5 * Bart De Schuymer <bdschuym@pandora.be>
7 * ebtables.c,v 2.0, July, 2002
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18 #include <linux/kmod.h>
19 #include <linux/module.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/spinlock.h>
24 #include <linux/mutex.h>
25 #include <linux/slab.h>
26 #include <asm/uaccess.h>
27 #include <linux/smp.h>
28 #include <linux/cpumask.h>
30 /* needed for logical [in,out]-dev filtering */
31 #include "../br_private.h"
33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
34 "report to author: "format, ## args)
35 /* #define BUGPRINT(format, args...) */
38 * Each cpu has its own set of counters, so there is no need for write_lock in
40 * For reading or updating the counters, the user context needs to
44 /* The size of each set of counters is altered to get cache alignment */
45 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
46 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
47 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
48 COUNTER_OFFSET(n) * cpu))
52 static DEFINE_MUTEX(ebt_mutex);
55 static void ebt_standard_compat_from_user(void *dst, const void *src)
57 int v = *(compat_int_t *)src;
60 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
61 memcpy(dst, &v, sizeof(v));
64 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
66 compat_int_t cv = *(int *)src;
69 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
70 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
75 static struct xt_target ebt_standard_target = {
78 .family = NFPROTO_BRIDGE,
79 .targetsize = sizeof(int),
81 .compatsize = sizeof(compat_int_t),
82 .compat_from_user = ebt_standard_compat_from_user,
83 .compat_to_user = ebt_standard_compat_to_user,
88 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
89 struct xt_action_param *par)
91 par->target = w->u.watcher;
92 par->targinfo = w->data;
93 w->u.watcher->target(skb, par);
94 /* watchers don't give a verdict */
99 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
100 struct xt_action_param *par)
102 par->match = m->u.match;
103 par->matchinfo = m->data;
104 return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
108 ebt_dev_check(const char *entry, const struct net_device *device)
117 devname = device->name;
118 /* 1 is the wildcard token */
119 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
121 return (devname[i] != entry[i] && entry[i] != 1);
124 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
125 /* process standard matches */
127 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
128 const struct net_device *in, const struct net_device *out)
130 const struct ethhdr *h = eth_hdr(skb);
131 const struct net_bridge_port *p;
135 if (vlan_tx_tag_present(skb))
136 ethproto = htons(ETH_P_8021Q);
138 ethproto = h->h_proto;
140 if (e->bitmask & EBT_802_3) {
141 if (FWINV2(ntohs(ethproto) >= 1536, EBT_IPROTO))
143 } else if (!(e->bitmask & EBT_NOPROTO) &&
144 FWINV2(e->ethproto != ethproto, EBT_IPROTO))
147 if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
149 if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
151 /* rcu_read_lock()ed by nf_hook_slow */
152 if (in && (p = br_port_get_rcu(in)) != NULL &&
153 FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
155 if (out && (p = br_port_get_rcu(out)) != NULL &&
156 FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
159 if (e->bitmask & EBT_SOURCEMAC) {
161 for (i = 0; i < 6; i++)
162 verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
164 if (FWINV2(verdict != 0, EBT_ISOURCE) )
167 if (e->bitmask & EBT_DESTMAC) {
169 for (i = 0; i < 6; i++)
170 verdict |= (h->h_dest[i] ^ e->destmac[i]) &
172 if (FWINV2(verdict != 0, EBT_IDEST) )
179 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
181 return (void *)entry + entry->next_offset;
184 /* Do some firewalling */
185 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
186 const struct net_device *in, const struct net_device *out,
187 struct ebt_table *table)
190 struct ebt_entry *point;
191 struct ebt_counter *counter_base, *cb_base;
192 const struct ebt_entry_target *t;
194 struct ebt_chainstack *cs;
195 struct ebt_entries *chaininfo;
197 const struct ebt_table_info *private;
198 struct xt_action_param acpar;
200 acpar.family = NFPROTO_BRIDGE;
203 acpar.hotdrop = false;
204 acpar.hooknum = hook;
206 read_lock_bh(&table->lock);
207 private = table->private;
208 cb_base = COUNTER_BASE(private->counters, private->nentries,
210 if (private->chainstack)
211 cs = private->chainstack[smp_processor_id()];
214 chaininfo = private->hook_entry[hook];
215 nentries = private->hook_entry[hook]->nentries;
216 point = (struct ebt_entry *)(private->hook_entry[hook]->data);
217 counter_base = cb_base + private->hook_entry[hook]->counter_offset;
218 /* base for chain jumps */
219 base = private->entries;
221 while (i < nentries) {
222 if (ebt_basic_match(point, skb, in, out))
225 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
228 read_unlock_bh(&table->lock);
232 /* increase counter */
233 (*(counter_base + i)).pcnt++;
234 (*(counter_base + i)).bcnt += skb->len;
236 /* these should only watch: not modify, nor tell us
237 what to do with the packet */
238 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
240 t = (struct ebt_entry_target *)
241 (((char *)point) + point->target_offset);
242 /* standard target */
243 if (!t->u.target->target)
244 verdict = ((struct ebt_standard_target *)t)->verdict;
246 acpar.target = t->u.target;
247 acpar.targinfo = t->data;
248 verdict = t->u.target->target(skb, &acpar);
250 if (verdict == EBT_ACCEPT) {
251 read_unlock_bh(&table->lock);
254 if (verdict == EBT_DROP) {
255 read_unlock_bh(&table->lock);
258 if (verdict == EBT_RETURN) {
260 #ifdef CONFIG_NETFILTER_DEBUG
262 BUGPRINT("RETURN on base chain");
263 /* act like this is EBT_CONTINUE */
268 /* put all the local variables right */
270 chaininfo = cs[sp].chaininfo;
271 nentries = chaininfo->nentries;
273 counter_base = cb_base +
274 chaininfo->counter_offset;
277 if (verdict == EBT_CONTINUE)
279 #ifdef CONFIG_NETFILTER_DEBUG
281 BUGPRINT("bogus standard verdict\n");
282 read_unlock_bh(&table->lock);
288 cs[sp].chaininfo = chaininfo;
289 cs[sp].e = ebt_next_entry(point);
291 chaininfo = (struct ebt_entries *) (base + verdict);
292 #ifdef CONFIG_NETFILTER_DEBUG
293 if (chaininfo->distinguisher) {
294 BUGPRINT("jump to non-chain\n");
295 read_unlock_bh(&table->lock);
299 nentries = chaininfo->nentries;
300 point = (struct ebt_entry *)chaininfo->data;
301 counter_base = cb_base + chaininfo->counter_offset;
305 point = ebt_next_entry(point);
309 /* I actually like this :) */
310 if (chaininfo->policy == EBT_RETURN)
312 if (chaininfo->policy == EBT_ACCEPT) {
313 read_unlock_bh(&table->lock);
316 read_unlock_bh(&table->lock);
320 /* If it succeeds, returns element and locks mutex */
322 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
326 struct list_head list;
327 char name[EBT_FUNCTION_MAXNAMELEN];
330 *error = mutex_lock_interruptible(mutex);
334 list_for_each_entry(e, head, list) {
335 if (strcmp(e->name, name) == 0)
344 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
345 int *error, struct mutex *mutex)
347 return try_then_request_module(
348 find_inlist_lock_noload(head, name, error, mutex),
349 "%s%s", prefix, name);
352 static inline struct ebt_table *
353 find_table_lock(struct net *net, const char *name, int *error,
356 return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
357 "ebtable_", error, mutex);
361 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
364 const struct ebt_entry *e = par->entryinfo;
365 struct xt_match *match;
366 size_t left = ((char *)e + e->watchers_offset) - (char *)m;
369 if (left < sizeof(struct ebt_entry_match) ||
370 left - sizeof(struct ebt_entry_match) < m->match_size)
373 match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
375 return PTR_ERR(match);
379 par->matchinfo = m->data;
380 ret = xt_check_match(par, m->match_size,
381 e->ethproto, e->invflags & EBT_IPROTO);
383 module_put(match->me);
392 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
395 const struct ebt_entry *e = par->entryinfo;
396 struct xt_target *watcher;
397 size_t left = ((char *)e + e->target_offset) - (char *)w;
400 if (left < sizeof(struct ebt_entry_watcher) ||
401 left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
404 watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
406 return PTR_ERR(watcher);
407 w->u.watcher = watcher;
409 par->target = watcher;
410 par->targinfo = w->data;
411 ret = xt_check_target(par, w->watcher_size,
412 e->ethproto, e->invflags & EBT_IPROTO);
414 module_put(watcher->me);
422 static int ebt_verify_pointers(const struct ebt_replace *repl,
423 struct ebt_table_info *newinfo)
425 unsigned int limit = repl->entries_size;
426 unsigned int valid_hooks = repl->valid_hooks;
427 unsigned int offset = 0;
430 for (i = 0; i < NF_BR_NUMHOOKS; i++)
431 newinfo->hook_entry[i] = NULL;
433 newinfo->entries_size = repl->entries_size;
434 newinfo->nentries = repl->nentries;
436 while (offset < limit) {
437 size_t left = limit - offset;
438 struct ebt_entry *e = (void *)newinfo->entries + offset;
440 if (left < sizeof(unsigned int))
443 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
444 if ((valid_hooks & (1 << i)) == 0)
446 if ((char __user *)repl->hook_entry[i] ==
447 repl->entries + offset)
451 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
452 if (e->bitmask != 0) {
453 /* we make userspace set this right,
454 so there is no misunderstanding */
455 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
456 "in distinguisher\n");
459 if (i != NF_BR_NUMHOOKS)
460 newinfo->hook_entry[i] = (struct ebt_entries *)e;
461 if (left < sizeof(struct ebt_entries))
463 offset += sizeof(struct ebt_entries);
465 if (left < sizeof(struct ebt_entry))
467 if (left < e->next_offset)
469 if (e->next_offset < sizeof(struct ebt_entry))
471 offset += e->next_offset;
474 if (offset != limit) {
475 BUGPRINT("entries_size too small\n");
479 /* check if all valid hooks have a chain */
480 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
481 if (!newinfo->hook_entry[i] &&
482 (valid_hooks & (1 << i))) {
483 BUGPRINT("Valid hook without chain\n");
491 * this one is very careful, as it is the first function
492 * to parse the userspace data
495 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
496 const struct ebt_table_info *newinfo,
497 unsigned int *n, unsigned int *cnt,
498 unsigned int *totalcnt, unsigned int *udc_cnt)
502 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
503 if ((void *)e == (void *)newinfo->hook_entry[i])
506 /* beginning of a new chain
507 if i == NF_BR_NUMHOOKS it must be a user defined chain */
508 if (i != NF_BR_NUMHOOKS || !e->bitmask) {
509 /* this checks if the previous chain has as many entries
512 BUGPRINT("nentries does not equal the nr of entries "
516 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
517 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
518 /* only RETURN from udc */
519 if (i != NF_BR_NUMHOOKS ||
520 ((struct ebt_entries *)e)->policy != EBT_RETURN) {
521 BUGPRINT("bad policy\n");
525 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
527 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
528 BUGPRINT("counter_offset != totalcnt");
531 *n = ((struct ebt_entries *)e)->nentries;
535 /* a plain old entry, heh */
536 if (sizeof(struct ebt_entry) > e->watchers_offset ||
537 e->watchers_offset > e->target_offset ||
538 e->target_offset >= e->next_offset) {
539 BUGPRINT("entry offsets not in right order\n");
542 /* this is not checked anywhere else */
543 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
544 BUGPRINT("target size too small\n");
554 struct ebt_chainstack cs;
556 unsigned int hookmask;
560 * we need these positions to check that the jumps to a different part of the
561 * entries is a jump to the beginning of a new chain.
564 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
565 unsigned int *n, struct ebt_cl_stack *udc)
569 /* we're only interested in chain starts */
572 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
573 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
576 /* only care about udc */
577 if (i != NF_BR_NUMHOOKS)
580 udc[*n].cs.chaininfo = (struct ebt_entries *)e;
581 /* these initialisations are depended on later in check_chainloops() */
583 udc[*n].hookmask = 0;
590 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
592 struct xt_mtdtor_param par;
594 if (i && (*i)-- == 0)
598 par.match = m->u.match;
599 par.matchinfo = m->data;
600 par.family = NFPROTO_BRIDGE;
601 if (par.match->destroy != NULL)
602 par.match->destroy(&par);
603 module_put(par.match->me);
608 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
610 struct xt_tgdtor_param par;
612 if (i && (*i)-- == 0)
616 par.target = w->u.watcher;
617 par.targinfo = w->data;
618 par.family = NFPROTO_BRIDGE;
619 if (par.target->destroy != NULL)
620 par.target->destroy(&par);
621 module_put(par.target->me);
626 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
628 struct xt_tgdtor_param par;
629 struct ebt_entry_target *t;
634 if (cnt && (*cnt)-- == 0)
636 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
637 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
638 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
641 par.target = t->u.target;
642 par.targinfo = t->data;
643 par.family = NFPROTO_BRIDGE;
644 if (par.target->destroy != NULL)
645 par.target->destroy(&par);
646 module_put(par.target->me);
651 ebt_check_entry(struct ebt_entry *e, struct net *net,
652 const struct ebt_table_info *newinfo,
653 const char *name, unsigned int *cnt,
654 struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
656 struct ebt_entry_target *t;
657 struct xt_target *target;
658 unsigned int i, j, hook = 0, hookmask = 0;
661 struct xt_mtchk_param mtpar;
662 struct xt_tgchk_param tgpar;
664 /* don't mess with the struct ebt_entries */
668 if (e->bitmask & ~EBT_F_MASK) {
669 BUGPRINT("Unknown flag for bitmask\n");
672 if (e->invflags & ~EBT_INV_MASK) {
673 BUGPRINT("Unknown flag for inv bitmask\n");
676 if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
677 BUGPRINT("NOPROTO & 802_3 not allowed\n");
680 /* what hook do we belong to? */
681 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
682 if (!newinfo->hook_entry[i])
684 if ((char *)newinfo->hook_entry[i] < (char *)e)
689 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
691 if (i < NF_BR_NUMHOOKS)
692 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
694 for (i = 0; i < udc_cnt; i++)
695 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
698 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
700 hookmask = cl_s[i - 1].hookmask;
704 mtpar.net = tgpar.net = net;
705 mtpar.table = tgpar.table = name;
706 mtpar.entryinfo = tgpar.entryinfo = e;
707 mtpar.hook_mask = tgpar.hook_mask = hookmask;
708 mtpar.family = tgpar.family = NFPROTO_BRIDGE;
709 ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
711 goto cleanup_matches;
713 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
715 goto cleanup_watchers;
716 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
717 gap = e->next_offset - e->target_offset;
719 target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
720 if (IS_ERR(target)) {
721 ret = PTR_ERR(target);
722 goto cleanup_watchers;
725 t->u.target = target;
726 if (t->u.target == &ebt_standard_target) {
727 if (gap < sizeof(struct ebt_standard_target)) {
728 BUGPRINT("Standard target size too big\n");
730 goto cleanup_watchers;
732 if (((struct ebt_standard_target *)t)->verdict <
733 -NUM_STANDARD_TARGETS) {
734 BUGPRINT("Invalid standard target\n");
736 goto cleanup_watchers;
738 } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
739 module_put(t->u.target->me);
741 goto cleanup_watchers;
744 tgpar.target = target;
745 tgpar.targinfo = t->data;
746 ret = xt_check_target(&tgpar, t->target_size,
747 e->ethproto, e->invflags & EBT_IPROTO);
749 module_put(target->me);
750 goto cleanup_watchers;
755 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
757 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
762 * checks for loops and sets the hook mask for udc
763 * the hook mask for udc tells us from which base chains the udc can be
764 * accessed. This mask is a parameter to the check() functions of the extensions
766 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
767 unsigned int udc_cnt, unsigned int hooknr, char *base)
769 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
770 const struct ebt_entry *e = (struct ebt_entry *)chain->data;
771 const struct ebt_entry_target *t;
773 while (pos < nentries || chain_nr != -1) {
774 /* end of udc, go back one 'recursion' step */
775 if (pos == nentries) {
776 /* put back values of the time when this chain was called */
777 e = cl_s[chain_nr].cs.e;
778 if (cl_s[chain_nr].from != -1)
780 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
782 nentries = chain->nentries;
783 pos = cl_s[chain_nr].cs.n;
784 /* make sure we won't see a loop that isn't one */
785 cl_s[chain_nr].cs.n = 0;
786 chain_nr = cl_s[chain_nr].from;
790 t = (struct ebt_entry_target *)
791 (((char *)e) + e->target_offset);
792 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
794 if (e->target_offset + sizeof(struct ebt_standard_target) >
796 BUGPRINT("Standard target size too big\n");
799 verdict = ((struct ebt_standard_target *)t)->verdict;
800 if (verdict >= 0) { /* jump to another chain */
801 struct ebt_entries *hlp2 =
802 (struct ebt_entries *)(base + verdict);
803 for (i = 0; i < udc_cnt; i++)
804 if (hlp2 == cl_s[i].cs.chaininfo)
806 /* bad destination or loop */
808 BUGPRINT("bad destination\n");
815 if (cl_s[i].hookmask & (1 << hooknr))
817 /* this can't be 0, so the loop test is correct */
818 cl_s[i].cs.n = pos + 1;
820 cl_s[i].cs.e = ebt_next_entry(e);
821 e = (struct ebt_entry *)(hlp2->data);
822 nentries = hlp2->nentries;
823 cl_s[i].from = chain_nr;
825 /* this udc is accessible from the base chain for hooknr */
826 cl_s[i].hookmask |= (1 << hooknr);
830 e = ebt_next_entry(e);
836 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
837 static int translate_table(struct net *net, const char *name,
838 struct ebt_table_info *newinfo)
840 unsigned int i, j, k, udc_cnt;
842 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
845 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
847 if (i == NF_BR_NUMHOOKS) {
848 BUGPRINT("No valid hooks specified\n");
851 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
852 BUGPRINT("Chains don't start at beginning\n");
855 /* make sure chains are ordered after each other in same order
856 as their corresponding hooks */
857 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
858 if (!newinfo->hook_entry[j])
860 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
861 BUGPRINT("Hook order must be followed\n");
867 /* do some early checkings and initialize some things */
868 i = 0; /* holds the expected nr. of entries for the chain */
869 j = 0; /* holds the up to now counted entries for the chain */
870 k = 0; /* holds the total nr. of entries, should equal
871 newinfo->nentries afterwards */
872 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
873 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
874 ebt_check_entry_size_and_hooks, newinfo,
875 &i, &j, &k, &udc_cnt);
881 BUGPRINT("nentries does not equal the nr of entries in the "
885 if (k != newinfo->nentries) {
886 BUGPRINT("Total nentries is wrong\n");
890 /* get the location of the udc, put them in an array
891 while we're at it, allocate the chainstack */
893 /* this will get free'd in do_replace()/ebt_register_table()
894 if an error occurs */
895 newinfo->chainstack =
896 vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
897 if (!newinfo->chainstack)
899 for_each_possible_cpu(i) {
900 newinfo->chainstack[i] =
901 vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
902 if (!newinfo->chainstack[i]) {
904 vfree(newinfo->chainstack[--i]);
905 vfree(newinfo->chainstack);
906 newinfo->chainstack = NULL;
911 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
914 i = 0; /* the i'th udc */
915 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
916 ebt_get_udc_positions, newinfo, &i, cl_s);
919 BUGPRINT("i != udc_cnt\n");
925 /* Check for loops */
926 for (i = 0; i < NF_BR_NUMHOOKS; i++)
927 if (newinfo->hook_entry[i])
928 if (check_chainloops(newinfo->hook_entry[i],
929 cl_s, udc_cnt, i, newinfo->entries)) {
934 /* we now know the following (along with E=mc²):
935 - the nr of entries in each chain is right
936 - the size of the allocated space is right
937 - all valid hooks have a corresponding chain
939 - wrong data can still be on the level of a single entry
940 - could be there are jumps to places that are not the
941 beginning of a chain. This can only occur in chains that
942 are not accessible from any base chains, so we don't care. */
944 /* used to know what we need to clean up if something goes wrong */
946 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
947 ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
949 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
950 ebt_cleanup_entry, net, &i);
956 /* called under write_lock */
957 static void get_counters(const struct ebt_counter *oldcounters,
958 struct ebt_counter *counters, unsigned int nentries)
961 struct ebt_counter *counter_base;
963 /* counters of cpu 0 */
964 memcpy(counters, oldcounters,
965 sizeof(struct ebt_counter) * nentries);
967 /* add other counters to those of cpu 0 */
968 for_each_possible_cpu(cpu) {
971 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
972 for (i = 0; i < nentries; i++) {
973 counters[i].pcnt += counter_base[i].pcnt;
974 counters[i].bcnt += counter_base[i].bcnt;
979 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
980 struct ebt_table_info *newinfo)
983 struct ebt_counter *counterstmp = NULL;
984 /* used to be able to unlock earlier */
985 struct ebt_table_info *table;
988 /* the user wants counters back
989 the check on the size is done later, when we have the lock */
990 if (repl->num_counters) {
991 unsigned long size = repl->num_counters * sizeof(*counterstmp);
992 counterstmp = vmalloc(size);
997 newinfo->chainstack = NULL;
998 ret = ebt_verify_pointers(repl, newinfo);
1000 goto free_counterstmp;
1002 ret = translate_table(net, repl->name, newinfo);
1005 goto free_counterstmp;
1007 t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1013 /* the table doesn't like it */
1014 if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1017 if (repl->num_counters && repl->num_counters != t->private->nentries) {
1018 BUGPRINT("Wrong nr. of counters requested\n");
1023 /* we have the mutex lock, so no danger in reading this pointer */
1025 /* make sure the table can only be rmmod'ed if it contains no rules */
1026 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1029 } else if (table->nentries && !newinfo->nentries)
1031 /* we need an atomic snapshot of the counters */
1032 write_lock_bh(&t->lock);
1033 if (repl->num_counters)
1034 get_counters(t->private->counters, counterstmp,
1035 t->private->nentries);
1037 t->private = newinfo;
1038 write_unlock_bh(&t->lock);
1039 mutex_unlock(&ebt_mutex);
1040 /* so, a user can change the chains while having messed up her counter
1041 allocation. Only reason why this is done is because this way the lock
1042 is held only once, while this doesn't bring the kernel into a
1044 if (repl->num_counters &&
1045 copy_to_user(repl->counters, counterstmp,
1046 repl->num_counters * sizeof(struct ebt_counter))) {
1047 /* Silent error, can't fail, new table is already in place */
1048 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
1051 /* decrease module count and free resources */
1052 EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1053 ebt_cleanup_entry, net, NULL);
1055 vfree(table->entries);
1056 if (table->chainstack) {
1057 for_each_possible_cpu(i)
1058 vfree(table->chainstack[i]);
1059 vfree(table->chainstack);
1067 mutex_unlock(&ebt_mutex);
1069 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1070 ebt_cleanup_entry, net, NULL);
1073 /* can be initialized in translate_table() */
1074 if (newinfo->chainstack) {
1075 for_each_possible_cpu(i)
1076 vfree(newinfo->chainstack[i]);
1077 vfree(newinfo->chainstack);
1082 /* replace the table */
1083 static int do_replace(struct net *net, const void __user *user,
1086 int ret, countersize;
1087 struct ebt_table_info *newinfo;
1088 struct ebt_replace tmp;
1090 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1093 if (len != sizeof(tmp) + tmp.entries_size) {
1094 BUGPRINT("Wrong len argument\n");
1098 if (tmp.entries_size == 0) {
1099 BUGPRINT("Entries_size never zero\n");
1102 /* overflow check */
1103 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1104 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1106 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1109 tmp.name[sizeof(tmp.name) - 1] = 0;
1111 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1112 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1117 memset(newinfo->counters, 0, countersize);
1119 newinfo->entries = vmalloc(tmp.entries_size);
1120 if (!newinfo->entries) {
1125 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1126 BUGPRINT("Couldn't copy entries from userspace\n");
1131 ret = do_replace_finish(net, &tmp, newinfo);
1135 vfree(newinfo->entries);
1142 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1144 struct ebt_table_info *newinfo;
1145 struct ebt_table *t, *table;
1146 struct ebt_replace_kernel *repl;
1147 int ret, i, countersize;
1150 if (input_table == NULL || (repl = input_table->table) == NULL ||
1151 repl->entries == NULL || repl->entries_size == 0 ||
1152 repl->counters != NULL || input_table->private != NULL) {
1153 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1154 return ERR_PTR(-EINVAL);
1157 /* Don't add one table to multiple lists. */
1158 table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1164 countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1165 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1170 p = vmalloc(repl->entries_size);
1174 memcpy(p, repl->entries, repl->entries_size);
1175 newinfo->entries = p;
1177 newinfo->entries_size = repl->entries_size;
1178 newinfo->nentries = repl->nentries;
1181 memset(newinfo->counters, 0, countersize);
1183 /* fill in newinfo and parse the entries */
1184 newinfo->chainstack = NULL;
1185 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1186 if ((repl->valid_hooks & (1 << i)) == 0)
1187 newinfo->hook_entry[i] = NULL;
1189 newinfo->hook_entry[i] = p +
1190 ((char *)repl->hook_entry[i] - repl->entries);
1192 ret = translate_table(net, repl->name, newinfo);
1194 BUGPRINT("Translate_table failed\n");
1195 goto free_chainstack;
1198 if (table->check && table->check(newinfo, table->valid_hooks)) {
1199 BUGPRINT("The table doesn't like its own initial data, lol\n");
1201 goto free_chainstack;
1204 table->private = newinfo;
1205 rwlock_init(&table->lock);
1206 ret = mutex_lock_interruptible(&ebt_mutex);
1208 goto free_chainstack;
1210 list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1211 if (strcmp(t->name, table->name) == 0) {
1213 BUGPRINT("Table name already exists\n");
1218 /* Hold a reference count if the chains aren't empty */
1219 if (newinfo->nentries && !try_module_get(table->me)) {
1223 list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1224 mutex_unlock(&ebt_mutex);
1227 mutex_unlock(&ebt_mutex);
1229 if (newinfo->chainstack) {
1230 for_each_possible_cpu(i)
1231 vfree(newinfo->chainstack[i]);
1232 vfree(newinfo->chainstack);
1234 vfree(newinfo->entries);
1240 return ERR_PTR(ret);
1243 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1248 BUGPRINT("Request to unregister NULL table!!!\n");
1251 mutex_lock(&ebt_mutex);
1252 list_del(&table->list);
1253 mutex_unlock(&ebt_mutex);
1254 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1255 ebt_cleanup_entry, net, NULL);
1256 if (table->private->nentries)
1257 module_put(table->me);
1258 vfree(table->private->entries);
1259 if (table->private->chainstack) {
1260 for_each_possible_cpu(i)
1261 vfree(table->private->chainstack[i]);
1262 vfree(table->private->chainstack);
1264 vfree(table->private);
1268 /* userspace just supplied us with counters */
1269 static int do_update_counters(struct net *net, const char *name,
1270 struct ebt_counter __user *counters,
1271 unsigned int num_counters,
1272 const void __user *user, unsigned int len)
1275 struct ebt_counter *tmp;
1276 struct ebt_table *t;
1278 if (num_counters == 0)
1281 tmp = vmalloc(num_counters * sizeof(*tmp));
1285 t = find_table_lock(net, name, &ret, &ebt_mutex);
1289 if (num_counters != t->private->nentries) {
1290 BUGPRINT("Wrong nr of counters\n");
1295 if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1300 /* we want an atomic add of the counters */
1301 write_lock_bh(&t->lock);
1303 /* we add to the counters of the first cpu */
1304 for (i = 0; i < num_counters; i++) {
1305 t->private->counters[i].pcnt += tmp[i].pcnt;
1306 t->private->counters[i].bcnt += tmp[i].bcnt;
1309 write_unlock_bh(&t->lock);
1312 mutex_unlock(&ebt_mutex);
1318 static int update_counters(struct net *net, const void __user *user,
1321 struct ebt_replace hlp;
1323 if (copy_from_user(&hlp, user, sizeof(hlp)))
1326 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1329 return do_update_counters(net, hlp.name, hlp.counters,
1330 hlp.num_counters, user, len);
1333 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1334 const char *base, char __user *ubase)
1336 char __user *hlp = ubase + ((char *)m - base);
1337 if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1342 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1343 const char *base, char __user *ubase)
1345 char __user *hlp = ubase + ((char *)w - base);
1346 if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1352 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1356 const struct ebt_entry_target *t;
1358 if (e->bitmask == 0)
1361 hlp = ubase + (((char *)e + e->target_offset) - base);
1362 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1364 ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1367 ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1370 if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1375 static int copy_counters_to_user(struct ebt_table *t,
1376 const struct ebt_counter *oldcounters,
1377 void __user *user, unsigned int num_counters,
1378 unsigned int nentries)
1380 struct ebt_counter *counterstmp;
1383 /* userspace might not need the counters */
1384 if (num_counters == 0)
1387 if (num_counters != nentries) {
1388 BUGPRINT("Num_counters wrong\n");
1392 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1396 write_lock_bh(&t->lock);
1397 get_counters(oldcounters, counterstmp, nentries);
1398 write_unlock_bh(&t->lock);
1400 if (copy_to_user(user, counterstmp,
1401 nentries * sizeof(struct ebt_counter)))
1407 /* called with ebt_mutex locked */
1408 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1409 const int *len, int cmd)
1411 struct ebt_replace tmp;
1412 const struct ebt_counter *oldcounters;
1413 unsigned int entries_size, nentries;
1417 if (cmd == EBT_SO_GET_ENTRIES) {
1418 entries_size = t->private->entries_size;
1419 nentries = t->private->nentries;
1420 entries = t->private->entries;
1421 oldcounters = t->private->counters;
1423 entries_size = t->table->entries_size;
1424 nentries = t->table->nentries;
1425 entries = t->table->entries;
1426 oldcounters = t->table->counters;
1429 if (copy_from_user(&tmp, user, sizeof(tmp)))
1432 if (*len != sizeof(struct ebt_replace) + entries_size +
1433 (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
1436 if (tmp.nentries != nentries) {
1437 BUGPRINT("Nentries wrong\n");
1441 if (tmp.entries_size != entries_size) {
1442 BUGPRINT("Wrong size\n");
1446 ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1447 tmp.num_counters, nentries);
1451 if (copy_to_user(tmp.entries, entries, entries_size)) {
1452 BUGPRINT("Couldn't copy entries to userspace\n");
1455 /* set the match/watcher/target names right */
1456 return EBT_ENTRY_ITERATE(entries, entries_size,
1457 ebt_make_names, entries, tmp.entries);
1460 static int do_ebt_set_ctl(struct sock *sk,
1461 int cmd, void __user *user, unsigned int len)
1465 if (!capable(CAP_NET_ADMIN))
1469 case EBT_SO_SET_ENTRIES:
1470 ret = do_replace(sock_net(sk), user, len);
1472 case EBT_SO_SET_COUNTERS:
1473 ret = update_counters(sock_net(sk), user, len);
1481 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1484 struct ebt_replace tmp;
1485 struct ebt_table *t;
1487 if (!capable(CAP_NET_ADMIN))
1490 if (copy_from_user(&tmp, user, sizeof(tmp)))
1493 t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1498 case EBT_SO_GET_INFO:
1499 case EBT_SO_GET_INIT_INFO:
1500 if (*len != sizeof(struct ebt_replace)){
1502 mutex_unlock(&ebt_mutex);
1505 if (cmd == EBT_SO_GET_INFO) {
1506 tmp.nentries = t->private->nentries;
1507 tmp.entries_size = t->private->entries_size;
1508 tmp.valid_hooks = t->valid_hooks;
1510 tmp.nentries = t->table->nentries;
1511 tmp.entries_size = t->table->entries_size;
1512 tmp.valid_hooks = t->table->valid_hooks;
1514 mutex_unlock(&ebt_mutex);
1515 if (copy_to_user(user, &tmp, *len) != 0){
1516 BUGPRINT("c2u Didn't work\n");
1523 case EBT_SO_GET_ENTRIES:
1524 case EBT_SO_GET_INIT_ENTRIES:
1525 ret = copy_everything_to_user(t, user, len, cmd);
1526 mutex_unlock(&ebt_mutex);
1530 mutex_unlock(&ebt_mutex);
1537 #ifdef CONFIG_COMPAT
1538 /* 32 bit-userspace compatibility definitions. */
1539 struct compat_ebt_replace {
1540 char name[EBT_TABLE_MAXNAMELEN];
1541 compat_uint_t valid_hooks;
1542 compat_uint_t nentries;
1543 compat_uint_t entries_size;
1544 /* start of the chains */
1545 compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1546 /* nr of counters userspace expects back */
1547 compat_uint_t num_counters;
1548 /* where the kernel will put the old counters. */
1549 compat_uptr_t counters;
1550 compat_uptr_t entries;
1553 /* struct ebt_entry_match, _target and _watcher have same layout */
1554 struct compat_ebt_entry_mwt {
1556 char name[EBT_FUNCTION_MAXNAMELEN];
1559 compat_uint_t match_size;
1560 compat_uint_t data[0];
1563 /* account for possible padding between match_size and ->data */
1564 static int ebt_compat_entry_padsize(void)
1566 BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1567 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1568 return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1569 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1572 static int ebt_compat_match_offset(const struct xt_match *match,
1573 unsigned int userlen)
1576 * ebt_among needs special handling. The kernel .matchsize is
1577 * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1578 * value is expected.
1579 * Example: userspace sends 4500, ebt_among.c wants 4504.
1581 if (unlikely(match->matchsize == -1))
1582 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1583 return xt_compat_match_offset(match);
1586 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1589 const struct xt_match *match = m->u.match;
1590 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1591 int off = ebt_compat_match_offset(match, m->match_size);
1592 compat_uint_t msize = m->match_size - off;
1594 BUG_ON(off >= m->match_size);
1596 if (copy_to_user(cm->u.name, match->name,
1597 strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1600 if (match->compat_to_user) {
1601 if (match->compat_to_user(cm->data, m->data))
1603 } else if (copy_to_user(cm->data, m->data, msize))
1606 *size -= ebt_compat_entry_padsize() + off;
1612 static int compat_target_to_user(struct ebt_entry_target *t,
1613 void __user **dstptr,
1616 const struct xt_target *target = t->u.target;
1617 struct compat_ebt_entry_mwt __user *cm = *dstptr;
1618 int off = xt_compat_target_offset(target);
1619 compat_uint_t tsize = t->target_size - off;
1621 BUG_ON(off >= t->target_size);
1623 if (copy_to_user(cm->u.name, target->name,
1624 strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1627 if (target->compat_to_user) {
1628 if (target->compat_to_user(cm->data, t->data))
1630 } else if (copy_to_user(cm->data, t->data, tsize))
1633 *size -= ebt_compat_entry_padsize() + off;
1639 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1640 void __user **dstptr,
1643 return compat_target_to_user((struct ebt_entry_target *)w,
1647 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1650 struct ebt_entry_target *t;
1651 struct ebt_entry __user *ce;
1652 u32 watchers_offset, target_offset, next_offset;
1653 compat_uint_t origsize;
1656 if (e->bitmask == 0) {
1657 if (*size < sizeof(struct ebt_entries))
1659 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1662 *dstptr += sizeof(struct ebt_entries);
1663 *size -= sizeof(struct ebt_entries);
1667 if (*size < sizeof(*ce))
1670 ce = (struct ebt_entry __user *)*dstptr;
1671 if (copy_to_user(ce, e, sizeof(*ce)))
1675 *dstptr += sizeof(*ce);
1677 ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1680 watchers_offset = e->watchers_offset - (origsize - *size);
1682 ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1685 target_offset = e->target_offset - (origsize - *size);
1687 t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1689 ret = compat_target_to_user(t, dstptr, size);
1692 next_offset = e->next_offset - (origsize - *size);
1694 if (put_user(watchers_offset, &ce->watchers_offset) ||
1695 put_user(target_offset, &ce->target_offset) ||
1696 put_user(next_offset, &ce->next_offset))
1699 *size -= sizeof(*ce);
1703 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1705 *off += ebt_compat_match_offset(m->u.match, m->match_size);
1706 *off += ebt_compat_entry_padsize();
1710 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1712 *off += xt_compat_target_offset(w->u.watcher);
1713 *off += ebt_compat_entry_padsize();
1717 static int compat_calc_entry(const struct ebt_entry *e,
1718 const struct ebt_table_info *info,
1720 struct compat_ebt_replace *newinfo)
1722 const struct ebt_entry_target *t;
1723 unsigned int entry_offset;
1726 if (e->bitmask == 0)
1730 entry_offset = (void *)e - base;
1732 EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1733 EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1735 t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1737 off += xt_compat_target_offset(t->u.target);
1738 off += ebt_compat_entry_padsize();
1740 newinfo->entries_size -= off;
1742 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1746 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1747 const void *hookptr = info->hook_entry[i];
1748 if (info->hook_entry[i] &&
1749 (e < (struct ebt_entry *)(base - hookptr))) {
1750 newinfo->hook_entry[i] -= off;
1751 pr_debug("0x%08X -> 0x%08X\n",
1752 newinfo->hook_entry[i] + off,
1753 newinfo->hook_entry[i]);
1761 static int compat_table_info(const struct ebt_table_info *info,
1762 struct compat_ebt_replace *newinfo)
1764 unsigned int size = info->entries_size;
1765 const void *entries = info->entries;
1767 newinfo->entries_size = size;
1769 xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
1770 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1774 static int compat_copy_everything_to_user(struct ebt_table *t,
1775 void __user *user, int *len, int cmd)
1777 struct compat_ebt_replace repl, tmp;
1778 struct ebt_counter *oldcounters;
1779 struct ebt_table_info tinfo;
1783 memset(&tinfo, 0, sizeof(tinfo));
1785 if (cmd == EBT_SO_GET_ENTRIES) {
1786 tinfo.entries_size = t->private->entries_size;
1787 tinfo.nentries = t->private->nentries;
1788 tinfo.entries = t->private->entries;
1789 oldcounters = t->private->counters;
1791 tinfo.entries_size = t->table->entries_size;
1792 tinfo.nentries = t->table->nentries;
1793 tinfo.entries = t->table->entries;
1794 oldcounters = t->table->counters;
1797 if (copy_from_user(&tmp, user, sizeof(tmp)))
1800 if (tmp.nentries != tinfo.nentries ||
1801 (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1804 memcpy(&repl, &tmp, sizeof(repl));
1805 if (cmd == EBT_SO_GET_ENTRIES)
1806 ret = compat_table_info(t->private, &repl);
1808 ret = compat_table_info(&tinfo, &repl);
1812 if (*len != sizeof(tmp) + repl.entries_size +
1813 (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1814 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1815 *len, tinfo.entries_size, repl.entries_size);
1819 /* userspace might not need the counters */
1820 ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1821 tmp.num_counters, tinfo.nentries);
1825 pos = compat_ptr(tmp.entries);
1826 return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1827 compat_copy_entry_to_user, &pos, &tmp.entries_size);
1830 struct ebt_entries_buf_state {
1831 char *buf_kern_start; /* kernel buffer to copy (translated) data to */
1832 u32 buf_kern_len; /* total size of kernel buffer */
1833 u32 buf_kern_offset; /* amount of data copied so far */
1834 u32 buf_user_offset; /* read position in userspace buffer */
1837 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1839 state->buf_kern_offset += sz;
1840 return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1843 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1844 void *data, unsigned int sz)
1846 if (state->buf_kern_start == NULL)
1849 BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1851 memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1854 state->buf_user_offset += sz;
1855 return ebt_buf_count(state, sz);
1858 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1860 char *b = state->buf_kern_start;
1862 BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1864 if (b != NULL && sz > 0)
1865 memset(b + state->buf_kern_offset, 0, sz);
1866 /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1867 return ebt_buf_count(state, sz);
1876 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1877 enum compat_mwt compat_mwt,
1878 struct ebt_entries_buf_state *state,
1879 const unsigned char *base)
1881 char name[EBT_FUNCTION_MAXNAMELEN];
1882 struct xt_match *match;
1883 struct xt_target *wt;
1886 unsigned int size_kern, match_size = mwt->match_size;
1888 strlcpy(name, mwt->u.name, sizeof(name));
1890 if (state->buf_kern_start)
1891 dst = state->buf_kern_start + state->buf_kern_offset;
1893 switch (compat_mwt) {
1894 case EBT_COMPAT_MATCH:
1895 match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
1896 name, 0), "ebt_%s", name);
1900 return PTR_ERR(match);
1902 off = ebt_compat_match_offset(match, match_size);
1904 if (match->compat_from_user)
1905 match->compat_from_user(dst, mwt->data);
1907 memcpy(dst, mwt->data, match_size);
1910 size_kern = match->matchsize;
1911 if (unlikely(size_kern == -1))
1912 size_kern = match_size;
1913 module_put(match->me);
1915 case EBT_COMPAT_WATCHER: /* fallthrough */
1916 case EBT_COMPAT_TARGET:
1917 wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
1918 name, 0), "ebt_%s", name);
1923 off = xt_compat_target_offset(wt);
1926 if (wt->compat_from_user)
1927 wt->compat_from_user(dst, mwt->data);
1929 memcpy(dst, mwt->data, match_size);
1932 size_kern = wt->targetsize;
1940 state->buf_kern_offset += match_size + off;
1941 state->buf_user_offset += match_size;
1942 pad = XT_ALIGN(size_kern) - size_kern;
1944 if (pad > 0 && dst) {
1945 BUG_ON(state->buf_kern_len <= pad);
1946 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1947 memset(dst + size_kern, 0, pad);
1949 return off + match_size;
1953 * return size of all matches, watchers or target, including necessary
1954 * alignment and padding.
1956 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1957 unsigned int size_left, enum compat_mwt type,
1958 struct ebt_entries_buf_state *state, const void *base)
1966 buf = (char *) match32;
1968 while (size_left >= sizeof(*match32)) {
1969 struct ebt_entry_match *match_kern;
1972 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1975 tmp = state->buf_kern_start + state->buf_kern_offset;
1976 match_kern = (struct ebt_entry_match *) tmp;
1978 ret = ebt_buf_add(state, buf, sizeof(*match32));
1981 size_left -= sizeof(*match32);
1983 /* add padding before match->data (if any) */
1984 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
1988 if (match32->match_size > size_left)
1991 size_left -= match32->match_size;
1993 ret = compat_mtw_from_user(match32, type, state, base);
1997 BUG_ON(ret < match32->match_size);
1998 growth += ret - match32->match_size;
1999 growth += ebt_compat_entry_padsize();
2001 buf += sizeof(*match32);
2002 buf += match32->match_size;
2005 match_kern->match_size = ret;
2007 if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
2010 match32 = (struct compat_ebt_entry_mwt *) buf;
2016 /* called for all ebt_entry structures. */
2017 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2018 unsigned int *total,
2019 struct ebt_entries_buf_state *state)
2021 unsigned int i, j, startoff, new_offset = 0;
2022 /* stores match/watchers/targets & offset of next struct ebt_entry: */
2023 unsigned int offsets[4];
2024 unsigned int *offsets_update = NULL;
2028 if (*total < sizeof(struct ebt_entries))
2031 if (!entry->bitmask) {
2032 *total -= sizeof(struct ebt_entries);
2033 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2035 if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2038 startoff = state->buf_user_offset;
2039 /* pull in most part of ebt_entry, it does not need to be changed. */
2040 ret = ebt_buf_add(state, entry,
2041 offsetof(struct ebt_entry, watchers_offset));
2045 offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2046 memcpy(&offsets[1], &entry->watchers_offset,
2047 sizeof(offsets) - sizeof(offsets[0]));
2049 if (state->buf_kern_start) {
2050 buf_start = state->buf_kern_start + state->buf_kern_offset;
2051 offsets_update = (unsigned int *) buf_start;
2053 ret = ebt_buf_add(state, &offsets[1],
2054 sizeof(offsets) - sizeof(offsets[0]));
2057 buf_start = (char *) entry;
2059 * 0: matches offset, always follows ebt_entry.
2060 * 1: watchers offset, from ebt_entry structure
2061 * 2: target offset, from ebt_entry structure
2062 * 3: next ebt_entry offset, from ebt_entry structure
2064 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2066 for (i = 0; i < 4 ; ++i) {
2067 if (offsets[i] >= *total)
2071 if (offsets[i-1] > offsets[i])
2075 for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2076 struct compat_ebt_entry_mwt *match32;
2078 char *buf = buf_start;
2080 buf = buf_start + offsets[i];
2081 if (offsets[i] > offsets[j])
2084 match32 = (struct compat_ebt_entry_mwt *) buf;
2085 size = offsets[j] - offsets[i];
2086 ret = ebt_size_mwt(match32, size, i, state, base);
2090 if (offsets_update && new_offset) {
2091 pr_debug("change offset %d to %d\n",
2092 offsets_update[i], offsets[j] + new_offset);
2093 offsets_update[i] = offsets[j] + new_offset;
2097 if (state->buf_kern_start == NULL) {
2098 unsigned int offset = buf_start - (char *) base;
2100 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
2105 startoff = state->buf_user_offset - startoff;
2107 BUG_ON(*total < startoff);
2113 * repl->entries_size is the size of the ebt_entry blob in userspace.
2114 * It might need more memory when copied to a 64 bit kernel in case
2115 * userspace is 32-bit. So, first task: find out how much memory is needed.
2117 * Called before validation is performed.
2119 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2120 struct ebt_entries_buf_state *state)
2122 unsigned int size_remaining = size_user;
2125 ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2126 &size_remaining, state);
2130 WARN_ON(size_remaining);
2131 return state->buf_kern_offset;
2135 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2136 void __user *user, unsigned int len)
2138 struct compat_ebt_replace tmp;
2141 if (len < sizeof(tmp))
2144 if (copy_from_user(&tmp, user, sizeof(tmp)))
2147 if (len != sizeof(tmp) + tmp.entries_size)
2150 if (tmp.entries_size == 0)
2153 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2154 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2156 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2159 memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2161 /* starting with hook_entry, 32 vs. 64 bit structures are different */
2162 for (i = 0; i < NF_BR_NUMHOOKS; i++)
2163 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2165 repl->num_counters = tmp.num_counters;
2166 repl->counters = compat_ptr(tmp.counters);
2167 repl->entries = compat_ptr(tmp.entries);
2171 static int compat_do_replace(struct net *net, void __user *user,
2174 int ret, i, countersize, size64;
2175 struct ebt_table_info *newinfo;
2176 struct ebt_replace tmp;
2177 struct ebt_entries_buf_state state;
2180 ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2182 /* try real handler in case userland supplied needed padding */
2183 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2188 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2189 newinfo = vmalloc(sizeof(*newinfo) + countersize);
2194 memset(newinfo->counters, 0, countersize);
2196 memset(&state, 0, sizeof(state));
2198 newinfo->entries = vmalloc(tmp.entries_size);
2199 if (!newinfo->entries) {
2204 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2209 entries_tmp = newinfo->entries;
2211 xt_compat_lock(NFPROTO_BRIDGE);
2213 xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
2214 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2218 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2219 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2220 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2223 newinfo->entries = vmalloc(size64);
2224 if (!newinfo->entries) {
2230 memset(&state, 0, sizeof(state));
2231 state.buf_kern_start = newinfo->entries;
2232 state.buf_kern_len = size64;
2234 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2235 BUG_ON(ret < 0); /* parses same data again */
2238 tmp.entries_size = size64;
2240 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2241 char __user *usrptr;
2242 if (tmp.hook_entry[i]) {
2244 usrptr = (char __user *) tmp.hook_entry[i];
2245 delta = usrptr - tmp.entries;
2246 usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2247 tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2251 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2252 xt_compat_unlock(NFPROTO_BRIDGE);
2254 ret = do_replace_finish(net, &tmp, newinfo);
2258 vfree(newinfo->entries);
2263 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2264 xt_compat_unlock(NFPROTO_BRIDGE);
2268 static int compat_update_counters(struct net *net, void __user *user,
2271 struct compat_ebt_replace hlp;
2273 if (copy_from_user(&hlp, user, sizeof(hlp)))
2276 /* try real handler in case userland supplied needed padding */
2277 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2278 return update_counters(net, user, len);
2280 return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2281 hlp.num_counters, user, len);
2284 static int compat_do_ebt_set_ctl(struct sock *sk,
2285 int cmd, void __user *user, unsigned int len)
2289 if (!capable(CAP_NET_ADMIN))
2293 case EBT_SO_SET_ENTRIES:
2294 ret = compat_do_replace(sock_net(sk), user, len);
2296 case EBT_SO_SET_COUNTERS:
2297 ret = compat_update_counters(sock_net(sk), user, len);
2305 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2306 void __user *user, int *len)
2309 struct compat_ebt_replace tmp;
2310 struct ebt_table *t;
2312 if (!capable(CAP_NET_ADMIN))
2315 /* try real handler in case userland supplied needed padding */
2316 if ((cmd == EBT_SO_GET_INFO ||
2317 cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2318 return do_ebt_get_ctl(sk, cmd, user, len);
2320 if (copy_from_user(&tmp, user, sizeof(tmp)))
2323 t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
2327 xt_compat_lock(NFPROTO_BRIDGE);
2329 case EBT_SO_GET_INFO:
2330 tmp.nentries = t->private->nentries;
2331 ret = compat_table_info(t->private, &tmp);
2334 tmp.valid_hooks = t->valid_hooks;
2336 if (copy_to_user(user, &tmp, *len) != 0) {
2342 case EBT_SO_GET_INIT_INFO:
2343 tmp.nentries = t->table->nentries;
2344 tmp.entries_size = t->table->entries_size;
2345 tmp.valid_hooks = t->table->valid_hooks;
2347 if (copy_to_user(user, &tmp, *len) != 0) {
2353 case EBT_SO_GET_ENTRIES:
2354 case EBT_SO_GET_INIT_ENTRIES:
2356 * try real handler first in case of userland-side padding.
2357 * in case we are dealing with an 'ordinary' 32 bit binary
2358 * without 64bit compatibility padding, this will fail right
2359 * after copy_from_user when the *len argument is validated.
2361 * the compat_ variant needs to do one pass over the kernel
2362 * data set to adjust for size differences before it the check.
2364 if (copy_everything_to_user(t, user, len, cmd) == 0)
2367 ret = compat_copy_everything_to_user(t, user, len, cmd);
2373 xt_compat_flush_offsets(NFPROTO_BRIDGE);
2374 xt_compat_unlock(NFPROTO_BRIDGE);
2375 mutex_unlock(&ebt_mutex);
2380 static struct nf_sockopt_ops ebt_sockopts =
2383 .set_optmin = EBT_BASE_CTL,
2384 .set_optmax = EBT_SO_SET_MAX + 1,
2385 .set = do_ebt_set_ctl,
2386 #ifdef CONFIG_COMPAT
2387 .compat_set = compat_do_ebt_set_ctl,
2389 .get_optmin = EBT_BASE_CTL,
2390 .get_optmax = EBT_SO_GET_MAX + 1,
2391 .get = do_ebt_get_ctl,
2392 #ifdef CONFIG_COMPAT
2393 .compat_get = compat_do_ebt_get_ctl,
2395 .owner = THIS_MODULE,
2398 static int __init ebtables_init(void)
2402 ret = xt_register_target(&ebt_standard_target);
2405 ret = nf_register_sockopt(&ebt_sockopts);
2407 xt_unregister_target(&ebt_standard_target);
2411 printk(KERN_INFO "Ebtables v2.0 registered\n");
2415 static void __exit ebtables_fini(void)
2417 nf_unregister_sockopt(&ebt_sockopts);
2418 xt_unregister_target(&ebt_standard_target);
2419 printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2422 EXPORT_SYMBOL(ebt_register_table);
2423 EXPORT_SYMBOL(ebt_unregister_table);
2424 EXPORT_SYMBOL(ebt_do_table);
2425 module_init(ebtables_init);
2426 module_exit(ebtables_fini);
2427 MODULE_LICENSE("GPL");