projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blob
? search:


3e1bf716509a99117400dc3ad25758acf9eff9d3
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bridge / netfilter / ebtables.c
1 /*
2 * ebtables
3 *
4 * Author:
5 * Bart De Schuymer <bdschuym@pandora.be>
6 *
7 * ebtables.c,v 2.0, July, 2002
8 *
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 */
17
18 /* used for print_string */
19 #include <linux/sched.h>
20 #include <linux/tty.h>
21
22 #include <linux/kmod.h>
23 #include <linux/module.h>
24 #include <linux/vmalloc.h>
25 #include <linux/netfilter_bridge/ebtables.h>
26 #include <linux/spinlock.h>
27 #include <linux/mutex.h>
28 #include <asm/uaccess.h>
29 #include <linux/smp.h>
30 #include <linux/cpumask.h>
31 #include <net/sock.h>
32 /* needed for logical [in,out]-dev filtering */
33 #include "../br_private.h"
34
35 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
36 "report to author: "format, ## args)
37 /* #define BUGPRINT(format, args...) */
38 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
39 ": out of memory: "format, ## args)
40 /* #define MEMPRINT(format, args...) */
41
42
43
44 /*
45 * Each cpu has its own set of counters, so there is no need for write_lock in
46 * the softirq
47 * For reading or updating the counters, the user context needs to
48 * get a write_lock
49 */
50
51 /* The size of each set of counters is altered to get cache alignment */
52 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
53 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
54 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
55 COUNTER_OFFSET(n) * cpu))
56
57
58
59 static DEFINE_MUTEX(ebt_mutex);
60 static LIST_HEAD(ebt_tables);
61 static LIST_HEAD(ebt_targets);
62 static LIST_HEAD(ebt_matches);
63 static LIST_HEAD(ebt_watchers);
64
65 static struct ebt_target ebt_standard_target =
66 { {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
67
68 static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
69 const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
70 const struct net_device *out)
71 {
72 w->u.watcher->watcher(skb, hooknr, in, out, w->data,
73 w->watcher_size);
74 /* watchers don't give a verdict */
75 return 0;
76 }
77
78 static inline int ebt_do_match (struct ebt_entry_match *m,
79 const struct sk_buff *skb, const struct net_device *in,
80 const struct net_device *out)
81 {
82 return m->u.match->match(skb, in, out, m->data,
83 m->match_size);
84 }
85
86 static inline int ebt_dev_check(char *entry, const struct net_device *device)
87 {
88 int i = 0;
89 const char *devname = device->name;
90
91 if (*entry == '\0')
92 return 0;
93 if (!device)
94 return 1;
95 /* 1 is the wildcard token */
96 while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
97 i++;
98 return (devname[i] != entry[i] && entry[i] != 1);
99 }
100
101 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
102 /* process standard matches */
103 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
104 const struct net_device *in, const struct net_device *out)
105 {
106 int verdict, i;
107
108 if (e->bitmask & EBT_802_3) {
109 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
110 return 1;
111 } else if (!(e->bitmask & EBT_NOPROTO) &&
112 FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
113 return 1;
114
115 if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
116 return 1;
117 if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
118 return 1;
119 if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
120 e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
121 return 1;
122 if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
123 e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
124 return 1;
125
126 if (e->bitmask & EBT_SOURCEMAC) {
127 verdict = 0;
128 for (i = 0; i < 6; i++)
129 verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
130 e->sourcemsk[i];
131 if (FWINV2(verdict != 0, EBT_ISOURCE) )
132 return 1;
133 }
134 if (e->bitmask & EBT_DESTMAC) {
135 verdict = 0;
136 for (i = 0; i < 6; i++)
137 verdict |= (h->h_dest[i] ^ e->destmac[i]) &
138 e->destmsk[i];
139 if (FWINV2(verdict != 0, EBT_IDEST) )
140 return 1;
141 }
142 return 0;
143 }
144
145 /* Do some firewalling */
146 unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
147 const struct net_device *in, const struct net_device *out,
148 struct ebt_table *table)
149 {
150 int i, nentries;
151 struct ebt_entry *point;
152 struct ebt_counter *counter_base, *cb_base;
153 struct ebt_entry_target *t;
154 int verdict, sp = 0;
155 struct ebt_chainstack *cs;
156 struct ebt_entries *chaininfo;
157 char *base;
158 struct ebt_table_info *private;
159
160 read_lock_bh(&table->lock);
161 private = table->private;
162 cb_base = COUNTER_BASE(private->counters, private->nentries,
163 smp_processor_id());
164 if (private->chainstack)
165 cs = private->chainstack[smp_processor_id()];
166 else
167 cs = NULL;
168 chaininfo = private->hook_entry[hook];
169 nentries = private->hook_entry[hook]->nentries;
170 point = (struct ebt_entry *)(private->hook_entry[hook]->data);
171 counter_base = cb_base + private->hook_entry[hook]->counter_offset;
172 /* base for chain jumps */
173 base = private->entries;
174 i = 0;
175 while (i < nentries) {
176 if (ebt_basic_match(point, eth_hdr(*pskb), in, out))
177 goto letscontinue;
178
179 if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
180 goto letscontinue;
181
182 /* increase counter */
183 (*(counter_base + i)).pcnt++;
184 (*(counter_base + i)).bcnt+=(**pskb).len;
185
186 /* these should only watch: not modify, nor tell us
187 what to do with the packet */
188 EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in,
189 out);
190
191 t = (struct ebt_entry_target *)
192 (((char *)point) + point->target_offset);
193 /* standard target */
194 if (!t->u.target->target)
195 verdict = ((struct ebt_standard_target *)t)->verdict;
196 else
197 verdict = t->u.target->target(pskb, hook,
198 in, out, t->data, t->target_size);
199 if (verdict == EBT_ACCEPT) {
200 read_unlock_bh(&table->lock);
201 return NF_ACCEPT;
202 }
203 if (verdict == EBT_DROP) {
204 read_unlock_bh(&table->lock);
205 return NF_DROP;
206 }
207 if (verdict == EBT_RETURN) {
208 letsreturn:
209 #ifdef CONFIG_NETFILTER_DEBUG
210 if (sp == 0) {
211 BUGPRINT("RETURN on base chain");
212 /* act like this is EBT_CONTINUE */
213 goto letscontinue;
214 }
215 #endif
216 sp--;
217 /* put all the local variables right */
218 i = cs[sp].n;
219 chaininfo = cs[sp].chaininfo;
220 nentries = chaininfo->nentries;
221 point = cs[sp].e;
222 counter_base = cb_base +
223 chaininfo->counter_offset;
224 continue;
225 }
226 if (verdict == EBT_CONTINUE)
227 goto letscontinue;
228 #ifdef CONFIG_NETFILTER_DEBUG
229 if (verdict < 0) {
230 BUGPRINT("bogus standard verdict\n");
231 read_unlock_bh(&table->lock);
232 return NF_DROP;
233 }
234 #endif
235 /* jump to a udc */
236 cs[sp].n = i + 1;
237 cs[sp].chaininfo = chaininfo;
238 cs[sp].e = (struct ebt_entry *)
239 (((char *)point) + point->next_offset);
240 i = 0;
241 chaininfo = (struct ebt_entries *) (base + verdict);
242 #ifdef CONFIG_NETFILTER_DEBUG
243 if (chaininfo->distinguisher) {
244 BUGPRINT("jump to non-chain\n");
245 read_unlock_bh(&table->lock);
246 return NF_DROP;
247 }
248 #endif
249 nentries = chaininfo->nentries;
250 point = (struct ebt_entry *)chaininfo->data;
251 counter_base = cb_base + chaininfo->counter_offset;
252 sp++;
253 continue;
254 letscontinue:
255 point = (struct ebt_entry *)
256 (((char *)point) + point->next_offset);
257 i++;
258 }
259
260 /* I actually like this :) */
261 if (chaininfo->policy == EBT_RETURN)
262 goto letsreturn;
263 if (chaininfo->policy == EBT_ACCEPT) {
264 read_unlock_bh(&table->lock);
265 return NF_ACCEPT;
266 }
267 read_unlock_bh(&table->lock);
268 return NF_DROP;
269 }
270
271 /* If it succeeds, returns element and locks mutex */
272 static inline void *
273 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
274 struct mutex *mutex)
275 {
276 struct {
277 struct list_head list;
278 char name[EBT_FUNCTION_MAXNAMELEN];
279 } *e;
280
281 *error = mutex_lock_interruptible(mutex);
282 if (*error != 0)
283 return NULL;
284
285 list_for_each_entry(e, head, list) {
286 if (strcmp(e->name, name) == 0)
287 return e;
288 }
289 *error = -ENOENT;
290 mutex_unlock(mutex);
291 return NULL;
292 }
293
294 #ifndef CONFIG_KMOD
295 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
296 #else
297 static void *
298 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
299 int *error, struct mutex *mutex)
300 {
301 void *ret;
302
303 ret = find_inlist_lock_noload(head, name, error, mutex);
304 if (!ret) {
305 request_module("%s%s", prefix, name);
306 ret = find_inlist_lock_noload(head, name, error, mutex);
307 }
308 return ret;
309 }
310 #endif
311
312 static inline struct ebt_table *
313 find_table_lock(const char *name, int *error, struct mutex *mutex)
314 {
315 return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
316 }
317
318 static inline struct ebt_match *
319 find_match_lock(const char *name, int *error, struct mutex *mutex)
320 {
321 return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
322 }
323
324 static inline struct ebt_watcher *
325 find_watcher_lock(const char *name, int *error, struct mutex *mutex)
326 {
327 return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
328 }
329
330 static inline struct ebt_target *
331 find_target_lock(const char *name, int *error, struct mutex *mutex)
332 {
333 return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
334 }
335
336 static inline int
337 ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
338 const char *name, unsigned int hookmask, unsigned int *cnt)
339 {
340 struct ebt_match *match;
341 size_t left = ((char *)e + e->watchers_offset) - (char *)m;
342 int ret;
343
344 if (left < sizeof(struct ebt_entry_match) ||
345 left - sizeof(struct ebt_entry_match) < m->match_size)
346 return -EINVAL;
347 match = find_match_lock(m->u.name, &ret, &ebt_mutex);
348 if (!match)
349 return ret;
350 m->u.match = match;
351 if (!try_module_get(match->me)) {
352 mutex_unlock(&ebt_mutex);
353 return -ENOENT;
354 }
355 mutex_unlock(&ebt_mutex);
356 if (match->check &&
357 match->check(name, hookmask, e, m->data, m->match_size) != 0) {
358 BUGPRINT("match->check failed\n");
359 module_put(match->me);
360 return -EINVAL;
361 }
362 (*cnt)++;
363 return 0;
364 }
365
366 static inline int
367 ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
368 const char *name, unsigned int hookmask, unsigned int *cnt)
369 {
370 struct ebt_watcher *watcher;
371 size_t left = ((char *)e + e->target_offset) - (char *)w;
372 int ret;
373
374 if (left < sizeof(struct ebt_entry_watcher) ||
375 left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
376 return -EINVAL;
377 watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
378 if (!watcher)
379 return ret;
380 w->u.watcher = watcher;
381 if (!try_module_get(watcher->me)) {
382 mutex_unlock(&ebt_mutex);
383 return -ENOENT;
384 }
385 mutex_unlock(&ebt_mutex);
386 if (watcher->check &&
387 watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
388 BUGPRINT("watcher->check failed\n");
389 module_put(watcher->me);
390 return -EINVAL;
391 }
392 (*cnt)++;
393 return 0;
394 }
395
396 static int ebt_verify_pointers(struct ebt_replace *repl,
397 struct ebt_table_info *newinfo)
398 {
399 unsigned int limit = repl->entries_size;
400 unsigned int valid_hooks = repl->valid_hooks;
401 unsigned int offset = 0;
402 int i;
403
404 for (i = 0; i < NF_BR_NUMHOOKS; i++)
405 newinfo->hook_entry[i] = NULL;
406
407 newinfo->entries_size = repl->entries_size;
408 newinfo->nentries = repl->nentries;
409
410 while (offset < limit) {
411 size_t left = limit - offset;
412 struct ebt_entry *e = (void *)newinfo->entries + offset;
413
414 if (left < sizeof(unsigned int))
415 break;
416
417 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
418 if ((valid_hooks & (1 << i)) == 0)
419 continue;
420 if ((char *)repl->hook_entry[i] == repl->entries + offset)
421 break;
422 }
423
424 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
425 if (e->bitmask != 0) {
426 /* we make userspace set this right,
427 so there is no misunderstanding */
428 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
429 "in distinguisher\n");
430 return -EINVAL;
431 }
432 if (i != NF_BR_NUMHOOKS)
433 newinfo->hook_entry[i] = (struct ebt_entries *)e;
434 if (left < sizeof(struct ebt_entries))
435 break;
436 offset += sizeof(struct ebt_entries);
437 } else {
438 if (left < sizeof(struct ebt_entry))
439 break;
440 if (left < e->next_offset)
441 break;
442 offset += e->next_offset;
443 }
444 }
445 if (offset != limit) {
446 BUGPRINT("entries_size too small\n");
447 return -EINVAL;
448 }
449
450 /* check if all valid hooks have a chain */
451 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
452 if (!newinfo->hook_entry[i] &&
453 (valid_hooks & (1 << i))) {
454 BUGPRINT("Valid hook without chain\n");
455 return -EINVAL;
456 }
457 }
458 return 0;
459 }
460
461 /*
462 * this one is very careful, as it is the first function
463 * to parse the userspace data
464 */
465 static inline int
466 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
467 struct ebt_table_info *newinfo, char *base,
468 struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
469 unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
470 {
471 unsigned int offset = (char *)e - newinfo->entries;
472 int i;
473
474 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
475 if ((valid_hooks & (1 << i)) == 0)
476 continue;
477 if ((char *)hook_entries[i] == base + offset)
478 break;
479 }
480 /* beginning of a new chain
481 if i == NF_BR_NUMHOOKS it must be a user defined chain */
482 if (i != NF_BR_NUMHOOKS || !e->bitmask) {
483 /* this checks if the previous chain has as many entries
484 as it said it has */
485 if (*n != *cnt) {
486 BUGPRINT("nentries does not equal the nr of entries "
487 "in the chain\n");
488 return -EINVAL;
489 }
490 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
491 ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
492 /* only RETURN from udc */
493 if (i != NF_BR_NUMHOOKS ||
494 ((struct ebt_entries *)e)->policy != EBT_RETURN) {
495 BUGPRINT("bad policy\n");
496 return -EINVAL;
497 }
498 }
499 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
500 (*udc_cnt)++;
501 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
502 BUGPRINT("counter_offset != totalcnt");
503 return -EINVAL;
504 }
505 *n = ((struct ebt_entries *)e)->nentries;
506 *cnt = 0;
507 return 0;
508 }
509 /* a plain old entry, heh */
510 if (sizeof(struct ebt_entry) > e->watchers_offset ||
511 e->watchers_offset > e->target_offset ||
512 e->target_offset >= e->next_offset) {
513 BUGPRINT("entry offsets not in right order\n");
514 return -EINVAL;
515 }
516 /* this is not checked anywhere else */
517 if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
518 BUGPRINT("target size too small\n");
519 return -EINVAL;
520 }
521 (*cnt)++;
522 (*totalcnt)++;
523 return 0;
524 }
525
526 struct ebt_cl_stack
527 {
528 struct ebt_chainstack cs;
529 int from;
530 unsigned int hookmask;
531 };
532
533 /*
534 * we need these positions to check that the jumps to a different part of the
535 * entries is a jump to the beginning of a new chain.
536 */
537 static inline int
538 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
539 struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
540 struct ebt_cl_stack *udc)
541 {
542 int i;
543
544 /* we're only interested in chain starts */
545 if (e->bitmask)
546 return 0;
547 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
548 if ((valid_hooks & (1 << i)) == 0)
549 continue;
550 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
551 break;
552 }
553 /* only care about udc */
554 if (i != NF_BR_NUMHOOKS)
555 return 0;
556
557 udc[*n].cs.chaininfo = (struct ebt_entries *)e;
558 /* these initialisations are depended on later in check_chainloops() */
559 udc[*n].cs.n = 0;
560 udc[*n].hookmask = 0;
561
562 (*n)++;
563 return 0;
564 }
565
566 static inline int
567 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
568 {
569 if (i && (*i)-- == 0)
570 return 1;
571 if (m->u.match->destroy)
572 m->u.match->destroy(m->data, m->match_size);
573 module_put(m->u.match->me);
574
575 return 0;
576 }
577
578 static inline int
579 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
580 {
581 if (i && (*i)-- == 0)
582 return 1;
583 if (w->u.watcher->destroy)
584 w->u.watcher->destroy(w->data, w->watcher_size);
585 module_put(w->u.watcher->me);
586
587 return 0;
588 }
589
590 static inline int
591 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
592 {
593 struct ebt_entry_target *t;
594
595 if (e->bitmask == 0)
596 return 0;
597 /* we're done */
598 if (cnt && (*cnt)-- == 0)
599 return 1;
600 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
601 EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
602 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
603 if (t->u.target->destroy)
604 t->u.target->destroy(t->data, t->target_size);
605 module_put(t->u.target->me);
606
607 return 0;
608 }
609
610 static inline int
611 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
612 const char *name, unsigned int *cnt, unsigned int valid_hooks,
613 struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
614 {
615 struct ebt_entry_target *t;
616 struct ebt_target *target;
617 unsigned int i, j, hook = 0, hookmask = 0;
618 size_t gap = e->next_offset - e->target_offset;
619 int ret;
620
621 /* don't mess with the struct ebt_entries */
622 if (e->bitmask == 0)
623 return 0;
624
625 if (e->bitmask & ~EBT_F_MASK) {
626 BUGPRINT("Unknown flag for bitmask\n");
627 return -EINVAL;
628 }
629 if (e->invflags & ~EBT_INV_MASK) {
630 BUGPRINT("Unknown flag for inv bitmask\n");
631 return -EINVAL;
632 }
633 if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
634 BUGPRINT("NOPROTO & 802_3 not allowed\n");
635 return -EINVAL;
636 }
637 /* what hook do we belong to? */
638 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
639 if ((valid_hooks & (1 << i)) == 0)
640 continue;
641 if ((char *)newinfo->hook_entry[i] < (char *)e)
642 hook = i;
643 else
644 break;
645 }
646 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
647 a base chain */
648 if (i < NF_BR_NUMHOOKS)
649 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
650 else {
651 for (i = 0; i < udc_cnt; i++)
652 if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
653 break;
654 if (i == 0)
655 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
656 else
657 hookmask = cl_s[i - 1].hookmask;
658 }
659 i = 0;
660 ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
661 if (ret != 0)
662 goto cleanup_matches;
663 j = 0;
664 ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
665 if (ret != 0)
666 goto cleanup_watchers;
667 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
668 target = find_target_lock(t->u.name, &ret, &ebt_mutex);
669 if (!target)
670 goto cleanup_watchers;
671 if (!try_module_get(target->me)) {
672 mutex_unlock(&ebt_mutex);
673 ret = -ENOENT;
674 goto cleanup_watchers;
675 }
676 mutex_unlock(&ebt_mutex);
677
678 t->u.target = target;
679 if (t->u.target == &ebt_standard_target) {
680 if (gap < sizeof(struct ebt_standard_target)) {
681 BUGPRINT("Standard target size too big\n");
682 ret = -EFAULT;
683 goto cleanup_watchers;
684 }
685 if (((struct ebt_standard_target *)t)->verdict <
686 -NUM_STANDARD_TARGETS) {
687 BUGPRINT("Invalid standard target\n");
688 ret = -EFAULT;
689 goto cleanup_watchers;
690 }
691 } else if (t->target_size > gap - sizeof(struct ebt_entry_target) ||
692 (t->u.target->check &&
693 t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
694 module_put(t->u.target->me);
695 ret = -EFAULT;
696 goto cleanup_watchers;
697 }
698 (*cnt)++;
699 return 0;
700 cleanup_watchers:
701 EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
702 cleanup_matches:
703 EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
704 return ret;
705 }
706
707 /*
708 * checks for loops and sets the hook mask for udc
709 * the hook mask for udc tells us from which base chains the udc can be
710 * accessed. This mask is a parameter to the check() functions of the extensions
711 */
712 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
713 unsigned int udc_cnt, unsigned int hooknr, char *base)
714 {
715 int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
716 struct ebt_entry *e = (struct ebt_entry *)chain->data;
717 struct ebt_entry_target *t;
718
719 while (pos < nentries || chain_nr != -1) {
720 /* end of udc, go back one 'recursion' step */
721 if (pos == nentries) {
722 /* put back values of the time when this chain was called */
723 e = cl_s[chain_nr].cs.e;
724 if (cl_s[chain_nr].from != -1)
725 nentries =
726 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
727 else
728 nentries = chain->nentries;
729 pos = cl_s[chain_nr].cs.n;
730 /* make sure we won't see a loop that isn't one */
731 cl_s[chain_nr].cs.n = 0;
732 chain_nr = cl_s[chain_nr].from;
733 if (pos == nentries)
734 continue;
735 }
736 t = (struct ebt_entry_target *)
737 (((char *)e) + e->target_offset);
738 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
739 goto letscontinue;
740 if (e->target_offset + sizeof(struct ebt_standard_target) >
741 e->next_offset) {
742 BUGPRINT("Standard target size too big\n");
743 return -1;
744 }
745 verdict = ((struct ebt_standard_target *)t)->verdict;
746 if (verdict >= 0) { /* jump to another chain */
747 struct ebt_entries *hlp2 =
748 (struct ebt_entries *)(base + verdict);
749 for (i = 0; i < udc_cnt; i++)
750 if (hlp2 == cl_s[i].cs.chaininfo)
751 break;
752 /* bad destination or loop */
753 if (i == udc_cnt) {
754 BUGPRINT("bad destination\n");
755 return -1;
756 }
757 if (cl_s[i].cs.n) {
758 BUGPRINT("loop\n");
759 return -1;
760 }
761 if (cl_s[i].hookmask & (1 << hooknr))
762 goto letscontinue;
763 /* this can't be 0, so the loop test is correct */
764 cl_s[i].cs.n = pos + 1;
765 pos = 0;
766 cl_s[i].cs.e = ((void *)e + e->next_offset);
767 e = (struct ebt_entry *)(hlp2->data);
768 nentries = hlp2->nentries;
769 cl_s[i].from = chain_nr;
770 chain_nr = i;
771 /* this udc is accessible from the base chain for hooknr */
772 cl_s[i].hookmask |= (1 << hooknr);
773 continue;
774 }
775 letscontinue:
776 e = (void *)e + e->next_offset;
777 pos++;
778 }
779 return 0;
780 }
781
782 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
783 static int translate_table(struct ebt_replace *repl,
784 struct ebt_table_info *newinfo)
785 {
786 unsigned int i, j, k, udc_cnt;
787 int ret;
788 struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
789
790 ret = ebt_verify_pointers(repl, newinfo);
791 if (ret != 0)
792 return ret;
793
794 i = 0;
795 while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
796 i++;
797 if (i == NF_BR_NUMHOOKS) {
798 BUGPRINT("No valid hooks specified\n");
799 return -EINVAL;
800 }
801 if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
802 BUGPRINT("Chains don't start at beginning\n");
803 return -EINVAL;
804 }
805 /* make sure chains are ordered after each other in same order
806 as their corresponding hooks */
807 for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
808 if (!newinfo->hook_entry[j])
809 continue;
810 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
811 BUGPRINT("Hook order must be followed\n");
812 return -EINVAL;
813 }
814 i = j;
815 }
816
817 /* do some early checkings and initialize some things */
818 i = 0; /* holds the expected nr. of entries for the chain */
819 j = 0; /* holds the up to now counted entries for the chain */
820 k = 0; /* holds the total nr. of entries, should equal
821 newinfo->nentries afterwards */
822 udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
823 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
824 ebt_check_entry_size_and_hooks, newinfo, repl->entries,
825 repl->hook_entry, &i, &j, &k,
826 &udc_cnt, repl->valid_hooks);
827
828 if (ret != 0)
829 return ret;
830
831 if (i != j) {
832 BUGPRINT("nentries does not equal the nr of entries in the "
833 "(last) chain\n");
834 return -EINVAL;
835 }
836 if (k != newinfo->nentries) {
837 BUGPRINT("Total nentries is wrong\n");
838 return -EINVAL;
839 }
840
841 /* get the location of the udc, put them in an array
842 while we're at it, allocate the chainstack */
843 if (udc_cnt) {
844 /* this will get free'd in do_replace()/ebt_register_table()
845 if an error occurs */
846 newinfo->chainstack =
847 vmalloc((highest_possible_processor_id()+1)
848 * sizeof(*(newinfo->chainstack)));
849 if (!newinfo->chainstack)
850 return -ENOMEM;
851 for_each_possible_cpu(i) {
852 newinfo->chainstack[i] =
853 vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
854 if (!newinfo->chainstack[i]) {
855 while (i)
856 vfree(newinfo->chainstack[--i]);
857 vfree(newinfo->chainstack);
858 newinfo->chainstack = NULL;
859 return -ENOMEM;
860 }
861 }
862
863 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
864 if (!cl_s)
865 return -ENOMEM;
866 i = 0; /* the i'th udc */
867 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
868 ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
869 repl->valid_hooks, cl_s);
870 /* sanity check */
871 if (i != udc_cnt) {
872 BUGPRINT("i != udc_cnt\n");
873 vfree(cl_s);
874 return -EFAULT;
875 }
876 }
877
878 /* Check for loops */
879 for (i = 0; i < NF_BR_NUMHOOKS; i++)
880 if (newinfo->hook_entry[i])
881 if (check_chainloops(newinfo->hook_entry[i],
882 cl_s, udc_cnt, i, newinfo->entries)) {
883 vfree(cl_s);
884 return -EINVAL;
885 }
886
887 /* we now know the following (along with E=mc²):
888 - the nr of entries in each chain is right
889 - the size of the allocated space is right
890 - all valid hooks have a corresponding chain
891 - there are no loops
892 - wrong data can still be on the level of a single entry
893 - could be there are jumps to places that are not the
894 beginning of a chain. This can only occur in chains that
895 are not accessible from any base chains, so we don't care. */
896
897 /* used to know what we need to clean up if something goes wrong */
898 i = 0;
899 ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
900 ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
901 cl_s, udc_cnt);
902 if (ret != 0) {
903 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
904 ebt_cleanup_entry, &i);
905 }
906 vfree(cl_s);
907 return ret;
908 }
909
910 /* called under write_lock */
911 static void get_counters(struct ebt_counter *oldcounters,
912 struct ebt_counter *counters, unsigned int nentries)
913 {
914 int i, cpu;
915 struct ebt_counter *counter_base;
916
917 /* counters of cpu 0 */
918 memcpy(counters, oldcounters,
919 sizeof(struct ebt_counter) * nentries);
920
921 /* add other counters to those of cpu 0 */
922 for_each_possible_cpu(cpu) {
923 if (cpu == 0)
924 continue;
925 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
926 for (i = 0; i < nentries; i++) {
927 counters[i].pcnt += counter_base[i].pcnt;
928 counters[i].bcnt += counter_base[i].bcnt;
929 }
930 }
931 }
932
933 /* replace the table */
934 static int do_replace(void __user *user, unsigned int len)
935 {
936 int ret, i, countersize;
937 struct ebt_table_info *newinfo;
938 struct ebt_replace tmp;
939 struct ebt_table *t;
940 struct ebt_counter *counterstmp = NULL;
941 /* used to be able to unlock earlier */
942 struct ebt_table_info *table;
943
944 if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
945 return -EFAULT;
946
947 if (len != sizeof(tmp) + tmp.entries_size) {
948 BUGPRINT("Wrong len argument\n");
949 return -EINVAL;
950 }
951
952 if (tmp.entries_size == 0) {
953 BUGPRINT("Entries_size never zero\n");
954 return -EINVAL;
955 }
956 /* overflow check */
957 if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
958 SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
959 return -ENOMEM;
960 if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
961 return -ENOMEM;
962
963 countersize = COUNTER_OFFSET(tmp.nentries) *
964 (highest_possible_processor_id()+1);
965 newinfo = vmalloc(sizeof(*newinfo) + countersize);
966 if (!newinfo)
967 return -ENOMEM;
968
969 if (countersize)
970 memset(newinfo->counters, 0, countersize);
971
972 newinfo->entries = vmalloc(tmp.entries_size);
973 if (!newinfo->entries) {
974 ret = -ENOMEM;
975 goto free_newinfo;
976 }
977 if (copy_from_user(
978 newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
979 BUGPRINT("Couldn't copy entries from userspace\n");
980 ret = -EFAULT;
981 goto free_entries;
982 }
983
984 /* the user wants counters back
985 the check on the size is done later, when we have the lock */
986 if (tmp.num_counters) {
987 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
988 if (!counterstmp) {
989 ret = -ENOMEM;
990 goto free_entries;
991 }
992 }
993 else
994 counterstmp = NULL;
995
996 /* this can get initialized by translate_table() */
997 newinfo->chainstack = NULL;
998 ret = translate_table(&tmp, newinfo);
999
1000 if (ret != 0)
1001 goto free_counterstmp;
1002
1003 t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1004 if (!t) {
1005 ret = -ENOENT;
1006 goto free_iterate;
1007 }
1008
1009 /* the table doesn't like it */
1010 if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
1011 goto free_unlock;
1012
1013 if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
1014 BUGPRINT("Wrong nr. of counters requested\n");
1015 ret = -EINVAL;
1016 goto free_unlock;
1017 }
1018
1019 /* we have the mutex lock, so no danger in reading this pointer */
1020 table = t->private;
1021 /* make sure the table can only be rmmod'ed if it contains no rules */
1022 if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1023 ret = -ENOENT;
1024 goto free_unlock;
1025 } else if (table->nentries && !newinfo->nentries)
1026 module_put(t->me);
1027 /* we need an atomic snapshot of the counters */
1028 write_lock_bh(&t->lock);
1029 if (tmp.num_counters)
1030 get_counters(t->private->counters, counterstmp,
1031 t->private->nentries);
1032
1033 t->private = newinfo;
1034 write_unlock_bh(&t->lock);
1035 mutex_unlock(&ebt_mutex);
1036 /* so, a user can change the chains while having messed up her counter
1037 allocation. Only reason why this is done is because this way the lock
1038 is held only once, while this doesn't bring the kernel into a
1039 dangerous state. */
1040 if (tmp.num_counters &&
1041 copy_to_user(tmp.counters, counterstmp,
1042 tmp.num_counters * sizeof(struct ebt_counter))) {
1043 BUGPRINT("Couldn't copy counters to userspace\n");
1044 ret = -EFAULT;
1045 }
1046 else
1047 ret = 0;
1048
1049 /* decrease module count and free resources */
1050 EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1051 ebt_cleanup_entry, NULL);
1052
1053 vfree(table->entries);
1054 if (table->chainstack) {
1055 for_each_possible_cpu(i)
1056 vfree(table->chainstack[i]);
1057 vfree(table->chainstack);
1058 }
1059 vfree(table);
1060
1061 vfree(counterstmp);
1062 return ret;
1063
1064 free_unlock:
1065 mutex_unlock(&ebt_mutex);
1066 free_iterate:
1067 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1068 ebt_cleanup_entry, NULL);
1069 free_counterstmp:
1070 vfree(counterstmp);
1071 /* can be initialized in translate_table() */
1072 if (newinfo->chainstack) {
1073 for_each_possible_cpu(i)
1074 vfree(newinfo->chainstack[i]);
1075 vfree(newinfo->chainstack);
1076 }
1077 free_entries:
1078 vfree(newinfo->entries);
1079 free_newinfo:
1080 vfree(newinfo);
1081 return ret;
1082 }
1083
1084 int ebt_register_target(struct ebt_target *target)
1085 {
1086 struct ebt_target *t;
1087 int ret;
1088
1089 ret = mutex_lock_interruptible(&ebt_mutex);
1090 if (ret != 0)
1091 return ret;
1092 list_for_each_entry(t, &ebt_targets, list) {
1093 if (strcmp(t->name, target->name) == 0) {
1094 mutex_unlock(&ebt_mutex);
1095 return -EEXIST;
1096 }
1097 }
1098 list_add(&target->list, &ebt_targets);
1099 mutex_unlock(&ebt_mutex);
1100
1101 return 0;
1102 }
1103
1104 void ebt_unregister_target(struct ebt_target *target)
1105 {
1106 mutex_lock(&ebt_mutex);
1107 list_del(&target->list);
1108 mutex_unlock(&ebt_mutex);
1109 }
1110
1111 int ebt_register_match(struct ebt_match *match)
1112 {
1113 struct ebt_match *m;
1114 int ret;
1115
1116 ret = mutex_lock_interruptible(&ebt_mutex);
1117 if (ret != 0)
1118 return ret;
1119 list_for_each_entry(m, &ebt_matches, list) {
1120 if (strcmp(m->name, match->name) == 0) {
1121 mutex_unlock(&ebt_mutex);
1122 return -EEXIST;
1123 }
1124 }
1125 list_add(&match->list, &ebt_matches);
1126 mutex_unlock(&ebt_mutex);
1127
1128 return 0;
1129 }
1130
1131 void ebt_unregister_match(struct ebt_match *match)
1132 {
1133 mutex_lock(&ebt_mutex);
1134 list_del(&match->list);
1135 mutex_unlock(&ebt_mutex);
1136 }
1137
1138 int ebt_register_watcher(struct ebt_watcher *watcher)
1139 {
1140 struct ebt_watcher *w;
1141 int ret;
1142
1143 ret = mutex_lock_interruptible(&ebt_mutex);
1144 if (ret != 0)
1145 return ret;
1146 list_for_each_entry(w, &ebt_watchers, list) {
1147 if (strcmp(w->name, watcher->name) == 0) {
1148 mutex_unlock(&ebt_mutex);
1149 return -EEXIST;
1150 }
1151 }
1152 list_add(&watcher->list, &ebt_watchers);
1153 mutex_unlock(&ebt_mutex);
1154
1155 return 0;
1156 }
1157
1158 void ebt_unregister_watcher(struct ebt_watcher *watcher)
1159 {
1160 mutex_lock(&ebt_mutex);
1161 list_del(&watcher->list);
1162 mutex_unlock(&ebt_mutex);
1163 }
1164
1165 int ebt_register_table(struct ebt_table *table)
1166 {
1167 struct ebt_table_info *newinfo;
1168 struct ebt_table *t;
1169 int ret, i, countersize;
1170
1171 if (!table || !table->table ||!table->table->entries ||
1172 table->table->entries_size == 0 ||
1173 table->table->counters || table->private) {
1174 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1175 return -EINVAL;
1176 }
1177
1178 countersize = COUNTER_OFFSET(table->table->nentries) *
1179 (highest_possible_processor_id()+1);
1180 newinfo = vmalloc(sizeof(*newinfo) + countersize);
1181 ret = -ENOMEM;
1182 if (!newinfo)
1183 return -ENOMEM;
1184
1185 newinfo->entries = vmalloc(table->table->entries_size);
1186 if (!(newinfo->entries))
1187 goto free_newinfo;
1188
1189 memcpy(newinfo->entries, table->table->entries,
1190 table->table->entries_size);
1191
1192 if (countersize)
1193 memset(newinfo->counters, 0, countersize);
1194
1195 /* fill in newinfo and parse the entries */
1196 newinfo->chainstack = NULL;
1197 ret = translate_table(table->table, newinfo);
1198 if (ret != 0) {
1199 BUGPRINT("Translate_table failed\n");
1200 goto free_chainstack;
1201 }
1202
1203 if (table->check && table->check(newinfo, table->valid_hooks)) {
1204 BUGPRINT("The table doesn't like its own initial data, lol\n");
1205 return -EINVAL;
1206 }
1207
1208 table->private = newinfo;
1209 rwlock_init(&table->lock);
1210 ret = mutex_lock_interruptible(&ebt_mutex);
1211 if (ret != 0)
1212 goto free_chainstack;
1213
1214 list_for_each_entry(t, &ebt_tables, list) {
1215 if (strcmp(t->name, table->name) == 0) {
1216 ret = -EEXIST;
1217 BUGPRINT("Table name already exists\n");
1218 goto free_unlock;
1219 }
1220 }
1221
1222 /* Hold a reference count if the chains aren't empty */
1223 if (newinfo->nentries && !try_module_get(table->me)) {
1224 ret = -ENOENT;
1225 goto free_unlock;
1226 }
1227 list_add(&table->list, &ebt_tables);
1228 mutex_unlock(&ebt_mutex);
1229 return 0;
1230 free_unlock:
1231 mutex_unlock(&ebt_mutex);
1232 free_chainstack:
1233 if (newinfo->chainstack) {
1234 for_each_possible_cpu(i)
1235 vfree(newinfo->chainstack[i]);
1236 vfree(newinfo->chainstack);
1237 }
1238 vfree(newinfo->entries);
1239 free_newinfo:
1240 vfree(newinfo);
1241 return ret;
1242 }
1243
1244 void ebt_unregister_table(struct ebt_table *table)
1245 {
1246 int i;
1247
1248 if (!table) {
1249 BUGPRINT("Request to unregister NULL table!!!\n");
1250 return;
1251 }
1252 mutex_lock(&ebt_mutex);
1253 list_del(&table->list);
1254 mutex_unlock(&ebt_mutex);
1255 vfree(table->private->entries);
1256 if (table->private->chainstack) {
1257 for_each_possible_cpu(i)
1258 vfree(table->private->chainstack[i]);
1259 vfree(table->private->chainstack);
1260 }
1261 vfree(table->private);
1262 }
1263
1264 /* userspace just supplied us with counters */
1265 static int update_counters(void __user *user, unsigned int len)
1266 {
1267 int i, ret;
1268 struct ebt_counter *tmp;
1269 struct ebt_replace hlp;
1270 struct ebt_table *t;
1271
1272 if (copy_from_user(&hlp, user, sizeof(hlp)))
1273 return -EFAULT;
1274
1275 if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1276 return -EINVAL;
1277 if (hlp.num_counters == 0)
1278 return -EINVAL;
1279
1280 if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
1281 MEMPRINT("Update_counters && nomemory\n");
1282 return -ENOMEM;
1283 }
1284
1285 t = find_table_lock(hlp.name, &ret, &ebt_mutex);
1286 if (!t)
1287 goto free_tmp;
1288
1289 if (hlp.num_counters != t->private->nentries) {
1290 BUGPRINT("Wrong nr of counters\n");
1291 ret = -EINVAL;
1292 goto unlock_mutex;
1293 }
1294
1295 if ( copy_from_user(tmp, hlp.counters,
1296 hlp.num_counters * sizeof(struct ebt_counter)) ) {
1297 BUGPRINT("Updata_counters && !cfu\n");
1298 ret = -EFAULT;
1299 goto unlock_mutex;
1300 }
1301
1302 /* we want an atomic add of the counters */
1303 write_lock_bh(&t->lock);
1304
1305 /* we add to the counters of the first cpu */
1306 for (i = 0; i < hlp.num_counters; i++) {
1307 t->private->counters[i].pcnt += tmp[i].pcnt;
1308 t->private->counters[i].bcnt += tmp[i].bcnt;
1309 }
1310
1311 write_unlock_bh(&t->lock);
1312 ret = 0;
1313 unlock_mutex:
1314 mutex_unlock(&ebt_mutex);
1315 free_tmp:
1316 vfree(tmp);
1317 return ret;
1318 }
1319
1320 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1321 char *base, char *ubase)
1322 {
1323 char *hlp = ubase - base + (char *)m;
1324 if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1325 return -EFAULT;
1326 return 0;
1327 }
1328
1329 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1330 char *base, char *ubase)
1331 {
1332 char *hlp = ubase - base + (char *)w;
1333 if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1334 return -EFAULT;
1335 return 0;
1336 }
1337
1338 static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
1339 {
1340 int ret;
1341 char *hlp;
1342 struct ebt_entry_target *t;
1343
1344 if (e->bitmask == 0)
1345 return 0;
1346
1347 hlp = ubase - base + (char *)e + e->target_offset;
1348 t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1349
1350 ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1351 if (ret != 0)
1352 return ret;
1353 ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1354 if (ret != 0)
1355 return ret;
1356 if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1357 return -EFAULT;
1358 return 0;
1359 }
1360
1361 /* called with ebt_mutex locked */
1362 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1363 int *len, int cmd)
1364 {
1365 struct ebt_replace tmp;
1366 struct ebt_counter *counterstmp, *oldcounters;
1367 unsigned int entries_size, nentries;
1368 char *entries;
1369
1370 if (cmd == EBT_SO_GET_ENTRIES) {
1371 entries_size = t->private->entries_size;
1372 nentries = t->private->nentries;
1373 entries = t->private->entries;
1374 oldcounters = t->private->counters;
1375 } else {
1376 entries_size = t->table->entries_size;
1377 nentries = t->table->nentries;
1378 entries = t->table->entries;
1379 oldcounters = t->table->counters;
1380 }
1381
1382 if (copy_from_user(&tmp, user, sizeof(tmp))) {
1383 BUGPRINT("Cfu didn't work\n");
1384 return -EFAULT;
1385 }
1386
1387 if (*len != sizeof(struct ebt_replace) + entries_size +
1388 (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1389 BUGPRINT("Wrong size\n");
1390 return -EINVAL;
1391 }
1392
1393 if (tmp.nentries != nentries) {
1394 BUGPRINT("Nentries wrong\n");
1395 return -EINVAL;
1396 }
1397
1398 if (tmp.entries_size != entries_size) {
1399 BUGPRINT("Wrong size\n");
1400 return -EINVAL;
1401 }
1402
1403 /* userspace might not need the counters */
1404 if (tmp.num_counters) {
1405 if (tmp.num_counters != nentries) {
1406 BUGPRINT("Num_counters wrong\n");
1407 return -EINVAL;
1408 }
1409 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1410 if (!counterstmp) {
1411 MEMPRINT("Couldn't copy counters, out of memory\n");
1412 return -ENOMEM;
1413 }
1414 write_lock_bh(&t->lock);
1415 get_counters(oldcounters, counterstmp, nentries);
1416 write_unlock_bh(&t->lock);
1417
1418 if (copy_to_user(tmp.counters, counterstmp,
1419 nentries * sizeof(struct ebt_counter))) {
1420 BUGPRINT("Couldn't copy counters to userspace\n");
1421 vfree(counterstmp);
1422 return -EFAULT;
1423 }
1424 vfree(counterstmp);
1425 }
1426
1427 if (copy_to_user(tmp.entries, entries, entries_size)) {
1428 BUGPRINT("Couldn't copy entries to userspace\n");
1429 return -EFAULT;
1430 }
1431 /* set the match/watcher/target names right */
1432 return EBT_ENTRY_ITERATE(entries, entries_size,
1433 ebt_make_names, entries, tmp.entries);
1434 }
1435
1436 static int do_ebt_set_ctl(struct sock *sk,
1437 int cmd, void __user *user, unsigned int len)
1438 {
1439 int ret;
1440
1441 switch(cmd) {
1442 case EBT_SO_SET_ENTRIES:
1443 ret = do_replace(user, len);
1444 break;
1445 case EBT_SO_SET_COUNTERS:
1446 ret = update_counters(user, len);
1447 break;
1448 default:
1449 ret = -EINVAL;
1450 }
1451 return ret;
1452 }
1453
1454 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1455 {
1456 int ret;
1457 struct ebt_replace tmp;
1458 struct ebt_table *t;
1459
1460 if (copy_from_user(&tmp, user, sizeof(tmp)))
1461 return -EFAULT;
1462
1463 t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1464 if (!t)
1465 return ret;
1466
1467 switch(cmd) {
1468 case EBT_SO_GET_INFO:
1469 case EBT_SO_GET_INIT_INFO:
1470 if (*len != sizeof(struct ebt_replace)){
1471 ret = -EINVAL;
1472 mutex_unlock(&ebt_mutex);
1473 break;
1474 }
1475 if (cmd == EBT_SO_GET_INFO) {
1476 tmp.nentries = t->private->nentries;
1477 tmp.entries_size = t->private->entries_size;
1478 tmp.valid_hooks = t->valid_hooks;
1479 } else {
1480 tmp.nentries = t->table->nentries;
1481 tmp.entries_size = t->table->entries_size;
1482 tmp.valid_hooks = t->table->valid_hooks;
1483 }
1484 mutex_unlock(&ebt_mutex);
1485 if (copy_to_user(user, &tmp, *len) != 0){
1486 BUGPRINT("c2u Didn't work\n");
1487 ret = -EFAULT;
1488 break;
1489 }
1490 ret = 0;
1491 break;
1492
1493 case EBT_SO_GET_ENTRIES:
1494 case EBT_SO_GET_INIT_ENTRIES:
1495 ret = copy_everything_to_user(t, user, len, cmd);
1496 mutex_unlock(&ebt_mutex);
1497 break;
1498
1499 default:
1500 mutex_unlock(&ebt_mutex);
1501 ret = -EINVAL;
1502 }
1503
1504 return ret;
1505 }
1506
1507 static struct nf_sockopt_ops ebt_sockopts =
1508 {
1509 .pf = PF_INET,
1510 .set_optmin = EBT_BASE_CTL,
1511 .set_optmax = EBT_SO_SET_MAX + 1,
1512 .set = do_ebt_set_ctl,
1513 .get_optmin = EBT_BASE_CTL,
1514 .get_optmax = EBT_SO_GET_MAX + 1,
1515 .get = do_ebt_get_ctl,
1516 };
1517
1518 static int __init ebtables_init(void)
1519 {
1520 int ret;
1521
1522 mutex_lock(&ebt_mutex);
1523 list_add(&ebt_standard_target.list, &ebt_targets);
1524 mutex_unlock(&ebt_mutex);
1525 if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
1526 return ret;
1527
1528 printk(KERN_NOTICE "Ebtables v2.0 registered\n");
1529 return 0;
1530 }
1531
1532 static void __exit ebtables_fini(void)
1533 {
1534 nf_unregister_sockopt(&ebt_sockopts);
1535 printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
1536 }
1537
1538 EXPORT_SYMBOL(ebt_register_table);
1539 EXPORT_SYMBOL(ebt_unregister_table);
1540 EXPORT_SYMBOL(ebt_register_match);
1541 EXPORT_SYMBOL(ebt_unregister_match);
1542 EXPORT_SYMBOL(ebt_register_watcher);
1543 EXPORT_SYMBOL(ebt_unregister_watcher);
1544 EXPORT_SYMBOL(ebt_register_target);
1545 EXPORT_SYMBOL(ebt_unregister_target);
1546 EXPORT_SYMBOL(ebt_do_table);
1547 module_init(ebtables_init);
1548 module_exit(ebtables_fini);
1549 MODULE_LICENSE("GPL");
kernel source for telekom puls (alcatel/mediatek)