SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18 /* used for print_string */
  19 #include <linux/sched.h>
  20 #include <linux/tty.h>
  21
  22 #include <linux/kmod.h>
  23 #include <linux/module.h>
  24 #include <linux/vmalloc.h>
  25 #include <linux/netfilter_bridge/ebtables.h>
  26 #include <linux/spinlock.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/smp.h>
  29 #include <linux/cpumask.h>
  30 #include <net/sock.h>
  31 /* needed for logical [in,out]-dev filtering */
  32 #include "../br_private.h"
  33
  34 /* list_named_find */
  35 #define ASSERT_READ_LOCK(x)
  36 #define ASSERT_WRITE_LOCK(x)
  37 #include <linux/netfilter_ipv4/listhelp.h>
  38 #include <linux/mutex.h>
  39
  40 #if 0
  41 /* use this for remote debugging
  42  * Copyright (C) 1998 by Ori Pomerantz
  43  * Print the string to the appropriate tty, the one
  44  * the current task uses
  45  */
  46 static void print_string(char *str)
  47 {
  48         struct tty_struct *my_tty;
  49
  50         /* The tty for the current task */
  51         my_tty = current->signal->tty;
  52         if (my_tty != NULL) {
  53                 my_tty->driver->write(my_tty, 0, str, strlen(str));
  54                 my_tty->driver->write(my_tty, 0, "\015\012", 2);
  55         }
  56 }
  57
  58 #define BUGPRINT(args) print_string(args);
  59 #else
  60 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  61                                          "report to author: "format, ## args)
  62 /* #define BUGPRINT(format, args...) */
  63 #endif
  64 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  65                                          ": out of memory: "format, ## args)
  66 /* #define MEMPRINT(format, args...) */
  67
  68
  69
  70 /*
  71  * Each cpu has its own set of counters, so there is no need for write_lock in
  72  * the softirq
  73  * For reading or updating the counters, the user context needs to
  74  * get a write_lock
  75  */
  76
  77 /* The size of each set of counters is altered to get cache alignment */
  78 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  79 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  80 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  81    COUNTER_OFFSET(n) * cpu))
  82
  83
  84
  85 static DEFINE_MUTEX(ebt_mutex);
  86 static LIST_HEAD(ebt_tables);
  87 static LIST_HEAD(ebt_targets);
  88 static LIST_HEAD(ebt_matches);
  89 static LIST_HEAD(ebt_watchers);
  90
  91 static struct ebt_target ebt_standard_target =
  92 { {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
  93
  94 static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
  95    const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
  96    const struct net_device *out)
  97 {
  98         w->u.watcher->watcher(skb, hooknr, in, out, w->data,
  99            w->watcher_size);
 100         /* watchers don't give a verdict */
 101         return 0;
 102 }
 103
 104 static inline int ebt_do_match (struct ebt_entry_match *m,
 105    const struct sk_buff *skb, const struct net_device *in,
 106    const struct net_device *out)
 107 {
 108         return m->u.match->match(skb, in, out, m->data,
 109            m->match_size);
 110 }
 111
 112 static inline int ebt_dev_check(char *entry, const struct net_device *device)
 113 {
 114         int i = 0;
 115         char *devname = device->name;
 116
 117         if (*entry == '\0')
 118                 return 0;
 119         if (!device)
 120                 return 1;
 121         /* 1 is the wildcard token */
 122         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 123                 i++;
 124         return (devname[i] != entry[i] && entry[i] != 1);
 125 }
 126
 127 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 128 /* process standard matches */
 129 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 130    const struct net_device *in, const struct net_device *out)
 131 {
 132         int verdict, i;
 133
 134         if (e->bitmask & EBT_802_3) {
 135                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 136                         return 1;
 137         } else if (!(e->bitmask & EBT_NOPROTO) &&
 138            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 139                 return 1;
 140
 141         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 142                 return 1;
 143         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 144                 return 1;
 145         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 146            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 147                 return 1;
 148         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 149            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 150                 return 1;
 151
 152         if (e->bitmask & EBT_SOURCEMAC) {
 153                 verdict = 0;
 154                 for (i = 0; i < 6; i++)
 155                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 156                            e->sourcemsk[i];
 157                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 158                         return 1;
 159         }
 160         if (e->bitmask & EBT_DESTMAC) {
 161                 verdict = 0;
 162                 for (i = 0; i < 6; i++)
 163                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 164                            e->destmsk[i];
 165                 if (FWINV2(verdict != 0, EBT_IDEST) )
 166                         return 1;
 167         }
 168         return 0;
 169 }
 170
 171 /* Do some firewalling */
 172 unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
 173    const struct net_device *in, const struct net_device *out,
 174    struct ebt_table *table)
 175 {
 176         int i, nentries;
 177         struct ebt_entry *point;
 178         struct ebt_counter *counter_base, *cb_base;
 179         struct ebt_entry_target *t;
 180         int verdict, sp = 0;
 181         struct ebt_chainstack *cs;
 182         struct ebt_entries *chaininfo;
 183         char *base;
 184         struct ebt_table_info *private;
 185
 186         read_lock_bh(&table->lock);
 187         private = table->private;
 188         cb_base = COUNTER_BASE(private->counters, private->nentries,
 189            smp_processor_id());
 190         if (private->chainstack)
 191                 cs = private->chainstack[smp_processor_id()];
 192         else
 193                 cs = NULL;
 194         chaininfo = private->hook_entry[hook];
 195         nentries = private->hook_entry[hook]->nentries;
 196         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 197         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 198         /* base for chain jumps */
 199         base = private->entries;
 200         i = 0;
 201         while (i < nentries) {
 202                 if (ebt_basic_match(point, eth_hdr(*pskb), in, out))
 203                         goto letscontinue;
 204
 205                 if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
 206                         goto letscontinue;
 207
 208                 /* increase counter */
 209                 (*(counter_base + i)).pcnt++;
 210                 (*(counter_base + i)).bcnt+=(**pskb).len;
 211
 212                 /* these should only watch: not modify, nor tell us
 213                    what to do with the packet */
 214                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in,
 215                    out);
 216
 217                 t = (struct ebt_entry_target *)
 218                    (((char *)point) + point->target_offset);
 219                 /* standard target */
 220                 if (!t->u.target->target)
 221                         verdict = ((struct ebt_standard_target *)t)->verdict;
 222                 else
 223                         verdict = t->u.target->target(pskb, hook,
 224                            in, out, t->data, t->target_size);
 225                 if (verdict == EBT_ACCEPT) {
 226                         read_unlock_bh(&table->lock);
 227                         return NF_ACCEPT;
 228                 }
 229                 if (verdict == EBT_DROP) {
 230                         read_unlock_bh(&table->lock);
 231                         return NF_DROP;
 232                 }
 233                 if (verdict == EBT_RETURN) {
 234 letsreturn:
 235 #ifdef CONFIG_NETFILTER_DEBUG
 236                         if (sp == 0) {
 237                                 BUGPRINT("RETURN on base chain");
 238                                 /* act like this is EBT_CONTINUE */
 239                                 goto letscontinue;
 240                         }
 241 #endif
 242                         sp--;
 243                         /* put all the local variables right */
 244                         i = cs[sp].n;
 245                         chaininfo = cs[sp].chaininfo;
 246                         nentries = chaininfo->nentries;
 247                         point = cs[sp].e;
 248                         counter_base = cb_base +
 249                            chaininfo->counter_offset;
 250                         continue;
 251                 }
 252                 if (verdict == EBT_CONTINUE)
 253                         goto letscontinue;
 254 #ifdef CONFIG_NETFILTER_DEBUG
 255                 if (verdict < 0) {
 256                         BUGPRINT("bogus standard verdict\n");
 257                         read_unlock_bh(&table->lock);
 258                         return NF_DROP;
 259                 }
 260 #endif
 261                 /* jump to a udc */
 262                 cs[sp].n = i + 1;
 263                 cs[sp].chaininfo = chaininfo;
 264                 cs[sp].e = (struct ebt_entry *)
 265                    (((char *)point) + point->next_offset);
 266                 i = 0;
 267                 chaininfo = (struct ebt_entries *) (base + verdict);
 268 #ifdef CONFIG_NETFILTER_DEBUG
 269                 if (chaininfo->distinguisher) {
 270                         BUGPRINT("jump to non-chain\n");
 271                         read_unlock_bh(&table->lock);
 272                         return NF_DROP;
 273                 }
 274 #endif
 275                 nentries = chaininfo->nentries;
 276                 point = (struct ebt_entry *)chaininfo->data;
 277                 counter_base = cb_base + chaininfo->counter_offset;
 278                 sp++;
 279                 continue;
 280 letscontinue:
 281                 point = (struct ebt_entry *)
 282                    (((char *)point) + point->next_offset);
 283                 i++;
 284         }
 285
 286         /* I actually like this :) */
 287         if (chaininfo->policy == EBT_RETURN)
 288                 goto letsreturn;
 289         if (chaininfo->policy == EBT_ACCEPT) {
 290                 read_unlock_bh(&table->lock);
 291                 return NF_ACCEPT;
 292         }
 293         read_unlock_bh(&table->lock);
 294         return NF_DROP;
 295 }
 296
 297 /* If it succeeds, returns element and locks mutex */
 298 static inline void *
 299 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 300    struct mutex *mutex)
 301 {
 302         void *ret;
 303
 304         *error = mutex_lock_interruptible(mutex);
 305         if (*error != 0)
 306                 return NULL;
 307
 308         ret = list_named_find(head, name);
 309         if (!ret) {
 310                 *error = -ENOENT;
 311                 mutex_unlock(mutex);
 312         }
 313         return ret;
 314 }
 315
 316 #ifndef CONFIG_KMOD
 317 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
 318 #else
 319 static void *
 320 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 321    int *error, struct mutex *mutex)
 322 {
 323         void *ret;
 324
 325         ret = find_inlist_lock_noload(head, name, error, mutex);
 326         if (!ret) {
 327                 request_module("%s%s", prefix, name);
 328                 ret = find_inlist_lock_noload(head, name, error, mutex);
 329         }
 330         return ret;
 331 }
 332 #endif
 333
 334 static inline struct ebt_table *
 335 find_table_lock(const char *name, int *error, struct mutex *mutex)
 336 {
 337         return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
 338 }
 339
 340 static inline struct ebt_match *
 341 find_match_lock(const char *name, int *error, struct mutex *mutex)
 342 {
 343         return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
 344 }
 345
 346 static inline struct ebt_watcher *
 347 find_watcher_lock(const char *name, int *error, struct mutex *mutex)
 348 {
 349         return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
 350 }
 351
 352 static inline struct ebt_target *
 353 find_target_lock(const char *name, int *error, struct mutex *mutex)
 354 {
 355         return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
 356 }
 357
 358 static inline int
 359 ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
 360    const char *name, unsigned int hookmask, unsigned int *cnt)
 361 {
 362         struct ebt_match *match;
 363         int ret;
 364
 365         if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
 366            ((char *)e) + e->watchers_offset)
 367                 return -EINVAL;
 368         match = find_match_lock(m->u.name, &ret, &ebt_mutex);
 369         if (!match)
 370                 return ret;
 371         m->u.match = match;
 372         if (!try_module_get(match->me)) {
 373                 mutex_unlock(&ebt_mutex);
 374                 return -ENOENT;
 375         }
 376         mutex_unlock(&ebt_mutex);
 377         if (match->check &&
 378            match->check(name, hookmask, e, m->data, m->match_size) != 0) {
 379                 BUGPRINT("match->check failed\n");
 380                 module_put(match->me);
 381                 return -EINVAL;
 382         }
 383         (*cnt)++;
 384         return 0;
 385 }
 386
 387 static inline int
 388 ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
 389    const char *name, unsigned int hookmask, unsigned int *cnt)
 390 {
 391         struct ebt_watcher *watcher;
 392         int ret;
 393
 394         if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
 395            ((char *)e) + e->target_offset)
 396                 return -EINVAL;
 397         watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
 398         if (!watcher)
 399                 return ret;
 400         w->u.watcher = watcher;
 401         if (!try_module_get(watcher->me)) {
 402                 mutex_unlock(&ebt_mutex);
 403                 return -ENOENT;
 404         }
 405         mutex_unlock(&ebt_mutex);
 406         if (watcher->check &&
 407            watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
 408                 BUGPRINT("watcher->check failed\n");
 409                 module_put(watcher->me);
 410                 return -EINVAL;
 411         }
 412         (*cnt)++;
 413         return 0;
 414 }
 415
 416 /*
 417  * this one is very careful, as it is the first function
 418  * to parse the userspace data
 419  */
 420 static inline int
 421 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
 422    struct ebt_table_info *newinfo, char *base, char *limit,
 423    struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
 424    unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
 425 {
 426         int i;
 427
 428         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 429                 if ((valid_hooks & (1 << i)) == 0)
 430                         continue;
 431                 if ( (char *)hook_entries[i] - base ==
 432                    (char *)e - newinfo->entries)
 433                         break;
 434         }
 435         /* beginning of a new chain
 436            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 437         if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 438                 if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
 439                         /* we make userspace set this right,
 440                            so there is no misunderstanding */
 441                         BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 442                                  "in distinguisher\n");
 443                         return -EINVAL;
 444                 }
 445                 /* this checks if the previous chain has as many entries
 446                    as it said it has */
 447                 if (*n != *cnt) {
 448                         BUGPRINT("nentries does not equal the nr of entries "
 449                                  "in the chain\n");
 450                         return -EINVAL;
 451                 }
 452                 /* before we look at the struct, be sure it is not too big */
 453                 if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
 454                    > limit) {
 455                         BUGPRINT("entries_size too small\n");
 456                         return -EINVAL;
 457                 }
 458                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 459                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 460                         /* only RETURN from udc */
 461                         if (i != NF_BR_NUMHOOKS ||
 462                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 463                                 BUGPRINT("bad policy\n");
 464                                 return -EINVAL;
 465                         }
 466                 }
 467                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 468                         (*udc_cnt)++;
 469                 else
 470                         newinfo->hook_entry[i] = (struct ebt_entries *)e;
 471                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 472                         BUGPRINT("counter_offset != totalcnt");
 473                         return -EINVAL;
 474                 }
 475                 *n = ((struct ebt_entries *)e)->nentries;
 476                 *cnt = 0;
 477                 return 0;
 478         }
 479         /* a plain old entry, heh */
 480         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 481            e->watchers_offset > e->target_offset ||
 482            e->target_offset >= e->next_offset) {
 483                 BUGPRINT("entry offsets not in right order\n");
 484                 return -EINVAL;
 485         }
 486         /* this is not checked anywhere else */
 487         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 488                 BUGPRINT("target size too small\n");
 489                 return -EINVAL;
 490         }
 491
 492         (*cnt)++;
 493         (*totalcnt)++;
 494         return 0;
 495 }
 496
 497 struct ebt_cl_stack
 498 {
 499         struct ebt_chainstack cs;
 500         int from;
 501         unsigned int hookmask;
 502 };
 503
 504 /*
 505  * we need these positions to check that the jumps to a different part of the
 506  * entries is a jump to the beginning of a new chain.
 507  */
 508 static inline int
 509 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 510    struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
 511    struct ebt_cl_stack *udc)
 512 {
 513         int i;
 514
 515         /* we're only interested in chain starts */
 516         if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
 517                 return 0;
 518         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 519                 if ((valid_hooks & (1 << i)) == 0)
 520                         continue;
 521                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 522                         break;
 523         }
 524         /* only care about udc */
 525         if (i != NF_BR_NUMHOOKS)
 526                 return 0;
 527
 528         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 529         /* these initialisations are depended on later in check_chainloops() */
 530         udc[*n].cs.n = 0;
 531         udc[*n].hookmask = 0;
 532
 533         (*n)++;
 534         return 0;
 535 }
 536
 537 static inline int
 538 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 539 {
 540         if (i && (*i)-- == 0)
 541                 return 1;
 542         if (m->u.match->destroy)
 543                 m->u.match->destroy(m->data, m->match_size);
 544         module_put(m->u.match->me);
 545
 546         return 0;
 547 }
 548
 549 static inline int
 550 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 551 {
 552         if (i && (*i)-- == 0)
 553                 return 1;
 554         if (w->u.watcher->destroy)
 555                 w->u.watcher->destroy(w->data, w->watcher_size);
 556         module_put(w->u.watcher->me);
 557
 558         return 0;
 559 }
 560
 561 static inline int
 562 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 563 {
 564         struct ebt_entry_target *t;
 565
 566         if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
 567                 return 0;
 568         /* we're done */
 569         if (cnt && (*cnt)-- == 0)
 570                 return 1;
 571         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
 572         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
 573         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 574         if (t->u.target->destroy)
 575                 t->u.target->destroy(t->data, t->target_size);
 576         module_put(t->u.target->me);
 577
 578         return 0;
 579 }
 580
 581 static inline int
 582 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
 583    const char *name, unsigned int *cnt, unsigned int valid_hooks,
 584    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 585 {
 586         struct ebt_entry_target *t;
 587         struct ebt_target *target;
 588         unsigned int i, j, hook = 0, hookmask = 0;
 589         int ret;
 590
 591         /* don't mess with the struct ebt_entries */
 592         if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
 593                 return 0;
 594
 595         if (e->bitmask & ~EBT_F_MASK) {
 596                 BUGPRINT("Unknown flag for bitmask\n");
 597                 return -EINVAL;
 598         }
 599         if (e->invflags & ~EBT_INV_MASK) {
 600                 BUGPRINT("Unknown flag for inv bitmask\n");
 601                 return -EINVAL;
 602         }
 603         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 604                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 605                 return -EINVAL;
 606         }
 607         /* what hook do we belong to? */
 608         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 609                 if ((valid_hooks & (1 << i)) == 0)
 610                         continue;
 611                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 612                         hook = i;
 613                 else
 614                         break;
 615         }
 616         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 617            a base chain */
 618         if (i < NF_BR_NUMHOOKS)
 619                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 620         else {
 621                 for (i = 0; i < udc_cnt; i++)
 622                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 623                                 break;
 624                 if (i == 0)
 625                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 626                 else
 627                         hookmask = cl_s[i - 1].hookmask;
 628         }
 629         i = 0;
 630         ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
 631         if (ret != 0)
 632                 goto cleanup_matches;
 633         j = 0;
 634         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
 635         if (ret != 0)
 636                 goto cleanup_watchers;
 637         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 638         target = find_target_lock(t->u.name, &ret, &ebt_mutex);
 639         if (!target)
 640                 goto cleanup_watchers;
 641         if (!try_module_get(target->me)) {
 642                 mutex_unlock(&ebt_mutex);
 643                 ret = -ENOENT;
 644                 goto cleanup_watchers;
 645         }
 646         mutex_unlock(&ebt_mutex);
 647
 648         t->u.target = target;
 649         if (t->u.target == &ebt_standard_target) {
 650                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 651                    e->next_offset) {
 652                         BUGPRINT("Standard target size too big\n");
 653                         ret = -EFAULT;
 654                         goto cleanup_watchers;
 655                 }
 656                 if (((struct ebt_standard_target *)t)->verdict <
 657                    -NUM_STANDARD_TARGETS) {
 658                         BUGPRINT("Invalid standard target\n");
 659                         ret = -EFAULT;
 660                         goto cleanup_watchers;
 661                 }
 662         } else if ((e->target_offset + t->target_size +
 663            sizeof(struct ebt_entry_target) > e->next_offset) ||
 664            (t->u.target->check &&
 665            t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
 666                 module_put(t->u.target->me);
 667                 ret = -EFAULT;
 668                 goto cleanup_watchers;
 669         }
 670         (*cnt)++;
 671         return 0;
 672 cleanup_watchers:
 673         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
 674 cleanup_matches:
 675         EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
 676         return ret;
 677 }
 678
 679 /*
 680  * checks for loops and sets the hook mask for udc
 681  * the hook mask for udc tells us from which base chains the udc can be
 682  * accessed. This mask is a parameter to the check() functions of the extensions
 683  */
 684 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 685    unsigned int udc_cnt, unsigned int hooknr, char *base)
 686 {
 687         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 688         struct ebt_entry *e = (struct ebt_entry *)chain->data;
 689         struct ebt_entry_target *t;
 690
 691         while (pos < nentries || chain_nr != -1) {
 692                 /* end of udc, go back one 'recursion' step */
 693                 if (pos == nentries) {
 694                         /* put back values of the time when this chain was called */
 695                         e = cl_s[chain_nr].cs.e;
 696                         if (cl_s[chain_nr].from != -1)
 697                                 nentries =
 698                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 699                         else
 700                                 nentries = chain->nentries;
 701                         pos = cl_s[chain_nr].cs.n;
 702                         /* make sure we won't see a loop that isn't one */
 703                         cl_s[chain_nr].cs.n = 0;
 704                         chain_nr = cl_s[chain_nr].from;
 705                         if (pos == nentries)
 706                                 continue;
 707                 }
 708                 t = (struct ebt_entry_target *)
 709                    (((char *)e) + e->target_offset);
 710                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 711                         goto letscontinue;
 712                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 713                    e->next_offset) {
 714                         BUGPRINT("Standard target size too big\n");
 715                         return -1;
 716                 }
 717                 verdict = ((struct ebt_standard_target *)t)->verdict;
 718                 if (verdict >= 0) { /* jump to another chain */
 719                         struct ebt_entries *hlp2 =
 720                            (struct ebt_entries *)(base + verdict);
 721                         for (i = 0; i < udc_cnt; i++)
 722                                 if (hlp2 == cl_s[i].cs.chaininfo)
 723                                         break;
 724                         /* bad destination or loop */
 725                         if (i == udc_cnt) {
 726                                 BUGPRINT("bad destination\n");
 727                                 return -1;
 728                         }
 729                         if (cl_s[i].cs.n) {
 730                                 BUGPRINT("loop\n");
 731                                 return -1;
 732                         }
 733                         /* this can't be 0, so the above test is correct */
 734                         cl_s[i].cs.n = pos + 1;
 735                         pos = 0;
 736                         cl_s[i].cs.e = ((void *)e + e->next_offset);
 737                         e = (struct ebt_entry *)(hlp2->data);
 738                         nentries = hlp2->nentries;
 739                         cl_s[i].from = chain_nr;
 740                         chain_nr = i;
 741                         /* this udc is accessible from the base chain for hooknr */
 742                         cl_s[i].hookmask |= (1 << hooknr);
 743                         continue;
 744                 }
 745 letscontinue:
 746                 e = (void *)e + e->next_offset;
 747                 pos++;
 748         }
 749         return 0;
 750 }
 751
 752 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 753 static int translate_table(struct ebt_replace *repl,
 754    struct ebt_table_info *newinfo)
 755 {
 756         unsigned int i, j, k, udc_cnt;
 757         int ret;
 758         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 759
 760         i = 0;
 761         while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
 762                 i++;
 763         if (i == NF_BR_NUMHOOKS) {
 764                 BUGPRINT("No valid hooks specified\n");
 765                 return -EINVAL;
 766         }
 767         if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
 768                 BUGPRINT("Chains don't start at beginning\n");
 769                 return -EINVAL;
 770         }
 771         /* make sure chains are ordered after each other in same order
 772            as their corresponding hooks */
 773         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 774                 if (!(repl->valid_hooks & (1 << j)))
 775                         continue;
 776                 if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
 777                         BUGPRINT("Hook order must be followed\n");
 778                         return -EINVAL;
 779                 }
 780                 i = j;
 781         }
 782
 783         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 784                 newinfo->hook_entry[i] = NULL;
 785
 786         newinfo->entries_size = repl->entries_size;
 787         newinfo->nentries = repl->nentries;
 788
 789         /* do some early checkings and initialize some things */
 790         i = 0; /* holds the expected nr. of entries for the chain */
 791         j = 0; /* holds the up to now counted entries for the chain */
 792         k = 0; /* holds the total nr. of entries, should equal
 793                   newinfo->nentries afterwards */
 794         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 795         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 796            ebt_check_entry_size_and_hooks, newinfo, repl->entries,
 797            repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
 798            &udc_cnt, repl->valid_hooks);
 799
 800         if (ret != 0)
 801                 return ret;
 802
 803         if (i != j) {
 804                 BUGPRINT("nentries does not equal the nr of entries in the "
 805                          "(last) chain\n");
 806                 return -EINVAL;
 807         }
 808         if (k != newinfo->nentries) {
 809                 BUGPRINT("Total nentries is wrong\n");
 810                 return -EINVAL;
 811         }
 812
 813         /* check if all valid hooks have a chain */
 814         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 815                 if (newinfo->hook_entry[i] == NULL &&
 816                    (repl->valid_hooks & (1 << i))) {
 817                         BUGPRINT("Valid hook without chain\n");
 818                         return -EINVAL;
 819                 }
 820         }
 821
 822         /* get the location of the udc, put them in an array
 823            while we're at it, allocate the chainstack */
 824         if (udc_cnt) {
 825                 /* this will get free'd in do_replace()/ebt_register_table()
 826                    if an error occurs */
 827                 newinfo->chainstack = (struct ebt_chainstack **)
 828                    vmalloc((highest_possible_processor_id()+1)
 829                                                 * sizeof(struct ebt_chainstack));
 830                 if (!newinfo->chainstack)
 831                         return -ENOMEM;
 832                 for_each_cpu(i) {
 833                         newinfo->chainstack[i] =
 834                            vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
 835                         if (!newinfo->chainstack[i]) {
 836                                 while (i)
 837                                         vfree(newinfo->chainstack[--i]);
 838                                 vfree(newinfo->chainstack);
 839                                 newinfo->chainstack = NULL;
 840                                 return -ENOMEM;
 841                         }
 842                 }
 843
 844                 cl_s = (struct ebt_cl_stack *)
 845                    vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
 846                 if (!cl_s)
 847                         return -ENOMEM;
 848                 i = 0; /* the i'th udc */
 849                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 850                    ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
 851                    repl->valid_hooks, cl_s);
 852                 /* sanity check */
 853                 if (i != udc_cnt) {
 854                         BUGPRINT("i != udc_cnt\n");
 855                         vfree(cl_s);
 856                         return -EFAULT;
 857                 }
 858         }
 859
 860         /* Check for loops */
 861         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 862                 if (repl->valid_hooks & (1 << i))
 863                         if (check_chainloops(newinfo->hook_entry[i],
 864                            cl_s, udc_cnt, i, newinfo->entries)) {
 865                                 vfree(cl_s);
 866                                 return -EINVAL;
 867                         }
 868
 869         /* we now know the following (along with E=mc²):
 870            - the nr of entries in each chain is right
 871            - the size of the allocated space is right
 872            - all valid hooks have a corresponding chain
 873            - there are no loops
 874            - wrong data can still be on the level of a single entry
 875            - could be there are jumps to places that are not the
 876              beginning of a chain. This can only occur in chains that
 877              are not accessible from any base chains, so we don't care. */
 878
 879         /* used to know what we need to clean up if something goes wrong */
 880         i = 0;
 881         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 882            ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
 883            cl_s, udc_cnt);
 884         if (ret != 0) {
 885                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 886                    ebt_cleanup_entry, &i);
 887         }
 888         vfree(cl_s);
 889         return ret;
 890 }
 891
 892 /* called under write_lock */
 893 static void get_counters(struct ebt_counter *oldcounters,
 894    struct ebt_counter *counters, unsigned int nentries)
 895 {
 896         int i, cpu;
 897         struct ebt_counter *counter_base;
 898
 899         /* counters of cpu 0 */
 900         memcpy(counters, oldcounters,
 901                sizeof(struct ebt_counter) * nentries);
 902
 903         /* add other counters to those of cpu 0 */
 904         for_each_cpu(cpu) {
 905                 if (cpu == 0)
 906                         continue;
 907                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 908                 for (i = 0; i < nentries; i++) {
 909                         counters[i].pcnt += counter_base[i].pcnt;
 910                         counters[i].bcnt += counter_base[i].bcnt;
 911                 }
 912         }
 913 }
 914
 915 /* replace the table */
 916 static int do_replace(void __user *user, unsigned int len)
 917 {
 918         int ret, i, countersize;
 919         struct ebt_table_info *newinfo;
 920         struct ebt_replace tmp;
 921         struct ebt_table *t;
 922         struct ebt_counter *counterstmp = NULL;
 923         /* used to be able to unlock earlier */
 924         struct ebt_table_info *table;
 925
 926         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 927                 return -EFAULT;
 928
 929         if (len != sizeof(tmp) + tmp.entries_size) {
 930                 BUGPRINT("Wrong len argument\n");
 931                 return -EINVAL;
 932         }
 933
 934         if (tmp.entries_size == 0) {
 935                 BUGPRINT("Entries_size never zero\n");
 936                 return -EINVAL;
 937         }
 938         /* overflow check */
 939         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
 940                         SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 941                 return -ENOMEM;
 942         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 943                 return -ENOMEM;
 944
 945         countersize = COUNTER_OFFSET(tmp.nentries) *
 946                                         (highest_possible_processor_id()+1);
 947         newinfo = (struct ebt_table_info *)
 948            vmalloc(sizeof(struct ebt_table_info) + countersize);
 949         if (!newinfo)
 950                 return -ENOMEM;
 951
 952         if (countersize)
 953                 memset(newinfo->counters, 0, countersize);
 954
 955         newinfo->entries = vmalloc(tmp.entries_size);
 956         if (!newinfo->entries) {
 957                 ret = -ENOMEM;
 958                 goto free_newinfo;
 959         }
 960         if (copy_from_user(
 961            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
 962                 BUGPRINT("Couldn't copy entries from userspace\n");
 963                 ret = -EFAULT;
 964                 goto free_entries;
 965         }
 966
 967         /* the user wants counters back
 968            the check on the size is done later, when we have the lock */
 969         if (tmp.num_counters) {
 970                 counterstmp = (struct ebt_counter *)
 971                    vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
 972                 if (!counterstmp) {
 973                         ret = -ENOMEM;
 974                         goto free_entries;
 975                 }
 976         }
 977         else
 978                 counterstmp = NULL;
 979
 980         /* this can get initialized by translate_table() */
 981         newinfo->chainstack = NULL;
 982         ret = translate_table(&tmp, newinfo);
 983
 984         if (ret != 0)
 985                 goto free_counterstmp;
 986
 987         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
 988         if (!t) {
 989                 ret = -ENOENT;
 990                 goto free_iterate;
 991         }
 992
 993         /* the table doesn't like it */
 994         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
 995                 goto free_unlock;
 996
 997         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
 998                 BUGPRINT("Wrong nr. of counters requested\n");
 999                 ret = -EINVAL;
1000                 goto free_unlock;
1001         }
1002
1003         /* we have the mutex lock, so no danger in reading this pointer */
1004         table = t->private;
1005         /* make sure the table can only be rmmod'ed if it contains no rules */
1006         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1007                 ret = -ENOENT;
1008                 goto free_unlock;
1009         } else if (table->nentries && !newinfo->nentries)
1010                 module_put(t->me);
1011         /* we need an atomic snapshot of the counters */
1012         write_lock_bh(&t->lock);
1013         if (tmp.num_counters)
1014                 get_counters(t->private->counters, counterstmp,
1015                    t->private->nentries);
1016
1017         t->private = newinfo;
1018         write_unlock_bh(&t->lock);
1019         mutex_unlock(&ebt_mutex);
1020         /* so, a user can change the chains while having messed up her counter
1021            allocation. Only reason why this is done is because this way the lock
1022            is held only once, while this doesn't bring the kernel into a
1023            dangerous state. */
1024         if (tmp.num_counters &&
1025            copy_to_user(tmp.counters, counterstmp,
1026            tmp.num_counters * sizeof(struct ebt_counter))) {
1027                 BUGPRINT("Couldn't copy counters to userspace\n");
1028                 ret = -EFAULT;
1029         }
1030         else
1031                 ret = 0;
1032
1033         /* decrease module count and free resources */
1034         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1035            ebt_cleanup_entry, NULL);
1036
1037         vfree(table->entries);
1038         if (table->chainstack) {
1039                 for_each_cpu(i)
1040                         vfree(table->chainstack[i]);
1041                 vfree(table->chainstack);
1042         }
1043         vfree(table);
1044
1045         vfree(counterstmp);
1046         return ret;
1047
1048 free_unlock:
1049         mutex_unlock(&ebt_mutex);
1050 free_iterate:
1051         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1052            ebt_cleanup_entry, NULL);
1053 free_counterstmp:
1054         vfree(counterstmp);
1055         /* can be initialized in translate_table() */
1056         if (newinfo->chainstack) {
1057                 for_each_cpu(i)
1058                         vfree(newinfo->chainstack[i]);
1059                 vfree(newinfo->chainstack);
1060         }
1061 free_entries:
1062         vfree(newinfo->entries);
1063 free_newinfo:
1064         vfree(newinfo);
1065         return ret;
1066 }
1067
1068 int ebt_register_target(struct ebt_target *target)
1069 {
1070         int ret;
1071
1072         ret = mutex_lock_interruptible(&ebt_mutex);
1073         if (ret != 0)
1074                 return ret;
1075         if (!list_named_insert(&ebt_targets, target)) {
1076                 mutex_unlock(&ebt_mutex);
1077                 return -EEXIST;
1078         }
1079         mutex_unlock(&ebt_mutex);
1080
1081         return 0;
1082 }
1083
1084 void ebt_unregister_target(struct ebt_target *target)
1085 {
1086         mutex_lock(&ebt_mutex);
1087         LIST_DELETE(&ebt_targets, target);
1088         mutex_unlock(&ebt_mutex);
1089 }
1090
1091 int ebt_register_match(struct ebt_match *match)
1092 {
1093         int ret;
1094
1095         ret = mutex_lock_interruptible(&ebt_mutex);
1096         if (ret != 0)
1097                 return ret;
1098         if (!list_named_insert(&ebt_matches, match)) {
1099                 mutex_unlock(&ebt_mutex);
1100                 return -EEXIST;
1101         }
1102         mutex_unlock(&ebt_mutex);
1103
1104         return 0;
1105 }
1106
1107 void ebt_unregister_match(struct ebt_match *match)
1108 {
1109         mutex_lock(&ebt_mutex);
1110         LIST_DELETE(&ebt_matches, match);
1111         mutex_unlock(&ebt_mutex);
1112 }
1113
1114 int ebt_register_watcher(struct ebt_watcher *watcher)
1115 {
1116         int ret;
1117
1118         ret = mutex_lock_interruptible(&ebt_mutex);
1119         if (ret != 0)
1120                 return ret;
1121         if (!list_named_insert(&ebt_watchers, watcher)) {
1122                 mutex_unlock(&ebt_mutex);
1123                 return -EEXIST;
1124         }
1125         mutex_unlock(&ebt_mutex);
1126
1127         return 0;
1128 }
1129
1130 void ebt_unregister_watcher(struct ebt_watcher *watcher)
1131 {
1132         mutex_lock(&ebt_mutex);
1133         LIST_DELETE(&ebt_watchers, watcher);
1134         mutex_unlock(&ebt_mutex);
1135 }
1136
1137 int ebt_register_table(struct ebt_table *table)
1138 {
1139         struct ebt_table_info *newinfo;
1140         int ret, i, countersize;
1141
1142         if (!table || !table->table ||!table->table->entries ||
1143             table->table->entries_size == 0 ||
1144             table->table->counters || table->private) {
1145                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1146                 return -EINVAL;
1147         }
1148
1149         countersize = COUNTER_OFFSET(table->table->nentries) *
1150                                         (highest_possible_processor_id()+1);
1151         newinfo = (struct ebt_table_info *)
1152            vmalloc(sizeof(struct ebt_table_info) + countersize);
1153         ret = -ENOMEM;
1154         if (!newinfo)
1155                 return -ENOMEM;
1156
1157         newinfo->entries = vmalloc(table->table->entries_size);
1158         if (!(newinfo->entries))
1159                 goto free_newinfo;
1160
1161         memcpy(newinfo->entries, table->table->entries,
1162            table->table->entries_size);
1163
1164         if (countersize)
1165                 memset(newinfo->counters, 0, countersize);
1166
1167         /* fill in newinfo and parse the entries */
1168         newinfo->chainstack = NULL;
1169         ret = translate_table(table->table, newinfo);
1170         if (ret != 0) {
1171                 BUGPRINT("Translate_table failed\n");
1172                 goto free_chainstack;
1173         }
1174
1175         if (table->check && table->check(newinfo, table->valid_hooks)) {
1176                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1177                 return -EINVAL;
1178         }
1179
1180         table->private = newinfo;
1181         rwlock_init(&table->lock);
1182         ret = mutex_lock_interruptible(&ebt_mutex);
1183         if (ret != 0)
1184                 goto free_chainstack;
1185
1186         if (list_named_find(&ebt_tables, table->name)) {
1187                 ret = -EEXIST;
1188                 BUGPRINT("Table name already exists\n");
1189                 goto free_unlock;
1190         }
1191
1192         /* Hold a reference count if the chains aren't empty */
1193         if (newinfo->nentries && !try_module_get(table->me)) {
1194                 ret = -ENOENT;
1195                 goto free_unlock;
1196         }
1197         list_prepend(&ebt_tables, table);
1198         mutex_unlock(&ebt_mutex);
1199         return 0;
1200 free_unlock:
1201         mutex_unlock(&ebt_mutex);
1202 free_chainstack:
1203         if (newinfo->chainstack) {
1204                 for_each_cpu(i)
1205                         vfree(newinfo->chainstack[i]);
1206                 vfree(newinfo->chainstack);
1207         }
1208         vfree(newinfo->entries);
1209 free_newinfo:
1210         vfree(newinfo);
1211         return ret;
1212 }
1213
1214 void ebt_unregister_table(struct ebt_table *table)
1215 {
1216         int i;
1217
1218         if (!table) {
1219                 BUGPRINT("Request to unregister NULL table!!!\n");
1220                 return;
1221         }
1222         mutex_lock(&ebt_mutex);
1223         LIST_DELETE(&ebt_tables, table);
1224         mutex_unlock(&ebt_mutex);
1225         vfree(table->private->entries);
1226         if (table->private->chainstack) {
1227                 for_each_cpu(i)
1228                         vfree(table->private->chainstack[i]);
1229                 vfree(table->private->chainstack);
1230         }
1231         vfree(table->private);
1232 }
1233
1234 /* userspace just supplied us with counters */
1235 static int update_counters(void __user *user, unsigned int len)
1236 {
1237         int i, ret;
1238         struct ebt_counter *tmp;
1239         struct ebt_replace hlp;
1240         struct ebt_table *t;
1241
1242         if (copy_from_user(&hlp, user, sizeof(hlp)))
1243                 return -EFAULT;
1244
1245         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1246                 return -EINVAL;
1247         if (hlp.num_counters == 0)
1248                 return -EINVAL;
1249
1250         if ( !(tmp = (struct ebt_counter *)
1251            vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
1252                 MEMPRINT("Update_counters && nomemory\n");
1253                 return -ENOMEM;
1254         }
1255
1256         t = find_table_lock(hlp.name, &ret, &ebt_mutex);
1257         if (!t)
1258                 goto free_tmp;
1259
1260         if (hlp.num_counters != t->private->nentries) {
1261                 BUGPRINT("Wrong nr of counters\n");
1262                 ret = -EINVAL;
1263                 goto unlock_mutex;
1264         }
1265
1266         if ( copy_from_user(tmp, hlp.counters,
1267            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1268                 BUGPRINT("Updata_counters && !cfu\n");
1269                 ret = -EFAULT;
1270                 goto unlock_mutex;
1271         }
1272
1273         /* we want an atomic add of the counters */
1274         write_lock_bh(&t->lock);
1275
1276         /* we add to the counters of the first cpu */
1277         for (i = 0; i < hlp.num_counters; i++) {
1278                 t->private->counters[i].pcnt += tmp[i].pcnt;
1279                 t->private->counters[i].bcnt += tmp[i].bcnt;
1280         }
1281
1282         write_unlock_bh(&t->lock);
1283         ret = 0;
1284 unlock_mutex:
1285         mutex_unlock(&ebt_mutex);
1286 free_tmp:
1287         vfree(tmp);
1288         return ret;
1289 }
1290
1291 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1292    char *base, char *ubase)
1293 {
1294         char *hlp = ubase - base + (char *)m;
1295         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1296                 return -EFAULT;
1297         return 0;
1298 }
1299
1300 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1301    char *base, char *ubase)
1302 {
1303         char *hlp = ubase - base + (char *)w;
1304         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1305                 return -EFAULT;
1306         return 0;
1307 }
1308
1309 static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
1310 {
1311         int ret;
1312         char *hlp;
1313         struct ebt_entry_target *t;
1314
1315         if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
1316                 return 0;
1317
1318         hlp = ubase - base + (char *)e + e->target_offset;
1319         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1320
1321         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1322         if (ret != 0)
1323                 return ret;
1324         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1325         if (ret != 0)
1326                 return ret;
1327         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1328                 return -EFAULT;
1329         return 0;
1330 }
1331
1332 /* called with ebt_mutex locked */
1333 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1334    int *len, int cmd)
1335 {
1336         struct ebt_replace tmp;
1337         struct ebt_counter *counterstmp, *oldcounters;
1338         unsigned int entries_size, nentries;
1339         char *entries;
1340
1341         if (cmd == EBT_SO_GET_ENTRIES) {
1342                 entries_size = t->private->entries_size;
1343                 nentries = t->private->nentries;
1344                 entries = t->private->entries;
1345                 oldcounters = t->private->counters;
1346         } else {
1347                 entries_size = t->table->entries_size;
1348                 nentries = t->table->nentries;
1349                 entries = t->table->entries;
1350                 oldcounters = t->table->counters;
1351         }
1352
1353         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1354                 BUGPRINT("Cfu didn't work\n");
1355                 return -EFAULT;
1356         }
1357
1358         if (*len != sizeof(struct ebt_replace) + entries_size +
1359            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1360                 BUGPRINT("Wrong size\n");
1361                 return -EINVAL;
1362         }
1363
1364         if (tmp.nentries != nentries) {
1365                 BUGPRINT("Nentries wrong\n");
1366                 return -EINVAL;
1367         }
1368
1369         if (tmp.entries_size != entries_size) {
1370                 BUGPRINT("Wrong size\n");
1371                 return -EINVAL;
1372         }
1373
1374         /* userspace might not need the counters */
1375         if (tmp.num_counters) {
1376                 if (tmp.num_counters != nentries) {
1377                         BUGPRINT("Num_counters wrong\n");
1378                         return -EINVAL;
1379                 }
1380                 counterstmp = (struct ebt_counter *)
1381                    vmalloc(nentries * sizeof(struct ebt_counter));
1382                 if (!counterstmp) {
1383                         MEMPRINT("Couldn't copy counters, out of memory\n");
1384                         return -ENOMEM;
1385                 }
1386                 write_lock_bh(&t->lock);
1387                 get_counters(oldcounters, counterstmp, nentries);
1388                 write_unlock_bh(&t->lock);
1389
1390                 if (copy_to_user(tmp.counters, counterstmp,
1391                    nentries * sizeof(struct ebt_counter))) {
1392                         BUGPRINT("Couldn't copy counters to userspace\n");
1393                         vfree(counterstmp);
1394                         return -EFAULT;
1395                 }
1396                 vfree(counterstmp);
1397         }
1398
1399         if (copy_to_user(tmp.entries, entries, entries_size)) {
1400                 BUGPRINT("Couldn't copy entries to userspace\n");
1401                 return -EFAULT;
1402         }
1403         /* set the match/watcher/target names right */
1404         return EBT_ENTRY_ITERATE(entries, entries_size,
1405            ebt_make_names, entries, tmp.entries);
1406 }
1407
1408 static int do_ebt_set_ctl(struct sock *sk,
1409         int cmd, void __user *user, unsigned int len)
1410 {
1411         int ret;
1412
1413         switch(cmd) {
1414         case EBT_SO_SET_ENTRIES:
1415                 ret = do_replace(user, len);
1416                 break;
1417         case EBT_SO_SET_COUNTERS:
1418                 ret = update_counters(user, len);
1419                 break;
1420         default:
1421                 ret = -EINVAL;
1422   }
1423         return ret;
1424 }
1425
1426 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1427 {
1428         int ret;
1429         struct ebt_replace tmp;
1430         struct ebt_table *t;
1431
1432         if (copy_from_user(&tmp, user, sizeof(tmp)))
1433                 return -EFAULT;
1434
1435         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1436         if (!t)
1437                 return ret;
1438
1439         switch(cmd) {
1440         case EBT_SO_GET_INFO:
1441         case EBT_SO_GET_INIT_INFO:
1442                 if (*len != sizeof(struct ebt_replace)){
1443                         ret = -EINVAL;
1444                         mutex_unlock(&ebt_mutex);
1445                         break;
1446                 }
1447                 if (cmd == EBT_SO_GET_INFO) {
1448                         tmp.nentries = t->private->nentries;
1449                         tmp.entries_size = t->private->entries_size;
1450                         tmp.valid_hooks = t->valid_hooks;
1451                 } else {
1452                         tmp.nentries = t->table->nentries;
1453                         tmp.entries_size = t->table->entries_size;
1454                         tmp.valid_hooks = t->table->valid_hooks;
1455                 }
1456                 mutex_unlock(&ebt_mutex);
1457                 if (copy_to_user(user, &tmp, *len) != 0){
1458                         BUGPRINT("c2u Didn't work\n");
1459                         ret = -EFAULT;
1460                         break;
1461                 }
1462                 ret = 0;
1463                 break;
1464
1465         case EBT_SO_GET_ENTRIES:
1466         case EBT_SO_GET_INIT_ENTRIES:
1467                 ret = copy_everything_to_user(t, user, len, cmd);
1468                 mutex_unlock(&ebt_mutex);
1469                 break;
1470
1471         default:
1472                 mutex_unlock(&ebt_mutex);
1473                 ret = -EINVAL;
1474         }
1475
1476         return ret;
1477 }
1478
1479 static struct nf_sockopt_ops ebt_sockopts =
1480 {
1481         .pf             = PF_INET,
1482         .set_optmin     = EBT_BASE_CTL,
1483         .set_optmax     = EBT_SO_SET_MAX + 1,
1484         .set            = do_ebt_set_ctl,
1485         .get_optmin     = EBT_BASE_CTL,
1486         .get_optmax     = EBT_SO_GET_MAX + 1,
1487         .get            = do_ebt_get_ctl,
1488 };
1489
1490 static int __init ebtables_init(void)
1491 {
1492         int ret;
1493
1494         mutex_lock(&ebt_mutex);
1495         list_named_insert(&ebt_targets, &ebt_standard_target);
1496         mutex_unlock(&ebt_mutex);
1497         if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
1498                 return ret;
1499
1500         printk(KERN_NOTICE "Ebtables v2.0 registered\n");
1501         return 0;
1502 }
1503
1504 static void __exit ebtables_fini(void)
1505 {
1506         nf_unregister_sockopt(&ebt_sockopts);
1507         printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
1508 }
1509
1510 EXPORT_SYMBOL(ebt_register_table);
1511 EXPORT_SYMBOL(ebt_unregister_table);
1512 EXPORT_SYMBOL(ebt_register_match);
1513 EXPORT_SYMBOL(ebt_unregister_match);
1514 EXPORT_SYMBOL(ebt_register_watcher);
1515 EXPORT_SYMBOL(ebt_unregister_watcher);
1516 EXPORT_SYMBOL(ebt_register_target);
1517 EXPORT_SYMBOL(ebt_unregister_target);
1518 EXPORT_SYMBOL(ebt_do_table);
1519 module_init(ebtables_init);
1520 module_exit(ebtables_fini);
1521 MODULE_LICENSE("GPL");