1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * ebtables 4 * 5 * Author: 6 * Bart De Schuymer <bdschuym@pandora.be> 7 * 8 * ebtables.c,v 2.0, July, 2002 9 * 10 * This code is strongly inspired by the iptables code which is 11 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 12 */ 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 #include <linux/kmod.h> 15 #include <linux/module.h> 16 #include <linux/vmalloc.h> 17 #include <linux/netfilter/x_tables.h> 18 #include <linux/netfilter_bridge/ebtables.h> 19 #include <linux/spinlock.h> 20 #include <linux/mutex.h> 21 #include <linux/slab.h> 22 #include <linux/uaccess.h> 23 #include <linux/smp.h> 24 #include <linux/cpumask.h> 25 #include <linux/audit.h> 26 #include <net/sock.h> 27 /* needed for logical [in,out]-dev filtering */ 28 #include "../br_private.h" 29 30 /* Each cpu has its own set of counters, so there is no need for write_lock in 31 * the softirq 32 * For reading or updating the counters, the user context needs to 33 * get a write_lock 34 */ 35 36 /* The size of each set of counters is altered to get cache alignment */ 37 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) 38 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter))) 39 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \ 40 COUNTER_OFFSET(n) * cpu)) 41 42 43 44 static DEFINE_MUTEX(ebt_mutex); 45 46 #ifdef CONFIG_COMPAT 47 static void ebt_standard_compat_from_user(void *dst, const void *src) 48 { 49 int v = *(compat_int_t *)src; 50 51 if (v >= 0) 52 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v); 53 memcpy(dst, &v, sizeof(v)); 54 } 55 56 static int ebt_standard_compat_to_user(void __user *dst, const void *src) 57 { 58 compat_int_t cv = *(int *)src; 59 60 if (cv >= 0) 61 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv); 62 return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0; 63 } 64 #endif 65 66 67 static struct xt_target ebt_standard_target = { 68 .name = "standard", 69 .revision = 0, 70 .family = NFPROTO_BRIDGE, 71 .targetsize = sizeof(int), 72 #ifdef CONFIG_COMPAT 73 .compatsize = sizeof(compat_int_t), 74 .compat_from_user = ebt_standard_compat_from_user, 75 .compat_to_user = ebt_standard_compat_to_user, 76 #endif 77 }; 78 79 static inline int 80 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb, 81 struct xt_action_param *par) 82 { 83 par->target = w->u.watcher; 84 par->targinfo = w->data; 85 w->u.watcher->target(skb, par); 86 /* watchers don't give a verdict */ 87 return 0; 88 } 89 90 static inline int 91 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb, 92 struct xt_action_param *par) 93 { 94 par->match = m->u.match; 95 par->matchinfo = m->data; 96 return !m->u.match->match(skb, par); 97 } 98 99 static inline int 100 ebt_dev_check(const char *entry, const struct net_device *device) 101 { 102 int i = 0; 103 const char *devname; 104 105 if (*entry == '\0') 106 return 0; 107 if (!device) 108 return 1; 109 devname = device->name; 110 /* 1 is the wildcard token */ 111 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i]) 112 i++; 113 return devname[i] != entry[i] && entry[i] != 1; 114 } 115 116 /* process standard matches */ 117 static inline int 118 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb, 119 const struct net_device *in, const struct net_device *out) 120 { 121 const struct ethhdr *h = eth_hdr(skb); 122 const struct net_bridge_port *p; 123 __be16 ethproto; 124 125 if (skb_vlan_tag_present(skb)) 126 ethproto = htons(ETH_P_8021Q); 127 else 128 ethproto = h->h_proto; 129 130 if (e->bitmask & EBT_802_3) { 131 if (NF_INVF(e, EBT_IPROTO, eth_proto_is_802_3(ethproto))) 132 return 1; 133 } else if (!(e->bitmask & EBT_NOPROTO) && 134 NF_INVF(e, EBT_IPROTO, e->ethproto != ethproto)) 135 return 1; 136 137 if (NF_INVF(e, EBT_IIN, ebt_dev_check(e->in, in))) 138 return 1; 139 if (NF_INVF(e, EBT_IOUT, ebt_dev_check(e->out, out))) 140 return 1; 141 /* rcu_read_lock()ed by nf_hook_thresh */ 142 if (in && (p = br_port_get_rcu(in)) != NULL && 143 NF_INVF(e, EBT_ILOGICALIN, 144 ebt_dev_check(e->logical_in, p->br->dev))) 145 return 1; 146 if (out && (p = br_port_get_rcu(out)) != NULL && 147 NF_INVF(e, EBT_ILOGICALOUT, 148 ebt_dev_check(e->logical_out, p->br->dev))) 149 return 1; 150 151 if (e->bitmask & EBT_SOURCEMAC) { 152 if (NF_INVF(e, EBT_ISOURCE, 153 !ether_addr_equal_masked(h->h_source, e->sourcemac, 154 e->sourcemsk))) 155 return 1; 156 } 157 if (e->bitmask & EBT_DESTMAC) { 158 if (NF_INVF(e, EBT_IDEST, 159 !ether_addr_equal_masked(h->h_dest, e->destmac, 160 e->destmsk))) 161 return 1; 162 } 163 return 0; 164 } 165 166 static inline 167 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry) 168 { 169 return (void *)entry + entry->next_offset; 170 } 171 172 static inline const struct ebt_entry_target * 173 ebt_get_target_c(const struct ebt_entry *e) 174 { 175 return ebt_get_target((struct ebt_entry *)e); 176 } 177 178 /* Do some firewalling */ 179 unsigned int ebt_do_table(struct sk_buff *skb, 180 const struct nf_hook_state *state, 181 struct ebt_table *table) 182 { 183 unsigned int hook = state->hook; 184 int i, nentries; 185 struct ebt_entry *point; 186 struct ebt_counter *counter_base, *cb_base; 187 const struct ebt_entry_target *t; 188 int verdict, sp = 0; 189 struct ebt_chainstack *cs; 190 struct ebt_entries *chaininfo; 191 const char *base; 192 const struct ebt_table_info *private; 193 struct xt_action_param acpar; 194 195 acpar.state = state; 196 acpar.hotdrop = false; 197 198 read_lock_bh(&table->lock); 199 private = table->private; 200 cb_base = COUNTER_BASE(private->counters, private->nentries, 201 smp_processor_id()); 202 if (private->chainstack) 203 cs = private->chainstack[smp_processor_id()]; 204 else 205 cs = NULL; 206 chaininfo = private->hook_entry[hook]; 207 nentries = private->hook_entry[hook]->nentries; 208 point = (struct ebt_entry *)(private->hook_entry[hook]->data); 209 counter_base = cb_base + private->hook_entry[hook]->counter_offset; 210 /* base for chain jumps */ 211 base = private->entries; 212 i = 0; 213 while (i < nentries) { 214 if (ebt_basic_match(point, skb, state->in, state->out)) 215 goto letscontinue; 216 217 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0) 218 goto letscontinue; 219 if (acpar.hotdrop) { 220 read_unlock_bh(&table->lock); 221 return NF_DROP; 222 } 223 224 ADD_COUNTER(*(counter_base + i), 1, skb->len); 225 226 /* these should only watch: not modify, nor tell us 227 * what to do with the packet 228 */ 229 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar); 230 231 t = ebt_get_target_c(point); 232 /* standard target */ 233 if (!t->u.target->target) 234 verdict = ((struct ebt_standard_target *)t)->verdict; 235 else { 236 acpar.target = t->u.target; 237 acpar.targinfo = t->data; 238 verdict = t->u.target->target(skb, &acpar); 239 } 240 if (verdict == EBT_ACCEPT) { 241 read_unlock_bh(&table->lock); 242 return NF_ACCEPT; 243 } 244 if (verdict == EBT_DROP) { 245 read_unlock_bh(&table->lock); 246 return NF_DROP; 247 } 248 if (verdict == EBT_RETURN) { 249 letsreturn: 250 if (WARN(sp == 0, "RETURN on base chain")) { 251 /* act like this is EBT_CONTINUE */ 252 goto letscontinue; 253 } 254 255 sp--; 256 /* put all the local variables right */ 257 i = cs[sp].n; 258 chaininfo = cs[sp].chaininfo; 259 nentries = chaininfo->nentries; 260 point = cs[sp].e; 261 counter_base = cb_base + 262 chaininfo->counter_offset; 263 continue; 264 } 265 if (verdict == EBT_CONTINUE) 266 goto letscontinue; 267 268 if (WARN(verdict < 0, "bogus standard verdict\n")) { 269 read_unlock_bh(&table->lock); 270 return NF_DROP; 271 } 272 273 /* jump to a udc */ 274 cs[sp].n = i + 1; 275 cs[sp].chaininfo = chaininfo; 276 cs[sp].e = ebt_next_entry(point); 277 i = 0; 278 chaininfo = (struct ebt_entries *) (base + verdict); 279 280 if (WARN(chaininfo->distinguisher, "jump to non-chain\n")) { 281 read_unlock_bh(&table->lock); 282 return NF_DROP; 283 } 284 285 nentries = chaininfo->nentries; 286 point = (struct ebt_entry *)chaininfo->data; 287 counter_base = cb_base + chaininfo->counter_offset; 288 sp++; 289 continue; 290 letscontinue: 291 point = ebt_next_entry(point); 292 i++; 293 } 294 295 /* I actually like this :) */ 296 if (chaininfo->policy == EBT_RETURN) 297 goto letsreturn; 298 if (chaininfo->policy == EBT_ACCEPT) { 299 read_unlock_bh(&table->lock); 300 return NF_ACCEPT; 301 } 302 read_unlock_bh(&table->lock); 303 return NF_DROP; 304 } 305 306 /* If it succeeds, returns element and locks mutex */ 307 static inline void * 308 find_inlist_lock_noload(struct list_head *head, const char *name, int *error, 309 struct mutex *mutex) 310 { 311 struct { 312 struct list_head list; 313 char name[EBT_FUNCTION_MAXNAMELEN]; 314 } *e; 315 316 mutex_lock(mutex); 317 list_for_each_entry(e, head, list) { 318 if (strcmp(e->name, name) == 0) 319 return e; 320 } 321 *error = -ENOENT; 322 mutex_unlock(mutex); 323 return NULL; 324 } 325 326 static void * 327 find_inlist_lock(struct list_head *head, const char *name, const char *prefix, 328 int *error, struct mutex *mutex) 329 { 330 return try_then_request_module( 331 find_inlist_lock_noload(head, name, error, mutex), 332 "%s%s", prefix, name); 333 } 334 335 static inline struct ebt_table * 336 find_table_lock(struct net *net, const char *name, int *error, 337 struct mutex *mutex) 338 { 339 return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name, 340 "ebtable_", error, mutex); 341 } 342 343 static inline void ebt_free_table_info(struct ebt_table_info *info) 344 { 345 int i; 346 347 if (info->chainstack) { 348 for_each_possible_cpu(i) 349 vfree(info->chainstack[i]); 350 vfree(info->chainstack); 351 } 352 } 353 static inline int 354 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par, 355 unsigned int *cnt) 356 { 357 const struct ebt_entry *e = par->entryinfo; 358 struct xt_match *match; 359 size_t left = ((char *)e + e->watchers_offset) - (char *)m; 360 int ret; 361 362 if (left < sizeof(struct ebt_entry_match) || 363 left - sizeof(struct ebt_entry_match) < m->match_size) 364 return -EINVAL; 365 366 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision); 367 if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) { 368 if (!IS_ERR(match)) 369 module_put(match->me); 370 request_module("ebt_%s", m->u.name); 371 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision); 372 } 373 if (IS_ERR(match)) 374 return PTR_ERR(match); 375 m->u.match = match; 376 377 par->match = match; 378 par->matchinfo = m->data; 379 ret = xt_check_match(par, m->match_size, 380 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 381 if (ret < 0) { 382 module_put(match->me); 383 return ret; 384 } 385 386 (*cnt)++; 387 return 0; 388 } 389 390 static inline int 391 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par, 392 unsigned int *cnt) 393 { 394 const struct ebt_entry *e = par->entryinfo; 395 struct xt_target *watcher; 396 size_t left = ((char *)e + e->target_offset) - (char *)w; 397 int ret; 398 399 if (left < sizeof(struct ebt_entry_watcher) || 400 left - sizeof(struct ebt_entry_watcher) < w->watcher_size) 401 return -EINVAL; 402 403 watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0); 404 if (IS_ERR(watcher)) 405 return PTR_ERR(watcher); 406 407 if (watcher->family != NFPROTO_BRIDGE) { 408 module_put(watcher->me); 409 return -ENOENT; 410 } 411 412 w->u.watcher = watcher; 413 414 par->target = watcher; 415 par->targinfo = w->data; 416 ret = xt_check_target(par, w->watcher_size, 417 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 418 if (ret < 0) { 419 module_put(watcher->me); 420 return ret; 421 } 422 423 (*cnt)++; 424 return 0; 425 } 426 427 static int ebt_verify_pointers(const struct ebt_replace *repl, 428 struct ebt_table_info *newinfo) 429 { 430 unsigned int limit = repl->entries_size; 431 unsigned int valid_hooks = repl->valid_hooks; 432 unsigned int offset = 0; 433 int i; 434 435 for (i = 0; i < NF_BR_NUMHOOKS; i++) 436 newinfo->hook_entry[i] = NULL; 437 438 newinfo->entries_size = repl->entries_size; 439 newinfo->nentries = repl->nentries; 440 441 while (offset < limit) { 442 size_t left = limit - offset; 443 struct ebt_entry *e = (void *)newinfo->entries + offset; 444 445 if (left < sizeof(unsigned int)) 446 break; 447 448 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 449 if ((valid_hooks & (1 << i)) == 0) 450 continue; 451 if ((char __user *)repl->hook_entry[i] == 452 repl->entries + offset) 453 break; 454 } 455 456 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) { 457 if (e->bitmask != 0) { 458 /* we make userspace set this right, 459 * so there is no misunderstanding 460 */ 461 return -EINVAL; 462 } 463 if (i != NF_BR_NUMHOOKS) 464 newinfo->hook_entry[i] = (struct ebt_entries *)e; 465 if (left < sizeof(struct ebt_entries)) 466 break; 467 offset += sizeof(struct ebt_entries); 468 } else { 469 if (left < sizeof(struct ebt_entry)) 470 break; 471 if (left < e->next_offset) 472 break; 473 if (e->next_offset < sizeof(struct ebt_entry)) 474 return -EINVAL; 475 offset += e->next_offset; 476 } 477 } 478 if (offset != limit) 479 return -EINVAL; 480 481 /* check if all valid hooks have a chain */ 482 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 483 if (!newinfo->hook_entry[i] && 484 (valid_hooks & (1 << i))) 485 return -EINVAL; 486 } 487 return 0; 488 } 489 490 /* this one is very careful, as it is the first function 491 * to parse the userspace data 492 */ 493 static inline int 494 ebt_check_entry_size_and_hooks(const struct ebt_entry *e, 495 const struct ebt_table_info *newinfo, 496 unsigned int *n, unsigned int *cnt, 497 unsigned int *totalcnt, unsigned int *udc_cnt) 498 { 499 int i; 500 501 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 502 if ((void *)e == (void *)newinfo->hook_entry[i]) 503 break; 504 } 505 /* beginning of a new chain 506 * if i == NF_BR_NUMHOOKS it must be a user defined chain 507 */ 508 if (i != NF_BR_NUMHOOKS || !e->bitmask) { 509 /* this checks if the previous chain has as many entries 510 * as it said it has 511 */ 512 if (*n != *cnt) 513 return -EINVAL; 514 515 if (((struct ebt_entries *)e)->policy != EBT_DROP && 516 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) { 517 /* only RETURN from udc */ 518 if (i != NF_BR_NUMHOOKS || 519 ((struct ebt_entries *)e)->policy != EBT_RETURN) 520 return -EINVAL; 521 } 522 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */ 523 (*udc_cnt)++; 524 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) 525 return -EINVAL; 526 *n = ((struct ebt_entries *)e)->nentries; 527 *cnt = 0; 528 return 0; 529 } 530 /* a plain old entry, heh */ 531 if (sizeof(struct ebt_entry) > e->watchers_offset || 532 e->watchers_offset > e->target_offset || 533 e->target_offset >= e->next_offset) 534 return -EINVAL; 535 536 /* this is not checked anywhere else */ 537 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) 538 return -EINVAL; 539 540 (*cnt)++; 541 (*totalcnt)++; 542 return 0; 543 } 544 545 struct ebt_cl_stack { 546 struct ebt_chainstack cs; 547 int from; 548 unsigned int hookmask; 549 }; 550 551 /* We need these positions to check that the jumps to a different part of the 552 * entries is a jump to the beginning of a new chain. 553 */ 554 static inline int 555 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo, 556 unsigned int *n, struct ebt_cl_stack *udc) 557 { 558 int i; 559 560 /* we're only interested in chain starts */ 561 if (e->bitmask) 562 return 0; 563 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 564 if (newinfo->hook_entry[i] == (struct ebt_entries *)e) 565 break; 566 } 567 /* only care about udc */ 568 if (i != NF_BR_NUMHOOKS) 569 return 0; 570 571 udc[*n].cs.chaininfo = (struct ebt_entries *)e; 572 /* these initialisations are depended on later in check_chainloops() */ 573 udc[*n].cs.n = 0; 574 udc[*n].hookmask = 0; 575 576 (*n)++; 577 return 0; 578 } 579 580 static inline int 581 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i) 582 { 583 struct xt_mtdtor_param par; 584 585 if (i && (*i)-- == 0) 586 return 1; 587 588 par.net = net; 589 par.match = m->u.match; 590 par.matchinfo = m->data; 591 par.family = NFPROTO_BRIDGE; 592 if (par.match->destroy != NULL) 593 par.match->destroy(&par); 594 module_put(par.match->me); 595 return 0; 596 } 597 598 static inline int 599 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i) 600 { 601 struct xt_tgdtor_param par; 602 603 if (i && (*i)-- == 0) 604 return 1; 605 606 par.net = net; 607 par.target = w->u.watcher; 608 par.targinfo = w->data; 609 par.family = NFPROTO_BRIDGE; 610 if (par.target->destroy != NULL) 611 par.target->destroy(&par); 612 module_put(par.target->me); 613 return 0; 614 } 615 616 static inline int 617 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt) 618 { 619 struct xt_tgdtor_param par; 620 struct ebt_entry_target *t; 621 622 if (e->bitmask == 0) 623 return 0; 624 /* we're done */ 625 if (cnt && (*cnt)-- == 0) 626 return 1; 627 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL); 628 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL); 629 t = ebt_get_target(e); 630 631 par.net = net; 632 par.target = t->u.target; 633 par.targinfo = t->data; 634 par.family = NFPROTO_BRIDGE; 635 if (par.target->destroy != NULL) 636 par.target->destroy(&par); 637 module_put(par.target->me); 638 return 0; 639 } 640 641 static inline int 642 ebt_check_entry(struct ebt_entry *e, struct net *net, 643 const struct ebt_table_info *newinfo, 644 const char *name, unsigned int *cnt, 645 struct ebt_cl_stack *cl_s, unsigned int udc_cnt) 646 { 647 struct ebt_entry_target *t; 648 struct xt_target *target; 649 unsigned int i, j, hook = 0, hookmask = 0; 650 size_t gap; 651 int ret; 652 struct xt_mtchk_param mtpar; 653 struct xt_tgchk_param tgpar; 654 655 /* don't mess with the struct ebt_entries */ 656 if (e->bitmask == 0) 657 return 0; 658 659 if (e->bitmask & ~EBT_F_MASK) 660 return -EINVAL; 661 662 if (e->invflags & ~EBT_INV_MASK) 663 return -EINVAL; 664 665 if ((e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3)) 666 return -EINVAL; 667 668 /* what hook do we belong to? */ 669 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 670 if (!newinfo->hook_entry[i]) 671 continue; 672 if ((char *)newinfo->hook_entry[i] < (char *)e) 673 hook = i; 674 else 675 break; 676 } 677 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on 678 * a base chain 679 */ 680 if (i < NF_BR_NUMHOOKS) 681 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 682 else { 683 for (i = 0; i < udc_cnt; i++) 684 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e) 685 break; 686 if (i == 0) 687 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 688 else 689 hookmask = cl_s[i - 1].hookmask; 690 } 691 i = 0; 692 693 memset(&mtpar, 0, sizeof(mtpar)); 694 memset(&tgpar, 0, sizeof(tgpar)); 695 mtpar.net = tgpar.net = net; 696 mtpar.table = tgpar.table = name; 697 mtpar.entryinfo = tgpar.entryinfo = e; 698 mtpar.hook_mask = tgpar.hook_mask = hookmask; 699 mtpar.family = tgpar.family = NFPROTO_BRIDGE; 700 ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i); 701 if (ret != 0) 702 goto cleanup_matches; 703 j = 0; 704 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j); 705 if (ret != 0) 706 goto cleanup_watchers; 707 t = ebt_get_target(e); 708 gap = e->next_offset - e->target_offset; 709 710 target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0); 711 if (IS_ERR(target)) { 712 ret = PTR_ERR(target); 713 goto cleanup_watchers; 714 } 715 716 /* Reject UNSPEC, xtables verdicts/return values are incompatible */ 717 if (target->family != NFPROTO_BRIDGE) { 718 module_put(target->me); 719 ret = -ENOENT; 720 goto cleanup_watchers; 721 } 722 723 t->u.target = target; 724 if (t->u.target == &ebt_standard_target) { 725 if (gap < sizeof(struct ebt_standard_target)) { 726 ret = -EFAULT; 727 goto cleanup_watchers; 728 } 729 if (((struct ebt_standard_target *)t)->verdict < 730 -NUM_STANDARD_TARGETS) { 731 ret = -EFAULT; 732 goto cleanup_watchers; 733 } 734 } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) { 735 module_put(t->u.target->me); 736 ret = -EFAULT; 737 goto cleanup_watchers; 738 } 739 740 tgpar.target = target; 741 tgpar.targinfo = t->data; 742 ret = xt_check_target(&tgpar, t->target_size, 743 ntohs(e->ethproto), e->invflags & EBT_IPROTO); 744 if (ret < 0) { 745 module_put(target->me); 746 goto cleanup_watchers; 747 } 748 (*cnt)++; 749 return 0; 750 cleanup_watchers: 751 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j); 752 cleanup_matches: 753 EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i); 754 return ret; 755 } 756 757 /* checks for loops and sets the hook mask for udc 758 * the hook mask for udc tells us from which base chains the udc can be 759 * accessed. This mask is a parameter to the check() functions of the extensions 760 */ 761 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s, 762 unsigned int udc_cnt, unsigned int hooknr, char *base) 763 { 764 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict; 765 const struct ebt_entry *e = (struct ebt_entry *)chain->data; 766 const struct ebt_entry_target *t; 767 768 while (pos < nentries || chain_nr != -1) { 769 /* end of udc, go back one 'recursion' step */ 770 if (pos == nentries) { 771 /* put back values of the time when this chain was called */ 772 e = cl_s[chain_nr].cs.e; 773 if (cl_s[chain_nr].from != -1) 774 nentries = 775 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries; 776 else 777 nentries = chain->nentries; 778 pos = cl_s[chain_nr].cs.n; 779 /* make sure we won't see a loop that isn't one */ 780 cl_s[chain_nr].cs.n = 0; 781 chain_nr = cl_s[chain_nr].from; 782 if (pos == nentries) 783 continue; 784 } 785 t = ebt_get_target_c(e); 786 if (strcmp(t->u.name, EBT_STANDARD_TARGET)) 787 goto letscontinue; 788 if (e->target_offset + sizeof(struct ebt_standard_target) > 789 e->next_offset) 790 return -1; 791 792 verdict = ((struct ebt_standard_target *)t)->verdict; 793 if (verdict >= 0) { /* jump to another chain */ 794 struct ebt_entries *hlp2 = 795 (struct ebt_entries *)(base + verdict); 796 for (i = 0; i < udc_cnt; i++) 797 if (hlp2 == cl_s[i].cs.chaininfo) 798 break; 799 /* bad destination or loop */ 800 if (i == udc_cnt) 801 return -1; 802 803 if (cl_s[i].cs.n) 804 return -1; 805 806 if (cl_s[i].hookmask & (1 << hooknr)) 807 goto letscontinue; 808 /* this can't be 0, so the loop test is correct */ 809 cl_s[i].cs.n = pos + 1; 810 pos = 0; 811 cl_s[i].cs.e = ebt_next_entry(e); 812 e = (struct ebt_entry *)(hlp2->data); 813 nentries = hlp2->nentries; 814 cl_s[i].from = chain_nr; 815 chain_nr = i; 816 /* this udc is accessible from the base chain for hooknr */ 817 cl_s[i].hookmask |= (1 << hooknr); 818 continue; 819 } 820 letscontinue: 821 e = ebt_next_entry(e); 822 pos++; 823 } 824 return 0; 825 } 826 827 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */ 828 static int translate_table(struct net *net, const char *name, 829 struct ebt_table_info *newinfo) 830 { 831 unsigned int i, j, k, udc_cnt; 832 int ret; 833 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */ 834 835 i = 0; 836 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i]) 837 i++; 838 if (i == NF_BR_NUMHOOKS) 839 return -EINVAL; 840 841 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) 842 return -EINVAL; 843 844 /* make sure chains are ordered after each other in same order 845 * as their corresponding hooks 846 */ 847 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) { 848 if (!newinfo->hook_entry[j]) 849 continue; 850 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) 851 return -EINVAL; 852 853 i = j; 854 } 855 856 /* do some early checkings and initialize some things */ 857 i = 0; /* holds the expected nr. of entries for the chain */ 858 j = 0; /* holds the up to now counted entries for the chain */ 859 k = 0; /* holds the total nr. of entries, should equal 860 * newinfo->nentries afterwards 861 */ 862 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */ 863 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 864 ebt_check_entry_size_and_hooks, newinfo, 865 &i, &j, &k, &udc_cnt); 866 867 if (ret != 0) 868 return ret; 869 870 if (i != j) 871 return -EINVAL; 872 873 if (k != newinfo->nentries) 874 return -EINVAL; 875 876 /* get the location of the udc, put them in an array 877 * while we're at it, allocate the chainstack 878 */ 879 if (udc_cnt) { 880 /* this will get free'd in do_replace()/ebt_register_table() 881 * if an error occurs 882 */ 883 newinfo->chainstack = 884 vmalloc(array_size(nr_cpu_ids, 885 sizeof(*(newinfo->chainstack)))); 886 if (!newinfo->chainstack) 887 return -ENOMEM; 888 for_each_possible_cpu(i) { 889 newinfo->chainstack[i] = 890 vmalloc(array_size(udc_cnt, sizeof(*(newinfo->chainstack[0])))); 891 if (!newinfo->chainstack[i]) { 892 while (i) 893 vfree(newinfo->chainstack[--i]); 894 vfree(newinfo->chainstack); 895 newinfo->chainstack = NULL; 896 return -ENOMEM; 897 } 898 } 899 900 cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s))); 901 if (!cl_s) 902 return -ENOMEM; 903 i = 0; /* the i'th udc */ 904 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 905 ebt_get_udc_positions, newinfo, &i, cl_s); 906 /* sanity check */ 907 if (i != udc_cnt) { 908 vfree(cl_s); 909 return -EFAULT; 910 } 911 } 912 913 /* Check for loops */ 914 for (i = 0; i < NF_BR_NUMHOOKS; i++) 915 if (newinfo->hook_entry[i]) 916 if (check_chainloops(newinfo->hook_entry[i], 917 cl_s, udc_cnt, i, newinfo->entries)) { 918 vfree(cl_s); 919 return -EINVAL; 920 } 921 922 /* we now know the following (along with E=mc²): 923 * - the nr of entries in each chain is right 924 * - the size of the allocated space is right 925 * - all valid hooks have a corresponding chain 926 * - there are no loops 927 * - wrong data can still be on the level of a single entry 928 * - could be there are jumps to places that are not the 929 * beginning of a chain. This can only occur in chains that 930 * are not accessible from any base chains, so we don't care. 931 */ 932 933 /* used to know what we need to clean up if something goes wrong */ 934 i = 0; 935 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 936 ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt); 937 if (ret != 0) { 938 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 939 ebt_cleanup_entry, net, &i); 940 } 941 vfree(cl_s); 942 return ret; 943 } 944 945 /* called under write_lock */ 946 static void get_counters(const struct ebt_counter *oldcounters, 947 struct ebt_counter *counters, unsigned int nentries) 948 { 949 int i, cpu; 950 struct ebt_counter *counter_base; 951 952 /* counters of cpu 0 */ 953 memcpy(counters, oldcounters, 954 sizeof(struct ebt_counter) * nentries); 955 956 /* add other counters to those of cpu 0 */ 957 for_each_possible_cpu(cpu) { 958 if (cpu == 0) 959 continue; 960 counter_base = COUNTER_BASE(oldcounters, nentries, cpu); 961 for (i = 0; i < nentries; i++) 962 ADD_COUNTER(counters[i], counter_base[i].pcnt, 963 counter_base[i].bcnt); 964 } 965 } 966 967 static int do_replace_finish(struct net *net, struct ebt_replace *repl, 968 struct ebt_table_info *newinfo) 969 { 970 int ret; 971 struct ebt_counter *counterstmp = NULL; 972 /* used to be able to unlock earlier */ 973 struct ebt_table_info *table; 974 struct ebt_table *t; 975 976 /* the user wants counters back 977 * the check on the size is done later, when we have the lock 978 */ 979 if (repl->num_counters) { 980 unsigned long size = repl->num_counters * sizeof(*counterstmp); 981 counterstmp = vmalloc(size); 982 if (!counterstmp) 983 return -ENOMEM; 984 } 985 986 newinfo->chainstack = NULL; 987 ret = ebt_verify_pointers(repl, newinfo); 988 if (ret != 0) 989 goto free_counterstmp; 990 991 ret = translate_table(net, repl->name, newinfo); 992 993 if (ret != 0) 994 goto free_counterstmp; 995 996 t = find_table_lock(net, repl->name, &ret, &ebt_mutex); 997 if (!t) { 998 ret = -ENOENT; 999 goto free_iterate; 1000 } 1001 1002 /* the table doesn't like it */ 1003 if (t->check && (ret = t->check(newinfo, repl->valid_hooks))) 1004 goto free_unlock; 1005 1006 if (repl->num_counters && repl->num_counters != t->private->nentries) { 1007 ret = -EINVAL; 1008 goto free_unlock; 1009 } 1010 1011 /* we have the mutex lock, so no danger in reading this pointer */ 1012 table = t->private; 1013 /* make sure the table can only be rmmod'ed if it contains no rules */ 1014 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) { 1015 ret = -ENOENT; 1016 goto free_unlock; 1017 } else if (table->nentries && !newinfo->nentries) 1018 module_put(t->me); 1019 /* we need an atomic snapshot of the counters */ 1020 write_lock_bh(&t->lock); 1021 if (repl->num_counters) 1022 get_counters(t->private->counters, counterstmp, 1023 t->private->nentries); 1024 1025 t->private = newinfo; 1026 write_unlock_bh(&t->lock); 1027 mutex_unlock(&ebt_mutex); 1028 /* so, a user can change the chains while having messed up her counter 1029 * allocation. Only reason why this is done is because this way the lock 1030 * is held only once, while this doesn't bring the kernel into a 1031 * dangerous state. 1032 */ 1033 if (repl->num_counters && 1034 copy_to_user(repl->counters, counterstmp, 1035 repl->num_counters * sizeof(struct ebt_counter))) { 1036 /* Silent error, can't fail, new table is already in place */ 1037 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n"); 1038 } 1039 1040 /* decrease module count and free resources */ 1041 EBT_ENTRY_ITERATE(table->entries, table->entries_size, 1042 ebt_cleanup_entry, net, NULL); 1043 1044 vfree(table->entries); 1045 ebt_free_table_info(table); 1046 vfree(table); 1047 vfree(counterstmp); 1048 1049 #ifdef CONFIG_AUDIT 1050 if (audit_enabled) { 1051 audit_log(audit_context(), GFP_KERNEL, 1052 AUDIT_NETFILTER_CFG, 1053 "table=%s family=%u entries=%u", 1054 repl->name, AF_BRIDGE, repl->nentries); 1055 } 1056 #endif 1057 return ret; 1058 1059 free_unlock: 1060 mutex_unlock(&ebt_mutex); 1061 free_iterate: 1062 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 1063 ebt_cleanup_entry, net, NULL); 1064 free_counterstmp: 1065 vfree(counterstmp); 1066 /* can be initialized in translate_table() */ 1067 ebt_free_table_info(newinfo); 1068 return ret; 1069 } 1070 1071 /* replace the table */ 1072 static int do_replace(struct net *net, const void __user *user, 1073 unsigned int len) 1074 { 1075 int ret, countersize; 1076 struct ebt_table_info *newinfo; 1077 struct ebt_replace tmp; 1078 1079 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0) 1080 return -EFAULT; 1081 1082 if (len != sizeof(tmp) + tmp.entries_size) 1083 return -EINVAL; 1084 1085 if (tmp.entries_size == 0) 1086 return -EINVAL; 1087 1088 /* overflow check */ 1089 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / 1090 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) 1091 return -ENOMEM; 1092 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 1093 return -ENOMEM; 1094 1095 tmp.name[sizeof(tmp.name) - 1] = 0; 1096 1097 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 1098 newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT, 1099 PAGE_KERNEL); 1100 if (!newinfo) 1101 return -ENOMEM; 1102 1103 if (countersize) 1104 memset(newinfo->counters, 0, countersize); 1105 1106 newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT, 1107 PAGE_KERNEL); 1108 if (!newinfo->entries) { 1109 ret = -ENOMEM; 1110 goto free_newinfo; 1111 } 1112 if (copy_from_user( 1113 newinfo->entries, tmp.entries, tmp.entries_size) != 0) { 1114 ret = -EFAULT; 1115 goto free_entries; 1116 } 1117 1118 ret = do_replace_finish(net, &tmp, newinfo); 1119 if (ret == 0) 1120 return ret; 1121 free_entries: 1122 vfree(newinfo->entries); 1123 free_newinfo: 1124 vfree(newinfo); 1125 return ret; 1126 } 1127 1128 static void __ebt_unregister_table(struct net *net, struct ebt_table *table) 1129 { 1130 mutex_lock(&ebt_mutex); 1131 list_del(&table->list); 1132 mutex_unlock(&ebt_mutex); 1133 EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size, 1134 ebt_cleanup_entry, net, NULL); 1135 if (table->private->nentries) 1136 module_put(table->me); 1137 vfree(table->private->entries); 1138 ebt_free_table_info(table->private); 1139 vfree(table->private); 1140 kfree(table); 1141 } 1142 1143 int ebt_register_table(struct net *net, const struct ebt_table *input_table, 1144 const struct nf_hook_ops *ops, struct ebt_table **res) 1145 { 1146 struct ebt_table_info *newinfo; 1147 struct ebt_table *t, *table; 1148 struct ebt_replace_kernel *repl; 1149 int ret, i, countersize; 1150 void *p; 1151 1152 if (input_table == NULL || (repl = input_table->table) == NULL || 1153 repl->entries == NULL || repl->entries_size == 0 || 1154 repl->counters != NULL || input_table->private != NULL) 1155 return -EINVAL; 1156 1157 /* Don't add one table to multiple lists. */ 1158 table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL); 1159 if (!table) { 1160 ret = -ENOMEM; 1161 goto out; 1162 } 1163 1164 countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids; 1165 newinfo = vmalloc(sizeof(*newinfo) + countersize); 1166 ret = -ENOMEM; 1167 if (!newinfo) 1168 goto free_table; 1169 1170 p = vmalloc(repl->entries_size); 1171 if (!p) 1172 goto free_newinfo; 1173 1174 memcpy(p, repl->entries, repl->entries_size); 1175 newinfo->entries = p; 1176 1177 newinfo->entries_size = repl->entries_size; 1178 newinfo->nentries = repl->nentries; 1179 1180 if (countersize) 1181 memset(newinfo->counters, 0, countersize); 1182 1183 /* fill in newinfo and parse the entries */ 1184 newinfo->chainstack = NULL; 1185 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 1186 if ((repl->valid_hooks & (1 << i)) == 0) 1187 newinfo->hook_entry[i] = NULL; 1188 else 1189 newinfo->hook_entry[i] = p + 1190 ((char *)repl->hook_entry[i] - repl->entries); 1191 } 1192 ret = translate_table(net, repl->name, newinfo); 1193 if (ret != 0) 1194 goto free_chainstack; 1195 1196 if (table->check && table->check(newinfo, table->valid_hooks)) { 1197 ret = -EINVAL; 1198 goto free_chainstack; 1199 } 1200 1201 table->private = newinfo; 1202 rwlock_init(&table->lock); 1203 mutex_lock(&ebt_mutex); 1204 list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) { 1205 if (strcmp(t->name, table->name) == 0) { 1206 ret = -EEXIST; 1207 goto free_unlock; 1208 } 1209 } 1210 1211 /* Hold a reference count if the chains aren't empty */ 1212 if (newinfo->nentries && !try_module_get(table->me)) { 1213 ret = -ENOENT; 1214 goto free_unlock; 1215 } 1216 list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]); 1217 mutex_unlock(&ebt_mutex); 1218 1219 WRITE_ONCE(*res, table); 1220 ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks)); 1221 if (ret) { 1222 __ebt_unregister_table(net, table); 1223 *res = NULL; 1224 } 1225 1226 return ret; 1227 free_unlock: 1228 mutex_unlock(&ebt_mutex); 1229 free_chainstack: 1230 ebt_free_table_info(newinfo); 1231 vfree(newinfo->entries); 1232 free_newinfo: 1233 vfree(newinfo); 1234 free_table: 1235 kfree(table); 1236 out: 1237 return ret; 1238 } 1239 1240 void ebt_unregister_table(struct net *net, struct ebt_table *table, 1241 const struct nf_hook_ops *ops) 1242 { 1243 nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks)); 1244 __ebt_unregister_table(net, table); 1245 } 1246 1247 /* userspace just supplied us with counters */ 1248 static int do_update_counters(struct net *net, const char *name, 1249 struct ebt_counter __user *counters, 1250 unsigned int num_counters, 1251 const void __user *user, unsigned int len) 1252 { 1253 int i, ret; 1254 struct ebt_counter *tmp; 1255 struct ebt_table *t; 1256 1257 if (num_counters == 0) 1258 return -EINVAL; 1259 1260 tmp = vmalloc(array_size(num_counters, sizeof(*tmp))); 1261 if (!tmp) 1262 return -ENOMEM; 1263 1264 t = find_table_lock(net, name, &ret, &ebt_mutex); 1265 if (!t) 1266 goto free_tmp; 1267 1268 if (num_counters != t->private->nentries) { 1269 ret = -EINVAL; 1270 goto unlock_mutex; 1271 } 1272 1273 if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) { 1274 ret = -EFAULT; 1275 goto unlock_mutex; 1276 } 1277 1278 /* we want an atomic add of the counters */ 1279 write_lock_bh(&t->lock); 1280 1281 /* we add to the counters of the first cpu */ 1282 for (i = 0; i < num_counters; i++) 1283 ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt); 1284 1285 write_unlock_bh(&t->lock); 1286 ret = 0; 1287 unlock_mutex: 1288 mutex_unlock(&ebt_mutex); 1289 free_tmp: 1290 vfree(tmp); 1291 return ret; 1292 } 1293 1294 static int update_counters(struct net *net, const void __user *user, 1295 unsigned int len) 1296 { 1297 struct ebt_replace hlp; 1298 1299 if (copy_from_user(&hlp, user, sizeof(hlp))) 1300 return -EFAULT; 1301 1302 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) 1303 return -EINVAL; 1304 1305 return do_update_counters(net, hlp.name, hlp.counters, 1306 hlp.num_counters, user, len); 1307 } 1308 1309 static inline int ebt_obj_to_user(char __user *um, const char *_name, 1310 const char *data, int entrysize, 1311 int usersize, int datasize, u8 revision) 1312 { 1313 char name[EBT_EXTENSION_MAXNAMELEN] = {0}; 1314 1315 /* ebtables expects 31 bytes long names but xt_match names are 29 bytes 1316 * long. Copy 29 bytes and fill remaining bytes with zeroes. 1317 */ 1318 strlcpy(name, _name, sizeof(name)); 1319 if (copy_to_user(um, name, EBT_EXTENSION_MAXNAMELEN) || 1320 put_user(revision, (u8 __user *)(um + EBT_EXTENSION_MAXNAMELEN)) || 1321 put_user(datasize, (int __user *)(um + EBT_EXTENSION_MAXNAMELEN + 1)) || 1322 xt_data_to_user(um + entrysize, data, usersize, datasize, 1323 XT_ALIGN(datasize))) 1324 return -EFAULT; 1325 1326 return 0; 1327 } 1328 1329 static inline int ebt_match_to_user(const struct ebt_entry_match *m, 1330 const char *base, char __user *ubase) 1331 { 1332 return ebt_obj_to_user(ubase + ((char *)m - base), 1333 m->u.match->name, m->data, sizeof(*m), 1334 m->u.match->usersize, m->match_size, 1335 m->u.match->revision); 1336 } 1337 1338 static inline int ebt_watcher_to_user(const struct ebt_entry_watcher *w, 1339 const char *base, char __user *ubase) 1340 { 1341 return ebt_obj_to_user(ubase + ((char *)w - base), 1342 w->u.watcher->name, w->data, sizeof(*w), 1343 w->u.watcher->usersize, w->watcher_size, 1344 w->u.watcher->revision); 1345 } 1346 1347 static inline int ebt_entry_to_user(struct ebt_entry *e, const char *base, 1348 char __user *ubase) 1349 { 1350 int ret; 1351 char __user *hlp; 1352 const struct ebt_entry_target *t; 1353 1354 if (e->bitmask == 0) { 1355 /* special case !EBT_ENTRY_OR_ENTRIES */ 1356 if (copy_to_user(ubase + ((char *)e - base), e, 1357 sizeof(struct ebt_entries))) 1358 return -EFAULT; 1359 return 0; 1360 } 1361 1362 if (copy_to_user(ubase + ((char *)e - base), e, sizeof(*e))) 1363 return -EFAULT; 1364 1365 hlp = ubase + (((char *)e + e->target_offset) - base); 1366 t = ebt_get_target_c(e); 1367 1368 ret = EBT_MATCH_ITERATE(e, ebt_match_to_user, base, ubase); 1369 if (ret != 0) 1370 return ret; 1371 ret = EBT_WATCHER_ITERATE(e, ebt_watcher_to_user, base, ubase); 1372 if (ret != 0) 1373 return ret; 1374 ret = ebt_obj_to_user(hlp, t->u.target->name, t->data, sizeof(*t), 1375 t->u.target->usersize, t->target_size, 1376 t->u.target->revision); 1377 if (ret != 0) 1378 return ret; 1379 1380 return 0; 1381 } 1382 1383 static int copy_counters_to_user(struct ebt_table *t, 1384 const struct ebt_counter *oldcounters, 1385 void __user *user, unsigned int num_counters, 1386 unsigned int nentries) 1387 { 1388 struct ebt_counter *counterstmp; 1389 int ret = 0; 1390 1391 /* userspace might not need the counters */ 1392 if (num_counters == 0) 1393 return 0; 1394 1395 if (num_counters != nentries) 1396 return -EINVAL; 1397 1398 counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp))); 1399 if (!counterstmp) 1400 return -ENOMEM; 1401 1402 write_lock_bh(&t->lock); 1403 get_counters(oldcounters, counterstmp, nentries); 1404 write_unlock_bh(&t->lock); 1405 1406 if (copy_to_user(user, counterstmp, 1407 nentries * sizeof(struct ebt_counter))) 1408 ret = -EFAULT; 1409 vfree(counterstmp); 1410 return ret; 1411 } 1412 1413 /* called with ebt_mutex locked */ 1414 static int copy_everything_to_user(struct ebt_table *t, void __user *user, 1415 const int *len, int cmd) 1416 { 1417 struct ebt_replace tmp; 1418 const struct ebt_counter *oldcounters; 1419 unsigned int entries_size, nentries; 1420 int ret; 1421 char *entries; 1422 1423 if (cmd == EBT_SO_GET_ENTRIES) { 1424 entries_size = t->private->entries_size; 1425 nentries = t->private->nentries; 1426 entries = t->private->entries; 1427 oldcounters = t->private->counters; 1428 } else { 1429 entries_size = t->table->entries_size; 1430 nentries = t->table->nentries; 1431 entries = t->table->entries; 1432 oldcounters = t->table->counters; 1433 } 1434 1435 if (copy_from_user(&tmp, user, sizeof(tmp))) 1436 return -EFAULT; 1437 1438 if (*len != sizeof(struct ebt_replace) + entries_size + 1439 (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0)) 1440 return -EINVAL; 1441 1442 if (tmp.nentries != nentries) 1443 return -EINVAL; 1444 1445 if (tmp.entries_size != entries_size) 1446 return -EINVAL; 1447 1448 ret = copy_counters_to_user(t, oldcounters, tmp.counters, 1449 tmp.num_counters, nentries); 1450 if (ret) 1451 return ret; 1452 1453 /* set the match/watcher/target names right */ 1454 return EBT_ENTRY_ITERATE(entries, entries_size, 1455 ebt_entry_to_user, entries, tmp.entries); 1456 } 1457 1458 static int do_ebt_set_ctl(struct sock *sk, 1459 int cmd, void __user *user, unsigned int len) 1460 { 1461 int ret; 1462 struct net *net = sock_net(sk); 1463 1464 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 1465 return -EPERM; 1466 1467 switch (cmd) { 1468 case EBT_SO_SET_ENTRIES: 1469 ret = do_replace(net, user, len); 1470 break; 1471 case EBT_SO_SET_COUNTERS: 1472 ret = update_counters(net, user, len); 1473 break; 1474 default: 1475 ret = -EINVAL; 1476 } 1477 return ret; 1478 } 1479 1480 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 1481 { 1482 int ret; 1483 struct ebt_replace tmp; 1484 struct ebt_table *t; 1485 struct net *net = sock_net(sk); 1486 1487 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 1488 return -EPERM; 1489 1490 if (copy_from_user(&tmp, user, sizeof(tmp))) 1491 return -EFAULT; 1492 1493 tmp.name[sizeof(tmp.name) - 1] = '\0'; 1494 1495 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); 1496 if (!t) 1497 return ret; 1498 1499 switch (cmd) { 1500 case EBT_SO_GET_INFO: 1501 case EBT_SO_GET_INIT_INFO: 1502 if (*len != sizeof(struct ebt_replace)) { 1503 ret = -EINVAL; 1504 mutex_unlock(&ebt_mutex); 1505 break; 1506 } 1507 if (cmd == EBT_SO_GET_INFO) { 1508 tmp.nentries = t->private->nentries; 1509 tmp.entries_size = t->private->entries_size; 1510 tmp.valid_hooks = t->valid_hooks; 1511 } else { 1512 tmp.nentries = t->table->nentries; 1513 tmp.entries_size = t->table->entries_size; 1514 tmp.valid_hooks = t->table->valid_hooks; 1515 } 1516 mutex_unlock(&ebt_mutex); 1517 if (copy_to_user(user, &tmp, *len) != 0) { 1518 ret = -EFAULT; 1519 break; 1520 } 1521 ret = 0; 1522 break; 1523 1524 case EBT_SO_GET_ENTRIES: 1525 case EBT_SO_GET_INIT_ENTRIES: 1526 ret = copy_everything_to_user(t, user, len, cmd); 1527 mutex_unlock(&ebt_mutex); 1528 break; 1529 1530 default: 1531 mutex_unlock(&ebt_mutex); 1532 ret = -EINVAL; 1533 } 1534 1535 return ret; 1536 } 1537 1538 #ifdef CONFIG_COMPAT 1539 /* 32 bit-userspace compatibility definitions. */ 1540 struct compat_ebt_replace { 1541 char name[EBT_TABLE_MAXNAMELEN]; 1542 compat_uint_t valid_hooks; 1543 compat_uint_t nentries; 1544 compat_uint_t entries_size; 1545 /* start of the chains */ 1546 compat_uptr_t hook_entry[NF_BR_NUMHOOKS]; 1547 /* nr of counters userspace expects back */ 1548 compat_uint_t num_counters; 1549 /* where the kernel will put the old counters. */ 1550 compat_uptr_t counters; 1551 compat_uptr_t entries; 1552 }; 1553 1554 /* struct ebt_entry_match, _target and _watcher have same layout */ 1555 struct compat_ebt_entry_mwt { 1556 union { 1557 struct { 1558 char name[EBT_EXTENSION_MAXNAMELEN]; 1559 u8 revision; 1560 }; 1561 compat_uptr_t ptr; 1562 } u; 1563 compat_uint_t match_size; 1564 compat_uint_t data[0] __attribute__ ((aligned (__alignof__(struct compat_ebt_replace)))); 1565 }; 1566 1567 /* account for possible padding between match_size and ->data */ 1568 static int ebt_compat_entry_padsize(void) 1569 { 1570 BUILD_BUG_ON(sizeof(struct ebt_entry_match) < 1571 sizeof(struct compat_ebt_entry_mwt)); 1572 return (int) sizeof(struct ebt_entry_match) - 1573 sizeof(struct compat_ebt_entry_mwt); 1574 } 1575 1576 static int ebt_compat_match_offset(const struct xt_match *match, 1577 unsigned int userlen) 1578 { 1579 /* ebt_among needs special handling. The kernel .matchsize is 1580 * set to -1 at registration time; at runtime an EBT_ALIGN()ed 1581 * value is expected. 1582 * Example: userspace sends 4500, ebt_among.c wants 4504. 1583 */ 1584 if (unlikely(match->matchsize == -1)) 1585 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen); 1586 return xt_compat_match_offset(match); 1587 } 1588 1589 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr, 1590 unsigned int *size) 1591 { 1592 const struct xt_match *match = m->u.match; 1593 struct compat_ebt_entry_mwt __user *cm = *dstptr; 1594 int off = ebt_compat_match_offset(match, m->match_size); 1595 compat_uint_t msize = m->match_size - off; 1596 1597 if (WARN_ON(off >= m->match_size)) 1598 return -EINVAL; 1599 1600 if (copy_to_user(cm->u.name, match->name, strlen(match->name) + 1) || 1601 put_user(match->revision, &cm->u.revision) || 1602 put_user(msize, &cm->match_size)) 1603 return -EFAULT; 1604 1605 if (match->compat_to_user) { 1606 if (match->compat_to_user(cm->data, m->data)) 1607 return -EFAULT; 1608 } else { 1609 if (xt_data_to_user(cm->data, m->data, match->usersize, msize, 1610 COMPAT_XT_ALIGN(msize))) 1611 return -EFAULT; 1612 } 1613 1614 *size -= ebt_compat_entry_padsize() + off; 1615 *dstptr = cm->data; 1616 *dstptr += msize; 1617 return 0; 1618 } 1619 1620 static int compat_target_to_user(struct ebt_entry_target *t, 1621 void __user **dstptr, 1622 unsigned int *size) 1623 { 1624 const struct xt_target *target = t->u.target; 1625 struct compat_ebt_entry_mwt __user *cm = *dstptr; 1626 int off = xt_compat_target_offset(target); 1627 compat_uint_t tsize = t->target_size - off; 1628 1629 if (WARN_ON(off >= t->target_size)) 1630 return -EINVAL; 1631 1632 if (copy_to_user(cm->u.name, target->name, strlen(target->name) + 1) || 1633 put_user(target->revision, &cm->u.revision) || 1634 put_user(tsize, &cm->match_size)) 1635 return -EFAULT; 1636 1637 if (target->compat_to_user) { 1638 if (target->compat_to_user(cm->data, t->data)) 1639 return -EFAULT; 1640 } else { 1641 if (xt_data_to_user(cm->data, t->data, target->usersize, tsize, 1642 COMPAT_XT_ALIGN(tsize))) 1643 return -EFAULT; 1644 } 1645 1646 *size -= ebt_compat_entry_padsize() + off; 1647 *dstptr = cm->data; 1648 *dstptr += tsize; 1649 return 0; 1650 } 1651 1652 static int compat_watcher_to_user(struct ebt_entry_watcher *w, 1653 void __user **dstptr, 1654 unsigned int *size) 1655 { 1656 return compat_target_to_user((struct ebt_entry_target *)w, 1657 dstptr, size); 1658 } 1659 1660 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr, 1661 unsigned int *size) 1662 { 1663 struct ebt_entry_target *t; 1664 struct ebt_entry __user *ce; 1665 u32 watchers_offset, target_offset, next_offset; 1666 compat_uint_t origsize; 1667 int ret; 1668 1669 if (e->bitmask == 0) { 1670 if (*size < sizeof(struct ebt_entries)) 1671 return -EINVAL; 1672 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries))) 1673 return -EFAULT; 1674 1675 *dstptr += sizeof(struct ebt_entries); 1676 *size -= sizeof(struct ebt_entries); 1677 return 0; 1678 } 1679 1680 if (*size < sizeof(*ce)) 1681 return -EINVAL; 1682 1683 ce = *dstptr; 1684 if (copy_to_user(ce, e, sizeof(*ce))) 1685 return -EFAULT; 1686 1687 origsize = *size; 1688 *dstptr += sizeof(*ce); 1689 1690 ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size); 1691 if (ret) 1692 return ret; 1693 watchers_offset = e->watchers_offset - (origsize - *size); 1694 1695 ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size); 1696 if (ret) 1697 return ret; 1698 target_offset = e->target_offset - (origsize - *size); 1699 1700 t = ebt_get_target(e); 1701 1702 ret = compat_target_to_user(t, dstptr, size); 1703 if (ret) 1704 return ret; 1705 next_offset = e->next_offset - (origsize - *size); 1706 1707 if (put_user(watchers_offset, &ce->watchers_offset) || 1708 put_user(target_offset, &ce->target_offset) || 1709 put_user(next_offset, &ce->next_offset)) 1710 return -EFAULT; 1711 1712 *size -= sizeof(*ce); 1713 return 0; 1714 } 1715 1716 static int compat_calc_match(struct ebt_entry_match *m, int *off) 1717 { 1718 *off += ebt_compat_match_offset(m->u.match, m->match_size); 1719 *off += ebt_compat_entry_padsize(); 1720 return 0; 1721 } 1722 1723 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off) 1724 { 1725 *off += xt_compat_target_offset(w->u.watcher); 1726 *off += ebt_compat_entry_padsize(); 1727 return 0; 1728 } 1729 1730 static int compat_calc_entry(const struct ebt_entry *e, 1731 const struct ebt_table_info *info, 1732 const void *base, 1733 struct compat_ebt_replace *newinfo) 1734 { 1735 const struct ebt_entry_target *t; 1736 unsigned int entry_offset; 1737 int off, ret, i; 1738 1739 if (e->bitmask == 0) 1740 return 0; 1741 1742 off = 0; 1743 entry_offset = (void *)e - base; 1744 1745 EBT_MATCH_ITERATE(e, compat_calc_match, &off); 1746 EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off); 1747 1748 t = ebt_get_target_c(e); 1749 1750 off += xt_compat_target_offset(t->u.target); 1751 off += ebt_compat_entry_padsize(); 1752 1753 newinfo->entries_size -= off; 1754 1755 ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off); 1756 if (ret) 1757 return ret; 1758 1759 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 1760 const void *hookptr = info->hook_entry[i]; 1761 if (info->hook_entry[i] && 1762 (e < (struct ebt_entry *)(base - hookptr))) { 1763 newinfo->hook_entry[i] -= off; 1764 pr_debug("0x%08X -> 0x%08X\n", 1765 newinfo->hook_entry[i] + off, 1766 newinfo->hook_entry[i]); 1767 } 1768 } 1769 1770 return 0; 1771 } 1772 1773 1774 static int compat_table_info(const struct ebt_table_info *info, 1775 struct compat_ebt_replace *newinfo) 1776 { 1777 unsigned int size = info->entries_size; 1778 const void *entries = info->entries; 1779 1780 newinfo->entries_size = size; 1781 if (info->nentries) { 1782 int ret = xt_compat_init_offsets(NFPROTO_BRIDGE, 1783 info->nentries); 1784 if (ret) 1785 return ret; 1786 } 1787 1788 return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info, 1789 entries, newinfo); 1790 } 1791 1792 static int compat_copy_everything_to_user(struct ebt_table *t, 1793 void __user *user, int *len, int cmd) 1794 { 1795 struct compat_ebt_replace repl, tmp; 1796 struct ebt_counter *oldcounters; 1797 struct ebt_table_info tinfo; 1798 int ret; 1799 void __user *pos; 1800 1801 memset(&tinfo, 0, sizeof(tinfo)); 1802 1803 if (cmd == EBT_SO_GET_ENTRIES) { 1804 tinfo.entries_size = t->private->entries_size; 1805 tinfo.nentries = t->private->nentries; 1806 tinfo.entries = t->private->entries; 1807 oldcounters = t->private->counters; 1808 } else { 1809 tinfo.entries_size = t->table->entries_size; 1810 tinfo.nentries = t->table->nentries; 1811 tinfo.entries = t->table->entries; 1812 oldcounters = t->table->counters; 1813 } 1814 1815 if (copy_from_user(&tmp, user, sizeof(tmp))) 1816 return -EFAULT; 1817 1818 if (tmp.nentries != tinfo.nentries || 1819 (tmp.num_counters && tmp.num_counters != tinfo.nentries)) 1820 return -EINVAL; 1821 1822 memcpy(&repl, &tmp, sizeof(repl)); 1823 if (cmd == EBT_SO_GET_ENTRIES) 1824 ret = compat_table_info(t->private, &repl); 1825 else 1826 ret = compat_table_info(&tinfo, &repl); 1827 if (ret) 1828 return ret; 1829 1830 if (*len != sizeof(tmp) + repl.entries_size + 1831 (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) { 1832 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n", 1833 *len, tinfo.entries_size, repl.entries_size); 1834 return -EINVAL; 1835 } 1836 1837 /* userspace might not need the counters */ 1838 ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters), 1839 tmp.num_counters, tinfo.nentries); 1840 if (ret) 1841 return ret; 1842 1843 pos = compat_ptr(tmp.entries); 1844 return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size, 1845 compat_copy_entry_to_user, &pos, &tmp.entries_size); 1846 } 1847 1848 struct ebt_entries_buf_state { 1849 char *buf_kern_start; /* kernel buffer to copy (translated) data to */ 1850 u32 buf_kern_len; /* total size of kernel buffer */ 1851 u32 buf_kern_offset; /* amount of data copied so far */ 1852 u32 buf_user_offset; /* read position in userspace buffer */ 1853 }; 1854 1855 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz) 1856 { 1857 state->buf_kern_offset += sz; 1858 return state->buf_kern_offset >= sz ? 0 : -EINVAL; 1859 } 1860 1861 static int ebt_buf_add(struct ebt_entries_buf_state *state, 1862 void *data, unsigned int sz) 1863 { 1864 if (state->buf_kern_start == NULL) 1865 goto count_only; 1866 1867 if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len)) 1868 return -EINVAL; 1869 1870 memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz); 1871 1872 count_only: 1873 state->buf_user_offset += sz; 1874 return ebt_buf_count(state, sz); 1875 } 1876 1877 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz) 1878 { 1879 char *b = state->buf_kern_start; 1880 1881 if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len)) 1882 return -EINVAL; 1883 1884 if (b != NULL && sz > 0) 1885 memset(b + state->buf_kern_offset, 0, sz); 1886 /* do not adjust ->buf_user_offset here, we added kernel-side padding */ 1887 return ebt_buf_count(state, sz); 1888 } 1889 1890 enum compat_mwt { 1891 EBT_COMPAT_MATCH, 1892 EBT_COMPAT_WATCHER, 1893 EBT_COMPAT_TARGET, 1894 }; 1895 1896 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, 1897 enum compat_mwt compat_mwt, 1898 struct ebt_entries_buf_state *state, 1899 const unsigned char *base) 1900 { 1901 char name[EBT_EXTENSION_MAXNAMELEN]; 1902 struct xt_match *match; 1903 struct xt_target *wt; 1904 void *dst = NULL; 1905 int off, pad = 0; 1906 unsigned int size_kern, match_size = mwt->match_size; 1907 1908 if (strscpy(name, mwt->u.name, sizeof(name)) < 0) 1909 return -EINVAL; 1910 1911 if (state->buf_kern_start) 1912 dst = state->buf_kern_start + state->buf_kern_offset; 1913 1914 switch (compat_mwt) { 1915 case EBT_COMPAT_MATCH: 1916 match = xt_request_find_match(NFPROTO_BRIDGE, name, 1917 mwt->u.revision); 1918 if (IS_ERR(match)) 1919 return PTR_ERR(match); 1920 1921 off = ebt_compat_match_offset(match, match_size); 1922 if (dst) { 1923 if (match->compat_from_user) 1924 match->compat_from_user(dst, mwt->data); 1925 else 1926 memcpy(dst, mwt->data, match_size); 1927 } 1928 1929 size_kern = match->matchsize; 1930 if (unlikely(size_kern == -1)) 1931 size_kern = match_size; 1932 module_put(match->me); 1933 break; 1934 case EBT_COMPAT_WATCHER: /* fallthrough */ 1935 case EBT_COMPAT_TARGET: 1936 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 1937 mwt->u.revision); 1938 if (IS_ERR(wt)) 1939 return PTR_ERR(wt); 1940 off = xt_compat_target_offset(wt); 1941 1942 if (dst) { 1943 if (wt->compat_from_user) 1944 wt->compat_from_user(dst, mwt->data); 1945 else 1946 memcpy(dst, mwt->data, match_size); 1947 } 1948 1949 size_kern = wt->targetsize; 1950 module_put(wt->me); 1951 break; 1952 1953 default: 1954 return -EINVAL; 1955 } 1956 1957 state->buf_kern_offset += match_size + off; 1958 state->buf_user_offset += match_size; 1959 pad = XT_ALIGN(size_kern) - size_kern; 1960 1961 if (pad > 0 && dst) { 1962 if (WARN_ON(state->buf_kern_len <= pad)) 1963 return -EINVAL; 1964 if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad)) 1965 return -EINVAL; 1966 memset(dst + size_kern, 0, pad); 1967 } 1968 return off + match_size; 1969 } 1970 1971 /* return size of all matches, watchers or target, including necessary 1972 * alignment and padding. 1973 */ 1974 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, 1975 unsigned int size_left, enum compat_mwt type, 1976 struct ebt_entries_buf_state *state, const void *base) 1977 { 1978 int growth = 0; 1979 char *buf; 1980 1981 if (size_left == 0) 1982 return 0; 1983 1984 buf = (char *) match32; 1985 1986 while (size_left >= sizeof(*match32)) { 1987 struct ebt_entry_match *match_kern; 1988 int ret; 1989 1990 match_kern = (struct ebt_entry_match *) state->buf_kern_start; 1991 if (match_kern) { 1992 char *tmp; 1993 tmp = state->buf_kern_start + state->buf_kern_offset; 1994 match_kern = (struct ebt_entry_match *) tmp; 1995 } 1996 ret = ebt_buf_add(state, buf, sizeof(*match32)); 1997 if (ret < 0) 1998 return ret; 1999 size_left -= sizeof(*match32); 2000 2001 /* add padding before match->data (if any) */ 2002 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize()); 2003 if (ret < 0) 2004 return ret; 2005 2006 if (match32->match_size > size_left) 2007 return -EINVAL; 2008 2009 size_left -= match32->match_size; 2010 2011 ret = compat_mtw_from_user(match32, type, state, base); 2012 if (ret < 0) 2013 return ret; 2014 2015 if (WARN_ON(ret < match32->match_size)) 2016 return -EINVAL; 2017 growth += ret - match32->match_size; 2018 growth += ebt_compat_entry_padsize(); 2019 2020 buf += sizeof(*match32); 2021 buf += match32->match_size; 2022 2023 if (match_kern) 2024 match_kern->match_size = ret; 2025 2026 /* rule should have no remaining data after target */ 2027 if (type == EBT_COMPAT_TARGET && size_left) 2028 return -EINVAL; 2029 2030 match32 = (struct compat_ebt_entry_mwt *) buf; 2031 } 2032 2033 return growth; 2034 } 2035 2036 /* called for all ebt_entry structures. */ 2037 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, 2038 unsigned int *total, 2039 struct ebt_entries_buf_state *state) 2040 { 2041 unsigned int i, j, startoff, new_offset = 0; 2042 /* stores match/watchers/targets & offset of next struct ebt_entry: */ 2043 unsigned int offsets[4]; 2044 unsigned int *offsets_update = NULL; 2045 int ret; 2046 char *buf_start; 2047 2048 if (*total < sizeof(struct ebt_entries)) 2049 return -EINVAL; 2050 2051 if (!entry->bitmask) { 2052 *total -= sizeof(struct ebt_entries); 2053 return ebt_buf_add(state, entry, sizeof(struct ebt_entries)); 2054 } 2055 if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry)) 2056 return -EINVAL; 2057 2058 startoff = state->buf_user_offset; 2059 /* pull in most part of ebt_entry, it does not need to be changed. */ 2060 ret = ebt_buf_add(state, entry, 2061 offsetof(struct ebt_entry, watchers_offset)); 2062 if (ret < 0) 2063 return ret; 2064 2065 offsets[0] = sizeof(struct ebt_entry); /* matches come first */ 2066 memcpy(&offsets[1], &entry->watchers_offset, 2067 sizeof(offsets) - sizeof(offsets[0])); 2068 2069 if (state->buf_kern_start) { 2070 buf_start = state->buf_kern_start + state->buf_kern_offset; 2071 offsets_update = (unsigned int *) buf_start; 2072 } 2073 ret = ebt_buf_add(state, &offsets[1], 2074 sizeof(offsets) - sizeof(offsets[0])); 2075 if (ret < 0) 2076 return ret; 2077 buf_start = (char *) entry; 2078 /* 0: matches offset, always follows ebt_entry. 2079 * 1: watchers offset, from ebt_entry structure 2080 * 2: target offset, from ebt_entry structure 2081 * 3: next ebt_entry offset, from ebt_entry structure 2082 * 2083 * offsets are relative to beginning of struct ebt_entry (i.e., 0). 2084 */ 2085 for (i = 0; i < 4 ; ++i) { 2086 if (offsets[i] > *total) 2087 return -EINVAL; 2088 2089 if (i < 3 && offsets[i] == *total) 2090 return -EINVAL; 2091 2092 if (i == 0) 2093 continue; 2094 if (offsets[i-1] > offsets[i]) 2095 return -EINVAL; 2096 } 2097 2098 for (i = 0, j = 1 ; j < 4 ; j++, i++) { 2099 struct compat_ebt_entry_mwt *match32; 2100 unsigned int size; 2101 char *buf = buf_start + offsets[i]; 2102 2103 if (offsets[i] > offsets[j]) 2104 return -EINVAL; 2105 2106 match32 = (struct compat_ebt_entry_mwt *) buf; 2107 size = offsets[j] - offsets[i]; 2108 ret = ebt_size_mwt(match32, size, i, state, base); 2109 if (ret < 0) 2110 return ret; 2111 new_offset += ret; 2112 if (offsets_update && new_offset) { 2113 pr_debug("change offset %d to %d\n", 2114 offsets_update[i], offsets[j] + new_offset); 2115 offsets_update[i] = offsets[j] + new_offset; 2116 } 2117 } 2118 2119 if (state->buf_kern_start == NULL) { 2120 unsigned int offset = buf_start - (char *) base; 2121 2122 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset); 2123 if (ret < 0) 2124 return ret; 2125 } 2126 2127 startoff = state->buf_user_offset - startoff; 2128 2129 if (WARN_ON(*total < startoff)) 2130 return -EINVAL; 2131 *total -= startoff; 2132 return 0; 2133 } 2134 2135 /* repl->entries_size is the size of the ebt_entry blob in userspace. 2136 * It might need more memory when copied to a 64 bit kernel in case 2137 * userspace is 32-bit. So, first task: find out how much memory is needed. 2138 * 2139 * Called before validation is performed. 2140 */ 2141 static int compat_copy_entries(unsigned char *data, unsigned int size_user, 2142 struct ebt_entries_buf_state *state) 2143 { 2144 unsigned int size_remaining = size_user; 2145 int ret; 2146 2147 ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data, 2148 &size_remaining, state); 2149 if (ret < 0) 2150 return ret; 2151 2152 if (size_remaining) 2153 return -EINVAL; 2154 2155 return state->buf_kern_offset; 2156 } 2157 2158 2159 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl, 2160 void __user *user, unsigned int len) 2161 { 2162 struct compat_ebt_replace tmp; 2163 int i; 2164 2165 if (len < sizeof(tmp)) 2166 return -EINVAL; 2167 2168 if (copy_from_user(&tmp, user, sizeof(tmp))) 2169 return -EFAULT; 2170 2171 if (len != sizeof(tmp) + tmp.entries_size) 2172 return -EINVAL; 2173 2174 if (tmp.entries_size == 0) 2175 return -EINVAL; 2176 2177 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / 2178 NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) 2179 return -ENOMEM; 2180 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 2181 return -ENOMEM; 2182 2183 memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry)); 2184 2185 /* starting with hook_entry, 32 vs. 64 bit structures are different */ 2186 for (i = 0; i < NF_BR_NUMHOOKS; i++) 2187 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]); 2188 2189 repl->num_counters = tmp.num_counters; 2190 repl->counters = compat_ptr(tmp.counters); 2191 repl->entries = compat_ptr(tmp.entries); 2192 return 0; 2193 } 2194 2195 static int compat_do_replace(struct net *net, void __user *user, 2196 unsigned int len) 2197 { 2198 int ret, i, countersize, size64; 2199 struct ebt_table_info *newinfo; 2200 struct ebt_replace tmp; 2201 struct ebt_entries_buf_state state; 2202 void *entries_tmp; 2203 2204 ret = compat_copy_ebt_replace_from_user(&tmp, user, len); 2205 if (ret) { 2206 /* try real handler in case userland supplied needed padding */ 2207 if (ret == -EINVAL && do_replace(net, user, len) == 0) 2208 ret = 0; 2209 return ret; 2210 } 2211 2212 countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; 2213 newinfo = vmalloc(sizeof(*newinfo) + countersize); 2214 if (!newinfo) 2215 return -ENOMEM; 2216 2217 if (countersize) 2218 memset(newinfo->counters, 0, countersize); 2219 2220 memset(&state, 0, sizeof(state)); 2221 2222 newinfo->entries = vmalloc(tmp.entries_size); 2223 if (!newinfo->entries) { 2224 ret = -ENOMEM; 2225 goto free_newinfo; 2226 } 2227 if (copy_from_user( 2228 newinfo->entries, tmp.entries, tmp.entries_size) != 0) { 2229 ret = -EFAULT; 2230 goto free_entries; 2231 } 2232 2233 entries_tmp = newinfo->entries; 2234 2235 xt_compat_lock(NFPROTO_BRIDGE); 2236 2237 if (tmp.nentries) { 2238 ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); 2239 if (ret < 0) 2240 goto out_unlock; 2241 } 2242 2243 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); 2244 if (ret < 0) 2245 goto out_unlock; 2246 2247 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n", 2248 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset, 2249 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size)); 2250 2251 size64 = ret; 2252 newinfo->entries = vmalloc(size64); 2253 if (!newinfo->entries) { 2254 vfree(entries_tmp); 2255 ret = -ENOMEM; 2256 goto out_unlock; 2257 } 2258 2259 memset(&state, 0, sizeof(state)); 2260 state.buf_kern_start = newinfo->entries; 2261 state.buf_kern_len = size64; 2262 2263 ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); 2264 if (WARN_ON(ret < 0)) 2265 goto out_unlock; 2266 2267 vfree(entries_tmp); 2268 tmp.entries_size = size64; 2269 2270 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 2271 char __user *usrptr; 2272 if (tmp.hook_entry[i]) { 2273 unsigned int delta; 2274 usrptr = (char __user *) tmp.hook_entry[i]; 2275 delta = usrptr - tmp.entries; 2276 usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta); 2277 tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr; 2278 } 2279 } 2280 2281 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2282 xt_compat_unlock(NFPROTO_BRIDGE); 2283 2284 ret = do_replace_finish(net, &tmp, newinfo); 2285 if (ret == 0) 2286 return ret; 2287 free_entries: 2288 vfree(newinfo->entries); 2289 free_newinfo: 2290 vfree(newinfo); 2291 return ret; 2292 out_unlock: 2293 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2294 xt_compat_unlock(NFPROTO_BRIDGE); 2295 goto free_entries; 2296 } 2297 2298 static int compat_update_counters(struct net *net, void __user *user, 2299 unsigned int len) 2300 { 2301 struct compat_ebt_replace hlp; 2302 2303 if (copy_from_user(&hlp, user, sizeof(hlp))) 2304 return -EFAULT; 2305 2306 /* try real handler in case userland supplied needed padding */ 2307 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) 2308 return update_counters(net, user, len); 2309 2310 return do_update_counters(net, hlp.name, compat_ptr(hlp.counters), 2311 hlp.num_counters, user, len); 2312 } 2313 2314 static int compat_do_ebt_set_ctl(struct sock *sk, 2315 int cmd, void __user *user, unsigned int len) 2316 { 2317 int ret; 2318 struct net *net = sock_net(sk); 2319 2320 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 2321 return -EPERM; 2322 2323 switch (cmd) { 2324 case EBT_SO_SET_ENTRIES: 2325 ret = compat_do_replace(net, user, len); 2326 break; 2327 case EBT_SO_SET_COUNTERS: 2328 ret = compat_update_counters(net, user, len); 2329 break; 2330 default: 2331 ret = -EINVAL; 2332 } 2333 return ret; 2334 } 2335 2336 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd, 2337 void __user *user, int *len) 2338 { 2339 int ret; 2340 struct compat_ebt_replace tmp; 2341 struct ebt_table *t; 2342 struct net *net = sock_net(sk); 2343 2344 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 2345 return -EPERM; 2346 2347 /* try real handler in case userland supplied needed padding */ 2348 if ((cmd == EBT_SO_GET_INFO || 2349 cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp)) 2350 return do_ebt_get_ctl(sk, cmd, user, len); 2351 2352 if (copy_from_user(&tmp, user, sizeof(tmp))) 2353 return -EFAULT; 2354 2355 tmp.name[sizeof(tmp.name) - 1] = '\0'; 2356 2357 t = find_table_lock(net, tmp.name, &ret, &ebt_mutex); 2358 if (!t) 2359 return ret; 2360 2361 xt_compat_lock(NFPROTO_BRIDGE); 2362 switch (cmd) { 2363 case EBT_SO_GET_INFO: 2364 tmp.nentries = t->private->nentries; 2365 ret = compat_table_info(t->private, &tmp); 2366 if (ret) 2367 goto out; 2368 tmp.valid_hooks = t->valid_hooks; 2369 2370 if (copy_to_user(user, &tmp, *len) != 0) { 2371 ret = -EFAULT; 2372 break; 2373 } 2374 ret = 0; 2375 break; 2376 case EBT_SO_GET_INIT_INFO: 2377 tmp.nentries = t->table->nentries; 2378 tmp.entries_size = t->table->entries_size; 2379 tmp.valid_hooks = t->table->valid_hooks; 2380 2381 if (copy_to_user(user, &tmp, *len) != 0) { 2382 ret = -EFAULT; 2383 break; 2384 } 2385 ret = 0; 2386 break; 2387 case EBT_SO_GET_ENTRIES: 2388 case EBT_SO_GET_INIT_ENTRIES: 2389 /* try real handler first in case of userland-side padding. 2390 * in case we are dealing with an 'ordinary' 32 bit binary 2391 * without 64bit compatibility padding, this will fail right 2392 * after copy_from_user when the *len argument is validated. 2393 * 2394 * the compat_ variant needs to do one pass over the kernel 2395 * data set to adjust for size differences before it the check. 2396 */ 2397 if (copy_everything_to_user(t, user, len, cmd) == 0) 2398 ret = 0; 2399 else 2400 ret = compat_copy_everything_to_user(t, user, len, cmd); 2401 break; 2402 default: 2403 ret = -EINVAL; 2404 } 2405 out: 2406 xt_compat_flush_offsets(NFPROTO_BRIDGE); 2407 xt_compat_unlock(NFPROTO_BRIDGE); 2408 mutex_unlock(&ebt_mutex); 2409 return ret; 2410 } 2411 #endif 2412 2413 static struct nf_sockopt_ops ebt_sockopts = { 2414 .pf = PF_INET, 2415 .set_optmin = EBT_BASE_CTL, 2416 .set_optmax = EBT_SO_SET_MAX + 1, 2417 .set = do_ebt_set_ctl, 2418 #ifdef CONFIG_COMPAT 2419 .compat_set = compat_do_ebt_set_ctl, 2420 #endif 2421 .get_optmin = EBT_BASE_CTL, 2422 .get_optmax = EBT_SO_GET_MAX + 1, 2423 .get = do_ebt_get_ctl, 2424 #ifdef CONFIG_COMPAT 2425 .compat_get = compat_do_ebt_get_ctl, 2426 #endif 2427 .owner = THIS_MODULE, 2428 }; 2429 2430 static int __init ebtables_init(void) 2431 { 2432 int ret; 2433 2434 ret = xt_register_target(&ebt_standard_target); 2435 if (ret < 0) 2436 return ret; 2437 ret = nf_register_sockopt(&ebt_sockopts); 2438 if (ret < 0) { 2439 xt_unregister_target(&ebt_standard_target); 2440 return ret; 2441 } 2442 2443 return 0; 2444 } 2445 2446 static void __exit ebtables_fini(void) 2447 { 2448 nf_unregister_sockopt(&ebt_sockopts); 2449 xt_unregister_target(&ebt_standard_target); 2450 } 2451 2452 EXPORT_SYMBOL(ebt_register_table); 2453 EXPORT_SYMBOL(ebt_unregister_table); 2454 EXPORT_SYMBOL(ebt_do_table); 2455 module_init(ebtables_init); 2456 module_exit(ebtables_fini); 2457 MODULE_LICENSE("GPL"); 2458