ebtables.c revision 0e795531c5e6d0a7d407b8d9edde47cab13be3ec
1/* 2 * ebtables 3 * 4 * Author: 5 * Bart De Schuymer <bdschuym@pandora.be> 6 * 7 * ebtables.c,v 2.0, July, 2002 8 * 9 * This code is stongly inspired on the iptables code which is 10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 11 * 12 * This program is free software; you can redistribute it and/or 13 * modify it under the terms of the GNU General Public License 14 * as published by the Free Software Foundation; either version 15 * 2 of the License, or (at your option) any later version. 16 */ 17 18/* used for print_string */ 19#include <linux/sched.h> 20#include <linux/tty.h> 21 22#include <linux/kmod.h> 23#include <linux/module.h> 24#include <linux/vmalloc.h> 25#include <linux/netfilter_bridge/ebtables.h> 26#include <linux/spinlock.h> 27#include <linux/mutex.h> 28#include <asm/uaccess.h> 29#include <linux/smp.h> 30#include <linux/cpumask.h> 31#include <net/sock.h> 32/* needed for logical [in,out]-dev filtering */ 33#include "../br_private.h" 34 35#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\ 36 "report to author: "format, ## args) 37/* #define BUGPRINT(format, args...) */ 38#define MEMPRINT(format, args...) printk("kernel msg: ebtables "\ 39 ": out of memory: "format, ## args) 40/* #define MEMPRINT(format, args...) */ 41 42 43 44/* 45 * Each cpu has its own set of counters, so there is no need for write_lock in 46 * the softirq 47 * For reading or updating the counters, the user context needs to 48 * get a write_lock 49 */ 50 51/* The size of each set of counters is altered to get cache alignment */ 52#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1)) 53#define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter))) 54#define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \ 55 COUNTER_OFFSET(n) * cpu)) 56 57 58 59static DEFINE_MUTEX(ebt_mutex); 60static LIST_HEAD(ebt_tables); 61static LIST_HEAD(ebt_targets); 62static LIST_HEAD(ebt_matches); 63static LIST_HEAD(ebt_watchers); 64 65static struct ebt_target ebt_standard_target = 66{ {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL}; 67 68static inline int ebt_do_watcher (struct ebt_entry_watcher *w, 69 const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in, 70 const struct net_device *out) 71{ 72 w->u.watcher->watcher(skb, hooknr, in, out, w->data, 73 w->watcher_size); 74 /* watchers don't give a verdict */ 75 return 0; 76} 77 78static inline int ebt_do_match (struct ebt_entry_match *m, 79 const struct sk_buff *skb, const struct net_device *in, 80 const struct net_device *out) 81{ 82 return m->u.match->match(skb, in, out, m->data, 83 m->match_size); 84} 85 86static inline int ebt_dev_check(char *entry, const struct net_device *device) 87{ 88 int i = 0; 89 const char *devname = device->name; 90 91 if (*entry == '\0') 92 return 0; 93 if (!device) 94 return 1; 95 /* 1 is the wildcard token */ 96 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i]) 97 i++; 98 return (devname[i] != entry[i] && entry[i] != 1); 99} 100 101#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg)) 102/* process standard matches */ 103static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h, 104 const struct net_device *in, const struct net_device *out) 105{ 106 int verdict, i; 107 108 if (e->bitmask & EBT_802_3) { 109 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO)) 110 return 1; 111 } else if (!(e->bitmask & EBT_NOPROTO) && 112 FWINV2(e->ethproto != h->h_proto, EBT_IPROTO)) 113 return 1; 114 115 if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN)) 116 return 1; 117 if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT)) 118 return 1; 119 if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check( 120 e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN)) 121 return 1; 122 if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check( 123 e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT)) 124 return 1; 125 126 if (e->bitmask & EBT_SOURCEMAC) { 127 verdict = 0; 128 for (i = 0; i < 6; i++) 129 verdict |= (h->h_source[i] ^ e->sourcemac[i]) & 130 e->sourcemsk[i]; 131 if (FWINV2(verdict != 0, EBT_ISOURCE) ) 132 return 1; 133 } 134 if (e->bitmask & EBT_DESTMAC) { 135 verdict = 0; 136 for (i = 0; i < 6; i++) 137 verdict |= (h->h_dest[i] ^ e->destmac[i]) & 138 e->destmsk[i]; 139 if (FWINV2(verdict != 0, EBT_IDEST) ) 140 return 1; 141 } 142 return 0; 143} 144 145/* Do some firewalling */ 146unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb, 147 const struct net_device *in, const struct net_device *out, 148 struct ebt_table *table) 149{ 150 int i, nentries; 151 struct ebt_entry *point; 152 struct ebt_counter *counter_base, *cb_base; 153 struct ebt_entry_target *t; 154 int verdict, sp = 0; 155 struct ebt_chainstack *cs; 156 struct ebt_entries *chaininfo; 157 char *base; 158 struct ebt_table_info *private; 159 160 read_lock_bh(&table->lock); 161 private = table->private; 162 cb_base = COUNTER_BASE(private->counters, private->nentries, 163 smp_processor_id()); 164 if (private->chainstack) 165 cs = private->chainstack[smp_processor_id()]; 166 else 167 cs = NULL; 168 chaininfo = private->hook_entry[hook]; 169 nentries = private->hook_entry[hook]->nentries; 170 point = (struct ebt_entry *)(private->hook_entry[hook]->data); 171 counter_base = cb_base + private->hook_entry[hook]->counter_offset; 172 /* base for chain jumps */ 173 base = private->entries; 174 i = 0; 175 while (i < nentries) { 176 if (ebt_basic_match(point, eth_hdr(*pskb), in, out)) 177 goto letscontinue; 178 179 if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0) 180 goto letscontinue; 181 182 /* increase counter */ 183 (*(counter_base + i)).pcnt++; 184 (*(counter_base + i)).bcnt+=(**pskb).len; 185 186 /* these should only watch: not modify, nor tell us 187 what to do with the packet */ 188 EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in, 189 out); 190 191 t = (struct ebt_entry_target *) 192 (((char *)point) + point->target_offset); 193 /* standard target */ 194 if (!t->u.target->target) 195 verdict = ((struct ebt_standard_target *)t)->verdict; 196 else 197 verdict = t->u.target->target(pskb, hook, 198 in, out, t->data, t->target_size); 199 if (verdict == EBT_ACCEPT) { 200 read_unlock_bh(&table->lock); 201 return NF_ACCEPT; 202 } 203 if (verdict == EBT_DROP) { 204 read_unlock_bh(&table->lock); 205 return NF_DROP; 206 } 207 if (verdict == EBT_RETURN) { 208letsreturn: 209#ifdef CONFIG_NETFILTER_DEBUG 210 if (sp == 0) { 211 BUGPRINT("RETURN on base chain"); 212 /* act like this is EBT_CONTINUE */ 213 goto letscontinue; 214 } 215#endif 216 sp--; 217 /* put all the local variables right */ 218 i = cs[sp].n; 219 chaininfo = cs[sp].chaininfo; 220 nentries = chaininfo->nentries; 221 point = cs[sp].e; 222 counter_base = cb_base + 223 chaininfo->counter_offset; 224 continue; 225 } 226 if (verdict == EBT_CONTINUE) 227 goto letscontinue; 228#ifdef CONFIG_NETFILTER_DEBUG 229 if (verdict < 0) { 230 BUGPRINT("bogus standard verdict\n"); 231 read_unlock_bh(&table->lock); 232 return NF_DROP; 233 } 234#endif 235 /* jump to a udc */ 236 cs[sp].n = i + 1; 237 cs[sp].chaininfo = chaininfo; 238 cs[sp].e = (struct ebt_entry *) 239 (((char *)point) + point->next_offset); 240 i = 0; 241 chaininfo = (struct ebt_entries *) (base + verdict); 242#ifdef CONFIG_NETFILTER_DEBUG 243 if (chaininfo->distinguisher) { 244 BUGPRINT("jump to non-chain\n"); 245 read_unlock_bh(&table->lock); 246 return NF_DROP; 247 } 248#endif 249 nentries = chaininfo->nentries; 250 point = (struct ebt_entry *)chaininfo->data; 251 counter_base = cb_base + chaininfo->counter_offset; 252 sp++; 253 continue; 254letscontinue: 255 point = (struct ebt_entry *) 256 (((char *)point) + point->next_offset); 257 i++; 258 } 259 260 /* I actually like this :) */ 261 if (chaininfo->policy == EBT_RETURN) 262 goto letsreturn; 263 if (chaininfo->policy == EBT_ACCEPT) { 264 read_unlock_bh(&table->lock); 265 return NF_ACCEPT; 266 } 267 read_unlock_bh(&table->lock); 268 return NF_DROP; 269} 270 271/* If it succeeds, returns element and locks mutex */ 272static inline void * 273find_inlist_lock_noload(struct list_head *head, const char *name, int *error, 274 struct mutex *mutex) 275{ 276 struct { 277 struct list_head list; 278 char name[EBT_FUNCTION_MAXNAMELEN]; 279 } *e; 280 281 *error = mutex_lock_interruptible(mutex); 282 if (*error != 0) 283 return NULL; 284 285 list_for_each_entry(e, head, list) { 286 if (strcmp(e->name, name) == 0) 287 return e; 288 } 289 *error = -ENOENT; 290 mutex_unlock(mutex); 291 return NULL; 292} 293 294#ifndef CONFIG_KMOD 295#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m)) 296#else 297static void * 298find_inlist_lock(struct list_head *head, const char *name, const char *prefix, 299 int *error, struct mutex *mutex) 300{ 301 void *ret; 302 303 ret = find_inlist_lock_noload(head, name, error, mutex); 304 if (!ret) { 305 request_module("%s%s", prefix, name); 306 ret = find_inlist_lock_noload(head, name, error, mutex); 307 } 308 return ret; 309} 310#endif 311 312static inline struct ebt_table * 313find_table_lock(const char *name, int *error, struct mutex *mutex) 314{ 315 return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex); 316} 317 318static inline struct ebt_match * 319find_match_lock(const char *name, int *error, struct mutex *mutex) 320{ 321 return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex); 322} 323 324static inline struct ebt_watcher * 325find_watcher_lock(const char *name, int *error, struct mutex *mutex) 326{ 327 return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex); 328} 329 330static inline struct ebt_target * 331find_target_lock(const char *name, int *error, struct mutex *mutex) 332{ 333 return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex); 334} 335 336static inline int 337ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e, 338 const char *name, unsigned int hookmask, unsigned int *cnt) 339{ 340 struct ebt_match *match; 341 size_t left = ((char *)e + e->watchers_offset) - (char *)m; 342 int ret; 343 344 if (left < sizeof(struct ebt_entry_match) || 345 left - sizeof(struct ebt_entry_match) < m->match_size) 346 return -EINVAL; 347 match = find_match_lock(m->u.name, &ret, &ebt_mutex); 348 if (!match) 349 return ret; 350 m->u.match = match; 351 if (!try_module_get(match->me)) { 352 mutex_unlock(&ebt_mutex); 353 return -ENOENT; 354 } 355 mutex_unlock(&ebt_mutex); 356 if (match->check && 357 match->check(name, hookmask, e, m->data, m->match_size) != 0) { 358 BUGPRINT("match->check failed\n"); 359 module_put(match->me); 360 return -EINVAL; 361 } 362 (*cnt)++; 363 return 0; 364} 365 366static inline int 367ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e, 368 const char *name, unsigned int hookmask, unsigned int *cnt) 369{ 370 struct ebt_watcher *watcher; 371 size_t left = ((char *)e + e->target_offset) - (char *)w; 372 int ret; 373 374 if (left < sizeof(struct ebt_entry_watcher) || 375 left - sizeof(struct ebt_entry_watcher) < w->watcher_size) 376 return -EINVAL; 377 watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex); 378 if (!watcher) 379 return ret; 380 w->u.watcher = watcher; 381 if (!try_module_get(watcher->me)) { 382 mutex_unlock(&ebt_mutex); 383 return -ENOENT; 384 } 385 mutex_unlock(&ebt_mutex); 386 if (watcher->check && 387 watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) { 388 BUGPRINT("watcher->check failed\n"); 389 module_put(watcher->me); 390 return -EINVAL; 391 } 392 (*cnt)++; 393 return 0; 394} 395 396static int ebt_verify_pointers(struct ebt_replace *repl, 397 struct ebt_table_info *newinfo) 398{ 399 unsigned int limit = repl->entries_size; 400 unsigned int valid_hooks = repl->valid_hooks; 401 unsigned int offset = 0; 402 int i; 403 404 for (i = 0; i < NF_BR_NUMHOOKS; i++) 405 newinfo->hook_entry[i] = NULL; 406 407 newinfo->entries_size = repl->entries_size; 408 newinfo->nentries = repl->nentries; 409 410 while (offset < limit) { 411 size_t left = limit - offset; 412 struct ebt_entry *e = (void *)newinfo->entries + offset; 413 414 if (left < sizeof(unsigned int)) 415 break; 416 417 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 418 if ((valid_hooks & (1 << i)) == 0) 419 continue; 420 if ((char *)repl->hook_entry[i] == repl->entries + offset) 421 break; 422 } 423 424 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) { 425 if (e->bitmask != 0) { 426 /* we make userspace set this right, 427 so there is no misunderstanding */ 428 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set " 429 "in distinguisher\n"); 430 return -EINVAL; 431 } 432 if (i != NF_BR_NUMHOOKS) 433 newinfo->hook_entry[i] = (struct ebt_entries *)e; 434 if (left < sizeof(struct ebt_entries)) 435 break; 436 offset += sizeof(struct ebt_entries); 437 } else { 438 if (left < sizeof(struct ebt_entry)) 439 break; 440 if (left < e->next_offset) 441 break; 442 offset += e->next_offset; 443 } 444 } 445 if (offset != limit) { 446 BUGPRINT("entries_size too small\n"); 447 return -EINVAL; 448 } 449 450 /* check if all valid hooks have a chain */ 451 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 452 if (!newinfo->hook_entry[i] && 453 (valid_hooks & (1 << i))) { 454 BUGPRINT("Valid hook without chain\n"); 455 return -EINVAL; 456 } 457 } 458 return 0; 459} 460 461/* 462 * this one is very careful, as it is the first function 463 * to parse the userspace data 464 */ 465static inline int 466ebt_check_entry_size_and_hooks(struct ebt_entry *e, 467 struct ebt_table_info *newinfo, 468 unsigned int *n, unsigned int *cnt, 469 unsigned int *totalcnt, unsigned int *udc_cnt) 470{ 471 int i; 472 473 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 474 if ((void *)e == (void *)newinfo->hook_entry[i]) 475 break; 476 } 477 /* beginning of a new chain 478 if i == NF_BR_NUMHOOKS it must be a user defined chain */ 479 if (i != NF_BR_NUMHOOKS || !e->bitmask) { 480 /* this checks if the previous chain has as many entries 481 as it said it has */ 482 if (*n != *cnt) { 483 BUGPRINT("nentries does not equal the nr of entries " 484 "in the chain\n"); 485 return -EINVAL; 486 } 487 if (((struct ebt_entries *)e)->policy != EBT_DROP && 488 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) { 489 /* only RETURN from udc */ 490 if (i != NF_BR_NUMHOOKS || 491 ((struct ebt_entries *)e)->policy != EBT_RETURN) { 492 BUGPRINT("bad policy\n"); 493 return -EINVAL; 494 } 495 } 496 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */ 497 (*udc_cnt)++; 498 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) { 499 BUGPRINT("counter_offset != totalcnt"); 500 return -EINVAL; 501 } 502 *n = ((struct ebt_entries *)e)->nentries; 503 *cnt = 0; 504 return 0; 505 } 506 /* a plain old entry, heh */ 507 if (sizeof(struct ebt_entry) > e->watchers_offset || 508 e->watchers_offset > e->target_offset || 509 e->target_offset >= e->next_offset) { 510 BUGPRINT("entry offsets not in right order\n"); 511 return -EINVAL; 512 } 513 /* this is not checked anywhere else */ 514 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) { 515 BUGPRINT("target size too small\n"); 516 return -EINVAL; 517 } 518 (*cnt)++; 519 (*totalcnt)++; 520 return 0; 521} 522 523struct ebt_cl_stack 524{ 525 struct ebt_chainstack cs; 526 int from; 527 unsigned int hookmask; 528}; 529 530/* 531 * we need these positions to check that the jumps to a different part of the 532 * entries is a jump to the beginning of a new chain. 533 */ 534static inline int 535ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo, 536 struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks, 537 struct ebt_cl_stack *udc) 538{ 539 int i; 540 541 /* we're only interested in chain starts */ 542 if (e->bitmask) 543 return 0; 544 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 545 if ((valid_hooks & (1 << i)) == 0) 546 continue; 547 if (newinfo->hook_entry[i] == (struct ebt_entries *)e) 548 break; 549 } 550 /* only care about udc */ 551 if (i != NF_BR_NUMHOOKS) 552 return 0; 553 554 udc[*n].cs.chaininfo = (struct ebt_entries *)e; 555 /* these initialisations are depended on later in check_chainloops() */ 556 udc[*n].cs.n = 0; 557 udc[*n].hookmask = 0; 558 559 (*n)++; 560 return 0; 561} 562 563static inline int 564ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i) 565{ 566 if (i && (*i)-- == 0) 567 return 1; 568 if (m->u.match->destroy) 569 m->u.match->destroy(m->data, m->match_size); 570 module_put(m->u.match->me); 571 572 return 0; 573} 574 575static inline int 576ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i) 577{ 578 if (i && (*i)-- == 0) 579 return 1; 580 if (w->u.watcher->destroy) 581 w->u.watcher->destroy(w->data, w->watcher_size); 582 module_put(w->u.watcher->me); 583 584 return 0; 585} 586 587static inline int 588ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt) 589{ 590 struct ebt_entry_target *t; 591 592 if (e->bitmask == 0) 593 return 0; 594 /* we're done */ 595 if (cnt && (*cnt)-- == 0) 596 return 1; 597 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL); 598 EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL); 599 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); 600 if (t->u.target->destroy) 601 t->u.target->destroy(t->data, t->target_size); 602 module_put(t->u.target->me); 603 604 return 0; 605} 606 607static inline int 608ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo, 609 const char *name, unsigned int *cnt, unsigned int valid_hooks, 610 struct ebt_cl_stack *cl_s, unsigned int udc_cnt) 611{ 612 struct ebt_entry_target *t; 613 struct ebt_target *target; 614 unsigned int i, j, hook = 0, hookmask = 0; 615 size_t gap = e->next_offset - e->target_offset; 616 int ret; 617 618 /* don't mess with the struct ebt_entries */ 619 if (e->bitmask == 0) 620 return 0; 621 622 if (e->bitmask & ~EBT_F_MASK) { 623 BUGPRINT("Unknown flag for bitmask\n"); 624 return -EINVAL; 625 } 626 if (e->invflags & ~EBT_INV_MASK) { 627 BUGPRINT("Unknown flag for inv bitmask\n"); 628 return -EINVAL; 629 } 630 if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) { 631 BUGPRINT("NOPROTO & 802_3 not allowed\n"); 632 return -EINVAL; 633 } 634 /* what hook do we belong to? */ 635 for (i = 0; i < NF_BR_NUMHOOKS; i++) { 636 if ((valid_hooks & (1 << i)) == 0) 637 continue; 638 if ((char *)newinfo->hook_entry[i] < (char *)e) 639 hook = i; 640 else 641 break; 642 } 643 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on 644 a base chain */ 645 if (i < NF_BR_NUMHOOKS) 646 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 647 else { 648 for (i = 0; i < udc_cnt; i++) 649 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e) 650 break; 651 if (i == 0) 652 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS); 653 else 654 hookmask = cl_s[i - 1].hookmask; 655 } 656 i = 0; 657 ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i); 658 if (ret != 0) 659 goto cleanup_matches; 660 j = 0; 661 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j); 662 if (ret != 0) 663 goto cleanup_watchers; 664 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); 665 target = find_target_lock(t->u.name, &ret, &ebt_mutex); 666 if (!target) 667 goto cleanup_watchers; 668 if (!try_module_get(target->me)) { 669 mutex_unlock(&ebt_mutex); 670 ret = -ENOENT; 671 goto cleanup_watchers; 672 } 673 mutex_unlock(&ebt_mutex); 674 675 t->u.target = target; 676 if (t->u.target == &ebt_standard_target) { 677 if (gap < sizeof(struct ebt_standard_target)) { 678 BUGPRINT("Standard target size too big\n"); 679 ret = -EFAULT; 680 goto cleanup_watchers; 681 } 682 if (((struct ebt_standard_target *)t)->verdict < 683 -NUM_STANDARD_TARGETS) { 684 BUGPRINT("Invalid standard target\n"); 685 ret = -EFAULT; 686 goto cleanup_watchers; 687 } 688 } else if (t->target_size > gap - sizeof(struct ebt_entry_target) || 689 (t->u.target->check && 690 t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){ 691 module_put(t->u.target->me); 692 ret = -EFAULT; 693 goto cleanup_watchers; 694 } 695 (*cnt)++; 696 return 0; 697cleanup_watchers: 698 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j); 699cleanup_matches: 700 EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i); 701 return ret; 702} 703 704/* 705 * checks for loops and sets the hook mask for udc 706 * the hook mask for udc tells us from which base chains the udc can be 707 * accessed. This mask is a parameter to the check() functions of the extensions 708 */ 709static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s, 710 unsigned int udc_cnt, unsigned int hooknr, char *base) 711{ 712 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict; 713 struct ebt_entry *e = (struct ebt_entry *)chain->data; 714 struct ebt_entry_target *t; 715 716 while (pos < nentries || chain_nr != -1) { 717 /* end of udc, go back one 'recursion' step */ 718 if (pos == nentries) { 719 /* put back values of the time when this chain was called */ 720 e = cl_s[chain_nr].cs.e; 721 if (cl_s[chain_nr].from != -1) 722 nentries = 723 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries; 724 else 725 nentries = chain->nentries; 726 pos = cl_s[chain_nr].cs.n; 727 /* make sure we won't see a loop that isn't one */ 728 cl_s[chain_nr].cs.n = 0; 729 chain_nr = cl_s[chain_nr].from; 730 if (pos == nentries) 731 continue; 732 } 733 t = (struct ebt_entry_target *) 734 (((char *)e) + e->target_offset); 735 if (strcmp(t->u.name, EBT_STANDARD_TARGET)) 736 goto letscontinue; 737 if (e->target_offset + sizeof(struct ebt_standard_target) > 738 e->next_offset) { 739 BUGPRINT("Standard target size too big\n"); 740 return -1; 741 } 742 verdict = ((struct ebt_standard_target *)t)->verdict; 743 if (verdict >= 0) { /* jump to another chain */ 744 struct ebt_entries *hlp2 = 745 (struct ebt_entries *)(base + verdict); 746 for (i = 0; i < udc_cnt; i++) 747 if (hlp2 == cl_s[i].cs.chaininfo) 748 break; 749 /* bad destination or loop */ 750 if (i == udc_cnt) { 751 BUGPRINT("bad destination\n"); 752 return -1; 753 } 754 if (cl_s[i].cs.n) { 755 BUGPRINT("loop\n"); 756 return -1; 757 } 758 if (cl_s[i].hookmask & (1 << hooknr)) 759 goto letscontinue; 760 /* this can't be 0, so the loop test is correct */ 761 cl_s[i].cs.n = pos + 1; 762 pos = 0; 763 cl_s[i].cs.e = ((void *)e + e->next_offset); 764 e = (struct ebt_entry *)(hlp2->data); 765 nentries = hlp2->nentries; 766 cl_s[i].from = chain_nr; 767 chain_nr = i; 768 /* this udc is accessible from the base chain for hooknr */ 769 cl_s[i].hookmask |= (1 << hooknr); 770 continue; 771 } 772letscontinue: 773 e = (void *)e + e->next_offset; 774 pos++; 775 } 776 return 0; 777} 778 779/* do the parsing of the table/chains/entries/matches/watchers/targets, heh */ 780static int translate_table(struct ebt_replace *repl, 781 struct ebt_table_info *newinfo) 782{ 783 unsigned int i, j, k, udc_cnt; 784 int ret; 785 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */ 786 787 ret = ebt_verify_pointers(repl, newinfo); 788 if (ret != 0) 789 return ret; 790 791 i = 0; 792 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i]) 793 i++; 794 if (i == NF_BR_NUMHOOKS) { 795 BUGPRINT("No valid hooks specified\n"); 796 return -EINVAL; 797 } 798 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) { 799 BUGPRINT("Chains don't start at beginning\n"); 800 return -EINVAL; 801 } 802 /* make sure chains are ordered after each other in same order 803 as their corresponding hooks */ 804 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) { 805 if (!newinfo->hook_entry[j]) 806 continue; 807 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) { 808 BUGPRINT("Hook order must be followed\n"); 809 return -EINVAL; 810 } 811 i = j; 812 } 813 814 /* do some early checkings and initialize some things */ 815 i = 0; /* holds the expected nr. of entries for the chain */ 816 j = 0; /* holds the up to now counted entries for the chain */ 817 k = 0; /* holds the total nr. of entries, should equal 818 newinfo->nentries afterwards */ 819 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */ 820 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 821 ebt_check_entry_size_and_hooks, newinfo, 822 &i, &j, &k, &udc_cnt); 823 824 if (ret != 0) 825 return ret; 826 827 if (i != j) { 828 BUGPRINT("nentries does not equal the nr of entries in the " 829 "(last) chain\n"); 830 return -EINVAL; 831 } 832 if (k != newinfo->nentries) { 833 BUGPRINT("Total nentries is wrong\n"); 834 return -EINVAL; 835 } 836 837 /* get the location of the udc, put them in an array 838 while we're at it, allocate the chainstack */ 839 if (udc_cnt) { 840 /* this will get free'd in do_replace()/ebt_register_table() 841 if an error occurs */ 842 newinfo->chainstack = 843 vmalloc((highest_possible_processor_id()+1) 844 * sizeof(*(newinfo->chainstack))); 845 if (!newinfo->chainstack) 846 return -ENOMEM; 847 for_each_possible_cpu(i) { 848 newinfo->chainstack[i] = 849 vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0]))); 850 if (!newinfo->chainstack[i]) { 851 while (i) 852 vfree(newinfo->chainstack[--i]); 853 vfree(newinfo->chainstack); 854 newinfo->chainstack = NULL; 855 return -ENOMEM; 856 } 857 } 858 859 cl_s = vmalloc(udc_cnt * sizeof(*cl_s)); 860 if (!cl_s) 861 return -ENOMEM; 862 i = 0; /* the i'th udc */ 863 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 864 ebt_get_udc_positions, newinfo, repl->hook_entry, &i, 865 repl->valid_hooks, cl_s); 866 /* sanity check */ 867 if (i != udc_cnt) { 868 BUGPRINT("i != udc_cnt\n"); 869 vfree(cl_s); 870 return -EFAULT; 871 } 872 } 873 874 /* Check for loops */ 875 for (i = 0; i < NF_BR_NUMHOOKS; i++) 876 if (newinfo->hook_entry[i]) 877 if (check_chainloops(newinfo->hook_entry[i], 878 cl_s, udc_cnt, i, newinfo->entries)) { 879 vfree(cl_s); 880 return -EINVAL; 881 } 882 883 /* we now know the following (along with E=mc�): 884 - the nr of entries in each chain is right 885 - the size of the allocated space is right 886 - all valid hooks have a corresponding chain 887 - there are no loops 888 - wrong data can still be on the level of a single entry 889 - could be there are jumps to places that are not the 890 beginning of a chain. This can only occur in chains that 891 are not accessible from any base chains, so we don't care. */ 892 893 /* used to know what we need to clean up if something goes wrong */ 894 i = 0; 895 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 896 ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks, 897 cl_s, udc_cnt); 898 if (ret != 0) { 899 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 900 ebt_cleanup_entry, &i); 901 } 902 vfree(cl_s); 903 return ret; 904} 905 906/* called under write_lock */ 907static void get_counters(struct ebt_counter *oldcounters, 908 struct ebt_counter *counters, unsigned int nentries) 909{ 910 int i, cpu; 911 struct ebt_counter *counter_base; 912 913 /* counters of cpu 0 */ 914 memcpy(counters, oldcounters, 915 sizeof(struct ebt_counter) * nentries); 916 917 /* add other counters to those of cpu 0 */ 918 for_each_possible_cpu(cpu) { 919 if (cpu == 0) 920 continue; 921 counter_base = COUNTER_BASE(oldcounters, nentries, cpu); 922 for (i = 0; i < nentries; i++) { 923 counters[i].pcnt += counter_base[i].pcnt; 924 counters[i].bcnt += counter_base[i].bcnt; 925 } 926 } 927} 928 929/* replace the table */ 930static int do_replace(void __user *user, unsigned int len) 931{ 932 int ret, i, countersize; 933 struct ebt_table_info *newinfo; 934 struct ebt_replace tmp; 935 struct ebt_table *t; 936 struct ebt_counter *counterstmp = NULL; 937 /* used to be able to unlock earlier */ 938 struct ebt_table_info *table; 939 940 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0) 941 return -EFAULT; 942 943 if (len != sizeof(tmp) + tmp.entries_size) { 944 BUGPRINT("Wrong len argument\n"); 945 return -EINVAL; 946 } 947 948 if (tmp.entries_size == 0) { 949 BUGPRINT("Entries_size never zero\n"); 950 return -EINVAL; 951 } 952 /* overflow check */ 953 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS - 954 SMP_CACHE_BYTES) / sizeof(struct ebt_counter)) 955 return -ENOMEM; 956 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter)) 957 return -ENOMEM; 958 959 countersize = COUNTER_OFFSET(tmp.nentries) * 960 (highest_possible_processor_id()+1); 961 newinfo = vmalloc(sizeof(*newinfo) + countersize); 962 if (!newinfo) 963 return -ENOMEM; 964 965 if (countersize) 966 memset(newinfo->counters, 0, countersize); 967 968 newinfo->entries = vmalloc(tmp.entries_size); 969 if (!newinfo->entries) { 970 ret = -ENOMEM; 971 goto free_newinfo; 972 } 973 if (copy_from_user( 974 newinfo->entries, tmp.entries, tmp.entries_size) != 0) { 975 BUGPRINT("Couldn't copy entries from userspace\n"); 976 ret = -EFAULT; 977 goto free_entries; 978 } 979 980 /* the user wants counters back 981 the check on the size is done later, when we have the lock */ 982 if (tmp.num_counters) { 983 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp)); 984 if (!counterstmp) { 985 ret = -ENOMEM; 986 goto free_entries; 987 } 988 } 989 else 990 counterstmp = NULL; 991 992 /* this can get initialized by translate_table() */ 993 newinfo->chainstack = NULL; 994 ret = translate_table(&tmp, newinfo); 995 996 if (ret != 0) 997 goto free_counterstmp; 998 999 t = find_table_lock(tmp.name, &ret, &ebt_mutex); 1000 if (!t) { 1001 ret = -ENOENT; 1002 goto free_iterate; 1003 } 1004 1005 /* the table doesn't like it */ 1006 if (t->check && (ret = t->check(newinfo, tmp.valid_hooks))) 1007 goto free_unlock; 1008 1009 if (tmp.num_counters && tmp.num_counters != t->private->nentries) { 1010 BUGPRINT("Wrong nr. of counters requested\n"); 1011 ret = -EINVAL; 1012 goto free_unlock; 1013 } 1014 1015 /* we have the mutex lock, so no danger in reading this pointer */ 1016 table = t->private; 1017 /* make sure the table can only be rmmod'ed if it contains no rules */ 1018 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) { 1019 ret = -ENOENT; 1020 goto free_unlock; 1021 } else if (table->nentries && !newinfo->nentries) 1022 module_put(t->me); 1023 /* we need an atomic snapshot of the counters */ 1024 write_lock_bh(&t->lock); 1025 if (tmp.num_counters) 1026 get_counters(t->private->counters, counterstmp, 1027 t->private->nentries); 1028 1029 t->private = newinfo; 1030 write_unlock_bh(&t->lock); 1031 mutex_unlock(&ebt_mutex); 1032 /* so, a user can change the chains while having messed up her counter 1033 allocation. Only reason why this is done is because this way the lock 1034 is held only once, while this doesn't bring the kernel into a 1035 dangerous state. */ 1036 if (tmp.num_counters && 1037 copy_to_user(tmp.counters, counterstmp, 1038 tmp.num_counters * sizeof(struct ebt_counter))) { 1039 BUGPRINT("Couldn't copy counters to userspace\n"); 1040 ret = -EFAULT; 1041 } 1042 else 1043 ret = 0; 1044 1045 /* decrease module count and free resources */ 1046 EBT_ENTRY_ITERATE(table->entries, table->entries_size, 1047 ebt_cleanup_entry, NULL); 1048 1049 vfree(table->entries); 1050 if (table->chainstack) { 1051 for_each_possible_cpu(i) 1052 vfree(table->chainstack[i]); 1053 vfree(table->chainstack); 1054 } 1055 vfree(table); 1056 1057 vfree(counterstmp); 1058 return ret; 1059 1060free_unlock: 1061 mutex_unlock(&ebt_mutex); 1062free_iterate: 1063 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size, 1064 ebt_cleanup_entry, NULL); 1065free_counterstmp: 1066 vfree(counterstmp); 1067 /* can be initialized in translate_table() */ 1068 if (newinfo->chainstack) { 1069 for_each_possible_cpu(i) 1070 vfree(newinfo->chainstack[i]); 1071 vfree(newinfo->chainstack); 1072 } 1073free_entries: 1074 vfree(newinfo->entries); 1075free_newinfo: 1076 vfree(newinfo); 1077 return ret; 1078} 1079 1080int ebt_register_target(struct ebt_target *target) 1081{ 1082 struct ebt_target *t; 1083 int ret; 1084 1085 ret = mutex_lock_interruptible(&ebt_mutex); 1086 if (ret != 0) 1087 return ret; 1088 list_for_each_entry(t, &ebt_targets, list) { 1089 if (strcmp(t->name, target->name) == 0) { 1090 mutex_unlock(&ebt_mutex); 1091 return -EEXIST; 1092 } 1093 } 1094 list_add(&target->list, &ebt_targets); 1095 mutex_unlock(&ebt_mutex); 1096 1097 return 0; 1098} 1099 1100void ebt_unregister_target(struct ebt_target *target) 1101{ 1102 mutex_lock(&ebt_mutex); 1103 list_del(&target->list); 1104 mutex_unlock(&ebt_mutex); 1105} 1106 1107int ebt_register_match(struct ebt_match *match) 1108{ 1109 struct ebt_match *m; 1110 int ret; 1111 1112 ret = mutex_lock_interruptible(&ebt_mutex); 1113 if (ret != 0) 1114 return ret; 1115 list_for_each_entry(m, &ebt_matches, list) { 1116 if (strcmp(m->name, match->name) == 0) { 1117 mutex_unlock(&ebt_mutex); 1118 return -EEXIST; 1119 } 1120 } 1121 list_add(&match->list, &ebt_matches); 1122 mutex_unlock(&ebt_mutex); 1123 1124 return 0; 1125} 1126 1127void ebt_unregister_match(struct ebt_match *match) 1128{ 1129 mutex_lock(&ebt_mutex); 1130 list_del(&match->list); 1131 mutex_unlock(&ebt_mutex); 1132} 1133 1134int ebt_register_watcher(struct ebt_watcher *watcher) 1135{ 1136 struct ebt_watcher *w; 1137 int ret; 1138 1139 ret = mutex_lock_interruptible(&ebt_mutex); 1140 if (ret != 0) 1141 return ret; 1142 list_for_each_entry(w, &ebt_watchers, list) { 1143 if (strcmp(w->name, watcher->name) == 0) { 1144 mutex_unlock(&ebt_mutex); 1145 return -EEXIST; 1146 } 1147 } 1148 list_add(&watcher->list, &ebt_watchers); 1149 mutex_unlock(&ebt_mutex); 1150 1151 return 0; 1152} 1153 1154void ebt_unregister_watcher(struct ebt_watcher *watcher) 1155{ 1156 mutex_lock(&ebt_mutex); 1157 list_del(&watcher->list); 1158 mutex_unlock(&ebt_mutex); 1159} 1160 1161int ebt_register_table(struct ebt_table *table) 1162{ 1163 struct ebt_table_info *newinfo; 1164 struct ebt_table *t; 1165 int ret, i, countersize; 1166 1167 if (!table || !table->table ||!table->table->entries || 1168 table->table->entries_size == 0 || 1169 table->table->counters || table->private) { 1170 BUGPRINT("Bad table data for ebt_register_table!!!\n"); 1171 return -EINVAL; 1172 } 1173 1174 countersize = COUNTER_OFFSET(table->table->nentries) * 1175 (highest_possible_processor_id()+1); 1176 newinfo = vmalloc(sizeof(*newinfo) + countersize); 1177 ret = -ENOMEM; 1178 if (!newinfo) 1179 return -ENOMEM; 1180 1181 newinfo->entries = vmalloc(table->table->entries_size); 1182 if (!(newinfo->entries)) 1183 goto free_newinfo; 1184 1185 memcpy(newinfo->entries, table->table->entries, 1186 table->table->entries_size); 1187 1188 if (countersize) 1189 memset(newinfo->counters, 0, countersize); 1190 1191 /* fill in newinfo and parse the entries */ 1192 newinfo->chainstack = NULL; 1193 ret = translate_table(table->table, newinfo); 1194 if (ret != 0) { 1195 BUGPRINT("Translate_table failed\n"); 1196 goto free_chainstack; 1197 } 1198 1199 if (table->check && table->check(newinfo, table->valid_hooks)) { 1200 BUGPRINT("The table doesn't like its own initial data, lol\n"); 1201 return -EINVAL; 1202 } 1203 1204 table->private = newinfo; 1205 rwlock_init(&table->lock); 1206 ret = mutex_lock_interruptible(&ebt_mutex); 1207 if (ret != 0) 1208 goto free_chainstack; 1209 1210 list_for_each_entry(t, &ebt_tables, list) { 1211 if (strcmp(t->name, table->name) == 0) { 1212 ret = -EEXIST; 1213 BUGPRINT("Table name already exists\n"); 1214 goto free_unlock; 1215 } 1216 } 1217 1218 /* Hold a reference count if the chains aren't empty */ 1219 if (newinfo->nentries && !try_module_get(table->me)) { 1220 ret = -ENOENT; 1221 goto free_unlock; 1222 } 1223 list_add(&table->list, &ebt_tables); 1224 mutex_unlock(&ebt_mutex); 1225 return 0; 1226free_unlock: 1227 mutex_unlock(&ebt_mutex); 1228free_chainstack: 1229 if (newinfo->chainstack) { 1230 for_each_possible_cpu(i) 1231 vfree(newinfo->chainstack[i]); 1232 vfree(newinfo->chainstack); 1233 } 1234 vfree(newinfo->entries); 1235free_newinfo: 1236 vfree(newinfo); 1237 return ret; 1238} 1239 1240void ebt_unregister_table(struct ebt_table *table) 1241{ 1242 int i; 1243 1244 if (!table) { 1245 BUGPRINT("Request to unregister NULL table!!!\n"); 1246 return; 1247 } 1248 mutex_lock(&ebt_mutex); 1249 list_del(&table->list); 1250 mutex_unlock(&ebt_mutex); 1251 vfree(table->private->entries); 1252 if (table->private->chainstack) { 1253 for_each_possible_cpu(i) 1254 vfree(table->private->chainstack[i]); 1255 vfree(table->private->chainstack); 1256 } 1257 vfree(table->private); 1258} 1259 1260/* userspace just supplied us with counters */ 1261static int update_counters(void __user *user, unsigned int len) 1262{ 1263 int i, ret; 1264 struct ebt_counter *tmp; 1265 struct ebt_replace hlp; 1266 struct ebt_table *t; 1267 1268 if (copy_from_user(&hlp, user, sizeof(hlp))) 1269 return -EFAULT; 1270 1271 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter)) 1272 return -EINVAL; 1273 if (hlp.num_counters == 0) 1274 return -EINVAL; 1275 1276 if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) { 1277 MEMPRINT("Update_counters && nomemory\n"); 1278 return -ENOMEM; 1279 } 1280 1281 t = find_table_lock(hlp.name, &ret, &ebt_mutex); 1282 if (!t) 1283 goto free_tmp; 1284 1285 if (hlp.num_counters != t->private->nentries) { 1286 BUGPRINT("Wrong nr of counters\n"); 1287 ret = -EINVAL; 1288 goto unlock_mutex; 1289 } 1290 1291 if ( copy_from_user(tmp, hlp.counters, 1292 hlp.num_counters * sizeof(struct ebt_counter)) ) { 1293 BUGPRINT("Updata_counters && !cfu\n"); 1294 ret = -EFAULT; 1295 goto unlock_mutex; 1296 } 1297 1298 /* we want an atomic add of the counters */ 1299 write_lock_bh(&t->lock); 1300 1301 /* we add to the counters of the first cpu */ 1302 for (i = 0; i < hlp.num_counters; i++) { 1303 t->private->counters[i].pcnt += tmp[i].pcnt; 1304 t->private->counters[i].bcnt += tmp[i].bcnt; 1305 } 1306 1307 write_unlock_bh(&t->lock); 1308 ret = 0; 1309unlock_mutex: 1310 mutex_unlock(&ebt_mutex); 1311free_tmp: 1312 vfree(tmp); 1313 return ret; 1314} 1315 1316static inline int ebt_make_matchname(struct ebt_entry_match *m, 1317 char *base, char *ubase) 1318{ 1319 char *hlp = ubase - base + (char *)m; 1320 if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN)) 1321 return -EFAULT; 1322 return 0; 1323} 1324 1325static inline int ebt_make_watchername(struct ebt_entry_watcher *w, 1326 char *base, char *ubase) 1327{ 1328 char *hlp = ubase - base + (char *)w; 1329 if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN)) 1330 return -EFAULT; 1331 return 0; 1332} 1333 1334static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase) 1335{ 1336 int ret; 1337 char *hlp; 1338 struct ebt_entry_target *t; 1339 1340 if (e->bitmask == 0) 1341 return 0; 1342 1343 hlp = ubase - base + (char *)e + e->target_offset; 1344 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset); 1345 1346 ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase); 1347 if (ret != 0) 1348 return ret; 1349 ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase); 1350 if (ret != 0) 1351 return ret; 1352 if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN)) 1353 return -EFAULT; 1354 return 0; 1355} 1356 1357/* called with ebt_mutex locked */ 1358static int copy_everything_to_user(struct ebt_table *t, void __user *user, 1359 int *len, int cmd) 1360{ 1361 struct ebt_replace tmp; 1362 struct ebt_counter *counterstmp, *oldcounters; 1363 unsigned int entries_size, nentries; 1364 char *entries; 1365 1366 if (cmd == EBT_SO_GET_ENTRIES) { 1367 entries_size = t->private->entries_size; 1368 nentries = t->private->nentries; 1369 entries = t->private->entries; 1370 oldcounters = t->private->counters; 1371 } else { 1372 entries_size = t->table->entries_size; 1373 nentries = t->table->nentries; 1374 entries = t->table->entries; 1375 oldcounters = t->table->counters; 1376 } 1377 1378 if (copy_from_user(&tmp, user, sizeof(tmp))) { 1379 BUGPRINT("Cfu didn't work\n"); 1380 return -EFAULT; 1381 } 1382 1383 if (*len != sizeof(struct ebt_replace) + entries_size + 1384 (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) { 1385 BUGPRINT("Wrong size\n"); 1386 return -EINVAL; 1387 } 1388 1389 if (tmp.nentries != nentries) { 1390 BUGPRINT("Nentries wrong\n"); 1391 return -EINVAL; 1392 } 1393 1394 if (tmp.entries_size != entries_size) { 1395 BUGPRINT("Wrong size\n"); 1396 return -EINVAL; 1397 } 1398 1399 /* userspace might not need the counters */ 1400 if (tmp.num_counters) { 1401 if (tmp.num_counters != nentries) { 1402 BUGPRINT("Num_counters wrong\n"); 1403 return -EINVAL; 1404 } 1405 counterstmp = vmalloc(nentries * sizeof(*counterstmp)); 1406 if (!counterstmp) { 1407 MEMPRINT("Couldn't copy counters, out of memory\n"); 1408 return -ENOMEM; 1409 } 1410 write_lock_bh(&t->lock); 1411 get_counters(oldcounters, counterstmp, nentries); 1412 write_unlock_bh(&t->lock); 1413 1414 if (copy_to_user(tmp.counters, counterstmp, 1415 nentries * sizeof(struct ebt_counter))) { 1416 BUGPRINT("Couldn't copy counters to userspace\n"); 1417 vfree(counterstmp); 1418 return -EFAULT; 1419 } 1420 vfree(counterstmp); 1421 } 1422 1423 if (copy_to_user(tmp.entries, entries, entries_size)) { 1424 BUGPRINT("Couldn't copy entries to userspace\n"); 1425 return -EFAULT; 1426 } 1427 /* set the match/watcher/target names right */ 1428 return EBT_ENTRY_ITERATE(entries, entries_size, 1429 ebt_make_names, entries, tmp.entries); 1430} 1431 1432static int do_ebt_set_ctl(struct sock *sk, 1433 int cmd, void __user *user, unsigned int len) 1434{ 1435 int ret; 1436 1437 switch(cmd) { 1438 case EBT_SO_SET_ENTRIES: 1439 ret = do_replace(user, len); 1440 break; 1441 case EBT_SO_SET_COUNTERS: 1442 ret = update_counters(user, len); 1443 break; 1444 default: 1445 ret = -EINVAL; 1446 } 1447 return ret; 1448} 1449 1450static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 1451{ 1452 int ret; 1453 struct ebt_replace tmp; 1454 struct ebt_table *t; 1455 1456 if (copy_from_user(&tmp, user, sizeof(tmp))) 1457 return -EFAULT; 1458 1459 t = find_table_lock(tmp.name, &ret, &ebt_mutex); 1460 if (!t) 1461 return ret; 1462 1463 switch(cmd) { 1464 case EBT_SO_GET_INFO: 1465 case EBT_SO_GET_INIT_INFO: 1466 if (*len != sizeof(struct ebt_replace)){ 1467 ret = -EINVAL; 1468 mutex_unlock(&ebt_mutex); 1469 break; 1470 } 1471 if (cmd == EBT_SO_GET_INFO) { 1472 tmp.nentries = t->private->nentries; 1473 tmp.entries_size = t->private->entries_size; 1474 tmp.valid_hooks = t->valid_hooks; 1475 } else { 1476 tmp.nentries = t->table->nentries; 1477 tmp.entries_size = t->table->entries_size; 1478 tmp.valid_hooks = t->table->valid_hooks; 1479 } 1480 mutex_unlock(&ebt_mutex); 1481 if (copy_to_user(user, &tmp, *len) != 0){ 1482 BUGPRINT("c2u Didn't work\n"); 1483 ret = -EFAULT; 1484 break; 1485 } 1486 ret = 0; 1487 break; 1488 1489 case EBT_SO_GET_ENTRIES: 1490 case EBT_SO_GET_INIT_ENTRIES: 1491 ret = copy_everything_to_user(t, user, len, cmd); 1492 mutex_unlock(&ebt_mutex); 1493 break; 1494 1495 default: 1496 mutex_unlock(&ebt_mutex); 1497 ret = -EINVAL; 1498 } 1499 1500 return ret; 1501} 1502 1503static struct nf_sockopt_ops ebt_sockopts = 1504{ 1505 .pf = PF_INET, 1506 .set_optmin = EBT_BASE_CTL, 1507 .set_optmax = EBT_SO_SET_MAX + 1, 1508 .set = do_ebt_set_ctl, 1509 .get_optmin = EBT_BASE_CTL, 1510 .get_optmax = EBT_SO_GET_MAX + 1, 1511 .get = do_ebt_get_ctl, 1512}; 1513 1514static int __init ebtables_init(void) 1515{ 1516 int ret; 1517 1518 mutex_lock(&ebt_mutex); 1519 list_add(&ebt_standard_target.list, &ebt_targets); 1520 mutex_unlock(&ebt_mutex); 1521 if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0) 1522 return ret; 1523 1524 printk(KERN_NOTICE "Ebtables v2.0 registered\n"); 1525 return 0; 1526} 1527 1528static void __exit ebtables_fini(void) 1529{ 1530 nf_unregister_sockopt(&ebt_sockopts); 1531 printk(KERN_NOTICE "Ebtables v2.0 unregistered\n"); 1532} 1533 1534EXPORT_SYMBOL(ebt_register_table); 1535EXPORT_SYMBOL(ebt_unregister_table); 1536EXPORT_SYMBOL(ebt_register_match); 1537EXPORT_SYMBOL(ebt_unregister_match); 1538EXPORT_SYMBOL(ebt_register_watcher); 1539EXPORT_SYMBOL(ebt_unregister_watcher); 1540EXPORT_SYMBOL(ebt_register_target); 1541EXPORT_SYMBOL(ebt_unregister_target); 1542EXPORT_SYMBOL(ebt_do_table); 1543module_init(ebtables_init); 1544module_exit(ebtables_fini); 1545MODULE_LICENSE("GPL"); 1546