1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * ebtables 4 * 5 * Author: 6 * Bart De Schuymer <bdschuym@pandora.be> 7 * 8 * ebtables.c,v 2.0, July, 2002 9 * 10 * This code is strongly inspired by the iptables code which is 11 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 12 */ 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 #include <linux/kmod.h> 15 #include <linux/module.h> 16 #include <linux/vmalloc.h> 17 #include <linux/netfilter/x_tables.h> 18 #include <linux/netfilter_bridge/ebtables.h> 19 #include <linux/spinlock.h> 20 #include <linux/mutex.h> 21 #include <linux/slab.h> 22 #include <linux/uaccess.h> 23 #include <linux/smp.h> 24 #include <linux/cpumask.h> 25 #include <linux/audit.h> 26 #include <net/sock.h> 27 /* needed for logical [in,out]-dev filtering */ 28 #include "../br_private.h" 29 30 /* Each cpu has its own set of counters, so there is no need for write_lock in 31 * the softirq 32 * For reading or updating the counters, the user context needs to 33 * get a write_lock 34 */ 35 36 /* The size of each set of counters is altered to get cache alignment */ 37 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) 38 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter))) 39 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \ 40 COUNTER_OFFSET(n) * cpu)) 41 42 43 44 static DEFINE_MUTEX(ebt_mutex); 45 46 #ifdef CONFIG_COMPAT 47 static void ebt_standard_compat_from_user(void *dst, const void *src) 48 { 49 int v = *(compat_int_t *)src; 50 51 if (v >= 0) 52 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v); 53 memcpy(dst, &v, sizeof(v)); 54 } 55 56 static int ebt_standard_compat_to_user(void __user *dst, const void *src) 57 { 58 compat_int_t cv = *(int *)src; 59 60 if (cv >= 0) 61 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv); 62 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0; 63 } 64 #endif 65 66 67 static struct xt_target ebt_standard_target = { 68 .name = "standard", 69 .revision = 0, 70 .family = NFPROTO_BRIDGE, 71 .targetsize = sizeof(int), 72 #ifdef CONFIG_COMPAT 73 .compatsize = sizeof(compat_int_t), 74 .compat_from_user = ebt_standard_compat_from_user, 75 .compat_to_user = ebt_standard_compat_to_user, 76 #endif 77 }; 78 79 static inline int 80 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb, 81 struct xt_action_param *par) 82 { 83 par->target = w->u.watcher; 84 par->targinfo = w->data; 85 w->u.watcher->target(skb, par); 86 /* watchers don't give a verdict */ 87 return 0; 88 } 89 90 static inline int 91 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb, 92 struct xt_action_param *par) 93 { 94 par->match = m->u.match; 95 par->matchinfo = m->data; 96 return !m->u.match->match(skb, par); 97 } 98 99 static inline int 100 ebt_dev_check(const char *entry, const struct net_device *device) 101 { 102 int i = 0; 103 const char *devname; 104 105 if (*entry == '\0') 106 return 0; 107 if (!device) 108 return 1; 109 devname = device->name; 110 /* 1 is the wildcard token */ 111 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i]) 112 i++; 113 return devname[i] != entry[i] && entry[i] != 1; 114 } 115 116 /* process standard matches */ 117 static inline int 118 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb, 119 const struct net_device *in, const struct net_device *out) 120 { 121 const struct ethhdr *h = eth_hdr(skb); 122 const struct net_bridge_port *p; 123 __be16 ethproto; 124 125 if (skb_vlan_tag_present(skb)) 126 ethproto = htons(ETH_P_8021Q); 127 else 128 ethproto = h->h_proto; 129 130 if (e->bitmask & EBT_802_3) { 131 if (NF_INVF(e, EBT_IPROTO, eth_proto_is_802_3(ethproto))) 132 return 1; 133 } else if (!(e->bitmask & EBT_NOPROTO) && 134 NF_INVF(e, EBT_IPROTO, e->ethproto != ethproto)) 135 return 1; 136 137 if (NF_INVF(e, EBT_IIN, ebt_dev_check(e->in, in))) 138 return 1; 139 if (NF_INVF(e, EBT_IOUT, ebt_dev_check(e->out, out))) 140 return 1; 141 /* rcu_read_lock()ed by nf_hook_thresh */ 142 if (in && (p = br_port_get_rcu(in)) != NULL && 143 NF_INVF(e, EBT_ILOGICALIN, 144 ebt_dev_check(e->logical_in, p->br->dev))) 145 return 1; 146 if (out && (p = br_port_get_rcu(out)) != NULL && 147 NF_INVF(e, EBT_ILOGICALOUT, 148 ebt_dev_check(e->logical_out, p->br->dev))) 149 return 1; 150 151 if (e->bitmask & EBT_SOURCEMAC) { 152 if (NF_INVF(e, EBT_ISOURCE, 153 !ether_addr_equal_masked(h->h_source, e->sourcemac, 154 e->sourcemsk))) 155 return 1; 156 } 157 if (e->bitmask & EBT_DESTMAC) { 158 if (NF_INVF(e, EBT_IDEST, 159 !ether_addr_equal_masked(h->h_dest, e->destmac, 160 e->destmsk))) 161 return 1; 162 } 163 return 0; 164 } 165 166 static inline 167 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry) 168 { 169 return (void *)entry + entry->next_offset; 170 } 171 172 static inline const struct ebt_entry_target * 173 ebt_get_target_c(const struct ebt_entry *e) 174 { 175 return ebt_get_target((struct ebt_entry *)e); 176 } 177 178 /* Do some firewalling */ 179 unsigned int ebt_do_table(struct sk_buff *skb, 180 const struct nf_hook_state *state, 181 struct ebt_table *table) 182 { 183 unsigned int hook = state->hook; 184 int i, nentries; 185 struct ebt_entry *point; 186 struct ebt_counter *counter_base, *cb_base; 187 const struct ebt_entry_target *t; 188 int verdict, sp = 0; 189 struct ebt_chainstack *cs; 190 struct ebt_entries *chaininfo; 191 const char *base; 192 const struct ebt_table_info *private; 193 struct xt_action_param acpar; 194 195 acpar.state = state; 196 acpar.hotdrop = false; 197 198 read_lock_bh(&table->lock); 199 private = table->private; 200 cb_base = COUNTER_BASE(private->counters, private->nentries, 201 smp_processor_id()); 202 if (private->chainstack) 203 cs = private->chainstack[smp_processor_id()]; 204 else 205 cs = NULL; 206 chaininfo = private->hook_entry[hook]; 207 nentries = private->hook_entry[hook]->nentries; 208 point = (struct ebt_entry *)(private->hook_entry[hook]->data); 209 counter_base = cb_base + private->hook_entry[hook]->counter_offset; 210 /* base for chain jumps */ 211 base = private->entries; 212 i = 0; 213 while (i < nentries) { 214 if (ebt_basic_match(point, skb, state->in, state->out)) 215 goto letscontinue; 216 217 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0) 218 goto letscontinue; 219 if (acpar.hotdrop) { 220 read_unlock_bh(&table->lock); 221 return NF_DROP; 222 } 223 224 ADD_COUNTER(*(counter_base + i), skb->len, 1); 225 226 /* these should only watch: not modify, nor tell us 227 * what to do with the packet 228 */ 229 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar); 230 231 t = ebt_get_target_c(point); 232 /* standard target */ 233 if (!t->u.target->target) 234 verdict = ((struct ebt_standard_target *)t)->verdict; 235 else { 236 acpar.target = t->u.target; 237 acpar.targinfo = t->data; 238 verdict = t->u.target->target(skb, &acpar); 239 } 240 if (verdict == EBT_ACCEPT) { 241 read_unlock_bh(&table->lock); 242 return NF_ACCEPT; 243 } 244 if (verdict == EBT_DROP) { 245 read_unlock_bh(&table->lock); 246 return NF_DROP; 247 } 248 if (verdict == EBT_RETURN) { 249 letsreturn: 250 if (WARN(sp == 0, "RETURN on base chain")) { 251 /* act like this is EBT_CONTINUE */ 252 goto letscontinue; 253 } 254 255 sp--; 256 /* put all the local variables right */ 257 i = cs[sp].n; 258 chaininfo = cs[sp].chaininfo; 259 nentries = chaininfo->nentries; 260 point = cs[sp].e; 261 counter_base = cb_base + 262 chaininfo->counter_offset; 263 continue; 264 } 265 if (verdict == EBT_CONTINUE) 266 goto letscontinue; 267 268 if (WARN(verdict < 0, "bogus standard verdict\n")) { 269 read_unlock_bh(&table->lock); 270 return NF_DROP; 271 } 272 273 /* jump to a udc */ 274 cs[sp].n = i + 1; 275 cs[sp].chaininfo = chaininfo; 276 cs[sp].e = ebt_next_entry(point); 277 i = 0; 278 chaininfo = (struct ebt_entries *) (base + verdict); 279 280 if (WARN(chaininfo->distinguisher, "jump to non-chain\n")) { 281 read_unlock_bh(&table->lock); 282 return NF_DROP; 283 } 284 285 nentries = chaininfo->nentries; 286 point = (struct ebt_entry *)chaininfo->data; 287 counter_base = cb_base + chaininfo->counter_offset; 288 sp++; 289 continue; 290 letscontinue: 291 point = ebt_next_entry(point); 292 i++; 293 } 294 295 /* I actually like this :) */ 296 if (chaininfo->policy == EBT_RETURN) 297 goto letsreturn; 298 if (chaininfo->policy == EBT_ACCEPT) { 299 read_unlock_bh(&table->lock); 300 return NF_ACCEPT; 301 } 302 read_unlock_bh(&table->lock); 303 return NF_DROP; 304 } 305 306 /* If it succeeds, returns element and locks mutex */ 307 static inline void * 308 find_inlist_lock_noload(struct list_head *head, const char *name, int *error, 309 struct mutex *mutex) 310 { 311 struct { 312 struct list_head list; 313 char name[EBT_FUNCTION_MAXNAMELEN]; 314 } *e; 315 316 mutex_lock(mutex); 317 list_for_each_entry(e, head, list) { 318 if (strcmp(e->name, name) == 0) 319 return e; 320 } 321 *error = -ENOENT; 322 mutex_unlock(mutex); 323 return NULL; 324 } 325 326 static void * 327 find_inlist_lock(struct list_head *head, const char *name, const char *prefix, 328 int *error, struct mutex *mutex) 329 { 330 return try_then_request_module( 331 find_inlist_lock_noload(head, name, error, mutex), 332 "%s%s", prefix, name); 333 } 334 335 static inline struct ebt_table * 336 find_table_lock(struct net *net, const char *name, int *error, 337 struct mutex *mutex) 338 { 339 return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name, 340 "ebtable_", error, mutex); 341 } 342 343 static inline void ebt_free_table_info(struct ebt_table_info *info) 344 { 345 int i; 346 347 if (info->chainstack) { 348 for_each_possible_cpu(i) 349 vfree(info->chainstack[i]); 350 vfree(info->chainstack); 351 } 352 } 353 static inline int 354 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par, 355 unsigned int *cnt) 356 { 357 const struct ebt_entry *e = par->entryinfo; 358 struct xt_match *match; 359 size_t left = ((char *)e + e->watchers_offset) - (char *)m; 360 int ret; 361 362 if (left < sizeof(struct ebt_entry_match) || 363 left - sizeof(struct ebt_entry_match) < m->match_size) 364 return -EINVAL; 365 366 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision); 367 if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) { 368 if (!IS_ERR(match)) 369 module_put(match->me); 370 request_module("ebt_%s", m->u.name); 371 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision); 372 } 373 if (IS_ERR(match)) 374 return PTR_ERR(match); 375 m->u.match = match; 376 377 par->match = match; 378 par->matchinfo = m->data; 379 ret = xt_check_match(par, m->match_size, 380 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 381 if (ret < 0) { 382 module_put(match->me); 383 return ret; 384 } 385 386 (*cnt)++; 387 return 0; 388 } 389 390 static inline int 391 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par, 392 unsigned int *cnt) 393 { 394 const struct ebt_entry *e = par->entryinfo; 395 struct xt_target *watcher; 396 size_t left = ((char *)e + e->target_offset) - (char *)w; 397 int ret; 398 399 if (left < sizeof(struct ebt_entry_watcher) || 400 left - sizeof(struct ebt_entry_watcher) < w->watcher_size) 401 return -EINVAL; 402 403 watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0); 404 if (IS_ERR(watcher)) 405 return PTR_ERR(watcher); 406 407 if (watcher->family != NFPROTO_BRIDGE) { 408 module_put(watcher->me); 409 return -ENOENT; 410 } 411 412 w->u.watcher = watcher; 413 414 par->target = watcher; 415 par->targinfo = w->data; 416 ret = xt_check_target(par, w->watcher_size, 417 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 418 if (ret < 0) { 419 module_put(watcher->me); 420 return ret; 421 } 422 423 (*cnt)++; 424 return 0; 425 } 426 427 static int ebt_verify_pointers(const struct ebt_replace *repl, 428 struct ebt_table_info *newinfo) 429 { 430 unsigned int limit = repl->entries_size; 431 unsigned int valid_hooks = repl->valid_hooks; 432 unsigned int offset = 0; 433 int i; 434 435 for (i = 0; i < NF_BR_NUMHOOKS; i++) 436 newinfo->hook_entry[i] = NULL; 437 438 newinfo->entries_size = repl->entries_size; 439 newinfo->nentries = repl->nentries; 440 441 while (offset < limit) { 442 size_t left = limit - offset; 443 struct ebt_entry *e = (void *)newinfo->entries + offset; 444 445 if (left < sizeof(unsigned int)) 446 break; 447 448 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 449 if ((valid_hooks & (1 << i)) == 0) 450 continue; 451 if ((char __user *)repl->hook_entry[i] == 452 repl->entries + offset) 453 break; 454 } 455 456 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) { 457 if (e->bitmask != 0) { 458 /* we make userspace set this right, 459 * so there is no misunderstanding 460 */ 461 return -EINVAL; 462 } 463 if (i != NF_BR_NUMHOOKS) 464 newinfo->hook_entry[i] = (struct ebt_entries *)e; 465 if (left < sizeof(struct ebt_entries)) 466 break; 467 offset += sizeof(struct ebt_entries); 468 } else { 469 if (left < sizeof(struct ebt_entry)) 470 break; 471 if (left < e->next_offset) 472 break; 473 if (e->next_offset < sizeof(struct ebt_entry)) 474 return -EINVAL; 475 offset += e->next_offset; 476 } 477 } 478 if (offset != limit) 479 return -EINVAL; 480 481 /* check if all valid hooks have a chain */ 482 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 483 if (!newinfo->hook_entry[i] && 484 (valid_hooks & (1 << i))) 485 return -EINVAL; 486 } 487 return 0; 488 } 489 490 /* this one is very careful, as it is the first function 491 * to parse the userspace data 492 */ 493 static inline int 494 ebt_check_entry_size_and_hooks(const struct ebt_entry *e, 495 const struct ebt_table_info *newinfo, 496 unsigned int *n, unsigned int *cnt, 497 unsigned int *totalcnt, unsigned int *udc_cnt) 498 { 499 int i; 500 501 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 502 if ((void *)e == (void *)newinfo->hook_entry[i]) 503 break; 504 } 505 /* beginning of a new chain 506 * if i == NF_BR_NUMHOOKS it must be a user defined chain 507 */ 508 if (i != NF_BR_NUMHOOKS || !e->bitmask) { 509 /* this checks if the previous chain has as many entries 510 * as it said it has 511 */ 512 if (*n != *cnt) 513 return -EINVAL; 514 515 if (((struct ebt_entries *)e)->policy != EBT_DROP && 516 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) { 517 /* only RETURN from udc */ 518 if (i != NF_BR_NUMHOOKS || 519 ((struct ebt_entries *)e)->policy != EBT_RETURN) 520 return -EINVAL; 521 } 522 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */ 523 (*udc_cnt)++; 524 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) 525 return -EINVAL; 526 *n = ((struct ebt_entries *)e)->nentries; 527 *cnt = 0; 528 return 0; 529 } 530 /* a plain old entry, heh */ 531 if (sizeof(struct ebt_entry) > e->watchers_offset || 532 e->watchers_offset > e->target_offset || 533 e->target_offset >= e->next_offset) 534 return -EINVAL; 535 536 /* this is not checked anywhere else */ 537 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) 538 return -EINVAL; 539 540 (*cnt)++; 541 (*totalcnt)++; 542 return 0; 543 } 544 545 struct ebt_cl_stack { 546 struct ebt_chainstack cs; 547 int from; 548 unsigned int hookmask; 549 }; 550 551 /* We need these positions to check that the jumps to a different part of the 552 * entries is a jump to the beginning of a new chain. 553 */ 554 static inline int 555 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo, 556 unsigned int *n, struct ebt_cl_stack *udc) 557 { 558 int i; 559 560 /* we're only interested in chain starts */ 561 if (e->bitmask) 562 return 0; 563 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 564 if (newinfo->hook_entry[i] == (struct ebt_entries *)e) 565 break; 566 } 567 /* only care about udc */ 568 if (i != NF_BR_NUMHOOKS) 569 return 0; 570 571 udc[*n].cs.chaininfo = (struct ebt_entries *)e; 572 /* these initialisations are depended on later in check_chainloops() */ 573 udc[*n].cs.n = 0; 574 udc[*n].hookmask = 0; 575 576 (*n)++; 577 return 0; 578 } 579 580 static inline int 581 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i) 582 { 583 struct xt_mtdtor_param par; 584 585 if (i && (*i)-- == 0) 586 return 1; 587 588 par.net = net; 589 par.match = m->u.match; 590 par.matchinfo = m->data; 591 par.family = NFPROTO_BRIDGE; 592 if (par.match->destroy != NULL) 593 par.match->destroy(&par); 594 module_put(par.match->me); 595 return 0; 596 } 597 598 static inline int 599 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i) 600 { 601 struct xt_tgdtor_param par; 602 603 if (i && (*i)-- == 0) 604 return 1; 605 606 par.net = net; 607 par.target = w->u.watcher; 608 par.targinfo = w->data; 609 par.family = NFPROTO_BRIDGE; 610 if (par.target->destroy != NULL) 611 par.target->destroy(&par); 612 module_put(par.target->me); 613 return 0; 614 } 615 616 static inline int 617 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt) 618 { 619 struct xt_tgdtor_param par; 620 struct ebt_entry_target *t; 621 622 if (e->bitmask == 0) 623 return 0; 624 /* we're done */ 625 if (cnt && (*cnt)-- == 0) 626 return 1; 627 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL); 628 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL); 629 t = ebt_get_target(e); 630 631 par.net = net; 632 par.target = t->u.target; 633 par.targinfo = t->data; 634 par.family = NFPROTO_BRIDGE; 635 if (par.target->destroy != NULL) 636 par.target->destroy(&par); 637 module_put(par.target->me); 638 return 0; 639 } 640 641 static inline int 642 ebt_check_entry(struct ebt_entry *e, struct net *net, 643 const struct ebt_table_info *newinfo, 644 const char *name, unsigned int *cnt, 645 struct ebt_cl_stack *cl_s, unsigned int udc_cnt) 646 { 647 struct ebt_entry_target *t; 648 struct xt_target *target; 649 unsigned int i, j, hook = 0, hookmask = 0; 650 size_t gap; 651 int ret; 652 struct xt_mtchk_param mtpar; 653 struct xt_tgchk_param tgpar; 654 655 /* don't mess with the struct ebt_entries */ 656 if (e->bitmask == 0) 657 return 0; 658 659 if (e->bitmask & ~EBT_F_MASK) 660 return -EINVAL; 661 662 if (e->invflags & ~EBT_INV_MASK) 663 return -EINVAL; 664 665 if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) 666 return -EINVAL; 667 668 /* what hook do we belong to? */ 669 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 670 if (!newinfo->hook_entry[i]) 671 continue; 672 if ((char *)newinfo->hook_entry[i] < (char *)e) 673 hook = i; 674 else 675 break; 676 } 677 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on 678 * a base chain 679 */ 680 if (i < NF_BR_NUMHOOKS) 681 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 682 else { 683 for (i = 0; i < udc_cnt; i++) 684 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e) 685 break; 686 if (i == 0) 687 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 688 else 689 hookmask = cl_s[i - 1].hookmask; 690 } 691 i = 0; 692 693 memset(&mtpar, 0, sizeof(mtpar)); 694 memset(&tgpar, 0, sizeof(tgpar)); 695 mtpar.net = tgpar.net = net; 696 mtpar.table = tgpar.table = name; 697 mtpar.entryinfo = tgpar.entryinfo = e; 698 mtpar.hook_mask = tgpar.hook_mask = hookmask; 699 mtpar.family = tgpar.family = NFPROTO_BRIDGE; 700 ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i); 701 if (ret != 0) 702 goto cleanup_matches; 703 j = 0; 704 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j); 705 if (ret != 0) 706 goto cleanup_watchers; 707 t = ebt_get_target(e); 708 gap = e->next_offset - e->target_offset; 709 710 target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0); 711 if (IS_ERR(target)) { 712 ret = PTR_ERR(target); 713 goto cleanup_watchers; 714 } 715 716 /* Reject UNSPEC, xtables verdicts/return values are incompatible */ 717 if (target->family != NFPROTO_BRIDGE) { 718 module_put(target->me); 719 ret = -ENOENT; 720 goto cleanup_watchers; 721 } 722 723 t->u.target = target; 724 if (t->u.target == &ebt_standard_target) { 725 if (gap < sizeof(struct ebt_standard_target)) { 726 ret = -EFAULT; 727 goto cleanup_watchers; 728 } 729 if (((struct ebt_standard_target *)t)->verdict < 730 -NUM_STANDARD_TARGETS) { 731 ret = -EFAULT; 732 goto cleanup_watchers; 733 } 734 } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) { 735 module_put(t->u.target->me); 736 ret = -EFAULT; 737 goto cleanup_watchers; 738 } 739 740 tgpar.target = target; 741 tgpar.targinfo = t->data; 742 ret = xt_check_target(&tgpar, t->target_size, 743 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 744 if (ret < 0) { 745 module_put(target->me); 746 goto cleanup_watchers; 747 } 748 (*cnt)++; 749 return 0; 750 cleanup_watchers: 751 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j); 752 cleanup_matches: 753 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i); 754 return ret; 755 } 756 757 /* checks for loops and sets the hook mask for udc 758 * the hook mask for udc tells us from which base chains the udc can be 759 * accessed. This mask is a parameter to the check() functions of the extensions 760 */ 761 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s, 762 unsigned int udc_cnt, unsigned int hooknr, char *base) 763 { 764 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict; 765 const struct ebt_entry *e = (struct ebt_entry *)chain->data; 766 const struct ebt_entry_target *t; 767 768 while (pos < nentries || chain_nr != -1) { 769 /* end of udc, go back one 'recursion' step */ 770 if (pos == nentries) { 771 /* put back values of the time when this chain was called */ 772 e = cl_s[chain_nr].cs.e; 773 if (cl_s[chain_nr].from != -1) 774 nentries = 775 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries; 776 else 777 nentries = chain->nentries; 778 pos = cl_s[chain_nr].cs.n; 779 /* make sure we won't see a loop that isn't one */ 780 cl_s[chain_nr].cs.n = 0; 781 chain_nr = cl_s[chain_nr].from; 782 if (pos == nentries) 783 continue; 784 } 785 t = ebt_get_target_c(e); 786 if (strcmp(t->u.name, EBT_STANDARD_TARGET)) 787 goto letscontinue; 788 if (e->target_offset + sizeof(struct ebt_standard_target) > 789 e->next_offset) 790 return -1; 791 792 verdict = ((struct ebt_standard_target *)t)->verdict; 793 if (verdict >= 0) { /* jump to another chain */ 794 struct ebt_entries *hlp2 = 795 (struct ebt_entries *)(base + verdict); 796 for (i = 0; i < udc_cnt; i++) 797 if (hlp2 == cl_s[i].cs.chaininfo) 798 break; 799 /* bad destination or loop */ 800 if (i == udc_cnt) 801 return -1; 802 803 if (cl_s[i].cs.n) 804 return -1; 805 806 if (cl_s[i].hookmask & (1 << hooknr)) 807 goto letscontinue; 808 /* this can't be 0, so the loop test is correct */ 809 cl_s[i].cs.n = pos + 1; 810 pos = 0; 811 cl_s[i].cs.e = ebt_next_entry(e); 812 e = (struct ebt_entry *)(hlp2->data); 813 nentries = hlp2->nentries; 814 cl_s[i].from = chain_nr; 815 chain_nr = i; 816 /* this udc is accessible from the base chain for hooknr */ 817 cl_s[i].hookmask |= (1 << hooknr); 818 continue; 819 } 820 letscontinue: 821 e = ebt_next_entry(e); 822 pos++; 823 } 824 return 0; 825 } 826 827 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */ 828 static int translate_table(struct net *net, const char *name, 829 struct ebt_table_info *newinfo) 830 { 831 unsigned int i, j, k, udc_cnt; 832 int ret; 833 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */ 834 835 i = 0; 836 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i]) 837 i++; 838 if (i == NF_BR_NUMHOOKS) 839 return -EINVAL; 840 841 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) 842 return -EINVAL; 843 844 /* make sure chains are ordered after each other in same order 845 * as their corresponding hooks 846 */ 847 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) { 848 if (!newinfo->hook_entry[j]) 849 continue; 850 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) 851 return -EINVAL; 852 853 i = j; 854 } 855 856 /* do some early checkings and initialize some things */ 857 i = 0; /* holds the expected nr. of entries for the chain */ 858 j = 0; /* holds the up to now counted entries for the chain */ 859 k = 0; /* holds the total nr. of entries, should equal 860 * newinfo->nentries afterwards 861 */ 862 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */ 863 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 864 ebt_check_entry_size_and_hooks, newinfo, 865 &i, &j, &k, &udc_cnt); 866 867 if (ret != 0) 868 return ret; 869 870 if (i != j) 871 return -EINVAL; 872 873 if (k != newinfo->nentries) 874 return -EINVAL; 875 876 /* get the location of the udc, put them in an array 877 * while we're at it, allocate the chainstack 878 */ 879 if (udc_cnt) { 880 /* this will get free'd in do_replace()/ebt_register_table() 881 * if an error occurs 882 */ 883 newinfo->chainstack = 884 vmalloc(array_size(nr_cpu_ids, 885 sizeof(*(newinfo->chainstack)))); 886 if (!newinfo->chainstack) 887 return -ENOMEM; 888 for_each_possible_cpu(i) { 889 newinfo->chainstack[i] = 890 vmalloc(array_size(udc_cnt, sizeof(*(newinfo->chainstack[0])))); 891 if (!newinfo->chainstack[i]) { 892 while (i) 893 vfree(newinfo->chainstack[--i]); 894 vfree(newinfo->chainstack); 895 newinfo->chainstack = NULL; 896 return -ENOMEM; 897 } 898 } 899 900 cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s))); 901 if (!cl_s) 902 return -ENOMEM; 903 i = 0; /* the i'th udc */ 904 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 905 ebt_get_udc_positions, newinfo, &i, cl_s); 906 /* sanity check */ 907 if (i != udc_cnt) { 908 vfree(cl_s); 909 return -EFAULT; 910 } 911 } 912 913 /* Check for loops */ 914 for (i = 0; i < NF_BR_NUMHOOKS; i++) 915 if (newinfo->hook_entry[i]) 916 if (check_chainloops(newinfo->hook_entry[i], 917 cl_s, udc_cnt, i, newinfo->entries)) { 918 vfree(cl_s); 919 return -EINVAL; 920 } 921 922 /* we now know the following (along with E=mc²): 923 * - the nr of entries in each chain is right 924 * - the size of the allocated space is right 925 * - all valid hooks have a corresponding chain 926 * - there are no loops 927 * - wrong data can still be on the level of a single entry 928 * - could be there are jumps to places that are not the 929 * beginning of a chain. This can only occur in chains that 930 * are not accessible from any base chains, so we don't care. 931 */ 932 933 /* used to know what we need to clean up if something goes wrong */ 934 i = 0; 935 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 936 ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt); 937 if (ret != 0) { 938 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 939 ebt_cleanup_entry, net, &i); 940 } 941 vfree(cl_s); 942 return ret; 943 } 944 945 /* called under write_lock */ 946 static void get_counters(const struct ebt_counter *oldcounters, 947 struct ebt_counter *counters, unsigned int nentries) 948 { 949 int i, cpu; 950 struct ebt_counter *counter_base; 951 952 /* counters of cpu 0 */ 953 memcpy(counters, oldcounters, 954 sizeof(struct ebt_counter) * nentries); 955 956 /* add other counters to those of cpu 0 */ 957 for_each_possible_cpu(cpu) { 958 if (cpu == 0) 959 continue; 960 counter_base = COUNTER_BASE(oldcounters, nentries, cpu); 961 for (i = 0; i < nentries; i++) 962 ADD_COUNTER(counters[i], counter_base[i].bcnt, 963 counter_base[i].pcnt); 964 } 965 } 966 967 static int do_replace_finish(struct net *net, struct ebt_replace *repl, 968 struct ebt_table_info *newinfo) 969 { 970 int ret; 971 struct ebt_counter *counterstmp = NULL; 972 /* used to be able to unlock earlier */ 973 struct ebt_table_info *table; 974 struct ebt_table *t; 975 976 /* the user wants counters back 977 * the check on the size is done later, when we have the lock 978 */ 979 if (repl->num_counters) { 980 unsigned long size = repl->num_counters * sizeof(*counterstmp); 981 counterstmp = vmalloc(size); 982 if (!counterstmp) 983 return -ENOMEM; 984 } 985 986 newinfo->chainstack = NULL; 987 ret = ebt_verify_pointers(repl, newinfo); 988 if (ret != 0) 989 goto free_counterstmp; 990 991 ret = translate_table(net, repl->name, newinfo); 992 993 if (ret != 0) 994 goto free_counterstmp; 995 996 t = find_table_lock(net, repl->name, &ret, &ebt_mutex); 997 if (!t) { 998 ret = -ENOENT; 999 goto free_iterate; 1000 } 1001 1002 /* the table doesn't like it */ 1003 if (t->check && (ret = t->check(newinfo, repl->valid_hooks))) 1004 goto free_unlock; 1005 1006 if (repl->num_counters && repl->num_counters != t->private->nentries) { 1007 ret = -EINVAL; 1008 goto free_unlock; 1009 } 1010 1011 /* we have the mutex lock, so no danger in reading this pointer */ 1012 table = t->private; 1013 /* make sure the table can only be rmmod'ed if it contains no rules */ 1014 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) { 1015 ret = -ENOENT; 1016 goto free_unlock; 1017 } else if (table->nentries && !newinfo->nentries) 1018 module_put(t->me); 1019 /* we need an atomic snapshot of the counters */ 1020 write_lock_bh(&t->lock); 1021 if (repl->num_counters) 1022 get_counters(t->private->counters, counterstmp, 1023 t->private->nentries); 1024 1025 t->private = newinfo; 1026 write_unlock_bh(&t->lock); 1027 mutex_unlock(&ebt_mutex); 1028 /* so, a user can change the chains while having messed up her counter 1029 * allocation. Only reason why this is done is because this way the lock 1030 * is held only once, while this doesn't bring the kernel into a 1031 * dangerous state. 1032 */ 1033 if (repl->num_counters && 1034 copy_to_user(repl->counters, counterstmp, 1035 repl->num_counters * sizeof(struct ebt_counter))) { 1036 /* Silent error, can't fail, new table is already in place */ 1037 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n"); 1038 } 1039 1040 /* decrease module count and free resources */ 1041 EBT_ENTRY_ITERATE(table->entries, table->entries_size, 1042 ebt_cleanup_entry, net, NULL); 1043 1044 vfree(table->entries); 1045 ebt_free_table_info(table); 1046 vfree(table); 1047 vfree(counterstmp); 1048 1049 audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries, 1050 AUDIT_XT_OP_REPLACE, GFP_KERNEL); 1051 return ret; 1052 1053 free_unlock: 1054 mutex_unlock(&ebt_mutex); 1055 free_iterate: 1056 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 1057 ebt_cleanup_entry, net, NULL); 1058 free_counterstmp: 1059 vfree(counterstmp); 1060 /* can be initialized in translate_table() */ 1061 ebt_free_table_info(newinfo); 1062 return ret; 1063 } 1064 1065 /* replace the table */ 1066 static int do_replace(struct net *net, sockptr_t arg, unsigned int len) 1067 { 1068 int ret, countersize; 1069 struct ebt_table_info *newinfo; 1070 struct ebt_replace tmp; 1071 1072 if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) 1073 return -EFAULT; 1074 1075 if (len != sizeof(tmp) + tmp.entries_size) 1076 return -EINVAL; 1077 1078 if (tmp.entries_size == 0) 1079 return -EINVAL; 1080 1081 /* overflow check */ 1082 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / 1083 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) 1084 return -ENOMEM; 1085 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 1086 return -ENOMEM; 1087 1088 tmp.name[sizeof(tmp.name) - 1] = 0; 1089 1090 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 1091 newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT); 1092 if (!newinfo) 1093 return -ENOMEM; 1094 1095 if (countersize) 1096 memset(newinfo->counters, 0, countersize); 1097 1098 newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT); 1099 if (!newinfo->entries) { 1100 ret = -ENOMEM; 1101 goto free_newinfo; 1102 } 1103 if (copy_from_user( 1104 newinfo->entries, tmp.entries, tmp.entries_size) != 0) { 1105 ret = -EFAULT; 1106 goto free_entries; 1107 } 1108 1109 ret = do_replace_finish(net, &tmp, newinfo); 1110 if (ret == 0) 1111 return ret; 1112 free_entries: 1113 vfree(newinfo->entries); 1114 free_newinfo: 1115 vfree(newinfo); 1116 return ret; 1117 } 1118 1119 static void __ebt_unregister_table(struct net *net, struct ebt_table *table) 1120 { 1121 mutex_lock(&ebt_mutex); 1122 list_del(&table->list); 1123 mutex_unlock(&ebt_mutex); 1124 audit_log_nfcfg(table->name, AF_BRIDGE, table->private->nentries, 1125 AUDIT_XT_OP_UNREGISTER, GFP_KERNEL); 1126 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size, 1127 ebt_cleanup_entry, net, NULL); 1128 if (table->private->nentries) 1129 module_put(table->me); 1130 vfree(table->private->entries); 1131 ebt_free_table_info(table->private); 1132 vfree(table->private); 1133 kfree(table); 1134 } 1135 1136 int ebt_register_table(struct net *net, const struct ebt_table *input_table, 1137 const struct nf_hook_ops *ops, struct ebt_table **res) 1138 { 1139 struct ebt_table_info *newinfo; 1140 struct ebt_table *t, *table; 1141 struct ebt_replace_kernel *repl; 1142 int ret, i, countersize; 1143 void *p; 1144 1145 if (input_table == NULL || (repl = input_table->table) == NULL || 1146 repl->entries == NULL || repl->entries_size == 0 || 1147 repl->counters != NULL || input_table->private != NULL) 1148 return -EINVAL; 1149 1150 /* Don't add one table to multiple lists. */ 1151 table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL); 1152 if (!table) { 1153 ret = -ENOMEM; 1154 goto out; 1155 } 1156 1157 countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids; 1158 newinfo = vmalloc(sizeof(*newinfo) + countersize); 1159 ret = -ENOMEM; 1160 if (!newinfo) 1161 goto free_table; 1162 1163 p = vmalloc(repl->entries_size); 1164 if (!p) 1165 goto free_newinfo; 1166 1167 memcpy(p, repl->entries, repl->entries_size); 1168 newinfo->entries = p; 1169 1170 newinfo->entries_size = repl->entries_size; 1171 newinfo->nentries = repl->nentries; 1172 1173 if (countersize) 1174 memset(newinfo->counters, 0, countersize); 1175 1176 /* fill in newinfo and parse the entries */ 1177 newinfo->chainstack = NULL; 1178 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 1179 if ((repl->valid_hooks & (1 << i)) == 0) 1180 newinfo->hook_entry[i] = NULL; 1181 else 1182 newinfo->hook_entry[i] = p + 1183 ((char *)repl->hook_entry[i] - repl->entries); 1184 } 1185 ret = translate_table(net, repl->name, newinfo); 1186 if (ret != 0) 1187 goto free_chainstack; 1188 1189 if (table->check && table->check(newinfo, table->valid_hooks)) { 1190 ret = -EINVAL; 1191 goto free_chainstack; 1192 } 1193 1194 table->private = newinfo; 1195 rwlock_init(&table->lock); 1196 mutex_lock(&ebt_mutex); 1197 list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) { 1198 if (strcmp(t->name, table->name) == 0) { 1199 ret = -EEXIST; 1200 goto free_unlock; 1201 } 1202 } 1203 1204 /* Hold a reference count if the chains aren't empty */ 1205 if (newinfo->nentries && !try_module_get(table->me)) { 1206 ret = -ENOENT; 1207 goto free_unlock; 1208 } 1209 list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]); 1210 mutex_unlock(&ebt_mutex); 1211 1212 WRITE_ONCE(*res, table); 1213 ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks)); 1214 if (ret) { 1215 __ebt_unregister_table(net, table); 1216 *res = NULL; 1217 } 1218 1219 audit_log_nfcfg(repl->name, AF_BRIDGE, repl->nentries, 1220 AUDIT_XT_OP_REGISTER, GFP_KERNEL); 1221 return ret; 1222 free_unlock: 1223 mutex_unlock(&ebt_mutex); 1224 free_chainstack: 1225 ebt_free_table_info(newinfo); 1226 vfree(newinfo->entries); 1227 free_newinfo: 1228 vfree(newinfo); 1229 free_table: 1230 kfree(table); 1231 out: 1232 return ret; 1233 } 1234 1235 void ebt_unregister_table(struct net *net, struct ebt_table *table, 1236 const struct nf_hook_ops *ops) 1237 { 1238 nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks)); 1239 __ebt_unregister_table(net, table); 1240 } 1241 1242 /* userspace just supplied us with counters */ 1243 static int do_update_counters(struct net *net, const char *name, 1244 struct ebt_counter __user *counters, 1245 unsigned int num_counters, unsigned int len) 1246 { 1247 int i, ret; 1248 struct ebt_counter *tmp; 1249 struct ebt_table *t; 1250 1251 if (num_counters == 0) 1252 return -EINVAL; 1253 1254 tmp = vmalloc(array_size(num_counters, sizeof(*tmp))); 1255 if (!tmp) 1256 return -ENOMEM; 1257 1258 t = find_table_lock(net, name, &ret, &ebt_mutex); 1259 if (!t) 1260 goto free_tmp; 1261 1262 if (num_counters != t->private->nentries) { 1263 ret = -EINVAL; 1264 goto unlock_mutex; 1265 } 1266 1267 if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) { 1268 ret = -EFAULT; 1269 goto unlock_mutex; 1270 } 1271 1272 /* we want an atomic add of the counters */ 1273 write_lock_bh(&t->lock); 1274 1275 /* we add to the counters of the first cpu */ 1276 for (i = 0; i < num_counters; i++) 1277 ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt); 1278 1279 write_unlock_bh(&t->lock); 1280 ret = 0; 1281 unlock_mutex: 1282 mutex_unlock(&ebt_mutex); 1283 free_tmp: 1284 vfree(tmp); 1285 return ret; 1286 } 1287 1288 static int update_counters(struct net *net, sockptr_t arg, unsigned int len) 1289 { 1290 struct ebt_replace hlp; 1291 1292 if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) 1293 return -EFAULT; 1294 1295 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) 1296 return -EINVAL; 1297 1298 return do_update_counters(net, hlp.name, hlp.counters, 1299 hlp.num_counters, len); 1300 } 1301 1302 static inline int ebt_obj_to_user(char __user *um, const char *_name, 1303 const char *data, int entrysize, 1304 int usersize, int datasize, u8 revision) 1305 { 1306 char name[EBT_EXTENSION_MAXNAMELEN] = {0}; 1307 1308 /* ebtables expects 31 bytes long names but xt_match names are 29 bytes 1309 * long. Copy 29 bytes and fill remaining bytes with zeroes. 1310 */ 1311 strlcpy(name, _name, sizeof(name)); 1312 if (copy_to_user(um, name, EBT_EXTENSION_MAXNAMELEN) || 1313 put_user(revision, (u8 __user *)(um + EBT_EXTENSION_MAXNAMELEN)) || 1314 put_user(datasize, (int __user *)(um + EBT_EXTENSION_MAXNAMELEN + 1)) || 1315 xt_data_to_user(um + entrysize, data, usersize, datasize, 1316 XT_ALIGN(datasize))) 1317 return -EFAULT; 1318 1319 return 0; 1320 } 1321 1322 static inline int ebt_match_to_user(const struct ebt_entry_match *m, 1323 const char *base, char __user *ubase) 1324 { 1325 return ebt_obj_to_user(ubase + ((char *)m - base), 1326 m->u.match->name, m->data, sizeof(*m), 1327 m->u.match->usersize, m->match_size, 1328 m->u.match->revision); 1329 } 1330 1331 static inline int ebt_watcher_to_user(const struct ebt_entry_watcher *w, 1332 const char *base, char __user *ubase) 1333 { 1334 return ebt_obj_to_user(ubase + ((char *)w - base), 1335 w->u.watcher->name, w->data, sizeof(*w), 1336 w->u.watcher->usersize, w->watcher_size, 1337 w->u.watcher->revision); 1338 } 1339 1340 static inline int ebt_entry_to_user(struct ebt_entry *e, const char *base, 1341 char __user *ubase) 1342 { 1343 int ret; 1344 char __user *hlp; 1345 const struct ebt_entry_target *t; 1346 1347 if (e->bitmask == 0) { 1348 /* special case !EBT_ENTRY_OR_ENTRIES */ 1349 if (copy_to_user(ubase + ((char *)e - base), e, 1350 sizeof(struct ebt_entries))) 1351 return -EFAULT; 1352 return 0; 1353 } 1354 1355 if (copy_to_user(ubase + ((char *)e - base), e, sizeof(*e))) 1356 return -EFAULT; 1357 1358 hlp = ubase + (((char *)e + e->target_offset) - base); 1359 t = ebt_get_target_c(e); 1360 1361 ret = EBT_MATCH_ITERATE(e, ebt_match_to_user, base, ubase); 1362 if (ret != 0) 1363 return ret; 1364 ret = EBT_WATCHER_ITERATE(e, ebt_watcher_to_user, base, ubase); 1365 if (ret != 0) 1366 return ret; 1367 ret = ebt_obj_to_user(hlp, t->u.target->name, t->data, sizeof(*t), 1368 t->u.target->usersize, t->target_size, 1369 t->u.target->revision); 1370 if (ret != 0) 1371 return ret; 1372 1373 return 0; 1374 } 1375 1376 static int copy_counters_to_user(struct ebt_table *t, 1377 const struct ebt_counter *oldcounters, 1378 void __user *user, unsigned int num_counters, 1379 unsigned int nentries) 1380 { 1381 struct ebt_counter *counterstmp; 1382 int ret = 0; 1383 1384 /* userspace might not need the counters */ 1385 if (num_counters == 0) 1386 return 0; 1387 1388 if (num_counters != nentries) 1389 return -EINVAL; 1390 1391 counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp))); 1392 if (!counterstmp) 1393 return -ENOMEM; 1394 1395 write_lock_bh(&t->lock); 1396 get_counters(oldcounters, counterstmp, nentries); 1397 write_unlock_bh(&t->lock); 1398 1399 if (copy_to_user(user, counterstmp, 1400 nentries * sizeof(struct ebt_counter))) 1401 ret = -EFAULT; 1402 vfree(counterstmp); 1403 return ret; 1404 } 1405 1406 /* called with ebt_mutex locked */ 1407 static int copy_everything_to_user(struct ebt_table *t, void __user *user, 1408 const int *len, int cmd) 1409 { 1410 struct ebt_replace tmp; 1411 const struct ebt_counter *oldcounters; 1412 unsigned int entries_size, nentries; 1413 int ret; 1414 char *entries; 1415 1416 if (cmd == EBT_SO_GET_ENTRIES) { 1417 entries_size = t->private->entries_size; 1418 nentries = t->private->nentries; 1419 entries = t->private->entries; 1420 oldcounters = t->private->counters; 1421 } else { 1422 entries_size = t->table->entries_size; 1423 nentries = t->table->nentries; 1424 entries = t->table->entries; 1425 oldcounters = t->table->counters; 1426 } 1427 1428 if (copy_from_user(&tmp, user, sizeof(tmp))) 1429 return -EFAULT; 1430 1431 if (*len != sizeof(struct ebt_replace) + entries_size + 1432 (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0)) 1433 return -EINVAL; 1434 1435 if (tmp.nentries != nentries) 1436 return -EINVAL; 1437 1438 if (tmp.entries_size != entries_size) 1439 return -EINVAL; 1440 1441 ret = copy_counters_to_user(t, oldcounters, tmp.counters, 1442 tmp.num_counters, nentries); 1443 if (ret) 1444 return ret; 1445 1446 /* set the match/watcher/target names right */ 1447 return EBT_ENTRY_ITERATE(entries, entries_size, 1448 ebt_entry_to_user, entries, tmp.entries); 1449 } 1450 1451 #ifdef CONFIG_COMPAT 1452 /* 32 bit-userspace compatibility definitions. */ 1453 struct compat_ebt_replace { 1454 char name[EBT_TABLE_MAXNAMELEN]; 1455 compat_uint_t valid_hooks; 1456 compat_uint_t nentries; 1457 compat_uint_t entries_size; 1458 /* start of the chains */ 1459 compat_uptr_t hook_entry[NF_BR_NUMHOOKS]; 1460 /* nr of counters userspace expects back */ 1461 compat_uint_t num_counters; 1462 /* where the kernel will put the old counters. */ 1463 compat_uptr_t counters; 1464 compat_uptr_t entries; 1465 }; 1466 1467 /* struct ebt_entry_match, _target and _watcher have same layout */ 1468 struct compat_ebt_entry_mwt { 1469 union { 1470 struct { 1471 char name[EBT_EXTENSION_MAXNAMELEN]; 1472 u8 revision; 1473 }; 1474 compat_uptr_t ptr; 1475 } u; 1476 compat_uint_t match_size; 1477 compat_uint_t data[] __aligned(__alignof__(struct compat_ebt_replace)); 1478 }; 1479 1480 /* account for possible padding between match_size and ->data */ 1481 static int ebt_compat_entry_padsize(void) 1482 { 1483 BUILD_BUG_ON(sizeof(struct ebt_entry_match) < 1484 sizeof(struct compat_ebt_entry_mwt)); 1485 return (int) sizeof(struct ebt_entry_match) - 1486 sizeof(struct compat_ebt_entry_mwt); 1487 } 1488 1489 static int ebt_compat_match_offset(const struct xt_match *match, 1490 unsigned int userlen) 1491 { 1492 /* ebt_among needs special handling. The kernel .matchsize is 1493 * set to -1 at registration time; at runtime an EBT_ALIGN()ed 1494 * value is expected. 1495 * Example: userspace sends 4500, ebt_among.c wants 4504. 1496 */ 1497 if (unlikely(match->matchsize == -1)) 1498 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen); 1499 return xt_compat_match_offset(match); 1500 } 1501 1502 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr, 1503 unsigned int *size) 1504 { 1505 const struct xt_match *match = m->u.match; 1506 struct compat_ebt_entry_mwt __user *cm = *dstptr; 1507 int off = ebt_compat_match_offset(match, m->match_size); 1508 compat_uint_t msize = m->match_size - off; 1509 1510 if (WARN_ON(off >= m->match_size)) 1511 return -EINVAL; 1512 1513 if (copy_to_user(cm->u.name, match->name, strlen(match->name) + 1) || 1514 put_user(match->revision, &cm->u.revision) || 1515 put_user(msize, &cm->match_size)) 1516 return -EFAULT; 1517 1518 if (match->compat_to_user) { 1519 if (match->compat_to_user(cm->data, m->data)) 1520 return -EFAULT; 1521 } else { 1522 if (xt_data_to_user(cm->data, m->data, match->usersize, msize, 1523 COMPAT_XT_ALIGN(msize))) 1524 return -EFAULT; 1525 } 1526 1527 *size -= ebt_compat_entry_padsize() + off; 1528 *dstptr = cm->data; 1529 *dstptr += msize; 1530 return 0; 1531 } 1532 1533 static int compat_target_to_user(struct ebt_entry_target *t, 1534 void __user **dstptr, 1535 unsigned int *size) 1536 { 1537 const struct xt_target *target = t->u.target; 1538 struct compat_ebt_entry_mwt __user *cm = *dstptr; 1539 int off = xt_compat_target_offset(target); 1540 compat_uint_t tsize = t->target_size - off; 1541 1542 if (WARN_ON(off >= t->target_size)) 1543 return -EINVAL; 1544 1545 if (copy_to_user(cm->u.name, target->name, strlen(target->name) + 1) || 1546 put_user(target->revision, &cm->u.revision) || 1547 put_user(tsize, &cm->match_size)) 1548 return -EFAULT; 1549 1550 if (target->compat_to_user) { 1551 if (target->compat_to_user(cm->data, t->data)) 1552 return -EFAULT; 1553 } else { 1554 if (xt_data_to_user(cm->data, t->data, target->usersize, tsize, 1555 COMPAT_XT_ALIGN(tsize))) 1556 return -EFAULT; 1557 } 1558 1559 *size -= ebt_compat_entry_padsize() + off; 1560 *dstptr = cm->data; 1561 *dstptr += tsize; 1562 return 0; 1563 } 1564 1565 static int compat_watcher_to_user(struct ebt_entry_watcher *w, 1566 void __user **dstptr, 1567 unsigned int *size) 1568 { 1569 return compat_target_to_user((struct ebt_entry_target *)w, 1570 dstptr, size); 1571 } 1572 1573 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr, 1574 unsigned int *size) 1575 { 1576 struct ebt_entry_target *t; 1577 struct ebt_entry __user *ce; 1578 u32 watchers_offset, target_offset, next_offset; 1579 compat_uint_t origsize; 1580 int ret; 1581 1582 if (e->bitmask == 0) { 1583 if (*size < sizeof(struct ebt_entries)) 1584 return -EINVAL; 1585 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries))) 1586 return -EFAULT; 1587 1588 *dstptr += sizeof(struct ebt_entries); 1589 *size -= sizeof(struct ebt_entries); 1590 return 0; 1591 } 1592 1593 if (*size < sizeof(*ce)) 1594 return -EINVAL; 1595 1596 ce = *dstptr; 1597 if (copy_to_user(ce, e, sizeof(*ce))) 1598 return -EFAULT; 1599 1600 origsize = *size; 1601 *dstptr += sizeof(*ce); 1602 1603 ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size); 1604 if (ret) 1605 return ret; 1606 watchers_offset = e->watchers_offset - (origsize - *size); 1607 1608 ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size); 1609 if (ret) 1610 return ret; 1611 target_offset = e->target_offset - (origsize - *size); 1612 1613 t = ebt_get_target(e); 1614 1615 ret = compat_target_to_user(t, dstptr, size); 1616 if (ret) 1617 return ret; 1618 next_offset = e->next_offset - (origsize - *size); 1619 1620 if (put_user(watchers_offset, &ce->watchers_offset) || 1621 put_user(target_offset, &ce->target_offset) || 1622 put_user(next_offset, &ce->next_offset)) 1623 return -EFAULT; 1624 1625 *size -= sizeof(*ce); 1626 return 0; 1627 } 1628 1629 static int compat_calc_match(struct ebt_entry_match *m, int *off) 1630 { 1631 *off += ebt_compat_match_offset(m->u.match, m->match_size); 1632 *off += ebt_compat_entry_padsize(); 1633 return 0; 1634 } 1635 1636 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off) 1637 { 1638 *off += xt_compat_target_offset(w->u.watcher); 1639 *off += ebt_compat_entry_padsize(); 1640 return 0; 1641 } 1642 1643 static int compat_calc_entry(const struct ebt_entry *e, 1644 const struct ebt_table_info *info, 1645 const void *base, 1646 struct compat_ebt_replace *newinfo) 1647 { 1648 const struct ebt_entry_target *t; 1649 unsigned int entry_offset; 1650 int off, ret, i; 1651 1652 if (e->bitmask == 0) 1653 return 0; 1654 1655 off = 0; 1656 entry_offset = (void *)e - base; 1657 1658 EBT_MATCH_ITERATE(e, compat_calc_match, &off); 1659 EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off); 1660 1661 t = ebt_get_target_c(e); 1662 1663 off += xt_compat_target_offset(t->u.target); 1664 off += ebt_compat_entry_padsize(); 1665 1666 newinfo->entries_size -= off; 1667 1668 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off); 1669 if (ret) 1670 return ret; 1671 1672 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 1673 const void *hookptr = info->hook_entry[i]; 1674 if (info->hook_entry[i] && 1675 (e < (struct ebt_entry *)(base - hookptr))) { 1676 newinfo->hook_entry[i] -= off; 1677 pr_debug("0x%08X -> 0x%08X\n", 1678 newinfo->hook_entry[i] + off, 1679 newinfo->hook_entry[i]); 1680 } 1681 } 1682 1683 return 0; 1684 } 1685 1686 static int ebt_compat_init_offsets(unsigned int number) 1687 { 1688 if (number > INT_MAX) 1689 return -EINVAL; 1690 1691 /* also count the base chain policies */ 1692 number += NF_BR_NUMHOOKS; 1693 1694 return xt_compat_init_offsets(NFPROTO_BRIDGE, number); 1695 } 1696 1697 static int compat_table_info(const struct ebt_table_info *info, 1698 struct compat_ebt_replace *newinfo) 1699 { 1700 unsigned int size = info->entries_size; 1701 const void *entries = info->entries; 1702 int ret; 1703 1704 newinfo->entries_size = size; 1705 ret = ebt_compat_init_offsets(info->nentries); 1706 if (ret) 1707 return ret; 1708 1709 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info, 1710 entries, newinfo); 1711 } 1712 1713 static int compat_copy_everything_to_user(struct ebt_table *t, 1714 void __user *user, int *len, int cmd) 1715 { 1716 struct compat_ebt_replace repl, tmp; 1717 struct ebt_counter *oldcounters; 1718 struct ebt_table_info tinfo; 1719 int ret; 1720 void __user *pos; 1721 1722 memset(&tinfo, 0, sizeof(tinfo)); 1723 1724 if (cmd == EBT_SO_GET_ENTRIES) { 1725 tinfo.entries_size = t->private->entries_size; 1726 tinfo.nentries = t->private->nentries; 1727 tinfo.entries = t->private->entries; 1728 oldcounters = t->private->counters; 1729 } else { 1730 tinfo.entries_size = t->table->entries_size; 1731 tinfo.nentries = t->table->nentries; 1732 tinfo.entries = t->table->entries; 1733 oldcounters = t->table->counters; 1734 } 1735 1736 if (copy_from_user(&tmp, user, sizeof(tmp))) 1737 return -EFAULT; 1738 1739 if (tmp.nentries != tinfo.nentries || 1740 (tmp.num_counters && tmp.num_counters != tinfo.nentries)) 1741 return -EINVAL; 1742 1743 memcpy(&repl, &tmp, sizeof(repl)); 1744 if (cmd == EBT_SO_GET_ENTRIES) 1745 ret = compat_table_info(t->private, &repl); 1746 else 1747 ret = compat_table_info(&tinfo, &repl); 1748 if (ret) 1749 return ret; 1750 1751 if (*len != sizeof(tmp) + repl.entries_size + 1752 (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) { 1753 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n", 1754 *len, tinfo.entries_size, repl.entries_size); 1755 return -EINVAL; 1756 } 1757 1758 /* userspace might not need the counters */ 1759 ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters), 1760 tmp.num_counters, tinfo.nentries); 1761 if (ret) 1762 return ret; 1763 1764 pos = compat_ptr(tmp.entries); 1765 return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size, 1766 compat_copy_entry_to_user, &pos, &tmp.entries_size); 1767 } 1768 1769 struct ebt_entries_buf_state { 1770 char *buf_kern_start; /* kernel buffer to copy (translated) data to */ 1771 u32 buf_kern_len; /* total size of kernel buffer */ 1772 u32 buf_kern_offset; /* amount of data copied so far */ 1773 u32 buf_user_offset; /* read position in userspace buffer */ 1774 }; 1775 1776 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz) 1777 { 1778 state->buf_kern_offset += sz; 1779 return state->buf_kern_offset >= sz ? 0 : -EINVAL; 1780 } 1781 1782 static int ebt_buf_add(struct ebt_entries_buf_state *state, 1783 const void *data, unsigned int sz) 1784 { 1785 if (state->buf_kern_start == NULL) 1786 goto count_only; 1787 1788 if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len)) 1789 return -EINVAL; 1790 1791 memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz); 1792 1793 count_only: 1794 state->buf_user_offset += sz; 1795 return ebt_buf_count(state, sz); 1796 } 1797 1798 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz) 1799 { 1800 char *b = state->buf_kern_start; 1801 1802 if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len)) 1803 return -EINVAL; 1804 1805 if (b != NULL && sz > 0) 1806 memset(b + state->buf_kern_offset, 0, sz); 1807 /* do not adjust ->buf_user_offset here, we added kernel-side padding */ 1808 return ebt_buf_count(state, sz); 1809 } 1810 1811 enum compat_mwt { 1812 EBT_COMPAT_MATCH, 1813 EBT_COMPAT_WATCHER, 1814 EBT_COMPAT_TARGET, 1815 }; 1816 1817 static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt, 1818 enum compat_mwt compat_mwt, 1819 struct ebt_entries_buf_state *state, 1820 const unsigned char *base) 1821 { 1822 char name[EBT_EXTENSION_MAXNAMELEN]; 1823 struct xt_match *match; 1824 struct xt_target *wt; 1825 void *dst = NULL; 1826 int off, pad = 0; 1827 unsigned int size_kern, match_size = mwt->match_size; 1828 1829 if (strscpy(name, mwt->u.name, sizeof(name)) < 0) 1830 return -EINVAL; 1831 1832 if (state->buf_kern_start) 1833 dst = state->buf_kern_start + state->buf_kern_offset; 1834 1835 switch (compat_mwt) { 1836 case EBT_COMPAT_MATCH: 1837 match = xt_request_find_match(NFPROTO_BRIDGE, name, 1838 mwt->u.revision); 1839 if (IS_ERR(match)) 1840 return PTR_ERR(match); 1841 1842 off = ebt_compat_match_offset(match, match_size); 1843 if (dst) { 1844 if (match->compat_from_user) 1845 match->compat_from_user(dst, mwt->data); 1846 else 1847 memcpy(dst, mwt->data, match_size); 1848 } 1849 1850 size_kern = match->matchsize; 1851 if (unlikely(size_kern == -1)) 1852 size_kern = match_size; 1853 module_put(match->me); 1854 break; 1855 case EBT_COMPAT_WATCHER: 1856 case EBT_COMPAT_TARGET: 1857 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 1858 mwt->u.revision); 1859 if (IS_ERR(wt)) 1860 return PTR_ERR(wt); 1861 off = xt_compat_target_offset(wt); 1862 1863 if (dst) { 1864 if (wt->compat_from_user) 1865 wt->compat_from_user(dst, mwt->data); 1866 else 1867 memcpy(dst, mwt->data, match_size); 1868 } 1869 1870 size_kern = wt->targetsize; 1871 module_put(wt->me); 1872 break; 1873 1874 default: 1875 return -EINVAL; 1876 } 1877 1878 state->buf_kern_offset += match_size + off; 1879 state->buf_user_offset += match_size; 1880 pad = XT_ALIGN(size_kern) - size_kern; 1881 1882 if (pad > 0 && dst) { 1883 if (WARN_ON(state->buf_kern_len <= pad)) 1884 return -EINVAL; 1885 if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad)) 1886 return -EINVAL; 1887 memset(dst + size_kern, 0, pad); 1888 } 1889 return off + match_size; 1890 } 1891 1892 /* return size of all matches, watchers or target, including necessary 1893 * alignment and padding. 1894 */ 1895 static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32, 1896 unsigned int size_left, enum compat_mwt type, 1897 struct ebt_entries_buf_state *state, const void *base) 1898 { 1899 const char *buf = (const char *)match32; 1900 int growth = 0; 1901 1902 if (size_left == 0) 1903 return 0; 1904 1905 do { 1906 struct ebt_entry_match *match_kern; 1907 int ret; 1908 1909 if (size_left < sizeof(*match32)) 1910 return -EINVAL; 1911 1912 match_kern = (struct ebt_entry_match *) state->buf_kern_start; 1913 if (match_kern) { 1914 char *tmp; 1915 tmp = state->buf_kern_start + state->buf_kern_offset; 1916 match_kern = (struct ebt_entry_match *) tmp; 1917 } 1918 ret = ebt_buf_add(state, buf, sizeof(*match32)); 1919 if (ret < 0) 1920 return ret; 1921 size_left -= sizeof(*match32); 1922 1923 /* add padding before match->data (if any) */ 1924 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize()); 1925 if (ret < 0) 1926 return ret; 1927 1928 if (match32->match_size > size_left) 1929 return -EINVAL; 1930 1931 size_left -= match32->match_size; 1932 1933 ret = compat_mtw_from_user(match32, type, state, base); 1934 if (ret < 0) 1935 return ret; 1936 1937 if (WARN_ON(ret < match32->match_size)) 1938 return -EINVAL; 1939 growth += ret - match32->match_size; 1940 growth += ebt_compat_entry_padsize(); 1941 1942 buf += sizeof(*match32); 1943 buf += match32->match_size; 1944 1945 if (match_kern) 1946 match_kern->match_size = ret; 1947 1948 match32 = (struct compat_ebt_entry_mwt *) buf; 1949 } while (size_left); 1950 1951 return growth; 1952 } 1953 1954 /* called for all ebt_entry structures. */ 1955 static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base, 1956 unsigned int *total, 1957 struct ebt_entries_buf_state *state) 1958 { 1959 unsigned int i, j, startoff, next_expected_off, new_offset = 0; 1960 /* stores match/watchers/targets & offset of next struct ebt_entry: */ 1961 unsigned int offsets[4]; 1962 unsigned int *offsets_update = NULL; 1963 int ret; 1964 char *buf_start; 1965 1966 if (*total < sizeof(struct ebt_entries)) 1967 return -EINVAL; 1968 1969 if (!entry->bitmask) { 1970 *total -= sizeof(struct ebt_entries); 1971 return ebt_buf_add(state, entry, sizeof(struct ebt_entries)); 1972 } 1973 if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry)) 1974 return -EINVAL; 1975 1976 startoff = state->buf_user_offset; 1977 /* pull in most part of ebt_entry, it does not need to be changed. */ 1978 ret = ebt_buf_add(state, entry, 1979 offsetof(struct ebt_entry, watchers_offset)); 1980 if (ret < 0) 1981 return ret; 1982 1983 offsets[0] = sizeof(struct ebt_entry); /* matches come first */ 1984 memcpy(&offsets[1], &entry->watchers_offset, 1985 sizeof(offsets) - sizeof(offsets[0])); 1986 1987 if (state->buf_kern_start) { 1988 buf_start = state->buf_kern_start + state->buf_kern_offset; 1989 offsets_update = (unsigned int *) buf_start; 1990 } 1991 ret = ebt_buf_add(state, &offsets[1], 1992 sizeof(offsets) - sizeof(offsets[0])); 1993 if (ret < 0) 1994 return ret; 1995 buf_start = (char *) entry; 1996 /* 0: matches offset, always follows ebt_entry. 1997 * 1: watchers offset, from ebt_entry structure 1998 * 2: target offset, from ebt_entry structure 1999 * 3: next ebt_entry offset, from ebt_entry structure 2000 * 2001 * offsets are relative to beginning of struct ebt_entry (i.e., 0). 2002 */ 2003 for (i = 0; i < 4 ; ++i) { 2004 if (offsets[i] > *total) 2005 return -EINVAL; 2006 2007 if (i < 3 && offsets[i] == *total) 2008 return -EINVAL; 2009 2010 if (i == 0) 2011 continue; 2012 if (offsets[i-1] > offsets[i]) 2013 return -EINVAL; 2014 } 2015 2016 for (i = 0, j = 1 ; j < 4 ; j++, i++) { 2017 struct compat_ebt_entry_mwt *match32; 2018 unsigned int size; 2019 char *buf = buf_start + offsets[i]; 2020 2021 if (offsets[i] > offsets[j]) 2022 return -EINVAL; 2023 2024 match32 = (struct compat_ebt_entry_mwt *) buf; 2025 size = offsets[j] - offsets[i]; 2026 ret = ebt_size_mwt(match32, size, i, state, base); 2027 if (ret < 0) 2028 return ret; 2029 new_offset += ret; 2030 if (offsets_update && new_offset) { 2031 pr_debug("change offset %d to %d\n", 2032 offsets_update[i], offsets[j] + new_offset); 2033 offsets_update[i] = offsets[j] + new_offset; 2034 } 2035 } 2036 2037 if (state->buf_kern_start == NULL) { 2038 unsigned int offset = buf_start - (char *) base; 2039 2040 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset); 2041 if (ret < 0) 2042 return ret; 2043 } 2044 2045 next_expected_off = state->buf_user_offset - startoff; 2046 if (next_expected_off != entry->next_offset) 2047 return -EINVAL; 2048 2049 if (*total < entry->next_offset) 2050 return -EINVAL; 2051 *total -= entry->next_offset; 2052 return 0; 2053 } 2054 2055 /* repl->entries_size is the size of the ebt_entry blob in userspace. 2056 * It might need more memory when copied to a 64 bit kernel in case 2057 * userspace is 32-bit. So, first task: find out how much memory is needed. 2058 * 2059 * Called before validation is performed. 2060 */ 2061 static int compat_copy_entries(unsigned char *data, unsigned int size_user, 2062 struct ebt_entries_buf_state *state) 2063 { 2064 unsigned int size_remaining = size_user; 2065 int ret; 2066 2067 ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data, 2068 &size_remaining, state); 2069 if (ret < 0) 2070 return ret; 2071 2072 if (size_remaining) 2073 return -EINVAL; 2074 2075 return state->buf_kern_offset; 2076 } 2077 2078 2079 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl, 2080 sockptr_t arg, unsigned int len) 2081 { 2082 struct compat_ebt_replace tmp; 2083 int i; 2084 2085 if (len < sizeof(tmp)) 2086 return -EINVAL; 2087 2088 if (copy_from_sockptr(&tmp, arg, sizeof(tmp))) 2089 return -EFAULT; 2090 2091 if (len != sizeof(tmp) + tmp.entries_size) 2092 return -EINVAL; 2093 2094 if (tmp.entries_size == 0) 2095 return -EINVAL; 2096 2097 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / 2098 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) 2099 return -ENOMEM; 2100 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 2101 return -ENOMEM; 2102 2103 memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry)); 2104 2105 /* starting with hook_entry, 32 vs. 64 bit structures are different */ 2106 for (i = 0; i < NF_BR_NUMHOOKS; i++) 2107 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]); 2108 2109 repl->num_counters = tmp.num_counters; 2110 repl->counters = compat_ptr(tmp.counters); 2111 repl->entries = compat_ptr(tmp.entries); 2112 return 0; 2113 } 2114 2115 static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) 2116 { 2117 int ret, i, countersize, size64; 2118 struct ebt_table_info *newinfo; 2119 struct ebt_replace tmp; 2120 struct ebt_entries_buf_state state; 2121 void *entries_tmp; 2122 2123 ret = compat_copy_ebt_replace_from_user(&tmp, arg, len); 2124 if (ret) { 2125 /* try real handler in case userland supplied needed padding */ 2126 if (ret == -EINVAL && do_replace(net, arg, len) == 0) 2127 ret = 0; 2128 return ret; 2129 } 2130 2131 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 2132 newinfo = vmalloc(sizeof(*newinfo) + countersize); 2133 if (!newinfo) 2134 return -ENOMEM; 2135 2136 if (countersize) 2137 memset(newinfo->counters, 0, countersize); 2138 2139 memset(&state, 0, sizeof(state)); 2140 2141 newinfo->entries = vmalloc(tmp.entries_size); 2142 if (!newinfo->entries) { 2143 ret = -ENOMEM; 2144 goto free_newinfo; 2145 } 2146 if (copy_from_user( 2147 newinfo->entries, tmp.entries, tmp.entries_size) != 0) { 2148 ret = -EFAULT; 2149 goto free_entries; 2150 } 2151 2152 entries_tmp = newinfo->entries; 2153 2154 xt_compat_lock(NFPROTO_BRIDGE); 2155 2156 ret = ebt_compat_init_offsets(tmp.nentries); 2157 if (ret < 0) 2158 goto out_unlock; 2159 2160 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); 2161 if (ret < 0) 2162 goto out_unlock; 2163 2164 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n", 2165 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset, 2166 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size)); 2167 2168 size64 = ret; 2169 newinfo->entries = vmalloc(size64); 2170 if (!newinfo->entries) { 2171 vfree(entries_tmp); 2172 ret = -ENOMEM; 2173 goto out_unlock; 2174 } 2175 2176 memset(&state, 0, sizeof(state)); 2177 state.buf_kern_start = newinfo->entries; 2178 state.buf_kern_len = size64; 2179 2180 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); 2181 if (WARN_ON(ret < 0)) { 2182 vfree(entries_tmp); 2183 goto out_unlock; 2184 } 2185 2186 vfree(entries_tmp); 2187 tmp.entries_size = size64; 2188 2189 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 2190 char __user *usrptr; 2191 if (tmp.hook_entry[i]) { 2192 unsigned int delta; 2193 usrptr = (char __user *) tmp.hook_entry[i]; 2194 delta = usrptr - tmp.entries; 2195 usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta); 2196 tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr; 2197 } 2198 } 2199 2200 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2201 xt_compat_unlock(NFPROTO_BRIDGE); 2202 2203 ret = do_replace_finish(net, &tmp, newinfo); 2204 if (ret == 0) 2205 return ret; 2206 free_entries: 2207 vfree(newinfo->entries); 2208 free_newinfo: 2209 vfree(newinfo); 2210 return ret; 2211 out_unlock: 2212 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2213 xt_compat_unlock(NFPROTO_BRIDGE); 2214 goto free_entries; 2215 } 2216 2217 static int compat_update_counters(struct net *net, sockptr_t arg, 2218 unsigned int len) 2219 { 2220 struct compat_ebt_replace hlp; 2221 2222 if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) 2223 return -EFAULT; 2224 2225 /* try real handler in case userland supplied needed padding */ 2226 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) 2227 return update_counters(net, arg, len); 2228 2229 return do_update_counters(net, hlp.name, compat_ptr(hlp.counters), 2230 hlp.num_counters, len); 2231 } 2232 2233 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd, 2234 void __user *user, int *len) 2235 { 2236 int ret; 2237 struct compat_ebt_replace tmp; 2238 struct ebt_table *t; 2239 struct net *net = sock_net(sk); 2240 2241 if ((cmd == EBT_SO_GET_INFO || cmd == EBT_SO_GET_INIT_INFO) && 2242 *len != sizeof(struct compat_ebt_replace)) 2243 return -EINVAL; 2244 2245 if (copy_from_user(&tmp, user, sizeof(tmp))) 2246 return -EFAULT; 2247 2248 tmp.name[sizeof(tmp.name) - 1] = '\0'; 2249 2250 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); 2251 if (!t) 2252 return ret; 2253 2254 xt_compat_lock(NFPROTO_BRIDGE); 2255 switch (cmd) { 2256 case EBT_SO_GET_INFO: 2257 tmp.nentries = t->private->nentries; 2258 ret = compat_table_info(t->private, &tmp); 2259 if (ret) 2260 goto out; 2261 tmp.valid_hooks = t->valid_hooks; 2262 2263 if (copy_to_user(user, &tmp, *len) != 0) { 2264 ret = -EFAULT; 2265 break; 2266 } 2267 ret = 0; 2268 break; 2269 case EBT_SO_GET_INIT_INFO: 2270 tmp.nentries = t->table->nentries; 2271 tmp.entries_size = t->table->entries_size; 2272 tmp.valid_hooks = t->table->valid_hooks; 2273 2274 if (copy_to_user(user, &tmp, *len) != 0) { 2275 ret = -EFAULT; 2276 break; 2277 } 2278 ret = 0; 2279 break; 2280 case EBT_SO_GET_ENTRIES: 2281 case EBT_SO_GET_INIT_ENTRIES: 2282 /* try real handler first in case of userland-side padding. 2283 * in case we are dealing with an 'ordinary' 32 bit binary 2284 * without 64bit compatibility padding, this will fail right 2285 * after copy_from_user when the *len argument is validated. 2286 * 2287 * the compat_ variant needs to do one pass over the kernel 2288 * data set to adjust for size differences before it the check. 2289 */ 2290 if (copy_everything_to_user(t, user, len, cmd) == 0) 2291 ret = 0; 2292 else 2293 ret = compat_copy_everything_to_user(t, user, len, cmd); 2294 break; 2295 default: 2296 ret = -EINVAL; 2297 } 2298 out: 2299 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2300 xt_compat_unlock(NFPROTO_BRIDGE); 2301 mutex_unlock(&ebt_mutex); 2302 return ret; 2303 } 2304 #endif 2305 2306 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 2307 { 2308 struct net *net = sock_net(sk); 2309 struct ebt_replace tmp; 2310 struct ebt_table *t; 2311 int ret; 2312 2313 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 2314 return -EPERM; 2315 2316 #ifdef CONFIG_COMPAT 2317 /* try real handler in case userland supplied needed padding */ 2318 if (in_compat_syscall() && 2319 ((cmd != EBT_SO_GET_INFO && cmd != EBT_SO_GET_INIT_INFO) || 2320 *len != sizeof(tmp))) 2321 return compat_do_ebt_get_ctl(sk, cmd, user, len); 2322 #endif 2323 2324 if (copy_from_user(&tmp, user, sizeof(tmp))) 2325 return -EFAULT; 2326 2327 tmp.name[sizeof(tmp.name) - 1] = '\0'; 2328 2329 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); 2330 if (!t) 2331 return ret; 2332 2333 switch (cmd) { 2334 case EBT_SO_GET_INFO: 2335 case EBT_SO_GET_INIT_INFO: 2336 if (*len != sizeof(struct ebt_replace)) { 2337 ret = -EINVAL; 2338 mutex_unlock(&ebt_mutex); 2339 break; 2340 } 2341 if (cmd == EBT_SO_GET_INFO) { 2342 tmp.nentries = t->private->nentries; 2343 tmp.entries_size = t->private->entries_size; 2344 tmp.valid_hooks = t->valid_hooks; 2345 } else { 2346 tmp.nentries = t->table->nentries; 2347 tmp.entries_size = t->table->entries_size; 2348 tmp.valid_hooks = t->table->valid_hooks; 2349 } 2350 mutex_unlock(&ebt_mutex); 2351 if (copy_to_user(user, &tmp, *len) != 0) { 2352 ret = -EFAULT; 2353 break; 2354 } 2355 ret = 0; 2356 break; 2357 2358 case EBT_SO_GET_ENTRIES: 2359 case EBT_SO_GET_INIT_ENTRIES: 2360 ret = copy_everything_to_user(t, user, len, cmd); 2361 mutex_unlock(&ebt_mutex); 2362 break; 2363 2364 default: 2365 mutex_unlock(&ebt_mutex); 2366 ret = -EINVAL; 2367 } 2368 2369 return ret; 2370 } 2371 2372 static int do_ebt_set_ctl(struct sock *sk, int cmd, sockptr_t arg, 2373 unsigned int len) 2374 { 2375 struct net *net = sock_net(sk); 2376 int ret; 2377 2378 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 2379 return -EPERM; 2380 2381 switch (cmd) { 2382 case EBT_SO_SET_ENTRIES: 2383 #ifdef CONFIG_COMPAT 2384 if (in_compat_syscall()) 2385 ret = compat_do_replace(net, arg, len); 2386 else 2387 #endif 2388 ret = do_replace(net, arg, len); 2389 break; 2390 case EBT_SO_SET_COUNTERS: 2391 #ifdef CONFIG_COMPAT 2392 if (in_compat_syscall()) 2393 ret = compat_update_counters(net, arg, len); 2394 else 2395 #endif 2396 ret = update_counters(net, arg, len); 2397 break; 2398 default: 2399 ret = -EINVAL; 2400 } 2401 return ret; 2402 } 2403 2404 static struct nf_sockopt_ops ebt_sockopts = { 2405 .pf = PF_INET, 2406 .set_optmin = EBT_BASE_CTL, 2407 .set_optmax = EBT_SO_SET_MAX + 1, 2408 .set = do_ebt_set_ctl, 2409 .get_optmin = EBT_BASE_CTL, 2410 .get_optmax = EBT_SO_GET_MAX + 1, 2411 .get = do_ebt_get_ctl, 2412 .owner = THIS_MODULE, 2413 }; 2414 2415 static int __init ebtables_init(void) 2416 { 2417 int ret; 2418 2419 ret = xt_register_target(&ebt_standard_target); 2420 if (ret < 0) 2421 return ret; 2422 ret = nf_register_sockopt(&ebt_sockopts); 2423 if (ret < 0) { 2424 xt_unregister_target(&ebt_standard_target); 2425 return ret; 2426 } 2427 2428 return 0; 2429 } 2430 2431 static void __exit ebtables_fini(void) 2432 { 2433 nf_unregister_sockopt(&ebt_sockopts); 2434 xt_unregister_target(&ebt_standard_target); 2435 } 2436 2437 EXPORT_SYMBOL(ebt_register_table); 2438 EXPORT_SYMBOL(ebt_unregister_table); 2439 EXPORT_SYMBOL(ebt_do_table); 2440 module_init(ebtables_init); 2441 module_exit(ebtables_fini); 2442 MODULE_LICENSE("GPL"); 2443