kernel/linux/net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18 /* used for print_string */
  19 #include <linux/sched.h>
  20 #include <linux/tty.h>
  21
  22 #include <linux/kmod.h>
  23 #include <linux/module.h>
  24 #include <linux/vmalloc.h>
  25 #include <linux/netfilter_bridge/ebtables.h>
  26 #include <linux/spinlock.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/smp.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 /* list_named_find */
  34 #define ASSERT_READ_LOCK(x)
  35 #define ASSERT_WRITE_LOCK(x)
  36 #include <linux/netfilter_ipv4/listhelp.h>
  37
  38 #if 0
  39 /* use this for remote debugging
  40  * Copyright (C) 1998 by Ori Pomerantz
  41  * Print the string to the appropriate tty, the one
  42  * the current task uses
  43  */
  44 static void print_string(char *str)
  45 {
  46         struct tty_struct *my_tty;
  47
  48         /* The tty for the current task */
  49         my_tty = current->signal->tty;
  50         if (my_tty != NULL) {
  51                 my_tty->driver->write(my_tty, 0, str, strlen(str));
  52                 my_tty->driver->write(my_tty, 0, "\015\012", 2);
  53         }
  54 }
  55
  56 #define BUGPRINT(args) print_string(args);
  57 #else
  58 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  59                                          "report to author: "format, ## args)
  60 /* #define BUGPRINT(format, args...) */
  61 #endif
  62 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  63                                          ": out of memory: "format, ## args)
  64 /* #define MEMPRINT(format, args...) */
  65
  66
  67
  68 /*
  69  * Each cpu has its own set of counters, so there is no need for write_lock in
  70  * the softirq
  71  * For reading or updating the counters, the user context needs to
  72  * get a write_lock
  73  */
  74
  75 /* The size of each set of counters is altered to get cache alignment */
  76 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  77 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  78 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  79    COUNTER_OFFSET(n) * cpu))
  80
  81
  82
  83 static DECLARE_MUTEX(ebt_mutex);
  84 static LIST_HEAD(ebt_tables);
  85 static LIST_HEAD(ebt_targets);
  86 static LIST_HEAD(ebt_matches);
  87 static LIST_HEAD(ebt_watchers);
  88
  89 static struct ebt_target ebt_standard_target =
  90 { {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
  91
  92 static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
  93    const struct sk_buff *skb, const struct net_device *in,
  94    const struct net_device *out)
  95 {
  96         w->u.watcher->watcher(skb, in, out, w->data,
  97            w->watcher_size);
  98         /* watchers don't give a verdict */
  99         return 0;
 100 }
 101
 102 static inline int ebt_do_match (struct ebt_entry_match *m,
 103    const struct sk_buff *skb, const struct net_device *in,
 104    const struct net_device *out)
 105 {
 106         return m->u.match->match(skb, in, out, m->data,
 107            m->match_size);
 108 }
 109
 110 static inline int ebt_dev_check(char *entry, const struct net_device *device)
 111 {
 112         if (*entry == '\0')
 113                 return 0;
 114         if (!device)
 115                 return 1;
 116         return !!strcmp(entry, device->name);
 117 }
 118
 119 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 120 /* process standard matches */
 121 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 122    const struct net_device *in, const struct net_device *out)
 123 {
 124         int verdict, i;
 125
 126         if (e->bitmask & EBT_802_3) {
 127                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 128                         return 1;
 129         } else if (!(e->bitmask & EBT_NOPROTO) &&
 130            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 131         {
 132                 if(h->h_proto!=ETH_P_PPP_SES)
 133                         return 1;
 134         }
 135         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 136                 return 1;
 137         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 138                 return 1;
 139         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 140            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 141                 return 1;
 142         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 143            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 144                 return 1;
 145
 146         if (e->bitmask & EBT_SOURCEMAC) {
 147                 verdict = 0;
 148                 for (i = 0; i < 6; i++)
 149                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 150                            e->sourcemsk[i];
 151                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 152                         return 1;
 153         }
 154         if (e->bitmask & EBT_DESTMAC) {
 155                 verdict = 0;
 156                 for (i = 0; i < 6; i++)
 157                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 158                            e->destmsk[i];
 159                 if (FWINV2(verdict != 0, EBT_IDEST) )
 160                         return 1;
 161         }
 162         return 0;
 163 }
 164
 165 /* Do some firewalling */
 166 unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
 167    const struct net_device *in, const struct net_device *out,
 168    struct ebt_table *table)
 169 {
 170         int i, nentries;
 171         struct ebt_entry *point;
 172         struct ebt_counter *counter_base, *cb_base;
 173         struct ebt_entry_target *t;
 174         int verdict, sp = 0;
 175         struct ebt_chainstack *cs;
 176         struct ebt_entries *chaininfo;
 177         char *base;
 178         struct ebt_table_info *private = table->private;
 179
 180         read_lock_bh(&table->lock);
 181         cb_base = COUNTER_BASE(private->counters, private->nentries,
 182            smp_processor_id());
 183         if (private->chainstack)
 184                 cs = private->chainstack[smp_processor_id()];
 185         else
 186                 cs = NULL;
 187         chaininfo = private->hook_entry[hook];
 188         nentries = private->hook_entry[hook]->nentries;
 189         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 190         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 191         /* base for chain jumps */
 192         base = private->entries;
 193         i = 0;
 194         while (i < nentries) {
 195                 if (ebt_basic_match(point, (**pskb).mac.ethernet, in, out))
 196                         goto letscontinue;
 197
 198                 if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
 199                         goto letscontinue;
 200
 201                 /* increase counter */
 202                 (*(counter_base + i)).pcnt++;
 203                 (*(counter_base + i)).bcnt+=(**pskb).len;
 204
 205                 /* these should only watch: not modify, nor tell us
 206                    what to do with the packet */
 207                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, in,
 208                    out);
 209
 210                 t = (struct ebt_entry_target *)
 211                    (((char *)point) + point->target_offset);
 212                 /* standard target */
 213                 if (!t->u.target->target)
 214                         verdict = ((struct ebt_standard_target *)t)->verdict;
 215                 else
 216                         verdict = t->u.target->target(pskb, hook,
 217                            in, out, t->data, t->target_size);
 218                 if (verdict == EBT_ACCEPT) {
 219                         read_unlock_bh(&table->lock);
 220                         return NF_ACCEPT;
 221                 }
 222                 if (verdict == EBT_DROP) {
 223                         read_unlock_bh(&table->lock);
 224                         return NF_DROP;
 225                 }
 226                 if (verdict == EBT_RETURN) {
 227 letsreturn:
 228 #ifdef CONFIG_NETFILTER_DEBUG
 229                         if (sp == 0) {
 230                                 BUGPRINT("RETURN on base chain");
 231                                 /* act like this is EBT_CONTINUE */
 232                                 goto letscontinue;
 233                         }
 234 #endif
 235                         sp--;
 236                         /* put all the local variables right */
 237                         i = cs[sp].n;
 238                         chaininfo = cs[sp].chaininfo;
 239                         nentries = chaininfo->nentries;
 240                         point = cs[sp].e;
 241                         counter_base = cb_base +
 242                            chaininfo->counter_offset;
 243                         continue;
 244                 }
 245                 if (verdict == EBT_CONTINUE)
 246                         goto letscontinue;
 247 #ifdef CONFIG_NETFILTER_DEBUG
 248                 if (verdict < 0) {
 249                         BUGPRINT("bogus standard verdict\n");
 250                         read_unlock_bh(&table->lock);
 251                         return NF_DROP;
 252                 }
 253 #endif
 254                 /* jump to a udc */
 255                 cs[sp].n = i + 1;
 256                 cs[sp].chaininfo = chaininfo;
 257                 cs[sp].e = (struct ebt_entry *)
 258                    (((char *)point) + point->next_offset);
 259                 i = 0;
 260                 chaininfo = (struct ebt_entries *) (base + verdict);
 261 #ifdef CONFIG_NETFILTER_DEBUG
 262                 if (chaininfo->distinguisher) {
 263                         BUGPRINT("jump to non-chain\n");
 264                         read_unlock_bh(&table->lock);
 265                         return NF_DROP;
 266                 }
 267 #endif
 268                 nentries = chaininfo->nentries;
 269                 point = (struct ebt_entry *)chaininfo->data;
 270                 counter_base = cb_base + chaininfo->counter_offset;
 271                 sp++;
 272                 continue;
 273 letscontinue:
 274                 point = (struct ebt_entry *)
 275                    (((char *)point) + point->next_offset);
 276                 i++;
 277         }
 278
 279         /* I actually like this :) */
 280         if (chaininfo->policy == EBT_RETURN)
 281                 goto letsreturn;
 282         if (chaininfo->policy == EBT_ACCEPT) {
 283                 read_unlock_bh(&table->lock);
 284                 return NF_ACCEPT;
 285         }
 286         read_unlock_bh(&table->lock);
 287         return NF_DROP;
 288 }
 289
 290 /* If it succeeds, returns element and locks mutex */
 291 static inline void *
 292 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 293    struct semaphore *mutex)
 294 {
 295         void *ret;
 296
 297         *error = down_interruptible(mutex);
 298         if (*error != 0)
 299                 return NULL;
 300
 301         ret = list_named_find(head, name);
 302         if (!ret) {
 303                 *error = -ENOENT;
 304                 up(mutex);
 305         }
 306         return ret;
 307 }
 308
 309 #ifndef CONFIG_KMOD
 310 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
 311 #else
 312 static void *
 313 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 314    int *error, struct semaphore *mutex)
 315 {
 316         void *ret;
 317
 318         ret = find_inlist_lock_noload(head, name, error, mutex);
 319         if (!ret) {
 320                 request_module("%s%s", prefix, name);
 321                 ret = find_inlist_lock_noload(head, name, error, mutex);
 322         }
 323         return ret;
 324 }
 325 #endif
 326
 327 static inline struct ebt_table *
 328 find_table_lock(const char *name, int *error, struct semaphore *mutex)
 329 {
 330         return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
 331 }
 332
 333 static inline struct ebt_match *
 334 find_match_lock(const char *name, int *error, struct semaphore *mutex)
 335 {
 336         return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
 337 }
 338
 339 static inline struct ebt_watcher *
 340 find_watcher_lock(const char *name, int *error, struct semaphore *mutex)
 341 {
 342         return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
 343 }
 344
 345 static inline struct ebt_target *
 346 find_target_lock(const char *name, int *error, struct semaphore *mutex)
 347 {
 348         return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
 349 }
 350
 351 static inline int
 352 ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
 353    const char *name, unsigned int hookmask, unsigned int *cnt)
 354 {
 355         struct ebt_match *match;
 356         int ret;
 357
 358         if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
 359            ((char *)e) + e->watchers_offset)
 360                 return -EINVAL;
 361         match = find_match_lock(m->u.name, &ret, &ebt_mutex);
 362         if (!match)
 363                 return ret;
 364         m->u.match = match;
 365         if (!try_module_get(match->me)) {
 366                 up(&ebt_mutex);
 367                 return -ENOENT;
 368         }
 369         up(&ebt_mutex);
 370         if (match->check &&
 371            match->check(name, hookmask, e, m->data, m->match_size) != 0) {
 372                 BUGPRINT("match->check failed\n");
 373                 module_put(match->me);
 374                 return -EINVAL;
 375         }
 376         (*cnt)++;
 377         return 0;
 378 }
 379
 380 static inline int
 381 ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
 382    const char *name, unsigned int hookmask, unsigned int *cnt)
 383 {
 384         struct ebt_watcher *watcher;
 385         int ret;
 386
 387         if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
 388            ((char *)e) + e->target_offset)
 389                 return -EINVAL;
 390         watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
 391         if (!watcher)
 392                 return ret;
 393         w->u.watcher = watcher;
 394         if (!try_module_get(watcher->me)) {
 395                 up(&ebt_mutex);
 396                 return -ENOENT;
 397         }
 398         up(&ebt_mutex);
 399         if (watcher->check &&
 400            watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
 401                 BUGPRINT("watcher->check failed\n");
 402                 module_put(watcher->me);
 403                 return -EINVAL;
 404         }
 405         (*cnt)++;
 406         return 0;
 407 }
 408
 409 /*
 410  * this one is very careful, as it is the first function
 411  * to parse the userspace data
 412  */
 413 static inline int
 414 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
 415    struct ebt_table_info *newinfo, char *base, char *limit,
 416    struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
 417    unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
 418 {
 419         int i;
 420
 421         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 422                 if ((valid_hooks & (1 << i)) == 0)
 423                         continue;
 424                 if ( (char *)hook_entries[i] - base ==
 425                    (char *)e - newinfo->entries)
 426                         break;
 427         }
 428         /* beginning of a new chain
 429            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 430         if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 431                 if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
 432                         /* we make userspace set this right,
 433                            so there is no misunderstanding */
 434                         BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 435                                  "in distinguisher\n");
 436                         return -EINVAL;
 437                 }
 438                 /* this checks if the previous chain has as many entries
 439                    as it said it has */
 440                 if (*n != *cnt) {
 441                         BUGPRINT("nentries does not equal the nr of entries "
 442                                  "in the chain\n");
 443                         return -EINVAL;
 444                 }
 445                 /* before we look at the struct, be sure it is not too big */
 446                 if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
 447                    > limit) {
 448                         BUGPRINT("entries_size too small\n");
 449                         return -EINVAL;
 450                 }
 451                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 452                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 453                         /* only RETURN from udc */
 454                         if (i != NF_BR_NUMHOOKS ||
 455                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 456                                 BUGPRINT("bad policy\n");
 457                                 return -EINVAL;
 458                         }
 459                 }
 460                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 461                         (*udc_cnt)++;
 462                 else
 463                         newinfo->hook_entry[i] = (struct ebt_entries *)e;
 464                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 465                         BUGPRINT("counter_offset != totalcnt");
 466                         return -EINVAL;
 467                 }
 468                 *n = ((struct ebt_entries *)e)->nentries;
 469                 *cnt = 0;
 470                 return 0;
 471         }
 472         /* a plain old entry, heh */
 473         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 474            e->watchers_offset > e->target_offset ||
 475            e->target_offset >= e->next_offset) {
 476                 BUGPRINT("entry offsets not in right order\n");
 477                 return -EINVAL;
 478         }
 479         /* this is not checked anywhere else */
 480         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 481                 BUGPRINT("target size too small\n");
 482                 return -EINVAL;
 483         }
 484
 485         (*cnt)++;
 486         (*totalcnt)++;
 487         return 0;
 488 }
 489
 490 struct ebt_cl_stack
 491 {
 492         struct ebt_chainstack cs;
 493         int from;
 494         unsigned int hookmask;
 495 };
 496
 497 /*
 498  * we need these positions to check that the jumps to a different part of the
 499  * entries is a jump to the beginning of a new chain.
 500  */
 501 static inline int
 502 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 503    struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
 504    struct ebt_cl_stack *udc)
 505 {
 506         int i;
 507
 508         /* we're only interested in chain starts */
 509         if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
 510                 return 0;
 511         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 512                 if ((valid_hooks & (1 << i)) == 0)
 513                         continue;
 514                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 515                         break;
 516         }
 517         /* only care about udc */
 518         if (i != NF_BR_NUMHOOKS)
 519                 return 0;
 520
 521         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 522         /* these initialisations are depended on later in check_chainloops() */
 523         udc[*n].cs.n = 0;
 524         udc[*n].hookmask = 0;
 525
 526         (*n)++;
 527         return 0;
 528 }
 529
 530 static inline int
 531 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 532 {
 533         if (i && (*i)-- == 0)
 534                 return 1;
 535         if (m->u.match->destroy)
 536                 m->u.match->destroy(m->data, m->match_size);
 537         module_put(m->u.match->me);
 538
 539         return 0;
 540 }
 541
 542 static inline int
 543 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 544 {
 545         if (i && (*i)-- == 0)
 546                 return 1;
 547         if (w->u.watcher->destroy)
 548                 w->u.watcher->destroy(w->data, w->watcher_size);
 549         module_put(w->u.watcher->me);
 550
 551         return 0;
 552 }
 553
 554 static inline int
 555 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 556 {
 557         struct ebt_entry_target *t;
 558
 559         if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
 560                 return 0;
 561         /* we're done */
 562         if (cnt && (*cnt)-- == 0)
 563                 return 1;
 564         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
 565         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
 566         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 567         if (t->u.target->destroy)
 568                 t->u.target->destroy(t->data, t->target_size);
 569         module_put(t->u.target->me);
 570
 571         return 0;
 572 }
 573
 574 static inline int
 575 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
 576    const char *name, unsigned int *cnt, unsigned int valid_hooks,
 577    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 578 {
 579         struct ebt_entry_target *t;
 580         struct ebt_target *target;
 581         unsigned int i, j, hook = 0, hookmask = 0;
 582         int ret;
 583
 584         /* don't mess with the struct ebt_entries */
 585         if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
 586                 return 0;
 587
 588         if (e->bitmask & ~EBT_F_MASK) {
 589                 BUGPRINT("Unknown flag for bitmask\n");
 590                 return -EINVAL;
 591         }
 592         if (e->invflags & ~EBT_INV_MASK) {
 593                 BUGPRINT("Unknown flag for inv bitmask\n");
 594                 return -EINVAL;
 595         }
 596         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 597                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 598                 return -EINVAL;
 599         }
 600         /* what hook do we belong to? */
 601         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 602                 if ((valid_hooks & (1 << i)) == 0)
 603                         continue;
 604                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 605                         hook = i;
 606                 else
 607                         break;
 608         }
 609         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 610            a base chain */
 611         if (i < NF_BR_NUMHOOKS)
 612                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 613         else {
 614                 for (i = 0; i < udc_cnt; i++)
 615                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 616                                 break;
 617                 if (i == 0)
 618                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 619                 else
 620                         hookmask = cl_s[i - 1].hookmask;
 621         }
 622         i = 0;
 623         ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
 624         if (ret != 0)
 625                 goto cleanup_matches;
 626         j = 0;
 627         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
 628         if (ret != 0)
 629                 goto cleanup_watchers;
 630         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 631         target = find_target_lock(t->u.name, &ret, &ebt_mutex);
 632         if (!target)
 633                 goto cleanup_watchers;
 634         if (!try_module_get(target->me)) {
 635                 up(&ebt_mutex);
 636                 ret = -ENOENT;
 637                 goto cleanup_watchers;
 638         }
 639         up(&ebt_mutex);
 640
 641         t->u.target = target;
 642         if (t->u.target == &ebt_standard_target) {
 643                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 644                    e->next_offset) {
 645                         BUGPRINT("Standard target size too big\n");
 646                         ret = -EFAULT;
 647                         goto cleanup_watchers;
 648                 }
 649                 if (((struct ebt_standard_target *)t)->verdict <
 650                    -NUM_STANDARD_TARGETS) {
 651                         BUGPRINT("Invalid standard target\n");
 652                         ret = -EFAULT;
 653                         goto cleanup_watchers;
 654                 }
 655         } else if ((e->target_offset + t->target_size +
 656            sizeof(struct ebt_entry_target) > e->next_offset) ||
 657            (t->u.target->check &&
 658            t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
 659                 module_put(t->u.target->me);
 660                 ret = -EFAULT;
 661                 goto cleanup_watchers;
 662         }
 663         (*cnt)++;
 664         return 0;
 665 cleanup_watchers:
 666         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
 667 cleanup_matches:
 668         EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
 669         return ret;
 670 }
 671
 672 /*
 673  * checks for loops and sets the hook mask for udc
 674  * the hook mask for udc tells us from which base chains the udc can be
 675  * accessed. This mask is a parameter to the check() functions of the extensions
 676  */
 677 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 678    unsigned int udc_cnt, unsigned int hooknr, char *base)
 679 {
 680         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 681         struct ebt_entry *e = (struct ebt_entry *)chain->data;
 682         struct ebt_entry_target *t;
 683
 684         while (pos < nentries || chain_nr != -1) {
 685                 /* end of udc, go back one 'recursion' step */
 686                 if (pos == nentries) {
 687                         /* put back values of the time when this chain was called */
 688                         e = cl_s[chain_nr].cs.e;
 689                         if (cl_s[chain_nr].from != -1)
 690                                 nentries =
 691                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 692                         else
 693                                 nentries = chain->nentries;
 694                         pos = cl_s[chain_nr].cs.n;
 695                         /* make sure we won't see a loop that isn't one */
 696                         cl_s[chain_nr].cs.n = 0;
 697                         chain_nr = cl_s[chain_nr].from;
 698                         if (pos == nentries)
 699                                 continue;
 700                 }
 701                 t = (struct ebt_entry_target *)
 702                    (((char *)e) + e->target_offset);
 703                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 704                         goto letscontinue;
 705                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 706                    e->next_offset) {
 707                         BUGPRINT("Standard target size too big\n");
 708                         return -1;
 709                 }
 710                 verdict = ((struct ebt_standard_target *)t)->verdict;
 711                 if (verdict >= 0) { /* jump to another chain */
 712                         struct ebt_entries *hlp2 =
 713                            (struct ebt_entries *)(base + verdict);
 714                         for (i = 0; i < udc_cnt; i++)
 715                                 if (hlp2 == cl_s[i].cs.chaininfo)
 716                                         break;
 717                         /* bad destination or loop */
 718                         if (i == udc_cnt) {
 719                                 BUGPRINT("bad destination\n");
 720                                 return -1;
 721                         }
 722                         if (cl_s[i].cs.n) {
 723                                 BUGPRINT("loop\n");
 724                                 return -1;
 725                         }
 726                         /* this can't be 0, so the above test is correct */
 727                         cl_s[i].cs.n = pos + 1;
 728                         pos = 0;
 729                         cl_s[i].cs.e = ((void *)e + e->next_offset);
 730                         e = (struct ebt_entry *)(hlp2->data);
 731                         nentries = hlp2->nentries;
 732                         cl_s[i].from = chain_nr;
 733                         chain_nr = i;
 734                         /* this udc is accessible from the base chain for hooknr */
 735                         cl_s[i].hookmask |= (1 << hooknr);
 736                         continue;
 737                 }
 738 letscontinue:
 739                 e = (void *)e + e->next_offset;
 740                 pos++;
 741         }
 742         return 0;
 743 }
 744
 745 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 746 static int translate_table(struct ebt_replace *repl,
 747    struct ebt_table_info *newinfo)
 748 {
 749         unsigned int i, j, k, udc_cnt;
 750         int ret;
 751         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 752
 753         i = 0;
 754         while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
 755                 i++;
 756         if (i == NF_BR_NUMHOOKS) {
 757                 BUGPRINT("No valid hooks specified\n");
 758                 return -EINVAL;
 759         }
 760         if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
 761                 BUGPRINT("Chains don't start at beginning\n");
 762                 return -EINVAL;
 763         }
 764         /* make sure chains are ordered after each other in same order
 765            as their corresponding hooks */
 766         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 767                 if (!(repl->valid_hooks & (1 << j)))
 768                         continue;
 769                 if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
 770                         BUGPRINT("Hook order must be followed\n");
 771                         return -EINVAL;
 772                 }
 773                 i = j;
 774         }
 775
 776         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 777                 newinfo->hook_entry[i] = NULL;
 778
 779         newinfo->entries_size = repl->entries_size;
 780         newinfo->nentries = repl->nentries;
 781
 782         /* do some early checkings and initialize some things */
 783         i = 0; /* holds the expected nr. of entries for the chain */
 784         j = 0; /* holds the up to now counted entries for the chain */
 785         k = 0; /* holds the total nr. of entries, should equal
 786                   newinfo->nentries afterwards */
 787         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 788         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 789            ebt_check_entry_size_and_hooks, newinfo, repl->entries,
 790            repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
 791            &udc_cnt, repl->valid_hooks);
 792
 793         if (ret != 0)
 794                 return ret;
 795
 796         if (i != j) {
 797                 BUGPRINT("nentries does not equal the nr of entries in the "
 798                          "(last) chain\n");
 799                 return -EINVAL;
 800         }
 801         if (k != newinfo->nentries) {
 802                 BUGPRINT("Total nentries is wrong\n");
 803                 return -EINVAL;
 804         }
 805
 806         /* check if all valid hooks have a chain */
 807         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 808                 if (newinfo->hook_entry[i] == NULL &&
 809                    (repl->valid_hooks & (1 << i))) {
 810                         BUGPRINT("Valid hook without chain\n");
 811                         return -EINVAL;
 812                 }
 813         }
 814
 815         /* get the location of the udc, put them in an array
 816            while we're at it, allocate the chainstack */
 817         if (udc_cnt) {
 818                 /* this will get free'd in do_replace()/ebt_register_table()
 819                    if an error occurs */
 820                 newinfo->chainstack = (struct ebt_chainstack **)
 821                    vmalloc(NR_CPUS * sizeof(struct ebt_chainstack));
 822                 if (!newinfo->chainstack)
 823                         return -ENOMEM;
 824                 for (i = 0; i < NR_CPUS; i++) {
 825                         newinfo->chainstack[i] =
 826                            vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
 827                         if (!newinfo->chainstack[i]) {
 828                                 while (i)
 829                                         vfree(newinfo->chainstack[--i]);
 830                                 vfree(newinfo->chainstack);
 831                                 newinfo->chainstack = NULL;
 832                                 return -ENOMEM;
 833                         }
 834                 }
 835
 836                 cl_s = (struct ebt_cl_stack *)
 837                    vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
 838                 if (!cl_s)
 839                         return -ENOMEM;
 840                 i = 0; /* the i'th udc */
 841                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 842                    ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
 843                    repl->valid_hooks, cl_s);
 844                 /* sanity check */
 845                 if (i != udc_cnt) {
 846                         BUGPRINT("i != udc_cnt\n");
 847                         vfree(cl_s);
 848                         return -EFAULT;
 849                 }
 850         }
 851
 852         /* Check for loops */
 853         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 854                 if (repl->valid_hooks & (1 << i))
 855                         if (check_chainloops(newinfo->hook_entry[i],
 856                            cl_s, udc_cnt, i, newinfo->entries)) {
 857                                 if (cl_s)
 858                                         vfree(cl_s);
 859                                 return -EINVAL;
 860                         }
 861
 862         /* we now know the following (along with E=mc²):
 863            - the nr of entries in each chain is right
 864            - the size of the allocated space is right
 865            - all valid hooks have a corresponding chain
 866            - there are no loops
 867            - wrong data can still be on the level of a single entry
 868            - could be there are jumps to places that are not the
 869              beginning of a chain. This can only occur in chains that
 870              are not accessible from any base chains, so we don't care. */
 871
 872         /* used to know what we need to clean up if something goes wrong */
 873         i = 0;
 874         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 875            ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
 876            cl_s, udc_cnt);
 877         if (ret != 0) {
 878                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 879                    ebt_cleanup_entry, &i);
 880         }
 881         if (cl_s)
 882                 vfree(cl_s);
 883         return ret;
 884 }
 885
 886 /* called under write_lock */
 887 static void get_counters(struct ebt_counter *oldcounters,
 888    struct ebt_counter *counters, unsigned int nentries)
 889 {
 890         int i, cpu;
 891         struct ebt_counter *counter_base;
 892
 893         /* counters of cpu 0 */
 894         memcpy(counters, oldcounters,
 895            sizeof(struct ebt_counter) * nentries);
 896         /* add other counters to those of cpu 0 */
 897         for (cpu = 1; cpu < NR_CPUS; cpu++) {
 898                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 899                 for (i = 0; i < nentries; i++) {
 900                         counters[i].pcnt += counter_base[i].pcnt;
 901                         counters[i].bcnt += counter_base[i].bcnt;
 902                 }
 903         }
 904 }
 905
 906 /* replace the table */
 907 static int do_replace(void __user *user, unsigned int len)
 908 {
 909         int ret, i, countersize;
 910         struct ebt_table_info *newinfo;
 911         struct ebt_replace tmp;
 912         struct ebt_table *t;
 913         struct ebt_counter *counterstmp = NULL;
 914         /* used to be able to unlock earlier */
 915         struct ebt_table_info *table;
 916
 917         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 918                 return -EFAULT;
 919
 920         if (len != sizeof(tmp) + tmp.entries_size) {
 921                 BUGPRINT("Wrong len argument\n");
 922                 return -EINVAL;
 923         }
 924
 925         if (tmp.entries_size == 0) {
 926                 BUGPRINT("Entries_size never zero\n");
 927                 return -EINVAL;
 928         }
 929         countersize = COUNTER_OFFSET(tmp.nentries) * NR_CPUS;
 930         newinfo = (struct ebt_table_info *)
 931            vmalloc(sizeof(struct ebt_table_info) + countersize);
 932         if (!newinfo)
 933                 return -ENOMEM;
 934
 935         if (countersize)
 936                 memset(newinfo->counters, 0, countersize);
 937
 938         newinfo->entries = (char *)vmalloc(tmp.entries_size);
 939         if (!newinfo->entries) {
 940                 ret = -ENOMEM;
 941                 goto free_newinfo;
 942         }
 943         if (copy_from_user(
 944            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
 945                 BUGPRINT("Couldn't copy entries from userspace\n");
 946                 ret = -EFAULT;
 947                 goto free_entries;
 948         }
 949
 950         /* the user wants counters back
 951            the check on the size is done later, when we have the lock */
 952         if (tmp.num_counters) {
 953                 counterstmp = (struct ebt_counter *)
 954                    vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
 955                 if (!counterstmp) {
 956                         ret = -ENOMEM;
 957                         goto free_entries;
 958                 }
 959         }
 960         else
 961                 counterstmp = NULL;
 962
 963         /* this can get initialized by translate_table() */
 964         newinfo->chainstack = NULL;
 965         ret = translate_table(&tmp, newinfo);
 966
 967         if (ret != 0)
 968                 goto free_counterstmp;
 969
 970         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
 971         if (!t) {
 972                 ret = -ENOENT;
 973                 goto free_iterate;
 974         }
 975
 976         /* the table doesn't like it */
 977         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
 978                 goto free_unlock;
 979
 980         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
 981                 BUGPRINT("Wrong nr. of counters requested\n");
 982                 ret = -EINVAL;
 983                 goto free_unlock;
 984         }
 985
 986         /* we have the mutex lock, so no danger in reading this pointer */
 987         table = t->private;
 988         /* make sure the table can only be rmmod'ed if it contains no rules */
 989         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
 990                 ret = -ENOENT;
 991                 goto free_unlock;
 992         } else if (table->nentries && !newinfo->nentries)
 993                 module_put(t->me);
 994         /* we need an atomic snapshot of the counters */
 995         write_lock_bh(&t->lock);
 996         if (tmp.num_counters)
 997                 get_counters(t->private->counters, counterstmp,
 998                    t->private->nentries);
 999
1000         t->private = newinfo;
1001         write_unlock_bh(&t->lock);
1002         up(&ebt_mutex);
1003         /* so, a user can change the chains while having messed up her counter
1004            allocation. Only reason why this is done is because this way the lock
1005            is held only once, while this doesn't bring the kernel into a
1006            dangerous state. */
1007         if (tmp.num_counters &&
1008            copy_to_user(tmp.counters, counterstmp,
1009            tmp.num_counters * sizeof(struct ebt_counter))) {
1010                 BUGPRINT("Couldn't copy counters to userspace\n");
1011                 ret = -EFAULT;
1012         }
1013         else
1014                 ret = 0;
1015
1016         /* decrease module count and free resources */
1017         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1018            ebt_cleanup_entry, NULL);
1019
1020         vfree(table->entries);
1021         if (table->chainstack) {
1022                 for (i = 0; i < NR_CPUS; i++)
1023                         vfree(table->chainstack[i]);
1024                 vfree(table->chainstack);
1025         }
1026         vfree(table);
1027
1028         if (counterstmp)
1029                 vfree(counterstmp);
1030         return ret;
1031
1032 free_unlock:
1033         up(&ebt_mutex);
1034 free_iterate:
1035         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1036            ebt_cleanup_entry, NULL);
1037 free_counterstmp:
1038         if (counterstmp)
1039                 vfree(counterstmp);
1040         /* can be initialized in translate_table() */
1041         if (newinfo->chainstack) {
1042                 for (i = 0; i < NR_CPUS; i++)
1043                         vfree(newinfo->chainstack[i]);
1044                 vfree(newinfo->chainstack);
1045         }
1046 free_entries:
1047         if (newinfo->entries)
1048                 vfree(newinfo->entries);
1049 free_newinfo:
1050         if (newinfo)
1051                 vfree(newinfo);
1052         return ret;
1053 }
1054
1055 int ebt_register_target(struct ebt_target *target)
1056 {
1057         int ret;
1058
1059         ret = down_interruptible(&ebt_mutex);
1060         if (ret != 0)
1061                 return ret;
1062         if (!list_named_insert(&ebt_targets, target)) {
1063                 up(&ebt_mutex);
1064                 return -EEXIST;
1065         }
1066         up(&ebt_mutex);
1067
1068         return 0;
1069 }
1070
1071 void ebt_unregister_target(struct ebt_target *target)
1072 {
1073         down(&ebt_mutex);
1074         LIST_DELETE(&ebt_targets, target);
1075         up(&ebt_mutex);
1076 }
1077
1078 int ebt_register_match(struct ebt_match *match)
1079 {
1080         int ret;
1081
1082         ret = down_interruptible(&ebt_mutex);
1083         if (ret != 0)
1084                 return ret;
1085         if (!list_named_insert(&ebt_matches, match)) {
1086                 up(&ebt_mutex);
1087                 return -EEXIST;
1088         }
1089         up(&ebt_mutex);
1090
1091         return 0;
1092 }
1093
1094 void ebt_unregister_match(struct ebt_match *match)
1095 {
1096         down(&ebt_mutex);
1097         LIST_DELETE(&ebt_matches, match);
1098         up(&ebt_mutex);
1099 }
1100
1101 int ebt_register_watcher(struct ebt_watcher *watcher)
1102 {
1103         int ret;
1104
1105         ret = down_interruptible(&ebt_mutex);
1106         if (ret != 0)
1107                 return ret;
1108         if (!list_named_insert(&ebt_watchers, watcher)) {
1109                 up(&ebt_mutex);
1110                 return -EEXIST;
1111         }
1112         up(&ebt_mutex);
1113
1114         return 0;
1115 }
1116
1117 void ebt_unregister_watcher(struct ebt_watcher *watcher)
1118 {
1119         down(&ebt_mutex);
1120         LIST_DELETE(&ebt_watchers, watcher);
1121         up(&ebt_mutex);
1122 }
1123
1124 int ebt_register_table(struct ebt_table *table)
1125 {
1126         struct ebt_table_info *newinfo;
1127         int ret, i, countersize;
1128
1129         if (!table || !table->table ||!table->table->entries ||
1130             table->table->entries_size == 0 ||
1131             table->table->counters || table->private) {
1132                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1133                 return -EINVAL;
1134         }
1135
1136         countersize = COUNTER_OFFSET(table->table->nentries) * NR_CPUS;
1137         newinfo = (struct ebt_table_info *)
1138            vmalloc(sizeof(struct ebt_table_info) + countersize);
1139         ret = -ENOMEM;
1140         if (!newinfo)
1141                 return -ENOMEM;
1142
1143         newinfo->entries = (char *)vmalloc(table->table->entries_size);
1144         if (!(newinfo->entries))
1145                 goto free_newinfo;
1146
1147         memcpy(newinfo->entries, table->table->entries,
1148            table->table->entries_size);
1149
1150         if (countersize)
1151                 memset(newinfo->counters, 0, countersize);
1152
1153         /* fill in newinfo and parse the entries */
1154         newinfo->chainstack = NULL;
1155         ret = translate_table(table->table, newinfo);
1156         if (ret != 0) {
1157                 BUGPRINT("Translate_table failed\n");
1158                 goto free_chainstack;
1159         }
1160
1161         if (table->check && table->check(newinfo, table->valid_hooks)) {
1162                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1163                 return -EINVAL;
1164         }
1165
1166         table->private = newinfo;
1167         table->lock = RW_LOCK_UNLOCKED;
1168         ret = down_interruptible(&ebt_mutex);
1169         if (ret != 0)
1170                 goto free_chainstack;
1171
1172         if (list_named_find(&ebt_tables, table->name)) {
1173                 ret = -EEXIST;
1174                 BUGPRINT("Table name already exists\n");
1175                 goto free_unlock;
1176         }
1177
1178         /* Hold a reference count if the chains aren't empty */
1179         if (newinfo->nentries && !try_module_get(table->me)) {
1180                 ret = -ENOENT;
1181                 goto free_unlock;
1182         }
1183         list_prepend(&ebt_tables, table);
1184         up(&ebt_mutex);
1185         return 0;
1186 free_unlock:
1187         up(&ebt_mutex);
1188 free_chainstack:
1189         if (newinfo->chainstack) {
1190                 for (i = 0; i < NR_CPUS; i++)
1191                         vfree(newinfo->chainstack[i]);
1192                 vfree(newinfo->chainstack);
1193         }
1194         vfree(newinfo->entries);
1195 free_newinfo:
1196         vfree(newinfo);
1197         return ret;
1198 }
1199
1200 void ebt_unregister_table(struct ebt_table *table)
1201 {
1202         int i;
1203
1204         if (!table) {
1205                 BUGPRINT("Request to unregister NULL table!!!\n");
1206                 return;
1207         }
1208         down(&ebt_mutex);
1209         LIST_DELETE(&ebt_tables, table);
1210         up(&ebt_mutex);
1211         if (table->private->entries)
1212                 vfree(table->private->entries);
1213         if (table->private->chainstack) {
1214                 for (i = 0; i < NR_CPUS; i++)
1215                         vfree(table->private->chainstack[i]);
1216                 vfree(table->private->chainstack);
1217         }
1218         vfree(table->private);
1219 }
1220
1221 /* userspace just supplied us with counters */
1222 static int update_counters(void __user *user, unsigned int len)
1223 {
1224         int i, ret;
1225         struct ebt_counter *tmp;
1226         struct ebt_replace hlp;
1227         struct ebt_table *t;
1228
1229         if (copy_from_user(&hlp, user, sizeof(hlp)))
1230                 return -EFAULT;
1231
1232         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1233                 return -EINVAL;
1234         if (hlp.num_counters == 0)
1235                 return -EINVAL;
1236
1237         if ( !(tmp = (struct ebt_counter *)
1238            vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
1239                 MEMPRINT("Update_counters && nomemory\n");
1240                 return -ENOMEM;
1241         }
1242
1243         t = find_table_lock(hlp.name, &ret, &ebt_mutex);
1244         if (!t)
1245                 goto free_tmp;
1246
1247         if (hlp.num_counters != t->private->nentries) {
1248                 BUGPRINT("Wrong nr of counters\n");
1249                 ret = -EINVAL;
1250                 goto unlock_mutex;
1251         }
1252
1253         if ( copy_from_user(tmp, hlp.counters,
1254            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1255                 BUGPRINT("Updata_counters && !cfu\n");
1256                 ret = -EFAULT;
1257                 goto unlock_mutex;
1258         }
1259
1260         /* we want an atomic add of the counters */
1261         write_lock_bh(&t->lock);
1262
1263         /* we add to the counters of the first cpu */
1264         for (i = 0; i < hlp.num_counters; i++) {
1265                 t->private->counters[i].pcnt += tmp[i].pcnt;
1266                 t->private->counters[i].bcnt += tmp[i].bcnt;
1267         }
1268
1269         write_unlock_bh(&t->lock);
1270         ret = 0;
1271 unlock_mutex:
1272         up(&ebt_mutex);
1273 free_tmp:
1274         vfree(tmp);
1275         return ret;
1276 }
1277
1278 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1279    char *base, char *ubase)
1280 {
1281         char *hlp = ubase - base + (char *)m;
1282         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1283                 return -EFAULT;
1284         return 0;
1285 }
1286
1287 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1288    char *base, char *ubase)
1289 {
1290         char *hlp = ubase - base + (char *)w;
1291         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1292                 return -EFAULT;
1293         return 0;
1294 }
1295
1296 static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
1297 {
1298         int ret;
1299         char *hlp;
1300         struct ebt_entry_target *t;
1301
1302         if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
1303                 return 0;
1304
1305         hlp = ubase - base + (char *)e + e->target_offset;
1306         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1307
1308         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1309         if (ret != 0)
1310                 return ret;
1311         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1312         if (ret != 0)
1313                 return ret;
1314         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1315                 return -EFAULT;
1316         return 0;
1317 }
1318
1319 /* called with ebt_mutex down */
1320 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1321    int *len, int cmd)
1322 {
1323         struct ebt_replace tmp;
1324         struct ebt_counter *counterstmp, *oldcounters;
1325         unsigned int entries_size, nentries;
1326         char *entries;
1327
1328         if (cmd == EBT_SO_GET_ENTRIES) {
1329                 entries_size = t->private->entries_size;
1330                 nentries = t->private->nentries;
1331                 entries = t->private->entries;
1332                 oldcounters = t->private->counters;
1333         } else {
1334                 entries_size = t->table->entries_size;
1335                 nentries = t->table->nentries;
1336                 entries = t->table->entries;
1337                 oldcounters = t->table->counters;
1338         }
1339
1340         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1341                 BUGPRINT("Cfu didn't work\n");
1342                 return -EFAULT;
1343         }
1344
1345         if (*len != sizeof(struct ebt_replace) + entries_size +
1346            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1347                 BUGPRINT("Wrong size\n");
1348                 return -EINVAL;
1349         }
1350
1351         if (tmp.nentries != nentries) {
1352                 BUGPRINT("Nentries wrong\n");
1353                 return -EINVAL;
1354         }
1355
1356         if (tmp.entries_size != entries_size) {
1357                 BUGPRINT("Wrong size\n");
1358                 return -EINVAL;
1359         }
1360
1361         /* userspace might not need the counters */
1362         if (tmp.num_counters) {
1363                 if (tmp.num_counters != nentries) {
1364                         BUGPRINT("Num_counters wrong\n");
1365                         return -EINVAL;
1366                 }
1367                 counterstmp = (struct ebt_counter *)
1368                    vmalloc(nentries * sizeof(struct ebt_counter));
1369                 if (!counterstmp) {
1370                         MEMPRINT("Couldn't copy counters, out of memory\n");
1371                         return -ENOMEM;
1372                 }
1373                 write_lock_bh(&t->lock);
1374                 get_counters(oldcounters, counterstmp, nentries);
1375                 write_unlock_bh(&t->lock);
1376
1377                 if (copy_to_user(tmp.counters, counterstmp,
1378                    nentries * sizeof(struct ebt_counter))) {
1379                         BUGPRINT("Couldn't copy counters to userspace\n");
1380                         vfree(counterstmp);
1381                         return -EFAULT;
1382                 }
1383                 vfree(counterstmp);
1384         }
1385
1386         if (copy_to_user(tmp.entries, entries, entries_size)) {
1387                 BUGPRINT("Couldn't copy entries to userspace\n");
1388                 return -EFAULT;
1389         }
1390         /* set the match/watcher/target names right */
1391         return EBT_ENTRY_ITERATE(entries, entries_size,
1392            ebt_make_names, entries, tmp.entries);
1393 }
1394
1395 static int do_ebt_set_ctl(struct sock *sk,
1396         int cmd, void __user *user, unsigned int len)
1397 {
1398         int ret;
1399
1400         switch(cmd) {
1401         case EBT_SO_SET_ENTRIES:
1402                 ret = do_replace(user, len);
1403                 break;
1404         case EBT_SO_SET_COUNTERS:
1405                 ret = update_counters(user, len);
1406                 break;
1407         default:
1408                 ret = -EINVAL;
1409   }
1410         return ret;
1411 }
1412
1413 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1414 {
1415         int ret;
1416         struct ebt_replace tmp;
1417         struct ebt_table *t;
1418
1419         if (copy_from_user(&tmp, user, sizeof(tmp)))
1420                 return -EFAULT;
1421
1422         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1423         if (!t)
1424                 return ret;
1425
1426         switch(cmd) {
1427         case EBT_SO_GET_INFO:
1428         case EBT_SO_GET_INIT_INFO:
1429                 if (*len != sizeof(struct ebt_replace)){
1430                         ret = -EINVAL;
1431                         up(&ebt_mutex);
1432                         break;
1433                 }
1434                 if (cmd == EBT_SO_GET_INFO) {
1435                         tmp.nentries = t->private->nentries;
1436                         tmp.entries_size = t->private->entries_size;
1437                         tmp.valid_hooks = t->valid_hooks;
1438                 } else {
1439                         tmp.nentries = t->table->nentries;
1440                         tmp.entries_size = t->table->entries_size;
1441                         tmp.valid_hooks = t->table->valid_hooks;
1442                 }
1443                 up(&ebt_mutex);
1444                 if (copy_to_user(user, &tmp, *len) != 0){
1445                         BUGPRINT("c2u Didn't work\n");
1446                         ret = -EFAULT;
1447                         break;
1448                 }
1449                 ret = 0;
1450                 break;
1451
1452         case EBT_SO_GET_ENTRIES:
1453         case EBT_SO_GET_INIT_ENTRIES:
1454                 ret = copy_everything_to_user(t, user, len, cmd);
1455                 up(&ebt_mutex);
1456                 break;
1457
1458         default:
1459                 up(&ebt_mutex);
1460                 ret = -EINVAL;
1461         }
1462
1463         return ret;
1464 }
1465
1466 static struct nf_sockopt_ops ebt_sockopts =
1467 { { NULL, NULL }, PF_INET, EBT_BASE_CTL, EBT_SO_SET_MAX + 1, do_ebt_set_ctl,
1468     EBT_BASE_CTL, EBT_SO_GET_MAX + 1, do_ebt_get_ctl, 0, NULL
1469 };
1470
1471 static int __init init(void)
1472 {
1473         int ret;
1474
1475         down(&ebt_mutex);
1476         list_named_insert(&ebt_targets, &ebt_standard_target);
1477         up(&ebt_mutex);
1478         if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
1479                 return ret;
1480
1481         printk(KERN_NOTICE "Ebtables v2.0 registered\n");
1482         return 0;
1483 }
1484
1485 static void __exit fini(void)
1486 {
1487         nf_unregister_sockopt(&ebt_sockopts);
1488         printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
1489 }
1490
1491 EXPORT_SYMBOL(ebt_register_table);
1492 EXPORT_SYMBOL(ebt_unregister_table);
1493 EXPORT_SYMBOL(ebt_register_match);
1494 EXPORT_SYMBOL(ebt_unregister_match);
1495 EXPORT_SYMBOL(ebt_register_watcher);
1496 EXPORT_SYMBOL(ebt_unregister_watcher);
1497 EXPORT_SYMBOL(ebt_register_target);
1498 EXPORT_SYMBOL(ebt_unregister_target);
1499 EXPORT_SYMBOL(ebt_do_table);
1500 module_init(init);
1501 module_exit(fini);
1502 MODULE_LICENSE("GPL");