5 * Bart De Schuymer <bdschuym@pandora.be>
7 * ebtables.c,v 2.0, July, 2002
9 * This code is strongly inspired by the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18 #include <linux/kmod.h>
19 #include <linux/module.h>
20 #include <linux/vmalloc.h>
21 #include <linux/netfilter/x_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/spinlock.h>
24 #include <linux/mutex.h>
25 #include <linux/slab.h>
26 #include <linux/uaccess.h>
27 #include <linux/smp.h>
28 #include <linux/cpumask.h>
29 #include <linux/audit.h>
31 /* needed for logical [in,out]-dev filtering */
32 #include "../br_private.h"
34 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
35 "report to author: "format, ## args)
36 /* #define BUGPRINT(format, args...) */
38 /* Each cpu has its own set of counters, so there is no need for write_lock in
40 * For reading or updating the counters, the user context needs to
44 /* The size of each set of counters is altered to get cache alignment */
45 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
46 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
47 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
48 COUNTER_OFFSET(n) * cpu))
52 static DEFINE_MUTEX(ebt_mutex
);
55 static void ebt_standard_compat_from_user(void *dst
, const void *src
)
57 int v
= *(compat_int_t
*)src
;
60 v
+= xt_compat_calc_jump(NFPROTO_BRIDGE
, v
);
61 memcpy(dst
, &v
, sizeof(v
));
64 static int ebt_standard_compat_to_user(void __user
*dst
, const void *src
)
66 compat_int_t cv
= *(int *)src
;
69 cv
-= xt_compat_calc_jump(NFPROTO_BRIDGE
, cv
);
70 return copy_to_user(dst
, &cv
, sizeof(cv
)) ? -EFAULT
: 0;
75 static struct xt_target ebt_standard_target
= {
78 .family
= NFPROTO_BRIDGE
,
79 .targetsize
= sizeof(int),
81 .compatsize
= sizeof(compat_int_t
),
82 .compat_from_user
= ebt_standard_compat_from_user
,
83 .compat_to_user
= ebt_standard_compat_to_user
,
88 ebt_do_watcher(const struct ebt_entry_watcher
*w
, struct sk_buff
*skb
,
89 struct xt_action_param
*par
)
91 par
->target
= w
->u
.watcher
;
92 par
->targinfo
= w
->data
;
93 w
->u
.watcher
->target(skb
, par
);
94 /* watchers don't give a verdict */
99 ebt_do_match(struct ebt_entry_match
*m
, const struct sk_buff
*skb
,
100 struct xt_action_param
*par
)
102 par
->match
= m
->u
.match
;
103 par
->matchinfo
= m
->data
;
104 return m
->u
.match
->match(skb
, par
) ? EBT_MATCH
: EBT_NOMATCH
;
108 ebt_dev_check(const char *entry
, const struct net_device
*device
)
117 devname
= device
->name
;
118 /* 1 is the wildcard token */
119 while (entry
[i
] != '\0' && entry
[i
] != 1 && entry
[i
] == devname
[i
])
121 return devname
[i
] != entry
[i
] && entry
[i
] != 1;
124 /* process standard matches */
126 ebt_basic_match(const struct ebt_entry
*e
, const struct sk_buff
*skb
,
127 const struct net_device
*in
, const struct net_device
*out
)
129 const struct ethhdr
*h
= eth_hdr(skb
);
130 const struct net_bridge_port
*p
;
133 if (skb_vlan_tag_present(skb
))
134 ethproto
= htons(ETH_P_8021Q
);
136 ethproto
= h
->h_proto
;
138 if (e
->bitmask
& EBT_802_3
) {
139 if (NF_INVF(e
, EBT_IPROTO
, eth_proto_is_802_3(ethproto
)))
141 } else if (!(e
->bitmask
& EBT_NOPROTO
) &&
142 NF_INVF(e
, EBT_IPROTO
, e
->ethproto
!= ethproto
))
145 if (NF_INVF(e
, EBT_IIN
, ebt_dev_check(e
->in
, in
)))
147 if (NF_INVF(e
, EBT_IOUT
, ebt_dev_check(e
->out
, out
)))
149 /* rcu_read_lock()ed by nf_hook_thresh */
150 if (in
&& (p
= br_port_get_rcu(in
)) != NULL
&&
151 NF_INVF(e
, EBT_ILOGICALIN
,
152 ebt_dev_check(e
->logical_in
, p
->br
->dev
)))
154 if (out
&& (p
= br_port_get_rcu(out
)) != NULL
&&
155 NF_INVF(e
, EBT_ILOGICALOUT
,
156 ebt_dev_check(e
->logical_out
, p
->br
->dev
)))
159 if (e
->bitmask
& EBT_SOURCEMAC
) {
160 if (NF_INVF(e
, EBT_ISOURCE
,
161 !ether_addr_equal_masked(h
->h_source
, e
->sourcemac
,
165 if (e
->bitmask
& EBT_DESTMAC
) {
166 if (NF_INVF(e
, EBT_IDEST
,
167 !ether_addr_equal_masked(h
->h_dest
, e
->destmac
,
175 struct ebt_entry
*ebt_next_entry(const struct ebt_entry
*entry
)
177 return (void *)entry
+ entry
->next_offset
;
180 /* Do some firewalling */
181 unsigned int ebt_do_table(struct sk_buff
*skb
,
182 const struct nf_hook_state
*state
,
183 struct ebt_table
*table
)
185 unsigned int hook
= state
->hook
;
187 struct ebt_entry
*point
;
188 struct ebt_counter
*counter_base
, *cb_base
;
189 const struct ebt_entry_target
*t
;
191 struct ebt_chainstack
*cs
;
192 struct ebt_entries
*chaininfo
;
194 const struct ebt_table_info
*private;
195 struct xt_action_param acpar
;
198 acpar
.hotdrop
= false;
200 read_lock_bh(&table
->lock
);
201 private = table
->private;
202 cb_base
= COUNTER_BASE(private->counters
, private->nentries
,
204 if (private->chainstack
)
205 cs
= private->chainstack
[smp_processor_id()];
208 chaininfo
= private->hook_entry
[hook
];
209 nentries
= private->hook_entry
[hook
]->nentries
;
210 point
= (struct ebt_entry
*)(private->hook_entry
[hook
]->data
);
211 counter_base
= cb_base
+ private->hook_entry
[hook
]->counter_offset
;
212 /* base for chain jumps */
213 base
= private->entries
;
215 while (i
< nentries
) {
216 if (ebt_basic_match(point
, skb
, state
->in
, state
->out
))
219 if (EBT_MATCH_ITERATE(point
, ebt_do_match
, skb
, &acpar
) != 0)
222 read_unlock_bh(&table
->lock
);
226 ADD_COUNTER(*(counter_base
+ i
), 1, skb
->len
);
228 /* these should only watch: not modify, nor tell us
229 * what to do with the packet
231 EBT_WATCHER_ITERATE(point
, ebt_do_watcher
, skb
, &acpar
);
233 t
= (struct ebt_entry_target
*)
234 (((char *)point
) + point
->target_offset
);
235 /* standard target */
236 if (!t
->u
.target
->target
)
237 verdict
= ((struct ebt_standard_target
*)t
)->verdict
;
239 acpar
.target
= t
->u
.target
;
240 acpar
.targinfo
= t
->data
;
241 verdict
= t
->u
.target
->target(skb
, &acpar
);
243 if (verdict
== EBT_ACCEPT
) {
244 read_unlock_bh(&table
->lock
);
247 if (verdict
== EBT_DROP
) {
248 read_unlock_bh(&table
->lock
);
251 if (verdict
== EBT_RETURN
) {
253 if (WARN(sp
== 0, "RETURN on base chain")) {
254 /* act like this is EBT_CONTINUE */
259 /* put all the local variables right */
261 chaininfo
= cs
[sp
].chaininfo
;
262 nentries
= chaininfo
->nentries
;
264 counter_base
= cb_base
+
265 chaininfo
->counter_offset
;
268 if (verdict
== EBT_CONTINUE
)
271 if (WARN(verdict
< 0, "bogus standard verdict\n")) {
272 read_unlock_bh(&table
->lock
);
278 cs
[sp
].chaininfo
= chaininfo
;
279 cs
[sp
].e
= ebt_next_entry(point
);
281 chaininfo
= (struct ebt_entries
*) (base
+ verdict
);
283 if (WARN(chaininfo
->distinguisher
, "jump to non-chain\n")) {
284 read_unlock_bh(&table
->lock
);
288 nentries
= chaininfo
->nentries
;
289 point
= (struct ebt_entry
*)chaininfo
->data
;
290 counter_base
= cb_base
+ chaininfo
->counter_offset
;
294 point
= ebt_next_entry(point
);
298 /* I actually like this :) */
299 if (chaininfo
->policy
== EBT_RETURN
)
301 if (chaininfo
->policy
== EBT_ACCEPT
) {
302 read_unlock_bh(&table
->lock
);
305 read_unlock_bh(&table
->lock
);
309 /* If it succeeds, returns element and locks mutex */
311 find_inlist_lock_noload(struct list_head
*head
, const char *name
, int *error
,
315 struct list_head list
;
316 char name
[EBT_FUNCTION_MAXNAMELEN
];
320 list_for_each_entry(e
, head
, list
) {
321 if (strcmp(e
->name
, name
) == 0)
330 find_inlist_lock(struct list_head
*head
, const char *name
, const char *prefix
,
331 int *error
, struct mutex
*mutex
)
333 return try_then_request_module(
334 find_inlist_lock_noload(head
, name
, error
, mutex
),
335 "%s%s", prefix
, name
);
338 static inline struct ebt_table
*
339 find_table_lock(struct net
*net
, const char *name
, int *error
,
342 return find_inlist_lock(&net
->xt
.tables
[NFPROTO_BRIDGE
], name
,
343 "ebtable_", error
, mutex
);
347 ebt_check_match(struct ebt_entry_match
*m
, struct xt_mtchk_param
*par
,
350 const struct ebt_entry
*e
= par
->entryinfo
;
351 struct xt_match
*match
;
352 size_t left
= ((char *)e
+ e
->watchers_offset
) - (char *)m
;
355 if (left
< sizeof(struct ebt_entry_match
) ||
356 left
- sizeof(struct ebt_entry_match
) < m
->match_size
)
359 match
= xt_find_match(NFPROTO_BRIDGE
, m
->u
.name
, m
->u
.revision
);
360 if (IS_ERR(match
) || match
->family
!= NFPROTO_BRIDGE
) {
362 module_put(match
->me
);
363 request_module("ebt_%s", m
->u
.name
);
364 match
= xt_find_match(NFPROTO_BRIDGE
, m
->u
.name
, m
->u
.revision
);
367 return PTR_ERR(match
);
371 par
->matchinfo
= m
->data
;
372 ret
= xt_check_match(par
, m
->match_size
,
373 e
->ethproto
, e
->invflags
& EBT_IPROTO
);
375 module_put(match
->me
);
384 ebt_check_watcher(struct ebt_entry_watcher
*w
, struct xt_tgchk_param
*par
,
387 const struct ebt_entry
*e
= par
->entryinfo
;
388 struct xt_target
*watcher
;
389 size_t left
= ((char *)e
+ e
->target_offset
) - (char *)w
;
392 if (left
< sizeof(struct ebt_entry_watcher
) ||
393 left
- sizeof(struct ebt_entry_watcher
) < w
->watcher_size
)
396 watcher
= xt_request_find_target(NFPROTO_BRIDGE
, w
->u
.name
, 0);
398 return PTR_ERR(watcher
);
399 w
->u
.watcher
= watcher
;
401 par
->target
= watcher
;
402 par
->targinfo
= w
->data
;
403 ret
= xt_check_target(par
, w
->watcher_size
,
404 e
->ethproto
, e
->invflags
& EBT_IPROTO
);
406 module_put(watcher
->me
);
414 static int ebt_verify_pointers(const struct ebt_replace
*repl
,
415 struct ebt_table_info
*newinfo
)
417 unsigned int limit
= repl
->entries_size
;
418 unsigned int valid_hooks
= repl
->valid_hooks
;
419 unsigned int offset
= 0;
422 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++)
423 newinfo
->hook_entry
[i
] = NULL
;
425 newinfo
->entries_size
= repl
->entries_size
;
426 newinfo
->nentries
= repl
->nentries
;
428 while (offset
< limit
) {
429 size_t left
= limit
- offset
;
430 struct ebt_entry
*e
= (void *)newinfo
->entries
+ offset
;
432 if (left
< sizeof(unsigned int))
435 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
436 if ((valid_hooks
& (1 << i
)) == 0)
438 if ((char __user
*)repl
->hook_entry
[i
] ==
439 repl
->entries
+ offset
)
443 if (i
!= NF_BR_NUMHOOKS
|| !(e
->bitmask
& EBT_ENTRY_OR_ENTRIES
)) {
444 if (e
->bitmask
!= 0) {
445 /* we make userspace set this right,
446 * so there is no misunderstanding
448 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
449 "in distinguisher\n");
452 if (i
!= NF_BR_NUMHOOKS
)
453 newinfo
->hook_entry
[i
] = (struct ebt_entries
*)e
;
454 if (left
< sizeof(struct ebt_entries
))
456 offset
+= sizeof(struct ebt_entries
);
458 if (left
< sizeof(struct ebt_entry
))
460 if (left
< e
->next_offset
)
462 if (e
->next_offset
< sizeof(struct ebt_entry
))
464 offset
+= e
->next_offset
;
467 if (offset
!= limit
) {
468 BUGPRINT("entries_size too small\n");
472 /* check if all valid hooks have a chain */
473 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
474 if (!newinfo
->hook_entry
[i
] &&
475 (valid_hooks
& (1 << i
))) {
476 BUGPRINT("Valid hook without chain\n");
483 /* this one is very careful, as it is the first function
484 * to parse the userspace data
487 ebt_check_entry_size_and_hooks(const struct ebt_entry
*e
,
488 const struct ebt_table_info
*newinfo
,
489 unsigned int *n
, unsigned int *cnt
,
490 unsigned int *totalcnt
, unsigned int *udc_cnt
)
494 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
495 if ((void *)e
== (void *)newinfo
->hook_entry
[i
])
498 /* beginning of a new chain
499 * if i == NF_BR_NUMHOOKS it must be a user defined chain
501 if (i
!= NF_BR_NUMHOOKS
|| !e
->bitmask
) {
502 /* this checks if the previous chain has as many entries
506 BUGPRINT("nentries does not equal the nr of entries "
510 if (((struct ebt_entries
*)e
)->policy
!= EBT_DROP
&&
511 ((struct ebt_entries
*)e
)->policy
!= EBT_ACCEPT
) {
512 /* only RETURN from udc */
513 if (i
!= NF_BR_NUMHOOKS
||
514 ((struct ebt_entries
*)e
)->policy
!= EBT_RETURN
) {
515 BUGPRINT("bad policy\n");
519 if (i
== NF_BR_NUMHOOKS
) /* it's a user defined chain */
521 if (((struct ebt_entries
*)e
)->counter_offset
!= *totalcnt
) {
522 BUGPRINT("counter_offset != totalcnt");
525 *n
= ((struct ebt_entries
*)e
)->nentries
;
529 /* a plain old entry, heh */
530 if (sizeof(struct ebt_entry
) > e
->watchers_offset
||
531 e
->watchers_offset
> e
->target_offset
||
532 e
->target_offset
>= e
->next_offset
) {
533 BUGPRINT("entry offsets not in right order\n");
536 /* this is not checked anywhere else */
537 if (e
->next_offset
- e
->target_offset
< sizeof(struct ebt_entry_target
)) {
538 BUGPRINT("target size too small\n");
546 struct ebt_cl_stack
{
547 struct ebt_chainstack cs
;
549 unsigned int hookmask
;
552 /* We need these positions to check that the jumps to a different part of the
553 * entries is a jump to the beginning of a new chain.
556 ebt_get_udc_positions(struct ebt_entry
*e
, struct ebt_table_info
*newinfo
,
557 unsigned int *n
, struct ebt_cl_stack
*udc
)
561 /* we're only interested in chain starts */
564 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
565 if (newinfo
->hook_entry
[i
] == (struct ebt_entries
*)e
)
568 /* only care about udc */
569 if (i
!= NF_BR_NUMHOOKS
)
572 udc
[*n
].cs
.chaininfo
= (struct ebt_entries
*)e
;
573 /* these initialisations are depended on later in check_chainloops() */
575 udc
[*n
].hookmask
= 0;
582 ebt_cleanup_match(struct ebt_entry_match
*m
, struct net
*net
, unsigned int *i
)
584 struct xt_mtdtor_param par
;
586 if (i
&& (*i
)-- == 0)
590 par
.match
= m
->u
.match
;
591 par
.matchinfo
= m
->data
;
592 par
.family
= NFPROTO_BRIDGE
;
593 if (par
.match
->destroy
!= NULL
)
594 par
.match
->destroy(&par
);
595 module_put(par
.match
->me
);
600 ebt_cleanup_watcher(struct ebt_entry_watcher
*w
, struct net
*net
, unsigned int *i
)
602 struct xt_tgdtor_param par
;
604 if (i
&& (*i
)-- == 0)
608 par
.target
= w
->u
.watcher
;
609 par
.targinfo
= w
->data
;
610 par
.family
= NFPROTO_BRIDGE
;
611 if (par
.target
->destroy
!= NULL
)
612 par
.target
->destroy(&par
);
613 module_put(par
.target
->me
);
618 ebt_cleanup_entry(struct ebt_entry
*e
, struct net
*net
, unsigned int *cnt
)
620 struct xt_tgdtor_param par
;
621 struct ebt_entry_target
*t
;
626 if (cnt
&& (*cnt
)-- == 0)
628 EBT_WATCHER_ITERATE(e
, ebt_cleanup_watcher
, net
, NULL
);
629 EBT_MATCH_ITERATE(e
, ebt_cleanup_match
, net
, NULL
);
630 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
633 par
.target
= t
->u
.target
;
634 par
.targinfo
= t
->data
;
635 par
.family
= NFPROTO_BRIDGE
;
636 if (par
.target
->destroy
!= NULL
)
637 par
.target
->destroy(&par
);
638 module_put(par
.target
->me
);
643 ebt_check_entry(struct ebt_entry
*e
, struct net
*net
,
644 const struct ebt_table_info
*newinfo
,
645 const char *name
, unsigned int *cnt
,
646 struct ebt_cl_stack
*cl_s
, unsigned int udc_cnt
)
648 struct ebt_entry_target
*t
;
649 struct xt_target
*target
;
650 unsigned int i
, j
, hook
= 0, hookmask
= 0;
653 struct xt_mtchk_param mtpar
;
654 struct xt_tgchk_param tgpar
;
656 /* don't mess with the struct ebt_entries */
660 if (e
->bitmask
& ~EBT_F_MASK
) {
661 BUGPRINT("Unknown flag for bitmask\n");
664 if (e
->invflags
& ~EBT_INV_MASK
) {
665 BUGPRINT("Unknown flag for inv bitmask\n");
668 if ((e
->bitmask
& EBT_NOPROTO
) && (e
->bitmask
& EBT_802_3
)) {
669 BUGPRINT("NOPROTO & 802_3 not allowed\n");
672 /* what hook do we belong to? */
673 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
674 if (!newinfo
->hook_entry
[i
])
676 if ((char *)newinfo
->hook_entry
[i
] < (char *)e
)
681 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
684 if (i
< NF_BR_NUMHOOKS
)
685 hookmask
= (1 << hook
) | (1 << NF_BR_NUMHOOKS
);
687 for (i
= 0; i
< udc_cnt
; i
++)
688 if ((char *)(cl_s
[i
].cs
.chaininfo
) > (char *)e
)
691 hookmask
= (1 << hook
) | (1 << NF_BR_NUMHOOKS
);
693 hookmask
= cl_s
[i
- 1].hookmask
;
697 mtpar
.net
= tgpar
.net
= net
;
698 mtpar
.table
= tgpar
.table
= name
;
699 mtpar
.entryinfo
= tgpar
.entryinfo
= e
;
700 mtpar
.hook_mask
= tgpar
.hook_mask
= hookmask
;
701 mtpar
.family
= tgpar
.family
= NFPROTO_BRIDGE
;
702 ret
= EBT_MATCH_ITERATE(e
, ebt_check_match
, &mtpar
, &i
);
704 goto cleanup_matches
;
706 ret
= EBT_WATCHER_ITERATE(e
, ebt_check_watcher
, &tgpar
, &j
);
708 goto cleanup_watchers
;
709 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
710 gap
= e
->next_offset
- e
->target_offset
;
712 target
= xt_request_find_target(NFPROTO_BRIDGE
, t
->u
.name
, 0);
713 if (IS_ERR(target
)) {
714 ret
= PTR_ERR(target
);
715 goto cleanup_watchers
;
718 t
->u
.target
= target
;
719 if (t
->u
.target
== &ebt_standard_target
) {
720 if (gap
< sizeof(struct ebt_standard_target
)) {
721 BUGPRINT("Standard target size too big\n");
723 goto cleanup_watchers
;
725 if (((struct ebt_standard_target
*)t
)->verdict
<
726 -NUM_STANDARD_TARGETS
) {
727 BUGPRINT("Invalid standard target\n");
729 goto cleanup_watchers
;
731 } else if (t
->target_size
> gap
- sizeof(struct ebt_entry_target
)) {
732 module_put(t
->u
.target
->me
);
734 goto cleanup_watchers
;
737 tgpar
.target
= target
;
738 tgpar
.targinfo
= t
->data
;
739 ret
= xt_check_target(&tgpar
, t
->target_size
,
740 e
->ethproto
, e
->invflags
& EBT_IPROTO
);
742 module_put(target
->me
);
743 goto cleanup_watchers
;
748 EBT_WATCHER_ITERATE(e
, ebt_cleanup_watcher
, net
, &j
);
750 EBT_MATCH_ITERATE(e
, ebt_cleanup_match
, net
, &i
);
754 /* checks for loops and sets the hook mask for udc
755 * the hook mask for udc tells us from which base chains the udc can be
756 * accessed. This mask is a parameter to the check() functions of the extensions
758 static int check_chainloops(const struct ebt_entries
*chain
, struct ebt_cl_stack
*cl_s
,
759 unsigned int udc_cnt
, unsigned int hooknr
, char *base
)
761 int i
, chain_nr
= -1, pos
= 0, nentries
= chain
->nentries
, verdict
;
762 const struct ebt_entry
*e
= (struct ebt_entry
*)chain
->data
;
763 const struct ebt_entry_target
*t
;
765 while (pos
< nentries
|| chain_nr
!= -1) {
766 /* end of udc, go back one 'recursion' step */
767 if (pos
== nentries
) {
768 /* put back values of the time when this chain was called */
769 e
= cl_s
[chain_nr
].cs
.e
;
770 if (cl_s
[chain_nr
].from
!= -1)
772 cl_s
[cl_s
[chain_nr
].from
].cs
.chaininfo
->nentries
;
774 nentries
= chain
->nentries
;
775 pos
= cl_s
[chain_nr
].cs
.n
;
776 /* make sure we won't see a loop that isn't one */
777 cl_s
[chain_nr
].cs
.n
= 0;
778 chain_nr
= cl_s
[chain_nr
].from
;
782 t
= (struct ebt_entry_target
*)
783 (((char *)e
) + e
->target_offset
);
784 if (strcmp(t
->u
.name
, EBT_STANDARD_TARGET
))
786 if (e
->target_offset
+ sizeof(struct ebt_standard_target
) >
788 BUGPRINT("Standard target size too big\n");
791 verdict
= ((struct ebt_standard_target
*)t
)->verdict
;
792 if (verdict
>= 0) { /* jump to another chain */
793 struct ebt_entries
*hlp2
=
794 (struct ebt_entries
*)(base
+ verdict
);
795 for (i
= 0; i
< udc_cnt
; i
++)
796 if (hlp2
== cl_s
[i
].cs
.chaininfo
)
798 /* bad destination or loop */
800 BUGPRINT("bad destination\n");
807 if (cl_s
[i
].hookmask
& (1 << hooknr
))
809 /* this can't be 0, so the loop test is correct */
810 cl_s
[i
].cs
.n
= pos
+ 1;
812 cl_s
[i
].cs
.e
= ebt_next_entry(e
);
813 e
= (struct ebt_entry
*)(hlp2
->data
);
814 nentries
= hlp2
->nentries
;
815 cl_s
[i
].from
= chain_nr
;
817 /* this udc is accessible from the base chain for hooknr */
818 cl_s
[i
].hookmask
|= (1 << hooknr
);
822 e
= ebt_next_entry(e
);
828 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
829 static int translate_table(struct net
*net
, const char *name
,
830 struct ebt_table_info
*newinfo
)
832 unsigned int i
, j
, k
, udc_cnt
;
834 struct ebt_cl_stack
*cl_s
= NULL
; /* used in the checking for chain loops */
837 while (i
< NF_BR_NUMHOOKS
&& !newinfo
->hook_entry
[i
])
839 if (i
== NF_BR_NUMHOOKS
) {
840 BUGPRINT("No valid hooks specified\n");
843 if (newinfo
->hook_entry
[i
] != (struct ebt_entries
*)newinfo
->entries
) {
844 BUGPRINT("Chains don't start at beginning\n");
847 /* make sure chains are ordered after each other in same order
848 * as their corresponding hooks
850 for (j
= i
+ 1; j
< NF_BR_NUMHOOKS
; j
++) {
851 if (!newinfo
->hook_entry
[j
])
853 if (newinfo
->hook_entry
[j
] <= newinfo
->hook_entry
[i
]) {
854 BUGPRINT("Hook order must be followed\n");
860 /* do some early checkings and initialize some things */
861 i
= 0; /* holds the expected nr. of entries for the chain */
862 j
= 0; /* holds the up to now counted entries for the chain */
863 k
= 0; /* holds the total nr. of entries, should equal
864 * newinfo->nentries afterwards
866 udc_cnt
= 0; /* will hold the nr. of user defined chains (udc) */
867 ret
= EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
868 ebt_check_entry_size_and_hooks
, newinfo
,
869 &i
, &j
, &k
, &udc_cnt
);
875 BUGPRINT("nentries does not equal the nr of entries in the "
879 if (k
!= newinfo
->nentries
) {
880 BUGPRINT("Total nentries is wrong\n");
884 /* get the location of the udc, put them in an array
885 * while we're at it, allocate the chainstack
888 /* this will get free'd in do_replace()/ebt_register_table()
891 newinfo
->chainstack
=
892 vmalloc(nr_cpu_ids
* sizeof(*(newinfo
->chainstack
)));
893 if (!newinfo
->chainstack
)
895 for_each_possible_cpu(i
) {
896 newinfo
->chainstack
[i
] =
897 vmalloc(udc_cnt
* sizeof(*(newinfo
->chainstack
[0])));
898 if (!newinfo
->chainstack
[i
]) {
900 vfree(newinfo
->chainstack
[--i
]);
901 vfree(newinfo
->chainstack
);
902 newinfo
->chainstack
= NULL
;
907 cl_s
= vmalloc(udc_cnt
* sizeof(*cl_s
));
910 i
= 0; /* the i'th udc */
911 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
912 ebt_get_udc_positions
, newinfo
, &i
, cl_s
);
915 BUGPRINT("i != udc_cnt\n");
921 /* Check for loops */
922 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++)
923 if (newinfo
->hook_entry
[i
])
924 if (check_chainloops(newinfo
->hook_entry
[i
],
925 cl_s
, udc_cnt
, i
, newinfo
->entries
)) {
930 /* we now know the following (along with E=mc²):
931 * - the nr of entries in each chain is right
932 * - the size of the allocated space is right
933 * - all valid hooks have a corresponding chain
934 * - there are no loops
935 * - wrong data can still be on the level of a single entry
936 * - could be there are jumps to places that are not the
937 * beginning of a chain. This can only occur in chains that
938 * are not accessible from any base chains, so we don't care.
941 /* used to know what we need to clean up if something goes wrong */
943 ret
= EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
944 ebt_check_entry
, net
, newinfo
, name
, &i
, cl_s
, udc_cnt
);
946 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
947 ebt_cleanup_entry
, net
, &i
);
953 /* called under write_lock */
954 static void get_counters(const struct ebt_counter
*oldcounters
,
955 struct ebt_counter
*counters
, unsigned int nentries
)
958 struct ebt_counter
*counter_base
;
960 /* counters of cpu 0 */
961 memcpy(counters
, oldcounters
,
962 sizeof(struct ebt_counter
) * nentries
);
964 /* add other counters to those of cpu 0 */
965 for_each_possible_cpu(cpu
) {
968 counter_base
= COUNTER_BASE(oldcounters
, nentries
, cpu
);
969 for (i
= 0; i
< nentries
; i
++)
970 ADD_COUNTER(counters
[i
], counter_base
[i
].pcnt
,
971 counter_base
[i
].bcnt
);
975 static int do_replace_finish(struct net
*net
, struct ebt_replace
*repl
,
976 struct ebt_table_info
*newinfo
)
979 struct ebt_counter
*counterstmp
= NULL
;
980 /* used to be able to unlock earlier */
981 struct ebt_table_info
*table
;
984 /* the user wants counters back
985 * the check on the size is done later, when we have the lock
987 if (repl
->num_counters
) {
988 unsigned long size
= repl
->num_counters
* sizeof(*counterstmp
);
989 counterstmp
= vmalloc(size
);
994 newinfo
->chainstack
= NULL
;
995 ret
= ebt_verify_pointers(repl
, newinfo
);
997 goto free_counterstmp
;
999 ret
= translate_table(net
, repl
->name
, newinfo
);
1002 goto free_counterstmp
;
1004 t
= find_table_lock(net
, repl
->name
, &ret
, &ebt_mutex
);
1010 /* the table doesn't like it */
1011 if (t
->check
&& (ret
= t
->check(newinfo
, repl
->valid_hooks
)))
1014 if (repl
->num_counters
&& repl
->num_counters
!= t
->private->nentries
) {
1015 BUGPRINT("Wrong nr. of counters requested\n");
1020 /* we have the mutex lock, so no danger in reading this pointer */
1022 /* make sure the table can only be rmmod'ed if it contains no rules */
1023 if (!table
->nentries
&& newinfo
->nentries
&& !try_module_get(t
->me
)) {
1026 } else if (table
->nentries
&& !newinfo
->nentries
)
1028 /* we need an atomic snapshot of the counters */
1029 write_lock_bh(&t
->lock
);
1030 if (repl
->num_counters
)
1031 get_counters(t
->private->counters
, counterstmp
,
1032 t
->private->nentries
);
1034 t
->private = newinfo
;
1035 write_unlock_bh(&t
->lock
);
1036 mutex_unlock(&ebt_mutex
);
1037 /* so, a user can change the chains while having messed up her counter
1038 * allocation. Only reason why this is done is because this way the lock
1039 * is held only once, while this doesn't bring the kernel into a
1042 if (repl
->num_counters
&&
1043 copy_to_user(repl
->counters
, counterstmp
,
1044 repl
->num_counters
* sizeof(struct ebt_counter
))) {
1045 /* Silent error, can't fail, new table is already in place */
1046 net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
1049 /* decrease module count and free resources */
1050 EBT_ENTRY_ITERATE(table
->entries
, table
->entries_size
,
1051 ebt_cleanup_entry
, net
, NULL
);
1053 vfree(table
->entries
);
1054 if (table
->chainstack
) {
1055 for_each_possible_cpu(i
)
1056 vfree(table
->chainstack
[i
]);
1057 vfree(table
->chainstack
);
1064 if (audit_enabled
) {
1065 audit_log(current
->audit_context
, GFP_KERNEL
,
1066 AUDIT_NETFILTER_CFG
,
1067 "table=%s family=%u entries=%u",
1068 repl
->name
, AF_BRIDGE
, repl
->nentries
);
1074 mutex_unlock(&ebt_mutex
);
1076 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
1077 ebt_cleanup_entry
, net
, NULL
);
1080 /* can be initialized in translate_table() */
1081 if (newinfo
->chainstack
) {
1082 for_each_possible_cpu(i
)
1083 vfree(newinfo
->chainstack
[i
]);
1084 vfree(newinfo
->chainstack
);
1089 /* replace the table */
1090 static int do_replace(struct net
*net
, const void __user
*user
,
1093 int ret
, countersize
;
1094 struct ebt_table_info
*newinfo
;
1095 struct ebt_replace tmp
;
1097 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
1100 if (len
!= sizeof(tmp
) + tmp
.entries_size
) {
1101 BUGPRINT("Wrong len argument\n");
1105 if (tmp
.entries_size
== 0) {
1106 BUGPRINT("Entries_size never zero\n");
1109 /* overflow check */
1110 if (tmp
.nentries
>= ((INT_MAX
- sizeof(struct ebt_table_info
)) /
1111 NR_CPUS
- SMP_CACHE_BYTES
) / sizeof(struct ebt_counter
))
1113 if (tmp
.num_counters
>= INT_MAX
/ sizeof(struct ebt_counter
))
1116 tmp
.name
[sizeof(tmp
.name
) - 1] = 0;
1118 countersize
= COUNTER_OFFSET(tmp
.nentries
) * nr_cpu_ids
;
1119 newinfo
= vmalloc(sizeof(*newinfo
) + countersize
);
1124 memset(newinfo
->counters
, 0, countersize
);
1126 newinfo
->entries
= vmalloc(tmp
.entries_size
);
1127 if (!newinfo
->entries
) {
1132 newinfo
->entries
, tmp
.entries
, tmp
.entries_size
) != 0) {
1133 BUGPRINT("Couldn't copy entries from userspace\n");
1138 ret
= do_replace_finish(net
, &tmp
, newinfo
);
1142 vfree(newinfo
->entries
);
1148 static void __ebt_unregister_table(struct net
*net
, struct ebt_table
*table
)
1152 mutex_lock(&ebt_mutex
);
1153 list_del(&table
->list
);
1154 mutex_unlock(&ebt_mutex
);
1155 EBT_ENTRY_ITERATE(table
->private->entries
, table
->private->entries_size
,
1156 ebt_cleanup_entry
, net
, NULL
);
1157 if (table
->private->nentries
)
1158 module_put(table
->me
);
1159 vfree(table
->private->entries
);
1160 if (table
->private->chainstack
) {
1161 for_each_possible_cpu(i
)
1162 vfree(table
->private->chainstack
[i
]);
1163 vfree(table
->private->chainstack
);
1165 vfree(table
->private);
1169 int ebt_register_table(struct net
*net
, const struct ebt_table
*input_table
,
1170 const struct nf_hook_ops
*ops
, struct ebt_table
**res
)
1172 struct ebt_table_info
*newinfo
;
1173 struct ebt_table
*t
, *table
;
1174 struct ebt_replace_kernel
*repl
;
1175 int ret
, i
, countersize
;
1178 if (input_table
== NULL
|| (repl
= input_table
->table
) == NULL
||
1179 repl
->entries
== NULL
|| repl
->entries_size
== 0 ||
1180 repl
->counters
!= NULL
|| input_table
->private != NULL
) {
1181 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1185 /* Don't add one table to multiple lists. */
1186 table
= kmemdup(input_table
, sizeof(struct ebt_table
), GFP_KERNEL
);
1192 countersize
= COUNTER_OFFSET(repl
->nentries
) * nr_cpu_ids
;
1193 newinfo
= vmalloc(sizeof(*newinfo
) + countersize
);
1198 p
= vmalloc(repl
->entries_size
);
1202 memcpy(p
, repl
->entries
, repl
->entries_size
);
1203 newinfo
->entries
= p
;
1205 newinfo
->entries_size
= repl
->entries_size
;
1206 newinfo
->nentries
= repl
->nentries
;
1209 memset(newinfo
->counters
, 0, countersize
);
1211 /* fill in newinfo and parse the entries */
1212 newinfo
->chainstack
= NULL
;
1213 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
1214 if ((repl
->valid_hooks
& (1 << i
)) == 0)
1215 newinfo
->hook_entry
[i
] = NULL
;
1217 newinfo
->hook_entry
[i
] = p
+
1218 ((char *)repl
->hook_entry
[i
] - repl
->entries
);
1220 ret
= translate_table(net
, repl
->name
, newinfo
);
1222 BUGPRINT("Translate_table failed\n");
1223 goto free_chainstack
;
1226 if (table
->check
&& table
->check(newinfo
, table
->valid_hooks
)) {
1227 BUGPRINT("The table doesn't like its own initial data, lol\n");
1229 goto free_chainstack
;
1232 table
->private = newinfo
;
1233 rwlock_init(&table
->lock
);
1234 mutex_lock(&ebt_mutex
);
1235 list_for_each_entry(t
, &net
->xt
.tables
[NFPROTO_BRIDGE
], list
) {
1236 if (strcmp(t
->name
, table
->name
) == 0) {
1238 BUGPRINT("Table name already exists\n");
1243 /* Hold a reference count if the chains aren't empty */
1244 if (newinfo
->nentries
&& !try_module_get(table
->me
)) {
1248 list_add(&table
->list
, &net
->xt
.tables
[NFPROTO_BRIDGE
]);
1249 mutex_unlock(&ebt_mutex
);
1251 WRITE_ONCE(*res
, table
);
1256 ret
= nf_register_net_hooks(net
, ops
, hweight32(table
->valid_hooks
));
1258 __ebt_unregister_table(net
, table
);
1264 mutex_unlock(&ebt_mutex
);
1266 if (newinfo
->chainstack
) {
1267 for_each_possible_cpu(i
)
1268 vfree(newinfo
->chainstack
[i
]);
1269 vfree(newinfo
->chainstack
);
1271 vfree(newinfo
->entries
);
1280 void ebt_unregister_table(struct net
*net
, struct ebt_table
*table
,
1281 const struct nf_hook_ops
*ops
)
1284 nf_unregister_net_hooks(net
, ops
, hweight32(table
->valid_hooks
));
1285 __ebt_unregister_table(net
, table
);
1288 /* userspace just supplied us with counters */
1289 static int do_update_counters(struct net
*net
, const char *name
,
1290 struct ebt_counter __user
*counters
,
1291 unsigned int num_counters
,
1292 const void __user
*user
, unsigned int len
)
1295 struct ebt_counter
*tmp
;
1296 struct ebt_table
*t
;
1298 if (num_counters
== 0)
1301 tmp
= vmalloc(num_counters
* sizeof(*tmp
));
1305 t
= find_table_lock(net
, name
, &ret
, &ebt_mutex
);
1309 if (num_counters
!= t
->private->nentries
) {
1310 BUGPRINT("Wrong nr of counters\n");
1315 if (copy_from_user(tmp
, counters
, num_counters
* sizeof(*counters
))) {
1320 /* we want an atomic add of the counters */
1321 write_lock_bh(&t
->lock
);
1323 /* we add to the counters of the first cpu */
1324 for (i
= 0; i
< num_counters
; i
++)
1325 ADD_COUNTER(t
->private->counters
[i
], tmp
[i
].pcnt
, tmp
[i
].bcnt
);
1327 write_unlock_bh(&t
->lock
);
1330 mutex_unlock(&ebt_mutex
);
1336 static int update_counters(struct net
*net
, const void __user
*user
,
1339 struct ebt_replace hlp
;
1341 if (copy_from_user(&hlp
, user
, sizeof(hlp
)))
1344 if (len
!= sizeof(hlp
) + hlp
.num_counters
* sizeof(struct ebt_counter
))
1347 return do_update_counters(net
, hlp
.name
, hlp
.counters
,
1348 hlp
.num_counters
, user
, len
);
1351 static inline int ebt_obj_to_user(char __user
*um
, const char *_name
,
1352 const char *data
, int entrysize
,
1353 int usersize
, int datasize
, u8 revision
)
1355 char name
[EBT_EXTENSION_MAXNAMELEN
] = {0};
1357 /* ebtables expects 31 bytes long names but xt_match names are 29 bytes
1358 * long. Copy 29 bytes and fill remaining bytes with zeroes.
1360 strlcpy(name
, _name
, sizeof(name
));
1361 if (copy_to_user(um
, name
, EBT_EXTENSION_MAXNAMELEN
) ||
1362 put_user(revision
, (u8 __user
*)(um
+ EBT_EXTENSION_MAXNAMELEN
)) ||
1363 put_user(datasize
, (int __user
*)(um
+ EBT_EXTENSION_MAXNAMELEN
+ 1)) ||
1364 xt_data_to_user(um
+ entrysize
, data
, usersize
, datasize
,
1365 XT_ALIGN(datasize
)))
1371 static inline int ebt_match_to_user(const struct ebt_entry_match
*m
,
1372 const char *base
, char __user
*ubase
)
1374 return ebt_obj_to_user(ubase
+ ((char *)m
- base
),
1375 m
->u
.match
->name
, m
->data
, sizeof(*m
),
1376 m
->u
.match
->usersize
, m
->match_size
,
1377 m
->u
.match
->revision
);
1380 static inline int ebt_watcher_to_user(const struct ebt_entry_watcher
*w
,
1381 const char *base
, char __user
*ubase
)
1383 return ebt_obj_to_user(ubase
+ ((char *)w
- base
),
1384 w
->u
.watcher
->name
, w
->data
, sizeof(*w
),
1385 w
->u
.watcher
->usersize
, w
->watcher_size
,
1386 w
->u
.watcher
->revision
);
1389 static inline int ebt_entry_to_user(struct ebt_entry
*e
, const char *base
,
1394 const struct ebt_entry_target
*t
;
1396 if (e
->bitmask
== 0) {
1397 /* special case !EBT_ENTRY_OR_ENTRIES */
1398 if (copy_to_user(ubase
+ ((char *)e
- base
), e
,
1399 sizeof(struct ebt_entries
)))
1404 if (copy_to_user(ubase
+ ((char *)e
- base
), e
, sizeof(*e
)))
1407 hlp
= ubase
+ (((char *)e
+ e
->target_offset
) - base
);
1408 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
1410 ret
= EBT_MATCH_ITERATE(e
, ebt_match_to_user
, base
, ubase
);
1413 ret
= EBT_WATCHER_ITERATE(e
, ebt_watcher_to_user
, base
, ubase
);
1416 ret
= ebt_obj_to_user(hlp
, t
->u
.target
->name
, t
->data
, sizeof(*t
),
1417 t
->u
.target
->usersize
, t
->target_size
,
1418 t
->u
.target
->revision
);
1425 static int copy_counters_to_user(struct ebt_table
*t
,
1426 const struct ebt_counter
*oldcounters
,
1427 void __user
*user
, unsigned int num_counters
,
1428 unsigned int nentries
)
1430 struct ebt_counter
*counterstmp
;
1433 /* userspace might not need the counters */
1434 if (num_counters
== 0)
1437 if (num_counters
!= nentries
) {
1438 BUGPRINT("Num_counters wrong\n");
1442 counterstmp
= vmalloc(nentries
* sizeof(*counterstmp
));
1446 write_lock_bh(&t
->lock
);
1447 get_counters(oldcounters
, counterstmp
, nentries
);
1448 write_unlock_bh(&t
->lock
);
1450 if (copy_to_user(user
, counterstmp
,
1451 nentries
* sizeof(struct ebt_counter
)))
1457 /* called with ebt_mutex locked */
1458 static int copy_everything_to_user(struct ebt_table
*t
, void __user
*user
,
1459 const int *len
, int cmd
)
1461 struct ebt_replace tmp
;
1462 const struct ebt_counter
*oldcounters
;
1463 unsigned int entries_size
, nentries
;
1467 if (cmd
== EBT_SO_GET_ENTRIES
) {
1468 entries_size
= t
->private->entries_size
;
1469 nentries
= t
->private->nentries
;
1470 entries
= t
->private->entries
;
1471 oldcounters
= t
->private->counters
;
1473 entries_size
= t
->table
->entries_size
;
1474 nentries
= t
->table
->nentries
;
1475 entries
= t
->table
->entries
;
1476 oldcounters
= t
->table
->counters
;
1479 if (copy_from_user(&tmp
, user
, sizeof(tmp
)))
1482 if (*len
!= sizeof(struct ebt_replace
) + entries_size
+
1483 (tmp
.num_counters
? nentries
* sizeof(struct ebt_counter
) : 0))
1486 if (tmp
.nentries
!= nentries
) {
1487 BUGPRINT("Nentries wrong\n");
1491 if (tmp
.entries_size
!= entries_size
) {
1492 BUGPRINT("Wrong size\n");
1496 ret
= copy_counters_to_user(t
, oldcounters
, tmp
.counters
,
1497 tmp
.num_counters
, nentries
);
1501 /* set the match/watcher/target names right */
1502 return EBT_ENTRY_ITERATE(entries
, entries_size
,
1503 ebt_entry_to_user
, entries
, tmp
.entries
);
1506 static int do_ebt_set_ctl(struct sock
*sk
,
1507 int cmd
, void __user
*user
, unsigned int len
)
1510 struct net
*net
= sock_net(sk
);
1512 if (!ns_capable(net
->user_ns
, CAP_NET_ADMIN
))
1516 case EBT_SO_SET_ENTRIES
:
1517 ret
= do_replace(net
, user
, len
);
1519 case EBT_SO_SET_COUNTERS
:
1520 ret
= update_counters(net
, user
, len
);
1528 static int do_ebt_get_ctl(struct sock
*sk
, int cmd
, void __user
*user
, int *len
)
1531 struct ebt_replace tmp
;
1532 struct ebt_table
*t
;
1533 struct net
*net
= sock_net(sk
);
1535 if (!ns_capable(net
->user_ns
, CAP_NET_ADMIN
))
1538 if (copy_from_user(&tmp
, user
, sizeof(tmp
)))
1541 tmp
.name
[sizeof(tmp
.name
) - 1] = '\0';
1543 t
= find_table_lock(net
, tmp
.name
, &ret
, &ebt_mutex
);
1548 case EBT_SO_GET_INFO
:
1549 case EBT_SO_GET_INIT_INFO
:
1550 if (*len
!= sizeof(struct ebt_replace
)) {
1552 mutex_unlock(&ebt_mutex
);
1555 if (cmd
== EBT_SO_GET_INFO
) {
1556 tmp
.nentries
= t
->private->nentries
;
1557 tmp
.entries_size
= t
->private->entries_size
;
1558 tmp
.valid_hooks
= t
->valid_hooks
;
1560 tmp
.nentries
= t
->table
->nentries
;
1561 tmp
.entries_size
= t
->table
->entries_size
;
1562 tmp
.valid_hooks
= t
->table
->valid_hooks
;
1564 mutex_unlock(&ebt_mutex
);
1565 if (copy_to_user(user
, &tmp
, *len
) != 0) {
1566 BUGPRINT("c2u Didn't work\n");
1573 case EBT_SO_GET_ENTRIES
:
1574 case EBT_SO_GET_INIT_ENTRIES
:
1575 ret
= copy_everything_to_user(t
, user
, len
, cmd
);
1576 mutex_unlock(&ebt_mutex
);
1580 mutex_unlock(&ebt_mutex
);
1587 #ifdef CONFIG_COMPAT
1588 /* 32 bit-userspace compatibility definitions. */
1589 struct compat_ebt_replace
{
1590 char name
[EBT_TABLE_MAXNAMELEN
];
1591 compat_uint_t valid_hooks
;
1592 compat_uint_t nentries
;
1593 compat_uint_t entries_size
;
1594 /* start of the chains */
1595 compat_uptr_t hook_entry
[NF_BR_NUMHOOKS
];
1596 /* nr of counters userspace expects back */
1597 compat_uint_t num_counters
;
1598 /* where the kernel will put the old counters. */
1599 compat_uptr_t counters
;
1600 compat_uptr_t entries
;
1603 /* struct ebt_entry_match, _target and _watcher have same layout */
1604 struct compat_ebt_entry_mwt
{
1607 char name
[EBT_EXTENSION_MAXNAMELEN
];
1612 compat_uint_t match_size
;
1613 compat_uint_t data
[0];
1616 /* account for possible padding between match_size and ->data */
1617 static int ebt_compat_entry_padsize(void)
1619 BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match
)) <
1620 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt
)));
1621 return (int) XT_ALIGN(sizeof(struct ebt_entry_match
)) -
1622 COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt
));
1625 static int ebt_compat_match_offset(const struct xt_match
*match
,
1626 unsigned int userlen
)
1628 /* ebt_among needs special handling. The kernel .matchsize is
1629 * set to -1 at registration time; at runtime an EBT_ALIGN()ed
1630 * value is expected.
1631 * Example: userspace sends 4500, ebt_among.c wants 4504.
1633 if (unlikely(match
->matchsize
== -1))
1634 return XT_ALIGN(userlen
) - COMPAT_XT_ALIGN(userlen
);
1635 return xt_compat_match_offset(match
);
1638 static int compat_match_to_user(struct ebt_entry_match
*m
, void __user
**dstptr
,
1641 const struct xt_match
*match
= m
->u
.match
;
1642 struct compat_ebt_entry_mwt __user
*cm
= *dstptr
;
1643 int off
= ebt_compat_match_offset(match
, m
->match_size
);
1644 compat_uint_t msize
= m
->match_size
- off
;
1646 if (WARN_ON(off
>= m
->match_size
))
1649 if (copy_to_user(cm
->u
.name
, match
->name
, strlen(match
->name
) + 1) ||
1650 put_user(match
->revision
, &cm
->u
.revision
) ||
1651 put_user(msize
, &cm
->match_size
))
1654 if (match
->compat_to_user
) {
1655 if (match
->compat_to_user(cm
->data
, m
->data
))
1658 if (xt_data_to_user(cm
->data
, m
->data
, match
->usersize
, msize
,
1659 COMPAT_XT_ALIGN(msize
)))
1663 *size
-= ebt_compat_entry_padsize() + off
;
1669 static int compat_target_to_user(struct ebt_entry_target
*t
,
1670 void __user
**dstptr
,
1673 const struct xt_target
*target
= t
->u
.target
;
1674 struct compat_ebt_entry_mwt __user
*cm
= *dstptr
;
1675 int off
= xt_compat_target_offset(target
);
1676 compat_uint_t tsize
= t
->target_size
- off
;
1678 if (WARN_ON(off
>= t
->target_size
))
1681 if (copy_to_user(cm
->u
.name
, target
->name
, strlen(target
->name
) + 1) ||
1682 put_user(target
->revision
, &cm
->u
.revision
) ||
1683 put_user(tsize
, &cm
->match_size
))
1686 if (target
->compat_to_user
) {
1687 if (target
->compat_to_user(cm
->data
, t
->data
))
1690 if (xt_data_to_user(cm
->data
, t
->data
, target
->usersize
, tsize
,
1691 COMPAT_XT_ALIGN(tsize
)))
1695 *size
-= ebt_compat_entry_padsize() + off
;
1701 static int compat_watcher_to_user(struct ebt_entry_watcher
*w
,
1702 void __user
**dstptr
,
1705 return compat_target_to_user((struct ebt_entry_target
*)w
,
1709 static int compat_copy_entry_to_user(struct ebt_entry
*e
, void __user
**dstptr
,
1712 struct ebt_entry_target
*t
;
1713 struct ebt_entry __user
*ce
;
1714 u32 watchers_offset
, target_offset
, next_offset
;
1715 compat_uint_t origsize
;
1718 if (e
->bitmask
== 0) {
1719 if (*size
< sizeof(struct ebt_entries
))
1721 if (copy_to_user(*dstptr
, e
, sizeof(struct ebt_entries
)))
1724 *dstptr
+= sizeof(struct ebt_entries
);
1725 *size
-= sizeof(struct ebt_entries
);
1729 if (*size
< sizeof(*ce
))
1733 if (copy_to_user(ce
, e
, sizeof(*ce
)))
1737 *dstptr
+= sizeof(*ce
);
1739 ret
= EBT_MATCH_ITERATE(e
, compat_match_to_user
, dstptr
, size
);
1742 watchers_offset
= e
->watchers_offset
- (origsize
- *size
);
1744 ret
= EBT_WATCHER_ITERATE(e
, compat_watcher_to_user
, dstptr
, size
);
1747 target_offset
= e
->target_offset
- (origsize
- *size
);
1749 t
= (struct ebt_entry_target
*) ((char *) e
+ e
->target_offset
);
1751 ret
= compat_target_to_user(t
, dstptr
, size
);
1754 next_offset
= e
->next_offset
- (origsize
- *size
);
1756 if (put_user(watchers_offset
, &ce
->watchers_offset
) ||
1757 put_user(target_offset
, &ce
->target_offset
) ||
1758 put_user(next_offset
, &ce
->next_offset
))
1761 *size
-= sizeof(*ce
);
1765 static int compat_calc_match(struct ebt_entry_match
*m
, int *off
)
1767 *off
+= ebt_compat_match_offset(m
->u
.match
, m
->match_size
);
1768 *off
+= ebt_compat_entry_padsize();
1772 static int compat_calc_watcher(struct ebt_entry_watcher
*w
, int *off
)
1774 *off
+= xt_compat_target_offset(w
->u
.watcher
);
1775 *off
+= ebt_compat_entry_padsize();
1779 static int compat_calc_entry(const struct ebt_entry
*e
,
1780 const struct ebt_table_info
*info
,
1782 struct compat_ebt_replace
*newinfo
)
1784 const struct ebt_entry_target
*t
;
1785 unsigned int entry_offset
;
1788 if (e
->bitmask
== 0)
1792 entry_offset
= (void *)e
- base
;
1794 EBT_MATCH_ITERATE(e
, compat_calc_match
, &off
);
1795 EBT_WATCHER_ITERATE(e
, compat_calc_watcher
, &off
);
1797 t
= (const struct ebt_entry_target
*) ((char *) e
+ e
->target_offset
);
1799 off
+= xt_compat_target_offset(t
->u
.target
);
1800 off
+= ebt_compat_entry_padsize();
1802 newinfo
->entries_size
-= off
;
1804 ret
= xt_compat_add_offset(NFPROTO_BRIDGE
, entry_offset
, off
);
1808 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
1809 const void *hookptr
= info
->hook_entry
[i
];
1810 if (info
->hook_entry
[i
] &&
1811 (e
< (struct ebt_entry
*)(base
- hookptr
))) {
1812 newinfo
->hook_entry
[i
] -= off
;
1813 pr_debug("0x%08X -> 0x%08X\n",
1814 newinfo
->hook_entry
[i
] + off
,
1815 newinfo
->hook_entry
[i
]);
1823 static int compat_table_info(const struct ebt_table_info
*info
,
1824 struct compat_ebt_replace
*newinfo
)
1826 unsigned int size
= info
->entries_size
;
1827 const void *entries
= info
->entries
;
1830 newinfo
->entries_size
= size
;
1832 ret
= xt_compat_init_offsets(NFPROTO_BRIDGE
, info
->nentries
);
1836 return EBT_ENTRY_ITERATE(entries
, size
, compat_calc_entry
, info
,
1840 static int compat_copy_everything_to_user(struct ebt_table
*t
,
1841 void __user
*user
, int *len
, int cmd
)
1843 struct compat_ebt_replace repl
, tmp
;
1844 struct ebt_counter
*oldcounters
;
1845 struct ebt_table_info tinfo
;
1849 memset(&tinfo
, 0, sizeof(tinfo
));
1851 if (cmd
== EBT_SO_GET_ENTRIES
) {
1852 tinfo
.entries_size
= t
->private->entries_size
;
1853 tinfo
.nentries
= t
->private->nentries
;
1854 tinfo
.entries
= t
->private->entries
;
1855 oldcounters
= t
->private->counters
;
1857 tinfo
.entries_size
= t
->table
->entries_size
;
1858 tinfo
.nentries
= t
->table
->nentries
;
1859 tinfo
.entries
= t
->table
->entries
;
1860 oldcounters
= t
->table
->counters
;
1863 if (copy_from_user(&tmp
, user
, sizeof(tmp
)))
1866 if (tmp
.nentries
!= tinfo
.nentries
||
1867 (tmp
.num_counters
&& tmp
.num_counters
!= tinfo
.nentries
))
1870 memcpy(&repl
, &tmp
, sizeof(repl
));
1871 if (cmd
== EBT_SO_GET_ENTRIES
)
1872 ret
= compat_table_info(t
->private, &repl
);
1874 ret
= compat_table_info(&tinfo
, &repl
);
1878 if (*len
!= sizeof(tmp
) + repl
.entries_size
+
1879 (tmp
.num_counters
? tinfo
.nentries
* sizeof(struct ebt_counter
): 0)) {
1880 pr_err("wrong size: *len %d, entries_size %u, replsz %d\n",
1881 *len
, tinfo
.entries_size
, repl
.entries_size
);
1885 /* userspace might not need the counters */
1886 ret
= copy_counters_to_user(t
, oldcounters
, compat_ptr(tmp
.counters
),
1887 tmp
.num_counters
, tinfo
.nentries
);
1891 pos
= compat_ptr(tmp
.entries
);
1892 return EBT_ENTRY_ITERATE(tinfo
.entries
, tinfo
.entries_size
,
1893 compat_copy_entry_to_user
, &pos
, &tmp
.entries_size
);
1896 struct ebt_entries_buf_state
{
1897 char *buf_kern_start
; /* kernel buffer to copy (translated) data to */
1898 u32 buf_kern_len
; /* total size of kernel buffer */
1899 u32 buf_kern_offset
; /* amount of data copied so far */
1900 u32 buf_user_offset
; /* read position in userspace buffer */
1903 static int ebt_buf_count(struct ebt_entries_buf_state
*state
, unsigned int sz
)
1905 state
->buf_kern_offset
+= sz
;
1906 return state
->buf_kern_offset
>= sz
? 0 : -EINVAL
;
1909 static int ebt_buf_add(struct ebt_entries_buf_state
*state
,
1910 void *data
, unsigned int sz
)
1912 if (state
->buf_kern_start
== NULL
)
1915 if (WARN_ON(state
->buf_kern_offset
+ sz
> state
->buf_kern_len
))
1918 memcpy(state
->buf_kern_start
+ state
->buf_kern_offset
, data
, sz
);
1921 state
->buf_user_offset
+= sz
;
1922 return ebt_buf_count(state
, sz
);
1925 static int ebt_buf_add_pad(struct ebt_entries_buf_state
*state
, unsigned int sz
)
1927 char *b
= state
->buf_kern_start
;
1929 if (WARN_ON(b
&& state
->buf_kern_offset
> state
->buf_kern_len
))
1932 if (b
!= NULL
&& sz
> 0)
1933 memset(b
+ state
->buf_kern_offset
, 0, sz
);
1934 /* do not adjust ->buf_user_offset here, we added kernel-side padding */
1935 return ebt_buf_count(state
, sz
);
1944 static int compat_mtw_from_user(struct compat_ebt_entry_mwt
*mwt
,
1945 enum compat_mwt compat_mwt
,
1946 struct ebt_entries_buf_state
*state
,
1947 const unsigned char *base
)
1949 char name
[EBT_EXTENSION_MAXNAMELEN
];
1950 struct xt_match
*match
;
1951 struct xt_target
*wt
;
1954 unsigned int size_kern
, match_size
= mwt
->match_size
;
1956 strlcpy(name
, mwt
->u
.name
, sizeof(name
));
1958 if (state
->buf_kern_start
)
1959 dst
= state
->buf_kern_start
+ state
->buf_kern_offset
;
1961 switch (compat_mwt
) {
1962 case EBT_COMPAT_MATCH
:
1963 match
= xt_request_find_match(NFPROTO_BRIDGE
, name
,
1966 return PTR_ERR(match
);
1968 off
= ebt_compat_match_offset(match
, match_size
);
1970 if (match
->compat_from_user
)
1971 match
->compat_from_user(dst
, mwt
->data
);
1973 memcpy(dst
, mwt
->data
, match_size
);
1976 size_kern
= match
->matchsize
;
1977 if (unlikely(size_kern
== -1))
1978 size_kern
= match_size
;
1979 module_put(match
->me
);
1981 case EBT_COMPAT_WATCHER
: /* fallthrough */
1982 case EBT_COMPAT_TARGET
:
1983 wt
= xt_request_find_target(NFPROTO_BRIDGE
, name
,
1987 off
= xt_compat_target_offset(wt
);
1990 if (wt
->compat_from_user
)
1991 wt
->compat_from_user(dst
, mwt
->data
);
1993 memcpy(dst
, mwt
->data
, match_size
);
1996 size_kern
= wt
->targetsize
;
2004 state
->buf_kern_offset
+= match_size
+ off
;
2005 state
->buf_user_offset
+= match_size
;
2006 pad
= XT_ALIGN(size_kern
) - size_kern
;
2008 if (pad
> 0 && dst
) {
2009 if (WARN_ON(state
->buf_kern_len
<= pad
))
2011 if (WARN_ON(state
->buf_kern_offset
- (match_size
+ off
) + size_kern
> state
->buf_kern_len
- pad
))
2013 memset(dst
+ size_kern
, 0, pad
);
2015 return off
+ match_size
;
2018 /* return size of all matches, watchers or target, including necessary
2019 * alignment and padding.
2021 static int ebt_size_mwt(struct compat_ebt_entry_mwt
*match32
,
2022 unsigned int size_left
, enum compat_mwt type
,
2023 struct ebt_entries_buf_state
*state
, const void *base
)
2031 buf
= (char *) match32
;
2033 while (size_left
>= sizeof(*match32
)) {
2034 struct ebt_entry_match
*match_kern
;
2037 match_kern
= (struct ebt_entry_match
*) state
->buf_kern_start
;
2040 tmp
= state
->buf_kern_start
+ state
->buf_kern_offset
;
2041 match_kern
= (struct ebt_entry_match
*) tmp
;
2043 ret
= ebt_buf_add(state
, buf
, sizeof(*match32
));
2046 size_left
-= sizeof(*match32
);
2048 /* add padding before match->data (if any) */
2049 ret
= ebt_buf_add_pad(state
, ebt_compat_entry_padsize());
2053 if (match32
->match_size
> size_left
)
2056 size_left
-= match32
->match_size
;
2058 ret
= compat_mtw_from_user(match32
, type
, state
, base
);
2062 if (WARN_ON(ret
< match32
->match_size
))
2064 growth
+= ret
- match32
->match_size
;
2065 growth
+= ebt_compat_entry_padsize();
2067 buf
+= sizeof(*match32
);
2068 buf
+= match32
->match_size
;
2071 match_kern
->match_size
= ret
;
2073 if (WARN_ON(type
== EBT_COMPAT_TARGET
&& size_left
))
2076 match32
= (struct compat_ebt_entry_mwt
*) buf
;
2082 /* called for all ebt_entry structures. */
2083 static int size_entry_mwt(struct ebt_entry
*entry
, const unsigned char *base
,
2084 unsigned int *total
,
2085 struct ebt_entries_buf_state
*state
)
2087 unsigned int i
, j
, startoff
, new_offset
= 0;
2088 /* stores match/watchers/targets & offset of next struct ebt_entry: */
2089 unsigned int offsets
[4];
2090 unsigned int *offsets_update
= NULL
;
2094 if (*total
< sizeof(struct ebt_entries
))
2097 if (!entry
->bitmask
) {
2098 *total
-= sizeof(struct ebt_entries
);
2099 return ebt_buf_add(state
, entry
, sizeof(struct ebt_entries
));
2101 if (*total
< sizeof(*entry
) || entry
->next_offset
< sizeof(*entry
))
2104 startoff
= state
->buf_user_offset
;
2105 /* pull in most part of ebt_entry, it does not need to be changed. */
2106 ret
= ebt_buf_add(state
, entry
,
2107 offsetof(struct ebt_entry
, watchers_offset
));
2111 offsets
[0] = sizeof(struct ebt_entry
); /* matches come first */
2112 memcpy(&offsets
[1], &entry
->watchers_offset
,
2113 sizeof(offsets
) - sizeof(offsets
[0]));
2115 if (state
->buf_kern_start
) {
2116 buf_start
= state
->buf_kern_start
+ state
->buf_kern_offset
;
2117 offsets_update
= (unsigned int *) buf_start
;
2119 ret
= ebt_buf_add(state
, &offsets
[1],
2120 sizeof(offsets
) - sizeof(offsets
[0]));
2123 buf_start
= (char *) entry
;
2124 /* 0: matches offset, always follows ebt_entry.
2125 * 1: watchers offset, from ebt_entry structure
2126 * 2: target offset, from ebt_entry structure
2127 * 3: next ebt_entry offset, from ebt_entry structure
2129 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
2131 for (i
= 0; i
< 4 ; ++i
) {
2132 if (offsets
[i
] > *total
)
2135 if (i
< 3 && offsets
[i
] == *total
)
2140 if (offsets
[i
-1] > offsets
[i
])
2144 for (i
= 0, j
= 1 ; j
< 4 ; j
++, i
++) {
2145 struct compat_ebt_entry_mwt
*match32
;
2147 char *buf
= buf_start
+ offsets
[i
];
2149 if (offsets
[i
] > offsets
[j
])
2152 match32
= (struct compat_ebt_entry_mwt
*) buf
;
2153 size
= offsets
[j
] - offsets
[i
];
2154 ret
= ebt_size_mwt(match32
, size
, i
, state
, base
);
2158 if (offsets_update
&& new_offset
) {
2159 pr_debug("change offset %d to %d\n",
2160 offsets_update
[i
], offsets
[j
] + new_offset
);
2161 offsets_update
[i
] = offsets
[j
] + new_offset
;
2165 if (state
->buf_kern_start
== NULL
) {
2166 unsigned int offset
= buf_start
- (char *) base
;
2168 ret
= xt_compat_add_offset(NFPROTO_BRIDGE
, offset
, new_offset
);
2173 startoff
= state
->buf_user_offset
- startoff
;
2175 if (WARN_ON(*total
< startoff
))
2181 /* repl->entries_size is the size of the ebt_entry blob in userspace.
2182 * It might need more memory when copied to a 64 bit kernel in case
2183 * userspace is 32-bit. So, first task: find out how much memory is needed.
2185 * Called before validation is performed.
2187 static int compat_copy_entries(unsigned char *data
, unsigned int size_user
,
2188 struct ebt_entries_buf_state
*state
)
2190 unsigned int size_remaining
= size_user
;
2193 ret
= EBT_ENTRY_ITERATE(data
, size_user
, size_entry_mwt
, data
,
2194 &size_remaining
, state
);
2198 WARN_ON(size_remaining
);
2199 return state
->buf_kern_offset
;
2203 static int compat_copy_ebt_replace_from_user(struct ebt_replace
*repl
,
2204 void __user
*user
, unsigned int len
)
2206 struct compat_ebt_replace tmp
;
2209 if (len
< sizeof(tmp
))
2212 if (copy_from_user(&tmp
, user
, sizeof(tmp
)))
2215 if (len
!= sizeof(tmp
) + tmp
.entries_size
)
2218 if (tmp
.entries_size
== 0)
2221 if (tmp
.nentries
>= ((INT_MAX
- sizeof(struct ebt_table_info
)) /
2222 NR_CPUS
- SMP_CACHE_BYTES
) / sizeof(struct ebt_counter
))
2224 if (tmp
.num_counters
>= INT_MAX
/ sizeof(struct ebt_counter
))
2227 memcpy(repl
, &tmp
, offsetof(struct ebt_replace
, hook_entry
));
2229 /* starting with hook_entry, 32 vs. 64 bit structures are different */
2230 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++)
2231 repl
->hook_entry
[i
] = compat_ptr(tmp
.hook_entry
[i
]);
2233 repl
->num_counters
= tmp
.num_counters
;
2234 repl
->counters
= compat_ptr(tmp
.counters
);
2235 repl
->entries
= compat_ptr(tmp
.entries
);
2239 static int compat_do_replace(struct net
*net
, void __user
*user
,
2242 int ret
, i
, countersize
, size64
;
2243 struct ebt_table_info
*newinfo
;
2244 struct ebt_replace tmp
;
2245 struct ebt_entries_buf_state state
;
2248 ret
= compat_copy_ebt_replace_from_user(&tmp
, user
, len
);
2250 /* try real handler in case userland supplied needed padding */
2251 if (ret
== -EINVAL
&& do_replace(net
, user
, len
) == 0)
2256 countersize
= COUNTER_OFFSET(tmp
.nentries
) * nr_cpu_ids
;
2257 newinfo
= vmalloc(sizeof(*newinfo
) + countersize
);
2262 memset(newinfo
->counters
, 0, countersize
);
2264 memset(&state
, 0, sizeof(state
));
2266 newinfo
->entries
= vmalloc(tmp
.entries_size
);
2267 if (!newinfo
->entries
) {
2272 newinfo
->entries
, tmp
.entries
, tmp
.entries_size
) != 0) {
2277 entries_tmp
= newinfo
->entries
;
2279 xt_compat_lock(NFPROTO_BRIDGE
);
2281 ret
= xt_compat_init_offsets(NFPROTO_BRIDGE
, tmp
.nentries
);
2284 ret
= compat_copy_entries(entries_tmp
, tmp
.entries_size
, &state
);
2288 pr_debug("tmp.entries_size %d, kern off %d, user off %d delta %d\n",
2289 tmp
.entries_size
, state
.buf_kern_offset
, state
.buf_user_offset
,
2290 xt_compat_calc_jump(NFPROTO_BRIDGE
, tmp
.entries_size
));
2293 newinfo
->entries
= vmalloc(size64
);
2294 if (!newinfo
->entries
) {
2300 memset(&state
, 0, sizeof(state
));
2301 state
.buf_kern_start
= newinfo
->entries
;
2302 state
.buf_kern_len
= size64
;
2304 ret
= compat_copy_entries(entries_tmp
, tmp
.entries_size
, &state
);
2305 if (WARN_ON(ret
< 0))
2309 tmp
.entries_size
= size64
;
2311 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
2312 char __user
*usrptr
;
2313 if (tmp
.hook_entry
[i
]) {
2315 usrptr
= (char __user
*) tmp
.hook_entry
[i
];
2316 delta
= usrptr
- tmp
.entries
;
2317 usrptr
+= xt_compat_calc_jump(NFPROTO_BRIDGE
, delta
);
2318 tmp
.hook_entry
[i
] = (struct ebt_entries __user
*)usrptr
;
2322 xt_compat_flush_offsets(NFPROTO_BRIDGE
);
2323 xt_compat_unlock(NFPROTO_BRIDGE
);
2325 ret
= do_replace_finish(net
, &tmp
, newinfo
);
2329 vfree(newinfo
->entries
);
2334 xt_compat_flush_offsets(NFPROTO_BRIDGE
);
2335 xt_compat_unlock(NFPROTO_BRIDGE
);
2339 static int compat_update_counters(struct net
*net
, void __user
*user
,
2342 struct compat_ebt_replace hlp
;
2344 if (copy_from_user(&hlp
, user
, sizeof(hlp
)))
2347 /* try real handler in case userland supplied needed padding */
2348 if (len
!= sizeof(hlp
) + hlp
.num_counters
* sizeof(struct ebt_counter
))
2349 return update_counters(net
, user
, len
);
2351 return do_update_counters(net
, hlp
.name
, compat_ptr(hlp
.counters
),
2352 hlp
.num_counters
, user
, len
);
2355 static int compat_do_ebt_set_ctl(struct sock
*sk
,
2356 int cmd
, void __user
*user
, unsigned int len
)
2359 struct net
*net
= sock_net(sk
);
2361 if (!ns_capable(net
->user_ns
, CAP_NET_ADMIN
))
2365 case EBT_SO_SET_ENTRIES
:
2366 ret
= compat_do_replace(net
, user
, len
);
2368 case EBT_SO_SET_COUNTERS
:
2369 ret
= compat_update_counters(net
, user
, len
);
2377 static int compat_do_ebt_get_ctl(struct sock
*sk
, int cmd
,
2378 void __user
*user
, int *len
)
2381 struct compat_ebt_replace tmp
;
2382 struct ebt_table
*t
;
2383 struct net
*net
= sock_net(sk
);
2385 if (!ns_capable(net
->user_ns
, CAP_NET_ADMIN
))
2388 /* try real handler in case userland supplied needed padding */
2389 if ((cmd
== EBT_SO_GET_INFO
||
2390 cmd
== EBT_SO_GET_INIT_INFO
) && *len
!= sizeof(tmp
))
2391 return do_ebt_get_ctl(sk
, cmd
, user
, len
);
2393 if (copy_from_user(&tmp
, user
, sizeof(tmp
)))
2396 tmp
.name
[sizeof(tmp
.name
) - 1] = '\0';
2398 t
= find_table_lock(net
, tmp
.name
, &ret
, &ebt_mutex
);
2402 xt_compat_lock(NFPROTO_BRIDGE
);
2404 case EBT_SO_GET_INFO
:
2405 tmp
.nentries
= t
->private->nentries
;
2406 ret
= compat_table_info(t
->private, &tmp
);
2409 tmp
.valid_hooks
= t
->valid_hooks
;
2411 if (copy_to_user(user
, &tmp
, *len
) != 0) {
2417 case EBT_SO_GET_INIT_INFO
:
2418 tmp
.nentries
= t
->table
->nentries
;
2419 tmp
.entries_size
= t
->table
->entries_size
;
2420 tmp
.valid_hooks
= t
->table
->valid_hooks
;
2422 if (copy_to_user(user
, &tmp
, *len
) != 0) {
2428 case EBT_SO_GET_ENTRIES
:
2429 case EBT_SO_GET_INIT_ENTRIES
:
2430 /* try real handler first in case of userland-side padding.
2431 * in case we are dealing with an 'ordinary' 32 bit binary
2432 * without 64bit compatibility padding, this will fail right
2433 * after copy_from_user when the *len argument is validated.
2435 * the compat_ variant needs to do one pass over the kernel
2436 * data set to adjust for size differences before it the check.
2438 if (copy_everything_to_user(t
, user
, len
, cmd
) == 0)
2441 ret
= compat_copy_everything_to_user(t
, user
, len
, cmd
);
2447 xt_compat_flush_offsets(NFPROTO_BRIDGE
);
2448 xt_compat_unlock(NFPROTO_BRIDGE
);
2449 mutex_unlock(&ebt_mutex
);
2454 static struct nf_sockopt_ops ebt_sockopts
= {
2456 .set_optmin
= EBT_BASE_CTL
,
2457 .set_optmax
= EBT_SO_SET_MAX
+ 1,
2458 .set
= do_ebt_set_ctl
,
2459 #ifdef CONFIG_COMPAT
2460 .compat_set
= compat_do_ebt_set_ctl
,
2462 .get_optmin
= EBT_BASE_CTL
,
2463 .get_optmax
= EBT_SO_GET_MAX
+ 1,
2464 .get
= do_ebt_get_ctl
,
2465 #ifdef CONFIG_COMPAT
2466 .compat_get
= compat_do_ebt_get_ctl
,
2468 .owner
= THIS_MODULE
,
2471 static int __init
ebtables_init(void)
2475 ret
= xt_register_target(&ebt_standard_target
);
2478 ret
= nf_register_sockopt(&ebt_sockopts
);
2480 xt_unregister_target(&ebt_standard_target
);
2487 static void __exit
ebtables_fini(void)
2489 nf_unregister_sockopt(&ebt_sockopts
);
2490 xt_unregister_target(&ebt_standard_target
);
2493 EXPORT_SYMBOL(ebt_register_table
);
2494 EXPORT_SYMBOL(ebt_unregister_table
);
2495 EXPORT_SYMBOL(ebt_do_table
);
2496 module_init(ebtables_init
);
2497 module_exit(ebtables_fini
);
2498 MODULE_LICENSE("GPL");