--- zzzz-none-000/linux-4.4.271/net/ipv4/netfilter/ip_tables.c 2021-06-03 06:22:09.000000000 +0000 +++ maple-fsgw-759/linux-4.4.271/net/ipv4/netfilter/ip_tables.c 2023-12-20 10:37:40.000000000 +0000 @@ -82,9 +82,14 @@ #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg))) - if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr, + if (ipinfo->flags & IPT_F_NO_DEF_MATCH) + return true; + + if (FWINV(ipinfo->smsk.s_addr && + (ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr, IPT_INV_SRCIP) || - FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr, + FWINV(ipinfo->dmsk.s_addr && + (ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr, IPT_INV_DSTIP)) { dprintf("Source or dest mismatch.\n"); @@ -135,6 +140,29 @@ return true; } +static void +ip_checkdefault(struct ipt_ip *ip) +{ + static const char iface_mask[IFNAMSIZ] = {}; + + if (ip->invflags || ip->flags & IPT_F_FRAG) + return; + + if (memcmp(ip->iniface_mask, iface_mask, IFNAMSIZ) != 0) + return; + + if (memcmp(ip->outiface_mask, iface_mask, IFNAMSIZ) != 0) + return; + + if (ip->smsk.s_addr || ip->dmsk.s_addr) + return; + + if (ip->proto) + return; + + ip->flags |= IPT_F_NO_DEF_MATCH; +} + static bool ip_checkentry(const struct ipt_ip *ip) { @@ -282,6 +310,33 @@ return (void *)entry + entry->next_offset; } +static bool +ipt_handle_default_rule(struct ipt_entry *e, unsigned int *verdict) +{ + struct xt_entry_target *t; + struct xt_standard_target *st; + + if (e->target_offset != sizeof(struct ipt_entry)) + return false; + + if (!(e->ip.flags & IPT_F_NO_DEF_MATCH)) + return false; + + t = ipt_get_target(e); + if (t->u.kernel.target->target) + return false; + + st = (struct xt_standard_target *) t; + if (st->verdict == XT_RETURN) + return false; + + if (st->verdict >= 0) + return false; + + *verdict = (unsigned)(-st->verdict) - 1; + return true; +} + /* Returns one of the generic firewall policies, like NF_ACCEPT. */ unsigned int ipt_do_table(struct sk_buff *skb, @@ -302,28 +357,11 @@ unsigned int addend; /* Initialization */ - stackidx = 0; - ip = ip_hdr(skb); - indev = state->in ? state->in->name : nulldevname; - outdev = state->out ? state->out->name : nulldevname; - /* We handle fragments by dealing with the first fragment as - * if it was a normal packet. All other fragments are treated - * normally, except that they will NEVER match rules that ask - * things we don't know, ie. tcp syn flag or ports). If the - * rule is also a fragment-specific rule, non-fragments won't - * match it. */ - acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET; - acpar.thoff = ip_hdrlen(skb); - acpar.hotdrop = false; - acpar.net = state->net; - acpar.in = state->in; - acpar.out = state->out; - acpar.family = NFPROTO_IPV4; - acpar.hooknum = hook; - IP_NF_ASSERT(table->valid_hooks & (1 << hook)); + local_bh_disable(); - addend = xt_write_recseq_begin(); + rcu_read_lock(); + private = table->private; cpu = smp_processor_id(); /* @@ -332,6 +370,25 @@ */ smp_read_barrier_depends(); table_base = private->entries; + + e = get_entry(table_base, private->hook_entry[hook]); + if (ipt_handle_default_rule(e, &verdict)) { + struct xt_counters *counter; + + counter = xt_get_this_cpu_counter(&e->counters); + ADD_COUNTER(*counter, skb->len, 1); + rcu_read_unlock(); + local_bh_enable(); + + return verdict; + } + + stackidx = 0; + ip = ip_hdr(skb); + indev = state->in ? state->in->name : nulldevname; + outdev = state->out ? state->out->name : nulldevname; + + addend = xt_write_recseq_begin(); jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; /* Switch to alternate jumpstack if we're being invoked via TEE. @@ -344,7 +401,20 @@ if (static_key_false(&xt_tee_enabled)) jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated); - e = get_entry(table_base, private->hook_entry[hook]); + /* We handle fragments by dealing with the first fragment as + * if it was a normal packet. All other fragments are treated + * normally, except that they will NEVER match rules that ask + * things we don't know, ie. tcp syn flag or ports). If the + * rule is also a fragment-specific rule, non-fragments won't + * match it. */ + acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET; + acpar.thoff = ip_hdrlen(skb); + acpar.hotdrop = false; + acpar.net = state->net; + acpar.in = state->in; + acpar.out = state->out; + acpar.family = NFPROTO_IPV4; + acpar.hooknum = hook; pr_debug("Entering %s(hook %u), UF %p\n", table->name, hook, @@ -436,6 +506,8 @@ pr_debug("Exiting %s; sp at %u\n", __func__, stackidx); xt_write_recseq_end(addend); + rcu_read_unlock(); + local_bh_enable(); #ifdef DEBUG_ALLOW_ALL @@ -582,6 +654,28 @@ } static int +check_entry(struct ipt_entry *e) +{ + const struct xt_entry_target *t; + + if (!ip_checkentry(&e->ip)) + return -EINVAL; + + ip_checkdefault(&e->ip); + + if (e->target_offset + sizeof(struct xt_entry_target) > + e->next_offset) + return -EINVAL; + + t = ipt_get_target_c(e); + + if (e->target_offset + t->u.target_size > e->next_offset) + return -EINVAL; + + return 0; +} + +static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par) { const struct ipt_ip *ip = par->entryinfo; @@ -659,6 +753,10 @@ struct xt_mtchk_param mtpar; struct xt_entry_match *ematch; + ret = check_entry(e); + if (ret) + return ret; + if (!xt_percpu_counter_alloc(alloc_state, &e->counters)) return -ENOMEM; @@ -958,6 +1056,7 @@ const struct xt_table_info *private = table->private; int ret = 0; const void *loc_cpu_entry; + u8 flags; counters = alloc_counters(table); if (IS_ERR(counters)) @@ -985,6 +1084,14 @@ goto free_counters; } + flags = e->ip.flags & IPT_F_MASK; + if (copy_to_user(userptr + off + + offsetof(struct ipt_entry, ip.flags), + &flags, sizeof(flags)) != 0) { + ret = -EFAULT; + goto free_counters; + } + for (i = sizeof(struct ipt_entry); i < e->target_offset; i += m->u.match_size) { @@ -1247,6 +1354,7 @@ xt_entry_foreach(iter, oldinfo->entries, oldinfo->size) cleanup_entry(iter, net); + synchronize_rcu(); xt_free_table_info(oldinfo); if (copy_to_user(counters_ptr, counters, sizeof(struct xt_counters) * num_counters) != 0) { @@ -1479,8 +1587,10 @@ return -EINVAL; } - if (!ip_checkentry(&e->ip)) - return -EINVAL; + /* For purposes of check_entry casting the compat entry is fine */ + ret = check_entry((struct ipt_entry *)e); + if (ret) + return ret; ret = xt_compat_check_entry_offsets(e, e->elems, e->target_offset, e->next_offset);