SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18
  19 #include <linux/kmod.h>
  20 #include <linux/module.h>
  21 #include <linux/vmalloc.h>
  22 #include <linux/netfilter/x_tables.h>
  23 #include <linux/netfilter_bridge/ebtables.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/mutex.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  37                                          ": out of memory: "format, ## args)
  38 /* #define MEMPRINT(format, args...) */
  39
  40
  41
  42 /*
  43  * Each cpu has its own set of counters, so there is no need for write_lock in
  44  * the softirq
  45  * For reading or updating the counters, the user context needs to
  46  * get a write_lock
  47  */
  48
  49 /* The size of each set of counters is altered to get cache alignment */
  50 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  51 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  52 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  53    COUNTER_OFFSET(n) * cpu))
  54
  55
  56
  57 static DEFINE_MUTEX(ebt_mutex);
  58 static LIST_HEAD(ebt_tables);
  59
  60 static struct xt_target ebt_standard_target = {
  61         .name       = "standard",
  62         .revision   = 0,
  63         .family     = NFPROTO_BRIDGE,
  64         .targetsize = sizeof(int),
  65 };
  66
  67 static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
  68    struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
  69    const struct net_device *out)
  70 {
  71         w->u.watcher->target(skb, in, out, hooknr, w->u.watcher, w->data);
  72         /* watchers don't give a verdict */
  73         return 0;
  74 }
  75
  76 static inline int ebt_do_match (struct ebt_entry_match *m,
  77    const struct sk_buff *skb, const struct net_device *in,
  78    const struct net_device *out, bool *hotdrop)
  79 {
  80         return m->u.match->match(skb, in, out, m->u.match,
  81                m->data, 0, 0, hotdrop);
  82 }
  83
  84 static inline int ebt_dev_check(char *entry, const struct net_device *device)
  85 {
  86         int i = 0;
  87         const char *devname = device->name;
  88
  89         if (*entry == '\0')
  90                 return 0;
  91         if (!device)
  92                 return 1;
  93         /* 1 is the wildcard token */
  94         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
  95                 i++;
  96         return (devname[i] != entry[i] && entry[i] != 1);
  97 }
  98
  99 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 100 /* process standard matches */
 101 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 102    const struct net_device *in, const struct net_device *out)
 103 {
 104         int verdict, i;
 105
 106         if (e->bitmask & EBT_802_3) {
 107                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 108                         return 1;
 109         } else if (!(e->bitmask & EBT_NOPROTO) &&
 110            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 111                 return 1;
 112
 113         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 114                 return 1;
 115         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 116                 return 1;
 117         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 118            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 119                 return 1;
 120         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 121            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 122                 return 1;
 123
 124         if (e->bitmask & EBT_SOURCEMAC) {
 125                 verdict = 0;
 126                 for (i = 0; i < 6; i++)
 127                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 128                            e->sourcemsk[i];
 129                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 130                         return 1;
 131         }
 132         if (e->bitmask & EBT_DESTMAC) {
 133                 verdict = 0;
 134                 for (i = 0; i < 6; i++)
 135                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 136                            e->destmsk[i];
 137                 if (FWINV2(verdict != 0, EBT_IDEST) )
 138                         return 1;
 139         }
 140         return 0;
 141 }
 142
 143 /* Do some firewalling */
 144 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 145    const struct net_device *in, const struct net_device *out,
 146    struct ebt_table *table)
 147 {
 148         int i, nentries;
 149         struct ebt_entry *point;
 150         struct ebt_counter *counter_base, *cb_base;
 151         struct ebt_entry_target *t;
 152         int verdict, sp = 0;
 153         struct ebt_chainstack *cs;
 154         struct ebt_entries *chaininfo;
 155         char *base;
 156         struct ebt_table_info *private;
 157         bool hotdrop = false;
 158
 159         read_lock_bh(&table->lock);
 160         private = table->private;
 161         cb_base = COUNTER_BASE(private->counters, private->nentries,
 162            smp_processor_id());
 163         if (private->chainstack)
 164                 cs = private->chainstack[smp_processor_id()];
 165         else
 166                 cs = NULL;
 167         chaininfo = private->hook_entry[hook];
 168         nentries = private->hook_entry[hook]->nentries;
 169         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 170         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 171         /* base for chain jumps */
 172         base = private->entries;
 173         i = 0;
 174         while (i < nentries) {
 175                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 176                         goto letscontinue;
 177
 178                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb,
 179                     in, out, &hotdrop) != 0)
 180                         goto letscontinue;
 181                 if (hotdrop) {
 182                         read_unlock_bh(&table->lock);
 183                         return NF_DROP;
 184                 }
 185
 186                 /* increase counter */
 187                 (*(counter_base + i)).pcnt++;
 188                 (*(counter_base + i)).bcnt += skb->len;
 189
 190                 /* these should only watch: not modify, nor tell us
 191                    what to do with the packet */
 192                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, hook, in,
 193                    out);
 194
 195                 t = (struct ebt_entry_target *)
 196                    (((char *)point) + point->target_offset);
 197                 /* standard target */
 198                 if (!t->u.target->target)
 199                         verdict = ((struct ebt_standard_target *)t)->verdict;
 200                 else
 201                         verdict = t->u.target->target(skb, in, out, hook,
 202                                   t->u.target, t->data);
 203                 if (verdict == EBT_ACCEPT) {
 204                         read_unlock_bh(&table->lock);
 205                         return NF_ACCEPT;
 206                 }
 207                 if (verdict == EBT_DROP) {
 208                         read_unlock_bh(&table->lock);
 209                         return NF_DROP;
 210                 }
 211                 if (verdict == EBT_RETURN) {
 212 letsreturn:
 213 #ifdef CONFIG_NETFILTER_DEBUG
 214                         if (sp == 0) {
 215                                 BUGPRINT("RETURN on base chain");
 216                                 /* act like this is EBT_CONTINUE */
 217                                 goto letscontinue;
 218                         }
 219 #endif
 220                         sp--;
 221                         /* put all the local variables right */
 222                         i = cs[sp].n;
 223                         chaininfo = cs[sp].chaininfo;
 224                         nentries = chaininfo->nentries;
 225                         point = cs[sp].e;
 226                         counter_base = cb_base +
 227                            chaininfo->counter_offset;
 228                         continue;
 229                 }
 230                 if (verdict == EBT_CONTINUE)
 231                         goto letscontinue;
 232 #ifdef CONFIG_NETFILTER_DEBUG
 233                 if (verdict < 0) {
 234                         BUGPRINT("bogus standard verdict\n");
 235                         read_unlock_bh(&table->lock);
 236                         return NF_DROP;
 237                 }
 238 #endif
 239                 /* jump to a udc */
 240                 cs[sp].n = i + 1;
 241                 cs[sp].chaininfo = chaininfo;
 242                 cs[sp].e = (struct ebt_entry *)
 243                    (((char *)point) + point->next_offset);
 244                 i = 0;
 245                 chaininfo = (struct ebt_entries *) (base + verdict);
 246 #ifdef CONFIG_NETFILTER_DEBUG
 247                 if (chaininfo->distinguisher) {
 248                         BUGPRINT("jump to non-chain\n");
 249                         read_unlock_bh(&table->lock);
 250                         return NF_DROP;
 251                 }
 252 #endif
 253                 nentries = chaininfo->nentries;
 254                 point = (struct ebt_entry *)chaininfo->data;
 255                 counter_base = cb_base + chaininfo->counter_offset;
 256                 sp++;
 257                 continue;
 258 letscontinue:
 259                 point = (struct ebt_entry *)
 260                    (((char *)point) + point->next_offset);
 261                 i++;
 262         }
 263
 264         /* I actually like this :) */
 265         if (chaininfo->policy == EBT_RETURN)
 266                 goto letsreturn;
 267         if (chaininfo->policy == EBT_ACCEPT) {
 268                 read_unlock_bh(&table->lock);
 269                 return NF_ACCEPT;
 270         }
 271         read_unlock_bh(&table->lock);
 272         return NF_DROP;
 273 }
 274
 275 /* If it succeeds, returns element and locks mutex */
 276 static inline void *
 277 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 278    struct mutex *mutex)
 279 {
 280         struct {
 281                 struct list_head list;
 282                 char name[EBT_FUNCTION_MAXNAMELEN];
 283         } *e;
 284
 285         *error = mutex_lock_interruptible(mutex);
 286         if (*error != 0)
 287                 return NULL;
 288
 289         list_for_each_entry(e, head, list) {
 290                 if (strcmp(e->name, name) == 0)
 291                         return e;
 292         }
 293         *error = -ENOENT;
 294         mutex_unlock(mutex);
 295         return NULL;
 296 }
 297
 298 #ifndef CONFIG_KMOD
 299 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
 300 #else
 301 static void *
 302 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 303    int *error, struct mutex *mutex)
 304 {
 305         void *ret;
 306
 307         ret = find_inlist_lock_noload(head, name, error, mutex);
 308         if (!ret) {
 309                 request_module("%s%s", prefix, name);
 310                 ret = find_inlist_lock_noload(head, name, error, mutex);
 311         }
 312         return ret;
 313 }
 314 #endif
 315
 316 static inline struct ebt_table *
 317 find_table_lock(const char *name, int *error, struct mutex *mutex)
 318 {
 319         return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
 320 }
 321
 322 static inline int
 323 ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
 324    const char *name, unsigned int hookmask, unsigned int *cnt)
 325 {
 326         struct xt_match *match;
 327         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 328         int ret;
 329
 330         if (left < sizeof(struct ebt_entry_match) ||
 331             left - sizeof(struct ebt_entry_match) < m->match_size)
 332                 return -EINVAL;
 333
 334         match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
 335                 m->u.name, 0), "ebt_%s", m->u.name);
 336         if (IS_ERR(match))
 337                 return PTR_ERR(match);
 338         if (match == NULL)
 339                 return -ENOENT;
 340         m->u.match = match;
 341
 342         ret = xt_check_match(match, NFPROTO_BRIDGE, m->match_size,
 343               name, hookmask, e->ethproto, e->invflags & EBT_IPROTO);
 344         if (ret < 0) {
 345                 module_put(match->me);
 346                 return ret;
 347         } else if (match->checkentry != NULL &&
 348             !match->checkentry(name, e, NULL, m->data, hookmask)) {
 349                 module_put(match->me);
 350                 BUGPRINT("match->check failed\n");
 351                 return -EINVAL;
 352         }
 353
 354         (*cnt)++;
 355         return 0;
 356 }
 357
 358 static inline int
 359 ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
 360    const char *name, unsigned int hookmask, unsigned int *cnt)
 361 {
 362         struct xt_target *watcher;
 363         size_t left = ((char *)e + e->target_offset) - (char *)w;
 364         int ret;
 365
 366         if (left < sizeof(struct ebt_entry_watcher) ||
 367            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 368                 return -EINVAL;
 369
 370         watcher = try_then_request_module(
 371                   xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
 372                   "ebt_%s", w->u.name);
 373         if (IS_ERR(watcher))
 374                 return PTR_ERR(watcher);
 375         if (watcher == NULL)
 376                 return -ENOENT;
 377         w->u.watcher = watcher;
 378
 379         ret = xt_check_target(watcher, NFPROTO_BRIDGE, w->watcher_size,
 380               name, hookmask, e->ethproto, e->invflags & EBT_IPROTO);
 381         if (ret < 0) {
 382                 module_put(watcher->me);
 383                 return ret;
 384         } else if (watcher->checkentry != NULL &&
 385             !watcher->checkentry(name, e, NULL, w->data, hookmask)) {
 386                 module_put(watcher->me);
 387                 BUGPRINT("watcher->check failed\n");
 388                 return -EINVAL;
 389         }
 390
 391         (*cnt)++;
 392         return 0;
 393 }
 394
 395 static int ebt_verify_pointers(struct ebt_replace *repl,
 396                                struct ebt_table_info *newinfo)
 397 {
 398         unsigned int limit = repl->entries_size;
 399         unsigned int valid_hooks = repl->valid_hooks;
 400         unsigned int offset = 0;
 401         int i;
 402
 403         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 404                 newinfo->hook_entry[i] = NULL;
 405
 406         newinfo->entries_size = repl->entries_size;
 407         newinfo->nentries = repl->nentries;
 408
 409         while (offset < limit) {
 410                 size_t left = limit - offset;
 411                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 412
 413                 if (left < sizeof(unsigned int))
 414                         break;
 415
 416                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 417                         if ((valid_hooks & (1 << i)) == 0)
 418                                 continue;
 419                         if ((char __user *)repl->hook_entry[i] ==
 420                              repl->entries + offset)
 421                                 break;
 422                 }
 423
 424                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 425                         if (e->bitmask != 0) {
 426                                 /* we make userspace set this right,
 427                                    so there is no misunderstanding */
 428                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 429                                          "in distinguisher\n");
 430                                 return -EINVAL;
 431                         }
 432                         if (i != NF_BR_NUMHOOKS)
 433                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 434                         if (left < sizeof(struct ebt_entries))
 435                                 break;
 436                         offset += sizeof(struct ebt_entries);
 437                 } else {
 438                         if (left < sizeof(struct ebt_entry))
 439                                 break;
 440                         if (left < e->next_offset)
 441                                 break;
 442                         offset += e->next_offset;
 443                 }
 444         }
 445         if (offset != limit) {
 446                 BUGPRINT("entries_size too small\n");
 447                 return -EINVAL;
 448         }
 449
 450         /* check if all valid hooks have a chain */
 451         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 452                 if (!newinfo->hook_entry[i] &&
 453                    (valid_hooks & (1 << i))) {
 454                         BUGPRINT("Valid hook without chain\n");
 455                         return -EINVAL;
 456                 }
 457         }
 458         return 0;
 459 }
 460
 461 /*
 462  * this one is very careful, as it is the first function
 463  * to parse the userspace data
 464  */
 465 static inline int
 466 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
 467    struct ebt_table_info *newinfo,
 468    unsigned int *n, unsigned int *cnt,
 469    unsigned int *totalcnt, unsigned int *udc_cnt)
 470 {
 471         int i;
 472
 473         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 474                 if ((void *)e == (void *)newinfo->hook_entry[i])
 475                         break;
 476         }
 477         /* beginning of a new chain
 478            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 479         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 480                 /* this checks if the previous chain has as many entries
 481                    as it said it has */
 482                 if (*n != *cnt) {
 483                         BUGPRINT("nentries does not equal the nr of entries "
 484                                  "in the chain\n");
 485                         return -EINVAL;
 486                 }
 487                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 488                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 489                         /* only RETURN from udc */
 490                         if (i != NF_BR_NUMHOOKS ||
 491                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 492                                 BUGPRINT("bad policy\n");
 493                                 return -EINVAL;
 494                         }
 495                 }
 496                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 497                         (*udc_cnt)++;
 498                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 499                         BUGPRINT("counter_offset != totalcnt");
 500                         return -EINVAL;
 501                 }
 502                 *n = ((struct ebt_entries *)e)->nentries;
 503                 *cnt = 0;
 504                 return 0;
 505         }
 506         /* a plain old entry, heh */
 507         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 508            e->watchers_offset > e->target_offset ||
 509            e->target_offset >= e->next_offset) {
 510                 BUGPRINT("entry offsets not in right order\n");
 511                 return -EINVAL;
 512         }
 513         /* this is not checked anywhere else */
 514         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 515                 BUGPRINT("target size too small\n");
 516                 return -EINVAL;
 517         }
 518         (*cnt)++;
 519         (*totalcnt)++;
 520         return 0;
 521 }
 522
 523 struct ebt_cl_stack
 524 {
 525         struct ebt_chainstack cs;
 526         int from;
 527         unsigned int hookmask;
 528 };
 529
 530 /*
 531  * we need these positions to check that the jumps to a different part of the
 532  * entries is a jump to the beginning of a new chain.
 533  */
 534 static inline int
 535 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 536    unsigned int *n, struct ebt_cl_stack *udc)
 537 {
 538         int i;
 539
 540         /* we're only interested in chain starts */
 541         if (e->bitmask)
 542                 return 0;
 543         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 544                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 545                         break;
 546         }
 547         /* only care about udc */
 548         if (i != NF_BR_NUMHOOKS)
 549                 return 0;
 550
 551         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 552         /* these initialisations are depended on later in check_chainloops() */
 553         udc[*n].cs.n = 0;
 554         udc[*n].hookmask = 0;
 555
 556         (*n)++;
 557         return 0;
 558 }
 559
 560 static inline int
 561 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 562 {
 563         if (i && (*i)-- == 0)
 564                 return 1;
 565         if (m->u.match->destroy)
 566                 m->u.match->destroy(m->u.match, m->data);
 567         module_put(m->u.match->me);
 568
 569         return 0;
 570 }
 571
 572 static inline int
 573 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 574 {
 575         if (i && (*i)-- == 0)
 576                 return 1;
 577         if (w->u.watcher->destroy)
 578                 w->u.watcher->destroy(w->u.watcher, w->data);
 579         module_put(w->u.watcher->me);
 580
 581         return 0;
 582 }
 583
 584 static inline int
 585 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 586 {
 587         struct ebt_entry_target *t;
 588
 589         if (e->bitmask == 0)
 590                 return 0;
 591         /* we're done */
 592         if (cnt && (*cnt)-- == 0)
 593                 return 1;
 594         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
 595         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
 596         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 597         if (t->u.target->destroy)
 598                 t->u.target->destroy(t->u.target, t->data);
 599         module_put(t->u.target->me);
 600
 601         return 0;
 602 }
 603
 604 static inline int
 605 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
 606    const char *name, unsigned int *cnt,
 607    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 608 {
 609         struct ebt_entry_target *t;
 610         struct xt_target *target;
 611         unsigned int i, j, hook = 0, hookmask = 0;
 612         size_t gap;
 613         int ret;
 614
 615         /* don't mess with the struct ebt_entries */
 616         if (e->bitmask == 0)
 617                 return 0;
 618
 619         if (e->bitmask & ~EBT_F_MASK) {
 620                 BUGPRINT("Unknown flag for bitmask\n");
 621                 return -EINVAL;
 622         }
 623         if (e->invflags & ~EBT_INV_MASK) {
 624                 BUGPRINT("Unknown flag for inv bitmask\n");
 625                 return -EINVAL;
 626         }
 627         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 628                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 629                 return -EINVAL;
 630         }
 631         /* what hook do we belong to? */
 632         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 633                 if (!newinfo->hook_entry[i])
 634                         continue;
 635                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 636                         hook = i;
 637                 else
 638                         break;
 639         }
 640         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 641            a base chain */
 642         if (i < NF_BR_NUMHOOKS)
 643                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 644         else {
 645                 for (i = 0; i < udc_cnt; i++)
 646                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 647                                 break;
 648                 if (i == 0)
 649                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 650                 else
 651                         hookmask = cl_s[i - 1].hookmask;
 652         }
 653         i = 0;
 654         ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
 655         if (ret != 0)
 656                 goto cleanup_matches;
 657         j = 0;
 658         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
 659         if (ret != 0)
 660                 goto cleanup_watchers;
 661         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 662         gap = e->next_offset - e->target_offset;
 663
 664         target = try_then_request_module(
 665                  xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
 666                  "ebt_%s", t->u.name);
 667         if (IS_ERR(target)) {
 668                 ret = PTR_ERR(target);
 669                 goto cleanup_watchers;
 670         } else if (target == NULL) {
 671                 ret = -ENOENT;
 672                 goto cleanup_watchers;
 673         }
 674
 675         t->u.target = target;
 676         if (t->u.target == &ebt_standard_target) {
 677                 if (gap < sizeof(struct ebt_standard_target)) {
 678                         BUGPRINT("Standard target size too big\n");
 679                         ret = -EFAULT;
 680                         goto cleanup_watchers;
 681                 }
 682                 if (((struct ebt_standard_target *)t)->verdict <
 683                    -NUM_STANDARD_TARGETS) {
 684                         BUGPRINT("Invalid standard target\n");
 685                         ret = -EFAULT;
 686                         goto cleanup_watchers;
 687                 }
 688         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 689                 module_put(t->u.target->me);
 690                 ret = -EFAULT;
 691                 goto cleanup_watchers;
 692         }
 693
 694         ret = xt_check_target(target, NFPROTO_BRIDGE, t->target_size,
 695               name, hookmask, e->ethproto, e->invflags & EBT_IPROTO);
 696         if (ret < 0) {
 697                 module_put(target->me);
 698                 goto cleanup_watchers;
 699         } else if (t->u.target->checkentry &&
 700             !t->u.target->checkentry(name, e, NULL, t->data, hookmask)) {
 701                 module_put(t->u.target->me);
 702                 ret = -EFAULT;
 703                 goto cleanup_watchers;
 704         }
 705         (*cnt)++;
 706         return 0;
 707 cleanup_watchers:
 708         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
 709 cleanup_matches:
 710         EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
 711         return ret;
 712 }
 713
 714 /*
 715  * checks for loops and sets the hook mask for udc
 716  * the hook mask for udc tells us from which base chains the udc can be
 717  * accessed. This mask is a parameter to the check() functions of the extensions
 718  */
 719 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 720    unsigned int udc_cnt, unsigned int hooknr, char *base)
 721 {
 722         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 723         struct ebt_entry *e = (struct ebt_entry *)chain->data;
 724         struct ebt_entry_target *t;
 725
 726         while (pos < nentries || chain_nr != -1) {
 727                 /* end of udc, go back one 'recursion' step */
 728                 if (pos == nentries) {
 729                         /* put back values of the time when this chain was called */
 730                         e = cl_s[chain_nr].cs.e;
 731                         if (cl_s[chain_nr].from != -1)
 732                                 nentries =
 733                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 734                         else
 735                                 nentries = chain->nentries;
 736                         pos = cl_s[chain_nr].cs.n;
 737                         /* make sure we won't see a loop that isn't one */
 738                         cl_s[chain_nr].cs.n = 0;
 739                         chain_nr = cl_s[chain_nr].from;
 740                         if (pos == nentries)
 741                                 continue;
 742                 }
 743                 t = (struct ebt_entry_target *)
 744                    (((char *)e) + e->target_offset);
 745                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 746                         goto letscontinue;
 747                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 748                    e->next_offset) {
 749                         BUGPRINT("Standard target size too big\n");
 750                         return -1;
 751                 }
 752                 verdict = ((struct ebt_standard_target *)t)->verdict;
 753                 if (verdict >= 0) { /* jump to another chain */
 754                         struct ebt_entries *hlp2 =
 755                            (struct ebt_entries *)(base + verdict);
 756                         for (i = 0; i < udc_cnt; i++)
 757                                 if (hlp2 == cl_s[i].cs.chaininfo)
 758                                         break;
 759                         /* bad destination or loop */
 760                         if (i == udc_cnt) {
 761                                 BUGPRINT("bad destination\n");
 762                                 return -1;
 763                         }
 764                         if (cl_s[i].cs.n) {
 765                                 BUGPRINT("loop\n");
 766                                 return -1;
 767                         }
 768                         if (cl_s[i].hookmask & (1 << hooknr))
 769                                 goto letscontinue;
 770                         /* this can't be 0, so the loop test is correct */
 771                         cl_s[i].cs.n = pos + 1;
 772                         pos = 0;
 773                         cl_s[i].cs.e = ((void *)e + e->next_offset);
 774                         e = (struct ebt_entry *)(hlp2->data);
 775                         nentries = hlp2->nentries;
 776                         cl_s[i].from = chain_nr;
 777                         chain_nr = i;
 778                         /* this udc is accessible from the base chain for hooknr */
 779                         cl_s[i].hookmask |= (1 << hooknr);
 780                         continue;
 781                 }
 782 letscontinue:
 783                 e = (void *)e + e->next_offset;
 784                 pos++;
 785         }
 786         return 0;
 787 }
 788
 789 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 790 static int translate_table(char *name, struct ebt_table_info *newinfo)
 791 {
 792         unsigned int i, j, k, udc_cnt;
 793         int ret;
 794         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 795
 796         i = 0;
 797         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 798                 i++;
 799         if (i == NF_BR_NUMHOOKS) {
 800                 BUGPRINT("No valid hooks specified\n");
 801                 return -EINVAL;
 802         }
 803         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 804                 BUGPRINT("Chains don't start at beginning\n");
 805                 return -EINVAL;
 806         }
 807         /* make sure chains are ordered after each other in same order
 808            as their corresponding hooks */
 809         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 810                 if (!newinfo->hook_entry[j])
 811                         continue;
 812                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 813                         BUGPRINT("Hook order must be followed\n");
 814                         return -EINVAL;
 815                 }
 816                 i = j;
 817         }
 818
 819         /* do some early checkings and initialize some things */
 820         i = 0; /* holds the expected nr. of entries for the chain */
 821         j = 0; /* holds the up to now counted entries for the chain */
 822         k = 0; /* holds the total nr. of entries, should equal
 823                   newinfo->nentries afterwards */
 824         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 825         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 826            ebt_check_entry_size_and_hooks, newinfo,
 827            &i, &j, &k, &udc_cnt);
 828
 829         if (ret != 0)
 830                 return ret;
 831
 832         if (i != j) {
 833                 BUGPRINT("nentries does not equal the nr of entries in the "
 834                          "(last) chain\n");
 835                 return -EINVAL;
 836         }
 837         if (k != newinfo->nentries) {
 838                 BUGPRINT("Total nentries is wrong\n");
 839                 return -EINVAL;
 840         }
 841
 842         /* get the location of the udc, put them in an array
 843            while we're at it, allocate the chainstack */
 844         if (udc_cnt) {
 845                 /* this will get free'd in do_replace()/ebt_register_table()
 846                    if an error occurs */
 847                 newinfo->chainstack =
 848                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 849                 if (!newinfo->chainstack)
 850                         return -ENOMEM;
 851                 for_each_possible_cpu(i) {
 852                         newinfo->chainstack[i] =
 853                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 854                         if (!newinfo->chainstack[i]) {
 855                                 while (i)
 856                                         vfree(newinfo->chainstack[--i]);
 857                                 vfree(newinfo->chainstack);
 858                                 newinfo->chainstack = NULL;
 859                                 return -ENOMEM;
 860                         }
 861                 }
 862
 863                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 864                 if (!cl_s)
 865                         return -ENOMEM;
 866                 i = 0; /* the i'th udc */
 867                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 868                    ebt_get_udc_positions, newinfo, &i, cl_s);
 869                 /* sanity check */
 870                 if (i != udc_cnt) {
 871                         BUGPRINT("i != udc_cnt\n");
 872                         vfree(cl_s);
 873                         return -EFAULT;
 874                 }
 875         }
 876
 877         /* Check for loops */
 878         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 879                 if (newinfo->hook_entry[i])
 880                         if (check_chainloops(newinfo->hook_entry[i],
 881                            cl_s, udc_cnt, i, newinfo->entries)) {
 882                                 vfree(cl_s);
 883                                 return -EINVAL;
 884                         }
 885
 886         /* we now know the following (along with E=mc²):
 887            - the nr of entries in each chain is right
 888            - the size of the allocated space is right
 889            - all valid hooks have a corresponding chain
 890            - there are no loops
 891            - wrong data can still be on the level of a single entry
 892            - could be there are jumps to places that are not the
 893              beginning of a chain. This can only occur in chains that
 894              are not accessible from any base chains, so we don't care. */
 895
 896         /* used to know what we need to clean up if something goes wrong */
 897         i = 0;
 898         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 899            ebt_check_entry, newinfo, name, &i, cl_s, udc_cnt);
 900         if (ret != 0) {
 901                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 902                    ebt_cleanup_entry, &i);
 903         }
 904         vfree(cl_s);
 905         return ret;
 906 }
 907
 908 /* called under write_lock */
 909 static void get_counters(struct ebt_counter *oldcounters,
 910    struct ebt_counter *counters, unsigned int nentries)
 911 {
 912         int i, cpu;
 913         struct ebt_counter *counter_base;
 914
 915         /* counters of cpu 0 */
 916         memcpy(counters, oldcounters,
 917                sizeof(struct ebt_counter) * nentries);
 918
 919         /* add other counters to those of cpu 0 */
 920         for_each_possible_cpu(cpu) {
 921                 if (cpu == 0)
 922                         continue;
 923                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 924                 for (i = 0; i < nentries; i++) {
 925                         counters[i].pcnt += counter_base[i].pcnt;
 926                         counters[i].bcnt += counter_base[i].bcnt;
 927                 }
 928         }
 929 }
 930
 931 /* replace the table */
 932 static int do_replace(void __user *user, unsigned int len)
 933 {
 934         int ret, i, countersize;
 935         struct ebt_table_info *newinfo;
 936         struct ebt_replace tmp;
 937         struct ebt_table *t;
 938         struct ebt_counter *counterstmp = NULL;
 939         /* used to be able to unlock earlier */
 940         struct ebt_table_info *table;
 941
 942         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 943                 return -EFAULT;
 944
 945         if (len != sizeof(tmp) + tmp.entries_size) {
 946                 BUGPRINT("Wrong len argument\n");
 947                 return -EINVAL;
 948         }
 949
 950         if (tmp.entries_size == 0) {
 951                 BUGPRINT("Entries_size never zero\n");
 952                 return -EINVAL;
 953         }
 954         /* overflow check */
 955         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
 956                         SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 957                 return -ENOMEM;
 958         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 959                 return -ENOMEM;
 960
 961         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
 962         newinfo = vmalloc(sizeof(*newinfo) + countersize);
 963         if (!newinfo)
 964                 return -ENOMEM;
 965
 966         if (countersize)
 967                 memset(newinfo->counters, 0, countersize);
 968
 969         newinfo->entries = vmalloc(tmp.entries_size);
 970         if (!newinfo->entries) {
 971                 ret = -ENOMEM;
 972                 goto free_newinfo;
 973         }
 974         if (copy_from_user(
 975            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
 976                 BUGPRINT("Couldn't copy entries from userspace\n");
 977                 ret = -EFAULT;
 978                 goto free_entries;
 979         }
 980
 981         /* the user wants counters back
 982            the check on the size is done later, when we have the lock */
 983         if (tmp.num_counters) {
 984                 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
 985                 if (!counterstmp) {
 986                         ret = -ENOMEM;
 987                         goto free_entries;
 988                 }
 989         }
 990         else
 991                 counterstmp = NULL;
 992
 993         /* this can get initialized by translate_table() */
 994         newinfo->chainstack = NULL;
 995         ret = ebt_verify_pointers(&tmp, newinfo);
 996         if (ret != 0)
 997                 goto free_counterstmp;
 998
 999         ret = translate_table(tmp.name, newinfo);
1000
1001         if (ret != 0)
1002                 goto free_counterstmp;
1003
1004         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1005         if (!t) {
1006                 ret = -ENOENT;
1007                 goto free_iterate;
1008         }
1009
1010         /* the table doesn't like it */
1011         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
1012                 goto free_unlock;
1013
1014         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
1015                 BUGPRINT("Wrong nr. of counters requested\n");
1016                 ret = -EINVAL;
1017                 goto free_unlock;
1018         }
1019
1020         /* we have the mutex lock, so no danger in reading this pointer */
1021         table = t->private;
1022         /* make sure the table can only be rmmod'ed if it contains no rules */
1023         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1024                 ret = -ENOENT;
1025                 goto free_unlock;
1026         } else if (table->nentries && !newinfo->nentries)
1027                 module_put(t->me);
1028         /* we need an atomic snapshot of the counters */
1029         write_lock_bh(&t->lock);
1030         if (tmp.num_counters)
1031                 get_counters(t->private->counters, counterstmp,
1032                    t->private->nentries);
1033
1034         t->private = newinfo;
1035         write_unlock_bh(&t->lock);
1036         mutex_unlock(&ebt_mutex);
1037         /* so, a user can change the chains while having messed up her counter
1038            allocation. Only reason why this is done is because this way the lock
1039            is held only once, while this doesn't bring the kernel into a
1040            dangerous state. */
1041         if (tmp.num_counters &&
1042            copy_to_user(tmp.counters, counterstmp,
1043            tmp.num_counters * sizeof(struct ebt_counter))) {
1044                 BUGPRINT("Couldn't copy counters to userspace\n");
1045                 ret = -EFAULT;
1046         }
1047         else
1048                 ret = 0;
1049
1050         /* decrease module count and free resources */
1051         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1052            ebt_cleanup_entry, NULL);
1053
1054         vfree(table->entries);
1055         if (table->chainstack) {
1056                 for_each_possible_cpu(i)
1057                         vfree(table->chainstack[i]);
1058                 vfree(table->chainstack);
1059         }
1060         vfree(table);
1061
1062         vfree(counterstmp);
1063         return ret;
1064
1065 free_unlock:
1066         mutex_unlock(&ebt_mutex);
1067 free_iterate:
1068         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1069            ebt_cleanup_entry, NULL);
1070 free_counterstmp:
1071         vfree(counterstmp);
1072         /* can be initialized in translate_table() */
1073         if (newinfo->chainstack) {
1074                 for_each_possible_cpu(i)
1075                         vfree(newinfo->chainstack[i]);
1076                 vfree(newinfo->chainstack);
1077         }
1078 free_entries:
1079         vfree(newinfo->entries);
1080 free_newinfo:
1081         vfree(newinfo);
1082         return ret;
1083 }
1084
1085 int ebt_register_table(struct ebt_table *table)
1086 {
1087         struct ebt_table_info *newinfo;
1088         struct ebt_table *t;
1089         struct ebt_replace_kernel *repl;
1090         int ret, i, countersize;
1091         void *p;
1092
1093         if (!table || !(repl = table->table) || !repl->entries ||
1094             repl->entries_size == 0 ||
1095             repl->counters || table->private) {
1096                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1097                 return -EINVAL;
1098         }
1099
1100         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1101         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1102         ret = -ENOMEM;
1103         if (!newinfo)
1104                 return -ENOMEM;
1105
1106         p = vmalloc(repl->entries_size);
1107         if (!p)
1108                 goto free_newinfo;
1109
1110         memcpy(p, repl->entries, repl->entries_size);
1111         newinfo->entries = p;
1112
1113         newinfo->entries_size = repl->entries_size;
1114         newinfo->nentries = repl->nentries;
1115
1116         if (countersize)
1117                 memset(newinfo->counters, 0, countersize);
1118
1119         /* fill in newinfo and parse the entries */
1120         newinfo->chainstack = NULL;
1121         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1122                 if ((repl->valid_hooks & (1 << i)) == 0)
1123                         newinfo->hook_entry[i] = NULL;
1124                 else
1125                         newinfo->hook_entry[i] = p +
1126                                 ((char *)repl->hook_entry[i] - repl->entries);
1127         }
1128         ret = translate_table(repl->name, newinfo);
1129         if (ret != 0) {
1130                 BUGPRINT("Translate_table failed\n");
1131                 goto free_chainstack;
1132         }
1133
1134         if (table->check && table->check(newinfo, table->valid_hooks)) {
1135                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1136                 return -EINVAL;
1137         }
1138
1139         table->private = newinfo;
1140         rwlock_init(&table->lock);
1141         ret = mutex_lock_interruptible(&ebt_mutex);
1142         if (ret != 0)
1143                 goto free_chainstack;
1144
1145         list_for_each_entry(t, &ebt_tables, list) {
1146                 if (strcmp(t->name, table->name) == 0) {
1147                         ret = -EEXIST;
1148                         BUGPRINT("Table name already exists\n");
1149                         goto free_unlock;
1150                 }
1151         }
1152
1153         /* Hold a reference count if the chains aren't empty */
1154         if (newinfo->nentries && !try_module_get(table->me)) {
1155                 ret = -ENOENT;
1156                 goto free_unlock;
1157         }
1158         list_add(&table->list, &ebt_tables);
1159         mutex_unlock(&ebt_mutex);
1160         return 0;
1161 free_unlock:
1162         mutex_unlock(&ebt_mutex);
1163 free_chainstack:
1164         if (newinfo->chainstack) {
1165                 for_each_possible_cpu(i)
1166                         vfree(newinfo->chainstack[i]);
1167                 vfree(newinfo->chainstack);
1168         }
1169         vfree(newinfo->entries);
1170 free_newinfo:
1171         vfree(newinfo);
1172         return ret;
1173 }
1174
1175 void ebt_unregister_table(struct ebt_table *table)
1176 {
1177         int i;
1178
1179         if (!table) {
1180                 BUGPRINT("Request to unregister NULL table!!!\n");
1181                 return;
1182         }
1183         mutex_lock(&ebt_mutex);
1184         list_del(&table->list);
1185         mutex_unlock(&ebt_mutex);
1186         vfree(table->private->entries);
1187         if (table->private->chainstack) {
1188                 for_each_possible_cpu(i)
1189                         vfree(table->private->chainstack[i]);
1190                 vfree(table->private->chainstack);
1191         }
1192         vfree(table->private);
1193 }
1194
1195 /* userspace just supplied us with counters */
1196 static int update_counters(void __user *user, unsigned int len)
1197 {
1198         int i, ret;
1199         struct ebt_counter *tmp;
1200         struct ebt_replace hlp;
1201         struct ebt_table *t;
1202
1203         if (copy_from_user(&hlp, user, sizeof(hlp)))
1204                 return -EFAULT;
1205
1206         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1207                 return -EINVAL;
1208         if (hlp.num_counters == 0)
1209                 return -EINVAL;
1210
1211         if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
1212                 MEMPRINT("Update_counters && nomemory\n");
1213                 return -ENOMEM;
1214         }
1215
1216         t = find_table_lock(hlp.name, &ret, &ebt_mutex);
1217         if (!t)
1218                 goto free_tmp;
1219
1220         if (hlp.num_counters != t->private->nentries) {
1221                 BUGPRINT("Wrong nr of counters\n");
1222                 ret = -EINVAL;
1223                 goto unlock_mutex;
1224         }
1225
1226         if ( copy_from_user(tmp, hlp.counters,
1227            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1228                 BUGPRINT("Updata_counters && !cfu\n");
1229                 ret = -EFAULT;
1230                 goto unlock_mutex;
1231         }
1232
1233         /* we want an atomic add of the counters */
1234         write_lock_bh(&t->lock);
1235
1236         /* we add to the counters of the first cpu */
1237         for (i = 0; i < hlp.num_counters; i++) {
1238                 t->private->counters[i].pcnt += tmp[i].pcnt;
1239                 t->private->counters[i].bcnt += tmp[i].bcnt;
1240         }
1241
1242         write_unlock_bh(&t->lock);
1243         ret = 0;
1244 unlock_mutex:
1245         mutex_unlock(&ebt_mutex);
1246 free_tmp:
1247         vfree(tmp);
1248         return ret;
1249 }
1250
1251 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1252    char *base, char __user *ubase)
1253 {
1254         char __user *hlp = ubase + ((char *)m - base);
1255         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1256                 return -EFAULT;
1257         return 0;
1258 }
1259
1260 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1261    char *base, char __user *ubase)
1262 {
1263         char __user *hlp = ubase + ((char *)w - base);
1264         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1265                 return -EFAULT;
1266         return 0;
1267 }
1268
1269 static inline int ebt_make_names(struct ebt_entry *e, char *base, char __user *ubase)
1270 {
1271         int ret;
1272         char __user *hlp;
1273         struct ebt_entry_target *t;
1274
1275         if (e->bitmask == 0)
1276                 return 0;
1277
1278         hlp = ubase + (((char *)e + e->target_offset) - base);
1279         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1280
1281         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1282         if (ret != 0)
1283                 return ret;
1284         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1285         if (ret != 0)
1286                 return ret;
1287         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1288                 return -EFAULT;
1289         return 0;
1290 }
1291
1292 /* called with ebt_mutex locked */
1293 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1294    int *len, int cmd)
1295 {
1296         struct ebt_replace tmp;
1297         struct ebt_counter *counterstmp, *oldcounters;
1298         unsigned int entries_size, nentries;
1299         char *entries;
1300
1301         if (cmd == EBT_SO_GET_ENTRIES) {
1302                 entries_size = t->private->entries_size;
1303                 nentries = t->private->nentries;
1304                 entries = t->private->entries;
1305                 oldcounters = t->private->counters;
1306         } else {
1307                 entries_size = t->table->entries_size;
1308                 nentries = t->table->nentries;
1309                 entries = t->table->entries;
1310                 oldcounters = t->table->counters;
1311         }
1312
1313         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1314                 BUGPRINT("Cfu didn't work\n");
1315                 return -EFAULT;
1316         }
1317
1318         if (*len != sizeof(struct ebt_replace) + entries_size +
1319            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1320                 BUGPRINT("Wrong size\n");
1321                 return -EINVAL;
1322         }
1323
1324         if (tmp.nentries != nentries) {
1325                 BUGPRINT("Nentries wrong\n");
1326                 return -EINVAL;
1327         }
1328
1329         if (tmp.entries_size != entries_size) {
1330                 BUGPRINT("Wrong size\n");
1331                 return -EINVAL;
1332         }
1333
1334         /* userspace might not need the counters */
1335         if (tmp.num_counters) {
1336                 if (tmp.num_counters != nentries) {
1337                         BUGPRINT("Num_counters wrong\n");
1338                         return -EINVAL;
1339                 }
1340                 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1341                 if (!counterstmp) {
1342                         MEMPRINT("Couldn't copy counters, out of memory\n");
1343                         return -ENOMEM;
1344                 }
1345                 write_lock_bh(&t->lock);
1346                 get_counters(oldcounters, counterstmp, nentries);
1347                 write_unlock_bh(&t->lock);
1348
1349                 if (copy_to_user(tmp.counters, counterstmp,
1350                    nentries * sizeof(struct ebt_counter))) {
1351                         BUGPRINT("Couldn't copy counters to userspace\n");
1352                         vfree(counterstmp);
1353                         return -EFAULT;
1354                 }
1355                 vfree(counterstmp);
1356         }
1357
1358         if (copy_to_user(tmp.entries, entries, entries_size)) {
1359                 BUGPRINT("Couldn't copy entries to userspace\n");
1360                 return -EFAULT;
1361         }
1362         /* set the match/watcher/target names right */
1363         return EBT_ENTRY_ITERATE(entries, entries_size,
1364            ebt_make_names, entries, tmp.entries);
1365 }
1366
1367 static int do_ebt_set_ctl(struct sock *sk,
1368         int cmd, void __user *user, unsigned int len)
1369 {
1370         int ret;
1371
1372         switch(cmd) {
1373         case EBT_SO_SET_ENTRIES:
1374                 ret = do_replace(user, len);
1375                 break;
1376         case EBT_SO_SET_COUNTERS:
1377                 ret = update_counters(user, len);
1378                 break;
1379         default:
1380                 ret = -EINVAL;
1381   }
1382         return ret;
1383 }
1384
1385 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1386 {
1387         int ret;
1388         struct ebt_replace tmp;
1389         struct ebt_table *t;
1390
1391         if (copy_from_user(&tmp, user, sizeof(tmp)))
1392                 return -EFAULT;
1393
1394         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1395         if (!t)
1396                 return ret;
1397
1398         switch(cmd) {
1399         case EBT_SO_GET_INFO:
1400         case EBT_SO_GET_INIT_INFO:
1401                 if (*len != sizeof(struct ebt_replace)){
1402                         ret = -EINVAL;
1403                         mutex_unlock(&ebt_mutex);
1404                         break;
1405                 }
1406                 if (cmd == EBT_SO_GET_INFO) {
1407                         tmp.nentries = t->private->nentries;
1408                         tmp.entries_size = t->private->entries_size;
1409                         tmp.valid_hooks = t->valid_hooks;
1410                 } else {
1411                         tmp.nentries = t->table->nentries;
1412                         tmp.entries_size = t->table->entries_size;
1413                         tmp.valid_hooks = t->table->valid_hooks;
1414                 }
1415                 mutex_unlock(&ebt_mutex);
1416                 if (copy_to_user(user, &tmp, *len) != 0){
1417                         BUGPRINT("c2u Didn't work\n");
1418                         ret = -EFAULT;
1419                         break;
1420                 }
1421                 ret = 0;
1422                 break;
1423
1424         case EBT_SO_GET_ENTRIES:
1425         case EBT_SO_GET_INIT_ENTRIES:
1426                 ret = copy_everything_to_user(t, user, len, cmd);
1427                 mutex_unlock(&ebt_mutex);
1428                 break;
1429
1430         default:
1431                 mutex_unlock(&ebt_mutex);
1432                 ret = -EINVAL;
1433         }
1434
1435         return ret;
1436 }
1437
1438 static struct nf_sockopt_ops ebt_sockopts =
1439 {
1440         .pf             = PF_INET,
1441         .set_optmin     = EBT_BASE_CTL,
1442         .set_optmax     = EBT_SO_SET_MAX + 1,
1443         .set            = do_ebt_set_ctl,
1444         .get_optmin     = EBT_BASE_CTL,
1445         .get_optmax     = EBT_SO_GET_MAX + 1,
1446         .get            = do_ebt_get_ctl,
1447         .owner          = THIS_MODULE,
1448 };
1449
1450 static int __init ebtables_init(void)
1451 {
1452         int ret;
1453
1454         ret = xt_register_target(&ebt_standard_target);
1455         if (ret < 0)
1456                 return ret;
1457         ret = nf_register_sockopt(&ebt_sockopts);
1458         if (ret < 0) {
1459                 xt_unregister_target(&ebt_standard_target);
1460                 return ret;
1461         }
1462
1463         printk(KERN_INFO "Ebtables v2.0 registered\n");
1464         return 0;
1465 }
1466
1467 static void __exit ebtables_fini(void)
1468 {
1469         nf_unregister_sockopt(&ebt_sockopts);
1470         xt_unregister_target(&ebt_standard_target);
1471         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
1472 }
1473
1474 EXPORT_SYMBOL(ebt_register_table);
1475 EXPORT_SYMBOL(ebt_unregister_table);
1476 EXPORT_SYMBOL(ebt_do_table);
1477 module_init(ebtables_init);
1478 module_exit(ebtables_fini);
1479 MODULE_LICENSE("GPL");