ebtables-v2.0.002_vs_2.4.20.patch

   1 ebtables-v2.0.002 vs 2.4.20-pre7 - 17 October 2002
   2
   3 --- linux-2.4.20-pre7/net/bridge/br_private.h   Mon Feb 25 20:38:14 2002
   4 +++ linux-2.4.20-pre7-bcnt/net/bridge/br_private.h      Thu Oct 17 22:40:38 2002
   5 @@ -166,7 +166,7 @@ extern void br_get_port_ifindices(struct
   6                            int *ifindices);
   7
   8  /* br_input.c */
   9 -extern void br_handle_frame(struct sk_buff *skb);
  10 +extern int br_handle_frame(struct sk_buff *skb);
  11
  12  /* br_ioctl.c */
  13  extern void br_call_ioctl_atomic(void (*fn)(void));
  14 --- linux-2.4.20-pre7/include/linux/if_bridge.h Thu Nov 22 20:47:12 2001
  15 +++ linux-2.4.20-pre7-bcnt/include/linux/if_bridge.h    Thu Oct 17 22:28:23 2002
  16 @@ -102,7 +102,8 @@ struct net_bridge;
  17  struct net_bridge_port;
  18
  19  extern int (*br_ioctl_hook)(unsigned long arg);
  20 -extern void (*br_handle_frame_hook)(struct sk_buff *skb);
  21 +extern int (*br_handle_frame_hook)(struct sk_buff *skb);
  22 +extern int (*br_should_route_hook)(struct sk_buff **pskb);
  23
  24  #endif
  25
  26 --- linux-2.4.20-pre7/net/core/dev.c    Thu Oct 17 23:42:53 2002
  27 +++ linux-2.4.20-pre7-bcnt/net/core/dev.c       Thu Oct 17 20:31:28 2002
  28 @@ -1392,7 +1392,7 @@ void net_call_rx_atomic(void (*fn)(void)
  29  }
  30
  31  #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
  32 -void (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
  33 +int (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
  34  #endif
  35
  36  static __inline__ int handle_bridge(struct sk_buff *skb,
  37 @@ -1409,7 +1409,6 @@ static __inline__ int handle_bridge(stru
  38                 }
  39         }
  40
  41 -       br_handle_frame_hook(skb);
  42         return ret;
  43  }
  44
  45 @@ -1469,7 +1468,12 @@ int netif_receive_skb(struct sk_buff *sk
  46  #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
  47         if (skb->dev->br_port != NULL &&
  48             br_handle_frame_hook != NULL) {
  49 -               return handle_bridge(skb, pt_prev);
  50 +               int ret;
  51 +
  52 +               ret = handle_bridge(skb, pt_prev);
  53 +               if (br_handle_frame_hook(skb) == 0)
  54 +                       return ret;
  55 +               pt_prev = NULL;
  56         }
  57  #endif
  58
  59 --- linux-2.4.20-pre7/net/bridge/br_input.c     Sat Aug  3 02:39:46 2002
  60 +++ linux-2.4.20-pre7-bcnt/net/bridge/br_input.c        Thu Oct 17 20:31:28 2002
  61 @@ -24,6 +24,9 @@ unsigned char bridge_ula[6] = { 0x01, 0x
  62
  63  static int br_pass_frame_up_finish(struct sk_buff *skb)
  64  {
  65 +#ifdef CONFIG_NETFILTER_DEBUG
  66 +       skb->nf_debug = 0;
  67 +#endif
  68         netif_rx(skb);
  69
  70         return 0;
  71 @@ -112,7 +115,7 @@ err_nolock:
  72         return 0;
  73  }
  74
  75 -void br_handle_frame(struct sk_buff *skb)
  76 +int br_handle_frame(struct sk_buff *skb)
  77  {
  78         struct net_bridge *br;
  79         unsigned char *dest;
  80 @@ -146,25 +149,31 @@ void br_handle_frame(struct sk_buff *skb
  81                 goto handle_special_frame;
  82
  83         if (p->state == BR_STATE_FORWARDING) {
  84 +               if (br_should_route_hook && br_should_route_hook(&skb)) {
  85 +                       read_unlock(&br->lock);
  86 +                       return -1;
  87 +               }
  88 +
  89                 NF_HOOK(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
  90                         br_handle_frame_finish);
  91                 read_unlock(&br->lock);
  92 -               return;
  93 +               return 0;
  94         }
  95
  96  err:
  97         read_unlock(&br->lock);
  98  err_nolock:
  99         kfree_skb(skb);
 100 -       return;
 101 +       return 0;
 102
 103  handle_special_frame:
 104         if (!dest[5]) {
 105                 br_stp_handle_bpdu(skb);
 106                 read_unlock(&br->lock);
 107 -               return;
 108 +               return 0;
 109         }
 110
 111         read_unlock(&br->lock);
 112         kfree_skb(skb);
 113 +       return 0;
 114  }
 115 --- linux-2.4.20-pre7/net/bridge/br_forward.c   Sat Aug  3 02:39:46 2002
 116 +++ linux-2.4.20-pre7-bcnt/net/bridge/br_forward.c      Thu Oct 17 20:31:28 2002
 117 @@ -49,6 +49,9 @@ static int __br_forward_finish(struct sk
 118  static void __br_deliver(struct net_bridge_port *to, struct sk_buff *skb)
 119  {
 120         skb->dev = to->dev;
 121 +#ifdef CONFIG_NETFILTER_DEBUG
 122 +       skb->nf_debug = 0;
 123 +#endif
 124         NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
 125                         __br_forward_finish);
 126  }
 127 --- linux-2.4.20-pre7/net/bridge/br.c   Mon Feb 25 20:38:14 2002
 128 +++ linux-2.4.20-pre7-bcnt/net/bridge/br.c      Thu Oct 17 20:31:28 2002
 129 @@ -28,6 +28,8 @@
 130  #include "../atm/lec.h"
 131  #endif
 132
 133 +int (*br_should_route_hook) (struct sk_buff **pskb) = NULL;
 134 +
 135  void br_dec_use_count()
 136  {
 137         MOD_DEC_USE_COUNT;
 138 @@ -74,7 +76,7 @@ static void __exit br_deinit(void)
 139  #endif
 140  }
 141
 142 -EXPORT_NO_SYMBOLS;
 143 +EXPORT_SYMBOL(br_should_route_hook);
 144
 145  module_init(br_init)
 146  module_exit(br_deinit)
 147 --- linux-2.4.20-pre7/net/bridge/Makefile       Fri Dec 29 23:07:24 2000
 148 +++ linux-2.4.20-pre7-bcnt/net/bridge/Makefile  Thu Oct 17 20:31:28 2002
 149 @@ -7,6 +7,8 @@
 150  #
 151  # Note 2! The CFLAGS definition is now in the main makefile...
 152
 153 +export-objs := br.o
 154 +
 155  O_TARGET       := bridge.o
 156  obj-y          := br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
 157                         br_ioctl.o br_notify.o br_stp.o br_stp_bpdu.o \
 158 --- linux-2.4.20-pre7/include/linux/netfilter_bridge.h  Tue Jun 12 04:15:27 2001
 159 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge.h     Thu Oct 17 22:40:51 2002
 160 @@ -18,7 +18,18 @@
 161  #define NF_BR_LOCAL_OUT                3
 162  /* Packets about to hit the wire. */
 163  #define NF_BR_POST_ROUTING     4
 164 -#define NF_BR_NUMHOOKS         5
 165 +/* Not really a hook, but used for the ebtables broute table */
 166 +#define NF_BR_BROUTING         5
 167 +#define NF_BR_NUMHOOKS         6
 168
 169 +enum nf_br_hook_priorities {
 170 +       NF_BR_PRI_FIRST = INT_MIN,
 171 +       NF_BR_PRI_FILTER_BRIDGED = -200,
 172 +       NF_BR_PRI_FILTER_OTHER = 200,
 173 +       NF_BR_PRI_NAT_DST_BRIDGED = -300,
 174 +       NF_BR_PRI_NAT_DST_OTHER = 100,
 175 +       NF_BR_PRI_NAT_SRC = 300,
 176 +       NF_BR_PRI_LAST = INT_MAX,
 177 +};
 178
 179  #endif
 180 --- linux-2.4.20-pre7/net/Makefile      Sat Aug  3 02:39:46 2002
 181 +++ linux-2.4.20-pre7-bcnt/net/Makefile Thu Oct 17 20:31:29 2002
 182 @@ -7,7 +7,8 @@
 183
 184  O_TARGET :=    network.o
 185
 186 -mod-subdirs := ipv4/netfilter ipv6/netfilter ipx irda bluetooth atm netlink sched core
 187 +mod-subdirs := ipv4/netfilter ipv6/netfilter bridge/netfilter ipx irda \
 188 +       bluetooth atm netlink sched core
 189  export-objs := netsyms.o
 190
 191  subdir-y :=    core ethernet
 192 @@ -23,6 +24,12 @@ subdir-$(CONFIG_IPV6)                += ipv6
 193  ifneq ($(CONFIG_IPV6),n)
 194  ifneq ($(CONFIG_IPV6),)
 195  subdir-$(CONFIG_NETFILTER)     += ipv6/netfilter
 196 +endif
 197 +endif
 198 +
 199 +ifneq ($(CONFIG_BRIDGE),n)
 200 +ifneq ($(CONFIG_BRIDGE),)
 201 +subdir-$(CONFIG_BRIDGE)                += bridge/netfilter
 202  endif
 203  endif
 204
 205 --- linux-2.4.20-pre7/net/Config.in     Sat Aug  3 02:39:46 2002
 206 +++ linux-2.4.20-pre7-bcnt/net/Config.in        Thu Oct 17 20:31:29 2002
 207 @@ -65,6 +65,9 @@ if [ "$CONFIG_DECNET" != "n" ]; then
 208     source net/decnet/Config.in
 209  fi
 210  dep_tristate '802.1d Ethernet Bridging' CONFIG_BRIDGE $CONFIG_INET
 211 +if [ "$CONFIG_BRIDGE" != "n" -a "$CONFIG_NETFILTER" != "n" ]; then
 212 +   source net/bridge/netfilter/Config.in
 213 +fi
 214  if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 215     tristate 'CCITT X.25 Packet Layer (EXPERIMENTAL)' CONFIG_X25
 216     tristate 'LAPB Data Link Driver (EXPERIMENTAL)' CONFIG_LAPB
 217 --- /dev/null   Thu Aug 24 11:00:32 2000
 218 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/Makefile        Thu Oct 17 20:31:29 2002
 219 @@ -0,0 +1,27 @@
 220 +#
 221 +# Makefile for the netfilter modules on top of bridging.
 222 +#
 223 +# Note! Dependencies are done automagically by 'make dep', which also
 224 +# removes any old dependencies. DON'T put your own dependencies here
 225 +# unless it's something special (ie not a .c file).
 226 +#
 227 +# Note 2! The CFLAGS definition is now in the main makefile...
 228 +
 229 +O_TARGET       := netfilter.o
 230 +
 231 +export-objs := ebtables.o
 232 +
 233 +obj-$(CONFIG_BRIDGE_NF_EBTABLES) += ebtables.o
 234 +obj-$(CONFIG_BRIDGE_EBT_T_FILTER) += ebtable_filter.o
 235 +obj-$(CONFIG_BRIDGE_EBT_T_NAT) += ebtable_nat.o
 236 +obj-$(CONFIG_BRIDGE_EBT_BROUTE) += ebtable_broute.o
 237 +obj-$(CONFIG_BRIDGE_EBT_IPF) += ebt_ip.o
 238 +obj-$(CONFIG_BRIDGE_EBT_ARPF) += ebt_arp.o
 239 +obj-$(CONFIG_BRIDGE_EBT_VLANF) += ebt_vlan.o
 240 +obj-$(CONFIG_BRIDGE_EBT_MARKF) += ebt_mark_m.o
 241 +obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
 242 +obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
 243 +obj-$(CONFIG_BRIDGE_EBT_DNAT) += ebt_dnat.o
 244 +obj-$(CONFIG_BRIDGE_EBT_REDIRECT) += ebt_redirect.o
 245 +obj-$(CONFIG_BRIDGE_EBT_MARK_T) += ebt_mark.o
 246 +include $(TOPDIR)/Rules.make
 247 --- /dev/null   Thu Aug 24 11:00:32 2000
 248 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/Config.in       Thu Oct 17 20:31:29 2002
 249 @@ -0,0 +1,16 @@
 250 +#
 251 +# Bridge netfilter configuration
 252 +#
 253 +dep_tristate '  Bridge: ebtables' CONFIG_BRIDGE_NF_EBTABLES $CONFIG_BRIDGE
 254 +dep_tristate '    ebt: filter table support' CONFIG_BRIDGE_EBT_T_FILTER $CONFIG_BRIDGE_NF_EBTABLES
 255 +dep_tristate '    ebt: nat table support' CONFIG_BRIDGE_EBT_T_NAT $CONFIG_BRIDGE_NF_EBTABLES
 256 +dep_tristate '    ebt: broute table support' CONFIG_BRIDGE_EBT_BROUTE $CONFIG_BRIDGE_NF_EBTABLES
 257 +dep_tristate '    ebt: log support' CONFIG_BRIDGE_EBT_LOG $CONFIG_BRIDGE_NF_EBTABLES
 258 +dep_tristate '    ebt: IP filter support' CONFIG_BRIDGE_EBT_IPF $CONFIG_BRIDGE_NF_EBTABLES
 259 +dep_tristate '    ebt: ARP filter support' CONFIG_BRIDGE_EBT_ARPF $CONFIG_BRIDGE_NF_EBTABLES
 260 +dep_tristate '    ebt: 802.1Q VLAN filter support (EXPERIMENTAL)' CONFIG_BRIDGE_EBT_VLANF $CONFIG_BRIDGE_NF_EBTABLES
 261 +dep_tristate '    ebt: mark filter support' CONFIG_BRIDGE_EBT_MARKF $CONFIG_BRIDGE_NF_EBTABLES
 262 +dep_tristate '    ebt: snat target support' CONFIG_BRIDGE_EBT_SNAT $CONFIG_BRIDGE_NF_EBTABLES
 263 +dep_tristate '    ebt: dnat target support' CONFIG_BRIDGE_EBT_DNAT $CONFIG_BRIDGE_NF_EBTABLES
 264 +dep_tristate '    ebt: redirect target support' CONFIG_BRIDGE_EBT_REDIRECT $CONFIG_BRIDGE_NF_EBTABLES
 265 +dep_tristate '    ebt: mark target support' CONFIG_BRIDGE_EBT_MARK_T $CONFIG_BRIDGE_NF_EBTABLES
 266 --- /dev/null   Thu Aug 24 11:00:32 2000
 267 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebtable_filter.c        Thu Oct 17 20:31:29 2002
 268 @@ -0,0 +1,90 @@
 269 +/*
 270 + *  ebtable_filter
 271 + *
 272 + *     Authors:
 273 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 274 + *
 275 + *  April, 2002
 276 + *
 277 + */
 278 +
 279 +#include <linux/netfilter_bridge/ebtables.h>
 280 +#include <linux/module.h>
 281 +
 282 +#define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \
 283 +   (1 << NF_BR_LOCAL_OUT))
 284 +
 285 +static struct ebt_entries initial_chains[] =
 286 +{
 287 +  {0, "INPUT", 0, EBT_ACCEPT, 0},
 288 +  {0, "FORWARD", 0, EBT_ACCEPT, 0},
 289 +  {0, "OUTPUT", 0, EBT_ACCEPT, 0}
 290 +};
 291 +
 292 +static struct ebt_replace initial_table =
 293 +{
 294 +  "filter", FILTER_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
 295 +  { [NF_BR_LOCAL_IN]&initial_chains[0], [NF_BR_FORWARD]&initial_chains[1],
 296 +    [NF_BR_LOCAL_OUT]&initial_chains[2] }, 0, NULL, (char *)initial_chains
 297 +};
 298 +
 299 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 300 +{
 301 +       if (valid_hooks & ~FILTER_VALID_HOOKS)
 302 +               return -EINVAL;
 303 +       return 0;
 304 +}
 305 +
 306 +static struct ebt_table frame_filter =
 307 +{
 308 +  {NULL, NULL}, "filter", &initial_table, FILTER_VALID_HOOKS,
 309 +  RW_LOCK_UNLOCKED, check, NULL
 310 +};
 311 +
 312 +static unsigned int
 313 +ebt_hook (unsigned int hook, struct sk_buff **pskb, const struct net_device *in,
 314 +   const struct net_device *out, int (*okfn)(struct sk_buff *))
 315 +{
 316 +       return ebt_do_table(hook, pskb, in, out, &frame_filter);
 317 +}
 318 +
 319 +static struct nf_hook_ops ebt_ops_filter[] = {
 320 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_IN,
 321 +          NF_BR_PRI_FILTER_BRIDGED},
 322 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_FORWARD,
 323 +          NF_BR_PRI_FILTER_BRIDGED},
 324 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_OUT,
 325 +          NF_BR_PRI_FILTER_OTHER}
 326 +};
 327 +
 328 +static int __init init(void)
 329 +{
 330 +       int i, j, ret;
 331 +
 332 +       ret = ebt_register_table(&frame_filter);
 333 +       if (ret < 0)
 334 +               return ret;
 335 +       for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
 336 +               if ((ret = nf_register_hook(&ebt_ops_filter[i])) < 0)
 337 +                       goto cleanup;
 338 +       return ret;
 339 +cleanup:
 340 +       for (j = 0; j < i; j++)
 341 +               nf_unregister_hook(&ebt_ops_filter[j]);
 342 +       ebt_unregister_table(&frame_filter);
 343 +       return ret;
 344 +}
 345 +
 346 +static void __exit fini(void)
 347 +{
 348 +       int i;
 349 +
 350 +       for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
 351 +               nf_unregister_hook(&ebt_ops_filter[i]);
 352 +       ebt_unregister_table(&frame_filter);
 353 +}
 354 +
 355 +module_init(init);
 356 +module_exit(fini);
 357 +EXPORT_NO_SYMBOLS;
 358 +MODULE_LICENSE("GPL");
 359 --- /dev/null   Thu Aug 24 11:00:32 2000
 360 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebtable_nat.c   Thu Oct 17 20:31:29 2002
 361 @@ -0,0 +1,96 @@
 362 +/*
 363 + *  ebtable_nat
 364 + *
 365 + *     Authors:
 366 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 367 + *
 368 + *  April, 2002
 369 + *
 370 + */
 371 +
 372 +#include <linux/netfilter_bridge/ebtables.h>
 373 +#include <linux/module.h>
 374 +#define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
 375 +   (1 << NF_BR_POST_ROUTING))
 376 +
 377 +static struct ebt_entries initial_chains[] =
 378 +{
 379 +  {0, "PREROUTING", 0, EBT_ACCEPT, 0},
 380 +  {0, "OUTPUT", 0, EBT_ACCEPT, 0},
 381 +  {0, "POSTROUTING", 0, EBT_ACCEPT, 0}
 382 +};
 383 +
 384 +static struct ebt_replace initial_table =
 385 +{
 386 +  "nat", NAT_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
 387 +  { [NF_BR_PRE_ROUTING]&initial_chains[0], [NF_BR_LOCAL_OUT]&initial_chains[1],
 388 +    [NF_BR_POST_ROUTING]&initial_chains[2] }, 0, NULL, (char *)initial_chains
 389 +};
 390 +
 391 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 392 +{
 393 +       if (valid_hooks & ~NAT_VALID_HOOKS)
 394 +               return -EINVAL;
 395 +       return 0;
 396 +}
 397 +
 398 +static struct ebt_table frame_nat =
 399 +{
 400 +  {NULL, NULL}, "nat", &initial_table, NAT_VALID_HOOKS,
 401 +  RW_LOCK_UNLOCKED, check, NULL
 402 +};
 403 +
 404 +static unsigned int
 405 +ebt_nat_dst(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
 406 +   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 407 +{
 408 +       return ebt_do_table(hook, pskb, in, out, &frame_nat);
 409 +}
 410 +
 411 +static unsigned int
 412 +ebt_nat_src(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
 413 +   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 414 +{
 415 +       return ebt_do_table(hook, pskb, in, out, &frame_nat);
 416 +}
 417 +
 418 +static struct nf_hook_ops ebt_ops_nat[] = {
 419 +       { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_LOCAL_OUT,
 420 +          NF_BR_PRI_NAT_DST_OTHER},
 421 +       { { NULL, NULL }, ebt_nat_src, PF_BRIDGE, NF_BR_POST_ROUTING,
 422 +          NF_BR_PRI_NAT_SRC},
 423 +       { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_PRE_ROUTING,
 424 +          NF_BR_PRI_NAT_DST_BRIDGED},
 425 +};
 426 +
 427 +static int __init init(void)
 428 +{
 429 +       int i, ret, j;
 430 +
 431 +       ret = ebt_register_table(&frame_nat);
 432 +       if (ret < 0)
 433 +               return ret;
 434 +       for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
 435 +               if ((ret = nf_register_hook(&ebt_ops_nat[i])) < 0)
 436 +                       goto cleanup;
 437 +       return ret;
 438 +cleanup:
 439 +       for (j = 0; j < i; j++)
 440 +               nf_unregister_hook(&ebt_ops_nat[j]);
 441 +       ebt_unregister_table(&frame_nat);
 442 +       return ret;
 443 +}
 444 +
 445 +static void __exit fini(void)
 446 +{
 447 +       int i;
 448 +
 449 +       for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
 450 +               nf_unregister_hook(&ebt_ops_nat[i]);
 451 +       ebt_unregister_table(&frame_nat);
 452 +}
 453 +
 454 +module_init(init);
 455 +module_exit(fini);
 456 +EXPORT_NO_SYMBOLS;
 457 +MODULE_LICENSE("GPL");
 458 --- /dev/null   Thu Aug 24 11:00:32 2000
 459 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebtable_broute.c        Thu Oct 17 20:31:29 2002
 460 @@ -0,0 +1,79 @@
 461 +/*
 462 + *  ebtable_broute
 463 + *
 464 + *     Authors:
 465 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 466 + *
 467 + *  April, 2002
 468 + *
 469 + *  This table lets you choose between routing and bridging for frames
 470 + *  entering on a bridge enslaved nic. This table is traversed before any
 471 + *  other ebtables table. See net/bridge/br_input.c.
 472 + */
 473 +
 474 +#include <linux/netfilter_bridge/ebtables.h>
 475 +#include <linux/module.h>
 476 +#include <linux/if_bridge.h>
 477 +#include <linux/brlock.h>
 478 +
 479 +// EBT_ACCEPT means the frame will be bridged
 480 +// EBT_DROP means the frame will be routed
 481 +static struct ebt_entries initial_chain =
 482 +  {0, "BROUTING", 0, EBT_ACCEPT, 0};
 483 +
 484 +static struct ebt_replace initial_table =
 485 +{
 486 +  "broute", 1 << NF_BR_BROUTING, 0, sizeof(struct ebt_entries),
 487 +  { [NF_BR_BROUTING]&initial_chain}, 0, NULL, (char *)&initial_chain
 488 +};
 489 +
 490 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 491 +{
 492 +       if (valid_hooks & ~(1 << NF_BR_BROUTING))
 493 +               return -EINVAL;
 494 +       return 0;
 495 +}
 496 +
 497 +static struct ebt_table broute_table =
 498 +{
 499 +  {NULL, NULL}, "broute", &initial_table, 1 << NF_BR_BROUTING,
 500 +  RW_LOCK_UNLOCKED, check, NULL
 501 +};
 502 +
 503 +static int ebt_broute(struct sk_buff **pskb)
 504 +{
 505 +       int ret;
 506 +
 507 +       ret = ebt_do_table(NF_BR_BROUTING, pskb, (*pskb)->dev, NULL,
 508 +          &broute_table);
 509 +       if (ret == NF_DROP)
 510 +               return 1; // route it
 511 +       return 0; // bridge it
 512 +}
 513 +
 514 +static int __init init(void)
 515 +{
 516 +       int ret;
 517 +
 518 +       ret = ebt_register_table(&broute_table);
 519 +       if (ret < 0)
 520 +               return ret;
 521 +       br_write_lock_bh(BR_NETPROTO_LOCK);
 522 +       // see br_input.c
 523 +       br_should_route_hook = ebt_broute;
 524 +       br_write_unlock_bh(BR_NETPROTO_LOCK);
 525 +       return ret;
 526 +}
 527 +
 528 +static void __exit fini(void)
 529 +{
 530 +       br_write_lock_bh(BR_NETPROTO_LOCK);
 531 +       br_should_route_hook = NULL;
 532 +       br_write_unlock_bh(BR_NETPROTO_LOCK);
 533 +       ebt_unregister_table(&broute_table);
 534 +}
 535 +
 536 +module_init(init);
 537 +module_exit(fini);
 538 +EXPORT_NO_SYMBOLS;
 539 +MODULE_LICENSE("GPL");
 540 --- /dev/null   Thu Aug 24 11:00:32 2000
 541 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_mark.c      Thu Oct 17 20:31:29 2002
 542 @@ -0,0 +1,66 @@
 543 +/*
 544 + *  ebt_mark
 545 + *
 546 + *     Authors:
 547 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 548 + *
 549 + *  July, 2002
 550 + *
 551 + */
 552 +
 553 +// The mark target can be used in any chain
 554 +// I believe adding a mangle table just for marking is total overkill
 555 +// Marking a frame doesn't really change anything in the frame anyway
 556 +
 557 +#include <linux/netfilter_bridge/ebtables.h>
 558 +#include <linux/netfilter_bridge/ebt_mark_t.h>
 559 +#include <linux/module.h>
 560 +
 561 +static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
 562 +   const struct net_device *in, const struct net_device *out,
 563 +   const void *data, unsigned int datalen)
 564 +{
 565 +       struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
 566 +
 567 +       if ((*pskb)->nfmark != info->mark) {
 568 +               (*pskb)->nfmark = info->mark;
 569 +               (*pskb)->nfcache |= NFC_ALTERED;
 570 +       }
 571 +       return info->target;
 572 +}
 573 +
 574 +static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
 575 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 576 +{
 577 +       struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
 578 +
 579 +       if (datalen != sizeof(struct ebt_mark_t_info))
 580 +               return -EINVAL;
 581 +       if (BASE_CHAIN && info->target == EBT_RETURN)
 582 +               return -EINVAL;
 583 +       CLEAR_BASE_CHAIN_BIT;
 584 +       if (INVALID_TARGET)
 585 +               return -EINVAL;
 586 +       return 0;
 587 +}
 588 +
 589 +static struct ebt_target mark_target =
 590 +{
 591 +       {NULL, NULL}, EBT_MARK_TARGET, ebt_target_mark,
 592 +       ebt_target_mark_check, NULL, THIS_MODULE
 593 +};
 594 +
 595 +static int __init init(void)
 596 +{
 597 +       return ebt_register_target(&mark_target);
 598 +}
 599 +
 600 +static void __exit fini(void)
 601 +{
 602 +       ebt_unregister_target(&mark_target);
 603 +}
 604 +
 605 +module_init(init);
 606 +module_exit(fini);
 607 +EXPORT_NO_SYMBOLS;
 608 +MODULE_LICENSE("GPL");
 609 --- /dev/null   Thu Aug 24 11:00:32 2000
 610 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_mark_m.c    Thu Oct 17 20:31:29 2002
 611 @@ -0,0 +1,61 @@
 612 +/*
 613 + *  ebt_mark_m
 614 + *
 615 + *     Authors:
 616 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 617 + *
 618 + *  July, 2002
 619 + *
 620 + */
 621 +
 622 +#include <linux/netfilter_bridge/ebtables.h>
 623 +#include <linux/netfilter_bridge/ebt_mark_m.h>
 624 +#include <linux/module.h>
 625 +
 626 +static int ebt_filter_mark(const struct sk_buff *skb,
 627 +   const struct net_device *in, const struct net_device *out, const void *data,
 628 +   unsigned int datalen)
 629 +{
 630 +       struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
 631 +
 632 +       if (info->bitmask & EBT_MARK_OR)
 633 +               return !(!!(skb->nfmark & info->mask) ^ info->invert);
 634 +       return !(((skb->nfmark & info->mask) == info->mark) ^ info->invert);
 635 +}
 636 +
 637 +static int ebt_mark_check(const char *tablename, unsigned int hookmask,
 638 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 639 +{
 640 +        struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
 641 +
 642 +       if (datalen != sizeof(struct ebt_mark_m_info))
 643 +               return -EINVAL;
 644 +       if (info->bitmask & ~EBT_MARK_MASK)
 645 +               return -EINVAL;
 646 +       if ((info->bitmask & EBT_MARK_OR) && (info->bitmask & EBT_MARK_AND))
 647 +               return -EINVAL;
 648 +       if (!info->bitmask)
 649 +               return -EINVAL;
 650 +       return 0;
 651 +}
 652 +
 653 +static struct ebt_match filter_mark =
 654 +{
 655 +       {NULL, NULL}, EBT_MARK_MATCH, ebt_filter_mark, ebt_mark_check, NULL,
 656 +       THIS_MODULE
 657 +};
 658 +
 659 +static int __init init(void)
 660 +{
 661 +       return ebt_register_match(&filter_mark);
 662 +}
 663 +
 664 +static void __exit fini(void)
 665 +{
 666 +       ebt_unregister_match(&filter_mark);
 667 +}
 668 +
 669 +module_init(init);
 670 +module_exit(fini);
 671 +EXPORT_NO_SYMBOLS;
 672 +MODULE_LICENSE("GPL");
 673 --- /dev/null   Thu Aug 24 11:00:32 2000
 674 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_redirect.c  Thu Oct 17 20:31:29 2002
 675 @@ -0,0 +1,71 @@
 676 +/*
 677 + *  ebt_redirect
 678 + *
 679 + *     Authors:
 680 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 681 + *
 682 + *  April, 2002
 683 + *
 684 + */
 685 +
 686 +#include <linux/netfilter_bridge/ebtables.h>
 687 +#include <linux/netfilter_bridge/ebt_redirect.h>
 688 +#include <linux/module.h>
 689 +#include <net/sock.h>
 690 +#include "../br_private.h"
 691 +
 692 +static int ebt_target_redirect(struct sk_buff **pskb, unsigned int hooknr,
 693 +   const struct net_device *in, const struct net_device *out,
 694 +   const void *data, unsigned int datalen)
 695 +{
 696 +       struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
 697 +
 698 +       if (hooknr != NF_BR_BROUTING)
 699 +               memcpy((**pskb).mac.ethernet->h_dest,
 700 +                  in->br_port->br->dev.dev_addr, ETH_ALEN);
 701 +       else {
 702 +               memcpy((**pskb).mac.ethernet->h_dest,
 703 +                  in->dev_addr, ETH_ALEN);
 704 +               (*pskb)->pkt_type = PACKET_HOST;
 705 +       }
 706 +       return info->target;
 707 +}
 708 +
 709 +static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
 710 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 711 +{
 712 +       struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
 713 +
 714 +       if (datalen != sizeof(struct ebt_redirect_info))
 715 +               return -EINVAL;
 716 +       if (BASE_CHAIN && info->target == EBT_RETURN)
 717 +               return -EINVAL;
 718 +       CLEAR_BASE_CHAIN_BIT;
 719 +       if ( (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING)) &&
 720 +            (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
 721 +               return -EINVAL;
 722 +       if (INVALID_TARGET)
 723 +               return -EINVAL;
 724 +       return 0;
 725 +}
 726 +
 727 +static struct ebt_target redirect_target =
 728 +{
 729 +       {NULL, NULL}, EBT_REDIRECT_TARGET, ebt_target_redirect,
 730 +       ebt_target_redirect_check, NULL, THIS_MODULE
 731 +};
 732 +
 733 +static int __init init(void)
 734 +{
 735 +       return ebt_register_target(&redirect_target);
 736 +}
 737 +
 738 +static void __exit fini(void)
 739 +{
 740 +       ebt_unregister_target(&redirect_target);
 741 +}
 742 +
 743 +module_init(init);
 744 +module_exit(fini);
 745 +EXPORT_NO_SYMBOLS;
 746 +MODULE_LICENSE("GPL");
 747 --- /dev/null   Thu Aug 24 11:00:32 2000
 748 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_arp.c       Thu Oct 17 20:31:29 2002
 749 @@ -0,0 +1,102 @@
 750 +/*
 751 + *  ebt_arp
 752 + *
 753 + *     Authors:
 754 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 755 + *     Tim Gardner <timg@tpi.com>
 756 + *
 757 + *  April, 2002
 758 + *
 759 + */
 760 +
 761 +#include <linux/netfilter_bridge/ebtables.h>
 762 +#include <linux/netfilter_bridge/ebt_arp.h>
 763 +#include <linux/if_arp.h>
 764 +#include <linux/module.h>
 765 +
 766 +static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
 767 +   const struct net_device *out, const void *data, unsigned int datalen)
 768 +{
 769 +       struct ebt_arp_info *info = (struct ebt_arp_info *)data;
 770 +
 771 +       if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
 772 +          ((*skb).nh.arph)->ar_op, EBT_ARP_OPCODE))
 773 +               return EBT_NOMATCH;
 774 +       if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
 775 +          ((*skb).nh.arph)->ar_hrd, EBT_ARP_HTYPE))
 776 +               return EBT_NOMATCH;
 777 +       if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
 778 +          ((*skb).nh.arph)->ar_pro, EBT_ARP_PTYPE))
 779 +               return EBT_NOMATCH;
 780 +
 781 +       if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP))
 782 +       {
 783 +               uint32_t arp_len = sizeof(struct arphdr) +
 784 +                  (2 * (((*skb).nh.arph)->ar_hln)) +
 785 +                  (2 * (((*skb).nh.arph)->ar_pln));
 786 +               uint32_t dst;
 787 +               uint32_t src;
 788 +
 789 +               // Make sure the packet is long enough.
 790 +               if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
 791 +                       return EBT_NOMATCH;
 792 +               // IPv4 addresses are always 4 bytes.
 793 +               if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
 794 +                       return EBT_NOMATCH;
 795 +
 796 +               if (info->bitmask & EBT_ARP_SRC_IP) {
 797 +                       memcpy(&src, ((*skb).nh.raw) + sizeof(struct arphdr) +
 798 +                          ((*skb).nh.arph)->ar_hln, sizeof(uint32_t));
 799 +                       if (FWINV(info->saddr != (src & info->smsk),
 800 +                          EBT_ARP_SRC_IP))
 801 +                               return EBT_NOMATCH;
 802 +               }
 803 +
 804 +               if (info->bitmask & EBT_ARP_DST_IP) {
 805 +                       memcpy(&dst, ((*skb).nh.raw)+sizeof(struct arphdr) +
 806 +                          (2*(((*skb).nh.arph)->ar_hln)) +
 807 +                          (((*skb).nh.arph)->ar_pln), sizeof(uint32_t));
 808 +                       if (FWINV(info->daddr != (dst & info->dmsk),
 809 +                          EBT_ARP_DST_IP))
 810 +                               return EBT_NOMATCH;
 811 +               }
 812 +       }
 813 +       return EBT_MATCH;
 814 +}
 815 +
 816 +static int ebt_arp_check(const char *tablename, unsigned int hookmask,
 817 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 818 +{
 819 +       struct ebt_arp_info *info = (struct ebt_arp_info *)data;
 820 +
 821 +       if (datalen != sizeof(struct ebt_arp_info))
 822 +               return -EINVAL;
 823 +       if ((e->ethproto != __constant_htons(ETH_P_ARP) &&
 824 +          e->ethproto != __constant_htons(ETH_P_RARP)) ||
 825 +          e->invflags & EBT_IPROTO)
 826 +               return -EINVAL;
 827 +       if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
 828 +               return -EINVAL;
 829 +       return 0;
 830 +}
 831 +
 832 +static struct ebt_match filter_arp =
 833 +{
 834 +       {NULL, NULL}, EBT_ARP_MATCH, ebt_filter_arp, ebt_arp_check, NULL,
 835 +       THIS_MODULE
 836 +};
 837 +
 838 +static int __init init(void)
 839 +{
 840 +       return ebt_register_match(&filter_arp);
 841 +}
 842 +
 843 +static void __exit fini(void)
 844 +{
 845 +       ebt_unregister_match(&filter_arp);
 846 +}
 847 +
 848 +module_init(init);
 849 +module_exit(fini);
 850 +EXPORT_NO_SYMBOLS;
 851 +MODULE_LICENSE("GPL");
 852 --- /dev/null   Thu Aug 24 11:00:32 2000
 853 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_ip.c        Thu Oct 17 23:22:58 2002
 854 @@ -0,0 +1,121 @@
 855 +/*
 856 + *  ebt_ip
 857 + *
 858 + *     Authors:
 859 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 860 + *
 861 + *  April, 2002
 862 + *
 863 + *  Changes:
 864 + *    added ip-sport and ip-dport
 865 + *    Innominate Security Technologies AG <mhopf@innominate.com>
 866 + *    September, 2002
 867 + */
 868 +
 869 +#include <linux/netfilter_bridge/ebtables.h>
 870 +#include <linux/netfilter_bridge/ebt_ip.h>
 871 +#include <linux/ip.h>
 872 +#include <linux/in.h>
 873 +#include <linux/module.h>
 874 +
 875 +struct tcpudphdr {
 876 +       uint16_t src;
 877 +       uint16_t dst;
 878 +};
 879 +
 880 +union h_u {
 881 +       unsigned char *raw;
 882 +       struct tcpudphdr *tuh;
 883 +};
 884 +
 885 +static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
 886 +   const struct net_device *out, const void *data,
 887 +   unsigned int datalen)
 888 +{
 889 +       struct ebt_ip_info *info = (struct ebt_ip_info *)data;
 890 +
 891 +       if (info->bitmask & EBT_IP_TOS &&
 892 +          FWINV(info->tos != ((*skb).nh.iph)->tos, EBT_IP_TOS))
 893 +               return EBT_NOMATCH;
 894 +       if (info->bitmask & EBT_IP_PROTO) {
 895 +               if (FWINV(info->protocol != ((*skb).nh.iph)->protocol,
 896 +                         EBT_IP_PROTO))
 897 +                       return EBT_NOMATCH;
 898 +               if ( info->protocol == IPPROTO_TCP ||
 899 +                    info->protocol == IPPROTO_UDP )
 900 +               {
 901 +                       union h_u h;
 902 +                       h.raw = skb->data + skb->nh.iph->ihl*4;
 903 +                       if (info->bitmask & EBT_IP_DPORT) {
 904 +                               uint16_t port = ntohs(h.tuh->dst);
 905 +                               if (FWINV(port < info->dport[0] ||
 906 +                                         port > info->dport[1],
 907 +                                         EBT_IP_DPORT))
 908 +                               return EBT_NOMATCH;
 909 +                       }
 910 +                       if (info->bitmask & EBT_IP_SPORT) {
 911 +                               uint16_t port = ntohs(h.tuh->src);
 912 +                               if (FWINV(port < info->sport[0] ||
 913 +                                         port > info->sport[1],
 914 +                                         EBT_IP_SPORT))
 915 +                               return EBT_NOMATCH;
 916 +                       }
 917 +               }
 918 +       }
 919 +       if (info->bitmask & EBT_IP_SOURCE &&
 920 +          FWINV((((*skb).nh.iph)->saddr & info->smsk) !=
 921 +          info->saddr, EBT_IP_SOURCE))
 922 +               return EBT_NOMATCH;
 923 +       if ((info->bitmask & EBT_IP_DEST) &&
 924 +          FWINV((((*skb).nh.iph)->daddr & info->dmsk) !=
 925 +          info->daddr, EBT_IP_DEST))
 926 +               return EBT_NOMATCH;
 927 +       return EBT_MATCH;
 928 +}
 929 +
 930 +static int ebt_ip_check(const char *tablename, unsigned int hookmask,
 931 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 932 +{
 933 +       struct ebt_ip_info *info = (struct ebt_ip_info *)data;
 934 +
 935 +       if (datalen != sizeof(struct ebt_ip_info))
 936 +               return -EINVAL;
 937 +       if (e->ethproto != __constant_htons(ETH_P_IP) ||
 938 +          e->invflags & EBT_IPROTO)
 939 +               return -EINVAL;
 940 +       if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
 941 +               return -EINVAL;
 942 +       if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
 943 +               if (!info->bitmask & EBT_IPROTO)
 944 +                       return -EINVAL;
 945 +               if (info->protocol != IPPROTO_TCP &&
 946 +                   info->protocol != IPPROTO_UDP)
 947 +                        return -EINVAL;
 948 +       }
 949 +       if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
 950 +               return -EINVAL;
 951 +       if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
 952 +               return -EINVAL;
 953 +       return 0;
 954 +}
 955 +
 956 +static struct ebt_match filter_ip =
 957 +{
 958 +       {NULL, NULL}, EBT_IP_MATCH, ebt_filter_ip, ebt_ip_check, NULL,
 959 +       THIS_MODULE
 960 +};
 961 +
 962 +static int __init init(void)
 963 +{
 964 +       return ebt_register_match(&filter_ip);
 965 +}
 966 +
 967 +static void __exit fini(void)
 968 +{
 969 +       ebt_unregister_match(&filter_ip);
 970 +}
 971 +
 972 +module_init(init);
 973 +module_exit(fini);
 974 +EXPORT_NO_SYMBOLS;
 975 +MODULE_LICENSE("GPL");
 976 --- /dev/null   Thu Aug 24 11:00:32 2000
 977 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_vlan.c      Thu Oct 17 20:31:29 2002
 978 @@ -0,0 +1,318 @@
 979 +/*
 980 + * Description: EBTables 802.1Q match extension kernelspace module.
 981 + * Authors: Nick Fedchik <nick@fedchik.org.ua>
 982 + *          Bart De Schuymer <bart.de.schuymer@pandora.be>
 983 + *
 984 + * This program is free software; you can redistribute it and/or modify
 985 + * it under the terms of the GNU General Public License as published by
 986 + * the Free Software Foundation; either version 2 of the License, or
 987 + * (at your option) any later version.
 988 + *
 989 + * This program is distributed in the hope that it will be useful,
 990 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 991 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 992 + * GNU General Public License for more details.
 993 + *
 994 + * You should have received a copy of the GNU General Public License
 995 + * along with this program; if not, write to the Free Software
 996 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 997 + */
 998 +
 999 +#include <linux/if_ether.h>
1000 +#include <linux/if_vlan.h>
1001 +#include <linux/module.h>
1002 +#include <linux/netfilter_bridge/ebtables.h>
1003 +#include <linux/netfilter_bridge/ebt_vlan.h>
1004 +
1005 +static unsigned char debug;
1006 +#define MODULE_VERSION "0.4 (" __DATE__ " " __TIME__ ")"
1007 +
1008 +MODULE_PARM (debug, "0-1b");
1009 +MODULE_PARM_DESC (debug, "debug=1 is turn on debug messages");
1010 +MODULE_AUTHOR ("Nick Fedchik <nick@fedchik.org.ua>");
1011 +MODULE_DESCRIPTION ("802.1Q match module (ebtables extension), v"
1012 +                   MODULE_VERSION);
1013 +MODULE_LICENSE ("GPL");
1014 +
1015 +
1016 +#define DEBUG_MSG(...) if (debug) printk (KERN_DEBUG __FILE__ ":" __VA_ARGS__)
1017 +#define INV_FLAG(_inv_flag_) (info->invflags & _inv_flag_) ? "!" : ""
1018 +#define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
1019 +#define SET_BITMASK(_BIT_MASK_) info->bitmask |= _BIT_MASK_
1020 +#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return 1;
1021 +
1022 +/*
1023 + * Function description: ebt_filter_vlan() is main engine for
1024 + * checking passed 802.1Q frame according to
1025 + * the passed extension parameters (in the *data buffer)
1026 + * ebt_filter_vlan() is called after successfull check the rule params
1027 + * by ebt_check_vlan() function.
1028 + * Parameters:
1029 + * const struct sk_buff *skb - pointer to passed ethernet frame buffer
1030 + * const void *data - pointer to passed extension parameters
1031 + * unsigned int datalen - length of passed *data buffer
1032 + * const struct net_device *in  -
1033 + * const struct net_device *out -
1034 + * const struct ebt_counter *c -
1035 + * Returned values:
1036 + * 0 - ok (all rule params matched)
1037 + * 1 - miss (rule params not acceptable to the parsed frame)
1038 + */
1039 +static int
1040 +ebt_filter_vlan (const struct sk_buff *skb,
1041 +                const struct net_device *in,
1042 +                const struct net_device *out,
1043 +                const void *data,
1044 +                unsigned int datalen)
1045 +{
1046 +       struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;     /* userspace data */
1047 +       struct vlan_ethhdr *frame = (struct vlan_ethhdr *) skb->mac.raw;        /* Passed tagged frame */
1048 +
1049 +       unsigned short TCI;     /* Whole TCI, given from parsed frame */
1050 +       unsigned short id;      /* VLAN ID, given from frame TCI */
1051 +       unsigned char prio;     /* user_priority, given from frame TCI */
1052 +       unsigned short encap;   /* VLAN encapsulated Type/Length field, given from orig frame */
1053 +
1054 +       /*
1055 +        * Tag Control Information (TCI) consists of the following elements:
1056 +        * - User_priority. This field allows the tagged frame to carry user_priority
1057 +        * information across Bridged LANs in which individual LAN segments may be unable to signal
1058 +        * priority information (e.g., 802.3/Ethernet segments).
1059 +        * The user_priority field is three bits in length,
1060 +        * interpreted as a binary number. The user_priority is therefore
1061 +        * capable of representing eight priority levels, 0 through 7.
1062 +        * The use and interpretation of this field is defined in ISO/IEC 15802-3.
1063 +        * - Canonical Format Indicator (CFI). This field is used,
1064 +        * in 802.3/Ethernet, to signal the presence or absence
1065 +        * of a RIF field, and, in combination with the Non-canonical Format Indicator (NCFI) carried
1066 +        * in the RIF, to signal the bit order of address information carried in the encapsulated
1067 +        * frame. The Canonical Format Indicator (CFI) is a single bit flag value.
1068 +        * - VLAN Identifier (VID). This field uniquely identifies the VLAN to
1069 +        * which the frame belongs. The twelve-bit VLAN Identifier (VID) field
1070 +        * uniquely identify the VLAN to which the frame belongs.
1071 +        * The VID is encoded as an unsigned binary number.
1072 +        */
1073 +       TCI = ntohs (frame->h_vlan_TCI);
1074 +       id = TCI & 0xFFF;
1075 +       prio = TCI >> 13;
1076 +       encap = frame->h_vlan_encapsulated_proto;
1077 +
1078 +       /*
1079 +        * First step is to check is null VLAN ID present
1080 +        * in the parsed frame
1081 +        */
1082 +       if (!(id)) {
1083 +               /*
1084 +                * Checking VLAN Identifier (VID)
1085 +                */
1086 +               if (GET_BITMASK (EBT_VLAN_ID)) {        /* Is VLAN ID parsed? */
1087 +                       EXIT_ON_MISMATCH (id, EBT_VLAN_ID);
1088 +                       DEBUG_MSG
1089 +                           ("matched rule id=%s%d for frame id=%d\n",
1090 +                            INV_FLAG (EBT_VLAN_ID), info->id, id);
1091 +               }
1092 +       } else {
1093 +               /*
1094 +                * Checking user_priority
1095 +                */
1096 +               if (GET_BITMASK (EBT_VLAN_PRIO)) {      /* Is VLAN user_priority parsed? */
1097 +                       EXIT_ON_MISMATCH (prio, EBT_VLAN_PRIO);
1098 +                       DEBUG_MSG
1099 +                           ("matched rule prio=%s%d for frame prio=%d\n",
1100 +                            INV_FLAG (EBT_VLAN_PRIO), info->prio,
1101 +                            prio);
1102 +               }
1103 +       }
1104 +       /*
1105 +        * Checking Encapsulated Proto (Length/Type) field
1106 +        */
1107 +       if (GET_BITMASK (EBT_VLAN_ENCAP)) {     /* Is VLAN Encap parsed? */
1108 +               EXIT_ON_MISMATCH (encap, EBT_VLAN_ENCAP);
1109 +               DEBUG_MSG ("matched encap=%s%2.4X for frame encap=%2.4X\n",
1110 +                          INV_FLAG (EBT_VLAN_ENCAP),
1111 +                          ntohs (info->encap), ntohs (encap));
1112 +       }
1113 +       /*
1114 +        * All possible extension parameters was parsed.
1115 +        * If rule never returned by missmatch, then all ok.
1116 +        */
1117 +       return 0;
1118 +}
1119 +
1120 +/*
1121 + * Function description: ebt_vlan_check() is called when userspace
1122 + * delivers the table to the kernel,
1123 + * and to check that userspace doesn't give a bad table.
1124 + * Parameters:
1125 + * const char *tablename - table name string
1126 + * unsigned int hooknr - hook number
1127 + * const struct ebt_entry *e - ebtables entry basic set
1128 + * const void *data - pointer to passed extension parameters
1129 + * unsigned int datalen - length of passed *data buffer
1130 + * Returned values:
1131 + * 0 - ok (all delivered rule params are correct)
1132 + * 1 - miss (rule params is out of range, invalid, incompatible, etc.)
1133 + */
1134 +static int
1135 +ebt_check_vlan (const char *tablename,
1136 +               unsigned int hooknr,
1137 +               const struct ebt_entry *e, void *data,
1138 +               unsigned int datalen)
1139 +{
1140 +       struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
1141 +
1142 +       /*
1143 +        * Parameters buffer overflow check
1144 +        */
1145 +       if (datalen != sizeof (struct ebt_vlan_info)) {
1146 +               DEBUG_MSG
1147 +                   ("params size %d is not eq to ebt_vlan_info (%d)\n",
1148 +                    datalen, sizeof (struct ebt_vlan_info));
1149 +               return -EINVAL;
1150 +       }
1151 +
1152 +       /*
1153 +        * Is it 802.1Q frame checked?
1154 +        */
1155 +       if (e->ethproto != __constant_htons (ETH_P_8021Q)) {
1156 +               DEBUG_MSG ("passed entry proto %2.4X is not 802.1Q (8100)\n",
1157 +                          (unsigned short) ntohs (e->ethproto));
1158 +               return -EINVAL;
1159 +       }
1160 +
1161 +       /*
1162 +        * Check for bitmask range
1163 +        * True if even one bit is out of mask
1164 +        */
1165 +       if (info->bitmask & ~EBT_VLAN_MASK) {
1166 +               DEBUG_MSG ("bitmask %2X is out of mask (%2X)\n",
1167 +                          info->bitmask, EBT_VLAN_MASK);
1168 +               return -EINVAL;
1169 +       }
1170 +
1171 +       /*
1172 +        * Check for inversion flags range
1173 +        */
1174 +       if (info->invflags & ~EBT_VLAN_MASK) {
1175 +               DEBUG_MSG ("inversion flags %2X is out of mask (%2X)\n",
1176 +                          info->invflags, EBT_VLAN_MASK);
1177 +               return -EINVAL;
1178 +       }
1179 +
1180 +       /*
1181 +        * Reserved VLAN ID (VID) values
1182 +        * -----------------------------
1183 +        * 0 - The null VLAN ID. Indicates that the tag header contains only user_priority information;
1184 +        * no VLAN identifier is present in the frame. This VID value shall not be
1185 +        * configured as a PVID, configured in any Filtering Database entry, or used in any
1186 +        * Management operation.
1187 +        *
1188 +        * 1 - The default Port VID (PVID) value used for classifying frames on ingress through a Bridge
1189 +        * Port. The PVID value can be changed by management on a per-Port basis.
1190 +        *
1191 +        * 0x0FFF - Reserved for implementation use. This VID value shall not be configured as a
1192 +        * PVID or transmitted in a tag header.
1193 +        *
1194 +        * The remaining values of VID are available for general use as VLAN identifiers.
1195 +        * A Bridge may implement the ability to support less than the full range of VID values;
1196 +        * i.e., for a given implementation,
1197 +        * an upper limit, N, is defined for the VID values supported, where N is less than or equal to 4094.
1198 +        * All implementations shall support the use of all VID values in the range 0 through their defined maximum
1199 +        * VID, N.
1200 +        *
1201 +        * For Linux, N = 4094.
1202 +        */
1203 +       if (GET_BITMASK (EBT_VLAN_ID)) {        /* when vlan-id param was spec-ed */
1204 +               if (!!info->id) {       /* if id!=0 => check vid range */
1205 +                       if (info->id > 4094) {  /* check if id > than (0x0FFE) */
1206 +                               DEBUG_MSG
1207 +                                   ("vlan id %d is out of range (1-4094)\n",
1208 +                                    info->id);
1209 +                               return -EINVAL;
1210 +                       }
1211 +                       /*
1212 +                        * Note: This is valid VLAN-tagged frame point.
1213 +                        * Any value of user_priority are acceptable, but could be ignored
1214 +                        * according to 802.1Q Std.
1215 +                        */
1216 +               } else {
1217 +                       /*
1218 +                        * if id=0 (null VLAN ID)  => Check for user_priority range
1219 +                        */
1220 +                       if (GET_BITMASK (EBT_VLAN_PRIO)) {
1221 +                               if ((unsigned char) info->prio > 7) {
1222 +                                       DEBUG_MSG
1223 +                                           ("prio %d is out of range (0-7)\n",
1224 +                                            info->prio);
1225 +                                       return -EINVAL;
1226 +                               }
1227 +                       }
1228 +                       /*
1229 +                        * Note2: This is valid priority-tagged frame point
1230 +                        * with null VID field.
1231 +                        */
1232 +               }
1233 +       } else {                /* VLAN Id not set */
1234 +               if (GET_BITMASK (EBT_VLAN_PRIO)) {      /* But user_priority is set - abnormal! */
1235 +                       info->id = 0;   /* Set null VID (case for Priority-tagged frames) */
1236 +                       SET_BITMASK (EBT_VLAN_ID);      /* and set id flag */
1237 +               }
1238 +       }
1239 +       /*
1240 +        * Check for encapsulated proto range - it is possible to be any value for u_short range.
1241 +        * When relaying a tagged frame between 802.3/Ethernet MACs,
1242 +        * a Bridge may adjust the padding field such that
1243 +        * the minimum size of a transmitted tagged frame is 68 octets (7.2).
1244 +        * if_ether.h:  ETH_ZLEN        60   -  Min. octets in frame sans FCS
1245 +        */
1246 +       if (GET_BITMASK (EBT_VLAN_ENCAP)) {
1247 +               if ((unsigned short) ntohs (info->encap) < ETH_ZLEN) {
1248 +                       DEBUG_MSG
1249 +                           ("encap packet length %d is less than minimal %d\n",
1250 +                            ntohs (info->encap), ETH_ZLEN);
1251 +                       return -EINVAL;
1252 +               }
1253 +       }
1254 +
1255 +       /*
1256 +        * Otherwise is all correct
1257 +        */
1258 +       DEBUG_MSG ("802.1Q tagged frame checked (%s table, %d hook)\n",
1259 +                  tablename, hooknr);
1260 +       return 0;
1261 +}
1262 +
1263 +static struct ebt_match filter_vlan = {
1264 +       {NULL, NULL},
1265 +       EBT_VLAN_MATCH,
1266 +       ebt_filter_vlan,
1267 +       ebt_check_vlan,
1268 +       NULL,
1269 +       THIS_MODULE
1270 +};
1271 +
1272 +/*
1273 + * Module initialization function.
1274 + * Called when module is loaded to kernelspace
1275 + */
1276 +static int __init init (void)
1277 +{
1278 +       DEBUG_MSG ("ebtables 802.1Q extension module v"
1279 +                  MODULE_VERSION "\n");
1280 +       DEBUG_MSG ("module debug=%d\n", !!debug);
1281 +       return ebt_register_match (&filter_vlan);
1282 +}
1283 +
1284 +/*
1285 + * Module "finalization" function
1286 + * Called when download module from kernelspace
1287 + */
1288 +static void __exit fini (void)
1289 +{
1290 +       ebt_unregister_match (&filter_vlan);
1291 +}
1292 +
1293 +module_init (init);
1294 +module_exit (fini);
1295 +
1296 +EXPORT_NO_SYMBOLS;
1297 --- /dev/null   Thu Aug 24 11:00:32 2000
1298 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_log.c       Thu Oct 17 20:31:29 2002
1299 @@ -0,0 +1,100 @@
1300 +/*
1301 + *  ebt_log
1302 + *
1303 + *     Authors:
1304 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1305 + *
1306 + *  April, 2002
1307 + *
1308 + */
1309 +
1310 +#include <linux/netfilter_bridge/ebtables.h>
1311 +#include <linux/netfilter_bridge/ebt_log.h>
1312 +#include <linux/module.h>
1313 +#include <linux/ip.h>
1314 +#include <linux/if_arp.h>
1315 +#include <linux/spinlock.h>
1316 +
1317 +static spinlock_t ebt_log_lock = SPIN_LOCK_UNLOCKED;
1318 +
1319 +static int ebt_log_check(const char *tablename, unsigned int hookmask,
1320 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1321 +{
1322 +       struct ebt_log_info *info = (struct ebt_log_info *)data;
1323 +
1324 +       if (datalen != sizeof(struct ebt_log_info))
1325 +               return -EINVAL;
1326 +       if (info->bitmask & ~EBT_LOG_MASK)
1327 +               return -EINVAL;
1328 +       if (info->loglevel >= 8)
1329 +               return -EINVAL;
1330 +       info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
1331 +       return 0;
1332 +}
1333 +
1334 +static void ebt_log(const struct sk_buff *skb, const struct net_device *in,
1335 +   const struct net_device *out, const void *data, unsigned int datalen)
1336 +{
1337 +       struct ebt_log_info *info = (struct ebt_log_info *)data;
1338 +       char level_string[4] = "< >";
1339 +       level_string[1] = '0' + info->loglevel;
1340 +
1341 +       spin_lock_bh(&ebt_log_lock);
1342 +       printk(level_string);
1343 +       printk("%s IN=%s OUT=%s ", info->prefix, in ? in->name : "",
1344 +          out ? out->name : "");
1345 +
1346 +       if (skb->dev->hard_header_len) {
1347 +               int i;
1348 +               unsigned char *p = (skb->mac.ethernet)->h_source;
1349 +
1350 +               printk("MAC source = ");
1351 +               for (i = 0; i < ETH_ALEN; i++,p++)
1352 +                       printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':');
1353 +               printk("MAC dest = ");
1354 +               p = (skb->mac.ethernet)->h_dest;
1355 +               for (i = 0; i < ETH_ALEN; i++,p++)
1356 +                       printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':');
1357 +       }
1358 +       printk("proto = 0x%04x", ntohs(((*skb).mac.ethernet)->h_proto));
1359 +
1360 +       if ((info->bitmask & EBT_LOG_IP) && skb->mac.ethernet->h_proto ==
1361 +          htons(ETH_P_IP)){
1362 +               struct iphdr *iph = skb->nh.iph;
1363 +               printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u,",
1364 +                  NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
1365 +               printk(" IP tos=0x%02X, IP proto=%d", iph->tos, iph->protocol);
1366 +       }
1367 +
1368 +       if ((info->bitmask & EBT_LOG_ARP) &&
1369 +           ((skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) ||
1370 +           (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_RARP)))) {
1371 +               struct arphdr * arph = skb->nh.arph;
1372 +               printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
1373 +                  ntohs(arph->ar_hrd), ntohs(arph->ar_pro),
1374 +                  ntohs(arph->ar_op));
1375 +       }
1376 +       printk("\n");
1377 +       spin_unlock_bh(&ebt_log_lock);
1378 +}
1379 +
1380 +struct ebt_watcher log =
1381 +{
1382 +       {NULL, NULL}, EBT_LOG_WATCHER, ebt_log, ebt_log_check, NULL,
1383 +       THIS_MODULE
1384 +};
1385 +
1386 +static int __init init(void)
1387 +{
1388 +       return ebt_register_watcher(&log);
1389 +}
1390 +
1391 +static void __exit fini(void)
1392 +{
1393 +       ebt_unregister_watcher(&log);
1394 +}
1395 +
1396 +module_init(init);
1397 +module_exit(fini);
1398 +EXPORT_NO_SYMBOLS;
1399 +MODULE_LICENSE("GPL");
1400 --- /dev/null   Thu Aug 24 11:00:32 2000
1401 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_snat.c      Thu Oct 17 20:31:29 2002
1402 @@ -0,0 +1,64 @@
1403 +/*
1404 + *  ebt_snat
1405 + *
1406 + *     Authors:
1407 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1408 + *
1409 + *  June, 2002
1410 + *
1411 + */
1412 +
1413 +#include <linux/netfilter_bridge/ebtables.h>
1414 +#include <linux/netfilter_bridge/ebt_nat.h>
1415 +#include <linux/module.h>
1416 +
1417 +static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
1418 +   const struct net_device *in, const struct net_device *out,
1419 +   const void *data, unsigned int datalen)
1420 +{
1421 +       struct ebt_nat_info *info = (struct ebt_nat_info *) data;
1422 +
1423 +       memcpy(((**pskb).mac.ethernet)->h_source, info->mac,
1424 +          ETH_ALEN * sizeof(unsigned char));
1425 +       return info->target;
1426 +}
1427 +
1428 +static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
1429 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1430 +{
1431 +       struct ebt_nat_info *info = (struct ebt_nat_info *) data;
1432 +
1433 +       if (datalen != sizeof(struct ebt_nat_info))
1434 +               return -EINVAL;
1435 +       if (BASE_CHAIN && info->target == EBT_RETURN)
1436 +               return -EINVAL;
1437 +       CLEAR_BASE_CHAIN_BIT;
1438 +       if (strcmp(tablename, "nat"))
1439 +               return -EINVAL;
1440 +       if (hookmask & ~(1 << NF_BR_POST_ROUTING))
1441 +               return -EINVAL;
1442 +       if (INVALID_TARGET)
1443 +               return -EINVAL;
1444 +       return 0;
1445 +}
1446 +
1447 +static struct ebt_target snat =
1448 +{
1449 +       {NULL, NULL}, EBT_SNAT_TARGET, ebt_target_snat, ebt_target_snat_check,
1450 +       NULL, THIS_MODULE
1451 +};
1452 +
1453 +static int __init init(void)
1454 +{
1455 +       return ebt_register_target(&snat);
1456 +}
1457 +
1458 +static void __exit fini(void)
1459 +{
1460 +       ebt_unregister_target(&snat);
1461 +}
1462 +
1463 +module_init(init);
1464 +module_exit(fini);
1465 +EXPORT_NO_SYMBOLS;
1466 +MODULE_LICENSE("GPL");
1467 --- /dev/null   Thu Aug 24 11:00:32 2000
1468 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebt_dnat.c      Thu Oct 17 20:31:29 2002
1469 @@ -0,0 +1,65 @@
1470 +/*
1471 + *  ebt_dnat
1472 + *
1473 + *     Authors:
1474 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1475 + *
1476 + *  June, 2002
1477 + *
1478 + */
1479 +
1480 +#include <linux/netfilter_bridge/ebtables.h>
1481 +#include <linux/netfilter_bridge/ebt_nat.h>
1482 +#include <linux/module.h>
1483 +#include <net/sock.h>
1484 +
1485 +static int ebt_target_dnat(struct sk_buff **pskb, unsigned int hooknr,
1486 +   const struct net_device *in, const struct net_device *out,
1487 +   const void *data, unsigned int datalen)
1488 +{
1489 +       struct ebt_nat_info *info = (struct ebt_nat_info *)data;
1490 +
1491 +       memcpy(((**pskb).mac.ethernet)->h_dest, info->mac,
1492 +          ETH_ALEN * sizeof(unsigned char));
1493 +       return info->target;
1494 +}
1495 +
1496 +static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
1497 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1498 +{
1499 +       struct ebt_nat_info *info = (struct ebt_nat_info *)data;
1500 +
1501 +       if (BASE_CHAIN && info->target == EBT_RETURN)
1502 +               return -EINVAL;
1503 +       CLEAR_BASE_CHAIN_BIT;
1504 +       if ( (strcmp(tablename, "nat") ||
1505 +          (hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))) &&
1506 +          (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
1507 +               return -EINVAL;
1508 +       if (datalen != sizeof(struct ebt_nat_info))
1509 +               return -EINVAL;
1510 +       if (INVALID_TARGET)
1511 +               return -EINVAL;
1512 +       return 0;
1513 +}
1514 +
1515 +static struct ebt_target dnat =
1516 +{
1517 +       {NULL, NULL}, EBT_DNAT_TARGET, ebt_target_dnat, ebt_target_dnat_check,
1518 +       NULL, THIS_MODULE
1519 +};
1520 +
1521 +static int __init init(void)
1522 +{
1523 +       return ebt_register_target(&dnat);
1524 +}
1525 +
1526 +static void __exit fini(void)
1527 +{
1528 +       ebt_unregister_target(&dnat);
1529 +}
1530 +
1531 +module_init(init);
1532 +module_exit(fini);
1533 +EXPORT_NO_SYMBOLS;
1534 +MODULE_LICENSE("GPL");
1535 --- /dev/null   Thu Aug 24 11:00:32 2000
1536 +++ linux-2.4.20-pre7-bcnt/net/bridge/netfilter/ebtables.c      Thu Oct 17 21:58:08 2002
1537 @@ -0,0 +1,1489 @@
1538 +/*
1539 + *  ebtables
1540 + *
1541 + *  Author:
1542 + *  Bart De Schuymer           <bart.de.schuymer@pandora.be>
1543 + *
1544 + *  ebtables.c,v 2.0, July, 2002
1545 + *
1546 + *  This code is stongly inspired on the iptables code which is
1547 + *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
1548 + *
1549 + *  This program is free software; you can redistribute it and/or
1550 + *  modify it under the terms of the GNU General Public License
1551 + *  as published by the Free Software Foundation; either version
1552 + *  2 of the License, or (at your option) any later version.
1553 + */
1554 +
1555 +// used for print_string
1556 +#include <linux/sched.h>
1557 +#include <linux/tty.h>
1558 +
1559 +#include <linux/kmod.h>
1560 +#include <linux/module.h>
1561 +#include <linux/vmalloc.h>
1562 +#include <linux/netfilter_bridge/ebtables.h>
1563 +#include <linux/spinlock.h>
1564 +#include <asm/uaccess.h>
1565 +#include <linux/smp.h>
1566 +#include <net/sock.h>
1567 +// needed for logical [in,out]-dev filtering
1568 +#include "../br_private.h"
1569 +
1570 +// list_named_find
1571 +#define ASSERT_READ_LOCK(x)
1572 +#define ASSERT_WRITE_LOCK(x)
1573 +#include <linux/netfilter_ipv4/listhelp.h>
1574 +
1575 +#if 0 // use this for remote debugging
1576 +// Copyright (C) 1998 by Ori Pomerantz
1577 +// Print the string to the appropriate tty, the one
1578 +// the current task uses
1579 +static void print_string(char *str)
1580 +{
1581 +       struct tty_struct *my_tty;
1582 +
1583 +       /* The tty for the current task */
1584 +       my_tty = current->tty;
1585 +       if (my_tty != NULL) {
1586 +               (*(my_tty->driver).write)(my_tty, 0, str, strlen(str));
1587 +               (*(my_tty->driver).write)(my_tty, 0, "\015\012", 2);
1588 +       }
1589 +}
1590 +
1591 +#define BUGPRINT(args) print_string(args);
1592 +#else
1593 +#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
1594 +                                         "report to author: "format, ## args)
1595 +// #define BUGPRINT(format, args...)
1596 +#endif
1597 +#define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
1598 +                                         ": out of memory: "format, ## args)
1599 +// #define MEMPRINT(format, args...)
1600 +
1601 +
1602 +
1603 +// Each cpu has its own set of counters, so there is no need for write_lock in
1604 +// the softirq
1605 +// For reading or updating the counters, the user context needs to
1606 +// get a write_lock
1607 +
1608 +// The size of each set of counters is altered to get cache alignment
1609 +#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
1610 +#define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
1611 +#define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
1612 +   COUNTER_OFFSET(n) * cpu))
1613 +
1614 +
1615 +
1616 +static DECLARE_MUTEX(ebt_mutex);
1617 +static LIST_HEAD(ebt_tables);
1618 +static LIST_HEAD(ebt_targets);
1619 +static LIST_HEAD(ebt_matches);
1620 +static LIST_HEAD(ebt_watchers);
1621 +
1622 +static struct ebt_target ebt_standard_target =
1623 +{ {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
1624 +
1625 +static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
1626 +   const struct sk_buff *skb, const struct net_device *in,
1627 +   const struct net_device *out)
1628 +{
1629 +       w->u.watcher->watcher(skb, in, out, w->data,
1630 +          w->watcher_size);
1631 +       // watchers don't give a verdict
1632 +       return 0;
1633 +}
1634 +
1635 +static inline int ebt_do_match (struct ebt_entry_match *m,
1636 +   const struct sk_buff *skb, const struct net_device *in,
1637 +   const struct net_device *out)
1638 +{
1639 +       return m->u.match->match(skb, in, out, m->data,
1640 +          m->match_size);
1641 +}
1642 +
1643 +static inline int ebt_dev_check(char *entry, const struct net_device *device)
1644 +{
1645 +       if (*entry == '\0')
1646 +               return 0;
1647 +       if (!device)
1648 +               return 1;
1649 +       return !!strcmp(entry, device->name);
1650 +}
1651 +
1652 +#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
1653 +// process standard matches
1654 +static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
1655 +   const struct net_device *in, const struct net_device *out)
1656 +{
1657 +       int verdict, i;
1658 +
1659 +       if (e->bitmask & EBT_802_3) {
1660 +               if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
1661 +                       return 1;
1662 +       } else if (!(e->bitmask & EBT_NOPROTO) &&
1663 +          FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
1664 +               return 1;
1665 +
1666 +       if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
1667 +               return 1;
1668 +       if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
1669 +               return 1;
1670 +       if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
1671 +          e->logical_in, &in->br_port->br->dev), EBT_ILOGICALIN))
1672 +               return 1;
1673 +       if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
1674 +          e->logical_out, &out->br_port->br->dev), EBT_ILOGICALOUT))
1675 +               return 1;
1676 +
1677 +       if (e->bitmask & EBT_SOURCEMAC) {
1678 +               verdict = 0;
1679 +               for (i = 0; i < 6; i++)
1680 +                       verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
1681 +                          e->sourcemsk[i];
1682 +               if (FWINV2(verdict != 0, EBT_ISOURCE) )
1683 +                       return 1;
1684 +       }
1685 +       if (e->bitmask & EBT_DESTMAC) {
1686 +               verdict = 0;
1687 +               for (i = 0; i < 6; i++)
1688 +                       verdict |= (h->h_dest[i] ^ e->destmac[i]) &
1689 +                          e->destmsk[i];
1690 +               if (FWINV2(verdict != 0, EBT_IDEST) )
1691 +                       return 1;
1692 +       }
1693 +       return 0;
1694 +}
1695 +
1696 +// Do some firewalling
1697 +unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
1698 +   const struct net_device *in, const struct net_device *out,
1699 +   struct ebt_table *table)
1700 +{
1701 +       int i, nentries;
1702 +       struct ebt_entry *point;
1703 +       struct ebt_counter *counter_base, *cb_base;
1704 +       struct ebt_entry_target *t;
1705 +       int verdict, sp = 0;
1706 +       struct ebt_chainstack *cs;
1707 +       struct ebt_entries *chaininfo;
1708 +       char *base;
1709 +       struct ebt_table_info *private = table->private;
1710 +
1711 +       read_lock_bh(&table->lock);
1712 +       cb_base = COUNTER_BASE(private->counters, private->nentries,
1713 +          cpu_number_map(smp_processor_id()));
1714 +       if (private->chainstack)
1715 +               cs = private->chainstack[cpu_number_map(smp_processor_id())];
1716 +       else
1717 +               cs = NULL;
1718 +       chaininfo = private->hook_entry[hook];
1719 +       nentries = private->hook_entry[hook]->nentries;
1720 +       point = (struct ebt_entry *)(private->hook_entry[hook]->data);
1721 +       counter_base = cb_base + private->hook_entry[hook]->counter_offset;
1722 +       // base for chain jumps
1723 +       base = (char *)chaininfo;
1724 +       i = 0;
1725 +       while (i < nentries) {
1726 +               if (ebt_basic_match(point, (**pskb).mac.ethernet, in, out))
1727 +                       goto letscontinue;
1728 +
1729 +               if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
1730 +                       goto letscontinue;
1731 +
1732 +               // increase counter
1733 +               (*(counter_base + i)).pcnt++;
1734 +               (*(counter_base + i)).bcnt+=(**pskb).len;
1735 +
1736 +               // these should only watch: not modify, nor tell us
1737 +               // what to do with the packet
1738 +               EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, in,
1739 +                  out);
1740 +
1741 +               t = (struct ebt_entry_target *)
1742 +                  (((char *)point) + point->target_offset);
1743 +               // standard target
1744 +               if (!t->u.target->target)
1745 +                       verdict = ((struct ebt_standard_target *)t)->verdict;
1746 +               else
1747 +                       verdict = t->u.target->target(pskb, hook,
1748 +                          in, out, t->data, t->target_size);
1749 +               if (verdict == EBT_ACCEPT) {
1750 +                       read_unlock_bh(&table->lock);
1751 +                       return NF_ACCEPT;
1752 +               }
1753 +               if (verdict == EBT_DROP) {
1754 +                       read_unlock_bh(&table->lock);
1755 +                       return NF_DROP;
1756 +               }
1757 +               if (verdict == EBT_RETURN) {
1758 +letsreturn:
1759 +#ifdef CONFIG_NETFILTER_DEBUG
1760 +                       if (sp == 0) {
1761 +                               BUGPRINT("RETURN on base chain");
1762 +                               // act like this is EBT_CONTINUE
1763 +                               goto letscontinue;
1764 +                       }
1765 +#endif
1766 +                       sp--;
1767 +                       // put all the local variables right
1768 +                       i = cs[sp].n;
1769 +                       chaininfo = cs[sp].chaininfo;
1770 +                       nentries = chaininfo->nentries;
1771 +                       point = cs[sp].e;
1772 +                       counter_base = cb_base +
1773 +                          chaininfo->counter_offset;
1774 +                       continue;
1775 +               }
1776 +               if (verdict == EBT_CONTINUE)
1777 +                       goto letscontinue;
1778 +#ifdef CONFIG_NETFILTER_DEBUG
1779 +               if (verdict < 0) {
1780 +                       BUGPRINT("bogus standard verdict\n");
1781 +                       read_unlock_bh(&table->lock);
1782 +                       return NF_DROP;
1783 +               }
1784 +#endif
1785 +               // jump to a udc
1786 +               cs[sp].n = i + 1;
1787 +               cs[sp].chaininfo = chaininfo;
1788 +               cs[sp].e = (struct ebt_entry *)
1789 +                  (((char *)point) + point->next_offset);
1790 +               i = 0;
1791 +               chaininfo = (struct ebt_entries *) (base + verdict);
1792 +#ifdef CONFIG_NETFILTER_DEBUG
1793 +               if (chaininfo->distinguisher) {
1794 +                       BUGPRINT("jump to non-chain\n");
1795 +                       read_unlock_bh(&table->lock);
1796 +                       return NF_DROP;
1797 +               }
1798 +#endif
1799 +               nentries = chaininfo->nentries;
1800 +               point = (struct ebt_entry *)chaininfo->data;
1801 +               counter_base = cb_base + chaininfo->counter_offset;
1802 +               sp++;
1803 +               continue;
1804 +letscontinue:
1805 +               point = (struct ebt_entry *)
1806 +                  (((char *)point) + point->next_offset);
1807 +               i++;
1808 +       }
1809 +
1810 +       // I actually like this :)
1811 +       if (chaininfo->policy == EBT_RETURN)
1812 +               goto letsreturn;
1813 +       if (chaininfo->policy == EBT_ACCEPT) {
1814 +               read_unlock_bh(&table->lock);
1815 +               return NF_ACCEPT;
1816 +       }
1817 +       read_unlock_bh(&table->lock);
1818 +       return NF_DROP;
1819 +}
1820 +
1821 +// If it succeeds, returns element and locks mutex
1822 +static inline void *
1823 +find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
1824 +   struct semaphore *mutex)
1825 +{
1826 +       void *ret;
1827 +
1828 +       *error = down_interruptible(mutex);
1829 +       if (*error != 0)
1830 +               return NULL;
1831 +
1832 +       ret = list_named_find(head, name);
1833 +       if (!ret) {
1834 +               *error = -ENOENT;
1835 +               up(mutex);
1836 +       }
1837 +       return ret;
1838 +}
1839 +
1840 +#ifndef CONFIG_KMOD
1841 +#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
1842 +#else
1843 +static void *
1844 +find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
1845 +   int *error, struct semaphore *mutex)
1846 +{
1847 +       void *ret;
1848 +
1849 +       ret = find_inlist_lock_noload(head, name, error, mutex);
1850 +       if (!ret) {
1851 +               char modulename[EBT_FUNCTION_MAXNAMELEN + strlen(prefix) + 1];
1852 +               strcpy(modulename, prefix);
1853 +               strcat(modulename, name);
1854 +               request_module(modulename);
1855 +               ret = find_inlist_lock_noload(head, name, error, mutex);
1856 +       }
1857 +       return ret;
1858 +}
1859 +#endif
1860 +
1861 +static inline struct ebt_table *
1862 +find_table_lock(const char *name, int *error, struct semaphore *mutex)
1863 +{
1864 +       return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
1865 +}
1866 +
1867 +static inline struct ebt_match *
1868 +find_match_lock(const char *name, int *error, struct semaphore *mutex)
1869 +{
1870 +       return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
1871 +}
1872 +
1873 +static inline struct ebt_watcher *
1874 +find_watcher_lock(const char *name, int *error, struct semaphore *mutex)
1875 +{
1876 +       return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
1877 +}
1878 +
1879 +static inline struct ebt_target *
1880 +find_target_lock(const char *name, int *error, struct semaphore *mutex)
1881 +{
1882 +       return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
1883 +}
1884 +
1885 +static inline int
1886 +ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
1887 +   const char *name, unsigned int hookmask, unsigned int *cnt)
1888 +{
1889 +       struct ebt_match *match;
1890 +       int ret;
1891 +
1892 +       if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
1893 +          ((char *)e) + e->watchers_offset)
1894 +               return -EINVAL;
1895 +       match = find_match_lock(m->u.name, &ret, &ebt_mutex);
1896 +       if (!match)
1897 +               return ret;
1898 +       m->u.match = match;
1899 +       if (match->me)
1900 +               __MOD_INC_USE_COUNT(match->me);
1901 +       up(&ebt_mutex);
1902 +       if (match->check &&
1903 +          match->check(name, hookmask, e, m->data, m->match_size) != 0) {
1904 +               BUGPRINT("match->check failed\n");
1905 +               if (match->me)
1906 +                       __MOD_DEC_USE_COUNT(match->me);
1907 +               return -EINVAL;
1908 +       }
1909 +       (*cnt)++;
1910 +       return 0;
1911 +}
1912 +
1913 +static inline int
1914 +ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
1915 +   const char *name, unsigned int hookmask, unsigned int *cnt)
1916 +{
1917 +       struct ebt_watcher *watcher;
1918 +       int ret;
1919 +
1920 +       if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
1921 +          ((char *)e) + e->target_offset)
1922 +               return -EINVAL;
1923 +       watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
1924 +       if (!watcher)
1925 +               return ret;
1926 +       w->u.watcher = watcher;
1927 +       if (watcher->me)
1928 +               __MOD_INC_USE_COUNT(watcher->me);
1929 +       up(&ebt_mutex);
1930 +       if (watcher->check &&
1931 +          watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
1932 +               BUGPRINT("watcher->check failed\n");
1933 +               if (watcher->me)
1934 +                       __MOD_DEC_USE_COUNT(watcher->me);
1935 +               return -EINVAL;
1936 +       }
1937 +       (*cnt)++;
1938 +       return 0;
1939 +}
1940 +
1941 +// this one is very careful, as it is the first function
1942 +// to parse the userspace data
1943 +static inline int
1944 +ebt_check_entry_size_and_hooks(struct ebt_entry *e,
1945 +   struct ebt_table_info *newinfo, char *base, char *limit,
1946 +   struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
1947 +   unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
1948 +{
1949 +       int i;
1950 +
1951 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1952 +               if ((valid_hooks & (1 << i)) == 0)
1953 +                       continue;
1954 +               if ( (char *)hook_entries[i] - base ==
1955 +                  (char *)e - newinfo->entries)
1956 +                       break;
1957 +       }
1958 +       // beginning of a new chain
1959 +       // if i == NF_BR_NUMHOOKS it must be a user defined chain
1960 +       if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
1961 +               if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
1962 +                       // we make userspace set this right,
1963 +                       // so there is no misunderstanding
1964 +                       BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
1965 +                                "in distinguisher\n");
1966 +                       return -EINVAL;
1967 +               }
1968 +               // this checks if the previous chain has as many entries
1969 +               // as it said it has
1970 +               if (*n != *cnt) {
1971 +                       BUGPRINT("nentries does not equal the nr of entries "
1972 +                                "in the chain\n");
1973 +                       return -EINVAL;
1974 +               }
1975 +               // before we look at the struct, be sure it is not too big
1976 +               if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
1977 +                  > limit) {
1978 +                       BUGPRINT("entries_size too small\n");
1979 +                       return -EINVAL;
1980 +               }
1981 +               if (((struct ebt_entries *)e)->policy != EBT_DROP &&
1982 +                  ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
1983 +                       // only RETURN from udc
1984 +                       if (i != NF_BR_NUMHOOKS ||
1985 +                          ((struct ebt_entries *)e)->policy != EBT_RETURN) {
1986 +                               BUGPRINT("bad policy\n");
1987 +                               return -EINVAL;
1988 +                       }
1989 +               }
1990 +               if (i == NF_BR_NUMHOOKS) // it's a user defined chain
1991 +                       (*udc_cnt)++;
1992 +               else
1993 +                       newinfo->hook_entry[i] = (struct ebt_entries *)e;
1994 +               if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
1995 +                       BUGPRINT("counter_offset != totalcnt");
1996 +                       return -EINVAL;
1997 +               }
1998 +               *n = ((struct ebt_entries *)e)->nentries;
1999 +               *cnt = 0;
2000 +               return 0;
2001 +       }
2002 +       // a plain old entry, heh
2003 +       if (sizeof(struct ebt_entry) > e->watchers_offset ||
2004 +          e->watchers_offset > e->target_offset ||
2005 +          e->target_offset >= e->next_offset) {
2006 +               BUGPRINT("entry offsets not in right order\n");
2007 +               return -EINVAL;
2008 +       }
2009 +       // this is not checked anywhere else
2010 +       if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
2011 +               BUGPRINT("target size too small\n");
2012 +               return -EINVAL;
2013 +       }
2014 +
2015 +       (*cnt)++;
2016 +       (*totalcnt)++;
2017 +       return 0;
2018 +}
2019 +
2020 +struct ebt_cl_stack
2021 +{
2022 +       struct ebt_chainstack cs;
2023 +       int from;
2024 +       unsigned int hookmask;
2025 +};
2026 +
2027 +// we need these positions to check that the jumps to a different part of the
2028 +// entries is a jump to the beginning of a new chain.
2029 +static inline int
2030 +ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
2031 +   struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
2032 +   struct ebt_cl_stack *udc)
2033 +{
2034 +       int i;
2035 +
2036 +       // we're only interested in chain starts
2037 +       if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
2038 +               return 0;
2039 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2040 +               if ((valid_hooks & (1 << i)) == 0)
2041 +                       continue;
2042 +               if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
2043 +                       break;
2044 +       }
2045 +       // only care about udc
2046 +       if (i != NF_BR_NUMHOOKS)
2047 +               return 0;
2048 +
2049 +       udc[*n].cs.chaininfo = (struct ebt_entries *)e;
2050 +       // these initialisations are depended on later in check_chainloops()
2051 +       udc[*n].cs.n = 0;
2052 +       udc[*n].hookmask = 0;
2053 +
2054 +       (*n)++;
2055 +       return 0;
2056 +}
2057 +
2058 +static inline int
2059 +ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
2060 +{
2061 +       if (i && (*i)-- == 0)
2062 +               return 1;
2063 +       if (m->u.match->destroy)
2064 +               m->u.match->destroy(m->data, m->match_size);
2065 +       if (m->u.match->me)
2066 +               __MOD_DEC_USE_COUNT(m->u.match->me);
2067 +
2068 +       return 0;
2069 +}
2070 +
2071 +static inline int
2072 +ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
2073 +{
2074 +       if (i && (*i)-- == 0)
2075 +               return 1;
2076 +       if (w->u.watcher->destroy)
2077 +               w->u.watcher->destroy(w->data, w->watcher_size);
2078 +       if (w->u.watcher->me)
2079 +               __MOD_DEC_USE_COUNT(w->u.watcher->me);
2080 +
2081 +       return 0;
2082 +}
2083 +
2084 +static inline int
2085 +ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
2086 +{
2087 +       struct ebt_entry_target *t;
2088 +
2089 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
2090 +               return 0;
2091 +       // we're done
2092 +       if (cnt && (*cnt)-- == 0)
2093 +               return 1;
2094 +       EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
2095 +       EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
2096 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
2097 +       if (t->u.target->destroy)
2098 +               t->u.target->destroy(t->data, t->target_size);
2099 +       if (t->u.target->me)
2100 +               __MOD_DEC_USE_COUNT(t->u.target->me);
2101 +
2102 +       return 0;
2103 +}
2104 +
2105 +static inline int
2106 +ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
2107 +   const char *name, unsigned int *cnt, unsigned int valid_hooks,
2108 +   struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
2109 +{
2110 +       struct ebt_entry_target *t;
2111 +       struct ebt_target *target;
2112 +       unsigned int i, j, hook = 0, hookmask = 0;
2113 +       int ret;
2114 +
2115 +       // Don't mess with the struct ebt_entries
2116 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
2117 +               return 0;
2118 +
2119 +       if (e->bitmask & ~EBT_F_MASK) {
2120 +               BUGPRINT("Unknown flag for bitmask\n");
2121 +               return -EINVAL;
2122 +       }
2123 +       if (e->invflags & ~EBT_INV_MASK) {
2124 +               BUGPRINT("Unknown flag for inv bitmask\n");
2125 +               return -EINVAL;
2126 +       }
2127 +       if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
2128 +               BUGPRINT("NOPROTO & 802_3 not allowed\n");
2129 +               return -EINVAL;
2130 +       }
2131 +       // what hook do we belong to?
2132 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2133 +               if ((valid_hooks & (1 << i)) == 0)
2134 +                       continue;
2135 +               if ((char *)newinfo->hook_entry[i] < (char *)e)
2136 +                       hook = i;
2137 +               else
2138 +                       break;
2139 +       }
2140 +       // (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
2141 +       // a base chain
2142 +       if (i < NF_BR_NUMHOOKS)
2143 +               hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
2144 +       else {
2145 +               for (i = 0; i < udc_cnt; i++)
2146 +                       if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
2147 +                               break;
2148 +               if (i == 0)
2149 +                       hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
2150 +               else
2151 +                       hookmask = cl_s[i - 1].hookmask;
2152 +       }
2153 +       i = 0;
2154 +       ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
2155 +       if (ret != 0)
2156 +               goto cleanup_matches;
2157 +       j = 0;
2158 +       ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
2159 +       if (ret != 0)
2160 +               goto cleanup_watchers;
2161 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
2162 +       target = find_target_lock(t->u.name, &ret, &ebt_mutex);
2163 +       if (!target)
2164 +               goto cleanup_watchers;
2165 +       if (target->me)
2166 +               __MOD_INC_USE_COUNT(target->me);
2167 +       up(&ebt_mutex);
2168 +
2169 +       t->u.target = target;
2170 +       if (t->u.target == &ebt_standard_target) {
2171 +               if (e->target_offset + sizeof(struct ebt_standard_target) >
2172 +                  e->next_offset) {
2173 +                       BUGPRINT("Standard target size too big\n");
2174 +                       ret = -EFAULT;
2175 +                       goto cleanup_watchers;
2176 +               }
2177 +               if (((struct ebt_standard_target *)t)->verdict <
2178 +                  -NUM_STANDARD_TARGETS) {
2179 +                       BUGPRINT("Invalid standard target\n");
2180 +                       ret = -EFAULT;
2181 +                       goto cleanup_watchers;
2182 +               }
2183 +       } else if ((e->target_offset + t->target_size +
2184 +          sizeof(struct ebt_entry_target) > e->next_offset) ||
2185 +          (t->u.target->check &&
2186 +          t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
2187 +               if (t->u.target->me)
2188 +                       __MOD_DEC_USE_COUNT(t->u.target->me);
2189 +               ret = -EFAULT;
2190 +               goto cleanup_watchers;
2191 +       }
2192 +       (*cnt)++;
2193 +       return 0;
2194 +cleanup_watchers:
2195 +       EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
2196 +cleanup_matches:
2197 +       EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
2198 +       return ret;
2199 +}
2200 +
2201 +// checks for loops and sets the hook mask for udc
2202 +// the hook mask for udc tells us from which base chains the udc can be
2203 +// accessed. This mask is a parameter to the check() functions of the extensions
2204 +int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
2205 +   unsigned int udc_cnt, unsigned int hooknr, char *base)
2206 +{
2207 +       int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
2208 +       struct ebt_entry *e = (struct ebt_entry *)chain->data;
2209 +       struct ebt_entry_target *t;
2210 +
2211 +       while (pos < nentries || chain_nr != -1) {
2212 +               // end of udc, go back one 'recursion' step
2213 +               if (pos == nentries) {
2214 +                       // put back values of the time when this chain was called
2215 +                       e = cl_s[chain_nr].cs.e;
2216 +                       if (cl_s[chain_nr].from != -1)
2217 +                               nentries =
2218 +                               cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
2219 +                       else
2220 +                               nentries = chain->nentries;
2221 +                       pos = cl_s[chain_nr].cs.n;
2222 +                       // make sure we won't see a loop that isn't one
2223 +                       cl_s[chain_nr].cs.n = 0;
2224 +                       chain_nr = cl_s[chain_nr].from;
2225 +                       if (pos == nentries)
2226 +                               continue;
2227 +               }
2228 +               t = (struct ebt_entry_target *)
2229 +                  (((char *)e) + e->target_offset);
2230 +               if (strcmp(t->u.name, EBT_STANDARD_TARGET))
2231 +                       goto letscontinue;
2232 +               if (e->target_offset + sizeof(struct ebt_standard_target) >
2233 +                  e->next_offset) {
2234 +                       BUGPRINT("Standard target size too big\n");
2235 +                       return -1;
2236 +               }
2237 +               verdict = ((struct ebt_standard_target *)t)->verdict;
2238 +               if (verdict >= 0) { // jump to another chain
2239 +                       struct ebt_entries *hlp2 =
2240 +                          (struct ebt_entries *)(base + verdict);
2241 +                       for (i = 0; i < udc_cnt; i++)
2242 +                               if (hlp2 == cl_s[i].cs.chaininfo)
2243 +                                       break;
2244 +                       // bad destination or loop
2245 +                       if (i == udc_cnt) {
2246 +                               BUGPRINT("bad destination\n");
2247 +                               return -1;
2248 +                       }
2249 +                       if (cl_s[i].cs.n) {
2250 +                               BUGPRINT("loop\n");
2251 +                               return -1;
2252 +                       }
2253 +                       // this can't be 0, so the above test is correct
2254 +                       cl_s[i].cs.n = pos + 1;
2255 +                       pos = 0;
2256 +                       cl_s[i].cs.e = ((void *)e + e->next_offset);
2257 +                       e = (struct ebt_entry *)(hlp2->data);
2258 +                       nentries = hlp2->nentries;
2259 +                       cl_s[i].from = chain_nr;
2260 +                       chain_nr = i;
2261 +                       // this udc is accessible from the base chain for hooknr
2262 +                       cl_s[i].hookmask |= (1 << hooknr);
2263 +                       continue;
2264 +               }
2265 +letscontinue:
2266 +               e = (void *)e + e->next_offset;
2267 +               pos++;
2268 +       }
2269 +       return 0;
2270 +}
2271 +
2272 +// do the parsing of the table/chains/entries/matches/watchers/targets, heh
2273 +static int translate_table(struct ebt_replace *repl,
2274 +   struct ebt_table_info *newinfo)
2275 +{
2276 +       unsigned int i, j, k, udc_cnt;
2277 +       int ret;
2278 +       struct ebt_cl_stack *cl_s = NULL; // used in the checking for chain loops
2279 +
2280 +       i = 0;
2281 +       while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
2282 +               i++;
2283 +       if (i == NF_BR_NUMHOOKS) {
2284 +               BUGPRINT("No valid hooks specified\n");
2285 +               return -EINVAL;
2286 +       }
2287 +       if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
2288 +               BUGPRINT("Chains don't start at beginning\n");
2289 +               return -EINVAL;
2290 +       }
2291 +       // make sure chains are ordered after each other in same order
2292 +       // as their corresponding hooks
2293 +       for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
2294 +               if (!(repl->valid_hooks & (1 << j)))
2295 +                       continue;
2296 +               if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
2297 +                       BUGPRINT("Hook order must be followed\n");
2298 +                       return -EINVAL;
2299 +               }
2300 +               i = j;
2301 +       }
2302 +
2303 +       for (i = 0; i < NF_BR_NUMHOOKS; i++)
2304 +               newinfo->hook_entry[i] = NULL;
2305 +
2306 +       newinfo->entries_size = repl->entries_size;
2307 +       newinfo->nentries = repl->nentries;
2308 +
2309 +       // do some early checkings and initialize some things
2310 +       i = 0; // holds the expected nr. of entries for the chain
2311 +       j = 0; // holds the up to now counted entries for the chain
2312 +       k = 0; // holds the total nr. of entries, should equal
2313 +              // newinfo->nentries afterwards
2314 +       udc_cnt = 0; // will hold the nr. of user defined chains (udc)
2315 +       ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2316 +          ebt_check_entry_size_and_hooks, newinfo, repl->entries,
2317 +          repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
2318 +          &udc_cnt, repl->valid_hooks);
2319 +
2320 +       if (ret != 0)
2321 +               return ret;
2322 +
2323 +       if (i != j) {
2324 +               BUGPRINT("nentries does not equal the nr of entries in the "
2325 +                        "(last) chain\n");
2326 +               return -EINVAL;
2327 +       }
2328 +       if (k != newinfo->nentries) {
2329 +               BUGPRINT("Total nentries is wrong\n");
2330 +               return -EINVAL;
2331 +       }
2332 +
2333 +       // check if all valid hooks have a chain
2334 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2335 +               if (newinfo->hook_entry[i] == NULL &&
2336 +                  (repl->valid_hooks & (1 << i))) {
2337 +                       BUGPRINT("Valid hook without chain\n");
2338 +                       return -EINVAL;
2339 +               }
2340 +       }
2341 +
2342 +       // Get the location of the udc, put them in an array
2343 +       // While we're at it, allocate the chainstack
2344 +       if (udc_cnt) {
2345 +               // this will get free'd in do_replace()/ebt_register_table()
2346 +               // if an error occurs
2347 +               newinfo->chainstack = (struct ebt_chainstack **)
2348 +                  vmalloc(smp_num_cpus * sizeof(struct ebt_chainstack));
2349 +               if (!newinfo->chainstack)
2350 +                       return -ENOMEM;
2351 +               for (i = 0; i < smp_num_cpus; i++) {
2352 +                       newinfo->chainstack[i] =
2353 +                          vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
2354 +                       if (!newinfo->chainstack[i]) {
2355 +                               while (i)
2356 +                                       vfree(newinfo->chainstack[--i]);
2357 +                               vfree(newinfo->chainstack);
2358 +                               newinfo->chainstack = NULL;
2359 +                               return -ENOMEM;
2360 +                       }
2361 +               }
2362 +
2363 +               cl_s = (struct ebt_cl_stack *)
2364 +                  vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
2365 +               if (!cl_s)
2366 +                       return -ENOMEM;
2367 +               i = 0; // the i'th udc
2368 +               EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2369 +                  ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
2370 +                  repl->valid_hooks, cl_s);
2371 +               // sanity check
2372 +               if (i != udc_cnt) {
2373 +                       BUGPRINT("i != udc_cnt\n");
2374 +                       vfree(cl_s);
2375 +                       return -EFAULT;
2376 +               }
2377 +       }
2378 +
2379 +       // Check for loops
2380 +       for (i = 0; i < NF_BR_NUMHOOKS; i++)
2381 +               if (repl->valid_hooks & (1 << i))
2382 +                       if (check_chainloops(newinfo->hook_entry[i],
2383 +                          cl_s, udc_cnt, i, newinfo->entries)) {
2384 +                               if (cl_s)
2385 +                                       vfree(cl_s);
2386 +                               return -EINVAL;
2387 +                       }
2388 +
2389 +       // we now know the following (along with E=mc²):
2390 +       // - the nr of entries in each chain is right
2391 +       // - the size of the allocated space is right
2392 +       // - all valid hooks have a corresponding chain
2393 +       // - there are no loops
2394 +       // - wrong data can still be on the level of a single entry
2395 +       // - could be there are jumps to places that are not the
2396 +       //   beginning of a chain. This can only occur in chains that
2397 +       //   are not accessible from any base chains, so we don't care.
2398 +
2399 +       // used to know what we need to clean up if something goes wrong
2400 +       i = 0;
2401 +       ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2402 +          ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
2403 +          cl_s, udc_cnt);
2404 +       if (ret != 0) {
2405 +               EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2406 +                  ebt_cleanup_entry, &i);
2407 +       }
2408 +       if (cl_s)
2409 +               vfree(cl_s);
2410 +       return ret;
2411 +}
2412 +
2413 +// called under write_lock
2414 +static void get_counters(struct ebt_counter *oldcounters,
2415 +   struct ebt_counter *counters, unsigned int nentries)
2416 +{
2417 +       int i, cpu;
2418 +       struct ebt_counter *counter_base;
2419 +
2420 +       // counters of cpu 0
2421 +       memcpy(counters, oldcounters,
2422 +          sizeof(struct ebt_counter) * nentries);
2423 +       // add other counters to those of cpu 0
2424 +       for (cpu = 1; cpu < smp_num_cpus; cpu++) {
2425 +               counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
2426 +               for (i = 0; i < nentries; i++) {
2427 +                       counters[i].pcnt += counter_base[i].pcnt;
2428 +                       counters[i].bcnt += counter_base[i].bcnt;
2429 +               }
2430 +       }
2431 +}
2432 +
2433 +// replace the table
2434 +static int do_replace(void *user, unsigned int len)
2435 +{
2436 +       int ret, i, countersize;
2437 +       struct ebt_table_info *newinfo;
2438 +       struct ebt_replace tmp;
2439 +       struct ebt_table *t;
2440 +       struct ebt_counter *counterstmp = NULL;
2441 +       // used to be able to unlock earlier
2442 +       struct ebt_table_info *table;
2443 +
2444 +       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
2445 +               return -EFAULT;
2446 +
2447 +       if (len != sizeof(tmp) + tmp.entries_size) {
2448 +               BUGPRINT("Wrong len argument\n");
2449 +               return -EINVAL;
2450 +       }
2451 +
2452 +       if (tmp.entries_size == 0) {
2453 +               BUGPRINT("Entries_size never zero\n");
2454 +               return -EINVAL;
2455 +       }
2456 +       countersize = COUNTER_OFFSET(tmp.nentries) * smp_num_cpus;
2457 +       newinfo = (struct ebt_table_info *)
2458 +          vmalloc(sizeof(struct ebt_table_info) + countersize);
2459 +       if (!newinfo)
2460 +               return -ENOMEM;
2461 +
2462 +       if (countersize)
2463 +               memset(newinfo->counters, 0, countersize);
2464 +
2465 +       newinfo->entries = (char *)vmalloc(tmp.entries_size);
2466 +       if (!newinfo->entries) {
2467 +               ret = -ENOMEM;
2468 +               goto free_newinfo;
2469 +       }
2470 +       if (copy_from_user(
2471 +          newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
2472 +               BUGPRINT("Couldn't copy entries from userspace\n");
2473 +               ret = -EFAULT;
2474 +               goto free_entries;
2475 +       }
2476 +
2477 +       // the user wants counters back
2478 +       // the check on the size is done later, when we have the lock
2479 +       if (tmp.num_counters) {
2480 +               counterstmp = (struct ebt_counter *)
2481 +                  vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
2482 +               if (!counterstmp) {
2483 +                       ret = -ENOMEM;
2484 +                       goto free_entries;
2485 +               }
2486 +       }
2487 +       else
2488 +               counterstmp = NULL;
2489 +
2490 +       // this can get initialized by translate_table()
2491 +       newinfo->chainstack = NULL;
2492 +       ret = translate_table(&tmp, newinfo);
2493 +
2494 +       if (ret != 0)
2495 +               goto free_counterstmp;
2496 +
2497 +       t = find_table_lock(tmp.name, &ret, &ebt_mutex);
2498 +       if (!t)
2499 +               goto free_iterate;
2500 +
2501 +       // the table doesn't like it
2502 +       if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
2503 +               goto free_unlock;
2504 +
2505 +       if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
2506 +               BUGPRINT("Wrong nr. of counters requested\n");
2507 +               ret = -EINVAL;
2508 +               goto free_unlock;
2509 +       }
2510 +
2511 +       // we have the mutex lock, so no danger in reading this pointer
2512 +       table = t->private;
2513 +       // we need an atomic snapshot of the counters
2514 +       write_lock_bh(&t->lock);
2515 +       if (tmp.num_counters)
2516 +               get_counters(t->private->counters, counterstmp,
2517 +                  t->private->nentries);
2518 +
2519 +       t->private = newinfo;
2520 +       write_unlock_bh(&t->lock);
2521 +       up(&ebt_mutex);
2522 +       // So, a user can change the chains while having messed up her counter
2523 +       // allocation. Only reason why this is done is because this way the lock
2524 +       // is held only once, while this doesn't bring the kernel into a
2525 +       // dangerous state.
2526 +       if (tmp.num_counters &&
2527 +          copy_to_user(tmp.counters, counterstmp,
2528 +          tmp.num_counters * sizeof(struct ebt_counter))) {
2529 +               BUGPRINT("Couldn't copy counters to userspace\n");
2530 +               ret = -EFAULT;
2531 +       }
2532 +       else
2533 +               ret = 0;
2534 +
2535 +       // decrease module count and free resources
2536 +       EBT_ENTRY_ITERATE(table->entries, table->entries_size,
2537 +          ebt_cleanup_entry, NULL);
2538 +
2539 +       vfree(table->entries);
2540 +       if (table->chainstack) {
2541 +               for (i = 0; i < smp_num_cpus; i++)
2542 +                       vfree(table->chainstack[i]);
2543 +               vfree(table->chainstack);
2544 +       }
2545 +       vfree(table);
2546 +
2547 +       if (counterstmp)
2548 +               vfree(counterstmp);
2549 +       return ret;
2550 +
2551 +free_unlock:
2552 +       up(&ebt_mutex);
2553 +free_iterate:
2554 +       EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2555 +          ebt_cleanup_entry, NULL);
2556 +free_counterstmp:
2557 +       if (counterstmp)
2558 +               vfree(counterstmp);
2559 +       // can be initialized in translate_table()
2560 +       if (newinfo->chainstack) {
2561 +               for (i = 0; i < smp_num_cpus; i++)
2562 +                       vfree(newinfo->chainstack[i]);
2563 +               vfree(newinfo->chainstack);
2564 +       }
2565 +free_entries:
2566 +       if (newinfo->entries)
2567 +               vfree(newinfo->entries);
2568 +free_newinfo:
2569 +       if (newinfo)
2570 +               vfree(newinfo);
2571 +       return ret;
2572 +}
2573 +
2574 +int ebt_register_target(struct ebt_target *target)
2575 +{
2576 +       int ret;
2577 +
2578 +       ret = down_interruptible(&ebt_mutex);
2579 +       if (ret != 0)
2580 +               return ret;
2581 +       if (!list_named_insert(&ebt_targets, target)) {
2582 +               up(&ebt_mutex);
2583 +               return -EEXIST;
2584 +       }
2585 +       up(&ebt_mutex);
2586 +       MOD_INC_USE_COUNT;
2587 +
2588 +       return 0;
2589 +}
2590 +
2591 +void ebt_unregister_target(struct ebt_target *target)
2592 +{
2593 +       down(&ebt_mutex);
2594 +       LIST_DELETE(&ebt_targets, target);
2595 +       up(&ebt_mutex);
2596 +       MOD_DEC_USE_COUNT;
2597 +}
2598 +
2599 +int ebt_register_match(struct ebt_match *match)
2600 +{
2601 +       int ret;
2602 +
2603 +       ret = down_interruptible(&ebt_mutex);
2604 +       if (ret != 0)
2605 +               return ret;
2606 +       if (!list_named_insert(&ebt_matches, match)) {
2607 +               up(&ebt_mutex);
2608 +               return -EEXIST;
2609 +       }
2610 +       up(&ebt_mutex);
2611 +       MOD_INC_USE_COUNT;
2612 +
2613 +       return 0;
2614 +}
2615 +
2616 +void ebt_unregister_match(struct ebt_match *match)
2617 +{
2618 +       down(&ebt_mutex);
2619 +       LIST_DELETE(&ebt_matches, match);
2620 +       up(&ebt_mutex);
2621 +       MOD_DEC_USE_COUNT;
2622 +}
2623 +
2624 +int ebt_register_watcher(struct ebt_watcher *watcher)
2625 +{
2626 +       int ret;
2627 +
2628 +       ret = down_interruptible(&ebt_mutex);
2629 +       if (ret != 0)
2630 +               return ret;
2631 +       if (!list_named_insert(&ebt_watchers, watcher)) {
2632 +               up(&ebt_mutex);
2633 +               return -EEXIST;
2634 +       }
2635 +       up(&ebt_mutex);
2636 +       MOD_INC_USE_COUNT;
2637 +
2638 +       return 0;
2639 +}
2640 +
2641 +void ebt_unregister_watcher(struct ebt_watcher *watcher)
2642 +{
2643 +       down(&ebt_mutex);
2644 +       LIST_DELETE(&ebt_watchers, watcher);
2645 +       up(&ebt_mutex);
2646 +       MOD_DEC_USE_COUNT;
2647 +}
2648 +
2649 +int ebt_register_table(struct ebt_table *table)
2650 +{
2651 +       struct ebt_table_info *newinfo;
2652 +       int ret, i, countersize;
2653 +
2654 +       if (!table || !table->table ||!table->table->entries ||
2655 +           table->table->entries_size == 0 ||
2656 +           table->table->counters || table->private) {
2657 +               BUGPRINT("Bad table data for ebt_register_table!!!\n");
2658 +               return -EINVAL;
2659 +       }
2660 +
2661 +       countersize = COUNTER_OFFSET(table->table->nentries) * smp_num_cpus;
2662 +       newinfo = (struct ebt_table_info *)
2663 +          vmalloc(sizeof(struct ebt_table_info) + countersize);
2664 +       ret = -ENOMEM;
2665 +       if (!newinfo)
2666 +               return -ENOMEM;
2667 +
2668 +       newinfo->entries = (char *)vmalloc(table->table->entries_size);
2669 +       if (!(newinfo->entries))
2670 +               goto free_newinfo;
2671 +
2672 +       memcpy(newinfo->entries, table->table->entries,
2673 +          table->table->entries_size);
2674 +
2675 +       if (countersize)
2676 +               memset(newinfo->counters, 0, countersize);
2677 +
2678 +       // fill in newinfo and parse the entries
2679 +       newinfo->chainstack = NULL;
2680 +       ret = translate_table(table->table, newinfo);
2681 +       if (ret != 0) {
2682 +               BUGPRINT("Translate_table failed\n");
2683 +               goto free_chainstack;
2684 +       }
2685 +
2686 +       if (table->check && table->check(newinfo, table->valid_hooks)) {
2687 +               BUGPRINT("The table doesn't like its own initial data, lol\n");
2688 +               return -EINVAL;
2689 +       }
2690 +
2691 +       table->private = newinfo;
2692 +       table->lock = RW_LOCK_UNLOCKED;
2693 +       ret = down_interruptible(&ebt_mutex);
2694 +       if (ret != 0)
2695 +               goto free_chainstack;
2696 +
2697 +       if (list_named_find(&ebt_tables, table->name)) {
2698 +               ret = -EEXIST;
2699 +               BUGPRINT("Table name already exists\n");
2700 +               goto free_unlock;
2701 +       }
2702 +
2703 +       list_prepend(&ebt_tables, table);
2704 +       up(&ebt_mutex);
2705 +       MOD_INC_USE_COUNT;
2706 +       return 0;
2707 +free_unlock:
2708 +       up(&ebt_mutex);
2709 +free_chainstack:
2710 +       if (newinfo->chainstack) {
2711 +               for (i = 0; i < smp_num_cpus; i++)
2712 +                       vfree(newinfo->chainstack[i]);
2713 +               vfree(newinfo->chainstack);
2714 +       }
2715 +       vfree(newinfo->entries);
2716 +free_newinfo:
2717 +       vfree(newinfo);
2718 +       return ret;
2719 +}
2720 +
2721 +void ebt_unregister_table(struct ebt_table *table)
2722 +{
2723 +       int i;
2724 +
2725 +       if (!table) {
2726 +               BUGPRINT("Request to unregister NULL table!!!\n");
2727 +               return;
2728 +       }
2729 +       down(&ebt_mutex);
2730 +       LIST_DELETE(&ebt_tables, table);
2731 +       up(&ebt_mutex);
2732 +       EBT_ENTRY_ITERATE(table->private->entries,
2733 +          table->private->entries_size, ebt_cleanup_entry, NULL);
2734 +       if (table->private->entries)
2735 +               vfree(table->private->entries);
2736 +       if (table->private->chainstack) {
2737 +               for (i = 0; i < smp_num_cpus; i++)
2738 +                       vfree(table->private->chainstack[i]);
2739 +               vfree(table->private->chainstack);
2740 +       }
2741 +       vfree(table->private);
2742 +       MOD_DEC_USE_COUNT;
2743 +}
2744 +
2745 +// userspace just supplied us with counters
2746 +static int update_counters(void *user, unsigned int len)
2747 +{
2748 +       int i, ret;
2749 +       struct ebt_counter *tmp;
2750 +       struct ebt_replace hlp;
2751 +       struct ebt_table *t;
2752 +
2753 +       if (copy_from_user(&hlp, user, sizeof(hlp)))
2754 +               return -EFAULT;
2755 +
2756 +       if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
2757 +               return -EINVAL;
2758 +       if (hlp.num_counters == 0)
2759 +               return -EINVAL;
2760 +
2761 +       if ( !(tmp = (struct ebt_counter *)
2762 +          vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
2763 +               MEMPRINT("Update_counters && nomemory\n");
2764 +               return -ENOMEM;
2765 +       }
2766 +
2767 +       t = find_table_lock(hlp.name, &ret, &ebt_mutex);
2768 +       if (!t)
2769 +               goto free_tmp;
2770 +
2771 +       if (hlp.num_counters != t->private->nentries) {
2772 +               BUGPRINT("Wrong nr of counters\n");
2773 +               ret = -EINVAL;
2774 +               goto unlock_mutex;
2775 +       }
2776 +
2777 +       if ( copy_from_user(tmp, hlp.counters,
2778 +          hlp.num_counters * sizeof(struct ebt_counter)) ) {
2779 +               BUGPRINT("Updata_counters && !cfu\n");
2780 +               ret = -EFAULT;
2781 +               goto unlock_mutex;
2782 +       }
2783 +
2784 +       // we want an atomic add of the counters
2785 +       write_lock_bh(&t->lock);
2786 +
2787 +       // we add to the counters of the first cpu
2788 +       for (i = 0; i < hlp.num_counters; i++) {
2789 +               t->private->counters[i].pcnt += tmp[i].pcnt;
2790 +               t->private->counters[i].bcnt += tmp[i].bcnt;
2791 +       }
2792 +
2793 +       write_unlock_bh(&t->lock);
2794 +       ret = 0;
2795 +unlock_mutex:
2796 +       up(&ebt_mutex);
2797 +free_tmp:
2798 +       vfree(tmp);
2799 +       return ret;
2800 +}
2801 +
2802 +static inline int ebt_make_matchname(struct ebt_entry_match *m,
2803 +   char *base, char *ubase)
2804 +{
2805 +       char *hlp = ubase - base + (char *)m;
2806 +       if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
2807 +               return -EFAULT;
2808 +       return 0;
2809 +}
2810 +
2811 +static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
2812 +   char *base, char *ubase)
2813 +{
2814 +       char *hlp = ubase - base + (char *)w;
2815 +       if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
2816 +               return -EFAULT;
2817 +       return 0;
2818 +}
2819 +
2820 +static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
2821 +{
2822 +       int ret;
2823 +       char *hlp;
2824 +       struct ebt_entry_target *t;
2825 +
2826 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
2827 +               return 0;
2828 +
2829 +       hlp = ubase - base + (char *)e + e->target_offset;
2830 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
2831 +
2832 +       ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
2833 +       if (ret != 0)
2834 +               return ret;
2835 +       ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
2836 +       if (ret != 0)
2837 +               return ret;
2838 +       if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
2839 +               return -EFAULT;
2840 +       return 0;
2841 +}
2842 +
2843 +// called with ebt_mutex down
2844 +static int copy_everything_to_user(struct ebt_table *t, void *user,
2845 +   int *len, int cmd)
2846 +{
2847 +       struct ebt_replace tmp;
2848 +       struct ebt_counter *counterstmp, *oldcounters;
2849 +       unsigned int entries_size, nentries;
2850 +       char *entries;
2851 +
2852 +       if (cmd == EBT_SO_GET_ENTRIES) {
2853 +               entries_size = t->private->entries_size;
2854 +               nentries = t->private->nentries;
2855 +               entries = t->private->entries;
2856 +               oldcounters = t->private->counters;
2857 +       } else {
2858 +               entries_size = t->table->entries_size;
2859 +               nentries = t->table->nentries;
2860 +               entries = t->table->entries;
2861 +               oldcounters = t->table->counters;
2862 +       }
2863 +
2864 +       if (copy_from_user(&tmp, user, sizeof(tmp))) {
2865 +               BUGPRINT("Cfu didn't work\n");
2866 +               return -EFAULT;
2867 +       }
2868 +
2869 +       if (*len != sizeof(struct ebt_replace) + entries_size +
2870 +          (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
2871 +               BUGPRINT("Wrong size\n");
2872 +               return -EINVAL;
2873 +       }
2874 +
2875 +       if (tmp.nentries != nentries) {
2876 +               BUGPRINT("Nentries wrong\n");
2877 +               return -EINVAL;
2878 +       }
2879 +
2880 +       if (tmp.entries_size != entries_size) {
2881 +               BUGPRINT("Wrong size\n");
2882 +               return -EINVAL;
2883 +       }
2884 +
2885 +       // userspace might not need the counters
2886 +       if (tmp.num_counters) {
2887 +               if (tmp.num_counters != nentries) {
2888 +                       BUGPRINT("Num_counters wrong\n");
2889 +                       return -EINVAL;
2890 +               }
2891 +               counterstmp = (struct ebt_counter *)
2892 +                  vmalloc(nentries * sizeof(struct ebt_counter));
2893 +               if (!counterstmp) {
2894 +                       MEMPRINT("Couldn't copy counters, out of memory\n");
2895 +                       return -ENOMEM;
2896 +               }
2897 +               write_lock_bh(&t->lock);
2898 +               get_counters(oldcounters, counterstmp, nentries);
2899 +               write_unlock_bh(&t->lock);
2900 +
2901 +               if (copy_to_user(tmp.counters, counterstmp,
2902 +                  nentries * sizeof(struct ebt_counter))) {
2903 +                       BUGPRINT("Couldn't copy counters to userspace\n");
2904 +                       vfree(counterstmp);
2905 +                       return -EFAULT;
2906 +               }
2907 +               vfree(counterstmp);
2908 +       }
2909 +
2910 +       if (copy_to_user(tmp.entries, entries, entries_size)) {
2911 +               BUGPRINT("Couldn't copy entries to userspace\n");
2912 +               return -EFAULT;
2913 +       }
2914 +       // set the match/watcher/target names right
2915 +       return EBT_ENTRY_ITERATE(entries, entries_size,
2916 +          ebt_make_names, entries, tmp.entries);
2917 +}
2918 +
2919 +static int do_ebt_set_ctl(struct sock *sk,
2920 +       int cmd, void *user, unsigned int len)
2921 +{
2922 +       int ret;
2923 +
2924 +       switch(cmd) {
2925 +       case EBT_SO_SET_ENTRIES:
2926 +               ret = do_replace(user, len);
2927 +               break;
2928 +       case EBT_SO_SET_COUNTERS:
2929 +               ret = update_counters(user, len);
2930 +               break;
2931 +       default:
2932 +               ret = -EINVAL;
2933 +  }
2934 +       return ret;
2935 +}
2936 +
2937 +static int do_ebt_get_ctl(struct sock *sk, int cmd, void *user, int *len)
2938 +{
2939 +       int ret;
2940 +       struct ebt_replace tmp;
2941 +       struct ebt_table *t;
2942 +
2943 +       if (copy_from_user(&tmp, user, sizeof(tmp)))
2944 +               return -EFAULT;
2945 +
2946 +       t = find_table_lock(tmp.name, &ret, &ebt_mutex);
2947 +       if (!t)
2948 +               return ret;
2949 +
2950 +       switch(cmd) {
2951 +       case EBT_SO_GET_INFO:
2952 +       case EBT_SO_GET_INIT_INFO:
2953 +               if (*len != sizeof(struct ebt_replace)){
2954 +                       ret = -EINVAL;
2955 +                       up(&ebt_mutex);
2956 +                       break;
2957 +               }
2958 +               if (cmd == EBT_SO_GET_INFO) {
2959 +                       tmp.nentries = t->private->nentries;
2960 +                       tmp.entries_size = t->private->entries_size;
2961 +                       tmp.valid_hooks = t->valid_hooks;
2962 +               } else {
2963 +                       tmp.nentries = t->table->nentries;
2964 +                       tmp.entries_size = t->table->entries_size;
2965 +                       tmp.valid_hooks = t->table->valid_hooks;
2966 +               }
2967 +               up(&ebt_mutex);
2968 +               if (copy_to_user(user, &tmp, *len) != 0){
2969 +                       BUGPRINT("c2u Didn't work\n");
2970 +                       ret = -EFAULT;
2971 +                       break;
2972 +               }
2973 +               ret = 0;
2974 +               break;
2975 +
2976 +       case EBT_SO_GET_ENTRIES:
2977 +       case EBT_SO_GET_INIT_ENTRIES:
2978 +               ret = copy_everything_to_user(t, user, len, cmd);
2979 +               up(&ebt_mutex);
2980 +               break;
2981 +
2982 +       default:
2983 +               up(&ebt_mutex);
2984 +               ret = -EINVAL;
2985 +       }
2986 +
2987 +       return ret;
2988 +}
2989 +
2990 +static struct nf_sockopt_ops ebt_sockopts =
2991 +{ { NULL, NULL }, PF_INET, EBT_BASE_CTL, EBT_SO_SET_MAX + 1, do_ebt_set_ctl,
2992 +    EBT_BASE_CTL, EBT_SO_GET_MAX + 1, do_ebt_get_ctl, 0, NULL
2993 +};
2994 +
2995 +static int __init init(void)
2996 +{
2997 +       int ret;
2998 +
2999 +       down(&ebt_mutex);
3000 +       list_named_insert(&ebt_targets, &ebt_standard_target);
3001 +       up(&ebt_mutex);
3002 +       if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
3003 +               return ret;
3004 +
3005 +       printk("Ebtables v2.0 registered");
3006 +       return 0;
3007 +}
3008 +
3009 +static void __exit fini(void)
3010 +{
3011 +       nf_unregister_sockopt(&ebt_sockopts);
3012 +       printk("Ebtables v2.0 unregistered");
3013 +}
3014 +
3015 +EXPORT_SYMBOL(ebt_register_table);
3016 +EXPORT_SYMBOL(ebt_unregister_table);
3017 +EXPORT_SYMBOL(ebt_register_match);
3018 +EXPORT_SYMBOL(ebt_unregister_match);
3019 +EXPORT_SYMBOL(ebt_register_watcher);
3020 +EXPORT_SYMBOL(ebt_unregister_watcher);
3021 +EXPORT_SYMBOL(ebt_register_target);
3022 +EXPORT_SYMBOL(ebt_unregister_target);
3023 +EXPORT_SYMBOL(ebt_do_table);
3024 +module_init(init);
3025 +module_exit(fini);
3026 +MODULE_LICENSE("GPL");
3027 --- /dev/null   Thu Aug 24 11:00:32 2000
3028 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebtables.h    Thu Oct 17 22:41:32 2002
3029 @@ -0,0 +1,359 @@
3030 +/*
3031 + *  ebtables
3032 + *
3033 + *     Authors:
3034 + *     Bart De Schuymer                <bart.de.schuymer@pandora.be>
3035 + *
3036 + *  ebtables.c,v 2.0, September, 2002
3037 + *
3038 + *  This code is stongly inspired on the iptables code which is
3039 + *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
3040 + */
3041 +
3042 +#ifndef __LINUX_BRIDGE_EFF_H
3043 +#define __LINUX_BRIDGE_EFF_H
3044 +#include <linux/if.h>
3045 +#include <linux/netfilter_bridge.h>
3046 +#include <linux/if_ether.h>
3047 +
3048 +#define EBT_TABLE_MAXNAMELEN 32
3049 +#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
3050 +#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
3051 +
3052 +// verdicts >0 are "branches"
3053 +#define EBT_ACCEPT   -1
3054 +#define EBT_DROP     -2
3055 +#define EBT_CONTINUE -3
3056 +#define EBT_RETURN   -4
3057 +#define NUM_STANDARD_TARGETS   4
3058 +
3059 +struct ebt_counter
3060 +{
3061 +       uint64_t pcnt;
3062 +       uint64_t bcnt;
3063 +};
3064 +
3065 +struct ebt_entries {
3066 +       // this field is always set to zero
3067 +       // See EBT_ENTRY_OR_ENTRIES.
3068 +       // Must be same size as ebt_entry.bitmask
3069 +       unsigned int distinguisher;
3070 +       // the chain name
3071 +       char name[EBT_CHAIN_MAXNAMELEN];
3072 +       // counter offset for this chain
3073 +       unsigned int counter_offset;
3074 +       // one standard (accept, drop, return) per hook
3075 +       int policy;
3076 +       // nr. of entries
3077 +       unsigned int nentries;
3078 +       // entry list
3079 +       char data[0];
3080 +};
3081 +
3082 +// used for the bitmask of struct ebt_entry
3083 +
3084 +// This is a hack to make a difference between an ebt_entry struct and an
3085 +// ebt_entries struct when traversing the entries from start to end.
3086 +// Using this simplifies the code alot, while still being able to use
3087 +// ebt_entries.
3088 +// Contrary, iptables doesn't use something like ebt_entries and therefore uses
3089 +// different techniques for naming the policy and such. So, iptables doesn't
3090 +// need a hack like this.
3091 +#define EBT_ENTRY_OR_ENTRIES 0x01
3092 +// these are the normal masks
3093 +#define EBT_NOPROTO 0x02
3094 +#define EBT_802_3 0x04
3095 +#define EBT_SOURCEMAC 0x08
3096 +#define EBT_DESTMAC 0x10
3097 +#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
3098 +   | EBT_ENTRY_OR_ENTRIES)
3099 +
3100 +#define EBT_IPROTO 0x01
3101 +#define EBT_IIN 0x02
3102 +#define EBT_IOUT 0x04
3103 +#define EBT_ISOURCE 0x8
3104 +#define EBT_IDEST 0x10
3105 +#define EBT_ILOGICALIN 0x20
3106 +#define EBT_ILOGICALOUT 0x40
3107 +#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
3108 +   | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
3109 +
3110 +struct ebt_entry_match
3111 +{
3112 +       union {
3113 +               char name[EBT_FUNCTION_MAXNAMELEN];
3114 +               struct ebt_match *match;
3115 +       } u;
3116 +       // size of data
3117 +       unsigned int match_size;
3118 +       unsigned char data[0];
3119 +};
3120 +
3121 +struct ebt_entry_watcher
3122 +{
3123 +       union {
3124 +               char name[EBT_FUNCTION_MAXNAMELEN];
3125 +               struct ebt_watcher *watcher;
3126 +       } u;
3127 +       // size of data
3128 +       unsigned int watcher_size;
3129 +       unsigned char data[0];
3130 +};
3131 +
3132 +struct ebt_entry_target
3133 +{
3134 +       union {
3135 +               char name[EBT_FUNCTION_MAXNAMELEN];
3136 +               struct ebt_target *target;
3137 +       } u;
3138 +       // size of data
3139 +       unsigned int target_size;
3140 +       unsigned char data[0];
3141 +};
3142 +
3143 +#define EBT_STANDARD_TARGET "standard"
3144 +struct ebt_standard_target
3145 +{
3146 +       struct ebt_entry_target target;
3147 +       int verdict;
3148 +};
3149 +
3150 +// one entry
3151 +struct ebt_entry {
3152 +       // this needs to be the first field
3153 +       unsigned int bitmask;
3154 +       unsigned int invflags;
3155 +       uint16_t ethproto;
3156 +       // the physical in-dev
3157 +       char in[IFNAMSIZ];
3158 +       // the logical in-dev
3159 +       char logical_in[IFNAMSIZ];
3160 +       // the physical out-dev
3161 +       char out[IFNAMSIZ];
3162 +       // the logical out-dev
3163 +       char logical_out[IFNAMSIZ];
3164 +       unsigned char sourcemac[ETH_ALEN];
3165 +       unsigned char sourcemsk[ETH_ALEN];
3166 +       unsigned char destmac[ETH_ALEN];
3167 +       unsigned char destmsk[ETH_ALEN];
3168 +       // sizeof ebt_entry + matches
3169 +       unsigned int watchers_offset;
3170 +       // sizeof ebt_entry + matches + watchers
3171 +       unsigned int target_offset;
3172 +       // sizeof ebt_entry + matches + watchers + target
3173 +       unsigned int next_offset;
3174 +       unsigned char elems[0];
3175 +};
3176 +
3177 +struct ebt_replace
3178 +{
3179 +       char name[EBT_TABLE_MAXNAMELEN];
3180 +       unsigned int valid_hooks;
3181 +       // nr of rules in the table
3182 +       unsigned int nentries;
3183 +       // total size of the entries
3184 +       unsigned int entries_size;
3185 +       // start of the chains
3186 +       struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
3187 +       // nr of counters userspace expects back
3188 +       unsigned int num_counters;
3189 +       // where the kernel will put the old counters
3190 +       struct ebt_counter *counters;
3191 +       char *entries;
3192 +};
3193 +
3194 +// [gs]etsockopt numbers
3195 +#define EBT_BASE_CTL            128
3196 +
3197 +#define EBT_SO_SET_ENTRIES      (EBT_BASE_CTL)
3198 +#define EBT_SO_SET_COUNTERS     (EBT_SO_SET_ENTRIES+1)
3199 +#define EBT_SO_SET_MAX          (EBT_SO_SET_COUNTERS+1)
3200 +
3201 +#define EBT_SO_GET_INFO         (EBT_BASE_CTL)
3202 +#define EBT_SO_GET_ENTRIES      (EBT_SO_GET_INFO+1)
3203 +#define EBT_SO_GET_INIT_INFO    (EBT_SO_GET_ENTRIES+1)
3204 +#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
3205 +#define EBT_SO_GET_MAX          (EBT_SO_GET_INIT_ENTRIES+1)
3206 +
3207 +#ifdef __KERNEL__
3208 +
3209 +// return values for match() functions
3210 +#define EBT_MATCH 0
3211 +#define EBT_NOMATCH 1
3212 +
3213 +struct ebt_match
3214 +{
3215 +       struct list_head list;
3216 +       const char name[EBT_FUNCTION_MAXNAMELEN];
3217 +       // 0 == it matches
3218 +       int (*match)(const struct sk_buff *skb, const struct net_device *in,
3219 +          const struct net_device *out, const void *matchdata,
3220 +          unsigned int datalen);
3221 +       // 0 == let it in
3222 +       int (*check)(const char *tablename, unsigned int hookmask,
3223 +          const struct ebt_entry *e, void *matchdata, unsigned int datalen);
3224 +       void (*destroy)(void *matchdata, unsigned int datalen);
3225 +       struct module *me;
3226 +};
3227 +
3228 +struct ebt_watcher
3229 +{
3230 +       struct list_head list;
3231 +       const char name[EBT_FUNCTION_MAXNAMELEN];
3232 +       void (*watcher)(const struct sk_buff *skb, const struct net_device *in,
3233 +          const struct net_device *out, const void *watcherdata,
3234 +          unsigned int datalen);
3235 +       // 0 == let it in
3236 +       int (*check)(const char *tablename, unsigned int hookmask,
3237 +          const struct ebt_entry *e, void *watcherdata, unsigned int datalen);
3238 +       void (*destroy)(void *watcherdata, unsigned int datalen);
3239 +       struct module *me;
3240 +};
3241 +
3242 +struct ebt_target
3243 +{
3244 +       struct list_head list;
3245 +       const char name[EBT_FUNCTION_MAXNAMELEN];
3246 +       // returns one of the standard verdicts
3247 +       int (*target)(struct sk_buff **pskb, unsigned int hooknr,
3248 +          const struct net_device *in, const struct net_device *out,
3249 +          const void *targetdata, unsigned int datalen);
3250 +       // 0 == let it in
3251 +       int (*check)(const char *tablename, unsigned int hookmask,
3252 +          const struct ebt_entry *e, void *targetdata, unsigned int datalen);
3253 +       void (*destroy)(void *targetdata, unsigned int datalen);
3254 +       struct module *me;
3255 +};
3256 +
3257 +// used for jumping from and into user defined chains (udc)
3258 +struct ebt_chainstack
3259 +{
3260 +       struct ebt_entries *chaininfo; // pointer to chain data
3261 +       struct ebt_entry *e; // pointer to entry data
3262 +       unsigned int n; // n'th entry
3263 +};
3264 +
3265 +struct ebt_table_info
3266 +{
3267 +       // total size of the entries
3268 +       unsigned int entries_size;
3269 +       unsigned int nentries;
3270 +       // pointers to the start of the chains
3271 +       struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
3272 +       // room to maintain the stack used for jumping from and into udc
3273 +       struct ebt_chainstack **chainstack;
3274 +       char *entries;
3275 +       struct ebt_counter counters[0] ____cacheline_aligned;
3276 +};
3277 +
3278 +struct ebt_table
3279 +{
3280 +       struct list_head list;
3281 +       char name[EBT_TABLE_MAXNAMELEN];
3282 +       struct ebt_replace *table;
3283 +       unsigned int valid_hooks;
3284 +       rwlock_t lock;
3285 +       // e.g. could be the table explicitly only allows certain
3286 +       // matches, targets, ... 0 == let it in
3287 +       int (*check)(const struct ebt_table_info *info,
3288 +          unsigned int valid_hooks);
3289 +       // the data used by the kernel
3290 +       struct ebt_table_info *private;
3291 +};
3292 +
3293 +extern int ebt_register_table(struct ebt_table *table);
3294 +extern void ebt_unregister_table(struct ebt_table *table);
3295 +extern int ebt_register_match(struct ebt_match *match);
3296 +extern void ebt_unregister_match(struct ebt_match *match);
3297 +extern int ebt_register_watcher(struct ebt_watcher *watcher);
3298 +extern void ebt_unregister_watcher(struct ebt_watcher *watcher);
3299 +extern int ebt_register_target(struct ebt_target *target);
3300 +extern void ebt_unregister_target(struct ebt_target *target);
3301 +extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff **pskb,
3302 +   const struct net_device *in, const struct net_device *out,
3303 +   struct ebt_table *table);
3304 +
3305 +   // Used in the kernel match() functions
3306 +#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
3307 +// True if the hook mask denotes that the rule is in a base chain,
3308 +// used in the check() functions
3309 +#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
3310 +// Clear the bit in the hook mask that tells if the rule is on a base chain
3311 +#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
3312 +// True if the target is not a standard target
3313 +#define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
3314 +
3315 +#endif /* __KERNEL__ */
3316 +
3317 +// blatently stolen from ip_tables.h
3318 +// fn returns 0 to continue iteration
3319 +#define EBT_MATCH_ITERATE(e, fn, args...)                   \
3320 +({                                                          \
3321 +       unsigned int __i;                                   \
3322 +       int __ret = 0;                                      \
3323 +       struct ebt_entry_match *__match;                    \
3324 +                                                           \
3325 +       for (__i = sizeof(struct ebt_entry);                \
3326 +            __i < (e)->watchers_offset;                    \
3327 +            __i += __match->match_size +                   \
3328 +            sizeof(struct ebt_entry_match)) {              \
3329 +               __match = (void *)(e) + __i;                \
3330 +                                                           \
3331 +               __ret = fn(__match , ## args);              \
3332 +               if (__ret != 0)                             \
3333 +                       break;                              \
3334 +       }                                                   \
3335 +       if (__ret == 0) {                                   \
3336 +               if (__i != (e)->watchers_offset)            \
3337 +                       __ret = -EINVAL;                    \
3338 +       }                                                   \
3339 +       __ret;                                              \
3340 +})
3341 +
3342 +#define EBT_WATCHER_ITERATE(e, fn, args...)                 \
3343 +({                                                          \
3344 +       unsigned int __i;                                   \
3345 +       int __ret = 0;                                      \
3346 +       struct ebt_entry_watcher *__watcher;                \
3347 +                                                           \
3348 +       for (__i = e->watchers_offset;                      \
3349 +            __i < (e)->target_offset;                      \
3350 +            __i += __watcher->watcher_size +               \
3351 +            sizeof(struct ebt_entry_watcher)) {            \
3352 +               __watcher = (void *)(e) + __i;              \
3353 +                                                           \
3354 +               __ret = fn(__watcher , ## args);            \
3355 +               if (__ret != 0)                             \
3356 +                       break;                              \
3357 +       }                                                   \
3358 +       if (__ret == 0) {                                   \
3359 +               if (__i != (e)->target_offset)              \
3360 +                       __ret = -EINVAL;                    \
3361 +       }                                                   \
3362 +       __ret;                                              \
3363 +})
3364 +
3365 +#define EBT_ENTRY_ITERATE(entries, size, fn, args...)       \
3366 +({                                                          \
3367 +       unsigned int __i;                                   \
3368 +       int __ret = 0;                                      \
3369 +       struct ebt_entry *__entry;                          \
3370 +                                                           \
3371 +       for (__i = 0; __i < (size);) {                      \
3372 +               __entry = (void *)(entries) + __i;          \
3373 +               __ret = fn(__entry , ## args);              \
3374 +               if (__ret != 0)                             \
3375 +                       break;                              \
3376 +               if (__entry->bitmask != 0)                  \
3377 +                       __i += __entry->next_offset;        \
3378 +               else                                        \
3379 +                       __i += sizeof(struct ebt_entries);  \
3380 +       }                                                   \
3381 +       if (__ret == 0) {                                   \
3382 +               if (__i != (size))                          \
3383 +                       __ret = -EINVAL;                    \
3384 +       }                                                   \
3385 +       __ret;                                              \
3386 +})
3387 +
3388 +#endif
3389 --- /dev/null   Thu Aug 24 11:00:32 2000
3390 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_arp.h     Thu Oct 17 20:31:29 2002
3391 @@ -0,0 +1,26 @@
3392 +#ifndef __LINUX_BRIDGE_EBT_ARP_H
3393 +#define __LINUX_BRIDGE_EBT_ARP_H
3394 +
3395 +#define EBT_ARP_OPCODE 0x01
3396 +#define EBT_ARP_HTYPE 0x02
3397 +#define EBT_ARP_PTYPE 0x04
3398 +#define EBT_ARP_SRC_IP 0x08
3399 +#define EBT_ARP_DST_IP 0x10
3400 +#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
3401 +   EBT_ARP_SRC_IP | EBT_ARP_DST_IP)
3402 +#define EBT_ARP_MATCH "arp"
3403 +
3404 +struct ebt_arp_info
3405 +{
3406 +       uint16_t htype;
3407 +       uint16_t ptype;
3408 +       uint16_t opcode;
3409 +       uint32_t saddr;
3410 +       uint32_t smsk;
3411 +       uint32_t daddr;
3412 +       uint32_t dmsk;
3413 +       uint8_t  bitmask;
3414 +       uint8_t  invflags;
3415 +};
3416 +
3417 +#endif
3418 --- /dev/null   Thu Aug 24 11:00:32 2000
3419 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_ip.h      Thu Oct 17 23:22:45 2002
3420 @@ -0,0 +1,43 @@
3421 +/*
3422 + *  ebt_ip
3423 + *
3424 + *     Authors:
3425 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
3426 + *
3427 + *  April, 2002
3428 + *
3429 + *  Changes:
3430 + *    added ip-sport and ip-dport
3431 + *    Innominate Security Technologies AG <mhopf@innominate.com>
3432 + *    September, 2002
3433 + */
3434 +
3435 +#ifndef __LINUX_BRIDGE_EBT_IP_H
3436 +#define __LINUX_BRIDGE_EBT_IP_H
3437 +
3438 +#define EBT_IP_SOURCE 0x01
3439 +#define EBT_IP_DEST 0x02
3440 +#define EBT_IP_TOS 0x04
3441 +#define EBT_IP_PROTO 0x08
3442 +#define EBT_IP_SPORT 0x10
3443 +#define EBT_IP_DPORT 0x20
3444 +#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
3445 + EBT_IP_SPORT | EBT_IP_DPORT )
3446 +#define EBT_IP_MATCH "ip"
3447 +
3448 +// the same values are used for the invflags
3449 +struct ebt_ip_info
3450 +{
3451 +       uint32_t saddr;
3452 +       uint32_t daddr;
3453 +       uint32_t smsk;
3454 +       uint32_t dmsk;
3455 +       uint8_t  tos;
3456 +       uint8_t  protocol;
3457 +       uint8_t  bitmask;
3458 +       uint8_t  invflags;
3459 +       uint16_t sport[2];
3460 +       uint16_t dport[2];
3461 +};
3462 +
3463 +#endif
3464 --- /dev/null   Thu Aug 24 11:00:32 2000
3465 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_vlan.h    Thu Oct 17 20:31:29 2002
3466 @@ -0,0 +1,20 @@
3467 +#ifndef __LINUX_BRIDGE_EBT_VLAN_H
3468 +#define __LINUX_BRIDGE_EBT_VLAN_H
3469 +
3470 +#define EBT_VLAN_ID    0x01
3471 +#define EBT_VLAN_PRIO  0x02
3472 +#define EBT_VLAN_ENCAP 0x04
3473 +#define EBT_VLAN_MASK (EBT_VLAN_ID | EBT_VLAN_PRIO | EBT_VLAN_ENCAP)
3474 +#define EBT_VLAN_MATCH "vlan"
3475 +
3476 +struct ebt_vlan_info {
3477 +       uint16_t id;            /* VLAN ID {1-4095} */
3478 +       uint8_t prio;           /* VLAN User Priority {0-7} */
3479 +       uint16_t encap;         /* VLAN Encapsulated frame code {0-65535} */
3480 +       uint8_t bitmask;                /* Args bitmask bit 1=1 - ID arg,
3481 +                                  bit 2=1 User-Priority arg, bit 3=1 encap*/
3482 +       uint8_t invflags;               /* Inverse bitmask  bit 1=1 - inversed ID arg,
3483 +                                  bit 2=1 - inversed Pirority arg */
3484 +};
3485 +
3486 +#endif
3487 --- /dev/null   Thu Aug 24 11:00:32 2000
3488 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_log.h     Thu Oct 17 20:31:29 2002
3489 @@ -0,0 +1,17 @@
3490 +#ifndef __LINUX_BRIDGE_EBT_LOG_H
3491 +#define __LINUX_BRIDGE_EBT_LOG_H
3492 +
3493 +#define EBT_LOG_IP 0x01 // if the frame is made by ip, log the ip information
3494 +#define EBT_LOG_ARP 0x02
3495 +#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
3496 +#define EBT_LOG_PREFIX_SIZE 30
3497 +#define EBT_LOG_WATCHER "log"
3498 +
3499 +struct ebt_log_info
3500 +{
3501 +       uint8_t loglevel;
3502 +       uint8_t prefix[EBT_LOG_PREFIX_SIZE];
3503 +       uint32_t bitmask;
3504 +};
3505 +
3506 +#endif
3507 --- /dev/null   Thu Aug 24 11:00:32 2000
3508 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_nat.h     Thu Oct 17 20:31:29 2002
3509 @@ -0,0 +1,13 @@
3510 +#ifndef __LINUX_BRIDGE_EBT_NAT_H
3511 +#define __LINUX_BRIDGE_EBT_NAT_H
3512 +
3513 +struct ebt_nat_info
3514 +{
3515 +       unsigned char mac[ETH_ALEN];
3516 +       // EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN
3517 +       int target;
3518 +};
3519 +#define EBT_SNAT_TARGET "snat"
3520 +#define EBT_DNAT_TARGET "dnat"
3521 +
3522 +#endif
3523 --- /dev/null   Thu Aug 24 11:00:32 2000
3524 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_redirect.h        Thu Oct 17 20:31:29 2002
3525 @@ -0,0 +1,11 @@
3526 +#ifndef __LINUX_BRIDGE_EBT_REDIRECT_H
3527 +#define __LINUX_BRIDGE_EBT_REDIRECT_H
3528 +
3529 +struct ebt_redirect_info
3530 +{
3531 +       // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
3532 +       int target;
3533 +};
3534 +#define EBT_REDIRECT_TARGET "redirect"
3535 +
3536 +#endif
3537 --- /dev/null   Thu Aug 24 11:00:32 2000
3538 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_mark_m.h  Thu Oct 17 20:31:29 2002
3539 @@ -0,0 +1,15 @@
3540 +#ifndef __LINUX_BRIDGE_EBT_MARK_M_H
3541 +#define __LINUX_BRIDGE_EBT_MARK_M_H
3542 +
3543 +#define EBT_MARK_AND 0x01
3544 +#define EBT_MARK_OR 0x02
3545 +#define EBT_MARK_MASK (EBT_MARK_AND | EBT_MARK_OR)
3546 +struct ebt_mark_m_info
3547 +{
3548 +       unsigned long mark, mask;
3549 +       uint8_t invert;
3550 +       uint8_t bitmask;
3551 +};
3552 +#define EBT_MARK_MATCH "mark_m"
3553 +
3554 +#endif
3555 --- /dev/null   Thu Aug 24 11:00:32 2000
3556 +++ linux-2.4.20-pre7-bcnt/include/linux/netfilter_bridge/ebt_mark_t.h  Thu Oct 17 20:31:29 2002
3557 @@ -0,0 +1,12 @@
3558 +#ifndef __LINUX_BRIDGE_EBT_MARK_T_H
3559 +#define __LINUX_BRIDGE_EBT_MARK_T_H
3560 +
3561 +struct ebt_mark_t_info
3562 +{
3563 +       unsigned long mark;
3564 +       // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
3565 +       int target;
3566 +};
3567 +#define EBT_MARK_TARGET "mark"
3568 +
3569 +#endif