <linux/netfilter_bridge/ebtables.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/mutex.h>
  25 #include <linux/slab.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36
  37 /*
  38  * Each cpu has its own set of counters, so there is no need for write_lock in
  39  * the softirq
  40  * For reading or updating the counters, the user context needs to
  41  * get a write_lock
  42  */
  43
  44 /* The size of each set of counters is altered to get cache alignment */
  45 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  46 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  47 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  48    COUNTER_OFFSET(n) * cpu))
  49
  50
  51
  52 static DEFINE_MUTEX(ebt_mutex);
  53
  54 #ifdef CONFIG_COMPAT
  55 static void ebt_standard_compat_from_user(void *dst, const void *src)
  56 {
  57         int v = *(compat_int_t *)src;
  58
  59         if (v >= 0)
  60                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  61         memcpy(dst, &v, sizeof(v));
  62 }
  63
  64 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  65 {
  66         compat_int_t cv = *(int *)src;
  67
  68         if (cv >= 0)
  69                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  70         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  71 }
  72 #endif
  73
  74
  75 static struct xt_target ebt_standard_target = {
  76         .name       = "standard",
  77         .revision   = 0,
  78         .family     = NFPROTO_BRIDGE,
  79         .targetsize = sizeof(int),
  80 #ifdef CONFIG_COMPAT
  81         .compatsize = sizeof(compat_int_t),
  82         .compat_from_user = ebt_standard_compat_from_user,
  83         .compat_to_user =  ebt_standard_compat_to_user,
  84 #endif
  85 };
  86
  87 static inline int
  88 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  89                struct xt_action_param *par)
  90 {
  91         par->target   = w->u.watcher;
  92         par->targinfo = w->data;
  93         w->u.watcher->target(skb, par);
  94         /* watchers don't give a verdict */
  95         return 0;
  96 }
  97
  98 static inline int
  99 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
 100              struct xt_action_param *par)
 101 {
 102         par->match     = m->u.match;
 103         par->matchinfo = m->data;
 104         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 105 }
 106
 107 static inline int
 108 ebt_dev_check(const char *entry, const struct net_device *device)
 109 {
 110         int i = 0;
 111         const char *devname;
 112
 113         if (*entry == '\0')
 114                 return 0;
 115         if (!device)
 116                 return 1;
 117         devname = device->name;
 118         /* 1 is the wildcard token */
 119         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 120                 i++;
 121         return (devname[i] != entry[i] && entry[i] != 1);
 122 }
 123
 124 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 125 /* process standard matches */
 126 static inline int
 127 ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
 128                 const struct net_device *in, const struct net_device *out)
 129 {
 130         int verdict, i;
 131
 132         if (e->bitmask & EBT_802_3) {
 133                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 134                         return 1;
 135         } else if (!(e->bitmask & EBT_NOPROTO) &&
 136            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 137                 return 1;
 138
 139         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 140                 return 1;
 141         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 142                 return 1;
 143         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 144            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 145                 return 1;
 146         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 147            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 148                 return 1;
 149
 150         if (e->bitmask & EBT_SOURCEMAC) {
 151                 verdict = 0;
 152                 for (i = 0; i < 6; i++)
 153                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 154                            e->sourcemsk[i];
 155                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 156                         return 1;
 157         }
 158         if (e->bitmask & EBT_DESTMAC) {
 159                 verdict = 0;
 160                 for (i = 0; i < 6; i++)
 161                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 162                            e->destmsk[i];
 163                 if (FWINV2(verdict != 0, EBT_IDEST) )
 164                         return 1;
 165         }
 166         return 0;
 167 }
 168
 169 static inline __pure
 170 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 171 {
 172         return (void *)entry + entry->next_offset;
 173 }
 174
 175 /* Do some firewalling */
 176 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 177    const struct net_device *in, const struct net_device *out,
 178    struct ebt_table *table)
 179 {
 180         int i, nentries;
 181         struct ebt_entry *point;
 182         struct ebt_counter *counter_base, *cb_base;
 183         const struct ebt_entry_target *t;
 184         int verdict, sp = 0;
 185         struct ebt_chainstack *cs;
 186         struct ebt_entries *chaininfo;
 187         const char *base;
 188         const struct ebt_table_info *private;
 189         struct xt_action_param acpar;
 190
 191         acpar.family  = NFPROTO_BRIDGE;
 192         acpar.in      = in;
 193         acpar.out     = out;
 194         acpar.hotdrop = false;
 195         acpar.hooknum = hook;
 196
 197         read_lock_bh(&table->lock);
 198         private = table->private;
 199         cb_base = COUNTER_BASE(private->counters, private->nentries,
 200            smp_processor_id());
 201         if (private->chainstack)
 202                 cs = private->chainstack[smp_processor_id()];
 203         else
 204                 cs = NULL;
 205         chaininfo = private->hook_entry[hook];
 206         nentries = private->hook_entry[hook]->nentries;
 207         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 208         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 209         /* base for chain jumps */
 210         base = private->entries;
 211         i = 0;
 212         while (i < nentries) {
 213                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 214                         goto letscontinue;
 215
 216                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
 217                         goto letscontinue;
 218                 if (acpar.hotdrop) {
 219                         read_unlock_bh(&table->lock);
 220                         return NF_DROP;
 221                 }
 222
 223                 /* increase counter */
 224                 (*(counter_base + i)).pcnt++;
 225                 (*(counter_base + i)).bcnt += skb->len;
 226
 227                 /* these should only watch: not modify, nor tell us
 228                    what to do with the packet */
 229                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
 230
 231                 t = (struct ebt_entry_target *)
 232                    (((char *)point) + point->target_offset);
 233                 /* standard target */
 234                 if (!t->u.target->target)
 235                         verdict = ((struct ebt_standard_target *)t)->verdict;
 236                 else {
 237                         acpar.target   = t->u.target;
 238                         acpar.targinfo = t->data;
 239                         verdict = t->u.target->target(skb, &acpar);
 240                 }
 241                 if (verdict == EBT_ACCEPT) {
 242                         read_unlock_bh(&table->lock);
 243                         return NF_ACCEPT;
 244                 }
 245                 if (verdict == EBT_DROP) {
 246                         read_unlock_bh(&table->lock);
 247                         return NF_DROP;
 248                 }
 249                 if (verdict == EBT_RETURN) {
 250 letsreturn:
 251 #ifdef CONFIG_NETFILTER_DEBUG
 252                         if (sp == 0) {
 253                                 BUGPRINT("RETURN on base chain");
 254                                 /* act like this is EBT_CONTINUE */
 255                                 goto letscontinue;
 256                         }
 257 #endif
 258                         sp--;
 259                         /* put all the local variables right */
 260                         i = cs[sp].n;
 261                         chaininfo = cs[sp].chaininfo;
 262                         nentries = chaininfo->nentries;
 263                         point = cs[sp].e;
 264                         counter_base = cb_base +
 265                            chaininfo->counter_offset;
 266                         continue;
 267                 }
 268                 if (verdict == EBT_CONTINUE)
 269                         goto letscontinue;
 270 #ifdef CONFIG_NETFILTER_DEBUG
 271                 if (verdict < 0) {
 272                         BUGPRINT("bogus standard verdict\n");
 273                         read_unlock_bh(&table->lock);
 274                         return NF_DROP;
 275                 }
 276 #endif
 277                 /* jump to a udc */
 278                 cs[sp].n = i + 1;
 279                 cs[sp].chaininfo = chaininfo;
 280                 cs[sp].e = ebt_next_entry(point);
 281                 i = 0;
 282                 chaininfo = (struct ebt_entries *) (base + verdict);
 283 #ifdef CONFIG_NETFILTER_DEBUG
 284                 if (chaininfo->distinguisher) {
 285                         BUGPRINT("jump to non-chain\n");
 286                         read_unlock_bh(&table->lock);
 287                         return NF_DROP;
 288                 }
 289 #endif
 290                 nentries = chaininfo->nentries;
 291                 point = (struct ebt_entry *)chaininfo->data;
 292                 counter_base = cb_base + chaininfo->counter_offset;
 293                 sp++;
 294                 continue;
 295 letscontinue:
 296                 point = ebt_next_entry(point);
 297                 i++;
 298         }
 299
 300         /* I actually like this :) */
 301         if (chaininfo->policy == EBT_RETURN)
 302                 goto letsreturn;
 303         if (chaininfo->policy == EBT_ACCEPT) {
 304                 read_unlock_bh(&table->lock);
 305                 return NF_ACCEPT;
 306         }
 307         read_unlock_bh(&table->lock);
 308         return NF_DROP;
 309 }
 310
 311 /* If it succeeds, returns element and locks mutex */
 312 static inline void *
 313 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 314    struct mutex *mutex)
 315 {
 316         struct {
 317                 struct list_head list;
 318                 char name[EBT_FUNCTION_MAXNAMELEN];
 319         } *e;
 320
 321         *error = mutex_lock_interruptible(mutex);
 322         if (*error != 0)
 323                 return NULL;
 324
 325         list_for_each_entry(e, head, list) {
 326                 if (strcmp(e->name, name) == 0)
 327                         return e;
 328         }
 329         *error = -ENOENT;
 330         mutex_unlock(mutex);
 331         return NULL;
 332 }
 333
 334 static void *
 335 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 336    int *error, struct mutex *mutex)
 337 {
 338         return try_then_request_module(
 339                         find_inlist_lock_noload(head, name, error, mutex),
 340                         "%s%s", prefix, name);
 341 }
 342
 343 static inline struct ebt_table *
 344 find_table_lock(struct net *net, const char *name, int *error,
 345                 struct mutex *mutex)
 346 {
 347         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 348                                 "ebtable_", error, mutex);
 349 }
 350
 351 static inline int
 352 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 353                 unsigned int *cnt)
 354 {
 355         const struct ebt_entry *e = par->entryinfo;
 356         struct xt_match *match;
 357         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 358         int ret;
 359
 360         if (left < sizeof(struct ebt_entry_match) ||
 361             left - sizeof(struct ebt_entry_match) < m->match_size)
 362                 return -EINVAL;
 363
 364         match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
 365         if (IS_ERR(match))
 366                 return PTR_ERR(match);
 367         m->u.match = match;
 368
 369         par->match     = match;
 370         par->matchinfo = m->data;
 371         ret = xt_check_match(par, m->match_size,
 372               e->ethproto, e->invflags & EBT_IPROTO);
 373         if (ret < 0) {
 374                 module_put(match->me);
 375                 return ret;
 376         }
 377
 378         (*cnt)++;
 379         return 0;
 380 }
 381
 382 static inline int
 383 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 384                   unsigned int *cnt)
 385 {
 386         const struct ebt_entry *e = par->entryinfo;
 387         struct xt_target *watcher;
 388         size_t left = ((char *)e + e->target_offset) - (char *)w;
 389         int ret;
 390
 391         if (left < sizeof(struct ebt_entry_watcher) ||
 392            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 393                 return -EINVAL;
 394
 395         watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
 396         if (IS_ERR(watcher))
 397                 return PTR_ERR(watcher);
 398         w->u.watcher = watcher;
 399
 400         par->target   = watcher;
 401         par->targinfo = w->data;
 402         ret = xt_check_target(par, w->watcher_size,
 403               e->ethproto, e->invflags & EBT_IPROTO);
 404         if (ret < 0) {
 405                 module_put(watcher->me);
 406                 return ret;
 407         }
 408
 409         (*cnt)++;
 410         return 0;
 411 }
 412
 413 static int ebt_verify_pointers(const struct ebt_replace *repl,
 414                                struct ebt_table_info *newinfo)
 415 {
 416         unsigned int limit = repl->entries_size;
 417         unsigned int valid_hooks = repl->valid_hooks;
 418         unsigned int offset = 0;
 419         int i;
 420
 421         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 422                 newinfo->hook_entry[i] = NULL;
 423
 424         newinfo->entries_size = repl->entries_size;
 425         newinfo->nentries = repl->nentries;
 426
 427         while (offset < limit) {
 428                 size_t left = limit - offset;
 429                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 430
 431                 if (left < sizeof(unsigned int))
 432                         break;
 433
 434                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 435                         if ((valid_hooks & (1 << i)) == 0)
 436                                 continue;
 437                         if ((char __user *)repl->hook_entry[i] ==
 438                              repl->entries + offset)
 439                                 break;
 440                 }
 441
 442                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 443                         if (e->bitmask != 0) {
 444                                 /* we make userspace set this right,
 445                                    so there is no misunderstanding */
 446                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 447                                          "in distinguisher\n");
 448                                 return -EINVAL;
 449                         }
 450                         if (i != NF_BR_NUMHOOKS)
 451                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 452                         if (left < sizeof(struct ebt_entries))
 453                                 break;
 454                         offset += sizeof(struct ebt_entries);
 455                 } else {
 456                         if (left < sizeof(struct ebt_entry))
 457                                 break;
 458                         if (left < e->next_offset)
 459                                 break;
 460                         if (e->next_offset < sizeof(struct ebt_entry))
 461                                 return -EINVAL;
 462                         offset += e->next_offset;
 463                 }
 464         }
 465         if (offset != limit) {
 466                 BUGPRINT("entries_size too small\n");
 467                 return -EINVAL;
 468         }
 469
 470         /* check if all valid hooks have a chain */
 471         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 472                 if (!newinfo->hook_entry[i] &&
 473                    (valid_hooks & (1 << i))) {
 474                         BUGPRINT("Valid hook without chain\n");
 475                         return -EINVAL;
 476                 }
 477         }
 478         return 0;
 479 }
 480
 481 /*
 482  * this one is very careful, as it is the first function
 483  * to parse the userspace data
 484  */
 485 static inline int
 486 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 487    const struct ebt_table_info *newinfo,
 488    unsigned int *n, unsigned int *cnt,
 489    unsigned int *totalcnt, unsigned int *udc_cnt)
 490 {
 491         int i;
 492
 493         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 494                 if ((void *)e == (void *)newinfo->hook_entry[i])
 495                         break;
 496         }
 497         /* beginning of a new chain
 498            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 499         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 500                 /* this checks if the previous chain has as many entries
 501                    as it said it has */
 502                 if (*n != *cnt) {
 503                         BUGPRINT("nentries does not equal the nr of entries "
 504                                  "in the chain\n");
 505                         return -EINVAL;
 506                 }
 507                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 508                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 509                         /* only RETURN from udc */
 510                         if (i != NF_BR_NUMHOOKS ||
 511                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 512                                 BUGPRINT("bad policy\n");
 513                                 return -EINVAL;
 514                         }
 515                 }
 516                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 517                         (*udc_cnt)++;
 518                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 519                         BUGPRINT("counter_offset != totalcnt");
 520                         return -EINVAL;
 521                 }
 522                 *n = ((struct ebt_entries *)e)->nentries;
 523                 *cnt = 0;
 524                 return 0;
 525         }
 526         /* a plain old entry, heh */
 527         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 528            e->watchers_offset > e->target_offset ||
 529            e->target_offset >= e->next_offset) {
 530                 BUGPRINT("entry offsets not in right order\n");
 531                 return -EINVAL;
 532         }
 533         /* this is not checked anywhere else */
 534         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 535                 BUGPRINT("target size too small\n");
 536                 return -EINVAL;
 537         }
 538         (*cnt)++;
 539         (*totalcnt)++;
 540         return 0;
 541 }
 542
 543 struct ebt_cl_stack
 544 {
 545         struct ebt_chainstack cs;
 546         int from;
 547         unsigned int hookmask;
 548 };
 549
 550 /*
 551  * we need these positions to check that the jumps to a different part of the
 552  * entries is a jump to the beginning of a new chain.
 553  */
 554 static inline int
 555 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 556    unsigned int *n, struct ebt_cl_stack *udc)
 557 {
 558         int i;
 559
 560         /* we're only interested in chain starts */
 561         if (e->bitmask)
 562                 return 0;
 563         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 564                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 565                         break;
 566         }
 567         /* only care about udc */
 568         if (i != NF_BR_NUMHOOKS)
 569                 return 0;
 570
 571         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 572         /* these initialisations are depended on later in check_chainloops() */
 573         udc[*n].cs.n = 0;
 574         udc[*n].hookmask = 0;
 575
 576         (*n)++;
 577         return 0;
 578 }
 579
 580 static inline int
 581 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 582 {
 583         struct xt_mtdtor_param par;
 584
 585         if (i && (*i)-- == 0)
 586                 return 1;
 587
 588         par.net       = net;
 589         par.match     = m->u.match;
 590         par.matchinfo = m->data;
 591         par.family    = NFPROTO_BRIDGE;
 592         if (par.match->destroy != NULL)
 593                 par.match->destroy(&par);
 594         module_put(par.match->me);
 595         return 0;
 596 }
 597
 598 static inline int
 599 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 600 {
 601         struct xt_tgdtor_param par;
 602
 603         if (i && (*i)-- == 0)
 604                 return 1;
 605
 606         par.net      = net;
 607         par.target   = w->u.watcher;
 608         par.targinfo = w->data;
 609         par.family   = NFPROTO_BRIDGE;
 610         if (par.target->destroy != NULL)
 611                 par.target->destroy(&par);
 612         module_put(par.target->me);
 613         return 0;
 614 }
 615
 616 static inline int
 617 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 618 {
 619         struct xt_tgdtor_param par;
 620         struct ebt_entry_target *t;
 621
 622         if (e->bitmask == 0)
 623                 return 0;
 624         /* we're done */
 625         if (cnt && (*cnt)-- == 0)
 626                 return 1;
 627         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 628         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 629         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 630
 631         par.net      = net;
 632         par.target   = t->u.target;
 633         par.targinfo = t->data;
 634         par.family   = NFPROTO_BRIDGE;
 635         if (par.target->destroy != NULL)
 636                 par.target->destroy(&par);
 637         module_put(par.target->me);
 638         return 0;
 639 }
 640
 641 static inline int
 642 ebt_check_entry(struct ebt_entry *e, struct net *net,
 643    const struct ebt_table_info *newinfo,
 644    const char *name, unsigned int *cnt,
 645    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 646 {
 647         struct ebt_entry_target *t;
 648         struct xt_target *target;
 649         unsigned int i, j, hook = 0, hookmask = 0;
 650         size_t gap;
 651         int ret;
 652         struct xt_mtchk_param mtpar;
 653         struct xt_tgchk_param tgpar;
 654
 655         /* don't mess with the struct ebt_entries */
 656         if (e->bitmask == 0)
 657                 return 0;
 658
 659         if (e->bitmask & ~EBT_F_MASK) {
 660                 BUGPRINT("Unknown flag for bitmask\n");
 661                 return -EINVAL;
 662         }
 663         if (e->invflags & ~EBT_INV_MASK) {
 664                 BUGPRINT("Unknown flag for inv bitmask\n");
 665                 return -EINVAL;
 666         }
 667         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 668                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 669                 return -EINVAL;
 670         }
 671         /* what hook do we belong to? */
 672         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 673                 if (!newinfo->hook_entry[i])
 674                         continue;
 675                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 676                         hook = i;
 677                 else
 678                         break;
 679         }
 680         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 681            a base chain */
 682         if (i < NF_BR_NUMHOOKS)
 683                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 684         else {
 685                 for (i = 0; i < udc_cnt; i++)
 686                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 687                                 break;
 688                 if (i == 0)
 689                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 690                 else
 691                         hookmask = cl_s[i - 1].hookmask;
 692         }
 693         i = 0;
 694
 695         mtpar.net       = tgpar.net       = net;
 696         mtpar.table     = tgpar.table     = name;
 697         mtpar.entryinfo = tgpar.entryinfo = e;
 698         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 699         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 700         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 701         if (ret != 0)
 702                 goto cleanup_matches;
 703         j = 0;
 704         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 705         if (ret != 0)
 706                 goto cleanup_watchers;
 707         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 708         gap = e->next_offset - e->target_offset;
 709
 710         target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
 711         if (IS_ERR(target)) {
 712                 ret = PTR_ERR(target);
 713                 goto cleanup_watchers;
 714         }
 715
 716         t->u.target = target;
 717         if (t->u.target == &ebt_standard_target) {
 718                 if (gap < sizeof(struct ebt_standard_target)) {
 719                         BUGPRINT("Standard target size too big\n");
 720                         ret = -EFAULT;
 721                         goto cleanup_watchers;
 722                 }
 723                 if (((struct ebt_standard_target *)t)->verdict <
 724                    -NUM_STANDARD_TARGETS) {
 725                         BUGPRINT("Invalid standard target\n");
 726                         ret = -EFAULT;
 727                         goto cleanup_watchers;
 728                 }
 729         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 730                 module_put(t->u.target->me);
 731                 ret = -EFAULT;
 732                 goto cleanup_watchers;
 733         }
 734
 735         tgpar.target   = target;
 736         tgpar.targinfo = t->data;
 737         ret = xt_check_target(&tgpar, t->target_size,
 738               e->ethproto, e->invflags & EBT_IPROTO);
 739         if (ret < 0) {
 740                 module_put(target->me);
 741                 goto cleanup_watchers;
 742         }
 743         (*cnt)++;
 744         return 0;
 745 cleanup_watchers:
 746         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 747 cleanup_matches:
 748         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 749         return ret;
 750 }
 751
 752 /*
 753  * checks for loops and sets the hook mask for udc
 754  * the hook mask for udc tells us from which base chains the udc can be
 755  * accessed. This mask is a parameter to the check() functions of the extensions
 756  */
 757 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 758    unsigned int udc_cnt, unsigned int hooknr, char *base)
 759 {
 760         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 761         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 762         const struct ebt_entry_target *t;
 763
 764         while (pos < nentries || chain_nr != -1) {
 765                 /* end of udc, go back one 'recursion' step */
 766                 if (pos == nentries) {
 767                         /* put back values of the time when this chain was called */
 768                         e = cl_s[chain_nr].cs.e;
 769                         if (cl_s[chain_nr].from != -1)
 770                                 nentries =
 771                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 772                         else
 773                                 nentries = chain->nentries;
 774                         pos = cl_s[chain_nr].cs.n;
 775                         /* make sure we won't see a loop that isn't one */
 776                         cl_s[chain_nr].cs.n = 0;
 777                         chain_nr = cl_s[chain_nr].from;
 778                         if (pos == nentries)
 779                                 continue;
 780                 }
 781                 t = (struct ebt_entry_target *)
 782                    (((char *)e) + e->target_offset);
 783                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 784                         goto letscontinue;
 785                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 786                    e->next_offset) {
 787                         BUGPRINT("Standard target size too big\n");
 788                         return -1;
 789                 }
 790                 verdict = ((struct ebt_standard_target *)t)->verdict;
 791                 if (verdict >= 0) { /* jump to another chain */
 792                         struct ebt_entries *hlp2 =
 793                            (struct ebt_entries *)(base + verdict);
 794                         for (i = 0; i < udc_cnt; i++)
 795                                 if (hlp2 == cl_s[i].cs.chaininfo)
 796                                         break;
 797                         /* bad destination or loop */
 798                         if (i == udc_cnt) {
 799                                 BUGPRINT("bad destination\n");
 800                                 return -1;
 801                         }
 802                         if (cl_s[i].cs.n) {
 803                                 BUGPRINT("loop\n");
 804                                 return -1;
 805                         }
 806                         if (cl_s[i].hookmask & (1 << hooknr))
 807                                 goto letscontinue;
 808                         /* this can't be 0, so the loop test is correct */
 809                         cl_s[i].cs.n = pos + 1;
 810                         pos = 0;
 811                         cl_s[i].cs.e = ebt_next_entry(e);
 812                         e = (struct ebt_entry *)(hlp2->data);
 813                         nentries = hlp2->nentries;
 814                         cl_s[i].from = chain_nr;
 815                         chain_nr = i;
 816                         /* this udc is accessible from the base chain for hooknr */
 817                         cl_s[i].hookmask |= (1 << hooknr);
 818                         continue;
 819                 }
 820 letscontinue:
 821                 e = ebt_next_entry(e);
 822                 pos++;
 823         }
 824         return 0;
 825 }
 826
 827 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 828 static int translate_table(struct net *net, const char *name,
 829                            struct ebt_table_info *newinfo)
 830 {
 831         unsigned int i, j, k, udc_cnt;
 832         int ret;
 833         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 834
 835         i = 0;
 836         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 837                 i++;
 838         if (i == NF_BR_NUMHOOKS) {
 839                 BUGPRINT("No valid hooks specified\n");
 840                 return -EINVAL;
 841         }
 842         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 843                 BUGPRINT("Chains don't start at beginning\n");
 844                 return -EINVAL;
 845         }
 846         /* make sure chains are ordered after each other in same order
 847            as their corresponding hooks */
 848         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 849                 if (!newinfo->hook_entry[j])
 850                         continue;
 851                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 852                         BUGPRINT("Hook order must be followed\n");
 853                         return -EINVAL;
 854                 }
 855                 i = j;
 856         }
 857
 858         /* do some early checkings and initialize some things */
 859         i = 0; /* holds the expected nr. of entries for the chain */
 860         j = 0; /* holds the up to now counted entries for the chain */
 861         k = 0; /* holds the total nr. of entries, should equal
 862                   newinfo->nentries afterwards */
 863         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 864         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 865            ebt_check_entry_size_and_hooks, newinfo,
 866            &i, &j, &k, &udc_cnt);
 867
 868         if (ret != 0)
 869                 return ret;
 870
 871         if (i != j) {
 872                 BUGPRINT("nentries does not equal the nr of entries in the "
 873                          "(last) chain\n");
 874                 return -EINVAL;
 875         }
 876         if (k != newinfo->nentries) {
 877                 BUGPRINT("Total nentries is wrong\n");
 878                 return -EINVAL;
 879         }
 880
 881         /* get the location of the udc, put them in an array
 882            while we're at it, allocate the chainstack */
 883         if (udc_cnt) {
 884                 /* this will get free'd in do_replace()/ebt_register_table()
 885                    if an error occurs */
 886                 newinfo->chainstack =
 887                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 888                 if (!newinfo->chainstack)
 889                         return -ENOMEM;
 890                 for_each_possible_cpu(i) {
 891                         newinfo->chainstack[i] =
 892                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 893                         if (!newinfo->chainstack[i]) {
 894                                 while (i)
 895                                         vfree(newinfo->chainstack[--i]);
 896                                 vfree(newinfo->chainstack);
 897                                 newinfo->chainstack = NULL;
 898                                 return -ENOMEM;
 899                         }
 900                 }
 901
 902                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 903                 if (!cl_s)
 904                         return -ENOMEM;
 905                 i = 0; /* the i'th udc */
 906                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 907                    ebt_get_udc_positions, newinfo, &i, cl_s);
 908                 /* sanity check */
 909                 if (i != udc_cnt) {
 910                         BUGPRINT("i != udc_cnt\n");
 911                         vfree(cl_s);
 912                         return -EFAULT;
 913                 }
 914         }
 915
 916         /* Check for loops */
 917         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 918                 if (newinfo->hook_entry[i])
 919                         if (check_chainloops(newinfo->hook_entry[i],
 920                            cl_s, udc_cnt, i, newinfo->entries)) {
 921                                 vfree(cl_s);
 922                                 return -EINVAL;
 923                         }
 924
 925         /* we now know the following (along with E=mc²):
 926            - the nr of entries in each chain is right
 927            - the size of the allocated space is right
 928            - all valid hooks have a corresponding chain
 929            - there are no loops
 930            - wrong data can still be on the level of a single entry
 931            - could be there are jumps to places that are not the
 932              beginning of a chain. This can only occur in chains that
 933              are not accessible from any base chains, so we don't care. */
 934
 935         /* used to know what we need to clean up if something goes wrong */
 936         i = 0;
 937         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 938            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 939         if (ret != 0) {
 940                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 941                                   ebt_cleanup_entry, net, &i);
 942         }
 943         vfree(cl_s);
 944         return ret;
 945 }
 946
 947 /* called under write_lock */
 948 static void get_counters(const struct ebt_counter *oldcounters,
 949    struct ebt_counter *counters, unsigned int nentries)
 950 {
 951         int i, cpu;
 952         struct ebt_counter *counter_base;
 953
 954         /* counters of cpu 0 */
 955         memcpy(counters, oldcounters,
 956                sizeof(struct ebt_counter) * nentries);
 957
 958         /* add other counters to those of cpu 0 */
 959         for_each_possible_cpu(cpu) {
 960                 if (cpu == 0)
 961                         continue;
 962                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 963                 for (i = 0; i < nentries; i++) {
 964                         counters[i].pcnt += counter_base[i].pcnt;
 965                         counters[i].bcnt += counter_base[i].bcnt;
 966                 }
 967         }
 968 }
 969
 970 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 971                               struct ebt_table_info *newinfo)
 972 {
 973         int ret, i;
 974         struct ebt_counter *counterstmp = NULL;
 975         /* used to be able to unlock earlier */
 976         struct ebt_table_info *table;
 977         struct ebt_table *t;
 978
 979         /* the user wants counters back
 980            the check on the size is done later, when we have the lock */
 981         if (repl->num_counters) {
 982                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
 983                 counterstmp = vmalloc(size);
 984                 if (!counterstmp)
 985                         return -ENOMEM;
 986         }
 987
 988         newinfo->chainstack = NULL;
 989         ret = ebt_verify_pointers(repl, newinfo);
 990         if (ret != 0)
 991                 goto free_counterstmp;
 992
 993         ret = translate_table(net, repl->name, newinfo);
 994
 995         if (ret != 0)
 996                 goto free_counterstmp;
 997
 998         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
 999         if (!t) {
1000                 ret = -ENOENT;
1001                 goto free_iterate;
1002         }
1003
1004         /* the table doesn't like it */
1005         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1006                 goto free_unlock;
1007
1008         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1009                 BUGPRINT("Wrong nr. of counters requested\n");
1010                 ret = -EINVAL;
1011                 goto free_unlock;
1012         }
1013
1014         /* we have the mutex lock, so no danger in reading this pointer */
1015         table = t->private;
1016         /* make sure the table can only be rmmod'ed if it contains no rules */
1017         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1018                 ret = -ENOENT;
1019                 goto free_unlock;
1020         } else if (table->nentries && !newinfo->nentries)
1021                 module_put(t->me);
1022         /* we need an atomic snapshot of the counters */
1023         write_lock_bh(&t->lock);
1024         if (repl->num_counters)
1025                 get_counters(t->private->counters, counterstmp,
1026                    t->private->nentries);
1027
1028         t->private = newinfo;
1029         write_unlock_bh(&t->lock);
1030         mutex_unlock(&ebt_mutex);
1031         /* so, a user can change the chains while having messed up her counter
1032            allocation. Only reason why this is done is because this way the lock
1033            is held only once, while this doesn't bring the kernel into a
1034            dangerous state. */
1035         if (repl->num_counters &&
1036            copy_to_user(repl->counters, counterstmp,
1037            repl->num_counters * sizeof(struct ebt_counter))) {
1038                 ret = -EFAULT;
1039         }
1040         else
1041                 ret = 0;
1042
1043         /* decrease module count and free resources */
1044         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1045                           ebt_cleanup_entry, net, NULL);
1046
1047         vfree(table->entries);
1048         if (table->chainstack) {
1049                 for_each_possible_cpu(i)
1050                         vfree(table->chainstack[i]);
1051                 vfree(table->chainstack);
1052         }
1053         vfree(table);
1054
1055         vfree(counterstmp);
1056         return ret;
1057
1058 free_unlock:
1059         mutex_unlock(&ebt_mutex);
1060 free_iterate:
1061         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1062                           ebt_cleanup_entry, net, NULL);
1063 free_counterstmp:
1064         vfree(counterstmp);
1065         /* can be initialized in translate_table() */
1066         if (newinfo->chainstack) {
1067                 for_each_possible_cpu(i)
1068                         vfree(newinfo->chainstack[i]);
1069                 vfree(newinfo->chainstack);
1070         }
1071         return ret;
1072 }
1073
1074 /* replace the table */
1075 static int do_replace(struct net *net, const void __user *user,
1076                       unsigned int len)
1077 {
1078         int ret, countersize;
1079         struct ebt_table_info *newinfo;
1080         struct ebt_replace tmp;
1081
1082         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1083                 return -EFAULT;
1084
1085         if (len != sizeof(tmp) + tmp.entries_size) {
1086                 BUGPRINT("Wrong len argument\n");
1087                 return -EINVAL;
1088         }
1089
1090         if (tmp.entries_size == 0) {
1091                 BUGPRINT("Entries_size never zero\n");
1092                 return -EINVAL;
1093         }
1094         /* overflow check */
1095         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1096                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1097                 return -ENOMEM;
1098         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1099                 return -ENOMEM;
1100
1101         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1102         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1103         if (!newinfo)
1104                 return -ENOMEM;
1105
1106         if (countersize)
1107                 memset(newinfo->counters, 0, countersize);
1108
1109         newinfo->entries = vmalloc(tmp.entries_size);
1110         if (!newinfo->entries) {
1111                 ret = -ENOMEM;
1112                 goto free_newinfo;
1113         }
1114         if (copy_from_user(
1115            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1116                 BUGPRINT("Couldn't copy entries from userspace\n");
1117                 ret = -EFAULT;
1118                 goto free_entries;
1119         }
1120
1121         ret = do_replace_finish(net, &tmp, newinfo);
1122         if (ret == 0)
1123                 return ret;
1124 free_entries:
1125         vfree(newinfo->entries);
1126 free_newinfo:
1127         vfree(newinfo);
1128         return ret;
1129 }
1130
1131 struct ebt_table *
1132 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1133 {
1134         struct ebt_table_info *newinfo;
1135         struct ebt_table *t, *table;
1136         struct ebt_replace_kernel *repl;
1137         int ret, i, countersize;
1138         void *p;
1139
1140         if (input_table == NULL || (repl = input_table->table) == NULL ||
1141             repl->entries == 0 || repl->entries_size == 0 ||
1142             repl->counters != NULL || input_table->private != NULL) {
1143                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1144                 return ERR_PTR(-EINVAL);
1145         }
1146
1147         /* Don't add one table to multiple lists. */
1148         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1149         if (!table) {
1150                 ret = -ENOMEM;
1151                 goto out;
1152         }
1153
1154         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1155         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1156         ret = -ENOMEM;
1157         if (!newinfo)
1158                 goto free_table;
1159
1160         p = vmalloc(repl->entries_size);
1161         if (!p)
1162                 goto free_newinfo;
1163
1164         memcpy(p, repl->entries, repl->entries_size);
1165         newinfo->entries = p;
1166
1167         newinfo->entries_size = repl->entries_size;
1168         newinfo->nentries = repl->nentries;
1169
1170         if (countersize)
1171                 memset(newinfo->counters, 0, countersize);
1172
1173         /* fill in newinfo and parse the entries */
1174         newinfo->chainstack = NULL;
1175         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1176                 if ((repl->valid_hooks & (1 << i)) == 0)
1177                         newinfo->hook_entry[i] = NULL;
1178                 else
1179                         newinfo->hook_entry[i] = p +
1180                                 ((char *)repl->hook_entry[i] - repl->entries);
1181         }
1182         ret = translate_table(net, repl->name, newinfo);
1183         if (ret != 0) {
1184                 BUGPRINT("Translate_table failed\n");
1185                 goto free_chainstack;
1186         }
1187
1188         if (table->check && table->check(newinfo, table->valid_hooks)) {
1189                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1190                 return ERR_PTR(-EINVAL);
1191         }
1192
1193         table->private = newinfo;
1194         rwlock_init(&table->lock);
1195         ret = mutex_lock_interruptible(&ebt_mutex);
1196         if (ret != 0)
1197                 goto free_chainstack;
1198
1199         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1200                 if (strcmp(t->name, table->name) == 0) {
1201                         ret = -EEXIST;
1202                         BUGPRINT("Table name already exists\n");
1203                         goto free_unlock;
1204                 }
1205         }
1206
1207         /* Hold a reference count if the chains aren't empty */
1208         if (newinfo->nentries && !try_module_get(table->me)) {
1209                 ret = -ENOENT;
1210                 goto free_unlock;
1211         }
1212         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1213         mutex_unlock(&ebt_mutex);
1214         return table;
1215 free_unlock:
1216         mutex_unlock(&ebt_mutex);
1217 free_chainstack:
1218         if (newinfo->chainstack) {
1219                 for_each_possible_cpu(i)
1220                         vfree(newinfo->chainstack[i]);
1221                 vfree(newinfo->chainstack);
1222         }
1223         vfree(newinfo->entries);
1224 free_newinfo:
1225         vfree(newinfo);
1226 free_table:
1227         kfree(table);
1228 out:
1229         return ERR_PTR(ret);
1230 }
1231
1232 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1233 {
1234         int i;
1235
1236         if (!table) {
1237                 BUGPRINT("Request to unregister NULL table!!!\n");
1238                 return;
1239         }
1240         mutex_lock(&ebt_mutex);
1241         list_del(&table->list);
1242         mutex_unlock(&ebt_mutex);
1243         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1244                           ebt_cleanup_entry, net, NULL);
1245         if (table->private->nentries)
1246                 module_put(table->me);
1247         vfree(table->private->entries);
1248         if (table->private->chainstack) {
1249                 for_each_possible_cpu(i)
1250                         vfree(table->private->chainstack[i]);
1251                 vfree(table->private->chainstack);
1252         }
1253         vfree(table->private);
1254         kfree(table);
1255 }
1256
1257 /* userspace just supplied us with counters */
1258 static int do_update_counters(struct net *net, const char *name,
1259                                 struct ebt_counter __user *counters,
1260                                 unsigned int num_counters,
1261                                 const void __user *user, unsigned int len)
1262 {
1263         int i, ret;
1264         struct ebt_counter *tmp;
1265         struct ebt_table *t;
1266
1267         if (num_counters == 0)
1268                 return -EINVAL;
1269
1270         tmp = vmalloc(num_counters * sizeof(*tmp));
1271         if (!tmp)
1272                 return -ENOMEM;
1273
1274         t = find_table_lock(net, name, &ret, &ebt_mutex);
1275         if (!t)
1276                 goto free_tmp;
1277
1278         if (num_counters != t->private->nentries) {
1279                 BUGPRINT("Wrong nr of counters\n");
1280                 ret = -EINVAL;
1281                 goto unlock_mutex;
1282         }
1283
1284         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1285                 ret = -EFAULT;
1286                 goto unlock_mutex;
1287         }
1288
1289         /* we want an atomic add of the counters */
1290         write_lock_bh(&t->lock);
1291
1292         /* we add to the counters of the first cpu */
1293         for (i = 0; i < num_counters; i++) {
1294                 t->private->counters[i].pcnt += tmp[i].pcnt;
1295                 t->private->counters[i].bcnt += tmp[i].bcnt;
1296         }
1297
1298         write_unlock_bh(&t->lock);
1299         ret = 0;
1300 unlock_mutex:
1301         mutex_unlock(&ebt_mutex);
1302 free_tmp:
1303         vfree(tmp);
1304         return ret;
1305 }
1306
1307 static int update_counters(struct net *net, const void __user *user,
1308                             unsigned int len)
1309 {
1310         struct ebt_replace hlp;
1311
1312         if (copy_from_user(&hlp, user, sizeof(hlp)))
1313                 return -EFAULT;
1314
1315         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1316                 return -EINVAL;
1317
1318         return do_update_counters(net, hlp.name, hlp.counters,
1319                                 hlp.num_counters, user, len);
1320 }
1321
1322 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1323     const char *base, char __user *ubase)
1324 {
1325         char __user *hlp = ubase + ((char *)m - base);
1326         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1327                 return -EFAULT;
1328         return 0;
1329 }
1330
1331 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1332     const char *base, char __user *ubase)
1333 {
1334         char __user *hlp = ubase + ((char *)w - base);
1335         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1336                 return -EFAULT;
1337         return 0;
1338 }
1339
1340 static inline int
1341 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1342 {
1343         int ret;
1344         char __user *hlp;
1345         const struct ebt_entry_target *t;
1346
1347         if (e->bitmask == 0)
1348                 return 0;
1349
1350         hlp = ubase + (((char *)e + e->target_offset) - base);
1351         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1352
1353         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1354         if (ret != 0)
1355                 return ret;
1356         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1357         if (ret != 0)
1358                 return ret;
1359         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1360                 return -EFAULT;
1361         return 0;
1362 }
1363
1364 static int copy_counters_to_user(struct ebt_table *t,
1365                                   const struct ebt_counter *oldcounters,
1366                                   void __user *user, unsigned int num_counters,
1367                                   unsigned int nentries)
1368 {
1369         struct ebt_counter *counterstmp;
1370         int ret = 0;
1371
1372         /* userspace might not need the counters */
1373         if (num_counters == 0)
1374                 return 0;
1375
1376         if (num_counters != nentries) {
1377                 BUGPRINT("Num_counters wrong\n");
1378                 return -EINVAL;
1379         }
1380
1381         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1382         if (!counterstmp)
1383                 return -ENOMEM;
1384
1385         write_lock_bh(&t->lock);
1386         get_counters(oldcounters, counterstmp, nentries);
1387         write_unlock_bh(&t->lock);
1388
1389         if (copy_to_user(user, counterstmp,
1390            nentries * sizeof(struct ebt_counter)))
1391                 ret = -EFAULT;
1392         vfree(counterstmp);
1393         return ret;
1394 }
1395
1396 /* called with ebt_mutex locked */
1397 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1398     const int *len, int cmd)
1399 {
1400         struct ebt_replace tmp;
1401         const struct ebt_counter *oldcounters;
1402         unsigned int entries_size, nentries;
1403         int ret;
1404         char *entries;
1405
1406         if (cmd == EBT_SO_GET_ENTRIES) {
1407                 entries_size = t->private->entries_size;
1408                 nentries = t->private->nentries;
1409                 entries = t->private->entries;
1410                 oldcounters = t->private->counters;
1411         } else {
1412                 entries_size = t->table->entries_size;
1413                 nentries = t->table->nentries;
1414                 entries = t->table->entries;
1415                 oldcounters = t->table->counters;
1416         }
1417
1418         if (copy_from_user(&tmp, user, sizeof(tmp)))
1419                 return -EFAULT;
1420
1421         if (*len != sizeof(struct ebt_replace) + entries_size +
1422            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
1423                 return -EINVAL;
1424
1425         if (tmp.nentries != nentries) {
1426                 BUGPRINT("Nentries wrong\n");
1427                 return -EINVAL;
1428         }
1429
1430         if (tmp.entries_size != entries_size) {
1431                 BUGPRINT("Wrong size\n");
1432                 return -EINVAL;
1433         }
1434
1435         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1436                                         tmp.num_counters, nentries);
1437         if (ret)
1438                 return ret;
1439
1440         if (copy_to_user(tmp.entries, entries, entries_size)) {
1441                 BUGPRINT("Couldn't copy entries to userspace\n");
1442                 return -EFAULT;
1443         }
1444         /* set the match/watcher/target names right */
1445         return EBT_ENTRY_ITERATE(entries, entries_size,
1446            ebt_make_names, entries, tmp.entries);
1447 }
1448
1449 static int do_ebt_set_ctl(struct sock *sk,
1450         int cmd, void __user *user, unsigned int len)
1451 {
1452         int ret;
1453
1454         if (!capable(CAP_NET_ADMIN))
1455                 return -EPERM;
1456
1457         switch(cmd) {
1458         case EBT_SO_SET_ENTRIES:
1459                 ret = do_replace(sock_net(sk), user, len);
1460                 break;
1461         case EBT_SO_SET_COUNTERS:
1462                 ret = update_counters(sock_net(sk), user, len);
1463                 break;
1464         default:
1465                 ret = -EINVAL;
1466         }
1467         return ret;
1468 }
1469
1470 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1471 {
1472         int ret;
1473         struct ebt_replace tmp;
1474         struct ebt_table *t;
1475
1476         if (!capable(CAP_NET_ADMIN))
1477                 return -EPERM;
1478
1479         if (copy_from_user(&tmp, user, sizeof(tmp)))
1480                 return -EFAULT;
1481
1482         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1483         if (!t)
1484                 return ret;
1485
1486         switch(cmd) {
1487         case EBT_SO_GET_INFO:
1488         case EBT_SO_GET_INIT_INFO:
1489                 if (*len != sizeof(struct ebt_replace)){
1490                         ret = -EINVAL;
1491                         mutex_unlock(&ebt_mutex);
1492                         break;
1493                 }
1494                 if (cmd == EBT_SO_GET_INFO) {
1495                         tmp.nentries = t->private->nentries;
1496                         tmp.entries_size = t->private->entries_size;
1497                         tmp.valid_hooks = t->valid_hooks;
1498                 } else {
1499                         tmp.nentries = t->table->nentries;
1500                         tmp.entries_size = t->table->entries_size;
1501                         tmp.valid_hooks = t->table->valid_hooks;
1502                 }
1503                 mutex_unlock(&ebt_mutex);
1504                 if (copy_to_user(user, &tmp, *len) != 0){
1505                         BUGPRINT("c2u Didn't work\n");
1506                         ret = -EFAULT;
1507                         break;
1508                 }
1509                 ret = 0;
1510                 break;
1511
1512         case EBT_SO_GET_ENTRIES:
1513         case EBT_SO_GET_INIT_ENTRIES:
1514                 ret = copy_everything_to_user(t, user, len, cmd);
1515                 mutex_unlock(&ebt_mutex);
1516                 break;
1517
1518         default:
1519                 mutex_unlock(&ebt_mutex);
1520                 ret = -EINVAL;
1521         }
1522
1523         return ret;
1524 }
1525
1526 #ifdef CONFIG_COMPAT
1527 /* 32 bit-userspace compatibility definitions. */
1528 struct compat_ebt_replace {
1529         char name[EBT_TABLE_MAXNAMELEN];
1530         compat_uint_t valid_hooks;
1531         compat_uint_t nentries;
1532         compat_uint_t entries_size;
1533         /* start of the chains */
1534         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1535         /* nr of counters userspace expects back */
1536         compat_uint_t num_counters;
1537         /* where the kernel will put the old counters. */
1538         compat_uptr_t counters;
1539         compat_uptr_t entries;
1540 };
1541
1542 /* struct ebt_entry_match, _target and _watcher have same layout */
1543 struct compat_ebt_entry_mwt {
1544         union {
1545                 char name[EBT_FUNCTION_MAXNAMELEN];
1546                 compat_uptr_t ptr;
1547         } u;
1548         compat_uint_t match_size;
1549         compat_uint_t data[0];
1550 };
1551
1552 /* account for possible padding between match_size and ->data */
1553 static int ebt_compat_entry_padsize(void)
1554 {
1555         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1556                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1557         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1558                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1559 }
1560
1561 static int ebt_compat_match_offset(const struct xt_match *match,
1562                                    unsigned int userlen)
1563 {
1564         /*
1565          * ebt_among needs special handling. The kernel .matchsize is
1566          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1567          * value is expected.
1568          * Example: userspace sends 4500, ebt_among.c wants 4504.
1569          */
1570         if (unlikely(match->matchsize == -1))
1571                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1572         return xt_compat_match_offset(match);
1573 }
1574
1575 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1576                                 unsigned int *size)
1577 {
1578         const struct xt_match *match = m->u.match;
1579         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1580         int off = ebt_compat_match_offset(match, m->match_size);
1581         compat_uint_t msize = m->match_size - off;
1582
1583         BUG_ON(off >= m->match_size);
1584
1585         if (copy_to_user(cm->u.name, match->name,
1586             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1587                 return -EFAULT;
1588
1589         if (match->compat_to_user) {
1590                 if (match->compat_to_user(cm->data, m->data))
1591                         return -EFAULT;
1592         } else if (copy_to_user(cm->data, m->data, msize))
1593                         return -EFAULT;
1594
1595         *size -= ebt_compat_entry_padsize() + off;
1596         *dstptr = cm->data;
1597         *dstptr += msize;
1598         return 0;
1599 }
1600
1601 static int compat_target_to_user(struct ebt_entry_target *t,
1602                                  void __user **dstptr,
1603                                  unsigned int *size)
1604 {
1605         const struct xt_target *target = t->u.target;
1606         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1607         int off = xt_compat_target_offset(target);
1608         compat_uint_t tsize = t->target_size - off;
1609
1610         BUG_ON(off >= t->target_size);
1611
1612         if (copy_to_user(cm->u.name, target->name,
1613             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1614                 return -EFAULT;
1615
1616         if (target->compat_to_user) {
1617                 if (target->compat_to_user(cm->data, t->data))
1618                         return -EFAULT;
1619         } else if (copy_to_user(cm->data, t->data, tsize))
1620                 return -EFAULT;
1621
1622         *size -= ebt_compat_entry_padsize() + off;
1623         *dstptr = cm->data;
1624         *dstptr += tsize;
1625         return 0;
1626 }
1627
1628 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1629                                   void __user **dstptr,
1630                                   unsigned int *size)
1631 {
1632         return compat_target_to_user((struct ebt_entry_target *)w,
1633                                                         dstptr, size);
1634 }
1635
1636 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1637                                 unsigned int *size)
1638 {
1639         struct ebt_entry_target *t;
1640         struct ebt_entry __user *ce;
1641         u32 watchers_offset, target_offset, next_offset;
1642         compat_uint_t origsize;
1643         int ret;
1644
1645         if (e->bitmask == 0) {
1646                 if (*size < sizeof(struct ebt_entries))
1647                         return -EINVAL;
1648                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1649                         return -EFAULT;
1650
1651                 *dstptr += sizeof(struct ebt_entries);
1652                 *size -= sizeof(struct ebt_entries);
1653                 return 0;
1654         }
1655
1656         if (*size < sizeof(*ce))
1657                 return -EINVAL;
1658
1659         ce = (struct ebt_entry __user *)*dstptr;
1660         if (copy_to_user(ce, e, sizeof(*ce)))
1661                 return -EFAULT;
1662
1663         origsize = *size;
1664         *dstptr += sizeof(*ce);
1665
1666         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1667         if (ret)
1668                 return ret;
1669         watchers_offset = e->watchers_offset - (origsize - *size);
1670
1671         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1672         if (ret)
1673                 return ret;
1674         target_offset = e->target_offset - (origsize - *size);
1675
1676         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1677
1678         ret = compat_target_to_user(t, dstptr, size);
1679         if (ret)
1680                 return ret;
1681         next_offset = e->next_offset - (origsize - *size);
1682
1683         if (put_user(watchers_offset, &ce->watchers_offset) ||
1684             put_user(target_offset, &ce->target_offset) ||
1685             put_user(next_offset, &ce->next_offset))
1686                 return -EFAULT;
1687
1688         *size -= sizeof(*ce);
1689         return 0;
1690 }
1691
1692 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1693 {
1694         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1695         *off += ebt_compat_entry_padsize();
1696         return 0;
1697 }
1698
1699 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1700 {
1701         *off += xt_compat_target_offset(w->u.watcher);
1702         *off += ebt_compat_entry_padsize();
1703         return 0;
1704 }
1705
1706 static int compat_calc_entry(const struct ebt_entry *e,
1707                              const struct ebt_table_info *info,
1708                              const void *base,
1709                              struct compat_ebt_replace *newinfo)
1710 {
1711         const struct ebt_entry_target *t;
1712         unsigned int entry_offset;
1713         int off, ret, i;
1714
1715         if (e->bitmask == 0)
1716                 return 0;
1717
1718         off = 0;
1719         entry_offset = (void *)e - base;
1720
1721         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1722         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1723
1724         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1725
1726         off += xt_compat_target_offset(t->u.target);
1727         off += ebt_compat_entry_padsize();
1728
1729         newinfo->entries_size -= off;
1730
1731         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1732         if (ret)
1733                 return ret;
1734
1735         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1736                 const void *hookptr = info->hook_entry[i];
1737                 if (info->hook_entry[i] &&
1738                     (e < (struct ebt_entry *)(base - hookptr))) {
1739                         newinfo->hook_entry[i] -= off;
1740                         pr_debug("0x%08X -> 0x%08X\n",
1741                                         newinfo->hook_entry[i] + off,
1742                                         newinfo->hook_entry[i]);
1743                 }
1744         }
1745
1746         return 0;
1747 }
1748
1749
1750 static int compat_table_info(const struct ebt_table_info *info,
1751                              struct compat_ebt_replace *newinfo)
1752 {
1753         unsigned int size = info->entries_size;
1754         const void *entries = info->entries;
1755
1756         newinfo->entries_size = size;
1757
1758         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1759                                                         entries, newinfo);
1760 }
1761
1762 static int compat_copy_everything_to_user(struct ebt_table *t,
1763                                           void __user *user, int *len, int cmd)
1764 {
1765         struct compat_ebt_replace repl, tmp;
1766         struct ebt_counter *oldcounters;
1767         struct ebt_table_info tinfo;
1768         int ret;
1769         void __user *pos;
1770
1771         memset(&tinfo, 0, sizeof(tinfo));
1772
1773         if (cmd == EBT_SO_GET_ENTRIES) {
1774                 tinfo.entries_size = t->private->entries_size;
1775                 tinfo.nentries = t->private->nentries;
1776                 tinfo.entries = t->private->entries;
1777                 oldcounters = t->private->counters;
1778         } else {
1779                 tinfo.entries_size = t->table->entries_size;
1780                 tinfo.nentries = t->table->nentries;
1781                 tinfo.entries = t->table->entries;
1782                 oldcounters = t->table->counters;
1783         }
1784
1785         if (copy_from_user(&tmp, user, sizeof(tmp)))
1786                 return -EFAULT;
1787
1788         if (tmp.nentries != tinfo.nentries ||
1789            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1790                 return -EINVAL;
1791
1792         memcpy(&repl, &tmp, sizeof(repl));
1793         if (cmd == EBT_SO_GET_ENTRIES)
1794                 ret = compat_table_info(t->private, &repl);
1795         else
1796                 ret = compat_table_info(&tinfo, &repl);
1797         if (ret)
1798                 return ret;
1799
1800         if (*len != sizeof(tmp) + repl.entries_size +
1801            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1802                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1803                                 *len, tinfo.entries_size, repl.entries_size);
1804                 return -EINVAL;
1805         }
1806
1807         /* userspace might not need the counters */
1808         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1809                                         tmp.num_counters, tinfo.nentries);
1810         if (ret)
1811                 return ret;
1812
1813         pos = compat_ptr(tmp.entries);
1814         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1815                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1816 }
1817
1818 struct ebt_entries_buf_state {
1819         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1820         u32 buf_kern_len;       /* total size of kernel buffer */
1821         u32 buf_kern_offset;    /* amount of data copied so far */
1822         u32 buf_user_offset;    /* read position in userspace buffer */
1823 };
1824
1825 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1826 {
1827         state->buf_kern_offset += sz;
1828         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1829 }
1830
1831 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1832                        void *data, unsigned int sz)
1833 {
1834         if (state->buf_kern_start == NULL)
1835                 goto count_only;
1836
1837         BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1838
1839         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1840
1841  count_only:
1842         state->buf_user_offset += sz;
1843         return ebt_buf_count(state, sz);
1844 }
1845
1846 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1847 {
1848         char *b = state->buf_kern_start;
1849
1850         BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1851
1852         if (b != NULL && sz > 0)
1853                 memset(b + state->buf_kern_offset, 0, sz);
1854         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1855         return ebt_buf_count(state, sz);
1856 }
1857
1858 enum compat_mwt {
1859         EBT_COMPAT_MATCH,
1860         EBT_COMPAT_WATCHER,
1861         EBT_COMPAT_TARGET,
1862 };
1863
1864 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1865                                 enum compat_mwt compat_mwt,
1866                                 struct ebt_entries_buf_state *state,
1867                                 const unsigned char *base)
1868 {
1869         char name[EBT_FUNCTION_MAXNAMELEN];
1870         struct xt_match *match;
1871         struct xt_target *wt;
1872         void *dst = NULL;
1873         int off, pad = 0, ret = 0;
1874         unsigned int size_kern, entry_offset, match_size = mwt->match_size;
1875
1876         strlcpy(name, mwt->u.name, sizeof(name));
1877
1878         if (state->buf_kern_start)
1879                 dst = state->buf_kern_start + state->buf_kern_offset;
1880
1881         entry_offset = (unsigned char *) mwt - base;
1882         switch (compat_mwt) {
1883         case EBT_COMPAT_MATCH:
1884                 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
1885                                                 name, 0), "ebt_%s", name);
1886                 if (match == NULL)
1887                         return -ENOENT;
1888                 if (IS_ERR(match))
1889                         return PTR_ERR(match);
1890
1891                 off = ebt_compat_match_offset(match, match_size);
1892                 if (dst) {
1893                         if (match->compat_from_user)
1894                                 match->compat_from_user(dst, mwt->data);
1895                         else
1896                                 memcpy(dst, mwt->data, match_size);
1897                 }
1898
1899                 size_kern = match->matchsize;
1900                 if (unlikely(size_kern == -1))
1901                         size_kern = match_size;
1902                 module_put(match->me);
1903                 break;
1904         case EBT_COMPAT_WATCHER: /* fallthrough */
1905         case EBT_COMPAT_TARGET:
1906                 wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
1907                                                 name, 0), "ebt_%s", name);
1908                 if (wt == NULL)
1909                         return -ENOENT;
1910                 if (IS_ERR(wt))
1911                         return PTR_ERR(wt);
1912                 off = xt_compat_target_offset(wt);
1913
1914                 if (dst) {
1915                         if (wt->compat_from_user)
1916                                 wt->compat_from_user(dst, mwt->data);
1917                         else
1918                                 memcpy(dst, mwt->data, match_size);
1919                 }
1920
1921                 size_kern = wt->targetsize;
1922                 module_put(wt->me);
1923                 break;
1924         }
1925
1926         if (!dst) {
1927                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset,
1928                                         off + ebt_compat_entry_padsize());
1929                 if (ret < 0)
1930                         return ret;
1931         }
1932
1933         state->buf_kern_offset += match_size + off;
1934         state->buf_user_offset += match_size;
1935         pad = XT_ALIGN(size_kern) - size_kern;
1936
1937         if (pad > 0 && dst) {
1938                 BUG_ON(state->buf_kern_len <= pad);
1939                 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1940                 memset(dst + size_kern, 0, pad);
1941         }
1942         return off + match_size;
1943 }
1944
1945 /*
1946  * return size of all matches, watchers or target, including necessary
1947  * alignment and padding.
1948  */
1949 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1950                         unsigned int size_left, enum compat_mwt type,
1951                         struct ebt_entries_buf_state *state, const void *base)
1952 {
1953         int growth = 0;
1954         char *buf;
1955
1956         if (size_left == 0)
1957                 return 0;
1958
1959         buf = (char *) match32;
1960
1961         while (size_left >= sizeof(*match32)) {
1962                 struct ebt_entry_match *match_kern;
1963                 int ret;
1964
1965                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1966                 if (match_kern) {
1967                         char *tmp;
1968                         tmp = state->buf_kern_start + state->buf_kern_offset;
1969                         match_kern = (struct ebt_entry_match *) tmp;
1970                 }
1971                 ret = ebt_buf_add(state, buf, sizeof(*match32));
1972                 if (ret < 0)
1973                         return ret;
1974                 size_left -= sizeof(*match32);
1975
1976                 /* add padding before match->data (if any) */
1977                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1978                 if (ret < 0)
1979                         return ret;
1980
1981                 if (match32->match_size > size_left)
1982                         return -EINVAL;
1983
1984                 size_left -= match32->match_size;
1985
1986                 ret = compat_mtw_from_user(match32, type, state, base);
1987                 if (ret < 0)
1988                         return ret;
1989
1990                 BUG_ON(ret < match32->match_size);
1991                 growth += ret - match32->match_size;
1992                 growth += ebt_compat_entry_padsize();
1993
1994                 buf += sizeof(*match32);
1995                 buf += match32->match_size;
1996
1997                 if (match_kern)
1998                         match_kern->match_size = ret;
1999
2000                 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2001                 match32 = (struct compat_ebt_entry_mwt *) buf;
2002         }
2003
2004         return growth;
2005 }
2006
2007 #define EBT_COMPAT_WATCHER_ITERATE(e, fn, args...)          \
2008 ({                                                          \
2009         unsigned int __i;                                   \
2010         int __ret = 0;                                      \
2011         struct compat_ebt_entry_mwt *__watcher;             \
2012                                                             \
2013         for (__i = e->watchers_offset;                      \
2014              __i < (e)->target_offset;                      \
2015              __i += __watcher->watcher_size +               \
2016              sizeof(struct compat_ebt_entry_mwt)) {         \
2017                 __watcher = (void *)(e) + __i;              \
2018                 __ret = fn(__watcher , ## args);            \
2019                 if (__ret != 0)                             \
2020                         break;                              \
2021         }                                                   \
2022         if (__ret == 0) {                                   \
2023                 if (__i != (e)->target_offset)              \
2024                         __ret = -EINVAL;                    \
2025         }                                                   \
2026         __ret;                                              \
2027 })
2028
2029 #define EBT_COMPAT_MATCH_ITERATE(e, fn, args...)            \
2030 ({                                                          \
2031         unsigned int __i;                                   \
2032         int __ret = 0;                                      \
2033         struct compat_ebt_entry_mwt *__match;               \
2034                                                             \
2035         for (__i = sizeof(struct ebt_entry);                \
2036              __i < (e)->watchers_offset;                    \
2037              __i += __match->match_size +                   \
2038              sizeof(struct compat_ebt_entry_mwt)) {         \
2039                 __match = (void *)(e) + __i;                \
2040                 __ret = fn(__match , ## args);              \
2041                 if (__ret != 0)                             \
2042                         break;                              \
2043         }                                                   \
2044         if (__ret == 0) {                                   \
2045                 if (__i != (e)->watchers_offset)            \
2046                         __ret = -EINVAL;                    \
2047         }                                                   \
2048         __ret;                                              \
2049 })
2050
2051 /* called for all ebt_entry structures. */
2052 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2053                           unsigned int *total,
2054                           struct ebt_entries_buf_state *state)
2055 {
2056         unsigned int i, j, startoff, new_offset = 0;
2057         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2058         unsigned int offsets[4];
2059         unsigned int *offsets_update = NULL;
2060         int ret;
2061         char *buf_start;
2062
2063         if (*total < sizeof(struct ebt_entries))
2064                 return -EINVAL;
2065
2066         if (!entry->bitmask) {
2067                 *total -= sizeof(struct ebt_entries);
2068                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2069         }
2070         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2071                 return -EINVAL;
2072
2073         startoff = state->buf_user_offset;
2074         /* pull in most part of ebt_entry, it does not need to be changed. */
2075         ret = ebt_buf_add(state, entry,
2076                         offsetof(struct ebt_entry, watchers_offset));
2077         if (ret < 0)
2078                 return ret;
2079
2080         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2081         memcpy(&offsets[1], &entry->watchers_offset,
2082                         sizeof(offsets) - sizeof(offsets[0]));
2083
2084         if (state->buf_kern_start) {
2085                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2086                 offsets_update = (unsigned int *) buf_start;
2087         }
2088         ret = ebt_buf_add(state, &offsets[1],
2089                         sizeof(offsets) - sizeof(offsets[0]));
2090         if (ret < 0)
2091                 return ret;
2092         buf_start = (char *) entry;
2093         /*
2094          * 0: matches offset, always follows ebt_entry.
2095          * 1: watchers offset, from ebt_entry structure
2096          * 2: target offset, from ebt_entry structure
2097          * 3: next ebt_entry offset, from ebt_entry structure
2098          *
2099          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2100          */
2101         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2102                 struct compat_ebt_entry_mwt *match32;
2103                 unsigned int size;
2104                 char *buf = buf_start;
2105
2106                 buf = buf_start + offsets[i];
2107                 if (offsets[i] > offsets[j])
2108                         return -EINVAL;
2109
2110                 match32 = (struct compat_ebt_entry_mwt *) buf;
2111                 size = offsets[j] - offsets[i];
2112                 ret = ebt_size_mwt(match32, size, i, state, base);
2113                 if (ret < 0)
2114                         return ret;
2115                 new_offset += ret;
2116                 if (offsets_update && new_offset) {
2117                         pr_debug("change offset %d to %d\n",
2118                                 offsets_update[i], offsets[j] + new_offset);
2119                         offsets_update[i] = offsets[j] + new_offset;
2120                 }
2121         }
2122
2123         startoff = state->buf_user_offset - startoff;
2124
2125         BUG_ON(*total < startoff);
2126         *total -= startoff;
2127         return 0;
2128 }
2129
2130 /*
2131  * repl->entries_size is the size of the ebt_entry blob in userspace.
2132  * It might need more memory when copied to a 64 bit kernel in case
2133  * userspace is 32-bit. So, first task: find out how much memory is needed.
2134  *
2135  * Called before validation is performed.
2136  */
2137 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2138                                 struct ebt_entries_buf_state *state)
2139 {
2140         unsigned int size_remaining = size_user;
2141         int ret;
2142
2143         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2144                                         &size_remaining, state);
2145         if (ret < 0)
2146                 return ret;
2147
2148         WARN_ON(size_remaining);
2149         return state->buf_kern_offset;
2150 }
2151
2152
2153 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2154                                             void __user *user, unsigned int len)
2155 {
2156         struct compat_ebt_replace tmp;
2157         int i;
2158
2159         if (len < sizeof(tmp))
2160                 return -EINVAL;
2161
2162         if (copy_from_user(&tmp, user, sizeof(tmp)))
2163                 return -EFAULT;
2164
2165         if (len != sizeof(tmp) + tmp.entries_size)
2166                 return -EINVAL;
2167
2168         if (tmp.entries_size == 0)
2169                 return -EINVAL;
2170
2171         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2172                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2173                 return -ENOMEM;
2174         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2175                 return -ENOMEM;
2176
2177         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2178
2179         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2180         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2181                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2182
2183         repl->num_counters = tmp.num_counters;
2184         repl->counters = compat_ptr(tmp.counters);
2185         repl->entries = compat_ptr(tmp.entries);
2186         return 0;
2187 }
2188
2189 static int compat_do_replace(struct net *net, void __user *user,
2190                              unsigned int len)
2191 {
2192         int ret, i, countersize, size64;
2193         struct ebt_table_info *newinfo;
2194         struct ebt_replace tmp;
2195         struct ebt_entries_buf_state state;
2196         void *entries_tmp;
2197
2198         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2199         if (ret) {
2200                 /* try real handler in case userland supplied needed padding */
2201                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2202                         ret = 0;
2203                 return ret;
2204         }
2205
2206         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2207         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2208         if (!newinfo)
2209                 return -ENOMEM;
2210
2211         if (countersize)
2212                 memset(newinfo->counters, 0, countersize);
2213
2214         memset(&state, 0, sizeof(state));
2215
2216         newinfo->entries = vmalloc(tmp.entries_size);
2217         if (!newinfo->entries) {
2218                 ret = -ENOMEM;
2219                 goto free_newinfo;
2220         }
2221         if (copy_from_user(
2222            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2223                 ret = -EFAULT;
2224                 goto free_entries;
2225         }
2226
2227         entries_tmp = newinfo->entries;
2228
2229         xt_compat_lock(NFPROTO_BRIDGE);
2230
2231         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2232         if (ret < 0)
2233                 goto out_unlock;
2234
2235         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2236                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2237                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2238
2239         size64 = ret;
2240         newinfo->entries = vmalloc(size64);
2241         if (!newinfo->entries) {
2242                 vfree(entries_tmp);
2243                 ret = -ENOMEM;
2244                 goto out_unlock;
2245         }
2246
2247         memset(&state, 0, sizeof(state));
2248         state.buf_kern_start = newinfo->entries;
2249         state.buf_kern_len = size64;
2250
2251         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2252         BUG_ON(ret < 0);        /* parses same data again */
2253
2254         vfree(entries_tmp);
2255         tmp.entries_size = size64;
2256
2257         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2258                 char __user *usrptr;
2259                 if (tmp.hook_entry[i]) {
2260                         unsigned int delta;
2261                         usrptr = (char __user *) tmp.hook_entry[i];
2262                         delta = usrptr - tmp.entries;
2263                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2264                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2265                 }
2266         }
2267
2268         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2269         xt_compat_unlock(NFPROTO_BRIDGE);
2270
2271         ret = do_replace_finish(net, &tmp, newinfo);
2272         if (ret == 0)
2273                 return ret;
2274 free_entries:
2275         vfree(newinfo->entries);
2276 free_newinfo:
2277         vfree(newinfo);
2278         return ret;
2279 out_unlock:
2280         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2281         xt_compat_unlock(NFPROTO_BRIDGE);
2282         goto free_entries;
2283 }
2284
2285 static int compat_update_counters(struct net *net, void __user *user,
2286                                   unsigned int len)
2287 {
2288         struct compat_ebt_replace hlp;
2289
2290         if (copy_from_user(&hlp, user, sizeof(hlp)))
2291                 return -EFAULT;
2292
2293         /* try real handler in case userland supplied needed padding */
2294         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2295                 return update_counters(net, user, len);
2296
2297         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2298                                         hlp.num_counters, user, len);
2299 }
2300
2301 static int compat_do_ebt_set_ctl(struct sock *sk,
2302                 int cmd, void __user *user, unsigned int len)
2303 {
2304         int ret;
2305
2306         if (!capable(CAP_NET_ADMIN))
2307                 return -EPERM;
2308
2309         switch (cmd) {
2310         case EBT_SO_SET_ENTRIES:
2311                 ret = compat_do_replace(sock_net(sk), user, len);
2312                 break;
2313         case EBT_SO_SET_COUNTERS:
2314                 ret = compat_update_counters(sock_net(sk), user, len);
2315                 break;
2316         default:
2317                 ret = -EINVAL;
2318   }
2319         return ret;
2320 }
2321
2322 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2323                 void __user *user, int *len)
2324 {
2325         int ret;
2326         struct compat_ebt_replace tmp;
2327         struct ebt_table *t;
2328
2329         if (!capable(CAP_NET_ADMIN))
2330                 return -EPERM;
2331
2332         /* try real handler in case userland supplied needed padding */
2333         if ((cmd == EBT_SO_GET_INFO ||
2334              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2335                         return do_ebt_get_ctl(sk, cmd, user, len);
2336
2337         if (copy_from_user(&tmp, user, sizeof(tmp)))
2338                 return -EFAULT;
2339
2340         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
2341         if (!t)
2342                 return ret;
2343
2344         xt_compat_lock(NFPROTO_BRIDGE);
2345         switch (cmd) {
2346         case EBT_SO_GET_INFO:
2347                 tmp.nentries = t->private->nentries;
2348                 ret = compat_table_info(t->private, &tmp);
2349                 if (ret)
2350                         goto out;
2351                 tmp.valid_hooks = t->valid_hooks;
2352
2353                 if (copy_to_user(user, &tmp, *len) != 0) {
2354                         ret = -EFAULT;
2355                         break;
2356                 }
2357                 ret = 0;
2358                 break;
2359         case EBT_SO_GET_INIT_INFO:
2360                 tmp.nentries = t->table->nentries;
2361                 tmp.entries_size = t->table->entries_size;
2362                 tmp.valid_hooks = t->table->valid_hooks;
2363
2364                 if (copy_to_user(user, &tmp, *len) != 0) {
2365                         ret = -EFAULT;
2366                         break;
2367                 }
2368                 ret = 0;
2369                 break;
2370         case EBT_SO_GET_ENTRIES:
2371         case EBT_SO_GET_INIT_ENTRIES:
2372                 /*
2373                  * try real handler first in case of userland-side padding.
2374                  * in case we are dealing with an 'ordinary' 32 bit binary
2375                  * without 64bit compatibility padding, this will fail right
2376                  * after copy_from_user when the *len argument is validated.
2377                  *
2378                  * the compat_ variant needs to do one pass over the kernel
2379                  * data set to adjust for size differences before it the check.
2380                  */
2381                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2382                         ret = 0;
2383                 else
2384                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2385                 break;
2386         default:
2387                 ret = -EINVAL;
2388         }
2389  out:
2390         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2391         xt_compat_unlock(NFPROTO_BRIDGE);
2392         mutex_unlock(&ebt_mutex);
2393         return ret;
2394 }
2395 #endif
2396
2397 static struct nf_sockopt_ops ebt_sockopts =
2398 {
2399         .pf             = PF_INET,
2400         .set_optmin     = EBT_BASE_CTL,
2401         .set_optmax     = EBT_SO_SET_MAX + 1,
2402         .set            = do_ebt_set_ctl,
2403 #ifdef CONFIG_COMPAT
2404         .compat_set     = compat_do_ebt_set_ctl,
2405 #endif
2406         .get_optmin     = EBT_BASE_CTL,
2407         .get_optmax     = EBT_SO_GET_MAX + 1,
2408         .get            = do_ebt_get_ctl,
2409 #ifdef CONFIG_COMPAT
2410         .compat_get     = compat_do_ebt_get_ctl,
2411 #endif
2412         .owner          = THIS_MODULE,
2413 };
2414
2415 static int __init ebtables_init(void)
2416 {
2417         int ret;
2418
2419         ret = xt_register_target(&ebt_standard_target);
2420         if (ret < 0)
2421                 return ret;
2422         ret = nf_register_sockopt(&ebt_sockopts);
2423         if (ret < 0) {
2424                 xt_unregister_target(&ebt_standard_target);
2425                 return ret;
2426         }
2427
2428         printk(KERN_INFO "Ebtables v2.0 registered\n");
2429         return 0;
2430 }
2431
2432 static void __exit ebtables_fini(void)
2433 {
2434         nf_unregister_sockopt(&ebt_sockopts);
2435         xt_unregister_target(&ebt_standard_target);
2436         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2437 }
2438
2439 EXPORT_SYMBOL(ebt_register_table);
2440 EXPORT_SYMBOL(ebt_unregister_table);
2441 EXPORT_SYMBOL(ebt_do_table);
2442 module_init(ebtables_init);
2443 module_exit(ebtables_fini);
2444 MODULE_LICENSE("GPL");