net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18 #include <linux/kmod.h>
  19 #include <linux/module.h>
  20 #include <linux/vmalloc.h>
  21 #include <linux/netfilter/x_tables.h>
  22 #include <linux/netfilter_bridge/ebtables.h>
  23 #include <linux/spinlock.h>
  24 #include <linux/mutex.h>
  25 #include <linux/slab.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <linux/audit.h>
  30 #include <net/sock.h>
  31 /* needed for logical [in,out]-dev filtering */
  32 #include "../br_private.h"
  33
  34 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  35                                          "report to author: "format, ## args)
  36 /* #define BUGPRINT(format, args...) */
  37
  38 /*
  39  * Each cpu has its own set of counters, so there is no need for write_lock in
  40  * the softirq
  41  * For reading or updating the counters, the user context needs to
  42  * get a write_lock
  43  */
  44
  45 /* The size of each set of counters is altered to get cache alignment */
  46 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  47 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  48 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  49    COUNTER_OFFSET(n) * cpu))
  50
  51
  52
  53 static DEFINE_MUTEX(ebt_mutex);
  54
  55 #ifdef CONFIG_COMPAT
  56 static void ebt_standard_compat_from_user(void *dst, const void *src)
  57 {
  58         int v = *(compat_int_t *)src;
  59
  60         if (v >= 0)
  61                 v += xt_compat_calc_jump(NFPROTO_BRIDGE, v);
  62         memcpy(dst, &v, sizeof(v));
  63 }
  64
  65 static int ebt_standard_compat_to_user(void __user *dst, const void *src)
  66 {
  67         compat_int_t cv = *(int *)src;
  68
  69         if (cv >= 0)
  70                 cv -= xt_compat_calc_jump(NFPROTO_BRIDGE, cv);
  71         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
  72 }
  73 #endif
  74
  75
  76 static struct xt_target ebt_standard_target = {
  77         .name       = "standard",
  78         .revision   = 0,
  79         .family     = NFPROTO_BRIDGE,
  80         .targetsize = sizeof(int),
  81 #ifdef CONFIG_COMPAT
  82         .compatsize = sizeof(compat_int_t),
  83         .compat_from_user = ebt_standard_compat_from_user,
  84         .compat_to_user =  ebt_standard_compat_to_user,
  85 #endif
  86 };
  87
  88 static inline int
  89 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  90                struct xt_action_param *par)
  91 {
  92         par->target   = w->u.watcher;
  93         par->targinfo = w->data;
  94         w->u.watcher->target(skb, par);
  95         /* watchers don't give a verdict */
  96         return 0;
  97 }
  98
  99 static inline int
 100 ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
 101              struct xt_action_param *par)
 102 {
 103         par->match     = m->u.match;
 104         par->matchinfo = m->data;
 105         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 106 }
 107
 108 static inline int
 109 ebt_dev_check(const char *entry, const struct net_device *device)
 110 {
 111         int i = 0;
 112         const char *devname;
 113
 114         if (*entry == '\0')
 115                 return 0;
 116         if (!device)
 117                 return 1;
 118         devname = device->name;
 119         /* 1 is the wildcard token */
 120         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 121                 i++;
 122         return devname[i] != entry[i] && entry[i] != 1;
 123 }
 124
 125 #define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
 126 /* process standard matches */
 127 static inline int
 128 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
 129                 const struct net_device *in, const struct net_device *out)
 130 {
 131         const struct ethhdr *h = eth_hdr(skb);
 132         const struct net_bridge_port *p;
 133         __be16 ethproto;
 134         int verdict, i;
 135
 136         if (skb_vlan_tag_present(skb))
 137                 ethproto = htons(ETH_P_8021Q);
 138         else
 139                 ethproto = h->h_proto;
 140
 141         if (e->bitmask & EBT_802_3) {
 142                 if (FWINV2(ntohs(ethproto) >= ETH_P_802_3_MIN, EBT_IPROTO))
 143                         return 1;
 144         } else if (!(e->bitmask & EBT_NOPROTO) &&
 145            FWINV2(e->ethproto != ethproto, EBT_IPROTO))
 146                 return 1;
 147
 148         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 149                 return 1;
 150         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 151                 return 1;
 152         /* rcu_read_lock()ed by nf_hook_slow */
 153         if (in && (p = br_port_get_rcu(in)) != NULL &&
 154             FWINV2(ebt_dev_check(e->logical_in, p->br->dev), EBT_ILOGICALIN))
 155                 return 1;
 156         if (out && (p = br_port_get_rcu(out)) != NULL &&
 157             FWINV2(ebt_dev_check(e->logical_out, p->br->dev), EBT_ILOGICALOUT))
 158                 return 1;
 159
 160         if (e->bitmask & EBT_SOURCEMAC) {
 161                 verdict = 0;
 162                 for (i = 0; i < 6; i++)
 163                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 164                            e->sourcemsk[i];
 165                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 166                         return 1;
 167         }
 168         if (e->bitmask & EBT_DESTMAC) {
 169                 verdict = 0;
 170                 for (i = 0; i < 6; i++)
 171                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 172                            e->destmsk[i];
 173                 if (FWINV2(verdict != 0, EBT_IDEST) )
 174                         return 1;
 175         }
 176         return 0;
 177 }
 178
 179 static inline __pure
 180 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 181 {
 182         return (void *)entry + entry->next_offset;
 183 }
 184
 185 /* Do some firewalling */
 186 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 187    const struct net_device *in, const struct net_device *out,
 188    struct ebt_table *table)
 189 {
 190         int i, nentries;
 191         struct ebt_entry *point;
 192         struct ebt_counter *counter_base, *cb_base;
 193         const struct ebt_entry_target *t;
 194         int verdict, sp = 0;
 195         struct ebt_chainstack *cs;
 196         struct ebt_entries *chaininfo;
 197         const char *base;
 198         const struct ebt_table_info *private;
 199         struct xt_action_param acpar;
 200
 201         acpar.family  = NFPROTO_BRIDGE;
 202         acpar.in      = in;
 203         acpar.out     = out;
 204         acpar.hotdrop = false;
 205         acpar.hooknum = hook;
 206
 207         read_lock_bh(&table->lock);
 208         private = table->private;
 209         cb_base = COUNTER_BASE(private->counters, private->nentries,
 210            smp_processor_id());
 211         if (private->chainstack)
 212                 cs = private->chainstack[smp_processor_id()];
 213         else
 214                 cs = NULL;
 215         chaininfo = private->hook_entry[hook];
 216         nentries = private->hook_entry[hook]->nentries;
 217         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 218         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 219         /* base for chain jumps */
 220         base = private->entries;
 221         i = 0;
 222         while (i < nentries) {
 223                 if (ebt_basic_match(point, skb, in, out))
 224                         goto letscontinue;
 225
 226                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &acpar) != 0)
 227                         goto letscontinue;
 228                 if (acpar.hotdrop) {
 229                         read_unlock_bh(&table->lock);
 230                         return NF_DROP;
 231                 }
 232
 233                 /* increase counter */
 234                 (*(counter_base + i)).pcnt++;
 235                 (*(counter_base + i)).bcnt += skb->len;
 236
 237                 /* these should only watch: not modify, nor tell us
 238                    what to do with the packet */
 239                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
 240
 241                 t = (struct ebt_entry_target *)
 242                    (((char *)point) + point->target_offset);
 243                 /* standard target */
 244                 if (!t->u.target->target)
 245                         verdict = ((struct ebt_standard_target *)t)->verdict;
 246                 else {
 247                         acpar.target   = t->u.target;
 248                         acpar.targinfo = t->data;
 249                         verdict = t->u.target->target(skb, &acpar);
 250                 }
 251                 if (verdict == EBT_ACCEPT) {
 252                         read_unlock_bh(&table->lock);
 253                         return NF_ACCEPT;
 254                 }
 255                 if (verdict == EBT_DROP) {
 256                         read_unlock_bh(&table->lock);
 257                         return NF_DROP;
 258                 }
 259                 if (verdict == EBT_RETURN) {
 260 letsreturn:
 261 #ifdef CONFIG_NETFILTER_DEBUG
 262                         if (sp == 0) {
 263                                 BUGPRINT("RETURN on base chain");
 264                                 /* act like this is EBT_CONTINUE */
 265                                 goto letscontinue;
 266                         }
 267 #endif
 268                         sp--;
 269                         /* put all the local variables right */
 270                         i = cs[sp].n;
 271                         chaininfo = cs[sp].chaininfo;
 272                         nentries = chaininfo->nentries;
 273                         point = cs[sp].e;
 274                         counter_base = cb_base +
 275                            chaininfo->counter_offset;
 276                         continue;
 277                 }
 278                 if (verdict == EBT_CONTINUE)
 279                         goto letscontinue;
 280 #ifdef CONFIG_NETFILTER_DEBUG
 281                 if (verdict < 0) {
 282                         BUGPRINT("bogus standard verdict\n");
 283                         read_unlock_bh(&table->lock);
 284                         return NF_DROP;
 285                 }
 286 #endif
 287                 /* jump to a udc */
 288                 cs[sp].n = i + 1;
 289                 cs[sp].chaininfo = chaininfo;
 290                 cs[sp].e = ebt_next_entry(point);
 291                 i = 0;
 292                 chaininfo = (struct ebt_entries *) (base + verdict);
 293 #ifdef CONFIG_NETFILTER_DEBUG
 294                 if (chaininfo->distinguisher) {
 295                         BUGPRINT("jump to non-chain\n");
 296                         read_unlock_bh(&table->lock);
 297                         return NF_DROP;
 298                 }
 299 #endif
 300                 nentries = chaininfo->nentries;
 301                 point = (struct ebt_entry *)chaininfo->data;
 302                 counter_base = cb_base + chaininfo->counter_offset;
 303                 sp++;
 304                 continue;
 305 letscontinue:
 306                 point = ebt_next_entry(point);
 307                 i++;
 308         }
 309
 310         /* I actually like this :) */
 311         if (chaininfo->policy == EBT_RETURN)
 312                 goto letsreturn;
 313         if (chaininfo->policy == EBT_ACCEPT) {
 314                 read_unlock_bh(&table->lock);
 315                 return NF_ACCEPT;
 316         }
 317         read_unlock_bh(&table->lock);
 318         return NF_DROP;
 319 }
 320
 321 /* If it succeeds, returns element and locks mutex */
 322 static inline void *
 323 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 324    struct mutex *mutex)
 325 {
 326         struct {
 327                 struct list_head list;
 328                 char name[EBT_FUNCTION_MAXNAMELEN];
 329         } *e;
 330
 331         mutex_lock(mutex);
 332         list_for_each_entry(e, head, list) {
 333                 if (strcmp(e->name, name) == 0)
 334                         return e;
 335         }
 336         *error = -ENOENT;
 337         mutex_unlock(mutex);
 338         return NULL;
 339 }
 340
 341 static void *
 342 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 343    int *error, struct mutex *mutex)
 344 {
 345         return try_then_request_module(
 346                         find_inlist_lock_noload(head, name, error, mutex),
 347                         "%s%s", prefix, name);
 348 }
 349
 350 static inline struct ebt_table *
 351 find_table_lock(struct net *net, const char *name, int *error,
 352                 struct mutex *mutex)
 353 {
 354         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 355                                 "ebtable_", error, mutex);
 356 }
 357
 358 static inline int
 359 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 360                 unsigned int *cnt)
 361 {
 362         const struct ebt_entry *e = par->entryinfo;
 363         struct xt_match *match;
 364         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 365         int ret;
 366
 367         if (left < sizeof(struct ebt_entry_match) ||
 368             left - sizeof(struct ebt_entry_match) < m->match_size)
 369                 return -EINVAL;
 370
 371         match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
 372         if (IS_ERR(match))
 373                 return PTR_ERR(match);
 374         m->u.match = match;
 375
 376         par->match     = match;
 377         par->matchinfo = m->data;
 378         ret = xt_check_match(par, m->match_size,
 379               e->ethproto, e->invflags & EBT_IPROTO);
 380         if (ret < 0) {
 381                 module_put(match->me);
 382                 return ret;
 383         }
 384
 385         (*cnt)++;
 386         return 0;
 387 }
 388
 389 static inline int
 390 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 391                   unsigned int *cnt)
 392 {
 393         const struct ebt_entry *e = par->entryinfo;
 394         struct xt_target *watcher;
 395         size_t left = ((char *)e + e->target_offset) - (char *)w;
 396         int ret;
 397
 398         if (left < sizeof(struct ebt_entry_watcher) ||
 399            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 400                 return -EINVAL;
 401
 402         watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
 403         if (IS_ERR(watcher))
 404                 return PTR_ERR(watcher);
 405         w->u.watcher = watcher;
 406
 407         par->target   = watcher;
 408         par->targinfo = w->data;
 409         ret = xt_check_target(par, w->watcher_size,
 410               e->ethproto, e->invflags & EBT_IPROTO);
 411         if (ret < 0) {
 412                 module_put(watcher->me);
 413                 return ret;
 414         }
 415
 416         (*cnt)++;
 417         return 0;
 418 }
 419
 420 static int ebt_verify_pointers(const struct ebt_replace *repl,
 421                                struct ebt_table_info *newinfo)
 422 {
 423         unsigned int limit = repl->entries_size;
 424         unsigned int valid_hooks = repl->valid_hooks;
 425         unsigned int offset = 0;
 426         int i;
 427
 428         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 429                 newinfo->hook_entry[i] = NULL;
 430
 431         newinfo->entries_size = repl->entries_size;
 432         newinfo->nentries = repl->nentries;
 433
 434         while (offset < limit) {
 435                 size_t left = limit - offset;
 436                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 437
 438                 if (left < sizeof(unsigned int))
 439                         break;
 440
 441                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 442                         if ((valid_hooks & (1 << i)) == 0)
 443                                 continue;
 444                         if ((char __user *)repl->hook_entry[i] ==
 445                              repl->entries + offset)
 446                                 break;
 447                 }
 448
 449                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 450                         if (e->bitmask != 0) {
 451                                 /* we make userspace set this right,
 452                                    so there is no misunderstanding */
 453                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 454                                          "in distinguisher\n");
 455                                 return -EINVAL;
 456                         }
 457                         if (i != NF_BR_NUMHOOKS)
 458                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 459                         if (left < sizeof(struct ebt_entries))
 460                                 break;
 461                         offset += sizeof(struct ebt_entries);
 462                 } else {
 463                         if (left < sizeof(struct ebt_entry))
 464                                 break;
 465                         if (left < e->next_offset)
 466                                 break;
 467                         if (e->next_offset < sizeof(struct ebt_entry))
 468                                 return -EINVAL;
 469                         offset += e->next_offset;
 470                 }
 471         }
 472         if (offset != limit) {
 473                 BUGPRINT("entries_size too small\n");
 474                 return -EINVAL;
 475         }
 476
 477         /* check if all valid hooks have a chain */
 478         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 479                 if (!newinfo->hook_entry[i] &&
 480                    (valid_hooks & (1 << i))) {
 481                         BUGPRINT("Valid hook without chain\n");
 482                         return -EINVAL;
 483                 }
 484         }
 485         return 0;
 486 }
 487
 488 /*
 489  * this one is very careful, as it is the first function
 490  * to parse the userspace data
 491  */
 492 static inline int
 493 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 494    const struct ebt_table_info *newinfo,
 495    unsigned int *n, unsigned int *cnt,
 496    unsigned int *totalcnt, unsigned int *udc_cnt)
 497 {
 498         int i;
 499
 500         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 501                 if ((void *)e == (void *)newinfo->hook_entry[i])
 502                         break;
 503         }
 504         /* beginning of a new chain
 505            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 506         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 507                 /* this checks if the previous chain has as many entries
 508                    as it said it has */
 509                 if (*n != *cnt) {
 510                         BUGPRINT("nentries does not equal the nr of entries "
 511                                  "in the chain\n");
 512                         return -EINVAL;
 513                 }
 514                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 515                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 516                         /* only RETURN from udc */
 517                         if (i != NF_BR_NUMHOOKS ||
 518                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 519                                 BUGPRINT("bad policy\n");
 520                                 return -EINVAL;
 521                         }
 522                 }
 523                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 524                         (*udc_cnt)++;
 525                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 526                         BUGPRINT("counter_offset != totalcnt");
 527                         return -EINVAL;
 528                 }
 529                 *n = ((struct ebt_entries *)e)->nentries;
 530                 *cnt = 0;
 531                 return 0;
 532         }
 533         /* a plain old entry, heh */
 534         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 535            e->watchers_offset > e->target_offset ||
 536            e->target_offset >= e->next_offset) {
 537                 BUGPRINT("entry offsets not in right order\n");
 538                 return -EINVAL;
 539         }
 540         /* this is not checked anywhere else */
 541         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 542                 BUGPRINT("target size too small\n");
 543                 return -EINVAL;
 544         }
 545         (*cnt)++;
 546         (*totalcnt)++;
 547         return 0;
 548 }
 549
 550 struct ebt_cl_stack
 551 {
 552         struct ebt_chainstack cs;
 553         int from;
 554         unsigned int hookmask;
 555 };
 556
 557 /*
 558  * we need these positions to check that the jumps to a different part of the
 559  * entries is a jump to the beginning of a new chain.
 560  */
 561 static inline int
 562 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 563    unsigned int *n, struct ebt_cl_stack *udc)
 564 {
 565         int i;
 566
 567         /* we're only interested in chain starts */
 568         if (e->bitmask)
 569                 return 0;
 570         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 571                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 572                         break;
 573         }
 574         /* only care about udc */
 575         if (i != NF_BR_NUMHOOKS)
 576                 return 0;
 577
 578         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 579         /* these initialisations are depended on later in check_chainloops() */
 580         udc[*n].cs.n = 0;
 581         udc[*n].hookmask = 0;
 582
 583         (*n)++;
 584         return 0;
 585 }
 586
 587 static inline int
 588 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 589 {
 590         struct xt_mtdtor_param par;
 591
 592         if (i && (*i)-- == 0)
 593                 return 1;
 594
 595         par.net       = net;
 596         par.match     = m->u.match;
 597         par.matchinfo = m->data;
 598         par.family    = NFPROTO_BRIDGE;
 599         if (par.match->destroy != NULL)
 600                 par.match->destroy(&par);
 601         module_put(par.match->me);
 602         return 0;
 603 }
 604
 605 static inline int
 606 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 607 {
 608         struct xt_tgdtor_param par;
 609
 610         if (i && (*i)-- == 0)
 611                 return 1;
 612
 613         par.net      = net;
 614         par.target   = w->u.watcher;
 615         par.targinfo = w->data;
 616         par.family   = NFPROTO_BRIDGE;
 617         if (par.target->destroy != NULL)
 618                 par.target->destroy(&par);
 619         module_put(par.target->me);
 620         return 0;
 621 }
 622
 623 static inline int
 624 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 625 {
 626         struct xt_tgdtor_param par;
 627         struct ebt_entry_target *t;
 628
 629         if (e->bitmask == 0)
 630                 return 0;
 631         /* we're done */
 632         if (cnt && (*cnt)-- == 0)
 633                 return 1;
 634         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 635         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 636         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 637
 638         par.net      = net;
 639         par.target   = t->u.target;
 640         par.targinfo = t->data;
 641         par.family   = NFPROTO_BRIDGE;
 642         if (par.target->destroy != NULL)
 643                 par.target->destroy(&par);
 644         module_put(par.target->me);
 645         return 0;
 646 }
 647
 648 static inline int
 649 ebt_check_entry(struct ebt_entry *e, struct net *net,
 650    const struct ebt_table_info *newinfo,
 651    const char *name, unsigned int *cnt,
 652    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 653 {
 654         struct ebt_entry_target *t;
 655         struct xt_target *target;
 656         unsigned int i, j, hook = 0, hookmask = 0;
 657         size_t gap;
 658         int ret;
 659         struct xt_mtchk_param mtpar;
 660         struct xt_tgchk_param tgpar;
 661
 662         /* don't mess with the struct ebt_entries */
 663         if (e->bitmask == 0)
 664                 return 0;
 665
 666         if (e->bitmask & ~EBT_F_MASK) {
 667                 BUGPRINT("Unknown flag for bitmask\n");
 668                 return -EINVAL;
 669         }
 670         if (e->invflags & ~EBT_INV_MASK) {
 671                 BUGPRINT("Unknown flag for inv bitmask\n");
 672                 return -EINVAL;
 673         }
 674         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 675                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 676                 return -EINVAL;
 677         }
 678         /* what hook do we belong to? */
 679         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 680                 if (!newinfo->hook_entry[i])
 681                         continue;
 682                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 683                         hook = i;
 684                 else
 685                         break;
 686         }
 687         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 688            a base chain */
 689         if (i < NF_BR_NUMHOOKS)
 690                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 691         else {
 692                 for (i = 0; i < udc_cnt; i++)
 693                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 694                                 break;
 695                 if (i == 0)
 696                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 697                 else
 698                         hookmask = cl_s[i - 1].hookmask;
 699         }
 700         i = 0;
 701
 702         mtpar.net       = tgpar.net       = net;
 703         mtpar.table     = tgpar.table     = name;
 704         mtpar.entryinfo = tgpar.entryinfo = e;
 705         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 706         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 707         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 708         if (ret != 0)
 709                 goto cleanup_matches;
 710         j = 0;
 711         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 712         if (ret != 0)
 713                 goto cleanup_watchers;
 714         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 715         gap = e->next_offset - e->target_offset;
 716
 717         target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
 718         if (IS_ERR(target)) {
 719                 ret = PTR_ERR(target);
 720                 goto cleanup_watchers;
 721         }
 722
 723         t->u.target = target;
 724         if (t->u.target == &ebt_standard_target) {
 725                 if (gap < sizeof(struct ebt_standard_target)) {
 726                         BUGPRINT("Standard target size too big\n");
 727                         ret = -EFAULT;
 728                         goto cleanup_watchers;
 729                 }
 730                 if (((struct ebt_standard_target *)t)->verdict <
 731                    -NUM_STANDARD_TARGETS) {
 732                         BUGPRINT("Invalid standard target\n");
 733                         ret = -EFAULT;
 734                         goto cleanup_watchers;
 735                 }
 736         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 737                 module_put(t->u.target->me);
 738                 ret = -EFAULT;
 739                 goto cleanup_watchers;
 740         }
 741
 742         tgpar.target   = target;
 743         tgpar.targinfo = t->data;
 744         ret = xt_check_target(&tgpar, t->target_size,
 745               e->ethproto, e->invflags & EBT_IPROTO);
 746         if (ret < 0) {
 747                 module_put(target->me);
 748                 goto cleanup_watchers;
 749         }
 750         (*cnt)++;
 751         return 0;
 752 cleanup_watchers:
 753         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 754 cleanup_matches:
 755         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 756         return ret;
 757 }
 758
 759 /*
 760  * checks for loops and sets the hook mask for udc
 761  * the hook mask for udc tells us from which base chains the udc can be
 762  * accessed. This mask is a parameter to the check() functions of the extensions
 763  */
 764 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 765    unsigned int udc_cnt, unsigned int hooknr, char *base)
 766 {
 767         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 768         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 769         const struct ebt_entry_target *t;
 770
 771         while (pos < nentries || chain_nr != -1) {
 772                 /* end of udc, go back one 'recursion' step */
 773                 if (pos == nentries) {
 774                         /* put back values of the time when this chain was called */
 775                         e = cl_s[chain_nr].cs.e;
 776                         if (cl_s[chain_nr].from != -1)
 777                                 nentries =
 778                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 779                         else
 780                                 nentries = chain->nentries;
 781                         pos = cl_s[chain_nr].cs.n;
 782                         /* make sure we won't see a loop that isn't one */
 783                         cl_s[chain_nr].cs.n = 0;
 784                         chain_nr = cl_s[chain_nr].from;
 785                         if (pos == nentries)
 786                                 continue;
 787                 }
 788                 t = (struct ebt_entry_target *)
 789                    (((char *)e) + e->target_offset);
 790                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 791                         goto letscontinue;
 792                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 793                    e->next_offset) {
 794                         BUGPRINT("Standard target size too big\n");
 795                         return -1;
 796                 }
 797                 verdict = ((struct ebt_standard_target *)t)->verdict;
 798                 if (verdict >= 0) { /* jump to another chain */
 799                         struct ebt_entries *hlp2 =
 800                            (struct ebt_entries *)(base + verdict);
 801                         for (i = 0; i < udc_cnt; i++)
 802                                 if (hlp2 == cl_s[i].cs.chaininfo)
 803                                         break;
 804                         /* bad destination or loop */
 805                         if (i == udc_cnt) {
 806                                 BUGPRINT("bad destination\n");
 807                                 return -1;
 808                         }
 809                         if (cl_s[i].cs.n) {
 810                                 BUGPRINT("loop\n");
 811                                 return -1;
 812                         }
 813                         if (cl_s[i].hookmask & (1 << hooknr))
 814                                 goto letscontinue;
 815                         /* this can't be 0, so the loop test is correct */
 816                         cl_s[i].cs.n = pos + 1;
 817                         pos = 0;
 818                         cl_s[i].cs.e = ebt_next_entry(e);
 819                         e = (struct ebt_entry *)(hlp2->data);
 820                         nentries = hlp2->nentries;
 821                         cl_s[i].from = chain_nr;
 822                         chain_nr = i;
 823                         /* this udc is accessible from the base chain for hooknr */
 824                         cl_s[i].hookmask |= (1 << hooknr);
 825                         continue;
 826                 }
 827 letscontinue:
 828                 e = ebt_next_entry(e);
 829                 pos++;
 830         }
 831         return 0;
 832 }
 833
 834 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 835 static int translate_table(struct net *net, const char *name,
 836                            struct ebt_table_info *newinfo)
 837 {
 838         unsigned int i, j, k, udc_cnt;
 839         int ret;
 840         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 841
 842         i = 0;
 843         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 844                 i++;
 845         if (i == NF_BR_NUMHOOKS) {
 846                 BUGPRINT("No valid hooks specified\n");
 847                 return -EINVAL;
 848         }
 849         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 850                 BUGPRINT("Chains don't start at beginning\n");
 851                 return -EINVAL;
 852         }
 853         /* make sure chains are ordered after each other in same order
 854            as their corresponding hooks */
 855         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 856                 if (!newinfo->hook_entry[j])
 857                         continue;
 858                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 859                         BUGPRINT("Hook order must be followed\n");
 860                         return -EINVAL;
 861                 }
 862                 i = j;
 863         }
 864
 865         /* do some early checkings and initialize some things */
 866         i = 0; /* holds the expected nr. of entries for the chain */
 867         j = 0; /* holds the up to now counted entries for the chain */
 868         k = 0; /* holds the total nr. of entries, should equal
 869                   newinfo->nentries afterwards */
 870         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 871         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 872            ebt_check_entry_size_and_hooks, newinfo,
 873            &i, &j, &k, &udc_cnt);
 874
 875         if (ret != 0)
 876                 return ret;
 877
 878         if (i != j) {
 879                 BUGPRINT("nentries does not equal the nr of entries in the "
 880                          "(last) chain\n");
 881                 return -EINVAL;
 882         }
 883         if (k != newinfo->nentries) {
 884                 BUGPRINT("Total nentries is wrong\n");
 885                 return -EINVAL;
 886         }
 887
 888         /* get the location of the udc, put them in an array
 889            while we're at it, allocate the chainstack */
 890         if (udc_cnt) {
 891                 /* this will get free'd in do_replace()/ebt_register_table()
 892                    if an error occurs */
 893                 newinfo->chainstack =
 894                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 895                 if (!newinfo->chainstack)
 896                         return -ENOMEM;
 897                 for_each_possible_cpu(i) {
 898                         newinfo->chainstack[i] =
 899                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 900                         if (!newinfo->chainstack[i]) {
 901                                 while (i)
 902                                         vfree(newinfo->chainstack[--i]);
 903                                 vfree(newinfo->chainstack);
 904                                 newinfo->chainstack = NULL;
 905                                 return -ENOMEM;
 906                         }
 907                 }
 908
 909                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 910                 if (!cl_s)
 911                         return -ENOMEM;
 912                 i = 0; /* the i'th udc */
 913                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 914                    ebt_get_udc_positions, newinfo, &i, cl_s);
 915                 /* sanity check */
 916                 if (i != udc_cnt) {
 917                         BUGPRINT("i != udc_cnt\n");
 918                         vfree(cl_s);
 919                         return -EFAULT;
 920                 }
 921         }
 922
 923         /* Check for loops */
 924         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 925                 if (newinfo->hook_entry[i])
 926                         if (check_chainloops(newinfo->hook_entry[i],
 927                            cl_s, udc_cnt, i, newinfo->entries)) {
 928                                 vfree(cl_s);
 929                                 return -EINVAL;
 930                         }
 931
 932         /* we now know the following (along with E=mc²):
 933            - the nr of entries in each chain is right
 934            - the size of the allocated space is right
 935            - all valid hooks have a corresponding chain
 936            - there are no loops
 937            - wrong data can still be on the level of a single entry
 938            - could be there are jumps to places that are not the
 939              beginning of a chain. This can only occur in chains that
 940              are not accessible from any base chains, so we don't care. */
 941
 942         /* used to know what we need to clean up if something goes wrong */
 943         i = 0;
 944         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 945            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 946         if (ret != 0) {
 947                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 948                                   ebt_cleanup_entry, net, &i);
 949         }
 950         vfree(cl_s);
 951         return ret;
 952 }
 953
 954 /* called under write_lock */
 955 static void get_counters(const struct ebt_counter *oldcounters,
 956    struct ebt_counter *counters, unsigned int nentries)
 957 {
 958         int i, cpu;
 959         struct ebt_counter *counter_base;
 960
 961         /* counters of cpu 0 */
 962         memcpy(counters, oldcounters,
 963                sizeof(struct ebt_counter) * nentries);
 964
 965         /* add other counters to those of cpu 0 */
 966         for_each_possible_cpu(cpu) {
 967                 if (cpu == 0)
 968                         continue;
 969                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 970                 for (i = 0; i < nentries; i++) {
 971                         counters[i].pcnt += counter_base[i].pcnt;
 972                         counters[i].bcnt += counter_base[i].bcnt;
 973                 }
 974         }
 975 }
 976
 977 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
 978                               struct ebt_table_info *newinfo)
 979 {
 980         int ret, i;
 981         struct ebt_counter *counterstmp = NULL;
 982         /* used to be able to unlock earlier */
 983         struct ebt_table_info *table;
 984         struct ebt_table *t;
 985
 986         /* the user wants counters back
 987            the check on the size is done later, when we have the lock */
 988         if (repl->num_counters) {
 989                 unsigned long size = repl->num_counters * sizeof(*counterstmp);
 990                 counterstmp = vmalloc(size);
 991                 if (!counterstmp)
 992                         return -ENOMEM;
 993         }
 994
 995         newinfo->chainstack = NULL;
 996         ret = ebt_verify_pointers(repl, newinfo);
 997         if (ret != 0)
 998                 goto free_counterstmp;
 999
1000         ret = translate_table(net, repl->name, newinfo);
1001
1002         if (ret != 0)
1003                 goto free_counterstmp;
1004
1005         t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
1006         if (!t) {
1007                 ret = -ENOENT;
1008                 goto free_iterate;
1009         }
1010
1011         /* the table doesn't like it */
1012         if (t->check && (ret = t->check(newinfo, repl->valid_hooks)))
1013                 goto free_unlock;
1014
1015         if (repl->num_counters && repl->num_counters != t->private->nentries) {
1016                 BUGPRINT("Wrong nr. of counters requested\n");
1017                 ret = -EINVAL;
1018                 goto free_unlock;
1019         }
1020
1021         /* we have the mutex lock, so no danger in reading this pointer */
1022         table = t->private;
1023         /* make sure the table can only be rmmod'ed if it contains no rules */
1024         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1025                 ret = -ENOENT;
1026                 goto free_unlock;
1027         } else if (table->nentries && !newinfo->nentries)
1028                 module_put(t->me);
1029         /* we need an atomic snapshot of the counters */
1030         write_lock_bh(&t->lock);
1031         if (repl->num_counters)
1032                 get_counters(t->private->counters, counterstmp,
1033                    t->private->nentries);
1034
1035         t->private = newinfo;
1036         write_unlock_bh(&t->lock);
1037         mutex_unlock(&ebt_mutex);
1038         /* so, a user can change the chains while having messed up her counter
1039            allocation. Only reason why this is done is because this way the lock
1040            is held only once, while this doesn't bring the kernel into a
1041            dangerous state. */
1042         if (repl->num_counters &&
1043            copy_to_user(repl->counters, counterstmp,
1044            repl->num_counters * sizeof(struct ebt_counter))) {
1045                 /* Silent error, can't fail, new table is already in place */
1046                 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
1047         }
1048
1049         /* decrease module count and free resources */
1050         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1051                           ebt_cleanup_entry, net, NULL);
1052
1053         vfree(table->entries);
1054         if (table->chainstack) {
1055                 for_each_possible_cpu(i)
1056                         vfree(table->chainstack[i]);
1057                 vfree(table->chainstack);
1058         }
1059         vfree(table);
1060
1061         vfree(counterstmp);
1062
1063 #ifdef CONFIG_AUDIT
1064         if (audit_enabled) {
1065                 struct audit_buffer *ab;
1066
1067                 ab = audit_log_start(current->audit_context, GFP_KERNEL,
1068                                      AUDIT_NETFILTER_CFG);
1069                 if (ab) {
1070                         audit_log_format(ab, "table=%s family=%u entries=%u",
1071                                          repl->name, AF_BRIDGE, repl->nentries);
1072                         audit_log_end(ab);
1073                 }
1074         }
1075 #endif
1076         return ret;
1077
1078 free_unlock:
1079         mutex_unlock(&ebt_mutex);
1080 free_iterate:
1081         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1082                           ebt_cleanup_entry, net, NULL);
1083 free_counterstmp:
1084         vfree(counterstmp);
1085         /* can be initialized in translate_table() */
1086         if (newinfo->chainstack) {
1087                 for_each_possible_cpu(i)
1088                         vfree(newinfo->chainstack[i]);
1089                 vfree(newinfo->chainstack);
1090         }
1091         return ret;
1092 }
1093
1094 /* replace the table */
1095 static int do_replace(struct net *net, const void __user *user,
1096                       unsigned int len)
1097 {
1098         int ret, countersize;
1099         struct ebt_table_info *newinfo;
1100         struct ebt_replace tmp;
1101
1102         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
1103                 return -EFAULT;
1104
1105         if (len != sizeof(tmp) + tmp.entries_size) {
1106                 BUGPRINT("Wrong len argument\n");
1107                 return -EINVAL;
1108         }
1109
1110         if (tmp.entries_size == 0) {
1111                 BUGPRINT("Entries_size never zero\n");
1112                 return -EINVAL;
1113         }
1114         /* overflow check */
1115         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
1116                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
1117                 return -ENOMEM;
1118         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
1119                 return -ENOMEM;
1120         if (tmp.num_counters == 0)
1121                 return -EINVAL;
1122
1123         tmp.name[sizeof(tmp.name) - 1] = 0;
1124
1125         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
1126         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1127         if (!newinfo)
1128                 return -ENOMEM;
1129
1130         if (countersize)
1131                 memset(newinfo->counters, 0, countersize);
1132
1133         newinfo->entries = vmalloc(tmp.entries_size);
1134         if (!newinfo->entries) {
1135                 ret = -ENOMEM;
1136                 goto free_newinfo;
1137         }
1138         if (copy_from_user(
1139            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1140                 BUGPRINT("Couldn't copy entries from userspace\n");
1141                 ret = -EFAULT;
1142                 goto free_entries;
1143         }
1144
1145         ret = do_replace_finish(net, &tmp, newinfo);
1146         if (ret == 0)
1147                 return ret;
1148 free_entries:
1149         vfree(newinfo->entries);
1150 free_newinfo:
1151         vfree(newinfo);
1152         return ret;
1153 }
1154
1155 struct ebt_table *
1156 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1157 {
1158         struct ebt_table_info *newinfo;
1159         struct ebt_table *t, *table;
1160         struct ebt_replace_kernel *repl;
1161         int ret, i, countersize;
1162         void *p;
1163
1164         if (input_table == NULL || (repl = input_table->table) == NULL ||
1165             repl->entries == NULL || repl->entries_size == 0 ||
1166             repl->counters != NULL || input_table->private != NULL) {
1167                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1168                 return ERR_PTR(-EINVAL);
1169         }
1170
1171         /* Don't add one table to multiple lists. */
1172         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1173         if (!table) {
1174                 ret = -ENOMEM;
1175                 goto out;
1176         }
1177
1178         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1179         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1180         ret = -ENOMEM;
1181         if (!newinfo)
1182                 goto free_table;
1183
1184         p = vmalloc(repl->entries_size);
1185         if (!p)
1186                 goto free_newinfo;
1187
1188         memcpy(p, repl->entries, repl->entries_size);
1189         newinfo->entries = p;
1190
1191         newinfo->entries_size = repl->entries_size;
1192         newinfo->nentries = repl->nentries;
1193
1194         if (countersize)
1195                 memset(newinfo->counters, 0, countersize);
1196
1197         /* fill in newinfo and parse the entries */
1198         newinfo->chainstack = NULL;
1199         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1200                 if ((repl->valid_hooks & (1 << i)) == 0)
1201                         newinfo->hook_entry[i] = NULL;
1202                 else
1203                         newinfo->hook_entry[i] = p +
1204                                 ((char *)repl->hook_entry[i] - repl->entries);
1205         }
1206         ret = translate_table(net, repl->name, newinfo);
1207         if (ret != 0) {
1208                 BUGPRINT("Translate_table failed\n");
1209                 goto free_chainstack;
1210         }
1211
1212         if (table->check && table->check(newinfo, table->valid_hooks)) {
1213                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1214                 ret = -EINVAL;
1215                 goto free_chainstack;
1216         }
1217
1218         table->private = newinfo;
1219         rwlock_init(&table->lock);
1220         mutex_lock(&ebt_mutex);
1221         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1222                 if (strcmp(t->name, table->name) == 0) {
1223                         ret = -EEXIST;
1224                         BUGPRINT("Table name already exists\n");
1225                         goto free_unlock;
1226                 }
1227         }
1228
1229         /* Hold a reference count if the chains aren't empty */
1230         if (newinfo->nentries && !try_module_get(table->me)) {
1231                 ret = -ENOENT;
1232                 goto free_unlock;
1233         }
1234         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1235         mutex_unlock(&ebt_mutex);
1236         return table;
1237 free_unlock:
1238         mutex_unlock(&ebt_mutex);
1239 free_chainstack:
1240         if (newinfo->chainstack) {
1241                 for_each_possible_cpu(i)
1242                         vfree(newinfo->chainstack[i]);
1243                 vfree(newinfo->chainstack);
1244         }
1245         vfree(newinfo->entries);
1246 free_newinfo:
1247         vfree(newinfo);
1248 free_table:
1249         kfree(table);
1250 out:
1251         return ERR_PTR(ret);
1252 }
1253
1254 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1255 {
1256         int i;
1257
1258         if (!table) {
1259                 BUGPRINT("Request to unregister NULL table!!!\n");
1260                 return;
1261         }
1262         mutex_lock(&ebt_mutex);
1263         list_del(&table->list);
1264         mutex_unlock(&ebt_mutex);
1265         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1266                           ebt_cleanup_entry, net, NULL);
1267         if (table->private->nentries)
1268                 module_put(table->me);
1269         vfree(table->private->entries);
1270         if (table->private->chainstack) {
1271                 for_each_possible_cpu(i)
1272                         vfree(table->private->chainstack[i]);
1273                 vfree(table->private->chainstack);
1274         }
1275         vfree(table->private);
1276         kfree(table);
1277 }
1278
1279 /* userspace just supplied us with counters */
1280 static int do_update_counters(struct net *net, const char *name,
1281                                 struct ebt_counter __user *counters,
1282                                 unsigned int num_counters,
1283                                 const void __user *user, unsigned int len)
1284 {
1285         int i, ret;
1286         struct ebt_counter *tmp;
1287         struct ebt_table *t;
1288
1289         if (num_counters == 0)
1290                 return -EINVAL;
1291
1292         tmp = vmalloc(num_counters * sizeof(*tmp));
1293         if (!tmp)
1294                 return -ENOMEM;
1295
1296         t = find_table_lock(net, name, &ret, &ebt_mutex);
1297         if (!t)
1298                 goto free_tmp;
1299
1300         if (num_counters != t->private->nentries) {
1301                 BUGPRINT("Wrong nr of counters\n");
1302                 ret = -EINVAL;
1303                 goto unlock_mutex;
1304         }
1305
1306         if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
1307                 ret = -EFAULT;
1308                 goto unlock_mutex;
1309         }
1310
1311         /* we want an atomic add of the counters */
1312         write_lock_bh(&t->lock);
1313
1314         /* we add to the counters of the first cpu */
1315         for (i = 0; i < num_counters; i++) {
1316                 t->private->counters[i].pcnt += tmp[i].pcnt;
1317                 t->private->counters[i].bcnt += tmp[i].bcnt;
1318         }
1319
1320         write_unlock_bh(&t->lock);
1321         ret = 0;
1322 unlock_mutex:
1323         mutex_unlock(&ebt_mutex);
1324 free_tmp:
1325         vfree(tmp);
1326         return ret;
1327 }
1328
1329 static int update_counters(struct net *net, const void __user *user,
1330                             unsigned int len)
1331 {
1332         struct ebt_replace hlp;
1333
1334         if (copy_from_user(&hlp, user, sizeof(hlp)))
1335                 return -EFAULT;
1336
1337         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1338                 return -EINVAL;
1339
1340         return do_update_counters(net, hlp.name, hlp.counters,
1341                                 hlp.num_counters, user, len);
1342 }
1343
1344 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1345     const char *base, char __user *ubase)
1346 {
1347         char __user *hlp = ubase + ((char *)m - base);
1348         char name[EBT_FUNCTION_MAXNAMELEN] = {};
1349
1350         /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
1351            long. Copy 29 bytes and fill remaining bytes with zeroes. */
1352         strlcpy(name, m->u.match->name, sizeof(name));
1353         if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1354                 return -EFAULT;
1355         return 0;
1356 }
1357
1358 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1359     const char *base, char __user *ubase)
1360 {
1361         char __user *hlp = ubase + ((char *)w - base);
1362         char name[EBT_FUNCTION_MAXNAMELEN] = {};
1363
1364         strlcpy(name, w->u.watcher->name, sizeof(name));
1365         if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
1366                 return -EFAULT;
1367         return 0;
1368 }
1369
1370 static inline int
1371 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1372 {
1373         int ret;
1374         char __user *hlp;
1375         const struct ebt_entry_target *t;
1376         char name[EBT_FUNCTION_MAXNAMELEN] = {};
1377
1378         if (e->bitmask == 0)
1379                 return 0;
1380
1381         hlp = ubase + (((char *)e + e->target_offset) - base);
1382         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1383
1384         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1385         if (ret != 0)
1386                 return ret;
1387         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1388         if (ret != 0)
1389                 return ret;
1390         strlcpy(name, t->u.target->name, sizeof(name));
1391         if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
1392                 return -EFAULT;
1393         return 0;
1394 }
1395
1396 static int copy_counters_to_user(struct ebt_table *t,
1397                                   const struct ebt_counter *oldcounters,
1398                                   void __user *user, unsigned int num_counters,
1399                                   unsigned int nentries)
1400 {
1401         struct ebt_counter *counterstmp;
1402         int ret = 0;
1403
1404         /* userspace might not need the counters */
1405         if (num_counters == 0)
1406                 return 0;
1407
1408         if (num_counters != nentries) {
1409                 BUGPRINT("Num_counters wrong\n");
1410                 return -EINVAL;
1411         }
1412
1413         counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1414         if (!counterstmp)
1415                 return -ENOMEM;
1416
1417         write_lock_bh(&t->lock);
1418         get_counters(oldcounters, counterstmp, nentries);
1419         write_unlock_bh(&t->lock);
1420
1421         if (copy_to_user(user, counterstmp,
1422            nentries * sizeof(struct ebt_counter)))
1423                 ret = -EFAULT;
1424         vfree(counterstmp);
1425         return ret;
1426 }
1427
1428 /* called with ebt_mutex locked */
1429 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1430     const int *len, int cmd)
1431 {
1432         struct ebt_replace tmp;
1433         const struct ebt_counter *oldcounters;
1434         unsigned int entries_size, nentries;
1435         int ret;
1436         char *entries;
1437
1438         if (cmd == EBT_SO_GET_ENTRIES) {
1439                 entries_size = t->private->entries_size;
1440                 nentries = t->private->nentries;
1441                 entries = t->private->entries;
1442                 oldcounters = t->private->counters;
1443         } else {
1444                 entries_size = t->table->entries_size;
1445                 nentries = t->table->nentries;
1446                 entries = t->table->entries;
1447                 oldcounters = t->table->counters;
1448         }
1449
1450         if (copy_from_user(&tmp, user, sizeof(tmp)))
1451                 return -EFAULT;
1452
1453         if (*len != sizeof(struct ebt_replace) + entries_size +
1454            (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
1455                 return -EINVAL;
1456
1457         if (tmp.nentries != nentries) {
1458                 BUGPRINT("Nentries wrong\n");
1459                 return -EINVAL;
1460         }
1461
1462         if (tmp.entries_size != entries_size) {
1463                 BUGPRINT("Wrong size\n");
1464                 return -EINVAL;
1465         }
1466
1467         ret = copy_counters_to_user(t, oldcounters, tmp.counters,
1468                                         tmp.num_counters, nentries);
1469         if (ret)
1470                 return ret;
1471
1472         if (copy_to_user(tmp.entries, entries, entries_size)) {
1473                 BUGPRINT("Couldn't copy entries to userspace\n");
1474                 return -EFAULT;
1475         }
1476         /* set the match/watcher/target names right */
1477         return EBT_ENTRY_ITERATE(entries, entries_size,
1478            ebt_make_names, entries, tmp.entries);
1479 }
1480
1481 static int do_ebt_set_ctl(struct sock *sk,
1482         int cmd, void __user *user, unsigned int len)
1483 {
1484         int ret;
1485         struct net *net = sock_net(sk);
1486
1487         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1488                 return -EPERM;
1489
1490         switch (cmd) {
1491         case EBT_SO_SET_ENTRIES:
1492                 ret = do_replace(net, user, len);
1493                 break;
1494         case EBT_SO_SET_COUNTERS:
1495                 ret = update_counters(net, user, len);
1496                 break;
1497         default:
1498                 ret = -EINVAL;
1499         }
1500         return ret;
1501 }
1502
1503 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1504 {
1505         int ret;
1506         struct ebt_replace tmp;
1507         struct ebt_table *t;
1508         struct net *net = sock_net(sk);
1509
1510         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1511                 return -EPERM;
1512
1513         if (copy_from_user(&tmp, user, sizeof(tmp)))
1514                 return -EFAULT;
1515
1516         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1517         if (!t)
1518                 return ret;
1519
1520         switch (cmd) {
1521         case EBT_SO_GET_INFO:
1522         case EBT_SO_GET_INIT_INFO:
1523                 if (*len != sizeof(struct ebt_replace)) {
1524                         ret = -EINVAL;
1525                         mutex_unlock(&ebt_mutex);
1526                         break;
1527                 }
1528                 if (cmd == EBT_SO_GET_INFO) {
1529                         tmp.nentries = t->private->nentries;
1530                         tmp.entries_size = t->private->entries_size;
1531                         tmp.valid_hooks = t->valid_hooks;
1532                 } else {
1533                         tmp.nentries = t->table->nentries;
1534                         tmp.entries_size = t->table->entries_size;
1535                         tmp.valid_hooks = t->table->valid_hooks;
1536                 }
1537                 mutex_unlock(&ebt_mutex);
1538                 if (copy_to_user(user, &tmp, *len) != 0) {
1539                         BUGPRINT("c2u Didn't work\n");
1540                         ret = -EFAULT;
1541                         break;
1542                 }
1543                 ret = 0;
1544                 break;
1545
1546         case EBT_SO_GET_ENTRIES:
1547         case EBT_SO_GET_INIT_ENTRIES:
1548                 ret = copy_everything_to_user(t, user, len, cmd);
1549                 mutex_unlock(&ebt_mutex);
1550                 break;
1551
1552         default:
1553                 mutex_unlock(&ebt_mutex);
1554                 ret = -EINVAL;
1555         }
1556
1557         return ret;
1558 }
1559
1560 #ifdef CONFIG_COMPAT
1561 /* 32 bit-userspace compatibility definitions. */
1562 struct compat_ebt_replace {
1563         char name[EBT_TABLE_MAXNAMELEN];
1564         compat_uint_t valid_hooks;
1565         compat_uint_t nentries;
1566         compat_uint_t entries_size;
1567         /* start of the chains */
1568         compat_uptr_t hook_entry[NF_BR_NUMHOOKS];
1569         /* nr of counters userspace expects back */
1570         compat_uint_t num_counters;
1571         /* where the kernel will put the old counters. */
1572         compat_uptr_t counters;
1573         compat_uptr_t entries;
1574 };
1575
1576 /* struct ebt_entry_match, _target and _watcher have same layout */
1577 struct compat_ebt_entry_mwt {
1578         union {
1579                 char name[EBT_FUNCTION_MAXNAMELEN];
1580                 compat_uptr_t ptr;
1581         } u;
1582         compat_uint_t match_size;
1583         compat_uint_t data[0];
1584 };
1585
1586 /* account for possible padding between match_size and ->data */
1587 static int ebt_compat_entry_padsize(void)
1588 {
1589         BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
1590                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
1591         return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
1592                         COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
1593 }
1594
1595 static int ebt_compat_match_offset(const struct xt_match *match,
1596                                    unsigned int userlen)
1597 {
1598         /*
1599          * ebt_among needs special handling. The kernel .matchsize is
1600          * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1601          * value is expected.
1602          * Example: userspace sends 4500, ebt_among.c wants 4504.
1603          */
1604         if (unlikely(match->matchsize == -1))
1605                 return XT_ALIGN(userlen) - COMPAT_XT_ALIGN(userlen);
1606         return xt_compat_match_offset(match);
1607 }
1608
1609 static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
1610                                 unsigned int *size)
1611 {
1612         const struct xt_match *match = m->u.match;
1613         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1614         int off = ebt_compat_match_offset(match, m->match_size);
1615         compat_uint_t msize = m->match_size - off;
1616
1617         BUG_ON(off >= m->match_size);
1618
1619         if (copy_to_user(cm->u.name, match->name,
1620             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
1621                 return -EFAULT;
1622
1623         if (match->compat_to_user) {
1624                 if (match->compat_to_user(cm->data, m->data))
1625                         return -EFAULT;
1626         } else if (copy_to_user(cm->data, m->data, msize))
1627                         return -EFAULT;
1628
1629         *size -= ebt_compat_entry_padsize() + off;
1630         *dstptr = cm->data;
1631         *dstptr += msize;
1632         return 0;
1633 }
1634
1635 static int compat_target_to_user(struct ebt_entry_target *t,
1636                                  void __user **dstptr,
1637                                  unsigned int *size)
1638 {
1639         const struct xt_target *target = t->u.target;
1640         struct compat_ebt_entry_mwt __user *cm = *dstptr;
1641         int off = xt_compat_target_offset(target);
1642         compat_uint_t tsize = t->target_size - off;
1643
1644         BUG_ON(off >= t->target_size);
1645
1646         if (copy_to_user(cm->u.name, target->name,
1647             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
1648                 return -EFAULT;
1649
1650         if (target->compat_to_user) {
1651                 if (target->compat_to_user(cm->data, t->data))
1652                         return -EFAULT;
1653         } else if (copy_to_user(cm->data, t->data, tsize))
1654                 return -EFAULT;
1655
1656         *size -= ebt_compat_entry_padsize() + off;
1657         *dstptr = cm->data;
1658         *dstptr += tsize;
1659         return 0;
1660 }
1661
1662 static int compat_watcher_to_user(struct ebt_entry_watcher *w,
1663                                   void __user **dstptr,
1664                                   unsigned int *size)
1665 {
1666         return compat_target_to_user((struct ebt_entry_target *)w,
1667                                                         dstptr, size);
1668 }
1669
1670 static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
1671                                 unsigned int *size)
1672 {
1673         struct ebt_entry_target *t;
1674         struct ebt_entry __user *ce;
1675         u32 watchers_offset, target_offset, next_offset;
1676         compat_uint_t origsize;
1677         int ret;
1678
1679         if (e->bitmask == 0) {
1680                 if (*size < sizeof(struct ebt_entries))
1681                         return -EINVAL;
1682                 if (copy_to_user(*dstptr, e, sizeof(struct ebt_entries)))
1683                         return -EFAULT;
1684
1685                 *dstptr += sizeof(struct ebt_entries);
1686                 *size -= sizeof(struct ebt_entries);
1687                 return 0;
1688         }
1689
1690         if (*size < sizeof(*ce))
1691                 return -EINVAL;
1692
1693         ce = (struct ebt_entry __user *)*dstptr;
1694         if (copy_to_user(ce, e, sizeof(*ce)))
1695                 return -EFAULT;
1696
1697         origsize = *size;
1698         *dstptr += sizeof(*ce);
1699
1700         ret = EBT_MATCH_ITERATE(e, compat_match_to_user, dstptr, size);
1701         if (ret)
1702                 return ret;
1703         watchers_offset = e->watchers_offset - (origsize - *size);
1704
1705         ret = EBT_WATCHER_ITERATE(e, compat_watcher_to_user, dstptr, size);
1706         if (ret)
1707                 return ret;
1708         target_offset = e->target_offset - (origsize - *size);
1709
1710         t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
1711
1712         ret = compat_target_to_user(t, dstptr, size);
1713         if (ret)
1714                 return ret;
1715         next_offset = e->next_offset - (origsize - *size);
1716
1717         if (put_user(watchers_offset, &ce->watchers_offset) ||
1718             put_user(target_offset, &ce->target_offset) ||
1719             put_user(next_offset, &ce->next_offset))
1720                 return -EFAULT;
1721
1722         *size -= sizeof(*ce);
1723         return 0;
1724 }
1725
1726 static int compat_calc_match(struct ebt_entry_match *m, int *off)
1727 {
1728         *off += ebt_compat_match_offset(m->u.match, m->match_size);
1729         *off += ebt_compat_entry_padsize();
1730         return 0;
1731 }
1732
1733 static int compat_calc_watcher(struct ebt_entry_watcher *w, int *off)
1734 {
1735         *off += xt_compat_target_offset(w->u.watcher);
1736         *off += ebt_compat_entry_padsize();
1737         return 0;
1738 }
1739
1740 static int compat_calc_entry(const struct ebt_entry *e,
1741                              const struct ebt_table_info *info,
1742                              const void *base,
1743                              struct compat_ebt_replace *newinfo)
1744 {
1745         const struct ebt_entry_target *t;
1746         unsigned int entry_offset;
1747         int off, ret, i;
1748
1749         if (e->bitmask == 0)
1750                 return 0;
1751
1752         off = 0;
1753         entry_offset = (void *)e - base;
1754
1755         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
1756         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
1757
1758         t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
1759
1760         off += xt_compat_target_offset(t->u.target);
1761         off += ebt_compat_entry_padsize();
1762
1763         newinfo->entries_size -= off;
1764
1765         ret = xt_compat_add_offset(NFPROTO_BRIDGE, entry_offset, off);
1766         if (ret)
1767                 return ret;
1768
1769         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1770                 const void *hookptr = info->hook_entry[i];
1771                 if (info->hook_entry[i] &&
1772                     (e < (struct ebt_entry *)(base - hookptr))) {
1773                         newinfo->hook_entry[i] -= off;
1774                         pr_debug("0x%08X -> 0x%08X\n",
1775                                         newinfo->hook_entry[i] + off,
1776                                         newinfo->hook_entry[i]);
1777                 }
1778         }
1779
1780         return 0;
1781 }
1782
1783
1784 static int compat_table_info(const struct ebt_table_info *info,
1785                              struct compat_ebt_replace *newinfo)
1786 {
1787         unsigned int size = info->entries_size;
1788         const void *entries = info->entries;
1789
1790         newinfo->entries_size = size;
1791
1792         xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
1793         return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
1794                                                         entries, newinfo);
1795 }
1796
1797 static int compat_copy_everything_to_user(struct ebt_table *t,
1798                                           void __user *user, int *len, int cmd)
1799 {
1800         struct compat_ebt_replace repl, tmp;
1801         struct ebt_counter *oldcounters;
1802         struct ebt_table_info tinfo;
1803         int ret;
1804         void __user *pos;
1805
1806         memset(&tinfo, 0, sizeof(tinfo));
1807
1808         if (cmd == EBT_SO_GET_ENTRIES) {
1809                 tinfo.entries_size = t->private->entries_size;
1810                 tinfo.nentries = t->private->nentries;
1811                 tinfo.entries = t->private->entries;
1812                 oldcounters = t->private->counters;
1813         } else {
1814                 tinfo.entries_size = t->table->entries_size;
1815                 tinfo.nentries = t->table->nentries;
1816                 tinfo.entries = t->table->entries;
1817                 oldcounters = t->table->counters;
1818         }
1819
1820         if (copy_from_user(&tmp, user, sizeof(tmp)))
1821                 return -EFAULT;
1822
1823         if (tmp.nentries != tinfo.nentries ||
1824            (tmp.num_counters && tmp.num_counters != tinfo.nentries))
1825                 return -EINVAL;
1826
1827         memcpy(&repl, &tmp, sizeof(repl));
1828         if (cmd == EBT_SO_GET_ENTRIES)
1829                 ret = compat_table_info(t->private, &repl);
1830         else
1831                 ret = compat_table_info(&tinfo, &repl);
1832         if (ret)
1833                 return ret;
1834
1835         if (*len != sizeof(tmp) + repl.entries_size +
1836            (tmp.num_counters? tinfo.nentries * sizeof(struct ebt_counter): 0)) {
1837                 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1838                                 *len, tinfo.entries_size, repl.entries_size);
1839                 return -EINVAL;
1840         }
1841
1842         /* userspace might not need the counters */
1843         ret = copy_counters_to_user(t, oldcounters, compat_ptr(tmp.counters),
1844                                         tmp.num_counters, tinfo.nentries);
1845         if (ret)
1846                 return ret;
1847
1848         pos = compat_ptr(tmp.entries);
1849         return EBT_ENTRY_ITERATE(tinfo.entries, tinfo.entries_size,
1850                         compat_copy_entry_to_user, &pos, &tmp.entries_size);
1851 }
1852
1853 struct ebt_entries_buf_state {
1854         char *buf_kern_start;   /* kernel buffer to copy (translated) data to */
1855         u32 buf_kern_len;       /* total size of kernel buffer */
1856         u32 buf_kern_offset;    /* amount of data copied so far */
1857         u32 buf_user_offset;    /* read position in userspace buffer */
1858 };
1859
1860 static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz)
1861 {
1862         state->buf_kern_offset += sz;
1863         return state->buf_kern_offset >= sz ? 0 : -EINVAL;
1864 }
1865
1866 static int ebt_buf_add(struct ebt_entries_buf_state *state,
1867                        void *data, unsigned int sz)
1868 {
1869         if (state->buf_kern_start == NULL)
1870                 goto count_only;
1871
1872         BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
1873
1874         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
1875
1876  count_only:
1877         state->buf_user_offset += sz;
1878         return ebt_buf_count(state, sz);
1879 }
1880
1881 static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
1882 {
1883         char *b = state->buf_kern_start;
1884
1885         BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
1886
1887         if (b != NULL && sz > 0)
1888                 memset(b + state->buf_kern_offset, 0, sz);
1889         /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1890         return ebt_buf_count(state, sz);
1891 }
1892
1893 enum compat_mwt {
1894         EBT_COMPAT_MATCH,
1895         EBT_COMPAT_WATCHER,
1896         EBT_COMPAT_TARGET,
1897 };
1898
1899 static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
1900                                 enum compat_mwt compat_mwt,
1901                                 struct ebt_entries_buf_state *state,
1902                                 const unsigned char *base)
1903 {
1904         char name[EBT_FUNCTION_MAXNAMELEN];
1905         struct xt_match *match;
1906         struct xt_target *wt;
1907         void *dst = NULL;
1908         int off, pad = 0;
1909         unsigned int size_kern, match_size = mwt->match_size;
1910
1911         strlcpy(name, mwt->u.name, sizeof(name));
1912
1913         if (state->buf_kern_start)
1914                 dst = state->buf_kern_start + state->buf_kern_offset;
1915
1916         switch (compat_mwt) {
1917         case EBT_COMPAT_MATCH:
1918                 match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
1919                 if (IS_ERR(match))
1920                         return PTR_ERR(match);
1921
1922                 off = ebt_compat_match_offset(match, match_size);
1923                 if (dst) {
1924                         if (match->compat_from_user)
1925                                 match->compat_from_user(dst, mwt->data);
1926                         else
1927                                 memcpy(dst, mwt->data, match_size);
1928                 }
1929
1930                 size_kern = match->matchsize;
1931                 if (unlikely(size_kern == -1))
1932                         size_kern = match_size;
1933                 module_put(match->me);
1934                 break;
1935         case EBT_COMPAT_WATCHER: /* fallthrough */
1936         case EBT_COMPAT_TARGET:
1937                 wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
1938                 if (IS_ERR(wt))
1939                         return PTR_ERR(wt);
1940                 off = xt_compat_target_offset(wt);
1941
1942                 if (dst) {
1943                         if (wt->compat_from_user)
1944                                 wt->compat_from_user(dst, mwt->data);
1945                         else
1946                                 memcpy(dst, mwt->data, match_size);
1947                 }
1948
1949                 size_kern = wt->targetsize;
1950                 module_put(wt->me);
1951                 break;
1952
1953         default:
1954                 return -EINVAL;
1955         }
1956
1957         state->buf_kern_offset += match_size + off;
1958         state->buf_user_offset += match_size;
1959         pad = XT_ALIGN(size_kern) - size_kern;
1960
1961         if (pad > 0 && dst) {
1962                 BUG_ON(state->buf_kern_len <= pad);
1963                 BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
1964                 memset(dst + size_kern, 0, pad);
1965         }
1966         return off + match_size;
1967 }
1968
1969 /*
1970  * return size of all matches, watchers or target, including necessary
1971  * alignment and padding.
1972  */
1973 static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
1974                         unsigned int size_left, enum compat_mwt type,
1975                         struct ebt_entries_buf_state *state, const void *base)
1976 {
1977         int growth = 0;
1978         char *buf;
1979
1980         if (size_left == 0)
1981                 return 0;
1982
1983         buf = (char *) match32;
1984
1985         while (size_left >= sizeof(*match32)) {
1986                 struct ebt_entry_match *match_kern;
1987                 int ret;
1988
1989                 match_kern = (struct ebt_entry_match *) state->buf_kern_start;
1990                 if (match_kern) {
1991                         char *tmp;
1992                         tmp = state->buf_kern_start + state->buf_kern_offset;
1993                         match_kern = (struct ebt_entry_match *) tmp;
1994                 }
1995                 ret = ebt_buf_add(state, buf, sizeof(*match32));
1996                 if (ret < 0)
1997                         return ret;
1998                 size_left -= sizeof(*match32);
1999
2000                 /* add padding before match->data (if any) */
2001                 ret = ebt_buf_add_pad(state, ebt_compat_entry_padsize());
2002                 if (ret < 0)
2003                         return ret;
2004
2005                 if (match32->match_size > size_left)
2006                         return -EINVAL;
2007
2008                 size_left -= match32->match_size;
2009
2010                 ret = compat_mtw_from_user(match32, type, state, base);
2011                 if (ret < 0)
2012                         return ret;
2013
2014                 BUG_ON(ret < match32->match_size);
2015                 growth += ret - match32->match_size;
2016                 growth += ebt_compat_entry_padsize();
2017
2018                 buf += sizeof(*match32);
2019                 buf += match32->match_size;
2020
2021                 if (match_kern)
2022                         match_kern->match_size = ret;
2023
2024                 WARN_ON(type == EBT_COMPAT_TARGET && size_left);
2025                 match32 = (struct compat_ebt_entry_mwt *) buf;
2026         }
2027
2028         return growth;
2029 }
2030
2031 /* called for all ebt_entry structures. */
2032 static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
2033                           unsigned int *total,
2034                           struct ebt_entries_buf_state *state)
2035 {
2036         unsigned int i, j, startoff, new_offset = 0;
2037         /* stores match/watchers/targets & offset of next struct ebt_entry: */
2038         unsigned int offsets[4];
2039         unsigned int *offsets_update = NULL;
2040         int ret;
2041         char *buf_start;
2042
2043         if (*total < sizeof(struct ebt_entries))
2044                 return -EINVAL;
2045
2046         if (!entry->bitmask) {
2047                 *total -= sizeof(struct ebt_entries);
2048                 return ebt_buf_add(state, entry, sizeof(struct ebt_entries));
2049         }
2050         if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))
2051                 return -EINVAL;
2052
2053         startoff = state->buf_user_offset;
2054         /* pull in most part of ebt_entry, it does not need to be changed. */
2055         ret = ebt_buf_add(state, entry,
2056                         offsetof(struct ebt_entry, watchers_offset));
2057         if (ret < 0)
2058                 return ret;
2059
2060         offsets[0] = sizeof(struct ebt_entry); /* matches come first */
2061         memcpy(&offsets[1], &entry->watchers_offset,
2062                         sizeof(offsets) - sizeof(offsets[0]));
2063
2064         if (state->buf_kern_start) {
2065                 buf_start = state->buf_kern_start + state->buf_kern_offset;
2066                 offsets_update = (unsigned int *) buf_start;
2067         }
2068         ret = ebt_buf_add(state, &offsets[1],
2069                         sizeof(offsets) - sizeof(offsets[0]));
2070         if (ret < 0)
2071                 return ret;
2072         buf_start = (char *) entry;
2073         /*
2074          * 0: matches offset, always follows ebt_entry.
2075          * 1: watchers offset, from ebt_entry structure
2076          * 2: target offset, from ebt_entry structure
2077          * 3: next ebt_entry offset, from ebt_entry structure
2078          *
2079          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2080          */
2081         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
2082                 struct compat_ebt_entry_mwt *match32;
2083                 unsigned int size;
2084                 char *buf = buf_start;
2085
2086                 buf = buf_start + offsets[i];
2087                 if (offsets[i] > offsets[j])
2088                         return -EINVAL;
2089
2090                 match32 = (struct compat_ebt_entry_mwt *) buf;
2091                 size = offsets[j] - offsets[i];
2092                 ret = ebt_size_mwt(match32, size, i, state, base);
2093                 if (ret < 0)
2094                         return ret;
2095                 new_offset += ret;
2096                 if (offsets_update && new_offset) {
2097                         pr_debug("change offset %d to %d\n",
2098                                 offsets_update[i], offsets[j] + new_offset);
2099                         offsets_update[i] = offsets[j] + new_offset;
2100                 }
2101         }
2102
2103         if (state->buf_kern_start == NULL) {
2104                 unsigned int offset = buf_start - (char *) base;
2105
2106                 ret = xt_compat_add_offset(NFPROTO_BRIDGE, offset, new_offset);
2107                 if (ret < 0)
2108                         return ret;
2109         }
2110
2111         startoff = state->buf_user_offset - startoff;
2112
2113         BUG_ON(*total < startoff);
2114         *total -= startoff;
2115         return 0;
2116 }
2117
2118 /*
2119  * repl->entries_size is the size of the ebt_entry blob in userspace.
2120  * It might need more memory when copied to a 64 bit kernel in case
2121  * userspace is 32-bit. So, first task: find out how much memory is needed.
2122  *
2123  * Called before validation is performed.
2124  */
2125 static int compat_copy_entries(unsigned char *data, unsigned int size_user,
2126                                 struct ebt_entries_buf_state *state)
2127 {
2128         unsigned int size_remaining = size_user;
2129         int ret;
2130
2131         ret = EBT_ENTRY_ITERATE(data, size_user, size_entry_mwt, data,
2132                                         &size_remaining, state);
2133         if (ret < 0)
2134                 return ret;
2135
2136         WARN_ON(size_remaining);
2137         return state->buf_kern_offset;
2138 }
2139
2140
2141 static int compat_copy_ebt_replace_from_user(struct ebt_replace *repl,
2142                                             void __user *user, unsigned int len)
2143 {
2144         struct compat_ebt_replace tmp;
2145         int i;
2146
2147         if (len < sizeof(tmp))
2148                 return -EINVAL;
2149
2150         if (copy_from_user(&tmp, user, sizeof(tmp)))
2151                 return -EFAULT;
2152
2153         if (len != sizeof(tmp) + tmp.entries_size)
2154                 return -EINVAL;
2155
2156         if (tmp.entries_size == 0)
2157                 return -EINVAL;
2158
2159         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) /
2160                         NR_CPUS - SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
2161                 return -ENOMEM;
2162         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
2163                 return -ENOMEM;
2164         if (tmp.num_counters == 0)
2165                 return -EINVAL;
2166
2167         memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
2168
2169         /* starting with hook_entry, 32 vs. 64 bit structures are different */
2170         for (i = 0; i < NF_BR_NUMHOOKS; i++)
2171                 repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
2172
2173         repl->num_counters = tmp.num_counters;
2174         repl->counters = compat_ptr(tmp.counters);
2175         repl->entries = compat_ptr(tmp.entries);
2176         return 0;
2177 }
2178
2179 static int compat_do_replace(struct net *net, void __user *user,
2180                              unsigned int len)
2181 {
2182         int ret, i, countersize, size64;
2183         struct ebt_table_info *newinfo;
2184         struct ebt_replace tmp;
2185         struct ebt_entries_buf_state state;
2186         void *entries_tmp;
2187
2188         ret = compat_copy_ebt_replace_from_user(&tmp, user, len);
2189         if (ret) {
2190                 /* try real handler in case userland supplied needed padding */
2191                 if (ret == -EINVAL && do_replace(net, user, len) == 0)
2192                         ret = 0;
2193                 return ret;
2194         }
2195
2196         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
2197         newinfo = vmalloc(sizeof(*newinfo) + countersize);
2198         if (!newinfo)
2199                 return -ENOMEM;
2200
2201         if (countersize)
2202                 memset(newinfo->counters, 0, countersize);
2203
2204         memset(&state, 0, sizeof(state));
2205
2206         newinfo->entries = vmalloc(tmp.entries_size);
2207         if (!newinfo->entries) {
2208                 ret = -ENOMEM;
2209                 goto free_newinfo;
2210         }
2211         if (copy_from_user(
2212            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2213                 ret = -EFAULT;
2214                 goto free_entries;
2215         }
2216
2217         entries_tmp = newinfo->entries;
2218
2219         xt_compat_lock(NFPROTO_BRIDGE);
2220
2221         xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
2222         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2223         if (ret < 0)
2224                 goto out_unlock;
2225
2226         pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2227                 tmp.entries_size, state.buf_kern_offset, state.buf_user_offset,
2228                 xt_compat_calc_jump(NFPROTO_BRIDGE, tmp.entries_size));
2229
2230         size64 = ret;
2231         newinfo->entries = vmalloc(size64);
2232         if (!newinfo->entries) {
2233                 vfree(entries_tmp);
2234                 ret = -ENOMEM;
2235                 goto out_unlock;
2236         }
2237
2238         memset(&state, 0, sizeof(state));
2239         state.buf_kern_start = newinfo->entries;
2240         state.buf_kern_len = size64;
2241
2242         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
2243         BUG_ON(ret < 0);        /* parses same data again */
2244
2245         vfree(entries_tmp);
2246         tmp.entries_size = size64;
2247
2248         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2249                 char __user *usrptr;
2250                 if (tmp.hook_entry[i]) {
2251                         unsigned int delta;
2252                         usrptr = (char __user *) tmp.hook_entry[i];
2253                         delta = usrptr - tmp.entries;
2254                         usrptr += xt_compat_calc_jump(NFPROTO_BRIDGE, delta);
2255                         tmp.hook_entry[i] = (struct ebt_entries __user *)usrptr;
2256                 }
2257         }
2258
2259         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2260         xt_compat_unlock(NFPROTO_BRIDGE);
2261
2262         ret = do_replace_finish(net, &tmp, newinfo);
2263         if (ret == 0)
2264                 return ret;
2265 free_entries:
2266         vfree(newinfo->entries);
2267 free_newinfo:
2268         vfree(newinfo);
2269         return ret;
2270 out_unlock:
2271         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2272         xt_compat_unlock(NFPROTO_BRIDGE);
2273         goto free_entries;
2274 }
2275
2276 static int compat_update_counters(struct net *net, void __user *user,
2277                                   unsigned int len)
2278 {
2279         struct compat_ebt_replace hlp;
2280
2281         if (copy_from_user(&hlp, user, sizeof(hlp)))
2282                 return -EFAULT;
2283
2284         /* try real handler in case userland supplied needed padding */
2285         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2286                 return update_counters(net, user, len);
2287
2288         return do_update_counters(net, hlp.name, compat_ptr(hlp.counters),
2289                                         hlp.num_counters, user, len);
2290 }
2291
2292 static int compat_do_ebt_set_ctl(struct sock *sk,
2293                 int cmd, void __user *user, unsigned int len)
2294 {
2295         int ret;
2296         struct net *net = sock_net(sk);
2297
2298         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2299                 return -EPERM;
2300
2301         switch (cmd) {
2302         case EBT_SO_SET_ENTRIES:
2303                 ret = compat_do_replace(net, user, len);
2304                 break;
2305         case EBT_SO_SET_COUNTERS:
2306                 ret = compat_update_counters(net, user, len);
2307                 break;
2308         default:
2309                 ret = -EINVAL;
2310   }
2311         return ret;
2312 }
2313
2314 static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
2315                 void __user *user, int *len)
2316 {
2317         int ret;
2318         struct compat_ebt_replace tmp;
2319         struct ebt_table *t;
2320         struct net *net = sock_net(sk);
2321
2322         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2323                 return -EPERM;
2324
2325         /* try real handler in case userland supplied needed padding */
2326         if ((cmd == EBT_SO_GET_INFO ||
2327              cmd == EBT_SO_GET_INIT_INFO) && *len != sizeof(tmp))
2328                         return do_ebt_get_ctl(sk, cmd, user, len);
2329
2330         if (copy_from_user(&tmp, user, sizeof(tmp)))
2331                 return -EFAULT;
2332
2333         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
2334         if (!t)
2335                 return ret;
2336
2337         xt_compat_lock(NFPROTO_BRIDGE);
2338         switch (cmd) {
2339         case EBT_SO_GET_INFO:
2340                 tmp.nentries = t->private->nentries;
2341                 ret = compat_table_info(t->private, &tmp);
2342                 if (ret)
2343                         goto out;
2344                 tmp.valid_hooks = t->valid_hooks;
2345
2346                 if (copy_to_user(user, &tmp, *len) != 0) {
2347                         ret = -EFAULT;
2348                         break;
2349                 }
2350                 ret = 0;
2351                 break;
2352         case EBT_SO_GET_INIT_INFO:
2353                 tmp.nentries = t->table->nentries;
2354                 tmp.entries_size = t->table->entries_size;
2355                 tmp.valid_hooks = t->table->valid_hooks;
2356
2357                 if (copy_to_user(user, &tmp, *len) != 0) {
2358                         ret = -EFAULT;
2359                         break;
2360                 }
2361                 ret = 0;
2362                 break;
2363         case EBT_SO_GET_ENTRIES:
2364         case EBT_SO_GET_INIT_ENTRIES:
2365                 /*
2366                  * try real handler first in case of userland-side padding.
2367                  * in case we are dealing with an 'ordinary' 32 bit binary
2368                  * without 64bit compatibility padding, this will fail right
2369                  * after copy_from_user when the *len argument is validated.
2370                  *
2371                  * the compat_ variant needs to do one pass over the kernel
2372                  * data set to adjust for size differences before it the check.
2373                  */
2374                 if (copy_everything_to_user(t, user, len, cmd) == 0)
2375                         ret = 0;
2376                 else
2377                         ret = compat_copy_everything_to_user(t, user, len, cmd);
2378                 break;
2379         default:
2380                 ret = -EINVAL;
2381         }
2382  out:
2383         xt_compat_flush_offsets(NFPROTO_BRIDGE);
2384         xt_compat_unlock(NFPROTO_BRIDGE);
2385         mutex_unlock(&ebt_mutex);
2386         return ret;
2387 }
2388 #endif
2389
2390 static struct nf_sockopt_ops ebt_sockopts = {
2391         .pf             = PF_INET,
2392         .set_optmin     = EBT_BASE_CTL,
2393         .set_optmax     = EBT_SO_SET_MAX + 1,
2394         .set            = do_ebt_set_ctl,
2395 #ifdef CONFIG_COMPAT
2396         .compat_set     = compat_do_ebt_set_ctl,
2397 #endif
2398         .get_optmin     = EBT_BASE_CTL,
2399         .get_optmax     = EBT_SO_GET_MAX + 1,
2400         .get            = do_ebt_get_ctl,
2401 #ifdef CONFIG_COMPAT
2402         .compat_get     = compat_do_ebt_get_ctl,
2403 #endif
2404         .owner          = THIS_MODULE,
2405 };
2406
2407 static int __init ebtables_init(void)
2408 {
2409         int ret;
2410
2411         ret = xt_register_target(&ebt_standard_target);
2412         if (ret < 0)
2413                 return ret;
2414         ret = nf_register_sockopt(&ebt_sockopts);
2415         if (ret < 0) {
2416                 xt_unregister_target(&ebt_standard_target);
2417                 return ret;
2418         }
2419
2420         printk(KERN_INFO "Ebtables v2.0 registered\n");
2421         return 0;
2422 }
2423
2424 static void __exit ebtables_fini(void)
2425 {
2426         nf_unregister_sockopt(&ebt_sockopts);
2427         xt_unregister_target(&ebt_standard_target);
2428         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
2429 }
2430
2431 EXPORT_SYMBOL(ebt_register_table);
2432 EXPORT_SYMBOL(ebt_unregister_table);
2433 EXPORT_SYMBOL(ebt_do_table);
2434 module_init(ebtables_init);
2435 module_exit(ebtables_fini);
2436 MODULE_LICENSE("GPL");