1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * ebtables 4 * 5 * Author: 6 * Bart De Schuymer <bdschuym@pandora.be> 7 * 8 * ebtables.c,v 2.0, July, 2002 9 * 10 * This code is strongly inspired by the iptables code which is 11 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 12 */ 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 #include <linux/kmod.h> 15 #include <linux/module.h> 16 #include <linux/vmalloc.h> 17 #include <linux/netfilter/x_tables.h> 18 #include <linux/netfilter_bridge/ebtables.h> 19 #include <linux/spinlock.h> 20 #include <linux/mutex.h> 21 #include <linux/slab.h> 22 #include <linux/uaccess.h> 23 #include <linux/smp.h> 24 #include <linux/cpumask.h> 25 #include <linux/audit.h> 26 #include <net/sock.h> 27 #include <net/netns/generic.h> 28 /* needed for logical [in,out]-dev filtering */ 29 #include "../br_private.h" 30 31 /* Each cpu has its own set of counters, so there is no need for write_lock in 32 * the softirq 33 * For reading or updating the counters, the user context needs to 34 * get a write_lock 35 */ 36 37 /* The size of each set of counters is altered to get cache alignment */ 38 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) 39 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter))) 40 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \ 41 COUNTER_OFFSET(n) * cpu)) 42 43 struct ebt_pernet { 44 struct list_head tables; 45 }; 46 47 struct ebt_template { 48 struct list_head list; 49 char name[EBT_TABLE_MAXNAMELEN]; 50 struct module *owner; 51 /* called when table is needed in the given netns */ 52 int (*table_init)(struct net *net); 53 }; 54 55 static unsigned int ebt_pernet_id __read_mostly; 56 static LIST_HEAD(template_tables); 57 static DEFINE_MUTEX(ebt_mutex); 58 59 #ifdef CONFIG_NETFILTER_XTABLES_COMPAT 60 static void ebt_standard_compat_from_user(void *dst, const void *src) 61 { 62 int v = *(compat_int_t *)src; 63 64 if (v >= 0) 65 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v); 66 memcpy(dst, &v, sizeof(v)); 67 } 68 69 static int ebt_standard_compat_to_user(void __user *dst, const void *src) 70 { 71 compat_int_t cv = *(int *)src; 72 73 if (cv >= 0) 74 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv); 75 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0; 76 } 77 #endif 78 79 80 static struct xt_target ebt_standard_target = { 81 .name = "standard", 82 .revision = 0, 83 .family = NFPROTO_BRIDGE, 84 .targetsize = sizeof(int), 85 #ifdef CONFIG_NETFILTER_XTABLES_COMPAT 86 .compatsize = sizeof(compat_int_t), 87 .compat_from_user = ebt_standard_compat_from_user, 88 .compat_to_user = ebt_standard_compat_to_user, 89 #endif 90 }; 91 92 static inline int 93 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb, 94 struct xt_action_param *par) 95 { 96 par->target = w->u.watcher; 97 par->targinfo = w->data; 98 w->u.watcher->target(skb, par); 99 /* watchers don't give a verdict */ 100 return 0; 101 } 102 103 static inline int 104 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb, 105 struct xt_action_param *par) 106 { 107 par->match = m->u.match; 108 par->matchinfo = m->data; 109 return !m->u.match->match(skb, par); 110 } 111 112 static inline int 113 ebt_dev_check(const char *entry, const struct net_device *device) 114 { 115 int i = 0; 116 const char *devname; 117 118 if (*entry == '\0') 119 return 0; 120 if (!device) 121 return 1; 122 devname = device->name; 123 /* 1 is the wildcard token */ 124 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i]) 125 i++; 126 return devname[i] != entry[i] && entry[i] != 1; 127 } 128 129 /* process standard matches */ 130 static inline int 131 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb, 132 const struct net_device *in, const struct net_device *out) 133 { 134 const struct ethhdr *h = eth_hdr(skb); 135 const struct net_bridge_port *p; 136 __be16 ethproto; 137 138 if (skb_vlan_tag_present(skb)) 139 ethproto = htons(ETH_P_8021Q); 140 else 141 ethproto = h->h_proto; 142 143 if (e->bitmask & EBT_802_3) { 144 if (NF_INVF(e, EBT_IPROTO, eth_proto_is_802_3(ethproto))) 145 return 1; 146 } else if (!(e->bitmask & EBT_NOPROTO) && 147 NF_INVF(e, EBT_IPROTO, e->ethproto != ethproto)) 148 return 1; 149 150 if (NF_INVF(e, EBT_IIN, ebt_dev_check(e->in, in))) 151 return 1; 152 if (NF_INVF(e, EBT_IOUT, ebt_dev_check(e->out, out))) 153 return 1; 154 /* rcu_read_lock()ed by nf_hook_thresh */ 155 if (in && (p = br_port_get_rcu(in)) != NULL && 156 NF_INVF(e, EBT_ILOGICALIN, 157 ebt_dev_check(e->logical_in, p->br->dev))) 158 return 1; 159 if (out && (p = br_port_get_rcu(out)) != NULL && 160 NF_INVF(e, EBT_ILOGICALOUT, 161 ebt_dev_check(e->logical_out, p->br->dev))) 162 return 1; 163 164 if (e->bitmask & EBT_SOURCEMAC) { 165 if (NF_INVF(e, EBT_ISOURCE, 166 !ether_addr_equal_masked(h->h_source, e->sourcemac, 167 e->sourcemsk))) 168 return 1; 169 } 170 if (e->bitmask & EBT_DESTMAC) { 171 if (NF_INVF(e, EBT_IDEST, 172 !ether_addr_equal_masked(h->h_dest, e->destmac, 173 e->destmsk))) 174 return 1; 175 } 176 return 0; 177 } 178 179 static inline 180 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry) 181 { 182 return (void *)entry + entry->next_offset; 183 } 184 185 static inline const struct ebt_entry_target * 186 ebt_get_target_c(const struct ebt_entry *e) 187 { 188 return ebt_get_target((struct ebt_entry *)e); 189 } 190 191 /* Do some firewalling */ 192 unsigned int ebt_do_table(void *priv, struct sk_buff *skb, 193 const struct nf_hook_state *state) 194 { 195 struct ebt_table *table = priv; 196 unsigned int hook = state->hook; 197 int i, nentries; 198 struct ebt_entry *point; 199 struct ebt_counter *counter_base, *cb_base; 200 const struct ebt_entry_target *t; 201 int verdict, sp = 0; 202 struct ebt_chainstack *cs; 203 struct ebt_entries *chaininfo; 204 const char *base; 205 const struct ebt_table_info *private; 206 struct xt_action_param acpar; 207 208 acpar.state = state; 209 acpar.hotdrop = false; 210 211 read_lock_bh(&table->lock); 212 private = table->private; 213 cb_base = COUNTER_BASE(private->counters, private->nentries, 214 smp_processor_id()); 215 if (private->chainstack) 216 cs = private->chainstack[smp_processor_id()]; 217 else 218 cs = NULL; 219 chaininfo = private->hook_entry[hook]; 220 nentries = private->hook_entry[hook]->nentries; 221 point = (struct ebt_entry *)(private->hook_entry[hook]->data); 222 counter_base = cb_base + private->hook_entry[hook]->counter_offset; 223 /* base for chain jumps */ 224 base = private->entries; 225 i = 0; 226 while (i < nentries) { 227 if (ebt_basic_match(point, skb, state->in, state->out)) 228 goto letscontinue; 229 230 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0) 231 goto letscontinue; 232 if (acpar.hotdrop) { 233 read_unlock_bh(&table->lock); 234 return NF_DROP; 235 } 236 237 ADD_COUNTER(*(counter_base + i), skb->len, 1); 238 239 /* these should only watch: not modify, nor tell us 240 * what to do with the packet 241 */ 242 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar); 243 244 t = ebt_get_target_c(point); 245 /* standard target */ 246 if (!t->u.target->target) 247 verdict = ((struct ebt_standard_target *)t)->verdict; 248 else { 249 acpar.target = t->u.target; 250 acpar.targinfo = t->data; 251 verdict = t->u.target->target(skb, &acpar); 252 } 253 if (verdict == EBT_ACCEPT) { 254 read_unlock_bh(&table->lock); 255 return NF_ACCEPT; 256 } 257 if (verdict == EBT_DROP) { 258 read_unlock_bh(&table->lock); 259 return NF_DROP; 260 } 261 if (verdict == EBT_RETURN) { 262 letsreturn: 263 if (WARN(sp == 0, "RETURN on base chain")) { 264 /* act like this is EBT_CONTINUE */ 265 goto letscontinue; 266 } 267 268 sp--; 269 /* put all the local variables right */ 270 i = cs[sp].n; 271 chaininfo = cs[sp].chaininfo; 272 nentries = chaininfo->nentries; 273 point = cs[sp].e; 274 counter_base = cb_base + 275 chaininfo->counter_offset; 276 continue; 277 } 278 if (verdict == EBT_CONTINUE) 279 goto letscontinue; 280 281 if (WARN(verdict < 0, "bogus standard verdict\n")) { 282 read_unlock_bh(&table->lock); 283 return NF_DROP; 284 } 285 286 /* jump to a udc */ 287 cs[sp].n = i + 1; 288 cs[sp].chaininfo = chaininfo; 289 cs[sp].e = ebt_next_entry(point); 290 i = 0; 291 chaininfo = (struct ebt_entries *) (base + verdict); 292 293 if (WARN(chaininfo->distinguisher, "jump to non-chain\n")) { 294 read_unlock_bh(&table->lock); 295 return NF_DROP; 296 } 297 298 nentries = chaininfo->nentries; 299 point = (struct ebt_entry *)chaininfo->data; 300 counter_base = cb_base + chaininfo->counter_offset; 301 sp++; 302 continue; 303 letscontinue: 304 point = ebt_next_entry(point); 305 i++; 306 } 307 308 /* I actually like this :) */ 309 if (chaininfo->policy == EBT_RETURN) 310 goto letsreturn; 311 if (chaininfo->policy == EBT_ACCEPT) { 312 read_unlock_bh(&table->lock); 313 return NF_ACCEPT; 314 } 315 read_unlock_bh(&table->lock); 316 return NF_DROP; 317 } 318 319 /* If it succeeds, returns element and locks mutex */ 320 static inline void * 321 find_inlist_lock_noload(struct net *net, const char *name, int *error, 322 struct mutex *mutex) 323 { 324 struct ebt_pernet *ebt_net = net_generic(net, ebt_pernet_id); 325 struct ebt_template *tmpl; 326 struct ebt_table *table; 327 328 mutex_lock(mutex); 329 list_for_each_entry(table, &ebt_net->tables, list) { 330 if (strcmp(table->name, name) == 0) 331 return table; 332 } 333 334 list_for_each_entry(tmpl, &template_tables, list) { 335 if (strcmp(name, tmpl->name) == 0) { 336 struct module *owner = tmpl->owner; 337 338 if (!try_module_get(owner)) 339 goto out; 340 341 mutex_unlock(mutex); 342 343 *error = tmpl->table_init(net); 344 if (*error) { 345 module_put(owner); 346 return NULL; 347 } 348 349 mutex_lock(mutex); 350 module_put(owner); 351 break; 352 } 353 } 354 355 list_for_each_entry(table, &ebt_net->tables, list) { 356 if (strcmp(table->name, name) == 0) 357 return table; 358 } 359 360 out: 361 *error = -ENOENT; 362 mutex_unlock(mutex); 363 return NULL; 364 } 365 366 static void * 367 find_inlist_lock(struct net *net, const char *name, const char *prefix, 368 int *error, struct mutex *mutex) 369 { 370 return try_then_request_module( 371 find_inlist_lock_noload(net, name, error, mutex), 372 "%s%s", prefix, name); 373 } 374 375 static inline struct ebt_table * 376 find_table_lock(struct net *net, const char *name, int *error, 377 struct mutex *mutex) 378 { 379 return find_inlist_lock(net, name, "ebtable_", error, mutex); 380 } 381 382 static inline void ebt_free_table_info(struct ebt_table_info *info) 383 { 384 int i; 385 386 if (info->chainstack) { 387 for_each_possible_cpu(i) 388 vfree(info->chainstack[i]); 389 vfree(info->chainstack); 390 } 391 } 392 static inline int 393 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par, 394 unsigned int *cnt) 395 { 396 const struct ebt_entry *e = par->entryinfo; 397 struct xt_match *match; 398 size_t left = ((char *)e + e->watchers_offset) - (char *)m; 399 int ret; 400 401 if (left < sizeof(struct ebt_entry_match) || 402 left - sizeof(struct ebt_entry_match) < m->match_size) 403 return -EINVAL; 404 405 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision); 406 if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) { 407 if (!IS_ERR(match)) 408 module_put(match->me); 409 request_module("ebt_%s", m->u.name); 410 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision); 411 } 412 if (IS_ERR(match)) 413 return PTR_ERR(match); 414 m->u.match = match; 415 416 par->match = match; 417 par->matchinfo = m->data; 418 ret = xt_check_match(par, m->match_size, 419 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 420 if (ret < 0) { 421 module_put(match->me); 422 return ret; 423 } 424 425 (*cnt)++; 426 return 0; 427 } 428 429 static inline int 430 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par, 431 unsigned int *cnt) 432 { 433 const struct ebt_entry *e = par->entryinfo; 434 struct xt_target *watcher; 435 size_t left = ((char *)e + e->target_offset) - (char *)w; 436 int ret; 437 438 if (left < sizeof(struct ebt_entry_watcher) || 439 left - sizeof(struct ebt_entry_watcher) < w->watcher_size) 440 return -EINVAL; 441 442 watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0); 443 if (IS_ERR(watcher)) 444 return PTR_ERR(watcher); 445 446 if (watcher->family != NFPROTO_BRIDGE) { 447 module_put(watcher->me); 448 return -ENOENT; 449 } 450 451 w->u.watcher = watcher; 452 453 par->target = watcher; 454 par->targinfo = w->data; 455 ret = xt_check_target(par, w->watcher_size, 456 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 457 if (ret < 0) { 458 module_put(watcher->me); 459 return ret; 460 } 461 462 (*cnt)++; 463 return 0; 464 } 465 466 static int ebt_verify_pointers(const struct ebt_replace *repl, 467 struct ebt_table_info *newinfo) 468 { 469 unsigned int limit = repl->entries_size; 470 unsigned int valid_hooks = repl->valid_hooks; 471 unsigned int offset = 0; 472 int i; 473 474 for (i = 0; i < NF_BR_NUMHOOKS; i++) 475 newinfo->hook_entry[i] = NULL; 476 477 newinfo->entries_size = repl->entries_size; 478 newinfo->nentries = repl->nentries; 479 480 while (offset < limit) { 481 size_t left = limit - offset; 482 struct ebt_entry *e = (void *)newinfo->entries + offset; 483 484 if (left < sizeof(unsigned int)) 485 break; 486 487 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 488 if ((valid_hooks & (1 << i)) == 0) 489 continue; 490 if ((char __user *)repl->hook_entry[i] == 491 repl->entries + offset) 492 break; 493 } 494 495 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) { 496 if (e->bitmask != 0) { 497 /* we make userspace set this right, 498 * so there is no misunderstanding 499 */ 500 return -EINVAL; 501 } 502 if (i != NF_BR_NUMHOOKS) 503 newinfo->hook_entry[i] = (struct ebt_entries *)e; 504 if (left < sizeof(struct ebt_entries)) 505 break; 506 offset += sizeof(struct ebt_entries); 507 } else { 508 if (left < sizeof(struct ebt_entry)) 509 break; 510 if (left < e->next_offset) 511 break; 512 if (e->next_offset < sizeof(struct ebt_entry)) 513 return -EINVAL; 514 offset += e->next_offset; 515 } 516 } 517 if (offset != limit) 518 return -EINVAL; 519 520 /* check if all valid hooks have a chain */ 521 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 522 if (!newinfo->hook_entry[i] && 523 (valid_hooks & (1 << i))) 524 return -EINVAL; 525 } 526 return 0; 527 } 528 529 /* this one is very careful, as it is the first function 530 * to parse the userspace data 531 */ 532 static inline int 533 ebt_check_entry_size_and_hooks(const struct ebt_entry *e, 534 const struct ebt_table_info *newinfo, 535 unsigned int *n, unsigned int *cnt, 536 unsigned int *totalcnt, unsigned int *udc_cnt) 537 { 538 int i; 539 540 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 541 if ((void *)e == (void *)newinfo->hook_entry[i]) 542 break; 543 } 544 /* beginning of a new chain 545 * if i == NF_BR_NUMHOOKS it must be a user defined chain 546 */ 547 if (i != NF_BR_NUMHOOKS || !e->bitmask) { 548 /* this checks if the previous chain has as many entries 549 * as it said it has 550 */ 551 if (*n != *cnt) 552 return -EINVAL; 553 554 if (((struct ebt_entries *)e)->policy != EBT_DROP && 555 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) { 556 /* only RETURN from udc */ 557 if (i != NF_BR_NUMHOOKS || 558 ((struct ebt_entries *)e)->policy != EBT_RETURN) 559 return -EINVAL; 560 } 561 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */ 562 (*udc_cnt)++; 563 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) 564 return -EINVAL; 565 *n = ((struct ebt_entries *)e)->nentries; 566 *cnt = 0; 567 return 0; 568 } 569 /* a plain old entry, heh */ 570 if (sizeof(struct ebt_entry) > e->watchers_offset || 571 e->watchers_offset > e->target_offset || 572 e->target_offset >= e->next_offset) 573 return -EINVAL; 574 575 /* this is not checked anywhere else */ 576 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) 577 return -EINVAL; 578 579 (*cnt)++; 580 (*totalcnt)++; 581 return 0; 582 } 583 584 struct ebt_cl_stack { 585 struct ebt_chainstack cs; 586 int from; 587 unsigned int hookmask; 588 }; 589 590 /* We need these positions to check that the jumps to a different part of the 591 * entries is a jump to the beginning of a new chain. 592 */ 593 static inline int 594 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo, 595 unsigned int *n, struct ebt_cl_stack *udc) 596 { 597 int i; 598 599 /* we're only interested in chain starts */ 600 if (e->bitmask) 601 return 0; 602 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 603 if (newinfo->hook_entry[i] == (struct ebt_entries *)e) 604 break; 605 } 606 /* only care about udc */ 607 if (i != NF_BR_NUMHOOKS) 608 return 0; 609 610 udc[*n].cs.chaininfo = (struct ebt_entries *)e; 611 /* these initialisations are depended on later in check_chainloops() */ 612 udc[*n].cs.n = 0; 613 udc[*n].hookmask = 0; 614 615 (*n)++; 616 return 0; 617 } 618 619 static inline int 620 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i) 621 { 622 struct xt_mtdtor_param par; 623 624 if (i && (*i)-- == 0) 625 return 1; 626 627 par.net = net; 628 par.match = m->u.match; 629 par.matchinfo = m->data; 630 par.family = NFPROTO_BRIDGE; 631 if (par.match->destroy != NULL) 632 par.match->destroy(&par); 633 module_put(par.match->me); 634 return 0; 635 } 636 637 static inline int 638 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i) 639 { 640 struct xt_tgdtor_param par; 641 642 if (i && (*i)-- == 0) 643 return 1; 644 645 par.net = net; 646 par.target = w->u.watcher; 647 par.targinfo = w->data; 648 par.family = NFPROTO_BRIDGE; 649 if (par.target->destroy != NULL) 650 par.target->destroy(&par); 651 module_put(par.target->me); 652 return 0; 653 } 654 655 static inline int 656 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt) 657 { 658 struct xt_tgdtor_param par; 659 struct ebt_entry_target *t; 660 661 if (e->bitmask == 0) 662 return 0; 663 /* we're done */ 664 if (cnt && (*cnt)-- == 0) 665 return 1; 666 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL); 667 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL); 668 t = ebt_get_target(e); 669 670 par.net = net; 671 par.target = t->u.target; 672 par.targinfo = t->data; 673 par.family = NFPROTO_BRIDGE; 674 if (par.target->destroy != NULL) 675 par.target->destroy(&par); 676 module_put(par.target->me); 677 return 0; 678 } 679 680 static inline int 681 ebt_check_entry(struct ebt_entry *e, struct net *net, 682 const struct ebt_table_info *newinfo, 683 const char *name, unsigned int *cnt, 684 struct ebt_cl_stack *cl_s, unsigned int udc_cnt) 685 { 686 struct ebt_entry_target *t; 687 struct xt_target *target; 688 unsigned int i, j, hook = 0, hookmask = 0; 689 size_t gap; 690 int ret; 691 struct xt_mtchk_param mtpar; 692 struct xt_tgchk_param tgpar; 693 694 /* don't mess with the struct ebt_entries */ 695 if (e->bitmask == 0) 696 return 0; 697 698 if (e->bitmask & ~EBT_F_MASK) 699 return -EINVAL; 700 701 if (e->invflags & ~EBT_INV_MASK) 702 return -EINVAL; 703 704 if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) 705 return -EINVAL; 706 707 /* what hook do we belong to? */ 708 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 709 if (!newinfo->hook_entry[i]) 710 continue; 711 if ((char *)newinfo->hook_entry[i] < (char *)e) 712 hook = i; 713 else 714 break; 715 } 716 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on 717 * a base chain 718 */ 719 if (i < NF_BR_NUMHOOKS) 720 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 721 else { 722 for (i = 0; i < udc_cnt; i++) 723 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e) 724 break; 725 if (i == 0) 726 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 727 else 728 hookmask = cl_s[i - 1].hookmask; 729 } 730 i = 0; 731 732 memset(&mtpar, 0, sizeof(mtpar)); 733 memset(&tgpar, 0, sizeof(tgpar)); 734 mtpar.net = tgpar.net = net; 735 mtpar.table = tgpar.table = name; 736 mtpar.entryinfo = tgpar.entryinfo = e; 737 mtpar.hook_mask = tgpar.hook_mask = hookmask; 738 mtpar.family = tgpar.family = NFPROTO_BRIDGE; 739 ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i); 740 if (ret != 0) 741 goto cleanup_matches; 742 j = 0; 743 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j); 744 if (ret != 0) 745 goto cleanup_watchers; 746 t = ebt_get_target(e); 747 gap = e->next_offset - e->target_offset; 748 749 target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0); 750 if (IS_ERR(target)) { 751 ret = PTR_ERR(target); 752 goto cleanup_watchers; 753 } 754 755 /* Reject UNSPEC, xtables verdicts/return values are incompatible */ 756 if (target->family != NFPROTO_BRIDGE) { 757 module_put(target->me); 758 ret = -ENOENT; 759 goto cleanup_watchers; 760 } 761 762 t->u.target = target; 763 if (t->u.target == &ebt_standard_target) { 764 if (gap < sizeof(struct ebt_standard_target)) { 765 ret = -EFAULT; 766 goto cleanup_watchers; 767 } 768 if (((struct ebt_standard_target *)t)->verdict < 769 -NUM_STANDARD_TARGETS) { 770 ret = -EFAULT; 771 goto cleanup_watchers; 772 } 773 } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) { 774 module_put(t->u.target->me); 775 ret = -EFAULT; 776 goto cleanup_watchers; 777 } 778 779 tgpar.target = target; 780 tgpar.targinfo = t->data; 781 ret = xt_check_target(&tgpar, t->target_size, 782 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 783 if (ret < 0) { 784 module_put(target->me); 785 goto cleanup_watchers; 786 } 787 (*cnt)++; 788 return 0; 789 cleanup_watchers: 790 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j); 791 cleanup_matches: 792 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i); 793 return ret; 794 } 795 796 /* checks for loops and sets the hook mask for udc 797 * the hook mask for udc tells us from which base chains the udc can be 798 * accessed. This mask is a parameter to the check() functions of the extensions 799 */ 800 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s, 801 unsigned int udc_cnt, unsigned int hooknr, char *base) 802 { 803 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict; 804 const struct ebt_entry *e = (struct ebt_entry *)chain->data; 805 const struct ebt_entry_target *t; 806 807 while (pos < nentries || chain_nr != -1) { 808 /* end of udc, go back one 'recursion' step */ 809 if (pos == nentries) { 810 /* put back values of the time when this chain was called */ 811 e = cl_s[chain_nr].cs.e; 812 if (cl_s[chain_nr].from != -1) 813 nentries = 814 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries; 815 else 816 nentries = chain->nentries; 817 pos = cl_s[chain_nr].cs.n; 818 /* make sure we won't see a loop that isn't one */ 819 cl_s[chain_nr].cs.n = 0; 820 chain_nr = cl_s[chain_nr].from; 821 if (pos == nentries) 822 continue; 823 } 824 t = ebt_get_target_c(e); 825 if (strcmp(t->u.name, EBT_STANDARD_TARGET)) 826 goto letscontinue; 827 if (e->target_offset + sizeof(struct ebt_standard_target) > 828 e->next_offset) 829 return -1; 830 831 verdict = ((struct ebt_standard_target *)t)->verdict; 832 if (verdict >= 0) { /* jump to another chain */ 833 struct ebt_entries *hlp2 = 834 (struct ebt_entries *)(base + verdict); 835 for (i = 0; i < udc_cnt; i++) 836 if (hlp2 == cl_s[i].cs.chaininfo) 837 break; 838 /* bad destination or loop */ 839 if (i == udc_cnt) 840 return -1; 841 842 if (cl_s[i].cs.n) 843 return -1; 844 845 if (cl_s[i].hookmask & (1 << hooknr)) 846 goto letscontinue; 847 /* this can't be 0, so the loop test is correct */ 848 cl_s[i].cs.n = pos + 1; 849 pos = 0; 850 cl_s[i].cs.e = ebt_next_entry(e); 851 e = (struct ebt_entry *)(hlp2->data); 852 nentries = hlp2->nentries; 853 cl_s[i].from = chain_nr; 854 chain_nr = i; 855 /* this udc is accessible from the base chain for hooknr */ 856 cl_s[i].hookmask |= (1 << hooknr); 857 continue; 858 } 859 letscontinue: 860 e = ebt_next_entry(e); 861 pos++; 862 } 863 return 0; 864 } 865 866 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */ 867 static int translate_table(struct net *net, const char *name, 868 struct ebt_table_info *newinfo) 869 { 870 unsigned int i, j, k, udc_cnt; 871 int ret; 872 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */ 873 874 i = 0; 875 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i]) 876 i++; 877 if (i == NF_BR_NUMHOOKS) 878 return -EINVAL; 879 880 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) 881 return -EINVAL; 882 883 /* make sure chains are ordered after each other in same order 884 * as their corresponding hooks 885 */ 886 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) { 887 if (!newinfo->hook_entry[j]) 888 continue; 889 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) 890 return -EINVAL; 891 892 i = j; 893 } 894 895 /* do some early checkings and initialize some things */ 896 i = 0; /* holds the expected nr. of entries for the chain */ 897 j = 0; /* holds the up to now counted entries for the chain */ 898 k = 0; /* holds the total nr. of entries, should equal 899 * newinfo->nentries afterwards 900 */ 901 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */ 902 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 903 ebt_check_entry_size_and_hooks, newinfo, 904 &i, &j, &k, &udc_cnt); 905 906 if (ret != 0) 907 return ret; 908 909 if (i != j) 910 return -EINVAL; 911 912 if (k != newinfo->nentries) 913 return -EINVAL; 914 915 /* get the location of the udc, put them in an array 916 * while we're at it, allocate the chainstack 917 */ 918 if (udc_cnt) { 919 /* this will get free'd in do_replace()/ebt_register_table() 920 * if an error occurs 921 */ 922 newinfo->chainstack = 923 vmalloc(array_size(nr_cpu_ids, 924 sizeof(*(newinfo->chainstack)))); 925 if (!newinfo->chainstack) 926 return -ENOMEM; 927 for_each_possible_cpu(i) { 928 newinfo->chainstack[i] = 929 vmalloc_node(array_size(udc_cnt, 930 sizeof(*(newinfo->chainstack[0]))), 931 cpu_to_node(i)); 932 if (!newinfo->chainstack[i]) { 933 while (i) 934 vfree(newinfo->chainstack[--i]); 935 vfree(newinfo->chainstack); 936 newinfo->chainstack = NULL; 937 return -ENOMEM; 938 } 939 } 940 941 cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s))); 942 if (!cl_s) 943 return -ENOMEM; 944 i = 0; /* the i'th udc */ 945 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 946 ebt_get_udc_positions, newinfo, &i, cl_s); 947 /* sanity check */ 948 if (i != udc_cnt) { 949 vfree(cl_s); 950 return -EFAULT; 951 } 952 } 953 954 /* Check for loops */ 955 for (i = 0; i < NF_BR_NUMHOOKS; i++) 956 if (newinfo->hook_entry[i]) 957 if (check_chainloops(newinfo->hook_entry[i], 958 cl_s, udc_cnt, i, newinfo->entries)) { 959 vfree(cl_s); 960 return -EINVAL; 961 } 962 963 /* we now know the following (along with E=mc²): 964 * - the nr of entries in each chain is right 965 * - the size of the allocated space is right 966 * - all valid hooks have a corresponding chain 967 * - there are no loops 968 * - wrong data can still be on the level of a single entry 969 * - could be there are jumps to places that are not the 970 * beginning of a chain. This can only occur in chains that 971 * are not accessible from any base chains, so we don't care. 972 */ 973 974 /* used to know what we need to clean up if something goes wrong */ 975 i = 0; 976 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 977 ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt); 978 if (ret != 0) { 979 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 980 ebt_cleanup_entry, net, &i); 981 } 982 vfree(cl_s); 983 return ret; 984 } 985 986 /* called under write_lock */ 987 static void get_counters(const struct ebt_counter *oldcounters, 988 struct ebt_counter *counters, unsigned int nentries) 989 { 990 int i, cpu; 991 struct ebt_counter *counter_base; 992 993 /* counters of cpu 0 */ 994 memcpy(counters, oldcounters, 995 sizeof(struct ebt_counter) * nentries); 996 997 /* add other counters to those of cpu 0 */ 998 for_each_possible_cpu(cpu) { 999 if (cpu == 0) 1000 continue; 1001 counter_base = COUNTER_BASE(oldcounters, nentries, cpu); 1002 for (i = 0; i < nentries; i++) 1003 ADD_COUNTER(counters[i], counter_base[i].bcnt, 1004 counter_base[i].pcnt); 1005 } 1006 } 1007 1008 static int do_replace_finish(struct net *net, struct ebt_replace *repl, 1009 struct ebt_table_info *newinfo) 1010 { 1011 int ret; 1012 struct ebt_counter *counterstmp = NULL; 1013 /* used to be able to unlock earlier */ 1014 struct ebt_table_info *table; 1015 struct ebt_table *t; 1016 1017 /* the user wants counters back 1018 * the check on the size is done later, when we have the lock 1019 */ 1020 if (repl->num_counters) { 1021 unsigned long size = repl->num_counters * sizeof(*counterstmp); 1022 counterstmp = vmalloc(size); 1023 if (!counterstmp) 1024 return -ENOMEM; 1025 } 1026 1027 newinfo->chainstack = NULL; 1028 ret = ebt_verify_pointers(repl, newinfo); 1029 if (ret != 0) 1030 goto free_counterstmp; 1031 1032 ret = translate_table(net, repl->name, newinfo); 1033 1034 if (ret != 0) 1035 goto free_counterstmp; 1036 1037 t = find_table_lock(net, repl->name, &ret, &ebt_mutex); 1038 if (!t) { 1039 ret = -ENOENT; 1040 goto free_iterate; 1041 } 1042 1043 if (repl->valid_hooks != t->valid_hooks) { 1044 ret = -EINVAL; 1045 goto free_unlock; 1046 } 1047 1048 if (repl->num_counters && repl->num_counters != t->private->nentries) { 1049 ret = -EINVAL; 1050 goto free_unlock; 1051 } 1052 1053 /* we have the mutex lock, so no danger in reading this pointer */ 1054 table = t->private; 1055 /* make sure the table can only be rmmod'ed if it contains no rules */ 1056 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) { 1057 ret = -ENOENT; 1058 goto free_unlock; 1059 } else if (table->nentries && !newinfo->nentries) 1060 module_put(t->me); 1061 /* we need an atomic snapshot of the counters */ 1062 write_lock_bh(&t->lock); 1063 if (repl->num_counters) 1064 get_counters(t->private->counters, counterstmp, 1065 t->private->nentries); 1066 1067 t->private = newinfo; 1068 write_unlock_bh(&t->lock); 1069 mutex_unlock(&ebt_mutex); 1070 /* so, a user can change the chains while having messed up her counter 1071 * allocation. Only reason why this is done is because this way the lock 1072 * is held only once, while this doesn't bring the kernel into a 1073 * dangerous state. 1074 */ 1075 if (repl->num_counters && 1076 copy_to_user(repl->counters, counterstmp, 1077 array_size(repl->num_counters, sizeof(struct ebt_counter)))) { 1078 /* Silent error, can't fail, new table is already in place */ 1079 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n"); 1080 } 1081 1082 /* decrease module count and free resources */ 1083 EBT_ENTRY_ITERATE(table->entries, table->entries_size, 1084 ebt_cleanup_entry, net, NULL); 1085 1086 vfree(table->entries); 1087 ebt_free_table_info(table); 1088 vfree(table); 1089 vfree(counterstmp); 1090 1091 audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries, 1092 AUDIT_XT_OP_REPLACE, GFP_KERNEL); 1093 return ret; 1094 1095 free_unlock: 1096 mutex_unlock(&ebt_mutex); 1097 free_iterate: 1098 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 1099 ebt_cleanup_entry, net, NULL); 1100 free_counterstmp: 1101 vfree(counterstmp); 1102 /* can be initialized in translate_table() */ 1103 ebt_free_table_info(newinfo); 1104 return ret; 1105 } 1106 1107 /* replace the table */ 1108 static int do_replace(struct net *net, sockptr_t arg, unsigned int len) 1109 { 1110 int ret, countersize; 1111 struct ebt_table_info *newinfo; 1112 struct ebt_replace tmp; 1113 1114 if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) 1115 return -EFAULT; 1116 1117 if (len != sizeof(tmp) + tmp.entries_size) 1118 return -EINVAL; 1119 1120 if (tmp.entries_size == 0) 1121 return -EINVAL; 1122 1123 /* overflow check */ 1124 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / 1125 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) 1126 return -ENOMEM; 1127 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 1128 return -ENOMEM; 1129 1130 tmp.name[sizeof(tmp.name) - 1] = 0; 1131 1132 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 1133 newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT); 1134 if (!newinfo) 1135 return -ENOMEM; 1136 1137 if (countersize) 1138 memset(newinfo->counters, 0, countersize); 1139 1140 newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT); 1141 if (!newinfo->entries) { 1142 ret = -ENOMEM; 1143 goto free_newinfo; 1144 } 1145 if (copy_from_user( 1146 newinfo->entries, tmp.entries, tmp.entries_size) != 0) { 1147 ret = -EFAULT; 1148 goto free_entries; 1149 } 1150 1151 ret = do_replace_finish(net, &tmp, newinfo); 1152 if (ret == 0) 1153 return ret; 1154 free_entries: 1155 vfree(newinfo->entries); 1156 free_newinfo: 1157 vfree(newinfo); 1158 return ret; 1159 } 1160 1161 static void __ebt_unregister_table(struct net *net, struct ebt_table *table) 1162 { 1163 mutex_lock(&ebt_mutex); 1164 list_del(&table->list); 1165 mutex_unlock(&ebt_mutex); 1166 audit_log_nfcfg(table->name, AF_BRIDGE, table->private->nentries, 1167 AUDIT_XT_OP_UNREGISTER, GFP_KERNEL); 1168 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size, 1169 ebt_cleanup_entry, net, NULL); 1170 if (table->private->nentries) 1171 module_put(table->me); 1172 vfree(table->private->entries); 1173 ebt_free_table_info(table->private); 1174 vfree(table->private); 1175 kfree(table->ops); 1176 kfree(table); 1177 } 1178 1179 int ebt_register_table(struct net *net, const struct ebt_table *input_table, 1180 const struct nf_hook_ops *template_ops) 1181 { 1182 struct ebt_pernet *ebt_net = net_generic(net, ebt_pernet_id); 1183 struct ebt_table_info *newinfo; 1184 struct ebt_table *t, *table; 1185 struct nf_hook_ops *ops; 1186 unsigned int num_ops; 1187 struct ebt_replace_kernel *repl; 1188 int ret, i, countersize; 1189 void *p; 1190 1191 if (input_table == NULL || (repl = input_table->table) == NULL || 1192 repl->entries == NULL || repl->entries_size == 0 || 1193 repl->counters != NULL || input_table->private != NULL) 1194 return -EINVAL; 1195 1196 /* Don't add one table to multiple lists. */ 1197 table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL); 1198 if (!table) { 1199 ret = -ENOMEM; 1200 goto out; 1201 } 1202 1203 countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids; 1204 newinfo = vmalloc(sizeof(*newinfo) + countersize); 1205 ret = -ENOMEM; 1206 if (!newinfo) 1207 goto free_table; 1208 1209 p = vmalloc(repl->entries_size); 1210 if (!p) 1211 goto free_newinfo; 1212 1213 memcpy(p, repl->entries, repl->entries_size); 1214 newinfo->entries = p; 1215 1216 newinfo->entries_size = repl->entries_size; 1217 newinfo->nentries = repl->nentries; 1218 1219 if (countersize) 1220 memset(newinfo->counters, 0, countersize); 1221 1222 /* fill in newinfo and parse the entries */ 1223 newinfo->chainstack = NULL; 1224 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 1225 if ((repl->valid_hooks & (1 << i)) == 0) 1226 newinfo->hook_entry[i] = NULL; 1227 else 1228 newinfo->hook_entry[i] = p + 1229 ((char *)repl->hook_entry[i] - repl->entries); 1230 } 1231 ret = translate_table(net, repl->name, newinfo); 1232 if (ret != 0) 1233 goto free_chainstack; 1234 1235 table->private = newinfo; 1236 rwlock_init(&table->lock); 1237 mutex_lock(&ebt_mutex); 1238 list_for_each_entry(t, &ebt_net->tables, list) { 1239 if (strcmp(t->name, table->name) == 0) { 1240 ret = -EEXIST; 1241 goto free_unlock; 1242 } 1243 } 1244 1245 /* Hold a reference count if the chains aren't empty */ 1246 if (newinfo->nentries && !try_module_get(table->me)) { 1247 ret = -ENOENT; 1248 goto free_unlock; 1249 } 1250 1251 num_ops = hweight32(table->valid_hooks); 1252 if (num_ops == 0) { 1253 ret = -EINVAL; 1254 goto free_unlock; 1255 } 1256 1257 ops = kmemdup(template_ops, sizeof(*ops) * num_ops, GFP_KERNEL); 1258 if (!ops) { 1259 ret = -ENOMEM; 1260 if (newinfo->nentries) 1261 module_put(table->me); 1262 goto free_unlock; 1263 } 1264 1265 for (i = 0; i < num_ops; i++) 1266 ops[i].priv = table; 1267 1268 list_add(&table->list, &ebt_net->tables); 1269 mutex_unlock(&ebt_mutex); 1270 1271 table->ops = ops; 1272 ret = nf_register_net_hooks(net, ops, num_ops); 1273 if (ret) 1274 __ebt_unregister_table(net, table); 1275 1276 audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries, 1277 AUDIT_XT_OP_REGISTER, GFP_KERNEL); 1278 return ret; 1279 free_unlock: 1280 mutex_unlock(&ebt_mutex); 1281 free_chainstack: 1282 ebt_free_table_info(newinfo); 1283 vfree(newinfo->entries); 1284 free_newinfo: 1285 vfree(newinfo); 1286 free_table: 1287 kfree(table); 1288 out: 1289 return ret; 1290 } 1291 1292 int ebt_register_template(const struct ebt_table *t, int (*table_init)(struct net *net)) 1293 { 1294 struct ebt_template *tmpl; 1295 1296 mutex_lock(&ebt_mutex); 1297 list_for_each_entry(tmpl, &template_tables, list) { 1298 if (WARN_ON_ONCE(strcmp(t->name, tmpl->name) == 0)) { 1299 mutex_unlock(&ebt_mutex); 1300 return -EEXIST; 1301 } 1302 } 1303 1304 tmpl = kzalloc(sizeof(*tmpl), GFP_KERNEL); 1305 if (!tmpl) { 1306 mutex_unlock(&ebt_mutex); 1307 return -ENOMEM; 1308 } 1309 1310 tmpl->table_init = table_init; 1311 strscpy(tmpl->name, t->name, sizeof(tmpl->name)); 1312 tmpl->owner = t->me; 1313 list_add(&tmpl->list, &template_tables); 1314 1315 mutex_unlock(&ebt_mutex); 1316 return 0; 1317 } 1318 EXPORT_SYMBOL(ebt_register_template); 1319 1320 void ebt_unregister_template(const struct ebt_table *t) 1321 { 1322 struct ebt_template *tmpl; 1323 1324 mutex_lock(&ebt_mutex); 1325 list_for_each_entry(tmpl, &template_tables, list) { 1326 if (strcmp(t->name, tmpl->name)) 1327 continue; 1328 1329 list_del(&tmpl->list); 1330 mutex_unlock(&ebt_mutex); 1331 kfree(tmpl); 1332 return; 1333 } 1334 1335 mutex_unlock(&ebt_mutex); 1336 WARN_ON_ONCE(1); 1337 } 1338 EXPORT_SYMBOL(ebt_unregister_template); 1339 1340 static struct ebt_table *__ebt_find_table(struct net *net, const char *name) 1341 { 1342 struct ebt_pernet *ebt_net = net_generic(net, ebt_pernet_id); 1343 struct ebt_table *t; 1344 1345 mutex_lock(&ebt_mutex); 1346 1347 list_for_each_entry(t, &ebt_net->tables, list) { 1348 if (strcmp(t->name, name) == 0) { 1349 mutex_unlock(&ebt_mutex); 1350 return t; 1351 } 1352 } 1353 1354 mutex_unlock(&ebt_mutex); 1355 return NULL; 1356 } 1357 1358 void ebt_unregister_table_pre_exit(struct net *net, const char *name) 1359 { 1360 struct ebt_table *table = __ebt_find_table(net, name); 1361 1362 if (table) 1363 nf_unregister_net_hooks(net, table->ops, hweight32(table->valid_hooks)); 1364 } 1365 EXPORT_SYMBOL(ebt_unregister_table_pre_exit); 1366 1367 void ebt_unregister_table(struct net *net, const char *name) 1368 { 1369 struct ebt_table *table = __ebt_find_table(net, name); 1370 1371 if (table) 1372 __ebt_unregister_table(net, table); 1373 } 1374 1375 /* userspace just supplied us with counters */ 1376 static int do_update_counters(struct net *net, const char *name, 1377 struct ebt_counter __user *counters, 1378 unsigned int num_counters, unsigned int len) 1379 { 1380 int i, ret; 1381 struct ebt_counter *tmp; 1382 struct ebt_table *t; 1383 1384 if (num_counters == 0) 1385 return -EINVAL; 1386 1387 tmp = vmalloc(array_size(num_counters, sizeof(*tmp))); 1388 if (!tmp) 1389 return -ENOMEM; 1390 1391 t = find_table_lock(net, name, &ret, &ebt_mutex); 1392 if (!t) 1393 goto free_tmp; 1394 1395 if (num_counters != t->private->nentries) { 1396 ret = -EINVAL; 1397 goto unlock_mutex; 1398 } 1399 1400 if (copy_from_user(tmp, counters, 1401 array_size(num_counters, sizeof(*counters)))) { 1402 ret = -EFAULT; 1403 goto unlock_mutex; 1404 } 1405 1406 /* we want an atomic add of the counters */ 1407 write_lock_bh(&t->lock); 1408 1409 /* we add to the counters of the first cpu */ 1410 for (i = 0; i < num_counters; i++) 1411 ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt); 1412 1413 write_unlock_bh(&t->lock); 1414 ret = 0; 1415 unlock_mutex: 1416 mutex_unlock(&ebt_mutex); 1417 free_tmp: 1418 vfree(tmp); 1419 return ret; 1420 } 1421 1422 static int update_counters(struct net *net, sockptr_t arg, unsigned int len) 1423 { 1424 struct ebt_replace hlp; 1425 1426 if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) 1427 return -EFAULT; 1428 1429 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) 1430 return -EINVAL; 1431 1432 return do_update_counters(net, hlp.name, hlp.counters, 1433 hlp.num_counters, len); 1434 } 1435 1436 static inline int ebt_obj_to_user(char __user *um, const char *_name, 1437 const char *data, int entrysize, 1438 int usersize, int datasize, u8 revision) 1439 { 1440 char name[EBT_EXTENSION_MAXNAMELEN] = {0}; 1441 1442 /* ebtables expects 31 bytes long names but xt_match names are 29 bytes 1443 * long. Copy 29 bytes and fill remaining bytes with zeroes. 1444 */ 1445 strscpy(name, _name, sizeof(name)); 1446 if (copy_to_user(um, name, EBT_EXTENSION_MAXNAMELEN) || 1447 put_user(revision, (u8 __user *)(um + EBT_EXTENSION_MAXNAMELEN)) || 1448 put_user(datasize, (int __user *)(um + EBT_EXTENSION_MAXNAMELEN + 1)) || 1449 xt_data_to_user(um + entrysize, data, usersize, datasize, 1450 XT_ALIGN(datasize))) 1451 return -EFAULT; 1452 1453 return 0; 1454 } 1455 1456 static inline int ebt_match_to_user(const struct ebt_entry_match *m, 1457 const char *base, char __user *ubase) 1458 { 1459 return ebt_obj_to_user(ubase + ((char *)m - base), 1460 m->u.match->name, m->data, sizeof(*m), 1461 m->u.match->usersize, m->match_size, 1462 m->u.match->revision); 1463 } 1464 1465 static inline int ebt_watcher_to_user(const struct ebt_entry_watcher *w, 1466 const char *base, char __user *ubase) 1467 { 1468 return ebt_obj_to_user(ubase + ((char *)w - base), 1469 w->u.watcher->name, w->data, sizeof(*w), 1470 w->u.watcher->usersize, w->watcher_size, 1471 w->u.watcher->revision); 1472 } 1473 1474 static inline int ebt_entry_to_user(struct ebt_entry *e, const char *base, 1475 char __user *ubase) 1476 { 1477 int ret; 1478 char __user *hlp; 1479 const struct ebt_entry_target *t; 1480 1481 if (e->bitmask == 0) { 1482 /* special case !EBT_ENTRY_OR_ENTRIES */ 1483 if (copy_to_user(ubase + ((char *)e - base), e, 1484 sizeof(struct ebt_entries))) 1485 return -EFAULT; 1486 return 0; 1487 } 1488 1489 if (copy_to_user(ubase + ((char *)e - base), e, sizeof(*e))) 1490 return -EFAULT; 1491 1492 hlp = ubase + (((char *)e + e->target_offset) - base); 1493 t = ebt_get_target_c(e); 1494 1495 ret = EBT_MATCH_ITERATE(e, ebt_match_to_user, base, ubase); 1496 if (ret != 0) 1497 return ret; 1498 ret = EBT_WATCHER_ITERATE(e, ebt_watcher_to_user, base, ubase); 1499 if (ret != 0) 1500 return ret; 1501 ret = ebt_obj_to_user(hlp, t->u.target->name, t->data, sizeof(*t), 1502 t->u.target->usersize, t->target_size, 1503 t->u.target->revision); 1504 if (ret != 0) 1505 return ret; 1506 1507 return 0; 1508 } 1509 1510 static int copy_counters_to_user(struct ebt_table *t, 1511 const struct ebt_counter *oldcounters, 1512 void __user *user, unsigned int num_counters, 1513 unsigned int nentries) 1514 { 1515 struct ebt_counter *counterstmp; 1516 int ret = 0; 1517 1518 /* userspace might not need the counters */ 1519 if (num_counters == 0) 1520 return 0; 1521 1522 if (num_counters != nentries) 1523 return -EINVAL; 1524 1525 counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp))); 1526 if (!counterstmp) 1527 return -ENOMEM; 1528 1529 write_lock_bh(&t->lock); 1530 get_counters(oldcounters, counterstmp, nentries); 1531 write_unlock_bh(&t->lock); 1532 1533 if (copy_to_user(user, counterstmp, 1534 array_size(nentries, sizeof(struct ebt_counter)))) 1535 ret = -EFAULT; 1536 vfree(counterstmp); 1537 return ret; 1538 } 1539 1540 /* called with ebt_mutex locked */ 1541 static int copy_everything_to_user(struct ebt_table *t, void __user *user, 1542 const int *len, int cmd) 1543 { 1544 struct ebt_replace tmp; 1545 const struct ebt_counter *oldcounters; 1546 unsigned int entries_size, nentries; 1547 int ret; 1548 char *entries; 1549 1550 if (cmd == EBT_SO_GET_ENTRIES) { 1551 entries_size = t->private->entries_size; 1552 nentries = t->private->nentries; 1553 entries = t->private->entries; 1554 oldcounters = t->private->counters; 1555 } else { 1556 entries_size = t->table->entries_size; 1557 nentries = t->table->nentries; 1558 entries = t->table->entries; 1559 oldcounters = t->table->counters; 1560 } 1561 1562 if (copy_from_user(&tmp, user, sizeof(tmp))) 1563 return -EFAULT; 1564 1565 if (*len != sizeof(struct ebt_replace) + entries_size + 1566 (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0)) 1567 return -EINVAL; 1568 1569 if (tmp.nentries != nentries) 1570 return -EINVAL; 1571 1572 if (tmp.entries_size != entries_size) 1573 return -EINVAL; 1574 1575 ret = copy_counters_to_user(t, oldcounters, tmp.counters, 1576 tmp.num_counters, nentries); 1577 if (ret) 1578 return ret; 1579 1580 /* set the match/watcher/target names right */ 1581 return EBT_ENTRY_ITERATE(entries, entries_size, 1582 ebt_entry_to_user, entries, tmp.entries); 1583 } 1584 1585 #ifdef CONFIG_NETFILTER_XTABLES_COMPAT 1586 /* 32 bit-userspace compatibility definitions. */ 1587 struct compat_ebt_replace { 1588 char name[EBT_TABLE_MAXNAMELEN]; 1589 compat_uint_t valid_hooks; 1590 compat_uint_t nentries; 1591 compat_uint_t entries_size; 1592 /* start of the chains */ 1593 compat_uptr_t hook_entry[NF_BR_NUMHOOKS]; 1594 /* nr of counters userspace expects back */ 1595 compat_uint_t num_counters; 1596 /* where the kernel will put the old counters. */ 1597 compat_uptr_t counters; 1598 compat_uptr_t entries; 1599 }; 1600 1601 /* struct ebt_entry_match, _target and _watcher have same layout */ 1602 struct compat_ebt_entry_mwt { 1603 union { 1604 struct { 1605 char name[EBT_EXTENSION_MAXNAMELEN]; 1606 u8 revision; 1607 }; 1608 compat_uptr_t ptr; 1609 } u; 1610 compat_uint_t match_size; 1611 compat_uint_t data[] __aligned(__alignof__(struct compat_ebt_replace)); 1612 }; 1613 1614 /* account for possible padding between match_size and ->data */ 1615 static int ebt_compat_entry_padsize(void) 1616 { 1617 BUILD_BUG_ON(sizeof(struct ebt_entry_match) < 1618 sizeof(struct compat_ebt_entry_mwt)); 1619 return (int) sizeof(struct ebt_entry_match) - 1620 sizeof(struct compat_ebt_entry_mwt); 1621 } 1622 1623 static int ebt_compat_match_offset(const struct xt_match *match, 1624 unsigned int userlen) 1625 { 1626 /* ebt_among needs special handling. The kernel .matchsize is 1627 * set to -1 at registration time; at runtime an EBT_ALIGN()ed 1628 * value is expected. 1629 * Example: userspace sends 4500, ebt_among.c wants 4504. 1630 */ 1631 if (unlikely(match->matchsize == -1)) 1632 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen); 1633 return xt_compat_match_offset(match); 1634 } 1635 1636 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr, 1637 unsigned int *size) 1638 { 1639 const struct xt_match *match = m->u.match; 1640 struct compat_ebt_entry_mwt __user *cm = *dstptr; 1641 int off = ebt_compat_match_offset(match, m->match_size); 1642 compat_uint_t msize = m->match_size - off; 1643 1644 if (WARN_ON(off >= m->match_size)) 1645 return -EINVAL; 1646 1647 if (copy_to_user(cm->u.name, match->name, strlen(match->name) + 1) || 1648 put_user(match->revision, &cm->u.revision) || 1649 put_user(msize, &cm->match_size)) 1650 return -EFAULT; 1651 1652 if (match->compat_to_user) { 1653 if (match->compat_to_user(cm->data, m->data)) 1654 return -EFAULT; 1655 } else { 1656 if (xt_data_to_user(cm->data, m->data, match->usersize, msize, 1657 COMPAT_XT_ALIGN(msize))) 1658 return -EFAULT; 1659 } 1660 1661 *size -= ebt_compat_entry_padsize() + off; 1662 *dstptr = cm->data; 1663 *dstptr += msize; 1664 return 0; 1665 } 1666 1667 static int compat_target_to_user(struct ebt_entry_target *t, 1668 void __user **dstptr, 1669 unsigned int *size) 1670 { 1671 const struct xt_target *target = t->u.target; 1672 struct compat_ebt_entry_mwt __user *cm = *dstptr; 1673 int off = xt_compat_target_offset(target); 1674 compat_uint_t tsize = t->target_size - off; 1675 1676 if (WARN_ON(off >= t->target_size)) 1677 return -EINVAL; 1678 1679 if (copy_to_user(cm->u.name, target->name, strlen(target->name) + 1) || 1680 put_user(target->revision, &cm->u.revision) || 1681 put_user(tsize, &cm->match_size)) 1682 return -EFAULT; 1683 1684 if (target->compat_to_user) { 1685 if (target->compat_to_user(cm->data, t->data)) 1686 return -EFAULT; 1687 } else { 1688 if (xt_data_to_user(cm->data, t->data, target->usersize, tsize, 1689 COMPAT_XT_ALIGN(tsize))) 1690 return -EFAULT; 1691 } 1692 1693 *size -= ebt_compat_entry_padsize() + off; 1694 *dstptr = cm->data; 1695 *dstptr += tsize; 1696 return 0; 1697 } 1698 1699 static int compat_watcher_to_user(struct ebt_entry_watcher *w, 1700 void __user **dstptr, 1701 unsigned int *size) 1702 { 1703 return compat_target_to_user((struct ebt_entry_target *)w, 1704 dstptr, size); 1705 } 1706 1707 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr, 1708 unsigned int *size) 1709 { 1710 struct ebt_entry_target *t; 1711 struct ebt_entry __user *ce; 1712 u32 watchers_offset, target_offset, next_offset; 1713 compat_uint_t origsize; 1714 int ret; 1715 1716 if (e->bitmask == 0) { 1717 if (*size < sizeof(struct ebt_entries)) 1718 return -EINVAL; 1719 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries))) 1720 return -EFAULT; 1721 1722 *dstptr += sizeof(struct ebt_entries); 1723 *size -= sizeof(struct ebt_entries); 1724 return 0; 1725 } 1726 1727 if (*size < sizeof(*ce)) 1728 return -EINVAL; 1729 1730 ce = *dstptr; 1731 if (copy_to_user(ce, e, sizeof(*ce))) 1732 return -EFAULT; 1733 1734 origsize = *size; 1735 *dstptr += sizeof(*ce); 1736 1737 ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size); 1738 if (ret) 1739 return ret; 1740 watchers_offset = e->watchers_offset - (origsize - *size); 1741 1742 ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size); 1743 if (ret) 1744 return ret; 1745 target_offset = e->target_offset - (origsize - *size); 1746 1747 t = ebt_get_target(e); 1748 1749 ret = compat_target_to_user(t, dstptr, size); 1750 if (ret) 1751 return ret; 1752 next_offset = e->next_offset - (origsize - *size); 1753 1754 if (put_user(watchers_offset, &ce->watchers_offset) || 1755 put_user(target_offset, &ce->target_offset) || 1756 put_user(next_offset, &ce->next_offset)) 1757 return -EFAULT; 1758 1759 *size -= sizeof(*ce); 1760 return 0; 1761 } 1762 1763 static int compat_calc_match(struct ebt_entry_match *m, int *off) 1764 { 1765 *off += ebt_compat_match_offset(m->u.match, m->match_size); 1766 *off += ebt_compat_entry_padsize(); 1767 return 0; 1768 } 1769 1770 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off) 1771 { 1772 *off += xt_compat_target_offset(w->u.watcher); 1773 *off += ebt_compat_entry_padsize(); 1774 return 0; 1775 } 1776 1777 static int compat_calc_entry(const struct ebt_entry *e, 1778 const struct ebt_table_info *info, 1779 const void *base, 1780 struct compat_ebt_replace *newinfo) 1781 { 1782 const struct ebt_entry_target *t; 1783 unsigned int entry_offset; 1784 int off, ret, i; 1785 1786 if (e->bitmask == 0) 1787 return 0; 1788 1789 off = 0; 1790 entry_offset = (void *)e - base; 1791 1792 EBT_MATCH_ITERATE(e, compat_calc_match, &off); 1793 EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off); 1794 1795 t = ebt_get_target_c(e); 1796 1797 off += xt_compat_target_offset(t->u.target); 1798 off += ebt_compat_entry_padsize(); 1799 1800 newinfo->entries_size -= off; 1801 1802 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off); 1803 if (ret) 1804 return ret; 1805 1806 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 1807 const void *hookptr = info->hook_entry[i]; 1808 if (info->hook_entry[i] && 1809 (e < (struct ebt_entry *)(base - hookptr))) { 1810 newinfo->hook_entry[i] -= off; 1811 pr_debug("0x%08X -> 0x%08X\n", 1812 newinfo->hook_entry[i] + off, 1813 newinfo->hook_entry[i]); 1814 } 1815 } 1816 1817 return 0; 1818 } 1819 1820 static int ebt_compat_init_offsets(unsigned int number) 1821 { 1822 if (number > INT_MAX) 1823 return -EINVAL; 1824 1825 /* also count the base chain policies */ 1826 number += NF_BR_NUMHOOKS; 1827 1828 return xt_compat_init_offsets(NFPROTO_BRIDGE, number); 1829 } 1830 1831 static int compat_table_info(const struct ebt_table_info *info, 1832 struct compat_ebt_replace *newinfo) 1833 { 1834 unsigned int size = info->entries_size; 1835 const void *entries = info->entries; 1836 int ret; 1837 1838 newinfo->entries_size = size; 1839 ret = ebt_compat_init_offsets(info->nentries); 1840 if (ret) 1841 return ret; 1842 1843 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info, 1844 entries, newinfo); 1845 } 1846 1847 static int compat_copy_everything_to_user(struct ebt_table *t, 1848 void __user *user, int *len, int cmd) 1849 { 1850 struct compat_ebt_replace repl, tmp; 1851 struct ebt_counter *oldcounters; 1852 struct ebt_table_info tinfo; 1853 int ret; 1854 void __user *pos; 1855 1856 memset(&tinfo, 0, sizeof(tinfo)); 1857 1858 if (cmd == EBT_SO_GET_ENTRIES) { 1859 tinfo.entries_size = t->private->entries_size; 1860 tinfo.nentries = t->private->nentries; 1861 tinfo.entries = t->private->entries; 1862 oldcounters = t->private->counters; 1863 } else { 1864 tinfo.entries_size = t->table->entries_size; 1865 tinfo.nentries = t->table->nentries; 1866 tinfo.entries = t->table->entries; 1867 oldcounters = t->table->counters; 1868 } 1869 1870 if (copy_from_user(&tmp, user, sizeof(tmp))) 1871 return -EFAULT; 1872 1873 if (tmp.nentries != tinfo.nentries || 1874 (tmp.num_counters && tmp.num_counters != tinfo.nentries)) 1875 return -EINVAL; 1876 1877 memcpy(&repl, &tmp, sizeof(repl)); 1878 if (cmd == EBT_SO_GET_ENTRIES) 1879 ret = compat_table_info(t->private, &repl); 1880 else 1881 ret = compat_table_info(&tinfo, &repl); 1882 if (ret) 1883 return ret; 1884 1885 if (*len != sizeof(tmp) + repl.entries_size + 1886 (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) { 1887 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n", 1888 *len, tinfo.entries_size, repl.entries_size); 1889 return -EINVAL; 1890 } 1891 1892 /* userspace might not need the counters */ 1893 ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters), 1894 tmp.num_counters, tinfo.nentries); 1895 if (ret) 1896 return ret; 1897 1898 pos = compat_ptr(tmp.entries); 1899 return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size, 1900 compat_copy_entry_to_user, &pos, &tmp.entries_size); 1901 } 1902 1903 struct ebt_entries_buf_state { 1904 char *buf_kern_start; /* kernel buffer to copy (translated) data to */ 1905 u32 buf_kern_len; /* total size of kernel buffer */ 1906 u32 buf_kern_offset; /* amount of data copied so far */ 1907 u32 buf_user_offset; /* read position in userspace buffer */ 1908 }; 1909 1910 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz) 1911 { 1912 state->buf_kern_offset += sz; 1913 return state->buf_kern_offset >= sz ? 0 : -EINVAL; 1914 } 1915 1916 static int ebt_buf_add(struct ebt_entries_buf_state *state, 1917 const void *data, unsigned int sz) 1918 { 1919 if (state->buf_kern_start == NULL) 1920 goto count_only; 1921 1922 if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len)) 1923 return -EINVAL; 1924 1925 memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz); 1926 1927 count_only: 1928 state->buf_user_offset += sz; 1929 return ebt_buf_count(state, sz); 1930 } 1931 1932 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz) 1933 { 1934 char *b = state->buf_kern_start; 1935 1936 if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len)) 1937 return -EINVAL; 1938 1939 if (b != NULL && sz > 0) 1940 memset(b + state->buf_kern_offset, 0, sz); 1941 /* do not adjust ->buf_user_offset here, we added kernel-side padding */ 1942 return ebt_buf_count(state, sz); 1943 } 1944 1945 enum compat_mwt { 1946 EBT_COMPAT_MATCH, 1947 EBT_COMPAT_WATCHER, 1948 EBT_COMPAT_TARGET, 1949 }; 1950 1951 static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt, 1952 enum compat_mwt compat_mwt, 1953 struct ebt_entries_buf_state *state, 1954 const unsigned char *base) 1955 { 1956 char name[EBT_EXTENSION_MAXNAMELEN]; 1957 struct xt_match *match; 1958 struct xt_target *wt; 1959 void *dst = NULL; 1960 int off, pad = 0; 1961 unsigned int size_kern, match_size = mwt->match_size; 1962 1963 if (strscpy(name, mwt->u.name, sizeof(name)) < 0) 1964 return -EINVAL; 1965 1966 if (state->buf_kern_start) 1967 dst = state->buf_kern_start + state->buf_kern_offset; 1968 1969 switch (compat_mwt) { 1970 case EBT_COMPAT_MATCH: 1971 match = xt_request_find_match(NFPROTO_BRIDGE, name, 1972 mwt->u.revision); 1973 if (IS_ERR(match)) 1974 return PTR_ERR(match); 1975 1976 off = ebt_compat_match_offset(match, match_size); 1977 if (dst) { 1978 if (match->compat_from_user) 1979 match->compat_from_user(dst, mwt->data); 1980 else 1981 memcpy(dst, mwt->data, match_size); 1982 } 1983 1984 size_kern = match->matchsize; 1985 if (unlikely(size_kern == -1)) 1986 size_kern = match_size; 1987 module_put(match->me); 1988 break; 1989 case EBT_COMPAT_WATCHER: 1990 case EBT_COMPAT_TARGET: 1991 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 1992 mwt->u.revision); 1993 if (IS_ERR(wt)) 1994 return PTR_ERR(wt); 1995 off = xt_compat_target_offset(wt); 1996 1997 if (dst) { 1998 if (wt->compat_from_user) 1999 wt->compat_from_user(dst, mwt->data); 2000 else 2001 memcpy(dst, mwt->data, match_size); 2002 } 2003 2004 size_kern = wt->targetsize; 2005 module_put(wt->me); 2006 break; 2007 2008 default: 2009 return -EINVAL; 2010 } 2011 2012 state->buf_kern_offset += match_size + off; 2013 state->buf_user_offset += match_size; 2014 pad = XT_ALIGN(size_kern) - size_kern; 2015 2016 if (pad > 0 && dst) { 2017 if (WARN_ON(state->buf_kern_len <= pad)) 2018 return -EINVAL; 2019 if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad)) 2020 return -EINVAL; 2021 memset(dst + size_kern, 0, pad); 2022 } 2023 return off + match_size; 2024 } 2025 2026 /* return size of all matches, watchers or target, including necessary 2027 * alignment and padding. 2028 */ 2029 static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32, 2030 unsigned int size_left, enum compat_mwt type, 2031 struct ebt_entries_buf_state *state, const void *base) 2032 { 2033 const char *buf = (const char *)match32; 2034 int growth = 0; 2035 2036 if (size_left == 0) 2037 return 0; 2038 2039 do { 2040 struct ebt_entry_match *match_kern; 2041 int ret; 2042 2043 if (size_left < sizeof(*match32)) 2044 return -EINVAL; 2045 2046 match_kern = (struct ebt_entry_match *) state->buf_kern_start; 2047 if (match_kern) { 2048 char *tmp; 2049 tmp = state->buf_kern_start + state->buf_kern_offset; 2050 match_kern = (struct ebt_entry_match *) tmp; 2051 } 2052 ret = ebt_buf_add(state, buf, sizeof(*match32)); 2053 if (ret < 0) 2054 return ret; 2055 size_left -= sizeof(*match32); 2056 2057 /* add padding before match->data (if any) */ 2058 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize()); 2059 if (ret < 0) 2060 return ret; 2061 2062 if (match32->match_size > size_left) 2063 return -EINVAL; 2064 2065 size_left -= match32->match_size; 2066 2067 ret = compat_mtw_from_user(match32, type, state, base); 2068 if (ret < 0) 2069 return ret; 2070 2071 if (WARN_ON(ret < match32->match_size)) 2072 return -EINVAL; 2073 growth += ret - match32->match_size; 2074 growth += ebt_compat_entry_padsize(); 2075 2076 buf += sizeof(*match32); 2077 buf += match32->match_size; 2078 2079 if (match_kern) 2080 match_kern->match_size = ret; 2081 2082 match32 = (struct compat_ebt_entry_mwt *) buf; 2083 } while (size_left); 2084 2085 return growth; 2086 } 2087 2088 /* called for all ebt_entry structures. */ 2089 static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base, 2090 unsigned int *total, 2091 struct ebt_entries_buf_state *state) 2092 { 2093 unsigned int i, j, startoff, next_expected_off, new_offset = 0; 2094 /* stores match/watchers/targets & offset of next struct ebt_entry: */ 2095 unsigned int offsets[4]; 2096 unsigned int *offsets_update = NULL; 2097 int ret; 2098 char *buf_start; 2099 2100 if (*total < sizeof(struct ebt_entries)) 2101 return -EINVAL; 2102 2103 if (!entry->bitmask) { 2104 *total -= sizeof(struct ebt_entries); 2105 return ebt_buf_add(state, entry, sizeof(struct ebt_entries)); 2106 } 2107 if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry)) 2108 return -EINVAL; 2109 2110 startoff = state->buf_user_offset; 2111 /* pull in most part of ebt_entry, it does not need to be changed. */ 2112 ret = ebt_buf_add(state, entry, 2113 offsetof(struct ebt_entry, watchers_offset)); 2114 if (ret < 0) 2115 return ret; 2116 2117 offsets[0] = sizeof(struct ebt_entry); /* matches come first */ 2118 memcpy(&offsets[1], &entry->watchers_offset, 2119 sizeof(offsets) - sizeof(offsets[0])); 2120 2121 if (state->buf_kern_start) { 2122 buf_start = state->buf_kern_start + state->buf_kern_offset; 2123 offsets_update = (unsigned int *) buf_start; 2124 } 2125 ret = ebt_buf_add(state, &offsets[1], 2126 sizeof(offsets) - sizeof(offsets[0])); 2127 if (ret < 0) 2128 return ret; 2129 buf_start = (char *) entry; 2130 /* 0: matches offset, always follows ebt_entry. 2131 * 1: watchers offset, from ebt_entry structure 2132 * 2: target offset, from ebt_entry structure 2133 * 3: next ebt_entry offset, from ebt_entry structure 2134 * 2135 * offsets are relative to beginning of struct ebt_entry (i.e., 0). 2136 */ 2137 for (i = 0; i < 4 ; ++i) { 2138 if (offsets[i] > *total) 2139 return -EINVAL; 2140 2141 if (i < 3 && offsets[i] == *total) 2142 return -EINVAL; 2143 2144 if (i == 0) 2145 continue; 2146 if (offsets[i-1] > offsets[i]) 2147 return -EINVAL; 2148 } 2149 2150 for (i = 0, j = 1 ; j < 4 ; j++, i++) { 2151 struct compat_ebt_entry_mwt *match32; 2152 unsigned int size; 2153 char *buf = buf_start + offsets[i]; 2154 2155 if (offsets[i] > offsets[j]) 2156 return -EINVAL; 2157 2158 match32 = (struct compat_ebt_entry_mwt *) buf; 2159 size = offsets[j] - offsets[i]; 2160 ret = ebt_size_mwt(match32, size, i, state, base); 2161 if (ret < 0) 2162 return ret; 2163 new_offset += ret; 2164 if (offsets_update && new_offset) { 2165 pr_debug("change offset %d to %d\n", 2166 offsets_update[i], offsets[j] + new_offset); 2167 offsets_update[i] = offsets[j] + new_offset; 2168 } 2169 } 2170 2171 if (state->buf_kern_start == NULL) { 2172 unsigned int offset = buf_start - (char *) base; 2173 2174 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset); 2175 if (ret < 0) 2176 return ret; 2177 } 2178 2179 next_expected_off = state->buf_user_offset - startoff; 2180 if (next_expected_off != entry->next_offset) 2181 return -EINVAL; 2182 2183 if (*total < entry->next_offset) 2184 return -EINVAL; 2185 *total -= entry->next_offset; 2186 return 0; 2187 } 2188 2189 /* repl->entries_size is the size of the ebt_entry blob in userspace. 2190 * It might need more memory when copied to a 64 bit kernel in case 2191 * userspace is 32-bit. So, first task: find out how much memory is needed. 2192 * 2193 * Called before validation is performed. 2194 */ 2195 static int compat_copy_entries(unsigned char *data, unsigned int size_user, 2196 struct ebt_entries_buf_state *state) 2197 { 2198 unsigned int size_remaining = size_user; 2199 int ret; 2200 2201 ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data, 2202 &size_remaining, state); 2203 if (ret < 0) 2204 return ret; 2205 2206 if (size_remaining) 2207 return -EINVAL; 2208 2209 return state->buf_kern_offset; 2210 } 2211 2212 2213 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl, 2214 sockptr_t arg, unsigned int len) 2215 { 2216 struct compat_ebt_replace tmp; 2217 int i; 2218 2219 if (len < sizeof(tmp)) 2220 return -EINVAL; 2221 2222 if (copy_from_sockptr(&tmp, arg, sizeof(tmp))) 2223 return -EFAULT; 2224 2225 if (len != sizeof(tmp) + tmp.entries_size) 2226 return -EINVAL; 2227 2228 if (tmp.entries_size == 0) 2229 return -EINVAL; 2230 2231 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / 2232 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) 2233 return -ENOMEM; 2234 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 2235 return -ENOMEM; 2236 2237 memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry)); 2238 2239 /* starting with hook_entry, 32 vs. 64 bit structures are different */ 2240 for (i = 0; i < NF_BR_NUMHOOKS; i++) 2241 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]); 2242 2243 repl->num_counters = tmp.num_counters; 2244 repl->counters = compat_ptr(tmp.counters); 2245 repl->entries = compat_ptr(tmp.entries); 2246 return 0; 2247 } 2248 2249 static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) 2250 { 2251 int ret, i, countersize, size64; 2252 struct ebt_table_info *newinfo; 2253 struct ebt_replace tmp; 2254 struct ebt_entries_buf_state state; 2255 void *entries_tmp; 2256 2257 ret = compat_copy_ebt_replace_from_user(&tmp, arg, len); 2258 if (ret) { 2259 /* try real handler in case userland supplied needed padding */ 2260 if (ret == -EINVAL && do_replace(net, arg, len) == 0) 2261 ret = 0; 2262 return ret; 2263 } 2264 2265 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 2266 newinfo = vmalloc(sizeof(*newinfo) + countersize); 2267 if (!newinfo) 2268 return -ENOMEM; 2269 2270 if (countersize) 2271 memset(newinfo->counters, 0, countersize); 2272 2273 memset(&state, 0, sizeof(state)); 2274 2275 newinfo->entries = vmalloc(tmp.entries_size); 2276 if (!newinfo->entries) { 2277 ret = -ENOMEM; 2278 goto free_newinfo; 2279 } 2280 if (copy_from_user( 2281 newinfo->entries, tmp.entries, tmp.entries_size) != 0) { 2282 ret = -EFAULT; 2283 goto free_entries; 2284 } 2285 2286 entries_tmp = newinfo->entries; 2287 2288 xt_compat_lock(NFPROTO_BRIDGE); 2289 2290 ret = ebt_compat_init_offsets(tmp.nentries); 2291 if (ret < 0) 2292 goto out_unlock; 2293 2294 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); 2295 if (ret < 0) 2296 goto out_unlock; 2297 2298 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n", 2299 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset, 2300 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size)); 2301 2302 size64 = ret; 2303 newinfo->entries = vmalloc(size64); 2304 if (!newinfo->entries) { 2305 vfree(entries_tmp); 2306 ret = -ENOMEM; 2307 goto out_unlock; 2308 } 2309 2310 memset(&state, 0, sizeof(state)); 2311 state.buf_kern_start = newinfo->entries; 2312 state.buf_kern_len = size64; 2313 2314 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); 2315 if (WARN_ON(ret < 0)) { 2316 vfree(entries_tmp); 2317 goto out_unlock; 2318 } 2319 2320 vfree(entries_tmp); 2321 tmp.entries_size = size64; 2322 2323 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 2324 char __user *usrptr; 2325 if (tmp.hook_entry[i]) { 2326 unsigned int delta; 2327 usrptr = (char __user *) tmp.hook_entry[i]; 2328 delta = usrptr - tmp.entries; 2329 usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta); 2330 tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr; 2331 } 2332 } 2333 2334 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2335 xt_compat_unlock(NFPROTO_BRIDGE); 2336 2337 ret = do_replace_finish(net, &tmp, newinfo); 2338 if (ret == 0) 2339 return ret; 2340 free_entries: 2341 vfree(newinfo->entries); 2342 free_newinfo: 2343 vfree(newinfo); 2344 return ret; 2345 out_unlock: 2346 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2347 xt_compat_unlock(NFPROTO_BRIDGE); 2348 goto free_entries; 2349 } 2350 2351 static int compat_update_counters(struct net *net, sockptr_t arg, 2352 unsigned int len) 2353 { 2354 struct compat_ebt_replace hlp; 2355 2356 if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) 2357 return -EFAULT; 2358 2359 /* try real handler in case userland supplied needed padding */ 2360 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) 2361 return update_counters(net, arg, len); 2362 2363 return do_update_counters(net, hlp.name, compat_ptr(hlp.counters), 2364 hlp.num_counters, len); 2365 } 2366 2367 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd, 2368 void __user *user, int *len) 2369 { 2370 int ret; 2371 struct compat_ebt_replace tmp; 2372 struct ebt_table *t; 2373 struct net *net = sock_net(sk); 2374 2375 if ((cmd == EBT_SO_GET_INFO || cmd == EBT_SO_GET_INIT_INFO) && 2376 *len != sizeof(struct compat_ebt_replace)) 2377 return -EINVAL; 2378 2379 if (copy_from_user(&tmp, user, sizeof(tmp))) 2380 return -EFAULT; 2381 2382 tmp.name[sizeof(tmp.name) - 1] = '\0'; 2383 2384 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); 2385 if (!t) 2386 return ret; 2387 2388 xt_compat_lock(NFPROTO_BRIDGE); 2389 switch (cmd) { 2390 case EBT_SO_GET_INFO: 2391 tmp.nentries = t->private->nentries; 2392 ret = compat_table_info(t->private, &tmp); 2393 if (ret) 2394 goto out; 2395 tmp.valid_hooks = t->valid_hooks; 2396 2397 if (copy_to_user(user, &tmp, *len) != 0) { 2398 ret = -EFAULT; 2399 break; 2400 } 2401 ret = 0; 2402 break; 2403 case EBT_SO_GET_INIT_INFO: 2404 tmp.nentries = t->table->nentries; 2405 tmp.entries_size = t->table->entries_size; 2406 tmp.valid_hooks = t->table->valid_hooks; 2407 2408 if (copy_to_user(user, &tmp, *len) != 0) { 2409 ret = -EFAULT; 2410 break; 2411 } 2412 ret = 0; 2413 break; 2414 case EBT_SO_GET_ENTRIES: 2415 case EBT_SO_GET_INIT_ENTRIES: 2416 /* try real handler first in case of userland-side padding. 2417 * in case we are dealing with an 'ordinary' 32 bit binary 2418 * without 64bit compatibility padding, this will fail right 2419 * after copy_from_user when the *len argument is validated. 2420 * 2421 * the compat_ variant needs to do one pass over the kernel 2422 * data set to adjust for size differences before it the check. 2423 */ 2424 if (copy_everything_to_user(t, user, len, cmd) == 0) 2425 ret = 0; 2426 else 2427 ret = compat_copy_everything_to_user(t, user, len, cmd); 2428 break; 2429 default: 2430 ret = -EINVAL; 2431 } 2432 out: 2433 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2434 xt_compat_unlock(NFPROTO_BRIDGE); 2435 mutex_unlock(&ebt_mutex); 2436 return ret; 2437 } 2438 #endif 2439 2440 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 2441 { 2442 struct net *net = sock_net(sk); 2443 struct ebt_replace tmp; 2444 struct ebt_table *t; 2445 int ret; 2446 2447 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 2448 return -EPERM; 2449 2450 #ifdef CONFIG_NETFILTER_XTABLES_COMPAT 2451 /* try real handler in case userland supplied needed padding */ 2452 if (in_compat_syscall() && 2453 ((cmd != EBT_SO_GET_INFO && cmd != EBT_SO_GET_INIT_INFO) || 2454 *len != sizeof(tmp))) 2455 return compat_do_ebt_get_ctl(sk, cmd, user, len); 2456 #endif 2457 2458 if (copy_from_user(&tmp, user, sizeof(tmp))) 2459 return -EFAULT; 2460 2461 tmp.name[sizeof(tmp.name) - 1] = '\0'; 2462 2463 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); 2464 if (!t) 2465 return ret; 2466 2467 switch (cmd) { 2468 case EBT_SO_GET_INFO: 2469 case EBT_SO_GET_INIT_INFO: 2470 if (*len != sizeof(struct ebt_replace)) { 2471 ret = -EINVAL; 2472 mutex_unlock(&ebt_mutex); 2473 break; 2474 } 2475 if (cmd == EBT_SO_GET_INFO) { 2476 tmp.nentries = t->private->nentries; 2477 tmp.entries_size = t->private->entries_size; 2478 tmp.valid_hooks = t->valid_hooks; 2479 } else { 2480 tmp.nentries = t->table->nentries; 2481 tmp.entries_size = t->table->entries_size; 2482 tmp.valid_hooks = t->table->valid_hooks; 2483 } 2484 mutex_unlock(&ebt_mutex); 2485 if (copy_to_user(user, &tmp, *len) != 0) { 2486 ret = -EFAULT; 2487 break; 2488 } 2489 ret = 0; 2490 break; 2491 2492 case EBT_SO_GET_ENTRIES: 2493 case EBT_SO_GET_INIT_ENTRIES: 2494 ret = copy_everything_to_user(t, user, len, cmd); 2495 mutex_unlock(&ebt_mutex); 2496 break; 2497 2498 default: 2499 mutex_unlock(&ebt_mutex); 2500 ret = -EINVAL; 2501 } 2502 2503 return ret; 2504 } 2505 2506 static int do_ebt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, 2507 unsigned int len) 2508 { 2509 struct net *net = sock_net(sk); 2510 int ret; 2511 2512 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 2513 return -EPERM; 2514 2515 switch (cmd) { 2516 case EBT_SO_SET_ENTRIES: 2517 #ifdef CONFIG_NETFILTER_XTABLES_COMPAT 2518 if (in_compat_syscall()) 2519 ret = compat_do_replace(net, arg, len); 2520 else 2521 #endif 2522 ret = do_replace(net, arg, len); 2523 break; 2524 case EBT_SO_SET_COUNTERS: 2525 #ifdef CONFIG_NETFILTER_XTABLES_COMPAT 2526 if (in_compat_syscall()) 2527 ret = compat_update_counters(net, arg, len); 2528 else 2529 #endif 2530 ret = update_counters(net, arg, len); 2531 break; 2532 default: 2533 ret = -EINVAL; 2534 } 2535 return ret; 2536 } 2537 2538 static struct nf_sockopt_ops ebt_sockopts = { 2539 .pf = PF_INET, 2540 .set_optmin = EBT_BASE_CTL, 2541 .set_optmax = EBT_SO_SET_MAX + 1, 2542 .set = do_ebt_set_ctl, 2543 .get_optmin = EBT_BASE_CTL, 2544 .get_optmax = EBT_SO_GET_MAX + 1, 2545 .get = do_ebt_get_ctl, 2546 .owner = THIS_MODULE, 2547 }; 2548 2549 static int __net_init ebt_pernet_init(struct net *net) 2550 { 2551 struct ebt_pernet *ebt_net = net_generic(net, ebt_pernet_id); 2552 2553 INIT_LIST_HEAD(&ebt_net->tables); 2554 return 0; 2555 } 2556 2557 static struct pernet_operations ebt_net_ops = { 2558 .init = ebt_pernet_init, 2559 .id = &ebt_pernet_id, 2560 .size = sizeof(struct ebt_pernet), 2561 }; 2562 2563 static int __init ebtables_init(void) 2564 { 2565 int ret; 2566 2567 ret = xt_register_target(&ebt_standard_target); 2568 if (ret < 0) 2569 return ret; 2570 ret = nf_register_sockopt(&ebt_sockopts); 2571 if (ret < 0) { 2572 xt_unregister_target(&ebt_standard_target); 2573 return ret; 2574 } 2575 2576 ret = register_pernet_subsys(&ebt_net_ops); 2577 if (ret < 0) { 2578 nf_unregister_sockopt(&ebt_sockopts); 2579 xt_unregister_target(&ebt_standard_target); 2580 return ret; 2581 } 2582 2583 return 0; 2584 } 2585 2586 static void ebtables_fini(void) 2587 { 2588 nf_unregister_sockopt(&ebt_sockopts); 2589 xt_unregister_target(&ebt_standard_target); 2590 unregister_pernet_subsys(&ebt_net_ops); 2591 } 2592 2593 EXPORT_SYMBOL(ebt_register_table); 2594 EXPORT_SYMBOL(ebt_unregister_table); 2595 EXPORT_SYMBOL(ebt_do_table); 2596 module_init(ebtables_init); 2597 module_exit(ebtables_fini); 2598 MODULE_LICENSE("GPL"); 2599