ebtables.c 62 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * ebtables
  4. *
  5. * Author:
  6. * Bart De Schuymer <bdschuym@pandora.be>
  7. *
  8. * ebtables.c,v 2.0, July, 2002
  9. *
  10. * This code is strongly inspired by the iptables code which is
  11. * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  12. */
  13. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14. #include <linux/kmod.h>
  15. #include <linux/module.h>
  16. #include <linux/vmalloc.h>
  17. #include <linux/netfilter/x_tables.h>
  18. #include <linux/netfilter_bridge/ebtables.h>
  19. #include <linux/spinlock.h>
  20. #include <linux/mutex.h>
  21. #include <linux/slab.h>
  22. #include <linux/uaccess.h>
  23. #include <linux/smp.h>
  24. #include <linux/cpumask.h>
  25. #include <linux/audit.h>
  26. #include <net/sock.h>
  27. /* needed for logical [in,out]-dev filtering */
  28. #include "../br_private.h"
  29. /* Each cpu has its own set of counters, so there is no need for write_lock in
  30. * the softirq
  31. * For reading or updating the counters, the user context needs to
  32. * get a write_lock
  33. */
  34. /* The size of each set of counters is altered to get cache alignment */
  35. #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  36. #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  37. #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  38. COUNTER_OFFSET(n) * cpu))
  39. static DEFINE_MUTEX(ebt_mutex);
  40. #ifdef CONFIG_COMPAT
  41. static void ebt_standard_compat_from_user(void *dst, const void *src)
  42. {
  43. int v = *(compat_int_t *)src;
  44. if (v >= 0)
  45. v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  46. memcpy(dst, &v, sizeof(v));
  47. }
  48. static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  49. {
  50. compat_int_t cv = *(int *)src;
  51. if (cv >= 0)
  52. cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  53. return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  54. }
  55. #endif
  56. static struct xt_target ebt_standard_target = {
  57. .name = "standard",
  58. .revision = 0,
  59. .family = NFPROTO_BRIDGE,
  60. .targetsize = sizeof(int),
  61. #ifdef CONFIG_COMPAT
  62. .compatsize = sizeof(compat_int_t),
  63. .compat_from_user = ebt_standard_compat_from_user,
  64. .compat_to_user = ebt_standard_compat_to_user,
  65. #endif
  66. };
  67. static inline int
  68. ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  69. struct xt_action_param *par)
  70. {
  71. par->target = w->u.watcher;
  72. par->targinfo = w->data;
  73. w->u.watcher->target(skb, par);
  74. /* watchers don't give a verdict */
  75. return 0;
  76. }
  77. static inline int
  78. ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
  79. struct xt_action_param *par)
  80. {
  81. par->match = m->u.match;
  82. par->matchinfo = m->data;
  83. return !m->u.match->match(skb, par);
  84. }
  85. static inline int
  86. ebt_dev_check(const char *entry, const struct net_device *device)
  87. {
  88. int i = 0;
  89. const char *devname;
  90. if (*entry == '\0')
  91. return 0;
  92. if (!device)
  93. return 1;
  94. devname = device->name;
  95. /* 1 is the wildcard token */
  96. while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
  97. i++;
  98. return devname[i] != entry[i] && entry[i] != 1;
  99. }
  100. /* process standard matches */
  101. static inline int
  102. ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
  103. const struct net_device *in, const struct net_device *out)
  104. {
  105. const struct ethhdr *h = eth_hdr(skb);
  106. const struct net_bridge_port *p;
  107. __be16 ethproto;
  108. if (skb_vlan_tag_present(skb))
  109. ethproto = htons(ETH_P_8021Q);
  110. else
  111. ethproto = h->h_proto;
  112. if (e->bitmask & EBT_802_3) {
  113. if (NF_INVF(e, EBT_IPROTO, eth_proto_is_802_3(ethproto)))
  114. return 1;
  115. } else if (!(e->bitmask & EBT_NOPROTO) &&
  116. NF_INVF(e, EBT_IPROTO, e->ethproto != ethproto))
  117. return 1;
  118. if (NF_INVF(e, EBT_IIN, ebt_dev_check(e->in, in)))
  119. return 1;
  120. if (NF_INVF(e, EBT_IOUT, ebt_dev_check(e->out, out)))
  121. return 1;
  122. /* rcu_read_lock()ed by nf_hook_thresh */
  123. if (in && (p = br_port_get_rcu(in)) != NULL &&
  124. NF_INVF(e, EBT_ILOGICALIN,
  125. ebt_dev_check(e->logical_in, p->br->dev)))
  126. return 1;
  127. if (out && (p = br_port_get_rcu(out)) != NULL &&
  128. NF_INVF(e, EBT_ILOGICALOUT,
  129. ebt_dev_check(e->logical_out, p->br->dev)))
  130. return 1;
  131. if (e->bitmask & EBT_SOURCEMAC) {
  132. if (NF_INVF(e, EBT_ISOURCE,
  133. !ether_addr_equal_masked(h->h_source, e->sourcemac,
  134. e->sourcemsk)))
  135. return 1;
  136. }
  137. if (e->bitmask & EBT_DESTMAC) {
  138. if (NF_INVF(e, EBT_IDEST,
  139. !ether_addr_equal_masked(h->h_dest, e->destmac,
  140. e->destmsk)))
  141. return 1;
  142. }
  143. return 0;
  144. }
  145. static inline
  146. struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
  147. {
  148. return (void *)entry + entry->next_offset;
  149. }
  150. static inline const struct ebt_entry_target *
  151. ebt_get_target_c(const struct ebt_entry *e)
  152. {
  153. return ebt_get_target((struct ebt_entry *)e);
  154. }
  155. /* Do some firewalling */
  156. unsigned int ebt_do_table(struct sk_buff *skb,
  157. const struct nf_hook_state *state,
  158. struct ebt_table *table)
  159. {
  160. unsigned int hook = state->hook;
  161. int i, nentries;
  162. struct ebt_entry *point;
  163. struct ebt_counter *counter_base, *cb_base;
  164. const struct ebt_entry_target *t;
  165. int verdict, sp = 0;
  166. struct ebt_chainstack *cs;
  167. struct ebt_entries *chaininfo;
  168. const char *base;
  169. const struct ebt_table_info *private;
  170. struct xt_action_param acpar;
  171. acpar.state = state;
  172. acpar.hotdrop = false;
  173. read_lock_bh(&table->lock);
  174. private = table->private;
  175. cb_base = COUNTER_BASE(private->counters, private->nentries,
  176. smp_processor_id());
  177. if (private->chainstack)
  178. cs = private->chainstack[smp_processor_id()];
  179. else
  180. cs = NULL;
  181. chaininfo = private->hook_entry[hook];
  182. nentries = private->hook_entry[hook]->nentries;
  183. point = (struct ebt_entry *)(private->hook_entry[hook]->data);
  184. counter_base = cb_base + private->hook_entry[hook]->counter_offset;
  185. /* base for chain jumps */
  186. base = private->entries;
  187. i = 0;
  188. while (i < nentries) {
  189. if (ebt_basic_match(point, skb, state->in, state->out))
  190. goto letscontinue;
  191. if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
  192. goto letscontinue;
  193. if (acpar.hotdrop) {
  194. read_unlock_bh(&table->lock);
  195. return NF_DROP;
  196. }
  197. ADD_COUNTER(*(counter_base + i), skb->len, 1);
  198. /* these should only watch: not modify, nor tell us
  199. * what to do with the packet
  200. */
  201. EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
  202. t = ebt_get_target_c(point);
  203. /* standard target */
  204. if (!t->u.target->target)
  205. verdict = ((struct ebt_standard_target *)t)->verdict;
  206. else {
  207. acpar.target = t->u.target;
  208. acpar.targinfo = t->data;
  209. verdict = t->u.target->target(skb, &acpar);
  210. }
  211. if (verdict == EBT_ACCEPT) {
  212. read_unlock_bh(&table->lock);
  213. return NF_ACCEPT;
  214. }
  215. if (verdict == EBT_DROP) {
  216. read_unlock_bh(&table->lock);
  217. return NF_DROP;
  218. }
  219. if (verdict == EBT_RETURN) {
  220. letsreturn:
  221. if (WARN(sp == 0, "RETURN on base chain")) {
  222. /* act like this is EBT_CONTINUE */
  223. goto letscontinue;
  224. }
  225. sp--;
  226. /* put all the local variables right */
  227. i = cs[sp].n;
  228. chaininfo = cs[sp].chaininfo;
  229. nentries = chaininfo->nentries;
  230. point = cs[sp].e;
  231. counter_base = cb_base +
  232. chaininfo->counter_offset;
  233. continue;
  234. }
  235. if (verdict == EBT_CONTINUE)
  236. goto letscontinue;
  237. if (WARN(verdict < 0, "bogus standard verdict\n")) {
  238. read_unlock_bh(&table->lock);
  239. return NF_DROP;
  240. }
  241. /* jump to a udc */
  242. cs[sp].n = i + 1;
  243. cs[sp].chaininfo = chaininfo;
  244. cs[sp].e = ebt_next_entry(point);
  245. i = 0;
  246. chaininfo = (struct ebt_entries *) (base + verdict);
  247. if (WARN(chaininfo->distinguisher, "jump to non-chain\n")) {
  248. read_unlock_bh(&table->lock);
  249. return NF_DROP;
  250. }
  251. nentries = chaininfo->nentries;
  252. point = (struct ebt_entry *)chaininfo->data;
  253. counter_base = cb_base + chaininfo->counter_offset;
  254. sp++;
  255. continue;
  256. letscontinue:
  257. point = ebt_next_entry(point);
  258. i++;
  259. }
  260. /* I actually like this :) */
  261. if (chaininfo->policy == EBT_RETURN)
  262. goto letsreturn;
  263. if (chaininfo->policy == EBT_ACCEPT) {
  264. read_unlock_bh(&table->lock);
  265. return NF_ACCEPT;
  266. }
  267. read_unlock_bh(&table->lock);
  268. return NF_DROP;
  269. }
  270. /* If it succeeds, returns element and locks mutex */
  271. static inline void *
  272. find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
  273. struct mutex *mutex)
  274. {
  275. struct {
  276. struct list_head list;
  277. char name[EBT_FUNCTION_MAXNAMELEN];
  278. } *e;
  279. mutex_lock(mutex);
  280. list_for_each_entry(e, head, list) {
  281. if (strcmp(e->name, name) == 0)
  282. return e;
  283. }
  284. *error = -ENOENT;
  285. mutex_unlock(mutex);
  286. return NULL;
  287. }
  288. static void *
  289. find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
  290. int *error, struct mutex *mutex)
  291. {
  292. return try_then_request_module(
  293. find_inlist_lock_noload(head, name, error, mutex),
  294. "%s%s", prefix, name);
  295. }
  296. static inline struct ebt_table *
  297. find_table_lock(struct net *net, const char *name, int *error,
  298. struct mutex *mutex)
  299. {
  300. return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
  301. "ebtable_", error, mutex);
  302. }
  303. static inline void ebt_free_table_info(struct ebt_table_info *info)
  304. {
  305. int i;
  306. if (info->chainstack) {
  307. for_each_possible_cpu(i)
  308. vfree(info->chainstack[i]);
  309. vfree(info->chainstack);
  310. }
  311. }
  312. static inline int
  313. ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
  314. unsigned int *cnt)
  315. {
  316. const struct ebt_entry *e = par->entryinfo;
  317. struct xt_match *match;
  318. size_t left = ((char *)e + e->watchers_offset) - (char *)m;
  319. int ret;
  320. if (left < sizeof(struct ebt_entry_match) ||
  321. left - sizeof(struct ebt_entry_match) < m->match_size)
  322. return -EINVAL;
  323. match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision);
  324. if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
  325. if (!IS_ERR(match))
  326. module_put(match->me);
  327. request_module("ebt_%s", m->u.name);
  328. match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision);
  329. }
  330. if (IS_ERR(match))
  331. return PTR_ERR(match);
  332. m->u.match = match;
  333. par->match = match;
  334. par->matchinfo = m->data;
  335. ret = xt_check_match(par, m->match_size,
  336. ntohs(e->ethproto), e->invflags & EBT_IPROTO);
  337. if (ret < 0) {
  338. module_put(match->me);
  339. return ret;
  340. }
  341. (*cnt)++;
  342. return 0;
  343. }
  344. static inline int
  345. ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
  346. unsigned int *cnt)
  347. {
  348. const struct ebt_entry *e = par->entryinfo;
  349. struct xt_target *watcher;
  350. size_t left = ((char *)e + e->target_offset) - (char *)w;
  351. int ret;
  352. if (left < sizeof(struct ebt_entry_watcher) ||
  353. left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
  354. return -EINVAL;
  355. watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
  356. if (IS_ERR(watcher))
  357. return PTR_ERR(watcher);
  358. if (watcher->family != NFPROTO_BRIDGE) {
  359. module_put(watcher->me);
  360. return -ENOENT;
  361. }
  362. w->u.watcher = watcher;
  363. par->target = watcher;
  364. par->targinfo = w->data;
  365. ret = xt_check_target(par, w->watcher_size,
  366. ntohs(e->ethproto), e->invflags & EBT_IPROTO);
  367. if (ret < 0) {
  368. module_put(watcher->me);
  369. return ret;
  370. }
  371. (*cnt)++;
  372. return 0;
  373. }
  374. static int ebt_verify_pointers(const struct ebt_replace *repl,
  375. struct ebt_table_info *newinfo)
  376. {
  377. unsigned int limit = repl->entries_size;
  378. unsigned int valid_hooks = repl->valid_hooks;
  379. unsigned int offset = 0;
  380. int i;
  381. for (i = 0; i < NF_BR_NUMHOOKS; i++)
  382. newinfo->hook_entry[i] = NULL;
  383. newinfo->entries_size = repl->entries_size;
  384. newinfo->nentries = repl->nentries;
  385. while (offset < limit) {
  386. size_t left = limit - offset;
  387. struct ebt_entry *e = (void *)newinfo->entries + offset;
  388. if (left < sizeof(unsigned int))
  389. break;
  390. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  391. if ((valid_hooks & (1 << i)) == 0)
  392. continue;
  393. if ((char __user *)repl->hook_entry[i] ==
  394. repl->entries + offset)
  395. break;
  396. }
  397. if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
  398. if (e->bitmask != 0) {
  399. /* we make userspace set this right,
  400. * so there is no misunderstanding
  401. */
  402. return -EINVAL;
  403. }
  404. if (i != NF_BR_NUMHOOKS)
  405. newinfo->hook_entry[i] = (struct ebt_entries *)e;
  406. if (left < sizeof(struct ebt_entries))
  407. break;
  408. offset += sizeof(struct ebt_entries);
  409. } else {
  410. if (left < sizeof(struct ebt_entry))
  411. break;
  412. if (left < e->next_offset)
  413. break;
  414. if (e->next_offset < sizeof(struct ebt_entry))
  415. return -EINVAL;
  416. offset += e->next_offset;
  417. }
  418. }
  419. if (offset != limit)
  420. return -EINVAL;
  421. /* check if all valid hooks have a chain */
  422. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  423. if (!newinfo->hook_entry[i] &&
  424. (valid_hooks & (1 << i)))
  425. return -EINVAL;
  426. }
  427. return 0;
  428. }
  429. /* this one is very careful, as it is the first function
  430. * to parse the userspace data
  431. */
  432. static inline int
  433. ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
  434. const struct ebt_table_info *newinfo,
  435. unsigned int *n, unsigned int *cnt,
  436. unsigned int *totalcnt, unsigned int *udc_cnt)
  437. {
  438. int i;
  439. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  440. if ((void *)e == (void *)newinfo->hook_entry[i])
  441. break;
  442. }
  443. /* beginning of a new chain
  444. * if i == NF_BR_NUMHOOKS it must be a user defined chain
  445. */
  446. if (i != NF_BR_NUMHOOKS || !e->bitmask) {
  447. /* this checks if the previous chain has as many entries
  448. * as it said it has
  449. */
  450. if (*n != *cnt)
  451. return -EINVAL;
  452. if (((struct ebt_entries *)e)->policy != EBT_DROP &&
  453. ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
  454. /* only RETURN from udc */
  455. if (i != NF_BR_NUMHOOKS ||
  456. ((struct ebt_entries *)e)->policy != EBT_RETURN)
  457. return -EINVAL;
  458. }
  459. if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
  460. (*udc_cnt)++;
  461. if (((struct ebt_entries *)e)->counter_offset != *totalcnt)
  462. return -EINVAL;
  463. *n = ((struct ebt_entries *)e)->nentries;
  464. *cnt = 0;
  465. return 0;
  466. }
  467. /* a plain old entry, heh */
  468. if (sizeof(struct ebt_entry) > e->watchers_offset ||
  469. e->watchers_offset > e->target_offset ||
  470. e->target_offset >= e->next_offset)
  471. return -EINVAL;
  472. /* this is not checked anywhere else */
  473. if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target))
  474. return -EINVAL;
  475. (*cnt)++;
  476. (*totalcnt)++;
  477. return 0;
  478. }
  479. struct ebt_cl_stack {
  480. struct ebt_chainstack cs;
  481. int from;
  482. unsigned int hookmask;
  483. };
  484. /* We need these positions to check that the jumps to a different part of the
  485. * entries is a jump to the beginning of a new chain.
  486. */
  487. static inline int
  488. ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
  489. unsigned int *n, struct ebt_cl_stack *udc)
  490. {
  491. int i;
  492. /* we're only interested in chain starts */
  493. if (e->bitmask)
  494. return 0;
  495. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  496. if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
  497. break;
  498. }
  499. /* only care about udc */
  500. if (i != NF_BR_NUMHOOKS)
  501. return 0;
  502. udc[*n].cs.chaininfo = (struct ebt_entries *)e;
  503. /* these initialisations are depended on later in check_chainloops() */
  504. udc[*n].cs.n = 0;
  505. udc[*n].hookmask = 0;
  506. (*n)++;
  507. return 0;
  508. }
  509. static inline int
  510. ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
  511. {
  512. struct xt_mtdtor_param par;
  513. if (i && (*i)-- == 0)
  514. return 1;
  515. par.net = net;
  516. par.match = m->u.match;
  517. par.matchinfo = m->data;
  518. par.family = NFPROTO_BRIDGE;
  519. if (par.match->destroy != NULL)
  520. par.match->destroy(&par);
  521. module_put(par.match->me);
  522. return 0;
  523. }
  524. static inline int
  525. ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
  526. {
  527. struct xt_tgdtor_param par;
  528. if (i && (*i)-- == 0)
  529. return 1;
  530. par.net = net;
  531. par.target = w->u.watcher;
  532. par.targinfo = w->data;
  533. par.family = NFPROTO_BRIDGE;
  534. if (par.target->destroy != NULL)
  535. par.target->destroy(&par);
  536. module_put(par.target->me);
  537. return 0;
  538. }
  539. static inline int
  540. ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
  541. {
  542. struct xt_tgdtor_param par;
  543. struct ebt_entry_target *t;
  544. if (e->bitmask == 0)
  545. return 0;
  546. /* we're done */
  547. if (cnt && (*cnt)-- == 0)
  548. return 1;
  549. EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
  550. EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
  551. t = ebt_get_target(e);
  552. par.net = net;
  553. par.target = t->u.target;
  554. par.targinfo = t->data;
  555. par.family = NFPROTO_BRIDGE;
  556. if (par.target->destroy != NULL)
  557. par.target->destroy(&par);
  558. module_put(par.target->me);
  559. return 0;
  560. }
  561. static inline int
  562. ebt_check_entry(struct ebt_entry *e, struct net *net,
  563. const struct ebt_table_info *newinfo,
  564. const char *name, unsigned int *cnt,
  565. struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
  566. {
  567. struct ebt_entry_target *t;
  568. struct xt_target *target;
  569. unsigned int i, j, hook = 0, hookmask = 0;
  570. size_t gap;
  571. int ret;
  572. struct xt_mtchk_param mtpar;
  573. struct xt_tgchk_param tgpar;
  574. /* don't mess with the struct ebt_entries */
  575. if (e->bitmask == 0)
  576. return 0;
  577. if (e->bitmask & ~EBT_F_MASK)
  578. return -EINVAL;
  579. if (e->invflags & ~EBT_INV_MASK)
  580. return -EINVAL;
  581. if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3))
  582. return -EINVAL;
  583. /* what hook do we belong to? */
  584. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  585. if (!newinfo->hook_entry[i])
  586. continue;
  587. if ((char *)newinfo->hook_entry[i] < (char *)e)
  588. hook = i;
  589. else
  590. break;
  591. }
  592. /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
  593. * a base chain
  594. */
  595. if (i < NF_BR_NUMHOOKS)
  596. hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
  597. else {
  598. for (i = 0; i < udc_cnt; i++)
  599. if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
  600. break;
  601. if (i == 0)
  602. hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
  603. else
  604. hookmask = cl_s[i - 1].hookmask;
  605. }
  606. i = 0;
  607. memset(&mtpar, 0, sizeof(mtpar));
  608. memset(&tgpar, 0, sizeof(tgpar));
  609. mtpar.net = tgpar.net = net;
  610. mtpar.table = tgpar.table = name;
  611. mtpar.entryinfo = tgpar.entryinfo = e;
  612. mtpar.hook_mask = tgpar.hook_mask = hookmask;
  613. mtpar.family = tgpar.family = NFPROTO_BRIDGE;
  614. ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
  615. if (ret != 0)
  616. goto cleanup_matches;
  617. j = 0;
  618. ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
  619. if (ret != 0)
  620. goto cleanup_watchers;
  621. t = ebt_get_target(e);
  622. gap = e->next_offset - e->target_offset;
  623. target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
  624. if (IS_ERR(target)) {
  625. ret = PTR_ERR(target);
  626. goto cleanup_watchers;
  627. }
  628. /* Reject UNSPEC, xtables verdicts/return values are incompatible */
  629. if (target->family != NFPROTO_BRIDGE) {
  630. module_put(target->me);
  631. ret = -ENOENT;
  632. goto cleanup_watchers;
  633. }
  634. t->u.target = target;
  635. if (t->u.target == &ebt_standard_target) {
  636. if (gap < sizeof(struct ebt_standard_target)) {
  637. ret = -EFAULT;
  638. goto cleanup_watchers;
  639. }
  640. if (((struct ebt_standard_target *)t)->verdict <
  641. -NUM_STANDARD_TARGETS) {
  642. ret = -EFAULT;
  643. goto cleanup_watchers;
  644. }
  645. } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
  646. module_put(t->u.target->me);
  647. ret = -EFAULT;
  648. goto cleanup_watchers;
  649. }
  650. tgpar.target = target;
  651. tgpar.targinfo = t->data;
  652. ret = xt_check_target(&tgpar, t->target_size,
  653. ntohs(e->ethproto), e->invflags & EBT_IPROTO);
  654. if (ret < 0) {
  655. module_put(target->me);
  656. goto cleanup_watchers;
  657. }
  658. (*cnt)++;
  659. return 0;
  660. cleanup_watchers:
  661. EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
  662. cleanup_matches:
  663. EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
  664. return ret;
  665. }
  666. /* checks for loops and sets the hook mask for udc
  667. * the hook mask for udc tells us from which base chains the udc can be
  668. * accessed. This mask is a parameter to the check() functions of the extensions
  669. */
  670. static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
  671. unsigned int udc_cnt, unsigned int hooknr, char *base)
  672. {
  673. int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
  674. const struct ebt_entry *e = (struct ebt_entry *)chain->data;
  675. const struct ebt_entry_target *t;
  676. while (pos < nentries || chain_nr != -1) {
  677. /* end of udc, go back one 'recursion' step */
  678. if (pos == nentries) {
  679. /* put back values of the time when this chain was called */
  680. e = cl_s[chain_nr].cs.e;
  681. if (cl_s[chain_nr].from != -1)
  682. nentries =
  683. cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
  684. else
  685. nentries = chain->nentries;
  686. pos = cl_s[chain_nr].cs.n;
  687. /* make sure we won't see a loop that isn't one */
  688. cl_s[chain_nr].cs.n = 0;
  689. chain_nr = cl_s[chain_nr].from;
  690. if (pos == nentries)
  691. continue;
  692. }
  693. t = ebt_get_target_c(e);
  694. if (strcmp(t->u.name, EBT_STANDARD_TARGET))
  695. goto letscontinue;
  696. if (e->target_offset + sizeof(struct ebt_standard_target) >
  697. e->next_offset)
  698. return -1;
  699. verdict = ((struct ebt_standard_target *)t)->verdict;
  700. if (verdict >= 0) { /* jump to another chain */
  701. struct ebt_entries *hlp2 =
  702. (struct ebt_entries *)(base + verdict);
  703. for (i = 0; i < udc_cnt; i++)
  704. if (hlp2 == cl_s[i].cs.chaininfo)
  705. break;
  706. /* bad destination or loop */
  707. if (i == udc_cnt)
  708. return -1;
  709. if (cl_s[i].cs.n)
  710. return -1;
  711. if (cl_s[i].hookmask & (1 << hooknr))
  712. goto letscontinue;
  713. /* this can't be 0, so the loop test is correct */
  714. cl_s[i].cs.n = pos + 1;
  715. pos = 0;
  716. cl_s[i].cs.e = ebt_next_entry(e);
  717. e = (struct ebt_entry *)(hlp2->data);
  718. nentries = hlp2->nentries;
  719. cl_s[i].from = chain_nr;
  720. chain_nr = i;
  721. /* this udc is accessible from the base chain for hooknr */
  722. cl_s[i].hookmask |= (1 << hooknr);
  723. continue;
  724. }
  725. letscontinue:
  726. e = ebt_next_entry(e);
  727. pos++;
  728. }
  729. return 0;
  730. }
  731. /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
  732. static int translate_table(struct net *net, const char *name,
  733. struct ebt_table_info *newinfo)
  734. {
  735. unsigned int i, j, k, udc_cnt;
  736. int ret;
  737. struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
  738. i = 0;
  739. while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
  740. i++;
  741. if (i == NF_BR_NUMHOOKS)
  742. return -EINVAL;
  743. if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries)
  744. return -EINVAL;
  745. /* make sure chains are ordered after each other in same order
  746. * as their corresponding hooks
  747. */
  748. for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
  749. if (!newinfo->hook_entry[j])
  750. continue;
  751. if (newinfo->hook_entry[j] <= newinfo->hook_entry[i])
  752. return -EINVAL;
  753. i = j;
  754. }
  755. /* do some early checkings and initialize some things */
  756. i = 0; /* holds the expected nr. of entries for the chain */
  757. j = 0; /* holds the up to now counted entries for the chain */
  758. k = 0; /* holds the total nr. of entries, should equal
  759. * newinfo->nentries afterwards
  760. */
  761. udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
  762. ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
  763. ebt_check_entry_size_and_hooks, newinfo,
  764. &i, &j, &k, &udc_cnt);
  765. if (ret != 0)
  766. return ret;
  767. if (i != j)
  768. return -EINVAL;
  769. if (k != newinfo->nentries)
  770. return -EINVAL;
  771. /* get the location of the udc, put them in an array
  772. * while we're at it, allocate the chainstack
  773. */
  774. if (udc_cnt) {
  775. /* this will get free'd in do_replace()/ebt_register_table()
  776. * if an error occurs
  777. */
  778. newinfo->chainstack =
  779. vmalloc(array_size(nr_cpu_ids,
  780. sizeof(*(newinfo->chainstack))));
  781. if (!newinfo->chainstack)
  782. return -ENOMEM;
  783. for_each_possible_cpu(i) {
  784. newinfo->chainstack[i] =
  785. vmalloc(array_size(udc_cnt, sizeof(*(newinfo->chainstack[0]))));
  786. if (!newinfo->chainstack[i]) {
  787. while (i)
  788. vfree(newinfo->chainstack[--i]);
  789. vfree(newinfo->chainstack);
  790. newinfo->chainstack = NULL;
  791. return -ENOMEM;
  792. }
  793. }
  794. cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s)));
  795. if (!cl_s)
  796. return -ENOMEM;
  797. i = 0; /* the i'th udc */
  798. EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
  799. ebt_get_udc_positions, newinfo, &i, cl_s);
  800. /* sanity check */
  801. if (i != udc_cnt) {
  802. vfree(cl_s);
  803. return -EFAULT;
  804. }
  805. }
  806. /* Check for loops */
  807. for (i = 0; i < NF_BR_NUMHOOKS; i++)
  808. if (newinfo->hook_entry[i])
  809. if (check_chainloops(newinfo->hook_entry[i],
  810. cl_s, udc_cnt, i, newinfo->entries)) {
  811. vfree(cl_s);
  812. return -EINVAL;
  813. }
  814. /* we now know the following (along with E=mc²):
  815. * - the nr of entries in each chain is right
  816. * - the size of the allocated space is right
  817. * - all valid hooks have a corresponding chain
  818. * - there are no loops
  819. * - wrong data can still be on the level of a single entry
  820. * - could be there are jumps to places that are not the
  821. * beginning of a chain. This can only occur in chains that
  822. * are not accessible from any base chains, so we don't care.
  823. */
  824. /* used to know what we need to clean up if something goes wrong */
  825. i = 0;
  826. ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
  827. ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
  828. if (ret != 0) {
  829. EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
  830. ebt_cleanup_entry, net, &i);
  831. }
  832. vfree(cl_s);
  833. return ret;
  834. }
  835. /* called under write_lock */
  836. static void get_counters(const struct ebt_counter *oldcounters,
  837. struct ebt_counter *counters, unsigned int nentries)
  838. {
  839. int i, cpu;
  840. struct ebt_counter *counter_base;
  841. /* counters of cpu 0 */
  842. memcpy(counters, oldcounters,
  843. sizeof(struct ebt_counter) * nentries);
  844. /* add other counters to those of cpu 0 */
  845. for_each_possible_cpu(cpu) {
  846. if (cpu == 0)
  847. continue;
  848. counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
  849. for (i = 0; i < nentries; i++)
  850. ADD_COUNTER(counters[i], counter_base[i].bcnt,
  851. counter_base[i].pcnt);
  852. }
  853. }
  854. static int do_replace_finish(struct net *net, struct ebt_replace *repl,
  855. struct ebt_table_info *newinfo)
  856. {
  857. int ret;
  858. struct ebt_counter *counterstmp = NULL;
  859. /* used to be able to unlock earlier */
  860. struct ebt_table_info *table;
  861. struct ebt_table *t;
  862. /* the user wants counters back
  863. * the check on the size is done later, when we have the lock
  864. */
  865. if (repl->num_counters) {
  866. unsigned long size = repl->num_counters * sizeof(*counterstmp);
  867. counterstmp = vmalloc(size);
  868. if (!counterstmp)
  869. return -ENOMEM;
  870. }
  871. newinfo->chainstack = NULL;
  872. ret = ebt_verify_pointers(repl, newinfo);
  873. if (ret != 0)
  874. goto free_counterstmp;
  875. ret = translate_table(net, repl->name, newinfo);
  876. if (ret != 0)
  877. goto free_counterstmp;
  878. t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
  879. if (!t) {
  880. ret = -ENOENT;
  881. goto free_iterate;
  882. }
  883. /* the table doesn't like it */
  884. if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
  885. goto free_unlock;
  886. if (repl->num_counters && repl->num_counters != t->private->nentries) {
  887. ret = -EINVAL;
  888. goto free_unlock;
  889. }
  890. /* we have the mutex lock, so no danger in reading this pointer */
  891. table = t->private;
  892. /* make sure the table can only be rmmod'ed if it contains no rules */
  893. if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
  894. ret = -ENOENT;
  895. goto free_unlock;
  896. } else if (table->nentries && !newinfo->nentries)
  897. module_put(t->me);
  898. /* we need an atomic snapshot of the counters */
  899. write_lock_bh(&t->lock);
  900. if (repl->num_counters)
  901. get_counters(t->private->counters, counterstmp,
  902. t->private->nentries);
  903. t->private = newinfo;
  904. write_unlock_bh(&t->lock);
  905. mutex_unlock(&ebt_mutex);
  906. /* so, a user can change the chains while having messed up her counter
  907. * allocation. Only reason why this is done is because this way the lock
  908. * is held only once, while this doesn't bring the kernel into a
  909. * dangerous state.
  910. */
  911. if (repl->num_counters &&
  912. copy_to_user(repl->counters, counterstmp,
  913. repl->num_counters * sizeof(struct ebt_counter))) {
  914. /* Silent error, can't fail, new table is already in place */
  915. net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
  916. }
  917. /* decrease module count and free resources */
  918. EBT_ENTRY_ITERATE(table->entries, table->entries_size,
  919. ebt_cleanup_entry, net, NULL);
  920. vfree(table->entries);
  921. ebt_free_table_info(table);
  922. vfree(table);
  923. vfree(counterstmp);
  924. audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries,
  925. AUDIT_XT_OP_REPLACE, GFP_KERNEL);
  926. return ret;
  927. free_unlock:
  928. mutex_unlock(&ebt_mutex);
  929. free_iterate:
  930. EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
  931. ebt_cleanup_entry, net, NULL);
  932. free_counterstmp:
  933. vfree(counterstmp);
  934. /* can be initialized in translate_table() */
  935. ebt_free_table_info(newinfo);
  936. return ret;
  937. }
  938. /* replace the table */
  939. static int do_replace(struct net *net, sockptr_t arg, unsigned int len)
  940. {
  941. int ret, countersize;
  942. struct ebt_table_info *newinfo;
  943. struct ebt_replace tmp;
  944. if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
  945. return -EFAULT;
  946. if (len != sizeof(tmp) + tmp.entries_size)
  947. return -EINVAL;
  948. if (tmp.entries_size == 0)
  949. return -EINVAL;
  950. /* overflow check */
  951. if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
  952. NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
  953. return -ENOMEM;
  954. if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
  955. return -ENOMEM;
  956. tmp.name[sizeof(tmp.name) - 1] = 0;
  957. countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
  958. newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT);
  959. if (!newinfo)
  960. return -ENOMEM;
  961. if (countersize)
  962. memset(newinfo->counters, 0, countersize);
  963. newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT);
  964. if (!newinfo->entries) {
  965. ret = -ENOMEM;
  966. goto free_newinfo;
  967. }
  968. if (copy_from_user(
  969. newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
  970. ret = -EFAULT;
  971. goto free_entries;
  972. }
  973. ret = do_replace_finish(net, &tmp, newinfo);
  974. if (ret == 0)
  975. return ret;
  976. free_entries:
  977. vfree(newinfo->entries);
  978. free_newinfo:
  979. vfree(newinfo);
  980. return ret;
  981. }
  982. static void __ebt_unregister_table(struct net *net, struct ebt_table *table)
  983. {
  984. mutex_lock(&ebt_mutex);
  985. list_del(&table->list);
  986. mutex_unlock(&ebt_mutex);
  987. audit_log_nfcfg(table->name, AF_BRIDGE, table->private->nentries,
  988. AUDIT_XT_OP_UNREGISTER, GFP_KERNEL);
  989. EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
  990. ebt_cleanup_entry, net, NULL);
  991. if (table->private->nentries)
  992. module_put(table->me);
  993. vfree(table->private->entries);
  994. ebt_free_table_info(table->private);
  995. vfree(table->private);
  996. kfree(table);
  997. }
  998. int ebt_register_table(struct net *net, const struct ebt_table *input_table,
  999. const struct nf_hook_ops *ops, struct ebt_table **res)
  1000. {
  1001. struct ebt_table_info *newinfo;
  1002. struct ebt_table *t, *table;
  1003. struct ebt_replace_kernel *repl;
  1004. int ret, i, countersize;
  1005. void *p;
  1006. if (input_table == NULL || (repl = input_table->table) == NULL ||
  1007. repl->entries == NULL || repl->entries_size == 0 ||
  1008. repl->counters != NULL || input_table->private != NULL)
  1009. return -EINVAL;
  1010. /* Don't add one table to multiple lists. */
  1011. table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
  1012. if (!table) {
  1013. ret = -ENOMEM;
  1014. goto out;
  1015. }
  1016. countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
  1017. newinfo = vmalloc(sizeof(*newinfo) + countersize);
  1018. ret = -ENOMEM;
  1019. if (!newinfo)
  1020. goto free_table;
  1021. p = vmalloc(repl->entries_size);
  1022. if (!p)
  1023. goto free_newinfo;
  1024. memcpy(p, repl->entries, repl->entries_size);
  1025. newinfo->entries = p;
  1026. newinfo->entries_size = repl->entries_size;
  1027. newinfo->nentries = repl->nentries;
  1028. if (countersize)
  1029. memset(newinfo->counters, 0, countersize);
  1030. /* fill in newinfo and parse the entries */
  1031. newinfo->chainstack = NULL;
  1032. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  1033. if ((repl->valid_hooks & (1 << i)) == 0)
  1034. newinfo->hook_entry[i] = NULL;
  1035. else
  1036. newinfo->hook_entry[i] = p +
  1037. ((char *)repl->hook_entry[i] - repl->entries);
  1038. }
  1039. ret = translate_table(net, repl->name, newinfo);
  1040. if (ret != 0)
  1041. goto free_chainstack;
  1042. if (table->check && table->check(newinfo, table->valid_hooks)) {
  1043. ret = -EINVAL;
  1044. goto free_chainstack;
  1045. }
  1046. table->private = newinfo;
  1047. rwlock_init(&table->lock);
  1048. mutex_lock(&ebt_mutex);
  1049. list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
  1050. if (strcmp(t->name, table->name) == 0) {
  1051. ret = -EEXIST;
  1052. goto free_unlock;
  1053. }
  1054. }
  1055. /* Hold a reference count if the chains aren't empty */
  1056. if (newinfo->nentries && !try_module_get(table->me)) {
  1057. ret = -ENOENT;
  1058. goto free_unlock;
  1059. }
  1060. list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
  1061. mutex_unlock(&ebt_mutex);
  1062. WRITE_ONCE(*res, table);
  1063. ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
  1064. if (ret) {
  1065. __ebt_unregister_table(net, table);
  1066. *res = NULL;
  1067. }
  1068. audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries,
  1069. AUDIT_XT_OP_REGISTER, GFP_KERNEL);
  1070. return ret;
  1071. free_unlock:
  1072. mutex_unlock(&ebt_mutex);
  1073. free_chainstack:
  1074. ebt_free_table_info(newinfo);
  1075. vfree(newinfo->entries);
  1076. free_newinfo:
  1077. vfree(newinfo);
  1078. free_table:
  1079. kfree(table);
  1080. out:
  1081. return ret;
  1082. }
  1083. static struct ebt_table *__ebt_find_table(struct net *net, const char *name)
  1084. {
  1085. struct ebt_table *t;
  1086. mutex_lock(&ebt_mutex);
  1087. list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
  1088. if (strcmp(t->name, name) == 0) {
  1089. mutex_unlock(&ebt_mutex);
  1090. return t;
  1091. }
  1092. }
  1093. mutex_unlock(&ebt_mutex);
  1094. return NULL;
  1095. }
  1096. void ebt_unregister_table_pre_exit(struct net *net, const char *name, const struct nf_hook_ops *ops)
  1097. {
  1098. struct ebt_table *table = __ebt_find_table(net, name);
  1099. if (table)
  1100. nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
  1101. }
  1102. EXPORT_SYMBOL(ebt_unregister_table_pre_exit);
  1103. void ebt_unregister_table(struct net *net, struct ebt_table *table)
  1104. {
  1105. __ebt_unregister_table(net, table);
  1106. }
  1107. /* userspace just supplied us with counters */
  1108. static int do_update_counters(struct net *net, const char *name,
  1109. struct ebt_counter __user *counters,
  1110. unsigned int num_counters, unsigned int len)
  1111. {
  1112. int i, ret;
  1113. struct ebt_counter *tmp;
  1114. struct ebt_table *t;
  1115. if (num_counters == 0)
  1116. return -EINVAL;
  1117. tmp = vmalloc(array_size(num_counters, sizeof(*tmp)));
  1118. if (!tmp)
  1119. return -ENOMEM;
  1120. t = find_table_lock(net, name, &ret, &ebt_mutex);
  1121. if (!t)
  1122. goto free_tmp;
  1123. if (num_counters != t->private->nentries) {
  1124. ret = -EINVAL;
  1125. goto unlock_mutex;
  1126. }
  1127. if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
  1128. ret = -EFAULT;
  1129. goto unlock_mutex;
  1130. }
  1131. /* we want an atomic add of the counters */
  1132. write_lock_bh(&t->lock);
  1133. /* we add to the counters of the first cpu */
  1134. for (i = 0; i < num_counters; i++)
  1135. ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt);
  1136. write_unlock_bh(&t->lock);
  1137. ret = 0;
  1138. unlock_mutex:
  1139. mutex_unlock(&ebt_mutex);
  1140. free_tmp:
  1141. vfree(tmp);
  1142. return ret;
  1143. }
  1144. static int update_counters(struct net *net, sockptr_t arg, unsigned int len)
  1145. {
  1146. struct ebt_replace hlp;
  1147. if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
  1148. return -EFAULT;
  1149. if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
  1150. return -EINVAL;
  1151. return do_update_counters(net, hlp.name, hlp.counters,
  1152. hlp.num_counters, len);
  1153. }
  1154. static inline int ebt_obj_to_user(char __user *um, const char *_name,
  1155. const char *data, int entrysize,
  1156. int usersize, int datasize, u8 revision)
  1157. {
  1158. char name[EBT_EXTENSION_MAXNAMELEN] = {0};
  1159. /* ebtables expects 31 bytes long names but xt_match names are 29 bytes
  1160. * long. Copy 29 bytes and fill remaining bytes with zeroes.
  1161. */
  1162. strlcpy(name, _name, sizeof(name));
  1163. if (copy_to_user(um, name, EBT_EXTENSION_MAXNAMELEN) ||
  1164. put_user(revision, (u8 __user *)(um + EBT_EXTENSION_MAXNAMELEN)) ||
  1165. put_user(datasize, (int __user *)(um + EBT_EXTENSION_MAXNAMELEN + 1)) ||
  1166. xt_data_to_user(um + entrysize, data, usersize, datasize,
  1167. XT_ALIGN(datasize)))
  1168. return -EFAULT;
  1169. return 0;
  1170. }
  1171. static inline int ebt_match_to_user(const struct ebt_entry_match *m,
  1172. const char *base, char __user *ubase)
  1173. {
  1174. return ebt_obj_to_user(ubase + ((char *)m - base),
  1175. m->u.match->name, m->data, sizeof(*m),
  1176. m->u.match->usersize, m->match_size,
  1177. m->u.match->revision);
  1178. }
  1179. static inline int ebt_watcher_to_user(const struct ebt_entry_watcher *w,
  1180. const char *base, char __user *ubase)
  1181. {
  1182. return ebt_obj_to_user(ubase + ((char *)w - base),
  1183. w->u.watcher->name, w->data, sizeof(*w),
  1184. w->u.watcher->usersize, w->watcher_size,
  1185. w->u.watcher->revision);
  1186. }
  1187. static inline int ebt_entry_to_user(struct ebt_entry *e, const char *base,
  1188. char __user *ubase)
  1189. {
  1190. int ret;
  1191. char __user *hlp;
  1192. const struct ebt_entry_target *t;
  1193. if (e->bitmask == 0) {
  1194. /* special case !EBT_ENTRY_OR_ENTRIES */
  1195. if (copy_to_user(ubase + ((char *)e - base), e,
  1196. sizeof(struct ebt_entries)))
  1197. return -EFAULT;
  1198. return 0;
  1199. }
  1200. if (copy_to_user(ubase + ((char *)e - base), e, sizeof(*e)))
  1201. return -EFAULT;
  1202. hlp = ubase + (((char *)e + e->target_offset) - base);
  1203. t = ebt_get_target_c(e);
  1204. ret = EBT_MATCH_ITERATE(e, ebt_match_to_user, base, ubase);
  1205. if (ret != 0)
  1206. return ret;
  1207. ret = EBT_WATCHER_ITERATE(e, ebt_watcher_to_user, base, ubase);
  1208. if (ret != 0)
  1209. return ret;
  1210. ret = ebt_obj_to_user(hlp, t->u.target->name, t->data, sizeof(*t),
  1211. t->u.target->usersize, t->target_size,
  1212. t->u.target->revision);
  1213. if (ret != 0)
  1214. return ret;
  1215. return 0;
  1216. }
  1217. static int copy_counters_to_user(struct ebt_table *t,
  1218. const struct ebt_counter *oldcounters,
  1219. void __user *user, unsigned int num_counters,
  1220. unsigned int nentries)
  1221. {
  1222. struct ebt_counter *counterstmp;
  1223. int ret = 0;
  1224. /* userspace might not need the counters */
  1225. if (num_counters == 0)
  1226. return 0;
  1227. if (num_counters != nentries)
  1228. return -EINVAL;
  1229. counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp)));
  1230. if (!counterstmp)
  1231. return -ENOMEM;
  1232. write_lock_bh(&t->lock);
  1233. get_counters(oldcounters, counterstmp, nentries);
  1234. write_unlock_bh(&t->lock);
  1235. if (copy_to_user(user, counterstmp,
  1236. nentries * sizeof(struct ebt_counter)))
  1237. ret = -EFAULT;
  1238. vfree(counterstmp);
  1239. return ret;
  1240. }
  1241. /* called with ebt_mutex locked */
  1242. static int copy_everything_to_user(struct ebt_table *t, void __user *user,
  1243. const int *len, int cmd)
  1244. {
  1245. struct ebt_replace tmp;
  1246. const struct ebt_counter *oldcounters;
  1247. unsigned int entries_size, nentries;
  1248. int ret;
  1249. char *entries;
  1250. if (cmd == EBT_SO_GET_ENTRIES) {
  1251. entries_size = t->private->entries_size;
  1252. nentries = t->private->nentries;
  1253. entries = t->private->entries;
  1254. oldcounters = t->private->counters;
  1255. } else {
  1256. entries_size = t->table->entries_size;
  1257. nentries = t->table->nentries;
  1258. entries = t->table->entries;
  1259. oldcounters = t->table->counters;
  1260. }
  1261. if (copy_from_user(&tmp, user, sizeof(tmp)))
  1262. return -EFAULT;
  1263. if (*len != sizeof(struct ebt_replace) + entries_size +
  1264. (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
  1265. return -EINVAL;
  1266. if (tmp.nentries != nentries)
  1267. return -EINVAL;
  1268. if (tmp.entries_size != entries_size)
  1269. return -EINVAL;
  1270. ret = copy_counters_to_user(t, oldcounters, tmp.counters,
  1271. tmp.num_counters, nentries);
  1272. if (ret)
  1273. return ret;
  1274. /* set the match/watcher/target names right */
  1275. return EBT_ENTRY_ITERATE(entries, entries_size,
  1276. ebt_entry_to_user, entries, tmp.entries);
  1277. }
  1278. #ifdef CONFIG_COMPAT
  1279. /* 32 bit-userspace compatibility definitions. */
  1280. struct compat_ebt_replace {
  1281. char name[EBT_TABLE_MAXNAMELEN];
  1282. compat_uint_t valid_hooks;
  1283. compat_uint_t nentries;
  1284. compat_uint_t entries_size;
  1285. /* start of the chains */
  1286. compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
  1287. /* nr of counters userspace expects back */
  1288. compat_uint_t num_counters;
  1289. /* where the kernel will put the old counters. */
  1290. compat_uptr_t counters;
  1291. compat_uptr_t entries;
  1292. };
  1293. /* struct ebt_entry_match, _target and _watcher have same layout */
  1294. struct compat_ebt_entry_mwt {
  1295. union {
  1296. struct {
  1297. char name[EBT_EXTENSION_MAXNAMELEN];
  1298. u8 revision;
  1299. };
  1300. compat_uptr_t ptr;
  1301. } u;
  1302. compat_uint_t match_size;
  1303. compat_uint_t data[] __aligned(__alignof__(struct compat_ebt_replace));
  1304. };
  1305. /* account for possible padding between match_size and ->data */
  1306. static int ebt_compat_entry_padsize(void)
  1307. {
  1308. BUILD_BUG_ON(sizeof(struct ebt_entry_match) <
  1309. sizeof(struct compat_ebt_entry_mwt));
  1310. return (int) sizeof(struct ebt_entry_match) -
  1311. sizeof(struct compat_ebt_entry_mwt);
  1312. }
  1313. static int ebt_compat_match_offset(const struct xt_match *match,
  1314. unsigned int userlen)
  1315. {
  1316. /* ebt_among needs special handling. The kernel .matchsize is
  1317. * set to -1 at registration time; at runtime an EBT_ALIGN()ed
  1318. * value is expected.
  1319. * Example: userspace sends 4500, ebt_among.c wants 4504.
  1320. */
  1321. if (unlikely(match->matchsize == -1))
  1322. return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
  1323. return xt_compat_match_offset(match);
  1324. }
  1325. static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
  1326. unsigned int *size)
  1327. {
  1328. const struct xt_match *match = m->u.match;
  1329. struct compat_ebt_entry_mwt __user *cm = *dstptr;
  1330. int off = ebt_compat_match_offset(match, m->match_size);
  1331. compat_uint_t msize = m->match_size - off;
  1332. if (WARN_ON(off >= m->match_size))
  1333. return -EINVAL;
  1334. if (copy_to_user(cm->u.name, match->name, strlen(match->name) + 1) ||
  1335. put_user(match->revision, &cm->u.revision) ||
  1336. put_user(msize, &cm->match_size))
  1337. return -EFAULT;
  1338. if (match->compat_to_user) {
  1339. if (match->compat_to_user(cm->data, m->data))
  1340. return -EFAULT;
  1341. } else {
  1342. if (xt_data_to_user(cm->data, m->data, match->usersize, msize,
  1343. COMPAT_XT_ALIGN(msize)))
  1344. return -EFAULT;
  1345. }
  1346. *size -= ebt_compat_entry_padsize() + off;
  1347. *dstptr = cm->data;
  1348. *dstptr += msize;
  1349. return 0;
  1350. }
  1351. static int compat_target_to_user(struct ebt_entry_target *t,
  1352. void __user **dstptr,
  1353. unsigned int *size)
  1354. {
  1355. const struct xt_target *target = t->u.target;
  1356. struct compat_ebt_entry_mwt __user *cm = *dstptr;
  1357. int off = xt_compat_target_offset(target);
  1358. compat_uint_t tsize = t->target_size - off;
  1359. if (WARN_ON(off >= t->target_size))
  1360. return -EINVAL;
  1361. if (copy_to_user(cm->u.name, target->name, strlen(target->name) + 1) ||
  1362. put_user(target->revision, &cm->u.revision) ||
  1363. put_user(tsize, &cm->match_size))
  1364. return -EFAULT;
  1365. if (target->compat_to_user) {
  1366. if (target->compat_to_user(cm->data, t->data))
  1367. return -EFAULT;
  1368. } else {
  1369. if (xt_data_to_user(cm->data, t->data, target->usersize, tsize,
  1370. COMPAT_XT_ALIGN(tsize)))
  1371. return -EFAULT;
  1372. }
  1373. *size -= ebt_compat_entry_padsize() + off;
  1374. *dstptr = cm->data;
  1375. *dstptr += tsize;
  1376. return 0;
  1377. }
  1378. static int compat_watcher_to_user(struct ebt_entry_watcher *w,
  1379. void __user **dstptr,
  1380. unsigned int *size)
  1381. {
  1382. return compat_target_to_user((struct ebt_entry_target *)w,
  1383. dstptr, size);
  1384. }
  1385. static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
  1386. unsigned int *size)
  1387. {
  1388. struct ebt_entry_target *t;
  1389. struct ebt_entry __user *ce;
  1390. u32 watchers_offset, target_offset, next_offset;
  1391. compat_uint_t origsize;
  1392. int ret;
  1393. if (e->bitmask == 0) {
  1394. if (*size < sizeof(struct ebt_entries))
  1395. return -EINVAL;
  1396. if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
  1397. return -EFAULT;
  1398. *dstptr += sizeof(struct ebt_entries);
  1399. *size -= sizeof(struct ebt_entries);
  1400. return 0;
  1401. }
  1402. if (*size < sizeof(*ce))
  1403. return -EINVAL;
  1404. ce = *dstptr;
  1405. if (copy_to_user(ce, e, sizeof(*ce)))
  1406. return -EFAULT;
  1407. origsize = *size;
  1408. *dstptr += sizeof(*ce);
  1409. ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
  1410. if (ret)
  1411. return ret;
  1412. watchers_offset = e->watchers_offset - (origsize - *size);
  1413. ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
  1414. if (ret)
  1415. return ret;
  1416. target_offset = e->target_offset - (origsize - *size);
  1417. t = ebt_get_target(e);
  1418. ret = compat_target_to_user(t, dstptr, size);
  1419. if (ret)
  1420. return ret;
  1421. next_offset = e->next_offset - (origsize - *size);
  1422. if (put_user(watchers_offset, &ce->watchers_offset) ||
  1423. put_user(target_offset, &ce->target_offset) ||
  1424. put_user(next_offset, &ce->next_offset))
  1425. return -EFAULT;
  1426. *size -= sizeof(*ce);
  1427. return 0;
  1428. }
  1429. static int compat_calc_match(struct ebt_entry_match *m, int *off)
  1430. {
  1431. *off += ebt_compat_match_offset(m->u.match, m->match_size);
  1432. *off += ebt_compat_entry_padsize();
  1433. return 0;
  1434. }
  1435. static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
  1436. {
  1437. *off += xt_compat_target_offset(w->u.watcher);
  1438. *off += ebt_compat_entry_padsize();
  1439. return 0;
  1440. }
  1441. static int compat_calc_entry(const struct ebt_entry *e,
  1442. const struct ebt_table_info *info,
  1443. const void *base,
  1444. struct compat_ebt_replace *newinfo)
  1445. {
  1446. const struct ebt_entry_target *t;
  1447. unsigned int entry_offset;
  1448. int off, ret, i;
  1449. if (e->bitmask == 0)
  1450. return 0;
  1451. off = 0;
  1452. entry_offset = (void *)e - base;
  1453. EBT_MATCH_ITERATE(e, compat_calc_match, &off);
  1454. EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
  1455. t = ebt_get_target_c(e);
  1456. off += xt_compat_target_offset(t->u.target);
  1457. off += ebt_compat_entry_padsize();
  1458. newinfo->entries_size -= off;
  1459. ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
  1460. if (ret)
  1461. return ret;
  1462. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  1463. const void *hookptr = info->hook_entry[i];
  1464. if (info->hook_entry[i] &&
  1465. (e < (struct ebt_entry *)(base - hookptr))) {
  1466. newinfo->hook_entry[i] -= off;
  1467. pr_debug("0x%08X -> 0x%08X\n",
  1468. newinfo->hook_entry[i] + off,
  1469. newinfo->hook_entry[i]);
  1470. }
  1471. }
  1472. return 0;
  1473. }
  1474. static int ebt_compat_init_offsets(unsigned int number)
  1475. {
  1476. if (number > INT_MAX)
  1477. return -EINVAL;
  1478. /* also count the base chain policies */
  1479. number += NF_BR_NUMHOOKS;
  1480. return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
  1481. }
  1482. static int compat_table_info(const struct ebt_table_info *info,
  1483. struct compat_ebt_replace *newinfo)
  1484. {
  1485. unsigned int size = info->entries_size;
  1486. const void *entries = info->entries;
  1487. int ret;
  1488. newinfo->entries_size = size;
  1489. ret = ebt_compat_init_offsets(info->nentries);
  1490. if (ret)
  1491. return ret;
  1492. return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
  1493. entries, newinfo);
  1494. }
  1495. static int compat_copy_everything_to_user(struct ebt_table *t,
  1496. void __user *user, int *len, int cmd)
  1497. {
  1498. struct compat_ebt_replace repl, tmp;
  1499. struct ebt_counter *oldcounters;
  1500. struct ebt_table_info tinfo;
  1501. int ret;
  1502. void __user *pos;
  1503. memset(&tinfo, 0, sizeof(tinfo));
  1504. if (cmd == EBT_SO_GET_ENTRIES) {
  1505. tinfo.entries_size = t->private->entries_size;
  1506. tinfo.nentries = t->private->nentries;
  1507. tinfo.entries = t->private->entries;
  1508. oldcounters = t->private->counters;
  1509. } else {
  1510. tinfo.entries_size = t->table->entries_size;
  1511. tinfo.nentries = t->table->nentries;
  1512. tinfo.entries = t->table->entries;
  1513. oldcounters = t->table->counters;
  1514. }
  1515. if (copy_from_user(&tmp, user, sizeof(tmp)))
  1516. return -EFAULT;
  1517. if (tmp.nentries != tinfo.nentries ||
  1518. (tmp.num_counters && tmp.num_counters != tinfo.nentries))
  1519. return -EINVAL;
  1520. memcpy(&repl, &tmp, sizeof(repl));
  1521. if (cmd == EBT_SO_GET_ENTRIES)
  1522. ret = compat_table_info(t->private, &repl);
  1523. else
  1524. ret = compat_table_info(&tinfo, &repl);
  1525. if (ret)
  1526. return ret;
  1527. if (*len != sizeof(tmp) + repl.entries_size +
  1528. (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
  1529. pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
  1530. *len, tinfo.entries_size, repl.entries_size);
  1531. return -EINVAL;
  1532. }
  1533. /* userspace might not need the counters */
  1534. ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
  1535. tmp.num_counters, tinfo.nentries);
  1536. if (ret)
  1537. return ret;
  1538. pos = compat_ptr(tmp.entries);
  1539. return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
  1540. compat_copy_entry_to_user, &pos, &tmp.entries_size);
  1541. }
  1542. struct ebt_entries_buf_state {
  1543. char *buf_kern_start; /* kernel buffer to copy (translated) data to */
  1544. u32 buf_kern_len; /* total size of kernel buffer */
  1545. u32 buf_kern_offset; /* amount of data copied so far */
  1546. u32 buf_user_offset; /* read position in userspace buffer */
  1547. };
  1548. static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
  1549. {
  1550. state->buf_kern_offset += sz;
  1551. return state->buf_kern_offset >= sz ? 0 : -EINVAL;
  1552. }
  1553. static int ebt_buf_add(struct ebt_entries_buf_state *state,
  1554. const void *data, unsigned int sz)
  1555. {
  1556. if (state->buf_kern_start == NULL)
  1557. goto count_only;
  1558. if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len))
  1559. return -EINVAL;
  1560. memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
  1561. count_only:
  1562. state->buf_user_offset += sz;
  1563. return ebt_buf_count(state, sz);
  1564. }
  1565. static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
  1566. {
  1567. char *b = state->buf_kern_start;
  1568. if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len))
  1569. return -EINVAL;
  1570. if (b != NULL && sz > 0)
  1571. memset(b + state->buf_kern_offset, 0, sz);
  1572. /* do not adjust ->buf_user_offset here, we added kernel-side padding */
  1573. return ebt_buf_count(state, sz);
  1574. }
  1575. enum compat_mwt {
  1576. EBT_COMPAT_MATCH,
  1577. EBT_COMPAT_WATCHER,
  1578. EBT_COMPAT_TARGET,
  1579. };
  1580. static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt,
  1581. enum compat_mwt compat_mwt,
  1582. struct ebt_entries_buf_state *state,
  1583. const unsigned char *base)
  1584. {
  1585. char name[EBT_EXTENSION_MAXNAMELEN];
  1586. struct xt_match *match;
  1587. struct xt_target *wt;
  1588. void *dst = NULL;
  1589. int off, pad = 0;
  1590. unsigned int size_kern, match_size = mwt->match_size;
  1591. if (strscpy(name, mwt->u.name, sizeof(name)) < 0)
  1592. return -EINVAL;
  1593. if (state->buf_kern_start)
  1594. dst = state->buf_kern_start + state->buf_kern_offset;
  1595. switch (compat_mwt) {
  1596. case EBT_COMPAT_MATCH:
  1597. match = xt_request_find_match(NFPROTO_BRIDGE, name,
  1598. mwt->u.revision);
  1599. if (IS_ERR(match))
  1600. return PTR_ERR(match);
  1601. off = ebt_compat_match_offset(match, match_size);
  1602. if (dst) {
  1603. if (match->compat_from_user)
  1604. match->compat_from_user(dst, mwt->data);
  1605. else
  1606. memcpy(dst, mwt->data, match_size);
  1607. }
  1608. size_kern = match->matchsize;
  1609. if (unlikely(size_kern == -1))
  1610. size_kern = match_size;
  1611. module_put(match->me);
  1612. break;
  1613. case EBT_COMPAT_WATCHER:
  1614. case EBT_COMPAT_TARGET:
  1615. wt = xt_request_find_target(NFPROTO_BRIDGE, name,
  1616. mwt->u.revision);
  1617. if (IS_ERR(wt))
  1618. return PTR_ERR(wt);
  1619. off = xt_compat_target_offset(wt);
  1620. if (dst) {
  1621. if (wt->compat_from_user)
  1622. wt->compat_from_user(dst, mwt->data);
  1623. else
  1624. memcpy(dst, mwt->data, match_size);
  1625. }
  1626. size_kern = wt->targetsize;
  1627. module_put(wt->me);
  1628. break;
  1629. default:
  1630. return -EINVAL;
  1631. }
  1632. state->buf_kern_offset += match_size + off;
  1633. state->buf_user_offset += match_size;
  1634. pad = XT_ALIGN(size_kern) - size_kern;
  1635. if (pad > 0 && dst) {
  1636. if (WARN_ON(state->buf_kern_len <= pad))
  1637. return -EINVAL;
  1638. if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad))
  1639. return -EINVAL;
  1640. memset(dst + size_kern, 0, pad);
  1641. }
  1642. return off + match_size;
  1643. }
  1644. /* return size of all matches, watchers or target, including necessary
  1645. * alignment and padding.
  1646. */
  1647. static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32,
  1648. unsigned int size_left, enum compat_mwt type,
  1649. struct ebt_entries_buf_state *state, const void *base)
  1650. {
  1651. const char *buf = (const char *)match32;
  1652. int growth = 0;
  1653. if (size_left == 0)
  1654. return 0;
  1655. do {
  1656. struct ebt_entry_match *match_kern;
  1657. int ret;
  1658. if (size_left < sizeof(*match32))
  1659. return -EINVAL;
  1660. match_kern = (struct ebt_entry_match *) state->buf_kern_start;
  1661. if (match_kern) {
  1662. char *tmp;
  1663. tmp = state->buf_kern_start + state->buf_kern_offset;
  1664. match_kern = (struct ebt_entry_match *) tmp;
  1665. }
  1666. ret = ebt_buf_add(state, buf, sizeof(*match32));
  1667. if (ret < 0)
  1668. return ret;
  1669. size_left -= sizeof(*match32);
  1670. /* add padding before match->data (if any) */
  1671. ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
  1672. if (ret < 0)
  1673. return ret;
  1674. if (match32->match_size > size_left)
  1675. return -EINVAL;
  1676. size_left -= match32->match_size;
  1677. ret = compat_mtw_from_user(match32, type, state, base);
  1678. if (ret < 0)
  1679. return ret;
  1680. if (WARN_ON(ret < match32->match_size))
  1681. return -EINVAL;
  1682. growth += ret - match32->match_size;
  1683. growth += ebt_compat_entry_padsize();
  1684. buf += sizeof(*match32);
  1685. buf += match32->match_size;
  1686. if (match_kern)
  1687. match_kern->match_size = ret;
  1688. match32 = (struct compat_ebt_entry_mwt *) buf;
  1689. } while (size_left);
  1690. return growth;
  1691. }
  1692. /* called for all ebt_entry structures. */
  1693. static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base,
  1694. unsigned int *total,
  1695. struct ebt_entries_buf_state *state)
  1696. {
  1697. unsigned int i, j, startoff, next_expected_off, new_offset = 0;
  1698. /* stores match/watchers/targets & offset of next struct ebt_entry: */
  1699. unsigned int offsets[4];
  1700. unsigned int *offsets_update = NULL;
  1701. int ret;
  1702. char *buf_start;
  1703. if (*total < sizeof(struct ebt_entries))
  1704. return -EINVAL;
  1705. if (!entry->bitmask) {
  1706. *total -= sizeof(struct ebt_entries);
  1707. return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
  1708. }
  1709. if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
  1710. return -EINVAL;
  1711. startoff = state->buf_user_offset;
  1712. /* pull in most part of ebt_entry, it does not need to be changed. */
  1713. ret = ebt_buf_add(state, entry,
  1714. offsetof(struct ebt_entry, watchers_offset));
  1715. if (ret < 0)
  1716. return ret;
  1717. offsets[0] = sizeof(struct ebt_entry); /* matches come first */
  1718. memcpy(&offsets[1], &entry->watchers_offset,
  1719. sizeof(offsets) - sizeof(offsets[0]));
  1720. if (state->buf_kern_start) {
  1721. buf_start = state->buf_kern_start + state->buf_kern_offset;
  1722. offsets_update = (unsigned int *) buf_start;
  1723. }
  1724. ret = ebt_buf_add(state, &offsets[1],
  1725. sizeof(offsets) - sizeof(offsets[0]));
  1726. if (ret < 0)
  1727. return ret;
  1728. buf_start = (char *) entry;
  1729. /* 0: matches offset, always follows ebt_entry.
  1730. * 1: watchers offset, from ebt_entry structure
  1731. * 2: target offset, from ebt_entry structure
  1732. * 3: next ebt_entry offset, from ebt_entry structure
  1733. *
  1734. * offsets are relative to beginning of struct ebt_entry (i.e., 0).
  1735. */
  1736. for (i = 0; i < 4 ; ++i) {
  1737. if (offsets[i] > *total)
  1738. return -EINVAL;
  1739. if (i < 3 && offsets[i] == *total)
  1740. return -EINVAL;
  1741. if (i == 0)
  1742. continue;
  1743. if (offsets[i-1] > offsets[i])
  1744. return -EINVAL;
  1745. }
  1746. for (i = 0, j = 1 ; j < 4 ; j++, i++) {
  1747. struct compat_ebt_entry_mwt *match32;
  1748. unsigned int size;
  1749. char *buf = buf_start + offsets[i];
  1750. if (offsets[i] > offsets[j])
  1751. return -EINVAL;
  1752. match32 = (struct compat_ebt_entry_mwt *) buf;
  1753. size = offsets[j] - offsets[i];
  1754. ret = ebt_size_mwt(match32, size, i, state, base);
  1755. if (ret < 0)
  1756. return ret;
  1757. new_offset += ret;
  1758. if (offsets_update && new_offset) {
  1759. pr_debug("change offset %d to %d\n",
  1760. offsets_update[i], offsets[j] + new_offset);
  1761. offsets_update[i] = offsets[j] + new_offset;
  1762. }
  1763. }
  1764. if (state->buf_kern_start == NULL) {
  1765. unsigned int offset = buf_start - (char *) base;
  1766. ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
  1767. if (ret < 0)
  1768. return ret;
  1769. }
  1770. next_expected_off = state->buf_user_offset - startoff;
  1771. if (next_expected_off != entry->next_offset)
  1772. return -EINVAL;
  1773. if (*total < entry->next_offset)
  1774. return -EINVAL;
  1775. *total -= entry->next_offset;
  1776. return 0;
  1777. }
  1778. /* repl->entries_size is the size of the ebt_entry blob in userspace.
  1779. * It might need more memory when copied to a 64 bit kernel in case
  1780. * userspace is 32-bit. So, first task: find out how much memory is needed.
  1781. *
  1782. * Called before validation is performed.
  1783. */
  1784. static int compat_copy_entries(unsigned char *data, unsigned int size_user,
  1785. struct ebt_entries_buf_state *state)
  1786. {
  1787. unsigned int size_remaining = size_user;
  1788. int ret;
  1789. ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
  1790. &size_remaining, state);
  1791. if (ret < 0)
  1792. return ret;
  1793. if (size_remaining)
  1794. return -EINVAL;
  1795. return state->buf_kern_offset;
  1796. }
  1797. static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
  1798. sockptr_t arg, unsigned int len)
  1799. {
  1800. struct compat_ebt_replace tmp;
  1801. int i;
  1802. if (len < sizeof(tmp))
  1803. return -EINVAL;
  1804. if (copy_from_sockptr(&tmp, arg, sizeof(tmp)))
  1805. return -EFAULT;
  1806. if (len != sizeof(tmp) + tmp.entries_size)
  1807. return -EINVAL;
  1808. if (tmp.entries_size == 0)
  1809. return -EINVAL;
  1810. if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
  1811. NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
  1812. return -ENOMEM;
  1813. if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
  1814. return -ENOMEM;
  1815. memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
  1816. /* starting with hook_entry, 32 vs. 64 bit structures are different */
  1817. for (i = 0; i < NF_BR_NUMHOOKS; i++)
  1818. repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
  1819. repl->num_counters = tmp.num_counters;
  1820. repl->counters = compat_ptr(tmp.counters);
  1821. repl->entries = compat_ptr(tmp.entries);
  1822. return 0;
  1823. }
  1824. static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
  1825. {
  1826. int ret, i, countersize, size64;
  1827. struct ebt_table_info *newinfo;
  1828. struct ebt_replace tmp;
  1829. struct ebt_entries_buf_state state;
  1830. void *entries_tmp;
  1831. ret = compat_copy_ebt_replace_from_user(&tmp, arg, len);
  1832. if (ret) {
  1833. /* try real handler in case userland supplied needed padding */
  1834. if (ret == -EINVAL && do_replace(net, arg, len) == 0)
  1835. ret = 0;
  1836. return ret;
  1837. }
  1838. countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
  1839. newinfo = vmalloc(sizeof(*newinfo) + countersize);
  1840. if (!newinfo)
  1841. return -ENOMEM;
  1842. if (countersize)
  1843. memset(newinfo->counters, 0, countersize);
  1844. memset(&state, 0, sizeof(state));
  1845. newinfo->entries = vmalloc(tmp.entries_size);
  1846. if (!newinfo->entries) {
  1847. ret = -ENOMEM;
  1848. goto free_newinfo;
  1849. }
  1850. if (copy_from_user(
  1851. newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
  1852. ret = -EFAULT;
  1853. goto free_entries;
  1854. }
  1855. entries_tmp = newinfo->entries;
  1856. xt_compat_lock(NFPROTO_BRIDGE);
  1857. ret = ebt_compat_init_offsets(tmp.nentries);
  1858. if (ret < 0)
  1859. goto out_unlock;
  1860. ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
  1861. if (ret < 0)
  1862. goto out_unlock;
  1863. pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
  1864. tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
  1865. xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
  1866. size64 = ret;
  1867. newinfo->entries = vmalloc(size64);
  1868. if (!newinfo->entries) {
  1869. vfree(entries_tmp);
  1870. ret = -ENOMEM;
  1871. goto out_unlock;
  1872. }
  1873. memset(&state, 0, sizeof(state));
  1874. state.buf_kern_start = newinfo->entries;
  1875. state.buf_kern_len = size64;
  1876. ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
  1877. if (WARN_ON(ret < 0)) {
  1878. vfree(entries_tmp);
  1879. goto out_unlock;
  1880. }
  1881. vfree(entries_tmp);
  1882. tmp.entries_size = size64;
  1883. for (i = 0; i < NF_BR_NUMHOOKS; i++) {
  1884. char __user *usrptr;
  1885. if (tmp.hook_entry[i]) {
  1886. unsigned int delta;
  1887. usrptr = (char __user *) tmp.hook_entry[i];
  1888. delta = usrptr - tmp.entries;
  1889. usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
  1890. tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
  1891. }
  1892. }
  1893. xt_compat_flush_offsets(NFPROTO_BRIDGE);
  1894. xt_compat_unlock(NFPROTO_BRIDGE);
  1895. ret = do_replace_finish(net, &tmp, newinfo);
  1896. if (ret == 0)
  1897. return ret;
  1898. free_entries:
  1899. vfree(newinfo->entries);
  1900. free_newinfo:
  1901. vfree(newinfo);
  1902. return ret;
  1903. out_unlock:
  1904. xt_compat_flush_offsets(NFPROTO_BRIDGE);
  1905. xt_compat_unlock(NFPROTO_BRIDGE);
  1906. goto free_entries;
  1907. }
  1908. static int compat_update_counters(struct net *net, sockptr_t arg,
  1909. unsigned int len)
  1910. {
  1911. struct compat_ebt_replace hlp;
  1912. if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
  1913. return -EFAULT;
  1914. /* try real handler in case userland supplied needed padding */
  1915. if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
  1916. return update_counters(net, arg, len);
  1917. return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
  1918. hlp.num_counters, len);
  1919. }
  1920. static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
  1921. void __user *user, int *len)
  1922. {
  1923. int ret;
  1924. struct compat_ebt_replace tmp;
  1925. struct ebt_table *t;
  1926. struct net *net = sock_net(sk);
  1927. if ((cmd == EBT_SO_GET_INFO || cmd == EBT_SO_GET_INIT_INFO) &&
  1928. *len != sizeof(struct compat_ebt_replace))
  1929. return -EINVAL;
  1930. if (copy_from_user(&tmp, user, sizeof(tmp)))
  1931. return -EFAULT;
  1932. tmp.name[sizeof(tmp.name) - 1] = '\0';
  1933. t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
  1934. if (!t)
  1935. return ret;
  1936. xt_compat_lock(NFPROTO_BRIDGE);
  1937. switch (cmd) {
  1938. case EBT_SO_GET_INFO:
  1939. tmp.nentries = t->private->nentries;
  1940. ret = compat_table_info(t->private, &tmp);
  1941. if (ret)
  1942. goto out;
  1943. tmp.valid_hooks = t->valid_hooks;
  1944. if (copy_to_user(user, &tmp, *len) != 0) {
  1945. ret = -EFAULT;
  1946. break;
  1947. }
  1948. ret = 0;
  1949. break;
  1950. case EBT_SO_GET_INIT_INFO:
  1951. tmp.nentries = t->table->nentries;
  1952. tmp.entries_size = t->table->entries_size;
  1953. tmp.valid_hooks = t->table->valid_hooks;
  1954. if (copy_to_user(user, &tmp, *len) != 0) {
  1955. ret = -EFAULT;
  1956. break;
  1957. }
  1958. ret = 0;
  1959. break;
  1960. case EBT_SO_GET_ENTRIES:
  1961. case EBT_SO_GET_INIT_ENTRIES:
  1962. /* try real handler first in case of userland-side padding.
  1963. * in case we are dealing with an 'ordinary' 32 bit binary
  1964. * without 64bit compatibility padding, this will fail right
  1965. * after copy_from_user when the *len argument is validated.
  1966. *
  1967. * the compat_ variant needs to do one pass over the kernel
  1968. * data set to adjust for size differences before it the check.
  1969. */
  1970. if (copy_everything_to_user(t, user, len, cmd) == 0)
  1971. ret = 0;
  1972. else
  1973. ret = compat_copy_everything_to_user(t, user, len, cmd);
  1974. break;
  1975. default:
  1976. ret = -EINVAL;
  1977. }
  1978. out:
  1979. xt_compat_flush_offsets(NFPROTO_BRIDGE);
  1980. xt_compat_unlock(NFPROTO_BRIDGE);
  1981. mutex_unlock(&ebt_mutex);
  1982. return ret;
  1983. }
  1984. #endif
  1985. static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
  1986. {
  1987. struct net *net = sock_net(sk);
  1988. struct ebt_replace tmp;
  1989. struct ebt_table *t;
  1990. int ret;
  1991. if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
  1992. return -EPERM;
  1993. #ifdef CONFIG_COMPAT
  1994. /* try real handler in case userland supplied needed padding */
  1995. if (in_compat_syscall() &&
  1996. ((cmd != EBT_SO_GET_INFO && cmd != EBT_SO_GET_INIT_INFO) ||
  1997. *len != sizeof(tmp)))
  1998. return compat_do_ebt_get_ctl(sk, cmd, user, len);
  1999. #endif
  2000. if (copy_from_user(&tmp, user, sizeof(tmp)))
  2001. return -EFAULT;
  2002. tmp.name[sizeof(tmp.name) - 1] = '\0';
  2003. t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
  2004. if (!t)
  2005. return ret;
  2006. switch (cmd) {
  2007. case EBT_SO_GET_INFO:
  2008. case EBT_SO_GET_INIT_INFO:
  2009. if (*len != sizeof(struct ebt_replace)) {
  2010. ret = -EINVAL;
  2011. mutex_unlock(&ebt_mutex);
  2012. break;
  2013. }
  2014. if (cmd == EBT_SO_GET_INFO) {
  2015. tmp.nentries = t->private->nentries;
  2016. tmp.entries_size = t->private->entries_size;
  2017. tmp.valid_hooks = t->valid_hooks;
  2018. } else {
  2019. tmp.nentries = t->table->nentries;
  2020. tmp.entries_size = t->table->entries_size;
  2021. tmp.valid_hooks = t->table->valid_hooks;
  2022. }
  2023. mutex_unlock(&ebt_mutex);
  2024. if (copy_to_user(user, &tmp, *len) != 0) {
  2025. ret = -EFAULT;
  2026. break;
  2027. }
  2028. ret = 0;
  2029. break;
  2030. case EBT_SO_GET_ENTRIES:
  2031. case EBT_SO_GET_INIT_ENTRIES:
  2032. ret = copy_everything_to_user(t, user, len, cmd);
  2033. mutex_unlock(&ebt_mutex);
  2034. break;
  2035. default:
  2036. mutex_unlock(&ebt_mutex);
  2037. ret = -EINVAL;
  2038. }
  2039. return ret;
  2040. }
  2041. static int do_ebt_set_ctl(struct sock *sk, int cmd, sockptr_t arg,
  2042. unsigned int len)
  2043. {
  2044. struct net *net = sock_net(sk);
  2045. int ret;
  2046. if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
  2047. return -EPERM;
  2048. switch (cmd) {
  2049. case EBT_SO_SET_ENTRIES:
  2050. #ifdef CONFIG_COMPAT
  2051. if (in_compat_syscall())
  2052. ret = compat_do_replace(net, arg, len);
  2053. else
  2054. #endif
  2055. ret = do_replace(net, arg, len);
  2056. break;
  2057. case EBT_SO_SET_COUNTERS:
  2058. #ifdef CONFIG_COMPAT
  2059. if (in_compat_syscall())
  2060. ret = compat_update_counters(net, arg, len);
  2061. else
  2062. #endif
  2063. ret = update_counters(net, arg, len);
  2064. break;
  2065. default:
  2066. ret = -EINVAL;
  2067. }
  2068. return ret;
  2069. }
  2070. static struct nf_sockopt_ops ebt_sockopts = {
  2071. .pf = PF_INET,
  2072. .set_optmin = EBT_BASE_CTL,
  2073. .set_optmax = EBT_SO_SET_MAX + 1,
  2074. .set = do_ebt_set_ctl,
  2075. .get_optmin = EBT_BASE_CTL,
  2076. .get_optmax = EBT_SO_GET_MAX + 1,
  2077. .get = do_ebt_get_ctl,
  2078. .owner = THIS_MODULE,
  2079. };
  2080. static int __init ebtables_init(void)
  2081. {
  2082. int ret;
  2083. ret = xt_register_target(&ebt_standard_target);
  2084. if (ret < 0)
  2085. return ret;
  2086. ret = nf_register_sockopt(&ebt_sockopts);
  2087. if (ret < 0) {
  2088. xt_unregister_target(&ebt_standard_target);
  2089. return ret;
  2090. }
  2091. return 0;
  2092. }
  2093. static void __exit ebtables_fini(void)
  2094. {
  2095. nf_unregister_sockopt(&ebt_sockopts);
  2096. xt_unregister_target(&ebt_standard_target);
  2097. }
  2098. EXPORT_SYMBOL(ebt_register_table);
  2099. EXPORT_SYMBOL(ebt_unregister_table);
  2100. EXPORT_SYMBOL(ebt_do_table);
  2101. module_init(ebtables_init);
  2102. module_exit(ebtables_fini);
  2103. MODULE_LICENSE("GPL");