5 * Bart De Schuymer <bdschuym@pandora.be>
7 * ebtables.c,v 2.0, July, 2002
9 * This code is stongly inspired on the iptables code which is
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
19 #include <linux/kmod.h>
20 #include <linux/module.h>
21 #include <linux/vmalloc.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/spinlock.h>
24 #include <linux/mutex.h>
25 #include <asm/uaccess.h>
26 #include <linux/smp.h>
27 #include <linux/cpumask.h>
29 /* needed for logical [in,out]-dev filtering */
30 #include "../br_private.h"
32 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
33 "report to author: "format, ## args)
34 /* #define BUGPRINT(format, args...) */
35 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
36 ": out of memory: "format, ## args)
37 /* #define MEMPRINT(format, args...) */
42 * Each cpu has its own set of counters, so there is no need for write_lock in
44 * For reading or updating the counters, the user context needs to
48 /* The size of each set of counters is altered to get cache alignment */
49 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
50 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
51 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
52 COUNTER_OFFSET(n) * cpu))
56 static DEFINE_MUTEX(ebt_mutex
);
57 static LIST_HEAD(ebt_tables
);
58 static LIST_HEAD(ebt_targets
);
59 static LIST_HEAD(ebt_matches
);
60 static LIST_HEAD(ebt_watchers
);
62 static struct ebt_target ebt_standard_target
=
63 { {NULL
, NULL
}, EBT_STANDARD_TARGET
, NULL
, NULL
, NULL
, NULL
};
65 static inline int ebt_do_watcher (struct ebt_entry_watcher
*w
,
66 const struct sk_buff
*skb
, unsigned int hooknr
, const struct net_device
*in
,
67 const struct net_device
*out
)
69 w
->u
.watcher
->watcher(skb
, hooknr
, in
, out
, w
->data
,
71 /* watchers don't give a verdict */
75 static inline int ebt_do_match (struct ebt_entry_match
*m
,
76 const struct sk_buff
*skb
, const struct net_device
*in
,
77 const struct net_device
*out
)
79 return m
->u
.match
->match(skb
, in
, out
, m
->data
,
83 static inline int ebt_dev_check(char *entry
, const struct net_device
*device
)
86 const char *devname
= device
->name
;
92 /* 1 is the wildcard token */
93 while (entry
[i
] != '\0' && entry
[i
] != 1 && entry
[i
] == devname
[i
])
95 return (devname
[i
] != entry
[i
] && entry
[i
] != 1);
98 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
99 /* process standard matches */
100 static inline int ebt_basic_match(struct ebt_entry
*e
, struct ethhdr
*h
,
101 const struct net_device
*in
, const struct net_device
*out
)
105 if (e
->bitmask
& EBT_802_3
) {
106 if (FWINV2(ntohs(h
->h_proto
) >= 1536, EBT_IPROTO
))
108 } else if (!(e
->bitmask
& EBT_NOPROTO
) &&
109 FWINV2(e
->ethproto
!= h
->h_proto
, EBT_IPROTO
))
112 if (FWINV2(ebt_dev_check(e
->in
, in
), EBT_IIN
))
114 if (FWINV2(ebt_dev_check(e
->out
, out
), EBT_IOUT
))
116 if ((!in
|| !in
->br_port
) ? 0 : FWINV2(ebt_dev_check(
117 e
->logical_in
, in
->br_port
->br
->dev
), EBT_ILOGICALIN
))
119 if ((!out
|| !out
->br_port
) ? 0 : FWINV2(ebt_dev_check(
120 e
->logical_out
, out
->br_port
->br
->dev
), EBT_ILOGICALOUT
))
123 if (e
->bitmask
& EBT_SOURCEMAC
) {
125 for (i
= 0; i
< 6; i
++)
126 verdict
|= (h
->h_source
[i
] ^ e
->sourcemac
[i
]) &
128 if (FWINV2(verdict
!= 0, EBT_ISOURCE
) )
131 if (e
->bitmask
& EBT_DESTMAC
) {
133 for (i
= 0; i
< 6; i
++)
134 verdict
|= (h
->h_dest
[i
] ^ e
->destmac
[i
]) &
136 if (FWINV2(verdict
!= 0, EBT_IDEST
) )
142 /* Do some firewalling */
143 unsigned int ebt_do_table (unsigned int hook
, struct sk_buff
*skb
,
144 const struct net_device
*in
, const struct net_device
*out
,
145 struct ebt_table
*table
)
148 struct ebt_entry
*point
;
149 struct ebt_counter
*counter_base
, *cb_base
;
150 struct ebt_entry_target
*t
;
152 struct ebt_chainstack
*cs
;
153 struct ebt_entries
*chaininfo
;
155 struct ebt_table_info
*private;
157 read_lock_bh(&table
->lock
);
158 private = table
->private;
159 cb_base
= COUNTER_BASE(private->counters
, private->nentries
,
161 if (private->chainstack
)
162 cs
= private->chainstack
[smp_processor_id()];
165 chaininfo
= private->hook_entry
[hook
];
166 nentries
= private->hook_entry
[hook
]->nentries
;
167 point
= (struct ebt_entry
*)(private->hook_entry
[hook
]->data
);
168 counter_base
= cb_base
+ private->hook_entry
[hook
]->counter_offset
;
169 /* base for chain jumps */
170 base
= private->entries
;
172 while (i
< nentries
) {
173 if (ebt_basic_match(point
, eth_hdr(skb
), in
, out
))
176 if (EBT_MATCH_ITERATE(point
, ebt_do_match
, skb
, in
, out
) != 0)
179 /* increase counter */
180 (*(counter_base
+ i
)).pcnt
++;
181 (*(counter_base
+ i
)).bcnt
+= skb
->len
;
183 /* these should only watch: not modify, nor tell us
184 what to do with the packet */
185 EBT_WATCHER_ITERATE(point
, ebt_do_watcher
, skb
, hook
, in
,
188 t
= (struct ebt_entry_target
*)
189 (((char *)point
) + point
->target_offset
);
190 /* standard target */
191 if (!t
->u
.target
->target
)
192 verdict
= ((struct ebt_standard_target
*)t
)->verdict
;
194 verdict
= t
->u
.target
->target(skb
, hook
,
195 in
, out
, t
->data
, t
->target_size
);
196 if (verdict
== EBT_ACCEPT
) {
197 read_unlock_bh(&table
->lock
);
200 if (verdict
== EBT_DROP
) {
201 read_unlock_bh(&table
->lock
);
204 if (verdict
== EBT_RETURN
) {
206 #ifdef CONFIG_NETFILTER_DEBUG
208 BUGPRINT("RETURN on base chain");
209 /* act like this is EBT_CONTINUE */
214 /* put all the local variables right */
216 chaininfo
= cs
[sp
].chaininfo
;
217 nentries
= chaininfo
->nentries
;
219 counter_base
= cb_base
+
220 chaininfo
->counter_offset
;
223 if (verdict
== EBT_CONTINUE
)
225 #ifdef CONFIG_NETFILTER_DEBUG
227 BUGPRINT("bogus standard verdict\n");
228 read_unlock_bh(&table
->lock
);
234 cs
[sp
].chaininfo
= chaininfo
;
235 cs
[sp
].e
= (struct ebt_entry
*)
236 (((char *)point
) + point
->next_offset
);
238 chaininfo
= (struct ebt_entries
*) (base
+ verdict
);
239 #ifdef CONFIG_NETFILTER_DEBUG
240 if (chaininfo
->distinguisher
) {
241 BUGPRINT("jump to non-chain\n");
242 read_unlock_bh(&table
->lock
);
246 nentries
= chaininfo
->nentries
;
247 point
= (struct ebt_entry
*)chaininfo
->data
;
248 counter_base
= cb_base
+ chaininfo
->counter_offset
;
252 point
= (struct ebt_entry
*)
253 (((char *)point
) + point
->next_offset
);
257 /* I actually like this :) */
258 if (chaininfo
->policy
== EBT_RETURN
)
260 if (chaininfo
->policy
== EBT_ACCEPT
) {
261 read_unlock_bh(&table
->lock
);
264 read_unlock_bh(&table
->lock
);
268 /* If it succeeds, returns element and locks mutex */
270 find_inlist_lock_noload(struct list_head
*head
, const char *name
, int *error
,
274 struct list_head list
;
275 char name
[EBT_FUNCTION_MAXNAMELEN
];
278 *error
= mutex_lock_interruptible(mutex
);
282 list_for_each_entry(e
, head
, list
) {
283 if (strcmp(e
->name
, name
) == 0)
292 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
295 find_inlist_lock(struct list_head
*head
, const char *name
, const char *prefix
,
296 int *error
, struct mutex
*mutex
)
300 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
302 request_module("%s%s", prefix
, name
);
303 ret
= find_inlist_lock_noload(head
, name
, error
, mutex
);
309 static inline struct ebt_table
*
310 find_table_lock(const char *name
, int *error
, struct mutex
*mutex
)
312 return find_inlist_lock(&ebt_tables
, name
, "ebtable_", error
, mutex
);
315 static inline struct ebt_match
*
316 find_match_lock(const char *name
, int *error
, struct mutex
*mutex
)
318 return find_inlist_lock(&ebt_matches
, name
, "ebt_", error
, mutex
);
321 static inline struct ebt_watcher
*
322 find_watcher_lock(const char *name
, int *error
, struct mutex
*mutex
)
324 return find_inlist_lock(&ebt_watchers
, name
, "ebt_", error
, mutex
);
327 static inline struct ebt_target
*
328 find_target_lock(const char *name
, int *error
, struct mutex
*mutex
)
330 return find_inlist_lock(&ebt_targets
, name
, "ebt_", error
, mutex
);
334 ebt_check_match(struct ebt_entry_match
*m
, struct ebt_entry
*e
,
335 const char *name
, unsigned int hookmask
, unsigned int *cnt
)
337 struct ebt_match
*match
;
338 size_t left
= ((char *)e
+ e
->watchers_offset
) - (char *)m
;
341 if (left
< sizeof(struct ebt_entry_match
) ||
342 left
- sizeof(struct ebt_entry_match
) < m
->match_size
)
344 match
= find_match_lock(m
->u
.name
, &ret
, &ebt_mutex
);
348 if (!try_module_get(match
->me
)) {
349 mutex_unlock(&ebt_mutex
);
352 mutex_unlock(&ebt_mutex
);
354 match
->check(name
, hookmask
, e
, m
->data
, m
->match_size
) != 0) {
355 BUGPRINT("match->check failed\n");
356 module_put(match
->me
);
364 ebt_check_watcher(struct ebt_entry_watcher
*w
, struct ebt_entry
*e
,
365 const char *name
, unsigned int hookmask
, unsigned int *cnt
)
367 struct ebt_watcher
*watcher
;
368 size_t left
= ((char *)e
+ e
->target_offset
) - (char *)w
;
371 if (left
< sizeof(struct ebt_entry_watcher
) ||
372 left
- sizeof(struct ebt_entry_watcher
) < w
->watcher_size
)
374 watcher
= find_watcher_lock(w
->u
.name
, &ret
, &ebt_mutex
);
377 w
->u
.watcher
= watcher
;
378 if (!try_module_get(watcher
->me
)) {
379 mutex_unlock(&ebt_mutex
);
382 mutex_unlock(&ebt_mutex
);
383 if (watcher
->check
&&
384 watcher
->check(name
, hookmask
, e
, w
->data
, w
->watcher_size
) != 0) {
385 BUGPRINT("watcher->check failed\n");
386 module_put(watcher
->me
);
393 static int ebt_verify_pointers(struct ebt_replace
*repl
,
394 struct ebt_table_info
*newinfo
)
396 unsigned int limit
= repl
->entries_size
;
397 unsigned int valid_hooks
= repl
->valid_hooks
;
398 unsigned int offset
= 0;
401 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++)
402 newinfo
->hook_entry
[i
] = NULL
;
404 newinfo
->entries_size
= repl
->entries_size
;
405 newinfo
->nentries
= repl
->nentries
;
407 while (offset
< limit
) {
408 size_t left
= limit
- offset
;
409 struct ebt_entry
*e
= (void *)newinfo
->entries
+ offset
;
411 if (left
< sizeof(unsigned int))
414 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
415 if ((valid_hooks
& (1 << i
)) == 0)
417 if ((char __user
*)repl
->hook_entry
[i
] ==
418 repl
->entries
+ offset
)
422 if (i
!= NF_BR_NUMHOOKS
|| !(e
->bitmask
& EBT_ENTRY_OR_ENTRIES
)) {
423 if (e
->bitmask
!= 0) {
424 /* we make userspace set this right,
425 so there is no misunderstanding */
426 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
427 "in distinguisher\n");
430 if (i
!= NF_BR_NUMHOOKS
)
431 newinfo
->hook_entry
[i
] = (struct ebt_entries
*)e
;
432 if (left
< sizeof(struct ebt_entries
))
434 offset
+= sizeof(struct ebt_entries
);
436 if (left
< sizeof(struct ebt_entry
))
438 if (left
< e
->next_offset
)
440 offset
+= e
->next_offset
;
443 if (offset
!= limit
) {
444 BUGPRINT("entries_size too small\n");
448 /* check if all valid hooks have a chain */
449 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
450 if (!newinfo
->hook_entry
[i
] &&
451 (valid_hooks
& (1 << i
))) {
452 BUGPRINT("Valid hook without chain\n");
460 * this one is very careful, as it is the first function
461 * to parse the userspace data
464 ebt_check_entry_size_and_hooks(struct ebt_entry
*e
,
465 struct ebt_table_info
*newinfo
,
466 unsigned int *n
, unsigned int *cnt
,
467 unsigned int *totalcnt
, unsigned int *udc_cnt
)
471 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
472 if ((void *)e
== (void *)newinfo
->hook_entry
[i
])
475 /* beginning of a new chain
476 if i == NF_BR_NUMHOOKS it must be a user defined chain */
477 if (i
!= NF_BR_NUMHOOKS
|| !e
->bitmask
) {
478 /* this checks if the previous chain has as many entries
481 BUGPRINT("nentries does not equal the nr of entries "
485 if (((struct ebt_entries
*)e
)->policy
!= EBT_DROP
&&
486 ((struct ebt_entries
*)e
)->policy
!= EBT_ACCEPT
) {
487 /* only RETURN from udc */
488 if (i
!= NF_BR_NUMHOOKS
||
489 ((struct ebt_entries
*)e
)->policy
!= EBT_RETURN
) {
490 BUGPRINT("bad policy\n");
494 if (i
== NF_BR_NUMHOOKS
) /* it's a user defined chain */
496 if (((struct ebt_entries
*)e
)->counter_offset
!= *totalcnt
) {
497 BUGPRINT("counter_offset != totalcnt");
500 *n
= ((struct ebt_entries
*)e
)->nentries
;
504 /* a plain old entry, heh */
505 if (sizeof(struct ebt_entry
) > e
->watchers_offset
||
506 e
->watchers_offset
> e
->target_offset
||
507 e
->target_offset
>= e
->next_offset
) {
508 BUGPRINT("entry offsets not in right order\n");
511 /* this is not checked anywhere else */
512 if (e
->next_offset
- e
->target_offset
< sizeof(struct ebt_entry_target
)) {
513 BUGPRINT("target size too small\n");
523 struct ebt_chainstack cs
;
525 unsigned int hookmask
;
529 * we need these positions to check that the jumps to a different part of the
530 * entries is a jump to the beginning of a new chain.
533 ebt_get_udc_positions(struct ebt_entry
*e
, struct ebt_table_info
*newinfo
,
534 unsigned int *n
, struct ebt_cl_stack
*udc
)
538 /* we're only interested in chain starts */
541 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
542 if (newinfo
->hook_entry
[i
] == (struct ebt_entries
*)e
)
545 /* only care about udc */
546 if (i
!= NF_BR_NUMHOOKS
)
549 udc
[*n
].cs
.chaininfo
= (struct ebt_entries
*)e
;
550 /* these initialisations are depended on later in check_chainloops() */
552 udc
[*n
].hookmask
= 0;
559 ebt_cleanup_match(struct ebt_entry_match
*m
, unsigned int *i
)
561 if (i
&& (*i
)-- == 0)
563 if (m
->u
.match
->destroy
)
564 m
->u
.match
->destroy(m
->data
, m
->match_size
);
565 module_put(m
->u
.match
->me
);
571 ebt_cleanup_watcher(struct ebt_entry_watcher
*w
, unsigned int *i
)
573 if (i
&& (*i
)-- == 0)
575 if (w
->u
.watcher
->destroy
)
576 w
->u
.watcher
->destroy(w
->data
, w
->watcher_size
);
577 module_put(w
->u
.watcher
->me
);
583 ebt_cleanup_entry(struct ebt_entry
*e
, unsigned int *cnt
)
585 struct ebt_entry_target
*t
;
590 if (cnt
&& (*cnt
)-- == 0)
592 EBT_WATCHER_ITERATE(e
, ebt_cleanup_watcher
, NULL
);
593 EBT_MATCH_ITERATE(e
, ebt_cleanup_match
, NULL
);
594 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
595 if (t
->u
.target
->destroy
)
596 t
->u
.target
->destroy(t
->data
, t
->target_size
);
597 module_put(t
->u
.target
->me
);
603 ebt_check_entry(struct ebt_entry
*e
, struct ebt_table_info
*newinfo
,
604 const char *name
, unsigned int *cnt
,
605 struct ebt_cl_stack
*cl_s
, unsigned int udc_cnt
)
607 struct ebt_entry_target
*t
;
608 struct ebt_target
*target
;
609 unsigned int i
, j
, hook
= 0, hookmask
= 0;
613 /* don't mess with the struct ebt_entries */
617 if (e
->bitmask
& ~EBT_F_MASK
) {
618 BUGPRINT("Unknown flag for bitmask\n");
621 if (e
->invflags
& ~EBT_INV_MASK
) {
622 BUGPRINT("Unknown flag for inv bitmask\n");
625 if ( (e
->bitmask
& EBT_NOPROTO
) && (e
->bitmask
& EBT_802_3
) ) {
626 BUGPRINT("NOPROTO & 802_3 not allowed\n");
629 /* what hook do we belong to? */
630 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
631 if (!newinfo
->hook_entry
[i
])
633 if ((char *)newinfo
->hook_entry
[i
] < (char *)e
)
638 /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
640 if (i
< NF_BR_NUMHOOKS
)
641 hookmask
= (1 << hook
) | (1 << NF_BR_NUMHOOKS
);
643 for (i
= 0; i
< udc_cnt
; i
++)
644 if ((char *)(cl_s
[i
].cs
.chaininfo
) > (char *)e
)
647 hookmask
= (1 << hook
) | (1 << NF_BR_NUMHOOKS
);
649 hookmask
= cl_s
[i
- 1].hookmask
;
652 ret
= EBT_MATCH_ITERATE(e
, ebt_check_match
, e
, name
, hookmask
, &i
);
654 goto cleanup_matches
;
656 ret
= EBT_WATCHER_ITERATE(e
, ebt_check_watcher
, e
, name
, hookmask
, &j
);
658 goto cleanup_watchers
;
659 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
660 gap
= e
->next_offset
- e
->target_offset
;
661 target
= find_target_lock(t
->u
.name
, &ret
, &ebt_mutex
);
663 goto cleanup_watchers
;
664 if (!try_module_get(target
->me
)) {
665 mutex_unlock(&ebt_mutex
);
667 goto cleanup_watchers
;
669 mutex_unlock(&ebt_mutex
);
671 t
->u
.target
= target
;
672 if (t
->u
.target
== &ebt_standard_target
) {
673 if (gap
< sizeof(struct ebt_standard_target
)) {
674 BUGPRINT("Standard target size too big\n");
676 goto cleanup_watchers
;
678 if (((struct ebt_standard_target
*)t
)->verdict
<
679 -NUM_STANDARD_TARGETS
) {
680 BUGPRINT("Invalid standard target\n");
682 goto cleanup_watchers
;
684 } else if (t
->target_size
> gap
- sizeof(struct ebt_entry_target
) ||
685 (t
->u
.target
->check
&&
686 t
->u
.target
->check(name
, hookmask
, e
, t
->data
, t
->target_size
) != 0)){
687 module_put(t
->u
.target
->me
);
689 goto cleanup_watchers
;
694 EBT_WATCHER_ITERATE(e
, ebt_cleanup_watcher
, &j
);
696 EBT_MATCH_ITERATE(e
, ebt_cleanup_match
, &i
);
701 * checks for loops and sets the hook mask for udc
702 * the hook mask for udc tells us from which base chains the udc can be
703 * accessed. This mask is a parameter to the check() functions of the extensions
705 static int check_chainloops(struct ebt_entries
*chain
, struct ebt_cl_stack
*cl_s
,
706 unsigned int udc_cnt
, unsigned int hooknr
, char *base
)
708 int i
, chain_nr
= -1, pos
= 0, nentries
= chain
->nentries
, verdict
;
709 struct ebt_entry
*e
= (struct ebt_entry
*)chain
->data
;
710 struct ebt_entry_target
*t
;
712 while (pos
< nentries
|| chain_nr
!= -1) {
713 /* end of udc, go back one 'recursion' step */
714 if (pos
== nentries
) {
715 /* put back values of the time when this chain was called */
716 e
= cl_s
[chain_nr
].cs
.e
;
717 if (cl_s
[chain_nr
].from
!= -1)
719 cl_s
[cl_s
[chain_nr
].from
].cs
.chaininfo
->nentries
;
721 nentries
= chain
->nentries
;
722 pos
= cl_s
[chain_nr
].cs
.n
;
723 /* make sure we won't see a loop that isn't one */
724 cl_s
[chain_nr
].cs
.n
= 0;
725 chain_nr
= cl_s
[chain_nr
].from
;
729 t
= (struct ebt_entry_target
*)
730 (((char *)e
) + e
->target_offset
);
731 if (strcmp(t
->u
.name
, EBT_STANDARD_TARGET
))
733 if (e
->target_offset
+ sizeof(struct ebt_standard_target
) >
735 BUGPRINT("Standard target size too big\n");
738 verdict
= ((struct ebt_standard_target
*)t
)->verdict
;
739 if (verdict
>= 0) { /* jump to another chain */
740 struct ebt_entries
*hlp2
=
741 (struct ebt_entries
*)(base
+ verdict
);
742 for (i
= 0; i
< udc_cnt
; i
++)
743 if (hlp2
== cl_s
[i
].cs
.chaininfo
)
745 /* bad destination or loop */
747 BUGPRINT("bad destination\n");
754 if (cl_s
[i
].hookmask
& (1 << hooknr
))
756 /* this can't be 0, so the loop test is correct */
757 cl_s
[i
].cs
.n
= pos
+ 1;
759 cl_s
[i
].cs
.e
= ((void *)e
+ e
->next_offset
);
760 e
= (struct ebt_entry
*)(hlp2
->data
);
761 nentries
= hlp2
->nentries
;
762 cl_s
[i
].from
= chain_nr
;
764 /* this udc is accessible from the base chain for hooknr */
765 cl_s
[i
].hookmask
|= (1 << hooknr
);
769 e
= (void *)e
+ e
->next_offset
;
775 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
776 static int translate_table(char *name
, struct ebt_table_info
*newinfo
)
778 unsigned int i
, j
, k
, udc_cnt
;
780 struct ebt_cl_stack
*cl_s
= NULL
; /* used in the checking for chain loops */
783 while (i
< NF_BR_NUMHOOKS
&& !newinfo
->hook_entry
[i
])
785 if (i
== NF_BR_NUMHOOKS
) {
786 BUGPRINT("No valid hooks specified\n");
789 if (newinfo
->hook_entry
[i
] != (struct ebt_entries
*)newinfo
->entries
) {
790 BUGPRINT("Chains don't start at beginning\n");
793 /* make sure chains are ordered after each other in same order
794 as their corresponding hooks */
795 for (j
= i
+ 1; j
< NF_BR_NUMHOOKS
; j
++) {
796 if (!newinfo
->hook_entry
[j
])
798 if (newinfo
->hook_entry
[j
] <= newinfo
->hook_entry
[i
]) {
799 BUGPRINT("Hook order must be followed\n");
805 /* do some early checkings and initialize some things */
806 i
= 0; /* holds the expected nr. of entries for the chain */
807 j
= 0; /* holds the up to now counted entries for the chain */
808 k
= 0; /* holds the total nr. of entries, should equal
809 newinfo->nentries afterwards */
810 udc_cnt
= 0; /* will hold the nr. of user defined chains (udc) */
811 ret
= EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
812 ebt_check_entry_size_and_hooks
, newinfo
,
813 &i
, &j
, &k
, &udc_cnt
);
819 BUGPRINT("nentries does not equal the nr of entries in the "
823 if (k
!= newinfo
->nentries
) {
824 BUGPRINT("Total nentries is wrong\n");
828 /* get the location of the udc, put them in an array
829 while we're at it, allocate the chainstack */
831 /* this will get free'd in do_replace()/ebt_register_table()
832 if an error occurs */
833 newinfo
->chainstack
=
834 vmalloc(nr_cpu_ids
* sizeof(*(newinfo
->chainstack
)));
835 if (!newinfo
->chainstack
)
837 for_each_possible_cpu(i
) {
838 newinfo
->chainstack
[i
] =
839 vmalloc(udc_cnt
* sizeof(*(newinfo
->chainstack
[0])));
840 if (!newinfo
->chainstack
[i
]) {
842 vfree(newinfo
->chainstack
[--i
]);
843 vfree(newinfo
->chainstack
);
844 newinfo
->chainstack
= NULL
;
849 cl_s
= vmalloc(udc_cnt
* sizeof(*cl_s
));
852 i
= 0; /* the i'th udc */
853 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
854 ebt_get_udc_positions
, newinfo
, &i
, cl_s
);
857 BUGPRINT("i != udc_cnt\n");
863 /* Check for loops */
864 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++)
865 if (newinfo
->hook_entry
[i
])
866 if (check_chainloops(newinfo
->hook_entry
[i
],
867 cl_s
, udc_cnt
, i
, newinfo
->entries
)) {
872 /* we now know the following (along with E=mc²):
873 - the nr of entries in each chain is right
874 - the size of the allocated space is right
875 - all valid hooks have a corresponding chain
877 - wrong data can still be on the level of a single entry
878 - could be there are jumps to places that are not the
879 beginning of a chain. This can only occur in chains that
880 are not accessible from any base chains, so we don't care. */
882 /* used to know what we need to clean up if something goes wrong */
884 ret
= EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
885 ebt_check_entry
, newinfo
, name
, &i
, cl_s
, udc_cnt
);
887 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
888 ebt_cleanup_entry
, &i
);
894 /* called under write_lock */
895 static void get_counters(struct ebt_counter
*oldcounters
,
896 struct ebt_counter
*counters
, unsigned int nentries
)
899 struct ebt_counter
*counter_base
;
901 /* counters of cpu 0 */
902 memcpy(counters
, oldcounters
,
903 sizeof(struct ebt_counter
) * nentries
);
905 /* add other counters to those of cpu 0 */
906 for_each_possible_cpu(cpu
) {
909 counter_base
= COUNTER_BASE(oldcounters
, nentries
, cpu
);
910 for (i
= 0; i
< nentries
; i
++) {
911 counters
[i
].pcnt
+= counter_base
[i
].pcnt
;
912 counters
[i
].bcnt
+= counter_base
[i
].bcnt
;
917 /* replace the table */
918 static int do_replace(void __user
*user
, unsigned int len
)
920 int ret
, i
, countersize
;
921 struct ebt_table_info
*newinfo
;
922 struct ebt_replace tmp
;
924 struct ebt_counter
*counterstmp
= NULL
;
925 /* used to be able to unlock earlier */
926 struct ebt_table_info
*table
;
928 if (copy_from_user(&tmp
, user
, sizeof(tmp
)) != 0)
931 if (len
!= sizeof(tmp
) + tmp
.entries_size
) {
932 BUGPRINT("Wrong len argument\n");
936 if (tmp
.entries_size
== 0) {
937 BUGPRINT("Entries_size never zero\n");
941 if (tmp
.nentries
>= ((INT_MAX
- sizeof(struct ebt_table_info
)) / NR_CPUS
-
942 SMP_CACHE_BYTES
) / sizeof(struct ebt_counter
))
944 if (tmp
.num_counters
>= INT_MAX
/ sizeof(struct ebt_counter
))
947 countersize
= COUNTER_OFFSET(tmp
.nentries
) * nr_cpu_ids
;
948 newinfo
= vmalloc(sizeof(*newinfo
) + countersize
);
953 memset(newinfo
->counters
, 0, countersize
);
955 newinfo
->entries
= vmalloc(tmp
.entries_size
);
956 if (!newinfo
->entries
) {
961 newinfo
->entries
, tmp
.entries
, tmp
.entries_size
) != 0) {
962 BUGPRINT("Couldn't copy entries from userspace\n");
967 /* the user wants counters back
968 the check on the size is done later, when we have the lock */
969 if (tmp
.num_counters
) {
970 counterstmp
= vmalloc(tmp
.num_counters
* sizeof(*counterstmp
));
979 /* this can get initialized by translate_table() */
980 newinfo
->chainstack
= NULL
;
981 ret
= ebt_verify_pointers(&tmp
, newinfo
);
983 goto free_counterstmp
;
985 ret
= translate_table(tmp
.name
, newinfo
);
988 goto free_counterstmp
;
990 t
= find_table_lock(tmp
.name
, &ret
, &ebt_mutex
);
996 /* the table doesn't like it */
997 if (t
->check
&& (ret
= t
->check(newinfo
, tmp
.valid_hooks
)))
1000 if (tmp
.num_counters
&& tmp
.num_counters
!= t
->private->nentries
) {
1001 BUGPRINT("Wrong nr. of counters requested\n");
1006 /* we have the mutex lock, so no danger in reading this pointer */
1008 /* make sure the table can only be rmmod'ed if it contains no rules */
1009 if (!table
->nentries
&& newinfo
->nentries
&& !try_module_get(t
->me
)) {
1012 } else if (table
->nentries
&& !newinfo
->nentries
)
1014 /* we need an atomic snapshot of the counters */
1015 write_lock_bh(&t
->lock
);
1016 if (tmp
.num_counters
)
1017 get_counters(t
->private->counters
, counterstmp
,
1018 t
->private->nentries
);
1020 t
->private = newinfo
;
1021 write_unlock_bh(&t
->lock
);
1022 mutex_unlock(&ebt_mutex
);
1023 /* so, a user can change the chains while having messed up her counter
1024 allocation. Only reason why this is done is because this way the lock
1025 is held only once, while this doesn't bring the kernel into a
1027 if (tmp
.num_counters
&&
1028 copy_to_user(tmp
.counters
, counterstmp
,
1029 tmp
.num_counters
* sizeof(struct ebt_counter
))) {
1030 BUGPRINT("Couldn't copy counters to userspace\n");
1036 /* decrease module count and free resources */
1037 EBT_ENTRY_ITERATE(table
->entries
, table
->entries_size
,
1038 ebt_cleanup_entry
, NULL
);
1040 vfree(table
->entries
);
1041 if (table
->chainstack
) {
1042 for_each_possible_cpu(i
)
1043 vfree(table
->chainstack
[i
]);
1044 vfree(table
->chainstack
);
1052 mutex_unlock(&ebt_mutex
);
1054 EBT_ENTRY_ITERATE(newinfo
->entries
, newinfo
->entries_size
,
1055 ebt_cleanup_entry
, NULL
);
1058 /* can be initialized in translate_table() */
1059 if (newinfo
->chainstack
) {
1060 for_each_possible_cpu(i
)
1061 vfree(newinfo
->chainstack
[i
]);
1062 vfree(newinfo
->chainstack
);
1065 vfree(newinfo
->entries
);
1071 int ebt_register_target(struct ebt_target
*target
)
1073 struct ebt_target
*t
;
1076 ret
= mutex_lock_interruptible(&ebt_mutex
);
1079 list_for_each_entry(t
, &ebt_targets
, list
) {
1080 if (strcmp(t
->name
, target
->name
) == 0) {
1081 mutex_unlock(&ebt_mutex
);
1085 list_add(&target
->list
, &ebt_targets
);
1086 mutex_unlock(&ebt_mutex
);
1091 void ebt_unregister_target(struct ebt_target
*target
)
1093 mutex_lock(&ebt_mutex
);
1094 list_del(&target
->list
);
1095 mutex_unlock(&ebt_mutex
);
1098 int ebt_register_match(struct ebt_match
*match
)
1100 struct ebt_match
*m
;
1103 ret
= mutex_lock_interruptible(&ebt_mutex
);
1106 list_for_each_entry(m
, &ebt_matches
, list
) {
1107 if (strcmp(m
->name
, match
->name
) == 0) {
1108 mutex_unlock(&ebt_mutex
);
1112 list_add(&match
->list
, &ebt_matches
);
1113 mutex_unlock(&ebt_mutex
);
1118 void ebt_unregister_match(struct ebt_match
*match
)
1120 mutex_lock(&ebt_mutex
);
1121 list_del(&match
->list
);
1122 mutex_unlock(&ebt_mutex
);
1125 int ebt_register_watcher(struct ebt_watcher
*watcher
)
1127 struct ebt_watcher
*w
;
1130 ret
= mutex_lock_interruptible(&ebt_mutex
);
1133 list_for_each_entry(w
, &ebt_watchers
, list
) {
1134 if (strcmp(w
->name
, watcher
->name
) == 0) {
1135 mutex_unlock(&ebt_mutex
);
1139 list_add(&watcher
->list
, &ebt_watchers
);
1140 mutex_unlock(&ebt_mutex
);
1145 void ebt_unregister_watcher(struct ebt_watcher
*watcher
)
1147 mutex_lock(&ebt_mutex
);
1148 list_del(&watcher
->list
);
1149 mutex_unlock(&ebt_mutex
);
1152 int ebt_register_table(struct ebt_table
*table
)
1154 struct ebt_table_info
*newinfo
;
1155 struct ebt_table
*t
;
1156 struct ebt_replace_kernel
*repl
;
1157 int ret
, i
, countersize
;
1160 if (!table
|| !(repl
= table
->table
) || !repl
->entries
||
1161 repl
->entries_size
== 0 ||
1162 repl
->counters
|| table
->private) {
1163 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1167 countersize
= COUNTER_OFFSET(repl
->nentries
) * nr_cpu_ids
;
1168 newinfo
= vmalloc(sizeof(*newinfo
) + countersize
);
1173 p
= vmalloc(repl
->entries_size
);
1177 memcpy(p
, repl
->entries
, repl
->entries_size
);
1178 newinfo
->entries
= p
;
1180 newinfo
->entries_size
= repl
->entries_size
;
1181 newinfo
->nentries
= repl
->nentries
;
1184 memset(newinfo
->counters
, 0, countersize
);
1186 /* fill in newinfo and parse the entries */
1187 newinfo
->chainstack
= NULL
;
1188 for (i
= 0; i
< NF_BR_NUMHOOKS
; i
++) {
1189 if ((repl
->valid_hooks
& (1 << i
)) == 0)
1190 newinfo
->hook_entry
[i
] = NULL
;
1192 newinfo
->hook_entry
[i
] = p
+
1193 ((char *)repl
->hook_entry
[i
] - repl
->entries
);
1195 ret
= translate_table(repl
->name
, newinfo
);
1197 BUGPRINT("Translate_table failed\n");
1198 goto free_chainstack
;
1201 if (table
->check
&& table
->check(newinfo
, table
->valid_hooks
)) {
1202 BUGPRINT("The table doesn't like its own initial data, lol\n");
1206 table
->private = newinfo
;
1207 rwlock_init(&table
->lock
);
1208 ret
= mutex_lock_interruptible(&ebt_mutex
);
1210 goto free_chainstack
;
1212 list_for_each_entry(t
, &ebt_tables
, list
) {
1213 if (strcmp(t
->name
, table
->name
) == 0) {
1215 BUGPRINT("Table name already exists\n");
1220 /* Hold a reference count if the chains aren't empty */
1221 if (newinfo
->nentries
&& !try_module_get(table
->me
)) {
1225 list_add(&table
->list
, &ebt_tables
);
1226 mutex_unlock(&ebt_mutex
);
1229 mutex_unlock(&ebt_mutex
);
1231 if (newinfo
->chainstack
) {
1232 for_each_possible_cpu(i
)
1233 vfree(newinfo
->chainstack
[i
]);
1234 vfree(newinfo
->chainstack
);
1236 vfree(newinfo
->entries
);
1242 void ebt_unregister_table(struct ebt_table
*table
)
1247 BUGPRINT("Request to unregister NULL table!!!\n");
1250 mutex_lock(&ebt_mutex
);
1251 list_del(&table
->list
);
1252 mutex_unlock(&ebt_mutex
);
1253 vfree(table
->private->entries
);
1254 if (table
->private->chainstack
) {
1255 for_each_possible_cpu(i
)
1256 vfree(table
->private->chainstack
[i
]);
1257 vfree(table
->private->chainstack
);
1259 vfree(table
->private);
1262 /* userspace just supplied us with counters */
1263 static int update_counters(void __user
*user
, unsigned int len
)
1266 struct ebt_counter
*tmp
;
1267 struct ebt_replace hlp
;
1268 struct ebt_table
*t
;
1270 if (copy_from_user(&hlp
, user
, sizeof(hlp
)))
1273 if (len
!= sizeof(hlp
) + hlp
.num_counters
* sizeof(struct ebt_counter
))
1275 if (hlp
.num_counters
== 0)
1278 if (!(tmp
= vmalloc(hlp
.num_counters
* sizeof(*tmp
)))) {
1279 MEMPRINT("Update_counters && nomemory\n");
1283 t
= find_table_lock(hlp
.name
, &ret
, &ebt_mutex
);
1287 if (hlp
.num_counters
!= t
->private->nentries
) {
1288 BUGPRINT("Wrong nr of counters\n");
1293 if ( copy_from_user(tmp
, hlp
.counters
,
1294 hlp
.num_counters
* sizeof(struct ebt_counter
)) ) {
1295 BUGPRINT("Updata_counters && !cfu\n");
1300 /* we want an atomic add of the counters */
1301 write_lock_bh(&t
->lock
);
1303 /* we add to the counters of the first cpu */
1304 for (i
= 0; i
< hlp
.num_counters
; i
++) {
1305 t
->private->counters
[i
].pcnt
+= tmp
[i
].pcnt
;
1306 t
->private->counters
[i
].bcnt
+= tmp
[i
].bcnt
;
1309 write_unlock_bh(&t
->lock
);
1312 mutex_unlock(&ebt_mutex
);
1318 static inline int ebt_make_matchname(struct ebt_entry_match
*m
,
1319 char *base
, char __user
*ubase
)
1321 char __user
*hlp
= ubase
+ ((char *)m
- base
);
1322 if (copy_to_user(hlp
, m
->u
.match
->name
, EBT_FUNCTION_MAXNAMELEN
))
1327 static inline int ebt_make_watchername(struct ebt_entry_watcher
*w
,
1328 char *base
, char __user
*ubase
)
1330 char __user
*hlp
= ubase
+ ((char *)w
- base
);
1331 if (copy_to_user(hlp
, w
->u
.watcher
->name
, EBT_FUNCTION_MAXNAMELEN
))
1336 static inline int ebt_make_names(struct ebt_entry
*e
, char *base
, char __user
*ubase
)
1340 struct ebt_entry_target
*t
;
1342 if (e
->bitmask
== 0)
1345 hlp
= ubase
+ (((char *)e
+ e
->target_offset
) - base
);
1346 t
= (struct ebt_entry_target
*)(((char *)e
) + e
->target_offset
);
1348 ret
= EBT_MATCH_ITERATE(e
, ebt_make_matchname
, base
, ubase
);
1351 ret
= EBT_WATCHER_ITERATE(e
, ebt_make_watchername
, base
, ubase
);
1354 if (copy_to_user(hlp
, t
->u
.target
->name
, EBT_FUNCTION_MAXNAMELEN
))
1359 /* called with ebt_mutex locked */
1360 static int copy_everything_to_user(struct ebt_table
*t
, void __user
*user
,
1363 struct ebt_replace tmp
;
1364 struct ebt_counter
*counterstmp
, *oldcounters
;
1365 unsigned int entries_size
, nentries
;
1368 if (cmd
== EBT_SO_GET_ENTRIES
) {
1369 entries_size
= t
->private->entries_size
;
1370 nentries
= t
->private->nentries
;
1371 entries
= t
->private->entries
;
1372 oldcounters
= t
->private->counters
;
1374 entries_size
= t
->table
->entries_size
;
1375 nentries
= t
->table
->nentries
;
1376 entries
= t
->table
->entries
;
1377 oldcounters
= t
->table
->counters
;
1380 if (copy_from_user(&tmp
, user
, sizeof(tmp
))) {
1381 BUGPRINT("Cfu didn't work\n");
1385 if (*len
!= sizeof(struct ebt_replace
) + entries_size
+
1386 (tmp
.num_counters
? nentries
* sizeof(struct ebt_counter
): 0)) {
1387 BUGPRINT("Wrong size\n");
1391 if (tmp
.nentries
!= nentries
) {
1392 BUGPRINT("Nentries wrong\n");
1396 if (tmp
.entries_size
!= entries_size
) {
1397 BUGPRINT("Wrong size\n");
1401 /* userspace might not need the counters */
1402 if (tmp
.num_counters
) {
1403 if (tmp
.num_counters
!= nentries
) {
1404 BUGPRINT("Num_counters wrong\n");
1407 counterstmp
= vmalloc(nentries
* sizeof(*counterstmp
));
1409 MEMPRINT("Couldn't copy counters, out of memory\n");
1412 write_lock_bh(&t
->lock
);
1413 get_counters(oldcounters
, counterstmp
, nentries
);
1414 write_unlock_bh(&t
->lock
);
1416 if (copy_to_user(tmp
.counters
, counterstmp
,
1417 nentries
* sizeof(struct ebt_counter
))) {
1418 BUGPRINT("Couldn't copy counters to userspace\n");
1425 if (copy_to_user(tmp
.entries
, entries
, entries_size
)) {
1426 BUGPRINT("Couldn't copy entries to userspace\n");
1429 /* set the match/watcher/target names right */
1430 return EBT_ENTRY_ITERATE(entries
, entries_size
,
1431 ebt_make_names
, entries
, tmp
.entries
);
1434 static int do_ebt_set_ctl(struct sock
*sk
,
1435 int cmd
, void __user
*user
, unsigned int len
)
1439 if (!capable(CAP_NET_ADMIN
))
1443 case EBT_SO_SET_ENTRIES
:
1444 ret
= do_replace(user
, len
);
1446 case EBT_SO_SET_COUNTERS
:
1447 ret
= update_counters(user
, len
);
1455 static int do_ebt_get_ctl(struct sock
*sk
, int cmd
, void __user
*user
, int *len
)
1458 struct ebt_replace tmp
;
1459 struct ebt_table
*t
;
1461 if (!capable(CAP_NET_ADMIN
))
1464 if (copy_from_user(&tmp
, user
, sizeof(tmp
)))
1467 t
= find_table_lock(tmp
.name
, &ret
, &ebt_mutex
);
1472 case EBT_SO_GET_INFO
:
1473 case EBT_SO_GET_INIT_INFO
:
1474 if (*len
!= sizeof(struct ebt_replace
)){
1476 mutex_unlock(&ebt_mutex
);
1479 if (cmd
== EBT_SO_GET_INFO
) {
1480 tmp
.nentries
= t
->private->nentries
;
1481 tmp
.entries_size
= t
->private->entries_size
;
1482 tmp
.valid_hooks
= t
->valid_hooks
;
1484 tmp
.nentries
= t
->table
->nentries
;
1485 tmp
.entries_size
= t
->table
->entries_size
;
1486 tmp
.valid_hooks
= t
->table
->valid_hooks
;
1488 mutex_unlock(&ebt_mutex
);
1489 if (copy_to_user(user
, &tmp
, *len
) != 0){
1490 BUGPRINT("c2u Didn't work\n");
1497 case EBT_SO_GET_ENTRIES
:
1498 case EBT_SO_GET_INIT_ENTRIES
:
1499 ret
= copy_everything_to_user(t
, user
, len
, cmd
);
1500 mutex_unlock(&ebt_mutex
);
1504 mutex_unlock(&ebt_mutex
);
1511 static struct nf_sockopt_ops ebt_sockopts
=
1514 .set_optmin
= EBT_BASE_CTL
,
1515 .set_optmax
= EBT_SO_SET_MAX
+ 1,
1516 .set
= do_ebt_set_ctl
,
1517 .get_optmin
= EBT_BASE_CTL
,
1518 .get_optmax
= EBT_SO_GET_MAX
+ 1,
1519 .get
= do_ebt_get_ctl
,
1520 .owner
= THIS_MODULE
,
1523 static int __init
ebtables_init(void)
1527 mutex_lock(&ebt_mutex
);
1528 list_add(&ebt_standard_target
.list
, &ebt_targets
);
1529 mutex_unlock(&ebt_mutex
);
1530 if ((ret
= nf_register_sockopt(&ebt_sockopts
)) < 0)
1533 printk(KERN_INFO
"Ebtables v2.0 registered\n");
1537 static void __exit
ebtables_fini(void)
1539 nf_unregister_sockopt(&ebt_sockopts
);
1540 printk(KERN_INFO
"Ebtables v2.0 unregistered\n");
1543 EXPORT_SYMBOL(ebt_register_table
);
1544 EXPORT_SYMBOL(ebt_unregister_table
);
1545 EXPORT_SYMBOL(ebt_register_match
);
1546 EXPORT_SYMBOL(ebt_unregister_match
);
1547 EXPORT_SYMBOL(ebt_register_watcher
);
1548 EXPORT_SYMBOL(ebt_unregister_watcher
);
1549 EXPORT_SYMBOL(ebt_register_target
);
1550 EXPORT_SYMBOL(ebt_unregister_target
);
1551 EXPORT_SYMBOL(ebt_do_table
);
1552 module_init(ebtables_init
);
1553 module_exit(ebtables_fini
);
1554 MODULE_LICENSE("GPL");