ebtables.c 39.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
/*
 *  ebtables
 *
 *  Author:
 *  Bart De Schuymer		<bdschuym@pandora.be>
 *
 *  ebtables.c,v 2.0, July, 2002
 *
 *  This code is stongly inspired on the iptables code which is
 *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 *
 *  This program is free software; you can redistribute it and/or
 *  modify it under the terms of the GNU General Public License
 *  as published by the Free Software Foundation; either version
 *  2 of the License, or (at your option) any later version.
 */


#include <linux/kmod.h>
#include <linux/module.h>
#include <linux/vmalloc.h>
22
#include <linux/netfilter/x_tables.h>
L
Linus Torvalds 已提交
23 24
#include <linux/netfilter_bridge/ebtables.h>
#include <linux/spinlock.h>
P
Patrick McHardy 已提交
25
#include <linux/mutex.h>
L
Linus Torvalds 已提交
26 27
#include <asm/uaccess.h>
#include <linux/smp.h>
28
#include <linux/cpumask.h>
L
Linus Torvalds 已提交
29 30 31 32 33
#include <net/sock.h>
/* needed for logical [in,out]-dev filtering */
#include "../br_private.h"

#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
34
					 "report to author: "format, ## args)
L
Linus Torvalds 已提交
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
/* #define BUGPRINT(format, args...) */

/*
 * Each cpu has its own set of counters, so there is no need for write_lock in
 * the softirq
 * For reading or updating the counters, the user context needs to
 * get a write_lock
 */

/* The size of each set of counters is altered to get cache alignment */
#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
#define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
#define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
   COUNTER_OFFSET(n) * cpu))



I
Ingo Molnar 已提交
52
static DEFINE_MUTEX(ebt_mutex);
L
Linus Torvalds 已提交
53

54
static struct xt_target ebt_standard_target = {
55 56 57
	.name       = "standard",
	.revision   = 0,
	.family     = NFPROTO_BRIDGE,
58
	.targetsize = sizeof(int),
59
};
L
Linus Torvalds 已提交
60

61 62 63
static inline int
ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
	       struct xt_target_param *par)
L
Linus Torvalds 已提交
64
{
65 66 67
	par->target   = w->u.watcher;
	par->targinfo = w->data;
	w->u.watcher->target(skb, par);
L
Linus Torvalds 已提交
68 69 70 71 72
	/* watchers don't give a verdict */
	return 0;
}

static inline int ebt_do_match (struct ebt_entry_match *m,
73
   const struct sk_buff *skb, struct xt_match_param *par)
L
Linus Torvalds 已提交
74
{
75 76
	par->match     = m->u.match;
	par->matchinfo = m->data;
77
	return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
L
Linus Torvalds 已提交
78 79
}

80 81
static inline int
ebt_dev_check(const char *entry, const struct net_device *device)
L
Linus Torvalds 已提交
82 83
{
	int i = 0;
84
	const char *devname;
L
Linus Torvalds 已提交
85 86 87 88 89

	if (*entry == '\0')
		return 0;
	if (!device)
		return 1;
90
	devname = device->name;
L
Linus Torvalds 已提交
91 92 93 94 95 96 97 98
	/* 1 is the wildcard token */
	while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
		i++;
	return (devname[i] != entry[i] && entry[i] != 1);
}

#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
/* process standard matches */
99 100 101
static inline int
ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
                const struct net_device *in, const struct net_device *out)
L
Linus Torvalds 已提交
102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141
{
	int verdict, i;

	if (e->bitmask & EBT_802_3) {
		if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
			return 1;
	} else if (!(e->bitmask & EBT_NOPROTO) &&
	   FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
		return 1;

	if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
		return 1;
	if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
		return 1;
	if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
	   e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
		return 1;
	if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
	   e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
		return 1;

	if (e->bitmask & EBT_SOURCEMAC) {
		verdict = 0;
		for (i = 0; i < 6; i++)
			verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
			   e->sourcemsk[i];
		if (FWINV2(verdict != 0, EBT_ISOURCE) )
			return 1;
	}
	if (e->bitmask & EBT_DESTMAC) {
		verdict = 0;
		for (i = 0; i < 6; i++)
			verdict |= (h->h_dest[i] ^ e->destmac[i]) &
			   e->destmsk[i];
		if (FWINV2(verdict != 0, EBT_IDEST) )
			return 1;
	}
	return 0;
}

142 143 144 145 146 147
static inline __pure
struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
{
	return (void *)entry + entry->next_offset;
}

L
Linus Torvalds 已提交
148
/* Do some firewalling */
149
unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
L
Linus Torvalds 已提交
150 151 152 153 154 155
   const struct net_device *in, const struct net_device *out,
   struct ebt_table *table)
{
	int i, nentries;
	struct ebt_entry *point;
	struct ebt_counter *counter_base, *cb_base;
156
	const struct ebt_entry_target *t;
L
Linus Torvalds 已提交
157 158 159
	int verdict, sp = 0;
	struct ebt_chainstack *cs;
	struct ebt_entries *chaininfo;
160 161
	const char *base;
	const struct ebt_table_info *private;
162
	bool hotdrop = false;
163
	struct xt_match_param mtpar;
164
	struct xt_target_param tgpar;
165

166
	mtpar.family  = tgpar.family = NFPROTO_BRIDGE;
167 168
	mtpar.in      = tgpar.in  = in;
	mtpar.out     = tgpar.out = out;
169
	mtpar.hotdrop = &hotdrop;
170
	mtpar.hooknum = tgpar.hooknum = hook;
L
Linus Torvalds 已提交
171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187

	read_lock_bh(&table->lock);
	private = table->private;
	cb_base = COUNTER_BASE(private->counters, private->nentries,
	   smp_processor_id());
	if (private->chainstack)
		cs = private->chainstack[smp_processor_id()];
	else
		cs = NULL;
	chaininfo = private->hook_entry[hook];
	nentries = private->hook_entry[hook]->nentries;
	point = (struct ebt_entry *)(private->hook_entry[hook]->data);
	counter_base = cb_base + private->hook_entry[hook]->counter_offset;
	/* base for chain jumps */
	base = private->entries;
	i = 0;
	while (i < nentries) {
188
		if (ebt_basic_match(point, eth_hdr(skb), in, out))
L
Linus Torvalds 已提交
189 190
			goto letscontinue;

191
		if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
L
Linus Torvalds 已提交
192
			goto letscontinue;
193 194 195 196
		if (hotdrop) {
			read_unlock_bh(&table->lock);
			return NF_DROP;
		}
L
Linus Torvalds 已提交
197 198 199

		/* increase counter */
		(*(counter_base + i)).pcnt++;
200
		(*(counter_base + i)).bcnt += skb->len;
L
Linus Torvalds 已提交
201 202 203

		/* these should only watch: not modify, nor tell us
		   what to do with the packet */
204
		EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &tgpar);
L
Linus Torvalds 已提交
205 206 207 208 209 210

		t = (struct ebt_entry_target *)
		   (((char *)point) + point->target_offset);
		/* standard target */
		if (!t->u.target->target)
			verdict = ((struct ebt_standard_target *)t)->verdict;
211 212 213 214 215
		else {
			tgpar.target   = t->u.target;
			tgpar.targinfo = t->data;
			verdict = t->u.target->target(skb, &tgpar);
		}
L
Linus Torvalds 已提交
216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254
		if (verdict == EBT_ACCEPT) {
			read_unlock_bh(&table->lock);
			return NF_ACCEPT;
		}
		if (verdict == EBT_DROP) {
			read_unlock_bh(&table->lock);
			return NF_DROP;
		}
		if (verdict == EBT_RETURN) {
letsreturn:
#ifdef CONFIG_NETFILTER_DEBUG
			if (sp == 0) {
				BUGPRINT("RETURN on base chain");
				/* act like this is EBT_CONTINUE */
				goto letscontinue;
			}
#endif
			sp--;
			/* put all the local variables right */
			i = cs[sp].n;
			chaininfo = cs[sp].chaininfo;
			nentries = chaininfo->nentries;
			point = cs[sp].e;
			counter_base = cb_base +
			   chaininfo->counter_offset;
			continue;
		}
		if (verdict == EBT_CONTINUE)
			goto letscontinue;
#ifdef CONFIG_NETFILTER_DEBUG
		if (verdict < 0) {
			BUGPRINT("bogus standard verdict\n");
			read_unlock_bh(&table->lock);
			return NF_DROP;
		}
#endif
		/* jump to a udc */
		cs[sp].n = i + 1;
		cs[sp].chaininfo = chaininfo;
255
		cs[sp].e = ebt_next_entry(point);
L
Linus Torvalds 已提交
256 257 258 259 260 261 262 263 264 265 266 267 268 269 270
		i = 0;
		chaininfo = (struct ebt_entries *) (base + verdict);
#ifdef CONFIG_NETFILTER_DEBUG
		if (chaininfo->distinguisher) {
			BUGPRINT("jump to non-chain\n");
			read_unlock_bh(&table->lock);
			return NF_DROP;
		}
#endif
		nentries = chaininfo->nentries;
		point = (struct ebt_entry *)chaininfo->data;
		counter_base = cb_base + chaininfo->counter_offset;
		sp++;
		continue;
letscontinue:
271
		point = ebt_next_entry(point);
L
Linus Torvalds 已提交
272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288
		i++;
	}

	/* I actually like this :) */
	if (chaininfo->policy == EBT_RETURN)
		goto letsreturn;
	if (chaininfo->policy == EBT_ACCEPT) {
		read_unlock_bh(&table->lock);
		return NF_ACCEPT;
	}
	read_unlock_bh(&table->lock);
	return NF_DROP;
}

/* If it succeeds, returns element and locks mutex */
static inline void *
find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
I
Ingo Molnar 已提交
289
   struct mutex *mutex)
L
Linus Torvalds 已提交
290
{
P
Patrick McHardy 已提交
291 292 293 294
	struct {
		struct list_head list;
		char name[EBT_FUNCTION_MAXNAMELEN];
	} *e;
L
Linus Torvalds 已提交
295

I
Ingo Molnar 已提交
296
	*error = mutex_lock_interruptible(mutex);
L
Linus Torvalds 已提交
297 298 299
	if (*error != 0)
		return NULL;

P
Patrick McHardy 已提交
300 301 302
	list_for_each_entry(e, head, list) {
		if (strcmp(e->name, name) == 0)
			return e;
L
Linus Torvalds 已提交
303
	}
P
Patrick McHardy 已提交
304 305 306
	*error = -ENOENT;
	mutex_unlock(mutex);
	return NULL;
L
Linus Torvalds 已提交
307 308 309 310
}

static void *
find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
I
Ingo Molnar 已提交
311
   int *error, struct mutex *mutex)
L
Linus Torvalds 已提交
312
{
313 314 315
	return try_then_request_module(
			find_inlist_lock_noload(head, name, error, mutex),
			"%s%s", prefix, name);
L
Linus Torvalds 已提交
316 317 318
}

static inline struct ebt_table *
319 320
find_table_lock(struct net *net, const char *name, int *error,
		struct mutex *mutex)
L
Linus Torvalds 已提交
321
{
322 323
	return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
				"ebtable_", error, mutex);
L
Linus Torvalds 已提交
324 325 326
}

static inline int
327 328
ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
		unsigned int *cnt)
L
Linus Torvalds 已提交
329
{
330
	const struct ebt_entry *e = par->entryinfo;
331
	struct xt_match *match;
332
	size_t left = ((char *)e + e->watchers_offset) - (char *)m;
L
Linus Torvalds 已提交
333 334
	int ret;

335 336
	if (left < sizeof(struct ebt_entry_match) ||
	    left - sizeof(struct ebt_entry_match) < m->match_size)
L
Linus Torvalds 已提交
337
		return -EINVAL;
338 339 340 341 342 343

	match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
		m->u.name, 0), "ebt_%s", m->u.name);
	if (IS_ERR(match))
		return PTR_ERR(match);
	if (match == NULL)
L
Linus Torvalds 已提交
344
		return -ENOENT;
345 346
	m->u.match = match;

347 348
	par->match     = match;
	par->matchinfo = m->data;
349
	ret = xt_check_match(par, m->match_size,
350
	      e->ethproto, e->invflags & EBT_IPROTO);
351 352 353
	if (ret < 0) {
		module_put(match->me);
		return ret;
L
Linus Torvalds 已提交
354
	}
355

L
Linus Torvalds 已提交
356 357 358 359 360
	(*cnt)++;
	return 0;
}

static inline int
361 362
ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
		  unsigned int *cnt)
L
Linus Torvalds 已提交
363
{
364
	const struct ebt_entry *e = par->entryinfo;
365
	struct xt_target *watcher;
366
	size_t left = ((char *)e + e->target_offset) - (char *)w;
L
Linus Torvalds 已提交
367 368
	int ret;

369 370
	if (left < sizeof(struct ebt_entry_watcher) ||
	   left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
L
Linus Torvalds 已提交
371
		return -EINVAL;
372 373 374 375 376 377 378

	watcher = try_then_request_module(
		  xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
		  "ebt_%s", w->u.name);
	if (IS_ERR(watcher))
		return PTR_ERR(watcher);
	if (watcher == NULL)
L
Linus Torvalds 已提交
379
		return -ENOENT;
380 381
	w->u.watcher = watcher;

382 383
	par->target   = watcher;
	par->targinfo = w->data;
384
	ret = xt_check_target(par, w->watcher_size,
385
	      e->ethproto, e->invflags & EBT_IPROTO);
386 387 388
	if (ret < 0) {
		module_put(watcher->me);
		return ret;
L
Linus Torvalds 已提交
389
	}
390

L
Linus Torvalds 已提交
391 392 393 394
	(*cnt)++;
	return 0;
}

395
static int ebt_verify_pointers(const struct ebt_replace *repl,
396
			       struct ebt_table_info *newinfo)
L
Linus Torvalds 已提交
397
{
398 399 400
	unsigned int limit = repl->entries_size;
	unsigned int valid_hooks = repl->valid_hooks;
	unsigned int offset = 0;
L
Linus Torvalds 已提交
401 402
	int i;

403 404 405 406 407 408
	for (i = 0; i < NF_BR_NUMHOOKS; i++)
		newinfo->hook_entry[i] = NULL;

	newinfo->entries_size = repl->entries_size;
	newinfo->nentries = repl->nentries;

409 410 411
	while (offset < limit) {
		size_t left = limit - offset;
		struct ebt_entry *e = (void *)newinfo->entries + offset;
412

413
		if (left < sizeof(unsigned int))
L
Linus Torvalds 已提交
414
			break;
415 416 417 418

		for (i = 0; i < NF_BR_NUMHOOKS; i++) {
			if ((valid_hooks & (1 << i)) == 0)
				continue;
419 420
			if ((char __user *)repl->hook_entry[i] ==
			     repl->entries + offset)
421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441
				break;
		}

		if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
			if (e->bitmask != 0) {
				/* we make userspace set this right,
				   so there is no misunderstanding */
				BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
					 "in distinguisher\n");
				return -EINVAL;
			}
			if (i != NF_BR_NUMHOOKS)
				newinfo->hook_entry[i] = (struct ebt_entries *)e;
			if (left < sizeof(struct ebt_entries))
				break;
			offset += sizeof(struct ebt_entries);
		} else {
			if (left < sizeof(struct ebt_entry))
				break;
			if (left < e->next_offset)
				break;
442 443
			if (e->next_offset < sizeof(struct ebt_entry))
				return -EINVAL;
444
			offset += e->next_offset;
L
Linus Torvalds 已提交
445
		}
446
	}
447 448 449 450
	if (offset != limit) {
		BUGPRINT("entries_size too small\n");
		return -EINVAL;
	}
451 452 453 454 455 456 457 458 459

	/* check if all valid hooks have a chain */
	for (i = 0; i < NF_BR_NUMHOOKS; i++) {
		if (!newinfo->hook_entry[i] &&
		   (valid_hooks & (1 << i))) {
			BUGPRINT("Valid hook without chain\n");
			return -EINVAL;
		}
	}
460 461 462 463 464 465 466 467
	return 0;
}

/*
 * this one is very careful, as it is the first function
 * to parse the userspace data
 */
static inline int
468 469
ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
   const struct ebt_table_info *newinfo,
470 471
   unsigned int *n, unsigned int *cnt,
   unsigned int *totalcnt, unsigned int *udc_cnt)
472 473 474 475
{
	int i;

	for (i = 0; i < NF_BR_NUMHOOKS; i++) {
476
		if ((void *)e == (void *)newinfo->hook_entry[i])
477 478 479 480 481
			break;
	}
	/* beginning of a new chain
	   if i == NF_BR_NUMHOOKS it must be a user defined chain */
	if (i != NF_BR_NUMHOOKS || !e->bitmask) {
L
Linus Torvalds 已提交
482 483 484 485
		/* this checks if the previous chain has as many entries
		   as it said it has */
		if (*n != *cnt) {
			BUGPRINT("nentries does not equal the nr of entries "
486
				 "in the chain\n");
L
Linus Torvalds 已提交
487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537
			return -EINVAL;
		}
		if (((struct ebt_entries *)e)->policy != EBT_DROP &&
		   ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
			/* only RETURN from udc */
			if (i != NF_BR_NUMHOOKS ||
			   ((struct ebt_entries *)e)->policy != EBT_RETURN) {
				BUGPRINT("bad policy\n");
				return -EINVAL;
			}
		}
		if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
			(*udc_cnt)++;
		if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
			BUGPRINT("counter_offset != totalcnt");
			return -EINVAL;
		}
		*n = ((struct ebt_entries *)e)->nentries;
		*cnt = 0;
		return 0;
	}
	/* a plain old entry, heh */
	if (sizeof(struct ebt_entry) > e->watchers_offset ||
	   e->watchers_offset > e->target_offset ||
	   e->target_offset >= e->next_offset) {
		BUGPRINT("entry offsets not in right order\n");
		return -EINVAL;
	}
	/* this is not checked anywhere else */
	if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
		BUGPRINT("target size too small\n");
		return -EINVAL;
	}
	(*cnt)++;
	(*totalcnt)++;
	return 0;
}

struct ebt_cl_stack
{
	struct ebt_chainstack cs;
	int from;
	unsigned int hookmask;
};

/*
 * we need these positions to check that the jumps to a different part of the
 * entries is a jump to the beginning of a new chain.
 */
static inline int
ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
538
   unsigned int *n, struct ebt_cl_stack *udc)
L
Linus Torvalds 已提交
539 540 541 542
{
	int i;

	/* we're only interested in chain starts */
543
	if (e->bitmask)
L
Linus Torvalds 已提交
544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562
		return 0;
	for (i = 0; i < NF_BR_NUMHOOKS; i++) {
		if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
			break;
	}
	/* only care about udc */
	if (i != NF_BR_NUMHOOKS)
		return 0;

	udc[*n].cs.chaininfo = (struct ebt_entries *)e;
	/* these initialisations are depended on later in check_chainloops() */
	udc[*n].cs.n = 0;
	udc[*n].hookmask = 0;

	(*n)++;
	return 0;
}

static inline int
563
ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
L
Linus Torvalds 已提交
564
{
565 566
	struct xt_mtdtor_param par;

L
Linus Torvalds 已提交
567 568 569
	if (i && (*i)-- == 0)
		return 1;

570
	par.net       = net;
571 572
	par.match     = m->u.match;
	par.matchinfo = m->data;
573
	par.family    = NFPROTO_BRIDGE;
574 575 576
	if (par.match->destroy != NULL)
		par.match->destroy(&par);
	module_put(par.match->me);
L
Linus Torvalds 已提交
577 578 579 580
	return 0;
}

static inline int
581
ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
L
Linus Torvalds 已提交
582
{
583 584
	struct xt_tgdtor_param par;

L
Linus Torvalds 已提交
585 586 587
	if (i && (*i)-- == 0)
		return 1;

588
	par.net      = net;
589 590
	par.target   = w->u.watcher;
	par.targinfo = w->data;
591
	par.family   = NFPROTO_BRIDGE;
592 593 594
	if (par.target->destroy != NULL)
		par.target->destroy(&par);
	module_put(par.target->me);
L
Linus Torvalds 已提交
595 596 597 598
	return 0;
}

static inline int
599
ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
L
Linus Torvalds 已提交
600
{
601
	struct xt_tgdtor_param par;
L
Linus Torvalds 已提交
602 603
	struct ebt_entry_target *t;

604
	if (e->bitmask == 0)
L
Linus Torvalds 已提交
605 606 607 608
		return 0;
	/* we're done */
	if (cnt && (*cnt)-- == 0)
		return 1;
609
	EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
610
	EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
L
Linus Torvalds 已提交
611 612
	t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);

613
	par.net      = net;
614 615
	par.target   = t->u.target;
	par.targinfo = t->data;
616
	par.family   = NFPROTO_BRIDGE;
617 618 619
	if (par.target->destroy != NULL)
		par.target->destroy(&par);
	module_put(par.target->me);
L
Linus Torvalds 已提交
620 621 622 623
	return 0;
}

static inline int
624 625
ebt_check_entry(struct ebt_entry *e, struct net *net,
   const struct ebt_table_info *newinfo,
626
   const char *name, unsigned int *cnt,
L
Linus Torvalds 已提交
627 628 629
   struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
{
	struct ebt_entry_target *t;
630
	struct xt_target *target;
L
Linus Torvalds 已提交
631
	unsigned int i, j, hook = 0, hookmask = 0;
632
	size_t gap;
L
Linus Torvalds 已提交
633
	int ret;
634
	struct xt_mtchk_param mtpar;
635
	struct xt_tgchk_param tgpar;
L
Linus Torvalds 已提交
636 637

	/* don't mess with the struct ebt_entries */
638
	if (e->bitmask == 0)
L
Linus Torvalds 已提交
639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654
		return 0;

	if (e->bitmask & ~EBT_F_MASK) {
		BUGPRINT("Unknown flag for bitmask\n");
		return -EINVAL;
	}
	if (e->invflags & ~EBT_INV_MASK) {
		BUGPRINT("Unknown flag for inv bitmask\n");
		return -EINVAL;
	}
	if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
		BUGPRINT("NOPROTO & 802_3 not allowed\n");
		return -EINVAL;
	}
	/* what hook do we belong to? */
	for (i = 0; i < NF_BR_NUMHOOKS; i++) {
655
		if (!newinfo->hook_entry[i])
L
Linus Torvalds 已提交
656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675
			continue;
		if ((char *)newinfo->hook_entry[i] < (char *)e)
			hook = i;
		else
			break;
	}
	/* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
	   a base chain */
	if (i < NF_BR_NUMHOOKS)
		hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
	else {
		for (i = 0; i < udc_cnt; i++)
			if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
				break;
		if (i == 0)
			hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
		else
			hookmask = cl_s[i - 1].hookmask;
	}
	i = 0;
676

677
	mtpar.net	= tgpar.net       = net;
678 679 680
	mtpar.table     = tgpar.table     = name;
	mtpar.entryinfo = tgpar.entryinfo = e;
	mtpar.hook_mask = tgpar.hook_mask = hookmask;
681
	mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
682
	ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
L
Linus Torvalds 已提交
683 684 685
	if (ret != 0)
		goto cleanup_matches;
	j = 0;
686
	ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
L
Linus Torvalds 已提交
687 688 689
	if (ret != 0)
		goto cleanup_watchers;
	t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
690
	gap = e->next_offset - e->target_offset;
L
Linus Torvalds 已提交
691

692 693 694 695 696
	target = try_then_request_module(
		 xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
		 "ebt_%s", t->u.name);
	if (IS_ERR(target)) {
		ret = PTR_ERR(target);
697
		goto cleanup_watchers;
698 699
	} else if (target == NULL) {
		ret = -ENOENT;
700 701 702
		goto cleanup_watchers;
	}

L
Linus Torvalds 已提交
703 704
	t->u.target = target;
	if (t->u.target == &ebt_standard_target) {
705
		if (gap < sizeof(struct ebt_standard_target)) {
L
Linus Torvalds 已提交
706 707 708 709 710 711 712 713 714 715
			BUGPRINT("Standard target size too big\n");
			ret = -EFAULT;
			goto cleanup_watchers;
		}
		if (((struct ebt_standard_target *)t)->verdict <
		   -NUM_STANDARD_TARGETS) {
			BUGPRINT("Invalid standard target\n");
			ret = -EFAULT;
			goto cleanup_watchers;
		}
716 717 718 719
	} else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
		module_put(t->u.target->me);
		ret = -EFAULT;
		goto cleanup_watchers;
720 721
	}

722 723
	tgpar.target   = target;
	tgpar.targinfo = t->data;
724
	ret = xt_check_target(&tgpar, t->target_size,
725
	      e->ethproto, e->invflags & EBT_IPROTO);
726 727
	if (ret < 0) {
		module_put(target->me);
728
		goto cleanup_watchers;
L
Linus Torvalds 已提交
729 730 731 732
	}
	(*cnt)++;
	return 0;
cleanup_watchers:
733
	EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
L
Linus Torvalds 已提交
734
cleanup_matches:
735
	EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
L
Linus Torvalds 已提交
736 737 738 739 740 741 742 743
	return ret;
}

/*
 * checks for loops and sets the hook mask for udc
 * the hook mask for udc tells us from which base chains the udc can be
 * accessed. This mask is a parameter to the check() functions of the extensions
 */
744
static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
L
Linus Torvalds 已提交
745 746 747
   unsigned int udc_cnt, unsigned int hooknr, char *base)
{
	int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
748 749
	const struct ebt_entry *e = (struct ebt_entry *)chain->data;
	const struct ebt_entry_target *t;
L
Linus Torvalds 已提交
750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792

	while (pos < nentries || chain_nr != -1) {
		/* end of udc, go back one 'recursion' step */
		if (pos == nentries) {
			/* put back values of the time when this chain was called */
			e = cl_s[chain_nr].cs.e;
			if (cl_s[chain_nr].from != -1)
				nentries =
				cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
			else
				nentries = chain->nentries;
			pos = cl_s[chain_nr].cs.n;
			/* make sure we won't see a loop that isn't one */
			cl_s[chain_nr].cs.n = 0;
			chain_nr = cl_s[chain_nr].from;
			if (pos == nentries)
				continue;
		}
		t = (struct ebt_entry_target *)
		   (((char *)e) + e->target_offset);
		if (strcmp(t->u.name, EBT_STANDARD_TARGET))
			goto letscontinue;
		if (e->target_offset + sizeof(struct ebt_standard_target) >
		   e->next_offset) {
			BUGPRINT("Standard target size too big\n");
			return -1;
		}
		verdict = ((struct ebt_standard_target *)t)->verdict;
		if (verdict >= 0) { /* jump to another chain */
			struct ebt_entries *hlp2 =
			   (struct ebt_entries *)(base + verdict);
			for (i = 0; i < udc_cnt; i++)
				if (hlp2 == cl_s[i].cs.chaininfo)
					break;
			/* bad destination or loop */
			if (i == udc_cnt) {
				BUGPRINT("bad destination\n");
				return -1;
			}
			if (cl_s[i].cs.n) {
				BUGPRINT("loop\n");
				return -1;
			}
793 794 795
			if (cl_s[i].hookmask & (1 << hooknr))
				goto letscontinue;
			/* this can't be 0, so the loop test is correct */
L
Linus Torvalds 已提交
796 797
			cl_s[i].cs.n = pos + 1;
			pos = 0;
798
			cl_s[i].cs.e = ebt_next_entry(e);
L
Linus Torvalds 已提交
799 800 801 802 803 804 805 806 807
			e = (struct ebt_entry *)(hlp2->data);
			nentries = hlp2->nentries;
			cl_s[i].from = chain_nr;
			chain_nr = i;
			/* this udc is accessible from the base chain for hooknr */
			cl_s[i].hookmask |= (1 << hooknr);
			continue;
		}
letscontinue:
808
		e = ebt_next_entry(e);
L
Linus Torvalds 已提交
809 810 811 812 813 814
		pos++;
	}
	return 0;
}

/* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
815
static int translate_table(struct net *net, const char *name,
816
			   struct ebt_table_info *newinfo)
L
Linus Torvalds 已提交
817 818 819 820 821 822
{
	unsigned int i, j, k, udc_cnt;
	int ret;
	struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */

	i = 0;
823
	while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
L
Linus Torvalds 已提交
824 825 826 827 828
		i++;
	if (i == NF_BR_NUMHOOKS) {
		BUGPRINT("No valid hooks specified\n");
		return -EINVAL;
	}
829
	if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
L
Linus Torvalds 已提交
830 831 832 833 834 835
		BUGPRINT("Chains don't start at beginning\n");
		return -EINVAL;
	}
	/* make sure chains are ordered after each other in same order
	   as their corresponding hooks */
	for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
836
		if (!newinfo->hook_entry[j])
L
Linus Torvalds 已提交
837
			continue;
838
		if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
L
Linus Torvalds 已提交
839 840 841 842 843 844 845 846 847 848
			BUGPRINT("Hook order must be followed\n");
			return -EINVAL;
		}
		i = j;
	}

	/* do some early checkings and initialize some things */
	i = 0; /* holds the expected nr. of entries for the chain */
	j = 0; /* holds the up to now counted entries for the chain */
	k = 0; /* holds the total nr. of entries, should equal
849
		  newinfo->nentries afterwards */
L
Linus Torvalds 已提交
850 851
	udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
	ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
852 853
	   ebt_check_entry_size_and_hooks, newinfo,
	   &i, &j, &k, &udc_cnt);
L
Linus Torvalds 已提交
854 855 856 857 858 859

	if (ret != 0)
		return ret;

	if (i != j) {
		BUGPRINT("nentries does not equal the nr of entries in the "
860
			 "(last) chain\n");
L
Linus Torvalds 已提交
861 862 863 864 865 866 867 868 869 870 871 872
		return -EINVAL;
	}
	if (k != newinfo->nentries) {
		BUGPRINT("Total nentries is wrong\n");
		return -EINVAL;
	}

	/* get the location of the udc, put them in an array
	   while we're at it, allocate the chainstack */
	if (udc_cnt) {
		/* this will get free'd in do_replace()/ebt_register_table()
		   if an error occurs */
873
		newinfo->chainstack =
874
			vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
L
Linus Torvalds 已提交
875 876
		if (!newinfo->chainstack)
			return -ENOMEM;
877
		for_each_possible_cpu(i) {
L
Linus Torvalds 已提交
878
			newinfo->chainstack[i] =
879
			  vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
L
Linus Torvalds 已提交
880 881 882 883 884 885 886 887 888
			if (!newinfo->chainstack[i]) {
				while (i)
					vfree(newinfo->chainstack[--i]);
				vfree(newinfo->chainstack);
				newinfo->chainstack = NULL;
				return -ENOMEM;
			}
		}

889
		cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
L
Linus Torvalds 已提交
890 891 892 893
		if (!cl_s)
			return -ENOMEM;
		i = 0; /* the i'th udc */
		EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
894
		   ebt_get_udc_positions, newinfo, &i, cl_s);
L
Linus Torvalds 已提交
895 896 897 898 899 900 901 902 903 904
		/* sanity check */
		if (i != udc_cnt) {
			BUGPRINT("i != udc_cnt\n");
			vfree(cl_s);
			return -EFAULT;
		}
	}

	/* Check for loops */
	for (i = 0; i < NF_BR_NUMHOOKS; i++)
905
		if (newinfo->hook_entry[i])
L
Linus Torvalds 已提交
906 907
			if (check_chainloops(newinfo->hook_entry[i],
			   cl_s, udc_cnt, i, newinfo->entries)) {
908
				vfree(cl_s);
L
Linus Torvalds 已提交
909 910 911
				return -EINVAL;
			}

912
	/* we now know the following (along with E=mc²):
L
Linus Torvalds 已提交
913 914 915 916 917 918 919 920 921 922 923 924
	   - the nr of entries in each chain is right
	   - the size of the allocated space is right
	   - all valid hooks have a corresponding chain
	   - there are no loops
	   - wrong data can still be on the level of a single entry
	   - could be there are jumps to places that are not the
	     beginning of a chain. This can only occur in chains that
	     are not accessible from any base chains, so we don't care. */

	/* used to know what we need to clean up if something goes wrong */
	i = 0;
	ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
925
	   ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
L
Linus Torvalds 已提交
926 927
	if (ret != 0) {
		EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
928
				  ebt_cleanup_entry, net, &i);
L
Linus Torvalds 已提交
929
	}
930
	vfree(cl_s);
L
Linus Torvalds 已提交
931 932 933 934
	return ret;
}

/* called under write_lock */
935
static void get_counters(const struct ebt_counter *oldcounters,
L
Linus Torvalds 已提交
936 937 938 939 940 941 942
   struct ebt_counter *counters, unsigned int nentries)
{
	int i, cpu;
	struct ebt_counter *counter_base;

	/* counters of cpu 0 */
	memcpy(counters, oldcounters,
943 944
	       sizeof(struct ebt_counter) * nentries);

L
Linus Torvalds 已提交
945
	/* add other counters to those of cpu 0 */
946
	for_each_possible_cpu(cpu) {
947 948
		if (cpu == 0)
			continue;
L
Linus Torvalds 已提交
949 950 951 952 953 954 955 956
		counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
		for (i = 0; i < nentries; i++) {
			counters[i].pcnt += counter_base[i].pcnt;
			counters[i].bcnt += counter_base[i].bcnt;
		}
	}
}

957 958
static int do_replace_finish(struct net *net, struct ebt_replace *repl,
			      struct ebt_table_info *newinfo)
L
Linus Torvalds 已提交
959
{
960
	int ret, i;
L
Linus Torvalds 已提交
961 962 963
	struct ebt_counter *counterstmp = NULL;
	/* used to be able to unlock earlier */
	struct ebt_table_info *table;
964
	struct ebt_table *t;
L
Linus Torvalds 已提交
965 966 967

	/* the user wants counters back
	   the check on the size is done later, when we have the lock */
968 969 970 971 972
	if (repl->num_counters) {
		unsigned long size = repl->num_counters * sizeof(*counterstmp);
		counterstmp = vmalloc(size);
		if (!counterstmp)
			return -ENOMEM;
L
Linus Torvalds 已提交
973 974 975
	}

	newinfo->chainstack = NULL;
976
	ret = ebt_verify_pointers(repl, newinfo);
977 978 979
	if (ret != 0)
		goto free_counterstmp;

980
	ret = translate_table(net, repl->name, newinfo);
L
Linus Torvalds 已提交
981 982 983 984

	if (ret != 0)
		goto free_counterstmp;

985
	t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
L
Linus Torvalds 已提交
986 987 988 989 990 991
	if (!t) {
		ret = -ENOENT;
		goto free_iterate;
	}

	/* the table doesn't like it */
992
	if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
L
Linus Torvalds 已提交
993 994
		goto free_unlock;

995
	if (repl->num_counters && repl->num_counters != t->private->nentries) {
L
Linus Torvalds 已提交
996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010
		BUGPRINT("Wrong nr. of counters requested\n");
		ret = -EINVAL;
		goto free_unlock;
	}

	/* we have the mutex lock, so no danger in reading this pointer */
	table = t->private;
	/* make sure the table can only be rmmod'ed if it contains no rules */
	if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
		ret = -ENOENT;
		goto free_unlock;
	} else if (table->nentries && !newinfo->nentries)
		module_put(t->me);
	/* we need an atomic snapshot of the counters */
	write_lock_bh(&t->lock);
1011
	if (repl->num_counters)
L
Linus Torvalds 已提交
1012 1013 1014 1015 1016
		get_counters(t->private->counters, counterstmp,
		   t->private->nentries);

	t->private = newinfo;
	write_unlock_bh(&t->lock);
I
Ingo Molnar 已提交
1017
	mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1018 1019 1020 1021
	/* so, a user can change the chains while having messed up her counter
	   allocation. Only reason why this is done is because this way the lock
	   is held only once, while this doesn't bring the kernel into a
	   dangerous state. */
1022 1023 1024
	if (repl->num_counters &&
	   copy_to_user(repl->counters, counterstmp,
	   repl->num_counters * sizeof(struct ebt_counter))) {
L
Linus Torvalds 已提交
1025 1026 1027 1028 1029 1030 1031
		ret = -EFAULT;
	}
	else
		ret = 0;

	/* decrease module count and free resources */
	EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1032
			  ebt_cleanup_entry, net, NULL);
L
Linus Torvalds 已提交
1033 1034 1035

	vfree(table->entries);
	if (table->chainstack) {
1036
		for_each_possible_cpu(i)
L
Linus Torvalds 已提交
1037 1038 1039 1040 1041
			vfree(table->chainstack[i]);
		vfree(table->chainstack);
	}
	vfree(table);

1042
	vfree(counterstmp);
L
Linus Torvalds 已提交
1043 1044 1045
	return ret;

free_unlock:
I
Ingo Molnar 已提交
1046
	mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1047 1048
free_iterate:
	EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1049
			  ebt_cleanup_entry, net, NULL);
L
Linus Torvalds 已提交
1050
free_counterstmp:
1051
	vfree(counterstmp);
L
Linus Torvalds 已提交
1052 1053
	/* can be initialized in translate_table() */
	if (newinfo->chainstack) {
1054
		for_each_possible_cpu(i)
L
Linus Torvalds 已提交
1055 1056 1057
			vfree(newinfo->chainstack[i]);
		vfree(newinfo->chainstack);
	}
1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110
	return ret;
}

/* replace the table */
static int do_replace(struct net *net, const void __user *user,
		      unsigned int len)
{
	int ret, countersize;
	struct ebt_table_info *newinfo;
	struct ebt_replace tmp;

	if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
		return -EFAULT;

	if (len != sizeof(tmp) + tmp.entries_size) {
		BUGPRINT("Wrong len argument\n");
		return -EINVAL;
	}

	if (tmp.entries_size == 0) {
		BUGPRINT("Entries_size never zero\n");
		return -EINVAL;
	}
	/* overflow check */
	if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
			NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
		return -ENOMEM;
	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
		return -ENOMEM;

	countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
	newinfo = vmalloc(sizeof(*newinfo) + countersize);
	if (!newinfo)
		return -ENOMEM;

	if (countersize)
		memset(newinfo->counters, 0, countersize);

	newinfo->entries = vmalloc(tmp.entries_size);
	if (!newinfo->entries) {
		ret = -ENOMEM;
		goto free_newinfo;
	}
	if (copy_from_user(
	   newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
		BUGPRINT("Couldn't copy entries from userspace\n");
		ret = -EFAULT;
		goto free_entries;
	}

	ret = do_replace_finish(net, &tmp, newinfo);
	if (ret == 0)
		return ret;
L
Linus Torvalds 已提交
1111
free_entries:
1112
	vfree(newinfo->entries);
L
Linus Torvalds 已提交
1113
free_newinfo:
1114
	vfree(newinfo);
L
Linus Torvalds 已提交
1115 1116 1117
	return ret;
}

1118 1119
struct ebt_table *
ebt_register_table(struct net *net, const struct ebt_table *input_table)
L
Linus Torvalds 已提交
1120 1121
{
	struct ebt_table_info *newinfo;
1122
	struct ebt_table *t, *table;
1123
	struct ebt_replace_kernel *repl;
L
Linus Torvalds 已提交
1124
	int ret, i, countersize;
1125
	void *p;
L
Linus Torvalds 已提交
1126

1127 1128 1129
	if (input_table == NULL || (repl = input_table->table) == NULL ||
	    repl->entries == 0 || repl->entries_size == 0 ||
	    repl->counters != NULL || input_table->private != NULL) {
L
Linus Torvalds 已提交
1130
		BUGPRINT("Bad table data for ebt_register_table!!!\n");
1131 1132 1133 1134
		return ERR_PTR(-EINVAL);
	}

	/* Don't add one table to multiple lists. */
1135
	table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1136 1137 1138
	if (!table) {
		ret = -ENOMEM;
		goto out;
L
Linus Torvalds 已提交
1139 1140
	}

1141
	countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1142
	newinfo = vmalloc(sizeof(*newinfo) + countersize);
L
Linus Torvalds 已提交
1143 1144
	ret = -ENOMEM;
	if (!newinfo)
1145
		goto free_table;
L
Linus Torvalds 已提交
1146

1147 1148
	p = vmalloc(repl->entries_size);
	if (!p)
L
Linus Torvalds 已提交
1149 1150
		goto free_newinfo;

1151 1152 1153 1154 1155
	memcpy(p, repl->entries, repl->entries_size);
	newinfo->entries = p;

	newinfo->entries_size = repl->entries_size;
	newinfo->nentries = repl->nentries;
L
Linus Torvalds 已提交
1156 1157 1158 1159 1160 1161

	if (countersize)
		memset(newinfo->counters, 0, countersize);

	/* fill in newinfo and parse the entries */
	newinfo->chainstack = NULL;
1162 1163 1164 1165 1166 1167 1168
	for (i = 0; i < NF_BR_NUMHOOKS; i++) {
		if ((repl->valid_hooks & (1 << i)) == 0)
			newinfo->hook_entry[i] = NULL;
		else
			newinfo->hook_entry[i] = p +
				((char *)repl->hook_entry[i] - repl->entries);
	}
1169
	ret = translate_table(net, repl->name, newinfo);
L
Linus Torvalds 已提交
1170 1171 1172 1173 1174 1175 1176
	if (ret != 0) {
		BUGPRINT("Translate_table failed\n");
		goto free_chainstack;
	}

	if (table->check && table->check(newinfo, table->valid_hooks)) {
		BUGPRINT("The table doesn't like its own initial data, lol\n");
1177
		return ERR_PTR(-EINVAL);
L
Linus Torvalds 已提交
1178 1179 1180 1181
	}

	table->private = newinfo;
	rwlock_init(&table->lock);
I
Ingo Molnar 已提交
1182
	ret = mutex_lock_interruptible(&ebt_mutex);
L
Linus Torvalds 已提交
1183 1184 1185
	if (ret != 0)
		goto free_chainstack;

1186
	list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
P
Patrick McHardy 已提交
1187 1188 1189 1190 1191
		if (strcmp(t->name, table->name) == 0) {
			ret = -EEXIST;
			BUGPRINT("Table name already exists\n");
			goto free_unlock;
		}
L
Linus Torvalds 已提交
1192 1193 1194 1195 1196 1197 1198
	}

	/* Hold a reference count if the chains aren't empty */
	if (newinfo->nentries && !try_module_get(table->me)) {
		ret = -ENOENT;
		goto free_unlock;
	}
1199
	list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
I
Ingo Molnar 已提交
1200
	mutex_unlock(&ebt_mutex);
1201
	return table;
L
Linus Torvalds 已提交
1202
free_unlock:
I
Ingo Molnar 已提交
1203
	mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1204 1205
free_chainstack:
	if (newinfo->chainstack) {
1206
		for_each_possible_cpu(i)
L
Linus Torvalds 已提交
1207 1208 1209 1210 1211 1212
			vfree(newinfo->chainstack[i]);
		vfree(newinfo->chainstack);
	}
	vfree(newinfo->entries);
free_newinfo:
	vfree(newinfo);
1213 1214 1215 1216
free_table:
	kfree(table);
out:
	return ERR_PTR(ret);
L
Linus Torvalds 已提交
1217 1218
}

1219
void ebt_unregister_table(struct net *net, struct ebt_table *table)
L
Linus Torvalds 已提交
1220 1221 1222 1223 1224 1225 1226
{
	int i;

	if (!table) {
		BUGPRINT("Request to unregister NULL table!!!\n");
		return;
	}
I
Ingo Molnar 已提交
1227
	mutex_lock(&ebt_mutex);
P
Patrick McHardy 已提交
1228
	list_del(&table->list);
I
Ingo Molnar 已提交
1229
	mutex_unlock(&ebt_mutex);
1230
	EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1231
			  ebt_cleanup_entry, net, NULL);
1232 1233
	if (table->private->nentries)
		module_put(table->me);
1234
	vfree(table->private->entries);
L
Linus Torvalds 已提交
1235
	if (table->private->chainstack) {
1236
		for_each_possible_cpu(i)
L
Linus Torvalds 已提交
1237 1238 1239 1240
			vfree(table->private->chainstack[i]);
		vfree(table->private->chainstack);
	}
	vfree(table->private);
1241
	kfree(table);
L
Linus Torvalds 已提交
1242 1243 1244
}

/* userspace just supplied us with counters */
1245 1246 1247 1248
static int do_update_counters(struct net *net, const char *name,
				struct ebt_counter __user *counters,
				unsigned int num_counters,
				const void __user *user, unsigned int len)
L
Linus Torvalds 已提交
1249 1250 1251 1252 1253
{
	int i, ret;
	struct ebt_counter *tmp;
	struct ebt_table *t;

1254
	if (num_counters == 0)
L
Linus Torvalds 已提交
1255 1256
		return -EINVAL;

1257 1258
	tmp = vmalloc(num_counters * sizeof(*tmp));
	if (!tmp)
L
Linus Torvalds 已提交
1259 1260
		return -ENOMEM;

1261
	t = find_table_lock(net, name, &ret, &ebt_mutex);
L
Linus Torvalds 已提交
1262 1263 1264
	if (!t)
		goto free_tmp;

1265
	if (num_counters != t->private->nentries) {
L
Linus Torvalds 已提交
1266 1267 1268 1269 1270
		BUGPRINT("Wrong nr of counters\n");
		ret = -EINVAL;
		goto unlock_mutex;
	}

1271
	if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
L
Linus Torvalds 已提交
1272 1273 1274 1275 1276 1277 1278 1279
		ret = -EFAULT;
		goto unlock_mutex;
	}

	/* we want an atomic add of the counters */
	write_lock_bh(&t->lock);

	/* we add to the counters of the first cpu */
1280
	for (i = 0; i < num_counters; i++) {
L
Linus Torvalds 已提交
1281 1282 1283 1284 1285 1286 1287
		t->private->counters[i].pcnt += tmp[i].pcnt;
		t->private->counters[i].bcnt += tmp[i].bcnt;
	}

	write_unlock_bh(&t->lock);
	ret = 0;
unlock_mutex:
I
Ingo Molnar 已提交
1288
	mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1289 1290 1291 1292 1293
free_tmp:
	vfree(tmp);
	return ret;
}

1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308
static int update_counters(struct net *net, const void __user *user,
			    unsigned int len)
{
	struct ebt_replace hlp;

	if (copy_from_user(&hlp, user, sizeof(hlp)))
		return -EFAULT;

	if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
		return -EINVAL;

	return do_update_counters(net, hlp.name, hlp.counters,
				hlp.num_counters, user, len);
}

1309 1310
static inline int ebt_make_matchname(const struct ebt_entry_match *m,
    const char *base, char __user *ubase)
L
Linus Torvalds 已提交
1311
{
1312
	char __user *hlp = ubase + ((char *)m - base);
L
Linus Torvalds 已提交
1313 1314 1315 1316 1317
	if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
		return -EFAULT;
	return 0;
}

1318 1319
static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
    const char *base, char __user *ubase)
L
Linus Torvalds 已提交
1320
{
1321
	char __user *hlp = ubase + ((char *)w - base);
L
Linus Torvalds 已提交
1322 1323 1324 1325 1326
	if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
		return -EFAULT;
	return 0;
}

1327 1328
static inline int
ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
L
Linus Torvalds 已提交
1329 1330
{
	int ret;
1331
	char __user *hlp;
1332
	const struct ebt_entry_target *t;
L
Linus Torvalds 已提交
1333

1334
	if (e->bitmask == 0)
L
Linus Torvalds 已提交
1335 1336
		return 0;

1337
	hlp = ubase + (((char *)e + e->target_offset) - base);
L
Linus Torvalds 已提交
1338
	t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1339

L
Linus Torvalds 已提交
1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350
	ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
	if (ret != 0)
		return ret;
	ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
	if (ret != 0)
		return ret;
	if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
		return -EFAULT;
	return 0;
}

1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382
static int copy_counters_to_user(struct ebt_table *t,
				  const struct ebt_counter *oldcounters,
				  void __user *user, unsigned int num_counters,
				  unsigned int nentries)
{
	struct ebt_counter *counterstmp;
	int ret = 0;

	/* userspace might not need the counters */
	if (num_counters == 0)
		return 0;

	if (num_counters != nentries) {
		BUGPRINT("Num_counters wrong\n");
		return -EINVAL;
	}

	counterstmp = vmalloc(nentries * sizeof(*counterstmp));
	if (!counterstmp)
		return -ENOMEM;

	write_lock_bh(&t->lock);
	get_counters(oldcounters, counterstmp, nentries);
	write_unlock_bh(&t->lock);

	if (copy_to_user(user, counterstmp,
	   nentries * sizeof(struct ebt_counter)))
		ret = -EFAULT;
	vfree(counterstmp);
	return ret;
}

I
Ingo Molnar 已提交
1383
/* called with ebt_mutex locked */
L
Linus Torvalds 已提交
1384
static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1385
    const int *len, int cmd)
L
Linus Torvalds 已提交
1386 1387
{
	struct ebt_replace tmp;
1388
	const struct ebt_counter *oldcounters;
L
Linus Torvalds 已提交
1389
	unsigned int entries_size, nentries;
1390
	int ret;
L
Linus Torvalds 已提交
1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425
	char *entries;

	if (cmd == EBT_SO_GET_ENTRIES) {
		entries_size = t->private->entries_size;
		nentries = t->private->nentries;
		entries = t->private->entries;
		oldcounters = t->private->counters;
	} else {
		entries_size = t->table->entries_size;
		nentries = t->table->nentries;
		entries = t->table->entries;
		oldcounters = t->table->counters;
	}

	if (copy_from_user(&tmp, user, sizeof(tmp))) {
		BUGPRINT("Cfu didn't work\n");
		return -EFAULT;
	}

	if (*len != sizeof(struct ebt_replace) + entries_size +
	   (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
		BUGPRINT("Wrong size\n");
		return -EINVAL;
	}

	if (tmp.nentries != nentries) {
		BUGPRINT("Nentries wrong\n");
		return -EINVAL;
	}

	if (tmp.entries_size != entries_size) {
		BUGPRINT("Wrong size\n");
		return -EINVAL;
	}

1426 1427 1428 1429
	ret = copy_counters_to_user(t, oldcounters, tmp.counters,
					tmp.num_counters, nentries);
	if (ret)
		return ret;
L
Linus Torvalds 已提交
1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444

	if (copy_to_user(tmp.entries, entries, entries_size)) {
		BUGPRINT("Couldn't copy entries to userspace\n");
		return -EFAULT;
	}
	/* set the match/watcher/target names right */
	return EBT_ENTRY_ITERATE(entries, entries_size,
	   ebt_make_names, entries, tmp.entries);
}

static int do_ebt_set_ctl(struct sock *sk,
	int cmd, void __user *user, unsigned int len)
{
	int ret;

1445 1446 1447
	if (!capable(CAP_NET_ADMIN))
		return -EPERM;

L
Linus Torvalds 已提交
1448 1449
	switch(cmd) {
	case EBT_SO_SET_ENTRIES:
1450
		ret = do_replace(sock_net(sk), user, len);
L
Linus Torvalds 已提交
1451 1452
		break;
	case EBT_SO_SET_COUNTERS:
1453
		ret = update_counters(sock_net(sk), user, len);
L
Linus Torvalds 已提交
1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466
		break;
	default:
		ret = -EINVAL;
  }
	return ret;
}

static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
{
	int ret;
	struct ebt_replace tmp;
	struct ebt_table *t;

1467 1468 1469
	if (!capable(CAP_NET_ADMIN))
		return -EPERM;

L
Linus Torvalds 已提交
1470 1471 1472
	if (copy_from_user(&tmp, user, sizeof(tmp)))
		return -EFAULT;

1473
	t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
L
Linus Torvalds 已提交
1474 1475 1476 1477 1478 1479 1480 1481
	if (!t)
		return ret;

	switch(cmd) {
	case EBT_SO_GET_INFO:
	case EBT_SO_GET_INIT_INFO:
		if (*len != sizeof(struct ebt_replace)){
			ret = -EINVAL;
I
Ingo Molnar 已提交
1482
			mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493
			break;
		}
		if (cmd == EBT_SO_GET_INFO) {
			tmp.nentries = t->private->nentries;
			tmp.entries_size = t->private->entries_size;
			tmp.valid_hooks = t->valid_hooks;
		} else {
			tmp.nentries = t->table->nentries;
			tmp.entries_size = t->table->entries_size;
			tmp.valid_hooks = t->table->valid_hooks;
		}
I
Ingo Molnar 已提交
1494
		mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505
		if (copy_to_user(user, &tmp, *len) != 0){
			BUGPRINT("c2u Didn't work\n");
			ret = -EFAULT;
			break;
		}
		ret = 0;
		break;

	case EBT_SO_GET_ENTRIES:
	case EBT_SO_GET_INIT_ENTRIES:
		ret = copy_everything_to_user(t, user, len, cmd);
I
Ingo Molnar 已提交
1506
		mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1507 1508 1509
		break;

	default:
I
Ingo Molnar 已提交
1510
		mutex_unlock(&ebt_mutex);
L
Linus Torvalds 已提交
1511 1512 1513 1514 1515 1516 1517
		ret = -EINVAL;
	}

	return ret;
}

static struct nf_sockopt_ops ebt_sockopts =
A
Andrew Morton 已提交
1518 1519 1520 1521 1522 1523 1524 1525
{
	.pf		= PF_INET,
	.set_optmin	= EBT_BASE_CTL,
	.set_optmax	= EBT_SO_SET_MAX + 1,
	.set		= do_ebt_set_ctl,
	.get_optmin	= EBT_BASE_CTL,
	.get_optmax	= EBT_SO_GET_MAX + 1,
	.get		= do_ebt_get_ctl,
1526
	.owner		= THIS_MODULE,
L
Linus Torvalds 已提交
1527 1528
};

1529
static int __init ebtables_init(void)
L
Linus Torvalds 已提交
1530 1531 1532
{
	int ret;

1533 1534
	ret = xt_register_target(&ebt_standard_target);
	if (ret < 0)
L
Linus Torvalds 已提交
1535
		return ret;
1536 1537 1538 1539 1540
	ret = nf_register_sockopt(&ebt_sockopts);
	if (ret < 0) {
		xt_unregister_target(&ebt_standard_target);
		return ret;
	}
L
Linus Torvalds 已提交
1541

1542
	printk(KERN_INFO "Ebtables v2.0 registered\n");
L
Linus Torvalds 已提交
1543 1544 1545
	return 0;
}

1546
static void __exit ebtables_fini(void)
L
Linus Torvalds 已提交
1547 1548
{
	nf_unregister_sockopt(&ebt_sockopts);
1549
	xt_unregister_target(&ebt_standard_target);
1550
	printk(KERN_INFO "Ebtables v2.0 unregistered\n");
L
Linus Torvalds 已提交
1551 1552 1553 1554 1555
}

EXPORT_SYMBOL(ebt_register_table);
EXPORT_SYMBOL(ebt_unregister_table);
EXPORT_SYMBOL(ebt_do_table);
1556 1557
module_init(ebtables_init);
module_exit(ebtables_fini);
L
Linus Torvalds 已提交
1558
MODULE_LICENSE("GPL");