5 * Bart De Schuymer <bdschuym@pandora.be>
7 * ebtables.c,v 2.0, July, 2002
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
19 #include <linux/kmod.h>
20 #include <linux/module.h>
21 #include <linux/vmalloc.h>
22 #include <linux/netfilter/x_tables.h>
23 #include <linux/netfilter_bridge/ebtables.h>
24 #include <linux/spinlock.h>
25 #include <linux/mutex.h>
26 #include <asm/uaccess.h>
27 #include <linux/smp.h>
28 #include <linux/cpumask.h>
30 /* needed for logical [in,out]-dev filtering */
31 #include "../br_private.h"
33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
34 "report to author: "format, ## args)
35 /* #define BUGPRINT(format, args...) */
36 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
37 ": out of memory: "format, ## args)
38 /* #define MEMPRINT(format, args...) */
43 * Each cpu has its own set of counters, so there is no need for write_lock in
45 * For reading or updating the counters, the user context needs to
49 /* The size of each set of counters is altered to get cache alignment */
50 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
51 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
52 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
53 COUNTER_OFFSET(n) * cpu))
57 static DEFINE_MUTEX(ebt_mutex
);
58 static LIST_HEAD(ebt_tables
);
60 static struct xt_target ebt_standard_target
= {
63 .family
= NFPROTO_BRIDGE
,
64 .targetsize
= sizeof(int),
68 ebt_do_watcher(const struct ebt_entry_watcher
*w
, struct sk_buff
*skb
,
69 struct xt_target_param
*par
)
71 par
->target
= w
->u
.watcher
;
72 par
->targinfo
= w
->data
;
73 w
->u
.watcher
->target(skb
, par
);
74 /* watchers don't give a verdict */
78 static inline int ebt_do_match (struct ebt_entry_match
*m
,
79 const struct sk_buff
*skb
, struct xt_match_param
*par
)
81 par
->match
= m
->u
.match
;
82 par
->matchinfo
= m
->data
;
83 return m
->u
.match
->match(skb
, par
);
86 static inline int ebt_dev_check(char *entry
, const struct net_device
*device
)
89 const char *devname
= device
->name
;
95 /* 1 is the wildcard token */
96 while (entry
[i
] != '\0' && entry
[i
] != 1 && entry
[i
] == devname
[i
])
98 return (devname
[i
] != entry
[i
] && entry
[i
] != 1);
101 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
102 /* process standard matches */
103 static inline int ebt_basic_match(struct ebt_entry
*e
, struct ethhdr
*h
,
104 const struct net_device
*in
, const struct net_device
*out
)
108 if (e
->bitmask
& EBT_802_3
) {
109 if (FWINV2(ntohs(h
->h_proto
) >= 1536, EBT_IPROTO
))
111 } else if (!(e
->bitmask
& EBT_NOPROTO
) &&
112 FWINV2(e
->ethproto
!= h
->h_proto
, EBT_IPROTO
))
115 if (FWINV2(ebt_dev_check(e
->in
, in
), EBT_IIN
))
117 if (FWINV2(ebt_dev_check(e
->out
, out
), EBT_IOUT
))
119 if ((!in
|| !in
->br_port
) ? 0 : FWINV2(ebt_dev_check(
120 e
->logical_in
, in
->br_port
->br
->dev
), EBT_ILOGICALIN
))
122 if ((!out
|| !out
->br_port
) ? 0 : FWINV2(ebt_dev_check(
123 e
->logical_out
, out
->br_port
->br
->dev
), EBT_ILOGICALOUT
))
126 if (e
->bitmask
& EBT_SOURCEMAC
) {
128 for (i
= 0; i
< 6; i
++)
129 verdict
|= (h
->h_source
[i
] ^ e
->sourcemac
[i
]) &
131 if (FWINV2(verdict
!= 0, EBT_ISOURCE
) )
134 if (e
->bitmask
& EBT_DESTMAC
) {
136 for (i
= 0; i
< 6; i
++)
137 verdict
|= (h
->h_dest
[i
] ^ e
->destmac
[i
]) &
139 if (FWINV2(verdict
!= 0, EBT_IDEST
) )
145 /* Do some firewalling */
146 unsigned int ebt_do_table (unsigned int hook
, struct sk_buff
*skb
,
147 const struct net_device
*in
, const struct net_device
*out
,
148 struct ebt_table
*table
)
151 struct ebt_entry
*point
;
152 struct ebt_counter
*counter_base
, *cb_base
;
153 struct ebt_entry_target
*t
;
155 struct ebt_chainstack
*cs
;
156 struct ebt_entries
*chaininfo
;
158 struct ebt_table_info
*private;
159 bool hotdrop
= false;
160 struct xt_match_param mtpar
;
161 struct xt_target_param tgpar
;
163 mtpar
.in
= tgpar
.in
= in
;
164 mtpar
.out
= tgpar
.out
= out
;
165 mtpar
.hotdrop
= &hotdrop
;
166 tgpar
.hooknum
= hook
;
168 read_lock_bh(&table
->lock
);
169 private = table
->private;
170 cb_base
= COUNTER_BASE(private->counters
, private->nentries
,
172 if (private->chainstack
)
173 cs
= private->chainstack
[smp_processor_id()];
176 chaininfo
= private->hook_entry
[hook
];
177 nentries
= private->hook_entry
[hook
]->nentries
;
178 point
= (struct ebt_entry
*)(private->hook_entry
[hook
]->data
);
179 counter_base
= cb_base
+ private->hook_entry
[hook
]->counter_offset
;
180 /* base for chain jumps */
181 base
= private->entries
;
183 while (i
< nentries
) {
184 if (ebt_basic_match(point
, eth_hdr(skb
), in
, out
))
187 if (EBT_MATCH_ITERATE(point
, ebt_do_match
, skb
, &mtpar
) != 0)
190 read_unlock_bh(&table
->lock
);
194 /* increase counter */
195 (*(counter_base
+ i
)).pcnt
++;
196 (*(counter_base
+ i
)).bcnt
+= skb
->len
;
198 /* these should only watch: not modify, nor tell us
199 what to do with the packet */
200 EBT_WATCHER_ITERATE(point
, ebt_do_watcher
, skb
, &tgpar
);
202 t
= (struct ebt_entry_target
*)
203 (((char *)point
) + point
->target_offset
);
204 /* standard target */
205 if (!t
->u
.target
->target
)
206 verdict
= ((struct ebt_standard_target
*)t
)->verdict
;
208 tgpar
.target
= t
->u
.target
;
209 tgpar
.targinfo
= t
->data
;
210 verdict
= t
->u
.target
->target(skb
, &tgpar
);
212 if (verdict
== EBT_ACCEPT
) {
213 read_unlock_bh(&table
->lock
);
216 if (verdict
== EBT_DROP
) {
217 read_unlock_bh(&table
->lock
);
220 if (verdict
== EBT_RETURN
) {
222 #ifdef CONFIG_NETFILTER_DEBUG
224 BUGPRINT("RETURN on base chain");
225 /* act like this is EBT_CONTINUE */
230 /* put all the local variables right */
232 chaininfo
= cs
[sp
].chaininfo
;
233 nentries
= chaininfo
->nentries
;
235 counter_base
= cb_base
+
236 chaininfo
->counter_offset
;
239 if (verdict
== EBT_CONTINUE
)
241 #ifdef CONFIG_NETFILTER_DEBUG
243 BUGPRINT("bogus standard verdict\n");
244 read_unlock_bh(&table
->lock
);
250 cs
[sp
].chaininfo
= chaininfo
;
251 cs
[sp
].e
= (struct ebt_entry
*)
252 (((char *)point
) + point
->next_offset
);
254 chaininfo
= (struct ebt_entries
*) (base
+ verdict
);
255 #ifdef CONFIG_NETFILTER_DEBUG
256 if (chaininfo
->distinguisher
) {
257 BUGPRINT("jump to non-chain\n");
258 read_unlock_bh(&table
->lock
);
262 nentries
= chaininfo
->nentries
;
263 point
= (struct ebt_entry
*)chaininfo
->data
;
264 counter_base
= cb_base
+ chaininfo
->counter_offset
;
268 point
= (struct ebt_entry
*)
269 (((char *)point
) + point
->next_offset
);
273 /* I actually like this :) */
274 if (chaininfo
->policy
== EBT_RETURN
)
276 if (chaininfo
->policy
== EBT_ACCEPT
) {
277 read_unlock_bh(&table
->lock
);
280 read_unlock_bh(&table
->lock
);
284 /* If it succeeds, returns element and locks mutex */
286 find_inlist_lock_noload(struct list_head
*head
, const char *name
, int *error
,
290 struct list_head list
;
291 char name
[EBT_FUNCTION_MAXNAMELEN
];
294 *error
= mutex_lock_interruptible(mutex
);
298 list_for_each_entry(e
, head
, list
) {
299 if (strcmp(e
->name
, name
) == 0)
308 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
311 find_inlist_lock(struct list_head
*head
, const char *name
, const char *prefix
,
312 int *error
, struct mutex
*mutex
)
316 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
318 request_module("%s%s", prefix
, name
);
319 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
325 static inline struct ebt_table
*
326 find_table_lock(const char *name
, int *error
, struct mutex
*mutex
)
328 return find_inlist_lock(&ebt_tables
, name
, "ebtable_", error
, mutex
);
332 ebt_check_match(struct ebt_entry_match
*m
, struct xt_mtchk_param
*par
,
335 const struct ebt_entry
*e
= par
->entryinfo
;
336 struct xt_match
*match
;
337 size_t left
= ((char *)e
+ e
->watchers_offset
) - (char *)m
;
340 if (left
< sizeof(struct ebt_entry_match
) ||
341 left
- sizeof(struct ebt_entry_match
) < m
->match_size
)
344 match
= try_then_request_module(xt_find_match(NFPROTO_BRIDGE
,
345 m
->u
.name
, 0), "ebt_%s", m
->u
.name
);
347 return PTR_ERR(match
);
353 par
->matchinfo
= m
->data
;
354 ret
= xt_check_match(par
, NFPROTO_BRIDGE
, m
->match_size
,
355 e
->ethproto
, e
->invflags
& EBT_IPROTO
);
357 module_put(match
->me
);
366 ebt_check_watcher(struct ebt_entry_watcher
*w
, struct xt_tgchk_param
*par
,
369 const struct ebt_entry
*e
= par
->entryinfo
;
370 struct xt_target
*watcher
;
371 size_t left
= ((char *)e
+ e
->target_offset
) - (char *)w
;
374 if (left
< sizeof(struct ebt_entry_watcher
) ||
375 left
- sizeof(struct ebt_entry_watcher
) < w
->watcher_size
)
378 watcher
= try_then_request_module(
379 xt_find_target(NFPROTO_BRIDGE
, w
->u
.name
, 0),
380 "ebt_%s", w
->u
.name
);
382 return PTR_ERR(watcher
);
385 w
->u
.watcher
= watcher
;
387 par
->target
= watcher
;
388 par
->targinfo
= w
->data
;
389 ret
= xt_check_target(par
, NFPROTO_BRIDGE
, w
->watcher_size
,
390 e
->ethproto
, e
->invflags
& EBT_IPROTO
);
392 module_put(watcher
->me
);
400 static int ebt_verify_pointers(struct ebt_replace
*repl
,
401 struct ebt_table_info
*newinfo
)
403 unsigned int limit
= repl
->entries_size
;
404 unsigned int valid_hooks
= repl
->valid_hooks
;
405 unsigned int offset
= 0;
408 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++)
409 newinfo
->hook_entry
[i
] = NULL
;
411 newinfo
->entries_size
= repl
->entries_size
;
412 newinfo
->nentries
= repl
->nentries
;
414 while (offset
< limit
) {
415 size_t left
= limit
- offset
;
416 struct ebt_entry
*e
= (void *)newinfo
->entries
+ offset
;
418 if (left
< sizeof(unsigned int))
421 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
422 if ((valid_hooks
& (1 << i
)) == 0)
424 if ((char __user
*)repl
->hook_entry
[i
] ==
425 repl
->entries
+ offset
)
429 if (i
!= NF_BR_NUMHOOKS
|| !(e
->bitmask
& EBT_ENTRY_OR_ENTRIES
)) {
430 if (e
->bitmask
!= 0) {
431 /* we make userspace set this right,
432 so there is no misunderstanding */
433 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
434 "in distinguisher\n");
437 if (i
!= NF_BR_NUMHOOKS
)
438 newinfo
->hook_entry
[i
] = (struct ebt_entries
*)e
;
439 if (left
< sizeof(struct ebt_entries
))
441 offset
+= sizeof(struct ebt_entries
);
443 if (left
< sizeof(struct ebt_entry
))
445 if (left
< e
->next_offset
)
447 offset
+= e
->next_offset
;
450 if (offset
!= limit
) {
451 BUGPRINT("entries_size too small\n");
455 /* check if all valid hooks have a chain */
456 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
457 if (!newinfo
->hook_entry
[i
] &&
458 (valid_hooks
& (1 << i
))) {
459 BUGPRINT("Valid hook without chain\n");
467 * this one is very careful, as it is the first function
468 * to parse the userspace data
471 ebt_check_entry_size_and_hooks(struct ebt_entry
*e
,
472 struct ebt_table_info
*newinfo
,
473 unsigned int *n
, unsigned int *cnt
,
474 unsigned int *totalcnt
, unsigned int *udc_cnt
)
478 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
479 if ((void *)e
== (void *)newinfo
->hook_entry
[i
])
482 /* beginning of a new chain
483 if i == NF_BR_NUMHOOKS it must be a user defined chain */
484 if (i
!= NF_BR_NUMHOOKS
|| !e
->bitmask
) {
485 /* this checks if the previous chain has as many entries
488 BUGPRINT("nentries does not equal the nr of entries "
492 if (((struct ebt_entries
*)e
)->policy
!= EBT_DROP
&&
493 ((struct ebt_entries
*)e
)->policy
!= EBT_ACCEPT
) {
494 /* only RETURN from udc */
495 if (i
!= NF_BR_NUMHOOKS
||
496 ((struct ebt_entries
*)e
)->policy
!= EBT_RETURN
) {
497 BUGPRINT("bad policy\n");
501 if (i
== NF_BR_NUMHOOKS
) /* it's a user defined chain */
503 if (((struct ebt_entries
*)e
)->counter_offset
!= *totalcnt
) {
504 BUGPRINT("counter_offset != totalcnt");
507 *n
= ((struct ebt_entries
*)e
)->nentries
;
511 /* a plain old entry, heh */
512 if (sizeof(struct ebt_entry
) > e
->watchers_offset
||
513 e
->watchers_offset
> e
->target_offset
||
514 e
->target_offset
>= e
->next_offset
) {
515 BUGPRINT("entry offsets not in right order\n");
518 /* this is not checked anywhere else */
519 if (e
->next_offset
- e
->target_offset
< sizeof(struct ebt_entry_target
)) {
520 BUGPRINT("target size too small\n");
530 struct ebt_chainstack cs
;
532 unsigned int hookmask
;
536 * we need these positions to check that the jumps to a different part of the
537 * entries is a jump to the beginning of a new chain.
540 ebt_get_udc_positions(struct ebt_entry
*e
, struct ebt_table_info
*newinfo
,
541 unsigned int *n
, struct ebt_cl_stack
*udc
)
545 /* we're only interested in chain starts */
548 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
549 if (newinfo
->hook_entry
[i
] == (struct ebt_entries
*)e
)
552 /* only care about udc */
553 if (i
!= NF_BR_NUMHOOKS
)
556 udc
[*n
].cs
.chaininfo
= (struct ebt_entries
*)e
;
557 /* these initialisations are depended on later in check_chainloops() */
559 udc
[*n
].hookmask
= 0;
566 ebt_cleanup_match(struct ebt_entry_match
*m
, unsigned int *i
)
568 struct xt_mtdtor_param par
;
570 if (i
&& (*i
)-- == 0)
573 par
.match
= m
->u
.match
;
574 par
.matchinfo
= m
->data
;
575 if (par
.match
->destroy
!= NULL
)
576 par
.match
->destroy(&par
);
577 module_put(par
.match
->me
);
582 ebt_cleanup_watcher(struct ebt_entry_watcher
*w
, unsigned int *i
)
584 if (i
&& (*i
)-- == 0)
586 if (w
->u
.watcher
->destroy
)
587 w
->u
.watcher
->destroy(w
->u
.watcher
, w
->data
);
588 module_put(w
->u
.watcher
->me
);
594 ebt_cleanup_entry(struct ebt_entry
*e
, unsigned int *cnt
)
596 struct ebt_entry_target
*t
;
601 if (cnt
&& (*cnt
)-- == 0)
603 EBT_WATCHER_ITERATE(e
, ebt_cleanup_watcher
, NULL
);
604 EBT_MATCH_ITERATE(e
, ebt_cleanup_match
, NULL
);
605 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
606 if (t
->u
.target
->destroy
)
607 t
->u
.target
->destroy(t
->u
.target
, t
->data
);
608 module_put(t
->u
.target
->me
);
614 ebt_check_entry(struct ebt_entry
*e
, struct ebt_table_info
*newinfo
,
615 const char *name
, unsigned int *cnt
,
616 struct ebt_cl_stack
*cl_s
, unsigned int udc_cnt
)
618 struct ebt_entry_target
*t
;
619 struct xt_target
*target
;
620 unsigned int i
, j
, hook
= 0, hookmask
= 0;
623 struct xt_mtchk_param mtpar
;
624 struct xt_tgchk_param tgpar
;
626 /* don't mess with the struct ebt_entries */
630 if (e
->bitmask
& ~EBT_F_MASK
) {
631 BUGPRINT("Unknown flag for bitmask\n");
634 if (e
->invflags
& ~EBT_INV_MASK
) {
635 BUGPRINT("Unknown flag for inv bitmask\n");
638 if ( (e
->bitmask
& EBT_NOPROTO
) && (e
->bitmask
& EBT_802_3
) ) {
639 BUGPRINT("NOPROTO & 802_3 not allowed\n");
642 /* what hook do we belong to? */
643 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
644 if (!newinfo
->hook_entry
[i
])
646 if ((char *)newinfo
->hook_entry
[i
] < (char *)e
)
651 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
653 if (i
< NF_BR_NUMHOOKS
)
654 hookmask
= (1 << hook
) | (1 << NF_BR_NUMHOOKS
);
656 for (i
= 0; i
< udc_cnt
; i
++)
657 if ((char *)(cl_s
[i
].cs
.chaininfo
) > (char *)e
)
660 hookmask
= (1 << hook
) | (1 << NF_BR_NUMHOOKS
);
662 hookmask
= cl_s
[i
- 1].hookmask
;
666 mtpar
.table
= tgpar
.table
= name
;
667 mtpar
.entryinfo
= tgpar
.entryinfo
= e
;
668 mtpar
.hook_mask
= tgpar
.hook_mask
= hookmask
;
669 ret
= EBT_MATCH_ITERATE(e
, ebt_check_match
, &mtpar
, &i
);
671 goto cleanup_matches
;
673 ret
= EBT_WATCHER_ITERATE(e
, ebt_check_watcher
, &tgpar
, &j
);
675 goto cleanup_watchers
;
676 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
677 gap
= e
->next_offset
- e
->target_offset
;
679 target
= try_then_request_module(
680 xt_find_target(NFPROTO_BRIDGE
, t
->u
.name
, 0),
681 "ebt_%s", t
->u
.name
);
682 if (IS_ERR(target
)) {
683 ret
= PTR_ERR(target
);
684 goto cleanup_watchers
;
685 } else if (target
== NULL
) {
687 goto cleanup_watchers
;
690 t
->u
.target
= target
;
691 if (t
->u
.target
== &ebt_standard_target
) {
692 if (gap
< sizeof(struct ebt_standard_target
)) {
693 BUGPRINT("Standard target size too big\n");
695 goto cleanup_watchers
;
697 if (((struct ebt_standard_target
*)t
)->verdict
<
698 -NUM_STANDARD_TARGETS
) {
699 BUGPRINT("Invalid standard target\n");
701 goto cleanup_watchers
;
703 } else if (t
->target_size
> gap
- sizeof(struct ebt_entry_target
)) {
704 module_put(t
->u
.target
->me
);
706 goto cleanup_watchers
;
709 tgpar
.target
= target
;
710 tgpar
.targinfo
= t
->data
;
711 ret
= xt_check_target(&tgpar
, NFPROTO_BRIDGE
, t
->target_size
,
712 e
->ethproto
, e
->invflags
& EBT_IPROTO
);
714 module_put(target
->me
);
715 goto cleanup_watchers
;
720 EBT_WATCHER_ITERATE(e
, ebt_cleanup_watcher
, &j
);
722 EBT_MATCH_ITERATE(e
, ebt_cleanup_match
, &i
);
727 * checks for loops and sets the hook mask for udc
728 * the hook mask for udc tells us from which base chains the udc can be
729 * accessed. This mask is a parameter to the check() functions of the extensions
731 static int check_chainloops(struct ebt_entries
*chain
, struct ebt_cl_stack
*cl_s
,
732 unsigned int udc_cnt
, unsigned int hooknr
, char *base
)
734 int i
, chain_nr
= -1, pos
= 0, nentries
= chain
->nentries
, verdict
;
735 struct ebt_entry
*e
= (struct ebt_entry
*)chain
->data
;
736 struct ebt_entry_target
*t
;
738 while (pos
< nentries
|| chain_nr
!= -1) {
739 /* end of udc, go back one 'recursion' step */
740 if (pos
== nentries
) {
741 /* put back values of the time when this chain was called */
742 e
= cl_s
[chain_nr
].cs
.e
;
743 if (cl_s
[chain_nr
].from
!= -1)
745 cl_s
[cl_s
[chain_nr
].from
].cs
.chaininfo
->nentries
;
747 nentries
= chain
->nentries
;
748 pos
= cl_s
[chain_nr
].cs
.n
;
749 /* make sure we won't see a loop that isn't one */
750 cl_s
[chain_nr
].cs
.n
= 0;
751 chain_nr
= cl_s
[chain_nr
].from
;
755 t
= (struct ebt_entry_target
*)
756 (((char *)e
) + e
->target_offset
);
757 if (strcmp(t
->u
.name
, EBT_STANDARD_TARGET
))
759 if (e
->target_offset
+ sizeof(struct ebt_standard_target
) >
761 BUGPRINT("Standard target size too big\n");
764 verdict
= ((struct ebt_standard_target
*)t
)->verdict
;
765 if (verdict
>= 0) { /* jump to another chain */
766 struct ebt_entries
*hlp2
=
767 (struct ebt_entries
*)(base
+ verdict
);
768 for (i
= 0; i
< udc_cnt
; i
++)
769 if (hlp2
== cl_s
[i
].cs
.chaininfo
)
771 /* bad destination or loop */
773 BUGPRINT("bad destination\n");
780 if (cl_s
[i
].hookmask
& (1 << hooknr
))
782 /* this can't be 0, so the loop test is correct */
783 cl_s
[i
].cs
.n
= pos
+ 1;
785 cl_s
[i
].cs
.e
= ((void *)e
+ e
->next_offset
);
786 e
= (struct ebt_entry
*)(hlp2
->data
);
787 nentries
= hlp2
->nentries
;
788 cl_s
[i
].from
= chain_nr
;
790 /* this udc is accessible from the base chain for hooknr */
791 cl_s
[i
].hookmask
|= (1 << hooknr
);
795 e
= (void *)e
+ e
->next_offset
;
801 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
802 static int translate_table(char *name
, struct ebt_table_info
*newinfo
)
804 unsigned int i
, j
, k
, udc_cnt
;
806 struct ebt_cl_stack
*cl_s
= NULL
; /* used in the checking for chain loops */
809 while (i
< NF_BR_NUMHOOKS
&& !newinfo
->hook_entry
[i
])
811 if (i
== NF_BR_NUMHOOKS
) {
812 BUGPRINT("No valid hooks specified\n");
815 if (newinfo
->hook_entry
[i
] != (struct ebt_entries
*)newinfo
->entries
) {
816 BUGPRINT("Chains don't start at beginning\n");
819 /* make sure chains are ordered after each other in same order
820 as their corresponding hooks */
821 for (j
= i
+ 1; j
< NF_BR_NUMHOOKS
; j
++) {
822 if (!newinfo
->hook_entry
[j
])
824 if (newinfo
->hook_entry
[j
] <= newinfo
->hook_entry
[i
]) {
825 BUGPRINT("Hook order must be followed\n");
831 /* do some early checkings and initialize some things */
832 i
= 0; /* holds the expected nr. of entries for the chain */
833 j
= 0; /* holds the up to now counted entries for the chain */
834 k
= 0; /* holds the total nr. of entries, should equal
835 newinfo->nentries afterwards */
836 udc_cnt
= 0; /* will hold the nr. of user defined chains (udc) */
837 ret
= EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
838 ebt_check_entry_size_and_hooks
, newinfo
,
839 &i
, &j
, &k
, &udc_cnt
);
845 BUGPRINT("nentries does not equal the nr of entries in the "
849 if (k
!= newinfo
->nentries
) {
850 BUGPRINT("Total nentries is wrong\n");
854 /* get the location of the udc, put them in an array
855 while we're at it, allocate the chainstack */
857 /* this will get free'd in do_replace()/ebt_register_table()
858 if an error occurs */
859 newinfo
->chainstack
=
860 vmalloc(nr_cpu_ids
* sizeof(*(newinfo
->chainstack
)));
861 if (!newinfo
->chainstack
)
863 for_each_possible_cpu(i
) {
864 newinfo
->chainstack
[i
] =
865 vmalloc(udc_cnt
* sizeof(*(newinfo
->chainstack
[0])));
866 if (!newinfo
->chainstack
[i
]) {
868 vfree(newinfo
->chainstack
[--i
]);
869 vfree(newinfo
->chainstack
);
870 newinfo
->chainstack
= NULL
;
875 cl_s
= vmalloc(udc_cnt
* sizeof(*cl_s
));
878 i
= 0; /* the i'th udc */
879 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
880 ebt_get_udc_positions
, newinfo
, &i
, cl_s
);
883 BUGPRINT("i != udc_cnt\n");
889 /* Check for loops */
890 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++)
891 if (newinfo
->hook_entry
[i
])
892 if (check_chainloops(newinfo
->hook_entry
[i
],
893 cl_s
, udc_cnt
, i
, newinfo
->entries
)) {
898 /* we now know the following (along with E=mc²):
899 - the nr of entries in each chain is right
900 - the size of the allocated space is right
901 - all valid hooks have a corresponding chain
903 - wrong data can still be on the level of a single entry
904 - could be there are jumps to places that are not the
905 beginning of a chain. This can only occur in chains that
906 are not accessible from any base chains, so we don't care. */
908 /* used to know what we need to clean up if something goes wrong */
910 ret
= EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
911 ebt_check_entry
, newinfo
, name
, &i
, cl_s
, udc_cnt
);
913 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
914 ebt_cleanup_entry
, &i
);
920 /* called under write_lock */
921 static void get_counters(struct ebt_counter
*oldcounters
,
922 struct ebt_counter
*counters
, unsigned int nentries
)
925 struct ebt_counter
*counter_base
;
927 /* counters of cpu 0 */
928 memcpy(counters
, oldcounters
,
929 sizeof(struct ebt_counter
) * nentries
);
931 /* add other counters to those of cpu 0 */
932 for_each_possible_cpu(cpu
) {
935 counter_base
= COUNTER_BASE(oldcounters
, nentries
, cpu
);
936 for (i
= 0; i
< nentries
; i
++) {
937 counters
[i
].pcnt
+= counter_base
[i
].pcnt
;
938 counters
[i
].bcnt
+= counter_base
[i
].bcnt
;
943 /* replace the table */
944 static int do_replace(void __user
*user
, unsigned int len
)
946 int ret
, i
, countersize
;
947 struct ebt_table_info
*newinfo
;
948 struct ebt_replace tmp
;
950 struct ebt_counter
*counterstmp
= NULL
;
951 /* used to be able to unlock earlier */
952 struct ebt_table_info
*table
;
954 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
957 if (len
!= sizeof(tmp
) + tmp
.entries_size
) {
958 BUGPRINT("Wrong len argument\n");
962 if (tmp
.entries_size
== 0) {
963 BUGPRINT("Entries_size never zero\n");
967 if (tmp
.nentries
>= ((INT_MAX
- sizeof(struct ebt_table_info
)) / NR_CPUS
-
968 SMP_CACHE_BYTES
) / sizeof(struct ebt_counter
))
970 if (tmp
.num_counters
>= INT_MAX
/ sizeof(struct ebt_counter
))
973 countersize
= COUNTER_OFFSET(tmp
.nentries
) * nr_cpu_ids
;
974 newinfo
= vmalloc(sizeof(*newinfo
) + countersize
);
979 memset(newinfo
->counters
, 0, countersize
);
981 newinfo
->entries
= vmalloc(tmp
.entries_size
);
982 if (!newinfo
->entries
) {
987 newinfo
->entries
, tmp
.entries
, tmp
.entries_size
) != 0) {
988 BUGPRINT("Couldn't copy entries from userspace\n");
993 /* the user wants counters back
994 the check on the size is done later, when we have the lock */
995 if (tmp
.num_counters
) {
996 counterstmp
= vmalloc(tmp
.num_counters
* sizeof(*counterstmp
));
1005 /* this can get initialized by translate_table() */
1006 newinfo
->chainstack
= NULL
;
1007 ret
= ebt_verify_pointers(&tmp
, newinfo
);
1009 goto free_counterstmp
;
1011 ret
= translate_table(tmp
.name
, newinfo
);
1014 goto free_counterstmp
;
1016 t
= find_table_lock(tmp
.name
, &ret
, &ebt_mutex
);
1022 /* the table doesn't like it */
1023 if (t
->check
&& (ret
= t
->check(newinfo
, tmp
.valid_hooks
)))
1026 if (tmp
.num_counters
&& tmp
.num_counters
!= t
->private->nentries
) {
1027 BUGPRINT("Wrong nr. of counters requested\n");
1032 /* we have the mutex lock, so no danger in reading this pointer */
1034 /* make sure the table can only be rmmod'ed if it contains no rules */
1035 if (!table
->nentries
&& newinfo
->nentries
&& !try_module_get(t
->me
)) {
1038 } else if (table
->nentries
&& !newinfo
->nentries
)
1040 /* we need an atomic snapshot of the counters */
1041 write_lock_bh(&t
->lock
);
1042 if (tmp
.num_counters
)
1043 get_counters(t
->private->counters
, counterstmp
,
1044 t
->private->nentries
);
1046 t
->private = newinfo
;
1047 write_unlock_bh(&t
->lock
);
1048 mutex_unlock(&ebt_mutex
);
1049 /* so, a user can change the chains while having messed up her counter
1050 allocation. Only reason why this is done is because this way the lock
1051 is held only once, while this doesn't bring the kernel into a
1053 if (tmp
.num_counters
&&
1054 copy_to_user(tmp
.counters
, counterstmp
,
1055 tmp
.num_counters
* sizeof(struct ebt_counter
))) {
1056 BUGPRINT("Couldn't copy counters to userspace\n");
1062 /* decrease module count and free resources */
1063 EBT_ENTRY_ITERATE(table
->entries
, table
->entries_size
,
1064 ebt_cleanup_entry
, NULL
);
1066 vfree(table
->entries
);
1067 if (table
->chainstack
) {
1068 for_each_possible_cpu(i
)
1069 vfree(table
->chainstack
[i
]);
1070 vfree(table
->chainstack
);
1078 mutex_unlock(&ebt_mutex
);
1080 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
1081 ebt_cleanup_entry
, NULL
);
1084 /* can be initialized in translate_table() */
1085 if (newinfo
->chainstack
) {
1086 for_each_possible_cpu(i
)
1087 vfree(newinfo
->chainstack
[i
]);
1088 vfree(newinfo
->chainstack
);
1091 vfree(newinfo
->entries
);
1097 int ebt_register_table(struct ebt_table
*table
)
1099 struct ebt_table_info
*newinfo
;
1100 struct ebt_table
*t
;
1101 struct ebt_replace_kernel
*repl
;
1102 int ret
, i
, countersize
;
1105 if (!table
|| !(repl
= table
->table
) || !repl
->entries
||
1106 repl
->entries_size
== 0 ||
1107 repl
->counters
|| table
->private) {
1108 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1112 countersize
= COUNTER_OFFSET(repl
->nentries
) * nr_cpu_ids
;
1113 newinfo
= vmalloc(sizeof(*newinfo
) + countersize
);
1118 p
= vmalloc(repl
->entries_size
);
1122 memcpy(p
, repl
->entries
, repl
->entries_size
);
1123 newinfo
->entries
= p
;
1125 newinfo
->entries_size
= repl
->entries_size
;
1126 newinfo
->nentries
= repl
->nentries
;
1129 memset(newinfo
->counters
, 0, countersize
);
1131 /* fill in newinfo and parse the entries */
1132 newinfo
->chainstack
= NULL
;
1133 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
1134 if ((repl
->valid_hooks
& (1 << i
)) == 0)
1135 newinfo
->hook_entry
[i
] = NULL
;
1137 newinfo
->hook_entry
[i
] = p
+
1138 ((char *)repl
->hook_entry
[i
] - repl
->entries
);
1140 ret
= translate_table(repl
->name
, newinfo
);
1142 BUGPRINT("Translate_table failed\n");
1143 goto free_chainstack
;
1146 if (table
->check
&& table
->check(newinfo
, table
->valid_hooks
)) {
1147 BUGPRINT("The table doesn't like its own initial data, lol\n");
1151 table
->private = newinfo
;
1152 rwlock_init(&table
->lock
);
1153 ret
= mutex_lock_interruptible(&ebt_mutex
);
1155 goto free_chainstack
;
1157 list_for_each_entry(t
, &ebt_tables
, list
) {
1158 if (strcmp(t
->name
, table
->name
) == 0) {
1160 BUGPRINT("Table name already exists\n");
1165 /* Hold a reference count if the chains aren't empty */
1166 if (newinfo
->nentries
&& !try_module_get(table
->me
)) {
1170 list_add(&table
->list
, &ebt_tables
);
1171 mutex_unlock(&ebt_mutex
);
1174 mutex_unlock(&ebt_mutex
);
1176 if (newinfo
->chainstack
) {
1177 for_each_possible_cpu(i
)
1178 vfree(newinfo
->chainstack
[i
]);
1179 vfree(newinfo
->chainstack
);
1181 vfree(newinfo
->entries
);
1187 void ebt_unregister_table(struct ebt_table
*table
)
1192 BUGPRINT("Request to unregister NULL table!!!\n");
1195 mutex_lock(&ebt_mutex
);
1196 list_del(&table
->list
);
1197 mutex_unlock(&ebt_mutex
);
1198 vfree(table
->private->entries
);
1199 if (table
->private->chainstack
) {
1200 for_each_possible_cpu(i
)
1201 vfree(table
->private->chainstack
[i
]);
1202 vfree(table
->private->chainstack
);
1204 vfree(table
->private);
1207 /* userspace just supplied us with counters */
1208 static int update_counters(void __user
*user
, unsigned int len
)
1211 struct ebt_counter
*tmp
;
1212 struct ebt_replace hlp
;
1213 struct ebt_table
*t
;
1215 if (copy_from_user(&hlp
, user
, sizeof(hlp
)))
1218 if (len
!= sizeof(hlp
) + hlp
.num_counters
* sizeof(struct ebt_counter
))
1220 if (hlp
.num_counters
== 0)
1223 if (!(tmp
= vmalloc(hlp
.num_counters
* sizeof(*tmp
)))) {
1224 MEMPRINT("Update_counters && nomemory\n");
1228 t
= find_table_lock(hlp
.name
, &ret
, &ebt_mutex
);
1232 if (hlp
.num_counters
!= t
->private->nentries
) {
1233 BUGPRINT("Wrong nr of counters\n");
1238 if ( copy_from_user(tmp
, hlp
.counters
,
1239 hlp
.num_counters
* sizeof(struct ebt_counter
)) ) {
1240 BUGPRINT("Updata_counters && !cfu\n");
1245 /* we want an atomic add of the counters */
1246 write_lock_bh(&t
->lock
);
1248 /* we add to the counters of the first cpu */
1249 for (i
= 0; i
< hlp
.num_counters
; i
++) {
1250 t
->private->counters
[i
].pcnt
+= tmp
[i
].pcnt
;
1251 t
->private->counters
[i
].bcnt
+= tmp
[i
].bcnt
;
1254 write_unlock_bh(&t
->lock
);
1257 mutex_unlock(&ebt_mutex
);
1263 static inline int ebt_make_matchname(struct ebt_entry_match
*m
,
1264 char *base
, char __user
*ubase
)
1266 char __user
*hlp
= ubase
+ ((char *)m
- base
);
1267 if (copy_to_user(hlp
, m
->u
.match
->name
, EBT_FUNCTION_MAXNAMELEN
))
1272 static inline int ebt_make_watchername(struct ebt_entry_watcher
*w
,
1273 char *base
, char __user
*ubase
)
1275 char __user
*hlp
= ubase
+ ((char *)w
- base
);
1276 if (copy_to_user(hlp
, w
->u
.watcher
->name
, EBT_FUNCTION_MAXNAMELEN
))
1281 static inline int ebt_make_names(struct ebt_entry
*e
, char *base
, char __user
*ubase
)
1285 struct ebt_entry_target
*t
;
1287 if (e
->bitmask
== 0)
1290 hlp
= ubase
+ (((char *)e
+ e
->target_offset
) - base
);
1291 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
1293 ret
= EBT_MATCH_ITERATE(e
, ebt_make_matchname
, base
, ubase
);
1296 ret
= EBT_WATCHER_ITERATE(e
, ebt_make_watchername
, base
, ubase
);
1299 if (copy_to_user(hlp
, t
->u
.target
->name
, EBT_FUNCTION_MAXNAMELEN
))
1304 /* called with ebt_mutex locked */
1305 static int copy_everything_to_user(struct ebt_table
*t
, void __user
*user
,
1308 struct ebt_replace tmp
;
1309 struct ebt_counter
*counterstmp
, *oldcounters
;
1310 unsigned int entries_size
, nentries
;
1313 if (cmd
== EBT_SO_GET_ENTRIES
) {
1314 entries_size
= t
->private->entries_size
;
1315 nentries
= t
->private->nentries
;
1316 entries
= t
->private->entries
;
1317 oldcounters
= t
->private->counters
;
1319 entries_size
= t
->table
->entries_size
;
1320 nentries
= t
->table
->nentries
;
1321 entries
= t
->table
->entries
;
1322 oldcounters
= t
->table
->counters
;
1325 if (copy_from_user(&tmp
, user
, sizeof(tmp
))) {
1326 BUGPRINT("Cfu didn't work\n");
1330 if (*len
!= sizeof(struct ebt_replace
) + entries_size
+
1331 (tmp
.num_counters
? nentries
* sizeof(struct ebt_counter
): 0)) {
1332 BUGPRINT("Wrong size\n");
1336 if (tmp
.nentries
!= nentries
) {
1337 BUGPRINT("Nentries wrong\n");
1341 if (tmp
.entries_size
!= entries_size
) {
1342 BUGPRINT("Wrong size\n");
1346 /* userspace might not need the counters */
1347 if (tmp
.num_counters
) {
1348 if (tmp
.num_counters
!= nentries
) {
1349 BUGPRINT("Num_counters wrong\n");
1352 counterstmp
= vmalloc(nentries
* sizeof(*counterstmp
));
1354 MEMPRINT("Couldn't copy counters, out of memory\n");
1357 write_lock_bh(&t
->lock
);
1358 get_counters(oldcounters
, counterstmp
, nentries
);
1359 write_unlock_bh(&t
->lock
);
1361 if (copy_to_user(tmp
.counters
, counterstmp
,
1362 nentries
* sizeof(struct ebt_counter
))) {
1363 BUGPRINT("Couldn't copy counters to userspace\n");
1370 if (copy_to_user(tmp
.entries
, entries
, entries_size
)) {
1371 BUGPRINT("Couldn't copy entries to userspace\n");
1374 /* set the match/watcher/target names right */
1375 return EBT_ENTRY_ITERATE(entries
, entries_size
,
1376 ebt_make_names
, entries
, tmp
.entries
);
1379 static int do_ebt_set_ctl(struct sock
*sk
,
1380 int cmd
, void __user
*user
, unsigned int len
)
1385 case EBT_SO_SET_ENTRIES
:
1386 ret
= do_replace(user
, len
);
1388 case EBT_SO_SET_COUNTERS
:
1389 ret
= update_counters(user
, len
);
1397 static int do_ebt_get_ctl(struct sock
*sk
, int cmd
, void __user
*user
, int *len
)
1400 struct ebt_replace tmp
;
1401 struct ebt_table
*t
;
1403 if (copy_from_user(&tmp
, user
, sizeof(tmp
)))
1406 t
= find_table_lock(tmp
.name
, &ret
, &ebt_mutex
);
1411 case EBT_SO_GET_INFO
:
1412 case EBT_SO_GET_INIT_INFO
:
1413 if (*len
!= sizeof(struct ebt_replace
)){
1415 mutex_unlock(&ebt_mutex
);
1418 if (cmd
== EBT_SO_GET_INFO
) {
1419 tmp
.nentries
= t
->private->nentries
;
1420 tmp
.entries_size
= t
->private->entries_size
;
1421 tmp
.valid_hooks
= t
->valid_hooks
;
1423 tmp
.nentries
= t
->table
->nentries
;
1424 tmp
.entries_size
= t
->table
->entries_size
;
1425 tmp
.valid_hooks
= t
->table
->valid_hooks
;
1427 mutex_unlock(&ebt_mutex
);
1428 if (copy_to_user(user
, &tmp
, *len
) != 0){
1429 BUGPRINT("c2u Didn't work\n");
1436 case EBT_SO_GET_ENTRIES
:
1437 case EBT_SO_GET_INIT_ENTRIES
:
1438 ret
= copy_everything_to_user(t
, user
, len
, cmd
);
1439 mutex_unlock(&ebt_mutex
);
1443 mutex_unlock(&ebt_mutex
);
1450 static struct nf_sockopt_ops ebt_sockopts
=
1453 .set_optmin
= EBT_BASE_CTL
,
1454 .set_optmax
= EBT_SO_SET_MAX
+ 1,
1455 .set
= do_ebt_set_ctl
,
1456 .get_optmin
= EBT_BASE_CTL
,
1457 .get_optmax
= EBT_SO_GET_MAX
+ 1,
1458 .get
= do_ebt_get_ctl
,
1459 .owner
= THIS_MODULE
,
1462 static int __init
ebtables_init(void)
1466 ret
= xt_register_target(&ebt_standard_target
);
1469 ret
= nf_register_sockopt(&ebt_sockopts
);
1471 xt_unregister_target(&ebt_standard_target
);
1475 printk(KERN_INFO
"Ebtables v2.0 registered\n");
1479 static void __exit
ebtables_fini(void)
1481 nf_unregister_sockopt(&ebt_sockopts
);
1482 xt_unregister_target(&ebt_standard_target
);
1483 printk(KERN_INFO
"Ebtables v2.0 unregistered\n");
1486 EXPORT_SYMBOL(ebt_register_table
);
1487 EXPORT_SYMBOL(ebt_unregister_table
);
1488 EXPORT_SYMBOL(ebt_do_table
);
1489 module_init(ebtables_init
);
1490 module_exit(ebtables_fini
);
1491 MODULE_LICENSE("GPL");