net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18
  19 #include <linux/kmod.h>
  20 #include <linux/module.h>
  21 #include <linux/vmalloc.h>
  22 #include <linux/netfilter/x_tables.h>
  23 #include <linux/netfilter_bridge/ebtables.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/mutex.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  37                                          ": out of memory: "format, ## args)
  38 /* #define MEMPRINT(format, args...) */
  39
  40
  41
  42 /*
  43  * Each cpu has its own set of counters, so there is no need for write_lock in
  44  * the softirq
  45  * For reading or updating the counters, the user context needs to
  46  * get a write_lock
  47  */
  48
  49 /* The size of each set of counters is altered to get cache alignment */
  50 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  51 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  52 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  53    COUNTER_OFFSET(n) * cpu))
  54
  55
  56
  57 static DEFINE_MUTEX(ebt_mutex);
  58
  59 static struct xt_target ebt_standard_target = {
  60         .name       = "standard",
  61         .revision   = 0,
  62         .family     = NFPROTO_BRIDGE,
  63         .targetsize = sizeof(int),
  64 };
  65
  66 static inline int
  67 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  68                struct xt_target_param *par)
  69 {
  70         par->target   = w->u.watcher;
  71         par->targinfo = w->data;
  72         w->u.watcher->target(skb, par);
  73         /* watchers don't give a verdict */
  74         return 0;
  75 }
  76
  77 static inline int ebt_do_match (struct ebt_entry_match *m,
  78    const struct sk_buff *skb, struct xt_match_param *par)
  79 {
  80         par->match     = m->u.match;
  81         par->matchinfo = m->data;
  82         return m->u.match->match(skb, par);
  83 }
  84
  85 static inline int ebt_dev_check(char *entry, const struct net_device *device)
  86 {
  87         int i = 0;
  88         const char *devname = device->name;
  89
  90         if (*entry == '\0')
  91                 return 0;
  92         if (!device)
  93                 return 1;
  94         /* 1 is the wildcard token */
  95         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
  96                 i++;
  97         return (devname[i] != entry[i] && entry[i] != 1);
  98 }
  99
 100 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 101 /* process standard matches */
 102 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 103    const struct net_device *in, const struct net_device *out)
 104 {
 105         int verdict, i;
 106
 107         if (e->bitmask & EBT_802_3) {
 108                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 109                         return 1;
 110         } else if (!(e->bitmask & EBT_NOPROTO) &&
 111            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 112                 return 1;
 113
 114         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 115                 return 1;
 116         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 117                 return 1;
 118         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 119            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 120                 return 1;
 121         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 122            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 123                 return 1;
 124
 125         if (e->bitmask & EBT_SOURCEMAC) {
 126                 verdict = 0;
 127                 for (i = 0; i < 6; i++)
 128                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 129                            e->sourcemsk[i];
 130                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 131                         return 1;
 132         }
 133         if (e->bitmask & EBT_DESTMAC) {
 134                 verdict = 0;
 135                 for (i = 0; i < 6; i++)
 136                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 137                            e->destmsk[i];
 138                 if (FWINV2(verdict != 0, EBT_IDEST) )
 139                         return 1;
 140         }
 141         return 0;
 142 }
 143
 144 /* Do some firewalling */
 145 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 146    const struct net_device *in, const struct net_device *out,
 147    struct ebt_table *table)
 148 {
 149         int i, nentries;
 150         struct ebt_entry *point;
 151         struct ebt_counter *counter_base, *cb_base;
 152         struct ebt_entry_target *t;
 153         int verdict, sp = 0;
 154         struct ebt_chainstack *cs;
 155         struct ebt_entries *chaininfo;
 156         char *base;
 157         struct ebt_table_info *private;
 158         bool hotdrop = false;
 159         struct xt_match_param mtpar;
 160         struct xt_target_param tgpar;
 161
 162         mtpar.family  = tgpar.family = NFPROTO_BRIDGE;
 163         mtpar.in      = tgpar.in  = in;
 164         mtpar.out     = tgpar.out = out;
 165         mtpar.hotdrop = &hotdrop;
 166         tgpar.hooknum = hook;
 167
 168         read_lock_bh(&table->lock);
 169         private = table->private;
 170         cb_base = COUNTER_BASE(private->counters, private->nentries,
 171            smp_processor_id());
 172         if (private->chainstack)
 173                 cs = private->chainstack[smp_processor_id()];
 174         else
 175                 cs = NULL;
 176         chaininfo = private->hook_entry[hook];
 177         nentries = private->hook_entry[hook]->nentries;
 178         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 179         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 180         /* base for chain jumps */
 181         base = private->entries;
 182         i = 0;
 183         while (i < nentries) {
 184                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 185                         goto letscontinue;
 186
 187                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
 188                         goto letscontinue;
 189                 if (hotdrop) {
 190                         read_unlock_bh(&table->lock);
 191                         return NF_DROP;
 192                 }
 193
 194                 /* increase counter */
 195                 (*(counter_base + i)).pcnt++;
 196                 (*(counter_base + i)).bcnt += skb->len;
 197
 198                 /* these should only watch: not modify, nor tell us
 199                    what to do with the packet */
 200                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &tgpar);
 201
 202                 t = (struct ebt_entry_target *)
 203                    (((char *)point) + point->target_offset);
 204                 /* standard target */
 205                 if (!t->u.target->target)
 206                         verdict = ((struct ebt_standard_target *)t)->verdict;
 207                 else {
 208                         tgpar.target   = t->u.target;
 209                         tgpar.targinfo = t->data;
 210                         verdict = t->u.target->target(skb, &tgpar);
 211                 }
 212                 if (verdict == EBT_ACCEPT) {
 213                         read_unlock_bh(&table->lock);
 214                         return NF_ACCEPT;
 215                 }
 216                 if (verdict == EBT_DROP) {
 217                         read_unlock_bh(&table->lock);
 218                         return NF_DROP;
 219                 }
 220                 if (verdict == EBT_RETURN) {
 221 letsreturn:
 222 #ifdef CONFIG_NETFILTER_DEBUG
 223                         if (sp == 0) {
 224                                 BUGPRINT("RETURN on base chain");
 225                                 /* act like this is EBT_CONTINUE */
 226                                 goto letscontinue;
 227                         }
 228 #endif
 229                         sp--;
 230                         /* put all the local variables right */
 231                         i = cs[sp].n;
 232                         chaininfo = cs[sp].chaininfo;
 233                         nentries = chaininfo->nentries;
 234                         point = cs[sp].e;
 235                         counter_base = cb_base +
 236                            chaininfo->counter_offset;
 237                         continue;
 238                 }
 239                 if (verdict == EBT_CONTINUE)
 240                         goto letscontinue;
 241 #ifdef CONFIG_NETFILTER_DEBUG
 242                 if (verdict < 0) {
 243                         BUGPRINT("bogus standard verdict\n");
 244                         read_unlock_bh(&table->lock);
 245                         return NF_DROP;
 246                 }
 247 #endif
 248                 /* jump to a udc */
 249                 cs[sp].n = i + 1;
 250                 cs[sp].chaininfo = chaininfo;
 251                 cs[sp].e = (struct ebt_entry *)
 252                    (((char *)point) + point->next_offset);
 253                 i = 0;
 254                 chaininfo = (struct ebt_entries *) (base + verdict);
 255 #ifdef CONFIG_NETFILTER_DEBUG
 256                 if (chaininfo->distinguisher) {
 257                         BUGPRINT("jump to non-chain\n");
 258                         read_unlock_bh(&table->lock);
 259                         return NF_DROP;
 260                 }
 261 #endif
 262                 nentries = chaininfo->nentries;
 263                 point = (struct ebt_entry *)chaininfo->data;
 264                 counter_base = cb_base + chaininfo->counter_offset;
 265                 sp++;
 266                 continue;
 267 letscontinue:
 268                 point = (struct ebt_entry *)
 269                    (((char *)point) + point->next_offset);
 270                 i++;
 271         }
 272
 273         /* I actually like this :) */
 274         if (chaininfo->policy == EBT_RETURN)
 275                 goto letsreturn;
 276         if (chaininfo->policy == EBT_ACCEPT) {
 277                 read_unlock_bh(&table->lock);
 278                 return NF_ACCEPT;
 279         }
 280         read_unlock_bh(&table->lock);
 281         return NF_DROP;
 282 }
 283
 284 /* If it succeeds, returns element and locks mutex */
 285 static inline void *
 286 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 287    struct mutex *mutex)
 288 {
 289         struct {
 290                 struct list_head list;
 291                 char name[EBT_FUNCTION_MAXNAMELEN];
 292         } *e;
 293
 294         *error = mutex_lock_interruptible(mutex);
 295         if (*error != 0)
 296                 return NULL;
 297
 298         list_for_each_entry(e, head, list) {
 299                 if (strcmp(e->name, name) == 0)
 300                         return e;
 301         }
 302         *error = -ENOENT;
 303         mutex_unlock(mutex);
 304         return NULL;
 305 }
 306
 307 static void *
 308 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 309    int *error, struct mutex *mutex)
 310 {
 311         return try_then_request_module(
 312                         find_inlist_lock_noload(head, name, error, mutex),
 313                         "%s%s", prefix, name);
 314 }
 315
 316 static inline struct ebt_table *
 317 find_table_lock(struct net *net, const char *name, int *error,
 318                 struct mutex *mutex)
 319 {
 320         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 321                                 "ebtable_", error, mutex);
 322 }
 323
 324 static inline int
 325 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 326                 unsigned int *cnt)
 327 {
 328         const struct ebt_entry *e = par->entryinfo;
 329         struct xt_match *match;
 330         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 331         int ret;
 332
 333         if (left < sizeof(struct ebt_entry_match) ||
 334             left - sizeof(struct ebt_entry_match) < m->match_size)
 335                 return -EINVAL;
 336
 337         match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
 338                 m->u.name, 0), "ebt_%s", m->u.name);
 339         if (IS_ERR(match))
 340                 return PTR_ERR(match);
 341         if (match == NULL)
 342                 return -ENOENT;
 343         m->u.match = match;
 344
 345         par->match     = match;
 346         par->matchinfo = m->data;
 347         ret = xt_check_match(par, m->match_size,
 348               e->ethproto, e->invflags & EBT_IPROTO);
 349         if (ret < 0) {
 350                 module_put(match->me);
 351                 return ret;
 352         }
 353
 354         (*cnt)++;
 355         return 0;
 356 }
 357
 358 static inline int
 359 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 360                   unsigned int *cnt)
 361 {
 362         const struct ebt_entry *e = par->entryinfo;
 363         struct xt_target *watcher;
 364         size_t left = ((char *)e + e->target_offset) - (char *)w;
 365         int ret;
 366
 367         if (left < sizeof(struct ebt_entry_watcher) ||
 368            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 369                 return -EINVAL;
 370
 371         watcher = try_then_request_module(
 372                   xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
 373                   "ebt_%s", w->u.name);
 374         if (IS_ERR(watcher))
 375                 return PTR_ERR(watcher);
 376         if (watcher == NULL)
 377                 return -ENOENT;
 378         w->u.watcher = watcher;
 379
 380         par->target   = watcher;
 381         par->targinfo = w->data;
 382         ret = xt_check_target(par, w->watcher_size,
 383               e->ethproto, e->invflags & EBT_IPROTO);
 384         if (ret < 0) {
 385                 module_put(watcher->me);
 386                 return ret;
 387         }
 388
 389         (*cnt)++;
 390         return 0;
 391 }
 392
 393 static int ebt_verify_pointers(struct ebt_replace *repl,
 394                                struct ebt_table_info *newinfo)
 395 {
 396         unsigned int limit = repl->entries_size;
 397         unsigned int valid_hooks = repl->valid_hooks;
 398         unsigned int offset = 0;
 399         int i;
 400
 401         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 402                 newinfo->hook_entry[i] = NULL;
 403
 404         newinfo->entries_size = repl->entries_size;
 405         newinfo->nentries = repl->nentries;
 406
 407         while (offset < limit) {
 408                 size_t left = limit - offset;
 409                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 410
 411                 if (left < sizeof(unsigned int))
 412                         break;
 413
 414                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 415                         if ((valid_hooks & (1 << i)) == 0)
 416                                 continue;
 417                         if ((char __user *)repl->hook_entry[i] ==
 418                              repl->entries + offset)
 419                                 break;
 420                 }
 421
 422                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 423                         if (e->bitmask != 0) {
 424                                 /* we make userspace set this right,
 425                                    so there is no misunderstanding */
 426                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 427                                          "in distinguisher\n");
 428                                 return -EINVAL;
 429                         }
 430                         if (i != NF_BR_NUMHOOKS)
 431                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 432                         if (left < sizeof(struct ebt_entries))
 433                                 break;
 434                         offset += sizeof(struct ebt_entries);
 435                 } else {
 436                         if (left < sizeof(struct ebt_entry))
 437                                 break;
 438                         if (left < e->next_offset)
 439                                 break;
 440                         offset += e->next_offset;
 441                 }
 442         }
 443         if (offset != limit) {
 444                 BUGPRINT("entries_size too small\n");
 445                 return -EINVAL;
 446         }
 447
 448         /* check if all valid hooks have a chain */
 449         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 450                 if (!newinfo->hook_entry[i] &&
 451                    (valid_hooks & (1 << i))) {
 452                         BUGPRINT("Valid hook without chain\n");
 453                         return -EINVAL;
 454                 }
 455         }
 456         return 0;
 457 }
 458
 459 /*
 460  * this one is very careful, as it is the first function
 461  * to parse the userspace data
 462  */
 463 static inline int
 464 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
 465    struct ebt_table_info *newinfo,
 466    unsigned int *n, unsigned int *cnt,
 467    unsigned int *totalcnt, unsigned int *udc_cnt)
 468 {
 469         int i;
 470
 471         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 472                 if ((void *)e == (void *)newinfo->hook_entry[i])
 473                         break;
 474         }
 475         /* beginning of a new chain
 476            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 477         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 478                 /* this checks if the previous chain has as many entries
 479                    as it said it has */
 480                 if (*n != *cnt) {
 481                         BUGPRINT("nentries does not equal the nr of entries "
 482                                  "in the chain\n");
 483                         return -EINVAL;
 484                 }
 485                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 486                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 487                         /* only RETURN from udc */
 488                         if (i != NF_BR_NUMHOOKS ||
 489                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 490                                 BUGPRINT("bad policy\n");
 491                                 return -EINVAL;
 492                         }
 493                 }
 494                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 495                         (*udc_cnt)++;
 496                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 497                         BUGPRINT("counter_offset != totalcnt");
 498                         return -EINVAL;
 499                 }
 500                 *n = ((struct ebt_entries *)e)->nentries;
 501                 *cnt = 0;
 502                 return 0;
 503         }
 504         /* a plain old entry, heh */
 505         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 506            e->watchers_offset > e->target_offset ||
 507            e->target_offset >= e->next_offset) {
 508                 BUGPRINT("entry offsets not in right order\n");
 509                 return -EINVAL;
 510         }
 511         /* this is not checked anywhere else */
 512         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 513                 BUGPRINT("target size too small\n");
 514                 return -EINVAL;
 515         }
 516         (*cnt)++;
 517         (*totalcnt)++;
 518         return 0;
 519 }
 520
 521 struct ebt_cl_stack
 522 {
 523         struct ebt_chainstack cs;
 524         int from;
 525         unsigned int hookmask;
 526 };
 527
 528 /*
 529  * we need these positions to check that the jumps to a different part of the
 530  * entries is a jump to the beginning of a new chain.
 531  */
 532 static inline int
 533 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 534    unsigned int *n, struct ebt_cl_stack *udc)
 535 {
 536         int i;
 537
 538         /* we're only interested in chain starts */
 539         if (e->bitmask)
 540                 return 0;
 541         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 542                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 543                         break;
 544         }
 545         /* only care about udc */
 546         if (i != NF_BR_NUMHOOKS)
 547                 return 0;
 548
 549         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 550         /* these initialisations are depended on later in check_chainloops() */
 551         udc[*n].cs.n = 0;
 552         udc[*n].hookmask = 0;
 553
 554         (*n)++;
 555         return 0;
 556 }
 557
 558 static inline int
 559 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 560 {
 561         struct xt_mtdtor_param par;
 562
 563         if (i && (*i)-- == 0)
 564                 return 1;
 565
 566         par.match     = m->u.match;
 567         par.matchinfo = m->data;
 568         par.family    = NFPROTO_BRIDGE;
 569         if (par.match->destroy != NULL)
 570                 par.match->destroy(&par);
 571         module_put(par.match->me);
 572         return 0;
 573 }
 574
 575 static inline int
 576 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 577 {
 578         struct xt_tgdtor_param par;
 579
 580         if (i && (*i)-- == 0)
 581                 return 1;
 582
 583         par.target   = w->u.watcher;
 584         par.targinfo = w->data;
 585         par.family   = NFPROTO_BRIDGE;
 586         if (par.target->destroy != NULL)
 587                 par.target->destroy(&par);
 588         module_put(par.target->me);
 589         return 0;
 590 }
 591
 592 static inline int
 593 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 594 {
 595         struct xt_tgdtor_param par;
 596         struct ebt_entry_target *t;
 597
 598         if (e->bitmask == 0)
 599                 return 0;
 600         /* we're done */
 601         if (cnt && (*cnt)-- == 0)
 602                 return 1;
 603         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
 604         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
 605         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 606
 607         par.target   = t->u.target;
 608         par.targinfo = t->data;
 609         par.family   = NFPROTO_BRIDGE;
 610         if (par.target->destroy != NULL)
 611                 par.target->destroy(&par);
 612         module_put(par.target->me);
 613         return 0;
 614 }
 615
 616 static inline int
 617 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
 618    const char *name, unsigned int *cnt,
 619    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 620 {
 621         struct ebt_entry_target *t;
 622         struct xt_target *target;
 623         unsigned int i, j, hook = 0, hookmask = 0;
 624         size_t gap;
 625         int ret;
 626         struct xt_mtchk_param mtpar;
 627         struct xt_tgchk_param tgpar;
 628
 629         /* don't mess with the struct ebt_entries */
 630         if (e->bitmask == 0)
 631                 return 0;
 632
 633         if (e->bitmask & ~EBT_F_MASK) {
 634                 BUGPRINT("Unknown flag for bitmask\n");
 635                 return -EINVAL;
 636         }
 637         if (e->invflags & ~EBT_INV_MASK) {
 638                 BUGPRINT("Unknown flag for inv bitmask\n");
 639                 return -EINVAL;
 640         }
 641         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 642                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 643                 return -EINVAL;
 644         }
 645         /* what hook do we belong to? */
 646         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 647                 if (!newinfo->hook_entry[i])
 648                         continue;
 649                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 650                         hook = i;
 651                 else
 652                         break;
 653         }
 654         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 655            a base chain */
 656         if (i < NF_BR_NUMHOOKS)
 657                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 658         else {
 659                 for (i = 0; i < udc_cnt; i++)
 660                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 661                                 break;
 662                 if (i == 0)
 663                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 664                 else
 665                         hookmask = cl_s[i - 1].hookmask;
 666         }
 667         i = 0;
 668
 669         mtpar.table     = tgpar.table     = name;
 670         mtpar.entryinfo = tgpar.entryinfo = e;
 671         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 672         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 673         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 674         if (ret != 0)
 675                 goto cleanup_matches;
 676         j = 0;
 677         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 678         if (ret != 0)
 679                 goto cleanup_watchers;
 680         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 681         gap = e->next_offset - e->target_offset;
 682
 683         target = try_then_request_module(
 684                  xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
 685                  "ebt_%s", t->u.name);
 686         if (IS_ERR(target)) {
 687                 ret = PTR_ERR(target);
 688                 goto cleanup_watchers;
 689         } else if (target == NULL) {
 690                 ret = -ENOENT;
 691                 goto cleanup_watchers;
 692         }
 693
 694         t->u.target = target;
 695         if (t->u.target == &ebt_standard_target) {
 696                 if (gap < sizeof(struct ebt_standard_target)) {
 697                         BUGPRINT("Standard target size too big\n");
 698                         ret = -EFAULT;
 699                         goto cleanup_watchers;
 700                 }
 701                 if (((struct ebt_standard_target *)t)->verdict <
 702                    -NUM_STANDARD_TARGETS) {
 703                         BUGPRINT("Invalid standard target\n");
 704                         ret = -EFAULT;
 705                         goto cleanup_watchers;
 706                 }
 707         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 708                 module_put(t->u.target->me);
 709                 ret = -EFAULT;
 710                 goto cleanup_watchers;
 711         }
 712
 713         tgpar.target   = target;
 714         tgpar.targinfo = t->data;
 715         ret = xt_check_target(&tgpar, t->target_size,
 716               e->ethproto, e->invflags & EBT_IPROTO);
 717         if (ret < 0) {
 718                 module_put(target->me);
 719                 goto cleanup_watchers;
 720         }
 721         (*cnt)++;
 722         return 0;
 723 cleanup_watchers:
 724         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
 725 cleanup_matches:
 726         EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
 727         return ret;
 728 }
 729
 730 /*
 731  * checks for loops and sets the hook mask for udc
 732  * the hook mask for udc tells us from which base chains the udc can be
 733  * accessed. This mask is a parameter to the check() functions of the extensions
 734  */
 735 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 736    unsigned int udc_cnt, unsigned int hooknr, char *base)
 737 {
 738         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 739         struct ebt_entry *e = (struct ebt_entry *)chain->data;
 740         struct ebt_entry_target *t;
 741
 742         while (pos < nentries || chain_nr != -1) {
 743                 /* end of udc, go back one 'recursion' step */
 744                 if (pos == nentries) {
 745                         /* put back values of the time when this chain was called */
 746                         e = cl_s[chain_nr].cs.e;
 747                         if (cl_s[chain_nr].from != -1)
 748                                 nentries =
 749                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 750                         else
 751                                 nentries = chain->nentries;
 752                         pos = cl_s[chain_nr].cs.n;
 753                         /* make sure we won't see a loop that isn't one */
 754                         cl_s[chain_nr].cs.n = 0;
 755                         chain_nr = cl_s[chain_nr].from;
 756                         if (pos == nentries)
 757                                 continue;
 758                 }
 759                 t = (struct ebt_entry_target *)
 760                    (((char *)e) + e->target_offset);
 761                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 762                         goto letscontinue;
 763                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 764                    e->next_offset) {
 765                         BUGPRINT("Standard target size too big\n");
 766                         return -1;
 767                 }
 768                 verdict = ((struct ebt_standard_target *)t)->verdict;
 769                 if (verdict >= 0) { /* jump to another chain */
 770                         struct ebt_entries *hlp2 =
 771                            (struct ebt_entries *)(base + verdict);
 772                         for (i = 0; i < udc_cnt; i++)
 773                                 if (hlp2 == cl_s[i].cs.chaininfo)
 774                                         break;
 775                         /* bad destination or loop */
 776                         if (i == udc_cnt) {
 777                                 BUGPRINT("bad destination\n");
 778                                 return -1;
 779                         }
 780                         if (cl_s[i].cs.n) {
 781                                 BUGPRINT("loop\n");
 782                                 return -1;
 783                         }
 784                         if (cl_s[i].hookmask & (1 << hooknr))
 785                                 goto letscontinue;
 786                         /* this can't be 0, so the loop test is correct */
 787                         cl_s[i].cs.n = pos + 1;
 788                         pos = 0;
 789                         cl_s[i].cs.e = ((void *)e + e->next_offset);
 790                         e = (struct ebt_entry *)(hlp2->data);
 791                         nentries = hlp2->nentries;
 792                         cl_s[i].from = chain_nr;
 793                         chain_nr = i;
 794                         /* this udc is accessible from the base chain for hooknr */
 795                         cl_s[i].hookmask |= (1 << hooknr);
 796                         continue;
 797                 }
 798 letscontinue:
 799                 e = (void *)e + e->next_offset;
 800                 pos++;
 801         }
 802         return 0;
 803 }
 804
 805 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 806 static int translate_table(char *name, struct ebt_table_info *newinfo)
 807 {
 808         unsigned int i, j, k, udc_cnt;
 809         int ret;
 810         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 811
 812         i = 0;
 813         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 814                 i++;
 815         if (i == NF_BR_NUMHOOKS) {
 816                 BUGPRINT("No valid hooks specified\n");
 817                 return -EINVAL;
 818         }
 819         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 820                 BUGPRINT("Chains don't start at beginning\n");
 821                 return -EINVAL;
 822         }
 823         /* make sure chains are ordered after each other in same order
 824            as their corresponding hooks */
 825         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 826                 if (!newinfo->hook_entry[j])
 827                         continue;
 828                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 829                         BUGPRINT("Hook order must be followed\n");
 830                         return -EINVAL;
 831                 }
 832                 i = j;
 833         }
 834
 835         /* do some early checkings and initialize some things */
 836         i = 0; /* holds the expected nr. of entries for the chain */
 837         j = 0; /* holds the up to now counted entries for the chain */
 838         k = 0; /* holds the total nr. of entries, should equal
 839                   newinfo->nentries afterwards */
 840         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 841         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 842            ebt_check_entry_size_and_hooks, newinfo,
 843            &i, &j, &k, &udc_cnt);
 844
 845         if (ret != 0)
 846                 return ret;
 847
 848         if (i != j) {
 849                 BUGPRINT("nentries does not equal the nr of entries in the "
 850                          "(last) chain\n");
 851                 return -EINVAL;
 852         }
 853         if (k != newinfo->nentries) {
 854                 BUGPRINT("Total nentries is wrong\n");
 855                 return -EINVAL;
 856         }
 857
 858         /* get the location of the udc, put them in an array
 859            while we're at it, allocate the chainstack */
 860         if (udc_cnt) {
 861                 /* this will get free'd in do_replace()/ebt_register_table()
 862                    if an error occurs */
 863                 newinfo->chainstack =
 864                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 865                 if (!newinfo->chainstack)
 866                         return -ENOMEM;
 867                 for_each_possible_cpu(i) {
 868                         newinfo->chainstack[i] =
 869                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 870                         if (!newinfo->chainstack[i]) {
 871                                 while (i)
 872                                         vfree(newinfo->chainstack[--i]);
 873                                 vfree(newinfo->chainstack);
 874                                 newinfo->chainstack = NULL;
 875                                 return -ENOMEM;
 876                         }
 877                 }
 878
 879                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 880                 if (!cl_s)
 881                         return -ENOMEM;
 882                 i = 0; /* the i'th udc */
 883                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 884                    ebt_get_udc_positions, newinfo, &i, cl_s);
 885                 /* sanity check */
 886                 if (i != udc_cnt) {
 887                         BUGPRINT("i != udc_cnt\n");
 888                         vfree(cl_s);
 889                         return -EFAULT;
 890                 }
 891         }
 892
 893         /* Check for loops */
 894         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 895                 if (newinfo->hook_entry[i])
 896                         if (check_chainloops(newinfo->hook_entry[i],
 897                            cl_s, udc_cnt, i, newinfo->entries)) {
 898                                 vfree(cl_s);
 899                                 return -EINVAL;
 900                         }
 901
 902         /* we now know the following (along with E=mc²):
 903            - the nr of entries in each chain is right
 904            - the size of the allocated space is right
 905            - all valid hooks have a corresponding chain
 906            - there are no loops
 907            - wrong data can still be on the level of a single entry
 908            - could be there are jumps to places that are not the
 909              beginning of a chain. This can only occur in chains that
 910              are not accessible from any base chains, so we don't care. */
 911
 912         /* used to know what we need to clean up if something goes wrong */
 913         i = 0;
 914         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 915            ebt_check_entry, newinfo, name, &i, cl_s, udc_cnt);
 916         if (ret != 0) {
 917                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 918                    ebt_cleanup_entry, &i);
 919         }
 920         vfree(cl_s);
 921         return ret;
 922 }
 923
 924 /* called under write_lock */
 925 static void get_counters(struct ebt_counter *oldcounters,
 926    struct ebt_counter *counters, unsigned int nentries)
 927 {
 928         int i, cpu;
 929         struct ebt_counter *counter_base;
 930
 931         /* counters of cpu 0 */
 932         memcpy(counters, oldcounters,
 933                sizeof(struct ebt_counter) * nentries);
 934
 935         /* add other counters to those of cpu 0 */
 936         for_each_possible_cpu(cpu) {
 937                 if (cpu == 0)
 938                         continue;
 939                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 940                 for (i = 0; i < nentries; i++) {
 941                         counters[i].pcnt += counter_base[i].pcnt;
 942                         counters[i].bcnt += counter_base[i].bcnt;
 943                 }
 944         }
 945 }
 946
 947 /* replace the table */
 948 static int do_replace(struct net *net, void __user *user, unsigned int len)
 949 {
 950         int ret, i, countersize;
 951         struct ebt_table_info *newinfo;
 952         struct ebt_replace tmp;
 953         struct ebt_table *t;
 954         struct ebt_counter *counterstmp = NULL;
 955         /* used to be able to unlock earlier */
 956         struct ebt_table_info *table;
 957
 958         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 959                 return -EFAULT;
 960
 961         if (len != sizeof(tmp) + tmp.entries_size) {
 962                 BUGPRINT("Wrong len argument\n");
 963                 return -EINVAL;
 964         }
 965
 966         if (tmp.entries_size == 0) {
 967                 BUGPRINT("Entries_size never zero\n");
 968                 return -EINVAL;
 969         }
 970         /* overflow check */
 971         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
 972                         SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 973                 return -ENOMEM;
 974         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 975                 return -ENOMEM;
 976
 977         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
 978         newinfo = vmalloc(sizeof(*newinfo) + countersize);
 979         if (!newinfo)
 980                 return -ENOMEM;
 981
 982         if (countersize)
 983                 memset(newinfo->counters, 0, countersize);
 984
 985         newinfo->entries = vmalloc(tmp.entries_size);
 986         if (!newinfo->entries) {
 987                 ret = -ENOMEM;
 988                 goto free_newinfo;
 989         }
 990         if (copy_from_user(
 991            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
 992                 BUGPRINT("Couldn't copy entries from userspace\n");
 993                 ret = -EFAULT;
 994                 goto free_entries;
 995         }
 996
 997         /* the user wants counters back
 998            the check on the size is done later, when we have the lock */
 999         if (tmp.num_counters) {
1000                 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
1001                 if (!counterstmp) {
1002                         ret = -ENOMEM;
1003                         goto free_entries;
1004                 }
1005         }
1006         else
1007                 counterstmp = NULL;
1008
1009         /* this can get initialized by translate_table() */
1010         newinfo->chainstack = NULL;
1011         ret = ebt_verify_pointers(&tmp, newinfo);
1012         if (ret != 0)
1013                 goto free_counterstmp;
1014
1015         ret = translate_table(tmp.name, newinfo);
1016
1017         if (ret != 0)
1018                 goto free_counterstmp;
1019
1020         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1021         if (!t) {
1022                 ret = -ENOENT;
1023                 goto free_iterate;
1024         }
1025
1026         /* the table doesn't like it */
1027         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
1028                 goto free_unlock;
1029
1030         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
1031                 BUGPRINT("Wrong nr. of counters requested\n");
1032                 ret = -EINVAL;
1033                 goto free_unlock;
1034         }
1035
1036         /* we have the mutex lock, so no danger in reading this pointer */
1037         table = t->private;
1038         /* make sure the table can only be rmmod'ed if it contains no rules */
1039         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1040                 ret = -ENOENT;
1041                 goto free_unlock;
1042         } else if (table->nentries && !newinfo->nentries)
1043                 module_put(t->me);
1044         /* we need an atomic snapshot of the counters */
1045         write_lock_bh(&t->lock);
1046         if (tmp.num_counters)
1047                 get_counters(t->private->counters, counterstmp,
1048                    t->private->nentries);
1049
1050         t->private = newinfo;
1051         write_unlock_bh(&t->lock);
1052         mutex_unlock(&ebt_mutex);
1053         /* so, a user can change the chains while having messed up her counter
1054            allocation. Only reason why this is done is because this way the lock
1055            is held only once, while this doesn't bring the kernel into a
1056            dangerous state. */
1057         if (tmp.num_counters &&
1058            copy_to_user(tmp.counters, counterstmp,
1059            tmp.num_counters * sizeof(struct ebt_counter))) {
1060                 BUGPRINT("Couldn't copy counters to userspace\n");
1061                 ret = -EFAULT;
1062         }
1063         else
1064                 ret = 0;
1065
1066         /* decrease module count and free resources */
1067         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1068            ebt_cleanup_entry, NULL);
1069
1070         vfree(table->entries);
1071         if (table->chainstack) {
1072                 for_each_possible_cpu(i)
1073                         vfree(table->chainstack[i]);
1074                 vfree(table->chainstack);
1075         }
1076         vfree(table);
1077
1078         vfree(counterstmp);
1079         return ret;
1080
1081 free_unlock:
1082         mutex_unlock(&ebt_mutex);
1083 free_iterate:
1084         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1085            ebt_cleanup_entry, NULL);
1086 free_counterstmp:
1087         vfree(counterstmp);
1088         /* can be initialized in translate_table() */
1089         if (newinfo->chainstack) {
1090                 for_each_possible_cpu(i)
1091                         vfree(newinfo->chainstack[i]);
1092                 vfree(newinfo->chainstack);
1093         }
1094 free_entries:
1095         vfree(newinfo->entries);
1096 free_newinfo:
1097         vfree(newinfo);
1098         return ret;
1099 }
1100
1101 int ebt_register_table(struct net *net, struct ebt_table *table)
1102 {
1103         struct ebt_table_info *newinfo;
1104         struct ebt_table *t;
1105         struct ebt_replace_kernel *repl;
1106         int ret, i, countersize;
1107         void *p;
1108
1109         if (!table || !(repl = table->table) || !repl->entries ||
1110             repl->entries_size == 0 ||
1111             repl->counters || table->private) {
1112                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1113                 return -EINVAL;
1114         }
1115
1116         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1117         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1118         ret = -ENOMEM;
1119         if (!newinfo)
1120                 return -ENOMEM;
1121
1122         p = vmalloc(repl->entries_size);
1123         if (!p)
1124                 goto free_newinfo;
1125
1126         memcpy(p, repl->entries, repl->entries_size);
1127         newinfo->entries = p;
1128
1129         newinfo->entries_size = repl->entries_size;
1130         newinfo->nentries = repl->nentries;
1131
1132         if (countersize)
1133                 memset(newinfo->counters, 0, countersize);
1134
1135         /* fill in newinfo and parse the entries */
1136         newinfo->chainstack = NULL;
1137         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1138                 if ((repl->valid_hooks & (1 << i)) == 0)
1139                         newinfo->hook_entry[i] = NULL;
1140                 else
1141                         newinfo->hook_entry[i] = p +
1142                                 ((char *)repl->hook_entry[i] - repl->entries);
1143         }
1144         ret = translate_table(repl->name, newinfo);
1145         if (ret != 0) {
1146                 BUGPRINT("Translate_table failed\n");
1147                 goto free_chainstack;
1148         }
1149
1150         if (table->check && table->check(newinfo, table->valid_hooks)) {
1151                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1152                 return -EINVAL;
1153         }
1154
1155         table->private = newinfo;
1156         rwlock_init(&table->lock);
1157         ret = mutex_lock_interruptible(&ebt_mutex);
1158         if (ret != 0)
1159                 goto free_chainstack;
1160
1161         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1162                 if (strcmp(t->name, table->name) == 0) {
1163                         ret = -EEXIST;
1164                         BUGPRINT("Table name already exists\n");
1165                         goto free_unlock;
1166                 }
1167         }
1168
1169         /* Hold a reference count if the chains aren't empty */
1170         if (newinfo->nentries && !try_module_get(table->me)) {
1171                 ret = -ENOENT;
1172                 goto free_unlock;
1173         }
1174         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1175         mutex_unlock(&ebt_mutex);
1176         return 0;
1177 free_unlock:
1178         mutex_unlock(&ebt_mutex);
1179 free_chainstack:
1180         if (newinfo->chainstack) {
1181                 for_each_possible_cpu(i)
1182                         vfree(newinfo->chainstack[i]);
1183                 vfree(newinfo->chainstack);
1184         }
1185         vfree(newinfo->entries);
1186 free_newinfo:
1187         vfree(newinfo);
1188         return ret;
1189 }
1190
1191 void ebt_unregister_table(struct ebt_table *table)
1192 {
1193         int i;
1194
1195         if (!table) {
1196                 BUGPRINT("Request to unregister NULL table!!!\n");
1197                 return;
1198         }
1199         mutex_lock(&ebt_mutex);
1200         list_del(&table->list);
1201         mutex_unlock(&ebt_mutex);
1202         vfree(table->private->entries);
1203         if (table->private->chainstack) {
1204                 for_each_possible_cpu(i)
1205                         vfree(table->private->chainstack[i]);
1206                 vfree(table->private->chainstack);
1207         }
1208         vfree(table->private);
1209 }
1210
1211 /* userspace just supplied us with counters */
1212 static int update_counters(struct net *net, void __user *user, unsigned int len)
1213 {
1214         int i, ret;
1215         struct ebt_counter *tmp;
1216         struct ebt_replace hlp;
1217         struct ebt_table *t;
1218
1219         if (copy_from_user(&hlp, user, sizeof(hlp)))
1220                 return -EFAULT;
1221
1222         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1223                 return -EINVAL;
1224         if (hlp.num_counters == 0)
1225                 return -EINVAL;
1226
1227         if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
1228                 MEMPRINT("Update_counters && nomemory\n");
1229                 return -ENOMEM;
1230         }
1231
1232         t = find_table_lock(net, hlp.name, &ret, &ebt_mutex);
1233         if (!t)
1234                 goto free_tmp;
1235
1236         if (hlp.num_counters != t->private->nentries) {
1237                 BUGPRINT("Wrong nr of counters\n");
1238                 ret = -EINVAL;
1239                 goto unlock_mutex;
1240         }
1241
1242         if ( copy_from_user(tmp, hlp.counters,
1243            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1244                 BUGPRINT("Updata_counters && !cfu\n");
1245                 ret = -EFAULT;
1246                 goto unlock_mutex;
1247         }
1248
1249         /* we want an atomic add of the counters */
1250         write_lock_bh(&t->lock);
1251
1252         /* we add to the counters of the first cpu */
1253         for (i = 0; i < hlp.num_counters; i++) {
1254                 t->private->counters[i].pcnt += tmp[i].pcnt;
1255                 t->private->counters[i].bcnt += tmp[i].bcnt;
1256         }
1257
1258         write_unlock_bh(&t->lock);
1259         ret = 0;
1260 unlock_mutex:
1261         mutex_unlock(&ebt_mutex);
1262 free_tmp:
1263         vfree(tmp);
1264         return ret;
1265 }
1266
1267 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1268    char *base, char __user *ubase)
1269 {
1270         char __user *hlp = ubase + ((char *)m - base);
1271         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1272                 return -EFAULT;
1273         return 0;
1274 }
1275
1276 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1277    char *base, char __user *ubase)
1278 {
1279         char __user *hlp = ubase + ((char *)w - base);
1280         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1281                 return -EFAULT;
1282         return 0;
1283 }
1284
1285 static inline int ebt_make_names(struct ebt_entry *e, char *base, char __user *ubase)
1286 {
1287         int ret;
1288         char __user *hlp;
1289         struct ebt_entry_target *t;
1290
1291         if (e->bitmask == 0)
1292                 return 0;
1293
1294         hlp = ubase + (((char *)e + e->target_offset) - base);
1295         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1296
1297         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1298         if (ret != 0)
1299                 return ret;
1300         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1301         if (ret != 0)
1302                 return ret;
1303         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1304                 return -EFAULT;
1305         return 0;
1306 }
1307
1308 /* called with ebt_mutex locked */
1309 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1310    int *len, int cmd)
1311 {
1312         struct ebt_replace tmp;
1313         struct ebt_counter *counterstmp, *oldcounters;
1314         unsigned int entries_size, nentries;
1315         char *entries;
1316
1317         if (cmd == EBT_SO_GET_ENTRIES) {
1318                 entries_size = t->private->entries_size;
1319                 nentries = t->private->nentries;
1320                 entries = t->private->entries;
1321                 oldcounters = t->private->counters;
1322         } else {
1323                 entries_size = t->table->entries_size;
1324                 nentries = t->table->nentries;
1325                 entries = t->table->entries;
1326                 oldcounters = t->table->counters;
1327         }
1328
1329         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1330                 BUGPRINT("Cfu didn't work\n");
1331                 return -EFAULT;
1332         }
1333
1334         if (*len != sizeof(struct ebt_replace) + entries_size +
1335            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1336                 BUGPRINT("Wrong size\n");
1337                 return -EINVAL;
1338         }
1339
1340         if (tmp.nentries != nentries) {
1341                 BUGPRINT("Nentries wrong\n");
1342                 return -EINVAL;
1343         }
1344
1345         if (tmp.entries_size != entries_size) {
1346                 BUGPRINT("Wrong size\n");
1347                 return -EINVAL;
1348         }
1349
1350         /* userspace might not need the counters */
1351         if (tmp.num_counters) {
1352                 if (tmp.num_counters != nentries) {
1353                         BUGPRINT("Num_counters wrong\n");
1354                         return -EINVAL;
1355                 }
1356                 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1357                 if (!counterstmp) {
1358                         MEMPRINT("Couldn't copy counters, out of memory\n");
1359                         return -ENOMEM;
1360                 }
1361                 write_lock_bh(&t->lock);
1362                 get_counters(oldcounters, counterstmp, nentries);
1363                 write_unlock_bh(&t->lock);
1364
1365                 if (copy_to_user(tmp.counters, counterstmp,
1366                    nentries * sizeof(struct ebt_counter))) {
1367                         BUGPRINT("Couldn't copy counters to userspace\n");
1368                         vfree(counterstmp);
1369                         return -EFAULT;
1370                 }
1371                 vfree(counterstmp);
1372         }
1373
1374         if (copy_to_user(tmp.entries, entries, entries_size)) {
1375                 BUGPRINT("Couldn't copy entries to userspace\n");
1376                 return -EFAULT;
1377         }
1378         /* set the match/watcher/target names right */
1379         return EBT_ENTRY_ITERATE(entries, entries_size,
1380            ebt_make_names, entries, tmp.entries);
1381 }
1382
1383 static int do_ebt_set_ctl(struct sock *sk,
1384         int cmd, void __user *user, unsigned int len)
1385 {
1386         int ret;
1387
1388         switch(cmd) {
1389         case EBT_SO_SET_ENTRIES:
1390                 ret = do_replace(sock_net(sk), user, len);
1391                 break;
1392         case EBT_SO_SET_COUNTERS:
1393                 ret = update_counters(sock_net(sk), user, len);
1394                 break;
1395         default:
1396                 ret = -EINVAL;
1397   }
1398         return ret;
1399 }
1400
1401 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1402 {
1403         int ret;
1404         struct ebt_replace tmp;
1405         struct ebt_table *t;
1406
1407         if (copy_from_user(&tmp, user, sizeof(tmp)))
1408                 return -EFAULT;
1409
1410         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1411         if (!t)
1412                 return ret;
1413
1414         switch(cmd) {
1415         case EBT_SO_GET_INFO:
1416         case EBT_SO_GET_INIT_INFO:
1417                 if (*len != sizeof(struct ebt_replace)){
1418                         ret = -EINVAL;
1419                         mutex_unlock(&ebt_mutex);
1420                         break;
1421                 }
1422                 if (cmd == EBT_SO_GET_INFO) {
1423                         tmp.nentries = t->private->nentries;
1424                         tmp.entries_size = t->private->entries_size;
1425                         tmp.valid_hooks = t->valid_hooks;
1426                 } else {
1427                         tmp.nentries = t->table->nentries;
1428                         tmp.entries_size = t->table->entries_size;
1429                         tmp.valid_hooks = t->table->valid_hooks;
1430                 }
1431                 mutex_unlock(&ebt_mutex);
1432                 if (copy_to_user(user, &tmp, *len) != 0){
1433                         BUGPRINT("c2u Didn't work\n");
1434                         ret = -EFAULT;
1435                         break;
1436                 }
1437                 ret = 0;
1438                 break;
1439
1440         case EBT_SO_GET_ENTRIES:
1441         case EBT_SO_GET_INIT_ENTRIES:
1442                 ret = copy_everything_to_user(t, user, len, cmd);
1443                 mutex_unlock(&ebt_mutex);
1444                 break;
1445
1446         default:
1447                 mutex_unlock(&ebt_mutex);
1448                 ret = -EINVAL;
1449         }
1450
1451         return ret;
1452 }
1453
1454 static struct nf_sockopt_ops ebt_sockopts =
1455 {
1456         .pf             = PF_INET,
1457         .set_optmin     = EBT_BASE_CTL,
1458         .set_optmax     = EBT_SO_SET_MAX + 1,
1459         .set            = do_ebt_set_ctl,
1460         .get_optmin     = EBT_BASE_CTL,
1461         .get_optmax     = EBT_SO_GET_MAX + 1,
1462         .get            = do_ebt_get_ctl,
1463         .owner          = THIS_MODULE,
1464 };
1465
1466 static int __init ebtables_init(void)
1467 {
1468         int ret;
1469
1470         ret = xt_register_target(&ebt_standard_target);
1471         if (ret < 0)
1472                 return ret;
1473         ret = nf_register_sockopt(&ebt_sockopts);
1474         if (ret < 0) {
1475                 xt_unregister_target(&ebt_standard_target);
1476                 return ret;
1477         }
1478
1479         printk(KERN_INFO "Ebtables v2.0 registered\n");
1480         return 0;
1481 }
1482
1483 static void __exit ebtables_fini(void)
1484 {
1485         nf_unregister_sockopt(&ebt_sockopts);
1486         xt_unregister_target(&ebt_standard_target);
1487         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
1488 }
1489
1490 EXPORT_SYMBOL(ebt_register_table);
1491 EXPORT_SYMBOL(ebt_unregister_table);
1492 EXPORT_SYMBOL(ebt_do_table);
1493 module_init(ebtables_init);
1494 module_exit(ebtables_fini);
1495 MODULE_LICENSE("GPL");